The candidate (the pipeline's own revision) against the branch's newest through mesh-catalog's revision; serving parts by the holder of the runner's, catalog's, steps' and composer's seats; acting rules, credentials; grants through grants-for. A read that fails says could not run. Touches steps.go (Hearer.Widens field, say's pipeline-ended), main.go (hearer.Widens), module.json invokes.
Builds: design 47 G §71, §275, §335, §441, A-207, A-215, A-220
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
run writes each member's pipeline at once under the run's random id and its named branch and says
run-started; the candidate run-<id>'s catalog-revision, handed to the runner by meshcatalogclient's
candidates hook, is read whole through the revision verb and places each member's steps and a pipeline
of each entry the members change, saying pipeline-started once each.
Builds: design 47 G §64, §373, §420, A-160, A-180, A-185, A-193, A-199
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
The runner hears the builder's stream of build ends (kept last per subject, read whole at its start, A-181: consumes
`mesh-delivery-builder.build.ended.**`) and keeps when each build ended, the stream's own time. wait-held carries it as
`clock-from`, the bound of the wait is armed from it (30 minutes less what passed), and a bound whose build has not ended is armed
when its end is heard, with wait-held said again. A failed end starts no clock.
Builds: design 47 G §266, §269, §703, A-181, A-206
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
The pipeline gains `unlogged`: a step's end is written in its key with its step-log entry in one compare-and-set, said as
step-ended, then appended to the step log and cleared; a log that refuses an append ends no step, says full and starts no new
pipeline; at its start the runner appends every unlogged entry in order after reading back the log's last entry of that
pipeline, and once a minute while the log is full. The tools runner_unlogged and runner_unlogged_append (a hand act).
Builds: design 47 G §486, §606, §549
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
The part claims mesh-grants, serving grants-for: a run by its group run-<id> or a
source revision by the branch and the new optional source of mesh-catalog's
revision (contract regenerated), compared with the branch's newest by the
permissions the composed accounts gain and lose with the candidate's entries in.
Builds: design 47 G §401, §441, §449, A-205
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
A pipeline held for the runner's new version says its wait-held and wait-ended on `runner version`, no longer on `build node`.
Contract (seat.json, regenerated by seatgen) gains the value.
Builds: design 47 G §534, §696, A-206
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
ReleaseExpired says each pipeline it started through the starter's Late, and the process writes the finding pipeline-waits
(scope module, id the pipeline's key `<branch>.<id>.<module>`) naming the awaited runner and since when.
Builds: design 47 G §266, §269, A-206
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
A step keeps the node whose holder said ask-taken; a superseded step's drop is asked of that node's holder, an
untaken ask's of any holder, as kept calls; steps on mesh-builds and mesh-wants are only ended superseded. A
pipeline a publish started says that publish (published), so a newer publish of the package supersedes it.
Builds: design 47 G §31, §119, §350, A-182, A-202
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
The seat mesh-pipeline-runner gains the act verb `release` (why; answers how many it started) beside start and ask-again, its
hand act written first through mesh-hand-acts; each released wait ends `released` and its bound is dropped. The tool
runner_release asks the verb. Contract regenerated with seatgen.
Builds: design 47 G §276, §534, A-206 (A-195)
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
The runner keeps each commit the seat mesh-delivery says a recovery merged in its state recoveries; a pipeline whose commit is
named there has its go, node and image steps asked on delivery.step, ahead of the first round, at its start, its resume and a
rerun; a recovery heard after its pipeline started asks nothing again.
Builds: design 47 G §81, §86, §415, A-207
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
Derived at every pass from the catalog graph's manifests and the seat definitions'
callers, never from a manifest field.
Builds: design 47 G §59, §124, §442
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
signals.go BusUserWords: the node-tools special word is gone (the node-engine's node.<node> user stays, a bus account form, not a
module name). The watchman's ControlNodeModule (signals.go:591, nats) and builderModule (names.go:17) went with A-197 and WM13.
