Merge pull request 'Say a secret given in plain words, and log words the keeper refuses (hq issue 359)' (#189) from fix/the-secret-given-words-pass-plain into main

The reviewer found that the logged reason quoted the refused fragment: a
hash-shaped secret would reach the journal, and a changing clock time
defeated the once-per-kind dedupe. The reason is now logged without its
quoted fragment, the test resets the dedupe so it repeats, and a module
name too long for the headline falls back to the machine.

cmd/mesh-controller/acting.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"os"
+	"strings"
 	"sync"
 	"time"
 
@@ -179,7 +180,21 @@ func (a *actor) release() {
 // holderOf is this process as the lease's holder.
 func holderOf(instance string) lease.Holder {
 	host, _ := os.Hostname()
-	return lease.Holder{Instance: instance, Host: host, Build: version}
+	build := runningBuild()
+	if build == "" {
+		build = version
+	}
+	return lease.Holder{Instance: instance, Host: host, Build: build}
+}
+
+// RunningBuildVar is where the declaration tells this process which build it is (module.json, the
+// controller process's env): the version its bundle is delivered as, `${version}` composed by the
+// catalogue from the bundle's digest. Empty for a process placed by hand.
+const RunningBuildVar = "MESH_CONTROLLER_VERSION"
+
+// runningBuild is the version of the build this process is, or empty when the declaration did not say.
+func runningBuild() string {
+	return strings.TrimSpace(os.Getenv(RunningBuildVar))
 }
 
 // serveUnderTheLease takes the lease for the serving controller, waiting while another holds it, and

cmd/mesh-controller/agent_account.go

@@ -48,7 +48,8 @@ const agentAccountProbe = "DA"
 //
 // The one judgement: `node show`, the self-check, and ADR 0259's router honouring a verified sender read
 // it here.
-func agentConfined(ctx context.Context, inv *inventory.Inventory, node string) (named, confined bool, why string, err error) {
+// now is the judging clock, threaded so a caller judging several things at one instant judges them all at it.
+func agentConfined(ctx context.Context, inv *inventory.Inventory, node string, now time.Time) (named, confined bool, why string, err error) {
 	n, err := inv.NodeByName(ctx, node)
 	if err != nil {
 		return false, false, "", err
@@ -61,7 +62,7 @@ func agentConfined(ctx context.Context, inv *inventory.Inventory, node string) (
 	if err != nil {
 		return true, false, "", err
 	}
-	confined, why = judgedConfined(n.AgentAccount, h, had, time.Now())
+	confined, why = judgedConfined(n.AgentAccount, h, had, now)
 	return true, confined, why, nil
 }
 
@@ -228,7 +229,7 @@ func agentAccountLines(ctx context.Context, inv *inventory.Inventory, n inventor
 		return []string{fmt.Sprintf("  agents run as      the operator account (%s); no agent account is named",
 			orNoneKnown(n.Account))}
 	}
-	_, confined, why, err := agentConfined(ctx, inv, n.Name)
+	_, confined, why, err := agentConfined(ctx, inv, n.Name, time.Now())
 	if err != nil {
 		return []string{fmt.Sprintf("  agents run as      %s (home %s); whether it can become root could NOT be read: %v",
 			n.AgentAccount, n.AgentHome(), err)}

cmd/mesh-controller/agent_account_test.go

@@ -106,10 +106,10 @@ func TestTheSelfCheckSaysAnAgentAccountThatCanBecomeRoot(t *testing.T) {
 	if found, err = probeAgentAccounts(ctx, d); err != nil || len(onlyMachine(found, "anchor")) != 0 {
 		t.Fatalf("a judged agent account still fails: %+v %v", found, err)
 	}
-	if named, confined, why, err := agentConfined(ctx, inv, "anchor"); err != nil || !named || !confined {
+	if named, confined, why, err := agentConfined(ctx, inv, "anchor", time.Now()); err != nil || !named || !confined {
 		t.Fatalf("agentConfined on anchor: %v %v %q %v", named, confined, why, err)
 	}
-	if named, _, why, err := agentConfined(ctx, inv, "laptop"); err != nil || named ||
+	if named, _, why, err := agentConfined(ctx, inv, "laptop", time.Now()); err != nil || named ||
 		!strings.Contains(why, "operator account") {
 		t.Fatalf("agentConfined on a machine naming none: %v %q %v", named, why, err)
 	}
@@ -246,7 +246,7 @@ func TestASearchStillRunningAfterARestartIsNotUrgent(t *testing.T) {
 	if found := say(link.StateUnknown, running); len(found) != 0 {
 		t.Fatalf("a search first seen now was raised: %+v", found)
 	}
-	if _, confined, why, _ := agentConfined(ctx, inv, "anchor"); confined || !strings.Contains(why, "not judged") {
+	if _, confined, why, _ := agentConfined(ctx, inv, "anchor", time.Now()); confined || !strings.Contains(why, "not judged") {
 		t.Fatalf("an account whose search runs was read as confined: %q", why)
 	}
 	// The engine restarted again and again, each statement's own since fresh: the controller's clock runs on.

cmd/mesh-controller/asker.go

@@ -0,0 +1,831 @@
+package main
+
+// The controller asks, and acts on the operator's warrant (novox/hq ADR 0259 §6). It holds no channel, no
+// identity and no factor: it asks the router like any other module, and performs the answer chosen with its
+// own grant.
+//
+//   - **For every open, unsilenced condition that needs the operator and names its answers**, one ask is
+//     published on the `operator-channel` seat under the controller's own name: the condition's words, its
+//     actions as options at their levels (Silence acknowledges; Release, Stop, Start and Restart approve),
+//     answered by the operator, expiring after a day (a week when every option only acknowledges). A
+//     condition that clears, is silenced, or changes its answers has its ask cancelled; an ask that expired
+//     unanswered is asked again while the condition lasts. Each ask is kept in the controller's bucket
+//     `asked`, so a restart neither asks twice nor forgets.
+//   - **On a warrant**, heard on the seat's event under the controller's own name (which only the router may
+//     say), the controller acts once per ask: only for an ask it holds, only for the option it offered at
+//     that option's level, and only while the condition is still open. It performs the action as itself —
+//     a silence through its own conditions, any other through the verb the action names — with the warrant's
+//     words as its why, and records it in the hand-act log as the operator's decision, naming the channel,
+//     the ask and the proofs. An ask that ended without a choice is recorded and nothing is done.
+//   - **A warrant it missed** while away is read from the router's record of its asks, under its own name.
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"sort"
+	"strings"
+	"sync"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/asks"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// The asker's name on the seat: the controller's module.
+const askerName = broker.ControllerSeat
+
+// How long an ask lasts: a day when an answer approves, a week when every answer only acknowledges.
+const (
+	// askApproveFor is a day less a margin, so an ask is never refused at the router for lasting a day and
+	// a moment (the SDK's bound is a day).
+	askApproveFor     = 24*time.Hour - 10*time.Minute
+	askAcknowledgeFor = 7 * 24 * time.Hour
+	// askEvery is how often what is open is asked about again, beside every change.
+	askEvery = time.Minute
+	// askCatchUpAfter is how old an open ask is before the router's record of it is read: a warrant heard
+	// on the event needs no reading.
+	askCatchUpAfter = 2 * time.Minute
+	// askAgainAfterAnswer is how long a condition the operator answered is not asked about again with the
+	// same answers: what was chosen takes a while to clear it, and asking again at once would ask twice.
+	askAgainAfterAnswer = time.Hour
+	// askMostOpen is how many asks the controller holds open at once (the router refuses a fourth): the
+	// most urgent conditions first, then the oldest.
+	askMostOpen = asks.MostOpen
+)
+
+// What became of an ask, as the controller keeps it.
+const (
+	askOpen      = "open"
+	askCancelled = "cancelled"
+)
+
+// asked is one ask the controller made, as it keeps it.
+type asked struct {
+	ID        string `json:"id"`
+	Condition string `json:"condition"`
+	// Channels is what the channels were when it was asked (asker.channels): an ask the router refused is not
+	// asked again until the condition's answers or the channels change.
+	Channels string              `json:"channels,omitempty"`
+	Ask      asks.Ask            `json:"ask"`
+	Actions  []conditions.Action `json:"actions"`
+	// Options are the actions by option id.
+	Options map[string]int `json:"options"`
+	State   string         `json:"state"`
+	Opened  time.Time      `json:"opened"`
+	Ended   time.Time      `json:"ended,omitempty"`
+	Warrant *asks.Warrant  `json:"warrant,omitempty"`
+	// Acted is what the controller did on the warrant: empty before it did anything, "acting" while it acts,
+	// then "done", "failed: …" or "nothing: …". Anything but empty is never acted on again.
+	Acted string `json:"acted,omitempty"`
+	// Part is which ask of its condition this is (askPart): empty for the one that carries the condition's
+	// answers, or the authorising ones where it has both; "acknowledge" for its acknowledging answers asked
+	// apart (the review of 2026-10-09, M1).
+	Part string `json:"part,omitempty"`
+	// Rehearsal is an ask started at the controller's terminal (rehearse.go): about no condition, its answers
+	// perform nothing, and the reconciling of conditions leaves it alone.
+	Rehearsal bool `json:"rehearsal,omitempty"`
+}
+
+// partKey is an ask's place among what is asked: its condition and its part.
+func partKey(condition, part string) string { return condition + "#" + part }
+
+// partAcknowledge is the part of a condition asked apart for its acknowledging answers.
+const partAcknowledge = "acknowledge"
+
+// askPart is one ask a condition is asked with: its part, what it is about, and its answers.
+type askPart struct {
+	name    string
+	about   string
+	actions []conditions.Action
+}
+
+// levelOf is an action's level as an option offers it: one that says none is never taken for less than
+// approve.
+func levelOf(act conditions.Action) asks.Level {
+	if act.Level == "" {
+		return asks.Approve
+	}
+	return asks.Level(act.Level)
+}
+
+// partsOf is the asks a condition is asked with (the review of 2026-10-09, M1): one, when its answers are all
+// of one kind; else its authorising answers (Release, Stop, Restart) in one ask, about the condition, and its
+// acknowledging ones (Silence) in another. **An acknowledgement never shares an ask with an approval**: a
+// channel that only acknowledges would otherwise answer the ask, and end the approval with it.
+func partsOf(c conditions.Condition) []askPart {
+	var ack, auth []conditions.Action
+	for _, act := range c.Actions {
+		if levelOf(act) == asks.Acknowledge {
+			ack = append(ack, act)
+		} else {
+			auth = append(auth, act)
+		}
+	}
+	if len(ack) == 0 || len(auth) == 0 {
+		return []askPart{{about: c.Key, actions: c.Actions}}
+	}
+	return []askPart{{about: c.Key, actions: auth},
+		{name: partAcknowledge, about: c.Key + "." + partAcknowledge, actions: ack}}
+}
+
+// askedStore keeps the asks (broker.AskedBucket). **Every write after the first is a compare-and-set** (the
+// review of 2026-10-09, L2): an ask is created once, and changed only over the revision it was read at, the
+// change decided again on what is read — so two controllers, or two deliveries of one warrant, never write
+// over each other, and of two that would act only the one whose write stands does.
+type askedStore interface {
+	Get(ctx context.Context, id string) (*asked, error)
+	// Create keeps a new ask, and refuses one already kept under its id.
+	Create(ctx context.Context, a asked) error
+	// Change applies change to the ask kept under id, by compare-and-set, and says whether its write stood.
+	// change says whether to write at all; on a write that came between, it is asked again on what is read.
+	Change(ctx context.Context, id string, change func(*asked) bool) (bool, error)
+	All(ctx context.Context) ([]asked, error)
+}
+
+// askChangeTries is how often a change is read and tried again when another write came between.
+const askChangeTries = 5
+
+// asker is the controller asking the operator and acting on the answer.
+type asker struct {
+	open    func(ctx context.Context) ([]conditions.Condition, error)
+	silence func(ctx context.Context, key string, d time.Duration, by, why string) error
+	store   askedStore
+	// publish puts a message on a subject's stream, de-duplicated by id.
+	publish func(ctx context.Context, subject string, body []byte, id string) error
+	// call performs an action's verb with its arguments, as the controller.
+	call func(ctx context.Context, a conditions.Action, args map[string]string) error
+	// record writes the hand-act log.
+	record func(ctx context.Context, act link.HandAct) error
+	// routerRecord reads the router's record of an ask for a warrant missed; nil reads nothing.
+	routerRecord func(ctx context.Context, id string) (*asks.Warrant, error)
+	// routerHere says whether a router holds the seat and takes asks under the asker's name; nil is yes.
+	routerHere func(ctx context.Context) (bool, error)
+	// grantHeld says whether the bus holds the controller's grant to ask: the user list the bus's machine was
+	// last sent is the one the mesh composes now (novox/hq issue 353). The grant is composed from the router's
+	// assignment and reaches the bus only when that machine is next pushed, so between `assign` and `push`
+	// the record says a router is here and the bus refuses every ask. why says what to do; nil is yes.
+	grantHeld func(ctx context.Context) (held bool, why string, err error)
+	// channels is what the channels are now, as a fingerprint: who holds which kind, promising what.
+	channels func(ctx context.Context) string
+	// raise keeps the asker's own condition (sourceAsker): which conditions needing the operator could not be
+	// asked, and why. Nil raises nothing (a test that does not look).
+	raise func(ctx context.Context, obs []conditions.Observation) error
+	now   func() time.Time
+	logf  func(string, ...any)
+
+	saidNoRouter bool
+	saidNoGrant  bool
+
+	mu     sync.Mutex
+	nudged chan struct{}
+}
+
+func (a *asker) nudge() {
+	if a == nil {
+		return
+	}
+	a.mu.Lock()
+	if a.nudged == nil {
+		a.nudged = make(chan struct{}, 1)
+	}
+	ch := a.nudged
+	a.mu.Unlock()
+	select {
+	case ch <- struct{}{}:
+	default:
+	}
+}
+
+// keep asks until ctx ends: now, on every change of a condition, and every askEvery.
+func (a *asker) keep(ctx context.Context) {
+	a.nudge()
+	tick := time.NewTicker(askEvery)
+	defer tick.Stop()
+	a.mu.Lock()
+	nudged := a.nudged
+	a.mu.Unlock()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-tick.C:
+		case <-nudged:
+		}
+		if err := a.reconcile(ctx); err != nil {
+			a.logf("what the operator is asked could not be brought up to date: %v", err)
+		}
+	}
+}
+
+// wants says whether a condition is one to ask about now.
+func wants(c conditions.Condition, now time.Time) bool {
+	return len(c.Actions) > 0 && c.Needs != "" && !c.SilencedAt(now)
+}
+
+func sameAsked(a []conditions.Action, b []conditions.Action) bool {
+	x, _ := json.Marshal(a)
+	y, _ := json.Marshal(b)
+	return string(x) == string(y)
+}
+
+// reconcile brings what is asked in line with what is open.
+func (a *asker) reconcile(ctx context.Context) error {
+	now := a.now()
+	if a.routerHere != nil {
+		here, err := a.routerHere(ctx)
+		if err != nil {
+			return err
+		}
+		if !here {
+			if !a.saidNoRouter {
+				a.logf("no router takes asks under the controller's name (a module declaring %s with its ask "+
+					"named by its caller, assigned): the operator is asked nothing until one is", broker.AsksSeat)
+				a.saidNoRouter = true
+			}
+			open, err := a.open(ctx)
+			if err != nil {
+				return err
+			}
+			var unasked []conditions.Condition
+			for _, c := range open {
+				if wants(c, now) {
+					unasked = append(unasked, c)
+				}
+			}
+			return a.sayUnasked(ctx, unasked, "no router takes the controller's asks: no module holding "+
+				broker.AsksSeat+" that takes an ask under its asker's name is assigned")
+		}
+		a.saidNoRouter = false
+	}
+	if a.grantHeld != nil {
+		held, why, err := a.grantHeld(ctx)
+		if err != nil {
+			return err
+		}
+		if !held {
+			if !a.saidNoGrant {
+				a.logf("the bus does not hold the controller's grant to ask yet: %s; the operator is asked nothing until it does", why)
+				a.saidNoGrant = true
+			}
+			open, err := a.open(ctx)
+			if err != nil {
+				return err
+			}
+			var unasked []conditions.Condition
+			for _, c := range open {
+				if wants(c, now) {
+					unasked = append(unasked, c)
+				}
+			}
+			return a.sayUnasked(ctx, unasked, "the bus does not hold the controller's grant to ask yet: "+why)
+		}
+		a.saidNoGrant = false
+	}
+	channels := ""
+	if a.channels != nil {
+		channels = a.channels(ctx)
+	}
+	open, err := a.open(ctx)
+	if err != nil {
+		return err
+	}
+	all, err := a.store.All(ctx)
+	if err != nil {
+		return err
+	}
+	byCondition := map[string]asked{} // by partKey
+	for _, r := range all {
+		if r.State == askOpen && !r.Rehearsal {
+			k := partKey(r.Condition, r.Part)
+			if prior, held := byCondition[k]; !held || r.Opened.After(prior.Opened) {
+				byCondition[k] = r
+			}
+		}
+	}
+	// A warrant missed while away, read from the router's record.
+	if a.routerRecord != nil {
+		for _, r := range byCondition {
+			if now.Sub(r.Opened) < askCatchUpAfter {
+				continue
+			}
+			if w, err := a.routerRecord(ctx, r.ID); err == nil && w != nil {
+				body, _ := json.Marshal(w)
+				if err := a.Decided(ctx, body); err != nil {
+					return err
+				}
+			}
+		}
+		if all, err = a.store.All(ctx); err != nil {
+			return err
+		}
+		byCondition = map[string]asked{}
+		for _, r := range all {
+			if r.State == askOpen && !r.Rehearsal {
+				byCondition[partKey(r.Condition, r.Part)] = r
+			}
+		}
+	}
+	// What the operator answered lately, by condition: not asked again at once; and what the router refused,
+	// newest first: not asked again until the answers or the channels change.
+	answered, refused := map[string]asked{}, map[string]asked{}
+	for _, r := range all {
+		k := partKey(r.Condition, r.Part)
+		if r.State == string(asks.OutcomeChosen) && now.Sub(r.Ended) < askAgainAfterAnswer {
+			answered[k] = r
+		}
+		if r.State == string(asks.OutcomeRefused) {
+			if prior, has := refused[k]; !has || r.Opened.After(prior.Opened) {
+				refused[k] = r
+			}
+		}
+	}
+	wanted := map[string]bool{}
+	var unasked []conditions.Condition // refused by the router, and nothing it was refused for changed
+	var refusedWords []string
+	// The most urgent first, then the oldest: those are asked when no more than askMostOpen may be.
+	sort.SliceStable(open, func(i, j int) bool {
+		ui, uj := open[i].Severity == conditions.Urgent, open[j].Severity == conditions.Urgent
+		if ui != uj {
+			return ui
+		}
+		if !open[i].Raised.Equal(open[j].Raised) {
+			return open[i].Raised.Before(open[j].Raised)
+		}
+		return open[i].Key < open[j].Key
+	})
+	openNow := 0
+	for _, c := range open {
+		if !wants(c, now) {
+			continue
+		}
+		for _, p := range partsOf(c) {
+			if r, held := byCondition[partKey(c.Key, p.name)]; held && sameAsked(r.Actions, p.actions) && now.Before(r.Ask.Expires) {
+				openNow++
+			}
+		}
+	}
+	for _, c := range open {
+		if !wants(c, now) {
+			continue
+		}
+		saidUnasked := false
+		for _, p := range partsOf(c) {
+			key := partKey(c.Key, p.name)
+			wanted[key] = true
+			if r, was := refused[key]; was && sameAsked(r.Actions, p.actions) && r.Channels == channels {
+				if _, held := byCondition[key]; !held {
+					if !saidUnasked {
+						unasked, saidUnasked = append(unasked, c), true
+					}
+					if r.Warrant != nil && r.Warrant.Words != "" {
+						refusedWords = append(refusedWords, r.Warrant.Words)
+					}
+					continue // refused, and nothing it was refused for has changed
+				}
+			}
+			if r, done := answered[key]; done && sameAsked(r.Actions, p.actions) {
+				if _, held := byCondition[key]; !held {
+					continue
+				}
+			}
+			if r, held := byCondition[key]; held {
+				switch {
+				case !sameAsked(r.Actions, p.actions):
+					if err := a.cancel(ctx, r, "its answers changed"); err != nil {
+						return err
+					}
+				case !now.Before(r.Ask.Expires):
+					// Expired unanswered: the router says so too; asked again below while it lasts.
+					if _, err := a.store.Change(ctx, r.ID, func(x *asked) bool {
+						if x.State != askOpen {
+							return false
+						}
+						x.State, x.Ended = string(asks.OutcomeExpired), now
+						return true
+					}); err != nil {
+						return err
+					}
+					openNow--
+				default:
+					continue
+				}
+			}
+			if openNow >= askMostOpen {
+				continue // asked when one of the open ones ends, most urgent first
+			}
+			if err := a.ask(ctx, c, p, channels); err != nil {
+				a.logf("the operator could not be asked about %s: %v", c.Key, err)
+				continue
+			}
+			openNow++
+		}
+	}
+	stillOpen := map[string]conditions.Condition{}
+	for _, c := range open {
+		stillOpen[c.Key] = c
+	}
+	for key, r := range byCondition {
+		if wanted[key] {
+			continue
+		}
+		// **A silence never takes an approval back** (the confirmation review of 2026-10-09, M1). Silence is an
+		// acknowledgement — anyone at the desk may give it — so a condition silenced while its approval is asked
+		// keeps that ask open, unchanged, until it is answered on a channel that proves who answered, or expires.
+		// It is not asked again once it ends, while the silence lasts.
+		if c, open := stillOpen[r.Condition]; open && c.SilencedAt(now) && r.Ask.Highest() != asks.Acknowledge &&
+			now.Before(r.Ask.Expires) && keepsItsAnswers(c, r) {
+			continue
+		}
+		if err := a.cancel(ctx, r, "the condition ended, was silenced or needs nothing now"); err != nil {
+			return err
+		}
+	}
+	why := "the router refused the ask"
+	if len(refusedWords) > 0 {
+		why += ": " + refusedWords[0]
+	}
+	return a.sayUnasked(ctx, unasked, why)
+}
+
+// keepsItsAnswers says a condition still offers the answers an ask kept was asked with.
+func keepsItsAnswers(c conditions.Condition, r asked) bool {
+	for _, p := range partsOf(c) {
+		if partKey(c.Key, p.name) == partKey(r.Condition, r.Part) {
+			return sameAsked(r.Actions, p.actions)
+		}
+	}
+	return false
+}
+
+// sourceAsker raises the asker's own condition.
+const sourceAsker = "asker"
+
+// sayUnasked keeps the asker's one condition: while a condition that needs the operator could not be asked
+// on any channel, said loudly (failure must be loud), cleared when every one could be.
+func (a *asker) sayUnasked(ctx context.Context, unasked []conditions.Condition, why string) error {
+	if a.raise == nil {
+		return nil
+	}
+	var obs []conditions.Observation
+	if len(unasked) > 0 {
+		keys := make([]string, 0, len(unasked))
+		severity := conditions.Warning
+		for _, c := range unasked {
+			keys = append(keys, c.Key)
+			if c.Severity == conditions.Urgent {
+				severity = conditions.Urgent
+			}
+		}
+		sort.Strings(keys)
+		obs = append(obs, conditions.Observation{Scope: conditions.ScopeSeat, ID: broker.AsksSeat, Token: "unasked",
+			Kind: "asks-undelivered", Severity: severity, Source: sourceAsker,
+			Summary: fmt.Sprintf("%d condition(s) that need the operator could not be asked on any channel: %s; %s",
+				len(keys), strings.Join(keys, ", "), why),
+			Headline:    "Questions for you not delivered",
+			Explanation: "Needs you: answer them from the mesh MCP server. The mesh could not send you its questions on any channel.",
+			Needs:       "answer them from the mesh MCP server, and check why no channel carries them.",
+			Resolved:    "The mesh can ask you again"})
+	}
+	if err := a.raise(ctx, obs); err != nil {
+		a.logf("whether the operator could be asked could not be kept as a condition: %v", err)
+	}
+	return nil
+}
+
+// optionID is an action's label as an option's id: "Silence for a week" is silence-for-a-week.
+func optionID(label string) string {
+	var b strings.Builder
+	dash := false
+	for _, r := range strings.ToLower(label) {
+		switch {
+		case r >= 'a' && r <= 'z', r >= '0' && r <= '9':
+			b.WriteRune(r)
+			dash = false
+		case !dash && b.Len() > 0:
+			b.WriteByte('-')
+			dash = true
+		}
+	}
+	return strings.TrimSuffix(b.String(), "-")
+}
+
+// doesWords is what an action does, in the words an option says it with.
+func doesWords(act conditions.Action) string {
+	switch {
+	case act.Arguments["silence"] != "":
+		return "nothing more is said of it for a week"
+	case act.Verb == "mesh-delivery.release":
+		return "the delivery goes on"
+	case act.Verb == "mesh-delivery.stop":
+		return "the delivery ends"
+	case act.Verb == broker.ControllerSeat+".plans" && act.Arguments["go"] != "":
+		return "the delivery starts"
+	case act.Verb == broker.ControllerSeat+".plans" && act.Arguments["stop"] != "":
+		return "the delivery is stopped"
+	case strings.HasSuffix(act.Verb, ".restart"):
+		return "its service is restarted on " + act.Machine
+	}
+	return strings.ToLower(act.Label)
+}
+
+// askText is a condition's words as an ask says them: without where an answer is given when no channel can
+// give it (FromMeshMCPServer), since the ask is answered on a channel and the router says where else.
+func askText(s string) string {
+	for _, with := range []string{", " + FromMeshMCPServer, " " + FromMeshMCPServer} {
+		s = strings.ReplaceAll(s, with, ".")
+	}
+	return strings.ReplaceAll(s, "..", ".")
+}
+
+// askOf is the ask one part of a condition is asked with.
+func askOf(id string, c conditions.Condition, p askPart, now time.Time) (asks.Ask, map[string]int) {
+	q := asks.Ask{ID: id, Headline: c.Headline, Explanation: askText(c.Explanation), Who: asks.Operator,
+		OnExpiry: "nothing is done, and you are asked again while it lasts", About: p.about,
+		Urgent: c.Severity == conditions.Urgent}
+	options := map[string]int{}
+	approves := false
+	for i, act := range p.actions {
+		level := levelOf(act) // an action that says nothing of its level is never taken for less than approve
+		approves = approves || level != asks.Acknowledge
+		oid := optionID(act.Label)
+		options[oid] = i
+		// Every option binds the exact act it stands for (novox/hq ADR 0259 §6): the verb, the machine and
+		// every argument. The warrant then authorises that act and no other.
+		binds, _ := asks.ActDigest(boundAct(act))
+		q.Options = append(q.Options, asks.Option{ID: oid, Label: act.Label, Does: doesWords(act), Level: level,
+			Binds: binds})
+	}
+	q.Expires = now.Add(askAcknowledgeFor)
+	if approves {
+		q.Expires = now.Add(askApproveFor)
+	}
+	return q, options
+}
+
+// boundAct is what an option's Binds digests: the act exactly as the controller will perform it — its verb,
+// machine, level, and each argument as "arg.<name>" — and never its label or words.
+func boundAct(act conditions.Action) asks.Act {
+	out := asks.Act{"verb": act.Verb, "machine": act.Machine, "level": act.Level}
+	for k, v := range act.Arguments {
+		out["arg."+k] = v
+	}
+	return out
+}
+
+func newAskID() string {
+	var b [8]byte
+	_, _ = rand.Read(b[:])
+	return "c" + hex.EncodeToString(b[:])
+}
+
+// askUnsent is an ask kept and never published: asked again at the next look.
+const askUnsent = "unsent"
+
+// ask publishes one ask about a part of a condition, kept before it is published (the review of 2026-10-09,
+// L3): a warrant for it then always finds it, and one whose publishing failed is marked so and asked again.
+func (a *asker) ask(ctx context.Context, c conditions.Condition, p askPart, channels string) error {
+	now := a.now()
+	id := newAskID()
+	q, options := askOf(id, c, p, now)
+	if err := q.Check(now); err != nil {
+		return err
+	}
+	body, err := json.Marshal(q)
+	if err != nil {
+		return err
+	}
+	if err := a.store.Create(ctx, asked{ID: id, Condition: c.Key, Part: p.name, Ask: q, Actions: p.actions,
+		Options: options, State: askOpen, Opened: now, Channels: channels}); err != nil {
+		return fmt.Errorf("the ask could not be kept, so it was not asked: %w", err)
+	}
+	if err := a.publish(ctx, asks.AskSubject(askerName), body, "ask."+id); err != nil {
+		if _, cerr := a.store.Change(ctx, id, func(x *asked) bool {
+			if x.State != askOpen || x.Acted != "" {
+				return false
+			}
+			x.State, x.Ended, x.Acted = askUnsent, a.now(), "nothing: it could not be published: "+err.Error()
+			return true
+		}); cerr != nil {
+			a.logf("the ask %s could not be published, and could not be marked so: %v", id, cerr)
+		}
+		return err
+	}
+	a.logf("asked the operator about %s (%s): %d answer(s)", c.Key, id, len(q.Options))
+	return nil
+}
+
+// cancel takes an ask back: kept cancelled first, so a warrant that comes after is refused, then said to the
+// router; a cancel the router did not hear leaves the ask to expire there, and nothing is done on it here.
+func (a *asker) cancel(ctx context.Context, r asked, why string) error {
+	stood, err := a.store.Change(ctx, r.ID, func(x *asked) bool {
+		if x.State != askOpen {
+			return false
+		}
+		x.State, x.Ended = askCancelled, a.now()
+		return true
+	})
+	if err != nil || !stood {
+		return err
+	}
+	body, _ := json.Marshal(map[string]string{"id": r.ID})
+	if err := a.publish(ctx, asks.CancelSubject(askerName), body, "cancel."+r.ID); err != nil {
+		a.logf("the ask %s about %s is taken back here, and the router could not be told (%v): it expires there, "+
+			"and no answer to it is acted on", r.ID, r.Condition, err)
+		return nil
+	}
+	a.logf("took back the ask %s about %s: %s", r.ID, r.Condition, why)
+	return nil
+}
+
+// Decided takes the router's word on one of the controller's asks (link.Decider). An error is returned only
+// when what was decided could not be kept, so the word is held and heard again.
+func (a *asker) Decided(ctx context.Context, body []byte) error {
+	var w asks.Warrant
+	if err := json.Unmarshal(body, &w); err != nil {
+		a.logf("the router's word on an ask could not be read; ignored: %v", err)
+		return nil
+	}
+	if w.Asker != askerName {
+		a.logf("REFUSED a warrant for %s's ask %s: the controller acts only on its own", w.Asker, w.Ask)
+		return nil
+	}
+	r, err := a.store.Get(ctx, w.Ask)
+	if err != nil {
+		return err
+	}
+	if r == nil {
+		a.logf("REFUSED a warrant for the ask %s, which the controller does not hold", w.Ask)
+		return nil
+	}
+	if r.Acted != "" {
+		return nil // heard again: acted on once
+	}
+	now := a.now()
+	if w.Outcome != asks.OutcomeChosen {
+		acted := "nothing: the ask " + string(w.Outcome)
+		if w.Words != "" {
+			acted += ": " + w.Words
+		}
+		if _, err := a.store.Change(ctx, r.ID, func(x *asked) bool {
+			if x.Acted != "" {
+				return false
+			}
+			x.State, x.Ended, x.Warrant, x.Acted = string(w.Outcome), now, &w, acted
+			return true
+		}); err != nil {
+			return err
+		}
+		a.logf("the ask %s about %s ended %s; nothing is done", r.ID, r.Condition, w.Outcome)
+		return nil
+	}
+	if r.State != askOpen {
+		// Cancelled, replaced or expired in the controller's own record: no answer to it is acted on.
+		a.logf("REFUSED a warrant for the ask %s, which is %s in the controller's own record", r.ID, r.State)
+		return nil
+	}
+	option, err := w.For(askerName, r.Ask)
+	if err != nil {
+		a.logf("REFUSED a warrant for the ask %s: %v", r.ID, err)
+		return nil
+	}
+	index, offered := r.Options[option.ID]
+	if !offered || index >= len(r.Actions) {
+		a.logf("REFUSED a warrant for the ask %s: it chose %s, which no action stands for", r.ID, option.ID)
+		return nil
+	}
+	act := r.Actions[index]
+	// The act about to be performed is the one the option bound when the controller asked: a record changed
+	// since is refused, never performed.
+	if err := option.Performs(boundAct(act)); err != nil {
+		a.logf("REFUSED a warrant for the ask %s: %v", r.ID, err)
+		return nil
+	}
+	open, err := a.open(ctx)
+	if err != nil {
+		return err
+	}
+	stillOpen := r.Rehearsal // a rehearsal is about no condition
+	for _, c := range open {
+		stillOpen = stillOpen || c.Key == r.Condition
+	}
+	if !stillOpen {
+		// The asker checks the state is still what it asked about before it acts (to-be 46 §10, step 7).
+		if _, err := a.store.Change(ctx, r.ID, func(x *asked) bool {
+			if x.State != askOpen || x.Acted != "" {
+				return false
+			}
+			x.State, x.Warrant, x.Ended, x.Acted = string(asks.OutcomeChosen), &w, now,
+				"nothing: the condition ended before the answer"
+			return true
+		}); err != nil {
+			return err
+		}
+		a.logf("%s, for %s, which ended meanwhile: nothing is done", w.Says(), r.Condition)
+		return nil
+	}
+	// Claimed before acting, by compare-and-set: only the delivery whose write stands acts (security review
+	// of 2026-10-08, finding 9). Not by the warrant's message id, which another publisher could take first:
+	// the controller's own record decides.
+	claimed, err := a.store.Change(ctx, r.ID, func(x *asked) bool {
+		if x.State != askOpen || x.Acted != "" {
+			return false
+		}
+		x.State, x.Warrant, x.Acted = string(asks.OutcomeChosen), &w, "acting"
+		return true
+	})
+	if err != nil {
+		return err
+	}
+	if !claimed {
+		a.logf("the warrant for the ask %s was already taken by another delivery; nothing more is done", r.ID)
+		return nil
+	}
+	r.Acted = "acting"
+
+	why := fmt.Sprintf("%s (ask %s)", w.Says(), r.ID)
+	args := map[string]string{}
+	for k, v := range act.Arguments {
+		args[k] = v
+	}
+	if v, takes := args["why"]; takes && v == "" {
+		args["why"] = why
+	}
+	var acted error
+	switch {
+	case r.Rehearsal && act.Verb == rehearsalVerb:
+		// A rehearsal's answer performs nothing: it is recorded below as the operator's decision.
+	case act.Arguments["silence"] != "":
+		acted = a.silence(ctx, act.Arguments["silence"], conditions.MaxSilence, byWords(w), why)
+	default:
+		acted = a.call(ctx, act, args)
+	}
+	ended, outcome := a.now(), "done"
+	if acted != nil {
+		outcome = "failed: " + acted.Error()
+	}
+	r.Ended, r.Acted = ended, outcome
+	if _, err := a.store.Change(ctx, r.ID, func(x *asked) bool {
+		if x.Acted != "acting" {
+			return false
+		}
+		x.Ended, x.Acted = ended, outcome
+		return true
+	}); err != nil {
+		a.logf("%s was acted on (%s), and how it ended could NOT be kept: %v", r.ID, outcome, err)
+	}
+	verbArgs := []string{act.Verb}
+	if act.Machine != "" {
+		verbArgs = append(verbArgs, "on "+act.Machine)
+	}
+	keys := make([]string, 0, len(args))
+	for k := range args {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	for _, k := range keys {
+		if k != "why" {
+			verbArgs = append(verbArgs, k+"="+args[k])
+		}
+	}
+	if err := a.record(ctx, link.HandAct{Verb: handActWarrant, Args: verbArgs, Why: why, By: byWords(w),
+		Cause: conditions.CauseOperatorAnswer, Condition: r.Condition, Via: viaWords(w), Ask: r.ID,
+		Proofs: w.Proofs, RequestedBy: r.Condition, Outcome: r.Acted}); err != nil {
+		a.logf("%s was done, and could NOT be recorded in the hand-act log: %v", why, err)
+	}
+	a.logf("%s: %s", why, r.Acted)
+	return nil
+}
+
+// handActWarrant is the verb an act the operator chose on a warrant is recorded under: a person's decision,
+// never a repair (handActVerbs).
+const handActWarrant = "warrant"
+
+// byWords is who chose, as the hand-act log says it: "the operator, as telegram identity 42".
+func byWords(w asks.Warrant) string {
+	if w.By == nil {
+		return "the operator"
+	}
+	return fmt.Sprintf("the %s, as %s identity %s", w.By.Who, w.By.Kind, w.By.Identity)
+}
+
+// viaWords is the channel an answer came through: its module and kind, and how the sender was known.
+func viaWords(w asks.Warrant) string {
+	if w.By == nil {
+		return w.Channel
+	}
+	via := w.Channel + " (" + w.By.Kind + ")"
+	if w.By.Verified != "" {
+		via += ", " + w.By.Verified
+	}
+	return via
+}
+
+// errNotGranted is an action whose verb the controller's grant does not name.
+var errNotGranted = errors.New("the controller's grant does not name this verb")

cmd/mesh-controller/asker_bus_test.go

@@ -0,0 +1,151 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/nats-io/nats.go"
+	"github.com/nats-io/nats.go/jetstream"
+
+	"git.novox.be/novox/mesh-sdk/go/asks"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/link"
+	"github.com/novox/mesh-controller/internal/testbus"
+)
+
+// busAsker is an asker on a real bus's `asked` bucket, counting what it performs: two of them are two
+// controllers sharing one record.
+type busAskerRig struct {
+	mu     sync.Mutex
+	called int
+	acts   int
+	open   []conditions.Condition
+	sent   [][]byte
+}
+
+func (rig *busAskerRig) asker(t *testing.T, conn *nats.Conn, now time.Time) *asker {
+	return &asker{
+		open: func(context.Context) ([]conditions.Condition, error) {
+			rig.mu.Lock()
+			defer rig.mu.Unlock()
+			return rig.open, nil
+		},
+		silence: func(context.Context, string, time.Duration, string, string) error { return nil },
+		store:   busAsked{conn: conn},
+		publish: func(_ context.Context, subject string, body []byte, _ string) error {
+			rig.mu.Lock()
+			defer rig.mu.Unlock()
+			if subject == asks.AskSubject(askerName) {
+				rig.sent = append(rig.sent, body)
+			}
+			return nil
+		},
+		call: func(context.Context, conditions.Action, map[string]string) error {
+			time.Sleep(20 * time.Millisecond) // long enough for the other delivery to arrive meanwhile
+			rig.mu.Lock()
+			defer rig.mu.Unlock()
+			rig.called++
+			return nil
+		},
+		record: func(context.Context, link.HandAct) error {
+			rig.mu.Lock()
+			defer rig.mu.Unlock()
+			rig.acts++
+			return nil
+		},
+		now:  func() time.Time { return now },
+		logf: t.Logf,
+	}
+}
+
+func askedBus(t *testing.T) *nats.Conn {
+	t.Helper()
+	conn, err := nats.Connect(testbus.URL(t))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(conn.Close)
+	js, err := jetstream.New(conn)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := js.CreateKeyValue(context.Background(), jetstream.KeyValueConfig{Bucket: broker.AskedBucket}); err != nil {
+		t.Fatal(err)
+	}
+	return conn
+}
+
+// The review of 2026-10-09 (L7): two deliveries of one warrant, to two controllers at once, perform its act
+// exactly once and record it once — the record's compare-and-set decides, never the warrant's message id.
+func TestTwoAnswersAtOnceActOnce(t *testing.T) {
+	conn := askedBus(t)
+	now := time.Date(2026, 10, 9, 14, 0, 0, 0, time.UTC)
+	rig := &busAskerRig{open: []conditions.Condition{heldCondition()}}
+	first, second := rig.asker(t, conn, now), rig.asker(t, conn, now)
+	if err := first.reconcile(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	if len(rig.sent) != 1 {
+		t.Fatalf("asked %d times", len(rig.sent))
+	}
+	var q asks.Ask
+	_ = json.Unmarshal(rig.sent[0], &q)
+	release, _ := q.Option("release")
+	w := asks.Warrant{Ask: q.ID, Asker: askerName, About: q.About, Outcome: asks.OutcomeChosen, Option: release.ID,
+		Label: release.Label, Level: release.Level, Channel: "telegram", Proofs: []string{"P1"}, At: now,
+		AskDigest: q.Digest(), By: &asks.Person{Who: asks.Operator, Kind: "telegram", Identity: "42", Verified: "user id verified"}}
+	body, _ := json.Marshal(w)
+	var wg sync.WaitGroup
+	for _, a := range []*asker{first, second, first, second} {
+		wg.Add(1)
+		go func(a *asker) {
+			defer wg.Done()
+			if err := a.Decided(context.Background(), body); err != nil {
+				t.Error(err)
+			}
+		}(a)
+	}
+	wg.Wait()
+	if rig.called != 1 || rig.acts != 1 {
+		t.Fatalf("performed %d time(s), recorded %d time(s)", rig.called, rig.acts)
+	}
+	got, err := busAsked{conn: conn}.Get(context.Background(), q.ID)
+	if err != nil || got == nil || got.Acted != "done" {
+		t.Fatalf("kept as %+v (%v)", got, err)
+	}
+}
+
+// The review of 2026-10-09 (L2): a write decided on a record read earlier never lands over one made since. A
+// cancel read before the answer was acted on leaves the act's record as it is.
+func TestAStaleCancelDoesNotWriteOverAnAct(t *testing.T) {
+	conn := askedBus(t)
+	now := time.Date(2026, 10, 9, 14, 0, 0, 0, time.UTC)
+	rig := &busAskerRig{open: []conditions.Condition{heldCondition()}}
+	a := rig.asker(t, conn, now)
+	if err := a.reconcile(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	var q asks.Ask
+	_ = json.Unmarshal(rig.sent[0], &q)
+	stale, _ := busAsked{conn: conn}.Get(context.Background(), q.ID)
+	release, _ := q.Option("release")
+	w := asks.Warrant{Ask: q.ID, Asker: askerName, About: q.About, Outcome: asks.OutcomeChosen, Option: release.ID,
+		Label: release.Label, Level: release.Level, Channel: "telegram", At: now, AskDigest: q.Digest(),
+		By: &asks.Person{Who: asks.Operator, Kind: "telegram", Identity: "42", Verified: "user id verified"}}
+	body, _ := json.Marshal(w)
+	if err := a.Decided(context.Background(), body); err != nil {
+		t.Fatal(err)
+	}
+	if err := a.cancel(context.Background(), *stale, "the condition ended"); err != nil {
+		t.Fatal(err)
+	}
+	got, _ := busAsked{conn: conn}.Get(context.Background(), q.ID)
+	if got.State != string(asks.OutcomeChosen) || got.Acted != "done" {
+		t.Errorf("a stale cancel wrote over the act: %+v", got)
+	}
+}

cmd/mesh-controller/asker_test.go

@@ -0,0 +1,705 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/asks"
+
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// novox/hq ADR 0259 §6: the controller asks the operator for the answers its conditions name, and performs
+// the one chosen on the router's warrant — once, for its own ask, the option offered, at its level.
+
+type memAskedStore map[string]asked
+
+// memAskedMu guards every memAskedStore: Change is a compare-and-set as the bus's is.
+var memAskedMu sync.Mutex
+
+func (m memAskedStore) Get(_ context.Context, id string) (*asked, error) {
+	memAskedMu.Lock()
+	defer memAskedMu.Unlock()
+	r, ok := m[id]
+	if !ok {
+		return nil, nil
+	}
+	return &r, nil
+}
+func (m memAskedStore) Create(_ context.Context, r asked) error {
+	memAskedMu.Lock()
+	defer memAskedMu.Unlock()
+	if _, kept := m[r.ID]; kept {
+		return errors.New("an ask is kept under that id")
+	}
+	m[r.ID] = r
+	return nil
+}
+func (m memAskedStore) Change(_ context.Context, id string, change func(*asked) bool) (bool, error) {
+	memAskedMu.Lock()
+	defer memAskedMu.Unlock()
+	r, ok := m[id]
+	if !ok || !change(&r) {
+		return false, nil
+	}
+	m[id] = r
+	return true, nil
+}
+func (m memAskedStore) All(context.Context) ([]asked, error) {
+	memAskedMu.Lock()
+	defer memAskedMu.Unlock()
+	var out []asked
+	for _, r := range m {
+		out = append(out, r)
+	}
+	return out, nil
+}
+
+type published struct {
+	subject, id string
+	body        []byte
+}
+
+type askerRig struct {
+	a        *asker
+	open     []conditions.Condition
+	store    memAskedStore
+	sent     []published
+	called   []string
+	silenced []string
+	acts     []link.HandAct
+	now      time.Time
+}
+
+func newAskerRig(t *testing.T) *askerRig {
+	r := &askerRig{store: memAskedStore{}, now: time.Date(2026, 10, 8, 14, 0, 0, 0, time.UTC)}
+	r.a = &asker{
+		open: func(context.Context) ([]conditions.Condition, error) { return r.open, nil },
+		silence: func(_ context.Context, key string, d time.Duration, by, why string) error {
+			r.silenced = append(r.silenced, key+" for "+d.String()+" by "+by+" because "+why)
+			// As the controller's conditions do (the confirmation review of 2026-10-09, M1): the condition is
+			// silenced from now on, so what is asked next sees it silenced.
+			for i := range r.open {
+				if r.open[i].Key == key {
+					r.open[i].Silenced = &conditions.Silence{Until: r.now.Add(d), By: by, Why: why, Since: r.now}
+				}
+			}
+			return nil
+		},
+		store: r.store,
+		publish: func(_ context.Context, subject string, body []byte, id string) error {
+			r.sent = append(r.sent, published{subject, id, body})
+			return nil
+		},
+		call: func(_ context.Context, a conditions.Action, args map[string]string) error {
+			raw, _ := json.Marshal(args)
+			r.called = append(r.called, a.Verb+"@"+a.Machine+" "+string(raw))
+			return nil
+		},
+		record: func(_ context.Context, act link.HandAct) error { r.acts = append(r.acts, act); return nil },
+		now:    func() time.Time { return r.now },
+		logf:   t.Logf,
+	}
+	return r
+}
+
+func heldCondition() conditions.Condition {
+	o := stalledObservations([]stalledLine{{ID: "novox/hq@055550802096", State: "held", For: "36h2m6s",
+		Bound: "24h0m0s", H2: "none: the state is the operator's"}})[0]
+	return conditions.Condition{Key: o.Key(), Kind: o.Kind, Severity: conditions.Warning, Headline: o.Headline,
+		Explanation: conditions.Verdict(o.Needs, o.Explanation), Needs: o.Needs, Actions: o.Actions}
+}
+
+func unitsCondition() conditions.Condition {
+	key := "machine.shanks.units"
+	return conditions.Condition{Key: key, Kind: "machine-units", Severity: conditions.Warning,
+		Headline: "3 failed services on shanks", Explanation: "Needs you: mend or remove them on shanks, or silence this.",
+		Needs: "mend or remove them on shanks, or silence this.", Actions: []conditions.Action{conditions.SilenceAction(key)}}
+}
+
+func (r *askerRig) asksSent(t *testing.T) []asks.Ask {
+	t.Helper()
+	var out []asks.Ask
+	for _, p := range r.sent {
+		if p.subject != asks.AskSubject("mesh-controller") {
+			continue
+		}
+		var q asks.Ask
+		if err := json.Unmarshal(p.body, &q); err != nil {
+			t.Fatal(err)
+		}
+		out = append(out, q)
+	}
+	return out
+}
+
+func TestAnAskIsMadeForEachConditionThatNamesItsAnswers(t *testing.T) {
+	r := newAskerRig(t)
+	quiet := conditions.Condition{Key: "machine.ace.silent", Headline: "ace silent", Explanation: "Nothing for you to do. x"}
+	r.open = []conditions.Condition{heldCondition(), unitsCondition(), quiet}
+	if err := r.a.reconcile(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	sent := r.asksSent(t)
+	if len(sent) != 2 {
+		t.Fatalf("asked %d times: %+v", len(sent), sent)
+	}
+	byAbout := map[string]asks.Ask{}
+	for _, q := range sent {
+		byAbout[q.About] = q
+		if err := q.Check(r.now); err != nil {
+			t.Errorf("%s: %v", q.About, err)
+		}
+	}
+	held := byAbout[heldCondition().Key]
+	if len(held.Options) != 2 || held.Options[0].Label != "Release" || held.Options[0].Level != asks.Approve ||
+		held.Options[1].ID != "stop" || held.Expires != r.now.Add(askApproveFor) || held.Who != asks.Operator ||
+		held.OnExpiry == "" {
+		t.Errorf("the held delivery is asked %+v", held)
+	}
+	units := byAbout["machine.shanks.units"]
+	if len(units.Options) != 1 || units.Options[0].Level != asks.Acknowledge || units.Expires != r.now.Add(askAcknowledgeFor) {
+		t.Errorf("the failed units are asked %+v", units)
+	}
+	// No second ask while one is open.
+	r.now = r.now.Add(time.Minute)
+	_ = r.a.reconcile(context.Background())
+	if n := len(r.asksSent(t)); n != 2 {
+		t.Errorf("asked again while open: %d", n)
+	}
+}
+
+func TestAnAskIsTakenBackWhenItsConditionEndsAndAskedAgainAfterItExpires(t *testing.T) {
+	r := newAskerRig(t)
+	r.open = []conditions.Condition{heldCondition(), unitsCondition()}
+	_ = r.a.reconcile(context.Background())
+	// The units are silenced, the held delivery lasts past its ask's day.
+	units := unitsCondition()
+	units.Silenced = &conditions.Silence{Until: r.now.Add(48 * time.Hour)}
+	r.open = []conditions.Condition{heldCondition(), units}
+	r.now = r.now.Add(askApproveFor)
+	if err := r.a.reconcile(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	var cancels int
+	for _, p := range r.sent {
+		if p.subject == asks.CancelSubject("mesh-controller") {
+			cancels++
+		}
+	}
+	if cancels != 1 {
+		t.Errorf("cancels %d, want the silenced one's", cancels)
+	}
+	if sent := r.asksSent(t); len(sent) != 3 || sent[2].About != heldCondition().Key {
+		t.Errorf("the expired ask was not asked again: %+v", sent)
+	}
+}
+
+// warrantFor is the router's warrant for the open ask about a condition, choosing an option by label.
+func (r *askerRig) warrantFor(t *testing.T, condition, label string) asks.Warrant {
+	t.Helper()
+	for _, a := range r.store {
+		if a.Condition != condition || a.State != askOpen {
+			continue
+		}
+		for _, o := range a.Ask.Options {
+			if o.Label == label {
+				return asks.Warrant{Ask: a.ID, Asker: "mesh-controller", About: condition, Outcome: asks.OutcomeChosen,
+					Option: o.ID, Label: o.Label, Level: o.Level, Channel: "telegram", Proofs: []string{"P1"}, At: r.now,
+					AskDigest: a.Ask.Digest(),
+					By:        &asks.Person{Who: asks.Operator, Kind: "telegram", Identity: "42", Verified: "user id verified"}}
+			}
+		}
+	}
+	t.Fatalf("no open ask about %s offers %s", condition, label)
+	return asks.Warrant{}
+}
+
+func answerWith(t *testing.T, r *askerRig, w asks.Warrant) {
+	t.Helper()
+	body, _ := json.Marshal(w)
+	if err := r.a.Decided(context.Background(), body); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestAWarrantIsActedOnOnce(t *testing.T) {
+	r := newAskerRig(t)
+	r.open = []conditions.Condition{heldCondition()}
+	_ = r.a.reconcile(context.Background())
+	w := r.warrantFor(t, heldCondition().Key, "Release")
+	answerWith(t, r, w)
+	answerWith(t, r, w) // heard again
+	if len(r.called) != 1 {
+		t.Fatalf("called %v", r.called)
+	}
+	want := `mesh-delivery.release@ {"id":"novox/hq@055550802096","why":"the operator, via telegram (user id verified), chose Release (ask ` + w.Ask + `)"}`
+	if r.called[0] != want {
+		t.Errorf("called\n  %s\nwant\n  %s", r.called[0], want)
+	}
+	if len(r.acts) != 1 {
+		t.Fatalf("hand-acts %+v", r.acts)
+	}
+	act := r.acts[0]
+	if act.Verb != handActWarrant || act.By != "the operator, as telegram identity 42" ||
+		act.Via != "telegram (telegram), user id verified" || act.Ask != w.Ask || strings.Join(act.Proofs, ",") != "P1" ||
+		act.Cause != conditions.CauseOperatorAnswer || act.Condition != heldCondition().Key || act.Outcome != "done" {
+		t.Errorf("the hand-act %+v", act)
+	}
+	if !personsDecision(act) {
+		t.Error("an act on a warrant counts as a repair")
+	}
+	if got := r.store[w.Ask]; got.State != string(asks.OutcomeChosen) || got.Acted != "done" {
+		t.Errorf("kept %+v", got)
+	}
+}
+
+func TestAWarrantThatIsNotForItsOwnAskIsRefused(t *testing.T) {
+	for name, change := range map[string]func(*asks.Warrant){
+		"another asker":         func(w *asks.Warrant) { w.Asker = "mesh-delivery" },
+		"an ask not held":       func(w *asks.Warrant) { w.Ask = "c0000000000000000" },
+		"an option not offered": func(w *asks.Warrant) { w.Option = "delete" },
+		"another level":         func(w *asks.Warrant) { w.Level = asks.Acknowledge },
+		"no person":             func(w *asks.Warrant) { w.By = nil },
+		"another ask's digest":  func(w *asks.Warrant) { w.AskDigest = "sha256:0000" },
+		"no ask's digest":       func(w *asks.Warrant) { w.AskDigest = "" },
+	} {
+		t.Run(name, func(t *testing.T) {
+			r := newAskerRig(t)
+			r.open = []conditions.Condition{heldCondition()}
+			_ = r.a.reconcile(context.Background())
+			w := r.warrantFor(t, heldCondition().Key, "Stop")
+			change(&w)
+			answerWith(t, r, w)
+			if len(r.called)+len(r.acts)+len(r.silenced) != 0 {
+				t.Errorf("acted on it: %v %v %v", r.called, r.acts, r.silenced)
+			}
+		})
+	}
+}
+
+func TestEachAnswerCallsExactlyItsVerb(t *testing.T) {
+	plan := "plan-1791454185265004861"
+	waiting := conditions.Condition{Key: "plan." + plan + ".waiting", Severity: conditions.Urgent,
+		Headline: "openrazer delivery waiting to start", Needs: "start it, or stop it.",
+		Explanation: "Needs you: start it, or stop it.", Actions: waitingActions(plan, conditions.Urgent)}
+	module := conditions.Condition{Key: "module.openrazer.g14.unhealthy", Severity: conditions.Warning,
+		Headline: "openrazer not working on g14", Needs: "restart its service openrazer-daemon on g14.",
+		Explanation: "Needs you: restart it.", Actions: []conditions.Action{{Label: "Restart",
+			Verb: "node-service-manager.restart", Machine: "g14", Level: conditions.LevelApprove,
+			Arguments: map[string]string{"unit": "openrazer-daemon.service", "scope": "user"}}}}
+	for _, tc := range []struct {
+		c     conditions.Condition
+		label string
+		want  string
+	}{
+		{waiting, "Start", `mesh-controller.plans@ {"cause":"operator-answer","go":"` + plan + `","why":"`},
+		{waiting, "Stop", `mesh-controller.plans@ {"cause":"operator-answer","stop":"` + plan + `","why":"`},
+		{module, "Restart", `node-service-manager.restart@g14 {"scope":"user","unit":"openrazer-daemon.service"}`},
+	} {
+		r := newAskerRig(t)
+		r.open = []conditions.Condition{tc.c}
+		_ = r.a.reconcile(context.Background())
+		answerWith(t, r, r.warrantFor(t, tc.c.Key, tc.label))
+		if len(r.called) != 1 || !strings.HasPrefix(r.called[0], tc.want) {
+			t.Errorf("%s: called %v, want %s…", tc.label, r.called, tc.want)
+		}
+	}
+}
+
+func TestASilenceChosenIsTheControllersOwnAndAnAnswerToAnAsk(t *testing.T) {
+	r := newAskerRig(t)
+	r.open = []conditions.Condition{unitsCondition()}
+	_ = r.a.reconcile(context.Background())
+	w := r.warrantFor(t, "machine.shanks.units", "Silence for a week")
+	w.Level, w.Proofs = asks.Acknowledge, nil
+	w.By = &asks.Person{Who: asks.Operator, Kind: "desktop", Identity: "g14",
+		Verified: "a desk click: whoever was at the operator's session on g14"}
+	w.Channel = "desk-channel"
+	answerWith(t, r, w)
+	if len(r.called) != 0 || len(r.silenced) != 1 || !strings.HasPrefix(r.silenced[0], "machine.shanks.units for 168h0m0s by the operator, as desktop identity g14") {
+		t.Fatalf("silenced %v, called %v", r.silenced, r.called)
+	}
+	if len(r.acts) != 1 || r.acts[0].Cause != conditions.CauseOperatorAnswer || len(r.acts[0].Proofs) != 0 {
+		t.Errorf("%+v", r.acts)
+	}
+}
+
+func TestAnAskThatEndedWithoutAChoiceDoesNothing(t *testing.T) {
+	r := newAskerRig(t)
+	r.open = []conditions.Condition{heldCondition()}
+	_ = r.a.reconcile(context.Background())
+	w := r.warrantFor(t, heldCondition().Key, "Release")
+	w.Outcome, w.Option, w.Label, w.Level, w.By, w.Words = asks.OutcomeExpired, "", "", "", nil, "nobody answered in time"
+	answerWith(t, r, w)
+	if len(r.called)+len(r.acts) != 0 || r.store[w.Ask].State != string(asks.OutcomeExpired) ||
+		!strings.HasPrefix(r.store[w.Ask].Acted, "nothing") {
+		t.Errorf("called %v acts %v kept %+v", r.called, r.acts, r.store[w.Ask])
+	}
+	// And a choice for a condition that ended meanwhile does nothing either.
+	r2 := newAskerRig(t)
+	r2.open = []conditions.Condition{heldCondition()}
+	_ = r2.a.reconcile(context.Background())
+	w2 := r2.warrantFor(t, heldCondition().Key, "Release")
+	r2.open = nil
+	answerWith(t, r2, w2)
+	if len(r2.called) != 0 || r2.store[w2.Ask].Acted != "nothing: the condition ended before the answer" {
+		t.Errorf("%v %+v", r2.called, r2.store[w2.Ask])
+	}
+}
+
+func TestAWarrantMissedWhileAwayIsReadFromTheRoutersRecord(t *testing.T) {
+	r := newAskerRig(t)
+	r.open = []conditions.Condition{heldCondition()}
+	_ = r.a.reconcile(context.Background())
+	w := r.warrantFor(t, heldCondition().Key, "Stop")
+	r.a.routerRecord = func(_ context.Context, id string) (*asks.Warrant, error) {
+		if id != w.Ask {
+			return nil, errors.New("another ask")
+		}
+		return &w, nil
+	}
+	r.now = r.now.Add(askCatchUpAfter)
+	if err := r.a.reconcile(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	if len(r.called) != 1 || !strings.HasPrefix(r.called[0], "mesh-delivery.stop@") {
+		t.Errorf("called %v", r.called)
+	}
+	if n := len(r.asksSent(t)); n != 1 {
+		t.Errorf("asked again after the answer: %d", n)
+	}
+}
+
+// After review (2026-10-08): a refused ask is not asked again until its answers or the channels change.
+func TestAnAskTheRouterRefusedWaitsUntilSomethingChanges(t *testing.T) {
+	r := newAskerRig(t)
+	channels := "channel/telegram=telegram@anchor[choice]own:true"
+	r.a.channels = func(context.Context) string { return channels }
+	r.open = []conditions.Condition{heldCondition()}
+	_ = r.a.reconcile(context.Background())
+	first := r.asksSent(t)[0]
+	refusal, _ := json.Marshal(asks.Warrant{Ask: first.ID, Asker: "mesh-controller", Outcome: asks.OutcomeRefused,
+		Words: "no channel can carry any of its answers now", At: r.now})
+	if err := r.a.Decided(context.Background(), refusal); err != nil {
+		t.Fatal(err)
+	}
+	if got := r.store[first.ID]; got.State != string(asks.OutcomeRefused) || !strings.Contains(got.Acted, "nothing") {
+		t.Fatalf("the refusal was kept as %+v", got)
+	}
+	for i := 0; i < 3; i++ {
+		r.now = r.now.Add(askEvery)
+		_ = r.a.reconcile(context.Background())
+	}
+	if n := len(r.asksSent(t)); n != 1 {
+		t.Fatalf("asked again %d time(s) though nothing changed", n-1)
+	}
+	channels = "channel/telegram=telegram@anchor[choice,verified-sender]own:true"
+	_ = r.a.reconcile(context.Background())
+	if n := len(r.asksSent(t)); n != 2 {
+		t.Errorf("not asked again once the channels changed: %d", n)
+	}
+}
+
+// After review: at most three asks open at once, the most urgent first, then the oldest.
+func TestAtMostThreeAsksAreOpenTheMostUrgentFirst(t *testing.T) {
+	r := newAskerRig(t)
+	var open []conditions.Condition
+	for i := 0; i < 4; i++ {
+		c := unitsCondition()
+		c.Key = "machine.m" + string(rune('a'+i)) + ".units"
+		c.Actions = []conditions.Action{conditions.SilenceAction(c.Key)}
+		c.Raised = r.now.Add(-time.Duration(10-i) * time.Hour)
+		open = append(open, c)
+	}
+	urgent := heldCondition()
+	urgent.Severity, urgent.Raised = conditions.Urgent, r.now.Add(-time.Minute)
+	r.open = append(open, urgent)
+	_ = r.a.reconcile(context.Background())
+	sent := r.asksSent(t)
+	if len(sent) != askMostOpen || sent[0].About != urgent.Key || sent[1].About != "machine.ma.units" || sent[2].About != "machine.mb.units" {
+		var about []string
+		for _, q := range sent {
+			about = append(about, q.About)
+		}
+		t.Fatalf("asked %v", about)
+	}
+}
+
+// After review: nothing is asked while no router takes asks under the controller's name, and that is said once.
+func TestNothingIsAskedWithoutARouter(t *testing.T) {
+	r := newAskerRig(t)
+	var said []string
+	r.a.logf = func(f string, a ...any) { said = append(said, f) }
+	r.a.routerHere = func(context.Context) (bool, error) { return false, nil }
+	r.open = []conditions.Condition{heldCondition()}
+	_ = r.a.reconcile(context.Background())
+	_ = r.a.reconcile(context.Background())
+	if len(r.asksSent(t)) != 0 {
+		t.Error("asked with no router")
+	}
+	n := 0
+	for _, s := range said {
+		if strings.Contains(s, "no router takes asks") {
+			n++
+		}
+	}
+	if n != 1 {
+		t.Errorf("said %d times", n)
+	}
+}
+
+// After review: the condition's words keep where an answer is given without a channel; the ask's text does not.
+func TestTheAskDropsWhereItIsAnsweredAndTheConditionKeepsIt(t *testing.T) {
+	c := heldCondition()
+	if !strings.Contains(c.Explanation, FromMeshMCPServer) {
+		t.Fatalf("the condition lost where it is answered: %q", c.Explanation)
+	}
+	q, _ := askOf("x", c, partsOf(c)[0], time.Now())
+	if strings.Contains(q.Explanation, "mesh MCP server") || !strings.HasPrefix(q.Explanation, "Needs you: release it, or stop it.") {
+		t.Errorf("the ask says %q", q.Explanation)
+	}
+	if askApproveFor >= 24*time.Hour {
+		t.Errorf("an approving ask lasts %s, which the SDK may refuse at its bound", askApproveFor)
+	}
+}
+
+// After review (security finding 9): a warrant is acted on only for an ask open in the controller's own record,
+// once the claim stands, and never when given after the ask expired.
+func TestAWarrantIsActedOnlyForAnOpenAskItClaimsBeforeItExpired(t *testing.T) {
+	r := newAskerRig(t)
+	r.open = []conditions.Condition{heldCondition()}
+	_ = r.a.reconcile(context.Background())
+	w := r.warrantFor(t, heldCondition().Key, "Release")
+	late := w
+	late.At = r.store[w.Ask].Ask.Expires.Add(time.Minute)
+	body, _ := json.Marshal(late)
+	_ = r.a.Decided(context.Background(), body)
+	if len(r.called) != 0 {
+		t.Fatalf("acted on a warrant given after the ask expired: %v", r.called)
+	}
+	// Claimed already by another delivery: nothing done here.
+	kept := r.store[w.Ask]
+	kept.Acted = "acting"
+	r.store[w.Ask] = kept
+	body, _ = json.Marshal(w)
+	_ = r.a.Decided(context.Background(), body)
+	if len(r.called) != 0 {
+		t.Fatalf("acted though the claim was another's: %v", r.called)
+	}
+	// Cancelled in its own record: refused.
+	kept.Acted, kept.State = "", askCancelled
+	r.store[w.Ask] = kept
+	_ = r.a.Decided(context.Background(), body)
+	if len(r.called) != 0 {
+		t.Errorf("acted on a cancelled ask: %v", r.called)
+	}
+}
+
+// novox/hq ADR 0259 §6: a warrant authorises the act its option bound when the controller asked, and no
+// other. A record of the act changed after the ask — another delivery, another machine, another argument —
+// is refused and nothing is performed.
+func TestAWarrantPerformsOnlyTheActItsOptionBound(t *testing.T) {
+	for name, change := range map[string]func(*conditions.Action){
+		"another argument": func(a *conditions.Action) {
+			a.Arguments = map[string]string{"id": "novox/mesh-controller@000000000000"}
+		},
+		"another verb":    func(a *conditions.Action) { a.Verb = "mesh-delivery.stop" },
+		"another machine": func(a *conditions.Action) { a.Machine = "anchor" },
+	} {
+		t.Run(name, func(t *testing.T) {
+			r := newAskerRig(t)
+			r.open = []conditions.Condition{heldCondition()}
+			_ = r.a.reconcile(context.Background())
+			w := r.warrantFor(t, heldCondition().Key, "Release")
+			kept := r.store[w.Ask]
+			acts := append([]conditions.Action(nil), kept.Actions...)
+			i := kept.Options[w.Option]
+			change(&acts[i])
+			kept.Actions = acts
+			r.store[w.Ask] = kept
+			answerWith(t, r, w)
+			if len(r.called)+len(r.acts) != 0 {
+				t.Errorf("performed an act the option did not bind: %v %v", r.called, r.acts)
+			}
+		})
+	}
+	// Every option of an ask binds its act.
+	q, _ := askOf("x", heldCondition(), partsOf(heldCondition())[0], time.Now())
+	for _, o := range q.Options {
+		if o.Binds == "" {
+			t.Errorf("the option %s binds nothing", o.ID)
+		}
+	}
+}
+
+// Failure is loud (novox/hq ADR 0259, the self-review of 2026-10-09): a condition that needs the operator and
+// could not be asked on any channel — no router, or the router refused the ask — is a condition of its own,
+// cleared once it can be asked again.
+func TestAnAskThatCannotBeDeliveredIsSaid(t *testing.T) {
+	r := newAskerRig(t)
+	var raised [][]conditions.Observation
+	r.a.raise = func(_ context.Context, obs []conditions.Observation) error {
+		raised = append(raised, obs)
+		return nil
+	}
+	last := func() []conditions.Observation { return raised[len(raised)-1] }
+	routerHere := false
+	r.a.routerHere = func(context.Context) (bool, error) { return routerHere, nil }
+	channels := "channel/telegram=telegram@anchor[choice]own:true"
+	r.a.channels = func(context.Context) string { return channels }
+	r.open = []conditions.Condition{heldCondition()}
+
+	_ = r.a.reconcile(context.Background())
+	if got := last(); len(got) != 1 || got[0].Kind != "asks-undelivered" ||
+		!strings.Contains(got[0].Summary, heldCondition().Key) || !strings.Contains(got[0].Summary, "no router") {
+		t.Fatalf("no router, said as %+v", got)
+	}
+
+	routerHere = true
+	_ = r.a.reconcile(context.Background())
+	if got := last(); len(got) != 0 {
+		t.Fatalf("asked, and still said undelivered: %+v", got)
+	}
+	first := r.asksSent(t)[0]
+	refusal, _ := json.Marshal(asks.Warrant{Ask: first.ID, Asker: "mesh-controller", Outcome: asks.OutcomeRefused,
+		Words: "no channel can carry any of its answers now", At: r.now})
+	if err := r.a.Decided(context.Background(), refusal); err != nil {
+		t.Fatal(err)
+	}
+	_ = r.a.reconcile(context.Background())
+	if got := last(); len(got) != 1 || !strings.Contains(got[0].Summary, "no channel can carry") {
+		t.Fatalf("the router's refusal, said as %+v", got)
+	}
+	if why, ok := conditions.PlainWords(conditions.Words{Headline: last()[0].Headline, Explanation: last()[0].Explanation,
+		Needs: last()[0].Needs, Resolved: last()[0].Resolved}, ""); !ok {
+		t.Errorf("not plain: %s", why)
+	}
+	r.open = nil
+	_ = r.a.reconcile(context.Background())
+	if got := last(); len(got) != 0 {
+		t.Errorf("nothing needs asking, and still said: %+v", got)
+	}
+}
+
+// The review of 2026-10-09 (M1): an acknowledging answer never shares an ask with an authorising one. A
+// condition offering Restart and Silence is asked twice — Restart alone, about the condition, and Silence
+// alone, apart — so Silence chosen on a channel that only acknowledges leaves the Restart ask open.
+func TestAnAcknowledgementNeverSharesAnAskWithAnApproval(t *testing.T) {
+	r := newAskerRig(t)
+	key := "module.shanks.plex.down"
+	c := conditions.Condition{Key: key, Kind: "module-down", Severity: conditions.Urgent, Headline: "Plex down on shanks",
+		Explanation: "Needs you: restart it, or silence this.", Needs: "restart it, or silence this.",
+		Actions: []conditions.Action{
+			{Label: "Restart", Verb: "node-service-manager.restart", Machine: "shanks", Level: conditions.LevelApprove,
+				Arguments: map[string]string{"unit": "plex"}},
+			conditions.SilenceAction(key)}}
+	r.open = []conditions.Condition{c}
+	if err := r.a.reconcile(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	sent := r.asksSent(t)
+	if len(sent) != 2 {
+		t.Fatalf("asked %d time(s): %+v", len(sent), sent)
+	}
+	for _, q := range sent {
+		if err := q.Check(r.now); err != nil {
+			t.Errorf("%s: %v", q.About, err)
+		}
+		levels := map[asks.Level]bool{}
+		for _, o := range q.Options {
+			levels[o.Level] = true
+		}
+		if len(levels) != 1 {
+			t.Errorf("the ask about %s mixes levels: %+v", q.About, q.Options)
+		}
+	}
+	byAbout := map[string]asks.Ask{}
+	for _, q := range sent {
+		byAbout[q.About] = q
+	}
+	if q := byAbout[key]; len(q.Options) != 1 || q.Options[0].Label != "Restart" {
+		t.Errorf("the condition's own ask: %+v", q)
+	}
+	if q := byAbout[key+".acknowledge"]; len(q.Options) != 1 || q.Options[0].Level != asks.Acknowledge {
+		t.Errorf("the acknowledging ask: %+v", q)
+	}
+	// Silence chosen: performed, and the Restart ask stays open, never asked twice.
+	answerWith(t, r, r.warrantFor(t, key, "Silence for a week"))
+	if len(r.silenced) != 1 || len(r.called) != 0 {
+		t.Fatalf("silenced %v called %v", r.silenced, r.called)
+	}
+	_ = r.a.reconcile(context.Background())
+	open := 0
+	for _, a := range r.store {
+		if a.State == askOpen && a.Condition == key {
+			open++
+			if a.Part != "" || a.Ask.Options[0].Label != "Restart" {
+				t.Errorf("the open ask is %+v", a)
+			}
+		}
+	}
+	if open != 1 || len(r.asksSent(t)) != 2 {
+		t.Errorf("after the silence: %d open, %d asked", open, len(r.asksSent(t)))
+	}
+	// And the approval still answers: Restart chosen on a channel that proves who answered is performed.
+	answerWith(t, r, r.warrantFor(t, key, "Restart"))
+	if len(r.called) != 1 || !strings.HasPrefix(r.called[0], "node-service-manager.restart@shanks") {
+		t.Errorf("the approval kept through a silence was not performed: %v", r.called)
+	}
+}
+
+// novox/hq issue 353: the controller's grant to ask is composed from the router's assignment and reaches the
+// bus only when its machine is pushed. Between the two, the bus refuses every ask (measured 2026-10-09, 17:54 to
+// 17:56 local: seven refusals of mesh.seat.operator-channel.accept.ask.mesh-controller). So nothing is asked
+// while the bus's user list is behind, it is said once, the conditions that need the operator are raised as
+// undelivered with what to do, and the asks go out once the bus holds the grant.
+func TestNothingIsAskedWhileTheBusLacksTheControllersGrant(t *testing.T) {
+	r := newAskerRig(t)
+	var said []string
+	r.a.logf = func(f string, a ...any) { said = append(said, fmt.Sprintf(f, a...)) }
+	var raised [][]conditions.Observation
+	r.a.raise = func(_ context.Context, obs []conditions.Observation) error {
+		raised = append(raised, obs)
+		return nil
+	}
+	held := false
+	r.a.grantHeld = func(context.Context) (bool, string, error) {
+		return held, "the bus's user list on anchor is behind what the mesh composes; `push anchor` carries it", nil
+	}
+	r.open = []conditions.Condition{heldCondition()}
+	_ = r.a.reconcile(context.Background())
+	_ = r.a.reconcile(context.Background())
+	if len(r.asksSent(t)) != 0 {
+		t.Error("asked while the bus lacks the grant")
+	}
+	n := 0
+	for _, s := range said {
+		if strings.Contains(s, "does not hold the controller's grant") {
+			n++
+		}
+	}
+	if n != 1 {
+		t.Errorf("said %d times: %q", n, said)
+	}
+	if len(raised) == 0 || len(raised[len(raised)-1]) != 1 ||
+		!strings.Contains(raised[len(raised)-1][0].Summary, "`push anchor` carries it") ||
+		raised[len(raised)-1][0].Kind != "asks-undelivered" {
+		t.Fatalf("not said as a condition with what to do: %+v", raised)
+	}
+	held = true
+	_ = r.a.reconcile(context.Background())
+	if sent := r.asksSent(t); len(sent) != 1 || sent[0].About != heldCondition().Key {
+		t.Errorf("not asked once the bus holds the grant: %+v", sent)
+	}
+	if last := raised[len(raised)-1]; len(last) != 0 {
+		t.Errorf("the undelivered condition was not cleared: %+v", last)
+	}
+}

