From cbd9f092d8d4fe325017ccc6711d752a4e28babc Mon Sep 17 00:00:00 2001 From: jochen Date: Fri, 9 Oct 2026 09:24:30 +0200 Subject: [PATCH] ADR 0270 and 0271 accepted: their home in designs 47 and 45, and the glossary's final states The operator accepted both on 2026-10-09. Design 47's state table gains covered and what ends a held delivery by itself, and its group the wait for a composed check and the lift; design 45's signals table gains S17 and its planned bus step says the wait is told at once. The glossary's delivery entry names its six final states. --- 00-META/glossary.md | 10 +++--- ...f-and-a-hold-whose-reason-is-gone-lifts.md | 4 +-- ...-that-needs-it-says-so-before-it-merges.md | 4 +-- .../45-a-core-that-cannot-fail-silently.md | 9 ++++-- .../47-delivery-from-commit-to-delivered.md | 32 ++++++++++++++----- .../01-diagnosis.md | 2 ++ .../01-diagnosis.md | 2 ++ .../01-diagnosis.md | 2 ++ 8 files changed, 47 insertions(+), 18 deletions(-) diff --git a/00-META/glossary.md b/00-META/glossary.md index b23fbc36..9062b7fa 100644 --- a/00-META/glossary.md +++ b/00-META/glossary.md @@ -278,7 +278,7 @@ and the operator act. **Recorded by** the controller's `identity` and `licences` **Purpose.** To take one commit from its pull request to every node that should run it, and to put it back when it fails. **Recorded by** the `mesh-delivery` module (deliveries) and the controller (the planner, the walk). **Downstream of** Module, Core, Health and repair and Data. -**Decided by** ADR 0162, 0218, 0236, 0237, 0238, 0239, 0267. +**Decided by** ADR 0162, 0218, 0236, 0237, 0238, 0239, 0250, 0267, 0270. **Uses:** module, node, declaration and send (Placement), health (Health and repair), person. - **merge check** — the two statuses a pull request carries before it may merge: the **merge gate** @@ -313,17 +313,19 @@ planner, the walk). **Downstream of** Module, Core, Health and repair and Data. modules live in. `mesh-catalog` and `catalog_modules` are identifiers and keep their spelling. *Not:* ~~catalog~~ (hq) - **delivery** — one commit in one repository on its way to the nodes, from its pull request's head - being announced to delivered, failed, superseded or stopped: one pull request, one status, one note + being announced to one of its final states: one pull request, one status, one note ([ADR 0239](../02-DECISIONS/0239-a-delivery-is-owned-by-the-mesh-delivery-module-and-runs-from-commit-to-delivered.md)). Its states are one table (`proposed`, `checked`, `ready` or `rejected`, `published`, `delivering`, - `held`, and the final four). Not *change* (a diff). *Pipeline* is the predecessor's build-and-deploy + `held`, and the final six: `delivered`, `failed`, `superseded`, `stopped`, `retired` and `covered`; + [ADR 0250](../02-DECISIONS/0250-a-merge-heard-only-from-the-buss-history-is-retired-and-owed-work-the-forge-cannot-do-ends.md), + [ADR 0270](../02-DECISIONS/0270-a-held-delivery-that-moves-nothing-or-that-a-later-delivered-merge-contains-ends-by-itself-and-a-hold-whose-reason-is-gone-lifts.md)). Not *change* (a diff). *Pipeline* is the predecessor's build-and-deploy mechanism, which the as-is designs describe; it is never a word for a delivery. *Not:* ~~deployment~~ (hq) - **covered** — the end of a delivery that a later merge containing it delivered: every module it moves was sent to every machine running it by the walk of a later merge into the same trunk, delivered on its own passing check, whose merge commit the forge says contains this one. Not *superseded*, which is a delivery whose walk a newer delivery took over before it ended; nor *delivered*, which its own walk or an empty plan - ends in ([ADR 0270](../02-DECISIONS/0270-a-held-delivery-that-moves-nothing-or-that-a-later-delivered-merge-contains-ends-by-itself-and-a-hold-whose-reason-is-gone-lifts.md), proposed). + ends in ([ADR 0270](../02-DECISIONS/0270-a-held-delivery-that-moves-nothing-or-that-a-later-delivered-merge-contains-ends-by-itself-and-a-hold-whose-reason-is-gone-lifts.md)). - **delivery group** — two or more deliveries sharing a pull request head branch name across the mesh's repositories, delivered as one unit in an order declared (`after:`) or inferred by the planner. One level: a group holds deliveries, never groups. Its state is derived from its members, never set. diff --git a/02-DECISIONS/0270-a-held-delivery-that-moves-nothing-or-that-a-later-delivered-merge-contains-ends-by-itself-and-a-hold-whose-reason-is-gone-lifts.md