On 2026-10-07 the catalogue merge that adopted the images' own health checks (mesh-catalog #104) rebuilt postgres and mongodb, both with policy record, together with the rest. The plan's gated send to the control node for mail, and the one to the anchor for the spreadsheet app, composed each machine's whole declaration from the builds the mesh held (ADR 0221), so both sends carried the providers' new builds and recreated them. Nobody pushed, and no gate judged them, because moves() and the gate only count modules that roll out. Separately, the same send recreated nine of mail's containers at once for a change that brought no new image.
What
A recorded build moves only by a person's push.sendToEach handles every send that is not push <node>: plans, release plans, rollbacks, healers, rotations and the bus step. It now composes under keepingRecorded, and planFor resolves every recorded module the machine was last sent, at a build not identical to the one the mesh holds, from the manifest of the build it runs (inventory.ManifestAt, the standing build's artifacts per issue 280). declarationWith records that the send still carries that build. status keeps saying the machine is behind, and push <node> sends the new build. The bus step lets only the bus move. If the build to keep is no longer in the records, the send is refused and the refusal names push <node> as the remedy.
A send says what it recreates.catalogue.Recreates compares two builds container by container. gatedSend puts a line on each move it carries, e.g. recreates 9 of mailu's 11 container(s) (no new image, only their declaration: …), at once: …, and the line goes into the plan's note, the controller's log and plans <id>.
Tests
TestARecordedBuildIsCarriedOnlyByAPersonsPush replays tonight's case: a record provider and a rolled module on one machine, both rebuilt with a health check and no new image. A non-person send composes the provider at its old build and records that build. A person's push composes the new build. The bus step lets only the bus move. A kept build that no longer exists refuses the send with its remedy. The send for mail says it recreates both containers with no new image. Without the fix the test fails at "a send that is not a person's push composed the recorded module's new build".
TestASendSaysWhatItRecreates covers the comparison.
check-here ran on this head: mesh/merge-gate PASS (4 of 4 compose); mesh/repo-check PASS.
hq: issue 294, ADR 0242 (PR in novox/hq).
## Why
On 2026-10-07 the catalogue merge that adopted the images' own health checks (mesh-catalog #104) rebuilt postgres and mongodb, both with policy `record`, together with the rest. The plan's gated send to the control node for mail, and the one to the anchor for the spreadsheet app, composed each machine's whole declaration from the builds the mesh held (ADR 0221), so both sends carried the providers' new builds and recreated them. Nobody pushed, and no gate judged them, because `moves()` and the gate only count modules that roll out. Separately, the same send recreated nine of mail's containers at once for a change that brought no new image.
## What
- **A recorded build moves only by a person's push.** `sendToEach` handles every send that is not `push <node>`: plans, release plans, rollbacks, healers, rotations and the bus step. It now composes under `keepingRecorded`, and `planFor` resolves every recorded module the machine was last sent, at a build not identical to the one the mesh holds, from the manifest of the build it runs (`inventory.ManifestAt`, the standing build's artifacts per issue 280). `declarationWith` records that the send still carries that build. `status` keeps saying the machine is behind, and `push <node>` sends the new build. The bus step lets only the bus move. If the build to keep is no longer in the records, the send is refused and the refusal names `push <node>` as the remedy.
- **A send says what it recreates.** `catalogue.Recreates` compares two builds container by container. `gatedSend` puts a line on each move it carries, e.g. `recreates 9 of mailu's 11 container(s) (no new image, only their declaration: …), at once: …`, and the line goes into the plan's note, the controller's log and `plans <id>`.
## Tests
- `TestARecordedBuildIsCarriedOnlyByAPersonsPush` replays tonight's case: a record provider and a rolled module on one machine, both rebuilt with a health check and no new image. A non-person send composes the provider at its old build and records that build. A person's push composes the new build. The bus step lets only the bus move. A kept build that no longer exists refuses the send with its remedy. The send for mail says it recreates both containers with no new image. Without the fix the test fails at "a send that is not a person's push composed the recorded module's new build".
- `TestASendSaysWhatItRecreates` covers the comparison.
