Merge pull request 'Amend designs 47, 46 and 51 for pipelines per module and milestone G as one milestone (ADR 0666, ADR 0667)' (#532) from design/086-pipelines into main

2026-11-10 07:20:44 +00:00
parent 6611b94e3d 43eac215d2
commit 38915bbe01
4 changed files with 1119 additions and 111 deletions
@@ -95,7 +95,9 @@ are a published vocabulary, fixed by the manifest's schema. **Decided by** ADR 0
 and repair).
 - **manifest** — the file a module is defined by (`module.json`): what it is, what it provides and
-  requires, the seats it claims, the resources it declares, its tools, its data and its health. Say
+  requires, the seats it claims, the resources it declares, its tools, its data and its health. From the delivery of
  design 47's milestone G it also names its artifacts and, where nothing else says it, each one's dependencies (`needs`),
  and never a pipeline step's status, which is the registration's policy (ADR 0666 §7, §14). Say
  manifest in prose, not the file's name.
  *Not:* ~~module definition~~ (hq)
 - **resource** — one thing a manifest declares a node must have: a file, a directory, a service, a
@@ -306,7 +308,9 @@ controller and the store; for module assignment, by the seat `mesh-module-assign
  Config) are `mesh-config`'s, never part of what the controller records (ADR 0348 §9).
 - **placement** — which module runs on which node, with its pins, host ports and bindings, and what a person
  decided of the node, as one key per node in the state `placement` of the seat `mesh-module-assigner`. It changes only by
-  a placement proposal the operator approves, and no repository holds it or names a node (ADR 0567). Until ADR
+  a placement proposal the operator approves, and no repository holds it or names a node (ADR 0567). From the delivery
  of design 47's milestone G it names, per module, the **watched branch** its node runs, by default the registration's
  first, and may name an earlier build to return to, one value (ADR 0666 §6, §24). Until ADR
  0547's third milestone the controller's assignments are kept equal to it by the holder.
  *Not:* ~~placement file~~ (hq)
 - **mesh-module-assigner** — the seat, held once for the mesh, that keeps placement: its states
@@ -526,28 +530,65 @@ and the operator act. **Recorded by** the controller's `identity` and `licences`
 back when it fails. The domain is continuous integration and delivery, named **delivery**, and its parts live in
 the repository `mesh-delivery` (ADR 0429 §2). **Recorded by** the `mesh-delivery` module (deliveries) and the
 controller (the planner, the rollout) until release 6 of ADR 0429; from each release on, by the parts it builds. **Downstream of** Module, Core, Health and repair and Data.
-**Decided by** ADR 0162, 0218, 0236, 0237, 0238, 0239, 0250, 0267, 0270, 0276, 0323, 0401–0408, 0428, 0429, 0444–0447, 0524–0530, 0539, 0548, 0551, 0571, 0578, 0579, 0593, 0601, 0641, 0644, 0656, 0659.
+**Decided by** ADR 0162, 0218, 0236, 0237, 0238, 0239, 0250, 0267, 0270, 0276, 0323, 0401–0408, 0428, 0429, 0444–0447, 0524–0530, 0539, 0548, 0551, 0571, 0578, 0579, 0593, 0601, 0641, 0644, 0656, 0659, 0666, 0667.
 **Uses:** module, node, declaration and send (Core), health (Health and repair), person.
 - **pipeline** — the pipeline steps run for one commit, or one group, of a module on one of its watched branches, by
  the seat `mesh-pipeline-runner`, before the commit is delivered (ADR 0666 §1, §7): each step asked of the seat that
  serves it, its end heard as an event, the pipeline's end said as `pipeline-ended` with every step's result, from
  which alone the assigner writes a want. From the delivery of design 47's milestone G. Not a **delivery**, the commit
  on its way; and *check* is no longer the word for a bundle of steps (research 086).
 - **pipeline step** — one action run on a module's commit before it is delivered: lint, unit tests, integration tests,
  composition, code review or approval (ADR 0666 §7). Its outcome is `passed`, `failed`, `nothing to run`, `bypassed`,
  `carried`, `could not run`, `accepted`, `superseded` or `cancelled`, or it waits on a person (design 47). Always written
  whole here, never *step* alone: see [Homonyms](#homonyms).
 - **policy** — a module's statuses of its pipeline steps, per artifact: `required` (runs, holds the delivery until it
  passes), `optional` (runs, a failure shown and holding nothing) or `bypass` (nothing runs), kept in its registration
  and never in a manifest (ADR 0666 §7). Not the **upgrade policy** (Module), how a module's builds reach its nodes (see
  [Homonyms](#homonyms)).
 - **registration** — a module's entry in the catalog: its git origin, the path of its manifest, its watched branches and
  its policy, kept by the seat `mesh-catalog`, every version with who changed it and on whose Approve;
  registering and changing one are trusted acts (ADR 0666 §2). The mesh knows modules, and a repository only as a
  module's git origin.
 - **watched branch** — a branch a module's registration names, whose commits start that module's pipeline and which a
  placement may choose for a node; registering one the forge does not protect is refused (ADR 0666 §3, §6).
