Merge origin/main into feat/r4d-n8n

.gitignore

@@ -14,7 +14,6 @@ modules/claude-code/claude-code
 modules/mesh-watcher/mesh-watcher
 modules/dnsmasq/dnsmasq
 modules/mesh-issues/cmd/mesh-issues/mesh-issues
-modules/mesh-issues/mesh-issues
 modules/mounts/cmd/mounts/mounts
 modules/mesh-knowledge/cmd/mesh-knowledge/mesh-knowledge
 modules/mesh-knowledge/mesh-knowledge
@@ -28,16 +27,3 @@ modules/mesh-provisioner-client/cmd/mesh-provisioner-client/mesh-provisioner-cli
 modules/brother/cmd/brother/brother
 modules/mesh-build-go/cmd/mesh-build-go/mesh-build-go
 modules/mesh-config/mesh-config
-modules/mesh-build-image/cmd/mesh-build-image/mesh-build-image
-*.test
-
-# binaries a local go build leaves in a module root
-/checks/paths/paths
-/modules/mesh-build-go/mesh-build-go
-/modules/mesh-delivery-gate/mesh-delivery-gate
-modules/mesh-config/cmd/mesh-config/mesh-config
-
-# Built by their modules' build step (issue 1577), never committed.
-modules/forticlient/cmd/forticlient-tools/forticlient-tools
-modules/networkmanager/uplink-tools
-checks/words/words

checks/agenthome/reads-outside

@@ -1,5 +0,0 @@
-# What these tests read outside their package, as paths from the repository's root (a glob, or a directory read whole;
-# ? before a path whose absence is read). mesh-build-go hashes them into the package's digest, so its verdict is kept
-# until one of them changes (issue 1936). An empty list, or a line matching nothing, keeps nothing.
-# Check("../.."): every manifest.
-modules/*/module.json

checks/config/go.mod

@@ -1,7 +1,3 @@
 module git.novox.be/novox/mesh-catalog/checks/config
 
 go 1.22
-
-require git.novox.be/novox/mesh-catalog/checks/trunk v0.0.0
-
-replace git.novox.be/novox/mesh-catalog/checks/trunk => ../trunk

checks/config/main.go

@@ -110,7 +110,7 @@ func Check(root string) (map[string][]string, error) {
 // The modules taking a whole layer were found after the list was first written and before the trunk held a copy
 // (issue 735), so they stand in it too.
 var seed = map[string]bool{
-	"fail2ban": true, "influxdb": true, "keycloak": true, "mailu": true, "searxng": true,
+	"betterbird": true, "fail2ban": true, "influxdb": true, "keycloak": true, "mailu": true, "searxng": true,
 	"baserow": true, "confluence": true, "gitea": true, "gitlab": true, "grafana": true, "home-assistant": true,
 	"icecast": true, "jira": true, "letta": true, "matrix": true, "nodered": true, "supabase": true, "unifi": true,
 }

checks/config/reads-outside

@@ -1,5 +0,0 @@
-# What these tests read outside their package, as paths from the repository's root (a glob, or a directory read whole;
-# ? before a path whose absence is read). mesh-build-go hashes them into the package's digest, so its verdict is kept
-# until one of them changes (issue 1936). An empty list, or a line matching nothing, keeps nothing.
-# Check("../.."): every manifest and the files it names.
-modules

checks/config/realtree_test.go

@@ -1,33 +0,0 @@
-package main
-
-import (
-	"path/filepath"
-	"testing"
-
-	"git.novox.be/novox/mesh-catalog/checks/trunk"
-)
-
-// The script's comparison of this list with the trunk's (novox/hq ADR 0529 clause 2): the list of modules not yet moved gains none
-// the trunk's copy at the merge base does not hold. The catalogue itself is judged against the list by
-// TestTheCatalogueSaysConfigInEveryMovedModule. Skipped, and said, where no trunk is beside.
-func TestTheUnmovedListHoldsNoModuleTheTrunksDoesNot(t *testing.T) {
-	path, ok := trunk.Copy(t, "checks/config/unmoved")
-	found, err := Check(filepath.Join("..", ".."))
-	if err != nil {
-		t.Fatal(err)
-	}
-	unmoved, err := Unmoved("unmoved")
-	if err != nil {
-		t.Fatal(err)
-	}
-	base := seed
-	if ok {
-		if base, err = Unmoved(path); err != nil {
-			t.Fatal(err)
-		}
-	}
-	_, _, added := Judge(found, unmoved, base)
-	for _, m := range added {
-		t.Errorf("checks/config/unmoved gains %s, which the trunk's copy does not hold: the list only shrinks", m)
-	}
-}

checks/credentialform/go.mod

@@ -1,5 +0,0 @@
-module checks/credentialform
-
-go 1.26.0
-
-require git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030001116-2da0de75c3f0

checks/credentialform/go.sum

@@ -1,2 +0,0 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030001116-2da0de75c3f0 h1:lKU3HjNXGiVbLW2hUgFjU/TMTUYMlNnnmZxG5T7biQA=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030001116-2da0de75c3f0/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=

checks/credentialform/main.go

@@ -1,96 +0,0 @@
-// Package credentialform refuses an offer that does not say the form of its credential: an own secret, an issuer, or
-// `form` pair or none (the lead, 2026-10-29). It reads every modules/*/module.json through mesh-sdk's
-// CredentialFormProblems.
-//
-// It refuses a route received as a file too (issue 774, research 072 row 34, the operator on 2026-10-31: "there is only
-// 1 path, the other is simply deprecated/invalid"): a route is a provision, served from the seat mesh-provisioner's
-// plans alone, and a manifest's `receives.route` is the deprecated path. A module still moving off it is listed in
-// stillReceivingRoutes with why; every refusal names them all, and a listed module that no longer receives one is
-// refused too, so the list only shrinks.
-package credentialform
-
-import (
-	"encoding/json"
-	"fmt"
-	"os"
-	"path/filepath"
-	"sort"
-	"strings"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-)
-
-// Problems is every offer of the manifests under root/modules that says no credential form, one line each.
-func Problems(root string) ([]string, error) {
-	files, err := filepath.Glob(filepath.Join(root, "modules", "*", "module.json"))
-	if err != nil {
-		return nil, err
-	}
-	sort.Strings(files)
-	var out []string
-	var receiving []string
-	reads := map[string]bool{}
-	var binders []string
-	for _, f := range files {
-		raw, err := os.ReadFile(f)
-		if err != nil {
-			return nil, err
-		}
-		var m catalogue.Manifest
-		if err := json.Unmarshal(raw, &m); err != nil {
-			return nil, fmt.Errorf("%s: %w", f, err)
-		}
-		out = append(out, catalogue.CredentialFormProblems(m)...)
-		if _, received := m.Receives["route"]; received {
-			receiving = append(receiving, m.Module)
-		} else if _, listed := stillReceivingRoutes[m.Module]; listed {
-			out = append(out, fmt.Sprintf("%s no longer receives route; take it off stillReceivingRoutes", m.Module))
-		}
-		var kept struct {
-			Reads []string          `json:"reads"`
-			State []json.RawMessage `json:"state"`
-		}
-		_ = json.Unmarshal(raw, &kept) // reads may hold objects in another module; only the provisioner's are read
-		if m.Module == "mesh-provisioner" {
-			for _, r := range kept.Reads {
-				reads[r] = true
-			}
-		}
-		if len(m.Provides) > 0 && keepsBound(kept.State) {
-			binders = append(binders, m.Module)
-		}
-	}
-	for _, module := range binders {
-		if !reads[module+".bound"] {
-			out = append(out, fmt.Sprintf("%s provides and keeps a `bound` state, and mesh-provisioner's manifest does not read %s.bound", module, module))
-		}
-	}
-	for _, module := range receiving {
-		if _, listed := stillReceivingRoutes[module]; !listed {
-			out = append(out, fmt.Sprintf("%s receives route as a file: a route is a provision, served from the seat "+
-				"mesh-provisioner's plans alone (issue 774); still on the deprecated path: %s", module,
-				strings.Join(receiving, ", ")))
-		}
-	}
-	return out, nil
-}
-
-// stillReceivingRoutes is every module still receiving its routes as a file, and why it has not moved yet.
-var stillReceivingRoutes = map[string]string{
-	"route-adapter": "migration scaffolding writing into a predecessor's proxy (novox/hq ADR 0104), deleted when that " +
-		"migration ends; it reads the received file its TypeScript adapter turns into the predecessor's route files",
-}
-
-// keepsBound says whether a manifest's `state` names `bound`, as a plain name or an object with a name.
-func keepsBound(state []json.RawMessage) bool {
-	for _, s := range state {
-		var name string
-		var obj struct {
-			Name string `json:"name"`
-		}
-		if json.Unmarshal(s, &name) == nil && name == "bound" || json.Unmarshal(s, &obj) == nil && obj.Name == "bound" {
-			return true
-		}
-	}
-	return false
-}

checks/credentialform/main_test.go

@@ -1,54 +0,0 @@
-package credentialform
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-func aCatalogue(t *testing.T, manifests map[string]string) string {
-	t.Helper()
-	root := t.TempDir()
-	for module, body := range manifests {
-		dir := filepath.Join(root, "modules", module)
-		if err := os.MkdirAll(dir, 0o755); err != nil {
-			t.Fatal(err)
-		}
-		if err := os.WriteFile(filepath.Join(dir, "module.json"), []byte(body), 0o644); err != nil {
-			t.Fatal(err)
-		}
-	}
-	return root
-}
-
-// An offer that says no form is refused and named; one that says pair, none or an own secret passes; a route received
-// as a file is refused but for the module still moving off it; and the real catalogue is clean.
-func TestEveryOfferSaysTheFormOfItsCredential(t *testing.T) {
-	root := aCatalogue(t, map[string]string{
-		"silent":           `{"module":"silent","provides":[{"name":"thing","scope":"mesh"}]}`,
-		"binder":           `{"module":"binder","provides":[{"name":"d","credential":{"form":"pair"}}],"state":["bound"]}`,
-		"mesh-provisioner": `{"module":"mesh-provisioner","reads":["other.bound"]}`,
-		"says":             `{"module":"says","provides":[{"name":"a","credential":{"form":"pair"}},{"name":"b","credential":{"form":"none"}},{"name":"c","credential":{"own":"jwt"}}]}`,
-		// A route received as a file (issue 774, research 072 row 34): refused, naming every module still on it; the one
-		// listed as still moving passes.
-		"old-proxy":     `{"module":"old-proxy","receives":{"route":"/var/lib/old-proxy/mesh.json"}}`,
-		"route-adapter": `{"module":"route-adapter","receives":{"route":"/var/lib/route-adapter/mesh.json"}}`,
-	})
-	got, err := Problems(root)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(got) != 3 || !strings.Contains(got[0], `silent provides "thing"`) ||
-		!strings.Contains(got[1], "binder") || !strings.Contains(got[1], "mesh-provisioner") ||
-		!strings.HasPrefix(got[2], "old-proxy receives route") || !strings.Contains(got[2], "old-proxy, route-adapter") {
-		t.Fatalf("refused %v, wanted the silent offer, the binder the provisioner does not read and the received route", got)
-	}
-	real, err := Problems(filepath.Join("..", ".."))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(real) != 0 {
-		t.Fatalf("the catalogue has offers with no credential form:\n%s", strings.Join(real, "\n"))
-	}
-}

checks/credentialform/reads-outside

@@ -1,3 +0,0 @@
-# What these tests read outside their package, as paths from the repository's root (issue 1936).
-# every manifest, for what each offer says of its credential's form.
-modules/*/module.json

checks/failurekit/failurekit.go

@@ -1,128 +0,0 @@
-// Package failurekit refuses a build module whose tests do not run mesh-sdk's conformance kit (issue 1901, its thorough
-// fix): a module that claims a node-build-* seat and serves a test step must hold a test that calls conformance.Run, so
-// its parse of the test runner's output is held to the failure contract (a failing test named with its cause, never a
-// passing line in its place). A build module with no test step (mesh-build-image builds images and runs no tests) is
-// exempt from that, and said so. Every build module, test step or not, must also hold a test that calls
-// conformance.LeftRunning with its own start sweep, so a step a previous process left running is ended at its start
-// (issue 1890).
-package failurekit
-
-import (
-	"encoding/json"
-	"fmt"
-	"io/fs"
-	"os"
-	"path/filepath"
-	"sort"
-	"strings"
-)
-
-// Judged is what the check says of one build module: Refused says why it fails the check, "" when it passes; Exempt
-// says why the kit does not apply.
-type Judged struct {
-	Module, Refused, Exempt string
-}
-
-type manifest struct {
-	Claims []struct {
-		Name string `json:"name"`
-	} `json:"claims"`
-	Tools []json.RawMessage `json:"tools"`
-}
-
-// Judge reads every modules/<m>/module.json of the catalogue at root and judges each module that claims a node-build-*
-// seat.
-func Judge(root string) ([]Judged, error) {
-	manifests, err := filepath.Glob(filepath.Join(root, "modules", "*", "module.json"))
-	if err != nil {
-		return nil, err
-	}
-	sort.Strings(manifests)
-	var out []Judged
-	for _, p := range manifests {
-		raw, err := os.ReadFile(p)
-		if err != nil {
-			return nil, err
-		}
-		var m manifest
-		if err := json.Unmarshal(raw, &m); err != nil {
-			return nil, fmt.Errorf("%s: %w", p, err)
-		}
-		seat := ""
-		for _, c := range m.Claims {
-			if strings.HasPrefix(c.Name, "node-build-") {
-				seat = c.Name
-			}
-		}
-		if seat == "" {
-			continue
-		}
-		dir := filepath.Dir(p)
-		j := Judged{Module: filepath.Base(dir)}
-		var refused []string
-		test := testTool(m.Tools)
-		switch {
-		case test == "":
-			j.Exempt = fmt.Sprintf("it claims %s and serves no test step, so the failure contract's cases do not apply", seat)
-		default:
-			runs, err := runsTheKit(dir, "conformance.Run(")
-			if err != nil {
-				return nil, err
-			}
-			if !runs {
-				refused = append(refused, fmt.Sprintf("it claims %s and serves the test step %s, and no test of it calls conformance.Run "+
-					"(mesh-sdk go/buildstep/conformance): run the kit with the module's own parse path (issue 1901)", seat, test))
-			}
-		}
-		// Every build module keeps steps, so every one runs the left-running case, test step or not (issue 1890).
-		sweeps, err := runsTheKit(dir, "conformance.LeftRunning(")
-		if err != nil {
-			return nil, err
-		}
-		if !sweeps {
-			refused = append(refused, fmt.Sprintf("it claims %s, and no test of it calls conformance.LeftRunning "+
-				"(mesh-sdk go/buildstep/conformance): run the kit's left-running case with the module's own start sweep (issue 1890)", seat))
-		}
-		j.Refused = strings.Join(refused, "; ")
-		out = append(out, j)
-	}
-	return out, nil
-}
-
-// testTool is the name of the module's test step tool (<prefix>_test), or "".
-func testTool(tools []json.RawMessage) string {
-	for _, raw := range tools {
-		var name string
-		if json.Unmarshal(raw, &name) != nil {
-			var t struct {
-				Name string `json:"name"`
-			}
-			if json.Unmarshal(raw, &t) != nil {
-				continue
-			}
-			name = t.Name
-		}
-		if strings.HasSuffix(name, "_test") {
-			return name
-		}
-	}
-	return ""
-}
-
-// runsTheKit says a _test.go file under dir calls the kit's function call (such as "conformance.Run(").
-func runsTheKit(dir, call string) (bool, error) {
-	found := false
-	err := filepath.WalkDir(dir, func(p string, d fs.DirEntry, err error) error {
-		if err != nil || found || d.IsDir() || !strings.HasSuffix(p, "_test.go") {
-			return err
-		}
-		raw, err := os.ReadFile(p)
-		if err != nil {
-			return err
-		}
-		found = strings.Contains(string(raw), call) &&
-			strings.Contains(string(raw), `"git.novox.be/novox/mesh-sdk/go/buildstep/conformance"`)
-		return nil
-	})
-	return found, err
-}

checks/failurekit/failurekit_test.go

@@ -1,77 +0,0 @@
-package failurekit
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-// 1901/AC7 and 1890/AC8: a build module with a test step and no kit is refused, one that runs the kit passes, one with no
-// test step is exempt from the failure cases but not from the left-running case, a module that runs only the failure
-// cases is refused, and a module that claims no node-build-* seat is not judged.
-func TestABuildModuleWithATestStepMustRunTheKit(t *testing.T) {
-	root := t.TempDir()
-	const imp = "package main\n\nimport \"git.novox.be/novox/mesh-sdk/go/buildstep/conformance\"\n\n"
-	const sweep = "func TestSweep(t *testing.T) { conformance.LeftRunning(t, nil) }\n"
-	kit := imp + "func TestKit(t *testing.T) { conformance.Run(t, conformance.GoTest, nil) }\n" + sweep
-	for path, body := range map[string]string{
-		"modules/a/module.json":         `{"claims":[{"name":"node-build-a"}],"tools":["build_a_fetch","build_a_test"]}`,
-		"modules/a/cmd/a/check_test.go": "package main\n",
-		"modules/b/module.json":         `{"claims":[{"name":"node-build-b"}],"tools":[{"name":"build_b_test"}]}`,
-		"modules/b/cmd/b/kit_test.go":   kit,
-		"modules/c/module.json":         `{"claims":[{"name":"node-build-c"}],"tools":["build_c_build"]}`,
-		"modules/c/cmd/c/kit_test.go":   imp + sweep,
-		"modules/f/module.json":         `{"claims":[{"name":"node-build-f"}],"tools":["build_f_build"]}`,
-		"modules/g/module.json":         `{"claims":[{"name":"node-build-g"}],"tools":["build_g_test"]}`,
-		"modules/g/cmd/g/kit_test.go":   imp + "func TestKit(t *testing.T) { conformance.Run(t, conformance.GoTest, nil) }\n",
-		"modules/d/module.json":         `{"claims":[{"name":"other"}],"tools":["d_test"]}`,
-		"modules/e/module.json":         `{"claims":[{"name":"node-build-e"}],"tools":["build_e_test"]}`,
-		"modules/e/cmd/e/kit.go":        kit, // not a test file
-	} {
-		p := filepath.Join(root, path)
-		if err := os.MkdirAll(filepath.Dir(p), 0o755); err != nil {
-			t.Fatal(err)
-		}
-		if err := os.WriteFile(p, []byte(body), 0o644); err != nil {
-			t.Fatal(err)
-		}
-	}
-	got, err := Judge(root)
-	if err != nil {
-		t.Fatal(err)
-	}
-	want := map[string]string{"a": "refused", "b": "passes", "c": "exempt", "e": "refused", "f": "refused", "g": "refused"}
-	if len(got) != len(want) {
-		t.Fatalf("judged %+v, want a, b, c, e, f and g", got)
-	}
-	for _, j := range got {
-		is := "passes"
-		if j.Refused != "" {
-			is = "refused"
-		} else if j.Exempt != "" {
-			is = "exempt"
-		}
-		if is != want[j.Module] {
-			t.Errorf("%s %s (%+v), want it %s", j.Module, is, j, want[j.Module])
-		}
-	}
-}
-
-// Every build module of this catalogue with a test step runs the kit.
-func TestTheCataloguesBuildModulesRunTheKit(t *testing.T) {
-	got, err := Judge(filepath.Join("..", ".."))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(got) == 0 {
-		t.Fatal("no module claims a node-build-* seat: the check reads the wrong tree")
-	}
-	for _, j := range got {
-		switch {
-		case j.Refused != "":
-			t.Errorf("%s: %s", j.Module, j.Refused)
-		case j.Exempt != "":
-			t.Logf("%s is exempt: %s", j.Module, j.Exempt)
-		}
-	}
-}

