---
status: resolved
opened: 2026-09-22
located-in: [mesh-controller internal/link (serve, enrolment), mesh-controller internal/inventory (tokens), mesh-host internal/link (enrol)]
fixed-by: mesh-controller multiple-fixes (build results, upgrades and catch-ups handed back while the store is away, bounded; an enrolment claims its token and spends it last, and is answered "try again"); mesh-host multiple-fixes (the host asks again with the same request); mesh-lab multiple-fixes (the store-window bed)
---

# 083 — Other control messages are lost while the store restarts

## Symptom

[Issue 082](../082-a-report-that-arrives-while-the-store-restarts-is-lost/00-report.md) kept a
node's report for another attempt while the store is restarting. The same control queue carries
four other kinds of message, and each is still settled on a failed write as if it had been
handled:

- **An enrolment** is answered with a refusal when the store cannot be asked, so a valid token is
  refused. Worse, if the store goes after the token is spent and before the node's key is kept,
  the node holds no key and needs a new token — and trying the enrolment again is not safe,
  because spending a token cannot be done twice.
- **A build result** is rejected on any failure to record it, and nothing announces it again.
- **An upgrade announcement** is acknowledged whatever happens, so a module that moved while the
  store was down is never sent to the machines that run it.
- **A catch-up announcement** is acknowledged before it is acted on, so it is lost until the
  catalogue restarts.

Found by review of 082, by reading the consumer. Not reproduced.

## Why it matters beyond the instance

A migration adopts the store while nodes enrol, builds run and modules move — the window 082
found for reports, for every other message the control plane cannot afford to drop.

## What would close it

Each kind decided on its own: which can be handed back and asked again (build results and
announcements, once recording them is shown to be safe to repeat), and which needs a different
shape (enrolment, whose token must be spent once — spent and keyed in one write, or answered "not
now" so the node asks again with the same token). A test for each, and a bed that restarts the
store while a node enrols and a build lands.