Make pending assignments safe to race, settle them on a tick, and say only what was checked

Review of #150: a withdrawal could land between the look and the act, a failed ask read as a build in flight, a request kept the wrong asker, a build being registered read as not built, build "true" could ask a build nothing waited on, and a status read changed state. Claim a row under the machine's hold before making it, keep a request only once asked, settle on the controller's own tick, raise an assignment not made as a condition until it is answered, and tie each row to its machine.
2026-10-08 16:38:11 +02:00
parent 7d63d2e68c
commit 249d97d1c8
12 changed files with 1018 additions and 235 deletions
@@ -1,6 +1,7 @@
 package main

 import (
+	"context"
 	"encoding/json"
 	"errors"
 	"slices"
@@ -9,6 +10,7 @@ import (
 	"time"

 	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
@@ -68,21 +70,27 @@ func pendingOf(t *testing.T, open *stores) []inventory.PendingAssignment {
 	return got
 }

-// A build in flight: the merge asked for it, the assignment is kept pending and said so with the build, and
-// the build's outcome makes it. Status says it while it waits.
+// A build in flight: the merge asked for it, the request is kept as the merge's, the assignment is kept
+// pending and said so with the build, status reads it without settling anything, and the build's outcome
+// makes it — saying that a push sends it, and nothing more.
 func TestAnAssignmentWaitsForTheBuildInFlight(t *testing.T) {
 	open := aCatalogueMesh(t)
 	ctx := t.Context()
 	asksWithPaths(t)
 	mergeAdding(t, open, "modules/sensors", "3da80a4b00aa")

+	requests, err := open.inventory.RequestsNamed(ctx, "sensors")
+	if err != nil || len(requests) != 1 || requests[0].For != "merge" || requests[0].Commit != "3da80a4b00aa" {
+		t.Fatalf("the merge's build request: %+v %v", requests, err)
+	}
+
 	said, err := assign(ctx, open, "laptop", "sensors")
 	if err != nil {
 		t.Fatalf("an assignment while its build runs was refused: %v", err)
 	}
 	t.Logf("assign laptop sensors, while its build runs:\n%s", said)
 	for _, want := range []string{"being built from novox/mesh-catalog@3da80a4b (modules/sensors)",
-		"build b-modules/sensors", "kept as pending", "`unassign laptop sensors`"} {
+		"build b-modules/sensors", "kept as pending", "the controller assigns sensors to laptop", "`unassign laptop sensors`"} {
 		if !strings.Contains(said, want) {
 			t.Fatalf("the answer does not say %q:\n%s", want, said)
 		}
@@ -94,7 +102,6 @@ func TestAnAssignmentWaitsForTheBuildInFlight(t *testing.T) {
 	if len(pending) != 1 || pending[0].State != inventory.PendingWaiting || pending[0].Build != "b-modules/sensors" {
 		t.Fatalf("pending: %+v", pending)
 	}
-	// Asked twice, it is one pending assignment.
 	if again, err := assign(ctx, open, "laptop", "sensors"); err != nil || !strings.Contains(again, "already waits") {
 		t.Fatalf("a second assignment: %q %v", again, err)
 	}
@@ -127,12 +134,41 @@ func TestAnAssignmentWaitsForTheBuildInFlight(t *testing.T) {
 	}
 	pending = pendingOf(t, open)
 	if len(pending) != 1 || pending[0].State != inventory.PendingApplied ||
-		!strings.Contains(pending[0].Note, "`push laptop` sends it if not") {
+		!strings.HasSuffix(pending[0].Note, "`push laptop` sends it") {
 		t.Fatalf("pending after the build: %+v", pending)
 	}
 }

-// The build of a pending assignment fails: it expires, saying the build's words, and nothing is assigned.
+// **A read settles nothing** (review of #150, point 6): status — and so the board, the summary and the
+// probe, which compose from the same reading — leaves a pending assignment whose module is registered as it
+// is; the controller's tick makes it.
+func TestAStatusReadSettlesNothing(t *testing.T) {
+	open := aCatalogueMesh(t)
+	ctx := t.Context()
+	asksWithPaths(t)
+	mergeAdding(t, open, "modules/sensors", "3da80a4b00aa")
+	if _, err := assign(ctx, open, "laptop", "sensors"); err != nil {
+		t.Fatal(err)
+	}
+	register(t, open, catalogue.Manifest{Module: "sensors", Version: "1"})
+	for range 2 {
+		if _, err := theThreeQuestions(ctx, open); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if slices.Contains(assignedTo(t, open, "laptop"), "sensors") || pendingOf(t, open)[0].State != inventory.PendingWaiting {
+		t.Fatalf("a status read settled a pending assignment: %+v", pendingOf(t, open))
+	}
+	said := settlePending(ctx, open, time.Now())
+	if !slices.Contains(assignedTo(t, open, "laptop"), "sensors") || pendingOf(t, open)[0].State != inventory.PendingApplied {
+		t.Fatalf("the tick did not make it: %v %+v", said, pendingOf(t, open))
+	}
+}
+
+// The build of a pending assignment fails: it expires with the build's words and nothing is assigned; the
+// tick raises it as a condition once; it then reads as known and not built; and `unassign` takes it back,
+// after which the tick clears the condition. Status is not called well while the condition is open, and is
+// again once it clears — no fixed day of "not well" (review point 6).
 func TestAPendingAssignmentExpiresWhenItsBuildFails(t *testing.T) {
 	open := aCatalogueMesh(t)
 	ctx := t.Context()
@@ -158,15 +194,17 @@ func TestAPendingAssignmentExpiresWhenItsBuildFails(t *testing.T) {
 	if slices.Contains(assignedTo(t, open, "laptop"), "sensors") {
 		t.Fatal("a failed build's module was assigned")
 	}
-	asked, err := theThreeQuestions(ctx, open)
-	if err != nil {
-		t.Fatal(err)
+
+	settlePending(ctx, open, time.Now())
+	key := pendingObservation(pending[0]).Key()
+	c, found, err := conditionsFrom.Get(ctx, key)
+	if err != nil || !found || c.Kind != kindPendingEnded {
+		t.Fatalf("no condition %s for the assignment not made: %+v %v %v", key, c, found, err)
 	}
-	if asked.well() {
-		t.Fatal("status called the mesh well on the day a pending assignment expired")
+	if asked, err := theThreeQuestions(ctx, open); err != nil || asked.well() || len(asked.conditions) == 0 {
+		t.Fatalf("status does not hold the open condition: %v", err)
 	}