cmd/mesh-controller/asker_wire.go

@@ -0,0 +1,337 @@
+package main
+
+// The asker on the bus: its asks in the controller's bucket `asked`, its asks and cancels published on the
+// seat under the controller's name, the verbs a warrant chooses called with the controller's grant, and the
+// router's record of its asks read under its name (novox/hq ADR 0259).
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"sort"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/nats-io/nats.go"
+	"github.com/nats-io/nats.go/jetstream"
+
+	"git.novox.be/novox/mesh-sdk/go/asks"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// askerFrom is the serving controller's asker; nil in any other process.
+var askerFrom *asker
+
+// askWithin is how long a verb a warrant chose is given to answer.
+const askWithin = time.Minute
+
+type busAsked struct{ conn *nats.Conn }
+
+func (b busAsked) kv(ctx context.Context) (jetstream.KeyValue, error) {
+	js, err := jetstream.New(b.conn)
+	if err != nil {
+		return nil, err
+	}
+	return js.KeyValue(ctx, broker.AskedBucket)
+}
+
+func (b busAsked) Get(ctx context.Context, id string) (*asked, error) {
+	kv, err := b.kv(ctx)
+	if err != nil {
+		return nil, err
+	}
+	e, err := kv.Get(ctx, id)
+	if errors.Is(err, jetstream.ErrKeyNotFound) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	var r asked
+	return &r, json.Unmarshal(e.Value(), &r)
+}
+
+// Create keeps a new ask under its id, and only where none is kept: never over another.
+func (b busAsked) Create(ctx context.Context, r asked) error {
+	kv, err := b.kv(ctx)
+	if err != nil {
+		return err
+	}
+	body, err := json.Marshal(r)
+	if err != nil {
+		return err
+	}
+	_, err = kv.Create(ctx, r.ID, body)
+	return err
+}
+
+// Change applies change to the ask kept under id by compare-and-set on its key's revision (the review of
+// 2026-10-09, L2): read, changed, and written only over the revision read; when another write came between,
+// read again and asked again, at most askChangeTries times. change says whether to write at all.
+func (b busAsked) Change(ctx context.Context, id string, change func(*asked) bool) (bool, error) {
+	kv, err := b.kv(ctx)
+	if err != nil {
+		return false, err
+	}
+	for try := 0; try < askChangeTries; try++ {
+		e, err := kv.Get(ctx, id)
+		if errors.Is(err, jetstream.ErrKeyNotFound) {
+			return false, nil
+		}
+		if err != nil {
+			return false, err
+		}
+		var r asked
+		if err := json.Unmarshal(e.Value(), &r); err != nil {
+			return false, err
+		}
+		if !change(&r) {
+			return false, nil
+		}
+		body, err := json.Marshal(r)
+		if err != nil {
+			return false, err
+		}
+		if _, err := kv.Update(ctx, id, body, e.Revision()); err != nil {
+			var api *jetstream.APIError
+			if errors.Is(err, jetstream.ErrKeyExists) || (errors.As(err, &api) && api.ErrorCode == jetstream.JSErrCodeStreamWrongLastSequence) {
+				continue
+			}
+			return false, err
+		}
+		return true, nil
+	}
+	return false, fmt.Errorf("the ask %s changed under every one of %d tries", id, askChangeTries)
+}
+
+func (b busAsked) All(ctx context.Context) ([]asked, error) {
+	kv, err := b.kv(ctx)
+	if err != nil {
+		return nil, err
+	}
+	lister, err := kv.ListKeys(ctx)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = lister.Stop() }()
+	var out []asked
+	for k := range lister.Keys() {
+		e, err := kv.Get(ctx, k)
+		if err != nil {
+			continue
+		}
+		var r asked
+		if json.Unmarshal(e.Value(), &r) == nil {
+			out = append(out, r)
+		}
+	}
+	return out, nil
+}
+
+// callAction performs an action's verb as the controller, through the grant that names it.
+func callAction(conn *nats.Conn) func(ctx context.Context, a conditions.Action, args map[string]string) error {
+	return func(ctx context.Context, a conditions.Action, args map[string]string) error {
+		seat, verb, ok := strings.Cut(a.Verb, ".")
+		if !ok {
+			return fmt.Errorf("%q names no seat and verb", a.Verb)
+		}
+		body := map[string]any{}
+		for k, v := range args {
+			body[k] = v
+		}
+		if seat == catalogue.DeliverySeat {
+			_, err := askDeliveryOwner(ctx, conn, verb, body)
+			return err
+		}
+		granted := false
+		for _, v := range broker.VerbsTheControllerActsOnAWarrant {
+			granted = granted || (v.Seat == seat && v.Verb == verb)
+		}
+		if !granted {
+			return fmt.Errorf("%s: %w", a.Verb, errNotGranted)
+		}
+		var answer link.Answer
+		var err error
+		if a.Machine != "" {
+			answer, err = link.AskSeatTool(ctx, conn, seat, verb, a.Machine, body, askWithin)
+		} else {
+			answer, err = link.AskMeshSeatTool(ctx, conn, seat, verb, body, askWithin)
+		}
+		if err != nil {
+			return err
+		}
+		if answer.Error != "" {
+			return fmt.Errorf("%s refused: %s", a.Verb, answer.Error)
+		}
+		return nil
+	}
+}
+
+// routerRecordOf reads the router's record of one of the controller's asks, under its name, and answers
+// how it ended when it did: the bucket is the one the asks seat's declarer names as its records.
+func routerRecordOf(conn *nats.Conn, inv *inventory.Inventory) func(ctx context.Context, id string) (*asks.Warrant, error) {
+	return func(ctx context.Context, id string) (*asks.Warrant, error) {
+		bucket, err := asksRecords(ctx, inv)
+		if err != nil || bucket == "" {
+			return nil, err
+		}
+		reply, err := conn.RequestWithContext(ctx, "$JS.API.DIRECT.GET.KV_"+bucket+".$KV."+bucket+"."+askerName+"."+id, nil)
+		if err != nil {
+			return nil, err
+		}
+		if reply.Header.Get("Status") != "" {
+			return nil, nil // none, or not readable: the event says it
+		}
+		var rec struct {
+			State   string        `json:"state"`
+			Warrant *asks.Warrant `json:"warrant"`
+		}
+		if json.Unmarshal(reply.Data, &rec) != nil || rec.State == "open" || rec.Warrant == nil {
+			return nil, nil
+		}
+		return rec.Warrant, nil
+	}
+}
+
+// asksRecords is the bucket the asks seat's declarer keeps its record of asks in.
+func asksRecords(ctx context.Context, inv *inventory.Inventory) (string, error) {
+	declared, err := inv.Catalogue(ctx)
+	if err != nil {
+		return "", err
+	}
+	for _, m := range declared {
+		for _, s := range m.DefinesSeats {
+			if s.Name == broker.AsksSeat && len(s.Records) > 0 {
+				return broker.BucketName(m.Module, s.Records[0]), nil
+			}
+		}
+	}
+	return "", nil
+}
+
+// routerHereIn says whether a module declaring the asks seat, with its ask named by its caller, is assigned:
+// without it nothing takes an ask, and asking would only fill a queue nobody reads.
+func routerHereIn(inv *inventory.Inventory) func(ctx context.Context) (bool, error) {
+	return func(ctx context.Context) (bool, error) {
+		entries, err := inv.Catalogued(ctx)
+		if err != nil {
+			return false, err
+		}
+		for _, e := range entries {
+			for _, s := range e.Manifest.DefinesSeats {
+				if s.Name == broker.AsksSeat && s.NamedByCaller("ask") && len(e.On) > 0 {
+					return true, nil
+				}
+			}
+		}
+		return false, nil
+	}
+}
+
+// grantHeldIn says whether the bus holds the controller's grant to ask (novox/hq issue 353): the user list the
+// machine holding the bus was last sent is the one the mesh composes now (brokerBehind, the same judgement a
+// push makes to send that machine first). While it is behind, the controller's ask is refused by the bus,
+// whatever the record says of the router, so nothing is asked and the operator is told to push that machine.
+// Judged at most every grantLookEvery: composing the list resolves the bus's machine whole.
+func grantHeldIn(open *stores) func(ctx context.Context) (bool, string, error) {
+	var mu sync.Mutex
+	var at time.Time
+	var held bool
+	var why string
+	return func(ctx context.Context) (bool, string, error) {
+		mu.Lock()
+		defer mu.Unlock()
+		if !at.IsZero() && time.Since(at) < grantLookEvery {
+			return held, why, nil
+		}
+		machine, behind, err := brokerBehind(ctx, open, nil)
+		if err != nil {
+			return false, "", err
+		}
+		at, held, why = time.Now(), !behind, ""
+		if behind {
+			why = fmt.Sprintf("the bus's user list on %s is behind what the mesh composes, so the bus has not been "+
+				"given the controller's grant to ask; `push %s` carries it", machine, machine)
+		}
+		return held, why, nil
+	}
+}
+
+// grantLookEvery is how often the bus's user list is judged against the one its machine was last sent.
+const grantLookEvery = 30 * time.Second
+
+// channelsIn is what the channels are now, as a fingerprint: each module claiming a kind of the channel
+// bench, where, promising what, and whether of its own account. An ask the router refused is asked again
+// once this changes.
+func channelsIn(inv *inventory.Inventory) func(ctx context.Context) string {
+	return func(ctx context.Context) string {
+		entries, err := inv.Catalogued(ctx)
+		if err != nil {
+			return ""
+		}
+		var parts []string
+		for _, e := range entries {
+			for _, c := range e.Manifest.Claims {
+				if c.Kind == "" || !catalogue.KindedBenches[c.Name] {
+					continue
+				}
+				on := append([]string(nil), e.On...)
+				sort.Strings(on)
+				caps := append([]string(nil), c.Capabilities...)
+				sort.Strings(caps)
+				parts = append(parts, fmt.Sprintf("%s/%s=%s@%s[%s]own:%t", c.Name, c.Kind, e.Manifest.Module,
+					strings.Join(on, ","), strings.Join(caps, ","), e.Manifest.RunsAs != ""))
+			}
+		}
+		sort.Strings(parts)
+		return strings.Join(parts, ";")
+	}
+}
+
+// startAsking makes the serving controller's asker and hands it the router's words.
+func startAsking(ctx context.Context, open *stores, server *link.Server, conn *nats.Conn, keeper *conditions.Keeper) {
+	js, err := jetstream.New(conn)
+	if err != nil {
+		fmt.Printf("the operator cannot be asked: %v\n", err)
+		return
+	}
+	a := &asker{
+		open: keeper.Open,
+		silence: func(ctx context.Context, key string, d time.Duration, by, why string) error {
+			_, err := keeper.Silence(ctx, key, d, by, why)
+			return err
+		},
+		store: busAsked{conn: conn},
+		publish: func(ctx context.Context, subject string, body []byte, id string) error {
+			_, err := js.Publish(ctx, subject, body, jetstream.WithMsgID(id))
+			return err
+		},
+		call: callAction(conn),
+		record: func(ctx context.Context, act link.HandAct) error {
+			_, err := link.RecordHandAct(ctx, conn, act)
+			return err
+		},
+		routerRecord: routerRecordOf(conn, open.inventory),
+		routerHere:   routerHereIn(open.inventory),
+		grantHeld:    grantHeldIn(open),
+		channels:     channelsIn(open.inventory),
+		raise: func(ctx context.Context, obs []conditions.Observation) error {
+			return keeper.Reconcile(ctx, sourceAsker, obs)
+		},
+		now:  time.Now,
+		logf: func(format string, args ...any) { fmt.Printf(format+"\n", args...) },
+	}
+	if err := server.Decides(a); err != nil {
+		fmt.Printf("the operator's answers cannot be heard, so nothing is asked: %v\n", err)
+		return
+	}
+	askerFrom = a
+	go a.keep(ctx)
+}

cmd/mesh-controller/busobjects.go

@@ -53,9 +53,26 @@ func assertBusObjects(ctx context.Context, inv *inventory.Inventory, r broker.Ra
 	if err != nil {
 		return nil, err
 	}
+	// And the work queues of seats that name their caller or their kind, with each holder's worker
+	// (novox/hq ADR 0259 §3): an ask queues until the router takes it, a channel's work until that kind
+	// takes it.
+	trafficStreams, trafficWorkers, err := seatTrafficObjects(ctx, inv)
+	if err != nil {
+		return nil, err
+	}
 	// Every one tried, and every failure named: one module's consumer the bus refuses is no reason
 	// the modules after it in the list hear nothing (novox/hq issue 208, where this runs on each send).
 	var failed []error
+	for _, s := range trafficStreams {
+		if err := r.EnsureStream(s); err != nil {
+			failed = append(failed, fmt.Errorf("the work queue %s: %w", s.Name, err))
+		}
+	}
+	for _, c := range trafficWorkers {
+		if err := r.EnsureConsumer(c); err != nil {
+			failed = append(failed, fmt.Errorf("the worker %s on %s: %w", c.Name, c.Stream, err))
+		}
+	}
 	for _, c := range consumers {
 		if err := r.EnsureConsumer(c.Consumer); err != nil {
 			failed = append(failed, fmt.Errorf("how %s on %s hears what it consumes: %w", c.Module, c.Node, err))
@@ -130,6 +147,37 @@ func moduleConsumers(ctx context.Context, inv *inventory.Inventory) ([]broker.Mo
 	return broker.ConsumersOf(users), nil
 }
 
+// seatTrafficObjects is the work queues and workers of seats that name their caller or their kind, from
+// the records the user list is composed from.
+func seatTrafficObjects(ctx context.Context, inv *inventory.Inventory) ([]broker.Stream, []broker.Consumer, error) {
+	records, err := inv.BusRecords(ctx)
+	if err != nil {
+		return nil, nil, err
+	}
+	users, err := broker.Users(records)
+	if err != nil {
+		return nil, nil, err
+	}
+	streams, workers := broker.SeatTrafficObjects(users)
+	// And the queue of every such seat the catalogue declares, held or not: work queues from registration,
+	// so what is submitted before a holder is assigned waits for it (the correctness review of 2026-10-08).
+	declared, err := inv.DeclaredTrafficSeats(ctx)
+	if err != nil {
+		return nil, nil, err
+	}
+	have := map[string]bool{}
+	for _, s := range streams {
+		have[s.Name] = true
+	}
+	for _, s := range broker.TrafficQueues(declared) {
+		if !have[s.Name] {
+			streams = append(streams, s)
+			have[s.Name] = true
+		}
+	}
+	return streams, workers, nil
+}
+
 // moduleConsumerCount is how many modules hear what they consume, for the raise's one line.
 func moduleConsumerCount(ctx context.Context, inv *inventory.Inventory) (int, error) {
 	consumers, err := moduleConsumers(ctx, inv)

cmd/mesh-controller/conditions.go

@@ -47,7 +47,7 @@ func keeperOn(ctx context.Context, conn *nats.Conn) (*conditions.Keeper, error)
 		Say:    func(format string, args ...any) { fmt.Fprintf(os.Stderr, format+"\n", args...) },
 		// What status leads with changed: composed again soon (a nudge outside the serving controller
 		// does nothing).
-		Changed: statusFrom.nudge,
+		Changed: func() { statusFrom.nudge(); askerFrom.nudge() },
 		// Written under the lease, carrying its epoch (novox/hq to-be 45 §6).
 		Epoch: func() (uint64, error) { return theLease.epoch(context.WithoutCancel(ctx)) }}), nil
 }

cmd/mesh-controller/delivery_conditions_test.go

@@ -136,12 +136,13 @@ func TestTheDeliveryOwnerIsAskedOverTheBus(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	for _, verb := range []string{"stalled", "close"} {
+	// And release and stop, which the operator's warrant chooses (novox/hq ADR 0259).
+	for _, verb := range []string{"stalled", "close", "release", "stop"} {
 		if !slices.Contains(granted.Publish, link.SeatToolSubject(catalogue.DeliverySeat, verb)) {
 			t.Errorf("the controller may not ask %s.%s", catalogue.DeliverySeat, verb)
 		}
 	}
-	if _, err := askDeliveryOwner(t.Context(), nil, "stop", nil); err == nil || !strings.Contains(err.Error(), "grant") {
+	if _, err := askDeliveryOwner(t.Context(), nil, "retire-history", nil); err == nil || !strings.Contains(err.Error(), "grant") {
 		t.Fatalf("a verb the grant does not name was asked: %v", err)
 	}
 	conn, err := nats.Connect(testbus.URL(t))

cmd/mesh-controller/desk_secret.go

@@ -0,0 +1,265 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/nats-io/nats.go"
+
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/link"
+	"github.com/novox/mesh-controller/internal/secrets"
+)
+
+// A module's own secret given at the operator's desk (novox/hq ADR 0259 §10).
+//
+// **The value never passes through whoever asked for it.** An agent, or the operator at the mesh MCP
+// server, calls `give` with the machine, the module, the secret's name and the desk — never a value. The
+// controller makes a sealing keypair for this one call, asks the desk's `node-launcher.secret` to prompt the
+// operator without showing what is typed, and is answered with what was typed **sealed to that key**: no
+// plaintext on the bus, in a runtime's log or in any call's record. It opens it here, seals it to the
+// module's machine exactly as `secret accept` does, and forgets it. What it answers says only that the
+// value was taken, or why not.
+//
+// **What remains** (ADR 0234's accepted residual risk): on an X11 desk any program of the operator's
+// account can read the keys as they are typed. And a program that calls the desk's prompt itself, with a
+// key of its own, is answered with what the operator typed into a prompt they did not ask for — as it could
+// draw a window of its own. The prompt says who asks and for what, so the operator types only into a
+// prompt they started.
+
+// deskPromptWithin is how long the prompt waits for the operator: below the runtime's thirty seconds for
+// one call, as the launcher's menu is.
+const deskPromptWithin = 25
+
+// deskGive is the desk path, its four reaches given so a test needs no store and no bus.
+type deskGive struct {
+	// declares refuses a module or a secret the mesh would refuse, before anybody is asked to type.
+	declares func(module, name string) error
+	// known refuses a machine the mesh does not know, before anybody is asked to type; nil knows every one
+	// (a test that does not look).
+	known func(machine string) error
+	// trusted says a module runs as an account of its own: its secret is never taken at a desk (below). Nil is
+	// never (a test that does not look).
+	trusted func(module string) (bool, error)
+	// ask asks one machine's node-launcher.secret and answers its result, or the holder's refusal.
+	ask func(machine string, args map[string]any) (json.RawMessage, error)
+	// accept seals the value as `secret accept` does, and says whether it lives until the module's start.
+	accept func(value string) (untilStart bool, err error)
+	// record writes the act in the hand-act log.
+	record func(link.HandAct) error
+	// announce raises the condition that says a module's own secret was given (secretGivenObservation), on
+	// every channel; nil announces nothing (a test that does not look).
+	announce func(node, module, name, how string) error
+}
+
+// errNothingGiven is a prompt dismissed, or not answered in time: nothing changes.
+var errNothingGiven = errors.New("nothing was given")
+
+// give asks the desk for the value and seals it; it answers the words said to the caller.
+func (d deskGive) give(node, module, name, desk string) (string, error) {
+	for what, v := range map[string]string{"the machine": node, "the module": module, "the secret": name, "the desk": desk} {
+		if strings.TrimSpace(v) == "" {
+			return "", fmt.Errorf("%s is not named", what)
+		}
+	}
+	if d.known != nil {
+		for what, machine := range map[string]string{"the machine the secret is for": node, "the desk": desk} {
+			if err := d.known(machine); err != nil {
+				return "", fmt.Errorf("nobody was asked to type anything: %s, %s, is not a machine this mesh knows: %w",
+					what, machine, err)
+			}
+		}
+	}
+	if err := d.declares(module, name); err != nil {
+		return "", fmt.Errorf("nobody was asked to type anything: %w", err)
+	}
+	// **A trusted party's secret is not taken at a desk** (the confirmation review of 2026-10-09, N1-give). The
+	// prompt's answer comes back over the desk machine's bus, on a subject that machine's runtime answers — and
+	// on a desk machine agents run as the operator, who holds that runtime's credential. An agent could answer
+	// first, with a bot token of its own sealed to this call's key, and the channel the operator's answers are
+	// proven on would be the agent's. So the value of a module running as its own account is typed at the
+	// controller's terminal, where no bus carries it.
+	if d.trusted != nil {
+		trusted, err := d.trusted(module)
+		if err != nil {
+			return "", fmt.Errorf("nobody was asked to type anything: whether %s is a trusted party could not be read: %w", module, err)
+		}
+		if trusted {
+			return "", fmt.Errorf("nobody was asked to type anything: %s runs as an account of its own and proves the "+
+				"operator's answers, so its %s is given at the controller's terminal alone — there, run `mesh-controller "+
+				"secret accept %s %s %s` and type it at its prompt. A desk's prompt is answered over the desk machine's "+
+				"bus, where an agent may answer first (novox/hq ADR 0259 §10)", module, name, node, module, name)
+		}
+	}
+	public, private, err := secrets.Keypair()
+	if err != nil {
+		return "", fmt.Errorf("no key could be made to take the value: %w", err)
+	}
+	// By name, never by words: the holder writes the prompt from these, and says the controller asks, which
+	// the bus alone makes true (broker.ControllerOnly).
+	raw, err := d.ask(desk, map[string]any{
+		"module":          module,
+		"secret":          name,
+		"node":            node,
+		"seal_to":         public,
+		"timeout_seconds": deskPromptWithin,
+	})
+	if err != nil {
+		return "", fmt.Errorf("the desk on %s could not be asked: %w", desk, err)
+	}
+	var answer struct {
+		Sealed    string `json:"sealed"`
+		Cancelled bool   `json:"cancelled"`
+		TimedOut  bool   `json:"timed_out"`
+	}
+	if err := json.Unmarshal(raw, &answer); err != nil {
+		return "", fmt.Errorf("the desk on %s answered something that is not the prompt's answer", desk)
+	}
+	switch {
+	case answer.TimedOut:
+		return "", fmt.Errorf("%w: the prompt on %s was not answered within %d seconds", errNothingGiven, desk, deskPromptWithin)
+	case answer.Cancelled:
+		return "", fmt.Errorf("%w: the prompt on %s was dismissed", errNothingGiven, desk)
+	case answer.Sealed == "":
+		return "", fmt.Errorf("the desk on %s answered no sealed value", desk)
+	}
+	opened, err := secrets.Open(private, answer.Sealed)
+	if err != nil {
+		// Never the value, never what failed to open: only that it was not sealed to this call.
+		return "", fmt.Errorf("the desk on %s answered a value not sealed to this call; nothing was taken", desk)
+	}
+	value := asSupplied(string(opened))
+	for i := range opened {
+		opened[i] = 0
+	}
+	if strings.TrimSpace(value) == "" {
+		return "", fmt.Errorf("%w: the prompt on %s was answered empty", errNothingGiven, desk)
+	}
+	untilStart, err := d.accept(value)
+	value = ""
+	if err != nil {
+		return "", err
+	}
+	act := link.HandAct{Verb: "secret accept", Args: []string{node, module, name, "--at-desk", desk},
+		Why:   fmt.Sprintf("the operator gave %s for %s on %s at the desk on %s", name, module, node, desk),
+		Cause: "given-at-the-desk"}
+	recorded := ""
+	if err := d.record(act); err != nil {
+		recorded = fmt.Sprintf("\n  this act could NOT be recorded in the hand-act log, and is done anyway: %v", err)
+	}
+	if d.announce != nil {
+		if err := d.announce(node, module, name, "at the desk on "+desk); err != nil {
+			recorded += fmt.Sprintf("\n  this change could NOT be announced on the operator's channels: %v", err)
+		}
+	}
+	words := fmt.Sprintf("%s on %s now holds %q, given at the desk on %s and sealed to %s; the mesh cannot read it "+
+		"back.\n  run `push %s` to send it", module, node, name, desk, node, node)
+	if untilStart {
+		words += fmt.Sprintf("\n  it lives until %s next starts well under the mesh, and is then replaced with a value "+
+			"the mesh makes (ADR 0228)", module)
+	}
+	return words + recorded, nil
+}
+
+// giveAtDesk is `secret accept <node> <module> <name> --at-desk <machine>`: the desk path, on this
+// controller's stores and bus.
+func giveAtDesk(ctx context.Context, node, module, name, desk string) error {
+	open, err := openStores(ctx)
+	if err != nil {
+		return err
+	}
+	defer open.Close()
+	d := deskGive{
+		declares: func(module, name string) error { return open.inventory.DeclaresOwnSecret(ctx, module, name) },
+		known: func(machine string) error {
+			_, err := open.inventory.NodeByName(ctx, machine)
+			return err
+		},
+		trusted: func(module string) (bool, error) { return open.inventory.RunsAsItsOwnAccount(ctx, module) },
+		ask: func(machine string, args map[string]any) (json.RawMessage, error) {
+			var result json.RawMessage
+			err := onTheBus(func(conn *nats.Conn) error {
+				answer, err := link.AskSeatTool(ctx, conn, "node-launcher", "secret", machine, args,
+					time.Duration(deskPromptWithin+5)*time.Second)
+				if err != nil {
+					return err
+				}
+				if answer.Error != "" {
+					return errors.New(answer.Error)
+				}
+				result = answer.Result
+				return nil
+			})
+			return result, err
+		},
+		accept: func(value string) (bool, error) {
+			return open.inventory.AcceptGivenSecret(ctx, node, module, name, value)
+		},
+		record: func(act link.HandAct) error {
+			return onTheBus(func(conn *nats.Conn) error {
+				_, err := link.RecordHandAct(ctx, conn, act)
+				return err
+			})
+		},
+		announce: func(node, module, name, how string) error { return announceSecretGiven(ctx, node, module, name, how) },
+	}
+	words, err := d.give(node, module, name, desk)
+	if err != nil {
+		return err
+	}
+	fmt.Println(words)
+	return nil
+}
+
+// kindSecretGiven is the condition every value given for a module's own secret raises (the review of 2026-10-09,
+// M4): on every channel, so a bot token changed by somebody else — a channel that now answers for them — is
+// heard of. It stays until the operator silences or clears it.
+const kindSecretGiven = "secret-given"
+
+// secretGivenObservation is that condition: which secret, of which module on which machine, how and when.
+// The summary, for whoever looks closer, names the secret and the time. The words the operator reads are
+// held to the plain rule (conditions.PlainWords): no clock time — the channel says when, in the operator's
+// time — and the secret's name said as words. Words that broke the rule were replaced by the keeper with
+// "needs a look … a problem it calls secret given" (hq issue 359), which told the operator nothing.
+func secretGivenObservation(node, module, name, how string, at time.Time) conditions.Observation {
+	key := node + "." + module + "." + name
+	where := module + " on " + node
+	// Within the bounds whatever the names' length: the module and machine, else the module, else the machine.
+	headline := "New secret given for " + where
+	for _, h := range []string{"New secret given for " + module, "New secret given on " + node} {
+		if len(headline) > conditions.HeadlineMax {
+			headline = h
+		}
+	}
+	resolved := "You saw that " + module + " was given a new secret"
+	if len(resolved) > conditions.HeadlineMax+20 {
+		resolved = "You saw that a new secret was given on " + node
+	}
+	return conditions.Observation{Scope: conditions.ScopeMachine, ID: key, Token: kindSecretGiven, Kind: kindSecretGiven,
+		Machine: node, Severity: conditions.Urgent, Source: kindSecretGiven,
+		Summary: fmt.Sprintf("%s of %s on %s was given %s at %s", name, module, node, how,
+			at.Local().Format("2006-01-02 15:04")),
+		Headline: headline,
+		Explanation: fmt.Sprintf("The secret %s of %s was given %s. If you gave it, nothing else is needed. If you "+
+			"did not, somebody else now holds what %s acts with.", secretNameWords(name), where, how, module),
+		Needs:    "silence this if you just gave it; if you did not, give it again yourself so that only you hold it.",
+		Resolved: resolved,
+		Actions:  []conditions.Action{conditions.SilenceAction(conditions.Key(conditions.ScopeMachine, key, kindSecretGiven))}}
+}
+
+// secretNameWords is a secret's name as the operator reads it: "telegram-token" is "telegram token".
+func secretNameWords(name string) string {
+	return strings.Join(strings.FieldsFunc(name, func(r rune) bool { return r == '-' || r == '_' || r == '.' }), " ")
+}
+
+// announceSecretGiven raises it on this controller's keeper.
+func announceSecretGiven(ctx context.Context, node, module, name, how string) error {
+	return withKeeper(ctx, func(k *conditions.Keeper) error {
+		_, err := k.Observe(ctx, secretGivenObservation(node, module, name, how, time.Now()))
+		return err
+	})
+}

cmd/mesh-controller/desk_secret_test.go

@@ -0,0 +1,400 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/link"
+	"github.com/novox/mesh-controller/internal/secrets"
+)
+
+const typed = "123456789:AAEhBP0av28P4XFQnIuR-o-7Xnz1kkUzW3g"
+
+// aDesk is the desk path with a prompt the test answers as the operator would, and what it was asked kept.
+func aDesk(t *testing.T, answer func(args map[string]any) (json.RawMessage, error)) (deskGive, *[]string, *[]link.HandAct, *[]map[string]any) {
+	t.Helper()
+	var accepted []string
+	var acts []link.HandAct
+	var asked []map[string]any
+	return deskGive{
+		declares: func(module, name string) error {
+			if module != "telegram" || name != "telegram-token" {
+				return errors.New(module + " does not declare " + name + " as an own secret")
+			}
+			return nil
+		},
+		ask: func(machine string, args map[string]any) (json.RawMessage, error) {
+			asked = append(asked, args)
+			return answer(args)
+		},
+		accept: func(value string) (bool, error) { accepted = append(accepted, value); return false, nil },
+		record: func(a link.HandAct) error { acts = append(acts, a); return nil },
+	}, &accepted, &acts, &asked
+}
+
+func sealedTo(t *testing.T, value string) func(args map[string]any) (json.RawMessage, error) {
+	return func(args map[string]any) (json.RawMessage, error) {
+		sealed, err := secrets.Seal(args["seal_to"].(string), []byte(value+"\n"))
+		if err != nil {
+			t.Fatal(err)
+		}
+		raw, _ := json.Marshal(map[string]any{"sealed": sealed})
+		return raw, nil
+	}
+}
+
+// novox/hq ADR 0259 §10: the value typed at the desk is sealed as `secret accept` seals it, and is in no
+// answer, no prompt argument and no act recorded.
+func TestASecretGivenAtTheDeskIsSealedAndSaidNowhere(t *testing.T) {
+	d, accepted, acts, asked := aDesk(t, sealedTo(t, typed))
+	words, err := d.give("anchor", "telegram", "telegram-token", "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(*accepted) != 1 || (*accepted)[0] != typed {
+		t.Fatalf("the value sealed is not what was typed, its line ending taken off")
+	}
+	if len(*acts) != 1 || (*acts)[0].Verb != "secret accept" || (*acts)[0].Cause != "given-at-the-desk" ||
+		!strings.Contains((*acts)[0].Why, "at the desk on laptop") {
+		t.Errorf("the act: %+v", *acts)
+	}
+	raw, _ := json.Marshal(struct {
+		Words string
+		Acts  []link.HandAct
+		Asked []map[string]any
+	}{words, *acts, *asked})
+	if strings.Contains(string(raw), typed) || strings.Contains(string(raw), "AAEhBP0") {
+		t.Fatal("the value appears in what was said, asked or recorded")
+	}
+	if !strings.Contains(words, "push anchor") || !strings.Contains(words, "given at the desk on laptop") {
+		t.Errorf("%q", words)
+	}
+	if p := (*asked)[0]; p["seal_to"] == "" || p["timeout_seconds"] != deskPromptWithin {
+		t.Errorf("the prompt was asked %v", p)
+	}
+}
+
+func TestNothingIsAskedForASecretTheMeshWouldRefuse(t *testing.T) {
+	for _, c := range [][2]string{{"telegram", "chat-id"}, {"nobody", "telegram-token"}} {
+		d, accepted, _, asked := aDesk(t, sealedTo(t, typed))
+		if _, err := d.give("anchor", c[0], c[1], "laptop"); err == nil || !strings.Contains(err.Error(), "nobody was asked") {
+			t.Errorf("%v: %v", c, err)
+		}
+		if len(*asked) != 0 || len(*accepted) != 0 {
+			t.Errorf("%v: the operator was asked anyway", c)
+		}
+	}
+	d, _, _, _ := aDesk(t, sealedTo(t, typed))
+	if _, err := d.give("anchor", "telegram", "telegram-token", ""); err == nil {
+		t.Error("no desk was refused nowhere")
+	}
+}
+
+func TestADismissedEmptyLateOrForeignAnswerTakesNothing(t *testing.T) {
+	for want, answer := range map[string]func(map[string]any) (json.RawMessage, error){
+		"not answered within 25 seconds": func(map[string]any) (json.RawMessage, error) {
+			return json.RawMessage(`{"cancelled":true,"timed_out":true}`), nil
+		},
+		"was dismissed":  func(map[string]any) (json.RawMessage, error) { return json.RawMessage(`{"cancelled":true}`), nil },
+		"answered empty": sealedTo(t, "  "),
+		"not sealed to this call": func(map[string]any) (json.RawMessage, error) {
+			other, _, _ := secrets.Keypair()
+			sealed, _ := secrets.Seal(other, []byte(typed))
+			raw, _ := json.Marshal(map[string]any{"sealed": sealed})
+			return raw, nil
+		},
+		"could not be asked": func(map[string]any) (json.RawMessage, error) { return nil, errors.New("no session answers") },
+	} {
+		d, accepted, acts, _ := aDesk(t, answer)
+		_, err := d.give("anchor", "telegram", "telegram-token", "laptop")
+		if err == nil || !strings.Contains(err.Error(), want) || strings.Contains(err.Error(), typed) {
+			t.Errorf("want %q, got %v", want, err)
+		}
+		if len(*accepted) != 0 || len(*acts) != 0 {
+			t.Errorf("%s: something was taken or recorded", want)
+		}
+	}
+}
+
+func TestTheGiveVerbRunsTheDeskPathAndTheControllerMayAskTheDesk(t *testing.T) {
+	argv, err := argvFor("give", map[string]any{"node": "anchor", "module": "telegram", "secret": "telegram-token", "at": "laptop"})
+	if err != nil || strings.Join(argv, " ") != "secret accept anchor telegram telegram-token --at-desk laptop" {
+		t.Fatalf("%v %v", argv, err)
+	}
+	if _, err := argvFor("give", map[string]any{"node": "anchor", "module": "telegram", "secret": "telegram-token"}); err == nil {
+		t.Error("give without a desk was taken")
+	}
+	perms, err := broker.PermissionsFor(broker.Principal{Kind: broker.KindController})
+	if err != nil {
+		t.Fatal(err)
+	}
+	found := false
+	for _, p := range perms.Publish {
+		found = found || p == "mesh.seat.node-launcher.tool.secret.*"
+	}
+	if !found {
+		t.Error("the controller may not ask the desk's prompt")
+	}
+}
+
+// The review of 2026-10-09 (M4): the desk's prompt says who asks in words the caller does not choose — the
+// controller, which the bus alone lets ask it — and what for, from names the controller checked; the prompt
+// carries no free text of the caller's.
+func TestThePromptIsAskedByNameNeverByWordsTheCallerChose(t *testing.T) {
+	d, _, _, asked := aDesk(t, sealedTo(t, typed))
+	if _, err := d.give("anchor", "telegram", "telegram-token", "laptop"); err != nil {
+		t.Fatal(err)
+	}
+	p := (*asked)[0]
+	if p["module"] != "telegram" || p["secret"] != "telegram-token" || p["node"] != "anchor" {
+		t.Errorf("the prompt was not asked by name: %v", p)
+	}
+	for _, free := range []string{"prompt", "message"} {
+		if _, there := p[free]; there {
+			t.Errorf("the prompt carries the caller's %s: %v", free, p)
+		}
+	}
+}
+
+// Every value given for a module's own secret is announced as a condition, on every channel (the review of
+// 2026-10-09, M4): a bot token changed by somebody else is a channel that now answers for them.
+func TestAValueGivenAtTheDeskIsAnnounced(t *testing.T) {
+	d, _, _, _ := aDesk(t, sealedTo(t, typed))
+	var said []string
+	d.announce = func(node, module, name, how string) error {
+		said = append(said, node+" "+module+" "+name+" "+how)
+		return nil
+	}
+	if _, err := d.give("anchor", "telegram", "telegram-token", "laptop"); err != nil {
+		t.Fatal(err)
+	}
+	if len(said) != 1 || !strings.Contains(said[0], "anchor telegram telegram-token") || !strings.Contains(said[0], "laptop") {
+		t.Fatalf("announced %v", said)
+	}
+	o := secretGivenObservation("anchor", "telegram", "telegram-token", "at the desk on laptop", time.Date(2026, 10, 9, 12, 3, 0, 0, time.UTC))
+	if o.Severity != conditions.Urgent || !strings.Contains(o.Explanation, "telegram token") ||
+		len(o.Actions) == 0 || o.Key() == "" {
+		t.Errorf("the announcement %+v", o)
+	}
+	if strings.Contains(o.Summary+o.Explanation+o.Said, typed) {
+		t.Error("the announcement carries the value")
+	}
+}
+
+// **The secret-given condition says itself in its own plain words** (hq issue 359): the words it carries pass
+// the plain rule, from the controller's terminal and from a desk, so the keeper keeps them — they once held a
+// clock time, and the operator read "Novox needs a look … a problem it calls secret given" instead. Its
+// severity and its answer stay: it is heard on every channel, and silenced by the operator.
+func TestTheSecretGivenConditionSaysItselfInPlainWords(t *testing.T) {
+	at := time.Date(2026, 10, 9, 23, 32, 0, 0, time.Local)
+	for _, how := range []string{"at the controller's terminal", "at the desk on laptop"} {
+		o := secretGivenObservation("anchor", "telegram", "telegram-token", how, at)
+		w := conditions.Words{Headline: o.Headline, Explanation: o.Explanation, Resolved: o.Resolved, Needs: o.Needs,
+			Actions: o.Actions}
+		if why, ok := conditions.PlainWords(w, o.Machine); !ok {
+			t.Fatalf("given %s, the words are not plain: %s", how, why)
+		}
+		k, _ := withConditionsInMemory(t)
+		c, err := k.Observe(t.Context(), o)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if c.Headline != "New secret given for telegram on anchor" || c.Severity != conditions.Urgent ||
+			!strings.HasPrefix(c.Explanation, conditions.NeedsYou+" silence this") ||
+			!strings.Contains(c.Explanation, "telegram token of telegram on anchor was given "+how) ||
+			len(c.Actions) != 1 || c.Actions[0].Label != "Silence for a week" {
+			t.Errorf("given %s, the keeper said %q / %q (%s, %v)", how, c.Headline, c.Explanation, c.Severity, c.Actions)
+		}
+		if strings.Contains(c.Headline+c.Explanation+c.Resolved+c.Needs, typed) {
+			t.Error("the words carry the value")
+		}
+	}
+	// A long module name keeps the headline and the resolved line within their bounds.
+	for _, module := range []string{"a-module-with-a-rather-long-name-indeed",
+		"a-module-with-a-name-so-long-that-no-headline-could-ever-hold-it"} {
+		o := secretGivenObservation("anchor", module, "api-key", "at the controller's terminal", at)
+		if why, ok := conditions.PlainWords(conditions.Words{Headline: o.Headline, Explanation: o.Explanation,
+			Resolved: o.Resolved, Needs: o.Needs, Actions: o.Actions}, o.Machine); !ok {
+			t.Errorf("the module %s: %s", module, why)
+		}
+	}
+}
+
+// The bus lets the controller alone ask the desk's prompt (the review of 2026-10-09, M4): the runtime, which
+// carries every agent's calls, and a person granted every tool are denied it, however wide their grant.
+func TestOnlyTheControllerMayAskTheDesksPrompt(t *testing.T) {
+	for _, p := range []broker.Principal{
+		{Kind: broker.KindNodeTools, Node: "laptop"},
+		{Kind: broker.KindPerson, Module: "operator", Invokes: []string{"*"}},
+		{Kind: broker.KindModule, Node: "laptop", Module: "lab", Invokes: []string{"seat:node-launcher.secret"}},
+	} {
+		perms, err := broker.PermissionsFor(p)
+		if err != nil {
+			t.Fatal(err)
+		}
+		for _, subject := range []string{"mesh.seat.node-launcher.tool.secret.laptop", "mesh.seat.node-launcher.tool.secret",
+			"mesh.mod.rofi.tool.node-launcher.secret", "mesh.mod.rofi.tool.node-launcher.secret.laptop"} {
+			if broker.MayPublish(perms, subject) {
+				t.Errorf("%s may publish %s", p.Username(), subject)
+			}
+		}
+	}
+	perms, _ := broker.PermissionsFor(broker.Principal{Kind: broker.KindController})
+	if !broker.MayPublish(perms, "mesh.seat.node-launcher.tool.secret.laptop") {
+		t.Error("the controller may not ask the desk's prompt")
+	}
+}
+
+// A value for a secret comes from the terminal or the desk, never through a verb (the review of 2026-10-09,
+// M4): `secret accept` with a value, run for a verb, is refused before anything is read.
+func TestASecretValueIsNeverAcceptedThroughAVerb(t *testing.T) {
+	t.Setenv(verbVar, "mesh-controller.command")
+	for _, args := range [][]string{
+		{"accept", "anchor", "telegram", "telegram-token", "--from", "/dev/null"},
+		{"accept", "anchor", "app", "db", "--from", "/dev/null", "--provider", "store"},
+	} {
+		err := secretCommand(context.Background(), args)
+		if err == nil || !strings.Contains(err.Error(), "never through a verb") {
+			t.Errorf("%v: %v", args, err)
+		}
+	}
+}
+
+// The `give` verb's own line passes the terminal-only rule of ADR 0266, and no other `secret accept` does: a
+// value, a file, a provider or an extra word is still the terminal's alone.
+func TestOnlyTheGiveLinePassesTheTerminalRuleForSecrets(t *testing.T) {
+	if err := terminalOnly([]string{"secret", "accept", "anchor", "telegram", "telegram-token", "--at-desk", "laptop"}); err != nil {
+		t.Errorf("give's line refused: %v", err)
+	}
+	for _, argv := range [][]string{
+		{"secret", "accept", "anchor", "telegram", "telegram-token"},
+		{"secret", "accept", "anchor", "telegram", "telegram-token", "--from", "/tmp/x"},
+		{"secret", "accept", "anchor", "telegram", "telegram-token", "--at-desk", "laptop", "--local"},
+		{"secret", "accept", "anchor", "telegram", "--provider", "--at-desk", "laptop"},
+		{"secret", "export", "anchor", "telegram", "telegram-token", "--at-desk", "laptop"},
+	} {
+		if err := terminalOnly(argv); err == nil {
+			t.Errorf("%v passed the terminal rule", argv)
+		}
+	}
+}
+
+// The confirmation review of 2026-10-09, N1-give: a desk's prompt is answered over the desk machine's bus, and
+// on a desk machine agents run as the operator, who holds its runtime's credential — so a trusted party's
+// secret (a module running as an account of its own: the Telegram bot's token) is never taken at a desk.
+// Refused before anybody is asked to type, whoever called, naming the terminal's line.
+func TestATrustedPartysSecretIsNeverTakenAtADesk(t *testing.T) {
+	d, accepted, acts, asked := aDesk(t, sealedTo(t, typed))
+	d.trusted = func(module string) (bool, error) { return module == "telegram", nil }
+	_, err := d.give("anchor", "telegram", "telegram-token", "laptop")
+	if err == nil || !strings.Contains(err.Error(), "controller's terminal alone") ||
+		!strings.Contains(err.Error(), "secret accept anchor telegram telegram-token") {
+		t.Fatalf("a trusted party's secret was taken at the desk, or refused without the line: %v", err)
+	}
+	if len(*asked)+len(*accepted)+len(*acts) != 0 {
+		t.Errorf("asked %v, accepted %d, recorded %v", *asked, len(*accepted), *acts)
+	}
+	d.trusted = func(string) (bool, error) { return false, errors.New("the store did not answer") }
+	if _, err := d.give("anchor", "telegram", "telegram-token", "laptop"); err == nil || len(*asked) != 0 {
+		t.Errorf("a module not known to be untrusted was asked at the desk: %v", err)
+	}
+}
+
+// And who may answer the desk's prompt at all: only the runtime of the machine it is asked on, carrying the
+// launcher that holds the seat there — never the controller, another machine's runtime, or a module's own
+// account (the confirmation review of 2026-10-09, N1-give).
+func TestOnlyTheDeskMachinesLauncherMayAnswerItsPrompt(t *testing.T) {
+	launcher := broker.Declared{Module: "rofi", Holds: []broker.Seat{{Name: "node-launcher", Scope: "node",
+		Serves: []string{"run", "secret"}}}}
+	subject := "mesh.seat.node-launcher.tool.secret.laptop"
+	for _, c := range []struct {
+		p       broker.Principal
+		answers bool
+	}{
+		{broker.Principal{Kind: broker.KindNodeTools, Node: "laptop", Module: broker.RuntimeModule, Carries: []broker.Declared{launcher}}, true},
+		{broker.Principal{Kind: broker.KindNodeTools, Node: "anchor", Module: broker.RuntimeModule, Carries: []broker.Declared{launcher}}, false},
+		{broker.Principal{Kind: broker.KindController}, false},
+		{broker.Principal{Kind: broker.KindModule, Node: "laptop", Module: "lab"}, false},
+		{broker.Principal{Kind: broker.KindNode, Node: "laptop"}, false},
+	} {
+		perms, err := broker.PermissionsFor(c.p)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if got := broker.MaySubscribe(perms, subject); got != c.answers {
+			t.Errorf("%s may answer %s: %v, want %v", c.p.Username(), subject, got, c.answers)
+		}
+	}
+}
+
+// N1-give at the controller's terminal (the confirmation review of 2026-10-09): a trusted party's secret is
+// announced before it is kept, and not kept when the announcement fails; another module's is kept first and
+// a failed announcement is said, not undone.
+func TestATrustedPartysSecretGivenAtTheTerminalIsAnnouncedBeforeItIsKept(t *testing.T) {
+	var order []string
+	announce := func(fail bool) func() error {
+		return func() error {
+			order = append(order, "announce")
+			if fail {
+				return errors.New("no channel")
+			}
+			return nil
+		}
+	}
+	keep := func() (bool, error) { order = append(order, "keep"); return false, nil }
+
+	order = nil
+	if _, unannounced, err := keepGiven(true, announce(false), keep); err != nil || unannounced != nil ||
+		strings.Join(order, ",") != "announce,keep" {
+		t.Errorf("trusted: %v %v, order %v; want announced, then kept", unannounced, err, order)
+	}
+	order = nil
+	if _, _, err := keepGiven(true, announce(true), keep); err == nil || strings.Join(order, ",") != "announce" {
+		t.Errorf("trusted, announcement failed: %v, order %v; want refused and nothing kept", err, order)
+	}
+	order = nil
+	if _, unannounced, err := keepGiven(false, announce(true), keep); err != nil || unannounced == nil ||
+		strings.Join(order, ",") != "keep,announce" {
+		t.Errorf("not trusted: %v %v, order %v; want kept, then the failed announcement said", unannounced, err, order)
+	}
+	order = nil
+	failing := func() (bool, error) { order = append(order, "keep"); return false, errors.New("store away") }
+	if _, _, err := keepGiven(false, announce(false), failing); err == nil || strings.Join(order, ",") != "keep" {
+		t.Errorf("not trusted, keep failed: %v, order %v; want refused and nothing announced", err, order)
+	}
+}
+
+// A machine the mesh does not know, as the secret's or as the desk, is refused before anybody is asked to type.
+func TestAGiveNamingAMachineTheMeshDoesNotKnowAsksNobody(t *testing.T) {
+	for _, unknown := range []string{"elsewhere", "nodesk"} {
+		d, accepted, acts, asked := aDesk(t, func(map[string]any) (json.RawMessage, error) {
+			t.Fatal("the desk was asked")
+			return nil, nil
+		})
+		d.known = func(machine string) error {
+			if machine == unknown {
+				return errors.New("no node " + machine)
+			}
+			return nil
+		}
+		node, desk := "anchor", "laptop"
+		if unknown == "elsewhere" {
+			node = unknown
+		} else {
+			desk = unknown
+		}
+		_, err := d.give(node, "telegram", "telegram-token", desk)
+		if err == nil || !strings.Contains(err.Error(), "nobody was asked") || !strings.Contains(err.Error(), unknown) {
+			t.Errorf("%s: %v", unknown, err)
+		}
+		if len(*accepted)+len(*acts)+len(*asked) != 0 {
+			t.Errorf("%s: something happened: %v %v %v", unknown, *accepted, *acts, *asked)
+		}
+	}
+}

cmd/mesh-controller/doctor.go

@@ -126,6 +126,11 @@ var probeRegistry = []probe{
 	{ID: agentAccountProbe, Asserts: "every machine that names an agent account has it judged, on its node-engine's " +
 		"newest statement, unable to become root without a person", From: "ADR 0266, ADR 0259 §8",
 		Kind: kindAgentCanBecomeRoot, Phase: 1, run: probeAgentAccounts},
+	// Root where the trusted parties run (novox/hq ADR 0259 §8): while an agent can become root there without a
+	// person, an answer proven there proves nothing.
+	{ID: "D-root", Asserts: "no agent can become root without a person on a machine where the router or a channel " +
+		"proving its sender runs: not by its own account, and not through a tool that runs its command as an account " +
+		"that can", From: "ADR 0259 §8", Kind: kindRootNotFree, Phase: 2, run: probeAgentRoot},
 	{ID: "DW", Asserts: "the watchdogs of the signals table ran within three of their intervals",
 		From: "ADR 0227 rule 6: the watchers are watched", Kind: "watchdogs-silent", Phase: 1, run: probeWatchdogs},
 	// The core's health definitions (novox/hq to-be 45 §8, ADR 0236): what a core component's new build is

cmd/mesh-controller/found_wait_test.go

@@ -18,7 +18,7 @@ func foundDirectory(module string, since time.Time) inventory.ResourceHealth {
 	return inventory.ResourceHealth{Module: module, Resource: module + ".data", Kind: link.KindDirectory,
 		Target: "/srv/" + module, State: link.StateUnhealthy, Since: since,
 		Reason: link.ReasonUsedAsFound + " owned by 1000:1000, mode 700, as found; root, mode 755 was declared and " +
-			"not given it — `mesh-host hand-over` at the machine hands it to the mesh"}
+			"not given it — `nox node hand-over laptop <directory>` on the control-node, with its path, hands it to the mesh"}
 }
 
 func TestADirectoryFoundBeforeTheSendIsAWaitForAPerson(t *testing.T) {

cmd/mesh-controller/gate.go

@@ -87,6 +87,9 @@ const (
 	healthWaiting
 	healthNotYet
 	healthBroken
+	// healthSuperseded is a judging that cannot go on: the machine was sent another build of the module
+	// after the gate's send (novox/hq issue 352). No verdict on the build judged, and nothing put back.
+	healthSuperseded
 )
 
 // served is what one machine's node tools answered the bus's discovery with.
@@ -122,6 +125,39 @@ type gateFacts struct {
 	// groupsAdded is, per module, whether the move judged puts an account in a group its previous build did
 	// not (issue 318 review): the only move whose wait for a new login is excused.
 	groupsAdded map[string]bool
+	// sent is, per machine, the declaration the gate's own send carried there (novox/hq issue 352): a
+	// report is held against it, never against the send made last. sentBuilds is what each machine was
+	// last sent of every module, and judged the commit of each module this gate judges: a machine last
+	// sent another build of the module is not running the build judged.
+	sent       map[string]inventory.SentDeclaration
+	sentBuilds map[string]map[string]string
+	commits    map[string]string
+}
+
+// reportedOn says a machine's last report is on what the gate sent it (novox/hq issue 352): on that
+// declaration, or one it was sent after it — or, for a gate kept before sends were kept on it, on the
+// declaration last sent. On 2026-10-09 a release's gate read the control node's report against a newer
+// send another plan had just made there, and failed three builds the machine had reported healthy as
+// "has not reported on what it was sent".
+func (f gateFacts) reportedOn(machine string, r inventory.Reported) bool {
+	if sent, kept := f.sent[machine]; kept {
+		return sent.ReportsOn(r)
+	}
+	return r.Current
+}
+
+// supersededOn says the machine was last sent another build of the module than the one this gate judges
+// (novox/hq issue 352): the judging cannot go on, whatever the machine reports. On 2026-10-09 a controller
+// put back by one gate judged another gate's newer controller build passed on the same machine, reading
+// the put-back build's health as the newer one's.
+func (f gateFacts) supersededOn(module, machine string) (string, bool) {
+	judged, known := f.commits[module]
+	sent, has := f.sentBuilds[machine][module]
+	if !known || !has || judged == "" || sent == "" || sameCommit(sent, judged) {
+		return "", false
+	}
+	return fmt.Sprintf("%s was sent %s %s after this gate's %s: the build judged no longer runs there, and "+
+		"this judging is superseded by that send's", machine, module, short(sent), short(judged)), true
 }
 