Builds: design 47 G §7, §428
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
The seat gains the events filling, full and room; at each step's end and each start the runner reads the fill of pipelines,
step-outputs, kept and step-log against their caps, says filling past 80 %, full at the cap and room below 70 %, and a start
while a store is full is refused, said in the journal and heard again by the bus.
Builds: design 47 G §366, §181
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
Removed with the reads of node-engine.have and mesh-host.health: the findings module-unhealthy (module <module>.<node>, token
unhealthy, urgent after four hours), kept-as-it-runs (module <module>.<node>, token kept), apply-failing from a have that failed
(machine <node>; the provisioner clients' half stays), machine-network, network-rewritten, network-unreachable, machine-units,
relogin-needed, directory-used-as-found, node-account-fallback, and the urgency of a silent control node. A want's pulse now ends on
the node-engine's running event (consumes node-engine.running).
Builds: design 47 G A-197, A-192, §541
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
The first reads the callers each verb and accepted kind of the seat definitions
admits, the second says which call subject an account lacks (the bus's own
nats_user_can) beside the definition's callers.
Builds: design 47 G §83, §391, §395
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
The seat's pipeline record gains `held` (since, the fingerprint awaited). A take-in giving the runner's own module a new
fingerprint holds every pipeline it starts, and a later take-in's while any is held; wait-held (step pipeline) is said, the
30-minute bound is a key of the state bounds. The node-engine seat's running of the runner's module at the awaited
fingerprint, healthy, or the bound's expiry, releases them: steps placed and asked, wait-ended and pipeline-started said. A
runner starting at the awaited fingerprint releases at its start. runner_waits lists the held pipelines.
Builds: design 47 G §65, §266, §276, §534, §19 (lead answer A-195)
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
Three step-log sequences in the state aged, one per retention (7, 30, 90 days); at each step's end up to 20 entries per
sequence past their retention delete the output and the pipeline (7 days), a kept result not read for 30 days (30 days) and a
passed pipeline (90 days), never a pipeline that is its branch's newest; each delete is a journal line. The step log is
written to and read from the log's stream (design 47 G §470); a log entry names the kept results it wrote or carried and a
kept result its last read.
Builds: design 47 G §330, §410, §470
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
record-opened is joined to the take-in.taken of its milestone, <branch>.<source revision>, whose entries name the modules; the
record-open finding is left unwritten only while one of those modules is held by an acting-part-late wait (or a store says full),
no longer while any wait is late. A record whose revision is not known taken is covered by a standing take-in-waits.
Builds: design 47 G §502, A-200
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
Each queue gets a named worker filtered to accept.<queue>.*; an asker is granted
accept.<queue>.<its seat> for the queues of the kinds it is a caller of, read from
the definitions' callers lists; main's accept.<queue> is the checker's and the
builder's alone. The purge of named subjects and workers (grants_named_purge) is
not in this commit.
Builds: design 47 G §543, §544, §600, §601, A-163, A-170, A-184
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
manifest-refused raises manifest-refused; manifest-accepted, which carries problems, raises manifest-outgrown or clears it
and any refusal; the start seeds both from indexer_verdicts. The indexer's modules view (ModuleVerdict, views.modules,
indexer_read_modules) is no longer followed, and manifest-waits is no longer written (§500).
Builds: design 47 G §500, §196, §668
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
The watchman's read of mesh-delivery-builder.builds (Build in mirror.go, the bucket, its manifest reads) goes; it hears the
builder's wait-held and wait-ended on the builder's stream, naming a package as their part, and times them as an acting
part's wait. A toolchain wait (no part) is left to the builder's own finding. The node-engine's have and mesh-host.health
reads stay: no event carries a have's phase, kept data, node record or a node's health report (asked of the lead).
Builds: design 47 G A-192, §484, §496, §602, §548
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
A required step that failed or could not run writes the finding of its commit, owned by the commit's author as the forge
records it (read through the seat git's pull); one with no known author has no owner and says why, written at the next step
end of that commit; a newer revision passing the steps clears it. The runner's finding writer is the held writer.
