hq ADR 0247, to-be 50 phase B. A new module, assigned nowhere by this PR.
Holds node-resolver and provides split-dns at the machine's reach. Upgrade policy record, with a why.
Renders:
/etc/resolv.conf: the machine's private address alone, with ADR 0223's options, beginning # Managed by the mesh;
a kept copy at /etc/node-resolver/resolv.conf;
the mesh's domain;
resolved's drop-in: every mesh resolver with Domains=~., FallbackDNS= empty, stub on loopback and on the private address, Cache=no, no hosts file, no LLMNR, mDNS or DNSSEC.
Declares:systemd-resolved.service running, restarted on its drop-in, with unit health. No package: resolved is systemd's (ADR 0207).
The guard (resolver-tools guard, root, unit health):
keeps an outside write of the file, readable by root only under /run/node-resolver;
puts the module's file back at once when a module takes the write, and after 90 s otherwise, so the node-engine still raises a write nothing handles;
stops any link with its own servers from being a default route for names;
serves the verbs on /run/node-resolver/verbs.sock (0600).
Verbs on the mesh:routes, route, unroute, which escalate with sudo -n like hostname's. They refuse the mesh's own domain and the root.
The tests cover the routes, the refusals, escalation, the guard's take, hold, write-over and link cases, the socket, and the manifest held to the code.
merge-check.sh passes locally with the controller from mesh-controller feat/node-resolver-seat as MESH_GATE. The health-undeclared count stays at 70. The check is expected red until that controller runs on the mesh: today's controller refuses a claim to node-resolver, a seat it does not define.
hq ADR 0247, to-be 50 phase B. A new module, assigned nowhere by this PR.
- Holds `node-resolver` and provides `split-dns` at the machine's reach. Upgrade policy `record`, with a why.
- **Renders:**
- `/etc/resolv.conf`: the machine's private address alone, with ADR 0223's options, beginning `# Managed by the mesh`;
- a kept copy at `/etc/node-resolver/resolv.conf`;
- the mesh's domain;
- resolved's drop-in: every mesh resolver with `Domains=~.`, `FallbackDNS=` empty, stub on loopback and on the private address, `Cache=no`, no hosts file, no LLMNR, mDNS or DNSSEC.
- **Declares:** `systemd-resolved.service` running, restarted on its drop-in, with `unit` health. No package: resolved is systemd's (ADR 0207).
- **The guard** (`resolver-tools guard`, root, `unit` health):
- keeps an outside write of the file, readable by root only under `/run/node-resolver`;
- puts the module's file back at once when a module takes the write, and after 90 s otherwise, so the node-engine still raises a write nothing handles;
- stops any link with its own servers from being a default route for names;
- serves the verbs on `/run/node-resolver/verbs.sock` (0600).
- **Verbs on the mesh:** `routes`, `route`, `unroute`, which escalate with `sudo -n` like hostname's. They refuse the mesh's own domain and the root.
The tests cover the routes, the refusals, escalation, the guard's take, hold, write-over and link cases, the socket, and the manifest held to the code.
`merge-check.sh` passes locally with the controller from mesh-controller `feat/node-resolver-seat` as `MESH_GATE`. The health-undeclared count stays at 70. **The check is expected red until that controller runs on the mesh**: today's controller refuses a claim to `node-resolver`, a seat it does not define.
mesh/merge-gate fail: builds new: modules/systemd-resolved, sent nowhere; no bus step; a manifest the change touches fails the module check: modules/system…
Holds node-resolver and provides split-dns at the machine's reach, for a
machine whose VPN client pushes resolvers of its own. It writes the
resolver file naming the machine's private address, gives resolved the
mesh's resolvers as the default route, and serves routes, route and unroute
on the mesh and, over a root-only socket, on the machine. Its guard keeps an
outside write of the file for the module that handles it and puts the
module's file back: at once when taken, after 90 s otherwise, so a write
nothing declared to handle is still raised by the node-engine.
Deliverynovox/mesh-catalog@60641176abaf — stopped since 2026-10-08T23:33:03Z
Delivery plan — builds new: modules/systemd-resolved, sent nowhere; no bus step
Transitions
2026-10-07 19:35 (new) → proposed (announced): novox/mesh-catalog#113's head announced
2026-10-07 19:36 proposed → checked (checked): the verdict names this commit
2026-10-07 19:36 checked → rejected (refused): the gate failed or could not run, or the repository's own check failed
2026-10-07 20:03 rejected → proposed (recheck): mesh-controller #120 (the node-resolver seat) is merged and running; the refusal was the old controller's
2026-10-07 20:05 proposed → checked (checked): the verdict names this commit
2026-10-07 20:05 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
2026-10-07 20:25 ready → held (hold): something holds it for a person: its group's composed check did not pass for the heads that merged, or it merged and no walk was opened for it
2026-10-08 23:33 held → stopped (stop): covered: its merge 3da80a4b50 adds a new module sent nowhere (plan moves no module) and is contained in a1406e7d79 which is delivered (walk plan-1791501183606479074); closed on the operator's word 2026-10-09; the held state came from no walk being opened for it — see hq issue to follow
The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.
<!-- mesh-delivery:view -->
**Delivery** `novox/mesh-catalog@60641176abaf` — **stopped** since 2026-10-08T23:33:03Z
**Delivery plan** — builds new: modules/systemd-resolved, sent nowhere; no bus step
**Transitions**
- 2026-10-07 19:35 (new) → proposed (announced): novox/mesh-catalog#113's head announced
- 2026-10-07 19:36 proposed → checked (checked): the verdict names this commit
- 2026-10-07 19:36 checked → rejected (refused): the gate failed or could not run, or the repository's own check failed
- 2026-10-07 20:03 rejected → proposed (recheck): mesh-controller #120 (the node-resolver seat) is merged and running; the refusal was the old controller's
- 2026-10-07 20:05 proposed → checked (checked): the verdict names this commit
- 2026-10-07 20:05 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
- 2026-10-07 20:25 ready → held (hold): something holds it for a person: its group's composed check did not pass for the heads that merged, or it merged and no walk was opened for it
- 2026-10-08 23:33 held → stopped (stop): covered: its merge 3da80a4b5051 adds a new module sent nowhere (plan moves no module) and is contained in a1406e7d796c which is delivered (walk plan-1791501183606479074); closed on the operator's word 2026-10-09; the held state came from no walk being opened for it — see hq issue to follow
The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.
mesh/merge-gate: FAIL — a manifest the change touches fails the module check: modules/systemd-resolved/module.json: this manifest cannot be used: (modules: new:modules/systemd-resolved)
mesh/repo-check: FAIL — its merge-check.sh failed: long-running resources without health: 70
Delivery plan — builds new: modules/systemd-resolved, sent nowhere; no bus step
Run by the build seat on shanks as build-1791401693639958173 (builds --log build-1791401693639958173).
