Cut design 47's release 4 into R4a to R4g by the orders it hides (ADR 0453)

2026-10-20 06:00:11 +00:00
parent f09cc22d99
commit 3e061bbd99
1 changed files with 10 additions and 8 deletions
@@ -2,8 +2,10 @@
 layer: to-be
 status: in-progress
 code: [mesh-controller, mesh-catalog modules/mesh-delivery, mesh-delivery, mesh-host, mesh-sdk]
-updated: 2026-10-19
+updated: 2026-10-20
 decisions:
+  - "ADR 0453"
+  - "ADR 0452"
  - "ADR 0450"
  - "ADR 0449"
  - "ADR 0447"
@@ -101,7 +103,7 @@ source revision is derived from the keys: every **want** equals its module's **f
  It also runs the **composition check**: whether the machines a change touches still compose with it, read
  from the keys the indexer and the builder hold and from what the controller keeps of machines, settings and
  grants, with the composition it sends with (ADR 0446). Its module
-  is made in release 4 for that check alone; its wants come in release 5.
+  is made in R4c for that check alone; its wants come in release 5.
 - **The node agent**, the node-engine's own process, applies its wants one module at a time, backs up a data
  module first, and writes its haves.
 - **The watchman** turns the bus's connections into presence and mirrors every key whose next move a machine
@@ -326,8 +328,8 @@ commit on the SDK's trunk or the head of an SDK pull request the forge holds, op

 *ADR 0444, ADR 0445, ADR 0446, ADR 0447; research 058.*

-Until release 4 is delivered, the subsections above are the rule, with their two statuses. From its delivery, a
-check is this:
+Until the status switch of release 4 (R4f) is delivered, the subsections above are the rule, with their two statuses.
+From its delivery, a check is this:

 - **One status per change.** A pull request carries one required status, `mesh/check`, written by the checker
  on its head; it passes only when the head merged onto its trunk's head passed its tests and the composition
@@ -514,9 +516,9 @@ delivery time.
 - **Builds and tests run directly**, as the build seat's own account on its node, in no container. The
  build module of each module's language runs its tests by that language's convention; no repository's
  script or toolchain line decides it, hq's alone excepted until issue 1296 (ADR 0445).
- **A judge has an account of its own, until release 4 is delivered.** Until then, a judge built from a sibling's
+- **A judge has an account of its own, until release 4 is delivered (R4f).** Until then, a judge built from a sibling's
  merge (ADR 0382 §3) is built and run as a second account of the Go build module, whose home, configuration and
-  cache the build seat's account cannot write, so a check's script cannot change it. From release 4 no judge is
+  cache the build seat's account cannot write, so a check's script cannot change it. From R4f no judge is
  built from a change and the account is not made (ADR 0446 §5).
 - **Every dependency comes by the version its lock file names**, checked against its checksum: the mesh's own
  code from the mesh's forge, its own packages from its package registry, any other from its public source.
@@ -686,7 +688,7 @@ development, the check's share about a minute):
  group's merges (ADR 0418 §1, §5, §6).
 - The controller's tables of builds, build requests, rollouts and their tiers, batches and merges, and
  assignments; the record mirrors, probe D17's audit and healer H6 for those kinds (ADR 0408).
- At release 4's delivery: `merge-check.sh` and its `# mesh-check-toolchain` line in every repository a module is
+- At release 4's deliveries (R4f for the merge gate, the judge and the two statuses; R4g for the scripts): `merge-check.sh` and its `# mesh-check-toolchain` line in every repository a module is
  built from, hq's alone kept until issue 1296 (ADR 0445 §6); the controller's merge gate, composing every
  machine from clones and throwaway stores (ADR 0446 §1, §6); the judge built from a change and the Go build
  module's second account for it (ADR 0446 §5); and the two statuses `mesh/merge-gate` and `mesh/repo-check`
@@ -711,7 +713,7 @@ release reports the controller's code lines against research 063's baseline (acc
 | 3 fix | A group approved together merges in one pass and goes out in one delivery plan, also when its members' tests read each other's repositories | 1 | mesh-catalog (mesh-delivery, gitea) | 1082, 1049, 1047, 1083, 1079 (1084 closed as its duplicate) |
 | 5 | One read of a module on a node names the commit, build and rollout that put it there | 10, 12 | mesh-controller, mesh-catalog (mesh-config, nats) | 981 |
 | 5b | Decided: building and delivering leave the controller for parts that watch and write keys in the repository `mesh-delivery`, landing in six releases (ADR 0429); the forge module makes that repository from its config, protected before any team reaches it (ADR 0428) | — (ADR 0429 names them: 13 to 20) | hq, mesh-catalog (gitea) | 1117, 1124, 1128 |
-| 6 | Folded into release 4 by ADR 0429 §10: installed toolchains, builders fetching over SSH with their own key, and an SDK change shipping with its users are built in the builder's new home, so the builder is changed once | (2, 4: proved by release 4) | — | 979, 971 (moved to release 4) |
+| 6 | Folded into release 4 by ADR 0429 §10 (the fetch over SSH in R4c, the cut-over in R4e): installed toolchains, builders fetching over SSH with their own key, and an SDK change shipping with its users are built in the builder's new home, so the builder is changed once | (2, 4: proved by release 4) | — | 979, 971 (moved to release 4) |
 | R1a | The node-engine, the controller and the parts can read one layout of the have, presence, pulse and stuck keys: mesh-sdk ships it before its users | — (13, 14 need it) | mesh-sdk | 1131 (key layouts) |
 | R1b | Every node writes what it runs of each module, on its own keys and nobody else's, and the bus says to one part when a connection opens and closes | 13 in part | the node-engine (`mesh-host`), mesh-controller | 1132 (have keys), 1142 (the node-engine's check, its tests half), 1136 (the have bucket and its grants), 1145 (a module and a build per resource), 1146 (a new repository's first module registered at its merge's Approve), 1147 (the bus's connect events for the watchman), 1160 (a plan passes a machine silent at a middle tier), 1162 (the have bucket takes a node's facts) |
 | R1c | The operator sees every module on every node, with its build, phase and health, in `mesh-delivery-cli` (aliased `nox-delivery`) and its web view | 13 | mesh-delivery (view) | 1134 (the view), 1137 (the alias, in the view's manifest) |