checks/failurekit/go.mod

@@ -1,3 +0,0 @@
-module git.novox.be/novox/mesh-catalog/checks/failurekit
-
-go 1.22

checks/failurekit/reads-outside

@@ -1,7 +0,0 @@
-# What these tests read outside their package, as paths from the repository's root (a glob, or a directory read whole;
-# ? before a path whose absence is read). mesh-build-go hashes them into the package's digest, so its verdict is kept
-# until one of them changes (issue 1936). An empty list, or a line matching nothing, keeps nothing.
-# Judge("../.."): every manifest, and the directory of each module claiming a node-build-* seat, walked for a test that
-# calls the kit. The build modules are the mesh-build-* directories; a build module named otherwise needs its line here.
-modules/*/module.json
-modules/mesh-build-*

checks/handacts/fallbacks

@@ -1,8 +0,0 @@
-# The calls of the controller's hand-act log a manifest of this catalogue may still invoke, each `<module> <verb> <why>`:
-# the fallback of a recorder (mesh-sdk handacts.Recorder) while the seat mesh-hand-acts has no holder that answers, until
-# the controller's lease is written to a holder that is no controller. The check of this directory (handacts) refuses any
-# other, and an entry whose module no longer invokes it: the list only shrinks, and it is empty before the lease write
-# (novox/hq ADR 0565 §11; issue 1953, issue 774).
-mesh-config   hand-act   fallback until the lease write: its sets, clears and held values record through mesh-hand-acts first
-mesh-config   warranted  fallback until the lease write: its warrants record through mesh-hand-acts first
-mesh-healers  drill      fallback until the lease write: a drill records through mesh-hand-acts first

checks/handacts/go.mod

@@ -1,3 +0,0 @@
-module git.novox.be/novox/mesh-catalog/checks/handacts
-
-go 1.22

checks/handacts/main.go

@@ -1,109 +0,0 @@
-// Command handacts refuses a manifest that records into the controller's hand-act log (novox/hq ADR 0565 §11): every
-// recorder records through the seat mesh-hand-acts from its delivery, so no manifest invokes
-// `seat:mesh-controller.hand-act`, `.warranted` or `.drill`. The recorders' fallbacks to the controller's log while the
-// seat has no holder are named in checks/handacts/fallbacks, each module and verb with why; that list only shrinks, and
-// an entry whose module no longer invokes the verb is refused too.
-//
-//	go run . <catalog root>
-//
-// Exits 1 on a finding.
-package main
-
-import (
-	"encoding/json"
-	"fmt"
-	"os"
-	"path/filepath"
-	"sort"
-	"strings"
-)
-
-// Verbs are the controller's hand-act verbs, as a manifest invokes them, and Allowed the list of named fallbacks.
-var Verbs = []string{"hand-act", "warranted", "drill"}
-
-const (
-	invokePrefix = "seat:mesh-controller."
-	Allowed      = "checks/handacts/fallbacks"
-)
-
-// Findings is every refusal in the catalog at root, sorted.
-func Findings(root string) ([]string, error) {
-	allowed := map[string]bool{}
-	raw, err := os.ReadFile(filepath.Join(root, Allowed))
-	if err != nil && !os.IsNotExist(err) {
-		return nil, err
-	}
-	for _, line := range strings.Split(string(raw), "\n") {
-		if f := strings.Fields(line); len(f) >= 3 && !strings.HasPrefix(f[0], "#") {
-			allowed[f[0]+" "+f[1]] = true
-		} else if len(f) > 0 && !strings.HasPrefix(f[0], "#") {
-			return nil, fmt.Errorf("%s: %q is not `<module> <verb> <why>`", Allowed, line)
-		}
-	}
-	manifests, err := filepath.Glob(filepath.Join(root, "modules", "*", "module.json"))
-	if err != nil {
-		return nil, err
-	}
-	var out []string
-	invoked := map[string]bool{}
-	for _, path := range manifests {
-		raw, err := os.ReadFile(path)
-		if err != nil {
-			return nil, err
-		}
-		var m struct {
-			Module  string   `json:"module"`
-			Invokes []string `json:"invokes"`
-		}
-		if json.Unmarshal(raw, &m) != nil || m.Module == "mesh-controller" {
-			continue
-		}
-		for _, inv := range m.Invokes {
-			verb, ok := strings.CutPrefix(strings.TrimSpace(inv), invokePrefix)
-			if !ok || !contains(Verbs, verb) {
-				continue
-			}
-			invoked[m.Module+" "+verb] = true
-			if !allowed[m.Module+" "+verb] {
-				out = append(out, fmt.Sprintf("%s invokes %s%s: record through seat:mesh-hand-acts.%s (novox/hq ADR 0565 §11), "+
-					"or name the fallback in %s", m.Module, invokePrefix, verb, verb, Allowed))
-			}
-		}
-	}
-	for entry := range allowed {
-		if !invoked[entry] {
-			out = append(out, fmt.Sprintf("%s names %q, which is no longer invoked: take it off the list, which only shrinks",
-				Allowed, entry))
-		}
-	}
-	sort.Strings(out)
-	return out, nil
-}
-
-func contains(list []string, s string) bool {
-	for _, x := range list {
-		if x == s {
-			return true
-		}
-	}
-	return false
-}
-
-func main() {
-	if len(os.Args) != 2 {
-		fmt.Fprintln(os.Stderr, "usage: handacts <catalog root>")
-		os.Exit(2)
-	}
-	found, err := Findings(os.Args[1])
-	if err != nil {
-		fmt.Println(err)
-		os.Exit(1)
-	}
-	for _, f := range found {
-		fmt.Println(f)
-	}
-	if len(found) > 0 {
-		os.Exit(1)
-	}
-	fmt.Println("no manifest records into the controller's hand-act log but the fallbacks named")
-}

checks/handacts/main_test.go

@@ -1,59 +0,0 @@
-package main
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-// No manifest invokes the controller's hand-act verbs but a named fallback; a named fallback no longer invoked is
-// refused (novox/hq ADR 0565 §11's catalog test).
-func TestFindings(t *testing.T) {
-	for _, row := range []struct {
-		name  string
-		files map[string]string
-		want  string // empty: clean
-	}{
-		{"clean", map[string]string{"modules/a/module.json": `{"module":"a","invokes":["seat:mesh-hand-acts.hand-act"]}`}, ""},
-		{"an unnamed call", map[string]string{"modules/a/module.json": `{"module":"a","invokes":["seat:mesh-controller.warranted"]}`},
-			"a invokes seat:mesh-controller.warranted"},
-		{"a named fallback, and the controller's own", map[string]string{
-			"modules/a/module.json":               `{"module":"a","invokes":["seat:mesh-controller.drill"]}`,
-			"modules/mesh-controller/module.json": `{"module":"mesh-controller","invokes":["seat:mesh-controller.hand-act"]}`,
-			Allowed:                               "# why\na drill fallback until the lease write\n"}, ""},
-		{"a fallback no longer invoked", map[string]string{Allowed: "gone hand-act fallback\n"}, `names "gone hand-act"`},
-		{"another verb of the controller", map[string]string{"modules/a/module.json": `{"module":"a","invokes":["seat:mesh-controller.conditions"]}`}, ""},
-	} {
-		t.Run(row.name, func(t *testing.T) {
-			root := t.TempDir()
-			for path, text := range row.files {
-				p := filepath.Join(root, path)
-				if err := os.MkdirAll(filepath.Dir(p), 0o755); err != nil {
-					t.Fatal(err)
-				}
-				if err := os.WriteFile(p, []byte(text), 0o644); err != nil {
-					t.Fatal(err)
-				}
-			}
-			got, err := Findings(root)
-			if err != nil {
-				t.Fatal(err)
-			}
-			if all := strings.Join(got, "\n"); (row.want == "") != (all == "") || !strings.Contains(all, row.want) {
-				t.Fatalf("findings = %q, want one containing %q", all, row.want)
-			}
-		})
-	}
-}
-
-// The run of this check over the real tree.
-func TestTheCatalogRecordsOnlyThroughTheSeat(t *testing.T) {
-	got, err := Findings(filepath.Join("..", ".."))
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, f := range got {
-		t.Error(f)
-	}
-}

checks/handacts/reads-outside

@@ -1,3 +0,0 @@
-# What these tests read outside their package, as paths from the repository's root (issue 1936).
-# every manifest, for what it invokes.
-modules/*/module.json

checks/health/go.mod

@@ -1,5 +0,0 @@
-module checks/health
-
-go 1.26.0
-
-require git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a

checks/health/go.sum

@@ -1,2 +0,0 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a h1:DcSvfEmdPBKqCg5OmXRNb269EkkPe7BsEp+RykEhkgE=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=

checks/health/health.go

@@ -1,70 +0,0 @@
-// Package health is the catalogue's count of long-running resources that do not say how they are ready (novox/hq ADR 0240 rule
-// 8), kept in health-undeclared and judged by a test over the real tree (ADR 0529 clauses 2 and 4): it replaces the step of
-// merge-check.sh that read it out of the controller's `module check`. Every manifest is read through mesh-sdk's catalogue
-// package, the one the controller counts with.
-package health
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"sort"
-	"strconv"
-	"strings"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-)
-
-// Count is the long-running resources without `health` of every module under root/modules.
-func Count(root string) (int, error) {
-	manifests, err := filepath.Glob(filepath.Join(root, "modules", "*", "module.json"))
-	if err != nil {
-		return 0, err
-	}
-	sort.Strings(manifests)
-	if len(manifests) == 0 {
-		return 0, fmt.Errorf("no manifest under %s: the count would be zero for any catalogue", filepath.Join(root, "modules"))
-	}
-	n := 0
-	for _, path := range manifests {
-		m, err := catalogue.ReadTreeManifest(root, filepath.Dir(path))
-		if err != nil {
-			return 0, fmt.Errorf("%s: %w", path, err)
-		}
-		n += len(catalogue.Undeclared(m))
-	}
-	return n, nil
-}
-
-// Kept is the number the file keeps: the first number of its first line.
-func Kept(path string) (int, error) {
-	raw, err := os.ReadFile(path)
-	if err != nil {
-		return 0, err
-	}
-	first, _, _ := strings.Cut(string(raw), "\n")
-	digits := ""
-	for _, r := range strings.TrimSpace(first) {
-		if r < '0' || r > '9' {
-			break
-		}
-		digits += string(r)
-	}
-	n, err := strconv.Atoi(digits)
-	if err != nil {
-		return 0, fmt.Errorf("%s does not begin with the number it keeps: %q", path, first)
-	}
-	return n, nil
-}
-
-// Judge says what is wrong with a count against the kept number; empty when they agree. It only goes down: a rise is refused,
-// and a fall asks the new number written in health-undeclared, so the count cannot rise again.
-func Judge(kept, counted int) string {
-	switch {
-	case counted > kept:
-		return fmt.Sprintf("the long-running resources without health rose from %d to %d: declare how each new one is ready (ADR 0240 rule 8)", kept, counted)
-	case counted < kept:
-		return fmt.Sprintf("the long-running resources without health fell from %d to %d: write %d in health-undeclared, so the count cannot rise again", kept, counted, counted)
-	}
-	return ""
-}

checks/health/health_test.go

@@ -1,88 +0,0 @@
-package health
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-func aCatalogue(t *testing.T, manifests map[string]string) string {
-	t.Helper()
-	root := t.TempDir()
-	for module, body := range manifests {
-		dir := filepath.Join(root, "modules", module)
-		if err := os.MkdirAll(dir, 0o755); err != nil {
-			t.Fatal(err)
-		}
-		if err := os.WriteFile(filepath.Join(dir, "module.json"), []byte(body), 0o644); err != nil {
-			t.Fatal(err)
-		}
-	}
-	return root
-}
-
-// A service that stays up and does not say how it is ready is counted; one that says, and a file, are not.
-func TestOnlyALongRunningResourceWithoutHealthIsCounted(t *testing.T) {
-	root := aCatalogue(t, map[string]string{
-		"quiet": `{"module":"quiet","resources":[{"id":"svc","type":"service","unit":"quiet.service","state":"running"}]}`,
-		"says": `{"module":"says","resources":[{"id":"svc","type":"service","unit":"says.service","state":"running",` +
-			`"health":{"kind":"unit"}}]}`,
-		"file": `{"module":"file","resources":[{"id":"cfg","type":"file","path":"/etc/file.conf","content":"x"}]}`,
-	})
-	counted, err := Count(root)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if counted != 1 {
-		t.Fatalf("counted %d, wanted the one quiet service", counted)
-	}
-}
-
-func TestTheCountMayOnlyGoDown(t *testing.T) {
-	for _, c := range []struct {
-		kept, counted int
-		says          string
-	}{
-		{58, 58, ""},
-		{58, 59, "rose from 58 to 59"},
-		{58, 57, "fell from 58 to 57"},
-	} {
-		got := Judge(c.kept, c.counted)
-		if (c.says == "") != (got == "") || !strings.Contains(got, c.says) {
-			t.Errorf("kept %d counted %d: %q, wanted %q", c.kept, c.counted, got, c.says)
-		}
-	}
-}
-
-func TestTheKeptCountIsTheFirstNumberOfTheFile(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "health-undeclared")
-	if err := os.WriteFile(path, []byte("58\nThe long-running resources ...\n"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	if n, err := Kept(path); err != nil || n != 58 {
-		t.Fatalf("%d %v", n, err)
-	}
-	if err := os.WriteFile(path, []byte("many\n"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := Kept(path); err == nil {
-		t.Fatal("a file with no number gave a count")
-	}
-}
-
-// The script's `module check` run over the real tree (novox/hq ADR 0240 rule 8, ADR 0529 clause 2 and 4): the long-running
-// resources that do not say how they are ready, counted as the controller counts them, are the number health-undeclared keeps.
-func TestTheCatalogueSaysHowItsLongRunningResourcesAreReady(t *testing.T) {
-	kept, err := Kept(filepath.Join("..", "..", "health-undeclared"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	counted, err := Count(filepath.Join("..", ".."))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if say := Judge(kept, counted); say != "" {
-		t.Fatal(say)
-	}
-}

checks/health/reads-outside

@@ -1,10 +0,0 @@
-# What these tests read outside their package, as paths from the repository's root (a glob, or a directory read whole;
-# ? before a path whose absence is read). mesh-build-go hashes them into the package's digest, so its verdict is kept
-# until one of them changes (issue 1936). An empty list, or a line matching nothing, keeps nothing.
-# every manifest through mesh-sdk's ReadTreeManifest: the root's predefined keys and each templated module's
-# templates (files/ by default, or the directory its manifest names); and the root's kept count of resources that do not say how they are ready.
-modules/*/module.json
-predefined.json
-modules/*/files
-modules/*/templates
-health-undeclared

checks/imagebuild/go.mod

@@ -1,3 +0,0 @@
-module git.novox.be/novox/mesh-catalog/checks/imagebuild
-
-go 1.22

checks/imagebuild/main.go

@@ -1,92 +0,0 @@
-// Command imagebuild refuses any manifest but modules/buildah providing the rootless-image-build provision
-// (novox/hq ADR 0487 §3, issue 1704): the image builder's tool is buildah alone, and docker, whose daemon holds
-// the machine's root, never stands in for it. A second provider would let a node compose mesh-build-image over
-// something that is not the rootless builder it was designed against.
-//
-//	go run . <catalogue root>
-//
-// Exits 1 on a finding.
-package main
-
-import (
-	"encoding/json"
-	"fmt"
-	"os"
-	"path/filepath"
-	"sort"
-)
-
-// Provision is the provision only Provider may provide.
-const Provision = "rootless-image-build"
-
-// Provider is the one module allowed to provide it.
-const Provider = "buildah"
-
-// Finding is one manifest refused: a module other than buildah providing the provision.
-type Finding struct {
-	Module string
-}
-
-// Check reads every manifest under root/modules and answers which ones it refuses, and whether buildah provides.
-func Check(root string) ([]Finding, error) {
-	manifests, err := filepath.Glob(filepath.Join(root, "modules", "*", "module.json"))
-	if err != nil {
-		return nil, err
-	}
-	sort.Strings(manifests)
-	var out []Finding
-	provided := false
-	for _, path := range manifests {
-		raw, err := os.ReadFile(path)
-		if err != nil {
-			return nil, err
-		}
-		var m struct {
-			Module   string `json:"module"`
-			Provides []struct {
-				Name string `json:"name"`
-			} `json:"provides"`
-		}
-		if err := json.Unmarshal(raw, &m); err != nil {
-			return nil, fmt.Errorf("%s: %w", path, err)
-		}
-		for _, p := range m.Provides {
-			if p.Name != Provision {
-				continue
-			}
-			if m.Module == Provider {
-				provided = true
-			} else {
-				out = append(out, Finding{Module: m.Module})
-			}
-			break
-		}
-	}
-	if !provided {
-		out = append(out, Finding{Module: Provider})
-	}
-	return out, nil
-}
-
-func main() {
-	root := "."
-	if len(os.Args) > 1 {
-		root = os.Args[1]
-	}
-	found, err := Check(root)
-	if err != nil {
-		fmt.Fprintln(os.Stderr, err)
-		os.Exit(1)
-	}
-	for _, f := range found {
-		if f.Module == Provider {
-			fmt.Printf("%s does not provide %s (novox/hq ADR 0487 §3)\n", Provider, Provision)
-			continue
-		}
-		fmt.Printf("%s provides %s: only %s may, and docker never (novox/hq ADR 0487 §3)\n", f.Module, Provision, Provider)
-	}
-	if len(found) > 0 {
-		os.Exit(1)
-	}
-	fmt.Println("imagebuild: rootless-image-build is provided only by buildah")
-}

checks/imagebuild/main_test.go

@@ -1,74 +0,0 @@
-package main
-
-import (
-	"os"
-	"path/filepath"
-	"reflect"
-	"testing"
-)
-
-func catalogue(t *testing.T, manifests map[string]string) string {
-	t.Helper()
-	root := t.TempDir()
-	for name, body := range manifests {
-		dir := filepath.Join(root, "modules", name)
-		if err := os.MkdirAll(dir, 0o755); err != nil {
-			t.Fatal(err)
-		}
-		if err := os.WriteFile(filepath.Join(dir, "module.json"), []byte(body), 0o644); err != nil {
-			t.Fatal(err)
-		}
-	}
-	return root
-}
-
-const buildah = `{"module":"buildah","provides":[{"name":"rootless-image-build","reach":"machine"}]}`
-
-func TestOnlyBuildahProvidesTheRootlessImageBuild(t *testing.T) {
-	root := catalogue(t, map[string]string{"buildah": buildah, "go": `{"module":"go","provides":[{"name":"go-toolchain"}]}`})
-	got, err := Check(root)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(got) != 0 {
-		t.Errorf("found %v, want none", got)
-	}
-}
-
-func TestDockerAndAnySecondProviderAreRefused(t *testing.T) {
-	root := catalogue(t, map[string]string{
-		"buildah": buildah,
-		"docker":  `{"module":"docker","provides":[{"name":"rootless-image-build"}]}`,
-		"other":   `{"module":"other","provides":[{"name":"x"},{"name":"rootless-image-build"}]}`,
-	})
-	got, err := Check(root)
-	if err != nil {
-		t.Fatal(err)
-	}
-	want := []Finding{{Module: "docker"}, {Module: "other"}}
-	if !reflect.DeepEqual(got, want) {
-		t.Errorf("found %v, want %v", got, want)
-	}
-}
-
-func TestBuildahMustProvideIt(t *testing.T) {
-	root := catalogue(t, map[string]string{"buildah": `{"module":"buildah"}`})
-	got, err := Check(root)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if want := []Finding{{Module: "buildah"}}; !reflect.DeepEqual(got, want) {
-		t.Errorf("found %v, want %v", got, want)
-	}
-}
-
-// The catalogue as it stands: this is the check itself, run here too.
-func TestTheCatalogueGivesTheProvisionToBuildahAlone(t *testing.T) {
-	got, err := Check("../..")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(got) != 0 {
-		t.Errorf("the catalogue's providers of rootless-image-build are wrong: %v", got)
-	}
-}

