jschoubben
9fd7e6c458
One push leaves the mesh consistent (the 057 decision, proposed for acceptance); the shared runtime waits for its broker (058). Fixes on mesh-control fix/one-push-is-enough and mesh-tools fix/the-runtime-waits-for-its-broker; the built-store-cross-node bed enforces both.
1.1 KiB
Diagnosis — 2026-09-18
The mechanism was already understood when the issue was opened: a provision secret is minted as a side-effect of composing the consumer's node, and the provider's grant list is a pure read of secrets already issued — so a provider composed before the consumer existed, and never again, is blind to it. The open question was the remedy: cascade the push, or report the obligation.
Decided as ADR 0083: a push
finishes what it starts. The controller captures the digest of what every machine should be
before composing the named node, recomputes after, and delivers to exactly the machines whose
declaration changed because of this push — named in the output, bounded rounds, converging.
Machines behind for unrelated reasons stay the business of push --behind.
Located in: mesh-controller (the push command). Checked by the built-store-cross-node bed, which now pushes only the consumer's node and asserts the provider minted the vhost — the workaround push is removed, so a regression fails the bed.