Say how the first twenty-three long-running resources are ready (hq ADR 0240, to-be 48 Phase E)

Seven modules' images ship a check the mesh never read. Adopted by name where it says healthy on the live mesh today: nine of mail's containers (not its antivirus, whose six-minute start is past the five-minute bound, nor its cache, whose image ships none), the certificate authority, the spreadsheet app, four of the database suite's (the studio among them, with the address it binds fixed), the flow editor and the chat client. And the endpoints four services already declare, looked at from the machine: tcp on the database, the cache, the document store and the broker; http on the website and the dashboards. The count of undeclared falls from 93 to 70.
Keep the count of long-running resources without health, and let it only go down (hq ADR 0240 rule 8)
2026-10-07 16:17:54 +02:00 · 2026-10-07 16:17:53 +02:00
14 changed files with 101 additions and 2 deletions
@@ -0,0 +1,5 @@
+70
+The long-running resources of this catalogue that do not say how they are ready (`health`, novox/hq ADR 0240
+rule 8), as `module check` counts them. It may only go down: merge-check.sh fails a change that raises it, and
+one that lowers it writes the new number on the first line. From 2026-11-18, or once it is 0, a long-running
+resource without `health` is refused.
@@ -10,14 +10,31 @@
 # graph builds these modules from here. It is not repeated here. This is the repository's own:
 #
 #   1. every manifest through the controller's module check, so one module's change cannot leave another
-#      it shares a rule with refused (MESH_GATE is the controller the mesh runs);
+#      it shares a rule with refused (MESH_GATE is the controller the mesh runs) — and the count of
+#      long-running resources without `health` held to the number in health-undeclared, which only goes down;
 #   2. the Go tests of every module the change touches that has them, under the race detector when the
 #      toolchain has a C compiler — and a module whose dependencies cannot be fetched here, or that is
 #      written in TypeScript, is said as not tested, never passed silently.
 set -eu

 if [ -n "${MESH_GATE:-}" ]; then
-	"$MESH_GATE" module check modules/*/module.json > /dev/null
+	checked=$("$MESH_GATE" module check modules/*/module.json) || { printf '%s\n' "$checked"; exit 1; }
+	# **The count only goes down** (novox/hq ADR 0240 rule 8): the long-running resources that do not say how
+	# they are ready, as the controller counts them, against the number kept in health-undeclared. A change
+	# that raises it fails; one that lowers it writes the new number there, so it can never rise again.
+	kept=$(sed -n 's/^\([0-9][0-9]*\).*/\1/p' health-undeclared | head -n 1)
+	counted=$(printf '%s\n' "$checked" | sed -n 's/^long-running resources without health: \([0-9][0-9]*\)$/\1/p')
+	if [ -z "$counted" ]; then
+		echo "NOT COUNTED: the controller the mesh runs is older than the count of resources without health (ADR 0240 Phase B)"
+	elif [ "$counted" -gt "$kept" ]; then
+		echo "the long-running resources without health rose from $kept to $counted: declare how each new one is ready (ADR 0240 rule 8)"
+		exit 1
+	elif [ "$counted" -lt "$kept" ]; then
+		echo "the long-running resources without health fell from $kept to $counted: write $counted in health-undeclared, so the count cannot rise again"
+		exit 1
+	else
+		echo "long-running resources without health: $counted, as kept"
+	fi
 else
 	echo "NOT CHECKED: no controller was built beside this check, so the manifests were not read by one"
 fi
@@ -82,6 +82,9 @@
      "type": "container",
      "name": "baserow",
