From f47744a8b68e15f266615404a94f91d3a37c1c8f Mon Sep 17 00:00:00 2001 From: jochen Date: Wed, 4 Nov 2026 09:44:31 +0100 Subject: [PATCH 1/4] Designs 51, 32: cite ADR 0618 for the windows' wake and the reference form ADR 0618 is accepted: the node-engine seat's manifest-reads verb and its manifest-reads-changed event wake the old seat name's, the old-form and the rename windows, and the builder writes a new form only once every present node-engine states it. The next delivered stays only for the rename window's case the record does not cover. Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig --- .../01-to-be/32-what-a-module-declares.md | 17 +++++--- .../51-the-registries-keep-what-is-named.md | 42 +++++++++++-------- 2 files changed, 35 insertions(+), 24 deletions(-) diff --git a/03-DESIGN/01-to-be/32-what-a-module-declares.md b/03-DESIGN/01-to-be/32-what-a-module-declares.md index c55a817e..f91004cd 100644 --- a/03-DESIGN/01-to-be/32-what-a-module-declares.md +++ b/03-DESIGN/01-to-be/32-what-a-module-declares.md @@ -18,6 +18,7 @@ decisions: - "ADR 0609" - "ADR 0612" - "ADR 0613" + - "ADR 0618" - "ADR 0606" - "ADR 0595" - "ADR 0596" @@ -516,10 +517,14 @@ value it holds under the old name to the new name in its own state, without the module reports applied a build of it that reads the new name. mesh-config hears the status view's `delivered` events and, at its start and on each, asks its `node_haves` for every node, away ones included, since `delivered` counts only the nodes present (design 47); until then mesh-config answers both names. A node away when the last - `delivered` was said should close its window when it returns, with no other delivery: what wakes mesh-config then - is to be decided in ADR 0618 (reserved), the node-engine seat's event for a node's stated manifest-reads, said also - on its return, as for the old seat name (design 51), never a watch of the node-engine's have state (ADR 0596). - **Until ADR 0618 is accepted**, such a node closes the window on the next `delivered`, whichever delivery says it. A node holding a window open + `delivered` was said should close its window when it returns, with no other delivery: mesh-config also wakes on + the node-engine seat's event `mesh.seat.node-engine.event.manifest-reads-changed`, said when a node's stated + capabilities change and when it returns after being away (ADR 0618 §4), as for the old seat name (design 51), and + on it reads that node's stated capabilities through the seat's verb `manifest-reads` (ADR 0618 §3) and its applied + builds through `node_haves`, never a watch of the node-engine's have state (ADR 0596). ADR 0618 does not cover a + returned node that applies the module's new build only after its return event, since that build changes what the + module reads, not what the node-engine states: such a node closes the window on the next `delivered`, whichever + delivery says it. A node holding a window open for seven days is mesh-config's finding naming the node, cleared when the window closes; `config_rename_close` drops a node from a window by hand, recorded as a hand act. - **The checker asks the seat, never the module.** The seat `mesh-config` gains the optional verb `renames` (the @@ -572,8 +577,8 @@ holder that does not serve it refuses `renamed-from` naming the verb, one meetin `renamed-from` naming the nodes, and a check that cannot ask fails saying so; `retire` with the warrant removes the secret and emits `retired` and `own-retired`, without it, with a warrant for another name, or from a caller not on the list it is refused; a waiter on the vault's `rotated` or `own-replaced` does not wake on `own-retired`; a node that was away, -returning with a build that reads the new name, closes the rename window on the next `delivered` (until ADR 0618 is -accepted); `config_rename_close` drops a node from a window and records the hand act; a window held seven days and a +returning with a build that reads the new name, closes the rename window on its `manifest-reads-changed` event when +it applied that build before the event (ADR 0618 §4), and on the next `delivered` when it applies it after; `config_rename_close` drops a node from a window and records the hand act; a window held seven days and a retirement held seven days each write their finding naming the node, cleared when it closes. ### The mesh delivery cases this design carries diff --git a/03-DESIGN/01-to-be/51-the-registries-keep-what-is-named.md b/03-DESIGN/01-to-be/51-the-registries-keep-what-is-named.md index 2fd24210..f140f711 100644 --- a/03-DESIGN/01-to-be/51-the-registries-keep-what-is-named.md +++ b/03-DESIGN/01-to-be/51-the-registries-keep-what-is-named.md @@ -18,6 +18,7 @@ decisions: - "ADR 0614" - "ADR 0613" - "ADR 0617" + - "ADR 0618" - "ADR 0606" - "ADR 0607" - "ADR 0610" @@ -79,11 +80,13 @@ it open for seven days is a finding naming the node, cleared when the window clo `distribution`'s own family `distribution.events`, kept seven days and capped at 16 MiB, dropping its oldest when full (it carries a handful of events per window), never