7 Commits

Include renames

Author	SHA1	Message	Date
jschoubben	e6e1e3bc89	A gate judges its own send and the build it sent, and never puts the controller back behind its store (hq issue 352) ... On 2026-10-09 a release's gate on the control node read the machine's report against a newer send another plan had just made there, failed three builds the machine had reported healthy, and put them back on every machine to a controller older than the store's schema; that controller then passed the newer plan's gate from its own health. - A gate keeps what its send carried (digest, sequence) and reads the report against it; a report on the last send is on it too. - A gate judges only the build the machine was last sent: another build there supersedes the judging — no verdict, nothing put back. - A controller is told its build (MESH_CONTROLLER_VERSION, ${version} in a process's env) and records how far it reads the store's schema; a put-back to a build that reaches less, or never said, is refused and the current build kept, said as urgent. - A release's open gate holds other sends of its modules there, and a plan's own first send waits on it.	2026-10-09 17:15:40 +02:00
jochen	a5e8baf6da	Register a module only from the repository the catalogue builds it from ... An agent could make a repository of its own, or fork one the mesh builds from, commit a module.json naming sudo or mesh-host, and ask the build verb for it: the outcome was registered under that name, and the next push made whoever wrote it root on every node (novox/hq ADR 0266 §7, the review of 2026-10-09). The trunk rule checked the trunk of the repository built, which was the agent's. The take-in, which every outcome reaches whichever verb asked it, now registers a module only from its registered repository, and a new module only from a repository the catalogue already builds from (a merge adding one); anything else only when the build request was kept as asked at the controller's terminal (migration 0084). Through a verb, a build of a repository the catalogue builds nothing from is not asked at all.	2026-10-09 12:37:18 +02:00
jochen	1cc6a2d759	Keep what each machine says of what it runs, raise it, and gate on it (hq ADR 0240, to-be 48 Phase A) ... The gate judged a module by what the mesh saw from outside, so a container that crash-looped after it applied passed it. Each machine's node-engine now states the health of every long-running resource it runs; the controller keeps the newest statement per machine, raises module.<module>.<machine>.unhealthy on the second statement in a row, clears it on the first that does not say it, and the gate passes a module only when every long-running resource of it is stated healthy since the send. An engine that states nothing is judged as before.	2026-10-07 02:28:16 +02:00
jochen	37229b4db5	Refuse every send that would replace the bus outside its planned step (hq ADR 0236) ... A plan's send to the bus's machine for another module carried the bus's new build and restarted it under every machine with nobody asking (2026-10-06). The guard is in the one send everything uses; only the bus step passes it. A rebuild that made the same artifacts is no move.	2026-10-06 18:56:54 +02:00
jochen	d7bf1bae83	Name the decision this builds: hq ADR 0236 (0235 is the bus's snapshot)	2026-10-06 18:56:54 +02:00
jochen	c6f3d8cdfa	Take the bus's snapshot through its machine's backup holder before the planned step (hq ADR 0235, 0236)	2026-10-06 18:56:54 +02:00
jochen	d9289ef6d4	Gate a release plan's first machine and roll a failed build back there (hq ADR 0236) ... A build that reported applied was sent everywhere; one that then did nothing, served no tools or broke its machine's word reached every machine. Now the first machine is judged by the component's health (the core's definitions, as doctor probes H-*, or a module's own) three times over two minutes within ten; a failing gate puts the previous build back there once, marks the build, and says it as a condition and an event. Upgrades roll out by default; the bus is a planned step; a module deleted at its source is not built (the public-acme plan failure).	2026-10-06 18:56:54 +02:00