 - **run on request** — a pipeline run for a named commit or group that delivers nothing, asked by the runner's verb
  `run`; the indexer builds its candidate from the runner's `run-started` (ADR 0666 §18).
 - **artifact reference** — an artifact written `<module>:<artifact>`, such as `mesh-grants:program`: the end of a
  dependency edge of the catalog graph (ADR 0666 §14).
 - **mesh-pipeline-runner** — the seat, held once for the mesh, that runs each pipeline: it reads the policy from the
  registrations, asks each pipeline step of the seat that serves it, says each step's start and end and each pipeline's
  end as its events, keeps each pipeline's state and step log on the bus, and serves the run on request (ADR 0666 §7,
  §11). An acting part of the step `pipeline` (design 47). Of this domain: its contract is in `mesh-delivery-contracts`.
 - **mesh-builds** — the seat, held once for the mesh, whose holder numbers a package's version when it is published and
  says the publication as its event `package-published`, on which every artifact built against the package is rebuilt
  and its pipeline started (ADR 0666 §15; design 51). Of this domain: its contract is in `mesh-delivery-contracts`.
 - **composition step** — the pipeline step that composes each machine's declaration with a change, by the composer built
  from its heads in the sandbox, refusing a change in which two modules own one path; served by the seat `mesh-wants`
  (ADR 0666 §17). From milestone G's delivery it replaces the **composition check**.
 - **merge check** — what a pull request carries before it may merge, judging the merge of its head into a
  named **trunk commit**, made in a clone of its own on a build node and never pushed (ADR 0323). One status,
  `mesh/check`, written by the checker: the change's tests, run by the language's build module, and the
  **composition check**; for a delivery group, one verdict on every member's head (ADR 0445, ADR 0447). Before
  release 4 of ADR 0429 a pull request carried two statuses, one for the modules the change touches and one
-  for the repository's own script (ADR 0238).
+  for the repository's own script (ADR 0238). Goes at the delivery of design 47's milestone G, the **pipeline** in its
  place (ADR 0666 §17); the word goes to the *pipeline* entry's *Not:* line with the as-is update after that delivery.
 - **catalog graph** — the modules as their manifests declare them at one revision (bases, packages, provides and
  requires, invokes and serves), with the acting rules the seats declare; the indexer keeps it, one
  revision per source revision it takes in (ADR 0656). Its other name is **module graph**, the word for it before
  ADR 0656, from which each delivery part orders a source revision by its own rule: provisions, bus state, a served
  verb and a reader's capability are waited on; a package, and until research 085's milestone a build module's
  change, are triggers that rebuild, never waits; a verb edge on a cycle is left out (ADR 0603 §1, §2, ADR 0614); from research 085's milestone an acting part's edge is a wait within
-  its step (ADR 0656). Nothing stores the order. Not the **assignment graph**, computed from it.
+  its step (ADR 0656). From milestone G's delivery it is kept once per **watched branch**, and its edges run between
  **artifact references**, of six kinds, the reverse order holding when something goes away (ADR 0666 §6, §14).
  Nothing stores the order. Not the **assignment graph**, computed from it.
  *Not:* ~~build graph~~
 - **assignment graph** — the module versions placed on nodes at one revision, with the edges between versions that
  its inputs give: provisioning, contribution, and the acting parts' versions that are to act on each entry. The
  assigner computes it from the catalog graph, the placements and the nodes' capabilities, and nothing else writes it;
  it keeps each revision naming the revisions of its inputs, served by the seat `mesh-wants`, and writes the wants
-  from a trunk revision's alone (ADR 0656). Not the **catalog graph**, whose entries are modules, not
+  from a trunk revision's alone (ADR 0656), from milestone G's delivery from a revision of the watched branch a
  placement chose whose `required` pipeline steps passed (ADR 0666 §9). Not the **catalog graph**, whose entries are modules, not
  versions on nodes; not an **assignment**, one module put on one node.
 - **mesh-wants** — the seat, held once for the mesh, that keeps what each node should run, one want
  per node and module (`want.<node>.<module>`), and a person's upgrade policy, served as its verb `upgrade`
@@ -555,7 +596,8 @@ controller (the planner, the rollout) until release 6 of ADR 0429; from each rel
  `mesh-delivery-contracts` (ADR 0641 §2).
 - **acting part** — the holder of a seat whose definition carries a rule: the step its holder acts in and the modules
  it acts on (ADR 0656), in the field `acts` (design 47): the indexer, the checker, the build modules, the
-  node-engine, the grants part, the assigner. Within a revision its new version acts first in its step, a wait with a
+  node-engine, the grants part, the assigner; from milestone G's delivery the holder of `mesh-pipeline-runner` in the
  checker's place (ADR 0666 §19). Within a revision its new version acts first in its step, a wait with a
  bound (ADR 0656); when it fails or is late, the modules it was to act on stay on their running builds and a
  condition names it (design 47). Not every
  **part**: an acting part may be any module that holds such a seat, a build module among them.
@@ -570,40 +612,46 @@ controller (the planner, the rollout) until release 6 of ADR 0429; from each rel
  and says so (ADR 0656). The node-engine reads only the catalog half, beside its want (design 47).
