Design 47 tests each change ADR 0656 makes, and leaves the review verb as ADR 0493 §5 has it

ADR 0656 v6 no longer changes ADR 0493 §5: who may review is another question,
waiting on issue 1782, so the design stops saying the reviewer comes from the
caller's bus account or that the author is refused. Each change ADR 0656 makes
in an earlier record now has its own acceptance test, so the milestone proves
every one of them.

Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i

03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md

@@ -1719,7 +1719,7 @@ From research 085's milestone the seat gains:
 | Verb or event | Answers or does |
 |---|---|
 | `groups` with a group | that group's members, which the forge bridge reads in place of the gate's `merges` state (ADR 0656) |
-| `review` | records a reviewer's verdict at the full head it reviewed, the reviewer taken from the caller's bus account, and refuses a review by the head's author; once it runs, the line in a pull request's description is read no more (ADR 0656, which changes ADR 0493 §5; ADR 0496 §3, issue 1782). The caller's account is the one the bus authenticated (ADR 0597 §7) |
+| `review` | records a reviewer's verdict at the full head it judged, as ADR 0493 §5 has it; once it runs, the line in a pull request's description is read no more (ADR 0496 §3, issue 1782). Whether the reviewer is taken from the caller's bus account and a review by the head's author refused is another question, waiting on issue 1782 |
 | milestone events | the one Approve ask per milestone (ADR 0493 §9 as ADR 0496 §2 changes it, issue 1783), held until it is answered, or withdrawn by a new head and asked again (ADR 0441 §1); said on a subject of their own, while each delivery's transitions stay as they are, so a waiter on one member's pull request wakes only on that member's `transition` |
 | `pinned`, `freed`, `heads-replaced` | the events by which the indexer and the assigner keep or drop graph revisions (*The delivery record*) |
 
@@ -1727,13 +1727,13 @@ From research 085's milestone the seat gains:
 of the revision view, ADR 0656), and `entry` and `difference` on `mesh-wants` (ADR 0656), with the events of *What
 each step says*.
 
-**Links of the trace.** A session reviews under its own bus account (ADR 0656, which changes ADR 0493 §5), and the
-trace's other links are this design's choices under ADR 0656, so that one call traces research to the running build
+**Links of the trace.** The review is recorded by the verb `review` (ADR 0493 §5), and the trace's other links are
+this design's choices under ADR 0656, so that one call traces research to the running build
 with no text match (research 085, Findings 7). The issue tracker gains link kinds from an issue to the decision and to the research effort
 it carries, made by a tool call and never by text, as ADR 0493 §4 has every link made; the knowledge base gains a
 typed link from a decision to the milestone of the issue tracker that builds it, made by a tool call, which joins the
 link kinds of its link-fits rule (design 55), beside the `became` link a research effort gets at its graduation
-(playbook 02). How it is checked: whole (gate), a review by the head's author is refused, and the verdict is read from the verb, not the description; one ask per milestone, withdrawn by a new head;
+(playbook 02). How it is checked: whole (gate), the verdict is read from the verb, not the description; one ask per milestone, withdrawn by a new head;
 a waiter on one member's pull request wakes only on that member's transition. Whole (issue tracker, knowledge base):
 an issue linked to a decision and to a research effort reads both back; a decision linked to its milestone reads it
 back. Live: research 085's milestone's record reads back research 085 to its decisions, its milestone, its issues,
@@ -1915,43 +1915,65 @@ From ADR 0548 and ADR 0551 (issue 568):
     and the forge's statuses; issue 568 is resolved only once this has passed on the mesh (ADR 0548 §10, ADR 0551
     §2).
 
