adwaita: the theme as a module, dark by default, for GTK, Qt, the portal and the cursor (hq ADR 0208)

GTK 3/4 settings, qt6ct, portals.conf and the default cursor as owned files.
GTK_THEME, GTK2_RC_FILES, the Qt words and XCURSOR_* as environment
contributions. The GSettings keys the portal serves go in the xinitrc slot,
replacing the predecessor's appearance script, and the cursor in the
xresources slot.

Qt is drawn by Fusion with qt6ct's darker palette instead of the
user-repository adwaita-qt, which is no longer developed. qt5ct is dropped. The
fonts are research 026's Inter and JetBrains Mono, and portals.conf routes the
Secret interface to gnome-keyring, which nothing answered.

The tools are appearance (dark or light per audience, switched for the session),
cursor, icons, and portal-check (which backend answers which interface, and why).

modules/adwaita/README.md

@@ -0,0 +1,103 @@
+# adwaita
+
+The desktop's theme as a module (novox/hq ADR 0208, research 026, to-be 42 phase 2, step 6): Adwaita
+for GTK, Qt, the portal and the cursor, dark by default. It claims no seat, because themes coexist.
+
+- **Packages:** `gnome-themes-extra` (Adwaita-dark for GTK 2 and 3), `adwaita-icon-theme`,
+  `adwaita-cursors`, `qt6ct`, `xdg-desktop-portal-gtk`.
+- **Environment** (ADR 0203), the five words today's `~/.xinitrc` exported plus the cursor:
+  - `GTK_THEME=Adwaita:dark`;
+  - `GTK2_RC_FILES=/usr/share/themes/Adwaita-dark/gtk-2.0/gtkrc`;
+  - `QT_QPA_PLATFORMTHEME=qt6ct`;
+  - `QT_STYLE_OVERRIDE=Fusion`;
+  - `QT_SELECT=6`;
+  - `XCURSOR_THEME=Adwaita`, `XCURSOR_SIZE=24`.
+- **Session code** (ADR 0208 §4):
+  - in the `xinitrc` slot `normal`, the GSettings keys the portal serves (dark, the GTK and icon theme,
+    the cursor, the UI and monospace fonts), set at every session start. This replaces the
+    predecessor's `~/scripts/xdg-appearance`;
+  - in the `xresources` slot `normal`, `Xcursor.theme` and `Xcursor.size`.
+
+## What it owns
+
+| path | class | from |
+|---|---|---|
+| `~/.config/gtk-3.0/settings.ini` | owned (the found file kept once) | [`config/gtk-settings.ini`](config/gtk-settings.ini) |
+| `~/.config/gtk-4.0/settings.ini` | owned | the same file |
+| `~/.config/qt6ct/qt6ct.conf` | owned | [`config/qt6ct.conf`](config/qt6ct.conf) |
+| `~/.config/xdg-desktop-portal/portals.conf` | owned | [`config/portals.conf`](config/portals.conf) |
+| `~/.icons/default/index.theme` | owned | [`config/cursor-index.theme`](config/cursor-index.theme): the cursor for programs that read neither `XCURSOR_THEME` nor the resources |
+
+**`qt6ct.conf` is the mesh's now.** A change made in qt6ct's own window is replaced at the next push,
+and the window's saved geometry goes with it. The theme is this module's to say. Settings will make it
+the operator's (issue 168).
+
+## What it improves
+
+- **No package from the user repository.** Today's Qt style, `adwaita-dark` (`QT_STYLE_OVERRIDE` and
+  qt6ct's `Adwaita-Dark`), comes from the user repository's `adwaita-qt5`/`adwaita-qt6-git`, a
+  project that is no longer developed. The module uses Qt's own **Fusion** style with qt6ct's
+  **`darker`** palette, both shipped with Qt and qt6ct. **This is the one visible change:** Qt
+  programs keep a dark palette, drawn by Fusion instead of Adwaita-Qt.
+- **One Qt tool.** `qt5ct` is gone (installed on the desktop only, with a configuration on both).
+  `QT_SELECT=6` and `qt6ct` cover the Qt 6 programs. A Qt 5 program gets Fusion through
+  `QT_STYLE_OVERRIDE`, but not the palette.
+- **The fonts research 026/04 chose:** Inter 11 for GTK, Qt and GSettings' interface font, and
+  JetBrains Mono Nerd Font for Qt's fixed font and GSettings' monospace. Today these are Noto Sans 12,
+  Adwaita Sans 11 and nothing.
+- **The cursor said everywhere**: GTK's settings, GSettings, `XCURSOR_*`, the X resources and the
+  default theme. Today only the resources and GSettings said it.
+- **The portal answers secrets.** `portals.conf` routes `org.freedesktop.impl.portal.Secret` to
+  gnome-keyring. Today `adwaita_portal_check` shows no backend answering it: gtk does not implement
+  it, and gnome-keyring's backend names only GNOME.
+
+## Tools
+
+| tool | | what |
+|---|---|---|
+| `adwaita_appearance` | r/a | dark or light as each audience sees it (GSettings, the portal's own answer, the GTK files, Qt's style and palette, the theme words in the user manager). `mode` switches GSettings for the session, and the answer says what follows live (programs asking the portal) and what stays dark (GTK 3 under `GTK_THEME`, the declared files) |
+| `adwaita_cursor` | r/a | the cursor in GSettings, the resources and the environment, and the cursor themes installed; set theme or size for new windows (GSettings, and the resources when a session runs) |
+| `adwaita_icons` | r | icon themes installed (where, what each inherits, whether it has cursors), and the one GSettings, GTK and Qt use |
+| `adwaita_portal_check` | r | the backends installed and what each implements, which `portals.conf` decides (the first that exists, in xdg-desktop-portal's order), the backend answering each interface, what runs on the bus, and the colour scheme the portal answers |
+
+Each reaches GSettings, the portal and the user manager on the account's bus. Only the cursor's X
+resources need the session. From the user manager it reads only the theme's own words.
+
+**The appearance is a session's choice.** A persistent dark or light, for the files too, is a setting
+and waits for issue 168. Until then the module's default is dark, and `mode` lasts until the next
+login.
+
+## What it leaves found
+
+`~/.config/qt5ct/`, `~/.config/gtk-3.0/bookmarks` and everything else in those directories,
+`~/scripts/xdg-appearance`, and the user repository's `adwaita-qt*` packages.
+
+## The one-off migration (ADR 0182)
+
+**Once `adwaita` is assigned:**
+
+1. In `~/.xinitrc`, the theme exports and `~/scripts/xdg-appearance || true` go (see `xorg`'s list).
+2. Delete `~/scripts/xdg-appearance`.
+3. In `~/.Xresources`, delete the two `Xcursor` lines.
+4. Delete `~/.config/qt5ct/`.
+5. Remove the user repository's packages: `sudo pacman -Rns adwaita-qt5-git adwaita-qt6-git`
+   (laptop), `sudo pacman -Rns adwaita-qt5 adwaita-qt6-git adwaita-dark qt5ct` (desktop). Check first
+   that nothing else needs them (`pacman -Qi`).
+
+## What changes when it is assigned
+
+| | g14 | shanks |
+|---|---|---|
+| packages | none (all present) | the same |
+| GTK settings, `portals.conf` | the found files kept once, then the module's: adds the cursor and Inter, keeps Adwaita dark; `portals.conf` adds the Secret line | the same |
+| `qt6ct.conf` | Fusion with the `darker` palette, Inter and JetBrains Mono, instead of Adwaita-Dark with Noto Sans | the same |
+| `~/.icons/default/index.theme` | new | new |
+| environment | `QT_STYLE_OVERRIDE` becomes `Fusion`; `XCURSOR_*` added; the rest as `~/.xinitrc` exported them | the same |
+| running programs | **nothing**: settings are read at a program's start, and GSettings is set at the next login | the same |
+| next login | GSettings' fonts become Inter and JetBrains Mono. A secret request through the portal finds gnome-keyring | the same |
+
+## Blockers
+
+- **`fonts` first**, for Inter and JetBrains Mono. Without them, GTK and Qt fall back to the nearest
+  installed face.
+- **Light is a session's choice only**, until settings (issue 168).

modules/adwaita/cmd/adwaita-tools/adwaita_test.go

@@ -0,0 +1,246 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"adwaita/internal/desktop"
+)
+
+type manifest struct {
+	Capabilities []string `json:"capabilities"`
+	Claims       []any    `json:"claims"`
+	Tools        []string `json:"tools"`
+	Environment  struct {
+		Variables map[string]string `json:"variables"`
+	} `json:"environment"`
+	Shell []struct {
+		For, Slot, Code string
+	} `json:"shell"`
+	Resources []map[string]any `json:"resources"`
+}
+
+func readManifest(t *testing.T) manifest {
+	raw, err := os.ReadFile(filepath.Join("..", "..", "module.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var m manifest
+	if err := json.Unmarshal(raw, &m); err != nil {
+		t.Fatal(err)
+	}
+	return m
+}
+
+func TestItContributesTheThemesWordsAndClaimsNoSeat(t *testing.T) {
+	m := readManifest(t)
+	if m.Claims != nil {
+		t.Fatal("a theme is not a seat: several coexist")
+	}
+	want := map[string]string{"GTK_THEME": "Adwaita:dark", "GTK2_RC_FILES": "/usr/share/themes/Adwaita-dark/gtk-2.0/gtkrc",
+		"QT_QPA_PLATFORMTHEME": "qt6ct", "QT_STYLE_OVERRIDE": "Fusion", "QT_SELECT": "6", "XCURSOR_THEME": "Adwaita", "XCURSOR_SIZE": "24"}
+	if len(m.Environment.Variables) != len(want) {
+		t.Fatalf("%v", m.Environment.Variables)
+	}
+	for k, v := range want {
+		if m.Environment.Variables[k] != v {
+			t.Errorf("%s=%q", k, m.Environment.Variables[k])
+		}
+	}
+	served := map[string]bool{}
+	for _, tool := range tools(adwaita{}) {
+		served[tool.Name] = true
+	}
+	if len(served) != len(m.Tools) {
+		t.Fatalf("%v %v", served, m.Tools)
+	}
+	for _, n := range m.Tools {
+		if !served[n] {
+			t.Errorf("%s", n)
+		}
+	}
+}
+
+func TestTheSessionLinesSetGSettingsAndTheResourcesTheCursor(t *testing.T) {
+	m := readManifest(t)
+	if len(m.Shell) != 2 || m.Shell[0].For != "xresources" || m.Shell[1].For != "xinitrc" || m.Shell[0].Slot != "normal" || m.Shell[1].Slot != "normal" {
+		t.Fatalf("%+v", m.Shell)
+	}
+	if m.Shell[0].Code != "! adwaita: the cursor, for X programs that take it from the resources.\nXcursor.theme: Adwaita\nXcursor.size: 24\n" {
+		t.Fatalf("%q", m.Shell[0].Code)
+	}
+	x := m.Shell[1].Code
+	for _, want := range []string{"color-scheme 'prefer-dark'", "gtk-theme 'Adwaita'", "icon-theme 'Adwaita'", "cursor-theme 'Adwaita'", "font-name 'Inter 11'", "monospace-font-name 'JetBrainsMono Nerd Font 11'"} {
+		if !strings.Contains(x, want) {
+			t.Errorf("lacks %s", want)
+		}
+	}
+	for _, l := range strings.Split(strings.TrimSpace(x), "\n") {
+		if !strings.HasPrefix(l, "#") && !strings.HasSuffix(l, "|| true") {
+			t.Errorf("a session line that can stop the session's start: %q", l)
+		}
+	}
+}
+
+func TestItOwnsTheFilesItsSourcesHoldAndNoQt5Duplicate(t *testing.T) {
+	m := readManifest(t)
+	sources := map[string]string{"gtk3": "gtk-settings.ini", "gtk4": "gtk-settings.ini", "qt6ct": "qt6ct.conf", "portals": "portals.conf", "cursor": "cursor-index.theme"}
+	pkgs := []string{}
+	for _, r := range m.Resources {
+		id := r["id"].(string)
+		if r["type"] == "package" {
+			pkgs = append(pkgs, r["package"].(string))
+			continue
+		}
+		raw, _ := os.ReadFile(filepath.Join("..", "..", "config", sources[id]))
+		if r["content"] != string(raw) || r["into"] != nil || r["owner"] != "${machine:account}" {
+			t.Errorf("%s is not config/%s, whole and the account's", id, sources[id])
+		}
+		if strings.Contains(r["path"].(string), "qt5ct") {
+			t.Error("qt5ct: both workstations run Qt 6 programs through qt6ct; a second tool is a duplicate")
+		}
+	}
+	if strings.Join(pkgs, ",") != "gnome-themes-extra,adwaita-icon-theme,adwaita-cursors,qt6ct,xdg-desktop-portal-gtk" {
+		t.Fatalf("%v", pkgs)
+	}
+	qt := readINI(filepath.Join("..", "..", "config", "qt6ct.conf"))
+	if qt["Appearance"]["style"] != "Fusion" || qt["Appearance"]["custom_palette"] != "true" || !strings.Contains(qt["Fonts"]["general"], "Inter,11") {
+		t.Fatalf("%v", qt)
+	}
+	if _, err := os.Stat("/usr/share/qt6ct/colors"); err == nil {
+		if _, err := os.Stat(qt["Appearance"]["color_scheme_path"]); err != nil {
+			t.Fatalf("qt6ct ships no %s", qt["Appearance"]["color_scheme_path"])
+		}
+	}
+	gtk := readINI(filepath.Join("..", "..", "config", "gtk-settings.ini"))["Settings"]
+	if gtk["gtk-theme-name"] != "Adwaita" || gtk["gtk-application-prefer-dark-theme"] != "1" || gtk["gtk-font-name"] != "Inter 11" {
+		t.Fatalf("%v", gtk)
+	}
+}
+
+func TestKeyFilesAreReadWithTheirComments(t *testing.T) {
+	ini := ParseINI("# c\n[A]\nk = v\n; also a comment\n[B]\nx=1=2\n")
+	if ini["A"]["k"] != "v" || ini["B"]["x"] != "1=2" || len(ini) != 2 {
+		t.Fatalf("%v", ini)
+	}
+}
+
+func TestThePortalsAnswerIsResolvedAsXdgDesktopPortalDoes(t *testing.T) {
+	dir := t.TempDir()
+	os.WriteFile(filepath.Join(dir, "gtk.portal"), []byte("[portal]\nDBusName=org.freedesktop.impl.portal.desktop.gtk\nInterfaces=org.freedesktop.impl.portal.FileChooser;org.freedesktop.impl.portal.Settings;\nUseIn=gnome\n"), 0o644)
+	os.WriteFile(filepath.Join(dir, "gnome-keyring.portal"), []byte("[portal]\nDBusName=org.freedesktop.secrets\nInterfaces=org.freedesktop.impl.portal.Secret;\nUseIn=gnome\n"), 0o644)
+	os.WriteFile(filepath.Join(dir, "kde.portal"), []byte("[portal]\nDBusName=org.freedesktop.impl.portal.desktop.kde\nInterfaces=org.freedesktop.impl.portal.FileChooser;\nUseIn=KDE\n"), 0o644)
+	b := Backends([]string{dir})
+	if len(b) != 3 || b[0].Name != "gnome-keyring" || len(b[1].Interfaces) != 2 {
+		t.Fatalf("%+v", b)
+	}
+	got := Resolve(b, map[string]string{"default": "gtk", "org.freedesktop.impl.portal.Secret": "gnome-keyring"}, []string{"i3"})
+	if got["org.freedesktop.impl.portal.FileChooser"] != "gtk" || got["org.freedesktop.impl.portal.Secret"] != "gnome-keyring" || got["org.freedesktop.impl.portal.Settings"] != "gtk" {
+		t.Fatalf("%v", got)
+	}
+	got = Resolve(b, map[string]string{"default": "gtk"}, []string{"i3"})
+	if got["org.freedesktop.impl.portal.Secret"] != "(none)" {
+		t.Fatalf("gtk does not implement secrets: %v", got)
+	}
+	got = Resolve(b, map[string]string{"default": "none;gtk"}, nil)
+	if got["org.freedesktop.impl.portal.FileChooser"] != "(none)" {
+		t.Fatalf("none stops the list: %v", got)
+	}
+	got = Resolve(b, nil, []string{"KDE"})
+	if got["org.freedesktop.impl.portal.FileChooser"] != "kde" || got["org.freedesktop.impl.portal.Settings"] != "(none)" {
+		t.Fatalf("with no configuration, UseIn decides: %v", got)
+	}
+	c := PortalConfigs("/h", []string{"i3", "GNOME"})
+	if c[0] != "/h/.config/xdg-desktop-portal/i3-portals.conf" || c[1] != "/h/.config/xdg-desktop-portal/gnome-portals.conf" || c[2] != "/h/.config/xdg-desktop-portal/portals.conf" {
+		t.Fatalf("%v", c[:3])
+	}
+}
+
+func TestThemesAreFoundOnceEachWithCursorsAndIcons(t *testing.T) {
+	a, b := t.TempDir(), t.TempDir()
+	os.MkdirAll(filepath.Join(a, "Adwaita", "cursors"), 0o755)
+	os.MkdirAll(filepath.Join(b, "Adwaita"), 0o755)
+	os.WriteFile(filepath.Join(b, "Adwaita", "index.theme"), []byte("[Icon Theme]\nName=Adwaita\nInherits=hicolor\nDirectories=16x16\n"), 0o644)
+	os.MkdirAll(filepath.Join(b, "hicolor"), 0o755)
+	os.WriteFile(filepath.Join(b, "hicolor", "index.theme"), []byte("[Icon Theme]\nName=Hicolor\nDirectories=16x16\n"), 0o644)
+	os.MkdirAll(filepath.Join(b, "empty"), 0o755)
+	got := Themes([]string{a, b})
+	if len(got) != 2 || got[0].Name != "Adwaita" || !got[0].Cursors || got[0].Icons || got[0].Dir != filepath.Join(a, "Adwaita") || got[1].Name != "hicolor" {
+		t.Fatalf("the first directory's Adwaita hides the second's: %+v", got)
+	}
+}
+
+type fake struct {
+	ran []string
+	get map[string]string
+}
+
+func (f *fake) desk() desktop.Desk {
+	return desktop.Desk{
+		Find: func() (*desktop.Session, error) { return nil, &desktop.NoSession{Reason: "none"} },
+		Run: func(_ context.Context, env []string, _ []byte, name string, args ...string) desktop.Result {
+			line := strings.Join(append([]string{name}, args...), " ")
+			f.ran = append(f.ran, line)
+			switch {
+			case name == "gsettings" && args[0] == "get":
+				return desktop.Result{Stdout: "'" + f.get[args[2]] + "'\n"}
+			case name == "gsettings" && args[0] == "set":
+				f.get[args[2]] = args[3]
+			case name == "systemctl":
+				return desktop.Result{Stdout: "GTK_THEME=Adwaita:dark\nNPM_TOKEN=secret\nXDG_CURRENT_DESKTOP=i3\n"}
+			case name == "busctl" && args[1] == "call":
+				return desktop.Result{Stdout: "v u 1\n"}
+			}
+			return desktop.Result{}
+		},
+	}
+}
+
+func TestAppearanceSwitchesGSettingsAndSaysWhatFollowsAndWhatStays(t *testing.T) {
+	f := &fake{get: map[string]string{"color-scheme": "prefer-dark", "gtk-theme": "Adwaita"}}
+	a := adwaita{d: f.desk(), home: t.TempDir()}
+	got, err := a.appearance(context.Background(), desktop.Args{"mode": "light"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	j := asJSON(got)
+	if f.get["color-scheme"] != "prefer-light" || !strings.Contains(j, `"switched":"light"`) || !strings.Contains(j, "GTK_THEME=Adwaita:dark") || !strings.Contains(j, `"lasts"`) {
+		t.Fatalf("%s", j)
+	}
+	if strings.Contains(j, "secret") || strings.Contains(j, "NPM_TOKEN") {
+		t.Fatal("only the theme's words are read back from the user manager")
+	}
+	if _, err := a.appearance(context.Background(), desktop.Args{"mode": "blue"}); err == nil {
+		t.Fatal("mode is dark or light")
+	}
+	got, _ = a.appearance(context.Background(), desktop.Args{})
+	if strings.Contains(asJSON(got), "switched") {
+		t.Fatal("reading changes nothing")
+	}
+}
+
+func TestACursorThemeMustBeInstalledAndWithoutASessionOnlyGSettingsChanges(t *testing.T) {
+	dir := t.TempDir()
+	os.MkdirAll(filepath.Join(dir, "Adwaita", "cursors"), 0o755)
+	f := &fake{get: map[string]string{}}
+	a := adwaita{d: f.desk(), home: t.TempDir(), iconDirs: []string{dir}}
+	if _, err := a.cursor(context.Background(), desktop.Args{"theme": "Bibata"}); err == nil {
+		t.Fatal("a theme that is not installed")
+	}
+	got, err := a.cursor(context.Background(), desktop.Args{"theme": "Adwaita", "size": float64(32)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if f.get["cursor-theme"] != "Adwaita" || f.get["cursor-size"] != "32" || !strings.Contains(asJSON(got), "no graphical session") {
+		t.Fatalf("%v %s", f.get, asJSON(got))
+	}
+}
+
+func asJSON(v any) string {
+	b, _ := json.Marshal(v)
+	return string(b)
+}

modules/adwaita/cmd/adwaita-tools/main.go

@@ -0,0 +1,84 @@
+// adwaita's tools (novox/hq ADR 0208, research 026/05): appearance (dark or light for GTK, Qt and the
+// portal at once), cursor, icons and portal-check. The predecessor's appearance script is folded into
+// the first, and into the module's session line.
+//
+// None needs the display except setting the cursor's X resources: GSettings, the portal and the user
+// manager are reached on the account's own bus, which exists whenever the operator's user manager
+// runs.
+package main
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"time"
+
+	stdio "git.novox.be/novox/mesh-sdk/go"
+
+	"adwaita/internal/desktop"
+)
+
+func main() {
+	home := desktop.Home()
+	a := adwaita{
+		d: desktop.Machine("i3", "sway"), home: home,
+		iconDirs:   []string{filepath.Join(home, ".local", "share", "icons"), filepath.Join(home, ".icons"), "/usr/local/share/icons", "/usr/share/icons"},
+		portalDirs: []string{"/usr/share/xdg-desktop-portal/portals"},
+		uid:        os.Getuid(),
+	}
+	if err := stdio.Serve("", tools(a)); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+}
+
+func call(run func(ctx context.Context, a desktop.Args) (any, error)) func(map[string]any) (any, error) {
+	return func(args map[string]any) (any, error) {
+		ctx, cancel := context.WithTimeout(context.Background(), 25*time.Second)
+		defer cancel()
+		return run(ctx, desktop.Args(args))
+	}
+}
+
+func tools(a adwaita) []stdio.Tool {
+	return []stdio.Tool{
+		{
+			Name: "adwaita_appearance",
+			Description: "Dark or light, as each audience sees it now: GSettings (which the portal serves to " +
+				"Electron, Firefox and flatpaks), the portal's own answer, the GTK settings files, Qt's palette " +
+				"and the theme words in the user manager's environment. With mode, switch GSettings for the " +
+				"running session and answer which audiences follow live and which keep the module's dark " +
+				"default until it is a setting.",
+			Input: desktop.Schema(map[string]any{"mode": desktop.Enum("switch to (optional)", "dark", "light")}),
+			Run:   call(a.appearance),
+		},
+		{
+			Name: "adwaita_cursor",
+			Description: "The cursor theme and size in force (GSettings, the X resources, XCURSOR_* in the user " +
+				"manager) and the cursor themes installed. With theme and/or size, set them for windows opened " +
+				"from now on; the module's defaults return at the next login.",
+			Input: desktop.Schema(map[string]any{
+				"theme": desktop.Str("an installed cursor theme"),
+				"size":  desktop.Int("pixels, 8 to 256"),
+			}),
+			Run: call(a.cursor),
+		},
+		{
+			Name: "adwaita_icons",
+			Description: "The icon themes installed (name, where, what each inherits, whether it carries cursors) " +
+				"and the one GTK and Qt are set to use.",
+			Input: desktop.Schema(map[string]any{}),
+			Run:   call(a.icons),
+		},
+		{
+			Name: "adwaita_portal_check",
+			Description: "Which xdg-desktop-portal backend answers which interface for this desktop: the backends " +
+				"installed and what they implement, the portals.conf that decides (and which one won), the " +
+				"resulting backend per interface, whether the portal and each backend are running on the " +
+				"account's bus, and the colour scheme the portal answers.",
+			Input: desktop.Schema(map[string]any{}),
+			Run:   call(a.portalCheck),
+		},
+	}
+}

modules/adwaita/cmd/adwaita-tools/tools.go

@@ -0,0 +1,434 @@
+package main
+
+import (
+	"bufio"
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"regexp"
+	"sort"
+	"strconv"
+	"strings"
+
+	"adwaita/internal/desktop"
+)
+
+type adwaita struct {
+	d          desktop.Desk
+	home       string
+	iconDirs   []string
+	portalDirs []string
+	uid        int
+}
+
+const iface = "org.gnome.desktop.interface"
+
+// ParseINI reads a key file (GTK's settings.ini, qt6ct.conf, a .portal, index.theme): sections of
+// key=value, `#` and `;` comments.
+func ParseINI(text string) map[string]map[string]string {
+	out := map[string]map[string]string{}
+	section := ""
+	sc := bufio.NewScanner(strings.NewReader(text))
+	for sc.Scan() {
+		l := strings.TrimSpace(sc.Text())
+		if l == "" || strings.HasPrefix(l, "#") || strings.HasPrefix(l, ";") {
+			continue
+		}
+		if strings.HasPrefix(l, "[") && strings.HasSuffix(l, "]") {
+			section = l[1 : len(l)-1]
+			continue
+		}
+		if k, v, ok := strings.Cut(l, "="); ok {
+			if out[section] == nil {
+				out[section] = map[string]string{}
+			}
+			out[section][strings.TrimSpace(k)] = strings.TrimSpace(v)
+		}
+	}
+	return out
+}
+
+func readINI(path string) map[string]map[string]string {
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return nil
+	}
+	return ParseINI(string(b))
+}
+
+// gsetting is one GSettings value, unquoted.
+func (a adwaita) gsetting(ctx context.Context, schema, key string) (string, error) {
+	r := a.d.AsUser(ctx, "gsettings", "get", schema, key)
+	if !r.OK() {
+		return "", r.Err()
+	}
+	return strings.Trim(strings.TrimSpace(r.Stdout), "'"), nil
+}
+
+// themeWords are the words of the user manager's environment the theme is about; nothing else of it
+// is read back.
+var themeWords = []string{"GTK_THEME", "GTK2_RC_FILES", "QT_QPA_PLATFORMTHEME", "QT_STYLE_OVERRIDE", "QT_SELECT",
+	"XCURSOR_THEME", "XCURSOR_SIZE", "XDG_CURRENT_DESKTOP"}
+
+func (a adwaita) userEnvironment(ctx context.Context) map[string]string {
+	r := a.d.AsUser(ctx, "systemctl", "--user", "show-environment")
+	all := desktop.ParseProperties(r.Stdout)
+	out := map[string]string{}
+	for _, w := range themeWords {
+		if v, ok := all[w]; ok {
+			out[w] = v
+		}
+	}
+	return out
+}
+
+var portalScheme = regexp.MustCompile(`^v u (\d)`)
+
+// portalColourScheme asks the portal what it tells applications: 0 no preference, 1 dark, 2 light.
+func (a adwaita) portalColourScheme(ctx context.Context) string {
+	r := a.d.AsUser(ctx, "busctl", "--user", "call", "org.freedesktop.portal.Desktop", "/org/freedesktop/portal/desktop",
+		"org.freedesktop.portal.Settings", "ReadOne", "ss", "org.freedesktop.appearance", "color-scheme")
+	m := portalScheme.FindStringSubmatch(strings.TrimSpace(r.Stdout))
+	if !r.OK() || m == nil {
+		return "unanswered"
+	}
+	return map[string]string{"0": "no-preference", "1": "dark", "2": "light"}[m[1]]
+}
+
+func (a adwaita) appearance(ctx context.Context, args desktop.Args) (any, error) {
+	mode := args.Opt("mode", "")
+	if mode != "" && mode != "dark" && mode != "light" {
+		return nil, fmt.Errorf("mode is dark or light")
+	}
+	if mode != "" {
+		scheme := map[string]string{"dark": "prefer-dark", "light": "prefer-light"}[mode]
+		if r := a.d.AsUser(ctx, "gsettings", "set", iface, "color-scheme", scheme); !r.OK() {
+			return nil, r.Err()
+		}
+	}
+	scheme, err := a.gsetting(ctx, iface, "color-scheme")
+	if err != nil {
+		return nil, fmt.Errorf("GSettings does not answer on the account's bus: %w", err)
+	}
+	gtkTheme, _ := a.gsetting(ctx, iface, "gtk-theme")
+	gtk3 := readINI(filepath.Join(a.home, ".config", "gtk-3.0", "settings.ini"))["Settings"]
+	gtk4 := readINI(filepath.Join(a.home, ".config", "gtk-4.0", "settings.ini"))["Settings"]
+	qt := readINI(filepath.Join(a.home, ".config", "qt6ct", "qt6ct.conf"))["Appearance"]
+	env := a.userEnvironment(ctx)
+	answer := map[string]any{
+		"gsettings":   map[string]string{"color-scheme": scheme, "gtk-theme": gtkTheme},
+		"portal":      a.portalColourScheme(ctx),
+		"gtk3":        map[string]string{"theme": gtk3["gtk-theme-name"], "prefer-dark": gtk3["gtk-application-prefer-dark-theme"]},
+		"gtk4":        map[string]string{"theme": gtk4["gtk-theme-name"], "prefer-dark": gtk4["gtk-application-prefer-dark-theme"]},
+		"qt":          map[string]string{"style": qt["style"], "palette": filepath.Base(qt["color_scheme_path"])},
+		"environment": env,
+	}
+	if mode != "" {
+		var stays []string
+		if strings.HasSuffix(env["GTK_THEME"], ":dark") && mode == "light" {
+			stays = append(stays, "GTK 3 programs: GTK_THEME="+env["GTK_THEME"]+" in the environment pins them dark")
+		}
+		if mode == "light" {
+			stays = append(stays, "the GTK settings files and Qt's palette, which the module declares dark")
+		}
+		answer["switched"] = mode
+		answer["follows_live"] = "programs asking the portal: Electron, Chromium, Firefox, libadwaita and flatpaks"
+		if len(stays) > 0 {
+			answer["stays"] = stays
+		}
+		answer["lasts"] = "until the next login, which sets the module's default (dark) again; a persistent choice waits for settings (hq issue 168)"
+	}
+	return answer, nil
+}
+
+// Theme is one installed icon or cursor theme.
+type Theme struct {
+	Name     string   `json:"name"`
+	Dir      string   `json:"dir"`
+	Title    string   `json:"title,omitempty"`
+	Inherits []string `json:"inherits,omitempty"`
+	Cursors  bool     `json:"cursors"`
+	Icons    bool     `json:"icons"`
+}
+
+// Themes lists the themes in dirs; a name found earlier hides the same name later, as lookups do.
+func Themes(dirs []string) []Theme {
+	seen := map[string]bool{}
+	var out []Theme
+	for _, d := range dirs {
+		entries, _ := os.ReadDir(d)
+		for _, e := range entries {
+			if !e.IsDir() && e.Type()&os.ModeSymlink == 0 || seen[e.Name()] {
+				continue
+			}
+			dir := filepath.Join(d, e.Name())
+			t := Theme{Name: e.Name(), Dir: dir}
+			if info, err := os.Stat(filepath.Join(dir, "cursors")); err == nil && info.IsDir() {
+				t.Cursors = true
+			}
+			if ini := readINI(filepath.Join(dir, "index.theme")); ini != nil {
+				th := ini["Icon Theme"]
+				t.Title = th["Name"]
+				if th["Directories"] != "" {
+					t.Icons = true
+				}
+				for _, i := range strings.Split(th["Inherits"], ",") {
+					if i = strings.TrimSpace(i); i != "" {
+						t.Inherits = append(t.Inherits, i)
+					}
+				}
+			}
+			if !t.Cursors && !t.Icons && t.Title == "" {
+				continue
+			}
+			seen[e.Name()] = true
+			out = append(out, t)
+		}
+	}
+	sort.Slice(out, func(i, j int) bool { return out[i].Name < out[j].Name })
+	return out
+}
+
+var cursorName = regexp.MustCompile(`^[A-Za-z0-9._ -]{1,64}$`)
+
+func (a adwaita) cursor(ctx context.Context, args desktop.Args) (any, error) {
+	theme := args.Opt("theme", "")
+	size, err := args.Whole("size", 0, 8, 256)
+	if err != nil {
+		return nil, err
+	}
+	var cursors []string
+	installed := map[string]bool{}
+	for _, t := range Themes(a.iconDirs) {
+		if t.Cursors {
+			cursors = append(cursors, t.Name)
+			installed[t.Name] = true
+		}
+	}
+	changed := theme != "" || size != 0
+	if theme != "" && (!cursorName.MatchString(theme) || !installed[theme]) {
+		return nil, fmt.Errorf("%q is not an installed cursor theme; installed: %s", theme, strings.Join(cursors, ", "))
+	}
+	var resources []string
+	if theme != "" {
+		if r := a.d.AsUser(ctx, "gsettings", "set", iface, "cursor-theme", theme); !r.OK() {
+			return nil, r.Err()
+		}
+		resources = append(resources, "Xcursor.theme: "+theme)
+	}
+	if size != 0 {
+		if r := a.d.AsUser(ctx, "gsettings", "set", iface, "cursor-size", strconv.Itoa(size)); !r.OK() {
+			return nil, r.Err()
+		}
+		resources = append(resources, "Xcursor.size: "+strconv.Itoa(size))
+	}
+	answer := map[string]any{"installed": cursors}
+	gTheme, _ := a.gsetting(ctx, iface, "cursor-theme")
+	gSize, _ := a.gsetting(ctx, iface, "cursor-size")
+	answer["gsettings"] = map[string]string{"cursor-theme": gTheme, "cursor-size": gSize}
+	env := a.userEnvironment(ctx)
+	answer["environment"] = map[string]string{"XCURSOR_THEME": env["XCURSOR_THEME"], "XCURSOR_SIZE": env["XCURSOR_SIZE"]}
+	if s, err := a.d.Find(); err == nil {
+		senv := s.Env(a.d.Base)
+		if len(resources) > 0 {
+			if r := a.d.Run(ctx, senv, []byte(strings.Join(resources, "\n")+"\n"), "xrdb", "-nocpp", "-merge", "-"); !r.OK() {
+				return nil, r.Err()
+			}
+		}
+		q := a.d.Run(ctx, senv, nil, "xrdb", "-query")
+		x := map[string]string{}
+		for _, l := range strings.Split(q.Stdout, "\n") {
+			if k, v, ok := strings.Cut(l, ":"); ok && strings.HasPrefix(k, "Xcursor.") {
+				x[k] = strings.TrimSpace(v)
+			}
+		}
+		answer["x_resources"] = x
+	} else {
+		answer["x_resources"] = nil
+		if changed {
+			answer["note"] = "no graphical session: GSettings changed, the X resources not"
+		}
+	}
+	if changed {
+		answer["lasts"] = "for windows opened from now on, until the next login"
+	}
+	return answer, nil
+}
+
+func (a adwaita) icons(ctx context.Context, args desktop.Args) (any, error) {
+	var themes []Theme
+	for _, t := range Themes(a.iconDirs) {
+		if t.Icons {
+			themes = append(themes, t)
+		}
+	}
+	gtk3 := readINI(filepath.Join(a.home, ".config", "gtk-3.0", "settings.ini"))["Settings"]
+	qt := readINI(filepath.Join(a.home, ".config", "qt6ct", "qt6ct.conf"))["Appearance"]
+	g, _ := a.gsetting(ctx, iface, "icon-theme")
+	return map[string]any{
+		"installed": themes,
+		"in_use":    map[string]string{"gsettings": g, "gtk": gtk3["gtk-icon-theme-name"], "qt": qt["icon_theme"]},
+	}, nil
+}
+
+// Backend is one installed portal backend.
+type Backend struct {
+	Name       string   `json:"name"`
+	DBusName   string   `json:"dbus_name"`
+	Interfaces []string `json:"interfaces"`
+	UseIn      []string `json:"use_in,omitempty"`
+	Running    bool     `json:"running"`
+}
+
+func splitList(v string) []string {
+	var out []string
+	for _, x := range strings.Split(v, ";") {
+		if x = strings.TrimSpace(x); x != "" {
+			out = append(out, x)
+		}
+	}
+	return out
+}
+
+// Backends reads the installed `.portal` files.
+func Backends(dirs []string) []Backend {
+	var out []Backend
+	for _, d := range dirs {
+		files, _ := filepath.Glob(filepath.Join(d, "*.portal"))
+		sort.Strings(files)
+		for _, f := range files {
+			p := readINI(f)["portal"]
+			out = append(out, Backend{Name: strings.TrimSuffix(filepath.Base(f), ".portal"), DBusName: p["DBusName"],
+				Interfaces: splitList(p["Interfaces"]), UseIn: splitList(p["UseIn"])})
+		}
+	}
+	return out
+}
+
+// PortalConfigs are the files xdg-desktop-portal looks for, in its order (portals.conf(5)): for each
+// directory, `<desktop>-portals.conf` for each of the desktops named, then `portals.conf`. The first
+// that exists decides everything.
+func PortalConfigs(home string, desktops []string) []string {
+	dirs := []string{
+		filepath.Join(home, ".config", "xdg-desktop-portal"), "/etc/xdg/xdg-desktop-portal", "/etc/xdg-desktop-portal",
+		filepath.Join(home, ".local", "share", "xdg-desktop-portal"), "/usr/local/share/xdg-desktop-portal", "/usr/share/xdg-desktop-portal",
+	}
+	var out []string
+	for _, d := range dirs {
+		for _, desk := range desktops {
+			out = append(out, filepath.Join(d, strings.ToLower(desk)+"-portals.conf"))
+		}
+		out = append(out, filepath.Join(d, "portals.conf"))
+	}
+	return out
+}
+
+// Resolve says which backend answers each interface the backends implement, given the deciding
+// file's [preferred] section: an interface's own key first, else `default`; each a list of backend
+// names, the first one that implements the interface wins; `none` answers nothing, `*` any.
+// With no file, a backend whose UseIn names the desktop answers.
+func Resolve(backends []Backend, preferred map[string]string, desktops []string) map[string]string {
+	out := map[string]string{}
+	implements := func(b Backend, i string) bool {
+		for _, x := range b.Interfaces {
+			if x == i {
+				return true
+			}
+		}
+		return false
+	}
+	var all []string
+	seen := map[string]bool{}
+	for _, b := range backends {
+		for _, i := range b.Interfaces {
+			if !seen[i] {
+				seen[i] = true
+				all = append(all, i)
+			}
+		}
+	}
+	sort.Strings(all)
+	for _, i := range all {
+		var want []string
+		if preferred != nil {
+			if v, ok := preferred[i]; ok {
+				want = splitList(v)
+			} else {
+				want = splitList(preferred["default"])
+			}
+		} else {
+			for _, b := range backends {
+				for _, u := range b.UseIn {
+					for _, d := range desktops {
+						if strings.EqualFold(u, d) {
+							want = append(want, b.Name)
+						}
+					}
+				}
+			}
+		}
+		out[i] = "(none)"
+	pick:
+		for _, w := range want {
+			if w == "none" {
+				break
+			}
+			for _, b := range backends {
+				if (w == "*" || w == b.Name) && implements(b, i) {
+					out[i] = b.Name
+					break pick
+				}
+			}
+		}
+	}
+	return out
+}
+
+func (a adwaita) portalCheck(ctx context.Context, args desktop.Args) (any, error) {
+	env := a.userEnvironment(ctx)
+	desktops := splitColon(env["XDG_CURRENT_DESKTOP"])
+	backends := Backends(a.portalDirs)
+	names := map[string]bool{}
+	if r := a.d.AsUser(ctx, "busctl", "--user", "list", "--no-legend", "--no-pager"); r.OK() {
+		for _, l := range strings.Split(r.Stdout, "\n") {
+			if f := strings.Fields(l); len(f) > 1 && f[1] != "-" {
+				names[f[0]] = true
+			}
+		}
+	}
+	for i := range backends {
+		backends[i].Running = names[backends[i].DBusName]
+	}
+	var decided string
+	var preferred map[string]string
+	looked := PortalConfigs(a.home, desktops)
+	for _, f := range looked {
+		if ini := readINI(f); ini != nil {
+			decided, preferred = f, ini["preferred"]
+			if preferred == nil {
+				preferred = map[string]string{}
+			}
+			break
+		}
+	}
+	return map[string]any{
+		"desktop":       env["XDG_CURRENT_DESKTOP"],
+		"portal":        map[string]bool{"running": names["org.freedesktop.portal.Desktop"]},
+		"backends":      backends,
+		"decided_by":    decided,
+		"preferred":     preferred,
+		"answers":       Resolve(backends, preferred, desktops),
+		"colour_scheme": a.portalColourScheme(ctx),
+	}, nil
+}
+
+func splitColon(v string) []string {
+	var out []string
+	for _, x := range strings.Split(v, ":") {
+		if x = strings.TrimSpace(x); x != "" {
+			out = append(out, x)
+		}
+	}
+	return out
+}

modules/adwaita/config/cursor-index.theme

@@ -0,0 +1,5 @@
+# Written by the mesh (module adwaita, novox/hq ADR 0208): the default cursor theme, for programs that
+# read neither XCURSOR_THEME nor the X resources.
+[Icon Theme]
+Name=Default
+Inherits=Adwaita

modules/adwaita/config/gtk-settings.ini

@@ -0,0 +1,9 @@
+# Written by the mesh (module adwaita, novox/hq ADR 0208), for GTK 3 and GTK 4 alike. Replaced at
+# every push; adwaita_appearance switches dark and light for the running session.
+[Settings]
+gtk-theme-name=Adwaita
+gtk-icon-theme-name=Adwaita
+gtk-cursor-theme-name=Adwaita
+gtk-cursor-theme-size=24
+gtk-font-name=Inter 11
+gtk-application-prefer-dark-theme=1

modules/adwaita/config/portals.conf

@@ -0,0 +1,11 @@
+# Written by the mesh (module adwaita, novox/hq ADR 0208). Replaced at every push.
+#
+# Which portal backend answers each interface. i3 is not a desktop xdg-desktop-portal knows, so with
+# no preference it uses whichever backend happens to be installed: fine while gtk is the only one,
+# wrong the day another arrives as somebody else's dependency. Named instead. gtk also serves
+# org.freedesktop.appearance (dark or light) from GSettings, which the session's start sets.
+[preferred]
+default=gtk
+# Secrets for sandboxed programs come from the keyring's backend. Without this line no backend answers
+# the interface: gtk does not implement it, and gnome-keyring's names only GNOME as its desktop.
+org.freedesktop.impl.portal.Secret=gnome-keyring

modules/adwaita/config/qt6ct.conf

@@ -0,0 +1,29 @@
+[Appearance]
+color_scheme_path=/usr/share/qt6ct/colors/darker.conf
+custom_palette=true
+icon_theme=Adwaita
+standard_dialogs=default
+style=Fusion
+
+[Fonts]
+fixed="JetBrainsMono Nerd Font,11,-1,5,50,0,0,0,0,0"
+general="Inter,11,-1,5,50,0,0,0,0,0"
+
+[Interface]
+activate_item_on_single_click=1
+buttonbox_layout=0
+cursor_flash_time=1000
+dialog_buttons_have_icons=1
+double_click_interval=400
+gui_effects=@Invalid()
+keyboard_scheme=2
+menus_have_icons=true
+show_shortcuts_in_context_menus=true
+stylesheets=@Invalid()
+toolbutton_style=4
+underline_shortcut=1
+wheel_scroll_lines=3
+
+[Troubleshooting]
+force_raster_widgets=1
+ignored_applications=@Invalid()

modules/adwaita/go.mod

@@ -0,0 +1,5 @@
+module adwaita
+
+go 1.22
+
+require git.novox.be/novox/mesh-sdk/go v0.1.7

modules/adwaita/go.sum

@@ -0,0 +1,2 @@
+git.novox.be/novox/mesh-sdk/go v0.1.7 h1:C0sTQmtTiyYH7bnqZb7PusXnqA37gKuT7Nqjn9gG47w=
+git.novox.be/novox/mesh-sdk/go v0.1.7/go.mod h1:GFuZUElBZ9A++mxgIKo97aXXo+kV0uJ/UkbhQPPIbrY=

modules/adwaita/internal/desktop/args.go

@@ -0,0 +1,160 @@
+package desktop
+
+import (
+	"fmt"
+	"math"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+// Args reads a tool's arguments as JSON decoded them: strings, float64 numbers, booleans.
+type Args map[string]any
+
+// Text is a required string, trimmed.
+func (a Args) Text(name string) (string, error) {
+	v, ok := a[name].(string)
+	if !ok || strings.TrimSpace(v) == "" {
+		return "", fmt.Errorf("%s is required, as text", name)
+	}
+	return strings.TrimSpace(v), nil
+}
+
+// Opt is an optional string, trimmed, or def.
+func (a Args) Opt(name, def string) string {
+	if v, ok := a[name].(string); ok && strings.TrimSpace(v) != "" {
+		return strings.TrimSpace(v)
+	}
+	return def
+}
+
+// Has is whether the caller gave the argument at all.
+func (a Args) Has(name string) bool {
+	v, ok := a[name]
+	return ok && v != nil
+}
+
+// Bool is an optional boolean: its value, and whether it was given.
+func (a Args) Bool(name string) (bool, bool, error) {
+	v, ok := a[name]
+	if !ok || v == nil {
+		return false, false, nil
+	}
+	b, isBool := v.(bool)
+	if !isBool {
+		return false, false, fmt.Errorf("%s is true or false", name)
+	}
+	return b, true, nil
+}
+
+// Number is an optional number: its value, and whether it was given.
+func (a Args) Number(name string) (float64, bool, error) {
+	v, ok := a[name]
+	if !ok || v == nil {
+		return 0, false, nil
+	}
+	f, isNum := v.(float64)
+	if !isNum || math.IsNaN(f) || math.IsInf(f, 0) {
+		return 0, false, fmt.Errorf("%s is a number", name)
+	}
+	return f, true, nil
+}
+
+// Whole is an optional whole number within [lo, hi], or def.
+func (a Args) Whole(name string, def, lo, hi int) (int, error) {
+	f, given, err := a.Number(name)
+	if err != nil {
+		return 0, err
+	}
+	if !given {
+		return def, nil
+	}
+	if f != math.Trunc(f) || f < float64(lo) || f > float64(hi) {
+		return 0, fmt.Errorf("%s is a whole number from %d to %d", name, lo, hi)
+	}
+	return int(f), nil
+}
+
+// OneOf is an optional string that must be one of choices, or def.
+func (a Args) OneOf(name, def string, choices ...string) (string, error) {
+	v := a.Opt(name, def)
+	for _, c := range choices {
+		if v == c {
+			return v, nil
+		}
+	}
+	return "", fmt.Errorf("%s is one of %s", name, strings.Join(choices, ", "))
+}
+
+// Strings is an optional list of strings.
+func (a Args) Strings(name string) ([]string, error) {
+	v, ok := a[name]
+	if !ok || v == nil {
+		return nil, nil
+	}
+	list, isList := v.([]any)
+	if !isList {
+		return nil, fmt.Errorf("%s is a list of text", name)
+	}
+	out := make([]string, 0, len(list))
+	for _, x := range list {
+		s, isText := x.(string)
+		if !isText {
+			return nil, fmt.Errorf("%s is a list of text", name)
+		}
+		out = append(out, s)
+	}
+	return out, nil
+}
+
+// Home is the operator account's home: the runtime's word for it, else this process's.
+func Home() string {
+	if h := os.Getenv("MESH_OPERATOR_HOME"); h != "" {
+		return h
+	}
+	if h, err := os.UserHomeDir(); err == nil {
+		return h
+	}
+	return "/"
+}
+
+// InHome resolves a path the caller gave: `~/x` and a relative path are under the home. A path
+// that leaves the home through `..` is refused, so a tool that writes never writes outside it.
+func InHome(path string) (string, error) {
+	home := Home()
+	switch {
+	case path == "~":
+		path = home
+	case strings.HasPrefix(path, "~/"):
+		path = filepath.Join(home, path[2:])
+	case !filepath.IsAbs(path):
+		path = filepath.Join(home, path)
+	}
+	path = filepath.Clean(path)
+	if path != home && !strings.HasPrefix(path, home+string(filepath.Separator)) {
+		return "", fmt.Errorf("%s is outside the account's home", path)
+	}
+	return path, nil
+}
+
+// Schema builds a tool's input schema from property descriptions; required names those that must
+// be given. A property is a string unless its description object says otherwise.
+func Schema(props map[string]any, required ...string) map[string]any {
+	s := map[string]any{"type": "object", "properties": props}
+	if len(required) > 0 {
+		s["required"] = required
+	}
+	return s
+}
+
+// Str, Num, Flag, List and Enum describe one property.
+func Str(desc string) map[string]any  { return map[string]any{"type": "string", "description": desc} }
+func Num(desc string) map[string]any  { return map[string]any{"type": "number", "description": desc} }
+func Int(desc string) map[string]any  { return map[string]any{"type": "integer", "description": desc} }
+func Flag(desc string) map[string]any { return map[string]any{"type": "boolean", "description": desc} }
+func List(desc string) map[string]any {
+	return map[string]any{"type": "array", "items": map[string]any{"type": "string"}, "description": desc}
+}
+func Enum(desc string, values ...string) map[string]any {
+	return map[string]any{"type": "string", "enum": values, "description": desc}
+}

modules/adwaita/internal/desktop/copies_test.go

@@ -0,0 +1,42 @@
+package desktop
+
+import (
+	"bytes"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// The desktop modules that carry this package. Each builds alone, so each has its own copy; this
+// test, itself one of the copied files, holds them to one text wherever the siblings are present.
+var carriers = []string{"xorg", "lemurs", "i3", "xterm", "adwaita"}
+
+func TestEveryDesktopModuleCarriesTheSameCopy(t *testing.T) {
+	mine, err := filepath.Glob("*.go")
+	if err != nil || len(mine) == 0 {
+		t.Fatal("no files of this package found", err)
+	}
+	compared := 0
+	for _, module := range carriers {
+		dir := filepath.Join("..", "..", "..", module, "internal", "desktop")
+		if _, err := os.Stat(dir); err != nil {
+			continue
+		}
+		theirs, _ := filepath.Glob(filepath.Join(dir, "*.go"))
+		if len(theirs) != len(mine) {
+			t.Errorf("%s carries %d files of this package, this copy %d", module, len(theirs), len(mine))
+			continue
+		}
+		for _, f := range mine {
+			a, _ := os.ReadFile(f)
+			b, err := os.ReadFile(filepath.Join(dir, f))
+			if err != nil || !bytes.Equal(a, b) {
+				t.Errorf("%s's copy of %s differs from this one: change every copy together", module, f)
+			}
+		}
+		compared++
+	}
+	if compared == 0 {
+		t.Log("no sibling copies beside this module")
+	}
+}

modules/adwaita/internal/desktop/run.go

@@ -0,0 +1,232 @@
+package desktop
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"strings"
+	"syscall"
+	"time"
+)
+
+// Bounds on a command a tool runs: well below the runtime's 30 s call limit, and an answer that
+// fits in a tool's reply.
+const (
+	DefaultTimeout = 10 * time.Second
+	MostOutput     = 256 << 10
+)
+
+// Result is what one command did.
+type Result struct {
+	Command   []string `json:"command"`
+	Code      int      `json:"exit_code"`
+	Stdout    string   `json:"stdout,omitempty"`
+	Stderr    string   `json:"stderr,omitempty"`
+	Truncated bool     `json:"truncated,omitempty"`
+	TimedOut  bool     `json:"timed_out,omitempty"`
+}
+
+// OK is whether the command ran and exited 0.
+func (r Result) OK() bool { return r.Code == 0 && !r.TimedOut }
+
+// Err is the command's failure as an error naming it and what it said, or nil.
+func (r Result) Err() error {
+	if r.OK() {
+		return nil
+	}
+	said := strings.TrimSpace(r.Stderr)
+	if said == "" {
+		said = strings.TrimSpace(r.Stdout)
+	}
+	if r.TimedOut {
+		return fmt.Errorf("%s did not finish in time", strings.Join(r.Command, " "))
+	}
+	return fmt.Errorf("%s exited %d: %s", strings.Join(r.Command, " "), r.Code, said)
+}
+
+// Runner runs a command with an environment and answers what it did. Tools take one, so their
+// tests replace the machine with a table of answers.
+type Runner func(ctx context.Context, env []string, stdin []byte, name string, args ...string) Result
+
+// Exec is the machine's Runner: the command in its own process group, ended with everything it
+// started at the deadline, each stream cut at MostOutput.
+func Exec(ctx context.Context, env []string, stdin []byte, name string, args ...string) Result {
+	if _, ok := ctx.Deadline(); !ok {
+		var cancel context.CancelFunc
+		ctx, cancel = context.WithTimeout(ctx, DefaultTimeout)
+		defer cancel()
+	}
+	res := Result{Command: append([]string{name}, args...)}
+	cmd := exec.Command(name, args...)
+	cmd.Env = env
+	cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
+	if stdin != nil {
+		cmd.Stdin = bytes.NewReader(stdin)
+	}
+	out, errb := &capped{}, &capped{}
+	cmd.Stdout, cmd.Stderr = out, errb
+	if err := cmd.Start(); err != nil {
+		res.Code = 127
+		res.Stderr = err.Error()
+		return res
+	}
+	done := make(chan error, 1)
+	go func() { done <- cmd.Wait() }()
+	var err error
+	select {
+	case err = <-done:
+	case <-ctx.Done():
+		_ = syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL)
+		err = <-done
+		res.TimedOut = true
+	}
+	res.Stdout, res.Stderr = out.String(), errb.String()
+	res.Truncated = out.cut || errb.cut
+	var exit *exec.ExitError
+	switch {
+	case err == nil:
+	case errors.As(err, &exit):
+		res.Code = exit.ExitCode()
+		if res.Code < 0 {
+			res.Code = 128
+		}
+	default:
+		res.Code = 1
+		if res.Stderr == "" {
+			res.Stderr = err.Error()
+		}
+	}
+	return res
+}
+
+// capped keeps the first MostOutput bytes written to it. Its buffer is a field, not embedded: an
+// embedded bytes.Buffer brings ReadFrom along, and io.Copy would use it and never call Write.
+type capped struct {
+	buf bytes.Buffer
+	cut bool
+}
+
+func (c *capped) Write(p []byte) (int, error) {
+	if room := MostOutput - c.buf.Len(); room < len(p) {
+		if room > 0 {
+			c.buf.Write(p[:room])
+		}
+		c.cut = true
+		return len(p), nil
+	}
+	return c.buf.Write(p)
+}
+
+func (c *capped) String() string { return c.buf.String() }
+
+// Desk is what a desktop tool needs: how to find the session, and how to run a command.
+type Desk struct {
+	Find func() (*Session, error)
+	Run  Runner
+	// Base is the environment a command starts from, before the session's words.
+	Base []string
+}
+
+// Machine is the real Desk, preferring the named processes as the session's.
+func Machine(prefer ...string) Desk {
+	return Desk{
+		Find: func() (*Session, error) { return Find(prefer...) },
+		Run:  Exec,
+		Base: os.Environ(),
+	}
+}
+
+// InSession runs a command in the operator's session, or answers NoSession.
+func (d Desk) InSession(ctx context.Context, name string, args ...string) (Result, *Session, error) {
+	s, err := d.Find()
+	if err != nil {
+		return Result{}, nil, err
+	}
+	return d.Run(ctx, s.Env(d.Base), nil, name, args...), s, nil
+}
+
+// InSessionWith is InSession with standard input.
+func (d Desk) InSessionWith(ctx context.Context, stdin []byte, name string, args ...string) (Result, *Session, error) {
+	s, err := d.Find()
+	if err != nil {
+		return Result{}, nil, err
+	}
+	return d.Run(ctx, s.Env(d.Base), stdin, name, args...), s, nil
+}
+
+// Plain runs a command with the base environment: for what needs no session.
+func (d Desk) Plain(ctx context.Context, name string, args ...string) Result {
+	return d.Run(ctx, d.Base, nil, name, args...)
+}
+
+// AsUser runs a command with the account's own runtime directory and bus, and no display.
+func (d Desk) AsUser(ctx context.Context, name string, args ...string) Result {
+	return d.Run(ctx, UserEnv(d.Base, os.Getuid()), nil, name, args...)
+}
+
+// Launched is how a program was started in the session.
+type Launched struct {
+	Unit string `json:"unit,omitempty"`
+	PID  int    `json:"pid,omitempty"`
+	How  string `json:"how"`
+}
+
+// Launch starts a program in the operator's session that outlives the call and the runtime.
+//
+// **Not as a child of this process.** The runtime is a system service; everything it starts is in
+// its control group, and the service manager ends that group whenever the runtime restarts — which
+// is every push that changes it. So the program is handed to the account's own service manager as a
+// transient unit (`systemd-run --user`), with the session's words set on it, and lives as long as the
+// operator's user manager does. Without a user manager it is started detached as a last resort, and
+// the answer says it will end with the runtime.
+func (d Desk) Launch(ctx context.Context, s *Session, name string, argv ...string) (Launched, error) {
+	if len(argv) == 0 {
+		return Launched{}, errors.New("nothing to launch")
+	}
+	env := s.Env(d.Base)
+	unit := "mesh-" + name + "-" + token()
+	args := []string{"--user", "--collect", "--quiet", "--unit=" + unit}
+	for _, w := range []string{"DISPLAY", "WAYLAND_DISPLAY", "XAUTHORITY", "XDG_SESSION_TYPE", "XDG_CURRENT_DESKTOP", "XDG_SESSION_DESKTOP", "I3SOCK", "SWAYSOCK"} {
+		if v := lookup(env, w); v != "" {
+			args = append(args, "--setenv="+w+"="+v)
+		}
+	}
+	args = append(args, "--")
+	args = append(args, argv...)
+	res := d.Run(ctx, env, nil, "systemd-run", args...)
+	if res.OK() {
+		return Launched{Unit: unit, How: "a transient unit of the account's service manager; ends when it exits or when the operator logs out"}, nil
+	}
+	if s.Bus != "" {
+		return Launched{}, res.Err()
+	}
+	cmd := exec.Command(argv[0], argv[1:]...)
+	cmd.Env = env
+	cmd.SysProcAttr = &syscall.SysProcAttr{Setsid: true}
+	if err := cmd.Start(); err != nil {
+		return Launched{}, err
+	}
+	pid := cmd.Process.Pid
+	go func() { _ = cmd.Wait() }()
+	return Launched{PID: pid, How: "detached from the runtime with no user manager to hand it to; it ends when the runtime restarts"}, nil
+}
+
+func lookup(env []string, name string) string {
+	for i := len(env) - 1; i >= 0; i-- {
+		if k, v, ok := strings.Cut(env[i], "="); ok && k == name {
+			return v
+		}
+	}
+	return ""
+}
+
+func token() string {
+	b := make([]byte, 4)
+	_, _ = rand.Read(b)
+	return hex.EncodeToString(b)
+}

modules/adwaita/internal/desktop/session.go

@@ -0,0 +1,445 @@
+// Package desktop is how a desktop module's tools act in the operator's graphical session
+// (novox/hq ADR 0208, research 026/05).
+//
+// **One question, answered once for every desktop tool.** A tool runs inside the node's runtime: a
+// process of node-tools.service, started by the system's service manager as the operator account,
+// with no session around it — no DISPLAY, no XAUTHORITY, no session bus. The session it must act in
+// was started elsewhere, by the login manager, and the only place its values are written down is
+// the environment of the processes it started. So this package finds the session the way a person
+// would: it looks at the operator account's own processes, takes the one that is plainly the
+// session's (the window manager, or the oldest process carrying a display), confirms with logind
+// that its session is a live local one, and checks that the display's socket is really there.
+//
+// **Only the session's own words are read.** A session's processes also carry whatever its start
+// script exported — on the workstations that was a file of secrets — so the environment is filtered
+// to a fixed list of names while it is read, and nothing else ever leaves /proc.
+//
+// The D-Bus address handed on is the user manager's socket, `unix:path=$XDG_RUNTIME_DIR/bus`,
+// whenever it exists, because that is where the portal, the notifier and every user service
+// listen. A session started on a private bus (a stale session, measured on one workstation) is
+// reported as `session_bus` beside it, so the difference is visible rather than guessed at.
+//
+// The same copy of this package is vendored into every desktop module (xorg, lemurs, i3, xterm,
+// adwaita); the catalogue builds each module alone, so it cannot be imported across them. Change
+// every copy together — the modules' tests compare them.
+package desktop
+
+import (
+	"bufio"
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"os/user"
+	"path/filepath"
+	"sort"
+	"strconv"
+	"strings"
+	"syscall"
+	"time"
+)
+
+// SessionWords are the only environment words read from a session's process: the ones that say
+// where the session is. Everything else in that environment is the operator's, and is never read.
+var SessionWords = []string{
+	"DISPLAY", "WAYLAND_DISPLAY", "XAUTHORITY",
+	"XDG_SESSION_ID", "XDG_SESSION_TYPE", "XDG_SESSION_DESKTOP", "XDG_CURRENT_DESKTOP",
+	"XDG_RUNTIME_DIR", "DBUS_SESSION_BUS_ADDRESS", "XDG_SEAT", "XDG_VTNR",
+	"I3SOCK", "SWAYSOCK",
+}
+
+// Session is the operator's running graphical session, as a tool needs it.
+type Session struct {
+	UID            int    `json:"uid"`
+	ID             string `json:"session_id,omitempty"`
+	Type           string `json:"type"`
+	Display        string `json:"display,omitempty"`
+	WaylandDisplay string `json:"wayland_display,omitempty"`
+	XAuthority     string `json:"xauthority,omitempty"`
+	RuntimeDir     string `json:"runtime_dir"`
+	Bus            string `json:"bus,omitempty"`
+	SessionBus     string `json:"session_bus,omitempty"`
+	Desktop        string `json:"desktop,omitempty"`
+	// FoundIn is the process whose environment named the session.
+	FoundIn Process `json:"found_in"`
+	// Active is logind's word on the session, when logind answered.
+	Active *bool `json:"active,omitempty"`
+
+	words map[string]string
+}
+
+// Process is one process the search looked at.
+type Process struct {
+	PID     int    `json:"pid"`
+	Command string `json:"command"`
+	start   uint64
+}
+
+// NoSession is the answer when there is no graphical session to act in. Its text is JSON, so a tool
+// that returns it as its error still answers structured data.
+type NoSession struct {
+	Reason string   `json:"reason"`
+	Looked []string `json:"looked"`
+}
+
+func (e *NoSession) Error() string {
+	b, _ := json.Marshal(map[string]any{"error": "no-graphical-session", "reason": e.Reason, "looked": e.Looked})
+	return string(b)
+}
+
+// IsNoSession is whether err says there is no session.
+func IsNoSession(err error) bool {
+	var n *NoSession
+	return errors.As(err, &n)
+}
+
+// Finder holds where the search looks, so a test can point it at a tree of its own.
+type Finder struct {
+	Proc        string // the process table: /proc
+	X11Sockets  string // where X servers listen: /tmp/.X11-unix
+	RuntimeBase string // the parent of every XDG_RUNTIME_DIR: /run/user
+	UID         int    // whose session
+	// Prefer names the processes that are the session's own, best first: the session's holder.
+	Prefer []string
+	// Logind answers `loginctl show-session` for one id; nil skips the check.
+	Logind func(id string) (map[string]string, error)
+}
+
+// DefaultFinder is the machine's: the account this process runs as, or — when it runs as root — the
+// operator account the runtime names (MESH_OPERATOR_ACCOUNT).
+func DefaultFinder(prefer ...string) Finder {
+	uid := os.Getuid()
+	if uid == 0 {
+		if name := os.Getenv("MESH_OPERATOR_ACCOUNT"); name != "" {
+			if u, err := user.Lookup(name); err == nil {
+				if n, err := strconv.Atoi(u.Uid); err == nil {
+					uid = n
+				}
+			}
+		}
+	}
+	return Finder{
+		Proc: "/proc", X11Sockets: "/tmp/.X11-unix", RuntimeBase: "/run/user",
+		UID: uid, Prefer: prefer, Logind: loginctl,
+	}
+}
+
+// Find is the operator's session on this machine, preferring a process named in prefer.
+func Find(prefer ...string) (*Session, error) {
+	return DefaultFinder(prefer...).Find()
+}
+
+type candidate struct {
+	proc   Process
+	words  map[string]string
+	rank   int
+	logind map[string]string
+}
+
+// Find looks for the session.
+func (f Finder) Find() (*Session, error) {
+	entries, err := os.ReadDir(f.Proc)
+	if err != nil {
+		return nil, &NoSession{Reason: "the process table cannot be read: " + err.Error(), Looked: []string{f.Proc}}
+	}
+	looked := []string{fmt.Sprintf("the processes of uid %d in %s", f.UID, f.Proc)}
+	var found []candidate
+	stale := 0
+	for _, e := range entries {
+		pid, err := strconv.Atoi(e.Name())
+		if err != nil {
+			continue
+		}
+		dir := filepath.Join(f.Proc, e.Name())
+		info, err := os.Stat(dir)
+		if err != nil {
+			continue
+		}
+		if st, ok := info.Sys().(*syscall.Stat_t); !ok || int(st.Uid) != f.UID {
+			continue
+		}
+		words := readWords(filepath.Join(dir, "environ"))
+		if words["DISPLAY"] == "" && words["WAYLAND_DISPLAY"] == "" {
+			continue
+		}
+		if !f.reachable(words) {
+			stale++
+			continue
+		}
+		found = append(found, candidate{proc: Process{PID: pid, Command: comm(dir), start: startTime(dir)}, words: words})
+	}
+	if len(found) == 0 {
+		reason := fmt.Sprintf("no process of uid %d carries a display", f.UID)
+		if stale > 0 {
+			reason = fmt.Sprintf("%d process(es) of uid %d name a display whose socket is gone: the session they belonged to has ended", stale, f.UID)
+		}
+		return nil, &NoSession{Reason: reason, Looked: append(looked, f.X11Sockets, f.RuntimeBase)}
+	}
+
+	// logind's word on each session the candidates name, asked once per session.
+	asked := map[string]map[string]string{}
+	for i := range found {
+		id := found[i].words["XDG_SESSION_ID"]
+		if f.Logind == nil || id == "" {
+			found[i].rank = 1
+			continue
+		}
+		props, done := asked[id]
+		if !done {
+			props, _ = f.Logind(id)
+			asked[id] = props
+		}
+		found[i].logind = props
+		switch {
+		case props == nil:
+			found[i].rank = 1
+		case props["Remote"] == "yes":
+			found[i].rank = 3
+		case props["Active"] == "yes" && props["State"] != "closing":
+			found[i].rank = 0
+		case props["State"] == "closing":
+			found[i].rank = 3
+		default:
+			found[i].rank = 2
+		}
+	}
+	if f.Logind != nil {
+		looked = append(looked, "logind's sessions")
+	}
+	preferred := func(c candidate) int {
+		for i, p := range f.Prefer {
+			if c.proc.Command == p {
+				return i
+			}
+		}
+		return len(f.Prefer)
+	}
+	sort.SliceStable(found, func(i, j int) bool {
+		a, b := found[i], found[j]
+		if a.rank != b.rank {
+			return a.rank < b.rank
+		}
+		if pa, pb := preferred(a), preferred(b); pa != pb {
+			return pa < pb
+		}
+		if a.proc.start != b.proc.start {
+			return a.proc.start < b.proc.start
+		}
+		return a.proc.PID < b.proc.PID
+	})
+	best := found[0]
+	if best.rank == 3 {
+		return nil, &NoSession{Reason: "the only sessions found are remote or closing", Looked: looked}
+	}
+	return f.session(best), nil
+}
+
+func (f Finder) session(c candidate) *Session {
+	w := c.words
+	s := &Session{
+		UID: f.UID, ID: w["XDG_SESSION_ID"], Display: w["DISPLAY"], WaylandDisplay: w["WAYLAND_DISPLAY"],
+		XAuthority: w["XAUTHORITY"], RuntimeDir: w["XDG_RUNTIME_DIR"], FoundIn: c.proc, words: w,
+	}
+	s.Desktop = w["XDG_CURRENT_DESKTOP"]
+	if s.Desktop == "" {
+		s.Desktop = w["XDG_SESSION_DESKTOP"]
+	}
+	switch {
+	case w["XDG_SESSION_TYPE"] != "":
+		s.Type = w["XDG_SESSION_TYPE"]
+	case s.WaylandDisplay != "":
+		s.Type = "wayland"
+	default:
+		s.Type = "x11"
+	}
+	if s.RuntimeDir == "" {
+		s.RuntimeDir = filepath.Join(f.RuntimeBase, strconv.Itoa(f.UID))
+	}
+	if isSocket(filepath.Join(s.RuntimeDir, "bus")) {
+		s.Bus = "unix:path=" + filepath.Join(s.RuntimeDir, "bus")
+	}
+	if own := w["DBUS_SESSION_BUS_ADDRESS"]; own != "" && own != s.Bus {
+		s.SessionBus = own
+	}
+	if c.logind != nil {
+		active := c.logind["Active"] == "yes"
+		s.Active = &active
+	}
+	return s
+}
+
+// reachable is whether the display a process names is still served: the X server's socket, or the
+// Wayland compositor's. A process outliving its session still carries the session's words.
+func (f Finder) reachable(w map[string]string) bool {
+	if d := w["WAYLAND_DISPLAY"]; d != "" {
+		path := d
+		if !filepath.IsAbs(d) {
+			dir := w["XDG_RUNTIME_DIR"]
+			if dir == "" {
+				dir = filepath.Join(f.RuntimeBase, strconv.Itoa(f.UID))
+			}
+			path = filepath.Join(dir, d)
+		}
+		if isSocket(path) {
+			return true
+		}
+	}
+	n, ok := DisplayNumber(w["DISPLAY"])
+	return ok && isSocket(filepath.Join(f.X11Sockets, "X"+strconv.Itoa(n)))
+}
+
+// DisplayNumber is the server number of a local X display (":1", ":1.0", "unix:1"); a display on
+// another host — an ssh session's forwarded one — is not the local session and answers false.
+func DisplayNumber(display string) (int, bool) {
+	host, rest, ok := strings.Cut(display, ":")
+	if !ok || (host != "" && host != "unix") {
+		return 0, false
+	}
+	num, _, _ := strings.Cut(rest, ".")
+	n, err := strconv.Atoi(num)
+	if err != nil || n < 0 {
+		return 0, false
+	}
+	return n, true
+}
+
+// Word is one of the session's words as its process had it ("" when it had none).
+func (s *Session) Word(name string) string { return s.words[name] }
+
+// Env is base with the session's words in place of whatever base said for them.
+func (s *Session) Env(base []string) []string {
+	drop := map[string]bool{}
+	for _, w := range SessionWords {
+		drop[w] = true
+	}
+	out := make([]string, 0, len(base)+8)
+	for _, kv := range base {
+		k, _, _ := strings.Cut(kv, "=")
+		if !drop[k] {
+			out = append(out, kv)
+		}
+	}
+	bus := s.Bus
+	if bus == "" {
+		bus = s.SessionBus
+	}
+	for _, kv := range [][2]string{
+		{"DISPLAY", s.Display}, {"WAYLAND_DISPLAY", s.WaylandDisplay}, {"XAUTHORITY", s.XAuthority},
+		{"XDG_RUNTIME_DIR", s.RuntimeDir}, {"DBUS_SESSION_BUS_ADDRESS", bus},
+		{"XDG_SESSION_TYPE", s.Type}, {"XDG_SESSION_ID", s.ID},
+		{"XDG_CURRENT_DESKTOP", s.words["XDG_CURRENT_DESKTOP"]},
+		{"XDG_SESSION_DESKTOP", s.words["XDG_SESSION_DESKTOP"]},
+		{"I3SOCK", s.words["I3SOCK"]}, {"SWAYSOCK", s.words["SWAYSOCK"]},
+	} {
+		if kv[1] != "" {
+			out = append(out, kv[0]+"="+kv[1])
+		}
+	}
+	return out
+}
+
+// UserEnv is base with the account's own runtime directory and bus, for a tool that talks to the
+// user manager or the session bus and needs no display — it works with no session at all.
+func UserEnv(base []string, uid int) []string {
+	dir := filepath.Join("/run/user", strconv.Itoa(uid))
+	out := make([]string, 0, len(base)+2)
+	for _, kv := range base {
+		k, _, _ := strings.Cut(kv, "=")
+		if k != "XDG_RUNTIME_DIR" && k != "DBUS_SESSION_BUS_ADDRESS" {
+			out = append(out, kv)
+		}
+	}
+	return append(out, "XDG_RUNTIME_DIR="+dir, "DBUS_SESSION_BUS_ADDRESS=unix:path="+filepath.Join(dir, "bus"))
+}
+
+// readWords reads a process's environment and keeps only SessionWords.
+func readWords(path string) map[string]string {
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		return nil
+	}
+	keep := map[string]bool{}
+	for _, w := range SessionWords {
+		keep[w] = true
+	}
+	out := map[string]string{}
+	for _, kv := range bytes.Split(raw, []byte{0}) {
+		k, v, ok := bytes.Cut(kv, []byte{'='})
+		if ok && keep[string(k)] {
+			out[string(k)] = string(v)
+		}
+	}
+	return out
+}
+
+func comm(dir string) string {
+	b, err := os.ReadFile(filepath.Join(dir, "comm"))
+	if err != nil {
+		return ""
+	}
+	return strings.TrimSpace(string(b))
+}
+
+// startTime is field 22 of /proc/<pid>/stat: when the process started, in clock ticks since boot.
+// Read after the command's closing parenthesis, because the command may hold spaces.
+func startTime(dir string) uint64 {
+	b, err := os.ReadFile(filepath.Join(dir, "stat"))
+	if err != nil {
+		return ^uint64(0)
+	}
+	i := bytes.LastIndexByte(b, ')')
+	if i < 0 {
+		return ^uint64(0)
+	}
+	fields := strings.Fields(string(b[i+1:]))
+	// fields[0] is the state, field 3 of the line; start time is field 22.
+	if len(fields) < 20 {
+		return ^uint64(0)
+	}
+	n, err := strconv.ParseUint(fields[19], 10, 64)
+	if err != nil {
+		return ^uint64(0)
+	}
+	return n
+}
+
+func isSocket(path string) bool {
+	info, err := os.Stat(path)
+	return err == nil && info.Mode()&os.ModeSocket != 0
+}
+
+// loginctl asks logind about one session, by its property lines.
+func loginctl(id string) (map[string]string, error) {
+	cmd := exec.Command("loginctl", "show-session", id, "-p", "Active", "-p", "State", "-p", "Remote", "-p", "Type", "-p", "Class")
+	var out bytes.Buffer
+	cmd.Stdout = &out
+	done := make(chan error, 1)
+	if err := cmd.Start(); err != nil {
+		return nil, err
+	}
+	go func() { done <- cmd.Wait() }()
+	select {
+	case err := <-done:
+		if err != nil {
+			return nil, err
+		}
+	case <-time.After(3 * time.Second):
+		_ = cmd.Process.Kill()
+		return nil, errors.New("loginctl did not answer in 3s")
+	}
+	return ParseProperties(out.String()), nil
+}
+
+// ParseProperties reads `Key=Value` lines, as loginctl and systemctl show print them.
+func ParseProperties(text string) map[string]string {
+	out := map[string]string{}
+	sc := bufio.NewScanner(strings.NewReader(text))
+	for sc.Scan() {
+		if k, v, ok := strings.Cut(sc.Text(), "="); ok {
+			out[k] = v
+		}
+	}
+	return out
+}

