jschoubben b0753e2aac Let a drain lapse, bound the gate's wait on the controller's clock, keep a busy wait out of apply time ...

Review of #283: a drain whose replacement was withdrawn held the agent for
ever with its health green; the gate trusted the engine's until; a machine
of the rest waiting at the bound read as silent and its apply time held the
wait; an unknown mesh-builder word exited 0; plan said nothing of a busy an
older engine is not sent; and a node with a report and no send broke the
reading of every last report (the store test's NULL).

2026-10-14 00:07:31 +02:00

..

migrations

Hold a walk's first-machine gate while its busy container finishes its build

2026-10-13 00:53:10 +02:00

addresses.go

A carried peer is nameable, and the mesh answers for it (hq 112)

2026-09-26 20:09:42 +02:00

adoption_test.go

A repeat assignment says nothing changed (ADR 0115)

2026-09-26 19:02:35 +02:00

adoption.go

The mesh says what filters a converged machine: filters kept per node, shown by node show, named by status, and previewed with their fates (hq ADR 0168)

2026-10-02 12:00:12 +02:00

agent_account_test.go

Refuse a node's accounts through any verb, and a stale or service-account agent verdict

2026-10-09 10:11:21 +02:00

artifacts_test.go

Answer what the records keep, collect on a person's word, and name a machine's images (hq ADR 0251)

2026-10-08 12:04:42 +02:00

asks_lab_test.go

Ask an acknowledgement apart from an approval, change every kept ask by compare-and-set, and rehearse rather than drill (hq ADR 0259, review M1/L2/L3/L7)

2026-10-09 16:22:34 +02:00

batches.go

Owe a merge to the record from its branch's first kept merge (hq ADR 0276 review)

2026-10-10 13:54:40 +02:00

bindings_test.go

Keep a consumer bound where its data is; only a pin moves it (hq ADR 0232, issue 273)

2026-10-06 15:19:23 +02:00

bindings.go

Keep a consumer bound where its data is; only a pin moves it (hq ADR 0232, issue 273)

2026-10-06 15:19:23 +02:00

buildinput_test.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

builds_test.go

Say why each module is in a plan: its build source's changed files, or why it is read whole (hq ADR 0267, issue 363)

2026-10-10 12:49:44 +02:00

builds.go

Say why each module is in a plan: its build source's changed files, or why it is read whole (hq ADR 0267, issue 363)

2026-10-10 12:49:44 +02:00

busrecords_test.go

Grant a bar one key of the state it shows, and per-machine state its own machine's key (hq ADR 0260)

2026-10-08 15:51:20 +02:00

busrecords.go

Merge remote-tracking branch 'origin/main' into adr-0297-module-logs

2026-10-12 02:29:00 +02:00

busstep.go

Name the decision this builds: hq ADR 0236 (0235 is the bus's snapshot)

2026-10-06 18:56:54 +02:00

bususers_test.go

Give a fast-renewing test lease a serving controller's time to renew, and prove the minted hash's cost

2026-10-13 00:08:48 +02:00

bususers.go

Give a fast-renewing test lease a serving controller's time to renew, and prove the minted hash's cost

2026-10-13 00:08:48 +02:00

busy_test.go

Let a drain lapse, bound the gate's wait on the controller's clock, keep a busy wait out of apply time

2026-10-14 00:07:31 +02:00

catalogue_test.go

Refuse the tools-container shape for every module (to-be 38 WP4b's last step)

2026-10-04 02:28:54 +02:00

catalogue.go

A trusted setting is proposed through the settings verb and set only on the operator's warrant (hq ADR 0277)

2026-10-10 14:42:40 +02:00

collection_test.go

Hold every kept archive by a manifest so the store's collector keeps it (hq issue 253)

2026-10-05 18:13:23 +02:00

collection.go

Record the bases a build copies, keep them by the builds that stood on them, and copy each image once

