dnsmasq answers or is restarted, binds once; tools for DNS, sockets and the runtime's memory (hq issue 348) #161

2026-10-09T11:50:49Z

mesh-admin commented

2026-10-09 11:50:49 +00:00

hq issue 348 (a resolver that stopped answering ran on unnoticed, and builds sent after it were blamed).

dnsmasq

Ported to Go (its TypeScript tools were never served). A root process, the watch, asks the machine's own name on every listen address over UDP and TCP every 15 s; after two failing looks it restarts dnsmasq.service (at most every 2 min, 3 an hour) and the next looks say whether that helped. dnsmasq_health is the watch's declared check (ADR 0240): a restart that helped leaves the module healthy; one that did not becomes module.dnsmasq.<machine>.unhealthy saying so. The service gets health: unit. Emits restarted. Tools: dnsmasq_health, dnsmasq_names, dnsmasq_resolve.
bind-interfaces instead of bind-dynamic: dnsmasq 2.93 closes every listener when an address re-read fails during a bridge teardown (network.c:832-875); reproduced in a network namespace (53 closings in 120 teardowns). A drop-in makes the unit wait for the private address and retry.
Departs from ADR 0240 rule 6 (nothing restarts on health): a module-local repair like ADR 0224 §5. Needs the operator's word, or a healer record.
health-undeclared 70 → 69.

docker: docker_events says where the runtime's memory of events begins and says so when the window reaches past it (measured: ~256 events, filled by health checks within minutes); new docker_resolv_conf reads a container's resolver file as it sees it.

netcheck: netcheck_dns can ask one named resolver (server, tcp); new netcheck_listening (replaces ss -lunt). netcheck is assigned only on ace and g14; assigning it on novox and shanks is the operator's.

Local merge-check.sh (MESH_GATE built from mesh-controller main + PR 179) passes: module check ok, count 69 as kept, dnsmasq/docker/netcheck tests ok.

Not merged; a person's approval decides.

hq issue 348 (a resolver that stopped answering ran on unnoticed, and builds sent after it were blamed). **dnsmasq** - Ported to Go (its TypeScript tools were never served). A root process, the watch, asks the machine's own name on every listen address over UDP and TCP every 15 s; after two failing looks it restarts `dnsmasq.service` (at most every 2 min, 3 an hour) and the next looks say whether that helped. `dnsmasq_health` is the watch's declared check (ADR 0240): a restart that helped leaves the module healthy; one that did not becomes `module.dnsmasq.<machine>.unhealthy` saying so. The service gets `health: unit`. Emits `restarted`. Tools: `dnsmasq_health`, `dnsmasq_names`, `dnsmasq_resolve`. - `bind-interfaces` instead of `bind-dynamic`: dnsmasq 2.93 closes every listener when an address re-read fails during a bridge teardown (network.c:832-875); reproduced in a network namespace (53 closings in 120 teardowns). A drop-in makes the unit wait for the private address and retry. - **Departs from ADR 0240 rule 6** (nothing restarts on health): a module-local repair like ADR 0224 §5. Needs the operator's word, or a healer record. - health-undeclared 70 → 69. **docker**: `docker_events` says where the runtime's memory of events begins and says so when the window reaches past it (measured: ~256 events, filled by health checks within minutes); new `docker_resolv_conf` reads a container's resolver file as it sees it. **netcheck**: `netcheck_dns` can ask one named resolver (`server`, `tcp`); new `netcheck_listening` (replaces `ss -lunt`). netcheck is assigned only on ace and g14; assigning it on novox and shanks is the operator's. Local `merge-check.sh` (MESH_GATE built from mesh-controller main + PR 179) passes: module check ok, count 69 as kept, dnsmasq/docker/netcheck tests ok. Not merged; a person's approval decides.

mesh-admin commented

2026-10-09 11:51:18 +00:00

Delivery novox/mesh-catalog@a10f1844f2cd — delivered since 2026-10-10T15:55:24Z

Delivery plan — builds dnsmasq, docker, netcheck → ace, g14, novox, shanks; no bus step; 2 wait(s) for a person

tier 0: dnsmasq, docker, netcheck
ace: receives docker, netcheck; waits for a person: dnsmasq
g14: receives docker, netcheck
novox: receives docker; waits for a person: dnsmasq
shanks: receives docker
dnsmasq waits for a person: its policy records (module)
dnsmasq provides wildcard-resolution: its consumers are sent again after it

Machines

docker on ace: passed — healthy 3 times over 2m36s
netcheck on ace: passed — judged with docker: healthy 3 times over 2m36s
docker on the rest running it: sent
netcheck on the rest running it: sent

Transitions

2026-10-10 15:46 (new) → proposed (announced): novox/mesh-catalog#161's head announced
2026-10-10 15:47 proposed → checked (checked): the verdict names this commit
2026-10-10 15:47 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
2026-10-10 15:50 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
2026-10-10 15:50 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
2026-10-10 15:55 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

**Delivery** `novox/mesh-catalog@a10f1844f2cd` — **delivered** since 2026-10-10T15:55:24Z **Delivery plan** — builds dnsmasq, docker, netcheck → ace, g14, novox, shanks; no bus step; 2 wait(s) for a person - tier 0: dnsmasq, docker, netcheck - ace: receives docker, netcheck; waits for a person: dnsmasq - g14: receives docker, netcheck - novox: receives docker; waits for a person: dnsmasq - shanks: receives docker - dnsmasq waits for a person: its policy records (module) - dnsmasq provides wildcard-resolution: its consumers are sent again after it **Machines** - docker on ace: passed — healthy 3 times over 2m36s - netcheck on ace: passed — judged with docker: healthy 3 times over 2m36s - docker on the rest running it: sent - netcheck on the rest running it: sent **Transitions** - 2026-10-10 15:46 (new) → proposed (announced): novox/mesh-catalog#161's head announced - 2026-10-10 15:47 proposed → checked (checked): the verdict names this commit - 2026-10-10 15:47 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-10 15:50 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-10 15:50 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit - 2026-10-10 15:55 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-admin commented

