From 9b3ccfc1b462dc6230d8fbab928bae98c675e2cb Mon Sep 17 00:00:00 2001 From: jochen Date: Thu, 8 Oct 2026 15:28:31 +0200 Subject: [PATCH] ADR 0254 insight: a broken module goes back at once, and only a move that adds a group is excused, at a stated cost --- ...ach-module-of-a-send-keeps-its-own-pass.md | 26 ++++++++++++------- .../48-a-module-says-how-it-is-healthy.md | 9 ++++--- 2 files changed, 21 insertions(+), 14 deletions(-) diff --git a/02-DECISIONS/0254-a-wait-for-a-persons-new-login-is-not-a-gates-failure-and-each-module-of-a-send-keeps-its-own-pass.md b/02-DECISIONS/0254-a-wait-for-a-persons-new-login-is-not-a-gates-failure-and-each-module-of-a-send-keeps-its-own-pass.md index 9374dfb3..2a43faee 100644 --- a/02-DECISIONS/0254-a-wait-for-a-persons-new-login-is-not-a-gates-failure-and-each-module-of-a-send-keeps-its-own-pass.md +++ b/02-DECISIONS/0254-a-wait-for-a-persons-new-login-is-not-a-gates-failure-and-each-module-of-a-send-keeps-its-own-pass.md @@ -141,11 +141,17 @@ anyway, since the unit that cannot run is what the gate names first. > **Progressive insight — 2026-10-08.** This consequence described the first build of the fix > (mesh-controller PR #142), and its review found it too wide. It said that while the relogin is pending > every later build of the module is excused, and that the walk carries each of them on. Since - > mesh-controller PR #146 the wait excuses **only the build whose own send put the account into its - > wait**: the account resource must have said *relogin needed* since the gate began judging, with two - > seconds allowed for the clocks. A later build sent while the login is still owed is judged as before, - > and fails at the bound if the account's manager still fails. The decision stands. What changed is - > what it covers. + > mesh-controller PR #146 the wait excuses **only a move that puts an account in a group its previous + > build did not**. The controller reads that from the two builds' manifests, which it keeps, not from + > when the machine says the wait began: that time lives in the node-engine's memory, and its restart, a + > change of its words or a clock's skew would move it. + > + > **The cost, accepted:** while a login stays owed, a later build of the same module adds no group, + > so its wait is not excused. It fails at the gate's bound and is put back, and its walk holds the other + > walks behind it as issue 318 described, until the operator logs in again. The module's + > `relogin-needed` condition says what to do the whole time. The decision stands. What changed is what + > it covers. + - **A failed send keeps the passes of its healthy modules only after the settle time, in the walk path.** In the walk of the builds waiting for a gate, a module that was healthy for the passes asked, at least the settle time after the send, keeps its pass when another module of the send fails. What still @@ -156,13 +162,13 @@ anyway, since the unit that cannot run is what the gate names first. them. A walk that fails still stops, and the next one still waits for a person's release (ADR 0236). > **Progressive insight — 2026-10-08.** The two gaps named above were closed by mesh-controller PR - > #146, from the review of the fix. A module found broken now stays broken for the rest of the judging. - > The send's verdict waits until every other module of the send has its own, or until the gate's bound: - > a fault before the settle time no longer strands the modules beside it. In a plan's own tier path, the + > #146, from the review of the fix. A module found broken is marked failed and **put back at once**, in + > the judging that found it, so that no resend declares again a build a witness has just reverted. The + > send goes on judging the other modules: its verdict, failed, waits until each of them has its own, or + > until the gate's bound. A fault before the settle time no longer strands the modules beside it. In a plan's own tier path, the > module the gate is kept on keeps its pass when it passed on its own, as the others of its tier already > did. At the verdict, every module of a failed send has one: a pass if it passed on its own, otherwise it - > is put back with what failed. A pass is counted only the gate's spacing after the one before. The cost: - > a broken module is put back when the rest of its send are judged, up to the bound, not at once. Each + > is put back with what failed. A pass is counted only the gate's spacing after the one before. Each > carried build's verdict carries only its own wait. A provider waiting for a login lists the consumers > held under it, and is urgent while any is. The decision stands: one verdict per send, and each module > keeps its own pass. diff --git a/03-DESIGN/01-to-be/48-a-module-says-how-it-is-healthy.md b/03-DESIGN/01-to-be/48-a-module-says-how-it-is-healthy.md index a7fa7f79..8985b1df 100644 --- a/03-DESIGN/01-to-be/48-a-module-says-how-it-is-healthy.md +++ b/03-DESIGN/01-to-be/48-a-module-says-how-it-is-healthy.md @@ -168,8 +168,9 @@ account that is *relogin needed* (ADR 0252), and units of that module failing in that same account, read **waits for a person**: the build did what it should, and the operator has one step left. The reading counts as a pass and is carried in the verdict; nothing is put back for it, so the account group the build added stays. Anything else unhealthy of the module beside it is judged as above. -Only the build whose own send put the account into its wait is excused; a later build sent while the login -is still owed is judged as above. +Only a move that puts an account in a group its previous build did not is excused, as the controller reads +it from the two builds' manifests. A later build sent while the login is still owed is judged as above, and +fails at the bound until the operator logs in again. The node-engine names the account on every resource that runs in an account's own manager, which is how the controller tells such a unit from one that is broken. @@ -177,8 +178,8 @@ the controller tells such a unit from one that is broken. The gate also counts, per module, the judgings in a row that found it healthy or waiting for a person; when the send fails, a module whose count reached the passes asked keeps a pass, said "on its own", and is neither put back nor left as a move no gate has seen for every other walk to wait on. A module found broken -holds the send's verdict until the modules beside it have their own, or the bound, so every module of a -failed send leaves it with a verdict: its own pass, or put back. +is marked failed and put back at once, and the send's verdict waits until the modules beside it have their +own, or the bound, so every module of a failed send leaves it with a verdict: its own pass, or put back. ## 6. A provider down is said once