From 15f0888b4f23b17bbb1bad973c0652b7d23f15f7 Mon Sep 17 00:00:00 2001
From: mesh-tools <mesh-tools@noreply.localhost>
Date: Tue, 20 Oct 2026 11:13:51 +0000
Subject: [PATCH] stage 4 of 8 for issue 1389

---
 cmd/mesh-controller/plan.go | 519 +-----------------------------------
 1 file changed, 1 insertion(+), 518 deletions(-)

diff --git a/cmd/mesh-controller/plan.go b/cmd/mesh-controller/plan.go
index 40e34796..3813d03b 100644
--- a/cmd/mesh-controller/plan.go
+++ b/cmd/mesh-controller/plan.go
@@ -15,11 +15,8 @@ import (
 	"sync"
 
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/overlay"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/chain"
 	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/licences"
 	"github.com/novox/mesh-controller/internal/link"
 )
 
@@ -55,339 +52,6 @@ func unresolvable(err error) bool {
 	return errors.As(err, &n)
 }
 
-// planFor works out everything a node should run, from what was assigned to it.
-//
-// A failure to compose the node's own modules is wrapped as notResolvable; every other failure is
-// returned as it is. Callers gathering across the mesh must tell them apart — see notResolvable.
-func planFor(ctx context.Context, open *stores, nodeName string) (catalogue.Resolution, catalogue.SettingsBy, error) {
-	inv := open.inventory
-	shelf, err := inv.Catalogue(ctx)
-	if err != nil {
-		return catalogue.Resolution{}, nil, err
-	}
-	assigned, err := inv.Assigned(ctx, nodeName)
-	if err != nil {
-		return catalogue.Resolution{}, nil, err
-	}
-	capabilities, err := inv.ProfileOf(ctx, nodeName)
-	if err != nil {
-		return catalogue.Resolution{}, nil, err
-	}
-
-	places, err := inv.Overlays(ctx)
-	if err != nil {
-		return catalogue.Resolution{}, nil, err
-	}
-	var site string
-	for _, p := range places {
-		if p.Name == nodeName {
-			site = p.Site
-		}
-	}
-
-	world, err := theRestOfTheMesh(ctx, inv, shelf, nodeName)
-	if err != nil {
-		return catalogue.Resolution{}, nil, err
-	}
-	world.Pinned, err = inv.PinsFor(ctx, nodeName)
-	if err != nil {
-		return catalogue.Resolution{}, nil, err
-	}
-	// Where each of its consumers of a provision that keeps data was last sent (novox/hq ADR 0232):
-	// a resolution that would answer one from anywhere else keeps it there, and says so.
-	world.Bound, err = inv.BindingsFor(ctx, nodeName)
-	if err != nil {
-		return catalogue.Resolution{}, nil, err
-	}
-
-	onNetwork, err := whereEveryoneIs(ctx, inv, shelf)
-	if err != nil {
-		return catalogue.Resolution{}, nil, err
-	}
-
-	// What this mesh can answer with a record rather than a machine, and which record each of
-	// this node's modules was put on. Read across a context boundary by name, which is what
-	// crossing one is allowed to carry (novox/hq ADR 0008).
-	world.Licences, world.Using, err = licencesFor(ctx, open, nodeName)
-	if err != nil {
-		return catalogue.Resolution{}, nil, err
-	}
-
-	// The domain this node composes its routed names under (novox/hq ADR 0066). A route
-	// contribution carries only a label; the resolver joins <label>.<public-domain> for this node,
-	// so the fact travels on the node it belongs to rather than being looked up where the name is
-	// composed.
-	publicDomain, err := inv.PublicDomainOf(ctx, nodeName)
-	if err != nil {
-		return catalogue.Resolution{}, nil, err
-	}
-
-	// The operator account this node logs a person in as, and where its home is (novox/hq to-be
-	// 29) — carried so a home-scoped file's owner and path resolve for this machine.
-	who, err := inv.NodeByName(ctx, nodeName)
-	if err != nil {
-		return catalogue.Resolution{}, nil, err
-	}
-
-	// A recorded module is composed at the build this machine runs, on any send but a person's push
-	// (novox/hq issue 295, ADR 0245).
