2026-09-26 13:22:55 +00:00
1 changed files with 29 additions and 0 deletions
@@ -8,6 +8,35 @@ amended-design:
 # 108 — The registry has no garbage collection, and two doors make it harder to add
 ## 2026-09-26 — the second door was attached to the wrong thing
 *Left in the title and in the text below rather than rewritten, because the reasoning that assumed
 two doors is what a reader needs to see retracted.*
 Two separate things were treated as one. **The mesh's own artifact store holds the store seat**: it
 is internal, reached by name over the overlay, with no accounts, because being on that network is the
 permission ([ADR 0082](../../02-DECISIONS/0082-the-registry-is-reached-by-name-and-trusted-by-the-overlay.md)).
 **Serving a registry publicly is a service the mesh can host** — a module with its own name, its own
 accounts and its own storage, like any other thing it runs for somebody. The conversion this report
 was written beside gave the seat-holding store a second, public, authenticated door over the same
 filesystem, which is neither of those: it is the internal store with an external face.
 That second door is not being built. A publicly served registry, if one is wanted, is a module beside
 the store rather than another way in to it, and it brings its own storage with it.
 What that leaves here:
 - **The complication in the title is gone.** One door means one registry process on the store's
  filesystem, so the shared blob-descriptor cache and the deletion-cached-by-the-other-door problem
  this report worried about do not arise at all.
 - **The original issue is untouched, and is the whole of it.** The mesh's registry has no garbage
  collection, never had, and the settings a collection routine depends on are not enabled.
 - **One thing is sharpened rather than removed.** Enabling deletion on the only door enables it on a
  door with no accounts, reachable by everything on the overlay. The predecessor kept deletion behind
  its authenticated door — which it could, having one. So adding garbage collection now includes
  deciding whether deletion is exposed on that door at all, or only ever performed by a routine the
  mesh runs against its own store.
 ## What was observed
 Reviewing the conversion that gives the mesh's image registry its public, authenticated name,