modules/adwaita/internal/desktop/session_test.go

@@ -0,0 +1,255 @@
+package desktop
+
+import (
+	"context"
+	"encoding/json"
+	"net"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"testing"
+)
+
+// A machine in a directory: a process table, the X servers' socket directory and a runtime base.
+type fakeMachine struct {
+	t                  *testing.T
+	proc, x11, runtime string
+	uid                int
+}
+
+func newMachine(t *testing.T) *fakeMachine {
+	root, err := os.MkdirTemp("", "desk")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { os.RemoveAll(root) })
+	m := &fakeMachine{t: t, proc: filepath.Join(root, "p"), x11: filepath.Join(root, "x"), runtime: filepath.Join(root, "r"), uid: os.Getuid()}
+	for _, d := range []string{m.proc, m.x11, filepath.Join(m.runtime, strconv.Itoa(m.uid))} {
+		if err := os.MkdirAll(d, 0o755); err != nil {
+			t.Fatal(err)
+		}
+	}
+	return m
+}
+
+func (m *fakeMachine) socket(path string) {
+	l, err := net.Listen("unix", path)
+	if err != nil {
+		m.t.Fatal(err)
+	}
+	m.t.Cleanup(func() { l.Close() })
+}
+
+func (m *fakeMachine) process(pid int, comm string, start int, env ...string) {
+	dir := filepath.Join(m.proc, strconv.Itoa(pid))
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		m.t.Fatal(err)
+	}
+	os.WriteFile(filepath.Join(dir, "environ"), []byte(strings.Join(env, "\x00")+"\x00"), 0o600)
+	os.WriteFile(filepath.Join(dir, "comm"), []byte(comm+"\n"), 0o644)
+	// pid (comm) state ppid pgrp session tty tpgid flags minflt cminflt majflt cmajflt utime stime
+	// cutime cstime priority nice threads itrealvalue starttime ...
+	stat := strconv.Itoa(pid) + " (" + comm + ") S 1 1 1 0 -1 0 0 0 0 0 0 0 0 0 20 0 1 0 " + strconv.Itoa(start) + " 0 0"
+	os.WriteFile(filepath.Join(dir, "stat"), []byte(stat), 0o644)
+}
+
+func (m *fakeMachine) finder(logind func(string) (map[string]string, error), prefer ...string) Finder {
+	return Finder{Proc: m.proc, X11Sockets: m.x11, RuntimeBase: m.runtime, UID: m.uid, Prefer: prefer, Logind: logind}
+}
+
+func active(id string) (map[string]string, error) {
+	return map[string]string{"Active": "yes", "State": "active", "Remote": "no", "Type": "x11"}, nil
+}
+
+func TestTheSessionIsFoundInTheWindowManagersEnvironmentAndOnlyItsWordsAreRead(t *testing.T) {
+	m := newMachine(t)
+	m.socket(filepath.Join(m.x11, "X1"))
+	run := filepath.Join(m.runtime, strconv.Itoa(m.uid))
+	m.socket(filepath.Join(run, "bus"))
+	m.process(100, "lemurs-child", 5, "DISPLAY=:1", "XDG_SESSION_ID=1")
+	m.process(200, "i3", 10, "DISPLAY=:1", "XAUTHORITY=/home/op/.Xauthority", "XDG_SESSION_ID=1",
+		"XDG_SESSION_TYPE=x11", "XDG_CURRENT_DESKTOP=i3", "XDG_RUNTIME_DIR="+run,
+		"DBUS_SESSION_BUS_ADDRESS=unix:path=/tmp/dbus-private", "NPM_TOKEN=secret", "OPENAI_API_KEY=secret")
+	m.process(300, "zsh", 50, "TERM=xterm") // no display: not a candidate
+
+	s, err := m.finder(active, "i3").Find()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if s.FoundIn.PID != 200 || s.Display != ":1" || s.XAuthority != "/home/op/.Xauthority" || s.ID != "1" || s.Type != "x11" || s.Desktop != "i3" {
+		t.Fatalf("session: %+v", s)
+	}
+	if s.Bus != "unix:path="+filepath.Join(run, "bus") || s.SessionBus != "unix:path=/tmp/dbus-private" {
+		t.Fatalf("the user manager's bus first, the session's private one reported beside it: %q %q", s.Bus, s.SessionBus)
+	}
+	if s.Active == nil || !*s.Active {
+		t.Fatal("logind's word is carried")
+	}
+	env := strings.Join(s.Env([]string{"PATH=/usr/bin", "DISPLAY=:9", "HOME=/home/op"}), "\n")
+	for _, want := range []string{"PATH=/usr/bin", "HOME=/home/op", "DISPLAY=:1", "XAUTHORITY=/home/op/.Xauthority", "DBUS_SESSION_BUS_ADDRESS=unix:path=" + filepath.Join(run, "bus"), "XDG_RUNTIME_DIR=" + run} {
+		if !strings.Contains(env, want) {
+			t.Errorf("env lacks %s:\n%s", want, env)
+		}
+	}
+	if strings.Contains(env, ":9") || strings.Contains(env, "secret") || strings.Contains(env, "NPM_TOKEN") {
+		t.Fatalf("the base's display is replaced and no other word of the session's process passes:\n%s", env)
+	}
+	b, _ := json.Marshal(s)
+	if strings.Contains(string(b), "secret") {
+		t.Fatal("the answer carries a word outside the session's")
+	}
+}
+
+func TestWithoutAPreferenceTheOldestProcessOfTheLiveSessionWins(t *testing.T) {
+	m := newMachine(t)
+	m.socket(filepath.Join(m.x11, "X0"))
+	m.process(410, "xterm", 90, "DISPLAY=:0", "XDG_SESSION_ID=3")
+	m.process(400, "openbox", 20, "DISPLAY=:0", "XDG_SESSION_ID=3")
+	s, err := m.finder(nil).Find()
+	if err != nil || s.FoundIn.PID != 400 {
+		t.Fatalf("%+v %v", s, err)
+	}
+	if s.RuntimeDir != filepath.Join(m.runtime, strconv.Itoa(m.uid)) || s.Bus != "" {
+		t.Fatalf("an absent runtime directory word falls back to the account's, and no bus socket means no bus: %+v", s)
+	}
+}
+
+func TestALeftoverProcessOfAnEndedSessionIsNotTheSession(t *testing.T) {
+	m := newMachine(t)
+	m.process(500, "i3", 10, "DISPLAY=:2", "XDG_SESSION_ID=7") // no X2 socket
+	_, err := m.finder(active, "i3").Find()
+	if !IsNoSession(err) || !strings.Contains(err.Error(), "socket is gone") {
+		t.Fatalf("%v", err)
+	}
+	var answer map[string]any
+	if json.Unmarshal([]byte(err.Error()), &answer) != nil || answer["error"] != "no-graphical-session" {
+		t.Fatalf("the refusal is structured: %s", err)
+	}
+}
+
+func TestNoProcessWithADisplayIsAClearNoSession(t *testing.T) {
+	m := newMachine(t)
+	m.process(600, "sshd", 1, "SSH_CONNECTION=x")
+	_, err := m.finder(active).Find()
+	if !IsNoSession(err) || !strings.Contains(err.Error(), "no process of uid") {
+		t.Fatalf("%v", err)
+	}
+}
+
+func TestAnActiveLocalSessionBeatsAnInactiveOneAndARemoteOneIsRefused(t *testing.T) {
+	m := newMachine(t)
+	m.socket(filepath.Join(m.x11, "X0"))
+	m.socket(filepath.Join(m.x11, "X1"))
+	m.process(700, "i3", 5, "DISPLAY=:0", "XDG_SESSION_ID=a")
+	m.process(800, "i3", 9, "DISPLAY=:1", "XDG_SESSION_ID=b")
+	logind := func(id string) (map[string]string, error) {
+		if id == "a" {
+			return map[string]string{"Active": "no", "State": "online", "Remote": "no"}, nil
+		}
+		return map[string]string{"Active": "yes", "State": "active", "Remote": "no"}, nil
+	}
+	s, err := m.finder(logind, "i3").Find()
+	if err != nil || s.FoundIn.PID != 800 || s.Display != ":1" {
+		t.Fatalf("the active session: %+v %v", s, err)
+	}
+	remote := func(string) (map[string]string, error) {
+		return map[string]string{"Active": "yes", "Remote": "yes"}, nil
+	}
+	if _, err := m.finder(remote).Find(); !IsNoSession(err) {
+		t.Fatalf("a remote session is not the operator's desktop: %v", err)
+	}
+}
+
+func TestAWaylandSessionIsFoundByItsCompositorsSocket(t *testing.T) {
+	m := newMachine(t)
+	run := filepath.Join(m.runtime, strconv.Itoa(m.uid))
+	m.socket(filepath.Join(run, "wayland-1"))
+	m.process(900, "sway", 3, "WAYLAND_DISPLAY=wayland-1", "XDG_RUNTIME_DIR="+run, "SWAYSOCK=/run/x.sock")
+	s, err := m.finder(nil, "sway").Find()
+	if err != nil || s.Type != "wayland" || s.WaylandDisplay != "wayland-1" {
+		t.Fatalf("%+v %v", s, err)
+	}
+	if !strings.Contains(strings.Join(s.Env(nil), " "), "SWAYSOCK=/run/x.sock") {
+		t.Fatal("the compositor's socket word passes")
+	}
+}
+
+func TestADisplayOnAnotherHostIsNotTheLocalSession(t *testing.T) {
+	for d, want := range map[string]bool{":0": true, ":1.0": true, "unix:2": true, "localhost:10.0": false, "host:0": false, "": false, ":x": false} {
+		if _, ok := DisplayNumber(d); ok != want {
+			t.Errorf("%q: %v", d, ok)
+		}
+	}
+}
+
+func TestACommandIsBoundedAndItsFailureNamed(t *testing.T) {
+	r := Exec(context.Background(), os.Environ(), []byte("hello"), "cat")
+	if !r.OK() || r.Stdout != "hello" {
+		t.Fatalf("%+v", r)
+	}
+	r = Exec(context.Background(), os.Environ(), nil, "sh", "-c", "echo no >&2; exit 3")
+	if r.OK() || r.Code != 3 || !strings.Contains(r.Err().Error(), "exited 3: no") {
+		t.Fatalf("%+v", r)
+	}
+	r = Exec(context.Background(), os.Environ(), nil, "no-such-program-here")
+	if r.OK() || r.Code != 127 {
+		t.Fatalf("%+v", r)
+	}
+	r = Exec(context.Background(), os.Environ(), nil, "sh", "-c", "head -c 400000 /dev/zero")
+	if !r.Truncated || len(r.Stdout) != MostOutput {
+		t.Fatalf("cut at %d: %d %v", MostOutput, len(r.Stdout), r.Truncated)
+	}
+}
+
+func TestArgumentsAreReadStrictly(t *testing.T) {
+	a := Args{"name": " x ", "n": float64(3), "f": 1.5, "b": true, "l": []any{"a", "b"}}
+	if v, err := a.Text("name"); err != nil || v != "x" {
+		t.Fatal(v, err)
+	}
+	if _, err := a.Text("missing"); err == nil {
+		t.Fatal("a missing required text")
+	}
+	if n, err := a.Whole("n", 0, 1, 5); err != nil || n != 3 {
+		t.Fatal(n, err)
+	}
+	if _, err := a.Whole("f", 0, 0, 5); err == nil {
+		t.Fatal("1.5 is not whole")
+	}
+	if _, err := a.Whole("n", 0, 4, 5); err == nil {
+		t.Fatal("out of range")
+	}
+	if b, given, err := a.Bool("b"); !b || !given || err != nil {
+		t.Fatal("bool")
+	}
+	if _, _, err := a.Bool("name"); err == nil {
+		t.Fatal("text is not a bool")
+	}
+	if l, err := a.Strings("l"); err != nil || len(l) != 2 {
+		t.Fatal(l, err)
+	}
+	if _, err := a.OneOf("name", "", "y", "z"); err == nil {
+		t.Fatal("not one of")
+	}
+}
+
+func TestAPathIsKeptInsideTheHome(t *testing.T) {
+	t.Setenv("MESH_OPERATOR_HOME", "/home/op")
+	for in, want := range map[string]string{"~/a.png": "/home/op/a.png", "b/c": "/home/op/b/c", "/home/op/d": "/home/op/d", "~": "/home/op"} {
+		if got, err := InHome(in); err != nil || got != want {
+			t.Errorf("%s: %s %v", in, got, err)
+		}
+	}
+	for _, out := range []string{"/etc/passwd", "~/../other", "../x"} {
+		if _, err := InHome(out); err == nil {
+			t.Errorf("%s was accepted", out)
+		}
+	}
+}
+
+func TestPropertiesAreParsed(t *testing.T) {
+	p := ParseProperties("Active=yes\nState=active\nDisplay=\n")
+	if p["Active"] != "yes" || p["State"] != "active" || p["Display"] != "" {
+		t.Fatal(p)
+	}
+}

modules/adwaita/module.json

@@ -0,0 +1,118 @@
+{
+  "module": "adwaita",
+  "version": "1",
+  "capabilities": [
+    "package-manager"
+  ],
+  "tools": [
+    "adwaita_appearance",
+    "adwaita_cursor",
+    "adwaita_icons",
+    "adwaita_portal_check"
+  ],
+  "environment": {
+    "variables": {
+      "GTK_THEME": "Adwaita:dark",
+      "GTK2_RC_FILES": "/usr/share/themes/Adwaita-dark/gtk-2.0/gtkrc",
+      "QT_QPA_PLATFORMTHEME": "qt6ct",
+      "QT_STYLE_OVERRIDE": "Fusion",
+      "QT_SELECT": "6",
+      "XCURSOR_THEME": "Adwaita",
+      "XCURSOR_SIZE": "24"
+    }
+  },
+  "shell": [
+    {
+      "for": "xresources",
+      "slot": "normal",
+      "code": "! adwaita: the cursor, for X programs that take it from the resources.\nXcursor.theme: Adwaita\nXcursor.size: 24\n"
+    },
+    {
+      "for": "xinitrc",
+      "slot": "normal",
+      "code": "# The appearance (module adwaita): GSettings is where the portal reads dark or light, and the portal is\n# the only way it reaches Electron, Chromium, Firefox and flatpaks. Set at every session start to the\n# module's default; adwaita_appearance switches it for a session.\ngsettings set org.gnome.desktop.interface color-scheme 'prefer-dark' || true\ngsettings set org.gnome.desktop.interface gtk-theme 'Adwaita' || true\ngsettings set org.gnome.desktop.interface icon-theme 'Adwaita' || true\ngsettings set org.gnome.desktop.interface cursor-theme 'Adwaita' || true\ngsettings set org.gnome.desktop.interface cursor-size 24 || true\ngsettings set org.gnome.desktop.interface font-name 'Inter 11' || true\ngsettings set org.gnome.desktop.interface monospace-font-name 'JetBrainsMono Nerd Font 11' || true\n"
+    }
+  ],
+  "resources": [
+    {
+      "id": "package-gnome-themes-extra",
+      "type": "package",
+      "package": "gnome-themes-extra"
+    },
+    {
+      "id": "package-adwaita-icon-theme",
+      "type": "package",
+      "package": "adwaita-icon-theme"
+    },
+    {
+      "id": "package-adwaita-cursors",
+      "type": "package",
+      "package": "adwaita-cursors"
+    },
+    {
+      "id": "package-qt6ct",
+      "type": "package",
+      "package": "qt6ct"
+    },
+    {
+      "id": "package-xdg-desktop-portal-gtk",
+      "type": "package",
+      "package": "xdg-desktop-portal-gtk"
+    },
+    {
+      "id": "gtk3",
+      "type": "file",
+      "path": "${machine:account-home}/.config/gtk-3.0/settings.ini",
+      "owner": "${machine:account}",
+      "mode": "0644",
+      "content": "# Written by the mesh (module adwaita, novox/hq ADR 0208), for GTK 3 and GTK 4 alike. Replaced at\n# every push; adwaita_appearance switches dark and light for the running session.\n[Settings]\ngtk-theme-name=Adwaita\ngtk-icon-theme-name=Adwaita\ngtk-cursor-theme-name=Adwaita\ngtk-cursor-theme-size=24\ngtk-font-name=Inter 11\ngtk-application-prefer-dark-theme=1\n"
+    },
+    {
+      "id": "gtk4",
+      "type": "file",
+      "path": "${machine:account-home}/.config/gtk-4.0/settings.ini",
+      "owner": "${machine:account}",
+      "mode": "0644",
+      "content": "# Written by the mesh (module adwaita, novox/hq ADR 0208), for GTK 3 and GTK 4 alike. Replaced at\n# every push; adwaita_appearance switches dark and light for the running session.\n[Settings]\ngtk-theme-name=Adwaita\ngtk-icon-theme-name=Adwaita\ngtk-cursor-theme-name=Adwaita\ngtk-cursor-theme-size=24\ngtk-font-name=Inter 11\ngtk-application-prefer-dark-theme=1\n"
+    },
+    {
+      "id": "qt6ct",
+      "type": "file",
+      "path": "${machine:account-home}/.config/qt6ct/qt6ct.conf",
+      "owner": "${machine:account}",
+      "mode": "0644",
+      "content": "[Appearance]\ncolor_scheme_path=/usr/share/qt6ct/colors/darker.conf\ncustom_palette=true\nicon_theme=Adwaita\nstandard_dialogs=default\nstyle=Fusion\n\n[Fonts]\nfixed=\"JetBrainsMono Nerd Font,11,-1,5,50,0,0,0,0,0\"\ngeneral=\"Inter,11,-1,5,50,0,0,0,0,0\"\n\n[Interface]\nactivate_item_on_single_click=1\nbuttonbox_layout=0\ncursor_flash_time=1000\ndialog_buttons_have_icons=1\ndouble_click_interval=400\ngui_effects=@Invalid()\nkeyboard_scheme=2\nmenus_have_icons=true\nshow_shortcuts_in_context_menus=true\nstylesheets=@Invalid()\ntoolbutton_style=4\nunderline_shortcut=1\nwheel_scroll_lines=3\n\n[Troubleshooting]\nforce_raster_widgets=1\nignored_applications=@Invalid()\n"
+    },
+    {
+      "id": "portals",
+      "type": "file",
+      "path": "${machine:account-home}/.config/xdg-desktop-portal/portals.conf",
+      "owner": "${machine:account}",
+      "mode": "0644",
+      "content": "# Written by the mesh (module adwaita, novox/hq ADR 0208). Replaced at every push.\n#\n# Which portal backend answers each interface. i3 is not a desktop xdg-desktop-portal knows, so with\n# no preference it uses whichever backend happens to be installed: fine while gtk is the only one,\n# wrong the day another arrives as somebody else's dependency. Named instead. gtk also serves\n# org.freedesktop.appearance (dark or light) from GSettings, which the session's start sets.\n[preferred]\ndefault=gtk\n# Secrets for sandboxed programs come from the keyring's backend. Without this line no backend answers\n# the interface: gtk does not implement it, and gnome-keyring's names only GNOME as its desktop.\norg.freedesktop.impl.portal.Secret=gnome-keyring\n"
+    },
+    {
+      "id": "cursor",
+      "type": "file",
+      "path": "${machine:account-home}/.icons/default/index.theme",
+      "owner": "${machine:account}",
+      "mode": "0644",
+      "content": "# Written by the mesh (module adwaita, novox/hq ADR 0208): the default cursor theme, for programs that\n# read neither XCURSOR_THEME nor the X resources.\n[Icon Theme]\nName=Default\nInherits=Adwaita\n"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/adwaita-tools",
+        "binary": "adwaita-tools",
+        "loads": [
+          "adwaita-tools"
+        ]
+      }
+    ]
+  }
+}

modules/avahi/README.md

@@ -0,0 +1,42 @@
+# avahi
+
+The local network's name and service discovery (mDNS/DNS-SD) as a module (novox/hq to-be 42 Phase 1,
+research 027).
+
+## What it owns
+
+- The `avahi` package.
+- `avahi-daemon.service`, running and enabled.
+
+## What it improves
+
+It was on all four machines and owned by none. It is now declared, and its tools show why discovery
+does not work today:
+
+- **The packet filter drops mDNS.** The mesh's filter has no rule for inbound UDP 5353 on any of the
+  four machines, so avahi announces this machine but hears no other machine's answers. A browse
+  finds nothing, and resolving even the machine's own `.local` name times out. A module's `listens`
+  can reach the private network, this machine or anywhere, but not the local link. Opening the port
+  to anywhere would answer the internet on a public machine, so the module opens nothing. This needs
+  a decision in novox/hq: a local-link source scope for `listens`. Until then, `avahi_status` reports
+  `inbound_mdns_accepted: false`, and browse and resolve say so whenever they hear nothing.
+
+## What it leaves found
+
+- **`nss-mdns` and `/etc/nsswitch.conf`.** An ordinary lookup reaches avahi only through the
+  `hosts:` line. That line is one ordered list shared by every name source: containers, files, DNS,
+  mDNS and the resolver daemon. The host can write a marked block into a file, but it cannot add a
+  member to a line. Owning the whole file would make this module the owner of every machine's name
+  resolution. On 2026-10-04 all four machines had the same file, with `mdns4_minimal` wired by hand
+  and nss-mdns installed. Both are left as found, and `avahi_status` reports the wiring.
+- `/etc/avahi/avahi-daemon.conf`, including each workstation's hand-set `allow-interfaces`, which
+  names that machine's own network interface.
+
+## Tools
+
+| tool | | answers |
+|---|---|---|
+| `avahi_status` | r | the daemon, its version and configuration, the `hosts:` line and whether mdns is on it, nss-mdns, whether the filter accepts inbound 5353, systemd-resolved beside it, and notes |
+| `avahi_browse` | r | every service announced in a few seconds (`avahi-browse -prt`), resolved where possible, narrowed to a type |
+| `avahi_resolve` | r | a `.local` name through avahi and through the name service side by side, or an address to its name |
+| `avahi_services` | r | what this machine publishes from `/etc/avahi/services` |

modules/avahi/cmd/avahi-tools/avahi.go

@@ -0,0 +1,353 @@
+package main
+
+// Avahi, the local network's name and service discovery (mDNS/DNS-SD), as a module (novox/hq to-be 42
+// Phase 1, research 027: "on all four, owned by none"). The module declares the package and the
+// daemon. Two things it does not declare, and these tools report instead:
+//
+//   - **The name service switch.** nss-mdns is what lets an ordinary lookup answer `<host>.local`, and
+//     it works only through the `hosts:` line of /etc/nsswitch.conf. That line is one ordered list
+//     shared by every name source on the machine (containers, files, DNS, mDNS, the resolver daemon),
+//     the host can write a marked block into a file but not a member into a line, and owning the whole
+//     file would make this module the owner of every machine's name resolution. So both stay as found
+//     (wired by hand, identically, on all four machines on 2026-10-04) and `avahi_status` says whether
+//     the wiring is there.
+//   - **The packet filter.** mDNS is multicast to UDP 5353 on the local link. The mesh's filter has no
+//     source scope for "the local link" — a module's `listens` reach the private network, this machine
+//     or anywhere — so it drops what other machines announce, and a browse hears nothing. Opening it to
+//     anywhere would answer the internet on a public machine. `avahi_status` reports whether inbound
+//     5353 is accepted; browse and resolve say so when they hear nothing.
+
+import (
+	"fmt"
+	"net"
+	"regexp"
+	"sort"
+	"strconv"
+	"strings"
+)
+
+// The files avahi and the name service read.
+const (
+	DaemonConf  = "/etc/avahi/avahi-daemon.conf"
+	ServicesDir = "/etc/avahi/services"
+	NSSwitch    = "/etc/nsswitch.conf"
+	Daemon      = "avahi-daemon.service"
+)
+
+// Status is the daemon, its configuration, the name service's wiring and the filter.
+type Status struct {
+	Daemon      map[string]string            `json:"daemon"`
+	Version     string                       `json:"version,omitempty"`
+	Config      map[string]map[string]string `json:"config"`
+	HostsLine   string                       `json:"nsswitch_hosts"`
+	MDNSWired   bool                         `json:"nss_mdns_wired"`
+	NSSMDNS     string                       `json:"nss_mdns_package,omitempty"`
+	InboundMDNS *bool                        `json:"inbound_mdns_accepted"`
+	FilterError string                       `json:"filter_error,omitempty"`
+	ResolvedOn  bool                         `json:"systemd_resolved_active"`
+	Notes       []string                     `json:"notes"`
+}
+
+// ParseINI reads avahi-daemon.conf's sections and their set keys; commented keys are defaults.
+func ParseINI(text string) map[string]map[string]string {
+	out := map[string]map[string]string{}
+	section := ""
+	for _, l := range lines(text) {
+		l = strings.TrimSpace(l)
+		switch {
+		case strings.HasPrefix(l, "#") || strings.HasPrefix(l, ";"):
+		case strings.HasPrefix(l, "[") && strings.HasSuffix(l, "]"):
+			section = strings.Trim(l, "[]")
+			out[section] = map[string]string{}
+		default:
+			if k, v, ok := strings.Cut(l, "="); ok && section != "" {
+				out[section][strings.TrimSpace(k)] = strings.TrimSpace(v)
+			}
+		}
+	}
+	return out
+}
+
+// HostsLine is the `hosts:` line of nsswitch.conf, and whether an mdns source is on it.
+func HostsLine(text string) (string, bool) {
+	for _, l := range lines(text) {
+		l = strings.TrimSpace(l)
+		if !strings.HasPrefix(l, "hosts:") {
+			continue
+		}
+		for _, f := range strings.Fields(strings.TrimPrefix(l, "hosts:")) {
+			if strings.HasPrefix(f, "mdns") {
+				return l, true
+			}
+		}
+		return l, false
+	}
+	return "", false
+}
+
+var mdnsAccept = regexp.MustCompile(`(?m)\budp dport (?:\{[^}\n]*\b(?:5353|mdns)\b[^}\n]*\}|(?:5353|mdns)\b)[^\n]*\baccept\b`)
+
+// InboundMDNS is whether a ruleset accepts UDP 5353 coming in.
+func InboundMDNS(ruleset string) bool { return mdnsAccept.MatchString(ruleset) }
+
+// GetStatus reads the daemon, its configuration, the name service and the packet filter.
+func (m *Machine) GetStatus() (Status, error) {
+	s := Status{Config: map[string]map[string]string{}, Notes: []string{}}
+	d, err := m.unitProps(Daemon, "LoadState", "ActiveState", "SubState", "UnitFileState", "MainPID")
+	if err != nil {
+		return s, err
+	}
+	s.Daemon = d
+	if v, err := m.Out("avahi-daemon", "--version"); err == nil {
+		s.Version = strings.TrimSpace(v)
+	}
+	if text, err := m.ReadFile(DaemonConf); err == nil {
+		s.Config = ParseINI(string(text))
+	}
+	if text, err := m.ReadFile(NSSwitch); err == nil {
+		s.HostsLine, s.MDNSWired = HostsLine(string(text))
+	}
+	if r := m.Run(bg(), "pacman", "-Q", "nss-mdns"); r.Status == 0 && r.Err == "" {
+		s.NSSMDNS = strings.TrimSpace(r.Stdout)
+	}
+	if rs, err := m.Root("nft", "list", "ruleset"); err == nil {
+		open := InboundMDNS(rs)
+		s.InboundMDNS = &open
+		if !open {
+			s.Notes = append(s.Notes, "the packet filter drops inbound UDP 5353: this machine announces itself but hears no other machine's mDNS")
+		}
+	} else {
+		s.FilterError = err.Error()
+	}
+	if p, err := m.unitProps("systemd-resolved.service", "ActiveState"); err == nil {
+		s.ResolvedOn = p["ActiveState"] == "active"
+	}
+	if s.MDNSWired && s.NSSMDNS == "" {
+		s.Notes = append(s.Notes, "nsswitch names mdns and nss-mdns is not installed: those lookups fail")
+	}
+	if !s.MDNSWired {
+		s.Notes = append(s.Notes, "nsswitch does not name mdns: ordinary lookups never ask avahi")
+	}
+	return s, nil
+}
+
+// Service is one service a browse found.
+type Service struct {
+	Interface string   `json:"interface"`
+	Protocol  string   `json:"protocol"`
+	Name      string   `json:"name"`
+	Type      string   `json:"type"`
+	Domain    string   `json:"domain"`
+	Host      string   `json:"host,omitempty"`
+	Address   string   `json:"address,omitempty"`
+	Port      int      `json:"port,omitempty"`
+	TXT       []string `json:"txt,omitempty"`
+	Resolved  bool     `json:"resolved"`
+}
+
+// unescape undoes avahi-browse -p's escaping: a special byte as a backslash and three decimals, any
+// other character after a backslash as itself. Decoded as bytes, so a name in UTF-8 stays whole.
+func unescape(s string) string {
+	out := make([]byte, 0, len(s))
+	for i := 0; i < len(s); i++ {
+		if s[i] == '\\' {
+			if d := s[i+1 : min(i+4, len(s))]; len(d) == 3 && isDigits(d) {
+				n, _ := strconv.Atoi(d)
+				out = append(out, byte(n))
+				i += 3
+				continue
+			}
+			if i+1 < len(s) {
+				out = append(out, s[i+1])
+				i++
+				continue
+			}
+		}
+		out = append(out, s[i])
+	}
+	return string(out)
+}
+
+func isDigits(s string) bool {
+	for _, c := range s {
+		if c < '0' || c > '9' {
+			return false
+		}
+	}
+	return true
+}
+
+var txtItem = regexp.MustCompile(`"((?:[^"\\]|\\.)*)"`)
+
+// ParseBrowse reads `avahi-browse -p -r`: `+` lines found, `=` lines resolved; a found service
+// that resolved is answered once, resolved.
+func ParseBrowse(out string) []Service {
+	byKey := map[string]int{}
+	services := []Service{}
+	for _, l := range lines(out) {
+		f := strings.Split(l, ";")
+		if len(f) < 6 || (f[0] != "+" && f[0] != "=") {
+			continue
+		}
+		s := Service{Interface: f[1], Protocol: f[2], Name: unescape(f[3]), Type: f[4], Domain: f[5]}
+		if f[0] == "=" && len(f) >= 9 {
+			s.Resolved, s.Host, s.Address = true, f[6], f[7]
+			s.Port, _ = strconv.Atoi(f[8])
+			if len(f) >= 10 {
+				for _, t := range txtItem.FindAllStringSubmatch(strings.Join(f[9:], ";"), -1) {
+					s.TXT = append(s.TXT, t[1])
+				}
+			}
+		}
+		key := strings.Join([]string{s.Interface, s.Protocol, s.Name, s.Type, s.Domain}, "\x00")
+		if i, seen := byKey[key]; seen {
+			if s.Resolved {
+				services[i] = s
+			}
+			continue
+		}
+		byKey[key] = len(services)
+		services = append(services, s)
+	}
+	sort.SliceStable(services, func(i, j int) bool {
+		if services[i].Type != services[j].Type {
+			return services[i].Type < services[j].Type
+		}
+		return services[i].Name < services[j].Name
+	})
+	return services
+}
+
+var serviceType = regexp.MustCompile(`^_[A-Za-z0-9-]+\._(tcp|udp)$`)
+
+// Browse listens for a few seconds and answers every service announced, resolved where it could be.
+func (m *Machine) Browse(seconds int, kind string) (map[string]any, error) {
+	args := []string{strconv.Itoa(seconds), "avahi-browse", "-p", "-r", "-t"}
+	if kind == "" {
+		args = append(args, "-a")
+	} else {
+		if !serviceType.MatchString(kind) {
+			return nil, fmt.Errorf("%q is not a service type such as _ssh._tcp", kind)
+		}
+		args = append(args, kind)
+	}
+	r := m.Run(bg(), "timeout", args...)
+	// timeout's 124 is the listening time ending, which is how a browse that keeps hearing ends.
+	if r.Err != "" || (r.Status != 0 && r.Status != 124) {
+		return nil, failure("avahi-browse", "avahi-browse", r)
+	}
+	services := ParseBrowse(r.Stdout)
+	out := map[string]any{"seconds": seconds, "count": len(services), "services": services}
+	if len(services) == 0 {
+		out["note"] = m.silenceNote()
+	}
+	return out, nil
+}
+
+// silenceNote says why nothing may have been heard, from the packet filter when it can be read.
+func (m *Machine) silenceNote() string {
+	if rs, err := m.Root("nft", "list", "ruleset"); err == nil && !InboundMDNS(rs) {
+		return "nothing was heard, and this machine's packet filter drops inbound UDP 5353 (mDNS): other machines' answers do not reach avahi"
+	}
+	return "nothing was heard on the local network"
+}
+
+// Resolve asks avahi for a name's address (or an address's name), and the name service the same,
+// so an answer avahi has and an ordinary lookup does not shows the switch unwired.
+func (m *Machine) Resolve(name, address string) (map[string]any, error) {
+	if (name == "") == (address == "") {
+		return nil, fmt.Errorf("give a name or an address")
+	}
+	out := map[string]any{}
+	var r Ran
+	if name != "" {
+		if !strings.HasSuffix(name, ".local") {
+			name += ".local"
+		}
+		out["name"] = name
+		r = m.Run(bg(), "avahi-resolve", "-n", name)
+	} else {
+		if net.ParseIP(address) == nil {
+			return nil, fmt.Errorf("%q is not an address", address)
+		}
+		out["address"] = address
+		r = m.Run(bg(), "avahi-resolve", "-a", address)
+	}
+	if r.Err != "" {
+		return nil, failure("avahi-resolve", "avahi-resolve", r)
+	}
+	// avahi-resolve says a failure on stderr and exits 0.
+	avahi := map[string]any{"answers": []string{}}
+	for _, l := range lines(r.Stdout) {
+		if f := strings.Fields(l); len(f) >= 2 {
+			avahi["answers"] = append(avahi["answers"].([]string), f[1])
+		}
+	}
+	if said := firstLine(r.Stderr); said != "" {
+		avahi["error"] = said
+	}
+	avahi["resolved"] = len(avahi["answers"].([]string)) > 0
+	out["avahi"] = avahi
+	if name != "" {
+		nss := map[string]any{"answers": []string{}}
+		g := m.Run(bg(), "getent", "hosts", name)
+		for _, l := range lines(g.Stdout) {
+			if f := strings.Fields(l); len(f) >= 1 {
+				nss["answers"] = append(nss["answers"].([]string), f[0])
+			}
+		}
+		nss["resolved"] = len(nss["answers"].([]string)) > 0
+		out["name_service"] = nss
+	}
+	if avahi["resolved"] == false {
+		out["note"] = m.silenceNote()
+	}
+	return out, nil
+}
+
+// Published is one service this machine announces from a file of /etc/avahi/services.
+type Published struct {
+	File  string   `json:"file"`
+	Name  string   `json:"name,omitempty"`
+	Types []string `json:"types"`
+	Ports []int    `json:"ports"`
+}
+
+var (
+	xmlName = regexp.MustCompile(`<name[^>]*>([^<]*)</name>`)
+	xmlType = regexp.MustCompile(`<type>([^<]*)</type>`)
+	xmlPort = regexp.MustCompile(`<port>(\d+)</port>`)
+)
+
+// Services is what this machine publishes from its service files.
+func (m *Machine) Services() (map[string]any, error) {
+	r := m.Run(bg(), "find", ServicesDir, "-mindepth", "1", "-maxdepth", "1", "-name", "*.service", "-printf", "%f\n")
+	if r.Err != "" || r.Status != 0 {
+		if strings.Contains(r.Stderr, "No such file") {
+			return map[string]any{"directory": ServicesDir, "published": []Published{}}, nil
+		}
+		return nil, failure("find", "find", r)
+	}
+	pub := []Published{}
+	names := lines(r.Stdout)
+	sort.Strings(names)
+	for _, n := range names {
+		text, err := m.ReadFile(ServicesDir + "/" + n)
+		if err != nil {
+			return nil, err
+		}
+		p := Published{File: n, Types: []string{}, Ports: []int{}}
+		if x := xmlName.FindStringSubmatch(string(text)); x != nil {
+			p.Name = x[1]
+		}
+		for _, t := range xmlType.FindAllStringSubmatch(string(text), -1) {
+			p.Types = append(p.Types, t[1])
+		}
+		for _, x := range xmlPort.FindAllStringSubmatch(string(text), -1) {
+			port, _ := strconv.Atoi(x[1])
+			p.Ports = append(p.Ports, port)
+		}
+		pub = append(pub, p)
+	}
+	return map[string]any{"directory": ServicesDir, "published": pub}, nil
+}

modules/avahi/cmd/avahi-tools/avahi_test.go

@@ -0,0 +1,165 @@
+package main
+
+import (
+	"strings"
+	"testing"
+)
+
+const browse = `+;enp6s0;IPv4;home\032server;_ssh._tcp;local
++;enp6s0;IPv4;Printer\046Co;_ipp._tcp;local
+=;enp6s0;IPv4;home\032server;_ssh._tcp;local;home-server.local;192.168.1.10;22;
+=;enp6s0;IPv4;Printer\046Co;_ipp._tcp;local;printer.local;192.168.1.20;631;"txtvers=1" "rp=ipp/print"
++;enp6s0;IPv6;Kitchen;_spotify-connect._tcp;local
+`
+
+func TestABrowseIsReadResolvedOnceAndUnescaped(t *testing.T) {
+	s := ParseBrowse(browse)
+	if len(s) != 3 {
+		t.Fatalf("%+v", s)
+	}
+	by := map[string]Service{}
+	for _, x := range s {
+		by[x.Name] = x
+	}
+	ssh := by["home server"]
+	if !ssh.Resolved || ssh.Address != "192.168.1.10" || ssh.Port != 22 || ssh.Host != "home-server.local" {
+		t.Fatalf("%+v", ssh)
+	}
+	ipp := by["Printer.Co"]
+	if strings.Join(ipp.TXT, ",") != "txtvers=1,rp=ipp/print" {
+		t.Fatalf("%+v", ipp)
+	}
+	if k := by["Kitchen"]; k.Resolved || k.Type != "_spotify-connect._tcp" {
+		t.Fatalf("%+v", k)
+	}
+	if unescape(`caf\195\169`) != "café" || unescape(`a\.b`) != "a.b" {
+		t.Fatal("unescape")
+	}
+}
+
+func TestABrowseThatHearsNothingSaysTheFilterDropsMDNS(t *testing.T) {
+	var calls []call
+	m := machine(fake(func(c call) Ran {
+		switch c.String() {
+		case "timeout 5 avahi-browse -p -r -t -a":
+			return Ran{Status: 124}
+		case "sudo -n nft list ruleset":
+			return Ran{Stdout: "table inet mesh {\n chain input {\n type filter hook input priority filter; policy drop;\n tcp dport 22 accept\n }\n}\n"}
+		}
+		return Ran{Status: 99}
+	}, &calls), 1000)
+	r, err := m.Browse(5, "")
+	if err != nil || r["count"] != 0 || !strings.Contains(r["note"].(string), "drops inbound UDP 5353") {
+		t.Fatalf("%v %v", r, err)
+	}
+	if _, err := m.Browse(5, "ssh; rm"); err == nil {
+		t.Fatal("not a service type")
+	}
+}
+
+func TestTheFilterIsReadForAnAcceptedInboundMDNS(t *testing.T) {
+	for rs, want := range map[string]bool{
+		"\t\tudp dport 5353 accept\n":                            true,
+		"\t\tiifname \"enp6s0\" udp dport { 53, 5353 } accept\n": true,
+		"\t\tudp dport mdns accept\n":                            true,
+		"\t\tudp dport 53 accept\n":                              false,
+		"\t\tudp dport 5353 drop\n":                              false,
+		"\t\tip saddr 10.0.0.0/8 udp dport 15353 accept\n":       false,
+	} {
+		if InboundMDNS(rs) != want {
+			t.Errorf("%q: %v", rs, !want)
+		}
+	}
+}
+
+func TestStatusNamesTheSwitchTheFilterAndTheDaemon(t *testing.T) {
+	m := machine(fake(func(c call) Ran {
+		switch {
+		case c.name == "systemctl" && c.args[1] == Daemon:
+			return Ran{Stdout: "LoadState=loaded\nActiveState=active\nUnitFileState=enabled\n"}
+		case c.name == "systemctl":
+			return Ran{Stdout: "ActiveState=inactive\n"}
+		case c.String() == "avahi-daemon --version":
+			return Ran{Stdout: "avahi-daemon 0.9-rc5\n"}
+		case c.String() == "pacman -Q nss-mdns":
+			return Ran{Stdout: "nss-mdns 0.15.1-2\n"}
+		case c.String() == "sudo -n nft list ruleset":
+			return Ran{Stdout: "udp dport 53 accept\n"}
+		}
+		return Ran{Status: 99}
+	}, nil), 1000)
+	files := map[string]string{
+		DaemonConf: "[server]\nuse-ipv4=yes\n#host-name=foo\nallow-interfaces=enp6s0\n[publish]\npublish-hinfo=no\n",
+		NSSwitch:   "passwd: files\nhosts: mymachines files dns mdns4_minimal [NOTFOUND=return] resolve [!UNAVAIL=return]\n",
+	}
+	m.ReadFile = func(p string) ([]byte, error) {
+		if s, ok := files[p]; ok {
+			return []byte(s), nil
+		}
+		return nil, errNoFile
+	}
+	s, err := m.GetStatus()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !s.MDNSWired || s.NSSMDNS != "nss-mdns 0.15.1-2" || s.InboundMDNS == nil || *s.InboundMDNS || s.Version != "avahi-daemon 0.9-rc5" {
+		t.Fatalf("%+v", s)
+	}
+	if s.Config["server"]["allow-interfaces"] != "enp6s0" || s.Config["server"]["host-name"] != "" || s.Daemon["ActiveState"] != "active" {
+		t.Fatalf("%+v", s.Config)
+	}
+	if len(s.Notes) != 1 || !strings.Contains(s.Notes[0], "drops inbound UDP 5353") {
+		t.Fatalf("%v", s.Notes)
+	}
+	if _, wired := HostsLine("hosts: files dns\n"); wired {
+		t.Fatal("no mdns on the line")
+	}
+}
+
+func TestResolveAsksAvahiAndTheNameServiceAndReadsAFailureFromStderr(t *testing.T) {
+	m := machine(byLine(map[string]Ran{
+		"avahi-resolve -n printer.local": {Stdout: "printer.local\t192.168.1.20\n"},
+		"getent hosts printer.local":     {Status: 2},
+		"avahi-resolve -n nowhere.local": {Stderr: "Failed to resolve host name 'nowhere.local': Timeout reached\n"},
+		"getent hosts nowhere.local":     {Status: 2},
+		"sudo -n nft list ruleset":       {Stdout: "udp dport 5353 accept\n"},
+		"avahi-resolve -a 192.168.1.20":  {Stdout: "192.168.1.20\tprinter.local\n"},
+	}, nil), 1000)
+	r, err := m.Resolve("printer", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if r["avahi"].(map[string]any)["resolved"] != true || r["name_service"].(map[string]any)["resolved"] != false {
+		t.Fatalf("%v", r)
+	}
+	r, _ = m.Resolve("nowhere.local", "")
+	if a := r["avahi"].(map[string]any); a["resolved"] != false || !strings.Contains(a["error"].(string), "Timeout reached") || r["note"] != "nothing was heard on the local network" {
+		t.Fatalf("%v", r)
+	}
+	r, _ = m.Resolve("", "192.168.1.20")
+	if r["avahi"].(map[string]any)["answers"].([]string)[0] != "printer.local" {
+		t.Fatalf("%v", r)
+	}
+	for _, bad := range [][2]string{{"", ""}, {"a", "1.2.3.4"}, {"", "not-an-ip"}} {
+		if _, err := m.Resolve(bad[0], bad[1]); err == nil {
+			t.Errorf("%v accepted", bad)
+		}
+	}
+}
+
+func TestPublishedServicesAreReadFromTheirFiles(t *testing.T) {
+	m := machine(byLine(map[string]Ran{
+		"find /etc/avahi/services -mindepth 1 -maxdepth 1 -name *.service -printf %f\n": {Stdout: "ssh.service\n"},
+	}, nil), 1000)
+	m.ReadFile = func(string) ([]byte, error) {
+		return []byte(`<service-group><name replace-wildcards="yes">%h</name><service><type>_ssh._tcp</type><port>22</port></service></service-group>`), nil
+	}
+	r, err := m.Services()
+	if err != nil {
+		t.Fatal(err)
+	}
+	p := r["published"].([]Published)
+	if len(p) != 1 || p[0].Name != "%h" || p[0].Types[0] != "_ssh._tcp" || p[0].Ports[0] != 22 {
+		t.Fatalf("%+v", p)
+	}
+}

modules/avahi/cmd/avahi-tools/machine.go

@@ -0,0 +1,289 @@
+package main
+
+// The commands this bundle runs on its machine, and who runs them.
+//
+// Who asks. The node's tool runtime runs as the operator account, not root (novox/hq ADR 0175 §4),
+// and launches this binary as a process of its own (ADR 0188, ADR 0193) with the runtime's words —
+// HOME, a PATH, MESH_OPERATOR_ACCOUNT — and no session words. Reading needs nothing more; what only
+// root may do goes through `sudo -n`, as the packet filter's, the service manager's and the
+// intrusion prevention's tools do (to-be 38 WP4), and the `sudo` module is what declares that the
+// account may (to-be 42, research 027). A refusal is named by how it failed, never read as an
+// empty answer.
+//
+// The runner is injected, so every tool is tested over a fake one without the machine.
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"os/exec"
+	"strings"
+	"time"
+)
+
+// Ran is what one command did: its output, its exit status, and why it never ran to an answer.
+type Ran struct {
+	Stdout string
+	Stderr string
+	Status int
+	// Err is "ENOENT" when the program is not there, or that it was ended for taking too long.
+	Err string
+}
+
+// Runner runs one command, so the tools can be tested without the machine.
+type Runner func(ctx context.Context, name string, args ...string) Ran
+
+// CallTimeout is how long one command may take: below the runtime's thirty-second call limit, so a
+// command that hangs is answered as such rather than as a call the runtime gave up on.
+const CallTimeout = 20 * time.Second
+
+// outputLimit bounds what one command may hand back, so a runaway listing cannot exhaust the
+// process; well above anything a tool answers.
+const outputLimit = 16 << 20
+
+type bounded struct {
+	bytes.Buffer
+	cut bool
+}
+
+func (b *bounded) Write(p []byte) (int, error) {
+	if room := outputLimit - b.Len(); room < len(p) {
+		if room > 0 {
+			b.Buffer.Write(p[:room])
+		}
+		b.cut = true
+		return len(p), nil
+	}
+	return b.Buffer.Write(p)
+}
+
+// ExecRunner runs a command on this machine, in the C locale so what is parsed is one language.
+func ExecRunner(ctx context.Context, name string, args ...string) Ran {
+	ctx, cancel := context.WithTimeout(ctx, CallTimeout)
+	defer cancel()
+	cmd := exec.CommandContext(ctx, name, args...)
+	cmd.Env = append(os.Environ(), "LC_ALL=C")
+	var out, errb bounded
+	cmd.Stdout, cmd.Stderr = &out, &errb
+	err := cmd.Run()
+	r := Ran{Stdout: out.String(), Stderr: errb.String()}
+	if ctx.Err() == context.DeadlineExceeded {
+		r.Status, r.Err = 124, fmt.Sprintf("no answer within %d s", int(CallTimeout.Seconds()))
+		return r
+	}
+	var exit *exec.ExitError
+	switch {
+	case err == nil:
+	case errors.As(err, &exit):
+		r.Status = exit.ExitCode()
+	case errors.Is(err, exec.ErrNotFound) || errors.Is(err, fs.ErrNotExist):
+		r.Status, r.Err = 127, "ENOENT"
+	default:
+		r.Status, r.Err = 126, err.Error()
+	}
+	return r
+}
+
+// Escalated is the command as it is run: as given when this process is root, else through sudo
+// without a prompt.
+func Escalated(uid int, name string, args ...string) (string, []string) {
+	if uid == 0 {
+		return name, args
+	}
+	return "sudo", append([]string{"-n", name}, args...)
+}
+
+// Machine is this machine as the tools see it: a runner, who this process is, and its files.
+type Machine struct {
+	Run      Runner
+	UID      int
+	User     string
+	Account  string
+	ReadFile func(path string) ([]byte, error)
+	Now      func() time.Time
+	Sleep    func(time.Duration)
+}
+
+// ThisMachine is the machine the runtime launched this bundle on.
+func ThisMachine() *Machine {
+	user := os.Getenv("USER")
+	if user == "" {
+		user = os.Getenv("LOGNAME")
+	}
+	account := strings.TrimSpace(os.Getenv("MESH_OPERATOR_ACCOUNT"))
+	if account == "" {
+		account = user
+	}
+	return &Machine{Run: ExecRunner, UID: os.Getuid(), User: user, Account: account, ReadFile: os.ReadFile, Now: time.Now, Sleep: time.Sleep}
+}
+
+// Out runs a command that only reads, and fails with what went wrong named.
+func (m *Machine) Out(name string, args ...string) (string, error) {
+	r := m.Run(context.Background(), name, args...)
+	if r.Status == 0 && r.Err == "" {
+		return r.Stdout, nil
+	}
+	return r.Stdout, failure(name, name, r)
+}
+
+// Root runs a command that needs root, escalated when this process is not.
+func (m *Machine) Root(name string, args ...string) (string, error) {
+	program, argv := Escalated(m.UID, name, args...)
+	r := m.Run(context.Background(), program, argv...)
+	if r.Status == 0 && r.Err == "" {
+		return r.Stdout, nil
+	}
+	return r.Stdout, failure(name, program, r)
+}
+
+// RootRan is Root's raw answer, for a command whose non-zero status is itself an answer.
+func (m *Machine) RootRan(name string, args ...string) (Ran, error) {
+	program, argv := Escalated(m.UID, name, args...)
+	r := m.Run(context.Background(), program, argv...)
+	if r.Err != "" || (program == "sudo" && sudoRefused(r)) {
+		return r, failure(name, program, r)
+	}
+	return r, nil
+}
+
+func sudoRefused(r Ran) bool {
+	return strings.HasPrefix(strings.TrimSpace(r.Stderr), "sudo:")
+}
+
+// failure names what failed by how it failed: the program missing is a spawn error, sudo missing
+// or refusing speaks for itself, and the rest is the command's own first line.
+func failure(cmd, program string, r Ran) error {
+	said := strings.TrimSpace(r.Stderr + "\n" + r.Stdout)
+	if r.Err == "ENOENT" {
+		if program == "sudo" {
+			return fmt.Errorf("%s needs root for this, and sudo is not installed here for the runtime's account to escalate with", cmd)
+		}
+		return fmt.Errorf("%s is not installed on this machine", cmd)
+	}
+	if r.Err != "" {
+		return fmt.Errorf("%s did not answer: %s", cmd, r.Err)
+	}
+	if program == "sudo" && sudoRefused(r) {
+		if strings.Contains(said, "command not found") {
+			return fmt.Errorf("%s is not installed on this machine", cmd)
+		}
+		return fmt.Errorf("%s needs root for this and the runtime's account may not run it without a prompt: %s", cmd, firstLine(said))
+	}
+	if line := firstLine(said); line != "" {
+		return fmt.Errorf("%s failed (%d): %s", cmd, r.Status, line)
+	}
+	return fmt.Errorf("%s failed with status %d", cmd, r.Status)
+}
+
+func firstLine(text string) string {
+	for _, l := range strings.Split(text, "\n") {
+		if l = strings.TrimSpace(l); l != "" {
+			return l
+		}
+	}
+	return ""
+}
+
+func lines(text string) []string {
+	var out []string
+	for _, l := range strings.Split(text, "\n") {
+		if l = strings.TrimRight(l, "\r"); strings.TrimSpace(l) != "" {
+			out = append(out, l)
+		}
+	}
+	return out
+}
+
+// text is a string argument; required says whether it may be absent. It is never something a
+// command would read as an option, which under sudo would be root's option.
+func text(args map[string]any, key string, required bool) (string, error) {
+	raw, present := args[key]
+	if !present || raw == nil {
+		if required {
+			return "", fmt.Errorf("%s is required", key)
+		}
+		return "", nil
+	}
+	s, ok := raw.(string)
+	if !ok {
+		return "", fmt.Errorf("%s must be a string", key)
+	}
+	s = strings.TrimSpace(s)
+	if required && s == "" {
+		return "", fmt.Errorf("%s is required", key)
+	}
+	if strings.HasPrefix(s, "-") || strings.ContainsRune(s, 0) || strings.ContainsAny(s, "\n\r") {
+		return "", fmt.Errorf("%s %q is not a value this tool passes on", key, s)
+	}
+	return s, nil
+}
+
+// whole is a whole-number argument with a default, kept within bounds.
+func whole(args map[string]any, key string, def, least, most int) (int, error) {
+	raw, present := args[key]
+	if !present || raw == nil {
+		return def, nil
+	}
+	f, ok := raw.(float64)
+	if !ok || f != float64(int(f)) {
+		return 0, fmt.Errorf("%s must be a whole number", key)
+	}
+	n := int(f)
+	if n < least {
+		return 0, fmt.Errorf("%s must be at least %d", key, least)
+	}
+	if n > most {
+		n = most
+	}
+	return n, nil
+}
+
+// flag is a boolean argument, false when absent.
+func flag(args map[string]any, key string) (bool, error) {
+	raw, present := args[key]
+	if !present || raw == nil {
+		return false, nil
+	}
+	b, ok := raw.(bool)
+	if !ok {
+		return false, fmt.Errorf("%s must be true or false", key)
+	}
+	return b, nil
+}
+
+// schema is a tool's input: its properties and the ones it requires.
+func schema(properties map[string]any, required ...string) map[string]any {
+	s := map[string]any{"type": "object", "properties": properties}
+	if len(required) > 0 {
+		s["required"] = required
+	}
+	return s
+}
+
+// unitProps reads a unit's properties as systemctl shows them.
+func (m *Machine) unitProps(unit string, props ...string) (map[string]string, error) {
+	args := []string{"show", unit, "--no-pager"}
+	for _, p := range props {
+		args = append(args, "--property="+p)
+	}
+	out, err := m.Out("systemctl", args...)
+	if err != nil {
+		return nil, err
+	}
+	return keyValues(out, "="), nil
+}
+
+// keyValues reads `key<sep>value` lines; a line without the separator is skipped.
+func keyValues(out, sep string) map[string]string {
+	kv := map[string]string{}
+	for _, l := range strings.Split(out, "\n") {
+		k, v, ok := strings.Cut(l, sep)
+		if ok {
+			kv[strings.TrimSpace(k)] = strings.TrimSpace(v)
+		}
+	}
+	return kv
+}

modules/avahi/cmd/avahi-tools/machine_test.go

@@ -0,0 +1,107 @@
+package main
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+)
+
+// call is one command a fake runner was asked to run.
+type call struct {
+	name string
+	args []string
+}
+
+func (c call) String() string {
+	if len(c.args) == 0 {
+		return c.name
+	}
+	return c.name + " " + strings.Join(c.args, " ")
+}
+
+// fake is a runner answering by the command line it is given, recording every call.
+func fake(answer func(c call) Ran, calls *[]call) Runner {
+	return func(_ context.Context, name string, args ...string) Ran {
+		c := call{name, append([]string(nil), args...)}
+		if calls != nil {
+			*calls = append(*calls, c)
+		}
+		return answer(c)
+	}
+}
+
+// byLine answers from a table keyed by the whole command line, and refuses anything else as a
+// command the test did not expect.
+func byLine(table map[string]Ran, calls *[]call) Runner {
+	return fake(func(c call) Ran {
+		if r, ok := table[c.String()]; ok {
+			return r
+		}
+		return Ran{Status: 99, Stderr: "unexpected command: " + c.String()}
+	}, calls)
+}
+
+func machine(run Runner, uid int) *Machine {
+	return &Machine{Run: run, UID: uid, User: "operator", Account: "operator",
+		ReadFile: func(string) ([]byte, error) { return nil, errNoFile },
+		Now:      func() time.Time { return time.Date(2026, 10, 4, 12, 0, 0, 0, time.UTC) },
+		Sleep:    func(time.Duration) {}}
+}
+
+type noFile struct{}
+
+func (noFile) Error() string { return "no such file" }
+
+var errNoFile = noFile{}
+
+func TestAnActNeedingRootGoesThroughSudoWithoutAPromptUnlessThisIsRoot(t *testing.T) {
+	if p, a := Escalated(1000, "visudo", "-c"); p != "sudo" || strings.Join(a, " ") != "-n visudo -c" {
+		t.Fatalf("not root: %s %v", p, a)
+	}
+	if p, a := Escalated(0, "visudo", "-c"); p != "visudo" || strings.Join(a, " ") != "-c" {
+		t.Fatalf("root: %s %v", p, a)
+	}
+}
+
+func TestFailuresAreNamedNeverReadAsEmpty(t *testing.T) {
+	cases := []struct {
+		r    Ran
+		want string
+	}{
+		{Ran{Status: 127, Err: "ENOENT"}, "sudo is not installed here"},
+		{Ran{Status: 1, Stderr: "sudo: a password is required\n"}, "may not run it without a prompt: sudo: a password is required"},
+		{Ran{Status: 124, Err: "no answer within 20 s"}, "did not answer: no answer within 20 s"},
+		{Ran{Status: 2, Stderr: "boom\nmore"}, "failed (2): boom"},
+	}
+	for _, c := range cases {
+		m := machine(fake(func(call) Ran { return c.r }, nil), 1000)
+		if _, err := m.Root("thing"); err == nil || !strings.Contains(err.Error(), c.want) {
+			t.Errorf("%+v: %v, want %q", c.r, err, c.want)
+		}
+	}
+	m := machine(fake(func(call) Ran { return Ran{Status: 127, Err: "ENOENT"} }, nil), 1000)
+	if _, err := m.Out("thing"); err == nil || !strings.Contains(err.Error(), "thing is not installed") {
+		t.Errorf("a missing program: %v", err)
+	}
+}
+
+func TestAnArgumentIsNeverAnOption(t *testing.T) {
+	for _, bad := range []any{"-rf", "a\nb", 3.0} {
+		if _, err := text(map[string]any{"x": bad}, "x", true); err == nil {
+			t.Errorf("%v was accepted", bad)
+		}
+	}
+	if s, err := text(map[string]any{"x": " ok "}, "x", true); err != nil || s != "ok" {
+		t.Errorf("a plain value: %q %v", s, err)
+	}
+	if _, err := text(map[string]any{}, "x", true); err == nil {
+		t.Error("a missing required value was accepted")
+	}
+	if n, _ := whole(map[string]any{"n": 10000.0}, "n", 5, 1, 100); n != 100 {
+		t.Errorf("not bounded: %d", n)
+	}
+	if _, err := whole(map[string]any{"n": 0.0}, "n", 5, 1, 100); err == nil {
+		t.Error("below the least was accepted")
+	}
+}

modules/avahi/cmd/avahi-tools/main.go

@@ -0,0 +1,85 @@
+// avahi's tools bundle (novox/hq to-be 42 Phase 1, research 026/05): a process the node's runtime
+// launches and speaks MCP over stdio to, through the Go SDK (ADR 0188, ADR 0193). It reads the
+// daemon, the name service's wiring and the packet filter's view of mDNS, browses the local network
+// for services, resolves a name, and lists what the machine publishes. It changes nothing.
+package main
+
+import (
+	"context"
+	"fmt"
+	"os"
+
+	stdio "git.novox.be/novox/mesh-sdk/go"
+)
+
+// binaryName is what the build names this bundle's executable: the manifest's `binary`.
+const binaryName = "avahi-tools"
+
+func bg() context.Context { return context.Background() }
+
+func main() {
+	// An empty name serves as the module the runtime names (MESH_SERVED_MODULE): avahi.
+	if err := stdio.Serve("", tools(ThisMachine())); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+}
+
+func tools(m *Machine) []stdio.Tool {
+	return []stdio.Tool{
+		{
+			Name: "avahi_status",
+			Description: "The daemon's state and version, its configuration as set, the name service switch's hosts line and whether mdns is on it, " +
+				"whether nss-mdns is installed, whether the packet filter accepts inbound mDNS (UDP 5353), whether systemd-resolved runs beside it, " +
+				"and notes naming what keeps discovery from working.",
+			Input: schema(map[string]any{}),
+			Run:   func(map[string]any) (any, error) { return m.GetStatus() },
+		},
+		{
+			Name: "avahi_browse",
+			Description: "Listen on the local network for a few seconds (avahi-browse -prt) and answer every service announced, with interface, " +
+				"protocol, name, type, host, address, port and TXT where it resolved; narrowed to one service type when given. Hearing nothing says why it may be.",
+			Input: schema(map[string]any{
+				"seconds": map[string]any{"type": "integer", "description": "how long to listen (default 5, at most 15)"},
+				"type":    map[string]any{"type": "string", "description": "one service type, e.g. _ssh._tcp (optional)"},
+			}),
+			Run: func(args map[string]any) (any, error) {
+				n, err := whole(args, "seconds", 5, 1, 15)
+				if err != nil {
+					return nil, err
+				}
+				kind, err := text(args, "type", false)
+				if err != nil {
+					return nil, err
+				}
+				return m.Browse(n, kind)
+			},
+		},
+		{
+			Name: "avahi_resolve",
+			Description: "Resolve a .local name to its addresses through avahi, and through the name service (getent) beside it, or an address to its name. " +
+				"An answer from avahi that the name service lacks shows nsswitch unwired; no answer says why it may be.",
+			Input: schema(map[string]any{
+				"name":    map[string]any{"type": "string", "description": "a host name; .local is added when missing"},
+				"address": map[string]any{"type": "string", "description": "an address to name instead"},
+			}),
+			Run: func(args map[string]any) (any, error) {
+				name, err := text(args, "name", false)
+				if err != nil {
+					return nil, err
+				}
+				address, err := text(args, "address", false)
+				if err != nil {
+					return nil, err
+				}
+				return m.Resolve(name, address)
+			},
+		},
+		{
+			Name:        "avahi_services",
+			Description: "What this machine publishes from /etc/avahi/services: each file with the service's name, types and ports.",
+			Input:       schema(map[string]any{}),
+			Run:         func(map[string]any) (any, error) { return m.Services() },
+		},
+	}
+}

modules/avahi/cmd/avahi-tools/manifest_test.go

@@ -0,0 +1,26 @@
+package main
+
+// The module's shape (novox/hq to-be 42 Phase 1, research 027): the package and the daemon, and
+// nothing written into the name service switch or opened in the packet filter — avahi.go says why
+// neither can be declared safely today, and the tools report both instead.
+
+import "testing"
+
+func TestItDeclaresThePackageAndTheDaemonOnly(t *testing.T) {
+	m := manifest(t)
+	if p := m.resource(t, "package"); p["package"] != "avahi" {
+		t.Fatalf("%v", p)
+	}
+	d := m.resource(t, "daemon")
+	if d["unit"] != Daemon || d["state"] != "running" || d["boot"] != "enabled" {
+		t.Fatalf("%v", d)
+	}
+	for _, r := range m.Resources {
+		if r["path"] == NSSwitch || r["package"] == "nss-mdns" {
+			t.Fatalf("%v: the name service switch is left as found", r["id"])
+		}
+	}
+	if len(m.Resources) != 2 {
+		t.Fatalf("%v", m.Resources)
+	}
+}

modules/avahi/cmd/avahi-tools/shape_test.go

@@ -0,0 +1,80 @@
+package main
+
+import (
+	"encoding/json"
+	"os"
+	"testing"
+)
+
+type resource map[string]any
+
+type manifestShape struct {
+	Module       string           `json:"module"`
+	Version      string           `json:"version"`
+	Capabilities []string         `json:"capabilities"`
+	Claims       []map[string]any `json:"claims"`
+	Tools        []string         `json:"tools"`
+	Resources    []resource       `json:"resources"`
+	Build        struct {
+		Artifacts []map[string]any `json:"artifacts"`
+	} `json:"build"`
+}
+
+func manifest(t *testing.T) manifestShape {
+	t.Helper()
+	raw, err := os.ReadFile("../../module.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var m manifestShape
+	if err := json.Unmarshal(raw, &m); err != nil {
+		t.Fatal(err)
+	}
+	return m
+}
+
+func (m manifestShape) resource(t *testing.T, id string) resource {
+	t.Helper()
+	for _, r := range m.Resources {
+		if r["id"] == id {
+			return r
+		}
+	}
+	t.Fatalf("no resource %s", id)
+	return nil
+}
+
+// TestToolsAreTheManifests holds the served tools and the manifest's list to one another, and the
+// bundle to the shape the builder compiles and the runtime loads.
+func TestToolsAreTheManifests(t *testing.T) {
+	m := manifest(t)
+	names := map[string]bool{}
+	for _, tool := range tools(machine(nil, 1000)) {
+		if names[tool.Name] {
+			t.Errorf("%s is served twice", tool.Name)
+		}
+		names[tool.Name] = true
+	}
+	for _, want := range m.Tools {
+		if !names[want] {
+			t.Errorf("the manifest lists %s and the bundle does not serve it", want)
+		}
+		delete(names, want)
+	}
+	if len(names) != 0 {
+		t.Errorf("served and not listed: %v", names)
+	}
+	var tools map[string]any
+	for _, a := range m.Build.Artifacts {
+		if a["name"] == "tools" {
+			tools = a
+		}
+	}
+	if tools == nil || tools["kind"] != "bundle" || tools["language"] != "go" || tools["system"] != "arch" ||
+		tools["from"] != "cmd/"+binaryName || tools["binary"] != binaryName {
+		t.Fatalf("the tools artifact: %v", tools)
+	}
+	if loads, _ := tools["loads"].([]any); len(loads) != 1 || loads[0] != binaryName {
+		t.Fatalf("loads: %v", tools["loads"])
+	}
+}

modules/avahi/go.mod

@@ -0,0 +1,5 @@
+module avahi
+
+go 1.22
+
+require git.novox.be/novox/mesh-sdk/go v0.1.6

modules/avahi/go.sum

@@ -0,0 +1,2 @@
+git.novox.be/novox/mesh-sdk/go v0.1.6 h1:9qzdYONYbJdWcu6sxQcq9v1LI0JxcfkiKYkMUzJSkVQ=
+git.novox.be/novox/mesh-sdk/go v0.1.6/go.mod h1:GFuZUElBZ9A++mxgIKo97aXXo+kV0uJ/UkbhQPPIbrY=

modules/avahi/module.json

@@ -0,0 +1,43 @@
+{
+  "module": "avahi",
+  "version": "1",
+  "capabilities": [
+    "package-manager",
+    "service-manager"
+  ],
+  "tools": [
+    "avahi_status",
+    "avahi_browse",
+    "avahi_resolve",
+    "avahi_services"
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "avahi"
+    },
+    {
+      "id": "daemon",
+      "type": "service",
+      "unit": "avahi-daemon.service",
+      "state": "running",
+      "boot": "enabled"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/avahi-tools",
+        "binary": "avahi-tools",
+        "loads": [
+          "avahi-tools"
+        ]
+      }
+    ]
+  }
+}

modules/bluetooth/README.md

@@ -0,0 +1,53 @@
+# bluetooth
+
+Bluetooth on the two workstations (novox/hq research 027/02, to-be 42 phase 2 step 9).
+
+## Owns
+
+| what | where |
+|---|---|
+| the Bluetooth stack and its daemon | package `bluez` |
+| `bluetoothctl`, which the tools speak through | package `bluez-utils` |
+| the daemon, running and enabled | `bluetooth.service` |
+
+All official. `/etc/bluetooth/main.conf` is the package's file, unchanged on both workstations
+(every setting commented out). The module states nothing in it, so it declares nothing there.
+
+## Improves
+
+- **The stack is declared, not a dependency of something else.** On both workstations `bluez` is
+  installed only as a dependency. Removing the applet that pulled it in would have left it an orphan
+  for the next clean-up to take, and Bluetooth with it.
+- **An owner for the daemon**, running and enabled on both today with nothing recording why.
+- **Headphones from the mesh.** `bluetooth_connect` and `bluetooth_devices` (with battery) answer from
+  any machine, without the applet.
+
+## Tools
+
+All answer JSON; `(r)` reads, `(a)` acts. They run as the operator account. bluez's bus policy lets
+the account act; if it ever refuses (`AccessDenied`), the act is repeated through `sudo -n`. An act
+whose output says it failed (`Failed to …`, `org.bluez.Error…`, `not available`) is an error, whatever
+bluetoothctl's exit status.
+
+| tool | what |
+|---|---|
+| `bluetooth_controller` (r) | address, name, powered, discoverable, pairable, discovering |
+| `bluetooth_power` (r/a) | read, or switch the controller on or off |
+| `bluetooth_devices` (r) | all, paired, connected or trusted devices: kind, paired, bonded, trusted, blocked, connected, battery where reported |
+| `bluetooth_scan` (r) | discover for 1 to 15 s (default 8); the unpaired devices found, strongest signal first |
+| `bluetooth_connect` / `bluetooth_disconnect` (a) | one device; connect waits up to 15 s |
+| `bluetooth_trust` (a) | trust, or untrust |
+| `bluetooth_pair` (a) | pair with an agent that confirms nothing (headphones, speakers), then trust. A device that shows a code is paired from the desktop |
+| `bluetooth_remove` (a) | forget a device |
+
+## What changes when it is assigned
+
+Nothing on disk on either workstation: both packages are installed, and the service is enabled and
+running. `bluez` becomes explicitly the mesh's.
+
+## Leaves as found
+
+- The paired devices and their keys under `/var/lib/bluetooth` (bluez's state).
+- `blueman` on both workstations, and its applet, which the window manager's configuration starts.
+  That line is the `i3` module's to keep or drop.
+- `bluez-obex` and the AUR terminal client `bluetuith-bin` (with its `-debug`) on the laptop.