-	if _, err := keepRecorded(ctx, open, nodeName, shelf); err != nil {
-		return catalogue.Resolution{}, nil, err
-	}
-
-	resolved, err := catalogue.Resolve(shelf, assigned,
-		catalogue.Node{Name: nodeName, Site: site, Capabilities: capabilities,
-			At: onNetwork[nodeName], PublicDomain: publicDomain,
-			Account: who.Account, AccountHome: who.AccountHome,
-			AgentAccount: who.AgentAccount, AgentAccountHome: who.AgentAccountHome}, world)
-	if err != nil {
-		// The node's own set does not compose. Marked, because this is the only failure here that
-		// a mesh-wide gatherer may pass over — see notResolvable.
-		return catalogue.Resolution{}, nil, notResolvable{err}
-	}
-	logUnheld(nodeName, resolved.Unheld)
-
-	// The credential for each thing this node takes from elsewhere. Made once and kept, so the
-	// password a provider is told to create is the one its consumer was given — and sealed to
-	// this node before it was ever written down, so nothing between here and there can read it.
-	for i, n := range resolved.Needs {
-		// **Issued for this holder alone and kept by the vault** (issue 757): where this consumer is handed to the
-		// provisioner, its machine's client asks the vault for it, and the declaration carries no value.
-		resolved.Needs[i].IssuedToHolder = issuedToHolder(shelf, n)
-		resolved.Needs[i].ProviderMoved = providerMoved(shelf, n)
-		if n.ByRecord {
-			// Answered by something the mesh holds, so there is no pair-wise secret between two
-			// machines. Its key was supplied by a person and sealed to this node then; the mesh
-			// discarded the plaintext and cannot make another.
-			sealed, err := keyFor(ctx, open, n.From, nodeName, n.For)
-			if err != nil {
-				return catalogue.Resolution{}, nil, err
-			}
-			resolved.Needs[i].Sealed = sealed
-			// If this holder is the licence's manager, hand it the manager node's PUBLIC sealing key
-			// in its bound facts (novox/hq ADR 0050). It is safe to disclose — a public key — and it
-			// is what the manager module needs to re-seal a rotated refresh token to this same node,
-			// having been given no private key of its own. A consumer holder gets none.
-			pub, err := managerPublicKeyFor(ctx, open, inv, n.From, nodeName, n.For)
-			if err != nil {
-				return catalogue.Resolution{}, nil, err
-			}
-			if pub != "" {
-				serves := map[string]any{}
-				for k, v := range resolved.Needs[i].Serves {
-					serves[k] = v
-				}
-				serves["manager_public_key"] = pub
-				resolved.Needs[i].Serves = serves
-				// The manager holder: its empty pre-adoption refresh token is a waiting state, not a
-				// missing consumer key, so the declaration tolerates it rather than refusing.
-				resolved.Needs[i].Manager = true
-			}
-			continue
-		}
-		var secret inventory.Secret
-		var err error
-		if outsideModule, outside := issuedOutsideBy(shelf, n); outside {
-			// Only a person can give it (novox/hq ADR 0337, issue 164): read as given, never made.
-			secret, err = inv.GivenPairSecret(ctx, n.Name, nodeName, n.For, n.From, outsideModule, n.Local)
-		} else if n.SharedOwn != "" {
-			// The provider's one credential, sealed to this consumer too (novox/hq ADR 0158).
-			secret, err = inv.SharedSecretFor(ctx, n.Name, nodeName, n.For, n.From, providerModuleOf(resolved, open, ctx, n), n.Local, n.SharedOwn)
-		} else {
-			secret, err = inv.SecretFor(ctx, n.Name, nodeName, n.For, n.From, n.Local)
-		}
-		if inventory.IsNotGiven(err) {
-			// **Not given, and the rest of the consumer runs** (ADR 0337 §4): no credential file, so the module can
-			// tell it was not given and says it waits for it; the machine is not refused for what only a person can
-			// give, and nothing the mesh made stands in for it.
-			continue
-		}
-		if err != nil {
-			// Said rather than skipped. A machine that resolves cleanly and receives no
-			// credential is one that will fail to authenticate at some later, less obvious
-			// moment.
-			return catalogue.Resolution{}, nil, fmt.Errorf(
-				"%s on %s needs %s from %s and no credential could be made for it: %w",
-				n.For, nodeName, n.Name, n.From, err)
-		}
-		resolved.Needs[i].Sealed = secret.ForConsumer
-	}
-
-	// Settings for everything that resolved, including modules nobody assigned directly: a
-	// requirement pulled in by something else is still configurable, and finding out that it is
-	// not only when you try would be an arbitrary line nobody could predict.
