Fixes the default half of hq issue 856, as ADR 0381 decides (the operator, 2026-10-15: every node set up and running consistently). Huge pages had reached only the control node: the module defaulted to the kernel's boot value (always), and the workstation still wrote 31 MB/s of journal.
modules/kernel: transparent-huge-pages defaults to madvise, its why citing ADR 0381; README; the manifest test asserts the new default (renamed). The module still writes only /sys/kernel/mm/transparent_hugepage/enabled and its own state: no modules-load, modprobe, kernel package, microcode or boot entries (ADR 0381 §2).
A node with no setting of its own moves from always to madvise and rotates the journal once (ADR 0369 §5, tested); a node already set to madvise (the control node) sees no change.
The module is assigned to every node by the mesh's assign verb (done 2026-10-15 for the other three); holding a module on every node by itself, a new node included, is issue 623.
Playbook 08. go vet, gofmt, go test, MESH_CHECK_MODULES=kernel merge-check.sh pass. Reviewed independently before push: APPROVE at b1b5801; the head adds only the stale test's new name.
Fixes the default half of hq issue 856, as ADR 0381 decides (the operator, 2026-10-15: every node set up and running consistently). Huge pages had reached only the control node: the module defaulted to the kernel's boot value (`always`), and the workstation still wrote 31 MB/s of journal.
- modules/kernel: `transparent-huge-pages` defaults to `madvise`, its `why` citing ADR 0381; README; the manifest test asserts the new default (renamed). The module still writes only `/sys/kernel/mm/transparent_hugepage/enabled` and its own state: no modules-load, modprobe, kernel package, microcode or boot entries (ADR 0381 §2).
- A node with no setting of its own moves from always to madvise and rotates the journal once (ADR 0369 §5, tested); a node already set to madvise (the control node) sees no change.
- The module is assigned to every node by the mesh's assign verb (done 2026-10-15 for the other three); holding a module on every node by itself, a new node included, is issue 623.
Playbook 08. go vet, gofmt, go test, MESH_CHECK_MODULES=kernel merge-check.sh pass. Reviewed independently before push: APPROVE at b1b5801; the head adds only the stale test's new name.
mesh/merge-gate head c816cafc00bd merged into trunk de6657c846b9 — pass: builds kernel → ace, g14, novox, shanks; no bus step; every machine composes with …
mesh/repo-check head c816cafc00bd merged into trunk de6657c846b9 — pass: its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-…
Deliverynovox/mesh-catalog@c816cafc00bd — delivered since 2026-10-15T20:50:31Z
Delivery plan — builds kernel → ace, g14, novox, shanks; no bus step
tier 0: kernel
ace: receives kernel
g14: receives kernel
novox: receives kernel
shanks: receives kernel
grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before kernel is judged on its first machine
Machines
kernel on every machine running it: sent
Transitions
2026-10-15 20:45 (new) → proposed (announced): novox/mesh-catalog#321's head announced
2026-10-15 20:47 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
2026-10-15 20:47 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
2026-10-15 20:47 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
2026-10-15 20:48 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
2026-10-15 20:50 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says
The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.
<!-- mesh-delivery:view -->
**Delivery** `novox/mesh-catalog@c816cafc00bd` — **delivered** since 2026-10-15T20:50:31Z
**Delivery plan** — builds kernel → ace, g14, novox, shanks; no bus step
- tier 0: kernel
- ace: receives kernel
- g14: receives kernel
- novox: receives kernel
- shanks: receives kernel
- grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before kernel is judged on its first machine
**Machines**
- kernel on every machine running it: sent
**Transitions**
- 2026-10-15 20:45 (new) → proposed (announced): novox/mesh-catalog#321's head announced
- 2026-10-15 20:47 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
- 2026-10-15 20:47 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
- 2026-10-15 20:47 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
- 2026-10-15 20:48 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
- 2026-10-15 20:50 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says
The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.
ready at c816cafc00 (the operator's word, 2026-10-15; independent review APPROVE at b1b5801, the head adds only a test's new name).
ready at c816cafc00bd498ce57484659252cfab3803eeae (the operator's word, 2026-10-15; independent review APPROVE at b1b5801, the head adds only a test's new name).
Merge check at c816cafc
Judged: head c816cafc00bd merged into trunk de6657c846b9; read beside it: mesh-controller 7543f64911c5, mesh-controller-main 7543f64911c5, mesh-host 198fd34ec497, mesh-tools 6b3e15042fee
mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: kernel)
mesh/repo-check: PASS — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)
Delivery plan — builds kernel → ace, g14, novox, shanks; no bus step
tier 0: kernel
ace: receives kernel
g14: receives kernel
novox: receives kernel
shanks: receives kernel
grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before kernel is judged on its first machine
read by no module's build: modules/kernel/README.md, modules/kernel/cmd/kernel-tools/manifest_test.go
Run by the build seat on shanks as build-1792097125858047052 (builds --log build-1792097125858047052).
