What. In a walk's tier, a build made from the source every machine running it runs (issue 280) is marked no move: SentAt is set to now and nothing is sent. The wait that gates the next tier then asked each machine running the module for a report at or after max(BuiltAt, SentAt). Nothing was sent, so no report follows, and a machine that does not report again for another reason held the walk for ever. Seen live in plan-1791919354338134213 (mesh-controller #304), tier 1 waiting on build-agent on g14 and shanks.
Fix. In the tier's wait, a module the plan marked no move (its Why says "no move", no first send, no gate) is judged per machine by the send that last carried its build: the machine runs it once its last report is at or after its last send (Reported.Sent). That is the send whose builds made it no move (unchangedOnEvery reads each machine's last send). A machine that has not answered its last send is still waited on. The mark is read from Why, so a plan kept by the controller now running (such as the stuck walk) is read the same; the text is now a constant, noMoveWhy.
Tested. New store test TestANoMoveTierWaitsForNoNewReport (listed in testdata/store-tests): a two-tier plan whose first tier is the build machine, no move on anchor and laptop, both having answered their last send before the build. On main it fails with tier 0, rolling "tier 0 built; waiting for app on anchor, laptop to be applied"; with the fix the walk asks tier 1 in the same step. Its second half shows a machine whose last send is unanswered is still waited on. go test ./cmd/mesh-controller against a throwaway store passes; go vet clean.
Fixes issue 648.
**What.** In a walk's tier, a build made from the source every machine running it runs (issue 280) is marked no move: `SentAt` is set to now and nothing is sent. The wait that gates the next tier then asked each machine running the module for a report at or after max(BuiltAt, SentAt). Nothing was sent, so no report follows, and a machine that does not report again for another reason held the walk for ever. Seen live in plan-1791919354338134213 (mesh-controller #304), tier 1 waiting on build-agent on g14 and shanks.
**Fix.** In the tier's wait, a module the plan marked no move (its `Why` says "no move", no first send, no gate) is judged per machine by the send that last carried its build: the machine runs it once its last report is at or after its last send (`Reported.Sent`). That is the send whose builds made it no move (`unchangedOnEvery` reads each machine's last send). A machine that has not answered its last send is still waited on. The mark is read from `Why`, so a plan kept by the controller now running (such as the stuck walk) is read the same; the text is now a constant, `noMoveWhy`.
**Tested.** New store test `TestANoMoveTierWaitsForNoNewReport` (listed in testdata/store-tests): a two-tier plan whose first tier is the build machine, no move on anchor and laptop, both having answered their last send before the build. On main it fails with `tier 0, rolling "tier 0 built; waiting for app on anchor, laptop to be applied"`; with the fix the walk asks tier 1 in the same step. Its second half shows a machine whose last send is unanswered is still waited on. `go test ./cmd/mesh-controller` against a throwaway store passes; `go vet` clean.
Deliverynovox/mesh-controller@70885ab3c4a3 — delivered since 2026-10-14T00:36:03Z
Delivery plan — builds mesh-controller → novox; no bus step
tier 0: mesh-controller
novox: receives mesh-controller
Machines
mesh-controller on novox: passed — healthy 1 times over 1m57s, by the controller's rule: one reading once it is ready, after the node-engine's witness window (novox/hq ADR 0351)
mesh-controller on the rest running it: sent
Transitions
2026-10-14 00:22 (new) → proposed (announced): novox/mesh-controller#309's head announced
2026-10-14 00:27 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
2026-10-14 00:27 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
2026-10-14 00:32 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
2026-10-14 00:32 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
2026-10-14 00:36 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says
The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.
<!-- mesh-delivery:view -->
**Delivery** `novox/mesh-controller@70885ab3c4a3` — **delivered** since 2026-10-14T00:36:03Z
**Delivery plan** — builds mesh-controller → novox; no bus step
- tier 0: mesh-controller
- novox: receives mesh-controller
**Machines**
- mesh-controller on novox: passed — healthy 1 times over 1m57s, by the controller's rule: one reading once it is ready, after the node-engine's witness window (novox/hq ADR 0351)
- mesh-controller on the rest running it: sent
**Transitions**
- 2026-10-14 00:22 (new) → proposed (announced): novox/mesh-controller#309's head announced
- 2026-10-14 00:27 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
- 2026-10-14 00:27 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
- 2026-10-14 00:32 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
- 2026-10-14 00:32 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
- 2026-10-14 00:36 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says
The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.
Merge check at c877a826
Judged: head c877a8267eb9 merged into trunk bff5b7f0e4f8; read beside it: mesh-catalog 7ed119995f69, mesh-controller-main bff5b7f0e4f8, mesh-host 0e92ef3d1b21, mesh-tools 954e1a53eef9
mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-controller, route-proxy)
mesh/repo-check: PASS — its merge-check.sh passed
Delivery plan — builds mesh-controller, route-proxy → ace, novox; no bus step
tier 0: mesh-controller, route-proxy
ace: receives route-proxy
novox: receives mesh-controller, route-proxy
route-proxy provides route: its consumers are sent again after it
route-proxy keeps data (ADR 0233): what it holds is backed up before it moves
grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before route-proxy is judged on its first machine
Run by the build seat on shanks as build-1791921638316140191 (builds --log build-1791921638316140191).
--- the gate: mesh-controller, route-proxy
mesh-controller: ok, 58 tool(s); WARNING: merge-window ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
long-running resources without health: 1
files asking for a setting without saying whether it is trusted: 1
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-13T19:37:05Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-13T19:37:05Z
modules the change moves:
- mesh-controller (changed)
machines:
- a machine (f35): composes
- holds mesh-dns-resolver (idt): composes
- holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
- a machine (yvbpsm): composes
a merge would rebuild 2 module(s) in 1 tier(s): mesh-controller, route-proxy
--- its merge-check.sh (go toolchain)
ok github.com/novox/mesh-controller/cmd/mesh-builder 1.044s
ok github.com/novox/mesh-controller/cmd/mesh-controller 192.271s
ok github.com/novox/mesh-controller/examples/objectstore-provisioner 1.054s
ok github.com/novox/mesh-controller/examples/postgres-provisioner 1.045s
ok github.com/novox/mesh-controller/examples/redis-provisioner 1.023s
ok github.com/novox/mesh-controller/examples/route-proxy 1.209s
