Merge pull request 'mesh-vault: own answers a node within its bound — assignments from a watched mirror, one read per module, one synced record per answer (issue 1126)' (#545) from fix/1126-vault-own into main

modules/mesh-vault/cmd/mesh-vault/askers.go

@@ -4,6 +4,9 @@ import (
 	"encoding/json"
 	"fmt"
 	"strings"
+	"sync"
+
+	stdio "git.novox.be/novox/mesh-sdk/go"
 )
 
 // Who may ask `get` for which secret (novox/hq ADR 0349 §11, design 57 V4, issue 647).
@@ -108,6 +111,9 @@ func fieldSet(f json.RawMessage) bool {
 // that the module's plan there names.
 type Declared struct {
 	Read AssignmentReader
+	// Confirm, when set, reads an assignment directly (over the bus): a module Read does not hold is confirmed through it
+	// before a credential is refused, since a watched mirror can be behind (issue 1126, review round 1).
+	Confirm AssignmentReader
 	// Store is the vault's store, whose record of who holds a provision's one credential (pair.go) the rule reads.
 	Store *Store
 }
@@ -207,3 +213,77 @@ func (d Declared) May(caller, name string) (bool, string) {
 // bus error rather than an answer. The vault says "holds no secret named ... yet", which the client waits on and asks
 // again, and records no refusal.
 const notYetPrefix = "not yet: "
+
+// WatchedAssignments is the assignments mirror as the vault's watch of it hands it over (issue 1126, 2026-10-28: novox's
+// `own` read one assignment over the bus per own secret and per credential, 203 reads, and answered after 26 s, past
+// the node-engine's 15 s). The state is the bus's; the vault watches it, never polls it, and reads it from memory once the
+// watch has handed every current value. Until then, and when the watch could not be begun, a read goes to the bus
+// (Fallback), as before.
+type WatchedAssignments struct {
+	mu       sync.Mutex
+	held     map[string][]byte
+	caught   bool
+	attempt  uint64
+	Fallback AssignmentReader
+}
+
+// WatchAttempt is one attempt at the watch: what it hands over counts only while it is the latest attempt, so a watch
+// that failed partway and is begun again keeps nothing it took (a key deleted meanwhile is never handed again), and a
+// late delivery to an older attempt changes nothing (issue 1126, review round 1).
+type WatchAttempt struct {
+	w *WatchedAssignments
+	n uint64
+}
+
+// Begin starts a new attempt from nothing held: reads go to the bus until it has caught up.
+func (w *WatchedAssignments) Begin() WatchAttempt {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	w.attempt++
+	w.held, w.caught = map[string][]byte{}, false
+	return WatchAttempt{w: w, n: w.attempt}
+}
+
+// Take keeps one change the attempt handed over, a value put or a key deleted, while it is the latest attempt.
+func (a WatchAttempt) Take(c stdio.StateChange) error {
+	w := a.w
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	if a.n != w.attempt {
+		return nil
+	}
+	if c.Op == "delete" || c.Op == "purge" || len(c.Value) == 0 {
+		delete(w.held, c.Key)
+		return nil
+	}
+	w.held[c.Key] = append([]byte(nil), c.Value...)
+	return nil
+}
+
+// Caught says the attempt handed every current value: reads are answered from memory from now on, if it is the latest.
+func (a WatchAttempt) Caught() {
+	w := a.w
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	if a.n == w.attempt {
+		w.caught = true
+	}
+}
+
+// Read is one value of the mirror, `<node>.<module>`: nil when there is none.
+func (w *WatchedAssignments) Read(key string) ([]byte, error) {
+	w.mu.Lock()
+	if w.caught {
+		raw, ok := w.held[key]
+		w.mu.Unlock()
+		if !ok {
+			return nil, nil
+		}
+		return append([]byte(nil), raw...), nil
+	}
+	w.mu.Unlock()
+	if w.Fallback == nil {
+		return nil, fmt.Errorf("the assignments mirror is not watched yet, and nothing reads it from the bus")
+	}
+	return w.Fallback(key)
+}

