Designs follow ADR 0636 as accepted: a waiting reader, the bootstrapped three

The accepted record renumbers its clauses and settles what the review asked: a
reader without the seat list starts nothing new but keeps running, its wait
reaches the operator through the condition keeper and the router, which are
bootstrapped with mesh-catalog, a missing definition blocks new claims only,
a move of a definition is a handover, and the private network's value is the
seat's contract. The renames also refuse old names in consumes and say what an
old installer meets; design 47's done milestones keep the name they shipped.

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig

00-META/glossary.md

@@ -61,7 +61,7 @@ is listed under [Homonyms](#homonyms), with the qualified form each domain uses.
 - **seat definition** — the one language-neutral file (a schema with conformance fixtures) that names a seat's
   verbs and their messages, its events, its states and the forms of its provisions; its Go and TypeScript types
   are generated from it. The indexer keeps every trunk's and open pull request's as bus state (ADR 0608 §1, §2).
-  Every seat has one, written by hand in its domain's contracts module, either whole or at the seat list's grain
+  Every seat has one, naming its domain, written by hand in its domain's contracts module, either whole or at the seat list's grain
   (its name, scope, verbs and provision), and every reader of the list of seats learns it from the bus, never from a
   compiled package (ADR 0635 §1, §2).
   *Not:* ~~seat-set package~~ (hq)
@@ -878,10 +878,10 @@ it should not. **Recorded by** the controller. **Upstream of** Provisioning and
   The network the machine sits on without it is the **underlay**.
   *Not:* ~~overlay~~ (hq)
 - **the-private-network** — the node seat of the private network, held by the module `mesh-wireguard`, whose
-  provision is the value a module reads to reach the private network. Its contract and its client, which keeps only
-  that value's layout and no key material, are in `mesh-connectivity-contracts`, a folder module of the
-  mesh-networking repository beside its holder; the private network's manifest and peer generator are the holder's own
-  (ADR 0634 §6, ADR 0636 §4).
+  provision is the value a module reads to reach the private network. Its contract, holding that value's layout and
+  no key material, is in `mesh-connectivity-contracts`, a folder module of the mesh-networking repository beside its
+  holder; it has a client only where its callers share logic, and the private network's manifest and peer generator
+  are the holder's own (ADR 0634 §6, ADR 0636 §6).
 - **anchor** and **hub** — the roles a node plays for the private network: the anchor is reachable from
   outside and every node reaches it; a hub relays for nodes that cannot reach each other directly.
 - **resolver** — a seat holder that answers the mesh's names, of the replicated seat `mesh-dns-resolver`; a node

03-DESIGN/01-to-be/26-the-seats.md

@@ -171,7 +171,7 @@ convention, which later seats departed from.
 | `node-resolver` | — | node | — | a machine's own resolver, held only where something requires `split-dns`: it writes `/etc/resolv.conf` there (the uplink's holder steps back from it) and routes a VPN's domains to the VPN's servers over its link through its verbs `routes`, `route`, `unroute` (ADR 0247). Held by the module `systemd-resolved` |
 | `mesh-intrusion-prevention` | `the-intrusion-prevention` | node | — | an intrusion-prevention service |
 | `mesh-packet-filter` | `the-packet-filter` | node | — | the packet filter |
-| `the-private-network` | — (it keeps its name, ADR 0636 §4) | node | — | `mesh-wireguard`, the private network the mesh runs over |
+| `the-private-network` | — (it keeps its name, ADR 0636 §6) | node | — | `mesh-wireguard`, the private network the mesh runs over |
 | ~~`mesh-resolver-configuration`~~ | `the-resolver-configuration` | node | — | retired by ADR 0223: `/etc/resolv.conf` is written by the holder of `node-uplink`, the program that would otherwise rewrite it, and the need of the uplink beside it (ADR 0220) goes with it; deleted from the set, and from the store's table, once nothing claims it |
 | `mesh-showcase` | `the-showcase` | node | — | the showcase module |
 
@@ -192,7 +192,8 @@ defined whole or at the seat list's grain (ADR 0635 §2). In the milestone of AD
 (ADR 0613 §1, ADR 0620, ADR 0627 §1, ADR 0634 §6, ADR 0635 §5); every other seat is defined at the seat list's grain.
