Design 47: sentences that still named the controller as composer, issuer or reader of grants follow ADR 0547 as amended

03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md

@@ -160,9 +160,10 @@ source revision is derived from the keys: every **want** equals its module's **f
   list, alone and with no want (*The bus's user list*, below).
 - **The grants part** (module `mesh-grants`, holding the seat `mesh-grants`) composes who may say what on the bus
   with mesh-sdk's bus composer: each module's membership, the buckets, logs and streams a manifest declares, the
-  bus's user list, and from ADR 0547's third milestone `grants.<module>.<fingerprint>` (ADR 0547 §5, §6). Until
-  the operator's `take-over` it runs in shadow, composing and comparing with what the bus loaded and writing
-  nothing that takes effect; its tools read all it holds and redo all it does.
+  bus's user list, and from ADR 0547's third milestone `grants.<module>.<fingerprint>` (ADR 0547 §5, §6). It publishes
+  memberships from the first milestone; until the operator's `take-over` it keeps the bus's user list, the
+  assertions and the grants in shadow, composing and comparing them with what the bus loaded and writing nothing
+  of them that takes effect; its tools read all it holds and redo all it does.
 - **The watchman** turns the bus's connections into presence and mirrors every key whose next move a machine
   owes into a **pulse**, whose expiry is a stall.
 - **The status view** is the operator's command `mesh-delivery-cli` and a web view, whose wants page sets each
@@ -183,7 +184,11 @@ there is three milestones, one issuer of each key at every moment (ADR 0547 §11
 
