Take in round 2 of the review by architectural domain of the 086 amendment

Seams and tools and security and upgrade asked seven items, ruled by
fix-1965 with ADR 0666 and ADR 0667 staged to match: the assigner and
merge-pull switch on the first registrations, a branch that lost its
protection starts nothing, a passing rerun clears a failed step, sent
objects are read by a grant derived from the manifests, and the object
store is a small mesh-sdk package so nothing else rebuilds. The staged
record renumbered its clauses, so every citation of ADR 0666 follows the
new numbers.

Claude-Session: https://claude.ai/code/session_01JG73KK8HD1gufnqyFxMFdW

00-META/glossary.md

@@ -97,7 +97,7 @@ and repair).
 - **manifest** — the file a module is defined by (`module.json`): what it is, what it provides and
   requires, the seats it claims, the resources it declares, its tools, its data and its health. From the delivery of
   design 47's milestone G it also names its artifacts and, where nothing else says it, each one's dependencies (`needs`),
-  and never a pipeline step's status, which is the registration's policy (ADR 0666 §4, §8). Say
+  and never a pipeline step's status, which is the registration's policy (ADR 0666 §4, §11). Say
   manifest in prose, not the file's name.
   *Not:* ~~module definition~~ (hq)
 - **resource** — one thing a manifest declares a node must have: a file, a directory, a service, a
@@ -310,7 +310,7 @@ controller and the store; for module assignment, by the seat `mesh-module-assign
   decided of the node, as one key per node in the state `placement` of the seat `mesh-module-assigner`. It changes only by
   a placement proposal the operator approves, and no repository holds it or names a node (ADR 0567). From the delivery
   of design 47's milestone G it names, per module, the **watched branch** its node runs, by default the registration's
-  first, and may name an earlier build to return to, one value (ADR 0666 §3, §13). Until ADR
+  first, and may name an earlier build to return to, one value (ADR 0666 §3, §18). Until ADR
   0547's third milestone the controller's assignments are kept equal to it by the holder.
   *Not:* ~~placement file~~ (hq)
 - **mesh-module-assigner** — the seat, held once for the mesh, that keeps placement: its states
@@ -553,26 +553,26 @@ controller (the planner, the rollout) until release 6 of ADR 0429; from each rel
 - **watched branch** — a branch a module's registration names, whose commits start that module's pipeline and which a
   placement may choose for a node; registering one the forge does not protect is refused (ADR 0666 §2, §3).
 - **run on request** — a pipeline run for a named commit or group that delivers nothing, asked by the runner's verb
-  `run`; the indexer builds its candidate from the runner's `run-started` (ADR 0666 §11).
+  `run`; the indexer builds its candidate from the runner's `run-started` (ADR 0666 §15).
 - **artifact reference** — an artifact written `<module>:<artifact>`, such as `mesh-grants:program`: the end of a
-  dependency edge of the catalog graph (ADR 0666 §8).
+  dependency edge of the catalog graph (ADR 0666 §11).
 - **mesh-pipeline-runner** — the seat, held once for the mesh, that runs each pipeline: it reads the policy from the
   registrations, asks each pipeline step of the seat that serves it, says each step's start and end and each pipeline's
   end as its events, keeps each pipeline's state and step log on the bus, and serves the run on request (ADR 0666 §4,
   §11). An acting part of the step `pipeline` (design 47). Of this domain: its contract is in `mesh-delivery-contracts`.
 - **mesh-builds** — the seat, held once for the mesh, whose holder numbers a package's version when it is published and
   says the publication as its event `package-published`, on which every artifact built against the package is rebuilt
-  and its pipeline started (ADR 0666 §9; design 51). Of this domain: its contract is in `mesh-delivery-contracts`.
+  and its pipeline started (ADR 0666 §12; design 51). Of this domain: its contract is in `mesh-delivery-contracts`.
 - **composition step** — the pipeline step that composes each machine's declaration with a change, by the composer built
   from its heads in the sandbox, refusing a change in which two modules own one path; served by the seat `mesh-wants`
-  (ADR 0666 §11). From milestone G's delivery it replaces the **composition check**.
+  (ADR 0666 §14). From milestone G's delivery it replaces the **composition check**.
 - **merge check** — what a pull request carries before it may merge, judging the merge of its head into a
   named **trunk commit**, made in a clone of its own on a build node and never pushed (ADR 0323). One status,
   `mesh/check`, written by the checker: the change's tests, run by the language's build module, and the
   **composition check**; for a delivery group, one verdict on every member's head (ADR 0445, ADR 0447). Before
   release 4 of ADR 0429 a pull request carried two statuses, one for the modules the change touches and one
   for the repository's own script (ADR 0238). Goes at the delivery of design 47's milestone G, the **pipeline** in its
-  place (ADR 0666 §11); the word goes to the *pipeline* entry's *Not:* line with the as-is update after that delivery.
+  place (ADR 0666 §14); the word goes to the *pipeline* entry's *Not:* line with the as-is update after that delivery.
 - **catalog graph** — the modules as their manifests declare them at one revision (bases, packages, provides and
   requires, invokes and serves), with the acting rules the seats declare; the indexer keeps it, one
   revision per source revision it takes in (ADR 0656). Its other name is **module graph**, the word for it before
@@ -580,7 +580,7 @@ controller (the planner, the rollout) until release 6 of ADR 0429; from each rel
   verb and a reader's capability are waited on; a package, and until research 085's milestone a build module's
   change, are triggers that rebuild, never waits; a verb edge on a cycle is left out (ADR 0603 §1, §2, ADR 0614); from research 085's milestone an acting part's edge is a wait within
   its step (ADR 0656). From milestone G's delivery it is kept once per **watched branch**, and its edges run between
-  **artifact references**, of six kinds, the reverse order holding when something goes away (ADR 0666 §3, §8).
+  **artifact references**, of six kinds, the reverse order holding when something goes away (ADR 0666 §3, §11).
   Nothing stores the order. Not the **assignment graph**, computed from it.
   *Not:* ~~build graph~~
 - **assignment graph** — the module versions placed on nodes at one revision, with the edges between versions that
@@ -588,7 +588,7 @@ controller (the planner, the rollout) until release 6 of ADR 0429; from each rel
   assigner computes it from the catalog graph, the placements and the nodes' capabilities, and nothing else writes it;
   it keeps each revision naming the revisions of its inputs, served by the seat `mesh-wants`, and writes the wants
   from a trunk revision's alone (ADR 0656), from milestone G's delivery from a revision of the watched branch a
-  placement chose whose `required` pipeline steps passed (ADR 0666 §5). Not the **catalog graph**, whose entries are modules, not
+  placement chose whose `required` pipeline steps passed (ADR 0666 §6). Not the **catalog graph**, whose entries are modules, not
   versions on nodes; not an **assignment**, one module put on one node.
 - **mesh-wants** — the seat, held once for the mesh, that keeps what each node should run, one want
   per node and module (`want.<node>.<module>`), and a person's upgrade policy, served as its verb `upgrade`
@@ -597,7 +597,7 @@ controller (the planner, the rollout) until release 6 of ADR 0429; from each rel
 - **acting part** — the holder of a seat whose definition carries a rule: the step its holder acts in and the modules
   it acts on (ADR 0656), in the field `acts` (design 47): the indexer, the checker, the build modules, the
   node-engine, the grants part, the assigner; from milestone G's delivery the holder of `mesh-pipeline-runner` in the
-  checker's place (ADR 0666 §11). Within a revision its new version acts first in its step, a wait with a
+  checker's place (ADR 0666 §16). Within a revision its new version acts first in its step, a wait with a
   bound (ADR 0656); when it fails or is late, the modules it was to act on stay on their running builds and a
   condition names it (design 47). Not every
   **part**: an acting part may be any module that holds such a seat, a build module among them.
@@ -613,13 +613,13 @@ controller (the planner, the rollout) until release 6 of ADR 0429; from each rel
 - **delivery record** — the gate's record of one milestone's delivery, a ledger instance it alone writes: the group's
   state (heads, verdicts, checks, asks), the trace (milestone, issues, pull requests, commits, the assignment graph
   revisions it moved between) and what happened to each entry on each node (ADR 0656); from milestone G's delivery the
-  pipelines' step and pipeline events in place of the verdicts, checks and asks (ADR 0666 §5). It holds no tiers and nothing
+  pipelines' step and pipeline events in place of the verdicts, checks and asks (ADR 0666 §6). It holds no tiers and nothing
   else orders by it. Not a **delivery**, one commit on its way.
 - **checking program** — the rules every check applies, built from the change's heads (ADR 0656, ADR 0644) and run in
   a build seat's sandbox (ADR 0448 §2) with the revision view as its input and no bus account; the running checker
   only asks for it, reads its verdict, records and publishes it (design 47). Not the **checker**, the part that asks for it.
   Goes with the checker at milestone G's delivery: its rules become the indexer's validation and cycle rule and the
-  **composition step** (ADR 0666 §11).
+  **composition step** (ADR 0666 §14).
 - **composition check** — whether the machines a change touches still compose with it, run by the assigner
   from the modules the indexer and the builder hold, with the composition of `mesh-delivery-sdk`, the one the controller
   composes with
@@ -629,17 +629,17 @@ controller (the planner, the rollout) until release 6 of ADR 0429; from each rel
   *Not:* ~~merge gate~~ (hq)
 - **kept verdict** — a package's passing verdict at one test level, kept by the checker under the digest of
   everything its tests read, written once and read-only; a check takes it instead of running an unchanged
-  package (ADR 0444). From milestone G's delivery the pipeline runner keeps it, and a test step takes it (ADR 0666 §4).
+  package (ADR 0444). From milestone G's delivery the pipeline runner keeps it, and a test step takes it (ADR 0666 §5).
 - **carried verdict** — a delivery's verdict moved to a newer trunk commit, or a newer sibling commit, by its
   package digests: the checker merges the head onto the new commit and runs only the packages whose digest the
   move changed, keeping the composition while no composed fingerprint changed; the verdict names the commits it
   was carried from (ADR 0548 §5, §6). A head git refuses onto the new commit is not carried: its next check is
-  whole (ADR 0548 §7). From milestone G's delivery the pipeline runner carries a step by its package digests (ADR 0666 §4).
+  whole (ADR 0548 §7). From milestone G's delivery the pipeline runner carries a step by its package digests (ADR 0666 §5).
 - **try** — the checker's run of a delivery group's check on one or more members, each a repository at an exact
   commit, before or without a pull request: the same examiner as the group's check, stricter in that a missing
   candidate or a node's missing composition answer ends it as error, and owing the forge no status and no Approve.
   It keeps the verdicts of the packages it passed for the check to take (ADR 0637). Asked only when the operator
-  asks for one (ADR 0637 §6). Goes at milestone G's delivery, the **run on request** in its place (ADR 0666 §11); the
+  asks for one (ADR 0637 §6). Goes at milestone G's delivery, the **run on request** in its place (ADR 0666 §15); the
   word goes to that entry's *Not:* line with the as-is update after that delivery.
 - **trunk commit** — the commit of the trunk a merge check's verdict was judged against: the trunk's head when
   the build module cloned it. The verdict holds for that commit only, goes out of date when the trunk moves, and
@@ -746,7 +746,7 @@ controller (the planner, the rollout) until release 6 of ADR 0429; from each rel
   level: a group holds deliveries, never groups. Its state is derived from its members, never set. From milestone G's
   delivery: a shared branch name carrying its issue number, complete when each member's commit has landed on its
   modules' watched branch, taken in as one source revision of that branch and run as one pipeline per watched branch
-  (ADR 0666 §7).
+  (ADR 0666 §10).
 - **hotfix** — one pull request in one repository, delivered at its merge (ADR 0401).
 - **feature** — one branch name across its repositories: in two or more, its pull requests are one delivery group,
   merged together and delivered member by member in the group's order; in one, a single pull request delivered as a
@@ -878,8 +878,8 @@ controller (the planner, the rollout) until release 6 of ADR 0429; from each rel
   bridge alone, as the holder's trusted value `callers` names, and the forge's events (`pull.*`, `forge.*`,
   `repo.writable`) as the seat's (design 47, *The verbs*). From milestone G's delivery `merge-pull` is a session's
   merge, refused only for a head at whose fingerprint a run failed a `required` step, a head that moved or an unprotected branch
-  (ADR 0666 §6), the read `branch` and the event `branch-moved` say a branch's head and protection, and the callers per
-  verb are the seat definition's (ADR 0666 §12). Not the **forge** itself, the server, nor the forge module's own tools.
+  (ADR 0666 §8), the read `branch` and the event `branch-moved` say a branch's head and protection, and the callers per
+  verb are the seat definition's (ADR 0666 §17). Not the **forge** itself, the server, nor the forge module's own tools.
 
