diff --git a/02-DECISIONS/0240-a-module-says-how-it-is-healthy-and-the-node-engine-judges-it.md b/02-DECISIONS/0240-a-module-says-how-it-is-healthy-and-the-node-engine-judges-it.md index 6bdbcb15..c4fd56b0 100644 --- a/02-DECISIONS/0240-a-module-says-how-it-is-healthy-and-the-node-engine-judges-it.md +++ b/02-DECISIONS/0240-a-module-says-how-it-is-healthy-and-the-node-engine-judges-it.md @@ -184,17 +184,6 @@ that provision's provider for this consumer is unhealthy on the record, the cons the provider's condition — listed there as waiting on it, raised as nothing of its own — and the consumer's gate waits rather than fails. What a consumer finds while its provider is healthy is its own. -> **Progressive insight — 2026-10-11.** A provider can now also be stated *waiting* for the operator's secret or -> setting ([ADR 0283](0283-a-part-that-waits-for-the-operators-secret-or-setting-is-said-as-waiting-passes-the-first-node-gate-and-names-the-act.md)), -> which this rule did not foresee. Its consumers are held under it as under an unhealthy provider: listed at its -> `needs-operator` condition, which stays a warning, and raised as nothing of their own. Their gate, however, does -> not wait: a consumer held under a provider that only waits for the operator passes its gate as a wait for a -> person ([ADR 0254](0254-a-wait-for-a-persons-new-login-is-not-a-gates-failure-and-each-module-of-a-send-keeps-its-own-pass.md)), -> the wait carried in the verdict. That is the trade-off ADR 0283 decision 4 makes for the waiting module itself, -> since a walk that waits for the operator may wait for days. Under an unhealthy provider the consumer's gate still -> waits, as written above. Only consumers of the part that waits are held (ADR 0283 decision 1, its note of the -> same date). Issue 405; built in mesh-controller #216. - **6. Nothing is restarted for being unhealthy.** The runtime restarts what exits, as now. A condition reaches a person through the operator's conversation, or a healer; a healer that restarts on health is its own decision. diff --git a/02-DECISIONS/0283-a-part-that-waits-for-the-operators-secret-or-setting-is-said-as-waiting-passes-the-first-node-gate-and-names-the-act.md b/02-DECISIONS/0283-a-part-that-waits-for-the-operators-secret-or-setting-is-said-as-waiting-passes-the-first-node-gate-and-names-the-act.md index 8745c5c7..90d9b0a5 100644 --- a/02-DECISIONS/0283-a-part-that-waits-for-the-operators-secret-or-setting-is-said-as-waiting-passes-the-first-node-gate-and-names-the-act.md +++ b/02-DECISIONS/0283-a-part-that-waits-for-the-operators-secret-or-setting-is-said-as-waiting-passes-the-first-node-gate-and-names-the-act.md @@ -99,16 +99,6 @@ named exactly, once. Nothing here conflicts with GENESIS. that reason. The type, its constructors and its reader are mesh-sdk's (`go/health`), so the module and the node-engine read one shape; an answer without `state` is read from `healthy` as before. - > **Progressive insight — 2026-10-11.** This decision says each wait names its `part` and that `waits` means - > nothing else of the module is wrong; it did not say which consumers a waiting provider holds - > ([ADR 0240](0240-a-module-says-how-it-is-healthy-and-the-node-engine-judges-it.md) rule 5). The controller reads - > it so: **a wait covers a provision when its `part` is that provision's name, or when the secret it waits for is - > the provision's shared credential** ([ADR 0158](0158-a-provider-with-one-credential-shares-it-with-every-consumer.md)). A consumer whose - > failing check needs a covered provision is held under the provider's `needs-operator` condition; a wait that - > covers nothing holds no consumer, so the consumer's own fault is said, with a line that its provider waits. Today - > no provider names a part after a provision — the mounts module says "the source …" and provides none — so the - > hold is dormant until one does. Issue 405; built in mesh-controller #216. - 2. **The node-engine states such a resource `waiting`**, a fifth state beside healthy, unhealthy, starting, held and unknown (ADR 0240 §4), with its waits. One look that says it is enough, inside the grace too: it is a statement, not a flake that a second look might not repeat. The next look that says diff --git a/02-DECISIONS/0292-a-consumer-of-the-part-a-provider-waits-on-is-held-under-the-wait-and-passes-its-gate-as-a-wait-for-a-person.md b/02-DECISIONS/0292-a-consumer-of-the-part-a-provider-waits-on-is-held-under-the-wait-and-passes-its-gate-as-a-wait-for-a-person.md new file mode 100644 index 00000000..d2e5e3a9 --- /dev/null +++ b/02-DECISIONS/0292-a-consumer-of-the-part-a-provider-waits-on-is-held-under-the-wait-and-passes-its-gate-as-a-wait-for-a-person.md @@ -0,0 +1,100 @@ +--- +topic: what runs on it +status: accepted +date: 2026-10-11 +deciders: an agent session on the workstation, under jochen's standing rule that small design limits are decided by the session and recorded; jochen may supersede it +reconstructed: false +extends: 02-DECISIONS/0283-a-part-that-waits-for-the-operators-secret-or-setting-is-said-as-waiting-passes-the-first-node-gate-and-names-the-act.md +--- + +# 292. A consumer of the part a provider waits on is held under the wait, and passes its gate as a wait for a person + +## Context + +[ADR 0283](0283-a-part-that-waits-for-the-operators-secret-or-setting-is-said-as-waiting-passes-the-first-node-gate-and-names-the-act.md) +gave a module a fifth state, *waiting* for the operator's secret or setting, said as `needs-operator`, and +passed the waiting module's own first-node gate as a wait for a person. It said nothing of the module's consumers. +[ADR 0240](0240-a-module-says-how-it-is-healthy-and-the-node-engine-judges-it.md) rule 5 holds a consumer's +findings under its provider while the provider is *unhealthy*, and