diff --git a/00-META/glossary.md b/00-META/glossary.md index 5bfcc769..e6aa0e5d 100644 --- a/00-META/glossary.md +++ b/00-META/glossary.md @@ -561,8 +561,8 @@ controller (the planner, the rollout) until release 6 of ADR 0429; from each rel passes), `optional` (runs, a failure shown and holding nothing) or `bypass` (nothing runs), kept in its registration and never in a manifest (ADR 0666 §7). Not the **upgrade policy** (Module), how a module's builds reach its nodes (see [Homonyms](#homonyms)). -- **registration** — a module's entry in the catalog: its git origin, the path of its manifest, its watched branches, - its policy and whether it is a foundation part (`foundation`), kept by the seat `mesh-catalog`, every version with who changed it and on whose Approve; +- **registration** — a module's entry in the catalog: its git origin, the path of its manifest, its watched branches and + its policy, kept by the seat `mesh-catalog`, every version with who changed it and on whose Approve; registering and changing one are trusted acts (ADR 0666 §2). The mesh knows modules, and a repository only as a module's git origin. - **watched branch** — a branch a module's registration names, whose commits start that module's pipeline and which a diff --git a/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md b/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md index 76c66ad3..91c9e7e1 100644 --- a/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md +++ b/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md @@ -439,7 +439,7 @@ check and deliver milestone G itself (ADR 0667 §2); each of them says so in a l │ registrations; a catalog graph │ per watched branch; the revision │ validated before take-in - ▼ catalog-revision (seat mesh-catalog) + ▼ take-in.taken pipeline runner (mesh-pipeline-runner) ── asks each pipeline step on the serving seat's work queue, hears step-ended: │ lint, unit tests, integration tests ──► the build seats (node-build-go, node-build-node, node-build-image) │ composition ──────────────────────────► the assigner (mesh-wants) @@ -453,8 +453,7 @@ check and deliver milestone G itself (ADR 0667 §2); each of them says so in a l ### A module's registration - **What it holds.** The seat `mesh-catalog` keeps each module's **registration**: its git origin, the path of its - manifest, its watched branches, its policy and whether it is a foundation part (its value `foundation`, absent read - as no), on the bus, every version with who changed it and the warrant of the + manifest, its watched branches and its policy, on the bus, every version with who changed it and the warrant of the operator's Approve (ADR 0666 §2). The indexer is a foundation part, so the registrations are kept in its old sections (ADR 0619 §1 to §3, ADR 0666 §4): one key per module in its old `state` section `registrations`, and every version on its old `streams` section's stream `registration-history`, kept with no age limit. @@ -463,8 +462,7 @@ check and deliver milestone G itself (ADR 0667 §2); each of them says so in a l - **Changing one is a trusted act.** The seat's verbs `register` (a module whole), `policy` (one module's step statuses, per artifact), `watch` and `unwatch` (add or remove a watched branch) each raise an authorising ask of tier approve through the seat `operator-channel` (design 46 §10), naming every value the change moves, one line each - ("`mesh-grants:program` unit tests: `required` → `bypass`", "`nats` foundation: no → yes"), and write the version - only on its warrant; a Decline or + ("`mesh-grants:program` unit tests: `required` → `bypass`"), and write the version only on its warrant; a Decline or an expiry writes nothing (ADR 0666 §2). Until a record binds each forge account to its bus identity, `register` and `policy` refuse code review as a `required` step, naming why, so no review gates while its author cannot be told (ADR 0666 §22; issue 1966, note 157). A manifest moved to another path is the one manifest change that changes the @@ -476,16 +474,11 @@ check and deliver milestone G itself (ADR 0667 §2); each of them says so in a l - **An unprotected branch is refused.** `register` and `watch` read a branch's protection through the seat `git`'s read verb `branch` (its head, and whether a rule refuses a direct push and admits only merges), and refuse a watched branch the forge does not protect, naming it (ADR 0666 §3). -- **The foundation parts are written once, in the registrations.