dbus: hold node-message-bus, and never restart the bus live (hq ADR 0215) #51

2026-10-05T09:51:07Z

mesh-admin commented

2026-10-05 09:51:07 +00:00

New module dbus, the first holder of the node seat node-message-bus (hq ADR 0215).

What it declares

claims node-message-bus (scope node), capabilities package-manager and service-manager
packages dbus, dbus-broker, dbus-broker-units. All four machines have them (dbus 1.16.2-1, dbus-broker 37-3), and no other module declares them.
service dbus-broker.service: state: running only. No boot, no restart-on, no reload-on.

Why no boot state. dbus.service is an alias, so the host cannot declare it enabled. dbus-broker.service reads disabled on three machines and enabled on one. At boot it is started through dbus.socket, which the dbus package links into sockets.target, and the alias link that dbus-broker-units ships in /usr/lib. Declaring it enabled would make the host write a new alias link into /etc on three running machines for no gain. ADR 0215 §1 says "running and enabled". On these machines it is enabled through the package, not through the unit file. This may deserve a progressive-insight note on the ADR.

Watcher (godbus, system bus, as the operator account). Emits bus.stalled (GetId takes more than 3 s, or the bus cannot be reached), bus.recovered, bus.restarted (bus id or driver pid changed within one boot), service.appeared / service.left (well-known names only, 10 s debounce, with pid, process and unit), and policy.denied (from the bus unit's journal, at most once per 5 min, with a count and up to 5 header-only examples). It never monitors and never publishes traffic. It reconnects when the bus goes away. Events queue in order while the mesh bus is unreachable, capped at 1000 with the oldest dropped first.

Tools: dbus_names, dbus_introspect (uses --auto-start=no and never returns property values), dbus_monitor (at most 15 s, headers only, system bus through sudo -n), dbus_check (shows when a reboot is due because the running bus is older than its package, missing SystemdService units, denials in the last hour, watcher state), dbus_health.

Tested: go vet, go test -race (fake bus: debounce, unique names ignored, stall and recovery, restart against a boot, queueing, denial rate limit, no traffic in any event body; parsing against recorded answers; manifest test). mctl module check modules/*: all 105 manifests pass. A read-only live test (MESH_LIVE=1) passed on the laptop.

Not merged, built or assigned.

New module `dbus`, the first holder of the node seat `node-message-bus` (hq ADR 0215). **What it declares** - claims `node-message-bus` (scope node), capabilities package-manager and service-manager - packages `dbus`, `dbus-broker`, `dbus-broker-units`. All four machines have them (dbus 1.16.2-1, dbus-broker 37-3), and no other module declares them. - service `dbus-broker.service`: `state: running` only. No `boot`, no `restart-on`, no `reload-on`. **Why no boot state.** `dbus.service` is an alias, so the host cannot declare it enabled. `dbus-broker.service` reads `disabled` on three machines and `enabled` on one. At boot it is started through `dbus.socket`, which the dbus package links into sockets.target, and the alias link that dbus-broker-units ships in /usr/lib. Declaring it enabled would make the host write a new alias link into /etc on three running machines for no gain. ADR 0215 §1 says "running and enabled". On these machines it is enabled through the package, not through the unit file. This may deserve a progressive-insight note on the ADR. **Watcher (godbus, system bus, as the operator account).** Emits `bus.stalled` (GetId takes more than 3 s, or the bus cannot be reached), `bus.recovered`, `bus.restarted` (bus id or driver pid changed within one boot), `service.appeared` / `service.left` (well-known names only, 10 s debounce, with pid, process and unit), and `policy.denied` (from the bus unit's journal, at most once per 5 min, with a count and up to 5 header-only examples). It never monitors and never publishes traffic. It reconnects when the bus goes away. Events queue in order while the mesh bus is unreachable, capped at 1000 with the oldest dropped first. **Tools:** `dbus_names`, `dbus_introspect` (uses --auto-start=no and never returns property values), `dbus_monitor` (at most 15 s, headers only, system bus through sudo -n), `dbus_check` (shows when a reboot is due because the running bus is older than its package, missing SystemdService units, denials in the last hour, watcher state), `dbus_health`. **Tested:** go vet, go test -race (fake bus: debounce, unique names ignored, stall and recovery, restart against a boot, queueing, denial rate limit, no traffic in any event body; parsing against recorded answers; manifest test). `mctl module check modules/*`: all 105 manifests pass. A read-only live test (MESH_LIVE=1) passed on the laptop. Not merged, built or assigned.

mesh-admin added 1 commit 2026-10-05 09:51:07 +00:00

dbus: hold node-message-bus, and never restart the bus live (hq ADR 0215) 7b5e1d3362

A live restart of the system bus during an upgrade hung every login on a
workstation until a reboot. The module owns the bus's packages, declares
the bus running with no restart or reload trigger, publishes only curated
events (health, services, denials; never traffic) and serves tools to look
at both buses.

mesh-admin merged commit 45f27eb300 into main

2026-10-05 09:52:33 +00:00

mesh-admin commented

2026-10-06 23:08:34 +00:00

Delivery novox/mesh-catalog@45f27eb30031 — held since 2026-10-06T23:05:28Z

Held for a person: merged without a passing check: only a person decides that it goes on — mesh-delivery.release with why lets it go on.

Delivery plan — builds dbus → ace, g14, novox, shanks; no bus step

tier 0: dbus
ace: receives dbus
g14: receives dbus
novox: receives dbus
shanks: receives dbus

Transitions

2026-10-06 23:05 (new) → proposed (announced): novox/mesh-catalog#51 merged; its head was not heard by this owner, so it is made from the forge's word
2026-10-06 23:05 proposed → held (merged-unchecked): merged without a passing check — a verdict known with it is taken first: only a person decides that it goes on

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

**Delivery** `novox/mesh-catalog@45f27eb30031` — **held** since 2026-10-06T23:05:28Z Held for a person: merged without a passing check: only a person decides that it goes on — `mesh-delivery.release` with why lets it go on. **Delivery plan** — builds dbus → ace, g14, novox, shanks; no bus step - tier 0: dbus - ace: receives dbus - g14: receives dbus - novox: receives dbus - shanks: receives dbus **Transitions** - 2026-10-06 23:05 (new) → proposed (announced): novox/mesh-catalog#51 merged; its head was not heard by this owner, so it is made from the forge's word - 2026-10-06 23:05 proposed → held (merged-unchecked): merged without a passing check — a verdict known with it is taken first: only a person decides that it goes on The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-tools referenced this pull request

2026-10-20 21:21:48 +00:00

The Go and the Node build modules, ssh-client on the SDK's key keeper, and gitea's read-only builder accounts (design 47 R4c-3) #389

mesh-tools referenced this pull request

2026-10-25 22:13:22 +00:00

Gate: a merge learnt seconds late moves the trunk; and a setting check-gates-merge so the merge check can stop gating (operator 2026-10-25 22:56) #483

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#51