-From research 085 (ADR 0644 and ADR 0656; each section above names its tests and their level; 26 and 30 are ADR
-0656's own checks, and ADR 0656 leaves the rest to this list):
+From research 085 (ADR 0644 and ADR 0656; each section above names its tests and their level). 26 and 30 are ADR
+0656's own checks; 38 to 45 check each change ADR 0656 makes in an earlier record; the rest ADR 0656 leaves to this
+list:
 
 26. **The milestone checks itself.** Research 085's milestone's group check runs on the checking program built from
     that group's own heads, read from the check's record (ADR 0644, How it is checked), and no member of it was
     delivered ahead of it.
 27. **A new acting part needs no code elsewhere.** A fixture seat declaring a rule, with a fixture holder, gets its
-    edges with no code change elsewhere, and a search of the delivery parts' code finds no other module's name
-   .
-28. **A change to a build module is built by the new one, once.** A group changing the shared contracts and the build
-    module that builds them is delivered, the contracts built by the running build module first and the rest by the
-    new one; a cycle among waits within one step is refused.
+    edges with no code change elsewhere, and a search of the delivery parts' code finds no other module's name.
+28. **Waits stay within their step.** A cycle among waits within one step is refused; an acting part acting on
+    itself, and two acting parts acting on each other in different steps, pass.
 29. **A failed acting part leaves the mesh on what runs.** A build module whose new build fails, and one that does not
     run within its bound, each leave the modules it builds on their running builds and raise the condition naming
     it, which clears when the wait ends.
-30. **A change is delivered as its difference.** A fixture change with a new fingerprint and an empty difference is
-    refused, naming its module, and a group's preview before its merge is its difference; a group that changes the indexer, the checker and a module that needs both is delivered with no
-    delivery ahead of it, each acting part's new version first in its own step, a node asleep throughout catching up
-    when it wakes.
-31. **A check never passes on the running version's word.** A change whose acting part does not build, and one whose
-    checking program does not run, each fail their check naming the part ; the registry
-    group passes its one check with its own checker, validator and composer.
+30. **A change is delivered as its difference.** A group that changes the indexer, the checker and a module that
+    needs both is delivered with no delivery ahead of it, each acting part's new version first in its own step, a
+    node asleep throughout catching up when it wakes; a fixture change with a new fingerprint and an empty difference
+    is refused, naming its module; a group's preview before its merge is its difference.
+31. **The registry group checks itself.** The registry group passes its one check with its own checker, validator and
+    composer.
 32. **One view.** A pull request adding a seat and a module using it is validated by the indexer's candidate pass and
-    checked by the checker with the same definitions, and a search of the readers' code finds no compiled seat list
-   .
-33. **Each process knows its own build.** A part started while its node's want differs from what runs reports the
-    build it was started with.
-34. **Two graphs, one source.** A revision of the assignment graph computed again from its named inputs equals the one
+    checked by the checker with the same definitions, and a search of the readers' code finds no compiled seat list.
+33. **Two graphs, one source.** A revision of the assignment graph computed again from its named inputs equals the one
     kept.
-35. **One record traces a delivery.** Stopping and restarting the gate in the middle of a delivery leaves the record