ok github.com/novox/mesh-controller/internal/artifacts 1.095s
? github.com/novox/mesh-controller/internal/beside [no test files]
ok github.com/novox/mesh-controller/internal/broker 4.591s
ok github.com/novox/mesh-controller/internal/builder 49.715s
ok github.com/novox/mesh-controller/internal/catalogue 8.893s
ok github.com/novox/mesh-controller/internal/conditions 2.704s
ok github.com/novox/mesh-controller/internal/envfile 1.063s
ok github.com/novox/mesh-controller/internal/facts 1.061s
ok github.com/novox/mesh-controller/internal/identity 5.169s
ok github.com/novox/mesh-controller/internal/inventory 44.370s
ok github.com/novox/mesh-controller/internal/lease 17.743s
ok github.com/novox/mesh-controller/internal/licences 4.270s
ok github.com/novox/mesh-controller/internal/licences/adapters 1.056s
ok github.com/novox/mesh-controller/internal/link 63.727s
ok github.com/novox/mesh-controller/internal/lint 2.555s
ok github.com/novox/mesh-controller/internal/outward 1.099s
ok github.com/novox/mesh-controller/internal/overlay 1.074s
ok github.com/novox/mesh-controller/internal/secrets 1.554s
ok github.com/novox/mesh-controller/internal/store 3.491s
ok github.com/novox/mesh-controller/internal/testbus 1.256s
ok github.com/novox/mesh-controller/internal/token 1.018s
store tests, each run against the store:
./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeWalksTheOthersAgain (0.22s)
./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeEndsTheMergesThatContainIt (0.24s)
./cmd/mesh-controller --- PASS: TestAStopWalksTheOthersAgainInTheOpenBatch (0.23s)
./cmd/mesh-controller --- PASS: TestAStopNamesWhatStaysOnTheMachinesAndWhatStillCarriesIt (0.22s)
./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeLeavesItOutOfABatch (0.21s)
./cmd/mesh-controller --- PASS: TestSavingPlansAndMovingMergesIsOneAct (0.18s)
./cmd/mesh-controller --- PASS: TestAPlanFollowedFromTheStoreAnswersWhenItMoves (1.98s)
./cmd/mesh-controller --- PASS: TestNodeShowAndStatusReadTheLastSendFromTheStore (0.25s)
./cmd/mesh-controller --- PASS: TestTheConditionsVerbReadsTheLooksTheBucketNoLongerHolds (0.14s)
./cmd/mesh-controller --- PASS: TestAWalkLetGoAndStoppedByVerbsIsSaidStartedAndEnded (0.27s)
./cmd/mesh-controller --- PASS: TestAWalkStoppedOrClosedByAPersonIsSaidEndedStopped (0.25s)
./cmd/mesh-controller --- PASS: TestAWalkRetriedByAPersonIsSaidStartedAgain (0.22s)
./cmd/mesh-controller --- PASS: TestABacklogReleasedByAPersonIsSaidStarted (0.22s)
./cmd/mesh-controller --- PASS: TestAWalkEndedByCancelOrClearIsSaidEnded (0.28s)
./cmd/mesh-controller --- PASS: TestAWalkRestartedByARebuildIsSaidStarted (0.22s)
./cmd/mesh-controller --- PASS: TestAWalkStoppedByHandAndRetriedEndsFailedWhenItFailsAgain (0.26s)
./cmd/mesh-controller --- PASS: TestReplay237 (0.21s)
./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeUnresolvedSaysSoOnceInItsAnswer (0.21s)
./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeResolvedSaysNothingOfIt (0.22s)
./cmd/mesh-controller --- PASS: TestAnAssignThatLeavesItsNodeUnresolvedSaysOnlyThePlansRefusal (0.21s)
./cmd/mesh-controller --- PASS: TestADirectoryOwnersKeyIsRefusedThroughAVerb (0.24s)
./cmd/mesh-controller --- PASS: TestTheSendMakesNoValueForAnOutsideSecretNobodyGave (0.31s)
./cmd/mesh-controller --- PASS: TestAQuestionComposesWithoutAnOutsideSecretNobodyGave (0.29s)
./cmd/mesh-controller --- PASS: TestReplay201 (0.17s)
./cmd/mesh-controller --- PASS: TestARollbackWhoseSendWasRefusedIsCompletedByTheNextSend (0.16s)
./cmd/mesh-controller --- PASS: TestAGateJudgesTheOtherMovesBesideAKeptCore (0.16s)
./cmd/mesh-controller --- PASS: TestReplay401 (0.30s)
./cmd/mesh-controller --- PASS: TestReplay201ThePlansSend (0.24s)
./cmd/mesh-controller --- PASS: TestPlanAndNodeListAnOptionalRequirementLeftUnbound (0.31s)
./cmd/mesh-controller --- PASS: TestReplay340 (0.25s)
./cmd/mesh-controller --- PASS: TestOnlyATrustedFilesNamedKeyIsRefusedThroughAVerb (0.21s)
./cmd/mesh-controller --- PASS: TestReplay349 (0.21s)
./cmd/mesh-controller --- PASS: TestReplay348AFaultFromBeforeTheSendFailsNoGate (0.19s)
./cmd/mesh-controller --- PASS: TestReplay239AModuleNameIsNotTakenOverByAnotherRepository (0.16s)
./cmd/mesh-controller --- PASS: TestAWalkThatMovedNothingSaysWhichModulesMatchedWhatRuns (0.20s)
./cmd/mesh-controller --- PASS: TestReplay614ANewSDKPlansTheToolchainAndThenItsBundles (0.08s)
./cmd/mesh-controller --- PASS: TestOneAcceptForAProviderIsPlacedForEveryConsumer (0.49s)
./cmd/mesh-controller --- PASS: TestReplay164 (0.30s)
./cmd/mesh-controller --- PASS: TestAnApprovedLayerOpensTheWalkThatSendsIt (0.21s)
./cmd/mesh-controller --- PASS: TestASettingsWalkSendsOneMachineAtATimeEachJudged (0.31s)
./cmd/mesh-controller --- PASS: TestAFailedSettingsWalkStopsAndHoldsNothingBack (0.20s)
./cmd/mesh-controller --- PASS: TestASettingsWalkSendsTheLayerAloneEveryBuildKept (0.20s)
./cmd/mesh-controller --- PASS: TestASettingsWalkStopsBeforeADataMoveAndPassesOverAMachineAway (0.58s)
./cmd/mesh-controller --- PASS: TestACrossingSendSupersedesASettingsGate (0.18s)
./cmd/mesh-controller --- PASS: TestASettingsWalkFailsOnARefusalThatCannotClear (0.19s)
./cmd/mesh-controller --- PASS: TestAProviderElsewhereServesItsOwnComposedName (0.24s)
./cmd/mesh-controller --- PASS: TestANoMoveTierWaitsForNoNewReport (0.23s)
./internal/inventory --- PASS: TestTheLastSendSaysWhatTheMachineAnswered (0.09s)
./internal/inventory --- PASS: TestAReportIsTheLastSendsAnswerOnlyWhenItIsAboutThatSend (0.09s)
./internal/inventory --- PASS: TestAnIssuedValueIsSealedToEveryHolderOnceAndNotAgain (0.10s)
./internal/inventory --- PASS: TestAnIssuedValueIsSealedAgainAfterAKeyChangeOrAnAcceptance (0.09s)
./internal/inventory --- PASS: TestAConditionsLooksAreKeptBesideTheBucket (0.07s)
./internal/inventory --- PASS: TestAPlanIdHoldingAQuoteIsReadAsAPlainId (0.07s)
./internal/inventory --- PASS: TestAWalksStartIsKeptAndARefusedSaveLeavesItUnsaid (0.07s)
./internal/inventory --- PASS: TestAWalksRestIsReadFromEachMachinesOwnSend (0.08s)
./internal/inventory --- PASS: TestAStoredBuildWithASilentMergeableFileIsStillReadAndComposed (0.07s)
./internal/inventory --- PASS: TestACredentialIssuedOutsideIsNeverMade (0.09s)
./internal/inventory --- PASS: TestOneAcceptForAProviderIsSealedToEveryConsumer (0.09s)
./internal/inventory --- PASS: TestASharedOwnSecretIssuedOutsideIsNeverMade (0.08s)
**Merge check** at `c877a826`
Judged: head `c877a8267eb9` merged into trunk `bff5b7f0e4f8`; read beside it: mesh-catalog `7ed119995f69`, mesh-controller-main `bff5b7f0e4f8`, mesh-host `0e92ef3d1b21`, mesh-tools `954e1a53eef9`
- `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-controller, route-proxy)
- `mesh/repo-check`: **PASS** — its merge-check.sh passed
**Delivery plan** — builds mesh-controller, route-proxy → ace, novox; no bus step
- tier 0: mesh-controller, route-proxy
- ace: receives route-proxy
- novox: receives mesh-controller, route-proxy
- route-proxy provides route: its consumers are sent again after it
- route-proxy keeps data (ADR 0233): what it holds is backed up before it moves
- grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before route-proxy is judged on its first machine
Run by the build seat on shanks as `build-1791921638316140191` (`builds --log build-1791921638316140191`).
