Issue: novox/hq issue 594 (a send that recreates a build agent kills the build it is running).
after: none (one repository)
This is the part of 594 that needs no decision: an interrupted build is never silently redelivered any more. The agent that takes an ask handed out again (JetStream's delivery count > 1) says so:
its started event carries delivery, and the build's log gets a restarted line;
the outcome carries delivery; checkedOf prefixes the summary and both layers' summaries (the lines the pull request shows for mesh/merge-gate and mesh/repo-check) with "restarted: handed out N times — an earlier build agent took it and did not finish, most often because it was replaced mid-build, so it ran again from the start";
the queue's in-flight line says ", restarted (handed out N times)", and its data carries delivery.
The drain itself (the agent finishing its build before it is replaced) is not here: the node-engine replaces a container with docker rm -f, a SIGKILL with no stop timeout, so the agent never hears a SIGTERM. That needs a decision; the options are on issue 594.
Tests (fail on main: the fields do not exist):
internal/link TestNatsAnAskHandedOutAgainSaysItRestarted (real bus: an ask handed back once; second start says delivery 2, a restarted log line, outcome delivery 2)
gofmt, go vet, go test -race on internal/link, cmd/mesh-controller, cmd/mesh-builder: green.
Rollout: rebuilds build-agent (all four machines) and the controller. A build agent from before reads no delivery and says nothing extra; a controller from before ignores the field. No order needed.
Issue: novox/hq issue 594 (a send that recreates a build agent kills the build it is running).
after: none (one repository)
This is the part of 594 that needs no decision: an interrupted build is never silently redelivered any more. The agent that takes an ask handed out again (JetStream's delivery count > 1) says so:
- its started event carries `delivery`, and the build's log gets a `restarted` line;
- the outcome carries `delivery`; `checkedOf` prefixes the summary and both layers' summaries (the lines the pull request shows for mesh/merge-gate and mesh/repo-check) with "restarted: handed out N times — an earlier build agent took it and did not finish, most often because it was replaced mid-build, so it ran again from the start";
- the queue's in-flight line says ", restarted (handed out N times)", and its data carries `delivery`.
The drain itself (the agent finishing its build before it is replaced) is not here: the node-engine replaces a container with `docker rm -f`, a SIGKILL with no stop timeout, so the agent never hears a SIGTERM. That needs a decision; the options are on issue 594.
Tests (fail on main: the fields do not exist):
- internal/link TestNatsAnAskHandedOutAgainSaysItRestarted (real bus: an ask handed back once; second start says delivery 2, a restarted log line, outcome delivery 2)
- cmd/mesh-controller TestARestartedCheckSaysSoOnEveryLayer, TestTheQueueSaysAnAskInFlightRestarted
gofmt, go vet, go test -race on internal/link, cmd/mesh-controller, cmd/mesh-builder: green.
Rollout: rebuilds build-agent (all four machines) and the controller. A build agent from before reads no delivery and says nothing extra; a controller from before ignores the field. No order needed.
A build agent replaced mid-build leaves its ask to be handed out again, and
the second run looked like a first: the queue and the pull request showed
nothing of the 5-8 minutes lost (novox/hq issue 594).
Deliverynovox/mesh-controller@ee1d7e5cae12 — delivered since 2026-10-12T23:06:22Z
Delivery plan — builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step
tier 0: mesh-controller
tier 1: build-agent
ace: receives build-agent
g14: receives build-agent
novox: receives mesh-controller, build-agent
shanks: receives build-agent
build-agent keeps data (ADR 0233): what it holds is backed up before it moves
grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before build-agent is judged on its first machine
Machines
mesh-controller on novox: passed — healthy 3 times over 4m7s
mesh-controller on the rest running it: sent
build-agent on ace: passed — healthy 1 times over 22s
build-agent on the rest running it: sent
Transitions
2026-10-12 22:32 (new) → proposed (announced): novox/mesh-controller#280's head announced
2026-10-12 22:37 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
2026-10-12 22:37 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
2026-10-12 22:56 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
2026-10-12 22:56 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
2026-10-12 23:06 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says
The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.
