novox/mesh-controller
7
0
Fork 0
Code Issues Pull Requests 6 Releases Wiki Activity

S9 raises every bus user's slow consumer and closed connection, from the bus module's events (hq issue 270, ADR 0357) #326

Merged
mesh-admin merged 2 commits from fix/270-the-bus-module-says-every-users-slow-consumer into main 2026-10-14 07:14:33 +00:00
Conversation 4 Commits 2 Files Changed 10
+601 -6
mesh-admin commented 2026-10-14 06:42:38 +00:00
Contributor
Copy Link
Copy Source

What

  • internal/link/busfaults.go: Server.BusFaults reads back the last hour of the nats module's events bus.slow-consumer and bus.connection-closed from EVENTS on an ordered consumer that acknowledges nothing (as PowerStates), after two direct reads of the newest of each, so a tick with nothing said costs no wait. Each closure (user, connection id, opening time) is counted once however often it is said; one advisory per user and kind. MergeAdvisories folds the controller's own client-side slow consumer and its server-side closure into one (user controller).
  • cmd/mesh-controller/watchdogs.go: the S9 gather merges them into the advisories it watches. signals.go: the S9 row names the bus module as an emitter and the kind connection-closed; busUserClosed words each per user (module and machine via busUserWords), dotted user name in the evidence only. plain_words.go: words for connection-closed.
  • internal/catalogue/manifest.go: the bus module may declare emits when it ships a tools bundle: the runtime carrying the bundle is granted them under the module's name; the bus's own account keeps the snapshot API alone (ADR 0235). Without this, the catalogue's nats manifest is refused.

Why

S9 heard a slow consumer only on the controller's own connection: the server says another user's only in its record of closed connections (issue 270, open question 2). The server counted 37 slow consumers since 2026-10-06 and none but the controller's raised anything. Decided in ADR 0357 (option C).

Tested

  • internal/link: TestNatsBusFaultsAreOnePerUserAndKindEachClosureCountedOnce (a closure said twice counted once, older than the hour not said), TestNatsBusFaultsReadNothingWhenTheBusModuleSaidNothing (under a second), TestTheControllersOwnSlowConsumerAndItsClosedConnectionAreOneAdvisory.
  • cmd/mesh-controller: TestAUserTheBusClosedAsASlowConsumerIsOneConditionNamingItsModuleAndMachine (raised at the first look, named in words, cleared an hour after the last).
  • internal/catalogue: TestTheBussAccountSaysNothingOnTheBus gains the bundled case (fails on main: the manifest is refused). internal/broker: the runtime carrying the bus module may publish its events, its own account may not.
  • go vet ./...; go test of internal/broker, internal/catalogue, internal/link, cmd/mesh-controller (niced, no race, no store).

Delivery group with mesh-catalog (same branch): this goes first, because the catalogue's nats manifest is refused by a controller without the manifest change.

Fixes issue 270

## What - `internal/link/busfaults.go`: `Server.BusFaults` reads back the last hour of the `nats` module's events `bus.slow-consumer` and `bus.connection-closed` from EVENTS on an ordered consumer that acknowledges nothing (as `PowerStates`), after two direct reads of the newest of each, so a tick with nothing said costs no wait. Each closure (user, connection id, opening time) is counted once however often it is said; one advisory per user and kind. `MergeAdvisories` folds the controller's own client-side slow consumer and its server-side closure into one (user `controller`). - `cmd/mesh-controller/watchdogs.go`: the S9 gather merges them into the advisories it watches. `signals.go`: the S9 row names the bus module as an emitter and the kind `connection-closed`; `busUserClosed` words each per user (module and machine via `busUserWords`), dotted user name in the evidence only. `plain_words.go`: words for `connection-closed`. - `internal/catalogue/manifest.go`: the bus module may declare `emits` when it ships a tools bundle: the runtime carrying the bundle is granted them under the module's name; the bus's own account keeps the snapshot API alone (ADR 0235). Without this, the catalogue's nats manifest is refused. ## Why S9 heard a slow consumer only on the controller's own connection: the server says another user's only in its record of closed connections (issue 270, open question 2). The server counted 37 slow consumers since 2026-10-06 and none but the controller's raised anything. Decided in ADR 0357 (option C). ## Tested - `internal/link`: `TestNatsBusFaultsAreOnePerUserAndKindEachClosureCountedOnce` (a closure said twice counted once, older than the hour not said), `TestNatsBusFaultsReadNothingWhenTheBusModuleSaidNothing` (under a second), `TestTheControllersOwnSlowConsumerAndItsClosedConnectionAreOneAdvisory`. - `cmd/mesh-controller`: `TestAUserTheBusClosedAsASlowConsumerIsOneConditionNamingItsModuleAndMachine` (raised at the first look, named in words, cleared an hour after the last). - `internal/catalogue`: `TestTheBussAccountSaysNothingOnTheBus` gains the bundled case (fails on main: the manifest is refused). `internal/broker`: the runtime carrying the bus module may publish its events, its own account may not. - `go vet ./...`; `go test` of internal/broker, internal/catalogue, internal/link, cmd/mesh-controller (niced, no race, no store). Delivery group with mesh-catalog (same branch): this goes first, because the catalogue's nats manifest is refused by a controller without the manifest change. Fixes issue 270
mesh-admin added 1 commit 2026-10-14 06:42:38 +00:00
Raise every bus user's slow consumer and closed connection as S9, from the bus module's events (hq issue 270, ADR 0357)
mesh/delivery-group group fix/270-the-bus-module-says-every-users-slow-consumer rejected: a member's own check failed
Details
mesh/merge-gate head fd9308d3287e merged into trunk 3479a35462b2 — pass: builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step; every …
Details
mesh/repo-check head fd9308d3287e merged into trunk 3479a35462b2 — pass: its merge-check.sh passed
Details
mesh/delivery superseded: a newer head of the same pull request
Details
fd9308d328 
The controller heard a slow consumer only on its own connection: the server
says another user's only in its record of closed connections. The bus module
now says that record as events; the watchdogs read the last hour back on every
tick and raise one condition per user and kind, naming the module and machine.
The module check lets the bus module emit, since its tool runner publishes.
mesh-admin commented 2026-10-14 06:43:13 +00:00
Author
Contributor
Copy Link
Copy Source

Delivery novox/mesh-controller@45870ab31cc5 — delivered since 2026-10-14T07:19:53Z

Delivery plan — builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step

  • tier 0: mesh-controller
  • tier 1: build-agent
  • ace: receives build-agent
  • g14: receives build-agent
  • novox: receives mesh-controller, build-agent
  • shanks: receives build-agent
  • build-agent keeps data (ADR 0233): what it holds is backed up before it moves
  • grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before build-agent is judged on its first machine

Machines

  • mesh-controller on novox: passed — healthy 1 times over 1m39s, by the controller's rule: one reading once it is ready, after the node-engine's witness window (novox/hq ADR 0351)
  • mesh-controller on the rest running it: sent
  • build-agent on ace: passed — healthy 1 times over 24s, by a leaf module's rule: one reading (novox/hq ADR 0304)
  • build-agent on the rest running it: sent

Transitions

  • 2026-10-14 07:03 (new) → proposed (announced): novox/mesh-controller#326's head announced
  • 2026-10-14 07:10 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
  • 2026-10-14 07:10 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
  • 2026-10-14 07:14 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
  • 2026-10-14 07:14 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
  • 2026-10-14 07:19 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-controller@45870ab31cc5` — **delivered** since 2026-10-14T07:19:53Z **Delivery plan** — builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step - tier 0: mesh-controller - tier 1: build-agent - ace: receives build-agent - g14: receives build-agent - novox: receives mesh-controller, build-agent - shanks: receives build-agent - build-agent keeps data (ADR 0233): what it holds is backed up before it moves - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before build-agent is judged on its first machine **Machines** - mesh-controller on novox: passed — healthy 1 times over 1m39s, by the controller's rule: one reading once it is ready, after the node-engine's witness window (novox/hq ADR 0351) - mesh-controller on the rest running it: sent - build-agent on ace: passed — healthy 1 times over 24s, by a leaf module's rule: one reading (novox/hq ADR 0304) - build-agent on the rest running it: sent **Transitions** - 2026-10-14 07:03 (new) → proposed (announced): novox/mesh-controller#326's head announced - 2026-10-14 07:10 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-14 07:10 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-14 07:14 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-14 07:14 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit - 2026-10-14 07:19 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.
mesh-admin commented 2026-10-14 06:53:57 +00:00
Author
Contributor
Copy Link
Copy Source

Merge check at fd9308d3
Judged: head fd9308d3287e merged into trunk 3479a35462b2; read beside it: mesh-catalog a44d490d974c, mesh-controller-main 3479a35462b2, mesh-host 1a2677882380, mesh-tools 954e1a53eef9

  • mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller)
  • mesh/repo-check: PASS — its merge-check.sh passed

Delivery plan — builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step

  • tier 0: mesh-controller
  • tier 1: build-agent
  • ace: receives build-agent
  • g14: receives build-agent
  • novox: receives mesh-controller, build-agent
  • shanks: receives build-agent
  • build-agent keeps data (ADR 0233): what it holds is backed up before it moves
  • grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before build-agent is judged on its first machine
  • read by no module's build: cmd/mesh-controller/bus_users_closed_test.go, internal/broker/bus_module_emits_test.go, internal/catalogue/bus_snapshot_test.go, internal/link/busfaults_test.go

Run by the build seat on novox as build-1791960189418839156 (builds --log build-1791960189418839156).