```
--- the gate: mesh-controller, route-proxy
mesh-controller: ok, 58 tool(s); WARNING: merge-window ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
long-running resources without health: 1
files asking for a setting without saying whether it is trusted: 1
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-13T19:37:05Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-13T19:37:05Z
modules the change moves:
- mesh-controller (changed)
machines:
- a machine (f35): composes
- holds mesh-dns-resolver (idt): composes
- holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
- a machine (yvbpsm): composes
a merge would rebuild 2 module(s) in 1 tier(s): mesh-controller, route-proxy
--- its merge-check.sh (go toolchain)
ok github.com/novox/mesh-controller/cmd/mesh-builder 1.044s
ok github.com/novox/mesh-controller/cmd/mesh-controller 192.271s
ok github.com/novox/mesh-controller/examples/objectstore-provisioner 1.054s
ok github.com/novox/mesh-controller/examples/postgres-provisioner 1.045s
ok github.com/novox/mesh-controller/examples/redis-provisioner 1.023s
ok github.com/novox/mesh-controller/examples/route-proxy 1.209s
ok github.com/novox/mesh-controller/internal/artifacts 1.095s
? github.com/novox/mesh-controller/internal/beside [no test files]
ok github.com/novox/mesh-controller/internal/broker 4.591s
ok github.com/novox/mesh-controller/internal/builder 49.715s
ok github.com/novox/mesh-controller/internal/catalogue 8.893s
ok github.com/novox/mesh-controller/internal/conditions 2.704s
ok github.com/novox/mesh-controller/internal/envfile 1.063s
ok github.com/novox/mesh-controller/internal/facts 1.061s
ok github.com/novox/mesh-controller/internal/identity 5.169s
ok github.com/novox/mesh-controller/internal/inventory 44.370s
ok github.com/novox/mesh-controller/internal/lease 17.743s
ok github.com/novox/mesh-controller/internal/licences 4.270s
ok github.com/novox/mesh-controller/internal/licences/adapters 1.056s
ok github.com/novox/mesh-controller/internal/link 63.727s
ok github.com/novox/mesh-controller/internal/lint 2.555s
ok github.com/novox/mesh-controller/internal/outward 1.099s
ok github.com/novox/mesh-controller/internal/overlay 1.074s
ok github.com/novox/mesh-controller/internal/secrets 1.554s
ok github.com/novox/mesh-controller/internal/store 3.491s
ok github.com/novox/mesh-controller/internal/testbus 1.256s
ok github.com/novox/mesh-controller/internal/token 1.018s
store tests, each run against the store:
./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeWalksTheOthersAgain (0.22s)
./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeEndsTheMergesThatContainIt (0.24s)
./cmd/mesh-controller --- PASS: TestAStopWalksTheOthersAgainInTheOpenBatch (0.23s)
./cmd/mesh-controller --- PASS: TestAStopNamesWhatStaysOnTheMachinesAndWhatStillCarriesIt (0.22s)
./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeLeavesItOutOfABatch (0.21s)
./cmd/mesh-controller --- PASS: TestSavingPlansAndMovingMergesIsOneAct (0.18s)
./cmd/mesh-controller --- PASS: TestAPlanFollowedFromTheStoreAnswersWhenItMoves (1.98s)
./cmd/mesh-controller --- PASS: TestNodeShowAndStatusReadTheLastSendFromTheStore (0.25s)
./cmd/mesh-controller --- PASS: TestTheConditionsVerbReadsTheLooksTheBucketNoLongerHolds (0.14s)
./cmd/mesh-controller --- PASS: TestAWalkLetGoAndStoppedByVerbsIsSaidStartedAndEnded (0.27s)
./cmd/mesh-controller --- PASS: TestAWalkStoppedOrClosedByAPersonIsSaidEndedStopped (0.25s)
./cmd/mesh-controller --- PASS: TestAWalkRetriedByAPersonIsSaidStartedAgain (0.22s)
./cmd/mesh-controller --- PASS: TestABacklogReleasedByAPersonIsSaidStarted (0.22s)
./cmd/mesh-controller --- PASS: TestAWalkEndedByCancelOrClearIsSaidEnded (0.28s)
./cmd/mesh-controller --- PASS: TestAWalkRestartedByARebuildIsSaidStarted (0.22s)
./cmd/mesh-controller --- PASS: TestAWalkStoppedByHandAndRetriedEndsFailedWhenItFailsAgain (0.26s)
./cmd/mesh-controller --- PASS: TestReplay237 (0.21s)
./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeUnresolvedSaysSoOnceInItsAnswer (0.21s)
./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeResolvedSaysNothingOfIt (0.22s)
./cmd/mesh-controller --- PASS: TestAnAssignThatLeavesItsNodeUnresolvedSaysOnlyThePlansRefusal (0.21s)
./cmd/mesh-controller --- PASS: TestADirectoryOwnersKeyIsRefusedThroughAVerb (0.24s)
./cmd/mesh-controller --- PASS: TestTheSendMakesNoValueForAnOutsideSecretNobodyGave (0.31s)
./cmd/mesh-controller --- PASS: TestAQuestionComposesWithoutAnOutsideSecretNobodyGave (0.29s)
./cmd/mesh-controller --- PASS: TestReplay201 (0.17s)
./cmd/mesh-controller --- PASS: TestARollbackWhoseSendWasRefusedIsCompletedByTheNextSend (0.16s)
./cmd/mesh-controller --- PASS: TestAGateJudgesTheOtherMovesBesideAKeptCore (0.16s)
./cmd/mesh-controller --- PASS: TestReplay401 (0.30s)
./cmd/mesh-controller --- PASS: TestReplay201ThePlansSend (0.24s)
./cmd/mesh-controller --- PASS: TestPlanAndNodeListAnOptionalRequirementLeftUnbound (0.31s)
./cmd/mesh-controller --- PASS: TestReplay340 (0.25s)
./cmd/mesh-controller --- PASS: TestOnlyATrustedFilesNamedKeyIsRefusedThroughAVerb (0.21s)
./cmd/mesh-controller --- PASS: TestReplay349 (0.21s)
./cmd/mesh-controller --- PASS: TestReplay348AFaultFromBeforeTheSendFailsNoGate (0.19s)
./cmd/mesh-controller --- PASS: TestReplay239AModuleNameIsNotTakenOverByAnotherRepository (0.16s)
./cmd/mesh-controller --- PASS: TestAWalkThatMovedNothingSaysWhichModulesMatchedWhatRuns (0.20s)
./cmd/mesh-controller --- PASS: TestReplay614ANewSDKPlansTheToolchainAndThenItsBundles (0.08s)
./cmd/mesh-controller --- PASS: TestOneAcceptForAProviderIsPlacedForEveryConsumer (0.49s)
./cmd/mesh-controller --- PASS: TestReplay164 (0.30s)
./cmd/mesh-controller --- PASS: TestAnApprovedLayerOpensTheWalkThatSendsIt (0.21s)
./cmd/mesh-controller --- PASS: TestASettingsWalkSendsOneMachineAtATimeEachJudged (0.31s)
./cmd/mesh-controller --- PASS: TestAFailedSettingsWalkStopsAndHoldsNothingBack (0.20s)
./cmd/mesh-controller --- PASS: TestASettingsWalkSendsTheLayerAloneEveryBuildKept (0.20s)
./cmd/mesh-controller --- PASS: TestASettingsWalkStopsBeforeADataMoveAndPassesOverAMachineAway (0.58s)
./cmd/mesh-controller --- PASS: TestACrossingSendSupersedesASettingsGate (0.18s)
./cmd/mesh-controller --- PASS: TestASettingsWalkFailsOnARefusalThatCannotClear (0.19s)
./cmd/mesh-controller --- PASS: TestAProviderElsewhereServesItsOwnComposedName (0.24s)
./cmd/mesh-controller --- PASS: TestANoMoveTierWaitsForNoNewReport (0.23s)
./internal/inventory --- PASS: TestTheLastSendSaysWhatTheMachineAnswered (0.09s)
./internal/inventory --- PASS: TestAReportIsTheLastSendsAnswerOnlyWhenItIsAboutThatSend (0.09s)
./internal/inventory --- PASS: TestAnIssuedValueIsSealedToEveryHolderOnceAndNotAgain (0.10s)
./internal/inventory --- PASS: TestAnIssuedValueIsSealedAgainAfterAKeyChangeOrAnAcceptance (0.09s)
./internal/inventory --- PASS: TestAConditionsLooksAreKeptBesideTheBucket (0.07s)
./internal/inventory --- PASS: TestAPlanIdHoldingAQuoteIsReadAsAPlainId (0.07s)
./internal/inventory --- PASS: TestAWalksStartIsKeptAndARefusedSaveLeavesItUnsaid (0.07s)
./internal/inventory --- PASS: TestAWalksRestIsReadFromEachMachinesOwnSend (0.08s)
./internal/inventory --- PASS: TestAStoredBuildWithASilentMergeableFileIsStillReadAndComposed (0.07s)
./internal/inventory --- PASS: TestACredentialIssuedOutsideIsNeverMade (0.09s)
./internal/inventory --- PASS: TestOneAcceptForAProviderIsSealedToEveryConsumer (0.09s)
./internal/inventory --- PASS: TestASharedOwnSecretIssuedOutsideIsNeverMade (0.08s)
```
Verdict: the fix is sound, but this pull request does not merge: rebase it on main (ca3f43c4) and resolve the conflict in testdata/store-tests, then recheck.