 // gatherGateFacts reads what a judging needs, from the store, the bus and this controller's memory. A
@@ -199,9 +235,12 @@ func judgeHealth(module, component string, m catalogue.Manifest, machine string,
 		return healthBroken, fmt.Sprintf("the witness on %s judged the %s %s and %s: %s", machine, r.Component,
 			short(r.From), r.Outcome, r.Why)
 	}
+	if why, superseded := f.supersededOn(module, machine); superseded {
+		return healthSuperseded, why
+	}
 	r, said := f.reports[machine]
 	switch {
-	case !said || r.At == nil || !r.Current:
+	case !said || r.At == nil || !f.reportedOn(machine, r):
 		return healthNotYet, fmt.Sprintf("%s has not reported on what it was sent", machine)
 	case r.Outcome == inventory.OutcomeFailed || r.Outcome == inventory.OutcomeRefused:
 		return healthBroken, fmt.Sprintf("%s %s what it was sent", machine, r.Outcome)
@@ -209,7 +248,9 @@ func judgeHealth(module, component string, m catalogue.Manifest, machine string,
 		return healthNotYet, fmt.Sprintf("%s reported %q", machine, r.Outcome)
 	}
 	// **No new condition about it**: about the machine itself, or naming the module on that machine,
-	// raised since the judging began. The gate's own are not evidence about the build.
+	// raised since the judging began. The gate's own are not evidence about the build. A fault that was
+	// there at the send and reopened since is not new; one that had cleared before the send and came back
+	// after it is (OpenAt, novox/hq issue 348).
 	if f.judged {
 		if f.openErr != nil {
 			return healthNotYet, "what is wrong cannot be read, so whether the build made anything wrong is not known: " +
@@ -219,7 +260,7 @@ func judgeHealth(module, component string, m catalogue.Manifest, machine string,
 			// A wait for a person's new login, or for a directory used as found to be handed over, is the module's
 			// reading, not a fault raised since the send: the gate reads it from the statement below (ADR 0254,
 			// novox/hq issue 339).
-			if c.Source == gateProbe || c.Raised.Before(since) || c.Kind == kindReloginNeeded || c.Kind == kindUsedAsFound {
+			if c.Source == gateProbe || c.OpenAt(since) || c.Kind == kindReloginNeeded || c.Kind == kindUsedAsFound {
 				continue
 			}
 			onIt := c.Subject.Machine == machine || slices.Contains(c.Subject.Also, machine) ||
@@ -331,7 +372,7 @@ func aboutTheMachine(machine string, moved []string, since time.Time, f gateFact
 		aboutIt := c.Subject.Scope == conditions.ScopeMachine && (c.Subject.ID == machine || c.Subject.Machine == machine ||
 			slices.Contains(c.Subject.Also, machine))
 		// A directory used as found waits for a person, whatever the send did (novox/hq issue 339).
-		if !aboutIt || c.Source == gateProbe || c.Raised.Before(since) || c.Kind == kindUsedAsFound {
+		if !aboutIt || c.Source == gateProbe || c.OpenAt(since) || c.Kind == kindUsedAsFound {
 			kept = append(kept, c)
 			continue
 		}
@@ -436,6 +477,21 @@ func judgeMoves(ctx context.Context, open *stores, g *inventory.PlanGate, pairs
 		return "", err
 	}
 	facts.groupsAdded = movesAddingGroups(ctx, open.inventory, g, pairs, shelf)
+	facts.sent = g.Sent
+	facts.commits, facts.sentBuilds = judgedCommits(g, pairs), map[string]map[string]string{}
+	// A module this gate put back at once (putBackBroken) was sent its earlier build by the gate itself:
+	// not another send, and not a judging superseded.
+	for _, m := range g.Returned {
+		delete(facts.commits, m)
+	}
+	for _, j := range pairs {
+		if _, read := facts.sentBuilds[j.node]; read {
+			continue
+		}
+		if builds, known, err := open.inventory.SentBuilds(ctx, j.node); err == nil && known {
+			facts.sentBuilds[j.node] = builds
+		}
+	}
 	// **What is wrong with a machine itself is the machine's** (novox/hq issue 281): read once for each
 	// machine judged, apart from what is wrong with a module there, and never pinned on the module the
 	// gate happens to be kept on.
@@ -472,6 +528,13 @@ func judgeMoves(ctx context.Context, open *stores, g *inventory.PlanGate, pairs
 		if _, seen := reading[j.module]; !seen {
 			modules = append(modules, j.module)
 		}
+		if h == healthSuperseded {
+			// Decided at once (novox/hq issue 352): nothing of this gate's can be judged on a machine that
+			// was sent another build of it, and nothing is put back — the later send is what runs there.
+			g.Failing, g.Last = nil, ""
+			decide(g, inventory.GateSuperseded, said, now)
+			return g.Verdict, nil
+		}
 		if h == healthBroken && !slices.Contains(g.Broken, j.module) {
 			g.Broken = append(g.Broken, j.module)
 			if g.BrokenWhy == "" {
@@ -575,6 +638,40 @@ func judgeMoves(ctx context.Context, open *stores, g *inventory.PlanGate, pairs
 	return g.Verdict, nil
 }
 
+// judgedCommits is the commit of each module a gate judges: the gate's own To for its module, and each
+// carried move's. Pure.
+func judgedCommits(g *inventory.PlanGate, pairs []judged) map[string]string {
+	out := map[string]string{}
+	for _, c := range g.Carried {
+		if c.To != "" {
+			out[c.Module] = c.To
+		}
+	}
+	if g.To != "" {
+		for _, j := range pairs {
+			if _, has := out[j.module]; !has && !slices.ContainsFunc(g.Carried, func(c inventory.CarriedMove) bool { return c.Module == j.module }) {
+				out[j.module] = g.To
+			}
+		}
+	}
+	return out
+}
+
+// sentNow is what each machine was just sent, read after a send for the gate to keep (novox/hq issue
+// 352): a machine whose send is not on record is left out, and its report is read as before.
+func sentNow(ctx context.Context, inv *inventory.Inventory, machines []string) map[string]inventory.SentDeclaration {
+	out := map[string]inventory.SentDeclaration{}
+	for _, n := range machines {
+		if s, found, err := inv.SentTo(ctx, n); err == nil && found {
+			out[n] = s
+		}
+	}
+	if len(out) == 0 {
+		return nil
+	}
+	return out
+}
+
 // whyFor is a passing gate's why as one module's verdict says it: the send's, and that module's own wait
 // for a person, never another's (issue 318 review).
 func whyFor(g *inventory.PlanGate, module string) string {
@@ -800,6 +897,16 @@ func gateFailed(ctx context.Context, open *stores, p *inventory.Plan, module str
 			"back", module, short(state.Previous), inventory.KeptBuilds))
 		return
 	}
+	if g.Component == lease.ComponentController {
+		// **The controller is never put back to a build older than the store's schema** (novox/hq issue
+		// 352): the build before it carries fewer migrations than the failed one applied, starts behind
+		// its own records, and judges the next gate with what it can read. The current build is kept and
+		// the condition says so; a person decides.
+		if why, ok := controllerSchemaAllows(ctx, inv, previous); !ok {
+			notBack(why)
+			return
+		}
+	}
 	if err := inv.RestoreModule(ctx, previous); err != nil {
 		notBack(err.Error())
 		return
@@ -833,6 +940,53 @@ func gateFailed(ctx context.Context, open *stores, p *inventory.Plan, module str
 	sayRollback(ctx, open, module, g, "")
 }
 
+// controllerSchemaAllows says the store's schema lets this build of the controller be put back: the
+// build recorded, when it served, a reach at or past the highest migration the store has applied. One
+// that never recorded a reach is not proved safe, and is refused as such (novox/hq issue 352). Why
+// says what is kept and why when it is not.
+func controllerSchemaAllows(ctx context.Context, inv *inventory.Inventory, previous inventory.Build) (string, bool) {
+	applied, err := inv.SchemaApplied(ctx)
+	if err != nil {
+		return "what the store's schema reaches cannot be read, so whether the build before it can read it is not " +
+			"known; the current build is kept: " + err.Error(), false
+	}
+	build := versionOfBuild(previous)
+	if build == "" {
+		return fmt.Sprintf("the build before it (%s) names no bundle to know it by, so whether it can read the store's "+
+			"schema (migration %04d) is not known; the current build is kept, and a person decides", short(previous.Commit), applied), false
+	}
+	reach, known, err := inv.SchemaReachOf(ctx, build)
+	if err != nil {
+		return "what the build before it knows of the store's schema cannot be read; the current build is kept: " + err.Error(), false
+	}
+	if !known {
+		return fmt.Sprintf("the build before it (%s, %s) never recorded how far it reads the store's schema — a "+
+			"controller records that when it serves — so it is not proved to read migration %04d, which the store "+
+			"has applied; a controller older than its store starts behind its own records and judges with what it "+
+			"can read, so the current build is kept, and a person decides", short(previous.Commit), build, applied), false
+	}
+	if reach < applied {
+		return fmt.Sprintf("the build before it (%s, %s) reads the store's schema up to migration %04d, and the store "+
+			"is at %04d: a controller older than its store starts behind its own records and judges with what it "+
+			"can read, so the current build is kept, and a person decides", short(previous.Commit), build, reach, applied), false
+	}
+	return "", true
+}
+
+// versionOfBuild is the version a build's bundle is delivered as — its archive's digest, short, as the
+// catalogue names it (`${version}`) — read from the build's artifacts; empty when none is a bundle.
+func versionOfBuild(b inventory.Build) string {
+	for _, a := range b.Made {
+		if a.Kind != catalogue.ArtifactBundle && a.Kind != catalogue.ArtifactArchive {
+			continue
+		}
+		if _, hex, found := strings.Cut(a.Reference, "sha256:"); found && len(hex) >= 12 {
+			return hex[:12]
+		}
+	}
+	return ""
+}
+
 // rollbacks is what a failed send puts back, sent together (novox/hq issue 281): a gate that judged one
 // send judges what it moved as one, and what it found wanting goes back in one send per machine — not
 // in a send for each module, which is the churn that failed the gate in the first place.

cmd/mesh-controller/gate_test.go

@@ -113,9 +113,10 @@ func aGateMesh(t *testing.T) *gateMesh {
 		}
 		for node, h := range g.health {
 			if h == healthNotYet {
+				// Not reported on the send: neither the send made last, nor the gate's own (issue 352).
 				f.rolledBack[node] = nil
 				r := f.reports[node]
-				r.Current = false
+				r.Current, r.Declared, r.ReportedSequence = false, "", 0
 				f.reports[node] = r
 			}
 		}

cmd/mesh-controller/handacts.go

@@ -60,11 +60,18 @@ var handActVerbs = []handActVerb{
 	// a person's word (ADR 0242), which the push itself reads from what it carried (recorded_push.go).
 	{Verb: "push", Decision: "a recorded build moves only by a person's push: that push is the word its " +
 		"upgrade policy asks for (ADR 0242)", DecidedWhen: pushedRecorded},
-	{Verb: "plans stop"},
+	// Stopping or starting a walk the operator chose on a warrant (novox/hq ADR 0259) is their decision.
+	{Verb: "plans stop", Decision: "the operator's answer to an ask is their decision, not a repair (ADR 0259)",
+		DecidedFor: []string{conditions.CauseOperatorAnswer}},
 	{Verb: "plans close"},
 	// A walk started by a person instead of its delivery's owner (novox/hq ADR 0239): the owner down, or
-	// not trusted with it — either is a repair the owner should have made.
-	{Verb: "plans go"},
+	// not trusted with it — either is a repair the owner should have made. Unless the operator chose it on
+	// a warrant (ADR 0259).
+	{Verb: "plans go", Decision: "the operator's answer to an ask is their decision, not a repair (ADR 0259)",
+		DecidedFor: []string{conditions.CauseOperatorAnswer}},
+	// An act the operator chose on a warrant (novox/hq ADR 0259): asked by the controller, answered on a
+	// channel that proved who answered, performed by the controller as itself.
+	{Verb: handActWarrant, Decision: "the operator chose it, answering what the controller asked (ADR 0259)"},
 	{Verb: "broker consumer-reset"},
 	// Silencing the same condition twice says the condition, or what it watches, wants mending — unless
 	// it is the operator's answer on a notification: a decision to live with it (novox/hq ADR 0258).
@@ -103,6 +110,9 @@ var handActVerbs = []handActVerb{
 	// to that judgement. Several values rotate for one leak, and a leak that recurs is a defect of the
 	// module that prints them, an issue against it, not a healer that rotates. A rotation for any other
 	// cause — a credential that stopped working — counts: a schedule or a healer could take it over.
+	// A value given at the desk (novox/hq ADR 0259 §10): an outside party's key, such as a bot token, which
+	// only a person can give. Their word, never a repair.
+	{Verb: "secret accept", Decision: "a value an outside party issued is given by a person, at their desk"},
 	{Verb: "secret rotate", Decision: "a value a person judged disclosed is replaced on their word",
 		DecidedFor: []string{causeLeakedInLogs}},
 }

cmd/mesh-controller/handover_test.go

@@ -0,0 +1,134 @@
+package main
+
+import (
+	"bytes"
+	"errors"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// A hand-over's line is judged before anything is asked (novox/hq issue 356): a node's name and the directory's
+// absolute path exactly as the engine states it — no `..`, no doubled or trailing separator, nothing relative.
+func TestAHandOverLineIsJudgedBeforeItIsAsked(t *testing.T) {
+	for _, args := range [][]string{
+		{},
+		{"laptop"},
+		{"laptop", "/srv/notes", "extra"},
+		{"", "/srv/notes"},
+		{"--node", "/srv/notes"},
+		{"laptop", "srv/notes"},
+		{"laptop", "/srv/../etc"},
+		{"laptop", "/srv//notes"},
+		{"laptop", "/srv/notes/"},
+		{"laptop", "/srv/notes/."},
+	} {
+		if _, _, err := handOverLine(args); err == nil {
+			t.Errorf("%q was taken", args)
+		}
+	}
+	node, path, err := handOverLine([]string{"laptop", "/srv/notes"})
+	if err != nil || node != "laptop" || path != "/srv/notes" {
+		t.Fatalf("read as %q %q %v", node, path, err)
+	}
+}
+
+// Who hands over is the line's caller in the words every verb's caller is recorded in — the operator through
+// mesh-cli — or the controller's terminal when nobody is named.
+func TestAHandOverNamesWhoAsked(t *testing.T) {
+	t.Setenv(link.CallerVar, " jo through mesh-cli on anchor ")
+	if by := handOverBy(); by != "jo through mesh-cli on anchor" {
+		t.Fatalf("by %q", by)
+	}
+	t.Setenv(link.CallerVar, "")
+	if by := handOverBy(); by != "the controller's terminal" {
+		t.Fatalf("by %q", by)
+	}
+}
+
+// **A hand-over is the controller's terminal's alone** (novox/hq issue 356, ADR 0266): through any verb, and
+// through mesh-cli outside the terminal, `node hand-over` is refused and nothing runs — at the next apply root
+// gives the directory to the account the module declares, and whoever may call a verb includes agents.
+func TestAHandOverIsRefusedThroughEveryVerb(t *testing.T) {
+	line := []string{"node", "hand-over", "laptop", "/srv/notes"}
+	if err := terminalOnly(line); err == nil {
+		t.Fatal("node hand-over passed as a verb's line")
+	}
+	if _, err := argvFor("command", map[string]any{"command": "node hand-over laptop /srv/notes"}); err == nil {
+		t.Fatal("the command verb composed node hand-over")
+	}
+	if _, err := ordinaryLine(line); err == nil {
+		t.Fatal("node hand-over composed as an ordinary mesh-cli line")
+	}
+	if _, err := argvFor("node", map[string]any{"node": "laptop", "hand-over": "/srv/notes"}); err == nil {
+		t.Fatal("the node verb composed a hand-over")
+	}
+}
+
+// The condition's words are plain and name no machine's binary; the operator's line, with the node and the path
+// (novox/hq ADR 0272), is in the summary the module's health gives (moduleHealthWord) and in the evidence.
+func TestTheUsedAsFoundConditionNamesTheOperatorsLine(t *testing.T) {
+	rs := []inventory.ResourceHealth{foundDirectory("notes", time.Now().Add(-24*time.Hour))}
+	o := usedAsFoundObservation("notes", "laptop", "notes on laptop uses notes.data as found", rs)
+	if strings.Contains(o.Needs, "mesh-host") || strings.Contains(o.Explanation, "mesh-host") ||
+		!strings.Contains(o.Needs, "control-node") {
+		t.Fatalf("the condition's words: %q %q", o.Needs, o.Explanation)
+	}
+	if why, ok := conditions.PlainWords(conditions.Words{Headline: o.Headline, Explanation: o.Explanation, Needs: o.Needs,
+		Resolved: o.Resolved}, "laptop"); !ok {
+		t.Fatalf("not plain: %s", why)
+	}
+	f := gateFacts{now: time.Now(), health: map[string]inventory.NodeHealth{"laptop": {Node: "laptop", HeardAt: time.Now(),
+		Resources: rs}}}
+	h, why := moduleHealthWord("notes", "laptop", time.Now().Add(-time.Hour), f)
+	if h != healthPerson || !strings.Contains(why, "`nox node hand-over laptop <directory>` on the control-node") ||
+		strings.Contains(why, "mesh-host") || strings.Contains(why, "/srv/") {
+		t.Fatalf("the module's health reads %v %q; want the operator's line", h, why)
+	}
+}
+
+// **Nothing is asked of a node the mesh does not know, and the engine's refusal is the command's failure**
+// (review of issue 356): a refused hand-over never exits as a success.
+func TestAHandOverAsksOnlyAKnownNodeAndFailsOnARefusal(t *testing.T) {
+	t.Setenv(link.CallerVar, "jo through mesh-cli on anchor")
+	asked := 0
+	ask := func(answer link.HandOverAnswer) func(node, path, by string) (link.HandOverAnswer, error) {
+		return func(node, path, by string) (link.HandOverAnswer, error) {
+			asked++
+			if node != "laptop" || path != "/srv/notes" || by != "jo through mesh-cli on anchor" {
+				t.Fatalf("asked %q %q %q", node, path, by)
+			}
+			return answer, nil
+		}
+	}
+	unknown := func(string) error { return errors.New("no node called laptop") }
+	known := func(string) error { return nil }
+	var out bytes.Buffer
+	err := handOverAsked([]string{"laptop", "/srv/notes"}, unknown, ask(link.HandOverAnswer{Said: "x"}), &out)
+	if err == nil || asked != 0 || !strings.Contains(err.Error(), "nothing was asked") {
+		t.Fatalf("an unknown node: %v, asked %d", err, asked)
+	}
+	err = handOverAsked([]string{"laptop", "/srv/../etc"}, known, ask(link.HandOverAnswer{Said: "x"}), &out)
+	if err == nil || asked != 0 {
+		t.Fatalf("a refused line was asked: %v, asked %d", err, asked)
+	}
+	err = handOverAsked([]string{"laptop", "/srv/notes"}, known,
+		ask(link.HandOverAnswer{Refused: "/srv/notes is not used as found; nothing was handed over"}), &out)
+	if err == nil || !strings.Contains(err.Error(), "laptop refused: /srv/notes is not used as found") || out.Len() != 0 {
+		t.Fatalf("a refusal: %v, printed %q", err, out.String())
+	}
+	err = handOverAsked([]string{"laptop", "/srv/notes"}, known, ask(link.HandOverAnswer{Said: "handed over"}), &out)
+	if err != nil || !strings.HasPrefix(out.String(), "handed over\n") || !strings.Contains(out.String(), "`nox push laptop`") {
+		t.Fatalf("a record: %v, printed %q", err, out.String())
+	}
+	failing := func(string, string, string) (link.HandOverAnswer, error) {
+		return link.HandOverAnswer{}, errors.New("no engine")
+	}
+	if err := handOverAsked([]string{"laptop", "/srv/notes"}, known, failing, &out); err == nil {
+		t.Fatal("an ask that failed was a success")
+	}
+}

cmd/mesh-controller/hidden_input.go

@@ -0,0 +1,26 @@
+package main
+
+import (
+	"os"
+
+	"golang.org/x/sys/unix"
+)
+
+// hideTyping turns a terminal's echo off while a secret is typed at it, and gives back what restores it. On
+// anything that is not a terminal (a pipe, a file) it does nothing.
+func hideTyping(f *os.File) func() {
+	fd := int(f.Fd())
+	before, err := unix.IoctlGetTermios(fd, unix.TCGETS)
+	if err != nil {
+		return func() {}
+	}
+	hidden := *before
+	hidden.Lflag &^= unix.ECHO
+	if err := unix.IoctlSetTermios(fd, unix.TCSETS, &hidden); err != nil {
+		return func() {}
+	}
+	return func() {
+		_ = unix.IoctlSetTermios(fd, unix.TCSETS, before)
+		_, _ = os.Stderr.WriteString("\n")
+	}
+}

cmd/mesh-controller/issue348_test.go

@@ -0,0 +1,221 @@
+package main
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/lease"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// novox/hq issue 348: on 2026-10-09 the control node's resolver stopped answering on its private address
+// at 10:57:57 UTC; the machine's network condition was raised at 10:58:45. The node-engine and the
+// controller were sent at 10:59:34. The new node-engine's first statement judged the names once — unknown,
+// "one look failed; a second decides" — and that statement cleared the condition, though its last evidence
+// still said "connection refused". The next look raised it again at 11:00:23, after the send, and both
+// builds failed their gate at 11:10 with "raised since it was sent" and were put back, for a fault that
+// began before they were sent.
+
+// namesRefused is the control node's names part as its node-engine said it in the outage: its own
+// resolver, at its own address, refusing.
+func namesRefused(state string, streak int) link.NetworkPart {
+	p := link.NetworkPart{Part: link.PartNames, State: state, Since: h0, Streak: streak}
+	if state == link.StateUnhealthy {
+		p.Reason = "1 of its 2 resolvers do not answer as the mesh's do"
+		p.Said = "10.77.0.1 — anchor.internal (IPv4): read udp 10.77.0.1:35244->10.77.0.1:53: read: connection refused"
+		p.Toward = []string{"10.77.0.1"}
+	}
+	return p
+}
+
+func networkSaying(parts ...link.NetworkPart) *link.NetworkHealth {
+	state := link.StateHealthy
+	for _, p := range parts {
+		switch {
+		case p.State == link.StateUnhealthy:
+			state = link.StateUnhealthy
+		case p.State == link.StateUnknown && state == link.StateHealthy:
+			state = link.StateUnknown
+		}
+	}
+	return &link.NetworkHealth{State: state, Since: h0, Parts: parts}
+}
+
+// TestReplay348 replays the statements of the outage: the condition raised before the send is not
+// cleared by the restarted engine's first, undecided statement, and the gate does not count it against
+// the builds sent after it began.
+func TestReplay348(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	inv, k := open.inventory, conditionsFrom
+	say := func(at time.Time, n *link.NetworkHealth) {
+		t.Helper()
+		if err := stateHealth(ctx, inv, k, "anchor", link.Health{Contract: link.ReadinessContract, At: at, Network: n}, at); err != nil {
+			t.Fatal(err)
+		}
+	}
+	network := func() (conditions.Condition, bool) {
+		t.Helper()
+		list, err := k.Open(ctx)
+		if err != nil {
+			t.Fatal(err)
+		}
+		for _, c := range list {
+			if c.Key == "machine.anchor.network" {
+				return c, true
+			}
+		}
+		return conditions.Condition{}, false
+	}
+
+	// 10:58:45 — the second failing look: raised.
+	say(h0, networkSaying(namesRefused(link.StateUnhealthy, 2)))
+	raised, ok := network()
+	if !ok {
+		t.Fatal("the resolver refusing on the control node raised nothing")
+	}
+	time.Sleep(5 * time.Millisecond)
+	sent := time.Now().UTC()
+	time.Sleep(5 * time.Millisecond)
+
+	// 10:59:42 — the restarted engine's first statement: one look failed, a second decides.
+	say(h0.Add(time.Minute), networkSaying(namesRefused(link.StateUnknown, 1)))
+	if _, ok := network(); !ok {
+		t.Fatal("a statement that judged nothing yet cleared the condition: the restarted engine's first look " +
+			"said the fault was gone while it still refused")
+	}
+	// 11:00:23 — its second look: unhealthy again, the same raising.
+	say(h0.Add(2*time.Minute), networkSaying(namesRefused(link.StateUnhealthy, 2)))
+	again, ok := network()
+	if !ok || !again.Raised.Equal(raised.Raised) || again.Count != 1 {
+		t.Fatalf("the same raising was not kept: raised %s (first %s), count %d", again.Raised, raised.Raised, again.Count)
+	}
+
+	// The gate on the control node, for a build sent after the fault began.
+	open2, err := k.Open(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	f := gateFacts{judged: true, open: open2}
+	if w := aboutTheMachine("anchor", []string{"mesh-host"}, sent, f); w.whole != "" || len(w.on) != 0 {
+		t.Fatalf("a fault from before the send held the build: %+v", w)
+	}
+
+	// Decided healthy: cleared.
+	say(h0.Add(3*time.Minute), networkSaying(link.NetworkPart{Part: link.PartNames, State: link.StateHealthy, Since: h0}))
+	if c, ok := network(); ok {
+		t.Fatalf("a statement that decides the names healthy left %s open", c.Key)
+	}
+}
+
+// A fault there at the send, cleared and reopened after it, is not raised since the send; one that cleared
+// before the send and came back after it is — a send that breaks a recovered machine fails its gate (review
+// of mesh-controller PR 179, A2). Read through OpenAt, by both of the gate's readings.
+func TestAFaultThatFlappedAfterTheSendIsNotTheSendsAndOneThatRecoveredBeforeItIs(t *testing.T) {
+	since := h0
+	network := func(first time.Time, gaps ...conditions.Gap) conditions.Condition {
+		raised := since.Add(time.Minute)
+		if len(gaps) > 0 {
+			raised = gaps[len(gaps)-1].Reopened
+		}
+		return conditions.Condition{Key: "machine.anchor.network", Kind: kindMachineNetwork,
+			Subject: conditions.Subject{Scope: conditions.ScopeMachine, ID: "anchor", Machine: "anchor"},
+			Summary: "anchor's network is not healthy", Source: sourceNetwork, First: first, Gaps: gaps, Raised: raised}
+	}
+	held := func(c conditions.Condition) bool {
+		return aboutTheMachine("anchor", []string{"mesh-controller"}, since, gateFacts{judged: true,
+			open: []conditions.Condition{c}}).whole != ""
+	}
+	// The day's case: raised before the send, cleared 8 s after it, reopened 49 s after it.
+	flapped := network(since.Add(-49*time.Second),
+		conditions.Gap{Cleared: since.Add(8 * time.Second), Reopened: since.Add(49 * time.Second)})
+	if held(flapped) {
+		t.Fatal("a fault there at the send, flapping after it, held the machine")
+	}
+	// Recovered before the send, broken again after it: the send's.
+	recovered := network(since.Add(-time.Hour),
+		conditions.Gap{Cleared: since.Add(-30 * time.Second), Reopened: since.Add(20 * time.Second)})
+	if !held(recovered) {
+		t.Fatal("a machine recovered at the send and broken after it passed the gate")
+	}
+	// An older gap, before the send, and the fault there at the send: not the send's.
+	twice := network(since.Add(-time.Hour),
+		conditions.Gap{Cleared: since.Add(-50 * time.Minute), Reopened: since.Add(-45 * time.Minute)},
+		conditions.Gap{Cleared: since.Add(10 * time.Second), Reopened: since.Add(30 * time.Second)})
+	if held(twice) {
+		t.Fatal("a fault there at the send, with an older gap, held the machine")
+	}
+	// Raised after the send, never cleared: the send's.
+	if !held(network(time.Time{})) {
+		t.Fatal("a fault raised after the send held nothing")
+	}
+	// And a module's own, through judgeHealth.
+	at := since.Add(2 * time.Minute)
+	g := gateFacts{judged: true, now: at, reports: map[string]inventory.Reported{"anchor": {Node: "anchor",
+		Outcome: inventory.OutcomeApplied, At: &at, Current: true}}, engines: map[string]string{},
+		served: map[string]served{}, rolledBack: map[string][]lease.Rollback{},
+		open: []conditions.Condition{{Key: "provider.app.anchor.x.failing", Subject: conditions.Subject{
+			Scope: conditions.ScopeProvider, ID: "app.anchor.x", Machine: "anchor"}, Summary: "failing",
+			First: since.Add(-time.Hour), Raised: since.Add(time.Minute),
+			Gaps: []conditions.Gap{{Cleared: since.Add(5 * time.Second), Reopened: since.Add(time.Minute)}}}}}
+	if _, why := judgeHealth("app", "", catalogue.Manifest{Module: "app"}, "anchor", since, g); strings.HasPrefix(why, "raised since it was sent") {
+		t.Fatalf("a module's own fault there at the send: %s", why)
+	}
+	g.open[0].Gaps[0].Cleared = since.Add(-5 * time.Second)
+	if _, why := judgeHealth("app", "", catalogue.Manifest{Module: "app"}, "anchor", since, g); !strings.HasPrefix(why, "raised since it was sent") {
+		t.Fatalf("a module's own fault, recovered at the send and back after it, was not counted: %s", why)
+	}
+}
+
+// Only an undecided part holds a condition that names it; a condition about another part clears, and a
+// statement unknown as a whole holds every part (review of PR 179, A4). Pure.
+func TestAnUndecidedPartHoldsOnlyWhatNamesIt(t *testing.T) {
+	f := netFacts(map[string]*inventory.NetworkHealth{
+		"anchor": aNetwork(link.StateUnknown, inventory.NetworkPart{Part: link.PartNames, State: link.StateUnknown, Streak: 1},
+			inventory.NetworkPart{Part: link.PartRoute, State: link.StateHealthy}),
+		"laptop": aNetwork(link.StateHealthy, inventory.NetworkPart{Part: link.PartNames, State: link.StateHealthy}),
+		"spare":  aNetwork(link.StateStarting, inventory.NetworkPart{Part: link.PartTunnel, State: link.StateHealthy}),
+		"other":  aNetwork(link.StateStarting, inventory.NetworkPart{Part: link.PartTunnel, State: link.StateStarting}),
+	})
+	u := undecidedParts(f)
+	if !u["anchor"][link.PartNames] || u["anchor"][link.PartRoute] || u["laptop"] != nil || !u["spare"]["*"] ||
+		!u["other"][link.PartTunnel] || u["other"]["*"] {
+		t.Fatalf("undecided: %v", u)
+	}
+	about := func(machine, said string, also ...string) conditions.Condition {
+		return conditions.Condition{Subject: conditions.Subject{Scope: conditions.ScopeMachine, ID: machine,
+			Machine: machine, Also: also}, Evidence: []conditions.Evidence{{Said: said}}}
+	}
+	for _, c := range []struct {
+		c    conditions.Condition
+		held bool
+	}{
+		{about("anchor", "names since 2026-10-09 10:58:45 UTC: 10.77.0.1 — refused"), true},
+		{about("anchor", "route since 2026-10-09 10:58:45 UTC: no default route"), false},
+		{about("laptop", "names since 2026-10-09 10:58:45 UTC: refused"), false},
+		{about("spare", "route since …: no default route"), true},
+		{about("hub", "anchor: names: refused", "anchor"), true},
+		{about("hub", "anchor: tunnel: no handshake", "anchor"), false},
+	} {
+		if got := heldUndecided(c.c, u); got != c.held {
+			t.Errorf("%s %q held %v, want %v", c.c.Subject.Machine, c.c.Evidence[0].Said, got, c.held)
+		}
+	}
+}
+
+// A release walks its modules without a record per module: D10 counts what its tier names as rolling,
+// so the node-engine a release walks is not "behind, and no plan is rolling it out" on its first machine.
+func TestAReleaseRollsOutWhatItsTierNames(t *testing.T) {
+	plans := []inventory.Plan{
+		{ID: "release-1", State: inventory.PlanRolling, Tiers: [][]string{{"mesh-host"}}, Modules: map[string]*inventory.PlanModule{}},
+		{ID: "plan-2", State: inventory.PlanRolling, Modules: map[string]*inventory.PlanModule{"letta": {}}},
+	}
+	got := rollingModules(plans)
+	if !got["mesh-host"] || !got["letta"] || len(got) != 2 {
+		t.Fatalf("rolling: %v", got)
+	}
+}

cmd/mesh-controller/issue349_test.go

@@ -0,0 +1,194 @@
+package main
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// novox/hq issue 349: on 2026-10-09 the plan of mesh-catalog at a082615b (the merge of a security fix to the
+// forge's module) was "superseded at tier 0 by" the plan at 8ff8197a, the merge before it, which the
+// catch-up acted on late; what the later plan had not built was folded into a plan at the commit before the
+// fix. Plans of one branch are ordered by when the forge made their merges, and a merge older than an open
+// plan of its branch is planned at that plan's commit.
+
+// TestTwoMergesActedOnInReverseOrderBuildTheNewerCommit replays it: the later merge acted on first, the
+// earlier one second (the catch-up). One plan is left open, at the later commit, and it builds both.
+func TestTwoMergesActedOnInReverseOrderBuildTheNewerCommit(t *testing.T) {
+	open := aCatalogueMesh(t)
+	ctx := t.Context()
+	asksWithPaths(t)
+	for _, m := range []string{"gitea", "notes"} {
+		if err := open.inventory.RegisterModule(ctx, catalogue.Manifest{Module: m, Version: "1"},
+			inventory.Source{Repository: "novox/mesh-catalog", Seat: "git", Path: "modules/" + m, Ref: "main",
+				BuiltFrom: "c0", Head: "c0"}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	at := time.Now().UTC().Add(-20 * time.Minute).Truncate(time.Second)
+	fix := link.SourceMoved{Owner: "novox", Repo: "mesh-catalog", Base: "main", Commit: "a082615bfix",
+		MergedAt: at.Add(2 * time.Minute).Format(time.RFC3339Nano),
+		Paths:    []string{"modules/gitea/module.json"}, ModuleDirs: []string{"modules/gitea"}, ModuleDirsSaid: true}
+	before := link.SourceMoved{Owner: "novox", Repo: "mesh-catalog", Base: "main", Commit: "8ff8197abefore",
+		MergedAt: at.Format(time.RFC3339Nano),
+		Paths:    []string{"modules/notes/module.json"}, ModuleDirs: []string{"modules/notes"}, ModuleDirsSaid: true}
+	for _, m := range []link.SourceMoved{fix, before} {
+		if err := (following{open: open}).SourceMoved(ctx, m); err != nil {
+			t.Fatal(err)
+		}
+	}
+	plans, err := open.inventory.OpenPlans(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(plans) != 1 {
+		var said []string
+		for _, p := range plans {
+			said = append(said, p.ID+" "+p.Commit+" "+p.Note)
+		}
+		t.Fatalf("open plans: %s", strings.Join(said, "; "))
+	}
+	p := plans[0]
+	if p.Commit != fix.Commit {
+		t.Fatalf("the open plan builds %s, not the newer commit %s", p.Commit, fix.Commit)
+	}
+	for _, m := range []string{"gitea", "notes"} {
+		if _, has := p.Modules[m]; !has {
+			t.Fatalf("the open plan at the newer commit does not build %s: %v", m, p.Modules)
+		}
+	}
+}
+
+// A late older merge after the newer plan is done (review of PR 179, A1): what it moved is built from the
+// newer commit, and what the newer merge already looked at is not built again at the older one.
+func TestALateMergeAfterTheNewerPlanEndedBuildsTheNewerCommit(t *testing.T) {
+	open := aCatalogueMesh(t)
+	ctx := t.Context()
+	asksWithPaths(t)
+	for _, m := range []string{"gitea", "notes"} {
+		if err := open.inventory.RegisterModule(ctx, catalogue.Manifest{Module: m, Version: "1"},
+			inventory.Source{Repository: "novox/mesh-catalog", Seat: "git", Path: "modules/" + m, Ref: "main",
+				BuiltFrom: "c0", Head: "c0"}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	at := time.Now().UTC().Add(-20 * time.Minute).Truncate(time.Second)
+	fix := link.SourceMoved{Owner: "novox", Repo: "mesh-catalog", Base: "main", Commit: "a082615bfix",
+		MergedAt: at.Add(2*time.Minute + 500*time.Millisecond).Format(time.RFC3339Nano),
+		Paths:    []string{"modules/gitea/module.json"}, ModuleDirs: []string{"modules/gitea"}, ModuleDirsSaid: true}
+	if err := (following{open: open}).SourceMoved(ctx, fix); err != nil {
+		t.Fatal(err)
+	}
+	plans, err := open.inventory.OpenPlans(ctx)
+	if err != nil || len(plans) != 1 {
+		t.Fatalf("%v %v", plans, err)
+	}
+	done := plans[0]
+	done.State = inventory.PlanDone
+	if err := open.inventory.SavePlan(ctx, &done); err != nil {
+		t.Fatal(err)
+	}
+	if got, err := open.inventory.PlanByID(ctx, done.ID); err != nil || !got.Merged.Equal(at.Add(2*time.Minute+500*time.Millisecond)) {
+		t.Fatalf("the merge time kept is %s, not to the nanosecond (%v)", got.Merged, err)
+	}
+	before := link.SourceMoved{Owner: "novox", Repo: "mesh-catalog", Base: "main", Commit: "8ff8197abefore",
+		MergedAt:   at.Format(time.RFC3339Nano),
+		Paths:      []string{"modules/notes/module.json", "modules/gitea/module.json"},
+		ModuleDirs: []string{"modules/notes", "modules/gitea"}, ModuleDirsSaid: true}
+	if err := (following{open: open}).SourceMoved(ctx, before); err != nil {
+		t.Fatal(err)
+	}
+	plans, err = open.inventory.OpenPlans(ctx)
+	if err != nil || len(plans) != 1 {
+		t.Fatalf("open plans after the late merge: %+v %v", plans, err)
+	}
+	p := plans[0]
+	if p.Commit != fix.Commit {
+		t.Fatalf("the late merge was planned at %s, not the newer commit %s", p.Commit, fix.Commit)
+	}
+	if _, has := p.Modules["notes"]; !has {
+		t.Fatalf("what only the late merge moved is not built: %v", p.Modules)
+	}
+	if _, has := p.Modules["gitea"]; has {
+		t.Fatalf("what the newer merge already built is built again: %v", p.Modules)
+	}
+}
+
+// Pure: the branch's order is the merges', where both plans know it; and a later merge of the branch is
+// found in any state, never a release's, another repository's or another branch's.
+func TestTheBranchOrderIsTheMerges(t *testing.T) {
+	t0 := time.Date(2026, 10, 9, 10, 0, 0, 0, time.UTC)
+	newerMerge := inventory.Plan{ID: "plan-1", Repository: "novox/mesh-catalog", Branch: "main", Commit: "a082615b",
+		Merged: t0.Add(time.Minute), Created: t0.Add(2 * time.Minute), State: inventory.PlanRolling}
+	olderMerge := inventory.Plan{ID: "plan-2", Repository: "novox/mesh-catalog", Branch: "main", Commit: "8ff8197a",
+		Merged: t0, Created: t0.Add(10 * time.Minute), State: inventory.PlanBuilding}
+	if earlierOnTheBranch(newerMerge, olderMerge) || !earlierOnTheBranch(olderMerge, newerMerge) {
+		t.Fatal("ordered by when the plans were made, not by when the merges were")
+	}
+	if _, closed := supersededBy(olderMerge, []inventory.Plan{newerMerge}, func(string) bool { return true }); len(closed) != 0 {
+		t.Fatalf("the plan of an older merge superseded a newer one: %s", closed[0].Note)
+	}
+	unknown := newerMerge
+	unknown.Merged = time.Time{}
+	if !earlierOnTheBranch(unknown, olderMerge) {
+		t.Fatal("without a merge time the plans' own order does not stand")
+	}
+	same := olderMerge
+	same.Merged = newerMerge.Merged
+	if !earlierOnTheBranch(newerMerge, same) || earlierOnTheBranch(same, newerMerge) {
+		t.Fatal("one merge time: the plans' own order does not stand")
+	}
+	m := link.SourceMoved{Owner: "novox", Repo: "mesh-catalog", Base: "main", Commit: "8ff8197a",
+		MergedAt: t0.Add(500 * time.Millisecond).Format(time.RFC3339Nano)}
+	newerMerge.State = inventory.PlanDone
+	if !laterOnTheBranch(m, newerMerge) {
+		t.Fatal("a later merge of the branch, its plan done, was not found")
+	}
+	for name, change := range map[string]func(p *inventory.Plan, m *link.SourceMoved){
+		"another branch":     func(_ *inventory.Plan, m *link.SourceMoved) { m.Base = "release" },
+		"another repository": func(p *inventory.Plan, _ *link.SourceMoved) { p.Repository = "novox/mesh-controller" },
+		"a release":          func(p *inventory.Plan, _ *link.SourceMoved) { p.Release = &inventory.PlanRelease{} },
+		"no merge time":      func(p *inventory.Plan, _ *link.SourceMoved) { p.Merged = time.Time{} },
+		"the same commit":    func(p *inventory.Plan, m *link.SourceMoved) { m.Commit = p.Commit },
+		"an older merge":     func(p *inventory.Plan, _ *link.SourceMoved) { p.Merged = t0 },
+		"the same moment":    func(p *inventory.Plan, _ *link.SourceMoved) { p.Merged = t0.Add(500 * time.Millisecond) },
+		"an unreadable time": func(_ *inventory.Plan, m *link.SourceMoved) { m.MergedAt = "yesterday" },
+	} {
+		p, mm := newerMerge, m
+		change(&p, &mm)
+		if laterOnTheBranch(mm, p) {
+			t.Errorf("%s was taken as a later merge of the branch", name)
+		}
+	}
+	// To the nanosecond: two merges within a second keep their order.
+	m.MergedAt = t0.Add(time.Minute + 200*time.Millisecond).Format(time.RFC3339Nano)
+	if !laterOnTheBranch(m, inventory.Plan{Repository: "novox/mesh-catalog", Branch: "main", Commit: "x",
+		Merged: t0.Add(time.Minute + 700*time.Millisecond)}) {
+		t.Fatal("merges within one second lost their order")
+	}
+}
+
+// A merge time with a fraction of a second is kept whole in its plan, and two merges within one second keep
+// their order through the plans and the lookup (review of PR 179).
+func TestAMergeTimeKeepsItsFractionOfASecond(t *testing.T) {
+	at := "2026-10-09T10:57:52.123456789Z"
+	p := planOfMerge(link.SourceMoved{Owner: "novox", Repo: "mesh-catalog", Base: "main", Commit: "c1", MergedAt: at}, nil, nil)
+	want := time.Date(2026, 10, 9, 10, 57, 52, 123456789, time.UTC)
+	if !p.Merged.Equal(want) {
+		t.Fatalf("the plan's merge time is %s, not %s", p.Merged, want)
+	}
+	earlier := planOfMerge(link.SourceMoved{Owner: "novox", Repo: "mesh-catalog", Base: "main", Commit: "c0",
+		MergedAt: "2026-10-09T10:57:52.123456788Z"}, nil, nil)
+	earlier.Created = p.Created.Add(time.Second) // made after, merged before
+	if !earlierOnTheBranch(earlier, p) || earlierOnTheBranch(p, earlier) {
+		t.Fatal("two merges a nanosecond apart lost their order")
+	}
+	m := link.SourceMoved{Owner: "novox", Repo: "mesh-catalog", Base: "main", Commit: "c0", MergedAt: "2026-10-09T10:57:52.123456788Z"}
+	if !laterOnTheBranch(m, p) {
+		t.Fatal("a merge a nanosecond later was not found as the later one")
+	}
+}

cmd/mesh-controller/issue352_test.go

@@ -0,0 +1,356 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/lease"
+)
+
+// novox/hq issue 352: on 2026-10-09 a release's gate on the control node read the machine's report against a
+// newer send another plan had just made there — not against its own send — and failed three builds the
+// machine had reported healthy ("has not reported on what it was sent"), put them back on every machine,
+// to a controller older than the store's schema, and that controller then judged the newer plan's
+// controller passed from the put-back build's health.
+
+// TestReplay352 replays the walk on the backlog fixture: the release sends anchor and anchor reports;
+// another send reaches anchor, unreported; the gate still passes. And a send that moves a judged module
+// to another build supersedes the judging: no verdict, nothing put back.
+func TestReplay352(t *testing.T) {
+	t.Run("a newer send to the judged machine does not unreport the gate's", testANewerSendDoesNotUnreportTheGatesOwn)
+	t.Run("a send that moves the module supersedes the judging", testASendThatMovesTheModuleSupersedesTheJudging)
+}
+
+func testANewerSendDoesNotUnreportTheGatesOwn(t *testing.T) {
+	b := aBacklog(t)
+	ctx := t.Context()
+	inv := b.open.inventory
+	advancePlans(ctx, b.open) // anchor is sent, and the fixture reports it applied
+	// 16:31:37 — another plan sends anchor a newer declaration, which it has not reported on.
+	carried, _, _ := inv.SentBuilds(ctx, "anchor")
+	if err := inv.RecordSent(ctx, nodeID(t, b.open, "anchor"), "d-anchor-newer", carried); err != nil {
+		t.Fatal(err)
+	}
+	reports, _ := inv.LastReports(ctx)
+	for _, r := range reports {
+		if r.Node == "anchor" && r.Current {
+			t.Fatal("the fixture's newer send reads as reported")
+		}
+	}
+	gateEvery, gateBound = 0, 0 // past the bound at once: before the fix, "has not reported" fails it here
+	for i := 0; i < 4; i++ {
+		advancePlans(ctx, b.open)
+	}
+	p := b.release(t)
+	if p.State == inventory.PlanFailed || strings.Contains(p.Note, "has not reported") {
+		t.Fatalf("the release failed on the newer send: %s %s", p.State, p.Note)
+	}
+	if g := p.Release.Gate; g != nil && (g.Sent == nil || g.Sent["anchor"].Digest == "") {
+		t.Fatalf("the gate does not keep what it sent: %+v", g)
+	}
+	if v, found, err := inv.GateOf(ctx, "build-app-c2"); err != nil || !found || v.Verdict != inventory.GatePassed {
+		t.Fatalf("app's pass on anchor was not kept: %+v %v %v", v, found, err)
+	}
+	if current, _ := inv.CurrentBuilds(ctx); current["app"].Commit != "c2" {
+		t.Fatalf("app was put back to %s", current["app"].Commit)
+	}
+}
+
+// A plan's own first send waits while a release judges the same module on that machine with another build.
+func TestAPlansFirstSendWaitsForAReleaseJudgingTheModuleThere(t *testing.T) {
+	b := aBacklog(t)
+	ctx := t.Context()
+	advancePlans(ctx, b.open) // the release judges app c2 on anchor
+	_, _, err := gatedSend(ctx, b.open, "anchor", []inventory.CarriedMove{{Module: "app", Node: "anchor", From: "c2", To: "c3", Build: "build-app-c3"}})
+	if !errors.Is(err, errWalkedElsewhere) || !strings.Contains(err.Error(), "release-") {
+		t.Fatalf("a newer build of a judged module was sent under the release's gate: %v", err)
+	}
+	if len(b.sent) != 1 {
+		t.Fatalf("sent %v", b.sent)
+	}
+}
+
+// A merge plan's judging is superseded the same way: another send moved its module on the first machine.
+func TestAPlansJudgingIsSupersededByASendThatMovesItsModule(t *testing.T) {
+	g := aGateMesh(t)
+	ctx := t.Context()
+	inv := g.open.inventory
+	advancePlans(ctx, g.open) // anchor is sent app c2 first
+	if err := inv.RecordSent(ctx, nodeID(t, g.open, "anchor"), "d-anchor-c3", map[string]string{"app": "c3"}); err != nil {
+		t.Fatal(err)
+	}
+	gateEvery = 0
+	advancePlans(ctx, g.open)
+	p := g.plan(t)
+	if p.State != inventory.PlanSuperseded || !strings.Contains(p.Note, "superseded") || !strings.Contains(p.Note, "c3") {
+		t.Fatalf("the plan is %s: %s", p.State, p.Note)
+	}
+	// Nothing put back: the registered build stands, the build is not marked, and the plan's gate made no
+	// rollback (a release may walk what the other send left waiting on anchor; that is not a put-back).
+	if r := p.Modules["app"].Gate.Rollback; r != "" {
+		t.Fatalf("a superseded judging made a rollback: %q", r)
+	}
+	if current, _ := inv.CurrentBuilds(ctx); current["app"].Commit != "c2" {
+		t.Fatalf("app was put back to %s", current["app"].Commit)
+	}
+	if failed, _ := inv.GateFailed(ctx, "build-2"); failed {
+		t.Fatal("a superseded build was marked failed")
+	}
+}
+
+func testASendThatMovesTheModuleSupersedesTheJudging(t *testing.T) {
+	b := aBacklog(t)
+	ctx := t.Context()
+	inv := b.open.inventory
+	advancePlans(ctx, b.open)
+	// Another send moves app on anchor to a build this gate does not judge.
+	carried, _, _ := inv.SentBuilds(ctx, "anchor")
+	carried["app"] = "c3"
+	if err := inv.RecordSent(ctx, nodeID(t, b.open, "anchor"), "d-anchor-c3", carried); err != nil {
+		t.Fatal(err)
+	}
+	gateEvery = 0
+	advancePlans(ctx, b.open)
+	p := b.release(t)
+	if p.State != inventory.PlanSuperseded || !strings.Contains(p.Note, "superseded") || !strings.Contains(p.Note, "c3") {
+		t.Fatalf("the release is %s: %s", p.State, p.Note)
+	}
+	if !reflect.DeepEqual(b.sent, [][]string{{"anchor"}}) {
+		t.Fatalf("sent %v: a superseded judging puts nothing back", b.sent)
+	}
+	if _, found, _ := inv.GateOf(ctx, "build-app-c2"); found {
+		t.Fatal("a superseded judging kept a verdict")
+	}
+	if current, _ := inv.CurrentBuilds(ctx); current["app"].Commit != "c2" {
+		t.Fatalf("app was put back to %s", current["app"].Commit)
+	}
+}
+
+// A report is on the gate's own send: the declaration itself, or one sequenced after it; a gate kept
+// without its send reads the report against the send made last, as before. Pure.
+func TestAReportIsHeldAgainstTheGatesOwnSend(t *testing.T) {
+	sent := inventory.SentDeclaration{Digest: "d-490", Sequence: 490}
+	for _, c := range []struct {
+		r    inventory.Reported
+		want bool
+	}{
+		{inventory.Reported{Declared: "d-490", Current: false}, true},
+		{inventory.Reported{Declared: "d-491", ReportedSequence: 491, Current: true}, true},
+		{inventory.Reported{Declared: "d-489", ReportedSequence: 489, Current: false}, false},
+		{inventory.Reported{Declared: "other", ReportedSequence: 490}, true},                // the same sequence, said by another digest
+		{inventory.Reported{Declared: "d-495", ReportedSequence: 495, Current: true}, true}, // the last send: this one or a later one
+		{inventory.Reported{Declared: "", Current: false}, false},
+	} {
+		if got := sent.ReportsOn(c.r); got != c.want {
+			t.Errorf("%+v on %+v: %v", c.r, sent, got)
+		}
+	}
+	byDigest := inventory.SentDeclaration{Digest: "d-1"}
+	if !byDigest.ReportsOn(inventory.Reported{Declared: "d-1"}) || byDigest.ReportsOn(inventory.Reported{ReportedSequence: 5}) ||
+		!byDigest.ReportsOn(inventory.Reported{Current: true}) {
+		t.Fatal("a send kept without a sequence is matched by its digest and by the last send alone")
+	}
+	f := gateFacts{sent: map[string]inventory.SentDeclaration{"anchor": sent}}
+	if !f.reportedOn("anchor", inventory.Reported{Declared: "d-490"}) || f.reportedOn("anchor", inventory.Reported{Declared: "d-1"}) {
+		t.Fatal("a gate that kept its send read the report against something other than it")
+	}
+	if !f.reportedOn("laptop", inventory.Reported{Current: true}) || f.reportedOn("laptop", inventory.Reported{Current: false}) {
+		t.Fatal("a gate that did not keep its send does not read the report against the send made last")
+	}
+	// Through the merge plan's first-machine wait too.
+	at := time.Now()
+	state := inventory.PlanModule{First: []string{"anchor"}, FirstAt: &at,
+		Gate: &inventory.PlanGate{Machines: []string{"anchor"}, Sent: map[string]inventory.SentDeclaration{"anchor": sent}}}
+	reports := []inventory.Reported{{Node: "anchor", At: &at, Outcome: inventory.OutcomeApplied, Current: false, Declared: "d-490"}}
+	if step := nextRollout(state, []string{"anchor", "laptop"}, false, reports, at.Add(time.Minute), time.Hour); step.waiting != "" || step.failed != "" {
+		t.Fatalf("the first machine's report on the plan's own send read as none: %+v", step)
+	}
+	reports[0].Declared = "d-480"
+	if step := nextRollout(state, []string{"anchor", "laptop"}, false, reports, at.Add(time.Minute), time.Hour); step.waiting == "" {
+		t.Fatalf("a report on an older send read as the plan's: %+v", step)
+	}
+}
+
+// A gate judges only the build the machine was last sent: last sent another build of the module, the
+// judging is superseded, whatever the machine reports. Pure.
+func TestAGateJudgesOnlyTheBuildTheMachineWasLastSent(t *testing.T) {
+	at := time.Now()
+	f := gateFacts{now: at, reports: map[string]inventory.Reported{"anchor": {Node: "anchor", Outcome: inventory.OutcomeApplied,
+		At: &at, Current: true}}, engines: map[string]string{}, served: map[string]served{}, rolledBack: map[string][]lease.Rollback{},
+		commits: map[string]string{"mesh-controller": "e6b00e2e"}, sentBuilds: map[string]map[string]string{"anchor": {"mesh-controller": "ef26d4cb"}}}
+	taken := at.Add(-30 * time.Second)
+	f.holder = &lease.Holder{Taken: taken, Health: &lease.Health{Ready: true}}
+	h, why := judgeHealth("mesh-controller", lease.ComponentController, catalogue.Manifest{}, "anchor", at.Add(-time.Minute), f)
+	if h != healthSuperseded || !strings.Contains(why, "ef26d4cb") || !strings.Contains(why, "e6b00e2e") {
+		t.Fatalf("a controller build the machine no longer runs: %v %q", h, why)
+	}
+	f.sentBuilds["anchor"]["mesh-controller"] = "e6b00e2e"
+	if h, why := judgeHealth("mesh-controller", lease.ComponentController, catalogue.Manifest{}, "anchor", at.Add(-time.Minute), f); h == healthSuperseded {
+		t.Fatalf("the build sent read as another: %q", why)
+	}
+	delete(f.sentBuilds, "anchor")
+	if h, why := judgeHealth("mesh-controller", lease.ComponentController, catalogue.Manifest{}, "anchor", at.Add(-time.Minute), f); h == healthSuperseded {
+		t.Fatalf("a machine whose send is not known read as superseded: %q", why)
+	}
+	g := &inventory.PlanGate{To: "c2", Carried: []inventory.CarriedMove{{Module: "late", Node: "anchor", To: "c5"}}}
+	if got := judgedCommits(g, []judged{{"app", "anchor"}, {"late", "anchor"}}); got["app"] != "c2" || got["late"] != "c5" {
+		t.Fatalf("judged commits %v", got)
+	}
+}
+
+// A move of another build of a module to a machine where a release or a plan is judging that module
+// waits for that judging; the same build to that machine is already there. Pure.
+func TestAWalkWaitsForAJudgingOfTheSameModuleOnThatMachine(t *testing.T) {
+	at := time.Now()
+	release := inventory.Plan{ID: "release-1", State: inventory.PlanRolling, Release: &inventory.PlanRelease{
+		Gate: &inventory.PlanGate{Machines: []string{"novox"}, Carried: []inventory.CarriedMove{
+			{Module: "mesh-controller", Node: "novox", From: "ef26d4cb", To: "2913c54c"}}}}}
+	merge := inventory.Plan{ID: "plan-1", State: inventory.PlanRolling, Modules: map[string]*inventory.PlanModule{
+		"app": {First: []string{"anchor"}, FirstAt: &at, Commit: "c2", Gate: &inventory.PlanGate{Machines: []string{"anchor"}}}}}
+	f := moveFacts{plans: []inventory.Plan{release, merge}}
+	for _, c := range []struct {
+		module, node, to, want string
+	}{
+		{"mesh-controller", "novox", "e6b00e2e", "release-1"}, // the day's case: a newer controller to the judged machine
+		{"mesh-controller", "novox", "2913c54c", ""},          // the same build: already there
+		{"mesh-controller", "ace", "2913c54c", "release-1"},   // another machine while the first is judged
+		{"mesh-host", "novox", "x", ""},                       // a module the release does not carry
+		{"app", "anchor", "c2", ""},
+		{"app", "anchor", "c3", "plan-1"},
+		{"app", "laptop", "c2", "plan-1"},
+	} {
+		if got := f.walkedBy(c.module, c.node, c.to); got != c.want {
+			t.Errorf("%s %s to %s: walked by %q, want %q", c.module, c.to, c.node, got, c.want)
+		}
+	}
+	release.Release.Gate.Verdict = inventory.GatePassed
+	merge.Modules["app"].Gate.Verdict = inventory.GatePassed
+	if f.walkedBy("mesh-controller", "novox", "e6b00e2e") != "" || f.walkedBy("app", "laptop", "c3") != "" {
+		t.Fatal("a passed judging still holds a move")
+	}
+	release.Release.Gate.Verdict = ""
+	f.plans[0].State = inventory.PlanSuperseded
+	if f.walkedBy("mesh-controller", "novox", "e6b00e2e") != "" {
+		t.Fatal("a closed release still holds a move")
+	}
+}
+
+// The controller is never put back to a build that reaches less of the store's schema than the store
+// has, or to one that never said what it reaches: the current build is kept, and the condition says so.
+func TestTheControllerIsNotPutBackToABuildOlderThanTheStoresSchema(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	keeper, _ := withConditionsInMemory(t)
+	told := &conditions.Told{}
+	was := doctorFrom
+	doctorFrom = &doctor{open: open, keeper: keeper, teller: told}
+	t.Cleanup(func() { doctorFrom = was })
+	wasSend := sendRollout
+	var sent [][]string
+	sendRollout = func(ctx context.Context, open *stores, names []string) ([]string, error) {
+		sent = append(sent, names)
+		return names, nil
+	}
+	t.Cleanup(func() { sendRollout = wasSend })
+
+	build := func(id, commit, digest string, asked time.Time) inventory.Build {
+		manifest, _ := json.Marshal(catalogue.Manifest{Module: "mesh-controller", Version: commit})
+		b := inventory.Build{ID: id, Module: "mesh-controller", Commit: commit, Repository: "novox/mesh-controller", Path: ".",
+			Manifest: manifest, Asked: asked, At: asked, Made: []inventory.Artifact{{Name: "controller", Kind: catalogue.ArtifactBundle,
+				Reference: "mesh-artifact://mesh-controller/controller/blobs/sha256:" + digest}}}
+		if err := inv.RecordBuild(ctx, b); err != nil {
+			t.Fatal(err)
+		}
+		if err := inv.RegisterModule(ctx, catalogue.Manifest{Module: "mesh-controller", Version: commit},
+			inventory.Source{Repository: "novox/mesh-controller", Seat: "git", Path: ".", BuiltFrom: commit, Head: commit, Asked: asked}); err != nil {
+			t.Fatal(err)
+		}
+		return b
+	}
+	previous := build("build-old", "ef26d4cb", strings.Repeat("1", 64), time.Now().Add(-2*time.Hour))
+	failed := build("build-new", "e6b00e2e", strings.Repeat("2", 64), time.Now().Add(-time.Minute))
+	if versionOfBuild(previous) != strings.Repeat("1", 12) {
+		t.Fatalf("the build's version is %q", versionOfBuild(previous))
+	}
+	applied, err := inv.SchemaApplied(ctx)
+	if err != nil || applied < 87 {
+		t.Fatalf("the store's schema reaches %d (%v)", applied, err)
+	}
+	// The build before never recorded what it reads: not proved, refused.
+	if why, ok := controllerSchemaAllows(ctx, inv, previous); ok || !strings.Contains(why, "never recorded") {
+		t.Fatalf("an unknown reach: %v %q", ok, why)
+	}
+	// It reads less than the store has: refused, naming both.
+	if err := inv.RecordSchemaReach(ctx, versionOfBuild(previous), applied-1); err != nil {
+		t.Fatal(err)
+	}
+	if why, ok := controllerSchemaAllows(ctx, inv, previous); ok || !strings.Contains(why, "is at") {
+		t.Fatalf("a reach behind the store: %v %q", ok, why)
+	}
+	// Through the gate: the failed build is marked, nothing is put back, nothing is sent, the condition is urgent.
+	at := time.Now().Add(-5 * time.Minute)
+	state := &inventory.PlanModule{Build: failed.ID, Commit: failed.Commit, Previous: previous.Commit, First: []string{"anchor"}, FirstAt: &at}
+	p := inventory.Plan{ID: "plan-352", Repository: "novox/mesh-controller", Branch: "main", Commit: failed.Commit, Created: at,
+		State: inventory.PlanRolling, Tiers: [][]string{{"mesh-controller"}}, Modules: map[string]*inventory.PlanModule{"mesh-controller": state}}
+	if err := inv.SavePlan(ctx, &p); err != nil {
+		t.Fatal(err)
+	}
+	gateFailed(ctx, open, &p, "mesh-controller", state, []string{"anchor"}, "not healthy within 10m0s of its apply")
+	if state.Gate.Rollback != inventory.NotRolledBack || !strings.Contains(p.Note, "NOT put back") || !strings.Contains(p.Note, "the current build is kept") {
+		t.Fatalf("rollback %q: %s", state.Gate.Rollback, p.Note)
+	}
+	if len(sent) != 0 {
+		t.Fatalf("sent %v: nothing is put back", sent)
+	}
+	if current, _ := inv.CurrentBuilds(ctx); current["mesh-controller"].Commit != failed.Commit {
+		t.Fatalf("the module was put back to %s", current["mesh-controller"].Commit)
+	}
+	if marked, _ := inv.GateFailed(ctx, failed.ID); !marked {
+		t.Fatal("the failed build is not marked failed at its gate")
+	}
+	open2, _ := keeper.Open(ctx)
+	var found bool
+	for _, c := range open2 {
+		if c.Kind == kindRollbackFailed && c.Severity == conditions.Urgent && strings.Contains(c.Summary, "current build is kept") {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatalf("no urgent rollback-failed condition saying the current build is kept: %+v", open2)
+	}
+	// Reaching the store: allowed.
+	if err := inv.RecordSchemaReach(ctx, versionOfBuild(previous), applied); err != nil {
+		t.Fatal(err)
+	}
+	if why, ok := controllerSchemaAllows(ctx, inv, previous); !ok {
+		t.Fatalf("a build that reads the whole schema was refused: %q", why)
+	}
+	// A build with no bundle to know it by: refused.
+	if why, ok := controllerSchemaAllows(ctx, inv, inventory.Build{Commit: "x"}); ok || !strings.Contains(why, "names no bundle") {
+		t.Fatalf("a build without a bundle: %v %q", ok, why)
+	}
+}
+
+// The lease's holder names the build the declaration told it it is, and the version stamp only without one.
+func TestTheHolderNamesTheBuildTheDeclarationToldIt(t *testing.T) {
+	t.Setenv(RunningBuildVar, " ad62528c47c7 ")
+	if h := holderOf("x"); h.Build != "ad62528c47c7" {
+		t.Fatalf("the holder's build is %q", h.Build)
+	}
+	t.Setenv(RunningBuildVar, "")
+	if h := holderOf("x"); h.Build != version {
+		t.Fatalf("without a declared version the holder's build is %q", h.Build)
+	}
+	if reach, err := schemaReach(); err != nil || reach < 87 {
+		t.Fatalf("this build's reach is %d (%v)", reach, err)
+	}
+}

cmd/mesh-controller/machine_network.go

@@ -98,8 +98,9 @@ func judgeNetworks(ctx context.Context, inv *inventory.Inventory, k *conditions.
 			problems = append(problems, err.Error())
 		}
 	}
+	undecided := undecidedParts(f)
 	for _, c := range open {
-		if !slices.Contains(networkKinds, c.Kind) || said[c.Key] {
+		if !slices.Contains(networkKinds, c.Kind) || said[c.Key] || heldUndecided(c, undecided) {
 			continue
 		}
 		why := "no machine says it any more"
@@ -116,6 +117,59 @@ func judgeNetworks(ctx context.Context, inv *inventory.Inventory, k *conditions.
 	return nil
 }
 
