Pin mesh-sdk feat/1126-nodes-compose 03dce12, the group's head: the checker refuses a pin that is neither trunk nor the group's head (issue 1126)

One commit for the branch feat/1126-nodes-compose of mesh-catalog: its 15 commits squashed so its history does not carry two compiled programs committed by mistake and removed later, mesh-config (5.5 MB) and checks/placement (6.2 MB) (issue 1577). The tree equals the former head 2db56067. The operator allowed this rewrite of the feature branch on 2026-10-26.

.gitignore

@@ -8,14 +8,13 @@ modules/messenger/cmd/messenger/messenger
 modules/mesh-watcher/cmd/mesh-watcher/mesh-watcher
 modules/claude-code/cmd/claude-code/claude-code
 modules/dnsmasq/cmd/dnsmasq-tools/dnsmasq-tools
-modules/mesh-delivery/cmd/mesh-delivery/mesh-delivery
 # ...and the same built from the module's root (go build ./cmd/<name>), which names it after the module.
 modules/messenger/messenger
 modules/claude-code/claude-code
 modules/mesh-watcher/mesh-watcher
 modules/dnsmasq/dnsmasq
-modules/mesh-delivery/mesh-delivery
 modules/mesh-issues/cmd/mesh-issues/mesh-issues
+modules/mesh-issues/mesh-issues
 modules/mounts/cmd/mounts/mounts
 modules/mesh-knowledge/cmd/mesh-knowledge/mesh-knowledge
 modules/mesh-knowledge/mesh-knowledge
@@ -26,3 +25,19 @@ modules/mesh-files/cmd/mesh-files/mesh-files
 
 # The provisioner client built in place (issue 671).
 modules/mesh-provisioner-client/cmd/mesh-provisioner-client/mesh-provisioner-client
+modules/brother/cmd/brother/brother
+modules/mesh-build-go/cmd/mesh-build-go/mesh-build-go
+modules/mesh-config/mesh-config
+modules/mesh-build-image/cmd/mesh-build-image/mesh-build-image
+*.test
+
+# binaries a local go build leaves in a module root
+/checks/paths/paths
+/modules/mesh-build-go/mesh-build-go
+/modules/mesh-delivery-gate/mesh-delivery-gate
+modules/mesh-config/cmd/mesh-config/mesh-config
+checks/placement/placement
+
+# Built by their modules' build step (issue 1577), never committed.
+modules/forticlient/cmd/forticlient-tools/forticlient-tools
+modules/networkmanager/uplink-tools

checks/agenthome/reads-outside

@@ -0,0 +1 @@
+These tests read files outside this directory (the whole catalogue, the repository, or its root files): mesh-build-go never keeps this package's verdict (issue 1935).

checks/config/go.mod

@@ -1,3 +1,7 @@
 module git.novox.be/novox/mesh-catalog/checks/config
 
 go 1.22
+
+require git.novox.be/novox/mesh-catalog/checks/trunk v0.0.0
+
+replace git.novox.be/novox/mesh-catalog/checks/trunk => ../trunk

checks/config/main.go

@@ -110,7 +110,7 @@ func Check(root string) (map[string][]string, error) {
 // The modules taking a whole layer were found after the list was first written and before the trunk held a copy
 // (issue 735), so they stand in it too.
 var seed = map[string]bool{
-	"betterbird": true, "fail2ban": true, "influxdb": true, "keycloak": true, "mailu": true, "searxng": true,
+	"fail2ban": true, "influxdb": true, "keycloak": true, "mailu": true, "searxng": true,
 	"baserow": true, "confluence": true, "gitea": true, "gitlab": true, "grafana": true, "home-assistant": true,
 	"icecast": true, "jira": true, "letta": true, "matrix": true, "nodered": true, "supabase": true, "unifi": true,
 }

checks/config/reads-outside

@@ -0,0 +1 @@
+These tests read files outside this directory (the whole catalogue, the repository, or its root files): mesh-build-go never keeps this package's verdict (issue 1935).

checks/config/realtree_test.go

@@ -0,0 +1,33 @@
+package main
+
+import (
+	"path/filepath"
+	"testing"
+
+	"git.novox.be/novox/mesh-catalog/checks/trunk"
+)
+
+// The script's comparison of this list with the trunk's (novox/hq ADR 0529 clause 2): the list of modules not yet moved gains none
+// the trunk's copy at the merge base does not hold. The catalogue itself is judged against the list by
+// TestTheCatalogueSaysConfigInEveryMovedModule. Skipped, and said, where no trunk is beside.
+func TestTheUnmovedListHoldsNoModuleTheTrunksDoesNot(t *testing.T) {
+	path, ok := trunk.Copy(t, "checks/config/unmoved")
+	found, err := Check(filepath.Join("..", ".."))
+	if err != nil {
+		t.Fatal(err)
+	}
+	unmoved, err := Unmoved("unmoved")
+	if err != nil {
+		t.Fatal(err)
+	}
+	base := seed
+	if ok {
+		if base, err = Unmoved(path); err != nil {
+			t.Fatal(err)
+		}
+	}
+	_, _, added := Judge(found, unmoved, base)
+	for _, m := range added {
+		t.Errorf("checks/config/unmoved gains %s, which the trunk's copy does not hold: the list only shrinks", m)
+	}
+}

checks/deps/reads-outside

@@ -0,0 +1 @@
+These tests read files outside this directory (the whole catalogue, the repository, or its root files): mesh-build-go never keeps this package's verdict (issue 1935).

checks/health/go.mod

@@ -0,0 +1,5 @@
+module checks/health
+
+go 1.26.0
+
+require git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468

checks/health/go.sum

@@ -0,0 +1,2 @@
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468 h1:UcMee+IV2ii5E4dRZdQUaSaeh9IedTFYumuQbBiB0k0=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=

checks/health/health.go

@@ -0,0 +1,70 @@
+// Package health is the catalogue's count of long-running resources that do not say how they are ready (novox/hq ADR 0240 rule
+// 8), kept in health-undeclared and judged by a test over the real tree (ADR 0529 clauses 2 and 4): it replaces the step of
+// merge-check.sh that read it out of the controller's `module check`. Every manifest is read through mesh-sdk's catalogue
+// package, the one the controller counts with.
+package health
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+	"strconv"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// Count is the long-running resources without `health` of every module under root/modules.
+func Count(root string) (int, error) {
+	manifests, err := filepath.Glob(filepath.Join(root, "modules", "*", "module.json"))
+	if err != nil {
+		return 0, err
+	}
+	sort.Strings(manifests)
+	if len(manifests) == 0 {
+		return 0, fmt.Errorf("no manifest under %s: the count would be zero for any catalogue", filepath.Join(root, "modules"))
+	}
+	n := 0
+	for _, path := range manifests {
+		m, err := catalogue.ReadTreeManifest(root, filepath.Dir(path))
+		if err != nil {
+			return 0, fmt.Errorf("%s: %w", path, err)
+		}
+		n += len(catalogue.Undeclared(m))
+	}
+	return n, nil
+}
+
+// Kept is the number the file keeps: the first number of its first line.
+func Kept(path string) (int, error) {
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		return 0, err
+	}
+	first, _, _ := strings.Cut(string(raw), "\n")
+	digits := ""
+	for _, r := range strings.TrimSpace(first) {
+		if r < '0' || r > '9' {
+			break
+		}
+		digits += string(r)
+	}
+	n, err := strconv.Atoi(digits)
+	if err != nil {
+		return 0, fmt.Errorf("%s does not begin with the number it keeps: %q", path, first)
+	}
+	return n, nil
+}
+
+// Judge says what is wrong with a count against the kept number; empty when they agree. It only goes down: a rise is refused,
+// and a fall asks the new number written in health-undeclared, so the count cannot rise again.
+func Judge(kept, counted int) string {
+	switch {
+	case counted > kept:
+		return fmt.Sprintf("the long-running resources without health rose from %d to %d: declare how each new one is ready (ADR 0240 rule 8)", kept, counted)
+	case counted < kept:
+		return fmt.Sprintf("the long-running resources without health fell from %d to %d: write %d in health-undeclared, so the count cannot rise again", kept, counted, counted)
+	}
+	return ""
+}

checks/health/health_test.go

@@ -0,0 +1,88 @@
+package health
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func aCatalogue(t *testing.T, manifests map[string]string) string {
+	t.Helper()
+	root := t.TempDir()
+	for module, body := range manifests {
+		dir := filepath.Join(root, "modules", module)
+		if err := os.MkdirAll(dir, 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(filepath.Join(dir, "module.json"), []byte(body), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	return root
+}
+
+// A service that stays up and does not say how it is ready is counted; one that says, and a file, are not.
+func TestOnlyALongRunningResourceWithoutHealthIsCounted(t *testing.T) {
+	root := aCatalogue(t, map[string]string{
+		"quiet": `{"module":"quiet","resources":[{"id":"svc","type":"service","unit":"quiet.service","state":"running"}]}`,
+		"says": `{"module":"says","resources":[{"id":"svc","type":"service","unit":"says.service","state":"running",` +
+			`"health":{"kind":"unit"}}]}`,
+		"file": `{"module":"file","resources":[{"id":"cfg","type":"file","path":"/etc/file.conf","content":"x"}]}`,
+	})
+	counted, err := Count(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if counted != 1 {
+		t.Fatalf("counted %d, wanted the one quiet service", counted)
+	}
+}
+
+func TestTheCountMayOnlyGoDown(t *testing.T) {
+	for _, c := range []struct {
+		kept, counted int
+		says          string
+	}{
+		{58, 58, ""},
+		{58, 59, "rose from 58 to 59"},
+		{58, 57, "fell from 58 to 57"},
+	} {
+		got := Judge(c.kept, c.counted)
+		if (c.says == "") != (got == "") || !strings.Contains(got, c.says) {
+			t.Errorf("kept %d counted %d: %q, wanted %q", c.kept, c.counted, got, c.says)
+		}
+	}
+}
+
+func TestTheKeptCountIsTheFirstNumberOfTheFile(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "health-undeclared")
+	if err := os.WriteFile(path, []byte("58\nThe long-running resources ...\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if n, err := Kept(path); err != nil || n != 58 {
+		t.Fatalf("%d %v", n, err)
+	}
+	if err := os.WriteFile(path, []byte("many\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := Kept(path); err == nil {
+		t.Fatal("a file with no number gave a count")
+	}
+}
+
+// The script's `module check` run over the real tree (novox/hq ADR 0240 rule 8, ADR 0529 clause 2 and 4): the long-running
+// resources that do not say how they are ready, counted as the controller counts them, are the number health-undeclared keeps.
+func TestTheCatalogueSaysHowItsLongRunningResourcesAreReady(t *testing.T) {
+	kept, err := Kept(filepath.Join("..", "..", "health-undeclared"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	counted, err := Count(filepath.Join("..", ".."))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if say := Judge(kept, counted); say != "" {
+		t.Fatal(say)
+	}
+}

checks/health/reads-outside

@@ -0,0 +1 @@
+These tests read files outside this directory (the whole catalogue, the repository, or its root files): mesh-build-go never keeps this package's verdict (issue 1935).

checks/imagebuild/go.mod

@@ -0,0 +1,3 @@
+module git.novox.be/novox/mesh-catalog/checks/imagebuild
+
+go 1.22

checks/imagebuild/main.go

@@ -0,0 +1,92 @@
+// Command imagebuild refuses any manifest but modules/buildah providing the rootless-image-build provision
+// (novox/hq ADR 0487 §3, issue 1704): the image builder's tool is buildah alone, and docker, whose daemon holds
+// the machine's root, never stands in for it. A second provider would let a node compose mesh-build-image over
+// something that is not the rootless builder it was designed against.
+//
+//	go run . <catalogue root>
+//
+// Exits 1 on a finding.
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+)
+
+// Provision is the provision only Provider may provide.
+const Provision = "rootless-image-build"
+
+// Provider is the one module allowed to provide it.
+const Provider = "buildah"
+
+// Finding is one manifest refused: a module other than buildah providing the provision.
+type Finding struct {
+	Module string
+}
+
+// Check reads every manifest under root/modules and answers which ones it refuses, and whether buildah provides.
+func Check(root string) ([]Finding, error) {
+	manifests, err := filepath.Glob(filepath.Join(root, "modules", "*", "module.json"))
+	if err != nil {
+		return nil, err
+	}
+	sort.Strings(manifests)
+	var out []Finding
+	provided := false
+	for _, path := range manifests {
+		raw, err := os.ReadFile(path)
+		if err != nil {
+			return nil, err
+		}
+		var m struct {
+			Module   string `json:"module"`
+			Provides []struct {
+				Name string `json:"name"`
+			} `json:"provides"`
+		}
+		if err := json.Unmarshal(raw, &m); err != nil {
+			return nil, fmt.Errorf("%s: %w", path, err)
+		}
+		for _, p := range m.Provides {
+			if p.Name != Provision {
+				continue
+			}
+			if m.Module == Provider {
+				provided = true
+			} else {
+				out = append(out, Finding{Module: m.Module})
+			}
+			break
+		}
+	}
+	if !provided {
+		out = append(out, Finding{Module: Provider})
+	}
+	return out, nil
+}
+
+func main() {
+	root := "."
+	if len(os.Args) > 1 {
+		root = os.Args[1]
+	}
+	found, err := Check(root)
+	if err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+	for _, f := range found {
+		if f.Module == Provider {
+			fmt.Printf("%s does not provide %s (novox/hq ADR 0487 §3)\n", Provider, Provision)
+			continue
+		}
+		fmt.Printf("%s provides %s: only %s may, and docker never (novox/hq ADR 0487 §3)\n", f.Module, Provision, Provider)
+	}
+	if len(found) > 0 {
+		os.Exit(1)
+	}
+	fmt.Println("imagebuild: rootless-image-build is provided only by buildah")
+}

checks/imagebuild/main_test.go

@@ -0,0 +1,74 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"reflect"
+	"testing"
+)
+
+func catalogue(t *testing.T, manifests map[string]string) string {
+	t.Helper()
+	root := t.TempDir()
+	for name, body := range manifests {
+		dir := filepath.Join(root, "modules", name)
+		if err := os.MkdirAll(dir, 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(filepath.Join(dir, "module.json"), []byte(body), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	return root
+}
+
+const buildah = `{"module":"buildah","provides":[{"name":"rootless-image-build","reach":"machine"}]}`
+
+func TestOnlyBuildahProvidesTheRootlessImageBuild(t *testing.T) {
+	root := catalogue(t, map[string]string{"buildah": buildah, "go": `{"module":"go","provides":[{"name":"go-toolchain"}]}`})
+	got, err := Check(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 0 {
+		t.Errorf("found %v, want none", got)
+	}
+}
+
+func TestDockerAndAnySecondProviderAreRefused(t *testing.T) {
+	root := catalogue(t, map[string]string{
+		"buildah": buildah,
+		"docker":  `{"module":"docker","provides":[{"name":"rootless-image-build"}]}`,
+		"other":   `{"module":"other","provides":[{"name":"x"},{"name":"rootless-image-build"}]}`,
+	})
+	got, err := Check(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := []Finding{{Module: "docker"}, {Module: "other"}}
+	if !reflect.DeepEqual(got, want) {
+		t.Errorf("found %v, want %v", got, want)
+	}
+}
+
+func TestBuildahMustProvideIt(t *testing.T) {
+	root := catalogue(t, map[string]string{"buildah": `{"module":"buildah"}`})
+	got, err := Check(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if want := []Finding{{Module: "buildah"}}; !reflect.DeepEqual(got, want) {
+		t.Errorf("found %v, want %v", got, want)
+	}
+}
+
+// The catalogue as it stands: this is the check itself, run here too.
+func TestTheCatalogueGivesTheProvisionToBuildahAlone(t *testing.T) {
+	got, err := Check("../..")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 0 {
+		t.Errorf("the catalogue's providers of rootless-image-build are wrong: %v", got)
+	}
+}

checks/imagebuild/reads-outside

@@ -0,0 +1 @@
+These tests read files outside this directory (the whole catalogue, the repository, or its root files): mesh-build-go never keeps this package's verdict (issue 1935).

checks/imageplace/go.mod

@@ -0,0 +1,3 @@
+module git.novox.be/novox/mesh-catalog/checks/imageplace
+
+go 1.22

checks/imageplace/main.go

@@ -0,0 +1,91 @@
+// Command imageplace refuses an image artifact whose Dockerfile is not a file inside its own module's directory
+// (novox/hq ADR 0487 §1, issue 1707): the image builder builds a module from that module's directory alone, so
+// a `from` that leaves it (../other/Dockerfile) or names a file that is not there could never build.
+//
+//	go run . <catalogue root>
+//
+// Exits 1 on a finding.
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+)
+
+// Finding is one image refused: Module's artifact Artifact names From, and Why says what is wrong with it.
+type Finding struct {
+	Module, Artifact, From, Why string
+}
+
+// Check reads every manifest under root/modules and answers which images it refuses.
+func Check(root string) ([]Finding, error) {
+	manifests, err := filepath.Glob(filepath.Join(root, "modules", "*", "module.json"))
+	if err != nil {
+		return nil, err
+	}
+	sort.Strings(manifests)
+	var out []Finding
+	for _, path := range manifests {
+		raw, err := os.ReadFile(path)
+		if err != nil {
+			return nil, err
+		}
+		var m struct {
+			Module string `json:"module"`
+			Build  struct {
+				Artifacts []struct {
+					Name string `json:"name"`
+					Kind string `json:"kind"`
+					From string `json:"from"`
+				} `json:"artifacts"`
+			} `json:"build"`
+		}
+		if err := json.Unmarshal(raw, &m); err != nil {
+			return nil, fmt.Errorf("%s: %w", path, err)
+		}
+		dir := filepath.Dir(path)
+		for _, a := range m.Build.Artifacts {
+			if a.Kind != "image" {
+				continue
+			}
+			f := Finding{Module: m.Module, Artifact: a.Name, From: a.From}
+			clean := filepath.Clean(a.From)
+			switch {
+			case a.From == "" || filepath.IsAbs(clean) || clean == ".." || strings.HasPrefix(clean, ".."+string(filepath.Separator)):
+				f.Why = "is not a path inside the module's own directory"
+			default:
+				info, err := os.Stat(filepath.Join(dir, clean))
+				if err != nil || info.IsDir() {
+					f.Why = "is not a file in the module's directory"
+				}
+			}
+			if f.Why != "" {
+				out = append(out, f)
+			}
+		}
+	}
+	return out, nil
+}
+
+func main() {
+	root := "."
+	if len(os.Args) > 1 {
+		root = os.Args[1]
+	}
+	found, err := Check(root)
+	if err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+	for _, f := range found {
+		fmt.Printf("%s: image %s builds from %q, which %s (novox/hq ADR 0487 §1)\n", f.Module, f.Artifact, f.From, f.Why)
+	}
+	if len(found) > 0 {
+		os.Exit(1)
+	}
+	fmt.Println("imageplace: every image builds from a Dockerfile in its own module's directory")
+}

checks/imageplace/main_test.go

@@ -0,0 +1,84 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"reflect"
+	"testing"
+)
+
+// module writes modules/<name>/module.json with one image artifact from `from`, and the files named.
+func module(t *testing.T, root, name, from string, files ...string) {
+	t.Helper()
+	dir := filepath.Join(root, "modules", name)
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	body := `{"module":"` + name + `","build":{"artifacts":[{"name":"server","kind":"image","from":"` + from + `"},{"name":"files","kind":"archive","from":"../elsewhere"}]}}`
+	if err := os.WriteFile(filepath.Join(dir, "module.json"), []byte(body), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	for _, f := range files {
+		p := filepath.Join(dir, f)
+		if err := os.MkdirAll(filepath.Dir(p), 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(p, []byte("FROM scratch\n"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+}
+
+func TestADockerfileInTheModulesOwnDirectoryPasses(t *testing.T) {
+	root := t.TempDir()
+	module(t, root, "own", "Dockerfile", "Dockerfile")
+	module(t, root, "nested", "image/Dockerfile", "image/Dockerfile")
+	got, err := Check(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 0 {
+		t.Errorf("found %v, want none", got)
+	}
+}
+
+func TestADockerfileOutsideTheModulesDirectoryFails(t *testing.T) {
+	root := t.TempDir()
+	module(t, root, "other", "Dockerfile", "Dockerfile")
+	module(t, root, "leaves", "../other/Dockerfile")
+	module(t, root, "absolute", "/etc/Dockerfile")
+	got, err := Check(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var mods []string
+	for _, f := range got {
+		mods = append(mods, f.Module)
+	}
+	if want := []string{"absolute", "leaves"}; !reflect.DeepEqual(mods, want) {
+		t.Errorf("refused %v (%v), want %v", mods, got, want)
+	}
+}
+
+func TestAMissingDockerfileFails(t *testing.T) {
+	root := t.TempDir()
+	module(t, root, "gone", "Dockerfile")
+	got, err := Check(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 1 || got[0].Module != "gone" {
+		t.Errorf("found %v, want gone refused", got)
+	}
+}
+
+// The catalogue as it stands: this is the check itself, run here too.
+func TestTheCataloguesImagesBuildFromTheirOwnDirectories(t *testing.T) {
+	got, err := Check("../..")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 0 {
+		t.Errorf("an image builds from outside its module: %v", got)
+	}
+}

checks/imageplace/reads-outside

@@ -0,0 +1 @@
+These tests read files outside this directory (the whole catalogue, the repository, or its root files): mesh-build-go never keeps this package's verdict (issue 1935).

checks/locks/go.mod

@@ -0,0 +1,3 @@
+module git.novox.be/novox/mesh-catalog/checks/locks
+
+go 1.22

checks/locks/main.go

@@ -0,0 +1,105 @@
+// Command locks refuses a TypeScript module that names packages beyond the SDK in its package.json and commits no
+// package-lock.json (novox/hq ADR 0469 §5, issue 1868): the Node build module installs a module's own packages only
+// from its committed lock, so such a module is refused by the builder and could not be delivered.
+//
+//	go run . <catalogue root>
+//
+// Exits 1 on a finding. The packages that count are those the build module counts (mesh-build-node fetch.go
+// ownDependencies): the `dependencies` beyond the SDK, typescript and the @types packages.
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+)
+
+// Finding is one module refused: it names Packages beyond the SDK and has no lock file.
+type Finding struct {
+	Module   string
+	Packages []string
+}
+
+// Check reads every module under root/modules that builds a TypeScript artifact.
+func Check(root string) ([]Finding, error) {
+	manifests, err := filepath.Glob(filepath.Join(root, "modules", "*", "module.json"))
+	if err != nil {
+		return nil, err
+	}
+	sort.Strings(manifests)
+	var out []Finding
+	for _, path := range manifests {
+		raw, err := os.ReadFile(path)
+		if err != nil {
+			return nil, err
+		}
+		var m struct {
+			Module string `json:"module"`
+			Build  struct {
+				Artifacts []struct {
+					Language string `json:"language"`
+				} `json:"artifacts"`
+			} `json:"build"`
+		}
+		if err := json.Unmarshal(raw, &m); err != nil {
+			return nil, fmt.Errorf("%s: %w", path, err)
+		}
+		typescript := false
+		for _, a := range m.Build.Artifacts {
+			typescript = typescript || a.Language == "typescript"
+		}
+		if !typescript {
+			continue
+		}
+		dir := filepath.Dir(path)
+		pkgRaw, err := os.ReadFile(filepath.Join(dir, "package.json"))
+		if os.IsNotExist(err) {
+			continue
+		}
+		if err != nil {
+			return nil, err
+		}
+		var pkg struct {
+			Dependencies map[string]json.RawMessage `json:"dependencies"`
+		}
+		if err := json.Unmarshal(pkgRaw, &pkg); err != nil {
+			return nil, fmt.Errorf("%s: package.json: %w", m.Module, err)
+		}
+		var names []string
+		for n := range pkg.Dependencies {
+			if n != "@novox/mesh-sdk" && n != "typescript" && !strings.HasPrefix(n, "@types/") {
+				names = append(names, n)
+			}
+		}
+		if len(names) == 0 {
+			continue
+		}
+		if _, err := os.Stat(filepath.Join(dir, "package-lock.json")); err != nil {
+			sort.Strings(names)
+			out = append(out, Finding{Module: m.Module, Packages: names})
+		}
+	}
+	return out, nil
+}
+
+func main() {
+	root := "."
+	if len(os.Args) > 1 {
+		root = os.Args[1]
+	}
+	found, err := Check(root)
+	if err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+	for _, f := range found {
+		fmt.Printf("%s names packages beyond the SDK (%s) and has no package-lock.json: commit one made by the build module's toolchain (novox/hq ADR 0469 §5)\n", f.Module, strings.Join(f.Packages, ", "))
+	}
+	if len(found) > 0 {
+		os.Exit(1)
+	}
+	fmt.Println("locks: every TypeScript module that names packages beyond the SDK commits its lock")
+}

checks/locks/main_test.go

@@ -0,0 +1,75 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"reflect"
+	"testing"
+)
+
+// module writes modules/<name> with a TypeScript artifact, the package.json given ("" for none) and, when lock, a lock.
+func module(t *testing.T, root, name, language, pkg string, lock bool) {
+	t.Helper()
+	dir := filepath.Join(root, "modules", name)
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	write := func(file, body string) {
+		if err := os.WriteFile(filepath.Join(dir, file), []byte(body), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	write("module.json", `{"module":"`+name+`","build":{"artifacts":[{"name":"tools","kind":"bundle","language":"`+language+`","from":"index.ts"}]}}`)
+	if pkg != "" {
+		write("package.json", pkg)
+	}
+	if lock {
+		write("package-lock.json", "{}")
+	}
+}
+
+const sdkOnly = `{"dependencies":{"@novox/mesh-sdk":"^0.1.1"},"devDependencies":{"typescript":"^5","@types/node":"^22"}}`
+const withPg = `{"dependencies":{"@novox/mesh-sdk":"^0.1.1","pg":"^8","@types/pg":"^8"}}`
+
+func TestAModuleNamingOnlyTheSDKNeedsNoLock(t *testing.T) {
+	root := t.TempDir()
+	module(t, root, "plain", "typescript", sdkOnly, false)
+	module(t, root, "none", "typescript", "", false)
+	got, err := Check(root)
+	if err != nil || len(got) != 0 {
+		t.Fatalf("%v %v", got, err)
+	}
+}
+
+func TestAModuleNamingMorePackagesWithoutALockIsRefusedNamingThem(t *testing.T) {
+	root := t.TempDir()
+	module(t, root, "db", "typescript", withPg, false)
+	module(t, root, "db-locked", "typescript", withPg, true)
+	got, err := Check(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if want := []Finding{{Module: "db", Packages: []string{"pg"}}}; !reflect.DeepEqual(got, want) {
+		t.Fatalf("got %v, want %v", got, want)
+	}
+}
+
+func TestAModuleThatIsNotTypeScriptIsNotJudged(t *testing.T) {
+	root := t.TempDir()
+	module(t, root, "go", "go", withPg, false)
+	if got, err := Check(root); err != nil || len(got) != 0 {
+		t.Fatalf("%v %v", got, err)
+	}
+}
+
+// The script's run of this check over the real tree (novox/hq ADR 0529 clause 2): every TypeScript module that names packages
+// beyond the SDK commits its lock.
+func TestTheCatalogueCommitsTheLocksItNeeds(t *testing.T) {
+	found, err := Check("../..")
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, f := range found {
+		t.Errorf("%s names packages beyond the SDK (%v) and has no package-lock.json: commit one made by the build module's toolchain (novox/hq ADR 0469 §5)", f.Module, f.Packages)
+	}
+}

checks/locks/reads-outside

@@ -0,0 +1 @@
+These tests read files outside this directory (the whole catalogue, the repository, or its root files): mesh-build-go never keeps this package's verdict (issue 1935).

checks/mailstore/reads-outside

@@ -0,0 +1 @@
+These tests read files outside this directory (the whole catalogue, the repository, or its root files): mesh-build-go never keeps this package's verdict (issue 1935).

checks/nobinaries/go.mod

@@ -0,0 +1,3 @@
+module git.novox.be/novox/mesh-catalog/checks/nobinaries
+
+go 1.22

checks/nobinaries/nobinaries.go

@@ -0,0 +1,78 @@
+// Package nobinaries refuses a compiled program under modules/ (issue 1577): it is build output, made by the module's build step,
+// and `go build` in a module's folder writes one beside go.mod where `git add -A` takes it.
+package nobinaries
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+)
+
+// Kind says what executable format the first bytes of a file are, or "" when they are none.
+func Kind(head []byte) string {
+	switch {
+	case bytes.HasPrefix(head, []byte("\x7fELF")):
+		return "ELF"
+	case bytes.HasPrefix(head, []byte("MZ")):
+		return "PE"
+	case bytes.HasPrefix(head, []byte{0xcf, 0xfa, 0xed, 0xfe}), bytes.HasPrefix(head, []byte{0xce, 0xfa, 0xed, 0xfe}),
+		bytes.HasPrefix(head, []byte{0xfe, 0xed, 0xfa, 0xcf}), bytes.HasPrefix(head, []byte{0xfe, 0xed, 0xfa, 0xce}),
+		bytes.HasPrefix(head, []byte{0xca, 0xfe, 0xba, 0xbe}) && len(head) >= 8 && head[7] < 0x20 && head[6] == 0 && head[5] == 0 && head[4] == 0:
+		return "Mach-O"
+	}
+	return ""
+}
+
+// Files are the files of the catalogue's root that the change holds under modules/: the tracked ones when the root is a git
+// checkout (an ignored binary a local build left is not the change's), else every file there.
+func Files(root string) ([]string, error) {
+	cmd := exec.Command("git", "-C", root, "ls-files", "-z", "--", "modules")
+	if out, err := cmd.Output(); err == nil && len(out) > 0 {
+		var files []string
+		for _, f := range strings.Split(strings.TrimRight(string(out), "\x00"), "\x00") {
+			if _, err := os.Lstat(filepath.Join(root, f)); err == nil { // a file the change deletes is not there
+				files = append(files, f)
+			}
+		}
+		return files, nil
+	}
+	var files []string
+	err := filepath.WalkDir(filepath.Join(root, "modules"), func(p string, d os.DirEntry, err error) error {
+		if err != nil || d.IsDir() || !d.Type().IsRegular() {
+			return err
+		}
+		rel, _ := filepath.Rel(root, p)
+		files = append(files, rel)
+		return nil
+	})
+	return files, err
+}
+
+// Find names each file of files (paths from root) that is a compiled program, with its format.
+func Find(root string, files []string) ([]string, error) {
+	var found []string
+	for _, f := range files {
+		p := filepath.Join(root, f)
+		if st, err := os.Lstat(p); err != nil || !st.Mode().IsRegular() {
+			continue
+		}
+		fh, err := os.Open(p)
+		if err != nil {
+			return nil, err
+		}
+		head := make([]byte, 8)
+		n, err := io.ReadFull(fh, head)
+		fh.Close()
+		if err != nil && err != io.ErrUnexpectedEOF && err != io.EOF {
+			return nil, err
+		}
+		if k := Kind(head[:n]); k != "" {
+			found = append(found, fmt.Sprintf("%s (%s)", f, k))
+		}
+	}
+	return found, nil
+}

checks/nobinaries/nobinaries_test.go

@@ -0,0 +1,54 @@
+package nobinaries
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestFindNamesEachCompiledProgramAndNothingElse(t *testing.T) {
+	root := t.TempDir()
+	files := map[string][]byte{
+		"modules/a/a":           []byte("\x7fELF\x02\x01\x01\x00rest"),
+		"modules/b/cmd/b/b.exe": []byte("MZ\x90\x00"),
+		"modules/c/c":           {0xcf, 0xfa, 0xed, 0xfe, 7, 0, 0, 1},
+		"modules/d/main.go":     []byte("package main\n"),
+		"modules/e/short":       []byte("\x7f"),
+		"modules/f/empty":       {},
+		"modules/g/Foo.class":   {0xca, 0xfe, 0xba, 0xbe, 0, 0, 0, 52}, // Java, not Mach-O
+	}
+	var names []string
+	for f, b := range files {
+		p := filepath.Join(root, f)
+		if err := os.MkdirAll(filepath.Dir(p), 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(p, b, 0o644); err != nil {
+			t.Fatal(err)
+		}
+		names = append(names, f)
+	}
+	got, err := Find(root, names)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 3 {
+		t.Fatalf("found %v; wanted modules/a/a, modules/b/cmd/b/b.exe and modules/c/c only", got)
+	}
+}
+
+// The catalogue's own tree holds no compiled program: a compiled program is build output, so remove it and add it to .gitignore.
+func TestTheCatalogueHoldsNoCompiledProgram(t *testing.T) {
+	root := filepath.Join("..", "..")
+	files, err := Files(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	found, err := Find(root, files)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, f := range found {
+		t.Errorf("%s: a compiled program is build output: remove it and add it to .gitignore (issue 1577)", f)
+	}
+}

checks/nobinaries/reads-outside

@@ -0,0 +1 @@
+These tests read files outside this directory (the whole catalogue, the repository, or its root files): mesh-build-go never keeps this package's verdict (issue 1935).

checks/noscripts/go.mod

@@ -0,0 +1,3 @@
+module checks/noscripts
+
+go 1.22

checks/noscripts/noscripts_test.go

@@ -0,0 +1,19 @@
+package noscripts
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// The catalogue's checks are Go tests (novox/hq ADR 0529 clause 5, ADR 0445): the checker runs every nested Go module's tests by
+// the language's convention and no script at the root says what else to run. A script back at the root would be a check nobody
+// runs (ADR 0503 §3: since R4e the checker has not run them), so it is refused.
+func TestNoScriptOfTheOldCheckStandsAtTheRoot(t *testing.T) {
+	for _, name := range []string{"merge-check.sh", "merge-check-typescript.sh", "check-nested-modules.sh"} {
+		if _, err := os.Stat(filepath.Join("..", "..", name)); !errors.Is(err, os.ErrNotExist) {
+			t.Errorf("%s stands at the catalogue's root (%v): what it ran is a Go test in checks/ or a step of the build module", name, err)
+		}
+	}
+}

checks/noscripts/reads-outside

@@ -0,0 +1 @@
+These tests read files outside this directory (the whole catalogue, the repository, or its root files): mesh-build-go never keeps this package's verdict (issue 1935).

checks/owned/go.mod

@@ -1,3 +1,7 @@
 module git.novox.be/novox/mesh-catalog/checks/owned
 
 go 1.22
+
+require git.novox.be/novox/mesh-catalog/checks/trunk v0.0.0
+
+replace git.novox.be/novox/mesh-catalog/checks/trunk => ../trunk

checks/owned/main.go

@@ -11,13 +11,23 @@
 //     another module, after ${dir:<id>} is resolved within each module and both homes are read as one root.
 //     Archives are not containers for this rule. This holds for ~/.ssh what checks/sshdir held (ADR 0415 §6).
 //
-//     go run . <catalogue root>
+//  5. a directory that is, lies inside or holds a directory a system package owns under /var/lib, or any other
+//     resource inside one (issue 1841: pacman's state directory, placed with "place": ".", was /var/lib/pacman, the
+//     package manager's own database directory). A placed directory is resolved as the mesh resolves it with the
+//     default data root: "." is /var/lib/<module>, "mesh" /var/lib/mesh/<module>, neither /var/lib/<module>/<id>.
+//     The system directories are checks/owned/system, captured from a machine (pacman -Qo, /usr/lib/tmpfiles.d);
+//     checks/owned/system-known names the exceptions still to fix, by module, resource and issue. That list only
+//     shrinks: an entry that no longer collides is refused, and with -base one the trunk's copy does not hold.
+//
+//     go run . [-base <trunk's system-known>] <catalogue root>
 //
 // Exits 1 on a finding.
 package main
 
 import (
 	"encoding/json"
+	"errors"
+	"flag"
 	"fmt"
 	"os"
 	"path"
@@ -27,6 +37,12 @@ import (
 	"strings"
 )
 
+// The lists of rule 5, relative to the catalogue's root.
+const (
+	SystemList  = "checks/owned/system"
+	SystemKnown = "checks/owned/system-known"
+)
+
 // Home is the one root both machine homes are read as.
 const Home = "${home}"
 
@@ -43,9 +59,9 @@ type Finding struct {
 }
 
 type resource struct {
-	ID, Type, Path, Unknown string
-	Knows                   []string
-	HasKnows                bool
+	ID, Type, Path, Unknown, Place string
+	Knows                          []string
+	HasKnows                       bool
 }
 
 type parsed struct {
@@ -65,6 +81,7 @@ func load(file string) (*parsed, error) {
 			ID      string   `json:"id"`
 			Type    string   `json:"type"`
 			Path    string   `json:"path"`
+			Place   string   `json:"place"`
 			Unknown *string  `json:"unknown"`
 			Knows   []string `json:"knows"`
 		} `json:"resources"`
@@ -81,7 +98,7 @@ func load(file string) (*parsed, error) {
 		out.Module = filepath.Base(filepath.Dir(file))
 	}
 	for _, r := range m.Resources {
-		x := resource{ID: r.ID, Type: r.Type, Path: r.Path, Knows: r.Knows, HasKnows: r.Knows != nil}
+		x := resource{ID: r.ID, Type: r.Type, Path: r.Path, Place: r.Place, Knows: r.Knows, HasKnows: r.Knows != nil}
 		if r.Unknown != nil {
 			x.Unknown = *r.Unknown
 			if x.Unknown == "" {
@@ -143,14 +160,23 @@ type declared struct {
 }
 
 // Check reads every manifest under root/modules and answers what it refuses.
-func Check(root string) ([]Finding, error) {
+func Check(root string, base []string) ([]Finding, error) {
 	files, err := filepath.Glob(filepath.Join(root, "modules", "*", "module.json"))
 	if err != nil {
 		return nil, err
 	}
 	sort.Strings(files)
+	system, err := readSystem(filepath.Join(root, SystemList))
+	if err != nil {
+		return nil, err
+	}
+	known, err := readLines(filepath.Join(root, SystemKnown))
+	if err != nil && !errors.Is(err, os.ErrNotExist) {
+		return nil, err
+	}
 	var out []Finding
 	var paths []declared
+	collided := map[string]bool{}
 	type container struct{ module, path string }
 	var containers []container
 	for _, file := range files {
@@ -160,10 +186,17 @@ func Check(root string) ([]Finding, error) {
 		}
 		dirs := map[string]string{}
 		for _, r := range m.Resources {
-			if r.ID != "" && r.Path != "" {
+			switch {
+			case r.ID != "" && r.Path != "":
 				dirs[r.ID] = r.Path
+			case r.ID != "" && r.Type == "directory":
+				// A directory the mesh places for the module (`place`): where it lies is the node-engine's, but it is
+				// the module's own, so a path under it belongs to this module and to no other's directory of the same
+				// id (issue 1484: two runs-as modules each keep a .ssh in their own state directory).
+				dirs[r.ID] = "/placed/" + m.Module + "/" + r.ID
 			}
 		}
+		out = append(out, inSystem(m, system, known, collided)...)
 		for _, r := range m.Resources {
 			p := norm(r.Path, dirs)
 			if p != "" {
@@ -206,6 +239,28 @@ func Check(root string) ([]Finding, error) {
 			}
 		}
 	}
+	for _, k := range known {
+		if !collided[k] {
+			module, id, _ := strings.Cut(k, " ")
+			id, _, _ = strings.Cut(id, " ")
+			out = append(out, Finding{5, module, id, fmt.Sprintf("is listed in %s, and no longer lies in a system "+
+				"package's directory: take the line out, so the list only shrinks", SystemKnown)})
+		}
+	}
+	if base != nil {
+		held := map[string]bool{}
+		for _, b := range base {
+			held[b] = true
+		}
+		for _, k := range known {
+			if !held[k] {
+				module, id, _ := strings.Cut(k, " ")
+				id, _, _ = strings.Cut(id, " ")
+				out = append(out, Finding{5, module, id, fmt.Sprintf("is a new line in %s, which the trunk's copy "+
+					"does not hold: a module's directory is placed outside a system package's, never listed", SystemKnown)})
+			}
+		}
+	}
 	for _, d := range paths {
 		for _, c := range containers {
 			if c.module != d.module && (d.path == c.path || strings.HasPrefix(d.path, c.path+"/")) {
@@ -216,21 +271,140 @@ func Check(root string) ([]Finding, error) {
 	return out, nil
 }
 
-func main() {
-	root := "."
-	if len(os.Args) > 1 {
-		root = os.Args[1]
+// systemDir is one directory a system package owns, and what says so.
+type systemDir struct{ Path, Source string }
+
+// readLines is a list's lines, without comments and blank lines.
+func readLines(file string) ([]string, error) {
+	raw, err := os.ReadFile(file)
+	if err != nil {
+		return nil, err
 	}
-	found, err := Check(root)
+	var lines []string
+	for _, line := range strings.Split(string(raw), "\n") {
+		if line = strings.TrimSpace(line); line != "" && !strings.HasPrefix(line, "#") {
+			lines = append(lines, line)
+		}
+	}
+	return lines, nil
+}
+
+// readSystem is the list of system directories: "<absolute path> <package>: <how it was read>" per line. Absent or
+// empty, the check fails: a list that says nothing would let every module through.
+func readSystem(file string) ([]systemDir, error) {
+	lines, err := readLines(file)
+	if err != nil {
+		return nil, fmt.Errorf("rule 5 reads the system packages' directories from %s: %w", file, err)
+	}
+	if len(lines) == 0 {
+		return nil, fmt.Errorf("%s names no system package's directory, so rule 5 would pass everything", file)
+	}
+	var out []systemDir
+	for _, line := range lines {
+		p, source, _ := strings.Cut(line, " ")
+		if !strings.HasPrefix(p, "/var/lib/") || strings.TrimSpace(source) == "" {
+			return nil, fmt.Errorf("%s: %q is not \"/var/lib/<directory> <package>: <how it was read>\"", file, line)
+		}
+		out = append(out, systemDir{path.Clean(p), strings.TrimSpace(source)})
+	}
+	return out, nil
+}
+
+// placedAt is where the mesh places a pathless directory with the default data root (mesh-sdk catalogue dirsFor).
+func placedAt(module string, r resource) string {
+	switch r.Place {
+	case ".":
+		return "/var/lib/" + module
+	case "mesh":
+		return "/var/lib/mesh/" + module
+	}
+	return "/var/lib/" + module + "/" + r.ID
+}
+
+// inSystem is rule 5 for one module: each resource whose resolved path collides with a system package's directory,
+// unless system-known lists it (then it is marked collided, so a stale line is found).
+func inSystem(m *parsed, system []systemDir, known []string, collided map[string]bool) []Finding {
+	real := map[string]string{}
+	for _, r := range m.Resources {
+		if r.Type == "directory" && r.Path == "" && r.ID != "" {
+			real[r.ID] = placedAt(m.Module, r)
+		}
+	}
+	for _, r := range m.Resources {
+		if r.ID != "" && r.Path != "" {
+			real[r.ID] = r.Path
+		}
+	}
+	var out []Finding
+	for _, r := range m.Resources {
+		p := ""
+		if r.Path != "" {
+			p = norm(r.Path, real)
+		} else if r.Type == "directory" {
+			p = real[r.ID]
+		}
+		if !strings.HasPrefix(p, "/") {
+			continue
+		}
+		for _, s := range system {
+			inside := p == s.Path || strings.HasPrefix(p, s.Path+"/")
+			holds := r.Type == "directory" && strings.HasPrefix(s.Path, p+"/")
+			if !inside && !holds {
+				continue
+			}
+			listed := ""
+			for _, k := range known {
+				if strings.HasPrefix(k, m.Module+" "+r.ID+" ") || k == m.Module+" "+r.ID {
+					listed = k
+				}
+			}
+			if listed != "" {
+				collided[listed] = true
+				break
+			}
+			how := "is or lies inside"
+			if holds {
+				how = "holds"
+			}
+			out = append(out, Finding{5, m.Module, r.ID, fmt.Sprintf("resolves to %q, which %s %s, the directory of the "+
+				"system package %s; place it under /var/lib/mesh/%s (\"place\": \"mesh\") or a path of its own", p, how,
+				s.Path, s.Source, m.Module)})
+			break
+		}
+	}
+	return out
+}
+
+func main() {
+	baseFile := flag.String("base", "", "the trunk's copy of "+SystemKnown+": a line it does not hold is refused")
+	flag.Parse()
+	root := "."
+	if flag.NArg() > 0 {
+		root = flag.Arg(0)
+	}
+	var base []string
+	if *baseFile != "" {
+		lines, err := readLines(*baseFile)
+		if err != nil {
+			fmt.Fprintln(os.Stderr, err)
+			os.Exit(1)
+		}
+		base = append([]string{}, lines...)
+	}
+	found, err := Check(root, base)
 	if err != nil {
 		fmt.Fprintln(os.Stderr, err)
 		os.Exit(1)
 	}
 	for _, f := range found {
-		fmt.Printf("%s: %s: %s (rule %d, novox/hq ADR 0422 §8, issue 1024)\n", f.Module, f.ID, f.Why, f.Rule)
+		cite := "novox/hq ADR 0422 §8, issue 1024"
+		if f.Rule == 5 {
+			cite = "issue 1841"
+		}
+		fmt.Printf("%s: %s: %s (rule %d, %s)\n", f.Module, f.ID, f.Why, f.Rule, cite)
 	}
 	if len(found) > 0 {
 		os.Exit(1)
 	}
-	fmt.Println("owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory")
+	fmt.Println("owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory, or in a system package's")
 }

checks/owned/main_test.go

@@ -20,7 +20,10 @@ func manifest(t *testing.T, root, module, body string) {
 
 func check(t *testing.T, root string) []Finding {
 	t.Helper()
-	found, err := Check(root)
+	if _, err := os.Stat(filepath.Join(root, SystemList)); os.IsNotExist(err) {
+		lists(t, root, "/var/lib/pacman pacman: pacman -Qo\n", "")
+	}
+	found, err := Check(root, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -35,6 +38,20 @@ func only(t *testing.T, found []Finding, rule int, module, id string) {
 	}
 }
 
+// lists writes the catalogue's list of system directories and its known exceptions.
+func lists(t *testing.T, root, system, known string) {
+	t.Helper()
+	if err := os.MkdirAll(filepath.Join(root, "checks", "owned"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(root, SystemList), []byte(system), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(root, SystemKnown), []byte(known), 0o644); err != nil {
+		t.Fatal(err)
+	}
+}
+
 func dir(id, path, rest string) string {
 	return `{"id":"` + id + `","type":"directory","path":"` + path + `"` + rest + `}`
 }
@@ -130,3 +147,102 @@ func TestAnArchiveIsNotAContainerAndSameModuleIsFine(t *testing.T) {
 		t.Fatalf("refused %+v", found)
 	}
 }
+
+// Issue 1484: a directory the mesh places for a module (no path, `place`) is that module's own: another module's
+// directory of the same id, and a path under it, are not inside it.
+func TestPlacedDirectoriesOfTwoModulesAreTheirOwn(t *testing.T) {
+	root := t.TempDir()
+	for _, name := range []string{"first", "second"} {
+		manifest(t, root, name, mod(name,
+			`{"id":"state","type":"directory","place":".","unknown":"program"}`,
+			dir("ssh", "${dir:state}/.ssh", `,"unknown":"program"`),
+			`{"id":"conf","type":"file","path":"${dir:ssh}/config"}`))
+	}
+	if found := check(t, root); len(found) != 0 {
+		t.Fatalf("refused %+v", found)
+	}
+}
+
+// 1841/AC18: a module's directory that resolves to a /var/lib directory a system package owns, lies inside one or
+// holds one, is refused, whether placed (place ".", or by default beneath the module's own) or stated; a placed
+// directory saying place "mesh" lies under /var/lib/mesh and passes (issue 1841: pacman's state was /var/lib/pacman).
+func TestADirectoryOfASystemPackageIsRefused(t *testing.T) {
+	system := "/var/lib/pacman pacman: pacman -Qo\n/var/lib/systemd/coredump systemd: tmpfiles.d/systemd.conf\n"
+	for name, resources := range map[string][]string{
+		"placed-own":     {`{"id":"state","type":"directory","place":".","unknown":"program"}`},
+		"placed-beneath": {`{"id":"coredump","type":"directory","unknown":"program"}`},
+		"stated-inside":  {dir("d", "/var/lib/pacman/keeper", `,"unknown":"program"`)},
+		"stated-holding": {dir("d", "/var/lib/systemd", `,"unknown":"program"`)},
+		"file-inside": {`{"id":"state","type":"directory","place":"mesh","unknown":"program"}`,
+			`{"id":"f","type":"file","path":"/var/lib/pacman/keeper.json"}`},
+	} {
+		module := map[string]string{"placed-own": "pacman", "placed-beneath": "systemd"}[name]
+		if module == "" {
+			module = "keeper"
+		}
+		root := t.TempDir()
+		lists(t, root, system, "")
+		manifest(t, root, module, mod(module, resources...))
+		found := check(t, root)
+		if len(found) != 1 || found[0].Rule != 5 || found[0].Module != module ||
+			!strings.Contains(found[0].Why, "/var/lib/") || !strings.Contains(found[0].Why, "package") {
+			t.Errorf("%s: found %+v; want one finding of rule 5 for %s naming the path and the package", name, found, module)
+		}
+	}
+	root := t.TempDir()
+	lists(t, root, system, "")
+	manifest(t, root, "pacman", mod("pacman",
+		`{"id":"state","type":"directory","place":"mesh","unknown":"program"}`,
+		`{"id":"f","type":"file","path":"${dir:state}/keeper.json"}`,
+		dir("other", "/var/lib/pacman-other", `,"unknown":"program"`)))
+	if found := check(t, root); len(found) != 0 {
+		t.Fatalf("a directory under /var/lib/mesh/pacman was refused: %+v", found)
+	}
+}
+
+// 1841/AC18: a known exception passes; one that no longer collides is refused, so the list only shrinks; one the trunk's
+// copy does not hold is refused; and an absent list of system directories fails the check rather than passing it.
+func TestKnownSystemExceptionsOnlyShrink(t *testing.T) {
+	system := "/var/lib/systemd systemd: tmpfiles.d/systemd.conf\n"
+	known := "# comment\nsystemd state issue 1873\n"
+	root := t.TempDir()
+	lists(t, root, system, known)
+	manifest(t, root, "systemd", mod("systemd", `{"id":"state","type":"directory","place":".","unknown":"program"}`))
+	if found := check(t, root); len(found) != 0 {
+		t.Fatalf("a known exception was refused: %+v", found)
+	}
+	if found, err := Check(root, []string{"systemd state issue 1873"}); err != nil || len(found) != 0 {
+		t.Fatalf("a known exception held by the trunk was refused: %+v %v", found, err)
+	}
+	if found, err := Check(root, []string{}); err != nil || len(found) != 1 || found[0].Rule != 5 {
+		t.Fatalf("an exception the trunk does not hold passed: %+v %v", found, err)
+	}
+
+	manifest(t, root, "systemd", mod("systemd", `{"id":"state","type":"directory","place":"mesh","unknown":"program"}`))
+	only(t, check(t, root), 5, "systemd", "state")
+
+	root = t.TempDir()
+	manifest(t, root, "a", mod("a"))
+	if err := os.MkdirAll(filepath.Join(root, "checks", "owned"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(root, SystemList), []byte("# nothing\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := Check(root, nil); err == nil {
+		t.Fatal("an empty list of system directories passed")
+	}
+}
+
+// 1841/AC18: the catalogue as it stands passes rule 5 with its own lists.
+func TestTheCatalogueKeepsOutOfSystemDirectories(t *testing.T) {
+	found, err := Check("../..", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, f := range found {
+		if f.Rule == 5 {
+			t.Errorf("%s: %s: %s", f.Module, f.ID, f.Why)
+		}
+	}
+}

checks/owned/reads-outside

@@ -0,0 +1 @@
+These tests read files outside this directory (the whole catalogue, the repository, or its root files): mesh-build-go never keeps this package's verdict (issue 1935).

