From 3bfedcfa1561d9ae07be5f5140f746c928cd170f Mon Sep 17 00:00:00 2001 From: jochen Date: Thu, 8 Oct 2026 14:56:48 +0200 Subject: [PATCH] ADR 0258 and issue 324: the live window, data loss never silenced from a click, and where to give what no notification can The second review found the fix could not read what the live build kept, missed quiet warnings known from history, and let a click silence data loss. --- ...ment-and-an-answer-is-a-one-time-ticket.md | 34 +++++++++++++------ .../00-report.md | 15 +++++--- 2 files changed, 34 insertions(+), 15 deletions(-) diff --git a/02-DECISIONS/0258-a-desk-click-performs-only-an-acknowledgement-and-an-answer-is-a-one-time-ticket.md b/02-DECISIONS/0258-a-desk-click-performs-only-an-acknowledgement-and-an-answer-is-a-one-time-ticket.md index 3ce990be..3ab170e0 100644 --- a/02-DECISIONS/0258-a-desk-click-performs-only-an-acknowledgement-and-an-answer-is-a-one-time-ticket.md +++ b/02-DECISIONS/0258-a-desk-click-performs-only-an-acknowledgement-and-an-answer-is-a-one-time-ticket.md @@ -44,10 +44,15 @@ ten-second notification or a restart of the notifier's bundle. - **Silence for a week**, through `conditions silence` with a why and the cause `operator-answer`. The operator channel's holder keeps this as an explicit allow-list and refuses everything else. A - condition's actions outside it are never offered, and a token for one is refused without a call. The - controller offers no other action. **Release, stop, start and restart are said in words**: "Needs you: - release it, or stop it." with no button. This replaces ADR 0253 §6's reading of *acknowledge* and its - promise to honour a tier. + silence answers only the condition it is offered on. A condition's actions outside the list are never + offered, and a token for one is refused without a call. The controller offers no other action. + **Release, stop, start and restart are said in words, with where to give them**: "Needs you: release it, + or stop it, from the mesh console; this notification cannot do it." This lasts until to-be 46 phases 5 + and 6 authorise answers. It replaces ADR 0253 §6's reading of *acknowledge* and its promise to honour a + tier. + **Data loss is never silenced from a notification.** A condition that says data is gone or shrank offers + no answer, and its words say where it is silenced. Announcing a silence chosen at the desk on the away + channel, so a silence by anything at the session is seen, is a follow-up. 2. **An answer is a one-time ticket.** A token is made for one message of one condition, together with the other tokens of that message; a newer message's tokens replace them. It is bound to the machines the message was shown on, good for a day, and used once. It is refused for a condition that cleared or is @@ -65,19 +70,23 @@ ten-second notification or a restart of the notifier's bundle. 6. **A change of words is said.** The controller emits `condition-changed` (change `words`) when what a condition needs or offers changes. The holder says a warning it kept quiet when its words now need the operator, whether it learns that from the event or from a reading of the state. It also says once, after - a day, a warning still kept quiet, so nothing stays silent for ever. + a day, every warning still kept quiet, including one it first knew from history, so nothing stays silent + for ever. 7. **The desk's answers stay and come back.** A notification that offers answers stays until it is dismissed. When the notifier's bundle starts, it says `started`, and the holder shows the open notifications that offer answers there again, with fresh tokens. 8. **The operator's zone is always known**: the holder carries the zone data, whatever the machine has installed. +9. **What the live build kept still loads.** The build live from 14:38 kept `tokens` as token to index. The + holder keeps its answers under a new name (`grants`), so such a record loads with its old tokens dropped, + and a click on one of them is refused and said. ## Consequences -- The delivery-waiting popup past its bound reads "Needs you: start it, or stop it. …" and offers Details - only. Starting or stopping it is not possible from the desk until phase 5. That is the honest state, - and the words say where the decision lies. -- Failed services nobody manages, and data that shrank or went, still offer Silence for a week. +- The delivery-waiting popup past its bound reads "Needs you: start it, or stop it, from the mesh console; + this notification cannot do it. …" and offers Details only. Starting or stopping it is not possible from + the