Hold a delivery on a machine whose network names an outside cause (O-9), and name mesh-host's wireguard places in §428

Claude-Session: https://claude.ai/code/session_01JG73KEq4zoDfM9WtYpcQgZ
2026-11-11 21:04:00 +01:00
parent 414490fa5a
commit e6c8bb15d1
3 changed files with 41 additions and 3 deletions
@@ -38,7 +38,7 @@ One file of milestone G's part of [design 47](../47-delivery-from-commit-to-deli
 2026-11-11): the approval mark once no verb names its callers (the operator's answer of about 16:10 CET, §610); the
 keeper's snapshots, with the operator's answer O-7 of 20:22 CET (§681); the recovery module's verbs, the entries the
 node-engine keeps and the grants part's first composition (§682 to §684); the gate before a marked verb's running
-(§677, the operator's O-8); and develop's D-16 to D-49, of internal form only. The rounds' other fixes are written in the lines they correct.*
+(§677, the operator's O-8); develop's D-16 to D-49, of internal form only; and the operator's O-9 (§705). The rounds' other fixes are written in the lines they correct.*
 ## The approval mark, with no named callers
@@ -521,3 +521,39 @@ node-engine keeps and the grants part's first composition (§682 to §684); the
  How it is checked: unit (indexer), the seed's `steps` input per artifact; `unwatch` refused through a fixture
  `placement`; `candidate` refused with `reserved branch name`; a full history refusing a change and naming it.
 ## The operator's O-9: a delivery waits on another machine's network
 - §705 **A machine whose network names an outside cause holds the delivery there as a wait, not a failure.** (ADR
  0241 §25 to §27; the main file's *A failure is held on the canary and fixed forward*; §498, §633) The operator,
  2026-11-11 about 21:05 CET at lead-47's terminal (O-9): a delivered module's own failing health check is the
  delivery's; but while the machine's network statement names an outside cause, the delivery waits on that machine,
  says from the start what it waits on, judges again once the cause clears and goes on by itself, and after 30
  minutes asks the operator to go on or count it as failed. Where the assigner judges a node's health after a want
  moves (the canary rule and its hold):
  - **An outside cause.** While the node-engine of that machine says a finding `rewritten` naming a file of a module
    the delivery did not move (ADR 0241 §25), or `unreachable` toward another machine (ADR 0241 §25), heard by the
    assigner's consumer of the node-engine's finding events (§627's stream, in its `consumes`), a failing health check
    of a module the delivery moved there is no failure: the assigner holds that move as a wait, said at once on
    `mesh-wants`' `wait-held` with `step` `delivery`, `node` that machine and `on` `rewritten:<owner>` or
    `unreachable:<machine>`, and writes the finding `delivery-waits-outside` (scope `delivery`, id
    `<node>.<module>`), naming the cause.
  - **It goes on by itself.** When that finding is cleared, the assigner judges the module's health there again:
    healthy, the delivery goes on, `wait-ended` with `how` `cleared`; failing, it is the delivery's failure, held as
    the canary rule has it.
  - **The bound and the ask.** Past `outside-wait-minutes` (a setting, §633, 30 unless set) from the wait's start,
    the assigner asks the operator through `operatorchannelclient`, `about` `<node>.<module>.<fingerprint>`, with
    two options, Go on (the module counted healthy there, so the delivery goes on, `how` `go-on`) and Count as
    failed (held as the canary rule has it, `how` `failed`); the ask names the cause and since when; the wait stands
    until the answer or the cause clears, which ends the ask. The finding clears when the wait ends.
  - **What stays the delivery's or the machine's.** A `rewritten` naming a module the delivery moved is that
    module's failure (ADR 0241 §26). A machine's own `network` finding holds the machine as a whole: no want moves to
    it until it clears (ADR 0241 §27).
  Why: the operator's answer O-9; ADR 0241 §25 had the wait with no bound, which this gives one and an ask, resting on
  the record of the outside-cause wait (number to come; its draft is with lead-47), which changes ADR 0241 §25 and
  keeps §26 and §27. How it is checked, as cases of the assigner's whole test: an `unreachable` toward
  another machine turning a failing check into a wait, said at once, ended `cleared` and the delivery going on when
  it clears; one that fails once cleared held as a failure; past the setting the ask, Go on ending `go-on` and Count
  as failed ending `failed`; a `rewritten` naming a moved module failing at once; a machine's own `network` moving
  no want to it.
@@ -242,7 +242,9 @@ line says so.*
  `mesh-config`, `mesh-vault`, `mesh-wireguard`, the tool runner and the bus module, and the branch `main`; in
  mesh-catalog, the gate's merge branch, the SDK's repository and the teller's, view's and forge bridge's module
  names, the forge module's base branch and the indexer's name and tool, and the build modules' indexer tool; in
-  `mesh-host`, the node-engine's own module name in its guard, compose and bootstrap; in mesh-sdk, the node-engine's
+  `mesh-host`, the node-engine's own module name in its guard, compose and bootstrap, and `mesh-wireguard` in
  `compose/composed.go` and `cmd/mesh-host/trust.go`, whose removal (with mesh-wireguard's built-in manifest,
  `ProvidedManifest` and `ProvidedByMesh`) is design 72's, not G's: G keeps them; in mesh-sdk, the node-engine's
  names (§364); in mesh-tools, the assigner's first views by name; in mesh-networking, `mesh-wireguard` and
  `mesh-provisioner`. Why: the design's choice (Q-H9, C10, D7). How it is checked: the code review (§7).
 - §429 **Lines "until G's delivery".** The new gate builds the forms from G's delivery and the switch (§156, §169)
@@ -101,6 +101,6 @@ The part is eighteen files, each read whole, its design lines numbered across th
 - [G-15-develop-answers-fifth](G-15-develop-answers-fifth.md): develop's fifth batch, round 3's notes on §516 to §559, the knowledge base's review of the recovery module's record, and the operator's answers of 2026-11-11 about 14:05, 14:15 and 14:30 CET (§560 to §586).
 - [G-16-develop-answers-sixth](G-16-develop-answers-sixth.md): develop's sixth batch: the ledger's upkeep calls, the builder's publishes again and its read of a module's builds, one event of a node's capabilities, the object stores' caps, the gate's merge path from G's delivery, and the readers of a module's manifest (§587 to §594).
 - [G-17-develop-answers-seventh](G-17-develop-answers-seventh.md): develop's seventh batch: the operator's answers of 2026-11-11 15:14 to 15:42 CET (callers by class, the five parts' findings, the forge and image registry's other entries, the gate's kept data), how every part reads the catalog half per watched branch, and the refreshed build maps' questions (§610 to §676).
- [G-18-fix-round-six-seven](G-18-fix-round-six-seven.md): the fix round of §587 to §676: the approval mark once no verb names its callers, the keeper's snapshots, the recovery module's verbs, the node-engine's kept entries, the gate before a marked verb's running, and develop's D-16 to D-49 (§677 to §704).
+- [G-18-fix-round-six-seven](G-18-fix-round-six-seven.md): the fix round of §587 to §676: the approval mark once no verb names its callers, the keeper's snapshots, the recovery module's verbs, the node-engine's kept entries, the gate before a marked verb's running, develop's D-16 to D-49, and a delivery's wait on another machine's network (§677 to §705).
 Design 34's milestone [every-event](../34-milestones/every-event.md) and design 46's milestone [7-approval-mark](../46-milestones/7-approval-mark.md) ship in milestone G's release, built in its repositories beside G's lines (lead-47, 2026-11-11 15:30 CET); where one of their lines and a line of G differ, G's later line holds and the other is corrected in place (§624 to §626).