Build config's switch from the controller's records: declared, compare, take-over and hand-back, so the operator approves the last move only once nothing differs (issue 1953)

compare also resolves every placed module's values on every node both ways, as ADR 0565's insight of 2026-10-29 asks after #558. After the take-over the predefined list and pull requests' config come from the indexer and pull-declares is refused; a hand-back returns to the mirrors until the lease write. From the lease write a trusted value is set only on an Approve. Acts are recorded through mesh-hand-acts. Pins mesh-sdk 2e5cc4f.
2026-10-29 22:27:23 +01:00
parent 0842361f85
commit d34645361d
14 changed files with 1293 additions and 28 deletions
@@ -61,3 +61,21 @@ them, newest first; with `proposal`, one read whole, with whether the router's a
 Each directory or archive this module declares says how it treats a file it did not write (ADR 0422, ADR 0416).

 - `${dir:state}`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
+
+## The switch from the controller's records (novox/hq ADR 0565 §3, §4, §13)
+
+- `mesh-config_declared`: each placed module's declarations at the trunk, with the manifest and commit they come
+  from, written only when they differ.
+- `mesh-config_takeover`: the key `switch` names the source that holds: none (the interim since mesh-catalog #558:
+  declarations from the modules' own manifests, the list of predefined keys and pull requests' config from the
+  controller), `indexer` after the operator's take-over (the list and pull requests' config from the indexer's
+  `predefined` and `config-candidates`; the controller's `pull-declares` refused), `controller` after a hand-back
+  (declarations, list and pull requests' config from the controller's records). Each take-over ask is kept beside it.
+- `config_compare` lists every difference between the own sources and the controller's records: each module's
+  declarations, the list, each open pull request's config, and every placed module's value on every node resolved
+  both ways. `config_take_over` asks the operator's Approve, refused while any difference stands and switched on the
+  Approve only if none stands then. `config_hand_back` returns to the controller's records until its lease is handed
+  away. `config_declared` and `config_resync` read and write again what it keeps.
+- From the controller's lease write a trusted value is set only through propose and the operator's Approve.
+- Its sets, clears and warrants are recorded in the hand-act log of the seat `mesh-hand-acts`, falling back to the
+  controller's while that seat has no holder and the controller holds its lease.