desk until phase 5. That is the honest state, and the words say where the decision lies. +- Failed services nobody manages still offer Silence for a week. Data that shrank or went offers none. - ADR 0253's other rules stand: the plain words, the verdict, the quiet rule, the time zone and the one-line clearance. Its §6 and the consequence "the verb's own record … says who chose it" are replaced here. - An answer chosen in a notification shown before a newer message about the same condition is refused, @@ -92,7 +101,9 @@ ten-second notification or a restart of the notifier's bundle. - at most four answers, Details included; - the same token twice is refused the second time, and the same event is acted on once; - a token is refused from another machine, when unknown, past its day, and for a condition silenced or - cleared; + cleared; a silence of another condition is not offered and its token is refused; + - a record in the form the build before kept (`tokens` as token to index) loads, and its old token is + refused; - a verb the mesh refuses is said on the notification; - a words-only change to "Needs you" after a quiet time is said, through the event and through a reading of the state, and a quiet warning is said once after a day; @@ -108,7 +119,8 @@ ten-second notification or a restart of the notifier's bundle. cut; refused words keep their verdict and answers; a change of words is a `condition-changed`. - `cmd/mesh-controller/plain_words_test.go`: the module, held-delivery and waiting conditions offer no answer; the relogin words and the kind `relogin-needed` (ADR 0254) are held to the plain rule; a silence - with the cause `operator-answer` does not count toward a healer wanted, and one by hand still does. + with the cause `operator-answer` does not count toward a healer wanted, and one by hand still does; + "Needs you" without a button names the mesh console, and data loss offers no silence. ## References diff --git a/04-ISSUES/324-a-desk-click-could-answer-in-the-operators-name/00-report.md b/04-ISSUES/324-a-desk-click-could-answer-in-the-operators-name/00-report.md index 1cd267b8..fd3bd9c6 100644 --- a/04-ISSUES/324-a-desk-click-could-answer-in-the-operators-name/00-report.md +++ b/04-ISSUES/324-a-desk-click-could-answer-in-the-operators-name/00-report.md @@ -2,7 +2,7 @@ status: located opened: 2026-10-08 located-in: [mesh-catalog modules/messenger (the answers, the quiet rule), mesh-catalog modules/dunst (the desk's actions), mesh-controller internal/conditions (the plain rule, the change of words)] -fixed-by: novox/mesh-controller PR #145, novox/mesh-catalog PR #131 +fixed-by: novox/mesh-controller PR #145, novox/mesh-controller PR #147, novox/mesh-catalog PR #131 amended-design: 03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md --- @@ -10,9 +10,11 @@ amended-design: 03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md ## Symptom -ADR 0253 (issue 320) was merged at the operator's request before its review had finished. The -controller's part began to roll out; the build of the operator channel's holder and the desktop notifier was -published and waited for its delivery's word, so it was not yet live. The review then found: +ADR 0253 (issue 320) was merged at the operator's request before its review had finished. Its controller +part was live from 14:35 on 2026-10-08, and the build of the operator channel's holder and the desktop +notifier from 14:38: from then on the desk offered Release, Stop, Start and Restart. According to +`operator-channel.history`, no answer was performed up to 14:46; the holder records each answer there, and +none appears. The review then found: 1. **A desk click could release, stop or start a delivery, or restart a service, in the operator's name.** Any process of the operator's account can choose a desktop notification's action (`dunstctl action`), so @@ -36,6 +38,11 @@ published and waited for its delivery's word, so it was not yet live. The review says who chose it", which was false for a restart (it takes no why). A silence chosen on the desk would have counted as a hand repair toward a healer wanted. +A second review of the fix found three more: the records the live build kept (`tokens` as token to index) +could not be read by the fix's form and would have been skipped; a quiet warning known only from history +was never reminded; and a silence answer was not held to its own condition. And a click could silence a +condition that says data is gone. + ## Cause The decision outran its review: it read ADR 0234's *acknowledge* ("what any granted principal may already