Fixes issue 1610 and its duplicate 1620 (hq#452 and okioki#8 were never asked for their Approve).
Cause. The router holds at most three open asks of one asker and refuses a fourth ("its asker already has 3 open asks", mesh-catalog modules/messenger asks.go:529-531) without keeping a record of it. The teller only logged the refusal and raised a condition; nothing asked the ask again once room came, so in a burst of merges an ask never reached the operator while the gate read it as written (teller journal on the control node, 2026-10-21 11:21:08 and 11:22:50 local).
Change (modules/mesh-delivery-teller). An ask refused for want of room waits in the teller's record room and is asked again when one of the teller's asks ends, under its own router id and a bus message id of its own (<id>.again-<tries>, so the bus's duplicate window does not drop it). An ask the gate withdrew, asked again under a newer asking, or that is answered or expired is dropped from the wait. After 6 refusals it is said as a condition. At start, waiting asks, asks asked again whose refusal was not heard, and first askings the router holds no record of are asked again (up to three at once). A refusal for another reason is still said as a condition at once.
Tests. Unit tests 1610/AC1-AC5 in room_test.go (including two restart cases from review round 1), and the integration test TestTellerAsksAgainAnAskRefusedForWantOfRoom on the real bus. Try build-1792593937256951762 passed at 037bf1ef36.
Follow-ups, not in this change. Issue 1733 (mesh-delivery.show says an ask was written while the router refused it; the gate in mesh-catalog) and issue 1737 (non-blocking edge cases from the review).
Fixes issue 1610 and its duplicate 1620 (hq#452 and okioki#8 were never asked for their Approve).
**Cause.** The router holds at most three open asks of one asker and refuses a fourth ("its asker already has 3 open asks", mesh-catalog modules/messenger asks.go:529-531) without keeping a record of it. The teller only logged the refusal and raised a condition; nothing asked the ask again once room came, so in a burst of merges an ask never reached the operator while the gate read it as written (teller journal on the control node, 2026-10-21 11:21:08 and 11:22:50 local).
**Change (modules/mesh-delivery-teller).** An ask refused for want of room waits in the teller's record `room` and is asked again when one of the teller's asks ends, under its own router id and a bus message id of its own (`<id>.again-<tries>`, so the bus's duplicate window does not drop it). An ask the gate withdrew, asked again under a newer asking, or that is answered or expired is dropped from the wait. After 6 refusals it is said as a condition. At start, waiting asks, asks asked again whose refusal was not heard, and first askings the router holds no record of are asked again (up to three at once). A refusal for another reason is still said as a condition at once.
**Tests.** Unit tests 1610/AC1-AC5 in room_test.go (including two restart cases from review round 1), and the integration test TestTellerAsksAgainAnAskRefusedForWantOfRoom on the real bus. Try build-1792593937256951762 passed at 037bf1ef361b.
**Follow-ups, not in this change.** Issue 1733 (mesh-delivery.show says an ask was written while the router refused it; the gate in mesh-catalog) and issue 1737 (non-blocking edge cases from the review).
Reviewed-by: reviewer-1610@shanks at 037bf1ef361b2a9a41979f99f1ddf4615ac1e7a9
The router holds at most three open asks of one asker and refuses a fourth without keeping it; the teller only logged the refusal, so a merge ask in a burst never reached the operator while the gate read it as asked (issues 1610, 1620). Bounded at six refusals, then said as a condition.
mesh/merge-gate head 037bf1ef361b merged into trunk b04ee764739a — pass: builds mesh-delivery-teller → novox; no bus step; every machine composes with the …
Deliverynovox/mesh-delivery@037bf1ef361b — delivered since 2026-10-21T15:45:30Z
Delivery plan — builds mesh-delivery-teller → novox; no bus step
tier 0: mesh-delivery-teller
novox: receives mesh-delivery-teller
Machines
mesh-delivery-teller on every machine running it: sent
Transitions
2026-10-21 15:00 (new) → proposed (announced): novox/mesh-delivery#15's head announced
2026-10-21 15:19 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
2026-10-21 15:19 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
2026-10-21 15:39 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
2026-10-21 15:39 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
2026-10-21 15:45 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says
The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.
<!-- mesh-delivery:view -->
**Delivery** `novox/mesh-delivery@037bf1ef361b` — **delivered** since 2026-10-21T15:45:30Z
**Delivery plan** — builds mesh-delivery-teller → novox; no bus step
- tier 0: mesh-delivery-teller
- novox: receives mesh-delivery-teller
**Machines**
- mesh-delivery-teller on every machine running it: sent
**Transitions**
- 2026-10-21 15:00 (new) → proposed (announced): novox/mesh-delivery#15's head announced
- 2026-10-21 15:19 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
- 2026-10-21 15:19 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
- 2026-10-21 15:39 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
- 2026-10-21 15:39 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
- 2026-10-21 15:45 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says
The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.
