Merge pull request 'Playbook 07: a new node-engine key needs the controller first, on a branch of its own (issue 1051)' (#411) from fix/1051-pb07-controller-first into main

00-META/process/07-feature-branches.md

@@ -62,7 +62,8 @@ never into the running one, unless it blocks the running one.
 
 ## Phase 0 — Prepare (the lead, larger model)
 
-1. **Name the feature once:** `feat/<slug>`, the same branch name in every repository it touches. The
+1. **Name the feature once:** `feat/<slug>`, the same branch name in every repository it touches (but see the
+   exception for a new manifest word in phase 3: a release that must merge first has a name of its own). The
    branch is never protected. **One milestone is one branch per repository** (the operator, 2026-10-17), with one
    folder `.work/<slug>/`; never a second name for part of it (`-2`, `-step2`).
 2. **Make the worktrees:** one per touched repository under `.work/<slug>/<repo>`, branched off `main`
@@ -169,6 +170,12 @@ never into the running one, unless it blocks the running one.
 **One exception: a catalogue change that uses a new manifest word.** The catalogue's merge check reads
 manifests with the controller the mesh runs, so the controller's pull request is merged and delivered first;
 then `mesh-delivery.recheck` the catalogue's and merge it on the new verdict. Such work is two releases, the controller's first, and playbook 04 cuts its milestones that way.
+**A new key the node-engine checks is such a word too** (issue 1051): the controller judges every machine with the
+node-engine's own validator, vendored at the commit `go.mod`'s `replace` pins, so a key added to the node-engine is
+refused by the gate until the controller's pin moves to the delivered node-engine (`go mod vendor`); the feature is
+then three releases, the node-engine's, the controller's, the catalogue's. **Every release that must merge before
+the catalogue's is on a branch name of its own** (`feat/<slug>-node-engine`, `feat/<slug>-controller`): on the
+feature's name it joins the catalogue's delivery group, and a group merges only whole, so neither merges.
 The exception ends when milestone 3 of design 47 is delivered (issue 977, ADR 0402, ADR 0403): the group's composed
 check, judged by the group's controller, is then each member's gate, and the feature is one group.