S3: the read seat-list answers the operator's sessions and the healers, as its seat says

The node-engine seat's definition names "the operator and the healers" for
both seat-list verbs, and design 47 G keeps it; the read was opened to every
proved caller on a ruling the review withdrew. node-tools stays on both: every
console call is proved as its machine's tool runner (issue 627, issue 1966).

Claude-Session: https://claude.ai/code/session_01JG73KEq4zoDfM9WtYpcQgZ

internal/link/handacts.go

@@ -57,13 +57,13 @@ const (
 	ActSeatListAgain = nodeengine.VerbSeatListAgain
 )
 
-// SeatListCallers are who may call the engine's two seat-list verbs (novox/hq ADR 0636 §7). The read is open to every
-// proved caller: the record limits only the read again, and the list holds nothing secret. The read again answers the
-// operator's sessions and the healers. A call through the mesh MCP server, and nox, is proved only as its machine's tool
-// runner (<node>.node-tools, issue 627), so node-tools stands for an operator's session until a session is proved; without
-// it the verb answered nobody but the healers, and no healer calls it (issue 1966).
+// SeatListCallers are who may call the engine's two seat-list verbs (novox/hq ADR 0636 §7; the node-engine seat's
+// definition: the operator and the healers): every operator's session and the healers, both verbs alike. A call through
+// the mesh MCP server, and nox, is proved only as its machine's tool runner (<node>.node-tools, issue 627), so node-tools
+// stands for an operator's session until a session is proved; without it the verbs answered nobody but the healers, and
+// no healer calls them (issue 1966).
 var SeatListCallers = stdio.VerbCallers{
-	ActSeatList:      {stdio.AnyCaller},
+	ActSeatList:      {stdio.AnyPerson, "node-tools", "mesh-healers"},
 	ActSeatListAgain: {stdio.AnyPerson, "node-tools", "mesh-healers"},
 }
 

internal/link/handover_test.go

@@ -301,12 +301,11 @@ func TestALinkThatHearsHandOversIsGivenTheQueues(t *testing.T) {
 			{"packages", EngineToolSubject("packages", "n1") + " " + `{"write":true}`, `"key":null,"wrote":true`},
 			{"packages", EngineToolSubject("packages", "n1") + " " + `{"write":"true"}`, `"note":"the engine has written no key for this node yet`},
 			{"manifest-reads", EngineToolSubject("manifest-reads", "n1"), `"manifest-reads":["form:a","seat:b"],"node":"n1","stated-at":"2026-11-04T10:00:00Z","v":1`},
-			// ADR 0636 §7: the read seat-list answers every proved caller; seat-list-again every operator's session, proved
-			// as a person or, through the mesh MCP server, as its machine's tool runner (issue 627, issue 1966), and the
-			// healers, no other module.
+			// ADR 0636 §7: both seat-list verbs answer every operator's session, proved as a person or, through the mesh MCP
+			// server, as its machine's tool runner (issue 627, issue 1966), and the healers, no other module.
 			{"seat-list", "mesh.seat.node-engine.call.seat-list.n1.person~jochen", `"held":true`},
 			{"seat-list", "mesh.seat.node-engine.call.seat-list.n1.shanks~node-tools", `"held":true`},
-			{"seat-list", "mesh.seat.node-engine.call.seat-list.n1.ace~messenger", `"held":true`},
+			{"seat-list", "mesh.seat.node-engine.call.seat-list.n1.ace~messenger", `not on the holder's caller list for seat-list`},
 			{"seat-list-again", "mesh.seat.node-engine.call.seat-list-again.n1.shanks~node-tools", `"read":true`},
 			{"seat-list-again", "mesh.seat.node-engine.call.seat-list-again.n1.person~jochen", `"read":true`},
 			{"seat-list-again", "mesh.seat.node-engine.call.seat-list-again.n1.ace~mesh-healers", `"read":true`},