on a seat's `.events`: it is one module's window, not the seats' contract. A node away when the last `delivered` was said should close the window when it returns and -applies the new build, with no other delivery: what wakes `distribution` then is to be decided in ADR 0618 -(reserved), the node-engine seat's event for a change of a node's stated manifest-reads and the delivery view's read -of them, never a watch of the node-engine's have state (ADR 0596). **Until ADR 0618 is accepted**, such a node closes -the window on the next `delivered`, whichever delivery says it: `distribution` asks `node_haves` then, finds the -returned node's new build, and closes. `cargo-package-registry` stays +applies the new build, with no other delivery: `distribution` also wakes on the node-engine seat's event +`mesh.seat.node-engine.event.manifest-reads-changed`, which each node-engine says when the capabilities it states +change and when its node returns after being away (ADR 0618 §4), and on it reads that node's stated capabilities +through the seat's verb `manifest-reads` (ADR 0618 §3), and its applied build through `node_haves`, never a watch of +the node-engine's have state (ADR 0596). A returned node that then applies the build whose node-engine reads the new +names says the event again, as its stated capabilities change, so ADR 0618 covers every node of this window and no +`delivered` is waited for. `cargo-package-registry` stays named, without a holder, until a build module publishes cargo packages. **One contract, a seat definition** (design 26, *A seat's definition*). Verbs: `publish`, `publish-part` (ADR 0611), `versions`, `remove` (a @@ -373,14 +376,16 @@ publish of mesh-sdk or `mesh-contracts` triggers their users (ADR 0614 §6). The build and adds none (ADR 0613 §1). ADR 0614 bounds nothing here; a bound, such as a settle before building a fingerprint whose inputs still move, is a question for a record, put to the operator, and is not designed here. -**The node-engine's own build keeps the old reference form** until every node-engine states the capability to read -the new one: a node-engine away across the milestone must be able to read the build it wakes to, or it could never -update itself (ADR 0603 §7, §9). The builder writes the node-engine's done key in the old form until the stated -capabilities show it on every node; this is a window like the old seat name's. What should wake the builder for a -node that returns is to be decided in ADR 0618 (reserved): the node-engine seat's event for a change of a node's stated -manifest-reads and the delivery view's read of them, never a watch of the node-engine's have state (ADR 0596). **Until -ADR 0618 is accepted**, the builder hears the status view's `delivered` events, asks `node_haves` at its start and on -each, and a node that was away closes the window on the next `delivered`. Its tool `builder_old_form` lists whether the +**The node-engine's own build keeps the old reference form** until every present node-engine states the capability +to read the new one (ADR 0618 §2): the builder writes a new reference form, in the node-engine's done key as in every +other build's, only once every node-engine on a node present states it, so no build, the node-engine's own included, +needs a form no running node-engine reads (ADR 0603 §7, §9). Each build names with it the reader capabilities its +forms need, and the assigner holds a node's want while that node's engine does not state one (ADR 0618 §1), so a node +that was away is held, never handed a form it cannot read. This is a window like the old seat name's. The builder +reads each node's stated capabilities through the node-engine seat's verb `manifest-reads` (ADR 0618 §3) at its start, +and wakes on the seat's event `mesh.seat.node-engine.event.manifest-reads-changed`, said when a node's stated +capabilities change and when the node returns after being away (ADR 0618 §4), never on a watch of the node-engine's +have state (ADR 0596) and never on a timer. Its tool `builder_old_form` lists whether the window is open and the nodes whose node-engine does not yet state the capability, and drops a retired node from it by hand, recorded as a hand act; a node holding it open for seven days is the builder's finding naming the node, cleared when the window closes. Closing it says so in the build log and emits `old-form-closed` (the time, the nodes that held @@ -415,8 +420,8 @@ reports (ADR 0610 §4). The revert's order is the module graph's, as the move's is delivered before a build module's reverted build only where that build module's reverted manifest requires or invokes something only `distribution`'s reverted build offers; the milestone's prepare step checks the build modules' manifests for such an edge. The done keys written in the new form stay in the builder's state after a -revert and are not built again for their form; whether an older reader can read them is to be decided in ADR 0618 -(reserved). **On a fresh mesh** the foundation's bootstrap (research 075) pushes the holders' own images +revert