2026-10-09 11:56:13 +00:00

Merge check at 3e56fa51

mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: dnsmasq, docker, netcheck)
mesh/repo-check: PASS — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds dnsmasq, docker, netcheck → ace, g14, novox, shanks; no bus step; 2 wait(s) for a person

tier 0: dnsmasq, docker, netcheck
ace: receives docker, netcheck; waits for a person: dnsmasq
g14: receives docker, netcheck
novox: receives docker; waits for a person: dnsmasq
shanks: receives docker
dnsmasq waits for a person: its policy records (module)
dnsmasq provides wildcard-resolution: its consumers are sent again after it
read by no module's build: health-undeclared

Run by the build seat on novox as build-1791546669480758956 (builds --log build-1791546669480758956).

--- the gate: dnsmasq, docker, netcheck
dnsmasq: ok, 3 tool(s), ready: service by unit every 30s; watch by its tool dnsmasq_health every 20s
docker: ok, 22 tool(s), invokes seat:mesh-controller.images; WARNING: socket, runtime, prune stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
netcheck: ok, 4 tool(s)
long-running resources without health: 3
files asking for a setting without saying whether it is trusted: 0
3 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 3 module(s) changed against 4 machine(s), as the snapshot of 2026-10-09T11:44:53Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-09T11:44:53Z

modules the change moves:
  - dnsmasq (changed)
  - docker (changed)
  - netcheck (changed)

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes; the change adds 5 resource(s) and removes 0 (+archive:dnsmasq.bundle-tools, +directory:dnsmasq.drop-ins, +directory:dnsmasq.watch-dir, +file:dnsmasq.wait-for-address, +process:dnsmasq.watch)
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes; the change adds 5 resource(s) and removes 0 (+archive:dnsmasq.bundle-tools, +directory:dnsmasq.drop-ins, +directory:dnsmasq.watch-dir, +file:dnsmasq.wait-for-address, +process:dnsmasq.watch)
  - a machine (yvbpsm): composes

a merge would rebuild 3 module(s) in 1 tier(s): dnsmasq, docker, netcheck

notes:
  - health-undeclared read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.002s
words: 12 retired words, none in the 35275 strings of 615 files
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.006s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 69, as kept
testing modules/dnsmasq
ok  	dnsmasq/cmd/dnsmasq-tools	1.083s
testing modules/docker
ok  	docker/cmd/docker-tools	1.042s
testing modules/netcheck
ok  	netcheck/cmd/netcheck	1.031s
--- its merge-check-typescript.sh (typescript toolchain)
type-checking modules/netcheck (TypeScript)
testing modules/netcheck (TypeScript)
✔ only http and https URLs are checked (0.961251ms)
✔ only HEAD and GET are used (0.224461ms)
✔ a status, its headers and a redirect not followed (27.669515ms)
✔ a refused connection is a result with its error (4.740786ms)
ℹ tests 4
ℹ suites 0
ℹ pass 4
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 138.865021

**Merge check** at `3e56fa51` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: dnsmasq, docker, netcheck) - `mesh/repo-check`: **PASS** — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds dnsmasq, docker, netcheck → ace, g14, novox, shanks; no bus step; 2 wait(s) for a person - tier 0: dnsmasq, docker, netcheck - ace: receives docker, netcheck; waits for a person: dnsmasq - g14: receives docker, netcheck - novox: receives docker; waits for a person: dnsmasq - shanks: receives docker - dnsmasq waits for a person: its policy records (module) - dnsmasq provides wildcard-resolution: its consumers are sent again after it - read by no module's build: health-undeclared Run by the build seat on novox as `build-1791546669480758956` (`builds --log build-1791546669480758956`). ``` --- the gate: dnsmasq, docker, netcheck dnsmasq: ok, 3 tool(s), ready: service by unit every 30s; watch by its tool dnsmasq_health every 20s docker: ok, 22 tool(s), invokes seat:mesh-controller.images; WARNING: socket, runtime, prune stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8) netcheck: ok, 4 tool(s) long-running resources without health: 3 files asking for a setting without saying whether it is trusted: 0 3 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 3 module(s) changed against 4 machine(s), as the snapshot of 2026-10-09T11:44:53Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-09T11:44:53Z modules the change moves: - dnsmasq (changed) - docker (changed) - netcheck (changed) machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes; the change adds 5 resource(s) and removes 0 (+archive:dnsmasq.bundle-tools, +directory:dnsmasq.drop-ins, +directory:dnsmasq.watch-dir, +file:dnsmasq.wait-for-address, +process:dnsmasq.watch) - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes; the change adds 5 resource(s) and removes 0 (+archive:dnsmasq.bundle-tools, +directory:dnsmasq.drop-ins, +directory:dnsmasq.watch-dir, +file:dnsmasq.wait-for-address, +process:dnsmasq.watch) - a machine (yvbpsm): composes a merge would rebuild 3 module(s) in 1 tier(s): dnsmasq, docker, netcheck notes: - health-undeclared read by no module's build, and rebuild nothing (issue 280) --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.002s words: 12 retired words, none in the 35275 strings of 615 files ok git.novox.be/novox/mesh-catalog/checks/paths 0.006s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 69, as kept testing modules/dnsmasq ok dnsmasq/cmd/dnsmasq-tools 1.083s testing modules/docker ok docker/cmd/docker-tools 1.042s testing modules/netcheck ok netcheck/cmd/netcheck 1.031s --- its merge-check-typescript.sh (typescript toolchain) type-checking modules/netcheck (TypeScript) testing modules/netcheck (TypeScript) ✔ only http and https URLs are checked (0.961251ms) ✔ only HEAD and GET are used (0.224461ms) ✔ a status, its headers and a redirect not followed (27.669515ms) ✔ a refused connection is a result with its error (4.740786ms) ℹ tests 4 ℹ suites 0 ℹ pass 4 ℹ fail 0 ℹ cancelled 0 ℹ skipped 0 ℹ todo 0 ℹ duration_ms 138.865021 ```