+// undecidedParts is, per machine, every part of its newest statement not yet judged: starting, or unknown
+// — one look failed and a second decides (novox/hq issue 348). Such a part does not say its fault is gone.
+// A statement whose parts are all decided but whose whole is unknown or starting holds every part. Pure.
+//
+// On 2026-10-09 the control node's resolver refused every question from 10:58 to 11:18 UTC. A build of
+// the node-engine sent at 10:59:34 restarted it; its first statement judged the names once (unknown, "one
+// look failed; a second decides"), and that statement cleared the control node's network condition while
+// its last evidence still said "connection refused". The second look raised it again forty seconds later —
+// after the send — and the gate failed the build for a fault from before it.
+func undecidedParts(f networkFacts) map[string]map[string]bool {
+	out := map[string]map[string]bool{}
+	for m, h := range f.healths {
+		if h.Network == nil {
+			continue
+		}
+		parts := map[string]bool{}
+		for _, p := range h.Network.Parts {
+			if p.State == link.StateUnknown || p.State == link.StateStarting {
+				parts[p.Part] = true
+			}
+		}
+		if len(parts) == 0 && (h.Network.State == link.StateUnknown || h.Network.State == link.StateStarting) {
+			parts["*"] = true
+		}
+		if len(parts) > 0 {
+			out[m] = parts
+		}
+	}
+	return out
+}
+
+// heldUndecided says an open network condition is kept rather than cleared: a part its newest evidence
+// names is undecided in the newest statement of a machine it is about. A condition about other parts
+// clears as before. Pure.
+func heldUndecided(c conditions.Condition, undecided map[string]map[string]bool) bool {
+	said := ""
+	if len(c.Evidence) > 0 {
+		said = c.Evidence[0].Said
+	}
+	for _, m := range append([]string{c.Subject.Machine}, c.Subject.Also...) {
+		parts := undecided[m]
+		if parts["*"] {
+			return true
+		}
+		for part := range parts {
+			if strings.Contains(said, part+" since ") || strings.Contains(said, part+": ") {
+				return true
+			}
+		}
+	}
+	return false
+}
+
 // pointed is one machine's failing part that points at another machine.
 type pointed struct {
 	from string

cmd/mesh-controller/main.go

@@ -78,6 +78,8 @@ func run() error {
 		return rotateCommand(ctx, args[1:])
 	case "ask":
 		return askCommand(ctx, args[1:])
+	case "rehearse":
+		return rehearseCommand(ctx, args[1:])
 	case "builds":
 		return buildsCommand(ctx, args[1:])
 	// The build queue, controlled by hand (novox/hq ADR 0219).

cmd/mesh-controller/meshcli.go

@@ -141,6 +141,12 @@ func runForMeshCLI(ctx context.Context, node string, asked link.CLIAsked, v cliV
 	if v.refused != "" {
 		return link.CLIRefusal(v.refused)
 	}
+	// Standard input is the terminal's alone: a secret given at the terminal reaches `secret accept`, and no ordinary
+	// call is handed what the asker's standard input held (novox/hq ADR 0259 §10, ADR 0272).
+	if len(asked.Stdin) > 0 && !v.terminal {
+		return link.CLIAnswer{Exit: 1, Why: v.why, Refused: "standard input is given to a line that runs as the " +
+			"controller's terminal alone, and this one does not. Nothing ran"}
+	}
 	if cliServers[asked.Line[0]] {
 		return link.CLIAnswer{Exit: 1, Why: v.why, Refused: fmt.Sprintf("%s serves until stopped, and is not a "+
 			"command line mesh-cli runs. Nothing ran", asked.Line[0])}
@@ -155,8 +161,12 @@ func runForMeshCLI(ctx context.Context, node string, asked link.CLIAsked, v cliV
 	}
 	cmd := selfCommand(ctx, line)
 	cmd.Env = commandEnvironment(fmt.Sprintf("%s through mesh-cli on %s", asked.Account, node), verb, v.terminal)
-	// No standard input: a command that reads one gets nothing, and fails saying so (ADR 0272 §5).
+	// No standard input unless mesh-cli carried one for a terminal line: a command that reads one gets nothing, and
+	// fails saying so (ADR 0272 §5).
 	cmd.Stdin = nil
+	if len(asked.Stdin) > 0 {
+		cmd.Stdin = bytes.NewReader(asked.Stdin)
+	}
 	var stdout, stderr bytes.Buffer
 	cmd.Stdout, cmd.Stderr = &stdout, &stderr
 	err := cmd.Run()

cmd/mesh-controller/meshcli_stdin_test.go

@@ -0,0 +1,99 @@
+package main
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"strings"
+	"sync"
+	"testing"
+)
+
+// secretAcceptWants makes the test binary, run as a command line, read a secret as `secret accept` reads it and
+// say whether it is the value whose SHA-256 the variable names (TestMain).
+const secretAcceptWants = "MESH_TEST_SECRET_ACCEPT_WANTS"
+
+// readAsSecretAccept is that process: `secret accept <node> <module> <name> [--from -]`, the value read by
+// valueFor, compared by digest, and only the verdict printed.
+func readAsSecretAccept(want string, argv []string) int {
+	if len(argv) < 5 || argv[0] != "secret" || argv[1] != "accept" {
+		fmt.Printf("not a secret accept line: %q\n", argv)
+		return 2
+	}
+	from := ""
+	if len(argv) == 7 && argv[5] == "--from" {
+		from = argv[6]
+	}
+	value, err := valueFor(argv[2], argv[3], argv[4], from)
+	if err != nil {
+		fmt.Printf("secret accept read nothing: %v\n", err)
+		return 1
+	}
+	sum := sha256.Sum256([]byte(asSupplied(value)))
+	if hex.EncodeToString(sum[:]) != want {
+		fmt.Printf("secret accept read something else (%d bytes)\n", len(value))
+		return 1
+	}
+	fmt.Println("secret accept read the value it was given")
+	return 0
+}
+
+// novox/hq ADR 0259 §10, ADR 0272: what mesh-cli's standard input held reaches `secret accept` on a line that runs
+// as the controller's terminal, and appears nowhere else — not in the answer, not in the journal, not in the calls
+// record; an ordinary line carrying it is refused and nothing runs.
+func TestStandardInputReachesSecretAcceptAtTheTerminalAndNowhereElse(t *testing.T) {
+	token := "123456789:AAEhBOweik6ad9r_QxGivenAtTheTerminal"
+	sum := sha256.Sum256([]byte(token))
+	t.Setenv(secretAcceptWants, hex.EncodeToString(sum[:]))
+	var journal []string
+	var mu sync.Mutex
+	was := cliJournal
+	cliJournal = func(line string) { mu.Lock(); journal = append(journal, line); mu.Unlock() }
+	t.Cleanup(func() { cliJournal = was })
+	ctx := context.Background()
+
+	for _, line := range [][]string{
+		{"secret", "accept", "anchor", "telegram", "telegram-token", "--from", "-"},
+		{"secret", "accept", "anchor", "telegram", "telegram-token"}, // the prompt's path, a line on standard input
+	} {
+		asked := cliAsked("operator", 1000, line...)
+		asked.Stdin = []byte(token + "\n")
+		a := runForMeshCLI(ctx, "control", asked, cliVerdict{terminal: true, why: "the terminal"})
+		if a.Exit != 0 || !strings.Contains(string(a.Stdout), "read the value it was given") {
+			t.Fatalf("%q: secret accept did not read what mesh-cli carried: %+v (%s)", line, a, a.Stdout)
+		}
+		if body, _ := json.Marshal(a); strings.Contains(string(body), "AAEh") || strings.Contains(string(body), base64.StdEncoding.EncodeToString([]byte(token))) {
+			t.Fatalf("the answer carries the secret: %s", body)
+		}
+	}
+
+	// Without standard input, the line reads nothing, as before.
+	a := runForMeshCLI(ctx, "control", cliAsked("operator", 1000, "secret", "accept", "anchor", "telegram",
+		"telegram-token", "--from", "-"), cliVerdict{terminal: true, why: "the terminal"})
+	if a.Exit == 0 {
+		t.Fatalf("a line with no standard input read a value: %+v", a)
+	}
+
+	// An ordinary call is never handed it: refused, and nothing ran.
+	asked := cliAsked("operator", 1000, "status")
+	asked.Stdin = []byte(token)
+	a = runForMeshCLI(ctx, "laptop", asked, cliVerdict{why: "not the terminal"})
+	if a.Exit == 0 || !strings.Contains(a.Refused, "terminal alone") || len(a.Stdout) != 0 {
+		t.Fatalf("an ordinary line was given standard input: %+v", a)
+	}
+
+	mu.Lock()
+	defer mu.Unlock()
+	for _, l := range journal {
+		if strings.Contains(l, "AAEh") {
+			t.Fatalf("the journal says the secret: %s", l)
+		}
+	}
+	if len(journal) == 0 {
+		t.Fatal("the lines were not said in the journal at all")
+	}
+
+}

cmd/mesh-controller/meshcli_test.go

@@ -24,7 +24,7 @@ var cliNodes = []inventory.Node{
 	{Name: "unnamed"},
 }
 
-func asked(account string, uid uint32, line ...string) link.CLIAsked {
+func cliAsked(account string, uid uint32, line ...string) link.CLIAsked {
 	return link.CLIAsked{Line: line, Account: account, UID: uid, Session: "session-1.scope"}
 }
 
@@ -39,13 +39,13 @@ func TestMeshCLIIsTheTerminalOnlyForTheControlNodesOperator(t *testing.T) {
 		refused    string
 		why        string
 	}{
-		{"the control-node's operator", "control", asked("operator", 1000, "status"), control, true, "", "the controller's terminal"},
-		{"another node's operator", "laptop", asked("operator", 1000, "status"), control, false, "", "agents on laptop may run as operator"},
-		{"another account", "control", asked("agent", 1001, "status"), control, false, "operator account (operator) only", ""},
-		{"root", "control", asked("root", 0, "status"), control, false, "never root", ""},
-		{"a node with no operator account", "unnamed", asked("operator", 1000, "status"), control, false, "does not know unnamed's operator account", ""},
-		{"a node the mesh does not know", "elsewhere", asked("operator", 1000, "status"), control, false, "not a node this mesh knows", ""},
-		{"two control-nodes", "control", asked("operator", 1000, "status"), []string{"control", "laptop"}, false, "", "2 control-nodes"},
+		{"the control-node's operator", "control", cliAsked("operator", 1000, "status"), control, true, "", "the controller's terminal"},
+		{"another node's operator", "laptop", cliAsked("operator", 1000, "status"), control, false, "", "agents on laptop may run as operator"},
+		{"another account", "control", cliAsked("agent", 1001, "status"), control, false, "operator account (operator) only", ""},
+		{"root", "control", cliAsked("root", 0, "status"), control, false, "never root", ""},
+		{"a node with no operator account", "unnamed", cliAsked("operator", 1000, "status"), control, false, "does not know unnamed's operator account", ""},
+		{"a node the mesh does not know", "elsewhere", cliAsked("operator", 1000, "status"), control, false, "not a node this mesh knows", ""},
+		{"two control-nodes", "control", cliAsked("operator", 1000, "status"), []string{"control", "laptop"}, false, "", "2 control-nodes"},
 	}
 	for _, c := range cases {
 		v := judgeCLI(c.node, c.asked, cliNodes, c.control)
@@ -70,7 +70,7 @@ func TestTheTerminalRunsWithoutAVerbAndAnOrdinaryCallNamesMeshCLI(t *testing.T)
 	t.Setenv(servedVar, "1")
 	ctx := context.Background()
 
-	a := runForMeshCLI(ctx, "control", asked("operator", 1000, "status"), cliVerdict{terminal: true, why: "the terminal"})
+	a := runForMeshCLI(ctx, "control", cliAsked("operator", 1000, "status"), cliVerdict{terminal: true, why: "the terminal"})
 	if a.Exit != 0 || a.Refused != "" || !a.Terminal {
 		t.Fatalf("the terminal's line did not run: %+v", a)
 	}
@@ -79,7 +79,7 @@ func TestTheTerminalRunsWithoutAVerbAndAnOrdinaryCallNamesMeshCLI(t *testing.T)
 		t.Fatalf("the terminal's line ran with %s", got)
 	}
 
-	a = runForMeshCLI(ctx, "laptop", asked("operator", 1000, "status"), cliVerdict{why: "not the terminal"})
+	a = runForMeshCLI(ctx, "laptop", cliAsked("operator", 1000, "status"), cliVerdict{why: "not the terminal"})
 	if a.Exit != 0 || a.Terminal || a.Why != "not the terminal" {
 		t.Fatalf("an ordinary line did not run as one: %+v", a)
 	}
@@ -93,21 +93,21 @@ func TestAnOrdinaryCallMeetsTheCommandVerbsRefusals(t *testing.T) {
 	t.Setenv(echoEnvironment, "1")
 	ctx := context.Background()
 	ordinary := cliVerdict{why: "not the terminal"}
-	a := runForMeshCLI(ctx, "laptop", asked("operator", 1000, "cleanup", "delete", "x"), ordinary)
+	a := runForMeshCLI(ctx, "laptop", cliAsked("operator", 1000, "cleanup", "delete", "x"), ordinary)
 	if a.Refused == "" || len(a.Stdout) != 0 || a.Exit != 1 || a.Why != "not the terminal" {
 		t.Fatalf("a repair without --why ran as an ordinary call: %+v", a)
 	}
-	a = runForMeshCLI(ctx, "laptop", asked("operator", 1000, "settings", "set", "claude-code", "{}"), ordinary)
+	a = runForMeshCLI(ctx, "laptop", cliAsked("operator", 1000, "settings", "set", "claude-code", "{}"), ordinary)
 	if a.Refused != "" || !strings.Contains(string(a.Stdout), `verb="mesh-cli"`) {
 		t.Fatalf("an ordinary settings set did not run through the settings verb's path with MESH_VERB set: %+v", a)
 	}
 	for _, server := range []string{"serve", "api", "board"} {
-		a := runForMeshCLI(ctx, "control", asked("operator", 1000, server), cliVerdict{terminal: true})
+		a := runForMeshCLI(ctx, "control", cliAsked("operator", 1000, server), cliVerdict{terminal: true})
 		if a.Refused == "" || len(a.Stdout) != 0 {
 			t.Fatalf("%s was run for mesh-cli: %+v", server, a)
 		}
 	}
-	a = runForMeshCLI(ctx, "control", asked("agent", 1001, "status"), cliVerdict{refused: "agent is not answered"})
+	a = runForMeshCLI(ctx, "control", cliAsked("agent", 1001, "status"), cliVerdict{refused: "agent is not answered"})
 	if a.Refused != "agent is not answered" || len(a.Stdout) != 0 {
 		t.Fatalf("a refused line ran: %+v", a)
 	}
@@ -184,9 +184,9 @@ func TestEveryMeshCLILineIsSaidInTheJournal(t *testing.T) {
 	cliJournal = func(line string) { said = append(said, line) }
 	t.Cleanup(func() { cliJournal = was })
 	ctx := link.WithCallID(context.Background(), "call-1")
-	runForMeshCLI(ctx, "control", asked("operator", 1000, "settings", "set", "x", `{"password":"s3cret"}`),
+	runForMeshCLI(ctx, "control", cliAsked("operator", 1000, "settings", "set", "x", `{"password":"s3cret"}`),
 		cliVerdict{terminal: true, why: "the terminal"})
-	runForMeshCLI(ctx, "control", asked("agent", 1001, "status"), cliVerdict{refused: "agent is not answered"})
+	runForMeshCLI(ctx, "control", cliAsked("agent", 1001, "status"), cliVerdict{refused: "agent is not answered"})
 	all := strings.Join(said, "\n")
 	if len(said) != 2 || !strings.Contains(all, "call-1") || !strings.Contains(all, "operator on control") ||
 		!strings.Contains(all, "as the controller's terminal") || !strings.Contains(all, "refused") {
@@ -213,7 +213,7 @@ func TestAnOrdinaryLineRunsNothingTheCommandVerbWouldRefuse(t *testing.T) {
 		if _, err := ordinaryLine(line); err == nil {
 			t.Errorf("%q composed as an ordinary line", line)
 		}
-		a := runForMeshCLI(context.Background(), "laptop", asked("operator", 1000, line...), cliVerdict{why: "not the terminal"})
+		a := runForMeshCLI(context.Background(), "laptop", cliAsked("operator", 1000, line...), cliVerdict{why: "not the terminal"})
 		if a.Refused == "" || len(a.Stdout) != 0 {
 			t.Errorf("%q ran as an ordinary line: %+v", line, a)
 		}
@@ -279,11 +279,11 @@ func TestTheTerminalsMarkIsStrippedFromEveryOtherLine(t *testing.T) {
 			}
 		}
 	}
-	a := runForMeshCLI(context.Background(), "laptop", asked("operator", 1000, "status"), cliVerdict{why: "not the terminal"})
+	a := runForMeshCLI(context.Background(), "laptop", cliAsked("operator", 1000, "status"), cliVerdict{why: "not the terminal"})
 	if got := string(a.Stdout); !strings.Contains(got, "terminal=false") || !strings.Contains(got, `verb="mesh-cli"`) {
 		t.Fatalf("an ordinary line with the mark in the serving environment ran as %s", got)
 	}
-	a = runForMeshCLI(context.Background(), "control", asked("operator", 1000, "status"), cliVerdict{terminal: true})
+	a = runForMeshCLI(context.Background(), "control", cliAsked("operator", 1000, "status"), cliVerdict{terminal: true})
 	if got := string(a.Stdout); !strings.Contains(got, "terminal=true") {
 		t.Fatalf("the terminal's line ran as %s", got)
 	}

cmd/mesh-controller/module_health.go

@@ -402,6 +402,7 @@ func moduleUnhealthyObservation(module, node string, rs []inventory.ResourceHeal
 		Explanation: fmt.Sprintf("%s on %s is not healthy: %s. It clears as soon as it runs again.", module, node,
 			namesWords(plain, 3)),
 		Needs:    needs,
+		Actions:  moduleActions(node, rs),
 		Resolved: fmt.Sprintf("%s works again on %s", module, node)}
 }
 
@@ -555,8 +556,8 @@ func moduleHealthWord(module, machine string, since time.Time, f gateFacts) (hea
 			said = append(said, wait)
 		}
 		if len(found) > 0 {
-			said = append(said, fmt.Sprintf("on %s, %s uses %s as found and waits for a person to hand it over "+
-				"(`mesh-host hand-over <directory>` at the machine)", machine, module, strings.Join(found, ", ")))
+			said = append(said, fmt.Sprintf("on %s, %s uses %s as found and waits for the operator to hand it over "+
+				"(`nox node hand-over %s <directory>` on the control-node)", machine, module, strings.Join(found, ", "), machine))
 		}
 		return healthPerson, strings.Join(said, "; ")
 	}
@@ -677,7 +678,9 @@ func usedAsFoundObservation(module, node, said string, rs []inventory.ResourceHe
 	o.Explanation = fmt.Sprintf("A directory of %s was already on %s, with another owner or mode than %s declares. "+
 		"The mesh left it as it was rather than hand it to an account, so %s may not be able to use it.",
 		module, node, module, module)
-	o.Needs = fmt.Sprintf("on %s, run mesh-host hand-over with the directory's path as root.", node)
+	// Plain words (ADR 0253): the line itself — `nox node hand-over <node> <path>` on the control-node (ADR 0272,
+	// issue 356) — is in the summary and the evidence, which name the directory; a path is never in these.
+	o.Needs = "hand the directory over from the control-node, as the operator; the details name it and the line to type."
 	o.Resolved = fmt.Sprintf("%s's directory on %s is the mesh's", module, node)
 	o.Actions = nil
 	return o

cmd/mesh-controller/network.go

@@ -426,10 +426,10 @@ func overlayShow(ctx context.Context, open *stores) error {
 				tunnel.Interface, tunnel.Range, tunnel.Port)
 		case n.Hub && hubName == n.Name && tunnel.Interface != "":
 			fmt.Printf("  hub — found a tunnel on %s and did NOT take it over: its key is not the tunnel's; "+
-				"`mesh-host overlay take --tunnel %s` on the machine takes it", tunnel.Interface, tunnel.Interface)
+				"`nox-mesh-host overlay take --tunnel %s` on the machine takes it", tunnel.Interface, tunnel.Interface)
 		case n.Hub:
 			fmt.Print("  hub — found no tunnel; if the machine runs the predecessor's, " +
-				"`mesh-host overlay take --tunnel <iface>` there adopts it (novox/hq ADR 0105)")
+				"`nox-mesh-host overlay take --tunnel <iface>` there adopts it (novox/hq ADR 0105)")
 		case !n.Reachable():
 			fmt.Print("  not dialable")
 		}

cmd/mesh-controller/nodes.go

@@ -10,6 +10,7 @@ import (
 	"io"
 	"net"
 	"os"
+	"path/filepath"
 	"strings"
 	"time"
 
@@ -17,6 +18,7 @@ import (
 	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
 	"github.com/novox/mesh-controller/internal/token"
 )
 
@@ -28,7 +30,7 @@ import (
 
 func nodeCommand(ctx context.Context, args []string) error {
 	if len(args) == 0 {
-		return errors.New("node add <name>, node list, node show <name>, or " + publicDomainUsage)
+		return errors.New("node add <name>, node list, node show <name>, " + publicDomainUsage + ", or " + handOverUsage)
 	}
 	open, err := openStores(ctx)
 	if err != nil {
@@ -112,11 +114,102 @@ func nodeCommand(ctx context.Context, args []string) error {
 		// an optional second argument is the home when it is not /home/<account>.
 		return nodeAccount(ctx, inv, args[1:])
 
+	case "hand-over":
+		// A directory the node-engine uses as found, handed to the mesh (novox/hq issue 356, issue 339). Here, at
+		// the controller's terminal, and nowhere else: at the next apply root gives the directory to the account
+		// the module declares, and whoever may call a verb includes agents.
+		return nodeHandOver(ctx, open, args[1:])
+
 	default:
-		return fmt.Errorf("node has no %q; it has add, list, show, public-domain, account and agent-account", args[0])
+		return fmt.Errorf("node has no %q; it has add, list, show, public-domain, account, agent-account and hand-over", args[0])
 	}
 }
 
+const handOverUsage = "node hand-over <node> <directory> — hand a directory the node-engine on <node> uses as found " +
+	"to the mesh: its next apply gives it the declared owner and mode. The directory's absolute path, as the module's " +
+	"condition names it"
+
+// handOverLine reads a hand-over's line: the node and the directory's absolute path, exactly as the engine states
+// it. Judged before anything is asked, and judged again by the engine, which is the one that acts.
+func handOverLine(args []string) (node, path string, err error) {
+	if len(args) != 2 {
+		return "", "", errors.New(handOverUsage)
+	}
+	node, path = args[0], args[1]
+	if node == "" || strings.HasPrefix(node, "-") {
+		return "", "", fmt.Errorf("%q is not a node's name; %s", node, handOverUsage)
+	}
+	if !filepath.IsAbs(path) {
+		return "", "", fmt.Errorf("%q is not an absolute path; %s", path, handOverUsage)
+	}
+	if filepath.Clean(path) != path {
+		return "", "", fmt.Errorf("%q is not the directory's path as the engine states it (no `..`, no doubled or "+
+			"trailing separator); %s", path, handOverUsage)
+	}
+	return node, path, nil
+}
+
+// handOverBy is who hands the directory over, in the words a verb's caller is recorded in: the operator through
+// mesh-cli on the control-node, or whoever runs this controller's binary at its terminal.
+func handOverBy() string {
+	if by := strings.TrimSpace(os.Getenv(link.CallerVar)); by != "" {
+		return by
+	}
+	return "the controller's terminal"
+}
+
+// nodeHandOver asks the node's engine to take a directory it uses as found as the mesh's, and says what came of
+// it. The engine records the hand-over or refuses; nothing is recorded here, because the directory is the
+// machine's and the engine is the one that reads it. The ask is signed with the mesh's key (issue 356's review).
+func nodeHandOver(ctx context.Context, open *stores, args []string) error {
+	known := func(node string) error {
+		_, err := open.inventory.NodeByName(ctx, node)
+		return err
+	}
+	ask := func(node, path, by string) (link.HandOverAnswer, error) {
+		ident, err := open.Identity(ctx)
+		if err != nil {
+			return link.HandOverAnswer{}, fmt.Errorf("the mesh's signing key cannot be read, so nothing was asked of %s: %w",
+				node, err)
+		}
+		address, err := broker.BusAddress()
+		if err != nil {
+			return link.HandOverAnswer{}, err
+		}
+		js, err := broker.Dial(address)
+		if err != nil {
+			return link.HandOverAnswer{}, fmt.Errorf("cannot reach the bus, so nothing was asked of %s: %w", node, err)
+		}
+		defer js.Close()
+		return link.AskHandOver(ctx, js.Conn(), ident, node, path, by, link.HandOverWithin)
+	}
+	return handOverAsked(args, known, ask, os.Stdout)
+}
+
+// handOverAsked is the hand-over's line with its two acts given: whether the mesh knows the node, and the ask.
+// Nothing is asked of a line or a node that is refused, and the engine's refusal is this command's failure —
+// never a success with the refusal printed.
+func handOverAsked(args []string, known func(node string) error,
+	ask func(node, path, by string) (link.HandOverAnswer, error), out io.Writer) error {
+	node, path, err := handOverLine(args)
+	if err != nil {
+		return err
+	}
+	if err := known(node); err != nil {
+		return fmt.Errorf("nothing was asked: %w", err)
+	}
+	answer, err := ask(node, path, handOverBy())
+	if err != nil {
+		return err
+	}
+	if answer.Refused != "" {
+		return fmt.Errorf("%s refused: %s", node, answer.Refused)
+	}
+	fmt.Fprintln(out, answer.Said)
+	fmt.Fprintf(out, "  the module's condition clears once %s applies; `nox push %s` applies it now\n", node, node)
+	return nil
+}
+
 // addNode creates a node record, adopted when the operator says so (novox/hq ADR 0100).
 func addNode(ctx context.Context, inv *inventory.Inventory, args []string) error {
 	set := flag.NewFlagSet("node add", flag.ContinueOnError)

cmd/mesh-controller/plain_words.go

@@ -680,6 +680,8 @@ func walkWaitingWords(w waitFacts, in time.Duration, severity conditions.Severit
 }
 
 // waitingNeeds is what the operator does about a walk waiting past its urgent bound: nothing before it.
+// Start and Stop are also asked of the operator (novox/hq ADR 0259); the condition's own words keep saying
+// where they are given without a channel, and the ask's text drops that (askText).
 func waitingNeeds(severity conditions.Severity) string {
 	if severity == conditions.Urgent {
 		return "start it, or stop it, " + FromMeshMCPServer
@@ -687,6 +689,20 @@ func waitingNeeds(severity conditions.Severity) string {
 	return ""
 }
 
+// waitingActions are the answers to a walk waiting past its urgent bound: start it, or stop it — the plan's
+// own verbs, approved by the operator (novox/hq ADR 0259). None before the bound.
+func waitingActions(plan string, severity conditions.Severity) []conditions.Action {
+	if severity != conditions.Urgent || plan == "" {
+		return nil
+	}
+	return []conditions.Action{
+		{Label: "Start", Verb: "mesh-controller.plans", Level: conditions.LevelApprove,
+			Arguments: map[string]string{"go": plan, "why": "", "cause": conditions.CauseOperatorAnswer}},
+		{Label: "Stop", Verb: "mesh-controller.plans", Level: conditions.LevelApprove,
+			Arguments: map[string]string{"stop": plan, "why": "", "cause": conditions.CauseOperatorAnswer}},
+	}
+}
+
 // moduleNeeds is what the operator can do about a module unhealthy on a machine: log in again where its
 // account's groups wait for it (ADR 0252), restart a failed service, or nothing where the mesh restarts it.
 // No answer is offered for a restart: a desk click performs only an acknowledgement (ADR 0258).
@@ -701,11 +717,35 @@ func moduleNeeds(node string, rs []inventory.ResourceHealth) string {
 		}
 	}
 	if unit != "" {
+		// Also asked of the operator (moduleActions); the ask's text drops where (askText).
 		return fmt.Sprintf("restart its service %s on %s %s", unit, node, FromMeshMCPServer)
 	}
 	return ""
 }
 
+// moduleActions are the answers to a module unhealthy on a machine: restart its failed service there,
+// approved by the operator (novox/hq ADR 0259) — none when the mesh restarts it, or a new login is what it
+// waits for.
+func moduleActions(node string, rs []inventory.ResourceHealth) []conditions.Action {
+	for _, r := range rs {
+		if strings.Contains(r.Reason, "relogin needed") {
+			return nil
+		}
+	}
+	for _, r := range rs {
+		if r.Kind != link.KindUnit || r.Target == "" {
+			continue
+		}
+		scope := "system"
+		if r.Account != "" {
+			scope = "user"
+		}
+		return []conditions.Action{{Label: "Restart", Verb: "node-service-manager.restart", Machine: node,
+			Level: conditions.LevelApprove, Arguments: map[string]string{"unit": r.Target, "scope": scope}}}
+	}
+	return nil
+}
+
 // FromMeshMCPServer ends what the operator needs when no notification can do it (ADR 0258), naming the mesh MCP
 // server (the glossary's word; "console" is retired): the answer is not an
 // acknowledgement, so it is given where the operator is known to be the one asking, until answers are
@@ -776,15 +816,19 @@ func stalledWords(l stalledLine, o conditions.Observation) (headline, explanatio
 		long = "for " + humanDuration(d)
 	}
 	if o.Resolver == conditions.ResolverOperator {
-		// Words only: releasing or stopping a delivery is not an acknowledgement, so no desk click
-		// performs it (ADR 0258).
+		// Asked of the operator, approved on a channel that proves who answered (novox/hq ADR 0259); the
+		// router says where each can be answered, so the words do not.
+		release := conditions.Action{Label: "Release", Verb: "mesh-delivery.release", Level: conditions.LevelApprove,
+			Arguments: map[string]string{"id": l.ID, "why": ""}}
+		stop := conditions.Action{Label: "Stop", Verb: "mesh-delivery.stop", Level: conditions.LevelApprove,
+			Arguments: map[string]string{"id": l.ID, "why": ""}}
 		switch held {
 		case "held":
-			needs = "release it, or stop it, " + FromMeshMCPServer
+			needs, actions = "release it, or stop it, "+FromMeshMCPServer, []conditions.Action{release, stop}
 		case "ready", "checked":
 			needs = "merge its pull request, or close it."
 		default:
-			needs = "stop it " + FromMeshMCPServer
+			needs, actions = "stop it "+FromMeshMCPServer, []conditions.Action{stop}
 		}
 	}
 	return fmt.Sprintf("Delivery of %s %s %s", name, held, long),

cmd/mesh-controller/plain_words_test.go

@@ -65,13 +65,21 @@ func TestADeliveryWaitingNeedsNothingUntilItsBoundThenOffersStartAndStop(t *test
 		t.Errorf("the summary lost the way on for whoever looks closer: %q", got[0].Summary)
 	}
 
-	// Past four hours it is urgent, and offers the controller's own answers.
+	// Past four hours it is urgent, and asks the operator to start or stop it (novox/hq ADR 0259): the plan's
+	// own verbs, approved, which the controller performs on the warrant. The router says where to answer.
 	f.waits[0].since = now.Add(-5 * time.Hour)
 	got = watchWaits(f)
 	plainExample(t, got[0], "openrazer delivery waiting to start",
 		"Needs you: start it, or stop it, from the mesh MCP server; this notification cannot do it. The change to openrazer is merged and built, and mesh-delivery (the "+
 			"module that decides when a delivery goes out) has not let it start for 5 hours, so mesh-delivery may "+
-			"be stuck.")
+			"be stuck.", "Start", "Stop")
+	for i, want := range []string{"go", "stop"} {
+		a := got[0].Actions[i]
+		if a.Verb != "mesh-controller.plans" || a.Arguments[want] != "plan-1791454185265004861" ||
+			a.Level != conditions.LevelApprove || a.Arguments["cause"] != conditions.CauseOperatorAnswer {
+			t.Errorf("%s: %+v", a.Label, a)
+		}
+	}
 
 	// Many modules are counted, not listed in the headline.
 	f.waits[0].modules = []string{"a", "b", "c", "d"}
@@ -82,16 +90,20 @@ func TestADeliveryWaitingNeedsNothingUntilItsBoundThenOffersStartAndStop(t *test
 }
 
 // **A module unhealthy**: "openrazer on g14 is not healthy: its unit openrazer-daemon.service failed in the
-// account's own service manager (exit-code)". Restarting is not an acknowledgement, so it is said in words
-// and offered as no answer (ADR 0258).
+// account's own service manager (exit-code)". Restarting is not an acknowledgement: it is asked of the
+// operator at the approve level (novox/hq ADR 0259), so a desk click never performs it (ADR 0258).
 func TestAModuleUnhealthyAsksForARestartInWords(t *testing.T) {
 	o := moduleUnhealthyObservation("openrazer", "g14", []inventory.ResourceHealth{{Kind: link.KindUnit,
-		Resource: "openrazer-daemon", Target: "openrazer-daemon.service",
+		Resource: "openrazer-daemon", Target: "openrazer-daemon.service", Account: "jochen",
 		Reason: "failed in the account's own service manager (exit-code)", Since: time.Now()}})
 	plainExample(t, o, "openrazer not working on g14",
 		"Needs you: restart its service openrazer-daemon on g14 from the mesh MCP server; this notification cannot do it. "+
 			"openrazer on g14 is not healthy: its service openrazer-daemon stopped with an error. It clears as soon "+
-			"as it runs again.")
+			"as it runs again.", "Restart")
+	if a := o.Actions[0]; a.Verb != "node-service-manager.restart" || a.Machine != "g14" || a.Level != conditions.LevelApprove ||
+		a.Arguments["unit"] != "openrazer-daemon.service" || a.Arguments["scope"] != "user" {
+		t.Errorf("restart: %+v", a)
+	}
 	// An account waiting for a new login (ADR 0252) asks for the login, held to the plain rule.
 	o = moduleUnhealthyObservation("openrazer", "g14", []inventory.ResourceHealth{{Kind: "account",
 		Resource: "operator-in-group", Target: "jochen", Reason: "relogin needed: the account is in the group"}})
@@ -154,7 +166,12 @@ func TestADeliveryHeldAsksForReleaseOrStopInWords(t *testing.T) {
 		Bound: "24h0m0s", H2: "none: the state is the operator's", Says: "it waits for the operator"}})
 	plainExample(t, got[0], "Delivery of hq held for 36 hours",
 		"Needs you: release it, or stop it, from the mesh MCP server; this notification cannot do it. A delivery of hq has been held for 36 hours, past its limit.",
-	)
+		"Release", "Stop")
+	for i, verb := range []string{"mesh-delivery.release", "mesh-delivery.stop"} {
+		if a := got[0].Actions[i]; a.Verb != verb || a.Arguments["id"] != "novox/hq@055550802096" || a.Level != conditions.LevelApprove {
+			t.Errorf("%+v", a)
+		}
+	}
 }
 
 // **Every kind the controller raises has plain words**, and its words are plain for a subject of every

cmd/mesh-controller/plan.go

@@ -512,15 +512,6 @@ func sortedKeysOf(m map[string]string) []string {
 	return out
 }
 
-// sayPlanDiff is `plan --diff`: what the declaration leaves out, then the diff. A module left out is not in
-// the body, so the diff alone would say "nothing would change" for a module just assigned whose settings
-// cannot compose — success-shaped silence. Said first, with why, as push and the plain plan say it
-// (novox/hq ADR 0163, rule 6).
-func sayPlanDiff(node string, declared sendable, diff func() error) error {
-	reportLeftOut(node, declared)
-	return diff()
-}
-
 // reportLeftOut says which of a machine's modules its declaration leaves out and why (novox/hq ADR
 // 0163, rule 6), one line each: the machine is told everything else, and is told it was left out.
 func reportLeftOut(node string, declared sendable) {
@@ -1248,9 +1239,11 @@ func planCommand(ctx context.Context, args []string) error {
 		if err != nil {
 			return err
 		}
-		return sayPlanDiff(args[0], declared, func() error {
-			return writePlanDiff(ctx, open.inventory, args[0], body)
-		})
+		// A module left out is not in the body, so the diff alone would say "nothing would change" for
+		// a module just assigned whose settings cannot compose — success-shaped silence. Said first, with
+		// why, as push and the plain plan say it (novox/hq ADR 0163, rule 6).
+		reportLeftOut(args[0], declared)
+		return writePlanDiff(ctx, open.inventory, args[0], body)
 	}
 	if *asJSON {
 		declared, err := declarationFor(ctx, open, args[0], plan, settings)

cmd/mesh-controller/plan_diff_left_out_test.go

@@ -1,25 +0,0 @@
-package main
-
-import (
-	"os"
-	"strings"
-	"testing"
-)
-
-// 2026-10-09: nfs-server was assigned to the home server, its file asked for a setting nothing set, and
-// `plan --diff` said "nothing would change". The diff now says what is left out, and why, before the diff.
-func TestPlanDiffSaysAModuleLeftOutBeforeTheDiff(t *testing.T) {
-	declared := sendable{LeftOut: []string{"nfs-server"},
-		leftOutWhy: map[string]string{"nfs-server": `nothing sets "shares" for it`}}
-	said := printed(t, func() error {
-		return sayPlanDiff("home", declared, func() error {
-			writeDiff(os.Stdout, "home", sentDiff{}, nil)
-			return nil
-		})
-	})
-	left := strings.Index(said, "home: nfs-server left out")
-	nothing := strings.Index(said, "home: nothing would change")
-	if left < 0 || !strings.Contains(said, `nothing sets "shares" for it`) || nothing < left {
-		t.Errorf("the left-out module and why, then the diff:\n%s", said)
-	}
-}

cmd/mesh-controller/probe_agent_root.go

@@ -0,0 +1,376 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/nats-io/nats.go"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// Who can become root where the trusted parties run (novox/hq ADR 0259 §8, as reviewed on 2026-10-09).
+//
+// The router and every channel proving its sender run as accounts of their own, so that no agent reads what
+// they hold or speaks as them. **Root on their machine undoes all of it**, and so does an agent running as the
+// operator's account there. A machine is **root-free** — an answer proven there may authorise — only when all
+// of these are measured, now, and hold:
+//
+//  1. the machine names an account agents run as (novox/hq ADR 0266), so no agent runs as the operator's
+//     account, which may become root;
+//  2. its node-engine — running as root, which no agent controls — judged that account unable to become root
+//     without a person, in a statement heard within the last 15 minutes (agentConfined, judgedConfined);
+//  3. the login shell's `execute` is not served there (novox/hq ADR 0268): its holder's setting withholds it
+//     **and** the bus was asked and heard no `execute` answered there. `execute` runs commands as the machine's
+//     runtime account, which the mesh's acting tools give passwordless sudo; that account is taken to become
+//     root, always, so no measure of it is asked.
+//
+// **Nothing else is a pass.** A machine that names no agent account, an unknown machine, a store or bus that
+// could not be read, a verdict stale or absent — each is not root-free, and says why. The sudo module's own
+// measure is no longer part of this judgement: it ran in the machine's runtime, as the very account an agent
+// could become, so it could not be believed.
+//
+// The one judgement (judgeRoot) is read two ways: the self-check raises `root-not-free` on every machine where
+// the router or a module of its own account runs and the judgement fails; and the `root-free` verb answers it
+// live, to the router, which honours a verified sender only on its pass. A machine holding the operator's
+// graphical session, where a messaging client's desktop app may run, is not judged here: the operator accepted
+// that gap for now (hq issue 344).
+
+// kindRootNotFree is the condition a trusted party's machine that is not root-free raises. Its own key, apart
+// from ADR 0266's agent-can-become-root (Token agent-root, from DA): the two judge different things — DA the
+// agent account alone, this the whole of root-free — and one key from two probes flapped between them (the
+// confirmation review of 2026-10-09).
+const kindRootNotFree = "root-not-free"
+
+// routerSeat is the seat the router holds: where it runs counts as a trusted party's machine.
+const routerSeat = "operator-channel"
+
+const (
+	loginShellSeat = "node-login-shell"
+	// loginShellVerb is the seat's verb that runs a command, and the name of the setting its holder withholds
+	// it by (novox/hq ADR 0268).
+	loginShellVerb = "execute"
+	// executeServes is the one value of that setting that serves the verb; anything else withholds it.
+	executeServes = "serve"
+)
+
+// loginShellServed judges whether the login shell's execute is served on a machine, failing closed (novox/hq
+// ADR 0268): served while the holder's setting there is `serve` (or the holder has no such setting and claims
+// the verb), or while the bus heard the verb answered there, or while the bus could not be asked. why says
+// which, in words.
+func loginShellServed(holder string, claims bool, setting *any, heard, asked bool) (bool, string) {
+	var why []string
+	switch {
+	case setting != nil:
+		if v, _ := (*setting).(string); v == executeServes {
+			why = append(why, holder+"'s execute setting there is "+executeServes)
+		}
+	case claims:
+		why = append(why, holder+" claims execute and has no setting that withholds it")
+	}
+	if heard {
+		why = append(why, "the bus hears execute answered there")
+	} else if !asked {
+		why = append(why, "the bus could not be asked whether execute is answered there")
+	}
+	return len(why) > 0, strings.Join(why, "; ")
+}
+
+// rootFacts is what the judgement reads of one machine.
+type rootFacts struct {
+	Machine string
+	// Unread is every read that failed, in words: any one is a fail.
+	Unread []string
+	// AgentNamed is whether the machine names an agent account; Confined whether its node-engine judged it
+	// unable to become root, freshly; ConfinedWhy the judgement's words either way.
+	AgentNamed  bool
+	Confined    bool
+	ConfinedWhy string
+	// Execute is whether the login shell's execute is served there; ExecuteWhy why, in words.
+	Execute    bool
+	ExecuteWhy string
+	// SearchPending is the agent account unjudged only because the node-engine's first setuid search runs,
+	// within its bound (ADR 0266's quiet window).
+	SearchPending bool
+}
+
+// rootVerdict is the judgement on one machine, as the root-free verb answers it.
+type rootVerdict struct {
+	Machine string    `json:"machine"`
+	Free    bool      `json:"free"`
+	Why     string    `json:"why"`
+	Judged  time.Time `json:"judged"`
+	// Quiet is a machine not free only because its first setuid search still runs, within its bound: the
+	// self-check raises nothing for it then (ADR 0266's quiet window). It is never free for it.
+	Quiet bool `json:"quiet,omitempty"`
+}
+
+// judgeRoot is the one judgement: free only when nothing failed to read, an agent account is named and judged
+// confined, and execute is not served.
+func judgeRoot(f rootFacts, now time.Time) rootVerdict {
+	v := rootVerdict{Machine: f.Machine, Judged: now.UTC()}
+	var not []string
+	if len(f.Unread) > 0 {
+		not = append(not, "not measured: "+strings.Join(f.Unread, "; "))
+	}
+	switch {
+	case f.ConfinedWhy == "":
+		// Not read (said above), or nothing said of it: never a pass.
+		if len(f.Unread) == 0 {
+			not = append(not, "whether agents there can become root was not judged")
+		}
+	case !f.AgentNamed:
+		not = append(not, "agents run as the operator's account there, which may become root ("+f.ConfinedWhy+")")
+	case !f.Confined:
+		not = append(not, f.ConfinedWhy)
+	}
+	if f.Execute {
+		not = append(not, "the login shell runs any command an agent gives it as the machine's runtime account, "+
+			"which can become root ("+orNoneKnown(f.ExecuteWhy)+")")
+	}
+	if len(not) > 0 {
+		v.Why = strings.Join(not, "; ")
+		// The one failure is the agent account not judged yet, because its first search runs.
+		v.Quiet = len(not) == 1 && f.SearchPending && f.AgentNamed && !f.Confined && len(f.Unread) == 0 && !f.Execute
+		return v
+	}
+	v.Free = true
+	v.Why = f.ConfinedWhy + "; the login shell's execute is not served there"
+	return v
+}
+
+// rootReader reads the facts of machines live: the catalogue's placements, the node-engine's verdicts and the
+// bus's discovery, each once per reader.
+type rootReader struct {
+	entries []inventory.Entry
+	read    error
+	heard   map[string]map[string]map[string]bool
+	asked   error
+	// confined is agentConfined; settings the login shell holder's settings on a machine. Replaceable in a test.
+	confined func(ctx context.Context, node string, now time.Time) (named, confined bool, why string, err error)
+	// quiet says the one thing keeping a machine's agent account unjudged is the node-engine's first setuid
+	// search, within its bound (ADR 0266, searchStillRunning). Read by the self-check alone, to raise nothing
+	// then; nil reads no quiet. It never makes a machine root-free.
+	quiet    func(ctx context.Context, node string, now time.Time) bool
+	settings func(ctx context.Context, node, module string) ([]catalogue.Layer, error)
+}
+
+func newRootReader(ctx context.Context, inv *inventory.Inventory, conn *nats.Conn) *rootReader {
+	r := &rootReader{}
+	r.entries, r.read = inv.Catalogued(ctx)
+	if conn == nil {
+		r.asked = fmt.Errorf("this process holds no connection to the bus")
+	} else {
+		r.heard, r.asked = discoverSeatVerbs(ctx, conn)
+	}
+	r.confined = func(ctx context.Context, node string, now time.Time) (bool, bool, string, error) {
+		return agentConfined(ctx, inv, node, now)
+	}
+	r.settings = inv.SettingsFor
+	return r
+}
+
+// facts reads one machine, at now.
+func (r *rootReader) facts(ctx context.Context, machine string, now time.Time) rootFacts {
+	f := rootFacts{Machine: machine}
+	if r.read != nil {
+		f.Unread = append(f.Unread, "the catalogue's placements could not be read: "+r.read.Error())
+	}
+	named, confined, why, err := r.confined(ctx, machine, now)
+	if err != nil {
+		f.Unread = append(f.Unread, "the account agents run as could not be read: "+err.Error())
+	} else {
+		f.AgentNamed, f.Confined, f.ConfinedWhy = named, confined, why
+	}
+	f.Execute, f.ExecuteWhy = r.executeServed(ctx, machine)
+	if r.quiet != nil && f.AgentNamed && !f.Confined {
+		f.SearchPending = r.quiet(ctx, machine, now)
+	}
+	return f
+}
+
+// executeServed is whether the login shell's execute is served on a machine, failing closed: the bus not
+// asked, the placements not read, or a holder's setting not read, is served.
+func (r *rootReader) executeServed(ctx context.Context, machine string) (bool, string) {
+	heard := r.heard[loginShellSeat][loginShellVerb][machine]
+	asked := r.asked == nil
+	var whys []string
+	served := false
+	holders := 0
+	for _, e := range r.entries {
+		if !e.Manifest.ClaimsSeat(loginShellSeat) || !slices.Contains(e.On, machine) {
+			continue
+		}
+		holders++
+		var setting *any
+		if _, declared := e.Manifest.Settings[loginShellVerb]; declared {
+			layers, err := r.settings(ctx, machine, e.Manifest.Module)
+			if err != nil {
+				served = true
+				whys = append(whys, e.Manifest.Module+"'s setting there could not be read: "+err.Error())
+				continue
+			}
+			for _, s := range catalogue.Effective(e.Manifest, layers) {
+				if s.Key == loginShellVerb {
+					v := s.Value
+					setting = &v
+				}
+			}
+		}
+		if s, why := loginShellServed(e.Manifest.Module, claimServes(e.Manifest, loginShellSeat, loginShellVerb),
+			setting, heard, asked); s {
+			served = true
+			whys = append(whys, why)
+		}
+	}
+	if holders == 0 {
+		// Nobody is assigned to serve it; the bus must still hear nobody answering it.
+		if s, why := loginShellServed("no holder", false, nil, heard, asked); s {
+			served = true
+			whys = append(whys, why)
+		}
+	}
+	if r.read != nil {
+		served = true
+		whys = append(whys, "who holds the login shell there could not be read")
+	}
+	return served, strings.Join(whys, "; ")
+}
+
+// claimServes says whether a manifest's claim of a seat names a verb among those it serves.
+func claimServes(m catalogue.Manifest, seat, verb string) bool {
+	for _, c := range m.Claims {
+		if c.Name == seat && slices.Contains(c.Serves, verb) {
+			return true
+		}
+	}
+	return false
+}
+
+// judgeRootFree is the root-free verb's answer: each named machine judged now. It never fails: what could not
+// be read is a machine not free, saying so.
+func judgeRootFree(ctx context.Context, r *rootReader, machines []string, now time.Time) []rootVerdict {
+	out := make([]rootVerdict, 0, len(machines))
+	for _, m := range machines {
+		out = append(out, judgeRoot(r.facts(ctx, m, now), now))
+	}
+	return out
+}
+
+// trustedMachines are the machines where the router or a module of its own account runs, each with those
+// modules.
+func trustedMachines(entries []inventory.Entry) map[string][]string {
+	trusted := map[string][]string{}
+	for _, e := range entries {
+		for _, node := range e.On {
+			if e.Manifest.RunsAs != "" || e.Manifest.ClaimsSeat(routerSeat) {
+				trusted[node] = append(trusted[node], e.Manifest.Module)
+			}
+		}
+	}
+	return trusted
+}
+
+// agentRootObservation is the condition of a trusted party's machine that is not root-free.
+func agentRootObservation(v rootVerdict, trusted []string) conditions.Observation {
+	trusted = append([]string(nil), trusted...)
+	sort.Strings(trusted)
+	return conditions.Observation{Scope: conditions.ScopeMachine, ID: v.Machine, Token: kindRootNotFree,
+		Machine: v.Machine, Kind: kindRootNotFree, Severity: conditions.Urgent,
+		Summary: fmt.Sprintf("%s is not root-free, where %s run: until it is, the router approves nothing proven "+
+			"there (novox/hq ADR 0259 §8): %s", v.Machine, strings.Join(trusted, ", "), v.Why),
+		Headline: "Phone answers held on " + v.Machine,
+		Needs:    "give the programs working for you on " + v.Machine + " an account that cannot become root.",
+		Explanation: "The modules that prove your answers from your phone run on " + v.Machine + ", and the mesh " +
+			"cannot show that a program working for you there is unable to become root or to act as you. Until " +
+			"it can, answers from your phone can only acknowledge.",
+		Resolved: "Answers from your phone can approve again on " + v.Machine}
+}
+
+// probeAgentRoot is the probe: every trusted party's machine, judged by the one judgement.
+func probeAgentRoot(ctx context.Context, d *doctor) ([]conditions.Observation, error) {
+	var conn *nats.Conn
+	if d.js != nil {
+		conn = d.js.Conn()
+	}
+	inv := d.open.inventory
+	r := newRootReader(ctx, inv, conn)
+	if r.read != nil {
+		return nil, r.read
+	}
+	// The self-check alone reads ADR 0266's quiet window: nothing raised while a machine's first setuid search
+	// runs, within its bound. The root-free verb never reads it, so the machine still answers not free.
+	r.quiet = func(ctx context.Context, node string, now time.Time) bool {
+		n, err := inv.NodeByName(ctx, node)
+		if err != nil || n.AgentAccount == "" {
+			return false
+		}
+		h, had, err := inv.HealthOf(ctx, node)
+		if err != nil {
+			return false
+		}
+		quiet, err := searchStillRunning(ctx, inv, node, n.AgentAccount, h, had, now)
+		return err == nil && quiet
+	}
+	return rootObservations(ctx, r, trustedMachines(r.entries), time.Now()), nil
+}
+
+// rootObservations judges the machines and says each that fails.
+func rootObservations(ctx context.Context, r *rootReader, trusted map[string][]string, now time.Time) []conditions.Observation {
+	var machines []string
+	for m := range trusted {
+		machines = append(machines, m)
+	}
+	sort.Strings(machines)
+	var out []conditions.Observation
+	for _, v := range judgeRootFree(ctx, r, machines, now) {
+		if !v.Free && !v.Quiet {
+			out = append(out, agentRootObservation(v, trusted[v.Machine]))
+		}
+	}
+	return out
+}
+
+// rootClock is the clock the root-free verb judges by.
+var rootClock = time.Now
+
+// rootFreeAnswer is the root-free verb: the named machines, each judged now by the serving controller. Only it
+// answers: a process that is not serving says so, and a caller reads that as no machine free.
+func rootFreeAnswer(ctx context.Context, machines string, now time.Time) (any, error) {
+	d := doctorFrom
+	if d == nil || d.open == nil || d.open.inventory == nil {
+		return nil, fmt.Errorf("this controller is not serving, so it judges no machine root-free: ask again, and " +
+			"the serving controller answers")
+	}
+	var names []string
+	for _, m := range strings.Split(machines, ",") {
+		if m = strings.TrimSpace(m); m != "" && !slices.Contains(names, m) {
+			names = append(names, m)
+		}
+	}
+	if len(names) == 0 {
+		return nil, fmt.Errorf("root-free judges the machines named, and none was")
+	}
+	var conn *nats.Conn
+	if d.js != nil {
+		conn = d.js.Conn()
+	}
+	return map[string]any{"machines": judgeRootFree(ctx, newRootReader(ctx, d.open.inventory, conn), names, now)}, nil
+}
+
+// rootFreeNow is the machines judged root-free, for composing a push's memberships: only those that pass.
+func rootFreeNow(ctx context.Context, r *rootReader, machines []string, now time.Time) map[string]bool {
+	free := map[string]bool{}
+	for _, v := range judgeRootFree(ctx, r, machines, now) {
+		if v.Free {
+			free[v.Machine] = true
+		}
+	}
+	return free
+}

cmd/mesh-controller/probe_agent_root_test.go

@@ -0,0 +1,265 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+var rootNow = time.Date(2026, 10, 9, 12, 0, 0, 0, time.UTC)
+
+// A machine is root-free only on a positive measure of each thing (the review of 2026-10-09, H2/H3): every
+// read succeeded, an agent account is named and judged confined by the node-engine, execute is not served.
+func TestRootFreeIsAPositiveMeasureAndNothingElse(t *testing.T) {
+	pass := rootFacts{Machine: "anchor", AgentNamed: true, Confined: true,
+		ConfinedWhy: "the agent account agents cannot become root without a person (judged 2026-10-09 12:00)"}
+	if v := judgeRoot(pass, rootNow); !v.Free || v.Machine != "anchor" || !v.Judged.Equal(rootNow) {
+		t.Fatalf("the one pass: %+v", v)
+	}
+	fails := map[string]func(*rootFacts){
+		"a read failed":            func(f *rootFacts) { f.Unread = []string{"the store did not answer"} },
+		"no agent account named":   func(f *rootFacts) { f.AgentNamed, f.Confined = false, false },
+		"not confined":             func(f *rootFacts) { f.Confined = false },
+		"nothing said of it":       func(f *rootFacts) { f.ConfinedWhy = "" },
+		"execute served":           func(f *rootFacts) { f.Execute, f.ExecuteWhy = true, "the bus hears execute answered there" },
+		"confined, but agent read": func(f *rootFacts) { f.Unread, f.ConfinedWhy = []string{"x"}, "" },
+	}
+	for name, mutate := range fails {
+		f := pass
+		mutate(&f)
+		if v := judgeRoot(f, rootNow); v.Free || v.Why == "" {
+			t.Errorf("%s: judged %+v", name, v)
+		}
+	}
+}
+
+// The reader fails closed on every case the review named: the agent account read only where the coding-agent
+// module runs (old :225), no account to measure taken for a pass (old :246), and a measure that did not answer
+// taken for "not root" (old :114, :123).
+func TestTheRootReaderFailsClosed(t *testing.T) {
+	shell := catalogue.Manifest{Module: "zsh", Claims: []catalogue.Claim{{Name: loginShellSeat, Serves: []string{"execute"}}},
+		Settings: map[string]catalogue.SettingDeclaration{"execute": {Default: "withhold"}}}
+	reader := func() *rootReader {
+		return &rootReader{
+			entries: []inventory.Entry{{Manifest: shell, On: []string{"anchor"}}},
+			heard:   map[string]map[string]map[string]bool{},
+			confined: func(context.Context, string, time.Time) (bool, bool, string, error) {
+				return true, true, "the agent account agents cannot become root without a person", nil
+			},
+			settings: func(context.Context, string, string) ([]catalogue.Layer, error) { return nil, nil },
+		}
+	}
+	ctx := context.Background()
+	if v := judgeRootFree(ctx, reader(), []string{"anchor"}, rootNow)[0]; !v.Free {
+		t.Fatalf("the control: agents confined, execute withheld and unheard, everything read: %+v", v)
+	}
+	cases := map[string]func(*rootReader){
+		"no agent account named, no coding-agent module there": func(r *rootReader) {
+			r.confined = func(context.Context, string, time.Time) (bool, bool, string, error) {
+				return false, false, "anchor names no agent account: agents run as the operator account (ops)", nil
+			}
+		},
+		"the node-engine's verdict not read": func(r *rootReader) {
+			r.confined = func(context.Context, string, time.Time) (bool, bool, string, error) {
+				return false, false, "", errors.New("the store did not answer")
+			}
+		},
+		"a stale verdict": func(r *rootReader) {
+			r.confined = func(context.Context, string, time.Time) (bool, bool, string, error) {
+				return true, false, "the agent account agents is not judged: the machine's newest statement was heard at …", nil
+			}
+		},
+		"the bus not asked":       func(r *rootReader) { r.asked = errors.New("no bus") },
+		"the placements not read": func(r *rootReader) { r.read = errors.New("no store") },
+		"the holder's setting not read": func(r *rootReader) {
+			r.settings = func(context.Context, string, string) ([]catalogue.Layer, error) { return nil, errors.New("no store") }
+		},
+		"execute heard on the bus": func(r *rootReader) {
+			r.heard = map[string]map[string]map[string]bool{loginShellSeat: {"execute": {"anchor": true}}}
+		},
+		"a holder that serves execute": func(r *rootReader) {
+			r.entries[0].Manifest.Settings = nil
+		},
+	}
+	for name, mutate := range cases {
+		r := reader()
+		mutate(r)
+		if v := judgeRootFree(ctx, r, []string{"anchor"}, rootNow)[0]; v.Free {
+			t.Errorf("%s: judged free: %+v", name, v)
+		}
+	}
+	// A machine with no login shell holder at all: still the bus must hear none.
+	r := reader()
+	r.entries = nil
+	r.heard = map[string]map[string]map[string]bool{loginShellSeat: {"execute": {"anchor": true}}}
+	if v := judgeRootFree(ctx, r, []string{"anchor"}, rootNow)[0]; v.Free {
+		t.Errorf("execute answered by a module nobody assigned: %+v", v)
+	}
+}
+
+// The probe says agent-root, by the same judgement, on each machine where the router or a module of its own
+// account runs and that is not root-free; urgent and in plain words; nothing where every one is free.
+func TestTheProbeSaysEachMachineThatIsNotRootFree(t *testing.T) {
+	entries := []inventory.Entry{
+		{Manifest: catalogue.Manifest{Module: "telegram", RunsAs: "telegram"}, On: []string{"anchor"}},
+		{Manifest: catalogue.Manifest{Module: "messenger", RunsAs: "messenger",
+			Claims: []catalogue.Claim{{Name: routerSeat}}}, On: []string{"anchor"}},
+		{Manifest: catalogue.Manifest{Module: "xorg", Claims: []catalogue.Claim{{Name: catalogue.DisplayServerSeat}}},
+			On: []string{"laptop"}},
+	}
+	trusted := trustedMachines(entries)
+	if len(trusted["anchor"]) != 2 || len(trusted["laptop"]) != 0 {
+		t.Fatalf("trusted %v", trusted)
+	}
+	r := &rootReader{entries: entries, heard: map[string]map[string]map[string]bool{},
+		confined: func(_ context.Context, node string, _ time.Time) (bool, bool, string, error) {
+			return false, false, node + " names no agent account: agents run as the operator account (ops)", nil
+		},
+		settings: func(context.Context, string, string) ([]catalogue.Layer, error) { return nil, nil }}
+	got := rootObservations(context.Background(), r, trusted, rootNow)
+	if len(got) != 1 || got[0].Machine != "anchor" || got[0].Kind != kindRootNotFree || got[0].Severity != conditions.Urgent ||
+		!strings.Contains(got[0].Summary, "messenger, telegram") || !strings.Contains(got[0].Summary, "names no agent account") {
+		t.Fatalf("said %+v", got)
+	}
+	o := got[0]
+	if why, ok := conditions.PlainWords(conditions.Words{Headline: o.Headline, Explanation: o.Explanation,
+		Needs: o.Needs, Resolved: o.Resolved}, o.Machine); !ok {
+		t.Errorf("not plain: %s", why)
+	}
+	r.confined = func(context.Context, string, time.Time) (bool, bool, string, error) {
+		return true, true, "confined", nil
+	}
+	if got := rootObservations(context.Background(), r, trusted, rootNow); len(got) != 0 {
+		t.Errorf("said of a free machine: %+v", got)
+	}
+}
+
+// novox/hq ADR 0268: the login shell counts only where its execute is served, and fails closed.
+func TestTheLoginShellCountsOnlyWhereExecuteIsServed(t *testing.T) {
+	val := func(v any) *any { return &v }
+	cases := []struct {
+		name          string
+		claims        bool
+		setting       *any
+		heard, asked  bool
+		served        bool
+		saysInTheWhys string
+	}{
+		{"withheld by the setting and silent on the bus", true, val("withhold"), false, true, false, ""},
+		{"withheld by the setting, the machine not yet pushed", true, val("withhold"), true, true, true, "the bus hears"},
+		{"the setting serves", true, val("serve"), false, true, true, "setting there is serve"},
+		{"a wrong value withholds, as the holder does", true, val("Serve"), false, true, false, ""},
+		{"the setting withholds, the bus could not be asked", true, val("withhold"), false, false, true, "could not be asked"},
+		{"a holder with no such setting that claims execute", true, nil, false, true, true, "claims execute"},
+		{"a holder with no such setting that does not claim it, heard all the same", false, nil, true, true, true, "the bus hears"},
+		{"a holder with no such setting that does not claim it, silent", false, nil, false, true, false, ""},
+	}
+	for _, c := range cases {
+		served, why := loginShellServed("zsh", c.claims, c.setting, c.heard, c.asked)
+		if served != c.served || (c.saysInTheWhys != "" && !strings.Contains(why, c.saysInTheWhys)) {
+			t.Errorf("%s: served %v (%q), want %v saying %q", c.name, served, why, c.served, c.saysInTheWhys)
+		}
+	}
+}
+
+// The root-free verb is the serving controller's alone, answered in its process and never as a command; a
+// controller not serving answers an error, which the router reads as no machine free.
+func TestRootFreeIsAnsweredOnlyByTheServingController(t *testing.T) {
+	was := doctorFrom
+	doctorFrom = nil
+	t.Cleanup(func() { doctorFrom = was })
+	if _, err := rootFreeAnswer(context.Background(), "anchor", rootNow); err == nil {
+		t.Error("a controller not serving judged a machine")
+	}
+	if !inProcess["root-free"] {
+		t.Error("root-free is not answered in the serving process")
+	}
+	if _, err := argvFor("root-free", map[string]any{"machines": "anchor"}); err == nil {
+		t.Error("root-free ran as a command")
+	}
+	// The router names its machines as a list (its contract with this verb); one text separated by commas is
+	// the same; anything else in the list is refused.
+	for _, given := range []any{[]any{"anchor", "relay"}, "anchor, relay"} {
+		a, err := readArguments("root-free", map[string]any{"machines": given})
+		if err != nil || a.given["machines"] != "anchor,relay" && a.given["machines"] != "anchor, relay" {
+			t.Errorf("root-free given %v read %v (%v)", given, a, err)
+		}
+	}
+	if _, err := readArguments("root-free", map[string]any{"machines": []any{"anchor", 7}}); err == nil {
+		t.Error("root-free took a number for a machine")
+	}
+	if _, err := readArguments("status", map[string]any{"machines": []any{"anchor"}}); err == nil {
+		t.Error("a verb that takes no list took one")
+	}
+}
+
+// The confirmation review of 2026-10-09: ADR 0266's quiet window (#175) keeps the self-check from raising
+// agent-can-become-root while the node-engine's first setuid search runs. It must not make root-free answer free:
+// root-free needs a complete, fresh verdict. A verdict still waiting for the search is "not judged" to
+// agentConfined, so the machine is not root-free, whatever the quiet says — and the same statement, complete
+// and healthy, is the control.
+func TestAMachineWaitingForItsFirstSetuidSearchIsNotRootFree(t *testing.T) {
+	now := rootNow
+	statement := func(state, reason string) inventory.NodeHealth {
+		return inventory.NodeHealth{Node: "anchor", Contract: link.RootContract, SaidAt: now, HeardAt: now,
+			Resources: []inventory.ResourceHealth{{Module: "claude-code", Resource: "agent", Kind: link.KindAccount,
+				Target: "agents", State: state, Reason: reason, Root: link.RootNever}}}
+	}
+	judged := func(h inventory.NodeHealth) rootVerdict {
+		confined, why := judgedConfined("agents", h, true, now)
+		return judgeRoot(rootFacts{Machine: "anchor", AgentNamed: true, Confined: confined, ConfinedWhy: why}, now)
+	}
+	if v := judged(statement(link.StateHealthy, "")); !v.Free {
+		t.Fatalf("the control: a complete healthy verdict, fresh: %+v", v)
+	}
+	pending := statement(link.StateUnknown, link.ReasonRootPending+": the search runs")
+	if rootVerdictKind("agents", pending, true, now) != verdictPending {
+		t.Fatal("the statement is not one the quiet window counts as waiting for the search")
+	}
+	if v := judged(pending); v.Free {
+		t.Errorf("a machine whose first setuid search is pending was judged root-free: %+v", v)
+	}
+}
+
+// The confirmation review of 2026-10-09, on #154 beside ADR 0266: D-root keeps ADR 0266's quiet window — nothing
+// raised while the one thing unjudged is the first setuid search, within its bound — while the root-free verb
+// still answers the machine not free; and D-root's condition has a key of its own, apart from DA's.
+func TestRootNotFreeIsQuietWhileTheFirstSearchRunsAndKeyedApartFromDA(t *testing.T) {
+	entries := []inventory.Entry{{Manifest: catalogue.Manifest{Module: "telegram", RunsAs: "telegram"}, On: []string{"anchor"}}}
+	r := &rootReader{entries: entries, heard: map[string]map[string]map[string]bool{},
+		confined: func(context.Context, string, time.Time) (bool, bool, string, error) {
+			return true, false, "the agent account agents is not judged: the search for setuid programs runs", nil
+		},
+		settings: func(context.Context, string, string) ([]catalogue.Layer, error) { return nil, nil },
+		quiet:    func(context.Context, string, time.Time) bool { return true }}
+	trusted := trustedMachines(entries)
+	if got := rootObservations(context.Background(), r, trusted, rootNow); len(got) != 0 {
+		t.Errorf("raised while the first search runs: %+v", got)
+	}
+	if v := judgeRootFree(context.Background(), r, []string{"anchor"}, rootNow)[0]; v.Free || !v.Quiet {
+		t.Errorf("root-free while the first search runs: %+v", v)
+	}
+	// Quiet hides nothing else: the login shell served as well is said.
+	r.heard = map[string]map[string]map[string]bool{loginShellSeat: {"execute": {"anchor": true}}}
+	if got := rootObservations(context.Background(), r, trusted, rootNow); len(got) != 1 {
+		t.Errorf("a second failure was kept quiet: %+v", got)
+	}
+	// Past its bound, said.
+	r.heard, r.quiet = map[string]map[string]map[string]bool{}, func(context.Context, string, time.Time) bool { return false }
+	got := rootObservations(context.Background(), r, trusted, rootNow)
+	if len(got) != 1 {
+		t.Fatalf("a search past its bound was not said: %+v", got)
+	}
+	// One key per judgement: DA's is machine.<m>.agent-root, this one its own.
+	da := conditions.Observation{Scope: conditions.ScopeMachine, ID: "anchor", Token: "agent-root", Machine: "anchor"}
+	if got[0].Key() == da.Key() {
+		t.Errorf("D-root and DA share the key %s", da.Key())
+	}
+}