--- the gate: build-agent, mesh-controller
mesh-controller: ok, 60 tool(s); WARNING: merge-window ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
long-running resources without health: 1
files asking for a setting without saying whether it is trusted: 1
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-14T05:31:20Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-14T05:31:20Z

modules the change moves:
  - mesh-controller (changed)

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 2 module(s) in 2 tier(s): build-agent, mesh-controller

notes:
  - cmd/mesh-controller/bus_users_closed_test.go, internal/broker/bus_module_emits_test.go, internal/catalogue/bus_snapshot_test.go and internal/link/busfaults_test.go read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok  	github.com/novox/mesh-controller/cmd/mesh-builder	2.775s
ok  	github.com/novox/mesh-controller/cmd/mesh-controller	240.571s
ok  	github.com/novox/mesh-controller/examples/objectstore-provisioner	1.022s
ok  	github.com/novox/mesh-controller/examples/postgres-provisioner	1.034s
ok  	github.com/novox/mesh-controller/examples/redis-provisioner	1.027s
ok  	github.com/novox/mesh-controller/examples/route-proxy	1.156s
ok  	github.com/novox/mesh-controller/internal/artifacts	1.060s
?   	github.com/novox/mesh-controller/internal/beside	[no test files]
ok  	github.com/novox/mesh-controller/internal/broker	5.291s
ok  	github.com/novox/mesh-controller/internal/builder	77.816s
ok  	github.com/novox/mesh-controller/internal/catalogue	11.546s
ok  	github.com/novox/mesh-controller/internal/conditions	2.626s
ok  	github.com/novox/mesh-controller/internal/envfile	1.029s
ok  	github.com/novox/mesh-controller/internal/facts	1.032s
ok  	github.com/novox/mesh-controller/internal/identity	6.928s
ok  	github.com/novox/mesh-controller/internal/inventory	58.575s
ok  	github.com/novox/mesh-controller/internal/lease	18.055s
ok  	github.com/novox/mesh-controller/internal/licences	5.427s
ok  	github.com/novox/mesh-controller/internal/licences/adapters	1.013s
ok  	github.com/novox/mesh-controller/internal/link	72.595s
ok  	github.com/novox/mesh-controller/internal/lint	2.870s
ok  	github.com/novox/mesh-controller/internal/outward	1.063s
ok  	github.com/novox/mesh-controller/internal/overlay	1.043s
ok  	github.com/novox/mesh-controller/internal/secrets	1.622s
ok  	github.com/novox/mesh-controller/internal/store	3.971s
ok  	github.com/novox/mesh-controller/internal/testbus	1.281s
ok  	github.com/novox/mesh-controller/internal/token	1.032s
store tests, each run against the store:
  ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeWalksTheOthersAgain (0.23s)
  ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeEndsTheMergesThatContainIt (0.25s)
  ./cmd/mesh-controller --- PASS: TestAStopWalksTheOthersAgainInTheOpenBatch (0.24s)
  ./cmd/mesh-controller --- PASS: TestAStopNamesWhatStaysOnTheMachinesAndWhatStillCarriesIt (0.31s)
  ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeLeavesItOutOfABatch (0.21s)
  ./cmd/mesh-controller --- PASS: TestSavingPlansAndMovingMergesIsOneAct (0.18s)
  ./cmd/mesh-controller --- PASS: TestAPlanFollowedFromTheStoreAnswersWhenItMoves (2.13s)
  ./cmd/mesh-controller --- PASS: TestNodeShowAndStatusReadTheLastSendFromTheStore (0.27s)
  ./cmd/mesh-controller --- PASS: TestTheConditionsVerbReadsTheLooksTheBucketNoLongerHolds (0.17s)
  ./cmd/mesh-controller --- PASS: TestAWalkLetGoAndStoppedByVerbsIsSaidStartedAndEnded (0.29s)
  ./cmd/mesh-controller --- PASS: TestAWalkStoppedOrClosedByAPersonIsSaidEndedStopped (0.27s)
  ./cmd/mesh-controller --- PASS: TestAWalkRetriedByAPersonIsSaidStartedAgain (0.23s)
  ./cmd/mesh-controller --- PASS: TestABacklogReleasedByAPersonIsSaidStarted (0.22s)
  ./cmd/mesh-controller --- PASS: TestAWalkEndedByCancelOrClearIsSaidEnded (0.29s)
  ./cmd/mesh-controller --- PASS: TestAWalkRestartedByARebuildIsSaidStarted (0.23s)
  ./cmd/mesh-controller --- PASS: TestAWalkStoppedByHandAndRetriedEndsFailedWhenItFailsAgain (0.29s)
  ./cmd/mesh-controller --- PASS: TestReplay237 (0.25s)
  ./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeUnresolvedSaysSoOnceInItsAnswer (0.24s)
  ./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeResolvedSaysNothingOfIt (0.23s)
  ./cmd/mesh-controller --- PASS: TestAnAssignThatLeavesItsNodeUnresolvedSaysOnlyThePlansRefusal (0.22s)
  ./cmd/mesh-controller --- PASS: TestADirectoryOwnersKeyIsRefusedThroughAVerb (0.26s)
  ./cmd/mesh-controller --- PASS: TestTheSendMakesNoValueForAnOutsideSecretNobodyGave (0.39s)
  ./cmd/mesh-controller --- PASS: TestAQuestionComposesWithoutAnOutsideSecretNobodyGave (0.34s)
  ./cmd/mesh-controller --- PASS: TestReplay201 (0.22s)
  ./cmd/mesh-controller --- PASS: TestARollbackWhoseSendWasRefusedIsCompletedByTheNextSend (0.17s)
  ./cmd/mesh-controller --- PASS: TestAGateJudgesTheOtherMovesBesideAKeptCore (0.23s)
  ./cmd/mesh-controller --- PASS: TestReplay401 (0.42s)
  ./cmd/mesh-controller --- PASS: TestReplay201ThePlansSend (0.55s)
  ./cmd/mesh-controller --- PASS: TestPlanAndNodeListAnOptionalRequirementLeftUnbound (0.34s)
  ./cmd/mesh-controller --- PASS: TestReplay340 (0.30s)
  ./cmd/mesh-controller --- PASS: TestOnlyATrustedFilesNamedKeyIsRefusedThroughAVerb (0.22s)
  ./cmd/mesh-controller --- PASS: TestReplay349 (0.26s)
  ./cmd/mesh-controller --- PASS: TestReplay348AFaultFromBeforeTheSendFailsNoGate (0.21s)
  ./cmd/mesh-controller --- PASS: TestReplay239AModuleNameIsNotTakenOverByAnotherRepository (0.45s)
  ./cmd/mesh-controller --- PASS: TestAWalkThatMovedNothingSaysWhichModulesMatchedWhatRuns (0.21s)
  ./cmd/mesh-controller --- PASS: TestReplay614ANewSDKPlansTheToolchainAndThenItsBundles (0.10s)
  ./cmd/mesh-controller --- PASS: TestOneAcceptForAProviderIsPlacedForEveryConsumer (0.57s)
  ./cmd/mesh-controller --- PASS: TestReplay164 (0.69s)
  ./cmd/mesh-controller --- PASS: TestAnApprovedLayerOpensTheWalkThatSendsIt (0.23s)
  ./cmd/mesh-controller --- PASS: TestASettingsWalkSendsOneMachineAtATimeEachJudged (0.23s)
  ./cmd/mesh-controller --- PASS: TestAFailedSettingsWalkStopsAndHoldsNothingBack (0.24s)
  ./cmd/mesh-controller --- PASS: TestASettingsWalkSendsTheLayerAloneEveryBuildKept (0.25s)