--- the gate: new:modules/systemd-resolved
modules/systemd-resolved/module.json: this manifest cannot be used:
- systemd-resolved claims "node-resolver", which is a seat in the mesh's own namespace (mesh-*/node-*) that it does not define (novox/hq ADR 0121) — the seats are: git, mesh-artifact-store, mesh-broker, mesh-build-machine, mesh-catalog, mesh-controller, mesh-delivery, mesh-dns-resolver, mesh-store, mesh-vault, node-backup, node-bar, node-build-agent, node-clipboard, node-compositor, node-container-runtime, node-display-server, node-display-session, node-environment, node-hostname, node-hotkeys, node-intrusion-prevention, node-launcher, node-lock-screen, node-login-manager, node-login-shell, node-message-bus, node-notifier, node-package-manager, node-packet-filter, node-power, node-secret-service, node-service-manager, node-terminal-emulator, node-uplink, npm-package-registry, the-private-network
long-running resources without health: 0
mesh-controller: 1 problem(s) in 1 manifest(s)
--- the same manifests on main
--- its merge-check.sh (go toolchain)
words: 12 retired words, none in the 27657 strings of 514 files
mesh-controller: 1 problem(s) in 114 manifest(s)
modules/systemd-resolved/module.json: this manifest cannot be used:
- systemd-resolved claims "node-resolver", which is a seat in the mesh's own namespace (mesh-*/node-*) that it does not define (novox/hq ADR 0121) — the seats are: git, mesh-artifact-store, mesh-broker, mesh-build-machine, mesh-catalog, mesh-controller, mesh-delivery, mesh-dns-resolver, mesh-store, mesh-vault, node-backup, node-bar, node-build-agent, node-clipboard, node-compositor, node-container-runtime, node-display-server, node-display-session, node-environment, node-hostname, node-hotkeys, node-intrusion-prevention, node-launcher, node-lock-screen, node-login-manager, node-login-shell, node-message-bus, node-notifier, node-package-manager, node-packet-filter, node-power, node-secret-service, node-service-manager, node-terminal-emulator, node-uplink, npm-package-registry, the-private-network
adwaita: ok, 4 tool(s)
asus-zephyrus-g14: ok, 11 tool(s); WARNING: asusd, supergfxd, upower stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
audit-logger: ok, keeps trail (valuable), spool (valuable)
avahi: ok, 4 tool(s); WARNING: daemon stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
baserow: ok, keeps data (valuable), ready: server by its image's own check every 30s
blueman: ok, 3 tool(s)
bluetooth: ok, 9 tool(s); WARNING: daemon stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
build-agent: ok, keeps workspace (cache); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
ca-trust: ok; WARNING: trust stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
claude-code: ok, 40 tool(s), keeps state servers, holdings, config, reads claude-licence-manager.bindings, keeps agent-home (valuable)
claude-licence-manager: ok, keeps state bindings, reads claude-code.holdings
clipmenu: ok, 3 tool(s)
confluence: ok
cups: ok, 7 tool(s); WARNING: socket, scheduler stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
dbus: ok, 5 tool(s); WARNING: system-bus stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
de-spiegel: ok; WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
distribution: ok, keeps registry (rebuildable); WARNING: store stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
dmenu: ok, 2 tool(s)
dnsmasq: ok; WARNING: service stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
docker: ok, 20 tool(s); WARNING: socket, runtime, prune stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
docker-compose: ok, 9 tool(s)
dunst: ok, 5 tool(s)
fail2ban: ok, 1 tool(s); WARNING: run stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
feh: ok, 2 tool(s)
flatpak: ok, 11 tool(s)
fonts: ok, 6 tool(s)
forticlient: ok, 3 tool(s); WARNING: scheduler stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
gitea: ok, keeps data (valuable); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
gitlab: ok
gnome-keyring: ok, 4 tool(s)
grafana: ok, keeps data (valuable), ready: server by http / on web every 30s
hello-web: ok; WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
home-assistant: ok, keeps config (valuable); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
hostname: ok
i3: ok, 10 tool(s)
i3status-rust: ok, 4 tool(s)
icecast: ok, keeps logs (cache); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
influxdb: ok, keeps data (valuable), config (valuable); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
invoicing: ok; WARNING: app, api stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
jira: ok
keycloak: ok; WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
lab: ok, keeps work (cache)
lemurs: ok, 2 tool(s); WARNING: service stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
letta: ok; WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
local-model-consumer: ok
localization: ok, 4 tool(s)
logrotate: ok, 7 tool(s); WARNING: timer stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
mailu: ok, keeps mail (valuable), dkim (valuable), data (valuable), dav (valuable), webmail (valuable), queue (valuable), filter (rebuildable), certs (rebuildable), automx (rebuildable), fetchmail (rebuildable), clamav (cache), redis (cache), ready: resolver by its image's own check every 30s; admin by its image's own check every 30s; imap by its image's own check every 30s; smtp by its image's own check every 30s; antispam by its image's own check every 30s; webmail by its image's own check every 30s; webdav by its image's own check every 30s; fetchmail by its image's own check every 30s; front by its image's own check every 30s; WARNING: redis, antivirus, automx stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
marrytts: ok; WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
matrix: ok, keeps db (valuable), ready: element by its image's own check every 30s; WARNING: homeserver stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
memory-pressure: ok, 6 tool(s); WARNING: oomd stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
mesh-catalog: ok
mesh-delivery: ok, 1 tool(s), invokes seat:mesh-controller.delivery-plan, seat:mesh-controller.delivery-order, seat:mesh-controller.delivery-check, seat:mesh-controller.deliver, seat:mesh-controller.delivery-stop, seat:mesh-controller.delivery-walks, gitea.gitea_note_append, gitea.gitea_delivery_view, gitea.gitea_commit_status, gitea.gitea_commit_statuses, keeps state deliveries, groups
mesh-vault: ok, keeps state (valuable), ledger (valuable), root (valuable)
mesh-watcher: ok, 4 tool(s), invokes mesh-watcher.watcher_ping, seat:mesh-controller.seats
messenger: ok, 4 tool(s), invokes seat:node-notifier.send, seat:mesh-controller.conditions, keeps state open, sent
minio: ok, keeps data (valuable); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
model-usage: ok, keeps state (cache), spool (valuable)
mongodb: ok, keeps data (valuable), dumps (rebuildable), ready: server by tcp on database every 30s
mosquitto: ok, keeps data (rebuildable), ready: server by tcp on mqtt every 30s
mssql: ok, keeps data (valuable), dumps (rebuildable); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
n8n: ok, keeps data (valuable), cache (cache); WARNING: server, cache-server, browser stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
nats: ok, 8 tool(s), keeps jetstream (valuable), snapshots (rebuildable); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
netcheck: ok, 3 tool(s)
networkmanager: ok
