Design 47 and the glossary: the batch's record in the chain is the rollout (ADR 0408's review)

00-META/glossary.md

@@ -222,7 +222,7 @@ every other domain has something to run on. **Recorded by** the controller and t
   records (nodes, settings, declared config, predefined keys), after each change commits in its store and only
   when the value differs, with one event per write. The store stays the record; the self-check compares
   the two and raises `mirror-drifted` on any difference
-  (ADR 0289, ADR 0356). Builds, delivery plans with their rollouts, and assignments are no mirrors: they are
+  (ADR 0289, ADR 0356). Builds, rollouts and assignments are no mirrors: they are
   the chain, kept on the bus as their only source (ADR 0408). Shortened to *mirror* where the
   text is about the controller's records; the builder's *mirrored* `upstream` image (Change and delivery) is
   a different thing, a copy of an outside image in the artifact store.
@@ -477,7 +477,7 @@ planner, the rollout). **Downstream of** Module, Core, Health and repair and Dat
 - **rollout** — the controller's sending of one batch's builds across nodes, at most one trunk commit per
   repository, tier by tier, to every node that runs each module at once (ADR 0276, ADR 0360). Rollouts that share a
   repository, a module or a graph edge run one after another; others run side by side (ADR 0407). It names every
-  merge it answers, and its record is part of its delivery plan's key on the bus (ADR 0408). A primitive the delivering stage
+  merge it answers, and its record is one key of the bus's rollouts bucket, a link of the chain (ADR 0408). A primitive the delivering stage
   asks for, not an object anyone manages. A **tier** is one step of a rollout: a module, then the modules
   built against it. The controller's verb `plans` lists the rollouts. A module is rolled out by its `roll`
   policy.

03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md

@@ -47,7 +47,7 @@ is no "release branch"** (ADR 0401).
 
 **Every step starts on an event, and the state lives on the bus.** The forge's events, the controller's
 events and the nodes' reports move a delivery; the bus's own rules keep the queues, the merge window and the
-order; and one chain, from module to commit to build to delivery plan to assignment, is kept in the bus's
+order; and one chain, from module to commit to build to rollout to assignment, is kept in the bus's
 key-value store as its only source (ADR 0406, ADR 0407, ADR 0408). A running delivery never touches merging:
 every merge is recorded at once for the next delivery plan of what it touches.
 
@@ -76,7 +76,7 @@ controller's delivery tables and the timers that polled them.
   and the nodes' backup seats for the backups a delivery needs. It never sends to a machine, writes a
   declaration or registers a build (ADR 0239 §25).
 - **The controller** keeps planning, ordering, registration, sending and judging. It writes the chain's
-  links it owns — builds, delivery plans with their rollouts and tiers, assignments — and the merge window's
+  links it owns — builds, rollouts with their tiers, assignments — and the merge window's
   keys, all on the bus, by compare-and-set, while it holds the lease.
 - **The builders**, the holders of the build seat, build and check with toolchains installed on their node, as
   the build seat's own account, and take their jobs from the bus's work queues, delivery builds first
@@ -371,29 +371,34 @@ delivery time.
 
 *ADR 0408.*
 
-Module, commit, build, published package or artifact, delivery plan and assignment are one chain, each link
-answerable from the next.
+Module, commit, build, published package or artifact, rollout and assignment are one chain, each link
+answerable from the next. A **rollout** here is the controller's record of one batch's delivery; a delivery's own
+delivery plan (*A delivery* above) stays the delivery's, and names the rollout that delivers it.
 
