S15: a hand act a person decides by design is no repair, read from the verb that recorded it (hq to-be 45 §7) #94

2026-10-06T18:14:24Z

mesh-admin commented

2026-10-06 18:14:24 +00:00

mesh.hand-acts.bus-upgrade.healer-wanted was raised by two planned bus upgrades on 2026-10-05/06, and leaked-in-logs by two rotations after one leak. A bus upgrade is a person's planned act by design (ADR 0236), so it should never ask for a healer.

The rule. Instead of adding one more cause to personsDecision, handacts.go now has one table, handActVerbs, listing every verb that writes the hand-act log. Each entry says whether that verb records a repair or a person's decision, and why. S15 (watchHandActs) and hand-acts' repeated both read it through repairs(). When a verb is marked as a decision, its acts never count, whatever cause they give.

Decisions: retire approve, retire reject, cleanup delete (ADR 0230); bus upgrade (the bus is never rolled by the mesh); upgrade release-backlog (after a failed release plan the next one opens only on a person's word, ADR 0236); and secret rotate, but only when the cause is leaked-in-logs.
Repairs, which still count: push, plans stop/close, broker consumer-reset, conditions silence, hand-act record (an act outside the mesh, whose kind the mesh cannot tell), a rotation for any other cause, and any verb the table does not list.

Why leaked-in-logs is a decision. A person judges what was disclosed. One leak rotates several values, so the count measures values rather than repairs. A leak that keeps coming back is a defect in the module that prints the secrets, to be fixed through an issue against it, not by a healer that rotates.

Already-open conditions. S15 reconciles its whole row on every tick, so the open bus-upgrade and leaked-in-logs conditions clear on the first tick after deploy. In the live log, the bus upgrade recorded after the fact through hand-act record still counts, but it is now alone.

Tests:

a decision repeated raises nothing, even when it gives another cause
repairs still raise
one repair plus one decision raises nothing
conditions opened by the build before this one clear on the next tick, checked through the keeper
a source scan finds every verb the controller records and fails on any that handActVerbs does not list

The full suite passes with -p 1 against throwaway postgres:17 and nats:2.11, plus vet and gofmt. In parallel, the link and controller NATS tests fail against each other because they share one server, which is not caused by this change.

The hq side is a progressive-insight note in to-be 45 §7.

`mesh.hand-acts.bus-upgrade.healer-wanted` was raised by two planned bus upgrades on 2026-10-05/06, and `leaked-in-logs` by two rotations after one leak. A bus upgrade is a person's planned act by design (ADR 0236), so it should never ask for a healer. **The rule.** Instead of adding one more cause to `personsDecision`, `handacts.go` now has one table, `handActVerbs`, listing every verb that writes the hand-act log. Each entry says whether that verb records a repair or a person's decision, and why. S15 (`watchHandActs`) and `hand-acts`' `repeated` both read it through `repairs()`. When a verb is marked as a decision, its acts never count, whatever cause they give. - Decisions: `retire approve`, `retire reject`, `cleanup delete` (ADR 0230); `bus upgrade` (the bus is never rolled by the mesh); `upgrade release-backlog` (after a failed release plan the next one opens only on a person's word, ADR 0236); and `secret rotate`, but only when the cause is `leaked-in-logs`. - Repairs, which still count: `push`, `plans stop`/`close`, `broker consumer-reset`, `conditions silence`, `hand-act record` (an act outside the mesh, whose kind the mesh cannot tell), a rotation for any other cause, and any verb the table does not list. **Why `leaked-in-logs` is a decision.** A person judges what was disclosed. One leak rotates several values, so the count measures values rather than repairs. A leak that keeps coming back is a defect in the module that prints the secrets, to be fixed through an issue against it, not by a healer that rotates. **Already-open conditions.** S15 reconciles its whole row on every tick, so the open `bus-upgrade` and `leaked-in-logs` conditions clear on the first tick after deploy. In the live log, the bus upgrade recorded after the fact through `hand-act record` still counts, but it is now alone. **Tests:** - a decision repeated raises nothing, even when it gives another cause - repairs still raise - one repair plus one decision raises nothing - conditions opened by the build before this one clear on the next tick, checked through the keeper - a source scan finds every verb the controller records and fails on any that `handActVerbs` does not list The full suite passes with `-p 1` against throwaway postgres:17 and nats:2.11, plus vet and gofmt. In parallel, the link and controller NATS tests fail against each other because they share one server, which is not caused by this change. The hq side is a progressive-insight note in to-be 45 §7.

