9 Commits

Include renames

Author	SHA1	Message	Date
jochen	1991fe931b	mesh-controller.try fault A: decide drop-only dead letters by a module's own retention: work-queue, not by the bus's work-queue retention alone (issue 1178) ... sourceAge keyed AgainTo's clause-6 refusal on the stream's bus retention policy, which SEAT_* and other mesh-internal work queues share without being one of ADR 0436 §6's module streams — so every seat's ask, once given up on, was refused delivery again. Added a dedicated metadata key (WorkQueueMetadata), set only by ModuleStream.Stream() when the catalogue declared retention: work-queue, and read sourceAge from that instead of the stream's retention policy. New test proves a seat's own work queue carries neither that metadata nor the restricted one.	2026-10-19 03:35:51 +02:00
jochen	f6a48ac5ef	Let module issue mint and deliver a bus process's account (issue 1181)	2026-10-19 02:55:29 +02:00
jochen	de651e0fd1	Give a work-queue stream its one consumer, drop-only dead letters (issue 1178)	2026-10-19 02:33:22 +02:00
jochen	a069898c0c	Let a module stream declare work-queue retention (issue 1177)	2026-10-19 02:11:05 +02:00
jochen	d03e24f423	Age a restricted stream's dead letters out with it and never show their body (issue 728) ... DEAD_LETTERS kept a message given up on MAIL forever and showed it whole to any caller of dead-letters, outside the grant and past MAIL's week. Per ADR 0376 §3-§6: the kept copy carries a per-message time to live of what is left of its stream's age (a copy already past it is kept without its body), DEAD_LETTERS and EVENTS allow per-message TTL, the list and show give no body or own headers for it, delivering it again needs a minute left and the copy keeps the time left, and its max-deliveries condition clears saying how many aged out undelivered and from which stream.	2026-10-15 14:11:37 +02:00
jochen	f75cd0239d	Hear a restricted stream only from a module's own account, never the tool runner's (issue 727) ... The tool runner's bus account carried the heard grants, consumer and bind word of every module it runs, and every agent session on that machine reaches the bus as that account, so any session could pull a granted module's consumer on MAIL. Per ADR 0376 §1 the controller now composes a restricted stream's consumer, grants and bind word only for a module that declares runs-as; registration refuses a consumes of a restricted stream without runs-as (§2), and a grant that composes nothing is said in doctor (D-heard) and in the controller's log on every raise and send.	2026-10-15 14:11:37 +02:00
jochen	743e6478a7	Remove a restricted stream's consumer when the bus refuses to narrow it, so its wider filters deliver nothing more (ADR 0363 §6, review of PR 338)	2026-10-14 22:05:47 +02:00
jochen	ede2772b3c	Deliver a module stream's given-up message again only while its consumer is still granted it (ADR 0363 §7)	2026-10-14 21:55:55 +02:00
jochen	ee13e75bf3	Let a module declare a stream of its own and restrict who hears it by a trusted config value (hq issue 718, ADR 0363) ... mesh-mail's events must live on a stream of their own and reach only the modules the operator granted an account (ADR 0359 §2, §4). The controller now creates a module's declared stream, publishes its events on mesh.stream.<module>.event.<event>, and composes a consumer's durable consumer, filters and bus grants on a restricted stream only where its consumes asks and the provider's trusted value names it; a consumer that loses its grant has its consumer removed on the next assertion. Nothing changes while no manifest declares a stream.	2026-10-14 21:52:45 +02:00