checks/owned/realtree_test.go

@@ -0,0 +1,41 @@
+package main
+
+import (
+	"testing"
+
+	"git.novox.be/novox/mesh-catalog/checks/trunk"
+)
+
+// The script's run of this check over the real tree (novox/hq ADR 0529 clause 2): every rule holds.
+func TestTheCatalogueKeepsEveryRuleOfOwnedPaths(t *testing.T) {
+	found, err := Check("../..", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, f := range found {
+		t.Errorf("%s: %s: %s (rule %d, novox/hq ADR 0422 §8)", f.Module, f.ID, f.Why, f.Rule)
+	}
+}
+
+// And the list of system directories' known exceptions holds no line the trunk's copy at the merge base does not (rule 5). A trunk
+// with none had no list: its first copy. Skipped, and said, where no trunk is beside.
+func TestTheSystemListHoldsNoLineTheTrunksDoesNot(t *testing.T) {
+	path, ok := trunk.Copy(t, "checks/owned/system-known")
+	var base []string
+	if ok {
+		lines, err := readLines(path)
+		if err != nil {
+			t.Fatal(err)
+		}
+		base = append([]string{}, lines...)
+	}
+	found, err := Check("../..", base)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, f := range found {
+		if f.Rule == 5 {
+			t.Errorf("%s: %s: %s (rule %d, issue 1841)", f.Module, f.ID, f.Why, f.Rule)
+		}
+	}
+}

checks/owned/system

@@ -0,0 +1,23 @@
+# The directories under /var/lib that a system package owns (rule 5 of checks/owned, issue 1841). A module's
+# directory, placed or stated, may not be one of these, lie inside one or hold one: the package's program and the
+# package manager keep their own files there, and the node-engine would judge, chmod or chown the directory.
+#
+# One line per directory: "<path> <package>: <how it was read>". Captured on the workstation on 2026-10-22, through
+# the mesh: pacman's own database by `pacman -Qo` (pacman_owns), the rest from the `d`, `D` and `Q` lines of
+# /usr/lib/tmpfiles.d (node-reads.search for "/var/lib/"). A directory found to belong to a package is added here.
+/var/lib/pacman pacman: pacman -Qo /var/lib/pacman/ (pacman 7.1.0)
+/var/lib/alsa alsa-utils: tmpfiles.d/alsa-utils.conf
+/var/lib/colord colord: tmpfiles.d/colord.conf
+/var/lib/containers podman: tmpfiles.d/podman.conf
+/var/lib/dbus dbus: tmpfiles.d/dbus.conf
+/var/lib/geoclue geoclue: tmpfiles.d/geoclue.conf
+/var/lib/lastlog util-linux: tmpfiles.d/lastlog2.conf
+/var/lib/libuuid util-linux: tmpfiles.d/uuidd.conf
+/var/lib/machines systemd: tmpfiles.d/systemd-nspawn.conf
+/var/lib/openvpn/chroot networkmanager-openvpn: tmpfiles.d/nm-openvpn-tmpfiles.conf
+/var/lib/portables systemd: tmpfiles.d/portables.conf
+/var/lib/postgres postgresql: tmpfiles.d/postgresql.conf
+/var/lib/private systemd: tmpfiles.d/systemd.conf
+/var/lib/rpcbind rpcbind: tmpfiles.d/rpcbind.conf
+/var/lib/systemd systemd: tmpfiles.d/systemd.conf
+/var/lib/tpm2-tss/system/keystore tpm2-tss: tmpfiles.d/tpm2-tss-fapi.conf

checks/owned/system-known

@@ -0,0 +1,5 @@
+# Modules whose directory lies in a system package's directory today (rule 5 of checks/owned, issue 1841), each with
+# the issue that moves it out: "<module> <resource id> issue <number>". This list only shrinks: a line whose module
+# no longer collides is refused, and so is a line the trunk's copy does not hold.
+postgres state issue 1873
+systemd state issue 1873

checks/particulars/covered

@@ -0,0 +1,3 @@
+# The modules the check covers (novox/hq ADR 0507 §9, issue 1838), one a line; issue 1838 widens it.
+pacman
+kernel

checks/particulars/go.mod

@@ -0,0 +1,3 @@
+module git.novox.be/novox/mesh-catalog/checks/particulars
+
+go 1.22

checks/particulars/main.go

@@ -0,0 +1,159 @@
+// Command particulars keeps this mesh's node names out of the modules it covers (novox/hq ADR 0507 §9,
+// issue 1838): a module is for any mesh, so no manifest, file, code string, identifier, comment, test name or
+// fixture of a covered module names a node of this one.
+//
+// The names are in the file `particulars` at the catalogue's root, one a line, `#` comments — the one place
+// they may be written. The modules covered are in `covered` at checks/particulars/covered, one a line. A name is matched
+// whole and in any case; a hyphen, an underscore or a CamelCase boundary parts one, so a longer word holding a name is another word.
+// The forge is not a node name: its host (git.novox.be) and the organisation path (novox/<repo>) are blanked
+// before a line is read.
+//
+//	go run . <catalogue root>
+//
+// Exits 1 naming file:line and the word, 2 when a list cannot be read.
+package main
+
+import (
+	"bufio"
+	"bytes"
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"regexp"
+	"sort"
+	"strings"
+)
+
+// forge is the forge's host and organisation path, blanked before a line is read; a path segment novox/ elsewhere
+// (testdata/novox/x, /srv/novox/data) is not blanked.
+var forge = regexp.MustCompile(`(?i)git\.novox\.be(?:/novox/[\w.-]+)?|(?:^|[^/\w.-])novox/[\w.-]+`)
+
+func main() {
+	root := "."
+	if len(os.Args) > 1 {
+		root = os.Args[1]
+	}
+	os.Exit(check(root))
+}
+
+// check runs the check over a catalogue and returns the exit code: 0 clean, 1 a finding, 2 a list unreadable.
+func check(root string) int {
+	names, err := readList(filepath.Join(root, "particulars"))
+	if err == nil && len(names) == 0 {
+		err = fmt.Errorf("particulars lists no name — the check would pass on anything")
+	}
+	var covered []string
+	if err == nil {
+		covered, err = readList(filepath.Join(root, "checks/particulars/covered"))
+		if err == nil && len(covered) == 0 {
+			err = fmt.Errorf("covered lists no module — the check would pass on anything")
+		}
+	}
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "particulars:", err)
+		return 2
+	}
+	findings, err := run(root, names, covered)
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "particulars:", err)
+		return 2
+	}
+	for _, f := range findings {
+		fmt.Println(f)
+	}
+	if len(findings) > 0 {
+		fmt.Printf("particulars: %d node name(s) in a module for any mesh (novox/hq ADR 0507 §9) — say what it shows, not where it was seen\n", len(findings))
+		return 1
+	}
+	fmt.Printf("particulars: none of %d node names in the %d covered modules\n", len(names), len(covered))
+	return 0
+}
+
+// readList reads a list: one entry a line; blank lines and lines starting with # are not entries.
+func readList(path string) ([]string, error) {
+	f, err := os.Open(path)
+	if err != nil {
+		return nil, err
+	}
+	defer f.Close()
+	var out []string
+	sc := bufio.NewScanner(f)
+	for sc.Scan() {
+		line := strings.TrimSpace(sc.Text())
+		if line == "" || strings.HasPrefix(line, "#") {
+			continue
+		}
+		out = append(out, line)
+	}
+	return out, sc.Err()
+}
+
+// run reads every text file of each covered module and returns the findings, sorted.
+func run(root string, names, covered []string) ([]string, error) {
+	var out []string
+	for _, m := range covered {
+		dir := filepath.Join(root, "modules", m)
+		err := filepath.WalkDir(dir, func(path string, d fs.DirEntry, err error) error {
+			if err != nil {
+				return err
+			}
+			if d.IsDir() {
+				switch d.Name() {
+				case "node_modules", "dist", "vendor", ".git":
+					return filepath.SkipDir
+				}
+				return nil
+			}
+			rel, _ := filepath.Rel(root, path)
+			// A path is read too: a testdata directory named after a node is a finding.
+			for _, n := range hits(filepath.ToSlash(rel), names) {
+				out = append(out, fmt.Sprintf("%s:0: node name %q in the path", filepath.ToSlash(rel), n))
+			}
+			if d.Name() == "go.sum" {
+				return nil
+			}
+			b, err := os.ReadFile(path)
+			if err != nil {
+				return err
+			}
+			if bytes.IndexByte(b, 0) >= 0 {
+				return nil
+			}
+			out = append(out, scan(filepath.ToSlash(rel), string(b), names)...)
+			return nil
+		})
+		if err != nil {
+			return nil, err
+		}
+	}
+	sort.Strings(out)
+	return out, nil
+}
+
+// scan returns a finding for each node name in src, whole-word and in any case.
+func scan(file, src string, names []string) []string {
+	var out []string
+	for i, line := range strings.Split(src, "\n") {
+		for _, n := range hits(line, names) {
+			out = append(out, fmt.Sprintf("%s:%d: node name %q — %s", file, i+1, n, strings.Join(strings.Fields(line), " ")))
+		}
+	}
+	return out
+}
+
+// hits returns the node names one line holds: as a word (a hyphen or underscore parts it), as a part of a
+// CamelCase identifier (TestAce, novoxTree), the forge's host and organisation path blanked first.
+func hits(line string, names []string) []string {
+	line = forge.ReplaceAllStringFunc(line, func(s string) string { return strings.Repeat(" ", len(s)) })
+	var out []string
+	for _, n := range names {
+		q := regexp.QuoteMeta(n)
+		camel := regexp.QuoteMeta(strings.ToUpper(n[:1]) + n[1:])
+		rx := regexp.MustCompile(`(?i:(?:^|[^A-Za-z0-9])` + q + `(?:$|[^A-Za-z0-9]))|[a-z0-9]` + camel + `(?:$|[^a-z])|(?:^|[^A-Za-z0-9])` + q + `[A-Z0-9]`)
+		if rx.MatchString(line) {
+			out = append(out, strings.ToLower(n))
+		}
+	}
+	return out
+}

checks/particulars/main_test.go

@@ -0,0 +1,123 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+var names = []string{"novox", "ace", "shanks", "g14"}
+
+func TestANodeNameIsRefusedWhereItIsWritten(t *testing.T) {
+	cases := map[string]struct{ file, src string }{
+		"manifest string": {"modules/kernel/module.json", "{\n \"description\": \"as on Shanks\"\n}\n"},
+		"file line":       {"modules/kernel/files/boot.sh", "#!/bin/sh\necho run on g14\n"},
+		"go identifier":   {"modules/kernel/cmd/x/a.go", "package main\n\nfunc novox() {}\n"},
+		"test name":       {"modules/kernel/cmd/x/a_test.go", "package main\n\nfunc TestAce(t *testing.T) {}\n\nfunc TestOnAce_x(t *testing.T) {}\n"},
+	}
+	for name, c := range cases {
+		if got := scan(c.file, c.src, names); len(got) == 0 {
+			t.Errorf("%s: %q not refused", name, c.src)
+		}
+	}
+}
+
+func TestTheFindingNamesTheLineAndTheWord(t *testing.T) {
+	got := scan("f.sh", "a\nb\nrun on ACE now\n", names)
+	if len(got) != 1 || !strings.HasPrefix(got[0], "f.sh:3:") || !strings.Contains(got[0], "ace") {
+		t.Errorf("got %v", got)
+	}
+}
+
+func TestTheForgeIsNotANodeName(t *testing.T) {
+	for _, s := range []string{
+		"see novox/hq issue 5",
+		"module git.novox.be/novox/mesh-sdk/go v1.2.3",
+		"https://git.novox.be/novox/mesh-catalog",
+		"git.novox.be",
+		"space trace surface grace g14x",
+	} {
+		if got := scan("f", s, names); len(got) != 0 {
+			t.Errorf("%q refused: %v", s, got)
+		}
+	}
+}
+
+func TestANodeNameInAPathOrJoinedIsRefused(t *testing.T) {
+	for _, s := range []string{
+		"modules/kernel/testdata/novox/meminfo",
+		"/srv/novox/data",
+		"testdata/shanks-meminfo.txt",
+		"on-shanks",
+		"shanks-desktop",
+		"mesh-novox",
+		"func novoxTree() {}",
+		"aceFiles := 1",
+		"g14Meminfo := 2",
+		"novox_tree := 3",
+	} {
+		if got := scan("f", s, names); len(got) == 0 {
+			t.Errorf("%q not refused", s)
+		}
+	}
+}
+
+func TestANodeNamedPathIsRefusedThroughRun(t *testing.T) {
+	root := t.TempDir()
+	p := filepath.Join(root, "modules/kernel/testdata/ace/x")
+	os.MkdirAll(filepath.Dir(p), 0o755)
+	os.WriteFile(p, []byte("clean\n"), 0o644)
+	got, err := run(root, names, []string{"kernel"})
+	if err != nil || len(got) != 1 || !strings.HasPrefix(got[0], "modules/kernel/testdata/ace/x:0: ") {
+		t.Errorf("got %v, %v", got, err)
+	}
+}
+
+func TestCheckReturnsOneOnAFindingAndTwoOnAnUnreadableList(t *testing.T) {
+	root := t.TempDir()
+	write := func(p, s string) {
+		p = filepath.Join(root, p)
+		os.MkdirAll(filepath.Dir(p), 0o755)
+		os.WriteFile(p, []byte(s), 0o644)
+	}
+	write("particulars", "ace\n")
+	write("checks/particulars/covered", "kernel\n")
+	write("modules/kernel/a", "clean\n")
+	if got := check(root); got != 0 {
+		t.Errorf("clean = %d, want 0", got)
+	}
+	write("modules/kernel/a", "on ace\n")
+	if got := check(root); got != 1 {
+		t.Errorf("finding = %d, want 1", got)
+	}
+	os.Remove(filepath.Join(root, "particulars"))
+	if got := check(root); got != 2 {
+		t.Errorf("no list = %d, want 2", got)
+	}
+}
+
+func TestOnlyCoveredModulesAreRead(t *testing.T) {
+	root := t.TempDir()
+	write := func(p, s string) {
+		p = filepath.Join(root, p)
+		os.MkdirAll(filepath.Dir(p), 0o755)
+		os.WriteFile(p, []byte(s), 0o644)
+	}
+	write("modules/kernel/files/a", "on novox\n")
+	write("modules/other/files/a", "on novox\n")
+	got, err := run(root, names, []string{"kernel"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 1 || !strings.Contains(got[0], "modules/kernel/files/a:1") {
+		t.Errorf("got %v", got)
+	}
+}
+
+// The script's run of this check over the real tree (novox/hq ADR 0529 clause 2): no node name of this mesh in a covered module.
+func TestTheCoveredModulesNameNoNode(t *testing.T) {
+	if code := check("../.."); code != 0 {
+		t.Fatalf("the check of the real catalogue exits %d (see what it printed above)", code)
+	}
+}

checks/particulars/reads-outside

@@ -0,0 +1 @@
+These tests read files outside this directory (the whole catalogue, the repository, or its root files): mesh-build-go never keeps this package's verdict (issue 1935).

checks/paths/go.mod

@@ -1,3 +1,7 @@
 module git.novox.be/novox/mesh-catalog/checks/paths
 
 go 1.22
+
+require git.novox.be/novox/mesh-catalog/checks/trunk v0.0.0
+
+replace git.novox.be/novox/mesh-catalog/checks/trunk => ../trunk

checks/paths/main.go

@@ -251,7 +251,8 @@ func main() {
 	}
 	var grown []string
 	if baseDir == "" {
-		fmt.Println("NOT COMPARED: no base branch's lists were given, so additions to them were not judged")
+		fmt.Fprintln(os.Stderr, "NOT COMPARED: no base branch's lists were given (-base <dir>), so additions to them were not judged; that is a failure, not a pass (issue 1295)")
+		os.Exit(2)
 	} else {
 		baseShared, _, err1 := list(filepath.Join(baseDir, "shared"))
 		baseKnown, _, err2 := list(filepath.Join(baseDir, "known"))

checks/paths/reads-outside

@@ -0,0 +1 @@
+These tests read files outside this directory (the whole catalogue, the repository, or its root files): mesh-build-go never keeps this package's verdict (issue 1935).

checks/paths/realtree_test.go

@@ -0,0 +1,63 @@
+package main
+
+import (
+	"path/filepath"
+	"testing"
+
+	"git.novox.be/novox/mesh-catalog/checks/trunk"
+)
+
+// The script's run of this check over the real tree (novox/hq ADR 0529 clause 2): no module names another's state on its machine,
+// and the known list holds only what still occurs.
+func TestNoModuleNamesAnothersState(t *testing.T) {
+	root := filepath.Join("..", "..")
+	found, err := Check(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	shared, _, err := list("shared")
+	if err != nil {
+		t.Fatal(err)
+	}
+	known, _, err := list("known")
+	if err != nil {
+		t.Fatal(err)
+	}
+	refused, gone := Judge(found, shared, known)
+	for _, f := range refused {
+		t.Error(f)
+	}
+	for _, k := range gone {
+		t.Errorf("%q is in checks/paths/known and no longer occurs: take it out, so it cannot come back", k)
+	}
+}
+
+// And neither list gains a line the trunk's copies at the merge base do not hold, unless the line says why after `# allow:`. Fails, saying
+// NOT COMPARED, where no trunk is beside (issue 1295).
+func TestTheListsOfPathsHoldNoLineTheTrunksDoNot(t *testing.T) {
+	sharedPath, okShared := trunk.Copy(t, "checks/paths/shared")
+	knownPath, okKnown := trunk.Copy(t, "checks/paths/known")
+	if !okShared || !okKnown {
+		t.Log("the trunk holds not both lists: their first copies, to which nothing was added")
+		return
+	}
+	shared, sharedWhy, err := list("shared")
+	if err != nil {
+		t.Fatal(err)
+	}
+	known, knownWhy, err := list("known")
+	if err != nil {
+		t.Fatal(err)
+	}
+	baseShared, _, err := list(sharedPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	baseKnown, _, err := list(knownPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, g := range append(Grown("shared", shared, sharedWhy, baseShared), Grown("known", known, knownWhy, baseKnown)...) {
+		t.Error(g)
+	}
+}

checks/paths/shared

@@ -1,3 +1,4 @@
 # Paths every program on a machine reads as the machine's own, not as a message from the module that
 # writes them (checks/paths, novox/hq ADR 0260). One per line, with why.
 /etc/hosts  # every resolver on the machine reads it; the hostname module writes it for all of them
+/var/lib/mesh-build-node-cache  # allow: the Go build module gives its integration level the node's installed Node toolchains read-only, so the Node build module's tests build offline (issue 1891, ADR 0533)

checks/placement/go.mod

@@ -0,0 +1,5 @@
+module checks/placement
+
+go 1.26.0
+
+require git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026193323-03dce1237803

checks/placement/go.sum

@@ -0,0 +1,14 @@
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026193323-03dce1237803 h1:RInAboHBk5THYf6Agvy05iO9p2XV5zGb0ilYa+iSO7o=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026193323-03dce1237803/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+github.com/klauspost/compress v1.20.0 h1:a3C1ke2ohxFymNlb2HWAHjDeKCI90scRskErZkR0ezA=
+github.com/klauspost/compress v1.20.0/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
+github.com/nats-io/nats.go v1.54.0 h1:vsXoOxjHp/GmPUN+EcI7uOf/uB+iAP+kEsAFNQN0yzA=
+github.com/nats-io/nats.go v1.54.0/go.mod h1:y+DZoD1oBOYfZTU681eTUiUjI0vbqYGixNVFHcjHJ0k=
+github.com/nats-io/nkeys v0.4.16 h1:rd5oAuLOb8mnAycB0xleuEBNS1pVVnN0fv/FF34Eypg=
+github.com/nats-io/nkeys v0.4.16/go.mod h1:llLgWoI0o4z/Q57q2R1kHfmocyhGV6VG/U18Glg1Afs=
+github.com/nats-io/nuid v1.0.1 h1:5iA8DT8V7q8WK2EScv2padNa/rTESc1KdnPw4TC2paw=
+github.com/nats-io/nuid v1.0.1/go.mod h1:19wcPz3Ph3q0Jbyiqsd0kePYG7A95tJPxeL+1OSON2c=
+golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
+golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=

checks/placement/main.go

@@ -0,0 +1,80 @@
+// Command placement is the catalogue's check of its placement files (novox/hq ADR 0549 §1, ADR 0555; issue 1126): every
+// `placement/<node>.json` reads as a placement of the node its name says, and the files together are refused, every
+// finding named at once, for two modules of one node on one host port, a pin, binding or holding naming a provider not
+// placed where it says, a seat held once for the mesh held twice, two nodes with one address on the private network, or
+// more than one hub (mesh-sdk delivery.CheckPlacements).
+//
+// A module the catalogue does not hold and a node not enrolled are the composition check's to refuse: placement names
+// modules of every repository the indexer reads and the nodes the mesh enrolled, neither of which this tree holds.
+//
+//	go run . <catalogue root>
+//
+// Exits 1 on a finding.
+package main
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// Check reads every placement file under root and answers each finding; none is a catalogue whose placement holds. A
+// catalogue with no placement directory has none to check.
+func Check(root string) ([]string, error) {
+	dir := filepath.Join(root, delivery.PlacementDir)
+	entries, err := os.ReadDir(dir)
+	if os.IsNotExist(err) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	var found []string
+	placements := map[string]delivery.Placement{}
+	for _, e := range entries {
+		rel := delivery.PlacementDir + "/" + e.Name()
+		node, ok := delivery.PlacementFileNode(rel)
+		if e.IsDir() || !ok {
+			found = append(found, fmt.Sprintf("%s is not a placement file: the directory holds only <node>.json, one per node", rel))
+			continue
+		}
+		raw, err := os.ReadFile(filepath.Join(dir, e.Name()))
+		if err != nil {
+			return nil, err
+		}
+		p, err := delivery.DecodePlacement(raw)
+		if err != nil {
+			found = append(found, fmt.Sprintf("%s does not read as a placement: %v", rel, err))
+			continue
+		}
+		if p.Revision != "" {
+			found = append(found, fmt.Sprintf("%s names a revision, which only the indexer writes into the key", rel))
+		}
+		placements[node] = p
+	}
+	all := func(string) bool { return true }
+	found = append(found, delivery.CheckPlacements(placements, all, all)...)
+	sort.Strings(found)
+	return found, nil
+}
+
+func main() {
+	if len(os.Args) != 2 {
+		fmt.Fprintln(os.Stderr, "usage: placement <catalogue root>")
+		os.Exit(2)
+	}
+	found, err := Check(os.Args[1])
+	if err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(2)
+	}
+	for _, f := range found {
+		fmt.Println(f)
+	}
+	if len(found) > 0 {
+		os.Exit(1)
+	}
+}

checks/placement/main_test.go

@@ -0,0 +1,55 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// The catalogue's placement files as the merge check reads them (ADR 0549 §1, ADR 0555): the real tree holds every
+// rule, and a tree that breaks them is refused with every finding named at once.
+func TestPlacementFiles(t *testing.T) {
+	found, err := Check("../..")
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, f := range found {
+		t.Errorf("%s (novox/hq ADR 0549 §1)", f)
+	}
+
+	root := t.TempDir()
+	write := func(name, body string) {
+		t.Helper()
+		if err := os.MkdirAll(filepath.Join(root, "placement"), 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(filepath.Join(root, "placement", name), []byte(body), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if found, err := Check(root); err != nil || len(found) != 0 {
+		t.Fatalf("a catalogue with no placement directory: %v, %v", found, err)
+	}
+	write("ace.json", `{"v":1,"node":"ace","decided":{"hub":true,"address":"10.77.0.1"},"modules":[{"module":"a","ports":{"80":8080}},{"module":"b","ports":{"81":8080}}]}`)
+	write("g14.json", `{"v":1,"node":"g14","decided":{"hub":true,"address":"10.77.0.1"},"modules":[{"module":"c","bindings":{"pg":{"node":"ace","module":"pg"}}}]}`)
+	write("novox.json", `{"v":1,"node":"shanks","modules":[]}`)
+	write("bad.json", `{"v":1,"node":"bad","modules":{}}`)
+	write("dated.json", `{"v":1,"node":"dated","revision":"abc","modules":[]}`)
+	write("notes.md", "x")
+	found, err = Check(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, want := range []string{"a and b are both published on host port 8080", "bound to ace/pg", "both have the address 10.77.0.1",
+		"ace, g14 are each placed as it", "placement file of novox names the node", "bad.json does not read", "dated.json names a revision",
+		"notes.md is not a placement file"} {
+		hit := false
+		for _, f := range found {
+			hit = hit || strings.Contains(f, want)
+		}
+		if !hit {
+			t.Errorf("no finding says %q; found %v", want, found)
+		}
+	}
+}

checks/placement/reads-outside

@@ -0,0 +1 @@
+These tests read files outside this directory (the whole catalogue, the repository, or its root files): mesh-build-go never keeps this package's verdict (issue 1935).

checks/predefined/go.mod

@@ -1,3 +1,7 @@
 module git.novox.be/novox/mesh-catalog/checks/predefined
 
 go 1.22
+
+require git.novox.be/novox/mesh-catalog/checks/trunk v0.0.0
+
+replace git.novox.be/novox/mesh-catalog/checks/trunk => ../trunk

checks/predefined/reads-outside

@@ -0,0 +1 @@
+These tests read files outside this directory (the whole catalogue, the repository, or its root files): mesh-build-go never keeps this package's verdict (issue 1935).

checks/predefined/realtree_test.go

@@ -0,0 +1,41 @@
+package main
+
+import (
+	"path/filepath"
+	"sort"
+	"testing"
+
+	"git.novox.be/novox/mesh-catalog/checks/trunk"
+)
+
+// The script's run of this check over the real tree (novox/hq ADR 0529 clause 2): predefined.json removes no key a module still
+// names, judged against the trunk's copy at the merge base. A trunk with none had no keys; with no trunk to read, nothing can be
+// seen removed, and the test says so.
+func TestThePredefinedListRemovesNoKeyAModuleStillNames(t *testing.T) {
+	tree, err := Keys(filepath.Join("..", "..", File))
+	if err != nil {
+		t.Fatal(err)
+	}
+	path, ok := trunk.Copy(t, File)
+	if !ok {
+		t.Log("no trunk copy of " + File + ": no removal can be seen")
+		return
+	}
+	base, err := Keys(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	named, err := Named(filepath.Join("..", ".."))
+	if err != nil {
+		t.Fatal(err)
+	}
+	removed := Removed(base, tree, named)
+	keys := make([]string, 0, len(removed))
+	for k := range removed {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	for _, k := range keys {
+		t.Errorf("%q is removed from %s and still named by %v", k, File, removed[k])
+	}
+}

checks/secrets/go.mod

@@ -1,3 +1,7 @@
 module git.novox.be/novox/mesh-catalog/checks/secrets
 
 go 1.22
+
+require git.novox.be/novox/mesh-catalog/checks/trunk v0.0.0
+
+replace git.novox.be/novox/mesh-catalog/checks/trunk => ../trunk

checks/secrets/reads-outside

@@ -0,0 +1 @@
+These tests read files outside this directory (the whole catalogue, the repository, or its root files): mesh-build-go never keeps this package's verdict (issue 1935).

checks/secrets/realtree_test.go

@@ -0,0 +1,25 @@
+package main
+
+import (
+	"testing"
+
+	"git.novox.be/novox/mesh-catalog/checks/trunk"
+)
+
+// The script's run of this check over the real tree (novox/hq ADR 0529 clause 2): the known list gains no line the trunk's copy
+// at the merge base does not hold. Without a trunk copy the lines in seed are the trunk's.
+func TestTheKnownListHoldsNoLineTheTrunksDoesNot(t *testing.T) {
+	known, err := Known("known")
+	if err != nil {
+		t.Fatal(err)
+	}
+	base := seed
+	if path, ok := trunk.Copy(t, "checks/secrets/known"); ok {
+		if base, err = Known(path); err != nil {
+			t.Fatal(err)
+		}
+	}
+	for _, line := range Added(known, base) {
+		t.Errorf("checks/secrets/known gains %q, which the trunk's copy does not hold: the list only shrinks — protect the key instead (novox/hq issue 342)", line)
+	}
+}

checks/sshdir/main.go

@@ -5,7 +5,7 @@
 //	go run . <catalogue root>
 //
 // Every string of a manifest is read, wherever it stands, except prose and a file's text (Prose): a path, a
-// place, a volume. Exits 1 on a finding.
+// place, a volume; a path inside a directory of the module's own (`${dir:<id>}`) is not ~/.ssh. Exits 1 on a finding.
 package main
 
 import (
@@ -15,6 +15,7 @@ import (
 	"path/filepath"
 	"regexp"
 	"sort"
+	"strings"
 )
 
 // SSHModule is the one module allowed to name a path under ~/.ssh.
@@ -60,7 +61,7 @@ func Check(root string) ([]Finding, error) {
 		if module == SSHModule {
 			continue
 		}
-		walk(m, "", func(key, value string) {
+		walk(m, "", dirsOf(m), func(key, value string) {
 			out = append(out, Finding{Module: module, Key: key, Value: value})
 		})
 	}
@@ -68,7 +69,7 @@ func Check(root string) ([]Finding, error) {
 }
 
 // walk calls found for every string under v, outside Prose, that names a path under ~/.ssh.
-func walk(v any, key string, found func(key, value string)) {
+func walk(v any, key string, dirs map[string]string, found func(key, value string)) {
 	switch x := v.(type) {
 	case map[string]any:
 		keys := make([]string, 0, len(x))
@@ -78,20 +79,68 @@ func walk(v any, key string, found func(key, value string)) {
 		sort.Strings(keys)
 		for _, k := range keys {
 			if !Prose[k] {
-				walk(x[k], k, found)
+				walk(x[k], k, dirs, found)
 			}
 		}
 	case []any:
 		for _, e := range x {
-			walk(e, key, found)
+			walk(e, key, dirs, found)
 		}
 	case string:
-		if underSSH.MatchString(x) {
+		// A path under a directory the mesh places for the module (${dir:<id>} of a directory with a place and no path,
+		// as a runs-as module's home) is that account's own .ssh, not the operator's ~/.ssh that ssh-client sweeps
+		// (issue 1484, ADR 0466 §4). Any other ${dir:<id>} is resolved to the path its resource declares and judged.
+		if resolved, placed := resolveDir(x, dirs); !placed && underSSH.MatchString(resolved) {
 			found(key, x)
 		}
 	}
 }
 
+var ofDir = regexp.MustCompile(`^\$\{dir:([a-z0-9][a-z0-9_-]*)\}`)
+
+// placedDir marks a directory the mesh places for the module: it has no path of its own.
+const placedDir = "\x00placed"
+
+// dirsOf are the module's directories by id: the path each declares, or placedDir for one with a place and no path.
+func dirsOf(m any) map[string]string {
+	dirs := map[string]string{}
+	obj, _ := m.(map[string]any)
+	list, _ := obj["resources"].([]any)
+	for _, r := range list {
+		res, _ := r.(map[string]any)
+		id, _ := res["id"].(string)
+		path, _ := res["path"].(string)
+		switch {
+		case id == "":
+		case path != "":
+			dirs[id] = path
+		case res["type"] == "directory":
+			dirs[id] = placedDir
+		}
+	}
+	return dirs
+}
+
+// resolveDir follows a leading ${dir:<id>} through the module's directories. It answers the path with the references
+// resolved, and whether it ends under a placed directory.
+func resolveDir(x string, dirs map[string]string) (string, bool) {
+	for i := 0; i < 8; i++ {
+		m := ofDir.FindStringSubmatch(x)
+		if m == nil {
+			return x, false
+		}
+		to, ok := dirs[m[1]]
+		if !ok {
+			return x, false
+		}
+		if to == placedDir {
+			return x, true
+		}
+		x = to + strings.TrimPrefix(x, m[0])
+	}
+	return x, false
+}
+
 func main() {
 	root := "."
 	if len(os.Args) > 1 {

checks/sshdir/main_test.go

@@ -37,6 +37,36 @@ func TestAnotherModuleNamingSSHIsRefused(t *testing.T) {
 	}
 }
 
+// Issue 1484: a runs-as module's own account has a .ssh of its own, inside its home (a directory of the module's);
+// that is not the operator's ~/.ssh, which only ssh-client names. A path outside any ${dir:} is still refused.
+func TestAModulesOwnDirectoryMayHoldADotSSH(t *testing.T) {
+	root := t.TempDir()
+	manifest(t, root, "builder", `{"module":"builder","resources":[{"id":"state","type":"directory","place":"."},{"id":"ssh-dir","type":"directory","path":"${dir:state}/.ssh"},{"path":"${dir:ssh-dir}/config"}]}`)
+	manifest(t, root, "other", `{"module":"other","resources":[{"path":"${machine:account-home}/.ssh/config"}]}`)
+	found, err := Check(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(found) != 1 || found[0].Module != "other" {
+		t.Fatalf("refused %+v; want only other", found)
+	}
+}
+
+// Issue 1484 review: only a directory the mesh places is the module's own home. A ${dir:} that resolves to the
+// operator's home is judged by the path it resolves to.
+func TestADirResolvingToTheOperatorsHomeIsStillRefused(t *testing.T) {
+	root := t.TempDir()
+	manifest(t, root, "escape", `{"module":"escape","resources":[{"id":"h","type":"directory","path":"${machine:account-home}","unknown":"module"},{"path":"${dir:h}/.ssh/config"}]}`)
+	manifest(t, root, "placed", `{"module":"placed","resources":[{"id":"state","type":"directory","place":".","unknown":"program"},{"id":"s","type":"directory","path":"${dir:state}/.ssh"},{"path":"${dir:s}/config"}]}`)
+	found, err := Check(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(found) != 1 || found[0].Module != "escape" {
+		t.Fatalf("refused %+v; want only escape", found)
+	}
+}
+
 func TestTheCatalogueHasNone(t *testing.T) {
 	found, err := Check("../..")
 	if err != nil {

checks/sshdir/reads-outside

@@ -0,0 +1 @@
+These tests read files outside this directory (the whole catalogue, the repository, or its root files): mesh-build-go never keeps this package's verdict (issue 1935).

checks/templates/go.mod

@@ -1,3 +1,7 @@
 module git.novox.be/novox/mesh-catalog/checks/templates
 
 go 1.22
+
+require git.novox.be/novox/mesh-catalog/checks/trunk v0.0.0
+
+replace git.novox.be/novox/mesh-catalog/checks/trunk => ../trunk

checks/templates/reads-outside

@@ -0,0 +1 @@
+These tests read files outside this directory (the whole catalogue, the repository, or its root files): mesh-build-go never keeps this package's verdict (issue 1935).

checks/templates/realtree_test.go

@@ -0,0 +1,32 @@
+package main
+
+import (
+	"testing"
+
+	"git.novox.be/novox/mesh-catalog/checks/trunk"
+)
+
+// The script's comparison of this list with the trunk's (novox/hq ADR 0529 clause 2): the list of modules keeping file text inline
+// gains none the trunk's copy at the merge base does not hold. The catalogue itself is judged against the list by
+// TestTheCatalogueKeepsFileTextInlineOnlyWhereListed. Skipped, and said, where no trunk is beside.
+func TestTheInlineListHoldsNoModuleTheTrunksDoesNot(t *testing.T) {
+	path, ok := trunk.Copy(t, "checks/templates/inline")
+	found, err := Check("../..")
+	if err != nil {
+		t.Fatal(err)
+	}
+	listed, err := Listed(listFile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	base := seed
+	if ok {
+		if base, err = Listed(path); err != nil {
+			t.Fatal(err)
+		}
+	}
+	_, _, added := Judge(found, listed, base)
+	for _, m := range added {
+		t.Errorf("checks/templates/inline gains %s, which the trunk's copy does not hold: the list only shrinks", m)
+	}
+}

checks/toolchains/go.mod

@@ -0,0 +1,3 @@
+module git.novox.be/novox/mesh-catalog/checks/toolchains
+
+go 1.22

checks/toolchains/main.go

@@ -0,0 +1,105 @@
+// Command toolchains refuses any manifest but the owner's declaring a language's toolchain package (novox/hq
+// ADR 0477 clause 4, issue 1573): the package go only in modules/go, nodejs and npm only in modules/nodejs, and buildah (issue 1702) only in modules/buildah.
+// Everything that compiles or runs that language requires the owner's provision instead (go-toolchain,
+// node-toolchain), so the package is declared once, and a node without the owner refuses the module that
+// needs it at resolution rather than failing at its first build. The owners must declare their packages.
+//
+//	go run . <catalogue root>
+//
+// Exits 1 on a finding.
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+)
+
+// Owners names, for each toolchain package, the one module that declares it.
+var Owners = map[string]string{
+	"buildah": "buildah",
+	"go":      "go",
+	"nodejs":  "nodejs",
+	"npm":     "nodejs",
+}
+
+// Finding is one refusal: Module declares Package, which Owner alone may, or (Missing) Owner does not declare
+// the Package it owns.
+type Finding struct {
+	Module, Package, Owner string
+	Missing                bool
+}
+
+// Check reads every manifest under root/modules and answers what it refuses.
+func Check(root string) ([]Finding, error) {
+	manifests, err := filepath.Glob(filepath.Join(root, "modules", "*", "module.json"))
+	if err != nil {
+		return nil, err
+	}
+	sort.Strings(manifests)
+	var out []Finding
+	declared := map[string]map[string]bool{} // module -> packages
+	for _, path := range manifests {
+		raw, err := os.ReadFile(path)
+		if err != nil {
+			return nil, err
+		}
+		var m struct {
+			Module    string `json:"module"`
+			Resources []struct {
+				Type    string `json:"type"`
+				Package string `json:"package"`
+			} `json:"resources"`
+		}
+		if err := json.Unmarshal(raw, &m); err != nil {
+			return nil, fmt.Errorf("%s: %w", path, err)
+		}
+		declared[m.Module] = map[string]bool{}
+		for _, r := range m.Resources {
+			if r.Type != "package" {
+				continue
+			}
+			declared[m.Module][r.Package] = true
+			if owner, ok := Owners[r.Package]; ok && owner != m.Module {
+				out = append(out, Finding{Module: m.Module, Package: r.Package, Owner: owner})
+			}
+		}
+	}
+	var pkgs []string
+	for p := range Owners {
+		pkgs = append(pkgs, p)
+	}
+	sort.Strings(pkgs)
+	for _, p := range pkgs {
+		if !declared[Owners[p]][p] {
+			out = append(out, Finding{Module: Owners[p], Package: p, Owner: Owners[p], Missing: true})
+		}
+	}
+	return out, nil
+}
+
+func main() {
+	root := "."
+	if len(os.Args) > 1 {
+		root = os.Args[1]
+	}
+	found, err := Check(root)
+	if err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+	for _, f := range found {
+		if f.Missing {
+			fmt.Printf("%s does not declare the package %s it owns (novox/hq ADR 0477 clause 4)\n", f.Owner, f.Package)
+			continue
+		}
+		fmt.Printf("%s declares the package %s: only %s may; require its provision instead (novox/hq ADR 0477 clause 4)\n",
+			f.Module, f.Package, f.Owner)
+	}
+	if len(found) > 0 {
+		os.Exit(1)
+	}
+	fmt.Println("toolchains: go, nodejs, npm and buildah are declared only by their owners")
+}

checks/toolchains/main_test.go

@@ -0,0 +1,82 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"reflect"
+	"testing"
+)
+
+func catalogue(t *testing.T, manifests map[string]string) string {
+	t.Helper()
+	root := t.TempDir()
+	for name, body := range manifests {
+		dir := filepath.Join(root, "modules", name)
+		if err := os.MkdirAll(dir, 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(filepath.Join(dir, "module.json"), []byte(body), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	return root
+}
+
+func TestOnlyTheOwnerDeclaresAToolchainPackage(t *testing.T) {
+	root := catalogue(t, map[string]string{
+		"go":      `{"module":"go","resources":[{"id":"go","type":"package","package":"go"}]}`,
+		"nodejs":  `{"module":"nodejs","resources":[{"id":"nodejs","type":"package","package":"nodejs"},{"id":"npm","type":"package","package":"npm"}]}`,
+		"buildah": `{"module":"buildah","resources":[{"id":"b","type":"package","package":"buildah"}]}`,
+		"lab":     `{"module":"lab","resources":[{"id":"git","type":"package","package":"git"},{"id":"go","type":"package","package":"go"}]}`,
+		"builder": `{"module":"builder","resources":[{"id":"n","type":"package","package":"nodejs"},{"id":"dir","type":"directory","path":"/go"}]}`,
+	})
+	got, err := Check(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := []Finding{{Module: "builder", Package: "nodejs", Owner: "nodejs"}, {Module: "lab", Package: "go", Owner: "go"}}
+	if !reflect.DeepEqual(got, want) {
+		t.Errorf("found %v, want %v", got, want)
+	}
+}
+
+func TestASecondDeclarerOfBuildahIsRefused(t *testing.T) {
+	root := catalogue(t, map[string]string{
+		"go":      `{"module":"go","resources":[{"id":"go","type":"package","package":"go"}]}`,
+		"nodejs":  `{"module":"nodejs","resources":[{"id":"nodejs","type":"package","package":"nodejs"},{"id":"npm","type":"package","package":"npm"}]}`,
+		"buildah": `{"module":"buildah","resources":[{"id":"b","type":"package","package":"buildah"}]}`,
+		"imagery": `{"module":"imagery","resources":[{"id":"b","type":"package","package":"buildah"}]}`,
+	})
+	got, err := Check(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := []Finding{{Module: "imagery", Package: "buildah", Owner: "buildah"}}
+	if !reflect.DeepEqual(got, want) {
+		t.Errorf("found %v, want %v", got, want)
+	}
+}
+
+func TestTheOwnersMustExistAndDeclareTheirPackages(t *testing.T) {
+	root := catalogue(t, map[string]string{
+		"go": `{"module":"go","resources":[]}`,
+	})
+	got, err := Check(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 4 {
+		t.Errorf("an owner missing its packages gave %v, want four findings (buildah, go, nodejs, npm)", got)
+	}
+}
+
+// The catalogue as it stands: this is the check itself, run here too.
+func TestTheCatalogueGivesEachToolchainPackageToItsOwnerAlone(t *testing.T) {
+	got, err := Check("../..")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 0 {
+		t.Errorf("the catalogue declares a toolchain package outside its owner: %v", got)
+	}
+}

checks/toolchains/reads-outside

@@ -0,0 +1 @@
+These tests read files outside this directory (the whole catalogue, the repository, or its root files): mesh-build-go never keeps this package's verdict (issue 1935).

checks/trunk/go.mod

@@ -0,0 +1,3 @@
+module git.novox.be/novox/mesh-catalog/checks/trunk
+
+go 1.22

checks/trunk/reads-outside

@@ -0,0 +1 @@
+These tests read files outside this directory (the whole catalogue, the repository, or its root files): mesh-build-go never keeps this package's verdict (issue 1935).

checks/trunk/trunk.go

@@ -0,0 +1,65 @@
+// Package trunk is where a catalogue check finds the trunk's copy of a list that may only shrink (novox/hq ADR 0529 clause 2):
+// the file as the catalogue's base commit holds it, to judge a change's list against.
+//
+// The checker fetches the change's own repository at its base commit beside the change, as it fetches a sibling, and says where
+// in MESH_CHECK_BESIDE; the copy is under the repository's name (the same convention the other repositories' tests use). With
+// MESH_CHECK_BESIDE unset, or set without the catalogue's copy in it, the test fails saying NOT COMPARED WITH THE TRUNK and
+// why: the checker places the change's own repository since R4g (issue 1295), so a missing copy is a fault, never a pass. A trunk that holds no such file had
+// none: the list's first copy, which nothing was added to.
+package trunk
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// Repository is the catalogue's name beside a check.
+const Repository = "mesh-catalog"
+
+// BesideEnv is where a merge check says the clones beside the one checked are.
+const BesideEnv = "MESH_CHECK_BESIDE"
+
+// Copy is the trunk's copy of the file at rel (a path from the catalogue's root), written to a file of the test's own: its path,
+// and whether the trunk holds one (false: its first copy). It fails the test when no copy of the catalogue is beside.
+func Copy(t testing.TB, rel string) (string, bool) {
+	t.Helper()
+	raw, found, err := Read(rel)
+	switch {
+	case err != nil:
+		t.Fatal(err)
+	case !found:
+		t.Logf("the trunk holds no %s: its first copy", rel)
+		return "", false
+	}
+	path := filepath.Join(t.TempDir(), filepath.Base(rel))
+	if err := os.WriteFile(path, raw, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	return path, true
+}
+
+// Read is the trunk's copy of rel and whether the trunk holds one. err is a trunk not beside the check (MESH_CHECK_BESIDE unset,
+// or without the catalogue's directory), or a copy unreadable: a comparison that cannot be made is never a pass.
+func Read(rel string) (content []byte, found bool, err error) {
+	beside := os.Getenv(BesideEnv)
+	if beside == "" {
+		return nil, false, fmt.Errorf("NOT COMPARED WITH THE TRUNK: %s is not set, so the trunk's copy of %s is not beside this run; the checker places the change's own repository there (issue 1295)", BesideEnv, rel)
+	}
+	dir := filepath.Join(beside, Repository)
+	if _, err := os.Stat(dir); errors.Is(err, os.ErrNotExist) {
+		return nil, false, fmt.Errorf("NOT COMPARED WITH THE TRUNK: %s is not beside this check in %s=%s, so %s is not judged against the trunk's copy; the checker places the change's own repository there at its trunk (issue 1295)", Repository, BesideEnv, beside, rel)
+	} else if err != nil {
+		return nil, false, err
+	}
+	raw, err := os.ReadFile(filepath.Join(dir, rel))
+	if errors.Is(err, os.ErrNotExist) {
+		return nil, false, nil
+	}
+	if err != nil {
+		return nil, false, err
+	}
+	return raw, true, nil
+}

checks/trunk/trunk_test.go

@@ -0,0 +1,43 @@
+package trunk
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestTheCloneBesideTheCheckIsTheTrunk(t *testing.T) {
+	beside := t.TempDir()
+	dir := filepath.Join(beside, Repository, "checks", "x")
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "known"), []byte("a\nb\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv(BesideEnv, beside)
+	raw, found, err := Read("checks/x/known")
+	if err != nil || !found || string(raw) != "a\nb\n" {
+		t.Fatalf("read %q found %v err %v", raw, found, err)
+	}
+	if _, found, err := Read("checks/x/absent"); err != nil || found {
+		t.Fatalf("a file the trunk does not hold: found %v err %v; wanted its first copy", found, err)
+	}
+}
+
+func TestWithNothingBesideTheComparisonFailsAndSaysNotMade(t *testing.T) {
+	t.Setenv(BesideEnv, "")
+	_, found, err := Read("checks/x/known")
+	if found || err == nil || !strings.Contains(err.Error(), "NOT COMPARED") {
+		t.Fatalf("found %v, err %v; wanted a failure saying NOT COMPARED", found, err)
+	}
+}
+
+func TestACloneBesideWithoutTheCatalogueFailsAndSaysNotMade(t *testing.T) {
+	t.Setenv(BesideEnv, t.TempDir()) // the siblings are there, the catalogue's own base is not
+	_, found, err := Read("checks/x/known")
+	if found || err == nil || !strings.Contains(err.Error(), "NOT COMPARED") || !strings.Contains(err.Error(), "not beside") {
+		t.Fatalf("found %v, err %v; wanted a failure naming the missing copy", found, err)
+	}
+}

checks/words/buildagent-allowed

@@ -0,0 +1,3 @@
+# The modules of the catalogue whose texts still name the build agent or the toolchain images, and why (checks/words,
+# buildagent_test.go). One module directory a line, with its reason after a #. It only shrinks.
+modules/mesh-build-go  # build.go:45 says "the build agent's recipe" in a step's description: the asks lane's module (issue 1887), not E6's to edit

checks/words/buildagent_test.go

@@ -0,0 +1,57 @@
+package main
+
+import (
+	"os"
+	"strings"
+	"testing"
+)
+
+// The build agent and the toolchain images are gone (novox/hq ADR 0524 §5, issue 1295 and E6 of milestone R4g): no text a module
+// can show names them. Where the word stands for a reason that is another lane's or still waits for its change, buildagent-allowed
+// names the module's directory with that reason and the date it is dated from; the list only shrinks: a directory on it that no
+// longer names the word is refused, so the line is taken out.
+var gone = []string{"build-agent", "build agent", "toolchain image"}
+
+func allowedModules(t *testing.T) map[string]string {
+	t.Helper()
+	raw, err := os.ReadFile("buildagent-allowed")
+	if err != nil {
+		t.Fatal(err)
+	}
+	out := map[string]string{}
+	for _, line := range strings.Split(string(raw), "\n") {
+		entry, why, _ := strings.Cut(line, "#")
+		if entry = strings.TrimSpace(entry); entry != "" && !strings.HasPrefix(line, "#") {
+			if strings.TrimSpace(why) == "" {
+				t.Fatalf("%q is allowed without a reason", entry)
+			}
+			out[entry] = strings.TrimSpace(why)
+		}
+	}
+	return out
+}
+
+func TestNoTextOfTheCatalogueNamesTheBuildAgentOutsideTheModulesAllowed(t *testing.T) {
+	texts, _, err := collect("../..")
+	if err != nil {
+		t.Fatal(err)
+	}
+	allowed := allowedModules(t)
+	seen := map[string]bool{}
+	for _, f := range check(gone, texts) {
+		module := f
+		if rest, ok := strings.CutPrefix(f, "modules/"); ok {
+			module = "modules/" + strings.SplitN(rest, "/", 2)[0]
+		}
+		if _, ok := allowed[module]; ok {
+			seen[module] = true
+			continue
+		}
+		t.Errorf("%s (the build agent and the toolchain images are gone: say what stands in their place)", f)
+	}
+	for module, why := range allowed {
+		if !seen[module] {
+			t.Errorf("buildagent-allowed names %s (%s), which names the word no more: take the line out, so it cannot come back", module, why)
+		}
+	}
+}

checks/words/lines.go

@@ -58,6 +58,9 @@ func checkLines(lines []retiredLine, texts []text) []string {
 	for _, l := range lines {
 		rx := linePattern(l)
 		for _, t := range texts {
+			if !strings.Contains(t.s, l.daemon) { // the pattern holds the daemon's name whole: the cheap test first
+				continue
+			}
 			if m := rx.FindStringSubmatchIndex(t.s); m != nil {
 				line := t.line
 				if line > 0 {

checks/words/main.go

@@ -43,18 +43,63 @@ func main() {
 	if len(os.Args) > 1 {
 		root = os.Args[1]
 	}
+	os.Exit(run(root))
+}
+
+// run reads every text a module can show under root and answers the command's exit code: 0 clean, 1 a finding, 2 a list or a
+// file unreadable. The command prints what it found; a test of the real catalogue reads the code.
+func run(root string) int {
 	words, err := readList(filepath.Join(root, "retired-words"))
 	if err != nil {
 		fmt.Fprintln(os.Stderr, "words:", err)
-		os.Exit(2)
+		return 2
 	}
 	if len(words) == 0 {
 		fmt.Fprintln(os.Stderr, "words: retired-words lists no word — the check would pass on anything")
-		os.Exit(2)
+		return 2
 	}
+	texts, files, err := collect(root)
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "words:", err)
+		return 2
+	}
+	findings := check(words, texts)
+	for _, f := range findings {
+		fmt.Println(f)
+	}
+	if len(findings) > 0 {
+		fmt.Printf("words: %d use(s) of a word the glossary retired (novox/hq ADR 0244) — say it in the glossary's word\n", len(findings))
+		return 1
+	}
+	// And no daemon's line (novox/hq ADR 0272): what a module tells the operator to type is a `nox` line.
+	lines, err := readLines(filepath.Join(root, "retired-lines"))
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "words:", err)
+		return 2
+	}
+	if len(lines) == 0 {
+		fmt.Fprintln(os.Stderr, "words: retired-lines lists no line — the check would pass on anything")
+		return 2
+	}
+	if findings := checkLines(lines, texts); len(findings) > 0 {
+		for _, f := range findings {
+			fmt.Println(f)
+		}
+		fmt.Printf("words: %d daemon's line(s) in what a module shows — the operator types one command, nox (novox/hq ADR 0272)\n",
+			len(findings))
+		return 1
+	}
+	fmt.Printf("words: %d retired words and %d daemons' lines, none in the %d strings of %d files\n", len(words), len(lines),
+		len(texts), files)
+	return 0
+}
+
+// collect reads every text a module can show under root: the strings of its own code that is not a test, and every string of
+// its manifests.
+func collect(root string) ([]text, int, error) {
 	var texts []text
 	files := 0
-	err = filepath.WalkDir(filepath.Join(root, "modules"), func(path string, d fs.DirEntry, err error) error {
+	err := filepath.WalkDir(filepath.Join(root, "modules"), func(path string, d fs.DirEntry, err error) error {
 		if err != nil {
 			return err
 		}
@@ -87,38 +132,7 @@ func main() {
 		texts = append(texts, found...)
 		return nil
 	})
-	if err != nil {
-		fmt.Fprintln(os.Stderr, "words:", err)
-		os.Exit(2)
-	}
-	findings := check(words, texts)
-	for _, f := range findings {
-		fmt.Println(f)
-	}
-	if len(findings) > 0 {
-		fmt.Printf("words: %d use(s) of a word the glossary retired (novox/hq ADR 0244) — say it in the glossary's word\n", len(findings))
-		os.Exit(1)
-	}
-	// And no daemon's line (novox/hq ADR 0272): what a module tells the operator to type is a `nox` line.
-	lines, err := readLines(filepath.Join(root, "retired-lines"))
-	if err != nil {
-		fmt.Fprintln(os.Stderr, "words:", err)
-		os.Exit(2)
-	}
-	if len(lines) == 0 {
-		fmt.Fprintln(os.Stderr, "words: retired-lines lists no line — the check would pass on anything")
-		os.Exit(2)
-	}
-	if findings := checkLines(lines, texts); len(findings) > 0 {
-		for _, f := range findings {
-			fmt.Println(f)
-		}
-		fmt.Printf("words: %d daemon's line(s) in what a module shows — the operator types one command, nox (novox/hq ADR 0272)\n",
-			len(findings))
-		os.Exit(1)
-	}
-	fmt.Printf("words: %d retired words and %d daemons' lines, none in the %d strings of %d files\n", len(words), len(lines),
-		len(texts), files)
+	return texts, files, err
 }
 
 // readList reads retired-words: one word or phrase a line; blank lines and lines starting with # are not words.
@@ -152,9 +166,22 @@ func pattern(word string) *regexp.Regexp {
 
 func check(words []string, texts []text) []string {
 	var out []string
+	// A text can hold a word only if it holds the word's first part, in any case: the regular expression is run on those alone,
+	// which keeps the check of the whole catalogue within the unit level's bound.
+	lower := make([]string, len(texts))
+	for i, t := range texts {
+		lower[i] = strings.ToLower(t.s)
+	}
 	for _, w := range words {
 		rx := pattern(w)
-		for _, t := range texts {
+		first := ""
+		if parts := strings.Fields(w); len(parts) > 0 {
+			first = strings.ToLower(parts[0])
+		}
+		for i, t := range texts {
+			if !strings.Contains(lower[i], first) {
+				continue
+			}
 			if m := rx.FindStringSubmatchIndex(t.s); m != nil {
 				line := t.line
 				if line > 0 {

checks/words/main_test.go

@@ -87,3 +87,11 @@ func TestRetiredLinesAreReadAsDaemonAndCommand(t *testing.T) {
 		t.Fatal("a line with no command was read")
 	}
 }
+
+// The script's run of this check over the real tree (novox/hq ADR 0529 clause 2): no word the glossary retired, and no
+// daemon's line, in any text a module's tools can show an agent.
+func TestTheCatalogueHoldsNoRetiredWordAndNoDaemonsLine(t *testing.T) {
+	if code := run("../.."); code != 0 {
+		t.Fatalf("the check of the real catalogue exits %d (see what it printed above)", code)
+	}
+}

checks/words/reads-outside

@@ -0,0 +1 @@
+These tests read files outside this directory (the whole catalogue, the repository, or its root files): mesh-build-go never keeps this package's verdict (issue 1935).

health-undeclared

@@ -1,5 +1,5 @@
-61
+58
 The long-running resources of this catalogue that do not say how they are ready (`health`, novox/hq ADR 0240
-rule 8), as `module check` counts them. It may only go down: merge-check.sh fails a change that raises it, and
+rule 8), as `module check` counts them. It may only go down: checks/health fails a change that raises it, and
 one that lowers it writes the new number on the first line. From 2026-11-18, or once it is 0, a long-running
 resource without `health` is refused.

