6 Commits

Include renames

Author	SHA1	Message	Date
jochen	a018ebd1ca	Pass -- before every unit, and give a unit back only when it is exactly as the mesh held it ... Third review of mesh-catalog #147. A unit's name can now come from a setting (a template's instance), so every systemctl call that names a unit passes `--` before it, and a name can never be read as an option. On removal, a unit is started or enabled again only when it is exactly the stopped and disabled the mesh held it to. A masked unit, or one somebody started or enabled since, is left as it is, and the report says why. A restore that fails (the start refused, or the unit not running after it) puts back what this attempt changed and is reported as waiting, so no apply is made fatal by it and the next one tries again. The tests' fake service managers read systemctl's arguments in the shape they were written for (oldShape); internal/system's own test holds the `--`.	2026-10-09 01:54:26 +02:00
jschoubben	b94e0f9a77	The mesh's own ban chain is a ban wherever it hangs; the front end's record is cited as 0180 (hq ADR 0186) ... The legacy reader required every path into a chain of refusals to come from a built-in whose policy accepts. The home server's ban chain hangs off the container runtime's user chain, whose forward policy the runtime set to DROP, so the machine reported the mesh's own intrusion prevention as a rule set the mesh did not write. A chain is a ban when every refusal names its sources and the chain accepts nothing — the rule the nftables side already used. A chain that accepts anything is still not a ban. Fixture captured from the machine. The citations for the uninstalled front end move to ADR 0180, which another session's renumber had left pointing at an unrelated record.	2026-10-02 18:42:16 +02:00
jschoubben	f57386cdea	A package may be declared absent, and an uninstalled front end is retired for good (hq ADR 0175) ... absent: true on a package has the host remove it through the machine's own package manager when it is installed and leave alone a machine that never had it; read back either way. Undeclaring a package still removes nothing. A found firewall whose command is gone is recorded as removed, said once, and asked nothing of.	2026-10-02 16:28:27 +02:00
jschoubben	cdbe3ab0a4	Cite hq ADR 0170, not 0169: the firewall seat's record was renumbered after a collision on hq main	2026-10-02 14:52:20 +02:00
jschoubben	b6dbe0a7b9	A container may declare the capabilities it is granted (hq ADR 0169) ... Exactly the names declared reach the runtime, named in the spec so a change recreates the container; a name that is not a capability's is refused and a privileged container stays undeclarable. For a seat holder whose runtime changes the machine's packet filter.	2026-10-02 13:27:34 +02:00
jschoubben	fb9c9c3ee8	A taken container keeps a found network, a left-out module is kept, and genesis raises the forge as its module declares (hq ADR 0163) ... A container may name networks it also joins once created, for the per-machine setting that keeps a found network while a neighbour still resolves it there: joined after the run, part of the spec, refused when it cannot be joined. A declaration may say which modules the mesh left out because a stored setting cannot compose with its definition. Absence used to read as removal; a left-out module's records are kept and said, and its holds are not released. Genesis raises the bootstrap forge under the gitea module's container name, with its image digest and its data directory mounted at /data, so the module holds it by the found rule instead of raising a second forge beside it (issue 090). The network is the one difference left for a take to say. Before this the forge had no volume: its repositories were the container's, lost with it.	2026-10-01 23:45:05 +02:00