ssh-client: the mesh's region first in ~/.ssh/config, its hosts in config.d, tools in Go

The region at the end let earlier Host lines win over the mesh's (research 027/03). A roster fact cannot be placed at the start, so the region holds one Include of config.d, and the hosts are config.d/00-mesh, read first. Eight tools; authorized_keys and known_hosts stay found until the controller holds those facts.
docker: the container runtime as a module, with its tools in Go
2026-10-04 12:37:44 +02:00 · 2026-10-04 12:37:44 +02:00
143 changed files with 4073 additions and 14449 deletions
@@ -1,69 +0,0 @@
 # clipmenu
 The clipboard manager as a module (novox/hq ADR 0208, research 026/04).
 - Installs `clipmenu` from the official repositories. It brings `clipnotify`, `xsel`, `xdotool` and
  `dmenu` as its own dependencies.
 - Claims the mesh's `node-clipboard` seat and serves its verbs `history` and `copy`. Requires
  `x11-display` on its own machine.
 - **Declares `rofi-greenclip` absent** (ADR 0180). This module replaces it.
 - Starts `clipmenud` **once per session**, from the session's start (the `xinitrc` slot `normal`).
  It is not a user unit as well. Its packaged unit needs user-scoped units (mesh-host #72, not
  merged), and the session start alone is one starter.
 - Binds `$mod+period` to `clipmenu`, as its own i3 drop-in (`50-clipmenu.conf`). clipmenu shows the
  history through `dmenu`, the seat command of `node-launcher`, so it looks like every other menu.
 - Its settings are environment contributions (ADR 0203), read by the daemon, the menu and the tools
  alike:
  - `CM_SELECTIONS=clipboard`: what was copied, not every highlighted word. The found greenclip did
    the same.
  - `CM_MAX_CLIPS=500`: how many clips are kept.
  - `CM_HISTLENGTH=15`: how many lines the menu shows.
 ## Tools
 | tool | does |
 |---|---|
 | `node-clipboard.history` | the history, newest first, each entry once with its id, first line, time, size and text (cut) |
 | `node-clipboard.copy` | put text on the clipboard; it enters the history like any copy |
 | `clipmenu_paste` | what the clipboard holds now |
 | `clipmenu_clear` | forget the history; the daemon's locks stay |
 | `clipmenu_delete` | forget one entry, by id or first line |
 The history is read from clipmenu's own store, in the account's runtime directory, under clipmenu's
 own lock, so a copy arriving meanwhile is neither lost nor half-written. `copy` hands the text to an
 owner (`xsel`) under the account's service manager. As a child of the tools runtime, the clipboard
 would empty whenever the runtime restarted.
 ## What it improves on what was found
 - **No AUR package.** greenclip came from the user repository. clipmenu is in the official one.
 - **Started once.** greenclip was started by the window manager on both workstations, and on the
  desktop by an enabled user unit as well.
 - **No absolute home path** in any configuration. greenclip's named one.
 - **The history does not outlive a reboot.** greenclip kept it in `~/.cache`, so every password ever
  copied stayed on disk. clipmenu keeps it in the runtime directory, which is memory.
 - **One menu.** The history appears in the launcher's own menu, through the seat's `dmenu` command,
  instead of a theme from a cloned theme repository.
 ## What it leaves as found
 - `~/.config/greenclip.toml` and greenclip's history, `~/.cache/greenclip.history`.
 - On the desktop: greenclip's enabled user unit link
  (`~/.config/systemd/user/default.target.wants/greenclip.service`). It dangles once the package is
  gone.
 ## Migration (ADR 0182)
 1. After the first push, delete `~/.config/greenclip.toml` and `~/.cache/greenclip.history`.
 2. On the desktop: `systemctl --user disable greenclip.service`, before the push if you can. The
   package's removal takes the unit file with it.
 3. Until the `i3` module carries the main configuration, the found `exec --no-startup-id greenclip
   daemon` and `$mod+period` lines stay in `~/.config/i3/config`. i3 reports `$mod+period` as bound
   twice. The `i3` module's configuration carries neither.
 ## Blockers
 - `node-clipboard`, `x11-display` and the `xinitrc` slot are ADR 0208's. Until the controller knows
  them, `mctl` reads them as unknown.
 - `CM_*` reach the session through `node-env` (ADR 0203), so the account's environment module must
  be assigned too. Without it clipmenu runs on its defaults: both selections, 1000 clips, 8 lines.
@@ -1,97 +0,0 @@
 // Reading a tool's arguments: JSON numbers arrive as float64, and a missing argument is its default.
 // The same in every desktop module that carries it.
 package main
 import (
 	"fmt"
 	"math"
 	"strings"
 	"time"
 )
 // text is a string argument, trimmed; required says an empty one is refused.
 func text(args map[string]any, key string, required bool) (string, error) {
 	v, present := args[key]
 	if !present || v == nil {
 		if required {
 			return "", fmt.Errorf("%s is required", key)
 		}
 		return "", nil
 	}
 	s, ok := v.(string)
 	if !ok {
 		return "", fmt.Errorf("%s is a string, not %T", key, v)
 	}
 	s = strings.TrimSpace(s)
 	if s == "" && required {
 		return "", fmt.Errorf("%s is required", key)
 	}
 	return s, nil
 }
 // whole is a whole-number argument within [least, most], or def when absent.
 func whole(args map[string]any, key string, def, least, most int) (int, error) {
 	v, present := args[key]
 	if !present || v == nil {
 		return def, nil
 	}
 	f, ok := v.(float64)
 	if !ok {
 		if i, isInt := v.(int); isInt {
 			f = float64(i)
 		} else {
 			return 0, fmt.Errorf("%s is a number, not %T", key, v)
 		}
 	}
 	if f != math.Trunc(f) {
 		return 0, fmt.Errorf("%s is a whole number, not %v", key, f)
 	}
 	n := int(f)
 	if n < least || n > most {
 		return 0, fmt.Errorf("%s is %d; it is between %d and %d", key, n, least, most)
 	}
 	return n, nil
 }
 // flag is a boolean argument, or def when absent.
 func flag(args map[string]any, key string, def bool) (bool, error) {
 	v, present := args[key]
 	if !present || v == nil {
 		return def, nil
 	}
 	b, ok := v.(bool)
 	if !ok {
 		return false, fmt.Errorf("%s is true or false, not %T", key, v)
 	}
 	return b, nil
 }
 // texts is a list-of-strings argument.
 func texts(args map[string]any, key string) ([]string, error) {
 	v, present := args[key]
 	if !present || v == nil {
 		return nil, nil
 	}
 	list, ok := v.([]any)
 	if !ok {
 		if ss, isStrings := v.([]string); isStrings {
 			return ss, nil
 		}
 		return nil, fmt.Errorf("%s is a list of strings, not %T", key, v)
 	}
 	out := make([]string, 0, len(list))
 	for i, item := range list {
 		s, ok := item.(string)
 		if !ok {
 			return nil, fmt.Errorf("%s[%d] is a string, not %T", key, i, item)
 		}
 		out = append(out, s)
 	}
 	return out, nil
 }
 // seconds is a timeout argument in seconds, defaulted and bounded below the runtime's call limit.
 func seconds(args map[string]any, key string, def, most int) (time.Duration, error) {
 	n, err := whole(args, key, def, 1, most)
 	return time.Duration(n) * time.Second, err
 }
@@ -1,348 +0,0 @@
 package main
 import (
 	"bufio"
 	"errors"
 	"fmt"
 	"os"
 	"os/user"
 	"path/filepath"
 	"sort"
 	"strconv"
 	"strings"
 	"syscall"
 	"time"
 )
 const (
 	mostCopy  = 1 << 20
 	mostPaste = 64 << 10
 	// majorVersion is clipmenu's store layout: <dir>/clipmenu.<major>.<user>/.
 	majorVersion = 6
 )
 // account is the user clipmenu's store is named for.
 func account() string {
 	for _, k := range []string{"USER", "MESH_OPERATOR_ACCOUNT", "LOGNAME"} {
 		if v := strings.TrimSpace(os.Getenv(k)); v != "" {
 			return v
 		}
 	}
 	if u, err := user.Current(); err == nil {
 		return u.Username
 	}
 	return ""
 }
 // storeDir is where clipmenud keeps the history: CM_DIR, else the account's runtime directory.
 func storeDir(s Session) (string, error) {
 	base := os.Getenv("CM_DIR")
 	if base == "" {
 		base = s.RuntimeDir
 	}
 	if base == "" {
 		return "", fmt.Errorf("%w: the account's runtime directory, where the clipboard history lives, is missing (the account is not logged in)", ErrNoBus)
 	}
 	return filepath.Join(base, fmt.Sprintf("clipmenu.%d.%s", majorVersion, account())), nil
 }
 // cksum is POSIX cksum(1) of data: clipmenu names each entry's file by the cksum of its first line
 // followed by a newline, as "<crc> <length>".
 func cksum(data []byte) string {
 	var crc uint32
 	step := func(b byte) {
 		crc ^= uint32(b) << 24
 		for i := 0; i < 8; i++ {
 			if crc&0x80000000 != 0 {
 				crc = crc<<1 ^ 0x04C11DB7
 			} else {
 				crc <<= 1
 			}
 		}
 	}
 	for _, b := range data {
 		step(b)
 	}
 	for n := len(data); n != 0; n >>= 8 {
 		step(byte(n))
 	}
 	return fmt.Sprintf("%d %d", ^crc, len(data))
 }
 func entryID(line string) string { return cksum([]byte(line + "\n")) }
 // Entry is one clip in the history.
 type Entry struct {
 	ID        string `json:"id"`
 	Line      string `json:"line"`
 	At        string `json:"at"`
 	Bytes     int    `json:"bytes"`
 	Text      string `json:"text,omitempty"`
 	Truncated bool   `json:"truncated,omitempty"`
 	at        int64
 }
 // HistoryResult is what node-clipboard.history answers.
 type HistoryResult struct {
 	Collecting bool    `json:"collecting"`
 	Store      string  `json:"store"`
 	Total      int     `json:"total"`
 	Entries    []Entry `json:"entries"`
 }
 // readStore reads clipmenu's line cache: one "<nanoseconds> <first line>" per copy, oldest first, a
 // line repeated when the same thing was copied again. The newest copy of each line wins.
 func readStore(dir string) ([]Entry, error) {
 	f, err := os.Open(filepath.Join(dir, "line_cache"))
 	if errors.Is(err, os.ErrNotExist) {
 		return []Entry{}, nil
 	}
 	if err != nil {
 		return nil, err
 	}
 	defer f.Close()
 	latest := map[string]int64{}
 	scan := bufio.NewScanner(f)
 	scan.Buffer(make([]byte, 64<<10), 1<<20)
 	for scan.Scan() {
 		stamp, line, ok := strings.Cut(scan.Text(), " ")
 		if !ok {
 			continue
 		}
 		ns, err := strconv.ParseInt(stamp, 10, 64)
 		if err != nil {
 			continue
 		}
 		if ns >= latest[line] {
 			latest[line] = ns
 		}
 	}
 	out := make([]Entry, 0, len(latest))
 	for line, ns := range latest {
 		out = append(out, Entry{ID: entryID(line), Line: line, at: ns, At: time.Unix(0, ns).Format(time.RFC3339)})
 	}
 	sort.Slice(out, func(i, j int) bool { return out[i].at > out[j].at })
 	return out, scan.Err()
 }
 // History is the clipboard's history, newest first.
 func History(limit, maxBytes int) (HistoryResult, error) {
 	dir, err := storeDir(findEnvironment())
 	if err != nil {
 		return HistoryResult{}, err
 	}
 	entries, err := readStore(dir)
 	if err != nil {
 		return HistoryResult{}, err
 	}
 	out := HistoryResult{Collecting: len(processesOf("clipmenud")) > 0, Store: dir, Total: len(entries), Entries: []Entry{}}
 	for i, e := range entries {
 		if i == limit {
 			break
 		}
 		if info, err := os.Stat(filepath.Join(dir, e.ID)); err == nil {
 			e.Bytes = int(info.Size())
 			if maxBytes > 0 {
 				raw, _ := os.ReadFile(filepath.Join(dir, e.ID))
 				if len(raw) > maxBytes {
 					raw, e.Truncated = raw[:maxBytes], true
 				}
 				e.Text = string(raw)
 			}
 		}
 		out.Entries = append(out.Entries, e)
 	}
 	return out, nil
 }
 // CopyResult is what node-clipboard.copy answers.
 type CopyResult struct {
 	Bytes int    `json:"bytes"`
 	Unit  string `json:"unit"`
 }
 // Copy puts text on the clipboard. The clipboard is owned by a process until another copies, so the
 // owner (xsel) runs under the account's service manager, not as a child of this tool.
 func Copy(text string) (CopyResult, error) {
 	if len(text) == 0 {
 		return CopyResult{}, errors.New("text is empty; to empty the clipboard's history, clipmenu_clear")
 	}
 	if len(text) > mostCopy {
 		return CopyResult{}, fmt.Errorf("%d bytes; the clipboard takes at most %d here", len(text), mostCopy)
 	}
 	s, err := findSession()
 	if err != nil {
 		return CopyResult{}, err
 	}
 	if s.RuntimeDir == "" {
 		return CopyResult{}, fmt.Errorf("%w: no runtime directory to hand the text over in", ErrNoBus)
 	}
 	// Handed over in a file only the account can read, which the owner reads and removes.
 	f, err := os.CreateTemp(s.RuntimeDir, "clipmenu-copy-")
 	if err != nil {
 		return CopyResult{}, err
 	}
 	if _, err := f.WriteString(text); err != nil {
 		f.Close()
 		os.Remove(f.Name())
 		return CopyResult{}, err
 	}
 	f.Close()
 	unit := uniqueUnit("clipmenu-copy")
 	script := `xsel --nodetach --input --clipboard < "$0" & sleep 1; rm -f "$0"; wait`
 	if err := s.detach(unit, "/bin/sh", "-c", script, f.Name()); err != nil {
 		os.Remove(f.Name())
 		return CopyResult{}, err
 	}
 	return CopyResult{Bytes: len(text), Unit: unit + ".service"}, nil
 }
 // PasteResult is what clipmenu_paste answers.
 type PasteResult struct {
 	Text      string `json:"text"`
 	Bytes     int    `json:"bytes"`
 	Truncated bool   `json:"truncated,omitempty"`
 }
 // Paste reads the clipboard now.
 func Paste() (PasteResult, error) {
 	s, err := findSession()
 	if err != nil {
 		return PasteResult{}, err
 	}
 	r, err := s.run(5*time.Second, "", "xsel", "--output", "--clipboard")
 	if err != nil {
 		return PasteResult{}, err
 	}
 	if r.Code != 0 {
 		return PasteResult{}, fmt.Errorf("xsel: %s", strings.TrimSpace(r.Stderr))
 	}
 	out := PasteResult{Text: r.Stdout, Bytes: len(r.Stdout), Truncated: r.Truncated}
 	if len(out.Text) > mostPaste {
 		out.Text, out.Truncated = out.Text[:mostPaste], true
 	}
 	return out, nil
 }
 // ChangeResult is what clear and delete answer.
 type ChangeResult struct {
 	Removed   int `json:"removed"`
 	Remaining int `json:"remaining"`
 }
 // withStoreLock holds clipmenu's own lock on its store, the one clipmenud and clipdel take, while
 // change runs, so a copy arriving meanwhile is neither lost nor half-written.
 func withStoreLock(dir string, change func() error) error {
 	lock, err := os.OpenFile(filepath.Join(dir, "lock"), os.O_CREATE|os.O_WRONLY, 0o600)
 	if err != nil {
 		return err
 	}
 	defer lock.Close()
 	deadline := time.Now().Add(2 * time.Second)
 	for {
 		err := syscall.Flock(int(lock.Fd()), syscall.LOCK_EX|syscall.LOCK_NB)
 		if err == nil {
 			break
 		}
 		if time.Now().After(deadline) {
 			return fmt.Errorf("the clipboard store is locked by clipmenud and did not come free within 2s")
 		}
 		time.Sleep(50 * time.Millisecond)
 	}
 	defer syscall.Flock(int(lock.Fd()), syscall.LOCK_UN)
 	return change()
 }
 func storeOf() (string, error) {
 	dir, err := storeDir(findEnvironment())
 	if err != nil {
 		return "", err
 	}
 	if _, err := os.Stat(dir); errors.Is(err, os.ErrNotExist) {
 		return "", fmt.Errorf("there is no clipboard history at %s: clipmenud has not run in this login", dir)
 	}
 	return dir, nil
 }
 // Clear forgets every entry and its text, keeping the store and its locks (clipdel's own clear
 // removes the directory, the daemon's lock with it).
 func Clear() (ChangeResult, error) {
 	dir, err := storeOf()
 	if err != nil {
 		return ChangeResult{}, err
 	}
 	var out ChangeResult
 	err = withStoreLock(dir, func() error {
 		entries, err := readStore(dir)
 		if err != nil {
 			return err
 		}
 		out.Removed = len(entries)
 		files, err := os.ReadDir(dir)
 		if err != nil {
 			return err
 		}
 		for _, f := range files {
 			switch f.Name() {
 			case "lock", "session_lock", "line_cache":
 				continue
 			}
 			if f.Type().IsRegular() {
 				if err := os.Remove(filepath.Join(dir, f.Name())); err != nil {
 					return err
 				}
 			}
 		}
 		return os.WriteFile(filepath.Join(dir, "line_cache"), nil, 0o600)
 	})
 	return out, err
 }
 // Delete forgets one entry, by id or by its first line.
 func Delete(id, line string) (ChangeResult, error) {
 	if (id == "") == (line == "") {
 		return ChangeResult{}, errors.New("give the entry's id or its line, one of the two")
 	}
 	dir, err := storeOf()
 	if err != nil {
 		return ChangeResult{}, err
 	}
 	var out ChangeResult
 	err = withStoreLock(dir, func() error {
 		raw, err := os.ReadFile(filepath.Join(dir, "line_cache"))
 		if err != nil && !errors.Is(err, os.ErrNotExist) {
 			return err
 		}
 		var kept []string
 		for _, l := range strings.Split(strings.TrimRight(string(raw), "\n"), "\n") {
 			if l == "" {
 				continue
 			}
 			_, text, _ := strings.Cut(l, " ")
 			if text == line || (id != "" && entryID(text) == id) {
 				out.Removed++
 				_ = os.Remove(filepath.Join(dir, entryID(text)))
 				continue
 			}
 			kept = append(kept, l)
 		}
 		if out.Removed == 0 {
 			return fmt.Errorf("no entry %s%s in the clipboard history", id, line)
 		}
 		content := strings.Join(kept, "\n")
 		if content != "" {
 			content += "\n"
 		}
 		tmp := filepath.Join(dir, ".line_cache.mesh")
 		if err := os.WriteFile(tmp, []byte(content), 0o600); err != nil {
 			return err
 		}
 		return os.Rename(tmp, filepath.Join(dir, "line_cache"))
 	})
 	if err != nil {
 		return ChangeResult{}, err
 	}
 	entries, _ := readStore(dir)
 	out.Remaining = len(entries)
 	return out, nil
 }
@@ -1,163 +0,0 @@
 package main
 import (
 	"errors"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"strconv"
 	"strings"
 	"testing"
 )
 const nobody = 4194400
 func TestEntryIdsAreWhatClipmenuNamesItsFiles(t *testing.T) {
 	for _, line := range []string{"hello", "", "two words (3 lines)", "ünïcode ✓", strings.Repeat("x", 300)} {
 		out, err := exec.Command("bash", "-c", `cksum <<< "$1"`, "_", line).Output()
 		if err != nil {
 			t.Skip("bash or cksum is missing here")
 		}
 		if got, want := entryID(line), strings.TrimSpace(string(out)); got != want {
 			t.Errorf("%q: %s, cksum says %s", line, got, want)
 		}
 	}
 }
 // store makes clipmenu's store as clipmenud leaves it, for the account the tools run as.
 func store(t *testing.T, clips map[string]string, order ...string) string {
 	t.Helper()
 	fakeMachine(t)
 	runtime := filepath.Join(runUserDir, strconv.Itoa(os.Getuid()))
 	t.Setenv("USER", "op")
 	t.Setenv("CM_DIR", "")
 	dir := filepath.Join(runtime, "clipmenu.6.op")
 	if err := os.MkdirAll(dir, 0o700); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.WriteFile(filepath.Join(runtime, "bus"), nil, 0o600); err != nil {
 		t.Fatal(err)
 	}
 	var cache strings.Builder
 	for i, line := range order {
 		cache.WriteString(strconv.FormatInt(1_700_000_000_000_000_000+int64(i)*1_000_000_000, 10) + " " + line + "\n")
 		if err := os.WriteFile(filepath.Join(dir, entryID(line)), []byte(clips[line]), 0o600); err != nil {
 			t.Fatal(err)
 		}
 	}
 	if err := os.WriteFile(filepath.Join(dir, "line_cache"), []byte(cache.String()), 0o600); err != nil {
 		t.Fatal(err)
 	}
 	return dir
 }
 func TestTheHistoryIsNewestFirstOnceEachWithItsText(t *testing.T) {
 	store(t, map[string]string{"first": "first", "second (2 lines)": "second\nline two"}, "first", "second (2 lines)", "first")
 	fakeProcess(t, nobody, "clipmenud")
 	h, err := History(10, 4096)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if !h.Collecting || h.Total != 2 || h.Entries[0].Line != "first" || h.Entries[1].Text != "second\nline two" || h.Entries[1].Bytes != 15 {
 		t.Fatalf("%+v", h)
 	}
 	if h, _ := History(1, 3); len(h.Entries) != 1 || h.Entries[0].Text != "fir" || !h.Entries[0].Truncated {
 		t.Fatalf("limited and cut: %+v", h)
 	}
 	if h, _ := History(10, 0); h.Entries[0].Text != "" || h.Entries[0].Bytes != 5 {
 		t.Fatalf("without text: %+v", h)
 	}
 }
 func TestAnEntryIsDeletedByIdOrLineWithItsText(t *testing.T) {
 	dir := store(t, map[string]string{"a": "a", "b": "b", "c": "c"}, "a", "b", "c", "a")
 	r, err := Delete(entryID("a"), "")
 	if err != nil || r.Removed != 2 || r.Remaining != 2 {
 		t.Fatalf("by id, both copies: %+v, %v", r, err)
 	}
 	if _, err := os.Stat(filepath.Join(dir, entryID("a"))); !errors.Is(err, os.ErrNotExist) {
 		t.Fatal("the text stayed")
 	}
 	if r, err := Delete("", "b"); err != nil || r.Removed != 1 || r.Remaining != 1 {
 		t.Fatalf("by line: %+v, %v", r, err)
 	}
 	if _, err := Delete("", "zzz"); err == nil {
 		t.Fatal("a missing entry was reported deleted")
 	}
 	if _, err := Delete("x", "y"); err == nil {
 		t.Fatal("both an id and a line were accepted")
 	}
 	cache, _ := os.ReadFile(filepath.Join(dir, "line_cache"))
 	if !strings.HasSuffix(string(cache), " c\n") || strings.Count(string(cache), "\n") != 1 {
 		t.Fatalf("line cache: %q", cache)
 	}
 }
 func TestClearForgetsEverythingButKeepsTheDaemonsLocks(t *testing.T) {
 	dir := store(t, map[string]string{"a": "a", "b": "b"}, "a", "b")
 	if err := os.WriteFile(filepath.Join(dir, "session_lock"), nil, 0o600); err != nil {
 		t.Fatal(err)
 	}
 	r, err := Clear()
 	if err != nil || r.Removed != 2 {
 		t.Fatalf("%+v, %v", r, err)
 	}
 	left, _ := os.ReadDir(dir)
 	var names []string
 	for _, f := range left {
 		names = append(names, f.Name())
 	}
 	if strings.Join(names, ",") != "line_cache,lock,session_lock" {
 		t.Fatalf("left: %v", names)
 	}
 }
 func TestCopyHandsTheTextToAnOwnerUnderTheAccountsServiceManager(t *testing.T) {
 	store(t, nil)
 	fakeProcess(t, nobody, "i3", "DISPLAY=:1")
 	bin := fakeBinaries(t, map[string]string{"systemctl": "true", "systemd-run": `echo "$*" > "$LOG"; for last; do :; done; cat "$last" > "$LOG.text"`})
 	t.Setenv("LOG", filepath.Join(bin, "log"))
 	r, err := Copy("secret-free text")
 	if err != nil || r.Bytes != 16 || !strings.HasPrefix(r.Unit, "clipmenu-copy-") {
 		t.Fatalf("%+v, %v", r, err)
 	}
 	asked, _ := os.ReadFile(filepath.Join(bin, "log"))
 	if !strings.Contains(string(asked), "--setenv=DISPLAY=:1 -- /bin/sh -c xsel --nodetach --input --clipboard") {
 		t.Fatalf("asked: %s", asked)
 	}
 	handed, _ := os.ReadFile(filepath.Join(bin, "log.text"))
 	if string(handed) != "secret-free text" {
 		t.Fatalf("handed over: %q", handed)
 	}
 	if _, err := Copy(""); err == nil {
 		t.Fatal("empty text was accepted")
 	}
 }
 func TestPasteReadsTheClipboardOrSaysThereIsNoSession(t *testing.T) {
 	fakeMachine(t)
 	if _, err := Paste(); !errors.Is(err, ErrNoSession) {
 		t.Fatal(err)
 	}
 	fakeProcess(t, nobody, "i3", "DISPLAY=:1")
 	fakeBinaries(t, map[string]string{"xsel": `[ "$*" = "--output --clipboard" ] && printf 'on the clipboard'`})
 	p, err := Paste()
 	if err != nil || p.Text != "on the clipboard" || p.Bytes != 16 {
 		t.Fatalf("%+v, %v", p, err)
 	}
 }
 func TestWithoutAStoreTheChangesSayWhy(t *testing.T) {
 	fakeMachine(t)
 	runtime := filepath.Join(runUserDir, strconv.Itoa(os.Getuid()))
 	if err := os.MkdirAll(runtime, 0o700); err != nil {
 		t.Fatal(err)
 	}
 	t.Setenv("USER", "op")
 	if _, err := Clear(); err == nil || !strings.Contains(err.Error(), "clipmenud has not run") {
 		t.Fatal(err)
 	}
 	if h, err := History(5, 0); err != nil || h.Total != 0 || h.Collecting {
 		t.Fatalf("an empty history: %+v, %v", h, err)
 	}
 }
@@ -1,90 +0,0 @@
 // clipmenu's Go tools bundle (novox/hq ADR 0188, ADR 0193, ADR 0208): its implementation of
 // node-clipboard's verbs `history` and `copy`, and its own tools, served by the node's runtime as the
 // operator account. The history is read from clipmenu's own store in the account's runtime directory;
 // the clipboard itself is the X session's.
 package main
 import (
 	"fmt"
 	"os"
 	stdio "git.novox.be/novox/mesh-sdk/go"
 )
 func main() {
 	if err := stdio.Serve("", tools()); err != nil {
 		fmt.Fprintln(os.Stderr, err)
 		os.Exit(1)
 	}
 }
 func tools() []stdio.Tool {
 	return []stdio.Tool{
 		{
 			Name: "node-clipboard.history",
 			Description: "What the operator copied, newest first: each entry's id, its first line, when, its size " +
 				"and its text (each cut at max_bytes). Whether the clipboard daemon is collecting.",
 			Input: map[string]any{
 				"limit":     map[string]any{"type": "integer", "description": "at most this many entries (default 20, at most 500)"},
 				"max_bytes": map[string]any{"type": "integer", "description": "cut each entry's text at this many bytes; 0 leaves the text out (default 4096, at most 65536)"},
 			},
 			Run: func(args map[string]any) (any, error) {
 				limit, err := whole(args, "limit", 20, 1, 500)
 				if err != nil {
 					return nil, err
 				}
 				most, err := whole(args, "max_bytes", 4096, 0, 65536)
 				if err != nil {
 					return nil, err
 				}
 				return History(limit, most)
 			},
 		},
 		{
 			Name: "node-clipboard.copy",
 			Description: "Put text on the operator's clipboard, as if they had copied it; it enters the history " +
 				"like any copy. Answers how many bytes.",
 			Input: map[string]any{
 				"type": "object",
 				"properties": map[string]any{
 					"text": map[string]any{"type": "string", "description": fmt.Sprintf("the text (at most %d bytes)", mostCopy)},
 				},
 				"required": []string{"text"},
 			},
 			Run: func(args map[string]any) (any, error) {
 				t, ok := args["text"].(string)
 				if !ok {
 					return nil, fmt.Errorf("text is required, as a string")
 				}
 				return Copy(t)
 			},
 		},
 		{
 			Name:        "clipmenu_paste",
 			Description: "What the operator's clipboard holds right now, as text (cut at 64 KiB, said in truncated).",
 			Run:         func(map[string]any) (any, error) { return Paste() },
 		},
 		{
 			Name:        "clipmenu_clear",
 			Description: "Forget the whole clipboard history. What is on the clipboard now stays there.",
 			Run:         func(map[string]any) (any, error) { return Clear() },
 		},
 		{
 			Name: "clipmenu_delete",
 			Description: "Forget one entry of the clipboard history, by its id as the history answers it, or by " +
 				"its first line exactly.",
 			Input: map[string]any{
 				"id":   map[string]any{"type": "string", "description": "the entry's id"},
 				"line": map[string]any{"type": "string", "description": "the entry's first line, exactly"},
 			},
 			Run: func(args map[string]any) (any, error) {
 				id, err := text(args, "id", false)
 				if err != nil {
 					return nil, err
 				}
 				line, _ := args["line"].(string)
 				return Delete(id, line)
 			},
 		},
 	}
 }
@@ -1,175 +0,0 @@
 package main
 import (
 	"encoding/json"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 )
 // The module's manifest, read the way the catalogue reads it, for the manifest tests. The same in
 // every desktop module that carries it.
 type manifest struct {
 	Module       string           `json:"module"`
 	Version      string           `json:"version"`
 	Capabilities []string         `json:"capabilities"`
 	Requires     []string         `json:"requires"`
 	Claims       []claim          `json:"claims"`
 	Seats        []any            `json:"seats"`
 	Tools        []string         `json:"tools"`
 	Environment  *environment     `json:"environment"`
 	Shell        []shellCode      `json:"shell"`
 	Resources    []map[string]any `json:"resources"`
 	Build        struct {
 		Artifacts []map[string]any `json:"artifacts"`
 	} `json:"build"`
 }
 type claim struct {
 	Name   string   `json:"name"`
 	Scope  string   `json:"scope"`
 	Serves []string `json:"serves"`
 }
 type environment struct {
 	Variables map[string]string `json:"variables"`
 	Path      []map[string]any  `json:"path"`
 }
 type shellCode struct {
 	For  string `json:"for"`
 	Slot string `json:"slot"`
 	Code string `json:"code"`
 }
 func readManifest(t *testing.T) manifest {
 	t.Helper()
 	raw, err := os.ReadFile(filepath.Join("..", "..", "module.json"))
 	if err != nil {
 		t.Fatal(err)
 	}
 	dec := json.NewDecoder(strings.NewReader(string(raw)))
 	dec.DisallowUnknownFields()
 	var m manifest
 	if err := dec.Decode(&m); err != nil {
 		t.Fatalf("module.json: %v", err)
 	}
 	return m
 }
 func (m manifest) resource(t *testing.T, id string) map[string]any {
 	t.Helper()
 	for _, r := range m.Resources {
 		if r["id"] == id {
 			return r
 		}
 	}
 	t.Fatalf("no resource %q", id)
 	return nil
 }
 func (m manifest) packages() (present, absent []string) {
 	for _, r := range m.Resources {
 		if r["type"] == "package" {
 			if r["absent"] == true {
 				absent = append(absent, r["package"].(string))
 			} else {
 				present = append(present, r["package"].(string))
 			}
 		}
 	}
 	return present, absent
 }
 // sameAsSource checks that a file resource's content is byte for byte the module's source file, so
 // the readable file in the repository is what the machine gets.
 func (m manifest) sameAsSource(t *testing.T, id, source string) {
 	t.Helper()
 	want, err := os.ReadFile(filepath.Join("..", "..", source))
 	if err != nil {
 		t.Fatal(err)
 	}
 	r := m.resource(t, id)
 	if r["type"] != "file" {
 		t.Fatalf("%s is a %v, not a file", id, r["type"])
 	}
 	if got, _ := r["content"].(string); got != string(want) {
 		t.Fatalf("resource %s's content is not %s: edit the source and copy it into module.json", id, source)
 	}
 	if r["owner"] != "${machine:account}" && !strings.HasPrefix(r["path"].(string), "/etc/") {
 		t.Fatalf("%s under the home is the account's", id)
 	}
 }
 // checkTheToolsAgree checks that the manifest lists the module's own tools exactly, that the bundle
 // serves each seat verb the claims promise as <seat>.<verb>, and that the Go bundle is declared.
 func checkTheToolsAgree(t *testing.T, m manifest) {
 	t.Helper()
 	own, seat := map[string]bool{}, map[string]bool{}
 	for _, tool := range tools() {
 		if strings.Contains(tool.Name, ".") {
 			seat[tool.Name] = true
 		} else {
 			own[tool.Name] = true
 		}
 		if strings.TrimSpace(tool.Description) == "" {
 			t.Errorf("%s has no description", tool.Name)
 		}
 	}
 	listed := map[string]bool{}
 	for _, name := range m.Tools {
 		listed[name] = true
 		if !own[name] {
 			t.Errorf("module.json lists %s, which the bundle does not serve", name)
 		}
 	}
 	for name := range own {
 		if !listed[name] {
 			t.Errorf("the bundle serves %s, which module.json does not list", name)
 		}
 		if !strings.HasPrefix(name, strings.ReplaceAll(m.Module, "-", "_")+"_") {
 			t.Errorf("%s is not prefixed with the module's name", name)
 		}
 	}
 	promised := map[string]bool{}
 	for _, c := range m.Claims {
 		for _, verb := range c.Serves {
 			promised[c.Name+"."+verb] = true
 			if !seat[c.Name+"."+verb] {
 				t.Errorf("the claim on %s promises %s, which the bundle does not serve", c.Name, verb)
 			}
 		}
 	}
 	for name := range seat {
 		if !promised[name] {
 			t.Errorf("the bundle serves %s, which no claim promises", name)
 		}
 	}
 	var bundle map[string]any
 	for _, a := range m.Build.Artifacts {
 		if a["kind"] == "bundle" {
 			bundle = a
 		}
 	}
 	if bundle == nil || bundle["language"] != "go" || bundle["system"] != "arch" ||
 		bundle["from"] != "cmd/"+m.Module+"-tools" || bundle["binary"] != m.Module+"-tools" {
 		t.Errorf("the Go tools bundle: %v", bundle)
 	}
 }
 // checkNoSecretsOrInstallationNames refuses what a catalogue manifest must never carry.
 func checkNoSecretsOrInstallationNames(t *testing.T) {
 	t.Helper()
 	raw, err := os.ReadFile(filepath.Join("..", "..", "module.json"))
 	if err != nil {
 		t.Fatal(err)
 	}
 	s := strings.ToLower(string(raw))
 	for _, never := range []string{"/home/", "jochen", "g14", "shanks", "novox.be", "api_key", ".hal/", "greenclip daemon"} {
 		if strings.Contains(s, never) {
 			t.Errorf("module.json names %q", never)
 		}
 	}
 }
@@ -1,64 +0,0 @@
 package main
 import (
 	"reflect"
 	"strings"
 	"testing"
 )
 // clipmenu's shape (novox/hq ADR 0208, research 026/04): it claims node-clipboard serving history
 // and copy, requires the X display on its own machine, replaces greenclip, starts its daemon once
 // from the session's start, and binds its menu as an i3 drop-in through the launcher's dmenu command.
 func TestItClaimsTheClipboardSeatServingHistoryAndCopy(t *testing.T) {
 	m := readManifest(t)
 	if m.Module != "clipmenu" || m.Seats != nil {
 		t.Fatalf("module %q declares seats %v", m.Module, m.Seats)
 	}
 	if !reflect.DeepEqual(m.Claims, []claim{{Name: "node-clipboard", Scope: "node", Serves: []string{"history", "copy"}}}) {
 		t.Fatalf("claims: %+v", m.Claims)
 	}
 	if !reflect.DeepEqual(m.Requires, []string{"x11-display"}) {
 		t.Fatalf("requires: %v", m.Requires)
 	}
 	present, absent := m.packages()
 	if !reflect.DeepEqual(present, []string{"clipmenu"}) || !reflect.DeepEqual(absent, []string{"rofi-greenclip"}) {
 		t.Fatalf("packages: %v, absent %v", present, absent)
 	}
 }
 func TestTheDaemonStartsOnceFromTheSessionsStart(t *testing.T) {
 	m := readManifest(t)
 	if len(m.Shell) != 1 || m.Shell[0].For != "xinitrc" || m.Shell[0].Slot != "normal" {
 		t.Fatalf("%+v", m.Shell)
 	}
 	code := m.Shell[0].Code
 	if strings.Count(code, "\nclipmenud &\n") != 1 || strings.Contains(code, "greenclip") {
 		t.Fatalf("%q", code)
 	}
 	for _, r := range m.Resources {
 		if r["type"] == "service" || r["type"] == "process" {
 			t.Fatalf("a second start: %v", r)
 		}
 	}
 }
 func TestItsSettingsAreEnvironmentAndItsMenuIsTheLaunchersDmenu(t *testing.T) {
 	m := readManifest(t)
 	if !reflect.DeepEqual(m.Environment.Variables, map[string]string{"CM_SELECTIONS": "clipboard", "CM_MAX_CLIPS": "500", "CM_HISTLENGTH": "15"}) {
 		t.Fatalf("%v", m.Environment.Variables)
 	}
 	if _, set := m.Environment.Variables["CM_LAUNCHER"]; set {
 		t.Fatal("the launcher is clipmenu's default, dmenu: the seat's command")
 	}
 	m.sameAsSource(t, "i3-bindings", "files/i3/50-clipmenu.conf")
 	if c := m.resource(t, "i3-bindings")["content"].(string); !strings.Contains(c, "bindsym $mod+period exec --no-startup-id clipmenu") {
 		t.Fatalf("%s", c)
 	}
 }
 func TestTheToolsAgreeWithTheManifest(t *testing.T) {
 	m := readManifest(t)
 	checkTheToolsAgree(t, m)
 	checkNoSecretsOrInstallationNames(t)
 }
@@ -1,423 +0,0 @@
 // The operator's graphical session, as a tool the node's runtime runs finds it (novox/hq ADR 0208).
 //
 // The runtime is a system service running as the operator account (ADR 0175): it has the account's
 // uid and none of the session's environment — no DISPLAY, no XAUTHORITY, no session bus. A tool that
 // draws on the screen or talks to the desktop's D-Bus must find them. It reads them from a process of
 // the account that is part of the session (the window manager first), the same thing `loginctl` and
 // a person's own shell would point at, and says where it found them.
 //
 // Long-lived programs a tool starts go to the account's own service manager through `systemd-run
 // --user`, never as children of the tool: the runtime's unit is a cgroup the service manager empties
 // whenever the runtime restarts, and a compositor or a clipboard owner started from inside it would
 // die with it.
 //
 // This file is the same in every desktop module that carries it; it moves into the Go SDK once a
 // second consumer outside the desktop wants it.
 package main
 import (
 	"bytes"
 	"errors"
 	"fmt"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"sort"
 	"strconv"
 	"strings"
 	"syscall"
 	"time"
 )
 // Where the session is looked for. Variables so a test can point them at a fake tree.
 var (
 	procRoot   = "/proc"
 	runUserDir = "/run/user"
 	x11Sockets = "/tmp/.X11-unix"
 )
 // sessionHolders are the processes whose environment is the session's, best first: the window
 // manager is the session, the rest are its children. Anything else carrying DISPLAY ranks after them.
 var sessionHolders = []string{"i3", "sway", "i3bar", "picom", "xss-lock", "dunst", "clipmenud", "xterm"}
 // sessionKeys are the variables a session carries that a tool hands on to what it runs.
 var sessionKeys = []string{"DISPLAY", "XAUTHORITY", "WAYLAND_DISPLAY", "DBUS_SESSION_BUS_ADDRESS",
 	"XDG_RUNTIME_DIR", "XDG_SESSION_ID", "I3SOCK"}
 // Session is what a tool needs to reach the operator's desktop.
 type Session struct {
 	UID        int    `json:"uid"`
 	Display    string `json:"display,omitempty"`
 	XAuthority string `json:"xauthority,omitempty"`
 	Wayland    string `json:"wayland_display,omitempty"`
 	Bus        string `json:"bus,omitempty"`
 	RuntimeDir string `json:"runtime_dir,omitempty"`
 	SessionID  string `json:"session_id,omitempty"`
 	I3Sock     string `json:"i3sock,omitempty"`
 	// From says where the values were found: the tool's own environment, a process, or the socket.
 	From string `json:"from"`
 }
 // ErrNoSession is answered by a tool that needs the desktop when nobody is logged in to it.
 var ErrNoSession = errors.New("no graphical session")
 // ErrTimedOut is what run answers for a command ended because it ran past its time.
 var ErrTimedOut = errors.New("timed out")
 // ErrNoBus is answered by a tool that needs the session bus when the account has none.
 var ErrNoBus = errors.New("no session bus")
 // operatorHome is the account's home: what the runtime was told, else the process's own.
 func operatorHome() string {
 	if h := strings.TrimSpace(os.Getenv("MESH_OPERATOR_HOME")); h != "" {
 		return h
 	}
 	h, _ := os.UserHomeDir()
 	return h
 }
 // findSession finds the graphical session of the account this tool runs as, or answers
 // ErrNoSession with what it looked at.
 func findSession() (Session, error) {
 	s := findEnvironment()
 	if s.Display == "" && s.Wayland == "" {
 		return s, fmt.Errorf("%w for uid %d on this machine: no process of the account carries DISPLAY "+
 			"or WAYLAND_DISPLAY, and no X server socket in %s has an authority file to go with it. "+
 			"Is anyone logged in to the desktop?", ErrNoSession, s.UID, x11Sockets)
 	}
 	return s, nil
 }
 // findBus finds the account's session bus, which a logged-in account has whether or not a desktop
 // is running.
 func findBus() (Session, error) {
 	s := findEnvironment()
 	if s.Bus == "" {
 		return s, fmt.Errorf("%w for uid %d: DBUS_SESSION_BUS_ADDRESS is not set and %s does not exist "+
 			"(the account is not logged in)", ErrNoBus, s.UID, filepath.Join(runUserDir, strconv.Itoa(s.UID), "bus"))
 	}
 	return s, nil
 }
 func findEnvironment() Session {
 	uid := os.Getuid()
 	s := Session{UID: uid}
 	own := map[string]string{}
 	for _, k := range sessionKeys {
 		own[k] = os.Getenv(k)
 	}
 	if own["DISPLAY"] != "" || own["WAYLAND_DISPLAY"] != "" {
 		s.fill(own)
 		s.From = "the tool's own environment"
 	} else if pid, comm, env, ok := sessionProcess(uid); ok {
 		s.fill(env)
 		s.From = fmt.Sprintf("process %s (pid %d)", comm, pid)
 	} else if display, ok := lonelyX11Socket(); ok {
 		if a := filepath.Join(operatorHome(), ".Xauthority"); exists(a) {
 			s.Display, s.XAuthority = display, a
 			s.From = "the X server socket and the account's ~/.Xauthority"
 		}
 		s.fill(own)
 	} else {
 		s.fill(own)
 		s.From = "nothing: no session found"
 	}
 	// The bus and the runtime directory are the account's, whether or not the process named them.
 	runtime := filepath.Join(runUserDir, strconv.Itoa(uid))
 	if s.RuntimeDir == "" && exists(runtime) {
 		s.RuntimeDir = runtime
 	}
 	if s.Bus == "" && s.RuntimeDir != "" && exists(filepath.Join(s.RuntimeDir, "bus")) {
 		s.Bus = "unix:path=" + filepath.Join(s.RuntimeDir, "bus")
 	}
 	return s
 }
 func (s *Session) fill(env map[string]string) {
 	set := func(dst *string, key string) {
 		if *dst == "" {
 			*dst = env[key]
 		}
 	}
 	set(&s.Display, "DISPLAY")
 	set(&s.XAuthority, "XAUTHORITY")
 	set(&s.Wayland, "WAYLAND_DISPLAY")
 	set(&s.Bus, "DBUS_SESSION_BUS_ADDRESS")
 	set(&s.RuntimeDir, "XDG_RUNTIME_DIR")
 	set(&s.SessionID, "XDG_SESSION_ID")
 	set(&s.I3Sock, "I3SOCK")
 }
 // sessionProcess is the best process of this uid whose environment names a display.
 func sessionProcess(uid int) (int, string, map[string]string, bool) {
 	entries, err := os.ReadDir(procRoot)
 	if err != nil {
 		return 0, "", nil, false
 	}
 	type candidate struct {
 		pid  int
 		comm string
 		env  map[string]string
 		rank int
 	}
 	var found []candidate
 	for _, e := range entries {
 		pid, err := strconv.Atoi(e.Name())
 		if err != nil {
 			continue
 		}
 		dir := filepath.Join(procRoot, e.Name())
 		if owner, ok := ownerOf(dir); !ok || owner != uid {
 			continue
 		}
 		raw, err := os.ReadFile(filepath.Join(dir, "environ"))
 		if err != nil {
 			continue
 		}
 		env := parseEnviron(raw)
 		if env["DISPLAY"] == "" && env["WAYLAND_DISPLAY"] == "" {
 			continue
 		}
 		comm := readTrimmed(filepath.Join(dir, "comm"))
 		rank := len(sessionHolders)
 		for i, h := range sessionHolders {
 			if h == comm {
 				rank = i
 				break
 			}
 		}
 		found = append(found, candidate{pid, comm, env, rank})
 	}
 	if len(found) == 0 {
 		return 0, "", nil, false
 	}
 	sort.Slice(found, func(i, j int) bool {
 		if found[i].rank != found[j].rank {
 			return found[i].rank < found[j].rank
 		}
 		return found[i].pid > found[j].pid // the newer of two equals
 	})
 	best := found[0]
 	return best.pid, best.comm, best.env, true
 }
 func parseEnviron(raw []byte) map[string]string {
 	env := map[string]string{}
 	for _, kv := range bytes.Split(raw, []byte{0}) {
 		if i := bytes.IndexByte(kv, '='); i > 0 {
 			env[string(kv[:i])] = string(kv[i+1:])
 		}
 	}
 	return env
 }
 func ownerOf(path string) (int, bool) {
 	info, err := os.Stat(path)
 	if err != nil {
 		return 0, false
 	}
 	st, ok := info.Sys().(*syscall.Stat_t)
 	if !ok {
 		return 0, false
 	}
 	return int(st.Uid), true
 }
 // lonelyX11Socket is the display of the one X server socket there is, when there is exactly one.
 func lonelyX11Socket() (string, bool) {
 	entries, err := os.ReadDir(x11Sockets)
 	if err != nil {
 		return "", false
 	}
 	var displays []string
 	for _, e := range entries {
 		if n := strings.TrimPrefix(e.Name(), "X"); n != e.Name() {
 			if _, err := strconv.Atoi(n); err == nil {
 				displays = append(displays, ":"+n)
 			}
 		}
 	}
 	if len(displays) != 1 {
 		return "", false
 	}
 	return displays[0], true
 }
 func readTrimmed(path string) string {
 	b, err := os.ReadFile(path)
 	if err != nil {
 		return ""
 	}
 	return strings.TrimSpace(string(b))
 }
 func exists(path string) bool {
 	_, err := os.Stat(path)
 	return err == nil
 }
 // Env is this process's environment with the session's variables in place of its own.
 func (s Session) Env() []string {
 	drop := map[string]bool{}
 	for _, k := range sessionKeys {
 		drop[k] = true
 	}
 	var env []string
 	for _, kv := range os.Environ() {
 		if i := strings.IndexByte(kv, '='); i > 0 && drop[kv[:i]] {
 			continue
 		}
 		env = append(env, kv)
 	}
 	add := func(k, v string) {
 		if v != "" {
 			env = append(env, k+"="+v)
 		}
 	}
 	add("DISPLAY", s.Display)
 	add("XAUTHORITY", s.XAuthority)
 	add("WAYLAND_DISPLAY", s.Wayland)
 	add("DBUS_SESSION_BUS_ADDRESS", s.Bus)
 	add("XDG_RUNTIME_DIR", s.RuntimeDir)
 	add("XDG_SESSION_ID", s.SessionID)
 	add("I3SOCK", s.I3Sock)
 	return env
 }
 // mostOutput bounds what a command may answer with, per stream.
 const mostOutput = 256 << 10
 // Result is what a command did.
 type Result struct {
 	Stdout    string `json:"stdout"`
 	Stderr    string `json:"stderr,omitempty"`
 	Code      int    `json:"code"`
 	Truncated bool   `json:"truncated,omitempty"`
 }
 // run runs a command in the session's environment, its input given, ended with everything it
 // started after timeout. A command that is not installed is an error naming it; one that exits
 // non-zero is a Result with its code, for the caller to judge.
 func (s Session) run(timeout time.Duration, stdin string, name string, args ...string) (Result, error) {
 	path, err := exec.LookPath(name)
 	if err != nil {
 		return Result{}, fmt.Errorf("%s is not installed on this machine", name)
 	}
 	cmd := exec.Command(path, args...)
 	cmd.Env = s.Env()
 	if home := operatorHome(); exists(home) {
 		cmd.Dir = home
 	}
 	if stdin != "" {
 		cmd.Stdin = strings.NewReader(stdin)
 	}
 	var out, errOut capped
 	cmd.Stdout, cmd.Stderr = &out, &errOut
 	cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
 	if err := cmd.Start(); err != nil {
 		return Result{}, fmt.Errorf("%s: %w", name, err)
 	}
 	done := make(chan error, 1)
 	go func() { done <- cmd.Wait() }()
 	select {
 	case err = <-done:
 	case <-time.After(timeout):
 		_ = syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL)
 		<-done
 		return Result{Stdout: out.String(), Stderr: errOut.String()},
 			fmt.Errorf("%s did not finish within %s and was ended: %w", name, timeout, ErrTimedOut)
 	}
 	r := Result{Stdout: out.String(), Stderr: errOut.String(), Truncated: out.cut || errOut.cut}
 	var exit *exec.ExitError
 	if errors.As(err, &exit) {
 		r.Code = exit.ExitCode()
 	} else if err != nil {
 		return r, fmt.Errorf("%s: %w", name, err)
 	}
 	return r, nil
 }
 // detach starts a long-lived program under the account's own service manager, as a transient unit
 // that carries the session's display, so it outlives the runtime that asked for it. A unit already
 // running under the same name is stopped first, so a fixed name means "at most one".
 func (s Session) detach(unit string, args ...string) error {
 	if s.RuntimeDir == "" {
 		return fmt.Errorf("%w: the account's runtime directory is missing, so its service manager "+
 			"cannot be reached", ErrNoBus)
 	}
 	_, _ = s.run(5*time.Second, "", "systemctl", "--user", "stop", unit+".service")
 	call := []string{"--user", "--collect", "--quiet", "--unit=" + unit}
 	for _, kv := range [][2]string{{"DISPLAY", s.Display}, {"XAUTHORITY", s.XAuthority},
 		{"WAYLAND_DISPLAY", s.Wayland}, {"XDG_SESSION_ID", s.SessionID}, {"I3SOCK", s.I3Sock}} {
 		if kv[1] != "" {
 			call = append(call, "--setenv="+kv[0]+"="+kv[1])
 		}
 	}
 	call = append(call, "--")
 	call = append(call, args...)
 	r, err := s.run(10*time.Second, "", "systemd-run", call...)
 	if err != nil {
 		return err
 	}
 	if r.Code != 0 {
 		return fmt.Errorf("systemd-run %s: %s", unit, strings.TrimSpace(r.Stderr))
 	}
 	return nil
 }
 // uniqueUnit is a transient unit name that will not collide with an earlier one.
 func uniqueUnit(prefix string) string {
 	return fmt.Sprintf("%s-%d", prefix, time.Now().UnixNano())
 }
 type capped struct {
 	bytes.Buffer
 	cut bool
 }
 func (c *capped) Write(p []byte) (int, error) {
 	if room := mostOutput - c.Len(); room < len(p) {
 		if room > 0 {
 			c.Buffer.Write(p[:room])
 		}
 		c.cut = true
 		return len(p), nil
 	}
 	return c.Buffer.Write(p)
 }
 // processesOf are the pids of this uid's processes whose command name is comm, oldest first.
 func processesOf(comm string) []int {
 	entries, err := os.ReadDir(procRoot)
 	if err != nil {
 		return nil
 	}
 	uid := os.Getuid()
 	var pids []int
 	for _, e := range entries {
 		pid, err := strconv.Atoi(e.Name())
 		if err != nil {
 			continue
 		}
 		dir := filepath.Join(procRoot, e.Name())
 		if owner, ok := ownerOf(dir); !ok || owner != uid {
 			continue
 		}
 		if readTrimmed(filepath.Join(dir, "comm")) == comm {
 			pids = append(pids, pid)
 		}
 	}
 	sort.Ints(pids)
 	return pids
 }
 // signalAll sends sig to every process of this uid named comm, and answers the pids it reached.
 func signalAll(comm string, sig syscall.Signal) []int {
 	var reached []int
 	for _, pid := range processesOf(comm) {
 		if syscall.Kill(pid, sig) == nil {
 			reached = append(reached, pid)
 		}
 	}
 	return reached
 }
@@ -1,174 +0,0 @@
 package main
 import (
 	"errors"
 	"os"
 	"path/filepath"
 	"strconv"
 	"strings"
 	"testing"
 	"time"
 )
 // fakeMachine points the session finder at a temporary /proc, /run/user and X socket directory, with
 // none of the test process's own session variables, and gives back the root.