mesh-admin added 1 commit 2026-10-06 18:14:25 +00:00

S15: a hand act a person decides by design is no repair, read from the verb that recorded it b1016e5c66

Two planned bus upgrades raised healer-wanted, though ADR 0236 never lets
the mesh roll the bus. Instead of naming one more cause, the hand-act
verbs are one table saying which record a person's decision (retire
approve/reject, cleanup delete, bus upgrade, upgrade release-backlog, and
secret rotate after a leak); S15 and `hand-acts` skip those, push and the
other repairs keep counting. Conditions already open for them clear on the
next tick.

mesh-admin merged commit 58924dc920 into main

2026-10-06 18:14:47 +00:00

mesh-admin deleted branch fix/s15-a-persons-decision-is-no-repair

2026-10-06 18:14:47 +00:00

mesh-admin commented

2026-10-06 23:09:27 +00:00

Delivery novox/mesh-controller@05ccab2e4b6d — delivered since 2026-10-06T23:05:28Z

Machines

build-agent on ace: passed — healthy 3 times over 2m28s
build-agent on the rest running it: sent
mesh-controller on novox: passed — healthy 3 times over 3m48s
mesh-controller on the rest running it: sent
route-proxy on ace: passed — healthy 3 times over 2m34s
route-proxy on the rest running it: sent

Transitions

2026-10-06 23:05 (new) → proposed (announced): novox/mesh-controller#94 merged; its head was not heard by this owner, so it is made from the forge's word
2026-10-06 23:05 proposed → held (merged-unchecked): merged without a passing check — a verdict known with it is taken first: only a person decides that it goes on
2026-10-06 23:05 held → delivering (go): its walk started on a word that was not this owner's: the controller's own path, which waits for nobody, or a person's plans go
2026-10-06 23:05 delivering → delivered (done): its walk is done: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

**Delivery** `novox/mesh-controller@05ccab2e4b6d` — **delivered** since 2026-10-06T23:05:28Z **Machines** - build-agent on ace: passed — healthy 3 times over 2m28s - build-agent on the rest running it: sent - mesh-controller on novox: passed — healthy 3 times over 3m48s - mesh-controller on the rest running it: sent - route-proxy on ace: passed — healthy 3 times over 2m34s - route-proxy on the rest running it: sent **Transitions** - 2026-10-06 23:05 (new) → proposed (announced): novox/mesh-controller#94 merged; its head was not heard by this owner, so it is made from the forge's word - 2026-10-06 23:05 proposed → held (merged-unchecked): merged without a passing check — a verdict known with it is taken first: only a person decides that it goes on - 2026-10-06 23:05 held → delivering (go): its walk started on a word that was not this owner's: the controller's own path, which waits for nobody, or a person's `plans go` - 2026-10-06 23:05 delivering → delivered (done): its walk is done: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-admin referenced this pull request

2026-10-07 23:44:53 +00:00

No change to a machine takes effect unseen (hq ADR 0217) #50

jschoubben referenced this issue from a commit

2026-10-12 19:00:42 +00:00

Pin the node-engine at its ADR 0325 merge (#94), and capture it beside

mesh-admin referenced this pull request

2026-10-13 00:52:02 +00:00

Add the replay of issue 340: a verb set what every agent session obeys (hq issue 340) #288

mesh-admin referenced this pull request

2026-10-13 01:03:20 +00:00

Add the replay of issue 340: a verb set what every agent session obeys (hq issue 340) #288