Look twice before saying a probe failed, and say conditions in machine names (hq issue 277) #91

2026-10-06T16:45:07Z

mesh-admin commented

2026-10-06 16:45:07 +00:00

D2 raised a resolver urgent on one DNS query that timed out while its machine was loaded (a push applying, a build starting), twice on 2026-10-06; and the summary carried the resolver's address and socket text, so the operator channel withheld the whole alert ("this message carried an IPv4 address, so its words are withheld").

Single-sample findings

New Confirm on conditions.Observation + confirming (confirm.go): such a finding is raised when the source's previous look saw it too (two doctor runs = 5 min; two watchdog ticks = 60 s), kept while open (never clear-and-reraise), cleared by the look that no longer sees it. Held findings appear in the verdict as unconfirmed, never as a pass. Definite answers (wrong address, NXDOMAIN for AAAA, missing stream) are raised at once.

Where	Single sample	Now
D2	one query each, sequential	up to 3 tries (2 s each, 250/500 ms apart), all questions concurrent; silence → Confirm, still urgent once confirmed
D3	one discovery round	second round for what was missing; Confirm
D6 behind	one pending count (H4 acts on it)	Confirm
D8, D13	one seat ask	asked again while the bound leaves room; D13 unmeasured Confirm
D9	timed once	Confirm
doctor probe-failed	one error	Confirm (verdict still failed-to-run at once)
watchdog blind rows	one failed read	Confirm over two ticks

Signals-table rows were not affected: their bounds already span several intervals.

Summaries

Summaries say things in machine names and words; addresses, domains, paths and raw errors move to Said (evidence): D2, D5 unheld, D8 (banned addresses, endpoint domain), D9, D13 (paths, dataset, array location, ask error), S12 unleased/reset.

internal/outward mirrors messenger's content rule (Check, Scrub), allowing the mesh's machine names. The keeper's sayable backstop rewords a withheld summary and keeps it whole in the evidence, and reports to conditions.Unsayable.

Tests

TestMain lint in cmd/mesh-controller: every observation any test pushes through a keeper, plus findings read directly via linted(...) (data, bindings, D1), must pass the rule (key and summary), or the suite fails, naming source and kind. Proven: the old data summaries fail it.
outward table test (machine names pass; IPv4/IPv6/host:port/domains/paths/secrets refused; Scrub always passes).
D2 against stand-in resolvers: miss-then-answer is well; silent is held and said in machine names with address in evidence; wrong answer at once.
doctor over runs; blind watchdog over ticks; existing tests updated for the two-look rule.

Full suite against throwaway postgres:17 + nats:2.11, vet, gofmt, -race on the changed packages: green, except internal/catalogue TestTheCataloguesBusIsBackedUpBySnapshot, which also fails on main (it reads a sibling mesh-catalog checkout that doesn't have the snapshot account yet).

hq: issue 277 (+ to-be 45 §4 amendment).

D2 raised a resolver **urgent** on one DNS query that timed out while its machine was loaded (a push applying, a build starting), twice on 2026-10-06; and the summary carried the resolver's address and socket text, so the operator channel withheld the whole alert ("this message carried an IPv4 address, so its words are withheld"). ## Single-sample findings New `Confirm` on `conditions.Observation` + `confirming` (confirm.go): such a finding is raised when the source's previous look saw it too (two doctor runs = 5 min; two watchdog ticks = 60 s), kept while open (never clear-and-reraise), cleared by the look that no longer sees it. Held findings appear in the verdict as `unconfirmed`, never as a pass. Definite answers (wrong address, NXDOMAIN for AAAA, missing stream) are raised at once. | Where | Single sample | Now | |---|---|---| | D2 | one query each, sequential | up to 3 tries (2 s each, 250/500 ms apart), all questions concurrent; silence → Confirm, still urgent once confirmed | | D3 | one discovery round | second round for what was missing; Confirm | | D6 behind | one pending count (H4 acts on it) | Confirm | | D8, D13 | one seat ask | asked again while the bound leaves room; D13 unmeasured Confirm | | D9 | timed once | Confirm | | doctor probe-failed | one error | Confirm (verdict still failed-to-run at once) | | watchdog blind rows | one failed read | Confirm over two ticks | Signals-table rows were not affected: their bounds already span several intervals. ## Summaries Summaries say things in machine names and words; addresses, domains, paths and raw errors move to `Said` (evidence): D2, D5 unheld, D8 (banned addresses, endpoint domain), D9, D13 (paths, dataset, array location, ask error), S12 unleased/reset. `internal/outward` mirrors messenger's content rule (`Check`, `Scrub`), allowing the mesh's machine names. The keeper's `sayable` backstop rewords a withheld summary and keeps it whole in the evidence, and reports to `conditions.Unsayable`. ## Tests - `TestMain` lint in cmd/mesh-controller: every observation any test pushes through a keeper, plus findings read directly via `linted(...)` (data, bindings, D1), must pass the rule (key and summary), or the suite fails, naming source and kind. Proven: the old data summaries fail it. - outward table test (machine names pass; IPv4/IPv6/host:port/domains/paths/secrets refused; Scrub always passes). - D2 against stand-in resolvers: miss-then-answer is well; silent is held and said in machine names with address in evidence; wrong answer at once. - doctor over runs; blind watchdog over ticks; existing tests updated for the two-look rule. Full suite against throwaway postgres:17 + nats:2.11, vet, gofmt, `-race` on the changed packages: green, except `internal/catalogue TestTheCataloguesBusIsBackedUpBySnapshot`, which also fails on main (it reads a sibling mesh-catalog checkout that doesn't have the snapshot account yet). hq: issue 277 (+ to-be 45 §4 amendment).

