jschoubben 5dd0e3c056 Raise S20 for every generation refusal, ask for a push when the counter was behind, and write a send's generation with its digest (hq issue 234 review) ...

A refusal of a send the mesh never recorded went only to stderr; it is now kept
with its sender said to be unknown, and raised. A counter behind the machine (a
store put back) is raised and the condition names push, since the receive loop
must not push. The node's digest and generation are one transaction, and a send
record that fails is said loudly without failing the send. The trigger ignores
an update that changes nothing, and the put-back mark is dropped: a put-back is
composed afresh with the current generation.

2026-10-11 11:55:27 +02:00

..

migrations

Raise S20 for every generation refusal, ask for a push when the counter was behind, and write a send's generation with its digest (hq issue 234 review)

2026-10-11 11:55:27 +02:00

addresses.go

A carried peer is nameable, and the mesh answers for it (hq 112)

2026-09-26 20:09:42 +02:00

adoption_test.go

A repeat assignment says nothing changed (ADR 0115)

2026-09-26 19:02:35 +02:00

adoption.go

The mesh says what filters a converged machine: filters kept per node, shown by node show, named by status, and previewed with their fates (hq ADR 0168)

2026-10-02 12:00:12 +02:00

agent_account_test.go

Refuse a node's accounts through any verb, and a stale or service-account agent verdict

2026-10-09 10:11:21 +02:00

artifacts_test.go

Answer what the records keep, collect on a person's word, and name a machine's images (hq ADR 0251)

2026-10-08 12:04:42 +02:00

asks_lab_test.go

Ask an acknowledgement apart from an approval, change every kept ask by compare-and-set, and rehearse rather than drill (hq ADR 0259, review M1/L2/L3/L7)

2026-10-09 16:22:34 +02:00

batches.go

Owe a merge to the record from its branch's first kept merge (hq ADR 0276 review)

2026-10-10 13:54:40 +02:00

bindings_test.go

Keep a consumer bound where its data is; only a pin moves it (hq ADR 0232, issue 273)

2026-10-06 15:19:23 +02:00

bindings.go

Keep a consumer bound where its data is; only a pin moves it (hq ADR 0232, issue 273)

2026-10-06 15:19:23 +02:00

buildinput_test.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

builds_test.go

Say why each module is in a plan: its build source's changed files, or why it is read whole (hq ADR 0267, issue 363)

2026-10-10 12:49:44 +02:00

builds.go

Say why each module is in a plan: its build source's changed files, or why it is read whole (hq ADR 0267, issue 363)

2026-10-10 12:49:44 +02:00

busrecords_test.go

Grant a bar one key of the state it shows, and per-machine state its own machine's key (hq ADR 0260)

2026-10-08 15:51:20 +02:00

busrecords.go

Serve a trusted holder from a runtime of its own account, refuse it in the machine's runtime, and say while an agent can become root where it runs (hq ADR 0259 §8)

2026-10-09 13:48:56 +02:00

busstep.go

Name the decision this builds: hq ADR 0236 (0235 is the bus's snapshot)

2026-10-06 18:56:54 +02:00

bususers_test.go

Genesis can raise a mesh on the new bus, and the carried user list is checked against the composer

2026-09-27 16:39:19 +02:00

bususers.go

One runtime principal per node carries every assigned module's tools (hq ADR 0175, to-be 38 WP2.1)

2026-10-02 18:16:14 +02:00

catalogue_test.go

Refuse the tools-container shape for every module (to-be 38 WP4b's last step)

2026-10-04 02:28:54 +02:00

catalogue.go

A trusted setting is proposed through the settings verb and set only on the operator's warrant (hq ADR 0277)

2026-10-10 14:42:40 +02:00

collection_test.go

Hold every kept archive by a manifest so the store's collector keeps it (hq issue 253)

2026-10-05 18:13:23 +02:00

collection.go

Record the bases a build copies, keep them by the builds that stood on them, and copy each image once

2026-10-08 15:47:42 +02:00

data_test.go

Keep one reading when two paths are measured at one moment, rather than failing the machine's record (hq issue 368 review)

2026-10-10 17:48:49 +02:00

data.go

Keep one reading when two paths are measured at one moment, rather than failing the machine's record (hq issue 368 review)

2026-10-10 17:48:49 +02:00

dependencies_test.go

Move a module on a merge only when its build source holds a changed file (hq ADR 0267, issue 363)

2026-10-10 03:20:36 +02:00

dependencies.go

Move a module on a merge only when its build source holds a changed file (hq ADR 0267, issue 363)