jschoubben force-pushed fix/the-resolver-answers-or-is-restarted from 3e56fa51a2 to d372fc3265

2026-10-09 12:12:04 +00:00

Compare

mesh-admin commented

2026-10-09 12:14:29 +00:00

Merge check at d372fc32

mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: dnsmasq, docker, netcheck)
mesh/repo-check: PASS — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds dnsmasq, docker, netcheck → ace, g14, novox, shanks; no bus step; 2 wait(s) for a person

tier 0: dnsmasq, docker, netcheck
ace: receives docker, netcheck; waits for a person: dnsmasq
g14: receives docker, netcheck
novox: receives docker; waits for a person: dnsmasq
shanks: receives docker
dnsmasq waits for a person: its policy records (module)
dnsmasq provides wildcard-resolution: its consumers are sent again after it
read by no module's build: health-undeclared

Run by the build seat on shanks as build-1791547935964726662 (builds --log build-1791547935964726662).

--- the gate: dnsmasq, docker, netcheck
dnsmasq: ok, 3 tool(s), ready: service by unit every 30s; watch by its tool dnsmasq_health every 20s
docker: ok, 22 tool(s), invokes seat:mesh-controller.images; WARNING: socket, runtime, prune stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
netcheck: ok, 4 tool(s)
long-running resources without health: 3
files asking for a setting without saying whether it is trusted: 0
3 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 3 module(s) changed against 4 machine(s), as the snapshot of 2026-10-09T12:05:01Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-09T12:05:01Z

modules the change moves:
  - dnsmasq (changed)
  - docker (changed)
  - netcheck (changed)

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes; the change adds 5 resource(s) and removes 0 (+archive:dnsmasq.bundle-tools, +directory:dnsmasq.drop-ins, +directory:dnsmasq.watch-dir, +file:dnsmasq.wait-for-address, +process:dnsmasq.watch)
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes; the change adds 5 resource(s) and removes 0 (+archive:dnsmasq.bundle-tools, +directory:dnsmasq.drop-ins, +directory:dnsmasq.watch-dir, +file:dnsmasq.wait-for-address, +process:dnsmasq.watch)
  - a machine (yvbpsm): composes

a merge would rebuild 3 module(s) in 1 tier(s): dnsmasq, docker, netcheck

notes:
  - health-undeclared read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.002s
words: 12 retired words, none in the 35535 strings of 619 files
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.006s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 69, as kept
testing modules/dnsmasq
ok  	dnsmasq/cmd/dnsmasq-tools	1.024s
testing modules/docker
ok  	docker/cmd/docker-tools	1.041s
testing modules/netcheck
ok  	netcheck/cmd/netcheck	1.020s
--- its merge-check-typescript.sh (typescript toolchain)
type-checking modules/netcheck (TypeScript)
testing modules/netcheck (TypeScript)
✔ only http and https URLs are checked (0.914121ms)
✔ only HEAD and GET are used (0.239313ms)
✔ a status, its headers and a redirect not followed (25.080884ms)
✔ a refused connection is a result with its error (3.744256ms)
ℹ tests 4
ℹ suites 0
ℹ pass 4
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 133.568072

**Merge check** at `d372fc32` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: dnsmasq, docker, netcheck) - `mesh/repo-check`: **PASS** — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds dnsmasq, docker, netcheck → ace, g14, novox, shanks; no bus step; 2 wait(s) for a person - tier 0: dnsmasq, docker, netcheck - ace: receives docker, netcheck; waits for a person: dnsmasq - g14: receives docker, netcheck - novox: receives docker; waits for a person: dnsmasq - shanks: receives docker - dnsmasq waits for a person: its policy records (module) - dnsmasq provides wildcard-resolution: its consumers are sent again after it - read by no module's build: health-undeclared Run by the build seat on shanks as `build-1791547935964726662` (`builds --log build-1791547935964726662`). ``` --- the gate: dnsmasq, docker, netcheck dnsmasq: ok, 3 tool(s), ready: service by unit every 30s; watch by its tool dnsmasq_health every 20s docker: ok, 22 tool(s), invokes seat:mesh-controller.images; WARNING: socket, runtime, prune stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8) netcheck: ok, 4 tool(s) long-running resources without health: 3 files asking for a setting without saying whether it is trusted: 0 3 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 3 module(s) changed against 4 machine(s), as the snapshot of 2026-10-09T12:05:01Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-09T12:05:01Z modules the change moves: - dnsmasq (changed) - docker (changed) - netcheck (changed) machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes; the change adds 5 resource(s) and removes 0 (+archive:dnsmasq.bundle-tools, +directory:dnsmasq.drop-ins, +directory:dnsmasq.watch-dir, +file:dnsmasq.wait-for-address, +process:dnsmasq.watch) - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes; the change adds 5 resource(s) and removes 0 (+archive:dnsmasq.bundle-tools, +directory:dnsmasq.drop-ins, +directory:dnsmasq.watch-dir, +file:dnsmasq.wait-for-address, +process:dnsmasq.watch) - a machine (yvbpsm): composes a merge would rebuild 3 module(s) in 1 tier(s): dnsmasq, docker, netcheck notes: - health-undeclared read by no module's build, and rebuild nothing (issue 280) --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.002s words: 12 retired words, none in the 35535 strings of 619 files ok git.novox.be/novox/mesh-catalog/checks/paths 0.006s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 69, as kept testing modules/dnsmasq ok dnsmasq/cmd/dnsmasq-tools 1.024s testing modules/docker ok docker/cmd/docker-tools 1.041s testing modules/netcheck ok netcheck/cmd/netcheck 1.020s --- its merge-check-typescript.sh (typescript toolchain) type-checking modules/netcheck (TypeScript) testing modules/netcheck (TypeScript) ✔ only http and https URLs are checked (0.914121ms) ✔ only HEAD and GET are used (0.239313ms) ✔ a status, its headers and a redirect not followed (25.080884ms) ✔ a refused connection is a result with its error (3.744256ms) ℹ tests 4 ℹ suites 0 ℹ pass 4 ℹ fail 0 ℹ cancelled 0 ℹ skipped 0 ℹ todo 0 ℹ duration_ms 133.568072 ```

