To-be 45 in progress; issue 269: the controller cannot write a cancelled set

Phase 0 is being built in mesh-controller and mesh-host. Granting the
controller its own buckets showed that its grant never covered the work
queues' cancelled sets, so every cancel times out.

03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md

@@ -1,7 +1,7 @@
 ---
 layer: to-be
-status: designed
-code: []
+status: in-progress
+code: [mesh-controller, mesh-host, mesh-tools, mesh-catalog, mesh-lab]
 updated: 2026-10-06
 decisions:
   - 02-DECISIONS/0227-the-core-holds-nine-rules-each-checked-and-is-built-to-them-in-six-phases.md

04-ISSUES/269-the-controller-cannot-write-a-work-queues-cancelled-set/00-report.md

@@ -0,0 +1,49 @@
+---
+status: located
+opened: 2026-10-06
+located-in: [mesh-controller]
+fixed-by:
+amended-design:
+---
+
+# 269. The controller cannot write a work queue's cancelled set
+
+## Symptom
+
+Found while granting the controller the buckets of
+[to-be 45](../../03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md) Phase 0, not seen on the
+live mesh. A bus server was given exactly the user list the controller composes for itself, and the
+controller, connected as itself, asked to mark a build cancelled:
+
+```
+asserting the cancelled set of the build seat     → succeeded
+putting an ask's id into it                        → context deadline exceeded (3 s)
+```
+
+The same put into the controller's own new buckets succeeded once their subjects were granted, and
+timed out the same way before.
+
+## Cause
+
+[ADR 0219](../../02-DECISIONS/0219-the-build-queue-is-controlled-through-the-controller-and-the-build-seat.md)'s cancel writes the ask's
+id into the seat's cancelled set before it deletes the ask, so a holder taking it in that moment ends
+it. Writing a key into a bucket is a publish to the bucket's own subject. The controller's grant
+reaches the bus's management interface, which creates the bucket, and does not reach the bucket's
+subject, which writes it. The server refuses the publish; the client waits for an acknowledgement
+that never comes.
+
+So `cancel` and `clear` cannot complete. No test composes the controller's grant and writes the set
+as the controller: the queue's tests write it with an unrestricted connection.
+
+## Fix
+
+The controller's publish grant names each cancelled set it writes, as it now names its own buckets,
+and a test writes the set as the controller, against a server holding the controller's composed
+grant. The installer's first user list says the same.
+
+Pull requests: novox/mesh-controller#78 and novox/mesh-host#32 — open, not merged. Checked against a
+server holding the controller's composed grant: the put that timed out succeeds.
+
+## How it is checked
+
+Live: `cancel` of a waiting ask answers that it was cancelled, and a holder taking that ask ends it.