2026-10-10 03:20:36 +02:00

doing_test.go

Keep a named push from sending builds a policy or a plan holds back

2026-10-05 22:22:03 +02:00

durations_test.go

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

durations.go

Keep each walk's phases and say a delivery over its budget (hq ADR 0282 slice 1, issue 382)

2026-10-10 20:15:01 +02:00

forget_test.go

A take acts on the preview it showed; a setting is judged where it is stored; a kept network and a minted secret are said (hq ADR 0163)

2026-10-02 11:01:09 +02:00

fortest.go

Give each pending assignment its own condition, and keep a raised row until it clears

2026-10-08 16:45:43 +02:00

gate.go

A gate judges its own send and the build it sent, and never puts the controller back behind its store (hq issue 352)

2026-10-09 17:15:40 +02:00

givable_test.go

give: take only a value a person holds, ask the desk by name, let the controller alone ask it, and announce every value given

2026-10-09 16:22:47 +02:00

given_test.go

Replace a value given by hand like one the mesh made (hq ADR 0228)

2026-10-06 12:13:48 +02:00

given.go

Say a part waiting for the operator as needs-operator and pass its gate; add secret families (issue 386, hq ADR 0283)

2026-10-10 21:19:58 +02:00

heals_test.go

Heal what is known, under a brake, and say every repair (hq to-be 45 Phase 3)

2026-10-06 14:26:26 +02:00

heals.go

Heal what is known, under a brake, and say every repair (hq to-be 45 Phase 3)

2026-10-06 14:26:26 +02:00

health.go

Say a part waiting for the operator as needs-operator and pass its gate; add secret families (issue 386, hq ADR 0283)

2026-10-10 21:19:58 +02:00

heldhere_test.go

Issue only the recorded holder a seat held once for the mesh (novox/hq issue 218)

2026-10-03 23:30:27 +02:00

hold_plans_test.go

Let two controllers overlap safely while one hands over to the other (hq issue 213)

2026-10-04 01:11:26 +02:00

hold_test.go

Give every test a bus of its own, at the release the mesh runs (hq ADR 0237)

2026-10-06 21:17:02 +02:00

hold.go

Let two controllers overlap safely while one hands over to the other (hq issue 213)

2026-10-04 01:11:26 +02:00

holdings_test.go

Let the mesh's resolver seat have several holders on record

2026-10-05 22:42:53 +02:00

inventory_test.go

Review of 083: finishing an enrolment whose token was spent takes proof of the key's private half, a live lease and a first delivery — a public key alone cannot replay a spent token; shutdown leaves held messages for the broker; identical builds supersede; what is held leaves room in the prefetch

2026-09-22 14:33:13 +02:00

inventory.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

mirrored_test.go

Let platform manifests go only on a confirmed collect, and copy again what a sweep took

2026-10-08 15:47:42 +02:00

named_peer_test.go

A carried peer is nameable, and the mesh answers for it (hq 112)

2026-09-26 20:09:42 +02:00

nodes.go

A gate judges its own send and the build it sent, and never puts the controller back behind its store (hq issue 352)

2026-10-09 17:15:40 +02:00

older_build_test.go

An older build request never replaces a newer one's artifact

2026-10-04 00:22:11 +02:00

operator_test.go

A module's own secret rotates when its definition says the module reads it at start (hq 180)

2026-10-01 11:41:49 +02:00

operator.go

Review: one local name is still a local name; a local name is unique; recovery knows it; recipes read as instructions; a tag before a digest; ask fails at once when nothing serves

2026-09-21 21:03:22 +02:00

order_test.go

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

order.go

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

pending_test.go

Make pending assignments safe to race, settle them on a tick, and say only what was checked

2026-10-08 16:38:11 +02:00

pending.go

Register only from a protected trunk of the same repository, and mark the serving controller never the terminal

2026-10-09 12:37:18 +02:00

people_test.go

Tests follow the grants and issue 203: a person may ask what answers; the resolver test mints its credential

2026-10-03 23:15:57 +02:00

pin_completed_test.go

A pin names the module as well as the node; a node that answers twice is refused

2026-10-01 17:23:31 +02:00

plans_test.go

A gate judges its own send and the build it sent, and never puts the controller back behind its store (hq issue 352)

2026-10-09 17:15:40 +02:00

plans.go

Walk phases: a report past the silent bound never moves a walk's end; keep phases outside the hold on the plans; first-node gate in words (review of #206)

2026-10-10 20:20:07 +02:00

ports_test.go

A take acts on the preview it showed; a setting is judged where it is stored; a kept network and a minted secret are said (hq ADR 0163)