 func fakeMachine(t *testing.T) string {
 	t.Helper()
 	root := t.TempDir()
 	procRoot, runUserDir, x11Sockets = filepath.Join(root, "proc"), filepath.Join(root, "run-user"), filepath.Join(root, "x11")
 	for _, d := range []string{procRoot, runUserDir, x11Sockets} {
 		if err := os.MkdirAll(d, 0o755); err != nil {
 			t.Fatal(err)
 		}
 	}
 	for _, k := range sessionKeys {
 		t.Setenv(k, "")
 	}
 	t.Setenv("MESH_OPERATOR_HOME", filepath.Join(root, "home"))
 	t.Cleanup(func() { procRoot, runUserDir, x11Sockets = "/proc", "/run/user", "/tmp/.X11-unix" })
 	return root
 }
 func fakeProcess(t *testing.T, pid int, comm string, env ...string) {
 	t.Helper()
 	dir := filepath.Join(procRoot, strconv.Itoa(pid))
 	if err := os.MkdirAll(dir, 0o755); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.WriteFile(filepath.Join(dir, "comm"), []byte(comm+"\n"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.WriteFile(filepath.Join(dir, "environ"), []byte(strings.Join(env, "\x00")+"\x00"), 0o600); err != nil {
 		t.Fatal(err)
 	}
 }
 func TestTheSessionIsReadFromTheWindowManagerBeforeAnyOtherProcess(t *testing.T) {
 	fakeMachine(t)
 	fakeProcess(t, 900, "xterm", "DISPLAY=:9", "XAUTHORITY=/elsewhere")
 	fakeProcess(t, 100, "i3", "DISPLAY=:1", "XAUTHORITY=/home/op/.Xauthority",
 		"DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus", "XDG_SESSION_ID=3", "SECRET_TOKEN=never-copied")
 	fakeProcess(t, 50, "bash", "PATH=/usr/bin")
 	s, err := findSession()
 	if err != nil {
 		t.Fatal(err)
 	}
 	if s.Display != ":1" || s.XAuthority != "/home/op/.Xauthority" || s.SessionID != "3" || !strings.Contains(s.From, "i3 (pid 100)") {
 		t.Fatalf("the window manager's environment: %+v", s)
 	}
 	for _, kv := range s.Env() {
 		if strings.HasPrefix(kv, "SECRET_TOKEN=") {
 			t.Fatal("a variable of the session process that is not a session variable was handed on")
 		}
 	}
 }
 func TestAnyProcessCarryingADisplayServesWhenTheWindowManagerIsNotFound(t *testing.T) {
 	fakeMachine(t)
 	fakeProcess(t, 10, "firefox", "DISPLAY=:0")
 	fakeProcess(t, 20, "firefox", "DISPLAY=:2")
 	s, err := findSession()
 	if err != nil || s.Display != ":2" {
 		t.Fatalf("the newest of two equals: %+v, %v", s, err)
 	}
 }
 func TestNoSessionIsAClearAnswerNotAGuess(t *testing.T) {
 	fakeMachine(t)
 	fakeProcess(t, 10, "sshd", "PATH=/usr/bin")
 	_, err := findSession()
 	if !errors.Is(err, ErrNoSession) || !strings.Contains(err.Error(), "logged in to the desktop") {
 		t.Fatalf("no session: %v", err)
 	}
 }
 func TestOneXSocketAndTheAccountsAuthorityFileAreASession(t *testing.T) {
 	root := fakeMachine(t)
 	if err := os.WriteFile(filepath.Join(x11Sockets, "X0"), nil, 0o644); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.MkdirAll(filepath.Join(root, "home"), 0o755); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.WriteFile(filepath.Join(root, "home", ".Xauthority"), nil, 0o600); err != nil {
 		t.Fatal(err)
 	}
 	s, err := findSession()
 	if err != nil || s.Display != ":0" || !strings.HasSuffix(s.XAuthority, "/home/.Xauthority") {
 		t.Fatalf("socket and authority: %+v, %v", s, err)
 	}
 }
 func TestTheBusIsTheAccountsRuntimeDirectoryWhenNoProcessNamesIt(t *testing.T) {
 	fakeMachine(t)
 	runtime := filepath.Join(runUserDir, strconv.Itoa(os.Getuid()))
 	if _, err := findBus(); !errors.Is(err, ErrNoBus) {
 		t.Fatalf("no runtime directory is no bus: %v", err)
 	}
 	if err := os.MkdirAll(runtime, 0o700); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.WriteFile(filepath.Join(runtime, "bus"), nil, 0o600); err != nil {
 		t.Fatal(err)
 	}
 	s, err := findBus()
 	if err != nil || s.Bus != "unix:path="+filepath.Join(runtime, "bus") || s.RuntimeDir != runtime {
 		t.Fatalf("bus: %+v, %v", s, err)
 	}
 	env := strings.Join(s.Env(), "\n")
 	if !strings.Contains(env, "XDG_RUNTIME_DIR="+runtime) || !strings.Contains(env, "DBUS_SESSION_BUS_ADDRESS=unix:path=") {
 		t.Fatalf("the bus is handed on: %s", env)
 	}
 }
 func TestACommandIsBoundedAndANonZeroExitIsAResult(t *testing.T) {
 	fakeMachine(t)
 	s := Session{}
 	r, err := s.run(5*time.Second, "in", "sh", "-c", "cat; echo err >&2; exit 3")
 	if err != nil || r.Stdout != "in" || r.Code != 3 || strings.TrimSpace(r.Stderr) != "err" {
 		t.Fatalf("result: %+v, %v", r, err)
 	}
 	start := time.Now()
 	if _, err := s.run(200*time.Millisecond, "", "sh", "-c", "sleep 30 & sleep 30"); err == nil || time.Since(start) > 5*time.Second {
 		t.Fatalf("a command past its time is ended with what it started: %v after %s", err, time.Since(start))
 	}
 	if _, err := s.run(time.Second, "", "no-such-program-here"); err == nil || !strings.Contains(err.Error(), "not installed") {
 		t.Fatalf("a missing program: %v", err)
 	}
 }
 func TestDetachAsksTheAccountsServiceManagerWithTheSessionsDisplay(t *testing.T) {
 	fakeMachine(t)
 	bin := fakeBinaries(t, map[string]string{
 		"systemctl":   `echo "systemctl $*" >> "$LOG"`,
 		"systemd-run": `echo "systemd-run $*" >> "$LOG"`,
 	})
 	log := filepath.Join(bin, "log")
 	t.Setenv("LOG", log)
 	s := Session{Display: ":1", XAuthority: "/x", RuntimeDir: "/run/user/1"}
 	if err := s.detach("picom-session", "picom", "--config", "/c"); err != nil {
 		t.Fatal(err)
 	}
 	got, _ := os.ReadFile(log)
 	want := "systemctl --user stop picom-session.service\n" +
 		"systemd-run --user --collect --quiet --unit=picom-session --setenv=DISPLAY=:1 --setenv=XAUTHORITY=/x -- picom --config /c\n"
 	if string(got) != want {
 		t.Fatalf("detach ran:\n%s\nwant:\n%s", got, want)
 	}
 	if err := (Session{}).detach("x", "y"); !errors.Is(err, ErrNoBus) {
 		t.Fatalf("no runtime directory: %v", err)
 	}
 }
 // fakeBinaries puts shell scripts named for programs first on PATH, and answers their directory.
 func fakeBinaries(t *testing.T, scripts map[string]string) string {
 	t.Helper()
 	dir := t.TempDir()
 	for name, body := range scripts {
 		if err := os.WriteFile(filepath.Join(dir, name), []byte("#!/bin/sh\n"+body+"\n"), 0o755); err != nil {
 			t.Fatal(err)
 		}
 	}
 	t.Setenv("PATH", dir+string(os.PathListSeparator)+os.Getenv("PATH"))
 	return dir
 }
@@ -1,5 +0,0 @@
 # The clipboard's history key (module clipmenu, novox/hq ADR 0208). Owned by the mesh: replaced at
 # every push. clipmenu shows the history through `dmenu`, the node's dmenu-compatible command, which
 # the holder of node-launcher answers (rofi on the workstations); the chosen entry is put back on the
 # clipboard.
 bindsym $mod+period exec --no-startup-id clipmenu -p Clipboard
@@ -1,5 +0,0 @@
 module clipmenu
 go 1.22
 require git.novox.be/novox/mesh-sdk/go v0.1.7
@@ -1,2 +0,0 @@
 git.novox.be/novox/mesh-sdk/go v0.1.7 h1:C0sTQmtTiyYH7bnqZb7PusXnqA37gKuT7Nqjn9gG47w=
 git.novox.be/novox/mesh-sdk/go v0.1.7/go.mod h1:GFuZUElBZ9A++mxgIKo97aXXo+kV0uJ/UkbhQPPIbrY=
@@ -1,75 +0,0 @@
 {
  "module": "clipmenu",
  "version": "1",
  "capabilities": [
    "package-manager"
  ],
  "requires": [
    "x11-display"
  ],
  "claims": [
    {
      "name": "node-clipboard",
      "scope": "node",
      "serves": [
        "history",
        "copy"
      ]
    }
  ],
  "tools": [
    "clipmenu_paste",
    "clipmenu_clear",
    "clipmenu_delete"
  ],
  "environment": {
    "variables": {
      "CM_SELECTIONS": "clipboard",
      "CM_MAX_CLIPS": "500",
      "CM_HISTLENGTH": "15"
    }
  },
  "shell": [
    {
      "for": "xinitrc",
      "slot": "normal",
      "code": "# The clipboard's history (module clipmenu, novox/hq ADR 0208): clipmenud collects every copy from\n# here on, once per session. It keeps the history in the account's runtime directory, so a reboot\n# forgets it, and with it every password that was ever copied.\nclipmenud &\n"
    }
  ],
  "resources": [
    {
      "id": "package",
      "type": "package",
      "package": "clipmenu"
    },
    {
      "id": "greenclip",
      "type": "package",
      "package": "rofi-greenclip",
      "absent": true
    },
    {
      "id": "i3-bindings",
      "type": "file",
      "path": "${machine:account-home}/.config/i3/config.d/50-clipmenu.conf",
      "owner": "${machine:account}",
      "mode": "0644",
      "content": "# The clipboard's history key (module clipmenu, novox/hq ADR 0208). Owned by the mesh: replaced at\n# every push. clipmenu shows the history through `dmenu`, the node's dmenu-compatible command, which\n# the holder of node-launcher answers (rofi on the workstations); the chosen entry is put back on the\n# clipboard.\nbindsym $mod+period exec --no-startup-id clipmenu -p Clipboard\n"
    }
  ],
  "build": {
    "artifacts": [
      {
        "name": "tools",
        "kind": "bundle",
        "language": "go",
        "system": "arch",
        "from": "cmd/clipmenu-tools",
        "binary": "clipmenu-tools",
        "loads": [
          "clipmenu-tools"
        ]
      }
    ]
  }
 }
@@ -0,0 +1,166 @@
 # docker
 The container runtime as a module (novox/hq to-be 42 phase 1, item 8; research 027/01–02; ADR 0166,
 ADR 0207). It claims the node seat `node-container-runtime`. That seat carries no verbs yet: its verbs,
 and the host creating containers through its holder, wait on ADR 0166's acceptance. Until then the
 tools below are the module's own.
 ## What it declares
 | resource | what | the host's rule |
 |---|---|---|
 | `package` | `docker` | installed if absent; never uninstalled when the module goes |
 | `buildx` | `docker-buildx` | the same. Only the build machine has it today; `docker build` needs it for BuildKit everywhere |
 | `socket` | `docker.socket` running, enabled at boot | given back as found when the module goes (ADR 0118) |
 | `prune-service`, `prune-timer` | `/etc/systemd/system/docker-prune.{service,timer}`, written whole | removed with the module |
 | `prune` | `docker-prune.timer` running, enabled at boot; restarted when either file changes | stopped and disabled with the module (the mesh made the unit) |
 The weekly prune takes **dangling images and build cache unused for a week, and nothing else**. It
 takes no volume, no container and no image a container uses, so it never touches a container the mesh
 holds. It runs at idle priority, at a random point in the hour after the weekly mark. A run missed
 while the machine was off happens at the next boot.
 **Capabilities:** `package-manager`, `service-manager`, `privileged`. It does not declare
 `container-runtime`: under ADR 0165, which is still proposed, that word means a running daemon, and
 the module that installs the daemon cannot require it.
 ## What it does not declare yet, and why
 Three things this module should own are already declared by other modules on every machine. The
 controller refuses two modules on one node that declare the same `path`, `unit`, `name` or `package`
 (`checkResources`, mesh-controller `internal/catalogue/resolve.go`). Declaring any of them here would
 make the module unassignable everywhere. The refusals were checked against the controller's own
 check:
 ```
 zsh and docker both declare the name "${machine:account}"
 dnsmasq and docker both declare the path "/etc/docker/daemon.json"
 dnsmasq and docker both declare the unit "docker.service"
 ```
 ### 1. `/etc/docker/daemon.json` and `docker.service` (issue 190)
 Today the file has three writers. Each writes into it (`into: json`, ADR 0102) and reloads the
 service:
 - **`dnsmasq`** writes `dns` and `live-restore`, through `dnsmasq.runtime-dns` and `dnsmasq.runtime`.
 - **The private network**, generated by the controller (`internal/overlay/generator.go`), writes
  `insecure-registries`. The collision check does not see generated resources.
 - **Nobody** writes log rotation. One machine has `log-driver` and `log-opts` by hand.
 **The change proposed, in one merge:**
 1. `dnsmasq` drops its `runtime-dns` and `runtime` resources.
 2. `docker` adds the two resources below:
   ```json
   {"id": "daemon", "type": "file", "path": "/etc/docker/daemon.json", "mode": "0644", "into": "json",
    "content": "{\"dns\": [\"${machine:address}\"], \"live-restore\": true, \"log-driver\": \"json-file\", \"log-opts\": {\"max-size\": \"100m\", \"max-file\": \"5\"}}\n"},
   {"id": "runtime", "type": "service", "unit": "docker.service", "state": "running", "boot": "enabled", "reload-on": ["daemon"]}
   ```
   The service is **reloaded, never restarted**: a restart stops every container. The daemon reads
   `live-restore` on a reload. It reads `dns`, `log-driver` and `log-opts` only at its next start, so
   they apply then (to containers created afterwards, for the log keys). With `live-restore` on, that
   start keeps every container running.
 **Why one merge, and only after this module is on every machine:**
 - In one apply, the host first gives back the resources that are no longer declared, then applies
  the new ones (mesh-host `apply.go`).
 - `dnsmasq` gives back `dns` and `live-restore` to what they held before it, and `docker` sets them
  again in the same apply. The daemon is reloaded once, after both steps.
 - A machine pushed the new `dnsmasq` *without* this module would keep its pre-mesh values for both
  keys. On one machine that is `live-restore: false`, and the next daemon restart there would stop
  every container.
 **Later:** the controller hands the registry to this module as a value, and the overlay stops
 generating its two resources (issue 190, steps 2 and 5). Until then the overlay keeps writing its one
 key beside this module's. The host merges disjoint keys correctly; the mesh-host `into.go` record is
 per resource.
 ### 2. The operator account's membership of the `docker` group
 The right shape is the host's `user` shape. Its `groups` are additive: the host runs
 `usermod --append` and never takes a group away.
 ```json
 {"id": "group", "type": "user", "name": "${machine:account}", "groups": ["docker"]}
 ```
 `zsh` already declares a `user` resource for the same account (its login shell). The controller
 compares `name` across modules, so the two collide.
 **The change proposed (mesh-controller, `checkResources`):** judge a `user` resource by the fields it
 sets, not by its name:
 - `shell` and `home` stay single-owner;
 - `groups` may be declared by any number of modules, because the host only adds them.
 Then this module declares the resource above, and no module has to carry another's group.
 Today the operator account is in the group on every machine, by hand. Nothing is lost while it waits.
 ## The bootstrap's runtime
 On the machine the mesh was first installed on, the foundation bundle declared `package docker`
 (`container-runtime`) and `docker.service` running and enabled (`container-runtime-running`). ADR 0207
 §5 exempts them.
 - The host records them under their bare ids, with origin *carried*. A mesh declaration's orphan pass
  never sees them (mesh-host `store.go`).
 - So `docker.package` here is a **second record of the same package**. The apply says "already
  installed", and neither record ever uninstalls it.
 - This module does not declare `docker.service` today, so nothing overlaps there. The proposed step
  1 would add a second record of that unit. Its found state is *running*, because genesis started
  it, so undeclaring this module would leave the daemon running.
 ## Tools
 The tools run as the operator account. If the daemon's socket refuses that account, a call is asked
 again through `sudo -n` (a process keeps the groups it started with). Every call has a 20 s bound.
 A failure is an error naming how it failed, never an empty answer.
 **Every container on the machine is in scope.** A container the mesh holds carries the host's label
 `mesh-host.id` (its value names the assignment), and every answer says `mesh_held`.
 | tool | | what |
 |---|---|---|
 | `docker_list` | r | every container: image, state, health, restarts, ports, mounts, compose project, `mesh_held`; filter by owner, state or name |
 | `docker_inspect` | r | one container whole, **environment values left out** (names kept) |
 | `docker_logs` | r | the last lines of both streams, merged in order, with timestamps (default 200, at most 2000) |
 | `docker_stats` | r | CPU, memory, I/O and process count per running container, heaviest first |
 | `docker_start` / `docker_stop` / `docker_restart` | a | one container. On a mesh-held one, the answer says the host restores its declared state at its next apply |
 | `docker_top` | r | the processes inside one container |
 | `docker_images` | r | images, largest first, with the containers using each; `dangling`, `unused` or `used` |
 | `docker_prune` | a | dangling images and build cache, and stopped containers the mesh does not hold if `containers` is true. **A dry run unless `dry_run` is false. Never a volume** |
 | `docker_disk_usage` | r | `docker system df -v`: total, active and reclaimable per kind, with the largest of each |
 | `docker_networks` | r | networks, subnets, and the containers on each |
 | `docker_volumes` | r | volumes, who mounts each, whether the mesh holds one of them, anonymous or not, and sizes if asked |
 | `docker_events` | r | the runtime's events over a window ending now (default 60 min, at most 24 h), without exec noise |
 | `docker_daemon_config` | r | `daemon.json` as on disk, `docker info`'s essentials, and keys the daemon has not taken yet |
 | `docker_unlabelled` | r | the containers the mesh does not hold: the cleanup list |
 | `docker_problems` | r | unhealthy, restarting, dead, killed for memory, failed, or restarted five times or more |
 | `docker_ports` | r | every published port, and the containers on the host's network |
 ## Tests
 ```
 go test ./...
 ```
 The tests run against a fake runner and cover:
 - escalation through `sudo -n` on a refused socket, and never as root;
 - each failure named by its cause;
 - a name or id never read as an option;
 - mesh-held marking;
 - the environment left out of `inspect`;
 - the restore note on a mesh-held act;
 - prune being a dry run by default and never reaching a volume, a mesh container or `--volumes`;
 - the log merge;
 - size parsing;
 - what the daemon has not yet taken;
 - event filtering;
 - volume ownership;
 - that the tools served are exactly the manifest's `tools`.
@@ -0,0 +1,360 @@
 package main
 import (
 	"context"
 	"encoding/json"
 	"errors"
 	"io/fs"
 	"os"
 	"reflect"
 	"strings"
 	"testing"
 	"time"
 )
 type call struct {
 	name string
 	args []string
 }
 // fake answers each command by the first rule whose prefix matches "name arg arg…".
 type fake struct {
 	rules []rule
 	calls []call
 }
 type rule struct {
 	prefix string
 	ran    Ran
 }
 func (f *fake) on(prefix string, r Ran) *fake { f.rules = append(f.rules, rule{prefix, r}); return f }
 func (f *fake) run(_ context.Context, name string, args ...string) Ran {
 	f.calls = append(f.calls, call{name, args})
 	line := strings.Join(append([]string{name}, args...), " ")
 	for _, r := range f.rules {
 		if strings.HasPrefix(line, r.prefix) {
 			return r.ran
 		}
 	}
 	return Ran{Status: 1, Stderr: "unexpected: " + line}
 }
 func (f *fake) ran(prefix string) bool {
 	for _, c := range f.calls {
 		if strings.HasPrefix(strings.Join(append([]string{c.name}, c.args...), " "), prefix) {
 			return true
 		}
 	}
 	return false
 }
 func client(f *fake, uid int) *Client {
 	return &Client{Run: f.run, UID: uid, ReadFile: func(string) ([]byte, error) { return nil, fs.ErrNotExist },
 		Now: func() time.Time { return time.Date(2026, 10, 4, 12, 0, 0, 0, time.UTC) }}
 }
 const held = `{"Id":"aaaaaaaaaaaaaaaa","Name":"/mesh-web","Created":"2026-10-01T00:00:00Z","Image":"sha256:img1",
 "Config":{"Image":"web:1","Labels":{"mesh-host.id":"hello-web.server","mesh-host.spec":"x"},"Env":["PASSWORD=hunter2","PATH=/bin"]},
 "State":{"Status":"running","Running":true,"StartedAt":"2026-10-01T00:00:01Z","FinishedAt":"0001-01-01T00:00:00Z","Health":{"Status":"healthy"}},
 "HostConfig":{"RestartPolicy":{"Name":"unless-stopped"},"NetworkMode":"bridge"},
 "NetworkSettings":{"Ports":{"80/tcp":[{"HostIp":"0.0.0.0","HostPort":"8080"}]}},
 "Mounts":[{"Type":"volume","Name":"webdata","Destination":"/data","RW":true}]}`
 const stray = `{"Id":"bbbbbbbbbbbbbbbb","Name":"/dev-db","Created":"2026-09-01T00:00:00Z","Image":"sha256:img2",
 "Config":{"Image":"postgres:16","Labels":{"com.docker.compose.project":"dev","com.docker.compose.project.working_dir":"/home/op/dev"}},
 "State":{"Status":"exited","ExitCode":1,"FinishedAt":"2026-09-02T00:00:00Z"},
 "HostConfig":{"RestartPolicy":{"Name":"no"}},"NetworkSettings":{"Ports":{}},
 "Mounts":[{"Type":"volume","Name":"dbdata","Destination":"/var/lib/postgresql/data","RW":true}]}`
 func machine() *fake {
 	return (&fake{}).
 		on("docker ps --all --quiet --no-trunc", Ran{Stdout: "aaaaaaaaaaaaaaaa\nbbbbbbbbbbbbbbbb\n"}).
 		on("docker container inspect aaaaaaaaaaaaaaaa bbbbbbbbbbbbbbbb", Ran{Stdout: "[" + held + "," + stray + "]"}).
 		on("docker container inspect mesh-web", Ran{Stdout: "[" + held + "]"}).
 		on("docker container inspect dev-db", Ran{Stdout: "[" + stray + "]"})
 }
 func TestARefusedSocketIsAskedAgainThroughSudoWithoutAPromptUnlessThisIsRoot(t *testing.T) {
 	denied := Ran{Status: 1, Stderr: "permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get ...: dial unix /var/run/docker.sock: connect: permission denied\n"}
 	f := (&fake{}).on("docker ", denied).on("sudo -n docker info", Ran{Stdout: "{}"})
 	if _, err := client(f, 1000).docker(context.Background(), "info", "--format", "{{json .}}"); err != nil {
 		t.Fatal(err)
 	}
 	if !f.ran("sudo -n docker info --format") {
 		t.Fatalf("not escalated: %+v", f.calls)
 	}
 	f = (&fake{}).on("docker ", denied)
 	if _, err := client(f, 0).docker(context.Background(), "info"); err == nil || f.ran("sudo") {
 		t.Fatalf("root escalated or answered: %v %+v", err, f.calls)
 	}
 }
 func TestFailuresAreNamedByHowTheyFailed(t *testing.T) {
 	denied := Ran{Status: 1, Stderr: "permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock\n"}
 	cases := map[string]*fake{
 		"may not escalate without a prompt": (&fake{}).on("docker ", denied).on("sudo ", Ran{Status: 1, Stderr: "sudo: a password is required\n"}),
 		"sudo is not installed":             (&fake{}).on("docker ", denied).on("sudo ", Ran{Status: 127, Err: "ENOENT"}),
 		"docker is not installed":           (&fake{}).on("docker ", Ran{Status: 127, Err: "ENOENT"}),
 		"daemon is not answering":           (&fake{}).on("docker ", Ran{Status: 1, Stderr: "Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?\n"}),
 		"did not answer: no answer within":  (&fake{}).on("docker ", Ran{Status: 124, Err: "no answer within 20 s"}),
 		"docker info failed (3): boom":      (&fake{}).on("docker ", Ran{Status: 3, Stderr: "boom\n"}),
 	}
 	for want, f := range cases {
 		_, err := client(f, 1000).docker(context.Background(), "info")
 		if err == nil || !strings.Contains(err.Error(), want) {
 			t.Errorf("want %q, got %v", want, err)
 		}
 	}
 }
 func TestANameIsNeverAnOption(t *testing.T) {
 	for _, bad := range []string{"--help", "-v", "", "a b", "x;y"} {
 		if _, err := Ref(bad); err == nil {
 			t.Errorf("%q accepted", bad)
 		}
 	}
 	for _, good := range []string{"mesh-web", "aaaaaaaaaaaa", "registry.mesh.internal:5100/x@sha256:abc", "dev_db.1"} {
 		if _, err := Ref(good); err != nil {
 			t.Errorf("%q refused: %v", good, err)
 		}
 	}
 	f := machine()
 	for _, verb := range []string{"start", "stop", "restart"} {
 		if _, err := client(f, 1000).Act(context.Background(), verb, "--rm"); err == nil {
 			t.Errorf("%s took an option", verb)
 		}
 	}
 	if len(f.calls) != 0 {
 		t.Fatalf("docker was called: %+v", f.calls)
 	}
 }
 func TestEveryContainerIsListedAndTheMeshsAreMarked(t *testing.T) {
 	c := client(machine(), 1000)
 	all, err := c.Containers(context.Background(), "", "", "")
 	if err != nil || len(all) != 2 {
 		t.Fatalf("%v %+v", err, all)
 	}
 	web, db := all[1], all[0]
 	if !web.MeshHeld || web.HeldBy != "hello-web.server" || web.Module != "hello-web" || web.Health != "healthy" {
 		t.Errorf("held: %+v", web)
 	}
 	if !reflect.DeepEqual(web.Ports, []string{"0.0.0.0:8080->80/tcp"}) || web.Mounts[0].Name != "webdata" {
 		t.Errorf("ports/mounts: %+v", web)
 	}
 	if db.MeshHeld || db.Compose != "dev" || db.ComposeDir != "/home/op/dev" || db.FinishedAt == "" {
 		t.Errorf("stray: %+v", db)
 	}
 	mesh, _ := c.Containers(context.Background(), "mesh", "", "")
 	other, _ := c.Containers(context.Background(), "other", "", "")
 	if len(mesh) != 1 || mesh[0].Name != "mesh-web" || len(other) != 1 || other[0].Name != "dev-db" {
 		t.Errorf("held filter: %+v / %+v", mesh, other)
 	}
 	if _, err := c.Containers(context.Background(), "mine", "", ""); err == nil {
 		t.Error("an unknown held filter was accepted")
 	}
 }
 func TestNoContainersIsAnEmptyListAndAFailureIsAnError(t *testing.T) {
 	got, err := client((&fake{}).on("docker ps", Ran{}), 1000).Containers(context.Background(), "", "", "")
 	if err != nil || got == nil || len(got) != 0 {
 		t.Fatalf("%v %v", got, err)
 	}
 	if _, err := client((&fake{}).on("docker ps", Ran{Status: 1, Stderr: "Cannot connect to the Docker daemon\n"}), 1000).Containers(context.Background(), "", "", ""); err == nil {
 		t.Fatal("a daemon that does not answer read as no containers")
 	}
 }
 func TestInspectLeavesTheEnvironmentsValuesOut(t *testing.T) {
 	got, err := client(machine(), 1000).Inspect(context.Background(), "mesh-web")
 	if err != nil {
 		t.Fatal(err)
 	}
 	b, _ := json.Marshal(got)
 	if strings.Contains(string(b), "hunter2") || !strings.Contains(string(b), `"PASSWORD"`) || got["mesh_held"] != true {
 		t.Fatalf("%s", b)
 	}
 }
 func TestActingOnAMeshContainerSaysTheHostRestoresIt(t *testing.T) {
 	f := machine().on("docker stop", Ran{}).on("docker start", Ran{})
 	got, err := client(f, 1000).Act(context.Background(), "stop", "mesh-web")
 	if err != nil {
 		t.Fatal(err)
 	}
 	if !f.ran("docker stop --time 10 mesh-web") || got["mesh_held"] != true || !strings.Contains(got["note"].(string), "host restores") {
 		t.Fatalf("%v %+v", got, f.calls)
 	}
 	got, _ = client(f, 1000).Act(context.Background(), "start", "dev-db")
 	if _, noted := got["note"]; noted || got["mesh_held"] != false {
 		t.Fatalf("a stray was noted: %v", got)
 	}
 }
 func TestPruneIsADryRunByDefaultAndNeverTouchesAVolumeOrAMeshContainer(t *testing.T) {
 	f := machine().
 		on("docker image ls --no-trunc --filter dangling=true", Ran{Stdout: `{"ID":"sha256:dead","Size":"1.5GB"}` + "\n"}).
 		on("docker system df --format", Ran{Stdout: `{"Type":"Build Cache","TotalCount":"3","Size":"2GB","Reclaimable":"1GB"}` + "\n"}).
 		on("docker image prune", Ran{Stdout: "Deleted Images:\nx\n\nTotal reclaimed space: 1.5GB\n"}).
 		on("docker builder prune", Ran{Stdout: "Total:\t1GB\n"}).
 		on("docker container rm", Ran{})
 	c := client(f, 1000)
 	got, err := c.Prune(context.Background(), PruneAsk{Images: true, BuildCache: true, Containers: true, DryRun: true})
 	if err != nil {
 		t.Fatal(err)
 	}
 	if f.ran("docker image prune") || f.ran("docker builder prune") || f.ran("docker container rm") {
 		t.Fatalf("a dry run removed something: %+v", f.calls)
 	}
 	if got["images"].(map[string]any)["dangling"] != 1 || !reflect.DeepEqual(got["containers"].(map[string]any)["stopped_not_held"], []string{"dev-db"}) {
 		t.Fatalf("%v", got)
 	}
 	got, err = c.Prune(context.Background(), PruneAsk{Images: true, BuildCache: true, Containers: true, OlderThanH: 24})
 	if err != nil {
 		t.Fatal(err)
 	}
 	if !f.ran("docker image prune --force --filter until=24h") || !f.ran("docker builder prune --force --filter until=24h") || !f.ran("docker container rm dev-db") {
 		t.Fatalf("not pruned: %+v", f.calls)
 	}
 	for _, c := range f.calls {
 		line := strings.Join(c.args, " ")
 		if strings.Contains(line, "volume") || strings.Contains(line, "mesh-web") && c.args[0] != "container" || strings.Contains(line, "--volumes") || strings.Contains(line, "--all") && c.args[0] != "ps" {
 			t.Errorf("prune reached too far: %s", line)
 		}
 	}
 	if got["images"].(map[string]any)["reclaimed"] != "1.5GB" || got["build_cache"].(map[string]any)["reclaimed"] != "1GB" {
 		t.Errorf("reclaimed: %v", got)
 	}
 }
 func TestLogsMergeBothStreamsInOrderAndKeepTheTail(t *testing.T) {
 	f := (&fake{}).on("docker logs", Ran{Stdout: "2026-10-04T10:00:01Z out one\n2026-10-04T10:00:03Z out two\n", Stderr: "2026-10-04T10:00:02Z err one\n"})
 	got, err := client(f, 1000).Logs(context.Background(), "web", 2, "30m")
 	if err != nil {
 		t.Fatal(err)
 	}
 	if !reflect.DeepEqual(got["lines"], []string{"2026-10-04T10:00:02Z err one", "2026-10-04T10:00:03Z out two"}) {
 		t.Fatalf("%v", got["lines"])
 	}
 	if !f.ran("docker logs --timestamps --tail 2 --since 30m web") {
 		t.Fatalf("%+v", f.calls)
 	}
 	if _, err := client(f, 1000).Logs(context.Background(), "web", 2, "--follow"); err == nil {
 		t.Fatal("since took an option")
 	}
 	f = (&fake{}).on("docker logs", Ran{Status: 1, Stderr: "Error response from daemon: No such container: nope\n"})
 	if _, err := client(f, 1000).Logs(context.Background(), "nope", 2, ""); err == nil {
 		t.Fatal("a missing container read as no lines")
 	}
 }
 func TestSizesAreReadAsDockerPrintsThem(t *testing.T) {
 	for in, want := range map[string]int64{"0B": 0, "55.63GB": 55630000000, "33.2MiB": 34812723, "1.5kB": 1500, "12MB (34%)": 12000000, "N/A": -1} {
 		if got := Bytes(in); got != want {
 			t.Errorf("%s: %d, want %d", in, got, want)
 		}
 	}
 }
 func TestDaemonConfigSaysWhatTheDaemonHasNotTakenYet(t *testing.T) {
 	f := (&fake{}).on("docker info", Ran{Stdout: `{"ServerVersion":"29.8.2","LiveRestoreEnabled":false,"LoggingDriver":"json-file","RegistryConfig":{"IndexConfigs":{"docker.io":{"Secure":true},"registry.mesh.internal:5100":{"Secure":false}}}}`})
 	c := client(f, 1000)
 	c.ReadFile = func(string) ([]byte, error) {
 		return []byte(`{"live-restore": true, "dns": ["10.0.0.1"], "log-driver": "local"}`), nil
 	}
 	got, err := c.DaemonConfig(context.Background())
 	if err != nil {
 		t.Fatal(err)
 	}
 	pending := strings.Join(got["pending"].([]string), "\n")
 	if !strings.Contains(pending, "live-restore is true in the file and false") || !strings.Contains(pending, "log-driver is local") {
 		t.Errorf("pending: %s", pending)
 	}
 	if !reflect.DeepEqual(got["daemon"].(map[string]any)["InsecureRegistries"], []string{"registry.mesh.internal:5100"}) {
 		t.Errorf("registries: %v", got["daemon"])
 	}
 	if !reflect.DeepEqual(got["read_only_at_start"], []string{"dns", "log-driver"}) {
 		t.Errorf("start-only: %v", got["read_only_at_start"])
 	}
 	c.ReadFile = func(string) ([]byte, error) { return nil, os.ErrNotExist }
 	got, _ = c.DaemonConfig(context.Background())
 	if !strings.HasPrefix(got["file_state"].(string), "absent") {
 		t.Errorf("absent: %v", got["file_state"])
 	}
 	c.ReadFile = func(string) ([]byte, error) { return nil, errors.New("permission denied") }
 	got, _ = c.DaemonConfig(context.Background())
 	if !strings.HasPrefix(got["file_state"].(string), "unreadable") {
 		t.Errorf("unreadable: %v", got["file_state"])
 	}
 }
 func TestEventsAreABoundedWindowWithoutExecNoise(t *testing.T) {
 	out := `{"Type":"container","Action":"exec_start: pg_isready","Actor":{"ID":"aaaaaaaaaaaaaaaa","Attributes":{"name":"db"}},"timeNano":1}
 {"Type":"container","Action":"die","Actor":{"ID":"aaaaaaaaaaaaaaaa","Attributes":{"name":"web","mesh-host.id":"hello-web.server","exitCode":"137"}},"timeNano":2}
 `
 	f := (&fake{}).on("docker events", Ran{Stdout: out})
 	got, err := client(f, 1000).Events(context.Background(), 30, "container", 10, false)
 	if err != nil {
 		t.Fatal(err)
 	}
 	evs := got["events"].([]map[string]any)
 	if len(evs) != 1 || evs[0]["action"] != "die" || evs[0]["mesh_held"] != true || evs[0]["exit_code"] != "137" {
 		t.Fatalf("%v", evs)
 	}
 	if !f.ran("docker events --since 30m --until 0s --format {{json .}} --filter type=container") {
 		t.Fatalf("%+v", f.calls)
 	}
 	if _, err := client(f, 1000).Events(context.Background(), 30, "secret", 10, false); err == nil {
 		t.Fatal("an unknown type was accepted")
 	}
 }
 func TestVolumesSayWhoMountsThemAndWhetherTheMeshDoes(t *testing.T) {
 	f := machine().
 		on("docker volume ls --quiet", Ran{Stdout: "webdata\ndbdata\nloose\n"}).
 		on("docker volume inspect", Ran{Stdout: `[{"Name":"webdata","Driver":"local"},{"Name":"dbdata","Driver":"local"},{"Name":"loose","Driver":"local","Labels":{"com.docker.volume.anonymous":""}}]`})
 	got, err := client(f, 1000).Volumes(context.Background(), false, false)
 	if err != nil {
 		t.Fatal(err)
 	}
 	vols := got["volumes"].([]map[string]any)
 	if vols[0]["mesh_held"] != true || vols[1]["mesh_held"] != false || len(vols[2]["mounted_by"].([]map[string]any)) != 0 || vols[2]["anonymous"] != true {
 		t.Fatalf("%v", vols)
 	}
 	got, _ = client(f, 1000).Volumes(context.Background(), true, false)
 	if got["count"] != 1 {
 		t.Fatalf("unmounted: %v", got)
 	}
 }
 func TestImagesNameTheirUsers(t *testing.T) {
 	f := machine().on("docker image ls", Ran{Stdout: `{"ID":"sha256:img1","Repository":"web","Tag":"1","Size":"100MB"}
 {"ID":"sha256:img3","Repository":"<none>","Tag":"<none>","Size":"2GB"}
 `})
 	got, err := client(f, 1000).Images(context.Background(), "", "", 10)
 	if err != nil {
 		t.Fatal(err)
 	}
 	imgs := got["images"].([]Image)
 	if imgs[0].ID != "sha256:img3" || !imgs[0].Dangling || imgs[1].UsedBy[0] != "mesh-web" || !imgs[1].MeshUsed {
 		t.Fatalf("%+v", imgs)
 	}
 	got, _ = client(f, 1000).Images(context.Background(), "unused", "", 10)
 	if got["count"] != 1 {
 		t.Fatalf("unused: %v", got)
 	}
 }
 func TestProblemsNameWhyAndUnlabelledIsTheCleanupList(t *testing.T) {
 	c := client(machine(), 1000)
 	p, err := c.Problems(context.Background())
 	if err != nil || len(p) != 1 || p[0]["name"] != "dev-db" || p[0]["why"].([]string)[0] != "exited 1" {
 		t.Fatalf("%v %v", p, err)
 	}
 	u, err := c.Unlabelled(context.Background())
 	if err != nil || u["count"] != 1 {
 		t.Fatalf("%v %v", u, err)
 	}
 }
@@ -0,0 +1,279 @@
 // docker's Go tools bundle (novox/hq ADR 0188, ADR 0193): a process the node's tool runtime launches
 // and speaks MCP over stdio to, through the Go SDK. It answers for every container on this machine —
 // the mesh's and every other — and for the runtime's images, networks, volumes, events and
 // configuration. It runs as the operator account (ADR 0175 §4); docker.go says how it reaches the
 // daemon's socket. The host applies the module's resources; these tools answer about the runtime.
 package main
 import (
 	"context"
 	"fmt"
 	"math"
 	"os"
 	"strings"
 	stdio "git.novox.be/novox/mesh-sdk/go"
 )
 func main() {
 	// An empty name serves as the module the runtime names (MESH_SERVED_MODULE): docker.
 	if err := stdio.Serve("", tools(NewClient())); err != nil {
 		fmt.Fprintln(os.Stderr, err)
 		os.Exit(1)
 	}
 }
 var containerArg = map[string]any{"type": "string", "description": "the container's name or id"}
 func tools(c *Client) []stdio.Tool {
 	ctx := context.Background()
 	act := func(verb, description string) stdio.Tool {
 		return stdio.Tool{
 			Name: "docker_" + verb, Description: description,
 			Input: map[string]any{"container": containerArg},
 			Run: func(args map[string]any) (any, error) {
 				ref, err := text(args, "container")
 				if err != nil {
 					return nil, err
 				}
 				return c.Act(ctx, verb, ref)
 			},
 		}
 	}
 	return []stdio.Tool{
 		{
 			Name: "docker_list",
 			Description: "Every container on this machine — the mesh's and every other — with its image, state, health, restarts, " +
 				"published ports, mounts, compose project, and mesh_held/held_by (the assignment that holds it).",
 			Input: map[string]any{
 				"held":  map[string]any{"type": "string", "enum": []string{"all", "mesh", "other"}, "description": "whose: all (default), the mesh's, or the others"},
 				"state": map[string]any{"type": "string", "description": "only containers in this state (running, exited, created, restarting, paused, dead)"},
 				"match": map[string]any{"type": "string", "description": "only containers whose name or image contains this"},
 			},
 			Run: func(args map[string]any) (any, error) {
 				list, err := c.Containers(ctx, optional(args, "held"), optional(args, "state"), optional(args, "match"))
 				if err != nil {
 					return nil, err
 				}
 				return map[string]any{"count": len(list), "containers": list}, nil
 			},
 		},
 		{
 			Name:        "docker_inspect",
 			Description: "One container whole, as docker inspects it, with mesh_held; its environment's values are left out (names kept), because that is where a container's secrets are.",
 			Input:       map[string]any{"container": containerArg},
 			Run: func(args map[string]any) (any, error) {
 				ref, err := text(args, "container")
 				if err != nil {
 					return nil, err
 				}
 				return c.Inspect(ctx, ref)
 			},
 		},
 		{
 			Name:        "docker_logs",
 			Description: "The last lines one container wrote, both streams merged in order, each with its timestamp (default 200, at most 2000 lines; a line is cut at 4 KiB).",
 			Input: map[string]any{
 				"container": containerArg,
 				"lines":     map[string]any{"type": "integer", "description": "how many lines from the end (default 200, at most 2000)"},
 				"since":     map[string]any{"type": "string", "description": "only lines since then: a duration such as 30m or 2h, or a time"},
 			},
 			Run: func(args map[string]any) (any, error) {
 				ref, err := text(args, "container")
 				if err != nil {
 					return nil, err
 				}
 				n, err := bounded(args, "lines", 200, 2000)
 				if err != nil {
 					return nil, err
 				}
 				return c.Logs(ctx, ref, n, optional(args, "since"))
 			},
 		},
 		{
 			Name:        "docker_stats",
 			Description: "What the running containers use now — CPU, memory, network and disk I/O, processes — the heaviest by memory first; or one container's.",
 			Input:       map[string]any{"container": map[string]any{"type": "string", "description": "one container (optional)"}},
 			Run: func(args map[string]any) (any, error) {
 				stats, err := c.Stats(ctx, optional(args, "container"))
 				if err != nil {
 					return nil, err
 				}
 				return map[string]any{"count": len(stats), "containers": stats}, nil
 			},
 		},
 		act("start", "Start one container. A container the mesh holds is started too, and the answer says the host restores what its declaration says at its next apply."),
 		act("stop", "Stop one container (ten seconds, then killed). For a container the mesh holds, the answer says the host will start it again at its next apply if its declaration says running."),
 		act("restart", "Restart one container (ten seconds to stop, then killed); the answer says whether the mesh holds it."),
 		{
 			Name:        "docker_top",
 			Description: "The processes running inside one container: pid, user, elapsed time, CPU, resident memory and command.",
 			Input:       map[string]any{"container": containerArg},
 			Run: func(args map[string]any) (any, error) {
 				ref, err := text(args, "container")
 				if err != nil {
 					return nil, err
 				}
 				return c.Top(ctx, ref)
 			},
 		},
 		{
 			Name: "docker_images",
 			Description: "The images on this machine, the largest first, each with its size and the containers using it (and whether one of them is the mesh's). " +
 				"filter: all, dangling, unused or used.",
 			Input: map[string]any{
 				"filter": map[string]any{"type": "string", "enum": []string{"all", "dangling", "unused", "used"}, "description": "which images (default all)"},
 				"match":  map[string]any{"type": "string", "description": "only images whose repository:tag contains this"},
 				"limit":  map[string]any{"type": "integer", "description": "how many to show (default 100, at most 1000); count says how many matched"},
 			},
 			Run: func(args map[string]any) (any, error) {
 				n, err := bounded(args, "limit", 100, 1000)
 				if err != nil {
 					return nil, err
 				}
 				return c.Images(ctx, optional(args, "filter"), optional(args, "match"), n)
 			},
 		},
 		{
 			Name: "docker_prune",
 			Description: "Reclaim space: dangling images and unused build cache, and — only when containers is true — stopped containers the mesh does not hold. " +
 				"Never a volume, never a container the mesh holds, never an image a container uses. A dry run by default: it lists what would go; dry_run false removes it.",
 			Input: map[string]any{
 				"dry_run":          map[string]any{"type": "boolean", "description": "list only (default true)"},
 				"images":           map[string]any{"type": "boolean", "description": "dangling images (default true)"},
 				"build_cache":      map[string]any{"type": "boolean", "description": "build cache nothing refers to (default true)"},
 				"containers":       map[string]any{"type": "boolean", "description": "stopped containers the mesh does not hold (default false); what they mounted is kept"},
 				"older_than_hours": map[string]any{"type": "integer", "description": "only what is older than this many hours (default 0: any age)"},
 			},
 			Run: func(args map[string]any) (any, error) {
 				older := 0
 				if v, ok := args["older_than_hours"]; ok && v != nil && v != float64(0) {
 					n, err := bounded(args, "older_than_hours", 0, 24*365)
 					if err != nil {
 						return nil, err
 					}
 					older = n
 				}
 				return c.Prune(ctx, PruneAsk{
 					DryRun: flag(args, "dry_run", true), Images: flag(args, "images", true), BuildCache: flag(args, "build_cache", true),
 					Containers: flag(args, "containers", false), OlderThanH: older,
 				})
 			},
 		},
 		{
 			Name:        "docker_disk_usage",
 			Description: "What the runtime takes on disk (docker system df -v): per kind — images, containers, volumes, build cache — the total, the active and the reclaimable, and the largest of each.",
 			Input:       map[string]any{"top": map[string]any{"type": "integer", "description": "how many of the largest per kind (default 10, at most 100)"}},
 			Run: func(args map[string]any) (any, error) {
 				n, err := bounded(args, "top", 10, 100)
 				if err != nil {
 					return nil, err
 				}
 				return c.DiskUsage(ctx, n)
 			},
 		},
 		{
 			Name:        "docker_networks",
 			Description: "Every network the runtime has: driver, scope, subnets and gateway, and the running containers on it with their addresses and whether the mesh holds them.",
 			Run:         func(map[string]any) (any, error) { return c.Networks(ctx) },
 		},
 		{
 			Name:        "docker_volumes",
 			Description: "Every volume with the containers mounting it, whether the mesh holds any of them, whether it is anonymous, its compose project, and — when sizes is true (slower) — its size.",
 			Input: map[string]any{
 				"unmounted": map[string]any{"type": "boolean", "description": "only volumes no container mounts (default false)"},
 				"sizes":     map[string]any{"type": "boolean", "description": "measure each volume (default false: it walks every volume)"},
 			},
 			Run: func(args map[string]any) (any, error) {
 				return c.Volumes(ctx, flag(args, "unmounted", false), flag(args, "sizes", false))
 			},
 		},
 		{
 			Name:        "docker_events",
 			Description: "What the runtime did in a window ending now (default the last 60 minutes, at most 24 hours): containers created, started, died, health changes, images pulled — with mesh_held. Exec events are left out unless asked.",
 			Input: map[string]any{
 				"minutes": map[string]any{"type": "integer", "description": "how far back (default 60, at most 1440)"},
 				"type":    map[string]any{"type": "string", "description": "only one kind: container, image, network, volume, daemon, plugin or builder"},
 				"limit":   map[string]any{"type": "integer", "description": "the latest this many (default 200, at most 2000)"},
 				"execs":   map[string]any{"type": "boolean", "description": "include exec_* events (default false: health checks make many)"},
 			},
 			Run: func(args map[string]any) (any, error) {
 				minutes, err := bounded(args, "minutes", 60, 1440)
 				if err != nil {
 					return nil, err
 				}
 				limit, err := bounded(args, "limit", 200, 2000)
 				if err != nil {
 					return nil, err
 				}
 				return c.Events(ctx, minutes, optional(args, "type"), limit, flag(args, "execs", false))
 			},
 		},
 		{
 			Name: "docker_daemon_config",
 			Description: "The runtime's configuration: /etc/docker/daemon.json as it is on disk, the daemon's essentials as it runs now (docker info: version, storage and logging drivers, " +
 				"live restore, root directory, insecure registries, warnings), and where the two differ — keys a reload or only a restart would take.",
 			Run: func(map[string]any) (any, error) { return c.DaemonConfig(ctx) },
 		},
 		{
 			Name:        "docker_unlabelled",
 			Description: "The containers the mesh does not hold — the cleanup list — each with its image, state, compose project and directory, ports and mounts.",
 			Run:         func(map[string]any) (any, error) { return c.Unlabelled(ctx) },
 		},
 		{
 			Name:        "docker_problems",
 			Description: "Every container that is not well: unhealthy, restarting, dead, killed for memory, exited with a failure, or restarted five times or more — with whether the mesh holds it.",
 			Run: func(map[string]any) (any, error) {
 				p, err := c.Problems(ctx)
 				if err != nil {
 					return nil, err
 				}
 				return map[string]any{"count": len(p), "containers": p}, nil
 			},
 		},
 		{
 			Name:        "docker_ports",
 			Description: "Every port the containers publish on this machine (address:port -> container port), and the containers on the host's network, which publish whatever they listen on.",
 			Run: func(map[string]any) (any, error) {
 				p, err := c.Ports(ctx)
 				if err != nil {
 					return nil, err
 				}
 				return map[string]any{"count": len(p), "ports": p}, nil
 			},
 		},
 	}
 }
 func text(args map[string]any, key string) (string, error) {
 	s, _ := args[key].(string)
 	if s = strings.TrimSpace(s); s == "" {
 		return "", fmt.Errorf("%s is required", key)
 	}
 	return s, nil
 }
 func optional(args map[string]any, key string) string {
 	s, _ := args[key].(string)
 	return strings.TrimSpace(s)
 }
 func flag(args map[string]any, key string, def bool) bool {
 	if b, ok := args[key].(bool); ok {
 		return b
 	}
 	return def
 }
 // bounded is a whole number argument, defaulted when absent and held to a ceiling.
 func bounded(args map[string]any, key string, def, most int) (int, error) {
 	v, ok := args[key]
 	if !ok || v == nil {
 		return def, nil
 	}
 	f, ok := v.(float64)
 	if !ok || f != math.Trunc(f) || f < 1 {
 		return 0, fmt.Errorf("%s must be a whole number of at least 1", key)
 	}
 	return int(math.Min(f, float64(most))), nil
 }
@@ -0,0 +1,59 @@
 package main
 import (
 	"bytes"
 	"context"
 	"errors"
 	"fmt"
 	"os/exec"
 	"strings"
 	"time"
 )
 // Ran is what a command did: its output, its exit status, and why it never ran to an answer.
 type Ran struct {
 	Stdout string
 	Stderr string
 	Status int
 	// Err is "ENOENT" when the program is not installed, or says it was ended for taking too long.
 	Err string
 }
 // Runner runs one command, so every tool can be tested without a daemon.
 type Runner func(ctx context.Context, name string, args ...string) Ran
 // CallTimeout is how long one docker command may take: below the runtime's thirty-second call
 // limit, so a daemon that hangs is answered as such rather than as a call the runtime gave up on.
 const CallTimeout = 20 * time.Second
 // ExecRunner runs a command on this machine, bounded by CallTimeout.
 func ExecRunner(ctx context.Context, name string, args ...string) Ran {
 	ctx, cancel := context.WithTimeout(ctx, CallTimeout)
 	defer cancel()
 	cmd := exec.CommandContext(ctx, name, args...)
 	var out, errb bytes.Buffer
 	cmd.Stdout, cmd.Stderr = &out, &errb
 	err := cmd.Run()
 	r := Ran{Stdout: out.String(), Stderr: errb.String()}
 	var exitErr *exec.ExitError
 	switch {
 	case errors.Is(ctx.Err(), context.DeadlineExceeded):
 		r.Status, r.Err = 124, fmt.Sprintf("no answer within %d s", int(CallTimeout/time.Second))
 	case errors.Is(err, exec.ErrNotFound):
 		r.Status, r.Err = 127, "ENOENT"
 	case errors.As(err, &exitErr):
 		r.Status = exitErr.ExitCode()
 	case err != nil:
 		r.Status, r.Err = 1, err.Error()
 	}
 	return r
 }
 func firstLine(s string) string {
 	for _, l := range strings.Split(s, "\n") {
 		if l = strings.TrimSpace(l); l != "" {
 			return l
 		}
 	}
 	return ""
 }
@@ -0,0 +1,60 @@
 package main
 import (
 	"encoding/json"
 	"os"
 	"reflect"
 	"sort"
 	"strings"
 	"testing"
 )
 func TestTheToolsServedAreTheToolsTheManifestNames(t *testing.T) {
 	raw, err := os.ReadFile("../../module.json")
 	if err != nil {
 		t.Fatal(err)
 	}
 	var m struct {
 		Tools []string `json:"tools"`
 	}
 	if err := json.Unmarshal(raw, &m); err != nil {
 		t.Fatal(err)
 	}
 	served := []string{}
 	for _, tool := range tools(client(&fake{}, 1000)) {
 		if !strings.HasPrefix(tool.Name, "docker_") || tool.Description == "" || tool.Run == nil {
 			t.Errorf("tool %q", tool.Name)
 		}
 		served = append(served, tool.Name)
 	}
 	sort.Strings(served)
 	listed := append([]string{}, m.Tools...)
 	sort.Strings(listed)
 	if !reflect.DeepEqual(served, listed) {
 		t.Fatalf("served %v, manifest %v", served, listed)
 	}
 }
 func TestNumbersAreDefaultedAndBounded(t *testing.T) {
 	if n, _ := bounded(map[string]any{}, "lines", 200, 2000); n != 200 {
 		t.Error(n)
 	}
 	if n, _ := bounded(map[string]any{"lines": float64(99999)}, "lines", 200, 2000); n != 2000 {
 		t.Error(n)
 	}
 	for _, bad := range []any{float64(0), float64(-1), float64(1.5), "10"} {
 		if _, err := bounded(map[string]any{"lines": bad}, "lines", 200, 2000); err == nil {
 			t.Errorf("%v accepted", bad)
 		}
 	}
 }
 func TestAStopFromTheToolNeedsAContainer(t *testing.T) {
 	for _, tool := range tools(client(&fake{}, 1000)) {
 		if tool.Name == "docker_stop" {
 			if _, err := tool.Run(map[string]any{}); err == nil {
 				t.Fatal("a stop without a container was accepted")
 			}
 		}
 	}
 }
@@ -0,0 +1,5 @@
 module docker
 go 1.22
 require git.novox.be/novox/mesh-sdk/go v0.1.6
@@ -0,0 +1,2 @@
 git.novox.be/novox/mesh-sdk/go v0.1.6 h1:9qzdYONYbJdWcu6sxQcq9v1LI0JxcfkiKYkMUzJSkVQ=
 git.novox.be/novox/mesh-sdk/go v0.1.6/go.mod h1:GFuZUElBZ9A++mxgIKo97aXXo+kV0uJ/UkbhQPPIbrY=
@@ -0,0 +1,94 @@
 {
  "module": "docker",
  "version": "1",
  "capabilities": [
    "package-manager",
    "service-manager",
    "privileged"
  ],
  "claims": [
    {
      "name": "node-container-runtime",
      "scope": "node"
    }
  ],
  "tools": [
    "docker_list",
    "docker_inspect",
    "docker_logs",
    "docker_stats",
    "docker_start",
    "docker_stop",
    "docker_restart",
    "docker_top",
    "docker_images",
    "docker_prune",
    "docker_disk_usage",
    "docker_networks",
    "docker_volumes",
    "docker_events",
    "docker_daemon_config",
    "docker_unlabelled",
    "docker_problems",
    "docker_ports"
  ],
  "resources": [
    {
      "id": "package",
      "type": "package",
      "package": "docker"
    },
    {
      "id": "buildx",
      "type": "package",
      "package": "docker-buildx"
    },
    {
      "id": "socket",
      "type": "service",
      "unit": "docker.socket",
      "state": "running",
      "boot": "enabled"
    },
    {
      "id": "prune-service",
      "type": "file",
      "path": "/etc/systemd/system/docker-prune.service",
      "mode": "0644",
      "content": "# Generated by the mesh. Do not edit — module docker writes this file and replaces it at every push.\n[Unit]\nDescription=Prune dangling images and unused build cache (the mesh's docker module)\n# Never volumes, never a container, never an image a container uses: dangling\n# images and build cache nothing refers to, unused for a week. What a person\n# prunes beyond that is docker_prune's, by hand.\nAfter=docker.service\nConditionPathExists=/run/docker.sock\n\n[Service]\nType=oneshot\nNice=19\nIOSchedulingClass=idle\nExecStart=/usr/bin/docker image prune --force --filter until=168h\nExecStart=/usr/bin/docker builder prune --force --filter until=168h\n"
    },
    {
      "id": "prune-timer",
      "type": "file",
      "path": "/etc/systemd/system/docker-prune.timer",
      "mode": "0644",
      "content": "# Generated by the mesh. Do not edit — module docker writes this file and replaces it at every push.\n[Unit]\nDescription=Weekly prune of dangling images and unused build cache (the mesh's docker module)\n\n[Timer]\nOnCalendar=weekly\nRandomizedDelaySec=1h\nPersistent=true\n\n[Install]\nWantedBy=timers.target\n"
    },
    {
      "id": "prune",
      "type": "service",
      "unit": "docker-prune.timer",
      "state": "running",
      "boot": "enabled",
      "restart-on": [
        "prune-service",
        "prune-timer"
      ]
    }
  ],
  "build": {
    "artifacts": [
      {
        "name": "tools",
        "kind": "bundle",
        "language": "go",
        "system": "arch",
        "from": "cmd/docker-tools",
        "binary": "docker-tools",
        "loads": [
          "docker-tools"
        ]
      }
    ]
  }
 }
@@ -1,60 +0,0 @@
 # dunst
 The notifier as a module (novox/hq ADR 0208, research 026/05).
