# Glossary — the words of the mesh, by domain, and the ones it stopped using One name per thing. This page is the authority; where an older record says something else, that record keeps its words and this page says how to read them. It exists because the words kept drifting in conversation — "control plane", "controller" and "master" for one thing, "substrate" and "foundation" for another — and a mesh you cannot name precisely is a mesh two people describe differently. The rule and its check are ADR 0244; the domains are drawn in [to-be 49](../03-DESIGN/01-to-be/49-the-mesh-in-domains.md). ## How to read this page A **domain** is an area of the mesh that owns a set of concepts: inside it each concept has one word, and the domain decides what that word means. Other domains use the word as it is defined here and never change its meaning. Every word is defined once, in the domain that owns it; a section lists the words it uses from other domains under *Uses*, with no second definition. Two fixed lines follow an entry where they apply, and the words test in `00-META/checks/` reads them: - *Not:* followed by struck-through words — the words this entry replaced. A struck word with no scope is retired everywhere; *(hq)* retires it in this repository's prose only; *(tools)* in the descriptions of the mesh's tools and seat verbs only. A retired word may be quoted, never used. - *Identifier until renamed:* followed by a name in a code span — code that still carries an old name. It may stand in a code span and nowhere else until the code is renamed, and then the line goes. **No entry says which module holds a seat.** Which module holds or claims a seat, and on which node, is a fact of the mesh's assignments, read with one call: `mesh-module-assigner.assignments` with `seats: true` (and `node` for one machine), which today answers the seats held once for the mesh (the operator, 2026-11-09: "it shouldn't be in the glossary"). An entry defines the seat; a word for a module defines the module and says no seat it holds. The words test refuses a seat "held by" or "claimed by" a named module, a named module "holder of" a seat, and a module that "holds the seat". Nothing else on this page is struck through. A word that means different things in different domains is listed under [Homonyms](#homonyms), with the qualified form each domain uses. ## Words every domain uses - **mesh** — the whole: the nodes, the modules assigned to them, the controller that decides and the records it keeps. One mesh per operator; a second mesh is a second everything. - **domain** — an area of the mesh that owns a set of concepts and the one word for each, as described in the section above (ADR 0244); its qualified form is **mesh domain**. Bare, "domain" keeps this sense; the review's sense is always written **architectural domain** (Homonyms). ADR 0006 called seven of them the controller's *contexts*; they carry over as domains under the same names, except *observability*, which is now **Health and repair**. Where a domain's records live in the controller, the domain owns that store alone (ADR 0008). *Context* in that sense is not used in new writing; the word stays ordinary English, so this is checked by review, not by the words test. - **machine** — any computer: hardware, a virtual machine, before, during or outside its membership of the mesh. Prose about the computer itself — its disks, its kernel, the network it sits on, what was on it before the mesh — says machine. - **node** — a machine the mesh has adopted and owns. A machine becomes a node when it joins (ADR 0004), and from then on it runs the node-engine and is either **adopted** (the mesh holds what it found there as found) or **converged** (the mesh made it what it is) — ADR 0100. Prose about a member of the mesh says node. A node is just a machine that has joined; being one implies nothing about what it runs. - **module** — the unit the mesh assigns: one named thing, defined by its manifest, that a node runs — a service, a container, files, packages, its own code — and the tools it serves (ADR 0040). Everything configurable on a node is a module. - **seat** — a named role at a scope (node / site / mesh), held by a module assignment, from a **closed set** the mesh defines: a claim naming a seat outside the set is refused. A seat may **deliver a provision**, and its holder is then the mesh's answer for it when several modules provide it (ADR 0126). The set is the overview of what a mesh has ([26 — The seats](../03-DESIGN/01-to-be/26-the-seats.md)); who holds each seat is read from the mesh, as this page's head says. A seat carries **verbs** — the tools every holder must serve. A verb added to a held seat is first promised as optional, then served, then required (ADR 0246). A node seat may also name **the paths its holder owns**, such as `/etc/hosts`: a claim whose module does not declare them is refused, and only a claimant declares them (ADR 0287). - **seat definition** — the one language-neutral file (a schema with conformance fixtures) that names a seat's verbs and their messages, its events, its states and the forms of its provisions; its Go and TypeScript types are generated from it. The indexer keeps every trunk's and open pull request's as bus state (ADR 0608 §1, §2). Every seat has one, naming its domain, written by hand in its domain's contracts module, either whole or at the seat list's grain (its name, scope, verbs and provision), and every reader of the list of seats learns it from the bus, never from a compiled package (ADR 0635 §1, §2). *Not:* ~~seat-set package~~ (hq) - **seat list** — every seat's definition the mesh holds: the trunks' definitions, served by the seat `mesh-catalog`'s verb `seat-definitions` and followed by its events, which every reader learns from the bus and never from a compiled package (ADR 0635 §1, ADR 0636 §4). A reader with no list acts on nothing new (ADR 0636 §1). Inside a check it is the one list made from the change's heads, by the checking program built from them, and handed to the manifest validator and the composer (ADR 0636 §4 with its insight of 2026-11-06, ADR 0644; design 47). Not a **seat definition**, one seat's file. *Not:* ~~seat set~~ (hq) - **operator** — the person who runs the mesh, and the one the mesh talks to. *Not:* ~~master~~ (hq) - **person** — any human, as against the mesh acting unattended: *a person's word* releases a held delivery, *a person* deletes a consumer's data. The operator is one; the word says that a human, not the mesh, acted. ## Module — what a module is and declares **Purpose.** To say what one module is, in the one document every other domain reads. **Recorded in** the catalog, one manifest per module. **Upstream of** every other domain; its words are a published vocabulary, fixed by the manifest's schema and judged by the manifest validator. **Decided by** ADR 0040, 0126, 0174, 0188, 0207, 0236, 0262, 0578, 0595, 0634, 0635. **Uses:** module, seat, config value (Config), provision (Provisioning), data class (Data), health (Health and repair). - **manifest** — the file a module is defined by (`module.json`): what it is, what it provides and requires, the seats it claims, the resources it declares, its tools, its data and its health. From the delivery of design 47's milestone G it also names its artifacts and, where nothing else says it, each one's dependencies (`needs`), and never a pipeline step's status, which is the registration's policy (ADR 0666 §7, §14). Say manifest in prose, not the file's name. *Not:* ~~module definition~~ (hq) - **resource** — one thing a manifest declares a node must have, by its `type`: a `directory`, a `file`, a `service`, a `package`, a `container`, a `user`, an `archive`, a `network`, an `access`, a `process` or an `opening`; never an `action` (ADR 0005). Its fields are the node-engine's vocabulary (mesh-sdk's declaration package), which refuses a field its type does not use. A module **declares** resources; the verb *declares* is this domain's and means what a manifest states. - **process resource** — a resource of type `process`: a bundle of the module's own, named by `artifact`, fetched by digest and run by the node-engine as a unit with the command `run`, in one of three modes: one that stays up, a **run-once step** or a **scheduled run**. The way a module runs its own code without an image (ADR 0052, ADR 0053). *Not:* ~~daemon resource~~ (hq) - **run-once step** — a `process` or `container` resource with `run-once` true, run to completion by the node-engine before every resource after it, which it gates; with `restart-on` it runs again when what it names changes (ADR 0052, ADR 0099). Not a migration of the module's own state, which is `prepares` (ADR 0135). *Not:* ~~init step~~ (hq) - **scheduled run** — a `process` or `container` resource with `schedule`, a five-field cron, run again on each fire and never left running; a scheduled container may hold its own module's containers still while it runs (`while-stopped`, ADR 0053, ADR 0189). *Not:* ~~cron job~~ (hq) - **runtime of its own** — the runtime that serves the tools bundle of a module saying `runs-as`, as that module's account and on a bus account of its own, never the machine's runtime the tool runner runs as the operator's account; its readiness is the manifest's `runtime-health` (ADR 0259 §8, ADR 0366). *Not:* ~~private runtime~~ (hq) - **old section** — a manifest's `state`, `logs`, `streams` or `objects`: kept data in the form before templates. The parts the bus module needs before it can answer keep them for good; any other module's use of one is refused once no accepted module outside those parts uses it any more (ADR 0595 §11, ADR 0619 §1). New kept data is asked for in `requires` by template. *Not:* ~~legacy section~~ (hq) - **claim** — a module taking a spot on a seat: `claims: [{name, scope}]` in a manifest. A mesh-scoped exclusive claim is how the mesh says "there is one of me". A foundation seat is named after the role it guards: the `mesh-controller`, `postgres` and `nats` modules claim the `mesh-controller`, `mesh-store` and `mesh-broker` seats (ADR 0079, ADR 0116). - **kept region** — a marked block in a managed file the mesh writes *into*, where the operator's own lines survive every send and are given back when the module goes (ADR 0174). The other way a node varies a module, besides a config value; a **managed** file's marked block is one (Provisioning). - **bundle** — the artifact a module's own code is built into — its tools, a seat's implementation, a daemon — in any language the mesh has a build module for (Go and TypeScript); never an image. A **tools bundle** speaks MCP to the tool runner. One module may declare several (ADR 0188). - **tool** — one capability a module serves through the tool runner, addressed `.