      "image": "baserow/baserow@sha256:263ea6c4b72c9eccabcd975ffe9fdebf23913a293a514bec6a3897a5e0a5a080",
+      "health": {
+        "kind": "runtime"
+      },
      "network": "baserow",
      "env-file": [
        "${dir:state}/server.env"
@@ -91,6 +91,11 @@
      "type": "container",
      "name": "grafana",
      "image": "grafana/grafana@sha256:ac461fb352abc50da10a51c7d02462e9c05488f11f53f14b3ad79a8145f638a0",
+      "health": {
+        "kind": "http",
+        "endpoint": "web",
+        "path": "/"
+      },
      "ports": [
        "3000"
      ],
@@ -368,6 +368,9 @@
      "type": "container",
      "name": "mailu-resolver",
      "image": "ghcr.io/mailu/unbound@sha256:3a0fdfb364a63f4f9259526e013c1ef40f5f14de3621ce1560804b3a5909584a",
+      "health": {
+        "kind": "runtime"
+      },
      "network": "mailu",
      "env-file": [
        "${dir:state}/mailu.env",
@@ -391,6 +394,9 @@
      "type": "container",
      "name": "mailu-admin",
      "image": "ghcr.io/mailu/admin@sha256:6dbfdadc4a9590dcb7652357b505200115b689b74008653bbf369e4599a3be5a",
+      "health": {
+        "kind": "runtime"
+      },
      "network": "mailu",
      "ports": [
        "8080"
@@ -412,6 +418,9 @@
      "type": "container",
      "name": "mailu-imap",
      "image": "ghcr.io/mailu/dovecot@sha256:7f0ed5db996fbdc00adc5c5e38a08492e04f7eb4a9fbd66a03aa9a28ddf23993",
+      "health": {
+        "kind": "runtime"
+      },
      "network": "mailu",
      "env-file": [
        "${dir:state}/mailu.env"
@@ -429,6 +438,9 @@
      "type": "container",
      "name": "mailu-smtp",
      "image": "ghcr.io/mailu/postfix@sha256:e2e49f39e53b80eac9e7a2f18d9df11edeb4914fd62dbba89b3155e8e034f62e",
+      "health": {
+        "kind": "runtime"
+      },
      "network": "mailu",
      "env-file": [
        "${dir:state}/mailu.env"
@@ -446,6 +458,9 @@
      "type": "container",
      "name": "mailu-antispam",
      "image": "ghcr.io/mailu/rspamd@sha256:ff3666d8a61f17d309c5c6f6bcf4d40470b82299ca706ac650301175bb1a079d",
+      "health": {
+        "kind": "runtime"
+      },
      "network": "mailu",
      "env-file": [
        "${dir:state}/mailu.env"
@@ -476,6 +491,9 @@
      "type": "container",
      "name": "mailu-webmail",
      "image": "ghcr.io/mailu/webmail@sha256:bdbee44cdb05a4658f0e3b62cc448de55ca8f8aea172279fda594826144c04f6",
+      "health": {
+        "kind": "runtime"
+      },
      "network": "mailu",
      "env-file": [
        "${dir:state}/mailu.env",
@@ -495,6 +513,9 @@
      "type": "container",
      "name": "mailu-webdav",
      "image": "ghcr.io/mailu/radicale@sha256:690ed6edf189dfef100a5a8b37c195ebf5d9241ac5f23f2f44b8b7b75726e3de",
+      "health": {
+        "kind": "runtime"
+      },
      "network": "mailu",
      "env-file": [
        "${dir:state}/mailu.env",
@@ -513,6 +534,9 @@
      "type": "container",
      "name": "mailu-fetchmail",
      "image": "ghcr.io/mailu/fetchmail@sha256:f881c8412d3bbe73d638469b48321558d6403a9d45bfa043c1e52c752103d42d",
+      "health": {
+        "kind": "runtime"
+      },
      "network": "mailu",
      "env-file": [
        "${dir:state}/mailu.env",
@@ -531,6 +555,9 @@
      "type": "container",
      "name": "mailu-front",
      "image": "ghcr.io/mailu/nginx@sha256:36f98897cd1bc9d27628bbb4e04bdf60147af2ec7507d6da77f002c4f256896d",
+      "health": {
+        "kind": "runtime"
+      },
      "network": "mailu",
      "env-file": [
        "${dir:state}/mailu.env"
@@ -120,6 +120,9 @@
      "type": "container",
      "name": "element-web",
      "image": "vectorim/element-web@sha256:a8f415462ab8d2600a592ba1b92bea51efe5a4d10eb738aab9bed769f7099613",
+      "health": {
