CAT-D4b: the program, as distribution's account, discards the bootstrap's credential when the tools close its window

The tools bundle runs in the tool runner's account and cannot remove a file in
distribution's 0700 state directory, so its first answered publish closes the
window bootstrap-push in the state windows and the program removes the file
(design 51 On a fresh mesh).

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig

modules/distribution/cmd/distribution-tools/main.go

@@ -104,12 +104,26 @@ func finding(kind, subject, words string, raised bool) {
 	}
 }
 
-// removeBootstrap discards the bootstrap's one-off credential once a publish is answered (design 51 *On a fresh mesh*).
-var removeBootstrap = sync.OnceFunc(func() {
-	if err := os.Remove(holder.BootstrapFile); err == nil {
-		logf("the bootstrap's one-off credential is discarded: the holders serve publish")
-	}
-})
+// closeBootstrap asks the program to discard the bootstrap's one-off credential once a publish is answered (design 51
+// *On a fresh mesh*): the window bootstrap-push closed in the state windows, which the program follows and then removes
+// the file. The tools bundle runs in the tool runner's account, which cannot remove a file in distribution's state
+// directory. Once per process; the window's record says it to the next.
+var closeBootstrap func()
+
+func bootstrapCloser(windows kept[holder.Window]) func() {
+	return sync.OnceFunc(func() {
+		cur, _, err := windows.Get(holder.BootstrapWindow)
+		if err == nil && !cur.Closed.IsZero() {
+			return
+		}
+		w := holder.Window{Name: holder.BootstrapWindow, Closed: time.Now().UTC()}
+		if err := windows.Put(w); err != nil {
+			logf("the bootstrap's one-off credential could not be asked away: %v", err)
+			return
+		}
+		logf("the bootstrap's one-off credential is asked away: the holders serve publish")
+	})
+}
 
 func arg[T any](args map[string]any) (T, error) {
 	var v T
@@ -142,8 +156,8 @@ func tools(v *holder.Verbs, windows kept[holder.Window]) []stdio.Tool {
 					}
 					_, _ = v.DropIdle()
 					a, err := v.Publish(seat, stdio.CallerOf(args), r)
-					if err == nil {
-						removeBootstrap()
+					if err == nil && closeBootstrap != nil {
+						closeBootstrap()
 					}
 					return a, err
 				}},
@@ -254,8 +268,12 @@ func tools(v *holder.Verbs, windows kept[holder.Window]) []stdio.Tool {
 						return nil, err
 					}
 				}
-				_, bootstrap := os.Stat(holder.BootstrapFile)
-				return map[string]any{"window": cur, "bootstrap_credential_present": bootstrap == nil}, nil
+				b, _, err := windows.Get(holder.BootstrapWindow)
+				if err != nil {
+					return nil, err
+				}
+				// The program removes the file when this window closes and writes it closed again with its removal's time.
+				return map[string]any{"window": cur, "bootstrap_credential_discarded": !b.Closed.IsZero(), "bootstrap": b}, nil
 			}})
 	}
 	return out
@@ -273,6 +291,7 @@ func main() {
 		Transfers: kept[holder.Transfer]{state: holder.TransfersState, key: func(t holder.Transfer) string { return t.Transfer }}}
 	v := &holder.Verbs{Holder: h, Catalog: store, Holds: kept[holder.Hold]{state: "holds", key: holder.Hold.Key}}
 	windows := kept[holder.Window]{state: "windows", key: func(w holder.Window) string { return w.Name }}
+	closeBootstrap = bootstrapCloser(windows)
 	if err := stdio.Serve("", tools(v, windows)); err != nil {
 		logf("%v", err)
 		os.Exit(1)

modules/distribution/cmd/distribution/main.go

@@ -10,6 +10,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"io/fs"
 	"log"
 	"net/http"
 	"net/url"
@@ -57,6 +58,7 @@ func run(ctx context.Context, getenv func(string) string) error {
 	windows := process.OptionalBucket(ctx, js, "distribution_windows", "the direct-write window is read as open until the program starts again", logger.Printf)
 	if windows != nil {
 		go follow(ctx, windows, &open, logger)
+		go followBootstrap(ctx, windows, logger)
 	}
 	front := &holder.Front{Store: store, Window: &open, Logf: logger.Printf,
 		Published: func(name, tag string) (bool, error) {
@@ -109,6 +111,42 @@ func follow(ctx context.Context, kv jetstream.KeyValue, open *atomic.Bool, logge
 	}
 }
 
