Design 47 records its review by architectural domain of 2026-11-06

Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i

03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md

@@ -2470,21 +2470,23 @@ order inside one milestone, for this one case (ADR 0644).
 
 ## Reviewed by architectural domain
 
-The amendment of 2026-11-05 (ADR 0637, ADR 0638, and ADR 0633 with its insights of 2026-11-05) was reviewed by the
-four reviewers by architectural domain side by side (playbook 01), and the lead ruled on every finding in round 1.
-The rulings that no record decided became ADR 0639, which the text cites clause by clause. What was found, and what
-answers it:
+The amendment for ADR 0656 and ADR 0644 (2026-11-06) was reviewed by the four reviewers by architectural domain side
+by side (playbook 01), in three rounds, the lead ruling on every finding; a fourth, confirming read covered only the
+revert section, written after the operator's ruling that no old form is kept. Every choice it answers with is this
+design's own under ADR 0656, written with its reason in *Choices this design makes under ADR 0656*. What was found,
+and what answers it:
 
 | Domain | Found | Answered by |
 |---|---|---|
-| seams | the indexer said to read none of the checker's state, while it reads the checker's previews and the checker watches its candidates; the forge bridge's read of the gate's `merges` unmarked | *A try* (two reads that stay under ADR 0596 §3 until issue 1966); *Taken in by the indexer it names* (the bridge's read marked the same) |
-| tools | the try's tools not listed against the four lines; the hand acts not said to clear the condition | *A try* (the table of the checker's and the indexer's tools, `indexer_recover_tries` new); *Taken in* (both hand acts emit `take-in.taken`, ADR 0639 §9) |
-| bus forms | the form of `pending` and the try events' contract unsaid | *Taken in* (`pending` in the old form the grants part creates); *A try* (the package `tryevent` of mesh-delivery's sdk) |
-| running qualities | `checker_tries` not answering; the new indexer before the new checker in this release; a lost try event; what a narrowed try keeps; a recovery cut at 64; how long tries are kept; a try waiting for its candidate | *A try* (nothing deleted, asked again, said in `indexer_try_candidates`, the ordering edge; publish with retry, `try.ended` on every end; the narrowed try's verdicts; every open try listed; 7 days; the reason in the try read, bounded by the step bound) |
-| testing | ADR 0633's live case on the node-engines' reads lost; no live case for ADR 0638 | *Taken in* (`node_manifest_reads` and `indexer_holds` on every node); *A try* (the candidate read during the registry group's try, gone after `try.ended`) |
-| health and events | an own build unknown left unbounded; who raises `take-in-waits`; what the two take-in events carry | *Taken in* (`take-in.pending` "own build unknown"; the watchman's finding and the condition keeper, ADR 0564 §2; the events' body) |
-| security | any account could publish a try event; a node's missing composition answer | *A try* (only the checker's account publishes `try.*`, a manifest-test row; the try ends as error naming the node, keeping no verdict) |
-| upgrade | the old indexer's take-in during its replacement: a build learnt lazily and kept let a process being replaced take in with its old validator | *Taken in* (the indexer fixes its own build at its start, never later from `composition`) |
+| seams | a capability change read from the node-engine's bucket; a live search that could not pass; the node-engine's input said two ways; waits held by four parts but read and released by one; a new field in the want an old node-engine cannot read; the catch-up tool named by a manifest a revert cannot carry | `capabilities-changed`; the search narrowed to the reads the view replaces; the node-engine reads its want and the catalog half; each holder's own wait tools; the assigner holds a node's wants until its new node-engine runs; the restore point carries the catch-up tool |
+| tools | no fill read; the repair tool's path; the indexer's hand tool; the data set aside at a restore | fill in each read tool; `gate_record_repair` names each owner's verb; `indexer_recompute`; `backed-up` lists it and `discard-aside` removes it |
+| running qualities | storage that grows without limit; the build module's wait ended two ways; a checking program built per check; the wait clocks; a revert whose assigner starts before its indexer catches up | 90-day records, unpinned revisions removed, entries stored once, caps with `filling`, `full` and `room`; the agreed toolchain; one build per fingerprint; clocks from the build's end, composing per node; the ordering edges of a revert |
+| testing | a revert test that needed a second check; the view with the assigner down | whole-module revert tests on the real builds from before milestone G; the assigner stopped and a cold control-node |
+| health and events | waits with no event or bound; a record that never ends; parts waiting for the view unreported; when a wait is first said | `wait-held` at the start with its bound, timed by the watchman; held and failed outcomes and `record-ended`; `view-waits` after five minutes |
+| security | a checking program hiding a removed rule; forged events; the `run` ask's grant; a kept build overwritten by the program it built; the review line retired before the review verb's grant | the running checker names every change of the checking program's fingerprint; the node in event subjects and grants per account; builds kept only from a step that runs nothing; the review verb left to issue 1782 |
+| upgrade | a newer indexer never wanted after milestone G; a revert across a change of kept data's form | the stand-in catalog graph revision; restore points taken before a move across a `form` change, restored at a revert before the reverted build starts, the node-engine back last |
 
-Left as notes, not in this amendment: the grants of `checker_try` and of the hand tools (the operator's), and the
-test budget of the checker and the indexer.
+Left as notes on issue 1921, not in this amendment: a conformance check that a changed layout raises its `form`; the
+size and retention of restore points and set-aside data; who may call `restore` for bus data and which manifest grants
+the catch-up call; the hold's bound while a large backup is taken; the granting and placing bound read from the first
+live run; a builder seat.