From a11b14f7ae78f9f5dcfcb0f86a7a2b0669d8a7ab Mon Sep 17 00:00:00 2001 From: jochen Date: Fri, 9 Oct 2026 02:17:32 +0200 Subject: [PATCH] ADR 0269 accepted: note the narrowing on ADR 0118, and give it a home in the node-engine's design The operator accepted ADR 0269 on 2026-10-09. ADR 0118 gets the dated note the README asks for where a later record narrows its mechanism. The node-engine's to-be design names the decision and says what it changes, which the cycle check requires of an accepted record. --- ...ng-gives-a-unit-back-the-state-it-was-found-in.md | 6 ++++++ ...laration-stopped-is-started-again-when-it-goes.md | 2 +- 03-DESIGN/01-to-be/05-the-node-host.md | 12 +++++++++++- 3 files changed, 18 insertions(+), 2 deletions(-) diff --git a/02-DECISIONS/0118-undeclaring-gives-a-unit-back-the-state-it-was-found-in.md b/02-DECISIONS/0118-undeclaring-gives-a-unit-back-the-state-it-was-found-in.md index c5958f13..7e11f52b 100644 --- a/02-DECISIONS/0118-undeclaring-gives-a-unit-back-the-state-it-was-found-in.md +++ b/02-DECISIONS/0118-undeclaring-gives-a-unit-back-the-state-it-was-found-in.md @@ -80,6 +80,12 @@ records the state it first found the unit in, and undeclaring returns the unit t manager: running before the mesh arrived, running after it leaves. - **A unit the mesh started is stopped again**, and one it enabled is disabled again — the packet filter a converge loaded, which returning to adopted unloads. +> **Narrowed, not replaced — 2026-10-09, by [ADR 0269](0269-what-the-meshs-own-declaration-stopped-is-started-again-when-it-goes.md).** +> "Never started on the way out" has one exception. The host now records what the mesh declared beside +> what it found. A unit found running or enabled that the mesh's own declaration held stopped or disabled +> is started or enabled again when that declaration goes, but only while it is still exactly as the mesh +> held it: a masked unit, or one changed since, is left as it is. The rest of this record stands. + - **Never started on the way out.** A unit the mesh stopped is not started again when its declaration goes; starting something is a decision, and the operator makes it. - **Unknown is left alone.** A record written before the host kept what it found says nothing diff --git a/02-DECISIONS/0269-what-the-meshs-own-declaration-stopped-is-started-again-when-it-goes.md b/02-DECISIONS/0269-what-the-meshs-own-declaration-stopped-is-started-again-when-it-goes.md index 577dbfe6..a2b4ae7a 100644 --- a/02-DECISIONS/0269-what-the-meshs-own-declaration-stopped-is-started-again-when-it-goes.md +++ b/02-DECISIONS/0269-what-the-meshs-own-declaration-stopped-is-started-again-when-it-goes.md @@ -1,6 +1,6 @@ --- topic: what runs on it -status: proposed +status: accepted date: 2026-10-09 deciders: jochen reconstructed: false diff --git a/03-DESIGN/01-to-be/05-the-node-host.md b/03-DESIGN/01-to-be/05-the-node-host.md index fc95481e..567ccd96 100644 --- a/03-DESIGN/01-to-be/05-the-node-host.md +++ b/03-DESIGN/01-to-be/05-the-node-host.md @@ -2,8 +2,9 @@ layer: to-be status: in-progress code: [mesh-host] -updated: 2026-10-02 +updated: 2026-10-09 decisions: + - 02-DECISIONS/0269-what-the-meshs-own-declaration-stopped-is-started-again-when-it-goes.md - 02-DECISIONS/0184-a-service-the-mesh-asked-to-run-is-still-running-a-moment-later.md - 02-DECISIONS/0168-a-converged-machine-is-filtered-by-the-mesh-alone.md - 02-DECISIONS/0163-taking-a-module-over-is-a-comparison.md @@ -186,6 +187,15 @@ the firewall it was found with is in force and who retired it. It retires that f converged apply, not once, records *found inactive* apart from *disabled by the mesh*, and says when the step was skipped. *How it is checked:* ADR 0168's table. +**What the mesh's own declaration stopped goes back with it** — revision, 2026-10-09 +([ADR 0269](../../02-DECISIONS/0269-what-the-meshs-own-declaration-stopped-is-started-again-when-it-goes.md)). The +node-engine records, for a service with a state, what the mesh declared beside what it found. When the +declaration goes, a unit found running or enabled that the declaration held stopped or disabled is +started or enabled again, but only while it is still exactly as the mesh held it. A masked unit, or one +changed since, is left as it is, and the report says why. A restore that fails waits for the next apply +and is never fatal. Every call that names a service's unit passes `--` before it. *How it is checked:* +ADR 0269's table. + **Found reaches every kind that can touch what the machine has** ([ADR 0103](../../02-DECISIONS/0103-what-an-adopted-node-holds-and-what-its-guard-refuses.md)). For a module not yet taken, a directory present with no record keeps its mode and owner, a unit present with no record keeps its state and boot setting, a