ADR 0236, to-be 45 Phase 4: a build is judged on its first machine and put back by something other than itself #146

2026-10-06T16:39:49Z

mesh-admin commented

2026-10-06 16:39:49 +00:00

Phase 4 of to-be 45 ("start phase 4"), recorded as ADR 0236.

The core's health as probes: H-controller, H-engine, H-tools, H-bus; DG (gate verdicts, witness rollbacks), DB (the bus step).
The gate on every plan's first machine: a core component by its definition, a module by its own health (applied, no witness verdict, no new condition about it on that machine, its tools served); three healthy judgings, at least 2 min after the send, within 10.
Rollback once per build by the ordinary path: the build marked, the registered build put back to what the first machine ran, that machine sent it; build.<module>.<machine>.rolled-back / core.<component>.<machine>.rolled-back / rollback-failed, and the event rolled-back.
Default policy roll; record kept where a module says why (network path, providers whose restart costs, the photos' stores), keeps irreplaceable data (plex, photos), or is the bus. Table of every module's resulting policy in the record.
The witness contract with mesh-host (PR #40): what the host reads, when it judges healthy, what it starts, rollbacks/witness in the report.
The bus as a step a person starts: bus upgrade --why … --reversible|--irreversible, snapshot first (ADR 0235's dump, via the bus machine's backup holder), bus-maintenance, checked after.
A module deleted at its source is not built (the public-acme plan failure).

Amends to-be 45 §4, §8 and Phase 4 (built on branches, not yet); pointers in ADR 0218 and 0221. Checks: records, cycle, index pass.

Code: mesh-controller, mesh-host, mesh-catalog branches feat/core-upgrades-that-roll-back; mesh-host witness PR #40.

Phase 4 of to-be 45 ("start phase 4"), recorded as ADR 0236. - **The core's health as probes**: H-controller, H-engine, H-tools, H-bus; DG (gate verdicts, witness rollbacks), DB (the bus step). - **The gate on every plan's first machine**: a core component by its definition, a module by its own health (applied, no witness verdict, no new condition about it on that machine, its tools served); three healthy judgings, at least 2 min after the send, within 10. - **Rollback once per build** by the ordinary path: the build marked, the registered build put back to what the first machine ran, that machine sent it; `build.<module>.<machine>.rolled-back` / `core.<component>.<machine>.rolled-back` / `rollback-failed`, and the event `rolled-back`. - **Default policy `roll`**; `record` kept where a module says why (network path, providers whose restart costs, the photos' stores), keeps irreplaceable data (plex, photos), or is the bus. Table of every module's resulting policy in the record. - **The witness contract** with mesh-host (PR #40): what the host reads, when it judges healthy, what it starts, `rollbacks`/`witness` in the report. - **The bus as a step a person starts**: `bus upgrade --why … --reversible|--irreversible`, snapshot first (ADR 0235's dump, via the bus machine's backup holder), `bus-maintenance`, checked after. - **A module deleted at its source is not built** (the public-acme plan failure). Amends to-be 45 §4, §8 and Phase 4 (built on branches, not yet); pointers in ADR 0218 and 0221. Checks: records, cycle, index pass. Code: mesh-controller, mesh-host, mesh-catalog branches `feat/core-upgrades-that-roll-back`; mesh-host witness PR #40.

jschoubben added 3 commits 2026-10-06 17:12:54 +00:00

ADR 0236, to-be 45: a build is judged on its first machine and put back by something other than itself 235330ce00

Phase 4 of to-be 45, started by the operator: the core's health as probes, a gate on
every plan's first machine, the rollback there once per build, the witness's contract
with the host, the bus as a step a person starts, and — with those in place — rolling
out as the default, keeping record where a module says why. 47 pushes by hand in one
day are what it ends.

ADR 0236: no send reaches the bus's machine while a new bus build waits 301c551888

Found live the same day: a plan's send of the catalogue carried the bus's rebuilt image
to the control node and restarted the bus unasked.

ADR 0236: no build reaches a machine without a gate, and a release plan walks what waits 4ee06bd99f

The coordinator's review: at the switch to roll, every send would carry the old default's
backlog unjudged. Measured: 88 of the 103 rebuilt modules were byte-identical, and no
build waited on any machine.

jschoubben force-pushed feat/core-upgrades-that-roll-back from b40e61dd02 to 4ee06bd99f

2026-10-06 17:12:54 +00:00

Compare

mesh-admin merged commit 62d4b1e5d4 into main

2026-10-06 17:15:09 +00:00

mesh-admin deleted branch feat/core-upgrades-that-roll-back

2026-10-06 17:15:10 +00:00

mesh-admin commented

2026-10-06 23:07:23 +00:00

Delivery novox/hq@62d4b1e5d4ff — held since 2026-10-06T23:05:28Z

Held for a person: merged without a passing check: only a person decides that it goes on — mesh-delivery.release with why lets it go on.

Delivery plan — builds nothing: the change touches no module of the mesh's graph

Transitions

2026-10-06 23:05 (new) → proposed (announced): novox/hq#146 merged; its head was not heard by this owner, so it is made from the forge's word
2026-10-06 23:05 proposed → held (merged-unchecked): merged without a passing check — a verdict known with it is taken first: only a person decides that it goes on

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

**Delivery** `novox/hq@62d4b1e5d4ff` — **held** since 2026-10-06T23:05:28Z Held for a person: merged without a passing check: only a person decides that it goes on — `mesh-delivery.release` with why lets it go on. **Delivery plan** — builds nothing: the change touches no module of the mesh's graph **Transitions** - 2026-10-06 23:05 (new) → proposed (announced): novox/hq#146 merged; its head was not heard by this owner, so it is made from the forge's word - 2026-10-06 23:05 proposed → held (merged-unchecked): merged without a passing check — a verdict known with it is taken first: only a person decides that it goes on The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-admin referenced this pull request

2026-10-08 13:09:18 +00:00

ADR 0254: correct what the fix covers after its review (progressive insight, issue 318) #210

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/hq#146