57 lines
3.1 KiB
Markdown
57 lines
3.1 KiB
Markdown
---
|
|
status: open
|
|
opened: 2026-09-28
|
|
located-in: [mesh-controller internal/catalogue, mesh-catalog]
|
|
fixed-by:
|
|
amended-design:
|
|
---
|
|
|
|
# 138 — Two modules claim one seat and are not interchangeable, and nothing says so
|
|
|
|
## What was observed
|
|
|
|
Three modules claim the node-scoped uplink seat: one for each network manager a machine here might
|
|
run. [ADR 0117](../../02-DECISIONS/0117-a-machines-uplink-is-a-seat.md) gives each of them the same
|
|
job — ask the manager the machine already runs to leave the resolver file alone and to leave the mesh's
|
|
interface alone — and deliberately keeps the machine's own links out of the mesh's hands.
|
|
|
|
A seat means one holder and an interchangeable holder. These are interchangeable in what they *ask*
|
|
and not in what they *do*:
|
|
|
|
- None installs, enables, starts or stops the manager. That is on purpose: stopping it takes every
|
|
link down, including the mesh's own way in.
|
|
- None carries an address, a route or a wireless credential, for the same reason.
|
|
- **Nothing checks that the module holding the seat names the manager the machine is actually
|
|
running.** Assigning the systemd-networkd holder to a machine running NetworkManager writes a file
|
|
for a daemon that is inactive and disabled, the seat reports held, and the two things the seat
|
|
exists to arrange are arranged for nobody. NetworkManager goes back to rewriting the resolver file
|
|
on every lease, which is the failure the module's own comment describes.
|
|
|
|
The machine reports which service manager and which units are active, so the fact needed to catch this
|
|
is already in the report the mesh holds.
|
|
|
|
## Why it matters beyond this instance
|
|
|
|
**A seat is the mesh's promise that a role is filled.** If the holder can be a module for software
|
|
that is not running, the seat says a role is filled while nothing fills it — and the surface that
|
|
would tell an operator says "held".
|
|
|
|
**It is the same shape as two faults found the same day.** A module named a firewall front-end the
|
|
machine does not have ([issue 136](../136-a-module-may-name-a-program-the-machine-does-not-have/00-report.md)),
|
|
and the filter named address ranges one runtime happens to use
|
|
([issue 137](../137-converging-a-machine-cut-off-its-own-guests/00-report.md)). Each is a claim about
|
|
the machine that nothing on the machine checks.
|
|
|
|
**And it decides whether the seat is worth having.** Either the holder must match what the machine
|
|
runs, which is a condition the mesh can check from the report it already has, or the holders must be
|
|
able to switch the manager, which ADR 0117 refuses for a reason that has not changed.
|
|
|
|
## Open questions
|
|
|
|
- Should a seat's conditions of holding include a capability the machine reports, so a holder naming
|
|
absent or inactive software is refused rather than recorded?
|
|
- Is "the uplink" one seat at all, if its holders are three dialects of the same two requests? The
|
|
alternative is one module that speaks whichever dialect the machine needs, chosen from the report.
|
|
- What should happen on a machine that switches manager afterwards? The seat would then be held by the
|
|
wrong module, and the machine is the only place that knows.
|