 ## Health and repair — what is wrong, and putting it right
 
@@ -915,7 +915,7 @@ becomes a message). **Decided by** ADR 0227, 0231, 0240, 0252, 0283, 0564.
 - **condition** — one open fact about something the mesh owns that is wrong, with a key and a severity;
   raised and cleared only by observation
   (ADR 0231). A pipeline step or a watched branch's head standing still five minutes is one, from the watchman's
-  finding `pipeline-stands`; a step waiting on a person is not (ADR 0666 §13).
+  finding `pipeline-stands`; a step waiting on a person is not (ADR 0666 §18).
   What a wrapped dashboard raises is its own; the mesh's notion is a condition.
   *Not:* ~~alert~~ (hq)
 - **self-check** — the mesh's own examination of itself, run on demand and on a schedule (to-be 45 §4), held
@@ -966,7 +966,7 @@ becomes a message). **Decided by** ADR 0227, 0231, 0240, 0252, 0283, 0564.
   asks the owner's tools for its data, or hears its declared events (ADR 0595, ADR 0596). A value is never refused for
   its size: one over the bus's per-value limit is kept in the object store beside its state, `<state>-objects`, granted
   to its owner alone, its name in the key, and a reply or an event over the per-message limit carries the object's
-  name (ADR 0666 §10).
+  name (ADR 0666 §13).
 - **`bus-state`** — the provision of the bus module that every bus-state entry of a manifest requires, so the module
   graph orders the bus module's build before a module asking bus state (ADR 0614 §5). Provided by the holder of the
   seat `mesh-broker`.
@@ -1075,9 +1075,9 @@ asking, never the act. **Decided by** ADR 0152, 0175, 0234, 0259, 0272, 0383, 03
   date, acknowledge). An **authorising ask** is one whose chosen option its asker performs. The router
   holds every ask, checks each answer's proofs and issues a **warrant**; the asker acts on it with its
   own grants (ADR 0234, ADR 0259). No ask is hidden: an asker has at most three offered at once, a newer ask with the
-  same `about` replaces its open one, and a fourth is offered while the oldest waits, never the newest (ADR 0666 §6;
+  same `about` replaces its open one, and a fourth is offered while the oldest waits, never the newest (ADR 0666 §9;
   design 46 §6). From the delivery of design 47's milestone G the operator's approval of a delivery is the pipeline
-  step `approval`, asked as an ask like any other, and no merge is asked (ADR 0666 §6).
+  step `approval`, asked as an ask like any other, and no merge is asked (ADR 0666 §7).
 - **warrant** — the router's record that a person chose one option of one ask: the ask, the option,
   who chose (the operator, as a channel kind's identity), through which channel, the proofs and when,
   published for that asker alone. The only thing an asker acts on (ADR 0259).

03-DESIGN/01-to-be/46-the-conversation-with-the-operator.md

@@ -223,7 +223,7 @@ when the title and the note alone do not fit, and says that too.
 
 ### Limits, batching, history
 
-- An asker holds **at most three open asks**; a fourth is refused in words. *Amended 2026-11-10, ADR 0666 §6, from the
+- An asker holds **at most three open asks**; a fourth is refused in words. *Amended 2026-11-10, ADR 0666 §9, from the
   delivery of design 47's milestone G:* **no ask is hidden, and the newest is never held back.** An asker still has at
   most three asks offered at once, but a fourth is offered, not refused: the oldest of its offered asks is held back
   instead, kept open with its answer tickets withdrawn, its message edited to say it waits behind newer asks of the
@@ -440,7 +440,7 @@ answer (`operator`); an expiry; what happens on expiry, in words; and optionally
 condition's key), so a newer ask about it replaces the older. It is refused at once, on its asker's
 `decided` subject, when its words break a rule, when no ready channel can carry one of its options' levels,
 or, until the delivery of design 47's milestone G, when the asker already has three open; from that delivery a fourth
-is offered and the asker's oldest held back (§6, *Limits, batching, history*; ADR 0666 §6).
+is offered and the asker's oldest held back (§6, *Limits, batching, history*; ADR 0666 §9).
 
 **A warrant** carries the ask's id and asker, the option, `by` ("the operator, via telegram, user id
 verified"), the channel module, the proofs, the level met and when. No secret. An ask that ends without one
@@ -719,7 +719,7 @@ Each phase ends at its own *done when*. Owning repositories from [`repos.md`](..
 | **5 — Authorise, with TOTP** | `authorises` in the verb table; the router's checks for the code; direct calls refused, break-glass; `retire approve` takes `expect`; the hand-act fields; the TOTP seed as the router's state, enrolled at a terminal with ten recovery codes; `factor recover`, `factor status`, the local-only break-glass enrolment; no P2 tier before recovery codes exist; optional key enrolment; the self-check probe for the away channel; agents' grants lose the authorising verbs | mesh-controller; mesh-catalog (agents' grants, the desk's code prompt) | one controller test per refusal passes; at the desk, approve needs a code; a recovery drill re-enrols with a recovery code, and is announced |
 | **6 — Telegram live** | the `telegram` module (built in 5a) with replies and forced-reply codes, under its own account on the control node; the operator's two bots configured; the watcher assigned off the control node; the dead-man ping | mesh-catalog | the self-check says the away channel carries every tier; rehearsals: an approve and a destroy answered on the phone, with the hand-acts read |
 | **7 — A call that needs approval** (ADR 0286) | `needs-approval` in the manifest and the seat list, issued in the membership, withheld from a runner without `approval-mark/1` in its bus permissions (controller); the act's digest in TypeScript beside Go, with shared vectors (shared library); the check, the ask, the runner's `approvals`, the node's used file and `warranted` (tool runner); the controller's own verbs; `execute` marked (the controller's seat list) once issue 418's reads exist | mesh-controller, mesh-sdk, mesh-tools, mesh-catalog | a marked call on a node is asked on the phone, does nothing, runs once when made again after Approve, is refused the third time and asked again, and `hand-acts` shows the warrant |
-| **8 — No ask hidden** (ADR 0666 §6), delivered with design 47's milestone G | a fourth ask offered and the asker's oldest held back, offered again when one ends; `asks` lists the held-back asks; the router's tool `ask-again`; the pipeline runner's `approval` asks and their `about` | mesh-catalog (the router) | a fourth ask and a declined approval each reach the operator; `asks` shows the held-back one |
+| **8 — No ask hidden** (ADR 0666 §9), delivered with design 47's milestone G | a fourth ask offered and the asker's oldest held back, offered again when one ends; `asks` lists the held-back asks; the router's tool `ask-again`; the pipeline runner's `approval` asks and their `about` | mesh-catalog (the router) | a fourth ask and a declined approval each reach the operator; `asks` shows the held-back one |
 
 **Switching phase 5a on: the operator's steps, in order** (amended 2026-10-09, ADR 0259). Each line is typed with
 `nox` (`mesh-cli`) on the control-node, from the operator's own account, which is the controller's terminal

03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md

@@ -227,11 +227,11 @@ source revision is derived from the keys: every **want** equals its module's **f
   and run in a build seat's sandbox (ADR 0448 §2); the running checker only asks, records and publishes (*The check
   on the change's own acting parts*, below). It makes milestone G's own check, and is removed with its buckets and its
   bus account once the first pipeline after G's delivery has delivered a change end to end, after a tested backup
-  (ADR 0667 §2, §6): from then the pipeline makes the check (ADR 0666 §11).
+  (ADR 0667 §2, §6): from then the pipeline makes the check (ADR 0666 §14).
 - **The pipeline runner** (module `mesh-delivery-pipeline`, holding the seat `mesh-pipeline-runner`), from milestone
   G's delivery: runs each module's pipeline for each commit or group on its watched branches, asking each pipeline step
   of the seat that serves it and saying each step's end and the pipeline's end as events, its state on the bus; it
-  serves the run on request in the try's place, and is an acting part in the checker's place (ADR 0666 §4, §11;
+  serves the run on request in the try's place, and is an acting part in the checker's place (ADR 0666 §4, §15, §16;
   *Pipelines per module*).
 - **The gate** merges a group's pull requests once the check and the operator's Approve agree on the same
   heads, reading no review line (ADR 0659 §1), and then moves the mesh's source revision in one write. While the
@@ -241,7 +241,7 @@ source revision is derived from the keys: every **want** equals its module's **f
   that milestone it keeps one delivery record per milestone's delivery as a ledger instance (ADR 0656), its `merges`
   carried into the records (*The delivery record*, below). From G's delivery it merges nothing and asks no Approve: a
   session merges a pull request through the seat `git`, and the gate keeps the delivery record, its groups and the
-  source revision per watched branch (ADR 0666 §6, §7).
+  source revision per watched branch (ADR 0666 §7, §8, §10).
 - **The teller** carries conditions and asks to the operator's phone and is the only writer of an ask's answer.
 - **The assigner** writes which fingerprint each node should run, by six rules: the build is done, the
   fingerprint is not held, the node is the module's **canary** or the canary runs it healthy, at most `step`
@@ -265,7 +265,7 @@ source revision is derived from the keys: every **want** equals its module's **f
   in an `objects` section in the old form (ADR 0619 §2), serves it and a change's graph difference by verbs of
   its seat `mesh-wants`, and writes the wants from a trunk revision's assignment graph alone (ADR 0656). From G's
   delivery it runs the composition step, and writes a want only from a revision whose every `required` pipeline step
-  passed, on the watched branch a placement chose (ADR 0666 §5, §11).
+  passed, on the watched branch a placement chose (ADR 0666 §6, §14).
 - **The node agent**, the node-engine's own process, follows its node's wants, **composes each wanted module for
   its own node** with the composition of `mesh-delivery-sdk` from the manifest by digest, the module's resolved values from
   mesh-config, its secrets and bus credential asked of the vault sealed to the node's key, its licences and what
@@ -360,7 +360,7 @@ The target (ADR 0547):
   one pass and moves the source revision in one write. It asks the controller nothing, consumes no event of a
   plan, never sends to a machine and writes no composition (ADR 0539 §17). From milestone G's delivery it asks no
   Approve and merges nothing; it forms the groups, keeps one source revision per watched branch and one delivery record
-  per delivery (ADR 0666 §6, §7).
+  per delivery (ADR 0666 §7, §8, §10).
 - **The controller** is no part of build and delivery (ADR 0547 §1). The jobs it still keeps outside them
   (nodes and adoption, identities, secrets and given values, licences, config moves, conditions and facts, ADR
   0429 §9) each move by a decision of their own under research 072 before it loses its lease. All are decided:
@@ -418,7 +418,7 @@ The target (ADR 0547):
 - **From milestone G's delivery a merge waits for nothing of the mesh.** A session merges a pull request through
   the seat `git`'s `merge-pull`, judged on its head, the branch's protection and the runs at its build-input
   fingerprint, which refuse it only where a `required` step failed and are never waited for; the pipeline then runs on the landed commit, and only its `required` steps, the `approval` step where a policy names it among them, hold the
-  delivery (ADR 0666 §5, §6; *Pipelines per module*). The trunk is still what runs, on each module's watched branches,
+  delivery (ADR 0666 §6, §8; *Pipelines per module*). The trunk is still what runs, on each module's watched branches,
   which a placement chooses.
 
