Designs 26, 51, 25: define whole the four seats the milestone adds verbs or events to

The operator chose to move them now (2026-11-04), so a seat's new verb never lands at the seat
list's grain. Each is listed with what its holder's manifest on the trunk serves today; the
builder and the indexer hold no seat, so their events stay module events.

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig

03-DESIGN/01-to-be/25-the-bus-on-nats.md

@@ -820,7 +820,7 @@ vault as an own secret: JetStream create and update under modules' names only (s
 
 ### 12.3 The seat's verbs, events and fill
 
-The seat `mesh-broker`, until now a seat with no verbs, gains these (ADR 0595 §5, §6). It is one of the five seats
+The seat `mesh-broker`, until now a seat with no verbs, gains these (ADR 0595 §5, §6). It is one of the nine seats
 defined whole in the milestone of ADR 0612, its contract in `mesh-contracts` (ADR 0613 §1; design 26 *A seat's
 definition*), which settles where its definition lives (ADR 0595 §12). An entry's arguments are the module, its local
 name, its storage type, its template, its options and its configuration; what is held answers the settings held and

03-DESIGN/01-to-be/26-the-seats.md

@@ -175,18 +175,40 @@ merges.
 ## A seat's definition (from 2026-11-03)
 
 **A seat is defined once, in one language-neutral file, and every part learns it from the bus** (ADR 0608, from
-research 081). The registry seats (design 51) and `mesh-broker` (design 25 § 12.3) are the first defined whole this
+research 081). The registry seats (design 51), `mesh-broker` (design 25 § 12.3) and the four seats the milestone
-way, in the milestone of ADR 0612 (ADR 0613 §1).
+adds verbs or events to are the first defined whole this way, in the milestone of ADR 0612 (ADR 0613 §1, and a
+record of this milestone changing ADR 0613 §1-§3, to be proposed).
 
 - **The file** is a schema with conformance fixtures: the seat's verbs and their messages, its events and their
   bodies, its state and the forms of its provisions. It lives in the contracts module of its area. Its Go and
   TypeScript types are generated from it and committed beside it; nobody writes them by hand. The format is JSON, its
   messages and bodies JSON Schema, as the seat set's verb inputs already are, with the format's own schema checked in;
   the fixtures are data, never functions.
-- **What is defined whole now** (ADR 0613). The five seats this milestone changes are defined whole and their contracts
+- **What is defined whole now** (ADR 0613; a record of this milestone changing ADR 0613 §1-§3, to be proposed, on the
-  move into `mesh-contracts`: `npm-package-registry`, `go-package-registry`, `container-image-registry`,
+  operator's answer of 2026-11-04 to move them all). Every seat this milestone changes is defined whole and its
+  contract moves into `mesh-contracts`: `npm-package-registry`, `go-package-registry`, `container-image-registry`,
   `oci-artifact-registry` (one common part of their shared verbs, written once, so the four cannot drift) and
-  `mesh-broker`. Every other seat, the foundation's included, has its definition on the bus in the same milestone, all
+  `mesh-broker`; and the four seats it adds a verb or an event to, each with every verb and event its holder's
+  manifest on the trunk declares today, plus the new ones:
+  - `mesh-delivery-checker` (held by the checker): the verbs `try`, `try-read` and `try-end`; the events `verdict`
+    and `tag-wanted` (design 51 *Tagged versions*, its family `checker.asks`), both new. Its manifest declares no
+    event today; `preview.written` on its own stream is declared in the same change (above).
+  - `mesh-config` (held by mesh-config): the verbs `config` and, new, `renames`; the events `config-changed` and,
+    new, `renamed`, `retiring` and `retired` (design 32).
+  - `mesh-vault` (held by the vault): the verbs `get`, `secret-ask`, `issued`, `rotate`, `move-in`, `node-key`,
+    `own`, `issue-account`, `sign`, `enrolment-token`, `node-account`, `rotate-node`, `node-account-confirm`,
+    `abandon` and, new, `retire`; the events `provisioned`, `rotated`, `secret-changed`, `account-hashed`,
+    `own-replaced`, `account-issued`, `signed`, `rotation-begun`, `node-account-ready`, `rotation-done` and, new,
+    `own-retired` (design 32). The seat list mesh-sdk compiles today also names `accept` and `move-asks`, which
+    the vault does not serve; the definition carries what the holder serves, and the two are an open point.
+  - `operator-channel` (held by the router, the messenger module): the verbs `open`, `history`, `notify`, `tell`
+    and `asks`; the asks it accepts, `ask`, `cancel` and `condition`; the events `decided` and, new, `offered` and
+    `closed` (design 55 § 11); the holder's own `refused` beside them. mesh-sdk's seat list holds no entry for it
+    today, so its definition is written from the holder's manifest.
+
+  The builder and the indexer hold no seat: the builder's `numbered` and `old-form-closed` and the indexer's
+  `manifest-accepted` and `indexer.views` are events of those modules, declared in their own manifests, which
+  ADR 0613 does not govern, and no seat definition carries them. Every other seat, the foundation's included, has its definition on the bus in the same milestone, all
   at once (ADR 0608 §2), holding the seat list's grain: its name, whether it is held once or on every node, its verbs
   with their inputs and its provision, generated from the seat list mesh-sdk compiles today, so the move changes
   nothing a reader sees (ADR 0613 §2). Its messages, events and state layouts are added to
@@ -446,6 +468,6 @@ and 32 by the four reviewers by architectural domain; the findings and what answ
 indexer learns out-of-step types from the check's verdict event and runs no generator (seams), findings go to the
 condition keeper (health), a pull request's entries are removed when it closes (running qualities).
 
-The milestone's amendment (ADR 0612, ADR 0613, ADR 0614: five seats defined whole, the rest at the seat list's grain,
+The milestone's amendment (ADR 0612, ADR 0613, ADR 0614: nine seats defined whole, the rest at the seat list's grain,
 the contracts marker, out of step learned from the checker's `verdict` and the builder's build end, the seat set's one
 source) awaits its own review by architectural domain, which rewrites this section.

03-DESIGN/01-to-be/51-the-registries-keep-what-is-named.md

@@ -87,8 +87,9 @@ named, without a holder, until a build module publishes cargo packages.
 tagged version; the holder itself refuses `remove` of a version with no tag, but for the retention removal below), and
 on `container-image-registry` `mirror` and `tags`; the two seats `distribution` holds add `hold` and `release`,
 with the events `held` and `released`, for the artifact sweep (ADR 0617 §2), both verbs in the seat definition and
-in `distribution`'s caller list. The five seats this milestone changes, these four and `mesh-broker`, are defined whole, their contracts moved
+in `distribution`'s caller list. The seats this milestone changes, these four, `mesh-broker` and the four it adds a verb or an event to, are defined
-into `mesh-contracts` (ADR 0613 §1; design 26). Events: `published`, `refused` (added to ADR 0605 §2's two, additively) and `removed`, each
+whole, their contracts moved into `mesh-contracts` (ADR 0613 §1, and a record of this milestone changing ADR 0613
+§1-§3, to be proposed; design 26). Events: `published`, `refused` (added to ADR 0605 §2's two, additively) and `removed`, each
 carrying the name, version, kind, tag, digest, fingerprint, commit and holder, and `refused` its reason; each seat's
 events are its own family, `<seat>.events`, kept seven days. A holder stores
 under the version it is given and counts nothing.