`. A seat's **verb** is the same thing carried by a seat rather than a module. - **mesh-sdk** — the library a module's own code is written against, including the SDK harness that serves a tools bundle to the tool runner. The SDK harness is part of it, not a library of its own. It keeps the runtime every module uses, and what modules or seats of more than one domain share; its seat contracts and the logic it held over seats move into the contracts modules, what one domain's modules share into its domain SDK, and what one module owns into that module's own package. It imports no contracts module and reads the seat list from the bus (ADR 0608 §5, ADR 0625 §9, ADR 0634 §1, §4, §5, ADR 0635 §1, §4). *Not:* ~~tools-sdk~~ - **contracts module** — a module whose work is to publish the contract packages of seats (their verbs, events, the layouts of their states, their messages), one per seat defined whole and per language, with the definitions of its seats at every grain and the seats' client packages; every file but a definition's, a fixture's and a client's is generated. `mesh-contracts` for the Core domain's seats, `mesh-config` and every domain that has none yet, `mesh--contracts` for a domain's, named after its heading on this page; a seat defined outside the mesh's own contracts has one of its own. A package-only module found by its manifest, at a repository's root or in a folder. A seat's holder implements the contract; the contracts module holds no seat (ADR 0608 §5, ADR 0625 §1, §5 to §7, ADR 0634 §7, §8, ADR 0635 §2). *Not:* ~~SDK module~~, ~~domain package~~ - **client package** — the one hand-written package a seat may carry beside its contract, in the seat's contracts module and never in a holder: the logic two or more callers or holders would otherwise each write over that seat. It uses only its own seat's contract, mesh-sdk's runtime and its own domain SDK, never another seat's client, and names no holder, no module's tool and no module's subject (ADR 0625 §4, ADR 0627 §1, §3, ADR 0634 §2). Bare "client" only where the sense is plain (see [Homonyms](#homonyms)). - **domain SDK** — a package-only module, `mesh--sdk`, named after a domain's heading on this page, holding the logic and forms that one domain's modules and seats share and that no seat carries and no one module owns (`mesh-delivery-sdk` the first). Its importers are its domain's modules and the holders and callers of its domain's seats; it imports only mesh-sdk and contract packages, names no module's tool or subject, and holds no seat's type or state layout and no state layout one module owns. Not a contracts module, and not mesh-sdk, which keeps what more than one domain uses (ADR 0634 §1, §2, §8). *Not:* ~~domain library~~ (hq) - **contracts marker** — the field `generated-from` of a contracts module's package artifact, naming the directory of the seat definitions its files are generated from; the manifest validator refuses a module carrying it that claims a seat, and the build modules' test step regenerates and compares every module carrying it (design 26). - **package series** — the first two numbers of a package's versions (`0.1`), declared in its manifest and raised only by a reviewed change, for a change that breaks its users; a user's manifest names the package series it accepts (ADR 0606 §4, ADR 0609 §1). Bare "series" only where the package is plain (see [Homonyms](#homonyms)). - **invokes** — the manifest word for the tools a module calls, `.` each or `*` for every one. A grant on the publish side and nothing else; a module that declares none calls nothing. - **run for** — an assignment, or a start of a module, that serves one agent identity with that identity's machine account, home and bus password. Only a module whose manifest declares it may be run for an identity; running for the operator is the default run, as the operator account, with no setting (ADR 0412). - **upgrade policy** — how a module's new builds reach its nodes: `roll` (one node first, judged, then the rest), `together`, or `record` (register the build, send it nowhere) (ADR 0236). The controller's verb `upgrade` shows it until the lease write; from L5's delivery the seat `mesh-wants` answers it too, as `mesh-wants.upgrade`; a person's choice is kept in that seat's state, and the bus is never rolled (ADR 0565 §7). ## Config — the values someone may change **Purpose.** To hold, check and resolve every value a module reads that someone may change, and to say where each resolved value came from. **Recorded by** the `mesh-config` module, in its buckets on the bus, with its store as the history behind them. **Upstream of** Provisioning, which places the values; downstream of Module and Core. **Decided by** ADR 0262, 0277, 0348. **Uses:** module, node, manifest (Module), assignment (Core), provision (Provisioning), proposal (Operator and conversation). - **template file** — a file a module ships with placeholders, such as `${config:}`, which the provisioner client fills on each node (ADR 0349). Never a template of bus state (see [Homonyms](#homonyms)). - **config value** — anything a module reads that someone may change: a font size, a domain, an address. A module declares every one it reads under `config` in its manifest, with a type, a description, validation, whether it is trusted, optionally the predefined key it falls back to, and a default or `required`; it lands in a template file as `${config:}` or is read by the module's code at runtime. It resolves from four sources, the most specific winning: the default in the manifest; **mesh config**, the value of the predefined key it falls back to for the whole mesh; **node config**, that key's value on one node; and **module-assignment config**, the module's own value on one node. There is no module value for the whole mesh. *Config* is the concept, the verb (`config`) and the manifest field (ADR 0348). Mesh config is a source level, the value set for the whole mesh; `mesh-config` is the module that keeps every level. The controller holds, mirrors and resolves no config value (ADR 0348 §9). Older records and documents say "setting" for a config value and "settings" for the concept; new writing says config value and config. The word goes on this entry's *Not:* line once the documents in force that still use it in running prose are reworded, which is issue 683; until then it is checked by review. The manifest field and the verb "settings" are kept as aliases until every module has moved (ADR 0348 §1, issue 630), and are named on the line below with the rest once issue 683 is done. *Identifier until renamed:* `takes-settings`, `${setting:}` — manifest forms kept as aliases until every module has moved to their config names (ADR 0348 §1, issue 630). What a "flavor" once varied is a config value or a separate module. *Not:* ~~flavor~~ - **rename window** — the time a renamed config value is read under both its names: from the merge of its `renamed-from` until every node-engine whose node has a want of the module reports applied a build reading the new name, away nodes included; mesh-config answers both names meanwhile, and its seat verb `renames` says each window's nodes (ADR 0609 §4, design 32 § 8). - **retiring value** — a config value or secret no manifest on any trunk reads any more and no node-engine runs a build reading; mesh-config asks the operator once whether to remove it, and removes it only on the Approve, a secret through the vault's `retire` (design 32 § 8). Not the provision sense of **retire** (Provisioning). - **config candidate** — the config declarations a pull request's head adds or changes against the trunk's manifests, kept by the indexer per open pull request in its state `config-candidates`; mesh-config judges it again for the values proposed for that pull request (ADR 0565 §2, §3). - **predefined key** — a key of the catalog's `predefined.json`, the fixed list of keys for which mesh config and node config hold values, each with its type, description, validation and whether it is trusted, such as `font-size`. A config value may name the predefined key it falls back to, of its own type; one that names none resolves from its default and the module's own value only. The list is the catalog build's: a change to it is validated with every manifest naming a key, and removing a key still named or still holding a value is refused (ADR 0348). - **trusted** — said of a config value that decides what runs or who can reach what. At every level it is set only at the controller's terminal or through `config` with propose, on the operator's Approve; a module value that falls back to a trusted predefined key is itself trusted (ADR 0277, ADR 0348 §8). Not the trusted sender of an operator message (see [Homonyms](#homonyms)). - **preference** — a config value whose manifest gives it a default, because its value is true of the software and only tuned per node: a font size, a width (ADR 0262). A config value with no default is `required`: the operator's own value, such as a domain or an identity, and while nothing sets it the module's files are not written (ADR 0348). *Not:* ~~tunable~~ (hq) - **`mesh-config`** — the module that owns every config value, and not the source level mesh config: it validates, takes a trusted value only from the controller's terminal or the operator's Approve, keeps the history with who set it and why, and resolves the four sources (ADR 0348). ## Core — the mesh's own machinery **Purpose.** To keep the controller, the bus, the store and every node's engine running and agreed, so every other domain has something to run on; and to decide and apply what each node runs, and say why: module assignment, which was the Placement domain until ADR 0641 §1 retired it into this one. **Recorded by** the controller and the store; for module assignment, by the seat `mesh-module-assigner`, in its states on the bus (ADR 0567). **Upstream of** every domain but Module; the others use the bus and the store as they are. **Decided by** ADR 0005, 0006, 0067, 0100, 0106, 0126, 0141, 0175, 0176, 0181, 0207, 0221, 0227, 0229, 0252, 0261, 0289, 0411, 0539, 0549, 0559, 0565, 0567, 0571, 0634, 0641, 0664, 0668. **Uses:** node, machine, module, seat, manifest (Module), config value (Config), proposal (Operator and conversation). - **controller** — the component that decides what each node should be, holds the mesh's records, and tells nodes over the bus. The relationship is *controller and nodes*, and no node is subordinate: a node applies its declaration on its own and survives the control-node dying. *Not:* ~~control plane~~, ~~slave~~ (hq), ~~mesh-control~~ (hq) - **mesh-controller** — the module that runs the controller. It claims the `mesh-controller` seat at mesh scope, which is what makes it singular. - **control-node** — the one node that also holds the `mesh-controller` seat. There is exactly one per mesh. It is not a separate kind of node — it is a node that additionally runs the controller (and, today, the foundation). Lose it and the other nodes keep running what they were last told; they simply cannot be told anything new. - **node-engine** — the program on every node that applies what its node should run: from release 6 of ADR 0429 its node agent follows the node's wants and the compositions the controller signs for it, one module at a time (ADR 0539); until then it received the node's whole declaration. It writes the files, runs the services and containers, and says what it runs in its haves. It is the engine, not a module: it owns no file's content, and every file it writes belongs to the module that declared it. *Agent* is avoided because that word means a coding agent here. A record written before the rename keeps