Merge check at 037bf1ef
Judged: head 037bf1ef361b merged into trunk b04ee764739a; read beside it: mesh-catalog 3259765d46bc, mesh-controller 98ffcb667fb2, mesh-controller-main d96c9f56a3f1, mesh-host fd3259a3f5d7, mesh-tools e0fadc43d9dd
mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-delivery-teller)
mesh/repo-check: PASS — its merge-check.sh passed
Delivery plan — builds mesh-delivery-teller → novox; no bus step
tier 0: mesh-delivery-teller
novox: receives mesh-delivery-teller
read by no module's build: modules/mesh-delivery-teller/cmd/mesh-delivery-teller/integration_test.go, modules/mesh-delivery-teller/cmd/mesh-delivery-teller/room_test.go, modules/mesh-delivery-teller/cmd/mesh-delivery-teller/teller_test.go
Run by the build seat on ace as build-1792594858037841254 (builds --log build-1792594858037841254).
--- the gate: mesh-delivery-teller
note: mesh-delivery-teller uses the seat "operator-channel", which no module declares and the mesh does not define among the manifests given; registration judges it against the whole catalogue, and passing the declaring module's manifest too judges it here
mesh-delivery-teller: ok, keeps state answers, asked, reads mesh-delivery-gate.asks, ready: teller by unit every 30s
long-running resources without health: 0
files asking for a setting without saying whether it is trusted: 0
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-21T15:13:45Z says they run
composing every machine as the mesh is
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
composing every machine with the change
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-21T15:13:45Z
machines:
- a machine (f35): composes
- holds mesh-dns-resolver (idt): composes
- holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
- a machine (yvbpsm): composes
a merge would rebuild 1 module(s) in 1 tier(s): mesh-delivery-teller
notes:
- modules/mesh-delivery-teller/cmd/mesh-delivery-teller/integration_test.go, modules/mesh-delivery-teller/cmd/mesh-delivery-teller/room_test.go and modules/mesh-delivery-teller/cmd/mesh-delivery-teller/teller_test.go read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
== ./modules/mesh-delivery-builder: go vet and the unit tests
ok mesh-delivery-builder 0.003s
ok mesh-delivery-builder/cmd/mesh-delivery-builder (cached)
ok mesh-delivery-builder/internal/build (cached)
== ./modules/mesh-delivery-builder: the integration tests (-tags integration)
ok mesh-delivery-builder 0.003s
ok mesh-delivery-builder/cmd/mesh-delivery-builder 2.005s
ok mesh-delivery-builder/internal/build (cached)
== ./modules/mesh-delivery-forge-bridge: go vet and the unit tests
ok mesh-delivery-forge-bridge 0.003s
ok mesh-delivery-forge-bridge/cmd/mesh-delivery-forge-bridge (cached)
ok mesh-delivery-forge-bridge/internal/bridge 0.197s
== ./modules/mesh-delivery-forge-bridge: the integration tests (-tags integration)
ok mesh-delivery-forge-bridge 0.003s
ok mesh-delivery-forge-bridge/cmd/mesh-delivery-forge-bridge 3.612s
ok mesh-delivery-forge-bridge/internal/bridge 0.198s
== ./modules/mesh-delivery-indexer: go vet and the unit tests
ok mesh-delivery-indexer 0.003s
ok mesh-delivery-indexer/cmd/mesh-delivery-indexer (cached)
ok mesh-delivery-indexer/internal/index 0.029s
== ./modules/mesh-delivery-indexer: the integration tests (-tags integration)
ok mesh-delivery-indexer 0.003s
ok mesh-delivery-indexer/cmd/mesh-delivery-indexer 0.642s
ok mesh-delivery-indexer/internal/index 0.030s
== ./modules/mesh-delivery-teller: go vet and the unit tests
ok mesh-delivery-teller 0.004s
ok mesh-delivery-teller/cmd/mesh-delivery-teller 0.108s
== ./modules/mesh-delivery-teller: the integration tests (-tags integration)
ok mesh-delivery-teller 0.002s
ok mesh-delivery-teller/cmd/mesh-delivery-teller 11.173s
== ./modules/mesh-delivery-view: go vet and the unit tests
ok mesh-delivery-view 0.003s
ok mesh-delivery-view/cmd/mesh-delivery-cli (cached)
ok mesh-delivery-view/cmd/mesh-delivery-view (cached)
ok mesh-delivery-view/cmd/mesh-delivery-view-tools (cached)
ok mesh-delivery-view/internal/view (cached)
