Merge pull request 'Design 47 G: the lead's answers A-353 to A-362 (G's start)' (#608) from design/47-G-lead-answers-30 into main

Reviewed-on: #608

03-DESIGN/01-to-be/47-milestones/G-22-lead-answers-2.md

@@ -3,7 +3,7 @@ layer: to-be
 status: in-progress
 design: 47
 milestone: G
-updated: 2026-11-12
+updated: 2026-11-13
 decisions:
   - "ADR 0667"
 ---
@@ -715,3 +715,34 @@ the principle that settles it, cited as "design 47 G A-n".
   runs healthy from the holder's have, also while a newer build of the bus module waits for the operator's yes: the
   running build serves the bus state, so a consumer that needs none of the new build's forms is not held; a consumer
   whose new form only the new build reads still waits for it by its edge of kind 4 (§50).
+- **A-353** (G's start, found 2026-11-13 after its merge; principles 3 and 7) While its catalog half is unread, a tool
+  runner's approval gate lets through the first-view calls the catalog half is read by (the seat mesh-catalog's
+  `registrations`, `revision` and `entry`, the seat mesh-delivery's `source`, and their owners' first-view tools) and
+  holds every other call as today, so the runner that serves the indexer's tools can answer the reads it waits on; the
+  rule lives once, in mesh-sdk's approval gate.
+- **A-354** (G's start; deb88b17 "grants keeps its read of modules until W8"; principles 3 and 7) The indexer keeps
+  serving the first view `modules` in its current form until grants reads the catalog half, so grants issues new
+  rights once G's indexer runs; the two move together in the same release as W8.
+- **A-355** (G's start; principle 5) Every G part builds from main before any is placed: the watchman's go.mod
+  requires and replaces the seats it imports (nodebuildimage, nodebuildnode), as every module's go.mod does.
+- **A-356** (G's start, the forge; principle 7) G's gitea is built by G's mesh-build-node, which is therefore delivered
+  before gitea; no lock file is kept for a mesh package that the build runtime exempts.
+- **A-357** (§47 kind 6; principles 3 and 7) A package's `calls` names every seat verb its code calls on a module's
+  behalf, in the `invokes` form (`seat:<seat>.<verb>`); mesh-sdk's Go package adds `seat:mesh-catalog.registrations`,
+  `seat:mesh-catalog.revision`, `seat:mesh-catalog.entry` and `seat:mesh-delivery.source`, and the indexer derives an
+  edge of kind 6 from such a call word against the verb's server exactly as from `invokes`, so every module built
+  against the SDK is delivered after the running versions that serve its start.
+- **A-358** (§47; principle 7) The tool runner keeps `invokes: "*"`, its role of forwarding any call; what its own start
+  needs comes to it through the SDK's `calls` (A-357), as for every module.
+- **A-359** (narrows A-353; principle 7) The catalog half is read by seat verbs alone, so the gate lets through, while
+  it is unread, exactly the calls whose seat and verb are `mesh-catalog` `registrations`, `revision` and `entry` and
+  `mesh-delivery` `source`, told from the call's seat and verb as today; no tool is marked as a first-view tool and no
+  owner is named.
+- **A-360** (completes A-354; principles 1 and 3) "Its current form" is the first view and its changes: the indexer
+  also says each change of `modules` on its views family (`mesh-delivery-indexer.views.modules`, in its `emits`) when a
+  new trunk revision changes it, so grants hears a newly merged module without asking again.
+- **A-361** (clarifies A-357, ADR 0614 §3; principle 7) "Exactly as from `invokes`" includes the cycle rule: a package's
+  seat call words count among the invokes of every module built against it when the graph leaves out the edges that lie
+  on a cycle, so a call word's edge on a cycle is left out like an invoked verb's.
+- **A-362** (completes A-353; principles 3 and 7) The seat list a runner starts with (mesh-sdk's bootstrapped list)
+  holds `mesh-delivery` beside `mesh-catalog`, so `mesh-delivery.source` is admitted before the seat list is read.