 ## Pipelines per module
@@ -465,7 +465,7 @@ check and deliver milestone G itself (ADR 0667 §2); each of them says so in a l
   ("`mesh-grants:program` unit tests: `required` → `bypass`"), and write the version only on its warrant; a Decline or
   an expiry writes nothing (ADR 0666 §2). Until a record binds each forge account to its bus identity, `register` and
   `policy` refuse code review as a `required` step, naming why, so no review gates while its author cannot be told
-  (ADR 0666 §12; issue 1966, note 157). A manifest moved to another path is the one manifest change that changes the
+  (ADR 0666 §17; issue 1966, note 157). A manifest moved to another path is the one manifest change that changes the
   registration; any other manifest change is a commit, judged at its revision.
 - **Said and read.** Each written change is said as the seat's event `registration-changed` (the module, the version,
   what moved); the verb `registrations` answers every registration, or one with its history. The indexer derives the
@@ -509,7 +509,7 @@ check and deliver milestone G itself (ADR 0667 §2); each of them says so in a l
 - **A head with no pipeline is a finding.** A watched branch's head that starts no pipeline within five minutes is the
   watchman's finding `pipeline-stands`, naming the branch and its head, raised by the condition keeper (ADR 0564 §2),
   unless it waits as progress not owed: a member of a gathered group is governed by ADR 0633 §5's 30-minute bound, and
-  a merge behind a pending revision of the same branch by its 60-minute bound (ADR 0666 §13). The finding clears on the
+  a merge behind a pending revision of the same branch by its 60-minute bound (ADR 0666 §18). The finding clears on the
   runner's `pipeline-started` for that head.
 - **The catalog graph per watched branch.** The indexer keeps the catalog graph once per watched branch, from that
   branch's manifests at each source revision (ADR 0666 §3): each revision names its branch, and the stores, caps and
@@ -530,9 +530,13 @@ check and deliver milestone G itself (ADR 0667 §2); each of them says so in a l
   indexer asks the manifest validator built from the revision's heads to judge it in the build seat's sandbox (the
   ask `run`, *What ADR 0656 leaves to this design*). A revision it refuses stays pending under ADR 0633 §5's
   60-minute bound, its hand acts and its condition `take-in-waits`; the way back is a revert, an ordinary merge
-  (ADR 0666 §3, §15). A revision on the branch the indexer's own placement chose is taken in only by the indexer it
+  (ADR 0666 §3, §20). A revision on the branch the indexer's own placement chose is taken in only by the indexer it
   names (ADR 0633 §1). This validation is no pipeline step and waits on no pipeline, so every delivering pipeline runs
   on a revision already taken in.
+- **A branch whose protection was removed starts nothing.** On every `branch-moved` the forge bridge reads the
+  branch's protection again; a move of a watched branch whose protection was removed starts no delivering pipeline, and
+  the forge bridge writes the finding `branch-unprotected`, naming the branch, which the condition keeper raises and
+  clears once the protection is back (ADR 0666 §3).
 - **A pending revision holds its own branch only.** A merge waits behind a pending revision only on the same watched
   branch; other branches move on (ADR 0666 §3, which changes ADR 0633 §3).
 - **How it is checked.** Whole (forge bridge): a commit of a branch no registration names starts nothing; a commit on a
@@ -555,7 +559,7 @@ check and deliver milestone G itself (ADR 0667 §2); each of them says so in a l
   can run by its language's convention (as *The check from release 4* says the tests are found), and the accepted kind
   `step` on its stream `check`, which runs one. Composition is the assigner's, an accepted kind `step` of the seat
   `mesh-wants`. Code review comes in through the runner's own verb `review`. Approval is asked through the seat
-  `operator-channel`'s ask and heard on its event `decided` (ADR 0666 §4, §6). A step with nothing to do ends at once as
+  `operator-channel`'s ask and heard on its event `decided` (ADR 0666 §4, §7). A step with nothing to do ends at once as
   `nothing to run`, never as passed.
 - **The policy.** Each step's status, per module and per artifact, is `required` (runs; holds the delivery until it
   passes), `optional` (runs; a failure is shown and may be accepted) or `bypass` (nothing runs; said as bypassed),
@@ -567,14 +571,14 @@ check and deliver milestone G itself (ADR 0667 §2); each of them says so in a l
   its own node's subject, through a durable consumer of its own, so a step outlives a restart of either side (ADR 0666
   §4, ADR 0363 §2). A build seat's holder restarted mid-step gets the step again from its work queue and finishes it
   (ADR 0664 §1). A unit or integration test step says its test counts in `step-ended`, and `pipeline-ended` names any
-  repository over 50 integration or 500 unit tests, and any catalog module over them (ADR 0666 §4; the test budget). A step's outcome is one of `passed`, `failed`, `nothing to run`,
+  repository over 50 integration or 500 unit tests, and any catalog module over them (ADR 0666 §5; the test budget). A step's outcome is one of `passed`, `failed`, `nothing to run`,
   `bypassed`, `carried` (with the pipeline it was carried from), `could not run` (naming the part not heard),
   `waiting on <person>`, `accepted` (a failed `optional` step a person accepted, with who and why), `superseded` and
   `cancelled`.
 - **Carried, not run.** A step whose build-input fingerprint and policy did not change is carried by its package
   digests, as ADR 0548 §5 holds, the runner making the carry instead of the checker: a test step runs only the packages
   with no kept result for their digest, and a run on request's results are reused when the merged commit's inputs match
-  (ADR 0666 §4; research 086, choice 24). An `approval` step is never carried.
+  (ADR 0666 §5; research 086, choice 24). An `approval` step is never carried.
 - **Approval comes last.** The runner asks the `approval` step only once every other `required` step of the pipeline
   passed, so the operator approves a commit the mesh already judged, the one place ADR 0661 §3 had the check gate the
   ask. A failure after an approval is said, as a failed `optional` step is, and the approval stays.
@@ -582,7 +586,7 @@ check and deliver milestone G itself (ADR 0667 §2); each of them says so in a l
   one key per pipeline keyed by its watched branch, source revision and module, written by compare-and-set so a holder
   replaced mid-pipeline and its successor never both write one; its step log on its old `streams` section's stream
   `step-log`; each step's output in its old `objects` section `step-outputs`, named in the log; and each package's
-  passing result per level in its old `state` section `kept`, under the digest of what its tests read (ADR 0666 §2, §4;
+  passing result per level in its old `state` section `kept`, under the digest of what its tests read (ADR 0666 §2, §5;
   *The runner's kept data*, below). At its first start it takes the checker's kept verdicts into `kept`, read by the
   checker's tool `checker_kept`, so the first pipelines after G carry what the checker had judged.
 - **How it is checked.** Whole (runner): a step with unchanged fingerprint and policy is carried and says from where,
@@ -600,15 +604,15 @@ check and deliver milestone G itself (ADR 0667 §2); each of them says so in a l
   (the record's `pipeline ended`), keyed by source revision, with every step's result. The assigner consumes it, and
   writes a want only from a source revision whose every `required` step passed for the modules it moves, on the watched
   branch a placement chose, by compare-and-set on a newer revision, so an older revision ending after a newer one
-  writes nothing (ADR 0666 §5). This is one more rule beside the assigner's others (ADR 0429 §6), checked per module.
-  From G's delivery it replaces the trunk-only want (ADR 0656 §2 as ADR 0666 §5 changes it). For a group's source
+  writes nothing (ADR 0666 §6). This is one more rule beside the assigner's others (ADR 0429 §6), checked per module.
+  From G's delivery it replaces the trunk-only want (ADR 0656 §2 as ADR 0666 §6 changes it). For a group's source
   revision the runner says one `group-ended` once every member's modules have ended, and the assigner writes the
-  group's wants only on it: a member's own `pipeline-ended` writes nothing (ADR 0666 §5).
+  group's wants only on it: a member's own `pipeline-ended` writes nothing (ADR 0666 §6).
 - **A failed `optional` step holds nothing.** It is shown in `pipeline-ended`, in the delivery record and in the runner's
   `show`; a person may accept it by the runner's verb `accept`, recorded in the hand-act log with who and why.
 - **A newer commit supersedes an older pipeline of a module whose fingerprint it changed.** On a newer commit of the
   same watched branch the runner ends a module's older running pipeline as `superseded` only when the newer commit
-  changed that module's build-input fingerprint (ADR 0666 §5); a module the commit leaves as it was finishes its
+  changed that module's build-input fingerprint (ADR 0666 §6); a module the commit leaves as it was finishes its
   pipeline. A newer publish of a package likewise supersedes the rebuild pipelines an older publish of it started. A
   superseded pipeline's waiting asks are dropped by each build seat's `drop` (ADR 0664 §4), naming
   the newer commit as the cause, so a cancelled pipeline leaves no ask on a stream (a gap G's prepare found: a cancelled
@@ -616,14 +620,14 @@ check and deliver milestone G itself (ADR 0667 §2); each of them says so in a l
 - **A step nothing starts ends its pipeline.** A step whose prerequisite nothing starts (a seat with no holder, a
   prerequisite step `bypass`) ends the pipeline refused within five minutes, naming the step and what it waits for,
   never as a silent wait (research 086, R5); a step whose seat has no holder ends its pipeline failed, naming the seat
-  (ADR 0666 §11).
+  (ADR 0666 §14).
 - **A failed head is said to its author, then to the operator.** A `required` step that failed, or ended `could not
   run`, on a watched branch's head is the runner's finding `pipeline-failed`, naming the module, the branch, the commit
   and the step; the condition keeper raises it as the commit's author's for two hours and then the operator's, as ADR
   0505 §5 and §6 have a delivery whose cure is its author's new head, and clears it when a newer revision of that branch
-  passes that step (ADR 0666 §13). The author is the forge's record of the commit, read through the seat `git`.
+  passes that step (ADR 0666 §18). The author is the forge's record of the commit, read through the seat `git`.
 - **The delivery record keeps every step.** The gate's delivery record consumes the step and pipeline events and keeps
-  them as long as the record (ADR 0666 §5; *The delivery record*).
+  them as long as the record (ADR 0666 §6; *The delivery record*).
 - **How it is checked.** Whole (assigner): a failed `required` step writes no want; a failed `optional` step holds
   nothing; an older revision's `pipeline-ended` after a newer one's writes nothing; a group with one member passed and
   another still running writes no want until `group-ended`. Whole (runner): a newer commit that changed a module's
@@ -635,14 +639,14 @@ check and deliver milestone G itself (ADR 0667 §2); each of them says so in a l
 ### Approval is a step, and a session merges a pull request
 
 - **No Approve per merge.** The operator's approval is the pipeline step `approval`, its status in each module's policy;
-  no Approve is asked per merge, and the delivery gate's merge turns and its Approve per merge go (ADR 0666 §6, which
+  no Approve is asked per merge, and the delivery gate's merge turns and its Approve per merge go (ADR 0666 §7, which
   changes ADR 0661 §3 to §5). The operator is asked only where a module's policy says `approval`, and for registrations
   and policy changes.
 - **The approval is an ask of the runner's.** The runner raises an authorising ask of tier approve on the seat
   `operator-channel` under its own name, its `about` the module and the watched branch only, so a newer commit's ask
   replaces the older one's (design 46 §10). The warrant ends the step passed; an ask that is declined, expires or is
   refused ends it `declined`, and one that is replaced ends it `superseded`. Only a declined `approval` step is asked
-  again, by the runner's verb `ask-again` (ADR 0666 §6). While it waits the runner
+  again, by the runner's verb `ask-again` (ADR 0666 §7). While it waits the runner
   says `wait-held` waiting on the operator, never a stall (ADR 0283).
 - **A session merges a pull request.** Any session the tool runner proves, and the operator, merges by calling the seat
   `git`'s verb `merge-pull` over the mesh, which merges with the forge tools' account (ADR 0398 §2) at the head the
@@ -650,18 +654,19 @@ check and deliver milestone G itself (ADR 0667 §2); each of them says so in a l
   push, the protection read again on every `branch-moved` of the branch, and it judges the head's runs by its modules'
   policies: it refuses a head when any run at its build-input fingerprint failed a step a policy marks `required`, and
   merges a head whose `required` steps passed or that has no run yet, a failed `optional` or a `bypass` step refusing
-  nothing; it never waits for a run and never asks an Approve (ADR 0666 §6). The forge keeps only its branch protection.
+  nothing; it never waits for a run and never asks an Approve (ADR 0666 §8). The forge keeps only its branch protection.
 - **Judged from its own state, never by a call.** The holder of the seat `git` consumes the runner's `step-ended`
   through a durable consumer of its own and keeps, in its own state `failed-steps`, each failed `required` step by
   module and build-input fingerprint, with the commits it was seen at and the run that failed it, for 30 days; so a head
-  merges while the runner is down, judged on what it already heard (ADR 0666 §6, ADR 0596). A head's fingerprints are
+  merges while the runner is down, judged on what it already heard (ADR 0666 §8, ADR 0596). A head's fingerprints are
   those its runs named for its commit; a step that failed at that fingerprint in any run, a group's or another commit's
-  of the same content included, refuses it. A run still running is judged by the steps it has ended, since the merge
-  never waits. A refusal names the run, the module and the step, so the session knows what to fix. The gate merges nothing, and its forge merge token is
+  of the same content included, refuses it, unless a later run of that same step at that fingerprint, asked again by
+  the operator or the healers (the runner's `rerun`), passed: that pass clears the failure from `failed-steps` (ADR 0666
+  §8). A run still running is judged by the steps it has ended, since the merge never waits. A refusal names the run, the module and the step, so the session knows what to fix. The gate merges nothing, and its forge merge token is
   removed by G's delivery (ADR 0667 §6); the forge bridge hears the landed commit as it hears every commit of a watched
   branch.
 - **The operator-channel hides no ask.** It keeps design 46's three open asks per asker, never holds the newest back,
-  and replaces an open ask by the same asker's ask with the same `about` (ADR 0666 §6; design 46 §6).
+  and replaces an open ask by the same asker's ask with the same `about` (ADR 0666 §9; design 46 §6).
 - **How it is checked.** Whole (forge module, forge bridge): a session's `merge-pull` at its head merges with no run yet,
   and with a passed one, and asks no Approve; with the runner stopped a head merges; a head at whose fingerprint any
   run failed a `required` step, a head that moved and a branch whose protection was removed since its last move are
@@ -673,17 +678,17 @@ check and deliver milestone G itself (ADR 0667 §2); each of them says so in a l
 ### Groups
 