 | Link | Names | Written by | Bucket |
 |---|---|---|---|
-| build | its module, repository and commit, its reuse key, what it published: an artifact by digest or a package release by name and version | the controller | one key per build |
-| delivery plan | the commit it fixed per repository, the builds it carried, its rollout and tiers, the machine steps, and every assignment it changed with the build before and after | the controller | one key per plan |
-| assignment | the module and node, the build, artifact or package and commit it runs, and the plan that put it there | the controller | one key per module on a node |
-| delivery, group | as *A delivery* says | mesh-delivery | `deliveries`, `groups` |
-| pull request | head, trunk commit asked against, verdict | mesh-delivery | one key per open pull request |
-| batch | its merges, and the window's two keys | the controller | one key per batch, two per window |
+| build | its module, repository and commit, its reuse key, what it published: an artifact by digest or a package release by name and version | the controller | `mesh-controller_builds` |
+| rollout | the commit it fixed per repository, its tiers, the builds it carried, the machine steps, and every assignment it changed with the build before and after; its states and transitions | the controller | `mesh-controller_rollouts` |
+| assignment | the module and node, the build, artifact or package and commit it runs, and the rollout that put it there | the controller | `mesh-controller_assignments` |
 
-- **The bus is the only source.** Each bucket is written by its owner by compare-and-set, and the controller
-  reads its own buckets to decide. No table of the controller's store holds builds, rollouts, batches or
-  assignments, so no record mirror, audit or healer exists for them; the nodes, settings, declared-config and
-  predefined-keys mirrors stay as ADR 0289 and ADR 0356 have them.
-- **What ended stays answerable.** A key of an ended plan or build stays while another link names it; each
-  bucket keeps up to 64 earlier revisions of each key as its history. A value is never cut to a summary and stays under the
-  bus's largest message. The bus's storage is declared as data and backed up like any data module's.
+Beside the chain, on the bus too: deliveries and groups (mesh-delivery's `deliveries` and `groups`, ADR 0239 §37),
+one key per open pull request (mesh-delivery), and each open batch with its merges and its window's two keys (the
+controller, ADR 0407).
+
+- **The bus is the only source.** Each bucket is written by the controller that holds the lease, by
+  compare-and-set, and the controller reads its own buckets to decide; a rollout resumes from its key after a
+  restart. No table of the controller's store holds builds, rollouts, batches or assignments, so no record mirror,
+  audit or healer exists for them; the nodes, settings, declared-config and predefined-keys mirrors stay as
+  ADR 0289 and ADR 0356 have them. A module reads a bucket by naming it in `reads`; mesh-config reads the
+  assignments bucket.
+- **No key of the chain is removed.** Each bucket keeps up to 64 earlier revisions of each key as its history. A
+  value is never cut to a summary and stays under the bus's largest message. The bus's storage is declared as data
+  protected by a backup, so it is backed up nightly and before a delivery moves the bus.
 - **One read answers each question.** For any module on any node, one read of its assignment names the commit,
-  the build, the artifact or package and the plan that put it there; one read of a plan lists every assignment
-  it changed.
-- **The tables go by a numbered migration**: their rows are written once into the buckets, then dropped from the
+  the build, the artifact or package and the rollout that put it there; one read of a rollout lists every
+  assignment it changed.
+- **The tables go by a numbered migration**: builds, rollouts and assignments are written once into the buckets,
+  waiting build requests onto the work queues and an open batch into its keys; then the tables are dropped from the
   controller's store and its consolidated schema.
 - **The artifact store and the package registry keep the bytes**; the chain names them (ADR 0251).
 
@@ -461,7 +466,7 @@ What the build proves before this design is implemented (research 055's directio
 8. The merge window closes by its key's expiry.
 9. A hotfix to a module the running feature's delivery does not touch reaches the machines in minutes, beside it.
 10. For any module on any node, one read of its assignment names the commit, build, artifact or package and the
-    delivery plan that put it there, and one read of that plan lists every assignment it changed.
+    rollout that put it there, and one read of that rollout lists every assignment it changed.
 11. Two merges into one repository while a delivery of that repository runs are both delivered by the next plan,
     with no person's release and nothing held in mesh-delivery.
 12. No table in the controller's store holds builds, rollouts or assignments.