 - Installs `dunst`, and `libnotify` for `notify-send`, the client every program and these tools use.
 - Claims the mesh's `node-notifier` seat and serves its verbs `send` and `history`.
 - Owns `~/.config/dunst/dunstrc` and the directory `~/.config/dunst/dunstrc.d/`. Another module's
  rule is that module's own file in the directory (ADR 0208 §4). dunst reads the directory after
  `dunstrc`, so a drop-in outranks it.
 - **Starts nothing.** The package registers dunst with D-Bus, which starts it on the first
  notification, inside the account's service manager. There is no autostart line, no unit and no
  session-start contribution.
 - **Requires no display of its own.** dunst speaks both X11 and Wayland and picks the one the session
  has, so it serves an X session and a later sway one alike.
 ## Tools
 Every tool goes over the account's session bus. None needs the screen, and each answers clearly when
 the account is not logged in.
 | tool | does |
 |---|---|
 | `node-notifier.send` | a notification: title, body, urgency, sender, icon, how long; answers its id |
 | `node-notifier.history` | what was shown, newest first, with how long ago |
 | `dunst_pause` / `dunst_resume` | do not disturb: notifications are held back, not lost |
 | `dunst_close_all` | clear the screen; the history keeps them |
 | `dunst_rules` | the rules the running notifier holds, and the files they come from |
 | `dunst_count` | shown, waiting, in history, and whether paused |
 ## What it chose, and what it improves
 The workstations' files differed: one had the notifications bottom-right, 15 % transparent and with
 rounded corners; the other top-right, opaque and square. This module takes the second, because the
 rest of the desktop is square and opaque, and the top-right corner sits under the bar that shows the
 count. The file keeps only the settings that differ from dunst's defaults.
 - **The context menu works.** It called `/usr/bin/dmenu`, installed on neither machine. It now calls
  `dmenu`, the seat command of whichever module holds `node-launcher` (`rofi` on the workstations).
 - **The face is the interface one,** Inter (research 026/04), instead of a monospace Nerd font.
 - `icon_path`, which named two directories of an icon theme that is not installed, is gone. The icon
  theme is looked up recursively.
 ## What it leaves as found
 - `~/.config/dunst/dunstrc.d/50-slack.conf`, the Slack rule. It becomes the Slack module's own drop-in
  when there is one, and until then it is the operator's file in a directory this module owns.
 ## Migration (ADR 0182)
 - The first push keeps the found `dunstrc` once, then writes the module's.
 - **The desktop runs two notification daemons** because its session began before the session bus
  fix (research 026/01). That ends at the next login, and nothing here starts a second one.
  `dunst_count` after logging in again shows the one daemon's counts.
 ## Blockers
 - `node-notifier` is ADR 0208's seat. Until the controller knows it, `mctl` reads the claim as
  unknown.
 - `dunst_rules` and the counts ask the running notifier. When none runs, the bus starts one, which
  needs a session to draw on.
@@ -1,97 +0,0 @@
 // Reading a tool's arguments: JSON numbers arrive as float64, and a missing argument is its default.
 // The same in every desktop module that carries it.
 package main
 import (
 	"fmt"
 	"math"
 	"strings"
 	"time"
 )
 // text is a string argument, trimmed; required says an empty one is refused.
 func text(args map[string]any, key string, required bool) (string, error) {
 	v, present := args[key]
 	if !present || v == nil {
 		if required {
 			return "", fmt.Errorf("%s is required", key)
 		}
 		return "", nil
 	}
 	s, ok := v.(string)
 	if !ok {
 		return "", fmt.Errorf("%s is a string, not %T", key, v)
 	}
 	s = strings.TrimSpace(s)
 	if s == "" && required {
 		return "", fmt.Errorf("%s is required", key)
 	}
 	return s, nil
 }
 // whole is a whole-number argument within [least, most], or def when absent.
 func whole(args map[string]any, key string, def, least, most int) (int, error) {
 	v, present := args[key]
 	if !present || v == nil {
 		return def, nil
 	}
 	f, ok := v.(float64)
 	if !ok {
 		if i, isInt := v.(int); isInt {
 			f = float64(i)
 		} else {
 			return 0, fmt.Errorf("%s is a number, not %T", key, v)
 		}
 	}
 	if f != math.Trunc(f) {
 		return 0, fmt.Errorf("%s is a whole number, not %v", key, f)
 	}
 	n := int(f)
 	if n < least || n > most {
 		return 0, fmt.Errorf("%s is %d; it is between %d and %d", key, n, least, most)
 	}
 	return n, nil
 }
 // flag is a boolean argument, or def when absent.
 func flag(args map[string]any, key string, def bool) (bool, error) {
 	v, present := args[key]
 	if !present || v == nil {
 		return def, nil
 	}
 	b, ok := v.(bool)
 	if !ok {
 		return false, fmt.Errorf("%s is true or false, not %T", key, v)
 	}
 	return b, nil
 }
 // texts is a list-of-strings argument.
 func texts(args map[string]any, key string) ([]string, error) {
 	v, present := args[key]
 	if !present || v == nil {
 		return nil, nil
 	}
 	list, ok := v.([]any)
 	if !ok {
 		if ss, isStrings := v.([]string); isStrings {
 			return ss, nil
 		}
 		return nil, fmt.Errorf("%s is a list of strings, not %T", key, v)
 	}
 	out := make([]string, 0, len(list))
 	for i, item := range list {
 		s, ok := item.(string)
 		if !ok {
 			return nil, fmt.Errorf("%s[%d] is a string, not %T", key, i, item)
 		}
 		out = append(out, s)
 	}
 	return out, nil
 }
 // seconds is a timeout argument in seconds, defaulted and bounded below the runtime's call limit.
 func seconds(args map[string]any, key string, def, most int) (time.Duration, error) {
 	n, err := whole(args, key, def, 1, most)
 	return time.Duration(n) * time.Second, err
 }
@@ -1,355 +0,0 @@
 package main
 import (
 	"encoding/json"
 	"fmt"
 	"os"
 	"path/filepath"
 	"sort"
 	"strconv"
 	"strings"
 	"syscall"
 	"time"
 	"unsafe"
 )
 var urgencies = []string{"low", "normal", "critical"}
 const busTimeout = 10 * time.Second
 // Notification is what node-notifier.send shows.
 type Notification struct {
 	Summary   string
 	Body      string
 	Urgency   string
 	AppName   string
 	Icon      string
 	ExpireMS  int
 	Category  string
 	ReplaceID int
 }
 func notificationOf(args map[string]any) (Notification, error) {
 	var n Notification
 	var err error
 	if n.Summary, err = text(args, "summary", true); err != nil {
 		return n, err
 	}
 	if n.Body, err = text(args, "body", false); err != nil {
 		return n, err
 	}
 	if n.Urgency, err = text(args, "urgency", false); err != nil {
 		return n, err
 	}
 	if n.Urgency == "" {
 		n.Urgency = "normal"
 	}
 	known := false
 	for _, u := range urgencies {
 		known = known || u == n.Urgency
 	}
 	if !known {
 		return n, fmt.Errorf("urgency %q is low, normal or critical", n.Urgency)
 	}
 	if n.AppName, err = text(args, "app_name", false); err != nil {
 		return n, err
 	}
 	if n.AppName == "" {
 		n.AppName = "mesh"
 	}
 	if n.Icon, err = text(args, "icon", false); err != nil {
 		return n, err
 	}
 	if n.ExpireMS, err = whole(args, "expire_ms", -1, 0, 24*3600*1000); err != nil {
 		return n, err
 	}
 	if n.Category, err = text(args, "category", false); err != nil {
 		return n, err
 	}
 	n.ReplaceID, err = whole(args, "replace_id", 0, 0, 1<<31-1)
 	return n, err
 }
 // SendResult is what node-notifier.send answers.
 type SendResult struct {
 	ID int `json:"id"`
 }
 // Send shows a notification through the desktop's notification service, whichever runs it.
 func Send(n Notification) (SendResult, error) {
 	s, err := findBus()
 	if err != nil {
 		return SendResult{}, err
 	}
 	args := []string{"--print-id", "--urgency=" + n.Urgency, "--app-name=" + n.AppName}
 	if n.Icon != "" {
 		args = append(args, "--icon="+n.Icon)
 	}
 	if n.ExpireMS >= 0 {
 		args = append(args, "--expire-time="+strconv.Itoa(n.ExpireMS))
 	}
 	if n.Category != "" {
 		args = append(args, "--category="+n.Category)
 	}
 	if n.ReplaceID > 0 {
 		args = append(args, "--replace-id="+strconv.Itoa(n.ReplaceID))
 	}
 	// "--" so a title that starts with a dash is a title.
 	args = append(args, "--", n.Summary)
 	if n.Body != "" {
 		args = append(args, n.Body)
 	}
 	r, err := s.run(busTimeout, "", "notify-send", args...)
 	if err != nil {
 		return SendResult{}, err
 	}
 	if r.Code != 0 {
 		return SendResult{}, fmt.Errorf("notify-send: %s", strings.TrimSpace(r.Stderr))
 	}
 	id, err := strconv.Atoi(strings.TrimSpace(r.Stdout))
 	if err != nil {
 		return SendResult{}, fmt.Errorf("notify-send answered no id: %q", r.Stdout)
 	}
 	return SendResult{ID: id}, nil
 }
 // dunstctl runs one dunstctl command over the session bus and answers what it printed.
 func dunstctl(args ...string) (string, error) {
 	s, err := findBus()
 	if err != nil {
 		return "", err
 	}
 	r, err := s.run(busTimeout, "", "dunstctl", args...)
 	if err != nil {
 		return "", err
 	}
 	if r.Code != 0 {
 		return "", fmt.Errorf("dunstctl %s: %s", strings.Join(args, " "), strings.TrimSpace(r.Stderr+r.Stdout))
 	}
 	return r.Stdout, nil
 }
 // variantMaps reads busctl's JSON form of an array of dictionaries (aa{sv}), which is how dunstctl
 // answers history and rules, into plain maps.
 func variantMaps(raw string) ([]map[string]any, error) {
 	var doc struct {
 		Type string `json:"type"`
 		Data [][]map[string]struct {
 			Data any `json:"data"`
 		} `json:"data"`
 	}
 	if err := json.Unmarshal([]byte(raw), &doc); err != nil {
 		return nil, fmt.Errorf("dunstctl's answer is not the bus's JSON: %w", err)
 	}
 	if doc.Type != "aa{sv}" {
 		return nil, fmt.Errorf("dunstctl answered %s, not aa{sv}", doc.Type)
 	}
 	out := []map[string]any{}
 	for _, group := range doc.Data {
 		for _, entry := range group {
 			m := map[string]any{}
 			for k, v := range entry {
 				m[k] = v.Data
 			}
 			out = append(out, m)
 		}
 	}
 	return out, nil
 }
 // Shown is one notification in the history.
 type Shown struct {
 	ID         int    `json:"id"`
 	AppName    string `json:"app_name"`
 	Summary    string `json:"summary"`
 	Body       string `json:"body,omitempty"`
 	Urgency    string `json:"urgency"`
 	Category   string `json:"category,omitempty"`
 	AgeSeconds int64  `json:"age_seconds"`
 }
 // HistoryResult is what node-notifier.history answers.
 type HistoryResult struct {
 	Total         int     `json:"total"`
 	Notifications []Shown `json:"notifications"`
 }
 // History is dunst's history, newest first.
 func History(limit int) (HistoryResult, error) {
 	raw, err := dunstctl("history")
 	if err != nil {
 		return HistoryResult{}, err
 	}
 	return parseHistory(raw, monotonicMicros(), limit)
 }
 func parseHistory(raw string, nowMicros int64, limit int) (HistoryResult, error) {
 	entries, err := variantMaps(raw)
 	if err != nil {
 		return HistoryResult{}, err
 	}
 	out := HistoryResult{Total: len(entries), Notifications: []Shown{}}
 	type stamped struct {
 		Shown
 		at int64
 	}
 	var all []stamped
 	for _, e := range entries {
 		at := number(e["timestamp"])
 		all = append(all, stamped{Shown{
 			ID: int(number(e["id"])), AppName: str(e["appname"]), Summary: str(e["summary"]), Body: str(e["body"]),
 			Urgency: strings.ToLower(str(e["urgency"])), Category: str(e["category"]),
 			AgeSeconds: max(0, (nowMicros-at)/1_000_000),
 		}, at})
 	}
 	sort.SliceStable(all, func(i, j int) bool { return all[i].at > all[j].at })
 	for i, s := range all {
 		if i == limit {
 			break
 		}
 		out.Notifications = append(out.Notifications, s.Shown)
 	}
 	return out, nil
 }
 func number(v any) int64 {
 	switch n := v.(type) {
 	case float64:
 		return int64(n)
 	case json.Number:
 		i, _ := n.Int64()
 		return i
 	}
 	return 0
 }
 func str(v any) string {
 	s, _ := v.(string)
 	return s
 }
 // monotonicMicros is the clock dunst stamps its notifications with (CLOCK_MONOTONIC, microseconds).
 func monotonicMicros() int64 {
 	var ts syscall.Timespec
 	const clockMonotonic = 1
 	if _, _, errno := syscall.Syscall(syscall.SYS_CLOCK_GETTIME, clockMonotonic, uintptr(unsafe.Pointer(&ts)), 0); errno != 0 {
 		return 0
 	}
 	return ts.Sec*1_000_000 + ts.Nsec/1000
 }
 // PauseResult is what dunst_pause and dunst_resume answer.
 type PauseResult struct {
 	Paused bool   `json:"paused"`
 	Note   string `json:"note"`
 }
 // SetPaused turns do-not-disturb on or off.
 func SetPaused(on bool) (PauseResult, error) {
 	if _, err := dunstctl("set-paused", strconv.FormatBool(on)); err != nil {
 		return PauseResult{}, err
 	}
 	out, err := dunstctl("is-paused")
 	if err != nil {
 		return PauseResult{}, err
 	}
 	paused := strings.TrimSpace(out) == "true"
 	note := "notifications are shown"
 	if paused {
 		note = "notifications are held back until dunst_resume; the next login starts unpaused"
 	}
 	return PauseResult{Paused: paused, Note: note}, nil
 }
 // CloseAll closes what is on screen.
 func CloseAll() (CountResult, error) {
 	if _, err := dunstctl("close-all"); err != nil {
 		return CountResult{}, err
 	}
 	return Count()
 }
 // CountResult is what dunst_count answers.
 type CountResult struct {
 	Displayed int  `json:"displayed"`
 	Waiting   int  `json:"waiting"`
 	History   int  `json:"history"`
 	Paused    bool `json:"paused"`
 }
 // Count is how many notifications are where.
 func Count() (CountResult, error) {
 	var c CountResult
 	for _, part := range []struct {
 		which string
 		into  *int
 	}{{"displayed", &c.Displayed}, {"waiting", &c.Waiting}, {"history", &c.History}} {
 		out, err := dunstctl("count", part.which)
 		if err != nil {
 			return c, err
 		}
 		n, err := strconv.Atoi(strings.TrimSpace(out))
 		if err != nil {
 			return c, fmt.Errorf("dunstctl count %s answered %q", part.which, out)
 		}
 		*part.into = n
 	}
 	out, err := dunstctl("is-paused")
 	if err != nil {
 		return c, err
 	}
 	c.Paused = strings.TrimSpace(out) == "true"
 	return c, nil
 }
 // Rule is one notifier rule in force.
 type Rule struct {
 	Name    string         `json:"name"`
 	Enabled bool           `json:"enabled"`
 	Sets    map[string]any `json:"sets"`
 }
 // RulesResult is what dunst_rules answers.
 type RulesResult struct {
 	Files []string `json:"files"`
 	Rules []Rule   `json:"rules"`
 }
 // Rules are the rules the running notifier holds, and the files it reads them from.
 func Rules() (RulesResult, error) {
 	raw, err := dunstctl("rules", "--json")
 	if err != nil {
 		return RulesResult{}, err
 	}
 	return parseRules(raw, configFiles(filepath.Join(operatorHome(), ".config", "dunst")))
 }
 func parseRules(raw string, files []string) (RulesResult, error) {
 	entries, err := variantMaps(raw)
 	if err != nil {
 		return RulesResult{}, err
 	}
 	out := RulesResult{Files: files, Rules: []Rule{}}
 	for _, e := range entries {
 		r := Rule{Name: str(e["name"]), Enabled: e["enabled"] == true, Sets: map[string]any{}}
 		for k, v := range e {
 			if k != "name" && k != "enabled" {
 				r.Sets[k] = v
 			}
 		}
 		out.Rules = append(out.Rules, r)
 	}
 	sort.SliceStable(out.Rules, func(i, j int) bool { return out.Rules[i].Name < out.Rules[j].Name })
 	return out, nil
 }
 // configFiles are dunstrc and its drop-ins in the order dunst reads them.
 func configFiles(dir string) []string {
 	files := []string{}
 	if _, err := os.Stat(filepath.Join(dir, "dunstrc")); err == nil {
 		files = append(files, filepath.Join(dir, "dunstrc"))
 	}
 	dropins, _ := filepath.Glob(filepath.Join(dir, "dunstrc.d", "*.conf"))
 	sort.Strings(dropins)
 	return append(files, dropins...)
 }
@@ -1,160 +0,0 @@
 package main
 import (
 	"errors"
 	"os"
 	"path/filepath"
 	"reflect"
 	"strconv"
 	"strings"
 	"testing"
 )
 // withBus gives the fake machine the account's runtime directory and bus socket.
 func withBus(t *testing.T) string {
 	t.Helper()
 	root := fakeMachine(t)
 	runtime := filepath.Join(runUserDir, strconv.Itoa(os.Getuid()))
 	if err := os.MkdirAll(runtime, 0o700); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.WriteFile(filepath.Join(runtime, "bus"), nil, 0o600); err != nil {
 		t.Fatal(err)
 	}
 	return root
 }
 // A history as dunstctl answers it (busctl's JSON), two entries out of order.
 const history = `{"type":"aa{sv}","data":[[
 {"body":{"type":"s","data":"the build is green"},"summary":{"type":"s","data":"CI"},"appname":{"type":"s","data":"mesh"},
  "category":{"type":"s","data":""},"id":{"type":"i","data":7},"timestamp":{"type":"x","data":100000000},"urgency":{"type":"s","data":"NORMAL"}},
 {"body":{"type":"s","data":""},"summary":{"type":"s","data":"Battery low"},"appname":{"type":"s","data":"upower"},
  "category":{"type":"s","data":"device"},"id":{"type":"i","data":9},"timestamp":{"type":"x","data":160000000},"urgency":{"type":"s","data":"CRITICAL"}}
 ]]}`
 func TestTheHistoryIsNewestFirstWithAgesFromDunstsOwnClock(t *testing.T) {
 	got, err := parseHistory(history, 200_000_000, 20)
 	if err != nil {
 		t.Fatal(err)
 	}
 	want := []Shown{
 		{ID: 9, AppName: "upower", Summary: "Battery low", Urgency: "critical", Category: "device", AgeSeconds: 40},
 		{ID: 7, AppName: "mesh", Summary: "CI", Body: "the build is green", Urgency: "normal", AgeSeconds: 100},
 	}
 	if got.Total != 2 || !reflect.DeepEqual(got.Notifications, want) {
 		t.Fatalf("%+v", got)
 	}
 	if got, _ := parseHistory(history, 200_000_000, 1); len(got.Notifications) != 1 || got.Total != 2 {
 		t.Fatalf("limited: %+v", got)
 	}
 	if _, err := parseHistory(`{"type":"as","data":[]}`, 0, 1); err == nil {
 		t.Fatal("an answer of another type was accepted")
 	}
 	if monotonicMicros() <= 0 {
 		t.Fatal("the monotonic clock")
 	}
 }
 func TestSendAsksNotifySendOverTheAccountsBusAndAnswersTheId(t *testing.T) {
 	withBus(t)
 	bin := fakeBinaries(t, map[string]string{"notify-send": `for a in "$@"; do printf '[%s]' "$a"; done > "$LOG"; echo >> "$LOG"; echo "bus=$DBUS_SESSION_BUS_ADDRESS" >> "$LOG"; echo 42`})
 	t.Setenv("LOG", filepath.Join(bin, "log"))
 	n, err := notificationOf(map[string]any{"summary": "-dash title", "body": "hello", "urgency": "critical", "expire_ms": float64(0)})
 	if err != nil {
 		t.Fatal(err)
 	}
 	got, err := Send(n)
 	if err != nil || got.ID != 42 {
 		t.Fatalf("%+v, %v", got, err)
 	}
 	asked, _ := os.ReadFile(filepath.Join(bin, "log"))
 	want := "[--print-id][--urgency=critical][--app-name=mesh][--expire-time=0][--][-dash title][hello]\nbus=unix:path=" +
 		filepath.Join(runUserDir, strconv.Itoa(os.Getuid()), "bus") + "\n"
 	if string(asked) != want {
 		t.Fatalf("notify-send was asked:\n%s\nwant:\n%s", asked, want)
 	}
 }
 func TestANotificationIsRefusedForWhatItCannotBe(t *testing.T) {
 	for _, bad := range []map[string]any{{}, {"summary": " "}, {"summary": "x", "urgency": "urgent"}, {"summary": "x", "expire_ms": float64(-5)}} {
 		if _, err := notificationOf(bad); err == nil {
 			t.Errorf("accepted %v", bad)
 		}
 	}
 	n, _ := notificationOf(map[string]any{"summary": "x"})
 	if n.Urgency != "normal" || n.AppName != "mesh" || n.ExpireMS != -1 {
 		t.Fatalf("defaults: %+v", n)
 	}
 }
 func TestWithoutABusTheToolsSaySo(t *testing.T) {
 	fakeMachine(t)
 	if _, err := Send(Notification{Summary: "x"}); !errors.Is(err, ErrNoBus) {
 		t.Fatal(err)
 	}
 	if _, err := Count(); !errors.Is(err, ErrNoBus) {
 		t.Fatal(err)
 	}
 }
 func TestCountPauseAndCloseAllAreDunstctlsAnswers(t *testing.T) {
 	withBus(t)
 	bin := fakeBinaries(t, map[string]string{"dunstctl": `echo "$*" >> "$LOG"
 case "$*" in
  "count displayed") echo 1 ;;
  "count waiting") echo 0 ;;
  "count history") echo 12 ;;
  is-paused) cat "$STATE" 2>/dev/null || echo false ;;
  "set-paused true") echo true > "$STATE" ;;
  "set-paused false") echo false > "$STATE" ;;
 esac`})
 	t.Setenv("LOG", filepath.Join(bin, "log"))
 	t.Setenv("STATE", filepath.Join(bin, "paused"))
 	c, err := Count()
 	if err != nil || c != (CountResult{Displayed: 1, History: 12}) {
 		t.Fatalf("%+v, %v", c, err)
 	}
 	p, err := SetPaused(true)
 	if err != nil || !p.Paused || !strings.Contains(p.Note, "held back") {
 		t.Fatalf("%+v, %v", p, err)
 	}
 	if c, _ := CloseAll(); !c.Paused {
 		t.Fatalf("close-all answers the counts: %+v", c)
 	}
 	if p, _ := SetPaused(false); p.Paused {
 		t.Fatalf("resumed: %+v", p)
 	}
 	log, _ := os.ReadFile(filepath.Join(bin, "log"))
 	if !strings.Contains(string(log), "close-all\n") {
 		t.Fatalf("dunstctl was asked:\n%s", log)
 	}
 }
 func TestRulesAreTheRunningNotifiersWithTheFilesTheyComeFrom(t *testing.T) {
 	root := t.TempDir()
 	for _, f := range []string{"dunstrc", "dunstrc.d/50-slack.conf", "dunstrc.d/10-mail.conf", "dunstrc.d/notes.txt"} {
 		if err := os.MkdirAll(filepath.Dir(filepath.Join(root, f)), 0o755); err != nil {
 			t.Fatal(err)
 		}
 		if err := os.WriteFile(filepath.Join(root, f), nil, 0o644); err != nil {
 			t.Fatal(err)
 		}
 	}
 	raw := `{"type":"aa{sv}","data":[[{"enabled":{"type":"b","data":true},"appname":{"type":"s","data":"Slack"},
 	  "fc":{"type":"s","data":"#6715ebff"},"name":{"type":"s","data":"slack"},"timeout":{"type":"x","data":10000000}}]]}`
 	got, err := parseRules(raw, configFiles(root))
 	if err != nil {
 		t.Fatal(err)
 	}
 	if len(got.Rules) != 1 || got.Rules[0].Name != "slack" || !got.Rules[0].Enabled || got.Rules[0].Sets["appname"] != "Slack" {
 		t.Fatalf("%+v", got)
 	}
 	var names []string
 	for _, f := range got.Files {
 		rel, _ := filepath.Rel(root, f)
 		names = append(names, rel)
 	}
 	if !reflect.DeepEqual(names, []string{"dunstrc", "dunstrc.d/10-mail.conf", "dunstrc.d/50-slack.conf"}) {
 		t.Fatalf("files: %v", names)
 	}
 }
@@ -1,91 +0,0 @@
 // dunst's Go tools bundle (novox/hq ADR 0188, ADR 0193, ADR 0208): its implementation of
 // node-notifier's verbs `send` and `history`, and its own tools, served by the node's runtime as the
 // operator account. Everything here goes over the account's session bus; none of it needs the screen.
 package main
 import (
 	"fmt"
 	"os"
 	stdio "git.novox.be/novox/mesh-sdk/go"
 )
 func main() {
 	if err := stdio.Serve("", tools()); err != nil {
 		fmt.Fprintln(os.Stderr, err)
 		os.Exit(1)
 	}
 }
 func tools() []stdio.Tool {
 	return []stdio.Tool{
 		{
 			Name: "node-notifier.send",
 			Description: "Show a notification on the operator's desktop: a title, a body, an urgency (low, " +
 				"normal, critical), and optionally the sending application's name, an icon and how long it stays. " +
 				"Answers the notification's id.",
 			Input: map[string]any{
 				"type": "object",
 				"properties": map[string]any{
 					"summary":    map[string]any{"type": "string", "description": "the title"},
 					"body":       map[string]any{"type": "string", "description": "the text; simple markup (<b>, <i>, <u>, <a href>) is shown"},
 					"urgency":    map[string]any{"type": "string", "enum": urgencies, "description": "default normal"},
 					"app_name":   map[string]any{"type": "string", "description": "who it is from (default: mesh); a notifier rule can match it"},
 					"icon":       map[string]any{"type": "string", "description": "an icon name from the icon theme, or a file"},
 					"expire_ms":  map[string]any{"type": "integer", "description": "how long it stays; 0 until dismissed (default: the urgency's own)"},
 					"category":   map[string]any{"type": "string", "description": "a notification category, e.g. email.arrived"},
 					"replace_id": map[string]any{"type": "integer", "description": "replace the notification with this id instead of adding one"},
 				},
 				"required": []string{"summary"},
 			},
 			Run: func(args map[string]any) (any, error) {
 				n, err := notificationOf(args)
 				if err != nil {
 					return nil, err
 				}
 				return Send(n)
 			},
 		},
 		{
 			Name: "node-notifier.history",
 			Description: "The notifications the operator was shown, newest first: id, application, title, " +
 				"body, urgency and how long ago.",
 			Input: map[string]any{
 				"limit": map[string]any{"type": "integer", "description": "at most this many (default 20, at most 200)"},
 			},
 			Run: func(args map[string]any) (any, error) {
 				limit, err := whole(args, "limit", 20, 1, 200)
 				if err != nil {
 					return nil, err
 				}
 				return History(limit)
 			},
 		},
 		{
 			Name:        "dunst_pause",
 			Description: "Do not disturb: hold every new notification back until resumed. They are shown then, not lost.",
 			Run:         func(map[string]any) (any, error) { return SetPaused(true) },
 		},
 		{
 			Name:        "dunst_resume",
 			Description: "End do-not-disturb: notifications held back are shown.",
 			Run:         func(map[string]any) (any, error) { return SetPaused(false) },
 		},
 		{
 			Name:        "dunst_close_all",
 			Description: "Close every notification on screen. They stay in the history.",
 			Run:         func(map[string]any) (any, error) { return CloseAll() },
 		},
 		{
 			Name: "dunst_rules",
 			Description: "The notifier's rules in force — each rule's name, whether it is enabled, what it " +
 				"matches and what it sets — and the files they come from (the mesh's dunstrc, then dunstrc.d).",
 			Run: func(map[string]any) (any, error) { return Rules() },
 		},
 		{
 			Name:        "dunst_count",
 			Description: "How many notifications are shown, waiting and in the history, and whether do-not-disturb is on.",
 			Run:         func(map[string]any) (any, error) { return Count() },
 		},
 	}
 }
@@ -1,175 +0,0 @@
 package main
 import (
 	"encoding/json"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 )
 // The module's manifest, read the way the catalogue reads it, for the manifest tests. The same in
 // every desktop module that carries it.
 type manifest struct {
 	Module       string           `json:"module"`
 	Version      string           `json:"version"`
 	Capabilities []string         `json:"capabilities"`
 	Requires     []string         `json:"requires"`
 	Claims       []claim          `json:"claims"`
 	Seats        []any            `json:"seats"`
 	Tools        []string         `json:"tools"`
 	Environment  *environment     `json:"environment"`
 	Shell        []shellCode      `json:"shell"`
 	Resources    []map[string]any `json:"resources"`
 	Build        struct {
 		Artifacts []map[string]any `json:"artifacts"`
 	} `json:"build"`
 }
 type claim struct {
 	Name   string   `json:"name"`
 	Scope  string   `json:"scope"`
 	Serves []string `json:"serves"`
 }
 type environment struct {
 	Variables map[string]string `json:"variables"`
 	Path      []map[string]any  `json:"path"`
 }
 type shellCode struct {
 	For  string `json:"for"`
 	Slot string `json:"slot"`
 	Code string `json:"code"`
 }
 func readManifest(t *testing.T) manifest {
 	t.Helper()
 	raw, err := os.ReadFile(filepath.Join("..", "..", "module.json"))
 	if err != nil {
 		t.Fatal(err)
 	}
 	dec := json.NewDecoder(strings.NewReader(string(raw)))
 	dec.DisallowUnknownFields()
 	var m manifest
 	if err := dec.Decode(&m); err != nil {
 		t.Fatalf("module.json: %v", err)
 	}
 	return m
 }
 func (m manifest) resource(t *testing.T, id string) map[string]any {
 	t.Helper()
 	for _, r := range m.Resources {
 		if r["id"] == id {
 			return r
 		}
 	}
 	t.Fatalf("no resource %q", id)
 	return nil
 }
 func (m manifest) packages() (present, absent []string) {
 	for _, r := range m.Resources {
 		if r["type"] == "package" {
 			if r["absent"] == true {
 				absent = append(absent, r["package"].(string))
 			} else {
 				present = append(present, r["package"].(string))
 			}
 		}
 	}
 	return present, absent
 }
 // sameAsSource checks that a file resource's content is byte for byte the module's source file, so
 // the readable file in the repository is what the machine gets.
 func (m manifest) sameAsSource(t *testing.T, id, source string) {
 	t.Helper()
 	want, err := os.ReadFile(filepath.Join("..", "..", source))
 	if err != nil {
 		t.Fatal(err)
 	}
 	r := m.resource(t, id)
 	if r["type"] != "file" {
 		t.Fatalf("%s is a %v, not a file", id, r["type"])
 	}
 	if got, _ := r["content"].(string); got != string(want) {
 		t.Fatalf("resource %s's content is not %s: edit the source and copy it into module.json", id, source)
 	}
 	if r["owner"] != "${machine:account}" && !strings.HasPrefix(r["path"].(string), "/etc/") {
 		t.Fatalf("%s under the home is the account's", id)
 	}
 }
 // checkTheToolsAgree checks that the manifest lists the module's own tools exactly, that the bundle
 // serves each seat verb the claims promise as <seat>.<verb>, and that the Go bundle is declared.
 func checkTheToolsAgree(t *testing.T, m manifest) {
 	t.Helper()
 	own, seat := map[string]bool{}, map[string]bool{}
 	for _, tool := range tools() {
 		if strings.Contains(tool.Name, ".") {
 			seat[tool.Name] = true
 		} else {
 			own[tool.Name] = true
 		}
 		if strings.TrimSpace(tool.Description) == "" {
 			t.Errorf("%s has no description", tool.Name)
 		}
 	}
 	listed := map[string]bool{}
 	for _, name := range m.Tools {
 		listed[name] = true
 		if !own[name] {
 			t.Errorf("module.json lists %s, which the bundle does not serve", name)
 		}
 	}
 	for name := range own {
 		if !listed[name] {
 			t.Errorf("the bundle serves %s, which module.json does not list", name)
 		}
 		if !strings.HasPrefix(name, strings.ReplaceAll(m.Module, "-", "_")+"_") {
 			t.Errorf("%s is not prefixed with the module's name", name)
 		}
 	}
 	promised := map[string]bool{}
 	for _, c := range m.Claims {
 		for _, verb := range c.Serves {
 			promised[c.Name+"."+verb] = true
 			if !seat[c.Name+"."+verb] {
 				t.Errorf("the claim on %s promises %s, which the bundle does not serve", c.Name, verb)
 			}
 		}
 	}
 	for name := range seat {
 		if !promised[name] {
 			t.Errorf("the bundle serves %s, which no claim promises", name)
 		}
 	}
 	var bundle map[string]any
 	for _, a := range m.Build.Artifacts {
 		if a["kind"] == "bundle" {
 			bundle = a
 		}
 	}
 	if bundle == nil || bundle["language"] != "go" || bundle["system"] != "arch" ||
 		bundle["from"] != "cmd/"+m.Module+"-tools" || bundle["binary"] != m.Module+"-tools" {
 		t.Errorf("the Go tools bundle: %v", bundle)
 	}
 }
 // checkNoSecretsOrInstallationNames refuses what a catalogue manifest must never carry.
 func checkNoSecretsOrInstallationNames(t *testing.T) {
 	t.Helper()
 	raw, err := os.ReadFile(filepath.Join("..", "..", "module.json"))
 	if err != nil {
 		t.Fatal(err)
 	}
 	s := strings.ToLower(string(raw))
 	for _, never := range []string{"/home/", "jochen", "g14", "shanks", "novox.be", "api_key", ".hal/", "greenclip daemon"} {
 		if strings.Contains(s, never) {
 			t.Errorf("module.json names %q", never)
 		}
 	}
 }
@@ -1,77 +0,0 @@
 package main
 import (
 	"reflect"
 	"strings"
 	"testing"
 )
 // dunst's shape (novox/hq ADR 0208): it claims node-notifier serving send and history, owns its
 // dunstrc and the drop-in directory other modules' rules go in, and starts nothing — D-Bus starts it
 // on the first notification. It draws only once a notification arrives, through the bus's
 // activation, so it requires no display of its own.
 func TestItClaimsTheNotifierSeatServingSendAndHistory(t *testing.T) {
 	m := readManifest(t)
 	if m.Module != "dunst" || m.Seats != nil {
 		t.Fatalf("module %q declares seats %v", m.Module, m.Seats)
 	}
 	if !reflect.DeepEqual(m.Claims, []claim{{Name: "node-notifier", Scope: "node", Serves: []string{"send", "history"}}}) {
 		t.Fatalf("claims: %+v", m.Claims)
 	}
 	if present, absent := m.packages(); !reflect.DeepEqual(present, []string{"dunst", "libnotify"}) || absent != nil {
 		t.Fatalf("packages: %v, absent %v", present, absent)
 	}
 }
 func TestItOwnsItsFileAndTheDropInDirectory(t *testing.T) {
 	m := readManifest(t)
 	m.sameAsSource(t, "configuration", "files/dunstrc")
 	if p := m.resource(t, "configuration")["path"]; p != "${machine:account-home}/.config/dunst/dunstrc" {
 		t.Fatalf("path: %v", p)
 	}
 	if d := m.resource(t, "dropins"); d["type"] != "directory" || d["path"] != "${machine:account-home}/.config/dunst/dunstrc.d" {
 		t.Fatalf("drop-ins: %v", d)
 	}
 	for _, r := range m.Resources {
 		if p, _ := r["path"].(string); strings.Contains(p, "dunstrc.d/") {
 			t.Fatalf("a rule of another module's: %v", r)
 		}
 	}
 }
 func TestTheFileIsTheDecidedOneAndCallsTheSeatsMenu(t *testing.T) {
 	m := readManifest(t)
 	c := m.resource(t, "configuration")["content"].(string)
 	for _, want := range []string{"origin = top-right", "transparency = 0", "corner_radius = 0", "font = Inter 10", "dmenu = dmenu -p dunst"} {
 		if !strings.Contains(c, "    "+want+"\n") {
 			t.Errorf("lacks %q", want)
 		}
 	}
 	for _, never := range []string{"/usr/bin/dmenu", "Hack", "icon_path", "/home/"} {
 		if strings.Contains(c, never) {
 			t.Errorf("names %q", never)
 		}
 	}
 }
 func TestNothingStartsItButTheBus(t *testing.T) {
 	m := readManifest(t)
 	if m.Shell != nil {
 		t.Fatalf("a session start: %+v", m.Shell)
 	}
 	for _, r := range m.Resources {
 		if r["type"] == "service" || r["type"] == "process" {
 			t.Fatalf("a unit: %v", r)
 		}
 		if p, _ := r["path"].(string); strings.Contains(p, "autostart") || strings.Contains(p, "i3/config.d") {
 			t.Fatalf("a start: %v", r)
 		}
 	}
 }
 func TestTheToolsAgreeWithTheManifest(t *testing.T) {
 	m := readManifest(t)
 	checkTheToolsAgree(t, m)
 	checkNoSecretsOrInstallationNames(t)
 }
@@ -1,423 +0,0 @@
 // The operator's graphical session, as a tool the node's runtime runs finds it (novox/hq ADR 0208).
 //
 // The runtime is a system service running as the operator account (ADR 0175): it has the account's
 // uid and none of the session's environment — no DISPLAY, no XAUTHORITY, no session bus. A tool that
 // draws on the screen or talks to the desktop's D-Bus must find them. It reads them from a process of
 // the account that is part of the session (the window manager first), the same thing `loginctl` and
 // a person's own shell would point at, and says where it found them.
 //
 // Long-lived programs a tool starts go to the account's own service manager through `systemd-run
 // --user`, never as children of the tool: the runtime's unit is a cgroup the service manager empties
 // whenever the runtime restarts, and a compositor or a clipboard owner started from inside it would
 // die with it.
 //
 // This file is the same in every desktop module that carries it; it moves into the Go SDK once a
 // second consumer outside the desktop wants it.
 package main
 import (
 	"bytes"
 	"errors"
 	"fmt"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"sort"
 	"strconv"
 	"strings"
 	"syscall"
 	"time"
 )
 // Where the session is looked for. Variables so a test can point them at a fake tree.
 var (
 	procRoot   = "/proc"
 	runUserDir = "/run/user"
 	x11Sockets = "/tmp/.X11-unix"
 )
 // sessionHolders are the processes whose environment is the session's, best first: the window
 // manager is the session, the rest are its children. Anything else carrying DISPLAY ranks after them.
 var sessionHolders = []string{"i3", "sway", "i3bar", "picom", "xss-lock", "dunst", "clipmenud", "xterm"}
 // sessionKeys are the variables a session carries that a tool hands on to what it runs.
 var sessionKeys = []string{"DISPLAY", "XAUTHORITY", "WAYLAND_DISPLAY", "DBUS_SESSION_BUS_ADDRESS",
 	"XDG_RUNTIME_DIR", "XDG_SESSION_ID", "I3SOCK"}
 // Session is what a tool needs to reach the operator's desktop.
 type Session struct {
 	UID        int    `json:"uid"`
 	Display    string `json:"display,omitempty"`
 	XAuthority string `json:"xauthority,omitempty"`
 	Wayland    string `json:"wayland_display,omitempty"`
 	Bus        string `json:"bus,omitempty"`
 	RuntimeDir string `json:"runtime_dir,omitempty"`
 	SessionID  string `json:"session_id,omitempty"`
 	I3Sock     string `json:"i3sock,omitempty"`
 	// From says where the values were found: the tool's own environment, a process, or the socket.
 	From string `json:"from"`
 }
 // ErrNoSession is answered by a tool that needs the desktop when nobody is logged in to it.
 var ErrNoSession = errors.New("no graphical session")
 // ErrTimedOut is what run answers for a command ended because it ran past its time.
 var ErrTimedOut = errors.New("timed out")
 // ErrNoBus is answered by a tool that needs the session bus when the account has none.
 var ErrNoBus = errors.New("no session bus")
 // operatorHome is the account's home: what the runtime was told, else the process's own.
 func operatorHome() string {
 	if h := strings.TrimSpace(os.Getenv("MESH_OPERATOR_HOME")); h != "" {
 		return h
 	}
 	h, _ := os.UserHomeDir()
 	return h
 }
 // findSession finds the graphical session of the account this tool runs as, or answers
 // ErrNoSession with what it looked at.
 func findSession() (Session, error) {
 	s := findEnvironment()
 	if s.Display == "" && s.Wayland == "" {
 		return s, fmt.Errorf("%w for uid %d on this machine: no process of the account carries DISPLAY "+
 			"or WAYLAND_DISPLAY, and no X server socket in %s has an authority file to go with it. "+
 			"Is anyone logged in to the desktop?", ErrNoSession, s.UID, x11Sockets)
 	}
 	return s, nil
 }
 // findBus finds the account's session bus, which a logged-in account has whether or not a desktop
 // is running.
 func findBus() (Session, error) {
 	s := findEnvironment()
 	if s.Bus == "" {
 		return s, fmt.Errorf("%w for uid %d: DBUS_SESSION_BUS_ADDRESS is not set and %s does not exist "+
 			"(the account is not logged in)", ErrNoBus, s.UID, filepath.Join(runUserDir, strconv.Itoa(s.UID), "bus"))
 	}
 	return s, nil
 }
 func findEnvironment() Session {
 	uid := os.Getuid()
 	s := Session{UID: uid}
 	own := map[string]string{}
 	for _, k := range sessionKeys {
 		own[k] = os.Getenv(k)
 	}
 	if own["DISPLAY"] != "" || own["WAYLAND_DISPLAY"] != "" {
 		s.fill(own)
 		s.From = "the tool's own environment"
 	} else if pid, comm, env, ok := sessionProcess(uid); ok {
 		s.fill(env)
 		s.From = fmt.Sprintf("process %s (pid %d)", comm, pid)
 	} else if display, ok := lonelyX11Socket(); ok {
 		if a := filepath.Join(operatorHome(), ".Xauthority"); exists(a) {
 			s.Display, s.XAuthority = display, a
 			s.From = "the X server socket and the account's ~/.Xauthority"
 		}
 		s.fill(own)
 	} else {
 		s.fill(own)
 		s.From = "nothing: no session found"
 	}
 	// The bus and the runtime directory are the account's, whether or not the process named them.
 	runtime := filepath.Join(runUserDir, strconv.Itoa(uid))
 	if s.RuntimeDir == "" && exists(runtime) {
 		s.RuntimeDir = runtime
 	}
 	if s.Bus == "" && s.RuntimeDir != "" && exists(filepath.Join(s.RuntimeDir, "bus")) {
 		s.Bus = "unix:path=" + filepath.Join(s.RuntimeDir, "bus")
 	}
 	return s
 }
 func (s *Session) fill(env map[string]string) {
 	set := func(dst *string, key string) {
 		if *dst == "" {
 			*dst = env[key]
 		}
 	}
 	set(&s.Display, "DISPLAY")
 	set(&s.XAuthority, "XAUTHORITY")
 	set(&s.Wayland, "WAYLAND_DISPLAY")
 	set(&s.Bus, "DBUS_SESSION_BUS_ADDRESS")
 	set(&s.RuntimeDir, "XDG_RUNTIME_DIR")
 	set(&s.SessionID, "XDG_SESSION_ID")
 	set(&s.I3Sock, "I3SOCK")
 }
 // sessionProcess is the best process of this uid whose environment names a display.
 func sessionProcess(uid int) (int, string, map[string]string, bool) {
 	entries, err := os.ReadDir(procRoot)
 	if err != nil {
 		return 0, "", nil, false
 	}
 	type candidate struct {
 		pid  int
 		comm string
 		env  map[string]string
 		rank int
 	}
 	var found []candidate
 	for _, e := range entries {
 		pid, err := strconv.Atoi(e.Name())
 		if err != nil {
 			continue
 		}
 		dir := filepath.Join(procRoot, e.Name())
 		if owner, ok := ownerOf(dir); !ok || owner != uid {
 			continue
 		}
 		raw, err := os.ReadFile(filepath.Join(dir, "environ"))
 		if err != nil {
 			continue
 		}
 		env := parseEnviron(raw)
 		if env["DISPLAY"] == "" && env["WAYLAND_DISPLAY"] == "" {
 			continue
 		}
 		comm := readTrimmed(filepath.Join(dir, "comm"))
 		rank := len(sessionHolders)
 		for i, h := range sessionHolders {
 			if h == comm {
 				rank = i
 				break
 			}
 		}
 		found = append(found, candidate{pid, comm, env, rank})
 	}
 	if len(found) == 0 {
 		return 0, "", nil, false
 	}
 	sort.Slice(found, func(i, j int) bool {
 		if found[i].rank != found[j].rank {
 			return found[i].rank < found[j].rank
 		}
 		return found[i].pid > found[j].pid // the newer of two equals
 	})
 	best := found[0]
 	return best.pid, best.comm, best.env, true
 }
 func parseEnviron(raw []byte) map[string]string {
 	env := map[string]string{}
 	for _, kv := range bytes.Split(raw, []byte{0}) {
 		if i := bytes.IndexByte(kv, '='); i > 0 {
 			env[string(kv[:i])] = string(kv[i+1:])
 		}
 	}
 	return env
 }
 func ownerOf(path string) (int, bool) {
 	info, err := os.Stat(path)
 	if err != nil {
 		return 0, false
 	}
 	st, ok := info.Sys().(*syscall.Stat_t)
 	if !ok {
 		return 0, false
 	}
 	return int(st.Uid), true
 }
 // lonelyX11Socket is the display of the one X server socket there is, when there is exactly one.
 func lonelyX11Socket() (string, bool) {
 	entries, err := os.ReadDir(x11Sockets)
 	if err != nil {
 		return "", false
 	}
 	var displays []string
 	for _, e := range entries {
 		if n := strings.TrimPrefix(e.Name(), "X"); n != e.Name() {
 			if _, err := strconv.Atoi(n); err == nil {
 				displays = append(displays, ":"+n)
 			}
 		}
 	}
 	if len(displays) != 1 {
 		return "", false
 	}
 	return displays[0], true
 }
 func readTrimmed(path string) string {
 	b, err := os.ReadFile(path)
 	if err != nil {
 		return ""
 	}
 	return strings.TrimSpace(string(b))
 }
 func exists(path string) bool {
 	_, err := os.Stat(path)
 	return err == nil
 }
 // Env is this process's environment with the session's variables in place of its own.
 func (s Session) Env() []string {
 	drop := map[string]bool{}
 	for _, k := range sessionKeys {
 		drop[k] = true
 	}
 	var env []string
 	for _, kv := range os.Environ() {
 		if i := strings.IndexByte(kv, '='); i > 0 && drop[kv[:i]] {
 			continue
 		}
 		env = append(env, kv)
 	}
 	add := func(k, v string) {
 		if v != "" {
 			env = append(env, k+"="+v)
 		}
 	}
 	add("DISPLAY", s.Display)
 	add("XAUTHORITY", s.XAuthority)
 	add("WAYLAND_DISPLAY", s.Wayland)
 	add("DBUS_SESSION_BUS_ADDRESS", s.Bus)
 	add("XDG_RUNTIME_DIR", s.RuntimeDir)
 	add("XDG_SESSION_ID", s.SessionID)
 	add("I3SOCK", s.I3Sock)
 	return env
 }
 // mostOutput bounds what a command may answer with, per stream.
 const mostOutput = 256 << 10
 // Result is what a command did.
 type Result struct {
 	Stdout    string `json:"stdout"`
 	Stderr    string `json:"stderr,omitempty"`
 	Code      int    `json:"code"`
 	Truncated bool   `json:"truncated,omitempty"`
 }
 // run runs a command in the session's environment, its input given, ended with everything it
 // started after timeout. A command that is not installed is an error naming it; one that exits
 // non-zero is a Result with its code, for the caller to judge.
 func (s Session) run(timeout time.Duration, stdin string, name string, args ...string) (Result, error) {
 	path, err := exec.LookPath(name)
 	if err != nil {
 		return Result{}, fmt.Errorf("%s is not installed on this machine", name)
 	}
 	cmd := exec.Command(path, args...)
 	cmd.Env = s.Env()
 	if home := operatorHome(); exists(home) {
 		cmd.Dir = home
 	}
 	if stdin != "" {
 		cmd.Stdin = strings.NewReader(stdin)
 	}
 	var out, errOut capped
 	cmd.Stdout, cmd.Stderr = &out, &errOut
 	cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
 	if err := cmd.Start(); err != nil {
 		return Result{}, fmt.Errorf("%s: %w", name, err)
 	}
 	done := make(chan error, 1)
 	go func() { done <- cmd.Wait() }()
 	select {
 	case err = <-done:
 	case <-time.After(timeout):
 		_ = syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL)
 		<-done
 		return Result{Stdout: out.String(), Stderr: errOut.String()},
 			fmt.Errorf("%s did not finish within %s and was ended: %w", name, timeout, ErrTimedOut)
 	}
 	r := Result{Stdout: out.String(), Stderr: errOut.String(), Truncated: out.cut || errOut.cut}
 	var exit *exec.ExitError
 	if errors.As(err, &exit) {
 		r.Code = exit.ExitCode()
 	} else if err != nil {
 		return r, fmt.Errorf("%s: %w", name, err)
 	}
 	return r, nil
 }
 // detach starts a long-lived program under the account's own service manager, as a transient unit
 // that carries the session's display, so it outlives the runtime that asked for it. A unit already
 // running under the same name is stopped first, so a fixed name means "at most one".
 func (s Session) detach(unit string, args ...string) error {
 	if s.RuntimeDir == "" {
 		return fmt.Errorf("%w: the account's runtime directory is missing, so its service manager "+
 			"cannot be reached", ErrNoBus)
 	}
 	_, _ = s.run(5*time.Second, "", "systemctl", "--user", "stop", unit+".service")
 	call := []string{"--user", "--collect", "--quiet", "--unit=" + unit}
 	for _, kv := range [][2]string{{"DISPLAY", s.Display}, {"XAUTHORITY", s.XAuthority},
 		{"WAYLAND_DISPLAY", s.Wayland}, {"XDG_SESSION_ID", s.SessionID}, {"I3SOCK", s.I3Sock}} {
 		if kv[1] != "" {
 			call = append(call, "--setenv="+kv[0]+"="+kv[1])
 		}
 	}
 	call = append(call, "--")
 	call = append(call, args...)
 	r, err := s.run(10*time.Second, "", "systemd-run", call...)
 	if err != nil {
 		return err
 	}
 	if r.Code != 0 {
 		return fmt.Errorf("systemd-run %s: %s", unit, strings.TrimSpace(r.Stderr))
 	}
 	return nil
 }
 // uniqueUnit is a transient unit name that will not collide with an earlier one.
 func uniqueUnit(prefix string) string {
 	return fmt.Sprintf("%s-%d", prefix, time.Now().UnixNano())
 }
 type capped struct {
 	bytes.Buffer
 	cut bool
 }
 func (c *capped) Write(p []byte) (int, error) {
 	if room := mostOutput - c.Len(); room < len(p) {
 		if room > 0 {
 			c.Buffer.Write(p[:room])
 		}
 		c.cut = true
 		return len(p), nil
 	}
 	return c.Buffer.Write(p)
 }
 // processesOf are the pids of this uid's processes whose command name is comm, oldest first.
 func processesOf(comm string) []int {
 	entries, err := os.ReadDir(procRoot)
 	if err != nil {
 		return nil
 	}
 	uid := os.Getuid()
 	var pids []int
 	for _, e := range entries {
 		pid, err := strconv.Atoi(e.Name())
 		if err != nil {
 			continue
 		}
 		dir := filepath.Join(procRoot, e.Name())
 		if owner, ok := ownerOf(dir); !ok || owner != uid {
 			continue
 		}
 		if readTrimmed(filepath.Join(dir, "comm")) == comm {
 			pids = append(pids, pid)
 		}
 	}
 	sort.Ints(pids)
 	return pids
 }
 // signalAll sends sig to every process of this uid named comm, and answers the pids it reached.
 func signalAll(comm string, sig syscall.Signal) []int {
 	var reached []int
 	for _, pid := range processesOf(comm) {
 		if syscall.Kill(pid, sig) == nil {
 			reached = append(reached, pid)
 		}
 	}
 	return reached
 }
@@ -1,174 +0,0 @@
 package main
 import (
 	"errors"
 	"os"
 	"path/filepath"
 	"strconv"
 	"strings"
 	"testing"
 	"time"
 )
 // fakeMachine points the session finder at a temporary /proc, /run/user and X socket directory, with
 // none of the test process's own session variables, and gives back the root.