jschoubben added 5 commits 2026-10-09 13:04:59 +00:00

dnsmasq: ask the resolver a real question, and restart it when it stops answering (hq issue 348) 2b2397abe0

On 2026-10-09 the control node's dnsmasq stayed active and running, its
journal silent, and refused every question on its private address for
twenty minutes; nothing in the module looked past the unit.

The module is now Go (its TypeScript tools were never served): a root
watch asks the machine's own name on every listen address over UDP and
TCP every 15s, restarts the unit after two failing looks (2 min apart,
3 an hour), and says whether that helped. dnsmasq_health is the watch
process's declared check, so a restart that did not help becomes the
module's unhealthy condition; the service is judged by its unit.

docker: say where the runtime's event history begins, so a short history never reads as a quiet one (hq issue 348) 3d8b52c9f4

docker_events asked for three hours across the 2026-10-09 resolver outage on the control node answered
zero events: the runtime keeps only its last ~256 events in memory, and health-check execs filled them
with the last ten minutes. The answer now carries held, oldest_held and complete, and a history line
when the window reaches further back than what the runtime still holds. The type filter moves into the
tool, since the history's start is only known from all of it.

netcheck: ask one named resolver, and list what listens here (hq issue 348) 0f6986aead

During the 2026-10-09 outage the control node's resolver stayed active while it no longer listened on
its private address, and nothing on the mesh could ask that address a question or show which sockets
were bound. netcheck_dns takes server (and tcp) to ask one resolver alone and say its response code;
netcheck_listening reads the kernel's socket tables, as ss -lunt does, with the owning program where
the tool's account may see it and a sentence where it may not.

docker: read the resolver file a container really uses (hq issue 348) 12de28c81d

On 2026-10-09 the control node's route-proxy failed every lookup against 10.10.0.1 alone for twenty
minutes while the machine's file listed both mesh resolvers; its copy lives under the runtime's
root-only directory and no tool read it. docker_resolv_conf reads /etc/resolv.conf as the container
sees it through the runtime's archive (docker cp, no exec), parses it, and says whether it lists the
same resolvers as the machine.

dnsmasq: bind each address once, at start, after it exists (hq issue 348) a0049f3e4e

bind-dynamic closes every listener whose interface a re-read of the
machine's addresses did not find, and a re-read during a bridge teardown
fails (dnsmasq 2.93 network.c:832-875, reproduced in a network namespace:
53 releases in 120 parallel teardowns). bind-interfaces never closes a
listener; a drop-in makes the unit wait for the private address and retry
a start that found it missing.

jschoubben force-pushed fix/the-resolver-answers-or-is-restarted from d372fc3265 to 486fbd0ba4

2026-10-09 13:04:59 +00:00

Compare

mesh-admin commented

2026-10-09 13:07:32 +00:00

Merge check at 486fbd0b

mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: dnsmasq, docker, netcheck)
mesh/repo-check: PASS — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds dnsmasq, docker, netcheck → ace, g14, novox, shanks; no bus step; 2 wait(s) for a person

tier 0: dnsmasq, docker, netcheck
ace: receives docker, netcheck; waits for a person: dnsmasq
g14: receives docker, netcheck
novox: receives docker; waits for a person: dnsmasq
shanks: receives docker
dnsmasq waits for a person: its policy records (module)
dnsmasq provides wildcard-resolution: its consumers are sent again after it
read by no module's build: health-undeclared

Run by the build seat on novox as build-1791551101030808396 (builds --log build-1791551101030808396).

