Merge pull request 'Design 47's L5 row and the glossary follow ADR 0565' (#492) from docs/0565-homing into main

00-META/glossary.md

@@ -104,7 +104,8 @@ and repair).
 - **upgrade policy** — how a module's new builds reach its nodes: `roll` (one node first, judged, then
   the rest), `together`, or `record` (register the build, send it nowhere)
   (ADR 0236).
-  The controller's verb `upgrade` shows it.
+  The controller's verb `upgrade` shows it until the lease write; from L5's delivery the seat `mesh-wants`,
+  held once by the assigner, answers it too, as `mesh-wants.upgrade`; a person's choice is kept by the assigner, and the bus is never rolled (ADR 0565 §7).
 
 ## Config — the values someone may change
 
@@ -134,6 +135,10 @@ downstream of Module and Placement. **Decided by** ADR 0262, 0277, 0348.
   module has moved to their config names (ADR 0348 §1, issue 630).
   What a "flavor" once varied is a config value or a separate module.
   *Not:* ~~flavor~~
+- **config candidate** — the config declarations a pull request's head adds or changes against the trunk's
+  manifests, kept by the indexer per open pull request in its state `config-candidates`; mesh-config judges
+  it again for the values proposed for that pull request (ADR 0565 §2, §3).
+
 - **predefined key** — a key of the catalog's `predefined.json`, the fixed list of keys for which mesh
   config and node config hold values, each with its type, description, validation and whether it is
   trusted, such as `font-size`. A config value may name the predefined key it falls back to, of its own
@@ -674,10 +679,15 @@ becomes a message). **Decided by** ADR 0227, 0231, 0240, 0252, 0283, 0564.
   channel, to see an answer travel the whole way: its approval performs nothing and is recorded as the
   operator's decision (ADR 0259).
   Not a drill: nothing is broken.
-- **hand-act** — a repair a person made by hand, recorded so the mesh knows it happened.
+- **hand-act** — a repair a person made by hand, recorded so the mesh knows it happened. The **hand-act log**
+  is the stream `acts` of the seat `mesh-hand-acts`, held once by the module mesh-hand-acts, which also records
+  who chose an ask (`warranted`); every recorder calls it, and the controller's own log is read beside it
+  until the lease write (ADR 0565 §10, §11).
 - **take-over** — the operator's approved switch of a job from the controller to the part that replaces it, with a
   way back until the lease write: for the bus's user list, the grants part's list becomes the one loaded (ADR 0547
-  §8); for conditions, the condition keeper's events become the ones the router hears (ADR 0564 §9).
+  §8); for conditions, the condition keeper's events become the ones the router hears (ADR 0564 §9); for
+  config, mesh-config's `take-over` is refused while its `compare` shows a difference between its new source and
+  the controller's mirrors (ADR 0565 §4).
 - **witness** — what rolls a core component back when its new build does not become healthy: never the
   component itself (to-be 45 §8).
 