  ./cmd/mesh-controller --- PASS: TestASettingsWalkStopsBeforeADataMoveAndPassesOverAMachineAway (0.60s)
  ./cmd/mesh-controller --- PASS: TestACrossingSendSupersedesASettingsGate (0.20s)
  ./cmd/mesh-controller --- PASS: TestASettingsWalkFailsOnARefusalThatCannotClear (0.20s)
  ./cmd/mesh-controller --- PASS: TestAProviderElsewhereServesItsOwnComposedName (0.30s)
  ./cmd/mesh-controller --- PASS: TestAReusedCheckBuildIsRegisteredByItsDigestAndGatedAsABuiltOne (0.33s)
  ./cmd/mesh-controller --- PASS: TestAReleaseSendsTheRestAtOnceAfterTheFirstPasses (0.37s)
  ./cmd/mesh-controller --- PASS: TestARestMachineThatFailsIsPutBackAloneAndTheOthersAreJudgedOn (0.28s)
  ./cmd/mesh-controller --- PASS: TestAWalkTakesOverTheReadingsOfAGateJudgingTheSameBuildThere (0.33s)
  ./cmd/mesh-controller --- PASS: TestAFirstSendMadeAndNotKeptIsNotSentAgain (0.34s)
  ./cmd/mesh-controller --- PASS: TestAReleaseSendKeptAndMadeIsNotMadeAgain (0.23s)
  ./cmd/mesh-controller --- PASS: TestAFirstMachineThatFailsStillStopsTheWalk (0.23s)
  ./cmd/mesh-controller --- PASS: TestTheControlNodeIsSentLastInAStep (0.36s)
  ./cmd/mesh-controller --- PASS: TestARestMachineSilentPastItsBoundIsLeftAndSaid (0.29s)
  ./cmd/mesh-controller --- PASS: TestANoMoveTierWaitsForNoNewReport (0.24s)
  ./cmd/mesh-controller --- PASS: TestOneProviderDownAndThreeConsumersFailingAreOneCondition (0.28s)
  ./cmd/mesh-controller --- PASS: TestAConsumerFailingBesideAHealthyProviderIsItsOwn (0.52s)
  ./internal/inventory --- PASS: TestTheLastSendSaysWhatTheMachineAnswered (0.09s)
  ./internal/inventory --- PASS: TestAReportIsTheLastSendsAnswerOnlyWhenItIsAboutThatSend (0.10s)
  ./internal/inventory --- PASS: TestAnIssuedValueIsSealedToEveryHolderOnceAndNotAgain (0.20s)
  ./internal/inventory --- PASS: TestAnIssuedValueIsSealedAgainAfterAKeyChangeOrAnAcceptance (0.10s)
  ./internal/inventory --- PASS: TestAConditionsLooksAreKeptBesideTheBucket (0.08s)
  ./internal/inventory --- PASS: TestAPlanIdHoldingAQuoteIsReadAsAPlainId (0.08s)
  ./internal/inventory --- PASS: TestAWalksStartIsKeptAndARefusedSaveLeavesItUnsaid (0.08s)
  ./internal/inventory --- PASS: TestAWalksRestIsReadFromEachMachinesOwnSend (0.08s)
  ./internal/inventory --- PASS: TestAStoredBuildWithASilentMergeableFileIsStillReadAndComposed (0.08s)
  ./internal/inventory --- PASS: TestACredentialIssuedOutsideIsNeverMade (0.10s)
  ./internal/inventory --- PASS: TestOneAcceptForAProviderIsSealedToEveryConsumer (0.09s)
  ./internal/inventory --- PASS: TestASharedOwnSecretIssuedOutsideIsNeverMade (0.08s)
  ./internal/inventory --- PASS: TestAReportOfABusyContainerIsKeptAndReadBack (0.11s)
**Merge check** at `fd9308d3` Judged: head `fd9308d3287e` merged into trunk `3479a35462b2`; read beside it: mesh-catalog `a44d490d974c`, mesh-controller-main `3479a35462b2`, mesh-host `1a2677882380`, mesh-tools `954e1a53eef9` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller) - `mesh/repo-check`: **PASS** — its merge-check.sh passed **Delivery plan** — builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step - tier 0: mesh-controller - tier 1: build-agent - ace: receives build-agent - g14: receives build-agent - novox: receives mesh-controller, build-agent - shanks: receives build-agent - build-agent keeps data (ADR 0233): what it holds is backed up before it moves - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before build-agent is judged on its first machine - read by no module's build: cmd/mesh-controller/bus_users_closed_test.go, internal/broker/bus_module_emits_test.go, internal/catalogue/bus_snapshot_test.go, internal/link/busfaults_test.go Run by the build seat on novox as `build-1791960189418839156` (`builds --log build-1791960189418839156`). ``` --- the gate: build-agent, mesh-controller mesh-controller: ok, 60 tool(s); WARNING: merge-window ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8) long-running resources without health: 1 files asking for a setting without saying whether it is trusted: 1 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-14T05:31:20Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-14T05:31:20Z modules the change moves: - mesh-controller (changed) machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 2 module(s) in 2 tier(s): build-agent, mesh-controller notes: - cmd/mesh-controller/bus_users_closed_test.go, internal/broker/bus_module_emits_test.go, internal/catalogue/bus_snapshot_test.go and internal/link/busfaults_test.go read by no module's build, and rebuild nothing (issue 280) --- its merge-check.sh (go toolchain) ok github.com/novox/mesh-controller/cmd/mesh-builder 2.775s ok github.com/novox/mesh-controller/cmd/mesh-controller 240.571s ok github.com/novox/mesh-controller/examples/objectstore-provisioner 1.022s ok github.com/novox/mesh-controller/examples/postgres-provisioner 1.034s ok github.com/novox/mesh-controller/examples/redis-provisioner 1.027s ok github.com/novox/mesh-controller/examples/route-proxy 1.156s ok github.com/novox/mesh-controller/internal/artifacts 1.060s ? github.com/novox/mesh-controller/internal/beside [no test files] ok github.com/novox/mesh-controller/internal/broker 5.291s ok github.com/novox/mesh-controller/internal/builder 77.816s ok github.com/novox/mesh-controller/internal/catalogue 11.546s ok github.com/novox/mesh-controller/internal/conditions 2.626s ok github.com/novox/mesh-controller/internal/envfile 1.029s ok github.com/novox/mesh-controller/internal/facts 1.032s ok github.com/novox/mesh-controller/internal/identity 6.928s ok github.com/novox/mesh-controller/internal/inventory 58.575s ok github.com/novox/mesh-controller/internal/lease 18.055s ok github.com/novox/mesh-controller/internal/licences 5.427s ok github.com/novox/mesh-controller/internal/licences/adapters 1.013s ok github.com/novox/mesh-controller/internal/link 72.595s ok github.com/novox/mesh-controller/internal/lint 2.870s ok github.com/novox/mesh-controller/internal/outward 1.063s ok github.com/novox/mesh-controller/internal/overlay 1.043s ok github.com/novox/mesh-controller/internal/secrets 1.622s ok github.com/novox/mesh-controller/internal/store 3.971s ok github.com/novox/mesh-controller/internal/testbus 1.281s ok github.com/novox/mesh-controller/internal/token 1.032s store