-	//
-	// A setting that reaches nothing, or cannot compose with the definition it was stored for,
-	// no longer refuses the machine here: it is judged where it is stored, and a definition that
-	// moved under it costs that module its place in the declaration, said by name (novox/hq ADR
-	// 0163, rule 6 — see Compose).
-	settings := catalogue.SettingsBy{}
-	for _, m := range resolved.Modules {
-		layers, err := inv.SettingsFor(ctx, nodeName, m.Module)
-		if err != nil {
-			return catalogue.Resolution{}, nil, err
-		}
-		if len(layers) == 0 {
-			continue
-		}
-		settings[m.Module] = layers
-	}
-	return resolved, settings, nil
-}
-
-// theRestOfTheMesh is what every other node holds and offers.
-//
-// Two things at once because they come from the same place — resolving the other nodes — and
-// because both are facts about what is actually running rather than records that could disagree
-// with it. A claim is held by whatever a node runs; a provision is offered by whatever a node
-// runs; neither is a table somebody keeps up to date.
-//
-// **Two passes over the others.** What a node offers the mesh needs that node resolved, and
-// resolving it may need what the mesh offers. So the first pass takes brokered requirements on
-// trust and answers only *what does each node offer*; the second answers everything with that in
-// hand. Nothing is ever declared from the first.
-func theRestOfTheMesh(ctx context.Context, inv *inventory.Inventory,
-	shelf map[string]catalogue.Manifest, exclude string) (catalogue.World, error) {
-
-	// Every node, not only the placed ones. A machine that was never put on the private network
-	// still runs modules, still holds claims, and still offers whatever it offers.
-	// **Who holds each seat on record, before anything is resolved** (novox/hq ADR 0131). Both
-	// passes below need it: without it, the assignment standing beside a seat's holder — the next
-	// holder, waiting for the handover — is refused as a second holder, and its node's whole set
-	// with it.
-	holdings, err := inv.Holdings(ctx)
-	if err != nil {
-		return catalogue.World{}, err
-	}
-
-	nodes, err := inv.Nodes(ctx)
-	if err != nil {
-		return catalogue.World{}, err
-	}
-	places, err := inv.Overlays(ctx)
-	if err != nil {
-		return catalogue.World{}, err
-	}
-	siteOf := map[string]string{}
-	for _, p := range places {
-		siteOf[p.Name] = p.Site
-	}
-	// Which machines are actually on the private network, and what they are called there. Not
-	// "has an address" — that was true of every placed machine and told you nothing about whether
-	// anything could reach it. It is what resolved the module.
-	onNetwork, err := whereEveryoneIs(ctx, inv, shelf)
-	if err != nil {
-		return catalogue.World{}, err
-	}
-
-	type candidate struct {
-		node     catalogue.Node
-		assigned []string
-	}
-	var others []candidate
-	// **Every machine's assignments, before the holdings are read by any resolution** (novox/hq ADR 0449 §4): a
-	// seat held once whose holder on record is assigned on no machine needs the whole mesh to be known, and it
-	// passes to its only claimant here, in the composition that finds it.
-	everyAssigned := map[string][]string{}
-	var assignedErr error
-	for _, n := range nodes {
-		theirs, err := inv.Assigned(ctx, n.Name)
-		if err != nil {
-			assignedErr = errors.Join(assignedErr, fmt.Errorf("%s: %w", n.Name, err))
-			continue
-		}
-		if len(theirs) > 0 {
-			everyAssigned[n.Name] = theirs
-		}
-	}
-	holdings = theMeshPassesSeatsOn(ctx, inv, shelf, everyAssigned, assignedErr, holdings)
-	for _, n := range nodes {
-		if n.Name == exclude {
-			continue
-		}
-		theirs := everyAssigned[n.Name]
-		if len(theirs) == 0 {
-			continue
-		}
-		caps, _ := inv.ProfileOf(ctx, n.Name)
-		// Its public domain too (novox/hq ADR 0346): a provider elsewhere serves its own composed names,
-		// and composes them as its own plan does, under its own domain.
-		// Read as its profile is: a machine whose domain cannot be read (removed since the list was read)
-		// composes no public name, which leaves the key out and says so, and fails no other machine's plan.
