ADR 0258 and issue 324: the live window, data loss never silenced from a click, and where to give what no notification can

The second review found the fix could not read what the live build kept, missed quiet warnings known from history, and let a click silence data loss.
2026-10-08 14:56:48 +02:00
parent f5d08f4b6f
commit 3bfedcfa15
2 changed files with 34 additions and 15 deletions
@@ -44,10 +44,15 @@ ten-second notification or a restart of the notifier's bundle.
   - **Silence for a week**, through `conditions silence` with a why and the cause `operator-answer`.

   The operator channel's holder keeps this as an explicit allow-list and refuses everything else. A
-   condition's actions outside it are never offered, and a token for one is refused without a call. The
-   controller offers no other action. **Release, stop, start and restart are said in words**: "Needs you:
-   release it, or stop it." with no button. This replaces ADR 0253 §6's reading of *acknowledge* and its
-   promise to honour a tier.
+   silence answers only the condition it is offered on. A condition's actions outside the list are never
+   offered, and a token for one is refused without a call. The controller offers no other action.
+   **Release, stop, start and restart are said in words, with where to give them**: "Needs you: release it,
+   or stop it, from the mesh console; this notification cannot do it." This lasts until to-be 46 phases 5
+   and 6 authorise answers. It replaces ADR 0253 §6's reading of *acknowledge* and its promise to honour a
+   tier.
+   **Data loss is never silenced from a notification.** A condition that says data is gone or shrank offers
+   no answer, and its words say where it is silenced. Announcing a silence chosen at the desk on the away
+   channel, so a silence by anything at the session is seen, is a follow-up.
 2. **An answer is a one-time ticket.** A token is made for one message of one condition, together with the
   other tokens of that message; a newer message's tokens replace them. It is bound to the machines the
   message was shown on, good for a day, and used once. It is refused for a condition that cleared or is
@@ -65,19 +70,23 @@ ten-second notification or a restart of the notifier's bundle.
 6. **A change of words is said.** The controller emits `condition-changed` (change `words`) when what a
   condition needs or offers changes. The holder says a warning it kept quiet when its words now need the
   operator, whether it learns that from the event or from a reading of the state. It also says once, after
-   a day, a warning still kept quiet, so nothing stays silent for ever.
+   a day, every warning still kept quiet, including one it first knew from history, so nothing stays silent
+   for ever.
 7. **The desk's answers stay and come back.** A notification that offers answers stays until it is
   dismissed. When the notifier's bundle starts, it says `started`, and the holder shows the open
   notifications that offer answers there again, with fresh tokens.
 8. **The operator's zone is always known**: the holder carries the zone data, whatever the machine has
   installed.
+9. **What the live build kept still loads.** The build live from 14:38 kept `tokens` as token to index. The
+   holder keeps its answers under a new name (`grants`), so such a record loads with its old tokens dropped,
+   and a click on one of them is refused and said.

 ## Consequences

- The delivery-waiting popup past its bound reads "Needs you: start it, or stop it. …" and offers Details
-  only. Starting or stopping it is not possible from the desk until phase 5. That is the honest state,
-  and the words say where the decision lies.
- Failed services nobody manages, and data that shrank or went, still offer Silence for a week.
+- The delivery-waiting popup past its bound reads "Needs you: start it, or stop it, from the mesh console;
+  this notification cannot do it. …" and offers Details only. Starting or stopping it is not possible from
+  the desk until phase 5. That is the honest state, and the words say where the decision lies.
+- Failed services nobody manages still offer Silence for a week. Data that shrank or went offers none.
 - ADR 0253's other rules stand: the plain words, the verdict, the quiet rule, the time zone and the one-line
  clearance. Its §6 and the consequence "the verb's own record … says who chose it" are replaced here.
 - An answer chosen in a notification shown before a newer message about the same condition is refused,
@@ -92,7 +101,9 @@ ten-second notification or a restart of the notifier's bundle.
  - at most four answers, Details included;
  - the same token twice is refused the second time, and the same event is acted on once;
  - a token is refused from another machine, when unknown, past its day, and for a condition silenced or
-    cleared;
+    cleared; a silence of another condition is not offered and its token is refused;
+  - a record in the form the build before kept (`tokens` as token to index) loads, and its old token is
+    refused;
  - a verb the mesh refuses is said on the notification;
  - a words-only change to "Needs you" after a quiet time is said, through the event and through a reading of
    the state, and a quiet warning is said once after a day;
@@ -108,7 +119,8 @@ ten-second notification or a restart of the notifier's bundle.
    cut; refused words keep their verdict and answers; a change of words is a `condition-changed`.
  - `cmd/mesh-controller/plain_words_test.go`: the module, held-delivery and waiting conditions offer no
    answer; the relogin words and the kind `relogin-needed` (ADR 0254) are held to the plain rule; a silence
-    with the cause `operator-answer` does not count toward a healer wanted, and one by hand still does.
+    with the cause `operator-answer` does not count toward a healer wanted, and one by hand still does;
+    "Needs you" without a button names the mesh console, and data loss offers no silence.

 ## References

@@ -2,7 +2,7 @@
 status: located
 opened: 2026-10-08
 located-in: [mesh-catalog modules/messenger (the answers, the quiet rule), mesh-catalog modules/dunst (the desk's actions), mesh-controller internal/conditions (the plain rule, the change of words)]
-fixed-by: novox/mesh-controller PR #145, novox/mesh-catalog PR #131
+fixed-by: novox/mesh-controller PR #145, novox/mesh-controller PR #147, novox/mesh-catalog PR #131
 amended-design: 03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md
 ---

@@ -10,9 +10,11 @@ amended-design: 03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md

 ## Symptom

-ADR 0253 (issue 320) was merged at the operator's request before its review had finished. The
-controller's part began to roll out; the build of the operator channel's holder and the desktop notifier was
-published and waited for its delivery's word, so it was not yet live. The review then found:
+ADR 0253 (issue 320) was merged at the operator's request before its review had finished. Its controller
+part was live from 14:35 on 2026-10-08, and the build of the operator channel's holder and the desktop
+notifier from 14:38: from then on the desk offered Release, Stop, Start and Restart. According to
+`operator-channel.history`, no answer was performed up to 14:46; the holder records each answer there, and
+none appears. The review then found:

 1. **A desk click could release, stop or start a delivery, or restart a service, in the operator's name.**
   Any process of the operator's account can choose a desktop notification's action (`dunstctl action`), so
@@ -36,6 +38,11 @@ published and waited for its delivery's word, so it was not yet live. The review
   says who chose it", which was false for a restart (it takes no why). A silence chosen on the desk would
   have counted as a hand repair toward a healer wanted.

+A second review of the fix found three more: the records the live build kept (`tokens` as token to index)
+could not be read by the fix's form and would have been skipped; a quiet warning known only from history
+was never reminded; and a silence answer was not held to its own condition. And a click could silence a
+condition that says data is gone.
+
 ## Cause

 The decision outran its review: it read ADR 0234's *acknowledge* ("what any granted principal may already