mailu records rather than rolls out: people's mail, whose containers are recreated together (hq issue 295, ADR 0242) #106

2026-10-07T17:28:13Z

mesh-admin commented

2026-10-07 17:28:13 +00:00

Why

On 2026-10-07, #104 adopted the images' own health checks. The plan's gated send to the control node recreated nine of mail's containers at once, with no new image, only a changed declaration. The operator's phone could not reach the mail, and mailu ... smtp not running was raised and then cleared. A module that people use directly should be moved at a moment a person chooses.

What

mailu declares upgrade: record and says why. Its new builds are registered and wait for push <node>, as postgres and mongodb already do.

Merge order: this policy only holds once novox/mesh-controller#115 is live. Merge #115 first.

The manifest's resources do not change, so merging this recreates nothing.

hq: issue 295, ADR 0242.

## Why On 2026-10-07, #104 adopted the images' own health checks. The plan's gated send to the control node recreated nine of mail's containers at once, with no new image, only a changed declaration. The operator's phone could not reach the mail, and `mailu ... smtp not running` was raised and then cleared. A module that people use directly should be moved at a moment a person chooses. ## What mailu declares `upgrade: record` and says why. Its new builds are registered and wait for `push <node>`, as postgres and mongodb already do. **Merge order:** this policy only holds once novox/mesh-controller#115 is live. Merge #115 first. The manifest's resources do not change, so merging this recreates nothing. hq: issue 295, ADR 0242.

mesh-admin added 1 commit 2026-10-07 17:28:13 +00:00

Hold mail's builds for a person: a change to how its containers are declared takes everyone's mail down at once (hq issue 294, ADR 0242)

mesh/merge-gate pass: builds mailu → novox; no bus step; every machine composes with the change as it did without (4 of 4 compose)

Details

mesh/repo-check pass: its merge-check.sh passed

Details

mesh/delivery superseded: a newer head of the same pull request

Details

05278d1aa0

On 2026-10-07 adopting its images' health checks recreated nine of mail's
containers in one send and the operator's phone could not reach the mail.
A module people use directly is moved at a moment a person chooses.

mesh-admin commented

2026-10-07 17:28:35 +00:00

Delivery novox/mesh-catalog@8150f38bfd15 — delivered since 2026-10-07T18:15:49Z

Delivery plan — builds mailu → novox; no bus step

tier 0: mailu
novox: receives mailu
mailu provides smtp: its consumers are sent again after it
mailu keeps data (ADR 0233): what it holds is backed up before it moves

Transitions

2026-10-07 17:39 (new) → proposed (announced): novox/mesh-catalog#106's head announced
2026-10-07 17:40 proposed → checked (checked): the verdict names this commit
2026-10-07 17:40 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
2026-10-07 18:13 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
2026-10-07 18:14 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path
2026-10-07 18:15 delivering → delivered (done): its walk is done: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

**Delivery** `novox/mesh-catalog@8150f38bfd15` — **delivered** since 2026-10-07T18:15:49Z **Delivery plan** — builds mailu → novox; no bus step - tier 0: mailu - novox: receives mailu - mailu provides smtp: its consumers are sent again after it - mailu keeps data (ADR 0233): what it holds is backed up before it moves **Transitions** - 2026-10-07 17:39 (new) → proposed (announced): novox/mesh-catalog#106's head announced - 2026-10-07 17:40 proposed → checked (checked): the verdict names this commit - 2026-10-07 17:40 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-07 18:13 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-07 18:14 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path - 2026-10-07 18:15 delivering → delivered (done): its walk is done: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-admin commented

2026-10-07 17:31:30 +00:00

Merge check at 05278d1a

mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mailu)
mesh/repo-check: PASS — its merge-check.sh passed

Change plan — builds mailu → novox; no bus step

tier 0: mailu
novox: receives mailu
mailu provides smtp: its consumers are sent again after it
mailu keeps data (ADR 0233): what it holds is backed up before it moves

Run by the build seat on novox as build-1791394105798408982 (builds --log build-1791394105798408982).

--- the gate: mailu
mailu: ok, keeps mail (valuable), dkim (valuable), data (valuable), dav (valuable), webmail (valuable), queue (valuable), filter (rebuildable), certs (rebuildable), automx (rebuildable), fetchmail (rebuildable), clamav (cache), redis (cache), ready: resolver by its image's own check every 30s; admin by its image's own check every 30s; imap by its image's own check every 30s; smtp by its image's own check every 30s; antispam by its image's own check every 30s; webmail by its image's own check every 30s; webdav by its image's own check every 30s; fetchmail by its image's own check every 30s; front by its image's own check every 30s; WARNING: redis, antivirus, automx stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
long-running resources without health: 3
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-07T17:23:39Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-07T17:23:39Z

modules the change moves:
  - mailu (changed)

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 1 module(s) in 1 tier(s): mailu
--- its merge-check.sh (go toolchain)
long-running resources without health: 70, as kept
NOT TESTED HERE: modules/mailu is TypeScript; the gate judges its manifest