modules/bluetooth/cmd/bluetooth-tools/bluetooth.go

@@ -0,0 +1,281 @@
+package main
+
+import (
+	"fmt"
+	"regexp"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+)
+
+var macAddress = regexp.MustCompile(`^[0-9A-Fa-f]{2}(:[0-9A-Fa-f]{2}){5}$`)
+
+func addressOf(args map[string]any) (string, error) {
+	a, err := text(args, "address")
+	if err != nil {
+		return "", err
+	}
+	if !macAddress.MatchString(a) {
+		return "", fmt.Errorf("%q is not a Bluetooth address (six hex pairs separated by colons)", a)
+	}
+	return strings.ToUpper(a), nil
+}
+
+var ansi = regexp.MustCompile(`\x1b\[[0-9;]*[A-Za-z]|\x01|\x02`)
+
+// btFailed are the words bluetoothctl uses for an act that did not happen, whatever its exit status.
+var btFailed = regexp.MustCompile(`(?m)(Failed to \w+|not available|org\.bluez\.Error\.\w+|No default controller available)`)
+
+// bt runs bluetoothctl once, non-interactively, as the account; bluez's bus policy lets the
+// account act, and if it refuses, the act is run through sudo -n.
+func bt(timeout time.Duration, args ...string) (string, error) {
+	c := Cmd{Name: "bluetoothctl", Args: args, Timeout: timeout}
+	r := run(c)
+	if strings.Contains(r.Stdout+r.Stderr, "AccessDenied") || strings.Contains(r.Stdout+r.Stderr, "Not authorized") {
+		c.Root = true
+		r = run(c)
+	}
+	out := ansi.ReplaceAllString(r.Stdout+"\n"+r.Stderr, "")
+	if r.Error != "" {
+		return out, failure(c, r)
+	}
+	if strings.Contains(out, "No default controller available") {
+		return out, fmt.Errorf("this machine has no Bluetooth controller bluez can use: none is present, it is blocked (rfkill), or bluetooth.service is not running")
+	}
+	if m := btFailed.FindString(out); m != "" || r.Status != 0 {
+		said := strings.TrimSpace(out)
+		if said == "" {
+			said = fmt.Sprintf("exit status %d", r.Status)
+		}
+		return out, fmt.Errorf("bluetoothctl %s: %s", strings.Join(args, " "), tail(said, 1000))
+	}
+	return out, nil
+}
+
+// fields reads bluetoothctl's "\tKey: value" lines; a key seen twice keeps its first value.
+func fields(s string) map[string]string {
+	out := map[string]string{}
+	for _, l := range strings.Split(s, "\n") {
+		if !strings.HasPrefix(l, "\t") {
+			continue
+		}
+		k, v, ok := strings.Cut(strings.TrimSpace(l), ":")
+		if !ok {
+			continue
+		}
+		if _, seen := out[k]; !seen {
+			out[k] = strings.TrimSpace(v)
+		}
+	}
+	return out
+}
+
+func yes(v string) bool { return v == "yes" }
+
+// ControllerAnswer is what bluetooth_controller answers.
+type ControllerAnswer struct {
+	Address      string `json:"address"`
+	Name         string `json:"name"`
+	Alias        string `json:"alias"`
+	Powered      bool   `json:"powered"`
+	PowerState   string `json:"power_state,omitempty"`
+	Discoverable bool   `json:"discoverable"`
+	Pairable     bool   `json:"pairable"`
+	Discovering  bool   `json:"discovering"`
+}
+
+// Controller answers the default controller.
+func Controller() (ControllerAnswer, error) {
+	out, err := bt(CallTimeout, "show")
+	if err != nil {
+		return ControllerAnswer{}, err
+	}
+	c := ControllerAnswer{}
+	for _, l := range strings.Split(out, "\n") {
+		if f := strings.Fields(l); len(f) >= 2 && f[0] == "Controller" {
+			c.Address = f[1]
+			break
+		}
+	}
+	if c.Address == "" {
+		return ControllerAnswer{}, fmt.Errorf("bluetoothctl show answered no controller: %s", tail(strings.TrimSpace(out), 500))
+	}
+	f := fields(out)
+	c.Name, c.Alias, c.PowerState = f["Name"], f["Alias"], f["PowerState"]
+	c.Powered, c.Discoverable, c.Pairable, c.Discovering = yes(f["Powered"]), yes(f["Discoverable"]), yes(f["Pairable"]), yes(f["Discovering"])
+	return c, nil
+}
+
+// Power switches the controller on or off.
+func Power(on bool) (map[string]any, error) {
+	word := "off"
+	if on {
+		word = "on"
+	}
+	if _, err := bt(CallTimeout, "power", word); err != nil {
+		return nil, err
+	}
+	c, err := Controller()
+	if err != nil {
+		return nil, err
+	}
+	return map[string]any{"powered": c.Powered, "asked": word}, nil
+}
+
+// Device is one device bluez knows.
+type Device struct {
+	Address   string `json:"address"`
+	Name      string `json:"name"`
+	Icon      string `json:"kind,omitempty"`
+	Paired    bool   `json:"paired"`
+	Bonded    bool   `json:"bonded"`
+	Trusted   bool   `json:"trusted"`
+	Blocked   bool   `json:"blocked"`
+	Connected bool   `json:"connected"`
+	Battery   *int   `json:"battery_percent,omitempty"`
+	RSSI      *int   `json:"rssi,omitempty"`
+}
+
+var inParens = regexp.MustCompile(`\((-?[0-9]+)\)`)
+
+// number reads "0x50 (80)" or "-62" as a number.
+func number(v string) *int {
+	if m := inParens.FindStringSubmatch(v); m != nil {
+		v = m[1]
+	}
+	n, err := strconv.Atoi(strings.TrimSpace(v))
+	if err != nil {
+		return nil
+	}
+	return &n
+}
+
+// deviceInfo asks bluez for one device.
+func deviceInfo(address string) (Device, error) {
+	out, err := bt(CallTimeout, "info", address)
+	if err != nil {
+		return Device{}, err
+	}
+	f := fields(out)
+	d := Device{Address: address, Name: f["Name"], Icon: f["Icon"], Paired: yes(f["Paired"]), Bonded: yes(f["Bonded"]),
+		Trusted: yes(f["Trusted"]), Blocked: yes(f["Blocked"]), Connected: yes(f["Connected"])}
+	if d.Name == "" {
+		d.Name = f["Alias"]
+	}
+	if v, ok := f["Battery Percentage"]; ok {
+		d.Battery = number(v)
+	}
+	if v, ok := f["RSSI"]; ok {
+		d.RSSI = number(v)
+	}
+	return d, nil
+}
+
+// listed reads "Device <address> <name>" lines.
+func listed(out string) []string {
+	seen := map[string]bool{}
+	addrs := []string{}
+	for _, l := range strings.Split(out, "\n") {
+		f := strings.Fields(strings.TrimSpace(l))
+		if len(f) >= 2 && f[0] == "Device" && macAddress.MatchString(f[1]) && !seen[f[1]] {
+			seen[f[1]] = true
+			addrs = append(addrs, f[1])
+		}
+	}
+	return addrs
+}
+
+// Devices answers the devices bluez knows, with each one's state.
+func Devices(which string) (map[string]any, error) {
+	if err := oneOf("which", which, "all", "paired", "connected", "trusted"); err != nil {
+		return nil, err
+	}
+	args := []string{"devices"}
+	if which != "all" {
+		args = append(args, strings.ToUpper(which[:1])+which[1:])
+	}
+	out, err := bt(CallTimeout, args...)
+	if err != nil {
+		return nil, err
+	}
+	devices := []Device{}
+	for _, a := range listed(out) {
+		d, err := deviceInfo(a)
+		if err != nil {
+			return nil, err
+		}
+		devices = append(devices, d)
+	}
+	sort.SliceStable(devices, func(i, k int) bool {
+		if devices[i].Connected != devices[k].Connected {
+			return devices[i].Connected
+		}
+		return devices[i].Name < devices[k].Name
+	})
+	return map[string]any{"which": which, "count": len(devices), "devices": devices}, nil
+}
+
+// Scan discovers for a while and answers the devices found that are not paired.
+func Scan(seconds int) (map[string]any, error) {
+	// bluetoothctl's own --timeout ends the scan; the command's bound is a little longer.
+	limit := time.Duration(seconds+4) * time.Second
+	if _, err := bt(limit, "--timeout", strconv.Itoa(seconds), "scan", "on"); err != nil {
+		return nil, err
+	}
+	out, err := bt(CallTimeout, "devices")
+	if err != nil {
+		return nil, err
+	}
+	found := []Device{}
+	for _, a := range listed(out) {
+		// A device seen a moment ago may have gone out of reach: it is skipped, not a failure.
+		d, err := deviceInfo(a)
+		if err != nil {
+			continue
+		}
+		if !d.Paired {
+			found = append(found, d)
+		}
+	}
+	sort.SliceStable(found, func(i, k int) bool {
+		ri, rk := -1000, -1000
+		if found[i].RSSI != nil {
+			ri = *found[i].RSSI
+		}
+		if found[k].RSSI != nil {
+			rk = *found[k].RSSI
+		}
+		return ri > rk
+	})
+	return map[string]any{"seconds": seconds, "count": len(found), "found": found}, nil
+}
+
+// Act runs one act on a device and answers the device's state afterwards.
+func Act(verb, address string) (map[string]any, error) {
+	limit := CallTimeout
+	if verb == "connect" {
+		// A connect waits for the device; bluetoothctl's own timeout ends it first.
+		if _, err := bt(limit, "--timeout", "15", verb, address); err != nil {
+			return nil, err
+		}
+	} else if _, err := bt(limit, verb, address); err != nil {
+		return nil, err
+	}
+	if verb == "remove" {
+		return map[string]any{"act": verb, "address": address, "removed": true}, nil
+	}
+	d, err := deviceInfo(address)
+	if err != nil {
+		return nil, err
+	}
+	return map[string]any{"act": verb, "device": d}, nil
+}
+
+// Pair pairs a device with an agent that confirms nothing, then trusts it.
+func Pair(address string) (map[string]any, error) {
+	if _, err := bt(CallTimeout, "--agent", "NoInputNoOutput", "--timeout", "15", "pair", address); err != nil {
+		return nil, err
+	}
+	return Act("trust", address)
+}

modules/bluetooth/cmd/bluetooth-tools/bluetooth_test.go

@@ -0,0 +1,163 @@
+package main
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestTheManifestIsTheStackItsToolsAndTheDaemon(t *testing.T) {
+	m := readManifest(t)
+	holdsTheBundle(t, m, "bluetooth")
+	if got := strings.Join(m.packages(), ","); got != "bluez,bluez-utils" {
+		t.Errorf("packages %s: the applet and the TUI are the operator's", got)
+	}
+	s := m.services()["bluetooth.service"]
+	if s == nil || s["state"] != "running" || s["boot"] != "enabled" {
+		t.Errorf("%v", s)
+	}
+	if len(m.Resources) != 3 {
+		t.Errorf("no configuration file: /etc/bluetooth/main.conf is the package's, unchanged on both workstations: %v", m.Resources)
+	}
+}
+
+const show = "Controller 4C:82:A9:97:01:8E (public)\n\tName: g14\n\tAlias: g14\n\tPowered: yes\n\tPowerState: on\n\tDiscoverable: no\n\tPairable: yes\n\tUUID: Headset (00001108-0000-1000-8000-00805f9b34fb)\n\tDiscovering: no\n"
+
+func headphones(connected bool) string {
+	c := "no"
+	extra := ""
+	if connected {
+		c, extra = "yes", "\tBattery Percentage: 0x50 (80)\n"
+	}
+	return "Device 80:99:E7:C2:29:DA (public)\n\tName: WH-1000XM4\n\tAlias: WH-1000XM4\n\tIcon: audio-headset\n\tPaired: yes\n\tBonded: yes\n\tTrusted: yes\n\tBlocked: no\n\tConnected: " + c + "\n" + extra + "\tUUID: Headset (00001108-0000-1000-8000-00805f9b34fb)\n"
+}
+
+func TestControllerReadsShow(t *testing.T) {
+	using(t, func(string, Cmd) Result { return ok("\x1b[0;94m" + show) })
+	c, err := Controller()
+	if err != nil || c.Address != "4C:82:A9:97:01:8E" || c.Name != "g14" || !c.Powered || c.Discoverable || !c.Pairable {
+		t.Fatalf("%+v %v", c, err)
+	}
+	using(t, func(string, Cmd) Result { return ok("No default controller available\n") })
+	if _, err := Controller(); err == nil || !strings.Contains(err.Error(), "no Bluetooth controller") {
+		t.Fatalf("%v", err)
+	}
+}
+
+func TestDevicesAskEachOneAndReportBatteryWhereGiven(t *testing.T) {
+	f := using(t, func(line string, c Cmd) Result {
+		switch line {
+		case "bluetoothctl devices Paired":
+			return ok("Device 80:99:E7:C2:29:DA WH-1000XM4\nDevice 2C:41:A1:E4:EC:86 Earmuffs\n")
+		case "bluetoothctl info 80:99:E7:C2:29:DA":
+			return ok(headphones(true))
+		}
+		return ok("Device 2C:41:A1:E4:EC:86 (public)\n\tName: Earmuffs\n\tPaired: yes\n\tConnected: no\n")
+	})
+	got, err := Devices("paired")
+	devices := got["devices"].([]Device)
+	if err != nil || got["count"] != 2 || !devices[0].Connected || devices[0].Battery == nil || *devices[0].Battery != 80 || devices[1].Battery != nil {
+		t.Fatalf("%+v %v", got, err)
+	}
+	if f.lines()[0] != "bluetoothctl devices Paired" {
+		t.Errorf("%v", f.lines())
+	}
+	if _, err := Devices("nearby"); err == nil {
+		t.Error("an unknown which")
+	}
+}
+
+func TestAnActThatFailsIsAnErrorWhateverTheExitStatus(t *testing.T) {
+	using(t, func(line string, c Cmd) Result {
+		return ok("Attempting to connect to 80:99:E7:C2:29:DA\nFailed to connect: org.bluez.Error.Failed br-connection-page-timeout\n")
+	})
+	if _, err := Act("connect", "80:99:E7:C2:29:DA"); err == nil || !strings.Contains(err.Error(), "page-timeout") {
+		t.Fatalf("%v", err)
+	}
+	using(t, func(string, Cmd) Result { return Result{Status: 1, Stdout: "Device 00:11:22:33:44:55 not available\n"} })
+	if _, err := Act("trust", "00:11:22:33:44:55"); err == nil || !strings.Contains(err.Error(), "not available") {
+		t.Fatalf("%v", err)
+	}
+}
+
+func TestConnectWaitsWithBluetoothctlsOwnTimeoutAndAnswersTheState(t *testing.T) {
+	f := using(t, func(line string, c Cmd) Result {
+		if strings.Contains(line, "connect") {
+			return ok("Attempting to connect\n[CHG] Device Connected: yes\nConnection successful\n")
+		}
+		return ok(headphones(true))
+	})
+	got, err := Act("connect", "80:99:E7:C2:29:DA")
+	if err != nil || !got["device"].(Device).Connected {
+		t.Fatalf("%v %v", got, err)
+	}
+	if f.lines()[0] != "bluetoothctl --timeout 15 connect 80:99:E7:C2:29:DA" || f.asked[0].Timeout != CallTimeout {
+		t.Errorf("%v", f.lines())
+	}
+}
+
+func TestAnActBluezRefusesTheAccountIsRetriedThroughSudo(t *testing.T) {
+	f := using(t, func(line string, c Cmd) Result {
+		if strings.HasPrefix(line, "sudo") {
+			return ok("Changing power off succeeded\n" + show)
+		}
+		return ok("Failed to set power off: org.freedesktop.DBus.Error.AccessDenied\n")
+	})
+	if _, err := Power(false); err != nil {
+		t.Fatal(err)
+	}
+	if l := f.lines(); l[0] != "bluetoothctl power off" || l[1] != "sudo -n bluetoothctl power off" {
+		t.Errorf("%v", l)
+	}
+}
+
+func TestScanIsBoundedAndAnswersUnpairedDevicesStrongestFirst(t *testing.T) {
+	f := using(t, func(line string, c Cmd) Result {
+		switch {
+		case strings.Contains(line, "scan on"):
+			return ok("Discovery started\n[NEW] Device AA:BB:CC:DD:EE:01 Speaker\n")
+		case line == "bluetoothctl devices":
+			return ok("Device 80:99:E7:C2:29:DA WH-1000XM4\nDevice AA:BB:CC:DD:EE:01 Speaker\nDevice AA:BB:CC:DD:EE:02 Phone\nDevice AA:BB:CC:DD:EE:03 Gone\n")
+		case strings.HasSuffix(line, "EE:01"):
+			return ok("Device AA:BB:CC:DD:EE:01\n\tName: Speaker\n\tPaired: no\n\tRSSI: 0xffffffc4 (-60)\n")
+		case strings.HasSuffix(line, "EE:02"):
+			return ok("Device AA:BB:CC:DD:EE:02\n\tName: Phone\n\tPaired: no\n\tRSSI: -40\n")
+		case strings.HasSuffix(line, "EE:03"):
+			return Result{Status: 1, Stdout: "Device AA:BB:CC:DD:EE:03 not available\n"}
+		}
+		return ok(headphones(false))
+	})
+	got, err := Scan(8)
+	found := got["found"].([]Device)
+	if err != nil || len(found) != 2 || found[0].Name != "Phone" || *found[1].RSSI != -60 {
+		t.Fatalf("%+v %v", got, err)
+	}
+	if f.lines()[0] != "bluetoothctl --timeout 8 scan on" || f.asked[0].Timeout.Seconds() != 12 {
+		t.Errorf("%v %v", f.lines()[0], f.asked[0].Timeout)
+	}
+}
+
+func TestPairUsesAnAgentThatConfirmsNothingAndThenTrusts(t *testing.T) {
+	f := using(t, func(line string, c Cmd) Result {
+		if strings.Contains(line, " pair ") {
+			return ok("Pairing successful\n")
+		}
+		return ok(headphones(false))
+	})
+	if _, err := Pair("80:99:e7:c2:29:da"); err != nil {
+		t.Fatal(err)
+	}
+	if l := f.lines(); l[0] != "bluetoothctl --agent NoInputNoOutput --timeout 15 pair 80:99:e7:c2:29:da" || l[1] != "bluetoothctl trust 80:99:e7:c2:29:da" {
+		t.Errorf("%v", l)
+	}
+}
+
+func TestAnAddressIsSixHexPairs(t *testing.T) {
+	for _, bad := range []string{"", "80:99:E7:C2:29", "80:99:E7:C2:29:DA; rm", "--help", "GG:99:E7:C2:29:DA"} {
+		if _, err := addressOf(map[string]any{"address": bad}); err == nil {
+			t.Errorf("%q accepted", bad)
+		}
+	}
+	if a, err := addressOf(map[string]any{"address": "80:99:e7:c2:29:da"}); err != nil || a != "80:99:E7:C2:29:DA" {
+		t.Errorf("%s %v", a, err)
+	}
+}

modules/bluetooth/cmd/bluetooth-tools/kit.go

@@ -0,0 +1,352 @@
+package main
+
+// kit.go is the same file in each of the workstations' tool bundles (fonts, docker-compose, snapd,
+// flatpak, cups, bluetooth, xclip, dmenu): how a tool runs a command, escalates, bounds what it
+// keeps, and names a failure. A module is built from its own directory, so the file is copied rather
+// than shared; a change to one copy is made to all eight.
+//
+// The rules it holds (novox/hq research 026/05, to-be 38 WP4):
+//   - the node's tool runtime runs as the operator account, not root (ADR 0175 §4); a command that
+//     needs root goes through `sudo -n`, never a prompt, and a refusal is named as such;
+//   - one command gets 20 s, below the runtime's 30 s call limit, and is ended with everything it
+//     started when it takes longer;
+//   - each stream is kept to 256 KiB, and the answer says when it was cut;
+//   - a failure is an error with what went wrong in it, never an empty answer.
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"strings"
+	"syscall"
+	"time"
+)
+
+// Bounds every command is held to.
+const (
+	CallTimeout = 20 * time.Second
+	MostOutput  = 256 << 10
+)
+
+// Cmd is one command a tool runs.
+type Cmd struct {
+	Name string
+	Args []string
+	// Stdin is written to the command's standard input when not empty.
+	Stdin string
+	// Env is added to this process's own environment.
+	Env []string
+	// Root says the command needs root: it is run through `sudo -n` when this process is not root.
+	Root bool
+	// Timeout replaces CallTimeout; only a background job (jobs.go) asks for longer.
+	Timeout time.Duration
+	// Detached is for a program that forks a child which outlives it, as xclip does to keep the
+	// selection: its streams go to files, because a pipe the child inherits would hold the call open
+	// until the child exits.
+	Detached bool
+}
+
+// Result is what a command did.
+type Result struct {
+	Stdout string `json:"stdout"`
+	Stderr string `json:"stderr"`
+	Status int    `json:"status"`
+	// Error is why it did not run to an answer: "not-found" when the program is not there,
+	// "timeout" when it was ended for taking too long, else the spawn error.
+	Error     string `json:"error,omitempty"`
+	Truncated bool   `json:"truncated,omitempty"`
+}
+
+// Runner runs a command. Tests replace it; nothing else does.
+type Runner func(Cmd) Result
+
+var (
+	run  Runner = execRun
+	euid        = os.Geteuid
+)
+
+// argv is the command as it is run: through sudo without a prompt when it needs root and this
+// process is not root.
+func argv(c Cmd) (string, []string) {
+	if c.Root && euid() != 0 {
+		return "sudo", append([]string{"-n", c.Name}, c.Args...)
+	}
+	return c.Name, c.Args
+}
+
+// bounded keeps the first MostOutput bytes written to it and notes that more came.
+type bounded struct {
+	b   bytes.Buffer
+	cut bool
+}
+
+func (w *bounded) Write(p []byte) (int, error) {
+	room := MostOutput - w.b.Len()
+	if room <= 0 {
+		w.cut = w.cut || len(p) > 0
+		return len(p), nil
+	}
+	if len(p) > room {
+		w.b.Write(p[:room])
+		w.cut = true
+		return len(p), nil
+	}
+	return w.b.Write(p)
+}
+
+func execRun(c Cmd) Result {
+	timeout := c.Timeout
+	if timeout <= 0 {
+		timeout = CallTimeout
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+	name, args := argv(c)
+	cmd := exec.CommandContext(ctx, name, args...)
+	cmd.Env = append(append(os.Environ(), "LC_ALL=C"), c.Env...)
+	if !c.Detached {
+		// Its own process group, so that ending it on a timeout ends what it started too.
+		cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
+		cmd.Cancel = func() error {
+			if cmd.Process != nil {
+				_ = syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL)
+			}
+			return nil
+		}
+	}
+	cmd.WaitDelay = 2 * time.Second
+	if c.Stdin != "" {
+		cmd.Stdin = strings.NewReader(c.Stdin)
+	}
+	var out, errs bounded
+	var outFile, errFile *os.File
+	if c.Detached {
+		var err error
+		if outFile, err = os.CreateTemp("", "mesh-tool-out-*"); err != nil {
+			return Result{Status: 127, Error: err.Error()}
+		}
+		defer os.Remove(outFile.Name())
+		defer outFile.Close()
+		if errFile, err = os.CreateTemp("", "mesh-tool-err-*"); err != nil {
+			return Result{Status: 127, Error: err.Error()}
+		}
+		defer os.Remove(errFile.Name())
+		defer errFile.Close()
+		cmd.Stdout, cmd.Stderr = outFile, errFile
+	} else {
+		cmd.Stdout, cmd.Stderr = &out, &errs
+	}
+	err := cmd.Run()
+	if c.Detached {
+		for _, f := range []struct {
+			file *os.File
+			into *bounded
+		}{{outFile, &out}, {errFile, &errs}} {
+			if _, e := f.file.Seek(0, io.SeekStart); e == nil {
+				_, _ = io.Copy(f.into, f.file)
+			}
+		}
+	}
+	r := Result{Stdout: out.b.String(), Stderr: errs.b.String(), Truncated: out.cut || errs.cut}
+	var exit *exec.ExitError
+	switch {
+	case err == nil:
+	case ctx.Err() == context.DeadlineExceeded:
+		r.Status, r.Error = 124, "timeout"
+	case errors.Is(err, exec.ErrNotFound) || errors.Is(err, os.ErrNotExist):
+		r.Status, r.Error = 127, "not-found"
+	case errors.As(err, &exit):
+		r.Status = exit.ExitCode()
+	default:
+		r.Status, r.Error = 127, err.Error()
+	}
+	return r
+}
+
+// call runs a command and answers its result, or an error naming what went wrong.
+func call(c Cmd) (Result, error) {
+	r := run(c)
+	if r.Status == 0 && r.Error == "" {
+		return r, nil
+	}
+	return r, failure(c, r)
+}
+
+// failure names how a command failed: not installed, refused escalation, too slow, or its exit
+// status with the end of what it said.
+func failure(c Cmd, r Result) error {
+	program, _ := argv(c)
+	switch {
+	case r.Error == "not-found" && program == "sudo":
+		return fmt.Errorf("%s needs root, and sudo is not installed here for the runtime's account to escalate with", c.Name)
+	case r.Error == "not-found":
+		if hint, ok := providedBy[c.Name]; ok {
+			return fmt.Errorf("%s is not installed on this machine (%s)", c.Name, hint)
+		}
+		return fmt.Errorf("%s is not installed on this machine", c.Name)
+	case r.Error == "timeout":
+		limit := c.Timeout
+		if limit <= 0 {
+			limit = CallTimeout
+		}
+		return fmt.Errorf("%s gave no answer within %s and was ended", c.Name, limit)
+	case r.Error != "":
+		return fmt.Errorf("%s did not run: %s", c.Name, r.Error)
+	case program == "sudo" && strings.Contains(r.Stderr, "command not found"):
+		if hint, ok := providedBy[c.Name]; ok {
+			return fmt.Errorf("%s is not installed on this machine (%s)", c.Name, hint)
+		}
+		return fmt.Errorf("%s is not installed on this machine", c.Name)
+	case program == "sudo" && strings.HasPrefix(strings.TrimSpace(r.Stderr), "sudo:"):
+		return fmt.Errorf("%s needs root, and sudo -n refused the runtime's account: %s (the escalation is the sudo module's to declare)",
+			c.Name, firstLine(r.Stderr))
+	}
+	said := tail(strings.TrimSpace(r.Stderr), 2000)
+	if said == "" {
+		said = tail(strings.TrimSpace(r.Stdout), 2000)
+	}
+	if said == "" {
+		said = "and said nothing"
+	}
+	return fmt.Errorf("%s %s exited %d: %s", c.Name, strings.Join(c.Args, " "), r.Status, said)
+}
+
+func firstLine(s string) string {
+	s = strings.TrimSpace(s)
+	if i := strings.IndexByte(s, '\n'); i >= 0 {
+		return s[:i]
+	}
+	return s
+}
+
+func tail(s string, n int) string {
+	if len(s) <= n {
+		return s
+	}
+	return "…" + s[len(s)-n:]
+}
+
+// lines are a command's output lines, blank ones dropped.
+func lines(s string) []string {
+	out := []string{}
+	for _, l := range strings.Split(s, "\n") {
+		if strings.TrimSpace(l) != "" {
+			out = append(out, strings.TrimRight(l, "\r"))
+		}
+	}
+	return out
+}
+
+// Arguments, read the way a tool's JSON arguments arrive.
+
+func text(args map[string]any, key string) (string, error) {
+	v, ok := args[key]
+	if !ok || v == nil {
+		return "", fmt.Errorf("%s is required", key)
+	}
+	s, ok := v.(string)
+	if !ok {
+		return "", fmt.Errorf("%s must be a string", key)
+	}
+	if strings.TrimSpace(s) == "" {
+		return "", fmt.Errorf("%s must not be empty", key)
+	}
+	return s, nil
+}
+
+func optText(args map[string]any, key, def string) (string, error) {
+	v, ok := args[key]
+	if !ok || v == nil {
+		return def, nil
+	}
+	s, ok := v.(string)
+	if !ok {
+		return "", fmt.Errorf("%s must be a string", key)
+	}
+	if strings.TrimSpace(s) == "" {
+		return def, nil
+	}
+	return s, nil
+}
+
+// optWhole reads a whole number, defaulted, refused below least and held to most.
+func optWhole(args map[string]any, key string, def, least, most int) (int, error) {
+	v, ok := args[key]
+	if !ok || v == nil {
+		return def, nil
+	}
+	f, ok := v.(float64)
+	if !ok {
+		if i, isInt := v.(int); isInt {
+			f = float64(i)
+		} else {
+			return 0, fmt.Errorf("%s must be a number", key)
+		}
+	}
+	if f != float64(int(f)) {
+		return 0, fmt.Errorf("%s must be a whole number", key)
+	}
+	n := int(f)
+	if n < least {
+		return 0, fmt.Errorf("%s must be at least %d", key, least)
+	}
+	if n > most {
+		n = most
+	}
+	return n, nil
+}
+
+func optFlag(args map[string]any, key string, def bool) (bool, error) {
+	v, ok := args[key]
+	if !ok || v == nil {
+		return def, nil
+	}
+	b, ok := v.(bool)
+	if !ok {
+		return false, fmt.Errorf("%s must be true or false", key)
+	}
+	return b, nil
+}
+
+func optList(args map[string]any, key string) ([]string, error) {
+	v, ok := args[key]
+	if !ok || v == nil {
+		return nil, nil
+	}
+	items, ok := v.([]any)
+	if !ok {
+		return nil, fmt.Errorf("%s must be a list of strings", key)
+	}
+	out := make([]string, 0, len(items))
+	for _, it := range items {
+		s, ok := it.(string)
+		if !ok || strings.TrimSpace(s) == "" {
+			return nil, fmt.Errorf("%s must be a list of non-empty strings", key)
+		}
+		out = append(out, s)
+	}
+	return out, nil
+}
+
+// oneOf refuses a value outside a closed set.
+func oneOf(key, value string, allowed ...string) error {
+	for _, a := range allowed {
+		if value == a {
+			return nil
+		}
+	}
+	return fmt.Errorf("%s must be one of %s, not %q", key, strings.Join(allowed, ", "), value)
+}
+
+// plainName refuses a name that could be read as an option or carries a path or a space: package,
+// snap, application and printer names never do.
+func plainName(key, value string) error {
+	if strings.HasPrefix(value, "-") || strings.ContainsAny(value, " \t\n/\\") {
+		return fmt.Errorf("%s %q is not a plain name", key, value)
+	}
+	return nil
+}

modules/bluetooth/cmd/bluetooth-tools/kit_test.go

@@ -0,0 +1,147 @@
+package main
+
+// Tests of kit.go, the same in each workstation module.
+
+import (
+	"strings"
+	"testing"
+	"time"
+)
+
+// fake records the commands asked and answers each from a function of the command line.
+type fake struct {
+	asked  []Cmd
+	answer func(line string, c Cmd) Result
+}
+
+func (f *fake) runner() Runner {
+	return func(c Cmd) Result {
+		f.asked = append(f.asked, c)
+		name, args := argv(c)
+		line := strings.TrimSpace(name + " " + strings.Join(args, " "))
+		if f.answer == nil {
+			return Result{}
+		}
+		return f.answer(line, c)
+	}
+}
+
+func (f *fake) lines() []string {
+	out := []string{}
+	for _, c := range f.asked {
+		name, args := argv(c)
+		out = append(out, strings.TrimSpace(name+" "+strings.Join(args, " ")))
+	}
+	return out
+}
+
+// using installs a fake runner and a non-root uid for one test.
+func using(t *testing.T, answer func(line string, c Cmd) Result) *fake {
+	t.Helper()
+	f := &fake{answer: answer}
+	wasRun, wasUID := run, euid
+	run, euid = f.runner(), func() int { return 1000 }
+	t.Cleanup(func() { run, euid = wasRun, wasUID })
+	return f
+}
+
+func ok(stdout string) Result { return Result{Stdout: stdout} }
+
+func TestKitAnActThatNeedsRootGoesThroughSudoWithoutAPromptUnlessAlreadyRoot(t *testing.T) {
+	was := euid
+	defer func() { euid = was }()
+	euid = func() int { return 1000 }
+	if name, args := argv(Cmd{Name: "x", Args: []string{"a"}, Root: true}); name != "sudo" || strings.Join(args, " ") != "-n x a" {
+		t.Fatalf("not root: %s %v", name, args)
+	}
+	if name, _ := argv(Cmd{Name: "x"}); name != "x" {
+		t.Fatalf("a read is run as the account: %s", name)
+	}
+	euid = func() int { return 0 }
+	if name, _ := argv(Cmd{Name: "x", Root: true}); name != "x" {
+		t.Fatalf("as root no sudo: %s", name)
+	}
+}
+
+func TestKitAFailureIsNamedByHowItFailed(t *testing.T) {
+	was := euid
+	defer func() { euid = was }()
+	euid = func() int { return 1000 }
+	cases := []struct {
+		c    Cmd
+		r    Result
+		want string
+	}{
+		{Cmd{Name: "nothere"}, Result{Status: 127, Error: "not-found"}, "not installed"},
+		{Cmd{Name: "x", Root: true}, Result{Status: 127, Error: "not-found"}, "sudo is not installed"},
+		{Cmd{Name: "x", Root: true}, Result{Status: 1, Stderr: "sudo: a password is required\n"}, "sudo -n refused"},
+		{Cmd{Name: "x", Root: true}, Result{Status: 1, Stderr: "sudo: x: command not found\n"}, "x is not installed"},
+		{Cmd{Name: "x"}, Result{Status: 124, Error: "timeout"}, "within 20s"},
+		{Cmd{Name: "x", Args: []string{"y"}}, Result{Status: 3, Stderr: "boom\n"}, "x y exited 3: boom"},
+		{Cmd{Name: "x"}, Result{Status: 3}, "said nothing"},
+	}
+	for _, k := range cases {
+		err := failure(k.c, k.r)
+		if err == nil || !strings.Contains(err.Error(), k.want) {
+			t.Errorf("%+v: %v, want %q", k.r, err, k.want)
+		}
+	}
+}
+
+func TestKitOutputIsBoundedAndSaysSo(t *testing.T) {
+	var w bounded
+	big := strings.Repeat("a", MostOutput+10)
+	n, _ := w.Write([]byte(big))
+	if n != len(big) || w.b.Len() != MostOutput || !w.cut {
+		t.Fatalf("kept %d of %d, cut %v", w.b.Len(), len(big), w.cut)
+	}
+}
+
+func TestKitTheRealRunnerRunsEndsAndReportsAMissingProgram(t *testing.T) {
+	r := execRun(Cmd{Name: "sh", Args: []string{"-c", "echo out; echo err >&2; exit 3"}})
+	if r.Status != 3 || strings.TrimSpace(r.Stdout) != "out" || strings.TrimSpace(r.Stderr) != "err" {
+		t.Fatalf("%+v", r)
+	}
+	r = execRun(Cmd{Name: "sh", Args: []string{"-c", "sleep 5 & sleep 5"}, Timeout: 200 * time.Millisecond})
+	if r.Error != "timeout" {
+		t.Fatalf("a slow command: %+v", r)
+	}
+	r = execRun(Cmd{Name: "no-such-program-anywhere"})
+	if r.Error != "not-found" {
+		t.Fatalf("a missing program: %+v", r)
+	}
+	r = execRun(Cmd{Name: "cat", Stdin: "given"})
+	if r.Stdout != "given" {
+		t.Fatalf("stdin: %+v", r)
+	}
+	start := time.Now()
+	r = execRun(Cmd{Name: "sh", Args: []string{"-c", "echo kept; (sleep 3 &) ; exit 0"}, Detached: true})
+	if r.Status != 0 || strings.TrimSpace(r.Stdout) != "kept" || time.Since(start) > 2*time.Second {
+		t.Fatalf("a detached command returns when it exits, not when its child does: %+v after %s", r, time.Since(start))
+	}
+}
+
+func TestKitArgumentsAreReadStrictly(t *testing.T) {
+	args := map[string]any{"s": "x", "n": float64(5), "f": 1.5, "b": true, "l": []any{"a", "b"}}
+	if _, err := text(args, "missing"); err == nil {
+		t.Error("a missing required string")
+	}
+	if n, _ := optWhole(args, "n", 1, 1, 3); n != 3 {
+		t.Errorf("held to most: %d", n)
+	}
+	if _, err := optWhole(args, "n", 1, 6, 9); err == nil {
+		t.Error("below least")
+	}
+	if _, err := optWhole(args, "f", 1, 0, 9); err == nil {
+		t.Error("a fraction")
+	}
+	if l, _ := optList(args, "l"); len(l) != 2 {
+		t.Errorf("list: %v", l)
+	}
+	if b, _ := optFlag(args, "b", false); !b {
+		t.Error("flag")
+	}
+	if err := plainName("name", "--all"); err == nil {
+		t.Error("an option as a name")
+	}
+}

modules/bluetooth/cmd/bluetooth-tools/main.go

@@ -0,0 +1,135 @@
+// The bluetooth module's tools (novox/hq research 027/02, 026/05): the controller, the devices with
+// their state and battery, scanning, and pairing, connecting, trusting and forgetting a device. A Go
+// bundle the node's runtime launches over stdio (ADR 0188, ADR 0193); it runs as the operator
+// account, and speaks to bluez through bluetoothctl.
+package main
+
+import (
+	"fmt"
+	"os"
+
+	stdio "git.novox.be/novox/mesh-sdk/go"
+)
+
+var providedBy = map[string]string{
+	"bluetoothctl": "the bluez-utils package, which this module installs",
+}
+
+func main() {
+	if err := stdio.Serve("", tools()); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+}
+
+var addressArg = map[string]any{"type": "string", "description": "the device's address, such as 80:99:E7:C2:29:DA, as bluetooth_devices answers it"}
+
+func withAddress(f func(string) (any, error)) func(map[string]any) (any, error) {
+	return func(args map[string]any) (any, error) {
+		a, err := addressOf(args)
+		if err != nil {
+			return nil, err
+		}
+		return f(a)
+	}
+}
+
+func tools() []stdio.Tool {
+	return []stdio.Tool{
+		{
+			Name:        "bluetooth_controller",
+			Description: "The machine's Bluetooth controller: address, name, powered, discoverable, pairable, discovering. (r)",
+			Input:       map[string]any{},
+			Run:         func(map[string]any) (any, error) { return Controller() },
+		},
+		{
+			Name:        "bluetooth_power",
+			Description: "Whether the controller is powered; with on, switch it on or off. (r/a)",
+			Input:       map[string]any{"on": map[string]any{"type": "boolean", "description": "power the controller on (true) or off (false)"}},
+			Run: func(args map[string]any) (any, error) {
+				if _, given := args["on"]; !given {
+					c, err := Controller()
+					if err != nil {
+						return nil, err
+					}
+					return map[string]any{"powered": c.Powered}, nil
+				}
+				on, err := optFlag(args, "on", true)
+				if err != nil {
+					return nil, err
+				}
+				return Power(on)
+			},
+		},
+		{
+			Name: "bluetooth_devices",
+			Description: "The devices bluez knows: every one, or only the paired, connected or trusted. Each with its " +
+				"name, kind, paired, bonded, trusted, blocked, connected, and its battery where the device reports it. (r)",
+			Input: map[string]any{"which": map[string]any{"type": "string", "enum": []string{"all", "paired", "connected", "trusted"}, "description": "which devices (default all)"}},
+			Run: func(args map[string]any) (any, error) {
+				which, err := optText(args, "which", "all")
+				if err != nil {
+					return nil, err
+				}
+				return Devices(which)
+			},
+		},
+		{
+			Name: "bluetooth_scan",
+			Description: "Discover devices nearby for a few seconds (default 8, at most 15), and answer the ones not " +
+				"paired, with their signal strength. (r)",
+			Input: map[string]any{"seconds": map[string]any{"type": "integer", "description": "how long to scan (default 8, at most 15)"}},
+			Run: func(args map[string]any) (any, error) {
+				s, err := optWhole(args, "seconds", 8, 1, 15)
+				if err != nil {
+					return nil, err
+				}
+				return Scan(s)
+			},
+		},
+		{
+			Name:        "bluetooth_connect",
+			Description: "Connect a paired device, such as headphones. Answers its state afterwards. (a)",
+			Input:       map[string]any{"address": addressArg},
+			Run:         withAddress(func(a string) (any, error) { return Act("connect", a) }),
+		},
+		{
+			Name:        "bluetooth_disconnect",
+			Description: "Disconnect a device. (a)",
+			Input:       map[string]any{"address": addressArg},
+			Run:         withAddress(func(a string) (any, error) { return Act("disconnect", a) }),
+		},
+		{
+			Name:        "bluetooth_trust",
+			Description: "Trust a device, so it may connect by itself; or with trusted false, stop trusting it. (a)",
+			Input:       map[string]any{"address": addressArg, "trusted": map[string]any{"type": "boolean", "description": "trust (default) or untrust"}},
+			Run: func(args map[string]any) (any, error) {
+				a, err := addressOf(args)
+				if err != nil {
+					return nil, err
+				}
+				trusted, err := optFlag(args, "trusted", true)
+				if err != nil {
+					return nil, err
+				}
+				if trusted {
+					return Act("trust", a)
+				}
+				return Act("untrust", a)
+			},
+		},
+		{
+			Name: "bluetooth_pair",
+			Description: "Pair a device found by a scan, and trust it. Works for a device that needs no code to be " +
+				"confirmed, such as headphones; one that shows a code is paired from the desktop. (a)",
+			Input: map[string]any{"address": addressArg},
+			Run:   withAddress(func(a string) (any, error) { return Pair(a) }),
+		},
+		{
+			Name:        "bluetooth_remove",
+			Description: "Forget a device: unpair it and drop what bluez knows of it. (a)",
+			Input:       map[string]any{"address": addressArg},
+			Run:         withAddress(func(a string) (any, error) { return Act("remove", a) }),
+		},
+	}
+}

modules/bluetooth/cmd/bluetooth-tools/manifest_kit_test.go

@@ -0,0 +1,107 @@
+package main
+
+// manifest_kit_test.go is the same file in each workstation module: it reads the module's
+// definition so the module's own tests can hold it to what it says.
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+	"testing"
+)
+
+type manifest struct {
+	Module       string           `json:"module"`
+	Capabilities []string         `json:"capabilities"`
+	Claims       []any            `json:"claims"`
+	Seats        []any            `json:"seats"`
+	Tools        []string         `json:"tools"`
+	Resources    []map[string]any `json:"resources"`
+	Build        struct {
+		Artifacts []map[string]any `json:"artifacts"`
+	} `json:"build"`
+}
+
+func readManifest(t *testing.T) manifest {
+	t.Helper()
+	raw, err := os.ReadFile(filepath.Join("..", "..", "module.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var m manifest
+	if err := json.Unmarshal(raw, &m); err != nil {
+		t.Fatalf("module.json: %v", err)
+	}
+	return m
+}
+
+func (m manifest) resource(id string) map[string]any {
+	for _, r := range m.Resources {
+		if r["id"] == id {
+			return r
+		}
+	}
+	return nil
+}
+
+// packages are the packages the module installs, sorted.
+func (m manifest) packages() []string {
+	out := []string{}
+	for _, r := range m.Resources {
+		if r["type"] == "package" && r["absent"] != true {
+			out = append(out, r["package"].(string))
+		}
+	}
+	sort.Strings(out)
+	return out
+}
+
+// services are the units the module declares, by unit name.
+func (m manifest) services() map[string]map[string]any {
+	out := map[string]map[string]any{}
+	for _, r := range m.Resources {
+		if r["type"] == "service" {
+			out[r["unit"].(string)] = r
+		}
+	}
+	return out
+}
+
+// holdsTheBundle holds the manifest to the Go bundle this directory builds: every tool registered
+// is listed and nothing else, each named <prefix>_…, and the artifact builds this command.
+func holdsTheBundle(t *testing.T, m manifest, prefix string) {
+	t.Helper()
+	registered := []string{}
+	for _, tool := range tools() {
+		registered = append(registered, tool.Name)
+		if !strings.HasPrefix(tool.Name, prefix+"_") {
+			t.Errorf("tool %s is not named %s_…", tool.Name, prefix)
+		}
+		if tool.Description == "" || tool.Run == nil || tool.Input == nil {
+			t.Errorf("tool %s is not described, runnable and given an input schema", tool.Name)
+		}
+	}
+	if strings.Join(registered, ",") != strings.Join(m.Tools, ",") {
+		t.Errorf("registered %v, listed %v", registered, m.Tools)
+	}
+	if len(m.Build.Artifacts) != 1 {
+		t.Fatalf("one artifact, got %d", len(m.Build.Artifacts))
+	}
+	cwd, _ := os.Getwd()
+	binary := filepath.Base(cwd)
+	a := m.Build.Artifacts[0]
+	want := map[string]any{"kind": "bundle", "language": "go", "system": "arch", "from": "cmd/" + binary, "binary": binary}
+	for k, v := range want {
+		if a[k] != v {
+			t.Errorf("artifact %s = %v, want %v", k, a[k], v)
+		}
+	}
+	if loads, _ := a["loads"].([]any); len(loads) != 1 || loads[0] != binary {
+		t.Errorf("artifact loads %v, want [%s]", a["loads"], binary)
+	}
+	if m.Claims != nil || m.Seats != nil {
+		t.Errorf("claims %v, seats %v: this module holds no seat", m.Claims, m.Seats)
+	}
+}

modules/bluetooth/go.mod

@@ -0,0 +1,5 @@
+module bluetooth
+
+go 1.22
+
+require git.novox.be/novox/mesh-sdk/go v0.1.6

modules/bluetooth/go.sum

@@ -0,0 +1,2 @@
+git.novox.be/novox/mesh-sdk/go v0.1.6 h1:9qzdYONYbJdWcu6sxQcq9v1LI0JxcfkiKYkMUzJSkVQ=
+git.novox.be/novox/mesh-sdk/go v0.1.6/go.mod h1:GFuZUElBZ9A++mxgIKo97aXXo+kV0uJ/UkbhQPPIbrY=

modules/bluetooth/module.json

@@ -0,0 +1,53 @@
+{
+  "module": "bluetooth",
+  "version": "1",
+  "capabilities": [
+    "package-manager",
+    "service-manager"
+  ],
+  "tools": [
+    "bluetooth_controller",
+    "bluetooth_power",
+    "bluetooth_devices",
+    "bluetooth_scan",
+    "bluetooth_connect",
+    "bluetooth_disconnect",
+    "bluetooth_trust",
+    "bluetooth_pair",
+    "bluetooth_remove"
+  ],
+  "resources": [
+    {
+      "id": "stack",
+      "type": "package",
+      "package": "bluez"
+    },
+    {
+      "id": "utilities",
+      "type": "package",
+      "package": "bluez-utils"
+    },
+    {
+      "id": "daemon",
+      "type": "service",
+      "unit": "bluetooth.service",
+      "state": "running",
+      "boot": "enabled"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/bluetooth-tools",
+        "binary": "bluetooth-tools",
+        "loads": [
+          "bluetooth-tools"
+        ]
+      }
+    ]
+  }
+}

modules/claude-licence-manager/cmd/claude-licence-manager/manager.go

@@ -198,6 +198,12 @@ func (m *Manager) Consider(ctx context.Context, reports []Holdings) ([]string, e
 		accounts = append(accounts, a)
 	}
 	sort.Strings(accounts)
+	// A node reporting an account the manager already holds, and bound to nothing, is bound to it
+	// (ADR 0206 §7) — whenever its report arrives, not only when the licence is adopted: a node whose own
+	// login is older than the one adopted is never a candidate, and would otherwise never be bound.
+	if err := m.bindReporters(ctx, reports); err != nil {
+		return nil, err
+	}
 	var adopted []string
 	for _, account := range accounts {
 		list := byAccount[account]
@@ -225,6 +231,38 @@ func (m *Manager) Consider(ctx context.Context, reports []Holdings) ([]string, e
 	return adopted, nil
 }
 
+// bindReporters binds each reporting node that is bound to nothing to the licence its account already has.
+func (m *Manager) bindReporters(ctx context.Context, reports []Holdings) error {
+	for _, rep := range reports {
+		if rep.Identity == nil || rep.Identity.AccountUUID == "" {
+			continue
+		}
+		if b, err := m.Store.Binding(ctx, rep.Node); err != nil || b != nil {
+			if err != nil {
+				return err
+			}
+			continue
+		}
+		l, err := m.Store.LicenceForAccount(ctx, rep.Identity.AccountUUID)
+		if err != nil {
+			return err
+		}
+		if l == nil {
+			continue
+		}
+		b, err := m.Store.Bind(ctx, rep.Node, l.Name)
+		if err != nil {
+			return err
+		}
+		_ = m.Store.Audit(ctx, "bound", map[string]any{"consumer": rep.Node, "licence": l.Name, "by": "its account's report"})
+		if err := m.PutBinding(ctx, rep.Node, BindingState{Licence: l.Name, Kind: l.Kind, Generation: b.Generation}); err != nil {
+			return err
+		}
+		m.Log("bound %s to %s, the licence its account already has", rep.Node, l.Name)
+	}
+	return nil
+}
+
 func (m *Manager) adoptOne(ctx context.Context, c Candidate, reports []Holdings) (string, error) {
 	answer, err := m.AskGrant(ctx, c.Node, m.Keys.PublicKey)
 	if err != nil {

modules/claude-licence-manager/cmd/claude-licence-manager/manager_test.go

@@ -336,3 +336,24 @@ func TestAReportIsReadAsTheAgentModuleWritesIt(t *testing.T) {
 		t.Fatalf("the report's time does not parse: %v", err)
 	}
 }
+
+// A node whose report arrives after its account was adopted — with an older login, so never a candidate —
+// is still bound to that account's licence, once.
+func TestANodeReportingAnAdoptedAccountLaterIsBoundToIt(t *testing.T) {
+	mm := newMesh(t)
+	ctx := context.Background()
+	_, _ = mm.m.Consider(ctx, []Holdings{mm.login("novox", "rt-new", true, t0)})
+	late := mm.login("laptop", "rt-older", true, t0.Add(-24*time.Hour))
+	_, _ = mm.m.Consider(ctx, []Holdings{late})
+	if mm.state["laptop"].Licence != licence1 {
+		t.Fatalf("a node reporting the adopted account later was not bound: %v", mm.state)
+	}
+	if strings.Contains(strings.Join(mm.vendor.exchanged, ","), "rt-older") {
+		t.Fatal("the older login was exchanged")
+	}
+	g := mm.state["laptop"].Generation
+	_, _ = mm.m.Consider(ctx, []Holdings{late})
+	if mm.state["laptop"].Generation != g {
+		t.Fatal("a node already bound was bound again")
+	}
+}

modules/cups/README.md

@@ -0,0 +1,84 @@
+# cups
+
+Printing on the two workstations (novox/hq research 027/02: "`cups` with the printer's driver"; to-be 42
+phase 2 step 9).
+
+## Owns
+
+| what | where |
+|---|---|
+| the print scheduler | package `cups` |
+| driverless printing: the filters that turn a document into what an IPP Everywhere printer takes | package `cups-filters` |
+| the scheduler, started on demand and at boot | `cups.socket` and `cups.service`, running and enabled |
+
+All from the official repositories. The queues (`/etc/cups/printers.conf`, the PPDs CUPS generates)
+and the default printer are CUPS's own state, set through its tools. They are found (ADR 0182), and
+the module declares none of them.
+
+## The printer's driver: none needed for the Brother
+
+Research 027 asked for "`cups` with the printer's driver". Measured on 2026-10-04:
+
+| workstation | queue | device | prints through | driver package installed |
+|---|---|---|---|---|
+| laptop | `Brother` (MFC-L8690CDW) | `ipp://` on the LAN | **IPP Everywhere, driverless** | `brother-mfc-l8690cdw` (AUR), unused |
+| desktop | `Brother_MFC_Novox` (default) | `ipp://` on the LAN | **IPP Everywhere, driverless** | `brother-mfc-l8390cdw` and its `-debug` (AUR), unused |
+| desktop | `Kanjuro` (Canon PIXMA MG4200) | `cnijnet:` | the vendor's PPD and filter | `cnijfilter-mg4200` 3.80 (AUR) |
+
+**Both Brother queues already print without a vendor driver.** CUPS's own IPP Everywhere support,
+with `cups-filters`, is the whole driver. The vendor packages installed beside them serve no queue,
+and the laptop's pulls in 32-bit glibc from multilib for a filter nothing runs. So the module declares
+no driver, and the Brother needs nothing outside the official repositories.
+
+**The Canon is the exception, and it is blocked.** Its driver is a user-repository package from 2012,
+with its own network backend. Like snapd, it waits for the mesh's package repository (research 027
+question 1, option P2). Until then it stays as found on the desktop. If the printer answers IPP (check
+with `cups_drivers` on a fresh queue, or `driverless` from `cups-filters`), a driverless queue replaces
+it and the question goes away.
+
+## Improves
+
+- **An owner for the scheduler.** It runs on both workstations today, enabled by nothing the mesh records.
+- **No driver package that nothing uses.** The README's one-off step below removes them, once.
+- **Supplies and state from anywhere.** `cups_printers` answers each queue's toner levels and flags a
+  low one. It also answers why a queue stopped, without opening the printer's page.
+- **The laptop has no default printer**, so a print without a named printer fails there.
+  `cups_default` sets one; it is the operator's choice, not declared.
+
+## Tools
+
+All answer JSON; `(r)` reads, `(a)` acts. They run as the operator account. CUPS lets any account
+print and cancel its own jobs. Setting the default, resuming a printer, and cancelling another
+account's job are kept for its administrators, so those go through `sudo -n`; a cancel tries the
+account first.
+
+| tool | what |
+|---|---|
+| `cups_printers` (r) | every queue: state, enabled, accepting, default, device, make and model, driverless or not, state reasons, supply levels (low flagged) |
+| `cups_queue` (r) | jobs waiting or printing, or the completed ones, newest first, bounded |
+| `cups_cancel` (a) | one job, or every job on a printer |
+| `cups_print` (a) | a file on this machine to a printer or the default, with copies and IPP options; answers the job id |
+| `cups_default` (r/a) | read the default, or set it |
+| `cups_resume` (a) | enable a stopped printer and make it accept jobs |
+| `cups_drivers` (r) | how each queue prints, the packages that bring filters and backends (foreign ones flagged), findings, and the driver models CUPS offers, filtered |
+
+## What changes when it is assigned
+
+Nothing on disk on either workstation: both have `cups` (explicit) and `cups-filters` (as its
+dependency), with `cups.socket` and `cups.service` enabled and running. The packages become the
+mesh's; `cups-filters` is now declared explicitly.
+
+## The one-off step for the operator (ADR 0182)
+
+The mesh removes nothing it did not install. Once the Brother queues are confirmed printing (they do
+today), remove the unused vendor drivers, once:
+
+- **laptop:** `brother-mfc-l8690cdw`, then whatever `pacman -Qdtq` shows it alone pulled in
+  (`lib32-glibc`).
+- **desktop:** `brother-mfc-l8390cdw` and `brother-mfc-l8390cdw-debug`. Keep `cnijfilter-mg4200` while
+  the Canon queue is used.
+
+## Leaves as found
+
+The queues and their PPDs, the default printer, `cups.path` (enabled by the package's preset),
+`system-config-printer` on the desktop, and `cnijfilter-mg4200`.

