Register R340: a verb set what every agent session obeys (hq issue 340)

Issue 340 is a core issue and resolves with a replay; the test lives in
mesh-controller and is proved against the commit before #172.

replays/register.go

@@ -430,6 +430,22 @@ var Register = []Replay{
 		Package: "./cmd/mesh-controller", Test: "TestReplay201ThePlansSend",
 		Files: []string{"cmd/mesh-controller/replay201_test.go"},
 		Home:  "mesh-controller", HomeRef: "45a1783ba9a43fd466a518ee85673c701223b517"},
+	// A verb set what every agent session obeys (2026-10-09): the agent's module keeps the managed settings and tool
+	// servers every Claude Code session on a node obeys in a mergeable file, and the settings verb took any key for it
+	// from any caller, so an agent could plant a SessionStart hook in the operator's sessions on every node; an
+	// identity provider's empty runtime configuration took a url of the caller's the same way. The fix's own tests
+	// read what the fix added, so the replay is a test of its own in the controller, written with only what it had
+	// before — a mesh, a registered manifest, an assignment, the settings verb run as a verb and as the terminal runs
+	// it, the inventory's layer — laid over the commit before. Needs a store: MESH_TEST_POSTGRES. Fix is the merge of
+	// its pull request (mesh-controller #172); Home is the commit that added the replay, reachable once its pull
+	// request merges.
+	{ID: "R340", Issue: 340, Kind: InRepository, Repository: "mesh-controller", Fix: "4d60628f37530c23c072011a697e6014de14b3f6",
+		What: "the settings verb took a SessionStart hook in the agent module's managed settings, a tool server of the " +
+			"caller's, and a url for an identity provider's empty runtime configuration, from any caller of the mesh's verbs",
+		Asserts: "through a verb, any change to the layer of a module with a mergeable file not marked trusted: false is " +
+			"refused as the controller's terminal's and leaves the layer as it was; at the terminal it is taken",
+		Package: "./cmd/mesh-controller", Test: "TestReplay340", Files: []string{"cmd/mesh-controller/replay340_test.go"},
+		Home: "mesh-controller", HomeRef: "6f34f8efea28d28c5a68b823df0b0a5cd486905f"},
 }
 
 // Find is the replay of that id, or of that issue.