-		domain, _ := inv.PublicDomainOf(ctx, n.Name)
-		others = append(others, candidate{
-			catalogue.Node{Name: n.Name, Site: siteOf[n.Name], Capabilities: caps,
-				At: onNetwork[n.Name], PublicDomain: domain}, theirs})
-	}
-
-	offered := map[string][]catalogue.Provider{}
-	var firstHeld []catalogue.Held
-	for _, o := range others {
-		got, err := catalogue.Resolve(shelf, o.assigned, o.node, catalogue.World{Unchecked: true, Holdings: holdings})
-		if err != nil {
-			// Said, not skipped: a machine dropped here offers nothing and holds nothing as far
-			// as every other machine's plan can tell (novox/hq issue 188).
-			sayLeftOut(ctx, o.node.Name, err)
-			continue
-		}
-		firstHeld = append(firstHeld, got.Claims...)
-		for _, m := range got.Modules {
-			for _, name := range m.OffersAt(catalogue.ScopeMesh) {
-				// What that module says a consumer needs to know, with that node's settings on
-				// it: a port somebody moved on the provider is a port its consumers must be told
-				// about, and the two coming from different places is how they come to disagree.
-				serves, layers, err := servedOnNode(ctx, inv, o.node.Name, m, name)
-				if err != nil {
-					return catalogue.World{}, err
-				}
-				// And its own composed names, as that node composes them (novox/hq ADR 0346): a name it
-				// does not compose leaves the key out, said under each consumer's need.
-				serves, leftOut, err := got.ServedOwnNames(m, name, serves, catalogue.WithDefaults(m, layers))
-				if err != nil {
-					return catalogue.World{}, err
-				}
-				offered[name] = append(offered[name], catalogue.Provider{
-					Node: o.node.Name, At: o.node.At, Serves: serves, Module: m.Module, LeftOut: leftOut})
-			}
-		}
-	}
-	for k := range offered {
-		sort.Slice(offered[k], func(i, j int) bool {
-			return offered[k][i].Node < offered[k][j].Node
-		})
-	}
-
-	// **The second pass is given the first pass's holdings.** A seat's holder answers a requirement
-	// with several providers (novox/hq ADR 0110), so a node consuming one resolves only once the
-	// holder is known. Without them its set is refused here, and a refused node's own claims drop
-	// out of what the mesh holds — so a second holder of one of its seats would pass unrefused.
-	world := catalogue.World{Offered: offered, Held: firstHeld, Holdings: holdings}
-	var held []catalogue.Held
-	for _, o := range others {
-		// Each machine is resolved with its own pins, as its plan is: a machine that needs one to
-		// settle two providers would otherwise be refused here and vanish from the mesh — every
-		// seat it holds unheld, every build that needs one refused (2026-10-01, the control node;
-		// novox/hq issue 188).
-		theirs := world
-		if pins, err := inv.PinsFor(ctx, o.node.Name); err == nil {
-			theirs.Pinned = pins
-		}
-		got, err := catalogue.Resolve(shelf, o.assigned, o.node, theirs)
-		if err != nil {
-			// Said only for the whole-mesh view. With one machine excluded, the others are
-			// resolved without its offers, and one that consumes them cannot resolve here by
-			// design — that is not the machine being dropped, it is the view being partial.
-			if exclude == "" {
-				sayLeftOut(ctx, o.node.Name, err)
-			}
-			continue
-		}
-		held = append(held, got.Claims...)
-	}
-	world.Held = held
-	return world, nil
-}
-
 // leftOutKey carries where theRestOfTheMesh says a machine it leaves out, for an act that answers with
 // its own resolution instead (novox/hq issue 237).
 type leftOutKey struct{}
@@ -406,17 +70,6 @@ func leftOutSaidBy(ctx context.Context, w io.Writer) context.Context {
 	return context.WithValue(ctx, leftOutKey{}, w)
 }
 
-// sayLeftOut says that a machine is left out of the rest of the mesh, where ctx says to: standard
-// error unless an act said otherwise. Said, not skipped: a machine dropped there offers nothing and
-// holds nothing as far as every other machine's plan can tell (novox/hq issue 188).