Reviewed at head c877a826 (unchanged since it was asked for).
A send still in flight cannot let a tier pass. For a no-move module each machine is asked for a report at or after its own last send (node.sent_at). A send after the last report keeps the machine waiting. The second half of the test shows this ("waiting for app on laptop"). Both times come from the store's clock: node_report.at is the store's now(), and sent_at is set by the controller's store too, so machine clock skew does not enter. A machine that was never sent anything and has reported counts as running, which is right, because no-move means it already runs that build's source. One residual: the report is judged by its time, not by Current (whether it names the last declaration). That is the same rule the ordinary path already uses (issue 256), so it is not a regression.
Spoofing the mark. PlanModule.Why is written only by the controller, inside release_plan.go, gate.go and plan_retry.go. No other writer starts it with "no move", and plan_retry clears Why on a retry. noMove also requires FirstAt == nil and Gate == nil, so a module that was sent or gated after being marked is never read as no move. Nothing outside the controller writes plans.
Rewording. noMove matches the literal prefix "no move", not noMoveWhy. If noMoveWhy is reworded to start differently, the code would drift. I checked this: with noMoveWhy reworded to "unchanged: ...", TestANoMoveTierWaitsForNoNewReport fails, so the reword cannot pass silently. A small suggestion, which does not block: define const noMovePrefix = "no move" and build noMoveWhy from it, so the writer and the reader share one string.
Plans the running controller already saved carry exactly the old text "no move: made from the source every machine running it runs", which noMoveWhy repeats word for word. The stuck walk is therefore read the same way after the upgrade.
The test fails on main. With main's release_plan.go in a merged tree, TestANoMoveTierWaitsForNoNewReport fails at issue648_test.go:71 with: tier 0, rolling "tier 0 built; waiting for app on anchor, laptop to be applied". With the fix it passes.
Merging into main ca3f43c4. git merge conflicts in testdata/store-tests only. Main appended ten store tests (from #312 and others) at the same place. Keeping both sides resolves it, and release_plan.go merges on its own. The forge says mergeable: false. On the resolved merged tree, sh merge-check.sh passed (exit 0, run niced with MESH_TEST_POSTGRES pointing at a throwaway postgres), and every listed store test passed, including the new one. #312's FirstAt and Rest changes do not touch the no-move path: line 1447 still skips it, because SentAt is set.
Checks at c877a826, as mesh-delivery.checks reports them:
mesh/merge-gate: pending. "out of date: judged against trunk bff5b7f0e4, the trunk is now 372faebf2824". The earlier verdict was "PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-controller, route-proxy)".
mesh/repo-check: pending. Same out-of-date note. The earlier verdict was "PASS — its merge-check.sh passed".
mesh/delivery: pending. "checking"; proposed: waits for its check.
Next step: rebase or merge main into the branch, keeping both sides of testdata/store-tests, and then ask mesh-delivery.recheck. Merge only on the new green verdicts.
Verdict: the fix is sound, but this pull request does not merge: rebase it on main (ca3f43c4) and resolve the conflict in testdata/store-tests, then recheck.
Reviewed at head c877a826 (unchanged since it was asked for).
1. A send still in flight cannot let a tier pass. For a no-move module each machine is asked for a report at or after its own last send (node.sent_at). A send after the last report keeps the machine waiting. The second half of the test shows this ("waiting for app on laptop"). Both times come from the store's clock: node_report.at is the store's now(), and sent_at is set by the controller's store too, so machine clock skew does not enter. A machine that was never sent anything and has reported counts as running, which is right, because no-move means it already runs that build's source. One residual: the report is judged by its time, not by Current (whether it names the last declaration). That is the same rule the ordinary path already uses (issue 256), so it is not a regression.
2. Spoofing the mark. PlanModule.Why is written only by the controller, inside release_plan.go, gate.go and plan_retry.go. No other writer starts it with "no move", and plan_retry clears Why on a retry. noMove also requires FirstAt == nil and Gate == nil, so a module that was sent or gated after being marked is never read as no move. Nothing outside the controller writes plans.
3. Rewording. noMove matches the literal prefix "no move", not noMoveWhy. If noMoveWhy is reworded to start differently, the code would drift. I checked this: with noMoveWhy reworded to "unchanged: ...", TestANoMoveTierWaitsForNoNewReport fails, so the reword cannot pass silently. A small suggestion, which does not block: define const noMovePrefix = "no move" and build noMoveWhy from it, so the writer and the reader share one string.
4. Plans the running controller already saved carry exactly the old text "no move: made from the source every machine running it runs", which noMoveWhy repeats word for word. The stuck walk is therefore read the same way after the upgrade.
5. The test fails on main. With main's release_plan.go in a merged tree, TestANoMoveTierWaitsForNoNewReport fails at issue648_test.go:71 with: tier 0, rolling "tier 0 built; waiting for app on anchor, laptop to be applied". With the fix it passes.
6. Merging into main ca3f43c4. git merge conflicts in testdata/store-tests only. Main appended ten store tests (from #312 and others) at the same place. Keeping both sides resolves it, and release_plan.go merges on its own. The forge says mergeable: false. On the resolved merged tree, sh merge-check.sh passed (exit 0, run niced with MESH_TEST_POSTGRES pointing at a throwaway postgres), and every listed store test passed, including the new one. #312's FirstAt and Rest changes do not touch the no-move path: line 1447 still skips it, because SentAt is set.
Checks at c877a826, as mesh-delivery.checks reports them:
mesh/merge-gate: pending. "out of date: judged against trunk bff5b7f0e4f8, the trunk is now 372faebf2824". The earlier verdict was "PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-controller, route-proxy)".
mesh/repo-check: pending. Same out-of-date note. The earlier verdict was "PASS — its merge-check.sh passed".
mesh/delivery: pending. "checking"; proposed: waits for its check.
Next step: rebase or merge main into the branch, keeping both sides of testdata/store-tests, and then ask mesh-delivery.recheck. Merge only on the new green verdicts.
A build made from the source every machine running it runs is marked sent
and sent nothing, yet the tier's wait asked each machine for a report after
that marking. None follows, and the walk waited for ever. Each machine is
now judged by whether it answered its last send, the one whose builds made
the build no move.
mesh/merge-gate head 70885ab3c4a3 merged into trunk ca3f43c400ba — pass: builds mesh-controller → novox; no bus step; every machine composes with the chang…
Merge check at 70885ab3
Judged: head 70885ab3c4a3 merged into trunk ca3f43c400ba; read beside it: mesh-catalog ebf7f3773dc7, mesh-controller-main ca3f43c400ba, mesh-host 1a2677882380, mesh-tools 954e1a53eef9
mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-controller)
mesh/repo-check: PASS — its merge-check.sh passed
Delivery plan — builds mesh-controller → novox; no bus step
tier 0: mesh-controller
novox: receives mesh-controller
read by no module's build: cmd/mesh-controller/issue648_test.go, testdata/store-tests
Run by the build seat on ace as build-1791937373861169106 (builds --log build-1791937373861169106).