--- the gate: dnsmasq, docker, netcheck
dnsmasq: ok, 3 tool(s), ready: service by unit every 30s; watch by its tool dnsmasq_health every 20s
docker: ok, 22 tool(s), invokes seat:mesh-controller.images; WARNING: socket, runtime, prune stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
netcheck: ok, 4 tool(s)
long-running resources without health: 3
files asking for a setting without saying whether it is trusted: 0
3 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 3 module(s) changed against 4 machine(s), as the snapshot of 2026-10-09T13:02:20Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-09T13:02:20Z

modules the change moves:
  - dnsmasq (changed)
  - docker (changed)
  - netcheck (changed)

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes; the change adds 5 resource(s) and removes 0 (+archive:dnsmasq.bundle-tools, +directory:dnsmasq.drop-ins, +directory:dnsmasq.watch-dir, +file:dnsmasq.wait-for-address, +process:dnsmasq.watch)
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes; the change adds 5 resource(s) and removes 0 (+archive:dnsmasq.bundle-tools, +directory:dnsmasq.drop-ins, +directory:dnsmasq.watch-dir, +file:dnsmasq.wait-for-address, +process:dnsmasq.watch)
  - a machine (yvbpsm): composes

a merge would rebuild 3 module(s) in 1 tier(s): dnsmasq, docker, netcheck

notes:
  - health-undeclared read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.002s
words: 12 retired words, none in the 35685 strings of 620 files
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.007s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 69, as kept
testing modules/dnsmasq
ok  	dnsmasq/cmd/dnsmasq-tools	1.124s
testing modules/docker
ok  	docker/cmd/docker-tools	1.050s
testing modules/netcheck
ok  	netcheck/cmd/netcheck	1.028s
--- its merge-check-typescript.sh (typescript toolchain)
type-checking modules/netcheck (TypeScript)
testing modules/netcheck (TypeScript)
✔ only http and https URLs are checked (0.952302ms)
✔ only HEAD and GET are used (0.258341ms)
✔ a status, its headers and a redirect not followed (27.639888ms)
✔ a refused connection is a result with its error (4.354966ms)
ℹ tests 4
ℹ suites 0
ℹ pass 4
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 157.715758

**Merge check** at `486fbd0b` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: dnsmasq, docker, netcheck) - `mesh/repo-check`: **PASS** — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds dnsmasq, docker, netcheck → ace, g14, novox, shanks; no bus step; 2 wait(s) for a person - tier 0: dnsmasq, docker, netcheck - ace: receives docker, netcheck; waits for a person: dnsmasq - g14: receives docker, netcheck - novox: receives docker; waits for a person: dnsmasq - shanks: receives docker - dnsmasq waits for a person: its policy records (module) - dnsmasq provides wildcard-resolution: its consumers are sent again after it - read by no module's build: health-undeclared Run by the build seat on novox as `build-1791551101030808396` (`builds --log build-1791551101030808396`). ``` --- the gate: dnsmasq, docker, netcheck dnsmasq: ok, 3 tool(s), ready: service by unit every 30s; watch by its tool dnsmasq_health every 20s docker: ok, 22 tool(s), invokes seat:mesh-controller.images; WARNING: socket, runtime, prune stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8) netcheck: ok, 4 tool(s) long-running resources without health: 3 files asking for a setting without saying whether it is trusted: 0 3 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 3 module(s) changed against 4 machine(s), as the snapshot of 2026-10-09T13:02:20Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-09T13:02:20Z modules the change moves: - dnsmasq (changed) - docker (changed) - netcheck (changed) machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes; the change adds 5 resource(s) and removes 0 (+archive:dnsmasq.bundle-tools, +directory:dnsmasq.drop-ins, +directory:dnsmasq.watch-dir, +file:dnsmasq.wait-for-address, +process:dnsmasq.watch) - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes; the change adds 5 resource(s) and removes 0 (+archive:dnsmasq.bundle-tools, +directory:dnsmasq.drop-ins, +directory:dnsmasq.watch-dir, +file:dnsmasq.wait-for-address, +process:dnsmasq.watch) - a machine (yvbpsm): composes a merge would rebuild 3 module(s) in 1 tier(s): dnsmasq, docker, netcheck notes: - health-undeclared read by no module's build, and rebuild nothing (issue 280) --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.002s words: 12 retired words, none in the 35685 strings of 620 files ok git.novox.be/novox/mesh-catalog/checks/paths 0.007s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 69, as kept testing modules/dnsmasq ok dnsmasq/cmd/dnsmasq-tools 1.124s testing modules/docker ok docker/cmd/docker-tools 1.050s testing modules/netcheck ok netcheck/cmd/netcheck 1.028s --- its merge-check-typescript.sh (typescript toolchain) type-checking modules/netcheck (TypeScript) testing modules/netcheck (TypeScript) ✔ only http and https URLs are checked (0.952302ms) ✔ only HEAD and GET are used (0.258341ms) ✔ a status, its headers and a redirect not followed (27.639888ms) ✔ a refused connection is a result with its error (4.354966ms) ℹ tests 4 ℹ suites 0 ℹ pass 4 ℹ fail 0 ℹ cancelled 0 ℹ skipped 0 ℹ todo 0 ℹ duration_ms 157.715758 ```

jschoubben added 1 commit 2026-10-09 13:25:48 +00:00

Answer the review of hq issue 348's catalogue change

mesh/merge-gate pass: builds dnsmasq, docker, netcheck → ace, g14, novox, shanks; no bus step; 2 wait(s) for a person; every machine composes with the chan…

Details

mesh/repo-check pass: its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Details

mesh/delivery superseded: a newer head of the same pull request

Details

a6a9a818d2

- The dnsmasq watch restarts only a unit that runs, without waiting for
  its start; a unit stopped, starting or failed is held and said (C2).
- dnsmasq_resolve asks only an address the resolver listens on (C3).
- Tests for the watch loop keeping its budget, a watch that wrote nothing
  or stopped looking, and a unit not running (C4).
- A restart is remembered as said only once emitted, restarts made before
  the bundle started are said, and whether one helped is said (C5).
- docker_events reads the runtime's whole buffer: complete when it is not
  full or reaches past the window, never a quiet machine read as lost (C6).
- netcheck: refused read with errors.Is; tests for addresses and ports,
  and for a container named as docker knows it.