 - **Formed from the branch name.** The gate forms a group from a shared branch name carrying its issue number, as it
-  does today without the fixed list of trunk names (ADR 0666 §7).
+  does today without the fixed list of trunk names (ADR 0666 §10).
 - **A member reaches its group by landing.** A member has reached its group when its commit lands on its modules'
   watched branch. The forge bridge sets the group on each landed member's commit, reading the members from the seat
-  `mesh-delivery`'s verb `groups`, and publishes `forge.group.merged` when that verb says every member has (ADR 0666 §7,
+  `mesh-delivery`'s verb `groups`, and publishes `forge.group.merged` when that verb says every member has (ADR 0666 §10,
   which changes ADR 0633 §4).
 - **One source revision, one pipeline per branch.** The indexer keeps landed members pending until the group's end and
   takes them in together as one source revision of that watched branch, saying `take-in.taken`; the runner starts the
   group's one pipeline per watched branch on that event, and a member of a gathered group starts no pipeline of its own.
   When one member's `required` step fails, none of the group's modules is delivered (research 086, R5).
 - **A group that never completes is said.** By ADR 0633 §5's 30-minute bound and its condition; `bridge_group_end_again`
-  says a group's end again from the gate's group verb, never the gate's `merges` state (ADR 0666 §7, which changes ADR
+  says a group's end again from the gate's group verb, never the gate's `merges` state (ADR 0666 §10, which changes ADR
   0633 §5).
 - **How it is checked.** Whole (indexer, gate, forge bridge): a group of three repositories, its own packages included,
   is one source revision and one pipeline; one member's failed `required` step delivers none; a group with a member that
@@ -692,7 +697,7 @@ check and deliver milestone G itself (ADR 0667 §2); each of them says so in a l
 ### Dependencies between artifacts
 
 - **Six kinds of edge between artifact references.** The catalog graph's edges run between **artifact references**,
-  `<module>:<artifact>`, such as `mesh-grants:program`, of six kinds (ADR 0666 §8):
+  `<module>:<artifact>`, such as `mesh-grants:program`, of six kinds (ADR 0666 §11):
 
   | Kind | B before A | Derived from |
   |---|---|---|
@@ -708,13 +713,13 @@ check and deliver milestone G itself (ADR 0667 §2); each of them says so in a l
   package edge names an artifact; at module level the tool runner and the grants part looked like a cycle, per artifact
   they are a chain (`mesh-grants:program`, then `node-tools:runtime`, then `mesh-grants:tools`).
 - **Removal runs the other way.** When something goes away the order is reversed: a seat moved to a new holder has its
-  old holder released before the new one claims (ADR 0666 §8).
+  old holder released before the new one claims (ADR 0666 §11).
 - **The edges alone order.** The build and the delivery order by these edges alone; a cycle of delivery edges (kinds 2,
   4, 5, 6) is delivered as one step, and a cycle of build edges (kinds 1 and 3) is refused, naming every artifact on it
-  (ADR 0666 §8; research 086, R17). The cycle rule is the indexer's, in the catalog graph it keeps, so the checking
+  (ADR 0666 §11; research 086, R17). The cycle rule is the indexer's, in the catalog graph it keeps, so the checking
   program's cycle rule goes with the checker.
 - **A format's reader first.** A format a running reader cannot read is preceded by its reader, an edge of kind 4 on
-  every watched branch (ADR 0666 §8): the indexer's manifest validator for a new field of a seat definition or a
+  every watched branch (ADR 0666 §11): the indexer's manifest validator for a new field of a seat definition or a
   manifest, and on each node the node-engine that reads a manifest's new fields before any manifest that writes them
   (ADR 0667 §4).
 - **How it is checked.** Unit (indexer's graph): a chain per artifact where modules would cycle; two programs needing
@@ -725,53 +730,57 @@ check and deliver milestone G itself (ADR 0667 §2); each of them says so in a l
 ### A publish rebuilds
 
 - **Numbered at publication.** The builder numbers a package's version when it is published, never only when a build
-  is claimed, and says the publication as the event `package-published` of its seat `mesh-builds` (ADR 0666 §9; design
+  is claimed, and says the publication as the event `package-published` of its seat `mesh-builds` (ADR 0666 §12; design
   51, *The versions*). The seat is new, held once for the mesh, defined in `mesh-delivery-contracts`; the builder held
   none until now, and its waits stay on its own stream in this milestone.
 - **Every dependent is rebuilt against it.** On `package-published` every artifact with a kind-1 edge to the package is
   rebuilt against the new version, and the runner, which consumes the event, starts its pipeline; nothing else is
-  rebuilt, and a change to tests alone publishes nothing (ADR 0666 §9; research 086, R18).
+  rebuilt, and a change to tests alone publishes nothing (ADR 0666 §12; research 086, R18).
 - **Unread packages refuse.** A build that cannot read the published packages refuses and names the unread state
-  (ADR 0666 §9).
+  (ADR 0666 §12).
 - **How it is checked.** Whole (builder, indexer): a mesh-sdk merge changing one package publishes one version, and only
   the artifacts importing that package rebuild; a merge changing only tests rebuilds nothing; a build whose packages
   cannot be read refuses naming the state. Tests 70 and 80.
 
 ### Any size
 
-- **A value over the limit is an object.** mesh-sdk's shared state layer puts a value over the bus's per-value limit in
-  the object store beside its state and keeps the object's name in the key; a verb's reply or an event over the
-  per-message limit carries the object's name (ADR 0666 §10). A value moved there is deleted with its key, and a
+- **A value over the limit is an object.** mesh-sdk's own small object store package (ADR 0595 §9) puts a value over
+  the bus's per-value limit in the object store beside its state and keeps the object's name in the key; a verb's reply or an event over the
+  per-message limit carries the object's name (ADR 0666 §13). A value moved there is deleted with its key, and a
   replaced value leaves one object.
 - **One object store per state, granted to its owner.** Each state asked by the template `state` gets its object store
   beside it, `<state>-objects`, a template form of ADR 0595 that the bus module provides and the grants part grants to
-  the state's owner alone (ADR 0666 §10); a foundation part's large values go in an old `objects` section of its own.
+  the state's owner alone (ADR 0666 §13); a foundation part's large values go in an old `objects` section of its own.
   Its size is the template's (ADR 0595 §3). An object store holds no space until a value is written to it, so the many
   it adds reserve nothing; the few values over the limit (a delivery record, a catalog graph revision list, a test's
   output) are estimated, as a guess, at under 1 GiB across the mesh.
-- **An object sent is readable by the module it is for.** A reply's or an event's object is written to the sender's
-  object store, and the grants part grants the read of that one object's name to the module the reply or the event is
-  for: a reply's caller, an event's consumers as their `consumes` declare them (ADR 0666 §10). A consumer's reader of
+- **An object sent is readable by the modules it is for.** A reply's or an event's object is written to the sender's
+  object store of sent objects, and the grants part derives from the manifests a standing grant to read them: the
+  callers its seat definition names for the verbs it serves, and the consumers whose `consumes` declare its events;
+  no other module may read them (ADR 0666 §13). The grant follows the manifests, so it is written when they change,
+  never per object. A consumer's reader of
   the form is delivered before its producer writes it, an edge of kind 4.
-- **Its tools are the runtime's.** mesh-sdk's runtime serves every module `<module>_state_objects` (the objects of each
-  state, with their size, the key that names each and the fill against its cap) and `<module>_state_objects_drop` (drop
-  the objects whose key is gone, recorded in the hand-act log).
-- **Its cost.** A change of mesh-sdk's runtime rebuilds every module once, said to the operator with G's delivery.
+- **Its tools come with the package.** The package serves each module that imports it `<module>_state_objects` (the
+  objects of each state, with their size, the key that names each and the fill against its cap) and
+  `<module>_state_objects_drop` (drop the objects whose key is gone, on a person's word as ADR 0595 §4 removes kept
+  data, recorded in the hand-act log).
+- **Its cost.** Only the modules that import the package are built with it, so no other module is rebuilt for it: a
+  package published before its users build (ADR 0573 §2, ADR 0667 §3).
 - **How it is checked.** Whole (mesh-sdk, against the real bus): values of one, ten and a hundred times the per-value
-  limit stored, sent as a reply and as an event, and read back whole by another module that the reply or event is for,
-  and refused to a module it is not for; a replaced large value leaves one object; a key deleted takes its object.
+  limit stored, sent as a reply and as an event, and read back whole by a caller and a consumer the manifests declare,
+  and refused to a module that declares neither; a replaced large value leaves one object; a key deleted takes its object.
   Tests 69 and 90.
 
 ### The pipeline makes the check, and the checker goes
 
 - **Every step runs on parts built from the change.** Every pipeline step that runs a change's code runs on parts built
-  from the change's own heads, in the build seat's sandbox, with no network and no bus account (ADR 0666 §11, ADR 0448
+  from the change's own heads, in the build seat's sandbox, with no network and no bus account (ADR 0666 §14, ADR 0448
   §2, §4): the composition step composes each machine's declaration with the composer built from the heads and refuses
   a change in which two modules own one path; the build seats' steps run lint and tests. A step whose serving part the
   change alters runs from the change's build of it, built within 20 minutes or ending `waiting for a build node` or
   `did not build`, the first tier of *The check on the change's own acting parts* made the runner's.
 - **The run on request.** The runner's verb `run` takes one or more members, each a module at a named commit, runs them
-  through their pipelines and delivers nothing, replacing the checker's try (ADR 0666 §11). Its callers are the
+  through their pipelines and delivers nothing, replacing the checker's try (ADR 0666 §15). Its callers are the
   sessions, as the agents' bus identities the tool runner proves, and the operator, and nothing else, since a run of a
   group builds and publishes its packages' tagged versions (design 51). The runner says `run-started`, the indexer builds
   the run's candidate from it, and the candidate's composition step writes no want (ADR 0656 §9); the candidate is
@@ -780,7 +789,7 @@ check and deliver milestone G itself (ADR 0667 §2); each of them says so in a l
 - **The runner is an acting part in the checker's place.** The acting rule's step `check` becomes the runner's step
   `pipeline` (*What ADR 0656 leaves to this design*): its own change runs on its own new version, a failing new runner
   holds while the old one runs pipelines (ADR 0656 §4), and the pipelines in flight when its holder is replaced are
-  taken up again from its kept state (ADR 0666 §11).
+  taken up again from its kept state (ADR 0666 §16).
 - **What the checker did, and where it goes.**
 
   | The checker's | From G's delivery |
@@ -803,22 +812,22 @@ check and deliver milestone G itself (ADR 0667 §2); each of them says so in a l
 
 - **Callers per verb, in the seat's definition.** Each seat definition names, per verb, the callers allowed to call it,
   in its field `callers` (holder roles, modules, the operator, the healers), which the grants part reads as its one
-  source of caller limits; the runner's verbs are the first (ADR 0666 §12). A verb whose definition names no `callers`
+  source of caller limits; the runner's verbs are the first (ADR 0666 §17). A verb whose definition names no `callers`
   admits only the seat's holder roles and the operator, so a field left out opens nothing. It replaces the holder's
   trusted config value `callers` of the seat `git` and the package seats (design 51), which no holder set for most
   verbs. A format its running reader cannot read, so its reader is delivered first (ADR 0667 §4).
 - **A step's result from its holder only.** The runner takes a step's result only from the bus account of that step's
   seat holder, naming the commit and the build-input fingerprint; a result from another account, or naming another
-  commit or fingerprint, is refused and said (ADR 0666 §12).
+  commit or fingerprint, is refused and said (ADR 0666 §17).
 - **A review gates, once it can.** A code review's result is taken through the verb `review` from the reviewer's bus
-  account and refused from the commit's author, so a review gates where a policy says `required` (ADR 0666 §12, which
+  account and refused from the commit's author, so a review gates where a policy says `required` (ADR 0666 §17, which
   changes ADR 0659 §2). Until a record binds each forge account to its bus identity no policy may say it (*A module's
   registration*; issue 1966, note 157).
 - **A widening is said, never refused.** A change that alters any part serving a step (the runner, step detection, the
   lint rule, a build seat's test runner, the composer), or widens an acting rule, a grant or a credential, says so in
   its `pipeline-ended`, its field `widens` naming each. The running runner computes it, from the sources of the change
   against those of the watched branch, never the runner built from the change, so a change cannot hide its own
-  widening; nothing refuses it for that (ADR 0666 §12, the operator, 2026-11-10). The teller passes `widens` on to every
+  widening; nothing refuses it for that (ADR 0666 §17, the operator, 2026-11-10). The teller passes `widens` on to every
   channel, as it does `recovery-merged`. This is what replaces ADR 0656 §8's naming in the Approve ask.
 - **How it is checked.** Whole (runner, grants part): a forged step result and an author's own review are refused; a
   caller not in a verb's `callers`, and any caller but the holder roles and the operator of a verb with no `callers`,
@@ -829,7 +838,7 @@ check and deliver milestone G itself (ADR 0667 §2); each of them says so in a l
 