Builds: design 47 G §33, §540, A-191
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
The builder says wait-held for a key queued behind a package, the package as its part and on (package:<ref>), on its
stream waits, and wait-ended published once the key is claimed; a toolchain wait never ends by that, and a package wait
never by a toolchain's end. Files: internal/build/waits.go (Package, On, WaitPublished), internal/build/run.go (Hold at
the queued result, End at the claim), cmd/mesh-delivery-builder/waits.go (Part in the body, the End rule).
Builds: design 47 G A-192, §499
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
pipeline-ended carries the module's test counts (the sum of its steps') and over-budget
past 500 unit or 50 integration tests; once every member of a group on a watched branch's
source revision ended, group-ended is said under the group.
Builds: design 47 G §24, §73, §332, §419
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
A step neither the artifact's nor the module's policy names is placed as an optional step
(Status returns optional), no longer no step; a failure of it holds nothing.
Builds: design 47 G §553, §23, §32, §535
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
A hold of the composition standing past 30 minutes is delivery-waits (node, module, reason), a wait for a kept build
past 60 minutes is kept-build-waits; each clears on wait-ended. The node-engine's version is not yet named in them
(it needs the catalog entry of the fingerprint running.<node>.<node-engine's module> names).
Builds: design 47 G §499, §541, §271, §376
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
A reader turns a stream's events into the bus's subjects with mesh-sdk's
buscompose.WirePattern; the grants part's copy goes. The catalog graph
entry already carries the validated manifest whole, its needs-approval,
emits and streams with their grant among it (design 47 G §443).
Builds: design 46 7-approval-mark §5
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
The watchman keeps the watched branch each open take-in wait names (take-in.pending's branch) and times a head only
while its branch has none; once the revision is taken in the head is timed again from its own move. The head on a
branch whose branch-unprotected stands (§497's second sentence) is not built: nothing the watchman hears says it
(the forge bridge writes that finding, no event).
Builds: design 47 G §12, §75, §497
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
A per-machine state's account reaches its machine's key and the keys
below it (mesh-sdk PerMachineKeys), no other machine's, so the tool
runner's approvals keep <node>.ask.<id> and <node>.act.<digest>; the
membership names the machine's key in the same form.
Builds: design 46 7-approval-mark §13
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
A manifest marking a tool its tools do not list, a verb its claims do not
serve or an event it does not carry, one name both a tool and an event, a
marked tool or verb (or a held seat verb its seat marks) without
operator-channel in uses, or a marked tool or verb while every bundle it
builds is run by its own process, is refused by both paths, naming the
entry and the rule. The login shell's captured manifest is copied at
AM-K1, which gives it operator-channel.
Builds: design 46 7-approval-mark §4, §7, §21; design 34 every-event §32; lead answers A-177, A-183
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
The runner's own writer of its consumer's oldest unacknowledged delivery is
replaced by mesh-sdk's consumer ledger: each message the hub hands a handler is
noted delivered, and applied when the handler acknowledges or ends it; one it
asks again stays unacknowledged. The key form is the same, a key per consumer
by its name in the state consumers. A runner that heard no event yet is healthy.
Builds: design 47 G §76, §468, §495; lead answers A-166, A-176
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
start starts by hand the pipeline of a watched branch's head from the runner's
catalog half, refusing a head already started; ask-again asks a declined
approval once more under an ask of its own, its id following from when it was
asked again so the ask rebuilt for its warrant is the same. Each is recorded in
the hand-act log first; the process answers both beside review, rerun, accept
and cancel.
Builds: design 47 G §30, §39, §306, §36, §394
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
A wait held with step put (no part) raises put-stands once its bound has run from its clock, and wait-ended ends it; a pipeline's
wait raises nothing for it. The seed from assigner_puts waits on that tool answering since and bound (assigner's, not built here).
Builds: design 47 G §498
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
The manifest no longer carries what a session waits on (mesh-sdk EE-S2), so
the rule judging it and its token form go; a manifest still carrying waits
is a field the validator does not know, refused by Shelf and set aside by
ShelfWaiting, and the tool runner's manifest without it is accepted.
Builds: design 34 every-event §10
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
jschoubben