2026-09-30 07:00:32 +00:00
4 changed files with 148 additions and 1 deletions
@@ -0,0 +1,68 @@
+# 107 — diagnosis: the fix is a flag day, and it should wait for delivery
+
+*2026-09-30. Read, measured, and not built — deliberately.*
+
+## The premise is confirmed
+
+A host parses a declaration with unknown fields refused, and the code says why rather than leaving it
+to be inferred:
+
+> `DisallowUnknownFields` is the whole point rather than strictness for its own sake: a field the host
+> does not know is a thing the control plane believes it asked for.
+
+So adding `sequence` and `supersedes` is not an additive change. **Any host that has not been upgraded
+refuses the whole declaration and applies nothing** — which is exactly the behaviour that keeps a
+half-understood declaration off a machine, and exactly what makes this expensive.
+
+## What has changed since this was filed
+
+[Issue 087](../087-the-controller-cannot-tell-a-host-is-too-old/00-report.md) is resolved: the mesh now
+records the host version each machine reports and `status` names every machine running an older host
+than another does. The flag day is visible before it is walked into, which it was not on 2026-09-23.
+
+That makes the cost measurable rather than hypothetical, and the measurement is the reason this is not
+being built today.
+
+## Why it waits
+
+**One machine of four runs an older host, and it cannot be upgraded.** `ace` is adopted, deliberately
+parked until the network and module-assignment work is settled, and **nothing delivers a host version at
+all** — [ADR 0141](../../02-DECISIONS/0141-the-host-delivers-its-own-successor.md) is accepted and not
+built, which is [issue 142](../142-the-host-is-the-one-thing-the-mesh-does-not-deliver/00-report.md).
+Every machine takes a hand-placed binary.
+
+So shipping the field means, in order: place a host by hand on three machines, unpark the fourth, place
+it there too, and only then turn the controller half on. A machine missed in that sequence is a machine
+the mesh cannot send anything to at all — not degraded, unreachable.
+
+**And the fault it prevents has never been observed.** The record says so itself: *"Not observed;
+constructed from the code, and narrow."* It needs a backlog of more than sixteen declarations queued
+across a `converge`/`adopt` pair, or a broker slow enough to split one, and the host already applies the
+newest of a drained batch and refuses a declaration that is not the last by digest.
+
+**Trading a machine's reachability for a replay nobody has seen is the wrong way round.** The right
+order is [issue 142](../142-the-host-is-the-one-thing-the-mesh-does-not-deliver/00-report.md) first —
+when the mesh can deliver a host, a declaration field costs a rollout instead of an expedition — and the
+work order already puts that in its last group, as the proof that the mesh can make another of itself.
+
+## What the open questions look like now
+
+- *A per-node `sequence` under the controller's node hold, and `supersedes` as the previous digest?*
+  Still the right shape. The controller already holds the lock and already records each send, so the
+  order exists and is thrown away at the wire — unchanged since this was filed.
+- *Genesis signing its bundle as sequence zero?* Yes, and it is the cheaper half: the bundle is written
+  by the host that will read it, so it has no flag day of its own.
+- *Is a sequence enough, or does a mode change deserve its own marker?* A sequence alone does not stop
+  a replayed *converged* declaration reaching a node that has since been returned to adopted, which is
+  the incident of issue 104 by another door and is what this record names as its real risk. It wants
+  both, and the second is the one worth having first.
+- **And one this record did not ask:** should a declaration say which host version it needs? 087 makes
+  that comparable for the first time, and it is the general form of the answer — a field that announces
+  its own requirement, rather than a flag day per field, for ever.
+
+## Status
+
+Left `located`. The owner is unchanged, the shape of the fix is agreed, and the gate is
+[issue 142](../142-the-host-is-the-one-thing-the-mesh-does-not-deliver/00-report.md) rather than anything
+in this record. **This is a judgement about order, not a refusal** — it is cheap to overrule, and the
+code is a day's work once a host can be delivered.
@@ -74,3 +74,18 @@ every future change of this shape, and it was paid today.
  argues for the former.
 - Does the same gap apply to the launcher and the units beside the binary, which are also files no
  declaration names?
+
+## What now waits on this (2026-09-30)
+
+[Issue 107](../107-a-declaration-carries-no-order/00-report.md) — a declaration carries no order, so a
+host cannot tell an older one from a newer. Its fix adds a field to the declaration, and a host refuses a
+declaration carrying a field it does not know, **whole**. So it is a flag day: every host upgraded, then
+the controller.
