The bus module's spend record must not be writable by the tool runner. A state declared read-only gets read on the module's own account and the tool runner carrying it (direct get, a watch's consumer) and no publish on its $KV subjects; the process whose bus state names it writes it. The judge rule and the manifest field follow with mesh-sdk's read-only. Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig