Playbook 07: stop pinning packages by hand, per ADR 0573

The pin rules learned on 2026-10-28 made the developer order a group's
mesh-sdk by hand, which the operator ruled out. A module now builds
against each package's latest published version, a group's check builds
its members against the group's heads, and a seat's contract is its
holder's package.

00-META/process/07-feature-branches.md

@@ -154,9 +154,11 @@ issue whether it is being fixed in between, after the delivery, or waits, and on
    hours; it ran past its 30-minute bound for over an hour, and the reports could only say "still on part D".
 6. **List every part the change reaches, before any agent starts**, so each is an issue of the milestone and
    nothing is found on the way. Read, for each repository of the milestone, what it takes from the others and how:
-   the SDK's users (they pin an SDK commit, and a pin to a commit no branch holds is a download that fails later,
-   issue 1148); every program that parses a manifest strictly (search `ParseManifest` across every repository, with
-   the SDK commit each pins), which must take an SDK that knows a new manifest word (2026-10-21: design 60's
+   the users of every package the change alters, mesh-sdk and each seat's package (a seat's contract is a package its
+   holder's repository publishes, and a user takes it as a package, never as another repository's source; each user
+   builds against the latest published version, and in the group's check against the group's head, so nobody writes a
+   version or a commit for them: ADR 0573); every program that parses a manifest strictly (search `ParseManifest`
+   across every repository), which must take an SDK that knows a new manifest word (2026-10-21: design 60's
    catalog milestone found mesh-build-go and the delivery's indexer reading manifests with an SDK from before the
    word); the SDK's list of a defined seat's verbs, which must name a verb a module adds (2026-10-21: node-files' two
    new verbs were refused on the claim); the node-engine's decoder for a new key on the wire; the route by which a
@@ -319,22 +321,12 @@ issue whether it is being fixed in between, after the delivery, or waits, and on
    change in how a node composes or applies always has such a test (2026-10-28: a compiled-only group failed in the one
    check on what a local run shows). How it is checked: the pull request's description names those tests and their
    results.
-   **Reproduce the check before the push.** Before a group's one push, the lead (or the agent it names) runs locally what
-   the checker runs: `gofmt -l` over every changed Go file; the whole unit suite of every module the group changes;
-   the integration tests that exercise the change, picked by name and run against an embedded bus (the rule above), with
-   no store or bus started by hand; and each repository's tests with
-   `MESH_CHECK_BESIDE` laid out exactly as the checker's beside rules place siblings for that repository, and once with
-   it unset. Agents add files by path, never every file, so no build output is committed (2026-11-01: one release lost
-   four check rounds of about fifteen minutes each to faults a local run would have caught, a formatting line, a test
-   fixture dated outside a thirty-day window, integration tests that exercise the change only compiled, and a test reading a sibling the checker
-   does not place; the same reproduction found a real credential regression before it reached the machines). How it is
-   checked: the pull request's description names the local runs and their results; a check that fails on a fault the
-   reproduction would have caught is a finding the lead reports.
    **While a group is being checked, nothing else is merged or pushed into a repository that is one of its members:**
    a moved main asks the group's check again. How it is checked: the lead's wait list names the group's members, and
    `mesh-delivery.show` shows one check per head.
-   **A group is one check.** Before the push, every member pins the group's own mesh-sdk head exactly (the checker refuses an
-   older commit of the same branch), then all members are pushed and opened together, so the group's check runs once. A head the review replaces
+   **A group is one check.** No member names the group's mesh-sdk head, or any package's version, by hand: the group's
+   check builds every member against the group's own package heads (ADR 0573 §4). All members are pushed and opened
+   together, so the group's check runs once. A head the review replaces
    counts for nothing against a running check; say so, and ask no other until the new head is reviewed.
