Design 57: answer the second review of hq#350

The word setting waits for R2, P3 waits for F3, the group's order is declared with after: lines, and a stop's fix is a new merge.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

03-DESIGN/01-to-be/57-building-config-and-provisioning.md

@@ -34,7 +34,8 @@ main. When the last package is merged, the whole is rehearsed in the lab: the wa
 their order, and every proof that is run live. Then each repository's branch reaches main in one pull
 request, and the five, sharing their branch's name, are one delivery group (ADR 0239 §2), judged as one
 future state. The five are merged within one merge window, so they are one batch and one walk (ADR 0276
-§1, §2), in the group's order: mesh-sdk, `mesh-host`, mesh-controller, mesh-catalog, hq (ADR 0239 §12). The release holds every package but T6, R1 and R2:
+§1, §2), in an order declared with `after:` lines in each pull request (ADR 0239 §11): mesh-sdk, then
+`mesh-host`, then mesh-controller, then mesh-catalog, then hq. The release holds every package but T6, R1 and R2:
 the media catalogue and the applications live in repositories of their own and move after it, and only
 then can the old forms be refused (R1) and the record say what runs (R2).
 
@@ -47,9 +48,9 @@ points at it.
 **What a release costs.** A proof that is run live (dunst on a workstation, a secret reaching its file, a
 database consumer connecting) is first seen in the lab rehearsal, and a fault found then holds the
 release, not one package. A walk that fails fails every commit it carries (ADR 0276 §3), so a fault on
-the release's first node holds all five; the merges walked again without one exist only after a person's
-stop, and leave out every merge that shares its modules (ADR 0299 §1, §2), which in this release is most
-of them.
+the release's first node holds all five; when mesh-delivery or a person stops a member, the others are walked
+again without it, leaving out every merge that shares its modules (ADR 0299 §1, §2), which in this
+release is most of them; the fix is a new merge into the release's branch, and the group is walked again.
 
 **Nothing breaks on the way.** ADR 0349 clause 17: each file is filled the old way or the new way, never
 both, by the form of its manifest, and the old forms stay accepted until the last module has moved.
@@ -69,8 +70,7 @@ Counted 2026-10-14 at mesh-controller `1601cb1`, the node-engine (`mesh-host`) `
 | secrets | the controller mints, seals and accepts every secret (`internal/secrets`, `inventory/secrets.go` 1 125 lines; tables `secret`, `module_secret`, `secret_ask`, `operator_key`); the vault (`mesh-vault`, TypeScript) is read-only and never asked | the vault, in Go, holding and minting; handing out on request and reply |
 | bindings | grant files and binding files composed by the controller (`declaration.go` 750–818); `${bound:}` 117 uses | each provider answers its consumers; the vault mints the pair's credential |
 | contributions | `${contribution:}` (4 collectors), `${shell:}` (3), `${environment:}` (1); 22 contributors | collections, filled by the provisioner client |
-| file text | 225 file resources in 88 modules, all inline (about 193 KB); 12 modules keep a second copy in 34 files with a test that the two agree (ADR 0349's context counted
-eleven; the twelfth is lemurs) | template files under `files/`, packed by the module's build |
+| file text | 225 file resources in 88 modules, all inline (about 193 KB); 12 modules keep a second copy in 34 files with a test that the two agree (ADR 0349's context counted eleven; the twelfth is lemurs) | template files under `files/`, packed by the module's build |
 | packing a directory | the builder's `archive` artifact packs a tree and publishes it by digest; the node-engine fetches and unpacks it | the same mechanism carries a module's templates |
 | the node-engine's file writing | `applyFile`, `applyBlock`, `applyInto`, create-once, drift written back, `Keep` backups, restart-on and reload-on, container reads | the same code, reached also through a narrow local write verb |
 | the node-engine's local verbs | one socket (`cli.sock`), peer-checked by uid, forwarding to the controller; no local write | a second, narrow socket for the provisioner client |
@@ -89,7 +89,7 @@ reuses it rather than writing as root itself.
 package   waits for                      package   waits for
 F1        —                              P1        —
 F2        —                              P2        P1
-F3        —                              P3        —
+F3        —                              P3        F3
 F4        —                              P4        P3
 T1        —                              P5        P2, P4, T1, K3
 T2        T1                             P6        P5
@@ -133,8 +133,9 @@ write. mesh-config needs both to resolve. **Proof:** a test against a real bus:
 registration each change exactly one key and raise one event.
 
 **F4 (issue 653) — The words.** *hq. Half a day.* The glossary gains *config value*, *predefined key*, *provision*
-and *provisioner client*, *collection*, and the ownership words *owned*, *seed* and *managed*; *setting*
-is named on *config value*'s *Not:* line. **Proof:** `words.py` passes and fails on a planted *settings*.
+and *provisioner client*, *collection*, and the ownership words *owned*, *seed* and *managed*. The word "setting" goes on *config
+value*'s *Not:* line only in R2, once the 67 documents still using it are reworded; until then the
+glossary says it is the older word. **Proof:** `words.py` passes.
 
 ## 1 — Template files (ADR 0349 clause 2)
 
@@ -266,7 +267,7 @@ answering the vault alone) and `rotate` become the vault's; the controller's ver
 `secret-ask` and issuing provider tests in ADR 0349.
 
 **V3 (issue 676) — The secrets move to the vault.** *mesh-controller and mesh-catalog. Two days.* Every row of
-`secret`, `module_secret`, `secret_ask` and the operator key's public half are copied into the vault as it is,
+`secret`, `module_secret`, `secret_ask` and the operator key's public half are copied into the vault as they are,
 nothing rotated, and read back through the vault before anything points at it. **Proof:** for every
 secret, the vault's sealed answer opens to the same value the controller's does.