checks/imagebuild/reads-outside

@@ -1,5 +0,0 @@
-# What these tests read outside their package, as paths from the repository's root (a glob, or a directory read whole;
-# ? before a path whose absence is read). mesh-build-go hashes them into the package's digest, so its verdict is kept
-# until one of them changes (issue 1936). An empty list, or a line matching nothing, keeps nothing.
-# Check("../.."): every manifest.
-modules/*/module.json

checks/imageplace/go.mod

@@ -1,3 +0,0 @@
-module git.novox.be/novox/mesh-catalog/checks/imageplace
-
-go 1.22

checks/imageplace/main.go

@@ -1,91 +0,0 @@
-// Command imageplace refuses an image artifact whose Dockerfile is not a file inside its own module's directory
-// (novox/hq ADR 0487 §1, issue 1707): the image builder builds a module from that module's directory alone, so
-// a `from` that leaves it (../other/Dockerfile) or names a file that is not there could never build.
-//
-//	go run . <catalogue root>
-//
-// Exits 1 on a finding.
-package main
-
-import (
-	"encoding/json"
-	"fmt"
-	"os"
-	"path/filepath"
-	"sort"
-	"strings"
-)
-
-// Finding is one image refused: Module's artifact Artifact names From, and Why says what is wrong with it.
-type Finding struct {
-	Module, Artifact, From, Why string
-}
-
-// Check reads every manifest under root/modules and answers which images it refuses.
-func Check(root string) ([]Finding, error) {
-	manifests, err := filepath.Glob(filepath.Join(root, "modules", "*", "module.json"))
-	if err != nil {
-		return nil, err
-	}
-	sort.Strings(manifests)
-	var out []Finding
-	for _, path := range manifests {
-		raw, err := os.ReadFile(path)
-		if err != nil {
-			return nil, err
-		}
-		var m struct {
-			Module string `json:"module"`
-			Build  struct {
-				Artifacts []struct {
-					Name string `json:"name"`
-					Kind string `json:"kind"`
-					From string `json:"from"`
-				} `json:"artifacts"`
-			} `json:"build"`
-		}
-		if err := json.Unmarshal(raw, &m); err != nil {
-			return nil, fmt.Errorf("%s: %w", path, err)
-		}
-		dir := filepath.Dir(path)
-		for _, a := range m.Build.Artifacts {
-			if a.Kind != "image" {
-				continue
-			}
-			f := Finding{Module: m.Module, Artifact: a.Name, From: a.From}
-			clean := filepath.Clean(a.From)
-			switch {
-			case a.From == "" || filepath.IsAbs(clean) || clean == ".." || strings.HasPrefix(clean, ".."+string(filepath.Separator)):
-				f.Why = "is not a path inside the module's own directory"
-			default:
-				info, err := os.Stat(filepath.Join(dir, clean))
-				if err != nil || info.IsDir() {
-					f.Why = "is not a file in the module's directory"
-				}
-			}
-			if f.Why != "" {
-				out = append(out, f)
-			}
-		}
-	}
-	return out, nil
-}
-
-func main() {
-	root := "."
-	if len(os.Args) > 1 {
-		root = os.Args[1]
-	}
-	found, err := Check(root)
-	if err != nil {
-		fmt.Fprintln(os.Stderr, err)
-		os.Exit(1)
-	}
-	for _, f := range found {
-		fmt.Printf("%s: image %s builds from %q, which %s (novox/hq ADR 0487 §1)\n", f.Module, f.Artifact, f.From, f.Why)
-	}
-	if len(found) > 0 {
-		os.Exit(1)
-	}
-	fmt.Println("imageplace: every image builds from a Dockerfile in its own module's directory")
-}

checks/imageplace/main_test.go

@@ -1,84 +0,0 @@
-package main
-
-import (
-	"os"
-	"path/filepath"
-	"reflect"
-	"testing"
-)
-
-// module writes modules/<name>/module.json with one image artifact from `from`, and the files named.
-func module(t *testing.T, root, name, from string, files ...string) {
-	t.Helper()
-	dir := filepath.Join(root, "modules", name)
-	if err := os.MkdirAll(dir, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	body := `{"module":"` + name + `","build":{"artifacts":[{"name":"server","kind":"image","from":"` + from + `"},{"name":"files","kind":"archive","from":"../elsewhere"}]}}`
-	if err := os.WriteFile(filepath.Join(dir, "module.json"), []byte(body), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	for _, f := range files {
-		p := filepath.Join(dir, f)
-		if err := os.MkdirAll(filepath.Dir(p), 0o755); err != nil {
-			t.Fatal(err)
-		}
-		if err := os.WriteFile(p, []byte("FROM scratch\n"), 0o644); err != nil {
-			t.Fatal(err)
-		}
-	}
-}
-
-func TestADockerfileInTheModulesOwnDirectoryPasses(t *testing.T) {
-	root := t.TempDir()
-	module(t, root, "own", "Dockerfile", "Dockerfile")
-	module(t, root, "nested", "image/Dockerfile", "image/Dockerfile")
-	got, err := Check(root)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(got) != 0 {
-		t.Errorf("found %v, want none", got)
-	}
-}
-
-func TestADockerfileOutsideTheModulesDirectoryFails(t *testing.T) {
-	root := t.TempDir()
-	module(t, root, "other", "Dockerfile", "Dockerfile")
-	module(t, root, "leaves", "../other/Dockerfile")
-	module(t, root, "absolute", "/etc/Dockerfile")
-	got, err := Check(root)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var mods []string
-	for _, f := range got {
-		mods = append(mods, f.Module)
-	}
-	if want := []string{"absolute", "leaves"}; !reflect.DeepEqual(mods, want) {
-		t.Errorf("refused %v (%v), want %v", mods, got, want)
-	}
-}
-
-func TestAMissingDockerfileFails(t *testing.T) {
-	root := t.TempDir()
-	module(t, root, "gone", "Dockerfile")
-	got, err := Check(root)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(got) != 1 || got[0].Module != "gone" {
-		t.Errorf("found %v, want gone refused", got)
-	}
-}
-
-// The catalogue as it stands: this is the check itself, run here too.
-func TestTheCataloguesImagesBuildFromTheirOwnDirectories(t *testing.T) {
-	got, err := Check("../..")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(got) != 0 {
-		t.Errorf("an image builds from outside its module: %v", got)
-	}
-}

checks/imageplace/reads-outside

@@ -1,5 +0,0 @@
-# What these tests read outside their package, as paths from the repository's root (a glob, or a directory read whole;
-# ? before a path whose absence is read). mesh-build-go hashes them into the package's digest, so its verdict is kept
-# until one of them changes (issue 1936). An empty list, or a line matching nothing, keeps nothing.
-# Check("../.."): every manifest, and whether the path each image artifact builds from is there.
-modules

checks/locks/go.mod

@@ -1,3 +0,0 @@
-module git.novox.be/novox/mesh-catalog/checks/locks
-
-go 1.22

checks/locks/main.go

@@ -1,105 +0,0 @@
-// Command locks refuses a TypeScript module that names packages beyond the SDK in its package.json and commits no
-// package-lock.json (novox/hq ADR 0469 §5, issue 1868): the Node build module installs a module's own packages only
-// from its committed lock, so such a module is refused by the builder and could not be delivered.
-//
-//	go run . <catalogue root>
-//
-// Exits 1 on a finding. The packages that count are those the build module counts (mesh-build-node fetch.go
-// ownDependencies): the `dependencies` beyond the SDK, typescript and the @types packages.
-package main
-
-import (
-	"encoding/json"
-	"fmt"
-	"os"
-	"path/filepath"
-	"sort"
-	"strings"
-)
-
-// Finding is one module refused: it names Packages beyond the SDK and has no lock file.
-type Finding struct {
-	Module   string
-	Packages []string
-}
-
-// Check reads every module under root/modules that builds a TypeScript artifact.
-func Check(root string) ([]Finding, error) {
-	manifests, err := filepath.Glob(filepath.Join(root, "modules", "*", "module.json"))
-	if err != nil {
-		return nil, err
-	}
-	sort.Strings(manifests)
-	var out []Finding
-	for _, path := range manifests {
-		raw, err := os.ReadFile(path)
-		if err != nil {
-			return nil, err
-		}
-		var m struct {
-			Module string `json:"module"`
-			Build  struct {
-				Artifacts []struct {
-					Language string `json:"language"`
-				} `json:"artifacts"`
-			} `json:"build"`
-		}
-		if err := json.Unmarshal(raw, &m); err != nil {
-			return nil, fmt.Errorf("%s: %w", path, err)
-		}
-		typescript := false
-		for _, a := range m.Build.Artifacts {
-			typescript = typescript || a.Language == "typescript"
-		}
-		if !typescript {
-			continue
-		}
-		dir := filepath.Dir(path)
-		pkgRaw, err := os.ReadFile(filepath.Join(dir, "package.json"))
-		if os.IsNotExist(err) {
-			continue
-		}
-		if err != nil {
-			return nil, err
-		}
-		var pkg struct {
-			Dependencies map[string]json.RawMessage `json:"dependencies"`
-		}
-		if err := json.Unmarshal(pkgRaw, &pkg); err != nil {
-			return nil, fmt.Errorf("%s: package.json: %w", m.Module, err)
-		}
-		var names []string
-		for n := range pkg.Dependencies {
-			if n != "@novox/mesh-sdk" && n != "typescript" && !strings.HasPrefix(n, "@types/") {
-				names = append(names, n)
-			}
-		}
-		if len(names) == 0 {
-			continue
-		}
-		if _, err := os.Stat(filepath.Join(dir, "package-lock.json")); err != nil {
-			sort.Strings(names)
-			out = append(out, Finding{Module: m.Module, Packages: names})
-		}
-	}
-	return out, nil
-}
-
-func main() {
-	root := "."
-	if len(os.Args) > 1 {
-		root = os.Args[1]
-	}
-	found, err := Check(root)
-	if err != nil {
-		fmt.Fprintln(os.Stderr, err)
-		os.Exit(1)
-	}
-	for _, f := range found {
-		fmt.Printf("%s names packages beyond the SDK (%s) and has no package-lock.json: commit one made by the build module's toolchain (novox/hq ADR 0469 §5)\n", f.Module, strings.Join(f.Packages, ", "))
-	}
-	if len(found) > 0 {
-		os.Exit(1)
-	}
-	fmt.Println("locks: every TypeScript module that names packages beyond the SDK commits its lock")
-}

checks/locks/main_test.go

@@ -1,75 +0,0 @@
-package main
-
-import (
-	"os"
-	"path/filepath"
-	"reflect"
-	"testing"
-)
-
-// module writes modules/<name> with a TypeScript artifact, the package.json given ("" for none) and, when lock, a lock.
-func module(t *testing.T, root, name, language, pkg string, lock bool) {
-	t.Helper()
-	dir := filepath.Join(root, "modules", name)
-	if err := os.MkdirAll(dir, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	write := func(file, body string) {
-		if err := os.WriteFile(filepath.Join(dir, file), []byte(body), 0o644); err != nil {
-			t.Fatal(err)
-		}
-	}
-	write("module.json", `{"module":"`+name+`","build":{"artifacts":[{"name":"tools","kind":"bundle","language":"`+language+`","from":"index.ts"}]}}`)
-	if pkg != "" {
-		write("package.json", pkg)
-	}
-	if lock {
-		write("package-lock.json", "{}")
-	}
-}
-
-const sdkOnly = `{"dependencies":{"@novox/mesh-sdk":"^0.1.1"},"devDependencies":{"typescript":"^5","@types/node":"^22"}}`
-const withPg = `{"dependencies":{"@novox/mesh-sdk":"^0.1.1","pg":"^8","@types/pg":"^8"}}`
-
-func TestAModuleNamingOnlyTheSDKNeedsNoLock(t *testing.T) {
-	root := t.TempDir()
-	module(t, root, "plain", "typescript", sdkOnly, false)
-	module(t, root, "none", "typescript", "", false)
-	got, err := Check(root)
-	if err != nil || len(got) != 0 {
-		t.Fatalf("%v %v", got, err)
-	}
-}
-
-func TestAModuleNamingMorePackagesWithoutALockIsRefusedNamingThem(t *testing.T) {
-	root := t.TempDir()
-	module(t, root, "db", "typescript", withPg, false)
-	module(t, root, "db-locked", "typescript", withPg, true)
-	got, err := Check(root)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if want := []Finding{{Module: "db", Packages: []string{"pg"}}}; !reflect.DeepEqual(got, want) {
-		t.Fatalf("got %v, want %v", got, want)
-	}
-}
-
-func TestAModuleThatIsNotTypeScriptIsNotJudged(t *testing.T) {
-	root := t.TempDir()
-	module(t, root, "go", "go", withPg, false)
-	if got, err := Check(root); err != nil || len(got) != 0 {
-		t.Fatalf("%v %v", got, err)
-	}
-}
-
-// The script's run of this check over the real tree (novox/hq ADR 0529 clause 2): every TypeScript module that names packages
-// beyond the SDK commits its lock.
-func TestTheCatalogueCommitsTheLocksItNeeds(t *testing.T) {
-	found, err := Check("../..")
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, f := range found {
-		t.Errorf("%s names packages beyond the SDK (%v) and has no package-lock.json: commit one made by the build module's toolchain (novox/hq ADR 0469 §5)", f.Module, f.Packages)
-	}
-}

checks/locks/reads-outside

@@ -1,7 +0,0 @@
-# What these tests read outside their package, as paths from the repository's root (a glob, or a directory read whole;
-# ? before a path whose absence is read). mesh-build-go hashes them into the package's digest, so its verdict is kept
-# until one of them changes (issue 1936). An empty list, or a line matching nothing, keeps nothing.
-# Check("../.."): every manifest, a TypeScript module's package.json and whether its lock is there.
-modules/*/module.json
-modules/*/package.json
-modules/*/package-lock.json

checks/mailstore/reads-outside

@@ -1,5 +0,0 @@
-# What these tests read outside their package, as paths from the repository's root (a glob, or a directory read whole;
-# ? before a path whose absence is read). mesh-build-go hashes them into the package's digest, so its verdict is kept
-# until one of them changes (issue 1936). An empty list, or a line matching nothing, keeps nothing.
-# Check("../.."): every manifest.
-modules/*/module.json

checks/manifests/go.mod

@@ -1,5 +0,0 @@
-module checks/manifests
-
-go 1.26.0
-
-require git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a

checks/manifests/go.sum

@@ -1,2 +0,0 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a h1:DcSvfEmdPBKqCg5OmXRNb269EkkPe7BsEp+RykEhkgE=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=

checks/manifests/main.go

@@ -1,61 +0,0 @@
-// Package manifests judges every module's manifest as the node-engine reads it, and the catalogue as one shelf: each
-// modules/*/module.json through mesh-sdk's ParseManifestWith against the predefined.json at the root, with its templates
-// read from the tree beside it (WithTemplatesFrom), then the rules between manifests (CatalogueProblems,
-// IdentityProblems, DataProblems).
-//
-// Why it is here (issue 774): on 2026-10-30 mesh-catalog ca8d6f33 gave power's bar item two attributes its bar places
-// by none of. ParseManifest refuses that, and every node-engine refused to compose at 19:13; no check of the pull
-// request had parsed the manifest. That judgement was mesh-controller's `module check`, which the merge gate ran over
-// every manifest before the checker moved to mesh-delivery; the checker runs this repository's Go tests and the
-// composition, and no test parsed a manifest whole. This one does, in the same functions the nodes use.
-package manifests
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"sort"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-)
-
-// Problems is what is wrong with the manifests under root/modules, one line each: a manifest the mesh refuses, named by
-// its path, then the rules between the manifests that parse.
-func Problems(root string) ([]string, error) {
-	files, err := filepath.Glob(filepath.Join(root, "modules", "*", "module.json"))
-	if err != nil {
-		return nil, err
-	}
-	sort.Strings(files)
-	list, err := catalogue.ReadPredefined(root)
-	if err != nil {
-		return nil, err
-	}
-	var out []string
-	shelf := catalogue.Shelf{}
-	for _, f := range files {
-		raw, err := os.ReadFile(f)
-		if err != nil {
-			return nil, err
-		}
-		rel, _ := filepath.Rel(root, f)
-		m, err := catalogue.ParseManifestWith(raw, list)
-		if err == nil {
-			m, err = catalogue.WithTemplatesFrom(m, filepath.Dir(f))
-		}
-		if err != nil {
-			out = append(out, fmt.Sprintf("%s: %v", rel, err))
-			continue
-		}
-		if _, twice := shelf[m.Module]; twice {
-			out = append(out, fmt.Sprintf("%s: %s was already given; two manifests name one module", rel, m.Module))
-			continue
-		}
-		shelf[m.Module] = m
-	}
-	between := catalogue.CatalogueProblems(shelf)
-	between = append(between, catalogue.IdentityProblems(shelf, catalogue.DefaultLongestMachine)...)
-	between = append(between, catalogue.DataProblems(shelf)...)
-	sort.Strings(between)
-	return append(out, between...), nil
-}

checks/manifests/main_test.go

@@ -1,51 +0,0 @@
-package manifests
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-// Every manifest of the catalogue is one the nodes can use, and the catalogue holds together as one shelf. A row is a
-// manifest written into a catalogue of its own: power's bar item as mesh-catalog ca8d6f33 gave it (issue 774) is
-// refused naming the attribute, and the same item without it passes.
-func TestEveryManifestIsOneTheNodesCanUse(t *testing.T) {
-	for _, row := range []struct {
-		name, attributes, refused string
-	}{
-		{name: "the bar places by bar and place", attributes: `"bar":"bottom","place":"status","order":"45"`},
-		{name: "an attribute the bar places by none of (ca8d6f33)",
-			attributes: `"bar":"bottom","place":"status","order":"45","shows":"state","state":"power.draw"`,
-			refused:    `"shows" is none of them`},
-	} {
-		root := t.TempDir()
-		dir := filepath.Join(root, "modules", "bar-user")
-		if err := os.MkdirAll(filepath.Join(dir, "files"), 0o755); err != nil {
-			t.Fatal(err)
-		}
-		manifest := `{"module":"bar-user","version":"1","moved":true,` +
-			`"build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]},` +
-			`"items":[{"collection":"contribution:node-bar:block","attributes":{` + row.attributes + `},"template":"files/bar"}]}`
-		for path, body := range map[string]string{"module.json": manifest, "files/bar": "{\"shows\":\"command\"}\n"} {
-			if err := os.WriteFile(filepath.Join(dir, path), []byte(body), 0o644); err != nil {
-				t.Fatal(err)
-			}
-		}
-		got, err := Problems(root)
-		if err != nil {
-			t.Fatal(err)
-		}
-		joined := strings.Join(got, "\n")
-		if (row.refused == "") != (len(got) == 0) || !strings.Contains(joined, row.refused) {
-			t.Errorf("%s: refused %q, want %q", row.name, joined, row.refused)
-		}
-	}
-	real, err := Problems(filepath.Join("..", ".."))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(real) != 0 {
-		t.Fatalf("the catalogue holds manifests the nodes cannot use:\n%s", strings.Join(real, "\n"))
-	}
-}