cmd/mesh-controller/probes.go

@@ -252,6 +252,10 @@ func askEveryResolver(ctx context.Context, resolvers map[string]string, places [
 				v.wrong[0], andMore(len(v.wrong)-1))
 		} else {
 			// Nothing but silence: held for the next run, which raises it if the resolver is still silent.
+			// Refused on every try too: a few hundred milliseconds of refusals is a resolver restarting as
+			// well as one that stopped, and the two looks a finding needs are this run and the next
+			// (novox/hq issue 348). The machine's own node-engine is the fast detector: its names check
+			// raised the control node's resolver within a minute on 2026-10-09.
 			o.Confirm = true
 			o.Summary = fmt.Sprintf("the mesh's resolver on %s does not answer: %d of the %d question(s) about the "+
 				"machines' names went unanswered, each asked %d times — the first, %s", node, len(v.unanswered), v.asked,
@@ -637,31 +641,8 @@ const (
 // discoverHolders asks the bus's discovery who serves what, and answers seat → machine for every
 // endpoint a seat's verb is served on.
 func discoverHolders(ctx context.Context, conn *nats.Conn) (map[string]map[string]bool, error) {
-	inbox := conn.NewRespInbox()
-	sub, err := conn.SubscribeSync(inbox)
-	if err != nil {
-		return nil, err
-	}
-	defer func() { _ = sub.Unsubscribe() }()
-	if err := conn.PublishRequest("$SRV.INFO", inbox, nil); err != nil {
-		return nil, fmt.Errorf("asking the bus who serves what: %w", err)
-	}
 	out := map[string]map[string]bool{}
-	deadline := time.Now().Add(discoveryPatience)
-	for time.Now().Before(deadline) {
-		wait, cancel := context.WithTimeout(ctx, discoveryQuiet)
-		msg, err := sub.NextMsgWithContext(wait)
-		cancel()
-		if err != nil {
-			if ctx.Err() != nil {
-				return nil, ctx.Err()
-			}
-			break
-		}
-		var info micro.Info
-		if json.Unmarshal(msg.Data, &info) != nil {
-			continue
-		}
+	err := discoverServices(ctx, conn, func(info micro.Info) {
 		for _, e := range info.Endpoints {
 			seat, node := e.Metadata["seat"], e.Metadata["node"]
 			if seat == "" {
@@ -680,8 +661,69 @@ func discoverHolders(ctx context.Context, conn *nats.Conn) (map[string]map[strin
 			out[info.Name] = map[string]bool{}
 		}
 		out[info.Name][info.ID] = true
+	})
+	return out, err
+}
+
+// discoverSeatVerbs asks the bus's discovery the same, one level finer: seat → verb → machine, for every
+// seat verb answered (an endpoint's `tool` is its verb). A seat held where a verb is withheld (novox/hq ADR
+// 0268) shows the seat and not that verb.
+func discoverSeatVerbs(ctx context.Context, conn *nats.Conn) (map[string]map[string]map[string]bool, error) {
+	out := map[string]map[string]map[string]bool{}
+	err := discoverServices(ctx, conn, func(info micro.Info) {
+		for _, e := range info.Endpoints {
+			seat, verb, node := e.Metadata["seat"], e.Metadata["tool"], e.Metadata["node"]
+			if seat == "" || verb == "" {
+				continue
+			}
+			if node == "" {
+				node = info.ID
+			}
+			if out[seat] == nil {
+				out[seat] = map[string]map[string]bool{}
+			}
+			if out[seat][verb] == nil {
+				out[seat][verb] = map[string]bool{}
+			}
+			out[seat][verb][node] = true
+		}
+	})
+	return out, err
+}
+
+// discoverServices asks the bus's discovery once and hands every service's answer to visit, waiting
+// discoveryQuiet after the last and discoveryPatience at the most.
+func discoverServices(ctx context.Context, conn *nats.Conn, visit func(micro.Info)) error {
+	if conn == nil {
+		return errors.New("the controller holds no connection to the bus")
 	}
-	return out, nil
+	inbox := conn.NewRespInbox()
+	sub, err := conn.SubscribeSync(inbox)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = sub.Unsubscribe() }()
+	if err := conn.PublishRequest("$SRV.INFO", inbox, nil); err != nil {
+		return fmt.Errorf("asking the bus who serves what: %w", err)
+	}
+	deadline := time.Now().Add(discoveryPatience)
+	for time.Now().Before(deadline) {
+		wait, cancel := context.WithTimeout(ctx, discoveryQuiet)
+		msg, err := sub.NextMsgWithContext(wait)
+		cancel()
+		if err != nil {
+			if ctx.Err() != nil {
+				return ctx.Err()
+			}
+			break
+		}
+		var info micro.Info
+		if json.Unmarshal(msg.Data, &info) != nil {
+			continue
+		}
+		visit(info)
+	}
+	return nil
 }
 
 // probeArchives is D4: every archive the mesh keeps is held by its manifest in the artifact store.
@@ -1040,12 +1082,7 @@ func probeCoreBuilds(ctx context.Context, d *doctor) ([]conditions.Observation,
 		return nil, err
 	}
 	hostVersions := deliveredVersions(shelf[hostModule])
-	rolling := map[string]bool{}
-	for _, p := range plans {
-		for m := range p.Modules {
-			rolling[m] = true
-		}
-	}
+	rolling := rollingModules(plans)
 	nodes, err := inv.Nodes(ctx)
 	if err != nil {
 		return nil, err
@@ -1103,6 +1140,26 @@ func probeCoreBuilds(ctx context.Context, d *doctor) ([]conditions.Observation,
 	return out, nil
 }
 
+// rollingModules is every module an open plan is rolling out: those it keeps a record of, and those its
+// tiers name. **A release keeps no record per module** — its walk is per machine, its modules only in its
+// tier — so reading the records alone, D10 said "no plan is rolling them out" about the node-engine while
+// a release walked it, and the gate on that release's first machine waited on what its own send causes
+// (novox/hq issue 348). Pure.
+func rollingModules(plans []inventory.Plan) map[string]bool {
+	rolling := map[string]bool{}
+	for _, p := range plans {
+		for m := range p.Modules {
+			rolling[m] = true
+		}
+		for _, tier := range p.Tiers {
+			for _, m := range tier {
+				rolling[m] = true
+			}
+		}
+	}
+	return rolling
+}
+
 // deliveredVersions are the versions a module's registered build is delivered as: the last element
 // of every resource path under a `versions/` directory, which registration filled from the artifact's
 // digest (catalogue `${version}`). The node-engine names itself by that directory.

cmd/mesh-controller/push.go

@@ -76,6 +76,21 @@ func serve(ctx context.Context) (err error) {
 	}
 	defer open.Close()
 	inv := open.inventory
+	// **What this build reads of the store's schema, on record** (novox/hq issue 352): the highest migration
+	// it carries, by its version, so a gate that would put this build back later knows it reads the store
+	// as it is then. A build that does not know its version records nothing, and is never put back.
+	if build := runningBuild(); build != "" {
+		if reach, err := schemaReach(); err != nil {
+			fmt.Printf("what this build reads of the store's schema is not recorded: %v\n", err)
+		} else if err := inv.RecordSchemaReach(ctx, build, reach); err != nil {
+			fmt.Printf("what this build (%s) reads of the store's schema is not recorded: %v\n", build, err)
+		} else {
+			fmt.Printf("this build (%s) reads the store's schema up to migration %04d; recorded\n", build, reach)
+		}
+	} else {
+		fmt.Printf("this process was not told which build it is (%s), so what it reads of the store's schema is not "+
+			"recorded, and a gate will never put it back\n", RunningBuildVar)
+	}
 
 	ident, err := openIdentity(ctx)
 	if err != nil {
@@ -1250,11 +1265,14 @@ func issueMemberships(ctx context.Context, open *stores, server *link.Server, se
 	if err != nil {
 		return err
 	}
-	where := broker.PlacementsOf(records, records.Interchangeable)
 	bus, ok := server.Bus().(link.OverNATS)
 	if !ok {
 		return nil
 	}
+	// Which machines are root-free now (novox/hq ADR 0259 §8): a channel's verified sender is composed for the
+	// router only from one, beside a router on one. Judged once per push, by the root-free verb's judgement.
+	records.RootFree = rootFreeNow(ctx, newRootReader(ctx, open.inventory, bus.Conn), records.Nodes, time.Now())
+	where := broker.PlacementsOf(records, records.Interchangeable)
 	// **Every declared state's bucket, before the memberships that name it** (novox/hq ADR 0201). The
 	// raise at start asserts them too, but a module registered and assigned since would otherwise have
 	// its bucket only after the control plane next restarts — found the first time a module declared
@@ -1595,3 +1613,18 @@ func reportUnheldPushed(w io.Writer, named bool, asked []string, unheld map[stri
 		fmt.Fprintf(w, "%s: %d unmet seat dependenc(ies) — see `status`\n", node, len(lines))
 	}
 }
+
+// schemaReach is the highest migration this build carries for the inventory's store (novox/hq issue 352).
+func schemaReach() (int, error) {
+	migrations, err := inventory.Migrations()
+	if err != nil {
+		return 0, err
+	}
+	reach := 0
+	for _, m := range migrations {
+		if m.Number > reach {
+			reach = m.Number
+		}
+	}
+	return reach, nil
+}

cmd/mesh-controller/rehearse.go

@@ -0,0 +1,114 @@
+package main
+
+// The rehearsal of the operator's answers — not a drill, which in the glossary is something broken on purpose (novox/hq ADR 0259, the live acceptance after rollout): an ask the
+// operator starts at the controller's terminal, answered on the phone, whose approval changes nothing and is
+// recorded as a person's decision like any other.
+//
+//	mesh-controller rehearse [--for 15m]
+//
+// It asks with two answers, Approve and Decline, each bound to the rehearsal's own act and **both at the level
+// approve** (the review of 2026-10-09, M1: an acknowledgement never shares an ask with an approval), so only a
+// channel that proves who answered carries either — the rehearsal is of exactly that. The serving controller acts on the warrant
+// as on any other: it claims the ask once, checks the act is the one bound, performs nothing, and records the
+// hand-act `warrant` with who answered, through which channel, and the proofs. `hand-acts` then shows it.
+//
+// **The terminal's alone** (startedAtTheTerminal): a command a verb runs, an ordinary mesh-cli line and anything the
+// serving controller started are refused, so no agent starts a rehearsal — a
+// rehearsal is a question the operator expects, and one an agent could start would teach them to approve what they
+// did not ask for.
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"time"
+
+	"github.com/nats-io/nats.go"
+
+	"git.novox.be/novox/mesh-sdk/go/asks"
+
+	"github.com/novox/mesh-controller/internal/conditions"
+)
+
+// rehearsalVerb is the act a rehearsal's answers bind: nothing is called.
+const rehearsalVerb = "rehearsal"
+
+// rehearsalActions are the rehearsal's two answers.
+func rehearsalActions() []conditions.Action {
+	return []conditions.Action{
+		{Label: "Approve", Verb: rehearsalVerb, Level: conditions.LevelApprove, Arguments: map[string]string{"rehearsal": "approve"}},
+		{Label: "Decline", Verb: rehearsalVerb, Level: conditions.LevelApprove, Arguments: map[string]string{"rehearsal": "decline"}},
+	}
+}
+
+// rehearsalAsk is the rehearsal's ask, as the router is sent it.
+func rehearsalAsk(id string, now time.Time, lasts time.Duration) (asks.Ask, map[string]int) {
+	q := asks.Ask{ID: id, Headline: "Rehearsal: approve this test question?", Who: asks.Operator,
+		Explanation: "Needs you: approve or decline. You started this rehearsal at the controller's terminal. Approving " +
+			"changes nothing on the mesh; it is recorded as your decision, so you can check the record.",
+		OnExpiry: "nothing is done", Expires: now.Add(lasts), About: "rehearsal." + id}
+	options := map[string]int{}
+	for i, act := range rehearsalActions() {
+		binds, _ := asks.ActDigest(boundAct(act))
+		oid := optionID(act.Label)
+		options[oid] = i
+		q.Options = append(q.Options, asks.Option{ID: oid, Label: act.Label, Does: doesRehearsal(act), Level: asks.Level(act.Level),
+			Binds: binds})
+	}
+	return q, options
+}
+
+func doesRehearsal(act conditions.Action) string {
+	if act.Arguments["rehearsal"] == "approve" {
+		return "nothing changes; your approval is recorded"
+	}
+	return "nothing changes; your answer is recorded"
+}
+
+func rehearseCommand(ctx context.Context, args []string) error {
+	// The terminal as main judges it (startedAtTheTerminal): not a verb, not the serving controller or anything it
+	// started, and a mesh-cli line only when it is the control-node's operator's (novox/hq ADR 0272 §4).
+	if !startedAtTheTerminal() {
+		return errors.New("rehearse is the controller's terminal's alone: a verb, a mesh-cli line from anybody but " +
+			"the control-node's operator, or a process the serving controller started may not start one, so no agent " +
+			"asks the operator a question they did not start (novox/hq ADR 0259)")
+	}
+	set := flag.NewFlagSet("rehearse", flag.ContinueOnError)
+	lasts := set.Duration("for", 15*time.Minute, "how long the question waits for an answer")
+	if err := set.Parse(args); err != nil {
+		return err
+	}
+	if *lasts < time.Minute || *lasts > askApproveFor {
+		return fmt.Errorf("a rehearsal waits between a minute and %s", askApproveFor)
+	}
+	js, err := aBus()
+	if err != nil {
+		return err
+	}
+	defer js.Close()
+	now := time.Now()
+	id := newAskID()
+	q, options := rehearsalAsk(id, now, *lasts)
+	if err := q.Check(now); err != nil {
+		return err
+	}
+	store := busAsked{conn: js.Conn()}
+	// Kept before it is published, as the asker keeps every ask, so a warrant always finds it.
+	if err := store.Create(ctx, asked{ID: id, Condition: q.About, Ask: q, Actions: rehearsalActions(), Options: options,
+		State: askOpen, Opened: now, Rehearsal: true}); err != nil {
+		return fmt.Errorf("the rehearsal could not be kept in the controller's asks: %w", err)
+	}
+	body, err := json.Marshal(q)
+	if err != nil {
+		return err
+	}
+	if _, err := js.Context().Publish(asks.AskSubject(askerName), body, nats.MsgId("ask."+id), nats.Context(ctx)); err != nil {
+		return fmt.Errorf("the rehearsal could not be asked: %w", err)
+	}
+	fmt.Printf("rehearsal %s asked: answer it on your phone before %s. Then `mesh-controller hand-acts` shows the "+
+		"answer as a warrant, with who answered, through which channel and the proofs; nothing else changes.\n",
+		id, q.Expires.Local().Format("15:04"))
+	return nil
+}

cmd/mesh-controller/rehearse_test.go

@@ -0,0 +1,76 @@
+package main
+
+import (
+	"context"
+	"github.com/novox/mesh-controller/internal/link"
+	"strings"
+	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/asks"
+)
+
+// A rehearsal (the live acceptance of novox/hq ADR 0259): its approval is a warrant like any other — claimed once,
+// its act checked against what the option bound, recorded as the operator's decision with who, how and the
+// proofs — and it performs nothing. The reconciling of conditions leaves it open.
+func TestARehearsalsApprovalIsRecordedAndPerformsNothing(t *testing.T) {
+	r := newAskerRig(t)
+	q, options := rehearsalAsk("crehearsal", r.now, askerRehearsalFor)
+	if err := q.Check(r.now); err != nil {
+		t.Fatalf("the rehearsal's ask is refused: %v", err)
+	}
+	r.store["crehearsal"] = asked{ID: "crehearsal", Condition: q.About, Ask: q, Actions: rehearsalActions(), Options: options,
+		State: askOpen, Opened: r.now, Rehearsal: true}
+	if err := r.a.reconcile(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	if got := r.store["crehearsal"]; got.State != askOpen {
+		t.Fatalf("the reconciling of conditions ended the rehearsal: %+v", got)
+	}
+	approve, _ := q.Option("approve")
+	w := asks.Warrant{Ask: "crehearsal", Asker: "mesh-controller", Outcome: asks.OutcomeChosen, Option: approve.ID,
+		Label: approve.Label, Level: approve.Level, Channel: "telegram", Proofs: []string{"P1"}, At: r.now,
+		AskDigest: q.Digest(), By: &asks.Person{Who: asks.Operator, Kind: "telegram", Identity: "42", Verified: "user id verified"}}
+	answerWith(t, r, w)
+	answerWith(t, r, w) // heard again
+	if len(r.called)+len(r.silenced) != 0 {
+		t.Errorf("a rehearsal performed something: %v %v", r.called, r.silenced)
+	}
+	if len(r.acts) != 1 {
+		t.Fatalf("hand-acts %+v", r.acts)
+	}
+	act := r.acts[0]
+	if act.Verb != handActWarrant || act.By != "the operator, as telegram identity 42" || act.Ask != "crehearsal" ||
+		strings.Join(act.Args, " ") != "rehearsal rehearsal=approve" || act.Outcome != "done" || strings.Join(act.Proofs, ",") != "P1" {
+		t.Errorf("the rehearsal's record: %+v", act)
+	}
+	if !personsDecision(act) {
+		t.Error("a rehearsal's answer counts as a repair")
+	}
+}
+
+// Only the terminal starts a rehearsal: a verb's process is refused before anything is asked.
+func TestARehearsalIsTheTerminalsAlone(t *testing.T) {
+	t.Setenv(verbVar, "mesh-controller.command")
+	if err := rehearseCommand(context.Background(), nil); err == nil || !strings.Contains(err.Error(), "terminal") {
+		t.Fatalf("a verb started a rehearsal: %v", err)
+	}
+	// Nor a mesh-cli line from anybody but the control-node's operator (hq ADR 0272 §4): run without a verb,
+	// naming its caller, and without the terminal's mark — and nor anything the serving controller started.
+	for name, env := range map[string]map[string]string{
+		"an ordinary mesh-cli line":            {verbVar: "", link.CallerVar: "laptop/agent"},
+		"a process the serving controller ran": {verbVar: "", servedVar: "1"},
+	} {
+		t.Run(name, func(t *testing.T) {
+			for k, v := range env {
+				t.Setenv(k, v)
+			}
+			if err := rehearseCommand(context.Background(), nil); err == nil || !strings.Contains(err.Error(), "terminal") {
+				t.Fatalf("%s started a rehearsal: %v", name, err)
+			}
+		})
+	}
+}
+
+// askerRehearsalFor is how long the test's rehearsal waits.
+const askerRehearsalFor = 15 * time.Minute

cmd/mesh-controller/release.go

@@ -180,12 +180,35 @@ func (f moveFacts) moves(node string, modules []string, sent map[string]string,
 	return out
 }
 
-// walkedBy is the open plan that has started walking a module's build — sent it to a first machine,
-// not yet passed — other than to this machine; empty when none does.
-func (f moveFacts) walkedBy(module, node string) string {
+// walkedBy is the open plan that has started walking a module's build — sent it to a first machine, not
+// yet passed — and whose walk this move would cross; empty when none does. A move of the same build to a
+// machine that plan already sent it is not a crossing: the build is there. A move of **another** build of
+// the module to that machine is (novox/hq issue 352): on 2026-10-09 a merge's plan sent the control node a
+// newer controller while a release's gate was judging the controller there, the release's gate read the
+// machine's report against the newer send, failed three builds and put them back under the new plan's
+// feet. A release keeps no module records: its open gate's carried moves are its walk.
+func (f moveFacts) walkedBy(module, node, to string) string {
 	for _, p := range f.plans {
+		if !p.Open() {
+			continue
+		}
+		if p.Release != nil {
+			g := p.Release.Gate
+			if g == nil || g.Verdict != "" {
+				continue
+			}
+			for _, c := range g.Carried {
+				if c.Module == module && !(slices.Contains(g.Machines, node) && sameCommit(c.To, to)) {
+					return p.ID
+				}
+			}
+			continue
+		}
 		s, holds := p.Modules[module]
-		if !p.Open() || !holds || s == nil || s.FirstAt == nil || s.SentAt != nil || slices.Contains(s.First, node) {
+		if !holds || s == nil || s.FirstAt == nil || s.SentAt != nil {
+			continue
+		}
+		if slices.Contains(s.First, node) && sameCommit(s.Commit, to) {
 			continue
 		}
 		if s.Gate != nil && s.Gate.Verdict == inventory.GatePassed {
@@ -277,11 +300,19 @@ func gatedSend(ctx context.Context, open *stores, node string, owns []inventory.
 		if own(mv.Module) {
 			continue
 		}
-		if id := f.walkedBy(mv.Module, node); id != "" {
+		if id := f.walkedBy(mv.Module, node, mv.To); id != "" {
 			return nil, nil, fmt.Errorf("%w: %s's build %s waits on %s, which %s is walking", errWalkedElsewhere,
 				mv.Module, short(mv.To), node, id)
 		}
 	}
+	// **And the plan's own modules wait too** (novox/hq issue 352): a walk of the same module by another
+	// plan, or a release, on this machine is not crossed with a newer build; this send waits for its gate.
+	for _, o := range owns {
+		if id := f.walkedBy(o.Module, node, o.To); id != "" {
+			return nil, nil, fmt.Errorf("%w: %s's build %s waits on %s, which %s is walking", errWalkedElsewhere,
+				o.Module, short(o.To), node, id)
+		}
+	}
 	for _, o := range owns {
 		i := slices.IndexFunc(moves, func(mv inventory.CarriedMove) bool { return mv.Module == o.Module })
 		switch {
@@ -526,7 +557,7 @@ func waitingMoves(ctx context.Context, open *stores, all bool) (map[string][]inv
 			return nil, err
 		}
 		for _, mv := range moves {
-			if f.walkedBy(mv.Module, n.Name) == "" {
+			if f.walkedBy(mv.Module, n.Name, mv.To) == "" {
 				out[n.Name] = append(out[n.Name], mv)
 			}
 		}
@@ -658,7 +689,7 @@ func advanceRelease(ctx context.Context, open *stores, p *inventory.Plan) (bool,
 				r.Next++
 				continue
 			}
-			r.Gate = &inventory.PlanGate{Machines: sent, Since: &now, Carried: moves}
+			r.Gate = &inventory.PlanGate{Machines: sent, Since: &now, Carried: moves, Sent: sentNow(ctx, open.inventory, sent)}
 			p.Note = fmt.Sprintf("sent %s %d build(s) that waited for a gate; judging them there", node, len(moves))
 			if said := recreationsSaid(moves); said != "" {
 				p.Note += "; " + said
@@ -693,6 +724,15 @@ func advanceRelease(ctx context.Context, open *stores, p *inventory.Plan) (bool,
 		r.Next++
 		r.Gate = nil
 		return true, nil
+	case inventory.GateSuperseded:
+		// Another send moved a judged module on the judged machine (novox/hq issue 352): no verdict on what
+		// was carried, nothing put back, and this release ends; the builds still waiting are released again
+		// by the next pass, judged afresh.
+		p.State = inventory.PlanSuperseded
+		p.Note = fmt.Sprintf("superseded on %s: %s — nothing judged, nothing put back; what still waits is released again",
+			strings.Join(g.Machines, ", "), g.Why)
+		fmt.Printf("%s: %s\n", p.ID, p.Note)
+		return true, nil
 	}
 	p.Note = ""
 	batched, back := batchingRollbacks(ctx)

cmd/mesh-controller/release_plan.go

@@ -188,11 +188,13 @@ func planOfMerge(m link.SourceMoved, moved []string, edges []inventory.Edge) inv
 	for _, name := range set {
 		modules[name] = &inventory.PlanModule{}
 	}
+	merged, _ := time.Parse(time.RFC3339Nano, m.MergedAt)
 	return inventory.Plan{
 		ID:         fmt.Sprintf("plan-%d", time.Now().UnixNano()),
 		Repository: m.Owner + "/" + m.Repo,
 		Branch:     m.Base,
 		Commit:     m.Commit,
+		Merged:     merged.UTC(),
 		Created:    time.Now().UTC(),
 		State:      inventory.PlanBuilding,
 		Tiers:      tiers,
@@ -220,12 +222,20 @@ func planOfMerge(m link.SourceMoved, moved []string, edges []inventory.Edge) inv
 //
 // A plan with no branch recorded is from before branches were kept, and is superseded by the next
 // plan of its repository: what it had not built is folded in, so nothing is lost by it.
+//
+// **Newer is the branch's order, not the plans'** (novox/hq issue 349). A merge the bus did not hand
+// over is acted on late, by the catch-up, so its plan is made after the plan of a merge that came after
+// it — and that later-made plan of the earlier commit superseded the later merge's, and built what it
+// folded in from the commit before the later merge: twice on 2026-10-09, once a security fix. So where
+// both plans know when their merge was made, that decides; only where one does not do the plans' own
+// times. A merge older than the newest planned merge of its branch never reaches here at its own commit:
+// it is planned at that merge's commit, which contains it (laterOnTheBranch).
 func supersededBy(newer inventory.Plan, open []inventory.Plan, rollsOut func(string) bool) ([]string, []inventory.Plan) {
 	folded := map[string]bool{}
 	var closed []inventory.Plan
 	for _, old := range open {
 		if old.ID == newer.ID || !old.Open() || !strings.EqualFold(old.Repository, newer.Repository) ||
-			(old.Branch != "" && old.Branch != newer.Branch) || !old.Created.Before(newer.Created) {
+			(old.Branch != "" && old.Branch != newer.Branch) || !earlierOnTheBranch(old, newer) {
 			continue
 		}
 		var took []string
@@ -254,6 +264,30 @@ func supersededBy(newer inventory.Plan, open []inventory.Plan, rollsOut func(str
 	return out, closed
 }
 
+// earlierOnTheBranch says plan a answers a merge made before b's: by when the forge made each merge where
+// both are known, else by when each plan was made. A merge's own plan made again at the same commit
+// (the same merge time) is ordered by when it was made. Pure.
+func earlierOnTheBranch(a, b inventory.Plan) bool {
+	if !a.Merged.IsZero() && !b.Merged.IsZero() && !a.Merged.Equal(b.Merged) {
+		return a.Merged.Before(b.Merged)
+	}
+	return a.Created.Before(b.Created)
+}
+
+// laterOnTheBranch says the plan newest answers a merge into m's branch made after m: then newest's commit
+// contains m's change, and m is planned there, so the newest commit of the branch is what is built (novox/hq
+// issue 349). newest is the newest merge's plan of the branch in any state: a later plan already done
+// built what it moved at its commit, and m planned at its own would build m's dependents back at the older
+// one. Pure.
+func laterOnTheBranch(m link.SourceMoved, newest inventory.Plan) bool {
+	merged, err := time.Parse(time.RFC3339Nano, m.MergedAt)
+	if err != nil || newest.Release != nil || newest.Commit == m.Commit {
+		return false
+	}
+	return strings.EqualFold(newest.Repository, m.Owner+"/"+m.Repo) && newest.Branch == m.Base &&
+		newest.Merged.After(merged)
+}
+
 // gates is what the next tier needs running from this one: a module of the tier that a later
 // tier is built by — the runtime dependency — and whose policy rolls it out, must be applied by
 // the machines running it before the next tier is asked. A base an image stands on need only be
@@ -759,6 +793,15 @@ func advanceOnce(ctx context.Context, open *stores, p *inventory.Plan,
 			case inventory.GateFailed:
 				failFirstSend(ctx, open, p, m, state, state.Gate.Machines, state.Gate.Why, step.rest)
 				return true, nil
+			case inventory.GateSuperseded:
+				// Another send moved this module on its first machine (novox/hq issue 352): the build is not
+				// judged, not marked, not put back; the plan ends here, said, and a newer plan carries on.
+				state.Why = "superseded: " + state.Gate.Why
+				p.State = inventory.PlanSuperseded
+				p.Note = fmt.Sprintf("%s's judging on %s was superseded: %s", m, strings.Join(state.Gate.Machines, ", "),
+					state.Gate.Why)
+				fmt.Printf("%s: %s\n", p.ID, p.Note)
+				return true, nil
 			case inventory.GatePassed:
 				if !state.Gate.Kept {
 					gatePassed(ctx, open, p, m, state)
@@ -930,6 +973,9 @@ func firstSend(ctx context.Context, open *stores, p *inventory.Plan, node string
 	}
 	now := time.Now().UTC()
 	lead := modules[0]
+	// What each machine was just sent, kept on the gate (novox/hq issue 352): its report is held against
+	// this send, whatever it is sent after.
+	sentWhat := sentNow(ctx, inv, sent)
 	for _, m := range modules {
 		s := p.Modules[m]
 		// What the first machine ran before: what a failed gate puts back (ADR 0236).
@@ -938,7 +984,7 @@ func firstSend(ctx context.Context, open *stores, p *inventory.Plan, node string
 		}
 		s.First, s.FirstAt = sent, &now
 		s.Gate = &inventory.PlanGate{Component: coreComponent(m), Machines: firstRunning(sent, runningOf[m]),
-			From: s.Previous, To: s.Commit, Since: &now}
+			From: s.Previous, To: s.Commit, Since: &now, Sent: sentWhat}
 		s.GatedBy = ""
 		if m == lead {
 			s.Gate.Carried = carried
@@ -1097,8 +1143,15 @@ func nextRollout(s inventory.PlanModule, running []string, together bool, report
 	var waiting, failed []string
 	for _, n := range s.First {
 		r, said := byNode[n]
-		// Only a report about what it was last sent says anything about this build.
-		if !said || r.At == nil || !r.Current {
+		// Only a report about what this plan sent it — or what it was sent after that — says anything about
+		// this build (novox/hq issue 352); a plan from before sends were kept on the gate reads the report
+		// against the send made last, as before.
+		reported := r.Current
+		if s.Gate != nil && s.Gate.Sent != nil {
+			sent, kept := s.Gate.Sent[n]
+			reported = kept && sent.ReportsOn(r)
+		}
+		if !said || r.At == nil || !reported {
 			waiting = append(waiting, n)
 			continue
 		}

cmd/mesh-controller/sayable_test.go

@@ -28,6 +28,11 @@ import (
 func TestMain(m *testing.M) {
 	// The process a mesh-cli test runs as a command line: it says the verb and the caller it was given, and
 	// ends (meshcli_test.go).
+	// The process a mesh-cli test runs as `secret accept`: it reads its value exactly as `secret accept` does
+	// (valueFor) and says whether it is the one the test gave, never the value (meshcli_stdin_test.go).
+	if want := os.Getenv(secretAcceptWants); want != "" {
+		os.Exit(readAsSecretAccept(want, os.Args[1:]))
+	}
 	if os.Getenv(echoEnvironment) != "" {
 		fmt.Printf("verb=%q caller=%q terminal=%v\n", os.Getenv("MESH_VERB"), os.Getenv("MESH_CALLER"), startedAtTheTerminal())
 		os.Exit(0)

cmd/mesh-controller/seats.go

@@ -135,6 +135,12 @@ func handOver(ctx context.Context, seatName, to string, adding bool) error {
 	if !ok || nodeName == "" || module == "" {
 		return fmt.Errorf("the new holder is named <node>/<module>, not %q", to)
 	}
+	// A kinded bench is held once per kind, by the claims themselves (novox/hq ADR 0234 §2, ADR 0259): the
+	// record of who holds a seat has no kind, so a handover would name one holder for every kind.
+	if catalogue.KindedBenches[seatName] {
+		return fmt.Errorf("%s is a kinded bench: each kind is held by the module claiming it, and is not handed "+
+			"over by `seat` — assign the module that claims the kind, or unassign the one that does", seatName)
+	}
 	open, err := openStores(ctx)
 	if err != nil {
 		return err

cmd/mesh-controller/seats_test.go

@@ -1,6 +1,8 @@
 package main
 
 import (
+	"context"
+	"strings"
 	"testing"
 
 	"github.com/novox/mesh-controller/internal/catalogue"
@@ -62,3 +64,13 @@ func TestAClaimOutsideTheSetIsShownNotHidden(t *testing.T) {
 		t.Fatalf("a claim outside the set was not shown: %+v", outside)
 	}
 }
+
+// A kinded bench is not handed over by `seat`: each kind is held by its claim (novox/hq ADR 0259).
+func TestAKindedBenchIsNotHandedOver(t *testing.T) {
+	for _, bench := range []string{"channel", "intake"} {
+		err := handOver(context.Background(), bench, "anchor/telegram", false)
+		if err == nil || !strings.Contains(err.Error(), "is a kinded bench") {
+			t.Errorf("%s: %v", bench, err)
+		}
+	}
+}

cmd/mesh-controller/seatverbs.go

@@ -114,6 +114,14 @@ func declaredArguments(v catalogue.Verb) (names []string, switches map[string]bo
 	return names, switches
 }
 
+// isList says a verb's argument is declared a list of text (catalogue's listed): given as a JSON array, it is
+// read as its items joined by commas, as the same argument given as one text would be.
+func isList(v catalogue.Verb, name string) bool {
+	props, _ := v.Input["properties"].(map[string]any)
+	p, _ := props[name].(map[string]any)
+	return p != nil && p["type"] == "array"
+}
+
 // readArguments refuses what the verb does not take, before anything is composed.
 func readArguments(verb string, args map[string]any) (*verbArguments, error) {
 	v, known := controllerVerb(verb)
@@ -150,6 +158,19 @@ func readArguments(verb string, args map[string]any) (*verbArguments, error) {
 				return nil, fmt.Errorf("%s: %q is text, not true or false", verb, k)
 			}
 			value = fmt.Sprint(x)
+		case []any:
+			if !isList(v, k) {
+				return nil, fmt.Errorf("%s: %q is text, and was given a list", verb, k)
+			}
+			items := make([]string, 0, len(x))
+			for _, item := range x {
+				text, ok := item.(string)
+				if !ok || strings.TrimSpace(text) == "" || strings.Contains(text, ",") {
+					return nil, fmt.Errorf("%s: %q is a list of names, and holds %v", verb, k, item)
+				}
+				items = append(items, strings.TrimSpace(text))
+			}
+			value = strings.Join(items, ",")
 		default:
 			return nil, fmt.Errorf("%s: %q is text, and was given %T", verb, k, x)
 		}
@@ -282,6 +303,8 @@ func (a *verbArguments) commandLine() ([]string, error) {
 		return nil, errors.New("tools is answered from the records, not by a command")
 	case "dead-letters":
 		return nil, errors.New("dead-letters is answered by the serving controller, on its own connection, not by a command")
+	case "root-free":
+		return nil, errors.New("root-free is judged by the serving controller, on its own connection, not by a command")
 	case "status":
 		return []string{"status", "--json"}, nil
 	case "nodes":
@@ -739,6 +762,11 @@ func (a *verbArguments) commandLine() ([]string, error) {
 			argv = append(argv, "--probe", p)
 		}
 		return append(argv, "--json"), nil
+	case "give":
+		if err := need("node", "module", "secret", "at"); err != nil {
+			return nil, err
+		}
+		return []string{"secret", "accept", str("node"), str("module"), str("secret"), "--at-desk", str("at")}, nil
 	case "rotate":
 		if p := str("provision"); p != "" {
 			argv := []string{"rotate", p}
@@ -1092,6 +1120,9 @@ func seatToolHandlers() (map[string]link.ToolHandler, []string, error) {
 				if verb == "dead-letters" {
 					return deadLettersAnswer(ctx, a)
 				}
+				if verb == "root-free" {
+					return rootFreeAnswer(ctx, a.given["machines"], rootClock())
+				}
 				if verb == "doctor" {
 					// From the serving controller, which runs the self-check and hears the signals
 					// (novox/hq to-be 45 §4): the last verdict at once, or a run now.
@@ -1182,7 +1213,10 @@ func actsOnAPlan(args map[string]any) bool {
 var inProcess = map[string]bool{"tools": true, "calls": true, "doctor": true,
 	// What a consumer gave up on, read and changed on the serving controller's own connection (novox/hq
 	// issue 330).
-	"dead-letters": true}
+	"dead-letters": true,
+	// Whether a machine is root-free, judged live on the serving controller's store and connection (novox/hq ADR
+	// 0259 §8): the router asks it before an approval.
+	"root-free": true}
 
 // answersFirst is a command line whose caller is answered before it runs: a push, by its verb or
 // through `command`. A push sends the machine holding the bus first when its user list changed, the
@@ -1466,6 +1500,20 @@ var terminalOnlyCommands = map[string]string{
 	"licence":  "the licences' secrets",
 }
 
+// givenAtTheDesk is exactly the line the `give` verb composes, and nothing beside it: `secret accept <node>
+// <module> <secret> --at-desk <machine>`, with no other word — no value, no file, no provider.
+func givenAtTheDesk(argv []string) bool {
+	if len(argv) != 7 || argv[0] != "secret" || argv[1] != "accept" || argv[5] != "--at-desk" {
+		return false
+	}
+	for _, w := range argv[2:5] {
+		if w == "" || strings.HasPrefix(w, "-") {
+			return false
+		}
+	}
+	return argv[6] != "" && !strings.HasPrefix(argv[6], "-")
+}
+
 // terminalOnly refuses, through any verb, a command that is the operator's at the controller's terminal
 // alone (novox/hq ADR 0266). **Every `node` subcommand that is not a read**: `node account` and
 // `node agent-account` above all. Whoever may call a verb includes agents, and an agent that named itself
@@ -1479,8 +1527,10 @@ func terminalOnly(argv []string) error {
 		return terminalRefusal("%s is run at the controller's terminal only, never through a verb: it holds %s, and "+
 			"whoever may call a verb includes agents (novox/hq ADR 0266). Nothing was done", argv[0], what)
 	}
-	// Of a secret's commands only rotation, which seals the new value to the machine that uses it.
-	if argv[0] == "secret" && (len(argv) < 2 || argv[1] != "rotate") {
+	// Of a secret's commands only rotation, which seals the new value to the machine that uses it, and the
+	// `give` verb's own line: an own secret typed by the operator into the desk's hidden prompt, sealed to this
+	// call and then to the module's machine, so no value travels in the verb or its answer (hq ADR 0259 §10).
+	if argv[0] == "secret" && (len(argv) < 2 || argv[1] != "rotate") && !givenAtTheDesk(argv) {
 		return terminalRefusal("secret %s is run at the controller's terminal only, never through a verb: accepting, "+
 			"recovering or exporting a secret hands it to whoever asks, and that includes agents (novox/hq ADR "+
 			"0266). Nothing was done", strings.Join(argv[1:], " "))

cmd/mesh-controller/seatverbs_schema_test.go

@@ -275,6 +275,13 @@ var accountedFlags = map[string]map[string]string{
 		"json": "set by the verb: the answer is data",
 		"all":  "withheld: every measurement of a fortnight is more than a call should carry; `command` reaches it",
 	},
+	// The desk path of `secret accept` (novox/hq ADR 0259 §10): a value is never an argument of a call.
+	"secret accept": {
+		"at-desk":  "=at",
+		"from":     "withheld: a file of the control node's is read at a shell, never named by a call",
+		"provider": "withheld: a pair credential's value is given at a shell; give takes a module's own secret",
+		"local":    "withheld: it goes with --provider",
+	},
 	"hand-acts":          {"json": "set by the verb: the answer is data"},
 	"conditions":         {"json": "set by the verb: the answer is data"},
 	"retire":             {"json": "set by the verb: the answer is data"},

cmd/mesh-controller/secret.go

@@ -55,6 +55,9 @@ func secretCommand(ctx context.Context, args []string) error {
 	provider := set.String("provider", "",
 		"the node providing <name>: the value becomes the PAIR credential between <module> on <node> "+
 			"and that provider, sealed to both — the vault's operator-delivered secret (ADR 0092)")
+	desk := set.String("at-desk", "",
+		"ask the operator for the value in a prompt that does not show it, on this machine's desk; the "+
+			"answer comes back sealed to this call alone (novox/hq ADR 0259 §10)")
 	local := set.String("local", "",
 		"with --provider: the name the credential goes by inside <module>, where its manifest keeps "+
 			"several for <name> (ADR 0094)")
@@ -65,6 +68,18 @@ func secretCommand(ctx context.Context, args []string) error {
 		return errors.New(secretUsage)
 	}
 	node, module, name := rest[0], rest[1], rest[2]
+	// A value comes from the terminal or the desk, never through a verb (the review of 2026-10-09, M4): a
+	// verb's caller may be an agent, and a value it chose would become what a module acts with.
+	if verb, through := throughAVerb(); through && *desk == "" {
+		return fmt.Errorf("a secret's value is given at the controller's terminal or at the desk (`give`), never "+
+			"through a verb (this line came through %q): nothing was read or sealed", verb)
+	}
+	if *desk != "" {
+		if *from != "" || *provider != "" {
+			return errors.New("--at-desk gives a module's own secret, and takes neither --from nor --provider")
+		}
+		return giveAtDesk(ctx, node, module, name, *desk)
+	}
 
 	value, err := valueFor(node, module, name, *from)
 	if err != nil {
@@ -93,10 +108,26 @@ func secretCommand(ctx context.Context, args []string) error {
 		fmt.Printf("  run `push %s` and `push %s` to send it\n", *provider, node)
 		return nil
 	}
-	untilStart, err := open.inventory.AcceptGivenSecret(ctx, node, module, name, value)
+	// A trusted party's secret is announced before it is kept (the confirmation review of 2026-10-09, N1-give):
+	// on every channel, the one it replaces among them, which still runs on its old value until the next push.
+	// Not announced, it is not kept: a channel whose token changed unheard of answers for somebody else.
+	trusted, err := open.inventory.RunsAsItsOwnAccount(ctx, module)
 	if err != nil {
 		return err
 	}
+	untilStart, unannounced, err := keepGiven(trusted,
+		func() error { return announceSecretGiven(ctx, node, module, name, "at the controller's terminal") },
+		func() (bool, error) { return open.inventory.AcceptGivenSecret(ctx, node, module, name, value) })
+	if err != nil {
+		if trusted && unannounced != nil {
+			return fmt.Errorf("%s runs as an account of its own, and the change of its %s could not be announced on "+
+				"your channels first, so nothing was kept: %w", module, name, err)
+		}
+		return err
+	}
+	if unannounced != nil {
+		fmt.Printf("  this change could NOT be announced on the operator's channels: %v\n", unannounced)
+	}
 	// Not printed back, and there is nowhere it could be printed from: it is sealed to that
 	// machine and the mesh cannot read it again.
 	fmt.Printf("%s on %s now holds %q, sealed to that machine.\n", module, node, name)
@@ -118,7 +149,7 @@ func secretCommand(ctx context.Context, args []string) error {
 }
 
 const secretUsage = "secret rotate <node> <module> <name> [--why <text> [--cause <word>]]\n" +
-	"secret accept <node> <module> <name> [--from <file>] [--provider <node> [--local <name>]]\n" +
+	"secret accept <node> <module> <name> [--from <file> | --at-desk <machine>] [--provider <node> [--local <name>]]\n" +
 	"secret recover <node> <module> <name> --key <operator-key> [--out <file>] [--from-export <file>] [--provider <node>]\n" +
 	"secret export [--out <file>]"
 
@@ -369,6 +400,8 @@ func valueFor(node, module, name, from string) (string, error) {
 		fmt.Fprintf(os.Stderr,
 			"reading %s's %q for %s from standard input; it is not echoed anywhere\n",
 			module, name, node)
+		// At a terminal, what is typed is not shown either: echo off while it is read.
+		defer hideTyping(os.Stdin)()
 		line, err := bufio.NewReader(os.Stdin).ReadString('\n')
 		if err != nil && line == "" {
 			return "", fmt.Errorf("nothing was given on standard input: %w", err)
@@ -452,3 +485,23 @@ func whoAsked() string {
 	}
 	return "the mesh"
 }
+
+// keepGiven keeps a value given at the controller's terminal, and announces it on the operator's channels
+// (the confirmation review of 2026-10-09, N1-give). **A trusted party's — a module running as an account of its
+// own: the router, a verified channel — is announced before it is kept, and not kept when the announcement
+// fails**: a channel whose token changed unheard of answers for somebody else. Any other module's is kept first
+// and announced after, and a failed announcement is said (unannounced) without undoing it.
+func keepGiven(trusted bool, announce func() error, keep func() (bool, error)) (untilStart bool, unannounced, err error) {
+	if trusted {
+		if err := announce(); err != nil {
+			return false, err, err
+		}
+		untilStart, err = keep()
+		return untilStart, nil, err
+	}
+	untilStart, err = keep()
+	if err != nil {
+		return false, nil, err
+	}
+	return untilStart, announce(), nil
+}

cmd/mesh-controller/signals.go

@@ -84,7 +84,7 @@ const (
 
 // callBounds are the verbs that may run longer than callDefault, and how long (S7).
 var callBounds = map[string]time.Duration{
-	"push": 30 * time.Minute, "rotate": 30 * time.Minute, "assign": 15 * time.Minute,
+	"push": 30 * time.Minute, "rotate": 30 * time.Minute, "give": 5 * time.Minute, "assign": 15 * time.Minute,
 	"unassign": 15 * time.Minute, "command": 30 * time.Minute, "doctor": 3 * time.Minute,
 }
 
@@ -378,6 +378,7 @@ func watchWaits(f *signalFacts) []conditions.Observation {
 			Headline:    deliveryName(w.modules, w.repository) + " waiting to start",
 			Explanation: walkWaitingWords(w, in, severity),
 			Needs:       waitingNeeds(severity),
+			Actions:     waitingActions(w.id, severity),
 			Resolved:    deliveryName(w.modules, w.repository) + " no longer waiting"})
 	}
 	return out

cmd/mesh-controller/upgrades.go

@@ -318,6 +318,21 @@ func (f following) SourceMoved(ctx context.Context, m link.SourceMoved) error {
 		return notNow(err)
 	}
 
+	// **A merge older than the newest planned merge of its branch is planned at that merge's commit**
+	// (novox/hq issue 349): the catch-up acts on a merge the bus did not hand over after the merges that
+	// came after it, and planned at its own commit it built what a later merge had fixed — the forge's
+	// security fix, on 2026-10-09 — from the commit before it, dependents and all. The later commit contains
+	// this merge's change. Planned there, with that merge's time, a module the later merge already looked at
+	// reads as history and is not built again; the rest are built from the newest commit.
+	newest, known, err := inv.NewestMergeOf(ctx, m.Owner+"/"+m.Repo, m.Base)
+	if err != nil {
+		return notNow(err)
+	}
+	if known && laterOnTheBranch(m, newest) {
+		fmt.Printf("  %s/%s %.8s was merged before %.8s (%s, %s): what it moved is built from %.8s, which "+
+			"contains it\n", m.Owner, m.Repo, m.Commit, newest.Commit, newest.ID, newest.State, newest.Commit)
+		m.Commit, m.MergedAt = newest.Commit, newest.Merged.Format(time.RFC3339Nano)
+	}
 	from, packaging, already := mergeCandidates(m, entries, read)
 	if len(from) == 0 && len(packaging) == 0 {
 		// "Already built from it" and "nothing reads it" are different facts, and reading the first

cmd/mesh-controller/watchdogs.go

@@ -700,6 +700,9 @@ func watchTheMesh(ctx context.Context, open *stores, server *link.Server, bus li
 	// under the lease and the brake, every act said.
 	healers := newHealing(open, keeper, bus, server.JetStream())
 	go healers.keep(watching)
+	// And the asker (novox/hq ADR 0259): what needs the operator and names its answers is asked of them,
+	// and the answer chosen is performed on its warrant.
+	startAsking(watching, open, server, bus.Conn, keeper)
 	go forgettingOldHeals(watching, open.inventory)
 	fmt.Printf("watching the mesh: %d signal(s) every %s, %d probe(s) every %s; what is wrong is kept in %s "+
 		"and said as %s events\n", len(watchedRows()), watchEvery, len(runnableProbes()), doctorEvery,

go.mod

@@ -3,11 +3,14 @@ module github.com/novox/mesh-controller
 go 1.26.0
 
 require (
+	git.novox.be/novox/mesh-sdk/go v0.1.10-0.20261009115850-16984aafc689
 	github.com/jackc/pgx/v5 v5.10.0
+	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 	github.com/novox/mesh-host v0.0.0
 	golang.org/x/crypto v0.57.0
 	golang.org/x/net v0.58.0
+	golang.org/x/sys v0.48.0
 )
 
 require (
@@ -19,12 +22,9 @@ require (
 	github.com/klauspost/compress v1.20.0 // indirect
 	github.com/minio/highwayhash v1.0.4 // indirect
 	github.com/nats-io/jwt/v2 v2.8.1 // indirect
-	github.com/nats-io/nats-server/v2 v2.11.17 // indirect
 	github.com/nats-io/nkeys v0.4.16 // indirect
 	github.com/nats-io/nuid v1.0.1 // indirect
-	go.uber.org/automaxprocs v1.6.0 // indirect
 	golang.org/x/sync v0.23.0 // indirect
-	golang.org/x/sys v0.48.0 // indirect
 	golang.org/x/text v0.42.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
 )
@@ -35,4 +35,4 @@ require (
 // committed. Every build (the build agent's `go build`, the Dockerfile) compiles from vendor/ and
 // fetches nothing; go refuses to build when vendor/ and this file disagree, so a pin moved without
 // `go mod vendor` fails loudly, at once, everywhere.
-replace github.com/novox/mesh-host => git.novox.be/novox/mesh-host v0.0.0-20261009103656-1c61b72f354d
+replace github.com/novox/mesh-host => git.novox.be/novox/mesh-host v0.0.0-20261009141741-d8ff1540df56

go.sum

@@ -1,15 +1,7 @@
-git.novox.be/novox/mesh-host v0.0.0-20261006095519-3e80b7ae325e h1:g9h4QRaAMg5yaJLwqtb0FoOs23DVGUYpW6qvnQ3oY5A=
-git.novox.be/novox/mesh-host v0.0.0-20261006095519-3e80b7ae325e/go.mod h1:VlilMCRZ5yyNXg7SNigNBLr0Gt32jrGw5KSNq5JAVYs=
-git.novox.be/novox/mesh-host v0.0.0-20261007120832-bdd44154ccac h1:KvnKtJ2rWeIE/t4GweK+JL0OjKSNxsrVP3/nMdpii8o=
-git.novox.be/novox/mesh-host v0.0.0-20261007120832-bdd44154ccac/go.mod h1:VlilMCRZ5yyNXg7SNigNBLr0Gt32jrGw5KSNq5JAVYs=
-git.novox.be/novox/mesh-host v0.0.0-20261007162834-56e2ebec4bac h1:yLtFS0pDCCqIE9Zx8hgXEFG9fUWzf8L9WQoKV+Amk1E=
-git.novox.be/novox/mesh-host v0.0.0-20261007162834-56e2ebec4bac/go.mod h1:VlilMCRZ5yyNXg7SNigNBLr0Gt32jrGw5KSNq5JAVYs=
-git.novox.be/novox/mesh-host v0.0.0-20261009081005-b28d7bbcbff4 h1:f4rBnKSemuN0Z9dTtRJMigIGfEs6ltFPOILJGHGab74=
-git.novox.be/novox/mesh-host v0.0.0-20261009081005-b28d7bbcbff4/go.mod h1:72ZATZjxMLaJfWdvlSDJrygIoBzCmKIjCDMhEXxVzTo=
-git.novox.be/novox/mesh-host v0.0.0-20261009101157-2673e7a2c95e h1:H7eVqDILL6e9cMbWSLHTbCqu9ZxDOmyeQhUmWl9QBV0=
-git.novox.be/novox/mesh-host v0.0.0-20261009101157-2673e7a2c95e/go.mod h1:72ZATZjxMLaJfWdvlSDJrygIoBzCmKIjCDMhEXxVzTo=
-git.novox.be/novox/mesh-host v0.0.0-20261009103656-1c61b72f354d h1:IrmJ+lz21n+eSqKrmXREtR/7raUCBJ+fZvs+BNhuXVI=
-git.novox.be/novox/mesh-host v0.0.0-20261009103656-1c61b72f354d/go.mod h1:72ZATZjxMLaJfWdvlSDJrygIoBzCmKIjCDMhEXxVzTo=
+git.novox.be/novox/mesh-host v0.0.0-20261009141741-d8ff1540df56 h1:Vut7OdwSAL0rFaavaFmv3+FIGS3ISM4jA+xTiS88nvg=
+git.novox.be/novox/mesh-host v0.0.0-20261009141741-d8ff1540df56/go.mod h1:mBxSf6wULwn0bdpHkIHUnhTvNzqnULnjoRN28dUgSBU=
+git.novox.be/novox/mesh-sdk/go v0.1.10-0.20261009115850-16984aafc689 h1:Ti2P9nwders7YQ/hq3X/dPo+CXMj5pdUcfA5P/c12CU=
+git.novox.be/novox/mesh-sdk/go v0.1.10-0.20261009115850-16984aafc689/go.mod h1:GFuZUElBZ9A++mxgIKo97aXXo+kV0uJ/UkbhQPPIbrY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -46,8 +38,6 @@ github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UV
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs=
-go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8=
 golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
 golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
 golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=

internal/broker/controller_asks_test.go

@@ -0,0 +1,53 @@
+package broker
+
+import (
+	"slices"
+	"testing"
+)
+
+// novox/hq ADR 0259 §6: the controller asks the operator through the router's seat as any user of it, under
+// its own name, hears its own warrants, reads its own record, and calls the verbs a warrant chooses.
+func TestTheControllerAsksUnderItsOwnNameAndCallsTheVerbsAWarrantChooses(t *testing.T) {
+	records := Records{Nodes: []string{"anchor"}, Assigned: map[string][]Declared{"anchor": {
+		{Module: "messenger", Holds: []Seat{operatorChannel()}},
+	}}}
+	users, err := Users(records)
+	if err != nil {
+		t.Fatal(err)
+	}
+	got := perms(t, users[0])
+	for _, s := range []string{
+		"mesh.seat.operator-channel.accept.ask.mesh-controller",
+		"mesh.seat.operator-channel.accept.cancel.mesh-controller",
+		"$JS.API.DIRECT.GET.KV_messenger_asks.$KV.messenger_asks.mesh-controller.c1",
+		"mesh.seat.mesh-delivery.tool.release", "mesh.seat.mesh-delivery.tool.stop",
+		"mesh.seat.node-service-manager.tool.restart.g14", "mesh.seat.mesh-controller.tool.plans",
+	} {
+		if !allowed(got.Publish, s) {
+			t.Errorf("the controller may not publish %s", s)
+		}
+	}
+	for _, s := range []string{
+		"mesh.seat.operator-channel.accept.ask.mesh-delivery",
+		"mesh.seat.operator-channel.event.decided.mesh-controller",
+		// (A direct get of another asker's record is not refused here: the controller holds the whole
+		// JetStream API, as the only writer of stream definitions.)
+		"mesh.seat.node-service-manager.tool.stop.g14",
+	} {
+		if allowed(got.Publish, s) {
+			t.Errorf("the controller may publish %s", s)
+		}
+	}
+	if !allowed(got.Subscribe, DecidedSubject) || allowed(got.Subscribe, "mesh.seat.operator-channel.event.decided.mesh-delivery") {
+		t.Error("the controller does not hear exactly its own warrants")
+	}
+	// Its events consumer carries them, so a controller that was away hears what was decided meanwhile.
+	if !slices.Contains(ControllerFollows, DecidedSubject) {
+		t.Error("the controller does not follow its warrants")
+	}
+	// Without a holder of the seat it is granted no ask at all.
+	alone, _ := Users(Records{Nodes: []string{"anchor"}, Assigned: map[string][]Declared{}})
+	if allowed(perms(t, alone[0]).Publish, "mesh.seat.operator-channel.accept.ask.mesh-controller") {
+		t.Error("asked a seat nobody holds")
+	}
+}

internal/broker/controller_buckets.go

@@ -34,8 +34,15 @@ var (
 	// LeaseBucket holds the controller's lease (to-be 45 §6): one key, `holder`, which the instance
 	// allowed to act writes by compare-and-set and renews; its revision when taken is the epoch.
 	LeaseBucket = BucketName(ControllerSeat, "lease")
+	// AskedBucket keeps what the controller asked the operator about its conditions (novox/hq ADR 0259):
+	// each ask by its id, its options and the actions they stand for, how it ended and whether the
+	// controller acted on its warrant — so a restart neither asks twice nor acts twice.
+	AskedBucket = BucketName(ControllerSeat, "asked")
 )
 
+// AskedKeptFor is how long an ask is kept after it was made: a month, as the router keeps its own.
+const AskedKeptFor = 30 * 24 * time.Hour
+
 // LeaseTTL is how long the lease's key lives unrenewed (to-be 45 §6): fifteen seconds, renewed
 // every five. The bucket's age, so the bus forgets a holder that stopped renewing.
 const LeaseTTL = 15 * time.Second
@@ -59,12 +66,12 @@ const (
 // IsControllerBucket says a bucket is the controller's own, not a module's state nothing declares.
 func IsControllerBucket(bucket string) bool {
 	return bucket == CallsBucket || bucket == HandActsBucket || bucket == ConditionsBucket ||
-		bucket == ConditionHistoryBucket || bucket == LeaseBucket
+		bucket == ConditionHistoryBucket || bucket == LeaseBucket || bucket == AskedBucket
 }
 
 // ControllerBuckets are the controller's own buckets, in the order they are asserted.
 func ControllerBuckets() []string {
-	return []string{LeaseBucket, CallsBucket, HandActsBucket, ConditionsBucket, ConditionHistoryBucket}
+	return []string{LeaseBucket, CallsBucket, HandActsBucket, ConditionsBucket, ConditionHistoryBucket, AskedBucket}
 }
 