modules/mesh-vault/cmd/mesh-vault/main.go

@@ -49,13 +49,37 @@ func build() *Env {
 	}
 	// Who may ask (askers.go): a node's provisioner client, for what its module's plan there names.
 	// Where it sees a consumer bind a provider (pair.go): the same mirror, every key.
-	env.Vault = &Vault{Store: store, Own: own, Askers: Declared{Read: readAssignment, Store: store},
+	// The assignments as the vault's watch keeps them (watchAssignments), read over the bus until it has caught up.
+	assigned = &WatchedAssignments{Fallback: readAssignment}
+	env.Vault = &Vault{Store: store, Own: own, Askers: Declared{Read: assigned.Read, Confirm: readAssignment, Store: store},
 		Assignments: Mirror{Keys: assignmentKeys, Read: readAssignment}, Emit: emit, Ask: stdio.Ask,
 		Now: time.Now, Log: say, Accounts: busAccounts{}, Haves: readHave,
 		HaveKeys: func() ([]string, error) { return stdio.State(HaveRead).Keys() }}
 	return env
 }
 
+// assigned is the assignments mirror as the vault's watch keeps it.
+var assigned *WatchedAssignments
+
+// watchAssignments begins the watch of the assignments mirror the vault's rules read (issue 1126, 2026-10-28): a
+// watch, never a poll, so `own` and `get` read no assignment over the bus once it has caught up. It answers whether the
+// watch began; one that did not is begun again at the next minute pass, and reads go to the bus meanwhile.
+func watchAssignments() bool {
+	if assigned == nil {
+		return true
+	}
+	// Each attempt begins from nothing held: one that failed partway leaves nothing a later one would not hand again.
+	attempt := assigned.Begin()
+	if err := stdio.State(AssignmentsRead).Watch("", attempt.Take); err != nil {
+		assigned.Begin() // what the failed attempt took counts for nothing, and reads go to the bus
+		say("the assignments are not watched, so each is read over the bus; begun again at the next pass: %v", err)
+		return false
+	}
+	attempt.Caught()
+	say("the assignments are watched: the vault's rules read them from memory")
+	return true
+}
+
 // readHave is one key of the node-engines' have bucket, read through the runtime under the vault's own account (its
 // manifest `reads` it), or nil when there is none.
 func readHave(key string) ([]byte, error) {
@@ -149,11 +173,14 @@ func main() {
 			written, failed := env.Vault.HashHeld()
 			say("hashed %d bus accounts at start; %d could not be, tried again every minute: %v", len(written), len(failed), failed)
 		}
-		watched := watchHandings(env)
+		watched, watching := watchHandings(env), watchAssignments()
 		for {
 			if !watched {
 				watched = watchHandings(env)
 			}
+			if !watching {
+				watching = watchAssignments()
+			}
 			env.pass()
 			if env.Vault != nil {
 				env.Vault.HashOwed()

modules/mesh-vault/cmd/mesh-vault/ownnode.go

@@ -70,7 +70,7 @@ func credentialNames(c CredentialAsked) []string {
 
 // credentialRefusal says why node may not have c, or "": a consumer's credential to the machine its consuming module
 // stands on, a provider's to the providing machine, and nothing to a machine that is neither.
-func (v *Vault) credentialRefusal(node string, c CredentialAsked) string {
+func (v *Vault) credentialRefusal(node string, c CredentialAsked, plan *planReader) string {
 	for _, part := range []string{c.Provision, c.Consumer, c.ConsumerModule, c.Provider} {
 		if !namePart.MatchString(part) {
 			return fmt.Sprintf("%q is not a name the mesh writes", part)
@@ -85,14 +85,19 @@ func (v *Vault) credentialRefusal(node string, c CredentialAsked) string {
 			return fmt.Sprintf("%s asks as a consumer on %s, and is not that machine", node, c.Consumer)
 		}
 		// The consuming module stands on the machine: read, never assumed (an assignment that cannot be read refuses).
-		read, why := v.assignmentReader(node)
+		raw, why, err := plan.read(c.ConsumerModule)
 		if why != "" {
 			return why
 		}
-		raw, err := read(node + "." + c.ConsumerModule)
 		if err != nil {
 			return fmt.Sprintf(notYetPrefix+"the assignment %s.%s could not be read: %v", node, c.ConsumerModule, err)
 		}
+		if raw == nil {
+			// Confirmed directly before refusing: the mirror may not hold a module assigned a moment ago.
+			if raw, err = plan.confirmed(c.ConsumerModule); err != nil {
+				return fmt.Sprintf(notYetPrefix+"the assignment %s.%s could not be read: %v", node, c.ConsumerModule, err)
+			}
+		}
 		if raw == nil {
 			return fmt.Sprintf("%s is not on %s: neither assigned there nor required by a module there", c.ConsumerModule, node)
 		}
@@ -106,6 +111,56 @@ func (v *Vault) credentialRefusal(node string, c CredentialAsked) string {
 	return fmt.Sprintf("the role %q is not consumer or provider", c.Role)
 }
 