 - **delivery record** — the gate's record of one milestone's delivery, a ledger instance it alone writes: the group's
  state (heads, verdicts, checks, asks), the trace (milestone, issues, pull requests, commits, the assignment graph
-  revisions it moved between) and what happened to each entry on each node (ADR 0656). It holds no tiers and nothing
+  revisions it moved between) and what happened to each entry on each node (ADR 0656); from milestone G's delivery the
  pipelines' step and pipeline events in place of the verdicts, checks and asks (ADR 0666 §9). It holds no tiers and nothing
  else orders by it. Not a **delivery**, one commit on its way.
 - **checking program** — the rules every check applies, built from the change's heads (ADR 0656, ADR 0644) and run in
  a build seat's sandbox (ADR 0448 §2) with the revision view as its input and no bus account; the running checker
  only asks for it, reads its verdict, records and publishes it (design 47). Not the **checker**, the part that asks for it.
  Goes with the checker at milestone G's delivery: its rules become the indexer's validation and cycle rule and the
  **composition step** (ADR 0666 §17).
 - **composition check** — whether the machines a change touches still compose with it, run by the assigner
  from the modules the indexer and the builder hold, with the composition of `mesh-delivery-sdk`, the one the controller
  composes with
  (ADR 0446). It replaces the controller's check of that kind, which composed every machine from release 4 of
-  ADR 0429 back (issue 1303).
+  ADR 0429 back (issue 1303). Becomes the **composition step** at milestone G's delivery; the word then goes to that
  entry's *Not:* line with the as-is update.
  *Not:* ~~merge gate~~ (hq)
 - **kept verdict** — a package's passing verdict at one test level, kept by the checker under the digest of
  everything its tests read, written once and read-only; a check takes it instead of running an unchanged
-  package (ADR 0444).
+  package (ADR 0444). From milestone G's delivery the pipeline runner keeps it, and a test step takes it (ADR 0666 §8).
 - **carried verdict** — a delivery's verdict moved to a newer trunk commit, or a newer sibling commit, by its
  package digests: the checker merges the head onto the new commit and runs only the packages whose digest the
  move changed, keeping the composition while no composed fingerprint changed; the verdict names the commits it
  was carried from (ADR 0548 §5, §6). A head git refuses onto the new commit is not carried: its next check is
-  whole (ADR 0548 §7).
+  whole (ADR 0548 §7). From milestone G's delivery the pipeline runner carries a step by its package digests (ADR 0666 §8).
 - **try** — the checker's run of a delivery group's check on one or more members, each a repository at an exact
  commit, before or without a pull request: the same examiner as the group's check, stricter in that a missing
  candidate or a node's missing composition answer ends it as error, and owing the forge no status and no Approve.
  It keeps the verdicts of the packages it passed for the check to take (ADR 0637). Asked only when the operator
-  asks for one (ADR 0637 §6).
+  asks for one (ADR 0637 §6). Goes at milestone G's delivery, the **run on request** in its place (ADR 0666 §18); the
  word goes to that entry's *Not:* line with the as-is update after that delivery.
 - **trunk commit** — the commit of the trunk a merge check's verdict was judged against: the trunk's head when
  the build module cloned it. The verdict holds for that commit only, goes out of date when the trunk moves, and
-  is then carried to the new commit (ADR 0323, ADR 0548).
+  is then carried to the new commit (ADR 0323, ADR 0548). Goes at milestone G's delivery with the merge check: a pipeline
  runs on a commit of a **watched branch**, and the word goes to that entry's *Not:* line with the as-is update after it.
 - **merge turn** — an approved merge's key on a repository in the gate's `turns` bucket: the deliveries waiting
  to merge there in the order of their Approve, and the check each waits for. It holds new checks off that
  repository until the merge is done (ADR 0548 §3). Written only while the check gates merges (the gate's
  setting `check-gates-merge`); while it does not, no turn is written and an approved merge goes in at once
  (ADR 0551 §1). Goes at research 085's milestone with the hold and the setting, once the record that ends them is
-  accepted (the operator, 2026-11-09; design 47); the word goes to a *Not:* line with the as-is update after that
+  accepted (the operator, 2026-11-09; design 47; ADR 0661); the word goes to the *pipeline* entry's *Not:* line with the
-  delivery.
+  as-is update after milestone G's delivery.
 - **build seat** — a language's node seat, held on a node by that language's build module: `node-build-go`,
  `node-build-node` and `node-build-image` (ADR 0525 §2). Its accepted kinds are the **build streams**, and its
  verbs `current`, `pause` and `resume` serve that node's pulls. It replaces the seat `node-build-agent`, retired
@@ -682,8 +730,10 @@ controller (the planner, the rollout) until release 6 of ADR 0429; from each rel
  ADR 0250,
  ADR 0270). From release 6 of ADR 0429 the gate keeps the merge's states alone (`proposed`, `ready`,
  `rejected`, `held`, `merged` and `closed`), and a merged delivery is delivered when its source revision is,
-  derived from the wants and the haves (ADR 0539 §17). Not *change* (a diff). *Pipeline* is the predecessor's build-and-deploy
+  derived from the wants and the haves (ADR 0539 §17). From milestone G's delivery a commit's states before it is
-  mechanism, which the as-is designs describe; it is never a word for a delivery.