--- the gate: mesh-controller
mesh-controller: ok, 59 tool(s); WARNING: merge-window ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
long-running resources without health: 1
files asking for a setting without saying whether it is trusted: 1
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-13T23:54:14Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-13T23:54:14Z
modules the change moves:
- mesh-controller (changed)
machines:
- a machine (f35): composes
- holds mesh-dns-resolver (idt): composes
- holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
- a machine (yvbpsm): composes
a merge would rebuild 1 module(s) in 1 tier(s): mesh-controller
notes:
- cmd/mesh-controller/issue648_test.go and testdata/store-tests read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok github.com/novox/mesh-controller/cmd/mesh-builder 1.082s
ok github.com/novox/mesh-controller/cmd/mesh-controller 155.196s
ok github.com/novox/mesh-controller/examples/objectstore-provisioner 1.022s
ok github.com/novox/mesh-controller/examples/postgres-provisioner 1.044s
ok github.com/novox/mesh-controller/examples/redis-provisioner 1.031s
ok github.com/novox/mesh-controller/examples/route-proxy 1.132s
ok github.com/novox/mesh-controller/internal/artifacts 1.069s
? github.com/novox/mesh-controller/internal/beside [no test files]
ok github.com/novox/mesh-controller/internal/broker 3.983s
ok github.com/novox/mesh-controller/internal/builder 36.003s
ok github.com/novox/mesh-controller/internal/catalogue 7.487s
ok github.com/novox/mesh-controller/internal/conditions 2.501s
ok github.com/novox/mesh-controller/internal/envfile 1.039s
ok github.com/novox/mesh-controller/internal/facts 1.043s
ok github.com/novox/mesh-controller/internal/identity 4.268s
ok github.com/novox/mesh-controller/internal/inventory 33.153s
ok github.com/novox/mesh-controller/internal/lease 17.687s
ok github.com/novox/mesh-controller/internal/licences 3.491s
ok github.com/novox/mesh-controller/internal/licences/adapters 1.036s
ok github.com/novox/mesh-controller/internal/link 59.191s
ok github.com/novox/mesh-controller/internal/lint 2.269s
ok github.com/novox/mesh-controller/internal/outward 1.074s
ok github.com/novox/mesh-controller/internal/overlay 1.053s
ok github.com/novox/mesh-controller/internal/secrets 1.420s
ok github.com/novox/mesh-controller/internal/store 3.260s
ok github.com/novox/mesh-controller/internal/testbus 1.225s
ok github.com/novox/mesh-controller/internal/token 1.016s
store tests, each run against the store:
./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeWalksTheOthersAgain (0.19s)
./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeEndsTheMergesThatContainIt (0.21s)
./cmd/mesh-controller --- PASS: TestAStopWalksTheOthersAgainInTheOpenBatch (0.20s)
./cmd/mesh-controller --- PASS: TestAStopNamesWhatStaysOnTheMachinesAndWhatStillCarriesIt (0.19s)
./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeLeavesItOutOfABatch (0.18s)
./cmd/mesh-controller --- PASS: TestSavingPlansAndMovingMergesIsOneAct (0.16s)
./cmd/mesh-controller --- PASS: TestAPlanFollowedFromTheStoreAnswersWhenItMoves (1.95s)
./cmd/mesh-controller --- PASS: TestNodeShowAndStatusReadTheLastSendFromTheStore (0.21s)
./cmd/mesh-controller --- PASS: TestTheConditionsVerbReadsTheLooksTheBucketNoLongerHolds (0.11s)
./cmd/mesh-controller --- PASS: TestAWalkLetGoAndStoppedByVerbsIsSaidStartedAndEnded (0.23s)
./cmd/mesh-controller --- PASS: TestAWalkStoppedOrClosedByAPersonIsSaidEndedStopped (0.22s)
./cmd/mesh-controller --- PASS: TestAWalkRetriedByAPersonIsSaidStartedAgain (0.18s)
./cmd/mesh-controller --- PASS: TestABacklogReleasedByAPersonIsSaidStarted (0.19s)
./cmd/mesh-controller --- PASS: TestAWalkEndedByCancelOrClearIsSaidEnded (0.25s)
./cmd/mesh-controller --- PASS: TestAWalkRestartedByARebuildIsSaidStarted (0.19s)
./cmd/mesh-controller --- PASS: TestAWalkStoppedByHandAndRetriedEndsFailedWhenItFailsAgain (0.22s)
./cmd/mesh-controller --- PASS: TestReplay237 (0.18s)
./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeUnresolvedSaysSoOnceInItsAnswer (0.17s)
./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeResolvedSaysNothingOfIt (0.18s)
./cmd/mesh-controller --- PASS: TestAnAssignThatLeavesItsNodeUnresolvedSaysOnlyThePlansRefusal (0.18s)
./cmd/mesh-controller --- PASS: TestADirectoryOwnersKeyIsRefusedThroughAVerb (0.20s)
./cmd/mesh-controller --- PASS: TestTheSendMakesNoValueForAnOutsideSecretNobodyGave (0.26s)
./cmd/mesh-controller --- PASS: TestAQuestionComposesWithoutAnOutsideSecretNobodyGave (0.24s)
./cmd/mesh-controller --- PASS: TestReplay201 (0.14s)
./cmd/mesh-controller --- PASS: TestARollbackWhoseSendWasRefusedIsCompletedByTheNextSend (0.13s)
./cmd/mesh-controller --- PASS: TestAGateJudgesTheOtherMovesBesideAKeptCore (0.14s)
./cmd/mesh-controller --- PASS: TestReplay401 (0.26s)
./cmd/mesh-controller --- PASS: TestReplay201ThePlansSend (0.20s)
./cmd/mesh-controller --- PASS: TestPlanAndNodeListAnOptionalRequirementLeftUnbound (0.25s)
./cmd/mesh-controller --- PASS: TestReplay340 (0.22s)
./cmd/mesh-controller --- PASS: TestOnlyATrustedFilesNamedKeyIsRefusedThroughAVerb (0.17s)
./cmd/mesh-controller --- PASS: TestReplay349 (0.18s)
./cmd/mesh-controller --- PASS: TestReplay348AFaultFromBeforeTheSendFailsNoGate (0.16s)
./cmd/mesh-controller --- PASS: TestReplay239AModuleNameIsNotTakenOverByAnotherRepository (0.14s)
./cmd/mesh-controller --- PASS: TestAWalkThatMovedNothingSaysWhichModulesMatchedWhatRuns (0.16s)
./cmd/mesh-controller --- PASS: TestReplay614ANewSDKPlansTheToolchainAndThenItsBundles (0.07s)
./cmd/mesh-controller --- PASS: TestOneAcceptForAProviderIsPlacedForEveryConsumer (0.43s)
./cmd/mesh-controller --- PASS: TestReplay164 (0.25s)
./cmd/mesh-controller --- PASS: TestAnApprovedLayerOpensTheWalkThatSendsIt (0.17s)
./cmd/mesh-controller --- PASS: TestASettingsWalkSendsOneMachineAtATimeEachJudged (0.18s)
./cmd/mesh-controller --- PASS: TestAFailedSettingsWalkStopsAndHoldsNothingBack (0.17s)
./cmd/mesh-controller --- PASS: TestASettingsWalkSendsTheLayerAloneEveryBuildKept (0.17s)
./cmd/mesh-controller --- PASS: TestASettingsWalkStopsBeforeADataMoveAndPassesOverAMachineAway (0.47s)
./cmd/mesh-controller --- PASS: TestACrossingSendSupersedesASettingsGate (0.16s)
./cmd/mesh-controller --- PASS: TestASettingsWalkFailsOnARefusalThatCannotClear (0.16s)
./cmd/mesh-controller --- PASS: TestAProviderElsewhereServesItsOwnComposedName (0.21s)
./cmd/mesh-controller --- PASS: TestAReusedCheckBuildIsRegisteredByItsDigestAndGatedAsABuiltOne (0.27s)
./cmd/mesh-controller --- PASS: TestAReleaseSendsTheRestAtOnceAfterTheFirstPasses (0.22s)
./cmd/mesh-controller --- PASS: TestARestMachineThatFailsIsPutBackAloneAndTheOthersAreJudgedOn (0.20s)