jschoubben force-pushed fix/the-resolver-answers-or-is-restarted from 486fbd0ba4 to a6a9a818d2

2026-10-09 13:25:48 +00:00

Compare

mesh-admin commented

2026-10-09 13:28:56 +00:00

Merge check at a6a9a818

mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: dnsmasq, docker, netcheck)
mesh/repo-check: PASS — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds dnsmasq, docker, netcheck → ace, g14, novox, shanks; no bus step; 2 wait(s) for a person

tier 0: dnsmasq, docker, netcheck
ace: receives docker, netcheck; waits for a person: dnsmasq
g14: receives docker, netcheck
novox: receives docker; waits for a person: dnsmasq
shanks: receives docker
dnsmasq waits for a person: its policy records (module)
dnsmasq provides wildcard-resolution: its consumers are sent again after it
read by no module's build: .gitignore, health-undeclared

Run by the build seat on novox as build-1791552386178608790 (builds --log build-1791552386178608790).

--- the gate: dnsmasq, docker, netcheck
dnsmasq: ok, 3 tool(s), ready: service by unit every 30s; watch by its tool dnsmasq_health every 20s
docker: ok, 22 tool(s), invokes seat:mesh-controller.images; WARNING: socket, runtime, prune stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
netcheck: ok, 4 tool(s)
long-running resources without health: 3
files asking for a setting without saying whether it is trusted: 0
3 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 3 module(s) changed against 4 machine(s), as the snapshot of 2026-10-09T13:02:20Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-09T13:02:20Z

modules the change moves:
  - dnsmasq (changed)
  - docker (changed)
  - netcheck (changed)

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes; the change adds 5 resource(s) and removes 0 (+archive:dnsmasq.bundle-tools, +directory:dnsmasq.drop-ins, +directory:dnsmasq.watch-dir, +file:dnsmasq.wait-for-address, +process:dnsmasq.watch)
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes; the change adds 5 resource(s) and removes 0 (+archive:dnsmasq.bundle-tools, +directory:dnsmasq.drop-ins, +directory:dnsmasq.watch-dir, +file:dnsmasq.wait-for-address, +process:dnsmasq.watch)
  - a machine (yvbpsm): composes

a merge would rebuild 3 module(s) in 1 tier(s): dnsmasq, docker, netcheck

notes:
  - .gitignore and health-undeclared read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.002s
words: 12 retired words, none in the 35685 strings of 620 files
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.007s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 69, as kept
testing modules/dnsmasq
ok  	dnsmasq/cmd/dnsmasq-tools	1.150s
testing modules/docker
ok  	docker/cmd/docker-tools	1.059s
testing modules/netcheck
ok  	netcheck/cmd/netcheck	1.028s
--- its merge-check-typescript.sh (typescript toolchain)
type-checking modules/netcheck (TypeScript)
testing modules/netcheck (TypeScript)
✔ only http and https URLs are checked (0.777302ms)
✔ only HEAD and GET are used (0.20906ms)
✔ a status, its headers and a redirect not followed (22.046904ms)
✔ a refused connection is a result with its error (3.964876ms)
ℹ tests 4
ℹ suites 0
ℹ pass 4
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 133.616302

**Merge check** at `a6a9a818` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: dnsmasq, docker, netcheck) - `mesh/repo-check`: **PASS** — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds dnsmasq, docker, netcheck → ace, g14, novox, shanks; no bus step; 2 wait(s) for a person - tier 0: dnsmasq, docker, netcheck - ace: receives docker, netcheck; waits for a person: dnsmasq - g14: receives docker, netcheck - novox: receives docker; waits for a person: dnsmasq - shanks: receives docker - dnsmasq waits for a person: its policy records (module) - dnsmasq provides wildcard-resolution: its consumers are sent again after it - read by no module's build: .gitignore, health-undeclared Run by the build seat on novox as `build-1791552386178608790` (`builds --log build-1791552386178608790`). ``` --- the gate: dnsmasq, docker, netcheck dnsmasq: ok, 3 tool(s), ready: service by unit every 30s; watch by its tool dnsmasq_health every 20s docker: ok, 22 tool(s), invokes seat:mesh-controller.images; WARNING: socket, runtime, prune stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8) netcheck: ok, 4 tool(s) long-running resources without health: 3 files asking for a setting without saying whether it is trusted: 0 3 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 3 module(s) changed against 4 machine(s), as the snapshot of 2026-10-09T13:02:20Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-09T13:02:20Z modules the change moves: - dnsmasq (changed) - docker (changed) - netcheck (changed) machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes; the change adds 5 resource(s) and removes 0 (+archive:dnsmasq.bundle-tools, +directory:dnsmasq.drop-ins, +directory:dnsmasq.watch-dir, +file:dnsmasq.wait-for-address, +process:dnsmasq.watch) - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes; the change adds 5 resource(s) and removes 0 (+archive:dnsmasq.bundle-tools, +directory:dnsmasq.drop-ins, +directory:dnsmasq.watch-dir, +file:dnsmasq.wait-for-address, +process:dnsmasq.watch) - a machine (yvbpsm): composes a merge would rebuild 3 module(s) in 1 tier(s): dnsmasq, docker, netcheck notes: - .gitignore and health-undeclared read by no module's build, and rebuild nothing (issue 280) --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.002s words: 12 retired words, none in the 35685 strings of 620 files ok git.novox.be/novox/mesh-catalog/checks/paths 0.007s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 69, as kept testing modules/dnsmasq ok dnsmasq/cmd/dnsmasq-tools 1.150s testing modules/docker ok docker/cmd/docker-tools 1.059s testing modules/netcheck ok netcheck/cmd/netcheck 1.028s --- its merge-check-typescript.sh (typescript toolchain) type-checking modules/netcheck (TypeScript) testing modules/netcheck (TypeScript) ✔ only http and https URLs are checked (0.777302ms) ✔ only HEAD and GET are used (0.20906ms) ✔ a status, its headers and a redirect not followed (22.046904ms) ✔ a refused connection is a result with its error (3.964876ms) ℹ tests 4 ℹ suites 0 ℹ pass 4 ℹ fail 0 ℹ cancelled 0 ℹ skipped 0 ℹ todo 0 ℹ duration_ms 133.616302 ```