 func fakeMachine(t *testing.T) string {
 	t.Helper()
 	root := t.TempDir()
 	procRoot, runUserDir, x11Sockets = filepath.Join(root, "proc"), filepath.Join(root, "run-user"), filepath.Join(root, "x11")
 	for _, d := range []string{procRoot, runUserDir, x11Sockets} {
 		if err := os.MkdirAll(d, 0o755); err != nil {
 			t.Fatal(err)
 		}
 	}
 	for _, k := range sessionKeys {
 		t.Setenv(k, "")
 	}
 	t.Setenv("MESH_OPERATOR_HOME", filepath.Join(root, "home"))
 	t.Cleanup(func() { procRoot, runUserDir, x11Sockets = "/proc", "/run/user", "/tmp/.X11-unix" })
 	return root
 }
 func fakeProcess(t *testing.T, pid int, comm string, env ...string) {
 	t.Helper()
 	dir := filepath.Join(procRoot, strconv.Itoa(pid))
 	if err := os.MkdirAll(dir, 0o755); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.WriteFile(filepath.Join(dir, "comm"), []byte(comm+"\n"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.WriteFile(filepath.Join(dir, "environ"), []byte(strings.Join(env, "\x00")+"\x00"), 0o600); err != nil {
 		t.Fatal(err)
 	}
 }
 func TestTheSessionIsReadFromTheWindowManagerBeforeAnyOtherProcess(t *testing.T) {
 	fakeMachine(t)
 	fakeProcess(t, 900, "xterm", "DISPLAY=:9", "XAUTHORITY=/elsewhere")
 	fakeProcess(t, 100, "i3", "DISPLAY=:1", "XAUTHORITY=/home/op/.Xauthority",
 		"DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus", "XDG_SESSION_ID=3", "SECRET_TOKEN=never-copied")
 	fakeProcess(t, 50, "bash", "PATH=/usr/bin")
 	s, err := findSession()
 	if err != nil {
 		t.Fatal(err)
 	}
 	if s.Display != ":1" || s.XAuthority != "/home/op/.Xauthority" || s.SessionID != "3" || !strings.Contains(s.From, "i3 (pid 100)") {
 		t.Fatalf("the window manager's environment: %+v", s)
 	}
 	for _, kv := range s.Env() {
 		if strings.HasPrefix(kv, "SECRET_TOKEN=") {
 			t.Fatal("a variable of the session process that is not a session variable was handed on")
 		}
 	}
 }
 func TestAnyProcessCarryingADisplayServesWhenTheWindowManagerIsNotFound(t *testing.T) {
 	fakeMachine(t)
 	fakeProcess(t, 10, "firefox", "DISPLAY=:0")
 	fakeProcess(t, 20, "firefox", "DISPLAY=:2")
 	s, err := findSession()
 	if err != nil || s.Display != ":2" {
 		t.Fatalf("the newest of two equals: %+v, %v", s, err)
 	}
 }
 func TestNoSessionIsAClearAnswerNotAGuess(t *testing.T) {
 	fakeMachine(t)
 	fakeProcess(t, 10, "sshd", "PATH=/usr/bin")
 	_, err := findSession()
 	if !errors.Is(err, ErrNoSession) || !strings.Contains(err.Error(), "logged in to the desktop") {
 		t.Fatalf("no session: %v", err)
 	}
 }
 func TestOneXSocketAndTheAccountsAuthorityFileAreASession(t *testing.T) {
 	root := fakeMachine(t)
 	if err := os.WriteFile(filepath.Join(x11Sockets, "X0"), nil, 0o644); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.MkdirAll(filepath.Join(root, "home"), 0o755); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.WriteFile(filepath.Join(root, "home", ".Xauthority"), nil, 0o600); err != nil {
 		t.Fatal(err)
 	}
 	s, err := findSession()
 	if err != nil || s.Display != ":0" || !strings.HasSuffix(s.XAuthority, "/home/.Xauthority") {
 		t.Fatalf("socket and authority: %+v, %v", s, err)
 	}
 }
 func TestTheBusIsTheAccountsRuntimeDirectoryWhenNoProcessNamesIt(t *testing.T) {
 	fakeMachine(t)
 	runtime := filepath.Join(runUserDir, strconv.Itoa(os.Getuid()))
 	if _, err := findBus(); !errors.Is(err, ErrNoBus) {
 		t.Fatalf("no runtime directory is no bus: %v", err)
 	}
 	if err := os.MkdirAll(runtime, 0o700); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.WriteFile(filepath.Join(runtime, "bus"), nil, 0o600); err != nil {
 		t.Fatal(err)
 	}
 	s, err := findBus()
 	if err != nil || s.Bus != "unix:path="+filepath.Join(runtime, "bus") || s.RuntimeDir != runtime {
 		t.Fatalf("bus: %+v, %v", s, err)
 	}
 	env := strings.Join(s.Env(), "\n")
 	if !strings.Contains(env, "XDG_RUNTIME_DIR="+runtime) || !strings.Contains(env, "DBUS_SESSION_BUS_ADDRESS=unix:path=") {
 		t.Fatalf("the bus is handed on: %s", env)
 	}
 }
 func TestACommandIsBoundedAndANonZeroExitIsAResult(t *testing.T) {
 	fakeMachine(t)
 	s := Session{}
 	r, err := s.run(5*time.Second, "in", "sh", "-c", "cat; echo err >&2; exit 3")
 	if err != nil || r.Stdout != "in" || r.Code != 3 || strings.TrimSpace(r.Stderr) != "err" {
 		t.Fatalf("result: %+v, %v", r, err)
 	}
 	start := time.Now()
 	if _, err := s.run(200*time.Millisecond, "", "sh", "-c", "sleep 30 & sleep 30"); err == nil || time.Since(start) > 5*time.Second {
 		t.Fatalf("a command past its time is ended with what it started: %v after %s", err, time.Since(start))
 	}
 	if _, err := s.run(time.Second, "", "no-such-program-here"); err == nil || !strings.Contains(err.Error(), "not installed") {
 		t.Fatalf("a missing program: %v", err)
 	}
 }
 func TestDetachAsksTheAccountsServiceManagerWithTheSessionsDisplay(t *testing.T) {
 	fakeMachine(t)
 	bin := fakeBinaries(t, map[string]string{
 		"systemctl":   `echo "systemctl $*" >> "$LOG"`,
 		"systemd-run": `echo "systemd-run $*" >> "$LOG"`,
 	})
 	log := filepath.Join(bin, "log")
 	t.Setenv("LOG", log)
 	s := Session{Display: ":1", XAuthority: "/x", RuntimeDir: "/run/user/1"}
 	if err := s.detach("picom-session", "picom", "--config", "/c"); err != nil {
 		t.Fatal(err)
 	}
 	got, _ := os.ReadFile(log)
 	want := "systemctl --user stop picom-session.service\n" +
 		"systemd-run --user --collect --quiet --unit=picom-session --setenv=DISPLAY=:1 --setenv=XAUTHORITY=/x -- picom --config /c\n"
 	if string(got) != want {
 		t.Fatalf("detach ran:\n%s\nwant:\n%s", got, want)
 	}
 	if err := (Session{}).detach("x", "y"); !errors.Is(err, ErrNoBus) {
 		t.Fatalf("no runtime directory: %v", err)
 	}
 }
 // fakeBinaries puts shell scripts named for programs first on PATH, and answers their directory.
 func fakeBinaries(t *testing.T, scripts map[string]string) string {
 	t.Helper()
 	dir := t.TempDir()
 	for name, body := range scripts {
 		if err := os.WriteFile(filepath.Join(dir, name), []byte("#!/bin/sh\n"+body+"\n"), 0o755); err != nil {
 			t.Fatal(err)
 		}
 	}
 	t.Setenv("PATH", dir+string(os.PathListSeparator)+os.Getenv("PATH"))
 	return dir
 }
@@ -1,92 +0,0 @@
 # dunst, the notifier (module dunst, novox/hq ADR 0208). Owned by the mesh: this file is replaced
 # at every push. Adopted from the laptop's file of 2026-10-04 (the two workstations differed in
 # position, transparency and corner radius; the laptop's square, opaque, top-right one matches the
 # rest of the desktop). Only what differs from dunst's defaults, and what the desktop relies on.
 #
 # Other modules' rules go in ~/.config/dunst/dunstrc.d/*.conf, which dunst reads after this file,
 # so a drop-in outranks it. dunst is started by D-Bus on the first notification: nothing starts it.
 [global]
    monitor = 0
    follow = none
    # Geometry
    width = 250
    height = (0, 300)
    origin = top-right
    offset = (10, 50)
    notification_limit = 20
    progress_bar = true
    progress_bar_height = 10
    progress_bar_frame_width = 1
    progress_bar_min_width = 150
    progress_bar_max_width = 300
    indicate_hidden = yes
    transparency = 0
    separator_height = 2
    padding = 8
    horizontal_padding = 8
    text_icon_padding = 0
    frame_width = 3
    frame_color = "#de5200"
    gap_size = 0
    separator_color = frame
    sort = yes
    corner_radius = 0
    # Text: the interface face (research 026/04)
    font = Inter 10
    line_height = 0
    markup = full
    format = "<b>%s</b>\n%b"
    alignment = left
    vertical_alignment = center
    show_age_threshold = 60
    ellipsize = middle
    ignore_newline = no
    stack_duplicates = true
    hide_duplicate_count = false
    show_indicators = yes
    # Icons, from the desktop's icon theme
    enable_recursive_icon_lookup = true
    icon_theme = Adwaita
    icon_position = left
    min_icon_size = 32
    max_icon_size = 128
    # History
    sticky_history = yes
    history_length = 20
    # The context menu is the node's dmenu-compatible command, which the holder of node-launcher
    # answers (rofi on the workstations). Links open in the desktop's default browser.
    dmenu = dmenu -p dunst
    browser = /usr/bin/xdg-open
    always_run_script = true
    title = Dunst
    class = Dunst
    ignore_dbusclose = false
    mouse_left_click = close_current
    mouse_middle_click = do_action, close_current
    mouse_right_click = close_all
 [urgency_low]
    background = "#000000"
    foreground = "#ffffff"
    timeout = 10
 [urgency_normal]
    background = "#000000"
    foreground = "#ffffff"
    timeout = 10
 [urgency_critical]
    background = "#000000"
    foreground = "#ffffff"
    frame_color = "#ff0000"
    timeout = 0
@@ -1,5 +0,0 @@
 module dunst
 go 1.22
 require git.novox.be/novox/mesh-sdk/go v0.1.7
@@ -1,2 +0,0 @@
 git.novox.be/novox/mesh-sdk/go v0.1.7 h1:C0sTQmtTiyYH7bnqZb7PusXnqA37gKuT7Nqjn9gG47w=
 git.novox.be/novox/mesh-sdk/go v0.1.7/go.mod h1:GFuZUElBZ9A++mxgIKo97aXXo+kV0uJ/UkbhQPPIbrY=
@@ -1,73 +0,0 @@
 {
  "module": "dunst",
  "version": "1",
  "capabilities": [
    "package-manager"
  ],
  "claims": [
    {
      "name": "node-notifier",
      "scope": "node",
      "serves": [
        "send",
        "history"
      ]
    }
  ],
  "tools": [
    "dunst_pause",
    "dunst_resume",
    "dunst_close_all",
    "dunst_rules",
    "dunst_count"
  ],
  "resources": [
    {
      "id": "package",
      "type": "package",
      "package": "dunst"
    },
    {
      "id": "client",
      "type": "package",
      "package": "libnotify"
    },
    {
      "id": "configuration-dir",
      "type": "directory",
      "path": "${machine:account-home}/.config/dunst",
      "owner": "${machine:account}",
      "mode": "0755"
    },
    {
      "id": "dropins",
      "type": "directory",
      "path": "${machine:account-home}/.config/dunst/dunstrc.d",
      "owner": "${machine:account}",
      "mode": "0755"
    },
    {
      "id": "configuration",
      "type": "file",
      "path": "${machine:account-home}/.config/dunst/dunstrc",
      "owner": "${machine:account}",
      "mode": "0644",
      "content": "# dunst, the notifier (module dunst, novox/hq ADR 0208). Owned by the mesh: this file is replaced\n# at every push. Adopted from the laptop's file of 2026-10-04 (the two workstations differed in\n# position, transparency and corner radius; the laptop's square, opaque, top-right one matches the\n# rest of the desktop). Only what differs from dunst's defaults, and what the desktop relies on.\n#\n# Other modules' rules go in ~/.config/dunst/dunstrc.d/*.conf, which dunst reads after this file,\n# so a drop-in outranks it. dunst is started by D-Bus on the first notification: nothing starts it.\n\n[global]\n    monitor = 0\n    follow = none\n\n    # Geometry\n    width = 250\n    height = (0, 300)\n    origin = top-right\n    offset = (10, 50)\n    notification_limit = 20\n\n    progress_bar = true\n    progress_bar_height = 10\n    progress_bar_frame_width = 1\n    progress_bar_min_width = 150\n    progress_bar_max_width = 300\n\n    indicate_hidden = yes\n    transparency = 0\n    separator_height = 2\n    padding = 8\n    horizontal_padding = 8\n    text_icon_padding = 0\n    frame_width = 3\n    frame_color = \"#de5200\"\n    gap_size = 0\n    separator_color = frame\n    sort = yes\n    corner_radius = 0\n\n    # Text: the interface face (research 026/04)\n    font = Inter 10\n    line_height = 0\n    markup = full\n    format = \"<b>%s</b>\\n%b\"\n    alignment = left\n    vertical_alignment = center\n    show_age_threshold = 60\n    ellipsize = middle\n    ignore_newline = no\n    stack_duplicates = true\n    hide_duplicate_count = false\n    show_indicators = yes\n\n    # Icons, from the desktop's icon theme\n    enable_recursive_icon_lookup = true\n    icon_theme = Adwaita\n    icon_position = left\n    min_icon_size = 32\n    max_icon_size = 128\n\n    # History\n    sticky_history = yes\n    history_length = 20\n\n    # The context menu is the node's dmenu-compatible command, which the holder of node-launcher\n    # answers (rofi on the workstations). Links open in the desktop's default browser.\n    dmenu = dmenu -p dunst\n    browser = /usr/bin/xdg-open\n    always_run_script = true\n\n    title = Dunst\n    class = Dunst\n    ignore_dbusclose = false\n\n    mouse_left_click = close_current\n    mouse_middle_click = do_action, close_current\n    mouse_right_click = close_all\n\n[urgency_low]\n    background = \"#000000\"\n    foreground = \"#ffffff\"\n    timeout = 10\n\n[urgency_normal]\n    background = \"#000000\"\n    foreground = \"#ffffff\"\n    timeout = 10\n\n[urgency_critical]\n    background = \"#000000\"\n    foreground = \"#ffffff\"\n    frame_color = \"#ff0000\"\n    timeout = 0\n"
    }
  ],
  "build": {
    "artifacts": [
      {
        "name": "tools",
        "kind": "bundle",
        "language": "go",
        "system": "arch",
        "from": "cmd/dunst-tools",
        "binary": "dunst-tools",
        "loads": [
          "dunst-tools"
        ]
      }
    ]
  }
 }
@@ -1,47 +0,0 @@
 # feh
 The wallpaper as a module (novox/hq ADR 0208, research 026/05).
 - Installs `feh` and requires `x11-display` on its own machine. It holds no seat: a wallpaper is not a
  role anything else calls.
 - **Carries the wallpaper itself.** `wallpaper/default.jpg` is built into an archive of the module
  (ADR 0205) and unpacked into `~/.local/share/feh/wallpapers/`, which the module owns.
 - Owns `~/.fehbg`, which sets that image, filled, on every monitor, without rewriting itself
  (`--no-fehbg`).
 - Runs `~/.fehbg` once per session, from the session's start (the `xinitrc` slot `normal`).
 - Binds `$mod+Shift+b` to the same file, as its own i3 drop-in (`50-feh.conf`): the declared wallpaper
  back, after a monitor change.
 ## Tools
 | tool | does |
 |---|---|
 | `feh_set` | set images (one for all monitors, or one each) in a mode: fill, center, max, scale, tile. For this session; the declared wallpaper returns at the next login |
 | `feh_current` | the declared wallpaper (from `~/.fehbg`) and the one `feh_set` put up in this session |
 `feh_set` never writes `~/.fehbg`. A wallpaper that should stay is a change to this module, or a
 setting once issue 168 closes, not a file the next push would overwrite.
 ## What it improves on what was found
 - **The wallpaper no longer lives in the predecessor's tree.** `~/.fehbg` pointed into a directory
  of the retired predecessor's. Deleting that directory would have left the desktop black, silently.
 - **One image file, the same on both workstations.** The image was byte-identical on both. It is now
  the module's own.
 ## What it leaves as found
 - The predecessor's wallpaper directory. It is part of the predecessor's tree, which goes as a whole.
 ## Migration (ADR 0182)
 - The first push keeps the found `~/.fehbg` once, then writes the module's.
 - Once the `xorg` module writes the session's start, delete the `~/.fehbg &` line from your own part
  of `~/.xinitrc`.
 - The image's origin is the predecessor's desktop module. Check that it may be redistributed before
  this catalogue is published anywhere public.
 ## Blockers
 - `x11-display` and the `xinitrc` slot are ADR 0208's. Until the controller knows them, `mctl` reads
  them as unknown.
@@ -1,97 +0,0 @@
 // Reading a tool's arguments: JSON numbers arrive as float64, and a missing argument is its default.
 // The same in every desktop module that carries it.
 package main
 import (
 	"fmt"
 	"math"
 	"strings"
 	"time"
 )
 // text is a string argument, trimmed; required says an empty one is refused.
 func text(args map[string]any, key string, required bool) (string, error) {
 	v, present := args[key]
 	if !present || v == nil {
 		if required {
 			return "", fmt.Errorf("%s is required", key)
 		}
 		return "", nil
 	}
 	s, ok := v.(string)
 	if !ok {
 		return "", fmt.Errorf("%s is a string, not %T", key, v)
 	}
 	s = strings.TrimSpace(s)
 	if s == "" && required {
 		return "", fmt.Errorf("%s is required", key)
 	}
 	return s, nil
 }
 // whole is a whole-number argument within [least, most], or def when absent.
 func whole(args map[string]any, key string, def, least, most int) (int, error) {
 	v, present := args[key]
 	if !present || v == nil {
 		return def, nil
 	}
 	f, ok := v.(float64)
 	if !ok {
 		if i, isInt := v.(int); isInt {
 			f = float64(i)
 		} else {
 			return 0, fmt.Errorf("%s is a number, not %T", key, v)
 		}
 	}
 	if f != math.Trunc(f) {
 		return 0, fmt.Errorf("%s is a whole number, not %v", key, f)
 	}
 	n := int(f)
 	if n < least || n > most {
 		return 0, fmt.Errorf("%s is %d; it is between %d and %d", key, n, least, most)
 	}
 	return n, nil
 }
 // flag is a boolean argument, or def when absent.
 func flag(args map[string]any, key string, def bool) (bool, error) {
 	v, present := args[key]
 	if !present || v == nil {
 		return def, nil
 	}
 	b, ok := v.(bool)
 	if !ok {
 		return false, fmt.Errorf("%s is true or false, not %T", key, v)
 	}
 	return b, nil
 }
 // texts is a list-of-strings argument.
 func texts(args map[string]any, key string) ([]string, error) {
 	v, present := args[key]
 	if !present || v == nil {
 		return nil, nil
 	}
 	list, ok := v.([]any)
 	if !ok {
 		if ss, isStrings := v.([]string); isStrings {
 			return ss, nil
 		}
 		return nil, fmt.Errorf("%s is a list of strings, not %T", key, v)
 	}
 	out := make([]string, 0, len(list))
 	for i, item := range list {
 		s, ok := item.(string)
 		if !ok {
 			return nil, fmt.Errorf("%s[%d] is a string, not %T", key, i, item)
 		}
 		out = append(out, s)
 	}
 	return out, nil
 }
 // seconds is a timeout argument in seconds, defaulted and bounded below the runtime's call limit.
 func seconds(args map[string]any, key string, def, most int) (time.Duration, error) {
 	n, err := whole(args, key, def, 1, most)
 	return time.Duration(n) * time.Second, err
 }
@@ -1,53 +0,0 @@
 // feh's Go tools bundle (novox/hq ADR 0188, ADR 0193, ADR 0208): the wallpaper's tools, served by the
 // node's runtime as the operator account.
 package main
 import (
 	"fmt"
 	"os"
 	stdio "git.novox.be/novox/mesh-sdk/go"
 )
 func main() {
 	if err := stdio.Serve("", tools()); err != nil {
 		fmt.Fprintln(os.Stderr, err)
 		os.Exit(1)
 	}
 }
 func tools() []stdio.Tool {
 	return []stdio.Tool{
 		{
 			Name: "feh_set",
 			Description: "Set the wallpaper in the operator's session: one image for every monitor, or one per " +
 				"monitor in the X screen order, filled, centred, scaled to fit, stretched or tiled. Lasts until the " +
 				"next session start, when the declared wallpaper returns; the declared one is untouched.",
 			Input: map[string]any{
 				"type": "object",
 				"properties": map[string]any{
 					"images": map[string]any{"type": "array", "items": map[string]any{"type": "string"}, "description": "image files on this machine, absolute or under the account's home; one per monitor, or one for all"},
 					"mode":   map[string]any{"type": "string", "enum": modes, "description": "default fill"},
 				},
 				"required": []string{"images"},
 			},
 			Run: func(args map[string]any) (any, error) {
 				images, err := texts(args, "images")
 				if err != nil {
 					return nil, err
 				}
 				mode, err := text(args, "mode", false)
 				if err != nil {
 					return nil, err
 				}
 				return Set(images, mode)
 			},
 		},
 		{
 			Name: "feh_current",
 			Description: "The wallpaper: the declared one the session start sets (images and mode, read from " +
 				"~/.fehbg), and the one feh_set put up in this session, if any.",
 			Run: func(map[string]any) (any, error) { return Current() },
 		},
 	}
 }
@@ -1,175 +0,0 @@
 package main
 import (
 	"encoding/json"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 )
 // The module's manifest, read the way the catalogue reads it, for the manifest tests. The same in
 // every desktop module that carries it.
 type manifest struct {
 	Module       string           `json:"module"`
 	Version      string           `json:"version"`
 	Capabilities []string         `json:"capabilities"`
 	Requires     []string         `json:"requires"`
 	Claims       []claim          `json:"claims"`
 	Seats        []any            `json:"seats"`
 	Tools        []string         `json:"tools"`
 	Environment  *environment     `json:"environment"`
 	Shell        []shellCode      `json:"shell"`
 	Resources    []map[string]any `json:"resources"`
 	Build        struct {
 		Artifacts []map[string]any `json:"artifacts"`
 	} `json:"build"`
 }
 type claim struct {
 	Name   string   `json:"name"`
 	Scope  string   `json:"scope"`
 	Serves []string `json:"serves"`
 }
 type environment struct {
 	Variables map[string]string `json:"variables"`
 	Path      []map[string]any  `json:"path"`
 }
 type shellCode struct {
 	For  string `json:"for"`
 	Slot string `json:"slot"`
 	Code string `json:"code"`
 }
 func readManifest(t *testing.T) manifest {
 	t.Helper()
 	raw, err := os.ReadFile(filepath.Join("..", "..", "module.json"))
 	if err != nil {
 		t.Fatal(err)
 	}
 	dec := json.NewDecoder(strings.NewReader(string(raw)))
 	dec.DisallowUnknownFields()
 	var m manifest
 	if err := dec.Decode(&m); err != nil {
 		t.Fatalf("module.json: %v", err)
 	}
 	return m
 }
 func (m manifest) resource(t *testing.T, id string) map[string]any {
 	t.Helper()
 	for _, r := range m.Resources {
 		if r["id"] == id {
 			return r
 		}
 	}
 	t.Fatalf("no resource %q", id)
 	return nil
 }
 func (m manifest) packages() (present, absent []string) {
 	for _, r := range m.Resources {
 		if r["type"] == "package" {
 			if r["absent"] == true {
 				absent = append(absent, r["package"].(string))
 			} else {
 				present = append(present, r["package"].(string))
 			}
 		}
 	}
 	return present, absent
 }
 // sameAsSource checks that a file resource's content is byte for byte the module's source file, so
 // the readable file in the repository is what the machine gets.
 func (m manifest) sameAsSource(t *testing.T, id, source string) {
 	t.Helper()
 	want, err := os.ReadFile(filepath.Join("..", "..", source))
 	if err != nil {
 		t.Fatal(err)
 	}
 	r := m.resource(t, id)
 	if r["type"] != "file" {
 		t.Fatalf("%s is a %v, not a file", id, r["type"])
 	}
 	if got, _ := r["content"].(string); got != string(want) {
 		t.Fatalf("resource %s's content is not %s: edit the source and copy it into module.json", id, source)
 	}
 	if r["owner"] != "${machine:account}" && !strings.HasPrefix(r["path"].(string), "/etc/") {
 		t.Fatalf("%s under the home is the account's", id)
 	}
 }
 // checkTheToolsAgree checks that the manifest lists the module's own tools exactly, that the bundle
 // serves each seat verb the claims promise as <seat>.<verb>, and that the Go bundle is declared.
 func checkTheToolsAgree(t *testing.T, m manifest) {
 	t.Helper()
 	own, seat := map[string]bool{}, map[string]bool{}
 	for _, tool := range tools() {
 		if strings.Contains(tool.Name, ".") {
 			seat[tool.Name] = true
 		} else {
 			own[tool.Name] = true
 		}
 		if strings.TrimSpace(tool.Description) == "" {
 			t.Errorf("%s has no description", tool.Name)
 		}
 	}
 	listed := map[string]bool{}
 	for _, name := range m.Tools {
 		listed[name] = true
 		if !own[name] {
 			t.Errorf("module.json lists %s, which the bundle does not serve", name)
 		}
 	}
 	for name := range own {
 		if !listed[name] {
 			t.Errorf("the bundle serves %s, which module.json does not list", name)
 		}
 		if !strings.HasPrefix(name, strings.ReplaceAll(m.Module, "-", "_")+"_") {
 			t.Errorf("%s is not prefixed with the module's name", name)
 		}
 	}
 	promised := map[string]bool{}
 	for _, c := range m.Claims {
 		for _, verb := range c.Serves {
 			promised[c.Name+"."+verb] = true
 			if !seat[c.Name+"."+verb] {
 				t.Errorf("the claim on %s promises %s, which the bundle does not serve", c.Name, verb)
 			}
 		}
 	}
 	for name := range seat {
 		if !promised[name] {
 			t.Errorf("the bundle serves %s, which no claim promises", name)
 		}
 	}
 	var bundle map[string]any
 	for _, a := range m.Build.Artifacts {
 		if a["kind"] == "bundle" {
 			bundle = a
 		}
 	}
 	if bundle == nil || bundle["language"] != "go" || bundle["system"] != "arch" ||
 		bundle["from"] != "cmd/"+m.Module+"-tools" || bundle["binary"] != m.Module+"-tools" {
 		t.Errorf("the Go tools bundle: %v", bundle)
 	}
 }
 // checkNoSecretsOrInstallationNames refuses what a catalogue manifest must never carry.
 func checkNoSecretsOrInstallationNames(t *testing.T) {
 	t.Helper()
 	raw, err := os.ReadFile(filepath.Join("..", "..", "module.json"))
 	if err != nil {
 		t.Fatal(err)
 	}
 	s := strings.ToLower(string(raw))
 	for _, never := range []string{"/home/", "jochen", "g14", "shanks", "novox.be", "api_key", ".hal/", "greenclip daemon"} {
 		if strings.Contains(s, never) {
 			t.Errorf("module.json names %q", never)
 		}
 	}
 }
@@ -1,79 +0,0 @@
 package main
 import (
 	"os"
 	"path/filepath"
 	"reflect"
 	"strings"
 	"testing"
 )
 // feh's shape (novox/hq ADR 0208): no seat; it requires the X display on its own machine, carries
 // the wallpaper as its own archive (ADR 0205), owns ~/.fehbg pointing at it, and sets it once from
 // the session's start.
 func TestItRequiresTheXDisplayAndClaimsNothing(t *testing.T) {
 	m := readManifest(t)
 	if m.Module != "feh" || m.Seats != nil || m.Claims != nil {
 		t.Fatalf("module %q, seats %v, claims %v", m.Module, m.Seats, m.Claims)
 	}
 	if !reflect.DeepEqual(m.Requires, []string{"x11-display"}) {
 		t.Fatalf("requires: %v", m.Requires)
 	}
 	if present, absent := m.packages(); !reflect.DeepEqual(present, []string{"feh"}) || absent != nil {
 		t.Fatalf("packages: %v, absent %v", present, absent)
 	}
 }
 func TestTheWallpaperIsTheModulesOwnArchive(t *testing.T) {
 	m := readManifest(t)
 	a := m.resource(t, "wallpapers")
 	if a["type"] != "archive" || a["artifact"] != "wallpapers" || a["path"] != "${machine:account-home}/.local/share/feh/wallpapers" || a["owner"] != "${machine:account}" {
 		t.Fatalf("%v", a)
 	}
 	found := false
 	for _, art := range m.Build.Artifacts {
 		if art["name"] == "wallpapers" && art["kind"] == "archive" && art["from"] == "wallpaper" {
 			found = true
 		}
 	}
 	if !found {
 		t.Fatal("no archive artifact built from wallpaper/")
 	}
 	info, err := os.Stat(filepath.Join("..", "..", "wallpaper", "default.jpg"))
 	if err != nil || info.Size() == 0 {
 		t.Fatalf("the image: %v", err)
 	}
 }
 func TestFehbgIsOwnedAndTheSessionStartRunsItOnce(t *testing.T) {
 	m := readManifest(t)
 	m.sameAsSource(t, "fehbg", "files/fehbg")
 	f := m.resource(t, "fehbg")
 	if f["path"] != "${machine:account-home}/.fehbg" || f["mode"] != "0755" {
 		t.Fatalf("%v", f)
 	}
 	if c := f["content"].(string); !strings.Contains(c, "$HOME/.local/share/feh/wallpapers/default.jpg") || strings.Contains(c, ".hal") {
 		t.Fatalf("%s", c)
 	}
 	if len(m.Shell) != 1 || m.Shell[0].For != "xinitrc" || m.Shell[0].Slot != "normal" || strings.Count(m.Shell[0].Code, `"$HOME/.fehbg"`) != 1 {
 		t.Fatalf("%+v", m.Shell)
 	}
 }
 func TestTheKeyThatRestoresTheWallpaperIsAnI3DropIn(t *testing.T) {
 	m := readManifest(t)
 	m.sameAsSource(t, "i3-bindings", "files/i3/50-feh.conf")
 	if p := m.resource(t, "i3-bindings")["path"]; p != "${machine:account-home}/.config/i3/config.d/50-feh.conf" {
 		t.Fatalf("path: %v", p)
 	}
 	if c := m.resource(t, "i3-bindings")["content"].(string); !strings.Contains(c, "bindsym $mod+Shift+b exec --no-startup-id ~/.fehbg\n") {
 		t.Fatalf("%s", c)
 	}
 }
 func TestTheToolsAgreeWithTheManifest(t *testing.T) {
 	m := readManifest(t)
 	checkTheToolsAgree(t, m)
 	checkNoSecretsOrInstallationNames(t)
 }
@@ -1,423 +0,0 @@
 // The operator's graphical session, as a tool the node's runtime runs finds it (novox/hq ADR 0208).
 //
 // The runtime is a system service running as the operator account (ADR 0175): it has the account's
 // uid and none of the session's environment — no DISPLAY, no XAUTHORITY, no session bus. A tool that
 // draws on the screen or talks to the desktop's D-Bus must find them. It reads them from a process of
 // the account that is part of the session (the window manager first), the same thing `loginctl` and
 // a person's own shell would point at, and says where it found them.
 //
 // Long-lived programs a tool starts go to the account's own service manager through `systemd-run
 // --user`, never as children of the tool: the runtime's unit is a cgroup the service manager empties
 // whenever the runtime restarts, and a compositor or a clipboard owner started from inside it would
 // die with it.
 //
 // This file is the same in every desktop module that carries it; it moves into the Go SDK once a
 // second consumer outside the desktop wants it.
 package main
 import (
 	"bytes"
 	"errors"
 	"fmt"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"sort"
 	"strconv"
 	"strings"
 	"syscall"
 	"time"
 )
 // Where the session is looked for. Variables so a test can point them at a fake tree.
 var (
 	procRoot   = "/proc"
 	runUserDir = "/run/user"
 	x11Sockets = "/tmp/.X11-unix"
 )
 // sessionHolders are the processes whose environment is the session's, best first: the window
 // manager is the session, the rest are its children. Anything else carrying DISPLAY ranks after them.
 var sessionHolders = []string{"i3", "sway", "i3bar", "picom", "xss-lock", "dunst", "clipmenud", "xterm"}
 // sessionKeys are the variables a session carries that a tool hands on to what it runs.
 var sessionKeys = []string{"DISPLAY", "XAUTHORITY", "WAYLAND_DISPLAY", "DBUS_SESSION_BUS_ADDRESS",
 	"XDG_RUNTIME_DIR", "XDG_SESSION_ID", "I3SOCK"}
 // Session is what a tool needs to reach the operator's desktop.
 type Session struct {
 	UID        int    `json:"uid"`
 	Display    string `json:"display,omitempty"`
 	XAuthority string `json:"xauthority,omitempty"`
 	Wayland    string `json:"wayland_display,omitempty"`
 	Bus        string `json:"bus,omitempty"`
 	RuntimeDir string `json:"runtime_dir,omitempty"`
 	SessionID  string `json:"session_id,omitempty"`
 	I3Sock     string `json:"i3sock,omitempty"`
 	// From says where the values were found: the tool's own environment, a process, or the socket.
 	From string `json:"from"`
 }
 // ErrNoSession is answered by a tool that needs the desktop when nobody is logged in to it.
 var ErrNoSession = errors.New("no graphical session")
 // ErrTimedOut is what run answers for a command ended because it ran past its time.
 var ErrTimedOut = errors.New("timed out")
 // ErrNoBus is answered by a tool that needs the session bus when the account has none.
 var ErrNoBus = errors.New("no session bus")
 // operatorHome is the account's home: what the runtime was told, else the process's own.
 func operatorHome() string {
 	if h := strings.TrimSpace(os.Getenv("MESH_OPERATOR_HOME")); h != "" {
 		return h
 	}
 	h, _ := os.UserHomeDir()
 	return h
 }
 // findSession finds the graphical session of the account this tool runs as, or answers
 // ErrNoSession with what it looked at.
 func findSession() (Session, error) {
 	s := findEnvironment()
 	if s.Display == "" && s.Wayland == "" {
 		return s, fmt.Errorf("%w for uid %d on this machine: no process of the account carries DISPLAY "+
 			"or WAYLAND_DISPLAY, and no X server socket in %s has an authority file to go with it. "+
 			"Is anyone logged in to the desktop?", ErrNoSession, s.UID, x11Sockets)
 	}
 	return s, nil
 }
 // findBus finds the account's session bus, which a logged-in account has whether or not a desktop
 // is running.
 func findBus() (Session, error) {
 	s := findEnvironment()
 	if s.Bus == "" {
 		return s, fmt.Errorf("%w for uid %d: DBUS_SESSION_BUS_ADDRESS is not set and %s does not exist "+
 			"(the account is not logged in)", ErrNoBus, s.UID, filepath.Join(runUserDir, strconv.Itoa(s.UID), "bus"))
 	}
 	return s, nil
 }
 func findEnvironment() Session {
 	uid := os.Getuid()
 	s := Session{UID: uid}
 	own := map[string]string{}
 	for _, k := range sessionKeys {
 		own[k] = os.Getenv(k)
 	}
 	if own["DISPLAY"] != "" || own["WAYLAND_DISPLAY"] != "" {
 		s.fill(own)
 		s.From = "the tool's own environment"
 	} else if pid, comm, env, ok := sessionProcess(uid); ok {
 		s.fill(env)
 		s.From = fmt.Sprintf("process %s (pid %d)", comm, pid)
 	} else if display, ok := lonelyX11Socket(); ok {
 		if a := filepath.Join(operatorHome(), ".Xauthority"); exists(a) {
 			s.Display, s.XAuthority = display, a
 			s.From = "the X server socket and the account's ~/.Xauthority"
 		}
 		s.fill(own)
 	} else {
 		s.fill(own)
 		s.From = "nothing: no session found"
 	}
 	// The bus and the runtime directory are the account's, whether or not the process named them.
 	runtime := filepath.Join(runUserDir, strconv.Itoa(uid))
 	if s.RuntimeDir == "" && exists(runtime) {
 		s.RuntimeDir = runtime
 	}
 	if s.Bus == "" && s.RuntimeDir != "" && exists(filepath.Join(s.RuntimeDir, "bus")) {
 		s.Bus = "unix:path=" + filepath.Join(s.RuntimeDir, "bus")
 	}
 	return s
 }
 func (s *Session) fill(env map[string]string) {
 	set := func(dst *string, key string) {
 		if *dst == "" {
 			*dst = env[key]
 		}
 	}
 	set(&s.Display, "DISPLAY")
 	set(&s.XAuthority, "XAUTHORITY")
 	set(&s.Wayland, "WAYLAND_DISPLAY")
 	set(&s.Bus, "DBUS_SESSION_BUS_ADDRESS")
 	set(&s.RuntimeDir, "XDG_RUNTIME_DIR")
 	set(&s.SessionID, "XDG_SESSION_ID")
 	set(&s.I3Sock, "I3SOCK")
 }
 // sessionProcess is the best process of this uid whose environment names a display.
 func sessionProcess(uid int) (int, string, map[string]string, bool) {
 	entries, err := os.ReadDir(procRoot)
 	if err != nil {
 		return 0, "", nil, false
 	}
 	type candidate struct {
 		pid  int
 		comm string
 		env  map[string]string
 		rank int
 	}
 	var found []candidate
 	for _, e := range entries {
 		pid, err := strconv.Atoi(e.Name())
 		if err != nil {
 			continue
 		}
 		dir := filepath.Join(procRoot, e.Name())
 		if owner, ok := ownerOf(dir); !ok || owner != uid {
 			continue
 		}
 		raw, err := os.ReadFile(filepath.Join(dir, "environ"))
 		if err != nil {
 			continue
 		}
 		env := parseEnviron(raw)
 		if env["DISPLAY"] == "" && env["WAYLAND_DISPLAY"] == "" {
 			continue
 		}
 		comm := readTrimmed(filepath.Join(dir, "comm"))
 		rank := len(sessionHolders)
 		for i, h := range sessionHolders {
 			if h == comm {
 				rank = i
 				break
 			}
 		}
 		found = append(found, candidate{pid, comm, env, rank})
 	}
 	if len(found) == 0 {
 		return 0, "", nil, false
 	}
 	sort.Slice(found, func(i, j int) bool {
 		if found[i].rank != found[j].rank {
 			return found[i].rank < found[j].rank
 		}
 		return found[i].pid > found[j].pid // the newer of two equals
 	})
 	best := found[0]
 	return best.pid, best.comm, best.env, true
 }
 func parseEnviron(raw []byte) map[string]string {
 	env := map[string]string{}
 	for _, kv := range bytes.Split(raw, []byte{0}) {
 		if i := bytes.IndexByte(kv, '='); i > 0 {
 			env[string(kv[:i])] = string(kv[i+1:])
 		}
 	}
 	return env
 }
 func ownerOf(path string) (int, bool) {
 	info, err := os.Stat(path)
 	if err != nil {
 		return 0, false
 	}
 	st, ok := info.Sys().(*syscall.Stat_t)
 	if !ok {
 		return 0, false
 	}
 	return int(st.Uid), true
 }
 // lonelyX11Socket is the display of the one X server socket there is, when there is exactly one.
 func lonelyX11Socket() (string, bool) {
 	entries, err := os.ReadDir(x11Sockets)
 	if err != nil {
 		return "", false
 	}
 	var displays []string
 	for _, e := range entries {
 		if n := strings.TrimPrefix(e.Name(), "X"); n != e.Name() {
 			if _, err := strconv.Atoi(n); err == nil {
 				displays = append(displays, ":"+n)
 			}
 		}
 	}
 	if len(displays) != 1 {
 		return "", false
 	}
 	return displays[0], true
 }
 func readTrimmed(path string) string {
 	b, err := os.ReadFile(path)
 	if err != nil {
 		return ""
 	}
 	return strings.TrimSpace(string(b))
 }
 func exists(path string) bool {
 	_, err := os.Stat(path)
 	return err == nil
 }
 // Env is this process's environment with the session's variables in place of its own.
 func (s Session) Env() []string {
 	drop := map[string]bool{}
 	for _, k := range sessionKeys {
 		drop[k] = true
 	}
 	var env []string
 	for _, kv := range os.Environ() {
 		if i := strings.IndexByte(kv, '='); i > 0 && drop[kv[:i]] {
 			continue
 		}
 		env = append(env, kv)
 	}
 	add := func(k, v string) {
 		if v != "" {
 			env = append(env, k+"="+v)
 		}
 	}
 	add("DISPLAY", s.Display)
 	add("XAUTHORITY", s.XAuthority)
 	add("WAYLAND_DISPLAY", s.Wayland)
 	add("DBUS_SESSION_BUS_ADDRESS", s.Bus)
 	add("XDG_RUNTIME_DIR", s.RuntimeDir)
 	add("XDG_SESSION_ID", s.SessionID)
 	add("I3SOCK", s.I3Sock)
 	return env
 }
 // mostOutput bounds what a command may answer with, per stream.
 const mostOutput = 256 << 10
 // Result is what a command did.
 type Result struct {
 	Stdout    string `json:"stdout"`
 	Stderr    string `json:"stderr,omitempty"`
 	Code      int    `json:"code"`
 	Truncated bool   `json:"truncated,omitempty"`
 }
 // run runs a command in the session's environment, its input given, ended with everything it
 // started after timeout. A command that is not installed is an error naming it; one that exits
 // non-zero is a Result with its code, for the caller to judge.
 func (s Session) run(timeout time.Duration, stdin string, name string, args ...string) (Result, error) {
 	path, err := exec.LookPath(name)
 	if err != nil {
 		return Result{}, fmt.Errorf("%s is not installed on this machine", name)
 	}
 	cmd := exec.Command(path, args...)
 	cmd.Env = s.Env()
 	if home := operatorHome(); exists(home) {
 		cmd.Dir = home
 	}
 	if stdin != "" {
 		cmd.Stdin = strings.NewReader(stdin)
 	}
 	var out, errOut capped
 	cmd.Stdout, cmd.Stderr = &out, &errOut
 	cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
 	if err := cmd.Start(); err != nil {
 		return Result{}, fmt.Errorf("%s: %w", name, err)
 	}
 	done := make(chan error, 1)
 	go func() { done <- cmd.Wait() }()
 	select {
 	case err = <-done:
 	case <-time.After(timeout):
 		_ = syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL)
 		<-done
 		return Result{Stdout: out.String(), Stderr: errOut.String()},
 			fmt.Errorf("%s did not finish within %s and was ended: %w", name, timeout, ErrTimedOut)
 	}
 	r := Result{Stdout: out.String(), Stderr: errOut.String(), Truncated: out.cut || errOut.cut}
 	var exit *exec.ExitError
 	if errors.As(err, &exit) {
 		r.Code = exit.ExitCode()
 	} else if err != nil {
 		return r, fmt.Errorf("%s: %w", name, err)
 	}
 	return r, nil
 }
 // detach starts a long-lived program under the account's own service manager, as a transient unit
 // that carries the session's display, so it outlives the runtime that asked for it. A unit already
 // running under the same name is stopped first, so a fixed name means "at most one".
 func (s Session) detach(unit string, args ...string) error {
 	if s.RuntimeDir == "" {
 		return fmt.Errorf("%w: the account's runtime directory is missing, so its service manager "+
 			"cannot be reached", ErrNoBus)
 	}
 	_, _ = s.run(5*time.Second, "", "systemctl", "--user", "stop", unit+".service")
 	call := []string{"--user", "--collect", "--quiet", "--unit=" + unit}
 	for _, kv := range [][2]string{{"DISPLAY", s.Display}, {"XAUTHORITY", s.XAuthority},
 		{"WAYLAND_DISPLAY", s.Wayland}, {"XDG_SESSION_ID", s.SessionID}, {"I3SOCK", s.I3Sock}} {
 		if kv[1] != "" {
 			call = append(call, "--setenv="+kv[0]+"="+kv[1])
 		}
 	}
 	call = append(call, "--")
 	call = append(call, args...)
 	r, err := s.run(10*time.Second, "", "systemd-run", call...)
 	if err != nil {
 		return err
 	}
 	if r.Code != 0 {
 		return fmt.Errorf("systemd-run %s: %s", unit, strings.TrimSpace(r.Stderr))
 	}
 	return nil
 }
 // uniqueUnit is a transient unit name that will not collide with an earlier one.
 func uniqueUnit(prefix string) string {
 	return fmt.Sprintf("%s-%d", prefix, time.Now().UnixNano())
 }
 type capped struct {
 	bytes.Buffer
 	cut bool
 }
 func (c *capped) Write(p []byte) (int, error) {
 	if room := mostOutput - c.Len(); room < len(p) {
 		if room > 0 {
 			c.Buffer.Write(p[:room])
 		}
 		c.cut = true
 		return len(p), nil
 	}
 	return c.Buffer.Write(p)
 }
 // processesOf are the pids of this uid's processes whose command name is comm, oldest first.
 func processesOf(comm string) []int {
 	entries, err := os.ReadDir(procRoot)
 	if err != nil {
 		return nil
 	}
 	uid := os.Getuid()
 	var pids []int
 	for _, e := range entries {
 		pid, err := strconv.Atoi(e.Name())
 		if err != nil {
 			continue
 		}
 		dir := filepath.Join(procRoot, e.Name())
 		if owner, ok := ownerOf(dir); !ok || owner != uid {
 			continue
 		}
 		if readTrimmed(filepath.Join(dir, "comm")) == comm {
 			pids = append(pids, pid)
 		}
 	}
 	sort.Ints(pids)
 	return pids
 }
 // signalAll sends sig to every process of this uid named comm, and answers the pids it reached.
 func signalAll(comm string, sig syscall.Signal) []int {
 	var reached []int
 	for _, pid := range processesOf(comm) {
 		if syscall.Kill(pid, sig) == nil {
 			reached = append(reached, pid)
 		}
 	}
 	return reached
 }
@@ -1,174 +0,0 @@
 package main
 import (
 	"errors"
 	"os"
 	"path/filepath"
 	"strconv"
 	"strings"
 	"testing"
 	"time"
 )
 // fakeMachine points the session finder at a temporary /proc, /run/user and X socket directory, with
 // none of the test process's own session variables, and gives back the root.
 func fakeMachine(t *testing.T) string {
 	t.Helper()
 	root := t.TempDir()
 	procRoot, runUserDir, x11Sockets = filepath.Join(root, "proc"), filepath.Join(root, "run-user"), filepath.Join(root, "x11")
 	for _, d := range []string{procRoot, runUserDir, x11Sockets} {
 		if err := os.MkdirAll(d, 0o755); err != nil {
 			t.Fatal(err)
 		}
 	}
 	for _, k := range sessionKeys {
 		t.Setenv(k, "")
 	}
 	t.Setenv("MESH_OPERATOR_HOME", filepath.Join(root, "home"))
 	t.Cleanup(func() { procRoot, runUserDir, x11Sockets = "/proc", "/run/user", "/tmp/.X11-unix" })
 	return root
 }
 func fakeProcess(t *testing.T, pid int, comm string, env ...string) {
 	t.Helper()
 	dir := filepath.Join(procRoot, strconv.Itoa(pid))
 	if err := os.MkdirAll(dir, 0o755); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.WriteFile(filepath.Join(dir, "comm"), []byte(comm+"\n"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.WriteFile(filepath.Join(dir, "environ"), []byte(strings.Join(env, "\x00")+"\x00"), 0o600); err != nil {
 		t.Fatal(err)
 	}
 }
 func TestTheSessionIsReadFromTheWindowManagerBeforeAnyOtherProcess(t *testing.T) {
 	fakeMachine(t)
 	fakeProcess(t, 900, "xterm", "DISPLAY=:9", "XAUTHORITY=/elsewhere")
 	fakeProcess(t, 100, "i3", "DISPLAY=:1", "XAUTHORITY=/home/op/.Xauthority",
 		"DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus", "XDG_SESSION_ID=3", "SECRET_TOKEN=never-copied")
 	fakeProcess(t, 50, "bash", "PATH=/usr/bin")
 	s, err := findSession()
 	if err != nil {
 		t.Fatal(err)
 	}
 	if s.Display != ":1" || s.XAuthority != "/home/op/.Xauthority" || s.SessionID != "3" || !strings.Contains(s.From, "i3 (pid 100)") {
 		t.Fatalf("the window manager's environment: %+v", s)
 	}
 	for _, kv := range s.Env() {
 		if strings.HasPrefix(kv, "SECRET_TOKEN=") {
 			t.Fatal("a variable of the session process that is not a session variable was handed on")
 		}
 	}
 }
 func TestAnyProcessCarryingADisplayServesWhenTheWindowManagerIsNotFound(t *testing.T) {
 	fakeMachine(t)
 	fakeProcess(t, 10, "firefox", "DISPLAY=:0")
 	fakeProcess(t, 20, "firefox", "DISPLAY=:2")
 	s, err := findSession()
 	if err != nil || s.Display != ":2" {
 		t.Fatalf("the newest of two equals: %+v, %v", s, err)
 	}
 }
 func TestNoSessionIsAClearAnswerNotAGuess(t *testing.T) {
 	fakeMachine(t)
 	fakeProcess(t, 10, "sshd", "PATH=/usr/bin")
 	_, err := findSession()
 	if !errors.Is(err, ErrNoSession) || !strings.Contains(err.Error(), "logged in to the desktop") {
 		t.Fatalf("no session: %v", err)
 	}
 }
 func TestOneXSocketAndTheAccountsAuthorityFileAreASession(t *testing.T) {
 	root := fakeMachine(t)
 	if err := os.WriteFile(filepath.Join(x11Sockets, "X0"), nil, 0o644); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.MkdirAll(filepath.Join(root, "home"), 0o755); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.WriteFile(filepath.Join(root, "home", ".Xauthority"), nil, 0o600); err != nil {
 		t.Fatal(err)
 	}
 	s, err := findSession()
 	if err != nil || s.Display != ":0" || !strings.HasSuffix(s.XAuthority, "/home/.Xauthority") {
 		t.Fatalf("socket and authority: %+v, %v", s, err)
 	}
 }
 func TestTheBusIsTheAccountsRuntimeDirectoryWhenNoProcessNamesIt(t *testing.T) {
 	fakeMachine(t)
 	runtime := filepath.Join(runUserDir, strconv.Itoa(os.Getuid()))
 	if _, err := findBus(); !errors.Is(err, ErrNoBus) {
 		t.Fatalf("no runtime directory is no bus: %v", err)
 	}
 	if err := os.MkdirAll(runtime, 0o700); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.WriteFile(filepath.Join(runtime, "bus"), nil, 0o600); err != nil {
 		t.Fatal(err)
 	}
 	s, err := findBus()
 	if err != nil || s.Bus != "unix:path="+filepath.Join(runtime, "bus") || s.RuntimeDir != runtime {
 		t.Fatalf("bus: %+v, %v", s, err)
 	}
 	env := strings.Join(s.Env(), "\n")
 	if !strings.Contains(env, "XDG_RUNTIME_DIR="+runtime) || !strings.Contains(env, "DBUS_SESSION_BUS_ADDRESS=unix:path=") {
 		t.Fatalf("the bus is handed on: %s", env)
 	}
 }
 func TestACommandIsBoundedAndANonZeroExitIsAResult(t *testing.T) {
 	fakeMachine(t)
 	s := Session{}
 	r, err := s.run(5*time.Second, "in", "sh", "-c", "cat; echo err >&2; exit 3")
 	if err != nil || r.Stdout != "in" || r.Code != 3 || strings.TrimSpace(r.Stderr) != "err" {
 		t.Fatalf("result: %+v, %v", r, err)
 	}
 	start := time.Now()
 	if _, err := s.run(200*time.Millisecond, "", "sh", "-c", "sleep 30 & sleep 30"); err == nil || time.Since(start) > 5*time.Second {
 		t.Fatalf("a command past its time is ended with what it started: %v after %s", err, time.Since(start))
 	}
 	if _, err := s.run(time.Second, "", "no-such-program-here"); err == nil || !strings.Contains(err.Error(), "not installed") {
 		t.Fatalf("a missing program: %v", err)
 	}
 }
 func TestDetachAsksTheAccountsServiceManagerWithTheSessionsDisplay(t *testing.T) {
 	fakeMachine(t)
 	bin := fakeBinaries(t, map[string]string{
 		"systemctl":   `echo "systemctl $*" >> "$LOG"`,
 		"systemd-run": `echo "systemd-run $*" >> "$LOG"`,
 	})
 	log := filepath.Join(bin, "log")
 	t.Setenv("LOG", log)
 	s := Session{Display: ":1", XAuthority: "/x", RuntimeDir: "/run/user/1"}
 	if err := s.detach("picom-session", "picom", "--config", "/c"); err != nil {
 		t.Fatal(err)
 	}
 	got, _ := os.ReadFile(log)
 	want := "systemctl --user stop picom-session.service\n" +
 		"systemd-run --user --collect --quiet --unit=picom-session --setenv=DISPLAY=:1 --setenv=XAUTHORITY=/x -- picom --config /c\n"
 	if string(got) != want {
 		t.Fatalf("detach ran:\n%s\nwant:\n%s", got, want)
 	}
 	if err := (Session{}).detach("x", "y"); !errors.Is(err, ErrNoBus) {
 		t.Fatalf("no runtime directory: %v", err)
 	}
 }
 // fakeBinaries puts shell scripts named for programs first on PATH, and answers their directory.
 func fakeBinaries(t *testing.T, scripts map[string]string) string {
 	t.Helper()
 	dir := t.TempDir()
 	for name, body := range scripts {
 		if err := os.WriteFile(filepath.Join(dir, name), []byte("#!/bin/sh\n"+body+"\n"), 0o755); err != nil {
 			t.Fatal(err)
 		}
 	}
 	t.Setenv("PATH", dir+string(os.PathListSeparator)+os.Getenv("PATH"))
 	return dir
 }
@@ -1,174 +0,0 @@
 package main
 import (
 	"encoding/json"
 	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
 	"regexp"
 	"strings"
 	"time"
 )
 // modes are feh's background modes, by the word feh_set takes.
 var modes = []string{"fill", "center", "max", "scale", "tile"}
 // Wallpaper is images and how they are laid on the screens.
 type Wallpaper struct {
 	Images []string `json:"images"`
 	Mode   string   `json:"mode"`
 	At     string   `json:"at,omitempty"`
 }
 func fehbg() string { return filepath.Join(operatorHome(), ".fehbg") }
 // sessionRecord is where feh_set notes what it put up, for feh_current: in the runtime directory,
 // so it lasts exactly as long as the login, like the wallpaper itself.
 func sessionRecord(s Session) string {
 	if s.RuntimeDir == "" {
 		return ""
 	}
 	return filepath.Join(s.RuntimeDir, "feh", "current.json")
 }
 // SetResult is what feh_set answers.
 type SetResult struct {
 	Wallpaper
 	Note string `json:"note"`
 }
 // Set puts images up as the wallpaper for this session.
 func Set(images []string, mode string) (SetResult, error) {
 	if mode == "" {
 		mode = "fill"
 	}
 	known := false
 	for _, m := range modes {
 		known = known || m == mode
 	}
 	if !known {
 		return SetResult{}, fmt.Errorf("mode %q is one of %s", mode, strings.Join(modes, ", "))
 	}
 	if len(images) == 0 {
 		return SetResult{}, errors.New("images is required: at least one image")
 	}
 	var paths []string
 	for _, img := range images {
 		p := img
 		if strings.HasPrefix(p, "~/") {
 			p = filepath.Join(operatorHome(), p[2:])
 		}
 		if !filepath.IsAbs(p) {
 			p = filepath.Join(operatorHome(), p)
 		}
 		info, err := os.Stat(p)
 		if err != nil {
 			return SetResult{}, fmt.Errorf("image %s: %w", img, err)
 		}
 		if info.IsDir() {
 			return SetResult{}, fmt.Errorf("image %s is a directory", img)
 		}
 		paths = append(paths, p)
 	}
 	s, err := findSession()
 	if err != nil {
 		return SetResult{}, err
 	}
 	args := append([]string{"--no-fehbg", "--bg-" + mode}, paths...)
 	r, err := s.run(15*time.Second, "", "feh", args...)
 	if err != nil {
 		return SetResult{}, err
 	}
 	if r.Code != 0 {
 		return SetResult{}, fmt.Errorf("feh: %s", strings.TrimSpace(r.Stderr))
 	}
 	w := Wallpaper{Images: paths, Mode: mode, At: time.Now().Format(time.RFC3339)}
 	if rec := sessionRecord(s); rec != "" {
 		if err := os.MkdirAll(filepath.Dir(rec), 0o700); err == nil {
 			raw, _ := json.Marshal(w)
 			_ = os.WriteFile(rec, raw, 0o600)
 		}
 	}
 	return SetResult{Wallpaper: w, Note: "for this session; the declared wallpaper returns at the next login"}, nil
 }
 // CurrentResult is what feh_current answers.
 type CurrentResult struct {
 	Declared *Wallpaper `json:"declared"`
 	Session  *Wallpaper `json:"session,omitempty"`
 }
 var bgMode = regexp.MustCompile(`--bg-(fill|center|max|scale|tile)\b`)
 // Current is the declared wallpaper and the one set in this session.
 func Current() (CurrentResult, error) {
 	var out CurrentResult
 	if raw, err := os.ReadFile(fehbg()); err == nil {
 		out.Declared = parseFehbg(string(raw), operatorHome())
 	}
 	if rec := sessionRecord(findEnvironment()); rec != "" {
 		if raw, err := os.ReadFile(rec); err == nil {
 			var w Wallpaper
 			if json.Unmarshal(raw, &w) == nil {
 				out.Session = &w
 			}
 		}
 	}
 	return out, nil
 }
 // parseFehbg reads the feh line of a ~/.fehbg: its mode and its images, with $HOME expanded.
 func parseFehbg(script, home string) *Wallpaper {
 	for _, line := range strings.Split(script, "\n") {
 		line = strings.TrimSpace(line)
 		if !strings.HasPrefix(line, "feh ") {
 			continue
 		}
 		w := &Wallpaper{Images: []string{}}
 		if m := bgMode.FindStringSubmatch(line); m != nil {
 			w.Mode = m[1]
 		}
 		for _, word := range shellWords(line)[1:] {
 			if strings.HasPrefix(word, "-") {
 				continue
 			}
 			word = strings.ReplaceAll(strings.ReplaceAll(word, "${HOME}", home), "$HOME", home)
 			w.Images = append(w.Images, word)
 		}
 		return w
 	}
 	return nil
 }
 // shellWords splits a simple command line on blanks, honouring single and double quotes.
