Designs 25, 26, 51: cite ADR 0620 and ADR 0621; the owners serve their first views as tools in a runtime of their own

ADR 0621 keeps the manifest form as it is, so the process-subject form, its mesh-sdk change, the
open point on who grants it and the push's wait on a judge release all go; the per-verb grants and
the record's four checks take their place.

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig

03-DESIGN/01-to-be/25-the-bus-on-nats.md

@@ -15,6 +15,7 @@ decisions:
   - "ADR 0595"
   - "ADR 0619"
   - "ADR 0615"
+  - "ADR 0621"
   - "ADR 0614"
   - "ADR 0613"
   - "ADR 0612"
@@ -747,24 +748,24 @@ vault as an own secret: JetStream create and update under modules' names only (s
   and `refused`; never by the bus module, which cannot raise it while it is down; it names the module
   and the entry; a later `created` clears it, and so does a later accepted verdict of that module that no longer asks
   for the entry.
-- **A foundation part's first view of another's state is a verb its owner's process answers** (ADR 0615). The four
+- **A foundation part's first view of another's state is a tool its owner answers in a runtime of its own** (ADR 0615,
+  ADR 0621). The four
   foundation parts that read each other (the grants part, the tool runner, the indexer and the assigner) stop
   reading the indexer's and the assigner's bus state in the milestone of ADR 0612, with the other 19 readers of that
-  state (ADR 0615 §1). Each owner answers on its own process subject, granted by name to these readers and never
-  through the tool runner, so the tool runner never asks through itself: the assigner serves `placement` to the
-  grants part, the tool runner and the indexer, `seat-holders` to the tool runner and `wants` to the grants part; the
-  indexer serves `manifests` and `modules` to the grants part, the tool runner and the assigner (ADR 0615 §3). Each
-  reader declares these as verbs it invokes. Serving a verb on a process's own subject, outside the tool runner, has
-  no manifest form today (the assigner serves its seat verbs as tools); the form is new in mesh-sdk's manifest types
-  and rides the milestone's one rebuild. Which part issues these subjects' grants first is not yet decided: the
-  grants part composes every grant from the manifests, and is itself one of these readers, so its own first view
-  cannot wait on a grant it has not composed (an open point, tracked on issue 1966). **The judge that runs takes the
-  form in.** Every manifest of the merge is judged by the indexer that runs, the old build, before any new build
-  runs, so a new indexer can never judge its own manifest; and mesh-sdk's strict decoding refuses a field it does not
-  know (research 082, its Findings for question 5). So the running judge accepts the process-subject form before the
-  indexer and the assigner use it, decided in a record of this milestone extending ADR 0615 §3 (to be proposed), and
-  design 51's *When the group is pushed* holds the push until the judge that runs accepts it. The owner answers at once from what it holds, as soon as its process is
-  connected and before it has its own first view of any other part, with the revision of its state it answered at,
+  state (ADR 0615 §1). **Each owner serves them as tools of its own module**, the indexer `manifests` and
+  `modules`, the assigner `placement`, `seat-holders` and `wants`, and declares `runs-as`, so its tools bundle runs in
+  a runtime of its own on the module's own bus account, never in the node's tool runner, and the tool runner never
+  asks through itself (ADR 0621 §1). No new manifest form is added: a process still answers no tool call or seat verb
+  (ADR 0436 §3). **Each verb is granted to exactly its readers** (ADR 0621 §2, as ADR 0615 §3 lists them): `placement`
+  to the grants part, the tool runner and the indexer; `seat-holders` to the tool runner; `wants` to the grants part;
+  `manifests` and `modules` to the grants part, the tool runner and the assigner. A reader declares each in `invokes`
+  as `<module>.<tool>` only where it is granted, which is the grant the grants part composes as for any tool, and
+  each tool checks the proved caller against a `callers` list holding exactly its readers and refuses any other, the
+  owner itself included. **The judge of the milestone is its own group's** (ADR 0621 §4): since no field is added,
+  the running judge takes the indexer's and the assigner's manifests in as it does today, and the merge check judges