`check-here` ran on this head: mesh/merge-gate PASS (4 of 4 compose); mesh/repo-check PASS.
hq: issue 294, ADR 0242 (PR in novox/hq).
mesh/merge-gate pass: builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step; every machine composes with the change as it…
A plan's gated send for mail carried postgres's and mongodb's new builds
(policy record) to the control node and the anchor on 2026-10-07: a send
composes the machine's whole declaration from the builds the mesh holds,
and the gate only ever looked at modules that roll out. Every send but a
person's push now composes a recorded module from the manifest of the build
the machine was last sent and records that it still carries it; the bus
step moves the bus alone. And each move a gated send carries says how many
of the module's containers it recreates, and whether with a new image or
only their declaration.
build-agent keeps data (ADR 0233): what it holds is backed up before it moves
route-proxy provides route: its consumers are sent again after it
route-proxy keeps data (ADR 0233): what it holds is backed up before it moves
Machines
mesh-controller on novox: judging — 0 healthy judging(s) so far
Transitions
2026-10-07 17:39 (new) → proposed (announced): novox/mesh-controller#115's head announced
2026-10-07 17:47 proposed → checked (checked): the verdict names this commit
2026-10-07 17:47 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
2026-10-07 17:57 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
2026-10-07 17:57 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path
2026-10-07 17:59 delivering → superseded (superseded): a newer delivery to the same trunk took over its walk
The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.
<!-- mesh-delivery:view -->
**Delivery** `novox/mesh-controller@5efe99973370` — **superseded** since 2026-10-07T17:59:17Z
**Delivery plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
- tier 0: mesh-controller
- tier 1: build-agent
- tier 2: route-proxy
- ace: receives build-agent, route-proxy
- g14: receives build-agent
- novox: receives mesh-controller, build-agent, route-proxy
- shanks: receives build-agent
- build-agent keeps data (ADR 0233): what it holds is backed up before it moves
- route-proxy provides route: its consumers are sent again after it
- route-proxy keeps data (ADR 0233): what it holds is backed up before it moves
**Machines**
- mesh-controller on novox: judging — 0 healthy judging(s) so far
**Transitions**
- 2026-10-07 17:39 (new) → proposed (announced): novox/mesh-controller#115's head announced
- 2026-10-07 17:47 proposed → checked (checked): the verdict names this commit
- 2026-10-07 17:47 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
- 2026-10-07 17:57 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
- 2026-10-07 17:57 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path
- 2026-10-07 17:59 delivering → superseded (superseded): a newer delivery to the same trunk took over its walk
The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.
build-agent keeps data (ADR 0233): what it holds is backed up before it moves
route-proxy provides route: its consumers are sent again after it
route-proxy keeps data (ADR 0233): what it holds is backed up before it moves
Run by the build seat on shanks as build-1791393924669409599 (builds --log build-1791393924669409599).
--- the gate: build-agent, mesh-controller, route-proxy
mesh-controller: ok, 46 tool(s); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
long-running resources without health: 1
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-07T17:23:39Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-07T17:23:39Z
machines:
- a machine (f35): composes
- holds mesh-dns-resolver (idt): composes
- holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
- a machine (yvbpsm): composes
a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy
--- its merge-check.sh (go toolchain)
ok github.com/novox/mesh-controller/cmd/mesh-builder 1.034s
ok github.com/novox/mesh-controller/cmd/mesh-controller 478.957s
ok github.com/novox/mesh-controller/examples/objectstore-provisioner 1.060s
ok github.com/novox/mesh-controller/examples/postgres-provisioner 1.065s
ok github.com/novox/mesh-controller/examples/redis-provisioner 1.042s
ok github.com/novox/mesh-controller/examples/route-proxy 1.250s
ok github.com/novox/mesh-controller/internal/artifacts 1.095s
ok github.com/novox/mesh-controller/internal/broker 2.611s