the old name. "The host" is retired in this repository's prose only: in the tools' descriptions it is also an SSH server's or a container runtime's own word, so a description that means the node-engine by it is found by review. *Not:* ~~host agent~~, ~~the host~~ (hq), ~~node host~~ *Identifier until renamed:* `mesh-host` — the repository, its binary and its service unit; the rename is [issue 354](../04-ISSUES/354-a-decided-rename-was-never-scheduled-and-the-operator-believed-it-live/00-report.md) - **tool runner** — the one program on each node that loads every assigned module's tools bundle and serves every tool and every held seat's verb on the subjects the memberships issue; the node-engine supervises it as a process beside the services it runs, never a container (ADR 0175, which called it "node tools"). Its mode on loopback is the mesh MCP server. *Not:* ~~node tools~~, ~~tool runtime~~ (hq) *Identifier until renamed:* `node-tools` — the module, its unit and its bus account; the rename is [issue 354](../04-ISSUES/354-a-decided-rename-was-never-scheduled-and-the-operator-believed-it-live/00-report.md) - **foundation** — the store and the bus, raised at genesis before any module system exists. The foundation is not a third thing beside the store and the bus — it *is* those two, named together. *Not:* ~~substrate~~ - **genesis** — raising the foundation and the controller on an empty mesh, by the one installation done by hand (ADR 0067). - **store** — the one postgres server. It holds the controller's own databases (`inventory`, `identity`, `licences`, each owned by one domain, ADR 0008) and every module's own database. One server, many databases — never one shared mesh database. Bare *store* means this and nothing else (see [Homonyms](#homonyms)). - **bus** — the mesh's own nervous system: NATS, one per mesh, carrying every link the mesh has — control, declarations, builds, events, tool calls (ADR 0106). A module reaches it by requiring `mesh-bus` (ADR 0128); one that does not require it has no account on it. Held by the `mesh-broker` seat, which is named after the role rather than the server, so the server can change without the seat doing so. The **bus module** is the module holding `mesh-broker`; it also provides bus state (Data, ADR 0595). - **transport fault** — a failure of a call or a step because the part it asks did not answer for a moment, not because of what it asked: a name lookup that timed out; a connection refused, reset or unreachable; a seat verb answered with no responders while a holder of that seat is named in the assignments (ADR 0664 §1); and, for a call, its own deadline passing (ADR 0668 §1). A build or check step that meets one is given again by the bus, at most three runs (ADR 0664 §1, §2); a kept call is called again. A fault in what was asked (a compile error, an unknown revision, a seat no holder is named for) is not one, and ends the step or the call at once. *Not:* ~~transient error~~ (hq), ~~network blip~~ (hq) - **kept call** — a call one part makes to another part's verb or tool whose answer it keeps and acts on, and which the caller marks safe to repeat when it makes it; only a read, or a write the callee takes once by a key, may be marked (ADR 0668 §1, §2). The caller calls it again through every transport fault until it is answered or the caller stops; still unanswered after five minutes, it writes the finding `call-unanswered` into its own findings state, naming the callee, the verb and since when, and none while the callee's machine is away (§3); and it calls again on the callee's event saying its answer changed (§4). mesh-sdk carries its form (§7). A call not marked is made once and its fault said. *Not:* ~~retried call~~ (hq) - **waiting call** — a module's call of a marked verb that the verb's holder keeps whole, with the caller the bus proved and its ask, until the operator's answer: on the Approve the holder runs it once, and it says the call's end (ran, declined, expired or refused) on its seat's event `gated-ended` to that caller alone (ADR 0676 §2, §3). The caller calls once and may not mark it safe to repeat; only its wait for the end is kept. Unlike a kept call, it is never called again. *Not:* ~~gated call~~ (hq) - **the deprecated broker** — the lavinmq module. It was the mesh's bus and is not any more. It keeps running as an **ordinary provider** of the `amqp` provision, for modules that need a message broker of their own the way something needs a database (ADR 0131) — it claims no seat, is not foundation, is never raised at genesis, and a mesh that never installs it is complete. Say *the deprecated broker*, not *the compatibility broker* (it serves the mesh's own modules, not only the predecessor's) and not *the AMQP broker* (naming it after a protocol invites describing the bus by contrast with it, which is backwards). - **layer** — one of the four levels the mesh is built in, from the bottom: the node-engine, the foundation, the controller, the surfaces. The records' `topic: the tiers` and `repos.md` say *tier* for this; new prose says layer (see [Homonyms](#homonyms)). - **lease** and **epoch** — which controller may send (the lease, held in the bus and renewed), and the order of what it sent (the epoch, which a node reads before it accepts a declaration) (ADR 0229). - **record mirror** — a key-value bucket on the bus that the controller writes from one kind of its records (nodes, settings, declared config, predefined keys), after each change commits in its store and only when the value differs, with one event per write. The store stays the record; the self-check compares the two and raises `mirror-drifted` on any difference (ADR 0289, ADR 0356). Builds, rollouts and assignments are no mirrors: they are the chain, kept on the bus as their only source (ADR 0408). Shortened to *mirror* where the text is about the controller's records; the builder's *mirrored* `upstream` image (Delivery) is a different thing, a copy of an outside image in the artifact store. - **assignment** — a module put on a node. Its config values on that node (module-assignment config, Config) are `mesh-config`'s, never part of what the controller records (ADR 0348 §9). - **placement** — which module runs on which node, with its pins, host ports and bindings, and what a person decided of the node, as one key per node in the state `placement` of the seat `mesh-module-assigner`. It changes only by a placement proposal the operator approves, and no repository holds it or names a node (ADR 0567). From the delivery of design 47's milestone G it names, per module, the **watched branch** its node runs, by default the registration's first, and may name an earlier build to return to, one value (ADR 0666 §6, §24). Until ADR 0547's third milestone the controller's assignments are kept equal to it by the holder. *Not:* ~~placement file~~ (hq) - **mesh-module-assigner** — the seat, held once for the mesh, that keeps placement: its states `placement`, `proposals` and `candidates`, and its seven verbs `placement`, `proposals`, `propose`, `withdraw`, `again`, `adopt` and `hand-back`. Only the holder writes its states (ADR 0567, renamed by ADR 0634 §9). Its contract is in `mesh-contracts`, module assignment being of this domain (ADR 0641 §1). *Not:* ~~mesh-placement~~ - **seat holders** — the state `seat-holders` of the seat `mesh-module-assigner`, written by its holder: one key per seat naming each holder and its node, composed from placement and the manifests' claims as the indexer holds them, and rewritten only when a key differs. The tool runner and every other reader of who holds a seat read it there, never the controller (ADR 0571 §6, §7); a person or a session reads it with `mesh-module-assigner.assignments` and `seats: true`. - **placement proposal** — a change to placement put forward through the verb `propose`: the changes, the revision of each key they were laid over, the nodes' answers, the verdict and the ask. It takes effect only on the operator's Approve, and is discarded if declined, expired or withdrawn. A kind of *proposal* (Operator and conversation). - **placement candidate** — one node's placement as a placement proposal lays it, kept in the state `candidates` of the seat `mesh-module-assigner` under `.` while the proposal is open. The node composes it in **shadow** (composed and compared, never applied) and answers in its own have whether what it would run is the same; the verdict fails only on a refusal or a node that has not answered (ADR 0567). Not the indexer's candidates of a group, which are fingerprints (Delivery). - **hand-back** — the operator's verb `hand-back` of the seat `mesh-module-assigner`, answered until the lease write: it deletes every placement key, and every node returns to the compositions the controller sends. A hand act (ADR 0567). - **pending assignment** — an assignment of a module whose build is still running, kept, and made by the controller when that build registers the module, or ended with why when it does not (ADR 0261). - **scope** — where a seat or a claim holds: `node`, `site` or `mesh`. `node` is also the scope's value in a manifest. - **capacity** — how many holders a seat takes. A capacity-1 seat is exclusive. A higher-capacity seat is a **bench**: several holders coexist. A **replicated** bench has one holder per node, each on record and each answering the same, like `mesh-dns-resolver` (ADR 0223). A **kinded** bench has holders that are different modules, each claiming one **kind**, and a verb's subject carries the kind; `channel` and `intake` are the only ones (ADR 0234). - **installed / holding** — a module may be assigned (its package installed, its files placed) without holding the seat its family declares; *holding* is being the one — the login shell, the display session — on that node (ADR 0176). The module that holds a seat is its **holder**. - **depends on a seat** — a module needing a seat held on its node by some module, without holding it. Derived from the resources it declares, never stated: a `service` depends on `node-service-manager`, a `package` on `node-package-manager`, a `container` on `node-container-runtime` (ADR 0207). Not a claim: a module claims a seat it holds and declares resources. - **declaration** — every resource of every module assigned to one node, composed, which the controller sent that node until release 6 of ADR 0429. From release 6 nothing is sent: what a node applies is its compositions, and the node-engine keeps the declaration it applied last only as what it starts from, its **last declaration** (ADR 0539 §9). The switch's own last declaration carries the operator's public key (ADR 0539 §3, §11). The noun is this domain's; what a manifest says is that it *declares* (Module), and a manifest is never called a declaration. The controller's verb `plan` previewed a node's declaration until release 6. - **composition** — one module's resources composed for one node at one fingerprint, signed by the controller (or, made by hand with `mesh-hand-compose`, by the operator), written by the controller as `..