nextcloud: ok, keeps html (valuable); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
nextcloud-client: ok, 4 tool(s)
nftables: ok, 1 tool(s); WARNING: load stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
nm-applet: ok, 3 tool(s)
node-env: ok
nodered: ok, keeps data (valuable), ready: server by its image's own check every 30s
ollama: ok, keeps models (rebuildable); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
only-office: ok, keeps data (rebuildable), lib (rebuildable), db (rebuildable), fonts (rebuildable), logs (cache), rabbitmq (cache), redis (cache); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
openai-consumer: ok
openrazer: ok, 3 tool(s)
pacman: ok, 15 tool(s); WARNING: mirror-refresh, cache-cleaning stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
photos-eef: ok; WARNING: client stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
photos-filip: ok; WARNING: client stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
picom: ok, 4 tool(s)
polychromatic: ok, 3 tool(s)
postgres: ok, keeps store (valuable), dumps (rebuildable), ready: server by tcp on database every 30s
power: ok, 5 tool(s); WARNING: after-boot, before-shutdown stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
powerlevel10k: ok
records: ok, 5 tool(s), keeps checkout (rebuildable)
redis: ok, keeps data (cache), ready: server by tcp on cache every 30s
restic: ok, keeps repository (rebuildable), state (cache)
rofi: ok, 3 tool(s)
route-adapter: ok
route-proxy: ok, keeps acme (rebuildable), ca (cache); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
screen-lock: ok, 3 tool(s)
searxng: ok, keeps valkey (cache); WARNING: cache, server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
showcase: ok; WARNING: server, tools stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
slack: ok, 4 tool(s)
snapd: ok, 10 tool(s)
ssh-client: ok, 8 tool(s), keeps ssh (valuable)
sshd: ok; WARNING: run stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
step-ca: ok, keeps home (valuable), ready: server by its image's own check every 30s
sudo: ok, 3 tool(s)
supabase: ok, keeps db (valuable), dumps (rebuildable), storage (valuable), functions (valuable), db-config (rebuildable), ready: db by its image's own check every 30s; kong by its image's own check every 30s; meta by its image's own check every 30s; studio by its image's own check every 30s; WARNING: vector, analytics, auth, rest, realtime, imgproxy, storage-api, edge-functions, pooler stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
systemd: ok, 1 tool(s)
systemd-networkd: ok
time-sync: ok, 3 tool(s); WARNING: daemon stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
triggerhappy: ok, 4 tool(s); WARNING: service stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
umami: ok; WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
unifi: ok, keeps data (valuable); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
website: ok, ready: server by http / on web every 30s
xclip: ok, 4 tool(s)
xdg: ok, 5 tool(s)
xorg: ok, 8 tool(s)
xterm: ok, 2 tool(s)
zsh: ok, 1 tool(s)
zsh-autosuggestions: ok
zsh-syntax-highlighting: ok
long-running resources without health: 70
**Merge check** at `d5357121`
- `mesh/merge-gate`: **FAIL** — a manifest the change touches fails the module check: modules/systemd-resolved/module.json: this manifest cannot be used: (modules: new:modules/systemd-resolved)
- `mesh/repo-check`: **FAIL** — its merge-check.sh failed: long-running resources without health: 70
**Delivery plan** — builds new: modules/systemd-resolved, sent nowhere; no bus step
Run by the build seat on shanks as `build-1791401693639958173` (`builds --log build-1791401693639958173`).
```
--- the gate: new:modules/systemd-resolved
modules/systemd-resolved/module.json: this manifest cannot be used:
- systemd-resolved claims "node-resolver", which is a seat in the mesh's own namespace (mesh-*/node-*) that it does not define (novox/hq ADR 0121) — the seats are: git, mesh-artifact-store, mesh-broker, mesh-build-machine, mesh-catalog, mesh-controller, mesh-delivery, mesh-dns-resolver, mesh-store, mesh-vault, node-backup, node-bar, node-build-agent, node-clipboard, node-compositor, node-container-runtime, node-display-server, node-display-session, node-environment, node-hostname, node-hotkeys, node-intrusion-prevention, node-launcher, node-lock-screen, node-login-manager, node-login-shell, node-message-bus, node-notifier, node-package-manager, node-packet-filter, node-power, node-secret-service, node-service-manager, node-terminal-emulator, node-uplink, npm-package-registry, the-private-network
long-running resources without health: 0
mesh-controller: 1 problem(s) in 1 manifest(s)
--- the same manifests on main
--- its merge-check.sh (go toolchain)
words: 12 retired words, none in the 27657 strings of 514 files
mesh-controller: 1 problem(s) in 114 manifest(s)
modules/systemd-resolved/module.json: this manifest cannot be used:
- systemd-resolved claims "node-resolver", which is a seat in the mesh's own namespace (mesh-*/node-*) that it does not define (novox/hq ADR 0121) — the seats are: git, mesh-artifact-store, mesh-broker, mesh-build-machine, mesh-catalog, mesh-controller, mesh-delivery, mesh-dns-resolver, mesh-store, mesh-vault, node-backup, node-bar, node-build-agent, node-clipboard, node-compositor, node-container-runtime, node-display-server, node-display-session, node-environment, node-hostname, node-hotkeys, node-intrusion-prevention, node-launcher, node-lock-screen, node-login-manager, node-login-shell, node-message-bus, node-notifier, node-package-manager, node-packet-filter, node-power, node-secret-service, node-service-manager, node-terminal-emulator, node-uplink, npm-package-registry, the-private-network
adwaita: ok, 4 tool(s)
asus-zephyrus-g14: ok, 11 tool(s); WARNING: asusd, supergfxd, upower stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
audit-logger: ok, keeps trail (valuable), spool (valuable)
avahi: ok, 4 tool(s); WARNING: daemon stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
baserow: ok, keeps data (valuable), ready: server by its image's own check every 30s
blueman: ok, 3 tool(s)
bluetooth: ok, 9 tool(s); WARNING: daemon stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
build-agent: ok, keeps workspace (cache); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
ca-trust: ok; WARNING: trust stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
claude-code: ok, 40 tool(s), keeps state servers, holdings, config, reads claude-licence-manager.bindings, keeps agent-home (valuable)
claude-licence-manager: ok, keeps state bindings, reads claude-code.holdings
clipmenu: ok, 3 tool(s)
confluence: ok
cups: ok, 7 tool(s); WARNING: socket, scheduler stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
dbus: ok, 5 tool(s); WARNING: system-bus stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
de-spiegel: ok; WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
distribution: ok, keeps registry (rebuildable); WARNING: store stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
dmenu: ok, 2 tool(s)
dnsmasq: ok; WARNING: service stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
docker: ok, 20 tool(s); WARNING: socket, runtime, prune stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
docker-compose: ok, 9 tool(s)
dunst: ok, 5 tool(s)
fail2ban: ok, 1 tool(s); WARNING: run stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
feh: ok, 2 tool(s)
flatpak: ok, 11 tool(s)
fonts: ok, 6 tool(s)
forticlient: ok, 3 tool(s); WARNING: scheduler stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