 
 - **The file** is a schema with conformance fixtures: the seat's verbs and their messages, its events and their
-  bodies, its states and the forms of its provisions. It lives in the contracts module of its domain (*Where a seat's
+  bodies, its states and the forms of its provisions, and names its glossary domain (ADR 0636 §5). It lives in the
+  contracts module of its domain (*Where a seat's
   code goes*, below). Its Go and
   TypeScript types are generated from it and committed beside it; nobody writes them by hand. The format is JSON, its
   messages and bodies JSON Schema, as the seat set's verb inputs already are, with the format's own schema checked in;
@@ -259,7 +260,7 @@ defined whole or at the seat list's grain (ADR 0635 §2). In the milestone of AD
   | `mesh-health-and-repair-contracts` | Health and repair | `mesh-conditions`, `mesh-self-check`, `mesh-healers`, `mesh-watchdogs`, `mesh-hand-acts` | the condition keeper, mesh-self-check, mesh-healers, the watchman, mesh-hand-acts |
   | `mesh-provisioning-contracts` | Provisioning | `mesh-provisioner` | mesh-provisioner |
   | `mesh-identity-and-access-contracts` | Identity and access | `mesh-vault`, `mesh-node-enroller` | the vault, the module `mesh-enrolment` |
-  | `mesh-connectivity-contracts` (mesh-networking repository, ADR 0636 §4) | Connectivity | `the-private-network` | `mesh-wireguard` |
+  | `mesh-connectivity-contracts` (mesh-networking repository, ADR 0636 §6) | Connectivity | `the-private-network` | `mesh-wireguard` |
   | `mesh-operator-and-conversation-contracts` | Operator and conversation | `operator-channel` | the router |
   | `mesh-contracts` | Core, and Config | `node-engine`, `mesh-broker`, `mesh-config` | the node-engine, the bus module, mesh-config |
 
@@ -284,35 +285,48 @@ defined whole or at the seat list's grain (ADR 0635 §2). In the milestone of AD
   the holder's (`<holder>_<state>`), so placement keeps every revision. The old subjects' events keep only their
   stream's own retention. **The order is the module graph's**: the grants of the new subjects are an ordering edge
   that comes before the holders move, and the callers come after the holder that serves the renamed verbs; an older
-  node-engine takes its new build through `mesh-wants`, which is not renamed. **How it is checked**: the manifest
-  validator refuses a claim, an `invokes` or a grant naming a seat no definition names, so an old name fails
+  node-engine takes its new build through `mesh-wants`, which is not renamed. **A machine enrolling with an installer
+  built before the rename** asks the old enrolment seat's subject, which no holder answers: its enrolment fails
+  loudly, naming the seat, and nothing joins; it enrols with an installer of the new build. **How it is checked**: the
+  manifest validator refuses a claim, an `invokes`, a `consumes` or a grant naming a seat no definition names, so an
+  old name fails
   (ADR 0634 §10); the acceptance after the delivery is that `mesh-module-assigner.placement` answers and
   `mesh-placement.placement` is not found, placement's revisions are those it had before, and no `seat-holders` key,
   finding or condition stays under an old name.
-- **Every part learns the seat list from the bus, through the seat `mesh-catalog`** (ADR 0635 §1, as ADR 0636 §2
-  changes it). The manifest validator, the node-engine, the tool runner, claude-code and every other reader of the
-  list of seats call, through mesh-sdk's runtime, the verb `seat-definitions` of the seat `mesh-catalog`, which answers every definition
-  on the trunks with its digest, at the grain each holds, and hear the seat's events `seat-definition-changed` and
-  `seat-definition-removed`. A reader names no module: it calls the seat, never its holder, the indexer, by name.
-  It acts only on definitions from a trunk, never on a pull request's head. No package carries the seat list, and
-  mesh-sdk imports no contracts module.
-  **A reader without the list acts on nothing new** (ADR 0636 §1, changing ADR 0635 §3). A reader that starts
-  without the seat's answer applies, composes, grants and judges nothing new and keeps running what it runs; it says
-  in its health what it waits for, and raises a condition when it has waited five minutes, cleared by its first full
-  read. It does act, from the bootstrapped definitions it carries (ADR 0608 §2), on the modules whose seats those
-  definitions name: the foundation's seats and `mesh-catalog`, so the bus, the store and the indexer, which serves the
-  list, come back after a full restart. A reader
-  away longer than the events' retention reads the whole list again. A check that cannot read the definitions it
-  needs fails, naming them, rather than passing without them.
-  **Each reader's list has tools** (ADR 0636 §5): mesh-sdk's runtime bundle serves, in every reader, a tool that
-  reads which definitions it holds (their source, digests and what it waits for) and one that makes it read the
-  list again now.
-  **How it is checked** (ADR 0635 §6, ADR 0636 §5): a test of the readers' start, with the seat unanswered, asserts
-  the reader acts on nothing but the bootstrapped modules and says so, then acts once the seat answers; a full
-  restart of the mesh with no reader holding the list brings the foundation and the indexer back first, then every
-  other module once `seat-definitions` answers; mesh-sdk's
-  unit test refuses a module's name in the runtime; the indexer's tests read a seat-list-grain definition from a
-  contracts module like a whole one, and a removed definition's seat is refused afterwards.
