A tool call names the machine it is for, every answer says which machine answered, and a holder's

runtime serves its seat's verbs (novox/hq ADR 0159)

A module on several machines served one subject in one queue group, so a call reached whichever
instance answered first and nobody could ask one machine's instance. Now each instance also serves
its subject with its machine as the last token, `<module>.<tool>@<node>` addresses it, and every
answer carries the machine that gave it: the console lists `node` on every module tool, strips it
into the subject, and appends "answered by <node>" to the answer; `mesh call` prints it.

And a seat's verbs are served by whoever claims the seat: the credential names the claimed seats
and the verbs each promises, the runtime serves each verb with the module's tool of the same name
on the seat's own subject, and the bus — which admits only the holder's subscription — decides where
that serving is real. Design 33 §3 and §4, built.

src/mcp.ts

@@ -118,9 +118,11 @@ export function mcpSurface(bus: Broker, who: string): Surface {
             tools: have.tools.map((t) => ({
               name: `${t.module}.${t.name}`,
               description: t.description ?? `${t.name}, served by ${t.module}`,
-              // The module's own schema, passed through. An empty object is a tool that takes
-              // nothing, which is a real answer and not a missing one.
-              inputSchema: asSchema(t.input),
+              // The module's own schema, passed through — with `node`, the machine to ask when
+              // the module runs on several (novox/hq ADR 0159); a seat's verb takes none, the
+              // seat's scope decides. An empty object is a tool that takes nothing, which is a
+              // real answer and not a missing one.
+              inputSchema: t.seat ? asSchema(t.input) : withNode(asSchema(t.input)),
             })),
             // Silence, named (design 34 §3): the modules the catalogue holds and nothing answered
             // for. Not a tool, so not in `tools`; not dropped either.
@@ -129,16 +131,23 @@ export function mcpSurface(bus: Broker, who: string): Surface {
         }
 
         case "tools/call": {
-          const name = String(request.params?.name ?? "");
-          const args = request.params?.arguments ?? {};
+          const given = String(request.params?.name ?? "");
+          const args = { ...((request.params?.arguments as Record<string, unknown> | undefined) ?? {}) };
+          // The machine, when the caller names one, travels in the subject and never reaches the
+          // module's arguments (novox/hq ADR 0159).
+          const node = typeof args.node === "string" && args.node !== "" ? args.node : "";
+          delete args.node;
+          const name = node && !given.includes("@") ? `${given}@${node}` : given;
           try {
-            const result = await callTool(bus, name, args, await roles());
+            const { result, node: answeredBy } = await callTool(bus, name, args, await roles());
             // Text, because that is what every host renders. The content is the module's answer
             // as JSON, unshaped: an adapter that flattened it would be deciding what matters in
-            // somebody else's answer.
-            return answer(request.id, {
-              content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
-            });
+            // somebody else's answer. Which machine answered follows it as its own line.
+            const content: { type: string; text: string }[] = [
+              { type: "text", text: JSON.stringify(result, null, 2) },
+            ];
+            if (answeredBy) content.push({ type: "text", text: `answered by ${answeredBy}` });
+            return answer(request.id, { content });
           } catch (e) {
             // **An error the agent can act on, not a stack.** isError rather than a protocol
             // failure, because the call was well-formed and the mesh answered it — with a refusal,
@@ -212,3 +221,16 @@ async function* lines(): AsyncGenerator<string> {
   }
   if (buffered.trim() !== "") yield buffered.trim();
 }
+
+/** Every module tool takes an optional `node`: the machine to ask when the module runs on several
+ *  (novox/hq ADR 0159). Added to the listing, stripped before the call, never seen by the module. */
+function withNode(schema: Record<string, unknown>): Record<string, unknown> {
+  const properties = { ...((schema.properties as Record<string, unknown> | undefined) ?? {}) };
+  if (!("node" in properties)) {
+    properties.node = {
+      type: "string",
+      description: "the machine to ask, when this module runs on several; else whichever answers, and the answer says which",
+    };
+  }
+  return { ...schema, type: "object", properties };
+}