<!-- mesh-delivery:view -->
**Delivery** `novox/mesh-controller@ee1d7e5cae12` — **delivered** since 2026-10-12T23:06:22Z
**Delivery plan** — builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step
- tier 0: mesh-controller
- tier 1: build-agent
- ace: receives build-agent
- g14: receives build-agent
- novox: receives mesh-controller, build-agent
- shanks: receives build-agent
- build-agent keeps data (ADR 0233): what it holds is backed up before it moves
- grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before build-agent is judged on its first machine
**Machines**
- mesh-controller on novox: passed — healthy 3 times over 4m7s
- mesh-controller on the rest running it: sent
- build-agent on ace: passed — healthy 1 times over 22s
- build-agent on the rest running it: sent
**Transitions**
- 2026-10-12 22:32 (new) → proposed (announced): novox/mesh-controller#280's head announced
- 2026-10-12 22:37 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
- 2026-10-12 22:37 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
- 2026-10-12 22:56 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
- 2026-10-12 22:56 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
- 2026-10-12 23:06 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says
The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.
mesh/merge-gate head ee1d7e5cae12 merged into trunk 56d6313262e8 — pass: builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step; every …
The forge clips a status to 140 characters, so the long sentence pushed the
verdict's own words out; and a paused holder's hand-back or a bus delay also
count as a delivery, so the cause is not claimed (novox/hq issue 594).
Merge check at ee1d7e5c
Judged: head ee1d7e5cae12 merged into trunk 56d6313262e8; read beside it: mesh-catalog 43a9155d5afe, mesh-controller-main 56d6313262e8, mesh-host 8e95c1d9ed2d, mesh-tools 954e1a53eef9
mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller)
mesh/repo-check: PASS — its merge-check.sh passed
Delivery plan — builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step
tier 0: mesh-controller
tier 1: build-agent
ace: receives build-agent
g14: receives build-agent
novox: receives mesh-controller, build-agent
shanks: receives build-agent
build-agent keeps data (ADR 0233): what it holds is backed up before it moves
grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before build-agent is judged on its first machine
read by no module's build: cmd/mesh-controller/restarted_test.go, internal/link/builds_nats_test.go
Run by the build seat on ace as build-1791844351702165471 (builds --log build-1791844351702165471).
--- the gate: build-agent, mesh-controller
mesh-controller: ok, 58 tool(s); WARNING: merge-window ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
long-running resources without health: 1
files asking for a setting without saying whether it is trusted: 1
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-12T22:24:48Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-12T22:24:48Z
modules the change moves:
- mesh-controller (changed)
machines:
- a machine (f35): composes
- holds mesh-dns-resolver (idt): composes
- holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
- a machine (yvbpsm): composes
a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy
--- its merge-check.sh (go toolchain)
ok github.com/novox/mesh-controller/cmd/mesh-builder 1.036s
ok github.com/novox/mesh-controller/cmd/mesh-controller 151.096s
ok github.com/novox/mesh-controller/examples/objectstore-provisioner 1.016s
ok github.com/novox/mesh-controller/examples/postgres-provisioner 1.024s
ok github.com/novox/mesh-controller/examples/redis-provisioner 1.016s
ok github.com/novox/mesh-controller/examples/route-proxy 1.145s
ok github.com/novox/mesh-controller/internal/artifacts 1.070s
? github.com/novox/mesh-controller/internal/beside [no test files]
ok github.com/novox/mesh-controller/internal/broker 4.074s
ok github.com/novox/mesh-controller/internal/builder 35.367s
ok github.com/novox/mesh-controller/internal/catalogue 7.612s
ok github.com/novox/mesh-controller/internal/conditions 2.623s
ok github.com/novox/mesh-controller/internal/envfile 1.064s
ok github.com/novox/mesh-controller/internal/facts 1.061s
ok github.com/novox/mesh-controller/internal/identity 4.552s
ok github.com/novox/mesh-controller/internal/inventory 30.318s
ok github.com/novox/mesh-controller/internal/lease 17.721s
ok github.com/novox/mesh-controller/internal/licences 3.693s
ok github.com/novox/mesh-controller/internal/licences/adapters 1.063s