+- **Every part learns the seat list from the bus, through the seat `mesh-catalog`** (ADR 0635 §1, as ADR 0636 §4
+  changes it). The node-engine, the tool runner, claude-code, the manifest validator and every other reader of the
+  list of seats call, through mesh-sdk's runtime, the verb `seat-definitions` of the seat `mesh-catalog`: without a
+  seat it answers every trunk's seat with its digest, with a seat that seat's definition. They hear the seat's events
+  `seat-definition-changed` and `seat-definition-removed`, said for the trunks' definitions. A reader names no
+  module: it calls the seat, never its holder, the indexer, by name. A running part acts on what is merged, so a
+  reader takes no definition from a pull request's head; the manifest validator inside a delivery group's check is
+  the one reader that reads the members' heads. No package carries the seat list, and mesh-sdk imports no contracts
+  module.
+  **A reader without the list acts on nothing new, and keeps running what it runs** (ADR 0636 §1, changing ADR 0635
+  §3). A reader that starts without the list applies, composes, grants and judges nothing new, except for the
+  bootstrapped modules below; it keeps running what it already runs, says in its health what it waits for, and a
+  node-engine after a reboot starts again the compositions it last applied. Each node writes one finding when its
+  readers have waited five minutes (ADR 0564 §2); the condition keeper raises it as a condition, which reaches the
+  operator as every condition does, and clears it at the first full read. A reader away longer than the events'
+  retention reads the whole list again. A check that cannot read the definitions it needs fails, naming them, rather
+  than passing without them.
+  **The bootstrapped definitions** (ADR 0636 §2, changing ADR 0608 §2) are the foundation's seats (research 075) and
+  `mesh-catalog`, `mesh-conditions` and `operator-channel`: every reader carries them from its start and acts on their
+  holders without the list, so after a full restart the indexer comes back and serves the list, and the condition
+  keeper and the router, with the channels it sends through (ADR 0259), carry a wait's condition to the operator.
+  **A missing or refused definition blocks new claims only** (ADR 0636 §3): when a seat's definition is missing,
+  removed or refused, readers refuse a new claim, `invokes` or grant of that seat, and never stop or remove a module
+  that already runs holding or calling it.
+  **Each reader's list has two tools** in mesh-sdk's runtime bundle (ADR 0636 §7): one reads which definitions a
+  reader holds, their source and digests and what it waits for; the other, granted to the operator and the healers,
+  makes it read the list again now.
+  **How it is checked** (ADR 0635 §6, ADR 0636 §8; *Acceptance tests*, below): the node-engine's whole-module test,
+  against a stand-in of the seat, acts on nothing but the bootstrapped modules without the list and on all once it
+  answers, and starts its last compositions after a restart; the indexer's whole-module test starts with only the
+  bootstrapped seats and answers `seat-definitions`; with the indexer kept down, the node's finding is written after
+  five minutes and the condition keeper raises it to the operator; a refused definition stops no running module; a
+  reader refuses a pull request head's definition; mesh-sdk's unit test refuses a module's name in the runtime; both
+  tools answer.
 - **The generator** is each language's build module's: the Go build module's package for Go, the Node and TypeScript
   build module's for TypeScript (the logic is the module's whose work it is). The generator's version is a build input
   of every contracts module, so a changed generator rebuilds each contracts module once (ADR 0603 §3). Each build
@@ -328,16 +342,20 @@ defined whole or at the seat list's grain (ADR 0635 §2). In the milestone of AD
   bridge's messages, and keeps them in its own state `seat-definitions`, keyed by seat and source (the trunk, or a
   pull request's head), as their only writer; a definition is at most 256 KiB. As the holder of `mesh-catalog` it says
   `seat-definition-changed` (seat, source, digest), kept seven days, only when a digest changed, and
-  `seat-definition-removed` when a trunk's definition goes, both as events of the seat (ADR 0636 §2, changing ADR 0608
-  §3, §4). **Only the trunk's entry is the seat's contract**: the readers of the seat list read the trunks' through
-  the seat's verb; the contracts modules' builds and the review ask `indexer_seat_definition`, which answers the
-  trunk's unless a pull request's head is named, and says which it answered. **The delivery group's one check reads
-  the seat definitions at every member's head**, so a group that changes a definition is judged by what it merges. A
-  pull request's entries are removed on the forge bridge's event that it closed or merged. **A seat is defined only in
-  its domain's contracts module** (ADR 0636 §3, changing ADR 0608 §2): the indexer takes a seat of the mesh's own
-  only from the contracts module of the seat's glossary domain, `mesh-contracts` for a domain with none, and a seat
-  defined outside the mesh's own contracts only from its own contracts module (ADR 0625 §7); it refuses a definition
-  of the same seat from any other module, with a finding naming both. A definition
+  `seat-definition-removed` when a trunk's definition goes, both as events of the seat (ADR 0636 §4, changing ADR 0608
+  §3). **Only the trunk's entry is the seat's contract**: the readers of the seat list read the trunks' through
+  `seat-definitions`; the contracts modules' builds and the review ask `indexer_seat_definition`, which answers the
+  trunk's unless a pull request's head is named, and says which it answered. **The manifest validator inside the
+  delivery group's one check reads the seat definitions at every member's head** (ADR 0636 §4), so a group that
+  changes a definition is judged by what it merges. A
+  pull request's entries are removed on the forge bridge's event that it closed or merged. **A seat of the mesh's own
+  contracts is defined only in its domain's contracts module, and a move there is a handover** (ADR 0636 §5, changing
+  ADR 0608 §2): a definition names its glossary domain; the indexer takes a seat of the mesh's
+  own contracts only from that domain's contracts module, `mesh-contracts` for a domain with none, and refuses a
+  definition of it from any other module, with a finding naming both. A definition moving from `mesh-contracts` to its
+  domain's contracts module is a handover: the indexer keeps the last trunk definition until the new one is merged,
+  in either order of the two trunks. A seat defined outside the mesh's own contracts is taken from its own contracts
+  module (ADR 0625 §7). A definition
   that does not parse fails its pull request's check; the trunk's stays. The merge is the only approval. The
   foundation's own definitions are bootstrapped before the bus exists, as the bootstrap of a fresh mesh has it
   (research 075).
