The toolchain carries the SDK the mesh last published, and esbuild (hq issue 212, ADR 0193)

mesh-tools stands on mesh-sdk's published package: the build receives its exact version and
installs it after the package.json install, so a release is a new argument and the cached layer
cannot keep an older SDK; the planner orders the toolchain after the SDK, and every bundle after the
toolchain (issue 211). esbuild, a development dependency, is what the builder bundles each
TypeScript entrypoint and launcher into one file with.

Dockerfile

@@ -28,6 +28,14 @@ COPY node-tools/package.json ./
 # credential travels no further than here. Development dependencies included: the compiler is one.
 COPY .npmrc ./.npmrc
 RUN npm install --no-audit --no-fund
+# **The SDK this image carries is the one the mesh last published** (novox/hq issue 212). The range in
+# package.json is resolved once and the layer above is cached, so a release reached no toolchain until
+# that file changed. The exact version arrives as a build argument from the SDK module's published
+# package (module.json `build.on`), so a new release is a new argument, this layer runs again — and
+# the planner orders this module after the SDK, so a release rebuilds the toolchain and, after it,
+# every bundle compiled in it (issue 211).
+ARG MESH_SDK=@novox/mesh-sdk@latest
+RUN npm install --no-audit --no-fund "${MESH_SDK}"
 
 # ---- compiling: the runtime's own code built, WITHOUT the credential -------------------------
 FROM ${NODE_BASE} AS compiling
@@ -45,6 +53,9 @@ FROM compiling AS lean
 RUN npm prune --omit=dev
 
 # ---- toolchain: what a TypeScript bundle is compiled in ---------------------------------------
+# The compiler, and esbuild (a development dependency) at /app/node_modules/esbuild: the builder
+# bundles every entrypoint and launcher into one file with it (novox/hq ADR 0193), so a bundle
+# carries what it imports and not this image's node_modules.
 # Beside the compiler, at /app/runtime, what every TypeScript bundle runs with: the production
 # dependencies the SDK and the runtime need, and a package.json saying the compiled files are ES
 # modules. The builder copies this directory whole into a compiled bundle (novox/hq ADR 0188 §5),