Design 47: the switch needs release 5's bus grants and the operator's key first, the record hold's exception after the switch, and nothing checks the budgets (review of 4b514e4, issue 1130)

2026-10-24 21:06:41 +02:00
parent 4b514e4d69
commit 3dbb5d4e65
1 changed files with 14 additions and 5 deletions
@@ -581,7 +581,9 @@ backup holder backs up nothing, and the have says so.
  no want naming a composition judged to recreate a container or move data, at a new fingerprint or a new
  revision alike, until the operator answers its ask yes, on the phone or in the view; a move judged neither is
  written as any want, and so is a module the node never ran; one that cannot be judged waits for the ask, which
-  says why. Each judgement and the way it went are shown in the view and named in the ask (ADR 0539 §14).
+  says why. One exception, right after the switch: with no readable want, and a have from the old node-engine at
+  the module's newest fingerprint naming no composition, the want is written with no record hold, because the
+  node agent applies nothing when the composition equals the declaration it kept (ADR 0539 §9). Each judgement and the way it went are shown in the view and named in the ask (ADR 0539 §14).
 - **The bus is never moved by the assigner.** The controller's `bus upgrade` checks as before and then asks the
  operator to write the bus node's want with the operator's credential, recorded, until issue 1125 settles the
  bus's replacement (ADR 0539 §15).
@@ -608,8 +610,9 @@ equal to its want, running and healthy, which the view says as `settled` for eac
 `delivered` for the source revision. A **leaf** delivery's budget is three minutes, a **core** delivery's ten.
 A move held for a person, a failed backup among them, is shown and held to no budget. The **fix time**
 (ADR 0313) runs from an issue's first move to `fixing` to its last fix delivered, and contains the delivery
-time. No verb of the gate answers the week's times since release 6: `times` went with the plans
-(ADR 0539 §17), and the view's events carry what a measure of it reads.
+time. Since release 6 nothing checks these budgets: the over-budget condition and the gate's `times` went with
+the plans (ADR 0539 §17). Their check is a queued finding (issue 1945, note 10): a reader of the view's `settled`
+and `delivered` events.

 ## Builds without a toolchain image

@@ -745,7 +748,13 @@ the operator for the bus node's want (ADR 0539 §15).
  node-engine is judged by its launcher, and the new controller by the node-engine's witness. A node away during
  the switch finds its last declaration on the bus's stream of declarations when it returns; the controller
  deletes that stream and the nodes' consumers only once every node's have names the new node-engine. The
-  merge waits until every node is present (ADR 0539 §11). At its first start the new controller deletes the
+  merge waits until every node is present (ADR 0539 §11). The switch works only because the bus's user list that
+  release 5's controller composes already grants what release 6 uses: the controller writing compositions and
+  their digests, each node-engine reading its own compositions and wants, asking its backup holder and hearing the
+  backup's end, the assigner reading the digests, and the operator's account writing the hand path. That grant is
+  delivered first by release 5's controller, like issue 1942, as issue 1945's fix before the switch. The
+  node-engine's setting `operator-signers` must hold the operator's public key before the switch, or no operator
+  key is trusted and the hand path cannot work (ADR 0539 §3). At its first start the new controller deletes the
  buckets of plan state (the merge window's, the silent sends' and the building plan's hold) and says each
  deletion as its event (ADR 0539 §13).