and are not built again for their form; each names the forms it needs, so a node whose node-engine does not +state them is held by the assigner, never handed them (ADR 0618 §1). **On a fresh mesh** the foundation's bootstrap (research 075) pushes the holders' own images with a one-off credential of the bootstrap, discarded once the holders serve `publish`. ### Acceptance tests @@ -466,7 +471,7 @@ test). module publishing through the seats, and refused after, naming `publish`, with `direct-writes-closed` emitted and its log line written; `registry_direct_writes` names the node still running an old build module, and drops it by hand with a hand act; a node that was away, returning with the new build, closes the old seat name's window on - the next `delivered` (until ADR 0618 is accepted); a waiter on a build's `published` does not wake on `held`, + its `manifest-reads-changed` event with no `delivered` said (ADR 0618 §4); a waiter on a build's `published` does not wake on `held`, `released`, `old-name-closed` or `direct-writes-closed`. - **Builder, added for the milestone, integration** (cases of the builder's whole-module test): with the seat's holder down at a first claim, a bundle's trunk build is built unnumbered and published by its digest, the holder's @@ -477,8 +482,9 @@ test). clears (no timer runs), and is then numbered and published by version; `builder_floor_again` asks the three sources at once and records the hand act; the node-engine's done key stays in the old form while one node's node-engine lacks the capability and is written in the new form once every node states it, `builder_old_form` - naming that node meanwhile and dropping it by hand with a hand act; a node that was away, returning with the - capability, closes that window on the next `delivered` (until ADR 0618 is accepted), with `old-form-closed` emitted + naming that node meanwhile and dropping it by hand with a hand act; a present node gaining the capability closes + that window on its `manifest-reads-changed` event with no `delivered` and no timer (ADR 0618 §2, §4), while a node + away is held by the assigner from builds in the new form (ADR 0618 §1), with `old-form-closed` emitted and its build-log line written, and a waiter on a build's end does not wake on it; with the image's own seat silent at the claim of `distribution`'s own image, the image is still built, published by its digest, and numbered once its new build answers (ADR 0617 *How it is checked*). -- 2.54.0 From 48fa0a5a48b70d2acf9994cf040b35fa25d9b0c8 Mon Sep 17 00:00:00 2001 From: jochen Date: Wed, 4 Nov 2026 09:46:46 +0100 Subject: [PATCH 2/4] Designs 51, 32: name the manifest-reads grant and who holds the old-form window The upgrade and security review asked that each window's caller be granted the event through its invokes, that an away node be held by the assigner rather than the old-form window, and that a node-engine not yet serving manifest-reads keep a window open by name. Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig --- .../01-to-be/32-what-a-module-declares.md | 6 +++- .../51-the-registries-keep-what-is-named.md | 29 +++++++++++++------ 2 files changed, 25 insertions(+), 10 deletions(-) diff --git a/03-DESIGN/01-to-be/32-what-a-module-declares.md b/03-DESIGN/01-to-be/32-what-a-module-declares.md index f91004cd..9d51cd8f 100644 --- a/03-DESIGN/01-to-be/32-what-a-module-declares.md +++ b/03-DESIGN/01-to-be/32-what-a-module-declares.md @@ -521,7 +521,11 @@ value it holds under the old name to the new name in its own state, without the the node-engine seat's event `mesh.seat.node-engine.event.manifest-reads-changed`, said when a node's stated capabilities change and when it returns after being away (ADR 0618 §4), as for the old seat name (design 51), and on it reads that node's stated capabilities through the seat's verb `manifest-reads` (ADR 0618 §3) and its applied - builds through `node_haves`, never a watch of the node-engine's have state (ADR 0596). ADR 0618 does not cover a + builds through `node_haves`, never a watch of the node-engine's have state (ADR 0596). mesh-config declares + `seat:node-engine.manifest-reads` in its `invokes`: that is the grant the grants part composes, and with it the + grants part grants mesh-config the subscription to the event's subject (its unit row is in design 51). A + node-engine that does not yet serve `manifest-reads` counts as stating nothing: the window stays open and + the seat's verb `renames` names the node. ADR 0618 does not cover a returned node that applies the module's new build only after its return event, since that build changes what the module reads, not what the node-engine states: such a node closes the window on the next `delivered`, whichever delivery says it. A node holding a window open diff --git a/03-DESIGN/01-to-be/51-the-registries-keep-what-is-named.md b/03-DESIGN/01-to-be/51-the-registries-keep-what-is-named.md index f140f711..92324edb 100644 --- a/03-DESIGN/01-to-be/51-the-registries-keep-what-is-named.md +++ b/03-DESIGN/01-to-be/51-the-registries-keep-what-is-named.md @@ -84,7 +84,10 @@ applies the new build, with no other delivery: `distribution` also wakes on the `mesh.seat.node-engine.event.manifest-reads-changed`, which each node-engine says when the capabilities it states change and when its node returns after being away (ADR 0618 §4), and on it reads that node's stated capabilities through the seat's verb `manifest-reads` (ADR 0618 §3), and its applied build through `node_haves`, never a watch of -the node-engine's have state (ADR 0596). A returned node that then applies the build whose node-engine reads the new +the node-engine's have state (ADR 0596). `distribution` declares `seat:node-engine.manifest-reads` in its `invokes`: +that is the grant the grants part composes, and with it the grants part grants `distribution` the subscription to +the event's subject. A node-engine that does not yet serve `manifest-reads` counts as stating nothing: the window stays +open and `registry_old_name` names the node. A returned node that then applies the build whose node-engine reads the new names says the event again, as its stated capabilities change, so ADR 0618 covers every node of this window and no `delivered` is waited for. `cargo-package-registry` stays named, without a holder, until a build module publishes cargo packages. @@ -385,10 +388,14 @@ that was away is held, never handed a form it cannot read. This is a window like reads each node's stated capabilities through the node-engine seat's verb `manifest-reads` (ADR 0618 §3) at its start, and wakes on the seat's event `mesh.seat.node-engine.event.manifest-reads-changed`, said when a node's stated capabilities change and when the node returns after being away (ADR 0618 §4), never on a watch of the node-engine's -have state (ADR 0596) and never on a timer. Its tool `builder_old_form` lists whether the -window is open and the nodes whose node-engine does not yet state the capability, and drops a retired node from it by -hand, recorded as a hand act; a node holding it open for seven days is the builder's finding naming the node, cleared -when the window closes. Closing it says so in the build log and emits `old-form-closed` (the time, the nodes that held +have state (ADR 0596) and never on a timer. The builder declares `seat:node-engine.manifest-reads` in its `invokes`: +that is the grant the grants part composes, and with it the grants part grants the builder the subscription to the +event's subject. A node-engine that does not yet serve `manifest-reads` counts as stating nothing: the window stays +open and names the node. Only a present node-engine that has not updated holds this window; a node away is held by the +assigner instead and is not listed as holding it. Its tool `builder_old_form` lists whether the window is open and the +present nodes whose node-engine does not yet state the capability, and drops a retired node from it by hand, recorded +as a hand act; a present node holding it open for seven days is the builder's finding naming the node, cleared when +the window closes. Closing it says so in the build log and emits `old-form-closed` (the time, the nodes that held it last, the nodes dropped by hand) on the builder's own family beside `numbered`; a waiter on a build's end does not wake on it. @@ -480,9 +487,11 @@ test). source other than the publish target) the floor finding is written and cleared once it answers, and with `bridge_tags` still silent after the by-digest publish, the build stays unnumbered until the forge bridge's health clears (no timer runs), and is then numbered and published by version; `builder_floor_again` asks the three - sources at once and records the hand act; the node-engine's done key stays in the old form while one node's - node-engine lacks the capability and is written in the new form once every node states it, `builder_old_form` - naming that node meanwhile and dropping it by hand with a hand act; a present node gaining the capability closes + sources at once and records the hand act; the node-engine's done key stays in the old form while one present node's + node-engine lacks the capability, or does not serve `manifest-reads`, and is written in the new form once every + present node states it, `builder_old_form` naming that node meanwhile and dropping it by hand with a hand act; with + one node away whose node-engine lacks the capability, the new form is written, the assigner holds that node's want, + and `builder_old_form` does not list it (ADR 0618 §1, §2); a present node gaining the capability closes that window on its `manifest-reads-changed` event with no `delivered` and no timer (ADR 0618 §2, §4), while a node away is held by the assigner from builds in the new form (ADR 0618 §1), with `old-form-closed` emitted and its build-log line written, and a waiter on a build's end does not wake on it; with the image's own seat silent @@ -508,7 +517,9 @@ test). the seat it came through and that seat's holder; a change of the seat's holder composes the declaration again with the new holder named and recreates no container. - **The grants part, unit** (a case of its composition test): a node-engine's subscriptions hold the status view's - `settled` family beside the backup holder's word, and nothing more. + `settled` family beside the backup holder's word, and nothing more; the subscriptions of `distribution`, the builder + and mesh-config, each declaring `seat:node-engine.manifest-reads` in `invokes`, hold the subject + `mesh.seat.node-engine.event.manifest-reads-changed`, and no other module's subscriptions hold it. - **Checker.