checks/manifests/reads-outside

@@ -1,4 +0,0 @@
-# What these tests read outside their package, as paths from the repository's root (issue 1936).
-# every module's directory (its manifest and the templates beside it), and the list of predefined keys.
-modules
-predefined.json

checks/nobinaries/go.mod

@@ -1,3 +0,0 @@
-module git.novox.be/novox/mesh-catalog/checks/nobinaries
-
-go 1.22

checks/nobinaries/nobinaries.go

@@ -1,84 +0,0 @@
-// Package nobinaries refuses a compiled program anywhere in the repository (issue 1577; first a checks/ binary slipped past a modules/-only rule): it is build output, made by the module's build step,
-// and `go build` in a module's folder writes one beside go.mod where `git add -A` takes it.
-package nobinaries
-
-import (
-	"bytes"
-	"fmt"
-	"io"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-)
-
-// Kind says what executable format the first bytes of a file are, or "" when they are none.
-func Kind(head []byte) string {
-	switch {
-	case bytes.HasPrefix(head, []byte("\x7fELF")):
-		return "ELF"
-	case bytes.HasPrefix(head, []byte("MZ")):
-		return "PE"
-	case bytes.HasPrefix(head, []byte{0xcf, 0xfa, 0xed, 0xfe}), bytes.HasPrefix(head, []byte{0xce, 0xfa, 0xed, 0xfe}),
-		bytes.HasPrefix(head, []byte{0xfe, 0xed, 0xfa, 0xcf}), bytes.HasPrefix(head, []byte{0xfe, 0xed, 0xfa, 0xce}),
-		bytes.HasPrefix(head, []byte{0xca, 0xfe, 0xba, 0xbe}) && len(head) >= 8 && head[7] < 0x20 && head[6] == 0 && head[5] == 0 && head[4] == 0:
-		return "Mach-O"
-	}
-	return ""
-}
-
-// Files are the files of the catalogue's root that the change holds, anywhere: the tracked ones when the root is a git
-// checkout (an ignored binary a local build left is not the change's), else every file there but .git's.
-func Files(root string) ([]string, error) {
-	cmd := exec.Command("git", "-C", root, "ls-files", "-z")
-	if out, err := cmd.Output(); err == nil && len(out) > 0 {
-		var files []string
-		for _, f := range strings.Split(strings.TrimRight(string(out), "\x00"), "\x00") {
-			if _, err := os.Lstat(filepath.Join(root, f)); err == nil { // a file the change deletes is not there
-				files = append(files, f)
-			}
-		}
-		return files, nil
-	}
-	var files []string
-	err := filepath.WalkDir(root, func(p string, d os.DirEntry, err error) error {
-		if err != nil {
-			return err
-		}
-		if d.IsDir() && d.Name() == ".git" {
-			return filepath.SkipDir
-		}
-		if d.IsDir() || !d.Type().IsRegular() {
-			return nil
-		}
-		rel, _ := filepath.Rel(root, p)
-		files = append(files, rel)
-		return nil
-	})
-	return files, err
-}
-
-// Find names each file of files (paths from root) that is a compiled program, with its format.
-func Find(root string, files []string) ([]string, error) {
-	var found []string
-	for _, f := range files {
-		p := filepath.Join(root, f)
-		if st, err := os.Lstat(p); err != nil || !st.Mode().IsRegular() {
-			continue
-		}
-		fh, err := os.Open(p)
-		if err != nil {
-			return nil, err
-		}
-		head := make([]byte, 8)
-		n, err := io.ReadFull(fh, head)
-		fh.Close()
-		if err != nil && err != io.ErrUnexpectedEOF && err != io.EOF {
-			return nil, err
-		}
-		if k := Kind(head[:n]); k != "" {
-			found = append(found, fmt.Sprintf("%s (%s)", f, k))
-		}
-	}
-	return found, nil
-}

checks/nobinaries/nobinaries_test.go

@@ -1,89 +0,0 @@
-package nobinaries
-
-import (
-	"os"
-	"os/exec"
-	"path/filepath"
-	"testing"
-)
-
-func TestFindNamesEachCompiledProgramAndNothingElse(t *testing.T) {
-	root := t.TempDir()
-	files := map[string][]byte{
-		"modules/a/a":           []byte("\x7fELF\x02\x01\x01\x00rest"),
-		"modules/b/cmd/b/b.exe": []byte("MZ\x90\x00"),
-		"modules/c/c":           {0xcf, 0xfa, 0xed, 0xfe, 7, 0, 0, 1},
-		"modules/d/main.go":     []byte("package main\n"),
-		"modules/e/short":       []byte("\x7f"),
-		"modules/f/empty":       {},
-		"modules/g/Foo.class":   {0xca, 0xfe, 0xba, 0xbe, 0, 0, 0, 52}, // Java, not Mach-O
-		"checks/words/words":    []byte("\x7fELF\x02\x01\x01\x00rest"), // outside modules/ too
-	}
-	var names []string
-	for f, b := range files {
-		p := filepath.Join(root, f)
-		if err := os.MkdirAll(filepath.Dir(p), 0o755); err != nil {
-			t.Fatal(err)
-		}
-		if err := os.WriteFile(p, b, 0o644); err != nil {
-			t.Fatal(err)
-		}
-		names = append(names, f)
-	}
-	got, err := Find(root, names)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(got) != 4 {
-		t.Fatalf("found %v; wanted modules/a/a, modules/b/cmd/b/b.exe and modules/c/c and checks/words/words only", got)
-	}
-}
-
-// The catalogue's own tree holds no compiled program: a compiled program is build output, so remove it and add it to .gitignore.
-func TestTheCatalogueHoldsNoCompiledProgram(t *testing.T) {
-	root := filepath.Join("..", "..")
-	files, err := Files(root)
-	if err != nil {
-		t.Fatal(err)
-	}
-	found, err := Find(root, files)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, f := range found {
-		t.Errorf("%s: a compiled program is build output: remove it and add it to .gitignore (issue 1577)", f)
-	}
-}
-
-// A compiled program outside modules/ is refused too (a binary under checks/ slipped past the modules/-only rule): Files holds
-// every tracked file of a git checkout and every file of a plain folder, and Find names the binary in both.
-func TestAProgramUnderChecksIsRefused(t *testing.T) {
-	for _, git := range []bool{true, false} {
-		root := t.TempDir()
-		p := filepath.Join(root, "checks", "words", "words")
-		if err := os.MkdirAll(filepath.Dir(p), 0o755); err != nil {
-			t.Fatal(err)
-		}
-		if err := os.WriteFile(p, []byte("\x7fELF\x02\x01\x01\x00rest"), 0o644); err != nil {
-			t.Fatal(err)
-		}
-		if git {
-			for _, args := range [][]string{{"init", "-q"}, {"add", "-A"}} {
-				if out, err := exec.Command("git", append([]string{"-C", root}, args...)...).CombinedOutput(); err != nil {
-					t.Fatalf("git %v: %v: %s", args, err, out)
-				}
-			}
-		}
-		files, err := Files(root)
-		if err != nil {
-			t.Fatal(err)
-		}
-		found, err := Find(root, files)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if len(found) != 1 {
-			t.Errorf("git=%v: found %v; wanted checks/words/words (ELF)", git, found)
-		}
-	}
-}

checks/nobinaries/reads-outside

@@ -1 +0,0 @@
-# every tracked file of the repository (git ls-files, no path limit): the whole tree, so this package's verdict is never kept.

checks/noplacement/assignments-readers

@@ -1,4 +0,0 @@
-# The modules of this catalogue that still read the controller's assignments (mesh-controller.assignments), each with
-# why. The check of this directory (noplacement) refuses any other module that reads them, and an entry here whose module no longer
-# does: the list only shrinks, and it is empty before the controller's lease is written to a holder that is no
-# controller (novox/hq ADR 0549 §3, §6; issue 774).

checks/noplacement/go.mod

@@ -1,7 +0,0 @@
-module git.novox.be/novox/mesh-catalog/checks/noplacement
-
-go 1.22
-
-require git.novox.be/novox/mesh-catalog/checks/trunk v0.0.0
-
-replace git.novox.be/novox/mesh-catalog/checks/trunk => ../trunk

checks/noplacement/main.go

@@ -1,170 +0,0 @@
-// Command noplacement refuses what the repository path of placement left behind (novox/hq ADR 0567 §10, §12).
-//
-// Placement, which module runs on which node, is bus state held by the seat mesh-placement; no file of the
-// catalogue says it, and no manifest reads it from the delivery indexer, which no longer keeps it. It refuses:
-//
-//  1. a `placement` directory (or file) at the root of the catalogue;
-//
-//  2. a `particulars` file at the root (the mesh's node names come from the checker's run, §16);
-//
-//  3. a manifest naming a state, stream, event or bucket of the indexer's placement (`mesh-delivery-indexer.placement…`
-//     or `mesh-delivery-indexer_placement…`) in any string value, such as `reads`;
-//
-//  4. a manifest, other than mesh-controller's, that reads the controller's assignments (`mesh-controller.assignments`):
-//     every reader takes placement from the seat mesh-placement (novox/hq ADR 0549 §3, ADR 0567), and the lease write is
-//     refused while one still reads them (ADR 0549 §6; issue 774). The modules that still read them for what the
-//     placement does not carry are named in checks/noplacement/assignments-readers, each with why; that list only
-//     shrinks: an entry whose module no longer reads them is refused too.
-//
-//     go run . <catalogue root>
-//
-// Exits 1 on a finding.
-package main
-
-import (
-	"encoding/json"
-	"fmt"
-	"os"
-	"path/filepath"
-	"sort"
-	"strings"
-)
-
-// Prefixes are the names of the indexer's placement parts; a manifest string starting with one names them.
-var Prefixes = []string{"mesh-delivery-indexer.placement", "mesh-delivery-indexer_placement"}
-
-// Findings is every refusal in the catalogue at root, sorted.
-func Findings(root string) ([]string, error) {
-	var out []string
-	if _, err := os.Lstat(filepath.Join(root, "placement")); err == nil {
-		out = append(out, "placement: the repository holds no placement; it is bus state of the seat mesh-placement (novox/hq ADR 0567 §10)")
-	}
-	if _, err := os.Lstat(filepath.Join(root, "particulars")); err == nil {
-		out = append(out, "particulars: the repository lists no node names; the checker hands them to the check (novox/hq ADR 0567 §16)")
-	}
-	manifests, err := filepath.Glob(filepath.Join(root, "modules", "*", "module.json"))
-	if err != nil {
-		return nil, err
-	}
-	sort.Strings(manifests)
-	for _, file := range manifests {
-		raw, err := os.ReadFile(file)
-		if err != nil {
-			return nil, err
-		}
-		var doc any
-		if err := json.Unmarshal(raw, &doc); err != nil {
-			return nil, fmt.Errorf("%s: %w", file, err)
-		}
-		module := filepath.Base(filepath.Dir(file))
-		for _, s := range named(doc, nil) {
-			out = append(out, fmt.Sprintf("%s: names %q, which the indexer no longer keeps; placement is the seat mesh-placement's (novox/hq ADR 0567 §12)", module, s))
-		}
-	}
-	readers, err := assignmentsReaders(root)
-	if err != nil {
-		return nil, err
-	}
-	out = append(out, readers...)
-	sort.Strings(out)
-	return out, nil
-}
-
-// AssignmentsRead is the controller's assignments as a manifest reads them, and Allowed the file, relative to the
-// catalogue's root, that names the modules still reading them: `<module> <why>` per line, `#` a comment.
-const (
-	AssignmentsRead = "mesh-controller.assignments"
-	Allowed         = "checks/noplacement/assignments-readers"
-)
-
-// assignmentsReaders is every finding on the reads of the controller's assignments: a module other than the controller
-// reading them that Allowed does not name, and a module Allowed names that no longer reads them (issue 774).
-func assignmentsReaders(root string) ([]string, error) {
-	allowed := map[string]bool{}
-	raw, err := os.ReadFile(filepath.Join(root, Allowed))
-	if err != nil && !os.IsNotExist(err) {
-		return nil, err
-	}
-	for _, line := range strings.Split(string(raw), "\n") {
-		if f := strings.Fields(line); len(f) > 0 && !strings.HasPrefix(f[0], "#") {
-			allowed[f[0]] = true
-		}
-	}
-	manifests, err := filepath.Glob(filepath.Join(root, "modules", "*", "module.json"))
-	if err != nil {
-		return nil, err
-	}
-	var found []string
-	reads := map[string]bool{}
-	for _, path := range manifests {
-		raw, err := os.ReadFile(path)
-		if err != nil {
-			return nil, err
-		}
-		var m struct {
-			Module string   `json:"module"`
-			Reads  []string `json:"reads"`
-		}
-		if json.Unmarshal(raw, &m) != nil || m.Module == "mesh-controller" {
-			continue // a manifest that does not read is the manifest checks' to refuse
-		}
-		for _, r := range m.Reads {
-			if strings.TrimSpace(r) != AssignmentsRead {
-				continue
-			}
-			reads[m.Module] = true
-			if !allowed[m.Module] {
-				found = append(found, fmt.Sprintf("%s reads %s: read where modules run from mesh-delivery-assigner.placement, "+
-					"the seat mesh-placement's (novox/hq ADR 0549 §3, ADR 0567); the lease write is refused while a module reads "+
-					"the assignments (ADR 0549 §6)", m.Module, AssignmentsRead))
-			}
-		}
-	}
-	for module := range allowed {
-		if !reads[module] {
-			found = append(found, fmt.Sprintf("%s names %s, which no longer reads %s: take it off the list, which only shrinks",
-				Allowed, module, AssignmentsRead))
-		}
-	}
-	return found, nil
-}
-
-// named collects the strings of a decoded manifest that start with one of the Prefixes.
-func named(v any, into []string) []string {
-	switch v := v.(type) {
-	case string:
-		for _, p := range Prefixes {
-			if strings.HasPrefix(v, p) {
-				return append(into, v)
-			}
-		}
-	case []any:
-		for _, e := range v {
-			into = named(e, into)
-		}
-	case map[string]any:
-		for _, e := range v {
-			into = named(e, into)
-		}
-	}
-	return into
-}
-
-func main() {
-	if len(os.Args) != 2 {
-		fmt.Fprintln(os.Stderr, "usage: noplacement <catalogue root>")
-		os.Exit(2)
-	}
-	found, err := Findings(os.Args[1])
-	if err != nil {
-		fmt.Println(err)
-		os.Exit(1)
-	}
-	for _, f := range found {
-		fmt.Println(f)
-	}
-	if len(found) > 0 {
-		os.Exit(1)
-	}
-	fmt.Println("no placement directory, no manifest reads the indexer's placement, and only the modules listed read the controller's assignments")
-}

checks/noplacement/main_test.go

@@ -1,88 +0,0 @@
-package main
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"git.novox.be/novox/mesh-catalog/checks/trunk"
-)
-
-func TestFindingsRefuseWhatThePlacementPathLeft(t *testing.T) {
-	for _, row := range []struct {
-		name  string
-		files map[string]string
-		want  string // empty: clean
-	}{
-		{"clean", map[string]string{"modules/a/module.json": `{"module":"a","reads":["mesh-delivery-assigner.placement"]}`}, ""},
-		{"a placement directory", map[string]string{"placement/ace.json": `{}`}, "placement: the repository holds no placement"},
-		{"a particulars file", map[string]string{"particulars": "ace\n"}, "particulars: the repository lists no node names"},
-		{"a read of the indexer's placement", map[string]string{"modules/a/module.json": `{"module":"a","reads":["mesh-delivery-indexer.placement"]}`}, `a: names "mesh-delivery-indexer.placement"`},
-		{"a read of its candidates", map[string]string{"modules/b/module.json": `{"module":"b","reads":["mesh-delivery-indexer.placement-candidates"]}`}, "placement-candidates"},
-		{"its event", map[string]string{"modules/c/module.json": `{"module":"c","on":[{"event":"mesh-delivery-indexer.placement-changed"}]}`}, "placement-changed"},
-		// Issue 774 (ADR 0549 §3, §6): a reader of the controller's assignments is refused unless the list names it, the
-		// controller's own manifest is not judged, and a name on the list whose module no longer reads them is refused.
-		{"an unlisted reader of the assignments", map[string]string{"modules/r/module.json": `{"module":"r","reads":["mesh-controller.assignments"]}`}, "r reads mesh-controller.assignments"},
-		{"a listed reader and the controller", map[string]string{"modules/l/module.json": `{"module":"l","reads":["mesh-controller.assignments"]}`,
-			"modules/mesh-controller/module.json": `{"module":"mesh-controller","reads":["mesh-controller.assignments"]}`, Allowed: "# why\nl  its plan\n"}, ""},
-		{"a listed module that reads them no more", map[string]string{Allowed: "gone  no longer reads\n"}, "names gone, which no longer reads"},
-		{"the seat's own state is allowed", map[string]string{"modules/d/module.json": `{"module":"d","reads":["mesh-placement.placement"]}`}, ""},
-	} {
-		t.Run(row.name, func(t *testing.T) {
-			root := t.TempDir()
-			for path, text := range row.files {
-				p := filepath.Join(root, path)
-				if err := os.MkdirAll(filepath.Dir(p), 0o755); err != nil {
-					t.Fatal(err)
-				}
-				if err := os.WriteFile(p, []byte(text), 0o644); err != nil {
-					t.Fatal(err)
-				}
-			}
-			got, err := Findings(root)
-			if err != nil {
-				t.Fatal(err)
-			}
-			if all := strings.Join(got, "\n"); (row.want == "") != (all == "") || !strings.Contains(all, row.want) {
-				t.Fatalf("findings = %q, want one containing %q", all, row.want)
-			}
-		})
-	}
-}
-
-// The script's run of this check over the real tree (novox/hq ADR 0529 clause 2).
-func TestTheCatalogueHoldsNoPlacementOfTheRepositoryPath(t *testing.T) {
-	got, err := Findings(filepath.Join("..", ".."))
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, f := range got {
-		t.Error(f)
-	}
-	// Issue 774 (ADR 0549 §3, §6; the comparison of novox/hq ADR 0529 clause 2): the list of modules still reading the
-	// controller's assignments gains none the trunk's copy at the merge base does not hold. Its first copy gains nothing.
-	path, ok := trunk.Copy(t, Allowed)
-	if !ok {
-		return
-	}
-	names := func(path string) map[string]bool {
-		raw, err := os.ReadFile(path)
-		if err != nil {
-			t.Fatal(err)
-		}
-		out := map[string]bool{}
-		for _, line := range strings.Split(string(raw), "\n") {
-			if f := strings.Fields(line); len(f) > 0 && !strings.HasPrefix(f[0], "#") {
-				out[f[0]] = true
-			}
-		}
-		return out
-	}
-	base := names(path)
-	for module := range names(filepath.Join("..", "..", Allowed)) {
-		if !base[module] {
-			t.Errorf("%s gains %s, which the trunk's copy does not hold: the list only shrinks", Allowed, module)
-		}
-	}
-}

checks/noplacement/reads-outside

@@ -1,6 +0,0 @@
-# What these tests read outside their package, as paths from the repository's root (a glob, or a directory read whole;
-# ? before a path whose absence is read). mesh-build-go hashes them into the package's digest, so its verdict is kept
-# until one of them changes (issue 1936). An empty list, or a line matching nothing, keeps nothing.
-# the root, for a placement directory, and every manifest, for a read of the indexer's placement states.
-?placement
-modules/*/module.json