+
+With nothing delivering a host, that means placing a binary by hand on every machine and unparking the
+adopted one, and a machine missed in the sequence is a machine the mesh cannot send anything to at all.
+107 is held for that reason rather than for anything in its own diagnosis.
+
+**This is what makes a declaration field cost a rollout instead of an expedition**, which is a use for
+this record beyond keeping machines current: it is the thing standing between the mesh and its own
+protocol evolving.
@@ -4,7 +4,7 @@ opened: 2026-09-29
 located-in:
  - mesh-controller internal/catalogue/filtering.go (fixed for this instance)
  - mesh-controller (what status reports, and what it does not ask)
-fixed-by:
+fixed-by: partly — mesh-controller 1da96e8 makes the report state its own scope; nothing dials a provision yet, which is ADR 0146 and is not built
 amended-design: 03-DESIGN/01-to-be/10-delivery.md
 ---

@@ -0,0 +1,64 @@
+# 145 — partly resolved: the report says what it is not a claim about
+
+*2026-09-30.*
+
+## What was done
+
+The sentence that was true for eleven hours now states its own scope, immediately below itself:
+
+```
+4 machine(s), all doing what they were told, all heard from, running what the mesh would send
+them, and every module current with its source
+
+  That is the mesh and the machines agreeing. Nothing here dials a provision:
+  no grant the mesh composed has been tested, so a module unable to reach what it
+  requires would not appear above (04-ISSUES/145)
+```
+
+That is the whole of what this change does, and it is deliberately small. It does not check anything.
+It closes the distance between *the machines are as the mesh described them* and *it works* by naming
+it, and that distance is where the eleven hours went: the report was read as the second and only ever
+meant the first.
+
+Two other reports in this group now carry real information they did not
+([issue 125](../125-a-hold-is-not-a-line-in-the-apply-report/00-report.md): a hold is a line in the
+apply report and breaks the all-well sentence;
+[issue 087](../087-the-controller-cannot-tell-a-host-is-too-old/00-report.md): the mesh knows which
+host runs a machine). Neither would have caught this fault, and both were the same shape of blindness.
+
+`printStatus` is now separated from the asking, so these words can be read by a test with no store, bus
+or machine — they have been acted on and been misleading twice, which makes them worth holding still.
+
+## What is NOT done, and why this record stays open
+
+**Nothing dials a provision.** [ADR 0146](../../02-DECISIONS/0146-connectivity-is-checked-by-name-per-hosting-form.md)
+decides how it should be done — a module on every machine serving an endpoint of its own and dialling
+every other machine's, one name per hosting form, over TLS with the certificate verified. **Nothing is
+built**, the module that existed was deleted, and the work was deferred deliberately by the operator.
+It is not this record's to start.
+
+So the measured fault of this issue — that the mesh can only report on itself — is unchanged. What
+changed is that the report no longer implies otherwise.
+
+## The open questions, where they stand
+
+- *Should a grant be checked, and from where?* Answered by ADR 0146 and not built: from the position
+  the callers are in, by a module on every machine, per hosting form.
+- *What would it cost to be wrong in the other direction?* Unanswered and important. A check that
+  reports a provision broken while it works trains a reader to ignore the report, which is the failure
+  this whole issue is about arriving by the other door.
+- *What should `status` say about a machine whose modules cannot reach each other?* Answered in part:
+  until something checks, it says that it has not checked. What it says when a check exists is ADR
+  0146's to settle.
+- *Is there a cheaper signal than a probe?* Still open. The affected module logged the failure 6,154
+  times; the mesh reads no module's logs and arguably should not, but something a module could *say*
+  about its own provisions would have surfaced this in minutes.
+- *Does the same blindness apply to a provider that lost a consumer's grant?* Still open, and still
+  nothing checks it.
+
+## One thing worth carrying forward
+
+**The certificate half of ADR 0146 is now possible where it was not.** Its check requires an internal
+name fetched over TLS with the certificate verified, and until 2026-09-30 no machine trusted the mesh's
+authority at all ([issue 129](../129-nothing-makes-a-machine-trust-the-meshs-authority/02-resolution.md)).
+Three of four do now. Whoever builds 0146 no longer has to solve that first.