03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md

@@ -4,6 +4,7 @@ status: in-progress
 code: [mesh-controller, mesh-catalog modules/mesh-delivery-gate, mesh-delivery, mesh-host, mesh-sdk, mesh-vault, hq 00-META/checks]
 updated: 2026-10-28
 decisions:
+  - "ADR 0565"
   - "ADR 0564"
   - "ADR 0559"
   - "ADR 0555"
@@ -1219,7 +1220,7 @@ release reports the controller's code lines against research 063's baseline (acc
 | L3 | Nothing is left with the controller: the vault mints bus accounts and signs, the grants part writes grants, the try is the checker's own verb, placement is read from the catalog alone, and the lease passes to a holder that is no controller (ADR 0547 §11, ADR 0549 §5, §6, ADR 0550 §2); the rest of the controller's code lines is the issue of L2 | — | mesh-controller, mesh-catalog (the vault, the grants part), mesh-delivery | 774 |
 | M1 | A milestone is a record of the issue tracker: each row of a design's milestone table is a milestone record its issues are linked to by `issue-tracker.link`, an issue to at most one, and pull requests and commits to issues the same way; the knowledge base's `progress` reads the milestones from the tracker, not from this table (ADR 0493 §1 to §4) | — (ADR 0493 §13 in part) | hq, mesh-catalog (mesh-issues, mesh-knowledge) | 1781 |
 | L4 | Health leaves the controller: the condition keeper holds the seat `mesh-conditions` and keeps every open condition from the observers' findings, saying today's condition events; the watchman holds `mesh-watchdogs`, its watchdogs pulses, and keeps the dead letters from the lease write; `mesh-self-check` runs the probes and says `checked`; `mesh-healers` heals on events and acts only once the lease names no controller; `status` is the view's derivation; built dark, compared, then switched by the operator's take-over; the bus module gains a tool that removes one named consumer, which the lease write uses (ADR 0564, ADR 0547 §11) | — | mesh-sdk, mesh-catalog (mesh-conditions, mesh-self-check, mesh-healers, the router, mesh-watcher, nats), mesh-delivery (watchman, view, the grants part) | 1952 |
-| L5 | Control records leave the controller: mesh-config keeps each module's declared config and the predefined keys in its own buckets and hears a pull request's config declarations from the indexer; each node agent writes its node's declared packages beside its compositions; the upgrade policy and the bus step are answered by their new owner; the hand-act log (`hand-act`, `hand-acts`, `warranted`) is a stream of a seat of its own; `settings`, `move-config` and `move-placement` go (a decision record first, under research 072; ADR 0348 §9, ADR 0502 §2, ADR 0539 §14, §15, ADR 0547 §11) | — | mesh-sdk, mesh-controller, mesh-catalog (mesh-config, pacman), mesh-delivery (indexer, assigner), the node-engine (`mesh-host`) | 1953 |
+| L5 | Control records leave the controller, and the controller is not changed (ADR 0565): mesh-config keeps each module's declared config in its state `declared` and publishes the predefined keys, which the indexer reads from the forge bridge's messages with each open pull request's config candidate; config switches to that source only on the operator's take-over, refused while `compare` shows a difference; each node agent writes its node's declared packages (the node seat `node-engine`, verb `packages`); the assigner holds the new seat `mesh-wants` with the upgrade policy a person chose and the bus step; the hand-act log (`hand-act`, `hand-acts`, `warranted`) is the stream of the new seat `mesh-hand-acts`, held by a new module in mesh-catalog, which every recorder calls from this delivery with no switch; the checker and the assigner's composition check read the held values of their pull requests from mesh-config's state `kept`; from the lease write a trusted config value is set only on the operator's Approve; `settings`, `move-config` and `move-placement` end with the lease and nothing replaces them. each person's six policy choices are set through `mesh-wants.upgrade` and recorded as hand acts, `upgrade compare` and the assigner's finding `policy-split` show any split, and the lease write waits for `compare` to be empty (ADR 0565 §8). One delivery group, built before the lease write of L3, which waits for the group delivered, the six choices set, mesh-config's `compare` empty and its take-over done, `mesh-wants.upgrade compare` empty, and the readings of ADR 0565 §12 (ADR 0565 §14; ADR 0348 §9, ADR 0502 §2, ADR 0539 §14, §15, ADR 0547 §11) | — | mesh-sdk, mesh-catalog (mesh-config, mesh-hand-acts, pacman, the forge module, claude-code, mesh-knowledge, mesh-conditions, mesh-healers), mesh-delivery (indexer, assigner, checker, grants part, forge bridge), the node-engine (`mesh-host`); mesh-controller is not a member | 1953 |
 | L6 | Provisioning leaves the controller: each node agent writes each handed module's provisioning plan on its own have key, which the vault, the node's provisioner client and every provider read through mesh-sdk instead of the controller's assignments; providers retire and clean up the consumers no plan names by themselves; `rotate` and `issued` are answered by the vault alone (a decision record first for the plan's home; ADR 0349 §10, §12, ADR 0230, ADR 0547 §11) | — | mesh-sdk, the node-engine (`mesh-host`), mesh-tools (the tool runner's provisioner client), mesh-catalog (the vault, the provisioner client, postgres, keycloak, gitea, route-adapter), mesh-controller | 1954 |
 | L7 | History and records leave the controller: builds, artifacts, durations and delivery history are read from the builder's keys and streams; the artifact store's sweep (`collect`, `held`, `mirrors`, `images`) is a seat's own; data readings are node-backup's own state; modules, seats and tools are read from the indexer, placement and the tool runner; no manifest but the controller's reads a controller bucket, so the lease write's check passes (a decision record first, under research 072; ADR 0189, ADR 0547 §11, ADR 0549 §6) | — | mesh-sdk, mesh-controller, mesh-delivery (builder, indexer, view), mesh-catalog (artifact-store-tools, the backup seat's holder, mounts, nfs-server, minio, mesh-watcher), mesh-tools (the tool runner) | 1955 |