Everything a build or check starts in a container on a build node now runs in meshbuild.slice, a slice at the top level beside user.slice and system.slice, which carries a low CPU weight, a low IO weight and memory limits. The build agent also renices itself to 19, which its git and go children inherit.
Why
Issue 1798: shanks, the operator's desktop, hung completely while it built, because nothing limited what a build or check took. ace runs Plex and the media apps and must be protected the same way.
How
modules/build-agent declares /etc/systemd/system/meshbuild.slice (template files/meshbuild.slice) and keeps it running; its CPUWeight, IOWeight, MemoryHigh and MemoryMax come from four module settings with defaults for every node: cpu-weight 20 (an ordinary service has 100), io-weight 10 (ordinary 100), memory-high 50%, memory-max 70%. The weights bind only under contention; the memory limits always bind. The name has no dash, because systemd reads a dash as nesting: mesh-build.slice would sit inside mesh.slice and its weights would bind against nothing.
The slice's service restarts on a change of its file (restart-on), so a changed limit reaches systemd. Restarting the slice stops every build and check running on that machine at that moment; the four settings' descriptions say so.
files/build-agent.env gives the agent MESH_BUILD_CGROUP_PARENT=meshbuild.slice; internal/builder LabelledArgs, the one place every docker run passes, adds --cgroup-parent (check containers, the store and bus containers a check starts, compile and judge containers).
Per node: ace and shanks both get the defaults. A desktop profile for shanks is a settings proposal, not part of this change: mesh-controller.settings module=build-agent node=shanks values={"cpu-weight":10,"memory-high":"40%","memory-max":"60%"} (propose it to the operator after the delivery).
Not covered, opened as issues: docker build image builds (issue 1805), the Go and Node build modules' host processes (issue 1806, needs a decision), and IOWeight having no effect on disks with the none scheduler (issue 1807).
How it is checked
Unit tests TestEveryContainerJoinsTheNodesBuildSlice (1798/AC1), TestTheBuildSliceCarriesTheMachinesLimits (1798/AC1, AC2), the dashless name (1798/AC3) and the restart on a change (1798/AC4); mesh-controller.try on head b174d743 passed (build-1792623412870045418, 9m14s); 6bf38072 changes only the four settings' descriptions.
## What
Everything a build or check starts in a container on a build node now runs in `meshbuild.slice`, a slice at the top level beside user.slice and system.slice, which carries a low CPU weight, a low IO weight and memory limits. The build agent also renices itself to 19, which its git and go children inherit.
## Why
Issue 1798: shanks, the operator's desktop, hung completely while it built, because nothing limited what a build or check took. ace runs Plex and the media apps and must be protected the same way.
## How
- modules/build-agent declares `/etc/systemd/system/meshbuild.slice` (template files/meshbuild.slice) and keeps it running; its CPUWeight, IOWeight, MemoryHigh and MemoryMax come from four module settings with defaults for every node: cpu-weight 20 (an ordinary service has 100), io-weight 10 (ordinary 100), memory-high 50%, memory-max 70%. The weights bind only under contention; the memory limits always bind. The name has no dash, because systemd reads a dash as nesting: `mesh-build.slice` would sit inside `mesh.slice` and its weights would bind against nothing.
- The slice's service restarts on a change of its file (`restart-on`), so a changed limit reaches systemd. Restarting the slice stops every build and check running on that machine at that moment; the four settings' descriptions say so.
- files/build-agent.env gives the agent `MESH_BUILD_CGROUP_PARENT=meshbuild.slice`; internal/builder `LabelledArgs`, the one place every `docker run` passes, adds `--cgroup-parent` (check containers, the store and bus containers a check starts, compile and judge containers).
- **Per node:** ace and shanks both get the defaults. A desktop profile for shanks is a settings proposal, not part of this change: `mesh-controller.settings module=build-agent node=shanks values={"cpu-weight":10,"memory-high":"40%","memory-max":"60%"}` (propose it to the operator after the delivery).
- Not covered, opened as issues: `docker build` image builds (issue 1805), the Go and Node build modules' host processes (issue 1806, needs a decision), and IOWeight having no effect on disks with the none scheduler (issue 1807).
## How it is checked
Unit tests `TestEveryContainerJoinsTheNodesBuildSlice` (1798/AC1), `TestTheBuildSliceCarriesTheMachinesLimits` (1798/AC1, AC2), the dashless name (1798/AC3) and the restart on a change (1798/AC4); `mesh-controller.try` on head b174d743 passed (build-1792623412870045418, 9m14s); 6bf38072 changes only the four settings' descriptions.
Reviewed-by: reviewer-1798@shanks at 6bf38072cacfc5698336e84492efe30f05f1255a
Deliverynovox/mesh-controller@6bf38072cacf — delivered since 2026-10-21T23:27:12Z
Delivery plan — builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step
tier 0: mesh-controller
tier 1: build-agent
ace: receives build-agent
g14: receives build-agent
novox: receives mesh-controller, build-agent
shanks: receives build-agent
build-agent keeps data (ADR 0233): what it holds is backed up before it moves
grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before build-agent is judged on its first machine
Machines
mesh-controller on every machine running it: sent
build-agent on every machine running it: sent
Transitions
2026-10-21 23:01 (new) → proposed (announced): novox/mesh-controller#432's head announced
2026-10-21 23:13 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
2026-10-21 23:13 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
2026-10-21 23:21 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
2026-10-21 23:21 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
2026-10-21 23:27 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says
The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.
