Number a module's version before its build, as the operator chose, so packed files carry it

A Go module zip and a TypeScript package hold their version inside the file, so a number given at publication
could not be valid for a digest built before it (gaps items 22, 23, 43). The operator chose on 2026-11-10: the
manifest says MAJOR.MINOR, the build system reserves the next patch at the build's start, the catalog holds and
says released versions only, the first watched branch alone releases, and Go packages are tagged, departing from
ADR 0573 §2 until a later research brings the record in line.

Claude-Session: https://claude.ai/code/session_01JG73KK8HD1gufnqyFxMFdW

03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md

@@ -1847,7 +1847,8 @@ milestone with more tests than it starts with (research 085, Direction, One mile
     other's new verb are delivered together as one step; two artifacts each needing the other's new package to build
     are refused, naming both; a seat moved to a new holder has its old holder released before the new one claims (unit,
     the indexer's graph; whole, assigner, mesh-delivery; live).
-80. **R18, a publish rebuilds.** A mesh-sdk merge changing one package publishes one version, and only the artifacts
+80. **R18, a publish rebuilds.** A mesh-sdk merge changing one package publishes one version, reserved before its
+    build (test 102), and only the artifacts
     importing that package rebuild against it and are delivered, with no hand act; a merge changing only tests rebuilds
     nothing (whole, builder and indexer, mesh-delivery; live).
 
@@ -1919,6 +1920,12 @@ ADR 0667's checks, of milestone G itself:
 101. **A second start writes nothing.** A `take-in.taken` and a `package-published` for the same source revision and
     module start one pipeline: the second start's compare-and-set on the pipeline key writes nothing (whole, runner,
     mesh-delivery).
+102. **A version is reserved, carried and released** (design 47 G §52, §349, §368 to §371). A module whose manifest
+    says `1.4`, with `1.4.2` the highest released, builds as `1.4.3`, its Go package tagged `v1.4.3` and its program
+    reporting it; with one of its two artifacts published `1.4.3` is not released, and `builder_publish_again`
+    publishes the other under `1.4.3`, which the catalog then says `version-released` once; a new `1.5` builds as
+    `1.5.0`; two builds close together reserve two versions; a `beta` build reserves none and is delivered; a manifest
+    saying `1.4-beta` is refused (whole, builder, indexer and Go build module, mesh-delivery and mesh-catalog).
 