tests, each run against the store: ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeWalksTheOthersAgain (0.23s) ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeEndsTheMergesThatContainIt (0.25s) ./cmd/mesh-controller --- PASS: TestAStopWalksTheOthersAgainInTheOpenBatch (0.24s) ./cmd/mesh-controller --- PASS: TestAStopNamesWhatStaysOnTheMachinesAndWhatStillCarriesIt (0.31s) ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeLeavesItOutOfABatch (0.21s) ./cmd/mesh-controller --- PASS: TestSavingPlansAndMovingMergesIsOneAct (0.18s) ./cmd/mesh-controller --- PASS: TestAPlanFollowedFromTheStoreAnswersWhenItMoves (2.13s) ./cmd/mesh-controller --- PASS: TestNodeShowAndStatusReadTheLastSendFromTheStore (0.27s) ./cmd/mesh-controller --- PASS: TestTheConditionsVerbReadsTheLooksTheBucketNoLongerHolds (0.17s) ./cmd/mesh-controller --- PASS: TestAWalkLetGoAndStoppedByVerbsIsSaidStartedAndEnded (0.29s) ./cmd/mesh-controller --- PASS: TestAWalkStoppedOrClosedByAPersonIsSaidEndedStopped (0.27s) ./cmd/mesh-controller --- PASS: TestAWalkRetriedByAPersonIsSaidStartedAgain (0.23s) ./cmd/mesh-controller --- PASS: TestABacklogReleasedByAPersonIsSaidStarted (0.22s) ./cmd/mesh-controller --- PASS: TestAWalkEndedByCancelOrClearIsSaidEnded (0.29s) ./cmd/mesh-controller --- PASS: TestAWalkRestartedByARebuildIsSaidStarted (0.23s) ./cmd/mesh-controller --- PASS: TestAWalkStoppedByHandAndRetriedEndsFailedWhenItFailsAgain (0.29s) ./cmd/mesh-controller --- PASS: TestReplay237 (0.25s) ./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeUnresolvedSaysSoOnceInItsAnswer (0.24s) ./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeResolvedSaysNothingOfIt (0.23s) ./cmd/mesh-controller --- PASS: TestAnAssignThatLeavesItsNodeUnresolvedSaysOnlyThePlansRefusal (0.22s) ./cmd/mesh-controller --- PASS: TestADirectoryOwnersKeyIsRefusedThroughAVerb (0.26s) ./cmd/mesh-controller --- PASS: TestTheSendMakesNoValueForAnOutsideSecretNobodyGave (0.39s) ./cmd/mesh-controller --- PASS: TestAQuestionComposesWithoutAnOutsideSecretNobodyGave (0.34s) ./cmd/mesh-controller --- PASS: TestReplay201 (0.22s) ./cmd/mesh-controller --- PASS: TestARollbackWhoseSendWasRefusedIsCompletedByTheNextSend (0.17s) ./cmd/mesh-controller --- PASS: TestAGateJudgesTheOtherMovesBesideAKeptCore (0.23s) ./cmd/mesh-controller --- PASS: TestReplay401 (0.42s) ./cmd/mesh-controller --- PASS: TestReplay201ThePlansSend (0.55s) ./cmd/mesh-controller --- PASS: TestPlanAndNodeListAnOptionalRequirementLeftUnbound (0.34s) ./cmd/mesh-controller --- PASS: TestReplay340 (0.30s) ./cmd/mesh-controller --- PASS: TestOnlyATrustedFilesNamedKeyIsRefusedThroughAVerb (0.22s) ./cmd/mesh-controller --- PASS: TestReplay349 (0.26s) ./cmd/mesh-controller --- PASS: TestReplay348AFaultFromBeforeTheSendFailsNoGate (0.21s) ./cmd/mesh-controller --- PASS: TestReplay239AModuleNameIsNotTakenOverByAnotherRepository (0.45s) ./cmd/mesh-controller --- PASS: TestAWalkThatMovedNothingSaysWhichModulesMatchedWhatRuns (0.21s) ./cmd/mesh-controller --- PASS: TestReplay614ANewSDKPlansTheToolchainAndThenItsBundles (0.10s) ./cmd/mesh-controller --- PASS: TestOneAcceptForAProviderIsPlacedForEveryConsumer (0.57s) ./cmd/mesh-controller --- PASS: TestReplay164 (0.69s) ./cmd/mesh-controller --- PASS: TestAnApprovedLayerOpensTheWalkThatSendsIt (0.23s) ./cmd/mesh-controller --- PASS: TestASettingsWalkSendsOneMachineAtATimeEachJudged (0.23s) ./cmd/mesh-controller --- PASS: TestAFailedSettingsWalkStopsAndHoldsNothingBack (0.24s) ./cmd/mesh-controller --- PASS: TestASettingsWalkSendsTheLayerAloneEveryBuildKept (0.25s) ./cmd/mesh-controller --- PASS: TestASettingsWalkStopsBeforeADataMoveAndPassesOverAMachineAway (0.60s) ./cmd/mesh-controller --- PASS: TestACrossingSendSupersedesASettingsGate (0.20s) ./cmd/mesh-controller --- PASS: TestASettingsWalkFailsOnARefusalThatCannotClear (0.20s) ./cmd/mesh-controller --- PASS: TestAProviderElsewhereServesItsOwnComposedName (0.30s) ./cmd/mesh-controller --- PASS: TestAReusedCheckBuildIsRegisteredByItsDigestAndGatedAsABuiltOne (0.33s) ./cmd/mesh-controller --- PASS: TestAReleaseSendsTheRestAtOnceAfterTheFirstPasses (0.37s) ./cmd/mesh-controller --- PASS: TestARestMachineThatFailsIsPutBackAloneAndTheOthersAreJudgedOn (0.28s) ./cmd/mesh-controller --- PASS: TestAWalkTakesOverTheReadingsOfAGateJudgingTheSameBuildThere (0.33s) ./cmd/mesh-controller --- PASS: TestAFirstSendMadeAndNotKeptIsNotSentAgain (0.34s) ./cmd/mesh-controller --- PASS: TestAReleaseSendKeptAndMadeIsNotMadeAgain (0.23s) ./cmd/mesh-controller --- PASS: TestAFirstMachineThatFailsStillStopsTheWalk (0.23s) ./cmd/mesh-controller --- PASS: TestTheControlNodeIsSentLastInAStep (0.36s) ./cmd/mesh-controller --- PASS: TestARestMachineSilentPastItsBoundIsLeftAndSaid (0.29s) ./cmd/mesh-controller --- PASS: TestANoMoveTierWaitsForNoNewReport (0.24s) ./cmd/mesh-controller --- PASS: TestOneProviderDownAndThreeConsumersFailingAreOneCondition (0.28s) ./cmd/mesh-controller --- PASS: TestAConsumerFailingBesideAHealthyProviderIsItsOwn (0.52s) ./internal/inventory --- PASS: TestTheLastSendSaysWhatTheMachineAnswered (0.09s) ./internal/inventory --- PASS: TestAReportIsTheLastSendsAnswerOnlyWhenItIsAboutThatSend (0.10s) ./internal/inventory --- PASS: TestAnIssuedValueIsSealedToEveryHolderOnceAndNotAgain (0.20s) ./internal/inventory --- PASS: TestAnIssuedValueIsSealedAgainAfterAKeyChangeOrAnAcceptance (0.10s) ./internal/inventory --- PASS: TestAConditionsLooksAreKeptBesideTheBucket (0.08s) ./internal/inventory --- PASS: TestAPlanIdHoldingAQuoteIsReadAsAPlainId (0.08s) ./internal/inventory --- PASS: TestAWalksStartIsKeptAndARefusedSaveLeavesItUnsaid (0.08s) ./internal/inventory --- PASS: TestAWalksRestIsReadFromEachMachinesOwnSend (0.08s) ./internal/inventory --- PASS: TestAStoredBuildWithASilentMergeableFileIsStillReadAndComposed (0.08s) ./internal/inventory --- PASS: TestACredentialIssuedOutsideIsNeverMade (0.10s) ./internal/inventory --- PASS: TestOneAcceptForAProviderIsSealedToEveryConsumer (0.09s) ./internal/inventory --- PASS: TestASharedOwnSecretIssuedOutsideIsNeverMade (0.08s) ./internal/inventory --- PASS: TestAReportOfABusyContainerIsKeptAndReadBack (0.11s) ```
mesh-admin left a comment
Author
Contributor
Copy Link
Copy Source