+  delivered are its **pipeline**'s steps, and the gate keeps no merge states (ADR 0666). Not *change* (a diff), and
  not a *pipeline*, which is what runs on a commit before it is delivered (below); the as-is designs' word for the
  predecessor's build-and-deploy mechanism is theirs.
  *Not:* ~~deployment~~ (hq)
 - **covered** — the end of a delivery that a later merge containing it delivered: every module it moves was
  sent to every machine running it by the rollout of a later merge into the same trunk, delivered on its own
@@ -693,7 +743,10 @@ controller (the planner, the rollout) until release 6 of ADR 0429; from each rel
  covers the older merges of its repository (ADR 0539 §17).
 - **delivery group** — two or more deliveries sharing a pull request head branch name across the mesh's
  repositories, delivered as one unit in an order declared (`after:`) or inferred by the planner. One
-  level: a group holds deliveries, never groups. Its state is derived from its members, never set.
+  level: a group holds deliveries, never groups. Its state is derived from its members, never set. From milestone G's
  delivery: a shared branch name carrying its issue number, complete when each member's commit has landed on its
  modules' watched branch, taken in as one source revision of that branch and run as one pipeline per watched branch
  (ADR 0666 §13).
 - **hotfix** — one pull request in one repository, delivered at its merge (ADR 0401).
 - **feature** — one branch name across its repositories: in two or more, its pull requests are one delivery group,
  merged together and delivered member by member in the group's order; in one, a single pull request delivered as a
@@ -735,7 +788,8 @@ controller (the planner, the rollout) until release 6 of ADR 0429; from each rel
  agent** (the node-engine's own process, applying its wants), the **watchman** (presence and pulses; it also holds the
  Health seat `mesh-watchdogs`, whose watchdogs are pulses, and keeps the dead letters, ADR 0564 §4, §5) and the
  **status view** (`mesh-delivery-cli` and a web view, writing only its answers to asks and saying the events
-  `delivered`, `moving`, `settled` and `stuck`, derived from the keys). The reviewer is the review
+  `delivered`, `moving`, `settled` and `stuck`, derived from the keys), and from milestone G the **pipeline runner**
  (the holder of `mesh-pipeline-runner`, ADR 0666 §7), in the checker's place at its delivery. The reviewer is the review
  agent's session, not a part. Built over releases 1 to 6 of ADR 0429.
 - **manifest validator** — the indexer's rules that judge each manifest before anything of it reaches a node: strict
  decoding, the seat and namespace rules, the bus and stream limits and the whole-catalog checks. It refuses a
@@ -746,17 +800,23 @@ controller (the planner, the rollout) until release 6 of ADR 0429; from each rel
  module that only the indexer and the checker use, never mesh-sdk's (ADR 0578 §4, ADR 0593 §1): the merge check
  runs the trunk's in its sandbox over the manifests a change touches, failing only on a problem in a manifest the
  change alters or one between manifests that an altered manifest takes part in, and
-  a group that changes it runs the one built from its own head (ADR 0578 §2, ADR 0579 §2).
+  a group that changes it runs the one built from its own head (ADR 0578 §2, ADR 0579 §2). From milestone G's delivery
  the indexer alone runs it: the validator built from a revision's heads judges that revision in the sandbox before any
  take-in, on every watched branch, and refuses a manifest that names a pipeline step's status (ADR 0666 §6, §7).
  *Not:* ~~the judge / a judge / its judge / no judge / judge's / own judge / whose judge / same judge / indexer's judge / trunk's judge / running judge / older judge / newer judge / stricter judge~~ (hq)
- **fingerprint** — what identifies a module's build by its content: a hash over its source files, its
+- **build-input fingerprint** — what identifies a module's build by its content: a hash over its source files, its
  manifest and the fingerprints of its build-time inputs, so equal content gives an equal fingerprint whatever
  the commit (ADR 0429 §5). It is today's source fingerprint with a base entering by its module's
  fingerprint, and a build resolving packages by its lock; from R4g the builder is no input of any fingerprint (ADR 0530). From
-  release 4 a build's key, so one source is never built twice.
+  release 4 a build's key, so one source is never built twice. Its meaning is kept from ADR 0429 §5, and the name says
  what it hashes beside an artifact's digest (research 086); *fingerprint* alone stays its short form where no other
  fingerprint is meant.
 - **source revision** — one revision of the key `source.main`, written only by the gate: every repository's
  merged head and the group that moved it. A group reaches the mesh as one source revision (ADR 0429 §11); a
  source revision is **delivered** when every want equals its module's fingerprint and every have equals its
-  want and is healthy, derived from the keys and recorded by no part (§1).
