CAT-D4b: the program, as distribution's account, discards the bootstrap's credential when the tools close its window

The tools bundle runs in the tool runner's account and cannot remove a file in
distribution's 0700 state directory, so its first answered publish closes the
window bootstrap-push in the state windows and the program removes the file
(design 51 On a fresh mesh).

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig

modules/distribution/cmd/distribution-tools/main.go

@@ -104,12 +104,26 @@ func finding(kind, subject, words string, raised bool) {
 	}
 }
 
-// removeBootstrap discards the bootstrap's one-off credential once a publish is answered (design 51 *On a fresh mesh*).
-var removeBootstrap = sync.OnceFunc(func() {
-	if err := os.Remove(holder.BootstrapFile); err == nil {
-		logf("the bootstrap's one-off credential is discarded: the holders serve publish")
-	}
-})
+// closeBootstrap asks the program to discard the bootstrap's one-off credential once a publish is answered (design 51
+// *On a fresh mesh*): the window bootstrap-push closed in the state windows, which the program follows and then removes
+// the file. The tools bundle runs in the tool runner's account, which cannot remove a file in distribution's state
+// directory. Once per process; the window's record says it to the next.
+var closeBootstrap func()
+
+func bootstrapCloser(windows kept[holder.Window]) func() {
+	return sync.OnceFunc(func() {
+		cur, _, err := windows.Get(holder.BootstrapWindow)
+		if err == nil && !cur.Closed.IsZero() {
+			return
+		}
+		w := holder.Window{Name: holder.BootstrapWindow, Closed: time.Now().UTC()}
+		if err := windows.Put(w); err != nil {
+			logf("the bootstrap's one-off credential could not be asked away: %v", err)
+			return
+		}
+		logf("the bootstrap's one-off credential is asked away: the holders serve publish")
+	})
+}
 
 func arg[T any](args map[string]any) (T, error) {
 	var v T
@@ -142,8 +156,8 @@ func tools(v *holder.Verbs, windows kept[holder.Window]) []stdio.Tool {
 					}
 					_, _ = v.DropIdle()
 					a, err := v.Publish(seat, stdio.CallerOf(args), r)
-					if err == nil {
-						removeBootstrap()
+					if err == nil && closeBootstrap != nil {
+						closeBootstrap()
 					}
 					return a, err
 				}},
@@ -254,8 +268,12 @@ func tools(v *holder.Verbs, windows kept[holder.Window]) []stdio.Tool {
 						return nil, err
 					}
 				}
-				_, bootstrap := os.Stat(holder.BootstrapFile)
-				return map[string]any{"window": cur, "bootstrap_credential_present": bootstrap == nil}, nil
+				b, _, err := windows.Get(holder.BootstrapWindow)
+				if err != nil {
+					return nil, err
+				}
+				// The program removes the file when this window closes and writes it closed again with its removal's time.
+				return map[string]any{"window": cur, "bootstrap_credential_discarded": !b.Closed.IsZero(), "bootstrap": b}, nil
 			}})
 	}
 	return out
@@ -273,6 +291,7 @@ func main() {
 		Transfers: kept[holder.Transfer]{state: holder.TransfersState, key: func(t holder.Transfer) string { return t.Transfer }}}
 	v := &holder.Verbs{Holder: h, Catalog: store, Holds: kept[holder.Hold]{state: "holds", key: holder.Hold.Key}}
 	windows := kept[holder.Window]{state: "windows", key: func(w holder.Window) string { return w.Name }}
+	closeBootstrap = bootstrapCloser(windows)
 	if err := stdio.Serve("", tools(v, windows)); err != nil {
 		logf("%v", err)
 		os.Exit(1)