modules/cups/cmd/cups-tools/cups.go

@@ -0,0 +1,560 @@
+package main
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"regexp"
+	"sort"
+	"strconv"
+	"strings"
+)
+
+var queueName = regexp.MustCompile(`^[A-Za-z0-9_.@-]{1,127}$`)
+
+func checkPrinter(p string) error {
+	if !queueName.MatchString(p) || strings.HasPrefix(p, "-") {
+		return fmt.Errorf("%q is not a printer queue's name", p)
+	}
+	return nil
+}
+
+var optionName = regexp.MustCompile(`^[a-z][a-z0-9-]{0,63}$`)
+var optionValue = regexp.MustCompile(`^[A-Za-z0-9._:-]{1,128}$`)
+
+// optionsOf reads the print options object.
+func optionsOf(args map[string]any) (map[string]string, error) {
+	v, ok := args["options"]
+	if !ok || v == nil {
+		return nil, nil
+	}
+	m, ok := v.(map[string]any)
+	if !ok {
+		return nil, fmt.Errorf("options must be an object of names to values")
+	}
+	out := map[string]string{}
+	for k, val := range m {
+		s, ok := val.(string)
+		if !ok || !optionName.MatchString(k) || !optionValue.MatchString(s) {
+			return nil, fmt.Errorf("option %s=%v is not an IPP option name and a plain value", k, val)
+		}
+		out[k] = s
+	}
+	return out, nil
+}
+
+// lpoptionsOf reads lpoptions' answer: name=value pairs, a value quoted with ' or with backslash escapes.
+func lpoptionsOf(s string) map[string]string {
+	out := map[string]string{}
+	s = strings.TrimSpace(s)
+	i := 0
+	for i < len(s) {
+		for i < len(s) && s[i] == ' ' {
+			i++
+		}
+		start := i
+		for i < len(s) && s[i] != '=' && s[i] != ' ' {
+			i++
+		}
+		key := s[start:i]
+		if i >= len(s) || s[i] != '=' {
+			if key != "" {
+				out[key] = ""
+			}
+			continue
+		}
+		i++
+		var b strings.Builder
+		for i < len(s) && s[i] != ' ' {
+			switch s[i] {
+			case '\'':
+				i++
+				for i < len(s) && s[i] != '\'' {
+					if s[i] == '\\' && i+1 < len(s) {
+						i++
+					}
+					b.WriteByte(s[i])
+					i++
+				}
+				i++
+			case '\\':
+				if i+1 < len(s) {
+					b.WriteByte(s[i+1])
+				}
+				i += 2
+			default:
+				b.WriteByte(s[i])
+				i++
+			}
+		}
+		out[key] = b.String()
+	}
+	return out
+}
+
+// Marker is one supply the printer reports.
+type Marker struct {
+	Name  string `json:"name"`
+	Type  string `json:"type,omitempty"`
+	Level int    `json:"level_percent"`
+	Low   bool   `json:"low"`
+}
+
+// Printer is one queue.
+type Printer struct {
+	Name       string   `json:"name"`
+	State      string   `json:"state"`
+	Enabled    bool     `json:"enabled"`
+	Accepting  bool     `json:"accepting"`
+	Default    bool     `json:"default"`
+	URI        string   `json:"uri"`
+	MakeModel  string   `json:"make_and_model"`
+	Driverless bool     `json:"driverless"`
+	Shared     bool     `json:"shared"`
+	Reasons    []string `json:"reasons"`
+	Markers    []Marker `json:"markers"`
+	Since      string   `json:"since,omitempty"`
+	Message    string   `json:"message,omitempty"`
+}
+
+// PrintersAnswer is what cups_printers answers.
+type PrintersAnswer struct {
+	Scheduler string    `json:"scheduler"`
+	Default   string    `json:"default,omitempty"`
+	Printers  []Printer `json:"printers"`
+}
+
+func lpstat(args ...string) (string, error) {
+	r, err := call(Cmd{Name: "lpstat", Args: args})
+	if err != nil {
+		if strings.Contains(r.Stderr, "Scheduler is not running") || strings.Contains(r.Stderr, "Connection refused") {
+			return "", fmt.Errorf("the print scheduler is not running on this machine: %s", firstLine(r.Stderr))
+		}
+		// lpstat answers "No destinations added." with a non-zero status: that is no printers.
+		if strings.Contains(r.Stderr, "No destinations added") {
+			return "", nil
+		}
+		return "", err
+	}
+	return r.Stdout, nil
+}
+
+func defaultPrinter() (string, error) {
+	out, err := lpstat("-d")
+	if err != nil {
+		return "", err
+	}
+	if _, after, ok := strings.Cut(out, "system default destination: "); ok {
+		return strings.TrimSpace(firstLine(after)), nil
+	}
+	return "", nil
+}
+
+// Printers answers every queue with its state, device, model and supplies.
+func Printers() (PrintersAnswer, error) {
+	out := PrintersAnswer{Printers: []Printer{}}
+	sched, err := lpstat("-r")
+	if err != nil {
+		return out, err
+	}
+	out.Scheduler = strings.TrimSpace(sched)
+	if out.Default, err = defaultPrinter(); err != nil {
+		return out, err
+	}
+	ps, err := lpstat("-p")
+	if err != nil {
+		return out, err
+	}
+	var cur *Printer
+	for _, l := range strings.Split(ps, "\n") {
+		if strings.HasPrefix(l, "printer ") {
+			f := strings.Fields(l)
+			if len(f) < 3 {
+				continue
+			}
+			out.Printers = append(out.Printers, Printer{Name: f[1], Reasons: []string{}, Markers: []Marker{}})
+			cur = &out.Printers[len(out.Printers)-1]
+			rest := strings.Join(f[2:], " ")
+			switch {
+			case strings.HasPrefix(rest, "is idle"):
+				cur.State = "idle"
+			case strings.HasPrefix(rest, "now printing"):
+				cur.State = "printing"
+			default:
+				cur.State = "stopped"
+			}
+			// "disabled since …" (stopped), or "enabled since …" after the state.
+			cur.Enabled = !strings.HasPrefix(rest, "disabled") && !strings.Contains(rest, "disabled since")
+			if _, since, found := strings.Cut(rest, " since "); found {
+				cur.Since = strings.TrimSuffix(strings.TrimSpace(since), " -")
+			}
+			continue
+		}
+		if cur != nil && strings.HasPrefix(l, "\t") && strings.TrimSpace(l) != "" {
+			cur.Message = strings.TrimSpace(cur.Message + " " + strings.TrimSpace(l))
+		}
+	}
+	acc, err := lpstat("-a")
+	if err != nil {
+		return out, err
+	}
+	accepting := map[string]bool{}
+	for _, l := range lines(acc) {
+		if f := strings.Fields(l); len(f) >= 2 && f[1] == "accepting" {
+			accepting[f[0]] = true
+		}
+	}
+	for i := range out.Printers {
+		p := &out.Printers[i]
+		p.Accepting = accepting[p.Name]
+		p.Default = p.Name == out.Default
+		r, err := call(Cmd{Name: "lpoptions", Args: []string{"-p", p.Name}})
+		if err != nil {
+			return out, err
+		}
+		o := lpoptionsOf(r.Stdout)
+		p.URI = o["device-uri"]
+		p.MakeModel = o["printer-make-and-model"]
+		p.Driverless = driverless(p.MakeModel, p.URI)
+		p.Shared = o["printer-is-shared"] == "true"
+		for _, reason := range strings.Split(o["printer-state-reasons"], ",") {
+			if reason = strings.TrimSpace(reason); reason != "" && reason != "none" {
+				p.Reasons = append(p.Reasons, reason)
+			}
+		}
+		p.Markers = markersOf(o)
+	}
+	return out, nil
+}
+
+// driverless says a queue prints without a vendor driver: CUPS's own IPP Everywhere model, or a
+// driverless URI.
+func driverless(model, uri string) bool {
+	m := strings.ToLower(model)
+	return strings.Contains(m, "ipp everywhere") || strings.Contains(m, "driverless") || strings.HasPrefix(uri, "implicitclass:") ||
+		strings.HasPrefix(uri, "ipp://") && strings.Contains(m, "everywhere")
+}
+
+func markersOf(o map[string]string) []Marker {
+	split := func(k string) []string {
+		if o[k] == "" {
+			return nil
+		}
+		return strings.Split(o[k], ",")
+	}
+	names, levels, lows, types := split("marker-names"), split("marker-levels"), split("marker-low-levels"), split("marker-types")
+	out := []Marker{}
+	for i, n := range names {
+		if i >= len(levels) {
+			break
+		}
+		level, err := strconv.Atoi(strings.TrimSpace(levels[i]))
+		if err != nil {
+			continue
+		}
+		m := Marker{Name: strings.TrimSpace(n), Level: level}
+		if i < len(types) {
+			m.Type = strings.TrimSpace(types[i])
+		}
+		if i < len(lows) {
+			if low, err := strconv.Atoi(strings.TrimSpace(lows[i])); err == nil && level >= 0 && level <= low {
+				m.Low = true
+			}
+		}
+		out = append(out, m)
+	}
+	return out
+}
+
+// Job is one print job.
+type Job struct {
+	ID        string `json:"id"`
+	Printer   string `json:"printer"`
+	User      string `json:"user"`
+	Bytes     int64  `json:"bytes"`
+	Submitted string `json:"submitted"`
+}
+
+// Queue answers the jobs waiting, or the finished ones.
+func Queue(printer string, completed bool, limit int) (map[string]any, error) {
+	args := []string{}
+	if completed {
+		args = append(args, "-W", "completed")
+	}
+	args = append(args, "-o")
+	if printer != "" {
+		if err := checkPrinter(printer); err != nil {
+			return nil, err
+		}
+		args = append(args, printer)
+	}
+	out, err := lpstat(args...)
+	if err != nil {
+		return nil, err
+	}
+	jobs := []Job{}
+	for _, l := range lines(out) {
+		f := strings.Fields(l)
+		if len(f) < 4 {
+			continue
+		}
+		i := strings.LastIndex(f[0], "-")
+		if i <= 0 {
+			continue
+		}
+		size, _ := strconv.ParseInt(f[2], 10, 64)
+		jobs = append(jobs, Job{ID: f[0], Printer: f[0][:i], User: f[1], Bytes: size, Submitted: strings.Join(f[3:], " ")})
+	}
+	sort.SliceStable(jobs, func(a, b int) bool { return jobNumber(jobs[a].ID) > jobNumber(jobs[b].ID) })
+	total := len(jobs)
+	if len(jobs) > limit {
+		jobs = jobs[:limit]
+	}
+	return map[string]any{"count": total, "jobs": jobs, "completed": completed}, nil
+}
+
+func jobNumber(id string) int {
+	n, _ := strconv.Atoi(id[strings.LastIndex(id, "-")+1:])
+	return n
+}
+
+var jobID = regexp.MustCompile(`^([A-Za-z0-9_.@-]+-)?[0-9]+$`)
+
+// refused says CUPS kept an act for its administrators.
+func refused(r Result) bool {
+	s := r.Stderr + r.Stdout
+	return strings.Contains(s, "Forbidden") || strings.Contains(s, "not-authorized") || strings.Contains(s, "Not authorized") || strings.Contains(s, "not allowed")
+}
+
+// asAccountThenRoot runs an act as the account, and through sudo -n when CUPS refuses the account.
+func asAccountThenRoot(c Cmd) (Result, bool, error) {
+	r := run(c)
+	if r.Status == 0 && r.Error == "" {
+		return r, false, nil
+	}
+	if !refused(r) {
+		return r, false, failure(c, r)
+	}
+	c.Root = true
+	r, err := call(c)
+	return r, true, err
+}
+
+// Cancel cancels one job, or every job on a printer.
+func Cancel(job, printer string, all bool) (map[string]any, error) {
+	var c Cmd
+	switch {
+	case all:
+		if printer == "" {
+			return nil, fmt.Errorf("all needs printer: cancelling every job on every printer is not offered")
+		}
+		if err := checkPrinter(printer); err != nil {
+			return nil, err
+		}
+		c = Cmd{Name: "cancel", Args: []string{"-a", printer}}
+	case job != "":
+		if !jobID.MatchString(job) {
+			return nil, fmt.Errorf("%q is not a job id", job)
+		}
+		c = Cmd{Name: "cancel", Args: []string{job}}
+	default:
+		return nil, fmt.Errorf("give job, or printer with all")
+	}
+	_, escalated, err := asAccountThenRoot(c)
+	if err != nil {
+		return nil, err
+	}
+	return map[string]any{"cancelled": strings.Join(c.Args, " "), "as_root": escalated}, nil
+}
+
+var requestID = regexp.MustCompile(`request id is (\S+)`)
+
+// statFile tells a regular file. Tests replace it.
+var statFile = func(p string) error {
+	info, err := os.Stat(p)
+	if err != nil {
+		return err
+	}
+	if !info.Mode().IsRegular() {
+		return fmt.Errorf("%s is not a regular file", p)
+	}
+	return nil
+}
+
+// Print sends a file to a printer.
+func Print(file, printer string, copies int, opts map[string]string, title string) (map[string]any, error) {
+	if !filepath.IsAbs(file) {
+		return nil, fmt.Errorf("file must be an absolute path, not %q", file)
+	}
+	if err := statFile(file); err != nil {
+		return nil, fmt.Errorf("cannot print %s: %v", file, err)
+	}
+	args := []string{}
+	if printer != "" {
+		if err := checkPrinter(printer); err != nil {
+			return nil, err
+		}
+		args = append(args, "-d", printer)
+	}
+	args = append(args, "-n", strconv.Itoa(copies))
+	names := make([]string, 0, len(opts))
+	for k := range opts {
+		names = append(names, k)
+	}
+	sort.Strings(names)
+	for _, k := range names {
+		args = append(args, "-o", k+"="+opts[k])
+	}
+	if title == "" {
+		title = filepath.Base(file)
+	}
+	args = append(args, "-t", title, "--", file)
+	r, err := call(Cmd{Name: "lp", Args: args})
+	if err != nil {
+		if strings.Contains(r.Stderr, "No default destination") {
+			return nil, fmt.Errorf("no printer given and this machine has no default printer: name one, or set one with cups_default")
+		}
+		return nil, err
+	}
+	m := requestID.FindStringSubmatch(r.Stdout)
+	if m == nil {
+		return nil, fmt.Errorf("lp answered no job id: %s", strings.TrimSpace(r.Stdout+r.Stderr))
+	}
+	return map[string]any{"job": m[1], "file": file, "copies": copies, "follow": "cups_queue"}, nil
+}
+
+// Default answers the default printer, or sets it.
+func Default(printer string) (map[string]any, error) {
+	if printer == "" {
+		d, err := defaultPrinter()
+		if err != nil {
+			return nil, err
+		}
+		return map[string]any{"default": d}, nil
+	}
+	if err := checkPrinter(printer); err != nil {
+		return nil, err
+	}
+	was, err := defaultPrinter()
+	if err != nil {
+		return nil, err
+	}
+	if _, err := call(Cmd{Name: "lpadmin", Args: []string{"-d", printer}, Root: true}); err != nil {
+		return nil, err
+	}
+	return map[string]any{"default": printer, "was": was}, nil
+}
+
+// Resume enables a printer and makes it accept jobs.
+func Resume(printer string) (map[string]any, error) {
+	if err := checkPrinter(printer); err != nil {
+		return nil, err
+	}
+	for _, c := range []string{"cupsenable", "cupsaccept"} {
+		if _, err := call(Cmd{Name: c, Args: []string{printer}, Root: true}); err != nil {
+			return nil, err
+		}
+	}
+	return map[string]any{"printer": printer, "enabled": true, "accepting": true}, nil
+}
+
+// DriverPackage is a package that brings filters or backends.
+type DriverPackage struct {
+	Package string `json:"package"`
+	Version string `json:"version"`
+	Foreign bool   `json:"foreign"`
+}
+
+// Model is one driver model CUPS offers.
+type Model struct {
+	PPD         string `json:"ppd"`
+	Description string `json:"description"`
+}
+
+// QueueDriver is how one queue prints.
+type QueueDriver struct {
+	Printer    string `json:"printer"`
+	MakeModel  string `json:"make_and_model"`
+	Driverless bool   `json:"driverless"`
+	URI        string `json:"uri"`
+}
+
+// DriversAnswer is what cups_drivers answers.
+type DriversAnswer struct {
+	Queues   []QueueDriver   `json:"queues"`
+	Packages []DriverPackage `json:"driver_packages"`
+	Models   []Model         `json:"models"`
+	Matched  int             `json:"models_matched"`
+	Findings []string        `json:"findings"`
+}
+
+// driverDirs are where drivers put what CUPS runs.
+var driverDirs = []string{"/usr/lib/cups/filter", "/usr/lib/cups/backend"}
+
+// basePackages bring CUPS's own filters and backends, not a printer's driver.
+var basePackages = map[string]bool{"cups": true, "cups-filters": true, "libcups": true, "ghostscript": true, "cups-pdf": false}
+
+// Drivers answers how each queue prints and which packages bring drivers.
+func Drivers(match string, limit int) (DriversAnswer, error) {
+	out := DriversAnswer{Queues: []QueueDriver{}, Packages: []DriverPackage{}, Models: []Model{}, Findings: []string{}}
+	ps, err := Printers()
+	if err != nil {
+		return out, err
+	}
+	for _, p := range ps.Printers {
+		out.Queues = append(out.Queues, QueueDriver{Printer: p.Name, MakeModel: p.MakeModel, Driverless: p.Driverless, URI: p.URI})
+	}
+	r := run(Cmd{Name: "pacman", Args: append([]string{"-Qo"}, driverDirs...)})
+	if r.Error != "" {
+		return out, failure(Cmd{Name: "pacman", Args: []string{"-Qo"}}, r)
+	}
+	seen := map[string]bool{}
+	for _, l := range lines(r.Stdout) {
+		if _, after, ok := strings.Cut(l, " is owned by "); ok {
+			f := strings.Fields(after)
+			if len(f) >= 2 && !seen[f[0]] && !basePackages[f[0]] {
+				seen[f[0]] = true
+				out.Packages = append(out.Packages, DriverPackage{Package: f[0], Version: f[1]})
+			}
+		}
+	}
+	if len(out.Packages) > 0 {
+		r := run(Cmd{Name: "pacman", Args: []string{"-Qqm"}})
+		foreign := map[string]bool{}
+		for _, l := range lines(r.Stdout) {
+			foreign[strings.TrimSpace(l)] = true
+		}
+		for i := range out.Packages {
+			out.Packages[i].Foreign = foreign[out.Packages[i].Package]
+		}
+	}
+	sort.Slice(out.Packages, func(i, k int) bool { return out.Packages[i].Package < out.Packages[k].Package })
+	m, err := call(Cmd{Name: "lpinfo", Args: []string{"-m"}})
+	if err != nil {
+		return out, err
+	}
+	for _, l := range lines(m.Stdout) {
+		ppd, desc, _ := strings.Cut(l, " ")
+		if match != "" && !strings.Contains(strings.ToLower(desc), strings.ToLower(match)) && !strings.Contains(strings.ToLower(ppd), strings.ToLower(match)) {
+			continue
+		}
+		out.Matched++
+		if len(out.Models) < limit {
+			out.Models = append(out.Models, Model{PPD: ppd, Description: desc})
+		}
+	}
+	// Which driver packages no queue prints through.
+	allDriverless := len(out.Queues) > 0
+	for _, q := range out.Queues {
+		allDriverless = allDriverless && q.Driverless
+	}
+	for _, p := range out.Packages {
+		if p.Foreign {
+			out.Findings = append(out.Findings, "driver package "+p.Package+" is not from the official repositories")
+		}
+		if allDriverless {
+			out.Findings = append(out.Findings, "every queue prints driverless, so no queue uses the driver package "+p.Package)
+		}
+	}
+	return out, nil
+}

modules/cups/cmd/cups-tools/cups_test.go

@@ -0,0 +1,234 @@
+package main
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestTheManifestIsTheSchedulerAndDriverlessPrintingAndNoVendorDriver(t *testing.T) {
+	m := readManifest(t)
+	holdsTheBundle(t, m, "cups")
+	if got := strings.Join(m.packages(), ","); got != "cups,cups-filters" {
+		t.Errorf("packages %s: a vendor driver is from outside the official repositories, and no queue measured needs one but the desktop's Canon", got)
+	}
+	s := m.services()
+	for _, u := range []string{"cups.socket", "cups.service"} {
+		if s[u] == nil || s[u]["state"] != "running" || s[u]["boot"] != "enabled" {
+			t.Errorf("%s: %v", u, s[u])
+		}
+	}
+	for _, r := range m.Resources {
+		if r["type"] == "file" {
+			t.Errorf("the queues and cupsd's files are CUPS's own: %v", r["id"])
+		}
+	}
+}
+
+// The desktop's two queues on 2026-10-04.
+func theDesktop(t *testing.T, more func(line string, c Cmd) (Result, bool)) *fake {
+	return using(t, func(line string, c Cmd) Result {
+		if more != nil {
+			if r, handled := more(line, c); handled {
+				return r
+			}
+		}
+		switch line {
+		case "lpstat -r":
+			return ok("scheduler is running\n")
+		case "lpstat -d":
+			return ok("system default destination: Brother_MFC_Novox\n")
+		case "lpstat -p":
+			return ok("printer Brother_MFC_Novox is idle.  enabled since Mon Jun 29 21:34:30 2026\n" +
+				"printer Kanjuro disabled since Sun Jun  9 11:16:03 2024 -\n\tPaused\n")
+		case "lpstat -a":
+			return ok("Brother_MFC_Novox accepting requests since Mon Jun 29 21:34:30 2026\nKanjuro not accepting requests since Sun Jun  9 11:16:03 2024 -\n\tRejecting Jobs\n")
+		case "lpoptions -p Brother_MFC_Novox":
+			return ok(`copies=1 device-uri=ipp://192.0.2.171/ipp/port1 finishings=3 marker-levels=70,100,8,100 marker-low-levels=10,10,10,10 marker-names='Black\ Toner\ Cartridge,Cyan\ Toner\ Cartridge,Magenta\ Toner\ Cartridge,Yellow\ Toner\ Cartridge' marker-types=toner,toner,toner,toner printer-is-shared=false printer-make-and-model='Printer - IPP Everywhere' printer-state-reasons=none`)
+		case "lpoptions -p Kanjuro":
+			return ok(`device-uri=cnijnet:/18-0C-AC-B0-62-83 printer-is-shared=false printer-make-and-model='Canon MG4200 series Ver.3.80' printer-state-reasons=paused`)
+		}
+		return Result{Status: 9, Stderr: "unexpected " + line}
+	})
+}
+
+func TestPrintersReadsStateDeviceModelAndSupplies(t *testing.T) {
+	theDesktop(t, nil)
+	got, err := Printers()
+	if err != nil || len(got.Printers) != 2 || got.Default != "Brother_MFC_Novox" || got.Scheduler != "scheduler is running" {
+		t.Fatalf("%+v %v", got, err)
+	}
+	b, k := got.Printers[0], got.Printers[1]
+	if b.State != "idle" || !b.Enabled || !b.Accepting || !b.Default || !b.Driverless || b.URI != "ipp://192.0.2.171/ipp/port1" || len(b.Reasons) != 0 {
+		t.Errorf("%+v", b)
+	}
+	if len(b.Markers) != 4 || b.Markers[0].Name != "Black Toner Cartridge" || b.Markers[2].Level != 8 || !b.Markers[2].Low || b.Markers[0].Low {
+		t.Errorf("markers %+v", b.Markers)
+	}
+	if k.State != "stopped" || k.Enabled || k.Accepting || k.Driverless || strings.Join(k.Reasons, ",") != "paused" || k.Message != "Paused" {
+		t.Errorf("%+v", k)
+	}
+}
+
+func TestPrintersWithoutAQueueOrAScheduler(t *testing.T) {
+	using(t, func(line string, c Cmd) Result {
+		if line == "lpstat -r" {
+			return ok("scheduler is running\n")
+		}
+		return Result{Status: 1, Stderr: "lpstat: No destinations added.\n"}
+	})
+	got, err := Printers()
+	if err != nil || len(got.Printers) != 0 {
+		t.Fatalf("no queue is an empty answer, not a failure: %+v %v", got, err)
+	}
+	using(t, func(string, Cmd) Result { return Result{Status: 1, Stderr: "lpstat: Scheduler is not running.\n"} })
+	if _, err := Printers(); err == nil || !strings.Contains(err.Error(), "scheduler is not running") {
+		t.Fatalf("%v", err)
+	}
+}
+
+func TestLpoptionsQuotingIsRead(t *testing.T) {
+	o := lpoptionsOf(`a=1 b='x y' c=p\ q d e=`)
+	if o["a"] != "1" || o["b"] != "x y" || o["c"] != "p q" || o["d"] != "" || o["e"] != "" {
+		t.Errorf("%v", o)
+	}
+}
+
+func TestQueueReadsJobsNewestFirstAndBounded(t *testing.T) {
+	f := using(t, func(string, Cmd) Result {
+		return ok("Brother-6               jochen            1024   Mon Jul  8 12:15:34 2024\nBrother-8               jochen            2048   Mon Jul  8 12:19:56 2024\nBrother-7               other             1024   Mon Jul  8 12:15:23 2024\n")
+	})
+	got, err := Queue("Brother", true, 2)
+	jobs := got["jobs"].([]Job)
+	if err != nil || got["count"] != 3 || len(jobs) != 2 || jobs[0].ID != "Brother-8" || jobs[0].Printer != "Brother" || jobs[0].Bytes != 2048 || jobs[0].Submitted != "Mon Jul 8 12:19:56 2024" {
+		t.Fatalf("%+v %v", got, err)
+	}
+	if f.lines()[0] != "lpstat -W completed -o Brother" {
+		t.Errorf("%v", f.lines())
+	}
+	if _, err := Queue("-h", false, 5); err == nil {
+		t.Error("an option as a printer")
+	}
+}
+
+func TestCancelTriesTheAccountThenRootWhenCUPSRefusesIt(t *testing.T) {
+	f := using(t, func(line string, c Cmd) Result {
+		if !strings.HasPrefix(line, "sudo") {
+			return Result{Status: 1, Stderr: "cancel: Forbidden\n"}
+		}
+		return ok("")
+	})
+	got, err := Cancel("Brother-12", "", false)
+	if err != nil || got["as_root"] != true {
+		t.Fatalf("%v %v", got, err)
+	}
+	if strings.Join(f.lines(), "|") != "cancel Brother-12|sudo -n cancel Brother-12" {
+		t.Errorf("%v", f.lines())
+	}
+	f = using(t, func(string, Cmd) Result { return ok("") })
+	if got, err := Cancel("", "Brother", true); err != nil || got["as_root"] != false || f.lines()[0] != "cancel -a Brother" {
+		t.Fatalf("%v %v %v", got, err, f.lines())
+	}
+	using(t, func(string, Cmd) Result { return Result{Status: 1, Stderr: "cancel: Unknown job 99\n"} })
+	if _, err := Cancel("99", "", false); err == nil || !strings.Contains(err.Error(), "Unknown job") {
+		t.Errorf("a failure that is not a refusal is not retried as root: %v", err)
+	}
+	for _, bad := range [][3]string{{"", "", ""}, {"12; rm", "", ""}, {"", "", "all"}} {
+		if _, err := Cancel(bad[0], bad[1], bad[2] == "all"); err == nil {
+			t.Errorf("%v accepted", bad)
+		}
+	}
+}
+
+func TestPrintChecksTheFileAndOptionsAndAnswersTheJob(t *testing.T) {
+	was := statFile
+	defer func() { statFile = was }()
+	statFile = func(p string) error {
+		if p == "/home/op/doc.pdf" {
+			return nil
+		}
+		return errString("no such file")
+	}
+	f := using(t, func(string, Cmd) Result { return ok("request id is Brother-13 (1 file(s))\n") })
+	got, err := Print("/home/op/doc.pdf", "Brother", 2, map[string]string{"sides": "two-sided-long-edge", "media": "A4"}, "")
+	if err != nil || got["job"] != "Brother-13" {
+		t.Fatalf("%v %v", got, err)
+	}
+	if l := f.lines()[0]; l != "lp -d Brother -n 2 -o media=A4 -o sides=two-sided-long-edge -t doc.pdf -- /home/op/doc.pdf" {
+		t.Errorf("%s", l)
+	}
+	if _, err := Print("doc.pdf", "", 1, nil, ""); err == nil {
+		t.Error("a relative file")
+	}
+	if _, err := Print("/home/op/missing.pdf", "", 1, nil, ""); err == nil {
+		t.Error("a missing file")
+	}
+	if _, err := optionsOf(map[string]any{"options": map[string]any{"sides": "x y"}}); err == nil {
+		t.Error("an option value with a space")
+	}
+	if _, err := optionsOf(map[string]any{"options": map[string]any{"-o": "x"}}); err == nil {
+		t.Error("an option name that is an option")
+	}
+	using(t, func(string, Cmd) Result { return Result{Status: 1, Stderr: "lp: Error - No default destination."} })
+	if _, err := Print("/home/op/doc.pdf", "", 1, nil, ""); err == nil || !strings.Contains(err.Error(), "no default printer") {
+		t.Errorf("%v", err)
+	}
+}
+
+type errString string
+
+func (e errString) Error() string { return string(e) }
+
+func TestDefaultReadsAndSetsThroughSudo(t *testing.T) {
+	f := theDesktop(t, func(line string, c Cmd) (Result, bool) {
+		if strings.HasPrefix(line, "sudo -n lpadmin") {
+			return ok(""), true
+		}
+		return Result{}, false
+	})
+	got, err := Default("")
+	if err != nil || got["default"] != "Brother_MFC_Novox" {
+		t.Fatalf("%v %v", got, err)
+	}
+	got, err = Default("Kanjuro")
+	if err != nil || got["default"] != "Kanjuro" || got["was"] != "Brother_MFC_Novox" {
+		t.Fatalf("%v %v", got, err)
+	}
+	if l := f.lines(); l[len(l)-1] != "sudo -n lpadmin -d Kanjuro" {
+		t.Errorf("%v", l)
+	}
+}
+
+func TestResumeEnablesAndAcceptsThroughSudo(t *testing.T) {
+	f := using(t, func(string, Cmd) Result { return ok("") })
+	if _, err := Resume("Kanjuro"); err != nil {
+		t.Fatal(err)
+	}
+	if strings.Join(f.lines(), "|") != "sudo -n cupsenable Kanjuro|sudo -n cupsaccept Kanjuro" {
+		t.Errorf("%v", f.lines())
+	}
+}
+
+func TestDriversNamesForeignDriverPackagesAndOnesNoQueueUses(t *testing.T) {
+	theDesktop(t, func(line string, c Cmd) (Result, bool) {
+		switch {
+		case strings.HasPrefix(line, "pacman -Qo"):
+			return ok("/usr/lib/cups/filter/ is owned by brother-mfc-l8390cdw 3.5.1-2\n/usr/lib/cups/filter/ is owned by cups 2:2.4.19-1\n/usr/lib/cups/filter/ is owned by cups-filters 2.0.1-2\n/usr/lib/cups/backend/ is owned by cnijfilter-mg4200 3.80-6\n/usr/lib/cups/backend/ is owned by cups 2:2.4.19-1\n"), true
+		case line == "pacman -Qqm":
+			return ok("brother-mfc-l8390cdw\ncnijfilter-mg4200\nsnapd\n"), true
+		case line == "lpinfo -m":
+			return ok("drv:///sample.drv/dymo.ppd DYMO Label Printer\ncanonmg4200.ppd Canon MG4200 series Ver.3.80\neverywhere IPP Everywhere\n"), true
+		}
+		return Result{}, false
+	})
+	got, err := Drivers("canon", 10)
+	if err != nil || len(got.Queues) != 2 || len(got.Packages) != 2 || got.Matched != 1 || got.Models[0].PPD != "canonmg4200.ppd" {
+		t.Fatalf("%+v %v", got, err)
+	}
+	if !got.Packages[0].Foreign || got.Packages[0].Package != "brother-mfc-l8390cdw" {
+		t.Errorf("%+v", got.Packages)
+	}
+	all := strings.Join(got.Findings, ";")
+	if !strings.Contains(all, "cnijfilter-mg4200 is not from the official") || strings.Contains(all, "every queue prints driverless") {
+		t.Errorf("the Canon queue uses its driver, so not every queue is driverless: %s", all)
+	}
+}

modules/cups/cmd/cups-tools/kit.go

@@ -0,0 +1,352 @@
+package main
+
+// kit.go is the same file in each of the workstations' tool bundles (fonts, docker-compose, snapd,
+// flatpak, cups, bluetooth, xclip, dmenu): how a tool runs a command, escalates, bounds what it
+// keeps, and names a failure. A module is built from its own directory, so the file is copied rather
+// than shared; a change to one copy is made to all eight.
+//
+// The rules it holds (novox/hq research 026/05, to-be 38 WP4):
+//   - the node's tool runtime runs as the operator account, not root (ADR 0175 §4); a command that
+//     needs root goes through `sudo -n`, never a prompt, and a refusal is named as such;
+//   - one command gets 20 s, below the runtime's 30 s call limit, and is ended with everything it
+//     started when it takes longer;
+//   - each stream is kept to 256 KiB, and the answer says when it was cut;
+//   - a failure is an error with what went wrong in it, never an empty answer.
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"strings"
+	"syscall"
+	"time"
+)
+
+// Bounds every command is held to.
+const (
+	CallTimeout = 20 * time.Second
+	MostOutput  = 256 << 10
+)
+
+// Cmd is one command a tool runs.
+type Cmd struct {
+	Name string
+	Args []string
+	// Stdin is written to the command's standard input when not empty.
+	Stdin string
+	// Env is added to this process's own environment.
+	Env []string
+	// Root says the command needs root: it is run through `sudo -n` when this process is not root.
+	Root bool
+	// Timeout replaces CallTimeout; only a background job (jobs.go) asks for longer.
+	Timeout time.Duration
+	// Detached is for a program that forks a child which outlives it, as xclip does to keep the
+	// selection: its streams go to files, because a pipe the child inherits would hold the call open
+	// until the child exits.
+	Detached bool
+}
+
+// Result is what a command did.
+type Result struct {
+	Stdout string `json:"stdout"`
+	Stderr string `json:"stderr"`
+	Status int    `json:"status"`
+	// Error is why it did not run to an answer: "not-found" when the program is not there,
+	// "timeout" when it was ended for taking too long, else the spawn error.
+	Error     string `json:"error,omitempty"`
+	Truncated bool   `json:"truncated,omitempty"`
+}
+
+// Runner runs a command. Tests replace it; nothing else does.
+type Runner func(Cmd) Result
+
+var (
+	run  Runner = execRun
+	euid        = os.Geteuid
+)
+
+// argv is the command as it is run: through sudo without a prompt when it needs root and this
+// process is not root.
+func argv(c Cmd) (string, []string) {
+	if c.Root && euid() != 0 {
+		return "sudo", append([]string{"-n", c.Name}, c.Args...)
+	}
+	return c.Name, c.Args
+}
+
+// bounded keeps the first MostOutput bytes written to it and notes that more came.
+type bounded struct {
+	b   bytes.Buffer
+	cut bool
+}
+
+func (w *bounded) Write(p []byte) (int, error) {
+	room := MostOutput - w.b.Len()
+	if room <= 0 {
+		w.cut = w.cut || len(p) > 0
+		return len(p), nil
+	}
+	if len(p) > room {
+		w.b.Write(p[:room])
+		w.cut = true
+		return len(p), nil
+	}
+	return w.b.Write(p)
+}
+
+func execRun(c Cmd) Result {
+	timeout := c.Timeout
+	if timeout <= 0 {
+		timeout = CallTimeout
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+	name, args := argv(c)
+	cmd := exec.CommandContext(ctx, name, args...)
+	cmd.Env = append(append(os.Environ(), "LC_ALL=C"), c.Env...)
+	if !c.Detached {
+		// Its own process group, so that ending it on a timeout ends what it started too.
+		cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
+		cmd.Cancel = func() error {
+			if cmd.Process != nil {
+				_ = syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL)
+			}
+			return nil
+		}
+	}
+	cmd.WaitDelay = 2 * time.Second
+	if c.Stdin != "" {
+		cmd.Stdin = strings.NewReader(c.Stdin)
+	}
+	var out, errs bounded
+	var outFile, errFile *os.File
+	if c.Detached {
+		var err error
+		if outFile, err = os.CreateTemp("", "mesh-tool-out-*"); err != nil {
+			return Result{Status: 127, Error: err.Error()}
+		}
+		defer os.Remove(outFile.Name())
+		defer outFile.Close()
+		if errFile, err = os.CreateTemp("", "mesh-tool-err-*"); err != nil {
+			return Result{Status: 127, Error: err.Error()}
+		}
+		defer os.Remove(errFile.Name())
+		defer errFile.Close()
+		cmd.Stdout, cmd.Stderr = outFile, errFile
+	} else {
+		cmd.Stdout, cmd.Stderr = &out, &errs
+	}
+	err := cmd.Run()
+	if c.Detached {
+		for _, f := range []struct {
+			file *os.File
+			into *bounded
+		}{{outFile, &out}, {errFile, &errs}} {
+			if _, e := f.file.Seek(0, io.SeekStart); e == nil {
+				_, _ = io.Copy(f.into, f.file)
+			}
+		}
+	}
+	r := Result{Stdout: out.b.String(), Stderr: errs.b.String(), Truncated: out.cut || errs.cut}
+	var exit *exec.ExitError
+	switch {
+	case err == nil:
+	case ctx.Err() == context.DeadlineExceeded:
+		r.Status, r.Error = 124, "timeout"
+	case errors.Is(err, exec.ErrNotFound) || errors.Is(err, os.ErrNotExist):
+		r.Status, r.Error = 127, "not-found"
+	case errors.As(err, &exit):
+		r.Status = exit.ExitCode()
+	default:
+		r.Status, r.Error = 127, err.Error()
+	}
+	return r
+}
+
+// call runs a command and answers its result, or an error naming what went wrong.
+func call(c Cmd) (Result, error) {
+	r := run(c)
+	if r.Status == 0 && r.Error == "" {
+		return r, nil
+	}
+	return r, failure(c, r)
+}
+
+// failure names how a command failed: not installed, refused escalation, too slow, or its exit
+// status with the end of what it said.
+func failure(c Cmd, r Result) error {
+	program, _ := argv(c)
+	switch {
+	case r.Error == "not-found" && program == "sudo":
+		return fmt.Errorf("%s needs root, and sudo is not installed here for the runtime's account to escalate with", c.Name)
+	case r.Error == "not-found":
+		if hint, ok := providedBy[c.Name]; ok {
+			return fmt.Errorf("%s is not installed on this machine (%s)", c.Name, hint)
+		}
+		return fmt.Errorf("%s is not installed on this machine", c.Name)
+	case r.Error == "timeout":
+		limit := c.Timeout
+		if limit <= 0 {
+			limit = CallTimeout
+		}
+		return fmt.Errorf("%s gave no answer within %s and was ended", c.Name, limit)
+	case r.Error != "":
+		return fmt.Errorf("%s did not run: %s", c.Name, r.Error)
+	case program == "sudo" && strings.Contains(r.Stderr, "command not found"):
+		if hint, ok := providedBy[c.Name]; ok {
+			return fmt.Errorf("%s is not installed on this machine (%s)", c.Name, hint)
+		}
+		return fmt.Errorf("%s is not installed on this machine", c.Name)
+	case program == "sudo" && strings.HasPrefix(strings.TrimSpace(r.Stderr), "sudo:"):
+		return fmt.Errorf("%s needs root, and sudo -n refused the runtime's account: %s (the escalation is the sudo module's to declare)",
+			c.Name, firstLine(r.Stderr))
+	}
+	said := tail(strings.TrimSpace(r.Stderr), 2000)
+	if said == "" {
+		said = tail(strings.TrimSpace(r.Stdout), 2000)
+	}
+	if said == "" {
+		said = "and said nothing"
+	}
+	return fmt.Errorf("%s %s exited %d: %s", c.Name, strings.Join(c.Args, " "), r.Status, said)
+}
+
+func firstLine(s string) string {
+	s = strings.TrimSpace(s)
+	if i := strings.IndexByte(s, '\n'); i >= 0 {
+		return s[:i]
+	}
+	return s
+}
+
+func tail(s string, n int) string {
+	if len(s) <= n {
+		return s
+	}
+	return "…" + s[len(s)-n:]
+}
+
+// lines are a command's output lines, blank ones dropped.
+func lines(s string) []string {
+	out := []string{}
+	for _, l := range strings.Split(s, "\n") {
+		if strings.TrimSpace(l) != "" {
+			out = append(out, strings.TrimRight(l, "\r"))
+		}
+	}
+	return out
+}
+
+// Arguments, read the way a tool's JSON arguments arrive.
+
+func text(args map[string]any, key string) (string, error) {
+	v, ok := args[key]
+	if !ok || v == nil {
+		return "", fmt.Errorf("%s is required", key)
+	}
+	s, ok := v.(string)
+	if !ok {
+		return "", fmt.Errorf("%s must be a string", key)
+	}
+	if strings.TrimSpace(s) == "" {
+		return "", fmt.Errorf("%s must not be empty", key)
+	}
+	return s, nil
+}
+
+func optText(args map[string]any, key, def string) (string, error) {
+	v, ok := args[key]
+	if !ok || v == nil {
+		return def, nil
+	}
+	s, ok := v.(string)
+	if !ok {
+		return "", fmt.Errorf("%s must be a string", key)
+	}
+	if strings.TrimSpace(s) == "" {
+		return def, nil
+	}
+	return s, nil
+}
+
+// optWhole reads a whole number, defaulted, refused below least and held to most.
+func optWhole(args map[string]any, key string, def, least, most int) (int, error) {
+	v, ok := args[key]
+	if !ok || v == nil {
+		return def, nil
+	}
+	f, ok := v.(float64)
+	if !ok {
+		if i, isInt := v.(int); isInt {
+			f = float64(i)
+		} else {
+			return 0, fmt.Errorf("%s must be a number", key)
+		}
+	}
+	if f != float64(int(f)) {
+		return 0, fmt.Errorf("%s must be a whole number", key)
+	}
+	n := int(f)
+	if n < least {
+		return 0, fmt.Errorf("%s must be at least %d", key, least)
+	}
+	if n > most {
+		n = most
+	}
+	return n, nil
+}
+
+func optFlag(args map[string]any, key string, def bool) (bool, error) {
+	v, ok := args[key]
+	if !ok || v == nil {
+		return def, nil
+	}
+	b, ok := v.(bool)
+	if !ok {
+		return false, fmt.Errorf("%s must be true or false", key)
+	}
+	return b, nil
+}
+
+func optList(args map[string]any, key string) ([]string, error) {
+	v, ok := args[key]
+	if !ok || v == nil {
+		return nil, nil
+	}
+	items, ok := v.([]any)
+	if !ok {
+		return nil, fmt.Errorf("%s must be a list of strings", key)
+	}
+	out := make([]string, 0, len(items))
+	for _, it := range items {
+		s, ok := it.(string)
+		if !ok || strings.TrimSpace(s) == "" {
+			return nil, fmt.Errorf("%s must be a list of non-empty strings", key)
+		}
+		out = append(out, s)
+	}
+	return out, nil
+}
+
+// oneOf refuses a value outside a closed set.
+func oneOf(key, value string, allowed ...string) error {
+	for _, a := range allowed {
+		if value == a {
+			return nil
+		}
+	}
+	return fmt.Errorf("%s must be one of %s, not %q", key, strings.Join(allowed, ", "), value)
+}
+
+// plainName refuses a name that could be read as an option or carries a path or a space: package,
+// snap, application and printer names never do.
+func plainName(key, value string) error {
+	if strings.HasPrefix(value, "-") || strings.ContainsAny(value, " \t\n/\\") {
+		return fmt.Errorf("%s %q is not a plain name", key, value)
+	}
+	return nil
+}

modules/cups/cmd/cups-tools/kit_test.go

@@ -0,0 +1,147 @@
+package main
+
+// Tests of kit.go, the same in each workstation module.
+
+import (
+	"strings"
+	"testing"
+	"time"
+)
+
+// fake records the commands asked and answers each from a function of the command line.
+type fake struct {
+	asked  []Cmd
+	answer func(line string, c Cmd) Result
+}
+
+func (f *fake) runner() Runner {
+	return func(c Cmd) Result {
+		f.asked = append(f.asked, c)
+		name, args := argv(c)
+		line := strings.TrimSpace(name + " " + strings.Join(args, " "))
+		if f.answer == nil {
+			return Result{}
+		}
+		return f.answer(line, c)
+	}
+}
+
+func (f *fake) lines() []string {
+	out := []string{}
+	for _, c := range f.asked {
+		name, args := argv(c)
+		out = append(out, strings.TrimSpace(name+" "+strings.Join(args, " ")))
+	}
+	return out
+}
+
+// using installs a fake runner and a non-root uid for one test.
+func using(t *testing.T, answer func(line string, c Cmd) Result) *fake {
+	t.Helper()
+	f := &fake{answer: answer}
+	wasRun, wasUID := run, euid
+	run, euid = f.runner(), func() int { return 1000 }
+	t.Cleanup(func() { run, euid = wasRun, wasUID })
+	return f
+}
+
+func ok(stdout string) Result { return Result{Stdout: stdout} }
+
+func TestKitAnActThatNeedsRootGoesThroughSudoWithoutAPromptUnlessAlreadyRoot(t *testing.T) {
+	was := euid
+	defer func() { euid = was }()
+	euid = func() int { return 1000 }
+	if name, args := argv(Cmd{Name: "x", Args: []string{"a"}, Root: true}); name != "sudo" || strings.Join(args, " ") != "-n x a" {
+		t.Fatalf("not root: %s %v", name, args)
+	}
+	if name, _ := argv(Cmd{Name: "x"}); name != "x" {
+		t.Fatalf("a read is run as the account: %s", name)
+	}
+	euid = func() int { return 0 }
+	if name, _ := argv(Cmd{Name: "x", Root: true}); name != "x" {
+		t.Fatalf("as root no sudo: %s", name)
+	}
+}
+
+func TestKitAFailureIsNamedByHowItFailed(t *testing.T) {
+	was := euid
+	defer func() { euid = was }()
+	euid = func() int { return 1000 }
+	cases := []struct {
+		c    Cmd
+		r    Result
+		want string
+	}{
+		{Cmd{Name: "nothere"}, Result{Status: 127, Error: "not-found"}, "not installed"},
+		{Cmd{Name: "x", Root: true}, Result{Status: 127, Error: "not-found"}, "sudo is not installed"},
+		{Cmd{Name: "x", Root: true}, Result{Status: 1, Stderr: "sudo: a password is required\n"}, "sudo -n refused"},
+		{Cmd{Name: "x", Root: true}, Result{Status: 1, Stderr: "sudo: x: command not found\n"}, "x is not installed"},
+		{Cmd{Name: "x"}, Result{Status: 124, Error: "timeout"}, "within 20s"},
+		{Cmd{Name: "x", Args: []string{"y"}}, Result{Status: 3, Stderr: "boom\n"}, "x y exited 3: boom"},
+		{Cmd{Name: "x"}, Result{Status: 3}, "said nothing"},
+	}
+	for _, k := range cases {
+		err := failure(k.c, k.r)
+		if err == nil || !strings.Contains(err.Error(), k.want) {
+			t.Errorf("%+v: %v, want %q", k.r, err, k.want)
+		}
+	}
+}
+
+func TestKitOutputIsBoundedAndSaysSo(t *testing.T) {
+	var w bounded
+	big := strings.Repeat("a", MostOutput+10)
+	n, _ := w.Write([]byte(big))
+	if n != len(big) || w.b.Len() != MostOutput || !w.cut {
+		t.Fatalf("kept %d of %d, cut %v", w.b.Len(), len(big), w.cut)
+	}
+}
+
+func TestKitTheRealRunnerRunsEndsAndReportsAMissingProgram(t *testing.T) {
+	r := execRun(Cmd{Name: "sh", Args: []string{"-c", "echo out; echo err >&2; exit 3"}})
+	if r.Status != 3 || strings.TrimSpace(r.Stdout) != "out" || strings.TrimSpace(r.Stderr) != "err" {
+		t.Fatalf("%+v", r)
+	}
+	r = execRun(Cmd{Name: "sh", Args: []string{"-c", "sleep 5 & sleep 5"}, Timeout: 200 * time.Millisecond})
+	if r.Error != "timeout" {
+		t.Fatalf("a slow command: %+v", r)
+	}
+	r = execRun(Cmd{Name: "no-such-program-anywhere"})
+	if r.Error != "not-found" {
+		t.Fatalf("a missing program: %+v", r)
+	}
+	r = execRun(Cmd{Name: "cat", Stdin: "given"})
+	if r.Stdout != "given" {
+		t.Fatalf("stdin: %+v", r)
+	}
+	start := time.Now()
+	r = execRun(Cmd{Name: "sh", Args: []string{"-c", "echo kept; (sleep 3 &) ; exit 0"}, Detached: true})
+	if r.Status != 0 || strings.TrimSpace(r.Stdout) != "kept" || time.Since(start) > 2*time.Second {
+		t.Fatalf("a detached command returns when it exits, not when its child does: %+v after %s", r, time.Since(start))
+	}
+}
+
+func TestKitArgumentsAreReadStrictly(t *testing.T) {
+	args := map[string]any{"s": "x", "n": float64(5), "f": 1.5, "b": true, "l": []any{"a", "b"}}
+	if _, err := text(args, "missing"); err == nil {
+		t.Error("a missing required string")
+	}
+	if n, _ := optWhole(args, "n", 1, 1, 3); n != 3 {
+		t.Errorf("held to most: %d", n)
+	}
+	if _, err := optWhole(args, "n", 1, 6, 9); err == nil {
+		t.Error("below least")
+	}
+	if _, err := optWhole(args, "f", 1, 0, 9); err == nil {
+		t.Error("a fraction")
+	}
+	if l, _ := optList(args, "l"); len(l) != 2 {
+		t.Errorf("list: %v", l)
+	}
+	if b, _ := optFlag(args, "b", false); !b {
+		t.Error("flag")
+	}
+	if err := plainName("name", "--all"); err == nil {
+		t.Error("an option as a name")
+	}
+}

modules/cups/cmd/cups-tools/main.go

@@ -0,0 +1,177 @@
+// The cups module's tools (novox/hq research 027/02, 026/05): the printers, their state, supplies and
+// driver, the queue, and printing, cancelling and choosing the default. A Go bundle the node's runtime
+// launches over stdio (ADR 0188, ADR 0193); it runs as the operator account. An act CUPS keeps for
+// its administrators goes through `sudo -n`.
+package main
+
+import (
+	"fmt"
+	"os"
+
+	stdio "git.novox.be/novox/mesh-sdk/go"
+)
+
+var providedBy = map[string]string{
+	"lpstat":     "the cups package, which this module installs",
+	"lpoptions":  "the cups package, which this module installs",
+	"lp":         "the cups package, which this module installs",
+	"cancel":     "the cups package, which this module installs",
+	"lpadmin":    "the cups package, which this module installs",
+	"lpinfo":     "the cups package, which this module installs",
+	"cupsenable": "the cups package, which this module installs",
+	"cupsaccept": "the cups package, which this module installs",
+	"pacman":     "this is not an Arch machine",
+}
+
+func main() {
+	if err := stdio.Serve("", tools()); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+}
+
+var printerArg = map[string]any{"type": "string", "description": "the printer's queue name, as cups_printers answers it"}
+
+func tools() []stdio.Tool {
+	return []stdio.Tool{
+		{
+			Name: "cups_printers",
+			Description: "Every printer queue: state, whether it is enabled and accepting jobs, the default, its device " +
+				"address, make and model, whether it prints driverless (IPP Everywhere), the reasons for its state, and " +
+				"supply levels where the printer reports them. (r)",
+			Input: map[string]any{},
+			Run:   func(map[string]any) (any, error) { return Printers() },
+		},
+		{
+			Name: "cups_queue",
+			Description: "The jobs waiting or printing, on every printer or one; or, with completed, the finished ones. " +
+				"Each with its id, printer, owner, size and when it was submitted. (r)",
+			Input: map[string]any{
+				"printer":   printerArg,
+				"completed": map[string]any{"type": "boolean", "description": "the finished jobs instead"},
+				"limit":     map[string]any{"type": "integer", "description": "at most this many, newest first (default 50, at most 500)"},
+			},
+			Run: func(args map[string]any) (any, error) {
+				p, err := optText(args, "printer", "")
+				if err != nil {
+					return nil, err
+				}
+				done, err := optFlag(args, "completed", false)
+				if err != nil {
+					return nil, err
+				}
+				limit, err := optWhole(args, "limit", 50, 1, 500)
+				if err != nil {
+					return nil, err
+				}
+				return Queue(p, done, limit)
+			},
+		},
+		{
+			Name: "cups_cancel",
+			Description: "Cancel one job by its id (\"Brother-12\" or 12), or every job on a printer with all. Another " +
+				"account's job is cancelled through sudo -n. (a)",
+			Input: map[string]any{
+				"job":     map[string]any{"type": "string", "description": "the job id"},
+				"printer": printerArg,
+				"all":     map[string]any{"type": "boolean", "description": "every job on printer"},
+			},
+			Run: func(args map[string]any) (any, error) {
+				job, err := optText(args, "job", "")
+				if err != nil {
+					return nil, err
+				}
+				p, err := optText(args, "printer", "")
+				if err != nil {
+					return nil, err
+				}
+				all, err := optFlag(args, "all", false)
+				if err != nil {
+					return nil, err
+				}
+				return Cancel(job, p, all)
+			},
+		},
+		{
+			Name: "cups_print",
+			Description: "Print a file on this machine, to a printer or the default, with copies and IPP options such as " +
+				"sides=two-sided-long-edge or media=A4. Answers the job id. (a)",
+			Input: map[string]any{
+				"file":    map[string]any{"type": "string", "description": "the file's absolute path on this machine"},
+				"printer": printerArg,
+				"copies":  map[string]any{"type": "integer", "description": "copies (default 1, at most 99)"},
+				"options": map[string]any{"type": "object", "additionalProperties": map[string]any{"type": "string"}, "description": "IPP options, name to value"},
+				"title":   map[string]any{"type": "string", "description": "the job's title (default the file's name)"},
+			},
+			Run: func(args map[string]any) (any, error) {
+				file, err := text(args, "file")
+				if err != nil {
+					return nil, err
+				}
+				p, err := optText(args, "printer", "")
+				if err != nil {
+					return nil, err
+				}
+				copies, err := optWhole(args, "copies", 1, 1, 99)
+				if err != nil {
+					return nil, err
+				}
+				opts, err := optionsOf(args)
+				if err != nil {
+					return nil, err
+				}
+				title, err := optText(args, "title", "")
+				if err != nil {
+					return nil, err
+				}
+				return Print(file, p, copies, opts, title)
+			},
+		},
+		{
+			Name: "cups_default",
+			Description: "The machine's default printer; with printer, make that printer the default (through sudo -n). " +
+				"The default is CUPS's own setting, kept as the operator chose it: the mesh does not declare it. (r/a)",
+			Input: map[string]any{"printer": printerArg},
+			Run: func(args map[string]any) (any, error) {
+				p, err := optText(args, "printer", "")
+				if err != nil {
+					return nil, err
+				}
+				return Default(p)
+			},
+		},
+		{
+			Name:        "cups_resume",
+			Description: "Enable a printer and make it accept jobs again, after CUPS stopped it on an error. Through sudo -n. (a)",
+			Input:       map[string]any{"printer": printerArg},
+			Run: func(args map[string]any) (any, error) {
+				p, err := text(args, "printer")
+				if err != nil {
+					return nil, err
+				}
+				return Resume(p)
+			},
+		},
+		{
+			Name: "cups_drivers",
+			Description: "What each printer prints through (driverless or a driver's PPD), the packages that bring drivers " +
+				"and backends, which of them are from outside the official repositories, and the driver models CUPS " +
+				"offers, filtered by match. (r)",
+			Input: map[string]any{
+				"match": map[string]any{"type": "string", "description": "only models whose description contains this, any case"},
+				"limit": map[string]any{"type": "integer", "description": "at most this many models (default 50, at most 1000)"},
+			},
+			Run: func(args map[string]any) (any, error) {
+				match, err := optText(args, "match", "")
+				if err != nil {
+					return nil, err
+				}
+				limit, err := optWhole(args, "limit", 50, 0, 1000)
+				if err != nil {
+					return nil, err
+				}
+				return Drivers(match, limit)
+			},
+		},
+	}
+}

modules/cups/cmd/cups-tools/manifest_kit_test.go

@@ -0,0 +1,107 @@
+package main
+
+// manifest_kit_test.go is the same file in each workstation module: it reads the module's
+// definition so the module's own tests can hold it to what it says.
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+	"testing"
+)
+
+type manifest struct {
+	Module       string           `json:"module"`
+	Capabilities []string         `json:"capabilities"`
+	Claims       []any            `json:"claims"`
+	Seats        []any            `json:"seats"`
+	Tools        []string         `json:"tools"`
+	Resources    []map[string]any `json:"resources"`
+	Build        struct {
+		Artifacts []map[string]any `json:"artifacts"`
+	} `json:"build"`
+}
+
+func readManifest(t *testing.T) manifest {
+	t.Helper()
+	raw, err := os.ReadFile(filepath.Join("..", "..", "module.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var m manifest
+	if err := json.Unmarshal(raw, &m); err != nil {
+		t.Fatalf("module.json: %v", err)
+	}
+	return m
+}
+
+func (m manifest) resource(id string) map[string]any {
+	for _, r := range m.Resources {
+		if r["id"] == id {
+			return r
+		}
+	}
+	return nil
+}
+
+// packages are the packages the module installs, sorted.
+func (m manifest) packages() []string {
+	out := []string{}
+	for _, r := range m.Resources {
+		if r["type"] == "package" && r["absent"] != true {
+			out = append(out, r["package"].(string))
+		}
+	}
+	sort.Strings(out)
+	return out
+}
+
+// services are the units the module declares, by unit name.
+func (m manifest) services() map[string]map[string]any {
+	out := map[string]map[string]any{}
+	for _, r := range m.Resources {
+		if r["type"] == "service" {
+			out[r["unit"].(string)] = r
+		}
+	}
+	return out
+}
+
+// holdsTheBundle holds the manifest to the Go bundle this directory builds: every tool registered
+// is listed and nothing else, each named <prefix>_…, and the artifact builds this command.
+func holdsTheBundle(t *testing.T, m manifest, prefix string) {
+	t.Helper()
+	registered := []string{}
+	for _, tool := range tools() {
+		registered = append(registered, tool.Name)
+		if !strings.HasPrefix(tool.Name, prefix+"_") {
+			t.Errorf("tool %s is not named %s_…", tool.Name, prefix)
+		}
+		if tool.Description == "" || tool.Run == nil || tool.Input == nil {
+			t.Errorf("tool %s is not described, runnable and given an input schema", tool.Name)
+		}
+	}
+	if strings.Join(registered, ",") != strings.Join(m.Tools, ",") {
+		t.Errorf("registered %v, listed %v", registered, m.Tools)
+	}
+	if len(m.Build.Artifacts) != 1 {
+		t.Fatalf("one artifact, got %d", len(m.Build.Artifacts))
+	}
+	cwd, _ := os.Getwd()
+	binary := filepath.Base(cwd)
+	a := m.Build.Artifacts[0]
+	want := map[string]any{"kind": "bundle", "language": "go", "system": "arch", "from": "cmd/" + binary, "binary": binary}
+	for k, v := range want {
+		if a[k] != v {
+			t.Errorf("artifact %s = %v, want %v", k, a[k], v)
+		}
+	}
+	if loads, _ := a["loads"].([]any); len(loads) != 1 || loads[0] != binary {
+		t.Errorf("artifact loads %v, want [%s]", a["loads"], binary)
+	}
+	if m.Claims != nil || m.Seats != nil {
+		t.Errorf("claims %v, seats %v: this module holds no seat", m.Claims, m.Seats)
+	}
+}

modules/cups/go.mod

@@ -0,0 +1,5 @@
+module cups
+
+go 1.22
+
+require git.novox.be/novox/mesh-sdk/go v0.1.6

modules/cups/go.sum

@@ -0,0 +1,2 @@
+git.novox.be/novox/mesh-sdk/go v0.1.6 h1:9qzdYONYbJdWcu6sxQcq9v1LI0JxcfkiKYkMUzJSkVQ=
+git.novox.be/novox/mesh-sdk/go v0.1.6/go.mod h1:GFuZUElBZ9A++mxgIKo97aXXo+kV0uJ/UkbhQPPIbrY=

modules/cups/module.json

@@ -0,0 +1,58 @@
+{
+  "module": "cups",
+  "version": "1",
+  "capabilities": [
+    "package-manager",
+    "service-manager"
+  ],
+  "tools": [
+    "cups_printers",
+    "cups_queue",
+    "cups_cancel",
+    "cups_print",
+    "cups_default",
+    "cups_resume",
+    "cups_drivers"
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "cups"
+    },
+    {
+      "id": "driverless",
+      "type": "package",
+      "package": "cups-filters"
+    },
+    {
+      "id": "socket",
+      "type": "service",
+      "unit": "cups.socket",
+      "state": "running",
+      "boot": "enabled"
+    },
+    {
+      "id": "scheduler",
+      "type": "service",
+      "unit": "cups.service",
+      "state": "running",
+      "boot": "enabled"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/cups-tools",
+        "binary": "cups-tools",
+        "loads": [
+          "cups-tools"
+        ]
+      }
+    ]
+  }
+}

modules/dmenu/README.md

@@ -0,0 +1,56 @@
+# dmenu
+
+The suckless menu, as a module (novox/hq research 026/04: "`dmenu` is a module of its own (official
+repositories), able to hold the same seat on a machine that wants it"; to-be 42 phase 2 step 7).
+
+## Owns
+
+| what | where |
+|---|---|
+| `dmenu`, `dmenu_run`, `dmenu_path`, `stest` | package `dmenu` (official repositories) |
+
+## Improves: two broken calls work by existing
+
+Research 026/04 measured "plain `dmenu` in two places" in the operator's configuration, with dmenu
+installed on neither workstation, so both failed. Measured again on 2026-10-04, the two are one line on
+each workstation, in the notifier's configuration:
+
+- `~/.config/dunst/dunstrc`: `dmenu = /usr/bin/dmenu -p dunst:`
+
+It is the menu dunst opens to pick a notification's action or link. Every other menu in the
+operator's scripts calls `rofi -dmenu`. Once this module installs the package, `/usr/bin/dmenu` exists
+and that menu opens. The `dunst` module may later point the line at the launcher seat's command
+instead (below). The line is that module's to own, so this module does not touch it.
+
+## The seat it would hold: not claimed yet
+
+Research 026/04 gives `node-launcher` to `rofi`, with a dmenu-compatible command as part of its
+protocol, and lets `dmenu` hold the same seat on a machine that wants it. **The seat is not in the
+controller's seat table yet**, and a claim on an unknown seat is refused. So this module claims
+nothing. Its tool `dmenu_menu` is shaped like the seat's `menu` verb (research 026/05): show a list,
+answer the chosen line. When the seat is recorded, the claim is one line here, serving `menu`.
+
+## Tools
+
+All answer JSON. `(r)` reads; `(d)` acts in the operator's session.
+
+| tool | what |
+|---|---|
+| `dmenu_menu` (d) | show up to 1000 choices, with a prompt, as one line or a vertical list, case-insensitive by default. Answers the chosen line and its index; a typed line that is not a choice (`typed`); `cancelled` when dismissed; `timed_out` when not answered in time (default 20 s, at most 25, below the runtime's 30 s call limit) |
+| `dmenu_session` (r) | the session the menu would appear in and how it was found, or why there is none; dmenu's version |
+
+**Reaching the session** works as the `xclip` module's README describes: the runtime runs as the
+account with no session words, and `session.go` finds the account's display and cookie from its own
+processes. With no session, the tool says so and shows nothing. A keyboard held by another program
+(a locked screen, an open menu) is answered as such.
+
+The menu draws in fontconfig's `monospace` at dmenu's default size, which the `fonts` module makes
+JetBrains Mono Nerd Font.
+
+## What changes when it is assigned
+
+On both workstations, the `dmenu` package is installed, which neither has today. Nothing else.
+
+## Leaves as found
+
+The notifier's configuration, and every `rofi -dmenu` call in the operator's scripts.

modules/dmenu/cmd/dmenu-tools/dmenu.go

@@ -0,0 +1,112 @@
+package main
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// MostWait is the longest a menu stays open: below the runtime's 30 s call limit, so an unanswered
+// menu is answered as such rather than as a call the runtime gave up on.
+const MostWait = 25
+
+// MostChoices bounds the list.
+const MostChoices = 1000
+
+// Ask is one menu.
+type Ask struct {
+	Choices         []string
+	Prompt          string
+	Lines           int
+	CaseInsensitive bool
+	Timeout         int
+}
+
+// MenuAnswer is what dmenu_menu answers.
+type MenuAnswer struct {
+	Chosen    string  `json:"chosen,omitempty"`
+	Index     int     `json:"index"`
+	Typed     bool    `json:"typed"`
+	Cancelled bool    `json:"cancelled"`
+	TimedOut  bool    `json:"timed_out"`
+	Session   Session `json:"session"`
+}
+
+// Menu shows the choices and answers the one taken. dmenu prints the selected (or typed) line and
+// exits 0; it exits 1 with nothing printed when dismissed.
+func Menu(a Ask) (MenuAnswer, error) {
+	if len(a.Choices) == 0 {
+		return MenuAnswer{}, fmt.Errorf("choices is required: at least one line")
+	}
+	if len(a.Choices) > MostChoices {
+		return MenuAnswer{}, fmt.Errorf("%d choices; at most %d are shown", len(a.Choices), MostChoices)
+	}
+	for _, c := range a.Choices {
+		if strings.ContainsAny(c, "\n\r") {
+			return MenuAnswer{}, fmt.Errorf("a choice holds a line break: %q", c)
+		}
+	}
+	if strings.ContainsAny(a.Prompt, "\n\r") {
+		return MenuAnswer{}, fmt.Errorf("the prompt holds a line break")
+	}
+	s, err := findSession()
+	if err != nil {
+		return MenuAnswer{}, err
+	}
+	args := []string{}
+	if a.CaseInsensitive {
+		args = append(args, "-i")
+	}
+	if a.Lines > 0 {
+		args = append(args, "-l", strconv.Itoa(a.Lines))
+	}
+	if a.Prompt != "" {
+		args = append(args, "-p", a.Prompt)
+	}
+	c := Cmd{Name: "dmenu", Args: args, Stdin: strings.Join(a.Choices, "\n") + "\n", Env: s.Env(), Timeout: time.Duration(a.Timeout) * time.Second}
+	r := run(c)
+	out := MenuAnswer{Index: -1, Session: s}
+	switch {
+	case r.Error == "timeout":
+		out.TimedOut = true
+		return out, nil
+	case r.Error != "":
+		return MenuAnswer{}, failure(c, r)
+	case strings.Contains(r.Stderr, "cannot open display"):
+		return MenuAnswer{}, fmt.Errorf("the X session at %s (found by %s) refused the connection", s.Display, s.FoundBy)
+	case strings.Contains(r.Stderr, "cannot grab keyboard"):
+		return MenuAnswer{}, fmt.Errorf("dmenu could not take the keyboard: another program holds it (a locked screen, an open menu)")
+	case r.Status == 1 && strings.TrimSpace(r.Stdout) == "":
+		out.Cancelled = true
+		return out, nil
+	case r.Status != 0:
+		return MenuAnswer{}, failure(c, r)
+	}
+	out.Chosen = strings.TrimRight(r.Stdout, "\r\n")
+	for i, ch := range a.Choices {
+		if ch == out.Chosen {
+			out.Index = i
+			break
+		}
+	}
+	out.Typed = out.Index < 0
+	return out, nil
+}
+
+// SessionCheck answers the session the menu would appear in, and dmenu's version.
+func SessionCheck() (map[string]any, error) {
+	out := map[string]any{}
+	if r := run(Cmd{Name: "dmenu", Args: []string{"-v"}}); r.Error == "" {
+		out["dmenu"] = strings.TrimSpace(r.Stdout + r.Stderr)
+	} else {
+		out["dmenu"] = failure(Cmd{Name: "dmenu"}, r).Error()
+	}
+	s, err := findSession()
+	if err != nil {
+		out["found"], out["why"] = false, err.Error()
+		return out, nil
+	}
+	out["found"], out["session"] = true, s
+	return out, nil
+}

modules/dmenu/cmd/dmenu-tools/dmenu_test.go

@@ -0,0 +1,108 @@
+package main
+
+import (
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestTheManifestIsThePackageAndClaimsNoSeatYet(t *testing.T) {
+	m := readManifest(t)
+	// holdsTheBundle also holds it to no claim: node-launcher is not in the controller's seat table
+	// yet (README).
+	holdsTheBundle(t, m, "dmenu")
+	if got := strings.Join(m.packages(), ","); got != "dmenu" || len(m.Resources) != 1 {
+		t.Errorf("packages %s, resources %v", got, m.Resources)
+	}
+}
+
+func aSession(t *testing.T) {
+	t.Helper()
+	_, sockets := aMachine(t, map[string]string{"DISPLAY": ":1", "XAUTHORITY": "/home/op/.Xauthority"})
+	aSocket(t, sockets, "X1")
+}
+
+func TestMenuShowsTheChoicesInTheSessionAndAnswersTheOneTaken(t *testing.T) {
+	aSession(t)
+	f := using(t, func(string, Cmd) Result { return ok("Lock\n") })
+	got, err := Menu(Ask{Choices: []string{"Shutdown", "Lock"}, Prompt: "power:", Lines: 5, CaseInsensitive: true, Timeout: 20})
+	if err != nil || got.Chosen != "Lock" || got.Index != 1 || got.Typed || got.Cancelled || got.TimedOut {
+		t.Fatalf("%+v %v", got, err)
+	}
+	c := f.asked[0]
+	if f.lines()[0] != "dmenu -i -l 5 -p power:" || c.Stdin != "Shutdown\nLock\n" || c.Timeout != 20*time.Second {
+		t.Errorf("%v %+v", f.lines(), c)
+	}
+	if strings.Join(c.Env, " ") != "DISPLAY=:1 XAUTHORITY=/home/op/.Xauthority" {
+		t.Errorf("env %v", c.Env)
+	}
+}
+
+func TestMenuTellsTypedDismissedAndUnansweredApart(t *testing.T) {
+	aSession(t)
+	answer := ok("something else\n")
+	using(t, func(string, Cmd) Result { return answer })
+	got, err := Menu(Ask{Choices: []string{"a"}, Timeout: 5})
+	if err != nil || !got.Typed || got.Index != -1 || got.Chosen != "something else" {
+		t.Errorf("typed: %+v %v", got, err)
+	}
+	answer = Result{Status: 1}
+	got, err = Menu(Ask{Choices: []string{"a"}, Timeout: 5})
+	if err != nil || !got.Cancelled || got.Chosen != "" {
+		t.Errorf("dismissed: %+v %v", got, err)
+	}
+	answer = Result{Status: 124, Error: "timeout"}
+	got, err = Menu(Ask{Choices: []string{"a"}, Timeout: 5})
+	if err != nil || !got.TimedOut {
+		t.Errorf("unanswered: %+v %v", got, err)
+	}
+	answer = Result{Status: 1, Stderr: "cannot grab keyboard\n"}
+	if _, err := Menu(Ask{Choices: []string{"a"}, Timeout: 5}); err == nil || !strings.Contains(err.Error(), "keyboard") {
+		t.Errorf("a held keyboard: %v", err)
+	}
+	answer = Result{Status: 1, Stderr: "cannot open display\n"}
+	if _, err := Menu(Ask{Choices: []string{"a"}, Timeout: 5}); err == nil || !strings.Contains(err.Error(), "refused") {
+		t.Errorf("a refusing display: %v", err)
+	}
+}
+
+func TestMenuRefusesWhatCannotBeShownAndRunsNothingWithoutASession(t *testing.T) {
+	aSession(t)
+	f := using(t, func(string, Cmd) Result { return ok("") })
+	for _, bad := range []Ask{{}, {Choices: []string{"a\nb"}}, {Choices: []string{"a"}, Prompt: "x\ny"}, {Choices: make([]string, MostChoices+1)}} {
+		if _, err := Menu(bad); err == nil {
+			t.Errorf("%+v accepted", bad)
+		}
+	}
+	aMachine(t, map[string]string{})
+	if _, err := Menu(Ask{Choices: []string{"a"}, Timeout: 5}); err == nil || !strings.Contains(err.Error(), "no graphical session") {
+		t.Errorf("%v", err)
+	}
+	if len(f.asked) != 0 {
+		t.Errorf("ran %v", f.lines())
+	}
+}
+
+func TestTheWaitIsBelowTheRuntimesCallLimit(t *testing.T) {
+	if MostWait >= 30 {
+		t.Fatalf("a menu may stay open %d s; the runtime gives a call 30", MostWait)
+	}
+	n, _ := optWhole(map[string]any{"timeout_seconds": float64(600)}, "timeout_seconds", 20, 1, MostWait)
+	if n != MostWait {
+		t.Errorf("%d", n)
+	}
+}
+
+func TestSessionCheckSaysTheVersionAndTheSession(t *testing.T) {
+	aSession(t)
+	using(t, func(string, Cmd) Result { return ok("dmenu-5.4\n") })
+	got, err := SessionCheck()
+	if err != nil || got["dmenu"] != "dmenu-5.4" || got["found"] != true {
+		t.Fatalf("%v %v", got, err)
+	}
+	using(t, func(string, Cmd) Result { return Result{Status: 127, Error: "not-found"} })
+	got, _ = SessionCheck()
+	if !strings.Contains(got["dmenu"].(string), "not installed") {
+		t.Errorf("%v", got)
+	}
+}