b/02-DECISIONS/0270-a-held-delivery-that-moves-nothing-or-that-a-later-delivered-merge-contains-ends-by-itself-and-a-hold-whose-reason-is-gone-lifts.md index c884e940..857992ef 100644 --- a/02-DECISIONS/0270-a-held-delivery-that-moves-nothing-or-that-a-later-delivered-merge-contains-ends-by-itself-and-a-hold-whose-reason-is-gone-lifts.md +++ b/02-DECISIONS/0270-a-held-delivery-that-moves-nothing-or-that-a-later-delivered-merge-contains-ends-by-itself-and-a-hold-whose-reason-is-gone-lifts.md @@ -1,6 +1,6 @@ --- topic: the mesh -status: proposed +status: accepted date: 2026-10-09 deciders: jochen reconstructed: false @@ -198,6 +198,6 @@ stopped or failed. - [Issue 300](../04-ISSUES/300-a-new-module-is-not-built-at-its-merge/00-report.md), why a new module opens no walk. - [Design 47](../03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md), *The state table* and *A - delivery group*, which take these rows once this record is accepted. + delivery group*, which carry these rows. - mesh-catalog #150, which builds it, and the forge module's `gitea_contains` with it; mesh-catalog #151, which has the catalogue's check run its TypeScript modules. diff --git a/02-DECISIONS/0271-a-send-held-for-the-buss-planned-step-is-told-to-the-operator-at-once-and-a-change-that-needs-it-says-so-before-it-merges.md b/02-DECISIONS/0271-a-send-held-for-the-buss-planned-step-is-told-to-the-operator-at-once-and-a-change-that-needs-it-says-so-before-it-merges.md index 389cc6fc..f353c2ae 100644 --- a/02-DECISIONS/0271-a-send-held-for-the-buss-planned-step-is-told-to-the-operator-at-once-and-a-change-that-needs-it-says-so-before-it-merges.md +++ b/02-DECISIONS/0271-a-send-held-for-the-buss-planned-step-is-told-to-the-operator-at-once-and-a-change-that-needs-it-says-so-before-it-merges.md @@ -1,6 +1,6 @@ --- topic: the mesh -status: proposed +status: accepted date: 2026-10-09 deciders: jochen reconstructed: false @@ -118,5 +118,5 @@ Three things were missing, read from the controller's code [ADR 0254](0254-a-wait-for-a-persons-new-login-is-not-a-gates-failure-and-each-module-of-a-send-keeps-its-own-pass.md), the precedent of a wait for a person said as its own condition. - [To-be 45](../03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md) §3, the signals table, and §8, the - bus as a planned step, which take this row once this record is accepted. + bus as a planned step, which carry this row. - mesh-controller #173, which builds it. diff --git a/03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md b/03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md index 858f6fef..6a593c44 100644 --- a/03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md +++ b/03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md @@ -2,8 +2,9 @@ layer: to-be status: in-progress code: [mesh-controller, mesh-host, mesh-tools, mesh-catalog, mesh-sdk, mesh-lab] -updated: 2026-10-08 +updated: 2026-10-09 decisions: + - 02-DECISIONS/0271-a-send-held-for-the-buss-planned-step-is-told-to-the-operator-at-once-and-a-change-that-needs-it-says-so-before-it-merges.md - 02-DECISIONS/0265-a-verb-that-reads-is-answered-on-the-serving-controllers-own-connection-and-every-connection-says-what-it-is.md - 02-DECISIONS/0264-a-message-a-consumer-gives-up-on-is-kept-until-a-person-delivers-it-again-or-drops-it.md - 02-DECISIONS/0261-an-assignment-made-while-its-modules-build-runs-is-kept-pending-and-the-controller-makes-it.md @@ -233,6 +234,7 @@ signal and asserts its condition. `doctor signals` shows, for every row, the age | S14 | facts snapshot exported | controller | when it moved, and daily | 2 days, or none kept by a controller up that long (Phase 5) | `facts-stale` | warning | — | | S15 | a hand act with a cause already recorded | hand-act log | each act | the second within 14 days; clears when fewer than two remain within 14 days | `healer-wanted` (names the cause, and the healer that was not enough where one answers it) | warning | — | | S16 | a walk waiting for its delivery's word is let go | mesh-delivery, through `deliver` (ADR 0239) | each merge whose walk waits | 30 min; urgent after 4 h | `waiting` (names the walk and `plans go`) | warning | — | +| S17 | a send held for the bus's planned step is told to a person (ADR 0271) | controller's plan | each send refused because it would replace the bus outside its step | none: the first refusal; cleared once the bus's machine has been sent the