@@ -345,7 +363,7 @@ defined whole or at the seat list's grain (ADR 0635 §2). In the milestone of AD
   trunk's seat definition that does not parse, `seat-definition-unparsed` (a pull request's is its check's verdict, not
   a condition), cleared by a definition that parses; generated types on a trunk out of step with their definition,
   `generated-types-out-of-step`, cleared only by a clean build end of the same contracts module, per module and not per repository, since several
-  contracts modules share one; a seat defined outside its domain's contracts module, naming both modules (ADR 0636 §3). **Tools** of the indexer: `indexer_seat_definition`
+  contracts modules share one; a seat defined outside its domain's contracts module, naming both modules (ADR 0636 §5). **Tools** of the indexer: `indexer_seat_definition`
   (read one), `indexer_seat_definitions_again` (read a trunk's or a pull request's again now) and `indexer_out_of_step`
   (the generated types out of step).
 - **Contracts modules.** A seat's contract is published by a contracts module, which holds the seats' definitions,
@@ -362,8 +380,7 @@ defined whole or at the seat list's grain (ADR 0635 §2). In the milestone of AD
   `mesh-delivery-contracts` and the Delivery domain's SDK are folders of the mesh-delivery repository, and the other
   domains' contracts modules folders of the mesh-contracts repository, but the Connectivity domain's:
   `mesh-connectivity-contracts` is a folder of the mesh-networking repository, beside `mesh-wireguard`, which holds
-  `the-private-network` with its manifest and peer generator its own (ADR 0636 §4, changing ADR 0634 §8). A
-  `mesh-connectivity-sdk` is made when that domain's modules share logic, not before. Each is a package-only module, as mesh-sdk long
+  `the-private-network` with its manifest and peer generator its own (ADR 0636 §6, changing ADR 0634 §8). Each is a package-only module, as mesh-sdk long
   is: published from its trunk, rebuilding the modules that use it like any package (ADR 0573 §2, §3), and delivered
   to no node. A step of the build or the delivery that treats a module in a folder unlike one at a repository's root
   is a gap of the build and delivery system, fixed in the milestone, never worked around. **How it is checked**: the
@@ -445,9 +462,11 @@ keeps only what modules or seats of more than one domain use.
   checks of its compose-candidate ask and answer); `npm-package-registry`, `go-package-registry`,
   `container-image-registry` and `oci-artifact-registry` (publishing a file in parts, one client per seat, each
   binding the Delivery domain's SDK's transfer to its own seat's verbs and types); `mesh-hand-acts` (recording a
-  hand act); `mesh-provisioner` (mesh-sdk's provider runtime and its harness, which only providers use); and
-  `the-private-network` (only the layout of the value the seat provides, which holds no key material; the private
-  network's manifest and peer generator are `mesh-wireguard`'s own, ADR 0636 §4, changing ADR 0635 §4).
+  hand act); and `mesh-provisioner` (mesh-sdk's provider runtime and its harness, which only providers use).
+  `the-private-network` has none: the layout of the value it provides, which holds no key material, is the seat's
+  contract in `mesh-connectivity-contracts` (ADR 0634 §1), the private network's manifest and peer generator are
+  `mesh-wireguard`'s own, and the seat has a client only where its callers share logic (ADR 0636 §6, changing ADR 0635
+  §4).
