The grants part keeps and recovers every binding of state asked in requires, and the validator reads both forms (issue 1966) #190

2026-11-09T13:23:36Z

mesh-tools commented

2026-11-09 13:23:36 +00:00

Issue 1966, the rest of the requires-grants fix (playbook 08), after the recovery group fix/1966-requires-state (mesh-sdk #177, mesh-tools #66, mesh-delivery #188).

Live case. distribution on novox lost four of its eight bindings (holds, windows, mirrors, events) and mesh-knowledge three of six: the grants part acknowledged a created event it failed to keep. Since 13:18 UTC a build whose upload goes in parts fails on it ("distribution keeps and reads no state called windows"), and oci-artifact-registry.list fails on holds.

Change.

The grants part writes a binding at the revision it read and retries once on a conflict; an event it cannot keep is not acknowledged but redelivered with a delay.
grants_bindings (read): each kept binding beside every membership written, naming the bindings a membership lacks.
grants_bindings_again (steer, a hand act): for one module, re-reads the seat mesh-broker's created, recreated and dropped events from the shared events stream (7 days) through the same keeping path; a dropped binding stays dropped, and a failed re-read keeps nothing. One new grant: $JS.API.STREAM.MSG.GET.EVENTS, the grants part's alone. (Ruling, fix-1965: re-read the events rather than extend the seat's list; the seat's list answering bindings and a first view at start belong to the record extending ADR 0595 §7.)
The manifest validator reads kept state in both forms (catalogue.KeptStates, ADR 0595 §11) and refuses a per-machine key-value entry in requires, which no manifest uses.
A source guard: kept and issued state is read only through mesh-sdk's two rules.
An integration step: under the composed user list, a module's own account creates, writes and reads its bound bucket; another module reads nothing of it.

Quick or thorough. Thorough: the kind (state asked in requires not issued, granted or kept) was met twice; every reader goes through one rule, and the lost-binding cause is fixed where the event is heard, with a hand tool to recover.

Checks run locally. go vet (plain and integration), unit suites and gofmt for all 41 Go modules; the integration step run once against an embedded bus (38 s). mesh-judge at trunk and at the change: no manifest's verdict differs. Rows only in tests (the repository is over its budgets).

After delivery. grants_bindings_again for distribution and mesh-knowledge.

Order. Merge after lead-47's checker group fix/1966-checker-compositions-objects (agreed).

Reviewed-by: mesh-code-reviewer@shanks at ecad0c688b

https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i

Issue 1966, the rest of the requires-grants fix (playbook 08), after the recovery group fix/1966-requires-state (mesh-sdk #177, mesh-tools #66, mesh-delivery #188). **Live case.** distribution on novox lost four of its eight bindings (holds, windows, mirrors, events) and mesh-knowledge three of six: the grants part acknowledged a `created` event it failed to keep. Since 13:18 UTC a build whose upload goes in parts fails on it ("distribution keeps and reads no state called windows"), and `oci-artifact-registry.list` fails on `holds`. **Change.** - The grants part writes a binding at the revision it read and retries once on a conflict; an event it cannot keep is not acknowledged but redelivered with a delay. - `grants_bindings` (read): each kept binding beside every membership written, naming the bindings a membership lacks. - `grants_bindings_again` (steer, a hand act): for one module, re-reads the seat mesh-broker's `created`, `recreated` and `dropped` events from the shared events stream (7 days) through the same keeping path; a dropped binding stays dropped, and a failed re-read keeps nothing. One new grant: `$JS.API.STREAM.MSG.GET.EVENTS`, the grants part's alone. (Ruling, fix-1965: re-read the events rather than extend the seat's `list`; the seat's list answering bindings and a first view at start belong to the record extending ADR 0595 §7.) - The manifest validator reads kept state in both forms (`catalogue.KeptStates`, ADR 0595 §11) and refuses a per-machine key-value entry in `requires`, which no manifest uses. - A source guard: kept and issued state is read only through mesh-sdk's two rules. - An integration step: under the composed user list, a module's own account creates, writes and reads its bound bucket; another module reads nothing of it. **Quick or thorough.** Thorough: the kind (state asked in `requires` not issued, granted or kept) was met twice; every reader goes through one rule, and the lost-binding cause is fixed where the event is heard, with a hand tool to recover. **Checks run locally.** go vet (plain and integration), unit suites and gofmt for all 41 Go modules; the integration step run once against an embedded bus (38 s). mesh-judge at trunk and at the change: no manifest's verdict differs. Rows only in tests (the repository is over its budgets). **After delivery.** `grants_bindings_again` for distribution and mesh-knowledge. **Order.** Merge after lead-47's checker group fix/1966-checker-compositions-objects (agreed). Reviewed-by: mesh-code-reviewer@shanks at ecad0c688b48d8c8ff0169f92ac87a55b2dace40 https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i

mesh-tools added 7 commits 2026-11-09 13:23:36 +00:00

The manifest validator reads kept state in both forms; per-machine in requires is refused 35c3f5dd2f

A process's bus.state, a seat contribution and a seat's records naming a
key-value entry asked in requires were refused, where the old state section
is accepted (issue 1966, ADR 0595 §11). They now read catalogue.KeptStates.
A per-machine key-value entry in requires is refused with its reason: its
binding names no machine's key, so no machine could be held to its own.

Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i

Keep every binding the bus module says created, and never acknowledge one not kept c2e7249897

distribution's membership carried 4 of its 8 bindings and mesh-knowledge's 3
of 6 (issue 1966). The grants part wrote a module's kept bindings with a blind
put, so two created heard at once lost one, and acknowledged every seat event
whatever its handler answered, while the log said it would come again. The
bindings are now written at the revision read and read again once on a
conflict, and an event not applied is left unacknowledged (a delayed nak).

Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i

Guard that kept and issued state is read only through mesh-sdk's two rules (issue 1966) 4d75646bf4

A reader of a manifest's or a membership's State beside catalogue.KeptStates
and Membership.StateIssued misses a key-value entry asked in requires, the
kind of this issue's faults. The row reads the repository's syntax trees and
allows only the rules that judge or compose the old section itself.

Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i

A tool reads the bindings the grants part keeps, beside the memberships it wrote (issue 1966) 67e1c7594f

bound.<module> had no reader: a binding lost or kept but not yet written into
a membership could only be guessed from grants_membership. grants_bindings
names each kept binding and, by membership, the ones it lacks.

Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i

Prove on a server under the composed grants that a module writes its bound bucket (issue 1966) 44422f21db

The integration case after created proved only that the binding is in the
membership, never that the account can use it (design 25 § 12.7). Under the
list the composer writes, the keeper creates mod-c_kept, mod-c's own account
binds and writes it, and another module reads nothing of it.

Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i

A tool reads one module's bindings again from the seat events the shared stream still holds (issue 1966) aa89032f02

A binding the bus module said created that the part did not keep had no
recovery: distribution's holds, windows, mirrors and events are missing on
the bus node's memberships. grants_bindings_again, a hand act, asks the
process to read the seat mesh-broker's created, recreated and dropped of
one module again from EVENTS by sequence and keep each through HearBroker
in order, so a dropped entry stays dropped. grants_bindings shows what it
kept, and says when the stream no longer holds a created: then the seat's
list answering bindings is the path (the record extending ADR 0595 §7).
The part alone is granted the stream's message get, no consumer.

Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i

A re-read of the seat events that fails partway keeps nothing it read (issue 1966)

mesh/delivery ready: it is merged on the Approve

Details

mesh/check being carried to ecad0c688b48 on 05e21fd8a382 | from fc21f2d1bd56

ecad0c688b

A created whose dropped lay past the failure was kept again. When the
stream cannot be read whole, only the error is written to bindings-again.

Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i

mesh-tools commented

2026-11-09 13:23:41 +00:00

Delivery novox/mesh-delivery@ecad0c688b48 — ready since 2026-11-09T13:23:40Z

Transitions

2026-11-09 13:23 (new) → proposed (announced): novox/mesh-delivery#190's head announced
2026-11-09 13:23 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false)

The commit's note under refs/notes/mesh-plan keeps every transition of this change up to its merge: git log --notes=mesh-plan.

**Delivery** `novox/mesh-delivery@ecad0c688b48` — **ready** since 2026-11-09T13:23:40Z **Transitions** - 2026-11-09 13:23 (new) → proposed (announced): novox/mesh-delivery#190's head announced - 2026-11-09 13:23 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false) The commit's note under `refs/notes/mesh-plan` keeps every transition of this change up to its merge: `git log --notes=mesh-plan`.

mesh-tools commented

2026-11-09 14:08:16 +00:00

mesh-delivery: not merged. The merge of this pull request into main at ecad0c688b was declined: the operator, via telegram (user id verified), chose Decline. A new head asks the operator again.

mesh-delivery: **not merged.** The merge of this pull request into main at ecad0c688b48d8c8ff0169f92ac87a55b2dace40 was declined: the operator, via telegram (user id verified), chose Decline. A new head asks the operator again.

mesh-tools referenced this pull request

2026-11-09 14:26:22 +00:00

The indexer writes no fingerprint from a packages state it did not read, and computes fingerprints again by hand (issue 1966, recovery) #191

Some checks are pending

mesh/delivery ready: it is merged on the Approve

Details

mesh/check being carried to ecad0c688b48 on 05e21fd8a382 | from fc21f2d1bd56

You are not authorized to merge this pull request.

This pull request can be merged automatically.

This branch is out-of-date with the base branch

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin fix/1966-requires-grants:fix/1966-requires-grants

git checkout fix/1966-requires-grants

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-delivery#190