== ./modules/mesh-delivery-view: the integration tests (-tags integration)
ok mesh-delivery-view 0.003s
ok mesh-delivery-view/cmd/mesh-delivery-cli (cached)
ok mesh-delivery-view/cmd/mesh-delivery-view (cached)
ok mesh-delivery-view/cmd/mesh-delivery-view-tools (cached)
ok mesh-delivery-view/internal/view (cached)
== ./modules/mesh-delivery-watchman: go vet and the unit tests
ok mesh-delivery-watchman 0.003s
ok mesh-delivery-watchman/cmd/mesh-delivery-watchman (cached)
ok mesh-delivery-watchman/internal/watch (cached)
== ./modules/mesh-delivery-watchman: the integration tests (-tags integration)
ok mesh-delivery-watchman 0.002s
ok mesh-delivery-watchman/cmd/mesh-delivery-watchman (cached)
ok mesh-delivery-watchman/internal/watch (cached)
**Merge check** at `037bf1ef`
Judged: head `037bf1ef361b` merged into trunk `b04ee764739a`; read beside it: mesh-catalog `3259765d46bc`, mesh-controller `98ffcb667fb2`, mesh-controller-main `d96c9f56a3f1`, mesh-host `fd3259a3f5d7`, mesh-tools `e0fadc43d9dd`
- `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-delivery-teller)
- `mesh/repo-check`: **PASS** — its merge-check.sh passed
**Delivery plan** — builds mesh-delivery-teller → novox; no bus step
- tier 0: mesh-delivery-teller
- novox: receives mesh-delivery-teller
- read by no module's build: modules/mesh-delivery-teller/cmd/mesh-delivery-teller/integration_test.go, modules/mesh-delivery-teller/cmd/mesh-delivery-teller/room_test.go, modules/mesh-delivery-teller/cmd/mesh-delivery-teller/teller_test.go
Run by the build seat on ace as `build-1792594858037841254` (`builds --log build-1792594858037841254`).
```
--- the gate: mesh-delivery-teller
note: mesh-delivery-teller uses the seat "operator-channel", which no module declares and the mesh does not define among the manifests given; registration judges it against the whole catalogue, and passing the declaring module's manifest too judges it here
mesh-delivery-teller: ok, keeps state answers, asked, reads mesh-delivery-gate.asks, ready: teller by unit every 30s
long-running resources without health: 0
files asking for a setting without saying whether it is trusted: 0
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-21T15:13:45Z says they run
composing every machine as the mesh is
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
composing every machine with the change
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-21T15:13:45Z
machines:
- a machine (f35): composes
- holds mesh-dns-resolver (idt): composes
- holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
- a machine (yvbpsm): composes
a merge would rebuild 1 module(s) in 1 tier(s): mesh-delivery-teller
notes:
- modules/mesh-delivery-teller/cmd/mesh-delivery-teller/integration_test.go, modules/mesh-delivery-teller/cmd/mesh-delivery-teller/room_test.go and modules/mesh-delivery-teller/cmd/mesh-delivery-teller/teller_test.go read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
== ./modules/mesh-delivery-builder: go vet and the unit tests
ok mesh-delivery-builder 0.003s
ok mesh-delivery-builder/cmd/mesh-delivery-builder (cached)
ok mesh-delivery-builder/internal/build (cached)
== ./modules/mesh-delivery-builder: the integration tests (-tags integration)
ok mesh-delivery-builder 0.003s
ok mesh-delivery-builder/cmd/mesh-delivery-builder 2.005s
ok mesh-delivery-builder/internal/build (cached)
== ./modules/mesh-delivery-forge-bridge: go vet and the unit tests
ok mesh-delivery-forge-bridge 0.003s
ok mesh-delivery-forge-bridge/cmd/mesh-delivery-forge-bridge (cached)
ok mesh-delivery-forge-bridge/internal/bridge 0.197s
== ./modules/mesh-delivery-forge-bridge: the integration tests (-tags integration)
ok mesh-delivery-forge-bridge 0.003s
ok mesh-delivery-forge-bridge/cmd/mesh-delivery-forge-bridge 3.612s
ok mesh-delivery-forge-bridge/internal/bridge 0.198s
== ./modules/mesh-delivery-indexer: go vet and the unit tests
ok mesh-delivery-indexer 0.003s
ok mesh-delivery-indexer/cmd/mesh-delivery-indexer (cached)
ok mesh-delivery-indexer/internal/index 0.029s
== ./modules/mesh-delivery-indexer: the integration tests (-tags integration)
