From 26fbade21a4f4aea7427ccf609cf871b8c2357c3 Mon Sep 17 00:00:00 2001 From: jochen Date: Mon, 12 Oct 2026 13:29:37 +0200 Subject: [PATCH 1/4] =?UTF-8?q?To-be=2045=20=C2=A75:=20say=20what=20the=20?= =?UTF-8?q?operator-channel=20holder=20now=20does=20about=20history=20(iss?= =?UTF-8?q?ue=20271,=20ADR=200318)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PR #88 (merged 2026-10-06) already fixed the holder to read open state first, coalesce bursts and hold a start grace minute, after a new consumer replayed a morning's 96 settled events as fresh alerts. §5 still only said a rate cap; this names the rules actually built, under ADR 0318. --- .../45-a-core-that-cannot-fail-silently.md | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md b/03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md index 8fb7183f..91226434 100644 --- a/03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md +++ b/03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md @@ -2,8 +2,9 @@ layer: to-be status: in-progress code: [mesh-controller, mesh-host, mesh-tools, mesh-catalog, mesh-sdk, mesh-lab] -updated: 2026-10-11 +updated: 2026-10-12 decisions: + - "ADR 0318" - "ADR 0293" - "ADR 0289" - "ADR 0285" @@ -375,7 +376,23 @@ section; to-be 46 §13 builds what follows from it. (warning); on `condition-cleared`, by editing the first message where the channel can. A silenced condition sends nothing. Urgent goes to both channels; warning to the desktop notifier when the operator's session is there, otherwise to Telegram. + *Amended 2026-10-12, ADR 0318:* **history is never news.** On start, every ten minutes, and at once + when an event older than its last reading arrives, the holder reads the open conditions from the + controller and takes them as its state; an event is acted on only when it is newer than that reading + (five seconds of clock slack) and its own `at` is no more than ten minutes old — otherwise it is + recorded as state and never said. A condition open in the holder's state but absent from the + controller's open set ended while the holder was away, and is closed quietly: edited where a channel + can, never sent to wake a desktop. A clearing of something never said says nothing, and a message + still waiting is dropped the moment its clearing is read. Every urgent condition a reading finds open + and unsaid is said once, together, naming all of them. A grace minute follows every start or + reassignment: nothing is sent in it except that one message. - **Rate:** at most twenty messages an hour; the excess is folded into one message naming them all. + *Amended 2026-10-12, ADR 0318:* a channel holds what it has to say for thirty seconds from the first + item and sends it together — alone as itself, several as one digest, one line each; an urgent item + breaks a thirty-second quiet at once. The desktop keeps a gentler rhythm than Telegram: a warning + reaches it at most once every fifteen minutes, never an urgent one. Reaching the cap is said once, in + its own message, and what it holds back waits for the next digest the hour allows, rather than one + message per excess item. - **What may leave the mesh:** roles and words. A message carrying an address, a path or anything shaped like a secret is refused by the holder and raises `channel-refused` instead. *Amended:* the mesh's own machine names may appear too; a concrete detail travels as a reference only From ac5bdeb178609c46398e6c1ab7845068832af5c1 Mon Sep 17 00:00:00 2001 From: jochen Date: Mon, 12 Oct 2026 21:07:37 +0200 Subject: [PATCH 2/4] =?UTF-8?q?To-be=2045=20=C2=A75:=20match=20ADR=200318?= =?UTF-8?q?=20version=2010,=20so=20an=20urgent=20message=20is=20never=20fo?= =?UTF-8?q?lded=20and=20a=20backlog=20gets=20its=20answers=20(issue=20271)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../45-a-core-that-cannot-fail-silently.md | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md b/03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md index 91226434..4f169223 100644 --- a/03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md +++ b/03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md @@ -380,19 +380,22 @@ section; to-be 46 §13 builds what follows from it. when an event older than its last reading arrives, the holder reads the open conditions from the controller and takes them as its state; an event is acted on only when it is newer than that reading (five seconds of clock slack) and its own `at` is no more than ten minutes old — otherwise it is - recorded as state and never said. A condition open in the holder's state but absent from the + recorded as state and never said as its own message. Ends and drops below are recorded in the + holder's own history. A condition open in the holder's state but absent from the controller's open set ended while the holder was away, and is closed quietly: edited where a channel can, never sent to wake a desktop. A clearing of something never said says nothing, and a message still waiting is dropped the moment its clearing is read. Every urgent condition a reading finds open - and unsaid is said once, together, naming all of them. A grace minute follows every start or - reassignment: nothing is sent in it except that one message. + and unsaid is named once, together, in one digest; when the grace minute ends, each still open and + unacknowledged is then sent as its own message with its answers. A grace minute follows every start or + reassignment: nothing is sent in it except that one digest, not even a fresh urgent event. - **Rate:** at most twenty messages an hour; the excess is folded into one message naming them all. *Amended 2026-10-12, ADR 0318:* a channel holds what it has to say for thirty seconds from the first - item and sends it together — alone as itself, several as one digest, one line each; an urgent item - breaks a thirty-second quiet at once. The desktop keeps a gentler rhythm than Telegram: a warning - reaches it at most once every fifteen minutes, never an urgent one. Reaching the cap is said once, in - its own message, and what it holds back waits for the next digest the hour allows, rather than one - message per excess item. + item and sends it together — alone as itself, several as one digest of headlines, one line each, with + no answers; a message that offers answers is never folded into a digest but sent on its own, and an + urgent item breaks a thirty-second quiet at once. The desktop keeps a gentler rhythm than Telegram: a + warning reaches it at most once every fifteen minutes, never an urgent one. Reaching the cap is said + once, in its own message; what it holds back, urgent included, waits until the hour allows, when each + message that offers answers is sent on its own with them and only the rest goes as one digest. - **What may leave the mesh:** roles and words. A message carrying an address, a path or anything shaped like a secret is refused by the holder and raises `channel-refused` instead. *Amended:* the mesh's own machine names may appear too; a concrete detail travels as a reference only From c6d92446e6973876477bfb9f876eba0780cb65ff Mon Sep 17 00:00:00 2001 From: jochen Date: Mon, 12 Oct 2026 21:09:24 +0200 Subject: [PATCH 3/4] =?UTF-8?q?To-be=2045=20=C2=A75:=20say=20what=20the=20?