ok github.com/novox/mesh-controller/internal/link 58.273s
ok github.com/novox/mesh-controller/internal/lint 2.322s
ok github.com/novox/mesh-controller/internal/outward 1.069s
ok github.com/novox/mesh-controller/internal/overlay 1.063s
ok github.com/novox/mesh-controller/internal/secrets 1.434s
ok github.com/novox/mesh-controller/internal/store 3.372s
ok github.com/novox/mesh-controller/internal/testbus 1.232s
ok github.com/novox/mesh-controller/internal/token 1.019s
store tests, each run against the store:
./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeWalksTheOthersAgain (0.18s)
./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeEndsTheMergesThatContainIt (0.21s)
./cmd/mesh-controller --- PASS: TestAStopWalksTheOthersAgainInTheOpenBatch (0.20s)
./cmd/mesh-controller --- PASS: TestAStopNamesWhatStaysOnTheMachinesAndWhatStillCarriesIt (0.19s)
./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeLeavesItOutOfABatch (0.18s)
./cmd/mesh-controller --- PASS: TestSavingPlansAndMovingMergesIsOneAct (0.16s)
./cmd/mesh-controller --- PASS: TestAPlanFollowedFromTheStoreAnswersWhenItMoves (1.95s)
./cmd/mesh-controller --- PASS: TestNodeShowAndStatusReadTheLastSendFromTheStore (0.22s)
./cmd/mesh-controller --- PASS: TestTheConditionsVerbReadsTheLooksTheBucketNoLongerHolds (0.12s)
./cmd/mesh-controller --- PASS: TestAWalkLetGoAndStoppedByVerbsIsSaidStartedAndEnded (0.24s)
./cmd/mesh-controller --- PASS: TestAWalkStoppedOrClosedByAPersonIsSaidEndedStopped (0.24s)
./cmd/mesh-controller --- PASS: TestAWalkRetriedByAPersonIsSaidStartedAgain (0.19s)
./cmd/mesh-controller --- PASS: TestABacklogReleasedByAPersonIsSaidStarted (0.20s)
./cmd/mesh-controller --- PASS: TestAWalkEndedByCancelOrClearIsSaidEnded (0.26s)
./cmd/mesh-controller --- PASS: TestAWalkRestartedByARebuildIsSaidStarted (0.20s)
./cmd/mesh-controller --- PASS: TestAWalkStoppedByHandAndRetriedEndsFailedWhenItFailsAgain (0.24s)
./cmd/mesh-controller --- PASS: TestReplay237 (0.18s)
./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeUnresolvedSaysSoOnceInItsAnswer (0.18s)
./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeResolvedSaysNothingOfIt (0.18s)
./cmd/mesh-controller --- PASS: TestAnAssignThatLeavesItsNodeUnresolvedSaysOnlyThePlansRefusal (0.18s)
./cmd/mesh-controller --- PASS: TestADirectoryOwnersKeyIsRefusedThroughAVerb (0.21s)
./cmd/mesh-controller --- PASS: TestTheSendMakesNoValueForAnOutsideSecretNobodyGave (0.25s)
./cmd/mesh-controller --- PASS: TestAQuestionComposesWithoutAnOutsideSecretNobodyGave (0.26s)
./cmd/mesh-controller --- PASS: TestReplay201 (0.16s)
./cmd/mesh-controller --- PASS: TestARollbackWhoseSendWasRefusedIsCompletedByTheNextSend (0.14s)
./cmd/mesh-controller --- PASS: TestAGateJudgesTheOtherMovesBesideAKeptCore (0.14s)
./cmd/mesh-controller --- PASS: TestReplay401 (0.26s)
./cmd/mesh-controller --- PASS: TestReplay201ThePlansSend (0.22s)
./internal/inventory --- PASS: TestTheLastSendSaysWhatTheMachineAnswered (0.07s)
./internal/inventory --- PASS: TestAReportIsTheLastSendsAnswerOnlyWhenItIsAboutThatSend (0.07s)
./internal/inventory --- PASS: TestAnIssuedValueIsSealedToEveryHolderOnceAndNotAgain (0.10s)
./internal/inventory --- PASS: TestAnIssuedValueIsSealedAgainAfterAKeyChangeOrAnAcceptance (0.08s)
./internal/inventory --- PASS: TestAConditionsLooksAreKeptBesideTheBucket (0.06s)
./internal/inventory --- PASS: TestAPlanIdHoldingAQuoteIsReadAsAPlainId (0.07s)
./internal/inventory --- PASS: TestAWalksStartIsKeptAndARefusedSaveLeavesItUnsaid (0.06s)
./internal/inventory --- PASS: TestAWalksRestIsReadFromEachMachinesOwnSend (0.06s)
**Merge check** at `ee1d7e5c`
Judged: head `ee1d7e5cae12` merged into trunk `56d6313262e8`; read beside it: mesh-catalog `43a9155d5afe`, mesh-controller-main `56d6313262e8`, mesh-host `8e95c1d9ed2d`, mesh-tools `954e1a53eef9`
- `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller)
- `mesh/repo-check`: **PASS** — its merge-check.sh passed
**Delivery plan** — builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step
- tier 0: mesh-controller
- tier 1: build-agent
- ace: receives build-agent
- g14: receives build-agent
- novox: receives mesh-controller, build-agent
- shanks: receives build-agent
- build-agent keeps data (ADR 0233): what it holds is backed up before it moves
- grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before build-agent is judged on its first machine
- read by no module's build: cmd/mesh-controller/restarted_test.go, internal/link/builds_nats_test.go
Run by the build seat on ace as `build-1791844351702165471` (`builds --log build-1791844351702165471`).