+  want and is healthy, derived from the keys and recorded by no part (§1). From milestone G's delivery there is one
  per **watched branch**, the key `source.<branch>` in place of `source.main`, served by the seat `mesh-delivery`'s verb
  `source`, and each want names a build-input fingerprint computed at one such revision (ADR 0666 §6).
 - **pending revision** — a source revision the running indexer has not taken in, because it names another build of
  the indexer or follows one that does: only the named indexer's own keys are written, the rest kept in the
  indexer's state `pending` until that indexer starts and takes it in (ADR 0633 §1 to §3). A group's members wait
@@ -816,7 +876,10 @@ controller (the planner, the rollout) until release 6 of ADR 0429; from each rel
  delivery part and the gate reach the forge: reads (`pull`, `open-pulls`, `tags`, `trees`, `file`, `contains`,
  `statuses`) for the parts that declare them, acts (`status`, `comment`, `view`, `note`, `merge-pull`) for the forge
  bridge alone, as the holder's trusted value `callers` names, and the forge's events (`pull.*`, `forge.*`,
-  `repo.writable`) as the seat's (design 47, *The verbs*). Not the **forge** itself, the server, nor the forge module's own tools.
+  `repo.writable`) as the seat's (design 47, *The verbs*). From milestone G's delivery `merge-pull` is a session's
  merge, refused only for a head at whose fingerprint a run failed a `required` step, a head that moved or an unprotected branch
  (ADR 0666 §11), the read `branch` and the event `branch-moved` say a branch's head and protection, and the callers per
  verb are the seat definition's (ADR 0666 §20). Not the **forge** itself, the server, nor the forge module's own tools.
 ## Health and repair — what is wrong, and putting it right
@@ -851,7 +914,8 @@ becomes a message). **Decided by** ADR 0227, 0231, 0240, 0252, 0283, 0564.
  and the watcher that raises a condition when it stops (to-be 45 §3).
 - **condition** — one open fact about something the mesh owns that is wrong, with a key and a severity;
  raised and cleared only by observation
-  (ADR 0231).
+  (ADR 0231). A pipeline step or a watched branch's head standing still five minutes is one, from the watchman's
  finding `pipeline-stands`; a step waiting on a person is not (ADR 0666 §24).
  What a wrapped dashboard raises is its own; the mesh's notion is a condition.
  *Not:* ~~alert~~ (hq)
 - **self-check** — the mesh's own examination of itself, run on demand and on a schedule (to-be 45 §4), held
@@ -899,7 +963,10 @@ becomes a message). **Decided by** ADR 0227, 0231, 0240, 0252, 0283, 0564.
  person (ADR 0232).
 - **bus state** — what a module keeps on the bus, asked for in `requires` as a provision of the bus module, by a
  template and its options; created by the bus module and reached by the owner's account alone. Another module
-  asks the owner's tools for its data, or hears its declared events (ADR 0595, ADR 0596).
+  asks the owner's tools for its data, or hears its declared events (ADR 0595, ADR 0596). A value is never refused for
  its size: one over the bus's per-value limit is kept in the object store beside its state, `<state>-objects`, granted
  to its owner alone, its name in the key, and a reply or an event over the per-message limit carries the object's
  name (ADR 0666 §16).
 - **`bus-state`** — the provision of the bus module that every bus-state entry of a manifest requires, so the module
  graph orders the bus module's build before a module asking bus state (ADR 0614 §5). Provided by the holder of the
  seat `mesh-broker`.
@@ -1007,7 +1074,10 @@ asking, never the act. **Decided by** ADR 0152, 0175, 0234, 0259, 0272, 0383, 03
 - **ask** — a request for the operator's input, of a declared kind (yes-no, one-of, text, number,
  date, acknowledge). An **authorising ask** is one whose chosen option its asker performs. The router
  holds every ask, checks each answer's proofs and issues a **warrant**; the asker acts on it with its
-  own grants (ADR 0234, ADR 0259).
+  own grants (ADR 0234, ADR 0259). No ask is hidden: an asker has at most three offered at once, a newer ask with the
  same `about` replaces its open one, and a fourth is offered while the oldest waits, never the newest (ADR 0666 §12;
  design 46 §6). From the delivery of design 47's milestone G the operator's approval of a delivery is the pipeline
  step `approval`, asked as an ask like any other, and no merge is asked (ADR 0666 §10).
 - **warrant** — the router's record that a person chose one option of one ask: the ask, the option,
  who chose (the operator, as a channel kind's identity), through which channel, the proofs and when,
  published for that asker alone. The only thing an asker acts on (ADR 0259).