** Which modules are foundation parts (ADR 0619 §1 as - ADR 0666 §4 changes it) is each registration's value `foundation`, changed only as every registration value is, on - the operator's Approve; the manifest validator holds no list of them in its code and takes them from its input, the - validation ask the indexer makes before every take-in carrying the foundation modules from the registrations, and - the running indexer's own judging reading them from the registrations it keeps. This departs from ADR 0619 §3, - which makes the validator's list in code the one place the foundation is written: a list of module names in code is - what ADR 0666 §5 refuses, so the one place becomes the registrations (the design's choice under ADR 0666 §5). The - indexer's finding `foundation-differs`, raised and cleared by the condition keeper (ADR 0564 §2), names a module - the registrations and a watched branch's catalog graph disagree on: one marked `foundation` that the graph does not - hold, or one whose manifest keeps old sections (ADR 0619 §2) that no registration marks. +- **The foundation parts are the manifest validator's list.** The manifest validator's list (ADR 0619 §3) holds + exactly the foundation parts, ADR 0619 §1's and the runner, which joins them (ADR 0666 §4); the checker leaves the + list when it is removed (*How milestone G itself is checked and delivered*). A registration holds no foundation + value. How it is checked: a unit test of the manifest validator refuses a template in the manifest of every part on + its list, the runner's included, and judges every other part's manifest as any part's. - **No part fixes a name.** Every branch, repository and module name a part needs is read from the registrations and the catalog graph; the lint step refuses such a name in a string, a constant or a table of code logic, a Go import path not being code logic (ADR 0666 §5). About 39 such names in 9 parts were found on 2026-11-09 (research 086, Findings); @@ -494,9 +487,7 @@ check and deliver milestone G itself (ADR 0667 §2); each of them says so in a l proposes one registration for every module its trunk revision holds, from what it took in (the origin and path of each), its watched branch the repository's default branch read through the seat `git`, and the statuses the check judged until then: lint, unit tests, integration tests and composition `required`, code review `optional`, approval - `bypass`; `foundation` marked for exactly the parts ADR 0619 §1 names at that start and the runner (ADR 0666 §4), - read once from the validator's list, which the same change then deletes; it raises them as one ask naming every - registration, as the seat `mesh-module-assigner`'s `adopt` proposes + `bypass`; it raises them as one ask naming every registration, as the seat `mesh-module-assigner`'s `adopt` proposes placement whole (ADR 0567). Until that Approve the runner starts no delivering pipeline and says why, so the operator is told of this one ask before G's delivery starts. A Decline or an expiry leaves the seed unwritten and says so; the indexer's tool `indexer_seed_again` raises the ask again, recorded in the hand-act log. @@ -508,11 +499,8 @@ check and deliver milestone G itself (ADR 0667 §2); each of them says so in a l the warrant writes nothing, and a declined one writes nothing; a change from `required` to `bypass` asks, showing that line; `registration-changed` is said and `registrations` answers the history; the first start proposes the seed as one ask, and `indexer_seed_again` asks it again after a Decline and after an expiry; a policy making code review - `required` is refused; a change of `foundation` without the warrant writes nothing. Unit and whole (indexer): given - registrations marking `nats` foundation and not `node-tools`, the validator refuses `nats`'s manifest asking a - template and judges `node-tools`'s as any part's, and no module name is left in the validator's code; a module - marked `foundation` that the graph does not hold raises `foundation-differs`. Unit (the Go build module's lint step): - a module name in a string, a constant and a table is refused, an import path is not. Tests 75, 68, 83 and 101. + `required` is refused. Unit (the Go build module's lint step): a module name in a string, a constant and a table is + refused, an import path is not. Tests 75, 68 and 83. ### Watched branches and the catalog graph per branch @@ -576,8 +564,8 @@ check and deliver milestone G itself (ADR 0667 §2); each of them says so in a l - **The runner.