@@ -917,7 +926,7 @@ release reports the controller's code lines against research 063's baseline (acc
 | R4e | The controller asks no build: a build is keyed by its fingerprint, the new form becomes the only one as one group, and a merge builds nothing its check built; builders fetch over SSH, so an SDK change ships with its users; the vendored copies leave mesh-controller and mesh-sdk; delivered only once the builder's artifact digests equal build-agent's (ADR 0453 clauses 2, 4, 5, 6) | 16, 2, 4 in part | mesh-controller (builds are no longer asked), mesh-delivery (builder), mesh-sdk | 979 (the installed toolchains; closed with the toolchain images in R4g), 1304, the controller asking no build (opened when it is prepared) |
 | R4f | A pull request carries one required status that says what it proved and how long each part took; the controller's composition check and its replays are deleted with the two old statuses; the controller's deletions R3e makes possible go; each level's times are measured, and a bound fails a repository from the first check that meets it (ADR 0447, ADR 0450 §8, ADR 0453 clauses 4, 9, 10) | 21, 22, 23, 24 (the status; the scripts' absence is proved in R4g) | mesh-delivery (checker, assigner), mesh-controller (composition check, replays, `delivery-plan`, `forget-checks`, the asker `mesh-delivery` deleted), mesh-catalog (gitea) | 1299 (the composition check deleted; closes issue 709, the replays' socket), 1300, 1301, 1302 (one status), 1305 (ADR 0482 §8), 1318 |
 | R4g | The last milestone of release 4 and release 5 as one, with one switch-over and no rehearsal (ADR 0524 §1): builds and checks are asks on streams that each build node pulls when it has a free slot, deliveries first, with nothing holding checks and no controller queue (ADR 0525); the assigner is made with its composition check, writes each node's wants compared with what the controller sends and every difference, and the view answers the asks that need no proof of who answered (ADR 0528, ADR 0437 §10); no module's fingerprint takes the builder (ADR 0530); the scripts of the repositories a module is built from, build-agent with its socket and Dockerfile code, the toolchain images and the controller's build code go, and the builder delivers its own module, the build modules and the controller from its keys (ADR 0453 clauses 5, 8, 10; ADR 0524 §5, §7); the ways to deliver without the builder are recorded (ADR 0526); hq's four checks are Go tests (ADR 0527); each repository's script goes (ADR 0529); the word for the composition check's predecessor is struck. Its pull requests are opened only after five readings, the revert path read, not shown on a test merge (ADR 0524 §3) | 4 (from R4g mesh-build-image, rootless, is the only part that builds an image: ADR 0487 §7), 17, 24 (no `merge-check.sh` in a repository a module is built from) | mesh-sdk, mesh-controller (build-agent removed), mesh-delivery, mesh-catalog, mesh-tools, mesh-tools-go, the node-engine (`mesh-host`), mesh-media-catalog, okioki, hq | 1887 (the flow), 1297 (the assigner), 1295 (`merge-check.sh` goes), 979 (closed with the toolchain images), 1296 and 1303 (hq's check, the old word struck), 1299, 1305, 1294, 1318 (the controller's deletions) |
-| R6 | Each node applies from its wants the compositions the controller signs for it, a new version reaches the module's canary first and the rest once it is healthy there, a move a person must allow is asked before its want, the view says what is moving, settled, stuck and delivered, and the plans are deleted from the code; switched over by release 5's last plan (ADR 0539) | 18, 19, 20 | mesh-sdk, the node-engine (`mesh-host`: the node agent), mesh-controller (compositions, credentials on a done build; plans deleted), mesh-delivery (assigner, watchman, view), mesh-catalog (the gate, the messenger, the issue tracker, the backup holder), hq | 1942 (the planner puts the node-engine and the controller in one tier for the switch; delivered first), 1943 (mesh-sdk: the composition's layout and signature, the want's digest, `mesh-compose`, the verb tables without the plan verbs), 1944 (the node agent), 1945 (the controller writes compositions and grants; the plans and the push deleted), 1946 (the gate keeps the merge's states; the messenger and the issue tracker hear the view), 1906 (the assigner's seventh rule and its asks, the watchman's pulses for wants, the view's wants and events), 1130 (hq) |
+| R6 | Each node applies from its wants the compositions the controller signs for it, a new version reaches the module's canary first and the rest once it is healthy there, a move a person must allow is asked before its want, the view says what is moving, settled, stuck and delivered, and the plans are deleted from the code; switched over by release 5's last plan (ADR 0539) | 18, 19, 20 | mesh-sdk, the node-engine (`mesh-host`: the node agent), mesh-controller (compositions, credentials on a done build; plans deleted), mesh-delivery (assigner, watchman, view), mesh-catalog (the gate, the messenger, the issue tracker, the backup holder), hq | 1942 (the planner puts the node-engine and the controller in one tier for the switch; delivered first), 1945's fix before the switch (the bus's user list grants what release 6 uses; delivered first), 1943 (mesh-sdk: the composition's layout and signature, the want's digest, `mesh-compose`, the verb tables without the plan verbs), 1944 (the node agent), 1945 (the controller writes compositions and grants; the plans and the push deleted), 1946 (the gate keeps the merge's states; the messenger and the issue tracker hear the view), 1906 (the assigner's seventh rule and its asks, the watchman's pulses for wants, the view's wants and events), 1130 (hq) |

 Release 5 (the assigner's wants, compared only) is not a milestone of its own: ADR 0524 §1 folds it into R4g, whose row above holds
 it. Release 6 is milestone R6, prepared on 2026-10-24 with ADR 0539. Its prepare step found six repositories where its row first