` in that node's bucket `composed-`, which only that node reads; the node's own resources (adoption, firewall openings, accounts, the resolver, identities and groups) are its node composition `.node`. Its digest, with the controller's judgement of the move from what the node runs now, is kept under the same key in `mesh-controller_composed`; a want names that digest. Derived state, kept while its fingerprint is among the module's five newest or a want names it, and no link of the chain (ADR 0539 §1 to §4). From release 6. Not the composition of `mesh-delivery-sdk`, the function that composes it (see [Homonyms](#homonyms)), nor the **composition check** (Delivery). - **send** — the controller giving a node its declaration, until release 6 of ADR 0429. The controller's verb `push` asked for a send (of one node, or of every node); prose says send. From release 6 nothing is sent: the controller writes compositions and the assigner writes wants, and every act that sent writes compositions instead (ADR 0539 §5). A git push and a phone's push notification are other things (see [Homonyms](#homonyms)). - **apply** — the node-engine making its node match what it should run. From release 6 of ADR 0429 its node agent applies one module at a time, the composition whose digest the module's want names, only when the want's fingerprint or digest differs from what runs, and removes only that module's own resources (ADR 0539 §9); until then it applied the node's whole declaration. **reconcile** is doing so again until nothing differs; from release 6 a failed apply is retried by the next change of the want or the composition, never by a clock. - **operator account** — the machine account of the operator's person identity on a node, read from the identity and no longer stated on the node record; empty for a node nobody logs into. Everything the mesh places under a person's home is resolved against this account's home and owned by it (ADR 0181, ADR 0411). Not a name a manifest carries. - **agent account** — the machine account of the agent identity the identity seat marks as a node's agent account, on the operator's Approve, never by an assignment or a config value. Where none is marked, agents run as the operator account. It cannot become root without a person, and the node-engine judges that on every look (ADR 0266, ADR 0411). - **account group** — a group of the machine's group database that a module puts an account in, by declaring the account with that group and nothing else of it. Several modules may each add one to the same account; the mesh takes back only an account group it added (ADR 0252). Never *membership*, which is the bus's word. ## Provisioning — one module serving another **Purpose.** To resolve which module serves a provision for which consumer, to wire the two, and to place every value a module needs into its files on its node. **Recorded by** the controller and `mesh-provisioner`. **Upstream of** Data; downstream of Module, Core, Config and Identity. **Decided by** ADR 0027, 0084, 0138, 0225, 0230, 0263, 0349. **Uses:** module, seat, node-engine (Core), declaration (Core), config value (Config), credential and vault (Identity and access). - **provision** — a service one module `provides` and others `require`; the mesh resolves a provider and wires the two with an endpoint and a credential. A provision is a service you offer, a seat is a role you occupy, and the two meet where a seat delivers a provision: occupying the seat is what makes a module *the* provider of it. Every value a module needs is a provision from the domain that owns it: placement from the controller, config values from `mesh-config`, shared secrets from the vault, a consumer's values from the module providing it, an item of a collection from its contributor. A module says only what it needs and where it lands (ADR 0349). - **provider** and **consumer** — the module that provides a provision, and the module that requires it. Which of several providers serves a consumer is resolved (ADR 0084). - **pin** — a person's choice of provider for a consumer, which resolution then respects. - **endpoint** — where a consumer reaches its provider; an assignment binds it and says how far it reaches (ADR 0138). - **retire** — a provider stops serving a consumer the mesh no longer asks for; what it kept is deleted only by a person (ADR 0230). - **share** — a folder one node offers to the mesh's other nodes over the private network: the provision `nfs-share`, provided by the holder of the node seat `node-nfs-server`, one share per folder (ADR 0263). A share may also be granted to the machine's local network (ADR 0341). An **SMB share** is a folder the holder of the node seat `node-smb-server` serves to devices on the local network, and is not a provision (ADR 0341). - **mount** — a share, or an occasional source, made visible at a path on one node by the holder of the node seat `node-mounts`, as a mount unit and an automount unit, mounted on access (ADR 0263). - **occasional source** — a share on a device that is not a node and comes and goes, such as a USB disk; its absence is a state, *not present*, never a fault (ADR 0263). - **mesh-provisioner** — the module that places provisions on the nodes, keeping which domain answers which kind of placeholder, what each module on each node needs, what is applied where and the items of every collection; its part on each node is its provisioner client (ADR 0349). The role's seats are `mesh-provisioner`, held once for the mesh, and the node seat `node-provisioner`; who holds them is read as this page's head says. - **provisioner client** — mesh-provisioner's part on one node. For each module there it reads the placeholders of its template files, records the needs, watches each owner's values for the node, fills a template only once every value is there, has the node-engine write the file through a narrow local verb, makes the program take the change as the file declares (`restart-on`, `reload-on`, `read-on-use`), and reports `prov.applied`. It runs as a service with a bus account of its own, never in the tool runner (ADR 0349). - **collection** — a provision with many providers. The **collector**, a module that takes additions from others (a shell's snippets, a bar's blocks), requires it; each **contributor** ships its **item** as a template in its own repository and provides it. The provisioner client fills the collector's template from the items of the contributors placed on its node, and an item goes when its contributor leaves the node (ADR 0349). - **owned** — a placed file that is the mesh's whole: the provisioner writes it back whenever it differs. It is one of three answers a manifest gives for each file it places (`owner-at-runtime`): **owned**, **seed** or **managed**. Whichever it is, the file has one writer: the node-engine writes it only on the provisioner client's word (ADR 0349). - **seed** — a placed file the provisioner writes once; from then on it is the program's. - **managed** — a placed file of which only its named keys or a marked block (a kept region, Module) are the mesh's; the program keeps the rest. ## Identity and access — who may do what **Purpose.** To issue, hold, rotate and check the credentials and grants by which modules, nodes, agents and the operator act. **Recorded by** the controller's `identity` and `licences` databases and the vault. **Upstream of** Provisioning, Delivery, and Operator and conversation. **Decided by** ADR 0085, 0113, 0183, 0225, 0234, 0386, 0387, 0388, 0411, 0413, 0414, 0550, 0571, 0587, 0634, 0636, 0656, 0660. **Uses:** module, node, seat, tool (Module), operator, consumer and provision (Provisioning), agent and ask (Operator and conversation). - **credential** — anything that proves an identity: a password, a key, a token. A **pair credential** is the two ends of one credential, the consumer's and the provider's. - **secret** — a credential or other value the vault keeps sealed and the node-engine unseals into a file at apply (ADR 0085). - **secret service** — a node's store of a person's secrets that the programs of a desktop session ask, the node seat `node-secret-service`, of this domain. - **mesh-node-enroller** — the seat, held once for the mesh, through which a new machine joins: a one-time token issued on the operator's Approve, redeemed once by the machine's node-engine, the node's account minted and signed by the vault (ADR 0587 §1, renamed by ADR 0634 §9). Only the seat's name changed; no module was renamed with it. Its contract is in `mesh-identity-and-access-contracts` (ADR 0634 §7). - **secret family** — a module's own secrets declared as one name ending in `-*`; each member is the prefix and a name (`smb-password-`, one per source the module's config values name), given by its full name and never made by the mesh (ADR 0283). - **vault** — the module that owns every secret (`mesh-vault`, [24 — The secrets vault](../03-DESIGN/01-to-be/24-the-secrets-vault.md)): the mesh's signing key, with which it signs on request, licence grants and tokens, bus account passwords and module secrets (ADR 0550). - **identity** — a person, an agent or a module as the mesh knows it: a name, a kind, a role, and whether it is switched on; a person or an agent also has a login name, the machines it is present on and, for a person, the login kept on a machine where it differs. Every identity and role is held by the identity seat, in the bus's key-value store, and changes only through its verbs (ADR 0386, ADR 0411). Each person and agent identity has a bus account of its own, carrying its role (ADR 0413). - **machine account** — an identity's login on one machine, made by the mesh from the identity: the controller composes it and the node-engine applies it, adopting a login that exists and never renaming or deleting one (ADR 0411). - **role** — what an identity may call, as a set of grants (ADR 0386). Not a seat: a bare *role* is a homonym (see [Homonyms](#homonyms)). - **grant** — one line of a role: an effect everywhere, an effect on one seat, or one named tool, and may be limited to named machines; a dangerous tool is granted only by name (ADR 0386). A module's role is made from what its manifest declares it calls (ADR 0386 §4). - **effect** — a tool's mark, set by its module in its manifest: **reads**, **acts** or **dangerous**; a tool served without one counts as dangerous (ADR 0387). - **break-glass agent** — the one agent that holds every tool and never asks: sealed until the operator, or a condition the operator named, opens it, open until the operator closes it, and every act it takes told at once (ADR 0387). - **signed login** — a bus login signed by a key the bus trusts, carrying its expiry, which the bus checks by its signature instead of reading a list (ADR 0388). The identity seat signs with one **signing key** per role. - **root key** — the key at the top of the signed logins, which vouches for the signing keys: sealed in the vault and used only to replace them, on the operator's Approve (ADR 0388). - **bus account** and **membership** — a module's or a node's account on the bus, and the subjects it is issued. The bus server calls its accounts *users*; the mesh says bus account. Each module's membership is kept in the grants part's state `memberships` (seat `mesh-grants`), one key `.