** The seat `mesh-pipeline-runner`, held once for the mesh by the module `mesh-delivery-pipeline`, runs each pipeline (ADR 0666 §7). It is a foundation part, since the bus module's own delivery waits on its pipeline (ADR 0666 §4): its kept data are in old sections (ADR 0619 §2), it waits on no bus module process to start, and it - is registered `foundation` from the first registrations on (*A module's registration*), so the manifest validator - refuses its manifest asking a template. It reads the policy from the registrations, asks each step that is not `bypass` of + joins the manifest validator's list of foundation parts, which refuses its manifest asking a template (ADR 0666 §4, + which changes ADR 0619 §1 and §3). It reads the policy from the registrations, asks each step that is not `bypass` of the seat that serves it, and says each step's start and end and the pipeline's end (*Health and going back*, below). - **The steps and who serves them.** Lint, unit tests and integration tests are the build seats' (`node-build-go`, `node-build-node`, `node-build-image`): each gains the verb `steps`, which answers which pipeline steps an artifact @@ -718,9 +706,9 @@ check and deliver milestone G itself (ADR 0667 §2); each of them says so in a l `mesh-delivery`'s verb `groups`, and publishes `forge.group.merged` when that verb says every member has (ADR 0666 §13, which changes ADR 0633 §4). - **One source revision, one pipeline per branch.** The indexer keeps landed members pending until the group's end and - takes them in together as one source revision of that watched branch, saying the catalog revision it makes as the seat - `mesh-catalog`'s event `catalog-revision`; the runner starts the group's one pipeline per watched branch on that - event, and a member of a gathered group starts no pipeline of its own (ADR 0666 §13). + takes them in together as one source revision of that watched branch, saying `take-in.taken`; the runner starts the + group's one pipeline per watched branch on that event, and a member of a gathered group starts no pipeline of its own + (ADR 0666 §13). When one member's `required` step fails, none of the group's modules is delivered (research 086, R5). - **A group that never completes is said.** By ADR 0633 §5's 30-minute bound and its condition; `bridge_group_end_again` says a group's end again from the gate's group verb, never the gate's `merges` state (ADR 0666 §13, which changes ADR @@ -769,31 +757,29 @@ check and deliver milestone G itself (ADR 0667 §2); each of them says so in a l 51, *The versions*). The seat is new, held once for the mesh, defined in `mesh-delivery-contracts`; the builder held none until now, and its waits stay on its own stream in this milestone. - **Every dependent is rebuilt against it.** On `package-published` every artifact with a kind-1 edge to the package is - rebuilt against the new version; nothing else is rebuilt, and a change to tests alone publishes nothing (ADR 0666 - §15; research 086, R18). The indexer consumes `package-published` and says the catalog revision the publication - makes as `catalog-revision`; the runner starts those artifacts' pipelines on it, once each, and a publication's - pipeline is keyed by that catalog revision. -- **The runner starts on one event.** The runner starts every pipeline on the seat `mesh-catalog`'s `catalog-revision`, - a commit's, a group's and a publication's alike, and consumes neither `package-published` nor the indexer's own - `take-in.taken`. The design's choice under ADR 0666 §13 and §15: the seat's event is the mesh path (a module's own - event would have the runner name the indexer, ADR 0666 §5), and one start event makes one publication one pipeline per - dependent, never two. + rebuilt against the new version, and the runner, which consumes the event, starts its pipeline; nothing else is + rebuilt, and a change to tests alone publishes nothing (ADR 0666 §15; research 086, R18). +- **A second start writes nothing.** The runner starts a pipeline on two events, the indexer's `take-in.taken` (ADR + 0666 §13) and `package-published` (ADR 0666 §15). When both reach it for the same source revision and module, the + second start writes nothing: the runner writes a pipeline's key (watched branch, source revision and module, *The + runner's kept data*) by compare-and-set on its absence, so one revision and module has one pipeline. The design's + choice under ADR 0666 §13 and §15: the key the runner already keeps is the one place a start is judged, so neither + event's producer needs to know of the other. - **Unread packages refuse.** A build that cannot read the published packages refuses and names the unread state (ADR 0666 §15). - **How it is checked.