-func sayLeftOut(ctx context.Context, node string, err error) {
-	w, ok := ctx.Value(leftOutKey{}).(io.Writer)
-	if !ok {
-		w = os.Stderr
-	}
-	fmt.Fprintf(w, "%s is left out of the rest of the mesh: it does not resolve: %v\n", node, err)
-}
-
 // declarationFor is everything a node would be sent.
 //
 // One place, because there were three and one of them was written before credentials existed and
@@ -431,161 +84,10 @@ func declarationFor(ctx context.Context, open *stores, node string,
 	//
 	// The line is not "a question may not write". It is who is asking and how often: this is a
 	// person, about one machine, on purpose. What may not write is the comparison the mesh runs
-	// over every machine to answer whether each is up to date — see Choosing.
+	// over every machine to answer whether each is up to date, which is a question and makes nothing (composeQuestion).
 	return composeSend(ctx, open, node)
 }
 
-// declarationWith is the same, for a caller that has already worked out the generators once and
-// is about to use them for every node.
-// Choosing says whether this composition may allocate what has not been allocated yet.
-//
-// **The comparison the mesh runs over every machine must not change what it is comparing.**
-// Composing a declaration assigns each module a machine port and seals its secrets, and `status`
-// composes one for every node to answer *is this machine running what I would send it* — so that
-// question allocated, minted, wrote, and contended with the very machine it was asking about. A
-// status polled every two seconds while a node applies is then two writers on the same rows,
-// which is how it came to hang rather than answer.
-//
-// `plan` sits on the other side of this and allocates, because it is a person asking what a push
-// would do to one named machine. The distinction is not question versus command; it is a person
-// asking once about one machine versus the mesh asking continuously about all of them.
-//
-// So the mesh chooses a port when it commits to sending one, and every other caller reads what
-// was chosen. A module with nothing assigned yet has never been sent, which is exactly what a
-// machine "waiting" means — the read needs no number to be right about that.
-type Choosing int
-
-const (
-	// Reading is every question: what is assigned is used, and nothing is created.
-	Reading Choosing = iota
-	// Allocating is the send path: what is not assigned yet is assigned now and kept.
-	Allocating
-	// Foreseeing is Reading, asked ahead of a send (the self-check's D1, novox/hq issue 275): nothing
-	// is created, and an own secret the next send WOULD make is composed with a stand-in and named
-	// (sendable.foreseen) rather than failing the composition — while one the send would be refused
-	// (a bus credential nobody issued, a given secret under an old key) is refused here as it would
-	// be there. Never sent: the stand-in is not a sealed value.
-	Foreseeing
-)
-
-func declarationWith(ctx context.Context, open *stores, node string,
-	plan catalogue.Resolution, settings catalogue.SettingsBy,
-	gens map[string]catalogue.Generator, choosing Choosing) (sendable, error) {
-	with, record, err := renderingFor(ctx, open, node, plan, settings, gens, choosing)
-	if err != nil {
-		return sendable{}, err
-	}
-	composed, err := plan.Compose(with)
-	if err != nil {
-		return sendable{}, err
-	}
-	// Which ports the filter admits from the local network, and from which networks, for plan to say
-	// (novox/hq ADR 0340 §8). The same rules the composition rendered, never sent.
-	rules, err := plan.Rules(with)
-	if err != nil {
-		return sendable{}, err
-	}
-	// And what was taken on it, said in every declaration it is sent from this one place.
-	adoption, err := adoptionOf(ctx, open.inventory, record, plan, composed)
-	if err != nil {
-		return sendable{}, err
-	}
-	out := sendable{Resources: composed.Resources, Adoption: adoption,
-		Received: composed.Received, Mesh: with.Mesh, BusUsers: with.BusUsers,
-		LeftOut: sortedKeysOf(composed.LeftOut), leftOutWhy: composed.LeftOut, withheld: with.Withheld,
-		unbound: with.Unbound, foreseen: composed.Foreseen, unplaced: composed.Unplaced, handedOnly: composed.HandedOnly,
-		modules: namedModules(plan, composed.LeftOut),
-		Filled:  composed.Filled, plans: composed.Plans,
-		localNetwork: catalogue.LocalNetworkPorts(rules, with.LocalNetworks)}
-	if len(composed.Filled) > 0 {
-		out.Provisioner = with.Provisioner
-	}
-	// A handed module only pulled in by another keeps what requires it, for its value of its own in the assignments
-	// mirror (issue 765).