` written only when it differs, and the runtime reads its membership there (ADR 0571 §10). - **mesh-grants** — the seat, held once for the mesh, that composes who may say what on the bus: each module's membership, the bus's user list and `grants..`, applying mesh-sdk's `SeatsToPassOn` for a seat's pass (ADR 0660 §3). From research 085's milestone it is defined whole in `mesh-identity-and-access-contracts`, this domain's contracts module (ADR 0636 §5), as an acting part of the step `grant` (ADR 0656 §1), with the events `wait-held` and `wait-ended` (design 47). - **rotate** — replacing a credential without a consumer holding one the provider does not know. - **licence** — a model-access account the licence manager holds and **binds** to a consumer, the coding agent on a node (ADR 0183). Taking a consumer off a licence is **unbinding** it; the licence manager's verb for it is still `release`, an identifier to rename. - **room** of a licence — how much of its vendor's usage windows is still unused: 100 less the higher of its session window's (five hours) and weekly window's percentage in its latest reading, known only for a subscription read recently and healthy. The licence manager moves every consumer off a licence at its threshold to the one with the most room (design 39 bus-and-switch §25, §26). *Not:* ~~headroom~~ - **proof** — what an authorising answer carries: a verified sender, a one-time code, a security key's touch (ADR 0234). How much proof a kind of ask needs is its **assurance level**. - **controller's terminal** — a command line the controller runs as typed by its operator, not asked through a verb, so a change that is the terminal's alone is taken (issue 339, issue 340) — or, since ADR 0277, proposed through a verb and set on the operator's warrant. In the controller's code it is a line run without `MESH_VERB`. The operator reaches it with `mesh-cli` from their own account on a node where no agent can run as that account: the control-node, and a node whose agents run under an account of their own (ADR 0272). ## Delivery — a commit on its way to the nodes **Purpose.** To take one commit from its pull request to every node that should run it, and to put it back when it fails. The domain is continuous integration and delivery, named **delivery**, and its parts live in the repository `mesh-delivery` (ADR 0429 §2). **Recorded by** the `mesh-delivery` module (deliveries) and the controller (the planner, the rollout) until release 6 of ADR 0429; from each release on, by the parts it builds. **Downstream of** Module, Core, Health and repair and Data. **Decided by** ADR 0162, 0218, 0236, 0237, 0238, 0239, 0250, 0267, 0270, 0276, 0323, 0401–0408, 0428, 0429, 0444–0447, 0524–0530, 0539, 0548, 0551, 0571, 0578, 0579, 0593, 0601, 0641, 0644, 0656, 0659, 0666, 0667. **Uses:** module, node, declaration and send (Core), health (Health and repair), person. - **pipeline** — the pipeline steps run for one commit, or one group, of a module on one of its watched branches, by the seat `mesh-pipeline-runner`, before the commit is delivered (ADR 0666 §1, §7): each step asked of the seat that serves it, its end heard as an event, the pipeline's end said as `pipeline-ended` with every step's result, from which alone the assigner writes a want. From the delivery of design 47's milestone G. Not a **delivery**, the commit on its way; and *check* is no longer the word for a bundle of steps (research 086). - **pipeline step** — one action run on a module's commit before it is delivered: lint, unit tests, integration tests, composition, code review or approval (ADR 0666 §7). Its outcome is `passed`, `failed`, `nothing to run`, `bypassed`, `carried`, `could not run`, `accepted`, `superseded` or `cancelled`, or it waits on a person (design 47). Always written whole here, never *step* alone: see [Homonyms](#homonyms). - **policy** — a module's statuses of its pipeline steps, per artifact: `required` (runs, holds the delivery until it passes), `optional` (runs, a failure shown and holding nothing) or `bypass` (nothing runs), kept in its registration and never in a manifest (ADR 0666 §7). Not the **upgrade policy** (Module), how a module's builds reach its nodes (see [Homonyms](#homonyms)). - **registration** — a module's entry in the catalog: its git origin, the path of its manifest, its watched branches and its policy, kept by the seat `mesh-catalog`, every version with who changed it and on whose Approve; registering and changing one are trusted acts (ADR 0666 §2). The mesh knows modules, and a repository only as a module's git origin. - **watched branch** — a branch a module's registration names, whose commits start that module's pipeline and which a placement may choose for a node; registering one the forge does not protect is refused (ADR 0666 §3, §6). - **run on request** — a pipeline run for a named commit or group that delivers nothing, asked by the runner's verb `run`; the indexer builds its candidate from the runner's `run-started` (ADR 0666 §18). - **artifact reference** — an artifact written `:`, such as `mesh-grants:program`: the end of a dependency edge of the catalog graph (ADR 0666 §14). - **mesh-pipeline-runner** — the seat, held once for the mesh, that runs each pipeline: it reads the policy from the registrations, asks each pipeline step of the seat that serves it, says each step's start and end and each pipeline's end as its events, keeps each pipeline's state and step log on the bus, and serves the run on request (ADR 0666 §7, §11). An acting part of the step `pipeline` (design 47). Of this domain: its contract is in `mesh-delivery-contracts`. - **mesh-delivery-view** — the seat, held once for the mesh, of the status view's role (ADR 0540 §1): it serves no verb and declares one state, `answers`, the person's answers in the web view to the asks of `mesh-wants` that need no proof of who answered, offered as a view, so the teller follows it by the seat (design 47 G §717). The four events of ADR 0540 §1 are its holder's own. Of this domain: its contract is in `mesh-delivery-contracts`. *Not:* ~~status seat~~ (hq) - **mesh-builds** — the seat, held once for the mesh, whose holder numbers a package's version when it is published and says the publication as its event `package-published`, on which every artifact built against the package is rebuilt and its pipeline started (ADR 0666 §15; design 51). Of this domain: its contract is in `mesh-delivery-contracts`. - **composition step** — the pipeline step that composes each machine's declaration with a change, by the composer built from its heads in the sandbox, refusing a change in which two modules own one path; served by the seat `mesh-wants` (ADR 0666 §17). From milestone G's delivery it replaces the **composition check**. - **merge check** — what a pull request carries before it may merge, judging the merge of its head into a named **trunk commit**, made in a clone of its own on a build node and never pushed (ADR 0323). One status, `mesh/check`, written by the checker: the change's tests, run by the language's build module, and the **composition check**; for a delivery group, one verdict on every member's head (ADR 0445, ADR 0447). Before release 4 of ADR 0429 a pull request carried two statuses, one for the modules the change touches and one for the repository's own script (ADR 0238). Goes at the delivery of design 47's milestone G, the **pipeline** in its place (ADR 0666 §17); the word goes to the *pipeline* entry's *Not:* line with the as-is update after that delivery. - **catalog graph** — the modules as their manifests declare them at one revision (bases, packages, provides and requires, invokes and serves), with the acting rules the seats declare; the indexer keeps it, one revision per source revision it takes in (ADR 0656). Its other name is **module graph**, the word for it before ADR 0656, from which each delivery part orders a source revision by its own rule: provisions, bus state, a served verb and a reader's capability are waited on; a package, and until research 085's milestone a build module's change, are triggers that rebuild, never waits; a verb edge on a cycle is left out (ADR 0603 §1, §2, ADR 0614); from research 085's milestone an acting part's edge is a wait within its step (ADR 0656). From milestone G's delivery it is kept once per **watched branch**, and its edges run between **artifact references**, of six kinds, the reverse order holding when something goes away (ADR 0666 §6, §14). Nothing stores the order. Only the indexer reads the manifests; every other part reads the catalog graph (the operator, 2026-11-11; design 47 G §442). Not the **assignment graph**, computed from it. *Not:* ~~build graph~~ - **assignment graph** — the module versions placed on nodes at one revision, with the edges between versions that its inputs give: provisioning, contribution, and the acting parts' versions that are to act on each entry. The assigner computes it from the catalog graph, the placements and the nodes' capabilities, and nothing else writes it; it keeps each revision naming the revisions of its inputs, served by the seat `mesh-wants`, and writes the wants from a trunk revision's alone (ADR 0656), from milestone G's delivery from a revision of the watched branch a placement chose whose `required` pipeline steps passed (ADR 0666 §9). Not the **catalog graph**, whose entries are modules, not versions on nodes; not an **assignment**, one module put on one node. - **mesh-wants** — the seat, held once for the mesh, that keeps what each node should run, one want per node and module (`want..`), and a person's upgrade policy, served as its verb `upgrade` (ADR 0565 §7, ADR 0571 §8). Of this domain: the wants are what the delivery asks of the nodes, so its contract is in `mesh-delivery-contracts` (ADR 0641 §2). - **acting part** — the holder of a seat whose definition carries a rule: the step its holder acts in and the modules it acts on (ADR 0656), in the field `acts` (design 47): the indexer, the checker, the build modules, the node-engine, the grants part, the assigner; from milestone G's delivery the holder of `mesh-pipeline-runner` in the checker's place (ADR 0666 §19). Within a revision its new version acts first in its step, a wait with a bound (ADR 0656); when it fails or is late, the modules it was to act on stay on their running builds and a condition names it (design 47). Not every **part**: an acting part may be any module that holds such a seat, a build module among them. - **graph difference** — a change's assignment graph against the current one: the new versions, the moved edges, the touched nodes and the order read off the edges. It is the change's delivery, and nothing stores a plan beside it (ADR 0656); the assigner serves it by the seat `mesh-wants`'s verb `difference` (design 47). Not a **delivery plan**, which was stored and handed out. - **revision view** — what every part acts on: the catalog graph with its heads, seat definitions, verdicts and fingerprints, served by the seat `mesh-catalog`'s verb `revision`, and the assignment graph computed from it, served by the seat `mesh-wants`'s verb `revision`, for a trunk revision or a candidate's heads; a pair, each half served by its one owner (ADR 0656; the verbs' names, design 47). A part with none for the current revision waits and says so (ADR 0656). The node-engine