ADR 0230: a consumer the mesh stops asking for is retired, and deleted only by a person #135

2026-10-06T12:25:21Z

mesh-admin commented

2026-10-06 12:25:21 +00:00

The operator's decision of 2026-10-06, recorded as theirs. It replaces ADR 0229's withdrawal-brake paragraph (the hourly release). The rest of 0229 stands.

Three states. A consumer is active, retired or deleted. Retired means access disabled (reversibly), marked with when and why, data kept.
Stable removals. Retirement waits for the same unasked set in 5 consecutive passes, 5 s apart, so about 20 s. Additions and changes act at once.
Threshold. More than 3, or more than half of those held (when more than one is held), waits for retire approve|reject <node> <module>. An urgent condition says so.
Cleanup. cleanup list and cleanup delete are controller verbs; the provider does the deleting. Every act goes in the hand-act log. D11 raises cleanup-waiting when something has been retired for more than 30 days.
Per-backend disable, defined. postgres: NOLOGIN plus a role comment. keycloak: client disabled plus attributes. TS providers: their issue-241 remove.

Changes:

New 02-DECISIONS/0230-….
A dated "replaced in part" note in 0229 and a "mechanism changed" note in 0224.
To-be 45 amended (§1 writers, §2 conditions, §4 D11, §7 hand acts, Phase 2, code: gains mesh-sdk).
To-be 19 gets a short retirement section.
Index regenerated.

Checks: records, index and cycle all pass.

Code PRs on the same branch name: mesh-controller, mesh-catalog, mesh-sdk. Merge this one first or together; it is documentation only.

The operator's decision of 2026-10-06, recorded as theirs. It replaces ADR 0229's withdrawal-brake paragraph (the hourly release). The rest of 0229 stands. - **Three states.** A consumer is active, retired or deleted. Retired means access disabled (reversibly), marked with when and why, data kept. - **Stable removals.** Retirement waits for the same unasked set in 5 consecutive passes, 5 s apart, so about 20 s. Additions and changes act at once. - **Threshold.** More than 3, or more than half of those held (when more than one is held), waits for `retire approve|reject <node> <module>`. An urgent condition says so. - **Cleanup.** `cleanup list` and `cleanup delete` are controller verbs; the provider does the deleting. Every act goes in the hand-act log. D11 raises `cleanup-waiting` when something has been retired for more than 30 days. - **Per-backend disable, defined.** postgres: NOLOGIN plus a role comment. keycloak: client disabled plus attributes. TS providers: their issue-241 remove. Changes: - New `02-DECISIONS/0230-…`. - A dated "replaced in part" note in 0229 and a "mechanism changed" note in 0224. - To-be 45 amended (§1 writers, §2 conditions, §4 D11, §7 hand acts, Phase 2, `code:` gains mesh-sdk). - To-be 19 gets a short retirement section. - Index regenerated. Checks: records, index and cycle all pass. Code PRs on the same branch name: mesh-controller, mesh-catalog, mesh-sdk. Merge this one first or together; it is documentation only.

mesh-admin commented

2026-10-06 12:36:20 +00:00

Updated in 2c25139.

ADR 0230:

§3. A consumer is retired only after 5 consecutive passes and 10 minutes of the same answer. Both constants are named (StableFor and STABLE_FOR_MS), and the record says why 25 s is not enough.
§1/§2 per provider kind:
- postgres disables.
- keycloak disables.
- A TS provider with retire disables.
- A TS provider without retire is mark-only: its consumer keeps its access, and remove is never called to retire.
Mark-only list: the ADR lists all 11 TS providers as mark-only until each adds a retire, and notes that a restart forgets a mark-only mark.
Consequences and How-it-is-checked are updated to match.

Other documents:

The 0229 and 0224 notes now say "five passes and ten minutes".
To-be 45 (Phase 2 row and amended note) and to-be 19 have the same wording.

The records, index and cycle checks pass.

Updated in 2c25139. ADR 0230: - **§3.** A consumer is retired only after 5 consecutive passes **and** 10 minutes of the same answer. Both constants are named (`StableFor` and `STABLE_FOR_MS`), and the record says why 25 s is not enough. - **§1/§2 per provider kind:** - postgres disables. - keycloak disables. - A TS provider with `retire` disables. - A TS provider without `retire` is **mark-only**: its consumer keeps its access, and `remove` is never called to retire. - **Mark-only list:** the ADR lists all 11 TS providers as mark-only until each adds a `retire`, and notes that a restart forgets a mark-only mark. - **Consequences and How-it-is-checked** are updated to match. Other documents: - The 0229 and 0224 notes now say "five passes and ten minutes". - To-be 45 (Phase 2 row and amended note) and to-be 19 have the same wording. The records, index and cycle checks pass.

jschoubben added 2 commits 2026-10-06 12:46:01 +00:00

ADR 0230: a consumer the mesh stops asking for is retired, and deleted only by a person 3904ef88bf

The operator's decision replaces ADR 0229's hourly release: the mesh no longer
finishes alone what its bound exists to question. To-be 45 and the module
protocol amended; 0229 and 0224 point to where their mechanism moved.

ADR 0230: ten minutes as well as five passes, and mark-only where a provider cannot disable da136ab40e

Five passes are 25 s, shorter than a real hiccup; and a TypeScript provider's
remove can destroy, so retiring never calls it. Every TypeScript provider is
mark-only until it gains a retire that disables.

jschoubben force-pushed feat/retired-consumers from 2c251396f2 to da136ab40e

2026-10-06 12:46:01 +00:00

Compare

jschoubben added 1 commit 2026-10-06 12:46:12 +00:00

Say that a retirement decision never asks for a healer 4801aa87c1

Approving and deleting are a person's act by design (ADR 0230); S15 of to-be
45 now says it leaves them out.

mesh-admin merged commit 89c7a4263d into main

2026-10-06 12:46:32 +00:00

mesh-admin deleted branch feat/retired-consumers

2026-10-06 12:46:32 +00:00

mesh-admin commented

2026-10-06 23:07:39 +00:00

Delivery novox/hq@89c7a4263d0f — held since 2026-10-06T23:05:28Z

Held for a person: merged without a passing check: only a person decides that it goes on — mesh-delivery.release with why lets it go on.

Delivery plan — builds nothing: the change touches no module of the mesh's graph

Transitions

2026-10-06 23:05 (new) → proposed (announced): novox/hq#135 merged; its head was not heard by this owner, so it is made from the forge's word
2026-10-06 23:05 proposed → held (merged-unchecked): merged without a passing check — a verdict known with it is taken first: only a person decides that it goes on

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

**Delivery** `novox/hq@89c7a4263d0f` — **held** since 2026-10-06T23:05:28Z Held for a person: merged without a passing check: only a person decides that it goes on — `mesh-delivery.release` with why lets it go on. **Delivery plan** — builds nothing: the change touches no module of the mesh's graph **Transitions** - 2026-10-06 23:05 (new) → proposed (announced): novox/hq#135 merged; its head was not heard by this owner, so it is made from the forge's word - 2026-10-06 23:05 proposed → held (merged-unchecked): merged without a passing check — a verdict known with it is taken first: only a person decides that it goes on The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/hq#135