A bus account counts as issued only once sealed, stale accounts are forgotten, and grants name sealed accounts only (issue 1945 note 35) #467

2026-10-25T19:31:02Z

mesh-tools commented

2026-10-25 19:31:02 +00:00

Research 072 piece moved: the grants piece (memberships and credentials heard from placement).

Why

Met twice (note 35): at 20:04 ace was assigned mesh-build-go and mesh-build-node; account rows from 17:19 had survived the unassign, so mint-if-absent minted and sealed nothing, ace got no broker file and crash-looped 20 times, the bus had no ace.mesh-build-* user, yet the log said 'grants written' and a grant written for other nodes let ace be wanted.

What

Migration 0108: bus_user.sealed_at (existing rows sealed at minted_at). An account is issued only when sealed; issue takes a per-account store lock across look, mint and seal (2-minute deadline); a failed seal leaves it unsealed for the next issue.
The start's look first forgets the accounts of modules that no longer resolve on their node (each node's resolution, required modules included; only with a reading that holds assignments and the lease; logged). This clears ace's 17:19 rows.
Unassign forgets accounts only of modules that no longer resolve on the node, never provisioner.; it lists what it forgot. Forgetting takes the account locks.
Grants name sealed accounts only; a grant with none left is deleted (an empty list names every node).
Log lines say what was issued and sealed.

Ship together

with mesh-delivery #46-to-be (same branch): the assigner's rule 6 per node.

Tests

No new test functions (1764); go test -race ./... and go vet -tags integration ./... pass. Recovery mode: no try; merge by hand.

Issue: issue 1945 note 35.

Reviewed-by: reviewer-seal@shanks at fbf14b68db

Research 072 piece moved: the grants piece (memberships and credentials heard from placement). ## Why Met twice (note 35): at 20:04 ace was assigned mesh-build-go and mesh-build-node; account rows from 17:19 had survived the unassign, so mint-if-absent minted and sealed nothing, ace got no broker file and crash-looped 20 times, the bus had no ace.mesh-build-* user, yet the log said 'grants written' and a grant written for other nodes let ace be wanted. ## What - Migration 0108: bus_user.sealed_at (existing rows sealed at minted_at). An account is issued only when sealed; issue takes a per-account store lock across look, mint and seal (2-minute deadline); a failed seal leaves it unsealed for the next issue. - The start's look first forgets the accounts of modules that no longer resolve on their node (each node's resolution, required modules included; only with a reading that holds assignments and the lease; logged). This clears ace's 17:19 rows. - Unassign forgets accounts only of modules that no longer resolve on the node, never provisioner.<node>; it lists what it forgot. Forgetting takes the account locks. - Grants name sealed accounts only; a grant with none left is deleted (an empty list names every node). - Log lines say what was issued and sealed. ## Ship together with mesh-delivery #46-to-be (same branch): the assigner's rule 6 per node. ## Tests No new test functions (1764); go test -race ./... and go vet -tags integration ./... pass. Recovery mode: no try; merge by hand. Issue: issue 1945 note 35. Reviewed-by: reviewer-seal@shanks at fbf14b68dbabbe4980ea85c32de03b0dbeb97c37

mesh-tools added 2 commits 2026-10-25 19:31:02 +00:00

Issue an account whose credential is not sealed, and forget an unassigned module's accounts (issue 1945, ADR 0543) 79ac62ffbc

Met a second time live on 2026-10-25 at 20:04 (note 35): mesh-build-go was
assigned to ace again, and its account rows, minted at 17:19, had outlived the
unassignment. The issue minted only when no row stood, so it minted and sealed
nothing; the node had no credential and the bus no user, and the module
crash-looped 20 times. The watch still said "the grants written".

- A bus account now says when its credential was sealed to its node (migration
  0108; every account standing before is taken as sealed). An issue under the
  assign act, the assignments' watch or a registration mints only an account
  that is not issued, a row with no seal counting as none, under the store's
  lock on the account across its look, mint and seal, and marks it sealed once
  sealed. A seal that fails leaves it unsealed for the next issue.
- Unassigning a module forgets its bus accounts and their credentials on that
  node, so an assignment again issues them afresh.
- Only sealed accounts count as minted for a composition and are named in a
  grant, so the assigner, which now wants a node only once the grant names its
  account (mesh-delivery, same branch), holds the node until it is.
- The assignment's log line says which accounts were issued and sealed, or that
  they stood issued and sealed.