@@ -1268,6 +1338,7 @@ renaming one sense, the old sense moves to a *Not:* line and becomes mechanical.
 | composition | one module's resources for one node at one fingerprint, signed, from release 6 | **composition** | Core |
 | | the function in `mesh-delivery-sdk` that composes them, which the node agents, the assigner and the grants part run (ADR 0635 §4) | **the composition of `mesh-delivery-sdk`** | Core |
 | | whether the machines a change touches still compose | **composition check** | Delivery |
 | | the pipeline step that composes each machine's declaration with a change, from milestone G's delivery | **composition step** | Delivery |
 | membership | the subjects a bus account is issued | **membership** | Provisioning |
 | binding | the names on the bus of a module's bus state, in its membership | **binding** of bus state | Data |
 | | a consumer's tie to the data a provider keeps for it | **sticky binding** | Data |
@@ -1296,6 +1367,12 @@ renaming one sense, the old sense moves to a *Not:* line and becomes mechanical.
 | | the check of what a change makes of the machines it touches, a pull request status until release 4 of ADR 0429 | ~~merge gate~~ (hq); the **composition check** | Delivery |
 | | the part that merges a group and moves the source revision | **gate part** (`mesh-delivery-gate`) | Delivery |
 | | a failed step stopping its module's later steps (ADR 0136) | *a failed step holds its module* | Core |
 | policy | how a module's new builds reach its nodes (`roll`, `together`, `record`) | **upgrade policy** | Module |
 | | a module's statuses of its pipeline steps, kept in its registration | **policy** | Delivery |
 | step | an action run on a module's commit before it is delivered | **pipeline step**, always whole | Delivery |
 | | the step an acting part acts in (`take-in`, `build`, `compose`, …) | an acting rule's **step** | Delivery |
 | | a step a person starts, like the bus's | **planned step** | Core |
 | | a step of a rollout | **tier** | Delivery |
 | tier | a level of the mesh | **layer** | Core |
 | | a step of a rollout | **tier** | Delivery |
 | | how much proof an ask needs | **assurance level** | Identity and access |
@@ -1327,7 +1404,7 @@ renaming one sense, the old sense moves to a *Not:* line and becomes mechanical.
 | draft | a record's version being written, held by one author | **draft** | The record |
 | | a clause the import's judgement wrote from prose | **drafted** clause | The record |
 | | the predecessor's operational memory, in older playbooks (issue 430) | none: it no longer exists | — |
-| check | a pull request's two statuses, until release 4 of ADR 0429 | **merge check**, **repository check**; from release 4, `mesh/check` | Delivery |
+| check | a pull request's two statuses, until release 4 of ADR 0429 | **merge check**, **repository check**; from release 4, `mesh/check`; from milestone G's delivery, the **pipeline** | Delivery |
 | | whether the machines a change touches still compose, the assigner's | **composition check** | Delivery |
 | | a delivery group's verdict | **composed check** | Delivery |
 | | the mesh's own examination | **self-check** | Health and repair |
@@ -2,8 +2,10 @@
 layer: to-be
 status: in-progress
 code: [mesh-controller, mesh-tools, mesh-sdk, mesh-catalog]
-updated: 2026-11-06
+updated: 2026-11-10
 decisions:
  - "ADR 0667"
  - "ADR 0666"
  - "ADR 0347"
  - "ADR 0345"
  - "ADR 0344"
@@ -221,7 +223,20 @@ when the title and the note alone do not fit, and says that too.
 ### Limits, batching, history
- An asker holds **at most three open asks**; a fourth is refused in words.
+- An asker holds **at most three open asks**; a fourth is refused in words. *Amended 2026-11-10, ADR 0666 §12, from the
  delivery of design 47's milestone G:* **no ask is hidden, and the newest is never held back.** An asker still has at
  most three asks offered at once, but a fourth is offered, not refused: the oldest of its offered asks is held back
  instead, kept open with its answer tickets withdrawn, its message edited to say it waits behind newer asks of the
  same asker, and offered again, with new tickets, as soon as one of the three ends. An ask with the same `about` as an
  open one of the same asker replaces it (§10), so a held-back ask is never one a newer ask already stands for. `asks`
  lists each asker's held-back asks with since when, and the router's tool `ask-again` offers one now, holding back the
  oldest offered one in its place. A Decline ends an ask like any answer, and its asker may ask again at once: the
  pipeline runner's verb `ask-again` asks a declined `approval` step so (design 47, *Approval is a step*). Why the
  oldest: the newest is what the asker needs now, and the oldest has had the operator's eye longest; holding it back
  edits its message rather than removing it, so the operator still sees it waits. *How it is checked:* the router's
  whole-module test offers a fourth ask and holds back the oldest, offers the held-back one again when one ends,
  replaces an open ask by a newer one with the same `about`, and offers an ask after a Decline; live, a fourth ask and
  a declined approval each reach the operator (design 47, test 71).
 - Asks count against the router's hourly cap, as messages do; answers do not.
 - Asks to one channel within the burst window go out together under a heading ("3 questions waiting"),
  each as its own message, answerable and editable alone.
@@ -424,7 +439,8 @@ what it does in plain words, its assurance level (`acknowledge`, `approve`, `des
 answer (`operator`); an expiry; what happens on expiry, in words; and optionally what it is about (a
 condition's key), so a newer ask about it replaces the older. It is refused at once, on its asker's
 `decided` subject, when its words break a rule, when no ready channel can carry one of its options' levels,
-or when the asker already has three open.
