Review 257 of mesh-controller#315 (hq issue 652): the test that only the audit
and a mirror's writer read a mirror (ADR 0289 §19, ADR 0356 §2) matched only
names qualified as broker. or recordmirror., so a reader inside package broker,
or one importing broker under another name, passed. It now matches by import
path and bare names in the defining packages, proves it on planted readers,
and names what it cannot see.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
mesh/repo-check head 35c7662f895f merged into trunk dc36536e199e — fail: its merge-check.sh failed: --- FAIL: TestTheInstallersFirstUserListIsWhatTheContro…
Reviews 251 of mesh-controller#315 and ADR 0356 v4 (hq issue 652): a removal
without the lease removes nothing; a module no longer registered loses its
declared-config key with its event; a listed mirror is never reported as
undeclared state; only the audit and a mirror's own writer name a mirror's
bucket; and the mirrors' list and the writers table agree. The store test's
line moves where it merges with the integration branch's own new lines.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Review of mesh-controller#315 (hq issue 652): the writer trusted the bucket as
it read it once, so a former lease holder's write stayed for good; it wrote
without the lease, asking only after a refused compare-and-set; and the
declared config carried a manifest's declarations whole, so a field the
manifest gains would reach the bus unreviewed (ADR 0289 §9, §10, §12). Every
pass now reads the bucket and writes back the store's value where it differs,
asks for the lease before the pass and before every write, and a declaration
is mirrored as its listed fields (kind, default, why), with a test that fails
on a declaration field the list does not name.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The template at mesh-host c8920622 carries the controller's grant to write the
two record mirrors and say their events; the genesis template test holds the
controller's composition to it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The controller's composition gains the two mirror buckets and their events, so
the golden composition moves, and the genesis template is captured again from
mesh-host's branch of this package, whose installer user list carries them.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An assignment and a registration each change exactly one key and raise exactly
one event; the same records written again change nothing (hq issue 652, the
package's done-when). Listed as a store test, so the merge check runs it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The writer behind the assignments and declared-config mirrors (hq issue 652,
ADR 0289, design 54 §2-3): filled from the bucket on its first pass, it
compares each value byte for byte, writes by compare-and-set, purges a key
whose record is gone with a marker that lives a day, and says each write once
after it succeeded.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
mesh-config resolves a module's config values per node from which module runs
where and what each registered module declares, and both lived only in the
controller's store (hq issue 652, design 57 F3). The controller now keeps two
record mirrors, mesh-controller_assignments (<node>.<module>) and
mesh-controller_declared-config (<module>), built from the store by the lease
holder every ten seconds and written only where a value differs, by
compare-and-set, with one assignment-changed or declared-config-changed per
write and a purge said as removed (ADR 0289, design 54 §2-3). A module reads
them through `reads` as mesh-controller.<mirror>; the writers table keeps every
other writer out. Neither holds a secret: an assignment names its node and
module, a declaration is what the public manifest declares.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
mesh-adminandClaude Opus 5.5