checks/noscripts/go.mod

@@ -1,3 +0,0 @@
-module checks/noscripts
-
-go 1.22

checks/noscripts/noscripts_test.go

@@ -1,19 +0,0 @@
-package noscripts
-
-import (
-	"errors"
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-// The catalogue's checks are Go tests (novox/hq ADR 0529 clause 5, ADR 0445): the checker runs every nested Go module's tests by
-// the language's convention and no script at the root says what else to run. A script back at the root would be a check nobody
-// runs (ADR 0503 §3: since R4e the checker has not run them), so it is refused.
-func TestNoScriptOfTheOldCheckStandsAtTheRoot(t *testing.T) {
-	for _, name := range []string{"merge-check.sh", "merge-check-typescript.sh", "check-nested-modules.sh"} {
-		if _, err := os.Stat(filepath.Join("..", "..", name)); !errors.Is(err, os.ErrNotExist) {
-			t.Errorf("%s stands at the catalogue's root (%v): what it ran is a Go test in checks/ or a step of the build module", name, err)
-		}
-	}
-}

checks/noscripts/reads-outside

@@ -1,7 +0,0 @@
-# What these tests read outside their package, as paths from the repository's root (a glob, or a directory read whole;
-# ? before a path whose absence is read). mesh-build-go hashes them into the package's digest, so its verdict is kept
-# until one of them changes (issue 1936). An empty list, or a line matching nothing, keeps nothing.
-# that none of the old check scripts stands at the root.
-?merge-check.sh
-?merge-check-typescript.sh
-?check-nested-modules.sh

checks/owned/go.mod

@@ -1,7 +1,3 @@
 module git.novox.be/novox/mesh-catalog/checks/owned
 
 go 1.22
-
-require git.novox.be/novox/mesh-catalog/checks/trunk v0.0.0
-
-replace git.novox.be/novox/mesh-catalog/checks/trunk => ../trunk

checks/owned/main.go

@@ -11,23 +11,13 @@
 //     another module, after ${dir:<id>} is resolved within each module and both homes are read as one root.
 //     Archives are not containers for this rule. This holds for ~/.ssh what checks/sshdir held (ADR 0415 §6).
 //
-//  5. a directory that is, lies inside or holds a directory a system package owns under /var/lib, or any other
-//     resource inside one (issue 1841: pacman's state directory, placed with "place": ".", was /var/lib/pacman, the
-//     package manager's own database directory). A placed directory is resolved as the mesh resolves it with the
-//     default data root: "." is /var/lib/<module>, "mesh" /var/lib/mesh/<module>, neither /var/lib/<module>/<id>.
-//     The system directories are checks/owned/system, captured from a machine (pacman -Qo, /usr/lib/tmpfiles.d);
-//     checks/owned/system-known names the exceptions still to fix, by module, resource and issue. That list only
-//     shrinks: an entry that no longer collides is refused, and with -base one the trunk's copy does not hold.
-//
-//     go run . [-base <trunk's system-known>] <catalogue root>
+//     go run . <catalogue root>
 //
 // Exits 1 on a finding.
 package main
 
 import (
 	"encoding/json"
-	"errors"
-	"flag"
 	"fmt"
 	"os"
 	"path"
@@ -37,12 +27,6 @@ import (
 	"strings"
 )
 
-// The lists of rule 5, relative to the catalogue's root.
-const (
-	SystemList  = "checks/owned/system"
-	SystemKnown = "checks/owned/system-known"
-)
-
 // Home is the one root both machine homes are read as.
 const Home = "${home}"
 
@@ -59,9 +43,9 @@ type Finding struct {
 }
 
 type resource struct {
-	ID, Type, Path, Unknown, Place string
-	Knows                          []string
-	HasKnows                       bool
+	ID, Type, Path, Unknown string
+	Knows                   []string
+	HasKnows                bool
 }
 
 type parsed struct {
@@ -81,7 +65,6 @@ func load(file string) (*parsed, error) {
 			ID      string   `json:"id"`
 			Type    string   `json:"type"`
 			Path    string   `json:"path"`
-			Place   string   `json:"place"`
 			Unknown *string  `json:"unknown"`
 			Knows   []string `json:"knows"`
 		} `json:"resources"`
@@ -98,7 +81,7 @@ func load(file string) (*parsed, error) {
 		out.Module = filepath.Base(filepath.Dir(file))
 	}
 	for _, r := range m.Resources {
-		x := resource{ID: r.ID, Type: r.Type, Path: r.Path, Place: r.Place, Knows: r.Knows, HasKnows: r.Knows != nil}
+		x := resource{ID: r.ID, Type: r.Type, Path: r.Path, Knows: r.Knows, HasKnows: r.Knows != nil}
 		if r.Unknown != nil {
 			x.Unknown = *r.Unknown
 			if x.Unknown == "" {
@@ -160,23 +143,14 @@ type declared struct {
 }
 
 // Check reads every manifest under root/modules and answers what it refuses.
-func Check(root string, base []string) ([]Finding, error) {
+func Check(root string) ([]Finding, error) {
 	files, err := filepath.Glob(filepath.Join(root, "modules", "*", "module.json"))
 	if err != nil {
 		return nil, err
 	}
 	sort.Strings(files)
-	system, err := readSystem(filepath.Join(root, SystemList))
-	if err != nil {
-		return nil, err
-	}
-	known, err := readLines(filepath.Join(root, SystemKnown))
-	if err != nil && !errors.Is(err, os.ErrNotExist) {
-		return nil, err
-	}
 	var out []Finding
 	var paths []declared
-	collided := map[string]bool{}
 	type container struct{ module, path string }
 	var containers []container
 	for _, file := range files {
@@ -196,7 +170,6 @@ func Check(root string, base []string) ([]Finding, error) {
 				dirs[r.ID] = "/placed/" + m.Module + "/" + r.ID
 			}
 		}
-		out = append(out, inSystem(m, system, known, collided)...)
 		for _, r := range m.Resources {
 			p := norm(r.Path, dirs)
 			if p != "" {
@@ -239,28 +212,6 @@ func Check(root string, base []string) ([]Finding, error) {
 			}
 		}
 	}
-	for _, k := range known {
-		if !collided[k] {
-			module, id, _ := strings.Cut(k, " ")
-			id, _, _ = strings.Cut(id, " ")
-			out = append(out, Finding{5, module, id, fmt.Sprintf("is listed in %s, and no longer lies in a system "+
-				"package's directory: take the line out, so the list only shrinks", SystemKnown)})
-		}
-	}
-	if base != nil {
-		held := map[string]bool{}
-		for _, b := range base {
-			held[b] = true
-		}
-		for _, k := range known {
-			if !held[k] {
-				module, id, _ := strings.Cut(k, " ")
-				id, _, _ = strings.Cut(id, " ")
-				out = append(out, Finding{5, module, id, fmt.Sprintf("is a new line in %s, which the trunk's copy "+
-					"does not hold: a module's directory is placed outside a system package's, never listed", SystemKnown)})
-			}
-		}
-	}
 	for _, d := range paths {
 		for _, c := range containers {
 			if c.module != d.module && (d.path == c.path || strings.HasPrefix(d.path, c.path+"/")) {
@@ -271,140 +222,21 @@ func Check(root string, base []string) ([]Finding, error) {
 	return out, nil
 }
 
-// systemDir is one directory a system package owns, and what says so.
-type systemDir struct{ Path, Source string }
-
-// readLines is a list's lines, without comments and blank lines.
-func readLines(file string) ([]string, error) {
-	raw, err := os.ReadFile(file)
-	if err != nil {
-		return nil, err
-	}
-	var lines []string
-	for _, line := range strings.Split(string(raw), "\n") {
-		if line = strings.TrimSpace(line); line != "" && !strings.HasPrefix(line, "#") {
-			lines = append(lines, line)
-		}
-	}
-	return lines, nil
-}
-
-// readSystem is the list of system directories: "<absolute path> <package>: <how it was read>" per line. Absent or
-// empty, the check fails: a list that says nothing would let every module through.
-func readSystem(file string) ([]systemDir, error) {
-	lines, err := readLines(file)
-	if err != nil {
-		return nil, fmt.Errorf("rule 5 reads the system packages' directories from %s: %w", file, err)
-	}
-	if len(lines) == 0 {
-		return nil, fmt.Errorf("%s names no system package's directory, so rule 5 would pass everything", file)
-	}
-	var out []systemDir
-	for _, line := range lines {
-		p, source, _ := strings.Cut(line, " ")
-		if !strings.HasPrefix(p, "/var/lib/") || strings.TrimSpace(source) == "" {
-			return nil, fmt.Errorf("%s: %q is not \"/var/lib/<directory> <package>: <how it was read>\"", file, line)
-		}
-		out = append(out, systemDir{path.Clean(p), strings.TrimSpace(source)})
-	}
-	return out, nil
-}
-
-// placedAt is where the mesh places a pathless directory with the default data root (mesh-sdk catalogue dirsFor).
-func placedAt(module string, r resource) string {
-	switch r.Place {
-	case ".":
-		return "/var/lib/" + module
-	case "mesh":
-		return "/var/lib/mesh/" + module
-	}
-	return "/var/lib/" + module + "/" + r.ID
-}
-
-// inSystem is rule 5 for one module: each resource whose resolved path collides with a system package's directory,
-// unless system-known lists it (then it is marked collided, so a stale line is found).
-func inSystem(m *parsed, system []systemDir, known []string, collided map[string]bool) []Finding {
-	real := map[string]string{}
-	for _, r := range m.Resources {
-		if r.Type == "directory" && r.Path == "" && r.ID != "" {
-			real[r.ID] = placedAt(m.Module, r)
-		}
-	}
-	for _, r := range m.Resources {
-		if r.ID != "" && r.Path != "" {
-			real[r.ID] = r.Path
-		}
-	}
-	var out []Finding
-	for _, r := range m.Resources {
-		p := ""
-		if r.Path != "" {
-			p = norm(r.Path, real)
-		} else if r.Type == "directory" {
-			p = real[r.ID]
-		}
-		if !strings.HasPrefix(p, "/") {
-			continue
-		}
-		for _, s := range system {
-			inside := p == s.Path || strings.HasPrefix(p, s.Path+"/")
-			holds := r.Type == "directory" && strings.HasPrefix(s.Path, p+"/")
-			if !inside && !holds {
-				continue
-			}
-			listed := ""
-			for _, k := range known {
-				if strings.HasPrefix(k, m.Module+" "+r.ID+" ") || k == m.Module+" "+r.ID {
-					listed = k
-				}
-			}
-			if listed != "" {
-				collided[listed] = true
-				break
-			}
-			how := "is or lies inside"
-			if holds {
-				how = "holds"
-			}
-			out = append(out, Finding{5, m.Module, r.ID, fmt.Sprintf("resolves to %q, which %s %s, the directory of the "+
-				"system package %s; place it under /var/lib/mesh/%s (\"place\": \"mesh\") or a path of its own", p, how,
-				s.Path, s.Source, m.Module)})
-			break
-		}
-	}
-	return out
-}
-
 func main() {
-	baseFile := flag.String("base", "", "the trunk's copy of "+SystemKnown+": a line it does not hold is refused")
-	flag.Parse()
 	root := "."
-	if flag.NArg() > 0 {
-		root = flag.Arg(0)
+	if len(os.Args) > 1 {
+		root = os.Args[1]
 	}
-	var base []string
-	if *baseFile != "" {
-		lines, err := readLines(*baseFile)
-		if err != nil {
-			fmt.Fprintln(os.Stderr, err)
-			os.Exit(1)
-		}
-		base = append([]string{}, lines...)
-	}
-	found, err := Check(root, base)
+	found, err := Check(root)
 	if err != nil {
 		fmt.Fprintln(os.Stderr, err)
 		os.Exit(1)
 	}
 	for _, f := range found {
-		cite := "novox/hq ADR 0422 §8, issue 1024"
-		if f.Rule == 5 {
-			cite = "issue 1841"
-		}
-		fmt.Printf("%s: %s: %s (rule %d, %s)\n", f.Module, f.ID, f.Why, f.Rule, cite)
+		fmt.Printf("%s: %s: %s (rule %d, novox/hq ADR 0422 §8, issue 1024)\n", f.Module, f.ID, f.Why, f.Rule)
 	}
 	if len(found) > 0 {
 		os.Exit(1)
 	}
-	fmt.Println("owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory, or in a system package's")
+	fmt.Println("owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory")
 }

checks/owned/main_test.go

@@ -20,10 +20,7 @@ func manifest(t *testing.T, root, module, body string) {
 
 func check(t *testing.T, root string) []Finding {
 	t.Helper()
-	if _, err := os.Stat(filepath.Join(root, SystemList)); os.IsNotExist(err) {
-		lists(t, root, "/var/lib/pacman pacman: pacman -Qo\n", "")
-	}
-	found, err := Check(root, nil)
+	found, err := Check(root)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -38,20 +35,6 @@ func only(t *testing.T, found []Finding, rule int, module, id string) {
 	}
 }
 
-// lists writes the catalogue's list of system directories and its known exceptions.
-func lists(t *testing.T, root, system, known string) {
-	t.Helper()
-	if err := os.MkdirAll(filepath.Join(root, "checks", "owned"), 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(root, SystemList), []byte(system), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(root, SystemKnown), []byte(known), 0o644); err != nil {
-		t.Fatal(err)
-	}
-}
-
 func dir(id, path, rest string) string {
 	return `{"id":"` + id + `","type":"directory","path":"` + path + `"` + rest + `}`
 }
@@ -162,87 +145,3 @@ func TestPlacedDirectoriesOfTwoModulesAreTheirOwn(t *testing.T) {
 		t.Fatalf("refused %+v", found)
 	}
 }
-
-// 1841/AC18: a module's directory that resolves to a /var/lib directory a system package owns, lies inside one or
-// holds one, is refused, whether placed (place ".", or by default beneath the module's own) or stated; a placed
-// directory saying place "mesh" lies under /var/lib/mesh and passes (issue 1841: pacman's state was /var/lib/pacman).
-func TestADirectoryOfASystemPackageIsRefused(t *testing.T) {
-	system := "/var/lib/pacman pacman: pacman -Qo\n/var/lib/systemd/coredump systemd: tmpfiles.d/systemd.conf\n"
-	for name, resources := range map[string][]string{
-		"placed-own":     {`{"id":"state","type":"directory","place":".","unknown":"program"}`},
-		"placed-beneath": {`{"id":"coredump","type":"directory","unknown":"program"}`},
-		"stated-inside":  {dir("d", "/var/lib/pacman/keeper", `,"unknown":"program"`)},
-		"stated-holding": {dir("d", "/var/lib/systemd", `,"unknown":"program"`)},
-		"file-inside": {`{"id":"state","type":"directory","place":"mesh","unknown":"program"}`,
-			`{"id":"f","type":"file","path":"/var/lib/pacman/keeper.json"}`},
-	} {
-		module := map[string]string{"placed-own": "pacman", "placed-beneath": "systemd"}[name]
-		if module == "" {
-			module = "keeper"
-		}
-		root := t.TempDir()
-		lists(t, root, system, "")
-		manifest(t, root, module, mod(module, resources...))
-		found := check(t, root)
-		if len(found) != 1 || found[0].Rule != 5 || found[0].Module != module ||
-			!strings.Contains(found[0].Why, "/var/lib/") || !strings.Contains(found[0].Why, "package") {
-			t.Errorf("%s: found %+v; want one finding of rule 5 for %s naming the path and the package", name, found, module)
-		}
-	}
-	root := t.TempDir()
-	lists(t, root, system, "")
-	manifest(t, root, "pacman", mod("pacman",
-		`{"id":"state","type":"directory","place":"mesh","unknown":"program"}`,
-		`{"id":"f","type":"file","path":"${dir:state}/keeper.json"}`,
-		dir("other", "/var/lib/pacman-other", `,"unknown":"program"`)))
-	if found := check(t, root); len(found) != 0 {
-		t.Fatalf("a directory under /var/lib/mesh/pacman was refused: %+v", found)
-	}
-}
-
-// 1841/AC18: a known exception passes; one that no longer collides is refused, so the list only shrinks; one the trunk's
-// copy does not hold is refused; and an absent list of system directories fails the check rather than passing it.
-func TestKnownSystemExceptionsOnlyShrink(t *testing.T) {
-	system := "/var/lib/systemd systemd: tmpfiles.d/systemd.conf\n"
-	known := "# comment\nsystemd state issue 1873\n"
-	root := t.TempDir()
-	lists(t, root, system, known)
-	manifest(t, root, "systemd", mod("systemd", `{"id":"state","type":"directory","place":".","unknown":"program"}`))
-	if found := check(t, root); len(found) != 0 {
-		t.Fatalf("a known exception was refused: %+v", found)
-	}
-	if found, err := Check(root, []string{"systemd state issue 1873"}); err != nil || len(found) != 0 {
-		t.Fatalf("a known exception held by the trunk was refused: %+v %v", found, err)
-	}
-	if found, err := Check(root, []string{}); err != nil || len(found) != 1 || found[0].Rule != 5 {
-		t.Fatalf("an exception the trunk does not hold passed: %+v %v", found, err)
-	}
-
-	manifest(t, root, "systemd", mod("systemd", `{"id":"state","type":"directory","place":"mesh","unknown":"program"}`))
-	only(t, check(t, root), 5, "systemd", "state")
-
-	root = t.TempDir()
-	manifest(t, root, "a", mod("a"))
-	if err := os.MkdirAll(filepath.Join(root, "checks", "owned"), 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(root, SystemList), []byte("# nothing\n"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := Check(root, nil); err == nil {
-		t.Fatal("an empty list of system directories passed")
-	}
-}
-
-// 1841/AC18: the catalogue as it stands passes rule 5 with its own lists.
-func TestTheCatalogueKeepsOutOfSystemDirectories(t *testing.T) {
-	found, err := Check("../..", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, f := range found {
-		if f.Rule == 5 {
-			t.Errorf("%s: %s: %s", f.Module, f.ID, f.Why)
-		}
-	}
-}

checks/owned/reads-outside

@@ -1,5 +0,0 @@
-# What these tests read outside their package, as paths from the repository's root (a glob, or a directory read whole;
-# ? before a path whose absence is read). mesh-build-go hashes them into the package's digest, so its verdict is kept
-# until one of them changes (issue 1936). An empty list, or a line matching nothing, keeps nothing.
-# Check("../.."): every manifest; its lists are this package's own files.
-modules/*/module.json

checks/owned/realtree_test.go

@@ -1,41 +0,0 @@
-package main
-
-import (
-	"testing"
-
-	"git.novox.be/novox/mesh-catalog/checks/trunk"
-)
-
-// The script's run of this check over the real tree (novox/hq ADR 0529 clause 2): every rule holds.
-func TestTheCatalogueKeepsEveryRuleOfOwnedPaths(t *testing.T) {
-	found, err := Check("../..", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, f := range found {
-		t.Errorf("%s: %s: %s (rule %d, novox/hq ADR 0422 §8)", f.Module, f.ID, f.Why, f.Rule)
-	}
-}
-
-// And the list of system directories' known exceptions holds no line the trunk's copy at the merge base does not (rule 5). A trunk
-// with none had no list: its first copy. Skipped, and said, where no trunk is beside.
-func TestTheSystemListHoldsNoLineTheTrunksDoesNot(t *testing.T) {
-	path, ok := trunk.Copy(t, "checks/owned/system-known")
-	var base []string
-	if ok {
-		lines, err := readLines(path)
-		if err != nil {
-			t.Fatal(err)
-		}
-		base = append([]string{}, lines...)
-	}
-	found, err := Check("../..", base)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, f := range found {
-		if f.Rule == 5 {
-			t.Errorf("%s: %s: %s (rule %d, issue 1841)", f.Module, f.ID, f.Why, f.Rule)
-		}
-	}
-}

