ADR 0270 and 0271 accepted: their home in designs 47 and 45, and the glossary's final states

The operator accepted both on 2026-10-09. Design 47's state table gains covered and what ends a held
delivery by itself, and its group the wait for a composed check and the lift; design 45's signals table
gains S17 and its planned bus step says the wait is told at once. The glossary's delivery entry names its
six final states.

00-META/glossary.md

@@ -278,7 +278,7 @@ and the operator act. **Recorded by** the controller's `identity` and `licences`
 **Purpose.** To take one commit from its pull request to every node that should run it, and to put it
 back when it fails. **Recorded by** the `mesh-delivery` module (deliveries) and the controller (the
 planner, the walk). **Downstream of** Module, Core, Health and repair and Data.
-**Decided by** ADR 0162, 0218, 0236, 0237, 0238, 0239, 0267.
+**Decided by** ADR 0162, 0218, 0236, 0237, 0238, 0239, 0250, 0267, 0270.
 **Uses:** module, node, declaration and send (Placement), health (Health and repair), person.
 
 - **merge check** — the two statuses a pull request carries before it may merge: the **merge gate**
@@ -313,17 +313,19 @@ planner, the walk). **Downstream of** Module, Core, Health and repair and Data.
   modules live in. `mesh-catalog` and `catalog_modules` are identifiers and keep their spelling.
   *Not:* ~~catalog~~ (hq)
 - **delivery** — one commit in one repository on its way to the nodes, from its pull request's head
-  being announced to delivered, failed, superseded or stopped: one pull request, one status, one note
+  being announced to one of its final states: one pull request, one status, one note
   ([ADR 0239](../02-DECISIONS/0239-a-delivery-is-owned-by-the-mesh-delivery-module-and-runs-from-commit-to-delivered.md)).
   Its states are one table (`proposed`, `checked`, `ready` or `rejected`, `published`, `delivering`,
-  `held`, and the final four). Not *change* (a diff). *Pipeline* is the predecessor's build-and-deploy
+  `held`, and the final six: `delivered`, `failed`, `superseded`, `stopped`, `retired` and `covered`;
+  [ADR 0250](../02-DECISIONS/0250-a-merge-heard-only-from-the-buss-history-is-retired-and-owed-work-the-forge-cannot-do-ends.md),
+  [ADR 0270](../02-DECISIONS/0270-a-held-delivery-that-moves-nothing-or-that-a-later-delivered-merge-contains-ends-by-itself-and-a-hold-whose-reason-is-gone-lifts.md)). Not *change* (a diff). *Pipeline* is the predecessor's build-and-deploy
   mechanism, which the as-is designs describe; it is never a word for a delivery.
   *Not:* ~~deployment~~ (hq)
 - **covered** — the end of a delivery that a later merge containing it delivered: every module it moves was
   sent to every machine running it by the walk of a later merge into the same trunk, delivered on its own
   passing check, whose merge commit the forge says contains this one. Not *superseded*, which is a delivery
   whose walk a newer delivery took over before it ended; nor *delivered*, which its own walk or an empty plan
-  ends in ([ADR 0270](../02-DECISIONS/0270-a-held-delivery-that-moves-nothing-or-that-a-later-delivered-merge-contains-ends-by-itself-and-a-hold-whose-reason-is-gone-lifts.md), proposed).
+  ends in ([ADR 0270](../02-DECISIONS/0270-a-held-delivery-that-moves-nothing-or-that-a-later-delivered-merge-contains-ends-by-itself-and-a-hold-whose-reason-is-gone-lifts.md)).
 - **delivery group** — two or more deliveries sharing a pull request head branch name across the mesh's
   repositories, delivered as one unit in an order declared (`after:`) or inferred by the planner. One
   level: a group holds deliveries, never groups. Its state is derived from its members, never set.

02-DECISIONS/0270-a-held-delivery-that-moves-nothing-or-that-a-later-delivered-merge-contains-ends-by-itself-and-a-hold-whose-reason-is-gone-lifts.md

@@ -1,6 +1,6 @@
 ---
 topic: the mesh
-status: proposed
+status: accepted
 date: 2026-10-09
 deciders: jochen
 reconstructed: false
@@ -198,6 +198,6 @@ stopped or failed.
 - [Issue 300](../04-ISSUES/300-a-new-module-is-not-built-at-its-merge/00-report.md), why a new
   module opens no walk.
 - [Design 47](../03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md), *The state table* and *A
-  delivery group*, which take these rows once this record is accepted.
+  delivery group*, which carry these rows.
 - mesh-catalog #150, which builds it, and the forge module's `gitea_contains` with it; mesh-catalog #151,
   which has the catalogue's check run its TypeScript modules.