makes the consumer's gate wait. + +Issue 405, found in the review of ADR 0283's controller change, saw the gap: a provider whose only part not +healthy waits for the operator held nothing. Every consumer that failed because of it raised its own `unhealthy` +condition, whose words say "nothing for you to do", about a fault only the operator could end. The controller +change that closes it is mesh-controller #216. + +Holding consumers under a waiting provider raises three questions ADR 0283 did not answer: which consumers a wait +covers, what the held consumer's gate reads, and whether the provider's condition grows urgent while consumers +wait. This record answers them. It was decided by the agent session that built #216, under the operator's standing +rule that an agent decides a small design limit itself and records it; the operator may supersede it. + +**Checked against GENESIS.** *Failure must be loud*: a consumer's fault is never hidden behind a wait that does not +cover it. *Evidence over assertion*: a consumer is held only where a wait the provider stated names what the consumer +needs. Nothing here conflicts with GENESIS. + +## Considered Options + +**Which consumers a waiting provider holds.** + +1. *Every consumer of the provider.* ADR 0283 decision 1 says a module that waits is otherwise sound, and each wait + names its part; a consumer of another part fails for a reason of its own, and holding it would hide that. + Rejected. +2. **Only the consumers of a provision a wait covers.** Chosen. + +**What the held consumer's gate reads.** + +3. *Waiting, as ADR 0240 rule 5 says for an unhealthy provider.* The walk then waits for the operator, possibly for + days, and every walk behind it — ADR 0283 option 4, rejected there for this reason. Rejected. +4. **A wait for a person ([ADR 0254](0254-a-wait-for-a-persons-new-login-is-not-a-gates-failure-and-each-module-of-a-send-keeps-its-own-pass.md)): + a pass, the wait carried in the verdict**, as ADR 0283 decision 4 reads the waiting module itself. Chosen. + +**The provider's severity while consumers wait.** + +5. *Urgent, as an unhealthy provider's condition is while consumers wait on it.* ADR 0283 decision 5 says + `needs-operator` is a warning and never escalated. Rejected. +6. **A warning, listing who waits on it.** Chosen. + +## Decision + +1. **A wait covers a provision** when its `part` is that provision's name, or when the secret it waits for is the + provision's shared credential ([ADR 0158](0158-a-provider-with-one-credential-shares-it-with-every-consumer.md)). + This is the convention for module authors: a provider whose waiting part gives a provision names the part after + it, or waits for that provision's shared credential. +2. **A consumer is held under a provider that only waits for the operator** when every finding of it that is not + healthy is of a check naming a provision a wait of that provider covers. It is listed at the provider's + `needs-operator` condition and raises nothing of its own. A provider that is unhealthy holds as ADR 0240 rule 5 + says. +3. **A consumer a wait does not cover is said on its own**: its `unhealthy` condition, whose evidence says its + provider waits for the operator, but not for anything the consumer is known to need. So is a consumer whose + provider's waits are not known (its `needs-operator` open, its statement naming none). +4. **The held consumer's first-node gate reads a wait for a person**: a pass, the verdict carrying "… waits on + on , which waits for you: ". Under an unhealthy provider the gate waits, as before. +5. **The provider's `needs-operator` stays a warning** while consumers wait on it. + +## Consequences + +- No walk waits for the operator's secret, whichever module owes it. +- **The blind spot accepted.** While a wait covers a consumer's provision, a build of the consumer that breaks its + own use of that provision passes its gate; the fault is said once the operator gives what is owed, as the + consumer's own `unhealthy`, and a newer build or a person's push is the way — what ADR 0283 accepts for the + waiting module itself. +- **Dormant today.** No provider names a part after a provision: the mounts module says "the source …" and provides + nothing. The hold acts once a provider follows the convention of decision 1. +- A provider whose wait fails the controller's check is unhealthy and holds as ADR 0240 rule 5 says; whether its + consumers are then listed at its condition is issue 450. + +## How it is checked + +| Rule | Checked by | +|---|---| +| 1, 2, 3 | mesh-controller `TestAProviderWaitingForTheOperatorHoldsOnlyTheConsumersOfTheWaitingPart`: held by part and by shared credential; not held for another part or when the waits are not known; an unhealthy provider holds; a healthy one does not | +| 3 | `TestAConsumerOfAnotherPartIsRaisedOnItsOwn`: the consumer's own condition, its evidence saying the provider waits | +| 4 | `TestAConsumersGateUnderAWaitingProviderPassesCarryingTheWait`: a wait for a person carrying the wait; waiting under an unhealthy provider | +| 2, 5 | `TestAWaitingProvidersConditionListsWhoWaitsOnItAndStaysAWarning`: one condition, at the provider, listing the consumer, a warning; and `TestAConsumerHeldOnceItsProviderWaitsSaysWhichItIs` | + +## References + +- Issue 405; mesh-controller #216; issue 450. +- [ADR 0240](0240-a-module-says-how-it-is-healthy-and-the-node-engine-judges-it.md) rule 5, + [ADR 0283](0283-a-part-that-waits-for-the-operators-secret-or-setting-is-said-as-waiting-passes-the-first-node-gate-and-names-the-act.md) + option 4 and decisions 1, 4 and 5, [ADR 0254](0254-a-wait-for-a-persons-new-login-is-not-a-gates-failure-and-each-module-of-a-send-keeps-its-own-pass.md), + [ADR 0158](0158-a-provider-with-one-credential-shares-it-with-every-consumer.md).