reads only the catalog half, beside its want (design 47). - **delivery record** — the gate's record of one milestone's delivery, a ledger instance it alone writes: the group's state (heads, verdicts, checks, asks), the trace (milestone, issues, pull requests, commits, the assignment graph revisions it moved between) and what happened to each entry on each node (ADR 0656); from milestone G's delivery the pipelines' step and pipeline events in place of the verdicts, checks and asks (ADR 0666 §9). It holds no tiers and nothing else orders by it. Not a **delivery**, one commit on its way. - **checking program** — the rules every check applies, built from the change's heads (ADR 0656, ADR 0644) and run in a build seat's sandbox (ADR 0448 §2) with the revision view as its input and no bus account; the running checker only asks for it, reads its verdict, records and publishes it (design 47). Not the **checker**, the part that asks for it. Goes with the checker at milestone G's delivery: its rules become the indexer's validation and cycle rule and the **composition step** (ADR 0666 §17). - **composition check** — whether the machines a change touches still compose with it, run by the assigner from the modules the indexer and the builder hold, with the composition of `mesh-delivery-sdk`, the one the controller composes with (ADR 0446). It replaces the controller's check of that kind, which composed every machine from release 4 of ADR 0429 back (issue 1303). Becomes the **composition step** at milestone G's delivery; the word then goes to that entry's *Not:* line with the as-is update. *Not:* ~~merge gate~~ (hq) - **kept verdict** — a package's passing verdict at one test level, kept by the checker under the digest of everything its tests read, written once and read-only; a check takes it instead of running an unchanged package (ADR 0444). From milestone G's delivery the pipeline runner keeps it, and a test step takes it (ADR 0666 §8). - **carried verdict** — a delivery's verdict moved to a newer trunk commit, or a newer sibling commit, by its package digests: the checker merges the head onto the new commit and runs only the packages whose digest the move changed, keeping the composition while no composed fingerprint changed; the verdict names the commits it was carried from (ADR 0548 §5, §6). A head git refuses onto the new commit is not carried: its next check is whole (ADR 0548 §7). From milestone G's delivery the pipeline runner carries a step by its package digests (ADR 0666 §8). - **try** — the checker's run of a delivery group's check on one or more members, each a repository at an exact commit, before or without a pull request: the same examiner as the group's check, stricter in that a missing candidate or a node's missing composition answer ends it as error, and owing the forge no status and no Approve. It keeps the verdicts of the packages it passed for the check to take (ADR 0637). Asked only when the operator asks for one (ADR 0637 §6). Goes at milestone G's delivery, the **run on request** in its place (ADR 0666 §18); the word goes to that entry's *Not:* line with the as-is update after that delivery. - **dry run** — a session's run, before a release is pushed, of the parts that will take it in, build it and merge it, as they run live, on the revision as the merge will make it: in process on the session's machine, reading the mesh and writing nothing there. It holds four items: the live take-in run whole with the seat list it will read, every build against the packages as published, the gate's merge path read for the group, and no item left open (hq playbook 07, step 2b). Not a **try** nor a **run on request**, which the mesh runs and which deliver a verdict; a dry run owes the forge nothing and is not a check. - **trunk commit** — the commit of the trunk a merge check's verdict was judged against: the trunk's head when the build module cloned it. The verdict holds for that commit only, goes out of date when the trunk moves, and is then carried to the new commit (ADR 0323, ADR 0548). Goes at milestone G's delivery with the merge check: a pipeline runs on a commit of a **watched branch**, and the word goes to that entry's *Not:* line with the as-is update after it. - **merge turn** — an approved merge's key on a repository in the gate's `turns` bucket: the deliveries waiting to merge there in the order of their Approve, and the check each waits for. It holds new checks off that repository until the merge is done (ADR 0548 §3). Written only while the check gates merges (the gate's setting `check-gates-merge`); while it does not, no turn is written and an approved merge goes in at once (ADR 0551 §1). Goes at research 085's milestone with the hold and the setting, once the record that ends them is accepted (the operator, 2026-11-09; design 47; ADR 0661); the word goes to the *pipeline* entry's *Not:* line with the as-is update after milestone G's delivery. - **build seat** — a language's node seat, held on a node by that language's build module: `node-build-go`, `node-build-node` and `node-build-image` (ADR 0525 §2). Its accepted kinds are the **build streams**, and its verbs `current`, `pause` and `resume` serve that node's pulls. It replaces the seat `node-build-agent`, retired in R4g (ADR 0525 §10). Any node may hold it, and a node whose **build capacity** is above zero builds, so there is no build node by nature (ADR 0237). *Not:* ~~build machine~~ - **build queue** — the build requests waiting to run, kept by the bus alone: per language, the work-queue streams `delivery`, `check` and `recheck`, which a build module pulls from, deliveries first, while its node has a free slot of the build capacity (ADR 0525 §1, §4; ADR 0536 §4). No part keeps a list of them: the controller's queue and its verbs are gone, and a stream's backlog and the age of its oldest request are read from its consumers (ADR 0525 §9). One entry in it is a **build request**, an ask on a build stream for one whole job on one node; the conversation's ask is another thing (see [Homonyms](#homonyms)). - **build capacity** — how many build requests a node's build modules hold at once: a setting of the node that the build modules read, and 0 pulls nothing (ADR 0525 §5). Not a seat's capacity (**capacity**, Module). - **build module** — the module of one language that does the build steps for it on a node (fetch, build, digest, test), claiming that language's build seat; which build modules claim which build seat, on which node, is read from the mesh's assignments (this page's head). It pulls the build requests of its language and writes each step's end on its own key (ADR 0525 §3, §6). Not the **builder**. - **build log** — the builder's own module log `build-log`, in ADR 0297's form, kept 30 days and keyed per module: one entry when a build of a fingerprint starts and one when it ends (the module, the fingerprint, the repository, the directory and the commit, the build node and the time, the build's manifest and its `against`, and at the end the outcome and each artifact's digest). A build's duration is read from its two entries, and no other part records durations; the builder's module tool `builder_builds_since` answers the builds a reader missed from it (ADR 0571 §1, §12). - **package** — what code resolves when it is **compiled**: a Go module, or an npm, cargo or pypi dependency, by **version**. Published by the registry seat of its language, on the request of its language's build module, from a trunk build under the **next version** or for a **tagged version** (ADR 0605 §3, ADR 0607). Only a build module asks a registry seat to store one. - **registry seat** — a seat held once for the mesh whose holder stores what build modules publish, under the version the builder gave, and serves its toolchain's read side: `npm-package-registry` and `go-package-registry` (together the **package-registry**), `container-image-registry` and `oci-artifact-registry`; who holds each is read as this page's head says. One contract: `publish`, `versions`, a verb removing a tagged version, the events `published` and `removed` (ADR 0605 §1, §2). Not the forge. *Not:* ~~docker-package-registry~~ - **next version** — the version the builder gives a trunk build of a published thing: its package series and one above the highest count it holds for that name, kept with its fingerprint, commit, digest and time in the builder's versions on the bus (ADR 0606 §1 to §3). Counted, never typed. - **tagged version** — a published version with a tag (a branch's name, or a word such as `beta`), numbered in Semantic Versioning's pre-release form below the next version, never a package's latest, taken only by a build that asks its tag, and removed when its branch is merged or deleted (ADR 0607). - **mesh delivery case** — a kind of change a developer makes (a package's change, a renamed config value, a new seat), and how the mesh carries it from the pull request to the nodes; research 081 lists them. - **artifact** — anything a build produces and the mesh delivers to a node by **digest**: an `image`, a mirrored `upstream` image, a `bundle` of the module's own code, an `archive`. Served by the **artifact store**, an OCI registry that holds every kind as content-addressed blobs (ADR 0156), reached through two registry seats: `container-image-registry` for images and `oci-artifact-registry` for bundles and archives, which replace the seat `mesh-artifact-store` (ADR 0605 §1). An image is one kind of artifact, and a module is not an image. A package and an artifact are two protocols, not one store being weak (ADR 0075). - **artifact sweep** — letting go of the artifacts no one needs any more, the seat `mesh-artifact-sweep`, held once for the mesh (ADR 0571 clause 2, as its progressive insight of 2026-10-29 has it; clauses 3 and 4). Its keep set comes from the store's own listing, the wants and the build log: a digest a want names is kept however old, and so are each module's five newest builds (ADR 0526 §1). From the lease write it sweeps at each build's end and records each deletion in the hand-act log; until then the controller sweeps. Not the artifact store itself, nor the registry's own collection of unreferenced bytes (ADR 0189). - **build source** — the files one artifact is built from, in one or more repositories: for a Go program its import closure (the directories of its packages, its Go module files) and its recipe; for any other artifact the paths its manifest names, by default its module's own directory. Each artifact of a build has its own, and a change rebuilds the artifacts whose build source it touches (ADR 0267). Older records (ADR 0015, ADR 0111) and designs say *build source* for the repository a module is built from; this entry narrows it to the files within, and that use reads as *the repository holding the build source*. Sharing a repository is not a dependency, and no build source is a whole repository holding another module's files. - **catalog** — what the mesh holds of every module, at which commit; and the repository the modules live in. `mesh-catalog` and `catalog_modules` are identifiers and keep their spelling. *Not:* ~~catalogue~~ - **delivery** — one commit in one repository on its way to the nodes, from its pull