    **Before a session trusts an agent's "pushed", it reads the forge branch's head** (`git ls-remote origin refs/heads/<branch>`) and compares it with the commit reviewed; an agent may commit on a detached HEAD and report a push that never happened (2026-10-26: the first check of a reviewed fix failed "not our ref"). The pull request is opened only on that read head. Pull requests in two or
    more repositories that share the branch name are one delivery group (ADR 0239 §2).
@@ -414,20 +406,29 @@ issue whether it is being fixed in between, after the delivery, or waits, and on
    moved to include it): one Approve, one delivery. The old Approve ask closes itself on the new head and the new
    head is asked once its checks pass. How it is checked: a follow-up that sits in a second pull request while the
    first still waits shows in `gitea.gitea_list_pull_requests` as two open pull requests of one lead.
-6. **A member pins mesh-sdk only at a commit that is a pull request's head**, merged or open (2026-10-28: the check
-   refused a pin to a merge commit on main as "on no pull request", though its tree equalled the head's). How it is
-   checked: the check's pin step; a refusal "on no pull request" is this rule skipped.
-7. **Two groups that pin the same module's mesh-sdk conflict in `go.mod` and `go.sum`.** The group that merges
-   second merges main in and re-pins once, to a pull request head that holds both changes, after the first group
-   is merged and not before (a re-pin before makes the first group conflict). How it is checked: the check's merge
-   step; a group that conflicts after the first one merged is this rule skipped.
-8. **A group that adds a seat, a verb or a manifest field in mesh-sdk and uses it in a module's manifest in the
-   same group cannot pass its check** until the running assigner pins a mesh-sdk that defines it, because the
-   check composes with the running assigner's mesh-sdk (issue 1585). The assigner's pin ships first, as its own
-   release. How it is checked: the check's composition step; a composition refusing the new word in such a group
-   is this rule skipped.
+6. **Nobody pins a package** (ADR 0573 §2, §4). No commit writes a mesh package's version or commit into `go.mod`,
+   `go.sum` or `package-lock.json` to choose what a module builds against: every module builds against the latest
+   published version of each package it uses, a publish rebuilds every dependent (ADR 0573 §3, along ADR 0267 §3's
+   edges), and a group's check builds its members against the group's own heads. This replaces the pin rules learned on
+   2026-10-28 (a pin only at a pull request's head; two groups pinning one module's mesh-sdk re-pin after the first
+   merges): each was a step the developer ordered by hand, which the operator ruled out (2026-10-21, 2026-10-31). A
+   check that refuses a member for the version it names, an older head, a merge commit or a commit on no pull request
+   is a fault of the check: say it to the operator and fix the check under issue 1585, never
+   re-pin around it. How it is checked: the review refuses a hand-written version or commit of a mesh package; a check
+   of the checker that refuses one is to be built (issue 1585).
+7. **A seat's contract is its holder's package, and a module takes another repository's code only as a package**
+   (ADR 0573 §1). A new or changed seat's records, keys, events, verbs and message schemas go into a package its
+   holder's repository publishes (a Go module or a node package), never into mesh-sdk, which keeps only what every
+   seat shares; a user imports that package, never a path into, a copy of or a `replace` to another repository's
+   source. A change that alters a seat whose contract mesh-sdk still holds moves it to the holder's package in the same
+   change (issue 167). How it is checked: the review refuses a seat-specific type, key or verb added to mesh-sdk and an
+   import of another repository's source; no check refuses them yet (issue 1585).
+8. **A group that adds a seat, a verb or a manifest field and uses it in a module's manifest in the same group is
+   composed with the group's own mesh-sdk head** (ADR 0482 §3), so it passes in one group, with no release ahead of
+   it. How it is checked: the check's composition step; a composition that refuses the new word in such a group is a
+   fault of the check (issue 1585).
 9. **A new head on an open pull request needs its `Reviewed-by` line at that head before the Approve is asked,
-   even for a pin-only commit.** How it is checked: the Approve's ask names the review record;
+   even for a one-line commit.** How it is checked: the Approve's ask names the review record;
    an ask whose line names another commit is this rule skipped.
 