Verdict: sound at fd9308d328, with two small follow-ups; do not merge while mesh/delivery-group is red (the catalogue member #292 is being re-opened).

Independent review for issue 270 under ADR 0357 (the bus module says every user's slow consumer and closed connection; S9 raises them).

Checks at this head: mesh/merge-gate success ("PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller)"), mesh/repo-check success ("PASS — its merge-check.sh passed"), mesh/delivery success ("ready: waits for its merge"), mesh/delivery-group FAILURE, set 06:44:41 ("group fix/270-the-bus-module-says-every-users-slow-consumer rejected: a member's own check failed").

  1. The module-check change does not widen what the bus account may publish. ParseManifest now lets a bus module declare emits only when it ships a tools bundle; everything else it might say or hear is still refused. The account's grant is unchanged: PermissionsFor returns BusSnapshotGrants and its own inbox for KindModule with SnapshotsTheBus before Emits is ever read. The runtime that carries the bundle gets the events under mesh.mod.nats.event.*, as for any module. TestTheRuntimeCarryingTheBusModuleMayPublishItsEventsAndTheBussAccountMayNot asserts both sides, and the catalogue test fails against main's manifest.go ("a bus module whose tools bundle declares what it emits was refused").
  2. Counted twice. Within one read, a closure is counted once per user and kind, by user, connection id and opening time; a closure said again after a restart is counted once (tested). Across ticks the hour is read afresh and Times is set from Count, as for every other advisory, so the looks are not added up. One exception: MergeAdvisories adds the controller's own client-side slow consumer and the server's closure of the controller's connection into one advisory with Count 2, and the test asserts 2. Those are two sightings of what is usually one incident, so the condition says "2 times" for one. Suggest the larger of the two counts, or count only the server's closures when both are there.
  3. Read cost per tick. With nothing in the last hour, it is two direct reads (GetLastMsg of each event). With something, every 30 s tick creates an ordered ephemeral consumer from now-1h on mesh.mod.nats.event.bus.>, reads every message to NumPending 0, and deletes it. That is bounded by what the module said in the hour, but nothing caps it: a user flapping every few seconds is thousands of messages per tick. Suggest a cap on messages read per tick that says when it was reached.
  4. No credential reaches a condition. The event is parsed into a fixed struct (user, connection name, cid, reason, opened, closed, pending bytes); any other field is dropped. The condition names the user in words, the reason and the times; Said also carries the client's connection name, a label the client chooses. Whether the bus module never puts a credential in the event is #292's to show.
  5. Also, not blocking: an error reading the bus module's events sets advisoriesErr, which makes the whole S9 row unable to judge, the controller's own advisories and dead letters included. That is loud, but one missing stream blinds S9. Suggest keeping the bus-module read's error apart.

Niced on g14: go vet clean on the four packages; TestNatsBusFaultsAreOnePerUserAndKindEachClosureCountedOnce, TestNatsBusFaultsReadNothingWhenTheBusModuleSaidNothing, TestTheControllersOwnSlowConsumerAndItsClosedConnectionAreOneAdvisory, TestTheRuntimeCarrying..., TestTheBussAccountSaysNothingOnTheBus and TestAUserTheBusClosedAsASlowConsumerIsOneCondition... all PASS. The full suite is in the repo-check above.

Reviewed by an independent reviewer on g14.

Verdict: sound at fd9308d3287e, with two small follow-ups; do not merge while mesh/delivery-group is red (the catalogue member #292 is being re-opened). Independent review for issue 270 under ADR 0357 (the bus module says every user's slow consumer and closed connection; S9 raises them). Checks at this head: mesh/merge-gate success ("PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller)"), mesh/repo-check success ("PASS — its merge-check.sh passed"), mesh/delivery success ("ready: waits for its merge"), mesh/delivery-group FAILURE, set 06:44:41 ("group fix/270-the-bus-module-says-every-users-slow-consumer rejected: a member's own check failed"). 1. The module-check change does not widen what the bus account may publish. ParseManifest now lets a bus module declare `emits` only when it ships a tools bundle; everything else it might say or hear is still refused. The account's grant is unchanged: PermissionsFor returns BusSnapshotGrants and its own inbox for KindModule with SnapshotsTheBus before Emits is ever read. The runtime that carries the bundle gets the events under mesh.mod.nats.event.*, as for any module. TestTheRuntimeCarryingTheBusModuleMayPublishItsEventsAndTheBussAccountMayNot asserts both sides, and the catalogue test fails against main's manifest.go ("a bus module whose tools bundle declares what it emits was refused"). 2. Counted twice. Within one read, a closure is counted once per user and kind, by user, connection id and opening time; a closure said again after a restart is counted once (tested). Across ticks the hour is read afresh and Times is set from Count, as for every other advisory, so the looks are not added up. One exception: MergeAdvisories adds the controller's own client-side slow consumer and the server's closure of the controller's connection into one advisory with Count 2, and the test asserts 2. Those are two sightings of what is usually one incident, so the condition says "2 times" for one. Suggest the larger of the two counts, or count only the server's closures when both are there. 3. Read cost per tick. With nothing in the last hour, it is two direct reads (GetLastMsg of each event). With something, every 30 s tick creates an ordered ephemeral consumer from now-1h on mesh.mod.nats.event.bus.>, reads every message to NumPending 0, and deletes it. That is bounded by what the module said in the hour, but nothing caps it: a user flapping every few seconds is thousands of messages per tick. Suggest a cap on messages read per tick that says when it was reached. 4. No credential reaches a condition. The event is parsed into a fixed struct (user, connection name, cid, reason, opened, closed, pending bytes); any other field is dropped. The condition names the user in words, the reason and the times; Said also carries the client's connection name, a label the client chooses. Whether the bus module never puts a credential in the event is #292's to show. 5. Also, not blocking: an error reading the bus module's events sets advisoriesErr, which makes the whole S9 row unable to judge, the controller's own advisories and dead letters included. That is loud, but one missing stream blinds S9. Suggest keeping the bus-module read's error apart. Niced on g14: go vet clean on the four packages; TestNatsBusFaultsAreOnePerUserAndKindEachClosureCountedOnce, TestNatsBusFaultsReadNothingWhenTheBusModuleSaidNothing, TestTheControllersOwnSlowConsumerAndItsClosedConnectionAreOneAdvisory, TestTheRuntimeCarrying..., TestTheBussAccountSaysNothingOnTheBus and TestAUserTheBusClosedAsASlowConsumerIsOneCondition... all PASS. The full suite is in the repo-check above. Reviewed by an independent reviewer on g14.
jschoubben added 1 commit 2026-10-14 07:02:50 +00:00
Bound the read of bus-module events, keep S9 seeing when it fails, count the controller's own slow consumer once (hq issue 270, review of #326)
mesh/merge-gate head 45870ab31cc5 merged into trunk 3479a35462b2 — pass: builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step; every …
Details
mesh/repo-check head 45870ab31cc5 merged into trunk 3479a35462b2 — pass: its merge-check.sh passed
Details
mesh/delivery delivered
Details
45870ab31c 
A storm of closures must not spend a watchdog tick, so the read stops at 2000
events and says the count is a floor. A failed read is its own condition
rather than blinding S9, so the controller's own signals are still said. The
controller's fall behind, told to its client and closed by the server, is one
fault, counted once.
mesh-admin commented 2026-10-14 07:10:52 +00:00
Author
Contributor
Copy Link
Copy Source

Merge check at 45870ab3
Judged: head 45870ab31cc5 merged into trunk 3479a35462b2; read beside it: mesh-catalog a44d490d974c, mesh-controller-main 3479a35462b2, mesh-host 1a2677882380, mesh-tools 954e1a53eef9

  • mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller)
  • mesh/repo-check: PASS — its merge-check.sh passed

Delivery plan — builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step

  • tier 0: mesh-controller
  • tier 1: build-agent
  • ace: receives build-agent
  • g14: receives build-agent
  • novox: receives mesh-controller, build-agent
  • shanks: receives build-agent
  • build-agent keeps data (ADR 0233): what it holds is backed up before it moves
  • grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before build-agent is judged on its first machine
  • read by no module's build: cmd/mesh-controller/bus_users_closed_test.go, internal/broker/bus_module_emits_test.go, internal/catalogue/bus_snapshot_test.go, internal/link/busfaults_test.go

Run by the build seat on shanks as build-1791961397786396384 (builds --log build-1791961397786396384).

--- the gate: build-agent, mesh-controller
mesh-controller: ok, 60 tool(s); WARNING: merge-window ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
long-running resources without health: 1
files asking for a setting without saying whether it is trusted: 1
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-14T05:31:20Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-14T05:31:20Z

modules the change moves:
  - mesh-controller (changed)