merge-check-typescript.sh

@@ -1,140 +0,0 @@
-#!/bin/sh
-# The catalogue's TypeScript part of its own check (novox/hq issue 302's `mesh-check-also`), declared in
-# merge-check.sh's header and run by the build seat in the TypeScript toolchain, after the Go part. The media
-# catalogue's twin is issue 311. Before this, a TypeScript module's change ran nothing of its own before it
-# merged: the Go part said "NOT TESTED HERE", and a type error in the forge module would first have shown in
-# its walk.
-#
-# For every touched module that has a package.json, in a copy of it outside the clone:
-#
-#   1. its dependencies are the toolchain's own (/app/node_modules: the mesh's SDK, Node's types and what the
-#      runtime carries), copied beside it, never fetched: the check holds no credential for the package
-#      registry. A module that depends on a package the toolchain does not hold **fails the check**, by name:
-#      it could not be type-checked or tested, and what could not run is a failure, never a note (novox/hq
-#      issue 385);
-#   2. every source that is not a test is type-checked with the toolchain's compiler and the flags a build
-#      compiles with — the same check the build makes, before the merge rather than in the walk;
-#   3. its tests (test/*.test.ts) run under Node's own runner with types stripped, as its own `npm test` does
-#      after its build: the sources are compiled to dist/ and beside themselves first, so a test that imports
-#      the compiled module, or a source that imports its sibling by its .js name, finds it.
-#
-# Said, never passed silently: a module with no tests is said NOT TESTED on every run that touches it —
-# nothing of it could fail. A module whose tests exist and could not run fails (novox/hq issue 385).
-#
-# By hand: MESH_CHECK_MODULES=gitea sh merge-check-typescript.sh, in the toolchain image (it reads
-# /app/node_modules), or with TOOLCHAIN_MODULES pointing at a node_modules that holds the same.
-#
-# **In an agent's session, outside the toolchain image** (novox/hq issue 742), the same node_modules is
-# assembled first, in a throwaway directory under the check's own workspace, the way the image's `deps` stage
-# assembles it: the toolchain's own package.json and lock (mesh-tools' node-tools/, read from the forge this
-# clone came from, so the list is never copied here) installed with `npm ci`, then the SDK the mesh last
-# published (`@novox/mesh-sdk@latest`), the @novox scope from the forge's package registry, read without a
-# credential. Node and npm are the dev-tools module's; nothing is installed on the machine, no npm
-# configuration or cache of the account's is read or written. Only when neither TOOLCHAIN_MODULES nor
-# /app/node_modules is there: the forge's check, in the image, fetches nothing, as before. The forge is
-# MESH_FORGE (default: the origin remote's), the owner MESH_FORGE_OWNER (default: the origin's owner).
-set -eu
-
-work=$(mktemp -d)
-trap 'rm -rf "$work"' EXIT
-
-deps="${TOOLCHAIN_MODULES:-/app/node_modules}"
-if [ -z "${TOOLCHAIN_MODULES:-}" ] && [ ! -f "$deps/typescript/bin/tsc" ]; then
-	origin=$(git remote get-url origin 2>/dev/null || true)
-	forge="${MESH_FORGE:-$(printf '%s\n' "$origin" | sed -n 's#^\(https\{0,1\}://[^/]*\)/.*#\1#p')}"
-	owner="${MESH_FORGE_OWNER:-$(printf '%s\n' "$origin" | sed -n 's#^https\{0,1\}://[^/]*/\([^/]*\)/.*#\1#p')}"
-	if [ -z "$forge" ] || [ -z "$owner" ]; then
-		echo "NOT CHECKED: no TypeScript toolchain at $deps, and no forge to assemble one from (origin is '$origin'; set MESH_FORGE and MESH_FORGE_OWNER, or TOOLCHAIN_MODULES)"
-		exit 1
-	fi
-	echo "no TypeScript toolchain at $deps: assembling one from $forge/$owner/mesh-tools node-tools/ and $owner's package registry (novox/hq issue 742)"
-	tc="$work/toolchain"
-	mkdir -p "$tc"
-	printf '@%s:registry=%s/api/packages/%s/npm/\n' "$owner" "$forge" "$owner" >"$work/npmrc"
-	# Read with Node's own fetch (dev-tools declares Node, not curl); a status that is not 2xx fails.
-	if ! { node -e '
-		const [base, dir] = process.argv.slice(1);
-		Promise.all(["package.json", "package-lock.json"].map(async (f) => {
-			const r = await fetch(base + f);
-			if (!r.ok) throw new Error(base + f + ": " + r.status);
-			require("fs").writeFileSync(dir + "/" + f, await r.text());
-		})).catch((e) => { console.error(e.message); process.exit(1); });' \
-		"$forge/$owner/mesh-tools/raw/branch/main/node-tools/" "$tc" &&
-		(cd "$tc" && export npm_config_userconfig="$work/npmrc" npm_config_cache="$work/npm-cache" &&
-			npm ci --ignore-scripts --no-audit --no-fund --loglevel=error &&
-			npm install --ignore-scripts --no-audit --no-fund --no-save --loglevel=error "@$owner/mesh-sdk@latest"); }; then
-		echo "NOT CHECKED: the TypeScript toolchain could not be assembled from $forge (novox/hq issue 742)"
-		exit 1
-	fi
-	deps="$tc/node_modules"
-fi
-tsc="$deps/typescript/bin/tsc"
-if [ ! -f "$tsc" ]; then
-	echo "NOT CHECKED: no TypeScript compiler at $tsc — this part runs in the TypeScript toolchain"
-	exit 1
-fi
-
-# The modules the change reaches: the planner's answer (hq ADR 0238), and every module a changed file is in —
-# a change to a module's tests alone moves no build (hq ADR 0267), and its tests must still run.
-touched=$({
-	printf '%s\n' "${MESH_CHECK_MODULES:-}" | tr ',' '\n' | sed -e 's#^modules/##' -e '/\//d'
-	printf '%s\n' "${MESH_CHECK_CHANGED:-}" | tr ',' '\n' | sed -n 's#^modules/\([^/]*\)/.*#\1#p'
-} | sed '/^$/d' | sort -u)
-
-failed=""
-for m in $touched; do
-	d="modules/$m"
-	[ -f "$d/package.json" ] || continue
-	copy="$work/$m"
-	mkdir -p "$copy"
-	(cd "$d" && tar --exclude=./node_modules --exclude=./dist -cf - .) | (cd "$copy" && tar -xf -)
-	# What it depends on, against what the toolchain holds.
-	missing=$(node -e '
-		const p = require(process.argv[1]); const have = require("fs").readdirSync(process.argv[2]);
-		const scoped = (n) => n.startsWith("@") ? n.split("/")[0] : n;
-		const names = Object.keys({ ...(p.dependencies || {}), ...(p.devDependencies || {}) });
-		const held = (n) => have.includes(n) || (n.startsWith("@") && have.includes(scoped(n)) &&
-			require("fs").existsSync(process.argv[2] + "/" + n));
-		console.log(names.filter((n) => n !== "typescript" && !held(n)).join(" "));' "$copy/package.json" "$deps")
-	if [ -n "$missing" ]; then
-		echo "FAILED: $d could not be checked — it depends on $missing, which the toolchain does not hold and the check cannot fetch (novox/hq issue 385)"
-		failed="$failed $m"
-		continue
-	fi
-	mkdir -p "$copy/node_modules"
-	for p in "$deps"/*; do
-		case "$(basename "$p")" in typescript | esbuild | @esbuild) continue ;; esac
-		cp -r "$p" "$copy/node_modules/"
-	done
-	sources=$(cd "$copy" && find . -name '*.ts' ! -name '*.d.ts' ! -path './test/*' ! -path './node_modules/*' ! -path './dist/*' | sort)
-	if [ -n "$sources" ]; then
-		echo "type-checking $d (TypeScript)"
-		# shellcheck disable=SC2086 # the module's sources, none with a space in its name
-		if ! (cd "$copy" && node "$tsc" --noEmit --module NodeNext --moduleResolution NodeNext --target ES2022 \
-			--types node $sources); then
-			failed="$failed $m"
-			continue
-		fi
-	else
-		echo "$d has no TypeScript sources of its own to type-check: its tests read its files"
-	fi
-	if ! ls "$copy"/test/*.test.ts >/dev/null 2>&1; then
-		echo "NOT TESTED: $d is TypeScript and has no tests of its own"
-		continue
-	fi
-	if [ -n "$sources" ]; then
-		# shellcheck disable=SC2086
-		(cd "$copy" && node "$tsc" --module NodeNext --moduleResolution NodeNext --target ES2022 --types node \
-			--rootDir . --outDir dist $sources && node "$tsc" --module NodeNext --moduleResolution NodeNext \
-			--target ES2022 --types node --rootDir . --outDir . $sources)
-	fi
-	echo "testing $d (TypeScript)"
-	if ! (cd "$copy" && node --test --test-reporter=spec --experimental-strip-types \
-		--no-warnings=ExperimentalWarning test/*.test.ts); then
-		failed="$failed $m"
-	fi
-done
-if [ -n "$failed" ]; then
-	echo "TypeScript modules that failed:$failed"
-	exit 1
-fi

merge-check.sh

@@ -1,195 +0,0 @@
-#!/bin/sh
-# mesh-check-toolchain: go
-# mesh-check-also: typescript merge-check-typescript.sh
-#
-# The catalogue's own check (novox/hq ADR 0237 as amended): the second layer of a pull request's merge
-# check, `mesh/repo-check`, run by the build seat in the mesh's Go toolchain.
-#
-# The gate — the manifests the change touches through the running controller's module check, every machine
-# of the facts snapshot composed with them and validated by the node-engine's own validator, the replays
-# against this tree — is the build seat's first layer (`mesh/merge-gate`), run because the mesh's module
-# graph builds these modules from here. It is not repeated here. This is the repository's own:
-#
-#   1. every manifest through the controller's module check, so one module's change cannot leave another
-#      it shares a rule with refused (MESH_GATE is the controller the mesh runs) — and the count of
-#      long-running resources without `health` held to the number in health-undeclared, which only goes down;
-#   2. the Go tests of every module the change touches that has them, under the race detector when the
-#      toolchain has a C compiler. A requirement of the mesh's own forge the module cache does not hold (a
-#      pinned SDK commit) is taken from its repository's clone beside the check (checks/deps); a module whose
-#      dependencies still cannot be had **fails the check**, by name and why — its tests could not run, and a
-#      test that could not run is a failure, never a note (novox/hq issue 385). The integration tests (`//go:build
-#      integration`) run here, with -tags integration, and only here. A module written in
-#      TypeScript is type-checked and tested by
-#      merge-check-typescript.sh, declared above, in the TypeScript toolchain (novox/hq issues 302, 311);
-#   3. the words (novox/hq ADR 0244): no word the glossary retired for the tools, as copied in
-#      retired-words, in any text a module's tools can show an agent — every string in its own code that is
-#      not a test, and every description in its manifest. Run over every module, not only the touched ones,
-#      so a word newly retired is found everywhere it stands. The check's own test runs first.
-#   4. the paths (novox/hq ADR 0260): no module names a path under /run, /var/lib, /usr/local/lib or /etc
-#      that another module's manifest places — modules talk over the bus, not through each other's files.
-#      Over every module; checks/paths/shared and checks/paths/known narrow it, and known only shrinks.
-#   5. the agent's home (novox/hq ADR 0266): no module unpacks an archive, or writes into a file, under
-#      ${machine:agent-home} — the node-engine does both after checking the path, and the agent account owns
-#      that home and could swap a link in between.
-#   6. the secrets (novox/hq issue 342): no mergeable file fills a key with a vault secret that a setting could
-#      replace — the key is `protected`, or left out of the file's `takes-settings`. checks/secrets/known names
-#      the nested ones the controller cannot protect alone yet, and only shrinks.
-#   7. the list of predefined keys (novox/hq ADR 0348 clause 7): a change to predefined.json removes no key a
-#      module still names, judged against the trunk's copy at the merge base. Whether a removed key still holds a
-#      value at the mesh or a node is mesh-config's to refuse; this check reads no store. The list itself and
-#      every manifest against it are judged by the controller's module check in step 1.
-#   8. the config form (novox/hq ADR 0348 clauses 1 and 11): no module says `settings`, `takes-settings` or
-#      `${setting:<key>}`, in its manifest or a template it names, or has a mergeable file naming no keys (which
-#      takes its whole layer), unless checks/config/unmoved lists it as not yet moved; that list only shrinks,
-#      judged against the trunk's copy at the merge base.
-#   9. the file text (novox/hq ADR 0349 §2): no module keeps a file's text inline in its manifest (`content`)
-#      unless checks/templates/inline lists it as not yet moved; each names its template in files/. That list
-#      only shrinks, judged against the trunk's copy at the merge base.
-#   10. the mail-store seat (novox/hq ADR 0378 §3, issue 800): no manifest but modules/mesh-mail claims it.
-#   11. owned paths (novox/hq ADR 0422 §8, issue 1024; it holds ~/.ssh for ssh-client as ADR 0415 §6 asked):
-#      every directory and archive says `unknown` (move-out, module or program) and a valid `knows`; `move-out`
-#      only under a home; and no module declares a path inside a directory of another module.
-#      checks/sshdir (ADR 0415 §6) stays while main runs it; it goes under issue 1035 once main runs checks/owned.
-set -eu
-
-(cd checks/words && go test -count=1 . && go run . ../..)
-# The agent's home (novox/hq ADR 0266): no archive, and no file written into, under it.
-(cd checks/agenthome && go test -count=1 . && go run . ../..)
-# The mail-store seat (novox/hq ADR 0378 §3): only mesh-mail may claim it.
-(cd checks/mailstore && go test -count=1 . && go run . ../..)
-# ~/.ssh (novox/hq ADR 0415 §6): only ssh-client may name a path under it. Main's merge check runs this line, so
-# checks/sshdir stays until main runs checks/owned; it goes under issue 1035.
-(cd checks/sshdir && go test -count=1 . && go run . ../..)
-# Owned paths (novox/hq ADR 0422 §8): unknown files named per directory; no path inside another module's directory.
-(cd checks/owned && go test -count=1 . && go run . ../..)
-# The secrets (novox/hq issue 342): a password is not a setting, so no setting can replace the vault's. The
-# known list only shrinks: judged against the trunk's copy at the merge base, a line it does not hold is refused.
-secrets_base=""
-secrets_ref="origin/${MESH_CHECK_BASE:-main}"
-if merge_base=$(git merge-base HEAD "$secrets_ref" 2>/dev/null); then
-	if git cat-file -e "$merge_base:checks/secrets/known" 2>/dev/null; then
-		secrets_base=$(mktemp)
-		git show "$merge_base:checks/secrets/known" >"$secrets_base"
-	fi
-else
-	echo "NOT COMPARED WITH THE TRUNK: no merge base with $secrets_ref; checks/secrets/known is held to the list it was first written with"
-fi
-(cd checks/secrets && go test -count=1 . && if [ -n "$secrets_base" ]; then go run . -base "$secrets_base" ../..; else go run . ../..; fi)
-# The list of predefined keys (novox/hq ADR 0348 clause 7): no key removed that a module still names. The trunk's
-# list at the merge base is what it is judged against; a trunk without the file had none.
-predefined_base=""
-if merge_base=$(git merge-base HEAD "origin/${MESH_CHECK_BASE:-main}" 2>/dev/null); then
-	predefined_base=$(mktemp)
-	if ! git show "$merge_base:predefined.json" >"$predefined_base" 2>/dev/null; then
-		echo '{}' >"$predefined_base"
-	fi
-else
-	echo "NOT COMPARED WITH THE TRUNK: no merge base with origin/${MESH_CHECK_BASE:-main}; no removal from predefined.json can be seen"
-fi
-(cd checks/predefined && go test -count=1 . && if [ -n "$predefined_base" ]; then go run . -base "$predefined_base" ../..; else go run . ../..; fi)
-# The config form (novox/hq ADR 0348 §1, §11): a moved module says no old name, and the list of modules not yet moved
-# only shrinks, judged against the trunk's copy at the merge base; a trunk without one is the list's first copy.
-unmoved_base=""
-if merge_base=$(git merge-base HEAD "origin/${MESH_CHECK_BASE:-main}" 2>/dev/null); then
-	if git cat-file -e "$merge_base:checks/config/unmoved" 2>/dev/null; then
-		unmoved_base=$(mktemp)
-		git show "$merge_base:checks/config/unmoved" >"$unmoved_base"
-	fi
-else
-	echo "NOT COMPARED WITH THE TRUNK: no merge base with origin/${MESH_CHECK_BASE:-main}; checks/config/unmoved is held to the list it was first written with"
-fi
-(cd checks/config && go test -count=1 . && if [ -n "$unmoved_base" ]; then go run . -base "$unmoved_base" ../..; else go run . ../..; fi)
-# The file text (novox/hq ADR 0349 §2): a file's text is a template in files/, outside the modules not yet moved; the
-# list of those only shrinks, judged against the trunk's copy at the merge base, a trunk without one being its first.
-inline_base=""
-if merge_base=$(git merge-base HEAD "origin/${MESH_CHECK_BASE:-main}" 2>/dev/null); then
-	if git cat-file -e "$merge_base:checks/templates/inline" 2>/dev/null; then
-		inline_base=$(mktemp)
-		git show "$merge_base:checks/templates/inline" >"$inline_base"
-	fi
-else
-	echo "NOT COMPARED WITH THE TRUNK: no merge base with origin/${MESH_CHECK_BASE:-main}; checks/templates/inline is held to the list it was first written with"
-fi
-(cd checks/templates && go test -count=1 . && if [ -n "$inline_base" ]; then go run . -base "$inline_base" ../..; else go run . ../..; fi)
-# The lists that narrow the paths check may not grow unseen: the base branch's copies are what they are
-# judged against (MESH_CHECK_BASE, main when unset), read from the clone the check runs in.
-base_lists=""
-base_ref="origin/${MESH_CHECK_BASE:-main}"
-if git rev-parse --verify --quiet "$base_ref^{commit}" >/dev/null 2>&1 &&
-	git cat-file -e "$base_ref:checks/paths/known" 2>/dev/null && git cat-file -e "$base_ref:checks/paths/shared" 2>/dev/null; then
-	base_lists=$(mktemp -d)
-	git show "$base_ref:checks/paths/known" >"$base_lists/known"
-	git show "$base_ref:checks/paths/shared" >"$base_lists/shared"
-fi
-(cd checks/paths && go test -count=1 . && if [ -n "$base_lists" ]; then go run . -base "$base_lists" ../..; else go run . ../..; fi)
-
-if [ -n "${MESH_GATE:-}" ]; then
-	checked=$("$MESH_GATE" module check modules/*/module.json) || { printf '%s\n' "$checked"; exit 1; }
-	# **The count only goes down** (novox/hq ADR 0240 rule 8): the long-running resources that do not say how
-	# they are ready, as the controller counts them, against the number kept in health-undeclared. A change
-	# that raises it fails; one that lowers it writes the new number there, so it can never rise again.
-	kept=$(sed -n 's/^\([0-9][0-9]*\).*/\1/p' health-undeclared | head -n 1)
-	counted=$(printf '%s\n' "$checked" | sed -n 's/^long-running resources without health: \([0-9][0-9]*\)$/\1/p')
-	if [ -z "$counted" ]; then
-		echo "NOT COUNTED: the controller the mesh runs is older than the count of resources without health (ADR 0240 Phase B)"
-	elif [ "$counted" -gt "$kept" ]; then
-		echo "the long-running resources without health rose from $kept to $counted: declare how each new one is ready (ADR 0240 rule 8)"
-		exit 1
-	elif [ "$counted" -lt "$kept" ]; then
-		echo "the long-running resources without health fell from $kept to $counted: write $counted in health-undeclared, so the count cannot rise again"
-		exit 1
-	else
-		echo "long-running resources without health: $counted, as kept"
-	fi
-else
-	echo "NOT CHECKED: no controller was built beside this check, so the manifests were not read by one"
-fi
-
-race=""
-if command -v gcc >/dev/null 2>&1; then race="-race"; else echo "NOT RACE-CHECKED: the toolchain holds no C compiler"; fi
-
-# The modules the change reaches are the controller's planner's answer (MESH_CHECK_MODULES, hq ADR 0238):
-# a module by its name, a new one by its directory. By hand, without it, the directories the changed files
-# are in.
-if [ -n "${MESH_CHECK_MODULES:-}" ]; then
-	touched=$(printf '%s\n' "$MESH_CHECK_MODULES" | tr ',' '\n' | sed -e 's#^modules/##' -e '/\//d' | sort -u)
-else
-	touched=$(printf '%s\n' "${MESH_CHECK_CHANGED:-}" | tr ',' '\n' | sed -n 's#^modules/\([^/]*\)/.*#\1#p' | sort -u)
-fi
-# A module's dependencies: fetched, or a forge requirement taken from its clone beside the check
-# (MESH_CHECK_BESIDE); its tests run against them (checks/deps, novox/hq issue 385). The helper's own test
-# runs first.
-(cd checks/deps && go test -count=1 .)
-deps=$(mktemp -d)
-trap 'rm -rf "$deps"' EXIT
-(cd checks/deps && go build -o "$deps/deps" .)
-untestable=""
-for m in $touched; do
-	[ -d "modules/$m" ] || continue
-	if [ ! -f "modules/$m/go.mod" ]; then
-		[ -f "modules/$m/package.json" ] && echo "modules/$m is TypeScript: merge-check-typescript.sh type-checks and tests it"
-		continue
-	fi
-	if ! modfile=$(GOPRIVATE=git.novox.be "$deps/deps" -beside "${MESH_CHECK_BESIDE:-}" -work "$deps" "modules/$m"); then
-		echo "FAILED: modules/$m could not be tested — $modfile"
-		untestable="$untestable modules/$m"
-		continue
-	fi
-	[ -n "$modfile" ] && echo "modules/$m takes its forge dependencies from the clones beside the check"
-	echo "testing modules/$m"
-	unformatted=$(cd "modules/$m" && gofmt -l .)
-	if [ -n "$unformatted" ]; then
-		echo "modules/$m is not gofmt'd: $unformatted"
-		exit 1
-	fi
-	cgo=0
-	[ -n "$race" ] && cgo=1
-	# The integration tests (a file whose first line is `//go:build integration`: a test that starts a bus, a store or
-	# another process) run here and nowhere else: the unit suite stays under a second (novox/hq playbook 07).
-	(cd "modules/$m" && CGO_ENABLED=$cgo GOPRIVATE=git.novox.be go vet -tags integration ${modfile:+"-modfile=$modfile"} ./... &&
-		CGO_ENABLED=$cgo GOPRIVATE=git.novox.be go test -tags integration ${modfile:+"-modfile=$modfile"} $race -count=1 ./...)
-done
-if [ -n "$untestable" ]; then
-	echo "the check fails: the tests of$untestable could not run (novox/hq issue 385)"
-	exit 1
-fi

modules/adwaita/internal/desktop/reads-outside

@@ -0,0 +1 @@
+These tests read files outside this directory (the whole catalogue, the repository, or its root files): mesh-build-go never keeps this package's verdict (issue 1935).

modules/betterbird/README.md

@@ -1,360 +0,0 @@
-# betterbird
-
-Betterbird, the mail and calendar client of g14 and shanks (a Thunderbird fork, with the operator's
-Exchange calendar through the Owl add-on), as a module (novox/hq issue 345, issue 586, ADR 0208, ADR 0316,
-ADR 0317, ADR 0329, to-be 56). It requires `x11-display`, so it is assigned only where a display server is held
-on the same machine. It installs Betterbird from a pinned upstream release, ships Owl with it through
-Betterbird's enterprise policy, and owns Betterbird's whole configuration as settings: the preferences, the
-mail accounts without their credentials, the identities with their signatures, the CalDAV calendars, the
-CardDAV address books, the filters and the tags.
-
-It exists because a symptom had no tools: on a workstation, a calendar reminder appeared as a
-transparent window with nothing in it (2026-10-09). Nothing in the mesh could say which window that
-was, how the compositor treats it, or which preferences Betterbird ran with. The diagnosis is in hq
-issue 345.
-
-## Owns
-
-| what | where | class |
-|---|---|---|
-| Betterbird, the upstream release (`archive`, pinned by URL and sha256) | `/opt/betterbird` | owned, whole |
-| the enterprise policy (`install/distribution/policies.json`) | `/opt/betterbird/distribution` | owned, whole |
-| Owl's xpi (`owl`, pinned by the vendor's sha256) | `/opt/betterbird/owl` | owned, whole |
-| the module's defaults (`install/defaults-pref/mesh-defaults.js`: the preferences kept at Betterbird's own default, no value of the operator's) and the spelling dictionaries' default (`vendor-prefs.js`) | `/opt/betterbird/defaults/pref` | owned: its two files |
-| the tools' program, for the start's preparation | `/usr/local/lib/mesh-betterbird` | owned, whole |
-| the start | `/usr/local/bin/betterbird` | owned, whole |
-| the launcher entry | `/usr/local/share/applications/eu.betterbird.Betterbird.desktop` | owned, whole |
-| the module's directory, with the settings as the node-engine writes them (`prefs.json`, `accounts.json`, `configuration.json`, `tags.json`), the records of what was adopted or created, and the filter files it replaced (`kept/`) | `~/.config/betterbird/` | owned, whole |
-| the profile's `user.js`, placed by the tools | the profile | the module's, or never touched |
-| the lists in the profile's `prefs.js` (accounts, outgoing servers, an adopted account's identities, the calendars' order), and the preferences of what the module created and the settings no longer hold | the profile | written into: the module's keys only, only while Betterbird is closed |
-| each declared account's `msgFilterRules.dat` (setting `filters`) | the account's directory in the profile | owned, whole, only while Betterbird is closed |
-| the profile's own values of the preferences the module manages, in `prefs.js` | the profile | cleared only by `betterbird_config_apply` with apply, Betterbird quit |
-| the profile: mail, address books, calendars, logins | `~/.thunderbird/` | found (ADR 0182) |
-
-**The community package `betterbird-bin` is declared absent** (ADR 0180), before anything is placed in
-`/opt/betterbird`: the node-engine removes it with `pacman -R`, then unpacks the release where the package
-had it. Betterbird chooses its profile by its installation's path, so the same profile opens after the
-switch. A package left in place (its removal failed) holds the path, and the release is refused there by
-the node-engine rather than mixed in. The module creates no link: the start, a launcher entry naming the
-icon in the installation, and the dictionaries as a default preference replace the package's links.
-
-**Every new build waits for the operator** (`upgrade: record`): the first push to a node removes the
-package and replaces what a running Betterbird has open, so the operator quits Betterbird, then pushes.
-An upgrade is a change to the pins, reviewed and delivered like any other (ADR 0316 §5).
-
-**The pins.** The release is `betterbird-153.4.0esr-bb10.en-US.linux-x86_64.tar.xz` (81,620,684 bytes) and
-Owl is 1.5.6.1 (430,201 bytes), each pinned by sha256 in `module.json`. The build seat fetches each once,
-refuses it when the digest differs, keeps it under its sha256, and packs it into the artifact store; a node
-receives the mesh's archive by digest and never asks the vendor. **Owl is never in this repository**: its
-licence forbids copying it to third parties, and its vendor serves only its newest version, at one
-address. Keeping the pinned copy in the mesh's private artifact store for the operator's own machines was
-the operator's call (2026-10-12, ADR 0316 §6).
-
-**Owl's range.** Owl declares which Betterbird versions it supports (`strict_min_version` to
-`strict_max_version`: 115 to 156 for 1.5.6.1). `owlSupports` in `manifest_test.go` holds the range read
-from each pinned xpi, and the module's tests refuse a Betterbird pin outside it: moving Owl's pin means
-reading the new range there (ADR 0316 §8).
-
-**The policy** turns Betterbird's own updater off (`DisableAppUpdate`, which Betterbird's update check
-honours) and installs Owl into every profile from `file:///opt/betterbird/owl/owl.xpi` as
-`force_installed`, with `updates_disabled`. A profile that already runs another Owl keeps it: the policy
-installs the pinned one where Owl is missing. A newer Owl in the profile (g14 runs 1.5.7) is said as a
-fact by `betterbird_status`; Owl installed by policy cannot be removed in Betterbird, so the remedy is
-moving the pin. An older one is a finding of `betterbird_check`, with the same remedy.
-
-**Betterbird never asks to be the default client.** The policy locks `mail.shell.checkDefaultClient` off
-(`Preferences`, `Status: locked`): Betterbird's own default (`all-thunderbird.js`) is to ask at every start,
-with a window to make it the default for mail, news, feeds and calendar files, while that preference is true
-(`messenger.js`). Betterbird 153 has no policy of its own for it (its `policies-schema.json`), and its
-`Preferences` policy accepts the `mail.` prefix. A lock, not a default: the window's own "always check" box
-writes the preference into the profile, which wins over a default; a lock wins over the profile and greys the
-box out in the settings. `betterbird_check` says when Betterbird would ask (novox/hq issue 345). **Owl's licence stays the person's**: the mesh holds no licence, key or payment (ADR 0316 §9).
-
-**No start of its own.** Betterbird is started by the operator from the launcher. The start
-(`/usr/local/bin/betterbird`) first runs `betterbird-tools prepare`, which, with no Betterbird of the
-account running, places the user.js and writes what Betterbird rewrites itself (the lists, the removals, the
-filter files); then it
-starts Betterbird either way. `betterbird_restart` starts it as the transient user unit
-`mesh-betterbird`, so its output then goes to the journal.
-
-
-## The preferences: locks, the setting prefs, and Betterbird's own defaults
-
-Betterbird's preferences come in three layers (novox/hq issue 345, issue 586). **The operator's own choices
-live in the module's configuration, never in the catalogue**: the module ships only its policy's locks and the
-names it keeps at Betterbird's own default.
-
-| layer | where | who changes it | holds |
-|---|---|---|---|
-| **locked** | `/opt/betterbird/distribution/policies.json` (`install/distribution/`) | only a reviewed catalogue change | what must never differ on a node; Betterbird's settings show it greyed out |
-| **declared** | the setting `prefs`, mesh-wide with a node's layer over it, written to `~/.config/betterbird/prefs.json` and placed in the profile's `user.js` | the operator, through the settings layers (trusted: the terminal or the operator's warrant) | the operator's setup, and a node's exceptions, such as a font size for a larger screen |
-| **Betterbird's default** | Betterbird's own defaults; `mesh-defaults.js` names those the module manages there | a catalogue change | the preferences kept at Betterbird's default |
-
-A locked value wins over everything; a declared one (in `user.js`) wins over the profile's `prefs.js` at every
-start; `prefs.js` wins over a default.
-
-**The setting `prefs` is one entry per preference** (issue 586): `{"prefs": {"mail.uifontsize": 14, …}}`, the
-value true, false, a whole number or a string. The node-engine merges the layers key by key, so a node's layer
-overrides one preference, or takes one out with `null`. The operator's setup approved on 2026-10-12 (compact
-density, 14-point text, the vertical view with multi-line cards and threads, no new-mail pop-up, sound or tray
-icon, the calendar's day from 09:00 to 20:00, reminders missed while asleep shown, chat off, remote content
-blocked, Do Not Track; 21 preferences) moved from the catalogue's defaults file into the mesh-wide layer of
-`prefs`, set on the operator's Approve.
-
-**The order that leaves no node on Betterbird's own defaults** (issue 586): merge this build (the `record`
-upgrade policy holds it back from the nodes); propose the mesh-wide layer through the controller's `settings`
-verb with `propose`, carrying the current `accounts` verbatim and `prefs` with the 21 values; the operator
-approves; only then push the desktop nodes. Caveat: between that approval and a node's push, any other send to a
-desktop node writes the map's text into the old build's user.js, and `betterbird_check` there says the user.js is
-refused until the push.
-
-**Locked** (the policy): Betterbird's updater off (`DisableAppUpdate`); telemetry off (`DisableTelemetry`);
-add-ons change only through the mesh's pins (`ExtensionUpdate` false); and three preferences locked off:
-`mail.shell.checkDefaultClient` (the ask to be the default client), `mail.inappnotifications.enabled` (the
-vendor's in-app notices), and `mailnews.start_page.enabled` (the start page, which otherwise loads from the
-vendor at every start).
-
-**Kept at Betterbird's default** (`// keeps Betterbird's default: <name>` in `mesh-defaults.js`): the theme,
-system colours, always-underlined links, manual spam marking, and the composer's attachment pane. A value the
-profile saved for one of them is drift.
-
-**Drift.** `betterbird_config` shows each managed preference (locked, declared, kept) through the layers, and
-flags **drift**: a declared value the profile's `user.js` does not hold yet (remedy: `betterbird_user_js` with
-apply, then `betterbird_restart`), or a value the profile saved where the module keeps Betterbird's default.
-`betterbird_check` reports it.
-
-- `betterbird_config_apply` with `apply` takes a kept preference's saved value out of `prefs.js`, so Betterbird's
-  default holds at the next start. It acts only while Betterbird is quit (no main process, and no `lock` in the
-  profile), and says what it cleared.
-- **The theme is the exception.** Betterbird keeps the active theme in its add-on database (`extensions.json`),
-  and `extensions.activeThemeID` only mirrors it. Another theme is drift whose remedy is to enable the default
-  theme in the add-on manager. `betterbird_config_apply` never clears it, and `keep` refuses it.
-- `betterbird_config` with `keep` proposes this node's layer of `prefs` holding the profile's values of the named
-  preferences beside what the layer holds, through the controller's settings verb, for the operator's Approve.
-
-**One owner per value.** `prefs` refuses a preference whose name can hold a credential, an account's
-(`mail.account.`, `mail.identity.`, `mail.server.`, `mail.smtpserver.` and the account lists, ADR 0316 §11), and
-those the settings below own: `calendar.registry.`, `calendar.list.`, `ldap_2.servers.` and `mailnews.tags.`
-(ADR 0329 §6).
-
-## The user.js
-
-Betterbird reads `user.js` in its profile when it starts, and a preference set there wins over the one it saved
-in `prefs.js`. The profile's directory has a random name per machine (`<random>.default-default`), which a
-manifest cannot name. So the tools compose the user.js from the settings — `prefs`, then the declared accounts,
-then the declared identities, calendars, address books and tags under the keys each resolved to — and place it
-in the profile: at the start from the launcher, `betterbird_user_js` with `apply`, or `betterbird_restart`.
-
-**The profile is found** as the one the running Betterbird holds open; with none running, as the
-installation's default in `profiles.ini` (`[Install…] Default`), else the profile marked `Default=1`.
-
-**A user.js the module did not write is never overwritten.** The module's begins with the line
-`// Betterbird's user.js (module betterbird`; any other is the operator's, and `apply` refuses with what to do.
-
-## The accounts: declared without credentials (ADR 0316 §10–§16, ADR 0317)
-
-The setting `accounts` reaches the machine as `~/.config/betterbird/accounts.json`, a trusted mergeable
-file: a map of accounts by name, each with `address`, `from-name` and `label` (optional), `incoming` (`kind`
-imap or pop3, `host`, `port`, `security` tls, starttls or none, `sign-in` password, encrypted-password,
-oauth, kerberos, ntlm or tls-certificate, `user`) and `outgoing` (the same, without a kind; its sign-in may
-be none), and, only in a node's own layer, `key`. **Never a password or a token**: the whole file is
-refused when any key in it is shaped like one, and an account signs in at its first use, in Betterbird's
-own window, where Betterbird keeps the result in its login store. The work account through Owl is never
-declared: the person creates it in Owl's setup (ADR 0316 §13).
-
-At every apply (the start from the launcher, `betterbird_user_js` with apply, `betterbird_restart`), each
-declared account, in its place in the setting, is (ADR 0317 §1):
-
-1. **kept by its recorded keys**, when the module recorded it on this node for this profile;
-2. **its creation**, when it is under the module's own keys (`account_mesh_<name>`, `id_mesh_<name>`,
-   `server_mesh_<name>`, `smtp_mesh_<name>`);
-3. **adopted by the key a node's layer names** (`key`), when that account is in the list, its default
-   identity has the address and it is not Owl's;
-4. **adopted by its address**, when exactly one account's default identity has it: its keys (account,
-   default identity, incoming server, and the outgoing server that identity names) become the module's, and
-   the account lists are left as they are;
-5. **created** under the module's own keys when no account has it: its keys are added at the end of
-   `mail.accountmanager.accounts` and `mail.smtpservers` in `prefs.js`, every other key kept in its place,
-   only while Betterbird is not running.
-
-**Refused, for that account alone and with the remedy** (§7): two accounts with the address (remove the
-duplicate in Betterbird, or name the `key`), Owl's account at the address, a named key that does not
-qualify, an account of another kind than declared (never converted), an identity that names no outgoing
-server, and an outgoing server that another identity, neither adopted nor the module's, also uses
-(Betterbird lets identities share one, and the declared values would change that other account's sending;
-ADR 0317 §2 leaves the identity's server and the lists as they are, so the module refuses rather than give
-it a server of its own). A recorded adoption follows the identity's current outgoing server at every apply,
-under the same rule. The other accounts go ahead; the start and `betterbird_check` say it.
-`betterbird_user_js` answers an account's preferences by name with their values withheld.
-
-The declared fields are written in the user.js under the account's keys, so they win at every start; only
-the fields the setting names, never the account's directory, folders, filters, caches, mail or kept
-sign-in, so an adopted account keeps its sign-in (§5). The apply names, by preference name only, each one
-whose value it changed (§4). What was adopted or created is recorded in
-`~/.config/betterbird/accounts-record.json`. **Leaving the setting** releases an adopted account (its
-lines and its record go, the account stays the person's) and takes a created account's keys out of the
-lists (its mail stays in the profile).
-
-**The value is derived, not retyped** (§9): `betterbird_accounts` with `propose` builds `accounts` from the
-profile (every account but Owl's, no credential) and proposes it in the mesh-wide layer as it stands, through
-the controller's settings verb; the operator approves on a channel that proves who answers. Its answer shows
-the value it proposed (ADR 0329 §10).
-
-**A node with no profile yet.** The preparation needs the profile Betterbird makes at its first start: on a
-node set up from nothing, the declared accounts are written at the second start from the launcher (or at
-`betterbird_restart`).
-
-## Identities, calendars, address books, filters and tags (ADR 0329)
-
-Five more settings, mesh-wide with a node's layer over each (an entry set to `null` in a node's layer is not on
-that node). `identities`, `calendars`, `address-books` and `filters` reach the machine as
-`~/.config/betterbird/configuration.json`, trusted as `accounts` is; `tags` as `tags.json`, trusted too since issue 751 (the operator's decision), so a change to it is the operator's to approve.
-**No value holds a password, a token or a cookie**: a key shaped like one is refused, and so is an address whose
-user part carries a password (§2). A setting holds no line break, so a signature is a list of its lines.
-
-| setting | an entry | matched in the profile by |
-|---|---|---|
-| `identities` | by a name: `account` (its name in `accounts`), and for another identity than the account's default `address` and `name`; `reply-to`, `organization`, `signature` (lines), `signature-html`, `signature-above-quote`; `key` in a node's layer | the account's default (no `address`), or an identity of that account with the address |
-| `calendars` | by a name: `name`, `url` (CalDAV), `color`, `read-only`, `reminders`, `user`, `invitations` (an identities entry); `key` in a node's layer | its address |
-| `address-books` | by a name: `name`, `url` (CardDAV), `user`; `key` in a node's layer | its address |
-| `tags` | by its key: `name`, `color`, `order` | its key |
-| `filters` | by an account's name: the ordered list, each with `name`, `enabled`, `when` (new-mail, manual, after-junk, sending, archiving, periodic), `match` (all, any, every-message), `conditions` (`field`, `op`, `value`, in Betterbird's words) and `actions` (`action` in Betterbird's words; `folder` as a path within the account, or `value`) | owned whole per account |
-
-**Adopted as accounts are** (§7): an entry recorded on this node is kept by its key; one under the module's own
-key (`ident_mesh_<name>`, `mesh_<name>` for a calendar or an address book) is its creation; a `key` in the
-node's layer is adopted when the profile holds it and it matches; else one match is adopted, none is created
-under the module's key, and several are refused with the remedy. The declared fields go into the user.js under
-that key. An entry leaving the setting releases what was adopted (its lines go) and removes the preferences of
-what was created, never a calendar's events, an address book's contacts or a cache. An entry no setting declares
-stays the person's. Owl's accounts and calendars, an ICS calendar (its address is often the secret), local
-calendars and address books are never declared (§13).
-
-**Filters are owned whole per declared account** (§8): the module writes that account's `msgFilterRules.dat`
-from the list, each folder's path turned into its address on this node, so a filter added in Betterbird is gone
-at the next apply (drift shows it first). Before its first write it keeps the replaced file in
-`~/.config/betterbird/kept/<profile>/`; when the account leaves `filters`, the module stops writing and the file
-stays the person's; `betterbird_filters` says where the kept copy is. A filter a setting cannot hold as it is (a
-folder of another account, an add-on's action, a news filter) is named and not derived.
-
-**Written only while Betterbird is closed** (§9): the lists in `prefs.js` and the filter files, because
-Betterbird rewrites them as it runs and quits; the user.js is placed as before. `betterbird_check` counts per
-kind the changes that wait.
-
-**Derived, then proposed one layer at a time** (§10): `betterbird_derive` asks every desktop node holding
-Betterbird for what its profile holds. An entry on every such node goes into the mesh-wide layer with the value of
-the node the derive was called on, and the answer lists each field another node holds differently (which then
-shows as drift there); one on some nodes only goes into those nodes' own layers. An account whose filter file
-holds no filter is not put in `filters`. With `propose`, the next layer (the mesh-wide one, then each node's) is
-proposed with the layer as it stands beside the derived kinds; never while a proposal of the module's waits, and
-never while a desktop node does not answer. `prefs` on the call carries values of the setting `prefs` into the
-mesh-wide layer. A `key` is never proposed for the mesh-wide layer.
-
-## Tools
-
-They are served by the node's runtime as the operator account (ADR 0175). **They show the operator's own
-configuration with its values, and never a credential** (ADR 0329 §1, §2): every answer passes the module's
-credential check, which withholds a field whose name says password, token, secret or cookie and the password
-part of any address. No answer carries mail, a calendar entry or a contact.
-
-| tool | does |
-|---|---|
-| `betterbird_status` (r) | whether it runs (pid, since, scope, children); what is installed and from where, its version beside the newest published build; the policy; Owl's version against the pin and whether it is active; where its output goes; the profile and how it was found; the user.js (declared, placed, in effect, with every declared entry as it resolved); the declared accounts by count; the add-ons; the preferences that decide how its windows and notifications look |
-| `betterbird_prefs` (r) | named preferences or prefixes: value and source, and the default with the file that gives it. Withheld without its value: a name that can hold a credential, one that names an account, server, calendar or person, and every `extensions.*` but the theme's id. Values masked (the home as `~`, addresses and hosts) |
-| `betterbird_config` (r; a with `keep`) | each managed preference: its lock, the declared value, Betterbird's default where the module keeps that, the profile's saved value, the value in effect, and drift; with `keep`, this node's layer of `prefs` proposed with the profile's values |
-| `betterbird_config_apply` (r; a with `apply`) | a kept preference's drifting values listed; with `apply`, while Betterbird is quit, taken out of `prefs.js` |
-| `betterbird_user_js` (r; a with `apply`) | the user.js composed from the settings against the profile's; `apply` places it, writes what Betterbird rewrites while it is closed, and counts what waits |
-| `betterbird_log` (r) | the last lines of the journal of `mesh-betterbird` (or of the reminder test), addresses and credentials masked |
-| `betterbird_restart` (a) | ends Betterbird (asked to quit, forced after 8 s), places the user.js and writes what waited, starts it as `mesh-betterbird`. **Refused while a composer window is open**, unless `discard_unsent` is true, which only the operator's yes justifies |
-| `betterbird_check` (r) | installed from the mesh's release; the policy and the module's defaults placed; no managed preference drifting; no ask to be the default mail client; Owl at its pin and active; one running; profile found; the user.js valid, placed, in effect; the declared accounts in the list, none refused, each signed in once; per kind, the declared entries drifting or refused and the changes waiting for Betterbird to close; its output read |
-| `betterbird_accounts` (r; a with `propose`) | the profile's accounts with their values and the declared account each is, Owl's by name and address and marked; with `propose`, `accounts` built from them and proposed in the mesh-wide layer as it stands |
-| `betterbird_identities`, `betterbird_calendars`, `betterbird_address_books`, `betterbird_filters`, `betterbird_tags` (r) | the profile's entries with their keys and values beside the declared ones and how each resolved (adopted, created or refused with why); an ICS calendar by its name only, Owl's marked; `betterbird_filters` also where the kept filter files are |
-| `betterbird_derive` (r; a with `propose`) | the five kinds derived from the desktop nodes' profiles, per layer, with the fields another node holds differently and what was left out; with `propose`, the next layer proposed; `here` answers this node's profile, as another node asks it |
-| `betterbird_drift` (r) | per kind and declared entry: holds, differs (each field with both values), lacks, or refused; and the profile's entries nothing declares |
-| `betterbird_reminder_test` (a) | a reminder on demand without the operator's calendar (below) |
-
-### A reminder on demand
-
-**It opens windows on the operator's screen**, and its description says so first, so a caller tells the
-operator before calling it. On 2026-10-12 at 12:05 a test Betterbird with an empty profile carrying the
-operator's theme looked like the operator's configuration lost; so the test is **visibly a test**: its
-profile carries a `userChrome.css` that frames every window of the test Betterbird in red and runs a red
-band reading MESH TEST across its top, and its event is called "MESH TEST reminder (a throw-away
-Betterbird of the mesh, not your calendar)". The reminder window itself is left unstyled, because how
-Betterbird draws it is what the test looks at; its title is the event's. A window title cannot be set by a
-preference, so the marking is the band, the frame and the event's name.
-
-`betterbird_reminder_test` starts a **second** Betterbird with `--no-remote` in a throw-away profile
-under `/run/user/<uid>/mesh-betterbird-reminder-test/`, as the user unit
-`mesh-betterbird-reminder-test` (ended after 10 minutes at most). The profile holds the module's
-user.js (the setting `prefs`; never a declared account) and one calendar: a local `.ics` file with one
-event, "MESH TEST reminder", whose reminder is
-due `after` seconds from the call (default 40). `carry` copies named preferences of the operator's
-profile into it (a theme, a colour switch), under the same limits as `betterbird_prefs`. The test's own
-preferences come last in its user.js, so nothing declared or carried overrides them; one of them turns
-Betterbird's update check off (`betterbird.update.checkIntervalDays` 0), because a fresh profile checks
-at its start and, when a newer build is published, opens the About window on the operator's screen
-(seen 2026-10-12). Then:
-
-- `xorg_windows` with class `Calendar` answers the reminder window: role `AlarmWindow`, type `Dialog`,
-  its depth (32: a visual with alpha, which the compositor blends), its map state;
-- `xorg_screenshot` with that window shows it as the screen shows it.
-
-The unit removes its profile when it ends, however it ends (`ExecStopPost`): at its 10 minutes, on
-`stop`, or when the test window is closed. The test Betterbird is never counted as the operator's: its
-command line names its own profile, and `status`, `check`, `restart` and the user.js leave it out.
-
-The running Betterbird, its profile and its calendars are not touched: `--no-remote` keeps the two
-apart. **`profiles.ini` and `installs.ini` are not rewritten either**, measured on the workstation
-(2026-10-09): their content and modification time (June 2023) were the same before a `--profile` start,
-while it ran, and after it ended.
-
-## The reminder window, as measured (2026-10-09, workstation, i3 and picom with glx)
-
-| | |
-|---|---|
-| X class / instance | `eu.betterbird.Betterbird` / `Calendar` |
-| role, type | `AlarmWindow`, `_NET_WM_WINDOW_TYPE_DIALOG` (i3 floats it) |
-| depth | 32 (ARGB visual), like every Betterbird window there |
-| size | 600×300, kept in the profile's `xulstore.json` |
-
-A window of depth 32 that its program has not drawn is transparent under a compositor, not black:
-that is why the symptom looks the way it does. Why Betterbird did not draw it is hq issue 345's
-question.
-
-## What changes when it is pushed
-
-The module is assigned to shanks today (look-only, from issue 345's first part); g14 runs Betterbird
-outside the mesh. With this version, a push to a node (each waits for the operator: `upgrade: record`):
-
-| | on a node with the community package (g14, shanks) |
-|---|---|
-| the package | `betterbird-bin` removed (quit Betterbird first) |
-| `/opt/betterbird` | the mesh's 153.4.0esr-bb10, in the same place, so the same profile opens |
-| the policy, Owl | placed; Owl installed into the profile by Betterbird at its next start where it is missing |
-| `/usr/local` | the start, the launcher entry, the tools' program |
-| `~/.config/betterbird/` | `prefs.json`, `accounts.json`, `configuration.json`, `tags.json` (each empty until its setting is approved) |
-| the profile | untouched until the next start from the launcher, `betterbird_user_js` with apply, or `betterbird_restart` |
-| the configuration | the policy's locks at Betterbird's next start; the settings in the user.js from the next start. Pushed in the order above, the operator's 21 preferences are in `prefs` before the build arrives; pushed before that layer is approved, Betterbird runs with its own defaults for them until it is |
-
-## Relies on
-
-- A display server on the same machine (`x11-display`, ADR 0208 §3).
-- **`xorg`** for `xorg_windows` and `xorg_screenshot`, which look at Betterbird's windows. This module
-  carries no window code of its own.
-- `systemd-run` and `journalctl` of the account's user manager.
-- The build seat's archive pinned by URL and sha256 (mesh-controller, ADR 0316 §2): a controller that does
-  not know it refuses this manifest.
-- The controller's `settings` verb, for every proposal and to read a layer as it stands; its `nodes` and `node`
-  verbs, for which machines hold the module; and the module's own `betterbird_derive` on those machines
-  (`invokes`).
-
-## Files it does not know
-
-Each directory or archive this module declares says how it treats a file it did not write (ADR 0422, ADR 0416).
-
-- `~/.config/betterbird`: holds only what this module declares and its own tools' records: `accounts-record.json` (`cmd/betterbird-tools/adoption.go:36`), `configuration-record.json` (`owned.go:33`) and the `kept/` folder of replaced filter files (`filters.go:261`); anything else is moved out by the node-engine to `~/.local/state/mesh-moved/betterbird/` with a list, never deleted (ADR 0422 §4).
-- `/opt/betterbird`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
-- `/opt/betterbird/owl`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
-- `/opt/betterbird/distribution`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
-- `/opt/betterbird/defaults/pref`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
-- `/usr/local/lib/mesh-betterbird`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).

