Take in round 3's last two fixes and record the three review rounds

Seams and tools and security and upgrade approved with two fixes: only an
operator's or a healer's rerun clears a failed step for merge-pull, and a
fix before the first registrations is merged by the operator under the
trunk-only want. The review section now records all three rounds.

Claude-Session: https://claude.ai/code/session_01JG73KK8HD1gufnqyFxMFdW

03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md

@@ -662,7 +662,9 @@ check and deliver milestone G itself (ADR 0667 §2); each of them says so in a l
   those its runs named for its commit; a step that failed at that fingerprint in any run, a group's or another commit's
   of the same content included, refuses it, unless a later run of that same step at that fingerprint, asked again by
   the operator or the healers (the runner's `rerun`), passed: that pass clears the failure from `failed-steps` (ADR 0666
-  §8). A run still running is judged by the steps it has ended, since the merge never waits. A refusal names the run, the module and the step, so the session knows what to fix. The gate merges nothing, and its forge merge token is
+  §8). The runner's `step-ended` says that the step was a rerun and the caller the runtime proved, and the forge module
+  clears a failure only for a rerun whose caller is the operator or a healer; a plain pass, or a rerun asked by anyone
+  else, clears nothing. A run still running is judged by the steps it has ended, since the merge never waits. A refusal names the run, the module and the step, so the session knows what to fix. The gate merges nothing, and its forge merge token is
   removed by G's delivery (ADR 0667 §6); the forge bridge hears the landed commit as it hears every commit of a watched
   branch.
 - **The operator-channel hides no ask.** It keeps design 46's three open asks per asker, never holds the newest back,
@@ -845,7 +847,7 @@ check and deliver milestone G itself (ADR 0667 §2); each of them says so in a l
   | `pipeline-started`, `pipeline-ended` | a pipeline's start, and its end with every step's result, its test counts, the source revision and `widens` |
   | `group-ended` | a group's one pipeline's end, on which alone its wants are written |
   | `run-started` | a run on request's start, with its members at their commits |
-  | `step-started`, `step-ended` | each step's start and end: the step, its status in the policy, its outcome, its build-input fingerprint, its test counts, and for a carried result what it was carried from; a bypassed step too |
+  | `step-started`, `step-ended` | each step's start and end: the step, its status in the policy, its outcome, its build-input fingerprint, its test counts, for a carried result what it was carried from, and for a rerun that it is one and the caller the runtime proved; a bypassed step too |
   | `wait-held`, `wait-ended` | a step's wait: on a person (approval, code review), on a build node, on the revision view |
 
 - **What a session hears after its merge.** Between its `merge-pull` and the delivery, a session waits with `mesh_wait`
@@ -959,6 +961,9 @@ step keys and the builder's build log, against the checker's last week (test 99)
   merge made with no Approve could reach the old assigner, which writes wants from the trunk with no pipeline. Both
   switch on one fact, the first registrations written, said as `registration-changed`: until it the new assigner keeps
   the trunk-only want and the new `merge-pull` refuses every merge, naming the missing registrations (ADR 0667 §5).
+  Meanwhile a fix, an indexer fix included, is merged by the operator on the forge, whose protection admits the operator
+  (ADR 0398 §2), and delivered under the trunk-only want still in force, and `indexer_seed_again` asks the first
+  registrations again.
 - **A gap is built, not worked around.** An order the delivery plan cannot derive from the edges is built in the
   delivery system within G; a node-engine of the version before applies every want whose manifests use no field it does
   not read, and a want that uses one waits for the new node-engine on that node (ADR 0667 §5).
@@ -3557,7 +3562,8 @@ The failure paths:
     Approve; with the runner stopped it still merges, judged on the `step-ended` it kept; a head at whose fingerprint any
     run failed a `required` step, a head that moved, and a branch whose protection was removed since its last
     `branch-moved` are refused, each naming why; a passing `rerun` of the failed step at that fingerprint, asked by the
-    operator, clears it and the head then merges; a failed `optional` step refuses nothing; a call from an account that is
+    operator, clears it and the head then merges, while a forged plain pass of that step clears nothing; a failed
+    `optional` step refuses nothing; a call from an account that is
     no proved session nor the operator is refused (whole, forge module and forge bridge, mesh-catalog and mesh-delivery).
 92. **A recovery named** by `recovery` is marked in its record and `recovery-merged` reaches every channel (whole, gate
     and teller).
@@ -3925,34 +3931,30 @@ test 62); and ADR 0662, which decided the same switch as ADR 0661 another way, i
 