+or, until the delivery of design 47's milestone G, when the asker already has three open; from that delivery a fourth
 is offered and the asker's oldest held back (§6, *Limits, batching, history*; ADR 0666 §12).
 **A warrant** carries the ask's id and asker, the option, `by` ("the operator, via telegram, user id
 verified"), the channel module, the proofs, the level met and when. No secret. An ask that ends without one
@@ -577,7 +593,8 @@ runner's bus permissions.
  refused and said: waiting, declined (not asked again for 10 minutes), expired, already run, or the router's
  refusal.
 - **Fail closed:** a secret's shape in an argument or more than 16 KiB of arguments, no operator channel, a
-  fourth open ask, an unpublished ask, an unreadable router record, node file or mark: nothing runs.
+  fourth open ask (until design 47's milestone G is delivered, after which a fourth is offered and the oldest held
  back, §6), an unpublished ask, an unreadable router record, node file or mark: nothing runs.
 - **The controller** enforces the same mark on its own verbs, asking as `mesh-controller`.
 - **Marked first:** `node-login-shell.execute` on every node once the reads it carried have tools (issue 418).
  `mesh-delivery.release` waits until a warrant the controller holds passes the mark of a verb it calls (issue
@@ -702,6 +719,7 @@ Each phase ends at its own *done when*. Owning repositories from [`repos.md`](..
 | **5 — Authorise, with TOTP** | `authorises` in the verb table; the router's checks for the code; direct calls refused, break-glass; `retire approve` takes `expect`; the hand-act fields; the TOTP seed as the router's state, enrolled at a terminal with ten recovery codes; `factor recover`, `factor status`, the local-only break-glass enrolment; no P2 tier before recovery codes exist; optional key enrolment; the self-check probe for the away channel; agents' grants lose the authorising verbs | mesh-controller; mesh-catalog (agents' grants, the desk's code prompt) | one controller test per refusal passes; at the desk, approve needs a code; a recovery drill re-enrols with a recovery code, and is announced |
 | **6 — Telegram live** | the `telegram` module (built in 5a) with replies and forced-reply codes, under its own account on the control node; the operator's two bots configured; the watcher assigned off the control node; the dead-man ping | mesh-catalog | the self-check says the away channel carries every tier; rehearsals: an approve and a destroy answered on the phone, with the hand-acts read |
 | **7 — A call that needs approval** (ADR 0286) | `needs-approval` in the manifest and the seat list, issued in the membership, withheld from a runner without `approval-mark/1` in its bus permissions (controller); the act's digest in TypeScript beside Go, with shared vectors (shared library); the check, the ask, the runner's `approvals`, the node's used file and `warranted` (tool runner); the controller's own verbs; `execute` marked (the controller's seat list) once issue 418's reads exist | mesh-controller, mesh-sdk, mesh-tools, mesh-catalog | a marked call on a node is asked on the phone, does nothing, runs once when made again after Approve, is refused the third time and asked again, and `hand-acts` shows the warrant |
 | **8 — No ask hidden** (ADR 0666 §12), delivered with design 47's milestone G | a fourth ask offered and the asker's oldest held back, offered again when one ends; `asks` lists the held-back asks; the router's tool `ask-again`; the pipeline runner's `approval` asks and their `about` | mesh-catalog (the router) | a fourth ask and a declined approval each reach the operator; `asks` shows the held-back one |
 **Switching phase 5a on: the operator's steps, in order** (amended 2026-10-09, ADR 0259). Each line is typed with
 `nox` (`mesh-cli`) on the control-node, from the operator's own account, which is the controller's terminal
@@ -6,13 +6,15 @@ code:
  - mesh-catalog modules/artifact-store-tools (the store's tools), modules/distribution (its program, holding the two image seats)
  - mesh-catalog modules/gitea (package retention; the two package seats' verbs in its Go bundle)
  - mesh-catalog modules/mesh-build-go, modules/mesh-build-node, modules/mesh-build-image (publishing through the seats)
-  - mesh-delivery modules/mesh-delivery-builder (versions, tag asks), the forge bridge, the indexer, the checker, the assigner
+  - mesh-delivery modules/mesh-delivery-builder (versions, tag asks; from milestone G a package numbered at its publication, the seat `mesh-builds`), the forge bridge, the indexer, the checker, the assigner, modules/mesh-delivery-pipeline (`tag-wanted` from milestone G)
  - mesh-sdk (the bus helper for sending in parts)
  - mesh-catalog modules/docker (image pruning)
  - mesh-host internal/apply (every new image of a module pulled before any of its containers is replaced; a failed pull applied again on the status view's `settled` for the store's holder, and at the node-engine's start), internal/compose (each routed image reference written with its seat and that seat's holder)
  - mesh-delivery modules/mesh-grants (what a node-engine hears: the status view's `settled`)
-updated: 2026-11-04
+updated: 2026-11-10
 decisions:
  - "ADR 0667"
  - "ADR 0666"
  - "ADR 0605"
  - "ADR 0612"
  - "ADR 0614"
@@ -160,7 +162,8 @@ the verb.
  entry turns `published` and the builder writes the done key then, so a late store is never lost.