 ## What retires
 
@@ -2014,7 +2021,7 @@ release reports the controller's code lines against research 063's baseline (acc
 | L6 | Provisioning leaves the controller (ADR 0570): every provision is one key of the seat `mesh-provisioner`, held by mesh-provisioner, holding a reference and never a value, and each placed module's provisioning plan a key of its state `plans`, both composed from placement, the wants and the manifests on change events; each provider acts once all a provision depends on is provided; the assigner moves a want only once its build's provisions are provided; a provision no want needs is retiring, and its account or credential is removed only on the operator's Approve, its data never; the vault mints each provision's secret sealed to the consumer's and the provider's node, and the consumer's node-engine writes it; a wait for a person is a provision's state, which the watchman reads; bus permissions stay with the grants part (ADR 0349, ADR 0230, ADR 0547 §11) | — | mesh-sdk, the node-engine (`mesh-host`), mesh-tools (the tool runner's provisioner client), mesh-catalog (mesh-provisioner, the vault, the provisioner client, postgres, keycloak, gitea, route-adapter), mesh-delivery (assigner, watchman) | 1954 |
 | L7 | History and records leave the controller (ADR 0571): the builder keeps its build log, one entry at a build's start and one at its end, from which build history and durations are read and the module mesh-catalog asks the builds it missed; the artifact sweep is the seat `mesh-artifact-sweep`, held by artifact-store-tools beside the artifact store, its keep set from the store's own listing, the wants and the build log, sweeping at each build's end from the lease write and recording each deletion in the hand-act log; disk readings are disk-load's own state on every node; who holds which seat is the state `seat-holders` of the seat `mesh-placement` (now `mesh-module-assigner`), and tools are found by the tool runners' announcements; what a node runs is its want and its have; the grants part writes `grants.<module>.<fingerprint>` and keeps memberships in its own state; root-free is a probe of the self-check; no manifest but the controller's reads, invokes or consumes `mesh-controller`, but a named list kept to the lease write, so the lease write's check passes (ADR 0189, ADR 0547 §11, ADR 0549 §6) | — | mesh-sdk, mesh-controller (its pin only), mesh-delivery (builder, indexer, assigner, grants part, view), mesh-catalog (artifact-store-tools, disk-load, the backup seat's holder, mounts, nfs-server, minio, mesh-watcher, the messenger, the self-check, the module mesh-catalog, docker), mesh-tools (the tool runner) | 1955 |
 | B0 | The bootstrap delivery: every check, a lone pull request's as a group of one and a verdict carried after a trunk move included, is judged by a checking program built from the change's own heads in the build seat's sandbox, which also makes the heads' one seat list that the check hands the manifest validator and the composer; it brings no seat definition and no manifest field, so the running checker checks it (ADR 0644; *The bootstrap delivery, and the one milestone after it*) | 26 needs it | mesh-sdk (`go/delivery`: the seat `node-build-go`'s ask `run` and the checker's record of which checking program judged; `go/composer`: the request's seat list), mesh-catalog (mesh-build-go: the run step, the refused answer, the kept programs' tools and sweep), mesh-delivery (checker: the checking program and its command), hq (this design, the glossary) | 1921 |
-| G | Two graphs and one revision view: the catalog graph and the assignment graph kept per revision, a change delivered as its graph difference, the acting parts' rules on their seats as bounded waits that hold their modules when the new version fails, the check on the change's own acting parts, the revision view and each process's own build, the gate's delivery record, and the trace's links (ADR 0656); no part reads a pull request's description (ADR 0659); every delivery part reaches the forge through the seat `git` and names no other module; nothing holds an approved merge for another check; and, one milestone with them, research 086's pipelines: a change of any module goes from a commit on a watched branch to the machines through its module's pipeline, its policy in its registration, ordered by edges between artifacts, with no Approve per merge and no hand act, the checker gone (ADR 0666, ADR 0667). Test counts at its start (G's prepare, 2026-11-09): mesh-delivery 665 unit and 68 integration, the node-engine (`mesh-host`) 1,742 unit; each other repository's and each catalog module's from the last check's verdict, read in the joint prepare | 26 to 62, 63 to 100 | mesh-sdk (the runtime: the fingerprint, the view, the definition reader, the seat list's one wiring), mesh-contracts and the domains' contracts modules (`acts`, the new verbs and events, the seat `mesh-grants`, the seat `git`'s verbs), mesh-delivery (indexer, assigner, checker until its removal, builder, grants part, gate's view, forge bridge, watchman, the new pipeline runner `mesh-delivery-pipeline`, `contracts` and `sdk` moved under `modules/`), mesh-catalog (the gate, the build modules, the forge module, mesh-issues, mesh-knowledge, the `node-backup` holder, the router, nats: a module's kept data on the bus as a backed-up item and the object store beside each state), mesh-sdk (also its small object store package, for values of any size), the node-engine (`mesh-host`), hq | 1966, 1961 (retargeted to this row's shape), 1660, 1972, 1721, 1783, 1785, 1794, 1791, 1373, 595; 1962 goes back with 1958, whose assignment entry it needs (ADR 0641 §3) |
+| G | Two graphs and one revision view: the catalog graph and the assignment graph kept per revision, a change delivered as its graph difference, the acting parts' rules on their seats as bounded waits that hold their modules when the new version fails, the check on the change's own acting parts, the revision view and each process's own build, the gate's delivery record, and the trace's links (ADR 0656); no part reads a pull request's description (ADR 0659); every delivery part reaches the forge through the seat `git` and names no other module; nothing holds an approved merge for another check; and, one milestone with them, research 086's pipelines: a change of any module goes from a commit on a watched branch to the machines through its module's pipeline, its policy in its registration, ordered by edges between artifacts, with no Approve per merge and no hand act, the checker gone (ADR 0666, ADR 0667). Test counts at its start (G's prepare, 2026-11-09): mesh-delivery 665 unit and 68 integration, the node-engine (`mesh-host`) 1,742 unit; each other repository's and each catalog module's from the last check's verdict, read in the joint prepare | 26 to 62, 63 to 102 | mesh-sdk (the runtime: the fingerprint, the view, the definition reader, the seat list's one wiring), mesh-contracts and the domains' contracts modules (`acts`, the new verbs and events, the seat `mesh-grants`, the seat `git`'s verbs), mesh-delivery (indexer, assigner, checker until its removal, builder, grants part, gate's view, forge bridge, watchman, the new pipeline runner `mesh-delivery-pipeline`, `contracts` and `sdk` moved under `modules/`), mesh-catalog (the gate, the build modules, the forge module, mesh-issues, mesh-knowledge, the `node-backup` holder, the router, nats: a module's kept data on the bus as a backed-up item and the object store beside each state), mesh-sdk (also its small object store package, for values of any size), the node-engine (`mesh-host`), hq | 1966, 1961 (retargeted to this row's shape), 1660, 1972, 1721, 1783, 1785, 1794, 1791, 1373, 595; 1962 goes back with 1958, whose assignment entry it needs (ADR 0641 §3) |
 