gitea: ok, keeps data (valuable); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
gitlab: ok
gnome-keyring: ok, 4 tool(s)
grafana: ok, keeps data (valuable), ready: server by http / on web every 30s
hello-web: ok; WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
home-assistant: ok, keeps config (valuable); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
hostname: ok
i3: ok, 10 tool(s)
i3status-rust: ok, 4 tool(s)
icecast: ok, keeps logs (cache); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
influxdb: ok, keeps data (valuable), config (valuable); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
invoicing: ok; WARNING: app, api stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
jira: ok
keycloak: ok; WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
lab: ok, keeps work (cache)
lemurs: ok, 2 tool(s); WARNING: service stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
letta: ok; WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
local-model-consumer: ok
localization: ok, 4 tool(s)
logrotate: ok, 7 tool(s); WARNING: timer stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
mailu: ok, keeps mail (valuable), dkim (valuable), data (valuable), dav (valuable), webmail (valuable), queue (valuable), filter (rebuildable), certs (rebuildable), automx (rebuildable), fetchmail (rebuildable), clamav (cache), redis (cache), ready: resolver by its image's own check every 30s; admin by its image's own check every 30s; imap by its image's own check every 30s; smtp by its image's own check every 30s; antispam by its image's own check every 30s; webmail by its image's own check every 30s; webdav by its image's own check every 30s; fetchmail by its image's own check every 30s; front by its image's own check every 30s; WARNING: redis, antivirus, automx stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
marrytts: ok; WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
matrix: ok, keeps db (valuable), ready: element by its image's own check every 30s; WARNING: homeserver stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
memory-pressure: ok, 6 tool(s); WARNING: oomd stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
mesh-catalog: ok
mesh-delivery: ok, 1 tool(s), invokes seat:mesh-controller.delivery-plan, seat:mesh-controller.delivery-order, seat:mesh-controller.delivery-check, seat:mesh-controller.deliver, seat:mesh-controller.delivery-stop, seat:mesh-controller.delivery-walks, gitea.gitea_note_append, gitea.gitea_delivery_view, gitea.gitea_commit_status, gitea.gitea_commit_statuses, keeps state deliveries, groups
mesh-vault: ok, keeps state (valuable), ledger (valuable), root (valuable)
mesh-watcher: ok, 4 tool(s), invokes mesh-watcher.watcher_ping, seat:mesh-controller.seats
messenger: ok, 4 tool(s), invokes seat:node-notifier.send, seat:mesh-controller.conditions, keeps state open, sent
minio: ok, keeps data (valuable); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
model-usage: ok, keeps state (cache), spool (valuable)
mongodb: ok, keeps data (valuable), dumps (rebuildable), ready: server by tcp on database every 30s
mosquitto: ok, keeps data (rebuildable), ready: server by tcp on mqtt every 30s
mssql: ok, keeps data (valuable), dumps (rebuildable); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
n8n: ok, keeps data (valuable), cache (cache); WARNING: server, cache-server, browser stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
nats: ok, 8 tool(s), keeps jetstream (valuable), snapshots (rebuildable); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
netcheck: ok, 3 tool(s)
networkmanager: ok
nextcloud: ok, keeps html (valuable); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
nextcloud-client: ok, 4 tool(s)
nftables: ok, 1 tool(s); WARNING: load stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
nm-applet: ok, 3 tool(s)
node-env: ok
nodered: ok, keeps data (valuable), ready: server by its image's own check every 30s
ollama: ok, keeps models (rebuildable); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
only-office: ok, keeps data (rebuildable), lib (rebuildable), db (rebuildable), fonts (rebuildable), logs (cache), rabbitmq (cache), redis (cache); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
openai-consumer: ok
openrazer: ok, 3 tool(s)
pacman: ok, 15 tool(s); WARNING: mirror-refresh, cache-cleaning stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
photos-eef: ok; WARNING: client stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
photos-filip: ok; WARNING: client stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
picom: ok, 4 tool(s)
polychromatic: ok, 3 tool(s)
postgres: ok, keeps store (valuable), dumps (rebuildable), ready: server by tcp on database every 30s
power: ok, 5 tool(s); WARNING: after-boot, before-shutdown stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
powerlevel10k: ok
records: ok, 5 tool(s), keeps checkout (rebuildable)
redis: ok, keeps data (cache), ready: server by tcp on cache every 30s
restic: ok, keeps repository (rebuildable), state (cache)
rofi: ok, 3 tool(s)
route-adapter: ok
route-proxy: ok, keeps acme (rebuildable), ca (cache); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
screen-lock: ok, 3 tool(s)
searxng: ok, keeps valkey (cache); WARNING: cache, server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
showcase: ok; WARNING: server, tools stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
slack: ok, 4 tool(s)
snapd: ok, 10 tool(s)
ssh-client: ok, 8 tool(s), keeps ssh (valuable)
sshd: ok; WARNING: run stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
step-ca: ok, keeps home (valuable), ready: server by its image's own check every 30s
sudo: ok, 3 tool(s)
supabase: ok, keeps db (valuable), dumps (rebuildable), storage (valuable), functions (valuable), db-config (rebuildable), ready: db by its image's own check every 30s; kong by its image's own check every 30s; meta by its image's own check every 30s; studio by its image's own check every 30s; WARNING: vector, analytics, auth, rest, realtime, imgproxy, storage-api, edge-functions, pooler stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
systemd: ok, 1 tool(s)
systemd-networkd: ok
time-sync: ok, 3 tool(s); WARNING: daemon stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
triggerhappy: ok, 4 tool(s); WARNING: service stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
umami: ok; WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
unifi: ok, keeps data (valuable); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
website: ok, ready: server by http / on web every 30s
xclip: ok, 4 tool(s)
xdg: ok, 5 tool(s)
xorg: ok, 8 tool(s)
xterm: ok, 2 tool(s)
zsh: ok, 1 tool(s)
zsh-autosuggestions: ok
zsh-syntax-highlighting: ok
long-running resources without health: 70
```
mesh/merge-gate pass: builds new: modules/systemd-resolved, sent nowhere; no bus step; every machine composes with the change as it did without (4 of 4 com…
mesh/delivery stopped: covered: its merge 3da80a4b5051 adds a new module sent nowhere (plan moves no module) and is contained in a1406e7d796c which is de…
mesh/merge-gate: FAIL — a manifest the change touches fails the module check: modules/systemd-resolved/module.json: this manifest cannot be used: (modules: new:modules/systemd-resolved)
mesh/repo-check: FAIL — its merge-check.sh failed: long-running resources without health: 70
Delivery plan — builds new: modules/systemd-resolved, sent nowhere; no bus step
Run by the build seat on g14 as build-1791401756536311140 (builds --log build-1791401756536311140).