ok mesh-delivery-indexer 0.003s
ok mesh-delivery-indexer/cmd/mesh-delivery-indexer 0.642s
ok mesh-delivery-indexer/internal/index 0.030s
== ./modules/mesh-delivery-teller: go vet and the unit tests
ok mesh-delivery-teller 0.004s
ok mesh-delivery-teller/cmd/mesh-delivery-teller 0.108s
== ./modules/mesh-delivery-teller: the integration tests (-tags integration)
ok mesh-delivery-teller 0.002s
ok mesh-delivery-teller/cmd/mesh-delivery-teller 11.173s
== ./modules/mesh-delivery-view: go vet and the unit tests
ok mesh-delivery-view 0.003s
ok mesh-delivery-view/cmd/mesh-delivery-cli (cached)
ok mesh-delivery-view/cmd/mesh-delivery-view (cached)
ok mesh-delivery-view/cmd/mesh-delivery-view-tools (cached)
ok mesh-delivery-view/internal/view (cached)
== ./modules/mesh-delivery-view: the integration tests (-tags integration)
ok mesh-delivery-view 0.003s
ok mesh-delivery-view/cmd/mesh-delivery-cli (cached)
ok mesh-delivery-view/cmd/mesh-delivery-view (cached)
ok mesh-delivery-view/cmd/mesh-delivery-view-tools (cached)
ok mesh-delivery-view/internal/view (cached)
== ./modules/mesh-delivery-watchman: go vet and the unit tests
ok mesh-delivery-watchman 0.003s
ok mesh-delivery-watchman/cmd/mesh-delivery-watchman (cached)
ok mesh-delivery-watchman/internal/watch (cached)
== ./modules/mesh-delivery-watchman: the integration tests (-tags integration)
ok mesh-delivery-watchman 0.002s
ok mesh-delivery-watchman/cmd/mesh-delivery-watchman (cached)
ok mesh-delivery-watchman/internal/watch (cached)
```
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Fixes issue 1610 and its duplicate 1620 (hq#452 and okioki#8 were never asked for their Approve).
Cause. The router holds at most three open asks of one asker and refuses a fourth ("its asker already has 3 open asks", mesh-catalog modules/messenger asks.go:529-531) without keeping a record of it. The teller only logged the refusal and raised a condition; nothing asked the ask again once room came, so in a burst of merges an ask never reached the operator while the gate read it as written (teller journal on the control node, 2026-10-21 11:21:08 and 11:22:50 local).
Change (modules/mesh-delivery-teller). An ask refused for want of room waits in the teller's record
roomand is asked again when one of the teller's asks ends, under its own router id and a bus message id of its own (<id>.again-<tries>, so the bus's duplicate window does not drop it). An ask the gate withdrew, asked again under a newer asking, or that is answered or expired is dropped from the wait. After 6 refusals it is said as a condition. At start, waiting asks, asks asked again whose refusal was not heard, and first askings the router holds no record of are asked again (up to three at once). A refusal for another reason is still said as a condition at once.Tests. Unit tests 1610/AC1-AC5 in room_test.go (including two restart cases from review round 1), and the integration test TestTellerAsksAgainAnAskRefusedForWantOfRoom on the real bus. Try build-1792593937256951762 passed at
037bf1ef36.Follow-ups, not in this change. Issue 1733 (mesh-delivery.show says an ask was written while the router refused it; the gate in mesh-catalog) and issue 1737 (non-blocking edge cases from the review).
Reviewed-by: reviewer-1610@shanks at
037bf1ef36Delivery
novox/mesh-delivery@037bf1ef361b— delivered since 2026-10-21T15:45:30ZDelivery plan — builds mesh-delivery-teller → novox; no bus step
Machines
Transitions
The commit's note under
refs/notes/mesh-plankeeps every transition:git log --notes=mesh-plan.Merge check at
037bf1efJudged: head
037bf1ef361bmerged into trunkb04ee764739a; read beside it: mesh-catalog3259765d46bc, mesh-controller98ffcb667fb2, mesh-controller-maind96c9f56a3f1, mesh-hostfd3259a3f5d7, mesh-toolse0fadc43d9ddmesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-delivery-teller)mesh/repo-check: PASS — its merge-check.sh passedDelivery plan — builds mesh-delivery-teller → novox; no bus step
Run by the build seat on ace as
build-1792594858037841254(builds --log build-1792594858037841254).