./cmd/mesh-controller --- PASS: TestAWalkTakesOverTheReadingsOfAGateJudgingTheSameBuildThere (0.17s)
./cmd/mesh-controller --- PASS: TestAFirstSendMadeAndNotKeptIsNotSentAgain (0.21s)
./cmd/mesh-controller --- PASS: TestAReleaseSendKeptAndMadeIsNotMadeAgain (0.16s)
./cmd/mesh-controller --- PASS: TestAFirstMachineThatFailsStillStopsTheWalk (0.17s)
./cmd/mesh-controller --- PASS: TestTheControlNodeIsSentLastInAStep (0.20s)
./cmd/mesh-controller --- PASS: TestARestMachineSilentPastItsBoundIsLeftAndSaid (0.19s)
./cmd/mesh-controller --- PASS: TestANoMoveTierWaitsForNoNewReport (0.20s)
./internal/inventory --- PASS: TestTheLastSendSaysWhatTheMachineAnswered (0.07s)
./internal/inventory --- PASS: TestAReportIsTheLastSendsAnswerOnlyWhenItIsAboutThatSend (0.07s)
./internal/inventory --- PASS: TestAnIssuedValueIsSealedToEveryHolderOnceAndNotAgain (0.08s)
./internal/inventory --- PASS: TestAnIssuedValueIsSealedAgainAfterAKeyChangeOrAnAcceptance (0.07s)
./internal/inventory --- PASS: TestAConditionsLooksAreKeptBesideTheBucket (0.06s)
./internal/inventory --- PASS: TestAPlanIdHoldingAQuoteIsReadAsAPlainId (0.06s)
./internal/inventory --- PASS: TestAWalksStartIsKeptAndARefusedSaveLeavesItUnsaid (0.06s)
./internal/inventory --- PASS: TestAWalksRestIsReadFromEachMachinesOwnSend (0.06s)
./internal/inventory --- PASS: TestAStoredBuildWithASilentMergeableFileIsStillReadAndComposed (0.06s)
./internal/inventory --- PASS: TestACredentialIssuedOutsideIsNeverMade (0.07s)
./internal/inventory --- PASS: TestOneAcceptForAProviderIsSealedToEveryConsumer (0.07s)
./internal/inventory --- PASS: TestASharedOwnSecretIssuedOutsideIsNeverMade (0.06s)
./internal/inventory --- PASS: TestAReportOfABusyContainerIsKeptAndReadBack (0.07s)
**Merge check** at `70885ab3`
Judged: head `70885ab3c4a3` merged into trunk `ca3f43c400ba`; read beside it: mesh-catalog `ebf7f3773dc7`, mesh-controller-main `ca3f43c400ba`, mesh-host `1a2677882380`, mesh-tools `954e1a53eef9`
- `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-controller)
- `mesh/repo-check`: **PASS** — its merge-check.sh passed
**Delivery plan** — builds mesh-controller → novox; no bus step
- tier 0: mesh-controller
- novox: receives mesh-controller
- read by no module's build: cmd/mesh-controller/issue648_test.go, testdata/store-tests
Run by the build seat on ace as `build-1791937373861169106` (`builds --log build-1791937373861169106`).
```
--- the gate: mesh-controller
mesh-controller: ok, 59 tool(s); WARNING: merge-window ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
long-running resources without health: 1
files asking for a setting without saying whether it is trusted: 1
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-13T23:54:14Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-13T23:54:14Z
modules the change moves:
- mesh-controller (changed)
machines:
- a machine (f35): composes
- holds mesh-dns-resolver (idt): composes
- holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
- a machine (yvbpsm): composes
a merge would rebuild 1 module(s) in 1 tier(s): mesh-controller
notes:
- cmd/mesh-controller/issue648_test.go and testdata/store-tests read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok github.com/novox/mesh-controller/cmd/mesh-builder 1.082s
ok github.com/novox/mesh-controller/cmd/mesh-controller 155.196s
ok github.com/novox/mesh-controller/examples/objectstore-provisioner 1.022s
ok github.com/novox/mesh-controller/examples/postgres-provisioner 1.044s
ok github.com/novox/mesh-controller/examples/redis-provisioner 1.031s
ok github.com/novox/mesh-controller/examples/route-proxy 1.132s
ok github.com/novox/mesh-controller/internal/artifacts 1.069s
? github.com/novox/mesh-controller/internal/beside [no test files]
ok github.com/novox/mesh-controller/internal/broker 3.983s
ok github.com/novox/mesh-controller/internal/builder 36.003s
ok github.com/novox/mesh-controller/internal/catalogue 7.487s
ok github.com/novox/mesh-controller/internal/conditions 2.501s
ok github.com/novox/mesh-controller/internal/envfile 1.039s
ok github.com/novox/mesh-controller/internal/facts 1.043s
ok github.com/novox/mesh-controller/internal/identity 4.268s
ok github.com/novox/mesh-controller/internal/inventory 33.153s
ok github.com/novox/mesh-controller/internal/lease 17.687s
ok github.com/novox/mesh-controller/internal/licences 3.491s
ok github.com/novox/mesh-controller/internal/licences/adapters 1.036s
ok github.com/novox/mesh-controller/internal/link 59.191s
ok github.com/novox/mesh-controller/internal/lint 2.269s
ok github.com/novox/mesh-controller/internal/outward 1.074s
ok github.com/novox/mesh-controller/internal/overlay 1.053s
ok github.com/novox/mesh-controller/internal/secrets 1.420s
ok github.com/novox/mesh-controller/internal/store 3.260s
ok github.com/novox/mesh-controller/internal/testbus 1.225s
ok github.com/novox/mesh-controller/internal/token 1.016s
store tests, each run against the store:
./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeWalksTheOthersAgain (0.19s)
./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeEndsTheMergesThatContainIt (0.21s)
./cmd/mesh-controller --- PASS: TestAStopWalksTheOthersAgainInTheOpenBatch (0.20s)
./cmd/mesh-controller --- PASS: TestAStopNamesWhatStaysOnTheMachinesAndWhatStillCarriesIt (0.19s)
./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeLeavesItOutOfABatch (0.18s)
./cmd/mesh-controller --- PASS: TestSavingPlansAndMovingMergesIsOneAct (0.16s)
./cmd/mesh-controller --- PASS: TestAPlanFollowedFromTheStoreAnswersWhenItMoves (1.95s)
./cmd/mesh-controller --- PASS: TestNodeShowAndStatusReadTheLastSendFromTheStore (0.21s)
./cmd/mesh-controller --- PASS: TestTheConditionsVerbReadsTheLooksTheBucketNoLongerHolds (0.11s)
./cmd/mesh-controller --- PASS: TestAWalkLetGoAndStoppedByVerbsIsSaidStartedAndEnded (0.23s)
./cmd/mesh-controller --- PASS: TestAWalkStoppedOrClosedByAPersonIsSaidEndedStopped (0.22s)
./cmd/mesh-controller --- PASS: TestAWalkRetriedByAPersonIsSaidStartedAgain (0.18s)
./cmd/mesh-controller --- PASS: TestABacklogReleasedByAPersonIsSaidStarted (0.19s)
./cmd/mesh-controller --- PASS: TestAWalkEndedByCancelOrClearIsSaidEnded (0.25s)
./cmd/mesh-controller --- PASS: TestAWalkRestartedByARebuildIsSaidStarted (0.19s)
./cmd/mesh-controller --- PASS: TestAWalkStoppedByHandAndRetriedEndsFailedWhenItFailsAgain (0.22s)
./cmd/mesh-controller --- PASS: TestReplay237 (0.18s)
./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeUnresolvedSaysSoOnceInItsAnswer (0.17s)
./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeResolvedSaysNothingOfIt (0.18s)
./cmd/mesh-controller --- PASS: TestAnAssignThatLeavesItsNodeUnresolvedSaysOnlyThePlansRefusal (0.18s)
