Design 47 milestone G, one release in seven repositories: the delivery group feat/47-G-join12 (issue 1966; ADR 0666, ADR 0667). It replaces #226 of group feat/47-G-join11, which the delivery gate closed after merging only 3 of its members this morning. Same head as #226. This is the node-engine. G's base branches are all main, so the gate can merge the whole group on one Approve.
The check cannot judge G on today's checker (issue 1373). Local evidence: go vet over 224 modules clean except the intentionally broken fixture; the touched modules' tests pass; G's manifest validator accepts 193 of 193; the second dry run against what is live finds no refusal caused by G.
Reviewed-by: mesh-code-reviewer@shanks at 8656e57eb9 (its one finding fixed in a12417fc, a sleep removed, read by lead-47@shanks); main merged in since (the zfs group, 5caa760f), looked at by the reviewer 2026-11-13 09:36 CET
Design 47 milestone G, one release in seven repositories: the delivery group feat/47-G-join12 (issue 1966; ADR 0666, ADR 0667). It replaces #226 of group feat/47-G-join11, which the delivery gate closed after merging only 3 of its members this morning. Same head as #226. This is the node-engine. G's base branches are all main, so the gate can merge the whole group on one Approve.
The check cannot judge G on today's checker (issue 1373). Local evidence: go vet over 224 modules clean except the intentionally broken fixture; the touched modules' tests pass; G's manifest validator accepts 193 of 193; the second dry run against what is live finds no refusal caused by G.
Reviewed-by: mesh-code-reviewer@shanks at 8656e57eb96e859a75b287e345c2ae576f9c5173 (its one finding fixed in a12417fc, a sleep removed, read by lead-47@shanks); main merged in since (the zfs group, 5caa760f), looked at by the reviewer 2026-11-13 09:36 CET
https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
The node follows the node-engine seat's running events (an ordered read of the last message of each subject, then a durable
consumer), keeps what each node runs by `at`, acts on none until the first read ended, and hands the composer each node's
heard build with the manifest read by the event's digest; compose resolves the passes through catalogue.SeatsToPassOn
(heard, entries) with the trunk's entry for a node that said nothing.
Builds: design 47 G §199, §249, §459, §536, §556
Claude-Session: https://claude.ai/code/session_01JG73KEq4zoDfM9WtYpcQgZ
The module is the one whose catalog entry claims node-engine, else the one this node heard run the build its own
fingerprint names; no name is fixed in the guard or in the compose.
Builds: design 47 G §364, §527, §428
Claude-Session: https://claude.ai/code/session_01JG73KEq4zoDfM9WtYpcQgZ
A finding is written in the node's state findings and followed by finding-written or finding-cleared on the engine's own
stream mesh-host-findings; the engine states every finding it observes at its start (the seat list's finding only while the
reader waits for the list, else not) and when the keeper asks, and answers an ask by a new statement. The node's grant in
the golden file gains the stream's publish, the ask stream's consumer, and the whole of its state findings.
Builds: design 47 G §383, §384, §390, §461, §485, §503
Claude-Session: https://claude.ai/code/session_01JG73KEq4zoDfM9WtYpcQgZ
A want with parts is applied only when every fetched archive, process and container
digest is among the parts and every part is a fetched digest; otherwise the module
keeps running what it has and its have is held with detail parts-differ naming the
digests. A want with no parts is applied as before.
Builds: design 47 G §524, §379
Claude-Session: https://claude.ai/code/session_01JG73KEq4zoDfM9WtYpcQgZ
The join with mesh-contracts' K6 (7d730a4a) removes the event and its body; H-3's second source of the same fact goes (haveState.capsSaid, capabilitiesToSay, sayCapabilities), the test asserts none is said.
Builds: design 47 G §590
Claude-Session: https://claude.ai/code/session_01JG73KEq4zoDfM9WtYpcQgZ
The seat list's five-minute finding and the finding of a held module are raised as they happen, so they use the held
writer (seeded at Start, Held() answers what stands) over the contract of the seat mesh-conditions; the keepers keep no
set or sweep of their own, and the writer is started before the seat list reader writes or clears any. The engine's own
finding stream stays its foundation stream mesh-host-findings.