modules/dmenu/cmd/dmenu-tools/kit.go

@@ -0,0 +1,352 @@
+package main
+
+// kit.go is the same file in each of the workstations' tool bundles (fonts, docker-compose, snapd,
+// flatpak, cups, bluetooth, xclip, dmenu): how a tool runs a command, escalates, bounds what it
+// keeps, and names a failure. A module is built from its own directory, so the file is copied rather
+// than shared; a change to one copy is made to all eight.
+//
+// The rules it holds (novox/hq research 026/05, to-be 38 WP4):
+//   - the node's tool runtime runs as the operator account, not root (ADR 0175 §4); a command that
+//     needs root goes through `sudo -n`, never a prompt, and a refusal is named as such;
+//   - one command gets 20 s, below the runtime's 30 s call limit, and is ended with everything it
+//     started when it takes longer;
+//   - each stream is kept to 256 KiB, and the answer says when it was cut;
+//   - a failure is an error with what went wrong in it, never an empty answer.
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"strings"
+	"syscall"
+	"time"
+)
+
+// Bounds every command is held to.
+const (
+	CallTimeout = 20 * time.Second
+	MostOutput  = 256 << 10
+)
+
+// Cmd is one command a tool runs.
+type Cmd struct {
+	Name string
+	Args []string
+	// Stdin is written to the command's standard input when not empty.
+	Stdin string
+	// Env is added to this process's own environment.
+	Env []string
+	// Root says the command needs root: it is run through `sudo -n` when this process is not root.
+	Root bool
+	// Timeout replaces CallTimeout; only a background job (jobs.go) asks for longer.
+	Timeout time.Duration
+	// Detached is for a program that forks a child which outlives it, as xclip does to keep the
+	// selection: its streams go to files, because a pipe the child inherits would hold the call open
+	// until the child exits.
+	Detached bool
+}
+
+// Result is what a command did.
+type Result struct {
+	Stdout string `json:"stdout"`
+	Stderr string `json:"stderr"`
+	Status int    `json:"status"`
+	// Error is why it did not run to an answer: "not-found" when the program is not there,
+	// "timeout" when it was ended for taking too long, else the spawn error.
+	Error     string `json:"error,omitempty"`
+	Truncated bool   `json:"truncated,omitempty"`
+}
+
+// Runner runs a command. Tests replace it; nothing else does.
+type Runner func(Cmd) Result
+
+var (
+	run  Runner = execRun
+	euid        = os.Geteuid
+)
+
+// argv is the command as it is run: through sudo without a prompt when it needs root and this
+// process is not root.
+func argv(c Cmd) (string, []string) {
+	if c.Root && euid() != 0 {
+		return "sudo", append([]string{"-n", c.Name}, c.Args...)
+	}
+	return c.Name, c.Args
+}
+
+// bounded keeps the first MostOutput bytes written to it and notes that more came.
+type bounded struct {
+	b   bytes.Buffer
+	cut bool
+}
+
+func (w *bounded) Write(p []byte) (int, error) {
+	room := MostOutput - w.b.Len()
+	if room <= 0 {
+		w.cut = w.cut || len(p) > 0
+		return len(p), nil
+	}
+	if len(p) > room {
+		w.b.Write(p[:room])
+		w.cut = true
+		return len(p), nil
+	}
+	return w.b.Write(p)
+}
+
+func execRun(c Cmd) Result {
+	timeout := c.Timeout
+	if timeout <= 0 {
+		timeout = CallTimeout
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+	name, args := argv(c)
+	cmd := exec.CommandContext(ctx, name, args...)
+	cmd.Env = append(append(os.Environ(), "LC_ALL=C"), c.Env...)
+	if !c.Detached {
+		// Its own process group, so that ending it on a timeout ends what it started too.
+		cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
+		cmd.Cancel = func() error {
+			if cmd.Process != nil {
+				_ = syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL)
+			}
+			return nil
+		}
+	}
+	cmd.WaitDelay = 2 * time.Second
+	if c.Stdin != "" {
+		cmd.Stdin = strings.NewReader(c.Stdin)
+	}
+	var out, errs bounded
+	var outFile, errFile *os.File
+	if c.Detached {
+		var err error
+		if outFile, err = os.CreateTemp("", "mesh-tool-out-*"); err != nil {
+			return Result{Status: 127, Error: err.Error()}
+		}
+		defer os.Remove(outFile.Name())
+		defer outFile.Close()
+		if errFile, err = os.CreateTemp("", "mesh-tool-err-*"); err != nil {
+			return Result{Status: 127, Error: err.Error()}
+		}
+		defer os.Remove(errFile.Name())
+		defer errFile.Close()
+		cmd.Stdout, cmd.Stderr = outFile, errFile
+	} else {
+		cmd.Stdout, cmd.Stderr = &out, &errs
+	}
+	err := cmd.Run()
+	if c.Detached {
+		for _, f := range []struct {
+			file *os.File
+			into *bounded
+		}{{outFile, &out}, {errFile, &errs}} {
+			if _, e := f.file.Seek(0, io.SeekStart); e == nil {
+				_, _ = io.Copy(f.into, f.file)
+			}
+		}
+	}
+	r := Result{Stdout: out.b.String(), Stderr: errs.b.String(), Truncated: out.cut || errs.cut}
+	var exit *exec.ExitError
+	switch {
+	case err == nil:
+	case ctx.Err() == context.DeadlineExceeded:
+		r.Status, r.Error = 124, "timeout"
+	case errors.Is(err, exec.ErrNotFound) || errors.Is(err, os.ErrNotExist):
+		r.Status, r.Error = 127, "not-found"
+	case errors.As(err, &exit):
+		r.Status = exit.ExitCode()
+	default:
+		r.Status, r.Error = 127, err.Error()
+	}
+	return r
+}
+
+// call runs a command and answers its result, or an error naming what went wrong.
+func call(c Cmd) (Result, error) {
+	r := run(c)
+	if r.Status == 0 && r.Error == "" {
+		return r, nil
+	}
+	return r, failure(c, r)
+}
+
+// failure names how a command failed: not installed, refused escalation, too slow, or its exit
+// status with the end of what it said.
+func failure(c Cmd, r Result) error {
+	program, _ := argv(c)
+	switch {
+	case r.Error == "not-found" && program == "sudo":
+		return fmt.Errorf("%s needs root, and sudo is not installed here for the runtime's account to escalate with", c.Name)
+	case r.Error == "not-found":
+		if hint, ok := providedBy[c.Name]; ok {
+			return fmt.Errorf("%s is not installed on this machine (%s)", c.Name, hint)
+		}
+		return fmt.Errorf("%s is not installed on this machine", c.Name)
+	case r.Error == "timeout":
+		limit := c.Timeout
+		if limit <= 0 {
+			limit = CallTimeout
+		}
+		return fmt.Errorf("%s gave no answer within %s and was ended", c.Name, limit)
+	case r.Error != "":
+		return fmt.Errorf("%s did not run: %s", c.Name, r.Error)
+	case program == "sudo" && strings.Contains(r.Stderr, "command not found"):
+		if hint, ok := providedBy[c.Name]; ok {
+			return fmt.Errorf("%s is not installed on this machine (%s)", c.Name, hint)
+		}
+		return fmt.Errorf("%s is not installed on this machine", c.Name)
+	case program == "sudo" && strings.HasPrefix(strings.TrimSpace(r.Stderr), "sudo:"):
+		return fmt.Errorf("%s needs root, and sudo -n refused the runtime's account: %s (the escalation is the sudo module's to declare)",
+			c.Name, firstLine(r.Stderr))
+	}
+	said := tail(strings.TrimSpace(r.Stderr), 2000)
+	if said == "" {
+		said = tail(strings.TrimSpace(r.Stdout), 2000)
+	}
+	if said == "" {
+		said = "and said nothing"
+	}
+	return fmt.Errorf("%s %s exited %d: %s", c.Name, strings.Join(c.Args, " "), r.Status, said)
+}
+
+func firstLine(s string) string {
+	s = strings.TrimSpace(s)
+	if i := strings.IndexByte(s, '\n'); i >= 0 {
+		return s[:i]
+	}
+	return s
+}
+
+func tail(s string, n int) string {
+	if len(s) <= n {
+		return s
+	}
+	return "…" + s[len(s)-n:]
+}
+
+// lines are a command's output lines, blank ones dropped.
+func lines(s string) []string {
+	out := []string{}
+	for _, l := range strings.Split(s, "\n") {
+		if strings.TrimSpace(l) != "" {
+			out = append(out, strings.TrimRight(l, "\r"))
+		}
+	}
+	return out
+}
+
+// Arguments, read the way a tool's JSON arguments arrive.
+
+func text(args map[string]any, key string) (string, error) {
+	v, ok := args[key]
+	if !ok || v == nil {
+		return "", fmt.Errorf("%s is required", key)
+	}
+	s, ok := v.(string)
+	if !ok {
+		return "", fmt.Errorf("%s must be a string", key)
+	}
+	if strings.TrimSpace(s) == "" {
+		return "", fmt.Errorf("%s must not be empty", key)
+	}
+	return s, nil
+}
+
+func optText(args map[string]any, key, def string) (string, error) {
+	v, ok := args[key]
+	if !ok || v == nil {
+		return def, nil
+	}
+	s, ok := v.(string)
+	if !ok {
+		return "", fmt.Errorf("%s must be a string", key)
+	}
+	if strings.TrimSpace(s) == "" {
+		return def, nil
+	}
+	return s, nil
+}
+
+// optWhole reads a whole number, defaulted, refused below least and held to most.
+func optWhole(args map[string]any, key string, def, least, most int) (int, error) {
+	v, ok := args[key]
+	if !ok || v == nil {
+		return def, nil
+	}
+	f, ok := v.(float64)
+	if !ok {
+		if i, isInt := v.(int); isInt {
+			f = float64(i)
+		} else {
+			return 0, fmt.Errorf("%s must be a number", key)
+		}
+	}
+	if f != float64(int(f)) {
+		return 0, fmt.Errorf("%s must be a whole number", key)
+	}
+	n := int(f)
+	if n < least {
+		return 0, fmt.Errorf("%s must be at least %d", key, least)
+	}
+	if n > most {
+		n = most
+	}
+	return n, nil
+}
+
+func optFlag(args map[string]any, key string, def bool) (bool, error) {
+	v, ok := args[key]
+	if !ok || v == nil {
+		return def, nil
+	}
+	b, ok := v.(bool)
+	if !ok {
+		return false, fmt.Errorf("%s must be true or false", key)
+	}
+	return b, nil
+}
+
+func optList(args map[string]any, key string) ([]string, error) {
+	v, ok := args[key]
+	if !ok || v == nil {
+		return nil, nil
+	}
+	items, ok := v.([]any)
+	if !ok {
+		return nil, fmt.Errorf("%s must be a list of strings", key)
+	}
+	out := make([]string, 0, len(items))
+	for _, it := range items {
+		s, ok := it.(string)
+		if !ok || strings.TrimSpace(s) == "" {
+			return nil, fmt.Errorf("%s must be a list of non-empty strings", key)
+		}
+		out = append(out, s)
+	}
+	return out, nil
+}
+
+// oneOf refuses a value outside a closed set.
+func oneOf(key, value string, allowed ...string) error {
+	for _, a := range allowed {
+		if value == a {
+			return nil
+		}
+	}
+	return fmt.Errorf("%s must be one of %s, not %q", key, strings.Join(allowed, ", "), value)
+}
+
+// plainName refuses a name that could be read as an option or carries a path or a space: package,
+// snap, application and printer names never do.
+func plainName(key, value string) error {
+	if strings.HasPrefix(value, "-") || strings.ContainsAny(value, " \t\n/\\") {
+		return fmt.Errorf("%s %q is not a plain name", key, value)
+	}
+	return nil
+}

modules/dmenu/cmd/dmenu-tools/kit_test.go

@@ -0,0 +1,147 @@
+package main
+
+// Tests of kit.go, the same in each workstation module.
+
+import (
+	"strings"
+	"testing"
+	"time"
+)
+
+// fake records the commands asked and answers each from a function of the command line.
+type fake struct {
+	asked  []Cmd
+	answer func(line string, c Cmd) Result
+}
+
+func (f *fake) runner() Runner {
+	return func(c Cmd) Result {
+		f.asked = append(f.asked, c)
+		name, args := argv(c)
+		line := strings.TrimSpace(name + " " + strings.Join(args, " "))
+		if f.answer == nil {
+			return Result{}
+		}
+		return f.answer(line, c)
+	}
+}
+
+func (f *fake) lines() []string {
+	out := []string{}
+	for _, c := range f.asked {
+		name, args := argv(c)
+		out = append(out, strings.TrimSpace(name+" "+strings.Join(args, " ")))
+	}
+	return out
+}
+
+// using installs a fake runner and a non-root uid for one test.
+func using(t *testing.T, answer func(line string, c Cmd) Result) *fake {
+	t.Helper()
+	f := &fake{answer: answer}
+	wasRun, wasUID := run, euid
+	run, euid = f.runner(), func() int { return 1000 }
+	t.Cleanup(func() { run, euid = wasRun, wasUID })
+	return f
+}
+
+func ok(stdout string) Result { return Result{Stdout: stdout} }
+
+func TestKitAnActThatNeedsRootGoesThroughSudoWithoutAPromptUnlessAlreadyRoot(t *testing.T) {
+	was := euid
+	defer func() { euid = was }()
+	euid = func() int { return 1000 }
+	if name, args := argv(Cmd{Name: "x", Args: []string{"a"}, Root: true}); name != "sudo" || strings.Join(args, " ") != "-n x a" {
+		t.Fatalf("not root: %s %v", name, args)
+	}
+	if name, _ := argv(Cmd{Name: "x"}); name != "x" {
+		t.Fatalf("a read is run as the account: %s", name)
+	}
+	euid = func() int { return 0 }
+	if name, _ := argv(Cmd{Name: "x", Root: true}); name != "x" {
+		t.Fatalf("as root no sudo: %s", name)
+	}
+}
+
+func TestKitAFailureIsNamedByHowItFailed(t *testing.T) {
+	was := euid
+	defer func() { euid = was }()
+	euid = func() int { return 1000 }
+	cases := []struct {
+		c    Cmd
+		r    Result
+		want string
+	}{
+		{Cmd{Name: "nothere"}, Result{Status: 127, Error: "not-found"}, "not installed"},
+		{Cmd{Name: "x", Root: true}, Result{Status: 127, Error: "not-found"}, "sudo is not installed"},
+		{Cmd{Name: "x", Root: true}, Result{Status: 1, Stderr: "sudo: a password is required\n"}, "sudo -n refused"},
+		{Cmd{Name: "x", Root: true}, Result{Status: 1, Stderr: "sudo: x: command not found\n"}, "x is not installed"},
+		{Cmd{Name: "x"}, Result{Status: 124, Error: "timeout"}, "within 20s"},
+		{Cmd{Name: "x", Args: []string{"y"}}, Result{Status: 3, Stderr: "boom\n"}, "x y exited 3: boom"},
+		{Cmd{Name: "x"}, Result{Status: 3}, "said nothing"},
+	}
+	for _, k := range cases {
+		err := failure(k.c, k.r)
+		if err == nil || !strings.Contains(err.Error(), k.want) {
+			t.Errorf("%+v: %v, want %q", k.r, err, k.want)
+		}
+	}
+}
+
+func TestKitOutputIsBoundedAndSaysSo(t *testing.T) {
+	var w bounded
+	big := strings.Repeat("a", MostOutput+10)
+	n, _ := w.Write([]byte(big))
+	if n != len(big) || w.b.Len() != MostOutput || !w.cut {
+		t.Fatalf("kept %d of %d, cut %v", w.b.Len(), len(big), w.cut)
+	}
+}
+
+func TestKitTheRealRunnerRunsEndsAndReportsAMissingProgram(t *testing.T) {
+	r := execRun(Cmd{Name: "sh", Args: []string{"-c", "echo out; echo err >&2; exit 3"}})
+	if r.Status != 3 || strings.TrimSpace(r.Stdout) != "out" || strings.TrimSpace(r.Stderr) != "err" {
+		t.Fatalf("%+v", r)
+	}
+	r = execRun(Cmd{Name: "sh", Args: []string{"-c", "sleep 5 & sleep 5"}, Timeout: 200 * time.Millisecond})
+	if r.Error != "timeout" {
+		t.Fatalf("a slow command: %+v", r)
+	}
+	r = execRun(Cmd{Name: "no-such-program-anywhere"})
+	if r.Error != "not-found" {
+		t.Fatalf("a missing program: %+v", r)
+	}
+	r = execRun(Cmd{Name: "cat", Stdin: "given"})
+	if r.Stdout != "given" {
+		t.Fatalf("stdin: %+v", r)
+	}
+	start := time.Now()
+	r = execRun(Cmd{Name: "sh", Args: []string{"-c", "echo kept; (sleep 3 &) ; exit 0"}, Detached: true})
+	if r.Status != 0 || strings.TrimSpace(r.Stdout) != "kept" || time.Since(start) > 2*time.Second {
+		t.Fatalf("a detached command returns when it exits, not when its child does: %+v after %s", r, time.Since(start))
+	}
+}
+
+func TestKitArgumentsAreReadStrictly(t *testing.T) {
+	args := map[string]any{"s": "x", "n": float64(5), "f": 1.5, "b": true, "l": []any{"a", "b"}}
+	if _, err := text(args, "missing"); err == nil {
+		t.Error("a missing required string")
+	}
+	if n, _ := optWhole(args, "n", 1, 1, 3); n != 3 {
+		t.Errorf("held to most: %d", n)
+	}
+	if _, err := optWhole(args, "n", 1, 6, 9); err == nil {
+		t.Error("below least")
+	}
+	if _, err := optWhole(args, "f", 1, 0, 9); err == nil {
+		t.Error("a fraction")
+	}
+	if l, _ := optList(args, "l"); len(l) != 2 {
+		t.Errorf("list: %v", l)
+	}
+	if b, _ := optFlag(args, "b", false); !b {
+		t.Error("flag")
+	}
+	if err := plainName("name", "--all"); err == nil {
+		t.Error("an option as a name")
+	}
+}

modules/dmenu/cmd/dmenu-tools/main.go

@@ -0,0 +1,70 @@
+// The dmenu module's tool (novox/hq research 026/04, 026/05): show the operator a menu of choices in
+// the graphical session and answer the one chosen — the dmenu-compatible command as a tool. A Go
+// bundle the node's runtime launches over stdio (ADR 0188, ADR 0193). It runs as the operator account
+// and reaches the account's X session as session.go finds it; with no session, it says so.
+package main
+
+import (
+	"fmt"
+	"os"
+
+	stdio "git.novox.be/novox/mesh-sdk/go"
+)
+
+var providedBy = map[string]string{
+	"dmenu": "the dmenu package, which this module installs",
+}
+
+func main() {
+	if err := stdio.Serve("", tools()); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+}
+
+func tools() []stdio.Tool {
+	return []stdio.Tool{
+		{
+			Name: "dmenu_menu",
+			Description: "Show the operator a menu of choices on their screen and answer the line chosen, its index, or " +
+				"that the menu was dismissed or not answered in time (default 20 s, at most 25). The operator may also " +
+				"type a line that is not a choice. Needs the operator's graphical session. (d)",
+			Input: map[string]any{
+				"choices":          map[string]any{"type": "array", "items": map[string]any{"type": "string"}, "description": "the lines to choose from, at most 1000, none with a line break"},
+				"prompt":           map[string]any{"type": "string", "description": "a prompt shown left of the input"},
+				"lines":            map[string]any{"type": "integer", "description": "show the choices as a vertical list of this many lines (default 0: one horizontal line; at most 40)"},
+				"case_insensitive": map[string]any{"type": "boolean", "description": "match what is typed regardless of case (default true)"},
+				"timeout_seconds":  map[string]any{"type": "integer", "description": "close the menu unanswered after this long (default 20, at most 25)"},
+			},
+			Run: func(args map[string]any) (any, error) {
+				choices, err := optList(args, "choices")
+				if err != nil {
+					return nil, err
+				}
+				prompt, err := optText(args, "prompt", "")
+				if err != nil {
+					return nil, err
+				}
+				n, err := optWhole(args, "lines", 0, 0, 40)
+				if err != nil {
+					return nil, err
+				}
+				ci, err := optFlag(args, "case_insensitive", true)
+				if err != nil {
+					return nil, err
+				}
+				timeout, err := optWhole(args, "timeout_seconds", 20, 1, MostWait)
+				if err != nil {
+					return nil, err
+				}
+				return Menu(Ask{Choices: choices, Prompt: prompt, Lines: n, CaseInsensitive: ci, Timeout: timeout})
+			},
+		},
+		{
+			Name:        "dmenu_session",
+			Description: "Which X session the menu would appear in and how it was found, or why there is none; and dmenu's version. (r)",
+			Input:       map[string]any{},
+			Run:         func(map[string]any) (any, error) { return SessionCheck() },
+		},
+	}
+}

modules/dmenu/cmd/dmenu-tools/manifest_kit_test.go

@@ -0,0 +1,107 @@
+package main
+
+// manifest_kit_test.go is the same file in each workstation module: it reads the module's
+// definition so the module's own tests can hold it to what it says.
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+	"testing"
+)
+
+type manifest struct {
+	Module       string           `json:"module"`
+	Capabilities []string         `json:"capabilities"`
+	Claims       []any            `json:"claims"`
+	Seats        []any            `json:"seats"`
+	Tools        []string         `json:"tools"`
+	Resources    []map[string]any `json:"resources"`
+	Build        struct {
+		Artifacts []map[string]any `json:"artifacts"`
+	} `json:"build"`
+}
+
+func readManifest(t *testing.T) manifest {
+	t.Helper()
+	raw, err := os.ReadFile(filepath.Join("..", "..", "module.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var m manifest
+	if err := json.Unmarshal(raw, &m); err != nil {
+		t.Fatalf("module.json: %v", err)
+	}
+	return m
+}
+
+func (m manifest) resource(id string) map[string]any {
+	for _, r := range m.Resources {
+		if r["id"] == id {
+			return r
+		}
+	}
+	return nil
+}
+
+// packages are the packages the module installs, sorted.
+func (m manifest) packages() []string {
+	out := []string{}
+	for _, r := range m.Resources {
+		if r["type"] == "package" && r["absent"] != true {
+			out = append(out, r["package"].(string))
+		}
+	}
+	sort.Strings(out)
+	return out
+}
+
+// services are the units the module declares, by unit name.
+func (m manifest) services() map[string]map[string]any {
+	out := map[string]map[string]any{}
+	for _, r := range m.Resources {
+		if r["type"] == "service" {
+			out[r["unit"].(string)] = r
+		}
+	}
+	return out
+}
+
+// holdsTheBundle holds the manifest to the Go bundle this directory builds: every tool registered
+// is listed and nothing else, each named <prefix>_…, and the artifact builds this command.
+func holdsTheBundle(t *testing.T, m manifest, prefix string) {
+	t.Helper()
+	registered := []string{}
+	for _, tool := range tools() {
+		registered = append(registered, tool.Name)
+		if !strings.HasPrefix(tool.Name, prefix+"_") {
+			t.Errorf("tool %s is not named %s_…", tool.Name, prefix)
+		}
+		if tool.Description == "" || tool.Run == nil || tool.Input == nil {
+			t.Errorf("tool %s is not described, runnable and given an input schema", tool.Name)
+		}
+	}
+	if strings.Join(registered, ",") != strings.Join(m.Tools, ",") {
+		t.Errorf("registered %v, listed %v", registered, m.Tools)
+	}
+	if len(m.Build.Artifacts) != 1 {
+		t.Fatalf("one artifact, got %d", len(m.Build.Artifacts))
+	}
+	cwd, _ := os.Getwd()
+	binary := filepath.Base(cwd)
+	a := m.Build.Artifacts[0]
+	want := map[string]any{"kind": "bundle", "language": "go", "system": "arch", "from": "cmd/" + binary, "binary": binary}
+	for k, v := range want {
+		if a[k] != v {
+			t.Errorf("artifact %s = %v, want %v", k, a[k], v)
+		}
+	}
+	if loads, _ := a["loads"].([]any); len(loads) != 1 || loads[0] != binary {
+		t.Errorf("artifact loads %v, want [%s]", a["loads"], binary)
+	}
+	if m.Claims != nil || m.Seats != nil {
+		t.Errorf("claims %v, seats %v: this module holds no seat", m.Claims, m.Seats)
+	}
+}

modules/dmenu/cmd/dmenu-tools/session.go

@@ -0,0 +1,177 @@
+package main
+
+// session.go is the same file in the bundles whose tools act in the operator's graphical session
+// (xclip, dmenu): how a process the node's tool runtime launched reaches that session.
+//
+// The runtime is a system service running as the operator account (novox/hq ADR 0175 §4), in the
+// machine's own mount namespace, and is given no session words: no DISPLAY, no XAUTHORITY. An X
+// server accepts a client that names its display and presents the cookie in the authority file, and
+// both are the account's: the display's socket is in /tmp/.X11-unix, and the cookie file is
+// readable by the account. So the session is found, not configured:
+//
+//  1. the process's own DISPLAY, when the runtime happens to have one;
+//  2. else the DISPLAY and XAUTHORITY of the account's own running processes, read from
+//     /proc/<pid>/environ (the window manager's, by preference), whose socket exists;
+//  3. else the only X socket there is, with the authority file in the account's home.
+//
+// When none is found the tool says that no graphical session of the account is running, and does
+// nothing.
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+	"strconv"
+	"strings"
+	"syscall"
+)
+
+// Session is the operator's X session as a tool reaches it.
+type Session struct {
+	Display    string `json:"display"`
+	XAuthority string `json:"xauthority,omitempty"`
+	// FoundBy says how: "environment", "process <pid> (<name>)" or "socket".
+	FoundBy string `json:"found_by"`
+}
+
+// Env is what a command needs to reach the session.
+func (s Session) Env() []string {
+	env := []string{"DISPLAY=" + s.Display}
+	if s.XAuthority != "" {
+		env = append(env, "XAUTHORITY="+s.XAuthority)
+	}
+	return env
+}
+
+// Where the session is looked for. Tests point these at a tree of their own.
+var (
+	procRoot   = "/proc"
+	x11Sockets = "/tmp/.X11-unix"
+	getenv     = os.Getenv
+	myUID      = os.Getuid
+)
+
+// sessionWMs are the programs whose environment is the session's own, preferred over any other
+// process's (a terminal's child may carry a stale or forwarded DISPLAY).
+var sessionWMs = map[string]bool{"i3": true, "sway": true, "xinit": true, "i3bar": true, "picom": true, "dunst": true}
+
+func accountHome() string {
+	if h := strings.TrimSpace(getenv("MESH_OPERATOR_HOME")); h != "" {
+		return h
+	}
+	if h := strings.TrimSpace(getenv("HOME")); h != "" {
+		return h
+	}
+	h, _ := os.UserHomeDir()
+	return h
+}
+
+// socketOf is the local socket of a display such as ":1" or ":1.0", or "" for a remote one.
+func socketOf(display string) string {
+	if !strings.HasPrefix(display, ":") {
+		return ""
+	}
+	n := strings.TrimPrefix(display, ":")
+	if i := strings.IndexByte(n, '.'); i >= 0 {
+		n = n[:i]
+	}
+	if _, err := strconv.Atoi(n); err != nil {
+		return ""
+	}
+	return filepath.Join(x11Sockets, "X"+n)
+}
+
+func exists(p string) bool {
+	_, err := os.Stat(p)
+	return err == nil
+}
+
+// findSession answers the account's X session, or an error saying there is none.
+func findSession() (Session, error) {
+	if d := strings.TrimSpace(getenv("DISPLAY")); d != "" {
+		if s := socketOf(d); s == "" || exists(s) {
+			return Session{Display: d, XAuthority: getenv("XAUTHORITY"), FoundBy: "environment"}, nil
+		}
+	}
+	type seen struct {
+		Session
+		wm    bool
+		count int
+	}
+	found := map[string]*seen{}
+	entries, _ := os.ReadDir(procRoot)
+	for _, e := range entries {
+		pid, err := strconv.Atoi(e.Name())
+		if err != nil || !e.IsDir() {
+			continue
+		}
+		dir := filepath.Join(procRoot, e.Name())
+		info, err := os.Stat(dir)
+		if err != nil {
+			continue
+		}
+		if st, ok := info.Sys().(*syscall.Stat_t); !ok || int(st.Uid) != myUID() {
+			continue
+		}
+		raw, err := os.ReadFile(filepath.Join(dir, "environ"))
+		if err != nil {
+			continue
+		}
+		var display, auth string
+		for _, kv := range strings.Split(string(raw), "\x00") {
+			switch {
+			case strings.HasPrefix(kv, "DISPLAY="):
+				display = strings.TrimPrefix(kv, "DISPLAY=")
+			case strings.HasPrefix(kv, "XAUTHORITY="):
+				auth = strings.TrimPrefix(kv, "XAUTHORITY=")
+			}
+		}
+		if display == "" {
+			continue
+		}
+		if s := socketOf(display); s == "" || !exists(s) {
+			continue
+		}
+		comm, _ := os.ReadFile(filepath.Join(dir, "comm"))
+		name := strings.TrimSpace(string(comm))
+		key := display + "\x00" + auth
+		if found[key] == nil {
+			found[key] = &seen{Session: Session{Display: display, XAuthority: auth, FoundBy: fmt.Sprintf("process %d (%s)", pid, name)}}
+		}
+		f := found[key]
+		f.count++
+		if sessionWMs[name] && !f.wm {
+			f.wm = true
+			f.FoundBy = fmt.Sprintf("process %d (%s)", pid, name)
+		}
+	}
+	if len(found) > 0 {
+		all := make([]*seen, 0, len(found))
+		for _, f := range found {
+			all = append(all, f)
+		}
+		sort.Slice(all, func(i, k int) bool {
+			if all[i].wm != all[k].wm {
+				return all[i].wm
+			}
+			if all[i].count != all[k].count {
+				return all[i].count > all[k].count
+			}
+			return all[i].Display < all[k].Display
+		})
+		return all[0].Session, nil
+	}
+	sockets, _ := filepath.Glob(filepath.Join(x11Sockets, "X*"))
+	if len(sockets) == 1 {
+		s := Session{Display: ":" + strings.TrimPrefix(filepath.Base(sockets[0]), "X"), FoundBy: "socket"}
+		if a := filepath.Join(accountHome(), ".Xauthority"); exists(a) {
+			s.XAuthority = a
+		}
+		return s, nil
+	}
+	if len(sockets) > 1 {
+		return Session{}, fmt.Errorf("no process of this account names its X display, and there are %d X sockets in %s: which one is the operator's session cannot be told", len(sockets), x11Sockets)
+	}
+	return Session{}, fmt.Errorf("no graphical session of this account is running on this machine: no process of the account has DISPLAY set, and there is no X socket in %s. A desktop tool acts only while the operator is logged in to the graphical session", x11Sockets)
+}

modules/dmenu/cmd/dmenu-tools/session_test.go

@@ -0,0 +1,94 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"testing"
+)
+
+// aMachine gives findSession a /proc and an X socket directory of the test's own.
+func aMachine(t *testing.T, env map[string]string) (proc, sockets string) {
+	t.Helper()
+	root := t.TempDir()
+	proc, sockets = filepath.Join(root, "proc"), filepath.Join(root, "x11")
+	for _, d := range []string{proc, sockets} {
+		if err := os.MkdirAll(d, 0o755); err != nil {
+			t.Fatal(err)
+		}
+	}
+	wasProc, wasX, wasEnv := procRoot, x11Sockets, getenv
+	procRoot, x11Sockets = proc, sockets
+	getenv = func(k string) string { return env[k] }
+	t.Cleanup(func() { procRoot, x11Sockets, getenv = wasProc, wasX, wasEnv })
+	return proc, sockets
+}
+
+func aProcess(t *testing.T, proc string, pid int, comm string, env ...string) {
+	t.Helper()
+	dir := filepath.Join(proc, strconv.Itoa(pid))
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	_ = os.WriteFile(filepath.Join(dir, "comm"), []byte(comm+"\n"), 0o644)
+	_ = os.WriteFile(filepath.Join(dir, "environ"), []byte(strings.Join(env, "\x00")+"\x00"), 0o644)
+}
+
+func aSocket(t *testing.T, dir, name string) {
+	t.Helper()
+	if err := os.WriteFile(filepath.Join(dir, name), nil, 0o644); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestSessionTheWindowManagersDisplayAndCookieAreTheSessions(t *testing.T) {
+	proc, sockets := aMachine(t, map[string]string{"MESH_OPERATOR_HOME": "/home/op"})
+	aSocket(t, sockets, "X1")
+	aProcess(t, proc, 3, "bash", "DISPLAY=:9", "XAUTHORITY=/stale")
+	aProcess(t, proc, 4, "kitty", "DISPLAY=:1", "XAUTHORITY=/home/op/.Xauthority")
+	aProcess(t, proc, 5, "i3", "DISPLAY=:1.0", "XAUTHORITY=/home/op/.Xauthority")
+	aProcess(t, proc, 6, "sshd", "PATH=/bin")
+	s, err := findSession()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if s.Display != ":1.0" || s.XAuthority != "/home/op/.Xauthority" || !strings.Contains(s.FoundBy, "i3") {
+		t.Fatalf("%+v: a display without a socket (:9) is skipped, and the window manager's is preferred", s)
+	}
+	if got := strings.Join(s.Env(), " "); got != "DISPLAY=:1.0 XAUTHORITY=/home/op/.Xauthority" {
+		t.Fatalf("env %s", got)
+	}
+}
+
+func TestSessionTheOnlySocketWithTheHomesCookieIsTheFallback(t *testing.T) {
+	home := t.TempDir()
+	_ = os.WriteFile(filepath.Join(home, ".Xauthority"), []byte("c"), 0o600)
+	_, sockets := aMachine(t, map[string]string{"MESH_OPERATOR_HOME": home})
+	aSocket(t, sockets, "X0")
+	s, err := findSession()
+	if err != nil || s.Display != ":0" || s.XAuthority != filepath.Join(home, ".Xauthority") || s.FoundBy != "socket" {
+		t.Fatalf("%+v %v", s, err)
+	}
+}
+
+func TestSessionNoSessionIsSaidNotGuessed(t *testing.T) {
+	_, sockets := aMachine(t, map[string]string{})
+	if _, err := findSession(); err == nil || !strings.Contains(err.Error(), "no graphical session") {
+		t.Fatalf("none: %v", err)
+	}
+	aSocket(t, sockets, "X0")
+	aSocket(t, sockets, "X1")
+	if _, err := findSession(); err == nil || !strings.Contains(err.Error(), "2 X sockets") {
+		t.Fatalf("two: %v", err)
+	}
+}
+
+func TestSessionTheProcessesOwnDisplayComesFirst(t *testing.T) {
+	_, sockets := aMachine(t, map[string]string{"DISPLAY": ":2", "XAUTHORITY": "/a"})
+	aSocket(t, sockets, "X2")
+	s, err := findSession()
+	if err != nil || s.Display != ":2" || s.FoundBy != "environment" {
+		t.Fatalf("%+v %v", s, err)
+	}
+}

modules/dmenu/go.mod

@@ -0,0 +1,5 @@
+module dmenu
+
+go 1.22
+
+require git.novox.be/novox/mesh-sdk/go v0.1.6

modules/dmenu/go.sum

@@ -0,0 +1,2 @@
+git.novox.be/novox/mesh-sdk/go v0.1.6 h1:9qzdYONYbJdWcu6sxQcq9v1LI0JxcfkiKYkMUzJSkVQ=
+git.novox.be/novox/mesh-sdk/go v0.1.6/go.mod h1:GFuZUElBZ9A++mxgIKo97aXXo+kV0uJ/UkbhQPPIbrY=

modules/dmenu/module.json

@@ -0,0 +1,33 @@
+{
+  "module": "dmenu",
+  "version": "1",
+  "capabilities": [
+    "package-manager"
+  ],
+  "tools": [
+    "dmenu_menu",
+    "dmenu_session"
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "dmenu"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/dmenu-tools",
+        "binary": "dmenu-tools",
+        "loads": [
+          "dmenu-tools"
+        ]
+      }
+    ]
+  }
+}

modules/docker-compose/README.md

@@ -0,0 +1,65 @@
+# docker-compose
+
+Compose, for development work on the two workstations (novox/hq research 027/02: "the distribution's
+package and nothing else", assigned only to the workstations; to-be 42 phase 2 step 9). The servers
+run nothing through compose.
+
+## Owns
+
+| what | where |
+|---|---|
+| compose, as the container runtime's plugin (`docker compose`) and as `docker-compose` | package `docker-compose` |
+
+Nothing else. The runtime, its configuration, buildx and the `docker` group are the `docker` module's
+(to-be 42 phase 1 step 8). This module needs that runtime on the machine. Until the `docker` module
+holds `node-container-runtime` there, nothing in the mesh says so, and the tools answer that the
+runtime is missing or unreachable rather than an empty list.
+
+## Improves
+
+- **An owner for a package both workstations already carry.** On both, `docker-compose` 5.5.0 is
+  installed explicitly by hand, as the plugin in `/usr/lib/docker/cli-plugins`. Assigning the module
+  changes nothing on disk; from then on the package is the mesh's, upgraded with the machine and
+  given back when the module goes.
+- **The projects become visible from the mesh** without a shell on the machine: which are running,
+  where their files are, their containers, logs and rendered configuration.
+- **No account-level copy of the plugin** exists on either workstation (`~/.docker/cli-plugins` is
+  empty), so there is no second compose to remove.
+
+## Tools
+
+All answer JSON; `(r)` reads, `(a)` acts. They run as the operator account, which reaches the runtime
+through the `docker` group. Nothing goes through `sudo`.
+
+A project is named by `dir`, its absolute directory, or by `project`, its name. A directory docker
+already knows a project for is that project, with the files it was started from, overrides included.
+Any other directory must hold a compose file.
+
+| tool | what |
+|---|---|
+| `docker_compose_projects` (r) | every project docker knows, running or stopped: status, working directory (from the containers' labels), compose files, services, containers running of total |
+| `docker_compose_ps` (r) | one project's containers: service, state, health, exit code, image, published ports |
+| `docker_compose_logs` (r) | the last lines per service (default 200, at most 5000), optionally `since`; cut at 256 KiB |
+| `docker_compose_config` (r) | the rendered configuration. Values of environment variables, build arguments and labels whose names suggest a secret, and inline secret or config content, are replaced with `[redacted]`, and the answer counts them |
+| `docker_compose_up` (a) | `up --detach`, with the pull policy (default `missing`) and optionally `--build`, for all or some services |
+| `docker_compose_down` (a) | `down`: containers and networks. **Volumes are kept**: no tool here removes data |
+| `docker_compose_restart` (a) | restart all or some services |
+| `docker_compose_pull` (a) | pull images without starting anything |
+| `docker_compose_job` (r) | a long act's state: running or finished, exit status, the end of its output; without an id, every act this process knows |
+
+**Acts are jobs.** An `up` that pulls or builds takes minutes, and the runtime gives a call 30 s. Each
+act runs inside the tool's process for up to 15 minutes, and is waited on for 18 s. A finished act is
+answered with its output, and a failed one as an error. One still running is answered with its job id,
+which `docker_compose_job` follows. A job ends if the runtime restarts the bundle.
+
+## Leaves as found
+
+The projects themselves are the operator's work, under the operator's directories. Measured on
+2026-10-04:
+
+- **laptop:** `anton-lavinmq` and `anton-traefik` running, `anton-redis` stopped.
+- **desktop:** `anton-lavinmq`, `lavinmq` (from `/services/lavinmq`, a predecessor's directory) and
+  `registry` running.
+
+Whether the desktop's `lavinmq` and `registry` should still run is the operator's call;
+`docker_compose_down` with their directory stops them.

modules/docker-compose/cmd/docker-compose-tools/compose.go

@@ -0,0 +1,455 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"regexp"
+	"sort"
+	"strings"
+)
+
+// Project is one compose project as docker knows it.
+type Project struct {
+	Name        string   `json:"name"`
+	Status      string   `json:"status,omitempty"`
+	WorkingDir  string   `json:"working_dir,omitempty"`
+	ConfigFiles []string `json:"config_files"`
+	Services    []string `json:"services"`
+	Running     int      `json:"running"`
+	Containers  int      `json:"containers"`
+}
+
+// ProjectsAnswer is what docker_compose_projects answers.
+type ProjectsAnswer struct {
+	Count    int       `json:"count"`
+	Projects []Project `json:"projects"`
+}
+
+// composeFiles are the names compose looks for in a directory, in its order.
+var composeFiles = []string{"compose.yaml", "compose.yml", "docker-compose.yaml", "docker-compose.yml"}
+
+// statDir says whether a path is a directory. Tests replace it.
+var statDir = func(p string) bool {
+	info, err := os.Stat(p)
+	return err == nil && info.IsDir()
+}
+
+// statFile says whether a path is a regular file. Tests replace it.
+var statFile = func(p string) bool {
+	info, err := os.Stat(p)
+	return err == nil && info.Mode().IsRegular()
+}
+
+// docker runs one docker command and names a daemon the account cannot reach as such.
+func docker(args ...string) (Result, error) {
+	r, err := call(Cmd{Name: "docker", Args: args})
+	if err != nil && strings.Contains(r.Stderr, "permission denied") && strings.Contains(r.Stderr, "docker.sock") {
+		return r, fmt.Errorf("the account cannot reach the container runtime's socket (permission denied): it is not in the docker group, or has not logged in since it was added. The docker module owns the group's members")
+	}
+	if err != nil && strings.Contains(r.Stderr, "Cannot connect to the Docker daemon") {
+		return r, fmt.Errorf("the container runtime is not running on this machine: %s", firstLine(r.Stderr))
+	}
+	return r, err
+}
+
+// Projects merges what compose lists with what the containers' labels say.
+func Projects() (ProjectsAnswer, error) {
+	r, err := docker("compose", "ls", "--all", "--format", "json")
+	if err != nil {
+		return ProjectsAnswer{}, err
+	}
+	var listed []struct {
+		Name        string `json:"Name"`
+		Status      string `json:"Status"`
+		ConfigFiles string `json:"ConfigFiles"`
+	}
+	if s := strings.TrimSpace(r.Stdout); s != "" {
+		if err := json.Unmarshal([]byte(s), &listed); err != nil {
+			return ProjectsAnswer{}, fmt.Errorf("docker compose ls answered what is not JSON: %v", err)
+		}
+	}
+	by := map[string]*Project{}
+	get := func(name string) *Project {
+		if by[name] == nil {
+			by[name] = &Project{Name: name, ConfigFiles: []string{}, Services: []string{}}
+		}
+		return by[name]
+	}
+	for _, l := range listed {
+		p := get(l.Name)
+		p.Status = l.Status
+		p.ConfigFiles = splitFiles(l.ConfigFiles)
+	}
+	r, err = docker("ps", "-a", "--filter", "label=com.docker.compose.project", "--format",
+		`{{.Label "com.docker.compose.project"}}`+"\t"+`{{.Label "com.docker.compose.project.working_dir"}}`+"\t"+
+			`{{.Label "com.docker.compose.project.config_files"}}`+"\t"+`{{.Label "com.docker.compose.service"}}`+"\t{{.State}}")
+	if err != nil {
+		return ProjectsAnswer{}, err
+	}
+	services := map[string]map[string]bool{}
+	for _, l := range lines(r.Stdout) {
+		f := strings.Split(l, "\t")
+		if len(f) < 5 || f[0] == "" {
+			continue
+		}
+		p := get(f[0])
+		if p.WorkingDir == "" {
+			p.WorkingDir = f[1]
+		}
+		if len(p.ConfigFiles) == 0 {
+			p.ConfigFiles = splitFiles(f[2])
+		}
+		if services[f[0]] == nil {
+			services[f[0]] = map[string]bool{}
+		}
+		if f[3] != "" {
+			services[f[0]][f[3]] = true
+		}
+		p.Containers++
+		if f[4] == "running" {
+			p.Running++
+		}
+	}
+	out := ProjectsAnswer{Projects: []Project{}}
+	for name, p := range by {
+		for s := range services[name] {
+			p.Services = append(p.Services, s)
+		}
+		sort.Strings(p.Services)
+		if p.WorkingDir == "" && len(p.ConfigFiles) > 0 {
+			p.WorkingDir = filepath.Dir(p.ConfigFiles[0])
+		}
+		out.Projects = append(out.Projects, *p)
+	}
+	sort.Slice(out.Projects, func(i, k int) bool { return out.Projects[i].Name < out.Projects[k].Name })
+	out.Count = len(out.Projects)
+	return out, nil
+}
+
+func splitFiles(s string) []string {
+	out := []string{}
+	for _, f := range strings.Split(s, ",") {
+		if f = strings.TrimSpace(f); f != "" {
+			out = append(out, f)
+		}
+	}
+	return out
+}
+
+// Target is the project a tool acts on, and how compose is told which it is.
+type Target struct {
+	Project string   `json:"project,omitempty"`
+	Dir     string   `json:"dir,omitempty"`
+	Files   []string `json:"files,omitempty"`
+}
+
+// args are compose's own options naming the target.
+func (t Target) args() []string {
+	out := []string{"compose"}
+	if t.Dir != "" {
+		out = append(out, "--project-directory", t.Dir)
+	}
+	for _, f := range t.Files {
+		out = append(out, "-f", f)
+	}
+	if t.Project != "" {
+		out = append(out, "-p", t.Project)
+	}
+	return out
+}
+
+var projectName = regexp.MustCompile(`^[a-z0-9][a-z0-9_-]*$`)
+
+// targetOf reads dir or project. A directory docker already knows a project for is that project,
+// with the files it was started from; otherwise it must hold a compose file. needFiles says the
+// tool reads the files (config, up, pull), so a project known only by its containers is not enough.
+func targetOf(args map[string]any, needFiles bool) (Target, error) {
+	dir, err := optText(args, "dir", "")
+	if err != nil {
+		return Target{}, err
+	}
+	name, err := optText(args, "project", "")
+	if err != nil {
+		return Target{}, err
+	}
+	if dir == "" && name == "" {
+		return Target{}, fmt.Errorf("give dir, the project's directory, or project, its name")
+	}
+	if dir != "" {
+		if !filepath.IsAbs(dir) {
+			return Target{}, fmt.Errorf("dir must be an absolute path, not %q", dir)
+		}
+		dir = filepath.Clean(dir)
+		if !statDir(dir) {
+			return Target{}, fmt.Errorf("%s is not a directory on this machine", dir)
+		}
+	}
+	if name != "" && !projectName.MatchString(name) {
+		return Target{}, fmt.Errorf("%q is not a compose project name", name)
+	}
+	known, err := Projects()
+	if err != nil {
+		return Target{}, err
+	}
+	for _, p := range known.Projects {
+		if (dir != "" && p.WorkingDir == dir) || (dir == "" && p.Name == name) {
+			if name != "" && p.Name != name {
+				continue
+			}
+			t := Target{Project: p.Name, Dir: p.WorkingDir}
+			present := len(p.ConfigFiles) > 0
+			for _, f := range p.ConfigFiles {
+				present = present && statFile(f)
+			}
+			if present {
+				t.Files = p.ConfigFiles
+			} else if needFiles && !hasComposeFile(t.Dir) {
+				return Target{}, fmt.Errorf("project %s was started from %s, which is no longer there", p.Name, strings.Join(p.ConfigFiles, ", "))
+			}
+			return t, nil
+		}
+	}
+	if dir == "" {
+		return Target{}, fmt.Errorf("no compose project named %s is known to docker here: give dir, its directory", name)
+	}
+	if !hasComposeFile(dir) {
+		return Target{}, fmt.Errorf("%s holds no compose file (%s)", dir, strings.Join(composeFiles, ", "))
+	}
+	return Target{Dir: dir, Project: name}, nil
+}
+
+func hasComposeFile(dir string) bool {
+	for _, f := range composeFiles {
+		if statFile(filepath.Join(dir, f)) {
+			return true
+		}
+	}
+	return false
+}
+
+// Container is one of a project's containers.
+type Container struct {
+	Name     string   `json:"name"`
+	Service  string   `json:"service"`
+	State    string   `json:"state"`
+	Status   string   `json:"status"`
+	Health   string   `json:"health,omitempty"`
+	ExitCode int      `json:"exit_code"`
+	Image    string   `json:"image"`
+	Ports    []string `json:"ports"`
+}
+
+// PsAnswer is what docker_compose_ps answers.
+type PsAnswer struct {
+	Target     Target      `json:"target"`
+	Containers []Container `json:"containers"`
+}
+
+// jsonObjects reads compose's JSON output, which is one array or one object per line by version.
+func jsonObjects(s string, into any) error {
+	s = strings.TrimSpace(s)
+	if s == "" {
+		s = "[]"
+	}
+	if !strings.HasPrefix(s, "[") {
+		s = "[" + strings.Join(lines(s), ",") + "]"
+	}
+	return json.Unmarshal([]byte(s), into)
+}
+
+// Ps answers a project's containers.
+func Ps(t Target) (PsAnswer, error) {
+	r, err := docker(append(t.args(), "ps", "-a", "--format", "json")...)
+	if err != nil {
+		return PsAnswer{}, err
+	}
+	var raw []struct {
+		Name       string `json:"Name"`
+		Service    string `json:"Service"`
+		State      string `json:"State"`
+		Status     string `json:"Status"`
+		Health     string `json:"Health"`
+		ExitCode   int    `json:"ExitCode"`
+		Image      string `json:"Image"`
+		Publishers []struct {
+			URL           string `json:"URL"`
+			TargetPort    int    `json:"TargetPort"`
+			PublishedPort int    `json:"PublishedPort"`
+			Protocol      string `json:"Protocol"`
+		} `json:"Publishers"`
+	}
+	if err := jsonObjects(r.Stdout, &raw); err != nil {
+		return PsAnswer{}, fmt.Errorf("docker compose ps answered what is not JSON: %v", err)
+	}
+	out := PsAnswer{Target: t, Containers: []Container{}}
+	for _, c := range raw {
+		ports := []string{}
+		for _, p := range c.Publishers {
+			if p.PublishedPort == 0 {
+				continue
+			}
+			ports = append(ports, fmt.Sprintf("%s:%d->%d/%s", p.URL, p.PublishedPort, p.TargetPort, p.Protocol))
+		}
+		out.Containers = append(out.Containers, Container{Name: c.Name, Service: c.Service, State: c.State, Status: c.Status,
+			Health: c.Health, ExitCode: c.ExitCode, Image: c.Image, Ports: ports})
+	}
+	return out, nil
+}
+
+// LogsAnswer is what docker_compose_logs answers.
+type LogsAnswer struct {
+	Target    Target   `json:"target"`
+	Lines     []string `json:"lines"`
+	Truncated bool     `json:"truncated,omitempty"`
+}
+
+var since = regexp.MustCompile(`^[0-9A-Za-z:.+-]+$`)
+
+// Logs answers a project's last lines.
+func Logs(t Target, services []string, n int, from string) (LogsAnswer, error) {
+	args := append(t.args(), "logs", "--no-color", "--timestamps", "--tail", fmt.Sprint(n))
+	if from != "" {
+		if !since.MatchString(from) {
+			return LogsAnswer{}, fmt.Errorf("since %q is neither a duration nor a timestamp", from)
+		}
+		args = append(args, "--since", from)
+	}
+	for _, s := range services {
+		if err := plainName("service", s); err != nil {
+			return LogsAnswer{}, err
+		}
+	}
+	r, err := docker(append(args, services...)...)
+	if err != nil {
+		return LogsAnswer{}, err
+	}
+	// compose writes the containers' output on its stdout, and its own complaints on stderr.
+	return LogsAnswer{Target: t, Lines: lines(r.Stdout), Truncated: r.Truncated}, nil
+}
+
+// ConfigAnswer is what docker_compose_config answers.
+type ConfigAnswer struct {
+	Target   Target         `json:"target"`
+	Services []string       `json:"services"`
+	Redacted int            `json:"redacted"`
+	Rendered map[string]any `json:"rendered"`
+}
+
+// secretish is a name whose value is not shown.
+var secretish = regexp.MustCompile(`(?i)(pass|secret|token|key|credential|auth|private|cert|cookie|session|salt|dsn|api)`)
+
+// redact replaces the values of secret-looking names in the maps compose renders.
+func redact(v any, count *int) {
+	switch x := v.(type) {
+	case map[string]any:
+		for k, child := range x {
+			switch k {
+			case "environment", "args", "labels", "build_args":
+				if m, ok := child.(map[string]any); ok {
+					for name, val := range m {
+						if val != nil && secretish.MatchString(name) {
+							m[name] = "[redacted]"
+							*count++
+						}
+					}
+					continue
+				}
+			case "content":
+				// An inline config or secret: its content is the secret itself.
+				if _, ok := child.(string); ok {
+					x[k] = "[redacted]"
+					*count++
+					continue
+				}
+			}
+			redact(child, count)
+		}
+	case []any:
+		for _, child := range x {
+			redact(child, count)
+		}
+	}
+}
+
+// Config answers the rendered configuration.
+func Config(t Target) (ConfigAnswer, error) {
+	r, err := docker(append(t.args(), "config", "--format", "json")...)
+	if err != nil {
+		return ConfigAnswer{}, err
+	}
+	var rendered map[string]any
+	if err := json.Unmarshal([]byte(r.Stdout), &rendered); err != nil {
+		return ConfigAnswer{}, fmt.Errorf("docker compose config answered what is not JSON: %v", err)
+	}
+	out := ConfigAnswer{Target: t, Services: []string{}, Rendered: rendered}
+	if s, ok := rendered["services"].(map[string]any); ok {
+		for name := range s {
+			out.Services = append(out.Services, name)
+		}
+		sort.Strings(out.Services)
+	}
+	redact(rendered, &out.Redacted)
+	return out, nil
+}
+
+// ActAnswer is what an act answers: the target and the job that carries it.
+type ActAnswer struct {
+	Act    string `json:"act"`
+	Target Target `json:"target"`
+	Job    Job    `json:"job"`
+}
+
+func act(name string, t Target, extra ...string) (ActAnswer, error) {
+	j, err := actAsJob(Cmd{Name: "docker", Args: append(append(t.args(), name), extra...)})
+	if err != nil {
+		return ActAnswer{}, err
+	}
+	return ActAnswer{Act: name, Target: t, Job: j}, nil
+}
+
+func checkServices(services []string) error {
+	for _, s := range services {
+		if err := plainName("service", s); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// Up brings a project up, detached.
+func Up(t Target, services []string, build bool, pull string) (ActAnswer, error) {
+	if err := oneOf("pull", pull, "missing", "always", "never"); err != nil {
+		return ActAnswer{}, err
+	}
+	if err := checkServices(services); err != nil {
+		return ActAnswer{}, err
+	}
+	extra := []string{"--detach", "--pull", pull}
+	if build {
+		extra = append(extra, "--build")
+	}
+	return act("up", t, append(extra, services...)...)
+}
+
+// Down stops and removes a project's containers and networks, keeping its volumes.
+func Down(t Target) (ActAnswer, error) {
+	return act("down", t)
+}
+
+// Restart restarts a project's containers.
+func Restart(t Target, services []string) (ActAnswer, error) {
+	if err := checkServices(services); err != nil {
+		return ActAnswer{}, err
+	}
+	return act("restart", t, services...)
+}
+
+// Pull pulls a project's images.
+func Pull(t Target, services []string) (ActAnswer, error) {
+	if err := checkServices(services); err != nil {
+		return ActAnswer{}, err
+	}
+	return act("pull", t, services...)
+}

modules/docker-compose/cmd/docker-compose-tools/compose_test.go

@@ -0,0 +1,222 @@
+package main
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+)
+
+func TestTheManifestIsComposesPackageAndNothingElse(t *testing.T) {
+	m := readManifest(t)
+	holdsTheBundle(t, m, "docker_compose")
+	if got := strings.Join(m.packages(), ","); got != "docker-compose" {
+		t.Errorf("packages %s: buildx and the runtime are the docker module's", got)
+	}
+	if len(m.Resources) != 1 {
+		t.Errorf("one resource, the package: %v", m.Resources)
+	}
+}
+
+const lsJSON = `[{"Name":"anton-lavinmq","Status":"running(1)","ConfigFiles":"/home/op/hub/lavinmq/docker-compose.yml"},{"Name":"old","Status":"exited(2)","ConfigFiles":"/srv/old/compose.yaml,/srv/old/compose.override.yaml"}]`
+
+const psLabels = "anton-lavinmq\t/home/op/hub/lavinmq\t/home/op/hub/lavinmq/docker-compose.yml\tlavinmq\trunning\n" +
+	"old\t/srv/old\t/srv/old/compose.yaml,/srv/old/compose.override.yaml\tweb\texited\n" +
+	"old\t/srv/old\t/srv/old/compose.yaml,/srv/old/compose.override.yaml\tdb\texited\n"
+
+// aDocker answers compose ls and the labelled ps, and hands every other line to rest.
+func aDocker(t *testing.T, rest func(line string) Result) *fake {
+	return using(t, func(line string, c Cmd) Result {
+		switch {
+		case strings.HasPrefix(line, "docker compose ls"):
+			return ok(lsJSON)
+		case strings.HasPrefix(line, "docker ps -a --filter label=com.docker.compose.project"):
+			return ok(psLabels)
+		}
+		if rest != nil {
+			return rest(line)
+		}
+		return ok("")
+	})
+}
+
+func onDisk(t *testing.T, dirs, files []string) {
+	t.Helper()
+	wasD, wasF := statDir, statFile
+	in := func(set []string) func(string) bool {
+		return func(p string) bool {
+			for _, s := range set {
+				if s == p {
+					return true
+				}
+			}
+			return false
+		}
+	}
+	statDir, statFile = in(dirs), in(files)
+	t.Cleanup(func() { statDir, statFile = wasD, wasF })
+}
+
+func TestProjectsMergesComposesListWithTheContainersLabels(t *testing.T) {
+	aDocker(t, nil)
+	got, err := Projects()
+	if err != nil || got.Count != 2 {
+		t.Fatalf("%+v %v", got, err)
+	}
+	p := got.Projects[0]
+	if p.Name != "anton-lavinmq" || p.WorkingDir != "/home/op/hub/lavinmq" || p.Running != 1 || p.Containers != 1 || p.Status != "running(1)" {
+		t.Errorf("%+v", p)
+	}
+	o := got.Projects[1]
+	if strings.Join(o.Services, ",") != "db,web" || len(o.ConfigFiles) != 2 || o.Running != 0 || o.Containers != 2 {
+		t.Errorf("%+v", o)
+	}
+}
+
+func TestProjectsNamesADaemonTheAccountCannotReach(t *testing.T) {
+	using(t, func(string, Cmd) Result {
+		return Result{Status: 1, Stderr: "permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock"}
+	})
+	if _, err := Projects(); err == nil || !strings.Contains(err.Error(), "docker group") {
+		t.Fatalf("%v", err)
+	}
+}
+
+func TestATargetIsAKnownProjectWithItsFilesOrADirectoryHoldingAComposeFile(t *testing.T) {
+	aDocker(t, nil)
+	onDisk(t, []string{"/home/op/hub/lavinmq", "/srv/new", "/srv/empty", "/srv/old"},
+		[]string{"/home/op/hub/lavinmq/docker-compose.yml", "/srv/new/compose.yaml"})
+	got, err := targetOf(map[string]any{"dir": "/home/op/hub/lavinmq/"}, true)
+	if err != nil || got.Project != "anton-lavinmq" || len(got.Files) != 1 {
+		t.Fatalf("a known directory: %+v %v", got, err)
+	}
+	if a := strings.Join(got.args(), " "); a != "compose --project-directory /home/op/hub/lavinmq -f /home/op/hub/lavinmq/docker-compose.yml -p anton-lavinmq" {
+		t.Errorf("args %s", a)
+	}
+	got, err = targetOf(map[string]any{"dir": "/srv/new"}, true)
+	if err != nil || got.Project != "" || got.Dir != "/srv/new" {
+		t.Fatalf("a new directory: %+v %v", got, err)
+	}
+	got, err = targetOf(map[string]any{"project": "old"}, false)
+	if err != nil || got.Dir != "/srv/old" || got.Files != nil {
+		t.Fatalf("a project whose files are gone, for an act that needs none: %+v %v", got, err)
+	}
+	if _, err := targetOf(map[string]any{"project": "old"}, true); err == nil || !strings.Contains(err.Error(), "no longer there") {
+		t.Errorf("its files are needed: %v", err)
+	}
+	for _, bad := range []map[string]any{{}, {"dir": "rel/path"}, {"dir": "/nope"}, {"dir": "/srv/empty"}, {"project": "Bad Name"}, {"project": "unknown"}} {
+		if _, err := targetOf(bad, false); err == nil {
+			t.Errorf("%v was accepted", bad)
+		}
+	}
+}
+
+func TestPsReadsEitherJSONShapeAndKeepsOnlyPublishedPorts(t *testing.T) {
+	aDocker(t, func(line string) Result {
+		return ok(`{"Name":"a-web-1","Service":"web","State":"running","Status":"Up 2 hours","Health":"healthy","ExitCode":0,"Image":"nginx","Publishers":[{"URL":"0.0.0.0","TargetPort":80,"PublishedPort":8080,"Protocol":"tcp"},{"URL":"","TargetPort":443,"PublishedPort":0,"Protocol":"tcp"}]}
+{"Name":"a-db-1","Service":"db","State":"exited","Status":"Exited (1)","ExitCode":1,"Image":"postgres","Publishers":[]}`)
+	})
+	got, err := Ps(Target{Project: "a"})
+	if err != nil || len(got.Containers) != 2 {
+		t.Fatalf("%+v %v", got, err)
+	}
+	if c := got.Containers[0]; strings.Join(c.Ports, ",") != "0.0.0.0:8080->80/tcp" || c.Health != "healthy" {
+		t.Errorf("%+v", c)
+	}
+	var arr []map[string]any
+	if err := jsonObjects(`[{"Name":"x"}]`, &arr); err != nil || len(arr) != 1 {
+		t.Errorf("an array: %v %v", arr, err)
+	}
+}
+
+func TestLogsAreBoundedAndRefuseAnOptionInAName(t *testing.T) {
+	f := aDocker(t, func(line string) Result { return Result{Stdout: "web-1 | a\nweb-1 | b\n", Truncated: true} })
+	got, err := Logs(Target{Project: "a"}, []string{"web"}, 50, "10m")
+	if err != nil || len(got.Lines) != 2 || !got.Truncated {
+		t.Fatalf("%+v %v", got, err)
+	}
+	if l := f.lines()[0]; l != "docker compose -p a logs --no-color --timestamps --tail 50 --since 10m web" {
+		t.Errorf("%s", l)
+	}
+	if _, err := Logs(Target{Project: "a"}, []string{"--follow"}, 5, ""); err == nil {
+		t.Error("an option as a service")
+	}
+	if _, err := Logs(Target{Project: "a"}, nil, 5, "1h; rm"); err == nil {
+		t.Error("a since that is neither")
+	}
+}
+
+func TestConfigRedactsSecretLookingValuesAndInlineContent(t *testing.T) {
+	aDocker(t, func(string) Result {
+		return ok(`{"name":"a","services":{"web":{"image":"nginx","environment":{"DB_PASSWORD":"hunter2","PORT":"80","API_TOKEN":"t"},"build":{"args":{"NPM_TOKEN":"n","NODE_ENV":"production"}}}},"secrets":{"s":{"content":"raw"}}}`)
+	})
+	got, err := Config(Target{Dir: "/srv/a"})
+	if err != nil || got.Redacted != 4 || strings.Join(got.Services, ",") != "web" {
+		t.Fatalf("%+v %v", got, err)
+	}
+	raw, _ := json.Marshal(got.Rendered)
+	for _, secret := range []string{"hunter2", `"t"`, `"n"`, "raw"} {
+		if strings.Contains(string(raw), secret) {
+			t.Errorf("%s shown: %s", secret, raw)
+		}
+	}
+	for _, kept := range []string{`"PORT":"80"`, `"NODE_ENV":"production"`, `"image":"nginx"`} {
+		if !strings.Contains(string(raw), kept) {
+			t.Errorf("%s hidden: %s", kept, raw)
+		}
+	}
+}
+
+func TestConfigAnInvalidFileIsComposesError(t *testing.T) {
+	aDocker(t, func(string) Result {
+		return Result{Status: 15, Stderr: "services.web Additional property foo is not allowed"}
+	})
+	if _, err := Config(Target{Dir: "/srv/a"}); err == nil || !strings.Contains(err.Error(), "Additional property") {
+		t.Fatalf("%v", err)
+	}
+}
+
+func TestActsAreJobsAsTheAccountKeepVolumesAndCheckTheirArguments(t *testing.T) {
+	f := aDocker(t, nil)
+	tg := Target{Dir: "/srv/a", Project: "a"}
+	if got, err := Up(tg, []string{"web"}, true, "always"); err != nil || got.Job.Running || got.Act != "up" {
+		t.Fatalf("%+v %v", got, err)
+	}
+	if _, err := Down(tg); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := Restart(tg, nil); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := Pull(tg, nil); err != nil {
+		t.Fatal(err)
+	}
+	want := []string{
+		"docker compose --project-directory /srv/a -p a up --detach --pull always --build web",
+		"docker compose --project-directory /srv/a -p a down",
+		"docker compose --project-directory /srv/a -p a restart",
+		"docker compose --project-directory /srv/a -p a pull",
+	}
+	if got := strings.Join(f.lines(), "\n"); got != strings.Join(want, "\n") {
+		t.Errorf("asked\n%s\nwant\n%s", got, strings.Join(want, "\n"))
+	}
+	for _, l := range f.lines() {
+		if strings.Contains(l, "sudo") || strings.Contains(l, "-v") || strings.Contains(l, "--volumes") {
+			t.Errorf("%s", l)
+		}
+	}
+	if _, err := Up(tg, nil, false, "sometimes"); err == nil {
+		t.Error("an unknown pull policy")
+	}
+	if _, err := Restart(tg, []string{"-t"}); err == nil {
+		t.Error("an option as a service")
+	}
+}
+
+func TestAFailedActIsAnError(t *testing.T) {
+	aDocker(t, func(string) Result {
+		return Result{Status: 1, Stderr: "Error response from daemon: port is already allocated"}
+	})
+	if _, err := Up(Target{Dir: "/srv/a"}, nil, false, "missing"); err == nil || !strings.Contains(err.Error(), "already allocated") {
+		t.Fatalf("%v", err)
+	}
+}

modules/docker-compose/cmd/docker-compose-tools/jobs.go

@@ -0,0 +1,151 @@
+package main
+
+// jobs.go is the same file in the bundles whose acts can outlast one call (flatpak, docker-compose):
+// an install or an `up` that pulls images takes minutes, and the runtime gives a call 30 s. Such an
+// act is started as a job inside this process, waited on for a while, and answered either finished
+// or with the job's id for the module's `_job` tool to follow. A job ends with this process: if the
+// runtime restarts the bundle, a running job is cut off, and its id is then unknown.
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+	"sync"
+	"time"
+)
+
+// JobLimit is the longest a job may run; JobWait how long an act waits before answering a job id.
+const (
+	JobLimit = 15 * time.Minute
+	JobWait  = 18 * time.Second
+	keptJobs = 50
+)
+
+// Job is one long act, as its tool answers it.
+type Job struct {
+	ID        string     `json:"job"`
+	Command   string     `json:"command"`
+	Started   time.Time  `json:"started"`
+	Finished  *time.Time `json:"finished,omitempty"`
+	Running   bool       `json:"running"`
+	Status    *int       `json:"status,omitempty"`
+	Error     string     `json:"error,omitempty"`
+	Output    string     `json:"output,omitempty"`
+	Truncated bool       `json:"truncated,omitempty"`
+	done      chan struct{}
+}
+
+type jobBook struct {
+	mu   sync.Mutex
+	seq  int
+	jobs map[string]*Job
+}
+
+var jobs = &jobBook{jobs: map[string]*Job{}}
+
+// startJob runs c in the background, held to JobLimit.
+func startJob(c Cmd) *Job {
+	c.Timeout = JobLimit
+	name, args := argv(c)
+	jobs.mu.Lock()
+	jobs.seq++
+	j := &Job{ID: fmt.Sprintf("%d-%d", time.Now().Unix(), jobs.seq), Command: strings.TrimSpace(name + " " + strings.Join(args, " ")),
+		Started: time.Now().UTC(), Running: true, done: make(chan struct{})}
+	jobs.jobs[j.ID] = j
+	jobs.forgetOldest()
+	jobs.mu.Unlock()
+	go func() {
+		r := run(c)
+		var err error
+		if r.Status != 0 || r.Error != "" {
+			err = failure(c, r)
+		}
+		jobs.mu.Lock()
+		now := time.Now().UTC()
+		j.Finished, j.Running = &now, false
+		status := r.Status
+		j.Status = &status
+		if err != nil {
+			j.Error = err.Error()
+		}
+		j.Output = tail(strings.TrimSpace(r.Stdout+"\n"+r.Stderr), 16<<10)
+		j.Truncated = r.Truncated || len(r.Stdout)+len(r.Stderr) > 16<<10
+		jobs.mu.Unlock()
+		close(j.done)
+	}()
+	return j
+}
+
+// forgetOldest keeps the book bounded; finished jobs go first. Called with the lock held.
+func (b *jobBook) forgetOldest() {
+	if len(b.jobs) <= keptJobs {
+		return
+	}
+	all := make([]*Job, 0, len(b.jobs))
+	for _, j := range b.jobs {
+		all = append(all, j)
+	}
+	sort.Slice(all, func(i, k int) bool { return all[i].Started.Before(all[k].Started) })
+	for _, j := range all {
+		if len(b.jobs) <= keptJobs {
+			return
+		}
+		if !j.Running {
+			delete(b.jobs, j.ID)
+		}
+	}
+}
+
+// awaitJob waits up to d for a job to finish and answers a copy of it as it then stands.
+func awaitJob(j *Job, d time.Duration) Job {
+	select {
+	case <-j.done:
+	case <-time.After(d):
+	}
+	return snapshot(j)
+}
+
+func snapshot(j *Job) Job {
+	jobs.mu.Lock()
+	defer jobs.mu.Unlock()
+	c := *j
+	c.done = nil
+	return c
+}
+
+// jobByID answers a job by its id, or says it is not known to this process.
+func jobByID(id string) (Job, error) {
+	jobs.mu.Lock()
+	j, ok := jobs.jobs[id]
+	jobs.mu.Unlock()
+	if !ok {
+		return Job{}, fmt.Errorf("no job %s in this process: it was never started here, was forgotten after %d newer ones, or the bundle has restarted since", id, keptJobs)
+	}
+	return snapshot(j), nil
+}
+
+// listJobs answers every job this process knows, newest first.
+func listJobs() []Job {
+	jobs.mu.Lock()
+	all := make([]*Job, 0, len(jobs.jobs))
+	for _, j := range jobs.jobs {
+		all = append(all, j)
+	}
+	jobs.mu.Unlock()
+	sort.Slice(all, func(i, k int) bool { return all[i].Started.After(all[k].Started) })
+	out := make([]Job, 0, len(all))
+	for _, j := range all {
+		out = append(out, snapshot(j))
+	}
+	return out
+}
+
+// actAsJob starts c and answers the job once it finishes or JobWait passes, whichever is first.
+// A finished job that failed is answered as an error, so a failed act is never read as success.
+func actAsJob(c Cmd) (Job, error) {
+	j := awaitJob(startJob(c), JobWait)
+	if !j.Running && j.Error != "" {
+		return j, fmt.Errorf("%s (job %s)", j.Error, j.ID)
+	}
+	return j, nil
+}

modules/docker-compose/cmd/docker-compose-tools/jobs_test.go

@@ -0,0 +1,51 @@
+package main
+
+import (
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestJobsAFastActIsAnsweredFinishedAndAFailedOneAsAnError(t *testing.T) {
+	using(t, func(line string, c Cmd) Result {
+		if c.Timeout != JobLimit {
+			t.Errorf("a job is held to JobLimit, not %s", c.Timeout)
+		}
+		if strings.Contains(line, "bad") {
+			return Result{Status: 2, Stderr: "it broke"}
+		}
+		return ok("done")
+	})
+	j, err := actAsJob(Cmd{Name: "good"})
+	if err != nil || j.Running || j.Status == nil || *j.Status != 0 || j.Output != "done" {
+		t.Fatalf("%+v %v", j, err)
+	}
+	if _, err := actAsJob(Cmd{Name: "bad"}); err == nil || !strings.Contains(err.Error(), "it broke") {
+		t.Fatalf("a failed job: %v", err)
+	}
+	got, err := jobByID(j.ID)
+	if err != nil || got.ID != j.ID {
+		t.Fatalf("by id: %+v %v", got, err)
+	}
+	if _, err := jobByID("nope"); err == nil {
+		t.Fatal("an unknown job")
+	}
+	if len(listJobs()) < 2 {
+		t.Fatal("listed")
+	}
+}
+
+func TestJobsASlowActIsAnsweredRunningWithItsID(t *testing.T) {
+	release := make(chan struct{})
+	using(t, func(line string, c Cmd) Result { <-release; return ok("") })
+	j := awaitJob(startJob(Cmd{Name: "slow"}), 50*time.Millisecond)
+	if !j.Running || j.ID == "" {
+		t.Fatalf("%+v", j)
+	}
+	close(release)
+	time.Sleep(50 * time.Millisecond)
+	got, _ := jobByID(j.ID)
+	if got.Running {
+		t.Fatalf("finished afterwards: %+v", got)
+	}
+}