 - **Moving a file in parts is seat-neutral, in the Delivery domain's SDK, on both sides** (ADR 0627 §2, as ADR 0634
   §3 changes it): it serves only the four registry seats, all of the Delivery domain. The sending side and the going
   on from what a holder already holds, and the holder's side (taking the parts into the holder's own objects,
@@ -490,7 +509,7 @@ keeps only what modules or seats of more than one domain use.
 | The parts transfer is seat-neutral | its unit test, in the Delivery domain's SDK, runs both sides against two different subjects and shapes the caller gives, and the seat-name check holds it seat-neutral; the review refuses a holder that takes parts in without it |
 | Only a client is written by hand in a published package | each build module's regenerate-and-compare test fails on a hand-written file outside a client package and passes a contracts module holding its definitions and fixtures; the step runs on every contracts module |
 | A module in a folder is built and published as one at a root | the delivery group's one check builds and publishes every new contracts module and the domain SDK from its folder, and `mesh-wireguard` and `mesh-connectivity-contracts` from the mesh-networking repository |
-| A seat is defined only in its domain's contracts module | the indexer refuses a second module's definition of a seat, with its finding naming both (ADR 0636 §3) |
+| A seat is defined only in its domain's contracts module | the indexer refuses a second module's definition of a seat, with its finding naming both, and a move from `mesh-contracts` holds in either merge order (ADR 0636 §5) |
 | A holder keeps its seat's states | the manifest validator refuses a holder whose `requires` does not declare each of its seat's states with the same local name and template |
 | A contracts module holds no seat; a role only one module could ever play has none | the manifest validator's refusal of a contracts module that claims a seat; review both ways: a new seat definition's pull request is asked whether another module could take the role over, and a module's pull request is asked the same of each new tool or event family other modules call |
 | Each new exported name sits where this section puts it | the review of every pull request (playbooks 07 and 08, the code reviewer's definition) asks the home of each new exported type, field, constant, package or module against this section, a domain SDK's importers included |
@@ -503,12 +522,12 @@ over its budget: each case below replaces or joins an existing one.
 |---|---|---|
 | research 081's 14, 21, 25 and 26 | as research 081 sets them | as research 081 sets them |
 | mesh-sdk's seat-naming, import and package-list tests; no module's name in the runtime | unit | mesh-sdk |
-| the readers' start: with the seat unanswered a reader acts on nothing but the bootstrapped modules and says so, raises its condition after five minutes, and acts once the seat answers; a reader away longer than the events' retention reads the whole list again; both list tools answer | unit, over a bus the test gives | mesh-sdk |
-| the indexer stopped mid-run: readers keep running what they run and act on nothing new until it answers again | a case of the indexer's whole-module test | mesh-delivery |
-| a full restart with no reader holding the list: the foundation and the indexer start from the bootstrapped definitions, then every other module once `seat-definitions` answers | a case of the node-engine's whole-module test | `mesh-host` (the node-engine's repository) |
+| a reader of the seat list, against a bus the test gives: a reader away longer than the events' retention reads the whole list again; a reader refuses a pull request head's definition; both list tools answer, the re-read one only for the operator and the healers | unit | mesh-sdk |
+| the node-engine, against a stand-in of the seat `mesh-catalog`: without the list it acts on nothing but the bootstrapped modules, then on all once the stand-in answers; after a restart it starts its last applied compositions again; a refused definition stops no running module | a case of the node-engine's whole-module test | `mesh-host` (the node-engine's repository) |
+| the indexer starts with only the bootstrapped seats and answers `seat-definitions`, without a seat (names and digests) and with one; with the indexer kept down, the node's finding is written after five minutes and the condition keeper raises it to the operator | cases of the indexer's whole-module test | mesh-delivery |
 | a trunk definition that does not parse writes its finding and a fixed one clears it; a trunk build end naming out-of-step types writes the finding, a clean build end of another contracts module of the same repository leaves it, and a clean one of the same module clears it | a case of the indexer's whole-module test | mesh-delivery |
-| `indexer_seat_definition` answers the trunk's entry while a pull request holds another; a pull request's entries go when it closes; a definition over 256 KiB is refused; a seat-list-grain definition is read from a contracts module like a whole one; a removed definition says `seat-definition-removed` and its seat is refused afterwards; a second module defining a seat is refused with its finding; each of the indexer's tools answers | cases of the indexer's whole-module test | mesh-delivery |
-| the manifest validator refuses a claim, an `invokes` or a grant naming `mesh-placement` or the seat `mesh-enrolment`, and a holder missing one of its seat's states in `requires` | unit | mesh-delivery |
+| `indexer_seat_definition` answers the trunk's entry while a pull request holds another; a pull request's entries go when it closes; a definition over 256 KiB is refused; a seat-list-grain definition is read from a contracts module like a whole one; a removed definition says `seat-definition-removed` and its seat takes no new claim afterwards; a second module defining a seat is refused with its finding, and a definition moving from `mesh-contracts` to its domain's contracts module holds in either merge order; each of the indexer's tools answers | cases of the indexer's whole-module test | mesh-delivery |
+| the manifest validator refuses a claim, an `invokes`, a `consumes` or a grant naming `mesh-placement` or the seat `mesh-enrolment`, and a holder missing one of its seat's states in `requires` | unit | mesh-delivery |
 | the checker's `verdict` names out-of-step files; the group's check reads seat definitions at every member's head | a case of the checker's whole-module test | mesh-delivery |
 | each build module's compare step fails on a differing, a missing and an unwritten file, naming each, per contracts module | unit | mesh-catalog |
 | a change in one folder module rebuilds and publishes only it and its importers; a module with both a deployed and a package artifact (the grants part or disk-load) is built, delivered and published | a case of the Go build module's whole-module test | mesh-catalog |
@@ -714,5 +733,5 @@ seat's code goes*), and the amendment of 2026-11-05 (ADR 0634, ADR 0635: shared
 SDK, a module's own package, a contracts module per domain the milestone moves, 25 seats defined whole with their
 states, the seat list read from the bus, two seats renamed), with ADR 0636 (the seat list through the seat
 `mesh-catalog`, a reader without it acting on nothing new, a seat defined only in its domain's contracts module, the
-Connectivity domain in the mesh-networking repository) and the lead's rulings on the first review by architectural
+Connectivity domain in the mesh-networking repository; accepted at its version 15) and the lead's rulings on the first review by architectural
 domain written in, await their final review, which rewrites this section.