-	for module := range composed.Plans {
-		if by := plan.RequiredBy(module); by != "" {
-			if out.requiredBy == nil {
-				out.requiredBy = map[string]string{}
-			}
-			out.requiredBy[module] = by
-		}
-	}
-	// And which build of each module it carries, for the send to record (novox/hq issue 259, ADR
-	// 0221). Read only on the send path: a question about what would be sent records nothing.
-	if choosing == Allocating {
-		carried, err := carriedOn(ctx, open, node, plan, composed.LeftOut, true)
-		if err != nil {
-			return sendable{}, err
-		}
-		out.Builds = carried
-		out.Bindings = boundToData(plan, composed.LeftOut)
-	}
-	// And the module of each resource and the build of each module, to a machine whose node-engine said it reads them
-	// (novox/hq issue 1145) and to no other; the same whatever the composition is for, so what a question about the
-	// send digests is what the send digests.
-	reads, err := open.inventory.ReadsModules(ctx, record.ID)
-	if err != nil {
-		return sendable{}, err
-	}
-	if reads {
-		carried := out.Builds
-		if choosing != Allocating {
-			if carried, err = carriedOn(ctx, open, node, plan, composed.LeftOut, false); err != nil {
-				return sendable{}, err
-			}
-		}
-		runs, err := open.inventory.AssignmentRuns(ctx, node)
-		if err != nil {
-			return sendable{}, err
-		}
-		builds, err := wireBuilds(carried, runs, func(module, commit string) (string, error) {
-			return open.inventory.BuildOf(ctx, module, commit)
-		})
-		if err != nil {
-			return sendable{}, err
-		}
-		out.ReadsModules, out.moduleOf, out.buildIDs = true, composed.Owner, builds
-	}
-	return out, nil
-}
-
-// carriedOn is the build of each module a declaration for node carries (see carriedBuilds), the module kept at the
-// build a machine runs included (ADR 0245). Only a send (strict) fails for a kept module that cannot be read: a question
-// about it is answered without.
-func carriedOn(ctx context.Context, open *stores, node string, plan catalogue.Resolution, leftOut map[string]string,
-	strict bool) (map[string]string, error) {
-	current, err := open.inventory.CurrentBuilds(ctx)
-	if err != nil {
-		return nil, err
-	}
-	before, known, err := open.inventory.SentBuilds(ctx, node)
-	if err != nil {
-		return nil, err
-	}
-	if !known {
-		before = nil
-	}
-	names := make([]string, 0, len(plan.Modules))
-	for _, m := range plan.Modules {
-		names = append(names, m.Module)
-	}
-	out := carriedBuilds(names, leftOut, current, before)
-	// A recorded module kept at the build the machine runs is recorded as carrying that one (ADR 0245).
-	kept, err := recordedKept(ctx, open, node)
-	if err != nil {
-		if strict {
-			return nil, err
-		}
-		kept = nil
-	}
-	for m, was := range kept {
-		if _, carried := out[m]; carried {
-			out[m] = was
-		}
-	}
-	return out, nil
-}
-
 // boundToData is every binding of this machine's consumers to a provision that keeps their data
 // (novox/hq ADR 0232), as a send records it. Not a consumer left out of the declaration: the machine
 // is not told anything new about it, so nothing about where it is bound has been sent.
@@ -610,25 +112,6 @@ func boundToData(plan catalogue.Resolution, leftOut map[string]string) []invento
 	return out
 }
 
-// carriedBuilds is the build of each module a declaration carries, as a send records it (novox/hq
-// issue 259): the module's current build for each module in it, and for a module left out of it
-// (ADR 0163, rule 6) the build it was last sent, since the machine keeps that one — or nothing, when
-// that is not known. Never nil, so a send through here always records what it knows.
-func carriedBuilds(modules []string, leftOut map[string]string, current map[string]inventory.CurrentBuild,
-	before map[string]string) map[string]string {
-	out := map[string]string{}
-	for _, m := range modules {
-		if _, left := leftOut[m]; left {
-			if was, kept := before[m]; kept {
-				out[m] = was
-			}
-			continue
-		}
-		out[m] = current[m].Commit
-	}
-	return out
-}
-
 // sortedKeysOf is a map's keys, sorted — so what a declaration says it left out does not move
 // for a reordering nobody made.
 func sortedKeysOf(m map[string]string) []string {