 func shellWords(line string) []string {
 	var words []string
 	var cur strings.Builder
 	var quote byte
 	in := false
 	for i := 0; i < len(line); i++ {
 		c := line[i]
 		switch {
 		case quote != 0 && c == quote:
 			quote = 0
 		case quote != 0:
 			cur.WriteByte(c)
 		case c == '\'' || c == '"':
 			quote, in = c, true
 		case c == ' ' || c == '\t':
 			if in {
 				words = append(words, cur.String())
 				cur.Reset()
 				in = false
 			}
 		default:
 			cur.WriteByte(c)
 			in = true
 		}
 	}
 	if in {
 		words = append(words, cur.String())
 	}
 	return words
 }
@@ -1,92 +0,0 @@
 package main
 import (
 	"errors"
 	"os"
 	"path/filepath"
 	"reflect"
 	"strconv"
 	"strings"
 	"testing"
 )
 const nobody = 4194400
 func TestTheDeclaredWallpaperIsReadFromTheModulesFehbg(t *testing.T) {
 	raw, err := os.ReadFile(filepath.Join("..", "..", "files", "fehbg"))
 	if err != nil {
 		t.Fatal(err)
 	}
 	w := parseFehbg(string(raw), "/home/op")
 	if w == nil || w.Mode != "fill" || !reflect.DeepEqual(w.Images, []string{"/home/op/.local/share/feh/wallpapers/default.jpg"}) {
 		t.Fatalf("%+v", w)
 	}
 	// The form feh writes itself, single-quoted, two monitors.
 	w = parseFehbg("#!/bin/sh\nfeh --no-fehbg --bg-center '/a b/one.png' '/two.png' \n", "/home/op")
 	if w.Mode != "center" || !reflect.DeepEqual(w.Images, []string{"/a b/one.png", "/two.png"}) {
 		t.Fatalf("%+v", w)
 	}
 	if parseFehbg("#!/bin/sh\n", "/h") != nil {
 		t.Fatal("a file without feh declares a wallpaper")
 	}
 }
 func TestSetPutsTheImagesUpForThisSessionAndCurrentSaysSo(t *testing.T) {
 	root := fakeMachine(t)
 	fakeProcess(t, nobody, "i3", "DISPLAY=:1")
 	if err := os.MkdirAll(filepath.Join(runUserDir, strconv.Itoa(os.Getuid())), 0o700); err != nil {
 		t.Fatal(err)
 	}
 	home := filepath.Join(root, "home")
 	for _, f := range []string{"Pictures/a.jpg", "Pictures/b.jpg"} {
 		if err := os.MkdirAll(filepath.Dir(filepath.Join(home, f)), 0o755); err != nil {
 			t.Fatal(err)
 		}
 		if err := os.WriteFile(filepath.Join(home, f), []byte("jpg"), 0o644); err != nil {
 			t.Fatal(err)
 		}
 	}
 	src, _ := os.ReadFile(filepath.Join("..", "..", "files", "fehbg"))
 	if err := os.WriteFile(filepath.Join(home, ".fehbg"), src, 0o755); err != nil {
 		t.Fatal(err)
 	}
 	bin := fakeBinaries(t, map[string]string{"feh": `echo "$* DISPLAY=$DISPLAY" > "$LOG"`})
 	t.Setenv("LOG", filepath.Join(bin, "log"))
 	got, err := Set([]string{"~/Pictures/a.jpg", "Pictures/b.jpg"}, "scale")
 	if err != nil || !strings.Contains(got.Note, "next login") {
 		t.Fatalf("%+v, %v", got, err)
 	}
 	asked, _ := os.ReadFile(filepath.Join(bin, "log"))
 	want := "--no-fehbg --bg-scale " + filepath.Join(home, "Pictures/a.jpg") + " " + filepath.Join(home, "Pictures/b.jpg") + " DISPLAY=:1\n"
 	if string(asked) != want {
 		t.Fatalf("feh was asked %q, want %q", asked, want)
 	}
 	cur, err := Current()
 	if err != nil || cur.Declared == nil || cur.Session == nil || cur.Session.Mode != "scale" || len(cur.Session.Images) != 2 ||
 		cur.Declared.Images[0] != filepath.Join(home, ".local/share/feh/wallpapers/default.jpg") {
 		t.Fatalf("%+v, %v", cur, err)
 	}
 }
 func TestSetRefusesWhatFehCannotShow(t *testing.T) {
 	fakeMachine(t)
 	if _, err := Set([]string{"/nowhere.jpg"}, ""); err == nil {
 		t.Fatal("a missing image was accepted")
 	}
 	if _, err := Set([]string{"/"}, ""); err == nil {
 		t.Fatal("a directory was accepted")
 	}
 	if _, err := Set([]string{"/etc/hostname"}, "stretch"); err == nil {
 		t.Fatal("an unknown mode was accepted")
 	}
 	if _, err := Set(nil, ""); err == nil {
 		t.Fatal("no image was accepted")
 	}
 	f := filepath.Join(t.TempDir(), "x.jpg")
 	if err := os.WriteFile(f, nil, 0o644); err != nil {
 		t.Fatal(err)
 	}
 	if _, err := Set([]string{f}, ""); !errors.Is(err, ErrNoSession) {
 		t.Fatalf("without a session: %v", err)
 	}
 }
@@ -1,6 +0,0 @@
 #!/bin/sh
 # The wallpaper (module feh, novox/hq ADR 0208). Owned by the mesh: replaced at every push. The
 # session's start runs it, and so may anything that wants the declared wallpaper back. The image is
 # the module's own, in ~/.local/share/feh/wallpapers. feh_set changes the wallpaper for a session
 # without touching this file.
 feh --no-fehbg --bg-fill "$HOME/.local/share/feh/wallpapers/default.jpg"
@@ -1,3 +0,0 @@
 # The wallpaper's key (module feh, novox/hq ADR 0208). Owned by the mesh: replaced at every push.
 # It puts the declared wallpaper back, after a monitor change or a wallpaper set for the session.
 bindsym $mod+Shift+b exec --no-startup-id ~/.fehbg
@@ -1,5 +0,0 @@
 module feh
 go 1.22
 require git.novox.be/novox/mesh-sdk/go v0.1.7
@@ -1,2 +0,0 @@
 git.novox.be/novox/mesh-sdk/go v0.1.7 h1:C0sTQmtTiyYH7bnqZb7PusXnqA37gKuT7Nqjn9gG47w=
 git.novox.be/novox/mesh-sdk/go v0.1.7/go.mod h1:GFuZUElBZ9A++mxgIKo97aXXo+kV0uJ/UkbhQPPIbrY=
@@ -1,71 +0,0 @@
 {
  "module": "feh",
  "version": "1",
  "capabilities": [
    "package-manager"
  ],
  "requires": [
    "x11-display"
  ],
  "tools": [
    "feh_set",
    "feh_current"
  ],
  "shell": [
    {
      "for": "xinitrc",
      "slot": "normal",
      "code": "# The wallpaper (module feh, novox/hq ADR 0208): the declared one, set once per session.\n\"$HOME/.fehbg\"\n"
    }
  ],
  "resources": [
    {
      "id": "package",
      "type": "package",
      "package": "feh"
    },
    {
      "id": "wallpapers",
      "type": "archive",
      "path": "${machine:account-home}/.local/share/feh/wallpapers",
      "owner": "${machine:account}",
      "artifact": "wallpapers"
    },
    {
      "id": "fehbg",
      "type": "file",
      "path": "${machine:account-home}/.fehbg",
      "owner": "${machine:account}",
      "mode": "0755",
      "content": "#!/bin/sh\n# The wallpaper (module feh, novox/hq ADR 0208). Owned by the mesh: replaced at every push. The\n# session's start runs it, and so may anything that wants the declared wallpaper back. The image is\n# the module's own, in ~/.local/share/feh/wallpapers. feh_set changes the wallpaper for a session\n# without touching this file.\nfeh --no-fehbg --bg-fill \"$HOME/.local/share/feh/wallpapers/default.jpg\"\n"
    },
    {
      "id": "i3-bindings",
      "type": "file",
      "path": "${machine:account-home}/.config/i3/config.d/50-feh.conf",
      "owner": "${machine:account}",
      "mode": "0644",
      "content": "# The wallpaper's key (module feh, novox/hq ADR 0208). Owned by the mesh: replaced at every push.\n# It puts the declared wallpaper back, after a monitor change or a wallpaper set for the session.\nbindsym $mod+Shift+b exec --no-startup-id ~/.fehbg\n"
    }
  ],
  "build": {
    "artifacts": [
      {
        "name": "wallpapers",
        "kind": "archive",
        "from": "wallpaper"
      },
      {
        "name": "tools",
        "kind": "bundle",
        "language": "go",
        "system": "arch",
        "from": "cmd/feh-tools",
        "binary": "feh-tools",
        "loads": [
          "feh-tools"
        ]
      }
    ]
  }
 }
@@ -1,101 +0,0 @@
 # gnome-keyring
 The secret service as a module (novox/hq ADR 0208, ADR 0102).
 - Installs `gnome-keyring` (it brings `gcr-4`, whose ssh agent this uses), `libsecret` (the client
  library and `secret-tool`) and `seahorse` (the keyrings' manager, for the operator).
 - Claims the mesh's `node-secret-service` seat (no verbs yet, ADR 0208 §2). It requires no display:
  the secret service is a D-Bus service, and a Wayland session uses the same module.
 - **Writes the PAM lines into the stacks, never over them** (ADR 0102). Each is a marked block at the
  end of the file; every other line stays the distribution's.
  - `/etc/pam.d/login`: `auth optional pam_gnome_keyring.so` and
    `session optional pam_gnome_keyring.so auto_start`. The login manager's stack includes `login`,
    so the password typed at the login screen unlocks the login keyring, and the login session starts
    the daemon.
  - `/etc/pam.d/passwd`: `password optional pam_gnome_keyring.so`, so changing the account's password
    changes the keyring's, and the next login still unlocks it.
 - **Starts no daemon.** PAM starts it at login, and D-Bus would if PAM had not.
 - Names gcr's ssh agent socket for the session, in the `xinitrc` slot `first`: `SSH_AUTH_SOCK` is
  `$XDG_RUNTIME_DIR/gcr/ssh`. The agent itself is `gcr-ssh-agent.socket`, a user unit the package
  enables by preset.
 ## Tools
 None reads a secret. They ask the Secret Service for names, counts and lock states, and the agent for
 fingerprints.
 | tool | does |
 |---|---|
 | `gnome_keyring_unlocked` | the login and default keyrings, locked or not; whether the daemon runs |
 | `gnome_keyring_lock` | lock a keyring now (login by default); unlocking stays the operator's |
 | `gnome_keyring_collections` | every keyring: id, label, locked, item count, created, changed, default |
 | `gnome_keyring_ssh_keys` | the agent's keys by fingerprint, size, type and comment |
 ## What it improves on what was found
 - **The desktop's login unlocks the keyring.** Its `/etc/pam.d/login` had no keyring lines, so the
  keyring stayed locked after every login, and a script prompted for the password to unlock it. Both
  workstations now get the same lines.
 - **One daemon.** The session's start ran `gnome-keyring-daemon --start` a second time, asking for an
  ssh component that gnome-keyring no longer has, and the window manager ran an unlock-prompt script.
  Both go.
 - **The session has an ssh agent.** The found `export SSH_AUTH_SOCK` exported nothing: the second
  daemon printed no socket. The session's processes had no agent, although gcr's was listening.
 ## The default keyring is not the login keyring
 On both workstations, measured on 2026-10-04, the default keyring, where programs store new secrets,
 is a second keyring, `Default_keyring`. The login keyring holds one item at most. PAM unlocks only the
 login keyring. Another keyring opens with it only if its password is stored in the login keyring
 ("unlock automatically"). On the desktop the login keyring was locked and the default one unlocked,
 which the unlock-prompt script did.
 After the first login with this module: `gnome_keyring_unlocked` shows both. If the default keyring
 is still locked, choose one, once, in `seahorse`:
 - tick its *unlock automatically* when prompted;
 - or move its items into the login keyring and make that the default.
 Which keyring is the default is the operator's data, never the module's.
 ## Blockers and a proposal
 **`SSH_AUTH_SOCK` belongs in the account's environment, and ADR 0203 cannot say it yet.** The value
 is a path under the account's runtime directory (`/run/user/<uid>`). ADR 0203 forbids `$` in a
 contributed value, and no `${machine:…}` fact names that directory. So today the variable reaches
 only the X session and what it starts, through the `xinitrc` slot. An ssh login, the login shell's
 `execute` and the user manager's services do not get it.
 **Proposed:** a machine fact `${machine:account-runtime-dir}`, resolved like `${machine:account-home}`
 from the account's uid. The variable then becomes an environment contribution:
 > `environment.variables.SSH_AUTH_SOCK` = `${machine:account-runtime-dir}/gcr/ssh`
 The slot contribution then goes. That is a progressive insight on ADR 0203, or a small record of its
 own. It changes the controller's machine facts, not this module's shape.
 **User-scoped units (mesh-host #72).** `gcr-ssh-agent.socket` and `gnome-keyring-daemon.socket` are
 enabled by the package's presets on both workstations, and nothing in the mesh asserts it. Once user
 units ship, this module should declare both enabled.
 ## What it leaves as found
 - The keyrings themselves (`~/.local/share/keyrings/`): the operator's data, never touched.
 - `~/.config/i3/unlock-keyring.sh`, the unlock-prompt script.
 ## Migration (ADR 0182)
 1. **On the laptop,** `/etc/pam.d/login` already has the two lines outside any block. After the first
   push they are there twice. Delete the two hand-written ones, outside the `# BEGIN mesh` block.
 2. Once the `xorg` module writes the session's start, delete from your own part of `~/.xinitrc` the
   `eval $(/usr/bin/gnome-keyring-daemon --start …)` line and the `export SSH_AUTH_SOCK` after it.
 3. Once the `i3` module carries the main configuration, its `exec … unlock-keyring.sh` line is gone.
   Delete `~/.config/i3/unlock-keyring.sh`.
 4. **On the desktop,** log in again after the first push. The keyring is unlocked by the login from
   then on.
 ## Blockers
 - `node-secret-service` and the `xinitrc` slot are ADR 0208's. Until the controller knows them,
  `mctl` reads them as unknown.
 - The environment fact above, and user-scoped units (mesh-host #72).
@@ -1,97 +0,0 @@
 // Reading a tool's arguments: JSON numbers arrive as float64, and a missing argument is its default.
 // The same in every desktop module that carries it.
 package main
 import (
 	"fmt"
 	"math"
 	"strings"
 	"time"
 )
 // text is a string argument, trimmed; required says an empty one is refused.
 func text(args map[string]any, key string, required bool) (string, error) {
 	v, present := args[key]
 	if !present || v == nil {
 		if required {
 			return "", fmt.Errorf("%s is required", key)
 		}
 		return "", nil
 	}
 	s, ok := v.(string)
 	if !ok {
 		return "", fmt.Errorf("%s is a string, not %T", key, v)
 	}
 	s = strings.TrimSpace(s)
 	if s == "" && required {
 		return "", fmt.Errorf("%s is required", key)
 	}
 	return s, nil
 }
 // whole is a whole-number argument within [least, most], or def when absent.
 func whole(args map[string]any, key string, def, least, most int) (int, error) {
 	v, present := args[key]
 	if !present || v == nil {
 		return def, nil
 	}
 	f, ok := v.(float64)
 	if !ok {
 		if i, isInt := v.(int); isInt {
 			f = float64(i)
 		} else {
 			return 0, fmt.Errorf("%s is a number, not %T", key, v)
 		}
 	}
 	if f != math.Trunc(f) {
 		return 0, fmt.Errorf("%s is a whole number, not %v", key, f)
 	}
 	n := int(f)
 	if n < least || n > most {
 		return 0, fmt.Errorf("%s is %d; it is between %d and %d", key, n, least, most)
 	}
 	return n, nil
 }
 // flag is a boolean argument, or def when absent.
 func flag(args map[string]any, key string, def bool) (bool, error) {
 	v, present := args[key]
 	if !present || v == nil {
 		return def, nil
 	}
 	b, ok := v.(bool)
 	if !ok {
 		return false, fmt.Errorf("%s is true or false, not %T", key, v)
 	}
 	return b, nil
 }
 // texts is a list-of-strings argument.
 func texts(args map[string]any, key string) ([]string, error) {
 	v, present := args[key]
 	if !present || v == nil {
 		return nil, nil
 	}
 	list, ok := v.([]any)
 	if !ok {
 		if ss, isStrings := v.([]string); isStrings {
 			return ss, nil
 		}
 		return nil, fmt.Errorf("%s is a list of strings, not %T", key, v)
 	}
 	out := make([]string, 0, len(list))
 	for i, item := range list {
 		s, ok := item.(string)
 		if !ok {
 			return nil, fmt.Errorf("%s[%d] is a string, not %T", key, i, item)
 		}
 		out = append(out, s)
 	}
 	return out, nil
 }
 // seconds is a timeout argument in seconds, defaulted and bounded below the runtime's call limit.
 func seconds(args map[string]any, key string, def, most int) (time.Duration, error) {
 	n, err := whole(args, key, def, 1, most)
 	return time.Duration(n) * time.Second, err
 }
@@ -1,260 +0,0 @@
 package main
 import (
 	"encoding/json"
 	"fmt"
 	"path/filepath"
 	"regexp"
 	"sort"
 	"strconv"
 	"strings"
 	"time"
 )
 const (
 	service       = "org.freedesktop.secrets"
 	servicePath   = "/org/freedesktop/secrets"
 	collectionDir = "/org/freedesktop/secrets/collection/"
 	busTimeout    = 10 * time.Second
 )
 // busctl runs one busctl call on the account's session bus and answers its JSON.
 func busctl(s Session, args ...string) (json.RawMessage, error) {
 	r, err := s.run(busTimeout, "", "busctl", append([]string{"--user", "--json=short"}, args...)...)
 	if err != nil {
 		return nil, err
 	}
 	if r.Code != 0 {
 		return nil, fmt.Errorf("the secret service: %s", strings.TrimSpace(r.Stderr))
 	}
 	var v struct {
 		Data json.RawMessage `json:"data"`
 	}
 	if err := json.Unmarshal([]byte(r.Stdout), &v); err != nil {
 		return nil, fmt.Errorf("busctl answered no JSON: %w", err)
 	}
 	return v.Data, nil
 }
 // collectionID is the part of a collection's object path after .../collection/, unescaped the way
 // the Secret Service escapes it ("_5f" is "_").
 func collectionID(path string) string { return strings.TrimPrefix(path, collectionDir) }
 func collectionPath(id string) string { return collectionDir + id }
 var validID = regexp.MustCompile(`^[A-Za-z0-9_]+$`)
 // Collection is one keyring.
 type Collection struct {
 	ID       string `json:"id"`
 	Label    string `json:"label"`
 	Locked   bool   `json:"locked"`
 	Items    int    `json:"items"`
 	Created  string `json:"created,omitempty"`
 	Modified string `json:"modified,omitempty"`
 	Default  bool   `json:"default,omitempty"`
 }
 // CollectionsResult is what gnome_keyring_collections answers.
 type CollectionsResult struct {
 	Collections []Collection `json:"collections"`
 }
 func paths(s Session) ([]string, error) {
 	raw, err := busctl(s, "get-property", service, servicePath, "org.freedesktop.Secret.Service", "Collections")
 	if err != nil {
 		return nil, err
 	}
 	var out []string
 	if err := json.Unmarshal(raw, &out); err != nil {
 		return nil, fmt.Errorf("the collections: %w", err)
 	}
 	return out, nil
 }
 func defaultCollection(s Session) string {
 	raw, err := busctl(s, "call", service, servicePath, "org.freedesktop.Secret.Service", "ReadAlias", "s", "default")
 	if err != nil {
 		return ""
 	}
 	var out []string
 	if json.Unmarshal(raw, &out) != nil || len(out) == 0 || out[0] == "/" {
 		return ""
 	}
 	return collectionID(out[0])
 }
 // describe reads a collection's properties: label, lock, the number of items (never the items), times.
 func describe(s Session, path string) (Collection, error) {
 	raw, err := busctl(s, "call", service, path, "org.freedesktop.DBus.Properties", "GetAll", "s", "org.freedesktop.Secret.Collection")
 	if err != nil {
 		return Collection{}, err
 	}
 	return parseCollection(path, raw)
 }
 func parseCollection(path string, raw json.RawMessage) (Collection, error) {
 	var answer []map[string]struct {
 		Data json.RawMessage `json:"data"`
 	}
 	if err := json.Unmarshal(raw, &answer); err != nil || len(answer) != 1 {
 		return Collection{}, fmt.Errorf("collection %s: not a property map", path)
 	}
 	p := answer[0]
 	c := Collection{ID: collectionID(path)}
 	_ = json.Unmarshal(p["Label"].Data, &c.Label)
 	_ = json.Unmarshal(p["Locked"].Data, &c.Locked)
 	var items []string
 	_ = json.Unmarshal(p["Items"].Data, &items)
 	c.Items = len(items)
 	for key, into := range map[string]*string{"Created": &c.Created, "Modified": &c.Modified} {
 		var t int64
 		if json.Unmarshal(p[key].Data, &t) == nil && t > 0 {
 			*into = time.Unix(t, 0).Format(time.RFC3339)
 		}
 	}
 	return c, nil
 }
 // Collections are the operator's keyrings.
 func Collections() (CollectionsResult, error) {
 	s, err := findBus()
 	if err != nil {
 		return CollectionsResult{}, err
 	}
 	ps, err := paths(s)
 	if err != nil {
 		return CollectionsResult{}, err
 	}
 	def := defaultCollection(s)
 	out := CollectionsResult{Collections: []Collection{}}
 	for _, p := range ps {
 		c, err := describe(s, p)
 		if err != nil {
 			return CollectionsResult{}, err
 		}
 		c.Default = c.ID == def
 		out.Collections = append(out.Collections, c)
 	}
 	sort.Slice(out.Collections, func(i, j int) bool { return out.Collections[i].ID < out.Collections[j].ID })
 	return out, nil
 }
 // UnlockedResult is what gnome_keyring_unlocked answers.
 type UnlockedResult struct {
 	Daemon  bool        `json:"daemon_running"`
 	Login   *Collection `json:"login,omitempty"`
 	Default *Collection `json:"default,omitempty"`
 	Note    string      `json:"note,omitempty"`
 }
 // Unlocked is whether the login and default keyrings are unlocked.
 func Unlocked() (UnlockedResult, error) {
 	s, err := findBus()
 	if err != nil {
 		return UnlockedResult{}, err
 	}
 	// gnome-keyring-daemon, as the kernel shortens a command's name to 15 characters.
 	out := UnlockedResult{Daemon: len(processesOf("gnome-keyring-d")) > 0}
 	if c, err := describe(s, collectionPath("login")); err == nil {
 		out.Login = &c
 	} else {
 		out.Note = "no login keyring: " + err.Error()
 	}
 	if def := defaultCollection(s); def != "" && def != "login" {
 		if c, err := describe(s, collectionPath(def)); err == nil {
 			c.Default = true
 			out.Default = &c
 		}
 	} else if out.Login != nil {
 		out.Login.Default = def == "login"
 	}
 	return out, nil
 }
 // LockResult is what gnome_keyring_lock answers.
 type LockResult struct {
 	Collection string `json:"collection"`
 	Locked     bool   `json:"locked"`
 }
 // Lock locks one keyring.
 func Lock(id string) (LockResult, error) {
 	if id == "" {
 		id = "login"
 	}
 	if !validID.MatchString(id) {
 		return LockResult{}, fmt.Errorf("collection %q is not a keyring id", id)
 	}
 	s, err := findBus()
 	if err != nil {
 		return LockResult{}, err
 	}
 	if _, err := busctl(s, "call", service, servicePath, "org.freedesktop.Secret.Service", "Lock", "ao", "1", collectionPath(id)); err != nil {
 		return LockResult{}, err
 	}
 	c, err := describe(s, collectionPath(id))
 	if err != nil {
 		return LockResult{}, err
 	}
 	return LockResult{Collection: id, Locked: c.Locked}, nil
 }
 // Key is one key the ssh agent holds.
 type Key struct {
 	Bits        int    `json:"bits"`
 	Fingerprint string `json:"fingerprint"`
 	Comment     string `json:"comment"`
 	Type        string `json:"type"`
 }
 // SSHKeysResult is what gnome_keyring_ssh_keys answers.
 type SSHKeysResult struct {
 	Agent string `json:"agent"`
 	Keys  []Key  `json:"keys"`
 	Note  string `json:"note,omitempty"`
 }
 // agentSocket is gcr's ssh agent socket, which its user socket unit listens on.
 func agentSocket(s Session) string { return filepath.Join(s.RuntimeDir, "gcr", "ssh") }
 var keyLine = regexp.MustCompile(`^(\d+)\s+(\S+)\s+(.*?)\s*\(([A-Z0-9-]+)\)$`)
 func parseKeys(out string) []Key {
 	keys := []Key{}
 	for _, line := range strings.Split(out, "\n") {
 		m := keyLine.FindStringSubmatch(strings.TrimSpace(line))
 		if m == nil {
 			continue
 		}
 		bits, _ := strconv.Atoi(m[1])
 		keys = append(keys, Key{Bits: bits, Fingerprint: m[2], Comment: m[3], Type: m[4]})
 	}
 	return keys
 }
 // SSHKeys lists what gcr's ssh agent holds, by fingerprint.
 func SSHKeys() (SSHKeysResult, error) {
 	s, err := findBus()
 	if err != nil {
 		return SSHKeysResult{}, err
 	}
 	sock := agentSocket(s)
 	// The agent is named for this one command only; nothing else of the tool's environment changes.
 	r, err := s.run(busTimeout, "", "env", "SSH_AUTH_SOCK="+sock, "ssh-add", "-l", "-E", "sha256")
 	if err != nil {
 		return SSHKeysResult{}, err
 	}
 	out := SSHKeysResult{Agent: sock, Keys: parseKeys(r.Stdout)}
 	switch r.Code {
 	case 0:
 	case 1:
 		out.Note = "the agent holds no keys"
 	case 127:
 		return SSHKeysResult{}, fmt.Errorf("ssh-add is not installed on this machine")
 	default:
 		return SSHKeysResult{}, fmt.Errorf("the ssh agent at %s does not answer: %s (is gcr-ssh-agent.socket enabled?)",
 			sock, strings.TrimSpace(r.Stderr))
 	}
 	return out, nil
 }
@@ -1,131 +0,0 @@
 package main
 import (
 	"errors"
 	"os"
 	"path/filepath"
 	"strconv"
 	"strings"
 	"testing"
 )
 const nobody = 4194400
 // secretService fakes busctl answering as gnome-keyring did on 2026-10-04: a session, a login and a
 // default keyring, the login one unlocked; Lock locks it.
 func secretService(t *testing.T) string {
 	t.Helper()
 	fakeMachine(t)
 	runtime := filepath.Join(runUserDir, strconv.Itoa(os.Getuid()))
 	if err := os.MkdirAll(runtime, 0o700); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.WriteFile(filepath.Join(runtime, "bus"), nil, 0o600); err != nil {
 		t.Fatal(err)
 	}
 	bin := fakeBinaries(t, map[string]string{"busctl": `echo "$*" >> "$LOG"
 locked=false; [ -f "$LOG.locked" ] && locked=true
 case "$*" in
  *"get-property org.freedesktop.secrets /org/freedesktop/secrets org.freedesktop.Secret.Service Collections")
    echo '{"type":"ao","data":["/org/freedesktop/secrets/collection/session","/org/freedesktop/secrets/collection/login","/org/freedesktop/secrets/collection/Default_5fkeyring"]}' ;;
  *"ReadAlias s default") echo '{"type":"o","data":["/org/freedesktop/secrets/collection/Default_5fkeyring"]}' ;;
  *"/collection/login org.freedesktop.DBus.Properties GetAll"*)
    echo '{"type":"a{sv}","data":[{"Items":{"type":"ao","data":["/x/1","/x/2"]},"Label":{"type":"s","data":"Login"},"Locked":{"type":"b","data":'$locked'},"Created":{"type":"t","data":1752488320},"Modified":{"type":"t","data":0}}]}' ;;
  *"/collection/"*"GetAll"*)
    echo '{"type":"a{sv}","data":[{"Items":{"type":"ao","data":[]},"Label":{"type":"s","data":"Other"},"Locked":{"type":"b","data":true},"Created":{"type":"t","data":0},"Modified":{"type":"t","data":0}}]}' ;;
  *"Lock ao 1 /org/freedesktop/secrets/collection/login") touch "$LOG.locked"; echo '{"type":"aoo","data":[["/org/freedesktop/secrets/collection/login"],"/"]}' ;;
  *) echo "no such call: $*" >&2; exit 1 ;;
 esac`})
 	t.Setenv("LOG", filepath.Join(bin, "log"))
 	return bin
 }
 func TestCollectionsAreNamesCountsAndLocksNeverItems(t *testing.T) {
 	bin := secretService(t)
 	got, err := Collections()
 	if err != nil {
 		t.Fatal(err)
 	}
 	if len(got.Collections) != 3 {
 		t.Fatalf("%+v", got)
 	}
 	var login, def Collection
 	for _, c := range got.Collections {
 		switch c.ID {
 		case "login":
 			login = c
 		case "Default_5fkeyring":
 			def = c
 		}
 	}
 	if login.Label != "Login" || login.Locked || login.Items != 2 || login.Created == "" || login.Modified != "" || login.Default {
 		t.Fatalf("login: %+v", login)
 	}
 	if !def.Default || !def.Locked {
 		t.Fatalf("default: %+v", def)
 	}
 	asked, _ := os.ReadFile(filepath.Join(bin, "log"))
 	if strings.Contains(string(asked), "GetSecret") || strings.Contains(string(asked), "Item") && strings.Contains(string(asked), "Secret.Item") {
 		t.Fatalf("a secret was asked for:\n%s", asked)
 	}
 }
 func TestUnlockedAnswersTheLoginAndTheDefaultKeyring(t *testing.T) {
 	secretService(t)
 	fakeProcess(t, nobody, "gnome-keyring-d")
 	got, err := Unlocked()
 	if err != nil || !got.Daemon || got.Login == nil || got.Login.Locked || got.Default == nil || !got.Default.Default {
 		t.Fatalf("%+v, %v", got, err)
 	}
 }
 func TestLockLocksTheLoginKeyringAndRefusesAPathForAnId(t *testing.T) {
 	secretService(t)
 	got, err := Lock("")
 	if err != nil || got.Collection != "login" || !got.Locked {
 		t.Fatalf("%+v, %v", got, err)
 	}
 	for _, bad := range []string{"../service", "login /org/x", "a b"} {
 		if _, err := Lock(bad); err == nil {
 			t.Errorf("%q was accepted", bad)
 		}
 	}
 }
 func TestTheAgentsKeysAreFingerprints(t *testing.T) {
 	keys := parseKeys("256 SHA256:x+LmFabc op@laptop (ED25519)\n3072 SHA256:yyy a comment with spaces (RSA)\nThe agent has no identities.\n")
 	if len(keys) != 2 || keys[0] != (Key{Bits: 256, Fingerprint: "SHA256:x+LmFabc", Comment: "op@laptop", Type: "ED25519"}) ||
 		keys[1].Comment != "a comment with spaces" || keys[1].Type != "RSA" {
 		t.Fatalf("%+v", keys)
 	}
 }
 func TestSSHKeysAsksGcrsAgentAndSaysWhenItDoesNotAnswer(t *testing.T) {
 	secretService(t)
 	bin := fakeBinaries(t, map[string]string{"ssh-add": `echo "$SSH_AUTH_SOCK $*" > "$LOG.ssh"; [ -f "$NOAGENT" ] && { echo "Could not open a connection" >&2; exit 2; }; echo "256 SHA256:abc op (ED25519)"`})
 	t.Setenv("NOAGENT", filepath.Join(bin, "noagent"))
 	got, err := SSHKeys()
 	if err != nil || len(got.Keys) != 1 || !strings.HasSuffix(got.Agent, "/gcr/ssh") {
 		t.Fatalf("%+v, %v", got, err)
 	}
 	asked, _ := os.ReadFile(os.Getenv("LOG") + ".ssh")
 	if !strings.HasSuffix(strings.TrimSpace(string(asked)), "/gcr/ssh -l -E sha256") {
 		t.Fatalf("asked: %s", asked)
 	}
 	if err := os.WriteFile(filepath.Join(bin, "noagent"), nil, 0o644); err != nil {
 		t.Fatal(err)
 	}
 	if _, err := SSHKeys(); err == nil || !strings.Contains(err.Error(), "gcr-ssh-agent.socket") {
 		t.Fatalf("no agent: %v", err)
 	}
 }
 func TestWithoutABusTheToolsSaySo(t *testing.T) {
 	fakeMachine(t)
 	if _, err := Collections(); !errors.Is(err, ErrNoBus) {
 		t.Fatal(err)
 	}
 	if _, err := SSHKeys(); !errors.Is(err, ErrNoBus) {
 		t.Fatal(err)
 	}
 }
@@ -1,57 +0,0 @@
 // gnome-keyring's Go tools bundle (novox/hq ADR 0188, ADR 0193, ADR 0208): the secret service's
 // tools, served by the node's runtime as the operator account. node-secret-service has no verbs yet
 // (ADR 0208 §2), so every tool here is the module's own. None of them ever reads a secret: they ask the
 // Secret Service for names, counts and lock states, and the ssh agent for fingerprints.
 package main
 import (
 	"fmt"
 	"os"
 	stdio "git.novox.be/novox/mesh-sdk/go"
 )
 func main() {
 	if err := stdio.Serve("", tools()); err != nil {
 		fmt.Fprintln(os.Stderr, err)
 		os.Exit(1)
 	}
 }
 func tools() []stdio.Tool {
 	return []stdio.Tool{
 		{
 			Name: "gnome_keyring_unlocked",
 			Description: "Is the operator's keyring unlocked: the login keyring and the default one, each locked " +
 				"or not, and whether the keyring daemon runs.",
 			Run: func(map[string]any) (any, error) { return Unlocked() },
 		},
 		{
 			Name: "gnome_keyring_lock",
 			Description: "Lock a keyring now (the login keyring unless another is named): programs must ask " +
 				"for its password again. Unlocking is the operator's, at their desktop.",
 			Input: map[string]any{
 				"collection": map[string]any{"type": "string", "description": "the keyring's id, as gnome_keyring_collections answers it (default login)"},
 			},
 			Run: func(args map[string]any) (any, error) {
 				c, err := text(args, "collection", false)
 				if err != nil {
 					return nil, err
 				}
 				return Lock(c)
 			},
 		},
 		{
 			Name: "gnome_keyring_collections",
 			Description: "The operator's keyrings: each one's id, label, whether it is locked, how many items it " +
 				"holds, when it was created and changed, and which is the default. Never an item, never a secret.",
 			Run: func(map[string]any) (any, error) { return Collections() },
 		},
 		{
 			Name: "gnome_keyring_ssh_keys",
 			Description: "The keys the session's ssh agent (gcr's) holds, by fingerprint, size, type and comment. " +
 				"Never a key.",
 			Run: func(map[string]any) (any, error) { return SSHKeys() },
 		},
 	}
 }
@@ -1,175 +0,0 @@
 package main
 import (
 	"encoding/json"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 )
 // The module's manifest, read the way the catalogue reads it, for the manifest tests. The same in
 // every desktop module that carries it.
 type manifest struct {
 	Module       string           `json:"module"`
 	Version      string           `json:"version"`
 	Capabilities []string         `json:"capabilities"`
 	Requires     []string         `json:"requires"`
 	Claims       []claim          `json:"claims"`
 	Seats        []any            `json:"seats"`
 	Tools        []string         `json:"tools"`
 	Environment  *environment     `json:"environment"`
 	Shell        []shellCode      `json:"shell"`
 	Resources    []map[string]any `json:"resources"`
 	Build        struct {
 		Artifacts []map[string]any `json:"artifacts"`
 	} `json:"build"`
 }
 type claim struct {
 	Name   string   `json:"name"`
 	Scope  string   `json:"scope"`
 	Serves []string `json:"serves"`
 }
 type environment struct {
 	Variables map[string]string `json:"variables"`
 	Path      []map[string]any  `json:"path"`
 }
 type shellCode struct {
 	For  string `json:"for"`
 	Slot string `json:"slot"`
 	Code string `json:"code"`
 }
 func readManifest(t *testing.T) manifest {
 	t.Helper()
 	raw, err := os.ReadFile(filepath.Join("..", "..", "module.json"))
 	if err != nil {
 		t.Fatal(err)
 	}
 	dec := json.NewDecoder(strings.NewReader(string(raw)))
 	dec.DisallowUnknownFields()
 	var m manifest
 	if err := dec.Decode(&m); err != nil {
 		t.Fatalf("module.json: %v", err)
 	}
 	return m
 }
 func (m manifest) resource(t *testing.T, id string) map[string]any {
 	t.Helper()
 	for _, r := range m.Resources {
 		if r["id"] == id {
 			return r
 		}
 	}
 	t.Fatalf("no resource %q", id)
 	return nil
 }
 func (m manifest) packages() (present, absent []string) {
 	for _, r := range m.Resources {
 		if r["type"] == "package" {
 			if r["absent"] == true {
 				absent = append(absent, r["package"].(string))
 			} else {
 				present = append(present, r["package"].(string))
 			}
 		}
 	}
 	return present, absent
 }
 // sameAsSource checks that a file resource's content is byte for byte the module's source file, so
 // the readable file in the repository is what the machine gets.
 func (m manifest) sameAsSource(t *testing.T, id, source string) {
 	t.Helper()
 	want, err := os.ReadFile(filepath.Join("..", "..", source))
 	if err != nil {
 		t.Fatal(err)
 	}
 	r := m.resource(t, id)
 	if r["type"] != "file" {
 		t.Fatalf("%s is a %v, not a file", id, r["type"])
 	}
 	if got, _ := r["content"].(string); got != string(want) {
 		t.Fatalf("resource %s's content is not %s: edit the source and copy it into module.json", id, source)
 	}
 	if r["owner"] != "${machine:account}" && !strings.HasPrefix(r["path"].(string), "/etc/") {
 		t.Fatalf("%s under the home is the account's", id)
 	}
 }
 // checkTheToolsAgree checks that the manifest lists the module's own tools exactly, that the bundle
 // serves each seat verb the claims promise as <seat>.<verb>, and that the Go bundle is declared.
 func checkTheToolsAgree(t *testing.T, m manifest) {
 	t.Helper()
 	own, seat := map[string]bool{}, map[string]bool{}
 	for _, tool := range tools() {
 		if strings.Contains(tool.Name, ".") {
 			seat[tool.Name] = true
 		} else {
 			own[tool.Name] = true
 		}
 		if strings.TrimSpace(tool.Description) == "" {
 			t.Errorf("%s has no description", tool.Name)
 		}
 	}
 	listed := map[string]bool{}
 	for _, name := range m.Tools {
 		listed[name] = true
 		if !own[name] {
 			t.Errorf("module.json lists %s, which the bundle does not serve", name)
 		}
 	}
 	for name := range own {
 		if !listed[name] {
 			t.Errorf("the bundle serves %s, which module.json does not list", name)
 		}
 		if !strings.HasPrefix(name, strings.ReplaceAll(m.Module, "-", "_")+"_") {
 			t.Errorf("%s is not prefixed with the module's name", name)
 		}
 	}
 	promised := map[string]bool{}
 	for _, c := range m.Claims {
 		for _, verb := range c.Serves {
 			promised[c.Name+"."+verb] = true
 			if !seat[c.Name+"."+verb] {
 				t.Errorf("the claim on %s promises %s, which the bundle does not serve", c.Name, verb)
 			}
 		}
 	}
 	for name := range seat {
 		if !promised[name] {
 			t.Errorf("the bundle serves %s, which no claim promises", name)
 		}
 	}
 	var bundle map[string]any
 	for _, a := range m.Build.Artifacts {
 		if a["kind"] == "bundle" {
 			bundle = a
 		}
 	}
 	if bundle == nil || bundle["language"] != "go" || bundle["system"] != "arch" ||
 		bundle["from"] != "cmd/"+m.Module+"-tools" || bundle["binary"] != m.Module+"-tools" {
 		t.Errorf("the Go tools bundle: %v", bundle)
 	}
 }
 // checkNoSecretsOrInstallationNames refuses what a catalogue manifest must never carry.
 func checkNoSecretsOrInstallationNames(t *testing.T) {
 	t.Helper()
 	raw, err := os.ReadFile(filepath.Join("..", "..", "module.json"))
 	if err != nil {
 		t.Fatal(err)
 	}
 	s := strings.ToLower(string(raw))
 	for _, never := range []string{"/home/", "jochen", "g14", "shanks", "novox.be", "api_key", ".hal/", "greenclip daemon"} {
 		if strings.Contains(s, never) {
 			t.Errorf("module.json names %q", never)
 		}
 	}
 }
@@ -1,64 +0,0 @@
 package main
 import (
 	"reflect"
 	"strings"
 	"testing"
 )
 // gnome-keyring's shape (novox/hq ADR 0208, ADR 0102): it claims node-secret-service, writes its PAM
 // lines into the login and passwd stacks as marked blocks (never over the files), and starts no daemon
 // of its own: PAM and D-Bus do.
 func TestItClaimsTheSecretServiceSeat(t *testing.T) {
 	m := readManifest(t)
 	if m.Module != "gnome-keyring" || m.Seats != nil || m.Requires != nil {
 		t.Fatalf("module %q, seats %v, requires %v", m.Module, m.Seats, m.Requires)
 	}
 	if !reflect.DeepEqual(m.Claims, []claim{{Name: "node-secret-service", Scope: "node"}}) {
 		t.Fatalf("claims: %+v", m.Claims)
 	}
 	if present, absent := m.packages(); !reflect.DeepEqual(present, []string{"gnome-keyring", "libsecret", "seahorse"}) || absent != nil {
 		t.Fatalf("packages: %v, absent %v", present, absent)
 	}
 }
 func TestThePAMLinesAreBlocksWrittenIntoTheStacks(t *testing.T) {
 	m := readManifest(t)
 	for id, want := range map[string]struct{ path, source string }{
 		"pam-login":  {"/etc/pam.d/login", "files/pam/login"},
 		"pam-passwd": {"/etc/pam.d/passwd", "files/pam/passwd"},
 	} {
 		m.sameAsSource(t, id, want.source)
 		r := m.resource(t, id)
 		if r["path"] != want.path || r["into"] != "block" || r["at"] != "end" || r["owner"] != nil {
 			t.Errorf("%s: %v", id, r)
 		}
 	}
 	login := m.resource(t, "pam-login")["content"].(string)
 	if !strings.Contains(login, "\nauth       optional     pam_gnome_keyring.so\n") ||
 		!strings.Contains(login, "\nsession    optional     pam_gnome_keyring.so auto_start\n") {
 		t.Fatalf("%s", login)
 	}
 }
 func TestItStartsNoDaemonAndOnlyNamesTheAgentsSocket(t *testing.T) {
 	m := readManifest(t)
 	if len(m.Shell) != 1 || m.Shell[0].For != "xinitrc" || m.Shell[0].Slot != "first" {
 		t.Fatalf("%+v", m.Shell)
 	}
 	code := m.Shell[0].Code
 	if strings.Contains(code, "gnome-keyring-daemon") || strings.Contains(code, "--unlock") ||
 		!strings.Contains(code, `SSH_AUTH_SOCK="${XDG_RUNTIME_DIR:-/run/user/$(id -u)}/gcr/ssh"`) {
 		t.Fatalf("%q", code)
 	}
 	if m.Environment != nil {
 		t.Fatal("SSH_AUTH_SOCK needs the runtime directory, which ADR 0203 forbids in a value; it is not an environment contribution yet")
 	}
 }
 func TestTheToolsAgreeWithTheManifest(t *testing.T) {
 	m := readManifest(t)
 	checkTheToolsAgree(t, m)
 	checkNoSecretsOrInstallationNames(t)
 }
@@ -1,423 +0,0 @@
 // The operator's graphical session, as a tool the node's runtime runs finds it (novox/hq ADR 0208).
 //
 // The runtime is a system service running as the operator account (ADR 0175): it has the account's
 // uid and none of the session's environment — no DISPLAY, no XAUTHORITY, no session bus. A tool that
 // draws on the screen or talks to the desktop's D-Bus must find them. It reads them from a process of
 // the account that is part of the session (the window manager first), the same thing `loginctl` and
 // a person's own shell would point at, and says where it found them.
 //
 // Long-lived programs a tool starts go to the account's own service manager through `systemd-run
 // --user`, never as children of the tool: the runtime's unit is a cgroup the service manager empties
 // whenever the runtime restarts, and a compositor or a clipboard owner started from inside it would
 // die with it.
 //
 // This file is the same in every desktop module that carries it; it moves into the Go SDK once a
 // second consumer outside the desktop wants it.
 package main
 import (
 	"bytes"
 	"errors"
 	"fmt"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"sort"
 	"strconv"
 	"strings"
 	"syscall"
 	"time"
 )
 // Where the session is looked for. Variables so a test can point them at a fake tree.
 var (
 	procRoot   = "/proc"
 	runUserDir = "/run/user"
 	x11Sockets = "/tmp/.X11-unix"
 )
 // sessionHolders are the processes whose environment is the session's, best first: the window
 // manager is the session, the rest are its children. Anything else carrying DISPLAY ranks after them.
 var sessionHolders = []string{"i3", "sway", "i3bar", "picom", "xss-lock", "dunst", "clipmenud", "xterm"}
 // sessionKeys are the variables a session carries that a tool hands on to what it runs.
 var sessionKeys = []string{"DISPLAY", "XAUTHORITY", "WAYLAND_DISPLAY", "DBUS_SESSION_BUS_ADDRESS",
 	"XDG_RUNTIME_DIR", "XDG_SESSION_ID", "I3SOCK"}
 // Session is what a tool needs to reach the operator's desktop.
 type Session struct {
 	UID        int    `json:"uid"`
 	Display    string `json:"display,omitempty"`
 	XAuthority string `json:"xauthority,omitempty"`
 	Wayland    string `json:"wayland_display,omitempty"`
 	Bus        string `json:"bus,omitempty"`
 	RuntimeDir string `json:"runtime_dir,omitempty"`
 	SessionID  string `json:"session_id,omitempty"`
 	I3Sock     string `json:"i3sock,omitempty"`
 	// From says where the values were found: the tool's own environment, a process, or the socket.
 	From string `json:"from"`
 }
 // ErrNoSession is answered by a tool that needs the desktop when nobody is logged in to it.
 var ErrNoSession = errors.New("no graphical session")
 // ErrTimedOut is what run answers for a command ended because it ran past its time.
 var ErrTimedOut = errors.New("timed out")
 // ErrNoBus is answered by a tool that needs the session bus when the account has none.
 var ErrNoBus = errors.New("no session bus")
 // operatorHome is the account's home: what the runtime was told, else the process's own.
 func operatorHome() string {
 	if h := strings.TrimSpace(os.Getenv("MESH_OPERATOR_HOME")); h != "" {
 		return h
 	}
 	h, _ := os.UserHomeDir()
 	return h
 }
 // findSession finds the graphical session of the account this tool runs as, or answers
 // ErrNoSession with what it looked at.
 func findSession() (Session, error) {
 	s := findEnvironment()
 	if s.Display == "" && s.Wayland == "" {
 		return s, fmt.Errorf("%w for uid %d on this machine: no process of the account carries DISPLAY "+
 			"or WAYLAND_DISPLAY, and no X server socket in %s has an authority file to go with it. "+
 			"Is anyone logged in to the desktop?", ErrNoSession, s.UID, x11Sockets)
 	}
 	return s, nil
 }
 // findBus finds the account's session bus, which a logged-in account has whether or not a desktop
 // is running.
 func findBus() (Session, error) {
 	s := findEnvironment()
 	if s.Bus == "" {
 		return s, fmt.Errorf("%w for uid %d: DBUS_SESSION_BUS_ADDRESS is not set and %s does not exist "+
 			"(the account is not logged in)", ErrNoBus, s.UID, filepath.Join(runUserDir, strconv.Itoa(s.UID), "bus"))
 	}
 	return s, nil
 }
 func findEnvironment() Session {
 	uid := os.Getuid()
 	s := Session{UID: uid}
 	own := map[string]string{}
 	for _, k := range sessionKeys {
 		own[k] = os.Getenv(k)
 	}
 	if own["DISPLAY"] != "" || own["WAYLAND_DISPLAY"] != "" {
 		s.fill(own)
 		s.From = "the tool's own environment"
 	} else if pid, comm, env, ok := sessionProcess(uid); ok {
 		s.fill(env)
 		s.From = fmt.Sprintf("process %s (pid %d)", comm, pid)
 	} else if display, ok := lonelyX11Socket(); ok {
 		if a := filepath.Join(operatorHome(), ".Xauthority"); exists(a) {
 			s.Display, s.XAuthority = display, a
 			s.From = "the X server socket and the account's ~/.Xauthority"
 		}
 		s.fill(own)
 	} else {
 		s.fill(own)
 		s.From = "nothing: no session found"
 	}
 	// The bus and the runtime directory are the account's, whether or not the process named them.
 	runtime := filepath.Join(runUserDir, strconv.Itoa(uid))
 	if s.RuntimeDir == "" && exists(runtime) {
 		s.RuntimeDir = runtime
 	}
 	if s.Bus == "" && s.RuntimeDir != "" && exists(filepath.Join(s.RuntimeDir, "bus")) {
 		s.Bus = "unix:path=" + filepath.Join(s.RuntimeDir, "bus")
 	}
 	return s
 }
 func (s *Session) fill(env map[string]string) {
 	set := func(dst *string, key string) {
 		if *dst == "" {
 			*dst = env[key]
 		}
 	}
 	set(&s.Display, "DISPLAY")
 	set(&s.XAuthority, "XAUTHORITY")
 	set(&s.Wayland, "WAYLAND_DISPLAY")
 	set(&s.Bus, "DBUS_SESSION_BUS_ADDRESS")
 	set(&s.RuntimeDir, "XDG_RUNTIME_DIR")
 	set(&s.SessionID, "XDG_SESSION_ID")
 	set(&s.I3Sock, "I3SOCK")
 }
 // sessionProcess is the best process of this uid whose environment names a display.
 func sessionProcess(uid int) (int, string, map[string]string, bool) {
 	entries, err := os.ReadDir(procRoot)
 	if err != nil {
 		return 0, "", nil, false
 	}
 	type candidate struct {
 		pid  int
 		comm string
 		env  map[string]string
 		rank int
 	}
 	var found []candidate
 	for _, e := range entries {
 		pid, err := strconv.Atoi(e.Name())
 		if err != nil {
 			continue
 		}
 		dir := filepath.Join(procRoot, e.Name())
 		if owner, ok := ownerOf(dir); !ok || owner != uid {
 			continue
 		}
 		raw, err := os.ReadFile(filepath.Join(dir, "environ"))
 		if err != nil {
 			continue
 		}
 		env := parseEnviron(raw)
 		if env["DISPLAY"] == "" && env["WAYLAND_DISPLAY"] == "" {
 			continue
 		}
 		comm := readTrimmed(filepath.Join(dir, "comm"))
 		rank := len(sessionHolders)
 		for i, h := range sessionHolders {
 			if h == comm {
 				rank = i
 				break
 			}
 		}
 		found = append(found, candidate{pid, comm, env, rank})
 	}
 	if len(found) == 0 {
 		return 0, "", nil, false
 	}
 	sort.Slice(found, func(i, j int) bool {
 		if found[i].rank != found[j].rank {
 			return found[i].rank < found[j].rank
 		}
 		return found[i].pid > found[j].pid // the newer of two equals
 	})
 	best := found[0]
 	return best.pid, best.comm, best.env, true
 }
 func parseEnviron(raw []byte) map[string]string {
 	env := map[string]string{}
 	for _, kv := range bytes.Split(raw, []byte{0}) {
 		if i := bytes.IndexByte(kv, '='); i > 0 {
 			env[string(kv[:i])] = string(kv[i+1:])
 		}
 	}
 	return env
 }
 func ownerOf(path string) (int, bool) {
 	info, err := os.Stat(path)
 	if err != nil {
 		return 0, false
 	}
 	st, ok := info.Sys().(*syscall.Stat_t)
 	if !ok {
 		return 0, false
 	}
 	return int(st.Uid), true
 }
 // lonelyX11Socket is the display of the one X server socket there is, when there is exactly one.
 func lonelyX11Socket() (string, bool) {
 	entries, err := os.ReadDir(x11Sockets)
 	if err != nil {
 		return "", false
 	}
 	var displays []string
 	for _, e := range entries {
 		if n := strings.TrimPrefix(e.Name(), "X"); n != e.Name() {
 			if _, err := strconv.Atoi(n); err == nil {
 				displays = append(displays, ":"+n)
 			}
 		}
 	}
 	if len(displays) != 1 {
 		return "", false
 	}
 	return displays[0], true
 }
 func readTrimmed(path string) string {
 	b, err := os.ReadFile(path)
 	if err != nil {
 		return ""
 	}
 	return strings.TrimSpace(string(b))
 }
 func exists(path string) bool {
 	_, err := os.Stat(path)
 	return err == nil
 }
 // Env is this process's environment with the session's variables in place of its own.
 func (s Session) Env() []string {
 	drop := map[string]bool{}
 	for _, k := range sessionKeys {
 		drop[k] = true
 	}
 	var env []string
 	for _, kv := range os.Environ() {
 		if i := strings.IndexByte(kv, '='); i > 0 && drop[kv[:i]] {
 			continue
 		}
 		env = append(env, kv)
 	}
 	add := func(k, v string) {
 		if v != "" {
 			env = append(env, k+"="+v)
 		}
 	}
 	add("DISPLAY", s.Display)
 	add("XAUTHORITY", s.XAuthority)
 	add("WAYLAND_DISPLAY", s.Wayland)
 	add("DBUS_SESSION_BUS_ADDRESS", s.Bus)
 	add("XDG_RUNTIME_DIR", s.RuntimeDir)
 	add("XDG_SESSION_ID", s.SessionID)
 	add("I3SOCK", s.I3Sock)
 	return env
 }
 // mostOutput bounds what a command may answer with, per stream.
 const mostOutput = 256 << 10
 // Result is what a command did.
 type Result struct {
 	Stdout    string `json:"stdout"`
 	Stderr    string `json:"stderr,omitempty"`
 	Code      int    `json:"code"`
 	Truncated bool   `json:"truncated,omitempty"`
 }
 // run runs a command in the session's environment, its input given, ended with everything it
 // started after timeout. A command that is not installed is an error naming it; one that exits
 // non-zero is a Result with its code, for the caller to judge.
 func (s Session) run(timeout time.Duration, stdin string, name string, args ...string) (Result, error) {
 	path, err := exec.LookPath(name)
 	if err != nil {
 		return Result{}, fmt.Errorf("%s is not installed on this machine", name)
 	}
 	cmd := exec.Command(path, args...)
 	cmd.Env = s.Env()
 	if home := operatorHome(); exists(home) {
 		cmd.Dir = home
 	}
 	if stdin != "" {
 		cmd.Stdin = strings.NewReader(stdin)
 	}
 	var out, errOut capped
 	cmd.Stdout, cmd.Stderr = &out, &errOut
 	cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
 	if err := cmd.Start(); err != nil {
 		return Result{}, fmt.Errorf("%s: %w", name, err)
 	}
 	done := make(chan error, 1)
 	go func() { done <- cmd.Wait() }()
 	select {
 	case err = <-done:
 	case <-time.After(timeout):
 		_ = syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL)
 		<-done
 		return Result{Stdout: out.String(), Stderr: errOut.String()},
 			fmt.Errorf("%s did not finish within %s and was ended: %w", name, timeout, ErrTimedOut)
 	}
 	r := Result{Stdout: out.String(), Stderr: errOut.String(), Truncated: out.cut || errOut.cut}
 	var exit *exec.ExitError
 	if errors.As(err, &exit) {
 		r.Code = exit.ExitCode()
 	} else if err != nil {
 		return r, fmt.Errorf("%s: %w", name, err)
 	}
 	return r, nil
 }
 // detach starts a long-lived program under the account's own service manager, as a transient unit
 // that carries the session's display, so it outlives the runtime that asked for it. A unit already
 // running under the same name is stopped first, so a fixed name means "at most one".
 func (s Session) detach(unit string, args ...string) error {
 	if s.RuntimeDir == "" {
 		return fmt.Errorf("%w: the account's runtime directory is missing, so its service manager "+
 			"cannot be reached", ErrNoBus)
 	}
 	_, _ = s.run(5*time.Second, "", "systemctl", "--user", "stop", unit+".service")
 	call := []string{"--user", "--collect", "--quiet", "--unit=" + unit}
 	for _, kv := range [][2]string{{"DISPLAY", s.Display}, {"XAUTHORITY", s.XAuthority},
 		{"WAYLAND_DISPLAY", s.Wayland}, {"XDG_SESSION_ID", s.SessionID}, {"I3SOCK", s.I3Sock}} {
 		if kv[1] != "" {
 			call = append(call, "--setenv="+kv[0]+"="+kv[1])
 		}
 	}
 	call = append(call, "--")
 	call = append(call, args...)
 	r, err := s.run(10*time.Second, "", "systemd-run", call...)
 	if err != nil {
 		return err
 	}
 	if r.Code != 0 {
 		return fmt.Errorf("systemd-run %s: %s", unit, strings.TrimSpace(r.Stderr))
 	}
 	return nil
 }
 // uniqueUnit is a transient unit name that will not collide with an earlier one.
 func uniqueUnit(prefix string) string {
 	return fmt.Sprintf("%s-%d", prefix, time.Now().UnixNano())
 }
 type capped struct {
 	bytes.Buffer
 	cut bool
 }
 func (c *capped) Write(p []byte) (int, error) {
 	if room := mostOutput - c.Len(); room < len(p) {
 		if room > 0 {
 			c.Buffer.Write(p[:room])
 		}
 		c.cut = true
 		return len(p), nil
 	}
 	return c.Buffer.Write(p)
 }
 // processesOf are the pids of this uid's processes whose command name is comm, oldest first.
 func processesOf(comm string) []int {
 	entries, err := os.ReadDir(procRoot)
 	if err != nil {
 		return nil
 	}
 	uid := os.Getuid()
 	var pids []int
 	for _, e := range entries {
 		pid, err := strconv.Atoi(e.Name())
 		if err != nil {
 			continue
 		}
 		dir := filepath.Join(procRoot, e.Name())
 		if owner, ok := ownerOf(dir); !ok || owner != uid {
 			continue
 		}
 		if readTrimmed(filepath.Join(dir, "comm")) == comm {
 			pids = append(pids, pid)
 		}
 	}
 	sort.Ints(pids)
 	return pids
 }
 // signalAll sends sig to every process of this uid named comm, and answers the pids it reached.
 func signalAll(comm string, sig syscall.Signal) []int {
 	var reached []int
 	for _, pid := range processesOf(comm) {
 		if syscall.Kill(pid, sig) == nil {
 			reached = append(reached, pid)
 		}
 	}
 	return reached
 }
@@ -1,174 +0,0 @@
 package main
 import (
 	"errors"
 	"os"
 	"path/filepath"
 	"strconv"
 	"strings"
 	"testing"
 	"time"
 )
 // fakeMachine points the session finder at a temporary /proc, /run/user and X socket directory, with
 // none of the test process's own session variables, and gives back the root.
 func fakeMachine(t *testing.T) string {
 	t.Helper()
 	root := t.TempDir()
 	procRoot, runUserDir, x11Sockets = filepath.Join(root, "proc"), filepath.Join(root, "run-user"), filepath.Join(root, "x11")
 	for _, d := range []string{procRoot, runUserDir, x11Sockets} {
 		if err := os.MkdirAll(d, 0o755); err != nil {
 			t.Fatal(err)
 		}
 	}
 	for _, k := range sessionKeys {
 		t.Setenv(k, "")
 	}
 	t.Setenv("MESH_OPERATOR_HOME", filepath.Join(root, "home"))
 	t.Cleanup(func() { procRoot, runUserDir, x11Sockets = "/proc", "/run/user", "/tmp/.X11-unix" })
 	return root
 }
 func fakeProcess(t *testing.T, pid int, comm string, env ...string) {
 	t.Helper()
 	dir := filepath.Join(procRoot, strconv.Itoa(pid))
 	if err := os.MkdirAll(dir, 0o755); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.WriteFile(filepath.Join(dir, "comm"), []byte(comm+"\n"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.WriteFile(filepath.Join(dir, "environ"), []byte(strings.Join(env, "\x00")+"\x00"), 0o600); err != nil {
 		t.Fatal(err)
 	}
 }
 func TestTheSessionIsReadFromTheWindowManagerBeforeAnyOtherProcess(t *testing.T) {
 	fakeMachine(t)
 	fakeProcess(t, 900, "xterm", "DISPLAY=:9", "XAUTHORITY=/elsewhere")
 	fakeProcess(t, 100, "i3", "DISPLAY=:1", "XAUTHORITY=/home/op/.Xauthority",
 		"DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus", "XDG_SESSION_ID=3", "SECRET_TOKEN=never-copied")
 	fakeProcess(t, 50, "bash", "PATH=/usr/bin")
 	s, err := findSession()
 	if err != nil {
 		t.Fatal(err)
 	}
 	if s.Display != ":1" || s.XAuthority != "/home/op/.Xauthority" || s.SessionID != "3" || !strings.Contains(s.From, "i3 (pid 100)") {
 		t.Fatalf("the window manager's environment: %+v", s)
 	}
 	for _, kv := range s.Env() {
 		if strings.HasPrefix(kv, "SECRET_TOKEN=") {
 			t.Fatal("a variable of the session process that is not a session variable was handed on")
 		}
 	}
 }
 func TestAnyProcessCarryingADisplayServesWhenTheWindowManagerIsNotFound(t *testing.T) {
 	fakeMachine(t)
 	fakeProcess(t, 10, "firefox", "DISPLAY=:0")
 	fakeProcess(t, 20, "firefox", "DISPLAY=:2")
 	s, err := findSession()
 	if err != nil || s.Display != ":2" {
 		t.Fatalf("the newest of two equals: %+v, %v", s, err)
 	}
 }
 func TestNoSessionIsAClearAnswerNotAGuess(t *testing.T) {
 	fakeMachine(t)
 	fakeProcess(t, 10, "sshd", "PATH=/usr/bin")
 	_, err := findSession()
 	if !errors.Is(err, ErrNoSession) || !strings.Contains(err.Error(), "logged in to the desktop") {
 		t.Fatalf("no session: %v", err)
 	}
 }
 func TestOneXSocketAndTheAccountsAuthorityFileAreASession(t *testing.T) {
 	root := fakeMachine(t)
 	if err := os.WriteFile(filepath.Join(x11Sockets, "X0"), nil, 0o644); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.MkdirAll(filepath.Join(root, "home"), 0o755); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.WriteFile(filepath.Join(root, "home", ".Xauthority"), nil, 0o600); err != nil {
 		t.Fatal(err)
 	}
 	s, err := findSession()
 	if err != nil || s.Display != ":0" || !strings.HasSuffix(s.XAuthority, "/home/.Xauthority") {
 		t.Fatalf("socket and authority: %+v, %v", s, err)
 	}
 }
 func TestTheBusIsTheAccountsRuntimeDirectoryWhenNoProcessNamesIt(t *testing.T) {
 	fakeMachine(t)
 	runtime := filepath.Join(runUserDir, strconv.Itoa(os.Getuid()))
 	if _, err := findBus(); !errors.Is(err, ErrNoBus) {
 		t.Fatalf("no runtime directory is no bus: %v", err)
 	}
 	if err := os.MkdirAll(runtime, 0o700); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.WriteFile(filepath.Join(runtime, "bus"), nil, 0o600); err != nil {
 		t.Fatal(err)
 	}
 	s, err := findBus()
 	if err != nil || s.Bus != "unix:path="+filepath.Join(runtime, "bus") || s.RuntimeDir != runtime {
 		t.Fatalf("bus: %+v, %v", s, err)
 	}
 	env := strings.Join(s.Env(), "\n")
 	if !strings.Contains(env, "XDG_RUNTIME_DIR="+runtime) || !strings.Contains(env, "DBUS_SESSION_BUS_ADDRESS=unix:path=") {
 		t.Fatalf("the bus is handed on: %s", env)
 	}
 }
 func TestACommandIsBoundedAndANonZeroExitIsAResult(t *testing.T) {
 	fakeMachine(t)
 	s := Session{}
 	r, err := s.run(5*time.Second, "in", "sh", "-c", "cat; echo err >&2; exit 3")
 	if err != nil || r.Stdout != "in" || r.Code != 3 || strings.TrimSpace(r.Stderr) != "err" {
 		t.Fatalf("result: %+v, %v", r, err)
 	}
 	start := time.Now()
 	if _, err := s.run(200*time.Millisecond, "", "sh", "-c", "sleep 30 & sleep 30"); err == nil || time.Since(start) > 5*time.Second {
 		t.Fatalf("a command past its time is ended with what it started: %v after %s", err, time.Since(start))
 	}
 	if _, err := s.run(time.Second, "", "no-such-program-here"); err == nil || !strings.Contains(err.Error(), "not installed") {
 		t.Fatalf("a missing program: %v", err)
 	}
 }
 func TestDetachAsksTheAccountsServiceManagerWithTheSessionsDisplay(t *testing.T) {
 	fakeMachine(t)
 	bin := fakeBinaries(t, map[string]string{
 		"systemctl":   `echo "systemctl $*" >> "$LOG"`,
 		"systemd-run": `echo "systemd-run $*" >> "$LOG"`,
 	})
 	log := filepath.Join(bin, "log")
 	t.Setenv("LOG", log)
 	s := Session{Display: ":1", XAuthority: "/x", RuntimeDir: "/run/user/1"}
 	if err := s.detach("picom-session", "picom", "--config", "/c"); err != nil {
 		t.Fatal(err)
 	}
 	got, _ := os.ReadFile(log)
 	want := "systemctl --user stop picom-session.service\n" +
 		"systemd-run --user --collect --quiet --unit=picom-session --setenv=DISPLAY=:1 --setenv=XAUTHORITY=/x -- picom --config /c\n"
 	if string(got) != want {
 		t.Fatalf("detach ran:\n%s\nwant:\n%s", got, want)
 	}
 	if err := (Session{}).detach("x", "y"); !errors.Is(err, ErrNoBus) {
 		t.Fatalf("no runtime directory: %v", err)
 	}
 }
 // fakeBinaries puts shell scripts named for programs first on PATH, and answers their directory.
 func fakeBinaries(t *testing.T, scripts map[string]string) string {
 	t.Helper()
 	dir := t.TempDir()
 	for name, body := range scripts {
 		if err := os.WriteFile(filepath.Join(dir, name), []byte("#!/bin/sh\n"+body+"\n"), 0o755); err != nil {
 			t.Fatal(err)
 		}
 	}
 	t.Setenv("PATH", dir+string(os.PathListSeparator)+os.Getenv("PATH"))
 	return dir
 }
@@ -1,4 +0,0 @@
 # The login keyring (module gnome-keyring, novox/hq ADR 0208, ADR 0102): the password typed at the
 # login screen unlocks the keyring, and the login session starts the keyring daemon with it.
 auth       optional     pam_gnome_keyring.so
 session    optional     pam_gnome_keyring.so auto_start
@@ -1,3 +0,0 @@
 # The login keyring (module gnome-keyring, novox/hq ADR 0208, ADR 0102): changing the account's
 # password changes the login keyring's with it, so the next login still unlocks it.
 password   optional     pam_gnome_keyring.so
@@ -1,5 +0,0 @@
 module gnomekeyring
 go 1.22
 require git.novox.be/novox/mesh-sdk/go v0.1.7
@@ -1,2 +0,0 @@
 git.novox.be/novox/mesh-sdk/go v0.1.7 h1:C0sTQmtTiyYH7bnqZb7PusXnqA37gKuT7Nqjn9gG47w=
 git.novox.be/novox/mesh-sdk/go v0.1.7/go.mod h1:GFuZUElBZ9A++mxgIKo97aXXo+kV0uJ/UkbhQPPIbrY=
@@ -1,76 +0,0 @@
 {
  "module": "gnome-keyring",
  "version": "1",
  "capabilities": [
    "package-manager"
  ],
  "claims": [
    {
      "name": "node-secret-service",
      "scope": "node"
    }
  ],
  "tools": [
    "gnome_keyring_unlocked",
    "gnome_keyring_lock",
    "gnome_keyring_collections",
    "gnome_keyring_ssh_keys"
  ],
  "shell": [
    {
      "for": "xinitrc",
      "slot": "first",
      "code": "# The ssh agent (module gnome-keyring, novox/hq ADR 0208): gcr's, which the account's service manager\n# starts on first use from its socket. Named here, for the session and every terminal it starts, until\n# the account's environment can say a path under the runtime directory (see the module's README).\nSSH_AUTH_SOCK=\"${XDG_RUNTIME_DIR:-/run/user/$(id -u)}/gcr/ssh\"\nexport SSH_AUTH_SOCK\n"
    }
  ],
  "resources": [
    {
      "id": "package",
      "type": "package",
      "package": "gnome-keyring"
    },
    {
      "id": "library",
      "type": "package",
      "package": "libsecret"
    },
    {
      "id": "manager",
      "type": "package",
      "package": "seahorse"
    },
    {
      "id": "pam-login",
      "type": "file",
      "path": "/etc/pam.d/login",
      "mode": "0644",
      "into": "block",
      "at": "end",
      "content": "# The login keyring (module gnome-keyring, novox/hq ADR 0208, ADR 0102): the password typed at the\n# login screen unlocks the keyring, and the login session starts the keyring daemon with it.\nauth       optional     pam_gnome_keyring.so\nsession    optional     pam_gnome_keyring.so auto_start\n"
    },
    {
      "id": "pam-passwd",
      "type": "file",
      "path": "/etc/pam.d/passwd",
      "mode": "0644",
      "into": "block",
      "at": "end",
      "content": "# The login keyring (module gnome-keyring, novox/hq ADR 0208, ADR 0102): changing the account's\n# password changes the login keyring's with it, so the next login still unlocks it.\npassword   optional     pam_gnome_keyring.so\n"
    }
  ],
  "build": {
    "artifacts": [
      {
        "name": "tools",
        "kind": "bundle",
        "language": "go",
        "system": "arch",
        "from": "cmd/gnome-keyring-tools",
        "binary": "gnome-keyring-tools",
        "loads": [
          "gnome-keyring-tools"
        ]
      }
    ]
  }
 }
@@ -1,86 +0,0 @@
 # i3status-rust
 The bars as a module (novox/hq ADR 0208, research 026/05).
 - Installs `i3status-rust`, and `pacman-contrib` for `checkupdates`, which the update block uses.
  Claims the mesh's `node-bar` seat (no verbs yet, ADR 0208 §2). Requires `x11-display` on its own
  machine: its bars are i3bar's.
 - Owns `~/.config/i3status-rust/`, both bars (`top-bar.toml`, `bottom-bar.toml`) and their icon set
  (`icons/custom-icons.toml`).
 - Places the two `bar { }` blocks as its own i3 drop-in, `~/.config/i3/config.d/60-i3status-rust.conf`:
  - the bottom bar shows the machine;
  - the top bar shows the focused window and the tray, on the primary output.
 - Places two programs in `~/.local/bin`:
  - `i3status-updates`, the pending-updates block;
  - `i3bar-watchdog`, which brings back a bar that died.
 - Starts the watchdog once per session, from the session's start (the `xinitrc` slot `normal`). It ends
  with the session's own process.
 ## Tools
 | tool | does |
 |---|---|
 | `i3status_rust_reload` | the running bars re-read their files (i3status-rs restarts in place) |
 | `i3status_rust_blocks` | each bar's blocks in order, kind and settings, and what each shows now (one run of the bar) |
 | `i3status_rust_block_run` | one block alone, with the bar's theme and icons, to see what it shows or why it errors |
 | `i3status_rust_themes` | the themes on the machine and the one each bar uses |
 ## The battery, and what else was left out
 A bar block that follows one machine's hardware is that machine model's hardware module's (ADR 0208
 §1), so the bottom bar here has none:
 - **the battery,** which only the laptop has;
 - **the GPU,** which was the laptop's AMD block, commented out for NVIDIA on the desktop;
 - **three Bluetooth headsets** by hardware address: one person's devices, not the bar's.
 i3status-rust reads no drop-in directory, and ADR 0208's slots cover `xinitrc` and `xresources` only,
 so a hardware module has no way into this file yet. Two ways forward, for the operator to choose:
 1. **Give the bar a slot.** A `shell`-style contribution `for: i3status-rust` would let the laptop's
   hardware module add its battery block. That is a decision record of its own, extending ADR 0208 §4.
 2. **Blocks that show only where they apply.** i3status-rust's common `if_command` option (for
   example `test -d /sys/class/power_supply/BAT0`) hides a block on a machine without the hardware.
   That is "say it by what is there" (ADR 0112), but the knowledge stays in the bar.
 Until one of them is chosen, **the laptop's bar shows no battery** once this module is assigned.
 ## What it improves on what was found
 - **The weather needs no key.** The found block used a weather service with an API key written in
  plain text in the file, and a fixed city. It now uses the Norwegian Meteorological Institute, which
  needs no key, located automatically.
 - **The update count is the module's own,** adopted from the operator's `~/scripts/pkg-updates`. It
  counts AUR updates only where an AUR helper is installed. Clicking it lists the updates in the
  launcher's menu, instead of a theme from a cloned theme repository.
 - **The faces** are JetBrains Mono Nerd Font, not Hack.
 - **The watchdog is no longer a hand-enabled user unit** that ran on one workstation and not the
  other. It runs on both, once per session, and ends with the session.
 - The docker block's click, which ran a program installed on neither machine, is gone.
 ## What it leaves as found
 - `~/.config/i3status-rust/scripts/` (a mouse battery script for one device).
 - `~/scripts/pkg-updates` and `~/scripts/i3-bar-watchdog`, replaced here.
 - The user unit `~/.config/systemd/user/i3-bar-watchdog.service` and its enablement link.
 ## Migration (ADR 0182)
 1. **Revoke the weather API key** that was in the found `bottom-bar.toml`. It sat in plain text on
   both workstations. The first push keeps the found file once and then writes the module's, which
   has no key.
 2. Before the first push, on the laptop: `systemctl --user disable --now i3-bar-watchdog.service`.
   Otherwise two watchdogs run. Then delete the unit file, `~/scripts/i3-bar-watchdog` and
   `~/scripts/pkg-updates`.
 3. Until the `i3` module carries the main configuration, the found `~/.config/i3/config` still has its
   own two `bar { }` blocks, and i3 shows four bars. The `i3` module's configuration has none.
 ## Blockers
 - `node-bar`, `x11-display` and the `xinitrc` slot are ADR 0208's. Until the controller knows them,
  `mctl` reads them as unknown.
 - The battery block waits for one of the two ways above.
 - The watchdog would be a user unit once user-scoped units ship (mesh-host #72). It is not, because it
  runs per session and ends with the session, as a session-start line already does.
 - `pacman-contrib` is declared here. A future `pacman` module that wants `checkupdates` or `paccache`
  takes it over, since a package is declared once per node.
@@ -1,97 +0,0 @@
 // Reading a tool's arguments: JSON numbers arrive as float64, and a missing argument is its default.
 // The same in every desktop module that carries it.
 package main
 import (
 	"fmt"
 	"math"
 	"strings"
 	"time"
 )
 // text is a string argument, trimmed; required says an empty one is refused.
 func text(args map[string]any, key string, required bool) (string, error) {
 	v, present := args[key]
 	if !present || v == nil {
 		if required {
 			return "", fmt.Errorf("%s is required", key)
 		}
 		return "", nil
 	}
 	s, ok := v.(string)
 	if !ok {
 		return "", fmt.Errorf("%s is a string, not %T", key, v)
 	}
 	s = strings.TrimSpace(s)
 	if s == "" && required {
 		return "", fmt.Errorf("%s is required", key)
 	}
 	return s, nil
 }
 // whole is a whole-number argument within [least, most], or def when absent.
 func whole(args map[string]any, key string, def, least, most int) (int, error) {
 	v, present := args[key]
 	if !present || v == nil {
 		return def, nil
 	}
 	f, ok := v.(float64)
 	if !ok {
 		if i, isInt := v.(int); isInt {
 			f = float64(i)
 		} else {
 			return 0, fmt.Errorf("%s is a number, not %T", key, v)
 		}
 	}
 	if f != math.Trunc(f) {
 		return 0, fmt.Errorf("%s is a whole number, not %v", key, f)
 	}
 	n := int(f)
 	if n < least || n > most {
 		return 0, fmt.Errorf("%s is %d; it is between %d and %d", key, n, least, most)
 	}
 	return n, nil
 }
 // flag is a boolean argument, or def when absent.
 func flag(args map[string]any, key string, def bool) (bool, error) {
 	v, present := args[key]
 	if !present || v == nil {
 		return def, nil
 	}
 	b, ok := v.(bool)
 	if !ok {
 		return false, fmt.Errorf("%s is true or false, not %T", key, v)
 	}
 	return b, nil
 }
 // texts is a list-of-strings argument.
 func texts(args map[string]any, key string) ([]string, error) {
 	v, present := args[key]
 	if !present || v == nil {
 		return nil, nil
 	}
 	list, ok := v.([]any)
 	if !ok {
 		if ss, isStrings := v.([]string); isStrings {
 			return ss, nil
 		}
 		return nil, fmt.Errorf("%s is a list of strings, not %T", key, v)
 	}
 	out := make([]string, 0, len(list))
 	for i, item := range list {
 		s, ok := item.(string)
 		if !ok {
 			return nil, fmt.Errorf("%s[%d] is a string, not %T", key, i, item)
 		}
 		out = append(out, s)
 	}
 	return out, nil
 }
 // seconds is a timeout argument in seconds, defaulted and bounded below the runtime's call limit.
 func seconds(args map[string]any, key string, def, most int) (time.Duration, error) {
 	n, err := whole(args, key, def, 1, most)
 	return time.Duration(n) * time.Second, err
 }
@@ -1,306 +0,0 @@
 package main
 import (
 	"encoding/json"
 	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
 	"regexp"
 	"sort"
 	"strconv"
 	"strings"
 	"syscall"
 	"time"
 )
 var bars = []string{"top", "bottom"}
 // A bar runs this long when a tool reads its values: long enough for every block's first update.
 const runFor = 4 * time.Second
 func configDir() string { return filepath.Join(operatorHome(), ".config", "i3status-rust") }
 func barFile(bar string) string { return filepath.Join(configDir(), bar+"-bar.toml") }
 func barsOf(bar string) ([]string, error) {
 	if bar == "" {
 		return bars, nil
 	}
 	for _, b := range bars {
 		if b == bar {
 			return []string{bar}, nil
 		}
 	}
 	return nil, fmt.Errorf("bar %q is top or bottom", bar)
 }
 // ReloadResult is what i3status_rust_reload answers.
 type ReloadResult struct {
 	Reached []int  `json:"reached"`
 	Note    string `json:"note"`
 }
 // Reload restarts every running i3status-rs in place, which re-reads its file (SIGUSR2).
 func Reload() ReloadResult {
 	reached := signalAll("i3status-rs", syscall.SIGUSR2)
 	if reached == nil {
 		return ReloadResult{Reached: []int{}, Note: "no bar is running: i3 starts them with the session"}
 	}
 	return ReloadResult{Reached: reached, Note: "each bar re-read its configuration"}
 }
 // Config is a bar's file cut into the part before its blocks and each block's own text.
 type Config struct {
 	Header string
 	Blocks []string
 }
 var blockStart = regexp.MustCompile(`(?m)^\[\[block\]\]\s*$`)
 func splitConfig(raw string) Config {
 	idx := blockStart.FindAllStringIndex(raw, -1)
 	if len(idx) == 0 {
 		return Config{Header: raw}
 	}
 	c := Config{Header: raw[:idx[0][0]]}
 	for i, at := range idx {
 		end := len(raw)
 		if i+1 < len(idx) {
 			end = idx[i+1][0]
 		}
 		c.Blocks = append(c.Blocks, raw[at[0]:end])
 	}
 	return c
 }
 // Block is one block of a bar.
 type Block struct {
 	Index    int               `json:"index"`
 	Kind     string            `json:"block"`
 	Settings map[string]string `json:"settings"`
 	Text     *string           `json:"text,omitempty"`
 	State    string            `json:"state,omitempty"`
 }
 var keyValue = regexp.MustCompile(`^([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.+?)\s*$`)
 // describe reads a block's own top-level settings (not its sub-tables, such as clicks), as written.
 func describe(index int, raw string) Block {
 	b := Block{Index: index, Settings: map[string]string{}}
 	for _, line := range strings.Split(raw, "\n")[1:] {
 		line = strings.TrimSpace(line)
 		if strings.HasPrefix(line, "[") {
 			break
 		}
 		if line == "" || strings.HasPrefix(line, "#") {
 			continue
 		}
 		if m := keyValue.FindStringSubmatch(line); m != nil {
 			v := strings.Trim(m[2], `"`)
 			if m[1] == "block" {
 				b.Kind = v
 			} else {
 				b.Settings[m[1]] = v
 			}
 		}
 	}
 	return b
 }
 // BarBlocks is one bar's blocks.
 type BarBlocks struct {
 	Bar    string  `json:"bar"`
 	File   string  `json:"file"`
 	Blocks []Block `json:"blocks"`
 	Error  string  `json:"error,omitempty"`
 }
 // Blocks describes each bar's blocks, and with values what each shows now.
 func Blocks(bar string, values bool) ([]BarBlocks, error) {
 	which, err := barsOf(bar)
 	if err != nil {
 		return nil, err
 	}
 	var out []BarBlocks
 	for _, b := range which {
 		file := barFile(b)
 		raw, err := os.ReadFile(file)
 		if err != nil {
 			out = append(out, BarBlocks{Bar: b, File: file, Blocks: []Block{}, Error: err.Error()})
 			continue
 		}
 		c := splitConfig(string(raw))
 		bb := BarBlocks{Bar: b, File: file, Blocks: []Block{}}
 		for i, text := range c.Blocks {
 			bb.Blocks = append(bb.Blocks, describe(i, text))
 		}
 		if values {
 			shown, err := runBar(file)
 			if err != nil {
 				bb.Error = err.Error()
 			}
 			for i := range bb.Blocks {
 				if w, ok := shown[i]; ok {
 					text := w.text
 					bb.Blocks[i].Text, bb.Blocks[i].State = &text, w.state
 				}
 			}
 		}
 		out = append(out, bb)
 	}
 	return out, nil
 }
 type widgetText struct{ text, state string }
 // runBar runs i3status-rs on a file for a moment and answers each block's latest text, by index.
 // i3status-rs names each block's widgets by an instance "<index>:…", which is how they are told apart.
 func runBar(file string) (map[int]widgetText, error) {
 	s := findEnvironment() // the session when there is one; blocks that need none run without
 	r, err := s.run(runFor, "", "i3status-rs", file)
 	if err != nil && !errors.Is(err, ErrTimedOut) {
 		return nil, err
 	}
 	shown := parseStatus(r.Stdout)
 	if len(shown) == 0 {
 		msg := strings.TrimSpace(r.Stderr)
 		if msg == "" {
 			msg = "the bar showed nothing within " + runFor.String()
 		}
 		return shown, errors.New(msg)
 	}
 	return shown, nil
 }
 // parseStatus reads i3bar's protocol — a header, "[", then one JSON array per update — and answers
 // the last complete update's text per block index.
 func parseStatus(stream string) map[int]widgetText {
 	var last []map[string]any
 	for _, line := range strings.Split(stream, "\n") {
 		line = strings.TrimSuffix(strings.TrimPrefix(strings.TrimSpace(line), ","), ",")
 		if !strings.HasPrefix(line, "[{") && line != "[]" {
 			continue
 		}
 		var update []map[string]any
 		if json.Unmarshal([]byte(line), &update) == nil {
 			last = update
 		}
 	}
 	out := map[int]widgetText{}
 	for _, w := range last {
 		instance, _ := w["instance"].(string)
 		head, _, ok := strings.Cut(instance, ":")
 		if !ok {
 			continue // a separator
 		}
 		i, err := strconv.Atoi(head)
 		if err != nil {
 			continue
 		}
 		text, _ := w["full_text"].(string)
 		cur := out[i]
 		cur.text = strings.TrimSpace(strings.TrimSpace(cur.text) + " " + strings.TrimSpace(text))
 		if colour, _ := w["color"].(string); strings.EqualFold(colour, "#FF0000FF") {
 			cur.state = "critical"
 		}
 		out[i] = cur
 	}
 	return out
 }
 // RunResult is what i3status_rust_block_run answers.
 type RunResult struct {
 	Bar   string `json:"bar"`
 	Block Block  `json:"block"`
 	Error string `json:"error,omitempty"`
 }
 // BlockRun runs one block of a bar alone, with the bar's theme and icons.
 func BlockRun(bar string, index int) (RunResult, error) {
 	if _, err := barsOf(bar); err != nil || bar == "" {
 		return RunResult{}, fmt.Errorf("bar %q is top or bottom", bar)
 	}
 	raw, err := os.ReadFile(barFile(bar))
 	if err != nil {
 		return RunResult{}, err
 	}
 	c := splitConfig(string(raw))
 	if index >= len(c.Blocks) {
 		return RunResult{}, fmt.Errorf("the %s bar has %d blocks, numbered from 0", bar, len(c.Blocks))
 	}
 	tmp, err := os.CreateTemp("", "i3status-rust-block-*.toml")
 	if err != nil {
 		return RunResult{}, err
 	}
 	defer os.Remove(tmp.Name())
 	if _, err := tmp.WriteString(c.Header + c.Blocks[index]); err != nil {
 		tmp.Close()
 		return RunResult{}, err
 	}
 	tmp.Close()
 	out := RunResult{Bar: bar, Block: describe(index, c.Blocks[index])}
 	shown, err := runBar(tmp.Name())
 	if err != nil {
 		out.Error = err.Error()
 	}
 	if w, ok := shown[0]; ok {
 		text := w.text
 		out.Block.Text, out.Block.State = &text, w.state
 	}
 	return out, nil
 }
 // Theme is one bar theme.
 type Theme struct {
 	Name   string `json:"name"`
 	File   string `json:"file"`
 	Source string `json:"source"`
 }
 // ThemesResult is what i3status_rust_themes answers.
 type ThemesResult struct {
 	InUse  map[string]string `json:"in_use"`
 	Themes []Theme           `json:"themes"`
 }
 type themeDir struct{ path, source string }
 func themeDirs() []themeDir {
 	return []themeDir{
 		{filepath.Join(configDir(), "themes"), "the account's"},
 		{filepath.Join(operatorHome(), ".local", "share", "i3status-rust", "themes"), "the account's"},
 		{"/usr/share/i3status-rust/themes", "the distribution's"},
 	}
 }
 var themeName = regexp.MustCompile(`(?ms)^\[theme\]\s*$.*?^theme\s*=\s*"([^"]+)"`)
 // Themes lists the themes, the first directory winning a name, and the one each bar names.
 func Themes(dirs []themeDir) ThemesResult {
 	out := ThemesResult{InUse: map[string]string{}, Themes: []Theme{}}
 	for _, b := range bars {
 		if raw, err := os.ReadFile(barFile(b)); err == nil {
 			if m := themeName.FindStringSubmatch(string(raw)); m != nil {
 				out.InUse[b] = m[1]
 			}
 		}
 	}
 	seen := map[string]bool{}
 	for _, d := range dirs {
 		entries, err := os.ReadDir(d.path)
 		if err != nil {
 			continue
 		}
 		for _, e := range entries {
 			name, ok := strings.CutSuffix(e.Name(), ".toml")
 			if !ok || seen[name] {
 				continue
 			}
 			seen[name] = true
 			out.Themes = append(out.Themes, Theme{Name: name, File: filepath.Join(d.path, e.Name()), Source: d.source})
 		}
 	}
 	sort.Slice(out.Themes, func(i, j int) bool { return out.Themes[i].Name < out.Themes[j].Name })
 	return out
 }
@@ -1,141 +0,0 @@
 package main
 import (
 	"os"
 	"path/filepath"
 	"reflect"
 	"strings"
 	"testing"
 )
 func source(t *testing.T, name string) string {
 	t.Helper()
 	raw, err := os.ReadFile(filepath.Join("..", "..", "files", name))
 	if err != nil {
 		t.Fatal(err)
 	}
 	return string(raw)
 }
 func TestTheModulesBarsSplitIntoTheirBlocksInOrder(t *testing.T) {
 	c := splitConfig(source(t, "bottom-bar.toml"))
 	var kinds []string
 	for i, b := range c.Blocks {
 		kinds = append(kinds, describe(i, b).Kind)
 	}
 	want := []string{"tea_timer", "custom", "cpu", "disk_space", "disk_space", "memory", "docker", "sound", "weather", "notify", "time"}
 	if !reflect.DeepEqual(kinds, want) {
 		t.Fatalf("%v", kinds)
 	}
 	if !strings.Contains(c.Header, `theme = "plain"`) || strings.Contains(c.Header, "[[block]]") {
 		t.Fatalf("header: %s", c.Header)
 	}
 	custom := describe(1, c.Blocks[1])
 	if custom.Settings["command"] != "~/.local/bin/i3status-updates 10" || custom.Settings["interval"] != "1800" {
 		t.Fatalf("a block's own settings, not its click's: %+v", custom)
 	}
 	if _, leaked := custom.Settings["cmd"]; leaked {
 		t.Fatal("the click's cmd was read as the block's")
 	}
 	top := splitConfig(source(t, "top-bar.toml"))
 	if len(top.Blocks) != 2 || describe(0, top.Blocks[0]).Kind != "focused_window" {
 		t.Fatalf("top: %+v", top.Blocks)
 	}
 }
 // Two updates of i3bar's protocol, as i3status-rs wrote them for the top bar on 2026-10-04.
 const stream = `{"version": 1, "click_events": true}
 [
 [{"full_text":" | ","color":"#FFFFFFFF","separator":false},{"full_text":" up 1d ","color":"#F1F1F1FF","name":"0","instance":"1:"}],
 [{"full_text":" | ","color":"#FFFFFFFF","separator":false},{"full_text":" ","color":"#FF0000FF","name":"0","instance":"0:"},{"full_text":"failed to connect to wayland ","color":"#FF0000FF","name":"0","instance":"0:"},{"full_text":" | "},{"full_text":" up 2d ","color":"#F1F1F1FF","name":"0","instance":"1:"}],
 `
 func TestTheLatestUpdateIsReadPerBlockIndex(t *testing.T) {
 	got := parseStatus(stream)
 	if got[1].text != "up 2d" || got[1].state != "" || got[0].text != "failed to connect to wayland" || got[0].state != "critical" || len(got) != 2 {
 		t.Fatalf("%+v", got)
 	}
 	if len(parseStatus("garbage\n[\n")) != 0 {
 		t.Fatal("no update is no blocks")
 	}
 }
 // installBars puts the module's bars where i3status-rs would read them, and a fake i3status-rs.
 func installBars(t *testing.T) string {
 	t.Helper()
 	root := fakeMachine(t)
 	dir := filepath.Join(root, "home", ".config", "i3status-rust")
 	if err := os.MkdirAll(dir, 0o755); err != nil {
 		t.Fatal(err)
 	}
 	for _, f := range []string{"top-bar.toml", "bottom-bar.toml"} {
 		if err := os.WriteFile(filepath.Join(dir, f), []byte(source(t, f)), 0o644); err != nil {
 			t.Fatal(err)
 		}
 	}
 	bin := fakeBinaries(t, map[string]string{"i3status-rs": `cp "$1" "$LOG.config"
 printf '%s\n' '{"version": 1}' '[' '[{"full_text":"first","instance":"0:"},{"full_text":"second","instance":"1:"}],'`})
 	t.Setenv("LOG", filepath.Join(bin, "log"))
 	return bin
 }
 func TestBlocksPairEachBlockWithWhatItShows(t *testing.T) {
 	installBars(t)
 	got, err := Blocks("top", true)
 	if err != nil || len(got) != 1 {
 		t.Fatalf("%+v, %v", got, err)
 	}
 	b := got[0].Blocks
 	if len(b) != 2 || b[0].Kind != "focused_window" || b[0].Text == nil || *b[0].Text != "first" || *b[1].Text != "second" {
 		t.Fatalf("%+v", got)
 	}
 	if all, _ := Blocks("", false); len(all) != 2 || all[1].Blocks[0].Text != nil {
 		t.Fatalf("both bars, without values: %+v", all)
 	}
 	if _, err := Blocks("side", false); err == nil {
 		t.Fatal("an unknown bar was accepted")
 	}
 }
 func TestOneBlockRunsAloneWithTheBarsThemeAndIcons(t *testing.T) {
 	bin := installBars(t)
 	got, err := BlockRun("bottom", 8)
 	if err != nil || got.Block.Kind != "weather" || got.Block.Text == nil || *got.Block.Text != "first" {
 		t.Fatalf("%+v, %v", got, err)
 	}
 	ran, _ := os.ReadFile(filepath.Join(bin, "log.config"))
 	if strings.Count(string(ran), "[[block]]") != 1 || !strings.Contains(string(ran), `name = "metno"`) ||
 		!strings.Contains(string(ran), `icons = "custom-icons"`) {
 		t.Fatalf("the config it ran:\n%s", ran)
 	}
 	if _, err := BlockRun("bottom", 11); err == nil {
 		t.Fatal("a block past the end was accepted")
 	}
 	if _, err := BlockRun("", 0); err == nil {
 		t.Fatal("no bar was accepted")
 	}
 }
 func TestThemesListEachOnceWithTheOnesInUse(t *testing.T) {
 	installBars(t)
 	root := t.TempDir()
 	for _, f := range []string{"mine/plain.toml", "system/plain.toml", "system/nord-dark.toml", "system/README"} {
 		if err := os.MkdirAll(filepath.Dir(filepath.Join(root, f)), 0o755); err != nil {
 			t.Fatal(err)
 		}
 		if err := os.WriteFile(filepath.Join(root, f), nil, 0o644); err != nil {
 			t.Fatal(err)
 		}
 	}
 	got := Themes([]themeDir{{filepath.Join(root, "mine"), "mine"}, {filepath.Join(root, "system"), "system"}})
 	if got.InUse["top"] != "plain" || got.InUse["bottom"] != "plain" || len(got.Themes) != 2 || got.Themes[1].Source != "mine" {
 		t.Fatalf("%+v", got)
 	}
 }
 func TestReloadWithNoBarRunningSaysSo(t *testing.T) {
 	fakeMachine(t)
 	if r := Reload(); len(r.Reached) != 0 || !strings.Contains(r.Note, "no bar") {
 		t.Fatalf("%+v", r)
 	}
 }
@@ -1,81 +0,0 @@
 // i3status-rust's Go tools bundle (novox/hq ADR 0188, ADR 0193, ADR 0208): the bars' tools, served by
 // the node's runtime as the operator account. node-bar has no verbs yet (ADR 0208 §2), so every tool
 // here is the module's own.
 package main
 import (
 	"fmt"
 	"os"
 	stdio "git.novox.be/novox/mesh-sdk/go"
 )
 func main() {
 	if err := stdio.Serve("", tools()); err != nil {
 		fmt.Fprintln(os.Stderr, err)
 		os.Exit(1)
 	}
 }
 var barInput = map[string]any{"type": "string", "enum": bars, "description": "which bar (default: both)"}
 func tools() []stdio.Tool {
 	return []stdio.Tool{
 		{
 			Name: "i3status_rust_reload",
 			Description: "Make the running bars re-read their configuration (i3status-rs restarts in place). " +
 				"Answers the processes reached.",
 			Run: func(map[string]any) (any, error) { return Reload(), nil },
 		},
 		{
 			Name: "i3status_rust_blocks",
 			Description: "What each bar shows: every block in order, its kind and settings, and with values " +
 				"(the default) what it shows right now, from one run of the bar's configuration.",
 			Input: map[string]any{
 				"bar":    barInput,
 				"values": map[string]any{"type": "boolean", "description": "run the bar once to read each block's current text (default true; a few seconds)"},
 			},
 			Run: func(args map[string]any) (any, error) {
 				bar, err := text(args, "bar", false)
 				if err != nil {
 					return nil, err
 				}
 				values, err := flag(args, "values", true)
 				if err != nil {
 					return nil, err
 				}
 				return Blocks(bar, values)
 			},
 		},
 		{
 			Name: "i3status_rust_block_run",
 			Description: "Run one block of a bar once, alone, and answer what it shows — to see a block that " +
 				"errors, or what a click would act on.",
 			Input: map[string]any{
 				"type": "object",
 				"properties": map[string]any{
 					"bar":   map[string]any{"type": "string", "enum": bars},
 					"index": map[string]any{"type": "integer", "description": "the block's position in the bar, from 0, as i3status_rust_blocks answers it"},
 				},
 				"required": []string{"bar", "index"},
 			},
 			Run: func(args map[string]any) (any, error) {
 				bar, err := text(args, "bar", true)
 				if err != nil {
 					return nil, err
 				}
 				index, err := whole(args, "index", 0, 0, 200)
 				if err != nil {
 					return nil, err
 				}
 				return BlockRun(bar, index)
 			},
 		},
 		{
 			Name: "i3status_rust_themes",
 			Description: "The bar themes on this machine (the distribution's and the account's own) and the " +
 				"one each bar uses.",
 			Run: func(map[string]any) (any, error) { return Themes(themeDirs()), nil },
 		},
 	}
 }
@@ -1,175 +0,0 @@
 package main
 import (
 	"encoding/json"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 )
 // The module's manifest, read the way the catalogue reads it, for the manifest tests. The same in
 // every desktop module that carries it.
 type manifest struct {
 	Module       string           `json:"module"`
 	Version      string           `json:"version"`
 	Capabilities []string         `json:"capabilities"`
 	Requires     []string         `json:"requires"`
 	Claims       []claim          `json:"claims"`
 	Seats        []any            `json:"seats"`
 	Tools        []string         `json:"tools"`
 	Environment  *environment     `json:"environment"`
 	Shell        []shellCode      `json:"shell"`
 	Resources    []map[string]any `json:"resources"`
 	Build        struct {
 		Artifacts []map[string]any `json:"artifacts"`
 	} `json:"build"`
 }
 type claim struct {
 	Name   string   `json:"name"`
 	Scope  string   `json:"scope"`
 	Serves []string `json:"serves"`
 }
 type environment struct {
 	Variables map[string]string `json:"variables"`
 	Path      []map[string]any  `json:"path"`
 }
 type shellCode struct {
 	For  string `json:"for"`
 	Slot string `json:"slot"`
 	Code string `json:"code"`
 }
 func readManifest(t *testing.T) manifest {
 	t.Helper()
 	raw, err := os.ReadFile(filepath.Join("..", "..", "module.json"))
 	if err != nil {
 		t.Fatal(err)
 	}
 	dec := json.NewDecoder(strings.NewReader(string(raw)))
 	dec.DisallowUnknownFields()
 	var m manifest
 	if err := dec.Decode(&m); err != nil {
 		t.Fatalf("module.json: %v", err)
 	}
 	return m
 }
 func (m manifest) resource(t *testing.T, id string) map[string]any {
 	t.Helper()
 	for _, r := range m.Resources {
 		if r["id"] == id {
 			return r
 		}
 	}
 	t.Fatalf("no resource %q", id)
 	return nil
 }
 func (m manifest) packages() (present, absent []string) {
 	for _, r := range m.Resources {
 		if r["type"] == "package" {
 			if r["absent"] == true {
 				absent = append(absent, r["package"].(string))
 			} else {
 				present = append(present, r["package"].(string))
 			}
 		}
 	}
 	return present, absent
 }
 // sameAsSource checks that a file resource's content is byte for byte the module's source file, so
 // the readable file in the repository is what the machine gets.
 func (m manifest) sameAsSource(t *testing.T, id, source string) {
 	t.Helper()
 	want, err := os.ReadFile(filepath.Join("..", "..", source))
 	if err != nil {
 		t.Fatal(err)
 	}
 	r := m.resource(t, id)
 	if r["type"] != "file" {
 		t.Fatalf("%s is a %v, not a file", id, r["type"])
 	}
 	if got, _ := r["content"].(string); got != string(want) {
 		t.Fatalf("resource %s's content is not %s: edit the source and copy it into module.json", id, source)
 	}
 	if r["owner"] != "${machine:account}" && !strings.HasPrefix(r["path"].(string), "/etc/") {
 		t.Fatalf("%s under the home is the account's", id)
 	}
 }
 // checkTheToolsAgree checks that the manifest lists the module's own tools exactly, that the bundle
 // serves each seat verb the claims promise as <seat>.<verb>, and that the Go bundle is declared.
 func checkTheToolsAgree(t *testing.T, m manifest) {
 	t.Helper()
 	own, seat := map[string]bool{}, map[string]bool{}
 	for _, tool := range tools() {
 		if strings.Contains(tool.Name, ".") {
 			seat[tool.Name] = true
 		} else {
 			own[tool.Name] = true
 		}
 		if strings.TrimSpace(tool.Description) == "" {
 			t.Errorf("%s has no description", tool.Name)
 		}
 	}
 	listed := map[string]bool{}
 	for _, name := range m.Tools {
 		listed[name] = true
 		if !own[name] {
 			t.Errorf("module.json lists %s, which the bundle does not serve", name)
 		}
 	}
 	for name := range own {
 		if !listed[name] {
 			t.Errorf("the bundle serves %s, which module.json does not list", name)
 		}
 		if !strings.HasPrefix(name, strings.ReplaceAll(m.Module, "-", "_")+"_") {
 			t.Errorf("%s is not prefixed with the module's name", name)
 		}
 	}
 	promised := map[string]bool{}
 	for _, c := range m.Claims {
 		for _, verb := range c.Serves {
 			promised[c.Name+"."+verb] = true
 			if !seat[c.Name+"."+verb] {
 				t.Errorf("the claim on %s promises %s, which the bundle does not serve", c.Name, verb)
 			}
 		}
 	}
 	for name := range seat {
 		if !promised[name] {
 			t.Errorf("the bundle serves %s, which no claim promises", name)
 		}
 	}
 	var bundle map[string]any
 	for _, a := range m.Build.Artifacts {
 		if a["kind"] == "bundle" {
 			bundle = a
 		}
 	}
 	if bundle == nil || bundle["language"] != "go" || bundle["system"] != "arch" ||
 		bundle["from"] != "cmd/"+m.Module+"-tools" || bundle["binary"] != m.Module+"-tools" {
 		t.Errorf("the Go tools bundle: %v", bundle)
 	}
 }
 // checkNoSecretsOrInstallationNames refuses what a catalogue manifest must never carry.
 func checkNoSecretsOrInstallationNames(t *testing.T) {
 	t.Helper()
 	raw, err := os.ReadFile(filepath.Join("..", "..", "module.json"))
 	if err != nil {
 		t.Fatal(err)
 	}
 	s := strings.ToLower(string(raw))
 	for _, never := range []string{"/home/", "jochen", "g14", "shanks", "novox.be", "api_key", ".hal/", "greenclip daemon"} {
 		if strings.Contains(s, never) {
 			t.Errorf("module.json names %q", never)
 		}
 	}
 }
@@ -1,71 +0,0 @@
 package main
 import (
 	"reflect"
 	"strings"
 	"testing"
 )
 // i3status-rust's shape (novox/hq ADR 0208): it claims node-bar, requires the X display on its own
 // machine (its bars are i3bar's), owns its two bars and their icons, places the bars as an i3 drop-in,
 // and runs the bar watchdog once per session. No block follows one machine's hardware or one person's
 // devices.
 func TestItClaimsTheBarSeatAndRequiresTheXDisplay(t *testing.T) {
 	m := readManifest(t)
 	if m.Module != "i3status-rust" || m.Seats != nil {
 		t.Fatalf("module %q declares seats %v", m.Module, m.Seats)
 	}
 	if !reflect.DeepEqual(m.Claims, []claim{{Name: "node-bar", Scope: "node"}}) {
 		t.Fatalf("claims: %+v", m.Claims)
 	}
 	if !reflect.DeepEqual(m.Requires, []string{"x11-display"}) {
 		t.Fatalf("requires: %v", m.Requires)
 	}
 	if present, absent := m.packages(); !reflect.DeepEqual(present, []string{"i3status-rust", "pacman-contrib"}) || absent != nil {
 		t.Fatalf("packages: %v, absent %v", present, absent)
 	}
 }
 func TestItOwnsItsFilesAsWrittenInTheModule(t *testing.T) {
 	m := readManifest(t)
 	for id, src := range map[string]string{
 		"top-bar": "files/top-bar.toml", "bottom-bar": "files/bottom-bar.toml", "icons": "files/icons/custom-icons.toml",
 		"updates": "files/bin/i3status-updates", "watchdog": "files/bin/i3bar-watchdog", "i3-bars": "files/i3/60-i3status-rust.conf",
 	} {
 		m.sameAsSource(t, id, src)
 	}
 }
 func TestNoBlockFollowsAMachinesHardwareOrAPersonsDevicesOrCarriesAKey(t *testing.T) {
 	m := readManifest(t)
 	bottom := m.resource(t, "bottom-bar")["content"].(string)
 	for _, never := range []string{`block = "battery"`, `block = "amd_gpu"`, `block = "nvidia_gpu"`, "mac = ", "api_key", "city_id", "openweathermap", "~/scripts/"} {
 		if strings.Contains(bottom, never) {
 			t.Errorf("the bottom bar has %s", never)
 		}
 	}
 }
 func TestTheBarsAreAnI3DropInAndTheWatchdogRunsOncePerSession(t *testing.T) {
 	m := readManifest(t)
 	bars := m.resource(t, "i3-bars")
 	if bars["path"] != "${machine:account-home}/.config/i3/config.d/60-i3status-rust.conf" {
 		t.Fatalf("%v", bars["path"])
 	}
 	c := bars["content"].(string)
 	if strings.Count(c, "bar {") != 2 || !strings.Contains(c, "status_command i3status-rs ~/.config/i3status-rust/bottom-bar.toml") ||
 		!strings.Contains(c, "font pango:JetBrainsMono Nerd Font 11") {
 		t.Fatalf("%s", c)
 	}
 	if len(m.Shell) != 1 || m.Shell[0].For != "xinitrc" || m.Shell[0].Slot != "normal" ||
 		!strings.Contains(m.Shell[0].Code, `"$HOME/.local/bin/i3bar-watchdog" "$$" &`) {
 		t.Fatalf("%+v", m.Shell)
 	}
 }
 func TestTheToolsAgreeWithTheManifest(t *testing.T) {
 	m := readManifest(t)
 	checkTheToolsAgree(t, m)
 	checkNoSecretsOrInstallationNames(t)
 }
@@ -1,423 +0,0 @@
 // The operator's graphical session, as a tool the node's runtime runs finds it (novox/hq ADR 0208).
 //
 // The runtime is a system service running as the operator account (ADR 0175): it has the account's
 // uid and none of the session's environment — no DISPLAY, no XAUTHORITY, no session bus. A tool that
 // draws on the screen or talks to the desktop's D-Bus must find them. It reads them from a process of
 // the account that is part of the session (the window manager first), the same thing `loginctl` and
 // a person's own shell would point at, and says where it found them.
 //
 // Long-lived programs a tool starts go to the account's own service manager through `systemd-run
 // --user`, never as children of the tool: the runtime's unit is a cgroup the service manager empties
 // whenever the runtime restarts, and a compositor or a clipboard owner started from inside it would
 // die with it.
 //
 // This file is the same in every desktop module that carries it; it moves into the Go SDK once a
 // second consumer outside the desktop wants it.
 package main
 import (
 	"bytes"
 	"errors"
 	"fmt"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"sort"
 	"strconv"
 	"strings"
 	"syscall"
 	"time"
 )
 // Where the session is looked for. Variables so a test can point them at a fake tree.
 var (
 	procRoot   = "/proc"
 	runUserDir = "/run/user"
 	x11Sockets = "/tmp/.X11-unix"
 )
 // sessionHolders are the processes whose environment is the session's, best first: the window
 // manager is the session, the rest are its children. Anything else carrying DISPLAY ranks after them.
 var sessionHolders = []string{"i3", "sway", "i3bar", "picom", "xss-lock", "dunst", "clipmenud", "xterm"}
 // sessionKeys are the variables a session carries that a tool hands on to what it runs.
 var sessionKeys = []string{"DISPLAY", "XAUTHORITY", "WAYLAND_DISPLAY", "DBUS_SESSION_BUS_ADDRESS",
 	"XDG_RUNTIME_DIR", "XDG_SESSION_ID", "I3SOCK"}
 // Session is what a tool needs to reach the operator's desktop.
 type Session struct {
 	UID        int    `json:"uid"`
 	Display    string `json:"display,omitempty"`
 	XAuthority string `json:"xauthority,omitempty"`
 	Wayland    string `json:"wayland_display,omitempty"`
 	Bus        string `json:"bus,omitempty"`
 	RuntimeDir string `json:"runtime_dir,omitempty"`
 	SessionID  string `json:"session_id,omitempty"`
 	I3Sock     string `json:"i3sock,omitempty"`
 	// From says where the values were found: the tool's own environment, a process, or the socket.
 	From string `json:"from"`
 }
 // ErrNoSession is answered by a tool that needs the desktop when nobody is logged in to it.
 var ErrNoSession = errors.New("no graphical session")
 // ErrTimedOut is what run answers for a command ended because it ran past its time.
 var ErrTimedOut = errors.New("timed out")
 // ErrNoBus is answered by a tool that needs the session bus when the account has none.
 var ErrNoBus = errors.New("no session bus")
 // operatorHome is the account's home: what the runtime was told, else the process's own.
 func operatorHome() string {
 	if h := strings.TrimSpace(os.Getenv("MESH_OPERATOR_HOME")); h != "" {
 		return h
 	}
 	h, _ := os.UserHomeDir()
 	return h
 }
 // findSession finds the graphical session of the account this tool runs as, or answers
 // ErrNoSession with what it looked at.
 func findSession() (Session, error) {
 	s := findEnvironment()
 	if s.Display == "" && s.Wayland == "" {
 		return s, fmt.Errorf("%w for uid %d on this machine: no process of the account carries DISPLAY "+
 			"or WAYLAND_DISPLAY, and no X server socket in %s has an authority file to go with it. "+
 			"Is anyone logged in to the desktop?", ErrNoSession, s.UID, x11Sockets)
 	}
 	return s, nil
 }
 // findBus finds the account's session bus, which a logged-in account has whether or not a desktop
 // is running.
 func findBus() (Session, error) {
 	s := findEnvironment()
 	if s.Bus == "" {
 		return s, fmt.Errorf("%w for uid %d: DBUS_SESSION_BUS_ADDRESS is not set and %s does not exist "+
 			"(the account is not logged in)", ErrNoBus, s.UID, filepath.Join(runUserDir, strconv.Itoa(s.UID), "bus"))
 	}
 	return s, nil
 }
 func findEnvironment() Session {
 	uid := os.Getuid()
 	s := Session{UID: uid}
 	own := map[string]string{}
 	for _, k := range sessionKeys {
 		own[k] = os.Getenv(k)
 	}
 	if own["DISPLAY"] != "" || own["WAYLAND_DISPLAY"] != "" {
 		s.fill(own)
 		s.From = "the tool's own environment"
 	} else if pid, comm, env, ok := sessionProcess(uid); ok {
 		s.fill(env)
 		s.From = fmt.Sprintf("process %s (pid %d)", comm, pid)
 	} else if display, ok := lonelyX11Socket(); ok {
 		if a := filepath.Join(operatorHome(), ".Xauthority"); exists(a) {
 			s.Display, s.XAuthority = display, a
 			s.From = "the X server socket and the account's ~/.Xauthority"
 		}
 		s.fill(own)
 	} else {
 		s.fill(own)
 		s.From = "nothing: no session found"
 	}
 	// The bus and the runtime directory are the account's, whether or not the process named them.
 	runtime := filepath.Join(runUserDir, strconv.Itoa(uid))
 	if s.RuntimeDir == "" && exists(runtime) {
 		s.RuntimeDir = runtime
 	}
 	if s.Bus == "" && s.RuntimeDir != "" && exists(filepath.Join(s.RuntimeDir, "bus")) {
 		s.Bus = "unix:path=" + filepath.Join(s.RuntimeDir, "bus")
 	}
 	return s
 }
 func (s *Session) fill(env map[string]string) {
 	set := func(dst *string, key string) {
 		if *dst == "" {
 			*dst = env[key]
 		}
 	}
 	set(&s.Display, "DISPLAY")
 	set(&s.XAuthority, "XAUTHORITY")
 	set(&s.Wayland, "WAYLAND_DISPLAY")
 	set(&s.Bus, "DBUS_SESSION_BUS_ADDRESS")
 	set(&s.RuntimeDir, "XDG_RUNTIME_DIR")
 	set(&s.SessionID, "XDG_SESSION_ID")
 	set(&s.I3Sock, "I3SOCK")
 }
 // sessionProcess is the best process of this uid whose environment names a display.
 func sessionProcess(uid int) (int, string, map[string]string, bool) {
 	entries, err := os.ReadDir(procRoot)
 	if err != nil {
 		return 0, "", nil, false
 	}
 	type candidate struct {
 		pid  int
 		comm string
 		env  map[string]string
 		rank int
 	}
 	var found []candidate
 	for _, e := range entries {
 		pid, err := strconv.Atoi(e.Name())
 		if err != nil {
 			continue
 		}
 		dir := filepath.Join(procRoot, e.Name())
 		if owner, ok := ownerOf(dir); !ok || owner != uid {
 			continue
 		}
 		raw, err := os.ReadFile(filepath.Join(dir, "environ"))
 		if err != nil {
 			continue
 		}
 		env := parseEnviron(raw)
 		if env["DISPLAY"] == "" && env["WAYLAND_DISPLAY"] == "" {
 			continue
 		}
 		comm := readTrimmed(filepath.Join(dir, "comm"))
 		rank := len(sessionHolders)
 		for i, h := range sessionHolders {
 			if h == comm {
 				rank = i
 				break
 			}
 		}
 		found = append(found, candidate{pid, comm, env, rank})
 	}
 	if len(found) == 0 {
 		return 0, "", nil, false
 	}
 	sort.Slice(found, func(i, j int) bool {
 		if found[i].rank != found[j].rank {
 			return found[i].rank < found[j].rank
 		}
 		return found[i].pid > found[j].pid // the newer of two equals
 	})
 	best := found[0]
 	return best.pid, best.comm, best.env, true
 }
 func parseEnviron(raw []byte) map[string]string {
 	env := map[string]string{}
 	for _, kv := range bytes.Split(raw, []byte{0}) {
 		if i := bytes.IndexByte(kv, '='); i > 0 {
 			env[string(kv[:i])] = string(kv[i+1:])
 		}
 	}
 	return env
 }
 func ownerOf(path string) (int, bool) {
 	info, err := os.Stat(path)
 	if err != nil {
 		return 0, false
 	}
 	st, ok := info.Sys().(*syscall.Stat_t)
 	if !ok {
 		return 0, false
 	}
 	return int(st.Uid), true
 }
 // lonelyX11Socket is the display of the one X server socket there is, when there is exactly one.
 func lonelyX11Socket() (string, bool) {
 	entries, err := os.ReadDir(x11Sockets)
 	if err != nil {
 		return "", false
 	}
 	var displays []string
 	for _, e := range entries {
 		if n := strings.TrimPrefix(e.Name(), "X"); n != e.Name() {
 			if _, err := strconv.Atoi(n); err == nil {
 				displays = append(displays, ":"+n)
 			}
 		}
 	}
 	if len(displays) != 1 {
 		return "", false
 	}
 	return displays[0], true
 }
 func readTrimmed(path string) string {
 	b, err := os.ReadFile(path)
 	if err != nil {
 		return ""
 	}
 	return strings.TrimSpace(string(b))
 }
 func exists(path string) bool {
 	_, err := os.Stat(path)
 	return err == nil
 }
 // Env is this process's environment with the session's variables in place of its own.
 func (s Session) Env() []string {
 	drop := map[string]bool{}
 	for _, k := range sessionKeys {
 		drop[k] = true
 	}
 	var env []string
 	for _, kv := range os.Environ() {
 		if i := strings.IndexByte(kv, '='); i > 0 && drop[kv[:i]] {
 			continue
 		}
 		env = append(env, kv)
 	}
 	add := func(k, v string) {
 		if v != "" {
 			env = append(env, k+"="+v)
 		}
 	}
 	add("DISPLAY", s.Display)
 	add("XAUTHORITY", s.XAuthority)
 	add("WAYLAND_DISPLAY", s.Wayland)
 	add("DBUS_SESSION_BUS_ADDRESS", s.Bus)
 	add("XDG_RUNTIME_DIR", s.RuntimeDir)
 	add("XDG_SESSION_ID", s.SessionID)
 	add("I3SOCK", s.I3Sock)
 	return env
 }
 // mostOutput bounds what a command may answer with, per stream.
 const mostOutput = 256 << 10
 // Result is what a command did.
 type Result struct {
 	Stdout    string `json:"stdout"`
 	Stderr    string `json:"stderr,omitempty"`
 	Code      int    `json:"code"`
 	Truncated bool   `json:"truncated,omitempty"`
 }
 // run runs a command in the session's environment, its input given, ended with everything it
 // started after timeout. A command that is not installed is an error naming it; one that exits
 // non-zero is a Result with its code, for the caller to judge.
 func (s Session) run(timeout time.Duration, stdin string, name string, args ...string) (Result, error) {
 	path, err := exec.LookPath(name)
 	if err != nil {
 		return Result{}, fmt.Errorf("%s is not installed on this machine", name)
 	}
 	cmd := exec.Command(path, args...)
 	cmd.Env = s.Env()
 	if home := operatorHome(); exists(home) {
 		cmd.Dir = home
 	}
 	if stdin != "" {
 		cmd.Stdin = strings.NewReader(stdin)
 	}
 	var out, errOut capped
 	cmd.Stdout, cmd.Stderr = &out, &errOut
 	cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
 	if err := cmd.Start(); err != nil {
 		return Result{}, fmt.Errorf("%s: %w", name, err)
 	}
 	done := make(chan error, 1)
 	go func() { done <- cmd.Wait() }()
 	select {
 	case err = <-done:
 	case <-time.After(timeout):
 		_ = syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL)
 		<-done
 		return Result{Stdout: out.String(), Stderr: errOut.String()},
 			fmt.Errorf("%s did not finish within %s and was ended: %w", name, timeout, ErrTimedOut)
 	}
 	r := Result{Stdout: out.String(), Stderr: errOut.String(), Truncated: out.cut || errOut.cut}
 	var exit *exec.ExitError
 	if errors.As(err, &exit) {
 		r.Code = exit.ExitCode()
 	} else if err != nil {
 		return r, fmt.Errorf("%s: %w", name, err)
 	}
 	return r, nil
 }
 // detach starts a long-lived program under the account's own service manager, as a transient unit
 // that carries the session's display, so it outlives the runtime that asked for it. A unit already
 // running under the same name is stopped first, so a fixed name means "at most one".
 func (s Session) detach(unit string, args ...string) error {
 	if s.RuntimeDir == "" {
 		return fmt.Errorf("%w: the account's runtime directory is missing, so its service manager "+
 			"cannot be reached", ErrNoBus)
 	}
 	_, _ = s.run(5*time.Second, "", "systemctl", "--user", "stop", unit+".service")
 	call := []string{"--user", "--collect", "--quiet", "--unit=" + unit}
 	for _, kv := range [][2]string{{"DISPLAY", s.Display}, {"XAUTHORITY", s.XAuthority},
 		{"WAYLAND_DISPLAY", s.Wayland}, {"XDG_SESSION_ID", s.SessionID}, {"I3SOCK", s.I3Sock}} {
 		if kv[1] != "" {
 			call = append(call, "--setenv="+kv[0]+"="+kv[1])
 		}
 	}
 	call = append(call, "--")
 	call = append(call, args...)
 	r, err := s.run(10*time.Second, "", "systemd-run", call...)
 	if err != nil {
 		return err
 	}
 	if r.Code != 0 {
 		return fmt.Errorf("systemd-run %s: %s", unit, strings.TrimSpace(r.Stderr))
 	}
 	return nil
 }
 // uniqueUnit is a transient unit name that will not collide with an earlier one.
 func uniqueUnit(prefix string) string {
 	return fmt.Sprintf("%s-%d", prefix, time.Now().UnixNano())
 }
 type capped struct {
 	bytes.Buffer
 	cut bool
 }
 func (c *capped) Write(p []byte) (int, error) {
 	if room := mostOutput - c.Len(); room < len(p) {
 		if room > 0 {
 			c.Buffer.Write(p[:room])
 		}
 		c.cut = true
 		return len(p), nil
 	}
 	return c.Buffer.Write(p)
 }
 // processesOf are the pids of this uid's processes whose command name is comm, oldest first.
 func processesOf(comm string) []int {
 	entries, err := os.ReadDir(procRoot)
 	if err != nil {
 		return nil
 	}
 	uid := os.Getuid()
 	var pids []int
 	for _, e := range entries {
 		pid, err := strconv.Atoi(e.Name())
 		if err != nil {
 			continue
 		}
 		dir := filepath.Join(procRoot, e.Name())
 		if owner, ok := ownerOf(dir); !ok || owner != uid {
 			continue
 		}
 		if readTrimmed(filepath.Join(dir, "comm")) == comm {
 			pids = append(pids, pid)
 		}
 	}
 	sort.Ints(pids)
 	return pids
 }
 // signalAll sends sig to every process of this uid named comm, and answers the pids it reached.
 func signalAll(comm string, sig syscall.Signal) []int {
 	var reached []int
 	for _, pid := range processesOf(comm) {
 		if syscall.Kill(pid, sig) == nil {
 			reached = append(reached, pid)
 		}
 	}
 	return reached
 }
@@ -1,174 +0,0 @@
 package main
 import (
 	"errors"
 	"os"
 	"path/filepath"
 	"strconv"
 	"strings"
 	"testing"
 	"time"
 )
 // fakeMachine points the session finder at a temporary /proc, /run/user and X socket directory, with
 // none of the test process's own session variables, and gives back the root.
 func fakeMachine(t *testing.T) string {
 	t.Helper()
 	root := t.TempDir()
 	procRoot, runUserDir, x11Sockets = filepath.Join(root, "proc"), filepath.Join(root, "run-user"), filepath.Join(root, "x11")
 	for _, d := range []string{procRoot, runUserDir, x11Sockets} {
 		if err := os.MkdirAll(d, 0o755); err != nil {
 			t.Fatal(err)
 		}
 	}
 	for _, k := range sessionKeys {
 		t.Setenv(k, "")
 	}
 	t.Setenv("MESH_OPERATOR_HOME", filepath.Join(root, "home"))
 	t.Cleanup(func() { procRoot, runUserDir, x11Sockets = "/proc", "/run/user", "/tmp/.X11-unix" })
 	return root
 }
 func fakeProcess(t *testing.T, pid int, comm string, env ...string) {
 	t.Helper()
 	dir := filepath.Join(procRoot, strconv.Itoa(pid))
 	if err := os.MkdirAll(dir, 0o755); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.WriteFile(filepath.Join(dir, "comm"), []byte(comm+"\n"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.WriteFile(filepath.Join(dir, "environ"), []byte(strings.Join(env, "\x00")+"\x00"), 0o600); err != nil {
 		t.Fatal(err)
 	}
 }
 func TestTheSessionIsReadFromTheWindowManagerBeforeAnyOtherProcess(t *testing.T) {
 	fakeMachine(t)
 	fakeProcess(t, 900, "xterm", "DISPLAY=:9", "XAUTHORITY=/elsewhere")
 	fakeProcess(t, 100, "i3", "DISPLAY=:1", "XAUTHORITY=/home/op/.Xauthority",
 		"DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus", "XDG_SESSION_ID=3", "SECRET_TOKEN=never-copied")
 	fakeProcess(t, 50, "bash", "PATH=/usr/bin")
 	s, err := findSession()
 	if err != nil {
 		t.Fatal(err)
 	}
 	if s.Display != ":1" || s.XAuthority != "/home/op/.Xauthority" || s.SessionID != "3" || !strings.Contains(s.From, "i3 (pid 100)") {
 		t.Fatalf("the window manager's environment: %+v", s)
 	}
 	for _, kv := range s.Env() {
 		if strings.HasPrefix(kv, "SECRET_TOKEN=") {
 			t.Fatal("a variable of the session process that is not a session variable was handed on")
 		}
 	}
 }
 func TestAnyProcessCarryingADisplayServesWhenTheWindowManagerIsNotFound(t *testing.T) {
 	fakeMachine(t)
 	fakeProcess(t, 10, "firefox", "DISPLAY=:0")
 	fakeProcess(t, 20, "firefox", "DISPLAY=:2")
 	s, err := findSession()
 	if err != nil || s.Display != ":2" {
 		t.Fatalf("the newest of two equals: %+v, %v", s, err)
 	}
 }
 func TestNoSessionIsAClearAnswerNotAGuess(t *testing.T) {
 	fakeMachine(t)
 	fakeProcess(t, 10, "sshd", "PATH=/usr/bin")
 	_, err := findSession()
 	if !errors.Is(err, ErrNoSession) || !strings.Contains(err.Error(), "logged in to the desktop") {
 		t.Fatalf("no session: %v", err)
 	}
 }
 func TestOneXSocketAndTheAccountsAuthorityFileAreASession(t *testing.T) {
 	root := fakeMachine(t)
 	if err := os.WriteFile(filepath.Join(x11Sockets, "X0"), nil, 0o644); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.MkdirAll(filepath.Join(root, "home"), 0o755); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.WriteFile(filepath.Join(root, "home", ".Xauthority"), nil, 0o600); err != nil {
 		t.Fatal(err)
 	}
 	s, err := findSession()
 	if err != nil || s.Display != ":0" || !strings.HasSuffix(s.XAuthority, "/home/.Xauthority") {
 		t.Fatalf("socket and authority: %+v, %v", s, err)
 	}
 }
 func TestTheBusIsTheAccountsRuntimeDirectoryWhenNoProcessNamesIt(t *testing.T) {
 	fakeMachine(t)
 	runtime := filepath.Join(runUserDir, strconv.Itoa(os.Getuid()))
 	if _, err := findBus(); !errors.Is(err, ErrNoBus) {
 		t.Fatalf("no runtime directory is no bus: %v", err)
 	}
 	if err := os.MkdirAll(runtime, 0o700); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.WriteFile(filepath.Join(runtime, "bus"), nil, 0o600); err != nil {
 		t.Fatal(err)
 	}
 	s, err := findBus()
 	if err != nil || s.Bus != "unix:path="+filepath.Join(runtime, "bus") || s.RuntimeDir != runtime {
 		t.Fatalf("bus: %+v, %v", s, err)
 	}
 	env := strings.Join(s.Env(), "\n")
 	if !strings.Contains(env, "XDG_RUNTIME_DIR="+runtime) || !strings.Contains(env, "DBUS_SESSION_BUS_ADDRESS=unix:path=") {
 		t.Fatalf("the bus is handed on: %s", env)
 	}
 }
 func TestACommandIsBoundedAndANonZeroExitIsAResult(t *testing.T) {
 	fakeMachine(t)
 	s := Session{}
 	r, err := s.run(5*time.Second, "in", "sh", "-c", "cat; echo err >&2; exit 3")
 	if err != nil || r.Stdout != "in" || r.Code != 3 || strings.TrimSpace(r.Stderr) != "err" {
 		t.Fatalf("result: %+v, %v", r, err)
 	}
 	start := time.Now()
 	if _, err := s.run(200*time.Millisecond, "", "sh", "-c", "sleep 30 & sleep 30"); err == nil || time.Since(start) > 5*time.Second {
 		t.Fatalf("a command past its time is ended with what it started: %v after %s", err, time.Since(start))
 	}
 	if _, err := s.run(time.Second, "", "no-such-program-here"); err == nil || !strings.Contains(err.Error(), "not installed") {
 		t.Fatalf("a missing program: %v", err)
 	}
 }
 func TestDetachAsksTheAccountsServiceManagerWithTheSessionsDisplay(t *testing.T) {
 	fakeMachine(t)
 	bin := fakeBinaries(t, map[string]string{
 		"systemctl":   `echo "systemctl $*" >> "$LOG"`,
 		"systemd-run": `echo "systemd-run $*" >> "$LOG"`,
 	})
 	log := filepath.Join(bin, "log")
 	t.Setenv("LOG", log)
 	s := Session{Display: ":1", XAuthority: "/x", RuntimeDir: "/run/user/1"}
 	if err := s.detach("picom-session", "picom", "--config", "/c"); err != nil {
 		t.Fatal(err)
 	}
 	got, _ := os.ReadFile(log)
 	want := "systemctl --user stop picom-session.service\n" +
 		"systemd-run --user --collect --quiet --unit=picom-session --setenv=DISPLAY=:1 --setenv=XAUTHORITY=/x -- picom --config /c\n"
 	if string(got) != want {
 		t.Fatalf("detach ran:\n%s\nwant:\n%s", got, want)
 	}
 	if err := (Session{}).detach("x", "y"); !errors.Is(err, ErrNoBus) {
 		t.Fatalf("no runtime directory: %v", err)
 	}
 }
 // fakeBinaries puts shell scripts named for programs first on PATH, and answers their directory.
 func fakeBinaries(t *testing.T, scripts map[string]string) string {
 	t.Helper()
 	dir := t.TempDir()
 	for name, body := range scripts {
 		if err := os.WriteFile(filepath.Join(dir, name), []byte("#!/bin/sh\n"+body+"\n"), 0o755); err != nil {
 			t.Fatal(err)
 		}
 	}
 	t.Setenv("PATH", dir+string(os.PathListSeparator)+os.Getenv("PATH"))
 	return dir
 }
@@ -1,64 +0,0 @@
 #!/usr/bin/env bash
 # i3bar-watchdog [session-pid] (module i3status-rust, novox/hq ADR 0208): respawns a bar that died.
 #
 # i3 starts one i3bar per `bar { }` block and never restarts one that exits, and a reload does not
 # either. Changing the monitor setup reliably kills the bar that owns the tray. This brings back the
 # one missing i3bar, without restarting i3, and logs the outputs at that moment: the evidence for the
 # cause, which is i3bar's.
 #
 # Started once per session from the session's start, with the session's own pid; it ends when that
 # process does. Adopted from the predecessor's i3-bar-watchdog user unit of 2026-10-04.
 set -uo pipefail
 session_pid="${1:-}"
 interval="${I3_BAR_WATCHDOG_INTERVAL:-5}"
 # Two misses in a row before acting: an i3 restart tears every bar down and starts them again.
 confirm="${I3_BAR_WATCHDOG_CONFIRM:-2}"
 # Never respawn the same bar more often than this, so a bar that dies at once is not a tight loop.
 cooldown="${I3_BAR_WATCHDOG_COOLDOWN:-30}"
 log() { printf 'i3bar-watchdog: %s\n' "$*" >&2; }
 for tool in i3-msg i3bar pgrep; do
 	command -v "$tool" >/dev/null 2>&1 || {
 		log "$tool is missing; not watching"
 		exit 1
 	}
 done
 declare -A missed=() fixed=()
 bar_ids() { i3-msg -t get_bar_config 2>/dev/null | grep -oE '"[^"]+"' | tr -d '"'; }
 outputs() { xrandr --listmonitors 2>/dev/null | tail -n +2 | awk '{print $2" "$3}' | tr '\n' ' '; }
 session_alive() { [ -z "$session_pid" ] || kill -0 "$session_pid" 2>/dev/null; }
 while session_alive; do
 	sleep "$interval"
 	socket="$(i3 --get-socketpath 2>/dev/null)"
 	[ -n "$socket" ] && [ -S "$socket" ] || continue
 	ids="$(bar_ids)"
 	[ -n "$ids" ] || continue
 	while read -r id; do
 		[ -n "$id" ] || continue
 		if pgrep -u "$EUID" -f -- "i3bar --bar_id=$id" >/dev/null 2>&1; then
 			missed[$id]=0
 			continue
 		fi
 		missed[$id]=$((${missed[$id]:-0} + 1))
 		[ "${missed[$id]}" -ge "$confirm" ] || continue
 		now="$(date +%s)"
 		if [ $((now - ${fixed[$id]:-0})) -lt "$cooldown" ]; then
 			continue
 		fi
 		log "$id is gone; respawning it. Outputs now: $(outputs)"
 		nohup i3bar --bar_id="$id" --socket="$socket" >/dev/null 2>&1 &
 		disown 2>/dev/null || true
 		fixed[$id]="$now"
 		sleep 2
 		if pgrep -u "$EUID" -f -- "i3bar --bar_id=$id" >/dev/null 2>&1; then
 			missed[$id]=0
 		else
 			log "$id exited within 2s of respawning; check its status_command"
 		fi
 	done <<<"$ids"
 done
@@ -1,63 +0,0 @@
 #!/usr/bin/env bash
 # i3status-updates [threshold] (module i3status-rust, novox/hq ADR 0208): the pending updates, for
 # the bottom bar's custom block (json = true). Emits one JSON line.
 #
 # Adopted from the operator's pkg-updates of 2026-10-04. The native `packages` block showed a raw
 # red error on every transient network failure, which on a roaming laptop is often. This keeps the
 # last good result through a failure and shows an error only after `threshold` failures in a row
 # (default 10). Official packages through checkupdates (pacman-contrib, a temporary database, no
 # root); AUR packages through paru when it is installed, and none counted when it is not.
 set -uo pipefail
 threshold="${1:-10}"
 icon="update"
 state_dir="${XDG_RUNTIME_DIR:-/tmp}/i3status-updates"
 mkdir -p "$state_dir"
 last="$state_dir/last_good.json"
 failures="$state_dir/failures"
 json() { printf '{"icon":"%s","state":"%s","text":"%s","short_text":"%s"}' "$icon" "$1" "$2" "$3"; }
 count() { [ -n "$1" ] && printf '%s\n' "$1" | grep -c . || echo 0; }
 official="$(checkupdates 2>/dev/null)"
 official_rc=$?
 aur="" aur_rc=0
 if command -v paru >/dev/null 2>&1; then
 	aur="$(paru -Qua 2>/dev/null)"
 	aur_rc=$?
 fi
 # checkupdates: 0 updates listed, 2 none pending; anything else is a failure.
 if { [ "$official_rc" -eq 0 ] || [ "$official_rc" -eq 2 ]; } && [ "$aur_rc" -eq 0 ]; then
 	o="$(count "$official")"
 	a="$(count "$aur")"
 	total=$((o + a))
 	if [ "$total" -eq 0 ]; then
 		payload="$(json Good "up to date" "")"
 	else
 		# A kernel update wants a reboot: the one worth not putting off.
 		state=Info
 		printf '%s\n' "$official" | grep -qE '^(linux|linux-lts|linux-zen) ' && state=Warning
 		label="$o + $a = $total updates"
 		[ "$a" -eq 0 ] && label="$total updates"
 		[ "$total" -eq 1 ] && label="1 update"
 		payload="$(json "$state" "$label" "$total")"
 	fi
 	printf '%s' "$payload" >"$last"
 	printf '0' >"$failures"
 	printf '%s\n' "$payload"
 	exit 0
 fi
 n=$(($(cat "$failures" 2>/dev/null || echo 0) + 1))
 printf '%s' "$n" >"$failures"
 if [ "$n" -ge "$threshold" ]; then
 	json Critical "update check failing (${n}x)" "!"
 	echo
 elif [ -s "$last" ]; then
 	cat "$last"
 	echo
 else
 	json Idle "" ""
 	echo
 fi
@@ -1,100 +0,0 @@
 # The bottom bar (module i3status-rust, novox/hq ADR 0208). Owned by the mesh: replaced at every
 # push. Adopted from the workstations of 2026-10-04 with what follows a machine's hardware or one
 # person's devices left out: the battery and the GPU belong to a machine model's hardware module,
 # and a headset's address is not the bar's to know. Every block here works the same on any machine.
 icons_format = "{icon}"
 [theme]
 theme = "plain"
 [theme.overrides]
 idle_bg = "#000000"
 idle_fg = "#f1f1f1"
 info_bg = "#000000"
 info_fg = "#f1f1f1"
 good_bg = "#000000"
 good_fg = "#859900"
 warning_bg = "#000000"
 warning_fg = "#de5200"
 critical_bg = "#000000"
 critical_fg = "#ff0000"
 separator = " | "
 separator_fg = "#ffffff"
 separator_bg = "#000000"
 [icons]
 icons = "custom-icons"
 [[block]]
 block = "tea_timer"
 format = "$icon{ $minutes:$seconds|}"
 done_cmd = "notify-send 'Timer finished'"
 # Pending updates: official and, where an AUR helper is installed, AUR. The script keeps the last good
 # count through a network gap and shows an error only after ten failed checks in a row. Click: the
 # list, in the launcher's menu.
 [[block]]
 block = "custom"
 command = "~/.local/bin/i3status-updates 10"
 json = true
 interval = 1800
 [[block.click]]
 button = "left"
 cmd = "checkupdates | dmenu -l 20 -p Updates"
 [[block]]
 block = "cpu"
 [[block]]
 block = "disk_space"
 path = "/"
 info_type = "used"
 alert_unit = "GB"
 interval = 20
 warning = 850
 alert = 920
 format = "$icon / $used.eng(w:2) ($percentage.eng(w:2))"
 [[block]]
 block = "disk_space"
 path = "/home"
 info_type = "used"
 alert_unit = "GB"
 interval = 20
 warning = 850
 alert = 920
 format = "$icon /home $used.eng(w:2) ($percentage.eng(w:2))"
 [[block]]
 block = "memory"
 format = "$icon $mem_total_used.eng(w:2) ($mem_total_used_percents.eng(w:2))"
 format_alt = "$icon_swap $swap_used.eng(w:2) ($swap_used_percents.eng(w:2))"
 [[block]]
 block = "docker"
 interval = 2
 format = "$icon $running/$total"
 [[block]]
 block = "sound"
 [[block.click]]
 button = "left"
 cmd = "pavucontrol"
 # The weather from the Norwegian Meteorological Institute, which needs no key, where the machine is.
 [[block]]
 block = "weather"
 format = "$icon  $weather_verbose ($location) $temp"
 autolocate = true
 autolocate_interval = 600
 [block.service]
 name = "metno"
 [[block]]
 block = "notify"
 driver = "dunst"
 format = " $icon {($notification_count.eng(w:1))|}"
 [[block]]
 block = "time"
 interval = 1
 format = "$timestamp.datetime(f:'%a %d/%m %H:%M:%S')"
@@ -1,34 +0,0 @@
 # The bars (module i3status-rust, novox/hq ADR 0208). Owned by the mesh: replaced at every push.
 # i3 reads this file through its configuration's `include ~/.config/i3/config.d/*.conf`. The bottom
 # bar shows the machine; the top bar the focused window and the tray, on the primary output. The
 # face is the monospace one every desktop module names.
 bar {
        font pango:JetBrainsMono Nerd Font 11
        position bottom
        status_command i3status-rs ~/.config/i3status-rust/bottom-bar.toml
        tray_output none
        colors {
                separator #ffffff
                background #000000
                statusline #ffffff
                # The text on an accent-coloured button is dark: light text on the accent was barely
                # legible.
                focused_workspace #de5200 #de5200 #000000
                active_workspace #de5200 #de5200 #000000
                inactive_workspace #000000 #000000 #ffffff
                urgent_workspace #2f343a #900000 #ffffff
        }
 }
 bar {
        font pango:JetBrainsMono Nerd Font 11
        position top
        status_command i3status-rs ~/.config/i3status-rust/top-bar.toml
        workspace_buttons no
        tray_output primary
        colors {
                separator #ffffff
                background #000000
                statusline #ffffff
        }
 }
@@ -1,135 +0,0 @@
 # Icons for the bars (module i3status-rust, novox/hq ADR 0208), from the JetBrains Mono Nerd Font.
 # Owned by the mesh: replaced at every push. Adopted unchanged from the workstations of 2026-10-04.
 # Material from NerdFont
 # https://www.nerdfonts.com/cheat-sheet
 backlight = [
    "\ue38d", # nf-weather-moon_new
    "\ue3d4", # nf-weather-moon_alt_waxing_gibbous_6
    "\ue3d3", # nf-weather-moon_alt_waxing_gibbous_5
    "\ue3d2", # nf-weather-moon_alt_waxing_gibbous_4
    "\ue3d1", # nf-weather-moon_alt_waxing_gibbous_3
    "\ue3d0", # nf-weather-moon_alt_waxing_gibbous_2
    "\ue3cf", # nf-weather-moon_alt_waxing_gibbous_1
    "\ue3ce", # nf-weather-moon_alt_first_quarter
    "\ue3cd", # nf-weather-moon_alt_waxing_crescent_6
    "\ue3cc", # nf-weather-moon_alt_waxing_crescent_5
    "\ue3cb", # nf-weather-moon_alt_waxing_crescent_4
    "\ue3ca", # nf-weather-moon_alt_waxing_crescent_3
    "\ue3c9", # nf-weather-moon_alt_waxing_crescent_2
    "\ue3c8", # nf-weather-moon_alt_waxing_crescent_1
    "\ue39b", # nf-weather-moon_full
 ]
 bat_charging = "\U000f0084" # nf-md-battery_charging
 bat_not_available = "\U000f0091" # nf-md-battery_unknown
 bat = [
    "\U000f007a", # nf-md-battery_10
    "\U000f007b", # nf-md-battery_20
    "\U000f007c", # nf-md-battery_30
    "\U000f007d", # nf-md-battery_40
    "\U000f007e", # nf-md-battery_50
    "\U000f007f", # nf-md-battery_60
    "\U000f0080", # nf-md-battery_70
    "\U000f0081", # nf-md-battery_80
    "\U000f0082", # nf-md-battery_90
    "\U000f0079", # nf-md-battery
 ]
 bell = "\U000f009c" # nf-md-bell_outline
 bell-slash = "\U000f009b" # nf-md-bell_off
 blackberry = "\uf307" # nf-md-blackberry
 bluetooth = "\U000f00af" # nf-md-bluetooth
 calendar = "\U000f00ed" # nf-md-calendar
 cogs = "\U000f0493" # nf-md-cog
 cpu = [
 	"\U000F0F86", # nf-md-speedometer_slow
 	"\U000F0F85", # nf-md-speedometer_medium
 	"\U000F04C5", # nf-md-speedometer
 ]
 cpu_boost_on = "\U000f0521" # nf-md-toggle_switch
 cpu_boost_off = "\U000f0a19" # nf-md-toggle_switch_off_outline
 disk_drive = "\U000f02ca" # nf-md-harddisk
 docker = "\uf308" # nf-linux-docker
 github = "\U000f02a4" # nf-md-github
 gpu = "\U000f0379" # nf-md-monitor
 headphones = "\U000f02cb" # nf-md-headphones
 joystick = "\U000f0297" # nf-md-gamepad_variant
 keyboard = "\U000f030c" # nf-md-keyboard
 mail = "\U000f01ee" # nf-md-email
 memory_mem = "\U000f035b" # nf-md-memory
 memory_swap = "\U000f02ca" # nf-md-harddisk
 mouse = "\U000f037d" # nf-md-mouse
 music = "\U000f075a" # nf-md-music
 music_next = "\U000f04ad" # nf-md-skip_next
 music_pause = "\U000f03e4" # nf-md-pause
 music_play = "\U000f040a" # nf-md-play
 music_prev = "\U000f04ae" # nf-md-skip_previous
 net_bridge = "\U000f04aa" # nf-md-sitemap
 net_down = "\U000f01da" # nf-md-download
 net_loopback = "\U000f006f" # nf-md-backup_restore
 net_modem = "\U000f03f2" # nf-md-phone
 net_cellular = [
        "\U000F08FD", # nf-md-network_strength_off_outline
        "\U000F08FE", # nf-md-network_strength_outline
        "\U000F08F4", # nf-md-network_strength_1
        "\U000F08F6", # nf-md-network_strength_2
        "\U000F08F8", # nf-md-network_strength_3
        "\U000F08FA", # nf-md-network_strength_4
 ]
 net_up = "\U000f0552" # nf-md-upload
 net_vpn = "\U000f0582" # nf-md-vpn
 net_wired = "\U000f0200" # nf-md-ethernet
 net_wireless = [
 	"\U000F092F", # nf-md-wifi_strength_outline
 	"\U000F091F", # nf-md-wifi_strength_1
 	"\U000F0922", # nf-md-wifi_strength_2
 	"\U000F0925", # nf-md-wifi_strength_3
 	"\U000F0928", # nf-md-wifi_strength_4
 ]
 notification = "\U000f009c" # nf-md-bell_outline
 phone = "\U000f03f2" # nf-md-phone
 phone_disconnected = "\U000f0658" # nf-md-phone_minus
 ping = "\U000f051f" # nf-md-timer_sand
 pomodoro = "\ue001" # nf-pom-pomodoro_done
 pomodoro_break = "\U000f0176" # nf-md-coffee
 pomodoro_paused = "\U000f03e4" # nf-md-pause
 pomodoro_started = "\U000f040a" # nf-md-play
 pomodoro_stopped = "\U000f04db" # nf-md-stop
 resolution = "\U000f0293" # nf-md-fullscreen
 tasks = "\U000f05c7" # nf-md-playlist_check
 tea = "\U000f0d9e" # nf-md-tea
 thermometer = [
    "\U000f10c3", # nf-md-thermometer_low
    "\U000f050f", # nf-md-thermometer
    "\U000f10c2", # nf-md-thermometer_high
 ]
 time = "\U000f0150" # nf-md-clock_outline
 toggle_off = "\U000f0a19" # nf-md-toggle_switch_off_outline
 toggle_on = "\U000f0521" # nf-md-toggle_switch
 unknown = "\U000f0186" # nf-md-comment_question_outline | TODO: Make default?
 update = "\U000f03d5" # nf-md-package_up
 uptime = "\U000f0153" # nf-md-clock_in
 volume_muted = "\U000f075f" # nf-md-volume_mute
 volume = [
    "\U000f057f", # nf-md-volume_low
    "\U000f0580", # nf-md-volume_medium
    "\U000f057e", # nf-md-volume_high
 ]
 microphone_muted = "\U000f036d" # nf-md-microphone_off
 microphone = [
 	"\U000f036e", # nf-md-microphone_outline
    "\U000f036c", # nf-md-microphone
    "\U000f036c", # nf-md-microphone
 ]
 xrandr = "\U000f037a" # nf-md-monitor_multiple
 # Weather icons (https://greshake.github.io/i3status-rust/i3status_rs/blocks/weather/index.html)
 weather_sun = "\ue30d" # nf-weather-day_sunny (when weather is reported as “Clear” during the day)
 weather_moon = "\ue32b" # nf-weather-night_clear (when weather is reported as “Clear” at night)
 weather_clouds = "\ue312" # nf-weather-cloudy (when weather is reported as “Clouds” during the day)
 weather_clouds_night = "\ue37e" # nf-weather-night_alt_cloudy (when weather is reported as “Clouds” at night)
 weather_fog = "\ue313" # nf-weather-fog (when weather is reported as “Fog” or “Mist” during the day)
 weather_fog_night = "\ue346" # nf-weather-night_fog (when weather is reported as “Fog” or “Mist” at night)
 weather_rain = "\ue318" # nf-weather-rain (when weather is reported as “Rain” or “Drizzle” during the day)
 weather_rain_night = "\ue325" # nf-weather-night_alt_rain (when weather is reported as “Rain” or “Drizzle” at night)
 weather_snow = "\ue31a" # nf-weather-snow (when weather is reported as “Snow”)
 weather_thunder = "\ue31d" # nf-weather-thunderstorm (when weather is reported as “Thunderstorm” during the day)
 weather_thunder_night = "\ue32a" # nf-weather-night_alt_thunderstorm (when weather is reported as “Thunderstorm” at night)
@@ -1,33 +0,0 @@
 # The top bar (module i3status-rust, novox/hq ADR 0208): the focused window's title and the uptime.
 # Owned by the mesh: replaced at every push. Adopted unchanged from the workstations of 2026-10-04.
 icons_format = "{icon}"
 [theme]
 theme = "plain"
 [theme.overrides]
 idle_bg = "#000000"
 idle_fg = "#f1f1f1"
 info_bg = "#000000"
 info_fg = "#f1f1f1"
 good_bg = "#000000"
 good_fg = "#859900"
 warning_bg = "#000000"
 warning_fg = "#de5200"
 critical_bg = "#000000"
 critical_fg = "#ff0000"
 separator = " | "
 separator_fg = "#ffffff"
 separator_bg = "#000000"
 [icons]
 icons = "custom-icons"
 [[block]]
 block = "focused_window"
 [block.format]
 full = " $title.str(max_w:50) |"
 short = " $title.str(max_w:100) |"
 [[block]]
 block = "uptime"
 interval = 60
@@ -1,5 +0,0 @@
 module i3statusrust
 go 1.22
 require git.novox.be/novox/mesh-sdk/go v0.1.7
@@ -1,2 +0,0 @@
 git.novox.be/novox/mesh-sdk/go v0.1.7 h1:C0sTQmtTiyYH7bnqZb7PusXnqA37gKuT7Nqjn9gG47w=
 git.novox.be/novox/mesh-sdk/go v0.1.7/go.mod h1:GFuZUElBZ9A++mxgIKo97aXXo+kV0uJ/UkbhQPPIbrY=
@@ -45,7 +45,7 @@
      "image": "registry-api.novox.be/novox/photos-client@sha256:f87d63ee7bfb44c9f9748b99be6ba6dc0daf955a1d463699e9e7e3009693c0ab",
      "network": "photos-eef",
      "ports": [
-        "4012:80"
+        "80"
      ],
      "names-on-purpose": {
        "registry-api.novox.be": "built outside the mesh, from the application's own repository, and pulled from the registry that built it; moves when that repository is a build source on the git seat (novox/hq ADR 0155, issue 122)"
@@ -45,7 +45,7 @@
      "image": "registry-api.novox.be/novox/photos-client@sha256:f87d63ee7bfb44c9f9748b99be6ba6dc0daf955a1d463699e9e7e3009693c0ab",
      "network": "photos-filip",
      "ports": [
-        "4013:80"
+        "80"
      ],
      "names-on-purpose": {
        "registry-api.novox.be": "built outside the mesh, from the application's own repository, and pulled from the registry that built it; moves when that repository is a build source on the git seat (novox/hq ADR 0155, issue 122)"
@@ -89,7 +89,7 @@
      "image": "registry-api.novox.be/novox/photos-admin-client@sha256:f437fa9ed28b29a012f715fb8d9b809a15cff4a672794c620d5d400f57695580",
      "network": "photos",
      "ports": [
-        "4001:80"
+        "80"
      ],
      "names-on-purpose": {
        "registry-api.novox.be": "built outside the mesh, from the application's own repository, and pulled from the registry that built it; moves when that repository is a build source on the git seat (novox/hq ADR 0155, issue 122)"
@@ -1,62 +0,0 @@
 # picom
 The X compositor as a module (novox/hq ADR 0208, research 026).
 - Installs `picom`, and `xorg-xprop` for setting a window's own opacity.
 - Claims the mesh's `node-compositor` seat (no verbs yet, ADR 0208 §2) and requires `x11-display`.
  That requirement has the machine's reach: the display server must be held on this module's own
  machine, or assignment is refused, naming the seat's holders.
 - Owns `~/.config/picom/` and `~/.config/picom/picom.conf`, which it writes whole at every push.
 - **Adds no start of its own.** picom's package ships an XDG autostart entry
  (`/etc/xdg/autostart/picom.desktop`), which the session runs: the `i3` module's `dex --autostart`.
  That is the tool's own grain (ADR 0208 §4) and its one start. The desktop modules follow one rule:
  a process has one starter. Its package's autostart entry is that starter where there is one, and
  the `xinitrc` slot where there is none.
 ## Tools
 Served by the node's runtime as the operator account (ADR 0175). The tools find the operator's X
 session from the window manager's own environment, and say so plainly when nobody is logged in.
 | tool | does |
 |---|---|
 | `picom_restart` | a running picom re-reads its file (`SIGUSR1`); `hard`, or none running, starts a fresh one |
 | `picom_rules` | the global options and the window rules in force, in picom's order, and whether it runs |
 | `picom_window_opacity` | read or set one window's own opacity, the focused window by default |
 | `picom_toggle` | compositing off or on, for a game or a test; the next login starts it again |
 A picom a tool starts runs under the account's own service manager (`systemd-run --user`, unit
 `picom`). As a child of the runtime it would die whenever the runtime restarts.
 ## What it improves on what was found
 - **Window rules** replace `opacity-rule`, `inactive-opacity` and `inactive-dim`, which picom 12 and
  later supersede. The behaviour is the same: only terminals are translucent (95 % focused, 75 %
  unfocused). The browser and video "pin to 100 %" rule went, because nothing else is made
  translucent any more.
 - **Full-screen windows are opaque,** a terminal included.
 - **One start.** Today both the window manager's configuration and the autostart entry start picom,
  and the second one exits.
 - On the desktop, picom was not running at all on the day it was measured, although both starts were
  in place. It probably fails to start on that machine's GPU. `picom_restart` with `hard` after
  assignment answers with what happened. The next step is the `picom` user unit's journal.
 ## What it leaves as found
 The window manager's own `exec --no-startup-id picom` line belongs to the `i3` module's configuration,
 which no longer carries it. Nothing else of picom's lies outside the directory this module owns.
 ## Migration (ADR 0182)
 - The first push keeps the found `picom.conf` once, then writes the module's.
 - Until the `i3` module replaces the hand-kept `~/.config/i3/config`, its `exec picom` line starts a
  second picom. The second one exits at once, because a compositor is already running. Nothing to
  do, unless the line is still there after `i3` is assigned.
 ## Blockers
 - The seat `node-compositor` and the provision `x11-display` are ADR 0208's.
  Until the controller knows them, `mctl` reads the claim and the requirement as unknown, and refuses
  the module.
 - `xorg-xprop` is declared here because the `xorg` module does not install it. If `xorg` comes to
  declare it, it leaves this module, since a package is declared once per node.
@@ -1,97 +0,0 @@
 // Reading a tool's arguments: JSON numbers arrive as float64, and a missing argument is its default.
 // The same in every desktop module that carries it.
 package main
 import (
 	"fmt"
 	"math"
 	"strings"
 	"time"
 )
 // text is a string argument, trimmed; required says an empty one is refused.
 func text(args map[string]any, key string, required bool) (string, error) {
 	v, present := args[key]
 	if !present || v == nil {
 		if required {
 			return "", fmt.Errorf("%s is required", key)
 		}
 		return "", nil
 	}
 	s, ok := v.(string)
 	if !ok {
 		return "", fmt.Errorf("%s is a string, not %T", key, v)
 	}
 	s = strings.TrimSpace(s)
 	if s == "" && required {
 		return "", fmt.Errorf("%s is required", key)
 	}
 	return s, nil
 }
 // whole is a whole-number argument within [least, most], or def when absent.
 func whole(args map[string]any, key string, def, least, most int) (int, error) {
 	v, present := args[key]
 	if !present || v == nil {
 		return def, nil
 	}
 	f, ok := v.(float64)
 	if !ok {
 		if i, isInt := v.(int); isInt {
 			f = float64(i)
 		} else {
 			return 0, fmt.Errorf("%s is a number, not %T", key, v)
 		}
 	}
 	if f != math.Trunc(f) {
 		return 0, fmt.Errorf("%s is a whole number, not %v", key, f)
 	}
 	n := int(f)
 	if n < least || n > most {
 		return 0, fmt.Errorf("%s is %d; it is between %d and %d", key, n, least, most)
 	}
 	return n, nil
 }
 // flag is a boolean argument, or def when absent.
 func flag(args map[string]any, key string, def bool) (bool, error) {
 	v, present := args[key]
 	if !present || v == nil {
 		return def, nil
 	}
 	b, ok := v.(bool)
 	if !ok {
 		return false, fmt.Errorf("%s is true or false, not %T", key, v)
 	}
 	return b, nil
 }
 // texts is a list-of-strings argument.
 func texts(args map[string]any, key string) ([]string, error) {
 	v, present := args[key]
 	if !present || v == nil {
 		return nil, nil
 	}
 	list, ok := v.([]any)
 	if !ok {
 		if ss, isStrings := v.([]string); isStrings {
 			return ss, nil
 		}
 		return nil, fmt.Errorf("%s is a list of strings, not %T", key, v)
 	}
 	out := make([]string, 0, len(list))
 	for i, item := range list {
 		s, ok := item.(string)
 		if !ok {
 			return nil, fmt.Errorf("%s[%d] is a string, not %T", key, i, item)
 		}
 		out = append(out, s)
 	}
 	return out, nil
 }
 // seconds is a timeout argument in seconds, defaulted and bounded below the runtime's call limit.
 func seconds(args map[string]any, key string, def, most int) (time.Duration, error) {
 	n, err := whole(args, key, def, 1, most)
 	return time.Duration(n) * time.Second, err
 }
@@ -1,89 +0,0 @@
 // picom's Go tools bundle (novox/hq ADR 0188, ADR 0193, ADR 0208): the compositor's own tools, served
 // by the node's runtime as the operator account. node-compositor has no verbs yet (ADR 0208 §2), so
 // every tool here is the module's own.
 package main
 import (
 	"fmt"
 	"os"
 	stdio "git.novox.be/novox/mesh-sdk/go"
 )
 func main() {
 	if err := stdio.Serve("", tools()); err != nil {
 		fmt.Fprintln(os.Stderr, err)
 		os.Exit(1)
 	}
 }
 func tools() []stdio.Tool {
 	return []stdio.Tool{
 		{
 			Name: "picom_restart",
 			Description: "Make the compositor re-read its configuration: a running picom is told to reinitialise " +
 				"(SIGUSR1); with hard, or when none runs, a fresh one is started in the operator's session under " +
 				"their service manager. Answers what was done and the pids.",
 			Input: map[string]any{
 				"hard": map[string]any{"type": "boolean", "description": "end the running picom and start a new one (default false)"},
 			},
 			Run: func(args map[string]any) (any, error) {
 				hard, err := flag(args, "hard", false)
 				if err != nil {
 					return nil, err
 				}
 				return Restart(hard)
 			},
 		},
 		{
 			Name: "picom_rules",
 			Description: "The compositor's configuration in force: its global options and each window rule " +
 				"(match, opacity, shadow, fade…) in the order picom applies them, from the file the mesh placed, " +
 				"and whether picom is running.",
 			Run: func(map[string]any) (any, error) { return Rules(configPath()) },
 		},
 		{
 			Name: "picom_window_opacity",
 			Description: "Read or set one window's own opacity (_NET_WM_WINDOW_OPACITY), the focused window " +
 				"unless one is named. A window rule that sets opacity (terminals) outranks it. Lasts as long as " +
 				"the window; the declared rules are untouched.",
 			Input: map[string]any{
 				"window":  map[string]any{"type": "string", "description": "X window id, 0x… or decimal (default: the focused window)"},
 				"opacity": map[string]any{"type": "integer", "description": "0-100 to set; 100 removes the window's own value; omit to read"},
 			},
 			Run: func(args map[string]any) (any, error) {
 				window, err := text(args, "window", false)
 				if err != nil {
 					return nil, err
 				}
 				if _, set := args["opacity"]; !set {
 					return WindowOpacity(window, -1)
 				}
 				opacity, err := whole(args, "opacity", 100, 0, 100)
 				if err != nil {
 					return nil, err
 				}
 				return WindowOpacity(window, opacity)
 			},
 		},
 		{
 			Name: "picom_toggle",
 			Description: "Turn compositing off or on in the operator's session, for a game or a test: off ends " +
 				"picom, on starts it. Without `on`, flips it. The session start brings it back at the next login.",
 			Input: map[string]any{
 				"on": map[string]any{"type": "boolean", "description": "true to start, false to stop (default: the opposite of now)"},
 			},
 			Run: func(args map[string]any) (any, error) {
 				var want *bool
 				if _, given := args["on"]; given {
 					on, err := flag(args, "on", false)
 					if err != nil {
 						return nil, err
 					}
 					want = &on
 				}
 				return Toggle(want)
 			},
 		},
 	}
 }
@@ -1,175 +0,0 @@
 package main
 import (
 	"encoding/json"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 )
 // The module's manifest, read the way the catalogue reads it, for the manifest tests. The same in
 // every desktop module that carries it.
 type manifest struct {
 	Module       string           `json:"module"`
 	Version      string           `json:"version"`
 	Capabilities []string         `json:"capabilities"`
 	Requires     []string         `json:"requires"`
 	Claims       []claim          `json:"claims"`
 	Seats        []any            `json:"seats"`
 	Tools        []string         `json:"tools"`
 	Environment  *environment     `json:"environment"`
 	Shell        []shellCode      `json:"shell"`
 	Resources    []map[string]any `json:"resources"`
 	Build        struct {
 		Artifacts []map[string]any `json:"artifacts"`
 	} `json:"build"`
 }
 type claim struct {
 	Name   string   `json:"name"`
 	Scope  string   `json:"scope"`
 	Serves []string `json:"serves"`
 }
 type environment struct {
 	Variables map[string]string `json:"variables"`
 	Path      []map[string]any  `json:"path"`
 }
 type shellCode struct {
 	For  string `json:"for"`
 	Slot string `json:"slot"`
 	Code string `json:"code"`
 }
 func readManifest(t *testing.T) manifest {
 	t.Helper()
 	raw, err := os.ReadFile(filepath.Join("..", "..", "module.json"))
 	if err != nil {
 		t.Fatal(err)
 	}
 	dec := json.NewDecoder(strings.NewReader(string(raw)))
 	dec.DisallowUnknownFields()
 	var m manifest
 	if err := dec.Decode(&m); err != nil {
 		t.Fatalf("module.json: %v", err)
 	}
 	return m
 }
 func (m manifest) resource(t *testing.T, id string) map[string]any {
 	t.Helper()
 	for _, r := range m.Resources {
 		if r["id"] == id {
 			return r
 		}
 	}
 	t.Fatalf("no resource %q", id)
 	return nil
 }
 func (m manifest) packages() (present, absent []string) {
 	for _, r := range m.Resources {
 		if r["type"] == "package" {
 			if r["absent"] == true {
 				absent = append(absent, r["package"].(string))
 			} else {
 				present = append(present, r["package"].(string))
 			}
 		}
 	}
 	return present, absent
 }
 // sameAsSource checks that a file resource's content is byte for byte the module's source file, so
 // the readable file in the repository is what the machine gets.
 func (m manifest) sameAsSource(t *testing.T, id, source string) {
 	t.Helper()
 	want, err := os.ReadFile(filepath.Join("..", "..", source))
 	if err != nil {
 		t.Fatal(err)
 	}
 	r := m.resource(t, id)
 	if r["type"] != "file" {
 		t.Fatalf("%s is a %v, not a file", id, r["type"])
 	}
 	if got, _ := r["content"].(string); got != string(want) {
 		t.Fatalf("resource %s's content is not %s: edit the source and copy it into module.json", id, source)
 	}
 	if r["owner"] != "${machine:account}" && !strings.HasPrefix(r["path"].(string), "/etc/") {
 		t.Fatalf("%s under the home is the account's", id)
 	}
 }
 // checkTheToolsAgree checks that the manifest lists the module's own tools exactly, that the bundle
 // serves each seat verb the claims promise as <seat>.<verb>, and that the Go bundle is declared.
 func checkTheToolsAgree(t *testing.T, m manifest) {
 	t.Helper()
 	own, seat := map[string]bool{}, map[string]bool{}
 	for _, tool := range tools() {
 		if strings.Contains(tool.Name, ".") {
 			seat[tool.Name] = true
 		} else {
 			own[tool.Name] = true
 		}
 		if strings.TrimSpace(tool.Description) == "" {
 			t.Errorf("%s has no description", tool.Name)
 		}
 	}
 	listed := map[string]bool{}
 	for _, name := range m.Tools {
 		listed[name] = true
 		if !own[name] {
 			t.Errorf("module.json lists %s, which the bundle does not serve", name)
 		}
 	}
 	for name := range own {
 		if !listed[name] {
 			t.Errorf("the bundle serves %s, which module.json does not list", name)
 		}
 		if !strings.HasPrefix(name, strings.ReplaceAll(m.Module, "-", "_")+"_") {
 			t.Errorf("%s is not prefixed with the module's name", name)
 		}
 	}
 	promised := map[string]bool{}
 	for _, c := range m.Claims {
 		for _, verb := range c.Serves {
 			promised[c.Name+"."+verb] = true
 			if !seat[c.Name+"."+verb] {
 				t.Errorf("the claim on %s promises %s, which the bundle does not serve", c.Name, verb)
 			}
 		}
 	}
 	for name := range seat {
 		if !promised[name] {
 			t.Errorf("the bundle serves %s, which no claim promises", name)
 		}
 	}
 	var bundle map[string]any
 	for _, a := range m.Build.Artifacts {
 		if a["kind"] == "bundle" {
 			bundle = a
 		}
 	}
 	if bundle == nil || bundle["language"] != "go" || bundle["system"] != "arch" ||
 		bundle["from"] != "cmd/"+m.Module+"-tools" || bundle["binary"] != m.Module+"-tools" {
 		t.Errorf("the Go tools bundle: %v", bundle)
 	}
 }
 // checkNoSecretsOrInstallationNames refuses what a catalogue manifest must never carry.
 func checkNoSecretsOrInstallationNames(t *testing.T) {
 	t.Helper()
 	raw, err := os.ReadFile(filepath.Join("..", "..", "module.json"))
 	if err != nil {
 		t.Fatal(err)
 	}
 	s := strings.ToLower(string(raw))
 	for _, never := range []string{"/home/", "jochen", "g14", "shanks", "novox.be", "api_key", ".hal/", "greenclip daemon"} {
 		if strings.Contains(s, never) {
 			t.Errorf("module.json names %q", never)
 		}
 	}
 }
@@ -1,61 +0,0 @@
 package main
 import (
 	"reflect"
 	"strings"
 	"testing"
 )
 // picom's shape (novox/hq ADR 0208): it claims node-compositor and serves no verb of it, requires the
 // X display on its own machine, owns its configuration file, and is started once, by its package's
 // XDG autostart entry, never by the window manager or the session's start as well.
 func TestItClaimsTheCompositorSeatAndRequiresTheXDisplay(t *testing.T) {
 	m := readManifest(t)
 	if m.Module != "picom" || m.Seats != nil {
 		t.Fatalf("module %q declares seats %v", m.Module, m.Seats)
 	}
 	if !reflect.DeepEqual(m.Claims, []claim{{Name: "node-compositor", Scope: "node"}}) {
 		t.Fatalf("claims: %+v", m.Claims)
 	}
 	if !reflect.DeepEqual(m.Requires, []string{"x11-display"}) {
 		t.Fatalf("requires: %v", m.Requires)
 	}
 	if present, absent := m.packages(); !reflect.DeepEqual(present, []string{"picom", "xorg-xprop"}) || absent != nil {
 		t.Fatalf("packages: %v, absent %v", present, absent)
 	}
 }
 func TestItOwnsItsConfigurationAsWrittenInTheModule(t *testing.T) {
 	m := readManifest(t)
 	m.sameAsSource(t, "configuration", "files/picom.conf")
 	if p := m.resource(t, "configuration")["path"]; p != "${machine:account-home}/.config/picom/picom.conf" {
 		t.Fatalf("path: %v", p)
 	}
 	if d := m.resource(t, "configuration-dir"); d["type"] != "directory" || d["path"] != "${machine:account-home}/.config/picom" {
 		t.Fatalf("the directory: %v", d)
 	}
 }
 func TestThePackagesAutostartEntryIsItsOnlyStart(t *testing.T) {
 	m := readManifest(t)
 	// picom's package ships /etc/xdg/autostart/picom.desktop, which the session's dex runs. A second
 	// start from here would be a second compositor, refused by the first.
 	if m.Shell != nil {
 		t.Fatalf("a session-start line as well as the package's autostart entry: %+v", m.Shell)
 	}
 	for _, r := range m.Resources {
 		if p, _ := r["path"].(string); strings.Contains(p, "i3/config.d") || strings.Contains(p, "autostart") {
 			t.Fatalf("a second start: %v", r)
 		}
 		if r["type"] == "service" || r["type"] == "process" {
 			t.Fatalf("a unit: %v", r)
 		}
 	}
 }
 func TestTheToolsAgreeWithTheManifest(t *testing.T) {
 	m := readManifest(t)
 	checkTheToolsAgree(t, m)
 	checkNoSecretsOrInstallationNames(t)
 }
@@ -1,293 +0,0 @@
 package main
 import (
 	"errors"
 	"fmt"
 	"math"
 	"os"
 	"path/filepath"
 	"regexp"
 	"strconv"
 	"strings"
 	"syscall"
 	"time"
 )
 // unit is the name picom runs under in the account's service manager when a tool starts it. The
 // session start runs its own, and a tool that starts one first ends any other (Toggle, Restart).
 const unit = "picom"
 func configPath() string { return filepath.Join(operatorHome(), ".config", "picom", "picom.conf") }
 // Running is picom's processes of this account.
 func running() []int { return processesOf("picom") }
 // RestartResult is what picom_restart answers.
 type RestartResult struct {
 	Action string `json:"action"`
 	PIDs   []int  `json:"pids"`
 	Note   string `json:"note,omitempty"`
 }
 // Restart tells a running picom to reinitialise, or starts one.
 func Restart(hard bool) (RestartResult, error) {
 	if pids := running(); len(pids) > 0 && !hard {
 		return RestartResult{Action: "reinitialised", PIDs: signalAll("picom", syscall.SIGUSR1),
 			Note: "picom re-read " + configPath()}, nil
 	}
 	s, err := findSession()
 	if err != nil {
 		return RestartResult{}, err
 	}
 	if err := stopAll(); err != nil {
 		return RestartResult{}, err
 	}
 	if err := s.detach(unit, "picom", "--config", configPath()); err != nil {
 		return RestartResult{}, err
 	}
 	pids := waitFor(func() []int { return running() }, 3*time.Second)
 	return RestartResult{Action: "started", PIDs: pids,
 		Note: "started under the account's service manager as " + unit + ".service"}, nil
 }
 // stopAll ends every picom of this account and waits for them to go.
 func stopAll() error {
 	signalAll("picom", syscall.SIGTERM)
 	deadline := time.Now().Add(3 * time.Second)
 	for time.Now().Before(deadline) {
 		if len(running()) == 0 {
 			return nil
 		}
 		time.Sleep(100 * time.Millisecond)
 	}
 	if left := running(); len(left) > 0 {
 		return fmt.Errorf("picom %v did not end within 3s", left)
 	}
 	return nil
 }
 func waitFor(get func() []int, within time.Duration) []int {
 	deadline := time.Now().Add(within)
 	for {
 		if got := get(); len(got) > 0 || time.Now().After(deadline) {
 			return got
 		}
 		time.Sleep(100 * time.Millisecond)
 	}
 }
 // ToggleResult is what picom_toggle answers.
 type ToggleResult struct {
 	Compositing bool   `json:"compositing"`
 	PIDs        []int  `json:"pids"`
 	Note        string `json:"note"`
 }
 // Toggle stops or starts compositing; want nil flips it.
 func Toggle(want *bool) (ToggleResult, error) {
 	on := len(running()) == 0
 	if want != nil {
 		on = *want
 	}
 	if !on {
 		if err := stopAll(); err != nil {
 			return ToggleResult{}, err
 		}
 		return ToggleResult{Compositing: false, PIDs: []int{},
 			Note: "picom ended; the session start runs it again at the next login, or call picom_toggle with on"}, nil
 	}
 	if pids := running(); len(pids) > 0 {
 		return ToggleResult{Compositing: true, PIDs: pids, Note: "picom was already running"}, nil
 	}
 	r, err := Restart(true)
 	if err != nil {
 		return ToggleResult{}, err
 	}
 	return ToggleResult{Compositing: len(r.PIDs) > 0, PIDs: r.PIDs, Note: r.Note}, nil
 }
 // Rule is one window rule, its options as written.
 type Rule struct {
 	Match   string            `json:"match"`
 	Options map[string]string `json:"options"`
 }
 // RulesResult is what picom_rules answers.
 type RulesResult struct {
 	File    string            `json:"file"`
 	Running []int             `json:"running"`
 	Global  map[string]string `json:"global"`
 	Rules   []Rule            `json:"rules"`
 	// Legacy names options that window rules supersede, which picom ignores when rules are set.