```
--- the gate: build-agent, mesh-controller
mesh-controller: ok, 58 tool(s); WARNING: merge-window ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
long-running resources without health: 1
files asking for a setting without saying whether it is trusted: 1
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-12T22:24:48Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-12T22:24:48Z
modules the change moves:
- mesh-controller (changed)
machines:
- a machine (f35): composes
- holds mesh-dns-resolver (idt): composes
- holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
- a machine (yvbpsm): composes
a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy
--- its merge-check.sh (go toolchain)
ok github.com/novox/mesh-controller/cmd/mesh-builder 1.036s
ok github.com/novox/mesh-controller/cmd/mesh-controller 151.096s
ok github.com/novox/mesh-controller/examples/objectstore-provisioner 1.016s
ok github.com/novox/mesh-controller/examples/postgres-provisioner 1.024s
ok github.com/novox/mesh-controller/examples/redis-provisioner 1.016s
ok github.com/novox/mesh-controller/examples/route-proxy 1.145s
ok github.com/novox/mesh-controller/internal/artifacts 1.070s
? github.com/novox/mesh-controller/internal/beside [no test files]
ok github.com/novox/mesh-controller/internal/broker 4.074s
ok github.com/novox/mesh-controller/internal/builder 35.367s
ok github.com/novox/mesh-controller/internal/catalogue 7.612s
ok github.com/novox/mesh-controller/internal/conditions 2.623s
ok github.com/novox/mesh-controller/internal/envfile 1.064s
ok github.com/novox/mesh-controller/internal/facts 1.061s
ok github.com/novox/mesh-controller/internal/identity 4.552s
ok github.com/novox/mesh-controller/internal/inventory 30.318s
ok github.com/novox/mesh-controller/internal/lease 17.721s
ok github.com/novox/mesh-controller/internal/licences 3.693s
ok github.com/novox/mesh-controller/internal/licences/adapters 1.063s
ok github.com/novox/mesh-controller/internal/link 58.273s
ok github.com/novox/mesh-controller/internal/lint 2.322s
ok github.com/novox/mesh-controller/internal/outward 1.069s
ok github.com/novox/mesh-controller/internal/overlay 1.063s
ok github.com/novox/mesh-controller/internal/secrets 1.434s
ok github.com/novox/mesh-controller/internal/store 3.372s
ok github.com/novox/mesh-controller/internal/testbus 1.232s
ok github.com/novox/mesh-controller/internal/token 1.019s
store tests, each run against the store:
./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeWalksTheOthersAgain (0.18s)
./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeEndsTheMergesThatContainIt (0.21s)
./cmd/mesh-controller --- PASS: TestAStopWalksTheOthersAgainInTheOpenBatch (0.20s)
./cmd/mesh-controller --- PASS: TestAStopNamesWhatStaysOnTheMachinesAndWhatStillCarriesIt (0.19s)
./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeLeavesItOutOfABatch (0.18s)
./cmd/mesh-controller --- PASS: TestSavingPlansAndMovingMergesIsOneAct (0.16s)
./cmd/mesh-controller --- PASS: TestAPlanFollowedFromTheStoreAnswersWhenItMoves (1.95s)
./cmd/mesh-controller --- PASS: TestNodeShowAndStatusReadTheLastSendFromTheStore (0.22s)
./cmd/mesh-controller --- PASS: TestTheConditionsVerbReadsTheLooksTheBucketNoLongerHolds (0.12s)
./cmd/mesh-controller --- PASS: TestAWalkLetGoAndStoppedByVerbsIsSaidStartedAndEnded (0.24s)
./cmd/mesh-controller --- PASS: TestAWalkStoppedOrClosedByAPersonIsSaidEndedStopped (0.24s)
./cmd/mesh-controller --- PASS: TestAWalkRetriedByAPersonIsSaidStartedAgain (0.19s)
./cmd/mesh-controller --- PASS: TestABacklogReleasedByAPersonIsSaidStarted (0.20s)
./cmd/mesh-controller --- PASS: TestAWalkEndedByCancelOrClearIsSaidEnded (0.26s)
./cmd/mesh-controller --- PASS: TestAWalkRestartedByARebuildIsSaidStarted (0.20s)
./cmd/mesh-controller --- PASS: TestAWalkStoppedByHandAndRetriedEndsFailedWhenItFailsAgain (0.24s)
./cmd/mesh-controller --- PASS: TestReplay237 (0.18s)
./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeUnresolvedSaysSoOnceInItsAnswer (0.18s)
./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeResolvedSaysNothingOfIt (0.18s)
./cmd/mesh-controller --- PASS: TestAnAssignThatLeavesItsNodeUnresolvedSaysOnlyThePlansRefusal (0.18s)
