A-1 marks: the tool runner derives each served module's marks from the catalog half

The gate (node-tools/internal/approval) derives a module's marked tools and verbs, and the
subjects of its marked events and restricted streams, from its served entry (the build its
composed environment's fingerprint names) and the newest, unioned while they differ, and
the seat definitions' verb marks, which no holder unmarks. A bundle whose marks name a tool
it does not register is not loaded, its finding mark-unserved raised through the runner's
held writer and cleared when a bundle serves it. The first views now start whether or not
the console listens, since the gate reads the catalog half too.

Builds: design 46 7-approval-mark §5, §4 (at load), §3; design 34 every-event §33; lead answer A-154

Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h

node-tools/internal/runtime/runtime.go

@@ -230,6 +230,10 @@ type runner struct {
 	of    map[string]*loadedModule
 	verbs map[string]func() // each module's `tools` verb, where it is answered
 
+	// fingerprintOf is the build a module's bundle serves: the fingerprint its composed environment carries (design 47 G
+	// §424, §618), never the runner's own.
+	fingerprintOf func(module string) string
+
 	seatsAgain func()
 	stops      []func() // the watch, the announcement and the seats, in the order they began
 }
@@ -263,6 +267,7 @@ func Run(conn *bus.Conn, served []Served, envs map[string]map[string]string, log
 
 	base := os.Environ()
 	r.envFor = func(module string) []string { return BundleEnv(base, envs[module], module, node) }
+	r.fingerprintOf = func(module string) string { return envs[module][FingerprintWord] }
 
 	// The module's events, for every child of it that subscribes (ADR 0198): one consumer per module,
 	// bound the first time any of its children subscribes, each event handed to every child that did.
@@ -409,6 +414,13 @@ func (r *runner) load(s Served) *loadedModule {
 			fail(clashed)
 			continue
 		}
+		// A bundle whose marks name a tool it does not register is not loaded: no tool of its module is served here, rather
+		// than one served unmarked that the manifest meant to mark (design 46 7-approval-mark §4).
+		if unserved := r.unservedMarks(module, child.Registrations); len(unserved) > 0 {
+			child.Stop()
+			fail(fmt.Sprintf("its marks name %s, which it does not register (design 46 7-approval-mark §4)", strings.Join(unserved, ", ")))
+			continue
+		}
 		l.children = append(l.children, child.Stop)
 		for _, reg := range child.Registrations {
 			got := registration{module: reg.Module, owner: module, tools: reg.Tools}
@@ -772,6 +784,8 @@ type consumers struct {
 	calls callsInFlight
 	// sessions are the bundles' put and get sessions (sessions.go).
 	sessions sessionTable
+	// gate is the approval gate every call is served through (gate.go); nil serves every call as before.
+	gate Gate
 }
 
 type moduleEvents struct {