ok github.com/novox/mesh-controller/internal/builder 1.543s
ok github.com/novox/mesh-controller/internal/catalogue 4.370s
ok github.com/novox/mesh-controller/internal/conditions 2.028s
ok github.com/novox/mesh-controller/internal/envfile 1.045s
ok github.com/novox/mesh-controller/internal/facts 1.061s
ok github.com/novox/mesh-controller/internal/identity 48.309s
ok github.com/novox/mesh-controller/internal/inventory 295.387s
ok github.com/novox/mesh-controller/internal/lease 17.701s
ok github.com/novox/mesh-controller/internal/licences 42.765s
ok github.com/novox/mesh-controller/internal/licences/adapters 1.052s
ok github.com/novox/mesh-controller/internal/link 89.865s
ok github.com/novox/mesh-controller/internal/lint 2.021s
ok github.com/novox/mesh-controller/internal/outward 1.091s
ok github.com/novox/mesh-controller/internal/overlay 1.088s
ok github.com/novox/mesh-controller/internal/secrets 1.529s
ok github.com/novox/mesh-controller/internal/store 11.462s
ok github.com/novox/mesh-controller/internal/testbus 1.231s
ok github.com/novox/mesh-controller/internal/token 1.014s
**Merge check** at `cdf30349`
- `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)
- `mesh/repo-check`: **PASS** — its merge-check.sh passed
**Change plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
- tier 0: mesh-controller
- tier 1: build-agent
- tier 2: route-proxy
- ace: receives build-agent, route-proxy
- g14: receives build-agent
- novox: receives mesh-controller, build-agent, route-proxy
- shanks: receives build-agent
- build-agent keeps data (ADR 0233): what it holds is backed up before it moves
- route-proxy provides route: its consumers are sent again after it
- route-proxy keeps data (ADR 0233): what it holds is backed up before it moves
Run by the build seat on shanks as `build-1791393924669409599` (`builds --log build-1791393924669409599`).
```
--- the gate: build-agent, mesh-controller, route-proxy
mesh-controller: ok, 46 tool(s); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
long-running resources without health: 1
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-07T17:23:39Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-07T17:23:39Z
machines:
- a machine (f35): composes
- holds mesh-dns-resolver (idt): composes
- holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
- a machine (yvbpsm): composes
a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy
--- its merge-check.sh (go toolchain)
ok github.com/novox/mesh-controller/cmd/mesh-builder 1.034s
ok github.com/novox/mesh-controller/cmd/mesh-controller 478.957s
ok github.com/novox/mesh-controller/examples/objectstore-provisioner 1.060s
ok github.com/novox/mesh-controller/examples/postgres-provisioner 1.065s
ok github.com/novox/mesh-controller/examples/redis-provisioner 1.042s
ok github.com/novox/mesh-controller/examples/route-proxy 1.250s
ok github.com/novox/mesh-controller/internal/artifacts 1.095s
ok github.com/novox/mesh-controller/internal/broker 2.611s
ok github.com/novox/mesh-controller/internal/builder 1.543s
ok github.com/novox/mesh-controller/internal/catalogue 4.370s
ok github.com/novox/mesh-controller/internal/conditions 2.028s
ok github.com/novox/mesh-controller/internal/envfile 1.045s
ok github.com/novox/mesh-controller/internal/facts 1.061s
ok github.com/novox/mesh-controller/internal/identity 48.309s
ok github.com/novox/mesh-controller/internal/inventory 295.387s
ok github.com/novox/mesh-controller/internal/lease 17.701s
ok github.com/novox/mesh-controller/internal/licences 42.765s
ok github.com/novox/mesh-controller/internal/licences/adapters 1.052s
ok github.com/novox/mesh-controller/internal/link 89.865s
ok github.com/novox/mesh-controller/internal/lint 2.021s
ok github.com/novox/mesh-controller/internal/outward 1.091s
ok github.com/novox/mesh-controller/internal/overlay 1.088s
ok github.com/novox/mesh-controller/internal/secrets 1.529s
ok github.com/novox/mesh-controller/internal/store 11.462s
ok github.com/novox/mesh-controller/internal/testbus 1.231s
ok github.com/novox/mesh-controller/internal/token 1.014s
```
mesh/merge-gate pass: builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step; every machine composes with the change as it…
build-agent keeps data (ADR 0233): what it holds is backed up before it moves
route-proxy provides route: its consumers are sent again after it
route-proxy keeps data (ADR 0233): what it holds is backed up before it moves
Run by the build seat on ace as build-1791394745872831366 (builds --log build-1791394745872831366).