./cmd/mesh-controller --- PASS: TestADirectoryOwnersKeyIsRefusedThroughAVerb (0.21s)
./cmd/mesh-controller --- PASS: TestTheSendMakesNoValueForAnOutsideSecretNobodyGave (0.25s)
./cmd/mesh-controller --- PASS: TestAQuestionComposesWithoutAnOutsideSecretNobodyGave (0.26s)
./cmd/mesh-controller --- PASS: TestReplay201 (0.16s)
./cmd/mesh-controller --- PASS: TestARollbackWhoseSendWasRefusedIsCompletedByTheNextSend (0.14s)
./cmd/mesh-controller --- PASS: TestAGateJudgesTheOtherMovesBesideAKeptCore (0.14s)
./cmd/mesh-controller --- PASS: TestReplay401 (0.26s)
./cmd/mesh-controller --- PASS: TestReplay201ThePlansSend (0.22s)
./internal/inventory --- PASS: TestTheLastSendSaysWhatTheMachineAnswered (0.07s)
./internal/inventory --- PASS: TestAReportIsTheLastSendsAnswerOnlyWhenItIsAboutThatSend (0.07s)
./internal/inventory --- PASS: TestAnIssuedValueIsSealedToEveryHolderOnceAndNotAgain (0.10s)
./internal/inventory --- PASS: TestAnIssuedValueIsSealedAgainAfterAKeyChangeOrAnAcceptance (0.08s)
./internal/inventory --- PASS: TestAConditionsLooksAreKeptBesideTheBucket (0.06s)
./internal/inventory --- PASS: TestAPlanIdHoldingAQuoteIsReadAsAPlainId (0.07s)
./internal/inventory --- PASS: TestAWalksStartIsKeptAndARefusedSaveLeavesItUnsaid (0.06s)
./internal/inventory --- PASS: TestAWalksRestIsReadFromEachMachinesOwnSend (0.06s)
```
build-agent keeps data (ADR 0233): what it holds is backed up before it moves
route-proxy provides route: its consumers are sent again after it
route-proxy keeps data (ADR 0233): what it holds is backed up before it moves
grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before build-agent, route-proxy is judged on its first machine
Run by the build seat on novox as build-1791843987312935971 (builds --log build-1791843987312935971).
--- the gate: build-agent, mesh-controller, route-proxy
mesh-controller: ok, 58 tool(s); WARNING: merge-window ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
long-running resources without health: 1
files asking for a setting without saying whether it is trusted: 1
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-12T22:24:48Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-12T22:24:48Z
modules the change moves:
- mesh-controller (changed)
machines:
- a machine (f35): composes
- holds mesh-dns-resolver (idt): composes
- holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
- a machine (yvbpsm): composes
a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy
--- its merge-check.sh (go toolchain)
ok github.com/novox/mesh-controller/cmd/mesh-builder 1.050s
ok github.com/novox/mesh-controller/cmd/mesh-controller 210.599s
ok github.com/novox/mesh-controller/examples/objectstore-provisioner 1.023s
ok github.com/novox/mesh-controller/examples/postgres-provisioner 1.031s
ok github.com/novox/mesh-controller/examples/redis-provisioner 1.022s
ok github.com/novox/mesh-controller/examples/route-proxy 1.136s
ok github.com/novox/mesh-controller/internal/artifacts 1.065s
? github.com/novox/mesh-controller/internal/beside [no test files]
ok github.com/novox/mesh-controller/internal/broker 4.794s
ok github.com/novox/mesh-controller/internal/builder 50.360s
ok github.com/novox/mesh-controller/internal/catalogue 9.403s
ok github.com/novox/mesh-controller/internal/conditions 2.613s
ok github.com/novox/mesh-controller/internal/envfile 1.032s
ok github.com/novox/mesh-controller/internal/facts 1.037s
ok github.com/novox/mesh-controller/internal/identity 9.267s
ok github.com/novox/mesh-controller/internal/inventory 50.249s
ok github.com/novox/mesh-controller/internal/lease 17.705s
ok github.com/novox/mesh-controller/internal/licences 4.836s
ok github.com/novox/mesh-controller/internal/licences/adapters 1.014s
ok github.com/novox/mesh-controller/internal/link 65.491s
ok github.com/novox/mesh-controller/internal/lint 2.582s
ok github.com/novox/mesh-controller/internal/outward 1.040s
ok github.com/novox/mesh-controller/internal/overlay 1.034s
ok github.com/novox/mesh-controller/internal/secrets 1.529s
ok github.com/novox/mesh-controller/internal/store 4.571s
ok github.com/novox/mesh-controller/internal/testbus 1.260s
ok github.com/novox/mesh-controller/internal/token 1.019s