--- the gate: new:modules/systemd-resolved
modules/systemd-resolved/module.json: this manifest cannot be used:
- systemd-resolved claims "node-resolver", which is a seat in the mesh's own namespace (mesh-*/node-*) that it does not define (novox/hq ADR 0121) — the seats are: git, mesh-artifact-store, mesh-broker, mesh-build-machine, mesh-catalog, mesh-controller, mesh-delivery, mesh-dns-resolver, mesh-store, mesh-vault, node-backup, node-bar, node-build-agent, node-clipboard, node-compositor, node-container-runtime, node-display-server, node-display-session, node-environment, node-hostname, node-hotkeys, node-intrusion-prevention, node-launcher, node-lock-screen, node-login-manager, node-login-shell, node-message-bus, node-notifier, node-package-manager, node-packet-filter, node-power, node-secret-service, node-service-manager, node-terminal-emulator, node-uplink, npm-package-registry, the-private-network
long-running resources without health: 0
mesh-controller: 1 problem(s) in 1 manifest(s)
--- the same manifests on main
--- its merge-check.sh (go toolchain)
words: 12 retired words, none in the 27657 strings of 514 files
mesh-controller: 1 problem(s) in 114 manifest(s)
modules/systemd-resolved/module.json: this manifest cannot be used:
- systemd-resolved claims "node-resolver", which is a seat in the mesh's own namespace (mesh-*/node-*) that it does not define (novox/hq ADR 0121) — the seats are: git, mesh-artifact-store, mesh-broker, mesh-build-machine, mesh-catalog, mesh-controller, mesh-delivery, mesh-dns-resolver, mesh-store, mesh-vault, node-backup, node-bar, node-build-agent, node-clipboard, node-compositor, node-container-runtime, node-display-server, node-display-session, node-environment, node-hostname, node-hotkeys, node-intrusion-prevention, node-launcher, node-lock-screen, node-login-manager, node-login-shell, node-message-bus, node-notifier, node-package-manager, node-packet-filter, node-power, node-secret-service, node-service-manager, node-terminal-emulator, node-uplink, npm-package-registry, the-private-network
adwaita: ok, 4 tool(s)
asus-zephyrus-g14: ok, 11 tool(s); WARNING: asusd, supergfxd, upower stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
audit-logger: ok, keeps trail (valuable), spool (valuable)
avahi: ok, 4 tool(s); WARNING: daemon stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
baserow: ok, keeps data (valuable), ready: server by its image's own check every 30s
blueman: ok, 3 tool(s)
bluetooth: ok, 9 tool(s); WARNING: daemon stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
build-agent: ok, keeps workspace (cache); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
ca-trust: ok; WARNING: trust stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
claude-code: ok, 40 tool(s), keeps state servers, holdings, config, reads claude-licence-manager.bindings, keeps agent-home (valuable)
claude-licence-manager: ok, keeps state bindings, reads claude-code.holdings
clipmenu: ok, 3 tool(s)
confluence: ok
cups: ok, 7 tool(s); WARNING: socket, scheduler stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
dbus: ok, 5 tool(s); WARNING: system-bus stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
de-spiegel: ok; WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
distribution: ok, keeps registry (rebuildable); WARNING: store stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
dmenu: ok, 2 tool(s)
dnsmasq: ok; WARNING: service stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
docker: ok, 20 tool(s); WARNING: socket, runtime, prune stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
docker-compose: ok, 9 tool(s)
dunst: ok, 5 tool(s)
fail2ban: ok, 1 tool(s); WARNING: run stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
feh: ok, 2 tool(s)
flatpak: ok, 11 tool(s)
fonts: ok, 6 tool(s)
forticlient: ok, 3 tool(s); WARNING: scheduler stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
gitea: ok, keeps data (valuable); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
gitlab: ok
gnome-keyring: ok, 4 tool(s)
grafana: ok, keeps data (valuable), ready: server by http / on web every 30s
hello-web: ok; WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
home-assistant: ok, keeps config (valuable); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
hostname: ok
i3: ok, 10 tool(s)
i3status-rust: ok, 4 tool(s)
icecast: ok, keeps logs (cache); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
influxdb: ok, keeps data (valuable), config (valuable); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
invoicing: ok; WARNING: app, api stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
jira: ok
keycloak: ok; WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
lab: ok, keeps work (cache)
lemurs: ok, 2 tool(s); WARNING: service stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
letta: ok; WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
local-model-consumer: ok
localization: ok, 4 tool(s)
logrotate: ok, 7 tool(s); WARNING: timer stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
mailu: ok, keeps mail (valuable), dkim (valuable), data (valuable), dav (valuable), webmail (valuable), queue (valuable), filter (rebuildable), certs (rebuildable), automx (rebuildable), fetchmail (rebuildable), clamav (cache), redis (cache), ready: resolver by its image's own check every 30s; admin by its image's own check every 30s; imap by its image's own check every 30s; smtp by its image's own check every 30s; antispam by its image's own check every 30s; webmail by its image's own check every 30s; webdav by its image's own check every 30s; fetchmail by its image's own check every 30s; front by its image's own check every 30s; WARNING: redis, antivirus, automx stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