modules/betterbird/cmd/betterbird-tools/accounts.go

@@ -1,842 +0,0 @@
-package main
-
-// The operator's mail accounts, declared without credentials (novox/hq ADR 0316 §10–§14, to-be 56 §4).
-//
-// The setting `accounts` reaches the machine as ~/.config/betterbird/accounts.json, a file the node-engine
-// writes from the module's settings layers. Per account it names the address, the incoming server and the
-// outgoing server; never a password or a token, and the whole file is refused when any key in it is shaped
-// like one. Betterbird's accounts are preferences, so a declared account becomes:
-//
-//   - its declared fields as preferences in the user.js the module places, where they win at every start
-//     (§11): under the keys of the account the profile already holds at that address, which the module adopts
-//     (novox/hq ADR 0317), or, where the profile holds none, under keys of the module's own that end in
-//     mesh_<name> (account_mesh_<name>, id_mesh_<name>, server_mesh_<name>, smtp_mesh_<name>);
-//   - for an account the module created, its key in the account list (mail.accountmanager.accounts) and in the
-//     list of outgoing servers (mail.smtpservers) of the profile's prefs.js: written into, never owned, and
-//     only while Betterbird is not running, because it rewrites prefs.js when it quits (§12). Every other key
-//     keeps its place, and an adopted account's keys are in the lists already.
-//
-// Which account is adopted, created or refused is adoption.go's.
-//
-// Nobody's password passes through here: an account signs in at its first use, in Betterbird's own window,
-// and Betterbird keeps the result in its login store (§14). Of that store the module reads only the server
-// names each entry is kept for, which Betterbird writes in the clear, to count the declared accounts that
-// have not signed in yet (§16); never a user name or a password, which are encrypted there anyway.
-
-import (
-	"bufio"
-	"bytes"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"os"
-	"path/filepath"
-	"regexp"
-	"sort"
-	"strconv"
-	"strings"
-
-	stdio "git.novox.be/novox/mesh-sdk/go"
-)
-
-// accountsFile is the setting accounts on the machine, written by the node-engine.
-const accountsFile = ".config/betterbird/accounts.json"
-
-// Account is one declared mail account, in the shape of the setting accounts: keyed by its name.
-type Account struct {
-	Address string `json:"address"`
-	// FromName is the name the account's mail is sent under. Absent: Betterbird's, none.
-	FromName string `json:"from-name,omitempty"`
-	// Label is what Betterbird shows the account as. Absent: its address.
-	Label    string `json:"label,omitempty"`
-	Incoming Server `json:"incoming"`
-	Outgoing Server `json:"outgoing"`
-	// Key is the profile's account key to adopt, given only in a node's own layer to settle an address the
-	// profile holds more than once (novox/hq ADR 0317 §8).
-	Key string `json:"key,omitempty"`
-}
-
-// Server is an account's incoming or outgoing server: never a password or a token.
-type Server struct {
-	// Kind is imap or pop3, for the incoming server; the outgoing one is smtp and says nothing.
-	Kind     string `json:"kind,omitempty"`
-	Host     string `json:"host"`
-	Port     int    `json:"port,omitempty"`
-	Security string `json:"security"`
-	SignIn   string `json:"sign-in"`
-	User     string `json:"user,omitempty"`
-}
-
-// The words a server's connection security and sign-in method are said in, and Betterbird's numbers for
-// them (socketType / try_ssl, authMethod).
-var (
-	securities = map[string]int{"none": 0, "starttls": 2, "tls": 3}
-	signIns    = map[string]int{"none": 1, "password": 3, "encrypted-password": 4, "kerberos": 5, "ntlm": 6,
-		"tls-certificate": 7, "oauth": 10}
-)
-
-func wordFor(words map[string]int, n int) string {
-	for w, v := range words {
-		if v == n {
-			return w
-		}
-	}
-	return ""
-}
-
-var (
-	accountName  = regexp.MustCompile(`^[a-z][a-z0-9]{0,30}$`)
-	addressShape = regexp.MustCompile(`^[^\s@"\\]+@[A-Za-z0-9.\-]+\.[A-Za-z]{2,}$`)
-	hostShape    = regexp.MustCompile(`^[A-Za-z0-9](?:[A-Za-z0-9.\-]*[A-Za-z0-9])?$`)
-	profileKey   = regexp.MustCompile(`^[A-Za-z0-9_]{1,64}$`)
-	// plainText is a value written into a preference: no quote, backslash or line break.
-	plainText = regexp.MustCompile(`^[^"\\\n\r]*$`)
-	// secretKey is a key the accounts file may never carry, at any depth: the setting holds no credential.
-	secretKey = regexp.MustCompile(`(?i)(pass|secret|token|oauth.?refresh|refresh|credential|api.?key|private.?key|cookie|bearer)`)
-)
-
-// keysOf are the module's own keys for a declared account: each ends in mesh_<name>.
-func keysOf(name string) (account, identity, server, smtp string) {
-	return "account_mesh_" + name, "id_mesh_" + name, "server_mesh_" + name, "smtp_mesh_" + name
-}
-
-// ownKey is a key of an account list the module wrote, and the name it was declared under.
-var ownKey = regexp.MustCompile(`^(?:account|smtp)_mesh_([a-z][a-z0-9]{0,30})$`)
-
-// readAccounts reads the declared accounts. A missing file is no account (the module is older here); a file
-// that carries a key shaped like a credential, an unknown field or a value that cannot be written is refused
-// whole, naming the key and never a value.
-func (m *Machine) readAccounts() (map[string]Account, bool, error) {
-	raw, err := readBounded(m.home(accountsFile))
-	if errors.Is(err, os.ErrNotExist) {
-		return map[string]Account{}, false, nil
-	}
-	if err != nil {
-		return nil, false, err
-	}
-	accounts, err := parseAccounts(raw)
-	return accounts, true, err
-}
-
-func parseAccounts(raw []byte) (map[string]Account, error) {
-	var tree any
-	if err := json.Unmarshal(raw, &tree); err != nil {
-		return nil, fmt.Errorf("~/%s is not JSON: %v", accountsFile, err)
-	}
-	if where := secretKeyIn(tree, ""); where != "" {
-		// An account's name is said by nothing: its segment of the path is withheld.
-		if parts := strings.SplitN(where, ".", 3); len(parts) == 3 && parts[0] == "accounts" {
-			where = "accounts.<an account>." + parts[2]
-		}
-		return nil, fmt.Errorf("the setting accounts carries %s, a key shaped like a credential: an account is declared "+
-			"without its password or token, which it signs in with at its first use (novox/hq ADR 0316 §10, §14). "+
-			"Take it out at the controller's terminal", where)
-	}
-	var top map[string]json.RawMessage
-	if err := json.Unmarshal(raw, &top); err != nil {
-		return nil, fmt.Errorf("~/%s is not an object: %v", accountsFile, err)
-	}
-	accounts := map[string]Account{}
-	if body, ok := top["accounts"]; ok && string(body) != "null" {
-		dec := json.NewDecoder(bytes.NewReader(body))
-		dec.DisallowUnknownFields()
-		if err := dec.Decode(&accounts); err != nil {
-			return nil, fmt.Errorf("the setting accounts is not a map of accounts by name: %v", err)
-		}
-	}
-	var problems []string
-	names := sortedNames(accounts)
-	for i, name := range names {
-		problems = append(problems, accountProblems(fmt.Sprintf("declared account %d of %d", i+1, len(names)),
-			name, accounts[name])...)
-	}
-	if len(problems) > 0 {
-		return nil, fmt.Errorf("the setting accounts is refused: %s", strings.Join(problems, "; "))
-	}
-	return accounts, nil
-}
-
-// secretKeyIn is the path of the first key shaped like a credential in a JSON tree, or "".
-func secretKeyIn(node any, at string) string {
-	switch v := node.(type) {
-	case map[string]any:
-		keys := make([]string, 0, len(v))
-		for k := range v {
-			keys = append(keys, k)
-		}
-		sort.Strings(keys)
-		for _, k := range keys {
-			here := k
-			if at != "" {
-				here = at + "." + k
-			}
-			if secretKey.MatchString(k) {
-				return here
-			}
-			if w := secretKeyIn(v[k], here); w != "" {
-				return w
-			}
-		}
-	case []any:
-		for i, x := range v {
-			if w := secretKeyIn(x, fmt.Sprintf("%s[%d]", at, i)); w != "" {
-				return w
-			}
-		}
-	}
-	return ""
-}
-
-func sortedNames(accounts map[string]Account) []string {
-	names := make([]string, 0, len(accounts))
-	for n := range accounts {
-		names = append(names, n)
-	}
-	sort.Strings(names)
-	return names
-}
-
-// accountProblems is what is wrong with one declared account, said of it by its place (label) and never by a
-// value of it, its name included (novox/hq ADR 0316 §16).
-func accountProblems(label, name string, a Account) []string {
-	var out []string
-	say := func(format string, args ...any) { out = append(out, label+": "+fmt.Sprintf(format, args...)) }
-	if !accountName.MatchString(name) {
-		say("an account's name is lower-case letters and digits, starting with a letter (it names the module's keys, mesh_<name>)")
-	}
-	if !addressShape.MatchString(a.Address) {
-		say("the address is not a mail address")
-	}
-	if a.Key != "" && !profileKey.MatchString(a.Key) {
-		say("key is an account key of the profile, such as account2")
-	}
-	for field, v := range map[string]string{"from-name": a.FromName, "label": a.Label} {
-		if !plainText.MatchString(v) {
-			say("%s holds a quote, a backslash or a line break", field)
-		}
-	}
-	for side, s := range map[string]Server{"incoming": a.Incoming, "outgoing": a.Outgoing} {
-		switch {
-		case side == "incoming" && s.Kind != "imap" && s.Kind != "pop3":
-			say("the incoming server's kind is imap or pop3")
-		case side == "outgoing" && s.Kind != "" && s.Kind != "smtp":
-			say("the outgoing server is smtp")
-		}
-		if !hostShape.MatchString(s.Host) {
-			say("the %s server's host is not a host name", side)
-		}
-		if s.Port < 0 || s.Port > 65535 {
-			say("the %s server's port is not a port", side)
-		}
-		if _, ok := securities[s.Security]; !ok {
-			say("the %s server's security is tls, starttls or none", side)
-		}
-		if _, ok := signIns[s.SignIn]; !ok || (side == "incoming" && s.SignIn == "none") {
-			say("the %s server's sign-in is password, encrypted-password, oauth, kerberos, ntlm or tls-certificate%s",
-				side, map[bool]string{true: ", or none", false: ""}[side == "outgoing"])
-		}
-		if !plainText.MatchString(s.User) {
-			say("the %s server's user holds a quote, a backslash or a line break", side)
-		}
-	}
-	return out
-}
-
-// quoted is a preference's string value as user.js writes it.
-func quoted(s string) string { return strconv.Quote(s) }
-
-// declaredPrefs are a declared account's fields as preferences under the keys it resolved to, name to value
-// as user.js writes it, in a fixed order. Only the fields the setting names (novox/hq ADR 0317 §5): never
-// the account's directory, folders, filters or caches. An adopted account keeps its kind, the outgoing server
-// its identity names, and its own name and sender's name where the declaration says none; a created one
-// gets every field.
-func declaredPrefs(k keySet, a Account, adopted bool) [][2]string {
-	label := a.Label
-	if label == "" && !adopted {
-		label = a.Address
-	}
-	inPort := a.Incoming.Port
-	if inPort == 0 {
-		inPort = defaultPort(a.Incoming.Kind, a.Incoming.Security)
-	}
-	outPort := a.Outgoing.Port
-	if outPort == 0 {
-		outPort = defaultPort("smtp", a.Outgoing.Security)
-	}
-	var out [][2]string
-	add := func(key, value string) { out = append(out, [2]string{key, value}) }
-	if !adopted {
-		add("mail.account."+k.Account+".identities", quoted(k.Identity))
-		add("mail.account."+k.Account+".server", quoted(k.Server))
-	}
-	if a.FromName != "" || !adopted {
-		add("mail.identity."+k.Identity+".fullName", quoted(a.FromName))
-	}
-	add("mail.identity."+k.Identity+".useremail", quoted(a.Address))
-	if !adopted {
-		add("mail.identity."+k.Identity+".smtpServer", quoted(k.SMTP))
-		add("mail.identity."+k.Identity+".valid", "true")
-		add("mail.server."+k.Server+".type", quoted(a.Incoming.Kind))
-	}
-	add("mail.server."+k.Server+".hostname", quoted(a.Incoming.Host))
-	add("mail.server."+k.Server+".port", strconv.Itoa(inPort))
-	add("mail.server."+k.Server+".socketType", strconv.Itoa(securities[a.Incoming.Security]))
-	add("mail.server."+k.Server+".authMethod", strconv.Itoa(signIns[a.Incoming.SignIn]))
-	add("mail.server."+k.Server+".userName", quoted(a.Incoming.User))
-	if label != "" {
-		add("mail.server."+k.Server+".name", quoted(label))
-	}
-	add("mail.smtpserver."+k.SMTP+".hostname", quoted(a.Outgoing.Host))
-	add("mail.smtpserver."+k.SMTP+".port", strconv.Itoa(outPort))
-	add("mail.smtpserver."+k.SMTP+".try_ssl", strconv.Itoa(securities[a.Outgoing.Security]))
-	add("mail.smtpserver."+k.SMTP+".authMethod", strconv.Itoa(signIns[a.Outgoing.SignIn]))
-	add("mail.smtpserver."+k.SMTP+".username", quoted(a.Outgoing.User))
-	if label != "" {
-		add("mail.smtpserver."+k.SMTP+".description", quoted(label))
-	}
-	return out
-}
-
-// defaultPort is the port a server listens on when the declaration says none.
-func defaultPort(kind, security string) int {
-	switch {
-	case kind == "imap" && security == "tls":
-		return 993
-	case kind == "imap":
-		return 143
-	case kind == "pop3" && security == "tls":
-		return 995
-	case kind == "pop3":
-		return 110
-	case security == "tls":
-		return 465
-	case security == "starttls":
-		return 587
-	}
-	return 25
-}
-
-// composeUserJS is the user.js the module places in the profile: the declared file (the setting prefs), then
-// each adopted or created account's declared fields under its keys. A refused account has none.
-func composeUserJS(declaredText string, accounts map[string]Account, resolved []resolvedAccount) string {
-	var lines []string
-	for _, r := range resolved {
-		if r.How == refused {
-			continue
-		}
-		lines = append(lines, fmt.Sprintf("// declared account %d: %s under %s", r.Place, r.How, r.Keys.Account))
-		for _, p := range declaredPrefs(r.Keys, accounts[r.name], r.How == adopted) {
-			lines = append(lines, fmt.Sprintf("user_pref(%s, %s);", quoted(p[0]), p[1]))
-		}
-	}
-	if len(lines) == 0 {
-		return declaredText
-	}
-	return strings.TrimRight(declaredText, "\n") + "\n\n" +
-		"// The accounts the setting accounts declares (novox/hq ADR 0316 §11, ADR 0317): the fields it names, under\n" +
-		"// the keys of the account adopted or created. No password or token: an account signs in at its first use.\n" +
-		strings.Join(lines, "\n") + "\n"
-}
-
-// profileAccount is one account the profile holds, as its preferences say it.
-type profileAccount struct {
-	Key, Server, Kind string
-	// Identities are its identities, the default first, and Addresses their addresses in that order.
-	Identities []string
-	Addresses  []string
-	Owl, Ours  bool
-}
-
-// profileAccounts reads the accounts the profile's list names, from prefs.js and user.js (user.js wins).
-func profileAccounts(prefs map[string]string) []profileAccount {
-	var out []profileAccount
-	for _, key := range listOf(prefs["mail.accountmanager.accounts"]) {
-		a := profileAccount{Key: key, Server: unquote(prefs["mail.account."+key+".server"])}
-		a.Kind = unquote(prefs["mail.server."+a.Server+".type"])
-		a.Owl = strings.HasPrefix(a.Kind, "owl")
-		a.Ours = ownKey.MatchString(key)
-		for _, id := range listOf(prefs["mail.account."+key+".identities"]) {
-			a.Identities = append(a.Identities, id)
-			a.Addresses = append(a.Addresses, unquote(prefs["mail.identity."+id+".useremail"]))
-		}
-		out = append(out, a)
-	}
-	return out
-}
-
-// mergedPrefs are a profile's preferences as Betterbird starts with them: prefs.js, then user.js over it.
-func mergedPrefs(profile string) map[string]string {
-	prefsJS, _ := readBounded(filepath.Join(profile, "prefs.js"))
-	userJS, _ := readBounded(filepath.Join(profile, "user.js"))
-	out := readPrefs(prefsJS)
-	for k, v := range readPrefs(userJS) {
-		out[k] = v
-	}
-	return out
-}
-
-// listOf reads a comma-separated list preference's value.
-func listOf(v string) []string {
-	var out []string
-	for _, k := range strings.Split(unquote(v), ",") {
-		if k = strings.TrimSpace(k); k != "" {
-			out = append(out, k)
-		}
-	}
-	return out
-}
-
-// unquote is a preference's string value without its quotes; any other value as written.
-func unquote(v string) string {
-	if s, err := strconv.Unquote(v); err == nil {
-		return s
-	}
-	return v
-}
-
-// writeAccountLists writes the module's keys into the profile's account list and list of outgoing servers
-// (§12): the declared accounts' keys added at the end, the module's keys of accounts no longer declared taken
-// out, every other key and line kept as it was. Only while Betterbird is not running. Says what changed.
-func (m *Machine) writeAccountLists(profile string, resolved []resolvedAccount) (string, error) {
-	path := filepath.Join(profile, "prefs.js")
-	raw, err := readBounded(path)
-	if err != nil && !errors.Is(err, os.ErrNotExist) {
-		return "", err
-	}
-	var wantAccounts, wantSMTP []string
-	for _, r := range resolved {
-		if r.How == created {
-			wantAccounts, wantSMTP = append(wantAccounts, r.Keys.Account), append(wantSMTP, r.Keys.SMTP)
-		}
-	}
-	out, changed := withListed(string(raw), map[string][]string{
-		"mail.accountmanager.accounts": wantAccounts, "mail.smtpservers": wantSMTP})
-	if !changed {
-		return "unchanged", nil
-	}
-	// Only while Betterbird is closed: no main process and no lock on the profile (novox/hq ADR 0316 §12, ADR 0329 §9).
-	if why := m.closedFor(profile); why != "" {
-		return "", errors.New(why + ": the account list is written at its next start from the launcher, or by betterbird_restart")
-	}
-	mode := os.FileMode(0o600)
-	if st, err := os.Stat(path); err == nil {
-		mode = st.Mode().Perm()
-	}
-	if err := writeAtomic(path, []byte(out), mode); err != nil {
-		return "", err
-	}
-	return fmt.Sprintf("written: %d account(s) the module created in the account list", len(wantAccounts)), nil
-}
-
-// withListed is prefs.js with each list preference holding the module's wanted keys: its own keys that are
-// not wanted taken out, the wanted ones not there added at its end, everything else as it was. A list the
-// file does not hold yet is added as a line, when anything is wanted in it.
-func withListed(text string, want map[string][]string) (string, bool) {
-	changed := false
-	done := map[string]bool{}
-	var lines []string
-	s := bufio.NewScanner(strings.NewReader(text))
-	s.Buffer(make([]byte, 64<<10), 4<<20)
-	for s.Scan() {
-		line := s.Text()
-		if mm := prefLine.FindStringSubmatch(line); mm != nil {
-			if keys, ok := want[mm[1]]; ok && !done[mm[1]] {
-				done[mm[1]] = true
-				next := listedWith(listOf(mm[2]), keys)
-				if next != strings.Join(listOf(mm[2]), ",") {
-					line = fmt.Sprintf("user_pref(%s, %s);", quoted(mm[1]), quoted(next))
-					changed = true
-				}
-			}
-		}
-		lines = append(lines, line)
-	}
-	names := make([]string, 0, len(want))
-	for n := range want {
-		names = append(names, n)
-	}
-	sort.Strings(names)
-	for _, n := range names {
-		if !done[n] && len(want[n]) > 0 {
-			lines = append(lines, fmt.Sprintf("user_pref(%s, %s);", quoted(n), quoted(strings.Join(want[n], ","))))
-			changed = true
-		}
-	}
-	out := strings.Join(lines, "\n")
-	if text == "" || strings.HasSuffix(text, "\n") {
-		out += "\n"
-	}
-	return out, changed
-}
-
-// listedWith is a list with the module's own keys made the wanted ones, every other key in its place.
-func listedWith(have, wanted []string) string {
-	want := map[string]bool{}
-	for _, k := range wanted {
-		want[k] = true
-	}
-	var out []string
-	there := map[string]bool{}
-	for _, k := range have {
-		if ownKey.MatchString(k) && !want[k] {
-			continue
-		}
-		out = append(out, k)
-		there[k] = true
-	}
-	for _, k := range wanted {
-		if !there[k] {
-			out = append(out, k)
-		}
-	}
-	return strings.Join(out, ",")
-}
-
-// AccountCount is what status and check say of the accounts: numbers, places and keys, never an address, a
-// host or a name (novox/hq ADR 0316 §16, ADR 0317 §3).
-type AccountCount struct {
-	Declared int `json:"declared"`
-	// InList are the declared accounts the profile's account list names, adopted or created.
-	InList int `json:"declared_in_the_list"`
-	// Others are the accounts the profile holds that no declaration names (the work account in Owl among them).
-	Others int `json:"other_accounts"`
-	// WithoutSignIn are the declared accounts with no sign-in kept in Betterbird's login store yet.
-	WithoutSignIn int `json:"declared_without_a_sign_in,omitempty"`
-	// Each is every declared account by its place in the setting: adopted, created or refused, and its keys.
-	Each    []resolvedAccount `json:"each,omitempty"`
-	Problem string            `json:"problem,omitempty"`
-}
-
-// countAccounts counts the declared accounts against the profile's.
-func (m *Machine) countAccounts(profile, profileDir string) AccountCount {
-	var c AccountCount
-	accounts, _, err := m.readAccounts()
-	if err != nil {
-		c.Problem = err.Error()
-		return c
-	}
-	c.Declared = len(accounts)
-	prefs := mergedPrefs(profile)
-	have := profileAccounts(prefs)
-	c.Each = resolveAccounts(accounts, prefs, m.readRecord(profileDir))
-	mine := map[string]bool{}
-	refusedN := 0
-	for _, r := range c.Each {
-		if r.How == refused {
-			refusedN++
-			continue
-		}
-		mine[r.Keys.Account] = true
-	}
-	for _, a := range have {
-		switch {
-		case mine[a.Key]:
-			c.InList++
-		case a.Kind != "none":
-			c.Others++
-		}
-	}
-	if refusedN > 0 {
-		c.Problem = fmt.Sprintf("%d declared account(s) are refused: each says why and what to do", refusedN)
-	}
-	c.WithoutSignIn = len(withoutSignIn(accounts, keptSignIns(profile)))
-	return c
-}
-
-// keptSignIns are the server names Betterbird's login store keeps a sign-in for: the `hostname` of each
-// entry of logins.json, which Betterbird writes in the clear. Nothing else of the file is read.
-func keptSignIns(profile string) map[string]bool {
-	raw, err := readBounded(filepath.Join(profile, "logins.json"))
-	out := map[string]bool{}
-	if err != nil {
-		return out
-	}
-	var store struct {
-		Logins []struct {
-			Hostname string `json:"hostname"`
-		} `json:"logins"`
-	}
-	if json.Unmarshal(raw, &store) != nil {
-		return out
-	}
-	for _, l := range store.Logins {
-		out[strings.ToLower(l.Hostname)] = true
-	}
-	return out
-}
-
-// oauthIssuers are the sign-in services of the providers whose servers sign in through OAuth, by a suffix of
-// the server's host: their kept sign-in is under the service's name, not the server's.
-var oauthIssuers = map[string]string{"gmail.com": "oauth://accounts.google.com",
-	"googlemail.com": "oauth://accounts.google.com", "office365.com": "oauth://login.microsoftonline.com",
-	"outlook.com": "oauth://login.microsoftonline.com"}
-
-// withoutSignIn are the declared accounts whose incoming server has no sign-in kept yet. A server signed in
-// to without a password (none, kerberos, ntlm, a certificate) keeps nothing and is never counted.
-func withoutSignIn(accounts map[string]Account, kept map[string]bool) []string {
-	var out []string
-	for _, name := range sortedNames(accounts) {
-		in := accounts[name].Incoming
-		switch in.SignIn {
-		case "password", "encrypted-password":
-			if !kept[strings.ToLower(in.Kind+"://"+in.Host)] {
-				out = append(out, name)
-			}
-		case "oauth":
-			issuer := ""
-			for suffix, i := range oauthIssuers {
-				if strings.HasSuffix(strings.ToLower(in.Host), suffix) {
-					issuer = i
-				}
-			}
-			found := false
-			for k := range kept {
-				if (issuer != "" && k == issuer) || (issuer == "" && strings.HasPrefix(k, "oauth://")) {
-					found = true
-				}
-			}
-			if !found {
-				out = append(out, name)
-			}
-		}
-	}
-	return out
-}
-
-// AccountsAnswer is what betterbird_accounts answers its caller: the profile's accounts with the operator's own
-// values (novox/hq ADR 0329 §1, §12), Owl's marked and by name and address only (§13), and counts and kinds.
-// Never a password, a token or anything of the login store (§2).
-type AccountsAnswer struct {
-	Profile string `json:"profile"`
-	// Accounts are the profile's accounts, in its list's order.
-	Accounts []listedAccount `json:"accounts"`
-	// Derived is the value of the setting accounts the propose built, as it was proposed (ADR 0329 §10).
-	Derived map[string]Account `json:"derived,omitempty"`
-	// Declarable are the profile's mail accounts a declaration can hold (IMAP and POP3), by kind.
-	Declarable map[string]int `json:"declarable"`
-	// KeptByOwl are the accounts Owl keeps (the work account through Exchange): never declared (ADR 0316 §13).
-	KeptByOwl int `json:"kept_by_owl"`
-	// NotDeclarable are accounts of another kind (local folders, feeds, news, chat), by kind.
-	NotDeclarable map[string]int `json:"not_declarable,omitempty"`
-	// AlreadyDeclared are the declarable accounts under the module's own keys.
-	AlreadyDeclared int `json:"under_the_modules_keys"`
-	// Proposed is the controller's answer to the proposal, with every address and host masked.
-	Proposed string `json:"proposed,omitempty"`
-	Note     string `json:"note"`
-}
-
-// listedAccount is one account of the profile as betterbird_accounts lists it.
-type listedAccount struct {
-	Key  string `json:"key"`
-	Kind string `json:"kind"`
-	// DeclaredAs is the name the setting accounts declares it under, or empty: the person's own.
-	DeclaredAs string `json:"declared_as,omitempty"`
-	Owl        bool   `json:"owl,omitempty"`
-	// Name is what Betterbird shows it as, and Address its default identity's.
-	Name    string   `json:"name,omitempty"`
-	Address string   `json:"address,omitempty"`
-	Value   *Account `json:"value,omitempty"`
-	Note    string   `json:"note,omitempty"`
-}
-
-// profileDeclarable reads the profile's accounts: the value a declaration of them would be, by name, and
-// what is answered of them.
-func (m *Machine) profileDeclarable() (map[string]Account, AccountsAnswer, error) {
-	p, err := m.profile()
-	if err != nil {
-		return nil, AccountsAnswer{}, err
-	}
-	prefs := mergedPrefs(p.path)
-	a := AccountsAnswer{Profile: p.Dir, Accounts: []listedAccount{}, Declarable: map[string]int{}, NotDeclarable: map[string]int{}}
-	value := map[string]Account{}
-	used := map[string]bool{}
-	declaredAs := map[string]string{}
-	if accounts, _, err := m.readAccounts(); err == nil {
-		for _, r := range resolveAccounts(accounts, prefs, m.readRecord(p.Dir)) {
-			if r.How != refused {
-				declaredAs[r.Keys.Account] = r.name
-			}
-		}
-	}
-	for _, pa := range profileAccounts(prefs) {
-		listed := listedAccount{Key: pa.Key, Kind: pa.Kind, DeclaredAs: declaredAs[pa.Key], Owl: pa.Owl,
-			Name: unquote(prefs["mail.server."+pa.Server+".name"])}
-		if len(pa.Addresses) > 0 {
-			listed.Address = pa.Addresses[0]
-		}
-		switch {
-		case pa.Owl:
-			a.KeptByOwl++
-			listed.Note = "Owl's: never declared (novox/hq ADR 0316 §13)"
-			a.Accounts = append(a.Accounts, listed)
-			continue
-		case pa.Kind != "imap" && pa.Kind != "pop3":
-			kind := pa.Kind
-			if kind == "none" {
-				kind = "local folders"
-			}
-			a.NotDeclarable[kind]++
-			listed.Note = "not an account a declaration holds"
-			a.Accounts = append(a.Accounts, listed)
-			continue
-		}
-		a.Declarable[pa.Kind]++
-		if pa.Ours {
-			a.AlreadyDeclared++
-		}
-		address := ""
-		if len(pa.Addresses) > 0 {
-			address = pa.Addresses[0]
-		}
-		name := nameFor(pa, address, used)
-		if declaredAs[pa.Key] != "" {
-			name = declaredAs[pa.Key]
-		}
-		used[name] = true
-		acc := readAccount(prefs, pa)
-		value[name] = acc
-		listed.Value = &acc
-		a.Accounts = append(a.Accounts, listed)
-	}
-	if len(a.NotDeclarable) == 0 {
-		a.NotDeclarable = nil
-	}
-	return value, a, nil
-}
-
-// asker calls a verb of the mesh as this module, through the runtime: a variable so a test answers.
-var asker = stdio.Ask
-
-// ProfileAccounts says, by count and kind, which accounts the profile in use holds; with propose it builds
-// the setting accounts from them (every account but Owl's, without any credential) and proposes it through
-// the controller's settings verb for the operator's Approve (novox/hq ADR 0317 §9, ADR 0277). The value
-// never comes back to the caller: the operator reads it whole at their desk (`settings proposals <id>`) and
-// checks the fingerprint the ask shows.
-func (m *Machine) ProfileAccounts(propose bool) (AccountsAnswer, error) {
-	value, a, err := m.profileDeclarable()
-	if err != nil {
-		return a, err
-	}
-	a.Note = "the profile's accounts with their values, never a password or token (novox/hq ADR 0329 §1, §2). With " +
-		"propose, the setting accounts is built from them (never Owl's) and proposed to the operator in the mesh-wide " +
-		"layer as it stands, who approves it on a channel that proves who answers (novox/hq ADR 0317 §9)"
-	if !propose {
-		return a, nil
-	}
-	if len(value) == 0 {
-		return a, errors.New("the profile holds no IMAP or POP3 account to declare: nothing was proposed")
-	}
-	var problems []string
-	for i, name := range sortedNames(value) {
-		if p := accountProblems("", name, value[name]); len(p) > 0 {
-			problems = append(problems, fmt.Sprintf("account %d of %d: %d field(s) cannot be declared as the profile "+
-				"holds them", i+1, len(value), len(p)))
-		}
-	}
-	if len(problems) > 0 {
-		return a, fmt.Errorf("nothing was proposed: %s; betterbird_prefs shows the account's preferences by name",
-			strings.Join(problems, "; "))
-	}
-	// A layer is replaced whole: the proposal carries the mesh-wide layer as it stands, with this value of accounts.
-	layer, err := readLayer("")
-	if err != nil {
-		return a, fmt.Errorf("nothing was proposed: %v", err)
-	}
-	layer["accounts"] = value
-	a.Derived = value
-	said, err := proposeLayer("", layer, false)
-	a.Proposed = m.maskValue(said)
-	return a, err
-}
-
-// verbSaid is a verb's words and whether it went ahead, whatever wraps them: the controller's {ok, output},
-// or the protocol's content list.
-func verbSaid(raw json.RawMessage) (string, bool) {
-	var s string
-	if json.Unmarshal(raw, &s) == nil {
-		return verbSaid(json.RawMessage(s))
-	}
-	var m map[string]json.RawMessage
-	if json.Unmarshal(raw, &m) != nil {
-		return string(raw), true
-	}
-	if content, has := m["content"]; has {
-		var items []struct {
-			Text string `json:"text"`
-		}
-		var e struct {
-			IsError bool `json:"isError"`
-		}
-		_ = json.Unmarshal(raw, &e)
-		if json.Unmarshal(content, &items) == nil && len(items) > 0 {
-			out, ok := verbSaid(json.RawMessage(items[0].Text))
-			return out, ok && !e.IsError
-		}
-	}
-	if okRaw, has := m["ok"]; has {
-		var ok bool
-		_ = json.Unmarshal(okRaw, &ok)
-		var output string
-		_ = json.Unmarshal(m["output"], &output)
-		return output, ok
-	}
-	return string(raw), true
-}
-
-// readAccount reads one profile account's preferences into the shape of the setting.
-func readAccount(prefs map[string]string, pa profileAccount) Account {
-	num := func(key string, def int) int {
-		if n, err := strconv.Atoi(prefs[key]); err == nil {
-			return n
-		}
-		return def
-	}
-	text := func(key string) string { return unquote(prefs[key]) }
-	srv := "mail.server." + pa.Server + "."
-	acc := Account{Incoming: Server{Kind: pa.Kind, Host: text(srv + "hostname"), User: text(srv + "userName"),
-		Security: wordFor(securities, num(srv+"socketType", 0)), SignIn: wordFor(signIns, num(srv+"authMethod", 3))}}
-	acc.Incoming.Port = num(srv+"port", defaultPort(pa.Kind, acc.Incoming.Security))
-	ids := listOf(prefs["mail.account."+pa.Key+".identities"])
-	if len(ids) > 0 {
-		id := "mail.identity." + ids[0] + "."
-		acc.Address, acc.FromName = text(id+"useremail"), text(id+"fullName")
-		smtp := text(id + "smtpServer")
-		if smtp == "" {
-			smtp = text("mail.smtp.defaultserver")
-		}
-		if smtp != "" {
-			s := "mail.smtpserver." + smtp + "."
-			acc.Outgoing = Server{Host: text(s + "hostname"), User: text(s + "username"),
-				Security: wordFor(securities, num(s+"try_ssl", 0)), SignIn: wordFor(signIns, num(s+"authMethod", 3))}
-			acc.Outgoing.Port = num(s+"port", defaultPort("smtp", acc.Outgoing.Security))
-		}
-	}
-	if label := text(srv + "name"); label != "" && label != acc.Address {
-		acc.Label = label
-	}
-	return acc
-}
-
-// nameFor is the name a profile account is answered under: its own name when the module declared it, else
-// the first label of its address's domain, made unique.
-func nameFor(pa profileAccount, address string, used map[string]bool) string {
-	if mm := ownKey.FindStringSubmatch(pa.Key); mm != nil {
-		return mm[1]
-	}
-	base := "account"
-	if _, domain, ok := strings.Cut(address, "@"); ok {
-		label, _, _ := strings.Cut(strings.ToLower(domain), ".")
-		label = regexp.MustCompile(`[^a-z0-9]`).ReplaceAllString(label, "")
-		if label != "" && label[0] >= 'a' && label[0] <= 'z' {
-			base = label
-		}
-	}
-	if len(base) > 28 {
-		base = base[:28]
-	}
-	name := base
-	for i := 2; used[name]; i++ {
-		name = base + strconv.Itoa(i)
-	}
-	return name
-}

modules/betterbird/cmd/betterbird-tools/accounts_test.go

@@ -1,567 +0,0 @@
-package main
-
-import (
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-// The setting accounts (novox/hq ADR 0316 §10–§16, ADR 0317 §9 for betterbird_accounts): declared without
-// credentials, written under the module's own keys, the account list written into and never owned, refused
-// rather than duplicated, and said by count.
-
-const personal = `{"accounts": {
-  "personal": {"address": "me@mail.example.org", "from-name": "Me",
-    "incoming": {"kind": "imap", "host": "imap.example.org", "security": "tls", "sign-in": "password", "user": "me"},
-    "outgoing": {"host": "smtp.example.org", "port": 587, "security": "starttls", "sign-in": "password", "user": "me"}}
-}}`
-
-// profileWithAccounts is a profile holding an account of the person's at another address, Owl's work account,
-// local folders, and an account list in that order.
-func (f *fake) profileWithAccounts() {
-	f.betterbird()
-	f.write(profileDir+"/prefs.js", "// Mozilla User Preferences\n"+
-		`user_pref("mail.account.account1.server", "server1");`+"\n"+
-		`user_pref("mail.account.account1.identities", "id1");`+"\n"+
-		`user_pref("mail.account.account2.server", "server2");`+"\n"+
-		`user_pref("mail.account.account3.server", "server3");`+"\n"+
-		`user_pref("mail.account.account3.identities", "id3");`+"\n"+
-		`user_pref("mail.accountmanager.accounts", "account1,account3,account2");`+"\n"+
-		`user_pref("mail.identity.id1.useremail", "other@mail.example.org");`+"\n"+
-		`user_pref("mail.identity.id1.fullName", "Other");`+"\n"+
-		`user_pref("mail.identity.id1.smtpServer", "smtp1");`+"\n"+
-		`user_pref("mail.identity.id3.useremail", "work@corp.example.com");`+"\n"+
-		`user_pref("mail.server.server1.type", "imap");`+"\n"+
-		`user_pref("mail.server.server1.hostname", "imap.example.org");`+"\n"+
-		`user_pref("mail.server.server1.socketType", 3);`+"\n"+
-		`user_pref("mail.server.server1.authMethod", 10);`+"\n"+
-		`user_pref("mail.server.server1.userName", "other");`+"\n"+
-		`user_pref("mail.server.server1.directory", "/home/operator/.thunderbird/x/ImapMail/imap.example.org");`+"\n"+
-		`user_pref("mail.server.server2.type", "none");`+"\n"+
-		`user_pref("mail.server.server3.type", "owl-ews");`+"\n"+
-		`user_pref("mail.smtpserver.smtp1.hostname", "smtp.example.org");`+"\n"+
-		`user_pref("mail.smtpserver.smtp1.try_ssl", 3);`+"\n"+
-		`user_pref("mail.smtpserver.smtp1.authMethod", 10);`+"\n"+
-		`user_pref("mail.smtpserver.smtp1.username", "other");`+"\n"+
-		`user_pref("mail.smtpservers", "smtp1");`+"\n"+
-		`user_pref("mailnews.tags.version", 2);`+"\n")
-}
-
-func (f *fake) declareAccounts(body string) {
-	f.write(testHome+"/"+accountsFile, body)
-}
-
-func (f *fake) read(path string) string {
-	f.t.Helper()
-	raw, err := os.ReadFile(filepath.Join(f.Root, path))
-	if err != nil {
-		f.t.Fatal(err)
-	}
-	return string(raw)
-}
-
-func TestAnAccountsValueCarryingAPasswordLikeFieldIsRefusedWithoutItsValue(t *testing.T) {
-	for _, body := range []string{
-		`{"accounts": {"personal": {"address": "me@mail.example.org", "password": "hunter2"}}}`,
-		`{"accounts": {"personal": {"incoming": {"oauth_refresh": "1//hunter2"}}}}`,
-		`{"token": "hunter2", "accounts": {}}`,
-	} {
-		_, err := parseAccounts([]byte(body))
-		if err == nil || !strings.Contains(err.Error(), "shaped like a credential") || strings.Contains(err.Error(), "hunter2") {
-			t.Errorf("%s: %v", body, err)
-		}
-	}
-	// An unknown field is refused too, and a value that cannot be declared, said by the account's place.
-	if _, err := parseAccounts([]byte(`{"accounts": {"personal": {"address": "me@mail.example.org", "keychain": 1}}}`)); err == nil {
-		t.Error("an unknown field was taken")
-	}
-	_, err := parseAccounts([]byte(strings.Replace(personal, `"security": "tls"`, `"security": "maybe"`, 1)))
-	if err == nil || !strings.Contains(err.Error(), "declared account 1 of 1") || strings.Contains(err.Error(), "personal") ||
-		strings.Contains(err.Error(), "example.org") {
-		t.Errorf("a bad value is said by the account's place, never its name or a value: %v", err)
-	}
-}
-
-func TestTheSettingPrefsRefusesAnAccountsPreferences(t *testing.T) {
-	for _, name := range []string{"mail.account.account1.server", "mail.identity.id1.useremail", "mail.server.server1.hostname",
-		"mail.smtpserver.smtp1.hostname", "mail.accountmanager.accounts", "mail.smtpservers"} {
-		err := validUserJS(mark + ")\nuser_pref(\"" + name + "\", \"x\");\n")
-		if err == nil || !strings.Contains(err.Error(), "setting accounts") {
-			t.Errorf("%s was taken in prefs: %v", name, err)
-		}
-	}
-	if err := validUserJS(mark + ")\nuser_pref(\"calendar.alarms.show\", true);\n"); err != nil {
-		t.Fatal(err)
-	}
-}
-
-// noPackage answers pacman as a machine without the community package.
-func (f *fake) noPackage() {
-	f.answer = func(name string, args []string) Output {
-		if name == "pacman" {
-			return Output{Code: 1}
-		}
-		return Output{}
-	}
-}
-
-// userPrefLines are the user_pref lines of a user.js, by preference name.
-func userPrefLines(t *testing.T, text string) map[string]string {
-	t.Helper()
-	out := map[string]string{}
-	for _, line := range strings.Split(text, "\n") {
-		if !strings.HasPrefix(line, "user_pref(") {
-			continue
-		}
-		if !statement.MatchString(line) {
-			t.Errorf("not a statement Betterbird reads as one: %s", line)
-		}
-		out[line[len(`user_pref("`):strings.Index(line, `",`)]] = line
-	}
-	return out
-}
-
-func TestADeclaredAccountTheProfileDoesNotHoldIsCreatedUnderTheModulesKeysAndListed(t *testing.T) {
-	f := newFake(t)
-	f.profileWithAccounts()
-	f.noPackage()
-	links(t, nil)
-	f.declare("// none")
-	f.declareAccounts(personal)
-	// Betterbird is running: the user.js is placed, the list waits for its next start.
-	u, err := f.userJS(true)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !strings.HasPrefix(u.Lists, "not written") || !strings.Contains(u.Lists, "running") {
-		t.Fatalf("the list is never written while Betterbird runs: %+v", u)
-	}
-	if len(u.Each) != 1 || u.Each[0].How != created || u.Each[0].Keys != (keySet{"account_mesh_personal", "id_mesh_personal",
-		"server_mesh_personal", "smtp_mesh_personal"}) {
-		t.Fatalf("%+v", u.Each)
-	}
-	placed := f.read(profileDir + "/user.js")
-	for name := range userPrefLines(t, placed) {
-		if key := strings.Split(name, ".")[2]; !strings.HasSuffix(key, "mesh_personal") {
-			t.Errorf("a created account's preference outside the module's keys: %s", name)
-		}
-		if strings.Contains(strings.ToLower(name), "password") || strings.Contains(name, "directory") {
-			t.Errorf("the module writes no credential and none of Betterbird's own preferences: %s", name)
-		}
-	}
-	for _, want := range []string{`user_pref("mail.server.server_mesh_personal.port", 993);`,
-		`user_pref("mail.server.server_mesh_personal.socketType", 3);`,
-		`user_pref("mail.smtpserver.smtp_mesh_personal.try_ssl", 2);`,
-		`user_pref("mail.identity.id_mesh_personal.useremail", "me@mail.example.org");`} {
-		if !strings.Contains(placed, want) {
-			t.Errorf("the user.js lacks %s:\n%s", want, placed)
-		}
-	}
-
-	// Quit: the list gains the module's keys at its end, every other line as it was.
-	before := f.read(profileDir + "/prefs.js")
-	os.RemoveAll(filepath.Join(f.Root, "proc", "4000"))
-	if err := f.Prepare(); err != nil {
-		t.Fatal(err)
-	}
-	after := f.read(profileDir + "/prefs.js")
-	if !strings.Contains(after, `user_pref("mail.accountmanager.accounts", "account1,account3,account2,account_mesh_personal");`) ||
-		!strings.Contains(after, `user_pref("mail.smtpservers", "smtp1,smtp_mesh_personal");`) {
-		t.Fatalf("the lists:\n%s", after)
-	}
-	bl, al := strings.Split(before, "\n"), strings.Split(after, "\n")
-	if len(bl) != len(al) {
-		t.Fatalf("lines were added or lost: %d then %d", len(bl), len(al))
-	}
-	for i := range bl {
-		if bl[i] != al[i] && !strings.Contains(bl[i], "mail.accountmanager.accounts") && !strings.Contains(bl[i], "mail.smtpservers") {
-			t.Errorf("line %d changed: %q to %q", i+1, bl[i], al[i])
-		}
-	}
-
-	// The record lost: an account under the module's own keys is still its creation, never adopted.
-	os.Remove(filepath.Join(f.Root, testHome, recordFile))
-	u, err = f.userJS(true)
-	if err != nil || u.Each[0].How != created {
-		t.Fatalf("without the record, the module's keys still say created: %+v %v", u.Each, err)
-	}
-
-	// The account leaves the setting: only the module's keys go, the mail stays in the profile.
-	f.declareAccounts(`{"accounts": {}}`)
-	if err := f.Prepare(); err != nil {
-		t.Fatal(err)
-	}
-	if got := f.read(profileDir + "/prefs.js"); got != before {
-		t.Fatalf("removing the module's keys left the file otherwise as it was:\n%s", got)
-	}
-}
-
-// adoptable is a declaration of the profile's account1 (other@mail.example.org): equal but for its outgoing
-// port, said explicitly, and its incoming user.
-const adoptable = `{"accounts": {
-  "mail": {"address": "Other@mail.example.org",
-    "incoming": {"kind": "imap", "host": "imap.example.org", "security": "tls", "sign-in": "oauth", "user": "other2"},
-    "outgoing": {"host": "smtp.example.org", "port": 465, "security": "tls", "sign-in": "oauth", "user": "other"}}}}`
-
-func TestADeclaredAccountTheProfileHoldsIsAdoptedUnderItsOwnKeysAndTheListIsLeftAlone(t *testing.T) {
-	f := newFake(t)
-	f.profileWithAccounts()
-	f.noPackage()
-	links(t, nil)
-	f.declare("// none")
-	f.declareAccounts(adoptable)
-	os.RemoveAll(filepath.Join(f.Root, "proc", "4000"))
-	before := f.read(profileDir + "/prefs.js")
-	u, err := f.userJS(true)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(u.Each) != 1 || u.Each[0].How != adopted || u.Each[0].Keys != (keySet{"account1", "id1", "server1", "smtp1"}) {
-		t.Fatalf("adopted under the profile's keys: %+v", u.Each)
-	}
-	// The address's case and the user name differ; the default port declared explicitly is no change. Names
-	// only, no value.
-	if strings.Join(u.Each[0].Changed, ",") != "mail.identity.id1.useremail,mail.server.server1.userName" {
-		t.Fatalf("the changed preferences, by name: %v", u.Each[0].Changed)
-	}
-	if f.read(profileDir+"/prefs.js") != before || u.Lists != "unchanged" {
-		t.Fatalf("an adopted account's keys are in the lists already: nothing written to prefs.js (%s)", u.Lists)
-	}
-	lines := userPrefLines(t, f.read(profileDir+"/user.js"))
-	for name := range lines {
-		key := strings.Split(name, ".")[2]
-		if key != "account1" && key != "id1" && key != "server1" && key != "smtp1" {
-			t.Errorf("an adopted account's preference outside its keys: %s", name)
-		}
-		for _, never := range []string{"directory", ".type", "smtpServer", "identities", ".server"} {
-			if strings.HasSuffix(name, never) {
-				t.Errorf("the module wrote %s, which is Betterbird's or the account's own", name)
-			}
-		}
-	}
-	if !strings.Contains(lines["mail.server.server1.userName"], `"other2"`) {
-		t.Fatalf("the declared value wins at every start: %v", lines)
-	}
-	// The status says it by place and keys, never by address, host or name.
-	s, err := f.Status()
-	if err != nil {
-		t.Fatal(err)
-	}
-	raw, _ := json.Marshal(s.Accounts)
-	if s.Accounts.InList != 1 || s.Accounts.Others != 1 || strings.Contains(string(raw), "example") ||
-		strings.Contains(string(raw), `"mail"`) || !strings.Contains(string(raw), `"account1"`) {
-		t.Fatalf("%s", raw)
-	}
-
-	// Leaving the setting releases it: its lines and its record go, the account and the lists stay.
-	f.declareAccounts(`{"accounts": {}}`)
-	if err := f.Prepare(); err != nil {
-		t.Fatal(err)
-	}
-	if f.read(profileDir+"/prefs.js") != before || strings.Contains(f.read(profileDir+"/user.js"), "server1") ||
-		strings.Contains(f.read(testHome+"/"+recordFile), "account1") {
-		t.Fatal("a released account stays the person's, with no line or record of the module's")
-	}
-}
-
-func TestAnAmbiguousOwlsOrOtherKindOfMatchIsRefusedForThatAccountAlone(t *testing.T) {
-	f := newFake(t)
-	f.profileWithAccounts()
-	f.noPackage()
-	links(t, nil)
-	f.declare("// none")
-	os.RemoveAll(filepath.Join(f.Root, "proc", "4000"))
-	// A second account with account1's address.
-	prefs := f.read(profileDir + "/prefs.js")
-	prefs = strings.Replace(prefs, `"account1,account3,account2"`, `"account1,account3,account2,account4"`, 1) +
-		`user_pref("mail.account.account4.server", "server4");` + "\n" +
-		`user_pref("mail.account.account4.identities", "id4");` + "\n" +
-		`user_pref("mail.identity.id4.useremail", "other@mail.example.org");` + "\n" +
-		`user_pref("mail.identity.id4.smtpServer", "smtp4");` + "\n" +
-		`user_pref("mail.smtpserver.smtp4.hostname", "smtp.example.org");` + "\n" +
-		`user_pref("mail.server.server4.type", "imap");` + "\n"
-	f.write(profileDir+"/prefs.js", prefs)
-	both := strings.Replace(adoptable, `{"accounts": {`, `{"accounts": {
-  "zz": {"address": "new@mail.example.org",
-    "incoming": {"kind": "imap", "host": "imap.example.org", "security": "tls", "sign-in": "password"},
-    "outgoing": {"host": "smtp.example.org", "security": "tls", "sign-in": "password"}},`, 1)
-	f.declareAccounts(both)
-	err := f.Prepare()
-	if err == nil || !strings.Contains(err.Error(), "declared account 1 of 2: 2 accounts in the profile have its address (account1, account4)") ||
-		!strings.Contains(err.Error(), "key") || strings.Contains(err.Error(), "example.org") {
-		t.Fatalf("refused by place, with the matches' keys and the remedy, never the address: %v", err)
-	}
-	u, _ := f.userJS(false)
-	if u.Each[0].How != refused || u.Each[1].How != created {
-		t.Fatalf("the other declared account goes ahead: %+v", u.Each)
-	}
-	if strings.Contains(f.read(profileDir+"/user.js"), "server1") || strings.Contains(f.read(profileDir+"/user.js"), "server4") {
-		t.Fatal("a refused account gets no line")
-	}
-
-	// The node's layer names the key: that one is adopted.
-	f.declareAccounts(strings.Replace(both, `"address": "Other@mail.example.org",`, `"address": "Other@mail.example.org", "key": "account4",`, 1))
-	if err := f.Prepare(); err != nil {
-		t.Fatalf("%v", err)
-	}
-	if u, _ := f.userJS(false); u.Each[0].How != adopted || u.Each[0].Keys.Account != "account4" {
-		t.Fatalf("%+v", u.Each)
-	}
-	os.Remove(filepath.Join(f.Root, testHome, recordFile))
-	for key, want := range map[string]string{"account9": "not in the profile's account list", "account3": "Owl's",
-		"account2": "another address"} {
-		f.declareAccounts(strings.Replace(adoptable, `"address": "Other@mail.example.org",`, `"address": "Other@mail.example.org", "key": "`+key+`",`, 1))
-		if err := f.Prepare(); err == nil || !strings.Contains(err.Error(), want) {
-			t.Errorf("key %s: %v", key, err)
-		}
-	}
-
-	// Owl's account at the address, and an account of another kind than declared.
-	f.declareAccounts(`{"accounts": {"work": {"address": "work@corp.example.com",
-	  "incoming": {"kind": "imap", "host": "outlook.example.com", "security": "tls", "sign-in": "oauth"},
-	  "outgoing": {"host": "smtp.example.com", "security": "tls", "sign-in": "oauth"}}}}`)
-	if err := f.Prepare(); err == nil || !strings.Contains(err.Error(), "Owl's") {
-		t.Errorf("Owl's account is never adopted: %v", err)
-	}
-	f.write(profileDir+"/prefs.js", strings.Replace(prefs, `"mail.server.server4.type", "imap"`, `"mail.server.server4.type", "pop3"`, 1))
-	f.declareAccounts(strings.Replace(adoptable, `"address": "Other@mail.example.org",`, `"address": "Other@mail.example.org", "key": "account4",`, 1))
-	if err := f.Prepare(); err == nil || !strings.Contains(err.Error(), "never converts") {
-		t.Errorf("an account of another kind is refused, not converted: %v", err)
-	}
-}
-
-func TestDeclaredAccountsWithoutASignInAreCountedFromTheServerNamesAlone(t *testing.T) {
-	f := newFake(t)
-	f.profileWithAccounts()
-	links(t, nil)
-	f.declareAccounts(`{"accounts": {
-	  "personal": {"address": "me@mail.example.org", "incoming": {"kind": "imap", "host": "imap.example.org", "security": "tls", "sign-in": "password"},
-	    "outgoing": {"host": "smtp.example.org", "security": "tls", "sign-in": "password"}},
-	  "google": {"address": "me@gmail.com", "incoming": {"kind": "imap", "host": "imap.gmail.com", "security": "tls", "sign-in": "oauth"},
-	    "outgoing": {"host": "smtp.gmail.com", "security": "tls", "sign-in": "oauth"}},
-	  "lan": {"address": "me@lan.example.org", "incoming": {"kind": "pop3", "host": "pop.example.org", "security": "tls", "sign-in": "kerberos"},
-	    "outgoing": {"host": "smtp.example.org", "security": "tls", "sign-in": "none"}}}}`)
-	// The username and password fields are encrypted and never read; a fixture holding junk there proves it.
-	f.write(profileDir+"/logins.json", `{"logins": [
-	  {"hostname": "imap://imap.example.org", "httpRealm": "imap://imap.example.org", "encryptedUsername": "MEIE...", "encryptedPassword": "MDoE..."},
-	  {"hostname": "smtp://smtp.example.org", "encryptedUsername": "x", "encryptedPassword": "y"}]}`)
-	c := f.countAccounts(filepath.Join(f.Root, profileDir), "~/.thunderbird/60016jsp.default-default")
-	if c.Declared != 3 || c.WithoutSignIn != 1 || c.Others != 2 || c.InList != 0 {
-		t.Fatalf("three declared, the OAuth one not signed in, the person's and Owl's other (local folders not counted): %+v", c)
-	}
-	raw, _ := json.Marshal(c)
-	if strings.Contains(string(raw), "example") || strings.Contains(string(raw), "gmail") {
-		t.Fatalf("a count names nothing: %s", raw)
-	}
-}
-
-// ADR 0329 §1, §10, §12, §13: betterbird_accounts lists the accounts with their values, Owl's by name and address
-// and marked; its propose carries the mesh-wide layer as it stands with accounts in it, and answers the value.
-func TestBetterbirdAccountsListsTheValuesAndProposesThemInTheLayerAsItStands(t *testing.T) {
-	f := newFake(t)
-	f.profileWithAccounts()
-	f.write(profileDir+"/logins.json", `{"logins":[{"hostname":"imap://imap.example.org","encryptedUsername":"MDoEEPgAAAAA","encryptedPassword":"hunter2secret"}]}`)
-	links(t, nil)
-	a, err := f.ProfileAccounts(false)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if a.Declarable["imap"] != 1 || a.KeptByOwl != 1 || a.NotDeclarable["local folders"] != 1 || a.Proposed != "" {
-		t.Fatalf("%+v", a)
-	}
-	raw, _ := json.Marshal(credentialChecked(a))
-	for _, shown := range []string{"other@mail.example.org", "imap.example.org", "smtp.example.org", `"port":993`, `"work@corp.example.com"`} {
-		if !strings.Contains(string(raw), shown) {
-			t.Errorf("the answer shows the operator's own %s (ADR 0329 §1): %s", shown, raw)
-		}
-	}
-	for _, never := range []string{"hunter2", "MDoEEP"} {
-		if strings.Contains(string(raw), never) {
-			t.Errorf("the answer carries the login store's %q", never)
-		}
-	}
-	for _, l := range a.Accounts {
-		if l.Key == "account3" && (!l.Owl || l.Value != nil || l.Address != "work@corp.example.com") {
-			t.Errorf("Owl's account is listed by name and address, marked, never as a value to declare: %+v", l)
-		}
-	}
-
-	var asked []map[string]any
-	asker = func(key string, body any) (json.RawMessage, error) {
-		if key != "seat:mesh-controller.settings" {
-			t.Fatalf("asked %s", key)
-		}
-		args := body.(map[string]any)
-		asked = append(asked, args)
-		if args["propose"] == nil {
-			return json.RawMessage(`{"ok": true, "output": "{\n  \"tags\": {\"$label1\": {\"name\": \"Important\"}}\n}\n  approved by the operator\nbetterbird on the whole mesh, every value"}`), nil
-		}
-		return json.RawMessage(`{"ok": true, "output": "proposed p-17 for betterbird on the whole mesh: accounts (other@mail.example.org); fingerprint ab12"}`), nil
-	}
-	t.Cleanup(func() { asker = nil })
-	a, err = f.ProfileAccounts(true)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(asked) != 2 || asked[1]["module"] != "betterbird" || asked[1]["propose"] != "true" || asked[1]["node"] != nil ||
-		asked[1]["replace"] != nil {
-		t.Fatalf("the layer read, then proposed for the whole mesh, never set, never removing: %v", asked)
-	}
-	var layer map[string]json.RawMessage
-	if err := json.Unmarshal([]byte(asked[1]["values"].(string)), &layer); err != nil || string(layer["tags"]) == "" {
-		t.Fatalf("the proposal carries the layer as it stands: %v %s", err, asked[1]["values"])
-	}
-	value, err := parseAccounts([]byte(asked[1]["values"].(string)))
-	if err != nil {
-		t.Fatalf("the proposed value is one the module takes: %v", err)
-	}
-	other, ok := value["mail"]
-	if len(value) != 1 || !ok || other.Address != "other@mail.example.org" || other.Incoming.SignIn != "oauth" ||
-		other.Incoming.Port != 993 || other.Outgoing.Security != "tls" || other.Outgoing.Port != 465 {
-		t.Fatalf("the value holds the person's account and not Owl's: %+v", value)
-	}
-	if a.Derived["mail"].Address != "other@mail.example.org" {
-		t.Fatalf("the answer shows the value it proposed (ADR 0329 §10): %+v", a.Derived)
-	}
-	if strings.Contains(a.Proposed, "other@") || !strings.Contains(a.Proposed, "p-17") {
-		t.Fatalf("the controller's words come back with every address masked: %s", a.Proposed)
-	}
-}
-
-func TestAnAdoptedAccountNeverWritesIntoAnOutgoingServerAnotherIdentityUses(t *testing.T) {
-	f := newFake(t)
-	f.profileWithAccounts()
-	f.noPackage()
-	links(t, nil)
-	f.declare("// none")
-	os.RemoveAll(filepath.Join(f.Root, "proc", "4000"))
-	// A second account of the person's, not declared, sends through smtp1 too.
-	prefs := strings.Replace(f.read(profileDir+"/prefs.js"), `"account1,account3,account2"`, `"account1,account3,account2,account5"`, 1) +
-		`user_pref("mail.account.account5.server", "server5");` + "\n" +
-		`user_pref("mail.account.account5.identities", "id5");` + "\n" +
-		`user_pref("mail.identity.id5.useremail", "fifth@mail.example.org");` + "\n" +
-		`user_pref("mail.identity.id5.smtpServer", "smtp1");` + "\n" +
-		`user_pref("mail.server.server5.type", "imap");` + "\n"
-	f.write(profileDir+"/prefs.js", prefs)
-	f.declareAccounts(adoptable)
-	err := f.Prepare()
-	if err == nil || !strings.Contains(err.Error(), "also used by identity id5") || strings.Contains(err.Error(), "example.org") {
-		t.Fatalf("refused with the remedy, by keys: %v", err)
-	}
-	if user, _ := os.ReadFile(filepath.Join(f.Root, profileDir, "user.js")); strings.Contains(string(user), "smtpserver.smtp1") {
-		t.Fatal("the shared outgoing server was written")
-	}
-
-	// Recorded adoption, then the person moves the identity to a server of its own: the module follows it.
-	f.write(profileDir+"/prefs.js", strings.Replace(prefs, `"mail.identity.id5.smtpServer", "smtp1"`, `"mail.identity.id5.smtpServer", "smtp5"`, 1))
-	if err := f.Prepare(); err != nil {
-		t.Fatal(err)
-	}
-	moved := strings.Replace(f.read(profileDir+"/prefs.js"), `"mail.identity.id1.smtpServer", "smtp1"`, `"mail.identity.id1.smtpServer", "smtp9"`, 1) +
-		`user_pref("mail.smtpserver.smtp9.hostname", "smtp.example.org");` + "\n"
-	f.write(profileDir+"/prefs.js", moved)
-	u, err := f.userJS(true)
-	if err != nil || u.Each[0].How != adopted || u.Each[0].Keys.SMTP != "smtp9" {
-		t.Fatalf("the identity's current outgoing server is followed: %+v %v", u.Each, err)
-	}
-	user := f.read(profileDir + "/user.js")
-	if strings.Contains(user, "smtpserver.smtp1.") || !strings.Contains(user, "smtpserver.smtp9.hostname") {
-		t.Fatalf("never the old one:\n%s", user)
-	}
-	// And the move back onto a shared server is refused again.
-	f.write(profileDir+"/prefs.js", strings.Replace(moved, `"mail.identity.id5.smtpServer", "smtp5"`, `"mail.identity.id5.smtpServer", "smtp9"`, 1))
-	if err := f.Prepare(); err == nil || !strings.Contains(err.Error(), "also used by identity id5") {
-		t.Fatalf("%v", err)
-	}
-}
-
-func TestTheUserJSAnswerWithholdsTheAccountsValues(t *testing.T) {
-	f := newFake(t)
-	f.profileWithAccounts()
-	f.noPackage()
-	links(t, nil)
-	f.declare(`user_pref("mail.compose.default_to", "x");`)
-	f.declareAccounts(personal)
-	u, err := f.userJS(false)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, never := range []string{"example.org", `"me"`, `"Me"`} {
-		if strings.Contains(u.Content, never) {
-			t.Errorf("the answer carries %s:\n%s", never, u.Content)
-		}
-	}
-	if !strings.Contains(u.Content, `user_pref("mail.server.server_mesh_personal.hostname", "<withheld>");`) {
-		t.Fatalf("an account's preference is named and its value withheld:\n%s", u.Content)
-	}
-	// What is placed in the profile keeps the values: only the answer withholds them.
-	if f.read(testHome+"/"+accountsFile) == "" {
-		t.Fatal("no declaration")
-	}
-}
-
-func TestACredentialRefusalNamesNoAccount(t *testing.T) {
-	_, err := parseAccounts([]byte(`{"accounts": {"personal": {"incoming": {"password": "hunter2"}}}}`))
-	if err == nil || strings.Contains(err.Error(), "personal") || !strings.Contains(err.Error(), "accounts.<an account>.incoming.password") {
-		t.Fatalf("%v", err)
-	}
-}
-
-func TestAnAccountsOwnAliasesAndNonMailIdentitiesDoNotShareItsOutgoingServer(t *testing.T) {
-	f := newFake(t)
-	f.profileWithAccounts()
-	f.noPackage()
-	links(t, nil)
-	f.declare("// none")
-	os.RemoveAll(filepath.Join(f.Root, "proc", "4000"))
-	// account1 has an alias identity on smtp1; smtp1 is the default server; Owl's account and local folders
-	// have identities that name no outgoing server.
-	prefs := strings.Replace(f.read(profileDir+"/prefs.js"), `"mail.account.account1.identities", "id1"`, `"mail.account.account1.identities", "id1,id1b"`, 1)
-	prefs = strings.Replace(prefs, `"mail.account.account2.server", "server2");`, `"mail.account.account2.server", "server2");`+"\n"+
-		`user_pref("mail.account.account2.identities", "id2");`, 1) +
-		`user_pref("mail.identity.id1b.useremail", "alias@mail.example.org");` + "\n" +
-		`user_pref("mail.identity.id1b.smtpServer", "smtp1");` + "\n" +
-		`user_pref("mail.identity.id2.useremail", "local@mail.example.org");` + "\n" +
-		`user_pref("mail.smtp.defaultserver", "smtp1");` + "\n"
-	f.write(profileDir+"/prefs.js", prefs)
-	f.declareAccounts(adoptable)
-	if err := f.Prepare(); err != nil {
-		t.Fatalf("an account's own alias, and identities that do not send by SMTP, are no sharing: %v", err)
-	}
-	// An identity of another mail account naming no server does use the default one.
-	f.write(profileDir+"/prefs.js", strings.Replace(prefs, `"account1,account3,account2"`, `"account1,account3,account2,account6"`, 1)+
-		`user_pref("mail.account.account6.server", "server6");`+"\n"+
-		`user_pref("mail.account.account6.identities", "id6");`+"\n"+
-		`user_pref("mail.identity.id6.useremail", "six@mail.example.org");`+"\n"+
-		`user_pref("mail.server.server6.type", "pop3");`+"\n")
-	os.Remove(filepath.Join(f.Root, testHome, recordFile))
-	if err := f.Prepare(); err == nil || !strings.Contains(err.Error(), "also used by identity id6") {
-		t.Fatalf("%v", err)
-	}
-}
-
-// Review 121: the account lists wait for Betterbird to close by its profile's lock too, not only by its process.
-func TestTheAccountListsWaitWhileTheProfileIsLocked(t *testing.T) {
-	f := newFake(t)
-	f.profileWithAccounts()
-	f.noPackage()
-	links(t, nil)
-	f.declare("// none")
-	f.declareAccounts(personal)
-	stopBetterbird(t, f)
-	f.write(profileDir+"/lock", "")
-	before := f.read(profileDir + "/prefs.js")
-	u, err := f.userJS(true)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !strings.HasPrefix(u.Lists, "not written") || !strings.Contains(u.Lists, "locked") || f.read(profileDir+"/prefs.js") != before {
-		t.Fatalf("with the profile locked and no Betterbird running, prefs.js is unchanged: %q", u.Lists)
-	}
-	os.Remove(filepath.Join(f.Root, profileDir, "lock"))
-	if u, err = f.userJS(true); err != nil || !strings.HasPrefix(u.Lists, "written") {
-		t.Fatalf("once unlocked the list is written: %q %v", u.Lists, err)
-	}
-}