2026-10-08 15:47:42 +02:00

data_test.go

Keep one reading when two paths are measured at one moment, rather than failing the machine's record (hq issue 368 review)

2026-10-10 17:48:49 +02:00

data.go

Keep one reading when two paths are measured at one moment, rather than failing the machine's record (hq issue 368 review)

2026-10-10 17:48:49 +02:00

dependencies_test.go

Read a built module's build edges from what is kept of it, so a new SDK rebuilds its toolchain and bundles (hq issue 614)

2026-10-13 11:08:17 +02:00

dependencies.go

Read a built module's build edges from what is kept of it, so a new SDK rebuilds its toolchain and bundles (hq issue 614)

2026-10-13 11:08:17 +02:00

doing_test.go

Keep a named push from sending builds a policy or a plan holds back

2026-10-05 22:22:03 +02:00

durations_test.go

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

durations.go

Let a drain lapse, bound the gate's wait on the controller's clock, keep a busy wait out of apply time

2026-10-14 00:07:31 +02:00

forget_test.go

A take acts on the preview it showed; a setting is judged where it is stored; a kept network and a minted secret are said (hq ADR 0163)

2026-10-02 11:01:09 +02:00

fortest.go

Copy each store test's database from a template migrated once, and hash test bus passwords at bcrypt's least cost

2026-10-12 23:53:06 +02:00

gate.go

A gate judges its own send and the build it sent, and never puts the controller back behind its store (hq issue 352)

2026-10-09 17:15:40 +02:00

givable_test.go

give: take only a value a person holds, ask the desk by name, let the controller alone ask it, and announce every value given

2026-10-09 16:22:47 +02:00

given_test.go

Replace a value given by hand like one the mesh made (hq ADR 0228)

2026-10-06 12:13:48 +02:00

given.go

Say a part waiting for the operator as needs-operator and pass its gate; add secret families (issue 386, hq ADR 0283)

2026-10-10 21:19:58 +02:00

heals_test.go

Heal what is known, under a brake, and say every repair (hq to-be 45 Phase 3)

2026-10-06 14:26:26 +02:00

heals.go

Heal what is known, under a brake, and say every repair (hq to-be 45 Phase 3)

2026-10-06 14:26:26 +02:00

health.go

Never make a credential only a person can give, and give it once per provider (hq issue 164, ADR 0337)

2026-10-13 11:37:31 +02:00

heldhere_test.go

Issue only the recorded holder a seat held once for the mesh (novox/hq issue 218)

2026-10-03 23:30:27 +02:00

hold_plans_test.go

Let two controllers overlap safely while one hands over to the other (hq issue 213)

2026-10-04 01:11:26 +02:00

hold_test.go

Give every test a bus of its own, at the release the mesh runs (hq ADR 0237)

2026-10-06 21:17:02 +02:00

hold.go

Let two controllers overlap safely while one hands over to the other (hq issue 213)

2026-10-04 01:11:26 +02:00

holdings_test.go

Let the mesh's resolver seat have several holders on record

2026-10-05 22:42:53 +02:00

inventory_test.go

Review of 083: finishing an enrolment whose token was spent takes proof of the key's private half, a live lease and a first delivery — a public key alone cannot replay a spent token; shutdown leaves held messages for the broker; identical builds supersede; what is held leaves room in the prefetch

2026-09-22 14:33:13 +02:00

inventory.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

issued_test.go

Let the controller ask an issued credential's tool in its own name, and seal it again over a remade pair (hq issue 526, ADR 0305)

2026-10-12 01:21:20 +02:00

issued.go

Take a provider's software-issued credential from the provider, sealed (hq issue 526, ADR 0305)

2026-10-12 01:07:16 +02:00

looks_test.go

Keep a condition's looks in the store, so a look that changes nothing writes no bucket (issue 420)

2026-10-12 12:11:13 +02:00

looks.go

Keep a condition's looks in the store, so a look that changes nothing writes no bucket (issue 420)