 // ControllerBucketsAsserter is what raising the controller's buckets needs of a connection.
@@ -149,6 +156,18 @@ func (j *JetStream) EnsureControllerBuckets() error {
 	}); err != nil {
 		return fmt.Errorf("asserting bucket %s: %w", ConditionHistoryBucket, err)
 	}
+	if _, err := js.CreateOrUpdateKeyValue(ctx, jetstream.KeyValueConfig{
+		Bucket: AskedBucket,
+		Description: "what the controller asked the operator about its conditions, and what came of each (novox/hq " +
+			"ADR 0259): written by the controller alone; an ask acted on is acted on once",
+		History:      1,
+		TTL:          AskedKeptFor,
+		MaxValueSize: 32 << 10,
+		MaxBytes:     32 << 20,
+		Storage:      jetstream.FileStorage,
+	}); err != nil {
+		return fmt.Errorf("asserting bucket %s: %w", AskedBucket, err)
+	}
 	return nil
 }
 

internal/broker/controller_buckets_test.go

@@ -1,9 +1,15 @@
 package broker
 
 import (
+	"context"
 	"slices"
 	"strings"
 	"testing"
+	"time"
+
+	"github.com/nats-io/nats.go/jetstream"
+
+	"github.com/novox/mesh-controller/internal/testbus"
 )
 
 // **The controller may write every bucket it writes** (novox/hq to-be 45 §1, issue 269). Writing a
@@ -59,3 +65,34 @@ func TestTheWatchedSignalsMayBeSaidAndHeard(t *testing.T) {
 		t.Error("the controller may not ask who answers, or hears every API call")
 	}
 }
+
+// The controller's record of what it asked the operator is bounded (correctness review of 2026-10-08): one
+// value a key, a month's age, and a size it cannot outgrow.
+func TestWhatTheControllerAskedIsBounded(t *testing.T) {
+	js, err := Dial(testbus.URL(t))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer js.Close()
+	if err := js.EnsureControllerBuckets(); err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	kv, err := jetstream.New(js.Conn())
+	if err != nil {
+		t.Fatal(err)
+	}
+	bucket, err := kv.KeyValue(ctx, AskedBucket)
+	if err != nil {
+		t.Fatal(err)
+	}
+	status, err := bucket.Status(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	info := status.(*jetstream.KeyValueBucketStatus).StreamInfo()
+	if status.History() != 1 || status.TTL() != AskedKeptFor || info.Config.MaxBytes <= 0 || info.Config.MaxBytes > 64<<20 {
+		t.Errorf("history %d, age %s, bytes %d", status.History(), status.TTL(), info.Config.MaxBytes)
+	}
+}

internal/broker/derived.go

@@ -126,7 +126,9 @@ func ConsumerFor(p Principal) (Consumer, bool) {
 	// A module that reacts to anything — a module's events or a role's (novox/hq ADR 0121). Watching
 	// a role was missing here, so the one module that does it got no consumer at all: it started,
 	// connected, and its graph stayed empty with nothing anywhere reporting why.
-	if p.Kind != KindModule || (len(p.Consumes) == 0 && len(p.Watches) == 0) {
+	// And one that hears its own answers on a seat it uses (novox/hq ADR 0259 §3): an asker's warrants.
+	hearsItsOwn := len(SeatTrafficOf(p.Module, nil, p.Uses, nil).Subscribe) > 0
+	if p.Kind != KindModule || (len(p.Consumes) == 0 && len(p.Watches) == 0 && !hearsItsOwn) {
 		return Consumer{}, false
 	}
 	perms, err := PermissionsFor(p)

internal/broker/membership.go

@@ -2,6 +2,7 @@ package broker
 
 import (
 	"encoding/json"
+	"slices"
 	"sort"
 	"strings"
 )
@@ -50,6 +51,12 @@ type Membership struct {
 	// and refuses, with the reason, what is not on it — the bus enforces only the union over every
 	// module on the machine.
 	State []StateIssued `json:"state,omitempty"`
+	// SeatTraffic is what this module's code may submit, say, hear, take, ask, answer and read on seats
+	// that name their caller or their kind (novox/hq ADR 0259 §3). The runtime carrying the module
+	// publishes, takes and answers for it only what is listed here: the bus enforces only the union
+	// over every module on the machine, so one module's code reaching another's name or kind through
+	// the runtime is the runtime's to refuse.
+	SeatTraffic *SeatTraffic `json:"seat-traffic,omitempty"`
 }
 
 // Served is one address a tool is answered on.
@@ -78,6 +85,8 @@ type Placements struct {
 	// Interchangeable is each module whose definition says its instances are the same anywhere,
 	// so the module's plain subject is issued to all of them in one queue.
 	Interchangeable map[string]bool
+	// Kinds is every kind held of a kinded bench, by whom and with what capabilities (ADR 0259 §5).
+	Kinds []KindHeld
 }
 
 // AnswersForTheModule says whether an instance of a module on one machine is issued the module's
@@ -104,11 +113,28 @@ func MembershipFor(node string, d Declared, where Placements) Membership {
 		m.Serves = append(m.Serves, Served{Subject: own + ".tool.{tool}", Queue: "serve." + d.Module})
 	}
 	for _, s := range d.Holds {
+		if servedOnlyByTheController(s) {
+			continue // answered by the serving controller alone, never through a membership
+		}
 		for _, verb := range s.Serves {
 			m.Seats = append(m.Seats, SeatServed{Seat: s.Name, Verb: verb, Subject: seatToolSubject(s, verb, node)})
 		}
 	}
 	m.State = stateIssuedFor(d, node)
+	t := SeatTrafficOf(d.Module, d.Holds, d.Uses, d.Watches)
+	for _, s := range append(append([]Seat{}, d.Uses...), d.Watches...) {
+		if !s.Kinded {
+			continue
+		}
+		for _, k := range where.Kinds {
+			if k.Seat == s.Name && !kindListed(t.Kinds, k) {
+				t.Kinds = append(t.Kinds, k)
+			}
+		}
+	}
+	if len(t.Publish)+len(t.Subscribe)+len(t.Answers)+len(t.Workers)+len(t.Records)+len(t.Kinds) > 0 {
+		m.SeatTraffic = &t
+	}
 	if len(d.Invokes) > 0 {
 		m.Reaches = map[string][]string{}
 		for _, t := range d.Invokes {
@@ -145,5 +171,67 @@ func PlacementsOf(r Records, interchangeable map[string]bool) Placements {
 	for _, nodes := range p.Nodes {
 		sort.Strings(nodes)
 	}
+	// Where the router runs: a verified sender is believed only while its machine is root-free too. A router
+	// placed nowhere, or on more than one machine, frees nothing.
+	var routerNodes []string
+	for node, declared := range r.Assigned {
+		for _, d := range declared {
+			for _, s := range d.Holds {
+				if s.Name == routerSeat && !slices.Contains(routerNodes, node) {
+					routerNodes = append(routerNodes, node)
+				}
+			}
+		}
+	}
+	routerFree := len(routerNodes) == 1 && r.RootFree[routerNodes[0]]
+	for node, declared := range r.Assigned {
+		for _, d := range declared {
+			for _, s := range d.Holds {
+				if s.Kinded && s.Kind != "" {
+					p.Kinds = append(p.Kinds, KindHeld{Seat: s.Name, Kind: s.Kind, Module: d.Module, Node: node,
+						Capabilities: placedCapabilities(s.Capabilities, d.RunsAs, routerFree && r.RootFree[node])})
+				}
+			}
+		}
+	}
+	sort.Slice(p.Kinds, func(i, j int) bool {
+		a, b := p.Kinds[i], p.Kinds[j]
+		if a.Seat != b.Seat {
+			return a.Seat < b.Seat
+		}
+		if a.Kind != b.Kind {
+			return a.Kind < b.Kind
+		}
+		return a.Node < b.Node
+	})
 	return p
 }
+
+// routerSeat is the seat the router of asks holds (novox/hq ADR 0259 §3).
+const routerSeat = "operator-channel"
+
+// placedCapabilities is what a kind's claim promises, as far as its placement lets the router believe it
+// (novox/hq ADR 0259 §8): `verified-sender` only from a holder that runs as an account of its own, on a bus
+// account of its own — never one the machine's runtime carries as the operator's account — and only while
+// its machine and the router's were root-free when composed (rootFree; the review of 2026-10-09, H3). The
+// membership carrying it is composed at a push, so it can outlive a pass that later fails: the router asks
+// the controller's root-free verb again before it honours an approval, and that is the check that holds.
+func placedCapabilities(declared []string, runsAs string, rootFree bool) []string {
+	var out []string
+	for _, c := range declared {
+		if c == "verified-sender" && (runsAs == "" || !rootFree) {
+			continue
+		}
+		out = append(out, c)
+	}
+	return out
+}
+
+func kindListed(list []KindHeld, k KindHeld) bool {
+	for _, x := range list {
+		if x.Seat == k.Seat && x.Kind == k.Kind && x.Module == k.Module && x.Node == k.Node {
+			return true
+		}
+	}
+	return false
+}

internal/broker/nats.go

@@ -63,6 +63,23 @@ type Seat struct {
 	Emits    []string
 	Serves   []string
 	Versions []string // protocol versions served beside the current one; empty for v1 only
+
+	// Kinded says the seat is a kinded bench (novox/hq ADR 0234 §2, ADR 0259 §3): each holder claims one
+	// kind, and its verbs' subjects carry it. Kind is the kind this principal's claim names, for a seat it
+	// holds.
+	Kinded bool
+	Kind   string
+	// ByCaller are the accepts and emits whose last token names the calling module (ADR 0259 §3).
+	ByCaller []string
+	// Proofs are the seat's proof verbs: core request and reply, never on a stream (ADR 0259 §3).
+	Proofs []string
+	// Records are the holder's buckets, by their full name, each user reads under its own name.
+	Records []string
+	// Capabilities are what this principal's claim of a kinded bench promises (ADR 0234 §2).
+	Capabilities []string
+	// DeclaredBy is the module that declares the seat. On a kinded bench it alone submits work to a kind
+	// and answers its proofs (novox/hq ADR 0259 §8): the router, not any user or watcher of the bench.
+	DeclaredBy string
 }
 
 // A Principal is one user of the bus. Its permissions are derived from what it declares and
@@ -166,11 +183,63 @@ var VerbsTheSelfCheckAsks = []SeatVerb{{Seat: "node-intrusion-prevention", Verb:
 // the controller's grant that acts, and only through the step a person starts.
 var VerbsTheBusStepAsks = []SeatVerb{{Seat: "node-backup", Verb: "now"}}
 
+// VerbsTheControllerAsksForASecret are the seat verbs `give` calls (novox/hq ADR 0259 §10): the operator's
+// desk opens a prompt that does not show what is typed, and answers it sealed to the controller's call.
+var VerbsTheControllerAsksForASecret = []SeatVerb{{Seat: "node-launcher", Verb: "secret"}}
+
+// ControllerOnly are the subjects the controller alone may publish, however wide another's grant (the review
+// of 2026-10-09, M4): the desk's hidden prompt, on its seat's subjects and on any holder's own module
+// subjects. A grant of every tool — the runtime's, which carries every agent's calls, or a person's `*` — would
+// otherwise reach it, and the prompt says the controller asks: only the bus makes that true.
+func ControllerOnly() []string {
+	var out []string
+	for _, v := range VerbsTheControllerAsksForASecret {
+		for _, base := range []string{"mesh.seat." + v.Seat + ".tool." + v.Verb, "mesh.mod.*.tool." + v.Seat + "." + v.Verb} {
+			out = append(out, base, base+".*")
+		}
+	}
+	return out
+}
+
+// MayPublish says whether permissions let a principal publish one subject: an allow covers it and no deny does.
+func MayPublish(perms Permissions, subject string) bool {
+	for _, d := range perms.PublishDeny {
+		if SubjectsOverlap(d, subject) {
+			return false
+		}
+	}
+	for _, a := range perms.Publish {
+		if SubjectsOverlap(a, subject) {
+			return true
+		}
+	}
+	return false
+}
+
+// MaySubscribe says whether a principal with these permissions may subscribe to (and so answer) a subject.
+func MaySubscribe(perms Permissions, subject string) bool {
+	for _, a := range perms.Subscribe {
+		if SubjectsOverlap(a, subject) {
+			return true
+		}
+	}
+	return false
+}
+
 // VerbsTheControllerAsksTheDeliveryOwner are the mesh-delivery seat's verbs the controller calls (novox/hq
 // ADR 0239): its self-check reads `stalled`, and healer H2 takes the one transition the table allows
 // through `close`. A mesh seat's verb is flat: no machine in the subject.
+//
+// And, since novox/hq ADR 0259, `release` and `stop`: the controller asks the operator for them about a
+// delivery held past its bound, and calls them on the operator's warrant, with its why.
 var VerbsTheControllerAsksTheDeliveryOwner = []SeatVerb{{Seat: "mesh-delivery", Verb: "stalled"},
-	{Seat: "mesh-delivery", Verb: "close"}}
+	{Seat: "mesh-delivery", Verb: "close"}, {Seat: "mesh-delivery", Verb: "release"}, {Seat: "mesh-delivery", Verb: "stop"}}
+
+// VerbsTheControllerActsOnAWarrant are the other seat verbs the controller calls when the operator's warrant
+// chooses them (novox/hq ADR 0259): a machine's service restarted, and a walk started or stopped through the
+// controller's own `plans`. Named one by one; a node seat's on any machine, a mesh seat's flat.
+var VerbsTheControllerActsOnAWarrant = []SeatVerb{{Seat: "node-service-manager", Verb: "restart"},
+	{Seat: ControllerSeat, Verb: "plans"}}
 
 // perMachineEvents are a node-scoped seat's events about the holder itself, whose last token is the
 // holder's machine (novox/hq ADR 0219): `paused.<node>`, the build agent saying whether it takes work.
@@ -220,6 +289,14 @@ func (p Principal) Username() string {
 // (novox/hq to-be 45 §6): its answer is an ordinary report, on its own report subject.
 func AskReportSubject(node string) string { return "mesh.node." + node + ".ask.report" }
 
+// AskHandOverSubject is where the controller's terminal asks one machine's node-engine to hand a directory it
+// uses as found to the mesh (novox/hq issue 356, issue 339): a request on core NATS, answered once on the reply
+// it carries. Only the controller is granted a publish here (the writers table holds it), but **that is not who
+// the engine hears**: the bus lets any principal allowed to answer reply to a message it received, on the reply
+// subject that message named, so a message can arrive here from any responder. The ask is therefore signed with
+// the mesh's key (link.SignedHandOver), and the engine verifies it before reading anything out of it.
+func AskHandOverSubject(node string) string { return "mesh.node." + node + ".ask.hand-over" }
+
 // inbox is a principal's own reply space. No user is ever granted a bare `_INBOX.>` (design 25
 // §4): with one account, inbox privacy is the permission list or it is nothing, so each user's
 // inbox is derived from its own identity and its permissions name that prefix and no other.
@@ -227,8 +304,11 @@ func (p Principal) inbox() string { return "_INBOX." + p.Username() + ".>" }
 
 // Permissions is what a principal may publish and subscribe, and whether it may answer.
 type Permissions struct {
-	Publish   []string
-	Subscribe []string
+	Publish []string
+	// PublishDeny are subjects refused although an allow covers them: the controller's alone (ControllerOnly),
+	// denied to everybody whose grant is wide enough to reach them. The server's deny outranks its allow.
+	PublishDeny []string
+	Subscribe   []string
 	// AllowResponses lets a principal reply to a request it received, on the reply subject that
 	// request carried, once.
 	//
@@ -366,10 +446,28 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		for _, v := range VerbsTheBusStepAsks {
 			pub = append(pub, "mesh.seat."+v.Seat+".tool."+v.Verb+".*")
 		}
+		// And the operator's desk, for a secret given there (ADR 0259 §10).
+		for _, v := range VerbsTheControllerAsksForASecret {
+			pub = append(pub, "mesh.seat."+v.Seat+".tool."+v.Verb+".*")
+		}
 		// And the delivery's owner, a mesh seat, asked on its flat subjects (ADR 0239).
 		for _, v := range VerbsTheControllerAsksTheDeliveryOwner {
 			pub = append(pub, "mesh.seat."+v.Seat+".tool."+v.Verb)
 		}
+		// And the verbs a warrant chooses (novox/hq ADR 0259): a node seat's on any machine, its own flat.
+		for _, v := range VerbsTheControllerActsOnAWarrant {
+			if v.Seat == ControllerSeat {
+				pub = append(pub, "mesh.seat."+v.Seat+".tool."+v.Verb)
+				continue
+			}
+			pub = append(pub, "mesh.seat."+v.Seat+".tool."+v.Verb+".*")
+		}
+		// And asking the operator (novox/hq ADR 0259): an ask and its cancel under its own name, its warrants
+		// heard under its own name, the record of its asks read under its own name — as any user of the seat,
+		// derived the same way, from the seat its holder declares.
+		tp, ts := SeatTrafficOf(ControllerSeat, nil, p.Uses, nil).grants()
+		pub = append(pub, tp...)
+		sub = append(sub, ts...)
 		// And asks who answers (novox/hq to-be 45 §4, D3): the self-check finds every seat's holder by
 		// the same discovery the console reads. The question only; the answers come to its own inbox.
 		pub = append(pub, "$SRV.INFO")
@@ -472,7 +570,10 @@ func PermissionsFor(p Principal) (Permissions, error) {
 			// And the mesh asking it to say again what it last applied (novox/hq to-be 45 §6, the
 			// `report` verb healer H1 asks): its own machine's, on core NATS and off any stream. It
 			// answers through its report, the one thing it already says — no reply to anybody's inbox.
-			AskReportSubject(p.Node)}
+			AskReportSubject(p.Node),
+			// And the controller's terminal asking it to hand a directory used as found to the mesh (novox/hq
+			// issue 356), which it answers on the request's reply: the one request a node is asked.
+			AskHandOverSubject(p.Node)}
 		// The node-engine witnesses the core builds it places (novox/hq to-be 45 §8, ADR 0236; the
 		// contract is lease/witness.go): it asks its own machine's node tools PING, and, where the
 		// machine runs the controller, reads the lease's one key — read, never written.
@@ -530,6 +631,9 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		// 2b. Events of a role it watches, under the seat's own namespace. Subscribe only: watching a
 		//     role is hearing what it announced, not taking part in it.
 		for _, w := range p.Watches {
+			if w.Kinded {
+				continue // composed by SeatTrafficOf below
+			}
 			for _, e := range w.Emits {
 				sub = append(sub, seatSubject(w, "event", e))
 			}
@@ -546,8 +650,19 @@ func PermissionsFor(p Principal) (Permissions, error) {
 			"$JS.API.CONSUMER.INFO."+consumerStream(p)+"."+consumerDurable(p),
 			"$JS.API.CONSUMER.MSG.NEXT."+consumerStream(p)+"."+consumerDurable(p))
 
-		// 3. Seats it holds: full participation.
+		// 3. Seats it holds: full participation — but the controller's own seat, whose verbs only the serving
+		//    controller answers, on its own connection (servedOnlyByTheController).
 		for _, s := range p.Holds {
+			if servedOnlyByTheController(s) {
+				continue
+			}
+			if s.isNewTraffic() {
+				// Composed by SeatTrafficOf below, worker and all; only its tools are served here.
+				for _, t := range s.Serves {
+					sub = append(sub, seatToolSubject(s, t, p.Node))
+				}
+				continue
+			}
 			// Taking work from the role's queue: the worker consumer every holder shares (asked
 			// about, pulled from, acknowledged), on the seat's own stream (novox/hq ADR 0190). A
 			// holder pulls — asks the consumer for its next message, answered on its own inbox —
@@ -590,7 +705,7 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		//    seat's inbound subject and watch other modules' traffic, nor publish its outbound
 		//    events and lie about outcomes (design 29 §2).
 		for _, s := range p.Uses {
-			for _, a := range s.Accepts {
+			for _, a := range plainVerbs(s, s.Accepts) {
 				pub = append(pub, seatSubject(s, "accept", a))
 			}
 			for _, t := range s.Serves {
@@ -603,6 +718,12 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		pub = append(pub, stateGrants(stateAccess{Module: p.Module, Node: p.Node, Keeps: p.State,
 			PerMachine: p.PerMachine, Reads: p.Reads, KeyedReads: p.KeyedReads})...)
 
+		// 6. Its traffic on seats that name their caller or their kind, ask proofs or keep records
+		//    (novox/hq ADR 0259 §3).
+		tp, ts := SeatTrafficOf(p.Module, p.Holds, p.Uses, p.Watches).grants()
+		pub = append(pub, tp...)
+		sub = append(sub, ts...)
+
 	case KindNodeTools:
 		// **One process serves what every module on the machine would have served for itself**
 		// (novox/hq ADR 0175). Each carried module's whole tool namespace — the same grant that
@@ -628,6 +749,9 @@ func PermissionsFor(p Principal) (Permissions, error) {
 				pub = append(pub, own+".event."+e)
 			}
 			for _, s := range d.Holds {
+				if servedOnlyByTheController(s) {
+					continue
+				}
 				for _, t := range s.Serves {
 					sub = append(sub, seatToolSubject(s, t, p.Node))
 				}
@@ -680,6 +804,25 @@ func PermissionsFor(p Principal) (Permissions, error) {
 			pub = append(pub, stateGrants(stateAccess{Module: d.Module, Node: p.Node, Keeps: stateNames(d.State),
 				PerMachine: perMachineNames(d.State), Reads: d.Reads, KeyedReads: d.KeyedReads})...)
 		}
+		// **Never the traffic of a trusted holder** (novox/hq ADR 0259 §8): the machine's runtime runs as the
+		// operator's account, which every agent runs as, so a module saying warrants or speaking for a kind
+		// that proves its sender is never composed into it — refused here, naming it, whatever registration
+		// let through.
+		for _, d := range p.Carries {
+			if why := trustedTraffic(d); why != "" {
+				return Permissions{}, fmt.Errorf("%s on %s is carried by the machine's runtime, and %s: it runs "+
+					"as an account of its own, never the runtime's (novox/hq ADR 0259)", d.Module, p.Node, why)
+			}
+		}
+		// **And the seat traffic of the modules it carries** (novox/hq ADR 0259 §3): a bundle reaches the
+		// bus only through its runtime, so the runtime is granted the union. That one module's code does
+		// not publish under another's name or kind through it is the runtime's to keep, from the seat
+		// traffic each module's membership lists.
+		for _, d := range p.Carries {
+			tp, ts := SeatTrafficOf(d.Module, d.Holds, d.Uses, d.Watches).grants()
+			pub = append(pub, tp...)
+			sub = append(sub, ts...)
+		}
 		sub = unique(sub)
 		pub = unique(pub)
 	}
@@ -714,13 +857,29 @@ func PermissionsFor(p Principal) (Permissions, error) {
 	if err := CheckWriters(p, pub); err != nil {
 		return Permissions{}, err
 	}
+	// What the controller alone may publish is denied to everybody else whose grant reaches it.
+	var deny []string
+	if p.Kind != KindController {
+		for _, only := range ControllerOnly() {
+			for _, a := range pub {
+				if SubjectsOverlap(a, only) {
+					deny = append(deny, only)
+					break
+				}
+			}
+		}
+	}
 	return Permissions{
-		Publish:   pub,
-		Subscribe: sub,
+		Publish:     pub,
+		PublishDeny: deny,
+		Subscribe:   sub,
 		// A module answers what it was asked — a tool call reaches it on its own namespace, so the
-		// authority is bounded by having been asked — and so does the controller. A node and a
-		// person are never asked anything, and are granted nothing here.
-		AllowResponses: p.Kind == KindModule || p.Kind == KindController || p.Kind == KindNodeTools,
+		// authority is bounded by having been asked — and so does the controller. A node is asked one
+		// thing, a hand-over on its own subject (novox/hq issue 356), and answers that: the node is its
+		// machine's engine, root there already, and it is delivered only its own subjects. What it answers is
+		// never trusted for being an answer — the controller reads the engine's words and records nothing. A
+		// person is never asked anything, and is granted nothing here.
+		AllowResponses: p.Kind == KindModule || p.Kind == KindController || p.Kind == KindNodeTools || p.Kind == KindNode,
 	}, nil
 }
 
@@ -743,6 +902,13 @@ func seatSubject(s Seat, kind, verb string) string {
 // seat carries the node it is asked of, because a flat subject would reach every machine's holder
 // and the queue group would silently pick a winner (novox/hq ADR 0132, design 33 §4). A holder
 // subscribes its own node's; a user publishes any node's (`*`) and names the machine in the subject.
+// servedOnlyByTheController says a seat's verbs are answered by the serving controller alone, on its own
+// connection (the KindController grant), never by a module claiming the seat or a runtime carrying it: the
+// controller's own seat. Its verbs decide what the mesh is — and `root-free` decides whether the router believes
+// a verified sender (novox/hq ADR 0259 §8) — so a machine's runtime, whose credential an agent on that machine
+// may hold, answering one would be an agent answering it (the confirmation review of 2026-10-09).
+func servedOnlyByTheController(s Seat) bool { return s.Name == ControllerSeat }
+
 func seatToolSubject(s Seat, verb, node string) string {
 	base := seatSubject(s, "tool", verb)
 	if s.Scope == "node" && node != "" {
@@ -931,7 +1097,11 @@ func ComposeAccounts(principals []Principal) (string, error) {
 			return "", fmt.Errorf("%s has no password hash: a user without one is a user anybody is", p.Username())
 		}
 		fmt.Fprintf(&b, "      { user: %q, password: %q, permissions: {\n", p.Username(), p.PasswordHash)
-		fmt.Fprintf(&b, "        publish: { allow: [%s] }\n", quoted(perms.Publish))
+		if len(perms.PublishDeny) > 0 {
+			fmt.Fprintf(&b, "        publish: { allow: [%s], deny: [%s] }\n", quoted(perms.Publish), quoted(perms.PublishDeny))
+		} else {
+			fmt.Fprintf(&b, "        publish: { allow: [%s] }\n", quoted(perms.Publish))
+		}
 		fmt.Fprintf(&b, "        subscribe: { allow: [%s] }\n", quoted(perms.Subscribe))
 		if perms.AllowResponses {
 			fmt.Fprintf(&b, "        allow_responses: { max: 1, ttl: \"%dm\" }\n", int(ResponseTTL/time.Minute))

internal/broker/nats_test.go

@@ -103,7 +103,8 @@ func TestAnInboxIsScopedToItsOwner(t *testing.T) {
 
 // A responder answers on the caller's inbox, which it has no permission for. allow_responses is
 // what makes a scoped inbox workable at all — the authority is bounded by having been asked. A
-// module is asked on its own namespace and may answer; a node and a person are never asked.
+// module is asked on its own namespace and may answer; a node is asked one thing, a hand-over on its own
+// subject (novox/hq issue 356), and may answer that; a person is never asked.
 func TestOnlyWhatCanBeAskedMayAnswer(t *testing.T) {
 	module, _ := PermissionsFor(Principal{Kind: KindModule, Node: "one", Module: "audit",
 		Consumes: []string{"shop.order.placed"}, PasswordHash: "x"})
@@ -111,8 +112,12 @@ func TestOnlyWhatCanBeAskedMayAnswer(t *testing.T) {
 		t.Fatal("a module cannot answer a tool call on its own namespace")
 	}
 	node, _ := PermissionsFor(Principal{Kind: KindNode, Node: "one", PasswordHash: "x"})
-	if node.AllowResponses {
-		t.Fatal("a node was granted the right to answer, and nothing asks a node anything")
+	if !node.AllowResponses || !slices.Contains(node.Subscribe, AskHandOverSubject("one")) {
+		t.Fatalf("a node cannot answer the hand-over it is asked: %v %v", node.AllowResponses, node.Subscribe)
+	}
+	person, _ := PermissionsFor(Principal{Kind: KindPerson, Node: "one", Module: "jo", PasswordHash: "x"})
+	if person.AllowResponses {
+		t.Fatal("a person was granted the right to answer, and nothing asks a person anything")
 	}
 }
 

internal/broker/seattraffic.go

@@ -0,0 +1,305 @@
+package broker
+
+import "sort"
+
+// What a module may say and take on the seats it holds, uses and watches, beyond tools (novox/hq ADR
+// 0259 §3, to-be 46 §10).
+//
+// Three rules are added to the ones a seat always had, each a subject whose last token names who may
+// publish it, granted to that publisher alone — the way a node seat's event about a machine carries the
+// machine (ADR 0219):
+//
+//   - **A verb named by its caller** (`by-caller`). A user of the seat submits that accept, and hears that
+//     event, under its own module's name and no other: `accept.ask.<module>`, `event.decided.<module>`. The
+//     holder takes every caller's accept and says the event to any caller. So an ask's asker is a fact the
+//     server enforces, and a warrant reaches only the asker it is for.
+//   - **A kinded bench** (ADR 0234 §2). A holder claims one kind and takes its own kind's accepts, says its
+//     own kind's events and asks its own kind's proofs, and nothing of another kind; a user submits to any
+//     kind. Each kind has its own worker on the seat's queue, so a holder that is away keeps its work and
+//     holds up no other kind.
+//   - **A proof** (`proofs`): core request and reply on `mesh.seat.<seat>.proof.<verb>.<kind>`. No stream's
+//     subjects cover it, so what travels there — a code typed by the operator — is never persisted. A kinded
+//     holder asks with its own kind; the modules that watch the seat answer.
+//
+// And one read: **a holder's records**, a bucket the seat names, read by each user under its own name only
+// (`$KV.<bucket>.<module>.>`), so an asker reads the state of its own asks and no other asker's.
+
+// Worker is one durable consumer a holder pulls a seat's work from.
+type Worker struct {
+	Stream   string
+	Consumer string
+	Filter   string
+}
+
+// SeatTraffic is one module's seat traffic beyond tools. Publish and Subscribe are subject patterns, in the
+// server's wildcards; the runtime that carries the module checks a bundle's request against them, since
+// the runtime's own principal holds the union of every module it carries.
+type SeatTraffic struct {
+	// Publish is what it submits (accepts of seats it uses), says (events of seats it holds) and asks
+	// (proofs of seats it holds a kind of).
+	Publish []string `json:"publish,omitempty"`
+	// Subscribe is what it hears: events of seats it uses that are named by caller, events of seats it
+	// watches, and accepts of seats it holds.
+	Subscribe []string `json:"subscribe,omitempty"`
+	// Answers is the proof subjects it answers, as a watcher of a kinded seat.
+	Answers []string `json:"answers,omitempty"`
+	// Workers are the work queues it takes from, as a holder.
+	Workers []Worker `json:"workers,omitempty"`
+	// Records is the direct-get subjects of the records it reads under its own name.
+	Records []string `json:"records,omitempty"`
+	// Kinds are the holders of every kinded bench it uses or watches, with what each promises: the one
+	// account of which channel is which, and what it can carry, that the router judges an answer by. The
+	// controller's, from the claims, never a channel's word (novox/hq ADR 0259 §5).
+	Kinds []KindHeld `json:"kinds,omitempty"`
+}
+
+// KindHeld is one kind of a kinded bench and who holds it.
+type KindHeld struct {
+	Seat         string   `json:"seat"`
+	Kind         string   `json:"kind"`
+	Module       string   `json:"module"`
+	Node         string   `json:"node"`
+	Capabilities []string `json:"capabilities,omitempty"`
+}
+
+// KindedBenches are the seats that may be kinded (ADR 0234 §2): making another is a decision, recorded.
+var KindedBenches = map[string]bool{"channel": true, "intake": true}
+
+// WorkerName is the worker a seat's holders pull from: one for the seat, or one per kind on a kinded bench.
+func WorkerName(seat, kind string) string {
+	if kind == "" {
+		return "SEAT_" + upperSnake(seat) + "_worker"
+	}
+	return "SEAT_" + upperSnake(seat) + "_" + upperSnake(kind) + "_worker"
+}
+
+func namesVerb(list []string, s string) bool {
+	for _, x := range list {
+		if x == s {
+			return true
+		}
+	}
+	return false
+}
+
+// SeatTrafficOf derives one module's seat traffic from the seats it holds, uses and watches. Only seats
+// carrying one of the rules above are read: every other seat is composed as it always was.
+func SeatTrafficOf(module string, holds, uses, watches []Seat) SeatTraffic {
+	var t SeatTraffic
+	for _, s := range holds {
+		if !s.isNewTraffic() {
+			continue
+		}
+		kind := ""
+		if s.Kinded {
+			kind = s.Kind
+			if kind == "" || !safeSubject.MatchString(kind) {
+				// A kinded claim without a usable kind is refused at registration; here it is granted
+				// nothing, which is the same answer at the last place it could be asked.
+				continue
+			}
+		}
+		if len(s.Accepts) > 0 {
+			stream := seatStreamName(s.Name)
+			filter := "mesh.seat." + s.Name + ".accept.>"
+			if kind != "" {
+				filter = "mesh.seat." + s.Name + ".accept.*." + kind
+			}
+			t.Workers = append(t.Workers, Worker{Stream: stream, Consumer: WorkerName(s.Name, kind), Filter: filter})
+		}
+		for _, a := range s.Accepts {
+			switch {
+			case kind != "":
+				t.Subscribe = append(t.Subscribe, seatSubject(s, "accept", a+"."+kind))
+			case namesVerb(s.ByCaller, a):
+				t.Subscribe = append(t.Subscribe, seatSubject(s, "accept", a+".*"))
+			}
+		}
+		for _, e := range s.Emits {
+			switch {
+			case kind != "":
+				t.Publish = append(t.Publish, seatSubject(s, "event", e+"."+kind))
+			case namesVerb(s.ByCaller, e):
+				t.Publish = append(t.Publish, seatSubject(s, "event", e+".*"))
+			}
+		}
+		if kind != "" {
+			for _, v := range s.Proofs {
+				t.Publish = append(t.Publish, seatSubject(s, "proof", v+"."+kind))
+			}
+		}
+	}
+	for _, s := range uses {
+		if !s.isNewTraffic() {
+			continue
+		}
+		for _, a := range s.Accepts {
+			switch {
+			case namesVerb(s.ByCaller, a):
+				t.Publish = append(t.Publish, seatSubject(s, "accept", a+"."+module))
+			case s.Kinded && module == s.DeclaredBy:
+				// Work for a kind is put on its queue by the bench's own router, and by no other user.
+				t.Publish = append(t.Publish, seatSubject(s, "accept", a+".*"))
+			}
+		}
+		for _, e := range s.Emits {
+			if namesVerb(s.ByCaller, e) {
+				t.Subscribe = append(t.Subscribe, seatSubject(s, "event", e+"."+module))
+			}
+		}
+		for _, b := range s.Records {
+			if !safeSubject.MatchString(b) {
+				continue
+			}
+			t.Records = append(t.Records, "$JS.API.DIRECT.GET.KV_"+b+".$KV."+b+"."+module+".>")
+		}
+	}
+	for _, w := range watches {
+		if w.Kinded {
+			for _, e := range w.Emits {
+				t.Subscribe = append(t.Subscribe, seatSubject(w, "event", e+".*"))
+			}
+			if module == w.DeclaredBy {
+				// A code is answered by the bench's own router, and by no other watcher.
+				for _, v := range w.Proofs {
+					t.Answers = append(t.Answers, seatSubject(w, "proof", v+".*"))
+				}
+			}
+		}
+	}
+	t.Publish = unique(t.Publish)
+	t.Subscribe = unique(t.Subscribe)
+	t.Answers = unique(t.Answers)
+	t.Records = unique(t.Records)
+	sort.Slice(t.Workers, func(i, j int) bool { return t.Workers[i].Consumer < t.Workers[j].Consumer })
+	return t
+}
+
+// grants is the bus permissions seat traffic needs: the subjects themselves, and the JetStream API a
+// worker is pulled and acknowledged through and a record is read through.
+func (t SeatTraffic) grants() (pub, sub []string) {
+	pub = append(pub, t.Publish...)
+	sub = append(sub, t.Subscribe...)
+	sub = append(sub, t.Answers...)
+	for _, w := range t.Workers {
+		pub = append(pub,
+			"$JS.API.CONSUMER.INFO."+w.Stream+"."+w.Consumer,
+			"$JS.API.CONSUMER.MSG.NEXT."+w.Stream+"."+w.Consumer,
+			"$JS.ACK."+w.Stream+"."+w.Consumer+".>")
+	}
+	pub = append(pub, t.Records...)
+	return pub, sub
+}
+
+// isNewTraffic says whether a seat carries any of the rules above, so a seat that carries none is
+// composed exactly as before them.
+func (s Seat) isNewTraffic() bool {
+	return s.Kinded || len(s.ByCaller) > 0 || len(s.Proofs) > 0 || len(s.Records) > 0
+}
+
+// plainVerbs is a seat's accepts or emits with those the rules above compose taken out: a verb named by
+// its caller and every verb of a kinded bench are composed by SeatTrafficOf and nowhere else.
+func plainVerbs(s Seat, verbs []string) []string {
+	if s.Kinded {
+		return nil
+	}
+	var out []string
+	for _, v := range verbs {
+		if !namesVerb(s.ByCaller, v) {
+			out = append(out, v)
+		}
+	}
+	return out
+}
+
+// SeatTrafficObjects is the work queues and workers the seat traffic of every composed user implies
+// (novox/hq ADR 0259 §3): a queue for each seat a holder takes work from, and each holder's worker on it —
+// one per kind on a kinded bench, filtered to that kind, so the kinds never take each other's work. Only
+// seats carrying the rules above; the mesh's own seats' queues are RaiseSeats'.
+func SeatTrafficObjects(users []Principal) ([]Stream, []Consumer) {
+	streams := map[string]Stream{}
+	consumers := map[string]Consumer{}
+	add := func(module string, holds []Seat) {
+		for _, w := range SeatTrafficOf(module, holds, nil, nil).Workers {
+			seat := ""
+			for _, s := range holds {
+				if seatStreamName(s.Name) == w.Stream {
+					seat = s.Name
+				}
+			}
+			streams[w.Stream] = Stream{
+				Name:      w.Stream,
+				Subjects:  []string{"mesh.seat." + seat + ".accept.>"},
+				Retention: RetentionWorkQueue,
+				MaxAge:    7 * 24 * 60 * 60,
+				Why:       "work submitted to the " + seat + " seat; its holders take it, each kind its own, and it queues while nobody does",
+			}
+			consumers[w.Consumer] = Consumer{
+				Name:           w.Consumer,
+				Stream:         w.Stream,
+				Filters:        []string{w.Filter},
+				AckWaitSeconds: 60,
+				// No bound on redelivery: a channel away for a day keeps its work, offered again later and
+				// later by its holder's runtime (novox/hq ADR 0259; the correctness review of 2026-10-08).
+				MaxDeliver: 0,
+				Why: module + " holds " + seat + "; it pulls one ask at a time and acknowledges once it has " +
+					"recorded it, so a crash redelivers rather than loses",
+			}
+		}
+	}
+	for _, p := range users {
+		switch p.Kind {
+		case KindModule:
+			add(p.Module, p.Holds)
+		case KindNodeTools:
+			for _, d := range p.Carries {
+				add(d.Module, d.Holds)
+			}
+		}
+	}
+	var ss []Stream
+	for _, s := range streams {
+		ss = append(ss, s)
+	}
+	sort.Slice(ss, func(i, j int) bool { return ss[i].Name < ss[j].Name })
+	var cs []Consumer
+	for _, c := range consumers {
+		cs = append(cs, c)
+	}
+	sort.Slice(cs, func(i, j int) bool { return cs[i].Name < cs[j].Name })
+	return ss, cs
+}
+
+// trustedTraffic is why a module's seat traffic is the trusted holder's (novox/hq ADR 0259 §8), or "": it
+// says a seat's event to one caller each (a warrant), or holds a kind of a kinded bench that proves its sender.
+func trustedTraffic(d Declared) string {
+	for _, s := range d.Holds {
+		for _, e := range s.Emits {
+			if namesVerb(s.ByCaller, e) {
+				return "it says " + s.Name + "'s " + e + " to one caller each"
+			}
+		}
+		if s.Kinded && namesVerb(s.Capabilities, "verified-sender") {
+			return "it holds " + s.Name + " of kind " + s.Kind + ", which proves its sender"
+		}
+	}
+	return ""
+}
+
+// TrafficQueues is the work queue of every seat naming its caller or its kind that accepts work, held or not
+// (novox/hq ADR 0259 §3): what is submitted before a holder is assigned waits for it.
+func TrafficQueues(seats []Seat) []Stream {
+	var out []Stream
+	seen := map[string]bool{}
+	for _, s := range seats {
+		if len(s.Accepts) == 0 || !s.isNewTraffic() || seen[s.Name] {
+			continue
+		}
+		seen[s.Name] = true
+		out = append(out, Stream{Name: seatStreamName(s.Name), Subjects: []string{"mesh.seat." + s.Name + ".accept.>"},
+			Retention: RetentionWorkQueue, MaxAge: 7 * 24 * 60 * 60,
+			Why: "work submitted to the " + s.Name + " seat; its holders take it, each kind its own, and it queues while nobody does"})
+	}
+	sort.Slice(out, func(i, j int) bool { return out[i].Name < out[j].Name })
+	return out
+}

internal/broker/seattraffic_test.go

@@ -0,0 +1,390 @@
+package broker
+
+import (
+	"strings"
+	"testing"
+)
+
+// The seats of novox/hq ADR 0259 §3, as the messenger declares them.
+func operatorChannel() Seat {
+	return Seat{Name: "operator-channel", Scope: "mesh", Accepts: []string{"ask", "cancel"},
+		Emits: []string{"decided"}, Serves: []string{"open", "history", "notify"},
+		ByCaller: []string{"ask", "cancel", "decided"}, Records: []string{"messenger_asks"}}
+}
+
+func channelSeat(kind string) Seat {
+	return Seat{Name: "channel", Scope: "mesh", Accepts: []string{"show", "edit", "send"}, Kinded: true, Kind: kind,
+		DeclaredBy: "messenger"}
+}
+
+func intakeSeat(kind string) Seat {
+	return Seat{Name: "intake", Scope: "mesh", Emits: []string{"choice", "link"}, Proofs: []string{"code"},
+		Kinded: true, Kind: kind, DeclaredBy: "messenger"}
+}
+
+func allowed(patterns []string, subject string) bool {
+	for _, p := range patterns {
+		if subjectMatches(p, subject) {
+			return true
+		}
+	}
+	return false
+}
+
+func perms(t *testing.T, p Principal) Permissions {
+	t.Helper()
+	got, err := PermissionsFor(p)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return got
+}
+
+func TestAnAskerAsksAndHearsUnderItsOwnNameOnly(t *testing.T) {
+	asker := Principal{Kind: KindModule, Node: "anchor", Module: "mesh-delivery", Uses: []Seat{operatorChannel()}}
+	got := perms(t, asker)
+	for _, s := range []string{
+		"mesh.seat.operator-channel.accept.ask.mesh-delivery",
+		"mesh.seat.operator-channel.accept.cancel.mesh-delivery",
+		"$JS.API.DIRECT.GET.KV_messenger_asks.$KV.messenger_asks.mesh-delivery.a1",
+	} {
+		if !allowed(got.Publish, s) {
+			t.Errorf("an asker may not publish %s", s)
+		}
+	}
+	for _, s := range []string{
+		"mesh.seat.operator-channel.accept.ask.mesh-controller",
+		"mesh.seat.operator-channel.accept.ask.*",
+		"mesh.seat.operator-channel.event.decided.mesh-delivery",
+		"$JS.API.DIRECT.GET.KV_messenger_asks.$KV.messenger_asks.mesh-controller.a1",
+		"$KV.messenger_asks.mesh-delivery.a1",
+	} {
+		if allowed(got.Publish, s) {
+			t.Errorf("an asker may publish %s, which is not its own to submit", s)
+		}
+	}
+	if !allowed(got.Subscribe, "mesh.seat.operator-channel.event.decided.mesh-delivery") {
+		t.Error("an asker does not hear its own warrants")
+	}
+	if allowed(got.Subscribe, "mesh.seat.operator-channel.event.decided.mesh-controller") {
+		t.Error("an asker hears another asker's warrants")
+	}
+	// And its own consumer carries its warrants, so a restart catches up.
+	c, ok := ConsumerFor(asker)
+	if !ok || !allowed(c.Filters, "mesh.seat.operator-channel.event.decided.mesh-delivery") {
+		t.Errorf("the asker's consumer does not carry its warrants: %v", c.Filters)
+	}
+}
+
+func TestOnlyTheHolderPublishesAWarrant(t *testing.T) {
+	users, err := Users(Records{
+		Nodes: []string{"anchor"},
+		Assigned: map[string][]Declared{"anchor": {
+			{Module: "messenger", Holds: []Seat{operatorChannel()}, Uses: []Seat{channelSeat("")},
+				Watches: []Seat{{Name: "intake", Emits: []string{"choice", "link"}, Kinded: true, Proofs: []string{"code"}, DeclaredBy: "messenger"}}},
+			{Module: "mesh-delivery", Uses: []Seat{operatorChannel()}},
+			{Module: "telegram", Holds: []Seat{channelSeat("telegram"), intakeSeat("telegram")}},
+		}},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, u := range users {
+		got := perms(t, u)
+		says := allowed(got.Publish, "mesh.seat.operator-channel.event.decided.mesh-delivery")
+		if says != (u.Module == "messenger") {
+			t.Errorf("%s %s publish a warrant", u.Username(), map[bool]string{true: "may", false: "may not"}[says])
+		}
+	}
+}
+
+func TestTheHolderTakesEveryCallersAskThroughItsWorker(t *testing.T) {
+	got := perms(t, Principal{Kind: KindModule, Node: "anchor", Module: "messenger", Holds: []Seat{operatorChannel()}})
+	if !allowed(got.Subscribe, "mesh.seat.operator-channel.accept.ask.mesh-delivery") {
+		t.Error("the router does not take an ask")
+	}
+	for _, s := range []string{
+		"$JS.API.CONSUMER.MSG.NEXT.SEAT_OPERATOR_CHANNEL.SEAT_OPERATOR_CHANNEL_worker",
+		"$JS.ACK.SEAT_OPERATOR_CHANNEL.SEAT_OPERATOR_CHANNEL_worker.x",
+		"mesh.seat.operator-channel.event.decided.mesh-controller",
+	} {
+		if !allowed(got.Publish, s) {
+			t.Errorf("the router may not publish %s", s)
+		}
+	}
+	if allowed(got.Publish, "mesh.seat.operator-channel.accept.ask.messenger") {
+		t.Error("the holder may ask its own seat without using it")
+	}
+}
+
+func TestAKindedHolderReachesItsOwnKindAndNoOther(t *testing.T) {
+	got := perms(t, Principal{Kind: KindModule, Node: "anchor", Module: "telegram",
+		Holds: []Seat{channelSeat("telegram"), intakeSeat("telegram")}})
+	for _, s := range []string{
+		"mesh.seat.intake.event.choice.telegram", "mesh.seat.intake.event.link.telegram",
+		"mesh.seat.intake.proof.code.telegram",
+		"$JS.API.CONSUMER.MSG.NEXT.SEAT_CHANNEL.SEAT_CHANNEL_TELEGRAM_worker",
+	} {
+		if !allowed(got.Publish, s) {
+			t.Errorf("telegram may not publish %s", s)
+		}
+	}
+	for _, s := range []string{
+		"mesh.seat.intake.event.choice.desktop", "mesh.seat.intake.proof.code.desktop",
+		"mesh.seat.channel.accept.show.telegram",
+		"$JS.API.CONSUMER.MSG.NEXT.SEAT_CHANNEL.SEAT_CHANNEL_DESKTOP_worker",
+		"mesh.seat.operator-channel.event.decided.mesh-delivery",
+	} {
+		if allowed(got.Publish, s) {
+			t.Errorf("telegram may publish %s", s)
+		}
+	}
+	if !allowed(got.Subscribe, "mesh.seat.channel.accept.show.telegram") ||
+		allowed(got.Subscribe, "mesh.seat.channel.accept.show.desktop") {
+		t.Error("telegram does not take exactly its own kind's work")
+	}
+	if allowed(got.Subscribe, "mesh.seat.intake.proof.code.telegram") {
+		t.Error("a channel answers its own proofs")
+	}
+}
+
+func TestTheWatcherAnswersProofsAndHearsEveryKind(t *testing.T) {
+	got := perms(t, Principal{Kind: KindModule, Node: "anchor", Module: "messenger",
+		Uses:    []Seat{channelSeat("")},
+		Watches: []Seat{{Name: "intake", Emits: []string{"choice"}, Kinded: true, Proofs: []string{"code"}, DeclaredBy: "messenger"}}})
+	for _, s := range []string{"mesh.seat.intake.event.choice.telegram", "mesh.seat.intake.proof.code.desktop"} {
+		if !allowed(got.Subscribe, s) {
+			t.Errorf("the router does not hear %s", s)
+		}
+	}
+	if !allowed(got.Publish, "mesh.seat.channel.accept.show.telegram") {
+		t.Error("the router cannot send a channel its work")
+	}
+	if allowed(got.Publish, "mesh.seat.intake.event.choice.telegram") || allowed(got.Publish, "mesh.seat.intake.proof.code.telegram") {
+		t.Error("the router may say a channel's answer or proof")
+	}
+}
+
+func TestNoStreamKeepsAProof(t *testing.T) {
+	users, _ := Users(Records{Nodes: []string{"anchor"}, Assigned: map[string][]Declared{"anchor": {
+		{Module: "telegram", Holds: []Seat{channelSeat("telegram"), intakeSeat("telegram")}},
+		{Module: "messenger", Holds: []Seat{operatorChannel()}},
+	}}})
+	streams, _ := SeatTrafficObjects(users)
+	streams = append(streams, MeshStreams()...)
+	for _, s := range streams {
+		for _, subject := range s.Subjects {
+			if subjectMatches(subject, "mesh.seat.intake.proof.code.telegram") {
+				t.Errorf("%s keeps a proof (%s)", s.Name, subject)
+			}
+		}
+	}
+}
+
+func TestEachKindHasAWorkerOfItsOwn(t *testing.T) {
+	users, _ := Users(Records{Nodes: []string{"anchor"}, Assigned: map[string][]Declared{"anchor": {
+		{Module: "telegram", Holds: []Seat{channelSeat("telegram")}},
+		{Module: "desk-channel", Holds: []Seat{channelSeat("desktop")}},
+		{Module: "messenger", Holds: []Seat{operatorChannel()}},
+	}}})
+	streams, workers := SeatTrafficObjects(users)
+	names := map[string]string{}
+	for _, w := range workers {
+		names[w.Name] = strings.Join(w.Filters, ",")
+	}
+	want := map[string]string{
+		"SEAT_CHANNEL_TELEGRAM_worker": "mesh.seat.channel.accept.*.telegram",
+		"SEAT_CHANNEL_DESKTOP_worker":  "mesh.seat.channel.accept.*.desktop",
+		"SEAT_OPERATOR_CHANNEL_worker": "mesh.seat.operator-channel.accept.>",
+	}
+	for n, f := range want {
+		if names[n] != f {
+			t.Errorf("worker %s filters %q, want %q", n, names[n], f)
+		}
+	}
+	if len(streams) != 2 {
+		t.Errorf("want the queues of channel and operator-channel, got %v", streams)
+	}
+}
+
+func TestTheRuntimeIsGrantedTheUnionAndTheMembershipEachModulesShare(t *testing.T) {
+	telegram := Declared{Module: "telegram", Holds: []Seat{channelSeat("telegram"), intakeSeat("telegram")}}
+	desk := Declared{Module: "desk-channel", Holds: []Seat{channelSeat("desktop"), intakeSeat("desktop")}}
+	got := perms(t, Principal{Kind: KindNodeTools, Node: "anchor", Module: RuntimeModule, Carries: []Declared{telegram, desk}})
+	for _, s := range []string{"mesh.seat.intake.event.choice.telegram", "mesh.seat.intake.event.choice.desktop"} {
+		if !allowed(got.Publish, s) {
+			t.Errorf("the runtime may not publish %s for a module it carries", s)
+		}
+	}
+	m := MembershipFor("anchor", telegram, Placements{})
+	if m.SeatTraffic == nil || !allowed(m.SeatTraffic.Publish, "mesh.seat.intake.event.choice.telegram") ||
+		allowed(m.SeatTraffic.Publish, "mesh.seat.intake.event.choice.desktop") {
+		t.Errorf("telegram's membership does not list exactly its own kind: %+v", m.SeatTraffic)
+	}
+	if plain := MembershipFor("anchor", Declared{Module: "plain"}, Placements{}); plain.SeatTraffic != nil {
+		t.Error("a module with no such seat is given seat traffic")
+	}
+}
+
+func TestASeatWithoutTheNewRulesIsComposedAsBefore(t *testing.T) {
+	old := Seat{Name: "node-build-agent", Scope: "node", Accepts: []string{"build"}, Emits: []string{"built"}}
+	got := perms(t, Principal{Kind: KindModule, Node: "anchor", Module: "builder", Holds: []Seat{old}})
+	for _, s := range []string{"mesh.seat.node-build-agent.event.built",
+		"$JS.API.CONSUMER.MSG.NEXT.SEAT_NODE_BUILD_AGENT.SEAT_NODE_BUILD_AGENT_worker"} {
+		if !allowed(got.Publish, s) {
+			t.Errorf("an old seat's holder lost %s", s)
+		}
+	}
+	if !allowed(got.Subscribe, "mesh.seat.node-build-agent.accept.build") {
+		t.Error("an old seat's holder lost its accept")
+	}
+}
+
+// The router learns which channel is which, and what each promises, from the controller's membership:
+// the claims, never a channel's word (ADR 0259 §5).
+func TestTheRoutersMembershipNamesEveryKindAndItsCapabilities(t *testing.T) {
+	tg := channelSeat("telegram")
+	tg.Capabilities = []string{"choice", "verified-sender"}
+	desk := channelSeat("desktop")
+	desk.Capabilities = []string{"choice"}
+	router := Declared{Module: "messenger", Holds: []Seat{operatorChannel()}, Uses: []Seat{channelSeat("")}}
+	records := Records{Nodes: []string{"anchor", "laptop"}, Assigned: map[string][]Declared{
+		"anchor": {router, {Module: "telegram", Holds: []Seat{tg}, RunsAs: "telegram"}},
+		"laptop": {{Module: "desk-channel", Holds: []Seat{desk}}},
+	}, RootFree: map[string]bool{"anchor": true}}
+	where := PlacementsOf(records, nil)
+	m := MembershipFor("anchor", router, where)
+	if m.SeatTraffic == nil || len(m.SeatTraffic.Kinds) != 2 {
+		t.Fatalf("the router is not told the kinds: %+v", m.SeatTraffic)
+	}
+	byKind := map[string]KindHeld{}
+	for _, k := range m.SeatTraffic.Kinds {
+		byKind[k.Kind] = k
+	}
+	if k := byKind["telegram"]; k.Module != "telegram" || k.Node != "anchor" || !namesVerb(k.Capabilities, "verified-sender") {
+		t.Errorf("telegram is %+v", k)
+	}
+	if k := byKind["desktop"]; k.Module != "desk-channel" || namesVerb(k.Capabilities, "verified-sender") {
+		t.Errorf("the desk is %+v", k)
+	}
+	if other := MembershipFor("anchor", Declared{Module: "mesh-delivery", Uses: []Seat{operatorChannel()}}, where); other.SeatTraffic != nil && len(other.SeatTraffic.Kinds) > 0 {
+		t.Error("an asker is told the channels")
+	}
+}
+
+// novox/hq ADR 0259 §8: only the bench's own router answers its proofs and puts work on a kind's queue.
+func TestOnlyTheBenchsRouterAnswersProofsAndSubmitsWork(t *testing.T) {
+	other := perms(t, Principal{Kind: KindModule, Node: "anchor", Module: "eavesdropper",
+		Uses:    []Seat{channelSeat("")},
+		Watches: []Seat{{Name: "intake", Emits: []string{"choice"}, Kinded: true, Proofs: []string{"code"}, DeclaredBy: "messenger"}}})
+	if allowed(other.Subscribe, "mesh.seat.intake.proof.code.telegram") {
+		t.Error("a watcher that is not the router answers codes")
+	}
+	if allowed(other.Publish, "mesh.seat.channel.accept.show.telegram") {
+		t.Error("a user that is not the router puts work on a kind's queue")
+	}
+	if !allowed(other.Subscribe, "mesh.seat.intake.event.choice.telegram") {
+		t.Error("a watcher no longer hears the bench's events")
+	}
+}
+
+// novox/hq ADR 0259 §8: the machine's runtime runs as the operator's account; it never carries a module
+// that says warrants or speaks for a kind proving its sender, and such a module has its own account.
+func TestTheMachinesRuntimeNeverCarriesATrustedHolder(t *testing.T) {
+	tg := channelSeat("telegram")
+	tg.Capabilities = []string{"choice", "verified-sender"}
+	for name, d := range map[string]Declared{
+		"the router":         {Module: "messenger", Holds: []Seat{operatorChannel()}},
+		"a verified channel": {Module: "telegram", Holds: []Seat{tg}},
+	} {
+		if _, err := PermissionsFor(Principal{Kind: KindNodeTools, Node: "anchor", Module: RuntimeModule,
+			Carries: []Declared{d}}); err == nil || !strings.Contains(err.Error(), "an account of its own") {
+			t.Errorf("%s was composed into the machine's runtime: %v", name, err)
+		}
+	}
+	desk := channelSeat("desktop")
+	desk.Capabilities = []string{"choice"}
+	if _, err := PermissionsFor(Principal{Kind: KindNodeTools, Node: "anchor", Module: RuntimeModule,
+		Carries: []Declared{{Module: "desk-channel", Holds: []Seat{desk}}}}); err != nil {
+		t.Errorf("a channel proving nothing was refused: %v", err)
+	}
+	users, err := Users(Records{Nodes: []string{"anchor"}, Assigned: map[string][]Declared{"anchor": {
+		{Module: RuntimeModule}, {Module: "telegram", Holds: []Seat{tg}, RunsAs: "telegram"},
+		{Module: "messenger", Holds: []Seat{operatorChannel()}, RunsAs: "messenger"},
+	}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, u := range users {
+		if u.Kind == KindNodeTools {
+			for _, d := range u.Carries {
+				if d.RunsAs != "" {
+					t.Errorf("the machine's runtime carries %s", d.Module)
+				}
+			}
+			if _, err := PermissionsFor(u); err != nil {
+				t.Errorf("the runtime could not be composed: %v", err)
+			}
+		}
+	}
+}
+
+// novox/hq ADR 0259 §8: verified-sender reaches the router only from a holder of its own account, on a machine
+// root-free when composed, with the router's own machine root-free too (the review of 2026-10-09, H3).
+func TestVerifiedSenderIsBelievedOnlyFromAHolderOfItsOwnAccount(t *testing.T) {
+	if got := placedCapabilities([]string{"choice", "verified-sender"}, "", true); namesVerb(got, "verified-sender") {
+		t.Errorf("a carried holder keeps verified-sender: %v", got)
+	}
+	if got := placedCapabilities([]string{"choice", "verified-sender"}, "telegram", true); !namesVerb(got, "verified-sender") {
+		t.Errorf("a holder of its own account on a root-free machine lost verified-sender: %v", got)
+	}
+	if got := placedCapabilities([]string{"choice", "verified-sender"}, "telegram", false); namesVerb(got, "verified-sender") ||
+		!namesVerb(got, "choice") {
+		t.Errorf("a holder on a machine not root-free keeps verified-sender, or lost the rest: %v", got)
+	}
+}
+
+// The kinds the router is told carry verified-sender only while the channel's machine and the router's are
+// both root-free as composed; no record of a pass is no pass, and neither is a router placed nowhere.
+func TestVerifiedSenderNeedsTheChannelsAndTheRoutersMachinesRootFree(t *testing.T) {
+	tg := channelSeat("telegram")
+	tg.Capabilities = []string{"choice", "verified-sender"}
+	router := Declared{Module: "messenger", Holds: []Seat{operatorChannel()}, RunsAs: "messenger"}
+	telegram := Declared{Module: "telegram", Holds: []Seat{tg}, RunsAs: "telegram"}
+	verified := func(r Records) bool {
+		for _, k := range PlacementsOf(r, nil).Kinds {
+			if k.Kind == "telegram" {
+				return namesVerb(k.Capabilities, "verified-sender")
+			}
+		}
+		t.Fatal("telegram not placed")
+		return false
+	}
+	same := func(free map[string]bool) Records {
+		return Records{Nodes: []string{"anchor"}, Assigned: map[string][]Declared{"anchor": {router, telegram}}, RootFree: free}
+	}
+	apart := func(free map[string]bool) Records {
+		return Records{Nodes: []string{"anchor", "relay"},
+			Assigned: map[string][]Declared{"anchor": {router}, "relay": {telegram}}, RootFree: free}
+	}
+	if !verified(same(map[string]bool{"anchor": true})) {
+		t.Error("both on one root-free machine: verified-sender withheld")
+	}
+	if verified(same(nil)) {
+		t.Error("no record of a pass, and verified-sender kept")
+	}
+	if verified(apart(map[string]bool{"relay": true})) {
+		t.Error("the router's machine not root-free, and verified-sender kept")
+	}
+	if verified(apart(map[string]bool{"anchor": true})) {
+		t.Error("the channel's machine not root-free, and verified-sender kept")
+	}
+	if !verified(apart(map[string]bool{"anchor": true, "relay": true})) {
+		t.Error("both machines root-free: verified-sender withheld")
+	}
+	noRouter := Records{Nodes: []string{"relay"}, Assigned: map[string][]Declared{"relay": {telegram}},
+		RootFree: map[string]bool{"relay": true}}
+	if verified(noRouter) {
+		t.Error("no router placed, and verified-sender kept")
+	}
+}

internal/broker/streams.go

@@ -363,8 +363,19 @@ var ControllerFollows = []string{
 	// seat to check before it merges — every machine of the facts snapshot composed with the change.
 	// Appended, because the index is a name.
 	moduleEventSubject("gitea", "pull.updated"),
+	// **The operator's answers to what the controller asked** (novox/hq ADR 0259): the router's warrant, or
+	// the end of an ask without one, said to the controller alone under its own name. On the stream, so a
+	// controller that was away hears what was decided meanwhile. Appended, because the index is a name.
+	DecidedSubject,
 }
 