 An issue is in one row only (ADR 0493 §2): where a row named an issue another row names too, the last row keeps it and the
 earlier row says so in words (the operator, 2026-10-26). Milestone M1 makes each row a record of the issue tracker

03-DESIGN/01-to-be/47-milestones/G-1-pipelines-registration-and-steps.md

@@ -378,10 +378,19 @@ check and deliver milestone G itself (ADR 0667 §2); each of them says so in a l
 
 ### A publish rebuilds
 
-- §52 **Numbered at publication.** The builder numbers a package's version when it is published, never only when a build
-  is claimed, and says the publication as the event `package-published` of its seat `mesh-builds` (ADR 0666 §15; design
-  51, *The versions*). The seat is new, held once for the mesh, defined in `mesh-delivery-contracts`; the builder held
-  none until now, and its waits stay on its own stream in this milestone.
+- §52 **A version is reserved before the build and released when every artifact is published.** A module's version
+  is its manifest's `version`, `MAJOR.MINOR`, and a patch the build system gives: the next after the highest version
+  the catalog holds released for that `MAJOR.MINOR`, 0 for one it holds none of. The builder reserves it when the
+  module's build starts and passes it to the build of every artifact of the module (§370), so code and packed files
+  carry it; each artifact published is said as the event `package-published` of the builder's seat `mesh-builds`
+  (ADR 0666 §15), and the version is released only once every artifact of the module at it is published (§349); only the first watched branch releases (§371). A
+  failed publish leaves the version reserved, and `builder_publish_again` publishes the missing artifacts under the
+  same version. The seat `mesh-builds` is new, held once for the mesh, defined in `mesh-delivery-contracts`; the
+  builder held none until now, and its waits stay on its own stream in this milestone. Why: the operator, 2026-11-10
+  about 21:40 CET, a design choice of G's part (gaps items 22, 23 and 43). This reserves the number when the build
+  starts, where ADR 0666 §15 numbers a package at its publication and design 51 publishes a held digest under a new
+  number: a packed file carries its version, so it must be known before the build; the operator's choice, which a
+  later research brings the records in line with. How it is checked: test 102.
 - §53 **Every dependent is rebuilt against it.** On `package-published` every artifact with a kind-1 edge to the package is
   rebuilt against the new version, and the runner, which consumes the event, starts its pipeline; nothing else is
   rebuilt, and a change to tests alone publishes nothing (ADR 0666 §15; research 086, R18).

03-DESIGN/01-to-be/47-milestones/G-2-pipelines-sizes-checks-and-tools.md

@@ -199,7 +199,7 @@ four lines a module's tools answer; every read tool of a store also answers its
 | the forge module (`git`) | `git_failed_steps` (the failed `required` steps it holds, by module and fingerprint, with the run that failed each) | — | `git_failed_steps_drop` (drop one, with why) |
 | the grants part (`mesh-grants`) | `grants_callers` (the callers each verb admits, read from the seat definitions) | — | `grants_why_refused` (for an account and a verb, the grant it lacks and the definition's line that leaves it out) |
 | the build seats | `steps` (the steps detected for an artifact) | `steps` with `again` (detect again) | `drop` (ADR 0664 §4) |
-| the builder (`mesh-builds`) | `builder_versions` (a package's published versions) | `builder_publish_again` | — |
+| the builder (`mesh-builds`) | `builder_reserved` (each module's reserved version, §369); the released versions are the catalog's `versions` | `builder_publish_again` (publish the missing artifacts under the reserved version) | — |
 | the assigner (`mesh-wants`) | `assigner_why_not` (why a module is not on a machine yet: the pipeline it waits for, its hold, the placement, the node's last `running`) | — | `assigner_release` |
 | the watchman | `watchman_views` (how far behind each part's view is, from each part's `view-waits` and first-view tools) | — | each part's `<module>_first_view_again` |
 | the operator-channel | `asks` (with each asker's asks held back) | — | `ask-again` (offer a held-back ask now) |