modules/betterbird/cmd/betterbird-tools/adoption.go

@@ -1,331 +0,0 @@
-package main
-
-// Which account of the profile a declared account is (novox/hq ADR 0317): adopted, created or refused.
-//
-// At every apply, per declared account in its place in the setting (§1):
-//
-//  1. an account the module recorded on this node for this profile, adopted or created, is kept by its
-//     recorded keys without matching again, while its account key is still in the profile's account list;
-//  2. otherwise an account under the module's own mesh_<name> keys is the module's creation;
-//  3. otherwise a node's layer may name the key to adopt (§8): adopted only when it is in the account list,
-//     its default identity has the declared address and it is not Owl's;
-//  4. otherwise the profile's accounts whose default identity has the declared address: one is adopted, none
-//     means the account is created under mesh_<name> keys (ADR 0316 §11).
-//
-// Refused, with the remedy, for that account alone (§7): two or more accounts with the address, the one that
-// has it being Owl's, a named key that does not qualify, an account of another kind than the declaration says
-// (the module never converts one: the review of ADR 0317), and an identity that names no outgoing server. The
-// other declared accounts go ahead.
-//
-// Adopting takes the account's keys as the module's (§2): its account key, its default identity, its incoming
-// server and the outgoing server that identity names. The account lists are left as they are, because the keys
-// are in them already; the declared fields are written under those keys (§4, §5). What was adopted or created
-// is recorded in the module's directory in the home, by the tools and never by a setting (§3); leaving the
-// setting releases an adopted account (its lines and its record go, the account stays the person's, §6).
-
-import (
-	"encoding/json"
-	"fmt"
-	"os"
-	"path/filepath"
-	"sort"
-	"strings"
-)
-
-// recordFile is where the module records, per profile, what it adopted or created (ADR 0317 §3).
-const recordFile = ".config/betterbird/accounts-record.json"
-
-// How a declared account resolved.
-const (
-	adopted = "adopted"
-	created = "created"
-	refused = "refused"
-)
-
-// keySet are an account's four keys.
-type keySet struct {
-	Account  string `json:"account"`
-	Identity string `json:"identity"`
-	Server   string `json:"server"`
-	SMTP     string `json:"smtp"`
-}
-
-// resolvedAccount is one declared account as it resolved, said by its place and keys, never its name, address
-// or host (ADR 0316 §16, ADR 0317 §3).
-type resolvedAccount struct {
-	Place int    `json:"place"`
-	How   string `json:"how"`
-	Keys  keySet `json:"keys,omitempty"`
-	// Why is a refusal's reason and its remedy.
-	Why string `json:"why,omitempty"`
-	// Changed are the preferences an apply changed for it, by name only (ADR 0317 §4).
-	Changed []string `json:"changed,omitempty"`
-	name    string
-}
-
-// record is what the module adopted or created, per profile (its directory as the tools say it), per
-// declared account's name.
-type record map[string]map[string]recorded
-
-type recorded struct {
-	How  string `json:"how"`
-	Keys keySet `json:"keys"`
-}
-
-func (m *Machine) readRecord(profileDir string) map[string]recorded {
-	raw, err := readBounded(m.home(recordFile))
-	if err != nil {
-		return map[string]recorded{}
-	}
-	var r record
-	if json.Unmarshal(raw, &r) != nil || r[profileDir] == nil {
-		return map[string]recorded{}
-	}
-	return r[profileDir]
-}
-
-// writeRecord keeps what this apply resolved for the profile: a refused account is not recorded, and an
-// account no longer declared is dropped (§6).
-func (m *Machine) writeRecord(profileDir string, resolved []resolvedAccount) error {
-	r := record{}
-	if raw, err := readBounded(m.home(recordFile)); err == nil {
-		_ = json.Unmarshal(raw, &r)
-	}
-	mine := map[string]recorded{}
-	for _, a := range resolved {
-		if a.How != refused {
-			mine[a.name] = recorded{How: a.How, Keys: a.Keys}
-		}
-	}
-	if len(mine) == 0 {
-		delete(r, profileDir)
-	} else {
-		r[profileDir] = mine
-	}
-	body, err := json.MarshalIndent(r, "", "  ")
-	if err != nil {
-		return err
-	}
-	path := m.home(recordFile)
-	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
-		return err
-	}
-	tmp := path + ".mesh-new"
-	if err := os.WriteFile(tmp, append(body, '\n'), 0o600); err != nil {
-		return err
-	}
-	if err := os.Rename(tmp, path); err != nil {
-		os.Remove(tmp)
-		return err
-	}
-	return nil
-}
-
-// resolveAccounts resolves every declared account, in its place in the setting (the file's order, by name).
-func resolveAccounts(accounts map[string]Account, prefs map[string]string, rec map[string]recorded) []resolvedAccount {
-	have := profileAccounts(prefs)
-	inList := map[string]profileAccount{}
-	for _, a := range have {
-		inList[a.Key] = a
-	}
-	names := sortedNames(accounts)
-	taken := map[string]bool{}
-	var out []resolvedAccount
-	for i, name := range names {
-		r := resolveOne(i+1, len(names), name, accounts[name], prefs, have, inList, rec, taken)
-		r.name = name
-		if r.How != refused {
-			taken[r.Keys.Account] = true
-		}
-		out = append(out, r)
-	}
-	return refuseSharedOutgoing(out, prefs, have)
-}
-
-// refuseSharedOutgoing refuses an adopted account whose outgoing server another identity uses that is neither
-// adopted nor the module's (review 34 of mesh-catalog #232): Betterbird lets identities share an outgoing
-// server, and the declared values written into it would change that other account's sending at every start.
-// ADR 0317 §2 adopts the outgoing server the identity names and leaves the lists as they are, so the module
-// does not give the identity a server of its own; it refuses, with the remedy.
-func refuseSharedOutgoing(resolved []resolvedAccount, prefs map[string]string, have []profileAccount) []resolvedAccount {
-	// Every identity of an adopted or created account is its own, its aliases too (review 36).
-	accountOf := map[string]profileAccount{}
-	kindOf := map[string]string{}
-	for _, a := range have {
-		accountOf[a.Key] = a
-		for _, id := range a.Identities {
-			kindOf[id] = a.Kind
-		}
-	}
-	ours := map[string]bool{}
-	for _, r := range resolved {
-		if r.How == refused {
-			continue
-		}
-		ours[r.Keys.Identity] = true
-		for _, id := range accountOf[r.Keys.Account].Identities {
-			ours[id] = true
-		}
-	}
-	defaultServer := unquote(prefs["mail.smtp.defaultserver"])
-	users := map[string][]string{}
-	seen := map[string]bool{}
-	use := func(id string) {
-		// An identity the module created for a declared account sends as that account does (ADR 0329 §7).
-		if seen[id] || ours[id] || ownIdentity.MatchString(id) {
-			return
-		}
-		seen[id] = true
-		server := unquote(prefs["mail.identity."+id+".smtpServer"])
-		// Only a mail account's identity sends through the default server when it names none: Owl's, local
-		// folders and feeds do not send by SMTP (review 36).
-		if server == "" && (kindOf[id] == "imap" || kindOf[id] == "pop3") {
-			server = defaultServer
-		}
-		if server != "" {
-			users[server] = append(users[server], id)
-		}
-	}
-	for _, a := range have {
-		for _, id := range a.Identities {
-			use(id)
-		}
-	}
-	for k := range prefs {
-		if strings.HasPrefix(k, "mail.identity.") && strings.HasSuffix(k, ".smtpServer") {
-			use(strings.TrimSuffix(strings.TrimPrefix(k, "mail.identity."), ".smtpServer"))
-		}
-	}
-	for i, r := range resolved {
-		if r.How != adopted {
-			continue
-		}
-		if others := users[r.Keys.SMTP]; len(others) > 0 {
-			sort.Strings(others)
-			resolved[i] = resolvedAccount{Place: r.Place, How: refused, name: r.name, Why: fmt.Sprintf(
-				"declared account %d of %d: the outgoing server %s of the profile's account %s is also used by "+
-					"identity %s, whose sending the declared values would change: give the account an outgoing "+
-					"server of its own in Betterbird's account settings, then start Betterbird again",
-				r.Place, len(resolved), r.Keys.SMTP, r.Keys.Account, strings.Join(others, ", "))}
-		}
-	}
-	return resolved
-}
-
-func resolveOne(place, of int, name string, a Account, prefs map[string]string, have []profileAccount,
-	inList map[string]profileAccount, rec map[string]recorded, taken map[string]bool) resolvedAccount {
-	r := resolvedAccount{Place: place}
-	refuse := func(format string, args ...any) resolvedAccount {
-		r.How, r.Keys = refused, keySet{}
-		r.Why = fmt.Sprintf("declared account %d of %d: ", place, of) + fmt.Sprintf(format, args...)
-		return r
-	}
-	// 1. Recorded, while its account is still in the list.
-	if was, ok := rec[name]; ok {
-		if _, there := inList[was.Keys.Account]; there || was.How == created {
-			r.How, r.Keys = was.How, was.Keys
-			if was.How == adopted {
-				// The identity's outgoing server as it is now: a person may have moved it since.
-				smtpKey := unquote(prefs["mail.identity."+was.Keys.Identity+".smtpServer"])
-				if smtpKey == "" {
-					return refuse("the profile's account %s has an identity that names no outgoing server: choose one "+
-						"for it in Betterbird's account settings, then start Betterbird again", was.Keys.Account)
-				}
-				r.Keys.SMTP = smtpKey
-			}
-			return r
-		}
-	}
-	// 2. Under the module's own keys: its creation.
-	account, identity, server, smtp := keysOf(name)
-	own := keySet{account, identity, server, smtp}
-	if _, there := inList[account]; there {
-		r.How, r.Keys = created, own
-		return r
-	}
-	adopt := func(pa profileAccount) resolvedAccount {
-		if pa.Kind != a.Incoming.Kind {
-			return refuse("the profile's account %s is of kind %s and the declaration says %s: the module never "+
-				"converts an account. Declare the kind the account has, or remove the account in Betterbird",
-				pa.Key, pa.Kind, a.Incoming.Kind)
-		}
-		smtpKey := unquote(prefs["mail.identity."+pa.Identities[0]+".smtpServer"])
-		if smtpKey == "" {
-			return refuse("the profile's account %s has an identity that names no outgoing server: choose one for it "+
-				"in Betterbird's account settings, then start Betterbird again", pa.Key)
-		}
-		r.How, r.Keys = adopted, keySet{pa.Key, pa.Identities[0], pa.Server, smtpKey}
-		return r
-	}
-	matchesDefault := func(pa profileAccount) bool {
-		return len(pa.Addresses) > 0 && strings.EqualFold(pa.Addresses[0], a.Address)
-	}
-	// 3. The key a node's layer names.
-	if a.Key != "" {
-		pa, there := inList[a.Key]
-		switch {
-		case !there:
-			return refuse("the key %s this node's layer names is not in the profile's account list", a.Key)
-		case pa.Owl:
-			return refuse("the key %s this node's layer names is Owl's account, which is never declared "+
-				"(novox/hq ADR 0316 §13)", a.Key)
-		case !matchesDefault(pa):
-			return refuse("the key %s this node's layer names is an account whose default identity has another "+
-				"address", a.Key)
-		case taken[pa.Key]:
-			return refuse("the key %s is already another declared account's", a.Key)
-		}
-		return adopt(pa)
-	}
-	// 4. By the default identity's address.
-	var matches []profileAccount
-	for _, pa := range have {
-		if !pa.Ours && !taken[pa.Key] && matchesDefault(pa) {
-			matches = append(matches, pa)
-		}
-	}
-	switch {
-	case len(matches) == 0:
-		r.How, r.Keys = created, own
-		return r
-	case len(matches) > 1:
-		var keys []string
-		for _, pa := range matches {
-			keys = append(keys, pa.Key)
-		}
-		return refuse("%d accounts in the profile have its address (%s): remove the duplicate in Betterbird, or "+
-			"give the one to adopt as key in this node's layer of the setting accounts (novox/hq ADR 0317 §7, §8)",
-			len(matches), strings.Join(keys, ", "))
-	case matches[0].Owl:
-		return refuse("the profile's account with its address, %s, is Owl's, which is never declared (novox/hq "+
-			"ADR 0316 §13): take it out of the setting accounts", matches[0].Key)
-	}
-	return adopt(matches[0])
-}
-
-// changedPrefs are the preferences of a resolved account whose declared value differs from the profile's
-// saved one (prefs.js), by name only (ADR 0317 §4). A preference prefs.js does not hold is changed unless the
-// declared value is what Betterbird reads in its place.
-func changedPrefs(r resolvedAccount, a Account, saved map[string]string) []string {
-	defaults := map[string]string{}
-	if r.How == adopted {
-		// What Betterbird reads when prefs.js holds no value: the same defaults betterbird_accounts reads with.
-		pa := profileAccount{Key: r.Keys.Account, Server: r.Keys.Server, Kind: a.Incoming.Kind,
-			Identities: []string{r.Keys.Identity}}
-		view := readAccount(saved, pa)
-		for _, p := range declaredPrefs(r.Keys, view, true) {
-			defaults[p[0]] = p[1]
-		}
-	}
-	var out []string
-	for _, p := range declaredPrefs(r.Keys, a, r.How == adopted) {
-		have, ok := saved[p[0]]
-		if !ok {
-			have, ok = defaults[p[0]]
-		}
-		if !ok || have != p[1] {
-			out = append(out, p[0])
-		}
-	}
-	return out
-}

modules/betterbird/cmd/betterbird-tools/args.go

@@ -1,97 +0,0 @@
-// Reading a tool's arguments: JSON numbers arrive as float64, and a missing argument is its default.
-// The same in every desktop module that carries it.
-package main
-
-import (
-	"fmt"
-	"math"
-	"strings"
-	"time"
-)
-
-// text is a string argument, trimmed; required says an empty one is refused.
-func text(args map[string]any, key string, required bool) (string, error) {
-	v, present := args[key]
-	if !present || v == nil {
-		if required {
-			return "", fmt.Errorf("%s is required", key)
-		}
-		return "", nil
-	}
-	s, ok := v.(string)
-	if !ok {
-		return "", fmt.Errorf("%s is a string, not %T", key, v)
-	}
-	s = strings.TrimSpace(s)
-	if s == "" && required {
-		return "", fmt.Errorf("%s is required", key)
-	}
-	return s, nil
-}
-
-// whole is a whole-number argument within [least, most], or def when absent.
-func whole(args map[string]any, key string, def, least, most int) (int, error) {
-	v, present := args[key]
-	if !present || v == nil {
-		return def, nil
-	}
-	f, ok := v.(float64)
-	if !ok {
-		if i, isInt := v.(int); isInt {
-			f = float64(i)
-		} else {
-			return 0, fmt.Errorf("%s is a number, not %T", key, v)
-		}
-	}
-	if f != math.Trunc(f) {
-		return 0, fmt.Errorf("%s is a whole number, not %v", key, f)
-	}
-	n := int(f)
-	if n < least || n > most {
-		return 0, fmt.Errorf("%s is %d; it is between %d and %d", key, n, least, most)
-	}
-	return n, nil
-}
-
-// flag is a boolean argument, or def when absent.
-func flag(args map[string]any, key string, def bool) (bool, error) {
-	v, present := args[key]
-	if !present || v == nil {
-		return def, nil
-	}
-	b, ok := v.(bool)
-	if !ok {
-		return false, fmt.Errorf("%s is true or false, not %T", key, v)
-	}
-	return b, nil
-}
-
-// texts is a list-of-strings argument.
-func texts(args map[string]any, key string) ([]string, error) {
-	v, present := args[key]
-	if !present || v == nil {
-		return nil, nil
-	}
-	list, ok := v.([]any)
-	if !ok {
-		if ss, isStrings := v.([]string); isStrings {
-			return ss, nil
-		}
-		return nil, fmt.Errorf("%s is a list of strings, not %T", key, v)
-	}
-	out := make([]string, 0, len(list))
-	for i, item := range list {
-		s, ok := item.(string)
-		if !ok {
-			return nil, fmt.Errorf("%s[%d] is a string, not %T", key, i, item)
-		}
-		out = append(out, s)
-	}
-	return out, nil
-}
-
-// seconds is a timeout argument in seconds, defaulted and bounded below the runtime's call limit.
-func seconds(args map[string]any, key string, def, most int) (time.Duration, error) {
-	n, err := whole(args, key, def, 1, most)
-	return time.Duration(n) * time.Second, err
-}

modules/betterbird/cmd/betterbird-tools/betterbird_test.go

@@ -1,276 +0,0 @@
-package main
-
-import (
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-	"time"
-)
-
-const profileDir = testHome + "/.thunderbird/60016jsp.default-default"
-
-// links stands in for the kernel's fd links: path → target.
-func links(t *testing.T, m map[string]string) {
-	t.Helper()
-	old := readLink
-	readLink = func(p string) (string, error) {
-		for k, v := range m {
-			if strings.HasSuffix(p, k) {
-				return v, nil
-			}
-		}
-		return "", os.ErrNotExist
-	}
-	t.Cleanup(func() { readLink = old })
-}
-
-// betterbird is a running Betterbird with one child, its profile and its prefs.
-func (f *fake) betterbird() {
-	f.proc(4000, 1000, "betterbird-bin", []string{"betterbird"}, "session-4.scope", "DISPLAY=:1")
-	f.proc(4001, 1000, "betterbird-bin", []string{"/opt/betterbird/betterbird-bin", "-contentproc", "-isForBrowser"}, "session-4.scope")
-	f.write("/proc/4000/fd/40", "")
-	f.write("/proc/4000/fd/41", "")
-	f.write("/proc/4000/fd/1", "")
-	f.write(testHome+"/.thunderbird/profiles.ini", "[Profile0]\nName=default-default\nIsRelative=1\nPath=60016jsp.default-default\n\n"+
-		"[Profile1]\nName=default\nIsRelative=1\nPath=au2i98w4.default\nDefault=1\n\n[InstallF72D9E66FA3C07ED]\nDefault=60016jsp.default-default\nLocked=1\n")
-	f.write(profileDir+"/prefs.js", "// Mozilla User Preferences\n"+
-		`user_pref("browser.display.use_system_colors", true);`+"\n"+
-		`user_pref("extensions.activeThemeID", "thunderbird-compact-dark@mozilla.org");`+"\n"+
-		`user_pref("calendar.alarms.showmissed", true);`+"\n"+
-		`user_pref("mail.identity.id1.useremail", "someone@example.org");`+"\n"+
-		`user_pref("extensions.owl.token", "abc");`+"\n"+
-		`user_pref("signon.rememberSignons", true);`+"\n")
-	f.write(profileDir+"/extensions.json", `{"addons":[{"id":"owl@beonex.com","active":true,"location":"app-profile"},{"id":"x@mozilla.org","active":true,"location":"app-builtin"}]}`)
-}
-
-// declare writes the setting prefs as the node-engine does (prefs.json, novox/hq issue 586), from user_pref
-// statements: each one entry of the map.
-func (f *fake) declare(prefs string) {
-	f.t.Helper()
-	values := map[string]any{}
-	for name, lit := range statementsOf([]byte(prefs)) {
-		v, ok := prefValue(lit)
-		if !ok {
-			f.t.Fatalf("%s: %s is not a value the setting holds", name, lit)
-		}
-		values[name] = v
-	}
-	body, _ := json.Marshal(map[string]any{"prefs": values})
-	f.write(testHome+"/"+prefsFile, string(body))
-}
-
-func TestTheProfileIsTheOneTheRunningBetterbirdHoldsElseTheInstallationsDefault(t *testing.T) {
-	f := newFake(t)
-	f.betterbird()
-	links(t, map[string]string{"/proc/4000/fd/40": profileDir + "/prefs.js", "/proc/4000/fd/41": profileDir + "/places.sqlite"})
-	p, err := f.profile()
-	if err != nil || p.Dir != "~/.thunderbird/60016jsp.default-default" || !strings.Contains(p.FoundBy, "pid 4000, 2 files") {
-		t.Fatalf("%+v %v", p, err)
-	}
-	links(t, map[string]string{})
-	p, err = f.profile()
-	if err != nil || p.Dir != "~/.thunderbird/60016jsp.default-default" || !strings.Contains(p.FoundBy, "InstallF72D9E66FA3C07ED") {
-		t.Fatalf("the installation's default, not Profile1's Default=1: %+v %v", p, err)
-	}
-}
-
-func TestPrefsAnswerValuesButNeverACredentialOrAnAccount(t *testing.T) {
-	f := newFake(t)
-	f.betterbird()
-	links(t, nil)
-	f.write(profileDir+"/user.js", mark+")\n"+`user_pref("browser.display.use_system_colors", false);`+"\n")
-	got, err := f.Prefs([]string{"browser.display.", "mail.identity.*", "extensions.owl.token", "signon.rememberSignons", "gfx.webrender.software"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	ps := got["prefs"].([]Pref)
-	by := map[string]Pref{}
-	for _, p := range ps {
-		by[p.Name] = p
-	}
-	if p := by["browser.display.use_system_colors"]; p.Value != "false" || !strings.HasPrefix(p.From, "user.js") {
-		t.Fatalf("user.js wins: %+v", p)
-	}
-	for _, n := range []string{"mail.identity.id1.useremail", "extensions.owl.token", "signon.rememberSignons"} {
-		if p := by[n]; p.Value != "" || p.Withheld == "" {
-			t.Errorf("%s: %+v", n, p)
-		}
-	}
-	if p := by["gfx.webrender.software"]; p.Value != "" || !strings.Contains(p.From, "default") {
-		t.Fatalf("%+v", p)
-	}
-	if _, err := f.Prefs(nil); err == nil {
-		t.Fatal("names are required")
-	}
-}
-
-func TestTheModulesUserJSIsPlacedOnlyWhereNoOperatorsFileIs(t *testing.T) {
-	f := newFake(t)
-	f.betterbird()
-	links(t, nil)
-	if _, err := f.userJS(true); err == nil || !strings.Contains(err.Error(), "not pushed") {
-		t.Fatalf("nothing declared: %v", err)
-	}
-	f.declare(`user_pref("calendar.alarms.showmissed", true); user_pref("ui.key.x", "a;b");`)
-	u, err := f.userJS(true)
-	if err != nil || !u.Applied || u.Statements != 2 {
-		t.Fatalf("%+v %v", u, err)
-	}
-	placed, _ := os.ReadFile(filepath.Join(f.Root, profileDir, "user.js"))
-	declared, _, _ := f.declaredText()
-	if string(placed) != declared || !strings.Contains(declared, `user_pref("ui.key.x", "a;b");`) {
-		t.Fatalf("placed whole, as declared:\n%s", placed)
-	}
-	if !strings.HasPrefix(u.Effective, "yes") {
-		t.Fatalf("the fake Betterbird started after the file's time: %q", u.Effective)
-	}
-	later := time.Unix(1_900_000_000, 0)
-	os.Chtimes(filepath.Join(f.Root, profileDir, "user.js"), later, later)
-	if u, _ := f.userJS(false); !strings.HasPrefix(u.Effective, "not yet") {
-		t.Fatalf("placed after Betterbird started: %q", u.Effective)
-	}
-	f.write(profileDir+"/user.js", `user_pref("a.b", 1);`+"\n")
-	if _, err := f.userJS(true); err == nil || !strings.Contains(err.Error(), "not the module's") {
-		t.Fatalf("an operator's user.js is never overwritten: %v", err)
-	}
-	if b, _ := os.ReadFile(filepath.Join(f.Root, profileDir, "user.js")); string(b) != `user_pref("a.b", 1);`+"\n" {
-		t.Fatal("and it is left as it was")
-	}
-}
-
-func TestTheUserJSHoldsOnlyPreferencesAndNoCredential(t *testing.T) {
-	for text, ok := range map[string]bool{
-		mark + ")\n// none\n": true,
-		mark + ")\n" + `user_pref("a.b", true); user_pref("c", -3); user_pref("d", "x\"y;z");`: true,
-		mark + ")\n" + `pref("a.b", true);`:                                                    false,
-		mark + ")\n" + `user_pref("a.b", true); Services.foo();`:                               false,
-		mark + ")\n" + `user_pref("mail.smtpserver.s1.password", "x");`:                        false,
-		`user_pref("a.b", true);`:                                                              false,
-	} {
-		if err := validUserJS(text); (err == nil) != ok {
-			t.Errorf("%q: %v", text, err)
-		}
-	}
-}
-
-func TestStatusSaysWhatRunsTheProfileTheAddOnsAndTheDisplayPrefs(t *testing.T) {
-	f := newFake(t)
-	f.betterbird()
-	links(t, map[string]string{"/proc/4000/fd/1": "pipe:[36802]"})
-	f.write("/opt/betterbird/application.ini", "[App]\nVendor=Betterbird Project\nName=Betterbird\nVersion=153.1.0\nBuildID=20260820183427\n")
-	f.answer = func(name string, args []string) Output {
-		if name == "pacman" && args[0] == "-Q" {
-			return Output{Stdout: "betterbird-bin 153.1.0esr-1\n"}
-		}
-		if name == "pacman" && args[0] == "-Qmq" {
-			return Output{Stdout: "betterbird-bin\n"}
-		}
-		return Output{}
-	}
-	s, err := f.Status()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(s.Running) != 1 || s.Running[0].PID != 4000 || s.Children != 1 || s.Installed != "153.1.0esr-1" || !s.Foreign ||
-		s.Installation.Version != "153.1.0" || s.Profile == nil || len(s.AddOns) != 1 || s.AddOns[0].ID != "owl@beonex.com" {
-		t.Fatalf("%+v", s)
-	}
-	if !s.Output[0].Dead {
-		t.Fatalf("the session's dead pipe: %+v", s.Output)
-	}
-	found := false
-	for _, p := range s.Display {
-		if p.Name == "extensions.activeThemeID" && p.Value == `"thunderbird-compact-dark@mozilla.org"` {
-			found = true
-		}
-	}
-	if !found {
-		t.Fatalf("%+v", s.Display)
-	}
-}
-
-func TestCheckNamesWhatIsMissingAndWhatToDo(t *testing.T) {
-	f := newFake(t)
-	f.betterbird()
-	links(t, map[string]string{"/proc/4000/fd/1": "pipe:[1]", "/proc/4000/fd/2": "/dev/null"})
-	f.answer = func(name string, args []string) Output { return Output{Stdout: "betterbird-bin 153.1.0esr-1\n"} }
-	a, err := f.Check()
-	if err != nil || a.OK {
-		t.Fatalf("%+v %v", a, err)
-	}
-	all := ""
-	for _, x := range a.Findings {
-		all += x.What + " | " + x.Do + "\n"
-	}
-	if !strings.Contains(all, "not on this machine") || !strings.Contains(all, "pipe nobody reads") {
-		t.Fatal(all)
-	}
-}
-
-func TestRestartEndsItPlacesTheUserJSAndStartsItUnderTheServiceManager(t *testing.T) {
-	f := newFake(t)
-	f.desktopSession()
-	f.betterbird()
-	links(t, nil)
-	f.declare("// none")
-	f.onStart = func(argv []string) {
-		f.proc(5000, 1000, "betterbird-bin", []string{"betterbird"}, "mesh-betterbird.service")
-	}
-	a, err := f.Restart(false)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(a.Ended) != 1 || a.Ended[0] != 4000 || len(a.Running) != 1 || a.Running[0].PID != 5000 || !strings.HasPrefix(a.UserJS, "placed") {
-		t.Fatalf("%+v", a)
-	}
-	if !f.called("systemd-run --user --collect --quiet --unit=mesh-betterbird") {
-		t.Fatalf("%v", f.calls)
-	}
-}
-
-func TestTheReminderTestTouchesNothingOfTheOperatorsProfile(t *testing.T) {
-	f := newFake(t)
-	f.desktopSession()
-	f.betterbird()
-	links(t, nil)
-	f.declare(`user_pref("calendar.alarms.show", true);`)
-	before, _ := os.ReadFile(filepath.Join(f.Root, profileDir, "prefs.js"))
-	a, err := f.ReminderTest(40*time.Second, []string{"extensions.activeThemeID", "mail.identity.id1.useremail", "nope.nope"}, false)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if strings.Join(a.Carried, ",") != "extensions.activeThemeID" || len(a.Withheld) != 2 {
-		t.Fatalf("%+v", a)
-	}
-	dir := filepath.Join(f.Root, "/run/user/1000", testUnit)
-	user, _ := os.ReadFile(filepath.Join(dir, "profile", "user.js"))
-	cal, _ := os.ReadFile(filepath.Join(dir, "test.ics"))
-	if !strings.Contains(string(user), `"calendar.alarms.show", true`) || !strings.Contains(string(user), `"extensions.activeThemeID", "thunderbird-compact-dark@mozilla.org"`) ||
-		!strings.Contains(string(user), "file:///run/user/1000/"+testUnit+"/test.ics") || strings.Contains(string(user), "someone@") {
-		t.Fatalf("%s", user)
-	}
-	// Betterbird's update check stays off, so no About window opens on the operator's screen, and the
-	// test's own preferences come last, so nothing carried or declared overrides them.
-	if !strings.Contains(string(user), `"betterbird.update.checkIntervalDays", 0`) ||
-		strings.Index(string(user), "extensions.activeThemeID") > strings.Index(string(user), "calendar.registry.meshtest.uri") ||
-		strings.Index(string(user), `"calendar.alarms.show"`) > strings.Index(string(user), "calendar.registry.meshtest.uri") {
-		t.Fatalf("%s", user)
-	}
-	// The event starts 10 minutes after the reminder, which is due 40 s from now.
-	if !strings.Contains(string(cal), "DTSTART:20270115T081040Z") || !strings.Contains(string(cal), "TRIGGER:-PT10M") ||
-		a.Due != "2027-01-15T08:00:40Z" {
-		t.Fatalf("%s %s", cal, a.Due)
-	}
-	if !f.called("systemd-run --user --collect --quiet --unit=" + testUnit + " -p RuntimeMaxSec=600 -p ExecStopPost=/usr/bin/rm -rf /run/user/1000/" + testUnit + " --setenv=MOZ_NO_REMOTE=1") {
-		t.Fatalf("%v", f.calls)
-	}
-	after, _ := os.ReadFile(filepath.Join(f.Root, profileDir, "prefs.js"))
-	if string(before) != string(after) || exists(filepath.Join(f.Root, profileDir, "user.js")) {
-		t.Fatal("the operator's profile is untouched")
-	}
-	if _, err := f.ReminderTest(0, nil, true); err != nil || exists(dir) {
-		t.Fatalf("stop removes the test profile: %v", err)
-	}
-}

modules/betterbird/cmd/betterbird-tools/config.go

@@ -1,666 +0,0 @@
-package main
-
-// The configuration of Betterbird's preferences (novox/hq issue 345, issue 586), in three layers:
-//
-//   - LOCKED: the enterprise policy (/opt/betterbird/distribution/policies.json). Its Preferences entries with
-//     Status locked win over everything, and Betterbird's settings show them greyed out.
-//   - DECLARED: the setting prefs, the operator's setup: mesh-wide, with a node's layer over it key by key. The
-//     node-engine writes it to ~/.config/betterbird/prefs.json and the tools place it in the profile's user.js,
-//     where it wins over prefs.js at every start.
-//   - BETTERBIRD'S DEFAULT: what Betterbird starts with. The module's defaults file
-//     (/opt/betterbird/defaults/pref/mesh-defaults.js) holds no value of the operator's any more (issue 586): it
-//     names the preferences the module keeps at Betterbird's own default, where a value the profile saved is drift.
-//
-// betterbird_config shows each managed preference through the layers and flags the drift; betterbird_config_apply
-// clears a drifting value from prefs.js while Betterbird is not running; keep proposes a node layer of the setting
-// prefs that holds the profile's value for this node instead, through the controller's settings verb, never by
-// writing user.js.
-
-import (
-	"archive/zip"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"os"
-	"path/filepath"
-	"regexp"
-	"sort"
-	"strconv"
-	"strings"
-)
-
-const (
-	// prefDir is the installation's own defaults directory; the module places its files there.
-	prefDir = installDir + "/defaults/pref"
-	// meshDefaults is the module's DEFAULT layer.
-	meshDefaults = prefDir + "/mesh-defaults.js"
-	// omniJa is Betterbird's packed application, holding its own default preferences.
-	omniJa = installDir + "/omni.ja"
-)
-
-// moduleFiles are the module's files in the installation's defaults directory: their values are the module's
-// defaults, not Betterbird's.
-var moduleFiles = map[string]bool{"mesh-defaults.js": true, "vendor-prefs.js": true}
-
-var (
-	// defaultLine is one pref(…) or sticky_pref(…) line of a defaults file; a comment may follow it.
-	defaultLine = regexp.MustCompile(`^\s*(?:sticky_)?pref\(\s*"((?:[^"\\]|\\.)*)"\s*,\s*(.*?)\s*\)\s*;`)
-	// keepsDefault is a line of the module's defaults naming a preference it manages without a value.
-	keepsDefault = regexp.MustCompile(`^//\s*keeps Betterbird's default:\s*([A-Za-z0-9_.@{}\-]+)\s*$`)
-)
-
-// builtIn are the defaults compiled into Betterbird of the preferences the module keeps at Betterbird's default,
-// which no defaults file gives: so a value saved equal to them is not drift.
-var builtIn = map[string]string{
-	themePref:                           `"` + defaultTheme + `"`,
-	"browser.display.use_system_colors": "false",
-	"layout.css.always_underline_links": "false",
-}
-
-const (
-	themePref    = "extensions.activeThemeID"
-	defaultTheme = "default-theme@mozilla.org"
-	// themeRemedy is how the theme comes back: Betterbird keeps the active theme in its add-on database
-	// (extensions.json), and the preference only mirrors it (XPIDatabase addonChanged), so clearing it changes
-	// nothing and betterbird_config_apply never touches it.
-	themeRemedy = "enable the default theme in Betterbird's add-on manager (Add-ons and Themes, Themes): the active " +
-		"theme is kept in the add-on database, and its preference only mirrors it, so clearing prefs.js would not change it"
-)
-
-// activeTheme is the theme the profile's add-on database marks active, or "" when it cannot be read.
-func activeTheme(profile string) string {
-	raw, err := readBounded(filepath.Join(profile, "extensions.json"))
-	if err != nil {
-		return ""
-	}
-	var ext struct {
-		Addons []struct {
-			ID     string `json:"id"`
-			Type   string `json:"type"`
-			Active bool   `json:"active"`
-		} `json:"addons"`
-	}
-	if json.Unmarshal(raw, &ext) != nil {
-		return ""
-	}
-	for _, a := range ext.Addons {
-		if a.Type == "theme" && a.Active {
-			return a.ID
-		}
-	}
-	return ""
-}
-
-// unmanageable says why a name in the module's defaults is never managed by these tools, or "": a credential's,
-// an account's or a server's preference, which betterbird_config never answers and betterbird_config_apply never
-// clears, whatever the defaults file lists.
-func unmanageable(name string) string {
-	if why := withheld(name); why != "" {
-		return why
-	}
-	for _, p := range accountOwned {
-		if strings.HasPrefix(name, p) {
-			return "an account's preference, the setting accounts' alone"
-		}
-	}
-	return ""
-}
-
-// answer is a value as these tools answer it: masked, but for the theme's id.
-func (m *Machine) answer(name, v string) string {
-	if allowedExtensions[name] {
-		return v
-	}
-	return m.maskValue(v)
-}
-
-// nodeName is the machine this runtime serves, as the mesh names it: a variable so a test answers.
-var nodeName = func() string { return os.Getenv("MESH_NODE") }
-
-// shipped is the module's DEFAULT layer as placed on the machine.
-type shipped struct {
-	values map[string]string
-	// keeps are the managed names whose module value is Betterbird's own default.
-	keeps map[string]bool
-	// order is every managed name, in the file's order.
-	order []string
-}
-
-// parseShipped reads the module's defaults file.
-func parseShipped(raw []byte) shipped {
-	s := shipped{values: map[string]string{}, keeps: map[string]bool{}}
-	for _, line := range strings.Split(string(raw), "\n") {
-		if mm := keepsDefault.FindStringSubmatch(strings.TrimSpace(line)); mm != nil {
-			if !s.keeps[mm[1]] {
-				s.keeps[mm[1]] = true
-				s.order = append(s.order, mm[1])
-			}
-			continue
-		}
-		if mm := defaultLine.FindStringSubmatch(line); mm != nil {
-			if _, seen := s.values[mm[1]]; !seen {
-				s.order = append(s.order, mm[1])
-			}
-			s.values[mm[1]] = mm[2]
-		}
-	}
-	return s
-}
-
-// shippedDefaults reads the module's defaults file from the installation.
-func (m *Machine) shippedDefaults() (shipped, error) {
-	raw, err := readBounded(m.path(meshDefaults))
-	if err != nil {
-		return shipped{values: map[string]string{}, keeps: map[string]bool{}}, err
-	}
-	return parseShipped(raw), nil
-}
-
-// DefaultValue is a default preference and the file that gives it.
-type DefaultValue struct {
-	Value string
-	From  string
-	// Module says the module's files give it, not Betterbird's.
-	Module bool
-}
-
-// readDefaultsInto reads the pref(…) lines of the files of one place, in Gecko's order: it reads a place's
-// files last-first by name (Preferences.cpp, pref_ReadDefaultPrefs), so of a name in several files the value
-// of the file first by name holds. A later place overrides an earlier one.
-func readDefaultsInto(out map[string]DefaultValue, files map[string][]byte, label func(string) (string, bool)) {
-	names := make([]string, 0, len(files))
-	for n := range files {
-		names = append(names, n)
-	}
-	sort.Strings(names)
-	place := map[string]DefaultValue{}
-	for i := len(names) - 1; i >= 0; i-- {
-		from, module := label(names[i])
-		for _, line := range strings.Split(string(files[names[i]]), "\n") {
-			if mm := defaultLine.FindStringSubmatch(line); mm != nil {
-				place[mm[1]] = DefaultValue{Value: mm[2], From: from, Module: module}
-			}
-		}
-	}
-	for k, v := range place {
-		out[k] = v
-	}
-}
-
-// mostDefaultsFile bounds one defaults file read from omni.ja.
-const mostDefaultsFile = 4 << 20
-
-// defaults reads every default preference Betterbird starts with: greprefs.js and defaults/pref/*.js in
-// omni.ja, then the installation's defaults/pref/*.js, where the module's files are. A preference compiled into
-// Betterbird (a static preference) is in no file, and is absent here. withModule false leaves the module's own
-// files out, so what remains is Betterbird's. The error says what could not be read.
-func (m *Machine) defaults(withModule bool) (map[string]DefaultValue, error) {
-	out := map[string]DefaultValue{}
-	var problems []string
-	if r, err := zip.OpenReader(m.path(omniJa)); err != nil {
-		problems = append(problems, omniJa+" is unreadable: "+err.Error())
-	} else {
-		gre, app := map[string][]byte{}, map[string][]byte{}
-		for _, f := range r.File {
-			switch {
-			case f.Name == "greprefs.js":
-			case strings.HasPrefix(f.Name, "defaults/pref/") && strings.HasSuffix(f.Name, ".js") && !strings.Contains(f.Name[len("defaults/pref/"):], "/"):
-			default:
-				continue
-			}
-			rc, err := f.Open()
-			if err != nil {
-				continue
-			}
-			b, _ := io.ReadAll(io.LimitReader(rc, mostDefaultsFile))
-			rc.Close()
-			if f.Name == "greprefs.js" {
-				gre[f.Name] = b
-			} else {
-				app[filepath.Base(f.Name)] = b
-			}
-		}
-		r.Close()
-		readDefaultsInto(out, gre, func(n string) (string, bool) { return "Betterbird's default (omni.ja " + n + ")", false })
-		readDefaultsInto(out, app, func(n string) (string, bool) {
-			return "Betterbird's default (omni.ja defaults/pref/" + n + ")", false
-		})
-	}
-	installed := map[string][]byte{}
-	entries, _ := os.ReadDir(m.path(prefDir))
-	for _, e := range entries {
-		if e.IsDir() || !strings.HasSuffix(e.Name(), ".js") || (moduleFiles[e.Name()] && !withModule) {
-			continue
-		}
-		if b, err := readBounded(m.path(filepath.Join(prefDir, e.Name()))); err == nil {
-			installed[e.Name()] = b
-		}
-	}
-	readDefaultsInto(out, installed, func(n string) (string, bool) {
-		if moduleFiles[n] {
-			return "the module's default (" + prefDir + "/" + n + ")", true
-		}
-		return "Betterbird's default (" + prefDir + "/" + n + ")", false
-	})
-	if len(problems) > 0 {
-		return out, errors.New(strings.Join(problems, "; "))
-	}
-	return out, nil
-}
-
-// policyPrefs are the Preferences entries of the placed policy: name to its value as a preference file writes
-// it, and whether it is locked. An unreadable policy has none.
-type policyPref struct {
-	Value  string
-	Locked bool
-}
-
-func policyPrefsOf(raw []byte) map[string]policyPref {
-	var p struct {
-		Policies struct {
-			Preferences map[string]struct {
-				Value  any    `json:"Value"`
-				Status string `json:"Status"`
-			} `json:"Preferences"`
-		} `json:"policies"`
-	}
-	out := map[string]policyPref{}
-	if json.Unmarshal(raw, &p) != nil {
-		return out
-	}
-	for name, e := range p.Policies.Preferences {
-		out[name] = policyPref{Value: literal(e.Value), Locked: e.Status == "locked"}
-	}
-	return out
-}
-
-// locks are the preferences the placed policy locks: name to value.
-func (m *Machine) locks() map[string]string {
-	raw, err := readBounded(m.path(policyFile))
-	if err != nil {
-		return map[string]string{}
-	}
-	out := map[string]string{}
-	for name, p := range policyPrefsOf(raw) {
-		if p.Locked {
-			out[name] = p.Value
-		}
-	}
-	return out
-}
-
-// literal is a JSON value as a preference file writes it.
-func literal(v any) string {
-	switch x := v.(type) {
-	case bool:
-		return strconv.FormatBool(x)
-	case float64:
-		return strconv.FormatFloat(x, 'f', -1, 64)
-	case string:
-		return quoted(x)
-	case nil:
-		return ""
-	}
-	b, _ := json.Marshal(v)
-	return string(b)
-}
-
-// statementsOf are the user_pref(…) statements of a user.js, several to a line allowed: name to value.
-func statementsOf(raw []byte) map[string]string {
-	out := map[string]string{}
-	for _, line := range strings.Split(string(raw), "\n") {
-		for _, st := range splitStatements(strings.TrimSpace(line)) {
-			if mm := prefLine.FindStringSubmatch(st); mm != nil {
-				out[mm[1]] = mm[2]
-			}
-		}
-	}
-	return out
-}
-
-// ConfigPref is one managed preference through the layers.
-type ConfigPref struct {
-	Name string `json:"name"`
-	// Layer is locked (the policy), declared (the setting prefs), default (a value of the module's defaults file) or
-	// "Betterbird's default" (a managed preference whose module value is Betterbird's own).
-	Layer             string `json:"layer"`
-	Locked            string `json:"locked,omitempty"`
-	ModuleDefault     string `json:"module_default,omitempty"`
-	BetterbirdDefault string `json:"betterbird_default,omitempty"`
-	// Declared is what the setting prefs says on this machine: mesh-wide, with the node's layer over it.
-	Declared string `json:"declared,omitempty"`
-	// Profile is what the profile saved in its prefs.js.
-	Profile   string `json:"profile,omitempty"`
-	Effective string `json:"effective"`
-	From      string `json:"effective_from"`
-	// Drift says how the profile's own value beats the module's without a node layer saying so.
-	Drift string `json:"drift,omitempty"`
-	// Remedy is how drift that clearing prefs.js cannot fix is fixed (the theme).
-	Remedy string `json:"remedy,omitempty"`
-	// module is the value the module means: its default, or Betterbird's.
-	module string
-}
-
-// ConfigAnswer is what betterbird_config answers.
-type ConfigAnswer struct {
-	Profile  string       `json:"profile"`
-	Defaults string       `json:"module_defaults"`
-	Prefs    []ConfigPref `json:"prefs"`
-	// Drifting are the names that drift.
-	Drifting []string `json:"drifting"`
-	// Refused are names the module's defaults list that the tools never manage: an account's or a credential's.
-	Refused []string `json:"refused,omitempty"`
-	// PrefsProblem says why the setting prefs on this machine is refused.
-	PrefsProblem string `json:"prefs_problem,omitempty"`
-	// Proposed is the controller's answer to a node layer proposed with keep.
-	Proposed string `json:"proposed,omitempty"`
-	Note     string `json:"note,omitempty"`
-}
-
-// config reads every managed preference through the layers: the policy's locks, the module's defaults, the
-// node layer (the declared user.js), the profile's prefs.js and user.js.
-func (m *Machine) config() (ConfigAnswer, Profile, error) {
-	a := ConfigAnswer{Prefs: []ConfigPref{}, Drifting: []string{}}
-	p, err := m.profile()
-	if err != nil {
-		return a, p, err
-	}
-	a.Profile = p.Dir
-	sh, serr := m.shippedDefaults()
-	if serr != nil {
-		a.Defaults = "not placed: " + meshDefaults + " is missing; the module's push places it"
-	} else {
-		a.Defaults = fmt.Sprintf("placed: %s, %d preference(s) with a value and %d kept at Betterbird's default",
-			meshDefaults, len(sh.values), len(sh.keeps))
-	}
-	locked := m.locks()
-	own, _ := m.defaults(false)
-	node, _, nerr := m.readDeclaredPrefs()
-	if nerr != nil {
-		a.PrefsProblem = nerr.Error()
-	}
-	prefsRaw, _ := readBounded(filepath.Join(p.path, "prefs.js"))
-	saved := readPrefs(prefsRaw)
-	userRaw, _ := readBounded(filepath.Join(p.path, "user.js"))
-	placed := statementsOf(userRaw)
-
-	var names []string
-	for n := range locked {
-		names = append(names, n)
-	}
-	sort.Strings(names)
-	listed := map[string]bool{}
-	for _, n := range names {
-		listed[n] = true
-	}
-	for _, n := range append(append([]string{}, sh.order...), sortedKeys(node)...) {
-		if !listed[n] {
-			listed[n] = true
-			names = append(names, n)
-		}
-	}
-	theme := activeTheme(p.path)
-	for _, n := range names {
-		if why := unmanageable(n); why != "" {
-			a.Refused = append(a.Refused, n+": "+why)
-			continue
-		}
-		c := ConfigPref{Name: n, Declared: node[n], Profile: saved[n]}
-		if n == themePref && theme != "" {
-			// The add-on database says which theme is active; the preference only mirrors it.
-			c.Profile = quoted(theme)
-		}
-		bb, hasBB := own[n]
-		if hasBB {
-			c.BetterbirdDefault = bb.Value
-		} else if v, ok := builtIn[n]; ok {
-			c.BetterbirdDefault = v
-			bb.From = "Betterbird's built-in default"
-		}
-		switch v, isLocked := locked[n]; {
-		case isLocked:
-			c.Layer, c.Locked, c.module = "locked", v, v
-		case c.Declared != "":
-			c.Layer, c.module = "declared", c.Declared
-		case sh.keeps[n]:
-			c.Layer = "Betterbird's default"
-			c.module = c.BetterbirdDefault
-		default:
-			c.Layer, c.ModuleDefault, c.module = "default", sh.values[n], sh.values[n]
-		}
-		switch {
-		case c.Locked != "":
-			c.Effective, c.From = c.Locked, "locked by the module's policy"
-		case placed[n] != "":
-			c.Effective, c.From = placed[n], "the profile's user.js (wins at the start)"
-		case c.Profile != "":
-			c.Effective, c.From = c.Profile, "the profile's prefs.js"
-		case c.ModuleDefault != "":
-			c.Effective, c.From = c.ModuleDefault, "the module's default"
-		case c.BetterbirdDefault != "":
-			c.Effective, c.From = c.BetterbirdDefault, bb.From
-		default:
-			c.From = "Betterbird's built-in default (in no defaults file)"
-		}
-		if why := drift(c, placed[n]); why != "" {
-			c.Drift = why
-			switch {
-			case n == themePref:
-				c.Remedy = themeRemedy
-			case c.Layer == "declared":
-				c.Remedy = "betterbird_user_js with apply places the setting in the profile's user.js; Betterbird reads it " +
-					"at its next start (betterbird_restart)"
-			}
-			a.Drifting = append(a.Drifting, n)
-		}
-		c.Declared, c.Profile, c.Effective = m.answer(n, c.Declared), m.answer(n, c.Profile), m.answer(n, c.Effective)
-		a.Prefs = append(a.Prefs, c)
-	}
-	return a, p, nil
-}
-
-// drift says how the profile differs from the module's configuration, or "": for a declared preference, the
-// profile's user.js not holding the declared value (so Betterbird does not start with it); for a preference kept at
-// Betterbird's default, a value in prefs.js that is not it. A lock holds whatever the profile says.
-func drift(c ConfigPref, placed string) string {
-	if c.Locked != "" {
-		return ""
-	}
-	if c.Declared != "" {
-		if placed == c.Declared {
-			return ""
-		}
-		return fmt.Sprintf("the setting prefs says %s, and the profile's user.js does not hold it yet", c.Declared)
-	}
-	if c.Profile == "" || c.Profile == c.module {
-		return ""
-	}
-	want := c.module
-	if want == "" {
-		want = "Betterbird's built-in default"
-	}
-	where := "the profile's prefs.js holds"
-	if c.Name == themePref {
-		where = "the profile's active theme is"
-	}
-	return fmt.Sprintf("%s %s, which beats the module's %s, and the setting prefs does not say so", where, c.Profile, want)
-}
-
-// Config is what betterbird_config answers; with keep it proposes a node layer of the setting prefs that holds
-// the profile's own values of the named managed preferences on this machine (novox/hq issue 345). The module
-// never writes user.js for it: the operator approves the layer, and the next push writes it.
-func (m *Machine) Config(keep []string) (ConfigAnswer, error) {
-	a, p, err := m.config()
-	if err != nil {
-		return a, err
-	}
-	a.Note = "drift is a declared value the profile's user.js does not hold yet (betterbird_user_js with apply), or a " +
-		"value the profile saved where the module keeps Betterbird's default: betterbird_config_apply clears that one " +
-		"(Betterbird quit), or keep proposes a node layer of the setting prefs that holds it for this machine"
-	if len(keep) == 0 {
-		return a, nil
-	}
-	by := map[string]ConfigPref{}
-	for _, c := range a.Prefs {
-		by[c.Name] = c
-	}
-	prefsRaw, _ := readBounded(filepath.Join(p.path, "prefs.js"))
-	saved := readPrefs(prefsRaw)
-	kept := map[string]string{}
-	for _, n := range keep {
-		c, managed := by[n]
-		switch {
-		case !managed:
-			return a, fmt.Errorf("nothing was proposed: %s is not a preference the module manages (betterbird_config lists them)", n)
-		case c.Locked != "":
-			return a, fmt.Errorf("nothing was proposed: %s is locked by the module's policy; a lock changes only in the catalogue", n)
-		case n == themePref:
-			return a, fmt.Errorf("nothing was proposed: a node layer cannot choose the theme; the add-on manager does (%s)", themeRemedy)
-		case saved[n] == "":
-			return a, fmt.Errorf("nothing was proposed: the profile saved no value of its own for %s", n)
-		}
-		kept[n] = saved[n]
-	}
-	node := nodeName()
-	if node == "" {
-		return a, errors.New("nothing was proposed: this runtime does not say which machine it serves (MESH_NODE)")
-	}
-	// A layer is replaced whole, so the proposal carries this node's layer as it stands, with the kept values in
-	// the setting prefs beside what it held (novox/hq issue 586: one entry per preference).
-	layer, err := readLayer(node)
-	if err != nil {
-		return a, fmt.Errorf("nothing was proposed: %v", err)
-	}
-	prefs, _ := layer["prefs"].(map[string]any)
-	if prefs == nil {
-		prefs = map[string]any{}
-	}
-	for _, n := range keep {
-		v, ok := prefValue(kept[n])
-		if !ok {
-			return a, fmt.Errorf("nothing was proposed: the profile's value of %s is not one the setting can hold", n)
-		}
-		prefs[n] = v
-	}
-	layer["prefs"] = prefs
-	said, err := proposeLayer(node, layer, false)
-	a.Proposed = m.maskValue(said)
-	if err != nil {
-		return a, err
-	}
-	a.Note = "proposed for " + node + ": the operator approves it on a channel that proves who answers; the next " +
-		"push writes it, and it is placed at Betterbird's next start from the launcher (or betterbird_restart). " +
-		"The layer carries this node's layer as it stands, with the kept preferences in the setting prefs"
-	return a, nil
-}
-
-// Cleared is one value betterbird_config_apply took out of prefs.js.
-type Cleared struct {
-	Name string `json:"name"`
-	Was  string `json:"was"`
-	// Now is the value that holds once Betterbird starts again.
-	Now string `json:"now"`
-}
-
-// ConfigApplyAnswer is what betterbird_config_apply answers.
-type ConfigApplyAnswer struct {
-	Profile string    `json:"profile"`
-	Applied bool      `json:"applied"`
-	Clears  []Cleared `json:"clears"`
-	// NotCleared is drift that clearing prefs.js cannot fix, each with how it is fixed.
-	NotCleared []string `json:"not_cleared,omitempty"`
-	Note       string   `json:"note"`
-}
-
-// ConfigApply takes the drifting values out of the profile's prefs.js, so the module's value holds at the next
-// start. Without apply it lists them. It acts only while Betterbird is not running, because Betterbird
-// rewrites prefs.js when it quits. Every other line of prefs.js is kept as it was.
-func (m *Machine) ConfigApply(apply bool) (ConfigApplyAnswer, error) {
-	c, p, err := m.config()
-	a := ConfigApplyAnswer{Profile: c.Profile, Clears: []Cleared{}}
-	if err != nil {
-		return a, err
-	}
-	if strings.HasPrefix(c.Defaults, "not placed") {
-		return a, fmt.Errorf("the module's defaults are %s: nothing to bring the profile back to", c.Defaults)
-	}
-	drifting := map[string]bool{}
-	for _, cp := range c.Prefs {
-		if cp.Drift != "" && cp.Remedy != "" {
-			a.NotCleared = append(a.NotCleared, cp.Name+": "+cp.Remedy)
-			continue
-		}
-		if cp.Drift != "" {
-			drifting[cp.Name] = true
-			now := m.answer(cp.Name, cp.module)
-			if now == "" {
-				now = "Betterbird's built-in default"
-			}
-			a.Clears = append(a.Clears, Cleared{Name: cp.Name, Was: cp.Profile, Now: now})
-		}
-	}
-	if !apply {
-		a.Note = "a dry run: these values would be taken out of prefs.js. Quit Betterbird, then call with apply"
-		return a, nil
-	}
-	if ps := m.mainProcs(); len(ps) > 0 {
-		return a, fmt.Errorf("Betterbird is running (pid %d): it rewrites prefs.js when it quits, so nothing was cleared; quit it, then apply again", ps[0].PID)
-	}
-	// The profile's own lock is Gecko's sign that a Betterbird holds it, whichever installation started it.
-	if _, err := os.Lstat(filepath.Join(p.path, "lock")); err == nil {
-		return a, errors.New("the profile is locked (its lock file is there): a Betterbird holds it, or one ended " +
-			"without quitting; nothing was cleared. Quit Betterbird (or start and quit it once), then apply again")
-	}
-	if len(drifting) == 0 {
-		a.Applied, a.Note = true, "nothing in prefs.js drifts: it was left as it was"
-		return a, nil
-	}
-	target := filepath.Join(p.path, "prefs.js")
-	raw, err := readBounded(target)
-	if err != nil {
-		return a, err
-	}
-	st, err := os.Stat(target)
-	if err != nil {
-		return a, err
-	}
-	lines := strings.SplitAfter(string(raw), "\n")
-	var kept strings.Builder
-	for _, l := range lines {
-		if mm := prefLine.FindStringSubmatch(strings.TrimRight(l, "\n")); mm != nil && drifting[mm[1]] {
-			continue
-		}
-		kept.WriteString(l)
-	}
-	tmp := target + ".mesh-new"
-	if err := writeSynced(tmp, []byte(kept.String()), st.Mode().Perm()); err != nil {
-		os.Remove(tmp)
-		return a, err
-	}
-	if err := os.Rename(tmp, target); err != nil {
-		os.Remove(tmp)
-		return a, err
-	}
-	a.Applied = true
-	a.Note = fmt.Sprintf("cleared %d value(s) from prefs.js; the module's values hold from Betterbird's next start", len(a.Clears))
-	return a, nil
-}
-
-// writeSynced writes a file and syncs it to disk before it is renamed into place, so a crash never leaves an
-// empty prefs.js.
-func writeSynced(path string, data []byte, mode os.FileMode) error {
-	f, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, mode)
-	if err != nil {
-		return err
-	}
-	if _, err := f.Write(data); err != nil {
-		f.Close()
-		return err
-	}
-	if err := f.Sync(); err != nil {
-		f.Close()
-		return err
-	}
-	return f.Close()
-}