** Whole (builder, indexer): a mesh-sdk merge changing one package publishes one version, and only the artifacts importing that package rebuild; a merge changing only tests rebuilds nothing; a build whose packages - cannot be read refuses naming the state. Whole (runner): the runner starts a pipeline only on `catalog-revision`, and - one publication starts one pipeline per dependent. Tests 70, 80 and 102. + cannot be read refuses naming the state. Whole (runner): a `take-in.taken` and a `package-published` for the same + source revision and module start one pipeline, the second writing nothing. Tests 70, 80 and 101. ### Any size - **A value over the limit is an object.** mesh-sdk's own small object store package (ADR 0595 §9) puts a value over the bus's per-value limit in the object store beside its state and keeps the object's name in the key; a verb's reply or an event over the - per-message limit carries the object's name (ADR 0666 §16). A replace writes the new object, sets the key by - compare-and-set, and removes the object it replaced in the same act, so a replaced value leaves one object; a key - deleted leaves its object, listed as `key gone`, which only the drop tool removes on a person's word (ADR 0666 §16, - as ADR 0595 §4 removes kept data). The design's choice under ADR 0666 §16: the object a replace removes is no longer - named by any key, so nothing can read it, while a deleted key may be one a person wants back. + per-message limit carries the object's name (ADR 0666 §16). A replace writes the new object and sets the key by + compare-and-set; the object it replaced stays, as one whose key was deleted does, listed as `key gone` since no key + names it, and only the drop tool removes either, on a person's word: the mesh removes kept data only through `drop` + and `recreate`, each on a person's word (ADR 0595 §4; ADR 0666 §16). - **One object store per state, granted to its owner.** Each state asked by the template `state` gets its object store beside it, `-objects`, a template form of ADR 0595 that the bus module provides and the grants part grants to the state's owner alone (ADR 0666 §16); a foundation part's large values go in an old `objects` section of its own. @@ -823,8 +809,9 @@ check and deliver milestone G itself (ADR 0667 §2); each of them says so in a l package published before its users build (ADR 0573 §2, ADR 0667 §3). - **How it is checked.** Whole (mesh-sdk, against the real bus): values of one, ten and a hundred times the per-value limit stored, sent as a reply and as an event, and read back whole by a caller and a consumer the manifests declare, - and refused to a module that declares neither; a replaced large value leaves one object; a key deleted leaves its - object listed `key gone`, which the drop tool removes and nothing else does; a sent object is readable within its 7 + and refused to a module that declares neither; a replaced large value leaves its old object listed `key gone` beside + the new one, and a key deleted leaves its object listed `key gone`, each removed by the drop tool and by nothing else; + a sent object is readable within its 7 days and expired after; each drop without who asked is refused. Tests 69 and 90. ### The pipeline makes the check, and the checker goes @@ -914,8 +901,8 @@ check and deliver milestone G itself (ADR 0667 §2); each of them says so in a l its members, and a merge behind a pending revision, are governed by their own bounds (ADR 0666 §24). At its start the watchman seeds its open waits from the runner's `stands`, as it seeds `take-in-waits` from `indexer_pending`. - **The runner's own health.** Its manifest declares its health check, run outside its process (ADR 0240): the runner - answers `show`, and its durable consumers of `step-ended`, `catalog-revision` and `decided` are each less than five - minutes behind; a failed check names which. + answers `show`, and its durable consumers of `step-ended`, `take-in.taken`, `package-published` and `decided` are + each less than five minutes behind; a failed check names which. - **The runner waits for its view.** With no revision view it says so in `_first_views` and raises `view-waits` after five minutes, as every part does (ADR 0656 §6). - **Going back is one act.