 - **The runner's events.** Each on `mesh.seat.mesh-pipeline-runner.event.<event>.<module>.<branch>.<commit or group>`,
   a branch or group name escaped as a key's name is, declared in the seat's definition and published by the runner's
-  account alone (ADR 0666 §13, ADR 0363 §2):
+  account alone (ADR 0666 §18, ADR 0363 §2):
 
   | Event | Says |
   |---|---|
@@ -846,7 +855,7 @@ check and deliver milestone G itself (ADR 0667 §2); each of them says so in a l
   never by run length; a step or a watched branch's head standing still five minutes is its finding `pipeline-stands`,
   raised by the condition keeper and cleared on the step's end, or for a head on its `pipeline-started` (ADR 0564 §2,
   §4). A step waiting on a person is said as waiting on that person (ADR 0283), never as a stall; a group waiting for
-  its members, and a merge behind a pending revision, are governed by their own bounds (ADR 0666 §13). At its start the
+  its members, and a merge behind a pending revision, are governed by their own bounds (ADR 0666 §18). At its start the
   watchman seeds its open waits from the runner's `stands`, as it seeds `take-in-waits` from `indexer_pending`.
 - **The runner's own health.** Its manifest declares its health check, run outside its process (ADR 0240): the runner
   answers `show`, and its durable consumers of `step-ended`, `take-in.taken`, `package-published` and `decided` are
@@ -855,7 +864,7 @@ check and deliver milestone G itself (ADR 0667 §2); each of them says so in a l
   after five minutes, as every part does (ADR 0656 §6).
 - **Going back is one act.** A failing new version holds while the old keeps running (ADR 0656 §4); a return to an
   earlier build is one value in the placement, the module's `build` in its placement key, set by a placement proposal
-  (ADR 0666 §13).
+  (ADR 0666 §18).
 - **How it is checked.** Whole (runner, watchman): a step whose worker dies raises `pipeline-stands` within five minutes;
   a head with no pipeline raises it and its `pipeline-started` clears it; a step waiting on the operator raises nothing;
   a runner restarted mid-step takes its pipelines up again; its health check fails naming a consumer behind. Whole
@@ -864,18 +873,18 @@ check and deliver milestone G itself (ADR 0667 §2); each of them says so in a l
 ### A recovery fix is an ordinary merge
 
 - **No recovery merge verb.** A fix that recovers the mesh is merged like any change on a watched branch, by a
-  session's `merge-pull`, and runs its pipeline; no trusted recovery merge verb is built (ADR 0666 §15). The shape this
+  session's `merge-pull`, and runs its pipeline; no trusted recovery merge verb is built (ADR 0666 §20). The shape this
   design sketched for one (a verb `merge` of the seat `mesh-delivery` with `recovery-callers`) is dropped.
 - **Named a recovery, said everywhere.** Its author names it a recovery by the seat `mesh-delivery`'s verb `recovery`
   (the commit and why), never by a pull request's text: the gate marks the delivery record `recovery` with the caller
-  the runtime proves, and says `recovery-merged`, which the teller passes on to every channel (ADR 0666 §15). A widening
+  the runtime proves, and says `recovery-merged`, which the teller passes on to every channel (ADR 0666 §20). A widening
   it carries is said in its `pipeline-ended` like any other (*Who may say what*).
 - **How it is checked.** Whole (gate): a merge named a recovery is marked in its record and `recovery-merged` is said;
   a recovery named by a description is not. Test 92.
 
 ### The tools
 
-Every new state has a tool that reads it and every new act a tool that starts it by hand (ADR 0666 §14), against the
+Every new state has a tool that reads it and every new act a tool that starts it by hand (ADR 0666 §19), against the
 four lines a module's tools answer; every read tool of a store also answers its fill against its cap:
 
 | Part (seat) | Read everything it holds | Do by hand what it does itself | Recover without help |
@@ -934,7 +943,7 @@ step keys and the builder's build log, against the checker's last week (test 99)
   the node-engine, and the checker, which makes G's own check) act from the milestone's heads, each first in its step,
   in the order of their ordering edges; the trunk-only want, the checker and the Approve per merge as ADR 0661 leaves it
   govern this delivery, no exemption is asked and no delivery goes ahead of it (ADR 0667 §2, ADR 0644 §1).
-- **Its other parts as any module.** mesh-sdk, with the object store layer, is a package published before the modules
+- **Its other parts as any module.** mesh-sdk's small object store package is a package published before the modules
   that use it build; the manifest validator moves with the indexer; the runner is placed like any module and acts only
   from the next change on; mesh-delivery's `contracts` and `sdk` move under its `modules/` folder (ADR 0667 §3).
 - **Readers, the stream maker and the bus module first** (ADR 0667 §4): the edges the delivery plan derives, kind 4 each:
@@ -947,15 +956,19 @@ step keys and the builder's build log, against the checker's last week (test 99)
 - **The new assigner before the new merge.** The new assigner, which writes a want only from a passed pipeline, is
   delivered before the forge module's new `merge-pull`, which asks no Approve, and before the runner: an edge of kind 4
   from `mesh-delivery-assigner` to each, declared in their manifests' `needs` since nothing else says it. Without it a
-  merge made with no Approve could reach the old assigner, which writes wants from the trunk with no pipeline.
+  merge made with no Approve could reach the old assigner, which writes wants from the trunk with no pipeline. Both
+  switch on one fact, the first registrations written, said as `registration-changed`: until it the new assigner keeps
+  the trunk-only want and the new `merge-pull` refuses every merge, naming the missing registrations (ADR 0667 §5).
 - **A gap is built, not worked around.** An order the delivery plan cannot derive from the edges is built in the
   delivery system within G; a node-engine of the version before applies every want whose manifests use no field it does
   not read, and a want that uses one waits for the new node-engine on that node (ADR 0667 §5).
 - **What is removed, and when.** The checker's buckets and bus account and the gate's forge merge token are removed only
   after the first pipeline after G's delivery has delivered a change end to end (test 63), after a backup of the buckets
   kept 90 days, as the delivery records are, whose restore is tested, and the operator is told before it (ADR 0667 §6).
+  The checker leaves the manifest validator's list of foundation parts (ADR 0619 §1) when it is removed; the runner is
+  on that list from G's delivery.
 - **Told to the operator before it starts**: one more Approve per merge under ADR 0661 for G's own group, then none; the
-  one ask of the seed registrations; a rebuild of every module for mesh-sdk's runtime; the bus's restart; and later the
+  one ask of the seed registrations; the bus's restart; and later the
   checker's removal.
 - **How it is checked.** Tests 94 to 97, and 100 for the assigner's edge.
 
@@ -968,28 +981,29 @@ step keys and the builder's build log, against the checker's last week (test 99)
 | The gate no foundation part, its `source` in the old section it already has | the bus module's delivery waits on no act of the gate's; only the key's layout changes |
 | The verbs `register`, `policy`, `watch`, `unwatch`, `registrations` and the event `registration-changed` on `mesh-catalog` | one verb per trusted act, each its own ask naming what moves; readers follow the event (ADR 0596) |
 | The seed of the first registrations proposed as one ask, with the statuses the check judged until then and approval `bypass`, raised again by `indexer_seed_again` | registering is a trusted act (ADR 0666 §2), and one ask for the whole seed is how placement was adopted (ADR 0567); a declined or expired seed must not leave the pipelines stopped with no way on |
-| Code review refused as `required` until forge accounts are bound to bus identities | a review is refused from its author (ADR 0666 §12), which cannot be told until then |
+| Code review refused as `required` until forge accounts are bound to bus identities | a review is refused from its author (ADR 0666 §17), which cannot be told until then |
 | The seat `git`'s read verb `branch` and event `branch-moved`, kept on its seat stream | registering reads a branch's protection through the seat `git` (ADR 0666 §2); a branch moves by a merge or an admitted push; a stream keeps a move said while the bridge is down |
-| The watchman's finding `pipeline-stands` for a step or a head still five minutes, cleared by the step's end or the head's `pipeline-started` | the record's five minutes (ADR 0666 §13), one finding for both, timed from the runner's events |
-| The runner's finding `pipeline-failed`, the author's for two hours, then the operator's | ADR 0666 §13 with ADR 0505 §5, §6 |
-| A module's watched branch and its `build` in the placement key, set by a proposal | a placement names the branch and a return is one value in it (ADR 0666 §3, §13); every placement change goes by a proposal (ADR 0567) |
+| The watchman's finding `pipeline-stands` for a step or a head still five minutes, cleared by the step's end or the head's `pipeline-started` | the record's five minutes (ADR 0666 §18), one finding for both, timed from the runner's events |
+| The runner's finding `pipeline-failed`, the author's for two hours, then the operator's | ADR 0666 §18 with ADR 0505 §5, §6 |
+| A module's watched branch and its `build` in the placement key, set by a proposal | a placement names the branch and a return is one value in it (ADR 0666 §3, §18); every placement change goes by a proposal (ADR 0567) |
 | The gate's `source.<branch>`, its verb `source` and event `source-moved` | one source revision per watched branch (ADR 0666 §3), read through the seat (G's prepare, the indexer's watch of the gate's `source`) |
 | The build seats' verb `steps` and accepted kind `step` on `check`; the assigner's kind `step` on `mesh-wants`; `step-ended` with the node in its subject | steps are asked on the serving seat's work queue (ADR 0666 §4); the `check` stream already orders after `delivery`; a node's account says only its own node's ends (ADR 0363 §2) |
-| The outcomes, with `accepted`, `superseded` and `cancelled`; an approval expired or refused ends `declined`, replaced `superseded` | every end a step can have is said as itself (ADR 0666 §6) |
+| The outcomes, with `accepted`, `superseded` and `cancelled`; an approval expired or refused ends `declined`, replaced `superseded` | every end a step can have is said as itself (ADR 0666 §7) |
 | `approval` asked last, its `about` the module and the branch | the operator approves a commit the mesh already judged, the point ADR 0661 §3 kept in one place; one ask per module and branch, a newer commit's replacing it |
-| A superseded pipeline's asks dropped by `drop`, and a pipeline superseded only when its module's fingerprint changed | a cancelled pipeline must leave no ask on a stream (ADR 0664 §4; G's prepare); a module the commit did not change has nothing newer to run (ADR 0666 §5) |
-| A group's wants only on `group-ended` | a group is delivered whole or not at all (ADR 0666 §5; research 086, R5) |
+| A superseded pipeline's asks dropped by `drop`, and a pipeline superseded only when its module's fingerprint changed | a cancelled pipeline must leave no ask on a stream (ADR 0664 §4; G's prepare); a module the commit did not change has nothing newer to run (ADR 0666 §6) |
+| A group's wants only on `group-ended` | a group is delivered whole or not at all (ADR 0666 §6; research 086, R5) |
 | The six kinds derived from existing words, `needs` per artifact only where nothing says it | one form of each fact (ADR 0656 §6); the catalog entry's `needs` already exists from G |
 | The cycle rule in the indexer's graph | the graph is the indexer's, and the checking program goes with the checker |
-| The builder's seat `mesh-builds` and its event `package-published` | the record has the builder say the publication as an event of its seat (ADR 0666 §9); its waits move only when a later change gives the seat its verbs |
-| Each state's object store `<state>-objects`, an object sent readable by its recipient, and the runtime's two tools | one object store per state, granted to its owner, the one object to the module it is for (ADR 0666 §10); the runtime serves the tools every module needs |
+| The builder's seat `mesh-builds` and its event `package-published` | the record has the builder say the publication as an event of its seat (ADR 0666 §12); its waits move only when a later change gives the seat its verbs |
+| Each state's object store `<state>-objects` through mesh-sdk's small package, sent objects readable by a standing grant derived from the manifests, and the package's two tools | one object store per state, granted to its owner; the sender's declared callers and consumers read what it sends (ADR 0666 §13); only its users import it, so nothing else is rebuilt |
 | The `run` ask published by the runner's account and the indexer's; the verb `run` called by the sessions and the operator only | the steps and the validation run code from the change, in the sandbox only, and each asker reads only its own step keys (ADR 0363 §2); a run publishes tagged packages, so nothing else may ask one |
-| The checker's step `check` becomes `pipeline`; the checker's kept verdicts taken into `kept` | the runner is an acting part in the checker's place (ADR 0666 §11); the first pipelines then run only what changed |
-| The field `callers` in a seat definition replaces the holders' trusted `callers`, a missing field admitting the holder roles and the operator only | the record makes the definition the grants part's one source (ADR 0666 §12); a field left out must open nothing |
-| `widens` in `pipeline-ended`, computed by the running runner over every part serving a step, passed on by the teller | a widening is said and nothing refuses it (ADR 0666 §12, §15); a change must not compute its own |
-| `merge-pull` judged from the forge module's own `failed-steps`, heard from `step-ended`, any run at the head's fingerprint counting, the protection read again on every `branch-moved` | the record has it judge from the events it consumes, never by a call, so a head merges while the runner is down (ADR 0666 §6, ADR 0596) |
-| The new assigner before the new `merge-pull` and the runner, by `needs` | a merge with no Approve must never reach an assigner that writes wants without a pipeline |
-| The verb `recovery` of `mesh-delivery` | a recovery is named by its author as a fact the bus keeps with who said it, never read from text (ADR 0666 §15, research 086 R10) |
+| The checker's step `check` becomes `pipeline`; the checker's kept verdicts taken into `kept` | the runner is an acting part in the checker's place (ADR 0666 §16); the first pipelines then run only what changed |
+| The field `callers` in a seat definition replaces the holders' trusted `callers`, a missing field admitting the holder roles and the operator only | the record makes the definition the grants part's one source (ADR 0666 §17); a field left out must open nothing |
+| `widens` in `pipeline-ended`, computed by the running runner over every part serving a step, passed on by the teller | a widening is said and nothing refuses it (ADR 0666 §17, §20); a change must not compute its own |
+| `merge-pull` judged from the forge module's own `failed-steps`, heard from `step-ended`, any run at the head's fingerprint counting unless a later rerun of that step passed, the protection read again on every `branch-moved` | the record has it judge from the events it consumes, never by a call, so a head merges while the runner is down (ADR 0666 §8, ADR 0596) |
+| The new assigner before the new `merge-pull` and the runner, by `needs`, both switching on the first `registration-changed` | a merge with no Approve must never reach an assigner that writes wants without a pipeline (ADR 0667 §5) |
+| The forge bridge's finding `branch-unprotected` | a move of a branch whose protection was removed starts no delivering pipeline and is said (ADR 0666 §3) |
+| The verb `recovery` of `mesh-delivery` | a recovery is named by its author as a fact the bus keeps with who said it, never read from text (ADR 0666 §20, research 086 R10) |
 | No forge status for a pipeline | the step results live on the bus (research 086 R10), shown by the runner and the delivery record; a status would be a second copy outside it |
 | The runner's `pipelines` kept 30 days, its outputs 7, keyed by source revision | the delivery record keeps its own copy of the events for 90 days; about 300 pipelines a day must fit its caps |
 | The checker's removal after the first end-to-end pipeline and a tested restore, its backup kept 90 days | ADR 0667 §6; 90 days is the delivery records' retention, the longest a trace reads back |
@@ -1040,7 +1054,7 @@ holds:
 