02-DECISIONS/0271-a-send-held-for-the-buss-planned-step-is-told-to-the-operator-at-once-and-a-change-that-needs-it-says-so-before-it-merges.md

@@ -1,6 +1,6 @@
 ---
 topic: the mesh
-status: proposed
+status: accepted
 date: 2026-10-09
 deciders: jochen
 reconstructed: false
@@ -118,5 +118,5 @@ Three things were missing, read from the controller's code
   [ADR 0254](0254-a-wait-for-a-persons-new-login-is-not-a-gates-failure-and-each-module-of-a-send-keeps-its-own-pass.md),
   the precedent of a wait for a person said as its own condition.
 - [To-be 45](../03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md) §3, the signals table, and §8, the
-  bus as a planned step, which take this row once this record is accepted.
+  bus as a planned step, which carry this row.
 - mesh-controller #173, which builds it.

03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md

@@ -2,8 +2,9 @@
 layer: to-be
 status: in-progress
 code: [mesh-controller, mesh-host, mesh-tools, mesh-catalog, mesh-sdk, mesh-lab]
-updated: 2026-10-08
+updated: 2026-10-09
 decisions:
+  - 02-DECISIONS/0271-a-send-held-for-the-buss-planned-step-is-told-to-the-operator-at-once-and-a-change-that-needs-it-says-so-before-it-merges.md
   - 02-DECISIONS/0265-a-verb-that-reads-is-answered-on-the-serving-controllers-own-connection-and-every-connection-says-what-it-is.md
   - 02-DECISIONS/0264-a-message-a-consumer-gives-up-on-is-kept-until-a-person-delivers-it-again-or-drops-it.md
   - 02-DECISIONS/0261-an-assignment-made-while-its-modules-build-runs-is-kept-pending-and-the-controller-makes-it.md
@@ -233,6 +234,7 @@ signal and asserts its condition. `doctor signals` shows, for every row, the age
 | S14 | facts snapshot exported | controller | when it moved, and daily | 2 days, or none kept by a controller up that long (Phase 5) | `facts-stale` | warning | — |
 | S15 | a hand act with a cause already recorded | hand-act log | each act | the second within 14 days; clears when fewer than two remain within 14 days | `healer-wanted` (names the cause, and the healer that was not enough where one answers it) | warning | — |
 | S16 | a walk waiting for its delivery's word is let go | mesh-delivery, through `deliver` (ADR 0239) | each merge whose walk waits | 30 min; urgent after 4 h | `waiting` (names the walk and `plans go`) | warning | — |
+| S17 | a send held for the bus's planned step is told to a person (ADR 0271) | controller's plan | each send refused because it would replace the bus outside its step | none: the first refusal; cleared once the bus's machine has been sent the build the mesh holds | `bus-step-waiting`, for the operator (names the machines, what waits, the bus build from and to, since when and the `mesh-controller.bus` call); S3 leaves such a walk out | warning | — |
 
 The bus advisories (S9) cost one read-only subscription: the server already publishes them. The
 controller translates each into a condition naming the thing in the mesh's words, as the refused reply
@@ -562,7 +564,10 @@ bus machine's backup holder backing the bus module up now ([ADR 0235](../../02-D
 or one a person took and names with `--snapshot-taken`; the step's bound is fifteen minutes; **no send
 reaches the bus's machine while a new bus build waits for it** — a push, a plan's send for another
 module, a healer's — after a plan's send restarted the bus unasked on 2026-10-06; a change of the bus's
-user list is reloaded in place, not a restart. *2026-10-06:* the snapshot
+user list is reloaded in place, not a restart. **A send held for the step is told at once** ([ADR 0271](../../02-DECISIONS/0271-a-send-held-for-the-buss-planned-step-is-told-to-the-operator-at-once-and-a-change-that-needs-it-says-so-before-it-merges.md)):
+S17 raises `bus.<module>.step-waiting` for the operator on the first refusal, and a change that builds the bus
+says in its delivery plan, and so in `mesh/merge-gate`'s description, that merging it needs a person's bus
+upgrade. *2026-10-06:* the snapshot
 and the way back from it exist — the bus image's own snapshot program, the same one the night's backup
 runs, and a restore that builds a new store beside the live one for a person to swap in
 ([ADR 0235](../../02-DECISIONS/0235-the-bus-is-backed-up-by-its-own-snapshot-of-each-stream.md),

03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md

@@ -2,8 +2,9 @@
 layer: to-be
 status: designed
 code: []
-updated: 2026-10-08
+updated: 2026-10-09
 decisions:
+  - 02-DECISIONS/0270-a-held-delivery-that-moves-nothing-or-that-a-later-delivered-merge-contains-ends-by-itself-and-a-hold-whose-reason-is-gone-lifts.md
   - 02-DECISIONS/0250-a-merge-heard-only-from-the-buss-history-is-retired-and-owed-work-the-forge-cannot-do-ends.md
   - 02-DECISIONS/0249-a-delivery-groups-order-rules-have-a-precedence-and-a-declared-order-outranks-them-all.md
   - 02-DECISIONS/0239-a-delivery-is-owned-by-the-mesh-delivery-module-and-runs-from-commit-to-delivered.md
@@ -72,14 +73,26 @@ allows.
 | ready | it passed; it waits to be merged | none | — |
 | rejected | it failed its check | none | — |
 | published | merged on the trunk its modules follow, its walk opened and asking nothing; it waits for its turn or its word | 30 minutes | `superseded` when a newer delivery took over its walk; `go` when its walk started |
-| held | it waits for a person | 1 day | nothing: it is the operator's |
+| held | it waits for a person; read again each tick, so it ends by itself when it moves nothing or a later merge covers it (ADR 0270) | 1 day | nothing: it is the operator's |
 | delivering | its walk runs; its builds are asked and registered tier by tier | 2 hours | `delivered`, `failed` or `superseded`, as the walk's record says |
-| delivered, failed, superseded, stopped, retired | final | — | — |
+| delivered, failed, superseded, stopped, retired, covered | final | — | — |
 