Builds: design 47 G §529, A-29, A-30, A-37, A-38, A-40
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
The node's own composer reads the catalog half through meshcatalogclient's Entries cache over its own calls of
mesh-catalog's verb entry, and no longer watches or reads the indexer's modules, manifests and verdicts or the
builder's builds: a module's manifest is its entry's, each artifact's reference is made from the digest its want's
part names (artifact-store://<module>/<artifact>/blobs/<digest>, A-50). A want whose entry is asked or not found is
held, its have the phase held with a detail opening entry-asked: or entry-missing: naming the fingerprint. The
entries and wants it composes from are kept in composed-<node> (entry.<digits> and want.<module>), written before
the composition that uses them, read at start before anything is asked, a kept want standing until the wants'
live read answers, and dropped when nothing names them. The shadow keeps its reads (G §628).
The node grant gains the verb entry and the running stream's consumer calls; OverNATS hears the running stream
as the link's session does.
Builds: design 47 G §421, §683, §614, §628, A-47, A-50
first-views answers {first-views, entries, wants}, entry-again asks one entry again as a recorded hand act and
answers {asked, read}; first-view-again names no view the engine follows (it follows no branch) and refuses in
words. module.json's claim of node-engine lists every verb the engine serves.
Builds: design 47 G §422, §698
A want that names a node in kept-on, for an artifact its parts name, is fetched through kept-artifact of that node's build seat and
read as an object on the bus, checked against the digest; with no kept-on it is fetched from the store, and the builder's builds
are read no more (the apply hook, the fetch and the object read from bc8fbc7, its node and fingerprint from the want).
Builds: design 47 G §271, §526, §421 (A-50)
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
The node's own composer reads the catalog half through meshcatalogclient's Entries cache over its own calls of
mesh-catalog's verb entry, and no longer watches or reads the indexer's modules, manifests and verdicts or the
builder's builds: a module's manifest is its entry's, each artifact's reference is made from the digest its want's
part names (artifact-store://<module>/<artifact>/blobs/<digest>, A-50). A want whose entry is asked or not found is
held, its have the phase held with a detail opening entry-asked: or entry-missing: naming the fingerprint. The
entries and wants it composes from are kept in composed-<node> (entry.<digits> and want.<module>), written before
the composition that uses them, read at start before anything is asked, a kept want standing until the wants'
live read answers, and dropped when nothing names them. The shadow keeps its reads (G §628).
The node grant gains the verb entry and the running stream's consumer calls; OverNATS hears the running stream
as the link's session does.
Builds: design 47 G §421, §683, §614, §628, A-47, A-50
Before a move across a kept data's form change the node agent asks snapshot-kept and waits for the ended of its own act; at a revert it stops the newer build (Env.Stop), asks kept-points, asks restore-kept with the snapshot of the point of the form and fingerprint it reverts from, waits for restored, applies the reverted build, and calls the point's catch-up as the module's tool through the tool runner. The wait is in the have (ask-at, act), bounded by a bounds key of the state bounds (recovery-wait-minutes, 90), and each ending is read as the table of 560 says. The manifest consumes mesh-recovery's ended and restored and invokes its three verbs.
Builds: design 47 G §296, §297, §554, §555, §560, §630, §631, §632, §633, A-77, A-92, A-98, A-108
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
The manifest declares the file recovery-wait (content ${config:recovery-wait-minutes}); the node-engine reads it at its start and
does not call stdio.Config, which needs the runtime that launches a bundle.
Builds: design 47 G §633, A-112
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
The codec moved from the mesh-delivery contracts into mesh-delivery's domain SDK (sdk/catalogkey), still a pure package
of the standard library and mesh-sdk; the command's import rule named the old place only.
Builds: design 47 G A-144
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
The long-form invokes entry is read by mesh-sdk's second reader release (09d6070e): packaging's manifest
tests pass with it placed and fail before it is joined.
Builds: design 47 G §558, §617, §633, §635
The delivery repository's contracts and SDK live under modules/ as
mesh-delivery-contracts and mesh-delivery-sdk, their Go module paths
renamed to match the folders (the TypeScript names already did), and
every importer in mesh-delivery, mesh-catalog, mesh-host, mesh-tools
and mesh-sdk follows in the same group: a design as it should be, one
path per module, checked by the group's check building every importer.
Builds: design 47 G §427, §88
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
The composer answers the assigner's composition step: the request is read from the file
named by MESH_RUN_INPUT and the verdict is the last line of standard output, exit 0; the
compose-job path stays.