<!-- mesh-delivery:view -->
**Delivery** `novox/mesh-controller@6bf38072cacf` — **delivered** since 2026-10-21T23:27:12Z
**Delivery plan** — builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step
- tier 0: mesh-controller
- tier 1: build-agent
- ace: receives build-agent
- g14: receives build-agent
- novox: receives mesh-controller, build-agent
- shanks: receives build-agent
- build-agent keeps data (ADR 0233): what it holds is backed up before it moves
- grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before build-agent is judged on its first machine
**Machines**
- mesh-controller on every machine running it: sent
- build-agent on every machine running it: sent
**Transitions**
- 2026-10-21 23:01 (new) → proposed (announced): novox/mesh-controller#432's head announced
- 2026-10-21 23:13 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
- 2026-10-21 23:13 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
- 2026-10-21 23:21 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
- 2026-10-21 23:21 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
- 2026-10-21 23:27 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says
The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.
mesh/merge-gate head 6bf38072cacf merged into trunk a929df9b0ec3 — pass: builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step; every …
Merge check at 6bf38072
Judged: head 6bf38072cacf merged into trunk a929df9b0ec3; read beside it: mesh-catalog 3bbae41037e3, mesh-controller-main a929df9b0ec3, mesh-host 4065b45ae84f, mesh-tools e0fadc43d9dd
mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller)
mesh/repo-check: PASS — its merge-check.sh passed
Delivery plan — builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step
tier 0: mesh-controller
tier 1: build-agent
ace: receives build-agent
g14: receives build-agent
novox: receives mesh-controller, build-agent
shanks: receives build-agent
build-agent keeps data (ADR 0233): what it holds is backed up before it moves
grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before build-agent is judged on its first machine
read by no module's build: internal/builder/kill_test.go, modules/build-agent/manifest_test.go
Run by the build seat on ace as build-1792623725004447997 (builds --log build-1792623725004447997).
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
What
Everything a build or check starts in a container on a build node now runs in
meshbuild.slice, a slice at the top level beside user.slice and system.slice, which carries a low CPU weight, a low IO weight and memory limits. The build agent also renices itself to 19, which its git and go children inherit.Why
Issue 1798: shanks, the operator's desktop, hung completely while it built, because nothing limited what a build or check took. ace runs Plex and the media apps and must be protected the same way.
How
/etc/systemd/system/meshbuild.slice(template files/meshbuild.slice) and keeps it running; its CPUWeight, IOWeight, MemoryHigh and MemoryMax come from four module settings with defaults for every node: cpu-weight 20 (an ordinary service has 100), io-weight 10 (ordinary 100), memory-high 50%, memory-max 70%. The weights bind only under contention; the memory limits always bind. The name has no dash, because systemd reads a dash as nesting:mesh-build.slicewould sit insidemesh.sliceand its weights would bind against nothing.restart-on), so a changed limit reaches systemd. Restarting the slice stops every build and check running on that machine at that moment; the four settings' descriptions say so.MESH_BUILD_CGROUP_PARENT=meshbuild.slice; internal/builderLabelledArgs, the one place everydocker runpasses, adds--cgroup-parent(check containers, the store and bus containers a check starts, compile and judge containers).mesh-controller.settings module=build-agent node=shanks values={"cpu-weight":10,"memory-high":"40%","memory-max":"60%"}(propose it to the operator after the delivery).docker buildimage builds (issue 1805), the Go and Node build modules' host processes (issue 1806, needs a decision), and IOWeight having no effect on disks with the none scheduler (issue 1807).How it is checked
Unit tests
TestEveryContainerJoinsTheNodesBuildSlice(1798/AC1),TestTheBuildSliceCarriesTheMachinesLimits(1798/AC1, AC2), the dashless name (1798/AC3) and the restart on a change (1798/AC4);mesh-controller.tryon headb174d743passed (build-1792623412870045418, 9m14s);6bf38072changes only the four settings' descriptions.Reviewed-by: reviewer-1798@shanks at
6bf38072caDelivery
novox/mesh-controller@6bf38072cacf— delivered since 2026-10-21T23:27:12ZDelivery plan — builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step
Machines
Transitions
The commit's note under
refs/notes/mesh-plankeeps every transition:git log --notes=mesh-plan.Merge check at
6bf38072Judged: head
6bf38072cacfmerged into trunka929df9b0ec3; read beside it: mesh-catalog3bbae41037e3, mesh-controller-maina929df9b0ec3, mesh-host4065b45ae84f, mesh-toolse0fadc43d9ddmesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller)mesh/repo-check: PASS — its merge-check.sh passedDelivery plan — builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step
Run by the build seat on ace as
build-1792623725004447997(builds --log build-1792623725004447997).