Review round 1 of issue 1966's keep-what-is-loaded fix.
- KeepLoaded intersected the denies, and the composer gives every composed user an empty
deny, so a user in force with a wide publish and a deny was sealed with no deny. The
union of every deny any list says is kept now, and Losses counts a deny dropped.
- A pass composing part of the mesh (the seat list unread, or placed by the haves) no
longer narrows a published membership: one whose published value serves, hears or gives
more than the pass composes is kept as published and said so (not_published), so a tool
runner or a seat holder goes on serving what it serves while keeping its login.
Claude-Session: https://claude.ai/code/session_01NcbgfFfQ4Z9UE5jK32PmE5
Issue 1966: the list sealed 2026-11-07 23:09, composed while the seat list was unread
(only the bootstrapped seats compose), took the node seats from the tool runners, the
vault's reads from the node-engines and the seat queues from the build modules, and left
out ledger.novox.mesh-knowledge.
- While the seat list is unread (the gate's MayAct with no seat) or a pass is placed by
the haves, each user of the loaded list and of the list in force is sealed with the
union of what the pass composes and what those lists give it (publish, subscribe,
responses; a deny only where every list saying one denies it), kept the way a refused
principal is; the users so kept are the pass's kept_loaded.
- In such a pass a list that still takes a permission from, or leaves out, a loaded user
is held (user-list-held), naming each user and how many permissions it loses.
- A held module keeps its ledger account, ledger.<node>.<module>, with its other users:
heldModuleUsers matched <node>.<module>[.<process>] only, which dropped the ledger user.
Claude-Session: https://claude.ai/code/session_01NcbgfFfQ4Z9UE5jK32PmE5
Review round 1 of issue 1966's fix: the membership check alone did not pin the removed
phase; the row now reads the inputs and requires mod-y off b while its have is removed.
Claude-Session: https://claude.ai/code/session_01NcbgfFfQ4Z9UE5jK32PmE5
Issue 1966: the seat list is read through mesh-catalog's seat-definitions, which got no
responders only because nothing was placed. A row shows that, the assignments view
unanswered, the indexer placed by its have (its real manifest) is composed to hear
mesh.seat.mesh-catalog.* and its membership serving seat-definitions is published, while
the seat list stays unread and other modules still wait for it.
Claude-Session: https://claude.ai/code/session_01NcbgfFfQ4Z9UE5jK32PmE5
Bootstrap only (issue 1966, notes 63 and 64; the operator chose it 2026-11-07 22:19,
bending ADR 0567 §9 for the bootstrap). An assigner that serves no first views answers
no assignments, so the grants part placed nothing and wrote no grant, membership or
bucket for anything, not even for the assigner that would serve the view.
When the assignments read fails and the haves read, each module is placed on the node
whose have says it runs (any phase but removed), the bus node found among them, and what
runs composed from each have's fingerprint instead of the assigner's wants. Said as a gap
naming the fallback, and kept as Inputs.ByHaves: such a pass retires no account and deletes
no withheld hearing (ReadFailures), and seals no list that drops a user of the list in
force or of the loaded list (holdsBack). Once the view answers, the fallback is unused.
Quick fix; the thorough one stays the module-graph edge (the assigner's views before the
grants part that reads them) in the delivery plan.
Claude-Session: https://claude.ai/code/session_01NcbgfFfQ4Z9UE5jK32PmE5
mesh/check pass 71a56d4606c9 on b73315ffe05c | carried from a37ee99b41d5 | unit 495 run, 947 kept | integration 494 run, 1014 kept | composition passe…
Both were published with the JetStream acknowledgement awaited, a request and response, for ten seconds each, and
manifest-accepted once more on failure. On a bus refusing the subject (the old grants do not grant the new indexer
mesh.seat.mesh-catalog.event.manifest-accepted) no acknowledgement ever came, so each judging pass took about twenty
seconds a manifest and the indexer never reached the forge's messages nor the seat definitions: the take-in stood
still. Now both are published plainly on their subject with the dedup id in Nats-Msg-Id, as an event is (the
operator, 2026-11-07: everything is event-driven); the stream that keeps the subject drops a duplicate by its id, and a
refusal is said on the connection's error handler, as the journal already shows. An error of the publish itself (no
connection) still goes to the caller, which retries once and writes the unsaid finding.