--- the gate: build-agent, mesh-controller, route-proxy
mesh-controller: ok, 46 tool(s); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
long-running resources without health: 1
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-07T17:23:39Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-07T17:23:39Z
machines:
- a machine (f35): composes
- holds mesh-dns-resolver (idt): composes
- holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
- a machine (yvbpsm): composes
a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy
--- its merge-check.sh (go toolchain)
ok github.com/novox/mesh-controller/cmd/mesh-builder 1.030s
ok github.com/novox/mesh-controller/cmd/mesh-controller 404.923s
ok github.com/novox/mesh-controller/examples/objectstore-provisioner 1.028s
ok github.com/novox/mesh-controller/examples/postgres-provisioner 1.036s
ok github.com/novox/mesh-controller/examples/redis-provisioner 1.032s
ok github.com/novox/mesh-controller/examples/route-proxy 1.118s
ok github.com/novox/mesh-controller/internal/artifacts 1.065s
ok github.com/novox/mesh-controller/internal/broker 2.389s
ok github.com/novox/mesh-controller/internal/builder 1.294s
ok github.com/novox/mesh-controller/internal/catalogue 3.526s
ok github.com/novox/mesh-controller/internal/conditions 1.980s
ok github.com/novox/mesh-controller/internal/envfile 1.031s
ok github.com/novox/mesh-controller/internal/facts 1.033s
ok github.com/novox/mesh-controller/internal/identity 43.764s
ok github.com/novox/mesh-controller/internal/inventory 250.429s
ok github.com/novox/mesh-controller/internal/lease 17.662s
ok github.com/novox/mesh-controller/internal/licences 40.883s
ok github.com/novox/mesh-controller/internal/licences/adapters 1.052s
ok github.com/novox/mesh-controller/internal/link 77.445s
ok github.com/novox/mesh-controller/internal/lint 1.723s
ok github.com/novox/mesh-controller/internal/outward 1.075s
ok github.com/novox/mesh-controller/internal/overlay 1.037s
ok github.com/novox/mesh-controller/internal/secrets 1.412s
ok github.com/novox/mesh-controller/internal/store 22.074s
ok github.com/novox/mesh-controller/internal/testbus 1.218s
ok github.com/novox/mesh-controller/internal/token 1.017s
**Merge check** at `5efe9997`
- `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)
- `mesh/repo-check`: **PASS** — its merge-check.sh passed
**Change plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
- tier 0: mesh-controller
- tier 1: build-agent
- tier 2: route-proxy
- ace: receives build-agent, route-proxy
- g14: receives build-agent
- novox: receives mesh-controller, build-agent, route-proxy
- shanks: receives build-agent
- build-agent keeps data (ADR 0233): what it holds is backed up before it moves
- route-proxy provides route: its consumers are sent again after it
- route-proxy keeps data (ADR 0233): what it holds is backed up before it moves
Run by the build seat on ace as `build-1791394745872831366` (`builds --log build-1791394745872831366`).