= =?UTF-8?q?holder=20does=20while=20the=20controller=20cannot=20be=20read,?= =?UTF-8?q?=20and=20that=20every=20fold=20and=20hold=20is=20recorded=20(AD?= =?UTF-8?q?R=200318,=20issue=20271)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../01-to-be/45-a-core-that-cannot-fail-silently.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md b/03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md index fe551841..01249661 100644 --- a/03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md +++ b/03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md @@ -384,10 +384,11 @@ section; to-be 46 §13 builds what follows from it. when an event older than its last reading arrives, the holder reads the open conditions from the controller and takes them as its state; an event is acted on only when it is newer than that reading (five seconds of clock slack) and its own `at` is no more than ten minutes old — otherwise it is - recorded as state and never said as its own message. Ends and drops below are recorded in the - holder's own history. A condition open in the holder's state but absent from the - controller's open set ended while the holder was away, and is closed quietly: edited where a channel - can, never sent to wake a desktop. A clearing of something never said says nothing, and a message + recorded as state and never said as its own message. While the controller cannot be read, the `at` + test alone decides, and the reading is asked for again until it is had. Every close, drop, fold into + a digest and hold under the cap is recorded in the holder's own history. A condition open in the + holder's state but absent from the controller's open set ended while the holder was away, and is + closed quietly: edited where a channel can, never sent to wake a desktop. A clearing of something never said says nothing, and a message still waiting is dropped the moment its clearing is read. Every urgent condition a reading finds open and unsaid is named once, together, in one digest; when the grace minute ends, each still open and unacknowledged is then sent as its own message with its answers. A grace minute follows every start or From d69c8929e9df1f3394726a46ab16c59f90278326 Mon Sep 17 00:00:00 2001 From: jochen Date: Mon, 12 Oct 2026 21:13:10 +0200 Subject: [PATCH 4/4] =?UTF-8?q?To-be=2045=20=C2=A75:=20say=20urgent=20is?= =?UTF-8?q?=20never=20held=20to=20the=20desktop's=20rhythm,=20and=20give?= =?UTF-8?q?=20clause=204=20its=20outside-a-start=20case=20and=20the=20cap?= =?UTF-8?q?=20(ADR=200318,=20review=2097)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../45-a-core-that-cannot-fail-silently.md | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md b/03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md index 01249661..2bee12f4 100644 --- a/03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md +++ b/03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md @@ -388,18 +388,21 @@ section; to-be 46 §13 builds what follows from it. test alone decides, and the reading is asked for again until it is had. Every close, drop, fold into a digest and hold under the cap is recorded in the holder's own history. A condition open in the holder's state but absent from the controller's open set ended while the holder was away, and is - closed quietly: edited where a channel can, never sent to wake a desktop. A clearing of something never said says nothing, and a message - still waiting is dropped the moment its clearing is read. Every urgent condition a reading finds open - and unsaid is named once, together, in one digest; when the grace minute ends, each still open and - unacknowledged is then sent as its own message with its answers. A grace minute follows every start or - reassignment: nothing is sent in it except that one digest, not even a fresh urgent event. + closed quietly: edited where a channel can, never sent to wake a desktop. A clearing of something + never said says nothing, and a message still waiting is dropped the moment its clearing is read. + Every urgent condition a reading finds open and unsaid is named once, together, in one digest; when + the grace minute ends, or at once when the reading is not a start's, each still open and + unacknowledged is then sent as its own message with its answers, under the cap. A grace minute + follows every start or reassignment: nothing is sent in it except that one digest, not even a fresh + urgent event. - **Rate:** at most twenty messages an hour; the excess is folded into one message naming them all. *Amended 2026-10-12, ADR 0318:* a channel holds what it has to say for thirty seconds from the first item and sends it together — alone as itself, several as one digest of headlines, one line each, with no answers; a message that offers answers is never folded into a digest but sent on its own, and an - urgent item breaks a thirty-second quiet at once. The desktop keeps a gentler rhythm than Telegram: a - warning reaches it at most once every fifteen minutes, never an urgent one. Reaching the cap is said - once, in its own message; what it holds back, urgent included, waits until the hour allows, when each + urgent item breaks a thirty-second quiet at once, except inside the grace minute. The desktop keeps a + gentler rhythm than Telegram: a warning reaches it at most once every fifteen minutes; an urgent + message is never held to that rhythm, and still goes to both channels. Reaching the cap is said once, + in its own message; what it holds back, urgent included, waits until the hour allows, when each message that offers answers is sent on its own with them and only the rest goes as one digest. - **What may leave the mesh:** roles and words. A message carrying an address, a path or anything shaped like a secret is refused by the holder and raises `channel-refused` instead.