+// planReader reads the assignments of one machine's modules for one answer of `own`, each module's once (issue 1126,
+// 2026-10-28: one read per own secret and per credential, 203 on novox, held the answer past the node-engine's bound).
+type planReader struct {
+	node    string
+	reader  AssignmentReader
+	confirm AssignmentReader
+	why     string
+	got     map[string]planRead
+}
+
+type planRead struct {
+	raw []byte
+	err error
+}
+
+func (v *Vault) plansOf(node string) *planReader {
+	read, why := v.assignmentReader(node)
+	var confirm AssignmentReader
+	if d, ok := v.Askers.(Declared); ok && d.Confirm != nil {
+		confirm = standing(d.Confirm)
+	}
+	return &planReader{node: node, confirm: confirm, reader: read, why: why, got: map[string]planRead{}}
+}
+
+// read is module's assignment on the machine, nil when there is none, or why the vault reads none.
+func (p *planReader) read(module string) ([]byte, string, error) {
+	if p.why != "" {
+		return nil, p.why, nil
+	}
+	r, ok := p.got[module]
+	if !ok {
+		r.raw, r.err = p.reader(p.node + "." + module)
+		p.got[module] = r
+	}
+	return r.raw, "", r.err
+}
+
+// confirmed is module's assignment read directly, for one the reader does not hold (a watched mirror can be behind),
+// nil when there is none or nothing reads directly.
+func (p *planReader) confirmed(module string) ([]byte, error) {
+	if p.confirm == nil {
+		return nil, nil
+	}
+	raw, err := p.confirm(p.node + "." + module)
+	if err == nil && raw != nil {
+		p.got[module] = planRead{raw: raw}
+	}
+	return raw, err
+}
+
 // assignmentReader is the vault's reader of the assignments, or why it has none: the rule `own` keeps reads them,
 // and without them it refuses rather than hands (a rule that cannot be read is no rule).
 func (v *Vault) assignmentReader(node string) (AssignmentReader, string) {
@@ -177,17 +232,21 @@ func (v *Vault) OwnOfNode(caller string, asked ...CredentialAsked) (OwnAnswer, e
 	if err != nil {
 		return OwnAnswer{}, fmt.Errorf("%s's sealing key as recorded is not usable: %w", node, err)
 	}
-	all, err := v.Store.List()
+	// Only this machine's own records are read, each module's assignment once, and every hand-out recorded in one synced
+	// write after all are sealed: none is handed when that record cannot be written (issue 1126, 2026-10-28).
+	all, err := v.Store.ListPrefix("own/" + node + "/")
 	if err != nil {
 		return OwnAnswer{}, err
 	}
+	plan := v.plansOf(node)
+	var handings []Handing
 	out := OwnAnswer{Node: node, Key: key}
 	for _, r := range all {
 		parts := strings.Split(r.Name, "/")
 		if len(parts) != 4 || parts[0] != "own" || parts[1] != node {
 			continue
 		}
-		handed, err := v.handed(node, parts[2])
+		handed, err := plan.handed(parts[2])
 		if err != nil {
 			return OwnAnswer{}, err
 		}
@@ -202,9 +261,7 @@ func (v *Vault) OwnOfNode(caller string, asked ...CredentialAsked) (OwnAnswer, e
 		if err != nil {
 			return OwnAnswer{}, err
 		}
-		if err := v.recordHanding(Handing{To: caller, Name: r.Name, Generation: r.Generation, Outcome: "handed"}); err != nil {
-			return OwnAnswer{}, fmt.Errorf("%s is not handed out: who was handed it could not be recorded: %w", r.Name, err)
-		}
+		handings = append(handings, Handing{To: caller, Name: r.Name, Generation: r.Generation, Outcome: "handed"})
 		out.Own = append(out.Own, NodeOwnSecret{Module: parts[2], Name: parts[3], Origin: composeOrigin(r.Origin),
 			Generation: r.Generation, Sealed: sealed})
 	}
@@ -215,7 +272,7 @@ func (v *Vault) OwnOfNode(caller string, asked ...CredentialAsked) (OwnAnswer, e
 		return out.Own[i].Name < out.Own[j].Name
 	})
 	for _, c := range asked {
-		if why := v.credentialRefusal(node, c); why != "" {
+		if why := v.credentialRefusal(node, c, plan); why != "" {
 			return OwnAnswer{}, fmt.Errorf("%s may not ask for the credential of %s from %s to %s on %s: %s", caller,
 				c.Provision, c.Provider, c.ConsumerModule, c.Consumer, why)
 		}
@@ -248,9 +305,7 @@ func (v *Vault) OwnOfNode(caller string, asked ...CredentialAsked) (OwnAnswer, e
 			if err != nil {
 				return OwnAnswer{}, err
 			}
-			if err := v.recordHanding(Handing{To: caller, Name: name, Generation: r.Generation, Outcome: "handed"}); err != nil {
-				return OwnAnswer{}, fmt.Errorf("%s is not handed out: who was handed it could not be recorded: %w", name, err)
-			}
+			handings = append(handings, Handing{To: caller, Name: name, Generation: r.Generation, Outcome: "handed"})
 			out.Credentials = append(out.Credentials, NodeCredential{CredentialAsked: c, Name: name, Generation: r.Generation, Sealed: sealed})
 			found = true
 			break
@@ -259,6 +314,10 @@ func (v *Vault) OwnOfNode(caller string, asked ...CredentialAsked) (OwnAnswer, e
 			out.Missing = append(out.Missing, c)
 		}
 	}
+	if err := v.recordHandings(handings); err != nil {
+		return OwnAnswer{}, fmt.Errorf("nothing is handed out to %s: who was handed its %d values could not be recorded: %w",
+			caller, len(handings), err)
+	}
 	v.log("handed %s's node-engine the %d own secrets of its modules and %d credentials (%d not held), sealed to its key",
 		node, len(out.Own), len(out.Credentials), len(out.Missing))
 	return out, nil
@@ -267,12 +326,12 @@ func (v *Vault) OwnOfNode(caller string, asked ...CredentialAsked) (OwnAnswer, e
 // handed says the plan of module on node hands it to the provisioner, so its secrets are filled from `get`, not composed.
 // A plan that cannot be read is an error, never "not handed": `own` refuses rather than hands a secret the provisioner
 // holds.
-func (v *Vault) handed(node, module string) (bool, error) {
-	read, why := v.assignmentReader(node)
+func (p *planReader) handed(module string) (bool, error) {
+	node := p.node
+	raw, why, err := p.read(module)
 	if why != "" {
 		return false, errors.New(why)
 	}
-	raw, err := read(node + "." + module)
 	if err != nil {
 		return false, fmt.Errorf(notYetPrefix+"the assignment %s.%s could not be read, so whether it is handed to the "+
 			"provisioner is not known: %w", node, module, err)