+// AsksSeat is the seat an ask is made on and its warrant heard from (novox/hq ADR 0259): the router's.
+const AsksSeat = "operator-channel"
+
+// DecidedSubject is where the router says the controller's warrants: the seat's event named by the
+// controller as its caller.
+var DecidedSubject = seatEventSubject(AsksSeat, "decided."+ControllerSeat)
+
 // The provider standing events, by their local names. Written here as well as in the catalogue
 // (catalogue.ProvisionerEvents), which this package cannot import; a test keeps them agreeing.
 const (

internal/broker/testdata/composed.conf

@@ -24,8 +24,8 @@ accounts {
     jetstream: enabled
     users = [
       { user: "controller", password: "$2a$11$cccccccccccccccccccccc", permissions: {
-        publish: { allow: ["$JS.ACK.CONTROL.controller.>", "$JS.ACK.DEAD_LETTER_NOTICES.controller.>", "$JS.ACK.EVENTS.controller.>", "$JS.API.>", "$KV.SEAT_MESH_BUILD_MACHINE_cancelled.>", "$KV.SEAT_NODE_BUILD_AGENT_cancelled.>", "$KV.mesh-controller_calls.>", "$KV.mesh-controller_condition-history.>", "$KV.mesh-controller_conditions.>", "$KV.mesh-controller_hand-acts.>", "$KV.mesh-controller_lease.>", "$SRV.INFO", "_INBOX.enrol.>", "mesh.again.>", "mesh.assignment.>", "mesh.events.dead.>", "mesh.mod.*.tool.>", "mesh.node.>", "mesh.seat.mesh-build-machine.accept.>", "mesh.seat.mesh-build-machine.tool.>", "mesh.seat.mesh-controller.event.applied", "mesh.seat.mesh-controller.event.built-before", "mesh.seat.mesh-controller.event.checked", "mesh.seat.mesh-controller.event.condition-changed", "mesh.seat.mesh-controller.event.condition-cleared", "mesh.seat.mesh-controller.event.condition-raised", "mesh.seat.mesh-controller.event.doctor-heartbeat", "mesh.seat.mesh-controller.event.healer-acted", "mesh.seat.mesh-controller.event.plan-moved", "mesh.seat.mesh-controller.event.refused", "mesh.seat.mesh-controller.event.rolled-back", "mesh.seat.mesh-controller.event.secret-replaced", "mesh.seat.mesh-delivery.tool.close", "mesh.seat.mesh-delivery.tool.stalled", "mesh.seat.node-backup.tool.backed-up.*", "mesh.seat.node-backup.tool.now.*", "mesh.seat.node-build-agent.accept.>", "mesh.seat.node-build-agent.tool.>", "mesh.seat.node-intrusion-prevention.tool.banned.*"] }
-        subscribe: { allow: ["$JS.API.>", "$JS.EVENT.ADVISORY.CONSUMER.DELETED.>", "$JS.EVENT.ADVISORY.CONSUMER.MAX_DELIVERIES.>", "$SRV.INFO", "$SRV.INFO.mesh-controller", "$SRV.INFO.mesh-controller.>", "$SRV.PING", "$SRV.PING.mesh-controller", "$SRV.PING.mesh-controller.>", "$SRV.STATS", "$SRV.STATS.mesh-controller", "$SRV.STATS.mesh-controller.>", "_DELIVER.controller", "_DELIVER.controller.>", "_INBOX.controller.>", "mesh.control.>", "mesh.mod.*.event.provisioner.failing", "mesh.mod.*.event.provisioner.recovered", "mesh.mod.*.event.provisioner.retirement", "mesh.mod.gitea.event.pull.merged", "mesh.mod.gitea.event.pull.updated", "mesh.mod.mesh-catalog.event.catching-up", "mesh.mod.mesh-catalog.event.upgraded", "mesh.seat.mesh-build-machine.event.built", "mesh.seat.mesh-controller.tool.>", "mesh.seat.node-build-agent.event.built"] }
+        publish: { allow: ["$JS.ACK.CONTROL.controller.>", "$JS.ACK.DEAD_LETTER_NOTICES.controller.>", "$JS.ACK.EVENTS.controller.>", "$JS.API.>", "$KV.SEAT_MESH_BUILD_MACHINE_cancelled.>", "$KV.SEAT_NODE_BUILD_AGENT_cancelled.>", "$KV.mesh-controller_asked.>", "$KV.mesh-controller_calls.>", "$KV.mesh-controller_condition-history.>", "$KV.mesh-controller_conditions.>", "$KV.mesh-controller_hand-acts.>", "$KV.mesh-controller_lease.>", "$SRV.INFO", "_INBOX.enrol.>", "mesh.again.>", "mesh.assignment.>", "mesh.events.dead.>", "mesh.mod.*.tool.>", "mesh.node.>", "mesh.seat.mesh-build-machine.accept.>", "mesh.seat.mesh-build-machine.tool.>", "mesh.seat.mesh-controller.event.applied", "mesh.seat.mesh-controller.event.built-before", "mesh.seat.mesh-controller.event.checked", "mesh.seat.mesh-controller.event.condition-changed", "mesh.seat.mesh-controller.event.condition-cleared", "mesh.seat.mesh-controller.event.condition-raised", "mesh.seat.mesh-controller.event.doctor-heartbeat", "mesh.seat.mesh-controller.event.healer-acted", "mesh.seat.mesh-controller.event.plan-moved", "mesh.seat.mesh-controller.event.refused", "mesh.seat.mesh-controller.event.rolled-back", "mesh.seat.mesh-controller.event.secret-replaced", "mesh.seat.mesh-controller.tool.plans", "mesh.seat.mesh-delivery.tool.close", "mesh.seat.mesh-delivery.tool.release", "mesh.seat.mesh-delivery.tool.stalled", "mesh.seat.mesh-delivery.tool.stop", "mesh.seat.node-backup.tool.backed-up.*", "mesh.seat.node-backup.tool.now.*", "mesh.seat.node-build-agent.accept.>", "mesh.seat.node-build-agent.tool.>", "mesh.seat.node-intrusion-prevention.tool.banned.*", "mesh.seat.node-launcher.tool.secret.*", "mesh.seat.node-service-manager.tool.restart.*"] }
+        subscribe: { allow: ["$JS.API.>", "$JS.EVENT.ADVISORY.CONSUMER.DELETED.>", "$JS.EVENT.ADVISORY.CONSUMER.MAX_DELIVERIES.>", "$SRV.INFO", "$SRV.INFO.mesh-controller", "$SRV.INFO.mesh-controller.>", "$SRV.PING", "$SRV.PING.mesh-controller", "$SRV.PING.mesh-controller.>", "$SRV.STATS", "$SRV.STATS.mesh-controller", "$SRV.STATS.mesh-controller.>", "_DELIVER.controller", "_DELIVER.controller.>", "_INBOX.controller.>", "mesh.control.>", "mesh.mod.*.event.provisioner.failing", "mesh.mod.*.event.provisioner.recovered", "mesh.mod.*.event.provisioner.retirement", "mesh.mod.gitea.event.pull.merged", "mesh.mod.gitea.event.pull.updated", "mesh.mod.mesh-catalog.event.catching-up", "mesh.mod.mesh-catalog.event.upgraded", "mesh.seat.mesh-build-machine.event.built", "mesh.seat.mesh-controller.tool.>", "mesh.seat.node-build-agent.event.built", "mesh.seat.operator-channel.event.decided.mesh-controller"] }
         allow_responses: { max: 1, ttl: "1m" }
       } }
       { user: "enrol.one", password: "$2a$11$eeeeeeeeeeeeeeeeeeeeee", permissions: {
@@ -34,7 +34,8 @@ accounts {
       } }
       { user: "node.one", password: "$2a$11$nnnnnnnnnnnnnnnnnnnnnn", permissions: {
         publish: { allow: ["$JS.ACK.NODES.one.>", "$JS.API.CONSUMER.INFO.NODES.one", "$SRV.PING.node-tools.one", "mesh.control.one.>"] }
-        subscribe: { allow: ["_DELIVER.one", "_DELIVER.one.>", "_INBOX.node.one.>", "mesh.node.one.ask.report", "mesh.node.one.declare"] }
+        subscribe: { allow: ["_DELIVER.one", "_DELIVER.one.>", "_INBOX.node.one.>", "mesh.node.one.ask.hand-over", "mesh.node.one.ask.report", "mesh.node.one.declare"] }
+        allow_responses: { max: 1, ttl: "1m" }
       } }
       { user: "one.nats", password: "$2a$11$bbbbbbbbbbbbbbbbbbbbbb", permissions: {
         publish: { allow: ["$JS.API.STREAM.INFO.*", "$JS.API.STREAM.NAMES", "$JS.API.STREAM.SNAPSHOT.*", "$JS.SNAPSHOT.ACK.>"] }

internal/broker/users.go

@@ -50,6 +50,9 @@ type Declared struct {
 	// Checks are the module's own tools its health asks, each `<module>.<tool>` (novox/hq ADR 0240, to-be
 	// 48 §3): the machine's node-engine asks them of its own node tools, and is granted that and no more.
 	Checks []string
+	// RunsAs is the account the module runs as in a runtime of its own (novox/hq ADR 0259 §8): it is never
+	// carried by the machine's runtime, and reaches the bus on its own account.
+	RunsAs string
 }
 
 // Records is what composing a user list needs to know about the mesh, and nothing more.
@@ -67,6 +70,10 @@ type Records struct {
 	// Interchangeable is each module whose definition says its instances are the same anywhere
 	// (ADR 0160), which decides whether the module's plain subject is issued to every instance.
 	Interchangeable map[string]bool
+	// RootFree is each machine judged root-free when this was composed (novox/hq ADR 0259 §8): it names an
+	// account agents run as, judged unable to become root by its node-engine, and serves no login shell
+	// execute. A machine absent is not free: no record of a pass is no pass.
+	RootFree map[string]bool
 }
 
 // Users is every user the composed file should contain, in the order it will be written.
@@ -75,7 +82,7 @@ type Records struct {
 // is a mesh that cannot be told anything, and there is no state of the records in which that is
 // correct.
 func Users(r Records) ([]Principal, error) {
-	out := []Principal{{Kind: KindController}}
+	out := []Principal{{Kind: KindController, Uses: asksSeatOf(r)}}
 
 	for _, node := range sortedCopy(r.Nodes) {
 		witness := false
@@ -120,10 +127,13 @@ func Users(r Records) ([]Principal, error) {
 			})
 		}
 		if runtimeHere {
-			out = append(out, Principal{
-				Kind: KindNodeTools, Node: node, Module: RuntimeModule,
-				Carries: append([]Declared(nil), r.Assigned[node]...),
-			})
+			var carried []Declared
+			for _, d := range r.Assigned[node] {
+				if d.RunsAs == "" {
+					carried = append(carried, d)
+				}
+			}
+			out = append(out, Principal{Kind: KindNodeTools, Node: node, Module: RuntimeModule, Carries: carried})
 		}
 	}
 	for _, node := range sortedCopy(r.Enrolling) {
@@ -189,3 +199,21 @@ func sortedNames(in map[string][]string) []string {
 
 // controllerModule is the controller's module: the machine assigned it witnesses its upgrades.
 const controllerModule = "mesh-controller"
+
+// asksSeatOf is the seat an ask is made on, as its holder declares it (novox/hq ADR 0259): the controller
+// asks the operator through it like any other user, and is granted what its declaration names for a caller.
+// None while nothing holds it.
+func asksSeatOf(r Records) []Seat {
+	for _, node := range sortedCopy(r.Nodes) {
+		for _, d := range r.Assigned[node] {
+			for _, s := range d.Holds {
+				if s.Name == AsksSeat && namesVerb(s.ByCaller, "ask") {
+					seat := s
+					seat.Kind, seat.Capabilities = "", nil
+					return []Seat{seat}
+				}
+			}
+		}
+	}
+	return nil
+}

internal/broker/writers.go

@@ -84,6 +84,13 @@ func kvOf(bucket string) []string { return []string{"$KV." + bucket + ".>"} }
 var WritersTable = []WriterRow{
 	{State: "a machine's declaration", Writer: "controller (lease holder)", KeptIn: "the bus, last per subject",
 		Others: "read", Subjects: []string{"mesh.node.*.declare"}, Writes: isController},
+	// The operator's hand-over of a directory used as found, asked of the machine's engine at the controller's
+	// terminal (novox/hq issue 356). One publisher; and because a responder can still reach the subject through a
+	// reply, the ask is signed with the mesh's key and the engine verifies it — the row bounds who is granted the
+	// publish, the signature who is believed.
+	{State: "a hand-over asked of a machine", Writer: "controller, at its terminal", KeptIn: "the machine, beside its state",
+		Others:   "the engine verifies the mesh's signature and records it, or refuses",
+		Subjects: []string{"mesh.node.*.ask.hand-over"}, Writes: isController},
 	{State: "a machine's applied state and its report", Writer: "the node-engine's apply queue",
 		KeptIn: "the machine; the report on the bus", Others: "the reconcile and a delivery enqueue, never apply",
 		// And its health statement between reports (novox/hq ADR 0240): the same writer stating the same

internal/broker/writers_test.go

@@ -15,6 +15,7 @@ import (
 // to the table; one dropped from either fails.
 var designRows = []string{
 	"a machine's declaration",
+	"a hand-over asked of a machine",
 	"a machine's applied state and its report",
 	"the controller lease",
 	"plans and their tiers",
@@ -150,3 +151,22 @@ func TestSubjectsOverlap(t *testing.T) {
 		}
 	}
 }
+
+// **A hand-over asked of a machine has one publisher, the controller** (novox/hq issue 356): a grant that lets any
+// other principal publish it — a node, the node tools, a module — is refused at composition, naming the state.
+// (Who the engine believes is the signature's; this bounds who is granted the publish.)
+func TestAHandOverAskHasOnePublisher(t *testing.T) {
+	for _, p := range []Principal{
+		{Kind: KindNode, Node: "laptop"},
+		{Kind: KindNodeTools, Node: "laptop", Module: RuntimeModule},
+		{Kind: KindModule, Node: "laptop", Module: "notes"},
+	} {
+		err := CheckWriters(p, []string{"mesh.node.laptop.ask.hand-over"})
+		if err == nil || !strings.Contains(err.Error(), "a hand-over asked of a machine") {
+			t.Errorf("%s may publish a hand-over: %v", p.Username(), err)
+		}
+	}
+	if err := CheckWriters(Principal{Kind: KindController}, []string{"mesh.node.>"}); err != nil {
+		t.Fatalf("the controller may not ask a hand-over: %v", err)
+	}
+}

internal/catalogue/build.go

@@ -173,11 +173,7 @@ func (m Manifest) Resolve(built []Built) (Manifest, error) {
 			// had — so re-composing a declaration moves nothing, where a commit would move the
 			// path of an identical binary and recreate everything that reads it.
 			for key, value := range filled {
-				text, isText := value.(string)
-				if !isText || !strings.Contains(text, versionRef) {
-					continue
-				}
-				filled[key] = strings.ReplaceAll(text, versionRef, versionOf(artifact.Digest))
+				filled[key] = withVersion(value, versionOf(artifact.Digest))
 			}
 		default:
 			return Manifest{}, fmt.Errorf("%s: %q is a %q, and an artifact is %q, %q, %q or %q",
@@ -189,6 +185,31 @@ func (m Manifest) Resolve(built []Built) (Manifest, error) {
 	return out, nil
 }
 
+// withVersion is a resource's value with `${version}` filled: in a string, and in each string of a map —
+// a process's env, where the controller is told which build it is (novox/hq issue 352). Anything else is
+// left as it is.
+func withVersion(value any, version string) any {
+	switch v := value.(type) {
+	case string:
+		if strings.Contains(v, versionRef) {
+			return strings.ReplaceAll(v, versionRef, version)
+		}
+	case map[string]any:
+		out := make(map[string]any, len(v))
+		for k, x := range v {
+			out[k] = withVersion(x, version)
+		}
+		return out
+	case map[string]string:
+		out := make(map[string]string, len(v))
+		for k, x := range v {
+			out[k] = strings.ReplaceAll(x, versionRef, version)
+		}
+		return out
+	}
+	return value
+}
+
 // checkBuild is the manifest's own account of what it builds.
 func (b *Build) problems(module string) []string {
 	if b == nil {

internal/catalogue/declaration.go

@@ -1101,9 +1101,23 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 		}
 		owner[fmt.Sprint(process["id"])] = RuntimeModule
 		out = append(out, process)
-		// What each module's bundles are given is read as the account the runtime runs as.
+		// And a runtime of its own for each module of its own account, after it (novox/hq ADR 0259 §8).
+		owns, err := r.ownRuntimes(with)
+		if err != nil {
+			return nil, err
+		}
+		for _, p := range owns {
+			id := fmt.Sprint(p["id"])
+			owner[id] = strings.TrimSuffix(id, "."+OwnRuntimeID())
+			out = append(out, p)
+		}
+		// What each module's bundles are given is read as the account the runtime runs as — not what a
+		// module of its own account is given, which its own account reads.
 		words := map[string]map[string]string{}
 		for _, m := range r.Modules {
+			if m.RunsAs != "" {
+				continue
+			}
 			w, err := bundleWords(m, with)
 			if err != nil {
 				return nil, err

internal/catalogue/graphical_session.go

@@ -78,6 +78,22 @@ func graphicalSessionSeats() []Seat {
 							"description": "the lines to choose between, in order"},
 						"prompt": map[string]any{"type": "string", "description": "what the menu asks (optional)"},
 					}}},
+			// A value the operator types and nobody sees (novox/hq ADR 0259 §10): a hidden prompt whose answer
+			// is sealed to the asker's key, so it is never plaintext on the bus or in any call's record.
+			// **Optional while its holders catch up** (ADR 0246): rofi serves it once this is live.
+			{Name: "secret", Optional: true, Description: "Ask the operator for a value in a prompt that " +
+				"does not show what is typed, and answer it sealed to the key the asker gives — never in " +
+				"the clear — or cancelled when the prompt was dismissed or not answered in time.",
+				// By name, never by words (the review of 2026-10-09, M4): the holder writes the prompt from the
+				// module, the secret and the machine, and says the controller asks — the bus lets nobody else
+				// ask it (broker.ControllerOnly) — so no caller puts words of its own before the operator.
+				Input: schema(map[string]string{
+					"module":          "the module whose own secret is asked for",
+					"secret":          "the own secret's name",
+					"node":            "the machine the module runs on",
+					"seal_to":         "the asker's public sealing key: the answer is sealed to it",
+					"timeout_seconds": "give up after this long (optional)",
+				}, []string{"module", "secret", "node", "seal_to"})},
 		}},
 		{Name: NotifierSeat, Scope: ScopeNode, Decision: decided, Serves: []Verb{
 			{Name: "send", Description: "Show the operator a notification.",

internal/catalogue/graphical_session_test.go

@@ -16,7 +16,7 @@ func TestTheGraphicalSessionsSeatsAreTheMeshsOwnWithTheirVerbs(t *testing.T) {
 		DisplayServerSeat:    {"displays", "layout"},
 		DisplaySessionSeat:   {"reload", "workspaces", "windows"},
 		TerminalEmulatorSeat: {"open"},
-		LauncherSeat:         {"menu"},
+		LauncherSeat:         {"menu", "secret"},
 		NotifierSeat:         {"send", "history"},
 		LockScreenSeat:       {"lock"},
 		ClipboardSeat:        {"history", "copy"},

internal/catalogue/kinded_test.go

@@ -0,0 +1,168 @@
+package catalogue
+
+import (
+	"strings"
+	"testing"
+)
+
+// The router of novox/hq ADR 0259: it declares the operator's seat and the two kinded benches.
+func router() Manifest {
+	return Manifest{Module: "messenger", Tools: []string{"open", "history", "notify"},
+		State: []StateDeclaration{{Name: "asks"}}, RunsAs: "messenger", SecretsOwner: "messenger",
+		DefinesSeats: []SeatDeclaration{
+			{Name: "operator-channel", Scope: ScopeMesh, Accepts: []string{"ask", "cancel"}, Emits: []string{"decided"},
+				ByCaller: []string{"ask", "cancel", "decided"}, Records: []string{"asks"},
+				Serves: []Verb{{Name: "open"}, {Name: "history"}, {Name: "notify"}}},
+			{Name: "channel", Scope: ScopeMesh, Kinded: true, Accepts: []string{"show", "edit", "send"}},
+			{Name: "intake", Scope: ScopeMesh, Kinded: true, Emits: []string{"choice", "link"}, Proofs: []string{"code"}},
+		},
+		Claims: []Claim{{Name: "operator-channel", Scope: ScopeMesh}},
+		Uses:   []string{"channel"}}
+}
+
+func aChannel(module, kind string) Manifest {
+	return Manifest{Module: module, Claims: []Claim{
+		{Name: "channel", Scope: ScopeMesh, Kind: kind}, {Name: "intake", Scope: ScopeMesh, Kind: kind}}}
+}
+
+func TestTwoChannelsOfDifferentKindsHoldTheBenches(t *testing.T) {
+	shelf := Shelf{"messenger": router(), "telegram": aChannel("telegram", "telegram"),
+		"desk-channel": aChannel("desk-channel", "desktop")}
+	if got := problemsFor(t, shelf); got != "" {
+		t.Fatalf("two kinds were refused: %s", got)
+	}
+	for _, m := range shelf {
+		if got := declaredSeatProblems(m); len(got) > 0 {
+			t.Fatalf("%s: %v", m.Module, got)
+		}
+	}
+}
+
+func TestASecondClaimOfOneKindIsRefused(t *testing.T) {
+	got := problemsFor(t, Shelf{"messenger": router(), "telegram": aChannel("telegram", "telegram"),
+		"telegram-two": aChannel("telegram-two", "telegram")})
+	if !strings.Contains(got, `of kind "telegram", which telegram already claims`) {
+		t.Fatalf("a second holder of one kind stood: %s", got)
+	}
+}
+
+func TestAKindedBenchNeedsAKindAndNoOtherSeatTakesOne(t *testing.T) {
+	got := problemsFor(t, Shelf{"messenger": router(), "nameless": aChannel("nameless", "")})
+	if !strings.Contains(got, "claims the kinded bench channel and names no kind") {
+		t.Fatalf("a claim without a kind stood: %s", got)
+	}
+	odd := Manifest{Module: "odd", Claims: []Claim{{Name: "operator-channel", Scope: ScopeMesh, Kind: "telegram"}}}
+	got = problemsFor(t, Shelf{"messenger": router(), "odd": odd})
+	if !strings.Contains(got, "only a kinded bench takes a kind") {
+		t.Fatalf("a kind on a seat that is not kinded stood: %s", got)
+	}
+	dotted := problemsFor(t, Shelf{"messenger": router(), "dotted": aChannel("dotted", "a.b")})
+	if !strings.Contains(dotted, "not a usable name") {
+		t.Fatalf("a kind that would widen a subject stood: %s", dotted)
+	}
+}
+
+func TestOnlyChannelAndIntakeAreKinded(t *testing.T) {
+	m := Manifest{Module: "x", DefinesSeats: []SeatDeclaration{{Name: "pager", Kinded: true, Accepts: []string{"page"}}}}
+	if got := strings.Join(declaredSeatProblems(m), "; "); !strings.Contains(got, "only channel and intake are kinded") {
+		t.Fatalf("another kinded bench was declared: %s", got)
+	}
+}
+
+func TestTheNewRulesAreHeldToWhatTheSeatSays(t *testing.T) {
+	m := Manifest{Module: "x", DefinesSeats: []SeatDeclaration{{Name: "thing", Accepts: []string{"do"},
+		ByCaller: []string{"undo"}, Proofs: []string{"code"}, Records: []string{"nothing"}}}}
+	got := strings.Join(declaredSeatProblems(m), "; ")
+	for _, want := range []string{"names thing.undo by its caller, which the seat neither accepts nor emits",
+		"declares proofs on thing, which is not kinded", `read its records "nothing", which it keeps no state of`} {
+		if !strings.Contains(got, want) {
+			t.Errorf("not refused: %q in %s", want, got)
+		}
+	}
+}
+
+// Two kinds on one machine are two holders, and one kind on two machines is a second claimant.
+func TestEachKindIsItsOwnHolderWhenResolved(t *testing.T) {
+	modules := []Manifest{aChannel("telegram", "telegram"), aChannel("desk-channel", "desktop")}
+	held, problems := checkClaims(modules, Node{Name: "anchor"}, nil, nil)
+	if len(problems) > 0 || len(held) != 4 {
+		t.Fatalf("two kinds on one machine: held %v, problems %v", held, problems)
+	}
+	_, problems = checkClaims([]Manifest{aChannel("telegram", "telegram")}, Node{Name: "home"}, held, nil)
+	if len(problems) == 0 {
+		t.Fatal("one kind held on two machines was not refused")
+	}
+}
+
+// A channel's capabilities come from the fixed vocabulary, and only a kinded claim carries any.
+func TestCapabilitiesAreTheVocabularysAndOnlyOnAKindedClaim(t *testing.T) {
+	good := aChannel("telegram", "telegram")
+	good.Claims[0].Capabilities = []string{"deliver", "choice", "verified-sender", "max-length:4096"}
+	good.RunsAs = "telegram"
+	if got := problemsFor(t, Shelf{"messenger": router(), "telegram": good}); got != "" {
+		t.Fatalf("the vocabulary was refused: %s", got)
+	}
+	bad := aChannel("telegram", "telegram")
+	bad.Claims[0].Capabilities = []string{"trusted", "max-length:lots"}
+	got := problemsFor(t, Shelf{"messenger": router(), "telegram": bad})
+	for _, w := range []string{`"trusted"`, `"max-length:lots"`} {
+		if !strings.Contains(got, w+", which channel-capabilities/1 does not have") {
+			t.Errorf("%s was not refused: %s", w, got)
+		}
+	}
+	odd := Manifest{Module: "odd", Claims: []Claim{{Name: "operator-channel", Scope: ScopeMesh, Capabilities: []string{"deliver"}}}}
+	if got := problemsFor(t, Shelf{"messenger": router(), "odd": odd}); !strings.Contains(got, "only a kinded bench's claim carries them") {
+		t.Errorf("capabilities on a seat that is not kinded stood: %s", got)
+	}
+}
+
+// novox/hq ADR 0259 §8: a module saying warrants, or speaking for a kind that proves its sender, runs as an
+// account of its own — never carried by the machine's runtime, which runs as the operator's account.
+func TestATrustedHolderMustRunAsAnAccountOfItsOwn(t *testing.T) {
+	r := router()
+	r.RunsAs = ""
+	if got := problemsFor(t, Shelf{"messenger": r}); !strings.Contains(got, "messenger must run as an account of its own") {
+		t.Errorf("a router on the machine's runtime stood: %s", got)
+	}
+	tg := aChannel("telegram", "telegram")
+	tg.Claims[0].Capabilities = []string{"choice", "verified-sender"}
+	if got := problemsFor(t, Shelf{"messenger": router(), "telegram": tg}); !strings.Contains(got, "telegram must run as an account of its own") {
+		t.Errorf("a verified channel on the machine's runtime stood: %s", got)
+	}
+	desk := aChannel("desk-channel", "desktop")
+	desk.Claims[0].Capabilities = []string{"choice"}
+	if got := problemsFor(t, Shelf{"messenger": router(), "desk-channel": desk}); got != "" {
+		t.Errorf("a channel proving nothing was held to it: %s", got)
+	}
+	// A kind that is `private` shows a link's code, which links an account as the operator: its holder is
+	// trusted with it, so it runs as its own account too (the confirmation review of 2026-10-09).
+	private := aChannel("desk-channel", "desktop")
+	private.Claims[0].Capabilities = []string{"choice", "private"}
+	if got := problemsFor(t, Shelf{"messenger": router(), "desk-channel": private}); !strings.Contains(got, "desk-channel must run as an account of its own") {
+		t.Errorf("a private channel on the machine's runtime stood: %s", got)
+	}
+}
+
+func TestRunsAsIsAnAccountOfTheModulesOwn(t *testing.T) {
+	ok := Manifest{Module: "telegram", RunsAs: "telegram", SecretsOwner: "telegram",
+		OwnSecrets: OwnSecrets{"broker": {Path: "/var/lib/telegram/broker"}},
+		Resources:  []map[string]any{{"id": "account", "type": "user", "name": "telegram"}}}
+	if got := RunsAsProblems(ok); len(got) != 0 {
+		t.Fatalf("a sound runs-as was refused: %v", got)
+	}
+	for want, change := range map[string]func(*Manifest){
+		"never root":                 func(m *Manifest) { m.RunsAs, m.SecretsOwner = "root", "root" },
+		"not an account name":        func(m *Manifest) { m.RunsAs = "${machine:account}" },
+		"which it does not make":     func(m *Manifest) { m.Resources = nil },
+		"declares no own secret":     func(m *Manifest) { m.OwnSecrets = nil },
+		"they are the account's own": func(m *Manifest) { m.SecretsOwner = "" },
+	} {
+		m := ok
+		m.Resources = append([]map[string]any(nil), ok.Resources...)
+		m.OwnSecrets = OwnSecrets{"broker": {Path: "/x"}}
+		change(&m)
+		if got := strings.Join(RunsAsProblems(m), "; "); !strings.Contains(got, want) {
+			t.Errorf("want %q, got %q", want, got)
+		}
+	}
+}

internal/catalogue/manifest.go

@@ -64,6 +64,13 @@ type Claim struct {
 	// text/template over one piece — its fields and `module` — in the tool's own grammar (novox/hq ADR
 	// 0255). The data is the mesh's, the format the holder's, as a module's facts template is.
 	Renders map[string]string `json:"renders,omitempty"`
+	// Kind is the kind this module holds a kinded bench as (novox/hq ADR 0234 §2, ADR 0259): `telegram`,
+	// `desktop`. Refused on any other seat, and a second claim of one kind is refused.
+	Kind string `json:"kind,omitempty"`
+	// Capabilities are what a channel of this kind promises, from the fixed vocabulary
+	// channel-capabilities/1 (novox/hq ADR 0234 §2): the router judges an answer by these, read from the
+	// controller's record of this claim and never from the channel.
+	Capabilities []string `json:"capabilities,omitempty"`
 }
 
 // ServesFor is what this claim offers a seat's protocol: the verbs it names, else the module's
@@ -640,6 +647,13 @@ type Manifest struct {
 	// cannot use.
 	SecretsOwner string `json:"secrets-owner,omitempty"`
 
+	// RunsAs is the account this module's tools bundle runs as, in a runtime of its own on a bus account of
+	// its own (novox/hq ADR 0259 §8): never the machine's runtime, which runs as the operator's account and
+	// carries every module on the machine. The account is one the module makes (a `user` resource of that
+	// name), owns its secrets (`secrets-owner`), and is neither root nor the operator's. Required of a module
+	// that says a warrant, or speaks for a channel kind that proves its sender.
+	RunsAs string `json:"runs-as,omitempty"`
+
 	// Keeps is where this module wants every operator-sealed secret in the mesh written — the
 	// vault's field, and so far nobody else's (novox/hq ADR 0085, amended).
 	//
@@ -1620,6 +1634,7 @@ func ParseManifest(raw []byte) (Manifest, error) {
 	// prefix. Whether a seat anybody names exists, and whether a holder answers for it, are
 	// facts about the catalogue and are checked at registration (CatalogueProblems).
 	problems = append(problems, declaredSeatProblems(m)...)
+	problems = append(problems, RunsAsProblems(m)...)
 	if m.Computed != "" && len(m.Resources) > 0 {
 		// One or the other. A module that both ships files and has them computed would leave
 		// nobody able to say where a given file came from.

internal/catalogue/resolve.go

@@ -120,6 +120,16 @@ type Held struct {
 	Node   string
 	Module string
 	Site   string
+	// Kind is the kind a kinded bench is held as (novox/hq ADR 0234 §2): each kind is its own holder.
+	Kind string
+}
+
+// heldKey is what one holder holds: the seat, and its kind on a kinded bench.
+func heldKey(claim, kind string) string {
+	if kind == "" {
+		return canonicalSeat(claim)
+	}
+	return canonicalSeat(claim) + "/" + kind
 }
 
 // Resolution is what a node should run, and why.
@@ -874,7 +884,7 @@ func checkClaims(modules []Manifest, node Node, elsewhere []Held, holdings []Hel
 			// **One seat under either of its names** (novox/hq ADR 0122): a manifest registered before
 			// a rename claims the former name, and one written after it the current — two claimants of
 			// one seat, compared by the seat they resolve to and not by how each spelled it.
-			seat := canonicalSeat(c.Name)
+			seat := heldKey(c.Name, c.Kind)
 			if other, taken := byScope[scope][seat]; taken {
 				problems = append(problems, fmt.Sprintf(
 					"%s and %s both claim %q, and only one thing may hold it per %s",
@@ -883,14 +893,14 @@ func checkClaims(modules []Manifest, node Node, elsewhere []Held, holdings []Hel
 			}
 			byScope[scope][seat] = m.Module
 			held = append(held, Held{Claim: c.Name, Scope: scope, Node: node.Name,
-				Module: m.Module, Site: node.Site})
+				Module: m.Module, Site: node.Site, Kind: c.Kind})
 		}
 	}
 
 	// And against the rest of the mesh, for the scopes that reach past this machine.
 	for _, h := range held {
 		for _, e := range elsewhere {
-			if e.Node == node.Name || canonicalSeat(e.Claim) != canonicalSeat(h.Claim) || e.Scope != h.Scope {
+			if e.Node == node.Name || heldKey(e.Claim, e.Kind) != heldKey(h.Claim, h.Kind) || e.Scope != h.Scope {
 				continue
 			}
 			switch h.Scope {

internal/catalogue/resolver_manifests_test.go

@@ -51,7 +51,8 @@ func TestTheResolverForwardsToFixedUpstreamsAndNeverReadsResolvConf(t *testing.T
 		"\nno-resolv\n", "\nserver=1.1.1.1\n", "\nserver=8.8.8.8\n",
 		// The private address and loopback, never a LAN's (novox/hq ADR 0194): a device that is not a
 		// member cannot reach what the mesh's names point at.
-		"\nlisten-address=127.0.0.1\n", "\nlisten-address=${machine:address}\n", "\nbind-dynamic\n",
+		"\nlisten-address=127.0.0.1\n", "\nlisten-address=${machine:address}\n",
+
 		// No hosts file and no operator's files: the mesh's resolver answers every node (ADR 0199).
 		"\nno-hosts\n",
 		"\nconf-file=" + m.Facts["zones"].Path + "\n",
@@ -62,6 +63,14 @@ func TestTheResolverForwardsToFixedUpstreamsAndNeverReadsResolvConf(t *testing.T
 			t.Errorf("the resolver's configuration lacks %q:\n%s", strings.TrimSpace(want), config)
 		}
 	}
+	// Bound to its addresses, one way or the other. mesh-catalog PR 161 (novox/hq issue 348) moves it from
+	// bind-dynamic, which closed the private address's listener when a bridge teardown failed its re-read
+	// of the machine's addresses, to bind-interfaces. This test reads the catalogue beside it, which may be
+	// on either side of that merge, so it takes both; once the catalogue's main has it, bind-dynamic is
+	// refused here.
+	if !strings.Contains(config, "\nbind-interfaces\n") && !strings.Contains(config, "\nbind-dynamic\n") {
+		t.Errorf("the resolver's configuration binds neither by bind-interfaces nor by bind-dynamic:\n%s", config)
+	}
 	// By address and never by interface: dnsmasq admits a query by the interface it arrives on
 	// when told one, and a container's query to the private address arrives on the runtime's
 	// bridge — `interface=mesh0` dropped every such query, silently (novox/hq issue 110).

internal/catalogue/runtime.go

@@ -170,6 +170,10 @@ func (r Resolution) runtimeProcess(with Rendering) (map[string]any, error) {
 		if with.Adopted && m.Filtering != nil {
 			continue
 		}
+		if m.RunsAs != "" {
+			// Served by a runtime of its own, on its own account (ownRuntimes): never the machine's.
+			continue
+		}
 		words, err := bundleWords(m, with)
 		if err != nil {
 			return nil, err
@@ -232,6 +236,94 @@ func (r Resolution) runtimeProcess(with Rendering) (map[string]any, error) {
 	return process, nil
 }
 
+// OwnRuntimeID names the process a module of its own account is served by (novox/hq ADR 0259 §8).
+func OwnRuntimeID() string { return "own-runtime" }
+
+// ownRuntimes are the processes the modules of their own account are served by (novox/hq ADR 0259 §8): each
+// the machine's runtime program — the same build, run from the same source — serving that one module alone,
+// as the module's own account, on the module's own bus credential. Never the machine's runtime, which runs
+// as the operator's account and carries every module on the machine.
+func (r Resolution) ownRuntimes(with Rendering) ([]map[string]any, error) {
+	var own []Manifest
+	for _, m := range r.Modules {
+		if m.RunsAs != "" && !(with.Adopted && m.Filtering != nil) {
+			own = append(own, m)
+		}
+	}
+	if len(own) == 0 {
+		return nil, nil
+	}
+	var runtime *Manifest
+	for i := range r.Modules {
+		if r.Modules[i].Module == RuntimeModule {
+			runtime = &r.Modules[i]
+		}
+	}
+	if runtime == nil || len(runtime.Bundles) != 1 || runtime.Bundles[0].Binary == "" {
+		return nil, fmt.Errorf("%s runs as its own account in a runtime of its own, and %s is not here to run it "+
+			"from: assign %s to %s first (novox/hq ADR 0259)", own[0].Module, RuntimeModule, RuntimeModule, r.Node)
+	}
+	program := runtime.Bundles[0]
+	var out []map[string]any
+	for _, m := range own {
+		// Never the node's operator account, nor the account agents run as there (the review of 2026-10-09):
+		// either would hand what it holds back to the very accounts it is kept from.
+		switch {
+		case r.Account != "" && m.RunsAs == r.Account:
+			return nil, fmt.Errorf("%s runs as %s, the operator's account on %s: a module of its own account never "+
+				"runs as it (novox/hq ADR 0259 §8)", m.Module, m.RunsAs, r.Node)
+		case r.AgentAccount != "" && m.RunsAs == r.AgentAccount:
+			return nil, fmt.Errorf("%s runs as %s, the account agents run as on %s: a module of its own account "+
+				"never runs as it (novox/hq ADR 0259 §8)", m.Module, m.RunsAs, r.Node)
+		}
+		credential, declared := m.OwnSecrets["broker"]
+		if !declared {
+			return nil, fmt.Errorf("%s runs as its own account and declares no own secret broker", m.Module)
+		}
+		var served, restartOn []string
+		for _, b := range m.Bundles {
+			for _, load := range b.Loads {
+				if launcher, has := b.Launchers[load]; has {
+					load = launcher
+				}
+				served = append(served, m.Module+"="+BundlePath(m.Module, b.Name)+"/"+load)
+			}
+			if len(b.Loads) > 0 {
+				restartOn = append(restartOn, m.Module+"."+BundleID(b.Name))
+			}
+		}
+		if len(served) == 0 {
+			return nil, fmt.Errorf("%s runs as its own account and its build produced no bundle to serve", m.Module)
+		}
+		sort.Strings(served)
+		restartOn = append(restartOn, m.Module+"."+NeedID("broker"))
+		sort.Strings(restartOn)
+		env := map[string]string{RuntimeToolModules: strings.Join(served, ","), RuntimeBrokerFile: credential.Path}
+		words, err := bundleWords(m, with)
+		if err != nil {
+			return nil, err
+		}
+		if len(words) > 0 {
+			body, err := json.Marshal(map[string]map[string]string{m.Module: words})
+			if err != nil {
+				return nil, err
+			}
+			env[RuntimeToolEnv] = string(body)
+		}
+		process := map[string]any{
+			"id": m.Module + "." + OwnRuntimeID(), "type": "process", "name": m.Module + "-runtime",
+			"source": program.Source, "digest": program.Digest,
+			"run": []any{"./" + program.Binary}, "env": env, "restart-on": toAny(restartOn),
+			"user": m.RunsAs,
+		}
+		if err := artifactsInto(process, RuntimeModule, with); err != nil {
+			return nil, err
+		}
+		out = append(out, process)
+	}
+	return out, nil
+}
+
 func toAny(in []string) []any {
 	out := make([]any, 0, len(in))
 	for _, s := range in {

internal/catalogue/runtime_test.go

@@ -457,3 +457,75 @@ func TestAGoToolsBundleIsServedByItsBinary(t *testing.T) {
 		t.Error("a Go bundle loading a file it does not contain was admitted")
 	}
 }
+
+// novox/hq ADR 0259 §8: a module of its own account is served by a runtime of its own — the machine's
+// runtime program, as that account, on that module's own credential — and never by the machine's runtime,
+// which runs as the operator's account and is given none of its words.
+func TestAModuleOfItsOwnAccountIsServedByARuntimeOfItsOwn(t *testing.T) {
+	with := Rendering{ArtifactStore: "anchor.internal:5101",
+		Needed: map[string]map[string]string{RuntimeModule: {"broker": "sealed-credential"}, "telegram": {"broker": "own"}}}
+	goRuntime := Manifest{Module: RuntimeModule, Version: "1",
+		OwnSecrets: OwnSecrets{"broker": {Path: "/var/lib/mesh/" + RuntimeModule + "/broker"}},
+		Build: &Build{Artifacts: []Artifact{{Name: "runtime", Kind: ArtifactBundle, Language: "go",
+			System: "arch", From: "cmd/node-tools"}}}}
+	goRuntime, err := goRuntime.Resolve([]Built{{Name: "runtime", Kind: ArtifactBundle,
+		Reference: ArtifactStoreScheme + RuntimeModule + "/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	telegram := aToolsModule(t, "telegram", "tools/index.js")
+	telegram.RunsAs, telegram.SecretsOwner = "telegram", "telegram"
+	telegram.OwnSecrets = OwnSecrets{"broker": {Path: "/var/lib/telegram/broker"}}
+	out, err := Resolution{Node: "anchor", Account: "ops",
+		Modules: []Manifest{aToolsModule(t, "nftables", "tools/index.js"), telegram, goRuntime}}.Declaration(with)
+	if err != nil {
+		t.Fatal(err)
+	}
+	machine := fileNamed(out, RuntimeModule+"."+RuntimeProcessID())
+	if served := machine["env"].(map[string]string)[RuntimeToolModules]; strings.Contains(served, "telegram") || !strings.Contains(served, "nftables") {
+		t.Errorf("the machine's runtime serves %q", served)
+	}
+	own := fileNamed(out, "telegram."+OwnRuntimeID())
+	if own == nil {
+		t.Fatalf("telegram has no runtime of its own: %v", ids(out))
+	}
+	env := own["env"].(map[string]string)
+	if own["user"] != "telegram" || fmt.Sprint(own["run"]) != "[./node-tools]" ||
+		env[RuntimeBrokerFile] != "/var/lib/telegram/broker" ||
+		env[RuntimeToolModules] != "telegram="+BundleRoot+"/telegram/tools/tools/index.js" {
+		t.Errorf("its own runtime: user %v run %v env %v", own["user"], own["run"], env)
+	}
+	if _, told := env[RuntimeOperatorAccount]; told {
+		t.Error("a runtime of a module's own account is told the operator's account")
+	}
+	// Without the machine's runtime to run it from, it is refused in words.
+	if _, err := (Resolution{Node: "anchor", Modules: []Manifest{telegram}}).ownRuntimes(with); err == nil {
+		t.Error("a module of its own account composed without a runtime program")
+	}
+}
+
+// The review of 2026-10-09 (L4): a module of its own account never runs as the node's operator account, nor
+// as the account agents run as there — either would hand what it holds back to the accounts it is kept from.
+func TestAModuleOfItsOwnAccountIsRefusedTheOperatorsAndTheAgentsAccount(t *testing.T) {
+	with := Rendering{ArtifactStore: "anchor.internal:5101",
+		Needed: map[string]map[string]string{RuntimeModule: {"broker": "sealed-credential"}, "telegram": {"broker": "own"}}}
+	goRuntime := Manifest{Module: RuntimeModule, Version: "1",
+		OwnSecrets: OwnSecrets{"broker": {Path: "/var/lib/mesh/" + RuntimeModule + "/broker"}},
+		Build: &Build{Artifacts: []Artifact{{Name: "runtime", Kind: ArtifactBundle, Language: "go",
+			System: "arch", From: "cmd/node-tools"}}}}
+	goRuntime, err := goRuntime.Resolve([]Built{{Name: "runtime", Kind: ArtifactBundle,
+		Reference: ArtifactStoreScheme + RuntimeModule + "/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, account := range []string{"ops", "agent"} {
+		telegram := aToolsModule(t, "telegram", "tools/index.js")
+		telegram.RunsAs, telegram.SecretsOwner = account, account
+		telegram.OwnSecrets = OwnSecrets{"broker": {Path: "/var/lib/telegram/broker"}}
+		_, err := Resolution{Node: "anchor", Account: "ops", AgentAccount: "agent",
+			Modules: []Manifest{telegram, goRuntime}}.ownRuntimes(with)
+		if err == nil || !strings.Contains(err.Error(), account) {
+			t.Errorf("telegram running as %s was composed: %v", account, err)
+		}
+	}
+}

internal/catalogue/seats_declared.go

@@ -2,6 +2,7 @@ package catalogue
 
 import (
 	"fmt"
+	"regexp"
 	"sort"
 	"strings"
 )
@@ -51,6 +52,35 @@ type SeatDeclaration struct {
 	// owns its own, which is why a seat is also the answer for a module that needs retention
 	// its events cannot have.
 	RetainSeconds int `json:"retain-seconds,omitempty"`
+
+	// Kinded makes the seat a kinded bench (novox/hq ADR 0234 §2, ADR 0259 §3): its holders are different
+	// modules, each claiming one kind, and each verb's subject carries the kind. Only the benches in
+	// KindedBenches may be kinded; making another is a decision, recorded.
+	Kinded bool `json:"kinded,omitempty"`
+	// ByCaller are accepts and emits whose subject's last token names the calling module (ADR 0259 §3): a
+	// user submits such an accept, and hears such an event, under its own name and no other.
+	ByCaller []string `json:"by-caller,omitempty"`
+	// Proofs are verbs carried as core request and reply, never on a stream: what travels on them (a code
+	// the operator typed) is never kept (ADR 0259 §3). On a kinded bench a holder asks with its own kind and
+	// the modules watching the seat answer.
+	Proofs []string `json:"proofs,omitempty"`
+	// Records are state buckets of the declaring module that each user reads under its own name — the
+	// keys `<user>.…` and no other (ADR 0259 §3).
+	Records []string `json:"records,omitempty"`
+}
+
+// KindedBenches are the seats that may be kinded (novox/hq ADR 0234 §2): `channel` sends to the operator,
+// `intake` takes what the operator answers. Another is a decision, recorded, as ADR 0223 asks of a bench.
+var KindedBenches = map[string]bool{"channel": true, "intake": true}
+
+// NamedByCaller says whether one of the seat's verbs is named by its caller.
+func (s SeatDeclaration) NamedByCaller(verb string) bool {
+	for _, v := range s.ByCaller {
+		if v == verb {
+			return true
+		}
+	}
+	return false
 }
 
 // At is this declaration's scope, with the default applied. Mesh by default, because a seat
@@ -132,6 +162,7 @@ func declaredSeatProblems(m Manifest) []string {
 					"%s declares %s.%s, which is not a usable verb", m.Module, s.Name, v))
 			}
 		}
+		problems = append(problems, trafficProblems(m, s)...)
 	}
 
 	for _, u := range m.Uses {
@@ -142,6 +173,56 @@ func declaredSeatProblems(m Manifest) []string {
 	return problems
 }
 
+// trafficProblems is what one declaration of the rules of ADR 0259 §3 can be judged on alone.
+func trafficProblems(m Manifest, s SeatDeclaration) []string {
+	var problems []string
+	if s.Kinded && !KindedBenches[s.Name] {
+		problems = append(problems, fmt.Sprintf(
+			"%s declares %s as a kinded bench; only channel and intake are kinded, and another is a "+
+				"decision, recorded (novox/hq ADR 0234)", m.Module, s.Name))
+	}
+	if s.Kinded && len(s.ByCaller) > 0 {
+		problems = append(problems, fmt.Sprintf(
+			"%s declares %s kinded and names verbs by their caller; a kinded bench's subjects carry the kind",
+			m.Module, s.Name))
+	}
+	for _, v := range s.ByCaller {
+		inAccepts, inEmits := false, false
+		for _, a := range s.Accepts {
+			inAccepts = inAccepts || a == v
+		}
+		for _, e := range s.Emits {
+			inEmits = inEmits || e == v
+		}
+		if !inAccepts && !inEmits {
+			problems = append(problems, fmt.Sprintf(
+				"%s names %s.%s by its caller, which the seat neither accepts nor emits", m.Module, s.Name, v))
+		}
+	}
+	for _, v := range s.Proofs {
+		if !name.MatchString(v) || strings.Contains(v, ".") {
+			problems = append(problems, fmt.Sprintf("%s declares the proof %s.%s, which is not a usable verb",
+				m.Module, s.Name, v))
+		}
+	}
+	if len(s.Proofs) > 0 && !s.Kinded {
+		problems = append(problems, fmt.Sprintf(
+			"%s declares proofs on %s, which is not kinded; a proof is asked by a holder of a kind",
+			m.Module, s.Name))
+	}
+	for _, r := range s.Records {
+		kept := false
+		for _, st := range m.State {
+			kept = kept || st.Name == r
+		}
+		if !kept {
+			problems = append(problems, fmt.Sprintf(
+				"%s says %s's users read its records %q, which it keeps no state of", m.Module, s.Name, r))
+		}
+	}
+	return problems
+}
+
 // A Shelf is every manifest the mesh has registered, by module name.
 type Shelf map[string]Manifest
 
@@ -182,8 +263,19 @@ func CatalogueProblems(shelf Shelf) []string {
 		return ok
 	}
 
+	// Who claims each kind of a kinded bench, so a second claim of one kind is refused (ADR 0234 §2).
+	kindsTaken := map[string]string{}
+
 	for _, module := range shelfOrder(shelf) {
 		m := shelf[module]
+		for _, c := range m.Claims {
+			if c.Kind != "" {
+				if _, isModuleSeat := declared[c.Name]; !isModuleSeat {
+					problems = append(problems, fmt.Sprintf(
+						"%s claims %s of kind %q, and only a kinded bench takes a kind", module, c.Name, c.Kind))
+				}
+			}
+		}
 
 		// A `uses` naming nothing is where ADR 0110's guarantee lands under a derived set: the
 		// same refusal, at the same moment, from a set nobody maintains by hand.
@@ -214,6 +306,7 @@ func CatalogueProblems(shelf Shelf) []string {
 				}
 				continue
 			}
+			problems = append(problems, kindProblems(module, c, s, kindsTaken)...)
 			if c.At() != s.At() {
 				problems = append(problems, fmt.Sprintf(
 					"%s claims %s at scope %q, and %s declares it at %s",
@@ -228,6 +321,16 @@ func CatalogueProblems(shelf Shelf) []string {
 			}
 		}
 	}
+	// **A trusted holder runs as its own account** (novox/hq ADR 0259 §8): a module saying warrants, or
+	// speaking for a kind that proves its sender, is never carried by a machine's runtime.
+	for _, module := range shelfOrder(shelf) {
+		m := shelf[module]
+		if why := TrustedHolding(m, declared); why != "" && m.RunsAs == "" {
+			problems = append(problems, fmt.Sprintf(
+				"%s must run as an account of its own (runs-as): %s, and the machine's runtime runs as the "+
+					"operator's account, which every agent runs as (novox/hq ADR 0259)", module, why))
+		}
+	}
 	// A read of a module's state that module does not keep (novox/hq ADR 0201) — said only where the
 	// owner is on the shelf, as a consumer may be installed before its emitter.
 	var manifests []Manifest
@@ -239,6 +342,63 @@ func CatalogueProblems(shelf Shelf) []string {
 	return problems
 }
 
+// ChannelCapabilities is the fixed vocabulary `channel-capabilities/1` (novox/hq ADR 0234 §2): a word
+// outside it is refused. `max-length:<N>` takes a number.
+var ChannelCapabilities = map[string]bool{
+	"deliver": true, "reaches-away": true, "loud": true, "silent": true, "edit": true,
+	"reaches-when-mesh-down": true, "private": true,
+	"choice": true, "reply": true, "threads": true, "operator-first": true,
+	"verified-sender": true, "exact-render": true, "code-factor": true, "key-factor": true,
+}
+
+var maxLength = regexp.MustCompile(`^max-length:[1-9][0-9]{0,6}$`)
+
+// capabilityProblems are the words of a claim outside the vocabulary, and capabilities on a claim of a
+// seat that is not kinded.
+func capabilityProblems(module string, c Claim, kinded bool) []string {
+	if len(c.Capabilities) == 0 {
+		return nil
+	}
+	if !kinded {
+		return []string{fmt.Sprintf("%s claims %s with capabilities, and only a kinded bench's claim carries them",
+			module, c.Name)}
+	}
+	var problems []string
+	for _, w := range c.Capabilities {
+		if !ChannelCapabilities[w] && !maxLength.MatchString(w) {
+			problems = append(problems, fmt.Sprintf(
+				"%s claims %s with the capability %q, which channel-capabilities/1 does not have", module, c.Name, w))
+		}
+	}
+	return problems
+}
+
+// kindProblems is a claim judged against a declared seat's kind: a kinded bench takes one claim per kind,
+// a usable name; any other seat takes none.
+func kindProblems(module string, c Claim, s SeatDeclaration, taken map[string]string) []string {
+	if problems := capabilityProblems(module, c, s.Kinded); len(problems) > 0 {
+		return problems
+	}
+	switch {
+	case !s.Kinded && c.Kind != "":
+		return []string{fmt.Sprintf("%s claims %s of kind %q, and only a kinded bench takes a kind",
+			module, c.Name, c.Kind)}
+	case !s.Kinded:
+		return nil
+	case c.Kind == "":
+		return []string{fmt.Sprintf("%s claims the kinded bench %s and names no kind", module, c.Name)}
+	case !name.MatchString(c.Kind) || strings.Contains(c.Kind, "."):
+		return []string{fmt.Sprintf("%s claims %s of kind %q, which is not a usable name", module, c.Name, c.Kind)}
+	}
+	key := c.Name + "/" + c.Kind
+	if first, ok := taken[key]; ok && first != module {
+		return []string{fmt.Sprintf("%s claims %s of kind %q, which %s already claims; a kind has one holder",
+			module, c.Name, c.Kind, first)}
+	}
+	taken[key] = module
+	return nil
+}
+
 // unserved is what a seat's protocol promises and the claimant does not answer. Only the tools
 // are checked: `accepts` and `emits` are wired by the runtime from the declaration, while a tool
 // is code the module either has or has not written — under the claim's serves, or among its own.
@@ -266,3 +426,70 @@ func shelfOrder(shelf Shelf) []string {
 	sort.Strings(out)
 	return out
 }
+
+var accountName = regexp.MustCompile(`^[a-z_][a-z0-9_-]{0,30}$`)
+
+// RunsAsProblems is what one manifest's `runs-as` is held to (novox/hq ADR 0259 §8): an account of the
+// module's own making — a `user` resource of that name — that owns its secrets, with a bus account of its own,
+// and that is neither root nor the operator's.
+func RunsAsProblems(m Manifest) []string {
+	if m.RunsAs == "" {
+		return nil
+	}
+	var problems []string
+	say := func(format string, a ...any) { problems = append(problems, fmt.Sprintf(format, a...)) }
+	switch {
+	case !accountName.MatchString(m.RunsAs):
+		say("%s runs as %q, which is not an account name of the module's own", m.Module, m.RunsAs)
+		return problems
+	case m.RunsAs == "root":
+		say("%s runs as root; a module of its own account runs as an account it makes, never root", m.Module)
+	}
+	made := false
+	for _, r := range m.Resources {
+		if fmt.Sprint(r["type"]) == "user" && fmt.Sprint(r["name"]) == m.RunsAs {
+			made = true
+		}
+	}
+	if !made {
+		say("%s runs as %s, which it does not make: a user resource named %s", m.Module, m.RunsAs, m.RunsAs)
+	}
+	if _, has := m.OwnSecrets["broker"]; !has {
+		say("%s runs as its own account and declares no own secret broker: its runtime reaches the bus on an "+
+			"account of its own", m.Module)
+	}
+	if m.SecretsOwner != m.RunsAs {
+		say("%s runs as %s, and its secrets belong to %q: they are the account's own", m.Module, m.RunsAs, m.SecretsOwner)
+	}
+	return problems
+}
+
+// TrustedHolding is why a module must run as its own account (novox/hq ADR 0259 §8), or "": it holds a seat
+// whose events it says to one caller each (a warrant), or speaks for a kind of a kinded bench that proves
+// its sender, or is private (a link's code is shown there). None may be carried by the machine's runtime, which
+// runs as the operator's account.
+func TrustedHolding(m Manifest, declared map[string]SeatDeclaration) string {
+	for _, c := range m.Claims {
+		s, ok := declared[c.Name]
+		if !ok {
+			continue
+		}
+		for _, e := range s.Emits {
+			if s.NamedByCaller(e) {
+				return fmt.Sprintf("it holds %s, whose %s it says to one caller each", c.Name, e)
+			}
+		}
+		if s.Kinded {
+			for _, capability := range c.Capabilities {
+				switch capability {
+				case "verified-sender":
+					return fmt.Sprintf("it holds %s of kind %s, which proves its sender", c.Name, c.Kind)
+				case "private":
+					// A private kind is shown a link's code, which makes an account the operator's.
+					return fmt.Sprintf("it holds %s of kind %s, which is private: a link's code is shown there", c.Name, c.Kind)
+				}
+			}
+		}
+	}
+	return ""
+}

internal/catalogue/verbs.go

@@ -230,6 +230,18 @@ var ControllerVerbs = []Verb{
 			"why":       "an own secret: why it is rotated — recorded in the hand-act log (optional)",
 			"cause":     "with why: the cause in a word, the word a second rotation for the same reason uses (optional)",
 		}, nil)},
+	{Name: "give", Description: "Take a module's own secret from the operator at their desk (novox/hq ADR 0259 " +
+		"§10): a prompt that does not show what is typed opens on the machine named by at, its answer comes " +
+		"back sealed to this call alone, and is sealed to the module's machine as `secret accept` seals it. " +
+		"The value is never an argument and never in the answer: the answer says it was taken, or why not. " +
+		"Recorded in the hand-act log as a value given at the desk. The prompt waits 25 seconds; dismissed " +
+		"or unanswered, nothing changes. Then push the machine.",
+		Input: schema(map[string]string{
+			"node":   "the machine the module runs on, which the secret is sealed to",
+			"module": "the module's name",
+			"secret": "the own secret's name in the module's definition",
+			"at":     "the machine the operator sits at, where the prompt opens",
+		}, []string{"node", "module", "secret", "at"})},
 	{Name: "issue", Description: "Give a module on a machine its account on the bus: minted, and sealed to the " +
 		"machine as the module's own secret named broker, read at the next push of that machine. For a module " +
 		"whose definition declares that secret; refused with the reason otherwise. Issued again, it replaces the account.",
@@ -429,6 +441,15 @@ var ControllerVerbs = []Verb{
 			"cause":      "with consumer or older-than: the cause in a word (cleanup-waiting when absent)",
 		}, nil, "confirm")},
 	// What a consumer gave up on (novox/hq issue 330): kept in DEAD_LETTERS until a person acts on it.
+	{Name: "root-free", Description: "Whether each machine named is root-free now (novox/hq ADR 0259 §8): no agent " +
+		"there can become root without a person. Judged when asked, never from a condition: free only when the machine " +
+		"names an account its agents run as, its node-engine judged that account unable to become root within the " +
+		"last 15 minutes, and the login shell's execute is not served there. Anything else, a read that failed " +
+		"included, is not free and says why. The router asks it before an answer from a channel proving its sender " +
+		"may approve. Only reads.",
+		Input: listed(schema(map[string]string{
+			"machines": "the machines to judge, by name: a list, or one text separated by commas",
+		}, []string{"machines"}), "machines")},
 	{Name: "dead-letters", Description: "Every message a consumer on the bus gave up on after handing it over " +
 		"as often as it may, kept in DEAD_LETTERS: whose consumer, the subject, how often it was handed over and " +
 		"when it was given up, newest first. With id: that one whole, with what it said. With deliver: hand it " +
@@ -545,6 +566,21 @@ func schema(properties map[string]string, required []string, switches ...string)
 	return out
 }
 
+// listed makes the named properties of a schema lists of text: a caller gives them as a JSON array (or, as
+// any argument, one text separated by commas).
+func listed(in map[string]any, names ...string) map[string]any {
+	props, _ := in["properties"].(map[string]any)
+	for _, n := range names {
+		p, _ := props[n].(map[string]any)
+		if p == nil {
+			panic("a list that is not a property: " + n)
+		}
+		props[n] = map[string]any{"type": "array", "items": map[string]any{"type": "string"},
+			"description": p["description"]}
+	}
+	return in
+}
+
 // unpromised is what a claim says it serves and the seat's protocol never promised.
 func unpromised(serves []string, promised []Verb) []string {
 	has := map[string]bool{}

internal/catalogue/version_in_a_path_test.go

@@ -95,3 +95,28 @@ func TestAResourceWithoutAVersionReferenceIsUntouched(t *testing.T) {
 		t.Fatalf("a path naming no version became %q", path)
 	}
 }
+
+// A process's env can name the build's own version too (novox/hq issue 352): the controller is told which
+// build it is, and records what that build reads of the store's schema under it.
+func TestAProcessEnvCanNameTheBuildsOwnVersion(t *testing.T) {
+	m := Manifest{
+		Module: "mesh-controller",
+		Build:  &Build{Artifacts: []Artifact{{Name: "controller", Kind: ArtifactBundle, Language: "go", System: "arch"}}},
+		Resources: []map[string]any{{
+			"id": "controller", "type": "process", "artifact": "controller", "run": []any{"./mesh-controller", "serve"},
+			"env": map[string]any{"MESH_CONTROLLER_VERSION": "${version}", "OTHER": "kept"},
+		}},
+	}
+	got, err := m.Resolve([]Built{{Name: "controller", Kind: ArtifactBundle,
+		Reference: "artifact-store://mesh-controller/controller", Digest: aDigest}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	env, _ := got.Resources[0]["env"].(map[string]any)
+	if env["MESH_CONTROLLER_VERSION"] != "ad62528c47c7" || env["OTHER"] != "kept" {
+		t.Fatalf("the env resolved to %v", env)
+	}
+	if run, _ := got.Resources[0]["run"].([]any); len(run) != 2 {
+		t.Fatalf("the run was changed: %v", run)
+	}
+}

internal/conditions/condition.go

@@ -145,6 +145,13 @@ type Condition struct {
 	// Raised is when it was first observed this time; LastObserved the newest observation.
 	Raised       time.Time `json:"raised"`
 	LastObserved time.Time `json:"last-observed"`
+	// First is when this fault was first raised, a reopening within ReopenWithin counted as the same
+	// fault; Gaps are the stretches between, each from a clearing to the reopening after it. Absent on a
+	// first raising, and on one written before they were kept. What asks whether the fault was there at a
+	// moment — the gate, at a send — reads OpenAt, never Raised (novox/hq issue 348): a fault cleared and
+	// reopened after a send was there at the send unless the send fell in one of its gaps.
+	First time.Time `json:"first,omitzero"`
+	Gaps  []Gap     `json:"gaps,omitempty"`
 	// Observations is how many times it was observed since raised.
 	Observations int `json:"observations"`
 	// Count is how many times it has been raised, a reopening within ReopenWithin counted.
@@ -274,3 +281,51 @@ func Order(list []Condition) {
 		return list[i].Key < list[j].Key
 	})
 }
+
+// Gap is a stretch in which a fault was cleared, between its clearing and its reopening.
+type Gap struct {
+	Cleared  time.Time `json:"cleared"`
+	Reopened time.Time `json:"reopened"`
+}
+
+// KeptGaps is how many gaps a condition keeps. Past it the oldest go, and the fault is said to have begun
+// at the reopening after the newest of them: earlier history forgotten, never a fault said older than known.
+const KeptGaps = 8
+
+// Began is when this fault began as the mesh knows it: its first raising, a reopening within
+// ReopenWithin being the same fault again (novox/hq issue 348).
+func (c Condition) Began() time.Time {
+	if !c.First.IsZero() && c.First.Before(c.Raised) {
+		return c.First
+	}
+	return c.Raised
+}
+
+// OpenAt says the fault was there at t: it began at or before t, and t fell in none of its gaps. A fault
+// that cleared before a send and came back after it was not there at the send — that is the send's to
+// answer for — while one that flapped after the send was (novox/hq issue 348).
+func (c Condition) OpenAt(t time.Time) bool {
+	if t.Before(c.Began()) {
+		return false
+	}
+	for _, g := range c.Gaps {
+		if !t.Before(g.Cleared) && t.Before(g.Reopened) {
+			return false
+		}
+	}
+	return true
+}
+
+// reopen is c raised again at now after a clearing at cleared, of a fault that began at first with gaps:
+// the same fault, with one more gap.
+func (c *Condition) reopen(first time.Time, gaps []Gap, cleared, now time.Time) {
+	if first.IsZero() || !first.Before(now) {
+		return
+	}
+	c.First = first
+	c.Gaps = append(append([]Gap(nil), gaps...), Gap{Cleared: cleared, Reopened: now})
+	if over := len(c.Gaps) - KeptGaps; over > 0 {
+		c.First = c.Gaps[over-1].Reopened
+		c.Gaps = c.Gaps[over:]
+	}
+}

internal/conditions/plain.go

@@ -27,6 +27,7 @@ package conditions
 
 import (
 	"fmt"
+	"log"
 	"regexp"
 	"strings"
 	"sync"
@@ -53,8 +54,19 @@ type Action struct {
 	Verb      string            `json:"verb"`
 	Machine   string            `json:"machine,omitempty"`
 	Arguments map[string]string `json:"arguments,omitempty"`
+	// Level is how much proof its answer needs (novox/hq ADR 0234 §8, ADR 0259): LevelAcknowledge for what
+	// any granted principal may already do, LevelApprove for what only the operator's proven word does.
+	// The controller asks for every action, and performs the one chosen on the warrant the router issues.
+	Level string `json:"level,omitempty"`
 }
 