 1. **The list follows, the grants part in shadow** (issue 1945): the bus node applies the user list alone, with
    no want; mesh-sdk carries a copy of the bus composer, held byte for byte to the one release 6 runs; the grants
-   part composes and compares in shadow with its tools; the vault hashes the bus accounts it is handed. The
+   part publishes memberships (by the one grant the operator allowed in the controller's composer and its
+   mesh-sdk copy, publishing the assignment subjects and nothing more) and composes and compares the user list,
+   assertions and grants in shadow with its tools; the vault hashes the bus accounts it is handed into its key
+   `bus-accounts.<user>` and adopts once the hashes of accounts it holds no value for, from the list the bus
+   loaded. The
    operator's `take-over` makes the grants part's list the one loaded; it is allowed only when the users of both
    lists are equal but for users placement no longer names, so it waits until the enrolment users and the persons
    have records on the bus, and the second milestone waits for it (ADR 0547 §8, §11).
@@ -470,8 +475,8 @@ From its delivery, a check is this:
 - **The composition check is the assigner's.** Whether the machines still compose with a change is checked by
   the part that owns what each machine should run. The assigner reads the modules, fingerprints and manifests
   the indexer holds and the builds the builder holds; the machines, their roles, assignments and settings, and
-  the grants and credentials it reads from the controller's facts snapshot and from the controller's buckets it
-  names in its manifest's `reads` (ADR 0237 §1, ADR 0408 §3). It clones no repository but at most the change's
+  the grants and credentials it reads from the grants part's state and the vault's accounts, and the rest from the buckets it
+  names in its manifest's `reads` (ADR 0237 §1, ADR 0408 §3, ADR 0547 §4). It clones no repository but at most the change's
   own, and
   composes only the machines that run or could run a module the change moves or adds, or whose grants or
   providers it alters; for a group, once over every member's change, read from the indexer's candidates of the
@@ -595,8 +600,9 @@ backup holder backs up nothing, and the have says so.
   the running system writes for it, the user-list resource alone (ADR 0547 §8).
 - **Memberships and assertions.** The grants part publishes each module's membership on the assignments stream
   only when it differs from the one last published, and asserts every bucket, log and stream a manifest declares
-  when a new manifest digest is registered, with its limits; before `take-over` it composes and compares both and
-  publishes or asserts nothing (ADR 0547 §5).
+  when a new manifest digest is registered, with its limits; memberships are published from the first milestone
+  (the operator's one grant, 22:31 on 2026-10-25), while before `take-over` assertions are composed and compared
+  and nothing is asserted (ADR 0547 §5).
 - **The want names the build.** A want `want.<node>.<module>` names the fingerprint, the artifact's digest, the
   source revision and whether the module holds data; the node's own want `want.<node>.node` names the node
   (ADR 0547 §2).
@@ -988,7 +994,7 @@ release reports the controller's code lines against research 063's baseline (acc
 | R4e | The controller asks no build: a build is keyed by its fingerprint, the new form becomes the only one as one group, and a merge builds nothing its check built; builders fetch over SSH, so an SDK change ships with its users; the vendored copies leave mesh-controller and mesh-sdk; delivered only once the builder's artifact digests equal build-agent's (ADR 0453 clauses 2, 4, 5, 6) | 16, 2, 4 in part | mesh-controller (builds are no longer asked), mesh-delivery (builder), mesh-sdk | 979 (the installed toolchains; closed with the toolchain images in R4g), 1304, the controller asking no build (opened when it is prepared) |
 | R4f | A pull request carries one required status that says what it proved and how long each part took; the controller's composition check and its replays are deleted with the two old statuses; the controller's deletions R3e makes possible go; each level's times are measured, and a bound fails a repository from the first check that meets it (ADR 0447, ADR 0450 §8, ADR 0453 clauses 4, 9, 10) | 21, 22, 23, 24 (the status; the scripts' absence is proved in R4g) | mesh-delivery (checker, assigner), mesh-controller (composition check, replays, `delivery-plan`, `forget-checks`, the asker `mesh-delivery` deleted), mesh-catalog (gitea) | 1299 (the composition check deleted; closes issue 709, the replays' socket), 1300, 1301, 1302 (one status), 1305 (ADR 0482 §8), 1318 |
 | R4g | The last milestone of release 4 and release 5 as one, with one switch-over and no rehearsal (ADR 0524 §1): builds and checks are asks on streams that each build node pulls when it has a free slot, deliveries first, with nothing holding checks and no controller queue (ADR 0525); the assigner is made with its composition check, writes each node's wants compared with what the controller sends and every difference, and the view answers the asks that need no proof of who answered (ADR 0528, ADR 0437 §10); no module's fingerprint takes the builder (ADR 0530); the scripts of the repositories a module is built from, build-agent with its socket and Dockerfile code, the toolchain images and the controller's build code go, and the builder delivers its own module, the build modules and the controller from its keys (ADR 0453 clauses 5, 8, 10; ADR 0524 §5, §7); the ways to deliver without the builder are recorded (ADR 0526); hq's four checks are Go tests (ADR 0527); each repository's script goes (ADR 0529); the word for the composition check's predecessor is struck. Its pull requests are opened only after five readings, the revert path read, not shown on a test merge (ADR 0524 §3) | 4 (from R4g mesh-build-image, rootless, is the only part that builds an image: ADR 0487 §7), 17, 24 (no `merge-check.sh` in a repository a module is built from) | mesh-sdk, mesh-controller (build-agent removed), mesh-delivery, mesh-catalog, mesh-tools, mesh-tools-go, the node-engine (`mesh-host`), mesh-media-catalog, okioki, hq | 1887 (the flow), 1297 (the assigner), 1295 (`merge-check.sh` goes), 979 (closed with the toolchain images), 1296 and 1303 (hq's check, the old word struck), 1299, 1305, 1294, 1318 (the controller's deletions) |
-| R6 | Each node applies from its wants the compositions the controller signs for it, a new version reaches the module's canary first and the rest once it is healthy there, a move a person must allow is asked before its want, the view says what is moving, settled, stuck and delivered, and the plans are deleted from the code; switched over by release 5's last plan (ADR 0539) | 18, 19, 20 | mesh-sdk, the node-engine (`mesh-host`: the node agent), mesh-controller (compositions, credentials on a done build; plans deleted), mesh-delivery (assigner, watchman, view), mesh-catalog (the gate, the messenger, the issue tracker, the backup holder), hq | 1942 (the planner puts the node-engine and the controller in one tier for the switch; delivered first), 1945's fix before the switch (the bus's user list grants what release 6 uses; delivered first), 1943 (mesh-sdk: the composition's layout and signature, the want's digest, `mesh-hand-compose`, the verb tables without the plan verbs), 1944 (the node agent), 1945 (the controller writes compositions and grants; the plans and the push deleted), 1946 (the gate keeps the merge's states; the messenger and the issue tracker hear the view), 1906 (the assigner's seventh rule and its asks, the watchman's pulses for wants, the view's wants and events), 1130 (hq) |
+| R6 | Each node applies from its wants the compositions its own node agent composes (ADR 0547 §2; as released it applied the controller's signed ones), a new version reaches the module's canary first and the rest once it is healthy there, a move a person must allow is asked before its want, the view says what is moving, settled, stuck and delivered, and the plans are deleted from the code; switched over by release 5's last plan (ADR 0539) | 18, 19, 20 | mesh-sdk, the node-engine (`mesh-host`: the node agent), mesh-controller (plans deleted; as released also compositions and credentials, which ADR 0547 moves to the node agents, the grants part and the vault), mesh-delivery (assigner, watchman, view), mesh-catalog (the gate, the messenger, the issue tracker, the backup holder), hq | 1942 (the planner puts the node-engine and the controller in one tier for the switch; delivered first), 1945's fix before the switch (the bus's user list grants what release 6 uses; delivered first), 1943 (mesh-sdk: the composition's layout and signature, the want's digest, `mesh-hand-compose`, the verb tables without the plan verbs), 1944 (the node agent), 1945 (as released the controller writes compositions and grants, which ADR 0547 moves; the plans and the push deleted), 1946 (the gate keeps the merge's states; the messenger and the issue tracker hear the view), 1906 (the assigner's seventh rule and its asks, the watchman's pulses for wants, the view's wants and events), 1130 (hq) |
 
 Release 5 (the assigner's wants, compared only) is not a milestone of its own: ADR 0524 §1 folds it into R4g, whose row above holds
 it. Release 6 is milestone R6, prepared on 2026-10-24 with ADR 0539. Its prepare step found six repositories where its row first