** A changed build module invoking a verb no running holder serves is not run, and the verdict names the modules composed from their manifests instead, and the verb. - **Vault.** Reverting the milestone's merge mints the build modules' credentials again; the bootstrap's one-off -- 2.54.0 From 01d4f2781ef04c786583f2e5ccdbedd3f75c03d9 Mon Sep 17 00:00:00 2001 From: jochen Date: Wed, 4 Nov 2026 09:48:56 +0100 Subject: [PATCH 3/4] Design 51: keep the node-engine's own build readable by away nodes (ADR 0623) Under ADR 0618 alone a node away with an old node-engine would be held from the node-engine's own build in the new form and could never update itself. ADR 0623 keeps every counted node-engine's form in those builds and moves them to a node that reads any one of them. Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig --- .../51-the-registries-keep-what-is-named.md | 61 +++++++++++-------- 1 file changed, 34 insertions(+), 27 deletions(-) diff --git a/03-DESIGN/01-to-be/51-the-registries-keep-what-is-named.md b/03-DESIGN/01-to-be/51-the-registries-keep-what-is-named.md index 92324edb..75c90c61 100644 --- a/03-DESIGN/01-to-be/51-the-registries-keep-what-is-named.md +++ b/03-DESIGN/01-to-be/51-the-registries-keep-what-is-named.md @@ -19,6 +19,7 @@ decisions: - "ADR 0613" - "ADR 0617" - "ADR 0618" + - "ADR 0623" - "ADR 0606" - "ADR 0607" - "ADR 0610" @@ -379,25 +380,30 @@ publish of mesh-sdk or `mesh-contracts` triggers their users (ADR 0614 §6). The build and adds none (ADR 0613 §1). ADR 0614 bounds nothing here; a bound, such as a settle before building a fingerprint whose inputs still move, is a question for a record, put to the operator, and is not designed here. -**The node-engine's own build keeps the old reference form** until every present node-engine states the capability -to read the new one (ADR 0618 §2): the builder writes a new reference form, in the node-engine's done key as in every -other build's, only once every node-engine on a node present states it, so no build, the node-engine's own included, -needs a form no running node-engine reads (ADR 0603 §7, §9). Each build names with it the reader capabilities its -forms need, and the assigner holds a node's want while that node's engine does not state one (ADR 0618 §1), so a node -that was away is held, never handed a form it cannot read. This is a window like the old seat name's. The builder -reads each node's stated capabilities through the node-engine seat's verb `manifest-reads` (ADR 0618 §3) at its start, -and wakes on the seat's event `mesh.seat.node-engine.event.manifest-reads-changed`, said when a node's stated -capabilities change and when the node returns after being away (ADR 0618 §4), never on a watch of the node-engine's -have state (ADR 0596) and never on a timer. The builder declares `seat:node-engine.manifest-reads` in its `invokes`: -that is the grant the grants part composes, and with it the grants part grants the builder the subscription to the -event's subject. A node-engine that does not yet serve `manifest-reads` counts as stating nothing: the window stays -open and names the node. Only a present node-engine that has not updated holds this window; a node away is held by the -assigner instead and is not listed as holding it. Its tool `builder_old_form` lists whether the window is open and the -present nodes whose node-engine does not yet state the capability, and drops a retired node from it by hand, recorded -as a hand act; a present node holding it open for seven days is the builder's finding naming the node, cleared when -the window closes. Closing it says so in the build log and emits `old-form-closed` (the time, the nodes that held -it last, the nodes dropped by hand) on the builder's own family beside `numbered`; a waiter on a build's end does not -wake on it. +**The node-engine's own build keeps the old reference form** while any node-engine the mesh counts states only it, +away ones included (ADR 0623 §1-2). For the module that holds the seat `node-engine`, the builder writes into each +build key every reference form a counted node-engine states, beside the new form, which it writes there as in every +other build only once every present node-engine states it (ADR 0618 §2); a node leaves the count only when it is +retired, never because it is away (ADR 0623 §1). The assigner moves the node-engine's own build to a node once that +node's engine states any one form the build carries (ADR 0623 §2), so a node back from being away moves to the new +node-engine through the old form, states the new capabilities from then