./cmd/mesh-controller --- PASS: TestADirectoryOwnersKeyIsRefusedThroughAVerb (0.20s)
./cmd/mesh-controller --- PASS: TestTheSendMakesNoValueForAnOutsideSecretNobodyGave (0.26s)
./cmd/mesh-controller --- PASS: TestAQuestionComposesWithoutAnOutsideSecretNobodyGave (0.24s)
./cmd/mesh-controller --- PASS: TestReplay201 (0.14s)
./cmd/mesh-controller --- PASS: TestARollbackWhoseSendWasRefusedIsCompletedByTheNextSend (0.13s)
./cmd/mesh-controller --- PASS: TestAGateJudgesTheOtherMovesBesideAKeptCore (0.14s)
./cmd/mesh-controller --- PASS: TestReplay401 (0.26s)
./cmd/mesh-controller --- PASS: TestReplay201ThePlansSend (0.20s)
./cmd/mesh-controller --- PASS: TestPlanAndNodeListAnOptionalRequirementLeftUnbound (0.25s)
./cmd/mesh-controller --- PASS: TestReplay340 (0.22s)
./cmd/mesh-controller --- PASS: TestOnlyATrustedFilesNamedKeyIsRefusedThroughAVerb (0.17s)
./cmd/mesh-controller --- PASS: TestReplay349 (0.18s)
./cmd/mesh-controller --- PASS: TestReplay348AFaultFromBeforeTheSendFailsNoGate (0.16s)
./cmd/mesh-controller --- PASS: TestReplay239AModuleNameIsNotTakenOverByAnotherRepository (0.14s)
./cmd/mesh-controller --- PASS: TestAWalkThatMovedNothingSaysWhichModulesMatchedWhatRuns (0.16s)
./cmd/mesh-controller --- PASS: TestReplay614ANewSDKPlansTheToolchainAndThenItsBundles (0.07s)
./cmd/mesh-controller --- PASS: TestOneAcceptForAProviderIsPlacedForEveryConsumer (0.43s)
./cmd/mesh-controller --- PASS: TestReplay164 (0.25s)
./cmd/mesh-controller --- PASS: TestAnApprovedLayerOpensTheWalkThatSendsIt (0.17s)
./cmd/mesh-controller --- PASS: TestASettingsWalkSendsOneMachineAtATimeEachJudged (0.18s)
./cmd/mesh-controller --- PASS: TestAFailedSettingsWalkStopsAndHoldsNothingBack (0.17s)
./cmd/mesh-controller --- PASS: TestASettingsWalkSendsTheLayerAloneEveryBuildKept (0.17s)
./cmd/mesh-controller --- PASS: TestASettingsWalkStopsBeforeADataMoveAndPassesOverAMachineAway (0.47s)
./cmd/mesh-controller --- PASS: TestACrossingSendSupersedesASettingsGate (0.16s)
./cmd/mesh-controller --- PASS: TestASettingsWalkFailsOnARefusalThatCannotClear (0.16s)
./cmd/mesh-controller --- PASS: TestAProviderElsewhereServesItsOwnComposedName (0.21s)
./cmd/mesh-controller --- PASS: TestAReusedCheckBuildIsRegisteredByItsDigestAndGatedAsABuiltOne (0.27s)
./cmd/mesh-controller --- PASS: TestAReleaseSendsTheRestAtOnceAfterTheFirstPasses (0.22s)
./cmd/mesh-controller --- PASS: TestARestMachineThatFailsIsPutBackAloneAndTheOthersAreJudgedOn (0.20s)
./cmd/mesh-controller --- PASS: TestAWalkTakesOverTheReadingsOfAGateJudgingTheSameBuildThere (0.17s)
./cmd/mesh-controller --- PASS: TestAFirstSendMadeAndNotKeptIsNotSentAgain (0.21s)
./cmd/mesh-controller --- PASS: TestAReleaseSendKeptAndMadeIsNotMadeAgain (0.16s)
./cmd/mesh-controller --- PASS: TestAFirstMachineThatFailsStillStopsTheWalk (0.17s)
./cmd/mesh-controller --- PASS: TestTheControlNodeIsSentLastInAStep (0.20s)
./cmd/mesh-controller --- PASS: TestARestMachineSilentPastItsBoundIsLeftAndSaid (0.19s)
./cmd/mesh-controller --- PASS: TestANoMoveTierWaitsForNoNewReport (0.20s)
./internal/inventory --- PASS: TestTheLastSendSaysWhatTheMachineAnswered (0.07s)
./internal/inventory --- PASS: TestAReportIsTheLastSendsAnswerOnlyWhenItIsAboutThatSend (0.07s)
./internal/inventory --- PASS: TestAnIssuedValueIsSealedToEveryHolderOnceAndNotAgain (0.08s)
./internal/inventory --- PASS: TestAnIssuedValueIsSealedAgainAfterAKeyChangeOrAnAcceptance (0.07s)
./internal/inventory --- PASS: TestAConditionsLooksAreKeptBesideTheBucket (0.06s)
./internal/inventory --- PASS: TestAPlanIdHoldingAQuoteIsReadAsAPlainId (0.06s)
./internal/inventory --- PASS: TestAWalksStartIsKeptAndARefusedSaveLeavesItUnsaid (0.06s)
./internal/inventory --- PASS: TestAWalksRestIsReadFromEachMachinesOwnSend (0.06s)
./internal/inventory --- PASS: TestAStoredBuildWithASilentMergeableFileIsStillReadAndComposed (0.06s)
./internal/inventory --- PASS: TestACredentialIssuedOutsideIsNeverMade (0.07s)
./internal/inventory --- PASS: TestOneAcceptForAProviderIsSealedToEveryConsumer (0.07s)
./internal/inventory --- PASS: TestASharedOwnSecretIssuedOutsideIsNeverMade (0.06s)
./internal/inventory --- PASS: TestAReportOfABusyContainerIsKeptAndReadBack (0.07s)
```
Verdict: ready to merge at 70885ab3. Both required checks are green against trunk ca3f43c4, and the earlier conflict and suggestion are both addressed.
I re-reviewed at head 70885ab3, rebased onto main ca3f43c4. I read the pull request's diff with the forge's diff tool. That tool shows the whole change against main, so I compared it with what I reviewed at c877a826 (review 242).
release_plan.go: the no-move wait is the same code as at c877a826, so the findings of review 242 still hold. The new commit adds const noMovePrefix = "no move" and builds noMoveWhy as noMovePrefix + ": made from the source every machine running it runs". noMove() reads strings.HasPrefix(s.Why, noMovePrefix), so the code that writes the mark and the code that reads it share one string. The full text is unchanged word for word, so plans the running controller already saved are still read the same way.
testdata/store-tests: the conflict is resolved by keeping both sides. Main's ten added tests stay, and TestANoMoveTierWaitsForNoNewReport is the last line. The forge now says mergeable.
Checks at 70885ab3, as mesh-delivery.checks reports them (head 70885ab3c4 merged into trunk ca3f43c400, build-1791937373861169106 on ace):
mesh/merge-gate: success. "PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-controller)"
mesh/repo-check: success. "PASS — its merge-check.sh passed". Its report names "./cmd/mesh-controller --- PASS: TestANoMoveTierWaitsForNoNewReport (0.20s)" among the store tests run against the store.
mesh/delivery: success. "ready: it delivers once merged".
Verdict: ready to merge at 70885ab3. Both required checks are green against trunk ca3f43c4, and the earlier conflict and suggestion are both addressed.
I re-reviewed at head 70885ab3, rebased onto main ca3f43c4. I read the pull request's diff with the forge's diff tool. That tool shows the whole change against main, so I compared it with what I reviewed at c877a826 (review 242).
1. release_plan.go: the no-move wait is the same code as at c877a826, so the findings of review 242 still hold. The new commit adds const noMovePrefix = "no move" and builds noMoveWhy as noMovePrefix + ": made from the source every machine running it runs". noMove() reads strings.HasPrefix(s.Why, noMovePrefix), so the code that writes the mark and the code that reads it share one string. The full text is unchanged word for word, so plans the running controller already saved are still read the same way.