2026-10-12 12:11:13 +02:00

machine_test.go

Admit a port from the machine's own local network, and never a public subnet (issue 154, ADR 0340)

2026-10-13 11:20:22 +02:00

machine.go

Admit a port from the machine's own local network, and never a public subnet (issue 154, ADR 0340)

2026-10-13 11:20:22 +02:00

mirrored_test.go

Let platform manifests go only on a confirmed collect, and copy again what a sweep took

2026-10-08 15:47:42 +02:00

named_peer_test.go

A carried peer is nameable, and the mesh answers for it (hq 112)

2026-09-26 20:09:42 +02:00

nodes.go

Let a drain lapse, bound the gate's wait on the controller's clock, keep a busy wait out of apply time

2026-10-14 00:07:31 +02:00

older_build_test.go

An older build request never replaces a newer one's artifact

2026-10-04 00:22:11 +02:00

operator_test.go

A module's own secret rotates when its definition says the module reads it at start (hq 180)

2026-10-01 11:41:49 +02:00

operator.go

Review: one local name is still a local name; a local name is unique; recovery knows it; recipes read as instructions; a tag before a digest; ask fails at once when nothing serves

2026-09-21 21:03:22 +02:00

order_test.go

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

order.go

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

outside_test.go

Never make a credential only a person can give, and give it once per provider (hq issue 164, ADR 0337)

2026-10-13 11:37:31 +02:00

outside.go

Never make a credential only a person can give, and give it once per provider (hq issue 164, ADR 0337)

2026-10-13 11:37:31 +02:00

pending_test.go

Make pending assignments safe to race, settle them on a tick, and say only what was checked

2026-10-08 16:38:11 +02:00

pending.go

Register only from a protected trunk of the same repository, and mark the serving controller never the terminal

2026-10-09 12:37:18 +02:00

people_test.go

inventory: a person's one tool is granted naming that person as the caller too (hq issue 365)

2026-10-11 05:47:40 +02:00

pin_completed_test.go

A pin names the module as well as the node; a node that answers twice is refused

2026-10-01 17:23:31 +02:00

plan_id_test.go

Read a plan by its id as a parameter, never as SQL (issue 561)

2026-10-12 16:33:23 +02:00

plans_test.go

A gate judges its own send and the build it sent, and never puts the controller back behind its store (hq issue 352)

2026-10-09 17:15:40 +02:00

plans.go

Let a drain lapse, bound the gate's wait on the controller's clock, keep a busy wait out of apply time

2026-10-14 00:07:31 +02:00

ports_test.go

A take acts on the preview it showed; a setting is judged where it is stored; a kept network and a minted secret are said (hq ADR 0163)

2026-10-02 11:01:09 +02:00

ports.go

Read the foundation's ports from each node's settings, wherever a port is used (hq ADR 0100)

2026-09-22 17:31:07 +02:00

public_domain_test.go

The routing record is 0066, not 0056

2026-09-11 00:09:56 +02:00

reachable_test.go

Review of 082: a store killed mid-conversation is an outage and a wrong password is not; one report holds the queue at most two minutes, then is let go loudly; shutdown does not wait out the pause

2026-09-22 13:34:04 +02:00

reachable.go

Review of 082: a store killed mid-conversation is an outage and a wrong password is not; one report holds the queue at most two minutes, then is let go loudly; shutdown does not wait out the pause

2026-09-22 13:34:04 +02:00

reported.go

Keep a facts snapshot for merge checks, and say when it goes stale (hq to-be 45 Phase 5, S14)

2026-10-06 20:31:10 +02:00

retire_test.go

Retire the networking bundle and what the control plane stops shipping (hq ADR 0226)

2026-10-06 14:59:28 +02:00

rootfree_grants_test.go

Answer the controller's own verbs, root-free among them, from the serving controller alone (hq ADR 0259 §8)

2026-10-09 13:51:18 +02:00

schema.go

A gate judges its own send and the build it sent, and never puts the controller back behind its store (hq issue 352)