modules/mesh-vault/cmd/mesh-vault/ownnode_test.go

@@ -2,9 +2,12 @@ package main
 
 import (
 	"errors"
+	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 
+	stdio "git.novox.be/novox/mesh-sdk/go"
 	"git.novox.be/novox/mesh-sdk/go/seal"
 )
 
@@ -119,3 +122,117 @@ func TestOwnAnswersAMachineItsModulesSecretsSealedToItsKey(t *testing.T) {
 		t.Errorf("own with no reader of the assignments: %v", err)
 	}
 }
+
+// Issue 1126, 2026-10-28 (seed-9's probe: novox's 57 own secrets and 146 credentials took 26 s, past the node-engine's
+// 15 s): one answer of `own` reads each module's assignment once, and records every hand-out in one synced write.
+func TestOwnReadsEachAssignmentOnceAndSyncsItsRecordOnce(t *testing.T) {
+	plans := assignments{"anchor.web": `{"node":"anchor","module":"web"}`, "anchor.db": `{"node":"anchor","module":"db"}`}
+	reads := map[string]int{}
+	v := newVault(t, nil)
+	v.Askers = Declared{Read: func(key string) ([]byte, error) { reads[key]++; return plans.read(key) }, Store: v.Store}
+	pub, _ := aSealingKey(t)
+	for _, m := range []MoveOf{
+		{Node: "anchor", Module: "web", Name: "password", Origin: "made", Generation: "g-1", SealingKey: pub},
+		{Node: "anchor", Module: "web", Name: "api-key", Origin: "made", Generation: "g-1", SealingKey: pub},
+		{Node: "anchor", Module: "web", Name: "cookie", Origin: "made", Generation: "g-1", SealingKey: pub},
+		{Node: "anchor", Module: "db", Name: "root", Origin: "made", Generation: "g-1", SealingKey: pub},
+		{Provider: "anchor", Provision: "postgres", Consumer: "anchor", ConsumerModule: "web", Origin: "made", Generation: "g-1", SealingKey: pub},
+		{Provider: "anchor", Provision: "redis", Consumer: "anchor", ConsumerModule: "web", Origin: "made", Generation: "g-1", SealingKey: pub},
+	} {
+		if _, err := moveIn(t, v, "node.anchor", m, "v-"+m.Name+m.Provision); err != nil {
+			t.Fatal(err)
+		}
+	}
+	for k := range reads {
+		delete(reads, k)
+	}
+	syncs, handed := v.Store.syncs, len(mustHanded(t, v))
+	got, err := v.OwnOfNode("node.anchor",
+		CredentialAsked{Role: "consumer", Provision: "postgres", Consumer: "anchor", ConsumerModule: "web", Provider: "anchor"},
+		CredentialAsked{Role: "consumer", Provision: "redis", Consumer: "anchor", ConsumerModule: "web", Provider: "anchor"})
+	if err != nil || len(got.Own) != 4 || len(got.Credentials) != 2 {
+		t.Fatalf("anchor was answered %+v, %v", got, err)
+	}
+	for key, n := range reads {
+		if n != 1 {
+			t.Errorf("the assignment %s was read %d times in one answer", key, n)
+		}
+	}
+	if len(reads) != 2 {
+		t.Errorf("the answer read %v, want each of anchor's two modules once", reads)
+	}
+	if n := v.Store.syncs - syncs; n != 1 {
+		t.Errorf("one answer synced the record %d times", n)
+	}
+	if n := len(mustHanded(t, v)) - handed; n != 6 {
+		t.Errorf("one answer recorded %d hand-outs, want 6", n)
+	}
+	// Review round 1, note (b): a consumer module the mirror does not hold yet (its watch behind) is read directly before
+	// the credential is refused.
+	v.Askers = Declared{Read: func(string) ([]byte, error) { return nil, nil }, Confirm: plans.read, Store: v.Store}