03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md

@@ -1280,13 +1280,13 @@ release reports the controller's code lines against research 063's baseline (acc
 | R4g | The last milestone of release 4 and release 5 as one, with one switch-over and no rehearsal (ADR 0524 §1): builds and checks are asks on streams that each build node pulls when it has a free slot, deliveries first, with nothing holding checks and no controller queue (ADR 0525); the assigner is made with its composition check, writes each node's wants compared with what the controller sends and every difference, and the view answers the asks that need no proof of who answered (ADR 0528, ADR 0437 §10); no module's fingerprint takes the builder (ADR 0530); the scripts of the repositories a module is built from, build-agent with its socket and Dockerfile code, the toolchain images and the controller's build code go, and the builder delivers its own module, the build modules and the controller from its keys (ADR 0453 clauses 5, 8, 10; ADR 0524 §5, §7); the ways to deliver without the builder are recorded (ADR 0526); hq's four checks are Go tests (ADR 0527); each repository's script goes (ADR 0529); the word for the composition check's predecessor is struck. Its pull requests are opened only after five readings, the revert path read, not shown on a test merge (ADR 0524 §3) | 4 (from R4g mesh-build-image, rootless, is the only part that builds an image: ADR 0487 §7), 17, 24 (no `merge-check.sh` in a repository a module is built from) | mesh-sdk, mesh-controller (build-agent removed), mesh-delivery, mesh-catalog, mesh-tools, mesh-tools-go, the node-engine (`mesh-host`), mesh-media-catalog, okioki, hq | 1887 (the flow), 1297 (the assigner), 1295 (`merge-check.sh` goes), 979 (closed with the toolchain images), 1296 and 1303 (hq's check, the old word struck), 1299, 1305, 1294, 1318 (the controller's deletions) |
 | R6 | Each node applies from its wants the compositions its own node agent composes (ADR 0547 §2; as released it applied the controller's signed ones), a new version reaches the module's canary first and the rest once it is healthy there, a move a person must allow is asked before its want, the view says what is moving, settled, stuck and delivered, and the plans are deleted from the code; switched over by release 5's last plan (ADR 0539) | 18, 19, 20 | mesh-sdk, the node-engine (`mesh-host`: the node agent), mesh-controller (plans deleted; as released also compositions and credentials, which ADR 0547 moves to the node agents, the grants part and the vault), mesh-delivery (assigner, watchman, view), mesh-catalog (the gate, the messenger, the issue tracker, the backup holder), hq | 1942 (the planner puts the node-engine and the controller in one tier for the switch; delivered first), the bus's user list granting what release 6 uses (delivered first, under L1's issue), 1943 (mesh-sdk: the composition's layout and signature, the want's digest, `mesh-hand-compose`, the verb tables without the plan verbs), 1944 (the node agent), 1946 (the gate keeps the merge's states; the messenger and the issue tracker hear the view), 1906 (the assigner's seventh rule and its asks, the watchman's pulses for wants, the view's wants and events), 1130 (hq) |
 | L1 | The controller leaves build and delivery, first milestone: the bus node follows the user list alone, the grants part composes in shadow and the vault holds the bus accounts' hashes, so the operator's take-over can make the grants part's list the one loaded (ADR 0547 §8, §11; ADR 0550 §4) | — | mesh-controller, mesh-delivery, mesh-catalog (the vault, the grants part), the node-engine (`mesh-host`), mesh-sdk | 1945 |
-| L2 | Nodes compose: each node agent composes its own modules, and no node applies a composition made elsewhere but the bus's user list (ADR 0547 §11); where modules run is bus state held by the seat `mesh-module-assigner` on the assigner, changed by a proposal the nodes answer and the operator approves, and no repository names a node or holds what one installation decides (ADR 0567). Built as release sdk1 (ADR 0593) and delivered to every machine on 2026-11-02, the controller's code emptied (mesh-controller #491) and its repository archived; done once a check has composed a candidate on every machine | — | the node-engine (`mesh-host`), mesh-sdk, mesh-delivery (the assigner as the seat's holder), mesh-catalog, mesh-controller (its pin only) | 1126 |
-| L3 | Nothing is left with the controller: the vault mints bus accounts and signs, the grants part writes grants, the try is the checker's own verb, placement is read from the seat `mesh-module-assigner` alone, each node-engine holds the node seat `node-engine`, judges `root-free` for its node and asks the operator itself for a hand-over or an access act, acting on the warrant with nothing signed (ADR 0563), and, once L4 to L7 are delivered, the lease write passes the lease to a holder that is no controller, made right after the delivery that drops every listed read of the controller but the three ADR 0571 §13 keeps to the write itself (ADR 0547 §11, ADR 0549 §5, §6, ADR 0550 §2, ADR 0571 §13); the rest of the controller's code lines is the issue of L2. Since the controller left (2026-11-02), nothing writes the bus module's own process accounts while the bus module has no want on the broker node, so its tools that write the bus fail (issue 774) | — | mesh-controller, mesh-sdk, the node-engine (`mesh-host`), mesh-catalog (the vault, the grants part, the messenger), mesh-delivery | 774 |