modules/docker-compose/cmd/docker-compose-tools/kit.go

@@ -0,0 +1,352 @@
+package main
+
+// kit.go is the same file in each of the workstations' tool bundles (fonts, docker-compose, snapd,
+// flatpak, cups, bluetooth, xclip, dmenu): how a tool runs a command, escalates, bounds what it
+// keeps, and names a failure. A module is built from its own directory, so the file is copied rather
+// than shared; a change to one copy is made to all eight.
+//
+// The rules it holds (novox/hq research 026/05, to-be 38 WP4):
+//   - the node's tool runtime runs as the operator account, not root (ADR 0175 §4); a command that
+//     needs root goes through `sudo -n`, never a prompt, and a refusal is named as such;
+//   - one command gets 20 s, below the runtime's 30 s call limit, and is ended with everything it
+//     started when it takes longer;
+//   - each stream is kept to 256 KiB, and the answer says when it was cut;
+//   - a failure is an error with what went wrong in it, never an empty answer.
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"strings"
+	"syscall"
+	"time"
+)
+
+// Bounds every command is held to.
+const (
+	CallTimeout = 20 * time.Second
+	MostOutput  = 256 << 10
+)
+
+// Cmd is one command a tool runs.
+type Cmd struct {
+	Name string
+	Args []string
+	// Stdin is written to the command's standard input when not empty.
+	Stdin string
+	// Env is added to this process's own environment.
+	Env []string
+	// Root says the command needs root: it is run through `sudo -n` when this process is not root.
+	Root bool
+	// Timeout replaces CallTimeout; only a background job (jobs.go) asks for longer.
+	Timeout time.Duration
+	// Detached is for a program that forks a child which outlives it, as xclip does to keep the
+	// selection: its streams go to files, because a pipe the child inherits would hold the call open
+	// until the child exits.
+	Detached bool
+}
+
+// Result is what a command did.
+type Result struct {
+	Stdout string `json:"stdout"`
+	Stderr string `json:"stderr"`
+	Status int    `json:"status"`
+	// Error is why it did not run to an answer: "not-found" when the program is not there,
+	// "timeout" when it was ended for taking too long, else the spawn error.
+	Error     string `json:"error,omitempty"`
+	Truncated bool   `json:"truncated,omitempty"`
+}
+
+// Runner runs a command. Tests replace it; nothing else does.
+type Runner func(Cmd) Result
+
+var (
+	run  Runner = execRun
+	euid        = os.Geteuid
+)
+
+// argv is the command as it is run: through sudo without a prompt when it needs root and this
+// process is not root.
+func argv(c Cmd) (string, []string) {
+	if c.Root && euid() != 0 {
+		return "sudo", append([]string{"-n", c.Name}, c.Args...)
+	}
+	return c.Name, c.Args
+}
+
+// bounded keeps the first MostOutput bytes written to it and notes that more came.
+type bounded struct {
+	b   bytes.Buffer
+	cut bool
+}
+
+func (w *bounded) Write(p []byte) (int, error) {
+	room := MostOutput - w.b.Len()
+	if room <= 0 {
+		w.cut = w.cut || len(p) > 0
+		return len(p), nil
+	}
+	if len(p) > room {
+		w.b.Write(p[:room])
+		w.cut = true
+		return len(p), nil
+	}
+	return w.b.Write(p)
+}
+
+func execRun(c Cmd) Result {
+	timeout := c.Timeout
+	if timeout <= 0 {
+		timeout = CallTimeout
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+	name, args := argv(c)
+	cmd := exec.CommandContext(ctx, name, args...)
+	cmd.Env = append(append(os.Environ(), "LC_ALL=C"), c.Env...)
+	if !c.Detached {
+		// Its own process group, so that ending it on a timeout ends what it started too.
+		cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
+		cmd.Cancel = func() error {
+			if cmd.Process != nil {
+				_ = syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL)
+			}
+			return nil
+		}
+	}
+	cmd.WaitDelay = 2 * time.Second
+	if c.Stdin != "" {
+		cmd.Stdin = strings.NewReader(c.Stdin)
+	}
+	var out, errs bounded
+	var outFile, errFile *os.File
+	if c.Detached {
+		var err error
+		if outFile, err = os.CreateTemp("", "mesh-tool-out-*"); err != nil {
+			return Result{Status: 127, Error: err.Error()}
+		}
+		defer os.Remove(outFile.Name())
+		defer outFile.Close()
+		if errFile, err = os.CreateTemp("", "mesh-tool-err-*"); err != nil {
+			return Result{Status: 127, Error: err.Error()}
+		}
+		defer os.Remove(errFile.Name())
+		defer errFile.Close()
+		cmd.Stdout, cmd.Stderr = outFile, errFile
+	} else {
+		cmd.Stdout, cmd.Stderr = &out, &errs
+	}
+	err := cmd.Run()
+	if c.Detached {
+		for _, f := range []struct {
+			file *os.File
+			into *bounded
+		}{{outFile, &out}, {errFile, &errs}} {
+			if _, e := f.file.Seek(0, io.SeekStart); e == nil {
+				_, _ = io.Copy(f.into, f.file)
+			}
+		}
+	}
+	r := Result{Stdout: out.b.String(), Stderr: errs.b.String(), Truncated: out.cut || errs.cut}
+	var exit *exec.ExitError
+	switch {
+	case err == nil:
+	case ctx.Err() == context.DeadlineExceeded:
+		r.Status, r.Error = 124, "timeout"
+	case errors.Is(err, exec.ErrNotFound) || errors.Is(err, os.ErrNotExist):
+		r.Status, r.Error = 127, "not-found"
+	case errors.As(err, &exit):
+		r.Status = exit.ExitCode()
+	default:
+		r.Status, r.Error = 127, err.Error()
+	}
+	return r
+}
+
+// call runs a command and answers its result, or an error naming what went wrong.
+func call(c Cmd) (Result, error) {
+	r := run(c)
+	if r.Status == 0 && r.Error == "" {
+		return r, nil
+	}
+	return r, failure(c, r)
+}
+
+// failure names how a command failed: not installed, refused escalation, too slow, or its exit
+// status with the end of what it said.
+func failure(c Cmd, r Result) error {
+	program, _ := argv(c)
+	switch {
+	case r.Error == "not-found" && program == "sudo":
+		return fmt.Errorf("%s needs root, and sudo is not installed here for the runtime's account to escalate with", c.Name)
+	case r.Error == "not-found":
+		if hint, ok := providedBy[c.Name]; ok {
+			return fmt.Errorf("%s is not installed on this machine (%s)", c.Name, hint)
+		}
+		return fmt.Errorf("%s is not installed on this machine", c.Name)
+	case r.Error == "timeout":
+		limit := c.Timeout
+		if limit <= 0 {
+			limit = CallTimeout
+		}
+		return fmt.Errorf("%s gave no answer within %s and was ended", c.Name, limit)
+	case r.Error != "":
+		return fmt.Errorf("%s did not run: %s", c.Name, r.Error)
+	case program == "sudo" && strings.Contains(r.Stderr, "command not found"):
+		if hint, ok := providedBy[c.Name]; ok {
+			return fmt.Errorf("%s is not installed on this machine (%s)", c.Name, hint)
+		}
+		return fmt.Errorf("%s is not installed on this machine", c.Name)
+	case program == "sudo" && strings.HasPrefix(strings.TrimSpace(r.Stderr), "sudo:"):
+		return fmt.Errorf("%s needs root, and sudo -n refused the runtime's account: %s (the escalation is the sudo module's to declare)",
+			c.Name, firstLine(r.Stderr))
+	}
+	said := tail(strings.TrimSpace(r.Stderr), 2000)
+	if said == "" {
+		said = tail(strings.TrimSpace(r.Stdout), 2000)
+	}
+	if said == "" {
+		said = "and said nothing"
+	}
+	return fmt.Errorf("%s %s exited %d: %s", c.Name, strings.Join(c.Args, " "), r.Status, said)
+}
+
+func firstLine(s string) string {
+	s = strings.TrimSpace(s)
+	if i := strings.IndexByte(s, '\n'); i >= 0 {
+		return s[:i]
+	}
+	return s
+}
+
+func tail(s string, n int) string {
+	if len(s) <= n {
+		return s
+	}
+	return "…" + s[len(s)-n:]
+}
+
+// lines are a command's output lines, blank ones dropped.
+func lines(s string) []string {
+	out := []string{}
+	for _, l := range strings.Split(s, "\n") {
+		if strings.TrimSpace(l) != "" {
+			out = append(out, strings.TrimRight(l, "\r"))
+		}
+	}
+	return out
+}
+
+// Arguments, read the way a tool's JSON arguments arrive.
+
+func text(args map[string]any, key string) (string, error) {
+	v, ok := args[key]
+	if !ok || v == nil {
+		return "", fmt.Errorf("%s is required", key)
+	}
+	s, ok := v.(string)
+	if !ok {
+		return "", fmt.Errorf("%s must be a string", key)
+	}
+	if strings.TrimSpace(s) == "" {
+		return "", fmt.Errorf("%s must not be empty", key)
+	}
+	return s, nil
+}
+
+func optText(args map[string]any, key, def string) (string, error) {
+	v, ok := args[key]
+	if !ok || v == nil {
+		return def, nil
+	}
+	s, ok := v.(string)
+	if !ok {
+		return "", fmt.Errorf("%s must be a string", key)
+	}
+	if strings.TrimSpace(s) == "" {
+		return def, nil
+	}
+	return s, nil
+}
+
+// optWhole reads a whole number, defaulted, refused below least and held to most.
+func optWhole(args map[string]any, key string, def, least, most int) (int, error) {
+	v, ok := args[key]
+	if !ok || v == nil {
+		return def, nil
+	}
+	f, ok := v.(float64)
+	if !ok {
+		if i, isInt := v.(int); isInt {
+			f = float64(i)
+		} else {
+			return 0, fmt.Errorf("%s must be a number", key)
+		}
+	}
+	if f != float64(int(f)) {
+		return 0, fmt.Errorf("%s must be a whole number", key)
+	}
+	n := int(f)
+	if n < least {
+		return 0, fmt.Errorf("%s must be at least %d", key, least)
+	}
+	if n > most {
+		n = most
+	}
+	return n, nil
+}
+
+func optFlag(args map[string]any, key string, def bool) (bool, error) {
+	v, ok := args[key]
+	if !ok || v == nil {
+		return def, nil
+	}
+	b, ok := v.(bool)
+	if !ok {
+		return false, fmt.Errorf("%s must be true or false", key)
+	}
+	return b, nil
+}
+
+func optList(args map[string]any, key string) ([]string, error) {
+	v, ok := args[key]
+	if !ok || v == nil {
+		return nil, nil
+	}
+	items, ok := v.([]any)
+	if !ok {
+		return nil, fmt.Errorf("%s must be a list of strings", key)
+	}
+	out := make([]string, 0, len(items))
+	for _, it := range items {
+		s, ok := it.(string)
+		if !ok || strings.TrimSpace(s) == "" {
+			return nil, fmt.Errorf("%s must be a list of non-empty strings", key)
+		}
+		out = append(out, s)
+	}
+	return out, nil
+}
+
+// oneOf refuses a value outside a closed set.
+func oneOf(key, value string, allowed ...string) error {
+	for _, a := range allowed {
+		if value == a {
+			return nil
+		}
+	}
+	return fmt.Errorf("%s must be one of %s, not %q", key, strings.Join(allowed, ", "), value)
+}
+
+// plainName refuses a name that could be read as an option or carries a path or a space: package,
+// snap, application and printer names never do.
+func plainName(key, value string) error {
+	if strings.HasPrefix(value, "-") || strings.ContainsAny(value, " \t\n/\\") {
+		return fmt.Errorf("%s %q is not a plain name", key, value)
+	}
+	return nil
+}

modules/docker-compose/cmd/docker-compose-tools/kit_test.go

@@ -0,0 +1,147 @@
+package main
+
+// Tests of kit.go, the same in each workstation module.
+
+import (
+	"strings"
+	"testing"
+	"time"
+)
+
+// fake records the commands asked and answers each from a function of the command line.
+type fake struct {
+	asked  []Cmd
+	answer func(line string, c Cmd) Result
+}
+
+func (f *fake) runner() Runner {
+	return func(c Cmd) Result {
+		f.asked = append(f.asked, c)
+		name, args := argv(c)
+		line := strings.TrimSpace(name + " " + strings.Join(args, " "))
+		if f.answer == nil {
+			return Result{}
+		}
+		return f.answer(line, c)
+	}
+}
+
+func (f *fake) lines() []string {
+	out := []string{}
+	for _, c := range f.asked {
+		name, args := argv(c)
+		out = append(out, strings.TrimSpace(name+" "+strings.Join(args, " ")))
+	}
+	return out
+}
+
+// using installs a fake runner and a non-root uid for one test.
+func using(t *testing.T, answer func(line string, c Cmd) Result) *fake {
+	t.Helper()
+	f := &fake{answer: answer}
+	wasRun, wasUID := run, euid
+	run, euid = f.runner(), func() int { return 1000 }
+	t.Cleanup(func() { run, euid = wasRun, wasUID })
+	return f
+}
+
+func ok(stdout string) Result { return Result{Stdout: stdout} }
+
+func TestKitAnActThatNeedsRootGoesThroughSudoWithoutAPromptUnlessAlreadyRoot(t *testing.T) {
+	was := euid
+	defer func() { euid = was }()
+	euid = func() int { return 1000 }
+	if name, args := argv(Cmd{Name: "x", Args: []string{"a"}, Root: true}); name != "sudo" || strings.Join(args, " ") != "-n x a" {
+		t.Fatalf("not root: %s %v", name, args)
+	}
+	if name, _ := argv(Cmd{Name: "x"}); name != "x" {
+		t.Fatalf("a read is run as the account: %s", name)
+	}
+	euid = func() int { return 0 }
+	if name, _ := argv(Cmd{Name: "x", Root: true}); name != "x" {
+		t.Fatalf("as root no sudo: %s", name)
+	}
+}
+
+func TestKitAFailureIsNamedByHowItFailed(t *testing.T) {
+	was := euid
+	defer func() { euid = was }()
+	euid = func() int { return 1000 }
+	cases := []struct {
+		c    Cmd
+		r    Result
+		want string
+	}{
+		{Cmd{Name: "nothere"}, Result{Status: 127, Error: "not-found"}, "not installed"},
+		{Cmd{Name: "x", Root: true}, Result{Status: 127, Error: "not-found"}, "sudo is not installed"},
+		{Cmd{Name: "x", Root: true}, Result{Status: 1, Stderr: "sudo: a password is required\n"}, "sudo -n refused"},
+		{Cmd{Name: "x", Root: true}, Result{Status: 1, Stderr: "sudo: x: command not found\n"}, "x is not installed"},
+		{Cmd{Name: "x"}, Result{Status: 124, Error: "timeout"}, "within 20s"},
+		{Cmd{Name: "x", Args: []string{"y"}}, Result{Status: 3, Stderr: "boom\n"}, "x y exited 3: boom"},
+		{Cmd{Name: "x"}, Result{Status: 3}, "said nothing"},
+	}
+	for _, k := range cases {
+		err := failure(k.c, k.r)
+		if err == nil || !strings.Contains(err.Error(), k.want) {
+			t.Errorf("%+v: %v, want %q", k.r, err, k.want)
+		}
+	}
+}
+
+func TestKitOutputIsBoundedAndSaysSo(t *testing.T) {
+	var w bounded
+	big := strings.Repeat("a", MostOutput+10)
+	n, _ := w.Write([]byte(big))
+	if n != len(big) || w.b.Len() != MostOutput || !w.cut {
+		t.Fatalf("kept %d of %d, cut %v", w.b.Len(), len(big), w.cut)
+	}
+}
+
+func TestKitTheRealRunnerRunsEndsAndReportsAMissingProgram(t *testing.T) {
+	r := execRun(Cmd{Name: "sh", Args: []string{"-c", "echo out; echo err >&2; exit 3"}})
+	if r.Status != 3 || strings.TrimSpace(r.Stdout) != "out" || strings.TrimSpace(r.Stderr) != "err" {
+		t.Fatalf("%+v", r)
+	}
+	r = execRun(Cmd{Name: "sh", Args: []string{"-c", "sleep 5 & sleep 5"}, Timeout: 200 * time.Millisecond})
+	if r.Error != "timeout" {
+		t.Fatalf("a slow command: %+v", r)
+	}
+	r = execRun(Cmd{Name: "no-such-program-anywhere"})
+	if r.Error != "not-found" {
+		t.Fatalf("a missing program: %+v", r)
+	}
+	r = execRun(Cmd{Name: "cat", Stdin: "given"})
+	if r.Stdout != "given" {
+		t.Fatalf("stdin: %+v", r)
+	}
+	start := time.Now()
+	r = execRun(Cmd{Name: "sh", Args: []string{"-c", "echo kept; (sleep 3 &) ; exit 0"}, Detached: true})
+	if r.Status != 0 || strings.TrimSpace(r.Stdout) != "kept" || time.Since(start) > 2*time.Second {
+		t.Fatalf("a detached command returns when it exits, not when its child does: %+v after %s", r, time.Since(start))
+	}
+}
+
+func TestKitArgumentsAreReadStrictly(t *testing.T) {
+	args := map[string]any{"s": "x", "n": float64(5), "f": 1.5, "b": true, "l": []any{"a", "b"}}
+	if _, err := text(args, "missing"); err == nil {
+		t.Error("a missing required string")
+	}
+	if n, _ := optWhole(args, "n", 1, 1, 3); n != 3 {
+		t.Errorf("held to most: %d", n)
+	}
+	if _, err := optWhole(args, "n", 1, 6, 9); err == nil {
+		t.Error("below least")
+	}
+	if _, err := optWhole(args, "f", 1, 0, 9); err == nil {
+		t.Error("a fraction")
+	}
+	if l, _ := optList(args, "l"); len(l) != 2 {
+		t.Errorf("list: %v", l)
+	}
+	if b, _ := optFlag(args, "b", false); !b {
+		t.Error("flag")
+	}
+	if err := plainName("name", "--all"); err == nil {
+		t.Error("an option as a name")
+	}
+}

modules/docker-compose/cmd/docker-compose-tools/main.go

@@ -0,0 +1,199 @@
+// The docker-compose module's tools (novox/hq research 027/02, 026/05): the compose projects on this
+// machine, their containers, logs and rendered configuration, and bringing one up, down or round
+// again by its directory. A Go bundle the node's runtime launches over stdio (ADR 0188, ADR 0193); it
+// runs as the operator account, which reaches the container runtime through the docker group.
+package main
+
+import (
+	"fmt"
+	"os"
+
+	stdio "git.novox.be/novox/mesh-sdk/go"
+)
+
+var providedBy = map[string]string{
+	"docker": "the docker module installs the container runtime; this module adds compose to it",
+}
+
+func main() {
+	if err := stdio.Serve("", tools()); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+}
+
+// where is the argument schema every tool that acts on one project takes.
+var where = map[string]any{
+	"dir":     map[string]any{"type": "string", "description": "the project's directory, absolute: where its compose file is"},
+	"project": map[string]any{"type": "string", "description": "the project's name, for a project docker already knows (instead of dir)"},
+}
+
+func with(extra map[string]any) map[string]any {
+	out := map[string]any{}
+	for k, v := range where {
+		out[k] = v
+	}
+	for k, v := range extra {
+		out[k] = v
+	}
+	return out
+}
+
+var servicesArg = map[string]any{"type": "array", "items": map[string]any{"type": "string"}, "description": "only these services (default all)"}
+
+func tools() []stdio.Tool {
+	return []stdio.Tool{
+		{
+			Name: "docker_compose_projects",
+			Description: "The compose projects docker knows on this machine, running or stopped: name, status, working " +
+				"directory, compose files, services, and containers running of total. (r)",
+			Input: map[string]any{},
+			Run:   func(map[string]any) (any, error) { return Projects() },
+		},
+		{
+			Name:        "docker_compose_ps",
+			Description: "One project's containers: service, state, health, exit code, image and published ports. (r)",
+			Input:       with(nil),
+			Run: func(args map[string]any) (any, error) {
+				t, err := targetOf(args, false)
+				if err != nil {
+					return nil, err
+				}
+				return Ps(t)
+			},
+		},
+		{
+			Name: "docker_compose_logs",
+			Description: "One project's logs, the last lines of each service (default 200, at most 5000), optionally since a " +
+				"time (\"10m\", \"2026-10-04T12:00:00\"). Cut at 256 KiB. (r)",
+			Input: with(map[string]any{
+				"services": servicesArg,
+				"tail":     map[string]any{"type": "integer", "description": "lines per service (default 200, at most 5000)"},
+				"since":    map[string]any{"type": "string", "description": "only lines since this: a duration such as 10m or a timestamp"},
+			}),
+			Run: func(args map[string]any) (any, error) {
+				t, err := targetOf(args, false)
+				if err != nil {
+					return nil, err
+				}
+				services, err := optList(args, "services")
+				if err != nil {
+					return nil, err
+				}
+				n, err := optWhole(args, "tail", 200, 1, 5000)
+				if err != nil {
+					return nil, err
+				}
+				since, err := optText(args, "since", "")
+				if err != nil {
+					return nil, err
+				}
+				return Logs(t, services, n, since)
+			},
+		},
+		{
+			Name: "docker_compose_config",
+			Description: "A project's configuration as compose renders it: files merged, variables filled. Values of " +
+				"environment variables, build arguments and labels whose names suggest a secret are replaced with " +
+				"[redacted]. An invalid file is answered as the error compose gives. (r)",
+			Input: with(nil),
+			Run: func(args map[string]any) (any, error) {
+				t, err := targetOf(args, true)
+				if err != nil {
+					return nil, err
+				}
+				return Config(t)
+			},
+		},
+		{
+			Name: "docker_compose_up",
+			Description: "Bring a project up, detached: create and start its containers, building or pulling what is " +
+				"missing. Answers when finished, or after 18 s with a job to follow with docker_compose_job. (a)",
+			Input: with(map[string]any{
+				"services": servicesArg,
+				"build":    map[string]any{"type": "boolean", "description": "build images before starting (--build)"},
+				"pull":     map[string]any{"type": "string", "enum": []string{"missing", "always", "never"}, "description": "pull policy (default missing)"},
+			}),
+			Run: func(args map[string]any) (any, error) {
+				t, err := targetOf(args, true)
+				if err != nil {
+					return nil, err
+				}
+				services, err := optList(args, "services")
+				if err != nil {
+					return nil, err
+				}
+				build, err := optFlag(args, "build", false)
+				if err != nil {
+					return nil, err
+				}
+				pull, err := optText(args, "pull", "missing")
+				if err != nil {
+					return nil, err
+				}
+				return Up(t, services, build, pull)
+			},
+		},
+		{
+			Name: "docker_compose_down",
+			Description: "Stop and remove a project's containers and networks. Its volumes are kept: removing data is not " +
+				"this tool's. Answers when finished, or with a job to follow. (a)",
+			Input: with(nil),
+			Run: func(args map[string]any) (any, error) {
+				t, err := targetOf(args, false)
+				if err != nil {
+					return nil, err
+				}
+				return Down(t)
+			},
+		},
+		{
+			Name:        "docker_compose_restart",
+			Description: "Restart a project's containers, or some of its services. Answers when finished, or with a job to follow. (a)",
+			Input:       with(map[string]any{"services": servicesArg}),
+			Run: func(args map[string]any) (any, error) {
+				t, err := targetOf(args, false)
+				if err != nil {
+					return nil, err
+				}
+				services, err := optList(args, "services")
+				if err != nil {
+					return nil, err
+				}
+				return Restart(t, services)
+			},
+		},
+		{
+			Name:        "docker_compose_pull",
+			Description: "Pull a project's images, or some services', without starting anything. Answers when finished, or with a job to follow. (a)",
+			Input:       with(map[string]any{"services": servicesArg}),
+			Run: func(args map[string]any) (any, error) {
+				t, err := targetOf(args, true)
+				if err != nil {
+					return nil, err
+				}
+				services, err := optList(args, "services")
+				if err != nil {
+					return nil, err
+				}
+				return Pull(t, services)
+			},
+		},
+		{
+			Name: "docker_compose_job",
+			Description: "A long act this module started (up, down, restart, pull): running or finished, its exit status " +
+				"and the end of its output. Without job, every act this process knows, newest first. (r)",
+			Input: map[string]any{"job": map[string]any{"type": "string", "description": "the job id an act answered"}},
+			Run: func(args map[string]any) (any, error) {
+				id, err := optText(args, "job", "")
+				if err != nil {
+					return nil, err
+				}
+				if id == "" {
+					return map[string]any{"jobs": listJobs()}, nil
+				}
+				return jobByID(id)
+			},
+		},
+	}
+}

modules/docker-compose/cmd/docker-compose-tools/manifest_kit_test.go

@@ -0,0 +1,107 @@
+package main
+
+// manifest_kit_test.go is the same file in each workstation module: it reads the module's
+// definition so the module's own tests can hold it to what it says.
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+	"testing"
+)
+
+type manifest struct {
+	Module       string           `json:"module"`
+	Capabilities []string         `json:"capabilities"`
+	Claims       []any            `json:"claims"`
+	Seats        []any            `json:"seats"`
+	Tools        []string         `json:"tools"`
+	Resources    []map[string]any `json:"resources"`
+	Build        struct {
+		Artifacts []map[string]any `json:"artifacts"`
+	} `json:"build"`
+}
+
+func readManifest(t *testing.T) manifest {
+	t.Helper()
+	raw, err := os.ReadFile(filepath.Join("..", "..", "module.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var m manifest
+	if err := json.Unmarshal(raw, &m); err != nil {
+		t.Fatalf("module.json: %v", err)
+	}
+	return m
+}
+
+func (m manifest) resource(id string) map[string]any {
+	for _, r := range m.Resources {
+		if r["id"] == id {
+			return r
+		}
+	}
+	return nil
+}
+
+// packages are the packages the module installs, sorted.
+func (m manifest) packages() []string {
+	out := []string{}
+	for _, r := range m.Resources {
+		if r["type"] == "package" && r["absent"] != true {
+			out = append(out, r["package"].(string))
+		}
+	}
+	sort.Strings(out)
+	return out
+}
+
+// services are the units the module declares, by unit name.
+func (m manifest) services() map[string]map[string]any {
+	out := map[string]map[string]any{}
+	for _, r := range m.Resources {
+		if r["type"] == "service" {
+			out[r["unit"].(string)] = r
+		}
+	}
+	return out
+}
+
+// holdsTheBundle holds the manifest to the Go bundle this directory builds: every tool registered
+// is listed and nothing else, each named <prefix>_…, and the artifact builds this command.
+func holdsTheBundle(t *testing.T, m manifest, prefix string) {
+	t.Helper()
+	registered := []string{}
+	for _, tool := range tools() {
+		registered = append(registered, tool.Name)
+		if !strings.HasPrefix(tool.Name, prefix+"_") {
+			t.Errorf("tool %s is not named %s_…", tool.Name, prefix)
+		}
+		if tool.Description == "" || tool.Run == nil || tool.Input == nil {
+			t.Errorf("tool %s is not described, runnable and given an input schema", tool.Name)
+		}
+	}
+	if strings.Join(registered, ",") != strings.Join(m.Tools, ",") {
+		t.Errorf("registered %v, listed %v", registered, m.Tools)
+	}
+	if len(m.Build.Artifacts) != 1 {
+		t.Fatalf("one artifact, got %d", len(m.Build.Artifacts))
+	}
+	cwd, _ := os.Getwd()
+	binary := filepath.Base(cwd)
+	a := m.Build.Artifacts[0]
+	want := map[string]any{"kind": "bundle", "language": "go", "system": "arch", "from": "cmd/" + binary, "binary": binary}
+	for k, v := range want {
+		if a[k] != v {
+			t.Errorf("artifact %s = %v, want %v", k, a[k], v)
+		}
+	}
+	if loads, _ := a["loads"].([]any); len(loads) != 1 || loads[0] != binary {
+		t.Errorf("artifact loads %v, want [%s]", a["loads"], binary)
+	}
+	if m.Claims != nil || m.Seats != nil {
+		t.Errorf("claims %v, seats %v: this module holds no seat", m.Claims, m.Seats)
+	}
+}

modules/docker-compose/go.mod

@@ -0,0 +1,5 @@
+module docker-compose
+
+go 1.22
+
+require git.novox.be/novox/mesh-sdk/go v0.1.6

modules/docker-compose/go.sum

@@ -0,0 +1,2 @@
+git.novox.be/novox/mesh-sdk/go v0.1.6 h1:9qzdYONYbJdWcu6sxQcq9v1LI0JxcfkiKYkMUzJSkVQ=
+git.novox.be/novox/mesh-sdk/go v0.1.6/go.mod h1:GFuZUElBZ9A++mxgIKo97aXXo+kV0uJ/UkbhQPPIbrY=

modules/docker-compose/module.json

@@ -0,0 +1,40 @@
+{
+  "module": "docker-compose",
+  "version": "1",
+  "capabilities": [
+    "package-manager"
+  ],
+  "tools": [
+    "docker_compose_projects",
+    "docker_compose_ps",
+    "docker_compose_logs",
+    "docker_compose_config",
+    "docker_compose_up",
+    "docker_compose_down",
+    "docker_compose_restart",
+    "docker_compose_pull",
+    "docker_compose_job"
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "docker-compose"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/docker-compose-tools",
+        "binary": "docker-compose-tools",
+        "loads": [
+          "docker-compose-tools"
+        ]
+      }
+    ]
+  }
+}

modules/docker/README.md

@@ -0,0 +1,166 @@
+# docker
+
+The container runtime as a module (novox/hq to-be 42 phase 1, item 8; research 027/01–02; ADR 0166,
+ADR 0207). It claims the node seat `node-container-runtime`. That seat carries no verbs yet: its verbs,
+and the host creating containers through its holder, wait on ADR 0166's acceptance. Until then the
+tools below are the module's own.
+
+## What it declares
+
+| resource | what | the host's rule |
+|---|---|---|
+| `package` | `docker` | installed if absent; never uninstalled when the module goes |
+| `buildx` | `docker-buildx` | the same. Only the build machine has it today; `docker build` needs it for BuildKit everywhere |
+| `socket` | `docker.socket` running, enabled at boot | given back as found when the module goes (ADR 0118) |
+| `prune-service`, `prune-timer` | `/etc/systemd/system/docker-prune.{service,timer}`, written whole | removed with the module |
+| `prune` | `docker-prune.timer` running, enabled at boot; restarted when either file changes | stopped and disabled with the module (the mesh made the unit) |
+
+The weekly prune takes **dangling images and build cache unused for a week, and nothing else**. It
+takes no volume, no container and no image a container uses, so it never touches a container the mesh
+holds. It runs at idle priority, at a random point in the hour after the weekly mark. A run missed
+while the machine was off happens at the next boot.
+
+**Capabilities:** `package-manager`, `service-manager`, `privileged`. It does not declare
+`container-runtime`: under ADR 0165, which is still proposed, that word means a running daemon, and
+the module that installs the daemon cannot require it.
+
+## What it does not declare yet, and why
+
+Three things this module should own are already declared by other modules on every machine. The
+controller refuses two modules on one node that declare the same `path`, `unit`, `name` or `package`
+(`checkResources`, mesh-controller `internal/catalogue/resolve.go`). Declaring any of them here would
+make the module unassignable everywhere. The refusals were checked against the controller's own
+check:
+
+```
+zsh and docker both declare the name "${machine:account}"
+dnsmasq and docker both declare the path "/etc/docker/daemon.json"
+dnsmasq and docker both declare the unit "docker.service"
+```
+
+### 1. `/etc/docker/daemon.json` and `docker.service` (issue 190)
+
+Today the file has three writers. Each writes into it (`into: json`, ADR 0102) and reloads the
+service:
+
+- **`dnsmasq`** writes `dns` and `live-restore`, through `dnsmasq.runtime-dns` and `dnsmasq.runtime`.
+- **The private network**, generated by the controller (`internal/overlay/generator.go`), writes
+  `insecure-registries`. The collision check does not see generated resources.
+- **Nobody** writes log rotation. One machine has `log-driver` and `log-opts` by hand.
+
+**The change proposed, in one merge:**
+
+1. `dnsmasq` drops its `runtime-dns` and `runtime` resources.
+2. `docker` adds the two resources below:
+
+   ```json
+   {"id": "daemon", "type": "file", "path": "/etc/docker/daemon.json", "mode": "0644", "into": "json",
+    "content": "{\"dns\": [\"${machine:address}\"], \"live-restore\": true, \"log-driver\": \"json-file\", \"log-opts\": {\"max-size\": \"100m\", \"max-file\": \"5\"}}\n"},
+   {"id": "runtime", "type": "service", "unit": "docker.service", "state": "running", "boot": "enabled", "reload-on": ["daemon"]}
+   ```
+
+   The service is **reloaded, never restarted**: a restart stops every container. The daemon reads
+   `live-restore` on a reload. It reads `dns`, `log-driver` and `log-opts` only at its next start, so
+   they apply then (to containers created afterwards, for the log keys). With `live-restore` on, that
+   start keeps every container running.
+
+**Why one merge, and only after this module is on every machine:**
+
+- In one apply, the host first gives back the resources that are no longer declared, then applies
+  the new ones (mesh-host `apply.go`).
+- `dnsmasq` gives back `dns` and `live-restore` to what they held before it, and `docker` sets them
+  again in the same apply. The daemon is reloaded once, after both steps.
+- A machine pushed the new `dnsmasq` *without* this module would keep its pre-mesh values for both
+  keys. On one machine that is `live-restore: false`, and the next daemon restart there would stop
+  every container.
+
+**Later:** the controller hands the registry to this module as a value, and the overlay stops
+generating its two resources (issue 190, steps 2 and 5). Until then the overlay keeps writing its one
+key beside this module's. The host merges disjoint keys correctly; the mesh-host `into.go` record is
+per resource.
+
+### 2. The operator account's membership of the `docker` group
+
+The right shape is the host's `user` shape. Its `groups` are additive: the host runs
+`usermod --append` and never takes a group away.
+
+```json
+{"id": "group", "type": "user", "name": "${machine:account}", "groups": ["docker"]}
+```
+
+`zsh` already declares a `user` resource for the same account (its login shell). The controller
+compares `name` across modules, so the two collide.
+
+**The change proposed (mesh-controller, `checkResources`):** judge a `user` resource by the fields it
+sets, not by its name:
+
+- `shell` and `home` stay single-owner;
+- `groups` may be declared by any number of modules, because the host only adds them.
+
+Then this module declares the resource above, and no module has to carry another's group.
+
+Today the operator account is in the group on every machine, by hand. Nothing is lost while it waits.
+
+## The bootstrap's runtime
+
+On the machine the mesh was first installed on, the foundation bundle declared `package docker`
+(`container-runtime`) and `docker.service` running and enabled (`container-runtime-running`). ADR 0207
+§5 exempts them.
+
+- The host records them under their bare ids, with origin *carried*. A mesh declaration's orphan pass
+  never sees them (mesh-host `store.go`).
+- So `docker.package` here is a **second record of the same package**. The apply says "already
+  installed", and neither record ever uninstalls it.
+- This module does not declare `docker.service` today, so nothing overlaps there. The proposed step
+  1 would add a second record of that unit. Its found state is *running*, because genesis started
+  it, so undeclaring this module would leave the daemon running.
+
+## Tools
+
+The tools run as the operator account. If the daemon's socket refuses that account, a call is asked
+again through `sudo -n` (a process keeps the groups it started with). Every call has a 20 s bound.
+A failure is an error naming how it failed, never an empty answer.
+
+**Every container on the machine is in scope.** A container the mesh holds carries the host's label
+`mesh-host.id` (its value names the assignment), and every answer says `mesh_held`.
+
+| tool | | what |
+|---|---|---|
+| `docker_list` | r | every container: image, state, health, restarts, ports, mounts, compose project, `mesh_held`; filter by owner, state or name |
+| `docker_inspect` | r | one container whole, **environment values left out** (names kept) |
+| `docker_logs` | r | the last lines of both streams, merged in order, with timestamps (default 200, at most 2000) |
+| `docker_stats` | r | CPU, memory, I/O and process count per running container, heaviest first |
+| `docker_start` / `docker_stop` / `docker_restart` | a | one container. On a mesh-held one, the answer says the host restores its declared state at its next apply |
+| `docker_top` | r | the processes inside one container |
+| `docker_images` | r | images, largest first, with the containers using each; `dangling`, `unused` or `used` |
+| `docker_prune` | a | dangling images and build cache, and stopped containers the mesh does not hold if `containers` is true. **A dry run unless `dry_run` is false. Never a volume** |
+| `docker_disk_usage` | r | `docker system df -v`: total, active and reclaimable per kind, with the largest of each |
+| `docker_networks` | r | networks, subnets, and the containers on each |
+| `docker_volumes` | r | volumes, who mounts each, whether the mesh holds one of them, anonymous or not, and sizes if asked |
+| `docker_events` | r | the runtime's events over a window ending now (default 60 min, at most 24 h), without exec noise |
+| `docker_daemon_config` | r | `daemon.json` as on disk, `docker info`'s essentials, and keys the daemon has not taken yet |
+| `docker_unlabelled` | r | the containers the mesh does not hold: the cleanup list |
+| `docker_problems` | r | unhealthy, restarting, dead, killed for memory, failed, or restarted five times or more |
+| `docker_ports` | r | every published port, and the containers on the host's network |
+
+## Tests
+
+```
+go test ./...
+```
+
+The tests run against a fake runner and cover:
+
+- escalation through `sudo -n` on a refused socket, and never as root;
+- each failure named by its cause;
+- a name or id never read as an option;
+- mesh-held marking;
+- the environment left out of `inspect`;
+- the restore note on a mesh-held act;
+- prune being a dry run by default and never reaching a volume, a mesh container or `--volumes`;
+- the log merge;
+- size parsing;
+- what the daemon has not yet taken;
+- event filtering;
+- volume ownership;
+- that the tools served are exactly the manifest's `tools`.

modules/docker/cmd/docker-tools/docker_test.go

@@ -0,0 +1,360 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"io/fs"
+	"os"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+)
+
+type call struct {
+	name string
+	args []string
+}
+
+// fake answers each command by the first rule whose prefix matches "name arg arg…".
+type fake struct {
+	rules []rule
+	calls []call
+}
+
+type rule struct {
+	prefix string
+	ran    Ran
+}
+
+func (f *fake) on(prefix string, r Ran) *fake { f.rules = append(f.rules, rule{prefix, r}); return f }
+
+func (f *fake) run(_ context.Context, name string, args ...string) Ran {
+	f.calls = append(f.calls, call{name, args})
+	line := strings.Join(append([]string{name}, args...), " ")
+	for _, r := range f.rules {
+		if strings.HasPrefix(line, r.prefix) {
+			return r.ran
+		}
+	}
+	return Ran{Status: 1, Stderr: "unexpected: " + line}
+}
+
+func (f *fake) ran(prefix string) bool {
+	for _, c := range f.calls {
+		if strings.HasPrefix(strings.Join(append([]string{c.name}, c.args...), " "), prefix) {
+			return true
+		}
+	}
+	return false
+}
+
+func client(f *fake, uid int) *Client {
+	return &Client{Run: f.run, UID: uid, ReadFile: func(string) ([]byte, error) { return nil, fs.ErrNotExist },
+		Now: func() time.Time { return time.Date(2026, 10, 4, 12, 0, 0, 0, time.UTC) }}
+}
+
+const held = `{"Id":"aaaaaaaaaaaaaaaa","Name":"/mesh-web","Created":"2026-10-01T00:00:00Z","Image":"sha256:img1",
+ "Config":{"Image":"web:1","Labels":{"mesh-host.id":"hello-web.server","mesh-host.spec":"x"},"Env":["PASSWORD=hunter2","PATH=/bin"]},
+ "State":{"Status":"running","Running":true,"StartedAt":"2026-10-01T00:00:01Z","FinishedAt":"0001-01-01T00:00:00Z","Health":{"Status":"healthy"}},
+ "HostConfig":{"RestartPolicy":{"Name":"unless-stopped"},"NetworkMode":"bridge"},
+ "NetworkSettings":{"Ports":{"80/tcp":[{"HostIp":"0.0.0.0","HostPort":"8080"}]}},
+ "Mounts":[{"Type":"volume","Name":"webdata","Destination":"/data","RW":true}]}`
+
+const stray = `{"Id":"bbbbbbbbbbbbbbbb","Name":"/dev-db","Created":"2026-09-01T00:00:00Z","Image":"sha256:img2",
+ "Config":{"Image":"postgres:16","Labels":{"com.docker.compose.project":"dev","com.docker.compose.project.working_dir":"/home/op/dev"}},
+ "State":{"Status":"exited","ExitCode":1,"FinishedAt":"2026-09-02T00:00:00Z"},
+ "HostConfig":{"RestartPolicy":{"Name":"no"}},"NetworkSettings":{"Ports":{}},
+ "Mounts":[{"Type":"volume","Name":"dbdata","Destination":"/var/lib/postgresql/data","RW":true}]}`
+
+func machine() *fake {
+	return (&fake{}).
+		on("docker ps --all --quiet --no-trunc", Ran{Stdout: "aaaaaaaaaaaaaaaa\nbbbbbbbbbbbbbbbb\n"}).
+		on("docker container inspect aaaaaaaaaaaaaaaa bbbbbbbbbbbbbbbb", Ran{Stdout: "[" + held + "," + stray + "]"}).
+		on("docker container inspect mesh-web", Ran{Stdout: "[" + held + "]"}).
+		on("docker container inspect dev-db", Ran{Stdout: "[" + stray + "]"})
+}
+
+func TestARefusedSocketIsAskedAgainThroughSudoWithoutAPromptUnlessThisIsRoot(t *testing.T) {
+	denied := Ran{Status: 1, Stderr: "permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get ...: dial unix /var/run/docker.sock: connect: permission denied\n"}
+	f := (&fake{}).on("docker ", denied).on("sudo -n docker info", Ran{Stdout: "{}"})
+	if _, err := client(f, 1000).docker(context.Background(), "info", "--format", "{{json .}}"); err != nil {
+		t.Fatal(err)
+	}
+	if !f.ran("sudo -n docker info --format") {
+		t.Fatalf("not escalated: %+v", f.calls)
+	}
+	f = (&fake{}).on("docker ", denied)
+	if _, err := client(f, 0).docker(context.Background(), "info"); err == nil || f.ran("sudo") {
+		t.Fatalf("root escalated or answered: %v %+v", err, f.calls)
+	}
+}
+
+func TestFailuresAreNamedByHowTheyFailed(t *testing.T) {
+	denied := Ran{Status: 1, Stderr: "permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock\n"}
+	cases := map[string]*fake{
+		"may not escalate without a prompt": (&fake{}).on("docker ", denied).on("sudo ", Ran{Status: 1, Stderr: "sudo: a password is required\n"}),
+		"sudo is not installed":             (&fake{}).on("docker ", denied).on("sudo ", Ran{Status: 127, Err: "ENOENT"}),
+		"docker is not installed":           (&fake{}).on("docker ", Ran{Status: 127, Err: "ENOENT"}),
+		"daemon is not answering":           (&fake{}).on("docker ", Ran{Status: 1, Stderr: "Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?\n"}),
+		"did not answer: no answer within":  (&fake{}).on("docker ", Ran{Status: 124, Err: "no answer within 20 s"}),
+		"docker info failed (3): boom":      (&fake{}).on("docker ", Ran{Status: 3, Stderr: "boom\n"}),
+	}
+	for want, f := range cases {
+		_, err := client(f, 1000).docker(context.Background(), "info")
+		if err == nil || !strings.Contains(err.Error(), want) {
+			t.Errorf("want %q, got %v", want, err)
+		}
+	}
+}
+
+func TestANameIsNeverAnOption(t *testing.T) {
+	for _, bad := range []string{"--help", "-v", "", "a b", "x;y"} {
+		if _, err := Ref(bad); err == nil {
+			t.Errorf("%q accepted", bad)
+		}
+	}
+	for _, good := range []string{"mesh-web", "aaaaaaaaaaaa", "registry.mesh.internal:5100/x@sha256:abc", "dev_db.1"} {
+		if _, err := Ref(good); err != nil {
+			t.Errorf("%q refused: %v", good, err)
+		}
+	}
+	f := machine()
+	for _, verb := range []string{"start", "stop", "restart"} {
+		if _, err := client(f, 1000).Act(context.Background(), verb, "--rm"); err == nil {
+			t.Errorf("%s took an option", verb)
+		}
+	}
+	if len(f.calls) != 0 {
+		t.Fatalf("docker was called: %+v", f.calls)
+	}
+}
+
+func TestEveryContainerIsListedAndTheMeshsAreMarked(t *testing.T) {
+	c := client(machine(), 1000)
+	all, err := c.Containers(context.Background(), "", "", "")
+	if err != nil || len(all) != 2 {
+		t.Fatalf("%v %+v", err, all)
+	}
+	web, db := all[1], all[0]
+	if !web.MeshHeld || web.HeldBy != "hello-web.server" || web.Module != "hello-web" || web.Health != "healthy" {
+		t.Errorf("held: %+v", web)
+	}
+	if !reflect.DeepEqual(web.Ports, []string{"0.0.0.0:8080->80/tcp"}) || web.Mounts[0].Name != "webdata" {
+		t.Errorf("ports/mounts: %+v", web)
+	}
+	if db.MeshHeld || db.Compose != "dev" || db.ComposeDir != "/home/op/dev" || db.FinishedAt == "" {
+		t.Errorf("stray: %+v", db)
+	}
+	mesh, _ := c.Containers(context.Background(), "mesh", "", "")
+	other, _ := c.Containers(context.Background(), "other", "", "")
+	if len(mesh) != 1 || mesh[0].Name != "mesh-web" || len(other) != 1 || other[0].Name != "dev-db" {
+		t.Errorf("held filter: %+v / %+v", mesh, other)
+	}
+	if _, err := c.Containers(context.Background(), "mine", "", ""); err == nil {
+		t.Error("an unknown held filter was accepted")
+	}
+}
+
+func TestNoContainersIsAnEmptyListAndAFailureIsAnError(t *testing.T) {
+	got, err := client((&fake{}).on("docker ps", Ran{}), 1000).Containers(context.Background(), "", "", "")
+	if err != nil || got == nil || len(got) != 0 {
+		t.Fatalf("%v %v", got, err)
+	}
+	if _, err := client((&fake{}).on("docker ps", Ran{Status: 1, Stderr: "Cannot connect to the Docker daemon\n"}), 1000).Containers(context.Background(), "", "", ""); err == nil {
+		t.Fatal("a daemon that does not answer read as no containers")
+	}
+}
+
+func TestInspectLeavesTheEnvironmentsValuesOut(t *testing.T) {
+	got, err := client(machine(), 1000).Inspect(context.Background(), "mesh-web")
+	if err != nil {
+		t.Fatal(err)
+	}
+	b, _ := json.Marshal(got)
+	if strings.Contains(string(b), "hunter2") || !strings.Contains(string(b), `"PASSWORD"`) || got["mesh_held"] != true {
+		t.Fatalf("%s", b)
+	}
+}
+
+func TestActingOnAMeshContainerSaysTheHostRestoresIt(t *testing.T) {
+	f := machine().on("docker stop", Ran{}).on("docker start", Ran{})
+	got, err := client(f, 1000).Act(context.Background(), "stop", "mesh-web")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !f.ran("docker stop --time 10 mesh-web") || got["mesh_held"] != true || !strings.Contains(got["note"].(string), "host restores") {
+		t.Fatalf("%v %+v", got, f.calls)
+	}
+	got, _ = client(f, 1000).Act(context.Background(), "start", "dev-db")
+	if _, noted := got["note"]; noted || got["mesh_held"] != false {
+		t.Fatalf("a stray was noted: %v", got)
+	}
+}
+
+func TestPruneIsADryRunByDefaultAndNeverTouchesAVolumeOrAMeshContainer(t *testing.T) {
+	f := machine().
+		on("docker image ls --no-trunc --filter dangling=true", Ran{Stdout: `{"ID":"sha256:dead","Size":"1.5GB"}` + "\n"}).
+		on("docker system df --format", Ran{Stdout: `{"Type":"Build Cache","TotalCount":"3","Size":"2GB","Reclaimable":"1GB"}` + "\n"}).
+		on("docker image prune", Ran{Stdout: "Deleted Images:\nx\n\nTotal reclaimed space: 1.5GB\n"}).
+		on("docker builder prune", Ran{Stdout: "Total:\t1GB\n"}).
+		on("docker container rm", Ran{})
+	c := client(f, 1000)
+	got, err := c.Prune(context.Background(), PruneAsk{Images: true, BuildCache: true, Containers: true, DryRun: true})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if f.ran("docker image prune") || f.ran("docker builder prune") || f.ran("docker container rm") {
+		t.Fatalf("a dry run removed something: %+v", f.calls)
+	}
+	if got["images"].(map[string]any)["dangling"] != 1 || !reflect.DeepEqual(got["containers"].(map[string]any)["stopped_not_held"], []string{"dev-db"}) {
+		t.Fatalf("%v", got)
+	}
+	got, err = c.Prune(context.Background(), PruneAsk{Images: true, BuildCache: true, Containers: true, OlderThanH: 24})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !f.ran("docker image prune --force --filter until=24h") || !f.ran("docker builder prune --force --filter until=24h") || !f.ran("docker container rm dev-db") {
+		t.Fatalf("not pruned: %+v", f.calls)
+	}
+	for _, c := range f.calls {
+		line := strings.Join(c.args, " ")
+		if strings.Contains(line, "volume") || strings.Contains(line, "mesh-web") && c.args[0] != "container" || strings.Contains(line, "--volumes") || strings.Contains(line, "--all") && c.args[0] != "ps" {
+			t.Errorf("prune reached too far: %s", line)
+		}
+	}
+	if got["images"].(map[string]any)["reclaimed"] != "1.5GB" || got["build_cache"].(map[string]any)["reclaimed"] != "1GB" {
+		t.Errorf("reclaimed: %v", got)
+	}
+}
+
+func TestLogsMergeBothStreamsInOrderAndKeepTheTail(t *testing.T) {
+	f := (&fake{}).on("docker logs", Ran{Stdout: "2026-10-04T10:00:01Z out one\n2026-10-04T10:00:03Z out two\n", Stderr: "2026-10-04T10:00:02Z err one\n"})
+	got, err := client(f, 1000).Logs(context.Background(), "web", 2, "30m")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(got["lines"], []string{"2026-10-04T10:00:02Z err one", "2026-10-04T10:00:03Z out two"}) {
+		t.Fatalf("%v", got["lines"])
+	}
+	if !f.ran("docker logs --timestamps --tail 2 --since 30m web") {
+		t.Fatalf("%+v", f.calls)
+	}
+	if _, err := client(f, 1000).Logs(context.Background(), "web", 2, "--follow"); err == nil {
+		t.Fatal("since took an option")
+	}
+	f = (&fake{}).on("docker logs", Ran{Status: 1, Stderr: "Error response from daemon: No such container: nope\n"})
+	if _, err := client(f, 1000).Logs(context.Background(), "nope", 2, ""); err == nil {
+		t.Fatal("a missing container read as no lines")
+	}
+}
+
+func TestSizesAreReadAsDockerPrintsThem(t *testing.T) {
+	for in, want := range map[string]int64{"0B": 0, "55.63GB": 55630000000, "33.2MiB": 34812723, "1.5kB": 1500, "12MB (34%)": 12000000, "N/A": -1} {
+		if got := Bytes(in); got != want {
+			t.Errorf("%s: %d, want %d", in, got, want)
+		}
+	}
+}
+
+func TestDaemonConfigSaysWhatTheDaemonHasNotTakenYet(t *testing.T) {
+	f := (&fake{}).on("docker info", Ran{Stdout: `{"ServerVersion":"29.8.2","LiveRestoreEnabled":false,"LoggingDriver":"json-file","RegistryConfig":{"IndexConfigs":{"docker.io":{"Secure":true},"registry.mesh.internal:5100":{"Secure":false}}}}`})
+	c := client(f, 1000)
+	c.ReadFile = func(string) ([]byte, error) {
+		return []byte(`{"live-restore": true, "dns": ["10.0.0.1"], "log-driver": "local"}`), nil
+	}
+	got, err := c.DaemonConfig(context.Background())
+	if err != nil {
+		t.Fatal(err)
+	}
+	pending := strings.Join(got["pending"].([]string), "\n")
+	if !strings.Contains(pending, "live-restore is true in the file and false") || !strings.Contains(pending, "log-driver is local") {
+		t.Errorf("pending: %s", pending)
+	}
+	if !reflect.DeepEqual(got["daemon"].(map[string]any)["InsecureRegistries"], []string{"registry.mesh.internal:5100"}) {
+		t.Errorf("registries: %v", got["daemon"])
+	}
+	if !reflect.DeepEqual(got["read_only_at_start"], []string{"dns", "log-driver"}) {
+		t.Errorf("start-only: %v", got["read_only_at_start"])
+	}
+	c.ReadFile = func(string) ([]byte, error) { return nil, os.ErrNotExist }
+	got, _ = c.DaemonConfig(context.Background())
+	if !strings.HasPrefix(got["file_state"].(string), "absent") {
+		t.Errorf("absent: %v", got["file_state"])
+	}
+	c.ReadFile = func(string) ([]byte, error) { return nil, errors.New("permission denied") }
+	got, _ = c.DaemonConfig(context.Background())
+	if !strings.HasPrefix(got["file_state"].(string), "unreadable") {
+		t.Errorf("unreadable: %v", got["file_state"])
+	}
+}
+
+func TestEventsAreABoundedWindowWithoutExecNoise(t *testing.T) {
+	out := `{"Type":"container","Action":"exec_start: pg_isready","Actor":{"ID":"aaaaaaaaaaaaaaaa","Attributes":{"name":"db"}},"timeNano":1}
+{"Type":"container","Action":"die","Actor":{"ID":"aaaaaaaaaaaaaaaa","Attributes":{"name":"web","mesh-host.id":"hello-web.server","exitCode":"137"}},"timeNano":2}
+`
+	f := (&fake{}).on("docker events", Ran{Stdout: out})
+	got, err := client(f, 1000).Events(context.Background(), 30, "container", 10, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	evs := got["events"].([]map[string]any)
+	if len(evs) != 1 || evs[0]["action"] != "die" || evs[0]["mesh_held"] != true || evs[0]["exit_code"] != "137" {
+		t.Fatalf("%v", evs)
+	}
+	if !f.ran("docker events --since 30m --until 0s --format {{json .}} --filter type=container") {
+		t.Fatalf("%+v", f.calls)
+	}
+	if _, err := client(f, 1000).Events(context.Background(), 30, "secret", 10, false); err == nil {
+		t.Fatal("an unknown type was accepted")
+	}
+}
+
+func TestVolumesSayWhoMountsThemAndWhetherTheMeshDoes(t *testing.T) {
+	f := machine().
+		on("docker volume ls --quiet", Ran{Stdout: "webdata\ndbdata\nloose\n"}).
+		on("docker volume inspect", Ran{Stdout: `[{"Name":"webdata","Driver":"local"},{"Name":"dbdata","Driver":"local"},{"Name":"loose","Driver":"local","Labels":{"com.docker.volume.anonymous":""}}]`})
+	got, err := client(f, 1000).Volumes(context.Background(), false, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	vols := got["volumes"].([]map[string]any)
+	if vols[0]["mesh_held"] != true || vols[1]["mesh_held"] != false || len(vols[2]["mounted_by"].([]map[string]any)) != 0 || vols[2]["anonymous"] != true {
+		t.Fatalf("%v", vols)
+	}
+	got, _ = client(f, 1000).Volumes(context.Background(), true, false)
+	if got["count"] != 1 {
+		t.Fatalf("unmounted: %v", got)
+	}
+}
+
+func TestImagesNameTheirUsers(t *testing.T) {
+	f := machine().on("docker image ls", Ran{Stdout: `{"ID":"sha256:img1","Repository":"web","Tag":"1","Size":"100MB"}
+{"ID":"sha256:img3","Repository":"<none>","Tag":"<none>","Size":"2GB"}
+`})
+	got, err := client(f, 1000).Images(context.Background(), "", "", 10)
+	if err != nil {
+		t.Fatal(err)
+	}
+	imgs := got["images"].([]Image)
+	if imgs[0].ID != "sha256:img3" || !imgs[0].Dangling || imgs[1].UsedBy[0] != "mesh-web" || !imgs[1].MeshUsed {
+		t.Fatalf("%+v", imgs)
+	}
+	got, _ = client(f, 1000).Images(context.Background(), "unused", "", 10)
+	if got["count"] != 1 {
+		t.Fatalf("unused: %v", got)
+	}
+}
+
+func TestProblemsNameWhyAndUnlabelledIsTheCleanupList(t *testing.T) {
+	c := client(machine(), 1000)
+	p, err := c.Problems(context.Background())
+	if err != nil || len(p) != 1 || p[0]["name"] != "dev-db" || p[0]["why"].([]string)[0] != "exited 1" {
+		t.Fatalf("%v %v", p, err)
+	}
+	u, err := c.Unlabelled(context.Background())
+	if err != nil || u["count"] != 1 {
+		t.Fatalf("%v %v", u, err)
+	}
+}

modules/docker/cmd/docker-tools/main.go

@@ -0,0 +1,279 @@
+// docker's Go tools bundle (novox/hq ADR 0188, ADR 0193): a process the node's tool runtime launches
+// and speaks MCP over stdio to, through the Go SDK. It answers for every container on this machine —
+// the mesh's and every other — and for the runtime's images, networks, volumes, events and
+// configuration. It runs as the operator account (ADR 0175 §4); docker.go says how it reaches the
+// daemon's socket. The host applies the module's resources; these tools answer about the runtime.
+package main
+
+import (
+	"context"
+	"fmt"
+	"math"
+	"os"
+	"strings"
+
+	stdio "git.novox.be/novox/mesh-sdk/go"
+)
+
+func main() {
+	// An empty name serves as the module the runtime names (MESH_SERVED_MODULE): docker.
+	if err := stdio.Serve("", tools(NewClient())); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+}
+
+var containerArg = map[string]any{"type": "string", "description": "the container's name or id"}
+
+func tools(c *Client) []stdio.Tool {
+	ctx := context.Background()
+	act := func(verb, description string) stdio.Tool {
+		return stdio.Tool{
+			Name: "docker_" + verb, Description: description,
+			Input: map[string]any{"container": containerArg},
+			Run: func(args map[string]any) (any, error) {
+				ref, err := text(args, "container")
+				if err != nil {
+					return nil, err
+				}
+				return c.Act(ctx, verb, ref)
+			},
+		}
+	}
+	return []stdio.Tool{
+		{
+			Name: "docker_list",
+			Description: "Every container on this machine — the mesh's and every other — with its image, state, health, restarts, " +
+				"published ports, mounts, compose project, and mesh_held/held_by (the assignment that holds it).",
+			Input: map[string]any{
+				"held":  map[string]any{"type": "string", "enum": []string{"all", "mesh", "other"}, "description": "whose: all (default), the mesh's, or the others"},
+				"state": map[string]any{"type": "string", "description": "only containers in this state (running, exited, created, restarting, paused, dead)"},
+				"match": map[string]any{"type": "string", "description": "only containers whose name or image contains this"},
+			},
+			Run: func(args map[string]any) (any, error) {
+				list, err := c.Containers(ctx, optional(args, "held"), optional(args, "state"), optional(args, "match"))
+				if err != nil {
+					return nil, err
+				}
+				return map[string]any{"count": len(list), "containers": list}, nil
+			},
+		},
+		{
+			Name:        "docker_inspect",
+			Description: "One container whole, as docker inspects it, with mesh_held; its environment's values are left out (names kept), because that is where a container's secrets are.",
+			Input:       map[string]any{"container": containerArg},
+			Run: func(args map[string]any) (any, error) {
+				ref, err := text(args, "container")
+				if err != nil {
+					return nil, err
+				}
+				return c.Inspect(ctx, ref)
+			},
+		},
+		{
+			Name:        "docker_logs",
+			Description: "The last lines one container wrote, both streams merged in order, each with its timestamp (default 200, at most 2000 lines; a line is cut at 4 KiB).",
+			Input: map[string]any{
+				"container": containerArg,
+				"lines":     map[string]any{"type": "integer", "description": "how many lines from the end (default 200, at most 2000)"},
+				"since":     map[string]any{"type": "string", "description": "only lines since then: a duration such as 30m or 2h, or a time"},
+			},
+			Run: func(args map[string]any) (any, error) {
+				ref, err := text(args, "container")
+				if err != nil {
+					return nil, err
+				}
+				n, err := bounded(args, "lines", 200, 2000)
+				if err != nil {
+					return nil, err
+				}
+				return c.Logs(ctx, ref, n, optional(args, "since"))
+			},
+		},
+		{
+			Name:        "docker_stats",
+			Description: "What the running containers use now — CPU, memory, network and disk I/O, processes — the heaviest by memory first; or one container's.",
+			Input:       map[string]any{"container": map[string]any{"type": "string", "description": "one container (optional)"}},
+			Run: func(args map[string]any) (any, error) {
+				stats, err := c.Stats(ctx, optional(args, "container"))
+				if err != nil {
+					return nil, err
+				}
+				return map[string]any{"count": len(stats), "containers": stats}, nil
+			},
+		},
+		act("start", "Start one container. A container the mesh holds is started too, and the answer says the host restores what its declaration says at its next apply."),
+		act("stop", "Stop one container (ten seconds, then killed). For a container the mesh holds, the answer says the host will start it again at its next apply if its declaration says running."),
+		act("restart", "Restart one container (ten seconds to stop, then killed); the answer says whether the mesh holds it."),
+		{
+			Name:        "docker_top",
+			Description: "The processes running inside one container: pid, user, elapsed time, CPU, resident memory and command.",
+			Input:       map[string]any{"container": containerArg},
+			Run: func(args map[string]any) (any, error) {
+				ref, err := text(args, "container")
+				if err != nil {
+					return nil, err
+				}
+				return c.Top(ctx, ref)
+			},
+		},
+		{
+			Name: "docker_images",
+			Description: "The images on this machine, the largest first, each with its size and the containers using it (and whether one of them is the mesh's). " +
+				"filter: all, dangling, unused or used.",
+			Input: map[string]any{
+				"filter": map[string]any{"type": "string", "enum": []string{"all", "dangling", "unused", "used"}, "description": "which images (default all)"},
+				"match":  map[string]any{"type": "string", "description": "only images whose repository:tag contains this"},
+				"limit":  map[string]any{"type": "integer", "description": "how many to show (default 100, at most 1000); count says how many matched"},
+			},
+			Run: func(args map[string]any) (any, error) {
+				n, err := bounded(args, "limit", 100, 1000)
+				if err != nil {
+					return nil, err
+				}
+				return c.Images(ctx, optional(args, "filter"), optional(args, "match"), n)
+			},
+		},
+		{
+			Name: "docker_prune",
+			Description: "Reclaim space: dangling images and unused build cache, and — only when containers is true — stopped containers the mesh does not hold. " +
+				"Never a volume, never a container the mesh holds, never an image a container uses. A dry run by default: it lists what would go; dry_run false removes it.",
+			Input: map[string]any{
+				"dry_run":          map[string]any{"type": "boolean", "description": "list only (default true)"},
+				"images":           map[string]any{"type": "boolean", "description": "dangling images (default true)"},
+				"build_cache":      map[string]any{"type": "boolean", "description": "build cache nothing refers to (default true)"},
+				"containers":       map[string]any{"type": "boolean", "description": "stopped containers the mesh does not hold (default false); what they mounted is kept"},
+				"older_than_hours": map[string]any{"type": "integer", "description": "only what is older than this many hours (default 0: any age)"},
+			},
+			Run: func(args map[string]any) (any, error) {
+				older := 0
+				if v, ok := args["older_than_hours"]; ok && v != nil && v != float64(0) {
+					n, err := bounded(args, "older_than_hours", 0, 24*365)
+					if err != nil {
+						return nil, err
+					}
+					older = n
+				}
+				return c.Prune(ctx, PruneAsk{
+					DryRun: flag(args, "dry_run", true), Images: flag(args, "images", true), BuildCache: flag(args, "build_cache", true),
+					Containers: flag(args, "containers", false), OlderThanH: older,
+				})
+			},
+		},
+		{
+			Name:        "docker_disk_usage",
+			Description: "What the runtime takes on disk (docker system df -v): per kind — images, containers, volumes, build cache — the total, the active and the reclaimable, and the largest of each.",
+			Input:       map[string]any{"top": map[string]any{"type": "integer", "description": "how many of the largest per kind (default 10, at most 100)"}},
+			Run: func(args map[string]any) (any, error) {
+				n, err := bounded(args, "top", 10, 100)
+				if err != nil {
+					return nil, err
+				}
+				return c.DiskUsage(ctx, n)
+			},
+		},
+		{
+			Name:        "docker_networks",
+			Description: "Every network the runtime has: driver, scope, subnets and gateway, and the running containers on it with their addresses and whether the mesh holds them.",
+			Run:         func(map[string]any) (any, error) { return c.Networks(ctx) },
+		},
+		{
+			Name:        "docker_volumes",
+			Description: "Every volume with the containers mounting it, whether the mesh holds any of them, whether it is anonymous, its compose project, and — when sizes is true (slower) — its size.",
+			Input: map[string]any{
+				"unmounted": map[string]any{"type": "boolean", "description": "only volumes no container mounts (default false)"},
+				"sizes":     map[string]any{"type": "boolean", "description": "measure each volume (default false: it walks every volume)"},
+			},
+			Run: func(args map[string]any) (any, error) {
+				return c.Volumes(ctx, flag(args, "unmounted", false), flag(args, "sizes", false))
+			},
+		},
+		{
+			Name:        "docker_events",
+			Description: "What the runtime did in a window ending now (default the last 60 minutes, at most 24 hours): containers created, started, died, health changes, images pulled — with mesh_held. Exec events are left out unless asked.",
+			Input: map[string]any{
+				"minutes": map[string]any{"type": "integer", "description": "how far back (default 60, at most 1440)"},
+				"type":    map[string]any{"type": "string", "description": "only one kind: container, image, network, volume, daemon, plugin or builder"},
+				"limit":   map[string]any{"type": "integer", "description": "the latest this many (default 200, at most 2000)"},
+				"execs":   map[string]any{"type": "boolean", "description": "include exec_* events (default false: health checks make many)"},
+			},
+			Run: func(args map[string]any) (any, error) {
+				minutes, err := bounded(args, "minutes", 60, 1440)
+				if err != nil {
+					return nil, err
+				}
+				limit, err := bounded(args, "limit", 200, 2000)
+				if err != nil {
+					return nil, err
+				}
+				return c.Events(ctx, minutes, optional(args, "type"), limit, flag(args, "execs", false))
+			},
+		},
+		{
+			Name: "docker_daemon_config",
+			Description: "The runtime's configuration: /etc/docker/daemon.json as it is on disk, the daemon's essentials as it runs now (docker info: version, storage and logging drivers, " +
+				"live restore, root directory, insecure registries, warnings), and where the two differ — keys a reload or only a restart would take.",
+			Run: func(map[string]any) (any, error) { return c.DaemonConfig(ctx) },
+		},
+		{
+			Name:        "docker_unlabelled",
+			Description: "The containers the mesh does not hold — the cleanup list — each with its image, state, compose project and directory, ports and mounts.",
+			Run:         func(map[string]any) (any, error) { return c.Unlabelled(ctx) },
+		},
+		{
+			Name:        "docker_problems",
+			Description: "Every container that is not well: unhealthy, restarting, dead, killed for memory, exited with a failure, or restarted five times or more — with whether the mesh holds it.",
+			Run: func(map[string]any) (any, error) {
+				p, err := c.Problems(ctx)
+				if err != nil {
+					return nil, err
+				}
+				return map[string]any{"count": len(p), "containers": p}, nil
+			},
+		},
+		{
+			Name:        "docker_ports",
+			Description: "Every port the containers publish on this machine (address:port -> container port), and the containers on the host's network, which publish whatever they listen on.",
+			Run: func(map[string]any) (any, error) {
+				p, err := c.Ports(ctx)
+				if err != nil {
+					return nil, err
+				}
+				return map[string]any{"count": len(p), "ports": p}, nil
+			},
+		},
+	}
+}
+
+func text(args map[string]any, key string) (string, error) {
+	s, _ := args[key].(string)
+	if s = strings.TrimSpace(s); s == "" {
+		return "", fmt.Errorf("%s is required", key)
+	}
+	return s, nil
+}
+
+func optional(args map[string]any, key string) string {
+	s, _ := args[key].(string)
+	return strings.TrimSpace(s)
+}
+
+func flag(args map[string]any, key string, def bool) bool {
+	if b, ok := args[key].(bool); ok {
+		return b
+	}
+	return def
+}
+
+// bounded is a whole number argument, defaulted when absent and held to a ceiling.
+func bounded(args map[string]any, key string, def, most int) (int, error) {
+	v, ok := args[key]
+	if !ok || v == nil {
+		return def, nil
+	}
+	f, ok := v.(float64)
+	if !ok || f != math.Trunc(f) || f < 1 {
+		return 0, fmt.Errorf("%s must be a whole number of at least 1", key)
+	}
+	return int(math.Min(f, float64(most))), nil
+}

modules/docker/cmd/docker-tools/runner.go

@@ -0,0 +1,59 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"os/exec"
+	"strings"
+	"time"
+)
+
+// Ran is what a command did: its output, its exit status, and why it never ran to an answer.
+type Ran struct {
+	Stdout string
+	Stderr string
+	Status int
+	// Err is "ENOENT" when the program is not installed, or says it was ended for taking too long.
+	Err string
+}
+
+// Runner runs one command, so every tool can be tested without a daemon.
+type Runner func(ctx context.Context, name string, args ...string) Ran
+
+// CallTimeout is how long one docker command may take: below the runtime's thirty-second call
+// limit, so a daemon that hangs is answered as such rather than as a call the runtime gave up on.
+const CallTimeout = 20 * time.Second
+
+// ExecRunner runs a command on this machine, bounded by CallTimeout.
+func ExecRunner(ctx context.Context, name string, args ...string) Ran {
+	ctx, cancel := context.WithTimeout(ctx, CallTimeout)
+	defer cancel()
+	cmd := exec.CommandContext(ctx, name, args...)
+	var out, errb bytes.Buffer
+	cmd.Stdout, cmd.Stderr = &out, &errb
+	err := cmd.Run()
+	r := Ran{Stdout: out.String(), Stderr: errb.String()}
+	var exitErr *exec.ExitError
+	switch {
+	case errors.Is(ctx.Err(), context.DeadlineExceeded):
+		r.Status, r.Err = 124, fmt.Sprintf("no answer within %d s", int(CallTimeout/time.Second))
+	case errors.Is(err, exec.ErrNotFound):
+		r.Status, r.Err = 127, "ENOENT"
+	case errors.As(err, &exitErr):
+		r.Status = exitErr.ExitCode()
+	case err != nil:
+		r.Status, r.Err = 1, err.Error()
+	}
+	return r
+}
+
+func firstLine(s string) string {
+	for _, l := range strings.Split(s, "\n") {
+		if l = strings.TrimSpace(l); l != "" {
+			return l
+		}
+	}
+	return ""
+}

modules/docker/cmd/docker-tools/tools_test.go

@@ -0,0 +1,60 @@
+package main
+
+import (
+	"encoding/json"
+	"os"
+	"reflect"
+	"sort"
+	"strings"
+	"testing"
+)
+
+func TestTheToolsServedAreTheToolsTheManifestNames(t *testing.T) {
+	raw, err := os.ReadFile("../../module.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var m struct {
+		Tools []string `json:"tools"`
+	}
+	if err := json.Unmarshal(raw, &m); err != nil {
+		t.Fatal(err)
+	}
+	served := []string{}
+	for _, tool := range tools(client(&fake{}, 1000)) {
+		if !strings.HasPrefix(tool.Name, "docker_") || tool.Description == "" || tool.Run == nil {
+			t.Errorf("tool %q", tool.Name)
+		}
+		served = append(served, tool.Name)
+	}
+	sort.Strings(served)
+	listed := append([]string{}, m.Tools...)
+	sort.Strings(listed)
+	if !reflect.DeepEqual(served, listed) {
+		t.Fatalf("served %v, manifest %v", served, listed)
+	}
+}
+
+func TestNumbersAreDefaultedAndBounded(t *testing.T) {
+	if n, _ := bounded(map[string]any{}, "lines", 200, 2000); n != 200 {
+		t.Error(n)
+	}
+	if n, _ := bounded(map[string]any{"lines": float64(99999)}, "lines", 200, 2000); n != 2000 {
+		t.Error(n)
+	}
+	for _, bad := range []any{float64(0), float64(-1), float64(1.5), "10"} {
+		if _, err := bounded(map[string]any{"lines": bad}, "lines", 200, 2000); err == nil {
+			t.Errorf("%v accepted", bad)
+		}
+	}
+}
+
+func TestAStopFromTheToolNeedsAContainer(t *testing.T) {
+	for _, tool := range tools(client(&fake{}, 1000)) {
+		if tool.Name == "docker_stop" {
+			if _, err := tool.Run(map[string]any{}); err == nil {
+				t.Fatal("a stop without a container was accepted")
+			}
+		}
+	}
+}

modules/docker/go.mod

@@ -0,0 +1,5 @@
+module docker
+
+go 1.22
+
+require git.novox.be/novox/mesh-sdk/go v0.1.6

modules/docker/go.sum

@@ -0,0 +1,2 @@
+git.novox.be/novox/mesh-sdk/go v0.1.6 h1:9qzdYONYbJdWcu6sxQcq9v1LI0JxcfkiKYkMUzJSkVQ=
+git.novox.be/novox/mesh-sdk/go v0.1.6/go.mod h1:GFuZUElBZ9A++mxgIKo97aXXo+kV0uJ/UkbhQPPIbrY=

modules/docker/module.json

@@ -0,0 +1,94 @@
+{
+  "module": "docker",
+  "version": "1",
+  "capabilities": [
+    "package-manager",
+    "service-manager",
+    "privileged"
+  ],
+  "claims": [
+    {
+      "name": "node-container-runtime",
+      "scope": "node"
+    }
+  ],
+  "tools": [
+    "docker_list",
+    "docker_inspect",
+    "docker_logs",
+    "docker_stats",
+    "docker_start",
+    "docker_stop",
+    "docker_restart",
+    "docker_top",
+    "docker_images",
+    "docker_prune",
+    "docker_disk_usage",
+    "docker_networks",
+    "docker_volumes",
+    "docker_events",
+    "docker_daemon_config",
+    "docker_unlabelled",
+    "docker_problems",
+    "docker_ports"
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "docker"
+    },
+    {
+      "id": "buildx",
+      "type": "package",
+      "package": "docker-buildx"
+    },
+    {
+      "id": "socket",
+      "type": "service",
+      "unit": "docker.socket",
+      "state": "running",
+      "boot": "enabled"
+    },
+    {
+      "id": "prune-service",
+      "type": "file",
+      "path": "/etc/systemd/system/docker-prune.service",
+      "mode": "0644",
+      "content": "# Generated by the mesh. Do not edit — module docker writes this file and replaces it at every push.\n[Unit]\nDescription=Prune dangling images and unused build cache (the mesh's docker module)\n# Never volumes, never a container, never an image a container uses: dangling\n# images and build cache nothing refers to, unused for a week. What a person\n# prunes beyond that is docker_prune's, by hand.\nAfter=docker.service\nConditionPathExists=/run/docker.sock\n\n[Service]\nType=oneshot\nNice=19\nIOSchedulingClass=idle\nExecStart=/usr/bin/docker image prune --force --filter until=168h\nExecStart=/usr/bin/docker builder prune --force --filter until=168h\n"
+    },
+    {
+      "id": "prune-timer",
+      "type": "file",
+      "path": "/etc/systemd/system/docker-prune.timer",
+      "mode": "0644",
+      "content": "# Generated by the mesh. Do not edit — module docker writes this file and replaces it at every push.\n[Unit]\nDescription=Weekly prune of dangling images and unused build cache (the mesh's docker module)\n\n[Timer]\nOnCalendar=weekly\nRandomizedDelaySec=1h\nPersistent=true\n\n[Install]\nWantedBy=timers.target\n"
+    },
+    {
+      "id": "prune",
+      "type": "service",
+      "unit": "docker-prune.timer",
+      "state": "running",
+      "boot": "enabled",
+      "restart-on": [
+        "prune-service",
+        "prune-timer"
+      ]
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/docker-tools",
+        "binary": "docker-tools",
+        "loads": [
+          "docker-tools"
+        ]
+      }
+    ]
+  }
+}

modules/flatpak/README.md

@@ -0,0 +1,80 @@
+# flatpak
+
+Flatpak applications on the two workstations (novox/hq research 027/02: "`snapd` and `flatpak` are
+modules, on the two workstations only"; to-be 42 phase 2 step 9).
+
+## Owns
+
+| what | where |
+|---|---|
+| flatpak | package `flatpak` (official repositories) |
+
+**The Flathub remote comes with the package.** The package ships `flathub.flatpakrepo` in
+`/usr/share/flatpak/remotes.d`, and flatpak adds every file there to the system installation as a
+remote. The module therefore declares no remote file of its own. `flatpak_remotes` checks that the
+system installation has Flathub, and says so when it does not.
+
+The installed applications and runtimes, and their data, are the operator's: found (ADR 0182).
+
+## Improves
+
+- **The laptop gains flatpak**, which only the desktop had, with Flathub.
+- **Unused runtimes become visible and removable.** On the desktop on 2026-10-04, `/var/lib/flatpak`
+  held 5.1 GB for three applications. They are Nextcloud on KDE 6.7, Warehouse on GNOME 46, and Plex on
+  Freedesktop 23.08. Beside them sat the whole Freedesktop 22.08 platform, both of its GL extensions,
+  and older codec and style extensions that nothing uses. `flatpak_unused` lists them read-only;
+  `flatpak_remove_unused` lets flatpak remove them.
+- **A duplicate remote is named.** The desktop has Flathub configured twice, once in the system
+  installation and once in the account's, which has nothing installed from it. `flatpak_remotes`
+  reports it.
+
+## Tools
+
+All answer JSON; `(r)` reads, `(a)` acts. Reads run as the operator account. An act on the system
+installation (the default) goes through `sudo -n`; one on the account's own installation does not.
+
+| tool | what |
+|---|---|
+| `flatpak_list` (r) | applications: id, name, version, branch, origin, installation, size in bytes |
+| `flatpak_runtimes` (r) | runtimes and extensions, the same way |
+| `flatpak_remotes` (r) | both installations' remotes, how many refs come from each, findings |
+| `flatpak_updates` (r) | refs with a newer commit on their remote (needs the network) |
+| `flatpak_unused` (r) | runtimes nothing needs, computed without changing anything (below), with the space each takes |
+| `flatpak_disk_usage` (r) | each installation's directory on disk, and the 50 largest refs |
+| `flatpak_install` (a) | install from a remote (default `flathub`) into the system or the account installation |
+| `flatpak_remove` (a) | uninstall, keeping the application's data unless `delete_data` |
+| `flatpak_update` (a) | update one ref, or everything in an installation |
+| `flatpak_remove_unused` (a) | `uninstall --unused`: flatpak decides |
+| `flatpak_job` (r) | a long act's state and the end of its output |
+
+**Unused, computed.** `flatpak uninstall --unused` has no dry run: it asks, and answering *yes* removes.
+So the read tool works it out from what flatpak already says. A runtime is in use when one of these
+holds:
+
+- an installed application names it as its runtime or SDK;
+- it fills an extension point declared in the metadata of something in use, matched by id
+  (subdirectories included) and accepted version;
+- it is pinned.
+
+The SDK is counted as used to err on the safe side. flatpak's own `--unused` may also remove an
+application's SDK.
+
+**Acts are jobs.** An install or update downloads hundreds of megabytes. Each act runs inside the
+tool's process for up to 15 minutes, and is waited on for 18 s. A finished act is answered, and a
+failed one as an error. One still running is answered with a job id for `flatpak_job`.
+
+## What changes when it is assigned
+
+- **laptop:** `flatpak` is installed, with Flathub as the system remote. Nothing else.
+- **desktop:** nothing on disk; the package, installed by hand, becomes the mesh's.
+
+## The one-off step for the operator (ADR 0182)
+
+On the desktop, the account's own Flathub remote duplicates the system's and has nothing installed
+from it. If it is not wanted: `flatpak remote-delete --user flathub`, once. The mesh did not make it,
+so it does not remove it.
+
+## Leaves as found
+
+The applications and runtimes, the account installation under `~/.local/share/flatpak`, application
+data under `~/.var/app`, and any remote other than the package's Flathub.

