Design 46 7-approval-mark §22's integration test: the runner's gate wired as main wires it, on a
real bus with stand-ins of the operator channel's router and the hand-act seat: a marked call
asked, approved, run once, recorded, listed; a restart between the run and warranted's answer
recorded once; a Decline runs nothing; no state bound or no holder of operator-channel runs
nothing. It failed first on the act's key: `<node>.act.sha256:<hex>` is a key the bus refuses,
so every marked call was refused on the live bus. The digest is now escaped with
keys.EscapeName (lead answer A-209). The runner's two start tests are one, so the module gains
no test (design 47 G §419, §626).
Builds: design 46 7-approval-mark §13, §22; design 47 G §419, §626; lead answer A-209
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
mesh_wait goes through the runner's approval gate (node-tools/internal/approval, Gate.Waited): a wait whose
subjects overlap a marked subject of any module the catalog half lists (the newest entry of every followed
branch, with the served entry of each module this runner serves) is an act of the runner's own module and
build (MESH_FINGERPRINT at its start), asked once on operator-channel as "Wait on <names> on <node>?", and
held, subscribing nothing but its ask's decided, until its timeout, its caller's going or the choice. On a
warrant it subscribes, its timeout running from then, and answers {answer, approval}. Before the marks are
read nothing is asked; a wait from a seat is never marked. The state fixture moves to meshtest so the
console's table can hold a gate.
Builds: design 34 every-event §34, §35, §36, §37; design 47 G lead answer A-168
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
A marked call is refused, asking nothing, when no module holds operator-channel (read from
the assigner's view of the seats' holders the runner follows, an unread view refusing too);
refused when the served entry cannot be read, the ask cannot be published, the router
refuses it or its record cannot be read; and while the state approvals cannot be read or
written no marked call runs on the machine, the failed read made again at the next marked
call and the next membership change, a bound key raising approvals-unreadable after five
minutes and the read again clearing it. Before the catalog half's first view a call waits
for it within 5 seconds, on the events the runner hears, and is refused naming
mesh_first_views when it is still unread. Each refusal is in the log with the ask's
fingerprint, never the arguments.
Builds: design 46 7-approval-mark §19, §5 (an unread served entry); lead answers A-157, A-154
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
The gate digests a marked call's act (address, node, module and tool or seat and verb,
build, each argument as itself or its canonical JSON), refuses at once and asks nothing
for a secret's shape or more than 16 KiB of arguments, and otherwise asks through
operator-channel's client under the marked module's name, its ask kept in the runner's
state approvals under the machine's keys with the act and the whole arguments, the act's
key naming it. The ask shows each argument whole only where it may leave the mesh, and the
first call answers Not run, with the router's record or without it within 5 seconds.
Builds: design 46 7-approval-mark §8, §9, §10, §11, §12, §13 (keys)
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
jschoubben