03-DESIGN/01-to-be/47-milestones/G-6-verbs-retires-and-answers.md

@@ -382,15 +382,22 @@ record it follows from, and replaces the builder's own choice where one was made
 - §347 **Reading sent objects is a bus state call.** mesh-sdk lists the call that reads a sent object under its existing
   bus state capability. Why: ADR 0595 §9 puts the calls in that package. How it is checked: the package's table test.
 - §348 **The builder reads the catalog through its seat.** The builder reads the registrations' watched branches through
-  `mesh-catalog`'s `registrations` and `registration-changed`, and a build seat's holder from the seat list; the
+  `mesh-catalog`'s `registrations` and `registration-changed`, the released versions it numbers from through
+  `versions` and `version-released`, keeping no list of versions of its own, and a build seat's holder from the seat list; the
   manifests, the packages, each package's name in its ecosystem (the Go module path, the npm name, which the catalog
   graph entry's packages carry) and a run's candidate from the catalog half of its revision view, never the indexer's
   state. With no holder of a build seat, a build ends `could not run`, naming the seat, and is asked again on the seat
   list's change. Why: ADR 0596 §2. How it is checked: the builder's account holds no grant to the indexer's state.
-- §349 **`package-published` is heard by the indexer.** The indexer keeps its package state from `package-published` for
-  every package, and from the builder's `version.numbered` only for images, bundles and archives. Why: the
-  publication is the seat's event (ADR 0666 §15). How it is checked: whole (indexer), a published package's version is
-  in its state.
+- §349 **The catalog holds released versions only, and says each.** The indexer keeps, for the seat `mesh-catalog`,
+  each module's released versions in its old `state` section `versions`, one key per module and `MAJOR.MINOR` holding
+  its released patches with each artifact's digest and the source revision built (issue 1961's catalog of versions).
+  It hears every artifact's `package-published` (packages, images, bundles and archives alike) and records a version
+  as released once every artifact the module's catalog entry names is published at it, then says `version-released`
+  (the module, the version, its artifacts, the source revision) on `mesh.seat.mesh-catalog.event.version-released`,
+  kept 90 days at 16 MiB; the verb `versions` answers a module's released versions, its callers the builder and any
+  person or session. A reserved version is not in it. The builder's `version.numbered` is no longer said or heard.
+  Why: the operator, 2026-11-10 about 21:40 CET (gaps items 23 and 43). How it is checked: whole (indexer), a version
+  with one of two artifacts published is not released, and with both is, said once.
 - §350 **A superseded build's drop is a kept call.** The runner ends a superseded build's step `superseded` at once, and
   asks the build seat's `drop` as a kept call (ADR 0668 §1, §2), so it is asked again through every transport fault
   and said `call-unanswered` after five minutes in the runner's findings. How it is checked: whole (runner), a drop
@@ -476,3 +483,27 @@ record it follows from, and replaces the builder's own choice where one was made
   itself answered as lost stays lost, said in the indexer's journal and in `indexer_pending`. G's own change for it
   (`LostAgain`, commit 106fc16b) is not built. Why: one rule for kept calls (ADR 0668), already on main. How it is
   checked: the indexer's take-in table, a transport fault reads the message again and a lost answer does not.
+- §368 **A manifest says its `MAJOR.MINOR`.** Each module's manifest names `version`, two numbers `MAJOR.MINOR`; the
+  manifest validator refuses any other form, a pre-release or custom suffix (`beta`, `alpha`) among them: no custom
+  version exists for now. A manifest without it is refused once G's reader runs (ADR 0667 §4: the reader is delivered
+  first). Why: the operator, 2026-11-10 about 21:40 CET. How it is checked: unit (manifest validator), `1.4` accepted,
+  `1.4-beta` and `1.4.2` refused.
+- §369 **The reservation is one key per module and `MAJOR.MINOR`.** The builder, a foundation part, keeps in its old
+  `state` section `reserved` one key per module and `MAJOR.MINOR`, the version its build reserved, written by
+  compare-and-set at the build's start; a newer build of the module takes the next after the higher of the highest
+  released and the one reserved, so two builds never share a version, and a superseded build's version is never
+  released, leaving a gap in the patches. The builder deletes the key when the catalog says `version-released` for it;
+  `builder_reserved` reads the keys. This is no list of released versions: numbering reads those only from the
+  catalog. Why: the operator, 2026-11-10 (a version reserved when the build starts); the key and the gap are the
+  design's choice. How it is checked: whole (builder), two builds close together reserve two versions, and the key
+  goes on `version-released`.
+- §370 **The version reaches every artifact's build.** The build seat's ask carries the version, and the build module
+  passes it to the artifact's build as the build argument `MESH_VERSION`: a Go package is tagged `vMAJOR.MINOR.PATCH`,
+  an npm package's version is it, an image carries it as its tag and label, and a program reads it as its own version.
+  A Go package's version is its tag: this departs from ADR 0573 §2, which has a Go package's version be its trunk
+  commit, by the operator's choice of 2026-11-10, and a later research brings that record in line. How it is checked:
+  whole (Go and TypeScript build modules), a built package and program carry the reserved version.
+- §371 **Only the first watched branch releases.** Only a build of the registration's first watched branch reserves and
+  releases a version; a build of another watched branch reserves none, publishes no version and is delivered by its
+  build, its fingerprint, as every want names one. Why: the operator, 2026-11-10. How it is checked: whole (builder),
+  a `beta` build reserves nothing and is delivered.