+	if got, err := v.OwnOfNode("node.anchor", CredentialAsked{Role: "consumer", Provision: "postgres", Consumer: "anchor",
+		ConsumerModule: "web", Provider: "anchor"}); err != nil || len(got.Credentials) != 1 {
+		t.Errorf("a module the mirror does not hold yet, read directly: %+v, %v", got, err)
+	}
+	v.Askers = Declared{Read: plans.read, Store: v.Store}
+	// A record that cannot be written hands nothing, the batch as one.
+	if err := os.Remove(filepath.Join(v.dir, "store", "handed.jsonl")); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Mkdir(filepath.Join(v.dir, "store", "handed.jsonl"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if a, err := v.OwnOfNode("node.anchor"); err == nil {
+		t.Errorf("handed with no record of it: %+v", a)
+	}
+}
+
+func mustHanded(t *testing.T, v testVault) []Handing {
+	t.Helper()
+	h, err := v.Store.Handed(1000)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return h
+}
+
+// Issue 1126, 2026-10-28: the vault keeps the assignments mirror as its watch hands it over, so `own` and `get` read
+// no assignment over the bus once the watch has caught up; before that a read goes to the bus.
+func TestTheWatchedAssignmentsAnswerWithoutTheBusOnceCaughtUp(t *testing.T) {
+	asked := 0
+	w := &WatchedAssignments{Fallback: func(key string) ([]byte, error) { asked++; return []byte(`{"from":"bus"}`), nil }}
+	if raw, err := w.Read("anchor.web"); err != nil || string(raw) != `{"from":"bus"}` || asked != 1 {
+		t.Errorf("before the watch caught up: %s, %v, %d asks", raw, err, asked)
+	}
+	// A first watch takes two values and fails before it caught up; a late value still arrives on it.
+	first := w.Begin()
+	for _, c := range []stdio.StateChange{
+		{Key: "anchor.web", Op: "put", Value: []byte(`{"node":"anchor","module":"web"}`), Current: true},
+		{Key: "anchor.db", Op: "put", Value: []byte(`{"node":"anchor","module":"db"}`), Current: true},
+	} {
+		if err := first.Take(c); err != nil {
+			t.Fatal(err)
+		}
+	}
+	// Review round 1: the watch begun again holds anchor.db no more (removed meanwhile); what the first took is gone.
+	second := w.Begin()
+	_ = second.Take(stdio.StateChange{Key: "anchor.web", Op: "put", Value: []byte(`{"node":"anchor","module":"web"}`), Current: true})
+	_ = first.Take(stdio.StateChange{Key: "anchor.db", Op: "put", Value: []byte(`{"node":"anchor","module":"db"}`)})
+	first.Caught()
+	if raw, _ := w.Read("anchor.db"); string(raw) != `{"from":"bus"}` {
+		t.Errorf("the failed watch's caught up counted: %s", raw)
+	}
+	second.Caught()
+	_ = first.Take(stdio.StateChange{Key: "anchor.db", Op: "put", Value: []byte(`{"node":"anchor","module":"db"}`)})
+	_ = second.Take(stdio.StateChange{Key: "anchor.web", Op: "put", Value: []byte(`{"node":"anchor","module":"web","v":2}`)})
+	asked = 0
+	for key, want := range map[string]string{"anchor.web": `{"node":"anchor","module":"web","v":2}`, "anchor.db": "", "laptop.x": ""} {
+		raw, err := w.Read(key)
+		if err != nil || string(raw) != want || (want == "") != (raw == nil) {
+			t.Errorf("%s read %q, %v; want %q", key, raw, err, want)
+		}
+	}
+	if asked != 0 {
+		t.Errorf("caught up, the mirror asked the bus %d times", asked)
+	}
+}