store tests, each run against the store:
./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeWalksTheOthersAgain (0.30s)
./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeEndsTheMergesThatContainIt (0.25s)
./cmd/mesh-controller --- PASS: TestAStopWalksTheOthersAgainInTheOpenBatch (0.25s)
./cmd/mesh-controller --- PASS: TestAStopNamesWhatStaysOnTheMachinesAndWhatStillCarriesIt (0.24s)
./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeLeavesItOutOfABatch (0.24s)
./cmd/mesh-controller --- PASS: TestSavingPlansAndMovingMergesIsOneAct (0.23s)
./cmd/mesh-controller --- PASS: TestAPlanFollowedFromTheStoreAnswersWhenItMoves (2.10s)
./cmd/mesh-controller --- PASS: TestNodeShowAndStatusReadTheLastSendFromTheStore (0.29s)
./cmd/mesh-controller --- PASS: TestTheConditionsVerbReadsTheLooksTheBucketNoLongerHolds (0.14s)
./cmd/mesh-controller --- PASS: TestAWalkLetGoAndStoppedByVerbsIsSaidStartedAndEnded (0.28s)
./cmd/mesh-controller --- PASS: TestAWalkStoppedOrClosedByAPersonIsSaidEndedStopped (0.26s)
./cmd/mesh-controller --- PASS: TestAWalkRetriedByAPersonIsSaidStartedAgain (0.22s)
./cmd/mesh-controller --- PASS: TestABacklogReleasedByAPersonIsSaidStarted (0.22s)
./cmd/mesh-controller --- PASS: TestAWalkEndedByCancelOrClearIsSaidEnded (0.29s)
./cmd/mesh-controller --- PASS: TestAWalkRestartedByARebuildIsSaidStarted (0.23s)
./cmd/mesh-controller --- PASS: TestAWalkStoppedByHandAndRetriedEndsFailedWhenItFailsAgain (0.35s)
./cmd/mesh-controller --- PASS: TestReplay237 (0.24s)
./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeUnresolvedSaysSoOnceInItsAnswer (0.23s)
./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeResolvedSaysNothingOfIt (0.56s)
./cmd/mesh-controller --- PASS: TestAnAssignThatLeavesItsNodeUnresolvedSaysOnlyThePlansRefusal (0.49s)
./cmd/mesh-controller --- PASS: TestADirectoryOwnersKeyIsRefusedThroughAVerb (0.26s)
./cmd/mesh-controller --- PASS: TestTheSendMakesNoValueForAnOutsideSecretNobodyGave (0.64s)
./cmd/mesh-controller --- PASS: TestAQuestionComposesWithoutAnOutsideSecretNobodyGave (0.95s)
./cmd/mesh-controller --- PASS: TestReplay201 (0.19s)
./cmd/mesh-controller --- PASS: TestARollbackWhoseSendWasRefusedIsCompletedByTheNextSend (0.17s)
./cmd/mesh-controller --- PASS: TestAGateJudgesTheOtherMovesBesideAKeptCore (0.17s)
./cmd/mesh-controller --- PASS: TestReplay401 (0.36s)
./cmd/mesh-controller --- PASS: TestReplay201ThePlansSend (0.29s)
./internal/inventory --- PASS: TestTheLastSendSaysWhatTheMachineAnswered (0.09s)
./internal/inventory --- PASS: TestAReportIsTheLastSendsAnswerOnlyWhenItIsAboutThatSend (0.10s)
./internal/inventory --- PASS: TestAnIssuedValueIsSealedToEveryHolderOnceAndNotAgain (0.15s)
./internal/inventory --- PASS: TestAnIssuedValueIsSealedAgainAfterAKeyChangeOrAnAcceptance (0.10s)
./internal/inventory --- PASS: TestAConditionsLooksAreKeptBesideTheBucket (0.08s)
./internal/inventory --- PASS: TestAPlanIdHoldingAQuoteIsReadAsAPlainId (0.08s)
./internal/inventory --- PASS: TestAWalksStartIsKeptAndARefusedSaveLeavesItUnsaid (0.07s)
./internal/inventory --- PASS: TestAWalksRestIsReadFromEachMachinesOwnSend (0.09s)
**Merge check** at `43cab564`
Judged: head `43cab564523d` merged into trunk `56d6313262e8`; read beside it: mesh-catalog `43a9155d5afe`, mesh-controller-main `56d6313262e8`, mesh-host `8e95c1d9ed2d`, mesh-tools `954e1a53eef9`
- `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)
- `mesh/repo-check`: **PASS** — its merge-check.sh passed
**Delivery plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
- tier 0: mesh-controller
- tier 1: build-agent
- tier 2: route-proxy
- ace: receives build-agent, route-proxy
- g14: receives build-agent
- novox: receives mesh-controller, build-agent, route-proxy
- shanks: receives build-agent
- build-agent keeps data (ADR 0233): what it holds is backed up before it moves
- route-proxy provides route: its consumers are sent again after it
- route-proxy keeps data (ADR 0233): what it holds is backed up before it moves
- grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before build-agent, route-proxy is judged on its first machine
Run by the build seat on novox as `build-1791843987312935971` (`builds --log build-1791843987312935971`).
