Merge pull request 'Design 47: the bus module is wanted like any module; only a warranted want replaces its server (ADR 0594)' (#505) from docs/774-bus-want into main

03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md

@@ -4,6 +4,7 @@ status: in-progress
 code: [mesh-controller, mesh-catalog modules/mesh-delivery-gate, mesh-delivery, mesh-host, mesh-sdk, mesh-vault, hq 00-META/checks]
 updated: 2026-11-03
 decisions:
+  - "ADR 0594"
   - "ADR 0572"
   - "ADR 0571"
   - "ADR 0570"
@@ -845,6 +846,21 @@ backup holder backs up nothing, and the have says so.
   fingerprint, the digest, the phase and the health after the module's start window. A failed apply is loud,
   retried by the next change of the want or the composition, never by a clock, and fixed forward (ADR 0360 §8,
   ADR 0539 §9).
+- **The bus module is wanted like any module; only a warranted want replaces its server** (ADR 0594, changing
+  ADR 0539 §14 and §15, ADR 0546 §8 and ADR 0565 §7 for the bus module). The assigner writes the bus module's want by
+  the same rules as every module's, and the node agent applies what that want brings (its files, its processes' bus
+  accounts and secrets, its tools) while it keeps the server's container as it runs, with no record ask. Only a want
+  that carries the operator's warrant (a put after the streams' snapshot, or the operator's hand write) replaces the
+  server; until then the bus module's have names the fingerprint applied and the one the server runs, and the view
+  says the server waits. mesh-sdk names the resources the bus's
+  server holds, so the assigner and the node agent read one list; the assigner writes the bus module's want only to a
+  node agent whose have says it keeps the server (the version it reports), so the node agent's keeping of the server
+  is delivered before the assigner's change. Until
+  then nothing writes the bus module's process accounts, and its tools that write to the bus fail (issue 774, the
+  operator, 2026-11-03). How it is checked: a node agent unit test applies a bus module's new want and shows the
+  server's container untouched and the tools' account written; an assigner unit test writes the bus module's want
+  by the rules, holds the server's replacement for a put, and writes none to a node agent whose have does not say it
+  keeps the server.
 - **Every want is owed.** The watchman mirrors every want as a pulse owed by that node's agent until its have
   names the want's fingerprint, so a node that does not move is a stall (ADR 0539 §19).
 - **A move a person must allow is judged by the node and asked by the assigner.** The node agent applies ADR 0377