checks/owned/system

@@ -1,23 +0,0 @@
-# The directories under /var/lib that a system package owns (rule 5 of checks/owned, issue 1841). A module's
-# directory, placed or stated, may not be one of these, lie inside one or hold one: the package's program and the
-# package manager keep their own files there, and the node-engine would judge, chmod or chown the directory.
-#
-# One line per directory: "<path> <package>: <how it was read>". Captured on the workstation on 2026-10-22, through
-# the mesh: pacman's own database by `pacman -Qo` (pacman_owns), the rest from the `d`, `D` and `Q` lines of
-# /usr/lib/tmpfiles.d (node-reads.search for "/var/lib/"). A directory found to belong to a package is added here.
-/var/lib/pacman pacman: pacman -Qo /var/lib/pacman/ (pacman 7.1.0)
-/var/lib/alsa alsa-utils: tmpfiles.d/alsa-utils.conf
-/var/lib/colord colord: tmpfiles.d/colord.conf
-/var/lib/containers podman: tmpfiles.d/podman.conf
-/var/lib/dbus dbus: tmpfiles.d/dbus.conf
-/var/lib/geoclue geoclue: tmpfiles.d/geoclue.conf
-/var/lib/lastlog util-linux: tmpfiles.d/lastlog2.conf
-/var/lib/libuuid util-linux: tmpfiles.d/uuidd.conf
-/var/lib/machines systemd: tmpfiles.d/systemd-nspawn.conf
-/var/lib/openvpn/chroot networkmanager-openvpn: tmpfiles.d/nm-openvpn-tmpfiles.conf
-/var/lib/portables systemd: tmpfiles.d/portables.conf
-/var/lib/postgres postgresql: tmpfiles.d/postgresql.conf
-/var/lib/private systemd: tmpfiles.d/systemd.conf
-/var/lib/rpcbind rpcbind: tmpfiles.d/rpcbind.conf
-/var/lib/systemd systemd: tmpfiles.d/systemd.conf
-/var/lib/tpm2-tss/system/keystore tpm2-tss: tmpfiles.d/tpm2-tss-fapi.conf

checks/owned/system-known

@@ -1,5 +0,0 @@
-# Modules whose directory lies in a system package's directory today (rule 5 of checks/owned, issue 1841), each with
-# the issue that moves it out: "<module> <resource id> issue <number>". This list only shrinks: a line whose module
-# no longer collides is refused, and so is a line the trunk's copy does not hold.
-postgres state issue 1873
-systemd state issue 1873

checks/particulars/covered

@@ -1,3 +0,0 @@
-# The modules the check covers (novox/hq ADR 0507 §9, issue 1838), one a line; issue 1838 widens it.
-pacman
-kernel

checks/particulars/go.mod

@@ -1,3 +0,0 @@
-module git.novox.be/novox/mesh-catalog/checks/particulars
-
-go 1.22

checks/particulars/main.go

@@ -1,174 +0,0 @@
-// Command particulars keeps this mesh's node names out of the modules it covers (novox/hq ADR 0507 §9,
-// issue 1838): a module is for any mesh, so no manifest, file, code string, identifier, comment, test name or
-// fixture of a covered module names a node of this one.
-//
-// The names are the mesh's own, not the repository's: the checker hands them in the environment value
-// MESH_NODE_NAMES, comma-separated, from the node records it reads (novox/hq ADR 0567 §16). A run with none fails
-// loudly, since it would pass on anything. The modules covered are in `covered` at checks/particulars/covered, one a line. A name is matched
-// whole and in any case; a hyphen, an underscore or a CamelCase boundary parts one, so a longer word holding a name is another word.
-// The forge is not a node name: its host (git.novox.be) and the organisation path (novox/<repo>) are blanked
-// before a line is read.
-//
-//	go run . <catalogue root>
-//
-// Exits 1 naming file:line and the word, 2 when a list cannot be read.
-package main
-
-import (
-	"bufio"
-	"bytes"
-	"fmt"
-	"io/fs"
-	"os"
-	"path/filepath"
-	"regexp"
-	"sort"
-	"strings"
-)
-
-// forge is the forge's host and organisation path, blanked before a line is read; a path segment novox/ elsewhere
-// (testdata/novox/x, /srv/novox/data) is not blanked.
-var forge = regexp.MustCompile(`(?i)git\.novox\.be(?:/novox/[\w.-]+)?|(?:^|[^/\w.-])novox/[\w.-]+`)
-
-func main() {
-	root := "."
-	if len(os.Args) > 1 {
-		root = os.Args[1]
-	}
-	os.Exit(check(root, namesFromEnv()))
-}
-
-// NamesEnv is the environment value that carries the mesh's node names (mesh-sdk delivery.NodeNamesEnv).
-const NamesEnv = "MESH_NODE_NAMES"
-
-// namesFromEnv is the names NamesEnv holds, comma-separated, trimmed, empty entries left out.
-func namesFromEnv() []string {
-	var out []string
-	for _, n := range strings.Split(os.Getenv(NamesEnv), ",") {
-		if n = strings.TrimSpace(n); n != "" {
-			out = append(out, n)
-		}
-	}
-	return out
-}
-
-// check runs the check over a catalogue and returns the exit code: 0 clean, 1 a finding, 2 a list unreadable.
-func check(root string, names []string) int {
-	var err error
-	if len(names) == 0 {
-		err = fmt.Errorf("no node names (%s is empty) — the check would pass on anything", NamesEnv)
-	}
-	var covered []string
-	if err == nil {
-		covered, err = readList(filepath.Join(root, "checks/particulars/covered"))
-		if err == nil && len(covered) == 0 {
-			err = fmt.Errorf("covered lists no module — the check would pass on anything")
-		}
-	}
-	if err != nil {
-		fmt.Fprintln(os.Stderr, "particulars:", err)
-		return 2
-	}
-	findings, err := run(root, names, covered)
-	if err != nil {
-		fmt.Fprintln(os.Stderr, "particulars:", err)
-		return 2
-	}
-	for _, f := range findings {
-		fmt.Println(f)
-	}
-	if len(findings) > 0 {
-		fmt.Printf("particulars: %d node name(s) in a module for any mesh (novox/hq ADR 0507 §9) — say what it shows, not where it was seen\n", len(findings))
-		return 1
-	}
-	fmt.Printf("particulars: none of %d node names in the %d covered modules\n", len(names), len(covered))
-	return 0
-}
-
-// readList reads a list: one entry a line; blank lines and lines starting with # are not entries.
-func readList(path string) ([]string, error) {
-	f, err := os.Open(path)
-	if err != nil {
-		return nil, err
-	}
-	defer f.Close()
-	var out []string
-	sc := bufio.NewScanner(f)
-	for sc.Scan() {
-		line := strings.TrimSpace(sc.Text())
-		if line == "" || strings.HasPrefix(line, "#") {
-			continue
-		}
-		out = append(out, line)
-	}
-	return out, sc.Err()
-}
-
-// run reads every text file of each covered module and returns the findings, sorted.
-func run(root string, names, covered []string) ([]string, error) {
-	var out []string
-	for _, m := range covered {
-		dir := filepath.Join(root, "modules", m)
-		err := filepath.WalkDir(dir, func(path string, d fs.DirEntry, err error) error {
-			if err != nil {
-				return err
-			}
-			if d.IsDir() {
-				switch d.Name() {
-				case "node_modules", "dist", "vendor", ".git":
-					return filepath.SkipDir
-				}
-				return nil
-			}
-			rel, _ := filepath.Rel(root, path)
-			// A path is read too: a testdata directory named after a node is a finding.
-			for _, n := range hits(filepath.ToSlash(rel), names) {
-				out = append(out, fmt.Sprintf("%s:0: node name %q in the path", filepath.ToSlash(rel), n))
-			}
-			if d.Name() == "go.sum" {
-				return nil
-			}
-			b, err := os.ReadFile(path)
-			if err != nil {
-				return err
-			}
-			if bytes.IndexByte(b, 0) >= 0 {
-				return nil
-			}
-			out = append(out, scan(filepath.ToSlash(rel), string(b), names)...)
-			return nil
-		})
-		if err != nil {
-			return nil, err
-		}
-	}
-	sort.Strings(out)
-	return out, nil
-}
-
-// scan returns a finding for each node name in src, whole-word and in any case.
-func scan(file, src string, names []string) []string {
-	var out []string
-	for i, line := range strings.Split(src, "\n") {
-		for _, n := range hits(line, names) {
-			out = append(out, fmt.Sprintf("%s:%d: node name %q — %s", file, i+1, n, strings.Join(strings.Fields(line), " ")))
-		}
-	}
-	return out
-}
-
-// hits returns the node names one line holds: as a word (a hyphen or underscore parts it), as a part of a
-// CamelCase identifier (TestAce, novoxTree), the forge's host and organisation path blanked first.
-func hits(line string, names []string) []string {
-	line = forge.ReplaceAllStringFunc(line, func(s string) string { return strings.Repeat(" ", len(s)) })
-	var out []string
-	for _, n := range names {
-		q := regexp.QuoteMeta(n)
-		camel := regexp.QuoteMeta(strings.ToUpper(n[:1]) + n[1:])
-		rx := regexp.MustCompile(`(?i:(?:^|[^A-Za-z0-9])` + q + `(?:$|[^A-Za-z0-9]))|[a-z0-9]` + camel + `(?:$|[^a-z])|(?:^|[^A-Za-z0-9])` + q + `[A-Z0-9]`)
-		if rx.MatchString(line) {
-			out = append(out, strings.ToLower(n))
-		}
-	}
-	return out
-}

checks/particulars/main_test.go

@@ -1,124 +0,0 @@
-package main
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-var names = []string{"novox", "ace", "shanks", "g14"}
-
-func TestANodeNameIsRefusedWhereItIsWritten(t *testing.T) {
-	cases := map[string]struct{ file, src string }{
-		"manifest string": {"modules/kernel/module.json", "{\n \"description\": \"as on Shanks\"\n}\n"},
-		"file line":       {"modules/kernel/files/boot.sh", "#!/bin/sh\necho run on g14\n"},
-		"go identifier":   {"modules/kernel/cmd/x/a.go", "package main\n\nfunc novox() {}\n"},
-		"test name":       {"modules/kernel/cmd/x/a_test.go", "package main\n\nfunc TestAce(t *testing.T) {}\n\nfunc TestOnAce_x(t *testing.T) {}\n"},
-	}
-	for name, c := range cases {
-		if got := scan(c.file, c.src, names); len(got) == 0 {
-			t.Errorf("%s: %q not refused", name, c.src)
-		}
-	}
-}
-
-func TestTheFindingNamesTheLineAndTheWord(t *testing.T) {
-	got := scan("f.sh", "a\nb\nrun on ACE now\n", names)
-	if len(got) != 1 || !strings.HasPrefix(got[0], "f.sh:3:") || !strings.Contains(got[0], "ace") {
-		t.Errorf("got %v", got)
-	}
-}
-
-func TestTheForgeIsNotANodeName(t *testing.T) {
-	for _, s := range []string{
-		"see novox/hq issue 5",
-		"module git.novox.be/novox/mesh-sdk/go v1.2.3",
-		"https://git.novox.be/novox/mesh-catalog",
-		"git.novox.be",
-		"space trace surface grace g14x",
-	} {
-		if got := scan("f", s, names); len(got) != 0 {
-			t.Errorf("%q refused: %v", s, got)
-		}
-	}
-}
-
-func TestANodeNameInAPathOrJoinedIsRefused(t *testing.T) {
-	for _, s := range []string{
-		"modules/kernel/testdata/novox/meminfo",
-		"/srv/novox/data",
-		"testdata/shanks-meminfo.txt",
-		"on-shanks",
-		"shanks-desktop",
-		"mesh-novox",
-		"func novoxTree() {}",
-		"aceFiles := 1",
-		"g14Meminfo := 2",
-		"novox_tree := 3",
-	} {
-		if got := scan("f", s, names); len(got) == 0 {
-			t.Errorf("%q not refused", s)
-		}
-	}
-}
-
-func TestANodeNamedPathIsRefusedThroughRun(t *testing.T) {
-	root := t.TempDir()
-	p := filepath.Join(root, "modules/kernel/testdata/ace/x")
-	os.MkdirAll(filepath.Dir(p), 0o755)
-	os.WriteFile(p, []byte("clean\n"), 0o644)
-	got, err := run(root, names, []string{"kernel"})
-	if err != nil || len(got) != 1 || !strings.HasPrefix(got[0], "modules/kernel/testdata/ace/x:0: ") {
-		t.Errorf("got %v, %v", got, err)
-	}
-}
-
-func TestCheckReturnsOneOnAFindingAndTwoOnNoNames(t *testing.T) {
-	root := t.TempDir()
-	write := func(p, s string) {
-		p = filepath.Join(root, p)
-		os.MkdirAll(filepath.Dir(p), 0o755)
-		os.WriteFile(p, []byte(s), 0o644)
-	}
-	write("checks/particulars/covered", "kernel\n")
-	write("modules/kernel/a", "clean\n")
-	if got := check(root, []string{"ace"}); got != 0 {
-		t.Errorf("clean = %d, want 0", got)
-	}
-	write("modules/kernel/a", "on ace\n")
-	if got := check(root, []string{"ace"}); got != 1 {
-		t.Errorf("finding = %d, want 1", got)
-	}
-	if got := check(root, nil); got != 2 {
-		t.Errorf("no names = %d, want 2", got)
-	}
-}
-
-func TestOnlyCoveredModulesAreRead(t *testing.T) {
-	root := t.TempDir()
-	write := func(p, s string) {
-		p = filepath.Join(root, p)
-		os.MkdirAll(filepath.Dir(p), 0o755)
-		os.WriteFile(p, []byte(s), 0o644)
-	}
-	write("modules/kernel/files/a", "on novox\n")
-	write("modules/other/files/a", "on novox\n")
-	got, err := run(root, names, []string{"kernel"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(got) != 1 || !strings.Contains(got[0], "modules/kernel/files/a:1") {
-		t.Errorf("got %v", got)
-	}
-}
-
-// The script's run of this check over the real tree (novox/hq ADR 0529 clause 2): no node name of this mesh in a covered module.
-func TestTheCoveredModulesNameNoNode(t *testing.T) {
-	if _, set := os.LookupEnv(NamesEnv); !set {
-		t.Skip("ADR 0567 §16: this checker hands no node names (before D14 is delivered); the skip goes once it is")
-	}
-	if code := check("../..", namesFromEnv()); code != 0 {
-		t.Fatalf("the check of the real catalogue exits %d (see what it printed above)", code)
-	}
-}

checks/particulars/reads-outside

@@ -1,5 +0,0 @@
-# What these tests read outside their package, as paths from the repository's root (a glob, or a directory read whole;
-# ? before a path whose absence is read). mesh-build-go hashes them into the package's digest, so its verdict is kept
-# until one of them changes (issue 1936). An empty list, or a line matching nothing, keeps nothing.
-# check("../.."): every file of the modules the covered list names. The node names come from the run (MESH_NODE_NAMES).
-modules

checks/paths/go.mod

@@ -1,7 +1,3 @@
 module git.novox.be/novox/mesh-catalog/checks/paths
 
 go 1.22
-
-require git.novox.be/novox/mesh-catalog/checks/trunk v0.0.0
-
-replace git.novox.be/novox/mesh-catalog/checks/trunk => ../trunk

checks/paths/main.go

@@ -251,8 +251,7 @@ func main() {
 	}
 	var grown []string
 	if baseDir == "" {
-		fmt.Fprintln(os.Stderr, "NOT COMPARED: no base branch's lists were given (-base <dir>), so additions to them were not judged; that is a failure, not a pass (issue 1295)")
-		os.Exit(2)
+		fmt.Println("NOT COMPARED: no base branch's lists were given, so additions to them were not judged")
 	} else {
 		baseShared, _, err1 := list(filepath.Join(baseDir, "shared"))
 		baseKnown, _, err2 := list(filepath.Join(baseDir, "known"))

checks/paths/reads-outside

@@ -1,5 +0,0 @@
-# What these tests read outside their package, as paths from the repository's root (a glob, or a directory read whole;
-# ? before a path whose absence is read). mesh-build-go hashes them into the package's digest, so its verdict is kept
-# until one of them changes (issue 1936). An empty list, or a line matching nothing, keeps nothing.
-# Check("../.."): every manifest and every file of a module.
-modules

checks/paths/realtree_test.go

@@ -1,63 +0,0 @@
-package main
-
-import (
-	"path/filepath"
-	"testing"
-
-	"git.novox.be/novox/mesh-catalog/checks/trunk"
-)
-
-// The script's run of this check over the real tree (novox/hq ADR 0529 clause 2): no module names another's state on its machine,
-// and the known list holds only what still occurs.
-func TestNoModuleNamesAnothersState(t *testing.T) {
-	root := filepath.Join("..", "..")
-	found, err := Check(root)
-	if err != nil {
-		t.Fatal(err)
-	}
-	shared, _, err := list("shared")
-	if err != nil {
-		t.Fatal(err)
-	}
-	known, _, err := list("known")
-	if err != nil {
-		t.Fatal(err)
-	}
-	refused, gone := Judge(found, shared, known)
-	for _, f := range refused {
-		t.Error(f)
-	}
-	for _, k := range gone {
-		t.Errorf("%q is in checks/paths/known and no longer occurs: take it out, so it cannot come back", k)
-	}
-}
-
-// And neither list gains a line the trunk's copies at the merge base do not hold, unless the line says why after `# allow:`. Fails, saying
-// NOT COMPARED, where no trunk is beside (issue 1295).
-func TestTheListsOfPathsHoldNoLineTheTrunksDoNot(t *testing.T) {
-	sharedPath, okShared := trunk.Copy(t, "checks/paths/shared")
-	knownPath, okKnown := trunk.Copy(t, "checks/paths/known")
-	if !okShared || !okKnown {
-		t.Log("the trunk holds not both lists: their first copies, to which nothing was added")
-		return
-	}
-	shared, sharedWhy, err := list("shared")
-	if err != nil {
-		t.Fatal(err)
-	}
-	known, knownWhy, err := list("known")
-	if err != nil {
-		t.Fatal(err)
-	}
-	baseShared, _, err := list(sharedPath)
-	if err != nil {
-		t.Fatal(err)
-	}
-	baseKnown, _, err := list(knownPath)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, g := range append(Grown("shared", shared, sharedWhy, baseShared), Grown("known", known, knownWhy, baseKnown)...) {
-		t.Error(g)
-	}
-}

checks/paths/shared

@@ -1,4 +1,3 @@
 # Paths every program on a machine reads as the machine's own, not as a message from the module that
 # writes them (checks/paths, novox/hq ADR 0260). One per line, with why.
 /etc/hosts  # every resolver on the machine reads it; the hostname module writes it for all of them
-/var/lib/mesh-build-node-cache  # allow: the Go build module gives its integration level the node's installed Node toolchains read-only, so the Node build module's tests build offline (issue 1891, ADR 0533)

checks/planhands/go.mod

@@ -1,3 +0,0 @@
-module checks/planhands
-
-go 1.26.0

checks/planhands/planhands.go

@@ -1,48 +0,0 @@
-// Package planhands refuses a module's line that takes a plan existing for its module handed to the provisioner (issue
-// 774). Whether a plan hands its module is mesh-sdk's one rule, catalogue.Plan.Hands: since the seat mesh-provisioner keys a
-// provision its provider's helper answers for a module not handed, a plan naming provisions alone exists for modules
-// whose files and own secrets stay their node's (on 2026-10-30 the vault read every such plan as handed and answered
-// twenty modules' own secrets to nobody, and the provisioner client refused each as a plan it could not act on). A line
-// that tests whether a plan exists either asks Hands on the same line, or says "not handing": it reads only who binds
-// whom, or that there is no plan at all.
-package planhands
-
-import (
-	"fmt"
-	"io/fs"
-	"os"
-	"path/filepath"
-	"regexp"
-	"sort"
-	"strings"
-)
-
-// existence is a test of whether an assignment's or a plan's `provisioning` is there: nil, or an empty raw value.
-var existence = regexp.MustCompile(`Provisioning\s*[!=]=\s*nil|len\([^)]*Provisioning\)\s*[!=]=\s*0`)
-
-// Problems is each such line under root's modules/ that neither asks Hands nor says "not handing", as
-// `path:line: text`, sorted. Test files are left out: a test may build a plan by hand.
-func Problems(root string) ([]string, error) {
-	var out []string
-	err := filepath.WalkDir(filepath.Join(root, "modules"), func(p string, d fs.DirEntry, err error) error {
-		if err != nil {
-			return err
-		}
-		if d.IsDir() || !strings.HasSuffix(p, ".go") || strings.HasSuffix(p, "_test.go") {
-			return nil
-		}
-		raw, err := os.ReadFile(p)
-		if err != nil {
-			return err
-		}
-		rel, _ := filepath.Rel(root, p)
-		for i, line := range strings.Split(string(raw), "\n") {
-			if existence.MatchString(line) && !strings.Contains(line, ".Hands()") && !strings.Contains(line, "not handing") {
-				out = append(out, fmt.Sprintf("%s:%d: %s", rel, i+1, strings.TrimSpace(line)))
-			}
-		}
-		return nil
-	})
-	sort.Strings(out)
-	return out, err
-}

checks/planhands/planhands_test.go

@@ -1,45 +0,0 @@
-package planhands
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-// A line that takes a plan existing for its module handed is refused and named; one that asks Hands, one marked "not
-// handing" and any test file pass; and the real catalogue is clean.
-func TestNoModuleTakesAPlanExistingForItsModuleHanded(t *testing.T) {
-	root := t.TempDir()
-	for f, body := range map[string]string{
-		"modules/vault/own.go":         "if a.Provisioning != nil {\n",
-		"modules/client/plan.go":       "if len(a.Provisioning) == 0 {\n",
-		"modules/vault/rule.go":        "return a.Provisioning != nil && a.Provisioning.Hands(), nil\n",
-		"modules/client/binds.go":      "if a.Provisioning != nil { // binds, not handing\n",
-		"modules/vault/own_test.go":    "if a.Provisioning == nil {\n",
-		"modules/client/notgo/plan.md": "if a.Provisioning == nil {\n",
-	} {
-		p := filepath.Join(root, f)
-		if err := os.MkdirAll(filepath.Dir(p), 0o755); err != nil {
-			t.Fatal(err)
-		}
-		if err := os.WriteFile(p, []byte(body), 0o644); err != nil {
-			t.Fatal(err)
-		}
-	}
-	got, err := Problems(root)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(got) != 2 || !strings.HasPrefix(got[0], "modules/client/plan.go:1:") || !strings.HasPrefix(got[1], "modules/vault/own.go:1:") {
-		t.Fatalf("refused %v, wanted the client's and the vault's existence tests alone", got)
-	}
-	real, err := Problems(filepath.Join("..", ".."))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(real) > 0 {
-		t.Errorf("a module takes a plan existing for its module handed; ask catalogue.Plan.Hands, or mark a line that reads "+
-			"only who binds whom \"not handing\":\n%s", strings.Join(real, "\n"))
-	}
-}

checks/planhands/reads-outside

@@ -1,3 +0,0 @@
-# What these tests read outside their package, as paths from the repository's root (issue 1936).
-# every module whole (a directory is read whole, so a module's Go source at any depth enters the digest), for a line that takes a plan existing for its module handed.
-modules

checks/predefined/go.mod

@@ -1,7 +1,3 @@
 module git.novox.be/novox/mesh-catalog/checks/predefined
 
 go 1.22
-
-require git.novox.be/novox/mesh-catalog/checks/trunk v0.0.0
-
-replace git.novox.be/novox/mesh-catalog/checks/trunk => ../trunk

checks/predefined/reads-outside

@@ -1,6 +0,0 @@
-# What these tests read outside their package, as paths from the repository's root (a glob, or a directory read whole;
-# ? before a path whose absence is read). mesh-build-go hashes them into the package's digest, so its verdict is kept
-# until one of them changes (issue 1936). An empty list, or a line matching nothing, keeps nothing.
-# the root's list of predefined keys and every manifest that names one.
-predefined.json
-modules/*/module.json

checks/predefined/realtree_test.go

@@ -1,41 +0,0 @@
-package main
-
-import (
-	"path/filepath"
-	"sort"
-	"testing"
-
-	"git.novox.be/novox/mesh-catalog/checks/trunk"
-)
-
-// The script's run of this check over the real tree (novox/hq ADR 0529 clause 2): predefined.json removes no key a module still
-// names, judged against the trunk's copy at the merge base. A trunk with none had no keys; with no trunk to read, nothing can be
-// seen removed, and the test says so.
-func TestThePredefinedListRemovesNoKeyAModuleStillNames(t *testing.T) {
-	tree, err := Keys(filepath.Join("..", "..", File))
-	if err != nil {
-		t.Fatal(err)
-	}
-	path, ok := trunk.Copy(t, File)
-	if !ok {
-		t.Log("no trunk copy of " + File + ": no removal can be seen")
-		return
-	}
-	base, err := Keys(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	named, err := Named(filepath.Join("..", ".."))
-	if err != nil {
-		t.Fatal(err)
-	}
-	removed := Removed(base, tree, named)
-	keys := make([]string, 0, len(removed))
-	for k := range removed {
-		keys = append(keys, k)
-	}
-	sort.Strings(keys)
-	for _, k := range keys {
-		t.Errorf("%q is removed from %s and still named by %v", k, File, removed[k])
-	}
-}

checks/readable/go.mod

@@ -1,5 +0,0 @@
-module checks/readable
-
-go 1.26.0
-
-require git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030001116-2da0de75c3f0

checks/readable/go.sum

@@ -1,2 +0,0 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030001116-2da0de75c3f0 h1:lKU3HjNXGiVbLW2hUgFjU/TMTUYMlNnnmZxG5T7biQA=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030001116-2da0de75c3f0/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=

checks/readable/main.go

@@ -1,333 +0,0 @@
-// Command readable refuses a catalogue where a module reads another module's state that the owner does not announce
-// readable (novox/hq ADR 0495 clause 3, issue 1790): the controller grants a read only from the owner's announcement, so
-// such a read is refused on the live mesh, said only in the controller's journal. The sweep of 2026-10-30 (issue 774)
-// found three: gitea's `bound` (read by mesh-provisioner, so no forge account was bound), disk-load's `readings` (read by
-// restic, nfs-server and mounts) and restic's `good` (read by the self-check). The merge gate's check of reads against
-// the owner's manifest went with clause 5, and announcetest holds a module to its own list, not to its readers.
-//
-// An owner announces from its code. A Go module announces when its code imports mesh-sdk's go/announce: every
-// announce.State literal there is read, its Name a string, a constant of the package, or a constant of mesh-sdk this
-// check knows (Known). A TypeScript module announces when its code says the event `states` or calls the SDK's keeps:
-// every `{ name: "...", readable: true }` there is read. An owner that announces nothing from code is read as before
-// on the mesh, and is not judged; neither is an owner outside the catalogue (another repository's).
-//
-//	go run . <catalog root>
-//
-// Exits 1 on a finding.
-package main
-
-import (
-	"encoding/json"
-	"fmt"
-	"go/ast"
-	"go/parser"
-	"go/token"
-	"os"
-	"path/filepath"
-	"regexp"
-	"sort"
-	"strconv"
-	"strings"
-
-	"git.novox.be/novox/mesh-sdk/go/health"
-)
-
-// Known are the mesh-sdk constants an announcement may name a state by, by the selector the code writes.
-var Known = map[string]string{
-	"health.GoodState":     health.GoodState,
-	"health.ReadingsState": health.ReadingsState,
-}
-
-const announcePkg = `"git.novox.be/novox/mesh-sdk/go/announce"`
-
-// Announced is what one owner's code announces: each state, readable or not.
-type Announced map[string]bool
-
-// Findings is every refusal in the catalogue at root, sorted.
-func Findings(root string) ([]string, error) {
-	manifests, err := filepath.Glob(filepath.Join(root, "modules", "*", "module.json"))
-	if err != nil {
-		return nil, err
-	}
-	dirs := map[string]string{}
-	reads := map[string][]string{}
-	for _, path := range manifests {
-		raw, err := os.ReadFile(path)
-		if err != nil {
-			return nil, err
-		}
-		var m struct {
-			Module string            `json:"module"`
-			Reads  []json.RawMessage `json:"reads"`
-		}
-		if err := json.Unmarshal(raw, &m); err != nil {
-			return nil, fmt.Errorf("%s: %w", path, err)
-		}
-		dirs[m.Module] = filepath.Dir(path)
-		for _, r := range m.Reads {
-			var s string
-			if json.Unmarshal(r, &s) == nil {
-				reads[m.Module] = append(reads[m.Module], s)
-			}
-		}
-	}
-	var out []string
-	owners := map[string]Announced{}
-	for reader, rs := range reads {
-		for _, r := range rs {
-			owner, state, ok := strings.Cut(r, ".")
-			dir, inCatalogue := dirs[owner]
-			if !ok || !inCatalogue || owner == reader {
-				continue
-			}
-			a, seen := owners[owner]
-			if !seen {
-				var problems []string
-				a, problems, err = AnnouncedBy(dir)
-				if err != nil {
-					return nil, err
-				}
-				owners[owner] = a
-				for _, p := range problems {
-					out = append(out, owner+": "+p)
-				}
-			}
-			if a == nil {
-				continue // announces nothing from code: read as before
-			}
-			readable, keeps := a[state]
-			switch {
-			case !keeps:
-				out = append(out, fmt.Sprintf("%s reads %s.%s, which %s's code does not announce: the read is refused on the mesh", reader, owner, state, owner))
-			case !readable:
-				out = append(out, fmt.Sprintf("%s reads %s.%s, which %s's code announces not readable: the read is refused on the mesh; announce it readable", reader, owner, state, owner))
-			}
-		}
-	}
-	sort.Strings(out)
-	return dedupe(out), nil
-}
-
-func dedupe(in []string) []string {
-	var out []string
-	for i, s := range in {
-		if i == 0 || s != in[i-1] {
-			out = append(out, s)
-		}
-	}
-	return out
-}
-
-var (
-	tsAnnounces = regexp.MustCompile(`emit\(\s*"states"|\bkeeps\(`)
-	tsState     = regexp.MustCompile(`\{\s*name:\s*"([a-z0-9][a-z0-9-]*)"\s*(,\s*readable:\s*(true|false)\s*)?\}`)
-)
-
-// AnnouncedBy is what the module in dir announces from its code, nil when it announces nothing; problems are
-// announcements whose state's name cannot be read.
-func AnnouncedBy(dir string) (Announced, []string, error) {
-	var out Announced
-	var problems []string
-	pkgs := map[string][]*ast.File{}
-	fset := token.NewFileSet()
-	err := filepath.WalkDir(dir, func(path string, d os.DirEntry, err error) error {
-		if err != nil {
-			return err
-		}
-		if d.IsDir() {
-			if n := d.Name(); path != dir && (n == "node_modules" || n == "dist" || n == "test" || n == "testdata" || strings.HasPrefix(n, ".")) {
-				return filepath.SkipDir
-			}
-			return nil
-		}
-		name := d.Name()
-		switch {
-		case strings.HasSuffix(name, ".go") && !strings.HasSuffix(name, "_test.go"):
-			f, err := parser.ParseFile(fset, path, nil, 0)
-			if err != nil {
-				return err
-			}
-			pkgs[filepath.Dir(path)] = append(pkgs[filepath.Dir(path)], f)
-		case strings.HasSuffix(name, ".ts") && !strings.HasSuffix(name, ".d.ts") && !strings.HasSuffix(name, ".test.ts"):
-			raw, err := os.ReadFile(path)
-			if err != nil {
-				return err
-			}
-			if !tsAnnounces.Match(raw) && !strings.Contains(string(raw), "KEPT") {
-				return nil
-			}
-			for _, m := range tsState.FindAllStringSubmatch(string(raw), -1) {
-				if out == nil {
-					out = Announced{}
-				}
-				out[m[1]] = out[m[1]] || m[3] == "true"
-			}
-		}
-		return nil
-	})
-	if err != nil {
-		return nil, nil, err
-	}
-	for _, files := range pkgs {
-		imports := false
-		consts := map[string]ast.Expr{}
-		for _, f := range files {
-			for _, im := range f.Imports {
-				if im.Path.Value == announcePkg && (im.Name == nil || im.Name.Name == "announce") {
-					imports = true
-				}
-			}
-			for _, decl := range f.Decls {
-				g, ok := decl.(*ast.GenDecl)
-				if !ok || g.Tok != token.CONST {
-					continue
-				}
-				for _, spec := range g.Specs {
-					v := spec.(*ast.ValueSpec)
-					for i, n := range v.Names {
-						if i < len(v.Values) {
-							consts[n.Name] = v.Values[i]
-						}
-					}
-				}
-			}
-		}
-		if !imports {
-			continue
-		}
-		if out == nil {
-			out = Announced{}
-		}
-		for _, f := range files {
-			ast.Inspect(f, func(n ast.Node) bool {
-				lit, ok := n.(*ast.CompositeLit)
-				if !ok {
-					return true
-				}
-				states := []*ast.CompositeLit{}
-				switch {
-				case isAnnounceState(lit.Type):
-					states = append(states, lit)
-				case isStateSlice(lit.Type):
-					for _, e := range lit.Elts {
-						if c, ok := e.(*ast.CompositeLit); ok && (c.Type == nil || isAnnounceState(c.Type)) {
-							states = append(states, c)
-						}
-					}
-				default:
-					return true
-				}
-				for _, s := range states {
-					name, readable, problem := stateOf(s, consts)
-					if problem != "" {
-						problems = append(problems, fmt.Sprintf("%s: %s", fset.Position(s.Pos()), problem))
-						continue
-					}
-					out[name] = out[name] || readable
-				}
-				return false
-			})
-		}
-	}
-	return out, problems, nil
-}
-
-func isAnnounceState(e ast.Expr) bool {
-	s, ok := e.(*ast.SelectorExpr)
-	if !ok {
-		return false
-	}
-	x, ok := s.X.(*ast.Ident)
-	return ok && x.Name == "announce" && s.Sel.Name == "State"
-}
-
-func isStateSlice(e ast.Expr) bool {
-	a, ok := e.(*ast.ArrayType)
-	return ok && isAnnounceState(a.Elt)
-}
-
-// stateOf is one announce.State literal's name and whether it is readable (Readable true, or Readers named).
-func stateOf(lit *ast.CompositeLit, consts map[string]ast.Expr) (string, bool, string) {
-	var name string
-	var readable bool
-	named := false
-	for _, e := range lit.Elts {
-		kv, ok := e.(*ast.KeyValueExpr)
-		if !ok {
-			return "", false, "an announce.State without field names cannot be read; name its fields"
-		}
-		key, _ := kv.Key.(*ast.Ident)
-		if key == nil {
-			continue
-		}
-		switch key.Name {
-		case "Name":
-			v, ok := resolve(kv.Value, consts, 0)
-			if !ok {
-				return "", false, fmt.Sprintf("the state's name %s cannot be read: name it by a string, a constant of the package, or a mesh-sdk constant in checks/readable's Known", exprString(kv.Value))
-			}
-			name, named = v, true
-		case "Readable":
-			if id, ok := kv.Value.(*ast.Ident); ok {
-				readable = readable || id.Name == "true"
-			}
-		case "Readers":
-			readable = true
-		}
-	}
-	if !named {
-		return "", false, "an announce.State without a Name"
-	}
-	return name, readable, ""
-}
-
-func resolve(e ast.Expr, consts map[string]ast.Expr, depth int) (string, bool) {
-	if depth > 8 {
-		return "", false
-	}
-	switch v := e.(type) {
-	case *ast.BasicLit:
-		if v.Kind == token.STRING {
-			s, err := strconv.Unquote(v.Value)
-			return s, err == nil
-		}
-	case *ast.Ident:
-		if c, ok := consts[v.Name]; ok {
-			return resolve(c, consts, depth+1)
-		}
-	case *ast.SelectorExpr:
-		s, ok := Known[exprString(v)]
-		return s, ok
-	}
-	return "", false
-}
-
-func exprString(e ast.Expr) string {
-	switch v := e.(type) {
-	case *ast.Ident:
-		return v.Name
-	case *ast.SelectorExpr:
-		return exprString(v.X) + "." + v.Sel.Name
-	case *ast.BasicLit:
-		return v.Value
-	}
-	return fmt.Sprintf("%T", e)
-}
-
-func main() {
-	root := "."
-	if len(os.Args) > 1 {
-		root = os.Args[1]
-	}
-	found, err := Findings(root)
-	if err != nil {
-		fmt.Fprintln(os.Stderr, err)
-		os.Exit(2)
-	}
-	for _, f := range found {
-		fmt.Println(f)
-	}
-	if len(found) > 0 {
-		os.Exit(1)
-	}
-}

checks/readable/main_test.go

@@ -1,90 +0,0 @@
-package main
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-// A read of another module's state is refused here when the owner's code announces that state not readable, or not at
-// all (the sweep of 2026-10-30, issue 774); an owner that announces nothing from code, or lives in another repository,
-// is not judged.
-func TestFindings(t *testing.T) {
-	const goOwner = "package main\n\nimport \"git.novox.be/novox/mesh-sdk/go/announce\"\n\n"
-	for _, row := range []struct {
-		name  string
-		files map[string]string
-		want  string // empty: clean
-	}{
-		{"go, readable by a constant", map[string]string{
-			"modules/r/module.json":        `{"module":"r","reads":["o.s"]}`,
-			"modules/o/module.json":        `{"module":"o"}`,
-			"modules/o/cmd/o/main.go":      goOwner + "const S = \"s\"\n\nvar _ = announce.State{Name: S, Readable: true}\n",
-			"modules/o/cmd/o/main_test.go": goOwner + "var _ = announce.State{Name: \"s\"}\n"}, ""},
-		{"go, not readable", map[string]string{
-			"modules/r/module.json":   `{"module":"r","reads":["o.s"]}`,
-			"modules/o/module.json":   `{"module":"o"}`,
-			"modules/o/cmd/o/main.go": goOwner + "var Kept = []announce.State{{Name: \"t\", Readable: true}, {Name: \"s\"}}\n"},
-			"r reads o.s, which o's code announces not readable"},
-		{"go, a known mesh-sdk name and readers", map[string]string{
-			"modules/r/module.json":   `{"module":"r","reads":["o.good","o.s"]}`,
-			"modules/o/module.json":   `{"module":"o"}`,
-			"modules/o/cmd/o/main.go": goOwner + "var _ = []announce.State{{Name: health.GoodState, Readable: true}, {Name: \"s\", Readers: []string{\"r\"}}}\n"}, ""},
-		{"go, a name that cannot be read", map[string]string{
-			"modules/r/module.json":   `{"module":"r","reads":["o.s"]}`,
-			"modules/o/module.json":   `{"module":"o"}`,
-			"modules/o/cmd/o/main.go": goOwner + "var _ = announce.State{Name: other.S, Readable: true}\n"},
-			"the state's name other.S cannot be read"},
-		{"go, a state not announced", map[string]string{
-			"modules/r/module.json":   `{"module":"r","reads":["o.s"]}`,
-			"modules/o/module.json":   `{"module":"o"}`,
-			"modules/o/cmd/o/main.go": goOwner + "var _ = announce.State{Name: \"t\"}\n"},
-			"r reads o.s, which o's code does not announce"},
-		{"typescript, not readable", map[string]string{
-			"modules/r/module.json": `{"module":"r","reads":["o.bound"]}`,
-			"modules/o/module.json": `{"module":"o"}`,
-			"modules/o/kept.ts":     `export const KEPT = [{ name: "announced" }, { name: "bound" }];`},
-			"r reads o.bound, which o's code announces not readable"},
-		{"typescript, readable", map[string]string{
-			"modules/r/module.json": `{"module":"r","reads":["o.bound"]}`,
-			"modules/o/module.json": `{"module":"o"}`,
-			"modules/o/index.ts":    `await keeps([{ name: "bound", readable: true }]);`}, ""},
-		{"an owner that announces nothing, and one outside the catalogue", map[string]string{
-			"modules/r/module.json":   `{"module":"r","reads":["o.s","mesh-controller.lease"]}`,
-			"modules/o/module.json":   `{"module":"o"}`,
-			"modules/o/cmd/o/main.go": "package main\n\nvar _ = 1\n"}, ""},
-	} {
-		t.Run(row.name, func(t *testing.T) {
-			root := t.TempDir()
-			for path, text := range row.files {
-				p := filepath.Join(root, path)
-				if err := os.MkdirAll(filepath.Dir(p), 0o755); err != nil {
-					t.Fatal(err)
-				}
-				if err := os.WriteFile(p, []byte(text), 0o644); err != nil {
-					t.Fatal(err)
-				}
-			}
-			got, err := Findings(root)
-			if err != nil {
-				t.Fatal(err)
-			}
-			joined := strings.Join(got, "\n")
-			if row.want == "" && len(got) != 0 || row.want != "" && !strings.Contains(joined, row.want) {
-				t.Errorf("findings %q, want %q", joined, row.want)
-			}
-		})
-	}
-}
-
-// The catalogue itself: every state a module reads of another module that announces from code is announced readable.
-func TestTheCatalogueReadsOnlyWhatItsOwnersAnnounceReadable(t *testing.T) {
-	got, err := Findings(filepath.Join("..", ".."))
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, f := range got {
-		t.Error(f)
-	}
-}

checks/readable/reads-outside

@@ -1,6 +0,0 @@
-# What these tests read outside their package, as paths from the repository's root (issue 1936).
-# every manifest, for what it reads; and every module's Go and TypeScript code, for the states it announces.
-modules/*/module.json
-modules/*/cmd
-modules/*/*.go
-modules/*/*.ts

checks/secrets/go.mod

@@ -1,7 +1,3 @@
 module git.novox.be/novox/mesh-catalog/checks/secrets
 
 go 1.22
-
-require git.novox.be/novox/mesh-catalog/checks/trunk v0.0.0
-
-replace git.novox.be/novox/mesh-catalog/checks/trunk => ../trunk

checks/secrets/reads-outside

@@ -1,5 +0,0 @@
-# What these tests read outside their package, as paths from the repository's root (a glob, or a directory read whole;
-# ? before a path whose absence is read). mesh-build-go hashes them into the package's digest, so its verdict is kept
-# until one of them changes (issue 1936). An empty list, or a line matching nothing, keeps nothing.
-# Check("../.."): every manifest and the files it names.
-modules

checks/secrets/realtree_test.go

@@ -1,25 +0,0 @@
-package main
-
-import (
-	"testing"
-
-	"git.novox.be/novox/mesh-catalog/checks/trunk"
-)
-
-// The script's run of this check over the real tree (novox/hq ADR 0529 clause 2): the known list gains no line the trunk's copy
-// at the merge base does not hold. Without a trunk copy the lines in seed are the trunk's.
-func TestTheKnownListHoldsNoLineTheTrunksDoesNot(t *testing.T) {
-	known, err := Known("known")
-	if err != nil {
-		t.Fatal(err)
-	}
-	base := seed
-	if path, ok := trunk.Copy(t, "checks/secrets/known"); ok {
-		if base, err = Known(path); err != nil {
-			t.Fatal(err)
-		}
-	}
-	for _, line := range Added(known, base) {
-		t.Errorf("checks/secrets/known gains %q, which the trunk's copy does not hold: the list only shrinks — protect the key instead (novox/hq issue 342)", line)
-	}
-}

checks/sshdir/reads-outside

@@ -1,5 +0,0 @@
-# What these tests read outside their package, as paths from the repository's root (a glob, or a directory read whole;
-# ? before a path whose absence is read). mesh-build-go hashes them into the package's digest, so its verdict is kept
-# until one of them changes (issue 1936). An empty list, or a line matching nothing, keeps nothing.
-# Check("../.."): every manifest.
-modules/*/module.json

checks/templates/go.mod

@@ -1,7 +1,3 @@
 module git.novox.be/novox/mesh-catalog/checks/templates
 
 go 1.22
-
-require git.novox.be/novox/mesh-catalog/checks/trunk v0.0.0
-
-replace git.novox.be/novox/mesh-catalog/checks/trunk => ../trunk

checks/templates/reads-outside

@@ -1,5 +0,0 @@
-# What these tests read outside their package, as paths from the repository's root (a glob, or a directory read whole;
-# ? before a path whose absence is read). mesh-build-go hashes them into the package's digest, so its verdict is kept
-# until one of them changes (issue 1936). An empty list, or a line matching nothing, keeps nothing.
-# Check("../.."): every manifest and its templates.
-modules

checks/templates/realtree_test.go

@@ -1,32 +0,0 @@
-package main
-
-import (
-	"testing"
-
-	"git.novox.be/novox/mesh-catalog/checks/trunk"
-)
-
-// The script's comparison of this list with the trunk's (novox/hq ADR 0529 clause 2): the list of modules keeping file text inline
-// gains none the trunk's copy at the merge base does not hold. The catalogue itself is judged against the list by
-// TestTheCatalogueKeepsFileTextInlineOnlyWhereListed. Skipped, and said, where no trunk is beside.
-func TestTheInlineListHoldsNoModuleTheTrunksDoesNot(t *testing.T) {
-	path, ok := trunk.Copy(t, "checks/templates/inline")
-	found, err := Check("../..")
-	if err != nil {
-		t.Fatal(err)
-	}
-	listed, err := Listed(listFile)
-	if err != nil {
-		t.Fatal(err)
-	}
-	base := seed
-	if ok {
-		if base, err = Listed(path); err != nil {
-			t.Fatal(err)
-		}
-	}
-	_, _, added := Judge(found, listed, base)
-	for _, m := range added {
-		t.Errorf("checks/templates/inline gains %s, which the trunk's copy does not hold: the list only shrinks", m)
-	}
-}

checks/toolchains/main.go

@@ -1,5 +1,5 @@
 // Command toolchains refuses any manifest but the owner's declaring a language's toolchain package (novox/hq
-// ADR 0477 clause 4, issue 1573): the package go only in modules/go, nodejs and npm only in modules/nodejs, and buildah (issue 1702) only in modules/buildah.
+// ADR 0477 clause 4, issue 1573): the package go only in modules/go, and nodejs and npm only in modules/nodejs.
 // Everything that compiles or runs that language requires the owner's provision instead (go-toolchain,
 // node-toolchain), so the package is declared once, and a node without the owner refuses the module that
 // needs it at resolution rather than failing at its first build. The owners must declare their packages.
@@ -19,10 +19,9 @@ import (
 
 // Owners names, for each toolchain package, the one module that declares it.
 var Owners = map[string]string{
-	"buildah": "buildah",
-	"go":      "go",
-	"nodejs":  "nodejs",
-	"npm":     "nodejs",
+	"go":     "go",
+	"nodejs": "nodejs",
+	"npm":    "nodejs",
 }
 
 // Finding is one refusal: Module declares Package, which Owner alone may, or (Missing) Owner does not declare
@@ -101,5 +100,5 @@ func main() {
 	if len(found) > 0 {
 		os.Exit(1)
 	}
-	fmt.Println("toolchains: go, nodejs, npm and buildah are declared only by their owners")
+	fmt.Println("toolchains: go, nodejs and npm are declared only by their owners")
 }

checks/toolchains/main_test.go

@@ -26,7 +26,6 @@ func TestOnlyTheOwnerDeclaresAToolchainPackage(t *testing.T) {
 	root := catalogue(t, map[string]string{
 		"go":      `{"module":"go","resources":[{"id":"go","type":"package","package":"go"}]}`,
 		"nodejs":  `{"module":"nodejs","resources":[{"id":"nodejs","type":"package","package":"nodejs"},{"id":"npm","type":"package","package":"npm"}]}`,
-		"buildah": `{"module":"buildah","resources":[{"id":"b","type":"package","package":"buildah"}]}`,
 		"lab":     `{"module":"lab","resources":[{"id":"git","type":"package","package":"git"},{"id":"go","type":"package","package":"go"}]}`,
 		"builder": `{"module":"builder","resources":[{"id":"n","type":"package","package":"nodejs"},{"id":"dir","type":"directory","path":"/go"}]}`,
 	})
@@ -40,23 +39,6 @@ func TestOnlyTheOwnerDeclaresAToolchainPackage(t *testing.T) {
 	}
 }
 
-func TestASecondDeclarerOfBuildahIsRefused(t *testing.T) {
-	root := catalogue(t, map[string]string{
-		"go":      `{"module":"go","resources":[{"id":"go","type":"package","package":"go"}]}`,
-		"nodejs":  `{"module":"nodejs","resources":[{"id":"nodejs","type":"package","package":"nodejs"},{"id":"npm","type":"package","package":"npm"}]}`,
-		"buildah": `{"module":"buildah","resources":[{"id":"b","type":"package","package":"buildah"}]}`,
-		"imagery": `{"module":"imagery","resources":[{"id":"b","type":"package","package":"buildah"}]}`,
-	})
-	got, err := Check(root)
-	if err != nil {
-		t.Fatal(err)
-	}
-	want := []Finding{{Module: "imagery", Package: "buildah", Owner: "buildah"}}
-	if !reflect.DeepEqual(got, want) {
-		t.Errorf("found %v, want %v", got, want)
-	}
-}
-
 func TestTheOwnersMustExistAndDeclareTheirPackages(t *testing.T) {
 	root := catalogue(t, map[string]string{
 		"go": `{"module":"go","resources":[]}`,
@@ -65,8 +47,8 @@ func TestTheOwnersMustExistAndDeclareTheirPackages(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if len(got) != 4 {
-		t.Errorf("an owner missing its packages gave %v, want four findings (buildah, go, nodejs, npm)", got)
+	if len(got) != 3 {
+		t.Errorf("an owner missing its packages gave %v, want three findings (go, nodejs, npm)", got)
 	}
 }
 

checks/toolchains/reads-outside

@@ -1,5 +0,0 @@
-# What these tests read outside their package, as paths from the repository's root (a glob, or a directory read whole;
-# ? before a path whose absence is read). mesh-build-go hashes them into the package's digest, so its verdict is kept
-# until one of them changes (issue 1936). An empty list, or a line matching nothing, keeps nothing.
-# Check("../.."): every manifest.
-modules/*/module.json

checks/trunk/go.mod

@@ -1,3 +0,0 @@
-module git.novox.be/novox/mesh-catalog/checks/trunk
-
-go 1.22

checks/trunk/trunk.go

@@ -1,65 +0,0 @@
-// Package trunk is where a catalogue check finds the trunk's copy of a list that may only shrink (novox/hq ADR 0529 clause 2):
-// the file as the catalogue's base commit holds it, to judge a change's list against.
-//
-// The checker fetches the change's own repository at its base commit beside the change, as it fetches a sibling, and says where
-// in MESH_CHECK_BESIDE; the copy is under the repository's name (the same convention the other repositories' tests use). With
-// MESH_CHECK_BESIDE unset, or set without the catalogue's copy in it, the test fails saying NOT COMPARED WITH THE TRUNK and
-// why: the checker places the change's own repository since R4g (issue 1295), so a missing copy is a fault, never a pass. A trunk that holds no such file had
-// none: the list's first copy, which nothing was added to.
-package trunk
-
-import (
-	"errors"
-	"fmt"
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-// Repository is the catalogue's name beside a check.
-const Repository = "mesh-catalog"
-
-// BesideEnv is where a merge check says the clones beside the one checked are.
-const BesideEnv = "MESH_CHECK_BESIDE"
-
-// Copy is the trunk's copy of the file at rel (a path from the catalogue's root), written to a file of the test's own: its path,
-// and whether the trunk holds one (false: its first copy). It fails the test when no copy of the catalogue is beside.
-func Copy(t testing.TB, rel string) (string, bool) {
-	t.Helper()
-	raw, found, err := Read(rel)
-	switch {
-	case err != nil:
-		t.Fatal(err)
-	case !found:
-		t.Logf("the trunk holds no %s: its first copy", rel)
-		return "", false
-	}
-	path := filepath.Join(t.TempDir(), filepath.Base(rel))
-	if err := os.WriteFile(path, raw, 0o644); err != nil {
-		t.Fatal(err)
-	}
-	return path, true
-}
-
-// Read is the trunk's copy of rel and whether the trunk holds one. err is a trunk not beside the check (MESH_CHECK_BESIDE unset,
-// or without the catalogue's directory), or a copy unreadable: a comparison that cannot be made is never a pass.
-func Read(rel string) (content []byte, found bool, err error) {
-	beside := os.Getenv(BesideEnv)
-	if beside == "" {
-		return nil, false, fmt.Errorf("NOT COMPARED WITH THE TRUNK: %s is not set, so the trunk's copy of %s is not beside this run; the checker places the change's own repository there (issue 1295)", BesideEnv, rel)
-	}
-	dir := filepath.Join(beside, Repository)
-	if _, err := os.Stat(dir); errors.Is(err, os.ErrNotExist) {
-		return nil, false, fmt.Errorf("NOT COMPARED WITH THE TRUNK: %s is not beside this check in %s=%s, so %s is not judged against the trunk's copy; the checker places the change's own repository there at its trunk (issue 1295)", Repository, BesideEnv, beside, rel)
-	} else if err != nil {
-		return nil, false, err
-	}
-	raw, err := os.ReadFile(filepath.Join(dir, rel))
-	if errors.Is(err, os.ErrNotExist) {
-		return nil, false, nil
-	}
-	if err != nil {
-		return nil, false, err
-	}
-	return raw, true, nil
-}

checks/trunk/trunk_test.go

@@ -1,43 +0,0 @@
-package trunk
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-func TestTheCloneBesideTheCheckIsTheTrunk(t *testing.T) {
-	beside := t.TempDir()
-	dir := filepath.Join(beside, Repository, "checks", "x")
-	if err := os.MkdirAll(dir, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(dir, "known"), []byte("a\nb\n"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	t.Setenv(BesideEnv, beside)
-	raw, found, err := Read("checks/x/known")
-	if err != nil || !found || string(raw) != "a\nb\n" {
-		t.Fatalf("read %q found %v err %v", raw, found, err)
-	}
-	if _, found, err := Read("checks/x/absent"); err != nil || found {
-		t.Fatalf("a file the trunk does not hold: found %v err %v; wanted its first copy", found, err)
-	}
-}
-
-func TestWithNothingBesideTheComparisonFailsAndSaysNotMade(t *testing.T) {
-	t.Setenv(BesideEnv, "")
-	_, found, err := Read("checks/x/known")
-	if found || err == nil || !strings.Contains(err.Error(), "NOT COMPARED") {
-		t.Fatalf("found %v, err %v; wanted a failure saying NOT COMPARED", found, err)
-	}
-}
-
-func TestACloneBesideWithoutTheCatalogueFailsAndSaysNotMade(t *testing.T) {
-	t.Setenv(BesideEnv, t.TempDir()) // the siblings are there, the catalogue's own base is not
-	_, found, err := Read("checks/x/known")
-	if found || err == nil || !strings.Contains(err.Error(), "NOT COMPARED") || !strings.Contains(err.Error(), "not beside") {
-		t.Fatalf("found %v, err %v; wanted a failure naming the missing copy", found, err)
-	}
-}

checks/words/buildagent-allowed

@@ -1,3 +0,0 @@
-# The modules of the catalogue whose texts still name the build agent or the toolchain images, and why (checks/words,
-# buildagent_test.go). One module directory a line, with its reason after a #. It only shrinks.
-modules/mesh-build-go  # build.go:45 says "the build agent's recipe" in a step's description: the asks lane's module (issue 1887), not E6's to edit

checks/words/buildagent_test.go

@@ -1,57 +0,0 @@
-package main
-
-import (
-	"os"
-	"strings"
-	"testing"
-)
-
-// The build agent and the toolchain images are gone (novox/hq ADR 0524 §5, issue 1295 and E6 of milestone R4g): no text a module
-// can show names them. Where the word stands for a reason that is another lane's or still waits for its change, buildagent-allowed
-// names the module's directory with that reason and the date it is dated from; the list only shrinks: a directory on it that no
-// longer names the word is refused, so the line is taken out.
-var gone = []string{"build-agent", "build agent", "toolchain image"}
-
-func allowedModules(t *testing.T) map[string]string {
-	t.Helper()
-	raw, err := os.ReadFile("buildagent-allowed")
-	if err != nil {
-		t.Fatal(err)
-	}
-	out := map[string]string{}
-	for _, line := range strings.Split(string(raw), "\n") {
-		entry, why, _ := strings.Cut(line, "#")
-		if entry = strings.TrimSpace(entry); entry != "" && !strings.HasPrefix(line, "#") {
-			if strings.TrimSpace(why) == "" {
-				t.Fatalf("%q is allowed without a reason", entry)
-			}
-			out[entry] = strings.TrimSpace(why)
-		}
-	}
-	return out
-}
-
-func TestNoTextOfTheCatalogueNamesTheBuildAgentOutsideTheModulesAllowed(t *testing.T) {
-	texts, _, err := collect("../..")
-	if err != nil {
-		t.Fatal(err)
-	}
-	allowed := allowedModules(t)
-	seen := map[string]bool{}
-	for _, f := range check(gone, texts) {
-		module := f
-		if rest, ok := strings.CutPrefix(f, "modules/"); ok {
-			module = "modules/" + strings.SplitN(rest, "/", 2)[0]
-		}
-		if _, ok := allowed[module]; ok {
-			seen[module] = true
-			continue
-		}
-		t.Errorf("%s (the build agent and the toolchain images are gone: say what stands in their place)", f)
-	}
-	for module, why := range allowed {
-		if !seen[module] {
-			t.Errorf("buildagent-allowed names %s (%s), which names the word no more: take the line out, so it cannot come back", module, why)
-		}
-	}
-}

checks/words/lines.go

@@ -58,9 +58,6 @@ func checkLines(lines []retiredLine, texts []text) []string {
 	for _, l := range lines {
 		rx := linePattern(l)
 		for _, t := range texts {
-			if !strings.Contains(t.s, l.daemon) { // the pattern holds the daemon's name whole: the cheap test first
-				continue
-			}
 			if m := rx.FindStringSubmatchIndex(t.s); m != nil {
 				line := t.line
 				if line > 0 {