```
--- the gate: build-agent, mesh-controller, route-proxy
mesh-controller: ok, 46 tool(s); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
long-running resources without health: 1
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-07T17:23:39Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-07T17:23:39Z
machines:
- a machine (f35): composes
- holds mesh-dns-resolver (idt): composes
- holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
- a machine (yvbpsm): composes
a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy
--- its merge-check.sh (go toolchain)
ok github.com/novox/mesh-controller/cmd/mesh-builder 1.030s
ok github.com/novox/mesh-controller/cmd/mesh-controller 404.923s
ok github.com/novox/mesh-controller/examples/objectstore-provisioner 1.028s
ok github.com/novox/mesh-controller/examples/postgres-provisioner 1.036s
ok github.com/novox/mesh-controller/examples/redis-provisioner 1.032s
ok github.com/novox/mesh-controller/examples/route-proxy 1.118s
ok github.com/novox/mesh-controller/internal/artifacts 1.065s
ok github.com/novox/mesh-controller/internal/broker 2.389s
ok github.com/novox/mesh-controller/internal/builder 1.294s
ok github.com/novox/mesh-controller/internal/catalogue 3.526s
ok github.com/novox/mesh-controller/internal/conditions 1.980s
ok github.com/novox/mesh-controller/internal/envfile 1.031s
ok github.com/novox/mesh-controller/internal/facts 1.033s
ok github.com/novox/mesh-controller/internal/identity 43.764s
ok github.com/novox/mesh-controller/internal/inventory 250.429s
ok github.com/novox/mesh-controller/internal/lease 17.662s
ok github.com/novox/mesh-controller/internal/licences 40.883s
ok github.com/novox/mesh-controller/internal/licences/adapters 1.052s
ok github.com/novox/mesh-controller/internal/link 77.445s
ok github.com/novox/mesh-controller/internal/lint 1.723s
ok github.com/novox/mesh-controller/internal/outward 1.075s
ok github.com/novox/mesh-controller/internal/overlay 1.037s
ok github.com/novox/mesh-controller/internal/secrets 1.412s
ok github.com/novox/mesh-controller/internal/store 22.074s
ok github.com/novox/mesh-controller/internal/testbus 1.218s
ok github.com/novox/mesh-controller/internal/token 1.017s
```
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Why
On 2026-10-07 the catalogue merge that adopted the images' own health checks (mesh-catalog #104) rebuilt postgres and mongodb, both with policy
record, together with the rest. The plan's gated send to the control node for mail, and the one to the anchor for the spreadsheet app, composed each machine's whole declaration from the builds the mesh held (ADR 0221), so both sends carried the providers' new builds and recreated them. Nobody pushed, and no gate judged them, becausemoves()and the gate only count modules that roll out. Separately, the same send recreated nine of mail's containers at once for a change that brought no new image.What
sendToEachhandles every send that is notpush <node>: plans, release plans, rollbacks, healers, rotations and the bus step. It now composes underkeepingRecorded, andplanForresolves every recorded module the machine was last sent, at a build not identical to the one the mesh holds, from the manifest of the build it runs (inventory.ManifestAt, the standing build's artifacts per issue 280).declarationWithrecords that the send still carries that build.statuskeeps saying the machine is behind, andpush <node>sends the new build. The bus step lets only the bus move. If the build to keep is no longer in the records, the send is refused and the refusal namespush <node>as the remedy.catalogue.Recreatescompares two builds container by container.gatedSendputs a line on each move it carries, e.g.recreates 9 of mailu's 11 container(s) (no new image, only their declaration: …), at once: …, and the line goes into the plan's note, the controller's log andplans <id>.Tests
TestARecordedBuildIsCarriedOnlyByAPersonsPushreplays tonight's case: a record provider and a rolled module on one machine, both rebuilt with a health check and no new image. A non-person send composes the provider at its old build and records that build. A person's push composes the new build. The bus step lets only the bus move. A kept build that no longer exists refuses the send with its remedy. The send for mail says it recreates both containers with no new image. Without the fix the test fails at "a send that is not a person's push composed the recorded module's new build".TestASendSaysWhatItRecreatescovers the comparison.check-hereran on this head: mesh/merge-gate PASS (4 of 4 compose); mesh/repo-check PASS.hq: issue 294, ADR 0242 (PR in novox/hq).
Delivery
novox/mesh-controller@5efe99973370— superseded since 2026-10-07T17:59:17ZDelivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
Machines
Transitions
The commit's note under
refs/notes/mesh-plankeeps every transition:git log --notes=mesh-plan.Merge check at
cdf30349mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)mesh/repo-check: PASS — its merge-check.sh passedChange plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
Run by the build seat on shanks as
build-1791393924669409599(builds --log build-1791393924669409599).Merge check at
5efe9997mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)mesh/repo-check: PASS — its merge-check.sh passedChange plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
Run by the build seat on ace as
build-1791394745872831366(builds --log build-1791394745872831366).