modules/flatpak/cmd/flatpak-tools/flatpak.go

@@ -0,0 +1,501 @@
+package main
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"regexp"
+	"sort"
+	"strconv"
+	"strings"
+)
+
+// refs are an application or runtime id, optionally with arch and branch: org.gimp.GIMP,
+// org.freedesktop.Platform/x86_64/23.08, app/org.gimp.GIMP/x86_64/stable.
+var refs = regexp.MustCompile(`^((app|runtime)/)?[A-Za-z][A-Za-z0-9_-]*(\.[A-Za-z0-9_-]+)+(/[A-Za-z0-9_]*(/[A-Za-z0-9._-]*)?)?$`)
+
+func checkRef(r string) error {
+	if !refs.MatchString(r) {
+		return fmt.Errorf("%q is not a flatpak id or ref", r)
+	}
+	return nil
+}
+
+var remoteName = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9._-]*$`)
+
+// Ref is one installed application or runtime.
+type Ref struct {
+	ID           string `json:"id"`
+	Name         string `json:"name,omitempty"`
+	Version      string `json:"version,omitempty"`
+	Branch       string `json:"branch"`
+	Arch         string `json:"arch"`
+	Ref          string `json:"ref"`
+	Origin       string `json:"origin"`
+	Installation string `json:"installation"`
+	Size         string `json:"size"`
+	Bytes        int64  `json:"bytes"`
+}
+
+// sizeBytes reads flatpak's human size ("275.8 MB", with a no-break space): decimal units.
+func sizeBytes(s string) int64 {
+	f := strings.Fields(strings.ReplaceAll(s, " ", " "))
+	if len(f) == 0 {
+		return 0
+	}
+	n, err := strconv.ParseFloat(f[0], 64)
+	if err != nil {
+		return 0
+	}
+	unit := map[string]float64{"bytes": 1, "byte": 1, "B": 1, "kB": 1e3, "KB": 1e3, "MB": 1e6, "GB": 1e9, "TB": 1e12}
+	if len(f) > 1 {
+		if m, ok := unit[f[1]]; ok {
+			n *= m
+		}
+	}
+	return int64(n)
+}
+
+func installFlag(inst string) []string {
+	if inst == "" {
+		return nil
+	}
+	return []string{"--" + inst}
+}
+
+// listRefs runs flatpak list for apps or runtimes.
+func listRefs(kind, inst string) ([]Ref, error) {
+	args := append([]string{"list", "--" + kind, "--columns=application,name,version,branch,arch,origin,installation,size,ref"}, installFlag(inst)...)
+	r, err := call(Cmd{Name: "flatpak", Args: args})
+	if err != nil {
+		return nil, err
+	}
+	out := []Ref{}
+	for _, l := range lines(r.Stdout) {
+		f := strings.Split(l, "\t")
+		if len(f) < 9 {
+			continue
+		}
+		size := strings.ReplaceAll(f[7], " ", " ")
+		out = append(out, Ref{ID: f[0], Name: f[1], Version: f[2], Branch: f[3], Arch: f[4], Origin: f[5], Installation: f[6], Size: size, Bytes: sizeBytes(size), Ref: f[8]})
+	}
+	return out, nil
+}
+
+// ListAnswer is what flatpak_list and flatpak_runtimes answer.
+type ListAnswer struct {
+	Count int   `json:"count"`
+	Bytes int64 `json:"bytes"`
+	Refs  []Ref `json:"refs"`
+}
+
+// List answers the applications or runtimes.
+func List(kind, inst string) (ListAnswer, error) {
+	got, err := listRefs(kind, inst)
+	if err != nil {
+		return ListAnswer{}, err
+	}
+	out := ListAnswer{Count: len(got), Refs: got}
+	for _, r := range got {
+		out.Bytes += r.Bytes
+	}
+	return out, nil
+}
+
+// Remote is one remote of one installation.
+type Remote struct {
+	Name         string `json:"name"`
+	URL          string `json:"url"`
+	Installation string `json:"installation"`
+	Priority     string `json:"priority"`
+	Disabled     bool   `json:"disabled"`
+	Installed    int    `json:"installed_from"`
+}
+
+// RemotesAnswer is what flatpak_remotes answers.
+type RemotesAnswer struct {
+	Remotes  []Remote `json:"remotes"`
+	Flathub  bool     `json:"flathub_system"`
+	Findings []string `json:"findings"`
+}
+
+// Remotes answers both installations' remotes and what is wrong with them.
+func Remotes() (RemotesAnswer, error) {
+	r, err := call(Cmd{Name: "flatpak", Args: []string{"remotes", "--show-disabled", "--columns=name,url,options,priority"}})
+	if err != nil {
+		return RemotesAnswer{}, err
+	}
+	all, err := listRefs("app", "")
+	if err != nil {
+		return RemotesAnswer{}, err
+	}
+	rt, err := listRefs("runtime", "")
+	if err != nil {
+		return RemotesAnswer{}, err
+	}
+	from := map[string]int{}
+	for _, x := range append(all, rt...) {
+		from[x.Origin+"\x00"+x.Installation]++
+	}
+	out := RemotesAnswer{Remotes: []Remote{}, Findings: []string{}}
+	byURL := map[string][]string{}
+	for _, l := range lines(r.Stdout) {
+		f := strings.Split(l, "\t")
+		if len(f) < 4 {
+			continue
+		}
+		inst := "system"
+		disabled := false
+		for _, o := range strings.Split(f[2], ",") {
+			switch strings.TrimSpace(o) {
+			case "user":
+				inst = "user"
+			case "disabled":
+				disabled = true
+			}
+			if strings.HasPrefix(strings.TrimSpace(o), "system") {
+				inst = strings.TrimSpace(o)
+			}
+		}
+		rem := Remote{Name: f[0], URL: f[1], Installation: inst, Priority: f[3], Disabled: disabled, Installed: from[f[0]+"\x00"+inst]}
+		out.Remotes = append(out.Remotes, rem)
+		byURL[strings.TrimRight(rem.URL, "/")] = append(byURL[strings.TrimRight(rem.URL, "/")], rem.Name+" ("+inst+")")
+		if inst == "system" && rem.Name == "flathub" && !disabled {
+			out.Flathub = true
+		}
+		if rem.Installed == 0 {
+			out.Findings = append(out.Findings, fmt.Sprintf("remote %s in the %s installation has nothing installed from it", rem.Name, inst))
+		}
+	}
+	if !out.Flathub {
+		out.Findings = append(out.Findings, "the system installation has no enabled flathub remote: the flatpak package ships one in /usr/share/flatpak/remotes.d, so it was removed or disabled by hand")
+	}
+	for url, names := range byURL {
+		if len(names) > 1 {
+			sort.Strings(names)
+			out.Findings = append(out.Findings, fmt.Sprintf("%s is configured %d times: %s", url, len(names), strings.Join(names, ", ")))
+		}
+	}
+	sort.Strings(out.Findings)
+	return out, nil
+}
+
+// Updates answers what an update would change.
+func Updates(inst string) (map[string]any, error) {
+	args := append([]string{"remote-ls", "--updates", "--columns=application,branch,version,origin,ref"}, installFlag(inst)...)
+	r, err := call(Cmd{Name: "flatpak", Args: args})
+	if err != nil {
+		return nil, err
+	}
+	out := []map[string]string{}
+	for _, l := range lines(r.Stdout) {
+		f := strings.Split(l, "\t")
+		if len(f) >= 5 {
+			out = append(out, map[string]string{"id": f[0], "branch": f[1], "version": f[2], "origin": f[3], "ref": f[4]})
+		}
+	}
+	return map[string]any{"count": len(out), "updates": out}, nil
+}
+
+// Extension is one extension point a ref's metadata declares.
+type Extension struct {
+	ID       string
+	Versions []string
+	Subdirs  bool
+}
+
+// extensionsOf reads [Extension …] groups from a ref's metadata, with the versions each accepts:
+// versions, else version, else the branch of the ref declaring it.
+func extensionsOf(metadata, branch string) []Extension {
+	out := []Extension{}
+	var cur *Extension
+	flush := func() {
+		if cur != nil {
+			if len(cur.Versions) == 0 {
+				cur.Versions = []string{branch}
+			}
+			out = append(out, *cur)
+		}
+		cur = nil
+	}
+	var version, versions string
+	for _, l := range strings.Split(metadata, "\n") {
+		l = strings.TrimSpace(l)
+		if strings.HasPrefix(l, "[") {
+			if cur != nil {
+				cur.Versions = pickVersions(versions, version)
+			}
+			flush()
+			version, versions = "", ""
+			if strings.HasPrefix(l, "[Extension ") && strings.HasSuffix(l, "]") {
+				cur = &Extension{ID: strings.TrimSuffix(strings.TrimPrefix(l, "[Extension "), "]")}
+			}
+			continue
+		}
+		if cur == nil {
+			continue
+		}
+		k, v, found := strings.Cut(l, "=")
+		if !found {
+			continue
+		}
+		switch strings.TrimSpace(k) {
+		case "version":
+			version = strings.TrimSpace(v)
+		case "versions":
+			versions = strings.TrimSpace(v)
+		case "subdirectories":
+			cur.Subdirs = strings.TrimSpace(v) == "true"
+		}
+	}
+	if cur != nil {
+		cur.Versions = pickVersions(versions, version)
+	}
+	flush()
+	return out
+}
+
+func pickVersions(versions, version string) []string {
+	if versions != "" {
+		out := []string{}
+		for _, v := range strings.Split(versions, ";") {
+			if v = strings.TrimSpace(v); v != "" {
+				out = append(out, v)
+			}
+		}
+		return out
+	}
+	if version != "" {
+		return []string{version}
+	}
+	return nil
+}
+
+// fills says whether a runtime fills an extension point.
+func (e Extension) fills(r Ref) bool {
+	if !(r.ID == e.ID || (e.Subdirs && strings.HasPrefix(r.ID, e.ID+"."))) {
+		return false
+	}
+	for _, v := range e.Versions {
+		if v == r.Branch {
+			return true
+		}
+	}
+	return false
+}
+
+// UnusedAnswer is what flatpak_unused answers.
+type UnusedAnswer struct {
+	Count  int      `json:"count"`
+	Bytes  int64    `json:"bytes"`
+	Unused []Ref    `json:"unused"`
+	Pinned []string `json:"pinned"`
+	Note   string   `json:"note"`
+}
+
+func info(inst string, extra ...string) (string, error) {
+	r, err := call(Cmd{Name: "flatpak", Args: append(append([]string{"info"}, installFlag(inst)...), extra...)})
+	return strings.TrimSpace(r.Stdout), err
+}
+
+// Unused computes what no installed application needs.
+func Unused() (UnusedAnswer, error) {
+	apps, err := listRefs("app", "")
+	if err != nil {
+		return UnusedAnswer{}, err
+	}
+	runtimes, err := listRefs("runtime", "")
+	if err != nil {
+		return UnusedAnswer{}, err
+	}
+	key := func(inst, ref string) string {
+		return inst + "\x00" + strings.TrimPrefix(strings.TrimPrefix(ref, "runtime/"), "app/")
+	}
+	installed := map[string]Ref{}
+	for _, r := range runtimes {
+		installed[key(r.Installation, r.Ref)] = r
+	}
+	used := map[string]bool{}
+	type item struct {
+		inst, ref, branch string
+	}
+	queue := []item{}
+	// A user installation's application may use a system runtime; a system one only system runtimes.
+	mark := func(inst, ref string) {
+		for _, where := range []string{inst, "system"} {
+			k := key(where, ref)
+			if r, ok := installed[k]; ok && !used[k] {
+				used[k] = true
+				queue = append(queue, item{where, r.Ref, r.Branch})
+				return
+			}
+		}
+	}
+	for _, a := range apps {
+		for _, flag := range []string{"--show-runtime", "--show-sdk"} {
+			ref, err := info(a.Installation, flag, a.Ref)
+			if err != nil {
+				return UnusedAnswer{}, err
+			}
+			if ref != "" {
+				mark(a.Installation, ref)
+			}
+		}
+		queue = append(queue, item{a.Installation, a.Ref, a.Branch})
+	}
+	pinned := []string{}
+	for _, inst := range []string{"system", "user"} {
+		r := run(Cmd{Name: "flatpak", Args: []string{"pin", "--" + inst}})
+		if r.Status != 0 || r.Error != "" {
+			continue
+		}
+		for _, l := range lines(r.Stdout) {
+			p := strings.TrimSpace(l)
+			if strings.HasPrefix(p, "runtime/") {
+				pinned = append(pinned, p)
+				mark(inst, p)
+			}
+		}
+	}
+	for len(queue) > 0 {
+		it := queue[0]
+		queue = queue[1:]
+		meta, err := info(it.inst, "--show-metadata", it.ref)
+		if err != nil {
+			return UnusedAnswer{}, err
+		}
+		for _, e := range extensionsOf(meta, it.branch) {
+			for k, r := range installed {
+				if !used[k] && e.fills(r) && (r.Installation == it.inst || r.Installation == "system") {
+					used[k] = true
+					queue = append(queue, item{r.Installation, r.Ref, r.Branch})
+				}
+			}
+		}
+	}
+	out := UnusedAnswer{Unused: []Ref{}, Pinned: pinned,
+		Note: "Computed without changing anything. flatpak_remove_unused lets flatpak decide, which may differ in detail (a locale or debug extension listed here by nothing)."}
+	for k, r := range installed {
+		if !used[k] {
+			out.Unused = append(out.Unused, r)
+			out.Bytes += r.Bytes
+		}
+	}
+	sort.Slice(out.Unused, func(i, k int) bool { return out.Unused[i].Ref < out.Unused[k].Ref })
+	out.Count = len(out.Unused)
+	return out, nil
+}
+
+// Where each installation lives.
+var installDirs = map[string]string{"system": "/var/lib/flatpak", "user": ".local/share/flatpak"}
+
+// DiskAnswer is what flatpak_disk_usage answers.
+type DiskAnswer struct {
+	Installations map[string]int64 `json:"installation_bytes"`
+	Largest       []Ref            `json:"largest"`
+	Note          string           `json:"note,omitempty"`
+}
+
+// DiskUsage measures each installation's directory and lists the largest refs.
+func DiskUsage() (DiskAnswer, error) {
+	out := DiskAnswer{Installations: map[string]int64{}, Largest: []Ref{}}
+	for inst, dir := range installDirs {
+		if !filepath.IsAbs(dir) {
+			dir = filepath.Join(accountHome(), dir)
+		}
+		// du exits 1 when a file is unreadable and still prints the total of what it could read.
+		r := run(Cmd{Name: "du", Args: []string{"-sb", dir}})
+		if r.Error != "" {
+			return DiskAnswer{}, failure(Cmd{Name: "du", Args: []string{"-sb", dir}}, r)
+		}
+		f := strings.Fields(r.Stdout)
+		if len(f) == 0 {
+			if strings.Contains(r.Stderr, "No such file") {
+				out.Installations[inst] = 0
+				continue
+			}
+			return DiskAnswer{}, failure(Cmd{Name: "du", Args: []string{"-sb", dir}}, r)
+		}
+		n, _ := strconv.ParseInt(f[0], 10, 64)
+		out.Installations[inst] = n
+		if r.Status != 0 {
+			out.Note = "some files were unreadable to the account, so a total is a lower bound"
+		}
+	}
+	apps, err := listRefs("app", "")
+	if err != nil {
+		return DiskAnswer{}, err
+	}
+	rts, err := listRefs("runtime", "")
+	if err != nil {
+		return DiskAnswer{}, err
+	}
+	all := append(apps, rts...)
+	sort.Slice(all, func(i, k int) bool { return all[i].Bytes > all[k].Bytes })
+	if len(all) > 50 {
+		all = all[:50]
+	}
+	out.Largest = all
+	return out, nil
+}
+
+func accountHome() string {
+	return homeFrom(getenv)
+}
+
+// ActAnswer is what an act answers.
+type ActAnswer struct {
+	Act          string `json:"act"`
+	Ref          string `json:"ref,omitempty"`
+	Installation string `json:"installation"`
+	Job          Job    `json:"job"`
+}
+
+// act runs flatpak as a job; the system installation needs root, the account's does not.
+func act(verb, ref, inst string, args ...string) (ActAnswer, error) {
+	c := Cmd{Name: "flatpak", Args: append([]string{verb, "--" + inst, "--noninteractive", "-y"}, args...), Root: inst == "system"}
+	j, err := actAsJob(c)
+	if err != nil {
+		return ActAnswer{}, err
+	}
+	return ActAnswer{Act: verb, Ref: ref, Installation: inst, Job: j}, nil
+}
+
+// Install installs a ref from a remote.
+func Install(ref, remote, inst string) (ActAnswer, error) {
+	if !remoteName.MatchString(remote) {
+		return ActAnswer{}, fmt.Errorf("%q is not a remote's name", remote)
+	}
+	return act("install", ref, inst, remote, ref)
+}
+
+// Remove uninstalls a ref.
+func Remove(ref, inst string, deleteData bool) (ActAnswer, error) {
+	if deleteData {
+		return act("uninstall", ref, inst, "--delete-data", ref)
+	}
+	return act("uninstall", ref, inst, ref)
+}
+
+// Update updates one ref, or everything.
+func Update(ref, inst string) (ActAnswer, error) {
+	if ref == "" {
+		return act("update", "", inst)
+	}
+	return act("update", ref, inst, ref)
+}
+
+// RemoveUnused lets flatpak uninstall what it finds unused.
+func RemoveUnused(inst string) (ActAnswer, error) {
+	return act("uninstall", "", inst, "--unused")
+}
+
+// getenv and homeFrom read the account's home the way the runtime gives it.
+var getenv = func(k string) string { return strings.TrimSpace(os.Getenv(k)) }
+
+func homeFrom(env func(string) string) string {
+	if h := env("MESH_OPERATOR_HOME"); h != "" {
+		return h
+	}
+	return env("HOME")
+}

modules/flatpak/cmd/flatpak-tools/flatpak_test.go

@@ -0,0 +1,249 @@
+package main
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestTheManifestIsFlatpaksPackageAndFlathubComesWithIt(t *testing.T) {
+	m := readManifest(t)
+	holdsTheBundle(t, m, "flatpak")
+	if got := strings.Join(m.packages(), ","); got != "flatpak" {
+		t.Errorf("packages %s", got)
+	}
+	// The package ships flathub in /usr/share/flatpak/remotes.d: the module declares no remote file.
+	if len(m.Resources) != 1 {
+		t.Errorf("one resource: %v", m.Resources)
+	}
+}
+
+const nb = " "
+
+// The desktop's installation on 2026-10-04, as flatpak list prints it.
+var apps = "com.nextcloud.desktopclient.nextcloud\tNextcloud Desktop\t3.14\tstable\tx86_64\tflathub\tsystem\t275.8" + nb + "MB\tcom.nextcloud.desktopclient.nextcloud/x86_64/stable\n" +
+	"tv.plex.PlexDesktop\tPlex\t1.9\tstable\tx86_64\tflathub\tsystem\t368.0" + nb + "MB\ttv.plex.PlexDesktop/x86_64/stable\n"
+
+var runtimes = strings.Join([]string{
+	"org.freedesktop.Platform\tFreedesktop Platform\t22.08.1\t22.08\tx86_64\tflathub\tsystem\t576.7" + nb + "MB\torg.freedesktop.Platform/x86_64/22.08",
+	"org.freedesktop.Platform\tFreedesktop Platform\t23.08.1\t23.08\tx86_64\tflathub\tsystem\t598.3" + nb + "MB\torg.freedesktop.Platform/x86_64/23.08",
+	"org.freedesktop.Platform.GL.default\tMesa\t\t22.08\tx86_64\tflathub\tsystem\t442.1" + nb + "MB\torg.freedesktop.Platform.GL.default/x86_64/22.08",
+	"org.freedesktop.Platform.GL.default\tMesa\t\t23.08\tx86_64\tflathub\tsystem\t533.8" + nb + "MB\torg.freedesktop.Platform.GL.default/x86_64/23.08",
+	"org.freedesktop.Platform.GL.default\tMesa\t\t23.08-extra\tx86_64\tflathub\tsystem\t533.8" + nb + "MB\torg.freedesktop.Platform.GL.default/x86_64/23.08-extra",
+	"org.freedesktop.Platform.openh264\topenh264\t\t2.2.0\tx86_64\tflathub\tsystem\t790.0" + nb + "kB\torg.freedesktop.Platform.openh264/x86_64/2.2.0",
+	"org.freedesktop.Sdk\tSdk\t\t23.08\tx86_64\tflathub\tsystem\t1.6" + nb + "GB\torg.freedesktop.Sdk/x86_64/23.08",
+	"org.kde.Platform\tKDE\t\t6.7\tx86_64\tflathub\tsystem\t931.4" + nb + "MB\torg.kde.Platform/x86_64/6.7",
+	"org.kde.KStyle.Adwaita\tAdwaita\t\t5.15-21.08\tx86_64\tflathub\tsystem\t16.3" + nb + "MB\torg.kde.KStyle.Adwaita/x86_64/5.15-21.08",
+	"org.kde.KStyle.Adwaita\tAdwaita\t\t6.7\tx86_64\tflathub\tsystem\t20.6" + nb + "MB\torg.kde.KStyle.Adwaita/x86_64/6.7",
+}, "\n") + "\n"
+
+const platformMeta = `[Runtime]
+name=org.freedesktop.Platform
+
+[Extension org.freedesktop.Platform.GL]
+versions = 23.08;23.08-extra;1.4
+version = 1.4
+directory = lib/x86_64-linux-gnu/GL
+subdirectories = true
+
+[Extension org.freedesktop.Platform.openh264]
+directory = lib/openh264
+version = 2.2.0
+
+[Extension org.freedesktop.Platform.Timezones]
+directory = share/zoneinfo
+`
+
+const kdeMeta = `[Runtime]
+name=org.kde.Platform
+
+[Extension org.kde.KStyle]
+directory = lib/plugins/styles
+subdirectories = true
+version = 6.7
+
+[Extension org.freedesktop.Platform.GL]
+versions = 23.08;1.4
+subdirectories = true
+`
+
+func theDesktop(t *testing.T) *fake {
+	return using(t, func(line string, c Cmd) Result {
+		switch {
+		case strings.HasPrefix(line, "flatpak list --app"):
+			return ok(apps)
+		case strings.HasPrefix(line, "flatpak list --runtime"):
+			return ok(runtimes)
+		case strings.Contains(line, "--show-runtime com.nextcloud"):
+			return ok("org.kde.Platform/x86_64/6.7\n")
+		case strings.Contains(line, "--show-runtime tv.plex"):
+			return ok("org.freedesktop.Platform/x86_64/23.08\n")
+		case strings.Contains(line, "--show-sdk tv.plex"):
+			return ok("org.freedesktop.Sdk/x86_64/23.08\n")
+		case strings.Contains(line, "--show-sdk"):
+			return ok("org.kde.Sdk/x86_64/6.7\n")
+		case strings.Contains(line, "--show-metadata org.freedesktop.Platform/x86_64/23.08"):
+			return ok(platformMeta)
+		case strings.Contains(line, "--show-metadata org.kde.Platform"):
+			return ok(kdeMeta)
+		case strings.Contains(line, "--show-metadata"):
+			return ok("[Application]\nname=x\n")
+		case strings.HasPrefix(line, "flatpak pin"):
+			return ok("")
+		case strings.HasPrefix(line, "flatpak remotes"):
+			return ok("flathub\thttps://dl.flathub.org/repo/\tsystem\t1\nflathub\thttps://dl.flathub.org/repo/\tuser\t1\n")
+		}
+		return Result{Status: 9, Stderr: "unexpected " + line}
+	})
+}
+
+func TestUnusedIsWhatNoApplicationNeedsDirectlyOrThroughAnExtensionPoint(t *testing.T) {
+	f := theDesktop(t)
+	got, err := Unused()
+	if err != nil {
+		t.Fatal(err)
+	}
+	names := []string{}
+	for _, r := range got.Unused {
+		names = append(names, r.Ref)
+	}
+	want := "org.freedesktop.Platform.GL.default/x86_64/22.08,org.freedesktop.Platform/x86_64/22.08,org.kde.KStyle.Adwaita/x86_64/5.15-21.08"
+	if strings.Join(names, ",") != want {
+		t.Errorf("unused\n%s\nwant\n%s", strings.Join(names, ","), want)
+	}
+	if got.Bytes != 576700000+442100000+16300000 {
+		t.Errorf("bytes %d", got.Bytes)
+	}
+	for _, l := range f.lines() {
+		if strings.Contains(l, "uninstall") || strings.HasPrefix(l, "sudo") {
+			t.Errorf("unused only reads: %s", l)
+		}
+	}
+}
+
+func TestAnExtensionPointAcceptsItsVersionsOrTheDeclaringBranch(t *testing.T) {
+	ext := extensionsOf(platformMeta, "23.08")
+	if len(ext) != 3 {
+		t.Fatalf("%+v", ext)
+	}
+	gl, h264, tz := ext[0], ext[1], ext[2]
+	if !gl.Subdirs || strings.Join(gl.Versions, ";") != "23.08;23.08-extra;1.4" {
+		t.Errorf("versions win over version: %+v", gl)
+	}
+	if h264.Subdirs || strings.Join(h264.Versions, ";") != "2.2.0" {
+		t.Errorf("%+v", h264)
+	}
+	if strings.Join(tz.Versions, ";") != "23.08" {
+		t.Errorf("no version is the declaring branch: %+v", tz)
+	}
+	if !gl.fills(Ref{ID: "org.freedesktop.Platform.GL.default", Branch: "23.08-extra"}) || gl.fills(Ref{ID: "org.freedesktop.Platform.GL.default", Branch: "22.08"}) {
+		t.Error("a subdirectory extension, by branch")
+	}
+	if h264.fills(Ref{ID: "org.freedesktop.Platform.openh264.x", Branch: "2.2.0"}) {
+		t.Error("without subdirectories only the id itself")
+	}
+}
+
+func TestRemotesFindTheDuplicateAndTheEmptyOne(t *testing.T) {
+	theDesktop(t)
+	got, err := Remotes()
+	if err != nil || len(got.Remotes) != 2 || !got.Flathub {
+		t.Fatalf("%+v %v", got, err)
+	}
+	if got.Remotes[0].Installed != 12 || got.Remotes[1].Installed != 0 {
+		t.Errorf("%+v", got.Remotes)
+	}
+	all := strings.Join(got.Findings, ";")
+	if !strings.Contains(all, "flathub in the user installation has nothing installed") || !strings.Contains(all, "configured 2 times") {
+		t.Errorf("%s", all)
+	}
+}
+
+func TestListReadsSizesAsBytes(t *testing.T) {
+	theDesktop(t)
+	got, err := List("app", "")
+	if err != nil || got.Count != 2 || got.Refs[0].Bytes != 275800000 || got.Refs[0].Size != "275.8 MB" || got.Bytes != 643800000 {
+		t.Fatalf("%+v %v", got, err)
+	}
+	for in, want := range map[string]int64{"1.6" + nb + "GB": 1600000000, "790.0 kB": 790000, "12 bytes": 12, "": 0} {
+		if b := sizeBytes(in); b != want {
+			t.Errorf("%q: %d", in, b)
+		}
+	}
+}
+
+func TestActsOnTheSystemInstallationEscalateAndTheAccountsDoNot(t *testing.T) {
+	f := using(t, func(string, Cmd) Result { return ok("done") })
+	if got, err := Install("org.gimp.GIMP", "flathub", "system"); err != nil || got.Job.Running {
+		t.Fatalf("%+v %v", got, err)
+	}
+	if _, err := Install("org.gimp.GIMP", "flathub", "user"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := Remove("org.gimp.GIMP", "system", true); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := Update("", "user"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := RemoveUnused("system"); err != nil {
+		t.Fatal(err)
+	}
+	want := []string{
+		"sudo -n flatpak install --system --noninteractive -y flathub org.gimp.GIMP",
+		"flatpak install --user --noninteractive -y flathub org.gimp.GIMP",
+		"sudo -n flatpak uninstall --system --noninteractive -y --delete-data org.gimp.GIMP",
+		"flatpak update --user --noninteractive -y",
+		"sudo -n flatpak uninstall --system --noninteractive -y --unused",
+	}
+	if got := strings.Join(f.lines(), "\n"); got != strings.Join(want, "\n") {
+		t.Errorf("asked\n%s", got)
+	}
+	if _, err := Install("org.gimp.GIMP", "--from=x", "system"); err == nil {
+		t.Error("an option as a remote")
+	}
+	for _, bad := range []string{"--assumeyes", "gimp", "org.gimp.GIMP; rm", "org/../x"} {
+		if checkRef(bad) == nil {
+			t.Errorf("%q accepted as a ref", bad)
+		}
+	}
+	for _, good := range []string{"org.gimp.GIMP", "org.freedesktop.Platform/x86_64/23.08", "app/org.gimp.GIMP/x86_64/stable", "org.freedesktop.Platform.GL.default//23.08-extra"} {
+		if err := checkRef(good); err != nil {
+			t.Errorf("%v", err)
+		}
+	}
+}
+
+func TestAFailedInstallIsAnErrorAndAMissingFlatpakIsSaid(t *testing.T) {
+	using(t, func(string, Cmd) Result {
+		return Result{Status: 1, Stderr: "error: Nothing matches org.nope.Nope in remote flathub"}
+	})
+	if _, err := Install("org.nope.Nope", "flathub", "user"); err == nil || !strings.Contains(err.Error(), "Nothing matches") {
+		t.Fatalf("%v", err)
+	}
+	using(t, func(string, Cmd) Result { return Result{Status: 127, Error: "not-found"} })
+	if _, err := List("app", ""); err == nil || !strings.Contains(err.Error(), "not installed") {
+		t.Fatalf("%v", err)
+	}
+}
+
+func TestDiskUsageReadsEachInstallationAndToleratesAnUnreadableFile(t *testing.T) {
+	t.Setenv("MESH_OPERATOR_HOME", "/home/op")
+	using(t, func(line string, c Cmd) Result {
+		switch {
+		case line == "du -sb /var/lib/flatpak":
+			return Result{Status: 1, Stdout: "5094728394\t/var/lib/flatpak\n", Stderr: "du: cannot read directory 'x': Permission denied"}
+		case line == "du -sb /home/op/.local/share/flatpak":
+			return Result{Status: 1, Stderr: "du: cannot access '/home/op/.local/share/flatpak': No such file or directory"}
+		case strings.Contains(line, "--app"):
+			return ok(apps)
+		}
+		return ok(runtimes)
+	})
+	got, err := DiskUsage()
+	if err != nil || got.Installations["system"] != 5094728394 || got.Installations["user"] != 0 || got.Note == "" {
+		t.Fatalf("%+v %v", got, err)
+	}
+	if got.Largest[0].ID != "org.freedesktop.Sdk" {
+		t.Errorf("largest first: %+v", got.Largest[0])
+	}
+}

modules/flatpak/cmd/flatpak-tools/jobs.go

@@ -0,0 +1,151 @@
+package main
+
+// jobs.go is the same file in the bundles whose acts can outlast one call (flatpak, docker-compose):
+// an install or an `up` that pulls images takes minutes, and the runtime gives a call 30 s. Such an
+// act is started as a job inside this process, waited on for a while, and answered either finished
+// or with the job's id for the module's `_job` tool to follow. A job ends with this process: if the
+// runtime restarts the bundle, a running job is cut off, and its id is then unknown.
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+	"sync"
+	"time"
+)
+
+// JobLimit is the longest a job may run; JobWait how long an act waits before answering a job id.
+const (
+	JobLimit = 15 * time.Minute
+	JobWait  = 18 * time.Second
+	keptJobs = 50
+)
+
+// Job is one long act, as its tool answers it.
+type Job struct {
+	ID        string     `json:"job"`
+	Command   string     `json:"command"`
+	Started   time.Time  `json:"started"`
+	Finished  *time.Time `json:"finished,omitempty"`
+	Running   bool       `json:"running"`
+	Status    *int       `json:"status,omitempty"`
+	Error     string     `json:"error,omitempty"`
+	Output    string     `json:"output,omitempty"`
+	Truncated bool       `json:"truncated,omitempty"`
+	done      chan struct{}
+}
+
+type jobBook struct {
+	mu   sync.Mutex
+	seq  int
+	jobs map[string]*Job
+}
+
+var jobs = &jobBook{jobs: map[string]*Job{}}
+
+// startJob runs c in the background, held to JobLimit.
+func startJob(c Cmd) *Job {
+	c.Timeout = JobLimit
+	name, args := argv(c)
+	jobs.mu.Lock()
+	jobs.seq++
+	j := &Job{ID: fmt.Sprintf("%d-%d", time.Now().Unix(), jobs.seq), Command: strings.TrimSpace(name + " " + strings.Join(args, " ")),
+		Started: time.Now().UTC(), Running: true, done: make(chan struct{})}
+	jobs.jobs[j.ID] = j
+	jobs.forgetOldest()
+	jobs.mu.Unlock()
+	go func() {
+		r := run(c)
+		var err error
+		if r.Status != 0 || r.Error != "" {
+			err = failure(c, r)
+		}
+		jobs.mu.Lock()
+		now := time.Now().UTC()
+		j.Finished, j.Running = &now, false
+		status := r.Status
+		j.Status = &status
+		if err != nil {
+			j.Error = err.Error()
+		}
+		j.Output = tail(strings.TrimSpace(r.Stdout+"\n"+r.Stderr), 16<<10)
+		j.Truncated = r.Truncated || len(r.Stdout)+len(r.Stderr) > 16<<10
+		jobs.mu.Unlock()
+		close(j.done)
+	}()
+	return j
+}
+
+// forgetOldest keeps the book bounded; finished jobs go first. Called with the lock held.
+func (b *jobBook) forgetOldest() {
+	if len(b.jobs) <= keptJobs {
+		return
+	}
+	all := make([]*Job, 0, len(b.jobs))
+	for _, j := range b.jobs {
+		all = append(all, j)
+	}
+	sort.Slice(all, func(i, k int) bool { return all[i].Started.Before(all[k].Started) })
+	for _, j := range all {
+		if len(b.jobs) <= keptJobs {
+			return
+		}
+		if !j.Running {
+			delete(b.jobs, j.ID)
+		}
+	}
+}
+
+// awaitJob waits up to d for a job to finish and answers a copy of it as it then stands.
+func awaitJob(j *Job, d time.Duration) Job {
+	select {
+	case <-j.done:
+	case <-time.After(d):
+	}
+	return snapshot(j)
+}
+
+func snapshot(j *Job) Job {
+	jobs.mu.Lock()
+	defer jobs.mu.Unlock()
+	c := *j
+	c.done = nil
+	return c
+}
+
+// jobByID answers a job by its id, or says it is not known to this process.
+func jobByID(id string) (Job, error) {
+	jobs.mu.Lock()
+	j, ok := jobs.jobs[id]
+	jobs.mu.Unlock()
+	if !ok {
+		return Job{}, fmt.Errorf("no job %s in this process: it was never started here, was forgotten after %d newer ones, or the bundle has restarted since", id, keptJobs)
+	}
+	return snapshot(j), nil
+}
+
+// listJobs answers every job this process knows, newest first.
+func listJobs() []Job {
+	jobs.mu.Lock()
+	all := make([]*Job, 0, len(jobs.jobs))
+	for _, j := range jobs.jobs {
+		all = append(all, j)
+	}
+	jobs.mu.Unlock()
+	sort.Slice(all, func(i, k int) bool { return all[i].Started.After(all[k].Started) })
+	out := make([]Job, 0, len(all))
+	for _, j := range all {
+		out = append(out, snapshot(j))
+	}
+	return out
+}
+
+// actAsJob starts c and answers the job once it finishes or JobWait passes, whichever is first.
+// A finished job that failed is answered as an error, so a failed act is never read as success.
+func actAsJob(c Cmd) (Job, error) {
+	j := awaitJob(startJob(c), JobWait)
+	if !j.Running && j.Error != "" {
+		return j, fmt.Errorf("%s (job %s)", j.Error, j.ID)
+	}
+	return j, nil
+}

modules/flatpak/cmd/flatpak-tools/jobs_test.go

@@ -0,0 +1,51 @@
+package main
+
+import (
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestJobsAFastActIsAnsweredFinishedAndAFailedOneAsAnError(t *testing.T) {
+	using(t, func(line string, c Cmd) Result {
+		if c.Timeout != JobLimit {
+			t.Errorf("a job is held to JobLimit, not %s", c.Timeout)
+		}
+		if strings.Contains(line, "bad") {
+			return Result{Status: 2, Stderr: "it broke"}
+		}
+		return ok("done")
+	})
+	j, err := actAsJob(Cmd{Name: "good"})
+	if err != nil || j.Running || j.Status == nil || *j.Status != 0 || j.Output != "done" {
+		t.Fatalf("%+v %v", j, err)
+	}
+	if _, err := actAsJob(Cmd{Name: "bad"}); err == nil || !strings.Contains(err.Error(), "it broke") {
+		t.Fatalf("a failed job: %v", err)
+	}
+	got, err := jobByID(j.ID)
+	if err != nil || got.ID != j.ID {
+		t.Fatalf("by id: %+v %v", got, err)
+	}
+	if _, err := jobByID("nope"); err == nil {
+		t.Fatal("an unknown job")
+	}
+	if len(listJobs()) < 2 {
+		t.Fatal("listed")
+	}
+}
+
+func TestJobsASlowActIsAnsweredRunningWithItsID(t *testing.T) {
+	release := make(chan struct{})
+	using(t, func(line string, c Cmd) Result { <-release; return ok("") })
+	j := awaitJob(startJob(Cmd{Name: "slow"}), 50*time.Millisecond)
+	if !j.Running || j.ID == "" {
+		t.Fatalf("%+v", j)
+	}
+	close(release)
+	time.Sleep(50 * time.Millisecond)
+	got, _ := jobByID(j.ID)
+	if got.Running {
+		t.Fatalf("finished afterwards: %+v", got)
+	}
+}

modules/flatpak/cmd/flatpak-tools/kit.go

@@ -0,0 +1,352 @@
+package main
+
+// kit.go is the same file in each of the workstations' tool bundles (fonts, docker-compose, snapd,
+// flatpak, cups, bluetooth, xclip, dmenu): how a tool runs a command, escalates, bounds what it
+// keeps, and names a failure. A module is built from its own directory, so the file is copied rather
+// than shared; a change to one copy is made to all eight.
+//
+// The rules it holds (novox/hq research 026/05, to-be 38 WP4):
+//   - the node's tool runtime runs as the operator account, not root (ADR 0175 §4); a command that
+//     needs root goes through `sudo -n`, never a prompt, and a refusal is named as such;
+//   - one command gets 20 s, below the runtime's 30 s call limit, and is ended with everything it
+//     started when it takes longer;
+//   - each stream is kept to 256 KiB, and the answer says when it was cut;
+//   - a failure is an error with what went wrong in it, never an empty answer.
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"strings"
+	"syscall"
+	"time"
+)
+
+// Bounds every command is held to.
+const (
+	CallTimeout = 20 * time.Second
+	MostOutput  = 256 << 10
+)
+
+// Cmd is one command a tool runs.
+type Cmd struct {
+	Name string
+	Args []string
+	// Stdin is written to the command's standard input when not empty.
+	Stdin string
+	// Env is added to this process's own environment.
+	Env []string
+	// Root says the command needs root: it is run through `sudo -n` when this process is not root.
+	Root bool
+	// Timeout replaces CallTimeout; only a background job (jobs.go) asks for longer.
+	Timeout time.Duration
+	// Detached is for a program that forks a child which outlives it, as xclip does to keep the
+	// selection: its streams go to files, because a pipe the child inherits would hold the call open
+	// until the child exits.
+	Detached bool
+}
+
+// Result is what a command did.
+type Result struct {
+	Stdout string `json:"stdout"`
+	Stderr string `json:"stderr"`
+	Status int    `json:"status"`
+	// Error is why it did not run to an answer: "not-found" when the program is not there,
+	// "timeout" when it was ended for taking too long, else the spawn error.
+	Error     string `json:"error,omitempty"`
+	Truncated bool   `json:"truncated,omitempty"`
+}
+
+// Runner runs a command. Tests replace it; nothing else does.
+type Runner func(Cmd) Result
+
+var (
+	run  Runner = execRun
+	euid        = os.Geteuid
+)
+
+// argv is the command as it is run: through sudo without a prompt when it needs root and this
+// process is not root.
+func argv(c Cmd) (string, []string) {
+	if c.Root && euid() != 0 {
+		return "sudo", append([]string{"-n", c.Name}, c.Args...)
+	}
+	return c.Name, c.Args
+}
+
+// bounded keeps the first MostOutput bytes written to it and notes that more came.
+type bounded struct {
+	b   bytes.Buffer
+	cut bool
+}
+
+func (w *bounded) Write(p []byte) (int, error) {
+	room := MostOutput - w.b.Len()
+	if room <= 0 {
+		w.cut = w.cut || len(p) > 0
+		return len(p), nil
+	}
+	if len(p) > room {
+		w.b.Write(p[:room])
+		w.cut = true
+		return len(p), nil
+	}
+	return w.b.Write(p)
+}
+
+func execRun(c Cmd) Result {
+	timeout := c.Timeout
+	if timeout <= 0 {
+		timeout = CallTimeout
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+	name, args := argv(c)
+	cmd := exec.CommandContext(ctx, name, args...)
+	cmd.Env = append(append(os.Environ(), "LC_ALL=C"), c.Env...)
+	if !c.Detached {
+		// Its own process group, so that ending it on a timeout ends what it started too.
+		cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
+		cmd.Cancel = func() error {
+			if cmd.Process != nil {
+				_ = syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL)
+			}
+			return nil
+		}
+	}
+	cmd.WaitDelay = 2 * time.Second
+	if c.Stdin != "" {
+		cmd.Stdin = strings.NewReader(c.Stdin)
+	}
+	var out, errs bounded
+	var outFile, errFile *os.File
+	if c.Detached {
+		var err error
+		if outFile, err = os.CreateTemp("", "mesh-tool-out-*"); err != nil {
+			return Result{Status: 127, Error: err.Error()}
+		}
+		defer os.Remove(outFile.Name())
+		defer outFile.Close()
+		if errFile, err = os.CreateTemp("", "mesh-tool-err-*"); err != nil {
+			return Result{Status: 127, Error: err.Error()}
+		}
+		defer os.Remove(errFile.Name())
+		defer errFile.Close()
+		cmd.Stdout, cmd.Stderr = outFile, errFile
+	} else {
+		cmd.Stdout, cmd.Stderr = &out, &errs
+	}
+	err := cmd.Run()
+	if c.Detached {
+		for _, f := range []struct {
+			file *os.File
+			into *bounded
+		}{{outFile, &out}, {errFile, &errs}} {
+			if _, e := f.file.Seek(0, io.SeekStart); e == nil {
+				_, _ = io.Copy(f.into, f.file)
+			}
+		}
+	}
+	r := Result{Stdout: out.b.String(), Stderr: errs.b.String(), Truncated: out.cut || errs.cut}
+	var exit *exec.ExitError
+	switch {
+	case err == nil:
+	case ctx.Err() == context.DeadlineExceeded:
+		r.Status, r.Error = 124, "timeout"
+	case errors.Is(err, exec.ErrNotFound) || errors.Is(err, os.ErrNotExist):
+		r.Status, r.Error = 127, "not-found"
+	case errors.As(err, &exit):
+		r.Status = exit.ExitCode()
+	default:
+		r.Status, r.Error = 127, err.Error()
+	}
+	return r
+}
+
+// call runs a command and answers its result, or an error naming what went wrong.
+func call(c Cmd) (Result, error) {
+	r := run(c)
+	if r.Status == 0 && r.Error == "" {
+		return r, nil
+	}
+	return r, failure(c, r)
+}
+
+// failure names how a command failed: not installed, refused escalation, too slow, or its exit
+// status with the end of what it said.
+func failure(c Cmd, r Result) error {
+	program, _ := argv(c)
+	switch {
+	case r.Error == "not-found" && program == "sudo":
+		return fmt.Errorf("%s needs root, and sudo is not installed here for the runtime's account to escalate with", c.Name)
+	case r.Error == "not-found":
+		if hint, ok := providedBy[c.Name]; ok {
+			return fmt.Errorf("%s is not installed on this machine (%s)", c.Name, hint)
+		}
+		return fmt.Errorf("%s is not installed on this machine", c.Name)
+	case r.Error == "timeout":
+		limit := c.Timeout
+		if limit <= 0 {
+			limit = CallTimeout
+		}
+		return fmt.Errorf("%s gave no answer within %s and was ended", c.Name, limit)
+	case r.Error != "":
+		return fmt.Errorf("%s did not run: %s", c.Name, r.Error)
+	case program == "sudo" && strings.Contains(r.Stderr, "command not found"):
+		if hint, ok := providedBy[c.Name]; ok {
+			return fmt.Errorf("%s is not installed on this machine (%s)", c.Name, hint)
+		}
+		return fmt.Errorf("%s is not installed on this machine", c.Name)
+	case program == "sudo" && strings.HasPrefix(strings.TrimSpace(r.Stderr), "sudo:"):
+		return fmt.Errorf("%s needs root, and sudo -n refused the runtime's account: %s (the escalation is the sudo module's to declare)",
+			c.Name, firstLine(r.Stderr))
+	}
+	said := tail(strings.TrimSpace(r.Stderr), 2000)
+	if said == "" {
+		said = tail(strings.TrimSpace(r.Stdout), 2000)
+	}
+	if said == "" {
+		said = "and said nothing"
+	}
+	return fmt.Errorf("%s %s exited %d: %s", c.Name, strings.Join(c.Args, " "), r.Status, said)
+}
+
+func firstLine(s string) string {
+	s = strings.TrimSpace(s)
+	if i := strings.IndexByte(s, '\n'); i >= 0 {
+		return s[:i]
+	}
+	return s
+}
+
+func tail(s string, n int) string {
+	if len(s) <= n {
+		return s
+	}
+	return "…" + s[len(s)-n:]
+}
+
+// lines are a command's output lines, blank ones dropped.
+func lines(s string) []string {
+	out := []string{}
+	for _, l := range strings.Split(s, "\n") {
+		if strings.TrimSpace(l) != "" {
+			out = append(out, strings.TrimRight(l, "\r"))
+		}
+	}
+	return out
+}
+
+// Arguments, read the way a tool's JSON arguments arrive.
+
+func text(args map[string]any, key string) (string, error) {
+	v, ok := args[key]
+	if !ok || v == nil {
+		return "", fmt.Errorf("%s is required", key)
+	}
+	s, ok := v.(string)
+	if !ok {
+		return "", fmt.Errorf("%s must be a string", key)
+	}
+	if strings.TrimSpace(s) == "" {
+		return "", fmt.Errorf("%s must not be empty", key)
+	}
+	return s, nil
+}
+
+func optText(args map[string]any, key, def string) (string, error) {
+	v, ok := args[key]
+	if !ok || v == nil {
+		return def, nil
+	}
+	s, ok := v.(string)
+	if !ok {
+		return "", fmt.Errorf("%s must be a string", key)
+	}
+	if strings.TrimSpace(s) == "" {
+		return def, nil
+	}
+	return s, nil
+}
+
+// optWhole reads a whole number, defaulted, refused below least and held to most.
+func optWhole(args map[string]any, key string, def, least, most int) (int, error) {
+	v, ok := args[key]
+	if !ok || v == nil {
+		return def, nil
+	}
+	f, ok := v.(float64)
+	if !ok {
+		if i, isInt := v.(int); isInt {
+			f = float64(i)
+		} else {
+			return 0, fmt.Errorf("%s must be a number", key)
+		}
+	}
+	if f != float64(int(f)) {
+		return 0, fmt.Errorf("%s must be a whole number", key)
+	}
+	n := int(f)
+	if n < least {
+		return 0, fmt.Errorf("%s must be at least %d", key, least)
+	}
+	if n > most {
+		n = most
+	}
+	return n, nil
+}
+
+func optFlag(args map[string]any, key string, def bool) (bool, error) {
+	v, ok := args[key]
+	if !ok || v == nil {
+		return def, nil
+	}
+	b, ok := v.(bool)
+	if !ok {
+		return false, fmt.Errorf("%s must be true or false", key)
+	}
+	return b, nil
+}
+
+func optList(args map[string]any, key string) ([]string, error) {
+	v, ok := args[key]
+	if !ok || v == nil {
+		return nil, nil
+	}
+	items, ok := v.([]any)
+	if !ok {
+		return nil, fmt.Errorf("%s must be a list of strings", key)
+	}
+	out := make([]string, 0, len(items))
+	for _, it := range items {
+		s, ok := it.(string)
+		if !ok || strings.TrimSpace(s) == "" {
+			return nil, fmt.Errorf("%s must be a list of non-empty strings", key)
+		}
+		out = append(out, s)
+	}
+	return out, nil
+}
+
+// oneOf refuses a value outside a closed set.
+func oneOf(key, value string, allowed ...string) error {
+	for _, a := range allowed {
+		if value == a {
+			return nil
+		}
+	}
+	return fmt.Errorf("%s must be one of %s, not %q", key, strings.Join(allowed, ", "), value)
+}
+
+// plainName refuses a name that could be read as an option or carries a path or a space: package,
+// snap, application and printer names never do.
+func plainName(key, value string) error {
+	if strings.HasPrefix(value, "-") || strings.ContainsAny(value, " \t\n/\\") {
+		return fmt.Errorf("%s %q is not a plain name", key, value)
+	}
+	return nil
+}

modules/flatpak/cmd/flatpak-tools/kit_test.go

@@ -0,0 +1,147 @@
+package main
+
+// Tests of kit.go, the same in each workstation module.
+
+import (
+	"strings"
+	"testing"
+	"time"
+)
+
+// fake records the commands asked and answers each from a function of the command line.
+type fake struct {
+	asked  []Cmd
+	answer func(line string, c Cmd) Result
+}
+
+func (f *fake) runner() Runner {
+	return func(c Cmd) Result {
+		f.asked = append(f.asked, c)
+		name, args := argv(c)
+		line := strings.TrimSpace(name + " " + strings.Join(args, " "))
+		if f.answer == nil {
+			return Result{}
+		}
+		return f.answer(line, c)
+	}
+}
+
+func (f *fake) lines() []string {
+	out := []string{}
+	for _, c := range f.asked {
+		name, args := argv(c)
+		out = append(out, strings.TrimSpace(name+" "+strings.Join(args, " ")))
+	}
+	return out
+}
+
+// using installs a fake runner and a non-root uid for one test.
+func using(t *testing.T, answer func(line string, c Cmd) Result) *fake {
+	t.Helper()
+	f := &fake{answer: answer}
+	wasRun, wasUID := run, euid
+	run, euid = f.runner(), func() int { return 1000 }
+	t.Cleanup(func() { run, euid = wasRun, wasUID })
+	return f
+}
+
+func ok(stdout string) Result { return Result{Stdout: stdout} }
+
+func TestKitAnActThatNeedsRootGoesThroughSudoWithoutAPromptUnlessAlreadyRoot(t *testing.T) {
+	was := euid
+	defer func() { euid = was }()
+	euid = func() int { return 1000 }
+	if name, args := argv(Cmd{Name: "x", Args: []string{"a"}, Root: true}); name != "sudo" || strings.Join(args, " ") != "-n x a" {
+		t.Fatalf("not root: %s %v", name, args)
+	}
+	if name, _ := argv(Cmd{Name: "x"}); name != "x" {
+		t.Fatalf("a read is run as the account: %s", name)
+	}
+	euid = func() int { return 0 }
+	if name, _ := argv(Cmd{Name: "x", Root: true}); name != "x" {
+		t.Fatalf("as root no sudo: %s", name)
+	}
+}
+
+func TestKitAFailureIsNamedByHowItFailed(t *testing.T) {
+	was := euid
+	defer func() { euid = was }()
+	euid = func() int { return 1000 }
+	cases := []struct {
+		c    Cmd
+		r    Result
+		want string
+	}{
+		{Cmd{Name: "nothere"}, Result{Status: 127, Error: "not-found"}, "not installed"},
+		{Cmd{Name: "x", Root: true}, Result{Status: 127, Error: "not-found"}, "sudo is not installed"},
+		{Cmd{Name: "x", Root: true}, Result{Status: 1, Stderr: "sudo: a password is required\n"}, "sudo -n refused"},
+		{Cmd{Name: "x", Root: true}, Result{Status: 1, Stderr: "sudo: x: command not found\n"}, "x is not installed"},
+		{Cmd{Name: "x"}, Result{Status: 124, Error: "timeout"}, "within 20s"},
+		{Cmd{Name: "x", Args: []string{"y"}}, Result{Status: 3, Stderr: "boom\n"}, "x y exited 3: boom"},
+		{Cmd{Name: "x"}, Result{Status: 3}, "said nothing"},
+	}
+	for _, k := range cases {
+		err := failure(k.c, k.r)
+		if err == nil || !strings.Contains(err.Error(), k.want) {
+			t.Errorf("%+v: %v, want %q", k.r, err, k.want)
+		}
+	}
+}
+
+func TestKitOutputIsBoundedAndSaysSo(t *testing.T) {
+	var w bounded
+	big := strings.Repeat("a", MostOutput+10)
+	n, _ := w.Write([]byte(big))
+	if n != len(big) || w.b.Len() != MostOutput || !w.cut {
+		t.Fatalf("kept %d of %d, cut %v", w.b.Len(), len(big), w.cut)
+	}
+}
+
+func TestKitTheRealRunnerRunsEndsAndReportsAMissingProgram(t *testing.T) {
+	r := execRun(Cmd{Name: "sh", Args: []string{"-c", "echo out; echo err >&2; exit 3"}})
+	if r.Status != 3 || strings.TrimSpace(r.Stdout) != "out" || strings.TrimSpace(r.Stderr) != "err" {
+		t.Fatalf("%+v", r)
+	}
+	r = execRun(Cmd{Name: "sh", Args: []string{"-c", "sleep 5 & sleep 5"}, Timeout: 200 * time.Millisecond})
+	if r.Error != "timeout" {
+		t.Fatalf("a slow command: %+v", r)
+	}
+	r = execRun(Cmd{Name: "no-such-program-anywhere"})
+	if r.Error != "not-found" {
+		t.Fatalf("a missing program: %+v", r)
+	}
+	r = execRun(Cmd{Name: "cat", Stdin: "given"})
+	if r.Stdout != "given" {
+		t.Fatalf("stdin: %+v", r)
+	}
+	start := time.Now()
+	r = execRun(Cmd{Name: "sh", Args: []string{"-c", "echo kept; (sleep 3 &) ; exit 0"}, Detached: true})
+	if r.Status != 0 || strings.TrimSpace(r.Stdout) != "kept" || time.Since(start) > 2*time.Second {
+		t.Fatalf("a detached command returns when it exits, not when its child does: %+v after %s", r, time.Since(start))
+	}
+}
+
+func TestKitArgumentsAreReadStrictly(t *testing.T) {
+	args := map[string]any{"s": "x", "n": float64(5), "f": 1.5, "b": true, "l": []any{"a", "b"}}
+	if _, err := text(args, "missing"); err == nil {
+		t.Error("a missing required string")
+	}
+	if n, _ := optWhole(args, "n", 1, 1, 3); n != 3 {
+		t.Errorf("held to most: %d", n)
+	}
+	if _, err := optWhole(args, "n", 1, 6, 9); err == nil {
+		t.Error("below least")
+	}
+	if _, err := optWhole(args, "f", 1, 0, 9); err == nil {
+		t.Error("a fraction")
+	}
+	if l, _ := optList(args, "l"); len(l) != 2 {
+		t.Errorf("list: %v", l)
+	}
+	if b, _ := optFlag(args, "b", false); !b {
+		t.Error("flag")
+	}
+	if err := plainName("name", "--all"); err == nil {
+		t.Error("an option as a name")
+	}
+}

modules/flatpak/cmd/flatpak-tools/main.go

@@ -0,0 +1,213 @@
+// The flatpak module's tools (novox/hq research 027/02, 026/05): the applications and runtimes in
+// both installations, the remotes, pending updates, what nothing uses any more and the space it all
+// takes; and installing, removing and updating. A Go bundle the node's runtime launches over stdio
+// (ADR 0188, ADR 0193); it runs as the operator account. An act on the system installation goes
+// through `sudo -n`; one on the account's own installation does not.
+package main
+
+import (
+	"fmt"
+	"os"
+
+	stdio "git.novox.be/novox/mesh-sdk/go"
+)
+
+var providedBy = map[string]string{
+	"flatpak": "the flatpak package, which this module installs",
+	"du":      "the coreutils package",
+}
+
+func main() {
+	if err := stdio.Serve("", tools()); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+}
+
+var installationArg = map[string]any{"type": "string", "enum": []string{"system", "user"},
+	"description": "the system installation (default), or the account's own"}
+
+func installationOf(args map[string]any, def string) (string, error) {
+	i, err := optText(args, "installation", def)
+	if err != nil {
+		return "", err
+	}
+	if i == "" {
+		return "", nil
+	}
+	return i, oneOf("installation", i, "system", "user")
+}
+
+func refArg(args map[string]any, key string) (string, error) {
+	r, err := text(args, key)
+	if err != nil {
+		return "", err
+	}
+	return r, checkRef(r)
+}
+
+func tools() []stdio.Tool {
+	return []stdio.Tool{
+		{
+			Name: "flatpak_list",
+			Description: "The installed applications, in both installations or one: id, name, version, branch, origin, " +
+				"installation and size. (r)",
+			Input: map[string]any{"installation": installationArg},
+			Run: func(args map[string]any) (any, error) {
+				inst, err := installationOf(args, "")
+				if err != nil {
+					return nil, err
+				}
+				return List("app", inst)
+			},
+		},
+		{
+			Name:        "flatpak_runtimes",
+			Description: "The installed runtimes and extensions, in both installations or one: id, branch, origin, installation and size. (r)",
+			Input:       map[string]any{"installation": installationArg},
+			Run: func(args map[string]any) (any, error) {
+				inst, err := installationOf(args, "")
+				if err != nil {
+					return nil, err
+				}
+				return List("runtime", inst)
+			},
+		},
+		{
+			Name: "flatpak_remotes",
+			Description: "The remotes of both installations, with how many installed refs come from each, and findings: " +
+				"Flathub missing from the system installation, the same remote in both installations, a remote nothing " +
+				"is installed from. (r)",
+			Input: map[string]any{},
+			Run:   func(map[string]any) (any, error) { return Remotes() },
+		},
+		{
+			Name:        "flatpak_updates",
+			Description: "What an update would change: each ref with a newer commit on its remote. Asks the remotes, so it needs the network. (r)",
+			Input:       map[string]any{"installation": installationArg},
+			Run: func(args map[string]any) (any, error) {
+				inst, err := installationOf(args, "")
+				if err != nil {
+					return nil, err
+				}
+				return Updates(inst)
+			},
+		},
+		{
+			Name: "flatpak_unused",
+			Description: "The runtimes and extensions no installed application needs any more, computed without changing " +
+				"anything: a runtime is used when an application names it as its runtime or SDK, when it fills an " +
+				"extension point of something used, or when it is pinned. With the space each takes. (r)",
+			Input: map[string]any{},
+			Run:   func(map[string]any) (any, error) { return Unused() },
+		},
+		{
+			Name: "flatpak_disk_usage",
+			Description: "The space flatpak takes: each installation's directory on disk, and the applications and " +
+				"runtimes by size, largest first. (r)",
+			Input: map[string]any{},
+			Run:   func(map[string]any) (any, error) { return DiskUsage() },
+		},
+		{
+			Name: "flatpak_install",
+			Description: "Install an application or runtime from a remote (default flathub), in the system installation " +
+				"(default) or the account's. Answers when finished, or after 18 s with a job to follow with flatpak_job. (a)",
+			Input: map[string]any{
+				"ref":          map[string]any{"type": "string", "description": "an application id such as org.gimp.GIMP, or a full ref"},
+				"remote":       map[string]any{"type": "string", "description": "the remote (default flathub)"},
+				"installation": installationArg,
+			},
+			Run: func(args map[string]any) (any, error) {
+				ref, err := refArg(args, "ref")
+				if err != nil {
+					return nil, err
+				}
+				remote, err := optText(args, "remote", "flathub")
+				if err != nil {
+					return nil, err
+				}
+				inst, err := installationOf(args, "system")
+				if err != nil {
+					return nil, err
+				}
+				return Install(ref, remote, inst)
+			},
+		},
+		{
+			Name:        "flatpak_remove",
+			Description: "Uninstall an application or runtime, keeping its data unless delete_data is set. Answers when finished, or with a job to follow. (a)",
+			Input: map[string]any{
+				"ref":          map[string]any{"type": "string", "description": "the application id or ref"},
+				"installation": installationArg,
+				"delete_data":  map[string]any{"type": "boolean", "description": "remove the application's data in the home too"},
+			},
+			Run: func(args map[string]any) (any, error) {
+				ref, err := refArg(args, "ref")
+				if err != nil {
+					return nil, err
+				}
+				inst, err := installationOf(args, "system")
+				if err != nil {
+					return nil, err
+				}
+				del, err := optFlag(args, "delete_data", false)
+				if err != nil {
+					return nil, err
+				}
+				return Remove(ref, inst, del)
+			},
+		},
+		{
+			Name:        "flatpak_update",
+			Description: "Update one ref, or everything in an installation when no ref is given. Answers when finished, or with a job to follow. (a)",
+			Input: map[string]any{
+				"ref":          map[string]any{"type": "string", "description": "the application id or ref (default all)"},
+				"installation": installationArg,
+			},
+			Run: func(args map[string]any) (any, error) {
+				ref, err := optText(args, "ref", "")
+				if err != nil {
+					return nil, err
+				}
+				if ref != "" {
+					if err := checkRef(ref); err != nil {
+						return nil, err
+					}
+				}
+				inst, err := installationOf(args, "system")
+				if err != nil {
+					return nil, err
+				}
+				return Update(ref, inst)
+			},
+		},
+		{
+			Name: "flatpak_remove_unused",
+			Description: "Uninstall what flatpak itself finds unused in one installation (system by default). " +
+				"flatpak_unused shows what that is beforehand. Answers when finished, or with a job to follow. (a)",
+			Input: map[string]any{"installation": installationArg},
+			Run: func(args map[string]any) (any, error) {
+				inst, err := installationOf(args, "system")
+				if err != nil {
+					return nil, err
+				}
+				return RemoveUnused(inst)
+			},
+		},
+		{
+			Name:        "flatpak_job",
+			Description: "A long act this module started: running or finished, its exit status and the end of its output. Without job, every act this process knows. (r)",
+			Input:       map[string]any{"job": map[string]any{"type": "string", "description": "the job id an act answered"}},
+			Run: func(args map[string]any) (any, error) {
+				id, err := optText(args, "job", "")
+				if err != nil {
+					return nil, err
+				}
+				if id == "" {
+					return map[string]any{"jobs": listJobs()}, nil
+				}
+				return jobByID(id)
+			},
+		},
+	}
+}