** A failing new version holds while the old keeps running (ADR 0656 §4); a return to an @@ -979,7 +966,7 @@ and an estimated 2 mesh-sdk publishes a day, each rebuilding about 120 artifacts | the indexer | catalog graph revisions, per watched branch | objects in the old form (ADR 0619 §2) | while a record pins it or it is its branch's current | 512 MiB, as *Two graphs, one source of truth*; a second watched branch on a few modules adds a few MiB | | the gate | `source`: one key per watched branch | its old `state` section, as today | 64 revisions of each key; a branch's key deleted when `registration-changed` says the last registration watching it unwatched it (`unwatch`) | a few KiB | | the forge module | `failed-steps`: failed `required` steps by module and fingerprint, with the commits each was seen at | state | an entry deleted once none of its commits is a watched branch's head or the head an open pull request names, judged on each `branch-moved` and each pull request's close | the template's 64 MiB; an estimated 50 failed steps a day of about 0.5 KiB, most gone within days, is under 1 MiB | -| every module that imports the object store package | `-objects` beside each state | objects | an object removed when a replace supersedes it; one whose key is gone, until `_state_objects_drop` on a person's word (ADR 0666 §16) | the template's; nothing reserved until written | +| every module that imports the object store package | `-objects` beside each state | objects | an object no key names, its key deleted or its value replaced, until `_state_objects_drop` on a person's word (ADR 0595 §4, ADR 0666 §16) | the template's; nothing reserved until written | | every sender of the new form, and a foundation part by its old `objects` section | `_sent-objects` (`sent-objects`) | objects, planned by the bus module with no manifest field | 7 days, transport (*Any size*) | the objects template's cap; full is the bus module's `full` | | the grants part, for each seat event a definition keeps | `SEAT__`, among them `SEAT_mesh-pipeline-runner_*`, `SEAT__step-ended`, `SEAT_git_branch-moved`, `SEAT_mesh-builds_package-published` and `SEAT_mesh-catalog_registration-changed` | a stream the grants part makes with its durable consumers | the seat definition's age (`keep`), 90 days unless the definition names less | the seat definition's cap (`keep`) | @@ -1033,12 +1020,11 @@ step keys and the builder's build log, against the checker's last week (test 99) - **What is removed, and when** (ADR 0667 §12). The checker's buckets and bus account and the gate's forge merge token are removed only after the first pipeline after G's delivery has delivered a change end to end (test 63), the runner then making every check in the checker's place (ADR 0666 §19), and only on the operator's word, asked once for all - three. That one ask also names the checker's registration leaving the foundation (`foundation`: yes → no), the design's - choice so that one warrant covers every value it moves (*A module's registration*). - The checker then leaves the foundation and is no longer placed, so no running module declares its buckets and they + three. The checker then leaves the manifest validator's list of foundation parts (ADR 0666 §4) and is no longer + placed, so no running module declares its buckets and they are orphans `orphans` lists; they go through ADR 0595's `drop` on that word, after the stream snapshot `drop` takes (ADR 0595 §4, §5, §10), kept 90 days as the delivery records are; a restore from that snapshot is tested before the - word is asked. The runner is registered `foundation` from the first registrations on. + word is asked. The runner is on that list from G's delivery. - **Told to the operator before it starts**: G's own merges are asked as ADR 0661 has them (ADR 0667 §2, §11); the one ask of the seed registrations; the bus's restart (ADR 0667 §7); and later the one word for the checker's removal (ADR 0667 §12). @@ -1049,10 +1035,9 @@ step keys and the builder's build log, against the checker's last week (test 99) | Choice | Why | |---|---| | The registrations in the indexer's old `state` section with their history on an old stream, capped at 64 MiB, kept for the life of the mesh | the indexer is a foundation part (ADR 0619 §1 to §3, ADR 0666 §4); a registration keeps every version with who and on whose Approve, and nothing derives it again | -| The runner a foundation part, its kept data in old sections, registered `foundation` | the bus module's own delivery waits on its pipeline (ADR 0666 §4) | -| The foundation parts written once, as the registration value `foundation` on the operator's Approve, read by the manifest validator from its validation ask; its list in code gone; `foundation-differs` when a catalog graph disagrees | a list of module names in code is what ADR 0666 §5 refuses, so the one place ADR 0619 §3 asks for becomes the registrations, changed as every registration is (ADR 0666 §2); a disagreement is said, never guessed | +| The runner a foundation part, its kept data in old sections, on the manifest validator's list | the bus module's own delivery