 The amendment for research 086's graduation (2026-11-10) writes ADR 0666 and ADR 0667 into this design: *Pipelines
 per module* whole (registrations, watched branches and the catalog graph per branch, the pipeline steps and the policy,
-what holds a delivery, approval as a step and a session's merge through `merge-pull` judged on the runs at the head's fingerprint,
-groups, the six kinds of edge between artifacts, a publish that rebuilds, values of any size, the pipeline making the
-check, callers per verb, health, the recovery fix, the tools, the runner's kept data and the build capacity, and how
-milestone G itself is delivered), a line in every section the pipelines replace, and tests 63 to 100. It folds in what
-milestone G's prepare left for the joint amendment: the events `milestone-asked`, `milestone-withdrawn`,
+what holds a delivery, approval as a step and a session's merge through `merge-pull` judged on the runs at the head's
+fingerprint, groups, the six kinds of edge between artifacts, a publish that rebuilds, values of any size, the pipeline
+making the check, callers per verb, health, the recovery fix, the tools, the runner's kept data and the build capacity,
+and how milestone G itself is delivered), a line in every section the pipelines replace, and tests 63 to 100. It folds
+in what milestone G's prepare left for the joint amendment: the events `milestone-asked`, `milestone-withdrawn`,
 `milestone-answered` and `record-opened` as built, `assignments-changed` for the seat's event, the size of the bridge's
 `performed` fixed by its template, the seat `git`'s `merging` and `not-found`, `acts` a list with none on `node-backup`,
-the gate's `source` per watched branch with `source-moved`, a superseded pipeline's asks dropped by `drop`, and
-`kept-artifact` an edge of the sixth kind (the operator kept six). Its review by architectural domain ran, four domains
-side by side, and fix-1965 ruled on round 1 (2026-11-10), the record's wording following: the registrations, the
-runner's kept data and the gate's `source` in old sections, the runner a foundation part and the gate not;
-`merge-pull` judged from the forge module's own state of failed steps heard from `step-ended`, any run at the head's
-fingerprint counting, its protection read on every move, any proved session merging; the first registrations' ask
-raised again by a tool; the node in `step-ended`'s subject; `step-outputs`; `branch-moved` kept on the seat's stream;
-the grants part's and the gate's new tools and every store's fill; a group's wants on `group-ended` alone; an
-approval's end states and its `about`; `pipeline-failed`, the author's then the operator's; `pipeline-stands` cleared by
-`pipeline-started`; what a session hears after its merge, `widens` passed on by the teller and computed by the running
-runner over every part serving a step, and the runner's health check; an object sent readable by its recipient; the
-new assigner before the new `merge-pull` and the runner; the checker removed only after a first end-to-end pipeline and
-a tested backup kept 90 days; code review never `required` until forge accounts are bound to bus identities; a missing
-`callers` admitting the holder roles and the operator only; `run` called by sessions and the operator; the stores
-estimated again with publish rebuilds; the build capacity; test counts in `step-ended`; `pipelines` keyed by source
-revision; a pipeline superseded only on a changed fingerprint; a build seat restarted mid-step; tests 98 to 100. Round 2
-(fix-1965's rulings of 2026-11-10): health and events and running and testing approve; seams and tools and security and
-upgrade asked, and this amendment adds, the manifest validator's cases on the bus module's path, the checker leaving
-the foundation list, a passing rerun clearing a failed step for `merge-pull`, the one switch fact of the first
-registrations, `branch-unprotected`, sent objects read by a standing grant from the manifests, and the object store as
-a small mesh-sdk package only its users import. Round 3 is to come.
+the gate's `source` per watched branch with `source-moved`, a superseded pipeline's asks dropped by `drop`,
+`kept-artifact` an edge of the sixth kind (the operator kept six), and a provider counted healthy by the build it runs,
+whatever a newer want of it waits for (issue 1966, note 150). Its review by architectural domain ran in three rounds,
+the four reviewers side by side, fix-1965 ruling on every finding and the records' wording staged to match:
+
+| Round | Domain | Found | Answered by |
+|---|---|---|---|
+| 1 | seams and tools | foundation parts' kept data in templates; `merge-pull` calling the runner; no way to ask the seed again; `step-ended` with no node; no store for step outputs; `branch-moved` lost while the bridge is down; tools missing for callers, refusals, the source and every store's fill | old sections, the runner a foundation part and the gate not; `failed-steps` heard from `step-ended`; `indexer_seed_again`; the node in the subject; `step-outputs`; the seat's stream; `grants_callers`, `grants_why_refused`, `gate_source`, `gate_source_again` and fill in every read |
+| 1 | health and events | a group's wants on a member's end; approval end states; a failed head unsaid; `pipeline-stands` never cleared for a head; an ask's `about`; what a session hears; the runner's health; the backup's keep | `group-ended` alone; `declined` and `superseded`; `pipeline-failed`, the author's then the operator's; cleared by `pipeline-started`; the module and branch; the runner's events then `delivered`; its health check; 90 days |
+| 1 | security and upgrade | sent objects readable by anyone; the new `merge-pull` before the new assigner; the checker removed at once; `widens` computed by the change; a review gating while its author cannot be told; a missing `callers`; "own" pull requests; only the latest run judged; `run` open to all | readable by their recipients; the assigner's edge by `needs`; removal after a first end-to-end pipeline and a tested backup; computed by the running runner over every part serving a step; code review never `required` until a record binds the accounts; holder roles and the operator only; any proved session; any run at the fingerprint; sessions and the operator |
+| 1 | running and testing | stores sized without publish rebuilds; the build capacity unmeasured; no test counts; pipelines keyed by commit; supersede on any commit; a build seat restarted mid-step; test 74 a review | re-estimated at about 300 pipelines a day; the checker's kept verdicts carried in, supersede per publish, a live measure; counts in `step-ended` and the budget named; keyed by source revision; only on a changed fingerprint; finished from its work queue and compare-and-set; live, from the check's record |
+| 2 | seams and tools | the bus module's path unchecked; the checker on the foundation list; a failed step that a rerun passed still refusing | the manifest validator's cases; it leaves the list, the runner joins; a passing rerun clears it |
+| 2 | security and upgrade | the new assigner and `merge-pull` switching apart; a branch that lost its protection; sent objects granted per object; the object store rebuilding every module | one switch fact, the first `registration-changed`; `branch-unprotected`; a standing grant from the manifests; a small mesh-sdk package |
+| 2 | health and events, running and testing | approved | — |
+| 3 | seams and tools | who may clear a failed step | `step-ended` says a rerun and its proved caller, and only the operator's or a healer's clears |
+| 3 | security and upgrade | (with the last fix) how a fix lands before the first registrations | the operator merges it on the forge under the trunk-only want, and `indexer_seed_again` asks again |
+| 3 | all four | approved | — |
 
 Left as notes on issue 1921, not in this amendment: a conformance check that a changed layout raises its `form`; the
 size and retention of restore points and set-aside data; who may call `restore` for bus data and which manifest grants