modules/flatpak/cmd/flatpak-tools/manifest_kit_test.go

@@ -0,0 +1,107 @@
+package main
+
+// manifest_kit_test.go is the same file in each workstation module: it reads the module's
+// definition so the module's own tests can hold it to what it says.
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+	"testing"
+)
+
+type manifest struct {
+	Module       string           `json:"module"`
+	Capabilities []string         `json:"capabilities"`
+	Claims       []any            `json:"claims"`
+	Seats        []any            `json:"seats"`
+	Tools        []string         `json:"tools"`
+	Resources    []map[string]any `json:"resources"`
+	Build        struct {
+		Artifacts []map[string]any `json:"artifacts"`
+	} `json:"build"`
+}
+
+func readManifest(t *testing.T) manifest {
+	t.Helper()
+	raw, err := os.ReadFile(filepath.Join("..", "..", "module.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var m manifest
+	if err := json.Unmarshal(raw, &m); err != nil {
+		t.Fatalf("module.json: %v", err)
+	}
+	return m
+}
+
+func (m manifest) resource(id string) map[string]any {
+	for _, r := range m.Resources {
+		if r["id"] == id {
+			return r
+		}
+	}
+	return nil
+}
+
+// packages are the packages the module installs, sorted.
+func (m manifest) packages() []string {
+	out := []string{}
+	for _, r := range m.Resources {
+		if r["type"] == "package" && r["absent"] != true {
+			out = append(out, r["package"].(string))
+		}
+	}
+	sort.Strings(out)
+	return out
+}
+
+// services are the units the module declares, by unit name.
+func (m manifest) services() map[string]map[string]any {
+	out := map[string]map[string]any{}
+	for _, r := range m.Resources {
+		if r["type"] == "service" {
+			out[r["unit"].(string)] = r
+		}
+	}
+	return out
+}
+
+// holdsTheBundle holds the manifest to the Go bundle this directory builds: every tool registered
+// is listed and nothing else, each named <prefix>_…, and the artifact builds this command.
+func holdsTheBundle(t *testing.T, m manifest, prefix string) {
+	t.Helper()
+	registered := []string{}
+	for _, tool := range tools() {
+		registered = append(registered, tool.Name)
+		if !strings.HasPrefix(tool.Name, prefix+"_") {
+			t.Errorf("tool %s is not named %s_…", tool.Name, prefix)
+		}
+		if tool.Description == "" || tool.Run == nil || tool.Input == nil {
+			t.Errorf("tool %s is not described, runnable and given an input schema", tool.Name)
+		}
+	}
+	if strings.Join(registered, ",") != strings.Join(m.Tools, ",") {
+		t.Errorf("registered %v, listed %v", registered, m.Tools)
+	}
+	if len(m.Build.Artifacts) != 1 {
+		t.Fatalf("one artifact, got %d", len(m.Build.Artifacts))
+	}
+	cwd, _ := os.Getwd()
+	binary := filepath.Base(cwd)
+	a := m.Build.Artifacts[0]
+	want := map[string]any{"kind": "bundle", "language": "go", "system": "arch", "from": "cmd/" + binary, "binary": binary}
+	for k, v := range want {
+		if a[k] != v {
+			t.Errorf("artifact %s = %v, want %v", k, a[k], v)
+		}
+	}
+	if loads, _ := a["loads"].([]any); len(loads) != 1 || loads[0] != binary {
+		t.Errorf("artifact loads %v, want [%s]", a["loads"], binary)
+	}
+	if m.Claims != nil || m.Seats != nil {
+		t.Errorf("claims %v, seats %v: this module holds no seat", m.Claims, m.Seats)
+	}
+}

modules/flatpak/go.mod

@@ -0,0 +1,5 @@
+module flatpak
+
+go 1.22
+
+require git.novox.be/novox/mesh-sdk/go v0.1.6

modules/flatpak/go.sum

@@ -0,0 +1,2 @@
+git.novox.be/novox/mesh-sdk/go v0.1.6 h1:9qzdYONYbJdWcu6sxQcq9v1LI0JxcfkiKYkMUzJSkVQ=
+git.novox.be/novox/mesh-sdk/go v0.1.6/go.mod h1:GFuZUElBZ9A++mxgIKo97aXXo+kV0uJ/UkbhQPPIbrY=

modules/flatpak/module.json

@@ -0,0 +1,42 @@
+{
+  "module": "flatpak",
+  "version": "1",
+  "capabilities": [
+    "package-manager"
+  ],
+  "tools": [
+    "flatpak_list",
+    "flatpak_runtimes",
+    "flatpak_remotes",
+    "flatpak_updates",
+    "flatpak_unused",
+    "flatpak_disk_usage",
+    "flatpak_install",
+    "flatpak_remove",
+    "flatpak_update",
+    "flatpak_remove_unused",
+    "flatpak_job"
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "flatpak"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/flatpak-tools",
+        "binary": "flatpak-tools",
+        "loads": [
+          "flatpak-tools"
+        ]
+      }
+    ]
+  }
+}

modules/fonts/README.md

@@ -0,0 +1,99 @@
+# fonts
+
+The faces the workstations draw text with, as a module (novox/hq research 026/04, to-be 42 phase 2
+step 1). Assigned to the two workstations.
+
+## Owns
+
+| what | where | class (ADR 0182) |
+|---|---|---|
+| JetBrains Mono Nerd Font, for monospace: terminal, window manager, bar, launcher, prompt | package `ttf-jetbrains-mono-nerd` | package |
+| Inter, for the interface: GTK, Qt, notifications | package `inter-font` | package |
+| Nerd Fonts Symbols, the icon fallback for any face | package `ttf-nerd-fonts-symbols` | package |
+| Noto, for serif and every other script | package `noto-fonts` | package |
+| Noto Color Emoji | package `noto-fonts-emoji` | package |
+| what `monospace`, `sans-serif`, `system-ui`, `serif` and `emoji` mean | `~/.config/fontconfig/conf.d/50-mesh-fonts.conf` | owned, whole |
+
+All five packages are in the distribution's official repositories.
+
+**Why the account's fontconfig directory, not `/etc/fonts/conf.d`.** The choice of faces is the
+operator's taste on the operator's machine, and every program that draws for the operator runs as the
+account. The account's directory is read by fontconfig's stock `50-user.conf`, before the
+distribution's `60-latin.conf`, so the module's file decides the generic families without touching
+anything the distribution owns. Root's tools and any other account keep the distribution's defaults.
+A system file would need a symlink into `conf.d` the way the distribution does it, which the mesh
+never makes (ADR 0012).
+
+**The file in short.** Each generic family prefers the decided face, bound `same` as the request.
+Measured with fontconfig 2.18 on a workstation: a face added with the default (weak) binding loses to
+`Noto Sans Mono` for a plain `monospace` request, because the distribution's own rule decides first.
+The Nerd Fonts symbols and the colour emoji are appended last to every pattern, so an icon or emoji a
+face lacks is still drawn, and they never displace a face that has the character.
+
+## Improves
+
+- **Every program agrees on monospace.** Today `monospace` is `Noto Sans Mono`, while the terminal, the
+  window manager and the bar use a hand-copied Hack. After the push, all of them can say the family
+  and get one face.
+- **Configurations naming a font that is not installed stop falling back to a proportional face.** The
+  launcher's theme asks for `Iosevka Nerd Font` and its power menu for `JetBrains Mono Nerd Font`.
+  Neither is installed on the laptop, so fontconfig falls back to `sans-serif`. The file maps
+  `Hack Nerd Font`, `MesloLGS NF` and `Iosevka Nerd Font` to `monospace` and the old JetBrains name to
+  the new one, for as long as those families are not installed. Where one still is, it is used as
+  before.
+- **Packages instead of copies.** The hand-copied files can go (below), and an upgrade of a face is a
+  package upgrade.
+
+## Tools
+
+All answer JSON; `(r)` reads, `(a)` acts.
+
+| tool | what |
+|---|---|
+| `fonts_families` (r) | installed families: styles, file count, monospaced or not, and source (`package`, `account` for a hand copy, `other`) |
+| `fonts_match` (r) | what each generic family resolves to, beside the decided face, with `all_as_decided`; or any patterns given |
+| `fonts_glyph` (r) | which installed families have a character (given as itself or `U+F120`), and which face monospace and sans-serif draw it with |
+| `fonts_sources` (r) | every hand-copied font file with its family, duplicates, and whether a package now provides the family; marks each `remove` with the reasons; lists packaged families with their package. Removes nothing |
+| `fonts_config` (r) | whether the module's file is in place and loaded by fontconfig, and the account's other fontconfig files beside it |
+| `fonts_cache_rebuild` (a) | rebuild the account's font cache, or with `system: true` the system's (through `sudo -n`) |
+
+## The one-off steps for the operator (ADR 0182)
+
+The mesh removes nothing it did not place. After the first push that assigns this module, on each
+workstation:
+
+1. **Remove the hand-copied files** in `~/.local/share/fonts` that `fonts_sources` marks `remove`, then
+   run `fonts_cache_rebuild`. Measured on 2026-10-04:
+   - **laptop:** the four `HackNerdFont-*.ttf`; the four `MesloLGS NF *.ttf`; the four
+     `MesloLGS%20NF%20*.ttf`, which are the same bytes under URL-encoded names. Twelve files, 30 MB.
+     Nothing stays.
+   - **desktop:** the same twelve, plus `Iosevka-Nerd-Font-Complete.ttf` and
+     `JetBrains-Mono-Nerd-Font-Complete.ttf` (version-2 Nerd builds). `GrapeNuts-Regular.ttf` and
+     `Icomoon-Feather.ttf` came from a theme's repository. They are kept until the theme module decides
+     what it ships.
+   - Do this **after** the modules below name the new family, or the terminal and the bar fall back
+     through the file's aliases to `monospace`, which is the right face anyway.
+2. **Nothing else.** No fontconfig file of the account's own exists today on either workstation.
+
+## Modules that must name the family
+
+Fonts are not a seat (research 026/04): this module says what the generic families mean, and each
+desktop module names its family. Each switches to `JetBrainsMono Nerd Font` when it is written:
+
+| module | today, on both workstations |
+|---|---|
+| `xterm` | `~/.Xresources.d/xterm`: `*faceName: Hack Nerd Font` |
+| `i3` | `~/.config/i3/config`: `font pango: Hack Nerd Font 11`, three times (the window manager and both bars) |
+| the bar (`i3status-rust`) | takes the font i3's bar block names, above |
+| `rofi` | `theme.rasi`: `Iosevka Nerd Font 10`; `powermenu.rasi`: `JetBrains Mono Nerd Font 10` and `Hack Nerd Font bold 32` |
+| `dunst` | `font = Hack Nerd Font 10`, which becomes `Inter` (the interface face) |
+| the prompt (`powerlevel10k`) | nothing: it uses whichever Nerd Font the terminal has |
+
+The DPI fixed in an X resource is the display server's setting (issue 168), not this module's.
+
+## Leaves as found
+
+- `noto-fonts-cjk` and `noto-fonts-extra`, installed on both workstations, and every other font
+  package. The module does not remove a package it did not install.
+- The distribution's fontconfig files under `/etc/fonts`.
+- The theme's two fonts on the desktop, above.

modules/fonts/cmd/fonts-tools/fonts.go

@@ -0,0 +1,522 @@
+package main
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"io"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+	"unicode/utf8"
+)
+
+// ConfigFile is where the module's fontconfig file is placed, under the account's home. fontconfig's
+// stock 50-user.conf reads this directory, before the distribution's 60-latin.conf, so what it says
+// is what the generic families mean.
+const ConfigFile = ".config/fontconfig/conf.d/50-mesh-fonts.conf"
+
+// Decided is the face each generic family means (novox/hq research 026/04).
+var Decided = map[string]string{
+	"monospace":  "JetBrainsMono Nerd Font",
+	"sans-serif": "Inter",
+	"system-ui":  "Inter",
+	"serif":      "Noto Serif",
+	"emoji":      "Noto Color Emoji",
+}
+
+// generics is the order fonts_match answers them in.
+var generics = []string{"monospace", "sans-serif", "system-ui", "serif", "emoji"}
+
+// Retired are the monospace families the desktop's files named before the module; a hand-copied
+// file of one of them is replaced by the decided face.
+var Retired = []string{"Hack Nerd Font", "MesloLGS NF", "Iosevka Nerd Font", "JetBrains Mono Nerd Font", "JetBrainsMono Nerd Font"}
+
+// fontDirs are the account's own font directories, relative to its home.
+var fontDirs = []string{".local/share/fonts", ".fonts"}
+
+const packagedRoot = "/usr/share/fonts/"
+
+// Family is one installed family.
+type Family struct {
+	Family    string   `json:"family"`
+	Styles    []string `json:"styles"`
+	Files     int      `json:"files"`
+	Monospace bool     `json:"monospace"`
+	Source    string   `json:"source"`
+}
+
+// FamiliesAnswer is what fonts_families answers.
+type FamiliesAnswer struct {
+	Count     int      `json:"count"`
+	Families  []Family `json:"families"`
+	Truncated bool     `json:"truncated,omitempty"`
+}
+
+func sourceOf(file string) string {
+	home := accountHome()
+	switch {
+	case home != "" && strings.HasPrefix(file, strings.TrimRight(home, "/")+"/"):
+		return "account"
+	case strings.HasPrefix(file, packagedRoot):
+		return "package"
+	}
+	return "other"
+}
+
+func accountHome() string {
+	if h := strings.TrimSpace(os.Getenv("MESH_OPERATOR_HOME")); h != "" {
+		return h
+	}
+	h, _ := os.UserHomeDir()
+	return h
+}
+
+// Families lists what fc-list knows, by family.
+func Families(contains string, limit int) (FamiliesAnswer, error) {
+	r, err := call(Cmd{Name: "fc-list", Args: []string{"--format", "%{family[0]}\t%{style[0]}\t%{spacing}\t%{file}\n"}})
+	if err != nil {
+		return FamiliesAnswer{}, err
+	}
+	by := map[string]*Family{}
+	styles := map[string]map[string]bool{}
+	sources := map[string]map[string]bool{}
+	for _, l := range lines(r.Stdout) {
+		f := strings.Split(l, "\t")
+		if len(f) < 4 || f[0] == "" {
+			continue
+		}
+		name := f[0]
+		if contains != "" && !strings.Contains(strings.ToLower(name), strings.ToLower(contains)) {
+			continue
+		}
+		if by[name] == nil {
+			by[name] = &Family{Family: name, Monospace: true}
+			styles[name], sources[name] = map[string]bool{}, map[string]bool{}
+		}
+		fam := by[name]
+		fam.Files++
+		if f[1] != "" {
+			styles[name][f[1]] = true
+		}
+		// fontconfig's spacing: 100 mono, 110 charcell, 90 dual; absent is proportional.
+		if f[2] != "100" && f[2] != "110" && f[2] != "90" {
+			fam.Monospace = false
+		}
+		sources[name][sourceOf(f[3])] = true
+	}
+	out := FamiliesAnswer{Families: []Family{}}
+	for name, fam := range by {
+		fam.Styles = keys(styles[name])
+		fam.Source = strings.Join(keys(sources[name]), "+")
+		out.Families = append(out.Families, *fam)
+	}
+	sort.Slice(out.Families, func(i, k int) bool { return out.Families[i].Family < out.Families[k].Family })
+	out.Count = len(out.Families)
+	if len(out.Families) > limit {
+		out.Families, out.Truncated = out.Families[:limit], true
+	}
+	return out, nil
+}
+
+func keys(m map[string]bool) []string {
+	out := make([]string, 0, len(m))
+	for k := range m {
+		out = append(out, k)
+	}
+	sort.Strings(out)
+	return out
+}
+
+// Resolved is what one pattern resolves to.
+type Resolved struct {
+	Asked     string `json:"asked"`
+	Family    string `json:"family"`
+	Style     string `json:"style"`
+	File      string `json:"file"`
+	Source    string `json:"source"`
+	Decided   string `json:"decided,omitempty"`
+	AsDecided *bool  `json:"as_decided,omitempty"`
+}
+
+func checkPattern(p string) error {
+	if strings.HasPrefix(p, "-") || strings.ContainsAny(p, "\n\t") {
+		return fmt.Errorf("%q is not a fontconfig pattern", p)
+	}
+	return nil
+}
+
+func resolve(pattern string) (Resolved, error) {
+	if err := checkPattern(pattern); err != nil {
+		return Resolved{}, err
+	}
+	r, err := call(Cmd{Name: "fc-match", Args: []string{"--format", "%{family[0]}\t%{style[0]}\t%{file}", pattern}})
+	if err != nil {
+		return Resolved{}, err
+	}
+	f := strings.Split(strings.TrimSpace(r.Stdout), "\t")
+	if len(f) < 3 || f[0] == "" {
+		return Resolved{}, fmt.Errorf("fc-match answered nothing usable for %q: %q", pattern, strings.TrimSpace(r.Stdout))
+	}
+	return Resolved{Asked: pattern, Family: f[0], Style: f[1], File: f[2], Source: sourceOf(f[2])}, nil
+}
+
+// MatchAnswer is what fonts_match answers.
+type MatchAnswer struct {
+	Resolved []Resolved `json:"resolved"`
+	// AllAsDecided is set when only the generics were asked, and says whether each is the decided face.
+	AllAsDecided *bool `json:"all_as_decided,omitempty"`
+}
+
+// Match resolves the generic families, or the patterns given.
+func Match(patterns []string) (MatchAnswer, error) {
+	generic := len(patterns) == 0
+	if generic {
+		patterns = generics
+	}
+	out := MatchAnswer{Resolved: []Resolved{}}
+	all := true
+	for _, p := range patterns {
+		r, err := resolve(p)
+		if err != nil {
+			return MatchAnswer{}, err
+		}
+		if want, ok := Decided[p]; ok {
+			agree := r.Family == want
+			r.Decided, r.AsDecided = want, &agree
+			all = all && agree
+		}
+		out.Resolved = append(out.Resolved, r)
+	}
+	if generic {
+		out.AllAsDecided = &all
+	}
+	return out, nil
+}
+
+// codePoint reads one character, or a code point written U+XXXX or 0xXXXX.
+func codePoint(s string) (rune, error) {
+	s = strings.TrimSpace(s)
+	if utf8.RuneCountInString(s) == 1 {
+		r, _ := utf8.DecodeRuneInString(s)
+		return r, nil
+	}
+	up := strings.ToUpper(s)
+	for _, prefix := range []string{"U+", "0X"} {
+		if strings.HasPrefix(up, prefix) {
+			n, err := strconv.ParseUint(up[len(prefix):], 16, 32)
+			if err != nil || n == 0 || n > utf8.MaxRune {
+				return 0, fmt.Errorf("%q is not a code point", s)
+			}
+			return rune(n), nil
+		}
+	}
+	return 0, fmt.Errorf("give one character, or its code point as U+XXXX or 0xXXXX, not %q", s)
+}
+
+// GlyphAnswer is what fonts_glyph answers.
+type GlyphAnswer struct {
+	CodePoint string            `json:"code_point"`
+	Character string            `json:"character"`
+	Count     int               `json:"count"`
+	Families  []Family          `json:"families"`
+	DrawnBy   map[string]string `json:"drawn_by"`
+	Truncated bool              `json:"truncated,omitempty"`
+}
+
+// Glyph answers which fonts have a character and which face the generics would draw it with.
+func Glyph(s string) (GlyphAnswer, error) {
+	cp, err := codePoint(s)
+	if err != nil {
+		return GlyphAnswer{}, err
+	}
+	hx := strconv.FormatInt(int64(cp), 16)
+	r, err := call(Cmd{Name: "fc-list", Args: []string{"--format", "%{family[0]}\t%{style[0]}\t%{spacing}\t%{file}\n", ":charset=" + hx}})
+	if err != nil {
+		return GlyphAnswer{}, err
+	}
+	by := map[string]*Family{}
+	for _, l := range lines(r.Stdout) {
+		f := strings.Split(l, "\t")
+		if len(f) < 4 || f[0] == "" {
+			continue
+		}
+		if by[f[0]] == nil {
+			by[f[0]] = &Family{Family: f[0], Monospace: f[2] == "100" || f[2] == "110" || f[2] == "90", Source: sourceOf(f[3]), Styles: []string{}}
+		}
+		by[f[0]].Files++
+	}
+	out := GlyphAnswer{CodePoint: fmt.Sprintf("U+%04X", cp), Character: string(cp), Families: []Family{}, DrawnBy: map[string]string{}}
+	for _, f := range by {
+		out.Families = append(out.Families, *f)
+	}
+	sort.Slice(out.Families, func(i, k int) bool { return out.Families[i].Family < out.Families[k].Family })
+	out.Count = len(out.Families)
+	if len(out.Families) > 200 {
+		out.Families, out.Truncated = out.Families[:200], true
+	}
+	for _, g := range []string{"monospace", "sans-serif"} {
+		res, err := resolve(g + ":charset=" + hx)
+		if err != nil {
+			return GlyphAnswer{}, err
+		}
+		out.DrawnBy[g] = res.Family
+	}
+	return out, nil
+}
+
+// HandFile is one font file copied into the account's home.
+type HandFile struct {
+	File   string   `json:"file"`
+	Family string   `json:"family"`
+	Style  string   `json:"style"`
+	Bytes  int64    `json:"bytes"`
+	Remove bool     `json:"remove"`
+	Why    []string `json:"why,omitempty"`
+	sum    string
+}
+
+// Packaged is a family a package installs.
+type Packaged struct {
+	Family  string `json:"family"`
+	Package string `json:"package"`
+}
+
+// SourcesAnswer is what fonts_sources answers.
+type SourcesAnswer struct {
+	Hand        []HandFile `json:"hand_copied"`
+	HandBytes   int64      `json:"hand_copied_bytes"`
+	RemoveCount int        `json:"removable"`
+	Packaged    []Packaged `json:"packaged"`
+	Note        string     `json:"note"`
+}
+
+var fontExt = map[string]bool{".ttf": true, ".otf": true, ".ttc": true, ".otc": true, ".pfb": true, ".pcf": true, ".woff": true, ".woff2": true, ".bdf": true}
+
+// handFiles walks the account's font directories.
+func handFiles(home string) ([]HandFile, error) {
+	out := []HandFile{}
+	for _, d := range fontDirs {
+		root := filepath.Join(home, d)
+		err := filepath.WalkDir(root, func(p string, e fs.DirEntry, err error) error {
+			if err != nil {
+				if p == root && os.IsNotExist(err) {
+					return filepath.SkipDir
+				}
+				return err
+			}
+			if e.IsDir() || !fontExt[strings.ToLower(filepath.Ext(p))] {
+				return nil
+			}
+			info, err := e.Info()
+			if err != nil {
+				return err
+			}
+			f, err := os.Open(p)
+			if err != nil {
+				return err
+			}
+			h := sha256.New()
+			_, err = io.Copy(h, f)
+			f.Close()
+			if err != nil {
+				return err
+			}
+			out = append(out, HandFile{File: p, Bytes: info.Size(), sum: hex.EncodeToString(h.Sum(nil))})
+			return nil
+		})
+		if err != nil && err != filepath.SkipDir {
+			return nil, fmt.Errorf("reading %s: %w", root, err)
+		}
+	}
+	sort.Slice(out, func(i, k int) bool { return out[i].File < out[k].File })
+	return out, nil
+}
+
+// Sources says which font files were copied by hand, which of them can go, and which families
+// packages install.
+func Sources() (SourcesAnswer, error) {
+	home := accountHome()
+	hand, err := handFiles(home)
+	if err != nil {
+		return SourcesAnswer{}, err
+	}
+	out := SourcesAnswer{Hand: hand, Packaged: []Packaged{},
+		Note: "Nothing is removed by this tool. The mesh removes nothing it did not place (ADR 0182): a file marked remove is for the operator to delete, once; then run fonts_cache_rebuild."}
+	if len(hand) > 0 {
+		args := []string{"--format", "%{file}\t%{family[0]}\t%{style[0]}\n"}
+		for _, h := range hand {
+			args = append(args, h.File)
+		}
+		r, err := call(Cmd{Name: "fc-scan", Args: args})
+		if err != nil {
+			return SourcesAnswer{}, err
+		}
+		named := map[string][2]string{}
+		for _, l := range lines(r.Stdout) {
+			f := strings.Split(l, "\t")
+			if len(f) >= 3 {
+				if _, seen := named[f[0]]; !seen {
+					named[f[0]] = [2]string{f[1], f[2]}
+				}
+			}
+		}
+		for i := range out.Hand {
+			n := named[out.Hand[i].File]
+			out.Hand[i].Family, out.Hand[i].Style = n[0], n[1]
+		}
+	}
+	// Families the packages install, each with one file to ask pacman about.
+	r, err := call(Cmd{Name: "fc-list", Args: []string{"--format", "%{family[0]}\t%{file}\n"}})
+	if err != nil {
+		return SourcesAnswer{}, err
+	}
+	fileOf := map[string]string{}
+	for _, l := range lines(r.Stdout) {
+		f := strings.Split(l, "\t")
+		if len(f) >= 2 && f[0] != "" && strings.HasPrefix(f[1], packagedRoot) {
+			if _, seen := fileOf[f[0]]; !seen {
+				fileOf[f[0]] = f[1]
+			}
+		}
+	}
+	owner := map[string]string{}
+	if len(fileOf) > 0 {
+		args := []string{"-Qo"}
+		for _, fam := range keys(boolSet(fileOf)) {
+			args = append(args, fileOf[fam])
+		}
+		// pacman exits 1 when one file is unowned and still answers the rest: read what it said.
+		r := run(Cmd{Name: "pacman", Args: args})
+		if r.Error != "" {
+			return SourcesAnswer{}, failure(Cmd{Name: "pacman", Args: []string{"-Qo"}}, r)
+		}
+		for _, l := range lines(r.Stdout) {
+			// "/usr/share/fonts/x.ttf is owned by noto-fonts 1:2026.08.01-1"
+			if i := strings.Index(l, " is owned by "); i > 0 {
+				pkg := strings.Fields(l[i+len(" is owned by "):])
+				if len(pkg) > 0 {
+					owner[l[:i]] = pkg[0]
+				}
+			}
+		}
+	}
+	for _, fam := range keys(boolSet(fileOf)) {
+		pkg := owner[fileOf[fam]]
+		if pkg == "" {
+			pkg = "(no package)"
+		}
+		out.Packaged = append(out.Packaged, Packaged{Family: fam, Package: pkg})
+	}
+	// Which hand-copied files can go, and why.
+	firstOf := map[string]string{}
+	for i := range out.Hand {
+		h := &out.Hand[i]
+		if prev, dup := firstOf[h.sum]; dup {
+			h.Why = append(h.Why, "the same bytes as "+filepath.Base(prev))
+		} else {
+			firstOf[h.sum] = h.File
+		}
+		if strings.Contains(filepath.Base(h.File), "%20") {
+			h.Why = append(h.Why, "a URL-encoded copy of a name")
+		}
+		if pkg := owner[fileOf[h.Family]]; h.Family != "" && pkg != "" {
+			h.Why = append(h.Why, "its family is installed by the package "+pkg)
+		}
+		for _, r := range Retired {
+			if h.Family == r {
+				h.Why = append(h.Why, "a monospace face the desktop named before the fonts module; "+Decided["monospace"]+" replaces it once the terminal, window manager, bar and launcher name that family")
+				break
+			}
+		}
+		h.Remove = len(h.Why) > 0
+		out.HandBytes += h.Bytes
+		if h.Remove {
+			out.RemoveCount++
+		}
+	}
+	return out, nil
+}
+
+func boolSet(m map[string]string) map[string]bool {
+	out := map[string]bool{}
+	for k := range m {
+		out[k] = true
+	}
+	return out
+}
+
+// ConfigAnswer is what fonts_config answers.
+type ConfigAnswer struct {
+	Path    string   `json:"path"`
+	Present bool     `json:"present"`
+	Loaded  bool     `json:"loaded"`
+	Bytes   int      `json:"bytes,omitempty"`
+	Others  []string `json:"account_files_beside_it"`
+	Note    string   `json:"note,omitempty"`
+}
+
+// Config says whether the module's file is in place and loaded.
+func Config() (ConfigAnswer, error) {
+	path := filepath.Join(accountHome(), ConfigFile)
+	out := ConfigAnswer{Path: path, Others: []string{}}
+	if b, err := os.ReadFile(path); err == nil {
+		out.Present, out.Bytes = true, len(b)
+	} else if !os.IsNotExist(err) {
+		return ConfigAnswer{}, fmt.Errorf("reading %s: %w", path, err)
+	}
+	entries, _ := os.ReadDir(filepath.Dir(path))
+	for _, e := range entries {
+		if p := filepath.Join(filepath.Dir(path), e.Name()); p != path {
+			out.Others = append(out.Others, p)
+		}
+	}
+	if b, err := os.ReadFile(filepath.Join(accountHome(), ".config/fontconfig/fonts.conf")); err == nil && len(b) > 0 {
+		out.Others = append(out.Others, filepath.Join(accountHome(), ".config/fontconfig/fonts.conf"))
+	}
+	r, err := call(Cmd{Name: "fc-conflist"})
+	if err != nil {
+		return ConfigAnswer{}, err
+	}
+	for _, l := range lines(r.Stdout) {
+		// "+ /path: description" for a file in use, "- /path" for one skipped
+		if strings.HasPrefix(l, "+ "+path+":") || strings.TrimSpace(l) == "+ "+path {
+			out.Loaded = true
+		}
+	}
+	if !out.Present {
+		out.Note = "the file is not in place: the fonts module is not assigned to this machine, or its push has not reached it"
+	} else if !out.Loaded {
+		out.Note = "the file is in place and fontconfig does not load it: check that /etc/fonts/conf.d/50-user.conf is enabled"
+	}
+	if len(out.Others) > 0 {
+		out.Note = strings.TrimSpace(out.Note + " The other files are the account's own: they are read too, and one sorting after 50-mesh-fonts.conf can override it.")
+	}
+	return out, nil
+}
+
+// RebuildAnswer is what fonts_cache_rebuild answers.
+type RebuildAnswer struct {
+	Scope     string `json:"scope"`
+	ElapsedMS int64  `json:"elapsed_ms"`
+	Output    string `json:"output,omitempty"`
+}
+
+// CacheRebuild rebuilds the account's font cache, or the system's.
+func CacheRebuild(system bool) (RebuildAnswer, error) {
+	c := Cmd{Name: "fc-cache", Args: []string{"-f"}}
+	scope := "account"
+	if system {
+		c, scope = Cmd{Name: "fc-cache", Args: []string{"-s", "-f"}, Root: true}, "system"
+	}
+	start := time.Now()
+	r, err := call(c)
+	if err != nil {
+		return RebuildAnswer{}, err
+	}
+	return RebuildAnswer{Scope: scope, ElapsedMS: time.Since(start).Milliseconds(), Output: tail(strings.TrimSpace(r.Stdout+r.Stderr), 4000)}, nil
+}

modules/fonts/cmd/fonts-tools/fonts_test.go

@@ -0,0 +1,302 @@
+package main
+
+import (
+	"encoding/xml"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestTheManifestInstallsTheFiveDecidedFacesAndOwnsOneAccountFile(t *testing.T) {
+	m := readManifest(t)
+	holdsTheBundle(t, m, "fonts")
+	want := "inter-font,noto-fonts,noto-fonts-emoji,ttf-jetbrains-mono-nerd,ttf-nerd-fonts-symbols"
+	if got := strings.Join(m.packages(), ","); got != want {
+		t.Errorf("packages %s, want %s", got, want)
+	}
+	files := 0
+	for _, r := range m.Resources {
+		if r["type"] == "file" {
+			files++
+		}
+		if r["type"] == "service" || r["type"] == "directory" {
+			t.Errorf("a font needs no %s: %v", r["type"], r["id"])
+		}
+	}
+	f := m.resource("defaults")
+	if files != 1 || f == nil {
+		t.Fatalf("one owned file, got %d", files)
+	}
+	if f["path"] != "${machine:account-home}/"+ConfigFile || f["owner"] != "${machine:account}" || f["mode"] != "0644" {
+		t.Errorf("the file is the account's, at %s: %v", ConfigFile, f)
+	}
+	if _, into := f["into"]; into {
+		t.Error("the file is the module's whole, not written into")
+	}
+}
+
+// fontconfig's document, as far as the module's file uses it.
+type fcDoc struct {
+	Aliases []struct {
+		Binding string   `xml:"binding,attr"`
+		Family  string   `xml:"family"`
+		Prefer  []string `xml:"prefer>family"`
+		Accept  []string `xml:"accept>family"`
+	} `xml:"alias"`
+	Matches []struct {
+		Target string `xml:"target,attr"`
+		Edits  []struct {
+			Name   string `xml:"name,attr"`
+			Mode   string `xml:"mode,attr"`
+			String string `xml:"string"`
+		} `xml:"edit"`
+	} `xml:"match"`
+}
+
+func TestTheFontconfigFileMapsEachGenericToTheDecidedFaceStronglyAndFallsBackLast(t *testing.T) {
+	m := readManifest(t)
+	content, _ := m.resource("defaults")["content"].(string)
+	if !strings.HasPrefix(content, "<?xml") || !strings.Contains(content, `<!DOCTYPE fontconfig`) {
+		t.Fatal("not a fontconfig document")
+	}
+	if strings.Contains(content, "$") {
+		t.Error("the file holds no placeholder: it is the same on every machine")
+	}
+	var doc fcDoc
+	if err := xml.Unmarshal([]byte(content), &doc); err != nil {
+		t.Fatalf("not well-formed: %v", err)
+	}
+	firstPrefer := map[string]string{}
+	order := []string{}
+	for _, a := range doc.Aliases {
+		order = append(order, a.Family)
+		if len(a.Prefer) > 0 {
+			firstPrefer[a.Family] = a.Prefer[0]
+			if a.Binding != "same" {
+				t.Errorf("%s is bound %q: a weakly added face loses to the distribution's choice", a.Family, a.Binding)
+			}
+		}
+	}
+	for generic, face := range Decided {
+		if firstPrefer[generic] != face {
+			t.Errorf("%s prefers %q, decided %q", generic, firstPrefer[generic], face)
+		}
+	}
+	// The retired families lead to monospace, and are placed before the monospace rule.
+	mono := strings.Index(strings.Join(order, "|"), "|monospace|")
+	for _, r := range []string{"Hack Nerd Font", "MesloLGS NF", "Iosevka Nerd Font"} {
+		at := strings.Index(strings.Join(order, "|"), r)
+		if at < 0 || at > mono {
+			t.Errorf("%s is not mapped to monospace before the monospace rule", r)
+		}
+	}
+	if len(doc.Matches) != 1 || doc.Matches[0].Target != "pattern" {
+		t.Fatalf("one pattern match for the fallbacks: %+v", doc.Matches)
+	}
+	got := []string{}
+	for _, e := range doc.Matches[0].Edits {
+		if e.Name != "family" || e.Mode != "append_last" {
+			t.Errorf("a fallback is appended last, never prepended: %+v", e)
+		}
+		got = append(got, e.String)
+	}
+	if strings.Join(got, ",") != "Symbols Nerd Font,Noto Color Emoji" {
+		t.Errorf("fallbacks %v", got)
+	}
+}
+
+func TestFamiliesGroupsFilesAndTellsAHandCopiedFaceFromAPackagedOne(t *testing.T) {
+	t.Setenv("MESH_OPERATOR_HOME", "/home/op")
+	using(t, func(line string, c Cmd) Result {
+		return ok("Inter\tRegular\t\t/usr/share/fonts/inter/Inter.ttc\n" +
+			"Inter\tBold\t\t/usr/share/fonts/inter/Inter-Bold.ttc\n" +
+			"Hack Nerd Font\tRegular\t100\t/home/op/.local/share/fonts/Hack.ttf\n" +
+			"Noto Sans Mono\tRegular\t100\t/usr/share/fonts/noto/NotoSansMono.ttf\n")
+	})
+	got, err := Families("", 10)
+	if err != nil || got.Count != 3 {
+		t.Fatalf("%+v %v", got, err)
+	}
+	if f := got.Families[0]; f.Family != "Hack Nerd Font" || f.Source != "account" || !f.Monospace {
+		t.Errorf("%+v", f)
+	}
+	if f := got.Families[1]; f.Family != "Inter" || f.Files != 2 || f.Monospace || f.Source != "package" || len(f.Styles) != 2 {
+		t.Errorf("%+v", f)
+	}
+	got, _ = Families("noto", 10)
+	if got.Count != 1 {
+		t.Errorf("filtered: %+v", got)
+	}
+	got, _ = Families("", 1)
+	if !got.Truncated || len(got.Families) != 1 || got.Count != 3 {
+		t.Errorf("bounded: %+v", got)
+	}
+}
+
+func TestMatchSaysWhetherEachGenericIsTheDecidedFace(t *testing.T) {
+	f := using(t, func(line string, c Cmd) Result {
+		switch c.Args[len(c.Args)-1] {
+		case "monospace":
+			return ok("JetBrainsMono Nerd Font\tRegular\t/usr/share/fonts/TTF/JetBrainsMonoNerdFont-Regular.ttf")
+		case "sans-serif", "system-ui":
+			return ok("Noto Sans\tRegular\t/usr/share/fonts/noto/NotoSans-Regular.ttf")
+		case "serif":
+			return ok("Noto Serif\tRegular\t/usr/share/fonts/noto/NotoSerif-Regular.ttf")
+		}
+		return ok("Noto Color Emoji\tRegular\t/usr/share/fonts/noto/NotoColorEmoji.ttf")
+	})
+	got, err := Match(nil)
+	if err != nil || len(got.Resolved) != 5 || got.AllAsDecided == nil || *got.AllAsDecided {
+		t.Fatalf("%+v %v", got, err)
+	}
+	if r := got.Resolved[0]; !*r.AsDecided || r.Source != "package" {
+		t.Errorf("monospace: %+v", r)
+	}
+	if r := got.Resolved[1]; *r.AsDecided || r.Decided != "Inter" {
+		t.Errorf("sans-serif is not Inter here: %+v", r)
+	}
+	if len(f.asked) != 5 {
+		t.Errorf("one fc-match per generic: %v", f.lines())
+	}
+	got, _ = Match([]string{"Inter:bold"})
+	if got.AllAsDecided != nil || got.Resolved[0].AsDecided != nil {
+		t.Errorf("a pattern of the caller's own has no decided face: %+v", got)
+	}
+	if _, err := Match([]string{"--help"}); err == nil {
+		t.Error("an option as a pattern")
+	}
+}
+
+func TestMatchAnEmptyAnswerIsAnError(t *testing.T) {
+	using(t, func(string, Cmd) Result { return ok("") })
+	if _, err := Match(nil); err == nil {
+		t.Fatal("an empty fc-match answer was read as a face")
+	}
+}
+
+func TestGlyphReadsACharacterOrACodePointAndAsksForIt(t *testing.T) {
+	for in, want := range map[string]rune{"\uf120": 0xf120, "U+F120": 0xf120, "0x1f600": 0x1f600, "a": 'a', "é": 'é'} {
+		got, err := codePoint(in)
+		if err != nil || got != want {
+			t.Errorf("%q: %x %v", in, got, err)
+		}
+	}
+	for _, bad := range []string{"ab", "U+ZZ", "U+0", "120"} {
+		if _, err := codePoint(bad); err == nil {
+			t.Errorf("%q was read as a code point", bad)
+		}
+	}
+	f := using(t, func(line string, c Cmd) Result {
+		if c.Name == "fc-list" {
+			return ok("Symbols Nerd Font\tRegular\t100\t/usr/share/fonts/TTF/SymbolsNerdFont-Regular.ttf\n" +
+				"JetBrainsMono Nerd Font\tBold\t100\t/usr/share/fonts/TTF/a.ttf\nJetBrainsMono Nerd Font\tRegular\t100\t/usr/share/fonts/TTF/b.ttf\n")
+		}
+		return ok("JetBrainsMono Nerd Font\tRegular\t/usr/share/fonts/TTF/b.ttf")
+	})
+	got, err := Glyph("U+F120")
+	if err != nil || got.Count != 2 || got.CodePoint != "U+F120" || got.DrawnBy["monospace"] != "JetBrainsMono Nerd Font" {
+		t.Fatalf("%+v %v", got, err)
+	}
+	if !strings.Contains(f.lines()[0], ":charset=f120") || !strings.Contains(f.lines()[1], "monospace:charset=f120") {
+		t.Errorf("asked %v", f.lines())
+	}
+}
+
+func TestSourcesMarksDuplicatesEncodedNamesPackagedAndRetiredFacesForRemoval(t *testing.T) {
+	home := t.TempDir()
+	t.Setenv("MESH_OPERATOR_HOME", home)
+	dir := filepath.Join(home, ".local/share/fonts")
+	_ = os.MkdirAll(dir, 0o755)
+	write := func(name, body string) string {
+		p := filepath.Join(dir, name)
+		_ = os.WriteFile(p, []byte(body), 0o644)
+		return p
+	}
+	meslo := write("MesloLGS NF Regular.ttf", "meslo")
+	encoded := write("MesloLGS%20NF%20Regular.ttf", "meslo")
+	grape := write("GrapeNuts-Regular.ttf", "grape")
+	noto := write("NotoSans-Copy.ttf", "noto")
+	_ = os.WriteFile(filepath.Join(dir, ".uuid"), []byte("x"), 0o644)
+	f := using(t, func(line string, c Cmd) Result {
+		switch c.Name {
+		case "fc-scan":
+			return ok(meslo + "\tMesloLGS NF\tRegular\n" + encoded + "\tMesloLGS NF\tRegular\n" + grape + "\tGrape Nuts\tRegular\n" + noto + "\tNoto Sans\tRegular\n")
+		case "fc-list":
+			return ok("Noto Sans\t/usr/share/fonts/noto/NotoSans-Regular.ttf\nNoto Sans\t/usr/share/fonts/noto/NotoSans-Bold.ttf\nInter\t/usr/share/fonts/inter/Inter.ttc\nMesloLGS NF\t" + meslo + "\n")
+		case "pacman":
+			return Result{Status: 1, Stdout: "/usr/share/fonts/noto/NotoSans-Regular.ttf is owned by noto-fonts 1:2026.08.01-1\n", Stderr: "error: No package owns /usr/share/fonts/inter/Inter.ttc\n"}
+		}
+		return Result{Status: 9}
+	})
+	got, err := Sources()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got.Hand) != 4 {
+		t.Fatalf("four font files, the .uuid is not one: %+v", got.Hand)
+	}
+	by := map[string]HandFile{}
+	for _, h := range got.Hand {
+		by[filepath.Base(h.File)] = h
+	}
+	if h := by["GrapeNuts-Regular.ttf"]; h.Remove || h.Family != "Grape Nuts" {
+		t.Errorf("a face nothing replaces is kept: %+v", h)
+	}
+	if h := by["MesloLGS%20NF%20Regular.ttf"]; !h.Remove || len(h.Why) < 3 {
+		t.Errorf("an encoded duplicate of a retired face: %+v", h)
+	}
+	if h := by["NotoSans-Copy.ttf"]; !h.Remove || !strings.Contains(strings.Join(h.Why, ";"), "noto-fonts") {
+		t.Errorf("a face a package installs: %+v", h)
+	}
+	if got.RemoveCount != 3 || got.HandBytes != int64(len("meslo")*2+len("grape")+len("noto")) {
+		t.Errorf("%d removable, %d bytes", got.RemoveCount, got.HandBytes)
+	}
+	pk := map[string]string{}
+	for _, p := range got.Packaged {
+		pk[p.Family] = p.Package
+	}
+	if pk["Noto Sans"] != "noto-fonts" || pk["Inter"] != "(no package)" || pk["MesloLGS NF"] != "" {
+		t.Errorf("packaged %v", pk)
+	}
+	for _, l := range f.lines() {
+		if strings.Contains(l, "rm ") || strings.HasPrefix(l, "sudo") {
+			t.Errorf("sources only reads: %s", l)
+		}
+	}
+}
+
+func TestConfigSaysWhetherTheFileIsInPlaceAndLoaded(t *testing.T) {
+	home := t.TempDir()
+	t.Setenv("MESH_OPERATOR_HOME", home)
+	path := filepath.Join(home, ConfigFile)
+	using(t, func(string, Cmd) Result { return ok("+ " + path + ": The mesh\n- /etc/fonts/conf.d/x.conf\n") })
+	got, err := Config()
+	if err != nil || got.Present || !strings.Contains(got.Note, "not in place") {
+		t.Fatalf("absent: %+v %v", got, err)
+	}
+	_ = os.MkdirAll(filepath.Dir(path), 0o755)
+	_ = os.WriteFile(path, []byte("<fontconfig/>"), 0o644)
+	_ = os.WriteFile(filepath.Join(filepath.Dir(path), "99-mine.conf"), []byte("x"), 0o644)
+	got, err = Config()
+	if err != nil || !got.Present || !got.Loaded || len(got.Others) != 1 {
+		t.Fatalf("present: %+v %v", got, err)
+	}
+}
+
+func TestCacheRebuildIsTheAccountsUnlessTheSystemIsAskedWhichNeedsRoot(t *testing.T) {
+	f := using(t, func(string, Cmd) Result { return ok("") })
+	if got, err := CacheRebuild(false); err != nil || got.Scope != "account" {
+		t.Fatal(got, err)
+	}
+	if got, err := CacheRebuild(true); err != nil || got.Scope != "system" {
+		t.Fatal(got, err)
+	}
+	if l := f.lines(); l[0] != "fc-cache -f" || l[1] != "sudo -n fc-cache -s -f" {
+		t.Errorf("%v", l)
+	}
+	using(t, func(string, Cmd) Result { return Result{Status: 1, Stderr: "sudo: a password is required"} })
+	if _, err := CacheRebuild(true); err == nil || !strings.Contains(err.Error(), "sudo -n refused") {
+		t.Errorf("a refused escalation: %v", err)
+	}
+}

modules/fonts/cmd/fonts-tools/kit.go

@@ -0,0 +1,352 @@
+package main
+
+// kit.go is the same file in each of the workstations' tool bundles (fonts, docker-compose, snapd,
+// flatpak, cups, bluetooth, xclip, dmenu): how a tool runs a command, escalates, bounds what it
+// keeps, and names a failure. A module is built from its own directory, so the file is copied rather
+// than shared; a change to one copy is made to all eight.
+//
+// The rules it holds (novox/hq research 026/05, to-be 38 WP4):
+//   - the node's tool runtime runs as the operator account, not root (ADR 0175 §4); a command that
+//     needs root goes through `sudo -n`, never a prompt, and a refusal is named as such;
+//   - one command gets 20 s, below the runtime's 30 s call limit, and is ended with everything it
+//     started when it takes longer;
+//   - each stream is kept to 256 KiB, and the answer says when it was cut;
+//   - a failure is an error with what went wrong in it, never an empty answer.
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"strings"
+	"syscall"
+	"time"
+)
+
+// Bounds every command is held to.
+const (
+	CallTimeout = 20 * time.Second
+	MostOutput  = 256 << 10
+)
+
+// Cmd is one command a tool runs.
+type Cmd struct {
+	Name string
+	Args []string
+	// Stdin is written to the command's standard input when not empty.
+	Stdin string
+	// Env is added to this process's own environment.
+	Env []string
+	// Root says the command needs root: it is run through `sudo -n` when this process is not root.
+	Root bool
+	// Timeout replaces CallTimeout; only a background job (jobs.go) asks for longer.
+	Timeout time.Duration
+	// Detached is for a program that forks a child which outlives it, as xclip does to keep the
+	// selection: its streams go to files, because a pipe the child inherits would hold the call open
+	// until the child exits.
+	Detached bool
+}
+
+// Result is what a command did.
+type Result struct {
+	Stdout string `json:"stdout"`
+	Stderr string `json:"stderr"`
+	Status int    `json:"status"`
+	// Error is why it did not run to an answer: "not-found" when the program is not there,
+	// "timeout" when it was ended for taking too long, else the spawn error.
+	Error     string `json:"error,omitempty"`
+	Truncated bool   `json:"truncated,omitempty"`
+}
+
+// Runner runs a command. Tests replace it; nothing else does.
+type Runner func(Cmd) Result
+
+var (
+	run  Runner = execRun
+	euid        = os.Geteuid
+)
+
+// argv is the command as it is run: through sudo without a prompt when it needs root and this
+// process is not root.
+func argv(c Cmd) (string, []string) {
+	if c.Root && euid() != 0 {
+		return "sudo", append([]string{"-n", c.Name}, c.Args...)
+	}
+	return c.Name, c.Args
+}
+
+// bounded keeps the first MostOutput bytes written to it and notes that more came.
+type bounded struct {
+	b   bytes.Buffer
+	cut bool
+}
+
+func (w *bounded) Write(p []byte) (int, error) {
+	room := MostOutput - w.b.Len()
+	if room <= 0 {
+		w.cut = w.cut || len(p) > 0
+		return len(p), nil
+	}
+	if len(p) > room {
+		w.b.Write(p[:room])
+		w.cut = true
+		return len(p), nil
+	}
+	return w.b.Write(p)
+}
+
+func execRun(c Cmd) Result {
+	timeout := c.Timeout
+	if timeout <= 0 {
+		timeout = CallTimeout
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+	name, args := argv(c)
+	cmd := exec.CommandContext(ctx, name, args...)
+	cmd.Env = append(append(os.Environ(), "LC_ALL=C"), c.Env...)
+	if !c.Detached {
+		// Its own process group, so that ending it on a timeout ends what it started too.
+		cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
+		cmd.Cancel = func() error {
+			if cmd.Process != nil {
+				_ = syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL)
+			}
+			return nil
+		}
+	}
+	cmd.WaitDelay = 2 * time.Second
+	if c.Stdin != "" {
+		cmd.Stdin = strings.NewReader(c.Stdin)
+	}
+	var out, errs bounded
+	var outFile, errFile *os.File
+	if c.Detached {
+		var err error
+		if outFile, err = os.CreateTemp("", "mesh-tool-out-*"); err != nil {
+			return Result{Status: 127, Error: err.Error()}
+		}
+		defer os.Remove(outFile.Name())
+		defer outFile.Close()
+		if errFile, err = os.CreateTemp("", "mesh-tool-err-*"); err != nil {
+			return Result{Status: 127, Error: err.Error()}
+		}
+		defer os.Remove(errFile.Name())
+		defer errFile.Close()
+		cmd.Stdout, cmd.Stderr = outFile, errFile
+	} else {
+		cmd.Stdout, cmd.Stderr = &out, &errs
+	}
+	err := cmd.Run()
+	if c.Detached {
+		for _, f := range []struct {
+			file *os.File
+			into *bounded
+		}{{outFile, &out}, {errFile, &errs}} {
+			if _, e := f.file.Seek(0, io.SeekStart); e == nil {
+				_, _ = io.Copy(f.into, f.file)
+			}
+		}
+	}
+	r := Result{Stdout: out.b.String(), Stderr: errs.b.String(), Truncated: out.cut || errs.cut}
+	var exit *exec.ExitError
+	switch {
+	case err == nil:
+	case ctx.Err() == context.DeadlineExceeded:
+		r.Status, r.Error = 124, "timeout"
+	case errors.Is(err, exec.ErrNotFound) || errors.Is(err, os.ErrNotExist):
+		r.Status, r.Error = 127, "not-found"
+	case errors.As(err, &exit):
+		r.Status = exit.ExitCode()
+	default:
+		r.Status, r.Error = 127, err.Error()
+	}
+	return r
+}
+
+// call runs a command and answers its result, or an error naming what went wrong.
+func call(c Cmd) (Result, error) {
+	r := run(c)
+	if r.Status == 0 && r.Error == "" {
+		return r, nil
+	}
+	return r, failure(c, r)
+}
+
+// failure names how a command failed: not installed, refused escalation, too slow, or its exit
+// status with the end of what it said.
+func failure(c Cmd, r Result) error {
+	program, _ := argv(c)
+	switch {
+	case r.Error == "not-found" && program == "sudo":
+		return fmt.Errorf("%s needs root, and sudo is not installed here for the runtime's account to escalate with", c.Name)
+	case r.Error == "not-found":
+		if hint, ok := providedBy[c.Name]; ok {
+			return fmt.Errorf("%s is not installed on this machine (%s)", c.Name, hint)
+		}
+		return fmt.Errorf("%s is not installed on this machine", c.Name)
+	case r.Error == "timeout":
+		limit := c.Timeout
+		if limit <= 0 {
+			limit = CallTimeout
+		}
+		return fmt.Errorf("%s gave no answer within %s and was ended", c.Name, limit)
+	case r.Error != "":
+		return fmt.Errorf("%s did not run: %s", c.Name, r.Error)
+	case program == "sudo" && strings.Contains(r.Stderr, "command not found"):
+		if hint, ok := providedBy[c.Name]; ok {
+			return fmt.Errorf("%s is not installed on this machine (%s)", c.Name, hint)
+		}
+		return fmt.Errorf("%s is not installed on this machine", c.Name)
+	case program == "sudo" && strings.HasPrefix(strings.TrimSpace(r.Stderr), "sudo:"):
+		return fmt.Errorf("%s needs root, and sudo -n refused the runtime's account: %s (the escalation is the sudo module's to declare)",
+			c.Name, firstLine(r.Stderr))
+	}
+	said := tail(strings.TrimSpace(r.Stderr), 2000)
+	if said == "" {
+		said = tail(strings.TrimSpace(r.Stdout), 2000)
+	}
+	if said == "" {
+		said = "and said nothing"
+	}
+	return fmt.Errorf("%s %s exited %d: %s", c.Name, strings.Join(c.Args, " "), r.Status, said)
+}
+
+func firstLine(s string) string {
+	s = strings.TrimSpace(s)
+	if i := strings.IndexByte(s, '\n'); i >= 0 {
+		return s[:i]
+	}
+	return s
+}
+
+func tail(s string, n int) string {
+	if len(s) <= n {
+		return s
+	}
+	return "…" + s[len(s)-n:]
+}
+
+// lines are a command's output lines, blank ones dropped.
+func lines(s string) []string {
+	out := []string{}
+	for _, l := range strings.Split(s, "\n") {
+		if strings.TrimSpace(l) != "" {
+			out = append(out, strings.TrimRight(l, "\r"))
+		}
+	}
+	return out
+}
+
+// Arguments, read the way a tool's JSON arguments arrive.
+
+func text(args map[string]any, key string) (string, error) {
+	v, ok := args[key]
+	if !ok || v == nil {
+		return "", fmt.Errorf("%s is required", key)
+	}
+	s, ok := v.(string)
+	if !ok {
+		return "", fmt.Errorf("%s must be a string", key)
+	}
+	if strings.TrimSpace(s) == "" {
+		return "", fmt.Errorf("%s must not be empty", key)
+	}
+	return s, nil
+}
+
+func optText(args map[string]any, key, def string) (string, error) {
+	v, ok := args[key]
+	if !ok || v == nil {
+		return def, nil
+	}
+	s, ok := v.(string)
+	if !ok {
+		return "", fmt.Errorf("%s must be a string", key)
+	}
+	if strings.TrimSpace(s) == "" {
+		return def, nil
+	}
+	return s, nil
+}
+
+// optWhole reads a whole number, defaulted, refused below least and held to most.
+func optWhole(args map[string]any, key string, def, least, most int) (int, error) {
+	v, ok := args[key]
+	if !ok || v == nil {
+		return def, nil
+	}
+	f, ok := v.(float64)
+	if !ok {
+		if i, isInt := v.(int); isInt {
+			f = float64(i)
+		} else {
+			return 0, fmt.Errorf("%s must be a number", key)
+		}
+	}
+	if f != float64(int(f)) {
+		return 0, fmt.Errorf("%s must be a whole number", key)
+	}
+	n := int(f)
+	if n < least {
+		return 0, fmt.Errorf("%s must be at least %d", key, least)
+	}
+	if n > most {
+		n = most
+	}
+	return n, nil
+}
+
+func optFlag(args map[string]any, key string, def bool) (bool, error) {
+	v, ok := args[key]
+	if !ok || v == nil {
+		return def, nil
+	}
+	b, ok := v.(bool)
+	if !ok {
+		return false, fmt.Errorf("%s must be true or false", key)
+	}
+	return b, nil
+}
+
+func optList(args map[string]any, key string) ([]string, error) {
+	v, ok := args[key]
+	if !ok || v == nil {
+		return nil, nil
+	}
+	items, ok := v.([]any)
+	if !ok {
+		return nil, fmt.Errorf("%s must be a list of strings", key)
+	}
+	out := make([]string, 0, len(items))
+	for _, it := range items {
+		s, ok := it.(string)
+		if !ok || strings.TrimSpace(s) == "" {
+			return nil, fmt.Errorf("%s must be a list of non-empty strings", key)
+		}
+		out = append(out, s)
+	}
+	return out, nil
+}
+
+// oneOf refuses a value outside a closed set.
+func oneOf(key, value string, allowed ...string) error {
+	for _, a := range allowed {
+		if value == a {
+			return nil
+		}
+	}
+	return fmt.Errorf("%s must be one of %s, not %q", key, strings.Join(allowed, ", "), value)
+}
+
+// plainName refuses a name that could be read as an option or carries a path or a space: package,
+// snap, application and printer names never do.
+func plainName(key, value string) error {
+	if strings.HasPrefix(value, "-") || strings.ContainsAny(value, " \t\n/\\") {
+		return fmt.Errorf("%s %q is not a plain name", key, value)
+	}
+	return nil
+}

modules/fonts/cmd/fonts-tools/kit_test.go

@@ -0,0 +1,147 @@
+package main
+
+// Tests of kit.go, the same in each workstation module.
+
+import (
+	"strings"
+	"testing"
+	"time"
+)
+
+// fake records the commands asked and answers each from a function of the command line.
+type fake struct {
+	asked  []Cmd
+	answer func(line string, c Cmd) Result
+}
+
+func (f *fake) runner() Runner {
+	return func(c Cmd) Result {
+		f.asked = append(f.asked, c)
+		name, args := argv(c)
+		line := strings.TrimSpace(name + " " + strings.Join(args, " "))
+		if f.answer == nil {
+			return Result{}
+		}
+		return f.answer(line, c)
+	}
+}
+
+func (f *fake) lines() []string {
+	out := []string{}
+	for _, c := range f.asked {
+		name, args := argv(c)
+		out = append(out, strings.TrimSpace(name+" "+strings.Join(args, " ")))
+	}
+	return out
+}
+
+// using installs a fake runner and a non-root uid for one test.
+func using(t *testing.T, answer func(line string, c Cmd) Result) *fake {
+	t.Helper()
+	f := &fake{answer: answer}
+	wasRun, wasUID := run, euid
+	run, euid = f.runner(), func() int { return 1000 }
+	t.Cleanup(func() { run, euid = wasRun, wasUID })
+	return f
+}
+
+func ok(stdout string) Result { return Result{Stdout: stdout} }
+
+func TestKitAnActThatNeedsRootGoesThroughSudoWithoutAPromptUnlessAlreadyRoot(t *testing.T) {
+	was := euid
+	defer func() { euid = was }()
+	euid = func() int { return 1000 }
+	if name, args := argv(Cmd{Name: "x", Args: []string{"a"}, Root: true}); name != "sudo" || strings.Join(args, " ") != "-n x a" {
+		t.Fatalf("not root: %s %v", name, args)
+	}
+	if name, _ := argv(Cmd{Name: "x"}); name != "x" {
+		t.Fatalf("a read is run as the account: %s", name)
+	}
+	euid = func() int { return 0 }
+	if name, _ := argv(Cmd{Name: "x", Root: true}); name != "x" {
+		t.Fatalf("as root no sudo: %s", name)
+	}
+}
+
+func TestKitAFailureIsNamedByHowItFailed(t *testing.T) {
+	was := euid
+	defer func() { euid = was }()
+	euid = func() int { return 1000 }
+	cases := []struct {
+		c    Cmd
+		r    Result
+		want string
+	}{
+		{Cmd{Name: "nothere"}, Result{Status: 127, Error: "not-found"}, "not installed"},
+		{Cmd{Name: "x", Root: true}, Result{Status: 127, Error: "not-found"}, "sudo is not installed"},
+		{Cmd{Name: "x", Root: true}, Result{Status: 1, Stderr: "sudo: a password is required\n"}, "sudo -n refused"},
+		{Cmd{Name: "x", Root: true}, Result{Status: 1, Stderr: "sudo: x: command not found\n"}, "x is not installed"},
+		{Cmd{Name: "x"}, Result{Status: 124, Error: "timeout"}, "within 20s"},
+		{Cmd{Name: "x", Args: []string{"y"}}, Result{Status: 3, Stderr: "boom\n"}, "x y exited 3: boom"},
+		{Cmd{Name: "x"}, Result{Status: 3}, "said nothing"},
+	}
+	for _, k := range cases {
+		err := failure(k.c, k.r)
+		if err == nil || !strings.Contains(err.Error(), k.want) {
+			t.Errorf("%+v: %v, want %q", k.r, err, k.want)
+		}
+	}
+}
+
+func TestKitOutputIsBoundedAndSaysSo(t *testing.T) {
+	var w bounded
+	big := strings.Repeat("a", MostOutput+10)
+	n, _ := w.Write([]byte(big))
+	if n != len(big) || w.b.Len() != MostOutput || !w.cut {
+		t.Fatalf("kept %d of %d, cut %v", w.b.Len(), len(big), w.cut)
+	}
+}
+
+func TestKitTheRealRunnerRunsEndsAndReportsAMissingProgram(t *testing.T) {
+	r := execRun(Cmd{Name: "sh", Args: []string{"-c", "echo out; echo err >&2; exit 3"}})
+	if r.Status != 3 || strings.TrimSpace(r.Stdout) != "out" || strings.TrimSpace(r.Stderr) != "err" {
+		t.Fatalf("%+v", r)
+	}
+	r = execRun(Cmd{Name: "sh", Args: []string{"-c", "sleep 5 & sleep 5"}, Timeout: 200 * time.Millisecond})
+	if r.Error != "timeout" {
+		t.Fatalf("a slow command: %+v", r)
+	}
+	r = execRun(Cmd{Name: "no-such-program-anywhere"})
+	if r.Error != "not-found" {
+		t.Fatalf("a missing program: %+v", r)
+	}
+	r = execRun(Cmd{Name: "cat", Stdin: "given"})
+	if r.Stdout != "given" {
+		t.Fatalf("stdin: %+v", r)
+	}
+	start := time.Now()
+	r = execRun(Cmd{Name: "sh", Args: []string{"-c", "echo kept; (sleep 3 &) ; exit 0"}, Detached: true})
+	if r.Status != 0 || strings.TrimSpace(r.Stdout) != "kept" || time.Since(start) > 2*time.Second {
+		t.Fatalf("a detached command returns when it exits, not when its child does: %+v after %s", r, time.Since(start))
+	}
+}
+
+func TestKitArgumentsAreReadStrictly(t *testing.T) {
+	args := map[string]any{"s": "x", "n": float64(5), "f": 1.5, "b": true, "l": []any{"a", "b"}}
+	if _, err := text(args, "missing"); err == nil {
+		t.Error("a missing required string")
+	}
+	if n, _ := optWhole(args, "n", 1, 1, 3); n != 3 {
+		t.Errorf("held to most: %d", n)
+	}
+	if _, err := optWhole(args, "n", 1, 6, 9); err == nil {
+		t.Error("below least")
+	}
+	if _, err := optWhole(args, "f", 1, 0, 9); err == nil {
+		t.Error("a fraction")
+	}
+	if l, _ := optList(args, "l"); len(l) != 2 {
+		t.Errorf("list: %v", l)
+	}
+	if b, _ := optFlag(args, "b", false); !b {
+		t.Error("flag")
+	}
+	if err := plainName("name", "--all"); err == nil {
+		t.Error("an option as a name")
+	}
+}

modules/fonts/cmd/fonts-tools/main.go

@@ -0,0 +1,117 @@
+// The fonts module's tools (novox/hq research 026/04, 026/05): what faces the account has, what the
+// generic families resolve to, which face draws a character, which font files were copied by hand
+// and may go, and rebuilding the font cache. A Go bundle the node's runtime launches and speaks MCP
+// to over stdio (ADR 0188, ADR 0193); it runs as the operator account.
+package main
+
+import (
+	"fmt"
+	"os"
+
+	stdio "git.novox.be/novox/mesh-sdk/go"
+)
+
+// providedBy names what installs a program the tools run, for a failure that says so.
+var providedBy = map[string]string{
+	"fc-list":     "the fontconfig package",
+	"fc-match":    "the fontconfig package",
+	"fc-scan":     "the fontconfig package",
+	"fc-cache":    "the fontconfig package",
+	"fc-conflist": "the fontconfig package",
+	"pacman":      "this is not an Arch machine",
+}
+
+func main() {
+	if err := stdio.Serve("", tools()); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+}
+
+func tools() []stdio.Tool {
+	return []stdio.Tool{
+		{
+			Name: "fonts_families",
+			Description: "The font families installed for the operator account, each with its styles, how many files, " +
+				"whether it is monospaced, and where it comes from: package (under /usr/share/fonts), account (copied into " +
+				"the home by hand) or other. (r)",
+			Input: map[string]any{
+				"contains": map[string]any{"type": "string", "description": "only families whose name contains this, any case"},
+				"limit":    map[string]any{"type": "integer", "description": "at most this many families (default 500, at most 2000)"},
+			},
+			Run: func(args map[string]any) (any, error) {
+				contains, err := optText(args, "contains", "")
+				if err != nil {
+					return nil, err
+				}
+				limit, err := optWhole(args, "limit", 500, 1, 2000)
+				if err != nil {
+					return nil, err
+				}
+				return Families(contains, limit)
+			},
+		},
+		{
+			Name: "fonts_match",
+			Description: "What the generic families resolve to for this account: monospace, sans-serif, system-ui, serif and " +
+				"emoji by default, or the patterns given. Each answer names the face, its file, the face the fonts module " +
+				"decided on, and whether they agree. (r)",
+			Input: map[string]any{
+				"patterns": map[string]any{"type": "array", "items": map[string]any{"type": "string"},
+					"description": "fontconfig patterns to resolve instead, such as \"monospace:bold\" or \"Inter\""},
+			},
+			Run: func(args map[string]any) (any, error) {
+				patterns, err := optList(args, "patterns")
+				if err != nil {
+					return nil, err
+				}
+				return Match(patterns)
+			},
+		},
+		{
+			Name: "fonts_glyph",
+			Description: "Which installed fonts have a given character, and which face monospace and sans-serif would draw " +
+				"it with. The character is given as itself or as a code point (U+F120, 0xF120). (r)",
+			Input: map[string]any{
+				"character": map[string]any{"type": "string", "description": "one character, or its code point as U+XXXX or 0xXXXX"},
+			},
+			Run: func(args map[string]any) (any, error) {
+				ch, err := text(args, "character")
+				if err != nil {
+					return nil, err
+				}
+				return Glyph(ch)
+			},
+		},
+		{
+			Name: "fonts_sources",
+			Description: "Every font file copied into the account's font directories by hand, with its family, whether it " +
+				"duplicates another, and whether a package now provides that family; and the families installed by " +
+				"packages, with the package. Says which hand-copied files can be removed and why; removes nothing. (r)",
+			Input: map[string]any{},
+			Run:   func(map[string]any) (any, error) { return Sources() },
+		},
+		{
+			Name: "fonts_config",
+			Description: "The fontconfig file the fonts module owns: whether it is in place, whether fontconfig loads it, " +
+				"and the account's other fontconfig files beside it. (r)",
+			Input: map[string]any{},
+			Run:   func(map[string]any) (any, error) { return Config() },
+		},
+		{
+			Name: "fonts_cache_rebuild",
+			Description: "Rebuild the font cache: the account's (default), or the system's with system: true, which needs " +
+				"root and goes through sudo without a prompt. Answers how long it took. (a)",
+			Input: map[string]any{
+				"system": map[string]any{"type": "boolean", "description": "rebuild the system cache instead of the account's"},
+			},
+			Run: func(args map[string]any) (any, error) {
+				system, err := optFlag(args, "system", false)
+				if err != nil {
+					return nil, err
+				}
+				return CacheRebuild(system)
+			},
+		},
+	}
+}