4 Commits

Include renames

Author	SHA1	Message	Date
jochen	913095d291	Keep a join token nowhere but in its caller's answer ... The calls the controller serves are kept on the bus with their answers, and calls answers anyone who may call its seat. A token is the one-time right to become a machine of the mesh, so the token verb's answer is kept as withheld (novox/hq ADR 0169).	2026-10-08 02:06:19 +02:00
jochen	6c7af5c63f	Run a verb from the controller's own running image, and refuse what it cannot run as a handover (hq issue 289) ... The witness moves a running build aside into a directory the controller's user cannot enter, then deletes it; a verb exec'd from os.Executable() in that window failed with permission denied. /proc/self/exe stays valid while the process lives. A verb that still cannot start, or arrives while the controller stops, is refused with link.ErrHandingOver and marked retry: handing-over.	2026-10-07 02:45:09 +02:00
jochen	e74c32ed50	Keep calls and hand acts on the bus, answer status at once, record durations (hq to-be 45 Phase 0) ... A controller restart lost every call's outcome, `status` composed the mesh while its caller waited (18.6s live on 2026-10-06, past the 10s window), a repair by hand left no trace, and the core's bounds had nothing measured to be set from. - calls: kept in the controller's bucket mesh-controller_calls (last 1000 or 14 days, answers bounded to 64 KiB), read by id across a restart; a controller starting marks a stopped one's running calls abandoned; each call names its caller from the inbox its answer goes to. - status: the serving controller composes it at start, after news from a machine, a build or an acting verb, and every minute; the verb answers the last composition at once with when and how long it took. Composing resolves each machine once instead of twice. - hand-act log in mesh-controller_hand-acts: push (required through the seat), plans stop/close, broker consumer-reset and the new hand-act record take --why/--cause/--condition; `hand-acts` lists them and repeated causes; status counts the week's. - durations (migration 0066): apply (send to first report), heartbeat gap, plan tier and build, recorded as heard; `durations` summarises them. - the controller's seat row takes this binary's definition of its own verbs, so the console no longer judges calls against an older build's schema. - the controller is granted its two buckets' subjects.	2026-10-06 02:59:36 +02:00
jochen	801552c0eb	Answer every seat call within ten seconds and keep what came of it (hq issue 265) ... A push outlasted the console's 30s wait and, when it sent the bus its changed user list, the broker's reload forgot the reply it may send: the push happened and its caller was told it did not answer. Calls now answer in full or as running with an id, a push answers before it sends, refused answers are recorded on their call, and 'calls' reads them back.	2026-10-06 01:14:58 +02:00