+| L2 | Nodes compose: each node agent composes its own modules, and no node applies a composition made elsewhere but the bus's user list (ADR 0547 §11); where modules run is bus state held by the seat `mesh-placement` (now `mesh-module-assigner`) on the assigner, changed by a proposal the nodes answer and the operator approves, and no repository names a node or holds what one installation decides (ADR 0567). Built as release sdk1 (ADR 0593) and delivered to every machine on 2026-11-02, the controller's code emptied (mesh-controller #491) and its repository archived; done once a check has composed a candidate on every machine | — | the node-engine (`mesh-host`), mesh-sdk, mesh-delivery (the assigner as the seat's holder), mesh-catalog, mesh-controller (its pin only) | 1126 |
+| L3 | Nothing is left with the controller: the vault mints bus accounts and signs, the grants part writes grants, the try is the checker's own verb, placement is read from the seat `mesh-placement` (now `mesh-module-assigner`) alone, each node-engine holds the node seat `node-engine`, judges `root-free` for its node and asks the operator itself for a hand-over or an access act, acting on the warrant with nothing signed (ADR 0563), and, once L4 to L7 are delivered, the lease write passes the lease to a holder that is no controller, made right after the delivery that drops every listed read of the controller but the three ADR 0571 §13 keeps to the write itself (ADR 0547 §11, ADR 0549 §5, §6, ADR 0550 §2, ADR 0571 §13); the rest of the controller's code lines is the issue of L2. Since the controller left (2026-11-02), nothing writes the bus module's own process accounts while the bus module has no want on the broker node, so its tools that write the bus fail (issue 774) | — | mesh-controller, mesh-sdk, the node-engine (`mesh-host`), mesh-catalog (the vault, the grants part, the messenger), mesh-delivery | 774 |
 | M1 | A milestone is a record of the issue tracker: each row of a design's milestone table is a milestone record its issues are linked to by `issue-tracker.link`, an issue to at most one, and pull requests and commits to issues the same way; the knowledge base's `progress` reads the milestones from the tracker, not from this table (ADR 0493 §1 to §4) | — (ADR 0493 §13 in part) | hq, mesh-catalog (mesh-issues, mesh-knowledge) | 1781 |
 | L4 | Health leaves the controller (ADR 0564): the condition keeper holds the seat `mesh-conditions` and keeps every open condition from the observers' findings, saying today's condition events; the watchman holds `mesh-watchdogs`, its watchdogs pulses, reads each node-engine's node health report, and keeps the dead letters from the lease write; `mesh-self-check` runs the probes, `root-free` among them from L7 (ADR 0571 §11), and says `checked`; of the probes still deferred, D13, D8, D-fill and DA are built and the rest are not, their kinds ending with the controller at the lease write (ADR 0572); `mesh-healers` heals on events and acts only once the lease names no controller; `status` is the view's derivation; built dark, compared, then switched by the operator's take-over; the bus module gains a tool that removes one named consumer, which the lease write uses (ADR 0547 §11) | — | mesh-sdk, mesh-catalog (mesh-conditions, mesh-self-check, mesh-healers, the router, mesh-watcher, nats), mesh-delivery (watchman, view, the grants part) | 1952 |
 | L5 | Control records leave the controller, and the controller is not changed (ADR 0565): mesh-config keeps each module's declared config in its state `declared` and publishes the predefined keys, which the indexer reads from the forge bridge's messages with each open pull request's config candidate; config switches to that source only on the operator's take-over, refused while `compare` shows a difference; each node agent writes its node's declared packages (the node seat `node-engine`, verb `packages`); the assigner holds the new seat `mesh-wants` with the upgrade policy a person chose and the bus step; the hand-act log (`hand-act`, `hand-acts`, `warranted`) is the stream of the new seat `mesh-hand-acts`, held by a new module in mesh-catalog, which every recorder calls from this delivery with no switch; the checker and the assigner's composition check read the held values of their pull requests from mesh-config's state `kept`; from the lease write a trusted config value is set only on the operator's Approve; `settings`, `move-config` and `move-placement` end with the lease and nothing replaces them. each person's