request's head being announced to one of its final states: one pull request, one status, one note (ADR 0239). From its merge on it is delivered by the rollout of the batch that answers it, and ends with that rollout (ADR 0276). Its states are one table (`proposed`, `checked`, `ready` or `rejected`, `published`, `delivering`, `held`, and the final six: `delivered`, `failed`, `superseded`, `stopped`, `retired` and `covered`; ADR 0250, ADR 0270). From release 6 of ADR 0429 the gate keeps the merge's states alone (`proposed`, `ready`, `rejected`, `held`, `merged` and `closed`), and a merged delivery is delivered when its source revision is, derived from the wants and the haves (ADR 0539 §17). From milestone G's delivery a commit's states before it is delivered are its **pipeline**'s steps, and the gate keeps no merge states (ADR 0666). Not *change* (a diff), and not a *pipeline*, which is what runs on a commit before it is delivered (below); the as-is designs' word for the predecessor's build-and-deploy mechanism is theirs. *Not:* ~~deployment~~ (hq) - **covered** — the end of a delivery that a later merge containing it delivered: every module it moves was sent to every machine running it by the rollout of a later merge into the same trunk, delivered on its own passing check, whose merge commit the forge says contains this one. Not *superseded*, which is a delivery whose rollout a newer delivery took over before it ended; nor *delivered*, which its own rollout or an empty plan ends in (ADR 0270). As a state of the gate it goes at release 6; a newer delivered source revision then covers the older merges of its repository (ADR 0539 §17). - **delivery group** — two or more deliveries sharing a pull request head branch name across the mesh's repositories, delivered as one unit in an order declared (`after:`) or inferred by the planner. One level: a group holds deliveries, never groups. Its state is derived from its members, never set. From milestone G's delivery: a shared branch name carrying its issue number, complete when each member's commit has landed on its modules' watched branch, taken in as one source revision of that branch and run as one pipeline per watched branch (ADR 0666 §13). - **hotfix** — one pull request in one repository, delivered at its merge (ADR 0401). - **feature** — one branch name across its repositories: in two or more, its pull requests are one delivery group, merged together and delivered member by member in the group's order; in one, a single pull request delivered as a lone delivery (ADR 0401). Work is never held back on a branch other than a trunk: the trunk is what runs. *Not:* ~~release branch~~ (hq) - **toolchain** — a language's compiler and tools, installed by that language's build module on every node holding its build seat, pinned to one version that is the same on every build node; its version is part of a build's reuse key (ADR 0405). No longer an image. - **delivery plan** — what a delivery does to the mesh: its **build plan** (the modules it moves and their dependents, in tiers), its **deploy plan** (per node, what it receives and what waits for a person) and its verdict (the composed nodes, the replays). Computed by the controller's planner from a diffset; the controller's verb `delivery-plan` showed it. *Deploy* is used in this one place. Deleted at release 6 of ADR 0429 (§8, ADR 0539): the word stays in use until that release is delivered, and goes to a *Not:* line with the as-is update that follows the delivery (playbook 02). *Not:* ~~change plan~~, ~~release plan~~ - **merge window** — the rolling wait in which the controller collects merges before it plans them: each merge restarts it, and it closes when none arrived for its length (90 seconds by default) or at the latest 10 minutes after its first merge (ADR 0276). Kept as two keys with a time to live on the bus; the first to expire closes the batch (ADR 0407). Goes at release 6 of ADR 0429, when nothing collects merges (§12), and its keys' bucket is deleted (ADR 0539 §13); the word goes to a *Not:* line with the as-is update after that delivery. - **batch** — the merges one merge window collected, planned once as one rollout. For a repository merged more than once in it, the rollout takes the latest commit, and the earlier merges are answered by it. Not *group*, which is a delivery group. Goes at release 6 of ADR 0429 (§11, §12): a merge moves the source revision and nothing collects it; the word goes to a *Not:* line with the as-is update after that delivery. - **mesh-delivery** — the repository of the delivery domain, holding its parts as modules prefixed `mesh-delivery-` (ADR 0429 §2), made by the forge module from its config (ADR 0428). Until release 3 of ADR 0429 also the module in the catalog that owns deliveries and delivery groups, holding the mesh-scoped seat of the same name: it records and decides, and the controller sends, judges and rolls back when it is asked. Release 3 splits that module into the parts, and then the name means the repository alone. - **part** — one independent process of the delivery domain with its own bus credential, which watches keys and writes keys and never calls another part (ADR 0429 §1). Each key has one writer; the operator's credential may also write a want, the one manual escape. The parts: the **forge bridge** (forge events in, the only caller of the forge), the **indexer** (fingerprints, the candidates of a group, the modules of the trunk), the **builder** (claims one fingerprint once and orders its build), the **checker** (the merge check on built artifacts), the **gate** (merges a group and moves the source revision; *gate part* where it could be read as another gate, see [Homonyms](#homonyms)), the **teller** (the operator's phone, and the only writer of an ask's answer), the **assigner** (writes each node's wants by its seven rules, ADR 0539 §6), the **node agent** (the node-engine's own process, applying its wants), the **watchman** (presence and pulses; it also holds the Health seat `mesh-watchdogs`, whose watchdogs are pulses, and keeps the dead letters, ADR 0564 §4, §5) and the **status view** (`mesh-delivery-cli` and a web view, writing only its answers to asks and saying the events `delivered`, `moving`, `settled` and `stuck`, derived from the keys), and from milestone G the **pipeline runner** (the holder of `mesh-pipeline-runner`, ADR 0666 §7), in the checker's place at its delivery. The reviewer is the review agent's session, not a part. Built over releases 1 to 6 of ADR 0429. - **manifest validator** — the indexer's rules that judge each manifest before anything of it reaches a node: strict decoding, the seat and namespace rules, the bus and stream limits and the whole-catalog checks. It refuses a manifest, sets one aside to wait when it uses a field the running validator does not know yet, or accepts it; a manifest it accepted before keeps that verdict when a newer validator finds problems in it, each written as a warning (ADR 0578 §1, ADR 0579 §1, ADR 0601 §3). Its verdict is the indexer's state, and every other part decodes a manifest and takes that verdict, never judging it (ADR 0578 §3). There is one copy, a package of the indexer's module that only the indexer and the checker use, never mesh-sdk's (ADR 0578 §4, ADR 0593 §1): the merge check runs the trunk's in its sandbox over the manifests a change touches, failing only on a problem in a manifest the change alters or one between manifests that an altered manifest takes part in, and a group that changes it runs the one built from its own head (ADR 0578 §2, ADR 0579 §2). From milestone G's delivery the indexer alone runs it: the validator built from a revision's heads judges that revision in the sandbox before any take-in, on every watched branch, and refuses a manifest that names a pipeline step's status (ADR 0666 §6, §7). *Not:* ~~the judge / a judge / its judge / no judge / judge's / own judge / whose judge / same judge / indexer's judge / trunk's judge / running judge / older judge / newer judge / stricter judge~~ (hq) - **build-input fingerprint** — what identifies a module's build by its content: a hash over its source files, its manifest and the fingerprints of its build-time inputs, so equal content gives an equal fingerprint whatever the commit (ADR 0429 §5). It is today's source fingerprint with a base entering by its module's fingerprint, and a build resolving packages by its lock; from R4g the builder is no input of any fingerprint (ADR 0530). From release 4 a build's key, so one source is never built twice. Its meaning is kept from ADR 0429 §5, and the name says what it hashes beside an artifact's digest (research 086); *fingerprint* alone stays its short form where no other fingerprint is meant. - **source revision** — one revision of the key `source.main`, written only by the gate: every repository's merged head and the group that moved it. A group reaches the mesh as one source revision (ADR 0429 §11); a source revision is **delivered** when every want equals its module's fingerprint and every have equals its want and is healthy, derived from the keys and recorded by no part (§1). From milestone G's delivery there is one per **watched branch**, the key `source.` in place of `source.main`, served by the seat `mesh-delivery`'s verb `source`, and each want names a build-input fingerprint computed at one such revision (ADR 0666 §6). - **pending revision** — a source revision the running indexer has not taken in, because it names another build of the indexer or follows one that does: only the named indexer's own keys are written, the rest kept in the indexer's state `pending` until that indexer starts and takes it in (ADR 0633 §1 to §3). A group's members wait there too until the group's end, as members still gathered (§4). - **canary** — the first node of a module's nodes, ordered by ring then name: a new fingerprint reaches it first and the module's other nodes only once it runs healthy there (ADR 0429 §6). Replaces sending to every machine at once from release 6 (§15); a fingerprint that fails there is held and the canary set back, or for a module that keeps data the operator is asked (ADR 0539 §18, §19). - **want** and **have** — a want (`want..`) is the fingerprint a node should run of a module and the digest of the one **composition** it allows for it, written by the assigner by its seven rules; the node's own want `want..node` names its node composition (ADR 0429 §4, §6; ADR 0539 §1, §6). A want may also carry the operator's answer to a failed backup (ADR 0539 §16). A have (`have..