mesh-admin added 1 commit 2026-10-06 16:45:07 +00:00

Look twice before saying a probe failed, and say conditions in machine names (hq issue 277) 8e8712e352

D2 raised a resolver urgent on one query that timed out while its machine was
loaded, and its summary carried the resolver's address and socket text, so the
operator channel withheld the whole alert.

- D2 asks every question up to three times, all at once; a resolver that
  answers nothing is held for the next run and raised urgent when two runs
  in a row find it silent. A wrong answer is still raised at once.
- Findings a single look can be wrong about carry Confirm: raised on the
  second look in a row, kept while open, never cleared-and-reraised. Used by
  D2 silence, D3 (also asks discovery twice), D6 behind, D9, D13 unmeasured,
  probe-failed of the doctor, and blind watchdog rows.
- Probe seat asks (D8, D13) are asked again when the bus brought no answer.
- Summaries name machines and say things in words; addresses, paths,
  domains and raw errors move to the evidence (D2, D5, D8, D9, D13, S12).
- internal/outward mirrors the messenger's content rule, allowing the mesh's
  machine names; the keeper rewords a summary that would be withheld and keeps
  it whole in the evidence; a TestMain lint fails the suite on any raised or
  linted finding that would be withheld.

mesh-admin merged commit 81f497e5dd into main

2026-10-06 16:47:40 +00:00

mesh-admin deleted branch fix/probes-look-twice-and-say-no-addresses

2026-10-06 16:47:40 +00:00

mesh-admin commented

2026-10-06 23:10:01 +00:00

Delivery novox/mesh-controller@81f497e5dd36 — delivered since 2026-10-06T23:05:28Z

Machines

build-agent on ace: sent
mesh-controller on novox: sent

Transitions

2026-10-06 23:05 (new) → proposed (announced): novox/mesh-controller#91 merged; its head was not heard by this owner, so it is made from the forge's word
2026-10-06 23:05 proposed → held (merged-unchecked): merged without a passing check — a verdict known with it is taken first: only a person decides that it goes on
2026-10-06 23:05 held → delivering (go): its walk started on a word that was not this owner's: the controller's own path, which waits for nobody, or a person's plans go
2026-10-06 23:05 delivering → delivered (done): its walk is done: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

**Delivery** `novox/mesh-controller@81f497e5dd36` — **delivered** since 2026-10-06T23:05:28Z **Machines** - build-agent on ace: sent - mesh-controller on novox: sent **Transitions** - 2026-10-06 23:05 (new) → proposed (announced): novox/mesh-controller#91 merged; its head was not heard by this owner, so it is made from the forge's word - 2026-10-06 23:05 proposed → held (merged-unchecked): merged without a passing check — a verdict known with it is taken first: only a person decides that it goes on - 2026-10-06 23:05 held → delivering (go): its walk started on a word that was not this owner's: the controller's own path, which waits for nobody, or a person's `plans go` - 2026-10-06 23:05 delivering → delivered (done): its walk is done: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

This repo is archived. You cannot comment on pull requests.

1 Participants

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-controller#91