+        "kind": "runtime"
+      },
      "network": "matrix",
      "ports": [
        "80"
@@ -116,6 +116,10 @@
      "type": "container",
      "name": "mongodb-server",
      "image": "mongo@sha256:e3fa459b4f4b72f3257c67a23c145e250b8b5700f033860392c68539b998bbe3",
+      "health": {
+        "kind": "tcp",
+        "endpoint": "database"
+      },
      "network": "mongodb",
      "env": {
        "MONGO_INITDB_ROOT_USERNAME": "root",
@@ -140,6 +140,10 @@
      "type": "container",
      "name": "mosquitto",
      "image": "eclipse-mosquitto@sha256:38c0da4f2ef84284d47b3b3eeea1cb3bdeabe81ee10caf0cd5c5ff61ee3ea408",
+      "health": {
+        "kind": "tcp",
+        "endpoint": "mqtt"
+      },
      "network": "mosquitto",
      "ports": [
        "1883",
@@ -82,6 +82,9 @@
      "type": "container",
      "name": "nodered",
      "image": "nodered/node-red@sha256:a649dd711d55490151a2c39a8e48ad0c44325488fbc0e66315f2d2e19e5e1ace",
+      "health": {
+        "kind": "runtime"
+      },
      "env": {
        "TZ": "Etc/UTC"
      },
@@ -121,6 +121,10 @@
      "type": "container",
      "name": "postgres",
      "image": "pgvector/pgvector@sha256:cf134a767f474095eeba57e0117be8e568e011a63f33fbf252f14c9b760f8e6f",
+      "health": {
+        "kind": "tcp",
+        "endpoint": "database"
+      },
      "env": {
        "POSTGRES_PASSWORD_FILE": "/run/secrets/superuser",
        "PGDATA": "/var/lib/postgresql/data/pgdata"
@@ -99,6 +99,10 @@
      "type": "container",
      "name": "redis",
      "image": "redis@sha256:520775a41a63e77e06c73e35d2fd9cc15921a609516818796b4ecbb813078bc7",
+      "health": {
+        "kind": "tcp",
+        "endpoint": "cache"
+      },
      "network": "redis",
      "ports": [
        "6379"
@@ -72,6 +72,9 @@
      "type": "container",
      "name": "step-ca",
      "image": "smallstep/step-ca@sha256:a2b17872915c193259b75a5474c398326f41bd199f0842093e52cf4182bc8270",
+      "health": {
+        "kind": "runtime"
+      },
      "network": "host",
      "env-file": [
        "${dir:mesh-state}/init.env"
@@ -359,6 +359,9 @@
      "type": "container",
      "name": "supabase-db",
      "image": "supabase/postgres@sha256:ee29d0aaff03d0e12c7aa63437cba25f24246872f0ed3f82a9fd13184d780777",
+      "health": {
+        "kind": "runtime"
+      },
      "network": "supabase",
      "args": [
        "postgres",
@@ -445,6 +448,9 @@
      "type": "container",
      "name": "supabase-kong",
      "image": "kong@sha256:1b53405d8680a09d6f44494b7990bf7da2ea43f84a258c59717d4539abf09f6d",
+      "health": {
+        "kind": "runtime"
+      },
      "network": "supabase",
      "ports": [
        "8000"
@@ -545,6 +551,9 @@
      "type": "container",
      "name": "supabase-meta",
      "image": "supabase/postgres-meta@sha256:d0a96973e9f1b6303f7500421a459af3d7273b3f9f1db38610899f9f573da7c7",
+      "health": {
+        "kind": "runtime"
+      },
      "network": "supabase",
      "env-file": [
        "${dir:state}/meta-env.env"
@@ -576,6 +585,9 @@
      "type": "container",
      "name": "supabase-studio",
      "image": "supabase/studio@sha256:ebf492ba82db1fc9497f56e4cdebf5cddb464b61f6227e21c8f5f3693f9dbbc5",
+      "health": {
+        "kind": "runtime"
+      },
      "network": "supabase",
      "env-file": [
        "${dir:state}/studio-env.env"
@@ -42,6 +42,11 @@
      "type": "container",
      "name": "website",
      "image": "registry-api.novox.be/novox/www@sha256:aa7ed20a293e1d7444c5c5d59b6d8bdb382bad159559a22e006810e379cae69c",
+      "health": {
+        "kind": "http",
+        "endpoint": "web",
+        "path": "/"
+      },
      "network": "website",
      "ports": [
        "8080"