CAT-D4b: the program, as distribution's account, discards the bootstrap's credential when the tools close its window

The tools bundle runs in the tool runner's account and cannot remove a file in
distribution's 0700 state directory, so its first answered publish closes the
window bootstrap-push in the state windows and the program removes the file
(design 51 On a fresh mesh).

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig

modules/distribution/cmd/distribution/main.go

@@ -10,6 +10,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"io/fs"
 	"log"
 	"net/http"
 	"net/url"
@@ -57,6 +58,7 @@ func run(ctx context.Context, getenv func(string) string) error {
 	windows := process.OptionalBucket(ctx, js, "distribution_windows", "the direct-write window is read as open until the program starts again", logger.Printf)
 	if windows != nil {
 		go follow(ctx, windows, &open, logger)
+		go followBootstrap(ctx, windows, logger)
 	}
 	front := &holder.Front{Store: store, Window: &open, Logf: logger.Printf,
 		Published: func(name, tag string) (bool, error) {
@@ -109,6 +111,42 @@ func follow(ctx context.Context, kv jetstream.KeyValue, open *atomic.Bool, logge
 	}
 }
 
+// followBootstrap removes the bootstrap's one-off credential (holder.BootstrapFile) when the tools bundle closes the
+// window bootstrap-push at its first answered publish (design 51 *On a fresh mesh*): the program runs as distribution's
+// account, which owns the file. A file already gone is no fault; one that cannot be removed is said each time the
+// window is written.
+func followBootstrap(ctx context.Context, kv jetstream.KeyValue, logger *log.Logger) {
+	w, err := kv.Watch(ctx, holder.BootstrapWindow)
+	if err != nil {
+		logger.Printf("the bootstrap's credential window cannot be watched (%v): its file stays until the program starts again", err)
+		return
+	}
+	for e := range w.Updates() {
+		if e == nil || e.Operation() != jetstream.KeyValuePut {
+			continue
+		}
+		var win holder.Window
+		if json.Unmarshal(e.Value(), &win) != nil || win.Closed.IsZero() {
+			continue
+		}
+		if why := removeBootstrap(holder.BootstrapFile); why != "" {
+			logger.Printf("%s", why)
+		}
+	}
+}
+
+// removeBootstrap removes the credential's file; it answers what went wrong, or "" when the file is gone.
+func removeBootstrap(path string) string {
+	switch err := os.Remove(path); {
+	case err == nil:
+		return "the bootstrap's one-off credential is discarded: the holders serve publish"
+	case errors.Is(err, fs.ErrNotExist):
+		return ""
+	default:
+		return fmt.Sprintf("the bootstrap's one-off credential could not be discarded, so it is still accepted: %v", err)
+	}
+}
+
 func or(v, d string) string {
 	if strings.TrimSpace(v) == "" {
 		return d

modules/distribution/cmd/distribution/main_test.go

@@ -0,0 +1,35 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// The program, which runs as distribution's account, removes the bootstrap's one-off credential when its window
+// closes (design 51 *On a fresh mesh*; a3-publish-contract): removed once, a file already gone is no fault, and one
+// that cannot be removed is said, since the front still accepts it.
+func TestTheProgramDiscardsTheBootstrapCredential(t *testing.T) {
+	dir := t.TempDir()
+	file := filepath.Join(dir, "bootstrap-push")
+	if err := os.WriteFile(file, []byte("token\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if why := removeBootstrap(file); !strings.Contains(why, "discarded") {
+		t.Fatalf("first removal = %q, want it said discarded", why)
+	}
+	if _, err := os.Stat(file); !os.IsNotExist(err) {
+		t.Fatalf("the file is still there: %v", err)
+	}
+	if why := removeBootstrap(file); why != "" {
+		t.Fatalf("a file already gone = %q, want nothing said", why)
+	}
+	stuck := filepath.Join(dir, "stuck")
+	if err := os.MkdirAll(filepath.Join(stuck, "child"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if why := removeBootstrap(stuck); !strings.Contains(why, "still accepted") {
+		t.Fatalf("an unremovable file = %q, want it said still accepted", why)
+	}
+}