Builds: design 47 G §354, §63, §22; lead answer A-167
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
The have's failed phase (apply-failing), unhealthy health (module-unhealthy) and kept words (kept-as-it-runs), and each part of
its health report (machine-network, network-rewritten, network-unreachable, machine-units, relogin-needed,
directory-used-as-found, node-account-fallback), raised and cleared by the held writer where the engine knows the fact.
Builds: design 47 G A-197 (ADR 0596, A-192, A-149)
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
Each finding's id carries its token as a ref (A-14), so machine.<node>.network, .rewritten, .unreachable, .units and module.<module>.<node>.unhealthy and .kept
read as before.
Builds: design 47 G A-197
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
The grants part decides a node's withheld subjects from the runner's own
reading tied to the runner that stated it; the merge into capabilities stays
for placement.
Builds: design 46 7 §6 (its node's node-engine takes both into the node's record), lead answer A-203 (runner-capabilities, runner-fingerprint)
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
The node-engine never reads the grants part's state: it asks the seat's verb
withheld in its own name, and says withheld unknown when nothing answers.
Builds: design 46 7 §6 (the composition reads them through the verb withheld; the node-engine's manifest gains mesh-grants in uses; "withheld unknown: the grants part does not answer"), lead answer A-239
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
A want with `revert` `live` starts the reverted build with no restore, no aside taken and no catch-up, and
applies as any want; without the field a revert with no restore point stays held.
Builds: design 47 G §710 (G-21-provider-and-revert-ask.md, "On the answer"), §300, §567
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
H-17 made discovery read the node-engine's own name (§527) instead of the constant mesh-host,
but the integration test still gave its link no own name and expected mesh-host, so every
endpoint announced an empty module. It now gives the link an own name and expects that one.
Builds: design 47 G §634, A-149
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
After a restart, g14's engine restated its reads three seconds after its
first, bootstrapped statement, and the assigner never heard that event: a
say that failed past the bus's retry bound waited for the next link. Now a
say the bus did not take (no responders, a deadline) is said again on the
link until the bus takes it, off the caller, each failed attempt written to
the engine's journal with the event's name; only a lost link, or a refusal
the bus answered, keeps it for the next link.
Builds: design 47 G §590, A-292
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
Brings mesh-host #224 (issue 1966): newestFPs returns a placed module whose
newest build failed, composedValues writes its refused key at that fingerprint,
takeBuildDone starts the pass on a failed build. Conflict in newestFPs settled
by keeping G's by-entries branch first (design 47 G §421, §628: the node reads
neither the indexer's modules nor the builder's builds; it returns no failed),
and main's failed-build path in the other.
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
Reading the catalog half by fingerprint, the node-engine no longer reads the builder's builds, so #224's refused key was
never written there and a reader waited on a build that will never be done. The engine now hears the builder's
build.ended stream, read whole at start then followed (as the assigner hears it); the last trunk end of a placed module
that ended failed is written as the refused key with the event's words, a later done end deletes it, an end naming a
branch moves nothing. The manifest consumes mesh-delivery-builder.build.ended.**.
Builds: design 47 G A-293 (with §421, §628), ADR 0593 §6, issue 1966 U1/U8
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
The composer's Build is made from the catalog half's entry it holds and the parts of the want that names it (buildOf); the
inputs of the indexer's modules and the builder's builds, takeBuildDone, takeModule and the builder read are gone, and mesh-host
names no BuilderBuildsBucket. The shadow takes the entries of the builds it composes from (askBuildsEntries), builds a module a
candidate adds from its entry and the candidate's `added` parts (A-316), and holds, with the reason, a module whose entry
has no part given, whose fingerprint the verb module does not give, or for which it errors (A-312). Its composer is given the
entry call as the node's own is. Rows: a built module added with and without parts, the verb module answering no fingerprint
and erroring.
Builds: design 47 G §421, §628, A-308, A-312, A-316
The whole test's web manifest keeps G's entry form (no build artifact, the entry read by fingerprint) and takes main's resources under if-config and config-lines.
Builds: design 47 G §421; design 42 zfs-owns-zfs H1-H5
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
The apply gives each process the declaration's For as MESH_NODE beside its own env, so a process that reads MESH_NODE (mesh-sdk, the zfs follower's writer and its node-service-manager calls) names its node.
Builds: design 47 G A-342
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
Deliverynovox/mesh-host@5caa760f5eaa — merged since 2026-11-13T13:09:32Z
Source — source.main moved to novox/mesh-host@fd023f7473. Whether it reached the machines is mesh-delivery-view's, derived from source.main, the wants and the haves.