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 2 module(s) in 2 tier(s): build-agent, mesh-controller

notes:
  - cmd/mesh-controller/bus_users_closed_test.go, internal/broker/bus_module_emits_test.go, internal/catalogue/bus_snapshot_test.go and internal/link/busfaults_test.go read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok  	github.com/novox/mesh-controller/cmd/mesh-builder	1.094s
ok  	github.com/novox/mesh-controller/cmd/mesh-controller	221.443s
ok  	github.com/novox/mesh-controller/examples/objectstore-provisioner	1.030s
ok  	github.com/novox/mesh-controller/examples/postgres-provisioner	1.054s
ok  	github.com/novox/mesh-controller/examples/redis-provisioner	1.070s
ok  	github.com/novox/mesh-controller/examples/route-proxy	1.256s
ok  	github.com/novox/mesh-controller/internal/artifacts	1.083s
?   	github.com/novox/mesh-controller/internal/beside	[no test files]
ok  	github.com/novox/mesh-controller/internal/broker	4.727s
ok  	github.com/novox/mesh-controller/internal/builder	73.116s
ok  	github.com/novox/mesh-controller/internal/catalogue	8.724s
ok  	github.com/novox/mesh-controller/internal/conditions	2.692s
ok  	github.com/novox/mesh-controller/internal/envfile	1.044s
ok  	github.com/novox/mesh-controller/internal/facts	1.081s
ok  	github.com/novox/mesh-controller/internal/identity	6.343s
ok  	github.com/novox/mesh-controller/internal/inventory	68.329s
ok  	github.com/novox/mesh-controller/internal/lease	17.728s
ok  	github.com/novox/mesh-controller/internal/licences	5.165s
ok  	github.com/novox/mesh-controller/internal/licences/adapters	1.038s
ok  	github.com/novox/mesh-controller/internal/link	74.863s
ok  	github.com/novox/mesh-controller/internal/lint	2.529s
ok  	github.com/novox/mesh-controller/internal/outward	1.121s
ok  	github.com/novox/mesh-controller/internal/overlay	1.083s
ok  	github.com/novox/mesh-controller/internal/secrets	1.557s
ok  	github.com/novox/mesh-controller/internal/store	3.810s
ok  	github.com/novox/mesh-controller/internal/testbus	1.287s
ok  	github.com/novox/mesh-controller/internal/token	1.015s
store tests, each run against the store:
  ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeWalksTheOthersAgain (0.25s)
  ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeEndsTheMergesThatContainIt (0.27s)
  ./cmd/mesh-controller --- PASS: TestAStopWalksTheOthersAgainInTheOpenBatch (0.24s)
  ./cmd/mesh-controller --- PASS: TestAStopNamesWhatStaysOnTheMachinesAndWhatStillCarriesIt (0.23s)
  ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeLeavesItOutOfABatch (0.22s)
  ./cmd/mesh-controller --- PASS: TestSavingPlansAndMovingMergesIsOneAct (0.19s)
  ./cmd/mesh-controller --- PASS: TestAPlanFollowedFromTheStoreAnswersWhenItMoves (1.98s)
  ./cmd/mesh-controller --- PASS: TestNodeShowAndStatusReadTheLastSendFromTheStore (0.26s)
  ./cmd/mesh-controller --- PASS: TestTheConditionsVerbReadsTheLooksTheBucketNoLongerHolds (0.13s)
  ./cmd/mesh-controller --- PASS: TestAWalkLetGoAndStoppedByVerbsIsSaidStartedAndEnded (0.26s)
  ./cmd/mesh-controller --- PASS: TestAWalkStoppedOrClosedByAPersonIsSaidEndedStopped (0.25s)
  ./cmd/mesh-controller --- PASS: TestAWalkRetriedByAPersonIsSaidStartedAgain (0.21s)
  ./cmd/mesh-controller --- PASS: TestABacklogReleasedByAPersonIsSaidStarted (0.22s)
  ./cmd/mesh-controller --- PASS: TestAWalkEndedByCancelOrClearIsSaidEnded (0.28s)
  ./cmd/mesh-controller --- PASS: TestAWalkRestartedByARebuildIsSaidStarted (0.23s)
  ./cmd/mesh-controller --- PASS: TestAWalkStoppedByHandAndRetriedEndsFailedWhenItFailsAgain (0.27s)
  ./cmd/mesh-controller --- PASS: TestReplay237 (0.22s)
  ./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeUnresolvedSaysSoOnceInItsAnswer (0.21s)
  ./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeResolvedSaysNothingOfIt (0.22s)
  ./cmd/mesh-controller --- PASS: TestAnAssignThatLeavesItsNodeUnresolvedSaysOnlyThePlansRefusal (0.22s)
  ./cmd/mesh-controller --- PASS: TestADirectoryOwnersKeyIsRefusedThroughAVerb (0.25s)
  ./cmd/mesh-controller --- PASS: TestTheSendMakesNoValueForAnOutsideSecretNobodyGave (0.30s)
  ./cmd/mesh-controller --- PASS: TestAQuestionComposesWithoutAnOutsideSecretNobodyGave (0.32s)
  ./cmd/mesh-controller --- PASS: TestReplay201 (0.17s)
  ./cmd/mesh-controller --- PASS: TestARollbackWhoseSendWasRefusedIsCompletedByTheNextSend (0.16s)
  ./cmd/mesh-controller --- PASS: TestAGateJudgesTheOtherMovesBesideAKeptCore (0.18s)
  ./cmd/mesh-controller --- PASS: TestReplay401 (0.31s)
  ./cmd/mesh-controller --- PASS: TestReplay201ThePlansSend (0.26s)
  ./cmd/mesh-controller --- PASS: TestPlanAndNodeListAnOptionalRequirementLeftUnbound (0.30s)
  ./cmd/mesh-controller --- PASS: TestReplay340 (0.26s)
  ./cmd/mesh-controller --- PASS: TestOnlyATrustedFilesNamedKeyIsRefusedThroughAVerb (0.21s)
  ./cmd/mesh-controller --- PASS: TestReplay349 (0.22s)
  ./cmd/mesh-controller --- PASS: TestReplay348AFaultFromBeforeTheSendFailsNoGate (0.19s)
  ./cmd/mesh-controller --- PASS: TestReplay239AModuleNameIsNotTakenOverByAnotherRepository (0.16s)
  ./cmd/mesh-controller --- PASS: TestAWalkThatMovedNothingSaysWhichModulesMatchedWhatRuns (0.20s)
  ./cmd/mesh-controller --- PASS: TestReplay614ANewSDKPlansTheToolchainAndThenItsBundles (0.08s)
  ./cmd/mesh-controller --- PASS: TestOneAcceptForAProviderIsPlacedForEveryConsumer (0.51s)
  ./cmd/mesh-controller --- PASS: TestReplay164 (0.31s)
  ./cmd/mesh-controller --- PASS: TestAnApprovedLayerOpensTheWalkThatSendsIt (0.22s)
  ./cmd/mesh-controller --- PASS: TestASettingsWalkSendsOneMachineAtATimeEachJudged (0.22s)
  ./cmd/mesh-controller --- PASS: TestAFailedSettingsWalkStopsAndHoldsNothingBack (0.21s)
  ./cmd/mesh-controller --- PASS: TestASettingsWalkSendsTheLayerAloneEveryBuildKept (0.20s)
  ./cmd/mesh-controller --- PASS: TestASettingsWalkStopsBeforeADataMoveAndPassesOverAMachineAway (0.57s)
  ./cmd/mesh-controller --- PASS: TestACrossingSendSupersedesASettingsGate (0.19s)
  ./cmd/mesh-controller --- PASS: TestASettingsWalkFailsOnARefusalThatCannotClear (0.18s)
  ./cmd/mesh-controller --- PASS: TestAProviderElsewhereServesItsOwnComposedName (0.28s)
  ./cmd/mesh-controller --- PASS: TestAReusedCheckBuildIsRegisteredByItsDigestAndGatedAsABuiltOne (0.33s)
  ./cmd/mesh-controller --- PASS: TestAReleaseSendsTheRestAtOnceAfterTheFirstPasses (0.27s)
  ./cmd/mesh-controller --- PASS: TestARestMachineThatFailsIsPutBackAloneAndTheOthersAreJudgedOn (0.24s)
  ./cmd/mesh-controller --- PASS: TestAWalkTakesOverTheReadingsOfAGateJudgingTheSameBuildThere (0.20s)
  ./cmd/mesh-controller --- PASS: TestAFirstSendMadeAndNotKeptIsNotSentAgain (0.26s)
  ./cmd/mesh-controller --- PASS: TestAReleaseSendKeptAndMadeIsNotMadeAgain (0.20s)
  ./cmd/mesh-controller --- PASS: TestAFirstMachineThatFailsStillStopsTheWalk (0.22s)
  ./cmd/mesh-controller --- PASS: TestTheControlNodeIsSentLastInAStep (0.25s)
  ./cmd/mesh-controller --- PASS: TestARestMachineSilentPastItsBoundIsLeftAndSaid (0.23s)
  ./cmd/mesh-controller --- PASS: TestANoMoveTierWaitsForNoNewReport (0.25s)
  ./cmd/mesh-controller --- PASS: TestOneProviderDownAndThreeConsumersFailingAreOneCondition (0.18s)
  ./cmd/mesh-controller --- PASS: TestAConsumerFailingBesideAHealthyProviderIsItsOwn (0.17s)
  ./internal/inventory --- PASS: TestTheLastSendSaysWhatTheMachineAnswered (0.09s)
  ./internal/inventory --- PASS: TestAReportIsTheLastSendsAnswerOnlyWhenItIsAboutThatSend (0.09s)
  ./internal/inventory --- PASS: TestAnIssuedValueIsSealedToEveryHolderOnceAndNotAgain (0.10s)
  ./internal/inventory --- PASS: TestAnIssuedValueIsSealedAgainAfterAKeyChangeOrAnAcceptance (0.09s)
  ./internal/inventory --- PASS: TestAConditionsLooksAreKeptBesideTheBucket (0.07s)
  ./internal/inventory --- PASS: TestAPlanIdHoldingAQuoteIsReadAsAPlainId (0.08s)
  ./internal/inventory --- PASS: TestAWalksStartIsKeptAndARefusedSaveLeavesItUnsaid (0.07s)
  ./internal/inventory --- PASS: TestAWalksRestIsReadFromEachMachinesOwnSend (0.08s)
  ./internal/inventory --- PASS: TestAStoredBuildWithASilentMergeableFileIsStillReadAndComposed (0.07s)
  ./internal/inventory --- PASS: TestACredentialIssuedOutsideIsNeverMade (0.09s)
  ./internal/inventory --- PASS: TestOneAcceptForAProviderIsSealedToEveryConsumer (0.09s)
  ./internal/inventory --- PASS: TestASharedOwnSecretIssuedOutsideIsNeverMade (0.08s)
  ./internal/inventory --- PASS: TestAReportOfABusyContainerIsKeptAndReadBack (0.09s)