marrytts: ok; WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
matrix: ok, keeps db (valuable), ready: element by its image's own check every 30s; WARNING: homeserver stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
memory-pressure: ok, 6 tool(s); WARNING: oomd stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
mesh-catalog: ok
mesh-delivery: ok, 1 tool(s), invokes seat:mesh-controller.delivery-plan, seat:mesh-controller.delivery-order, seat:mesh-controller.delivery-check, seat:mesh-controller.deliver, seat:mesh-controller.delivery-stop, seat:mesh-controller.delivery-walks, gitea.gitea_note_append, gitea.gitea_delivery_view, gitea.gitea_commit_status, gitea.gitea_commit_statuses, keeps state deliveries, groups
mesh-vault: ok, keeps state (valuable), ledger (valuable), root (valuable)
mesh-watcher: ok, 4 tool(s), invokes mesh-watcher.watcher_ping, seat:mesh-controller.seats
messenger: ok, 4 tool(s), invokes seat:node-notifier.send, seat:mesh-controller.conditions, keeps state open, sent
minio: ok, keeps data (valuable); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
model-usage: ok, keeps state (cache), spool (valuable)
mongodb: ok, keeps data (valuable), dumps (rebuildable), ready: server by tcp on database every 30s
mosquitto: ok, keeps data (rebuildable), ready: server by tcp on mqtt every 30s
mssql: ok, keeps data (valuable), dumps (rebuildable); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
n8n: ok, keeps data (valuable), cache (cache); WARNING: server, cache-server, browser stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
nats: ok, 8 tool(s), keeps jetstream (valuable), snapshots (rebuildable); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
netcheck: ok, 3 tool(s)
networkmanager: ok
nextcloud: ok, keeps html (valuable); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
nextcloud-client: ok, 4 tool(s)
nftables: ok, 1 tool(s); WARNING: load stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
nm-applet: ok, 3 tool(s)
node-env: ok
nodered: ok, keeps data (valuable), ready: server by its image's own check every 30s
ollama: ok, keeps models (rebuildable); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
only-office: ok, keeps data (rebuildable), lib (rebuildable), db (rebuildable), fonts (rebuildable), logs (cache), rabbitmq (cache), redis (cache); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
openai-consumer: ok
openrazer: ok, 3 tool(s)
pacman: ok, 15 tool(s); WARNING: mirror-refresh, cache-cleaning stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
photos-eef: ok; WARNING: client stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
photos-filip: ok; WARNING: client stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
picom: ok, 4 tool(s)
polychromatic: ok, 3 tool(s)
postgres: ok, keeps store (valuable), dumps (rebuildable), ready: server by tcp on database every 30s
power: ok, 5 tool(s); WARNING: after-boot, before-shutdown stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
powerlevel10k: ok
records: ok, 5 tool(s), keeps checkout (rebuildable)
redis: ok, keeps data (cache), ready: server by tcp on cache every 30s
restic: ok, keeps repository (rebuildable), state (cache)
rofi: ok, 3 tool(s)
route-adapter: ok
route-proxy: ok, keeps acme (rebuildable), ca (cache); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
screen-lock: ok, 3 tool(s)
searxng: ok, keeps valkey (cache); WARNING: cache, server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
showcase: ok; WARNING: server, tools stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
slack: ok, 4 tool(s)
snapd: ok, 10 tool(s)
ssh-client: ok, 8 tool(s), keeps ssh (valuable)
sshd: ok; WARNING: run stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
step-ca: ok, keeps home (valuable), ready: server by its image's own check every 30s
sudo: ok, 3 tool(s)
supabase: ok, keeps db (valuable), dumps (rebuildable), storage (valuable), functions (valuable), db-config (rebuildable), ready: db by its image's own check every 30s; kong by its image's own check every 30s; meta by its image's own check every 30s; studio by its image's own check every 30s; WARNING: vector, analytics, auth, rest, realtime, imgproxy, storage-api, edge-functions, pooler stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
systemd: ok, 1 tool(s)
systemd-networkd: ok
time-sync: ok, 3 tool(s); WARNING: daemon stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
triggerhappy: ok, 4 tool(s); WARNING: service stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
umami: ok; WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
unifi: ok, keeps data (valuable); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
website: ok, ready: server by http / on web every 30s
xclip: ok, 4 tool(s)
xdg: ok, 5 tool(s)
xorg: ok, 8 tool(s)
xterm: ok, 2 tool(s)
zsh: ok, 1 tool(s)
zsh-autosuggestions: ok
zsh-syntax-highlighting: ok
long-running resources without health: 70
**Merge check** at `60641176`
- `mesh/merge-gate`: **FAIL** — a manifest the change touches fails the module check: modules/systemd-resolved/module.json: this manifest cannot be used: (modules: new:modules/systemd-resolved)
- `mesh/repo-check`: **FAIL** — its merge-check.sh failed: long-running resources without health: 70
**Delivery plan** — builds new: modules/systemd-resolved, sent nowhere; no bus step
Run by the build seat on g14 as `build-1791401756536311140` (`builds --log build-1791401756536311140`).
