From 0e8a6980257096bb8967a32816b5b42a8ad776d8 Mon Sep 17 00:00:00 2001 From: jochen Date: Wed, 4 Nov 2026 01:59:59 +0100 Subject: [PATCH] Designs 25, 51: the owners take the view's six tool names; distribution's delivered retries a failed pull The status view can no longer answer its six tools named for the owners' buckets once it stops reading them, so the owners' tools take the names. A finding held during distribution's own delivery raises no condition and so no clear, so the node-engine also tries a failed pull again on the status view's delivered for distribution, and nothing waits for a hand compose. Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig --- 03-DESIGN/01-to-be/25-the-bus-on-nats.md | 8 ++++++-- .../51-the-registries-keep-what-is-named.md | 19 +++++++++++++------ 2 files changed, 19 insertions(+), 8 deletions(-) diff --git a/03-DESIGN/01-to-be/25-the-bus-on-nats.md b/03-DESIGN/01-to-be/25-the-bus-on-nats.md index e6df2a05..948e6be7 100644 --- a/03-DESIGN/01-to-be/25-the-bus-on-nats.md +++ b/03-DESIGN/01-to-be/25-the-bus-on-nats.md @@ -823,7 +823,10 @@ vault as an own secret: JetStream create and update under modules' names only (s (`heard`) and `indexer_taken` (`taken`). The assigner's three: `assigner_findings` (`findings`), `assigner_asks` (`asks`) and `assigner_differences` (`differences`). So the nine buckets of the indexer and the six of the assigner that the 23 readers read (§ 12.6) each have their owner's tool. Six of these names are today tools of the - status view, which serves them by reading the owner's bucket and is one of the 19 readers. + status view, which serves them by reading the owner's bucket and is one of the 19 readers: `indexer_predefined`, + `indexer_config_candidates`, `indexer_candidates`, `indexer_packages`, `indexer_heard` and `assigner_differences`. + **The owners' tools take the six names, and the status view drops its six tools of those names as it moves**, + since without its reads it can no longer answer them; one name is then one tool, the owner's. - **Only the owner reaches it** (ADR 0596 §2). The membership grants the owner's account its own entries and no other module's: the new form has no readers. What another module needs of that data it asks through the owner's tools or seat verbs, and what the owner lets others hear is its declared events, subscribed to through @@ -983,7 +986,8 @@ not by the 19 the first plan counted; and 151 state entries were counted, not 15 the first count, which chose the templates). The owners first gain their events and first-view tools: the indexer one per bucket its readers read, the assigner the same (§ 12.2 lists them). Then all 23 readers move in the milestone of ADR 0612, the four foundation readers included, by the first view of § 12.2 (ADR 0615 §1); their order is the module graph's, not -a review reading an owner delivered (ADR 0615 §2). The judge still refuses a moved module's subscription to an event +a review reading an owner delivered (ADR 0615 §2). The status view's move drops its six tools named for the owners' +buckets, which the owners' tools of § 12.2 take over under the same names. The judge still refuses a moved module's subscription to an event its owner does not declare. Every other reader moves when its module is next touched. These moves are tracked by issue 1966. diff --git a/03-DESIGN/01-to-be/51-the-registries-keep-what-is-named.md b/03-DESIGN/01-to-be/51-the-registries-keep-what-is-named.md index 4bc8d001..55cf9f61 100644 --- a/03-DESIGN/01-to-be/51-the-registries-keep-what-is-named.md +++ b/03-DESIGN/01-to-be/51-the-registries-keep-what-is-named.md @@ -9,7 +9,7 @@ code: - mesh-delivery modules/mesh-delivery-builder (versions, tag asks), the forge bridge, the indexer, the checker, the assigner - mesh-sdk (the bus helper for sending in parts) - mesh-catalog modules/docker (image pruning) - - mesh-host internal/apply (every new image of a module pulled before any of its containers is replaced; a failed pull applied again when the condition keeper clears the store's holder's condition) + - mesh-host internal/apply (every new image of a module pulled before any of its containers is replaced; a failed pull applied again when the condition keeper clears the store's holder's condition or the status view says `distribution` delivered) updated: 2026-11-04 decisions: - "ADR 0605" @@ -199,8 +199,13 @@ the verb. node-engine hears the seat `mesh-conditions`'s `condition-cleared` (ADR 0564 §3) through its manifest's `consumes`, and when the condition it clears names the store's holder (`distribution`, the holder of the image seats) as not healthy or its seat as not answering, it applies once more each module whose have says failed naming an image of - that store, one apply per clear, said in its journal. A clear of any other condition starts nothing, and no clock - starts an apply. `compose` naming the module stays, but only as the hand recovery of a pull still failed after + that store, one apply per clear, said in its journal. **It also tries them again when `distribution`'s own delivery + ends**: the node-engine hears the status view's `delivered` (the event design 47 derives, once for each source + revision whose wants and haves all agree) through its `consumes` as well, and on a `delivered` for a source revision + that moved `distribution` it applies once more each module whose have says failed naming an image of the store. A + finding of the holder held during its own delivery (ADR 0564 §13) raises no condition and so no clear; without this + a pull failed in the swap would wait for `compose`. A clear of any other condition and a `delivered` that did not + move `distribution` start nothing, and no clock starts an apply. `compose` naming the module stays, but only as the hand recovery of a pull still failed after that, recorded as a hand act; it is no step of the delivery. - **The package seats' read sides need no credential** for the mesh's own packages: the forge serves the mesh owner's packages to anonymous reads, so the provisions `npm-package-registry` and `go-package-registry` carry no @@ -472,7 +477,9 @@ test). - **Node-engine, unit** (a case of its apply test, with the runner and the bus it already fakes): a module whose pull failed, its have failed naming an image of the store, is applied once more on a `condition-cleared` of the store's holder's condition, and its new image pulled; a `condition-cleared` of another module's condition applies nothing; - with no clear heard, nothing applies it again, however long the test waits. + with no clear heard, nothing applies it again, however long the test waits; the same module is applied once more on + a `delivered` for a source revision that moved `distribution`, and a `delivered` that moved only another module + applies nothing. - **Checker.** A changed build module invoking a verb no running holder serves is not run, and the verdict names the modules composed from their manifests instead, and the verb. - **Vault.** Reverting the milestone's merge mints the build modules' credentials again; the bootstrap's one-off @@ -485,8 +492,8 @@ test). milestone wakes and applies the new node-engine; the node-engine's apply journal for `distribution` on each node shows every new image pulled before its first container was replaced, and no node's pull of any module failed during the delivery (each node's haves, none failed naming an image), or, where one fell in the swap, its have - turned healthy after the condition keeper cleared the store's holder's condition, the node-engine's journal naming - that clear, and no `compose` was called for it; mesh-build-node installs from a lock file + turned healthy after the condition keeper cleared the store's holder's condition or after `distribution`'s + `delivered`, the node-engine's journal naming which, and no `compose` was called for it; mesh-build-node installs from a lock file naming the registry's public root with no credential. Go's `direct`: its removal is named on the milestone's issue, and the change that removes it adds to the Go build module's recipe test a case that refuses `direct` in the fetch.