Review round 1 of issue 1966's keep-what-is-loaded fix.
- KeepLoaded intersected the denies, and the composer gives every composed user an empty
deny, so a user in force with a wide publish and a deny was sealed with no deny. The
union of every deny any list says is kept now, and Losses counts a deny dropped.
- A pass composing part of the mesh (the seat list unread, or placed by the haves) no
longer narrows a published membership: one whose published value serves, hears or gives
more than the pass composes is kept as published and said so (not_published), so a tool
runner or a seat holder goes on serving what it serves while keeping its login.
Claude-Session: https://claude.ai/code/session_01NcbgfFfQ4Z9UE5jK32PmE5
Issue 1966: the list sealed 2026-11-07 23:09, composed while the seat list was unread
(only the bootstrapped seats compose), took the node seats from the tool runners, the
vault's reads from the node-engines and the seat queues from the build modules, and left
out ledger.novox.mesh-knowledge.
- While the seat list is unread (the gate's MayAct with no seat) or a pass is placed by
the haves, each user of the loaded list and of the list in force is sealed with the
union of what the pass composes and what those lists give it (publish, subscribe,
responses; a deny only where every list saying one denies it), kept the way a refused
principal is; the users so kept are the pass's kept_loaded.
- In such a pass a list that still takes a permission from, or leaves out, a loaded user
is held (user-list-held), naming each user and how many permissions it loses.
- A held module keeps its ledger account, ledger.<node>.<module>, with its other users:
heldModuleUsers matched <node>.<module>[.<process>] only, which dropped the ledger user.
Claude-Session: https://claude.ai/code/session_01NcbgfFfQ4Z9UE5jK32PmE5
Review round 1 of issue 1966's fix: the membership check alone did not pin the removed
phase; the row now reads the inputs and requires mod-y off b while its have is removed.
Claude-Session: https://claude.ai/code/session_01NcbgfFfQ4Z9UE5jK32PmE5
Issue 1966: the seat list is read through mesh-catalog's seat-definitions, which got no
responders only because nothing was placed. A row shows that, the assignments view
unanswered, the indexer placed by its have (its real manifest) is composed to hear
mesh.seat.mesh-catalog.* and its membership serving seat-definitions is published, while
the seat list stays unread and other modules still wait for it.
Claude-Session: https://claude.ai/code/session_01NcbgfFfQ4Z9UE5jK32PmE5
Bootstrap only (issue 1966, notes 63 and 64; the operator chose it 2026-11-07 22:19,
bending ADR 0567 §9 for the bootstrap). An assigner that serves no first views answers
no assignments, so the grants part placed nothing and wrote no grant, membership or
bucket for anything, not even for the assigner that would serve the view.
When the assignments read fails and the haves read, each module is placed on the node
whose have says it runs (any phase but removed), the bus node found among them, and what
runs composed from each have's fingerprint instead of the assigner's wants. Said as a gap
naming the fallback, and kept as Inputs.ByHaves: such a pass retires no account and deletes
no withheld hearing (ReadFailures), and seals no list that drops a user of the list in
force or of the loaded list (holdsBack). Once the view answers, the fallback is unused.
Quick fix; the thorough one stays the module-graph edge (the assigner's views before the
grants part that reads them) in the delivery plan.
Claude-Session: https://claude.ai/code/session_01NcbgfFfQ4Z9UE5jK32PmE5
mesh/check checking e0f510facb17 on b73315ffe05c | novox/mesh-delivery#166 in group fix/1966-bootstrap-no-packages
The running builder predates Go package artifacts ("refused kind: package of language go ... no build module
builds it"), so it can build neither the new builder, the grants module, the Go build module nor the checker:
each new part is needed before the others can be built or delivered. For the bootstrap of the registry
delivery, at the operator's word (19:4x, "do the temporary change"), the package artifacts leave the manifests of
the parts that run; the contracts and SDK modules, which run on no node, keep theirs. They come back in one change
once the new builder runs. Quick vs thorough: quick; the thorough fix is 47/G's tier order (issue 1921 note 80).
Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
Dropped since the hear was removed (ADR 0625 §4); the golden user list and the grants case now hold the node user's subscriptions. The indexer's open-tries comment says it refuses an answer without the key.
Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
A member's go.mod names the oldest version a module accepts; the check builds the group's own heads whatever it names. go.sum lines of mesh packages are left out.
Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
mesh/check failed (9): ace: novox/mesh-sdk#167 does not merge into the trunk: files in conflict: go/catalog…; and 8 more | 83b962cc6d6d on bab05c66b3cb
mesh-sdk's state read-only (d420491c) is mapped into the grants' buckets, so the module's account and the tool
runner read it and never write it; the judge refuses a read-only state no process's bus state names, since
nothing would write it.
Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig
The bus module's spend record must not be writable by the tool runner. A state declared read-only gets read on
the module's own account and the tool runner carrying it (direct get, a watch's consumer) and no publish on its
$KV subjects; the process whose bus state names it writes it. The judge rule and the manifest field follow
with mesh-sdk's read-only.
Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig
Review round 1, running F4 (design 25 § 12.7), moved here from the nats test by the lead: in the composed-grants case
of the whole test, the part composes nats and messenger from their manifests (testdata copies of the catalogue's at
the join); the keeper connects on its own process account to a server loading the composed list, reads the router's
record of its ask, and is refused a write to the router's asks and the part's state and another asker's record.
Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig
Its durable consumer filtered only its consumes, composed as module subjects, so the operator channel's
decided for its own asks could not be heard there (design 25 § 12.3: it wakes on the warrant).
Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig
The raise and clear of first-view-unanswered dropped a failed publish (_ = say). The binding comment
named the bus module's own stream and 30 days; the part hears the seat's events on the shared stream, 7 days.
Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig
mesh-sdk holds no go/asks, go/asker, vault answers or compose-candidate types (A1d, J1): each module now names the
operator-channel contract and client, the channel benches (mesh-sdk/go/channel), mesh-vault's contract, and node-engine's
contract and client (a1-progress.md, the A1d and J1 rewrite maps).
- assigner, teller, view: delivery.Ask.Ask and AssignerAsk.Ask are the router's ask as JSON; the refusals mesh-sdk
dropped (an id other than AskingID(key, asking), no option) are each reader's and writer's: assign.EncodeAsk/DecodeAsk
(askjson.go), the teller's routerAskOf (teller.go) and the view's routerAsk (view.go); the teller refuses an option
the asking does not offer and one whose level is not acknowledge (viewanswers.go), the two refusals ViewAnswerFits
gave. Row: subtest of TestTheHoldAskIsValid (another id, no option, no ask; each written before).
- enrolment, grants: the vault's verbs and answers from meshvault; asks' conditions from the contract and client.
- checker, assigner's judge: compose-candidate from nodeengine/nodeengineclient (nec.Own for "node").
- mesh-grants' user-lists golden: the node-engine's users now subscribe to mesh-delivery-view's settled (mesh-sdk's
NodeAgentHears, A7's ENG-8 retry).
go.mod: each module requires the mesh-contracts modules it imports (and nodeengineclient, which mesh-sdk imports) at the
zero version, for the group pin.
Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig
L3 (710c4032) arrives with it. Conflicts, each kept from both sides:
- assigner module.json, manifest_test.go, main.go, tools.go, integration_test.go: A2's first-view tools,
read tools and states beside L3's assigner_engine_reads and engine-reads; the two "consumes" lists
joined into one (the indexer's views and node-engine.manifest-reads-changed).
- builder module.json and manifest_test.go: A3's tools, states, consumes and invokes beside A2g's first
views (DLV-M1); one findings state (A3's, history 5) carries both; reads keep A3o's
mesh-delivery-indexer.packages until the builder follows it (join item).
- builder cmd main.go: rebuilt from A3's with A2g's changes applied (the reader follows modules,
manifests, candidates and placement; one calls connection; one findings bucket, A3's
health.FindingsBucket; FollowPlacement on a goroutine once placement's first view is answered;
buildFromModules in place of the start's settle). Tools main.go: A3's tools then the first-view tools.
- builder run.go: A2k's out-of-step on the end entry, then A3's numbering of a done build.
- view module.json and manifest_test.go: node_manifest_reads and seat:node-engine.manifest-reads beside
A2j's first views and read tools; one invokes list.
- indexer judge rules_test.go: L3's manifest-reads verb and event, without pull-waits (J1 dropped it).
- sdk/go.mod and builder go.mod: both requires kept.
Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig
A case of the grants part's whole-module test (ADR 0615 §6, ADR 0621 §3): each first view refused once, the part's log
names the indexer's and the assigner's tools it waits on, no membership is written; once the owners answer it composes
as before.
Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig
ADR 0615 §5: a gap in revisions asks the first view once more. The indexer's verdict events carry no mark of when its
verdicts were made, so verdicts made again show only as revisions starting low, which the grants part passed over as
already held. A redelivery of a verdict the picture holds for its manifest is still passed over, so a consumer's backlog
after a restart asks nothing.
Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig
The lead's ruling of 13:0x (registry milestone): mesh-broker's events are mesh.seat.mesh-broker.event.<event> on the
shared events stream like every seat's. The grants part and the watchman consume mesh-broker.<event> and no longer hear
the bus module's own stream, which is its history for its tool. The keeper's process account is composed the seat's
event subjects, and the acknowledgement of a snapshot's chunks of each entry it keeps, which ADR 0626 §1 grants and the
composition lacked; a row holds it to no subscription of a restricted stream's subjects and no consumer of one.
Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig
jschoubben