```
--- the gate: new:modules/systemd-resolved
modules/systemd-resolved/module.json: this manifest cannot be used:
- systemd-resolved claims "node-resolver", which is a seat in the mesh's own namespace (mesh-*/node-*) that it does not define (novox/hq ADR 0121) — the seats are: git, mesh-artifact-store, mesh-broker, mesh-build-machine, mesh-catalog, mesh-controller, mesh-delivery, mesh-dns-resolver, mesh-store, mesh-vault, node-backup, node-bar, node-build-agent, node-clipboard, node-compositor, node-container-runtime, node-display-server, node-display-session, node-environment, node-hostname, node-hotkeys, node-intrusion-prevention, node-launcher, node-lock-screen, node-login-manager, node-login-shell, node-message-bus, node-notifier, node-package-manager, node-packet-filter, node-power, node-secret-service, node-service-manager, node-terminal-emulator, node-uplink, npm-package-registry, the-private-network
long-running resources without health: 0
mesh-controller: 1 problem(s) in 1 manifest(s)
--- the same manifests on main
--- its merge-check.sh (go toolchain)
words: 12 retired words, none in the 27657 strings of 514 files
mesh-controller: 1 problem(s) in 114 manifest(s)
modules/systemd-resolved/module.json: this manifest cannot be used:
- systemd-resolved claims "node-resolver", which is a seat in the mesh's own namespace (mesh-*/node-*) that it does not define (novox/hq ADR 0121) — the seats are: git, mesh-artifact-store, mesh-broker, mesh-build-machine, mesh-catalog, mesh-controller, mesh-delivery, mesh-dns-resolver, mesh-store, mesh-vault, node-backup, node-bar, node-build-agent, node-clipboard, node-compositor, node-container-runtime, node-display-server, node-display-session, node-environment, node-hostname, node-hotkeys, node-intrusion-prevention, node-launcher, node-lock-screen, node-login-manager, node-login-shell, node-message-bus, node-notifier, node-package-manager, node-packet-filter, node-power, node-secret-service, node-service-manager, node-terminal-emulator, node-uplink, npm-package-registry, the-private-network
adwaita: ok, 4 tool(s)
asus-zephyrus-g14: ok, 11 tool(s); WARNING: asusd, supergfxd, upower stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
audit-logger: ok, keeps trail (valuable), spool (valuable)
avahi: ok, 4 tool(s); WARNING: daemon stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
baserow: ok, keeps data (valuable), ready: server by its image's own check every 30s
blueman: ok, 3 tool(s)
bluetooth: ok, 9 tool(s); WARNING: daemon stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
build-agent: ok, keeps workspace (cache); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
ca-trust: ok; WARNING: trust stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
claude-code: ok, 40 tool(s), keeps state servers, holdings, config, reads claude-licence-manager.bindings, keeps agent-home (valuable)
claude-licence-manager: ok, keeps state bindings, reads claude-code.holdings
clipmenu: ok, 3 tool(s)
confluence: ok
cups: ok, 7 tool(s); WARNING: socket, scheduler stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
dbus: ok, 5 tool(s); WARNING: system-bus stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
de-spiegel: ok; WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
distribution: ok, keeps registry (rebuildable); WARNING: store stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
dmenu: ok, 2 tool(s)
dnsmasq: ok; WARNING: service stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
docker: ok, 20 tool(s); WARNING: socket, runtime, prune stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
docker-compose: ok, 9 tool(s)
dunst: ok, 5 tool(s)
fail2ban: ok, 1 tool(s); WARNING: run stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
feh: ok, 2 tool(s)
flatpak: ok, 11 tool(s)
fonts: ok, 6 tool(s)
forticlient: ok, 3 tool(s); WARNING: scheduler stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
gitea: ok, keeps data (valuable); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
gitlab: ok
gnome-keyring: ok, 4 tool(s)
grafana: ok, keeps data (valuable), ready: server by http / on web every 30s
hello-web: ok; WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
home-assistant: ok, keeps config (valuable); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
hostname: ok
i3: ok, 10 tool(s)
i3status-rust: ok, 4 tool(s)
icecast: ok, keeps logs (cache); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
influxdb: ok, keeps data (valuable), config (valuable); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
invoicing: ok; WARNING: app, api stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
jira: ok
keycloak: ok; WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
lab: ok, keeps work (cache)
lemurs: ok, 2 tool(s); WARNING: service stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
letta: ok; WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
local-model-consumer: ok
localization: ok, 4 tool(s)
logrotate: ok, 7 tool(s); WARNING: timer stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
mailu: ok, keeps mail (valuable), dkim (valuable), data (valuable), dav (valuable), webmail (valuable), queue (valuable), filter (rebuildable), certs (rebuildable), automx (rebuildable), fetchmail (rebuildable), clamav (cache), redis (cache), ready: resolver by its image's own check every 30s; admin by its image's own check every 30s; imap by its image's own check every 30s; smtp by its image's own check every 30s; antispam by its image's own check every 30s; webmail by its image's own check every 30s; webdav by its image's own check every 30s; fetchmail by its image's own check every 30s; front by its image's own check every 30s; WARNING: redis, antivirus, automx stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
marrytts: ok; WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
matrix: ok, keeps db (valuable), ready: element by its image's own check every 30s; WARNING: homeserver stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
memory-pressure: ok, 6 tool(s); WARNING: oomd stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
mesh-catalog: ok
mesh-delivery: ok, 1 tool(s), invokes seat:mesh-controller.delivery-plan, seat:mesh-controller.delivery-order, seat:mesh-controller.delivery-check, seat:mesh-controller.deliver, seat:mesh-controller.delivery-stop, seat:mesh-controller.delivery-walks, gitea.gitea_note_append, gitea.gitea_delivery_view, gitea.gitea_commit_status, gitea.gitea_commit_statuses, keeps state deliveries, groups
mesh-vault: ok, keeps state (valuable), ledger (valuable), root (valuable)
mesh-watcher: ok, 4 tool(s), invokes mesh-watcher.watcher_ping, seat:mesh-controller.seats
messenger: ok, 4 tool(s), invokes seat:node-notifier.send, seat:mesh-controller.conditions, keeps state open, sent
minio: ok, keeps data (valuable); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
model-usage: ok, keeps state (cache), spool (valuable)
mongodb: ok, keeps data (valuable), dumps (rebuildable), ready: server by tcp on database every 30s
mosquitto: ok, keeps data (rebuildable), ready: server by tcp on mqtt every 30s
mssql: ok, keeps data (valuable), dumps (rebuildable); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
n8n: ok, keeps data (valuable), cache (cache); WARNING: server, cache-server, browser stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
nats: ok, 8 tool(s), keeps jetstream (valuable), snapshots (rebuildable); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
netcheck: ok, 3 tool(s)
networkmanager: ok
nextcloud: ok, keeps html (valuable); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
nextcloud-client: ok, 4 tool(s)
nftables: ok, 1 tool(s); WARNING: load stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
nm-applet: ok, 3 tool(s)
node-env: ok
nodered: ok, keeps data (valuable), ready: server by its image's own check every 30s
ollama: ok, keeps models (rebuildable); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
only-office: ok, keeps data (rebuildable), lib (rebuildable), db (rebuildable), fonts (rebuildable), logs (cache), rabbitmq (cache), redis (cache); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
openai-consumer: ok
openrazer: ok, 3 tool(s)
pacman: ok, 15 tool(s); WARNING: mirror-refresh, cache-cleaning stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
photos-eef: ok; WARNING: client stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
photos-filip: ok; WARNING: client stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
picom: ok, 4 tool(s)
polychromatic: ok, 3 tool(s)
postgres: ok, keeps store (valuable), dumps (rebuildable), ready: server by tcp on database every 30s
power: ok, 5 tool(s); WARNING: after-boot, before-shutdown stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
powerlevel10k: ok
records: ok, 5 tool(s), keeps checkout (rebuildable)
redis: ok, keeps data (cache), ready: server by tcp on cache every 30s
restic: ok, keeps repository (rebuildable), state (cache)
rofi: ok, 3 tool(s)
route-adapter: ok
route-proxy: ok, keeps acme (rebuildable), ca (cache); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
screen-lock: ok, 3 tool(s)
searxng: ok, keeps valkey (cache); WARNING: cache, server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
showcase: ok; WARNING: server, tools stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
slack: ok, 4 tool(s)
snapd: ok, 10 tool(s)
ssh-client: ok, 8 tool(s), keeps ssh (valuable)
sshd: ok; WARNING: run stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
step-ca: ok, keeps home (valuable), ready: server by its image's own check every 30s
sudo: ok, 3 tool(s)
supabase: ok, keeps db (valuable), dumps (rebuildable), storage (valuable), functions (valuable), db-config (rebuildable), ready: db by its image's own check every 30s; kong by its image's own check every 30s; meta by its image's own check every 30s; studio by its image's own check every 30s; WARNING: vector, analytics, auth, rest, realtime, imgproxy, storage-api, edge-functions, pooler stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
systemd: ok, 1 tool(s)
systemd-networkd: ok
time-sync: ok, 3 tool(s); WARNING: daemon stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
triggerhappy: ok, 4 tool(s); WARNING: service stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
umami: ok; WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
unifi: ok, keeps data (valuable); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
website: ok, ready: server by http / on web every 30s
xclip: ok, 4 tool(s)
xdg: ok, 5 tool(s)
xorg: ok, 8 tool(s)
xterm: ok, 2 tool(s)
zsh: ok, 1 tool(s)
zsh-autosuggestions: ok
zsh-syntax-highlighting: ok
long-running resources without health: 70
```
mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: new:modules/systemd-resolved)
mesh/repo-check: PASS — its merge-check.sh passed
Delivery plan — builds new: modules/systemd-resolved, sent nowhere; no bus step
Run by the build seat on g14 as build-1791403382131653496 (builds --log build-1791403382131653496).