+34. **One record traces a delivery.** Stopping and restarting the gate in the middle of a delivery leaves the record
     complete, with no outcome counted twice, and one call traces an issue of the registry milestone to each node's
-    running build, also after six later merges; a group approved before the switch to
-    the records is not asked again.
-36. **The trace is links.** A review by the head's author is refused, and research 085's
-    milestone reads back from research 085 to its reviews with no text match.
-37. **The milestone can be undone.** A revert of research 085's milestone passes its check under the milestone's own
+    running build, also after six later merges; a group approved before the switch to the records is not asked again.
+35. **The trace is links.** Research 085's milestone reads back from research 085 to its decisions, its milestone,
+    its issues, its pull requests and their reviews with no text match.
+36. **The milestone can be undone.** A revert of research 085's milestone passes its check under the milestone's own
     checker (research 085, Direction, One milestone).
+37. **Nothing is delivered ahead.** Research 085's milestone is delivered with no part delivered ahead of it, read
+    from its delivery record (ADR 0656, How it is checked).
+
+Each change ADR 0656 makes in an earlier record, and its test:
+
+38. **The want comes from the assignment graph** (ADR 0571 §8). A node-engine's want is written only from a trunk
+    revision's assignment graph: a pull request's graph leaves every node's want unchanged, and a placement-only
+    revision moves the want of the module it places (whole, assigner).
+39. **A module changed with its build module is built once, by the new one** (ADR 0603 §1, §3, ADR 0614 §1, §6). A
+    group changing the shared contracts and the build module that builds them is delivered, the contracts built by
+    the running build module first and the rest by the new one, each module built once, with no build by the running
+    recipe for a module the new build module builds (whole, assigner and builder).
+40. **The graph is kept per revision** (ADR 0603 §2). A source revision taken in gives one catalog graph revision and
+    its assignment graph revision, kept as objects in the old `objects` sections, and a revision a delivery record
+    pins is not removed; no key per module with five past values is written (whole, indexer and assigner).
+41. **The tiers are a view of the difference** (ADR 0603 §6). The view's tiers of a group equal those read off its
+    difference by `difference`, with no other source read (whole, view and assigner).
+42. **A check fails by name** (ADR 0603 §10, ADR 0614 §7). A fixture change whose acting part does not build, one
+    whose checking program does not run, and one whose build module invokes a verb no running holder serves, each fail
+    their check naming the part, and no module of them is composed from its manifest (whole, checker).
+43. **A part waits for the revision view** (ADR 0636 §1, §4). With the indexer stopped, the checker, the builder and
+    the grants part each keep running what they run, say they wait, naming the revision, and act once it is back; a
+    candidate's heads are read by the indexer's candidate pass and by no running part (whole).
+44. **A process reports its handed build** (ADR 0639 §7). A part started while its node's want differs from what runs
+    reports the build it was started with, and `node_process_builds` reads it (whole, node-engine).
+45. **The forge bridge reads a group from the gate's verb** (ADR 0633 §4, §5). The forge bridge sets the group on each
+    merged message and publishes a group's end again from the seat `mesh-delivery`'s verb `groups`, and its account
+    holds no read of the gate's `merges` state, so a read of it is refused (whole, forge bridge).
 
