4 Commits

Include renames

Author	SHA1	Message	Date
jochen	bdd44154cc	Judge how a module says it is ready, beside whether it stays up (hq ADR 0240, to-be 48 Phase B) ... Liveness alone could not see a web application whose port was open and whose program ran while every request hung for eleven hours (issue 145). A resource now carries the `health` its module declared: the engine makes http and tcp looks itself from the machine to the endpoint's published port, reads a unit's readiness from the show it already makes, hands an exec command or the image's own check to the runtime as the container's check with the declared timing and reads its state from the inspect it already makes, and asks a module's tool on its own node tools. Starting until the check passed, unhealthy once its looks after the grace fail the declared number of times; never more looks than the measured budget; nothing restarted. The statement says contract 2, which tells the controller this engine may be sent the field.	2026-10-07 14:08:32 +02:00
jochen	1fc1e74cc3	Judge whether what a module runs stays up, and say it (hq ADR 0240, to-be 48 Phase A) ... A container that crash-looped after its compose applied passed every check the gate had: nothing looked at what a module runs. The node-engine now judges every long-running resource on every look — one read of the runtime, one per service manager — keeps the restarts it counts across recreates and its own restarts, and says the state in every report and as an event on change, again every minute while not healthy. It reads only; nothing is restarted for being unhealthy.	2026-10-07 02:28:15 +02:00
jschoubben	2478b5f127	One bus: the AMQP transport is gone from the host ... The mesh runs on the seat's bus alone (novox/hq ADR 0131, design 28 task 5.5). The host's old dialling and enrolment paths are deleted with the switch that chose between them; a membership or a token naming another bus is refused before anything is sent, rather than dialled on a transport that no longer exists.	2026-09-28 03:54:22 +02:00
jschoubben	25449a31c3	The host's outbound behind a seam, with both transports ... Step 3.5's first half, mirroring the controller's. A host says exactly two things unprompted, and the difference between them is the whole interface: a report must arrive, and a heartbeat must not be insisted on. So a report goes through JetStream — it is the message the store-window guarantee is about — and a heartbeat stays on core, because a heartbeat in a stream is the mesh's least valuable message competing for retention with its most valuable. The host still imports nothing of the mesh's own (ADR 0005): this is its own interface over its own libraries. It agrees with the controller because a fixture holds both to one envelope, which is the only agreement that survives two repositories. Also recorded, where the next person reads it rather than in a plan: the "newest wins" window narrows at the rollout and does not disappear. Last- per-subject makes the catch-up half the stream's, and sequence orders them definitively — but three pushes to a connected node are still three deliveries. Saying which half goes is worth more than "can probably be removed", which is how a load-bearing window gets deleted in a hurry.	2026-09-27 00:01:42 +02:00