 - **What is published when**: a package or an image from a trunk build under its version, or as a tagged version; a
  bundle or an archive from every done key by its digest alone, a candidate's included, and at the trunk's claim the
-  build module calls `publish` with the version and the held digest, which stores nothing. An upstream image is copied
+  build module calls `publish` with the version and the held digest, which stores nothing. From the delivery of design
  47's milestone G a package's version is given at its publication instead (*The versions*). An upstream image is copied
  by `mirror` with its pinned digest.
 - **The done key names the reference the seat answered**, in ADR 0605 §9's form from this milestone on:
  `<registry>/<module>/<artifact>@sha256:<digest>` for an image, bundle, archive or upstream copy and
@@ -263,7 +266,26 @@ the verb.
 ### The versions
- **The builder numbers every trunk build** of a package, image, bundle or archive at its claim: the package series
+- **From the delivery of design 47's milestone G, a package is numbered when it is published** (ADR 0666 §15). The
  builder numbers a package's version at its publication, never only when its build is claimed: a package's trunk
  build is claimed with no number and built by its digest, and once its build is done the builder gives it the next
  count of its series, under compare-and-set, and says `numbered`, on which the build module calls `publish` with
  the version and the held digest, as below for a floor not yet known. A build of an older source revision of the
  same watched branch than one already numbered for that name is not numbered and publishes nothing, so a version never
  names older content than the one below it. When the holder says `published`, the builder says the publication as the
  event `package-published` of its seat `mesh-builds` (the name, the version, the fingerprint, the commit, the watched
  branch). On it every artifact with a "published before it builds" edge to the package is rebuilt against the new
  version, and the pipeline runner, which consumes the event, starts its pipeline (design 47, *A publish rebuilds*);
  nothing else is rebuilt, and a change to a package's tests alone publishes nothing. This removes the claim's wait
  for earlier merges' numbers below, which held a group on 2026-11-09 (research 086, Findings). Why at publication: a
  number given at the claim must wait for every earlier merge's number, and a build that never publishes keeps a
  number nothing holds. An image, bundle or archive keeps the rule below. How it is checked: in the builder's
  whole-module test a package's trunk build is numbered only once built, an older revision's build after a newer one
  publishes nothing, `package-published` is said once per publication, and only the importing artifacts rebuild
  (design 47, test 80).
 - **A build that cannot read the published packages refuses**, naming the unread state, never building against a guess
  (ADR 0666 §15; design 47, test 70).
 - **Until that delivery, the builder numbers every trunk build** of a package, image, bundle or archive at its claim: the package series
  its manifest declares (design 32; `0.1` when it declares none) and the next count for that name, under
  compare-and-set. Numbers follow the order of the forge bridge's merge events: a claim of a later merge waits until
  every earlier merge of the same name whose fingerprint the indexer still holds is numbered (a fingerprint replaced
@@ -318,7 +340,11 @@ the verb.
 - **Asked by an event, never by a push** (ADR 0610 §1). The checker emits `tag-wanted` (repository, branch, head,
  tag), on a family of its own, `checker.asks`, kept seven days, apart from its verdicts, so a waiter on a verdict does
-  not wake on it, for each head of a delivery group member that declares a package; a person asks through `builder_tag`. The
+  not wake on it, for each head of a delivery group member that declares a package; a person asks through `builder_tag`.
  From the delivery of design 47's milestone G the checker goes, and the pipeline runner says `tag-wanted` instead, on
  its own seat `mesh-pipeline-runner`, for each member that declares a package of a run on request of a group not yet
  merged (ADR 0666 §18): a group merged together is one source revision whose packages are published before its
  dependents build, so only a run on request needs a tagged version. The
  builder consumes the event on a durable consumer and keeps the ask in its own state `tag-asks`, removed when its
  branch is merged or deleted, or its pull request closed. An ask the builder has not answered within five minutes is narrated in the build log
  with what it waits on.
@@ -326,7 +352,9 @@ the verb.
  and Go's `@latest` skips it. A package new in a group is numbered from its floor (`0.1.0-feat-x.1`).
 - **A group's check builds after `published`**: Go members by the tagged version, TypeScript members with their lock
  naming it and the registry's integrity; nothing is packed for a check, and a lone pull request's check publishes
-  nothing. No `published` within the publish's bound (10 minutes) fails the check naming the package.
+  nothing. No `published` within the publish's bound (10 minutes) fails the check naming the package. From the
  delivery of design 47's milestone G the same holds for a group's run on request, whose pipeline steps build after
  `published`, and a step that gets no `published` within the bound ends failed, naming the package.
 - **Removed with its branch**: on the forge bridge's `merged` event, its pull `closed`, or its branch-deleted event,
  heard on a durable consumer, the builder
  calls each seat's `remove`. It acknowledges the event only once every seat emitted `removed`; until then it retries