 ## What retires
 
@@ -2004,8 +2026,8 @@ From research 085 (ADR 0644 and ADR 0656; each section above names its tests and
   the tiers worked out from five live sources (ADR 0603 §6, as ADR 0656 changes it); a seat list compiled into a
   part, and every read of another module's bus state the revision view replaces (ADR 0656); the gate's `merges` and
   `turns` as its own state, carried into the delivery records and kept current beside them until a later change
-  removes them; and the review line in a pull request's description, once the verb `review` runs (ADR 0656,
-  ADR 0496 §3).
+  removes them; and the review line in a pull request's description, once the verb `review` runs
+  (ADR 0496 §3).
 
 ## Milestones
 
@@ -2056,7 +2078,7 @@ release reports the controller's code lines against research 063's baseline (acc
 | L6 | Provisioning leaves the controller (ADR 0570): every provision is one key of the seat `mesh-provisioner`, held by mesh-provisioner, holding a reference and never a value, and each placed module's provisioning plan a key of its state `plans`, both composed from placement, the wants and the manifests on change events; each provider acts once all a provision depends on is provided; the assigner moves a want only once its build's provisions are provided; a provision no want needs is retiring, and its account or credential is removed only on the operator's Approve, its data never; the vault mints each provision's secret sealed to the consumer's and the provider's node, and the consumer's node-engine writes it; a wait for a person is a provision's state, which the watchman reads; bus permissions stay with the grants part (ADR 0349, ADR 0230, ADR 0547 §11) | — | mesh-sdk, the node-engine (`mesh-host`), mesh-tools (the tool runner's provisioner client), mesh-catalog (mesh-provisioner, the vault, the provisioner client, postgres, keycloak, gitea, route-adapter), mesh-delivery (assigner, watchman) | 1954 |
 | L7 | History and records leave the controller (ADR 0571): the builder keeps its build log, one entry at a build's start and one at its end, from which build history and durations are read and the module mesh-catalog asks the builds it missed; the artifact sweep is the seat `mesh-artifact-sweep`, held by artifact-store-tools beside the artifact store, its keep set from the store's own listing, the wants and the build log, sweeping at each build's end from the lease write and recording each deletion in the hand-act log; disk readings are disk-load's own state on every node; who holds which seat is the state `seat-holders` of the seat `mesh-placement` (now `mesh-module-assigner`), and tools are found by the tool runners' announcements; what a node runs is its want and its have; the grants part writes `grants.<module>.<fingerprint>` and keeps memberships in its own state; root-free is a probe of the self-check; no manifest but the controller's reads, invokes or consumes `mesh-controller`, but a named list kept to the lease write, so the lease write's check passes (ADR 0189, ADR 0547 §11, ADR 0549 §6) | — | mesh-sdk, mesh-controller (its pin only), mesh-delivery (builder, indexer, assigner, grants part, view), mesh-catalog (artifact-store-tools, disk-load, the backup seat's holder, mounts, nfs-server, minio, mesh-watcher, the messenger, the self-check, the module mesh-catalog, docker), mesh-tools (the tool runner) | 1955 |
 | B0 | The bootstrap delivery: a delivery group's check runs a checking program built from the group's own heads in the build seat's sandbox, and hands the manifest validator and the composer the heads' one seat list; it brings no seat definition, so the running checker checks it (ADR 0644) | 26 needs it | mesh-delivery (checker), mesh-catalog (mesh-build-go), mesh-delivery-contracts (the seat `node-build-go`'s ask `run`) | 1921 |
-| G | Two graphs and one revision view: the catalog graph and the assignment graph kept per revision, a change delivered as its graph difference, the acting parts' rules on their seats as bounded waits that hold their modules when the new version fails, the check on the change's own acting parts, the revision view and each process's own build, the gate's delivery record, and the review verb and the trace's links (ADR 0656); the registry milestone's reviewed heads are joined to its group as members | 26 to 37 | mesh-sdk (the runtime: the fingerprint, the view, the definition reader), mesh-contracts and the domains' contracts modules (`acts`, the new verbs and events), mesh-delivery (indexer, assigner, checker, builder, grants part, gate's view, forge bridge), mesh-catalog (the gate, the build modules, mesh-issues, mesh-knowledge), the node-engine (`mesh-host`), hq | 1966 (with the registry milestone's heads), 1961, 1660, 1962, 1972, 1721, 1783, 1785, 1794, 1791, 1373, 1782 |
+| G | Two graphs and one revision view: the catalog graph and the assignment graph kept per revision, a change delivered as its graph difference, the acting parts' rules on their seats as bounded waits that hold their modules when the new version fails, the check on the change's own acting parts, the revision view and each process's own build, the gate's delivery record, and the trace's links (ADR 0656); the registry milestone's reviewed heads are joined to its group as members | 26 to 45 | mesh-sdk (the runtime: the fingerprint, the view, the definition reader), mesh-contracts and the domains' contracts modules (`acts`, the new verbs and events), mesh-delivery (indexer, assigner, checker, builder, grants part, gate's view, forge bridge), mesh-catalog (the gate, the build modules, mesh-issues, mesh-knowledge), the node-engine (`mesh-host`), hq | 1966 (with the registry milestone's heads), 1961, 1660, 1962, 1972, 1721, 1783, 1785, 1794, 1791, 1373, 1782 |
 
 An issue is in one row only (ADR 0493 §2): where a row named an issue another row names too, the last row keeps it and the
 earlier row says so in words (the operator, 2026-10-26). Milestone M1 makes each row a record of the issue tracker