Give each restated acceptance test of design 47 its own proof, and add puts, the hand path and the builds bucket to as-is 04 (issue 1130, review round 1)

Tests 18 and 19 do not cover tests 3, 7, 9, 10 and 11 as restated, so each now names the test or live read that proves it, or says it is not yet proved.
2026-10-26 01:27:21 +01:00
parent c255fd071c
commit 9eb963d5f1
2 changed files with 34 additions and 5 deletions
@@ -23,6 +23,7 @@ decisions:
  - "ADR 0528"
  - "ADR 0529"
  - "ADR 0539"
+  - "ADR 0546"
  - "ADR 0547"
 ---

@@ -70,6 +71,10 @@ for each merge, ordered it in tiers and sent whole declarations to the machines;
  nodes by name that is online (one ring), and rule 4 always holds, because the mesh keeps no `step`. It also runs
  the composition check the checker reads. Its differences bucket, from release 5's comparison with what the
  controller sent, is no longer written.
+- **Two ways around the rules, both by hand.** A **put** (ADR 0546), written by the assigner's tool `assigner_put`,
+  puts one version of a module on one node: while a put owns a node's want of a module, from its ask until it ends,
+  the rules pass over that want. And the operator's credential may write a want itself, with a composition the
+  operator signed and wrote through mesh-sdk's `mesh-hand-compose` (ADR 0539 §10).
 - **The node agent**, a process of the node-engine (`mesh-host`) on every node, watches its node's wants and its
  bucket of compositions, and applies a module only when the want's fingerprint or digest differs from what runs,
  and only the composition whose digest the want names, after checking its signature. It asks its node's
@@ -106,8 +111,9 @@ for each merge, ordered it in tiers and sent whole declarations to the machines;

 Fingerprints, builds, verdicts, wants and haves are keys in the parts' buckets on the bus; compositions are in each
 node's `composed-<node>` bucket, readable only by that node, with a file over 64 KiB in the object store; builds'
-files are in the artifact store by digest; packages are versions in the package registry. The controller's
-assignments bucket keeps placement alone, and its rollouts bucket keeps the record of releases 1 to 5 read-only;
+files are in the artifact store by digest; packages are versions in the package registry. The controller
+still records every build it takes in, in its builds bucket (`RecordBuild` in `cmd/mesh-controller/key_takein.go`); its
+assignments bucket keeps placement alone, and its rollouts bucket keeps the record of releases 1 to 5 read-only, and
 nothing writes it now.

 ## What is not covered
@@ -819,7 +819,30 @@ What the build proves before this design is implemented (research 055's directio

 Tests 1 to 12 are stated as they hold from release 6. Tests 1, 3, 7, 8, 9, 10 and 11 were first proved by
 milestones 1 to 5 in the shape of their time, the controller's plans and what it sent (the milestones table keeps
-it); restated, they are proved again by release 6's tests 18 and 19.
+it). Restated, each has its own proof, or says it has none yet:
+
+- **Tests 1 and 8, and the assigner's half of test 7:** test 18 (scenario A, three repositories through the keys
+  alone; scenario D, the assigner replaced, in the assigner's integration test
+  `TestTheAssignerReplacedResumesWithNothingLostOrRepeated`). **Tests 8 and 12:** test 19 (the window, the batches,
+  the plans and their verbs deleted from the code).
+- **Test 3:** the node-engine's integration test `TestNatsADataModuleAsksItsBackupFirstAndIsHeldWhenItFails`
+  (`cmd/mesh-host/nodeagent_integration_test.go`, R6-A AC5) proves the backup first and the hold with phase `held`.
+  That every other want moves meanwhile is not yet proved by a test; it shows on the live mesh at the first failed
+  backup, in the view's wants beside the haves.
+- **Test 7, the node agent's and the controller's halves:** a node agent restarted on its own haves applies nothing
+  (`internal/agent/agent_test.go`, `TestStartingOnItsOwnHaveAppliesNothing`, at the unit level), and a controller
+  writes a composition once and again only when it changes (`composed_writer_test.go`,
+  `TestACompositionIsWrittenOnceAndAgainOnlyWhenItChanges`). A controller replaced while a source revision is being
+  delivered is not yet proved; it shows at the next delivery of the controller, in the view.
+- **Test 9:** not yet proved under release 6. Each rule holding a want back on its own is a unit test of the assigner
+  (`internal/assign/wants_test.go`, `TestEachRuleHoldsTheWantBack`); the hotfix beside a moving source revision shows
+  live at the first such pair, read in the view's wants and haves.
+- **Test 10:** a live read on 2026-10-26 at 01:20: ace's have of `avahi` named its fingerprint and composition digest,
+  its want named the same, and the builder's build of that fingerprint (`builder_build`) named its artifact by digest.
+  In all, 303 wants equalled their haves in fingerprint and digest.
+- **Test 11:** half proved. The node agent applies only the composition its current want names
+  (`internal/agent/agent_test.go`, `TestTheRevisionAWantNamesIsAppliedFromHistory`); two merges of one repository
+  while its modules move are not yet proved live, and show at the first such pair in the view.

 From ADR 0429 (research 063's done-when, and the live proof each of its releases names):

@@ -830,8 +853,8 @@ From ADR 0429 (research 063's done-when, and the live proof each of its releases
    writes equals the controller's source fingerprint.
 16. A merge builds nothing its check built, and a hotfix's build waits for no other build.
 17. A day of deliveries in release 5 showed no difference between the assigner's wants and what the controller
-    sent that the six rules then in force do not explain; the differences bucket is kept read-only as that
-    evidence (ADR 0539 §8).
+    sent that the six rules then in force did not explain. That was proved in R4g; the differences bucket is kept
+    read-only as its evidence (ADR 0539 §8).
 18. On the live mesh a milestone of three repositories reaches every node through the keys alone (research 063's
    scenario A), and the assigner replaced in the middle of it resumes with nothing lost or repeated (scenario
    D, once).