-The transitions are those of ADR 0239 decision 2. A delivery that is merged while not `ready` goes to
-`held`. Its check did not pass, and only a person decides that it goes on. A delivery merged with no walk
-opened for it within ten minutes is held too, saying so: nothing it moves follows that branch, or the merge
-was not heard. Nothing waits silently.
+The transitions are those of ADR 0239 decision 2 and [ADR 0270](../../02-DECISIONS/0270-a-held-delivery-that-moves-nothing-or-that-a-later-delivered-merge-contains-ends-by-itself-and-a-hold-whose-reason-is-gone-lifts.md). A delivery that is
+merged while not `ready` goes to `held`. Its check did not pass, and only a person decides that it goes on. A
+delivery merged with no walk opened for it within ten minutes is held too, saying so: nothing it moves follows
+that branch, or the merge was not heard. Nothing waits silently.
+
+**What needs no person ends by itself** (ADR 0270):
+
+- *a merge that moves nothing* (its plan builds nothing, or only adds a module the controller builds and
+  sends nowhere) is `delivered` as soon as it is merged, whatever its check said;
+- *a merge a later delivered merge contains* is `covered`: every module it moves was sent to every machine
+  running it by the walk of a later merge into the same trunk, delivered on its own passing check, and the
+  forge says that later merge commit contains it (`gitea_contains`, asked once per pair and kept). Merge
+  order is only the first filter, and a forge that cannot answer means not yet covered. `mesh/delivery`
+  says `covered: a later merge that contains it was delivered` as a success. A module that runs on one
+  machine only gets no "rest" step and is never covered;
+- the covered row is tried before `go`, from `held` and from `ready` past the ten minutes.
 
 **History is retired, not held** ([ADR 0250](../../02-DECISIONS/0250-a-merge-heard-only-from-the-buss-history-is-retired-and-owed-work-the-forge-cannot-do-ends.md)).
 A delivery made from the forge's word at its merge, heard fifteen minutes or more after that merge, with no walk
@@ -108,7 +121,10 @@ controller's `plan-moved` event, never inferred from time.
 - **Check**: the members' heads composed together, one gate over every machine with all their definitions. It
   is asked by mesh-delivery through `delivery-check` when the group forms or a member's head moves, and
   posted on every member's head as `mesh/delivery-group`.
-- **Delivering**: in order. A member waits in `published` until the one before is `delivered`.
+- **Delivering**: in order. A member waits in `published` until the one before is `delivered` or `covered`.
+  A member published while its group's composed check is asked and not answered waits there for the answer;
+  one held because that check had not passed is *lifted* back to `published` once it passes or warns for the
+  heads that merged and its own walk is still open (ADR 0270).
 - **A failed member**: the members after it are `stopped`, naming it. The members before it stay delivered.
   Its own builds were put back at its gate.
 

04-ISSUES/316-a-group-member-held-before-its-composed-check-answered-stayed-held-after-it-passed/01-diagnosis.md

@@ -63,3 +63,5 @@ The group's order put it second. Open question 4 in the report asks whether that
 
 Open question 3, whether `mesh/delivery-group` is required on the trunks, stays the operator's setting. Open
 question 4 is not touched.
+
+**Accepted 2026-10-09.** The operator accepted the record named above; it is no longer proposed.

04-ISSUES/319-a-held-delivery-a-later-commit-superseded-has-no-end-but-release/01-diagnosis.md

@@ -145,3 +145,5 @@ longer leaves anything held.
    `delivery.<id>.stalled`.
 6. The two catalogue merges held for their group (issue 316) are covered only if a later delivered walk sent
    their module. One that stays held is a real question: its change may not run anywhere.
+
+**Accepted 2026-10-09.** The operator accepted the record named above; it is no longer proposed.

04-ISSUES/336-a-send-held-for-the-bus-step-raises-nothing/01-diagnosis.md

@@ -79,3 +79,5 @@ in mesh-lab's replays register as R336 before this issue resolves with `replay:
 
 Suggested fix 2 (an ask) waits for ADR 0259's asks. The guess about letting a send keep the bus at its running
 build and carry the rest is not checked here.
+
+**Accepted 2026-10-09.** The operator accepted the record named above; it is no longer proposed.