---
status: resolved
opened: 2026-10-06
located-in: [mesh-controller]
fixed-by: novox/mesh-controller PR #78 (cf4834a), novox/mesh-host PR #32 (93efe41)
replay-none: opened and fixed before ADR 0237 made a replay a condition of resolving; the fix's own tests, a write of the set as the controller against a server holding its composed grant, guard it, but none was laid over the commit before the fix and registered, and doing so now would be a new test written after the fact rather than a replay
amended-design:
---

# 269. The controller cannot write a work queue's cancelled set

## Symptom

Found while granting the controller the buckets of
[to-be 45](../../03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md) Phase 0, not seen on the
live mesh. A bus server was given exactly the user list the controller composes for itself, and the
controller, connected as itself, asked to mark a build cancelled:

```
asserting the cancelled set of the build seat     → succeeded
putting an ask's id into it                        → context deadline exceeded (3 s)
```

The same put into the controller's own new buckets succeeded once their subjects were granted, and
timed out the same way before.

## Cause

[ADR 0219](../../02-DECISIONS/0219-the-build-queue-is-controlled-through-the-controller-and-the-build-seat.md)'s cancel writes the ask's
id into the seat's cancelled set before it deletes the ask, so a holder taking it in that moment ends
it. Writing a key into a bucket is a publish to the bucket's own subject. The controller's grant
reaches the bus's management interface, which creates the bucket, and does not reach the bucket's
subject, which writes it. The server refuses the publish; the client waits for an acknowledgement
that never comes.

So `cancel` and `clear` cannot complete. No test composes the controller's grant and writes the set
as the controller: the queue's tests write it with an unrestricted connection.

## Fix

The controller's publish grant names each cancelled set it writes, as it now names its own buckets,
and a test writes the set as the controller, against a server holding the controller's composed
grant. The installer's first user list says the same.

Pull requests: novox/mesh-controller#78 and novox/mesh-host#32 — open, not merged. Checked against a
server holding the controller's composed grant: the put that timed out succeeds.

## How it is checked

Live: `cancel` of a waiting ask answers that it was cancelled, and a holder taking that ask ends it.

## Resolved — 2026-10-08

Both pull requests named under Fix are merged (2026-10-06) and live: the controller's publish grant
names each cancelled set it writes, and the installer's first user list says the same.