2. testdata/store-tests: the conflict is resolved by keeping both sides. Main's ten added tests stay, and TestANoMoveTierWaitsForNoNewReport is the last line. The forge now says mergeable.
3. Checks at 70885ab3, as mesh-delivery.checks reports them (head 70885ab3c4a3 merged into trunk ca3f43c400ba, build-1791937373861169106 on ace):
mesh/merge-gate: success. "PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-controller)"
mesh/repo-check: success. "PASS — its merge-check.sh passed". Its report names "./cmd/mesh-controller --- PASS: TestANoMoveTierWaitsForNoNewReport (0.20s)" among the store tests run against the store.
mesh/delivery: success. "ready: it delivers once merged".
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Fixes issue 648.
What. In a walk's tier, a build made from the source every machine running it runs (issue 280) is marked no move:
SentAtis set to now and nothing is sent. The wait that gates the next tier then asked each machine running the module for a report at or after max(BuiltAt, SentAt). Nothing was sent, so no report follows, and a machine that does not report again for another reason held the walk for ever. Seen live in plan-1791919354338134213 (mesh-controller #304), tier 1 waiting on build-agent on g14 and shanks.Fix. In the tier's wait, a module the plan marked no move (its
Whysays "no move", no first send, no gate) is judged per machine by the send that last carried its build: the machine runs it once its last report is at or after its last send (Reported.Sent). That is the send whose builds made it no move (unchangedOnEveryreads each machine's last send). A machine that has not answered its last send is still waited on. The mark is read fromWhy, so a plan kept by the controller now running (such as the stuck walk) is read the same; the text is now a constant,noMoveWhy.Tested. New store test
TestANoMoveTierWaitsForNoNewReport(listed in testdata/store-tests): a two-tier plan whose first tier is the build machine, no move on anchor and laptop, both having answered their last send before the build. On main it fails withtier 0, rolling "tier 0 built; waiting for app on anchor, laptop to be applied"; with the fix the walk asks tier 1 in the same step. Its second half shows a machine whose last send is unanswered is still waited on.go test ./cmd/mesh-controlleragainst a throwaway store passes;go vetclean.Delivery
novox/mesh-controller@70885ab3c4a3— delivered since 2026-10-14T00:36:03ZDelivery plan — builds mesh-controller → novox; no bus step
Machines
Transitions
The commit's note under
refs/notes/mesh-plankeeps every transition:git log --notes=mesh-plan.Merge check at
c877a826Judged: head
c877a8267eb9merged into trunkbff5b7f0e4f8; read beside it: mesh-catalog7ed119995f69, mesh-controller-mainbff5b7f0e4f8, mesh-host0e92ef3d1b21, mesh-tools954e1a53eef9mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-controller, route-proxy)mesh/repo-check: PASS — its merge-check.sh passedDelivery plan — builds mesh-controller, route-proxy → ace, novox; no bus step
Run by the build seat on shanks as
build-1791921638316140191(builds --log build-1791921638316140191).Verdict: the fix is sound, but this pull request does not merge: rebase it on main (
ca3f43c4) and resolve the conflict in testdata/store-tests, then recheck.Reviewed at head
c877a826(unchanged since it was asked for).A send still in flight cannot let a tier pass. For a no-move module each machine is asked for a report at or after its own last send (node.sent_at). A send after the last report keeps the machine waiting. The second half of the test shows this ("waiting for app on laptop"). Both times come from the store's clock: node_report.at is the store's now(), and sent_at is set by the controller's store too, so machine clock skew does not enter. A machine that was never sent anything and has reported counts as running, which is right, because no-move means it already runs that build's source. One residual: the report is judged by its time, not by Current (whether it names the last declaration). That is the same rule the ordinary path already uses (issue 256), so it is not a regression.
Spoofing the mark. PlanModule.Why is written only by the controller, inside release_plan.go, gate.go and plan_retry.go. No other writer starts it with "no move", and plan_retry clears Why on a retry. noMove also requires FirstAt == nil and Gate == nil, so a module that was sent or gated after being marked is never read as no move. Nothing outside the controller writes plans.
Rewording. noMove matches the literal prefix "no move", not noMoveWhy. If noMoveWhy is reworded to start differently, the code would drift. I checked this: with noMoveWhy reworded to "unchanged: ...", TestANoMoveTierWaitsForNoNewReport fails, so the reword cannot pass silently. A small suggestion, which does not block: define const noMovePrefix = "no move" and build noMoveWhy from it, so the writer and the reader share one string.
Plans the running controller already saved carry exactly the old text "no move: made from the source every machine running it runs", which noMoveWhy repeats word for word. The stuck walk is therefore read the same way after the upgrade.
The test fails on main. With main's release_plan.go in a merged tree, TestANoMoveTierWaitsForNoNewReport fails at issue648_test.go:71 with: tier 0, rolling "tier 0 built; waiting for app on anchor, laptop to be applied". With the fix it passes.
Merging into main
ca3f43c4. git merge conflicts in testdata/store-tests only. Main appended ten store tests (from #312 and others) at the same place. Keeping both sides resolves it, and release_plan.go merges on its own. The forge says mergeable: false. On the resolved merged tree, sh merge-check.sh passed (exit 0, run niced with MESH_TEST_POSTGRES pointing at a throwaway postgres), and every listed store test passed, including the new one. #312's FirstAt and Rest changes do not touch the no-move path: line 1447 still skips it, because SentAt is set.Checks at
c877a826, as mesh-delivery.checks reports them:mesh/merge-gate: pending. "out of date: judged against trunk
bff5b7f0e4, the trunk is now 372faebf2824". The earlier verdict was "PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-controller, route-proxy)".mesh/repo-check: pending. Same out-of-date note. The earlier verdict was "PASS — its merge-check.sh passed".
mesh/delivery: pending. "checking"; proposed: waits for its check.
Next step: rebase or merge main into the branch, keeping both sides of testdata/store-tests, and then ask mesh-delivery.recheck. Merge only on the new green verdicts.
c877a8267eto70885ab3c4Merge check at
70885ab3Judged: head
70885ab3c4a3merged into trunkca3f43c400ba; read beside it: mesh-catalogebf7f3773dc7, mesh-controller-mainca3f43c400ba, mesh-host1a2677882380, mesh-tools954e1a53eef9mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-controller)mesh/repo-check: PASS — its merge-check.sh passedDelivery plan — builds mesh-controller → novox; no bus step
Run by the build seat on ace as
build-1791937373861169106(builds --log build-1791937373861169106).Verdict: ready to merge at
70885ab3. Both required checks are green against trunkca3f43c4, and the earlier conflict and suggestion are both addressed.I re-reviewed at head
70885ab3, rebased onto mainca3f43c4. I read the pull request's diff with the forge's diff tool. That tool shows the whole change against main, so I compared it with what I reviewed atc877a826(review 242).release_plan.go: the no-move wait is the same code as at
c877a826, so the findings of review 242 still hold. The new commit adds const noMovePrefix = "no move" and builds noMoveWhy as noMovePrefix + ": made from the source every machine running it runs". noMove() reads strings.HasPrefix(s.Why, noMovePrefix), so the code that writes the mark and the code that reads it share one string. The full text is unchanged word for word, so plans the running controller already saved are still read the same way.testdata/store-tests: the conflict is resolved by keeping both sides. Main's ten added tests stay, and TestANoMoveTierWaitsForNoNewReport is the last line. The forge now says mergeable.
Checks at
70885ab3, as mesh-delivery.checks reports them (head70885ab3c4merged into trunkca3f43c400, build-1791937373861169106 on ace):mesh/merge-gate: success. "PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-controller)"
mesh/repo-check: success. "PASS — its merge-check.sh passed". Its report names "./cmd/mesh-controller --- PASS: TestANoMoveTierWaitsForNoNewReport (0.20s)" among the store tests run against the store.
mesh/delivery: success. "ready: it delivers once merged".