**Merge check** at `45870ab3` Judged: head `45870ab31cc5` merged into trunk `3479a35462b2`; read beside it: mesh-catalog `a44d490d974c`, mesh-controller-main `3479a35462b2`, mesh-host `1a2677882380`, mesh-tools `954e1a53eef9` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller) - `mesh/repo-check`: **PASS** — its merge-check.sh passed **Delivery plan** — builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step - tier 0: mesh-controller - tier 1: build-agent - ace: receives build-agent - g14: receives build-agent - novox: receives mesh-controller, build-agent - shanks: receives build-agent - build-agent keeps data (ADR 0233): what it holds is backed up before it moves - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before build-agent is judged on its first machine - read by no module's build: cmd/mesh-controller/bus_users_closed_test.go, internal/broker/bus_module_emits_test.go, internal/catalogue/bus_snapshot_test.go, internal/link/busfaults_test.go Run by the build seat on shanks as `build-1791961397786396384` (`builds --log build-1791961397786396384`). ``` --- the gate: build-agent, mesh-controller mesh-controller: ok, 60 tool(s); WARNING: merge-window ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8) long-running resources without health: 1 files asking for a setting without saying whether it is trusted: 1 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-14T05:31:20Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-14T05:31:20Z modules the change moves: - mesh-controller (changed) machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 2 module(s) in 2 tier(s): build-agent, mesh-controller notes: - cmd/mesh-controller/bus_users_closed_test.go, internal/broker/bus_module_emits_test.go, internal/catalogue/bus_snapshot_test.go and internal/link/busfaults_test.go read by no module's build, and rebuild nothing (issue 280) --- its merge-check.sh (go toolchain) ok github.com/novox/mesh-controller/cmd/mesh-builder 1.094s ok github.com/novox/mesh-controller/cmd/mesh-controller 221.443s ok github.com/novox/mesh-controller/examples/objectstore-provisioner 1.030s ok github.com/novox/mesh-controller/examples/postgres-provisioner 1.054s ok github.com/novox/mesh-controller/examples/redis-provisioner 1.070s ok github.com/novox/mesh-controller/examples/route-proxy 1.256s ok github.com/novox/mesh-controller/internal/artifacts 1.083s ? github.com/novox/mesh-controller/internal/beside [no test files] ok github.com/novox/mesh-controller/internal/broker 4.727s ok github.com/novox/mesh-controller/internal/builder 73.116s ok github.com/novox/mesh-controller/internal/catalogue 8.724s ok github.com/novox/mesh-controller/internal/conditions 2.692s ok github.com/novox/mesh-controller/internal/envfile 1.044s ok github.com/novox/mesh-controller/internal/facts 1.081s ok github.com/novox/mesh-controller/internal/identity 6.343s ok github.com/novox/mesh-controller/internal/inventory 68.329s ok github.com/novox/mesh-controller/internal/lease 17.728s ok github.com/novox/mesh-controller/internal/licences 5.165s ok github.com/novox/mesh-controller/internal/licences/adapters 1.038s ok github.com/novox/mesh-controller/internal/link 74.863s ok github.com/novox/mesh-controller/internal/lint 2.529s ok github.com/novox/mesh-controller/internal/outward 1.121s ok github.com/novox/mesh-controller/internal/overlay 1.083s ok github.com/novox/mesh-controller/internal/secrets 1.557s ok github.com/novox/mesh-controller/internal/store 3.810s ok github.com/novox/mesh-controller/internal/testbus 1.287s ok github.com/novox/mesh-controller/internal/token 1.015s store tests, each run against the store: ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeWalksTheOthersAgain (0.25s) ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeEndsTheMergesThatContainIt (0.27s) ./cmd/mesh-controller --- PASS: TestAStopWalksTheOthersAgainInTheOpenBatch (0.24s) ./cmd/mesh-controller --- PASS: TestAStopNamesWhatStaysOnTheMachinesAndWhatStillCarriesIt (0.23s) ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeLeavesItOutOfABatch (0.22s) ./cmd/mesh-controller --- PASS: TestSavingPlansAndMovingMergesIsOneAct (0.19s) ./cmd/mesh-controller --- PASS: TestAPlanFollowedFromTheStoreAnswersWhenItMoves (1.98s) ./cmd/mesh-controller --- PASS: TestNodeShowAndStatusReadTheLastSendFromTheStore (0.26s) ./cmd/mesh-controller --- PASS: TestTheConditionsVerbReadsTheLooksTheBucketNoLongerHolds (0.13s) ./cmd/mesh-controller --- PASS: TestAWalkLetGoAndStoppedByVerbsIsSaidStartedAndEnded (0.26s) ./cmd/mesh-controller --- PASS: TestAWalkStoppedOrClosedByAPersonIsSaidEndedStopped (0.25s) ./cmd/mesh-controller --- PASS: TestAWalkRetriedByAPersonIsSaidStartedAgain (0.21s) ./cmd/mesh-controller --- PASS: TestABacklogReleasedByAPersonIsSaidStarted (0.22s) ./cmd/mesh-controller --- PASS: TestAWalkEndedByCancelOrClearIsSaidEnded (0.28s) ./cmd/mesh-controller --- PASS: TestAWalkRestartedByARebuildIsSaidStarted (0.23s) ./cmd/mesh-controller --- PASS: TestAWalkStoppedByHandAndRetriedEndsFailedWhenItFailsAgain (0.27s) ./cmd/mesh-controller --- PASS: TestReplay237 (0.22s) ./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeUnresolvedSaysSoOnceInItsAnswer (0.21s) ./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeResolvedSaysNothingOfIt (0.22s) ./cmd/mesh-controller --- PASS: TestAnAssignThatLeavesItsNodeUnresolvedSaysOnlyThePlansRefusal (0.22s) ./cmd/mesh-controller --- PASS: TestADirectoryOwnersKeyIsRefusedThroughAVerb (0.25s) ./cmd/mesh-controller --- PASS: TestTheSendMakesNoValueForAnOutsideSecretNobodyGave (0.30s) ./cmd/mesh-controller --- PASS: TestAQuestionComposesWithoutAnOutsideSecretNobodyGave (0.32s) ./cmd/mesh-controller --- PASS: TestReplay201 (0.17s) ./cmd/mesh-controller --- PASS: TestARollbackWhoseSendWasRefusedIsCompletedByTheNextSend (0.16s) ./cmd/mesh-controller --- PASS: TestAGateJudgesTheOtherMovesBesideAKeptCore (0.18s) ./cmd/mesh-controller --- PASS: TestReplay401 (0.31s) ./cmd/mesh-controller --- PASS: TestReplay201ThePlansSend (0.26s) ./cmd/mesh-controller --- PASS: TestPlanAndNodeListAnOptionalRequirementLeftUnbound (0.30s) ./cmd/mesh-controller --- PASS: TestReplay340 (0.26s) ./cmd/mesh-controller --- PASS: TestOnlyATrustedFilesNamedKeyIsRefusedThroughAVerb (0.21s) ./cmd/mesh-controller --- PASS: TestReplay349 (0.22s) ./cmd/mesh-controller --- PASS: TestReplay348AFaultFromBeforeTheSendFailsNoGate (0.19s) ./cmd/mesh-controller --- PASS: TestReplay239AModuleNameIsNotTakenOverByAnotherRepository (0.16s) ./cmd/mesh-controller --- PASS: TestAWalkThatMovedNothingSaysWhichModulesMatchedWhatRuns (0.20s) ./cmd/mesh-controller --- PASS: TestReplay614ANewSDKPlansTheToolchainAndThenItsBundles (0.08s) ./cmd/mesh-controller --- PASS: TestOneAcceptForAProviderIsPlacedForEveryConsumer (0.51s) ./cmd/mesh-controller --- PASS: TestReplay164 (0.31s) ./cmd/mesh-controller --- PASS: TestAnApprovedLayerOpensTheWalkThatSendsIt (0.22s) ./cmd/mesh-controller --- PASS: TestASettingsWalkSendsOneMachineAtATimeEachJudged (0.22s) ./cmd/mesh-controller --- PASS: TestAFailedSettingsWalkStopsAndHoldsNothingBack (0.21s) ./cmd/mesh-controller --- PASS: TestASettingsWalkSendsTheLayerAloneEveryBuildKept (0.20s) ./cmd/mesh-controller --- PASS: TestASettingsWalkStopsBeforeADataMoveAndPassesOverAMachineAway (0.57s) ./cmd/mesh-controller --- PASS: TestACrossingSendSupersedesASettingsGate (0.19s) ./cmd/mesh-controller --- PASS: TestASettingsWalkFailsOnARefusalThatCannotClear (0.18s) ./cmd/mesh-controller --- PASS: TestAProviderElsewhereServesItsOwnComposedName (0.28s) ./cmd/mesh-controller --- PASS: TestAReusedCheckBuildIsRegisteredByItsDigestAndGatedAsABuiltOne (0.33s) ./cmd/mesh-controller --- PASS: TestAReleaseSendsTheRestAtOnceAfterTheFirstPasses (0.27s) ./cmd/mesh-controller --- PASS: TestARestMachineThatFailsIsPutBackAloneAndTheOthersAreJudgedOn (0.24s) ./cmd/mesh-controller --- PASS: TestAWalkTakesOverTheReadingsOfAGateJudgingTheSameBuildThere (0.20s) ./cmd/mesh-controller --- PASS: TestAFirstSendMadeAndNotKeptIsNotSentAgain (0.26s) ./cmd/mesh-controller --- PASS: TestAReleaseSendKeptAndMadeIsNotMadeAgain (0.20s) ./cmd/mesh-controller --- PASS: TestAFirstMachineThatFailsStillStopsTheWalk (0.22s) ./cmd/mesh-controller --- PASS: TestTheControlNodeIsSentLastInAStep (0.25s) ./cmd/mesh-controller --- PASS: TestARestMachineSilentPastItsBoundIsLeftAndSaid (0.23s) ./cmd/mesh-controller --- PASS: TestANoMoveTierWaitsForNoNewReport (0.25s) ./cmd/mesh-controller --- PASS: TestOneProviderDownAndThreeConsumersFailingAreOneCondition (0.18s) ./cmd/mesh-controller --- PASS: TestAConsumerFailingBesideAHealthyProviderIsItsOwn (0.17s) ./internal/inventory --- PASS: TestTheLastSendSaysWhatTheMachineAnswered (0.09s) ./internal/inventory --- PASS: TestAReportIsTheLastSendsAnswerOnlyWhenItIsAboutThatSend (0.09s) ./internal/inventory --- PASS: TestAnIssuedValueIsSealedToEveryHolderOnceAndNotAgain (0.10s) ./internal/inventory --- PASS: TestAnIssuedValueIsSealedAgainAfterAKeyChangeOrAnAcceptance (0.09s) ./internal/inventory --- PASS: TestAConditionsLooksAreKeptBesideTheBucket (0.07s) ./internal/inventory --- PASS: TestAPlanIdHoldingAQuoteIsReadAsAPlainId (0.08s) ./internal/inventory --- PASS: TestAWalksStartIsKeptAndARefusedSaveLeavesItUnsaid (0.07s) ./internal/inventory --- PASS: TestAWalksRestIsReadFromEachMachinesOwnSend (0.08s) ./internal/inventory --- PASS: TestAStoredBuildWithASilentMergeableFileIsStillReadAndComposed (0.07s) ./internal/inventory --- PASS: TestACredentialIssuedOutsideIsNeverMade (0.09s) ./internal/inventory --- PASS: TestOneAcceptForAProviderIsSealedToEveryConsumer (0.09s) ./internal/inventory --- PASS: TestASharedOwnSecretIssuedOutsideIsNeverMade (0.08s) ./internal/inventory --- PASS: TestAReportOfABusyContainerIsKeptAndReadBack (0.09s) ```
mesh-admin left a comment
Author
Contributor
Copy Link
Copy Source

