mesh-issues: an open whose write may have landed never says nothing was opened, and a module must itself be registered

From the review: a taken key that cannot be read back, or a write never
confirmed, now tells the caller to get the number before opening again; an
owner entry naming a module is owned only by that module registered; link
targets get the secret guard; line separators are refused in one-line fields;
the acceptance test now proves the counter's own updates were contended.

modules/mesh-issues/cmd/mesh-issues/tracker_test.go

@@ -3,11 +3,14 @@ package main
 import (
 	"encoding/json"
 	"errors"
+	"fmt"
 	"reflect"
 	"strings"
 	"sync"
 	"testing"
 	"time"
+
+	stdio "git.novox.be/novox/mesh-sdk/go"
 )
 
 func TestTheFirstIssueGetsTheSettingsNumberAndEachNextOneMore(t *testing.T) {
@@ -113,7 +116,7 @@ func TestANumberTakenAndNotWrittenIsSaidAndNeverHandedOutAgain(t *testing.T) {
 	failing := &failingStore{memory: h.mem, failCreates: createAttempts}
 	h.Store = failing
 	_, err := h.Open(OpenAsk{Title: "third", Report: "r"})
-	if err == nil || !strings.Contains(err.Error(), "367 stays unused") {
+	if err == nil || !strings.Contains(err.Error(), "may have been written") || !strings.Contains(err.Error(), "get 367") {
 		t.Fatalf("a write that never landed: %v", err)
 	}
 	h.Store = h.mem
@@ -160,6 +163,47 @@ func TestAWriteWhoseAnswerWasLostIsKnownAsItsOwn(t *testing.T) {
 	}
 }
 
+// lostEvery writes the issue on its first create and then answers every create with a failure.
+type lostEvery struct{ *memory }
+
+func (l lostEvery) Create(state, key string, value any) (uint64, error) {
+	if state == IssuesState {
+		_, _ = l.memory.Create(state, key, value)
+		return 0, errors.New("no answer in 30 s")
+	}
+	return l.memory.Create(state, key, value)
+}
+
+// unreadable answers a taken key with a refusal and cannot read it back.
+type unreadable struct{ *memory }
+
+func (u unreadable) Create(state, key string, value any) (uint64, error) {
+	if state == IssuesState {
+		return 0, fmt.Errorf("%s: %w", key, stdio.ErrChanged)
+	}
+	return u.memory.Create(state, key, value)
+}
+func (u unreadable) Get(state, key string) (*Entry, error) {
+	if state == IssuesState {
+		return nil, errors.New("no answer in 30 s")
+	}
+	return u.memory.Get(state, key)
+}
+
+// An open whose write may have landed never says nothing was opened (the review of 2026-10-10).
+func TestAnOpenWhoseWriteMayHaveLandedNeverSaysNothingWasOpened(t *testing.T) {
+	h := newHarness(t)
+	h.Store = lostEvery{h.mem}
+	if o, err := h.Open(OpenAsk{Title: "t", Report: "r"}); err != nil || o.Number != 365 {
+		t.Fatalf("a write that landed, every answer lost: %v %v", o, err)
+	}
+	h.Store = unreadable{h.mem}
+	_, err := h.Open(OpenAsk{Title: "t", Report: "r"})
+	if err == nil || strings.Contains(err.Error(), "nothing was opened") || !strings.Contains(err.Error(), "get 366") {
+		t.Fatalf("a taken key that cannot be read back: %v", err)
+	}
+}
+
 func TestOpenSaysAnEventWithWhatChangedAndWhoChangedIt(t *testing.T) {
 	h := newHarness(t)
 	o, err := h.Open(OpenAsk{Title: "a title", Report: "a report", LocatedIn: []string{"mesh-controller internal/broker"}})
@@ -407,6 +451,7 @@ func TestLinksAreTypedAddedOnceAndRemoved(t *testing.T) {
 		{LinkAsk{Kind: LinkDecision, Target: "275"}, "four-digit"},
 		{LinkAsk{Kind: LinkDesign, Target: "03-DESIGN/../../etc/passwd"}, "design document"},
 		{LinkAsk{Kind: LinkCondition, Target: "a key\nwith a line"}, "condition"},
+		{LinkAsk{Kind: LinkCondition, Target: "token=abcdefgh123"}, "secret"},
 		{LinkAsk{Kind: LinkRelatesTo, Target: keyOf(b), Remove: true}, ""},
 		{LinkAsk{Kind: LinkRelatesTo, Target: keyOf(b), Remove: true}, "no relates-to link"},
 	}
@@ -549,7 +594,9 @@ func TestAnOwnersEntryIsTheRegisteredOneOrStartsWithIt(t *testing.T) {
 	for entry, want := range map[string]string{
 		"mesh-catalog":                         "mesh-catalog",
 		"mesh-catalog modules/nats":            "mesh-catalog modules/nats",
-		"mesh-catalog modules/nats/module.go":  "mesh-catalog",
+		"mesh-catalog modules/nats/module.go":  "mesh-catalog modules/nats",
+		"mesh-catalog modules/does-not-exist":  "",
+		"mesh-catalog checks/words":            "mesh-catalog",
 		"mesh-catalog modules/nats (the gate)": "mesh-catalog modules/nats",
 		"mesh-controller cmd/mesh-controller":  "mesh-controller",
 		"mesh-controllers":                     "",