+  them with the judge built from the group's own head; no release of the judge goes ahead of the milestone. **The
+  owner's runtime answers before any first view of its own** (ADR 0621 §3): at once from its module's own state, as
+  soon as it is connected and before it has asked any other part anything, with the revision of its state it answered at,
   so the indexer and the assigner, each asking the other at start, never wait on each other (§4). The reader then
   follows the owner's declared events, each carrying the revision of the state it follows, and never asks the verb
   again on a timer; a gap in revisions makes it ask once more, said in its log (§5). The owners' events are new
@@ -986,6 +987,7 @@ issue 1966.
 | The bus module runs whole | one integration test in the nats module's repository that starts the bus module whole against the real bus server: a verdict, then `created`, then the binding in the membership; a restart that catches up a verdict given while it was down; a bucket whose settings differ raises `drifted`, the seat's `apply` of a larger cap clears it with `drift-cleared`; a refused create raises its condition and hands no binding; `recreate` and `drop` without the operator's warrant are refused, and with it act after a stream snapshot; an orphan is listed, raises `orphaned`, and goes only by `drop`; each template at a small cap refuses, events drop the oldest, and `full` is raised at the raise mark and cleared only below the clear mark; `recreated` rewrites the binding and `dropped` removes it; at start the first view from `indexer_bus_state` creates what a verdict given while it was down asked; the older remove tools refuse a new-form entry, naming `drop`'s tool |
 | A module asking bus state waits for the bus module | the module graph's table test: a manifest with a ledger entry has a requirement edge to the module providing `bus-state`, one without has none (ADR 0614 §5) |
 | A foundation part's first view | unit tests of each owner and reader (ADR 0615's How it is checked), as table cases, and these cases of the whole-module integration tests that exist today (mesh-delivery is over its integration budget, so no new test function): the indexer's (`cmd/mesh-delivery-indexer`, its one whole-module test, which the milestone's packages test merges into), the assigner's (`cmd/mesh-delivery-assigner`) and the grants part's (`cmd/mesh-grants`), and the tool runner's in mesh-tools: the owner answers its verb at once from what it holds, with its revision, before its own first view; the reader asks once at start, then only on a gap in revisions; a reader whose owner is down raises its condition only past the bound and never reads the owner's state, and the owner's answer clears it; an empty answer at revision 0 drops no login; an owner's event carries the changed value whole, and a reader applies a put and a delete from the events alone and never asks the verb; a revision lower than the one held makes the reader ask its first view again; an existing waiter on `manifest-accepted` or on the assigner's `put` does not wake on the new families; the read tool shows the revision each reader holds, and the re-read tool asks once and records the hand act; in the
+| The owners' first views are their own tools, in a runtime of their own (ADR 0621) | cases of the indexer's and the assigner's whole-module integration tests: each first-view tool, called from a reader's account while the node's tool runner is stopped, answers (§1); each answers its granted readers and refuses every other account, the owner's own included (§2); the two runtimes started at the same moment, each asking the other's first view at start, both answer within the first-view bound with their revisions (§3); and the milestone's group passes its merge check with no change to the judge's known fields for these verbs (§4) |
 assigner's whole-module test, the assigner starts before any new-form bus state exists, with no binding of the bus
 module, and the indexer, the grants part and the tool runner each get their first view of it. Live, after the delivery: the indexer's count of `reads` entries on the indexer's and the assigner's state reads 0 |
 | A foundation part's first view comes within its bound | live, after the delivery: each reader's read tool (`grants_first_views`, the mesh MCP server's `mesh_first_views`, `indexer_first_views`, `assigner_first_views`) shows, for the indexer's and the assigner's verbs, the time from its ask to the owner's answer under the two-minute bound, and no first-view condition raised by the delivery |