2026-10-09 17:15:40 +02:00

seats_test.go

Give the store tests' service manager holders the three verbs it now must serve (issue 332)

2026-10-12 12:25:05 +02:00

seats.go

Let failed join the seat optional, and let a seeded row carry both changes

2026-10-07 20:05:01 +02:00

secret_ask_test.go

A module's own secret is asked for by a verb and typed at the desk, bounded, the prompt naming who asked (hq ADR 0277)

2026-10-10 15:24:08 +02:00

secret_ask.go

A module's own secret is asked for by a verb and typed at the desk, bounded, the prompt naming who asked (hq ADR 0277)

2026-10-10 15:24:08 +02:00

secret_family_test.go

Say a part waiting for the operator as needs-operator and pass its gate; add secret families (issue 386, hq ADR 0283)

2026-10-10 21:19:58 +02:00

secrets_test.go

Replace a value given by hand like one the mesh made (hq ADR 0228)

2026-10-06 12:13:48 +02:00

secrets.go

Never make a credential only a person can give, and give it once per provider (hq issue 164, ADR 0337)

2026-10-13 11:37:31 +02:00

sends_test.go

Take an ordered engine's report as a send's answer only by its epoch and sequence (novox/hq issue 485)

2026-10-11 20:44:54 +02:00

sends.go

Take an ordered engine's report as a send's answer only by its epoch and sequence (novox/hq issue 485)

2026-10-11 20:44:54 +02:00

sent_builds_test.go

Name the decision this builds: hq ADR 0236 (0235 is the bus's snapshot)

2026-10-06 18:56:54 +02:00

sent_bus_users_test.go

Send the bus's machine before the grants, and only when its user list moved (hq issue 249)

2026-10-05 18:17:52 +02:00

settings_judged_test.go

A take acts on the preview it showed; a setting is judged where it is stored; a kept network and a minted secret are said (hq ADR 0163)

2026-10-02 11:01:09 +02:00

source.go

Read a rebuild of an unchanged source as no move, whatever image digest it made (hq issue 280)

2026-10-06 22:09:11 +02:00

store_as_run_test.go

Give every test a bus of its own, at the release the mesh runs (hq ADR 0237)

2026-10-06 21:17:02 +02:00

stored_silent_file_test.go

Judge ADR 0326 §3 only where a definition is written (hq issue 574)

2026-10-13 00:54:26 +02:00

tunnel_test.go

Adopt the tunnel as a mesh fact, refuse a mismatched takeover, and rekey after enrolment

2026-09-24 00:02:07 +02:00

tunnel.go

The mesh's interface takes over the found tunnel's MTU

2026-09-26 22:40:42 +02:00

unknown_field_test.go

Leave out a module whose stored manifest has an unknown field, and raise it (hq ADR 0262 review)

2026-10-08 17:34:53 +02:00

unseen_test.go

No change to a machine takes effect unseen (hq ADR 0217, to-be 44)

2026-10-08 01:44:43 +02:00

unseen.go

A trusted setting is proposed through the settings verb and set only on the operator's warrant (hq ADR 0277)

2026-10-10 14:42:40 +02:00

walkphases_582_test.go

End a walk's apply phase at each machine's own report of its send (hq issue 582)

2026-10-12 23:18:28 +02:00

walkphases_test.go

End a walk's apply phase at each machine's own report of its send (hq issue 582)

2026-10-12 23:18:28 +02:00

walkphases.go

Let a drain lapse, bound the gate's wait on the controller's clock, keep a busy wait out of apply time

2026-10-14 00:07:31 +02:00

walksaid_test.go

Say every walk a verb keeps, and clear a stop from a walk that walks again

2026-10-12 12:54:20 +02:00

walksaid.go

Say what a walk touches, its bound and its outcome when it starts and ends (ADR 0308, issue 532)

2026-10-12 12:54:20 +02:00