 - **the group's state**: the heads, the verdicts, the checks and the asks, which `merges` holds today; from milestone
   G's delivery the pipelines' `step-started`, `step-ended` and `pipeline-ended` in place of the verdicts, the checks and
-  the asks, kept as long as the record (ADR 0666 §5);
+  the asks, kept as long as the record (ADR 0666 §6);
 - **the trace**: the milestone, its issues, its pull requests, their commits, and the graph revisions the delivery
   moved between;
 - **what happened to each entry on each node**: for every entry of the graph difference, taken in, built, checked,
@@ -1073,7 +1087,7 @@ ADR 0656.
   the record and asks the operator nothing again (issue 1972). The Approve is withdrawn only as ADR 0441 §1 has it,
   when a member stops being mergeable, and a carried verdict is read as current (ADR 0548 §8). From G's delivery no
   Approve is asked per merge; an `approval` step's answer is the runner's, kept in the record as its step's end
-  (ADR 0666 §6).
+  (ADR 0666 §7).
 - **From G's delivery, a record for every landed merge.** A session merges through the seat `git` and the gate merges
   nothing, so every merge is one the gate did not make: the gate opens a record for each source revision of a watched
   branch the indexer takes in, a group's members in one, and `forge-made` no longer marks a record apart. A merge its
@@ -1173,7 +1187,7 @@ checker's `mesh/check` from a watch of the checker's state `owed`: reads of anot
 - **A group's merges follow one another, until G's delivery.** The gate says a group's next `merge-pull` only once the previous member's
   merged message is heard (ADR 0441 §5), so a member the forge refuses holds the rest, and none is merged ahead.
 - **From G's delivery the gate owes no merge, and the checker nothing.** A session calls `merge-pull` itself (ADR 0666
-  §6), and a group's members land one by one, the group ending when every member has (*Groups*); the checker's `owed`
+  §8), and a group's members land one by one, the group ending when every member has (*Groups*); the checker's `owed`
   goes with the checker, and the runner owes the forge nothing, a pipeline's result living on the bus. The gate still
   owes the delivery's view, a comment and the note's line, performed by the forge bridge as above.
 - **The bridge catches up from the seat.** At its start the bridge resumes its durable consumer and also reads
@@ -1239,7 +1253,7 @@ backup hold, superseded, covered, stopped, retired and failed) and the machine s
 module's progress on each node is its want against its have, shown by the view (ADR 0539 §17).
 
 **From milestone G's delivery the gate keeps no merge states.** With no check before a merge and no Approve per merge
-(ADR 0666 §6, §11), nothing is `proposed`, `ready`, `rejected` or `held` before a merge: a commit's states are its
+(ADR 0666 §7, §14), nothing is `proposed`, `ready`, `rejected` or `held` before a merge: a commit's states are its
 pipeline's steps, kept by the runner (*Pipeline steps and the policy*). The table, the gate's `table`, `recheck` and
 `close` and the one key per pull request go with the check; `stalled` lists the acts owed to the forge past their 15
 minutes and the records `record-open` names.
@@ -1332,9 +1346,9 @@ Findings 11). How each is kept, read and retained is this design's choice under
   it runs (ADR 0656, which changes ADR 0571 §8).
 - **From G's delivery, per watched branch and between artifacts.** The catalog graph is kept once per watched branch,
   each revision naming its branch, and its edges run between artifact references, of the six kinds of *Dependencies
-  between artifacts* (ADR 0666 §3, §8). The assigner computes a node's entries from the catalog graph of the branch its
+  between artifacts* (ADR 0666 §3, §11). The assigner computes a node's entries from the catalog graph of the branch its
   placement names, and writes a want from a revision of that branch whose `required` steps passed, in place of a trunk
-  revision's alone (ADR 0666 §5, which changes ADR 0656 §2).
+  revision's alone (ADR 0666 §6, which changes ADR 0656 §2).
 - **Reverted.** Only the new form is written: the indexer, the assigner and the gate keep nothing of ADR 0603 §2's
   keys or of `merges` and `turns` beside the new forms, since nothing reads them after milestone G. A revert of
   milestone G is a change like any other, checked and delivered, and the delivery system restores what it must
@@ -1382,7 +1396,7 @@ Findings 11). How each is kept, read and retained is this design's choice under
   candidate's graph writes none (ADR 0656). From G's delivery a want comes from a revision of the watched branch a
   placement chose whose `required` steps passed, and a candidate is a run on request's: the indexer builds it on the
   runner's `run-started` and drops it on that run's `pipeline-ended`, the gate's `heads-replaced` no longer making
-  candidates (ADR 0666 §5, §11).
+  candidates (ADR 0666 §6, §15).
 - **Each part acts on its own entries.** The builder, the build modules and the grants part each act when their own
   entries in the new revision differ from what they run (ADR 0656), reading them through the seat `mesh-wants`'s verbs
   and events, never its bus state (ADR 0596), and naming no other module (ADR 0656). The node-engine acts on its want
@@ -1412,7 +1426,7 @@ Findings 11). How each is kept, read and retained is this design's choice under
   candidate's view is read only by the parts that judge a candidate, inside the check its manifest validator and
   composer, and the indexer's candidate pass (ADR 0656, which changes ADR 0636 §4 in that the candidate pass joins
   them). From G's delivery a running part acts on a revision of a watched branch as on a trunk revision, and a
-  candidate's view is read only by a run on request's steps and the indexer's candidate pass (ADR 0666 §3, §11).
+  candidate's view is read only by a run on request's steps and the indexer's candidate pass (ADR 0666 §3, §15).
 - **Every other reader of which modules exist reads the catalog half, in the same milestone.** From milestone G the
   indexer declares no state `modules` and serves neither its tool `indexer_read_modules` nor a view of it (*Reverted*,
   above), so every module that learns from it which modules exist moves in milestone G, not after: the watchman (its
@@ -1495,7 +1509,7 @@ ADR 0656 leaves how each part is built to this design, under issue 1921; these f
 - **An acting rule's fields.** The seat's definition is where ADR 0656 has an acting part declare what it acts on. A
   seat's definition gains one optional field `acts`, a list of rules, each with three fields of its own: `step`, one of `take-in`,
   `validate`, `check`, `build`, `compose`, `grant` and `place`, and from G's delivery `pipeline`, the runner's, in
-  `check`'s place (ADR 0666 §11); `on`, either `every` (every module) or a `language`
+  `check`'s place (ADR 0666 §16); `on`, either `every` (every module) or a `language`
   naming the language of the modules it acts on, matched against what the manifest says its language is, as the
   indexer's language map matches today; and `bound`, how long an entry waits in that step for the acting part's new
   version (*An acting part's new version acts first*, below, gives each step's default). The definition format's own
@@ -1829,7 +1843,7 @@ names go, since every new acting part needed code changes elsewhere (research 08
   acting rule changes what a part acts on across every module it matches, so the operator's Approve ask of a change
   names any acting rule it adds, and any it widens: a `step`, an `on` or a longer `bound` that now matches more
   modules or holds them longer is named like an added rule. From G's delivery there is no Approve ask per merge, and
-  the pipeline's end names it in `widens` instead, refusing nothing (ADR 0666 §12).
+  the pipeline's end names it in `widens` instead, refusing nothing (ADR 0666 §17).
 - **Each step's wait is its own part's, read and released by its own tools.** The part that does a step holds its
   wait, so each wait has one owner that already holds that step's state, and says `wait-held` and `wait-ended` (*What
   each step says*) with the step, the acting part, its version, the entry and since when:
@@ -1881,7 +1895,7 @@ commit on the SDK's trunk or the head of an SDK pull request the forge holds, op
 ## Checks
 
 **Until milestone G's delivery.** The sections under *Checks* hold as written until then, and make milestone G's own
-check (ADR 0667 §2). From its delivery the pipeline makes the check and the checker goes (ADR 0666 §11): what each
+check (ADR 0667 §2). From its delivery the pipeline makes the check and the checker goes (ADR 0666 §14): what each
 part of the checker did, and where it goes, is in *The pipeline makes the check, and the checker goes*.
 
 ### One check per set of heads, kept by the bus
@@ -1985,10 +1999,10 @@ on the operator's Approve; below).*
 **Removed at research 085's milestone.** The hold, the merge turns, their stalled line, the gate's tools for them and
 the setting `check-gates-merge` go in milestone G, the gate's and the forge module's alike (the operator, on Telegram,
 2026-11-09 01:11 UTC, choosing "Remove them in G"; the forge's merge then judges no check, *The seat `git`*). The setting has been false since 2026-10-25, so the gate wrote no turn and held no merge in that time, and the
-operator's word for G is that no check gates delivery (1921's note of 2026-11-07). From G's delivery no merge waits on a check, and none on an Approve either (ADR 0666 §6): the checker is gone, and the
+operator's word for G is that no check gates delivery (1921's note of 2026-11-07). From G's delivery no merge waits on a check, and none on an Approve either (ADR 0666 §7): the checker is gone, and the
 pipeline runs on the landed commit (*Pipelines per module*). **Its record is accepted:** ADR 0661 ends ADR 0548 §2
 to §4, §9 and §10 and ADR 0551 and changes ADR 0534 §4's judgement of `mesh/check` by the merge; until G's delivery the
-rule below holds as those records have it. ADR 0662 is withdrawn; G builds ADR 0661 §1, §2 and §6, and ADR 0666 §6
+rule below holds as those records have it. ADR 0662 is withdrawn; G builds ADR 0661 §1, §2 and §6, and ADR 0666 §7
 changes its §3 to §5 (the merge on the Approve alone), which G therefore builds for no merge. Beside it, ADR 0663 (accepted: the indexer answers `revision` in its own runtime to
 exactly the parts that invoke it, the tool runner among them) holds the tool
 runner's first view of the catalog half (*Every other reader of which modules exist*). How it is checked: in the gate's whole-module test an approved merge into a
@@ -2172,7 +2186,7 @@ running versions never check in their place, and a check fails, naming the part,
 
 A try says beforehand whether a check will pass. It is the check's own code run on commits nobody pushed to a
 pull request, and it owes the forge nothing. It holds until milestone G's delivery, when the runner's run on request
-takes its place and the checker's try, its events and the indexer's try candidates go (ADR 0666 §11).
+takes its place and the checker's try, its events and the indexer's try candidates go (ADR 0666 §15).
 
