From ae4c90f99063827b556d182fb68a7fa00b5f6052 Mon Sep 17 00:00:00 2001 From: jochen Date: Tue, 3 Nov 2026 01:37:31 +0100 Subject: [PATCH 1/3] Design 47: the bus module is wanted like any module, and only a put replaces its server (issue 774, the operator 2026-11-03) Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL --- .../01-to-be/47-delivery-from-commit-to-delivered.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md b/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md index 30ff16cc..4effc640 100644 --- a/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md +++ b/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md @@ -845,6 +845,17 @@ backup holder backs up nothing, and the have says so. fingerprint, the digest, the phase and the health after the module's start window. A failed apply is loud, retried by the next change of the want or the composition, never by a clock, and fixed forward (ADR 0360 §8, ADR 0539 §9). +- **The bus module is wanted like any module; its server moves only by a put.** "The bus moves" (ADR 0539 §15, + ADR 0546 §8) means its server is replaced. So the assigner writes the bus module's want by the same rules as + every module's, and the node agent applies what that want brings (its files, its processes' bus accounts and + secrets, its tools) while it keeps the server's container as it runs. Only a want written by a put, on the + operator's warrant after the streams' snapshot, replaces the server. mesh-sdk names the resources the bus's + server holds, so the assigner and the node agent read one list; a node agent that does not know the list yet is + never sent a want for the bus module, so the node agent's hold is delivered before the assigner's change. Until + then nothing writes the bus module's process accounts, and its tools that write to the bus fail (issue 774, the + operator, 2026-11-03). How it is checked: a node agent unit test applies a bus module's new want and shows the + server's container untouched and the tools' account written; an assigner unit test writes the bus module's want + by the rules and holds the server's replacement for a put. - **Every want is owed.** The watchman mirrors every want as a pulse owed by that node's agent until its have names the want's fingerprint, so a node that does not move is a stall (ADR 0539 §19). - **A move a person must allow is judged by the node and asked by the assigner.** The node agent applies ADR 0377 From 402ac3bfda9134ad3265a0bc1fa68f017b06d760 Mon Sep 17 00:00:00 2001 From: jochen Date: Tue, 3 Nov 2026 01:44:38 +0100 Subject: [PATCH 2/3] Design 47: the assigner writes the bus module's want only to a node agent that keeps the server, and the test says so Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL --- .../01-to-be/47-delivery-from-commit-to-delivered.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md b/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md index 4effc640..8fe20575 100644 --- a/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md +++ b/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md @@ -850,12 +850,14 @@ backup holder backs up nothing, and the have says so. every module's, and the node agent applies what that want brings (its files, its processes' bus accounts and secrets, its tools) while it keeps the server's container as it runs. Only a want written by a put, on the operator's warrant after the streams' snapshot, replaces the server. mesh-sdk names the resources the bus's - server holds, so the assigner and the node agent read one list; a node agent that does not know the list yet is - never sent a want for the bus module, so the node agent's hold is delivered before the assigner's change. Until + server holds, so the assigner and the node agent read one list; the assigner writes the bus module's want only to a + node agent whose have says it keeps the server (the version it reports), so the node agent's keeping of the server + is delivered before the assigner's change. Until then nothing writes the bus module's process accounts, and its tools that write to the bus fail (issue 774, the operator, 2026-11-03). How it is checked: a node agent unit test applies a bus module's new want and shows the server's container untouched and the tools' account written; an assigner unit test writes the bus module's want - by the rules and holds the server's replacement for a put. + by the rules, holds the server's replacement for a put, and writes none to a node agent whose have does not say it + keeps the server. - **Every want is owed.** The watchman mirrors every want as a pulse owed by that node's agent until its have names the want's fingerprint, so a node that does not move is a stall (ADR 0539 §19). - **A move a person must allow is judged by the node and asked by the assigner.** The node agent applies ADR 0377 From b01f86734552b10251f6b163cf2fed3f8e4c622c Mon Sep 17 00:00:00 2001 From: jochen Date: Tue, 3 Nov 2026 02:02:39 +0100 Subject: [PATCH 3/3] Design 47: the bus module's want follows ADR 0594 Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL --- .../47-delivery-from-commit-to-delivered.md | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md b/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md index 8fe20575..177340b6 100644 --- a/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md +++ b/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md @@ -4,6 +4,7 @@ status: in-progress code: [mesh-controller, mesh-catalog modules/mesh-delivery-gate, mesh-delivery, mesh-host, mesh-sdk, mesh-vault, hq 00-META/checks] updated: 2026-11-03 decisions: + - "ADR 0594" - "ADR 0572" - "ADR 0571" - "ADR 0570" @@ -845,11 +846,13 @@ backup holder backs up nothing, and the have says so. fingerprint, the digest, the phase and the health after the module's start window. A failed apply is loud, retried by the next change of the want or the composition, never by a clock, and fixed forward (ADR 0360 §8, ADR 0539 §9). -- **The bus module is wanted like any module; its server moves only by a put.** "The bus moves" (ADR 0539 §15, - ADR 0546 §8) means its server is replaced. So the assigner writes the bus module's want by the same rules as - every module's, and the node agent applies what that want brings (its files, its processes' bus accounts and - secrets, its tools) while it keeps the server's container as it runs. Only a want written by a put, on the - operator's warrant after the streams' snapshot, replaces the server. mesh-sdk names the resources the bus's +- **The bus module is wanted like any module; only a warranted want replaces its server** (ADR 0594, changing + ADR 0539 §14 and §15, ADR 0546 §8 and ADR 0565 §7 for the bus module). The assigner writes the bus module's want by + the same rules as every module's, and the node agent applies what that want brings (its files, its processes' bus + accounts and secrets, its tools) while it keeps the server's container as it runs, with no record ask. Only a want + that carries the operator's warrant (a put after the streams' snapshot, or the operator's hand write) replaces the + server; until then the bus module's have names the fingerprint applied and the one the server runs, and the view + says the server waits. mesh-sdk names the resources the bus's server holds, so the assigner and the node agent read one list; the assigner writes the bus module's want only to a node agent whose have says it keeps the server (the version it reports), so the node agent's keeping of the server is delivered before the assigner's change. Until