modules/mesh-vault/cmd/mesh-vault/store.go

@@ -81,6 +81,8 @@ type Store struct {
 
 	handedMu sync.Mutex
 	rolled   int
+	// syncs counts the record's synced appends since the vault started: how a test proves one sync per answer.
+	syncs int
 	// asksMu serialises the record of asks, so two asks for one secret at once do not both pass its bounds.
 	asksMu sync.Mutex
 }
@@ -173,22 +175,37 @@ type Handing struct {
 // RecordHanding appends one handing to the store's record, synced before it returns. It says whether the
 // record was rolled to make room.
 func (s *Store) RecordHanding(h Handing) (rolled bool, err error) {
-	raw, err := json.Marshal(h)
-	if err != nil {
-		return false, err
+	return s.RecordHandings([]Handing{h})
+}
+
+// RecordHandings appends every handing of one answer to the store's record in one write, synced once before it returns
+// (issue 1126, 2026-10-28: one sync per secret, under the one lock every node's answers share, held `own` past the
+// node-engine's bound). It says whether the record was rolled to make room; nothing is written when one cannot be.
+func (s *Store) RecordHandings(hs []Handing) (rolled bool, err error) {
+	if len(hs) == 0 {
+		return false, nil
+	}
+	var raw []byte
+	for _, h := range hs {
+		line, err := json.Marshal(h)
+		if err != nil {
+			return false, err
+		}
+		raw = append(append(raw, line...), '\n')
 	}
 	s.handedMu.Lock()
 	defer s.handedMu.Unlock()
 	path := filepath.Join(s.dir, "handed.jsonl")
 	max := s.HandedBound()
-	if info, err := os.Stat(path); err == nil && info.Mode().IsRegular() && info.Size()+int64(len(raw))+1 > max {
+	if info, err := os.Stat(path); err == nil && info.Mode().IsRegular() && info.Size()+int64(len(raw)) > max {
 		if err := s.roll(path); err != nil {
 			return false, err
 		}
 		s.rolled++
 		rolled = true
 	}
-	return rolled, appendSynced(path, append(raw, '\n'))
+	s.syncs++
+	return rolled, appendSynced(path, raw)
 }
 