modules/betterbird/cmd/betterbird-tools/config_test.go

@@ -1,541 +0,0 @@
-package main
-
-import (
-	"archive/zip"
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"reflect"
-	"strings"
-	"testing"
-)
-
-// The configuration the module ships (novox/hq issue 345): the policy's locks, the module's defaults file, and the
-// tools that show the layers, flag drift, clear it and propose a node layer.
-
-// shippedDefaultsWant is the setup the operator approved on 2026-10-12 (the laptop's, with reminders missed while
-// asleep shown at the next start and chat off), which the module shipped as its defaults file until issue 586 moved
-// it into the mesh-wide layer of the setting prefs: the catalogue holds none of it now.
-var shippedDefaultsWant = map[string]string{
-	"mail.uidensity":                                "0",
-	"mail.uifontsize":                               "14",
-	"mail.dark-reader.enabled":                      "false",
-	"mail.pane_config.dynamic":                      "2",
-	"mail.pane_config.multiline_all":                "true",
-	"mail.threadpane.listview":                      "0",
-	"mailnews.default_view_flags":                   "1",
-	"mail.warn_on_shift_delete":                     "false",
-	"mail.biff.show_alert":                          "false",
-	"mail.biff.play_sound":                          "false",
-	"mail.biff.show_tray_icon":                      "false",
-	"mail.biff.use_system_alert":                    "true",
-	"calendar.view.daystarthour":                    "9",
-	"calendar.view.dayendhour":                      "20",
-	"calendar.item.promptDelete":                    "false",
-	"calendar.timezone.useSystemTimezone":           "true",
-	"calendar.alarms.show":                          "true",
-	"calendar.alarms.showmissed":                    "true",
-	"mail.chat.enabled":                             "false",
-	"mailnews.message_display.disable_remote_image": "true",
-	"privacy.donottrackheader.enabled":              "true",
-}
-
-var shippedKeepsWant = []string{"extensions.activeThemeID", "browser.display.use_system_colors",
-	"layout.css.always_underline_links", "mail.spam.manualMark", "mail.compose.show_attachment_pane"}
-
-func repoFile(t *testing.T, rel string) []byte {
-	t.Helper()
-	raw, err := os.ReadFile(filepath.Join("..", "..", rel))
-	if err != nil {
-		t.Fatal(err)
-	}
-	return raw
-}
-
-// withDefaults places the module's defaults file as the push does.
-func (f *fake) withDefaults() {
-	f.t.Helper()
-	f.write(meshDefaults, string(repoFile(f.t, "install/defaults-pref/mesh-defaults.js")))
-}
-
-// omni places a packed application holding the given files.
-func (f *fake) omni(files map[string]string) {
-	f.t.Helper()
-	full := filepath.Join(f.Root, omniJa)
-	if err := os.MkdirAll(filepath.Dir(full), 0o755); err != nil {
-		f.t.Fatal(err)
-	}
-	out, err := os.Create(full)
-	if err != nil {
-		f.t.Fatal(err)
-	}
-	w := zip.NewWriter(out)
-	for name, body := range files {
-		e, _ := w.Create(name)
-		e.Write([]byte(body))
-	}
-	w.Close()
-	out.Close()
-}
-
-// betterbirdsOwn is a small omni.ja: two files that contradict each other, as all-thunderbird.js and
-// mailnews.js do in the pinned release.
-func (f *fake) betterbirdsOwn() {
-	f.omni(map[string]string{
-		"greprefs.js": `pref("gfx.webrender.software", false);` + "\n",
-		"defaults/pref/all-thunderbird.js": `pref("offline.autoDetect", true);` + "\n" +
-			`pref("mail.threadpane.listview", 1);` + "\n" + `pref("mail.uidensity", 1);` + "\n" +
-			`pref("mail.shell.checkDefaultClient", true);` + "\n",
-		"defaults/pref/mailnews.js": `pref("offline.autoDetect", false);` + "\n" +
-			`pref("mail.biff.show_alert", true); // a comment after it` + "\n" + `pref("mail.spam.manualMark", false);` + "\n" +
-			`pref("mailnews.start_page.enabled", true);` + "\n",
-		"defaults/pref/calendar.js": `pref("calendar.alarms.showmissed", false);` + "\n",
-		"chrome/other.js":           `pref("not.a.default", 1);` + "\n",
-	})
-}
-
-func stopBetterbird(t *testing.T, f *fake) {
-	t.Helper()
-	for _, pid := range []string{"4000", "4001"} {
-		if err := os.RemoveAll(filepath.Join(f.Root, "proc", pid)); err != nil {
-			t.Fatal(err)
-		}
-	}
-}
-
-func TestTheModuleShipsTheApprovedLocksAndDefaults(t *testing.T) {
-	m, _ := readManifest(t)
-	if a := artifact(t, m, "defaults"); a["from"] != "install/defaults-pref" {
-		t.Fatalf("the defaults file ships through the defaults artifact: %v", a)
-	}
-	if r := resource(t, m, "spelling"); r["path"] != prefDir || r["artifact"] != "defaults" {
-		t.Fatalf("placed in Betterbird's own defaults directory: %v", r)
-	}
-	raw := repoFile(t, "install/distribution/policies.json")
-	if why := policyProblem(raw); why != "" {
-		t.Fatal(why)
-	}
-	var p struct {
-		Policies map[string]json.RawMessage `json:"policies"`
-	}
-	if err := json.Unmarshal(raw, &p); err != nil {
-		t.Fatal(err)
-	}
-	for k, want := range map[string]string{"DisableAppUpdate": "true", "DisableTelemetry": "true", "ExtensionUpdate": "false"} {
-		if string(p.Policies[k]) != want {
-			t.Errorf("%s is %s, not %s", k, p.Policies[k], want)
-		}
-	}
-	prefs := policyPrefsOf(raw)
-	for _, n := range []string{"mail.shell.checkDefaultClient", "mail.inappnotifications.enabled", "mailnews.start_page.enabled"} {
-		if prefs[n] != (policyPref{Value: "false", Locked: true}) {
-			t.Errorf("%s is locked off: %+v", n, prefs[n])
-		}
-	}
-	// Betterbird's Preferences policy accepts only these prefixes (Policies.sys.mjs); privacy. and toolkit. are not.
-	allowed := []string{"accessibility.", "app.update.", "browser.", "calendar.", "chat.", "datareporting.policy.", "dom.",
-		"extensions.", "general.autoScroll", "general.smoothScroll", "geo.", "gfx.", "intl.", "layers.", "layout.", "mail.",
-		"mailnews.", "media.", "network.", "pdfjs.", "places.", "print.", "signon.", "spellchecker.", "ui.", "widget."}
-	for n := range prefs {
-		ok := false
-		for _, a := range allowed {
-			ok = ok || strings.HasPrefix(n, a)
-		}
-		if !ok {
-			t.Errorf("the policy cannot lock %s: its prefix is not one Betterbird accepts", n)
-		}
-	}
-
-	text := string(repoFile(t, "install/defaults-pref/mesh-defaults.js"))
-	sh := parseShipped([]byte(text))
-	if len(sh.values) != 0 {
-		t.Errorf("the module's defaults hold no value of the operator's: they are the setting prefs (issue 586): %v", sh.values)
-	}
-	for n := range shippedDefaultsWant {
-		if strings.Contains(text, n) {
-			t.Errorf("%s is the operator's choice and lives in the setting prefs, never in the catalogue", n)
-		}
-	}
-	var keeps []string
-	for _, n := range sh.order {
-		if sh.keeps[n] {
-			keeps = append(keeps, n)
-		}
-	}
-	if !reflect.DeepEqual(keeps, shippedKeepsWant) {
-		t.Errorf("the preferences kept at Betterbird's default: %v", keeps)
-	}
-	lines := strings.Split(text, "\n")
-	for i, l := range lines {
-		if defaultLine.MatchString(l) && (i == 0 || !strings.HasPrefix(lines[i-1], "// ")) {
-			t.Errorf("line %d has no comment saying why: %s", i+1, l)
-		}
-		if t2 := strings.TrimSpace(l); t2 != "" && !strings.HasPrefix(t2, "//") && !defaultLine.MatchString(l) {
-			t.Errorf("line %d is neither a comment nor a pref(…) line: %s", i+1, l)
-		}
-	}
-	for n := range sh.values {
-		if withheld(n) != "" || passwordSecret.MatchString(n) {
-			t.Errorf("%s is an account's or a credential's preference, never a default of the module", n)
-		}
-		if _, locked := prefs[n]; locked {
-			t.Errorf("%s is both locked and a default", n)
-		}
-	}
-}
-
-// T2: Betterbird's own defaults are values read from omni.ja, in Gecko's order, and the module's beside them.
-func TestPrefsSayTheDefaultAndTheFileThatGivesIt(t *testing.T) {
-	f := newFake(t)
-	f.betterbird()
-	f.placedByTheMesh()
-	f.withDefaults()
-	f.betterbirdsOwn()
-	links(t, nil)
-	got, err := f.Prefs([]string{"offline.autoDetect", "mail.threadpane.listview", "mail.uidensity", "gfx.webrender.software",
-		"mailnews.start_page.enabled", "layout.css.always_underline_links", "not.a.default"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	by := map[string]Pref{}
-	for _, p := range got["prefs"].([]Pref) {
-		by[p.Name] = p
-	}
-	if p := by["offline.autoDetect"]; p.Value != "true" || p.Default != "true" || !strings.Contains(p.DefaultFrom, "all-thunderbird.js") {
-		t.Errorf("of two files, the one first by name holds, as Gecko reads them: %+v", p)
-	}
-	if p := by["mail.threadpane.listview"]; p.Value != "1" || strings.Contains(p.From, "module") || strings.Contains(p.DefaultFrom, "module") {
-		t.Errorf("the module ships no value of the operator's, so Betterbird's own default holds: %+v", p)
-	}
-	if p := by["gfx.webrender.software"]; p.Value != "false" || !strings.Contains(p.From, "greprefs.js") {
-		t.Errorf("%+v", p)
-	}
-	if p := by["mailnews.start_page.enabled"]; p.Value != "false" || p.From != "locked by the module's policy" || p.Default != "true" {
-		t.Errorf("a locked preference says its lock and Betterbird's default under it: %+v", p)
-	}
-	if p := by["layout.css.always_underline_links"]; p.Value != "" || !strings.Contains(p.From, "built-in") {
-		t.Errorf("a preference in no file is said as such: %+v", p)
-	}
-	if p := by["not.a.default"]; p.Default != "" {
-		t.Errorf("only defaults/pref and greprefs.js are defaults: %+v", p)
-	}
-}
-
-// T4: of mailnews.* only what names an account, a server or the operator's tags is withheld.
-func TestMailnewsIsWithheldOnlyWhereItNamesAnAccount(t *testing.T) {
-	for name, held := range map[string]bool{
-		"mailnews.start_page.enabled":                        false,
-		"mailnews.default_view_flags":                        false,
-		"mailnews.message_display.disable_remote_image":      false,
-		"mailnews.tags.$label1.tag":                          true,
-		"mailnews.smtp.loglevel":                             true,
-		"mailnews.reply_to_self_check_all_ident":             true,
-		"mailnews.auto_config.fetchFromISP.sendEmailAddress": true,
-		"mailnews.oauth.useSchemeRedirect":                   true,
-		"mail.server.server1.hostname":                       true,
-	} {
-		if got := withheld(name) != ""; got != held {
-			t.Errorf("%s: withheld %v, want %v", name, got, held)
-		}
-	}
-}
-
-// T1: every managed preference through the layers, and drift: a declared value the profile's user.js does not hold
-// yet, or a value the profile saved where the module keeps Betterbird's default.
-func TestTheConfigShowsTheLayersAndTheDrift(t *testing.T) {
-	f := newFake(t)
-	f.betterbird()
-	f.placedByTheMesh()
-	f.withDefaults()
-	f.betterbirdsOwn()
-	links(t, nil)
-	f.declare(`user_pref("mail.uifontsize", 16); user_pref("mail.biff.show_alert", false); user_pref("calendar.alarms.showmissed", true);`)
-	f.write(profileDir+"/user.js", mark+")\n"+`user_pref("mail.uifontsize", 16);`+"\n"+`user_pref("calendar.alarms.showmissed", true);`+"\n")
-	f.write(profileDir+"/prefs.js", "// Mozilla User Preferences\n"+
-		`user_pref("extensions.activeThemeID", "thunderbird-compact-dark@mozilla.org");`+"\n"+
-		`user_pref("mail.uifontsize", 12);`+"\n"+
-		`user_pref("mail.biff.show_alert", true);`+"\n"+
-		`user_pref("mail.spam.manualMark", true);`+"\n"+
-		`user_pref("browser.display.use_system_colors", false);`+"\n"+
-		`user_pref("mailnews.start_page.enabled", true);`+"\n")
-	c, err := f.Config(nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	by := map[string]ConfigPref{}
-	for _, p := range c.Prefs {
-		by[p.Name] = p
-	}
-	if len(c.Prefs) != 3+3+len(shippedKeepsWant) || !strings.HasPrefix(c.Defaults, "placed") {
-		t.Fatalf("every lock, declared preference and kept default: %d, %s", len(c.Prefs), c.Defaults)
-	}
-	if !reflect.DeepEqual(c.Drifting, []string{"extensions.activeThemeID", "mail.spam.manualMark", "mail.biff.show_alert"}) {
-		t.Fatalf("drift: %v", c.Drifting)
-	}
-	if p := by["mail.biff.show_alert"]; p.Layer != "declared" || p.Declared != "false" || p.Profile != "true" ||
-		p.Effective != "true" || !strings.Contains(p.Drift, "the setting prefs says false") || !strings.Contains(p.Remedy, "betterbird_user_js") {
-		t.Errorf("a declared value the profile's user.js does not hold yet: %+v", p)
-	}
-	if p := by["mail.spam.manualMark"]; p.Layer != "Betterbird's default" || p.BetterbirdDefault != "false" ||
-		!strings.Contains(p.Drift, "beats the module's false") || p.Remedy != "" {
-		t.Errorf("a saved value where the module keeps Betterbird's default: %+v", p)
-	}
-	if p := by["extensions.activeThemeID"]; p.Layer != "Betterbird's default" || !strings.Contains(p.Drift, `"default-theme@mozilla.org"`) ||
-		!strings.Contains(p.Remedy, "add-on manager") || p.Profile != `"thunderbird-compact-dark@mozilla.org"` {
-		t.Errorf("another theme is drift whose remedy is the add-on manager, its id answered whole: %+v", p)
-	}
-	if p := by["browser.display.use_system_colors"]; p.Drift != "" {
-		t.Errorf("a saved value equal to Betterbird's default is not drift: %+v", p)
-	}
-	if p := by["mail.uifontsize"]; p.Drift != "" || p.Declared != "16" || p.Effective != "16" || !strings.Contains(p.From, "user.js") {
-		t.Errorf("a declared value the user.js holds wins at the start, whatever prefs.js saved: %+v", p)
-	}
-	if p := by["mailnews.start_page.enabled"]; p.Layer != "locked" || p.Effective != "false" || p.Drift != "" {
-		t.Errorf("a lock wins over the profile: %+v", p)
-	}
-	if p := by["calendar.alarms.showmissed"]; p.Effective != "true" || p.Layer != "declared" {
-		t.Errorf("%+v", p)
-	}
-	// T5: the check says the drift, with both remedies.
-	ch, err := f.Check()
-	if err != nil {
-		t.Fatal(err)
-	}
-	found := false
-	for _, x := range ch.Findings {
-		found = found || (strings.Contains(x.What, "1 managed preference(s) drift") && strings.Contains(x.What, "mail.spam.manualMark") &&
-			strings.Contains(x.Do, "betterbird_config_apply") && strings.Contains(x.Do, "keep"))
-	}
-	theme := false
-	for _, x := range ch.Findings {
-		theme = theme || (strings.HasPrefix(x.What, "extensions.activeThemeID drifts") && strings.Contains(x.Do, "add-on manager") &&
-			!strings.Contains(x.Do, "betterbird_config_apply"))
-	}
-	declared := false
-	for _, x := range ch.Findings {
-		declared = declared || (strings.HasPrefix(x.What, "mail.biff.show_alert drifts") && strings.Contains(x.Do, "betterbird_user_js"))
-	}
-	if !found || !theme || !declared {
-		t.Fatalf("the check reports the drift: %+v", ch.Findings)
-	}
-	os.Remove(filepath.Join(f.Root, meshDefaults))
-	ch, _ = f.Check()
-	found = false
-	for _, x := range ch.Findings {
-		found = found || strings.Contains(x.What, "the module's defaults are not placed")
-	}
-	if !found {
-		t.Fatalf("defaults missing on a node of the mesh's release is a finding: %+v", ch.Findings)
-	}
-}
-
-// T3: the drifting values are cleared from prefs.js only while Betterbird is not running, and nothing else.
-func TestConfigApplyClearsTheDriftOnlyWhileBetterbirdIsQuit(t *testing.T) {
-	f := newFake(t)
-	f.betterbird()
-	f.placedByTheMesh()
-	f.withDefaults()
-	f.betterbirdsOwn()
-	links(t, nil)
-	f.declare("// none")
-	prefs := "// Mozilla User Preferences\n" +
-		`user_pref("extensions.activeThemeID", "thunderbird-compact-dark@mozilla.org");` + "\n" +
-		`user_pref("mail.identity.id1.useremail", "someone@example.org");` + "\n" +
-		`user_pref("mail.spam.manualMark", true);` + "\n" +
-		`user_pref("mail.uidensity", 0);` + "\n"
-	f.write(profileDir+"/prefs.js", prefs)
-	dry, err := f.ConfigApply(false)
-	if err != nil || dry.Applied || len(dry.Clears) != 1 || len(dry.NotCleared) != 1 {
-		t.Fatalf("a dry run lists and changes nothing: %+v %v", dry, err)
-	}
-	if f.read(profileDir+"/prefs.js") != prefs {
-		t.Fatal("a dry run wrote prefs.js")
-	}
-	if _, err := f.ConfigApply(true); err == nil || !strings.Contains(err.Error(), "running") {
-		t.Fatalf("refused while Betterbird runs: %v", err)
-	}
-	if f.read(profileDir+"/prefs.js") != prefs {
-		t.Fatal("prefs.js changed while Betterbird runs")
-	}
-	stopBetterbird(t, f)
-	f.write(profileDir+"/lock", "")
-	if _, err := f.ConfigApply(true); err == nil || !strings.Contains(err.Error(), "locked") {
-		t.Fatalf("refused while the profile's own lock is there: %v", err)
-	}
-	if err := os.Remove(filepath.Join(f.Root, profileDir, "lock")); err != nil {
-		t.Fatal(err)
-	}
-	a, err := f.ConfigApply(true)
-	if err != nil || !a.Applied {
-		t.Fatalf("%+v %v", a, err)
-	}
-	want := "// Mozilla User Preferences\n" +
-		`user_pref("extensions.activeThemeID", "thunderbird-compact-dark@mozilla.org");` + "\n" +
-		`user_pref("mail.identity.id1.useremail", "someone@example.org");` + "\n" +
-		`user_pref("mail.uidensity", 0);` + "\n"
-	if got := f.read(profileDir + "/prefs.js"); got != want {
-		t.Fatalf("only the drifting lines go:\n%s", got)
-	}
-	said := map[string]Cleared{}
-	for _, c := range a.Clears {
-		said[c.Name] = c
-	}
-	if c := said["mail.spam.manualMark"]; c.Was != "true" || c.Now != "false" {
-		t.Errorf("it says what it cleared and what holds now: %+v", c)
-	}
-	if _, cleared := said["extensions.activeThemeID"]; cleared || len(a.NotCleared) != 1 || !strings.Contains(a.NotCleared[0], "add-on manager") {
-		t.Errorf("the theme is never cleared, and said with its remedy: %+v", a)
-	}
-	raw, _ := json.Marshal(a)
-	if strings.Contains(string(raw), "example.org") {
-		t.Fatalf("no account value leaves: %s", raw)
-	}
-	if c, _ := f.Config(nil); !reflect.DeepEqual(c.Drifting, []string{"extensions.activeThemeID"}) {
-		t.Fatalf("once applied, only the theme drifts, until the add-on manager changes it: %v", c.Drifting)
-	}
-	os.Remove(filepath.Join(f.Root, meshDefaults))
-	if _, err := f.ConfigApply(true); err == nil || !strings.Contains(err.Error(), "not placed") {
-		t.Fatalf("without the module's defaults there is nothing to come back to: %v", err)
-	}
-}
-
-// T6: keeping a value on one node is that node's layer of the setting prefs proposed through the controller, one
-// entry per preference beside what the layer holds (issue 586), never a write to user.js.
-func TestKeepProposesANodeLayerThroughTheController(t *testing.T) {
-	f := newFake(t)
-	f.betterbird()
-	f.placedByTheMesh()
-	f.withDefaults()
-	f.betterbirdsOwn()
-	links(t, nil)
-	f.declare(`user_pref("calendar.alarms.playsound", false); user_pref("mail.uifontsize", 12);`)
-	f.write(profileDir+"/prefs.js", `user_pref("mail.uifontsize", 16);`+"\n"+`user_pref("mail.spam.manualMark", true);`+"\n")
-	oldNode, oldAsk := nodeName, asker
-	t.Cleanup(func() { nodeName, asker = oldNode, oldAsk })
-	nodeName = func() string { return "shanks" }
-	var asked []map[string]any
-	asker = func(v string, a any) (json.RawMessage, error) {
-		args := a.(map[string]any)
-		asked = append(asked, args)
-		if args["propose"] == nil {
-			return json.RawMessage(`{"ok": true, "output": "{\"prefs\": {\"calendar.alarms.playsound\": false}, \"identities\": {\"mail\": {\"account\": \"mail\"}}}\n  set at the terminal\nbetterbird on shanks, every value"}`), nil
-		}
-		return json.RawMessage(`{"ok": true, "output": "proposed: p-1"}`), nil
-	}
-	before := f.read(testHome + "/" + prefsFile)
-	c, err := f.Config([]string{"mail.uifontsize", "mail.spam.manualMark"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(asked) != 2 || asked[0]["node"] != "shanks" || asked[1]["node"] != "shanks" || asked[1]["propose"] != "true" ||
-		asked[1]["module"] != "betterbird" {
-		t.Fatalf("the node's layer read, then proposed: %v", asked)
-	}
-	var values map[string]any
-	if err := json.Unmarshal([]byte(asked[1]["values"].(string)), &values); err != nil {
-		t.Fatal(err)
-	}
-	want := map[string]any{"calendar.alarms.playsound": false, "mail.uifontsize": float64(16), "mail.spam.manualMark": true}
-	if !reflect.DeepEqual(values["prefs"], want) || values["identities"] == nil {
-		t.Fatalf("the layer as it stands with the kept values, one entry each:\n got %v\nwant %v", values, want)
-	}
-	if c.Proposed != "proposed: p-1" || f.read(testHome+"/"+prefsFile) != before {
-		t.Fatalf("proposed, and nothing written: %+v", c)
-	}
-	for _, bad := range [][]string{{"mailnews.start_page.enabled"}, {"some.other.pref"}, {"calendar.alarms.playsound"}} {
-		asked = nil
-		if _, err := f.Config(bad); err == nil || len(asked) != 0 {
-			t.Errorf("%v: a lock, an unmanaged name or a value the profile did not save is refused: %v", bad, err)
-		}
-	}
-	nodeName = func() string { return "" }
-	if _, err := f.Config([]string{"mail.uifontsize"}); err == nil || !strings.Contains(err.Error(), "MESH_NODE") {
-		t.Fatalf("%v", err)
-	}
-}
-
-// The review of pull request 253: whether Betterbird asks to be the default client is decided from the policy's
-// own Preferences entry, never from what else the policy lacks.
-func TestTheDefaultClientAskIsDecidedFromThePreferencesEntry(t *testing.T) {
-	f := newFake(t)
-	f.betterbird()
-	f.placedByTheMesh()
-	links(t, nil)
-	f.write(policyFile, `{"policies": {"ExtensionSettings": {}}}`)
-	if why := f.defaultClientAsk(filepath.Join(f.Root, profileDir)); why == "" {
-		t.Fatal("a policy lacking the updater and the lock still asks")
-	}
-	f.write(policyFile, `{"policies": {"Preferences": {"mail.shell.checkDefaultClient": {"Value": false, "Status": "locked"}}}}`)
-	if why := f.defaultClientAsk(filepath.Join(f.Root, profileDir)); why != "" {
-		t.Fatalf("the lock holds whatever else the policy lacks: %s", why)
-	}
-}
-
-// The review of pull request 256: the theme is the add-on database's, and a saved default is not drift.
-func TestTheThemeIsTheAddOnDatabasesAndASavedDefaultIsNotDrift(t *testing.T) {
-	f := newFake(t)
-	f.betterbird()
-	f.placedByTheMesh()
-	f.withDefaults()
-	links(t, nil)
-	f.write(profileDir+"/prefs.js", `user_pref("browser.display.use_system_colors", false);`+"\n"+
-		`user_pref("layout.css.always_underline_links", false);`+"\n")
-	f.write(profileDir+"/extensions.json", `{"addons":[{"id":"thunderbird-compact-dark@mozilla.org","type":"theme","active":true,"location":"app-builtin"},`+
-		`{"id":"default-theme@mozilla.org","type":"theme","active":false,"location":"app-builtin"}]}`)
-	c, err := f.Config(nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !reflect.DeepEqual(c.Drifting, []string{"extensions.activeThemeID"}) {
-		t.Fatalf("the active theme from the add-on database, with no preference saved, is drift; a saved default is not: %v", c.Drifting)
-	}
-	f.write(profileDir+"/prefs.js", `user_pref("extensions.activeThemeID", "default-theme@mozilla.org");`+"\n")
-	f.write(profileDir+"/extensions.json", `{"addons":[{"id":"default-theme@mozilla.org","type":"theme","active":true,"location":"app-builtin"}]}`)
-	if c, _ := f.Config(nil); len(c.Drifting) != 0 {
-		t.Fatalf("a profile back on the default theme does not drift: %v", c.Drifting)
-	}
-	if _, err := f.Config([]string{"extensions.activeThemeID"}); err == nil || !strings.Contains(err.Error(), "add-on manager") {
-		t.Fatalf("a node layer cannot choose the theme: %v", err)
-	}
-}
-
-// The review of pull request 256: a credential's or an account's name in the defaults file is never managed.
-func TestAnAccountsNameInTheDefaultsIsNeverManaged(t *testing.T) {
-	f := newFake(t)
-	f.betterbird()
-	f.placedByTheMesh()
-	links(t, nil)
-	f.write(meshDefaults, string(repoFile(t, "install/defaults-pref/mesh-defaults.js"))+
-		`pref("mail.identity.id1.useremail", "x");`+"\n"+"// keeps Betterbird's default: mail.server.server1.hostname\n"+
-		`pref("mail.smtpservers", "");`+"\n")
-	prefs := `user_pref("mail.identity.id1.useremail", "someone@example.org");` + "\n" +
-		`user_pref("mail.server.server1.hostname", "imap.example.org");` + "\n" +
-		`user_pref("mail.smtpservers", "smtp1");` + "\n"
-	f.write(profileDir+"/prefs.js", prefs)
-	c, err := f.Config(nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(c.Refused) != 3 || len(c.Drifting) != 0 {
-		t.Fatalf("refused, never managed: %+v", c)
-	}
-	raw, _ := json.Marshal(c)
-	if strings.Contains(string(raw), "example.org") {
-		t.Fatalf("no account value is answered: %s", raw)
-	}
-	stopBetterbird(t, f)
-	if _, err := f.ConfigApply(true); err != nil {
-		t.Fatal(err)
-	}
-	if f.read(profileDir+"/prefs.js") != prefs {
-		t.Fatal("prefs.js keeps every account's value")
-	}
-	ch, _ := f.Check()
-	found := false
-	for _, x := range ch.Findings {
-		found = found || (strings.Contains(x.What, "3 preference(s) the tools never manage") && strings.Contains(x.Do, "mesh-defaults.js"))
-	}
-	if !found {
-		t.Fatalf("the check says so: %+v", ch.Findings)
-	}
-}

modules/betterbird/cmd/betterbird-tools/configuration.go

@@ -1,472 +0,0 @@
-package main
-
-// Betterbird's whole configuration, beside the accounts (novox/hq ADR 0329 §4–§6, issue 586).
-//
-// Five settings, each mesh-wide with a node's layer over it, reach the machine as two files the node-engine
-// merges from the module's layers key by key:
-//
-//   - ~/.config/betterbird/configuration.json: identities, calendars, address-books and filters, trusted as
-//     accounts is (§5), because each names where a password, a reply or forwarded mail goes;
-//   - ~/.config/betterbird/tags.json: tags, which names no server and sends no mail; trusted too since issue 751,
-//     so a change to it is the operator's to approve.
-//
-// An entry is keyed by a name of the operator's (lower-case letters and digits, as an account's), a tag by its
-// own key. A node's layer may set an entry to null to take it out on that node, and may give an identity, a
-// calendar or an address book its `key`: the profile's key to adopt there (§4, §7). No value holds a password,
-// a token or a cookie: a key shaped like one is refused whole, and so is an address whose user part carries a
-// password (§2). A setting holds no line break (novox/hq issue 339), so a signature is a list of its lines.
-
-import (
-	"bytes"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"net/url"
-	"os"
-	"regexp"
-	"sort"
-	"strings"
-)
-
-const (
-	// configurationFile holds identities, calendars, address-books and filters; tagsFile holds tags.
-	configurationFile = ".config/betterbird/configuration.json"
-	tagsFile          = ".config/betterbird/tags.json"
-)
-
-// The five kinds, in the order the tools answer them.
-const (
-	kindIdentities   = "identities"
-	kindCalendars    = "calendars"
-	kindAddressBooks = "address-books"
-	kindFilters      = "filters"
-	kindTags         = "tags"
-)
-
-var allKinds = []string{kindIdentities, kindCalendars, kindAddressBooks, kindFilters, kindTags}
-
-// Identity is one identity of a declared account. The account's default identity is the entry that gives no
-// address: its name and address are the ones the setting accounts gives (§4). Any other entry is another
-// identity of that account, matched by its address.
-type Identity struct {
-	Account      string `json:"account"`
-	Address      string `json:"address,omitempty"`
-	Name         string `json:"name,omitempty"`
-	ReplyTo      string `json:"reply-to,omitempty"`
-	Organization string `json:"organization,omitempty"`
-	// Signature is the signature's text, a line to an element.
-	Signature     []string `json:"signature,omitempty"`
-	SignatureHTML bool     `json:"signature-html,omitempty"`
-	// SignatureAboveQuote puts the reply and its signature above the quoted message (Betterbird's "start my
-	// reply above the quote", signature below the reply); false is below the quote.
-	SignatureAboveQuote bool   `json:"signature-above-quote,omitempty"`
-	Key                 string `json:"key,omitempty"`
-}
-
-// Calendar is one CalDAV calendar.
-type Calendar struct {
-	Name     string `json:"name"`
-	URL      string `json:"url"`
-	Color    string `json:"color,omitempty"`
-	ReadOnly bool   `json:"read-only,omitempty"`
-	// Reminders absent is on.
-	Reminders *bool  `json:"reminders,omitempty"`
-	User      string `json:"user,omitempty"`
-	// Invitations is the identities entry whose address answers invitations; absent, none.
-	Invitations string `json:"invitations,omitempty"`
-	Key         string `json:"key,omitempty"`
-}
-
-// AddressBook is one CardDAV address book.
-type AddressBook struct {
-	Name string `json:"name"`
-	URL  string `json:"url"`
-	User string `json:"user,omitempty"`
-	Key  string `json:"key,omitempty"`
-}
-
-// Tag is one tag, keyed in the setting by its own key.
-type Tag struct {
-	Name  string `json:"name"`
-	Color string `json:"color,omitempty"`
-	// Order is its place among the tags, from 1.
-	Order int `json:"order,omitempty"`
-}
-
-// Filter is one message filter of an account, in its place in the account's list.
-type Filter struct {
-	Name    string `json:"name"`
-	Enabled bool   `json:"enabled"`
-	// When it runs: new-mail, manual, after-junk, sending, archiving, periodic.
-	When []string `json:"when"`
-	// Match is all (every condition holds), any (one does) or every-message (no condition).
-	Match      string      `json:"match"`
-	Conditions []Condition `json:"conditions,omitempty"`
-	Actions    []Action    `json:"actions"`
-}
-
-// Condition is one of a filter's conditions, in Betterbird's own words: a field, an operator, a value.
-type Condition struct {
-	Field string `json:"field"`
-	Op    string `json:"op"`
-	Value string `json:"value,omitempty"`
-}
-
-// Action is one of a filter's actions, in Betterbird's own words. A folder is named by its path within the
-// account (INBOX/Receipts), and becomes that folder's address on each node (§8).
-type Action struct {
-	Action string `json:"action"`
-	Folder string `json:"folder,omitempty"`
-	Value  string `json:"value,omitempty"`
-}
-
-// Configuration is the five settings as the machine has them.
-type Configuration struct {
-	Identities   map[string]*Identity    `json:"identities,omitempty"`
-	Calendars    map[string]*Calendar    `json:"calendars,omitempty"`
-	AddressBooks map[string]*AddressBook `json:"address-books,omitempty"`
-	Filters      map[string][]Filter     `json:"filters,omitempty"`
-	Tags         map[string]*Tag         `json:"tags,omitempty"`
-}
-
-var (
-	entryName = regexp.MustCompile(`^[a-z][a-z0-9]{0,30}$`)
-	tagKey    = regexp.MustCompile(`^[$A-Za-z0-9_.\-]{1,64}$`)
-	colorWord = regexp.MustCompile(`^#[0-9A-Fa-f]{6}$`)
-	// secretName is a field's name that says it holds a credential: such a field is withheld from every answer (§2).
-	secretName = regexp.MustCompile(`(?i)(password|passwd|token|secret|cookie)`)
-	// userPassword is an address whose user part carries a password: scheme://user:password@host.
-	userPassword = regexp.MustCompile(`(?i)\b([a-z][a-z0-9+.\-]*://[^/:@\s]*):[^@/\s]+@`)
-)
-
-// The words a filter is written in.
-var (
-	filterWhen = map[string]int{"new-mail": 0x1, "manual": 0x10, "after-junk": 0x20, "sending": 0x40,
-		"archiving": 0x80, "periodic": 0x100}
-	filterFields = map[string]bool{"subject": true, "from": true, "to": true, "cc": true, "to or cc": true,
-		"all addresses": true, "body": true, "date": true, "priority": true, "status": true, "age in days": true,
-		"size": true, "tag": true, "junk status": true, "junk percent": true, "junk score origin": true,
-		"has attachment status": true, "date received": true}
-	filterOps = map[string]bool{"contains": true, "doesn't contain": true, "is": true, "isn't": true,
-		"begins with": true, "ends with": true, "is empty": true, "isn't empty": true, "is before": true,
-		"is after": true, "is greater than": true, "is less than": true, "is higher than": true,
-		"is lower than": true, "is in ab": true, "isn't in ab": true, "matches": true, "doesn't match": true}
-	// filterActions are the actions a declared filter may take, and whether each names a folder or a value.
-	filterActions = map[string]string{"Move to folder": "folder", "Copy to folder": "folder",
-		"Change priority": "value", "Delete": "", "Mark read": "", "Mark unread": "", "Mark flagged": "",
-		"Ignore thread": "", "Ignore subthread": "", "Watch thread": "", "AddTag": "value", "JunkScore": "value",
-		"Forward": "value", "Stop execution": "", "Delete from Pop3 server": "", "Leave on Pop3 server": "",
-		"Fetch body from Pop3Server": ""}
-)
-
-// readConfiguration reads the five settings. A missing file holds none of its kinds (the module is older
-// here); a file that carries a key shaped like a credential, an address with a password, an unknown field or a
-// value Betterbird cannot be given is refused whole, naming the entry and never a value.
-func (m *Machine) readConfiguration() (Configuration, error) {
-	var c Configuration
-	var problems []string
-	for _, file := range []string{configurationFile, tagsFile} {
-		raw, err := readBounded(m.home(file))
-		if errors.Is(err, os.ErrNotExist) {
-			continue
-		}
-		if err != nil {
-			return Configuration{}, err
-		}
-		if err := decodeInto(raw, file, &c); err != nil {
-			problems = append(problems, err.Error())
-		}
-	}
-	if len(problems) > 0 {
-		return Configuration{}, errors.New(strings.Join(problems, "; "))
-	}
-	if p := configurationProblems(c); len(p) > 0 {
-		return Configuration{}, fmt.Errorf("the configuration is refused: %s", strings.Join(p, "; "))
-	}
-	c.dropNulls()
-	for _, cal := range c.Calendars {
-		cal.Color = strings.ToLower(cal.Color)
-	}
-	for _, t := range c.Tags {
-		t.Color = strings.ToUpper(t.Color)
-	}
-	return c, nil
-}
-
-// decodeInto reads one settings file into c, refusing a credential-shaped key or an unknown field.
-func decodeInto(raw []byte, file string, c *Configuration) error {
-	var tree any
-	if err := json.Unmarshal(raw, &tree); err != nil {
-		return fmt.Errorf("~/%s is not JSON: %v", file, err)
-	}
-	if where := secretKeyIn(tree, ""); where != "" {
-		return fmt.Errorf("~/%s carries %s, a key shaped like a credential: the configuration is declared without "+
-			"any password, token or cookie (novox/hq ADR 0329 §2); take it out at the controller's terminal", file, where)
-	}
-	dec := json.NewDecoder(bytes.NewReader(raw))
-	dec.DisallowUnknownFields()
-	var into Configuration
-	if err := dec.Decode(&into); err != nil {
-		return fmt.Errorf("~/%s does not hold the shape of the settings it takes: %v", file, err)
-	}
-	if file == tagsFile {
-		if into.Identities != nil || into.Calendars != nil || into.AddressBooks != nil || into.Filters != nil {
-			return fmt.Errorf("~/%s holds only tags", file)
-		}
-		c.Tags = into.Tags
-		return nil
-	}
-	if into.Tags != nil {
-		return fmt.Errorf("~/%s holds no tags: tags are their own setting", file)
-	}
-	c.Identities, c.Calendars, c.AddressBooks, c.Filters = into.Identities, into.Calendars, into.AddressBooks, into.Filters
-	return nil
-}
-
-// dropNulls takes out the entries a node's layer set to null: not on this node.
-func (c *Configuration) dropNulls() {
-	for k, v := range c.Identities {
-		if v == nil {
-			delete(c.Identities, k)
-		}
-	}
-	for k, v := range c.Calendars {
-		if v == nil {
-			delete(c.Calendars, k)
-		}
-	}
-	for k, v := range c.AddressBooks {
-		if v == nil {
-			delete(c.AddressBooks, k)
-		}
-	}
-	for k, v := range c.Filters {
-		if v == nil {
-			delete(c.Filters, k)
-		}
-	}
-	for k, v := range c.Tags {
-		if v == nil {
-			delete(c.Tags, k)
-		}
-	}
-}
-
-// addressPassword says whether an address carries a password in its user part.
-func addressPassword(s string) bool {
-	if userPassword.MatchString(s) {
-		return true
-	}
-	if u, err := url.Parse(s); err == nil && u.User != nil {
-		_, has := u.User.Password()
-		return has
-	}
-	return false
-}
-
-// withoutPassword is an address with the password of its user part as ‹withheld› (§2).
-func withoutPassword(s string) string {
-	return userPassword.ReplaceAllString(s, "${1}:‹withheld›@")
-}
-
-// davURL says what is wrong with a calendar's or an address book's address, or "".
-func davURL(s string) string {
-	if addressPassword(s) {
-		return "its address carries a password in its user part, which no setting holds (novox/hq ADR 0329 §2): " +
-			"Betterbird asks for the password at the first sign-in"
-	}
-	u, err := url.Parse(s)
-	if err != nil || (u.Scheme != "https" && u.Scheme != "http") || u.Host == "" {
-		return "its address is an https:// (or http://) address of the server"
-	}
-	if strings.ContainsAny(s, lineEnds+`"\`) {
-		return "its address holds a quote, a backslash or a line break"
-	}
-	return ""
-}
-
-// configurationProblems is everything wrong with the five settings, each said by its kind and entry name.
-func configurationProblems(c Configuration) []string {
-	var out []string
-	say := func(kind, name, format string, args ...any) {
-		out = append(out, fmt.Sprintf("%s %s: ", kind, name)+fmt.Sprintf(format, args...))
-	}
-	text := func(kind, name, field, v string) {
-		if !plainText.MatchString(v) {
-			say(kind, name, "%s holds a quote, a backslash or a line break", field)
-		}
-	}
-	for _, name := range sortedKeys(c.Identities) {
-		id := c.Identities[name]
-		if id == nil {
-			continue
-		}
-		if !entryName.MatchString(name) {
-			say(kindIdentities, name, "a name is lower-case letters and digits, starting with a letter")
-		}
-		if !accountName.MatchString(id.Account) {
-			say(kindIdentities, name, "account names an entry of the setting accounts")
-		}
-		if id.Address == "" && id.Name != "" {
-			say(kindIdentities, name, "the account's default identity (no address) takes its name from the setting accounts")
-		}
-		if id.Address != "" && !addressShape.MatchString(id.Address) {
-			say(kindIdentities, name, "the address is not a mail address")
-		}
-		if id.ReplyTo != "" && !addressShape.MatchString(id.ReplyTo) {
-			say(kindIdentities, name, "reply-to is not a mail address")
-		}
-		for field, v := range map[string]string{"name": id.Name, "organization": id.Organization} {
-			text(kindIdentities, name, field, v)
-		}
-		for _, line := range id.Signature {
-			if strings.ContainsAny(line, lineEnds) {
-				say(kindIdentities, name, "a signature's line holds a line break: each line is its own element")
-				break
-			}
-		}
-		if id.Key != "" && !profileKey.MatchString(id.Key) {
-			say(kindIdentities, name, "key is an identity key of the profile, such as id3")
-		}
-	}
-	for _, name := range sortedKeys(c.Calendars) {
-		cal := c.Calendars[name]
-		if cal == nil {
-			continue
-		}
-		if !entryName.MatchString(name) {
-			say(kindCalendars, name, "a name is lower-case letters and digits, starting with a letter")
-		}
-		if why := davURL(cal.URL); why != "" {
-			say(kindCalendars, name, "%s", why)
-		}
-		if cal.Color != "" && !colorWord.MatchString(cal.Color) {
-			say(kindCalendars, name, "a colour is #rrggbb")
-		}
-		if cal.Invitations != "" && c.Identities[cal.Invitations] == nil {
-			say(kindCalendars, name, "invitations names %s, which the setting identities does not hold", cal.Invitations)
-		}
-		text(kindCalendars, name, "name", cal.Name)
-		text(kindCalendars, name, "user", cal.User)
-		if cal.Key != "" && !tagKey.MatchString(cal.Key) {
-			say(kindCalendars, name, "key is a calendar key of the profile")
-		}
-	}
-	for _, name := range sortedKeys(c.AddressBooks) {
-		ab := c.AddressBooks[name]
-		if ab == nil {
-			continue
-		}
-		if !entryName.MatchString(name) {
-			say(kindAddressBooks, name, "a name is lower-case letters and digits, starting with a letter")
-		}
-		if why := davURL(ab.URL); why != "" {
-			say(kindAddressBooks, name, "%s", why)
-		}
-		text(kindAddressBooks, name, "name", ab.Name)
-		text(kindAddressBooks, name, "user", ab.User)
-		if ab.Key != "" && !profileKey.MatchString(ab.Key) {
-			say(kindAddressBooks, name, "key is an address book key of the profile")
-		}
-	}
-	for _, key := range sortedKeys(c.Tags) {
-		t := c.Tags[key]
-		if t == nil {
-			continue
-		}
-		if !tagKey.MatchString(key) {
-			say(kindTags, key, "a tag's key is letters, digits, $, _, . or -")
-		}
-		if t.Color != "" && !colorWord.MatchString(t.Color) {
-			say(kindTags, key, "a colour is #rrggbb")
-		}
-		text(kindTags, key, "name", t.Name)
-	}
-	for _, account := range sortedKeys(c.Filters) {
-		if !accountName.MatchString(account) {
-			say(kindFilters, account, "filters are keyed by an account's name in the setting accounts")
-		}
-		for i, f := range c.Filters[account] {
-			for _, p := range filterProblems(f) {
-				say(kindFilters, account, "filter %d: %s", i+1, p)
-			}
-		}
-	}
-	return out
-}
-
-// filterValue is what a filter's name, value or folder may hold: what its file can carry without quoting.
-var filterValue = regexp.MustCompile(`^[^"\\()\n\r]*$`)
-
-func filterProblems(f Filter) []string {
-	var out []string
-	if f.Name == "" || !filterValue.MatchString(f.Name) {
-		out = append(out, "a name, without a quote, a backslash or a parenthesis")
-	}
-	if len(f.When) == 0 {
-		out = append(out, "when says when it runs: new-mail, manual, after-junk, sending, archiving or periodic")
-	}
-	for _, w := range f.When {
-		if _, ok := filterWhen[w]; !ok {
-			out = append(out, fmt.Sprintf("when %q is new-mail, manual, after-junk, sending, archiving or periodic", w))
-		}
-	}
-	switch f.Match {
-	case "all", "any":
-		if len(f.Conditions) == 0 {
-			out = append(out, "match all or any needs a condition")
-		}
-	case "every-message":
-		if len(f.Conditions) > 0 {
-			out = append(out, "match every-message takes no condition")
-		}
-	default:
-		out = append(out, "match is all, any or every-message")
-	}
-	for i, c := range f.Conditions {
-		if !filterFields[c.Field] && !(strings.HasPrefix(c.Field, `"`) && strings.HasSuffix(c.Field, `"`) && len(c.Field) > 2) {
-			out = append(out, fmt.Sprintf("condition %d: the field %q is not one Betterbird filters on", i+1, c.Field))
-		}
-		if !filterOps[c.Op] {
-			out = append(out, fmt.Sprintf("condition %d: the operator %q is not one of Betterbird's", i+1, c.Op))
-		}
-		if !filterValue.MatchString(c.Value) {
-			out = append(out, fmt.Sprintf("condition %d: the value holds a quote, a backslash, a parenthesis or a line break", i+1))
-		}
-	}
-	if len(f.Actions) == 0 {
-		out = append(out, "a filter takes an action")
-	}
-	for i, a := range f.Actions {
-		takes, ok := filterActions[a.Action]
-		switch {
-		case !ok:
-			out = append(out, fmt.Sprintf("action %d: %q is not an action a declared filter takes", i+1, a.Action))
-		case takes == "folder" && (a.Folder == "" || a.Value != ""):
-			out = append(out, fmt.Sprintf("action %d: %s names a folder, by its path within the account", i+1, a.Action))
-		case takes == "value" && (a.Value == "" || a.Folder != ""):
-			out = append(out, fmt.Sprintf("action %d: %s takes a value", i+1, a.Action))
-		case takes == "" && (a.Value != "" || a.Folder != ""):
-			out = append(out, fmt.Sprintf("action %d: %s takes no value", i+1, a.Action))
-		}
-		if !filterValue.MatchString(a.Value) || !filterValue.MatchString(a.Folder) || strings.HasPrefix(a.Folder, "/") ||
-			strings.Contains(a.Folder, "://") {
-			out = append(out, fmt.Sprintf("action %d: a folder is a path within the account, and a value holds no quote, "+
-				"backslash, parenthesis or line break", i+1))
-		}
-		if a.Action == "Forward" && !addressShape.MatchString(a.Value) {
-			out = append(out, fmt.Sprintf("action %d: Forward names a mail address", i+1))
-		}
-	}
-	return out
-}
-
-// sortedFilterAccounts are the accounts filters are declared for.
-func (c Configuration) sortedFilterAccounts() []string {
-	out := make([]string, 0, len(c.Filters))
-	for a := range c.Filters {
-		out = append(out, a)
-	}
-	sort.Strings(out)
-	return out
-}