```
--- the gate: build-agent, mesh-controller, route-proxy
mesh-controller: ok, 58 tool(s); WARNING: merge-window ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
long-running resources without health: 1
files asking for a setting without saying whether it is trusted: 1
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-12T22:24:48Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-12T22:24:48Z
modules the change moves:
- mesh-controller (changed)
machines:
- a machine (f35): composes
- holds mesh-dns-resolver (idt): composes
- holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
- a machine (yvbpsm): composes
a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy
--- its merge-check.sh (go toolchain)
ok github.com/novox/mesh-controller/cmd/mesh-builder 1.050s
ok github.com/novox/mesh-controller/cmd/mesh-controller 210.599s
ok github.com/novox/mesh-controller/examples/objectstore-provisioner 1.023s
ok github.com/novox/mesh-controller/examples/postgres-provisioner 1.031s
ok github.com/novox/mesh-controller/examples/redis-provisioner 1.022s
ok github.com/novox/mesh-controller/examples/route-proxy 1.136s
ok github.com/novox/mesh-controller/internal/artifacts 1.065s
? github.com/novox/mesh-controller/internal/beside [no test files]
ok github.com/novox/mesh-controller/internal/broker 4.794s
ok github.com/novox/mesh-controller/internal/builder 50.360s
ok github.com/novox/mesh-controller/internal/catalogue 9.403s
ok github.com/novox/mesh-controller/internal/conditions 2.613s
ok github.com/novox/mesh-controller/internal/envfile 1.032s
ok github.com/novox/mesh-controller/internal/facts 1.037s
ok github.com/novox/mesh-controller/internal/identity 9.267s
ok github.com/novox/mesh-controller/internal/inventory 50.249s
ok github.com/novox/mesh-controller/internal/lease 17.705s
ok github.com/novox/mesh-controller/internal/licences 4.836s
ok github.com/novox/mesh-controller/internal/licences/adapters 1.014s
ok github.com/novox/mesh-controller/internal/link 65.491s
ok github.com/novox/mesh-controller/internal/lint 2.582s
ok github.com/novox/mesh-controller/internal/outward 1.040s
ok github.com/novox/mesh-controller/internal/overlay 1.034s
ok github.com/novox/mesh-controller/internal/secrets 1.529s
ok github.com/novox/mesh-controller/internal/store 4.571s
ok github.com/novox/mesh-controller/internal/testbus 1.260s
ok github.com/novox/mesh-controller/internal/token 1.019s
store tests, each run against the store:
./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeWalksTheOthersAgain (0.30s)
./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeEndsTheMergesThatContainIt (0.25s)
./cmd/mesh-controller --- PASS: TestAStopWalksTheOthersAgainInTheOpenBatch (0.25s)
./cmd/mesh-controller --- PASS: TestAStopNamesWhatStaysOnTheMachinesAndWhatStillCarriesIt (0.24s)
./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeLeavesItOutOfABatch (0.24s)
./cmd/mesh-controller --- PASS: TestSavingPlansAndMovingMergesIsOneAct (0.23s)
./cmd/mesh-controller --- PASS: TestAPlanFollowedFromTheStoreAnswersWhenItMoves (2.10s)
./cmd/mesh-controller --- PASS: TestNodeShowAndStatusReadTheLastSendFromTheStore (0.29s)
./cmd/mesh-controller --- PASS: TestTheConditionsVerbReadsTheLooksTheBucketNoLongerHolds (0.14s)
./cmd/mesh-controller --- PASS: TestAWalkLetGoAndStoppedByVerbsIsSaidStartedAndEnded (0.28s)
./cmd/mesh-controller --- PASS: TestAWalkStoppedOrClosedByAPersonIsSaidEndedStopped (0.26s)
./cmd/mesh-controller --- PASS: TestAWalkRetriedByAPersonIsSaidStartedAgain (0.22s)
./cmd/mesh-controller --- PASS: TestABacklogReleasedByAPersonIsSaidStarted (0.22s)
./cmd/mesh-controller --- PASS: TestAWalkEndedByCancelOrClearIsSaidEnded (0.29s)
./cmd/mesh-controller --- PASS: TestAWalkRestartedByARebuildIsSaidStarted (0.23s)
./cmd/mesh-controller --- PASS: TestAWalkStoppedByHandAndRetriedEndsFailedWhenItFailsAgain (0.35s)
./cmd/mesh-controller --- PASS: TestReplay237 (0.24s)
./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeUnresolvedSaysSoOnceInItsAnswer (0.23s)
