Answer design 47's review for release 4's check: the judge's account ends at release 4, the assigner's reads and version skew and field refusal stated, where acceptance tests 22 and 23 are measured, and what release 4 retires

03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md

@@ -97,7 +97,8 @@ source revision is derived from the keys: every **want** equals its module's **f
   fingerprint is not held, the node is the module's **canary** or the canary runs it healthy, at most `step`
   other nodes are ahead when `step` is above zero, every provider runs healthy, and the module's credential for that fingerprint exists.
   It also runs the **composition check**: whether the machines a change touches still compose with it, read
-  from the keys the indexer and the builder hold, with the composition it sends with (ADR 0446). Its module
+  from the keys the indexer and the builder hold and from what the controller keeps of machines, settings and
+  grants, with the composition it sends with (ADR 0446). Its module
   is made in release 4 for that check alone; its wants come in release 5.
 - **The node agent**, the node-engine's own process, applies its wants one module at a time, backs up a data
   module first, and writes its haves.
@@ -332,7 +333,7 @@ check is this:
   member's tests, read beside the others' heads, and one composition of all members' changes. It replaces
   `mesh/merge-gate` and `mesh/repo-check`; the forge requires it, the checker writes it and the gate reads it from
   the same delivery (ADR 0447). `mesh/delivery-group` stays the delivery's view, not a required check. Wherever
-  the sections above say both checks passed, they read this one status.
+  this design says both checks passed, they read this one status.
 - **What the status says.** Its line says the verdict, the tests run and kept at each level, the machines
   composed, and how long each part took: waiting in the queue, cloning, the unit level, the integration level's
   setup and its running, and the composition. A failure names the test or the machine first. The line links to
@@ -357,13 +358,18 @@ check is this:
   changed.
 - **The composition check is the assigner's.** Whether the machines still compose with a change is checked by
   the part that owns what each machine should run. The assigner reads the modules, fingerprints and manifests
-  the indexer holds and the builds the builder holds, clones no repository but at most the change's own, and
+  the indexer holds and the builds the builder holds; the machines, their roles, assignments and settings, and
+  the grants and credentials it reads from the controller's facts snapshot and from the controller's buckets it
+  names in its manifest's `reads` (ADR 0237 §1, ADR 0408 §3). It clones no repository but at most the change's
+  own, and
   composes only the machines that run or could run a module the change moves or adds, or whose grants or
   providers it alters; for a group, once over every member's change, read from the indexer's candidates of the
   group, and while the indexer holds none the group's check waits and says why. It composes with the function the
-  controller sends with, moved into mesh-sdk, so the two agree for one mesh-sdk version. No judge is built from
-  a change: a change to the composition is proved by its own tests, and a field only a newer composition reads
-  goes out as optional first. What it fails on, and its warning past twelve rebuilt modules, are today's merge
+  controller sends with, moved into mesh-sdk, so the two agree for one mesh-sdk version; its verdict names the
+  mesh-sdk version it composed with, and while the assigner and the controller run different versions the
+  controller's self-check raises a condition until they agree. No judge is built from a change: a change to the
+  composition is proved by its own tests, a field only a newer composition reads goes out as optional first, and
+  the running composition refuses a manifest that uses a field it does not read, naming the field. What it fails on, and its warning past twelve rebuilt modules, are today's merge
   gate's (ADR 0446, ADR 0237 §2).
 
 ## The Approve and the merge
@@ -506,9 +512,10 @@ delivery time.
 - **Builds and tests run directly**, as the build seat's own account on its node, in no container. The
   build module of each module's language runs its tests by that language's convention; no repository's
   script or toolchain line decides it, hq's alone excepted until issue 1296 (ADR 0445).
-- **A judge has an account of its own.** A judge built from a sibling's merge (ADR 0382 §3) is built and run as a
-  second account of the Go build module, whose home, configuration and cache the build seat's account cannot write,
-  so a check's script cannot change it.
+- **A judge has an account of its own, until release 4 is delivered.** Until then, a judge built from a sibling's
+  merge (ADR 0382 §3) is built and run as a second account of the Go build module, whose home, configuration and
+  cache the build seat's account cannot write, so a check's script cannot change it. From release 4 no judge is
+  built from a change and the account is not made (ADR 0446 §5).
 - **Every dependency comes by the version its lock file names**, checked against its checksum: the mesh's own
   code from the mesh's forge, its own packages from its package registry, any other from its public source.
 - **A builder fetches from the forge over SSH with a key of its own**, as the build seat's account, under a forge
@@ -652,9 +659,11 @@ development, the check's share about a minute):
     each part's time as the status's line says it.
 22. A change that adds a failing test is answered failed with only that test's package run; a check asked again
     after one failed package runs that package alone; a check whose inputs equal an earlier one's runs nothing
-    and takes every kept verdict.
+    and takes every kept verdict. Measured on the status's line: the tests run and kept at each level, and the
+    failed test it names.
 23. A library or catalogue change's composition check composes only the machines it touches, and clones no
-    repository but at most the change's own.
+    repository but at most the change's own. Measured in the check's report: the machines composed, against the
+    machines that run or could run a module the change moves or adds, and the repositories cloned.
 24. A pull request carries one required status, and a delivery group one verdict on every member's head, its
     line naming what was proved and each part's time; no repository a module is built from holds a
     `merge-check.sh`.
@@ -675,6 +684,11 @@ development, the check's share about a minute):
   group's merges (ADR 0418 §1, §5, §6).
 - The controller's tables of builds, build requests, rollouts and their tiers, batches and merges, and
   assignments; the record mirrors, probe D17's audit and healer H6 for those kinds (ADR 0408).
+- At release 4's delivery: `merge-check.sh` and its `# mesh-check-toolchain` line in every repository a module is
+  built from, hq's alone kept until issue 1296 (ADR 0445 §6); the controller's merge gate, composing every
+  machine from clones and throwaway stores (ADR 0446 §1, §6); the judge built from a change and the Go build
+  module's second account for it (ADR 0446 §5); and the two statuses `mesh/merge-gate` and `mesh/repo-check`
+  (ADR 0447 §1).
 
 ## Milestones