Judge a leaf module on one healthy reading, a core module on three (hq issue 524)

ADR 0282 decided readings by class and ADR 0304 took a leaf module to
one, but the gate never learned it: every build, leaf or core, needed
three readings over at least two minutes, so a container module that
was healthy at once still waited about two and a half minutes on its
first machine. The number of readings and the settle time now follow
the module's class: three after two minutes for the controller's own
path and the resolver, one for every other module. Tests that judge a
gate's other rules keep leaf modules on three readings.

cmd/mesh-controller/gate.go

@@ -27,8 +27,10 @@ import (
 // **"Reported applied" is not enough.** ADR 0218 sent a module to one machine first and the rest once
 // that machine reported it applied. A build that applies and then does nothing, crashes, serves no
 // tools, or breaks the machine's word to the mesh passed that test. Now the first machine is judged by
-// the component's health — the core's health definitions, or a module's own — passing three times over
-// at least two minutes, within ten minutes of the apply. Only then are the rest sent.
+// the component's health — the core's health definitions, or a module's own — within ten minutes of the
+// apply: a core module passing three times over at least two minutes, a leaf module once, as soon as the
+// node-engine states it healthy (novox/hq ADR 0282 decision 4 as ADR 0304 decision 3 changed it). Only then
+// are the rest sent.
 //
 // **A failing gate stops the plan and puts the previous build back there.** The build is marked failed
 // at its gate — registration refuses it and nothing sends it again on its own — the module's registered
@@ -43,11 +45,38 @@ var (
 	gateSettle = 2 * time.Minute
 	// gateBound is how long after the apply the build may take to become healthy.
 	gateBound = 10 * time.Minute
-	// gatePasses is how many consecutive judgings must find it healthy, gateEvery apart at the least.
-	gatePasses = 3
-	gateEvery  = 40 * time.Second
+	// gatePasses is how many consecutive judgings must find a core module healthy, gateEvery apart at the
+	// least, after gateSettle. gateLeafPasses is a leaf module's: one, taken once the node-engine states every
+	// resource of it healthy by its own check, with no settle (novox/hq ADR 0282 decision 4 as ADR 0304
+	// decision 3 changed it, issue 524).
+	gatePasses      = 3
+	gateLeafPasses  = 1
+	gateLeafSettles = false
+	gateEvery       = 40 * time.Second
 )
 
+// coreModule is whether a module is judged as the core (novox/hq ADR 0282 decision 1): one on the controller's
+// own path, or one holding the mesh's resolver. Every other module is a leaf.
+func coreModule(module string, m catalogue.Manifest) bool {
+	if _, own := onTheControllersPath[module]; own {
+		return true
+	}
+	for _, c := range m.Claims {
+		if c.Name == resolverSeat {
+			return true
+		}
+	}
+	return coreComponent(module) != ""
+}
+
+// gateWants is how many passes a module needs, and whether it must stay healthy gateSettle first.
+func gateWants(module string, m catalogue.Manifest) (passes int, settles bool) {
+	if coreModule(module, m) {
+		return gatePasses, true
+	}
+	return gateLeafPasses, gateLeafSettles
+}
+
 // gateProbe is the registry's row for the gate's verdicts and the witnesses' rollbacks: its conditions
 // are raised by a plan as it judges, and kept or cleared by the probe on every run.
 const gateProbe = "DG"
@@ -608,8 +637,17 @@ func judgeMoves(ctx context.Context, open *stores, g *inventory.PlanGate, pairs
 		}
 	}
 	settled := now.Sub(*g.Since) >= gateSettle
+	// What the send needs is what its most demanding module needs: a send carrying a core module is judged
+	// as the core.
+	wants, settles := 0, false
+	for _, m := range modules {
+		p, s := gateWants(m, shelf[m])
+		wants, settles = max(wants, p), settles || s
+	}
+	g.Wants = wants
 	passedAlone := func(m string) bool {
-		return settled && reading[m] <= healthPerson && g.Healthy[m] >= gatePasses
+		p, s := gateWants(m, shelf[m])
+		return (settled || !s) && reading[m] <= healthPerson && g.Healthy[m] >= p
 	}
 	// fail decides the send failed: what passed on its own keeps its pass, everything else is put back.
 	fail := func(why string) {
@@ -657,7 +695,7 @@ func judgeMoves(ctx context.Context, open *stores, g *inventory.PlanGate, pairs
 		g.Passes++
 		g.LastPass, g.Last, g.Failing = &now, "", nil
 		g.Read(now, true, "")
-		if g.Passes >= gatePasses && settled {
+		if g.Passes >= wants && (settled || !settles) {
 			decide(g, inventory.GatePassed, fmt.Sprintf("healthy %d times over %s", g.Passes,
 				now.Sub(*g.Since).Round(time.Second))+waitsSaid(g.Waits), now)
 		}
@@ -1340,9 +1378,9 @@ func gateLine(g *inventory.PlanGate) string {
 	if g.Why != "" {
 		line += ": " + g.Why
 	} else if g.Last != "" {
-		line += fmt.Sprintf(" (%d of %d passes; wanting: %s)", g.Passes, gatePasses, g.Last)
+		line += fmt.Sprintf(" (%d of %d passes; wanting: %s)", g.Passes, gateWanted(g), g.Last)
 	} else if g.Verdict == "" {
-		line += fmt.Sprintf(" (%d of %d passes)", g.Passes, gatePasses)
+		line += fmt.Sprintf(" (%d of %d passes)", g.Passes, gateWanted(g))
 	}
 	if g.Verdict == "" && len(g.Waits) > 0 {
 		line += waitsSaid(g.Waits)
@@ -1385,3 +1423,11 @@ func witnessObservation(node string, r lease.Rollback) conditions.Observation {
 		Summary: fmt.Sprintf("the witness on %s judged the %s %s not healthy %s at %s: %s", node, r.Component,
 			short(r.From), what, r.At.UTC().Format(time.RFC3339), r.Why)}
 }
+
+// gateWanted is the passes a gate's send needs, three where the gate was judged before it was said.
+func gateWanted(g *inventory.PlanGate) int {
+	if g.Wants > 0 {
+		return g.Wants
+	}
+	return gatePasses
+}