The process-only issue drops the atomic insert of the review of 9ff47f6a for
the lock, which also covers the seal. Tests: cases in the existing tables.
Research 072: the grants piece (memberships and credentials heard from placement).

Forget the accounts of modules no longer on their nodes at the start's look, and grant sealed accounts alone (issue 1945, ADR 0543, review)

mesh/delivery held for a person: merged without a passing check: only a person decides what follows

Details

mesh/delivery-group group fix/1945-credential-when-row-without-seal held: a member is held: novox/mesh-controller@fbf14b68dbab (merged without a passing check:…

Details

mesh/check checking fbf14b68dbab on 40034be479f8

fbf14b68db

Migration 0108 marks every standing account sealed, ace's stale mesh-build-go
rows from 17:19 among them, and the forgetting ran only at a later unassign:
the next assignment to ace would have issued nothing again.

- The start's look first forgets, from each node's own resolution (assigned
  and required), the accounts of every module that no longer resolves on its
  node, and says each; only from a reading that holds assignments, and a node
  whose resolution is unknown is left alone.
- Unassign forgets a module's accounts only once it no longer resolves on the
  node (a module another requires keeps running), and never the node's own
  provisioner account; the forgetting moved from the inventory to the act.
- Forgetting holds each account's lock across its delete, so an issue in flight
  never writes a row back after it.
- A module whose accounts are not all sealed is granted its sealed accounts
  alone, and its grant is dropped when none is: an older grant naming ace no
  longer lets the assigner want it.
- An issue's locked section has a deadline of two minutes, since it holds a
  connection of the store's pool across the vault and the bus.
Tests: cases in the existing tables.
Research 072: the grants piece (memberships and credentials heard from placement).

mesh-tools commented

2026-10-25 19:31:07 +00:00

Delivery novox/mesh-controller@fbf14b68dbab — held since 2026-10-25T19:31:44Z

Held for a person: merged without a passing check: only a person decides what follows — the merge reached the trunk without a passing check.

Source — source.main moved to novox/mesh-controller@7cd4d18bd5. Whether it reached the machines is mesh-delivery-view's, derived from source.main, the wants and the haves.

Group fix/1945-credential-when-row-without-seal: novox/mesh-controller@fbf14b68db, novox/mesh-delivery@61196c99e6

Transitions

2026-10-25 19:31 (new) → proposed (announced): novox/mesh-controller#467's head announced
2026-10-25 19:31 proposed → held (merged-unchecked): merged without a passing check — a verdict known with it is taken first: only a person decides what follows

The commit's note under refs/notes/mesh-plan keeps every transition of this change up to its merge: git log --notes=mesh-plan.

**Delivery** `novox/mesh-controller@fbf14b68dbab` — **held** since 2026-10-25T19:31:44Z Held for a person: merged without a passing check: only a person decides what follows — the merge reached the trunk without a passing check. **Source** — source.main moved to novox/mesh-controller@7cd4d18bd54e. Whether it reached the machines is `mesh-delivery-view`'s, derived from `source.main`, the wants and the haves. **Group** `fix/1945-credential-when-row-without-seal`: novox/mesh-controller@fbf14b68dbab, novox/mesh-delivery@61196c99e6a4 **Transitions** - 2026-10-25 19:31 (new) → proposed (announced): novox/mesh-controller#467's head announced - 2026-10-25 19:31 proposed → held (merged-unchecked): merged without a passing check — a verdict known with it is taken first: only a person decides what follows The commit's note under `refs/notes/mesh-plan` keeps every transition of this change up to its merge: `git log --notes=mesh-plan`.

jschoubben merged commit 7cd4d18bd5 into main

2026-10-25 19:31:42 +00:00

jschoubben deleted branch fix/1945-credential-when-row-without-seal

2026-10-25 19:31:42 +00:00

jschoubben referenced this issue from a commit

2026-10-25 21:51:28 +00:00

Grant the grants part reading every membership; seal the seeded account in the addresses test (ADR 0547 §5, review; issue 1945)

mesh-tools referenced this pull request

2026-10-25 21:57:16 +00:00

The bus composer grants mesh-grants publishing memberships, nothing more (ADR 0547, the operator's one grant of 2026-10-25 22:31) #468

jschoubben referenced this issue from a commit

2026-10-25 22:30:22 +00:00