waits on its pipeline (ADR 0666 §4) | | The want's compare-and-set keyed per module and watched branch | source revisions are kept per watched branch, so two branches' revisions have no order; comparing across them would let `main` refuse `beta`'s want (ADR 0666 §9) | -| The runner starts every pipeline on `catalog-revision`, a publication's included, and consumes no `package-published` and no `take-in.taken` | the seat's event is the mesh path and names no module (ADR 0666 §5); one start event gives one pipeline per dependent of a publication (ADR 0666 §13, §15) | +| A second start of a pipeline for the same source revision and module, on `take-in.taken` and `package-published`, writes nothing, by the pipeline key's compare-and-set | the runner starts on both events (ADR 0666 §13, §15); the key it already keeps judges a start in one place, so neither producer knows of the other | | A refused new indexer revision holds later merges on its branch until a revert lands | the validation runs after the merge and before take-in (ADR 0666 §6), so the refused revision has landed; taking later merges in past it would deliver them on a graph its own validator refused | | Each check at its row's level, every requirement R1 to R18 keeping its named test | the record's rows name the levels; the test budget and one check per release bound what runs | | The approval asked as the operator-channel's accepted kind `ask` on its work queue | the seat has no verb `ask`: an ask is its accepted kind, by the asker's own name (design 46 §10) | @@ -1087,8 +1072,8 @@ step keys and the builder's build log, against the checker's last week (test 99) | The forge module's `failed-steps` kept until no head it was seen at is a watched branch's head or an open pull request's | an entry judges only a head that can still be merged; once neither names it, nothing can be refused by it | | The gate's `source.` deleted when the branch's last watch goes | a branch no registration watches makes no revision, so its key would name nothing | | The sent store kept 7 days by age, with no person's word | an object sent carries one reply or event and is transport, not kept data (ADR 0595 §4); its readers fetch it within a call's bound or a consumer's lag | -| A replace removes the object it replaced; a gone key's object waits for the drop tool | no key names a replaced object, so nothing reads it; a deleted key may be wanted back, and ADR 0666 §16 drops it on a person's word | -| The checker's removal after the first end-to-end pipeline, on one word naming its `foundation` too, its buckets through `drop`, the snapshot kept 90 days | ADR 0667 §12 asks one word for all three; a registration change needs a warrant naming its value (ADR 0666 §2), so the one ask names it; 90 days is the delivery records' retention, the longest a trace reads back | +| A replaced object listed `key gone`, as a deleted key's is | no key names it, and one listing lets the drop tool take both on a person's word, as ADR 0595 §4 and ADR 0666 §16 have it | +| The checker's removal after the first end-to-end pipeline, on one word, its buckets through `drop`, the snapshot kept 90 days | ADR 0667 §12 asks one word for all three; 90 days is the delivery records' retention, the longest a trace reads back | | The pipeline steps on the `check` stream after `delivery` | a delivery's build is never held by a pipeline, as a check never held one (ADR 0525 §4) | ## A delivery @@ -1725,7 +1710,7 @@ say another runs a build (ADR 0363 §2); the gate's events are granted to the ga | Step | Event | Owner: the seat, then the module | Subject | Declared in | |---|---|---|---|---| -| a catalog graph revision kept, saying whether it is a trunk revision or a candidate's and its watched branch; the one event every pipeline starts on, from G's delivery | `catalog-revision` | `mesh-catalog`, the indexer | `mesh.seat.mesh-catalog.event.catalog-revision`, the watched branch in the subject from G's delivery | the seat's definition in `mesh-delivery-contracts` | +| a catalog graph revision kept, saying whether it is a trunk revision or a candidate's and its watched branch | `catalog-revision` | `mesh-catalog`, the indexer | `mesh.seat.mesh-catalog.event.catalog-revision`, the watched branch in the subject from G's delivery | the seat's definition in `mesh-delivery-contracts` | | an assignment graph revision kept | `assignment-revision` | `mesh-wants`, the assigner | `mesh.seat.mesh-wants.event.assignment-revision` | the seat's definition in `mesh-delivery-contracts` (ADR 0641 §2) | | a difference worked out | `difference` | `mesh-wants`, the assigner | `mesh.seat.mesh-wants.event.difference` | the same | | an entry taken in | `take-in.taken`, which gains the entries | the indexer's own | `mesh.stream.mesh-delivery-indexer.event.take-in.taken` | the indexer's manifest | @@ -3083,9 +3068,8 @@ of each verb (ADR 0666 §7, §20, §25): | `rerun`, `accept`, `cancel`, `ask-again` | one step again; a failed `optional` step accepted with why; a pipeline ended, its asks dropped; a declined `approval` asked again | the operator, the healers (`accept` and `ask-again` the operator) | **The seat `mesh-catalog`** gains, from milestone G's delivery, `register`, `policy`, `watch`, `unwatch` and -`registrations`, and the event `registration-changed` (*A module's registration*); a registration carries `foundation`, -and `catalog-revision` names its watched branch in its subject and is the one event the runner starts a pipeline on, -a publication's included (*A publish rebuilds*). **The build seats** gain the verb +`registrations`, and the event `registration-changed` (*A module's registration*), and `catalog-revision` names its +watched branch in its subject. **The build seats** gain the verb `steps` and the accepted kind `step`, and **the seat `mesh-wants`** the kind `step`, each saying `step-ended`. **The seat `mesh-builds`**, new and held once for the mesh, says `package-published` (*A publish rebuilds*). @@ -3641,7 +3625,7 @@ The failure paths: 89. **An older revision ending after a newer one** writes no want, and a revision of one watched branch ending after a newer one of another writes its own want and refuses neither; a newer commit supersedes a module's pipeline only when it changed that module's build-input fingerprint (whole, assigner and runner). -90. **A replaced oversized value** leaves one object; a deleted key leaves its object listed `key gone` until +90. **A replaced oversized value** leaves its old object, and a deleted key its object, each listed `key gone` until `_state_objects_drop` removes it on a person's word; a sent object expires after its 7 days (whole, mesh-sdk). 91. **A session's merge** through `merge-pull` at its head merges with no run yet and with a passed run, and asks no Approve; with the runner stopped it still merges, judged on the `step-ended` it kept; a head at whose fingerprint any @@ -3668,8 +3652,8 @@ ADR 0667's checks, of milestone G itself: `mesh-hand-acts` names none for the milestone (live). 97. **What G removes, and when.** The checker's buckets and bus account and the gate's forge merge token are removed only after test 63 has passed on the mesh and on the operator's one word for all three, asked after a restore from - the stream snapshot was tested; the buckets are listed by `orphans` once the checker is unplaced and no longer - `foundation`, and go through `drop`; then they are gone, and the snapshot is kept 90 days (live). + the stream snapshot was tested; the buckets are listed by `orphans` once the checker is unplaced and off the + manifest validator's list, and go through `drop`; then they are gone, and the snapshot is kept 90 days (live). 98. **A failed head is said.** A `required` step that failed, or could not run, on a watched branch's head raises `pipeline-failed`, the commit's author's for two hours and then the operator's, cleared when a newer revision of that branch passes it (whole, runner and condition keeper). @@ -3681,14 +3665,9 @@ ADR 0667's checks, of milestone G itself: `merge-pull` reaches an old assigner; until the first registrations' `registration-changed` the new assigner writes wants from the trunk alone and `merge-pull` refuses every merge, and after it both switch (live, read from the delivery plan and the forge module's and the assigner's `running`; whole, assigner and forge module). -101. **The foundation from the registrations.** Given registrations marking `nats` foundation and not `node-tools`, the - manifest validator refuses `nats`'s manifest asking a template and judges `node-tools`'s as any part's; a change of - `foundation` without the warrant writes nothing; a module marked `foundation` that a watched branch's catalog graph - does not hold raises `foundation-differs`; no module name is left in the validator's code (unit, manifest - validator; whole, indexer, mesh-delivery; live, a search of the indexer's code). -102. **One start event.** The runner starts a pipeline only on `catalog-revision`, a commit's, a group's and a - publication's, and one publication of a package starts one pipeline per dependent artifact, never one more on - `package-published` (whole, runner and indexer, mesh-delivery). +101. **A second start writes nothing.