novox/hq
6
0
Fork 0
Code Issues Pull Requests 4 Releases Wiki Activity

To-be 45 §7: a hand act a person decides by design is no repair, by the verb that recorded it

Browse Source 
Planned bus upgrades and rotations after one leak raised healer-wanted,
because the exemption was keyed on two causes. Progressive insight: the
exemption is read from the verb table; the decisions stand.
This commit is contained in:
jochen
2026-10-06 20:14:09 +02:00
parent 62d4b1e5d4
commit 2d56eae2f1
1 changed files with 22 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md
+22 -2
View File
@@ -393,8 +393,28 @@ controller), and `hand-act record` for an act done outside the mesh —
takes a required `--why` and writes an entry: who, which verb and arguments, why, when, the condition
key it addresses if any, and a **cause** (the condition kind, or a word the person gives). `status`
shows the week's count. A cause recorded twice within fourteen days raises `healer-wanted` (S15) —
except `retire-waiting` and `cleanup-waiting`: approving a retirement and deleting what was retired are
a person's decision by design (ADR 0230), and no healer may take them over.
except an act recorded by a verb that is a person's decision by design, which is no repair and never
counts, whatever cause it gives. The controller keeps one table of the verbs that write the log, and
each says whether it records a repair or a decision, and why: approving or rejecting a retirement and
deleting what was retired (ADR 0230); `bus upgrade`, because the bus is never rolled by the mesh, and
`upgrade release-backlog`, because after a failed release plan the next opens only on a person's word
(ADR 0236); and `secret rotate` when its cause is a leak (`leaked-in-logs`) — a person judges what was
disclosed, one leak rotates several values, and a leak that recurs is a defect of the module that
prints them, an issue against it, not a healer that rotates. A rotation for any other cause counts. A
push by hand, `plans stop` and `close`, `broker consumer-reset`, `conditions silence` and `hand-act
record` (an act outside the mesh, whose kind the mesh cannot tell) count; so does a verb the table does
not list. The table's test finds every verb the controller records and fails on one it does not list.
A `healer-wanted` already open for a decision clears on the next watchdog tick, as any condition its
row no longer sees.
> **Progressive insight — 2026-10-06.** This paragraph said before: "except `retire-waiting` and
> `cleanup-waiting`: approving a retirement and deleting what was retired are a person's decision by
> design (ADR 0230), and no healer may take them over." The exception was keyed on two causes, and the
> first planned bus upgrades (two within a day, one recorded after the fact and one through `bus
> upgrade`) raised `healer-wanted` for `bus-upgrade`, as did two rotations after one leak for
> `leaked-in-logs`. What makes an act a decision is the verb that recorded it, not the word it gives as
> its cause, so the exception is read from the verbs. Nothing decided changes: ADR 0230's acts stay
> exempt, and pushes by hand — what roll-out by default (ADR 0236) exists to end — still count.
## 8. Staged core upgrades and rollback (rule 8)