From a6c0f002a54d3a309e5af05b1c32e481edb7a27b Mon Sep 17 00:00:00 2001 From: jochen Date: Tue, 6 Oct 2026 03:04:36 +0200 Subject: [PATCH] To-be 45 in progress; issue 269: the controller cannot write a cancelled set Phase 0 is being built in mesh-controller and mesh-host. Granting the controller its own buckets showed that its grant never covered the work queues' cancelled sets, so every cancel times out. --- .../45-a-core-that-cannot-fail-silently.md | 4 +- .../00-report.md | 49 +++++++++++++++++++ 2 files changed, 51 insertions(+), 2 deletions(-) create mode 100644 04-ISSUES/269-the-controller-cannot-write-a-work-queues-cancelled-set/00-report.md diff --git a/03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md b/03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md index 4f70660..1555321 100644 --- a/03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md +++ b/03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md @@ -1,7 +1,7 @@ --- layer: to-be -status: designed -code: [] +status: in-progress +code: [mesh-controller, mesh-host, mesh-tools, mesh-catalog, mesh-lab] updated: 2026-10-06 decisions: - 02-DECISIONS/0227-the-core-holds-nine-rules-each-checked-and-is-built-to-them-in-six-phases.md diff --git a/04-ISSUES/269-the-controller-cannot-write-a-work-queues-cancelled-set/00-report.md b/04-ISSUES/269-the-controller-cannot-write-a-work-queues-cancelled-set/00-report.md new file mode 100644 index 0000000..2dabbe8 --- /dev/null +++ b/04-ISSUES/269-the-controller-cannot-write-a-work-queues-cancelled-set/00-report.md @@ -0,0 +1,49 @@ +--- +status: located +opened: 2026-10-06 +located-in: [mesh-controller] +fixed-by: +amended-design: +--- + +# 269. The controller cannot write a work queue's cancelled set + +## Symptom + +Found while granting the controller the buckets of +[to-be 45](../../03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md) Phase 0, not seen on the +live mesh. A bus server was given exactly the user list the controller composes for itself, and the +controller, connected as itself, asked to mark a build cancelled: + +``` +asserting the cancelled set of the build seat → succeeded +putting an ask's id into it → context deadline exceeded (3 s) +``` + +The same put into the controller's own new buckets succeeded once their subjects were granted, and +timed out the same way before. + +## Cause + +[ADR 0219](../../02-DECISIONS/0219-the-build-queue-is-controlled-through-the-controller-and-the-build-seat.md)'s cancel writes the ask's +id into the seat's cancelled set before it deletes the ask, so a holder taking it in that moment ends +it. Writing a key into a bucket is a publish to the bucket's own subject. The controller's grant +reaches the bus's management interface, which creates the bucket, and does not reach the bucket's +subject, which writes it. The server refuses the publish; the client waits for an acknowledgement +that never comes. + +So `cancel` and `clear` cannot complete. No test composes the controller's grant and writes the set +as the controller: the queue's tests write it with an unrestricted connection. + +## Fix + +The controller's publish grant names each cancelled set it writes, as it now names its own buckets, +and a test writes the set as the controller, against a server holding the controller's composed +grant. The installer's first user list says the same. + +Pull requests: novox/mesh-controller#78 and novox/mesh-host#32 — open, not merged. Checked against a +server holding the controller's composed grant: the put that timed out succeeds. + +## How it is checked + +Live: `cancel` of a waiting ask answers that it was cancelled, and a holder taking that ask ends it.