Fit design 57 to walks with no first-machine gate

ADR 0360 sends a merge's builds to every machine at once, so release 57
has no first node to hold it and P6 can no longer wait at a gate. ADR 0362
moves the wait for the provisioner to the walk's end.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

03-DESIGN/01-to-be/57-building-config-and-provisioning.md

@@ -9,6 +9,7 @@ decisions:
   - "ADR 0201"
   - "ADR 0113"
   - "ADR 0158"
+  - "ADR 0362"
 ---
 
 # 57. Building config and provisioning
@@ -47,10 +48,10 @@ points at it.
 
 **What a release costs.** A proof that is run live (dunst on a workstation, a secret reaching its file, a
 database consumer connecting) is first seen in the lab rehearsal, and a fault found then holds the
-release, not one package. A walk that fails fails every commit it carries (ADR 0276 §3), so a fault on
-the release's first node holds all five; when mesh-delivery or a person stops a member, the others are walked
-again without it, leaving out every merge that shares its modules (ADR 0299 §1, §2), which in this
-release is most of them; the fix is a new merge into the release's branch, and the group is walked again.
+release, not one package. A merge's builds go to every machine at once (ADR 0360), so the release has no
+first node to hold it: the lab rehearsal is the only check before it reaches every node. A machine that
+fails to apply it, or whose provisioner reports a module's files failed (ADR 0362), is named in the walk's
+end and raises apply-failing, and is fixed forward with a new merge into the release's branches.
 
 **Nothing breaks on the way.** ADR 0349 clause 17: each file is filled the old way or the new way, never
 both, by the form of its manifest, and the old forms stay accepted until the last module has moved.
@@ -243,11 +244,12 @@ back on drift, removes a module's files and needs when it leaves, fills from cur
 comes back. Its first owners are placement (from the declaration) and config (from
 `mesh-config_resolved`). **Proof:** the client's test list in ADR 0349, against a real bus.
 
-**P6 (issue 672) — The controller hands a module to the provisioner, and the gate waits for it.** *mesh-controller.
+**P6 (issue 672) — The controller hands a module to the provisioner, and the walk waits for it.** *mesh-controller.
 Two days.* For a module marked moved, the declaration carries placement, the templates' digest and the
-filled-files list, and the controller runs no other filling pass for it; the first-node gate counts the
-module healthy only after its node's `prov.applied` for the new build (`gateFacts`). dunst moves first.
-**Proof:** composition and gate tests; dunst on the first workstation filled by the client, live.
+filled-files list, and the controller runs no other filling pass for it; a walk counts the module applied
+on a machine only after the node-engine's report and that node's `prov.applied` for the new build, and a
+failed `prov.applied` is a failed apply (ADR 0362). dunst moves first. **Proof:** composition and walk
+tests; dunst on the first workstation filled by the client, live.
 
 **P7 (issue 673) — The node-engine stops writing placed files from the declaration.** *`mesh-host`. A day.* For a moved
 module the engine writes its filled files only through P2, and removes as an orphan only what the verb