on, and can always update itself (ADR 0603 +§7, §9). Every other module's builds keep ADR 0618 §1-2: they carry the new form once every present node-engine +states it, each names the reader capabilities its forms need, and the assigner holds a node's want while that node's +engine does not state one, so a node that was away is held from them, never handed a form it cannot read, until its +new node-engine states the form. The old form in the node-engine's own builds is a window like the old seat name's: +it closes when no counted node-engine states the old form alone, and the builder then drops it from those builds. The +builder reads each node's stated capabilities through the node-engine seat's verb `manifest-reads` (ADR 0618 §3) at +its start, and wakes on the seat's event `mesh.seat.node-engine.event.manifest-reads-changed`, said when a node's +stated capabilities change and when the node returns after being away (ADR 0618 §4), never on a watch of the +node-engine's have state (ADR 0596) and never on a timer. The builder declares `seat:node-engine.manifest-reads` in +its `invokes`: that is the grant the grants part composes, and with it the grants part grants the builder the +subscription to the event's subject. A node-engine that does not yet serve `manifest-reads` counts as stating +nothing: the window stays open and names the node. Its tool `builder_old_form` lists whether the window is open and +the counted nodes, present or away, whose node-engine states only the old form, and drops a retired node from the +count by hand, recorded as a hand act; a node holding it open for seven days is the builder's finding naming the node, +cleared when the window closes. Closing it says so in the build log and emits `old-form-closed` (the time, the nodes +that held it last, the nodes dropped by hand) on the builder's own family beside `numbered`; a waiter on a build's end +does not wake on it. **When the group is pushed.** Only once the release that adds the node-engine's stated capability (design 47) runs on every node, read from the status view's haves before the push, and once the progressive insights of ADR 0595 and @@ -487,14 +493,15 @@ test). source other than the publish target) the floor finding is written and cleared once it answers, and with `bridge_tags` still silent after the by-digest publish, the build stays unnumbered until the forge bridge's health clears (no timer runs), and is then numbered and published by version; `builder_floor_again` asks the three - sources at once and records the hand act; the node-engine's done key stays in the old form while one present node's - node-engine lacks the capability, or does not serve `manifest-reads`, and is written in the new form once every - present node states it, `builder_old_form` naming that node meanwhile and dropping it by hand with a hand act; with - one node away whose node-engine lacks the capability, the new form is written, the assigner holds that node's want, - and `builder_old_form` does not list it (ADR 0618 §1, §2); a present node gaining the capability closes - that window on its `manifest-reads-changed` event with no `delivered` and no timer (ADR 0618 §2, §4), while a node - away is held by the assigner from builds in the new form (ADR 0618 §1), with `old-form-closed` emitted - and its build-log line written, and a waiter on a build's end does not wake on it; with the image's own seat silent + sources at once and records the hand act; a build key carries only the old form while one present node's + node-engine lacks the capability, or does not serve `manifest-reads`, and carries the new form once every present + node states it (ADR 0618 §2); with one node away whose node-engine lacks the capability, the node-engine's own build + still carries the old form beside the new and is moved to that node, while another module's build in the new form + is held by the assigner for it (ADR 0623 §1-2, ADR 0618 §1), `builder_old_form` naming that node meanwhile and + dropping a retired one from the count by hand with a hand act; that node, back with the new node-engine, says + `manifest-reads-changed` and the window closes with no `delivered` and no timer (ADR 0618 §4), the old form dropped + from the node-engine's own builds, with `old-form-closed` emitted and its build-log line written, and a waiter on a + build's end does not wake on it; with the image's own seat silent at the claim of `distribution`'s own image, the image is still built, published by its digest, and numbered once its new build answers (ADR 0617 *How it is checked*). - **Builder, added for the milestone, unit** (cases of the builder's numbering): a second trunk build of a package's -- 2.54.0 From cac55dc2543a56909c915e162b2258eb163b6f8f Mon Sep 17 00:00:00 2001 From: jochen Date: Wed, 4 Nov 2026 09:59:44 +0100 Subject: [PATCH 4/4] Design 51: follow ADR 0624, every build keeps each counted node-engine's form ADR 0624 supersedes ADR 0623, which could find the node-engine's own builds only by the module's name. Every build now keeps each form a counted node-engine states, the oldest in the single reference, and a node is held only when it reads none of them. Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig --- .../51-the-registries-keep-what-is-named.md | 70 ++++++++++--------- 1 file changed, 36 insertions(+), 34 deletions(-) diff --git a/03-DESIGN/01-to-be/51-the-registries-keep-what-is-named.md b/03-DESIGN/01-to-be/51-the-registries-keep-what-is-named.md index 75c90c61..59323beb 100644 --- a/03-DESIGN/01-to-be/51-the-registries-keep-what-is-named.md +++ b/03-DESIGN/01-to-be/51-the-registries-keep-what-is-named.md @@ -19,7 +19,7 @@ decisions: - "ADR 0613" - "ADR 0617" - "ADR 0618" - - "ADR 0623" + - "ADR 0624" - "ADR 0606" - "ADR 0607" - "ADR 0610" @@ -380,30 +380,30 @@ publish of mesh-sdk or `mesh-contracts` triggers their users (ADR 0614 §6). The build and adds none (ADR 0613 §1). ADR 0614 bounds nothing here; a bound, such as a settle before building a fingerprint whose inputs still move, is a question for a record, put to the operator, and is not designed here. -**The node-engine's own build keeps the old reference form** while any node-engine the mesh counts states only it, -away ones included (ADR 0623 §1-2). For the module that holds the seat `node-engine`, the builder writes into each -build key every reference form a counted node-engine states, beside the new form, which it writes there as in every -other build only once every present node-engine states it (ADR 0618 §2); a node leaves the count only when it is -retired, never because it is away (ADR 0623 §1). The assigner moves the node-engine's own build to a node once that -node's engine states any one form the build carries (ADR 0623 §2), so a node back from being away moves to the new -node-engine through the old form, states the new capabilities from then on, and can always update itself (ADR 0603 -§7, §9). Every other module's builds keep ADR 0618 §1-2: they carry the new form once every present node-engine -states it, each names the reader capabilities its forms need, and the assigner holds a node's want while that node's -engine does not state one, so a node that was away is held from them, never handed a form it cannot read, until its -new node-engine states the form. The old form in the node-engine's own builds is a window like the old seat name's: -it closes when no counted node-engine states the old form alone, and the builder then drops it from those builds. The -builder reads each node's stated capabilities through the node-engine seat's verb `manifest-reads` (ADR 0618 §3) at -its start, and wakes on the seat's event `mesh.seat.node-engine.event.manifest-reads-changed`, said when a node's -stated capabilities change and when the node returns after being away (ADR 0618 §4), never on a watch of the -node-engine's have state (ADR 0596) and never on a timer. The builder declares `seat:node-engine.manifest-reads` in -its `invokes`: that is the grant the grants part composes, and with it the grants part grants the builder the -subscription to the event's subject. A node-engine that does not yet serve `manifest-reads` counts as stating -nothing: the window stays open and names the node. Its tool `builder_old_form` lists whether the window is open and -the counted nodes, present or away, whose node-engine states only the old form, and drops a retired node from the -count by hand, recorded as a hand act; a node holding it open for seven days is the builder's finding naming the node, -cleared when the window closes. Closing it says so in the build log and emits `old-form-closed` (the time, the nodes -that held it last, the nodes dropped by hand) on the builder's own family beside `numbered`; a waiter on a build's end -does not wake on it. +**Every build keeps the old reference form** while any node-engine the mesh counts states it alone, away ones +included, the node-engine's own builds as every other, never by a module's name (ADR 0624 §1; ADR 0601 §4). The +builder writes into every build key each reference form a counted node-engine states, beside the new form, which it +writes only once every present node-engine states it (ADR 0618 §2); a counted node whose engine states nothing counts +as stating the baseline's forms, and a node leaves the count only when it is retired, never because it is away (ADR +0624 §1). Of the forms kept, the oldest a counted engine states is written into the build key's single reference +(ADR 0605 §9) and the others are listed beside it, so an engine that predates the list still fetches the build (ADR +0624 §3). The assigner holds a node's want for a build's reference forms only when that node's engine states none of +them (ADR 0624 §2); a hold for a manifest word or a seat name the engine does not state stays as ADR 0614 §4 has it. +So a node back from being away with an old node-engine still gets any build, the node-engine's own included, through +the oldest form, and can always update itself (ADR 0603 §7, §9). The old form in the build keys is a window like the +old seat name's: it closes when no counted node-engine states the old form