modules/betterbird/cmd/betterbird-tools/configuration_test.go

@@ -1,518 +0,0 @@
-package main
-
-import (
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"reflect"
-	"strings"
-	"testing"
-)
-
-// Betterbird's whole configuration (novox/hq ADR 0329, issue 586): identities, calendars, address books, filters
-// and tags declared mesh-wide, adopted or created as accounts are, filters owned whole per declared account, what
-// Betterbird rewrites written only while it is closed, derived from the nodes' profiles one layer at a time, and
-// shown with the operator's own values but never a credential.
-
-// profileWithConfiguration adds to profileWithAccounts' profile: account1's directory and signature, CalDAV
-// calendars (one address twice), an ICS and an Owl calendar, a local and a CardDAV address book, two tags, and
-// account1's filter file holding one filter of the person's.
-func (f *fake) profileWithConfiguration() {
-	f.t.Helper()
-	prefs := f.read(profileDir+"/prefs.js") +
-		`user_pref("mail.server.server1.directory-rel", "[ProfD]ImapMail/imap.example.org");` + "\n" +
-		`user_pref("mail.server.server2.directory-rel", "[ProfD]Mail/Local Folders");` + "\n" +
-		`user_pref("mail.identity.id1.htmlSigText", "Regards");` + "\n" +
-		`user_pref("calendar.registry.c1.type", "caldav");` + "\n" +
-		`user_pref("calendar.registry.c1.uri", "https://dav.example.org/cal/home/");` + "\n" +
-		`user_pref("calendar.registry.c1.name", "Home");` + "\n" +
-		`user_pref("calendar.registry.c1.color", "#3366ff");` + "\n" +
-		`user_pref("calendar.registry.c2.type", "caldav");` + "\n" +
-		`user_pref("calendar.registry.c2.uri", "https://dav.example.org/cal/shared/");` + "\n" +
-		`user_pref("calendar.registry.c2.name", "Shared A");` + "\n" +
-		`user_pref("calendar.registry.c3.type", "caldav");` + "\n" +
-		`user_pref("calendar.registry.c3.uri", "https://dav.example.org/cal/shared/");` + "\n" +
-		`user_pref("calendar.registry.c3.name", "Shared B");` + "\n" +
-		`user_pref("calendar.registry.c4.type", "ics");` + "\n" +
-		`user_pref("calendar.registry.c4.uri", "https://feeds.example.org/secret-token-abc.ics");` + "\n" +
-		`user_pref("calendar.registry.c4.name", "Holidays");` + "\n" +
-		`user_pref("calendar.registry.c5.type", "owl");` + "\n" +
-		`user_pref("calendar.registry.c5.uri", "owl://work@corp.example.com/calendar");` + "\n" +
-		`user_pref("calendar.registry.c5.name", "Work");` + "\n" +
-		`user_pref("calendar.list.sortOrder", "c1 c2 c3 c4 c5");` + "\n" +
-		`user_pref("ldap_2.servers.pab.description", "Personal Address Book");` + "\n" +
-		`user_pref("ldap_2.servers.pab.dirType", 101);` + "\n" +
-		`user_pref("ldap_2.servers.ab1.description", "Contacts");` + "\n" +
-		`user_pref("ldap_2.servers.ab1.dirType", 102);` + "\n" +
-		`user_pref("ldap_2.servers.ab1.carddav.url", "https://dav.example.org/card/me/");` + "\n" +
-		`user_pref("ldap_2.servers.ab1.carddav.username", "me");` + "\n" +
-		`user_pref("mailnews.tags.$label1.tag", "Important");` + "\n" +
-		`user_pref("mailnews.tags.$label1.color", "#FF0000");` + "\n" +
-		`user_pref("mailnews.tags.personal.tag", "Personal");` + "\n" +
-		`user_pref("mailnews.tags.personal.color", "#00AA00");` + "\n"
-	f.write(profileDir+"/prefs.js", prefs)
-	f.write(profileDir+"/ImapMail/imap.example.org/"+filterFileName, "version=\"9\"\nlogging=\"no\"\nname=\"Old\"\n"+
-		"enabled=\"yes\"\ntype=\"17\"\naction=\"Mark read\"\ncondition=\"AND (from,contains,news)\"\n")
-	f.write(profileDir+"/Mail/Local Folders/"+filterFileName, "version=\"9\"\nlogging=\"no\"\n")
-	f.write(profileDir+"/calendar-data/cache.sqlite", "events")
-}
-
-const declaredConfiguration = `{
-  "identities": {
-    "mail": {"account": "mail", "signature": ["-- ", "Other"], "signature-above-quote": true},
-    "mailalias": {"account": "mail", "address": "alias@mail.example.org", "name": "Alias", "reply-to": "other@mail.example.org"}
-  },
-  "calendars": {
-    "home": {"name": "Home", "url": "https://dav.example.org/cal/home", "color": "#3366CC", "user": "other", "invitations": "mail"},
-    "work": {"name": "Team", "url": "https://dav.example.org/cal/team/"},
-    "shared": {"name": "Shared", "url": "https://dav.example.org/cal/shared/"}
-  },
-  "address-books": {
-    "contacts": {"name": "Contacts", "url": "https://dav.example.org/card/me/", "user": "other"},
-    "team": {"name": "Team", "url": "https://dav.example.org/card/team/"}
-  },
-  "filters": {}
-}`
-
-const declaredTags = `{"tags": {"$label1": {"name": "Important", "color": "#ff0000", "order": 1}, "todo": {"name": "To do", "color": "#0000ff", "order": 2}}}`
-
-func (f *fake) declareConfiguration(body, tags string) {
-	f.write(testHome+"/"+configurationFile, body)
-	f.write(testHome+"/"+tagsFile, tags)
-}
-
-func entriesBy(u UserJS) map[string]resolvedEntry {
-	out := map[string]resolvedEntry{}
-	for _, e := range u.Configuration {
-		out[e.Kind+"/"+e.Name] = e
-	}
-	return out
-}
-
-// §2, §4, §6: the settings' shapes; a credential, an address with a password, a key on a tag and the four new
-// prefixes in prefs are refused, said without the value.
-func TestTheSettingsRefuseACredentialAPasswordedAddressATagsKeyAndTheirPrefixesInPrefs(t *testing.T) {
-	f := newFake(t)
-	f.declareConfiguration(declaredConfiguration, declaredTags)
-	c, err := f.readConfiguration()
-	if err != nil || len(c.Identities) != 2 || len(c.Calendars) != 3 || len(c.AddressBooks) != 2 || len(c.Tags) != 2 {
-		t.Fatalf("the declared shapes are taken: %+v %v", c, err)
-	}
-	if c.Calendars["home"].Color != "#3366cc" || c.Tags["todo"].Color != "#0000FF" {
-		t.Errorf("colours are said as Betterbird keeps them: %+v %+v", c.Calendars["home"], c.Tags["todo"])
-	}
-	for _, bad := range []struct{ conf, tags, says string }{
-		{`{"calendars": {"home": {"name": "H", "url": "https://dav.example.org/c/", "password": "hunter2"}}}`, `{}`, "shaped like a credential"},
-		{`{"calendars": {"home": {"name": "H", "url": "https://me:hunter2@dav.example.org/c/"}}}`, `{}`, "carries a password"},
-		{`{"address-books": {"b": {"name": "B", "url": "https://me:hunter2@dav.example.org/b/"}}}`, `{}`, "carries a password"},
-		{`{}`, `{"tags": {"todo": {"name": "To do", "key": "x"}}}`, "does not hold the shape"},
-		{`{"tags": {"todo": {"name": "To do"}}}`, `{}`, "holds no tags"},
-		{`{"identities": {"x": {"account": "mail", "name": "Me"}}}`, `{}`, "default identity"},
-		{`{"filters": {"mail": [{"name": "F", "enabled": true, "when": ["manual"], "match": "all", "actions": [{"action": "Delete"}]}]}}`, `{}`, "needs a condition"},
-		{`{"filters": {"mail": [{"name": "F", "enabled": true, "when": ["manual"], "match": "every-message", "actions": [{"action": "Move to folder", "folder": "imap://x@y/INBOX"}]}]}}`, `{}`, "path within the account"},
-	} {
-		f.declareConfiguration(bad.conf, bad.tags)
-		_, err := f.readConfiguration()
-		if err == nil || !strings.Contains(err.Error(), bad.says) || strings.Contains(err.Error(), "hunter2") {
-			t.Errorf("%s %s: %v", bad.conf, bad.tags, err)
-		}
-	}
-	// A key is an identity's, a calendar's or an address book's.
-	f.declareConfiguration(`{"identities": {"x": {"account": "mail", "address": "x@mail.example.org", "key": "id9"}},
-		"calendars": {"c": {"name": "C", "url": "https://dav.example.org/c/", "key": "c9"}},
-		"address-books": {"b": {"name": "B", "url": "https://dav.example.org/b/", "key": "ab9"}}}`, `{}`)
-	if _, err := f.readConfiguration(); err != nil {
-		t.Fatal(err)
-	}
-	// prefs refuses the four prefixes the new settings own, and the account's and a credential's as before.
-	for _, name := range []string{"calendar.registry.c1.color", "calendar.list.sortOrder", "ldap_2.servers.ab1.description",
-		"mailnews.tags.$label1.color", "mail.identity.id1.htmlSigText", "signon.rememberSignons"} {
-		body, _ := json.Marshal(map[string]any{"prefs": map[string]any{name: "x"}})
-		if _, err := parseDeclaredPrefs(body); err == nil || !strings.Contains(err.Error(), name) {
-			t.Errorf("%s: %v", name, err)
-		}
-	}
-	got, err := parseDeclaredPrefs([]byte(`{"prefs": {"mail.uifontsize": 14, "mail.chat.enabled": false, "calendar.alarms.show": null,
-		"intl.date_time.pattern_override.date_short": "yyyy-MM-dd"}}`))
-	if err != nil || !reflect.DeepEqual(got, map[string]string{"mail.uifontsize": "14", "mail.chat.enabled": "false",
-		"intl.date_time.pattern_override.date_short": `"yyyy-MM-dd"`}) {
-		t.Fatalf("one entry per preference, null taking one out: %v %v", got, err)
-	}
-	if _, err := parseDeclaredPrefs([]byte(`{"prefs": {"mail.uifontsize": 14.5}}`)); err == nil {
-		t.Fatal("a number Betterbird does not keep is refused")
-	}
-}
-
-// §7, §9: each kind is adopted, created or refused as accounts are; the declared fields go into the user.js, and
-// what Betterbird rewrites waits for it to close; leaving the setting releases or removes, never events.
-func TestEachKindIsAdoptedOrCreatedAndWhatBetterbirdRewritesWaitsForItToClose(t *testing.T) {
-	f := newFake(t)
-	f.profileWithAccounts()
-	f.profileWithConfiguration()
-	f.noPackage()
-	links(t, nil)
-	f.declare("// none")
-	f.declareAccounts(adoptable)
-	f.declareConfiguration(declaredConfiguration, declaredTags)
-	before := f.read(profileDir + "/prefs.js")
-
-	// Betterbird runs: the user.js is placed, prefs.js and the filter files wait (§9).
-	u, err := f.userJS(true)
-	if err != nil {
-		t.Fatal(err)
-	}
-	by := entriesBy(u)
-	for want, how := range map[string][2]string{
-		"identities/mail": {adopted, "id1"}, "identities/mailalias": {created, "ident_mesh_mailalias"},
-		"calendars/home": {adopted, "c1"}, "calendars/work": {created, "mesh_work"}, "calendars/shared": {refused, ""},
-		"address-books/contacts": {adopted, "ab1"}, "address-books/team": {created, "mesh_team"},
-		"tags/$label1": {adopted, "$label1"}, "tags/todo": {created, "todo"},
-	} {
-		if e := by[want]; e.How != how[0] || e.Key != how[1] {
-			t.Errorf("%s: %+v, want %v", want, e, how)
-		}
-	}
-	if why := by["calendars/shared"].Why; !strings.Contains(why, "2 entries") || !strings.Contains(why, "c2, c3") ||
-		!strings.Contains(why, "key in this node's layer") {
-		t.Errorf("an ambiguous match is refused with the keys and the remedy: %s", why)
-	}
-	placed := f.read(profileDir + "/user.js")
-	for _, want := range []string{
-		`user_pref("mail.identity.id1.htmlSigText", "-- \nOther");`,
-		`user_pref("mail.identity.id1.reply_on_top", 1);`,
-		`user_pref("mail.identity.id1.sig_bottom", false);`,
-		`user_pref("mail.identity.ident_mesh_mailalias.useremail", "alias@mail.example.org");`,
-		`user_pref("mail.identity.ident_mesh_mailalias.smtpServer", "smtp1");`,
-		`user_pref("calendar.registry.c1.color", "#3366cc");`,
-		`user_pref("calendar.registry.c1.imip.identity.key", "id1");`,
-		`user_pref("calendar.registry.mesh_work.type", "caldav");`,
-		`user_pref("ldap_2.servers.ab1.carddav.username", "other");`,
-		`user_pref("ldap_2.servers.mesh_team.dirType", 102);`,
-		`user_pref("mailnews.tags.todo.color", "#0000FF");`,
-		`user_pref("mailnews.tags.todo.ordinal", "1002");`,
-	} {
-		if !strings.Contains(placed, want) {
-			t.Errorf("the user.js lacks %s", want)
-		}
-	}
-	for _, never := range []string{"calendar.registry.c2.", "calendar.registry.c3.", "calendar.registry.c4.", "calendar.registry.c5.",
-		"ldap_2.servers.pab.", "mailnews.tags.personal.", "calendar.list.sortOrder"} {
-		if strings.Contains(placed, never) {
-			t.Errorf("the user.js writes %s, which nothing declares or which is refused", never)
-		}
-	}
-	if !strings.HasPrefix(u.Closed, "not written") || !strings.Contains(u.Closed, "running") ||
-		u.Waiting[kindIdentities] != 1 || u.Waiting[kindCalendars] != 1 {
-		t.Fatalf("while Betterbird runs prefs.js is not written, and the waiting changes are counted: %q %v", u.Closed, u.Waiting)
-	}
-	if f.read(profileDir+"/prefs.js") != before {
-		t.Fatal("prefs.js changed while Betterbird runs")
-	}
-	ch, _ := f.Check()
-	waits := false
-	for _, x := range ch.Findings {
-		waits = waits || (strings.Contains(x.What, "change(s) to calendars are not written yet") && strings.Contains(x.Do, "betterbird_restart"))
-	}
-	if !waits {
-		t.Fatalf("the check counts the waiting changes per kind: %+v", ch.Findings)
-	}
-
-	// A key in the node's layer settles the ambiguous calendar; one the profile does not hold is refused.
-	f.declareConfiguration(strings.Replace(declaredConfiguration, `"url": "https://dav.example.org/cal/shared/"}`,
-		`"url": "https://dav.example.org/cal/shared/", "key": "c3"}`, 1), declaredTags)
-	if u, _ = f.userJS(false); entriesBy(u)["calendars/shared"].Key != "c3" || entriesBy(u)["calendars/shared"].How != adopted {
-		t.Fatalf("the named key is adopted: %+v", entriesBy(u)["calendars/shared"])
-	}
-	f.declareConfiguration(strings.Replace(declaredConfiguration, `"url": "https://dav.example.org/cal/shared/"}`,
-		`"url": "https://dav.example.org/cal/shared/", "key": "c9"}`, 1), declaredTags)
-	if u, _ = f.userJS(false); entriesBy(u)["calendars/shared"].How != refused || !strings.Contains(entriesBy(u)["calendars/shared"].Why, "c9") {
-		t.Fatalf("a key the profile does not hold is refused: %+v", entriesBy(u)["calendars/shared"])
-	}
-	f.declareConfiguration(strings.Replace(declaredConfiguration, `"url": "https://dav.example.org/cal/shared/"}`,
-		`"url": "https://dav.example.org/cal/shared/", "key": "c1"}`, 1), declaredTags)
-	if u, _ = f.userJS(false); entriesBy(u)["calendars/shared"].How != refused {
-		t.Fatalf("a key whose entry does not match is refused: %+v", entriesBy(u)["calendars/shared"])
-	}
-	f.declareConfiguration(declaredConfiguration, declaredTags)
-
-	// Closed: the lists gain the module's own keys at their end, every other line as it was.
-	stopBetterbird(t, f)
-	f.write(profileDir+"/lock", "")
-	if err := f.Prepare(); err == nil || !strings.Contains(err.Error(), "locked") {
-		t.Fatalf("the profile's lock holds the writes back: %v", err)
-	}
-	os.Remove(filepath.Join(f.Root, profileDir, "lock"))
-	if err := f.Prepare(); err != nil && !strings.Contains(err.Error(), "calendars shared is refused") {
-		t.Fatal(err)
-	}
-	after := f.read(profileDir + "/prefs.js")
-	for _, want := range []string{`user_pref("mail.account.account1.identities", "id1,ident_mesh_mailalias");`,
-		`user_pref("calendar.list.sortOrder", "c1 c2 c3 c4 c5 mesh_work");`} {
-		if !strings.Contains(after, want) {
-			t.Errorf("prefs.js lacks %s:\n%s", want, after)
-		}
-	}
-	bl, al := strings.Split(before, "\n"), strings.Split(after, "\n")
-	for i := range bl {
-		if bl[i] != al[i] && !strings.Contains(bl[i], ".identities") && !strings.Contains(bl[i], "sortOrder") {
-			t.Errorf("line %d changed: %q to %q", i+1, bl[i], al[i])
-		}
-	}
-
-	// Leaving: an adopted entry is released (its lines go, the profile keeps it), a created one's preferences are
-	// removed; the calendar's events stay.
-	f.write(profileDir+"/prefs.js", f.read(profileDir+"/prefs.js")+
-		`user_pref("calendar.registry.mesh_work.calendarSyncState", "x");`+"\n"+`user_pref("mailnews.tags.todo.tag", "To do");`+"\n")
-	f.declareConfiguration(`{"identities": {"mail": {"account": "mail"}}}`, `{"tags": {}}`)
-	if err := f.Prepare(); err != nil {
-		t.Fatal(err)
-	}
-	final := f.read(profileDir + "/prefs.js")
-	for _, gone := range []string{"mesh_work", "ident_mesh_mailalias", "mailnews.tags.todo."} {
-		if strings.Contains(final, gone) {
-			t.Errorf("what the module created and the setting left is removed: %s is still there", gone)
-		}
-	}
-	for _, kept := range []string{`calendar.registry.c1.uri`, `ldap_2.servers.ab1.carddav.url`, `mailnews.tags.$label1.tag`,
-		`calendar.registry.c4.uri`} {
-		if !strings.Contains(final, kept) {
-			t.Errorf("released or undeclared, %s stays the person's", kept)
-		}
-	}
-	if f.read(profileDir+"/calendar-data/cache.sqlite") != "events" {
-		t.Error("a calendar's events are never touched")
-	}
-	if placed := f.read(profileDir + "/user.js"); strings.Contains(placed, "calendar.registry.c1.") || strings.Contains(placed, "ab1") {
-		t.Errorf("a released entry's lines leave the user.js:\n%s", placed)
-	}
-}
-
-const declaredFilters = `{"filters": {"mail": [
-  {"name": "Receipts", "enabled": true, "when": ["new-mail", "manual"], "match": "all",
-   "conditions": [{"field": "subject", "op": "contains", "value": "receipt"}],
-   "actions": [{"action": "Move to folder", "folder": "INBOX/Receipts"}, {"action": "Forward", "value": "archive@mail.example.org"}]},
-  {"name": "Everything", "enabled": false, "when": ["manual"], "match": "every-message", "actions": [{"action": "Mark read"}]}
-]}}`
-
-const renderedFilters = "version=\"9\"\nlogging=\"no\"\n" +
-	"name=\"Receipts\"\nenabled=\"yes\"\ntype=\"17\"\naction=\"Move to folder\"\n" +
-	"actionValue=\"imap://other2@imap.example.org/INBOX/Receipts\"\naction=\"Forward\"\nactionValue=\"archive@mail.example.org\"\n" +
-	"condition=\"AND (subject,contains,receipt)\"\n" +
-	"name=\"Everything\"\nenabled=\"no\"\ntype=\"16\"\naction=\"Mark read\"\ncondition=\"ALL\"\n"
-
-// §8: an account named in filters has its msgFilterRules.dat written whole from the list, the replaced file kept;
-// an account never named keeps its file byte for byte; one taken out keeps the file it last had.
-func TestFiltersAreOwnedWholePerDeclaredAccount(t *testing.T) {
-	f := newFake(t)
-	f.profileWithAccounts()
-	f.profileWithConfiguration()
-	f.noPackage()
-	links(t, nil)
-	f.declare("// none")
-	f.declareAccounts(adoptable)
-	f.declareConfiguration(declaredFilters, `{"tags": {}}`)
-	filters := profileDir + "/ImapMail/imap.example.org/" + filterFileName
-	local := profileDir + "/Mail/Local Folders/" + filterFileName
-	old, oldLocal := f.read(filters), f.read(local)
-
-	u, err := f.userJS(true)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if u.Waiting[kindFilters] != 1 || f.read(filters) != old {
-		t.Fatalf("while Betterbird runs the filter file waits: %v", u.Waiting)
-	}
-	stopBetterbird(t, f)
-	if err := f.Prepare(); err != nil {
-		t.Fatal(err)
-	}
-	if got := f.read(filters); got != renderedFilters {
-		t.Fatalf("the file is the declared list, its folder this node's address:\n%s", got)
-	}
-	keptPath := testHome + "/.config/betterbird/kept/60016jsp.default-default/mail." + filterFileName
-	if f.read(keptPath) != old {
-		t.Fatal("the replaced file is kept in the module's own directory")
-	}
-	if f.read(local) != oldLocal {
-		t.Fatal("an account never named keeps its file byte for byte")
-	}
-	if parsed := parseFilters(renderedFilters, "imap://other2@imap.example.org"); len(parsed.NotDeclarable) != 0 ||
-		mustJSON(parsed.Filters) != mustJSON(mustConfig(t, declaredFilters).Filters["mail"]) {
-		t.Fatalf("the file reads back as the declared list: %+v", parsed)
-	}
-
-	// A filter the person adds in Betterbird is drift first, and gone at the next apply; the kept file stays the first.
-	f.write(filters, renderedFilters+"name=\"Mine\"\nenabled=\"yes\"\ntype=\"16\"\naction=\"Delete\"\ncondition=\"ALL\"\n")
-	d, _ := f.Drift(kindFilters)
-	if len(d.Kinds) != 1 || len(d.Kinds[0].Declared) != 1 || d.Kinds[0].Declared[0].State != "differs" ||
-		!strings.Contains(mustJSON(d.Kinds[0].Declared[0].Differs), "Mine") {
-		t.Fatalf("drift shows the added filter: %+v", d)
-	}
-	if err := f.Prepare(); err != nil {
-		t.Fatal(err)
-	}
-	if f.read(filters) != renderedFilters || f.read(keptPath) != old {
-		t.Fatal("the added filter is gone, and the kept file is still the one first replaced")
-	}
-
-	// Taken out of filters: the module stops writing, the last file stays the person's, the kept copy is named.
-	f.declareConfiguration(`{"filters": {}}`, `{"tags": {}}`)
-	f.write(filters, renderedFilters+"name=\"Later\"\nenabled=\"yes\"\ntype=\"16\"\naction=\"Delete\"\ncondition=\"ALL\"\n")
-	lastHad := f.read(filters)
-	if err := f.Prepare(); err != nil {
-		t.Fatal(err)
-	}
-	if f.read(filters) != lastHad || f.read(keptPath) != old {
-		t.Fatal("an account taken out keeps its file byte for byte, and the kept copy stays")
-	}
-	l, _ := f.List(kindFilters)
-	if l.Kept["mail"] != "~/.config/betterbird/kept/60016jsp.default-default/mail."+filterFileName {
-		t.Fatalf("betterbird_filters says where the kept copy is: %+v", l.Kept)
-	}
-	d, _ = f.Drift(kindFilters)
-	if len(d.Kinds[0].Declared) != 0 || len(d.Kinds[0].Undeclared) != 0 {
-		t.Fatalf("drift no longer counts that account's filters: %+v", d.Kinds[0])
-	}
-}
-
-func mustConfig(t *testing.T, body string) Configuration {
-	t.Helper()
-	var c Configuration
-	if err := decodeInto([]byte(body), configurationFile, &c); err != nil {
-		t.Fatal(err)
-	}
-	return c
-}
-
-// §11: per kind and entry, the field that differs with both values; an undeclared entry is listed; once the module's
-// user.js is placed, what it declares holds.
-func TestDriftNamesEachDifferingFieldAndTheUndeclaredEntries(t *testing.T) {
-	f := newFake(t)
-	f.profileWithAccounts()
-	f.profileWithConfiguration()
-	f.noPackage()
-	links(t, nil)
-	f.declare("// none")
-	f.declareAccounts(adoptable)
-	f.declareConfiguration(strings.Replace(declaredConfiguration, `"work": {"name": "Team", "url": "https://dav.example.org/cal/team/"},`, "", 1), declaredTags)
-	d, err := f.Drift("")
-	if err != nil {
-		t.Fatal(err)
-	}
-	by := map[string]KindDrift{}
-	for _, k := range d.Kinds {
-		by[k.Kind] = k
-	}
-	field := func(kind, name, f string) *fieldDiff {
-		for _, e := range by[kind].Declared {
-			if e.Name == name {
-				for _, x := range e.Differs {
-					if x.Field == f {
-						return &x
-					}
-				}
-			}
-		}
-		return nil
-	}
-	if x := field(kindIdentities, "mail", "signature"); x == nil || mustJSON(x.Profile) != `["Regards"]` {
-		t.Errorf("the signature differs, with both values: %+v", by[kindIdentities])
-	}
-	if x := field(kindCalendars, "home", "color"); x == nil || x.Declared != "#3366cc" || x.Profile != "#3366ff" {
-		t.Errorf("the colour differs: %+v", by[kindCalendars])
-	}
-	if x := field(kindAddressBooks, "contacts", "user"); x == nil || x.Profile != "me" {
-		t.Errorf("the user differs: %+v", by[kindAddressBooks])
-	}
-	states := map[string]string{}
-	for _, k := range d.Kinds {
-		for _, e := range k.Declared {
-			states[k.Kind+"/"+e.Name] = e.State
-		}
-	}
-	if states["tags/todo"] != "lacks" || states["calendars/shared"] != refused || states["tags/$label1"] != "holds" ||
-		states["address-books/team"] != "lacks" {
-		t.Errorf("lacks, refused and holds: %v", states)
-	}
-	undeclared := mustJSON(d)
-	for _, want := range []string{`"key":"personal"`, `"key":"c2"`, `"key":"c3"`} {
-		if !strings.Contains(undeclared, want) {
-			t.Errorf("the undeclared entries are listed: lacks %s", want)
-		}
-	}
-	if _, err := f.userJS(true); err != nil {
-		t.Fatal(err)
-	}
-	d, _ = f.Drift("")
-	for _, k := range d.Kinds {
-		for _, e := range k.Declared {
-			if e.State == "differs" {
-				t.Errorf("once the user.js is placed, %s %s holds: %+v", k.Kind, e.Name, e)
-			}
-		}
-	}
-}
-
-// §1, §2, §13: the listing tools answer the operator's own values, Owl's marked, an ICS calendar by its name only,
-// and never a credential: through the tools, a password in an address and a field named for one are withheld.
-func TestTheListingsShowTheValuesOwlsMarkedAnICSByNameAndNoCredential(t *testing.T) {
-	f := newFake(t)
-	f.profileWithAccounts()
-	f.profileWithConfiguration()
-	f.write(profileDir+"/prefs.js", f.read(profileDir+"/prefs.js")+
-		`user_pref("calendar.registry.c6.type", "caldav");`+"\n"+
-		`user_pref("calendar.registry.c6.uri", "https://other:hunter2@dav.example.org/cal/x/");`+"\n"+
-		`user_pref("calendar.registry.c6.name", "Old");`+"\n")
-	f.write(profileDir+"/logins.json", `{"logins":[{"hostname":"https://dav.example.org","encryptedPassword":"hunter3"}]}`)
-	links(t, nil)
-	f.declare("// none")
-	f.declareAccounts(adoptable)
-	f.declareConfiguration(declaredConfiguration, declaredTags)
-	old := machine
-	machine = f.Machine
-	t.Cleanup(func() { machine = old })
-	answers := map[string]string{}
-	for _, tool := range tools() {
-		if strings.HasPrefix(tool.Name, "betterbird_") && contains([]string{"betterbird_identities", "betterbird_calendars",
-			"betterbird_address_books", "betterbird_filters", "betterbird_tags", "betterbird_accounts", "betterbird_drift"}, tool.Name) {
-			out, err := tool.Run(map[string]any{})
-			if err != nil {
-				t.Fatalf("%s: %v", tool.Name, err)
-			}
-			answers[tool.Name] = mustJSON(out)
-		}
-	}
-	cals := answers["betterbird_calendars"]
-	for _, shown := range []string{"https://dav.example.org/cal/home/", `"name":"Work","url":"owl://work@corp.example.com/calendar"`,
-		`"owl":true`, `"name":"Holidays"`} {
-		if !strings.Contains(cals, shown) {
-			t.Errorf("betterbird_calendars shows %s: %s", shown, cals)
-		}
-	}
-	if strings.Contains(cals, "secret-token") {
-		t.Error("an ICS calendar is listed by its name only")
-	}
-	for name, a := range answers {
-		if strings.Contains(a, "hunter2") || strings.Contains(a, "hunter3") {
-			t.Errorf("%s carries a credential: %s", name, a)
-		}
-	}
-	if !strings.Contains(cals, "https://other:‹withheld›@dav.example.org/cal/x/") {
-		t.Errorf("an address's password is shown as ‹withheld›: %s", cals)
-	}
-	for _, shown := range []string{`"signature":["Regards"]`, "other@mail.example.org"} {
-		if !strings.Contains(answers["betterbird_identities"], shown) {
-			t.Errorf("betterbird_identities shows %s", shown)
-		}
-	}
-	if got := mustJSON(credentialChecked(map[string]any{"name": "x", "password": "p", "nested": []any{map[string]any{"oauthToken": "t"}}})); got !=
-		`{"name":"x","nested":[{"oauthToken":"‹withheld›"}],"password":"‹withheld›"}` {
-		t.Errorf("a field named for a credential is withheld: %s", got)
-	}
-	// The start's words reach the journal: a refusal names kinds, names and keys, never an address.
-	stopBetterbird(t, f)
-	err := f.Prepare()
-	if err == nil || !strings.Contains(err.Error(), "calendars shared is refused") || strings.Contains(err.Error(), "example.org") {
-		t.Fatalf("%v", err)
-	}
-}

modules/betterbird/cmd/betterbird-tools/copies_test.go

@@ -1,37 +0,0 @@
-package main
-
-// The desktop applications whose bundles carry desktop.go. Each builds alone, so each has its own copy;
-// this test, itself one of the copied files, holds them to one text wherever the siblings are present.
-
-import (
-	"bytes"
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-var carriers = []string{"blueman", "forticlient", "nextcloud-client", "nm-applet", "openrazer", "polychromatic", "slack"}
-
-func TestEveryDesktopApplicationCarriesTheSameCopy(t *testing.T) {
-	compared := 0
-	for _, module := range carriers {
-		dir := filepath.Join("..", "..", "..", module, "cmd", module+"-tools")
-		if _, err := os.Stat(dir); err != nil {
-			continue
-		}
-		for _, f := range []string{"desktop.go", "desktop_test.go", "copies_test.go"} {
-			mine, err := os.ReadFile(f)
-			if err != nil {
-				t.Fatal(err)
-			}
-			theirs, err := os.ReadFile(filepath.Join(dir, f))
-			if err != nil || !bytes.Equal(mine, theirs) {
-				t.Errorf("%s's copy of %s differs from this one: change every copy together", module, f)
-			}
-		}
-		compared++
-	}
-	if compared == 0 {
-		t.Log("no sibling copies beside this module")
-	}
-}

modules/betterbird/cmd/betterbird-tools/derive.go

@@ -1,700 +0,0 @@
-package main
-
-// The five settings derived from the desktop nodes' profiles and proposed for the operator's Approve, one layer
-// at a time (novox/hq ADR 0329 §10, §12).
-//
-// betterbird_derive asks every desktop node that holds Betterbird for what its profile holds (its own derive with
-// here), and lays the answers out per layer: an entry found on every such node goes into the mesh-wide layer, with
-// the value of the node the derive was called on, and the answer lists every field another node holds differently,
-// which then shows as drift there; an entry found on some nodes only goes into each of those nodes' layers, so
-// nothing is added to another node until the operator moves it. With propose it proposes the next layer through
-// the controller's settings verb: first the mesh-wide one, then each node's that needs one, each only once no
-// proposal of the module's is open, against the layer as it then stands, which it carries whole beside the derived
-// kinds (a layer is replaced whole). The ask shows the values in their shape (ADR 0277 §6); the operator reads them
-// whole with `settings proposals <id>` at their desk.
-
-import (
-	"encoding/json"
-	"errors"
-	"fmt"
-	"regexp"
-	"sort"
-	"strings"
-)
-
-// derivedEntry is one entry a node's profile holds, in the setting's shape. Match is what makes two nodes' entries
-// the same one: an identity's account and address, a calendar's or an address book's address, a tag's key, an
-// account's name for its filters.
-type derivedEntry struct {
-	Match string          `json:"match"`
-	Name  string          `json:"name"`
-	Value json.RawMessage `json:"value"`
-}
-
-// nodeDerivation is what one node's profile holds of the five kinds.
-type nodeDerivation struct {
-	Node  string                    `json:"node"`
-	Kinds map[string][]derivedEntry `json:"kinds"`
-	// NotDerived names what a setting does not hold, by name and why: Owl's, an ICS calendar, a local address
-	// book, an address carrying a password, a filter a setting cannot say.
-	NotDerived []string `json:"not_derived,omitempty"`
-}
-
-var nameChars = regexp.MustCompile(`[^a-z0-9]`)
-
-// entryNameFor is a name of the operator's kind for an entry: lower-case letters and digits from its words,
-// unique among those used.
-func entryNameFor(words string, fallback string, used map[string]bool) string {
-	base := nameChars.ReplaceAllString(strings.ToLower(words), "")
-	if base == "" || base[0] < 'a' || base[0] > 'z' {
-		base = fallback + base
-	}
-	if len(base) > 28 {
-		base = base[:28]
-	}
-	name := base
-	for i := 2; used[name]; i++ {
-		name = fmt.Sprintf("%s%d", base, i)
-	}
-	used[name] = true
-	return name
-}
-
-func raw(v any) json.RawMessage {
-	b, _ := json.Marshal(v)
-	return b
-}
-
-// deriveHere reads this node's profile into the five kinds.
-func (m *Machine) deriveHere(kinds []string) (nodeDerivation, error) {
-	d := nodeDerivation{Node: nodeName(), Kinds: map[string][]derivedEntry{}}
-	p, err := m.profile()
-	if err != nil {
-		return d, err
-	}
-	prefs := mergedPrefs(p.path)
-	accounts, _, err := m.readAccounts()
-	if err != nil {
-		return d, err
-	}
-	nameOf := map[string]string{}
-	serverOf := map[string]string{}
-	for _, r := range resolveAccounts(accounts, prefs, m.readRecord(p.Dir)) {
-		if r.How != refused {
-			nameOf[r.Keys.Account], serverOf[r.name] = r.name, r.Keys.Server
-		}
-	}
-	want := map[string]bool{}
-	for _, k := range kinds {
-		want[k] = true
-	}
-	// Identities, by their account's name; the default carries no name or address (the setting accounts' own).
-	identityName := map[string]string{}
-	used := map[string]bool{}
-	byAccount := map[string]bool{}
-	for _, pi := range m.profileIdentities(prefs) {
-		account, declared := nameOf[pi.AccountKey]
-		switch {
-		case pi.Owl:
-			if pi.Default {
-				d.NotDerived = append(d.NotDerived, fmt.Sprintf("identities: %s <%s> is Owl's (novox/hq ADR 0316 §13)",
-					pi.Value.Name, pi.Value.Address))
-			}
-			continue
-		case !declared:
-			if !byAccount[pi.AccountKey] {
-				byAccount[pi.AccountKey] = true
-				d.NotDerived = append(d.NotDerived, fmt.Sprintf("identities: those of the profile's account %s, which the "+
-					"setting accounts does not hold", pi.AccountKey))
-			}
-			continue
-		}
-		v := pi.Value
-		v.Account = account
-		e := derivedEntry{}
-		if pi.Default {
-			v.Address, v.Name = "", ""
-			e.Match, e.Name = account+"|", entryNameFor(account, "id", used)
-		} else {
-			local, _, _ := strings.Cut(v.Address, "@")
-			e.Match, e.Name = account+"|"+strings.ToLower(v.Address), entryNameFor(account+local, "id", used)
-		}
-		identityName[pi.Key] = e.Name
-		e.Value = raw(v)
-		if want[kindIdentities] {
-			d.Kinds[kindIdentities] = append(d.Kinds[kindIdentities], e)
-		}
-	}
-	// Calendars: CalDAV only; Owl's are listed, an ICS one by its name only, a local one by its name (§13).
-	used = map[string]bool{}
-	for _, pc := range profileCalendars(prefs) {
-		if !want[kindCalendars] {
-			break
-		}
-		switch {
-		case pc.Kind == "owl" || strings.HasPrefix(pc.Kind, "owl"):
-			d.NotDerived = append(d.NotDerived, fmt.Sprintf("calendars: %s (%s) is Owl's", pc.Value.Name, pc.Value.URL))
-			continue
-		case pc.Kind == "ics":
-			d.NotDerived = append(d.NotDerived, fmt.Sprintf("calendars: %s is subscribed by an ICS address, which is "+
-				"often itself the secret: listed by its name only, never declared (novox/hq ADR 0329 §13)", pc.Value.Name))
-			continue
-		case pc.Kind != "caldav":
-			d.NotDerived = append(d.NotDerived, fmt.Sprintf("calendars: %s is %s, kept in the profile: its events are never declared",
-				pc.Value.Name, pc.Kind))
-			continue
-		case addressPassword(pc.Value.URL):
-			d.NotDerived = append(d.NotDerived, fmt.Sprintf("calendars: %s at %s carries a password in its address: refused "+
-				"(novox/hq ADR 0329 §2)", pc.Value.Name, withoutPassword(pc.Value.URL)))
-			continue
-		}
-		v := pc.Value
-		v.Invitations = identityName[pc.IdentityKey]
-		d.Kinds[kindCalendars] = append(d.Kinds[kindCalendars], derivedEntry{Match: strings.ToLower(strings.TrimRight(v.URL, "/")),
-			Name: entryNameFor(v.Name, "calendar", used), Value: raw(v)})
-	}
-	// Address books: CardDAV only.
-	used = map[string]bool{}
-	for _, b := range profileAddressBooks(prefs) {
-		if !want[kindAddressBooks] {
-			break
-		}
-		switch {
-		case !b.CardDAV:
-			d.NotDerived = append(d.NotDerived, fmt.Sprintf("address-books: %s is %s: its contacts are never declared", b.Value.Name, b.Kind))
-			continue
-		case addressPassword(b.Value.URL):
-			d.NotDerived = append(d.NotDerived, fmt.Sprintf("address-books: %s at %s carries a password in its address: "+
-				"refused (novox/hq ADR 0329 §2)", b.Value.Name, withoutPassword(b.Value.URL)))
-			continue
-		}
-		d.Kinds[kindAddressBooks] = append(d.Kinds[kindAddressBooks], derivedEntry{
-			Match: strings.ToLower(strings.TrimRight(b.Value.URL, "/")), Name: entryNameFor(b.Value.Name, "book", used), Value: raw(b.Value)})
-	}
-	// Tags, by their own key.
-	if want[kindTags] {
-		for _, t := range profileTags(prefs) {
-			d.Kinds[kindTags] = append(d.Kinds[kindTags], derivedEntry{Match: t.Key, Name: t.Key, Value: raw(t.Value)})
-		}
-	}
-	// Filters of each declared account whose file holds one or more: an account with none keeps its file as the
-	// person's until a setting names it.
-	if want[kindFilters] {
-		for _, name := range sortedKeys(serverOf) {
-			dir := m.accountDirectory(p.path, prefs, serverOf[name])
-			if dir == "" {
-				continue
-			}
-			text, err := readBounded(dir + "/" + filterFileName)
-			if err != nil {
-				continue
-			}
-			parsed := parseFilters(string(text), folderBase(prefs, serverOf[name]))
-			for _, why := range parsed.NotDeclarable {
-				d.NotDerived = append(d.NotDerived, "filters of "+name+": "+why)
-			}
-			if len(parsed.Filters) > 0 {
-				d.Kinds[kindFilters] = append(d.Kinds[kindFilters], derivedEntry{Match: name, Name: name, Value: raw(parsed.Filters)})
-			}
-		}
-	}
-	return d, nil
-}
-
-// difference is one field another node holds differently from the value the mesh-wide layer gets.
-type difference struct {
-	Kind     string `json:"kind"`
-	Entry    string `json:"entry"`
-	Node     string `json:"node"`
-	Field    string `json:"field"`
-	MeshWide any    `json:"mesh_wide"`
-	There    any    `json:"there"`
-}
-
-// DeriveAnswer is what betterbird_derive answers its caller: the values it derived, which ADR 0329 §10 lets it show.
-type DeriveAnswer struct {
-	// Here is this node's own derivation, when asked with here.
-	Here *nodeDerivation `json:"here,omitempty"`
-	// From are the desktop nodes derived from, and NotHeard those holding Betterbird that did not answer.
-	From     []string `json:"derived_from,omitempty"`
-	NotHeard []string `json:"not_heard,omitempty"`
-	// Layers are the derived values per layer: "mesh-wide", then each node's own.
-	Layers      map[string]map[string]any `json:"layers,omitempty"`
-	Differences []difference              `json:"differences,omitempty"`
-	NotDerived  map[string][]string       `json:"not_derived,omitempty"`
-	// Next is the layer a propose proposes now, or why none.
-	Next     string `json:"next,omitempty"`
-	Proposed string `json:"proposed,omitempty"`
-	Note     string `json:"note,omitempty"`
-}
-
-const meshWide = "mesh-wide"
-
-// Derive derives the kinds asked for (all five when none) from the desktop nodes, and with propose proposes the
-// next layer. prefs are values for the setting prefs to carry in the mesh-wide layer (issue 586: the operator's
-// setup moved out of the catalogue); layer names the layer to propose instead of the next in order.
-func (m *Machine) Derive(kinds []string, here, propose bool, prefs map[string]any, layer string) (DeriveAnswer, error) {
-	var a DeriveAnswer
-	if len(kinds) == 0 {
-		kinds = allKinds
-	}
-	for _, k := range kinds {
-		if !contains(allKinds, k) {
-			return a, fmt.Errorf("kinds are %s; %q is not one", strings.Join(allKinds, ", "), k)
-		}
-	}
-	if here {
-		d, err := m.deriveHere(kinds)
-		if err != nil {
-			return a, err
-		}
-		a.Here = &d
-		return a, nil
-	}
-	self := nodeName()
-	if self == "" {
-		return a, errors.New("this runtime does not say which machine it serves (MESH_NODE), so the node derived on is unknown")
-	}
-	holders, err := holdersOfBetterbird()
-	if err != nil {
-		return a, err
-	}
-	derived := map[string]nodeDerivation{}
-	for _, n := range holders {
-		if n == self {
-			d, err := m.deriveHere(kinds)
-			if err != nil {
-				return a, fmt.Errorf("this node's profile: %v", err)
-			}
-			derived[n] = d
-			continue
-		}
-		d, err := deriveOn(n, kinds)
-		if err != nil {
-			a.NotHeard = append(a.NotHeard, n+": "+err.Error())
-			continue
-		}
-		derived[n] = d
-	}
-	if _, ok := derived[self]; !ok {
-		return a, fmt.Errorf("%s does not hold Betterbird as the controller says: derive on a desktop node", self)
-	}
-	a.From = sortedKeys(derived)
-	a.Layers, a.Differences = layOut(self, derived, kinds)
-	a.NotDerived = map[string][]string{}
-	for n, d := range derived {
-		if len(d.NotDerived) > 0 {
-			a.NotDerived[n] = d.NotDerived
-		}
-	}
-	if len(a.NotDerived) == 0 {
-		a.NotDerived = nil
-	}
-	if len(prefs) > 0 {
-		a.Layers[meshWide]["prefs"] = prefs
-	}
-	a.Note = "the values each layer would get; an entry on every desktop node is mesh-wide with this node's value, one " +
-		"on some nodes only is in those nodes' own layers. With propose, the next layer is proposed for the operator's " +
-		"Approve, carrying the layer as it stands beside these kinds; nothing changes until then (novox/hq ADR 0329 §10)"
-	if !propose {
-		return a, nil
-	}
-	if len(a.NotHeard) > 0 {
-		return a, fmt.Errorf("nothing was proposed: %d desktop node(s) holding Betterbird did not answer (%s), and a "+
-			"layer derived without them would put on every node what only some hold; derive again when they are awake",
-			len(a.NotHeard), strings.Join(a.NotHeard, "; "))
-	}
-	if open, err := openProposals(); err != nil {
-		return a, fmt.Errorf("nothing was proposed: whether a proposal of the module's is open cannot be read: %v", err)
-	} else if len(open) > 0 {
-		return a, fmt.Errorf("nothing was proposed: the module's proposal %s waits for the operator; the next layer is "+
-			"proposed once it is set or declined (novox/hq ADR 0329 §10, ADR 0277 §10)", strings.Join(open, ", "))
-	}
-	order := []string{meshWide}
-	for _, n := range sortedKeys(a.Layers) {
-		if n != meshWide {
-			order = append(order, n)
-		}
-	}
-	if layer != "" {
-		if _, ok := a.Layers[layer]; !ok {
-			return a, fmt.Errorf("nothing was proposed: layer is %s", strings.Join(order, " or "))
-		}
-		order = []string{layer}
-	}
-	for _, l := range order {
-		node := l
-		if l == meshWide {
-			node = ""
-		}
-		current, err := readLayer(node)
-		if err != nil {
-			return a, fmt.Errorf("nothing was proposed: %v", err)
-		}
-		next := withKinds(current, a.Layers[l])
-		if l == meshWide {
-			if prefs, ok := next["prefs"]; ok {
-				body, _ := json.Marshal(map[string]any{"prefs": prefs})
-				if _, err := parseDeclaredPrefs(body); err != nil {
-					return a, fmt.Errorf("nothing was proposed: %v", err)
-				}
-			}
-		}
-		if err := proposable(next, l == meshWide); err != nil {
-			return a, fmt.Errorf("nothing was proposed for %s: %v", l, err)
-		}
-		if mustJSON(next) == mustJSON(current) {
-			continue
-		}
-		a.Next = l
-		said, err := proposeLayer(node, next, true)
-		a.Proposed = m.maskValue(said)
-		if err != nil {
-			return a, err
-		}
-		a.Note = "proposed the " + l + " layer for the operator's Approve; the next layer is proposed by calling again " +
-			"once this one is set or declined"
-		return a, nil
-	}
-	a.Next = "none: every layer already holds what was derived"
-	return a, nil
-}
-
-// proposable checks a layer's derived kinds as the module would read them, so the operator is never asked to set
-// a value the module then refuses. A key to adopt names one node's profile, so the mesh-wide layer holds none (§4).
-func proposable(layer map[string]any, mesh bool) error {
-	conf := map[string]any{}
-	for _, k := range []string{kindIdentities, kindCalendars, kindAddressBooks, kindFilters} {
-		if v, ok := layer[k]; ok {
-			conf[k] = v
-		}
-	}
-	var c Configuration
-	if err := decodeInto([]byte(mustJSON(conf)), configurationFile, &c); err != nil {
-		return err
-	}
-	if v, ok := layer[kindTags]; ok {
-		if err := decodeInto([]byte(mustJSON(map[string]any{kindTags: v})), tagsFile, &c); err != nil {
-			return err
-		}
-	}
-	// A node's layer may name an identity the mesh-wide layer holds for a calendar's invitations: that is judged
-	// where the layers meet, on the node.
-	var problems []string
-	if mesh {
-		for name, id := range c.Identities {
-			if id != nil && id.Key != "" {
-				problems = append(problems, "identities "+name+": a key is given in a node's own layer only")
-			}
-		}
-		for name, cal := range c.Calendars {
-			if cal != nil && cal.Key != "" {
-				problems = append(problems, "calendars "+name+": a key is given in a node's own layer only")
-			}
-		}
-		for name, ab := range c.AddressBooks {
-			if ab != nil && ab.Key != "" {
-				problems = append(problems, "address-books "+name+": a key is given in a node's own layer only")
-			}
-		}
-	}
-	for _, p := range configurationProblems(c) {
-		if !strings.Contains(p, "invitations names") {
-			problems = append(problems, p)
-		}
-	}
-	if len(problems) > 0 {
-		return errors.New(strings.Join(problems, "; "))
-	}
-	return nil
-}
-
-// layOut puts each kind's entries into the layers (§10).
-func layOut(self string, derived map[string]nodeDerivation, kinds []string) (map[string]map[string]any, []difference) {
-	layers := map[string]map[string]any{meshWide: {}}
-	var diffs []difference
-	nodes := sortedKeys(derived)
-	for _, kind := range kinds {
-		type seen struct {
-			by map[string]derivedEntry
-		}
-		groups := map[string]*seen{}
-		var order []string
-		for _, n := range append([]string{self}, nodes...) {
-			for _, e := range derived[n].Kinds[kind] {
-				g := groups[e.Match]
-				if g == nil {
-					g = &seen{by: map[string]derivedEntry{}}
-					groups[e.Match] = g
-					order = append(order, e.Match)
-				}
-				if _, already := g.by[n]; !already {
-					g.by[n] = e
-				}
-			}
-		}
-		mesh := map[string]any{}
-		used := map[string]bool{}
-		for _, match := range order {
-			g := groups[match]
-			if len(g.by) == len(nodes) {
-				mine := g.by[self]
-				name := uniqueName(mine.Name, used)
-				var v any
-				_ = json.Unmarshal(mine.Value, &v)
-				mesh[name] = v
-				for _, n := range nodes {
-					if n == self {
-						continue
-					}
-					diffs = append(diffs, fieldDifferences(kind, name, n, mine.Value, g.by[n].Value)...)
-				}
-			}
-		}
-		for _, match := range order {
-			g := groups[match]
-			if len(g.by) == len(nodes) {
-				continue
-			}
-			for _, n := range sortedKeys(g.by) {
-				e := g.by[n]
-				if layers[n] == nil {
-					layers[n] = map[string]any{}
-				}
-				nodeKind, _ := layers[n][kind].(map[string]any)
-				if nodeKind == nil {
-					nodeKind = map[string]any{}
-					layers[n][kind] = nodeKind
-				}
-				var v any
-				_ = json.Unmarshal(e.Value, &v)
-				nodeKind[uniqueName(e.Name, used)] = v
-			}
-		}
-		if len(mesh) > 0 {
-			layers[meshWide][kind] = mesh
-		}
-	}
-	return layers, diffs
-}
-
-func uniqueName(name string, used map[string]bool) string {
-	n := name
-	for i := 2; used[n]; i++ {
-		n = fmt.Sprintf("%s%d", name, i)
-	}
-	used[n] = true
-	return n
-}
-
-// fieldDifferences are the fields a node holds differently from the mesh-wide value of one entry.
-func fieldDifferences(kind, entry, node string, mesh, there json.RawMessage) []difference {
-	var a, b map[string]any
-	if json.Unmarshal(mesh, &a) != nil || json.Unmarshal(there, &b) != nil {
-		if mustJSON(json.RawMessage(mesh)) != mustJSON(json.RawMessage(there)) {
-			var x, y any
-			_ = json.Unmarshal(mesh, &x)
-			_ = json.Unmarshal(there, &y)
-			return []difference{{Kind: kind, Entry: entry, Node: node, Field: "the whole list", MeshWide: x, There: y}}
-		}
-		return nil
-	}
-	var out []difference
-	for _, f := range sortedKeys(mergeKeys(a, b)) {
-		if mustJSON(a[f]) != mustJSON(b[f]) {
-			out = append(out, difference{Kind: kind, Entry: entry, Node: node, Field: f, MeshWide: a[f], There: b[f]})
-		}
-	}
-	return out
-}
-
-func mergeKeys(a, b map[string]any) map[string]bool {
-	out := map[string]bool{}
-	for k := range a {
-		out[k] = true
-	}
-	for k := range b {
-		out[k] = true
-	}
-	return out
-}
-
-// withKinds is a layer with the derived kinds in place of its own, every other key kept.
-func withKinds(layer map[string]any, kinds map[string]any) map[string]any {
-	out := map[string]any{}
-	for k, v := range layer {
-		out[k] = v
-	}
-	for k, v := range kinds {
-		if k == "prefs" {
-			merged := map[string]any{}
-			if was, ok := out["prefs"].(map[string]any); ok {
-				for n, x := range was {
-					merged[n] = x
-				}
-			}
-			for n, x := range v.(map[string]any) {
-				merged[n] = x
-			}
-			out[k] = merged
-			continue
-		}
-		out[k] = v
-	}
-	return out
-}
-
-func contains(list []string, s string) bool {
-	for _, x := range list {
-		if x == s {
-			return true
-		}
-	}
-	return false
-}
-
-// readLayer is the module's layer as the controller holds it: the mesh-wide one for node "", else that node's.
-func readLayer(node string) (map[string]any, error) {
-	args := map[string]any{"module": "betterbird"}
-	if node != "" {
-		args["node"] = node
-	}
-	raw, err := asker("seat:mesh-controller.settings", args)
-	if err != nil {
-		return nil, fmt.Errorf("the controller's settings verb did not answer: %v", err)
-	}
-	said, ok := verbSaid(raw)
-	if !ok {
-		return nil, fmt.Errorf("the controller did not answer the layer: %s", said)
-	}
-	// A missing layer is said in exactly these words; anything else must read as the layer's JSON. A proposal
-	// replaces the layer whole, so an answer read wrongly as empty would drop what the layer holds: refused, loudly.
-	text := strings.TrimSpace(said)
-	where := "the whole mesh"
-	if node != "" {
-		where = node
-	}
-	if strings.HasPrefix(text, "betterbird on "+where+": no layer") {
-		return map[string]any{}, nil
-	}
-	out := map[string]any{}
-	if err := json.NewDecoder(strings.NewReader(text)).Decode(&out); err != nil || !strings.HasPrefix(text, "{") {
-		first, _, _ := strings.Cut(text, "\n")
-		return nil, fmt.Errorf("the controller's answer for the layer of betterbird on %s cannot be read as the layer "+
-			"(it begins %q), so nothing is proposed: a layer is replaced whole and would lose what it holds", where, first)
-	}
-	return out, nil
-}
-
-// proposeLayer proposes a layer whole for the operator's Approve (ADR 0277); replace says a key the layer had
-// and the proposal does not hold is meant to go, which a re-derive needs when an entry left every profile.
-func proposeLayer(node string, values map[string]any, replace bool) (string, error) {
-	body, err := json.Marshal(values)
-	if err != nil {
-		return "", err
-	}
-	args := map[string]any{"module": "betterbird", "values": string(body), "propose": "true"}
-	if replace {
-		args["replace"] = "true"
-	}
-	if node != "" {
-		args["node"] = node
-	}
-	raw, err := asker("seat:mesh-controller.settings", args)
-	if err != nil {
-		return "", fmt.Errorf("the controller's settings verb did not answer: %v", err)
-	}
-	said, ok := verbSaid(raw)
-	if !ok {
-		return said, fmt.Errorf("the controller did not take the proposal: %s", said)
-	}
-	return said, nil
-}
-
-var (
-	proposalHead = regexp.MustCompile(`^(\S+)\s+(?:set|clear) betterbird on (.+?)\s+\(`)
-	waitingLine  = regexp.MustCompile(`^\s+waiting for the operator until`)
-)
-
-// openProposals are the module's proposals that wait for the operator, by id and layer.
-func openProposals() ([]string, error) {
-	raw, err := asker("seat:mesh-controller.settings", map[string]any{"proposals": "true"})
-	if err != nil {
-		return nil, err
-	}
-	said, ok := verbSaid(raw)
-	if !ok {
-		return nil, errors.New(said)
-	}
-	var out []string
-	current := ""
-	for _, line := range strings.Split(said, "\n") {
-		if mm := proposalHead.FindStringSubmatch(line); mm != nil {
-			current = mm[1] + " (" + mm[2] + ")"
-			continue
-		}
-		if !strings.HasPrefix(line, " ") {
-			current = ""
-		}
-		if current != "" && waitingLine.MatchString(line) {
-			out = append(out, current)
-			current = ""
-		}
-	}
-	return out, nil
-}
-
-// holdersOfBetterbird are the nodes the controller has assigned the module to: the desktop nodes.
-func holdersOfBetterbird() ([]string, error) {
-	raw, err := asker("seat:mesh-controller.nodes", map[string]any{})
-	if err != nil {
-		return nil, fmt.Errorf("the controller's nodes verb did not answer: %v", err)
-	}
-	said, _ := verbSaid(raw)
-	var nodes []struct {
-		Name string `json:"name"`
-	}
-	if err := json.Unmarshal([]byte(said), &nodes); err != nil {
-		return nil, fmt.Errorf("the controller's nodes cannot be read: %v", err)
-	}
-	var out []string
-	for _, n := range nodes {
-		raw, err := asker("seat:mesh-controller.node", map[string]any{"node": n.Name})
-		if err != nil {
-			return nil, fmt.Errorf("the controller's node verb did not answer for %s: %v", n.Name, err)
-		}
-		said, _ := verbSaid(raw)
-		for _, line := range strings.Split(said, "\n") {
-			if rest, ok := strings.CutPrefix(strings.TrimSpace(line), "assigned:"); ok {
-				for _, mod := range strings.Split(rest, ",") {
-					if strings.TrimSpace(mod) == "betterbird" {
-						out = append(out, n.Name)
-					}
-				}
-			}
-		}
-	}
-	sort.Strings(out)
-	if len(out) == 0 {
-		return nil, errors.New("the controller names no node the module is assigned to")
-	}
-	return out, nil
-}
-
-// deriveOn asks another node's betterbird for what its profile holds.
-func deriveOn(node string, kinds []string) (nodeDerivation, error) {
-	raw, err := asker("betterbird.betterbird_derive@"+node, map[string]any{"here": true, "kinds": kinds})
-	if err != nil {
-		return nodeDerivation{}, err
-	}
-	said, ok := verbSaid(raw)
-	if !ok {
-		return nodeDerivation{}, errors.New(said)
-	}
-	var a DeriveAnswer
-	if err := json.Unmarshal([]byte(said), &a); err != nil || a.Here == nil {
-		return nodeDerivation{}, fmt.Errorf("its answer cannot be read")
-	}
-	a.Here.Node = node
-	return *a.Here, nil
-}