`) is what the node runs: the fingerprint, the composition's digest, its phase (`held` among them) and health, written by that node's agent. A node's facts that no module owns are its node key. They replace rollouts at release 6, and the assignments keep placement alone (ADR 0429 §17, ADR 0539 §12); haves are written from release 1. - **pulse** — a key the watchman writes for each key whose next move a machine owes, with a time to live; its expiry is a stall, raised as a condition, so no part needs a timer (ADR 0429 §1, research 063). A person's wait carries none. - **rollout** — the controller's sending of one batch's builds across nodes, at most one trunk commit per repository, tier by tier, to every node that runs each module at once (ADR 0276, ADR 0360). Rollouts that share a repository, a module or a graph edge run one after another; others run side by side (ADR 0407). It names every merge it answers, and its record is one key of the bus's rollouts bucket, a link of the chain (ADR 0408). A primitive the delivering stage asks for, not an object anyone manages. A **tier** is one step of a rollout: a module, then the modules built against it. The controller's verb `plans` lists the rollouts. A module is rolled out by its `roll` policy. Rollouts and tiers go at release 6 of ADR 0429 (§8, §15), replaced by wants and haves (§17); the rollouts bucket is kept read-only with its history (ADR 0539 §12), and both words go to a *Not:* line with the as-is update after that delivery. *Not:* ~~walk~~ (hq) - **first-node gate** — the judgement on a delivery's first node: healthy three times, no witness put it back, no condition raised since the send (ADR 0236 §2). Goes at release 6 of ADR 0429, replaced by the **canary**. Not *the gate* bare (see [Homonyms](#homonyms)). - **core module** and **leaf module** — a core module is one on the controller's own path (the controller, the node-engine, the tool runner, the bus, mesh-delivery) or the mesh's resolver, whose judgement protects the mesh's ability to reach a node at all; a leaf module is every other module. Decided by ADR 0282. Not a *core component* (ADR 0236's controller, node-engine, tool runner and bus, each with a health probe): the core modules add mesh-delivery and the resolver. - **delivery time** — from a delivery's merge to every node of its deploy plan that is heard from running its modules' builds and reporting them healthy. Its **delivery budget** is what it is held to: three minutes for a leaf module (ADR 0304), ten for a core module (ADR 0282). Not the rollout's time, which ends at the send. A measure inside the fix budget, not the operator's target (ADR 0313). - **fix time** — from an issue's first move to `fixing` to the moment the last of its fixes is delivered: the operator's measure of a fix, the agent's work, the review and the checks included, the delivery time its last part. Its **fix budget** is what it is held to: five minutes for a leaf module, ten for a core module, counted from the move to `fixing`; an issue whose fixes move no module has none (ADR 0313). Not the delivery time, which starts at the merge. - **release** — a person's word that a held delivery goes on; the verb `mesh-delivery.release`, until release 6 of ADR 0429, when the verb goes (ADR 0539 §17) and a held move goes on by the operator's answer to the assigner's ask. Used in this sense only. - **rollback** — putting a node back on the build it ran before, by something other than the build being judged (a witness, ADR 0236). - **the lab**, **scenario**, **replay** — a real mesh raised to run a change against before it reaches nodes; what a lab run declares; and a recorded failure run again to prove a fix (ADR 0016, ADR 0237). - **git seat** — the seat `git`, held once for the mesh, delivering the provision `git`: the repositories a build comes from ([26 — The seats](../03-DESIGN/01-to-be/26-the-seats.md) *The git seat*). A seat of this domain, defined in `mesh-delivery-contracts`. From research 085's milestone its verbs are the one way a delivery part and the gate reach the forge: reads (`pull`, `open-pulls`, `tags`, `trees`, `file`, `contains`, `statuses`) for the parts that declare them, acts (`status`, `comment`, `view`, `note`, `merge-pull`) for the forge bridge alone, as the holder's trusted value `callers` names, and the forge's events (`pull.*`, `forge.*`, `repo.writable`) as the seat's (design 47, *The verbs*). From milestone G's delivery `merge-pull` is a session's merge, refused only for a head at whose fingerprint a run failed a `required` step, a head that moved or an unprotected branch (ADR 0666 §11), the read `branch` and the event `branch-moved` say a branch's head and protection, and the callers per verb are the seat definition's (ADR 0666 §20). Not the **forge** itself, the server, nor the forge module's own tools. ## Health and repair — what is wrong, and putting it right **Purpose.** To notice what is wrong with the mesh, say it once, repair what may be repaired unattended, and record what was done by hand. **Recorded by** the controller's condition store. **Upstream of** Delivery (the first-node gate) and Operator and conversation (a condition becomes a message). **Decided by** ADR 0227, 0231, 0240, 0252, 0283, 0564, 0668. **Uses:** node, module, node-engine (Core). - **health** — a module's or a core component's statement of how it is alive and ready, which the node-engine judges (ADR 0240). - **relogin needed** — an account's health when the group database lists it in an account group and its running session, started before, does not have that group yet. Said by the node-engine as the module's resource of kind `account`; it clears at the first look after a new login (ADR 0252). - **waiting** — a resource's health when its module's tool check says it waits for the operator: a named own secret or config value of the module, not given yet, without which a part cannot work. Not a fault: the controller checks it and says it as the condition `needs-operator`, naming the act, and the first-node gate reads it as *waits for a person* (ADR 0283). - **probe** — one look at one thing's health, run by whoever owns the verdict; what a probe returns is a **finding**, before it becomes a condition. A finding is kept as a key `..` in its observer's bucket `findings` until it is no longer observed (ADR 0564 §2); from design 47's milestone G the observer also says each as its own event, and states every finding it owns at its start, so the condition keeper hears findings and reads no observer's bucket (ADR 0596 §2; design 47 G §383, §384). - **node health report** — each node-engine's own report of its node's health, a key that node's engine writes and the watchman reads (ADR 0564, as its progressive insight of 2026-10-29 has it); its layout is mesh-sdk's. - **observer** — a part that writes findings for the condition keeper: the watchman, the self-check and the healers (ADR 0564 §2), and each caller of a kept call, for its `call-unanswered` (ADR 0668 §3); from design 47's milestone G, every module that writes findings (design 47 G §383). An observer never writes a condition. - **condition keeper** — the holder of the seat `mesh-conditions`: the one writer of the open conditions, raising each from an observer's finding and clearing it when the finding goes, and saying `condition-raised`, `condition-changed` and `condition-cleared` (ADR 0564 §2, §3). The controller keeps them until the take-over. - **signal** and **watchdog** — something that must keep happening (a heartbeat, a report after a send), and the watcher that raises a condition when it stops (to-be 45 §3). - **condition** — one open fact about something the mesh owns that is wrong, with a key and a severity; raised and cleared only by observation (ADR 0231). A pipeline step or a watched branch's head standing still five minutes is one, from the watchman's finding `pipeline-stands`; a step waiting on a person is not (ADR 0666 §24). What a wrapped dashboard raises is its own; the mesh's notion is a condition. *Not:* ~~alert~~ (hq) - **self-check** — the mesh's own examination of itself, run on demand and on a schedule (to-be 45 §4), held by the seat `mesh-self-check` (ADR 0564 §6); the controller runs it until that is delivered. Its verb is `doctor`, an identifier; prose says self-check. *Not:* ~~doctor~~ (hq) - **healer** — a registered response to one condition kind: its **repair** (the ordinary path again), its **budget**, its back-off and its brake. A healer may not withdraw, delete or recreate data. - **drill** — something broken on purpose to see the mesh raise and clear its condition; a drill is never counted as a repair. - **rehearsal** — a question the operator starts at the controller's terminal (`rehearse`) and answers on a channel, to see an answer travel the whole way: its approval performs nothing and is recorded as the operator's decision (ADR 0259). Not a drill: nothing is broken. - **hand-act** — a repair a person made by hand, recorded so the mesh knows it happened. The **hand-act log** is the module's log in ADR 0297's form, the stream `acts` of the seat `mesh-hand-acts`, held once for the mesh, whose holder also records who chose an ask (`warranted`); every recorder calls it, and the controller's own log is read beside it until the lease write (ADR 0565 §10, §11). - **take-over** — the operator's approved switch of a job from the controller to the part that replaces it, with a way back until the lease write: for the bus's user list, the grants part's list becomes the one loaded (ADR 0547 §8); for conditions, the condition keeper's events become the ones the router hears (ADR 0564 §9); for config, mesh-config's `take-over` is refused while its `compare` shows a difference between its new source and the controller's mirrors (ADR 0565 §4). - **witness** — what rolls a core component back when its new build does not become healthy: never the component itself (to-be 45 §8). ## Data — what the mesh keeps, and getting it back **Purpose.** To know every item of data a module holds, how precious it is, and to keep it recoverable. **Recorded by** the manifests' `data` declarations and every node's `node-backup` seat. **Upstream of** Delivery and Health and repair. **Decided by** ADR 0232, 0233, 0235, 0571, 0595, 0596, 0597. **Uses:** module, node, provider and consumer (Provisioning), person, bus module (Core), tool runner (Core). - **data class** — how precious an item of data is, ranked by the operator: `irreplaceable`, `valuable`, `rebuildable`, `cache`; and `none` for a provision that keeps nothing of anybody's (ADR 0233). - **backup** — a copy kept elsewhere by the node's `node-backup` holder; **restore point** — one backup at one moment; **restore** — bringing it back beside the live data, never over it. - **stream snapshot** — the bus's own backup of each stream, taken by the module holding `mesh-broker` (ADR 0235). - **recovery module** — the holder of the seat `mesh-recovery`, held once for the mesh: under an account of its own it takes a restore point of a module's kept data on the live bus before the module moves across a `form` change, sets the live data aside and restores the point at a revert, and lists and removes restore points; the snapshot account restores nothing into the live bus, the bus module only the stream snapshot it took before a `drop` or `recreate` of a protected stream, in place (design 47 G §681), and the backup holder only stores copies (design 47 G §554). **aside** — live kept data a restore set aside, removed only by the hand tool `recovery_discard_aside`, which the operator and sessions call. *Not:* ~~restorer~~, ~~restore account~~ - **ZFS snapshot** — a read-only point in time of one ZFS dataset on a machine, kept inside that dataset's pool, so it guards against a mistake and never against the pool's loss; taken by a person with `zfs_snapshot`, or by the zfs module's scheduled run, which names its own `mesh--