+// followBootstrap removes the bootstrap's one-off credential (holder.BootstrapFile) when the tools bundle closes the
+// window bootstrap-push at its first answered publish (design 51 *On a fresh mesh*): the program runs as distribution's
+// account, which owns the file. A file already gone is no fault; one that cannot be removed is said each time the
+// window is written.
+func followBootstrap(ctx context.Context, kv jetstream.KeyValue, logger *log.Logger) {
+	w, err := kv.Watch(ctx, holder.BootstrapWindow)
+	if err != nil {
+		logger.Printf("the bootstrap's credential window cannot be watched (%v): its file stays until the program starts again", err)
+		return
+	}
+	for e := range w.Updates() {
+		if e == nil || e.Operation() != jetstream.KeyValuePut {
+			continue
+		}
+		var win holder.Window
+		if json.Unmarshal(e.Value(), &win) != nil || win.Closed.IsZero() {
+			continue
+		}
+		if why := removeBootstrap(holder.BootstrapFile); why != "" {
+			logger.Printf("%s", why)
+		}
+	}
+}
+
+// removeBootstrap removes the credential's file; it answers what went wrong, or "" when the file is gone.
+func removeBootstrap(path string) string {
+	switch err := os.Remove(path); {
+	case err == nil:
+		return "the bootstrap's one-off credential is discarded: the holders serve publish"
+	case errors.Is(err, fs.ErrNotExist):
+		return ""
+	default:
+		return fmt.Sprintf("the bootstrap's one-off credential could not be discarded, so it is still accepted: %v", err)
+	}
+}
+
 func or(v, d string) string {
 	if strings.TrimSpace(v) == "" {
 		return d

modules/distribution/cmd/distribution/main_test.go

@@ -0,0 +1,35 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// The program, which runs as distribution's account, removes the bootstrap's one-off credential when its window
+// closes (design 51 *On a fresh mesh*; a3-publish-contract): removed once, a file already gone is no fault, and one
+// that cannot be removed is said, since the front still accepts it.
+func TestTheProgramDiscardsTheBootstrapCredential(t *testing.T) {
+	dir := t.TempDir()
+	file := filepath.Join(dir, "bootstrap-push")
+	if err := os.WriteFile(file, []byte("token\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if why := removeBootstrap(file); !strings.Contains(why, "discarded") {
+		t.Fatalf("first removal = %q, want it said discarded", why)
+	}
+	if _, err := os.Stat(file); !os.IsNotExist(err) {
+		t.Fatalf("the file is still there: %v", err)
+	}
+	if why := removeBootstrap(file); why != "" {
+		t.Fatalf("a file already gone = %q, want nothing said", why)
+	}
+	stuck := filepath.Join(dir, "stuck")
+	if err := os.MkdirAll(filepath.Join(stuck, "child"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if why := removeBootstrap(stuck); !strings.Contains(why, "still accepted") {
+		t.Fatalf("an unremovable file = %q, want it said still accepted", why)
+	}
+}

modules/distribution/internal/holder/window.go

@@ -16,6 +16,10 @@ import (
 const (
 	OldNameWindow      = "old-name"
 	DirectWritesWindow = "direct-writes"
+	// BootstrapWindow is the bootstrap's one-off credential (BootstrapFile): open while the file is there. The tools
+	// bundle closes it at its first answered publish; the program, which runs as distribution's account and alone may
+	// remove the file in distribution's state directory, removes it on that close.
+	BootstrapWindow = "bootstrap-push"
 	// WindowFindingAfter is how long a node holds a window open before it is distribution's finding naming the node.
 	WindowFindingAfter = 7 * 24 * time.Hour
 	// The events a window's close says on distribution's own family distribution.events (7 days, 16 MiB, drop