 **One exception: a catalog change that uses a new manifest word.** The catalog's merge check reads

00-META/process/playbooks.html

@@ -463,7 +463,7 @@ const P = [
  {n:"07",name:"Features",kind:"build",c:"--build",
   trig:"Work that changes code across issues or repositories, too large for a small fix.",
   who:"A lead (larger model), one fixing agent per repository (smaller), one reviewer (larger).",
-  steps:["Prepare: name the branch, make the worktrees, settle every question.","Write one context file per repository.","Write the findings and acceptance criteria into each issue.","Survey every other reader and writer of each changed value. (new)","Answer three questions in the milestone file: who deletes each new key and stream, how the switch-over is tried on one node first, what the one check does not cover. The review checks them. (new)","List every part the change reaches; copy fixtures from the real writer.","Develop: one agent per repository, one commit per issue.","A test fails first on behaviour, not on compiling. (new)","Bring each branch up to the trunk; nothing is pushed, no try runs. (new)","Review all of it, reading the integration tests against the code; at most 3 rounds; the report answers the state-and-seams and mesh-agnostic questions. (new)","A group pins the group's own mesh-sdk head in every member. (new)","Reproduce the check locally before the push: gofmt, unit suite, the integration tests that exercise the change (by name, embedded bus), MESH_CHECK_BESIDE laid out and unset. (new)","Push the reviewed heads once and read each forge head against the reviewed commit; no draft pull request, no fix round on an open one. (new)","Open one pull request per repository, together, with Reviewed-by and Pushed-by; the one check runs. A failed check is read, fixed, reviewed, pushed once more. (new)","The operator's Approve on Telegram; the group merges in one pass.","Follow the delivery in the status view (moving, settled, stuck, delivered) to done; resolve the issues; clean up. (new)","When the builder cannot deliver its own fix: revert, a build by a session's call, a registration at the terminal, copies kept outside the store; a broken controller is put back by a want the operator writes, a hand build by mesh-hand-compose and a want. (new)"],
+  steps:["Prepare: name the branch, make the worktrees, settle every question.","Write one context file per repository.","Write the findings and acceptance criteria into each issue.","Survey every other reader and writer of each changed value. (new)","Answer three questions in the milestone file: who deletes each new key and stream, how the switch-over is tried on one node first, what the one check does not cover. The review checks them. (new)","List every part the change reaches; copy fixtures from the real writer.","Develop: one agent per repository, one commit per issue.","A test fails first on behaviour, not on compiling. (new)","Bring each branch up to the trunk; nothing is pushed, no try runs. (new)","Review all of it, reading the integration tests against the code; at most 3 rounds; the report answers the state-and-seams and mesh-agnostic questions. (new)","No member pins a package: the group's check builds every member against the group's own heads (ADR 0573). (new)","Push the reviewed heads once and read each forge head against the reviewed commit; no draft pull request, no fix round on an open one. (new)","Open one pull request per repository, together, with Reviewed-by and Pushed-by; the one check runs. A failed check is read, fixed, reviewed, pushed once more. (new)","The operator's Approve on Telegram; the group merges in one pass.","Follow the delivery in the status view (moving, settled, stuck, delivered) to done; resolve the issues; clean up. (new)","When the builder cannot deliver its own fix: revert, a build by a session's call, a registration at the terminal, copies kept outside the store; a broken controller is put back by a want the operator writes, a hand build by mesh-hand-compose and a want. (new)"],
   prod:"One pull request per repository, one source revision delivered, resolved issues, no branch or worktree left.",
   next:"02 (when it ships)",bounds:"Prepare 15 min · 30 min per issue · review 15 min, ≤ 3 rounds · one check, pushed once",
   prev:["Pull requests as scratchpads","Context bought again and again","Review rounds spent on what a run would show","A node agent's bus reads, proven only by review"],