jschoubben added 1 commit 2026-10-10 15:45:36 +00:00

Merge branch 'main' into fix/the-resolver-answers-or-is-restarted

mesh/merge-gate pass: builds dnsmasq, docker, netcheck → ace, g14, novox, shanks; no bus step; 2 wait(s) for a person; every machine composes with the chan…

Details

mesh/repo-check pass: its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Details

mesh/delivery delivered

Details

a10f1844f2

mesh-admin commented

2026-10-10 15:47:51 +00:00

Merge check at a10f1844

mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: dnsmasq, docker, netcheck)
mesh/repo-check: PASS — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds dnsmasq, docker, netcheck → ace, g14, novox, shanks; no bus step; 2 wait(s) for a person

tier 0: dnsmasq, docker, netcheck
ace: receives docker, netcheck; waits for a person: dnsmasq
g14: receives docker, netcheck
novox: receives docker; waits for a person: dnsmasq
shanks: receives docker
dnsmasq waits for a person: its policy records (module)
dnsmasq provides wildcard-resolution: its consumers are sent again after it
read by no module's build: .gitignore, health-undeclared

Run by the build seat on ace as build-1791647165417231416 (builds --log build-1791647165417231416).

--- the gate: dnsmasq, docker, netcheck
dnsmasq: ok, 3 tool(s), ready: service by unit every 30s; watch by its tool dnsmasq_health every 20s
docker: ok, 22 tool(s), invokes seat:mesh-controller.images; WARNING: socket, runtime, prune stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
netcheck: ok, 4 tool(s)
long-running resources without health: 3
files asking for a setting without saying whether it is trusted: 0
3 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 3 module(s) changed against 4 machine(s), as the snapshot of 2026-10-10T15:36:57Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-10T15:36:57Z

modules the change moves:
  - dnsmasq (changed)
  - docker (changed)
  - netcheck (changed)

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes; the change adds 5 resource(s) and removes 0 (+archive:dnsmasq.bundle-tools, +directory:dnsmasq.drop-ins, +directory:dnsmasq.watch-dir, +file:dnsmasq.wait-for-address, +process:dnsmasq.watch)
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes; the change adds 5 resource(s) and removes 0 (+archive:dnsmasq.bundle-tools, +directory:dnsmasq.drop-ins, +directory:dnsmasq.watch-dir, +file:dnsmasq.wait-for-address, +process:dnsmasq.watch)
  - a machine (yvbpsm): composes

a merge would rebuild 3 module(s) in 1 tier(s): dnsmasq, docker, netcheck

notes:
  - .gitignore and health-undeclared read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.002s
words: 12 retired words and 70 daemons' lines, none in the 38588 strings of 647 files
ok  	git.novox.be/novox/mesh-catalog/checks/agenthome	0.011s
agent-home: no archive and no file written into under the agent's home
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.005s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 69, as kept
testing modules/dnsmasq
ok  	dnsmasq/cmd/dnsmasq-tools	1.043s
testing modules/docker
ok  	docker/cmd/docker-tools	1.041s
testing modules/netcheck
ok  	netcheck/cmd/netcheck	1.047s
--- its merge-check-typescript.sh (typescript toolchain)
Unable to find image 'novox.internal:5100/mesh-tools/build@sha256:6af966c761db958a2f021d1cb4f4b65061016545b66f38245d189ae29a004edb' locally
novox.internal:5100/mesh-tools/build@sha256:6af966c761db958a2f021d1cb4f4b65061016545b66f38245d189ae29a004edb: Pulling from mesh-tools/build
501c3e032d32: Already exists
d456d1aa143e: Already exists
60f37e2c93ec: Already exists
e53f92c42dd6: Already exists
b571db164614: Already exists
3130c230dcec: Already exists
4198e49907ef: Already exists
487f65298731: Already exists
b7c34aa97486: Already exists
8a0200dee3b4: Pulling fs layer
1724f328ad6c: Pulling fs layer
ec17680e3745: Pulling fs layer
f40ed2016c96: Pulling fs layer
33683062e5fd: Pulling fs layer
f40ed2016c96: Waiting
33683062e5fd: Waiting
8a0200dee3b4: Download complete
f40ed2016c96: Verifying Checksum
f40ed2016c96: Download complete
8a0200dee3b4: Pull complete
1724f328ad6c: Verifying Checksum
1724f328ad6c: Download complete
ec17680e3745: Verifying Checksum
ec17680e3745: Download complete
1724f328ad6c: Pull complete
ec17680e3745: Pull complete
f40ed2016c96: Pull complete
33683062e5fd: Verifying Checksum
33683062e5fd: Download complete
33683062e5fd: Pull complete
Digest: sha256:6af966c761db958a2f021d1cb4f4b65061016545b66f38245d189ae29a004edb
Status: Downloaded newer image for novox.internal:5100/mesh-tools/build@sha256:6af966c761db958a2f021d1cb4f4b65061016545b66f38245d189ae29a004edb
type-checking modules/netcheck (TypeScript)
testing modules/netcheck (TypeScript)
✔ only http and https URLs are checked (0.877098ms)
✔ only HEAD and GET are used (0.187402ms)
✔ a status, its headers and a redirect not followed (21.913508ms)
✔ a refused connection is a result with its error (3.204621ms)
ℹ tests 4
ℹ suites 0
ℹ pass 4
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 116.603301