./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeResolvedSaysNothingOfIt (0.56s)
./cmd/mesh-controller --- PASS: TestAnAssignThatLeavesItsNodeUnresolvedSaysOnlyThePlansRefusal (0.49s)
./cmd/mesh-controller --- PASS: TestADirectoryOwnersKeyIsRefusedThroughAVerb (0.26s)
./cmd/mesh-controller --- PASS: TestTheSendMakesNoValueForAnOutsideSecretNobodyGave (0.64s)
./cmd/mesh-controller --- PASS: TestAQuestionComposesWithoutAnOutsideSecretNobodyGave (0.95s)
./cmd/mesh-controller --- PASS: TestReplay201 (0.19s)
./cmd/mesh-controller --- PASS: TestARollbackWhoseSendWasRefusedIsCompletedByTheNextSend (0.17s)
./cmd/mesh-controller --- PASS: TestAGateJudgesTheOtherMovesBesideAKeptCore (0.17s)
./cmd/mesh-controller --- PASS: TestReplay401 (0.36s)
./cmd/mesh-controller --- PASS: TestReplay201ThePlansSend (0.29s)
./internal/inventory --- PASS: TestTheLastSendSaysWhatTheMachineAnswered (0.09s)
./internal/inventory --- PASS: TestAReportIsTheLastSendsAnswerOnlyWhenItIsAboutThatSend (0.10s)
./internal/inventory --- PASS: TestAnIssuedValueIsSealedToEveryHolderOnceAndNotAgain (0.15s)
./internal/inventory --- PASS: TestAnIssuedValueIsSealedAgainAfterAKeyChangeOrAnAcceptance (0.10s)
./internal/inventory --- PASS: TestAConditionsLooksAreKeptBesideTheBucket (0.08s)
./internal/inventory --- PASS: TestAPlanIdHoldingAQuoteIsReadAsAPlainId (0.08s)
./internal/inventory --- PASS: TestAWalksStartIsKeptAndARefusedSaveLeavesItUnsaid (0.07s)
./internal/inventory --- PASS: TestAWalksRestIsReadFromEachMachinesOwnSend (0.09s)
```
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Issue: novox/hq issue 594 (a send that recreates a build agent kills the build it is running).
after: none (one repository)
This is the part of 594 that needs no decision: an interrupted build is never silently redelivered any more. The agent that takes an ask handed out again (JetStream's delivery count > 1) says so:
delivery, and the build's log gets arestartedline;delivery;checkedOfprefixes the summary and both layers' summaries (the lines the pull request shows for mesh/merge-gate and mesh/repo-check) with "restarted: handed out N times — an earlier build agent took it and did not finish, most often because it was replaced mid-build, so it ran again from the start";delivery.The drain itself (the agent finishing its build before it is replaced) is not here: the node-engine replaces a container with
docker rm -f, a SIGKILL with no stop timeout, so the agent never hears a SIGTERM. That needs a decision; the options are on issue 594.Tests (fail on main: the fields do not exist):
gofmt, go vet, go test -race on internal/link, cmd/mesh-controller, cmd/mesh-builder: green.
Rollout: rebuilds build-agent (all four machines) and the controller. A build agent from before reads no delivery and says nothing extra; a controller from before ignores the field. No order needed.
Delivery
novox/mesh-controller@ee1d7e5cae12— delivered since 2026-10-12T23:06:22ZDelivery plan — builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step
Machines
Transitions
The commit's note under
refs/notes/mesh-plankeeps every transition:git log --notes=mesh-plan.Merge check at
ee1d7e5cJudged: head
ee1d7e5cae12merged into trunk56d6313262e8; read beside it: mesh-catalog43a9155d5afe, mesh-controller-main56d6313262e8, mesh-host8e95c1d9ed2d, mesh-tools954e1a53eef9mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller)mesh/repo-check: PASS — its merge-check.sh passedDelivery plan — builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step
Run by the build seat on ace as
build-1791844351702165471(builds --log build-1791844351702165471).Merge check at
43cab564Judged: head
43cab564523dmerged into trunk56d6313262e8; read beside it: mesh-catalog43a9155d5afe, mesh-controller-main56d6313262e8, mesh-host8e95c1d9ed2d, mesh-tools954e1a53eef9mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)mesh/repo-check: PASS — its merge-check.sh passedDelivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
Run by the build seat on novox as
build-1791843987312935971(builds --log build-1791843987312935971).