 // roll moves handed.jsonl to .1, .1 to .2 and so on, dropping what falls past HandedKept.
@@ -266,7 +283,10 @@ func (s *Store) HandedBound() int64 {
 }
 
 // List is every record, by name.
-func (s *Store) List() ([]Record, error) {
+func (s *Store) List() ([]Record, error) { return s.ListPrefix("") }
+
+// ListPrefix is every record whose name begins with prefix, by name: only those files are read.
+func (s *Store) ListPrefix(prefix string) ([]Record, error) {
 	entries, err := os.ReadDir(filepath.Join(s.dir, "secrets"))
 	if err != nil {
 		return nil, err
@@ -277,7 +297,7 @@ func (s *Store) List() ([]Record, error) {
 			continue
 		}
 		name, err := url.PathUnescape(strings.TrimSuffix(e.Name(), ".json"))
-		if err != nil {
+		if err != nil || !strings.HasPrefix(name, prefix) {
 			continue
 		}
 		r, ok, err := s.Read(name)

modules/mesh-vault/cmd/mesh-vault/vault.go

@@ -235,11 +235,24 @@ func (v *Vault) announce(c Changed) {
 
 // recordHanding keeps who asked for what, and what they got, in the vault's own store, and says loudly
 // when the record had to be rolled to make room.
-func (v *Vault) recordHanding(h Handing) error {
-	h.At = v.Now().UTC()
-	rolled, err := v.Store.RecordHanding(h)
+func (v *Vault) recordHanding(h Handing) error { return v.recordHandings([]Handing{h}) }
+
+// recordHandings keeps every handing of one answer in one synced write, as recordHanding keeps one.
+func (v *Vault) recordHandings(hs []Handing) error {
+	if len(hs) == 0 {
+		return nil
+	}
+	at := v.Now().UTC()
+	for i := range hs {
+		hs[i].At = at
+	}
+	rolled, err := v.Store.RecordHandings(hs)
 	if err != nil {
-		v.log("the record of %s asking for %s could not be written: %v", h.To, h.Name, err)
+		names := make([]string, len(hs))
+		for i, h := range hs {
+			names[i] = h.Name
+		}
+		v.log("the record of %s asking for %s could not be written: %v", hs[0].To, strings.Join(names, ", "), err)
 		return err
 	}
 	if rolled {

modules/mesh-vault/cmd/mesh-vault/vault_test.go

@@ -167,8 +167,10 @@ func TestNoBucketHoldsASecret(t *testing.T) {
 			code = []byte(strings.Replace(string(code), "stdio.State(BusAccountsState).Put(", "", 1))
 			code = []byte(strings.Replace(string(code), "stdio.State(BusAccountsState).Keys(", "", 1))
 		}
-		// The haves, in main.go alone: one read, one watch and their keys (own_drift), never a write.
+		// The haves, in main.go alone: one read, one watch and their keys (own_drift), never a write; and one watch of
+		// the assignments, which the vault's rules read from memory once it caught up (issue 1126).
 		if f == "main.go" {
+			code = []byte(strings.Replace(string(code), "stdio.State(AssignmentsRead).Watch(", "", 1))
 			code = []byte(strings.Replace(string(code), "stdio.State(HaveRead).Get(", "", 1))
 			code = []byte(strings.Replace(string(code), "stdio.State(HaveRead).Watch(", "", 1))
 			code = []byte(strings.Replace(string(code), "stdio.State(HaveRead).Keys(", "", 1))