--- the gate: new:modules/systemd-resolved
systemd-resolved: ok, ready: service by unit every 30s; guard by unit every 30s
long-running resources without health: 0
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-07T19:57:57Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-07T19:57:57Z
modules the change moves:
- systemd-resolved (added)
machines:
- a machine (f35): composes
- holds mesh-dns-resolver (idt): composes
- holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
- a machine (yvbpsm): composes
a merge would rebuild 0 module(s) in 0 tier(s)
--- its merge-check.sh (go toolchain)
words: 12 retired words, none in the 27657 strings of 514 files
long-running resources without health: 70, as kept
testing modules/systemd-resolved
ok systemd-resolved/cmd/resolver-tools 1.041s
**Merge check** at `60641176`
- `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: new:modules/systemd-resolved)
- `mesh/repo-check`: **PASS** — its merge-check.sh passed
**Delivery plan** — builds new: modules/systemd-resolved, sent nowhere; no bus step
Run by the build seat on g14 as `build-1791403382131653496` (`builds --log build-1791403382131653496`).
```
--- the gate: new:modules/systemd-resolved
systemd-resolved: ok, ready: service by unit every 30s; guard by unit every 30s
long-running resources without health: 0
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-07T19:57:57Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-07T19:57:57Z
modules the change moves:
- systemd-resolved (added)
machines:
- a machine (f35): composes
- holds mesh-dns-resolver (idt): composes
- holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
- a machine (yvbpsm): composes
a merge would rebuild 0 module(s) in 0 tier(s)
--- its merge-check.sh (go toolchain)
words: 12 retired words, none in the 27657 strings of 514 files
long-running resources without health: 70, as kept
testing modules/systemd-resolved
ok systemd-resolved/cmd/resolver-tools 1.041s
```
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
hq ADR 0247, to-be 50 phase B. A new module, assigned nowhere by this PR.
node-resolverand providessplit-dnsat the machine's reach. Upgrade policyrecord, with a why./etc/resolv.conf: the machine's private address alone, with ADR 0223's options, beginning# Managed by the mesh;/etc/node-resolver/resolv.conf;Domains=~.,FallbackDNS=empty, stub on loopback and on the private address,Cache=no, no hosts file, no LLMNR, mDNS or DNSSEC.systemd-resolved.servicerunning, restarted on its drop-in, withunithealth. No package: resolved is systemd's (ADR 0207).resolver-tools guard, root,unithealth):/run/node-resolver;/run/node-resolver/verbs.sock(0600).routes,route,unroute, which escalate withsudo -nlike hostname's. They refuse the mesh's own domain and the root.The tests cover the routes, the refusals, escalation, the guard's take, hold, write-over and link cases, the socket, and the manifest held to the code.
merge-check.shpasses locally with the controller from mesh-controllerfeat/node-resolver-seatasMESH_GATE. The health-undeclared count stays at 70. The check is expected red until that controller runs on the mesh: today's controller refuses a claim tonode-resolver, a seat it does not define.Delivery
novox/mesh-catalog@60641176abaf— stopped since 2026-10-08T23:33:03ZDelivery plan — builds new: modules/systemd-resolved, sent nowhere; no bus step
Transitions
3da80a4b50adds a new module sent nowhere (plan moves no module) and is contained ina1406e7d79which is delivered (walk plan-1791501183606479074); closed on the operator's word 2026-10-09; the held state came from no walk being opened for it — see hq issue to followThe commit's note under
refs/notes/mesh-plankeeps every transition:git log --notes=mesh-plan.Merge check at
d5357121mesh/merge-gate: FAIL — a manifest the change touches fails the module check: modules/systemd-resolved/module.json: this manifest cannot be used: (modules: new:modules/systemd-resolved)mesh/repo-check: FAIL — its merge-check.sh failed: long-running resources without health: 70Delivery plan — builds new: modules/systemd-resolved, sent nowhere; no bus step
Run by the build seat on shanks as
build-1791401693639958173(builds --log build-1791401693639958173).Merge check at
60641176mesh/merge-gate: FAIL — a manifest the change touches fails the module check: modules/systemd-resolved/module.json: this manifest cannot be used: (modules: new:modules/systemd-resolved)mesh/repo-check: FAIL — its merge-check.sh failed: long-running resources without health: 70Delivery plan — builds new: modules/systemd-resolved, sent nowhere; no bus step
Run by the build seat on g14 as
build-1791401756536311140(builds --log build-1791401756536311140).Merge check at
60641176mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: new:modules/systemd-resolved)mesh/repo-check: PASS — its merge-check.sh passedDelivery plan — builds new: modules/systemd-resolved, sent nowhere; no bus step
Run by the build seat on g14 as
build-1791403382131653496(builds --log build-1791403382131653496).