alone, and the builder then leaves it out +of new build keys. The builder reads each node's stated capabilities through the node-engine seat's verb +`manifest-reads` (ADR 0618 §3) at its start, and wakes on the seat's event +`mesh.seat.node-engine.event.manifest-reads-changed`, said when a node's stated capabilities change and when the node +returns after being away (ADR 0618 §4), never on a watch of the node-engine's have state (ADR 0596) and never on a +timer. The builder declares `seat:node-engine.manifest-reads` in its `invokes`: that is the grant the grants part +composes, and with it the grants part grants the builder the subscription to the event's subject. A node-engine that +does not yet serve `manifest-reads` counts as stating the baseline's forms: the window stays open and names the node. +Its tool `builder_old_form` lists whether the window is open and the counted nodes, present or away, whose +node-engine states the old form alone, and drops a retired node from the count by hand, recorded as a hand act; a +node holding it open for seven days is the builder's finding naming the node, cleared when the window closes. Closing +it says so in the build log and emits `old-form-closed` (the time, the nodes that held it last, the nodes dropped by +hand) on the builder's own family beside `numbered`; a waiter on a build's end does not wake on it. **When the group is pushed.** Only once the release that adds the node-engine's stated capability (design 47) runs on every node, read from the status view's haves before the push, and once the progressive insights of ADR 0595 and @@ -433,8 +433,9 @@ reports (ADR 0610 §4). The revert's order is the module graph's, as the move's is delivered before a build module's reverted build only where that build module's reverted manifest requires or invokes something only `distribution`'s reverted build offers; the milestone's prepare step checks the build modules' manifests for such an edge. The done keys written in the new form stay in the builder's state after a -revert and are not built again for their form; each names the forms it needs, so a node whose node-engine does not -state them is held by the assigner, never handed them (ADR 0618 §1). **On a fresh mesh** the foundation's bootstrap (research 075) pushes the holders' own images +revert and are not built again for their form; each still carries every form a counted node-engine states, the +oldest in its single reference, so a node is held from them only when its engine reads none of those forms (ADR 0624 +§1-3). **On a fresh mesh** the foundation's bootstrap (research 075) pushes the holders' own images with a one-off credential of the bootstrap, discarded once the holders serve `publish`. ### Acceptance tests @@ -494,13 +495,14 @@ test). `bridge_tags` still silent after the by-digest publish, the build stays unnumbered until the forge bridge's health clears (no timer runs), and is then numbered and published by version; `builder_floor_again` asks the three sources at once and records the hand act; a build key carries only the old form while one present node's - node-engine lacks the capability, or does not serve `manifest-reads`, and carries the new form once every present - node states it (ADR 0618 §2); with one node away whose node-engine lacks the capability, the node-engine's own build - still carries the old form beside the new and is moved to that node, while another module's build in the new form - is held by the assigner for it (ADR 0623 §1-2, ADR 0618 §1), `builder_old_form` naming that node meanwhile and - dropping a retired one from the count by hand with a hand act; that node, back with the new node-engine, says - `manifest-reads-changed` and the window closes with no `delivered` and no timer (ADR 0618 §4), the old form dropped - from the node-engine's own builds, with `old-form-closed` emitted and its build-log line written, and a waiter on a + node-engine lacks the capability, or does not serve `manifest-reads`, and carries the new form beside it once every + present node states it (ADR 0618 §2), the old form in its single reference (ADR 0624 §3); with one node away whose + node-engine lacks the capability, or states nothing, every build still carries the old form beside the new, and any + build, the node-engine's own included, is moved to that node because it reads the oldest form (ADR 0624 §1-2), + `builder_old_form` naming that node meanwhile and dropping a retired one from the count by hand with a hand act; a + build whose forms that node reads none of is held for it; that node, back with the new node-engine, says + `manifest-reads-changed` and the window closes with no `delivered` and no timer (ADR 0618 §4), the old form left + out of new build keys, with `old-form-closed` emitted and its build-log line written, and a waiter on a build's end does not wake on it; with the image's own seat silent at the claim of `distribution`'s own image, the image is still built, published by its digest, and numbered once its new build answers (ADR 0617 *How it is checked*). -- 2.54.0