Merge pull request 'To-be 47: a busy container on the first node holds only its walk, and the wait counts (ADR 0335, issue 594)' (#349) from design/335-a-busy-container into main

03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md

@@ -5,6 +5,7 @@ code: [mesh-controller, mesh-catalog modules/mesh-delivery]
 updated: 2026-10-13
 decisions:
   - "ADR 0350"
+  - "ADR 0335"
   - "ADR 0323"
   - "ADR 0313"
   - "ADR 0306"
@@ -313,6 +314,18 @@ of walk B's send and not taken up as backlog while A is open; a group's second m
 overlapping dependents keeping two walks apart; the warning on the third set-aside; a failed apply failing every
 open judgement on its node.
 
+*A busy container on the first node (2026-10-13, ADR 0335, citing ADR 0282 §1).* A container may declare `busy`,
+a command that says whether it holds work a replacement would lose; the build agent declares it, so a merge
+into the controller's repository no longer throws away the checks in flight. When a walk's send would replace
+such a container while it says busy, the node-engine leaves it running, applies the rest, and replaces it once
+it says idle, or after 15 minutes at the latest. Only that node's walk waits: the walk says it waits for a busy
+container there, its first-node gate starts at the report that says the container replaced, and the wait is a
+phase of the delivery time of its own, never exempted from the delivery budget. A delivery it puts over budget
+is said over budget, with that wait as its longest phase. *How it is checked:* the controller's test that a
+walk whose module's container waits as busy on its first node says so and starts that node's gate only once the
+node reports it replaced, and the walk-phase test that the wait is a measured phase between the send and the
+judgement.
+
 **Who builds what.**
 
 | Part | Owner | What it adds |