 - **A try is a delivery group at exact commits.** The checker's try takes one or more members, each a repository
   and the exact commit asked, never a branch's head, with an optional trunk commit. One repository at one commit
@@ -2267,7 +2281,7 @@ takes its place and the checker's try, its events and the indexer's try candidat
 
 ## The Approve and the merge
 
-*ADR 0421, ADR 0398 §3, ADR 0406 §1, ADR 0659; from milestone G's delivery ADR 0666 §6.*
+*ADR 0421, ADR 0398 §3, ADR 0406 §1, ADR 0659; from milestone G's delivery ADR 0666 §7, §8.*
 
 **Until milestone G's delivery**, which is merged under it (ADR 0667 §2). From that delivery no Approve is asked per
 merge and the gate merges nothing: a session merges a pull request through the seat `git`'s `merge-pull`, and
@@ -2309,7 +2323,7 @@ session merges a pull request*).
   merges through the seat `git`'s verb `merge-pull`, which judges those two and no check, and a trunk move holds no
   merge for its carry (ADR 0661; *The seat `git`*, under *The verbs*). This shape is built for no merge: milestone G's
   own merges are made by the running gate, and from G's delivery `merge-pull` is the session's own act, judged on the
-  pull request's head, the branch's protection and the runs at its fingerprint, never on an Approve (ADR 0666 §6, which
+  pull request's head, the branch's protection and the runs at its fingerprint, never on an Approve (ADR 0666 §8, which
   changes ADR 0661 §3 to §5).
 - **A push or a Decline ends the Approve.** A new head ends its ask or its Approve, for a group every member's, and
   is said once on the pull request; the new head is asked again once its checks pass. A Decline merges nothing and
@@ -2331,7 +2345,7 @@ session merges a pull request*).
   (*Taken in by the indexer it names*, below; ADR 0633).
 - **From milestone G's delivery, per watched branch.** The gate writes one source revision per watched branch,
   `source.<branch>`, as a commit or a group lands there; the pipeline runs on each revision the indexer takes in, and
-  the wants follow a revision whose `required` steps passed, on the branch each placement chose (ADR 0666 §3, §5).
+  the wants follow a revision whose `required` steps passed, on the branch each placement chose (ADR 0666 §3, §6).
 - **From research 085's milestone, the wants follow the trunk's assignment graph.** A merge taken in makes a
   catalog graph revision and then an assignment graph revision; the assigner writes each want from that revision,
   its rules unchanged (ADR 0656), and each acting part's new version acts first in its own step (ADR 0656; *Two
@@ -2439,7 +2453,7 @@ timer. A group's merges arrive together.
   `take-in.taken`: a hand take-in as any take-in does, and a hand drop naming the drop, for a merge whose wait was
   said pending, so the watchman's `take-in-waits` clears; a drop of a merge never said pending emits none (ADR 0633
   §5, ADR 0639 §9).
-- **From milestone G's delivery** (ADR 0666 §3, §7, which change ADR 0633 §1 and §3 to §6): before any take-in, on every
+- **From milestone G's delivery** (ADR 0666 §3, §10, which change ADR 0633 §1 and §3 to §6): before any take-in, on every
   watched branch, the running indexer validates the revision with the manifest validator built from its heads, in the
   sandbox, and a revision it refuses stays pending, as the bullets above have it, with the way back a revert; a pending
   revision holds only its own watched branch; a group's member reaches it by landing, and the group ends when the gate's
@@ -2960,13 +2974,13 @@ From research 085's milestone the seat gains:
 |---|---|
 | `groups` with a group | that group's members, which the forge bridge reads in place of the gate's `merges` state (ADR 0656), and the acts the gate said it owes the forge for it, each with its id and its recorded outcome (*What the gate owes the forge*) |
 | `owed` | an act the gate owes the forge (a merge, a status, the delivery's view, a comment, a line on the commit's note), with its pull request, head and id, on `mesh.seat.mesh-delivery.event.owed.<repository>.<number>`, said only from the gate's account and heard by the forge bridge through a durable consumer (*What the gate owes the forge*) |
-| `milestone-asked`, `milestone-withdrawn`, `milestone-answered` | until G's delivery: the one Approve ask per milestone (ADR 0493 §9 as ADR 0659 §1 changes it, issue 1783), held until it is answered, or withdrawn by a new head and asked again (ADR 0441 §1); said on `mesh.seat.mesh-delivery.event.<event>`, the milestone in the event, apart from each delivery's `transition`, which stays as it is, so a waiter on one member's pull request wakes only on that member's `transition`. G's delivery ends the ask and its three events with the Approve per merge (ADR 0666 §6) |
+| `milestone-asked`, `milestone-withdrawn`, `milestone-answered` | until G's delivery: the one Approve ask per milestone (ADR 0493 §9 as ADR 0659 §1 changes it, issue 1783), held until it is answered, or withdrawn by a new head and asked again (ADR 0441 §1); said on `mesh.seat.mesh-delivery.event.<event>`, the milestone in the event, apart from each delivery's `transition`, which stays as it is, so a waiter on one member's pull request wakes only on that member's `transition`. G's delivery ends the ask and its three events with the Approve per merge (ADR 0666 §7) |
 | `record-opened` | a delivery record opened, which the watchman times for `record-open` |
 | `pinned`, `freed`, `heads-replaced` | the events by which the indexer and the assigner keep or drop graph revisions, said only from the gate's account (*The delivery record*) |
 | `record-ended`, `filling`, `full`, `room` | a delivery record ended; the ledger past 80 % of its cap; the ledger full; the ledger back below its cap (*The delivery record*) |
 
 From milestone G's delivery the seat's `table`, `recheck` and `close` go with the merge states (*The state table*),
-the milestone ask and its three events with the Approve per merge, and it gains (ADR 0666 §3, §15):
+the milestone ask and its three events with the Approve per merge, and it gains (ADR 0666 §3, §20):
 
 | Verb or event | Answers or does |
 |---|---|
@@ -2976,7 +2990,7 @@ the milestone ask and its three events with the Approve per merge, and it gains
 | `record-opened`, `recovery-merged` | a delivery record opened; a merge named a recovery, which the teller passes on to every channel |
 
 **The seat `mesh-pipeline-runner`**, from milestone G's delivery, defined in `mesh-delivery-contracts` with the callers
-of each verb (ADR 0666 §4, §12, §14):
+of each verb (ADR 0666 §4, §17, §19):
 
 | Verb | Answers or does | Callers |
 |---|---|---|
@@ -3022,7 +3036,7 @@ parts' manifests declare in `invokes` and `consumes` and what their code calls,
 | `contains` | whether one commit contains another | the indexer, the gate (`gitea_contains`) |
 | `statuses` | the statuses a commit carries | the gate (`gitea_commit_statuses`) |
 | `status`, `comment`, `view`, `note` | a commit status, a comment, the delivery's one view comment, a line on the commit's note under `refs/notes/mesh-plan`; a comment and a note line carry the act's id and an id already held is skipped | the forge bridge alone, performing the gate's and the checker's `owed` (`gitea_commit_status`, `gitea_add_comment`, `gitea_delivery_view`, `gitea_note_append`) |
-| `merge-pull` | until G's delivery: merges a pull request at the head the operator's Approve names; refuses a head that moved, a branch no rule guards, a head the Approve does not name and a merge git refuses; judges no check (below). From G's delivery: merges with the forge tools' account (ADR 0398 §2) at the head the caller names, judging that it is still the pull request's head and that the branch's protection refuses a direct push, the protection read again on every `branch-moved`, and refusing a head when any run at its build-input fingerprint failed a `required` step, judged from its own state `failed-steps` heard from the runner's `step-ended`, never by a call; a head with no run yet or a passed one merges, it never waits for a run and never asks an Approve (ADR 0666 §6). A pull request already merged at that head is answered performed | until G's delivery the forge bridge alone (`gitea_merge_pull_request`); from it any session the tool runner proves, and the operator |
+| `merge-pull` | until G's delivery: merges a pull request at the head the operator's Approve names; refuses a head that moved, a branch no rule guards, a head the Approve does not name and a merge git refuses; judges no check (below). From G's delivery: merges with the forge tools' account (ADR 0398 §2) at the head the caller names, judging that it is still the pull request's head and that the branch's protection refuses a direct push, the protection read again on every `branch-moved`, and refusing a head when any run at its build-input fingerprint failed a `required` step, judged from its own state `failed-steps` heard from the runner's `step-ended`, never by a call; a head with no run yet or a passed one merges, it never waits for a run and never asks an Approve (ADR 0666 §8). A pull request already merged at that head is answered performed | until G's delivery the forge bridge alone (`gitea_merge_pull_request`); from it any session the tool runner proves, and the operator |
 
 | Event of the seat | Says | Heard by (today's event) |
 |---|---|---|
@@ -3043,7 +3057,7 @@ Each is said on `mesh.seat.git.event.<event>`, declared in the seat's definition
   two package seats' verbs (design 51), gains a line per verb of the seat `git`: the act verbs name the forge bridge
   alone, the reads name each part that declares them in `invokes`; the grants part grants by it, and the holder
   refuses a caller it does not name. From G's delivery the callers per verb are the seat definition's field `callers`,
-  the grants part's one source (ADR 0666 §12): `status`, `comment`, `view` and `note` the forge bridge alone,
+  the grants part's one source (ADR 0666 §17): `status`, `comment`, `view` and `note` the forge bridge alone,
   `merge-pull` the persons and agent sessions the tool runner proves, the reads the parts that declare them. The forge module's own acting tools (`gitea_merge_pull_request`,
   `gitea_commit_status`, `gitea_delivery_view`, `gitea_note_append`, `gitea_add_comment`) retire with the milestone,
   and so do its watch of the checker's state `owed` and its read of the gate's `source`, so the bridge stays the one
@@ -3054,7 +3068,7 @@ Each is said on `mesh.seat.git.event.<event>`, declared in the seat's definition
   ADR 0548 §2 to §4, §9 and §10 also changes ADR 0534 §4's judgement of `mesh/check` by the merge; it is to be accepted
   before the push (*Nothing merges into a repository under check*). From G's delivery it judges no Approve either, its caller
   is any session the tool runner proves, and it refuses a head when any run at its fingerprint failed a `required` step,
-  never waiting for one (ADR 0666 §6; *Approval is a step, and a session merges a pull request*). The reads the
+  never waiting for one (ADR 0666 §8; *Approval is a step, and a session merges a pull request*). The reads the
   gate would have needed to merge (the forge's word for a conflict, the base's required statuses, the merging account's
   write access) are not added: no part of the mesh but `merge-pull` merges, and it answers git's own refusal of a merge
   as refused.
@@ -3465,8 +3479,9 @@ milestone with more tests than it starts with (research 085, Direction, One mile
 
 63. **R1, no hand act delivers a change.** A change to the indexer, the grants part and the tool runner is delivered end
     to end, and the hand-act log of the seat `mesh-hand-acts` names no act for it (live; mesh-delivery, mesh-tools).
-64. **R2, a watched branch triggers, any commit can be run.** A commit on a watched branch runs its module's pipeline;
-    a branch `feature/1966-x` runs on request and delivers nothing (whole, runner and forge bridge, mesh-delivery; live).
+64. **R2, a watched branch triggers, any commit can be run.** A commit on a watched branch runs its module's pipeline,
+    and a move of a watched branch whose protection was removed starts none and raises `branch-unprotected`; a branch
+    `feature/1966-x` runs on request and delivers nothing (whole, runner and forge bridge, mesh-delivery; live).
 65. **R3, steps detected, statuses in the catalog.** A module with no integration tests shows `nothing to run`; a
     manifest naming a status is refused (whole, Go build module, mesh-catalog; unit, manifest validator, mesh-delivery).
 66. **R4, only a `required` step holds, and every step is shown.** A failed `optional` step does not hold the delivery;
@@ -3482,8 +3497,8 @@ milestone with more tests than it starts with (research 085, Direction, One mile
     an import path (whole, assigner, mesh-delivery; unit, the Go build module's lint, mesh-catalog; live, a search of the
     delivery parts' code).
 69. **R7, any size.** Values of one, ten and a hundred times the bus's per-value limit are stored, sent as a verb's reply
-    and as an event, and read back whole by another module the reply or the event is for, and refused to a module it is
-    not for (whole, mesh-sdk, against the real bus).
+    and as an event, and read back whole by a caller the sender's seat definition names and a consumer declaring its
+    event, and refused to a module that declares neither (whole, mesh-sdk, against the real bus).
 70. **R8, an unread input refuses.** A build whose published packages cannot be read is refused, naming the state
     (whole, builder, mesh-delivery).
 71. **R9, no ask hidden.** A fourth ask and an ask after a Decline reach the channel; an ask with the same `about` from
@@ -3522,7 +3537,8 @@ The failure paths:
 82. **An indexer whose manifest its validator refuses** leaves its revision pending, holds only its own watched branch,
     raises `take-in-waits` at 60 minutes, and a revert taken in moves the branch on (whole, indexer).
 83. **A declined registration change, and an unprotected branch,** each write nothing: the first after its Decline, the
-    second refused naming the branch (whole, indexer).
+    second refused naming the branch; a watched branch whose protection is removed later starts no delivering pipeline
+    on its next move and raises `branch-unprotected` naming it (whole, indexer and forge bridge).
 84. **A composition step for a node that sleeps** passes it with a warning; a step whose part is not heard ends `could
     not run`, never passed; two modules owning one path are refused (whole, runner and assigner).
 85. **A forged step result**, from an account other than the step's seat holder's, or naming another commit or
@@ -3540,7 +3556,8 @@ The failure paths:
 91. **A session's merge** through `merge-pull` at its head merges with no run yet and with a passed run, and asks no
     Approve; with the runner stopped it still merges, judged on the `step-ended` it kept; a head at whose fingerprint any
     run failed a `required` step, a head that moved, and a branch whose protection was removed since its last
-    `branch-moved` are refused, each naming why; a failed `optional` step refuses nothing; a call from an account that is
+    `branch-moved` are refused, each naming why; a passing `rerun` of the failed step at that fingerprint, asked by the
+    operator, clears it and the head then merges; a failed `optional` step refuses nothing; a call from an account that is
     no proved session nor the operator is refused (whole, forge module and forge bridge, mesh-catalog and mesh-delivery).
 92. **A recovery named** by `recovery` is marked in its record and `recovery-merged` reaches every channel (whole, gate
     and teller).
@@ -3554,7 +3571,8 @@ ADR 0667's checks, of milestone G itself:
     member was delivered ahead of it (live).
 95. **Readers and the bus module first.** The reader releases, the node-engines that read `form` and `catch-up`, the
     grants part and the bus module are delivered before the modules that use them, by the delivery plan's derived edges
-    (live).
+    (live). The manifest validator accepts every manifest on the bus module's path, and refuses a runner manifest that
+    asks for a template (unit, manifest validator).
 96. **No order by hand.** The delivery plan names every ordering edge it derived, and the hand-act log of the seat
     `mesh-hand-acts` names none for the milestone (live).
 97. **What G removes, and when.** The checker's buckets and bus account and the gate's forge merge token are removed
@@ -3568,8 +3586,9 @@ ADR 0667's checks, of milestone G itself:
     rebuild pipelines, and the first pipelines after G carry what the checker's kept verdicts held (live; whole, runner).
 100. **The new assigner before the new merge.** In G's delivery the delivery plan delivers the new assigner before the
     forge module's new `merge-pull` and before the runner, by their `needs`, and no merge made through the new
-    `merge-pull` reaches an old assigner (live, read from the delivery plan and the forge module's and the assigner's
-    `running`).
+    `merge-pull` reaches an old assigner; until the first registrations' `registration-changed` the new assigner writes
+    wants from the trunk alone and `merge-pull` refuses every merge, and after it both switch (live, read from the
+    delivery plan and the forge module's and the assigner's `running`; whole, assigner and forge module).
 