2026-10-02 11:01:09 +02:00

ports.go

Read the foundation's ports from each node's settings, wherever a port is used (hq ADR 0100)

2026-09-22 17:31:07 +02:00

public_domain_test.go

The routing record is 0066, not 0056

2026-09-11 00:09:56 +02:00

reachable_test.go

Review of 082: a store killed mid-conversation is an outage and a wrong password is not; one report holds the queue at most two minutes, then is let go loudly; shutdown does not wait out the pause

2026-09-22 13:34:04 +02:00

reachable.go

Review of 082: a store killed mid-conversation is an outage and a wrong password is not; one report holds the queue at most two minutes, then is let go loudly; shutdown does not wait out the pause

2026-09-22 13:34:04 +02:00

reported.go

Keep a facts snapshot for merge checks, and say when it goes stale (hq to-be 45 Phase 5, S14)

2026-10-06 20:31:10 +02:00

retire_test.go

Retire the networking bundle and what the control plane stops shipping (hq ADR 0226)

2026-10-06 14:59:28 +02:00

rootfree_grants_test.go

Answer the controller's own verbs, root-free among them, from the serving controller alone (hq ADR 0259 §8)

2026-10-09 13:51:18 +02:00

schema.go

A gate judges its own send and the build it sent, and never puts the controller back behind its store (hq issue 352)

2026-10-09 17:15:40 +02:00

seats_test.go

Give the build verb the command's other two shapes, so a changed base or a source that moved can be rebuilt through the console

2026-10-08 01:37:30 +02:00

seats.go

Let failed join the seat optional, and let a seeded row carry both changes

2026-10-07 20:05:01 +02:00

secret_ask_test.go

A module's own secret is asked for by a verb and typed at the desk, bounded, the prompt naming who asked (hq ADR 0277)

2026-10-10 15:24:08 +02:00

secret_ask.go

A module's own secret is asked for by a verb and typed at the desk, bounded, the prompt naming who asked (hq ADR 0277)

2026-10-10 15:24:08 +02:00

secret_family_test.go

Say a part waiting for the operator as needs-operator and pass its gate; add secret families (issue 386, hq ADR 0283)

2026-10-10 21:19:58 +02:00

secrets_test.go

Replace a value given by hand like one the mesh made (hq ADR 0228)

2026-10-06 12:13:48 +02:00

secrets.go

Say a part waiting for the operator as needs-operator and pass its gate; add secret families (issue 386, hq ADR 0283)

2026-10-10 21:19:58 +02:00

sends_test.go

Raise S20 for every generation refusal, ask for a push when the counter was behind, and write a send's generation with its digest (hq issue 234 review)

2026-10-11 11:55:27 +02:00

sends.go

Raise S20 for every generation refusal, ask for a push when the counter was behind, and write a send's generation with its digest (hq issue 234 review)

2026-10-11 11:55:27 +02:00

sent_builds_test.go

Name the decision this builds: hq ADR 0236 (0235 is the bus's snapshot)

2026-10-06 18:56:54 +02:00

sent_bus_users_test.go

Send the bus's machine before the grants, and only when its user list moved (hq issue 249)

2026-10-05 18:17:52 +02:00

settings_judged_test.go

A take acts on the preview it showed; a setting is judged where it is stored; a kept network and a minted secret are said (hq ADR 0163)

2026-10-02 11:01:09 +02:00

source.go

Read a rebuild of an unchanged source as no move, whatever image digest it made (hq issue 280)

2026-10-06 22:09:11 +02:00

store_as_run_test.go

Give every test a bus of its own, at the release the mesh runs (hq ADR 0237)

2026-10-06 21:17:02 +02:00

tunnel_test.go

Adopt the tunnel as a mesh fact, refuse a mismatched takeover, and rekey after enrolment

2026-09-24 00:02:07 +02:00

tunnel.go

The mesh's interface takes over the found tunnel's MTU

2026-09-26 22:40:42 +02:00

unknown_field_test.go

Leave out a module whose stored manifest has an unknown field, and raise it (hq ADR 0262 review)

2026-10-08 17:34:53 +02:00

unseen_test.go

No change to a machine takes effect unseen (hq ADR 0217, to-be 44)

2026-10-08 01:44:43 +02:00

unseen.go

A trusted setting is proposed through the settings verb and set only on the operator's warrant (hq ADR 0277)

2026-10-10 14:42:40 +02:00

walkphases_test.go

Say a walk's phases out of order unknown, never a negative time (hq issue 382)

2026-10-10 21:15:48 +02:00

walkphases.go

Say a walk's phases out of order unknown, never a negative time (hq issue 382)

2026-10-10 21:15:48 +02:00