** A `take-in.taken` and a `package-published` for the same source revision and + module start one pipeline: the second start's compare-and-set on the pipeline key writes nothing (whole, runner, + mesh-delivery). ## What retires @@ -4056,15 +4035,17 @@ the catch-up call; the hold's bound while a large backup is taken; the granting live run; a builder seat. The joint amendment for milestone 47/G (2026-11-10) writes what the milestone's prepare found where ADR 0666, ADR 0667 -and this design disagreed, each as this design's own choice with its reason: the foundation parts written once, as the -registration value `foundation` on the operator's Approve, the validator's list in code gone (ADR 0666 §5, where it -departs from ADR 0619 §3) and `foundation-differs` when a catalog graph disagrees; the want's compare-and-set per module -and watched branch; every pipeline started on `catalog-revision`, a publication's included, and the runner's health -read on that consumer; the cost of a refused new indexer revision, which holds its branch until a revert lands; each -check at its row's level, tests 101 and 102 added; ADR 0667's clause numbers as accepted, the gate's forge merge token -removed only at ADR 0667 §12's moment and on the operator's one word, and a fix before the first registrations merged -by the operator's own hand (ADR 0661 §3); the approval asked as the operator-channel's accepted kind `ask`; a replace -removing its object and a gone key's object left to the drop tool; the sent store, its 7-day age as transport, and its -two tools; and the retentions of what the milestone creates (the runner's pipelines and step log, the forge module's -`failed-steps`, the gate's `source.`, the kept seat streams). Its review by architectural domain is still to -come. +and this design disagreed, each as this design's own choice with its reason: the want's compare-and-set per module and +watched branch; the cost of a refused new indexer revision, which holds its branch until a revert lands; each check at +its row's level; ADR 0667's clause numbers as accepted, the gate's forge merge token removed only at ADR 0667 §12's +moment and on the operator's one word, and a fix before the first registrations merged by the operator's own hand (ADR +0661 §3); the approval asked as the operator-channel's accepted kind `ask`; the sent store, its 7-day age as transport, +and its two tools; and the retentions of what the milestone creates (the runner's pipelines and step log, the forge +module's `failed-steps`, the gate's `source.`, the kept seat streams). + +The same day three of that amendment's choices were undone, since they went against accepted decisions: the foundation +parts are again the manifest validator's list, the runner added (ADR 0666 §4), with no registration value for them; the +runner again starts a group's pipeline on the indexer's `take-in.taken` and consumes `package-published` (ADR 0666 §13, +§15), a second start for the same source revision and module writing nothing by the pipeline key's compare-and-set +(test 101); and a replaced object stays, like one whose key is gone, until the drop tool on a person's word (ADR 0595 +§4). Its review by architectural domain is still to come. diff --git a/03-DESIGN/01-to-be/51-the-registries-keep-what-is-named.md b/03-DESIGN/01-to-be/51-the-registries-keep-what-is-named.md index f983953c..580bf6dd 100644 --- a/03-DESIGN/01-to-be/51-the-registries-keep-what-is-named.md +++ b/03-DESIGN/01-to-be/51-the-registries-keep-what-is-named.md @@ -275,8 +275,8 @@ the verb. names older content than the one below it. When the holder says `published`, the builder says the publication as the event `package-published` of its seat `mesh-builds` (the name, the version, the fingerprint, the commit, the watched branch). On it every artifact with a "published before it builds" edge to the package is rebuilt against the new - version; the indexer, which consumes the event, says the catalog revision the publication makes, and the pipeline - runner starts each such artifact's pipeline on that `catalog-revision`, once each (design 47, *A publish rebuilds*); + version, and the pipeline runner, which consumes the event, starts its pipeline (ADR 0666 §15; design 47, *A publish + rebuilds*); nothing else is rebuilt, and a change to a package's tests alone publishes nothing. This removes the claim's wait for earlier merges' numbers below, which held a group on 2026-11-09 (research 086, Findings). Why at publication: a number given at the claim must wait for every earlier merge's number, and a build that never publishes keeps a