2026-11-13 13:02 (new) → proposed (announced): novox/mesh-host#228's head announced; #226 with the same head closed unmerged
2026-11-13 13:02 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false)
2026-11-13 13:09 ready → merged (merged): on the trunk its modules follow: merged there
The commit's note under refs/notes/mesh-plan keeps every transition of this change up to its merge: git log --notes=mesh-plan.
<!-- mesh-delivery:view -->
**Delivery** `novox/mesh-host@5caa760f5eaa` — **merged** since 2026-11-13T13:09:32Z
**Source** — source.main moved to novox/mesh-host@fd023f7473bc. Whether it reached the machines is `mesh-delivery-view`'s, derived from `source.main`, the wants and the haves.
**Group** `feat/47-G-join12`: novox/mesh-catalog@53351dd30df2, novox/mesh-contracts@ef1fe33a9da5, novox/mesh-delivery@bc8126efefa9, novox/mesh-host@5caa760f5eaa, novox/mesh-networking@ccfdaec5ed2d, novox/mesh-sdk@627bee35c811, novox/mesh-tools@6be5679a0d58
**Transitions**
- 2026-11-13 13:02 (new) → proposed (announced): novox/mesh-host#228's head announced; #226 with the same head closed unmerged
- 2026-11-13 13:02 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false)
- 2026-11-13 13:09 ready → merged (merged): on the trunk its modules follow: merged there
The commit's note under `refs/notes/mesh-plan` keeps every transition of this change up to its merge: `git log --notes=mesh-plan`.
mesh-delivery: the operator's Approve of this pull request's merge into main is ended: a head it covers moved on: the heads it covers are no longer the group's heads. Nothing is merged on it. The operator is asked again once the checks pass at the new head.
mesh-delivery: the operator's Approve of this pull request's merge into main is ended: a head it covers moved on: the heads it covers are no longer the group's heads. Nothing is merged on it. The operator is asked again once the checks pass at the new head.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Design 47 milestone G, one release in seven repositories: the delivery group feat/47-G-join12 (issue 1966; ADR 0666, ADR 0667). It replaces #226 of group feat/47-G-join11, which the delivery gate closed after merging only 3 of its members this morning. Same head as #226. This is the node-engine. G's base branches are all main, so the gate can merge the whole group on one Approve.
The check cannot judge G on today's checker (issue 1373). Local evidence: go vet over 224 modules clean except the intentionally broken fixture; the touched modules' tests pass; G's manifest validator accepts 193 of 193; the second dry run against what is live finds no refusal caused by G.
Reviewed-by: mesh-code-reviewer@shanks at
8656e57eb9(its one finding fixed ina12417fc, a sleep removed, read by lead-47@shanks); main merged in since (the zfs group,5caa760f), looked at by the reviewer 2026-11-13 09:36 CEThttps://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
first-views answers {first-views, entries, wants}, entry-again asks one entry again as a recorded hand act and answers {asked, read}; first-view-again names no view the engine follows (it follows no branch) and refuses in words. module.json's claim of node-engine lists every verb the engine serves. Builds: design 47 G §422, §698The manifest declares the file recovery-wait (content ${config:recovery-wait-minutes}); the node-engine reads it at its start and does not call stdio.Config, which needs the runtime that launches a bundle. Builds: design 47 G §633, A-112 Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4hDelivery
novox/mesh-host@5caa760f5eaa— merged since 2026-11-13T13:09:32ZSource — source.main moved to novox/mesh-host@fd023f7473. Whether it reached the machines is
mesh-delivery-view's, derived fromsource.main, the wants and the haves.Group
feat/47-G-join12: novox/mesh-catalog@53351dd30d, novox/mesh-contracts@ef1fe33a9d, novox/mesh-delivery@bc8126efef, novox/mesh-host@5caa760f5e, novox/mesh-networking@ccfdaec5ed, novox/mesh-sdk@627bee35c8, novox/mesh-tools@6be5679a0dTransitions
The commit's note under
refs/notes/mesh-plankeeps every transition of this change up to its merge:git log --notes=mesh-plan.mesh-delivery: the operator's Approve of this pull request's merge into main is ended: a head it covers moved on: the heads it covers are no longer the group's heads. Nothing is merged on it. The operator is asked again once the checks pass at the new head.