The approval unit table's in-memory state held `<node>.act.sha256:<hex>`, a key the live bus refuses, so the table passed while every marked call failed on the bus. meshtest.State now refuses a key outside letters, digits and -/_= in dot-separated names, as the bus does, checked with mesh-sdk's keys.CheckName per name; a row of the refusals table holds it. Builds: design 46 7-approval-mark §13, §22; lead answer A-209 Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
node-tools
The node's tool runtime as a module (novox/hq ADR 0175, to-be 38 WP3). Assigned to a machine, it is one process the host runs from this bundle, as the operator's account: it serves every assigned module's tools and every held seat's verbs on the bus, and answers MCP on the machine's loopback — the console (design 34). The mesh composes the process (which bundles to load, where the credential is, whose machine it is); this manifest says only what the machine must have for it: the interpreter, a place for the credential, the loopback port, and leave to call every tool.
The code is the mesh-tools package in this directory; the module at the repository root,
mesh-tools, builds the images TypeScript bundles are compiled in. See the repository README.