+// The assurance levels an action's answer needs (novox/hq ADR 0234 §8): acknowledge, approve. Destroy is
+// not asked for by any condition: nothing carries its second proof yet.
+const (
+	LevelAcknowledge = "acknowledge"
+	LevelApprove     = "approve"
+)
+
 // The two verdicts an explanation opens with.
 const (
 	NothingToDo = "Nothing for you to do."
@@ -66,7 +78,7 @@ const (
 // only kind of answer a desk click performs until answers are authorised (novox/hq ADR 0258). Its cause
 // marks it as an answer, which the hand-act log does not count as a repair.
 func SilenceAction(key string) Action {
-	return Action{Label: "Silence for a week", Verb: "mesh-controller.conditions",
+	return Action{Label: "Silence for a week", Verb: "mesh-controller.conditions", Level: LevelAcknowledge,
 		Arguments: map[string]string{"silence": key, "for": "7d", "why": "", "cause": CauseOperatorAnswer}}
 }
 
@@ -124,9 +136,32 @@ func Worded(kind string) bool {
 
 // Unworded is told of every observation said in borrowed words: its kind has none registered, or the
 // words it was given break the plain rule. The keeper says it plainly anyway; a test suite sets this to
-// fail the producer.
+// fail the producer. Unset, as in the serving controller, it is a line in the log (unworded).
 var Unworded func(o Observation, why string)
 
+// loggedUnworded holds each kind and why already logged: once per process, since a condition observed
+// every minute would otherwise say the same line every minute.
+var loggedUnworded sync.Map
+
+// unworded tells Unworded, or else logs once, that an observation is said in borrowed words — so words
+// that fell back are never silent (hq issue 359: a secret given reached the operator as "needs a look",
+// and nothing said why).
+func unworded(o Observation, why string) {
+	if Unworded != nil {
+		Unworded(o, why)
+		return
+	}
+	// The reason without what it quotes of the words: a quoted fragment may be a hash-shaped secret, and a
+	// fragment that changes (a clock time) would log a new line every time.
+	reason := quotedFragment.ReplaceAllString(why, "")
+	if _, seen := loggedUnworded.LoadOrStore(o.Kind+"\x00"+reason, true); !seen {
+		log.Printf("the condition kind %q is said in the scope's words, not its own: %s", o.Kind, reason)
+	}
+}
+
+// quotedFragment is what a reason of the plain rule quotes of the words it refused, at its end.
+var quotedFragment = regexp.MustCompile(` \([^()]*\)$`)
+
 // The plain rule's shapes.
 var (
 	hexID      = regexp.MustCompile(`\b[0-9a-f]{7,40}\b`)
@@ -252,14 +287,10 @@ func plainly(o Observation) Observation {
 	// An explanation too long is cut, never refused: what it says first is what matters.
 	w.Explanation = cut(w.Explanation, ExplanationMax-len(Verdict(w.Needs, ""))-1)
 	if from == "" {
-		if Unworded != nil {
-			Unworded(o, "the kind "+o.Kind+" has no plain words")
-		}
+		unworded(o, "the kind "+o.Kind+" has no plain words")
 		w = scopeWords(o)
 	} else if why, ok := PlainWords(w, machines...); !ok {
-		if Unworded != nil {
-			Unworded(o, from+" is not plain: "+why)
-		}
+		unworded(o, from+" is not plain: "+why)
 		// The scope's words, but never a weaker verdict: what needed the operator still does, and its
 		// answers are kept where they are themselves sound.
 		needed, actions := w.Needs != "", soundActions(w.Actions)

internal/conditions/plain_test.go

@@ -1,7 +1,9 @@
 package conditions
 
 import (
+	"bytes"
 	"encoding/json"
+	"log"
 	"strings"
 	"testing"
 )
@@ -245,3 +247,36 @@ func TestAChangeOfWordsIsSaid(t *testing.T) {
 		t.Fatalf("%+v", said)
 	}
 }
+
+// **Words that fall back are never silent** (hq issue 359): with no test listening, the keeper logs which
+// kind is said in borrowed words and why — once, however often the condition is observed.
+func TestBorrowedWordsAreLogged(t *testing.T) {
+	k, _, _, _ := keeper(t)
+	before := Unworded
+	Unworded = nil
+	t.Cleanup(func() { Unworded = before })
+	loggedUnworded.Clear()
+	t.Cleanup(loggedUnworded.Clear)
+	var out bytes.Buffer
+	writer := log.Writer()
+	log.SetOutput(&out)
+	t.Cleanup(func() { log.SetOutput(writer) })
+	// A time that changes each observation, and a hash-shaped word: one line, quoting neither.
+	for _, at := range []string{"23:32", "23:33", "23:34"} {
+		if _, err := k.Observe(t.Context(), Observation{Scope: ScopeMachine, ID: "ace", Kind: "test-clock", Machine: "ace",
+			Severity: Warning, Source: "test", Summary: "s", Headline: "ace was given a secret",
+			Explanation: "It was given at " + at + ".", Resolved: "Seen"}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if _, err := k.Observe(t.Context(), Observation{Scope: ScopeMachine, ID: "ace", Kind: "test-hash", Machine: "ace",
+		Severity: Warning, Source: "test", Summary: "s", Headline: "ace was given 0123abcd4567ef89",
+		Explanation: "It was given.", Resolved: "Seen"}); err != nil {
+		t.Fatal(err)
+	}
+	if got := out.String(); strings.Count(got, "\n") != 2 || !strings.Contains(got, `"test-clock"`) ||
+		!strings.Contains(got, "a clock time or date") || strings.Contains(got, "23:3") ||
+		!strings.Contains(got, `"test-hash"`) || strings.Contains(got, "0123abcd4567ef89") {
+		t.Errorf("the log said %q", got)
+	}
+}

internal/conditions/store.go

@@ -77,8 +77,12 @@ type Keeper struct {
 }
 
 type clearing struct {
-	at       time.Time
-	count    int
+	at    time.Time
+	count int
+	// began is when the fault that cleared began, and gaps its earlier gaps, so its reopening keeps
+	// them (Condition.OpenAt).
+	began    time.Time
+	gaps     []Gap
 	silenced *Silence
 	// tried is what healers tried before it cleared: a reopening is the same fault, and what was
 	// tried on it is still what was tried.
@@ -120,8 +124,8 @@ func NewKeeper(ctx context.Context, o Options) *Keeper {
 		if recent, err := k.history.Since(ctx, k.now().Add(-ReopenWithin)); err == nil {
 			for _, e := range recent {
 				if e.Change == ChangeCleared {
-					k.cleared[e.Key] = clearing{at: e.At, count: e.Condition.Count, silenced: e.Condition.Silenced,
-						tried: e.Condition.Tried}
+					k.cleared[e.Key] = clearing{at: e.At, count: e.Condition.Count, began: e.Condition.Began(), gaps: e.Condition.Gaps,
+						silenced: e.Condition.Silenced, tried: e.Condition.Tried}
 				}
 			}
 		} else {
@@ -197,6 +201,7 @@ func (k *Keeper) Observe(ctx context.Context, o Observation) (Condition, error)
 			k.mu.Lock()
 			if before, ok := k.cleared[key]; ok && now.Sub(before.at) <= ReopenWithin {
 				c.Count, change = before.count+1, ChangeReopened
+				c.reopen(before.began, before.gaps, before.at, now)
 				// A silence a person gave the condition before it cleared still holds: they said
 				// they knew, and the same fault again ten minutes later is what they knew about.
 				if before.silenced != nil && now.Before(before.silenced.Until) {
@@ -313,7 +318,7 @@ func (k *Keeper) ClearSaying(ctx context.Context, key, why, resolved string) (bo
 		}
 		now := k.now().UTC()
 		k.mu.Lock()
-		k.cleared[key] = clearing{at: now, count: c.Count, silenced: c.Silenced, tried: c.Tried}
+		k.cleared[key] = clearing{at: now, count: c.Count, began: c.Began(), gaps: c.Gaps, silenced: c.Silenced, tried: c.Tried}
 		k.mu.Unlock()
 		k.tell(Event{Condition: c, At: now, Change: ChangeCleared, Why: why, Cleared: &now})
 		return true, nil

internal/conditions/store_test.go

@@ -378,3 +378,119 @@ func TestATransitionIsOfferedAgainWhileTheBusIsAway(t *testing.T) {
 		t.Fatalf("said %+v, unsaid %d", said, k.Unsaid())
 	}
 }
+
+// **A reopening keeps when the fault began** (novox/hq issue 348): Raised is the reopening, Began the
+// first raising — also from a keeper that read what cleared from the history — and past the window a
+// raising is a new fault that begins then.
+func TestAReopeningKeepsWhenTheFaultBegan(t *testing.T) {
+	k, store, told, c := keeper(t)
+	ctx := t.Context()
+	first, err := k.Observe(ctx, silent("ace"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !first.Began().Equal(first.Raised) || !first.First.IsZero() {
+		t.Fatalf("a first raising began at %s, raised %s, first %s", first.Began(), first.Raised, first.First)
+	}
+	c.pass(30 * time.Second)
+	if _, err := k.Clear(ctx, "machine.ace.silent", "heard again"); err != nil {
+		t.Fatal(err)
+	}
+	c.pass(time.Minute)
+	again, err := k.Observe(ctx, silent("ace"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !again.Raised.After(first.Raised) || !again.Began().Equal(first.Raised) || len(again.Gaps) != 1 ||
+		!again.Gaps[0].Reopened.Equal(again.Raised) || !again.Gaps[0].Cleared.Before(again.Raised) {
+		t.Fatalf("reopened: raised %s, began %s, gaps %+v; first raised %s", again.Raised, again.Began(), again.Gaps, first.Raised)
+	}
+	if !again.OpenAt(first.Raised) || again.OpenAt(again.Gaps[0].Cleared) || !again.OpenAt(again.Raised) ||
+		again.OpenAt(first.Raised.Add(-time.Second)) {
+		t.Fatalf("open at the wrong moments: %+v", again)
+	}
+	// Through a restarted controller, reading the clearing from the history.
+	if _, err := k.Clear(ctx, "machine.ace.silent", "heard again"); err != nil {
+		t.Fatal(err)
+	}
+	settled(t, told, 4)
+	k.Close(context.Background())
+	next := NewKeeper(ctx, Options{Store: store, History: store, Now: c.now})
+	defer next.Close(context.Background())
+	c.pass(time.Minute)
+	third, err := next.Observe(ctx, silent("ace"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !third.Began().Equal(first.Raised) || len(third.Gaps) != 2 {
+		t.Fatalf("after a restart the reopening began at %s, not %s, with gaps %+v", third.Began(), first.Raised, third.Gaps)
+	}
+	if _, err := next.Clear(ctx, "machine.ace.silent", "heard again"); err != nil {
+		t.Fatal(err)
+	}
+	c.pass(ReopenWithin + time.Minute)
+	fourth, err := next.Observe(ctx, silent("ace"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !fourth.Began().Equal(fourth.Raised) || len(fourth.Gaps) != 0 {
+		t.Fatalf("past the window the fault began at %s, raised %s, gaps %+v", fourth.Began(), fourth.Raised, fourth.Gaps)
+	}
+}
+
+// Past KeptGaps the oldest gaps go, and the fault is said to have begun after them, never before.
+func TestAFaultKeepsItsNewestGapsAndForgetsWhatWasBefore(t *testing.T) {
+	t0 := time.Date(2026, 10, 9, 10, 0, 0, 0, time.UTC)
+	c := Condition{Raised: t0}
+	first, gaps := t0, []Gap(nil)
+	for i := 1; i <= KeptGaps+2; i++ {
+		cleared, now := t0.Add(time.Duration(2*i)*time.Minute), t0.Add(time.Duration(2*i+1)*time.Minute)
+		c = Condition{Raised: now}
+		c.reopen(first, gaps, cleared, now)
+		first, gaps = c.Began(), c.Gaps
+	}
+	if len(c.Gaps) != KeptGaps || !c.Began().Equal(t0.Add(5*time.Minute)) || c.OpenAt(t0.Add(time.Minute)) {
+		t.Fatalf("after %d gaps: began %s, %d gaps", KeptGaps+2, c.Began(), len(c.Gaps))
+	}
+	// A first time not before the reopening is no earlier fault.
+	d := Condition{Raised: t0}
+	d.reopen(t0, nil, t0.Add(-time.Minute), t0)
+	if !d.First.IsZero() || len(d.Gaps) != 0 {
+		t.Fatalf("a fault reopened at its own first raising: %+v", d)
+	}
+}
+
+// Two reopenings in one keeper, each after ClearSaying: both gaps kept, the fault begun at its first raising,
+// and open again at the second clearing's reopening.
+func TestASecondReopeningKeepsBothGaps(t *testing.T) {
+	k, _, _, c := keeper(t)
+	ctx := t.Context()
+	first, err := k.Observe(ctx, silent("ace"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var cleared []time.Time
+	for i := 0; i < 2; i++ {
+		c.pass(30 * time.Second)
+		cleared = append(cleared, c.now().UTC())
+		if ok, err := k.ClearSaying(ctx, "machine.ace.silent", "heard again", "ace is heard again"); err != nil || !ok {
+			t.Fatalf("cleared %v: %v", ok, err)
+		}
+		c.pass(time.Minute)
+		if _, err := k.Observe(ctx, silent("ace")); err != nil {
+			t.Fatal(err)
+		}
+	}
+	got, err := k.Open(ctx)
+	if err != nil || len(got) != 1 {
+		t.Fatalf("%+v %v", got, err)
+	}
+	g := got[0]
+	if !g.Began().Equal(first.Raised) || len(g.Gaps) != 2 || !g.Gaps[0].Cleared.Equal(cleared[0]) ||
+		!g.Gaps[1].Cleared.Equal(cleared[1]) || !g.Gaps[1].Reopened.Equal(g.Raised) || g.Count != 3 {
+		t.Fatalf("after two reopenings: began %s, gaps %+v, count %d", g.Began(), g.Gaps, g.Count)
+	}
+	if g.OpenAt(cleared[0].Add(time.Second)) || !g.OpenAt(cleared[0].Add(-time.Second)) || g.OpenAt(cleared[1].Add(time.Second)) {
+		t.Fatalf("open at the wrong moments: %+v", g)
+	}
+}

internal/inventory/asks_lab_test.go

@@ -0,0 +1,249 @@
+package inventory
+
+// The bus of the lab's proof of the operator's answers (mesh-lab `asks/`, novox/hq ADR 0259).
+//
+// The proof runs the router, the Telegram channel and an asker against a real bus, and the bus must be the
+// one this controller would compose — not a copy of its rules written again in the lab, which would prove
+// the copy. So the lab asks this test, at the controller's commit, for both halves:
+//
+//  1. **Composed** (MESH_LAB_ASKS_OUT and MESH_LAB_ASKS_CATALOGUE set): one machine, `anchor`, running the
+//     router (messenger), the Telegram channel, the desk channel and the machine's runtime as the catalogue
+//     declares them, beside two modules of the lab's own — `lab-asker`, which uses `operator-channel`, and
+//     `lab-bystander`, which does not. Written to the directory: the accounts block exactly as Users and
+//     ComposeAccounts make it, each user's credential, and every membership as MembershipFor makes it.
+//  2. **Raised** (MESH_LAB_ASKS_BUS set as well): on the lab's running bus, as the controller, what a send
+//     asserts — the mesh's streams and consumers, the seats' work queues and workers, the modules' buckets —
+//     and every membership published where the runtime reads it.
+//
+// Without those words it skips: the controller's own suite has nothing to raise.
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"sort"
+	"testing"
+	"time"
+
+	"github.com/nats-io/nats.go"
+	"golang.org/x/crypto/bcrypt"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/catalogue"
+)
+
+// labMachine is the one machine of the lab's bus.
+const labMachine = "anchor"
+
+// The lab's own modules: one that asks, one that may not.
+var labManifests = []string{
+	`{"module": "lab-asker", "version": "1", "uses": ["operator-channel"], "state": ["acted"],
+	  "own-secrets": {"broker": "${dir:state}/broker"},
+	  "resources": [{"id": "state", "type": "directory", "mode": "0700", "place": "."}]}`,
+	`{"module": "lab-bystander", "version": "1", "own-secrets": {"broker": "${dir:state}/broker"},
+	  "resources": [{"id": "state", "type": "directory", "mode": "0700", "place": "."}]}`,
+}
+
+// labCredential is what a lab process connects as: the runtime's credential shape (mesh-tools bus.Credential).
+type labCredential struct {
+	URL      string `json:"url"`
+	Node     string `json:"node,omitempty"`
+	Module   string `json:"module,omitempty"`
+	User     string `json:"user"`
+	Password string `json:"password"`
+}
+
+func TestTheAsksLabBus(t *testing.T) {
+	out, modules := os.Getenv("MESH_LAB_ASKS_OUT"), os.Getenv("MESH_LAB_ASKS_CATALOGUE")
+	if out == "" || modules == "" {
+		t.Skip("the lab did not ask for its bus (MESH_LAB_ASKS_OUT, MESH_LAB_ASKS_CATALOGUE)")
+	}
+	var manifests []catalogue.Manifest
+	read := func(raw []byte, from string) {
+		m, err := catalogue.ParseManifest(raw)
+		if err != nil {
+			t.Fatalf("%s: %v", from, err)
+		}
+		manifests = append(manifests, m)
+	}
+	for _, name := range []string{"messenger", "telegram", "desk-channel"} {
+		path := filepath.Join(modules, name, "module.json")
+		raw, err := os.ReadFile(path)
+		if err != nil {
+			t.Fatal(err)
+		}
+		read(raw, path)
+	}
+	if path := os.Getenv("MESH_LAB_ASKS_RUNTIME"); path != "" {
+		raw, err := os.ReadFile(path)
+		if err != nil {
+			t.Fatal(err)
+		}
+		read(raw, path)
+	}
+	for i, raw := range labManifests {
+		read([]byte(raw), "the lab's module "+string(rune('1'+i)))
+	}
+
+	// As BusRecords reads the store: every seat any module declares, the mesh's own beside them.
+	seats := map[string]catalogue.SeatDeclaration{}
+	declarers := map[string]string{}
+	for _, m := range manifests {
+		for _, s := range m.DefinesSeats {
+			seats[s.Name], declarers[s.Name] = s, m.Module
+		}
+	}
+	for _, own := range catalogue.SeatsWithAProtocol() {
+		seats[own.Name] = catalogue.SeatDeclaration{Name: own.Name, Scope: own.Scope, Accepts: own.Accepts,
+			Emits: own.Emits, Serves: own.Serves}
+	}
+	records := broker.Records{Nodes: []string{labMachine}, Assigned: map[string][]broker.Declared{},
+		People: map[string][]string{}, Interchangeable: map[string]bool{}, RootFree: map[string]bool{}}
+	// Whether the lab's machine is root-free is the lab's to say (MESH_LAB_ASKS_ROOT_FREE=true): it has no
+	// node-engine to judge it. Unsaid, it is not, and no kind is composed with verified-sender — as a push
+	// composes on a machine that is not (novox/hq ADR 0259 §8).
+	if os.Getenv("MESH_LAB_ASKS_ROOT_FREE") == "true" {
+		records.RootFree[labMachine] = true
+	}
+	var buckets []broker.Bucket
+	var trafficSeats []broker.Seat
+	for _, m := range manifests {
+		records.Assigned[labMachine] = append(records.Assigned[labMachine], declaredFor(m, seats, declarers))
+		buckets = append(buckets, bucketsOf(m)...)
+		for _, s := range m.DefinesSeats {
+			if seat := asSeat(s, m.Module); seat.Kinded || len(seat.ByCaller) > 0 {
+				trafficSeats = append(trafficSeats, seat)
+			}
+		}
+	}
+	users, err := broker.Users(records)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Each user a password of the lab's, the hash in the composition.
+	passwords := map[string]string{}
+	if raw, err := os.ReadFile(filepath.Join(out, "passwords.json")); err == nil {
+		_ = json.Unmarshal(raw, &passwords)
+	}
+	for i, u := range users {
+		name := u.Username()
+		if passwords[name] == "" {
+			passwords[name] = "lab-" + name + "-" + time.Now().Format("150405.000000")
+		}
+		hash, err := bcrypt.GenerateFromPassword([]byte(passwords[name]), bcrypt.MinCost)
+		if err != nil {
+			t.Fatal(err)
+		}
+		users[i].PasswordHash = string(hash)
+	}
+
+	bus := os.Getenv("MESH_LAB_ASKS_BUS")
+	if bus == "" {
+		accounts, err := broker.ComposeAccounts(users)
+		if err != nil {
+			t.Fatal(err)
+		}
+		creds := map[string]labCredential{}
+		for _, u := range users {
+			creds[u.Username()] = labCredential{Node: u.Node, Module: u.Module, User: u.Username(),
+				Password: passwords[u.Username()]}
+		}
+		where := broker.PlacementsOf(records, records.Interchangeable)
+		memberships := map[string]broker.Membership{}
+		for _, d := range records.Assigned[labMachine] {
+			memberships[d.Module] = broker.MembershipFor(labMachine, d, where)
+		}
+		write(t, filepath.Join(out, "accounts.conf"), []byte(accounts))
+		writeJSON(t, filepath.Join(out, "passwords.json"), passwords)
+		writeJSON(t, filepath.Join(out, "credentials.json"), creds)
+		writeJSON(t, filepath.Join(out, "memberships.json"), memberships)
+		return
+	}
+
+	// Raised on the lab's bus, as the controller, as a send asserts it (cmd/mesh-controller busobjects.go).
+	js, err := broker.Dial(bus, nats.UserInfo("controller", passwords["controller"]), nats.CustomInboxPrefix("_INBOX.controller"))
+	if err != nil {
+		t.Fatalf("the lab's bus, as the controller: %v", err)
+	}
+	defer js.Close()
+	if err := broker.Raise(js, records.Nodes); err != nil {
+		t.Fatal(err)
+	}
+	holders := map[string]broker.Holder{}
+	for _, d := range records.Assigned[labMachine] {
+		for _, s := range d.Holds {
+			if _, taken := holders[s.Name]; !taken {
+				holders[s.Name] = broker.Holder{Node: labMachine, Module: d.Module}
+			}
+		}
+	}
+	if err := broker.RaiseSeats(js, MeshSeats(), holders); err != nil {
+		t.Fatal(err)
+	}
+	streams, workers := broker.SeatTrafficObjects(users)
+	have := map[string]bool{}
+	for _, s := range streams {
+		have[s.Name] = true
+	}
+	for _, s := range broker.TrafficQueues(trafficSeats) {
+		if !have[s.Name] {
+			streams, have[s.Name] = append(streams, s), true
+		}
+	}
+	for _, s := range streams {
+		if err := js.EnsureStream(s); err != nil {
+			t.Fatalf("the work queue %s: %v", s.Name, err)
+		}
+	}
+	for _, c := range workers {
+		if err := js.EnsureConsumer(c); err != nil {
+			t.Fatalf("the worker %s: %v", c.Name, err)
+		}
+	}
+	for _, c := range broker.ConsumersOf(users) {
+		if err := js.EnsureConsumer(c.Consumer); err != nil {
+			t.Fatalf("how %s hears what it consumes: %v", c.Module, err)
+		}
+	}
+	if _, err := broker.RaiseBuckets(js, buckets); err != nil {
+		t.Fatal(err)
+	}
+	if err := js.EnsureControllerBuckets(); err != nil {
+		t.Fatal(err)
+	}
+	where := broker.PlacementsOf(records, records.Interchangeable)
+	names := make([]string, 0)
+	for _, d := range records.Assigned[labMachine] {
+		body, err := json.Marshal(broker.MembershipFor(labMachine, d, where))
+		if err != nil {
+			t.Fatal(err)
+		}
+		if _, err := js.Context().Publish(broker.MembershipSubject(labMachine, d.Module), body); err != nil {
+			t.Fatalf("issuing %s its membership: %v", d.Module, err)
+		}
+		names = append(names, d.Module)
+	}
+	sort.Strings(names)
+	t.Logf("raised on %s: %d streams of seats, %d workers, %d buckets, memberships for %v", bus, len(streams),
+		len(workers), len(buckets), names)
+}
+
+func write(t *testing.T, path string, body []byte) {
+	t.Helper()
+	if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(path, body, 0o600); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func writeJSON(t *testing.T, path string, v any) {
+	t.Helper()
+	body, err := json.MarshalIndent(v, "", "  ")
+	if err != nil {
+		t.Fatal(err)
+	}
+	write(t, path, body)
+}

internal/inventory/busrecords.go

@@ -34,9 +34,12 @@ func (i *Inventory) BusRecords(ctx context.Context) (broker.Records, error) {
 	// that seat promises. **Across the whole catalogue, not one manifest**: a seat is declared by
 	// one module and held by another, which is the whole reason a seat exists (ADR 0118).
 	seats := map[string]catalogue.SeatDeclaration{}
+	// And who declared each, so a seat's records are named as the declaring module's buckets (ADR 0259).
+	declarers := map[string]string{}
 	for _, m := range declared {
 		for _, s := range m.DefinesSeats {
 			seats[s.Name] = s
+			declarers[s.Name] = m.Module
 		}
 	}
 	// And the mesh's own, which carry protocol too (novox/hq ADR 0121). Added after the modules'
@@ -78,7 +81,7 @@ func (i *Inventory) BusRecords(ctx context.Context) (broker.Records, error) {
 					"%s is assigned to %s and is not in the catalogue, so what it may say cannot "+
 						"be derived", module, n.Name)
 			}
-			d := declaredFor(m, seats)
+			d := declaredFor(m, seats, declarers)
 			// And the state offered to it as a seat's holder by the modules beside it (novox/hq ADR 0255).
 			// For this machine's key alone (novox/hq ADR 0260): a bar shows its own machine's draw.
 			for _, sr := range catalogue.ReadsGranted(m, onMachine(declared, modules), n.Name) {
@@ -121,7 +124,7 @@ func onMachine(declared map[string]catalogue.Manifest, modules []string) []catal
 
 // declaredFor is one module's manifest as the composer needs it: what it says about itself, and the
 // protocol of every seat it holds or uses.
-func declaredFor(m catalogue.Manifest, seats map[string]catalogue.SeatDeclaration) broker.Declared {
+func declaredFor(m catalogue.Manifest, seats map[string]catalogue.SeatDeclaration, declarers map[string]string) broker.Declared {
 	// A consumed name is a module's event unless it names a seat, and only somebody holding the seat
 	// set can tell (novox/hq ADR 0121). Split here, because the composer cannot look at a name and
 	// know — and a role's event read as a module's is a subscription to a namespace nobody owns.
@@ -132,6 +135,16 @@ func declaredFor(m catalogue.Manifest, seats map[string]catalogue.SeatDeclaratio
 		if named {
 			// A seat's event when the seat says it; else the event of the module of that name — a seat and
 			// the module holding it may share a name (mesh-delivery, novox/hq ADR 0239).
+			if s, isASeat := seats[emitter]; isASeat && s.Kinded {
+				// A kinded bench's event is named `<event>` or `<event>.*` and heard from every kind; its
+				// proofs are answered by whoever watches it (ADR 0259 §3).
+				ev := strings.TrimSuffix(event, ".*")
+				if catalogue.SeatSays(s.Emits, ev) {
+					watches = append(watches, broker.Seat{Name: s.Name, Scope: s.Scope, Emits: []string{ev},
+						Kinded: true, Proofs: s.Proofs, DeclaredBy: declarers[s.Name]})
+					continue
+				}
+			}
 			if s, isASeat := seats[emitter]; isASeat && catalogue.SeatSays(s.Emits, event) {
 				watches = append(watches, broker.Seat{Name: s.Name, Emits: []string{event}})
 				continue
@@ -155,6 +168,8 @@ func declaredFor(m catalogue.Manifest, seats map[string]catalogue.SeatDeclaratio
 		Reads: m.Reads,
 		// And the tools its health asks (novox/hq ADR 0240): the machine's node-engine is granted them.
 		Checks: catalogue.HealthChecks(m),
+		// And whether it runs as an account of its own (novox/hq ADR 0259 §8).
+		RunsAs: m.RunsAs,
 	}
 	// Whether it can be given an account at all: delivered as its own secret named broker, so one
 	// that declares none has nowhere to read it (novox/hq issue 195).
@@ -168,12 +183,15 @@ func declaredFor(m catalogue.Manifest, seats map[string]catalogue.SeatDeclaratio
 		// Every seat with a protocol, the mesh's own included. One that says only who does a job is
 		// not here and grants nothing, which is most of them.
 		if s, hasAProtocol := seats[c.Name]; hasAProtocol {
-			d.Holds = append(d.Holds, asSeat(s))
+			held := asSeat(s, declarers[s.Name])
+			held.Kind = c.Kind
+			held.Capabilities = c.Capabilities
+			d.Holds = append(d.Holds, held)
 		}
 	}
 	for _, name := range m.Uses {
 		if s, declaredSomewhere := seats[name]; declaredSomewhere {
-			d.Uses = append(d.Uses, asSeat(s))
+			d.Uses = append(d.Uses, asSeat(s, declarers[s.Name]))
 		}
 	}
 	return d
@@ -204,9 +222,17 @@ func (i *Inventory) DeclaredBuckets(ctx context.Context) ([]broker.Bucket, error
 	return out, nil
 }
 
-func asSeat(s catalogue.SeatDeclaration) broker.Seat {
-	return broker.Seat{Name: s.Name, Scope: s.Scope, Accepts: s.Accepts, Emits: s.Emits,
-		Serves: catalogue.VerbNames(s.Serves)}
+func asSeat(s catalogue.SeatDeclaration, declarer string) broker.Seat {
+	seat := broker.Seat{Name: s.Name, Scope: s.Scope, Accepts: s.Accepts, Emits: s.Emits,
+		Serves: catalogue.VerbNames(s.Serves), Kinded: s.Kinded, ByCaller: s.ByCaller, Proofs: s.Proofs,
+		DeclaredBy: declarer}
+	// A seat's records are its declaring module's buckets, named as the bus holds them (ADR 0259 §3).
+	for _, r := range s.Records {
+		if declarer != "" {
+			seat.Records = append(seat.Records, broker.BucketName(declarer, r))
+		}
+	}
+	return seat
 }
 
 // MeshSeats are the mesh's own seats that carry a protocol, as the bus needs them: what to make a work
@@ -277,3 +303,22 @@ func heldHere(claimed []broker.Seat, holdings []catalogue.Held, node, module str
 	}
 	return out
 }
+
+// DeclaredTrafficSeats is every seat any registered module declares that names its caller or its kind
+// (novox/hq ADR 0259 §3), as the bus needs it: assigned or not, so its work queue exists from registration.
+func (i *Inventory) DeclaredTrafficSeats(ctx context.Context) ([]broker.Seat, error) {
+	declared, err := i.Catalogue(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("cannot read the catalogue: %w", err)
+	}
+	var out []broker.Seat
+	for _, m := range declared {
+		for _, s := range m.DefinesSeats {
+			seat := asSeat(s, m.Module)
+			if seat.Kinded || len(seat.ByCaller) > 0 {
+				out = append(out, seat)
+			}
+		}
+	}
+	return out, nil
+}

internal/inventory/gate.go

@@ -23,6 +23,9 @@ import (
 const (
 	GatePassed = "passed"
 	GateFailed = "failed"
+	// GateSuperseded is a judging ended by a later send to the judged machine that moved the module to
+	// another build (novox/hq issue 352): no verdict on the build, and nothing put back.
+	GateSuperseded = "superseded"
 
 	RollingBack   = "rolling-back"
 	RolledBack    = "rolled-back"

internal/inventory/givable_test.go

@@ -0,0 +1,28 @@
+package inventory
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+)
+
+// `give` takes only a value nobody but a person has (the review of 2026-10-09, M4): never the module's bus
+// account, which `issue` mints, nor a secret the mesh may make itself.
+func TestOnlyASecretThePersonHoldsIsGivenAtTheDesk(t *testing.T) {
+	m := catalogue.Manifest{Module: "telegram", OwnSecrets: catalogue.OwnSecrets{
+		"telegram-token": {Path: "/s/telegram-token"},
+		"broker":         {Path: "/s/broker"},
+		"session":        {Path: "/s/session", Taken: catalogue.TakenAtStart},
+	}}
+	if err := GivableAtDesk(m, "telegram-token"); err != nil {
+		t.Errorf("the bot token was refused: %v", err)
+	}
+	for _, name := range []string{"broker", "session", "chat-id"} {
+		if err := GivableAtDesk(m, name); err == nil {
+			t.Errorf("%s was givable", name)
+		} else if name != "chat-id" && !strings.Contains(err.Error(), "the mesh makes") {
+			t.Errorf("%s: %v", name, err)
+		}
+	}
+}

internal/inventory/migrations/0086-a-plan-keeps-when-its-merge-was-made.sql

@@ -0,0 +1,10 @@
+-- A plan keeps when the forge made the merge it answers (novox/hq issue 349).
+--
+-- A newer plan of a repository's branch supersedes the older open ones, and "newer" was read from when each
+-- plan was made. A merge the bus did not hand over is acted on late, by the catch-up, so its plan is made
+-- after the plan of a merge that came after it — and superseded it, folding its unbuilt modules into a plan
+-- at the older commit. On 2026-10-09 a security fix to the forge's module would have been built from the
+-- commit before it. Merges into one branch are made one after another, each on the one before, so the
+-- forge's merge time is the branch's order. Null for a plan kept before this column, and for a plan no merge
+-- made (a release); then the plans' own order stands, as before.
+alter table release_plan add column merged_at timestamptz;

internal/inventory/migrations/0087-a-controller-records-what-its-stores-schema-reaches.sql

@@ -0,0 +1,10 @@
+-- A controller records, when it serves, how far the store's schema reaches in the build it is (novox/hq
+-- issue 352): the highest migration it carries, by its build's version. A gate that fails the controller's
+-- build puts the build before it back, and on 2026-10-09 that build was older than the migrations the
+-- failed one had applied: it started, said it was behind its own row, and judged the next gate half-blind.
+-- A put-back now reads this and keeps the current build when the one before it reaches less than the store.
+create table controller_schema (
+    build    text        primary key,
+    reach    integer     not null,
+    recorded timestamptz not null default now()
+);

internal/inventory/nodes.go

@@ -1054,13 +1054,57 @@ type Reported struct {
 	// acted on the current words, not merely spoken after they were written. False also covers
 	// a machine that has not said which, which is every host from before reports carried it.
 	Current bool
+	// Declared is the digest of the declaration the last report was about, and ReportedSequence that
+	// declaration's sequence as the report claimed it (zero from an engine that claims none): what a
+	// gate holds against the send it made, rather than against the send made last (novox/hq issue 352).
+	Declared         string
+	ReportedSequence int64
+}
+
+// SentDeclaration is what one send carried to a machine, as a gate keeps it: the declaration's digest and
+// its sequence (novox/hq issue 352). A report about this declaration, or about one sequenced after it, is a
+// report on what the gate sent — whatever the machine was sent since.
+type SentDeclaration struct {
+	Digest   string `json:"digest"`
+	Sequence int64  `json:"sequence,omitempty"`
+}
+
+// ReportsOn says a report is about this send: the declaration itself; one the same machine was sequenced
+// after it; or the declaration the machine was sent last (Current), which is this send or a later one —
+// sends to a machine are made one after another. A send kept without a sequence is matched by its digest
+// and by the last send alone.
+func (s SentDeclaration) ReportsOn(r Reported) bool {
+	if r.Current || (s.Digest != "" && r.Declared == s.Digest) {
+		return true
+	}
+	return s.Sequence > 0 && r.ReportedSequence >= s.Sequence
+}
+
+// SentTo is the declaration a machine was last sent, by name: its digest and sequence, and false when it
+// was never sent one.
+func (i *Inventory) SentTo(ctx context.Context, name string) (SentDeclaration, bool, error) {
+	var digest *string
+	var seq *int64
+	err := i.store.Pool().QueryRow(ctx, `select sent, sequence from node where name = $1`, name).Scan(&digest, &seq)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return SentDeclaration{}, false, fmt.Errorf("%w: %s", ErrNoSuchNode, name)
+	}
+	if err != nil || digest == nil || *digest == "" {
+		return SentDeclaration{}, false, err
+	}
+	s := SentDeclaration{Digest: *digest}
+	if seq != nil {
+		s.Sequence = *seq
+	}
+	return s, true, nil
 }
 
 // LastReports is every machine's last report beside when it was last sent a declaration.
 func (i *Inventory) LastReports(ctx context.Context) ([]Reported, error) {
 	rows, err := i.store.Pool().Query(ctx,
 		`select n.name, coalesce(r.outcome, ''), r.at, n.sent_at,
-		        r.declared is not null and r.declared <> '' and r.declared = n.sent
+		        r.declared is not null and r.declared <> '' and r.declared = n.sent,
+		        coalesce(r.declared, ''), coalesce(r.reported_sequence, 0)
 		 from node n left join node_report r on r.node = n.id
 		 order by n.name`)
 	if err != nil {
@@ -1070,7 +1114,7 @@ func (i *Inventory) LastReports(ctx context.Context) ([]Reported, error) {
 	var out []Reported
 	for rows.Next() {
 		var r Reported
-		if err := rows.Scan(&r.Node, &r.Outcome, &r.At, &r.Sent, &r.Current); err != nil {
+		if err := rows.Scan(&r.Node, &r.Outcome, &r.At, &r.Sent, &r.Current, &r.Declared, &r.ReportedSequence); err != nil {
 			return nil, err
 		}
 		out = append(out, r)

internal/inventory/plans.go

@@ -19,8 +19,12 @@ type Plan struct {
 	Repository string `json:"repository"`
 	// Branch is the branch the merge went into (novox/hq issue 254): a newer plan supersedes the open
 	// ones of the same repository and branch. Empty for a plan from before it was kept.
-	Branch  string                 `json:"branch,omitempty"`
-	Commit  string                 `json:"commit"`
+	Branch string `json:"branch,omitempty"`
+	Commit string `json:"commit"`
+	// Merged is when the forge made the merge this plan answers (novox/hq issue 349): the order of a
+	// branch's merges, which is not the order their plans were made in when one was acted on late. Zero
+	// for a release, and for a plan kept before it was.
+	Merged  time.Time              `json:"merged,omitzero"`
 	Created time.Time              `json:"created"`
 	Updated time.Time              `json:"updated"`
 	State   string                 `json:"state"`
@@ -122,6 +126,10 @@ type PlanGate struct {
 	To        string   `json:"to,omitempty"`
 	// Since is when the judging began: the first machine reported the new build applied.
 	Since *time.Time `json:"since,omitempty"`
+	// Sent is, per machine, the declaration the gate's send carried there (novox/hq issue 352): what a
+	// machine's report is held against. Absent on a gate kept before it was, which reads the report
+	// against the send made last, as before.
+	Sent map[string]SentDeclaration `json:"sent,omitempty"`
 	// Passes counts the consecutive judgings that found it healthy, LastPass the newest; a judging that
 	// does not resets them.
 	Passes   int        `json:"passes,omitempty"`
@@ -249,8 +257,8 @@ func (i *Inventory) SavePlan(ctx context.Context, p *Plan) error {
 	var revision int64
 	err = tx.QueryRow(ctx,
 		`insert into release_plan (id, repository, commit_hash, created, updated, state, tier, tiers, modules, note,
-		                           branch, tier_entered, revision, epoch, release, delivery)
-		 values ($1, $2, $3, $4, now(), $5, $6, $7, $8, $9, $10, $11, 1, $13, $14, $15)
+		                           branch, tier_entered, revision, epoch, release, delivery, merged_at)
+		 values ($1, $2, $3, $4, now(), $5, $6, $7, $8, $9, $10, $11, 1, $13, $14, $15, $16)
 		 on conflict (id) do update set updated = now(), state = excluded.state, tier = excluded.tier,
 		        tiers = excluded.tiers, modules = excluded.modules, note = excluded.note, branch = excluded.branch,
 		        tier_entered = excluded.tier_entered, revision = release_plan.revision + 1, epoch = excluded.epoch,
@@ -258,7 +266,7 @@ func (i *Inventory) SavePlan(ctx context.Context, p *Plan) error {
 		  where release_plan.revision = $12
 		 returning revision`,
 		p.ID, p.Repository, p.Commit, p.Created, p.State, p.Tier, tiers, modules, p.Note, p.Branch, entered,
-		p.Revision, epoch, release, delivery).Scan(&revision)
+		p.Revision, epoch, release, delivery, mergedAt(p.Merged)).Scan(&revision)
 	if errors.Is(err, pgx.ErrNoRows) {
 		// The row is there and at another revision — moved since this was read, or there already
 		// when this one is new: either way not this writer's to overwrite. (A plan saved before plans
@@ -291,6 +299,14 @@ func short(commit string) string {
 	return commit
 }
 
+// mergedAt is a plan's merge time as the store keeps it: null when not known.
+func mergedAt(t time.Time) *time.Time {
+	if t.IsZero() {
+		return nil
+	}
+	return &t
+}
+
 // OpenPlans is every plan still being worked, oldest first.
 func (i *Inventory) OpenPlans(ctx context.Context) ([]Plan, error) {
 	return i.plans(ctx, `where state in ('building', 'rolling') order by created`)
@@ -301,6 +317,18 @@ func (i *Inventory) RecentPlans(ctx context.Context, limit int) ([]Plan, error)
 	return i.plans(ctx, fmt.Sprintf(`order by created desc limit %d`, limit))
 }
 
+// NewestMergeOf is the plan, in any state, of the newest merge into a repository's branch that the mesh
+// planned: the branch's newest commit the mesh knows of (novox/hq issue 349). False when no plan of it
+// recorded when its merge was made.
+func (i *Inventory) NewestMergeOf(ctx context.Context, repository, branch string) (Plan, bool, error) {
+	plans, err := i.plans(ctx, `where lower(repository) = lower($1) and branch = $2 and merged_at is not null
+		 and release is null order by merged_at desc, created desc limit 1`, repository, branch)
+	if err != nil || len(plans) == 0 {
+		return Plan{}, false, err
+	}
+	return plans[0], true, nil
+}
+
 // PlanByID is one plan.
 func (i *Inventory) PlanByID(ctx context.Context, id string) (Plan, error) {
 	plans, err := i.plans(ctx, `where id = '`+id+`'`)
@@ -313,11 +341,11 @@ func (i *Inventory) PlanByID(ctx context.Context, id string) (Plan, error) {
 	return plans[0], nil
 }
 
-func (i *Inventory) plans(ctx context.Context, tail string) ([]Plan, error) {
+func (i *Inventory) plans(ctx context.Context, tail string, args ...any) ([]Plan, error) {
 	rows, err := i.store.Pool().Query(ctx,
 		`select id, repository, commit_hash, created, updated, state, tier, tiers, modules, note, branch,
-		        coalesce(tier_entered, created), revision, coalesce(epoch, 0), release, delivery
-		   from release_plan `+tail)
+		        coalesce(tier_entered, created), revision, coalesce(epoch, 0), release, delivery, merged_at
+		   from release_plan `+tail, args...)
 	if err != nil {
 		return nil, err
 	}
@@ -327,11 +355,15 @@ func (i *Inventory) plans(ctx context.Context, tail string) ([]Plan, error) {
 		var p Plan
 		var tiers, modules, release, delivery []byte
 		var epoch int64
+		var merged *time.Time
 		if err := rows.Scan(&p.ID, &p.Repository, &p.Commit, &p.Created, &p.Updated, &p.State,
 			&p.Tier, &tiers, &modules, &p.Note, &p.Branch, &p.TierEntered, &p.Revision, &epoch, &release,
-			&delivery); err != nil {
+			&delivery, &merged); err != nil {
 			return nil, err
 		}
+		if merged != nil {
+			p.Merged = merged.UTC()
+		}
 		if len(release) > 0 {
 			if err := json.Unmarshal(release, &p.Release); err != nil {
 				return nil, err

internal/inventory/plans_test.go

@@ -73,3 +73,125 @@ func TestASupersededPlanIsNotOpen(t *testing.T) {
 		t.Fatalf("a superseded plan is not among the recent ones as superseded: %+v", recent)
 	}
 }
+
+// novox/hq issue 349 (review of the follow-up): the newest merge of a branch is the one merged last, whatever
+// order the plans were made in, in any state; a tie is broken by the plan made last; a release, another
+// branch and another repository are never it; and its time is kept to the nanosecond.
+func TestTheNewestMergeOfABranchIsTheOneMergedLast(t *testing.T) {
+	inv := ForTest(t)
+	ctx := t.Context()
+	t0 := time.Date(2026, 10, 9, 10, 0, 0, 0, time.UTC)
+	save := func(id, repo, branch string, merged, created time.Time, state string, release bool) {
+		t.Helper()
+		p := Plan{ID: id, Repository: repo, Branch: branch, Commit: id + "-commit", Merged: merged, Created: created,
+			State: state, Tiers: [][]string{}, Modules: map[string]*PlanModule{}}
+		if release {
+			p.Release = &PlanRelease{}
+		}
+		if err := inv.SavePlan(ctx, &p); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if _, found, err := inv.NewestMergeOf(ctx, "novox/mesh-catalog", "main"); err != nil || found {
+		t.Fatalf("a branch with no plan: %v %v", found, err)
+	}
+	// Made in the other order than merged: the later merge's plan made first, and done.
+	save("plan-later", "novox/mesh-catalog", "main", t0.Add(2*time.Minute+250*time.Millisecond), t0, PlanDone, false)
+	save("plan-earlier", "novox/mesh-catalog", "main", t0.Add(time.Minute), t0.Add(5*time.Minute), PlanRolling, false)
+	save("plan-other-branch", "novox/mesh-catalog", "release", t0.Add(time.Hour), t0, PlanRolling, false)
+	save("plan-other-repo", "novox/mesh-controller", "main", t0.Add(time.Hour), t0, PlanRolling, false)
+	save("release-1", "novox/mesh-catalog", "main", t0.Add(time.Hour), t0, PlanRolling, true)
+	save("plan-unknown", "novox/mesh-catalog", "main", time.Time{}, t0.Add(time.Hour), PlanRolling, false)
+	p, found, err := inv.NewestMergeOf(ctx, "Novox/Mesh-Catalog", "main")
+	if err != nil || !found || p.ID != "plan-later" {
+		t.Fatalf("the newest merge: %s %v %v", p.ID, found, err)
+	}
+	if !p.Merged.Equal(t0.Add(2*time.Minute + 250*time.Millisecond)) {
+		t.Fatalf("its merge time was not kept to the nanosecond: %s", p.Merged)
+	}
+	// The same merge time: the plan made last.
+	save("plan-again", "novox/mesh-catalog", "main", t0.Add(2*time.Minute+250*time.Millisecond), t0.Add(time.Minute), PlanBuilding, false)
+	if p, _, _ := inv.NewestMergeOf(ctx, "novox/mesh-catalog", "main"); p.ID != "plan-again" {
+		t.Fatalf("one merge time, two plans: %s", p.ID)
+	}
+}
+
+// novox/hq issue 352: what a machine was last sent is read back by name with its sequence, a report keeps
+// the declaration it was about and that declaration's sequence, and a gate's sends are kept with the plan.
+func TestASendAndAReportAreKnownByTheirDeclaration(t *testing.T) {
+	inv := ForTest(t)
+	ctx := t.Context()
+	record, err := inv.AddNode(ctx, "anchor")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, found, err := inv.SentTo(ctx, "anchor"); err != nil || found {
+		t.Fatalf("a machine never sent anything: %v %v", found, err)
+	}
+	if _, _, err := inv.SentTo(ctx, "nobody"); err == nil {
+		t.Fatal("a machine that does not exist was answered")
+	}
+	seq, err := inv.NextSequence(ctx, record.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.RecordSent(ctx, record.ID, "d-1", map[string]string{"app": "c1"}); err != nil {
+		t.Fatal(err)
+	}
+	sent, found, err := inv.SentTo(ctx, "anchor")
+	if err != nil || !found || sent.Digest != "d-1" || sent.Sequence != seq {
+		t.Fatalf("sent %+v %v %v", sent, found, err)
+	}
+	if _, err := inv.RecordOrderedDoing(ctx, record.ID, Doing{Node: "anchor", Outcome: OutcomeApplied, Declared: "d-1", Applied: 1},
+		ReportOrder{Sequence: seq, ReportSequence: 1}, func(ReportOrder) bool { return false }); err != nil {
+		t.Fatal(err)
+	}
+	reports, err := inv.LastReports(ctx)
+	if err != nil || len(reports) != 1 || reports[0].Declared != "d-1" || reports[0].ReportedSequence != seq || !reports[0].Current {
+		t.Fatalf("reports %+v %v", reports, err)
+	}
+	// Sent again, unreported: the report is no longer on the last send, and is still on the first.
+	if err := inv.RecordSent(ctx, record.ID, "d-2", map[string]string{"app": "c1"}); err != nil {
+		t.Fatal(err)
+	}
+	reports, _ = inv.LastReports(ctx)
+	if reports[0].Current || !sent.ReportsOn(reports[0]) {
+		t.Fatalf("after a newer send: %+v", reports[0])
+	}
+	at := time.Now().UTC()
+	p := Plan{ID: "plan-352", Repository: "novox/x", Commit: "c", Created: at, State: PlanRolling, Tiers: [][]string{{"app"}},
+		Modules: map[string]*PlanModule{"app": {Gate: &PlanGate{Machines: []string{"anchor"}, Since: &at,
+			Sent: map[string]SentDeclaration{"anchor": sent}}}}}
+	if err := inv.SavePlan(ctx, &p); err != nil {
+		t.Fatal(err)
+	}
+	kept, err := inv.PlanByID(ctx, "plan-352")
+	if err != nil || kept.Modules["app"].Gate.Sent["anchor"] != sent {
+		t.Fatalf("the gate's send was not kept with the plan: %+v %v", kept.Modules["app"].Gate, err)
+	}
+}
+
+// A controller build's reach of the store's schema is kept by its version, and the store's own is read.
+func TestASchemaReachIsKeptByBuild(t *testing.T) {
+	inv := ForTest(t)
+	ctx := t.Context()
+	applied, err := inv.SchemaApplied(ctx)
+	if err != nil || applied < 87 {
+		t.Fatalf("applied %d %v", applied, err)
+	}
+	if _, known, err := inv.SchemaReachOf(ctx, "ad62528c47c7"); err != nil || known {
+		t.Fatalf("an unrecorded build: %v %v", known, err)
+	}
+	if err := inv.RecordSchemaReach(ctx, "", 87); err == nil {
+		t.Fatal("a reach without a build was recorded")
+	}
+	if err := inv.RecordSchemaReach(ctx, "ad62528c47c7", 86); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.RecordSchemaReach(ctx, "ad62528c47c7", 87); err != nil {
+		t.Fatal(err)
+	}
+	if reach, known, err := inv.SchemaReachOf(ctx, "ad62528c47c7"); err != nil || !known || reach != 87 {
+		t.Fatalf("reach %d %v %v", reach, known, err)
+	}
+}

internal/inventory/rootfree_grants_test.go

@@ -0,0 +1,119 @@
+package inventory
+
+import (
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/catalogue"
+)
+
+// grantMatches is a NATS subject pattern matching a subject: `*` one token, `>` the rest.
+func grantMatches(pattern, subject string) bool {
+	p, s := strings.Split(pattern, "."), strings.Split(subject, ".")
+	for i, tok := range p {
+		if tok == ">" {
+			return len(s) > i
+		}
+		if i >= len(s) || (tok != "*" && tok != s[i]) {
+			return false
+		}
+	}
+	return len(p) == len(s)
+}
+
+func grantsAny(patterns []string, subject string) bool {
+	for _, p := range patterns {
+		if grantMatches(p, subject) {
+			return true
+		}
+	}
+	return false
+}
+
+// novox/hq ADR 0259 §8 (confirmation review of 2026-10-09): the router honours a verified sender only on the
+// controller's `root-free` word, asked on the bus. So only the serving controller may answer that verb — be
+// subscribed to its subject — and nobody may publish into the router's inbox but by answering a request it
+// made (allow_responses). Composed here from the controller's own manifest, on a machine where the machine's
+// runtime carries it beside an ordinary module, with the router, a channel, a person and an administrator: a
+// runtime carrying the controller's module, a node-engine, a channel or anybody else answering `root-free` is
+// an agent answering it.
+func TestOnlyTheServingControllerMayAnswerRootFree(t *testing.T) {
+	raw, err := os.ReadFile("../../module.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	controller, err := catalogue.ParseManifest(raw)
+	if err != nil {
+		t.Fatal(err)
+	}
+	parse := func(s string) catalogue.Manifest {
+		m, err := catalogue.ParseManifest([]byte(s))
+		if err != nil {
+			t.Fatal(err)
+		}
+		return m
+	}
+	dir := `"resources": [{"id": "state", "type": "directory", "mode": "0700", "place": "."}]`
+	router := parse(`{"module": "messenger", "version": "1", "runs-as": "messenger",
+	  "seats": [{"name": "operator-channel", "scope": "mesh", "serves": ["open"], "accepts": ["ask"],
+	             "emits": ["decided"], "by-caller": ["ask", "decided"]}],
+	  "claims": [{"name": "operator-channel", "scope": "mesh", "serves": ["open"]}],
+	  "invokes": ["seat:mesh-controller.root-free", "seat:mesh-controller.conditions"],
+	  "own-secrets": {"broker": "${dir:state}/broker"}, "secrets-owner": "messenger",
+	  "resources": [{"id": "account", "type": "user", "name": "messenger", "shell": "/usr/bin/nologin", "home": "/var/lib/messenger"},
+	                {"id": "state", "type": "directory", "mode": "0700", "place": ".", "owner": "messenger"}]}`)
+	ordinary := parse(`{"module": "lab-bystander", "version": "1", "own-secrets": {"broker": "${dir:state}/broker"}, ` + dir + `}`)
+	runtime := catalogue.Manifest{Module: broker.RuntimeModule}
+
+	manifests := []catalogue.Manifest{controller, router, ordinary, runtime}
+	seats := map[string]catalogue.SeatDeclaration{}
+	declarers := map[string]string{}
+	for _, m := range manifests {
+		for _, s := range m.DefinesSeats {
+			seats[s.Name], declarers[s.Name] = s, m.Module
+		}
+	}
+	for _, own := range catalogue.SeatsWithAProtocol() {
+		seats[own.Name] = catalogue.SeatDeclaration{Name: own.Name, Scope: own.Scope, Accepts: own.Accepts,
+			Emits: own.Emits, Serves: own.Serves}
+	}
+	records := broker.Records{Nodes: []string{"anchor", "laptop"}, Assigned: map[string][]broker.Declared{},
+		People:          map[string][]string{"operator": {"*"}, "guest": {"mesh-controller.status"}},
+		Interchangeable: map[string]bool{}}
+	for _, m := range manifests {
+		records.Assigned["anchor"] = append(records.Assigned["anchor"], declaredFor(m, seats, declarers))
+	}
+	// And a second machine whose runtime carries an ordinary module: where agents run as the operator.
+	records.Assigned["laptop"] = []broker.Declared{declaredFor(ordinary, seats, declarers), declaredFor(runtime, seats, declarers)}
+	users, err := broker.Users(records)
+	if err != nil {
+		t.Fatal(err)
+	}
+	const verb = "mesh.seat.mesh-controller.tool.root-free"
+	answerers := 0
+	for _, u := range users {
+		p, err := broker.PermissionsFor(u)
+		if err != nil {
+			t.Fatal(err)
+		}
+		answers := grantsAny(p.Subscribe, verb)
+		if answers != (u.Kind == broker.KindController) {
+			t.Errorf("%s (%s) %s subscribe to %s", u.Username(), u.Kind,
+				map[bool]string{true: "may", false: "may not"}[answers], verb)
+		}
+		if answers {
+			answerers++
+		}
+		// Nobody publishes into the router's inbox but as an answer to what it asked.
+		for _, inbox := range []string{"_INBOX.anchor.messenger.x1.y", "_INBOX.anchor.messenger.>"} {
+			if u.Username() != "anchor.messenger" && grantsAny(p.Publish, inbox) {
+				t.Errorf("%s may publish into the router's inbox (%s) without being asked", u.Username(), inbox)
+			}
+		}
+	}
+	if answerers != 1 {
+		t.Errorf("%d principals may answer root-free, want the controller alone", answerers)
+	}
+}

internal/inventory/schema.go

@@ -0,0 +1,47 @@
+package inventory
+
+import (
+	"context"
+	"errors"
+
+	"github.com/jackc/pgx/v5"
+)
+
+// What a controller build knows of the store's schema (novox/hq issue 352): the highest migration it
+// carries, recorded by its version when it serves, and the highest migration the store has applied. A
+// put-back of the controller to a build that reaches less than the store is refused (gate.go), because
+// such a controller starts behind its own records and judges with what it can read.
+
+// RecordSchemaReach keeps the highest migration the build serving now carries.
+func (i *Inventory) RecordSchemaReach(ctx context.Context, build string, reach int) error {
+	if build == "" {
+		return errors.New("a schema reach is recorded by a build's version, and this controller has none")
+	}
+	_, err := i.store.Pool().Exec(ctx,
+		`insert into controller_schema (build, reach) values ($1, $2)
+		 on conflict (build) do update set reach = excluded.reach, recorded = now()`, build, reach)
+	return err
+}
+
+// SchemaReachOf is the highest migration a build carries, as it recorded when it served; false for a
+// build that never did.
+func (i *Inventory) SchemaReachOf(ctx context.Context, build string) (int, bool, error) {
+	var reach int
+	err := i.store.Pool().QueryRow(ctx, `select reach from controller_schema where build = $1`, build).Scan(&reach)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return 0, false, nil
+	}
+	return reach, err == nil, err
+}
+
+// SchemaApplied is the highest migration the store has applied.
+func (i *Inventory) SchemaApplied(ctx context.Context) (int, error) {
+	var n *int
+	if err := i.store.Pool().QueryRow(ctx, `select max(number) from migration`).Scan(&n); err != nil {
+		return 0, err
+	}
+	if n == nil {
+		return 0, nil
+	}
+	return *n, nil
+}

internal/inventory/secrets.go

@@ -554,6 +554,50 @@ func (i *Inventory) declared(ctx context.Context, module string) (catalogue.Mani
 	return m, nil
 }
 
+// DeclaresOwnSecret refuses, in words, a module the mesh does not know or an own secret its definition does
+// not declare: asked before anybody is asked for a value, so nobody types one the mesh would refuse.
+func (i *Inventory) DeclaresOwnSecret(ctx context.Context, module, name string) error {
+	m, err := i.declared(ctx, module)
+	if err != nil {
+		return err
+	}
+	return GivableAtDesk(m, name)
+}
+
+// RunsAsItsOwnAccount says a module runs as an account of its own (novox/hq ADR 0259 §8): a trusted party — the
+// router, a channel that proves its sender or shows a link's code — whose own secret is what the operator's
+// answers are believed by. Its value is given at the controller's terminal alone.
+func (i *Inventory) RunsAsItsOwnAccount(ctx context.Context, module string) (bool, error) {
+	m, err := i.declared(ctx, module)
+	if err != nil {
+		return false, err
+	}
+	return m.RunsAs != "", nil
+}
+
+// BrokerSecret is the own secret that is a module's bus account, which `issue` mints.
+const BrokerSecret = "broker"
+
+// GivableAtDesk refuses, in words, an own secret a module does not declare, and one the mesh makes itself
+// (the review of 2026-10-09, M4): the module's bus account, which `issue` mints, and any the mesh may make
+// in place of a value given (catalogue.OwnSecret.MeshMayMake). The desk takes only what a person holds and
+// the mesh cannot make — a bot's token — so nobody is asked to type the mesh's own credential into a prompt.
+func GivableAtDesk(m catalogue.Manifest, name string) error {
+	own, ok := m.OwnSecrets[name]
+	if !ok {
+		return fmt.Errorf("%s does not declare %q as an own secret; %s", m.Module, name, declaresOwn(m))
+	}
+	switch {
+	case name == BrokerSecret:
+		return fmt.Errorf("%q is %s's account on the bus, which the mesh makes (`issue`), never a value a person gives",
+			name, m.Module)
+	case own.MeshMayMake():
+		return fmt.Errorf("%q of %s is a secret the mesh makes itself (it may replace a value given at the module's "+
+			"start, ADR 0228); a person gives it only at the controller's terminal, with `secret accept`", name, m.Module)
+	}
+	return nil
+}
+
 func declaresOwn(m catalogue.Manifest) string {
 	if len(m.OwnSecrets) == 0 {
 		return "it declares no own secrets"

internal/link/calls.go

@@ -461,7 +461,7 @@ func kept(args json.RawMessage) json.RawMessage {
 	for k, v := range given {
 		s, isString := v.(string)
 		switch {
-		case k == "values" || k == "secret":
+		case k == "values" || k == "secret" || k == "stdin":
 			out[k] = "(given, not kept)"
 		case k == "line":
 			// A mesh-cli line (ADR 0272): its command word, never the rest, which may carry settings.

internal/link/contracts.go

@@ -47,6 +47,10 @@ var Contracts = map[string]Contract{
 	KindPullUpdated: {Unordered: "a pull request's head, asked to be checked: each head is its own commit, and its " +
 		"verdict is set on that commit alone, so a head heard late is checked and judged as itself and never " +
 		"stands for a newer one (novox/hq to-be 45 §9)"},
+	KindDecided: {Unordered: "the router's word on one ask, by the ask's id: an ask is ended once, by compare-and-set " +
+		"at the router, and the controller acts on it once, recording that it did under the ask's id — so a word " +
+		"heard again, or late, does nothing more (novox/hq ADR 0259)",
+		Tests: []string{"TestAWarrantIsActedOnOnce"}},
 	KindCatchUp: {Unordered: "a catalogue asking what it missed: answered from the record, whenever asked"},
 	KindProvisioner: {Unordered: "a provider's newest word about a consumer, said again every fifteen minutes " +
 		"while it holds (ADR 0224): the condition keeps the last observed, and S8 says when the words stop. " +

internal/link/handacts.go

@@ -49,6 +49,16 @@ type HandAct struct {
 	Kind string `json:"kind,omitempty"`
 	// Carried is what such a push moved, one "module from → to" per module, so the log says it.
 	Carried []string `json:"carried,omitempty"`
+	// Via, Ask, Proofs and RequestedBy are an act the operator chose on a warrant (novox/hq ADR 0234 §8, ADR
+	// 0259): the channel it came through (module and kind, and how the sender was known), the ask's id, the
+	// proofs present (P1, P2, P3), and what asked (a condition's key). By then names the operator as that
+	// kind's identity. Absent from every other act.
+	Via         string   `json:"via,omitempty"`
+	Ask         string   `json:"ask,omitempty"`
+	Proofs      []string `json:"proofs,omitempty"`
+	RequestedBy string   `json:"requested-by,omitempty"`
+	// Outcome is what came of an act recorded after it was done: done, or the verb's refusal.
+	Outcome string `json:"outcome,omitempty"`
 }
 
 // KindRecordedBuilds is a push that only moved recorded builds: the person's word their `record` policy