**Merge check** at `a10f1844` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: dnsmasq, docker, netcheck) - `mesh/repo-check`: **PASS** — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds dnsmasq, docker, netcheck → ace, g14, novox, shanks; no bus step; 2 wait(s) for a person - tier 0: dnsmasq, docker, netcheck - ace: receives docker, netcheck; waits for a person: dnsmasq - g14: receives docker, netcheck - novox: receives docker; waits for a person: dnsmasq - shanks: receives docker - dnsmasq waits for a person: its policy records (module) - dnsmasq provides wildcard-resolution: its consumers are sent again after it - read by no module's build: .gitignore, health-undeclared Run by the build seat on ace as `build-1791647165417231416` (`builds --log build-1791647165417231416`). ``` --- the gate: dnsmasq, docker, netcheck dnsmasq: ok, 3 tool(s), ready: service by unit every 30s; watch by its tool dnsmasq_health every 20s docker: ok, 22 tool(s), invokes seat:mesh-controller.images; WARNING: socket, runtime, prune stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8) netcheck: ok, 4 tool(s) long-running resources without health: 3 files asking for a setting without saying whether it is trusted: 0 3 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 3 module(s) changed against 4 machine(s), as the snapshot of 2026-10-10T15:36:57Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-10T15:36:57Z modules the change moves: - dnsmasq (changed) - docker (changed) - netcheck (changed) machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes; the change adds 5 resource(s) and removes 0 (+archive:dnsmasq.bundle-tools, +directory:dnsmasq.drop-ins, +directory:dnsmasq.watch-dir, +file:dnsmasq.wait-for-address, +process:dnsmasq.watch) - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes; the change adds 5 resource(s) and removes 0 (+archive:dnsmasq.bundle-tools, +directory:dnsmasq.drop-ins, +directory:dnsmasq.watch-dir, +file:dnsmasq.wait-for-address, +process:dnsmasq.watch) - a machine (yvbpsm): composes a merge would rebuild 3 module(s) in 1 tier(s): dnsmasq, docker, netcheck notes: - .gitignore and health-undeclared read by no module's build, and rebuild nothing (issue 280) --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.002s words: 12 retired words and 70 daemons' lines, none in the 38588 strings of 647 files ok git.novox.be/novox/mesh-catalog/checks/agenthome 0.011s agent-home: no archive and no file written into under the agent's home ok git.novox.be/novox/mesh-catalog/checks/paths 0.005s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 69, as kept testing modules/dnsmasq ok dnsmasq/cmd/dnsmasq-tools 1.043s testing modules/docker ok docker/cmd/docker-tools 1.041s testing modules/netcheck ok netcheck/cmd/netcheck 1.047s --- its merge-check-typescript.sh (typescript toolchain) Unable to find image 'novox.internal:5100/mesh-tools/build@sha256:6af966c761db958a2f021d1cb4f4b65061016545b66f38245d189ae29a004edb' locally novox.internal:5100/mesh-tools/build@sha256:6af966c761db958a2f021d1cb4f4b65061016545b66f38245d189ae29a004edb: Pulling from mesh-tools/build 501c3e032d32: Already exists d456d1aa143e: Already exists 60f37e2c93ec: Already exists e53f92c42dd6: Already exists b571db164614: Already exists 3130c230dcec: Already exists 4198e49907ef: Already exists 487f65298731: Already exists b7c34aa97486: Already exists 8a0200dee3b4: Pulling fs layer 1724f328ad6c: Pulling fs layer ec17680e3745: Pulling fs layer f40ed2016c96: Pulling fs layer 33683062e5fd: Pulling fs layer f40ed2016c96: Waiting 33683062e5fd: Waiting 8a0200dee3b4: Download complete f40ed2016c96: Verifying Checksum f40ed2016c96: Download complete 8a0200dee3b4: Pull complete 1724f328ad6c: Verifying Checksum 1724f328ad6c: Download complete ec17680e3745: Verifying Checksum ec17680e3745: Download complete 1724f328ad6c: Pull complete ec17680e3745: Pull complete f40ed2016c96: Pull complete 33683062e5fd: Verifying Checksum 33683062e5fd: Download complete 33683062e5fd: Pull complete Digest: sha256:6af966c761db958a2f021d1cb4f4b65061016545b66f38245d189ae29a004edb Status: Downloaded newer image for novox.internal:5100/mesh-tools/build@sha256:6af966c761db958a2f021d1cb4f4b65061016545b66f38245d189ae29a004edb type-checking modules/netcheck (TypeScript) testing modules/netcheck (TypeScript) ✔ only http and https URLs are checked (0.877098ms) ✔ only HEAD and GET are used (0.187402ms) ✔ a status, its headers and a redirect not followed (21.913508ms) ✔ a refused connection is a result with its error (3.204621ms) ℹ tests 4 ℹ suites 0 ℹ pass 4 ℹ fail 0 ℹ cancelled 0 ℹ skipped 0 ℹ todo 0 ℹ duration_ms 116.603301 ```

mesh-admin merged commit 105cc7c0de into main

2026-10-10 15:48:12 +00:00

mesh-admin deleted branch fix/the-resolver-answers-or-is-restarted

2026-10-10 15:48:13 +00:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#161