 	Legacy []string `json:"legacy,omitempty"`
 }
 var (
 	commentLine = regexp.MustCompile(`(?m)^\s*#.*$`)
 	rulesBlock  = regexp.MustCompile(`(?s)\brules\s*[=:]\s*\((.*?)\)\s*;`)
 	ruleGroup   = regexp.MustCompile(`(?s)\{(.*?)\}`)
 	assignment  = regexp.MustCompile(`(?m)^\s*([A-Za-z][A-Za-z0-9-]*)\s*[=:]\s*(.+?)\s*;?\s*$`)
 )
 // superseded are the options picom's window rules replace (picom(1), WINDOW RULES).
 var superseded = []string{"opacity-rule", "inactive-opacity", "active-opacity", "inactive-dim",
 	"shadow-exclude", "fade-exclude", "focus-exclude", "rounded-corners-exclude", "blur-background-exclude",
 	"corner-radius-rules", "wintypes", "inactive-opacity-override", "mark-wmwin-focused"}
 // Rules reads picom's configuration file into its global options and its window rules.
 func Rules(path string) (RulesResult, error) {
 	raw, err := os.ReadFile(path)
 	if err != nil {
 		return RulesResult{}, fmt.Errorf("picom's configuration: %w", err)
 	}
 	return parseRules(path, string(raw), running()), nil
 }
 func parseRules(path, conf string, pids []int) RulesResult {
 	out := RulesResult{File: path, Running: pids, Global: map[string]string{}, Rules: []Rule{}}
 	conf = commentLine.ReplaceAllString(conf, "")
 	rest := conf
 	if m := rulesBlock.FindStringSubmatchIndex(conf); m != nil {
 		body := conf[m[2]:m[3]]
 		rest = conf[:m[0]] + conf[m[1]:]
 		for _, g := range ruleGroup.FindAllStringSubmatch(body, -1) {
 			r := Rule{Options: map[string]string{}}
 			for _, part := range strings.Split(g[1], ";") {
 				k, v, ok := strings.Cut(part, "=")
 				if !ok {
 					continue
 				}
 				k, v = strings.TrimSpace(k), strings.TrimSpace(v)
 				if k == "match" {
 					r.Match = unquote(v)
 				} else {
 					r.Options[k] = unquote(v)
 				}
 			}
 			out.Rules = append(out.Rules, r)
 		}
 	}
 	for _, m := range assignment.FindAllStringSubmatch(rest, -1) {
 		out.Global[m[1]] = unquote(strings.TrimSuffix(m[2], ";"))
 	}
 	if len(out.Rules) > 0 {
 		for _, name := range superseded {
 			if _, set := out.Global[name]; set {
 				out.Legacy = append(out.Legacy, name)
 			}
 		}
 	}
 	return out
 }
 func unquote(v string) string {
 	v = strings.TrimSpace(v)
 	if len(v) >= 2 && v[0] == '"' && v[len(v)-1] == '"' {
 		return v[1 : len(v)-1]
 	}
 	return v
 }
 // OpacityResult is what picom_window_opacity answers.
 type OpacityResult struct {
 	Window string `json:"window"`
 	Class  string `json:"class,omitempty"`
 	Title  string `json:"title,omitempty"`
 	// Opacity is the window's own value in percent; nil when it has none.
 	Opacity *int   `json:"opacity"`
 	Note    string `json:"note,omitempty"`
 }
 var (
 	activeWindow = regexp.MustCompile(`window id # (0x[0-9a-fA-F]+)`)
 	cardinal     = regexp.MustCompile(`_NET_WM_WINDOW_OPACITY\(CARDINAL\) = (\d+)`)
 	wmClass      = regexp.MustCompile(`WM_CLASS\(STRING\) = "[^"]*", "([^"]*)"`)
 	wmName       = regexp.MustCompile(`_NET_WM_NAME\(UTF8_STRING\) = "(.*)"`)
 )
 // WindowOpacity reads a window's own opacity, and sets it when percent is 0-100.
 func WindowOpacity(window string, percent int) (OpacityResult, error) {
 	s, err := findSession()
 	if err != nil {
 		return OpacityResult{}, err
 	}
 	if window == "" {
 		r, err := s.run(5*time.Second, "", "xprop", "-root", "_NET_ACTIVE_WINDOW")
 		if err != nil {
 			return OpacityResult{}, err
 		}
 		m := activeWindow.FindStringSubmatch(r.Stdout)
 		if m == nil || m[1] == "0x0" {
 			return OpacityResult{}, errors.New("no window is focused")
 		}
 		window = m[1]
 	}
 	id, err := windowID(window)
 	if err != nil {
 		return OpacityResult{}, err
 	}
 	if percent >= 0 {
 		var r Result
 		if percent == 100 {
 			r, err = s.run(5*time.Second, "", "xprop", "-id", id, "-remove", "_NET_WM_WINDOW_OPACITY")
 		} else {
 			r, err = s.run(5*time.Second, "", "xprop", "-id", id, "-f", "_NET_WM_WINDOW_OPACITY", "32c",
 				"-set", "_NET_WM_WINDOW_OPACITY", strconv.FormatUint(opacityCardinal(percent), 10))
 		}
 		if err != nil {
 			return OpacityResult{}, err
 		}
 		if r.Code != 0 {
 			return OpacityResult{}, fmt.Errorf("xprop: %s", strings.TrimSpace(r.Stderr))
 		}
 	}
 	r, err := s.run(5*time.Second, "", "xprop", "-id", id, "_NET_WM_WINDOW_OPACITY", "WM_CLASS", "_NET_WM_NAME")
 	if err != nil {
 		return OpacityResult{}, err
 	}
 	if r.Code != 0 {
 		return OpacityResult{}, fmt.Errorf("window %s: %s", id, strings.TrimSpace(r.Stderr))
 	}
 	out := parseWindow(id, r.Stdout)
 	if rules, err := Rules(configPath()); err == nil && out.Class != "" {
 		for _, rule := range rules.Rules {
 			if _, sets := rule.Options["opacity"]; sets && strings.Contains(rule.Match, "class_g = '"+out.Class+"'") {
 				out.Note = "a window rule sets the opacity of class " + out.Class + " and outranks the window's own value"
 			}
 		}
 	}
 	return out, nil
 }
 func windowID(w string) (string, error) {
 	w = strings.TrimSpace(strings.ToLower(w))
 	base := 10
 	if strings.HasPrefix(w, "0x") {
 		w, base = w[2:], 16
 	}
 	n, err := strconv.ParseUint(w, base, 32)
 	if err != nil || n == 0 {
 		return "", fmt.Errorf("window %q is not an X window id", w)
 	}
 	return fmt.Sprintf("0x%x", n), nil
 }
 func opacityCardinal(percent int) uint64 {
 	return uint64(math.Round(float64(percent) / 100 * float64(math.MaxUint32)))
 }
 func parseWindow(id, out string) OpacityResult {
 	r := OpacityResult{Window: id}
 	if m := cardinal.FindStringSubmatch(out); m != nil {
 		n, _ := strconv.ParseUint(m[1], 10, 64)
 		p := int(math.Round(float64(n) / float64(math.MaxUint32) * 100))
 		r.Opacity = &p
 	}
 	if m := wmClass.FindStringSubmatch(out); m != nil {
 		r.Class = m[1]
 	}
 	if m := wmName.FindStringSubmatch(out); m != nil {
 		r.Title = m[1]
 	}
 	return r
 }
@@ -1,131 +0,0 @@
 package main
 import (
 	"errors"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 )
 // A pid above the kernel's largest, so a signal a test sends reaches nothing.
 const nobody = 4194400
 func TestTheModulesOwnConfigurationReadsAsRulesInOrder(t *testing.T) {
 	raw, err := os.ReadFile(filepath.Join("..", "..", "files", "picom.conf"))
 	if err != nil {
 		t.Fatal(err)
 	}
 	r := parseRules("picom.conf", string(raw), nil)
 	if r.Global["backend"] != "glx" || r.Global["vsync"] != "true" || r.Global["shadow"] != "false" {
 		t.Fatalf("global options: %v", r.Global)
 	}
 	if len(r.Rules) != 5 {
 		t.Fatalf("five rules: %+v", r.Rules)
 	}
 	focused, unfocused := r.Rules[2], r.Rules[3]
 	if focused.Match != "class_g = 'XTerm' && focused" || focused.Options["opacity"] != "0.95" ||
 		unfocused.Match != "class_g = 'XTerm' && !focused" || unfocused.Options["opacity"] != "0.75" {
 		t.Fatalf("the terminal rules: %+v %+v", focused, unfocused)
 	}
 	if last := r.Rules[4]; last.Match != "fullscreen" || last.Options["opacity"] != "1" {
 		t.Fatalf("full screen is opaque, and last so it wins: %+v", last)
 	}
 	if len(r.Legacy) != 0 {
 		t.Fatalf("the module's file sets no option the rules supersede: %v", r.Legacy)
 	}
 	if _, inGlobal := r.Global["match"]; inGlobal {
 		t.Fatal("a rule's key leaked into the global options")
 	}
 }
 func TestTodaysFileIsReportedForTheOptionsItsRulesWouldIgnore(t *testing.T) {
 	conf := "inactive-opacity = 1.0;\nopacity-rule = [ \"95:class_g = 'XTerm'\" ];\nrules = (\n  { match = \"focused\"; opacity = 1; }\n);\n"
 	r := parseRules("x", conf, []int{7})
 	if len(r.Rules) != 1 || r.Rules[0].Match != "focused" || len(r.Running) != 1 {
 		t.Fatalf("%+v", r)
 	}
 	if strings.Join(r.Legacy, ",") != "opacity-rule,inactive-opacity" {
 		t.Fatalf("legacy: %v", r.Legacy)
 	}
 }
 func TestAWindowIdIsHexOrDecimalAndNeverZero(t *testing.T) {
 	for in, want := range map[string]string{"0x3C00012": "0x3c00012", "62914578": "0x3c00012"} {
 		if got, err := windowID(in); err != nil || got != want {
 			t.Errorf("%s: %s, %v", in, got, err)
 		}
 	}
 	for _, bad := range []string{"0", "0x0", "window", "-1", "0x1ffffffff"} {
 		if _, err := windowID(bad); err == nil {
 			t.Errorf("%s was accepted", bad)
 		}
 	}
 }
 func TestOpacityIsAPercentOfTheFullCardinal(t *testing.T) {
 	if opacityCardinal(0) != 0 || opacityCardinal(100) != 0xffffffff || opacityCardinal(75) != 3221225471 {
 		t.Fatalf("%d %d %d", opacityCardinal(0), opacityCardinal(100), opacityCardinal(75))
 	}
 	r := parseWindow("0x1", "_NET_WM_WINDOW_OPACITY(CARDINAL) = 3221225471\nWM_CLASS(STRING) = \"xterm\", \"XTerm\"\n_NET_WM_NAME(UTF8_STRING) = \"op@host: ~\"\n")
 	if r.Opacity == nil || *r.Opacity != 75 || r.Class != "XTerm" || r.Title != "op@host: ~" {
 		t.Fatalf("%+v", r)
 	}
 	if r := parseWindow("0x1", "_NET_WM_WINDOW_OPACITY:  not found.\n"); r.Opacity != nil {
 		t.Fatalf("no value of its own: %+v", r)
 	}
 }
 func TestSettingTheFocusedWindowsOpacityAsksXpropAndNamesTheRuleThatOutranksIt(t *testing.T) {
 	root := fakeMachine(t)
 	fakeProcess(t, nobody, "i3", "DISPLAY=:1")
 	conf := filepath.Join(root, "home", ".config", "picom")
 	if err := os.MkdirAll(conf, 0o755); err != nil {
 		t.Fatal(err)
 	}
 	src, _ := os.ReadFile(filepath.Join("..", "..", "files", "picom.conf"))
 	if err := os.WriteFile(filepath.Join(conf, "picom.conf"), src, 0o644); err != nil {
 		t.Fatal(err)
 	}
 	bin := fakeBinaries(t, map[string]string{"xprop": `echo "xprop $* DISPLAY=$DISPLAY" >> "$LOG"
 case "$*" in
  "-root _NET_ACTIVE_WINDOW") echo "_NET_ACTIVE_WINDOW(WINDOW): window id # 0x3c00012" ;;
  *WM_CLASS*) printf '_NET_WM_WINDOW_OPACITY(CARDINAL) = 2147483648\nWM_CLASS(STRING) = "xterm", "XTerm"\n' ;;
 esac`})
 	t.Setenv("LOG", filepath.Join(bin, "log"))
 	r, err := WindowOpacity("", 50)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if r.Window != "0x3c00012" || r.Opacity == nil || *r.Opacity != 50 || !strings.Contains(r.Note, "XTerm") {
 		t.Fatalf("%+v", r)
 	}
 	log, _ := os.ReadFile(filepath.Join(bin, "log"))
 	if !strings.Contains(string(log), "xprop -id 0x3c00012 -f _NET_WM_WINDOW_OPACITY 32c -set _NET_WM_WINDOW_OPACITY 2147483648 DISPLAY=:1") {
 		t.Fatalf("xprop was asked:\n%s", log)
 	}
 }
 func TestWithoutASessionTheToolsThatDrawSaySo(t *testing.T) {
 	fakeMachine(t)
 	if _, err := WindowOpacity("", -1); !errors.Is(err, ErrNoSession) {
 		t.Fatalf("window opacity: %v", err)
 	}
 	on := true
 	if _, err := Toggle(&on); !errors.Is(err, ErrNoSession) {
 		t.Fatalf("toggle on: %v", err)
 	}
 }
 func TestARunningPicomIsToldToReinitialiseNotRestarted(t *testing.T) {
 	fakeMachine(t)
 	fakeProcess(t, nobody, "picom", "DISPLAY=:1")
 	r, err := Restart(false)
 	if err != nil || r.Action != "reinitialised" {
 		t.Fatalf("%+v, %v", r, err)
 	}
 	on := true
 	if r, err := Toggle(&on); err != nil || !r.Compositing || r.PIDs[0] != nobody {
 		t.Fatalf("on while running: %+v, %v", r, err)
 	}
 }
@@ -1,423 +0,0 @@
 // The operator's graphical session, as a tool the node's runtime runs finds it (novox/hq ADR 0208).
 //
 // The runtime is a system service running as the operator account (ADR 0175): it has the account's
 // uid and none of the session's environment — no DISPLAY, no XAUTHORITY, no session bus. A tool that
 // draws on the screen or talks to the desktop's D-Bus must find them. It reads them from a process of
 // the account that is part of the session (the window manager first), the same thing `loginctl` and
 // a person's own shell would point at, and says where it found them.
 //
 // Long-lived programs a tool starts go to the account's own service manager through `systemd-run
 // --user`, never as children of the tool: the runtime's unit is a cgroup the service manager empties
 // whenever the runtime restarts, and a compositor or a clipboard owner started from inside it would
 // die with it.
 //
 // This file is the same in every desktop module that carries it; it moves into the Go SDK once a
 // second consumer outside the desktop wants it.
 package main
 import (
 	"bytes"
 	"errors"
 	"fmt"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"sort"
 	"strconv"
 	"strings"
 	"syscall"
 	"time"
 )
 // Where the session is looked for. Variables so a test can point them at a fake tree.
 var (
 	procRoot   = "/proc"
 	runUserDir = "/run/user"
 	x11Sockets = "/tmp/.X11-unix"
 )
 // sessionHolders are the processes whose environment is the session's, best first: the window
 // manager is the session, the rest are its children. Anything else carrying DISPLAY ranks after them.
 var sessionHolders = []string{"i3", "sway", "i3bar", "picom", "xss-lock", "dunst", "clipmenud", "xterm"}
 // sessionKeys are the variables a session carries that a tool hands on to what it runs.
 var sessionKeys = []string{"DISPLAY", "XAUTHORITY", "WAYLAND_DISPLAY", "DBUS_SESSION_BUS_ADDRESS",
 	"XDG_RUNTIME_DIR", "XDG_SESSION_ID", "I3SOCK"}
 // Session is what a tool needs to reach the operator's desktop.
 type Session struct {
 	UID        int    `json:"uid"`
 	Display    string `json:"display,omitempty"`
 	XAuthority string `json:"xauthority,omitempty"`
 	Wayland    string `json:"wayland_display,omitempty"`
 	Bus        string `json:"bus,omitempty"`
 	RuntimeDir string `json:"runtime_dir,omitempty"`
 	SessionID  string `json:"session_id,omitempty"`
 	I3Sock     string `json:"i3sock,omitempty"`
 	// From says where the values were found: the tool's own environment, a process, or the socket.
 	From string `json:"from"`
 }
 // ErrNoSession is answered by a tool that needs the desktop when nobody is logged in to it.
 var ErrNoSession = errors.New("no graphical session")
 // ErrTimedOut is what run answers for a command ended because it ran past its time.
 var ErrTimedOut = errors.New("timed out")
 // ErrNoBus is answered by a tool that needs the session bus when the account has none.
 var ErrNoBus = errors.New("no session bus")
 // operatorHome is the account's home: what the runtime was told, else the process's own.
 func operatorHome() string {
 	if h := strings.TrimSpace(os.Getenv("MESH_OPERATOR_HOME")); h != "" {
 		return h
 	}
 	h, _ := os.UserHomeDir()
 	return h
 }
 // findSession finds the graphical session of the account this tool runs as, or answers
 // ErrNoSession with what it looked at.
 func findSession() (Session, error) {
 	s := findEnvironment()
 	if s.Display == "" && s.Wayland == "" {
 		return s, fmt.Errorf("%w for uid %d on this machine: no process of the account carries DISPLAY "+
 			"or WAYLAND_DISPLAY, and no X server socket in %s has an authority file to go with it. "+
 			"Is anyone logged in to the desktop?", ErrNoSession, s.UID, x11Sockets)
 	}
 	return s, nil
 }
 // findBus finds the account's session bus, which a logged-in account has whether or not a desktop
 // is running.
 func findBus() (Session, error) {
 	s := findEnvironment()
 	if s.Bus == "" {
 		return s, fmt.Errorf("%w for uid %d: DBUS_SESSION_BUS_ADDRESS is not set and %s does not exist "+
 			"(the account is not logged in)", ErrNoBus, s.UID, filepath.Join(runUserDir, strconv.Itoa(s.UID), "bus"))
 	}
 	return s, nil
 }
 func findEnvironment() Session {
 	uid := os.Getuid()
 	s := Session{UID: uid}
 	own := map[string]string{}
 	for _, k := range sessionKeys {
 		own[k] = os.Getenv(k)
 	}
 	if own["DISPLAY"] != "" || own["WAYLAND_DISPLAY"] != "" {
 		s.fill(own)
 		s.From = "the tool's own environment"
 	} else if pid, comm, env, ok := sessionProcess(uid); ok {
 		s.fill(env)
 		s.From = fmt.Sprintf("process %s (pid %d)", comm, pid)
 	} else if display, ok := lonelyX11Socket(); ok {
 		if a := filepath.Join(operatorHome(), ".Xauthority"); exists(a) {
 			s.Display, s.XAuthority = display, a
 			s.From = "the X server socket and the account's ~/.Xauthority"
 		}
 		s.fill(own)
 	} else {
 		s.fill(own)
 		s.From = "nothing: no session found"
 	}
 	// The bus and the runtime directory are the account's, whether or not the process named them.
 	runtime := filepath.Join(runUserDir, strconv.Itoa(uid))
 	if s.RuntimeDir == "" && exists(runtime) {
 		s.RuntimeDir = runtime
 	}
 	if s.Bus == "" && s.RuntimeDir != "" && exists(filepath.Join(s.RuntimeDir, "bus")) {
 		s.Bus = "unix:path=" + filepath.Join(s.RuntimeDir, "bus")
 	}
 	return s
 }
 func (s *Session) fill(env map[string]string) {
 	set := func(dst *string, key string) {
 		if *dst == "" {
 			*dst = env[key]
 		}
 	}
 	set(&s.Display, "DISPLAY")
 	set(&s.XAuthority, "XAUTHORITY")
 	set(&s.Wayland, "WAYLAND_DISPLAY")
 	set(&s.Bus, "DBUS_SESSION_BUS_ADDRESS")
 	set(&s.RuntimeDir, "XDG_RUNTIME_DIR")
 	set(&s.SessionID, "XDG_SESSION_ID")
 	set(&s.I3Sock, "I3SOCK")
 }
 // sessionProcess is the best process of this uid whose environment names a display.
 func sessionProcess(uid int) (int, string, map[string]string, bool) {
 	entries, err := os.ReadDir(procRoot)
 	if err != nil {
 		return 0, "", nil, false
 	}
 	type candidate struct {
 		pid  int
 		comm string
 		env  map[string]string
 		rank int
 	}
 	var found []candidate
 	for _, e := range entries {
 		pid, err := strconv.Atoi(e.Name())
 		if err != nil {
 			continue
 		}
 		dir := filepath.Join(procRoot, e.Name())
 		if owner, ok := ownerOf(dir); !ok || owner != uid {
 			continue
 		}
 		raw, err := os.ReadFile(filepath.Join(dir, "environ"))
 		if err != nil {
 			continue
 		}
 		env := parseEnviron(raw)
 		if env["DISPLAY"] == "" && env["WAYLAND_DISPLAY"] == "" {
 			continue
 		}
 		comm := readTrimmed(filepath.Join(dir, "comm"))
 		rank := len(sessionHolders)
 		for i, h := range sessionHolders {
 			if h == comm {
 				rank = i
 				break
 			}
 		}
 		found = append(found, candidate{pid, comm, env, rank})
 	}
 	if len(found) == 0 {
 		return 0, "", nil, false
 	}
 	sort.Slice(found, func(i, j int) bool {
 		if found[i].rank != found[j].rank {
 			return found[i].rank < found[j].rank
 		}
 		return found[i].pid > found[j].pid // the newer of two equals
 	})
 	best := found[0]
 	return best.pid, best.comm, best.env, true
 }
 func parseEnviron(raw []byte) map[string]string {
 	env := map[string]string{}
 	for _, kv := range bytes.Split(raw, []byte{0}) {
 		if i := bytes.IndexByte(kv, '='); i > 0 {
 			env[string(kv[:i])] = string(kv[i+1:])
 		}
 	}
 	return env
 }
 func ownerOf(path string) (int, bool) {
 	info, err := os.Stat(path)
 	if err != nil {
 		return 0, false
 	}
 	st, ok := info.Sys().(*syscall.Stat_t)
 	if !ok {
 		return 0, false
 	}
 	return int(st.Uid), true
 }
 // lonelyX11Socket is the display of the one X server socket there is, when there is exactly one.
 func lonelyX11Socket() (string, bool) {
 	entries, err := os.ReadDir(x11Sockets)
 	if err != nil {
 		return "", false
 	}
 	var displays []string
 	for _, e := range entries {
 		if n := strings.TrimPrefix(e.Name(), "X"); n != e.Name() {
 			if _, err := strconv.Atoi(n); err == nil {
 				displays = append(displays, ":"+n)
 			}
 		}
 	}
 	if len(displays) != 1 {
 		return "", false
 	}
 	return displays[0], true
 }
 func readTrimmed(path string) string {
 	b, err := os.ReadFile(path)
 	if err != nil {
 		return ""
 	}
 	return strings.TrimSpace(string(b))
 }
 func exists(path string) bool {
 	_, err := os.Stat(path)
 	return err == nil
 }
 // Env is this process's environment with the session's variables in place of its own.
 func (s Session) Env() []string {
 	drop := map[string]bool{}
 	for _, k := range sessionKeys {
 		drop[k] = true
 	}
 	var env []string
 	for _, kv := range os.Environ() {
 		if i := strings.IndexByte(kv, '='); i > 0 && drop[kv[:i]] {
 			continue
 		}
 		env = append(env, kv)
 	}
 	add := func(k, v string) {
 		if v != "" {
 			env = append(env, k+"="+v)
 		}
 	}
 	add("DISPLAY", s.Display)
 	add("XAUTHORITY", s.XAuthority)
 	add("WAYLAND_DISPLAY", s.Wayland)
 	add("DBUS_SESSION_BUS_ADDRESS", s.Bus)
 	add("XDG_RUNTIME_DIR", s.RuntimeDir)
 	add("XDG_SESSION_ID", s.SessionID)
 	add("I3SOCK", s.I3Sock)
 	return env
 }
 // mostOutput bounds what a command may answer with, per stream.
 const mostOutput = 256 << 10
 // Result is what a command did.
 type Result struct {
 	Stdout    string `json:"stdout"`
 	Stderr    string `json:"stderr,omitempty"`
 	Code      int    `json:"code"`
 	Truncated bool   `json:"truncated,omitempty"`
 }
 // run runs a command in the session's environment, its input given, ended with everything it
 // started after timeout. A command that is not installed is an error naming it; one that exits
 // non-zero is a Result with its code, for the caller to judge.
 func (s Session) run(timeout time.Duration, stdin string, name string, args ...string) (Result, error) {
 	path, err := exec.LookPath(name)
 	if err != nil {
 		return Result{}, fmt.Errorf("%s is not installed on this machine", name)
 	}
 	cmd := exec.Command(path, args...)
 	cmd.Env = s.Env()
 	if home := operatorHome(); exists(home) {
 		cmd.Dir = home
 	}
 	if stdin != "" {
 		cmd.Stdin = strings.NewReader(stdin)
 	}
 	var out, errOut capped
 	cmd.Stdout, cmd.Stderr = &out, &errOut
 	cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
 	if err := cmd.Start(); err != nil {
 		return Result{}, fmt.Errorf("%s: %w", name, err)
 	}
 	done := make(chan error, 1)
 	go func() { done <- cmd.Wait() }()
 	select {
 	case err = <-done:
 	case <-time.After(timeout):
 		_ = syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL)
 		<-done
 		return Result{Stdout: out.String(), Stderr: errOut.String()},
 			fmt.Errorf("%s did not finish within %s and was ended: %w", name, timeout, ErrTimedOut)
 	}
 	r := Result{Stdout: out.String(), Stderr: errOut.String(), Truncated: out.cut || errOut.cut}
 	var exit *exec.ExitError
 	if errors.As(err, &exit) {
 		r.Code = exit.ExitCode()
 	} else if err != nil {
 		return r, fmt.Errorf("%s: %w", name, err)
 	}
 	return r, nil
 }
 // detach starts a long-lived program under the account's own service manager, as a transient unit
 // that carries the session's display, so it outlives the runtime that asked for it. A unit already
 // running under the same name is stopped first, so a fixed name means "at most one".
 func (s Session) detach(unit string, args ...string) error {
 	if s.RuntimeDir == "" {
 		return fmt.Errorf("%w: the account's runtime directory is missing, so its service manager "+
 			"cannot be reached", ErrNoBus)
 	}
 	_, _ = s.run(5*time.Second, "", "systemctl", "--user", "stop", unit+".service")
 	call := []string{"--user", "--collect", "--quiet", "--unit=" + unit}
 	for _, kv := range [][2]string{{"DISPLAY", s.Display}, {"XAUTHORITY", s.XAuthority},
 		{"WAYLAND_DISPLAY", s.Wayland}, {"XDG_SESSION_ID", s.SessionID}, {"I3SOCK", s.I3Sock}} {
 		if kv[1] != "" {
 			call = append(call, "--setenv="+kv[0]+"="+kv[1])
 		}
 	}
 	call = append(call, "--")
 	call = append(call, args...)
 	r, err := s.run(10*time.Second, "", "systemd-run", call...)
 	if err != nil {
 		return err
 	}
 	if r.Code != 0 {
 		return fmt.Errorf("systemd-run %s: %s", unit, strings.TrimSpace(r.Stderr))
 	}
 	return nil
 }
 // uniqueUnit is a transient unit name that will not collide with an earlier one.
 func uniqueUnit(prefix string) string {
 	return fmt.Sprintf("%s-%d", prefix, time.Now().UnixNano())
 }
 type capped struct {
 	bytes.Buffer
 	cut bool
 }
 func (c *capped) Write(p []byte) (int, error) {
 	if room := mostOutput - c.Len(); room < len(p) {
 		if room > 0 {
 			c.Buffer.Write(p[:room])
 		}
 		c.cut = true
 		return len(p), nil
 	}
 	return c.Buffer.Write(p)
 }
 // processesOf are the pids of this uid's processes whose command name is comm, oldest first.
 func processesOf(comm string) []int {
 	entries, err := os.ReadDir(procRoot)
 	if err != nil {
 		return nil
 	}
 	uid := os.Getuid()
 	var pids []int
 	for _, e := range entries {
 		pid, err := strconv.Atoi(e.Name())
 		if err != nil {
 			continue
 		}
 		dir := filepath.Join(procRoot, e.Name())
 		if owner, ok := ownerOf(dir); !ok || owner != uid {
 			continue
 		}
 		if readTrimmed(filepath.Join(dir, "comm")) == comm {
 			pids = append(pids, pid)
 		}
 	}
 	sort.Ints(pids)
 	return pids
 }
 // signalAll sends sig to every process of this uid named comm, and answers the pids it reached.
 func signalAll(comm string, sig syscall.Signal) []int {
 	var reached []int
 	for _, pid := range processesOf(comm) {
 		if syscall.Kill(pid, sig) == nil {
 			reached = append(reached, pid)
 		}
 	}
 	return reached
 }
@@ -1,174 +0,0 @@
 package main
 import (
 	"errors"
 	"os"
 	"path/filepath"
 	"strconv"
 	"strings"
 	"testing"
 	"time"
 )
 // fakeMachine points the session finder at a temporary /proc, /run/user and X socket directory, with
 // none of the test process's own session variables, and gives back the root.
 func fakeMachine(t *testing.T) string {
 	t.Helper()
 	root := t.TempDir()
 	procRoot, runUserDir, x11Sockets = filepath.Join(root, "proc"), filepath.Join(root, "run-user"), filepath.Join(root, "x11")
 	for _, d := range []string{procRoot, runUserDir, x11Sockets} {
 		if err := os.MkdirAll(d, 0o755); err != nil {
 			t.Fatal(err)
 		}
 	}
 	for _, k := range sessionKeys {
 		t.Setenv(k, "")
 	}
 	t.Setenv("MESH_OPERATOR_HOME", filepath.Join(root, "home"))
 	t.Cleanup(func() { procRoot, runUserDir, x11Sockets = "/proc", "/run/user", "/tmp/.X11-unix" })
 	return root
 }
 func fakeProcess(t *testing.T, pid int, comm string, env ...string) {
 	t.Helper()
 	dir := filepath.Join(procRoot, strconv.Itoa(pid))
 	if err := os.MkdirAll(dir, 0o755); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.WriteFile(filepath.Join(dir, "comm"), []byte(comm+"\n"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.WriteFile(filepath.Join(dir, "environ"), []byte(strings.Join(env, "\x00")+"\x00"), 0o600); err != nil {
 		t.Fatal(err)
 	}
 }
 func TestTheSessionIsReadFromTheWindowManagerBeforeAnyOtherProcess(t *testing.T) {
 	fakeMachine(t)
 	fakeProcess(t, 900, "xterm", "DISPLAY=:9", "XAUTHORITY=/elsewhere")
 	fakeProcess(t, 100, "i3", "DISPLAY=:1", "XAUTHORITY=/home/op/.Xauthority",
 		"DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus", "XDG_SESSION_ID=3", "SECRET_TOKEN=never-copied")
 	fakeProcess(t, 50, "bash", "PATH=/usr/bin")
 	s, err := findSession()
 	if err != nil {
 		t.Fatal(err)
 	}
 	if s.Display != ":1" || s.XAuthority != "/home/op/.Xauthority" || s.SessionID != "3" || !strings.Contains(s.From, "i3 (pid 100)") {
 		t.Fatalf("the window manager's environment: %+v", s)
 	}
 	for _, kv := range s.Env() {
 		if strings.HasPrefix(kv, "SECRET_TOKEN=") {
 			t.Fatal("a variable of the session process that is not a session variable was handed on")
 		}
 	}
 }
 func TestAnyProcessCarryingADisplayServesWhenTheWindowManagerIsNotFound(t *testing.T) {
 	fakeMachine(t)
 	fakeProcess(t, 10, "firefox", "DISPLAY=:0")
 	fakeProcess(t, 20, "firefox", "DISPLAY=:2")
 	s, err := findSession()
 	if err != nil || s.Display != ":2" {
 		t.Fatalf("the newest of two equals: %+v, %v", s, err)
 	}
 }
 func TestNoSessionIsAClearAnswerNotAGuess(t *testing.T) {
 	fakeMachine(t)
 	fakeProcess(t, 10, "sshd", "PATH=/usr/bin")
 	_, err := findSession()
 	if !errors.Is(err, ErrNoSession) || !strings.Contains(err.Error(), "logged in to the desktop") {
 		t.Fatalf("no session: %v", err)
 	}
 }
 func TestOneXSocketAndTheAccountsAuthorityFileAreASession(t *testing.T) {
 	root := fakeMachine(t)
 	if err := os.WriteFile(filepath.Join(x11Sockets, "X0"), nil, 0o644); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.MkdirAll(filepath.Join(root, "home"), 0o755); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.WriteFile(filepath.Join(root, "home", ".Xauthority"), nil, 0o600); err != nil {
 		t.Fatal(err)
 	}
 	s, err := findSession()
 	if err != nil || s.Display != ":0" || !strings.HasSuffix(s.XAuthority, "/home/.Xauthority") {
 		t.Fatalf("socket and authority: %+v, %v", s, err)
 	}
 }
 func TestTheBusIsTheAccountsRuntimeDirectoryWhenNoProcessNamesIt(t *testing.T) {
 	fakeMachine(t)
 	runtime := filepath.Join(runUserDir, strconv.Itoa(os.Getuid()))
 	if _, err := findBus(); !errors.Is(err, ErrNoBus) {
 		t.Fatalf("no runtime directory is no bus: %v", err)
 	}
 	if err := os.MkdirAll(runtime, 0o700); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.WriteFile(filepath.Join(runtime, "bus"), nil, 0o600); err != nil {
 		t.Fatal(err)
 	}
 	s, err := findBus()
 	if err != nil || s.Bus != "unix:path="+filepath.Join(runtime, "bus") || s.RuntimeDir != runtime {
 		t.Fatalf("bus: %+v, %v", s, err)
 	}
 	env := strings.Join(s.Env(), "\n")
 	if !strings.Contains(env, "XDG_RUNTIME_DIR="+runtime) || !strings.Contains(env, "DBUS_SESSION_BUS_ADDRESS=unix:path=") {
 		t.Fatalf("the bus is handed on: %s", env)
 	}
 }
 func TestACommandIsBoundedAndANonZeroExitIsAResult(t *testing.T) {
 	fakeMachine(t)
 	s := Session{}
 	r, err := s.run(5*time.Second, "in", "sh", "-c", "cat; echo err >&2; exit 3")
 	if err != nil || r.Stdout != "in" || r.Code != 3 || strings.TrimSpace(r.Stderr) != "err" {
 		t.Fatalf("result: %+v, %v", r, err)
 	}
 	start := time.Now()
 	if _, err := s.run(200*time.Millisecond, "", "sh", "-c", "sleep 30 & sleep 30"); err == nil || time.Since(start) > 5*time.Second {
 		t.Fatalf("a command past its time is ended with what it started: %v after %s", err, time.Since(start))
 	}
 	if _, err := s.run(time.Second, "", "no-such-program-here"); err == nil || !strings.Contains(err.Error(), "not installed") {
 		t.Fatalf("a missing program: %v", err)
 	}
 }
 func TestDetachAsksTheAccountsServiceManagerWithTheSessionsDisplay(t *testing.T) {
 	fakeMachine(t)
 	bin := fakeBinaries(t, map[string]string{
 		"systemctl":   `echo "systemctl $*" >> "$LOG"`,
 		"systemd-run": `echo "systemd-run $*" >> "$LOG"`,
 	})
 	log := filepath.Join(bin, "log")
 	t.Setenv("LOG", log)
 	s := Session{Display: ":1", XAuthority: "/x", RuntimeDir: "/run/user/1"}
 	if err := s.detach("picom-session", "picom", "--config", "/c"); err != nil {
 		t.Fatal(err)
 	}
 	got, _ := os.ReadFile(log)
 	want := "systemctl --user stop picom-session.service\n" +
 		"systemd-run --user --collect --quiet --unit=picom-session --setenv=DISPLAY=:1 --setenv=XAUTHORITY=/x -- picom --config /c\n"
 	if string(got) != want {
 		t.Fatalf("detach ran:\n%s\nwant:\n%s", got, want)
 	}
 	if err := (Session{}).detach("x", "y"); !errors.Is(err, ErrNoBus) {
 		t.Fatalf("no runtime directory: %v", err)
 	}
 }
 // fakeBinaries puts shell scripts named for programs first on PATH, and answers their directory.
 func fakeBinaries(t *testing.T, scripts map[string]string) string {
 	t.Helper()
 	dir := t.TempDir()
 	for name, body := range scripts {
 		if err := os.WriteFile(filepath.Join(dir, name), []byte("#!/bin/sh\n"+body+"\n"), 0o755); err != nil {
 			t.Fatal(err)
 		}
 	}
 	t.Setenv("PATH", dir+string(os.PathListSeparator)+os.Getenv("PATH"))
 	return dir
 }
@@ -1,32 +0,0 @@
 # picom, the X compositor (module picom, novox/hq ADR 0208). Owned by the mesh: this file is
 # replaced at every push. Adopted from the two workstations' file of 2026-10-04 and moved to
 # picom's window rules, which supersede opacity-rule, inactive-opacity and inactive-dim.
 backend = "glx";
 vsync = true;
 fading = true;
 fade-in-step = 0.05;
 fade-out-step = 0.05;
 # Tiled windows hide their shadows and corners, so neither is drawn.
 shadow = false;
 corner-radius = 0;
 blur-method = "none";
 # "Focused" is i3's _NET_ACTIVE_WINDOW, not X focus events: under i3 those do not reliably reach
 # the toplevel picom tracks, and a terminal then never lifts to its focused opacity.
 use-ewmh-active-win = true;
 # Window rules are applied in order, and a later match wins. Only terminals are translucent:
 # nothing else on screen (browsers, video, games) is touched. A terminal is matched by its class;
 # the node's terminal emulator today is xterm (class XTerm). A window's own opacity property is
 # used wherever no rule sets one, which is what the window-opacity tool sets.
 rules = (
  { match = "window_type = 'tooltip'"; fade = false; opacity = 0.95; },
  { match = "window_type = 'dock' || window_type = 'desktop'"; fade = false; },
  { match = "class_g = 'XTerm' && focused"; opacity = 0.95; },
  { match = "class_g = 'XTerm' && !focused"; opacity = 0.75; },
  # A full-screen window is opaque, a terminal included: a video or a game is never see-through.
  { match = "fullscreen"; opacity = 1; }
 );
@@ -1,5 +0,0 @@
 module picom
 go 1.22
 require git.novox.be/novox/mesh-sdk/go v0.1.7
@@ -1,2 +0,0 @@
 git.novox.be/novox/mesh-sdk/go v0.1.7 h1:C0sTQmtTiyYH7bnqZb7PusXnqA37gKuT7Nqjn9gG47w=
 git.novox.be/novox/mesh-sdk/go v0.1.7/go.mod h1:GFuZUElBZ9A++mxgIKo97aXXo+kV0uJ/UkbhQPPIbrY=
@@ -1,64 +0,0 @@
 {
  "module": "picom",
  "version": "1",
  "capabilities": [
    "package-manager"
  ],
  "requires": [
    "x11-display"
  ],
  "claims": [
    {
      "name": "node-compositor",
      "scope": "node"
    }
  ],
  "tools": [
    "picom_restart",
    "picom_rules",
    "picom_window_opacity",
    "picom_toggle"
  ],
  "resources": [
    {
      "id": "package",
      "type": "package",
      "package": "picom"
    },
    {
      "id": "window-properties",
      "type": "package",
      "package": "xorg-xprop"
    },
    {
      "id": "configuration-dir",
      "type": "directory",
      "path": "${machine:account-home}/.config/picom",
      "owner": "${machine:account}",
      "mode": "0755"
    },
    {
      "id": "configuration",
      "type": "file",
      "path": "${machine:account-home}/.config/picom/picom.conf",
      "owner": "${machine:account}",
      "mode": "0644",
      "content": "# picom, the X compositor (module picom, novox/hq ADR 0208). Owned by the mesh: this file is\n# replaced at every push. Adopted from the two workstations' file of 2026-10-04 and moved to\n# picom's window rules, which supersede opacity-rule, inactive-opacity and inactive-dim.\n\nbackend = \"glx\";\nvsync = true;\n\nfading = true;\nfade-in-step = 0.05;\nfade-out-step = 0.05;\n\n# Tiled windows hide their shadows and corners, so neither is drawn.\nshadow = false;\ncorner-radius = 0;\nblur-method = \"none\";\n\n# \"Focused\" is i3's _NET_ACTIVE_WINDOW, not X focus events: under i3 those do not reliably reach\n# the toplevel picom tracks, and a terminal then never lifts to its focused opacity.\nuse-ewmh-active-win = true;\n\n# Window rules are applied in order, and a later match wins. Only terminals are translucent:\n# nothing else on screen (browsers, video, games) is touched. A terminal is matched by its class;\n# the node's terminal emulator today is xterm (class XTerm). A window's own opacity property is\n# used wherever no rule sets one, which is what the window-opacity tool sets.\nrules = (\n  { match = \"window_type = 'tooltip'\"; fade = false; opacity = 0.95; },\n  { match = \"window_type = 'dock' || window_type = 'desktop'\"; fade = false; },\n  { match = \"class_g = 'XTerm' && focused\"; opacity = 0.95; },\n  { match = \"class_g = 'XTerm' && !focused\"; opacity = 0.75; },\n  # A full-screen window is opaque, a terminal included: a video or a game is never see-through.\n  { match = \"fullscreen\"; opacity = 1; }\n);\n"
    }
  ],
  "build": {
    "artifacts": [
      {
        "name": "tools",
        "kind": "bundle",
        "language": "go",
        "system": "arch",
        "from": "cmd/picom-tools",
        "binary": "picom-tools",
        "loads": [
          "picom-tools"
        ]
      }
    ]
  }
 }
@@ -1,88 +0,0 @@
 # rofi
 The launcher as a module (novox/hq ADR 0208, research 026/04 and 05).
 - Installs `rofi`, claims the mesh's `node-launcher` seat and serves its verb `menu`. Requires
  `x11-display` on its own machine.
 - **The seat's dmenu-compatible command.** It places `~/.local/bin/dmenu`: choices on standard input,
  the chosen one on standard output, exit 1 when nothing was chosen. It runs `rofi -dmenu`, passing
  on dmenu's `-p`, `-l` and `-i` and dropping its look options. A script, a notifier or a clipboard
  manager calls `dmenu` and works whichever module holds the seat. On a node where the `dmenu` module
  holds `node-launcher` instead, the real dmenu answers the same calls.
 - Owns `~/.config/rofi/config.rasi` and the themes `mesh` and `mesh-powermenu` in
  `~/.config/rofi/themes/`. The faces are JetBrains Mono Nerd Font for the list and the input, and
  Inter for messages. Both are packages of the `fonts` module.
 - Places its key bindings as its own i3 drop-in, `~/.config/i3/config.d/50-rofi.conf`. The `i3`
  module's configuration includes that directory after it sets `$mod`.
 - Starts nothing. rofi runs when a key is pressed.
 | key | runs |
 |---|---|
 | `$mod+d` | applications (`rofi-launch drun`) |
 | `$mod+t` | a command (`rofi-launch run`) |
 | `$mod+Shift+t` | a command with sudo, in the terminal (`rofi-launch sudo`) |
 | `$mod+Shift+w` | the window switcher (`rofi-launch window`) |
 | `$mod+Escape` | the power menu (`rofi-powermenu`) |
 ## The power menu is here
 The power menu belongs to the session. It is still the launcher's, because all of it is rofi: its
 theme, its buttons and its confirmation. Every action it takes is a verb of logind or the service
 manager, so it names no window manager and no locker:
 - **lock** is `loginctl lock-session`, which the holder of `node-lock-screen` answers;
 - **log out** is `loginctl terminate-session`;
 - **suspend, reboot and shut down** are `systemctl`'s.
 A Wayland session gets the same menu from whichever launcher holds the seat there.
 ## Tools
 | tool | does |
 |---|---|
 | `node-launcher.menu` | show a list in the operator's session and answer the chosen line and its index, or `cancelled` (also when nobody answers within the timeout, 20 s by default, 25 s at most) |
 | `rofi_applications` | the desktop entries the launcher offers, the account's own winning an id; filter by words, hidden ones on request |
 | `rofi_themes` | every theme (the mesh's, the account's, the distribution's) and the one configured |
 | `rofi_run` | start a desktop entry or a command in the session, under the account's service manager |
 ## What it improves on what was found
 - **Plain `dmenu` calls work again.** The one found on 2026-10-04 is the notifier's context menu: on
  both workstations it called `/usr/bin/dmenu`, which neither had installed. The `dunst` module now
  calls `dmenu`, and this module answers it. The operator's own scripts all call `rofi -dmenu`, which
  keeps working.
 - **The theme is one file per face.** There is no colour file imported from a cloned theme
  repository. The faces are the decided ones (research 026/04): Iosevka and Hack are gone.
 - **The retry after resume no longer reopens a closed menu.** The found launchers retried
  `rofi -dmenu` on any failure, so pressing Escape in the sudo prompt reopened it four times.
  `rofi-launch` retries only a failure within half a second, which is a failed keyboard grab.
 - **The power menu locks through logind,** so it goes through the one locker. The found one ran
  `i3lock` directly and bypassed it. Log out no longer names four window managers.
 - `icon-theme` and `window-command` are gone. They named an icon theme and a program (`wmctrl`) that
  nothing installs. rofi's defaults serve.
 ## What it leaves as found
 - `~/.config/rofi/themes-repo/` (a cloned theme repository), the five symbolic links into it
  (`applets`, `images`, `launchers`, `powermenu`, `scripts`), `colors/`, `theme.rasi` and
  `powermenu.rasi`.
 - The predecessor's scripts in `~/scripts`: `rofi-launcher-normal`, `rofi-launcher-terminal`,
  `rofi-launcher-terminal-sudo` and `powermenu` (replaced here), and `theme-picker` with its modes
  (settings, once issue 168 closes).
 ## Migration (ADR 0182)
 Once the `i3` module carries the main i3 configuration:
 1. Delete `~/.config/rofi/theme.rasi`, `powermenu.rasi`, `colors/`, the five links and `themes-repo/`.
   Nothing reads them any more.
 2. Delete the four scripts above from `~/scripts`.
 3. Your scripts that call `rofi -dmenu` keep working. Calling `dmenu` instead lets them follow the
   seat, for example to a Wayland launcher later.
 ## Blockers
 - `node-launcher`, `x11-display` and the `i3` drop-in directory are ADR 0208's and the `i3`
  module's. Until the controller knows the seat, `mctl` reads the claim as unknown.
 - `~/.local/bin` is on `PATH` through the `zsh` module's environment contribution (ADR 0203). The
  key bindings name `~/.local/bin/…` in full, so they do not depend on it. Callers of `dmenu` do.
@@ -1,97 +0,0 @@
 // Reading a tool's arguments: JSON numbers arrive as float64, and a missing argument is its default.
 // The same in every desktop module that carries it.
 package main
 import (
 	"fmt"
 	"math"
 	"strings"
 	"time"
 )
 // text is a string argument, trimmed; required says an empty one is refused.
 func text(args map[string]any, key string, required bool) (string, error) {
 	v, present := args[key]
 	if !present || v == nil {
 		if required {
 			return "", fmt.Errorf("%s is required", key)
 		}
 		return "", nil
 	}
 	s, ok := v.(string)
 	if !ok {
 		return "", fmt.Errorf("%s is a string, not %T", key, v)
 	}
 	s = strings.TrimSpace(s)
 	if s == "" && required {
 		return "", fmt.Errorf("%s is required", key)
 	}
 	return s, nil
 }
 // whole is a whole-number argument within [least, most], or def when absent.
 func whole(args map[string]any, key string, def, least, most int) (int, error) {
 	v, present := args[key]
 	if !present || v == nil {
 		return def, nil
 	}
 	f, ok := v.(float64)
 	if !ok {
 		if i, isInt := v.(int); isInt {
 			f = float64(i)
 		} else {
 			return 0, fmt.Errorf("%s is a number, not %T", key, v)
 		}
 	}
 	if f != math.Trunc(f) {
 		return 0, fmt.Errorf("%s is a whole number, not %v", key, f)
 	}
 	n := int(f)
 	if n < least || n > most {
 		return 0, fmt.Errorf("%s is %d; it is between %d and %d", key, n, least, most)
 	}
 	return n, nil
 }
 // flag is a boolean argument, or def when absent.
 func flag(args map[string]any, key string, def bool) (bool, error) {
 	v, present := args[key]
 	if !present || v == nil {
 		return def, nil
 	}
 	b, ok := v.(bool)
 	if !ok {
 		return false, fmt.Errorf("%s is true or false, not %T", key, v)
 	}
 	return b, nil
 }
 // texts is a list-of-strings argument.
 func texts(args map[string]any, key string) ([]string, error) {
 	v, present := args[key]
 	if !present || v == nil {
 		return nil, nil
 	}
 	list, ok := v.([]any)
 	if !ok {
 		if ss, isStrings := v.([]string); isStrings {
 			return ss, nil
 		}
 		return nil, fmt.Errorf("%s is a list of strings, not %T", key, v)
 	}
 	out := make([]string, 0, len(list))
 	for i, item := range list {
 		s, ok := item.(string)
 		if !ok {
 			return nil, fmt.Errorf("%s[%d] is a string, not %T", key, i, item)
 		}
 		out = append(out, s)
 	}
 	return out, nil
 }
 // seconds is a timeout argument in seconds, defaulted and bounded below the runtime's call limit.
 func seconds(args map[string]any, key string, def, most int) (time.Duration, error) {
 	n, err := whole(args, key, def, 1, most)
 	return time.Duration(n) * time.Second, err
 }
--- a/Show More
+++ b/Show More
		`@@ -1,2 +0,0 @@`
			`git.novox.be/novox/mesh-sdk/go v0.1.7 h1:C0sTQmtTiyYH7bnqZb7PusXnqA37gKuT7Nqjn9gG47w=`
			`git.novox.be/novox/mesh-sdk/go v0.1.7/go.mod h1:GFuZUElBZ9A++mxgIKo97aXXo+kV0uJ/UkbhQPPIbrY=`
		`@@ -0,0 +1,2 @@`
							`git.novox.be/novox/mesh-sdk/go v0.1.6 h1:9qzdYONYbJdWcu6sxQcq9v1LI0JxcfkiKYkMUzJSkVQ=`
							`git.novox.be/novox/mesh-sdk/go v0.1.6/go.mod h1:GFuZUElBZ9A++mxgIKo97aXXo+kV0uJ/UkbhQPPIbrY=`