03-DESIGN/01-to-be/26-the-seats.md

@@ -19,6 +19,7 @@ updated: 2026-11-04
 decisions:
   - "ADR 0608"
   - "ADR 0613"
+  - "ADR 0620"
   - "ADR 0612"
   - "ADR 0614"
   - "ADR 0605"
@@ -176,21 +177,20 @@ merges.
 
 **A seat is defined once, in one language-neutral file, and every part learns it from the bus** (ADR 0608, from
 research 081). The registry seats (design 51), `mesh-broker` (design 25 § 12.3) and the four seats the milestone
-adds verbs or events to are the first defined whole this way, in the milestone of ADR 0612 (ADR 0613 §1, and a
-record of this milestone changing ADR 0613 §1-§3, to be proposed).
+adds verbs or events to are the first defined whole this way, in the milestone of ADR 0612 (ADR 0613 §1,
+ADR 0620).
 
 - **The file** is a schema with conformance fixtures: the seat's verbs and their messages, its events and their
   bodies, its state and the forms of its provisions. It lives in the contracts module of its area. Its Go and
   TypeScript types are generated from it and committed beside it; nobody writes them by hand. The format is JSON, its
   messages and bodies JSON Schema, as the seat set's verb inputs already are, with the format's own schema checked in;
   the fixtures are data, never functions.
-- **What is defined whole now** (ADR 0613; a record of this milestone changing ADR 0613 §1-§3, to be proposed, on the
+- **What is defined whole now** (ADR 0613; ADR 0620, on the
   operator's answer of 2026-11-04 to move them all). Every seat this milestone changes is defined whole and its
   contract moves into `mesh-contracts`: `npm-package-registry`, `go-package-registry`, `container-image-registry`,
   `oci-artifact-registry` (one common part of their shared verbs, written once, so the four cannot drift) and
   `mesh-broker`; and the four seats it adds a verb or an event to, each with every verb its holder's manifest on the
-  trunk declares today, plus the new ones. **No event moves subject in this milestone** (a record of this milestone
-  changing ADR 0613 §1-§3, to be proposed): a seat's own events are only those published on its seat subject today,
+  trunk declares today, plus the new ones. **No event moves subject in this milestone** (ADR 0620): a seat's own events are only those published on its seat subject today,
   and a holder's own events stay under the holder's own subjects, listed beside the seat they belong with, never moved
   onto it:
   - `mesh-delivery-checker` (held by the checker): the verbs `try`, `try-read` and `try-end`; no seat event. The

03-DESIGN/01-to-be/51-the-registries-keep-what-is-named.md

@@ -24,6 +24,8 @@ decisions:
   - "ADR 0595"
   - "ADR 0596"
   - "ADR 0615"
+  - "ADR 0620"
+  - "ADR 0621"
   - "ADR 0346"
   - "ADR 0386"
   - "ADR 0564"
@@ -88,8 +90,7 @@ tagged version; the holder itself refuses `remove` of a version with no tag, but
 on `container-image-registry` `mirror` and `tags`; the two seats `distribution` holds add `hold` and `release`,
 with the events `held` and `released`, for the artifact sweep (ADR 0617 §2), both verbs in the seat definition and
 in `distribution`'s caller list. The seats this milestone changes, these four, `mesh-broker` and the four it adds a verb or an event to, are defined
-whole, their contracts moved into `mesh-contracts` (ADR 0613 §1, and a record of this milestone changing ADR 0613
-§1-§3, to be proposed; design 26). Events: `published`, `refused` (added to ADR 0605 §2's two, additively) and `removed`, each
+whole, their contracts moved into `mesh-contracts` (ADR 0613 §1, ADR 0620; design 26). Events: `published`, `refused` (added to ADR 0605 §2's two, additively) and `removed`, each
 carrying the name, version, kind, tag, digest, fingerprint, commit and holder, and `refused` its reason; each seat's
 events are its own family, `<seat>.events`, kept seven days. A holder stores
 under the version it is given and counts nothing.
@@ -363,10 +364,9 @@ wake on it.
 
 **When the group is pushed.** Only once the release that adds the node-engine's stated capability (design 47) runs on
 every node, read from the status view's haves before the push, and once the progressive insights of ADR 0595 and
-ADR 0597 this design is written to are accepted, and once the running judge accepts the process-subject form, the
-manifest form by which the indexer and the assigner serve their verbs on their own process subjects (design 25
-§ 12.2): the judge that runs accepts that form before the indexer and the assigner use it, decided in a record of
-this milestone extending ADR 0615 §3 (to be proposed). A node away for weeks does not hold the push for ever: it is left
+ADR 0597 this design is written to are accepted. No release of the judge goes ahead: the indexer and the assigner
+serve their first views as tools of their own, in a form the running judge already takes in (ADR 0621 §4; design 25
+§ 12.2). A node away for weeks does not hold the push for ever: it is left
 out of that read only by a recorded hand act naming the node and why, as `registry_old_name` drops one, said in the
 group's pull request; the node then takes the new node-engine as any away node does when it returns.