**Merge check** at `05278d1a` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: mailu) - `mesh/repo-check`: **PASS** — its merge-check.sh passed **Change plan** — builds mailu → novox; no bus step - tier 0: mailu - novox: receives mailu - mailu provides smtp: its consumers are sent again after it - mailu keeps data (ADR 0233): what it holds is backed up before it moves Run by the build seat on novox as `build-1791394105798408982` (`builds --log build-1791394105798408982`). ``` --- the gate: mailu mailu: ok, keeps mail (valuable), dkim (valuable), data (valuable), dav (valuable), webmail (valuable), queue (valuable), filter (rebuildable), certs (rebuildable), automx (rebuildable), fetchmail (rebuildable), clamav (cache), redis (cache), ready: resolver by its image's own check every 30s; admin by its image's own check every 30s; imap by its image's own check every 30s; smtp by its image's own check every 30s; antispam by its image's own check every 30s; webmail by its image's own check every 30s; webdav by its image's own check every 30s; fetchmail by its image's own check every 30s; front by its image's own check every 30s; WARNING: redis, antivirus, automx stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8) long-running resources without health: 3 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-07T17:23:39Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-07T17:23:39Z modules the change moves: - mailu (changed) machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 1 module(s) in 1 tier(s): mailu --- its merge-check.sh (go toolchain) long-running resources without health: 70, as kept NOT TESTED HERE: modules/mailu is TypeScript; the gate judges its manifest ```

jschoubben added 1 commit 2026-10-07 17:38:46 +00:00

Name the hq issue by its number: 294 was taken on an open branch, this is 295

mesh/merge-gate pass: builds mailu → novox; no bus step; every machine composes with the change as it did without (4 of 4 compose)

Details

mesh/repo-check pass: its merge-check.sh passed

Details

mesh/delivery delivered

Details

8150f38bfd

mesh-admin referenced this pull request from novox/hq

2026-10-07 17:40:29 +00:00

Issue 295 and ADR 0242 (proposed): a recorded build moves only by a person's push, and a send says what it recreates #171

mesh-admin commented

2026-10-07 17:40:57 +00:00

Merge check at 8150f38b

mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mailu)
mesh/repo-check: PASS — its merge-check.sh passed

Change plan — builds mailu → novox; no bus step

tier 0: mailu
novox: receives mailu
mailu provides smtp: its consumers are sent again after it
mailu keeps data (ADR 0233): what it holds is backed up before it moves

Run by the build seat on shanks as build-1791394745263382111 (builds --log build-1791394745263382111).

--- the gate: mailu
mailu: ok, keeps mail (valuable), dkim (valuable), data (valuable), dav (valuable), webmail (valuable), queue (valuable), filter (rebuildable), certs (rebuildable), automx (rebuildable), fetchmail (rebuildable), clamav (cache), redis (cache), ready: resolver by its image's own check every 30s; admin by its image's own check every 30s; imap by its image's own check every 30s; smtp by its image's own check every 30s; antispam by its image's own check every 30s; webmail by its image's own check every 30s; webdav by its image's own check every 30s; fetchmail by its image's own check every 30s; front by its image's own check every 30s; WARNING: redis, antivirus, automx stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
long-running resources without health: 3
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-07T17:23:39Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-07T17:23:39Z

modules the change moves:
  - mailu (changed)

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 1 module(s) in 1 tier(s): mailu
--- its merge-check.sh (go toolchain)
long-running resources without health: 70, as kept
NOT TESTED HERE: modules/mailu is TypeScript; the gate judges its manifest

**Merge check** at `8150f38b` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: mailu) - `mesh/repo-check`: **PASS** — its merge-check.sh passed **Change plan** — builds mailu → novox; no bus step - tier 0: mailu - novox: receives mailu - mailu provides smtp: its consumers are sent again after it - mailu keeps data (ADR 0233): what it holds is backed up before it moves Run by the build seat on shanks as `build-1791394745263382111` (`builds --log build-1791394745263382111`). ``` --- the gate: mailu mailu: ok, keeps mail (valuable), dkim (valuable), data (valuable), dav (valuable), webmail (valuable), queue (valuable), filter (rebuildable), certs (rebuildable), automx (rebuildable), fetchmail (rebuildable), clamav (cache), redis (cache), ready: resolver by its image's own check every 30s; admin by its image's own check every 30s; imap by its image's own check every 30s; smtp by its image's own check every 30s; antispam by its image's own check every 30s; webmail by its image's own check every 30s; webdav by its image's own check every 30s; fetchmail by its image's own check every 30s; front by its image's own check every 30s; WARNING: redis, antivirus, automx stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8) long-running resources without health: 3 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-07T17:23:39Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-07T17:23:39Z modules the change moves: - mailu (changed) machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 1 module(s) in 1 tier(s): mailu --- its merge-check.sh (go toolchain) long-running resources without health: 70, as kept NOT TESTED HERE: modules/mailu is TypeScript; the gate judges its manifest ```

mesh-admin changed title from ~~mailu: record — a change that recreates its containers waits for a person (hq issue 294, ADR 0242)~~ to mailu records rather than rolls out: people's mail, whose containers are recreated together (hq issue 295, ADR 0242)

2026-10-07 17:56:56 +00:00

mesh-admin merged commit 1ab84e69f2 into main

2026-10-07 18:13:21 +00:00

mesh-admin deleted branch fix/mail-waits-for-a-person

2026-10-07 18:13:21 +00:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#106