 ## What retires
 
@@ -3685,7 +3704,7 @@ release reports the controller's code lines against research 063's baseline (acc
 | L6 | Provisioning leaves the controller (ADR 0570): every provision is one key of the seat `mesh-provisioner`, held by mesh-provisioner, holding a reference and never a value, and each placed module's provisioning plan a key of its state `plans`, both composed from placement, the wants and the manifests on change events; each provider acts once all a provision depends on is provided; the assigner moves a want only once its build's provisions are provided; a provision no want needs is retiring, and its account or credential is removed only on the operator's Approve, its data never; the vault mints each provision's secret sealed to the consumer's and the provider's node, and the consumer's node-engine writes it; a wait for a person is a provision's state, which the watchman reads; bus permissions stay with the grants part (ADR 0349, ADR 0230, ADR 0547 §11) | — | mesh-sdk, the node-engine (`mesh-host`), mesh-tools (the tool runner's provisioner client), mesh-catalog (mesh-provisioner, the vault, the provisioner client, postgres, keycloak, gitea, route-adapter), mesh-delivery (assigner, watchman) | 1954 |
 | L7 | History and records leave the controller (ADR 0571): the builder keeps its build log, one entry at a build's start and one at its end, from which build history and durations are read and the module mesh-catalog asks the builds it missed; the artifact sweep is the seat `mesh-artifact-sweep`, held by artifact-store-tools beside the artifact store, its keep set from the store's own listing, the wants and the build log, sweeping at each build's end from the lease write and recording each deletion in the hand-act log; disk readings are disk-load's own state on every node; who holds which seat is the state `seat-holders` of the seat `mesh-placement` (now `mesh-module-assigner`), and tools are found by the tool runners' announcements; what a node runs is its want and its have; the grants part writes `grants.<module>.<fingerprint>` and keeps memberships in its own state; root-free is a probe of the self-check; no manifest but the controller's reads, invokes or consumes `mesh-controller`, but a named list kept to the lease write, so the lease write's check passes (ADR 0189, ADR 0547 §11, ADR 0549 §6) | — | mesh-sdk, mesh-controller (its pin only), mesh-delivery (builder, indexer, assigner, grants part, view), mesh-catalog (artifact-store-tools, disk-load, the backup seat's holder, mounts, nfs-server, minio, mesh-watcher, the messenger, the self-check, the module mesh-catalog, docker), mesh-tools (the tool runner) | 1955 |
 | B0 | The bootstrap delivery: every check, a lone pull request's as a group of one and a verdict carried after a trunk move included, is judged by a checking program built from the change's own heads in the build seat's sandbox, which also makes the heads' one seat list that the check hands the manifest validator and the composer; it brings no seat definition and no manifest field, so the running checker checks it (ADR 0644; *The bootstrap delivery, and the one milestone after it*) | 26 needs it | mesh-sdk (`go/delivery`: the seat `node-build-go`'s ask `run` and the checker's record of which checking program judged; `go/composer`: the request's seat list), mesh-catalog (mesh-build-go: the run step, the refused answer, the kept programs' tools and sweep), mesh-delivery (checker: the checking program and its command), hq (this design, the glossary) | 1921 |
-| G | Two graphs and one revision view: the catalog graph and the assignment graph kept per revision, a change delivered as its graph difference, the acting parts' rules on their seats as bounded waits that hold their modules when the new version fails, the check on the change's own acting parts, the revision view and each process's own build, the gate's delivery record, and the trace's links (ADR 0656); no part reads a pull request's description (ADR 0659); every delivery part reaches the forge through the seat `git` and names no other module; nothing holds an approved merge for another check; and, one milestone with them, research 086's pipelines: a change of any module goes from a commit on a watched branch to the machines through its module's pipeline, its policy in its registration, ordered by edges between artifacts, with no Approve per merge and no hand act, the checker gone (ADR 0666, ADR 0667). Test counts at its start (G's prepare, 2026-11-09): mesh-delivery 665 unit and 68 integration, the node-engine (`mesh-host`) 1,742 unit; each other repository's and each catalog module's from the last check's verdict, read in the joint prepare | 26 to 62, 63 to 100 | mesh-sdk (the runtime: the fingerprint, the view, the definition reader, the seat list's one wiring), mesh-contracts and the domains' contracts modules (`acts`, the new verbs and events, the seat `mesh-grants`, the seat `git`'s verbs), mesh-delivery (indexer, assigner, checker until its removal, builder, grants part, gate's view, forge bridge, watchman, the new pipeline runner `mesh-delivery-pipeline`, `contracts` and `sdk` moved under `modules/`), mesh-catalog (the gate, the build modules, the forge module, mesh-issues, mesh-knowledge, the `node-backup` holder, the router, nats: a module's kept data on the bus as a backed-up item and the object store beside each state), mesh-sdk (also the shared state layer of any size), the node-engine (`mesh-host`), hq | 1966, 1961 (retargeted to this row's shape), 1660, 1972, 1721, 1783, 1785, 1794, 1791, 1373, 595; 1962 goes back with 1958, whose assignment entry it needs (ADR 0641 §3) |
+| G | Two graphs and one revision view: the catalog graph and the assignment graph kept per revision, a change delivered as its graph difference, the acting parts' rules on their seats as bounded waits that hold their modules when the new version fails, the check on the change's own acting parts, the revision view and each process's own build, the gate's delivery record, and the trace's links (ADR 0656); no part reads a pull request's description (ADR 0659); every delivery part reaches the forge through the seat `git` and names no other module; nothing holds an approved merge for another check; and, one milestone with them, research 086's pipelines: a change of any module goes from a commit on a watched branch to the machines through its module's pipeline, its policy in its registration, ordered by edges between artifacts, with no Approve per merge and no hand act, the checker gone (ADR 0666, ADR 0667). Test counts at its start (G's prepare, 2026-11-09): mesh-delivery 665 unit and 68 integration, the node-engine (`mesh-host`) 1,742 unit; each other repository's and each catalog module's from the last check's verdict, read in the joint prepare | 26 to 62, 63 to 100 | mesh-sdk (the runtime: the fingerprint, the view, the definition reader, the seat list's one wiring), mesh-contracts and the domains' contracts modules (`acts`, the new verbs and events, the seat `mesh-grants`, the seat `git`'s verbs), mesh-delivery (indexer, assigner, checker until its removal, builder, grants part, gate's view, forge bridge, watchman, the new pipeline runner `mesh-delivery-pipeline`, `contracts` and `sdk` moved under `modules/`), mesh-catalog (the gate, the build modules, the forge module, mesh-issues, mesh-knowledge, the `node-backup` holder, the router, nats: a module's kept data on the bus as a backed-up item and the object store beside each state), mesh-sdk (also its small object store package, for values of any size), the node-engine (`mesh-host`), hq | 1966, 1961 (retargeted to this row's shape), 1660, 1972, 1721, 1783, 1785, 1794, 1791, 1373, 595; 1962 goes back with 1958, whose assignment entry it needs (ADR 0641 §3) |
 
 An issue is in one row only (ADR 0493 §2): where a row named an issue another row names too, the last row keeps it and the
 earlier row says so in words (the operator, 2026-10-26). Milestone M1 makes each row a record of the issue tracker
@@ -3832,8 +3851,8 @@ B0's own choices, each checked by the rows of *How it is checked* below:
 - Who may review a change, and the review verb's grant: issue 1782, outside milestone G; no part reads a review line
   meanwhile, and the verb, if built, gates nothing (ADR 0659 §2, §3).
 - **A session's merge of a recovery fix** is decided: an ordinary merge through its pipeline, named a recovery by its
-  author (ADR 0666 §15; *A recovery fix is an ordinary merge*). The verb this design sketched for it is not built.
-- **How the runner knows a review's caller is the commit's author.** ADR 0666 §12 refuses a review from the commit's
+  author (ADR 0666 §20; *A recovery fix is an ordinary merge*). The verb this design sketched for it is not built.
+- **How the runner knows a review's caller is the commit's author.** ADR 0666 §17 refuses a review from the commit's
   author; the forge names the author by its forge account and the runtime proves the caller's bus account, and no
   record binds the two. Until one does, code review is never a `required` step: `register` and `policy` refuse it
   (*A module's registration*); issue 1966 tracks it (note 157).
@@ -3929,7 +3948,11 @@ a tested backup kept 90 days; code review never `required` until forge accounts
 `callers` admitting the holder roles and the operator only; `run` called by sessions and the operator; the stores
 estimated again with publish rebuilds; the build capacity; test counts in `step-ended`; `pipelines` keyed by source
 revision; a pipeline superseded only on a changed fingerprint; a build seat restarted mid-step; tests 98 to 100. Round 2
-is to come.
+(fix-1965's rulings of 2026-11-10): health and events and running and testing approve; seams and tools and security and
+upgrade asked, and this amendment adds, the manifest validator's cases on the bus module's path, the checker leaving
+the foundation list, a passing rerun clearing a failed step for `merge-pull`, the one switch fact of the first
+registrations, `branch-unprotected`, sent objects read by a standing grant from the manifests, and the object store as
+a small mesh-sdk package only its users import. Round 3 is to come.
 
 Left as notes on issue 1921, not in this amendment: a conformance check that a changed layout raises its `form`; the
 size and retention of restore points and set-aside data; who may call `restore` for bus data and which manifest grants

03-DESIGN/01-to-be/51-the-registries-keep-what-is-named.md

@@ -266,7 +266,7 @@ the verb.
 
 ### The versions
 
-- **From the delivery of design 47's milestone G, a package is numbered when it is published** (ADR 0666 §9). The
+- **From the delivery of design 47's milestone G, a package is numbered when it is published** (ADR 0666 §12). The
   builder numbers a package's version at its publication, never only when its build is claimed: a package's trunk
   build is claimed with no number and built by its digest, and once its build is done the builder gives it the next
   count of its series, under compare-and-set, and says `numbered`, on which the build module calls `publish` with
@@ -284,7 +284,7 @@ the verb.
   publishes nothing, `package-published` is said once per publication, and only the importing artifacts rebuild
   (design 47, test 80).
 - **A build that cannot read the published packages refuses**, naming the unread state, never building against a guess
-  (ADR 0666 §9; design 47, test 70).
+  (ADR 0666 §12; design 47, test 70).
 - **Until that delivery, the builder numbers every trunk build** of a package, image, bundle or archive at its claim: the package series
   its manifest declares (design 32; `0.1` when it declares none) and the next count for that name, under
   compare-and-set. Numbers follow the order of the forge bridge's merge events: a claim of a later merge waits until
@@ -343,7 +343,7 @@ the verb.
   not wake on it, for each head of a delivery group member that declares a package; a person asks through `builder_tag`.
   From the delivery of design 47's milestone G the checker goes, and the pipeline runner says `tag-wanted` instead, on
   its own seat `mesh-pipeline-runner`, for each member that declares a package of a run on request of a group not yet
-  merged (ADR 0666 §11): a group merged together is one source revision whose packages are published before its
+  merged (ADR 0666 §15): a group merged together is one source revision whose packages are published before its
   dependents build, so only a run on request needs a tagged version. The
   builder consumes the event on a durable consumer and keeps the ask in its own state `tag-asks`, removed when its
   branch is merged or deleted, or its pull request closed. An ask the builder has not answered within five minutes is narrated in the build log