Verdict: sound, mergeable at 45870ab31cc5; the three follow-ups of review 271 are answered, and no mesh/delivery-group status is set now.

Re-review for issue 270 under ADR 0357.

Checks at this head: mesh/merge-gate success ("PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller)"), mesh/repo-check success ("PASS — its merge-check.sh passed"), mesh/delivery success ("ready: waits for its merge"). mesh/delivery-group: no status on this head, and the delivery names no group.

  1. Cap: BusFaults reads at most MaxBusEventsRead = 2000 events per tick, and a cut read appends "(at least: the read stopped at 2000 ...)" to every advisory (TestNatsBusFaultsReadAtMostTheBoundAndSaySo). A note, not blocking: the read starts at now-1h, so a cut keeps the OLDEST 2000. In a storm, "newest at" in the summary is then the 2000th event's time, not the newest. The condition stays open and says it is a floor, so nothing is hidden, but a read from the tail would name the newest.
  2. A failed read now sets busFaultsErr and raises its own warning, bus-faults-unread (scope bus, id bus-module, the first line of the error), while advisoriesErr and the controller's own signals and dead letters are untouched (TestABusModuleReadThatFailsKeepsTheControllersOwnSignals).
  3. MergeAdvisories keeps the larger of the two counts, so the controller's own slow consumer seen by its client library and closed by the server is counted once (the test now asserts that).

Niced on g14: go vet clean on internal/link and cmd/mesh-controller; the bus-fault tests in internal/link and the S9 bus tests in cmd/mesh-controller pass, skips only where a store is needed. The full suite is in the repo-check above.

Merge order: this one first. Then mesh-catalog #293 must be checked again; its red verdict was judged beside mesh-controller 2959c814, which still refuses a bus module's emits.

Reviewed by an independent reviewer on g14.

Verdict: sound, mergeable at 45870ab31cc5; the three follow-ups of review 271 are answered, and no mesh/delivery-group status is set now. Re-review for issue 270 under ADR 0357. Checks at this head: mesh/merge-gate success ("PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller)"), mesh/repo-check success ("PASS — its merge-check.sh passed"), mesh/delivery success ("ready: waits for its merge"). mesh/delivery-group: no status on this head, and the delivery names no group. 1. Cap: BusFaults reads at most MaxBusEventsRead = 2000 events per tick, and a cut read appends "(at least: the read stopped at 2000 ...)" to every advisory (TestNatsBusFaultsReadAtMostTheBoundAndSaySo). A note, not blocking: the read starts at now-1h, so a cut keeps the OLDEST 2000. In a storm, "newest at" in the summary is then the 2000th event's time, not the newest. The condition stays open and says it is a floor, so nothing is hidden, but a read from the tail would name the newest. 2. A failed read now sets busFaultsErr and raises its own warning, bus-faults-unread (scope bus, id bus-module, the first line of the error), while advisoriesErr and the controller's own signals and dead letters are untouched (TestABusModuleReadThatFailsKeepsTheControllersOwnSignals). 3. MergeAdvisories keeps the larger of the two counts, so the controller's own slow consumer seen by its client library and closed by the server is counted once (the test now asserts that). Niced on g14: go vet clean on internal/link and cmd/mesh-controller; the bus-fault tests in internal/link and the S9 bus tests in cmd/mesh-controller pass, skips only where a store is needed. The full suite is in the repo-check above. Merge order: this one first. Then mesh-catalog #293 must be checked again; its red verdict was judged beside mesh-controller 2959c814, which still refuses a bus module's emits. Reviewed by an independent reviewer on g14.
mesh-admin merged commit 04730b54a8 into main 2026-10-14 07:14:33 +00:00
mesh-admin deleted branch fix/270-the-bus-module-says-every-users-slow-consumer 2026-10-14 07:14:33 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
mesh-admin
Labels
No items
No labels
Milestone
No items
No Milestone
Assignees
Clear assignees
jschoubben miel.truyen
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: novox/mesh-controller#326