--- the gate: kernel
kernel: ok, 1 tool(s), ready: apply by unit every 30s
long-running resources without health: 0
files asking for a setting without saying whether it is trusted: 0
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-15T20:37:28Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-15T20:37:28Z
modules the change moves:
- kernel (changed)
machines:
- a machine (f35): composes
- holds mesh-dns-resolver (idt): composes
- holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
- a machine (yvbpsm): composes
a merge would rebuild 1 module(s) in 1 tier(s): kernel
notes:
- modules/kernel/README.md and modules/kernel/cmd/kernel-tools/manifest_test.go read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok git.novox.be/novox/mesh-catalog/checks/words 0.003s
words: 12 retired words and 70 daemons' lines, none in the 48734 strings of 746 files
ok git.novox.be/novox/mesh-catalog/checks/agenthome 0.013s
agent-home: no archive and no file written into under the agent's home
ok git.novox.be/novox/mesh-catalog/checks/mailstore 0.010s
mail-store: claimed only by mesh-mail
ok git.novox.be/novox/mesh-catalog/checks/secrets 0.012s
secrets: no setting can replace a vault secret in a mergeable file (1 known, nested)
ok git.novox.be/novox/mesh-catalog/checks/paths 0.006s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 62, as kept
ok git.novox.be/novox/mesh-catalog/checks/deps 0.205s
testing modules/kernel
ok kernel/cmd/kernel-tools 1.056s
--- its merge-check-typescript.sh (typescript toolchain)
**Merge check** at `c816cafc`
Judged: head `c816cafc00bd` merged into trunk `de6657c846b9`; read beside it: mesh-controller `7543f64911c5`, mesh-controller-main `7543f64911c5`, mesh-host `198fd34ec497`, mesh-tools `6b3e15042fee`
- `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: kernel)
- `mesh/repo-check`: **PASS** — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)
**Delivery plan** — builds kernel → ace, g14, novox, shanks; no bus step
- tier 0: kernel
- ace: receives kernel
- g14: receives kernel
- novox: receives kernel
- shanks: receives kernel
- grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before kernel is judged on its first machine
- read by no module's build: modules/kernel/README.md, modules/kernel/cmd/kernel-tools/manifest_test.go
Run by the build seat on shanks as `build-1792097125858047052` (`builds --log build-1792097125858047052`).
```
--- the gate: kernel
kernel: ok, 1 tool(s), ready: apply by unit every 30s
long-running resources without health: 0
files asking for a setting without saying whether it is trusted: 0
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-15T20:37:28Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-15T20:37:28Z
modules the change moves:
- kernel (changed)
machines:
- a machine (f35): composes
- holds mesh-dns-resolver (idt): composes
- holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
- a machine (yvbpsm): composes
a merge would rebuild 1 module(s) in 1 tier(s): kernel
notes:
- modules/kernel/README.md and modules/kernel/cmd/kernel-tools/manifest_test.go read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok git.novox.be/novox/mesh-catalog/checks/words 0.003s
words: 12 retired words and 70 daemons' lines, none in the 48734 strings of 746 files
ok git.novox.be/novox/mesh-catalog/checks/agenthome 0.013s
agent-home: no archive and no file written into under the agent's home
ok git.novox.be/novox/mesh-catalog/checks/mailstore 0.010s
mail-store: claimed only by mesh-mail
ok git.novox.be/novox/mesh-catalog/checks/secrets 0.012s
secrets: no setting can replace a vault secret in a mergeable file (1 known, nested)
ok git.novox.be/novox/mesh-catalog/checks/paths 0.006s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 62, as kept
ok git.novox.be/novox/mesh-catalog/checks/deps 0.205s
testing modules/kernel
ok kernel/cmd/kernel-tools 1.056s
--- its merge-check-typescript.sh (typescript toolchain)
```
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Fixes the default half of hq issue 856, as ADR 0381 decides (the operator, 2026-10-15: every node set up and running consistently). Huge pages had reached only the control node: the module defaulted to the kernel's boot value (
always), and the workstation still wrote 31 MB/s of journal.transparent-huge-pagesdefaults tomadvise, itswhyciting ADR 0381; README; the manifest test asserts the new default (renamed). The module still writes only/sys/kernel/mm/transparent_hugepage/enabledand its own state: no modules-load, modprobe, kernel package, microcode or boot entries (ADR 0381 §2).Playbook 08. go vet, gofmt, go test, MESH_CHECK_MODULES=kernel merge-check.sh pass. Reviewed independently before push: APPROVE at b1b5801; the head adds only the stale test's new name.
Delivery
novox/mesh-catalog@c816cafc00bd— delivered since 2026-10-15T20:50:31ZDelivery plan — builds kernel → ace, g14, novox, shanks; no bus step
Machines
Transitions
The commit's note under
refs/notes/mesh-plankeeps every transition:git log --notes=mesh-plan.ready at
c816cafc00(the operator's word, 2026-10-15; independent review APPROVE at b1b5801, the head adds only a test's new name).Merge check at
c816cafcJudged: head
c816cafc00bdmerged into trunkde6657c846b9; read beside it: mesh-controller7543f64911c5, mesh-controller-main7543f64911c5, mesh-host198fd34ec497, mesh-tools6b3e15042feemesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: kernel)mesh/repo-check: PASS — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)Delivery plan — builds kernel → ace, g14, novox, shanks; no bus step
Run by the build seat on shanks as
build-1792097125858047052(builds --log build-1792097125858047052).