Quick vs thorough: thorough for these two events (every publish of a seat event by the indexer is now an event);
sayTakeIn keeps its acknowledged publish, said in the issue for 47/G.
Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
mesh/check pass e01d265decb3 on b73315ffe05c | carried from a37ee99b41d5 | unit 495 run, 947 kept | integration 494 run, 1014 kept | over bound: integ…
The running indexer (built at the registry merge) publishes every Go module of a repository it published before in
one forge listing; seatfiles, published at 6bc232eb and removed since, is not in the tree, so the listing fails and
every take-in of mesh-delivery is 'computed and not written' (journal 19:56:29: 'the directory
modules/mesh-delivery-indexer/seatfiles is not in novox/mesh-delivery'). mesh-delivery #165 fixed that in the new
indexer, which cannot run yet. The module comes back as it stood at 6bc232eb, imported by nothing, until the new
indexer runs; the follow-up removes it. The operator's bootstrap of 2026-11-07.
Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
mesh/check checking e0f510facb17 on b73315ffe05c | novox/mesh-delivery#166 in group fix/1966-bootstrap-no-packages
The running builder predates Go package artifacts ("refused kind: package of language go ... no build module
builds it"), so it can build neither the new builder, the grants module, the Go build module nor the checker:
each new part is needed before the others can be built or delivered. For the bootstrap of the registry
delivery, at the operator's word (19:4x, "do the temporary change"), the package artifacts leave the manifests of
the parts that run; the contracts and SDK modules, which run on no node, keep theirs. They come back in one change
once the new builder runs. Quick vs thorough: quick; the thorough fix is 47/G's tier order (issue 1921 note 80).
Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
publish asked the forge for every published module of the repository in one call; when the merge removed one (seatfiles), the whole call failed and a revision's own new Go modules stayed unpublished, so the take-in waited for a version only its own take-in would publish. packagesAt now reads the modules one by one when the tree lacks a directory and leaves the missing one out, said.
mesh/check checking 4735fc0b5fdb on 8ad2bf6951d5 | novox/mesh-delivery#151 in group feat/registry-milestone
Conflicts in the checker's judge.go, builds.go, composition_test.go and try_candidates.go:
the group's contract types and kept composition path stay, #164's behaviour is taken whole.
WaitsOnPreview reads the contracts' meshcatalogclient.NoneNoPreview instead of a copied
constant; awaitBuilds names its failures failedBuilds, beside the builds package.
Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
mesh/check failed: novox: not composed on novox: mesh-delivery-checker: frombus: mesh-delivery-checker is wanted at src… | 3f9acf022325 on b719dc0ecf27
The indexer writes a pull request's candidate first from its pull message alone, every module's
fingerprint "no merge preview is computed", and the fingerprints only with the preview, on the same
heads. A check that began on that first write kept its case: it waited on no build, said nothing,
and the engines, reading the previewed candidate, refused the module as not yet built (mesh-catalog
#624, mesh-delivery #163). Such a check now takes the previewed candidate before it judges the
manifests, waits on the builds and composes, as a whole try already does.
A build not ended within the build-wait-bound is named and the change is not composed, never an
engine's refusal of a fingerprint it has no done build of read as the change's.
Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
#163's group-wait end, the retried start and its subtest are kept whole; its
names follow the registry's translation off mesh-sdk go/delivery (trunk,
takein, meshdeliveryclient), as the rest of pending.go already does.
Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
mesh/check failed: novox: not composed on novox: mesh-delivery-indexer: frombus: mesh-delivery-indexer is wanted at src… | 0520c126195b on bab05c66b3cb
mesh/check checking 918d21b7dac5 on 6bc232eb78b9 | novox/mesh-delivery#151 in group feat/registry-milestone
The request sent to the composer is kept gzip-compressed in the state compositions (ttl 3 days) under the check's key and the node, and the tool checker_composition_requests reads one by check and node or lists a check's. A request that cannot be kept fails the node's composition, naming why.
Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
mesh/check failed (4): unit: git.novox.be/novox/mesh-catalog/checks/gitignored.TestNoProgramABuildLeavesIsC…; and 3 more | 599046805156 on bab05c66b3cb
A group that changes mesh-vault's, node-launcher's or operator-channel's
definition would otherwise meet the step state's credential guard again; the
laid list goes only to the manifest validator and the composer, which read no
verb's or message's schema. The test digests the definitions whole, as the
reader holds them.
Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
The build seat's step state keeps the checking program's answer and refuses a
value with a field named like a credential; schema property names such as
mesh-vault's verb input 'credentials' tripped it. Neither the manifest
validator nor the composer reads those schemas: the verdicts of the head's and
the trunk's validator are byte-identical over the group, and the answer is
99,784 bytes (was 171,088).
Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
A manifest-reads ask the assigner made on manifest-reads-changed before the
test's SUB reached the server was answered by nobody and, by design, never
asked again; a flush is the barrier after each of the test's subscriptions.
Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
mesh/check failed (3): ace: the check of novox/mesh-catalog#612 failed: the unit level: the candidate's mes…; and 2 more | 932e7ccf0255 on bab05c66b3cb
G's own check is made by the running B0 checker, which hands no digests, so the
program answers every head definition: 342 KB, over the 256 KiB a run's answer may
be. Without digests the descriptions of verbs, events and their schemas are left
out (171 KB for the group's heads); neither the manifest validator nor the composer
reads one, and the validator's verdicts over the group are the same either way.
Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
The whole heads' list is 342 KB for this group, over the 256 KiB a run's answer
may be. The checker hands the program its reader's seat-to-digest list (5.6 KB)
and lays the answer, the new or changed definitions, over its own list.
Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
The parked composition-at-running path is folded as the lead's ruling Q3: one
path, so no check composes with the running engines' own code (ADR 0656 §5).
The sandbox request no longer drops a change's manifest verdict: it carries the
check's judge's, or none, which the composer reads as accepted (ADR 0578 §3).
Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
B0's shape wins: the running checker asks and records facts, the checking program
decides. The registry's types win: the rules and the program read the generated
checker contract and the domain SDK, and no mesh-sdk delivery import is left.
The registry's series, renames and unparsed seat definitions become facts with
their refusals as rules; the tagged versions ride on the case. The program reads
the heads' seat definitions through sdk/seatdefs and the running checker lays them
over its reader's list by seat, reading no file of the heads: the reader's list
is larger than a run input's bound.
Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
mesh/check checking 9c9ed7a1d8f1 on 2d201f781ced | novox/mesh-delivery#162 in group feat/b0-checking-program
The operator's answer: mesh-build-go reading the checker's state inputs broke ADR 0596 §2. The run ask's input now names
the verb seat:mesh-delivery-checker.input; the checker's tools serve it from the state inputs (Reader.Input, checked
against its digest), and the state is the checker's own again, read by no other module.
Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
ADR 0656 §5 has every check judged by parts built from the change's heads, and no record keeps the cycle rule in the
running checker. The facts carry each ordering edge's two modules and kind, never manifests: the whole catalogue's
graph is 50 edges, 3195 bytes.
Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
A level's digest, unmet packages, kept packages' names and test packages are read by no rule: a mesh-catalog check
step's two levels were 78682 bytes as facts and are 4506. A build node with no job run held a check four begin bounds;
it now holds it two.
Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
The fake build module of the integration tests answers a run ask with the checking program's
work over the input kept in the state inputs, as mesh-build-go does; the whole-module test
reads that the verdict names the program built at the group's mesh-delivery head, and the
keeps test reads inputs as readable.
Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
The running checker asks the checking program twice on the build seat's job run: first the
heads' seat list, which the manifest validator's requests (change and trunk) and the
node-engine composer's carry; then the verdict of the facts it gathered. The program is built
at the group's mesh-delivery head, else at mesh-delivery's trunk, and its input is kept in the
checker's new state inputs as the exact bytes of its digest, read with checker_inputs. A run
ask no build node begins within 5 minutes is put once more, then fails the check naming the
job; a program that does not build or answer fails the check naming it, and the verdict
records who judged it (JudgedBy). A second step-seen hook on a context is added to the
first, so a try still sees its steps.
Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
The checking program's seat list parsed the definition format a second time beside the
indexer's judge. The indexer's reading moves whole into its own sibling module seatfiles
(a domain path, as takein), with ResolveRaw keeping every field as written for a request's
seats; the judge and the take-in read through it, and the checker's rules only find the
definitions and say why one is left out (the lead's ruling on D3, ADR 0634 §1).
Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
Asked -seats, it reads every seat definition the heads carry, resolves the parts it includes and answers the list
with what it left out and why, so the running checker hands the manifest validator and the composer a list it does not
read itself (ADR 0636 §4, ADR 0644 §1).
Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
Every asking function only records what it met; the one verdict is the rules' of the facts, so nothing in the
running checker judges beside the checking program.
Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
The running checker records the manifest validator's cases, each fetch's programs and the engines' answers as facts,
and the rules package judges them, with the notes it gives a reader, so the checking program judges every rule the
running checker judged. The module graph's cycle stays with the asking: its facts are whole manifests, over a run's
input bound; G's program reads them from the heads.
Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
The running checker records each failure where it is met and the node of each step it reads; the verdict is
rules.Judge of those facts, so the checking program, given the same facts, gives the same verdict. Its own
second outcome and its node set are gone.
Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
mesh-checking-program -verdict reads the facts from the file the build
seat's run step names, judges them with the rules package and answers
one versioned line; facts of a version it does not read are refused,
naming it, because the running checker of B0 runs G's programs
(milestone 47/B0, ADR 0644, ADR 0656).
Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
The checking program judges a check from its facts (milestone 47/B0,
ADR 0644, ADR 0656): the rules package holds Facts v1, the level rule,
the failure words and the verdict's outcome, and the running checker
records each level answer as a fact and calls the rules. A row of the
every-failure tests judges the gathered facts and finds the running
checker's verdict.
Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
When the checker's seat list is not read, or a head's definitions are not
taken, the composer at a node-engine member's head was handed no list,
judged no machine, and the composition passed with warnings. It now
fails, naming why (ADR 0635 §3), and no composer is asked. The check's
readers of the members' heads are its manifest validator and that
composer (ADR 0636 §4 insight 1). The composer's Request.Seats contract
says both the judge and the composer read the list, and a composer
handed none judges no machine (ADR 0636 §1).
Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
The group try of 2026-11-06 10:07 composed with a composer that had no
seat list, so its composition failed on all four machines for paths and
holders the seats define. The checker's one list per check (the
reader's, the members' heads' laid over it, ADR 0636 §4) now goes to the
judge and the sandbox composer alike; a list the reader has not read
goes to neither, and the composer then judges no machine (ADR 0636 §1).
Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
The group's beside.go and pins_test.go already carry #161's fixes in their
group form (siblings from each sibling's go.mod); try_test.go keeps #161's
case that echoes the end through Put, in the group's event types.
Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
The checker read any touched contracts module's definitions, skipped the
check that a definition names its own directory's seat, and copied the
indexer's tree reading. sdk/seatdefs now holds the reading and the rule of
which contracts module may define a seat; the indexer's keeping, its
revision seats and the checker's head seats all use it. Two heads defining
one seat fail the judging unless one hands it over to its domain's module.
Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
mesh/check being carried to d58b71724312 on 2d201f781ced | from 205a3b37501f
The end a run writes comes back on the key's watch, where Put stops the run's context and leaves the saying to the run, so the end was never said and the indexer kept the try's candidate. The group try's unit test now echoes the end on the watch while the run says it.
Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
The third failure of the kind (tries 1, 3, 4): a sibling a test builds, the node-engine's composer, needs every repository it requires at the zero version beside it. besideFor now reads each sibling's root go.mod through the forge and places those repositories as any sibling is placed; the catalogue's rule names only what its tests read themselves.
Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
mesh-build-go's composer test builds the node-engine's composer from what lies beside, with nothing fetched; with mesh-sdk
and the node-engine alone, its zero-version requirements on mesh-contracts (and mesh-delivery, mesh-networking) were looked
up on the network and the group's fourth try failed. The quick fix, chosen: the catalogue's beside rule names them. The
thorough fix, left: besideFor derives a built sibling's siblings from its go.mod's zero-version requirements.
Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
LogEnded copied the outcome, manifest, bases, artifacts and imports of the build's key but not its error or step, and the log entry had no field for them: a failed build read back as only "failed".
Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
jschoubben
mesh-tools