six policy choices are set through `mesh-wants.upgrade` and recorded as hand acts, `upgrade compare` and the assigner's finding `policy-split` show any split, and the lease write waits for `compare` to be empty (ADR 0565 §8). One delivery group, built before the lease write of L3, which waits for the group delivered, the six choices set, mesh-config's `compare` empty and its take-over done, `mesh-wants.upgrade compare` empty, and the readings of ADR 0565 §12 (ADR 0565 §14; ADR 0348 §9, ADR 0502 §2, ADR 0539 §14, §15, ADR 0547 §11) | — | mesh-sdk, mesh-catalog (mesh-config, mesh-hand-acts, pacman, the forge module, claude-code, mesh-knowledge, mesh-conditions, mesh-healers), mesh-delivery (indexer, assigner, checker, grants part, forge bridge), the node-engine (`mesh-host`); mesh-controller is not a member | 1953 |
 | L6 | Provisioning leaves the controller (ADR 0570): every provision is one key of the seat `mesh-provisioner`, held by mesh-provisioner, holding a reference and never a value, and each placed module's provisioning plan a key of its state `plans`, both composed from placement, the wants and the manifests on change events; each provider acts once all a provision depends on is provided; the assigner moves a want only once its build's provisions are provided; a provision no want needs is retiring, and its account or credential is removed only on the operator's Approve, its data never; the vault mints each provision's secret sealed to the consumer's and the provider's node, and the consumer's node-engine writes it; a wait for a person is a provision's state, which the watchman reads; bus permissions stay with the grants part (ADR 0349, ADR 0230, ADR 0547 §11) | — | mesh-sdk, the node-engine (`mesh-host`), mesh-tools (the tool runner's provisioner client), mesh-catalog (mesh-provisioner, the vault, the provisioner client, postgres, keycloak, gitea, route-adapter), mesh-delivery (assigner, watchman) | 1954 |
-| L7 | History and records leave the controller (ADR 0571): the builder keeps its build log, one entry at a build's start and one at its end, from which build history and durations are read and the module mesh-catalog asks the builds it missed; the artifact sweep is the seat `mesh-artifact-sweep`, held by artifact-store-tools beside the artifact store, its keep set from the store's own listing, the wants and the build log, sweeping at each build's end from the lease write and recording each deletion in the hand-act log; disk readings are disk-load's own state on every node; who holds which seat is the state `seat-holders` of the seat `mesh-module-assigner`, and tools are found by the tool runners' announcements; what a node runs is its want and its have; the grants part writes `grants.<module>.<fingerprint>` and keeps memberships in its own state; root-free is a probe of the self-check; no manifest but the controller's reads, invokes or consumes `mesh-controller`, but a named list kept to the lease write, so the lease write's check passes (ADR 0189, ADR 0547 §11, ADR 0549 §6) | — | mesh-sdk, mesh-controller (its pin only), mesh-delivery (builder, indexer, assigner, grants part, view), mesh-catalog (artifact-store-tools, disk-load, the backup seat's holder, mounts, nfs-server, minio, mesh-watcher, the messenger, the self-check, the module mesh-catalog, docker), mesh-tools (the tool runner) | 1955 |
+| L7 | History and records leave the controller (ADR 0571): the builder keeps its build log, one entry at a build's start and one at its end, from which build history and durations are read and the module mesh-catalog asks the builds it missed; the artifact sweep is the seat `mesh-artifact-sweep`, held by artifact-store-tools beside the artifact store, its keep set from the store's own listing, the wants and the build log, sweeping at each build's end from the lease write and recording each deletion in the hand-act log; disk readings are disk-load's own state on every node; who holds which seat is the state `seat-holders` of the seat `mesh-placement` (now `mesh-module-assigner`), and tools are found by the tool runners' announcements; what a node runs is its want and its have; the grants part writes `grants.<module>.<fingerprint>` and keeps memberships in its own state; root-free is a probe of the self-check; no manifest but the controller's reads, invokes or consumes `mesh-controller`, but a named list kept to the lease write, so the lease write's check passes (ADR 0189, ADR 0547 §11, ADR 0549 §6) | — | mesh-sdk, mesh-controller (its pin only), mesh-delivery (builder, indexer, assigner, grants part, view), mesh-catalog (artifact-store-tools, disk-load, the backup seat's holder, mounts, nfs-server, minio, mesh-watcher, the messenger, the self-check, the module mesh-catalog, docker), mesh-tools (the tool runner) | 1955 |
 
 An issue is in one row only (ADR 0493 §2): where a row named an issue another row names too, the last row keeps it and the
 earlier row says so in words (the operator, 2026-10-26). Milestone M1 makes each row a record of the issue tracker