From 301c551888c7dc63d9fba9f8e68a66aaad8431da Mon Sep 17 00:00:00 2001 From: jochen Date: Tue, 6 Oct 2026 18:54:34 +0200 Subject: [PATCH] ADR 0236: no send reaches the bus's machine while a new bus build waits Found live the same day: a plan's send of the catalogue carried the bus's rebuilt image to the control node and restarted the bus unasked. --- ...han-itself-and-so-it-rolls-out-unattended.md | 17 ++++++++++++++--- .../45-a-core-that-cannot-fail-silently.md | 6 ++++-- 2 files changed, 18 insertions(+), 5 deletions(-) diff --git a/02-DECISIONS/0236-a-build-is-judged-on-its-first-machine-and-put-back-by-something-other-than-itself-and-so-it-rolls-out-unattended.md b/02-DECISIONS/0236-a-build-is-judged-on-its-first-machine-and-put-back-by-something-other-than-itself-and-so-it-rolls-out-unattended.md index 254f8ee..f290050 100644 --- a/02-DECISIONS/0236-a-build-is-judged-on-its-first-machine-and-put-back-by-something-other-than-itself-and-so-it-rolls-out-unattended.md +++ b/02-DECISIONS/0236-a-build-is-judged-on-its-first-machine-and-put-back-by-something-other-than-itself-and-so-it-rolls-out-unattended.md @@ -158,8 +158,13 @@ held field for field: **6. The bus is never rolled out; its upgrade is a step a person starts.** Its policy is `record` whatever is said, `upgrade` refuses it a roll-out, a plan builds it and sends nothing, a cascade holds its -machine (ADR 0221), and **a push naming its machine is refused while a new bus build waits for it**, with -the remedy. The step is `bus upgrade --why …`: refused unless the person says whether the new version can +machine (ADR 0221), and **no send reaches its machine while a new bus build waits for it** — a push naming +it, a plan's send for another module there, a healer's, a rollback's — each refused with the remedy. On +2026-10-06 a plan's send of the catalogue to the control node carried the bus's rebuilt image with it, +and the bus restarted under every machine with nobody having asked (`record` held a cascade, not the +machine a send was for). A rebuild that made the same artifacts from the same manifest is no move. A +change of the bus's **user list** is not a restart: the bus's image reloads its server in place when the +list it is written changes, and that stays the ordinary path. The step is `bus upgrade --why …`: refused unless the person says whether the new version can be reverted (`--reversible`, or `--irreversible` as their explicit word that it runs anyway); the bus machine's backup holder snapshots the streams first (ADR 0235) — a person who took one by hand says where — and only then is the machine sent; recorded as a hand act; `bus-maintenance` (the probe DB) is open @@ -181,6 +186,12 @@ not say which files went, marks the module deleted in its plan, which goes on. tier. - **The controller's grant gains one verb that acts**, `node-backup now`, used only by the bus step, and an event, `rolled-back`; the installer's first user list carries both (mesh-host). +- **A new bus build stalls every send to the bus's machine until a person runs the step.** A plan whose + first machine is that machine waits, said in the plan and, past its bound, as `stalled`. That is the + point: the bus is replaced when a person is there, not as a side effect. +- **A change to the build agent rebuilds most of the catalogue** (its modules are built on what it + builds), which is how the bus came to be rebuilt by a merge that did not touch it. Whether that tiering + is right is left open here; a rebuild that changes nothing is at least no longer a move of the bus. - **Thirteen modules still wait for a person**, each saying why in the catalogue or by its data; `status` lists the machines behind them and `push ` walks them, as before. A person who wants another held says `upgrade record --why …`. @@ -205,7 +216,7 @@ not say which files went, marks the module deleted in its plan, which goes on. | the bound | the controller's test: a first machine never healthy fails at the bound and is put back | | the health definitions | the controller's test per component: tools not served, a condition since the send, a witness's verdict, node tools not answering, a lease held by an older controller or one not ready | | the policy | the catalogue's test: default roll, a module's word, irreplaceable data, the bus whatever it says; a record without why refused; the store's test: the current builds read the derived policy | -| the bus is never rolled out | the controller's test: the bus records whatever it says, a person's roll-out is refused, a plan sends nothing, a push may not send its machine, the step refuses without its word on reversibility and without its snapshot, and starts with both | +| the bus is never rolled out | the controller's test: the bus records whatever it says, a person's roll-out is refused, a plan sends nothing, no send may reach its machine while a new bus build waits — a rebuild with the same artifacts and manifest excepted — the step refuses without its word on reversibility and without its snapshot, and starts with both | | a deleted module is not built | the controller's test: a merge deleting a module's manifest asks no build and forgets it; a build finding no manifest leaves the plan going | | the witness's contract | the lease package's test of the host's rule; the broker's test of the grants (the ping on every machine, the lease's key where the controller runs, no write); the controller's test that a witness's verdict is its condition while reports carry it and cleared after | | live | the next merge to the catalogue sends one machine first and the rest after its gate, with no push; `plans ` shows the gate's record; the next week's hand-act log has no push for a build that rolled out | diff --git a/03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md b/03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md index 40bbcd2..908d59b 100644 --- a/03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md +++ b/03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md @@ -459,8 +459,10 @@ bus becomes a cluster that can be upgraded live is left to its own effort. As built (ADR 0236): the verb is `bus upgrade --why … --reversible|--irreversible`; the snapshot is the bus machine's backup holder backing the bus module up now ([ADR 0235](../../02-DECISIONS/0235-the-bus-is-backed-up-by-its-own-snapshot-of-each-stream.md)), -or one a person took and names with `--snapshot-taken`; the step's bound is fifteen minutes; a push -naming the bus's machine is refused while a new bus build waits for it. *2026-10-06:* the snapshot +or one a person took and names with `--snapshot-taken`; the step's bound is fifteen minutes; **no send +reaches the bus's machine while a new bus build waits for it** — a push, a plan's send for another +module, a healer's — after a plan's send restarted the bus unasked on 2026-10-06; a change of the bus's +user list is reloaded in place, not a restart. *2026-10-06:* the snapshot and the way back from it exist — the bus image's own snapshot program, the same one the night's backup runs, and a restore that builds a new store beside the live one for a person to swap in ([ADR 0235](../../02-DECISIONS/0235-the-bus-is-backed-up-by-its-own-snapshot-of-each-stream.md),