modules/betterbird/cmd/betterbird-tools/derive_test.go

@@ -1,263 +0,0 @@
-package main
-
-import (
-	"encoding/json"
-	"errors"
-	"fmt"
-	"reflect"
-	"strings"
-	"testing"
-)
-
-// ADR 0329 §10, §12: derived from every desktop node's profile, laid out per layer, and proposed one layer at a
-// time, carrying the layer as it stands.
-
-// derivingMesh is two desktop nodes, g14 (this one, f) and shanks (f2), and a server that holds no Betterbird, as the
-// controller answers them; layers are the controller's layers, open the proposals that wait.
-type derivingMesh struct {
-	t        *testing.T
-	shanks   *fake
-	layers   map[string]map[string]any
-	open     bool
-	proposed []map[string]any
-	asked    []string
-	asleep   bool
-	// garbled answers the layer in words that are not its JSON.
-	garbled bool
-}
-
-func (d *derivingMesh) ask(key string, body any) (json.RawMessage, error) {
-	d.asked = append(d.asked, key)
-	args, _ := body.(map[string]any)
-	answer := func(ok bool, text string) (json.RawMessage, error) {
-		b, _ := json.Marshal(map[string]any{"ok": ok, "output": text})
-		return b, nil
-	}
-	switch {
-	case key == "seat:mesh-controller.nodes":
-		return answer(true, `[{"name": "g14"}, {"name": "novox"}, {"name": "shanks"}]`)
-	case key == "seat:mesh-controller.node":
-		if args["node"] == "novox" {
-			return answer(true, "novox\n  assigned: postgres, nats\n")
-		}
-		return answer(true, fmt.Sprintf("%s\n  last heard from   here\n  assigned: adwaita, betterbird, dunst\n", args["node"]))
-	case key == "betterbird.betterbird_derive@shanks":
-		if d.asleep {
-			return nil, errors.New("nats: no responders available for request")
-		}
-		here, err := d.shanks.deriveHere(stringsOf(args["kinds"]))
-		if err != nil {
-			d.t.Fatal(err)
-		}
-		text, _ := json.Marshal(credentialChecked(DeriveAnswer{Here: &here}))
-		return json.Marshal(map[string]any{"content": []any{map[string]any{"type": "text", "text": string(text)}}})
-	case key == "seat:mesh-controller.settings" && args["proposals"] == "true":
-		if d.open {
-			return answer(true, "sab12  set betterbird on the whole mesh  (accounts, identities)\n    by g14.node-tools at 2026-10-13 01:00; fingerprint ab12\n    waiting for the operator until 2026-10-14 01:00\n"+
-				"scd34  set mounts on shanks  (sources)\n    by g14.node-tools at 2026-10-11 00:05; fingerprint dd0b\n    chosen: done\n")
-		}
-		return answer(true, "scd34  set mounts on shanks  (sources)\n    by g14.node-tools; fingerprint dd0b\n    chosen: done\n")
-	case key == "seat:mesh-controller.settings" && args["propose"] == "true":
-		d.proposed = append(d.proposed, args)
-		return answer(true, "proposal sab12: Set the settings of betterbird?\n  fingerprint ab12")
-	case key == "seat:mesh-controller.settings":
-		node, _ := args["node"].(string)
-		if d.garbled {
-			return answer(true, "Settings of betterbird on "+node+":\n  accounts = {…}\n")
-		}
-		layer := d.layers[node]
-		if layer == nil {
-			where := node
-			if where == "" {
-				where = "the whole mesh"
-			}
-			return answer(true, "betterbird on "+where+": no layer — the module's definition says\nbetterbird on "+where+", every value")
-		}
-		b, _ := json.MarshalIndent(layer, "", "  ")
-		return answer(true, string(b)+"\n  approved by the operator\nbetterbird on the whole mesh, every value and where it comes from:\n")
-	}
-	d.t.Fatalf("asked %s %v", key, body)
-	return nil, nil
-}
-
-func stringsOf(v any) []string {
-	switch x := v.(type) {
-	case []string:
-		return x
-	case []any:
-		var out []string
-		for _, s := range x {
-			out = append(out, s.(string))
-		}
-		return out
-	}
-	return nil
-}
-
-func TestDeriveLaysEachEntryOutPerLayerAndProposesOneLayerAtATime(t *testing.T) {
-	f := newFake(t)
-	f.profileWithAccounts()
-	f.profileWithConfiguration()
-	f.write(profileDir+"/prefs.js", f.read(profileDir+"/prefs.js")+
-		`user_pref("calendar.registry.c6.type", "caldav");`+"\n"+
-		`user_pref("calendar.registry.c6.uri", "https://other:hunter2@dav.example.org/cal/x/");`+"\n"+
-		`user_pref("calendar.registry.c6.name", "Old");`+"\n")
-	f.declareAccounts(adoptable)
-	links(t, nil)
-	f2 := newFake(t)
-	f2.profileWithAccounts()
-	f2.profileWithConfiguration()
-	// shanks holds the same accounts and calendars, another signature, another tag colour and a calendar of its own.
-	f2.write(profileDir+"/prefs.js", strings.NewReplacer(`"Regards"`, `"Cheers"`, `"#FF0000"`, `"#CC0000"`).Replace(f2.read(profileDir+"/prefs.js"))+
-		`user_pref("calendar.registry.s1.type", "caldav");`+"\n"+
-		`user_pref("calendar.registry.s1.uri", "https://dav.example.org/cal/standup/");`+"\n"+
-		`user_pref("calendar.registry.s1.name", "Standup");`+"\n")
-	f2.declareAccounts(adoptable)
-	mesh := &derivingMesh{t: t, shanks: f2, layers: map[string]map[string]any{"": {"accounts": map[string]any{"mail": "as approved"}}}}
-	oldNode, oldAsk := nodeName, asker
-	t.Cleanup(func() { nodeName, asker = oldNode, oldAsk })
-	nodeName = func() string { return "g14" }
-	asker = mesh.ask
-
-	a, err := f.Derive(nil, false, false, nil, "")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !reflect.DeepEqual(a.From, []string{"g14", "shanks"}) || len(a.NotHeard) != 0 {
-		t.Fatalf("derived from the nodes holding Betterbird: %v %v", a.From, a.NotHeard)
-	}
-	whole := mustJSON(a)
-	mw := a.Layers[meshWide]
-	ids, _ := mw[kindIdentities].(map[string]any)
-	if mail, _ := ids["mail"].(map[string]any); mail == nil || mustJSON(mail["signature"]) != `["Regards"]` || mail["address"] != nil {
-		t.Errorf("an identity on both nodes is mesh-wide with this node's value, the default without its address: %v", ids)
-	}
-	cals, _ := mw[kindCalendars].(map[string]any)
-	if cals["home"] == nil || cals["standup"] != nil {
-		t.Errorf("a calendar both hold is mesh-wide, one only shanks holds is not: %v", cals)
-	}
-	if sh := mustJSON(a.Layers["shanks"]); !strings.Contains(sh, "https://dav.example.org/cal/standup/") {
-		t.Errorf("an entry on one node only goes into that node's layer: %s", sh)
-	}
-	tags, _ := mw[kindTags].(map[string]any)
-	if l1, _ := tags["$label1"].(map[string]any); l1 == nil || l1["color"] != "#FF0000" {
-		t.Errorf("the tag is mesh-wide with this node's colour: %v", tags)
-	}
-	diffs := map[string]difference{}
-	for _, d := range a.Differences {
-		diffs[d.Kind+"/"+d.Entry+"/"+d.Field] = d
-	}
-	if d := diffs["identities/mail/signature"]; d.Node != "shanks" || mustJSON(d.There) != `["Cheers"]` {
-		t.Errorf("the answer lists the field shanks holds differently: %+v", a.Differences)
-	}
-	if d := diffs["tags/$label1/color"]; d.There != "#CC0000" || d.MeshWide != "#FF0000" {
-		t.Errorf("%+v", a.Differences)
-	}
-	for _, never := range []string{"secret-token", "hunter2", "owl://", `"Work"`} {
-		if strings.Contains(mustJSON(a.Layers), never) {
-			t.Errorf("no ICS address, credential or Owl calendar is derived: %s in %s", never, mustJSON(a.Layers))
-		}
-	}
-	if !strings.Contains(whole, "Holidays") || !strings.Contains(whole, "‹withheld›") || strings.Contains(mustJSON(credentialChecked(a)), "hunter2") {
-		t.Errorf("what is left out is named, an ICS calendar by its name and a password as ‹withheld›: %v", a.NotDerived)
-	}
-	if len(mesh.proposed) != 0 {
-		t.Fatal("without propose nothing is proposed")
-	}
-
-	// Propose: the mesh-wide layer first, as it stands with the derived kinds, and the operator's setup of prefs.
-	prefs := map[string]any{}
-	for n, v := range shippedDefaultsWant {
-		prefs[n], _ = prefValue(v)
-	}
-	a, err = f.Derive(nil, false, true, prefs, "")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(mesh.proposed) != 1 || mesh.proposed[0]["node"] != nil || mesh.proposed[0]["replace"] != "true" || a.Next != meshWide {
-		t.Fatalf("the mesh-wide layer is proposed first: %v %s", mesh.proposed, a.Next)
-	}
-	var values map[string]any
-	_ = json.Unmarshal([]byte(mesh.proposed[0]["values"].(string)), &values)
-	if values["accounts"] == nil || values[kindIdentities] == nil || values[kindTags] == nil || values["prefs"] == nil {
-		t.Fatalf("the layer as it stands, with every derived kind and prefs: %v", values)
-	}
-	body, _ := json.Marshal(map[string]any{"prefs": values["prefs"]})
-	if got, err := parseDeclaredPrefs(body); err != nil || !reflect.DeepEqual(got, shippedDefaultsWant) {
-		t.Fatalf("the operator's 21 preferences, one entry each: %v %v", got, err)
-	}
-	if !strings.Contains(a.Proposed, "sab12") {
-		t.Fatalf("%s", a.Proposed)
-	}
-
-	// While it waits nothing more is proposed.
-	mesh.open = true
-	if _, err := f.Derive(nil, false, true, nil, ""); err == nil || !strings.Contains(err.Error(), "sab12 (the whole mesh)") || len(mesh.proposed) != 1 {
-		t.Fatalf("one open proposal of the module's at a time: %v", err)
-	}
-	// Approved: the mesh-wide layer holds it, so the next layer is shanks's own.
-	mesh.open = false
-	mesh.layers[""] = values
-	a, err = f.Derive(nil, false, true, prefs, "")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(mesh.proposed) != 2 || mesh.proposed[1]["node"] != "shanks" || a.Next != "shanks" ||
-		!strings.Contains(mesh.proposed[1]["values"].(string), "standup") {
-		t.Fatalf("then the node's own layer: %v", mesh.proposed)
-	}
-	var shanks map[string]any
-	if err := json.Unmarshal([]byte(mesh.proposed[1]["values"].(string)), &shanks); err != nil {
-		t.Fatal(err)
-	}
-	mesh.layers["shanks"] = shanks
-	if a, err = f.Derive(nil, false, true, prefs, ""); err != nil || len(mesh.proposed) != 2 || !strings.HasPrefix(a.Next, "none") {
-		t.Fatalf("nothing left to propose: %v %s", err, a.Next)
-	}
-
-	// A desktop node that does not answer: derived without it, never proposed.
-	mesh.asleep = true
-	a, err = f.Derive(nil, false, true, nil, meshWide)
-	if err == nil || len(a.NotHeard) != 1 || !strings.Contains(err.Error(), "did not answer") || len(mesh.proposed) != 2 {
-		t.Fatalf("a layer is never proposed without a desktop node: %v %v", err, a.NotHeard)
-	}
-
-	// A key to adopt is a node's: the mesh-wide layer's proposal refuses one.
-	if err := proposable(map[string]any{kindCalendars: map[string]any{"c": map[string]any{"name": "C",
-		"url": "https://dav.example.org/c/", "key": "c3"}}}, true); err == nil || !strings.Contains(err.Error(), "node's own layer") {
-		t.Fatalf("%v", err)
-	}
-}
-
-// Review 121: a layer the controller answers in any other words than its JSON or "no layer" refuses the proposal,
-// because a proposal replaces the layer whole and would drop accounts.
-func TestALayerThatCannotBeReadRefusesTheProposal(t *testing.T) {
-	f := newFake(t)
-	f.profileWithAccounts()
-	f.profileWithConfiguration()
-	f.declareAccounts(adoptable)
-	links(t, nil)
-	f2 := newFake(t)
-	f2.profileWithAccounts()
-	f2.declareAccounts(adoptable)
-	mesh := &derivingMesh{t: t, shanks: f2, garbled: true}
-	oldNode, oldAsk := nodeName, asker
-	t.Cleanup(func() { nodeName, asker = oldNode, oldAsk })
-	nodeName = func() string { return "g14" }
-	asker = mesh.ask
-	if _, err := f.Derive(nil, false, true, nil, ""); err == nil || !strings.Contains(err.Error(), "cannot be read as the layer") ||
-		len(mesh.proposed) != 0 {
-		t.Fatalf("the derive refuses: %v %v", err, mesh.proposed)
-	}
-	if _, err := f.ProfileAccounts(true); err == nil || !strings.Contains(err.Error(), "cannot be read as the layer") ||
-		len(mesh.proposed) != 0 {
-		t.Fatalf("betterbird_accounts refuses: %v %v", err, mesh.proposed)
-	}
-	if _, err := readLayer(""); err == nil {
-		t.Fatal("an unreadable layer is an error, never an empty layer")
-	}
-	mesh.garbled = false
-	if got, err := readLayer("shanks"); err != nil || len(got) != 0 {
-		t.Fatalf("no layer, in the controller's words, is an empty layer: %v %v", got, err)
-	}
-}

modules/betterbird/cmd/betterbird-tools/desktop.go

@@ -1,601 +0,0 @@
-package main
-
-// desktop.go is the same file in every desktop application's bundle (copies_test.go names them and
-// holds them to one text): a tray application of the operator's graphical session, seen from the
-// node's tool runtime (novox/hq ADR 0208).
-//
-// The runtime is a system service running as the operator account (ADR 0175): it has the account's
-// uid and none of the session's environment. A tool that starts something on the desktop finds the
-// session from a process of the account that carries DISPLAY (the window manager first), and starts
-// the program under the account's own service manager with `systemd-run --user`, never as its own
-// child: the runtime's unit is a cgroup that is emptied whenever the runtime restarts.
-//
-// Everything a tool touches goes through a Machine: its filesystem root, its commands (a Runner) and
-// its signals are injected, so the tests run against a fake /proc and a fake home.
-//
-// Bounds: one command gets at most CallTimeout (below the runtime's 30 s call limit) and is ended
-// with everything it started when it takes longer; each stream is kept to MostOutput; a file is read
-// to at most MostRead.
-
-import (
-	"bufio"
-	"bytes"
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"sort"
-	"strconv"
-	"strings"
-	"syscall"
-	"time"
-)
-
-// Bounds every command and read is held to.
-const (
-	CallTimeout = 10 * time.Second
-	MostOutput  = 256 << 10
-	MostRead    = 16 << 20
-)
-
-// Output is what a command did.
-type Output struct {
-	Stdout string
-	Stderr string
-	Code   int
-	// Err is why it did not run to an answer: not installed, ended on its timeout, or the spawn error.
-	Err error
-	Cut bool
-}
-
-// ErrNotInstalled and ErrTimedOut are what a Runner answers in Output.Err.
-var (
-	ErrNotInstalled = errors.New("not installed")
-	ErrTimedOut     = errors.New("timed out")
-	// ErrNoSession is answered by a tool that needs the desktop when nobody is logged in to it.
-	ErrNoSession = errors.New("no graphical session")
-)
-
-// Runner runs one command with extra environment, within the context's deadline. Tests replace it.
-type Runner func(ctx context.Context, env []string, name string, args ...string) Output
-
-// Machine is what the tools read and act on.
-type Machine struct {
-	Root    string // "" on the machine; a fake root in tests
-	Home    string // the operator's home, as the machine names it
-	UID     int
-	Run     Runner
-	Kill    func(pid int, sig syscall.Signal) error
-	Sleep   func(time.Duration)
-	Now     func() time.Time
-	Timeout time.Duration
-}
-
-// NewMachine is the machine the bundle runs on.
-func NewMachine() *Machine {
-	return &Machine{Home: operatorHome(), UID: os.Getuid(), Run: execRun, Kill: syscall.Kill,
-		Sleep: time.Sleep, Now: time.Now, Timeout: CallTimeout}
-}
-
-// operatorHome is the account's home: what the runtime was told, else the process's own.
-func operatorHome() string {
-	if h := strings.TrimSpace(os.Getenv("MESH_OPERATOR_HOME")); h != "" {
-		return h
-	}
-	h, _ := os.UserHomeDir()
-	return h
-}
-
-func (m *Machine) path(p string) string { return filepath.Join(m.Root, p) }
-
-// home is a path under the operator's home, on this machine's filesystem.
-func (m *Machine) home(rel ...string) string {
-	return filepath.Join(append([]string{m.Root, m.Home}, rel...)...)
-}
-
-// tilde shows a path under the home as ~/…, so an answer does not carry the account's name.
-func (m *Machine) tilde(p string) string {
-	if m.Home != "" && m.Home != "/" {
-		h := strings.TrimSuffix(m.Home, "/")
-		if p == h {
-			return "~"
-		}
-		if strings.HasPrefix(p, h+"/") {
-			return "~/" + strings.TrimPrefix(p, h+"/")
-		}
-	}
-	return p
-}
-
-// cmd runs a command within the machine's timeout (or a shorter one).
-func (m *Machine) cmd(timeout time.Duration, env []string, name string, args ...string) Output {
-	if timeout <= 0 || timeout > m.Timeout {
-		timeout = m.Timeout
-	}
-	ctx, cancel := context.WithTimeout(context.Background(), timeout)
-	defer cancel()
-	return m.Run(ctx, env, name, args...)
-}
-
-// failed names how a command failed, or answers nil when it ran and exited 0.
-func failed(o Output, name string, args ...string) error {
-	switch {
-	case errors.Is(o.Err, ErrNotInstalled):
-		return fmt.Errorf("%s is not installed on this machine", name)
-	case errors.Is(o.Err, ErrTimedOut):
-		return fmt.Errorf("%s gave no answer in time and was ended", name)
-	case o.Err != nil:
-		return fmt.Errorf("%s did not run: %v", name, o.Err)
-	case o.Code != 0:
-		said := strings.TrimSpace(o.Stderr)
-		if said == "" {
-			said = strings.TrimSpace(o.Stdout)
-		}
-		if said == "" {
-			said = "and said nothing"
-		}
-		return fmt.Errorf("%s %s exited %d: %s", name, strings.Join(args, " "), o.Code, tail(said, 1000))
-	}
-	return nil
-}
-
-func tail(s string, n int) string {
-	if len(s) <= n {
-		return s
-	}
-	return "…" + s[len(s)-n:]
-}
-
-type capped struct {
-	b   bytes.Buffer
-	cut bool
-}
-
-func (c *capped) Write(p []byte) (int, error) {
-	if room := MostOutput - c.b.Len(); room < len(p) {
-		if room > 0 {
-			c.b.Write(p[:room])
-		}
-		c.cut = true
-		return len(p), nil
-	}
-	return c.b.Write(p)
-}
-
-func execRun(ctx context.Context, env []string, name string, args ...string) Output {
-	path, err := exec.LookPath(name)
-	if err != nil {
-		return Output{Code: 127, Err: ErrNotInstalled}
-	}
-	cmd := exec.CommandContext(ctx, path, args...)
-	cmd.Env = append(append(os.Environ(), "LC_ALL=C"), env...)
-	// Its own process group, so that ending it on a timeout ends what it started too.
-	cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
-	cmd.Cancel = func() error {
-		if cmd.Process != nil {
-			_ = syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL)
-		}
-		return nil
-	}
-	cmd.WaitDelay = 2 * time.Second
-	var out, errs capped
-	cmd.Stdout, cmd.Stderr = &out, &errs
-	err = cmd.Run()
-	o := Output{Stdout: out.b.String(), Stderr: errs.b.String(), Cut: out.cut || errs.cut}
-	var exit *exec.ExitError
-	switch {
-	case err == nil:
-	case ctx.Err() == context.DeadlineExceeded:
-		o.Code, o.Err = 124, ErrTimedOut
-	case errors.As(err, &exit):
-		o.Code = exit.ExitCode()
-	default:
-		o.Code, o.Err = 127, err
-	}
-	return o
-}
-
-// readBounded reads a file to at most MostRead bytes.
-func readBounded(path string) ([]byte, error) {
-	f, err := os.Open(path)
-	if err != nil {
-		return nil, err
-	}
-	defer f.Close()
-	return io.ReadAll(io.LimitReader(f, MostRead))
-}
-
-// Proc is one process of the account.
-type Proc struct {
-	PID     int    `json:"pid"`
-	Command string `json:"command"`
-	// StartedIn is the unit or scope it runs in: the login session's scope when the session's start
-	// (dex, the window manager) started it, a mesh-… unit when a tool restarted it.
-	StartedIn string `json:"started_in,omitempty"`
-	Since     string `json:"since,omitempty"`
-}
-
-// procs are this account's processes named comm, oldest first.
-func (m *Machine) procs(comm string) []Proc {
-	entries, err := os.ReadDir(m.path("/proc"))
-	if err != nil {
-		return nil
-	}
-	boot := m.bootTime()
-	var out []Proc
-	for _, e := range entries {
-		pid, err := strconv.Atoi(e.Name())
-		if err != nil {
-			continue
-		}
-		dir := m.path(filepath.Join("/proc", e.Name()))
-		if readTrimmed(filepath.Join(dir, "comm")) != comm || m.uidOf(dir) != m.UID {
-			continue
-		}
-		p := Proc{PID: pid, Command: strings.TrimSpace(strings.ReplaceAll(readTrimmed(filepath.Join(dir, "cmdline")), "\x00", " "))}
-		if p.Command == "" {
-			p.Command = comm
-		}
-		if cg := readTrimmed(filepath.Join(dir, "cgroup")); cg != "" {
-			line := strings.Split(cg, "\n")[0]
-			p.StartedIn = filepath.Base(line[strings.LastIndexByte(line, ':')+1:])
-		}
-		if t, ok := startOf(readTrimmed(filepath.Join(dir, "stat")), boot); ok {
-			p.Since = t.UTC().Format(time.RFC3339)
-		}
-		out = append(out, p)
-	}
-	sort.Slice(out, func(i, j int) bool { return out[i].PID < out[j].PID })
-	return out
-}
-
-// procsOf are the account's processes named comm whose program is word. The kernel keeps 15
-// characters of a command name, so a longer name can share them with another program's: this bundle's
-// own binary among them (polychromatic-tools and polychromatic-tray-applet are both polychromatic-t).
-// The program is the first word of the command line, or the second for a script run by its
-// interpreter. An empty word keeps every process named comm.
-func (m *Machine) procsOf(comm, word string) []Proc {
-	var out []Proc
-	for _, p := range m.procs(comm) {
-		f := strings.Fields(p.Command)
-		if word == "" || (len(f) > 0 && filepath.Base(f[0]) == word) || (len(f) > 1 && filepath.Base(f[1]) == word) {
-			out = append(out, p)
-		}
-	}
-	return out
-}
-
-// uidOf is the real uid on a process's status, -1 when unreadable.
-func (m *Machine) uidOf(dir string) int {
-	for _, l := range strings.Split(readTrimmed(filepath.Join(dir, "status")), "\n") {
-		if f := strings.Fields(l); len(f) > 1 && f[0] == "Uid:" {
-			if n, err := strconv.Atoi(f[1]); err == nil {
-				return n
-			}
-		}
-	}
-	return -1
-}
-
-func (m *Machine) bootTime() int64 {
-	for _, l := range strings.Split(readTrimmed(m.path("/proc/stat")), "\n") {
-		if f := strings.Fields(l); len(f) == 2 && f[0] == "btime" {
-			n, _ := strconv.ParseInt(f[1], 10, 64)
-			return n
-		}
-	}
-	return 0
-}
-
-// startOf reads a process's start from its stat line (field 22, in clock ticks of 1/100 s since boot).
-func startOf(stat string, boot int64) (time.Time, bool) {
-	i := strings.LastIndexByte(stat, ')')
-	if i < 0 || boot == 0 {
-		return time.Time{}, false
-	}
-	f := strings.Fields(stat[i+1:])
-	if len(f) < 20 {
-		return time.Time{}, false
-	}
-	ticks, err := strconv.ParseInt(f[19], 10, 64)
-	if err != nil {
-		return time.Time{}, false
-	}
-	return time.Unix(boot+ticks/100, 0), true
-}
-
-func readTrimmed(path string) string {
-	b, err := os.ReadFile(path)
-	if err != nil {
-		return ""
-	}
-	return strings.TrimSpace(string(b))
-}
-
-func exists(path string) bool {
-	_, err := os.Stat(path)
-	return err == nil
-}
-
-// Session is what a tool needs to start something on the operator's desktop.
-type Session struct {
-	Display    string `json:"display"`
-	XAuthority string `json:"xauthority,omitempty"`
-	Bus        string `json:"bus,omitempty"`
-	RuntimeDir string `json:"runtime_dir,omitempty"`
-	From       string `json:"found_in"`
-}
-
-// sessionHolders are the processes whose environment is the session's, best first.
-var sessionHolders = []string{"i3", "sway", "i3bar", "picom", "dunst", "xterm"}
-
-// session finds the account's graphical session, or ErrNoSession saying what it looked at.
-func (m *Machine) session() (Session, error) {
-	entries, _ := os.ReadDir(m.path("/proc"))
-	best, bestRank := -1, len(sessionHolders)+1
-	var env map[string]string
-	var from string
-	for _, e := range entries {
-		pid, err := strconv.Atoi(e.Name())
-		if err != nil {
-			continue
-		}
-		dir := m.path(filepath.Join("/proc", e.Name()))
-		if m.uidOf(dir) != m.UID {
-			continue
-		}
-		raw, err := os.ReadFile(filepath.Join(dir, "environ"))
-		if err != nil {
-			continue
-		}
-		vars := parseEnviron(raw)
-		if vars["DISPLAY"] == "" {
-			continue
-		}
-		comm := readTrimmed(filepath.Join(dir, "comm"))
-		rank := len(sessionHolders)
-		for i, h := range sessionHolders {
-			if h == comm {
-				rank = i
-			}
-		}
-		if rank < bestRank || (rank == bestRank && pid > best) {
-			best, bestRank, env, from = pid, rank, vars, fmt.Sprintf("process %s (pid %d)", comm, pid)
-		}
-	}
-	if env == nil {
-		return Session{}, fmt.Errorf("%w for uid %d on this machine: no process of the account carries DISPLAY. "+
-			"Is anyone logged in to the desktop?", ErrNoSession, m.UID)
-	}
-	s := Session{Display: env["DISPLAY"], XAuthority: env["XAUTHORITY"], Bus: env["DBUS_SESSION_BUS_ADDRESS"],
-		RuntimeDir: env["XDG_RUNTIME_DIR"], From: from}
-	if s.RuntimeDir == "" {
-		s.RuntimeDir = fmt.Sprintf("/run/user/%d", m.UID)
-	}
-	if s.Bus == "" && exists(m.path(filepath.Join(s.RuntimeDir, "bus"))) {
-		s.Bus = "unix:path=" + filepath.Join(s.RuntimeDir, "bus")
-	}
-	return s, nil
-}
-
-// bus is the account's session bus environment, which a logged-in account has with or without a
-// desktop: what a command needs to reach the user's service manager or a bus name.
-func (m *Machine) bus() []string {
-	runtime := fmt.Sprintf("/run/user/%d", m.UID)
-	return []string{"XDG_RUNTIME_DIR=" + runtime, "DBUS_SESSION_BUS_ADDRESS=unix:path=" + runtime + "/bus"}
-}
-
-// Env is the session's variables, for a command that draws or speaks to the desktop.
-func (s Session) Env() []string {
-	var env []string
-	for _, kv := range [][2]string{{"DISPLAY", s.Display}, {"XAUTHORITY", s.XAuthority},
-		{"DBUS_SESSION_BUS_ADDRESS", s.Bus}, {"XDG_RUNTIME_DIR", s.RuntimeDir}} {
-		if kv[1] != "" {
-			env = append(env, kv[0]+"="+kv[1])
-		}
-	}
-	return env
-}
-
-func parseEnviron(raw []byte) map[string]string {
-	env := map[string]string{}
-	for _, kv := range bytes.Split(raw, []byte{0}) {
-		if i := bytes.IndexByte(kv, '='); i > 0 {
-			env[string(kv[:i])] = string(kv[i+1:])
-		}
-	}
-	return env
-}
-
-// detach starts a long-lived program under the account's service manager, as a transient unit that
-// carries the session's display. A unit left by an earlier start under the same name is stopped
-// first, so the fixed name means at most one.
-func (m *Machine) detach(s Session, unit string, argv ...string) error {
-	_ = m.cmd(5*time.Second, s.Env(), "systemctl", "--user", "stop", unit+".service")
-	call := []string{"--user", "--collect", "--quiet", "--unit=" + unit}
-	for _, kv := range [][2]string{{"DISPLAY", s.Display}, {"XAUTHORITY", s.XAuthority}} {
-		if kv[1] != "" {
-			call = append(call, "--setenv="+kv[0]+"="+kv[1])
-		}
-	}
-	call = append(append(call, "--"), argv...)
-	return failed(m.cmd(8*time.Second, s.Env(), "systemd-run", call...), "systemd-run", call...)
-}
-
-// stop ends every process of the account named in comms: SIGTERM, then SIGKILL for what is still
-// there after grace. It answers the pids that ended and those that had to be killed.
-func (m *Machine) stop(grace time.Duration, comms ...string) (ended, killed []int) {
-	var ps []Proc
-	for _, c := range comms {
-		ps = append(ps, m.procs(c)...)
-	}
-	return m.stopProcs(grace, ps)
-}
-
-// stopProcs ends the processes given, as stop does.
-func (m *Machine) stopProcs(grace time.Duration, ps []Proc) (ended, killed []int) {
-	var pids []int
-	for _, p := range ps {
-		if m.Kill(p.PID, syscall.SIGTERM) == nil {
-			pids = append(pids, p.PID)
-		}
-	}
-	alive := func() []int {
-		var left []int
-		for _, pid := range pids {
-			if exists(m.path(filepath.Join("/proc", strconv.Itoa(pid)))) {
-				left = append(left, pid)
-			}
-		}
-		return left
-	}
-	step := 200 * time.Millisecond
-	for waited := time.Duration(0); waited < grace && len(alive()) > 0; waited += step {
-		m.Sleep(step)
-	}
-	left := alive()
-	for _, pid := range left {
-		if m.Kill(pid, syscall.SIGKILL) == nil {
-			killed = append(killed, pid)
-		}
-	}
-	gone := map[int]bool{}
-	for _, pid := range left {
-		gone[pid] = true
-	}
-	for _, pid := range pids {
-		if !gone[pid] {
-			ended = append(ended, pid)
-		}
-	}
-	return ended, killed
-}
-
-// waitFor waits up to d for a process of the account named comm, and answers what it found.
-func (m *Machine) waitFor(comm string, d time.Duration) []Proc { return m.waitForOf(comm, "", d) }
-
-// waitForOf waits up to d for a process of the account named comm whose program is word (procsOf).
-func (m *Machine) waitForOf(comm, word string, d time.Duration) []Proc {
-	step := 250 * time.Millisecond
-	for waited := time.Duration(0); ; waited += step {
-		if p := m.procsOf(comm, word); len(p) > 0 || waited >= d {
-			return p
-		}
-		m.Sleep(step)
-	}
-}
-
-// desktopEntry reads the [Desktop Entry] group of an XDG desktop file; nil when there is none.
-func desktopEntry(path string) map[string]string {
-	raw, err := readBounded(path)
-	if err != nil {
-		return nil
-	}
-	out := map[string]string{}
-	in := false
-	s := bufio.NewScanner(bytes.NewReader(raw))
-	for s.Scan() {
-		l := strings.TrimSpace(s.Text())
-		switch {
-		case strings.HasPrefix(l, "["):
-			in = l == "[Desktop Entry]"
-		case in && l != "" && !strings.HasPrefix(l, "#"):
-			if i := strings.IndexByte(l, '='); i > 0 {
-				out[strings.TrimSpace(l[:i])] = strings.TrimSpace(l[i+1:])
-			}
-		}
-	}
-	return out
-}
-
-// Autostart is what XDG autostart does with one entry: the account's file overrides the system's
-// of the same name, and Hidden=true (or the GNOME switch off) means it is not started.
-type Autostart struct {
-	Entry   string `json:"entry"`
-	From    string `json:"from"`
-	Exec    string `json:"exec,omitempty"`
-	Starts  bool   `json:"starts"`
-	Because string `json:"because,omitempty"`
-}
-
-// autostart resolves one XDG autostart entry by its file name, the account's directory first.
-func (m *Machine) autostart(name string) Autostart {
-	a := Autostart{Entry: name}
-	user := m.home(".config", "autostart", name)
-	system := m.path(filepath.Join("/etc/xdg/autostart", name))
-	var e map[string]string
-	switch {
-	case exists(user):
-		e, a.From = desktopEntry(user), m.tilde(filepath.Join(m.Home, ".config/autostart", name))
-	case exists(system):
-		e, a.From = desktopEntry(system), filepath.Join("/etc/xdg/autostart", name)
-	default:
-		a.Because = "no such entry in ~/.config/autostart or /etc/xdg/autostart"
-		return a
-	}
-	a.Exec = e["Exec"]
-	switch {
-	case strings.EqualFold(e["Hidden"], "true"):
-		a.Because = "Hidden=true"
-	case strings.EqualFold(e["X-GNOME-Autostart-enabled"], "false"):
-		a.Because = "X-GNOME-Autostart-enabled=false"
-	case a.Exec == "":
-		a.Because = "the entry has no Exec"
-	default:
-		a.Starts = true
-	}
-	return a
-}
-
-// i3Starts are the window manager's start-up lines (exec, exec_always) that run a program named
-// word, in the configuration and its config.d: a second start beside an autostart entry.
-func (m *Machine) i3Starts(word string) []string {
-	files := []string{m.home(".config", "i3", "config")}
-	more, _ := filepath.Glob(m.home(".config", "i3", "config.d", "*.conf"))
-	files = append(files, more...)
-	var out []string
-	for _, f := range files {
-		raw, err := readBounded(f)
-		if err != nil {
-			continue
-		}
-		for n, l := range strings.Split(string(raw), "\n") {
-			t := strings.TrimSpace(l)
-			if !strings.HasPrefix(t, "exec ") && !strings.HasPrefix(t, "exec_always ") {
-				continue
-			}
-			for _, w := range strings.Fields(t)[1:] {
-				if filepath.Base(strings.Trim(w, `"'`)) == word {
-					out = append(out, fmt.Sprintf("%s:%d: %s", m.tilde(strings.TrimPrefix(f, m.Root)), n+1, t))
-					break
-				}
-			}
-		}
-	}
-	return out
-}
-
-// installed asks the package manager for one package's version; "" when it is not installed.
-func (m *Machine) installed(pkg string) (string, error) {
-	o := m.cmd(0, nil, "pacman", "-Q", pkg)
-	if o.Err != nil {
-		return "", failed(o, "pacman", "-Q", pkg)
-	}
-	if o.Code != 0 {
-		return "", nil
-	}
-	f := strings.Fields(o.Stdout)
-	if len(f) < 2 {
-		return "", fmt.Errorf("pacman -Q %s answered %q", pkg, o.Stdout)
-	}
-	return f[1], nil
-}
-
-// Finding is one thing a check found wrong, and what to do about it.
-type Finding struct {
-	What string `json:"what"`
-	Do   string `json:"do,omitempty"`
-}

modules/betterbird/cmd/betterbird-tools/desktop_test.go

@@ -1,219 +0,0 @@
-package main
-
-// The fake machine the tests run against, and the tests of desktop.go. The same in every desktop
-// application's bundle (copies_test.go).
-
-import (
-	"context"
-	"os"
-	"path/filepath"
-	"strconv"
-	"strings"
-	"sync"
-	"syscall"
-	"testing"
-	"time"
-)
-
-const testHome = "/home/operator"
-
-// fake is a machine with a fake root, a scripted Runner and signals that end fake processes.
-type fake struct {
-	*Machine
-	t      *testing.T
-	mu     sync.Mutex
-	calls  []string
-	answer func(name string, args []string) Output
-	// onStart is run when systemd-run starts something, to let a fake process appear.
-	onStart func(argv []string)
-	// stubborn pids ignore SIGTERM.
-	stubborn map[int]bool
-	signals  []string
-}
-
-func newFake(t *testing.T) *fake {
-	t.Helper()
-	root := t.TempDir()
-	f := &fake{t: t, stubborn: map[int]bool{}}
-	f.Machine = &Machine{Root: root, Home: testHome, UID: 1000, Timeout: CallTimeout,
-		Sleep: func(time.Duration) {}, Now: func() time.Time { return time.Unix(1_800_000_000, 0) }}
-	f.Run = func(_ context.Context, env []string, name string, args ...string) Output {
-		f.mu.Lock()
-		f.calls = append(f.calls, strings.TrimSpace(name+" "+strings.Join(args, " ")))
-		f.mu.Unlock()
-		if name == "systemd-run" && f.onStart != nil {
-			for i, a := range args {
-				if a == "--" {
-					f.onStart(args[i+1:])
-				}
-			}
-		}
-		if f.answer != nil {
-			return f.answer(name, args)
-		}
-		return Output{}
-	}
-	f.Kill = func(pid int, sig syscall.Signal) error {
-		f.signals = append(f.signals, strconv.Itoa(pid)+":"+sig.String())
-		if sig == syscall.SIGKILL || !f.stubborn[pid] {
-			return os.RemoveAll(filepath.Join(root, "proc", strconv.Itoa(pid)))
-		}
-		return nil
-	}
-	f.write("/proc/stat", "cpu 1 2 3\nbtime 1799990000\n")
-	return f
-}
-
-func (f *fake) write(path, content string) {
-	f.t.Helper()
-	p := filepath.Join(f.Root, path)
-	if err := os.MkdirAll(filepath.Dir(p), 0o755); err != nil {
-		f.t.Fatal(err)
-	}
-	if err := os.WriteFile(p, []byte(content), 0o644); err != nil {
-		f.t.Fatal(err)
-	}
-}
-
-// proc adds a process of uid with a command name, argv, cgroup and environment.
-func (f *fake) proc(pid, uid int, comm string, argv []string, cgroup string, env ...string) {
-	d := "/proc/" + strconv.Itoa(pid) + "/"
-	f.write(d+"comm", comm+"\n")
-	f.write(d+"status", "Name:\t"+comm+"\nUid:\t"+strconv.Itoa(uid)+"\t"+strconv.Itoa(uid)+"\t"+strconv.Itoa(uid)+"\t"+strconv.Itoa(uid)+"\n")
-	f.write(d+"cmdline", strings.Join(argv, "\x00")+"\x00")
-	f.write(d+"cgroup", "0::/user.slice/user-"+strconv.Itoa(uid)+".slice/"+cgroup+"\n")
-	f.write(d+"environ", strings.Join(env, "\x00")+"\x00")
-	// starttime (field 22) is 1000 ticks: 10 s after boot.
-	f.write(d+"stat", strconv.Itoa(pid)+" ("+comm+") S 1 1 1 0 -1 0 0 0 0 0 0 0 0 0 20 0 1 0 1000 0 0\n")
-}
-
-func (f *fake) desktopSession() {
-	f.proc(3700, 1000, "i3", []string{"i3"}, "session-c1.scope", "DISPLAY=:1", "XAUTHORITY="+testHome+"/.Xauthority")
-	f.write("/run/user/1000/bus", "")
-}
-
-func (f *fake) called(prefix string) bool {
-	for _, c := range f.calls {
-		if strings.HasPrefix(c, prefix) {
-			return true
-		}
-	}
-	return false
-}
-
-func TestProcessesAreTheAccountsOwnWithWhereAndWhenTheyStarted(t *testing.T) {
-	f := newFake(t)
-	f.proc(10, 1000, "worker", []string{"/usr/bin/worker", "--background"}, "session-c1.scope")
-	f.proc(11, 1001, "worker", []string{"/usr/bin/worker"}, "session-c2.scope")
-	f.proc(12, 1000, "other", []string{"other"}, "x.scope")
-	got := f.procs("worker")
-	if len(got) != 1 || got[0].PID != 10 || got[0].Command != "/usr/bin/worker --background" ||
-		got[0].StartedIn != "session-c1.scope" || got[0].Since != time.Unix(1799990010, 0).UTC().Format(time.RFC3339) {
-		t.Fatalf("%+v", got)
-	}
-}
-
-func TestAProgramIsToldFromAnotherSharingItsCutName(t *testing.T) {
-	f := newFake(t)
-	f.proc(10, 1000, "polychromatic-t", []string{"/usr/bin/python", "/usr/bin/polychromatic-tray-applet"}, "s.scope")
-	f.proc(11, 1000, "polychromatic-t", []string{"polychromatic-tray-applet"}, "s.scope")
-	f.proc(12, 1000, "polychromatic-t", []string{"/usr/lib/mesh/polychromatic-tools"}, "s.scope")
-	if got := f.procsOf("polychromatic-t", "polychromatic-tray-applet"); len(got) != 2 || got[0].PID != 10 || got[1].PID != 11 {
-		t.Fatalf("%+v", got)
-	}
-	if got := f.procsOf("polychromatic-t", ""); len(got) != 3 {
-		t.Fatalf("%+v", got)
-	}
-	ended, _ := f.stopProcs(time.Second, f.procsOf("polychromatic-t", "polychromatic-tray-applet"))
-	if len(ended) != 2 || len(f.procs("polychromatic-t")) != 1 {
-		t.Fatalf("ended %v; the tools' own process must stay", ended)
-	}
-}
-
-func TestTheSessionIsTheWindowManagersAndNoneIsSaidPlainly(t *testing.T) {
-	f := newFake(t)
-	if _, err := f.session(); err == nil || !strings.Contains(err.Error(), "no graphical session") {
-		t.Fatalf("%v", err)
-	}
-	f.proc(50, 1000, "xterm", []string{"xterm"}, "s.scope", "DISPLAY=:9")
-	f.desktopSession()
-	f.proc(60, 1001, "i3", []string{"i3"}, "s.scope", "DISPLAY=:5")
-	s, err := f.session()
-	if err != nil || s.Display != ":1" || s.XAuthority != testHome+"/.Xauthority" || s.Bus != "unix:path=/run/user/1000/bus" ||
-		!strings.Contains(s.From, "i3") {
-		t.Fatalf("%+v %v", s, err)
-	}
-}
-
-func TestStopAsksThenForcesAndDetachStartsUnderTheServiceManager(t *testing.T) {
-	f := newFake(t)
-	f.desktopSession()
-	f.proc(20, 1000, "app", []string{"app"}, "s.scope")
-	f.proc(21, 1000, "app", []string{"app"}, "s.scope")
-	f.stubborn[21] = true
-	ended, killed := f.stop(time.Second, "app")
-	if len(ended) != 1 || ended[0] != 20 || len(killed) != 1 || killed[0] != 21 {
-		t.Fatalf("ended %v killed %v (%v)", ended, killed, f.signals)
-	}
-	s, _ := f.session()
-	if err := f.detach(s, "mesh-app", "/usr/bin/app", "--background"); err != nil {
-		t.Fatal(err)
-	}
-	want := "systemd-run --user --collect --quiet --unit=mesh-app --setenv=DISPLAY=:1 --setenv=XAUTHORITY=" + testHome +
-		"/.Xauthority -- /usr/bin/app --background"
-	if !f.called("systemctl --user stop mesh-app.service") || !f.called(want) {
-		t.Fatalf("%q", f.calls)
-	}
-}
-
-func TestAnAutostartEntryOfTheAccountOverridesTheSystemsAndHiddenStartsNothing(t *testing.T) {
-	f := newFake(t)
-	if a := f.autostart("x.desktop"); a.Starts || a.Because == "" {
-		t.Fatalf("%+v", a)
-	}
-	f.write("/etc/xdg/autostart/x.desktop", "[Desktop Entry]\nExec=x-applet\n[Desktop Action y]\nExec=other\n")
-	if a := f.autostart("x.desktop"); !a.Starts || a.Exec != "x-applet" || a.From != "/etc/xdg/autostart/x.desktop" {
-		t.Fatalf("%+v", a)
-	}
-	f.write(testHome+"/.config/autostart/x.desktop", "[Desktop Entry]\nExec=x-applet\nHidden=true\n")
-	if a := f.autostart("x.desktop"); a.Starts || a.Because != "Hidden=true" || a.From != "~/.config/autostart/x.desktop" {
-		t.Fatalf("%+v", a)
-	}
-}
-
-func TestAWindowManagerStartIsFoundInTheConfigurationAndItsDropIns(t *testing.T) {
-	f := newFake(t)
-	f.write(testHome+"/.config/i3/config", "exec --no-startup-id dex --autostart --environment i3\n# exec app\nbindsym $mod+a exec app\n")
-	f.write(testHome+"/.config/i3/config.d/50-x.conf", "exec_always --no-startup-id /usr/bin/app --flag\n")
-	got := f.i3Starts("app")
-	if len(got) != 1 || got[0] != "~/.config/i3/config.d/50-x.conf:1: exec_always --no-startup-id /usr/bin/app --flag" {
-		t.Fatalf("%q", got)
-	}
-}
-
-func TestACommandThatFailsIsNamed(t *testing.T) {
-	if err := failed(Output{Code: 127, Err: ErrNotInstalled}, "dex"); err == nil || !strings.Contains(err.Error(), "dex is not installed") {
-		t.Fatal(err)
-	}
-	if err := failed(Output{Code: 1, Stderr: "nope"}, "pacman", "-Q", "x"); err == nil || !strings.Contains(err.Error(), "pacman -Q x exited 1: nope") {
-		t.Fatal(err)
-	}
-	if err := failed(Output{}, "true"); err != nil {
-		t.Fatal(err)
-	}
-}
-
-func TestTheRealRunnerBoundsTimeAndOutput(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 200*time.Millisecond)
-	defer cancel()
-	if o := execRun(ctx, nil, "sleep", "5"); o.Err != ErrTimedOut {
-		t.Fatalf("%+v", o)
-	}
-	if o := execRun(context.Background(), nil, "no-such-program-here"); o.Err != ErrNotInstalled {
-		t.Fatalf("%+v", o)
-	}
-	o := execRun(context.Background(), nil, "head", "-c", strconv.Itoa(MostOutput+10), "/dev/zero")
-	if !o.Cut || len(o.Stdout) != MostOutput {
-		t.Fatalf("cut %v, %d bytes", o.Cut, len(o.Stdout))
-	}
-}