build the mesh holds | `bus-step-waiting`, for the operator (names the machines, what waits, the bus build from and to, since when and the `mesh-controller.bus` call); S3 leaves such a walk out | warning | — | The bus advisories (S9) cost one read-only subscription: the server already publishes them. The controller translates each into a condition naming the thing in the mesh's words, as the refused reply @@ -562,7 +564,10 @@ bus machine's backup holder backing the bus module up now ([ADR 0235](../../02-D or one a person took and names with `--snapshot-taken`; the step's bound is fifteen minutes; **no send reaches the bus's machine while a new bus build waits for it** — a push, a plan's send for another module, a healer's — after a plan's send restarted the bus unasked on 2026-10-06; a change of the bus's -user list is reloaded in place, not a restart. *2026-10-06:* the snapshot +user list is reloaded in place, not a restart. **A send held for the step is told at once** ([ADR 0271](../../02-DECISIONS/0271-a-send-held-for-the-buss-planned-step-is-told-to-the-operator-at-once-and-a-change-that-needs-it-says-so-before-it-merges.md)): +S17 raises `bus..step-waiting` for the operator on the first refusal, and a change that builds the bus +says in its delivery plan, and so in `mesh/merge-gate`'s description, that merging it needs a person's bus +upgrade. *2026-10-06:* the snapshot and the way back from it exist — the bus image's own snapshot program, the same one the night's backup runs, and a restore that builds a new store beside the live one for a person to swap in ([ADR 0235](../../02-DECISIONS/0235-the-bus-is-backed-up-by-its-own-snapshot-of-each-stream.md), diff --git a/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md b/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md index 01708154..b69000e6 100644 --- a/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md +++ b/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md @@ -2,8 +2,9 @@ layer: to-be status: designed code: [] -updated: 2026-10-08 +updated: 2026-10-09 decisions: + - 02-DECISIONS/0270-a-held-delivery-that-moves-nothing-or-that-a-later-delivered-merge-contains-ends-by-itself-and-a-hold-whose-reason-is-gone-lifts.md - 02-DECISIONS/0250-a-merge-heard-only-from-the-buss-history-is-retired-and-owed-work-the-forge-cannot-do-ends.md - 02-DECISIONS/0249-a-delivery-groups-order-rules-have-a-precedence-and-a-declared-order-outranks-them-all.md - 02-DECISIONS/0239-a-delivery-is-owned-by-the-mesh-delivery-module-and-runs-from-commit-to-delivered.md @@ -72,14 +73,26 @@ allows. | ready | it passed; it waits to be merged | none | — | | rejected | it failed its check | none | — | | published | merged on the trunk its modules follow, its walk opened and asking nothing; it waits for its turn or its word | 30 minutes | `superseded` when a newer delivery took over its walk; `go` when its walk started | -| held | it waits for a person | 1 day | nothing: it is the operator's | +| held | it waits for a person; read again each tick, so it ends by itself when it moves nothing or a later merge covers it (ADR 0270) | 1 day | nothing: it is the operator's | | delivering | its walk runs; its builds are asked and registered tier by tier | 2 hours | `delivered`, `failed` or `superseded`, as the walk's record says | -| delivered, failed, superseded, stopped, retired | final | — | — | +| delivered, failed, superseded, stopped, retired, covered | final | — | — | -The transitions are those of ADR 0239 decision 2. A delivery that is merged while not `ready` goes to -`held`. Its check did not pass, and only a person decides that it goes on. A delivery merged with no walk -opened for it within ten minutes is held too, saying so: nothing it moves follows that branch, or the merge -was not heard. Nothing waits silently. +The transitions are those of ADR 0239 decision 2 and [ADR 0270](../../02-DECISIONS/0270-a-held-delivery-that-moves-nothing-or-that-a-later-delivered-merge-contains-ends-by-itself-and-a-hold-whose-reason-is-gone-lifts.md). A delivery that is +merged while not `ready` goes to `held`. Its check did not pass, and only a person decides that it goes on. A +delivery merged with no walk opened for it within ten minutes is held too, saying so: nothing it moves follows +that branch, or the merge was not heard. Nothing waits silently. + +**What needs no person ends by itself** (ADR 0270): + +- *a merge that moves nothing* (its