From 8b6c306cfdb9f2337d287a94b81fc88dc6e16a5b Mon Sep 17 00:00:00 2001 From: jochen Date: Sat, 10 Oct 2026 19:53:36 +0200 Subject: [PATCH] ADR 0282: a core send sets aside a leaf judgement; the window row says how it was split; the repository rule cites ADR 0276 From the independent review: a core delivery could wait on a leaf judgement past its ten minutes, the window figure's split was not stated beside it, and the one-repository rule was credited to the wrong issue. --- 00-META/glossary.md | 2 ++ ...tes-of-its-merge-and-a-core-module-within-ten.md | 13 ++++++++----- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/00-META/glossary.md b/00-META/glossary.md index b8c15608..a6abceca 100644 --- a/00-META/glossary.md +++ b/00-META/glossary.md @@ -370,6 +370,8 @@ planner, the walk). **Downstream of** Module, Core, Health and repair and Data. the node-engine, the tool runner, the bus, mesh-delivery) or the mesh's resolver, whose judgement protects the mesh's ability to reach a node at all; a leaf module is every other module. Proposed by [ADR 0282](../02-DECISIONS/0282-a-fix-to-a-leaf-module-runs-healthy-on-every-node-within-five-minutes-of-its-merge-and-a-core-module-within-ten.md). + Not a *core component* (ADR 0236's controller, node-engine, tool runner and bus, each with a health probe): + the core modules add mesh-delivery and the resolver. - **delivery time** — from a delivery's merge to every node of its deploy plan that is heard from running its modules' builds and reporting them healthy. Its **delivery budget** is what it is held to: five minutes for a leaf module, ten for a core module (proposed by ADR 0282). Not the walk's time, which ends at the send. diff --git a/02-DECISIONS/0282-a-fix-to-a-leaf-module-runs-healthy-on-every-node-within-five-minutes-of-its-merge-and-a-core-module-within-ten.md b/02-DECISIONS/0282-a-fix-to-a-leaf-module-runs-healthy-on-every-node-within-five-minutes-of-its-merge-and-a-core-module-within-ten.md index 8e4dcbfd..f0093172 100644 --- a/02-DECISIONS/0282-a-fix-to-a-leaf-module-runs-healthy-on-every-node-within-five-minutes-of-its-merge-and-a-core-module-within-ten.md +++ b/02-DECISIONS/0282-a-fix-to-a-leaf-module-runs-healthy-on-every-node-within-five-minutes-of-its-merge-and-a-core-module-within-ten.md @@ -30,7 +30,7 @@ into another are not counted. | Phase, in minutes | Leaf: median | Leaf: worst | Leaf: share | Core: median | Core: worst | Core: share | |---|---|---|---|---|---|---| -| the merge window: merge to walk opened | 0.5 | 2.1 | 9 % | 0.4 | 2.1 | 7 % | +| the merge window: merge to walk opened (a wait over 2.2 counted as 1.8 of window, the rest as waiting) | 0.5 | 2.1 | 9 % | 0.4 | 2.1 | 7 % | | waiting behind another walk | 0.3 | 59.1 | 47 % | 0.0 | 1.8 | 1 % | | build | 0.4 | 1.6 | 5 % | 1.2 | 4.1 | 14 % | | built to sent to the first node | 0.3 | 0.6 | 3 % | 0.5 | 3.0 | 5 % | @@ -125,7 +125,8 @@ and applying only options 1, 2 and 4 gives a median of 3.9 and a worst of 9.6 (1 every node of its deploy plan that is heard from runs its modules' builds and reports them healthy. A node not heard from (a laptop asleep) is listed and not waited for, as ADR 0236 leaves it. **A leaf module's delivery budget is five minutes. A core module's is ten.** A delivery held for a person (a module that records, a hold, - a bus step) is shown and not held to a budget: its wait is the person's, and S16 and D14 already speak for it. + a bus step) is shown and not held to a budget: its wait is the person's, and the controller's + condition for a walk left waiting (S16) and its probe of stalled deliveries (D14) already speak for it. - A **core module** is one on the controller's own path (the controller, the node-engine, the tool runner, the bus, mesh-delivery) or the mesh's resolver. A **leaf module** is every other module. A delivery's class is that of the slowest-budgeted module it moves. @@ -144,8 +145,10 @@ and applying only options 1, 2 and 4 gives a median of 3.9 and a worst of 9.6 (1 verdict, so ADR 0236 decision 4a (no build reaches a node without a judgement) holds as written; - **a core walk keeps its ground**: no leaf build is sent to a node where a core build is being judged, and while a new controller is judged, no leaf judgement counts a reading; those resume when it passes or is put - back; - - two walks of one repository never run at once (issue 335's rule stands), and a merge into a repository with + back. A core send never waits for a leaf judgement: a leaf judgement open on that node is set aside without + a verdict and starts again, from its first reading, after the core build's verdict, so a core delivery is + not held past its budget by a leaf one; + - two walks of one repository never run at once (a repository's later merge contains its earlier ones, ADR 0276 decision 2), and a merge into a repository with an open walk joins that repository's next batch. This replaces ADR 0276 decision 4's "one walk at a time"; its rule that a walk which started is never @@ -181,7 +184,7 @@ and applying only options 1, 2 and 4 gives a median of 3.9 and a worst of 9.6 (1 - **A leaf fix lands within five minutes when nothing else is in its way**, by the measurement's own estimate: build 0.4, send 0.3, one or two readings at about a minute each, the rest a quarter of a minute. - **A burst of unrelated merges no longer queues**; it walks in parallel, and one node judges one walk at a time. - The controller holds several open walks, and every reader of a walk (`plans`, S3, S16, `plan-moved`, + The controller holds several open walks, and every reader of a walk (`plans`, the walk's conditions, `plan-moved`, mesh-delivery) reads a list where it read one. - **A leaf module is judged on less evidence.** A build that fails after its last reading reaches the rest. That is bounded: the rest's first healthy report is recorded, a failure there is a condition on that node, and the