A catalogue test refuses a manifest that still depends on the controller at the lease write (ADR 0571 §13)

checks/controllerdeps decodes every module.json and judges the set with mesh-sdk's ManifestRefusals at the phase of the
lease write's own delivery, so no module reads, invokes or consumes the controller beyond the lease and the entries
kept to the write. At origin/main it refuses 11 declarations (the ones S7-S12 drop); at this head it passes. Two
tests (the real tree, and four rows on a tree of its own), in a new check of its own; go.mod pins the previous
mesh-sdk until the group's head is pinned, and go.sum needs the group's entries then.

(issue 774, 774/S13)

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

checks/controllerdeps/controllerdeps_test.go

@@ -0,0 +1,56 @@
+package controllerdeps
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// 774/S13/AC1: every manifest of the catalogue at this head, at the phase of the lease write's own delivery, reads,
+// invokes and consumes nothing of the controller beyond the lease and the entries kept to the write.
+func TestNoManifestDependsOnTheControllerBeyondTheLeaseAndTheEntriesKeptToTheWrite(t *testing.T) {
+	got, err := Refusals("../..", catalogue.PhaseWrite)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) > 0 {
+		t.Errorf("the catalogue still declares on the controller (novox/hq ADR 0571 §13):\n%s", strings.Join(got, "\n"))
+	}
+}
+
+// The check refuses what it must and lets the lease and the kept entries through, on a tree of its own.
+func TestRefusalsJudgeATreeByPhase(t *testing.T) {
+	for _, row := range []struct {
+		name, phase string
+		manifests   map[string]string
+		want        string // empty: passes
+	}{
+		{"the lease is no dependency", catalogue.PhaseWrite, map[string]string{"a": `{"module":"a","reads":["mesh-controller.lease"]}`}, ""},
+		{"a read of the controller's states", catalogue.PhaseWrite, map[string]string{"a": `{"module":"a","reads":["mesh-controller.conditions"]}`}, "a declares read mesh-controller.conditions"},
+		{"a kept entry passes before the delivery", catalogue.PhaseBefore, map[string]string{"artifact-store-tools": `{"module":"artifact-store-tools","invokes":["seat:mesh-controller.collect"]}`}, ""},
+		{"a kept-to-the-write entry passes at the write", catalogue.PhaseWrite, map[string]string{"artifact-store-tools": `{"module":"artifact-store-tools","invokes":["seat:mesh-controller.collect"]}`}, ""},
+	} {
+		t.Run(row.name, func(t *testing.T) {
+			root := t.TempDir()
+			for module, text := range row.manifests {
+				dir := filepath.Join(root, "modules", module)
+				if err := os.MkdirAll(dir, 0o755); err != nil {
+					t.Fatal(err)
+				}
+				if err := os.WriteFile(filepath.Join(dir, "module.json"), []byte(text), 0o644); err != nil {
+					t.Fatal(err)
+				}
+			}
+			got, err := Refusals(root, row.phase)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if joined := strings.Join(got, "\n"); (row.want == "") != (joined == "") || !strings.Contains(joined, row.want) {
+				t.Errorf("refusals %q, want %q", joined, row.want)
+			}
+		})
+	}
+}