plan builds nothing, or only adds a module the controller builds and + sends nowhere) is `delivered` as soon as it is merged, whatever its check said; +- *a merge a later delivered merge contains* is `covered`: every module it moves was sent to every machine + running it by the walk of a later merge into the same trunk, delivered on its own passing check, and the + forge says that later merge commit contains it (`gitea_contains`, asked once per pair and kept). Merge + order is only the first filter, and a forge that cannot answer means not yet covered. `mesh/delivery` + says `covered: a later merge that contains it was delivered` as a success. A module that runs on one + machine only gets no "rest" step and is never covered; +- the covered row is tried before `go`, from `held` and from `ready` past the ten minutes. **History is retired, not held** ([ADR 0250](../../02-DECISIONS/0250-a-merge-heard-only-from-the-buss-history-is-retired-and-owed-work-the-forge-cannot-do-ends.md)). A delivery made from the forge's word at its merge, heard fifteen minutes or more after that merge, with no walk @@ -108,7 +121,10 @@ controller's `plan-moved` event, never inferred from time. - **Check**: the members' heads composed together, one gate over every machine with all their definitions. It is asked by mesh-delivery through `delivery-check` when the group forms or a member's head moves, and posted on every member's head as `mesh/delivery-group`. -- **Delivering**: in order. A member waits in `published` until the one before is `delivered`. +- **Delivering**: in order. A member waits in `published` until the one before is `delivered` or `covered`. + A member published while its group's composed check is asked and not answered waits there for the answer; + one held because that check had not passed is *lifted* back to `published` once it passes or warns for the + heads that merged and its own walk is still open (ADR 0270). - **A failed member**: the members after it are `stopped`, naming it. The members before it stay delivered. Its own builds were put back at its gate. diff --git a/04-ISSUES/316-a-group-member-held-before-its-composed-check-answered-stayed-held-after-it-passed/01-diagnosis.md b/04-ISSUES/316-a-group-member-held-before-its-composed-check-answered-stayed-held-after-it-passed/01-diagnosis.md index 6b9fcb02..1fe3bcc2 100644 --- a/04-ISSUES/316-a-group-member-held-before-its-composed-check-answered-stayed-held-after-it-passed/01-diagnosis.md +++ b/04-ISSUES/316-a-group-member-held-before-its-composed-check-answered-stayed-held-after-it-passed/01-diagnosis.md @@ -63,3 +63,5 @@ The group's order put it second. Open question 4 in the report asks whether that Open question 3, whether `mesh/delivery-group` is required on the trunks, stays the operator's setting. Open question 4 is not touched. + +**Accepted 2026-10-09.** The operator accepted the record named above; it is no longer proposed. diff --git a/04-ISSUES/319-a-held-delivery-a-later-commit-superseded-has-no-end-but-release/01-diagnosis.md b/04-ISSUES/319-a-held-delivery-a-later-commit-superseded-has-no-end-but-release/01-diagnosis.md index 4e669d19..ece2470f 100644 --- a/04-ISSUES/319-a-held-delivery-a-later-commit-superseded-has-no-end-but-release/01-diagnosis.md +++ b/04-ISSUES/319-a-held-delivery-a-later-commit-superseded-has-no-end-but-release/01-diagnosis.md @@ -145,3 +145,5 @@ longer leaves anything held. `delivery..stalled`. 6. The two catalogue merges held for their group (issue 316) are covered only if a later delivered walk sent their module. One that stays held is a real question: its change may not run anywhere. + +**Accepted 2026-10-09.** The operator accepted the record named above; it is no longer proposed. diff --git a/04-ISSUES/336-a-send-held-for-the-bus-step-raises-nothing/01-diagnosis.md b/04-ISSUES/336-a-send-held-for-the-bus-step-raises-nothing/01-diagnosis.md index 2318eee2..37c27199 100644 --- a/04-ISSUES/336-a-send-held-for-the-bus-step-raises-nothing/01-diagnosis.md +++ b/04-ISSUES/336-a-send-held-for-the-bus-step-raises-nothing/01-diagnosis.md @@ -79,3 +79,5 @@ in mesh-lab's replays register as R336 before this issue resolves with `replay: Suggested fix 2 (an ask) waits for ADR 0259's asks. The guess about letting a send keep the bus at its running build and carry the rest is not checked here. + +**Accepted 2026-10-09.** The operator accepted the record named above; it is no longer proposed.