-	// Known and not built now: said, and refused without build.
 	_, err = assign(ctx, open, "laptop", "sensors")
 	if !errors.Is(err, inventory.ErrNoSuchModule) {
 		t.Fatalf("a module whose build failed: %v", err)
@@ -177,10 +215,54 @@ func TestAPendingAssignmentExpiresWhenItsBuildFails(t *testing.T) {
 			t.Fatalf("the refusal does not say %q:\n%v", want, err)
 		}
 	}
+
+	said, err := unassign(ctx, open, "laptop", "sensors")
+	if err != nil || !strings.Contains(said, "taken back") {
+		t.Fatalf("unassign of an expired pending assignment: %q %v", said, err)
+	}
+	settlePending(ctx, open, time.Now())
+	if _, found, _ := conditionsFrom.Get(ctx, key); found {
+		t.Fatal("the condition stayed open after the assignment was taken back")
+	}
+	// Nothing of it keeps status from being well any more: no open pending assignment, no open condition of it.
+	asked, err := theThreeQuestions(ctx, open)
+	if err != nil || pendingOpen(asked.pending) {
+		t.Fatalf("status still counts the pending assignment: %+v %v", asked.pending, err)
+	}
+	for _, c := range asked.conditions {
+		if c.Kind == kindPendingEnded {
+			t.Fatalf("status still holds the condition: %+v", c)
+		}
+	}
 }

-// Known and not built, asked with build: the build is asked from where the last one was, and the assignment
-// kept pending on the new build.
+// The condition also clears when the module is later assigned to the machine.
+func TestTheConditionClearsWhenTheModuleIsAssignedLater(t *testing.T) {
+	open := aCatalogueMesh(t)
+	ctx := t.Context()
+	asksWithPaths(t)
+	mergeAdding(t, open, "modules/sensors", "3da80a4b00aa")
+	if _, err := assign(ctx, open, "laptop", "sensors"); err != nil {
+		t.Fatal(err)
+	}
+	if err := (builds{open.inventory, open}).Built(ctx, outcome("b-modules/sensors", "modules/sensors",
+		"3da80a4b00aa", "", "boom")); err != nil {
+		t.Fatal(err)
+	}
+	settlePending(ctx, open, time.Now())
+	key := pendingObservation(pendingOf(t, open)[0]).Key()
+	register(t, open, catalogue.Manifest{Module: "sensors", Version: "1"})
+	if _, err := assign(ctx, open, "laptop", "sensors"); err != nil {
+		t.Fatal(err)
+	}
+	settlePending(ctx, open, time.Now())
+	if _, found, _ := conditionsFrom.Get(ctx, key); found {
+		t.Fatal("the condition stayed open after the module was assigned")
+	}
+}
+
+// Known and not built, asked with build: the build is asked from where the last one was, the request kept as
+// assign's, and the assignment kept pending on the new build.
 func TestAssignWithBuildAsksForAKnownModule(t *testing.T) {
 	open := aCatalogueMesh(t)
 	ctx := t.Context()
@@ -211,10 +293,146 @@ func TestAssignWithBuildAsksForAKnownModule(t *testing.T) {
 	if len(pending) != 1 || pending[0].Build != "b-modules/sensors" {
 		t.Fatalf("pending: %+v", pending)
 	}
+	requests, _ := inv.RequestsNamed(ctx, "sensors")
+	if len(requests) != 2 || requests[0].ID != "b-modules/sensors" || requests[0].For != "assign" {
+		t.Fatalf("the request is not kept as assign's: %+v", requests)
+	}
 }

-// Unknown: refused as before, as no module of that name, with the closest names the mesh holds; build asks
-// for nothing, since the mesh does not know where it is.
+// **build "true" with a pending assignment already waiting** (review point 5): the waiting one is made to
+// wait for the new build, and no build is asked that nothing waits on.
+func TestAssignWithBuildRepointsTheWaitingAssignment(t *testing.T) {
+	open := aCatalogueMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	if err := inv.RecordBuildRequest(ctx, inventory.BuildRequest{ID: "build-old", Repository: "novox/mesh-catalog",
+		Seat: "git", Path: "modules/sensors", Ref: "main", For: "merge", At: time.Now().Add(-time.Hour)}); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.RecordBuild(ctx, inventory.Build{ID: "build-old", Repository: "novox/mesh-catalog", Ref: "main",
+		Path: "modules/sensors", On: "anchor", Failed: "boom"}); err != nil {
+		t.Fatal(err)
+	}
+	// Waiting on the failed build, its expiry not yet settled.
+	if _, err := inv.RecordPending(ctx, inventory.PendingAssignment{Node: "laptop", Module: "sensors",
+		Build: "build-old", Repository: "novox/mesh-catalog", Path: "modules/sensors"}); err != nil {
+		t.Fatal(err)
+	}
+	_, err := assign(ctx, open, "laptop", "sensors")
+	if err == nil || !strings.Contains(err.Error(), "already has a pending assignment of sensors, waiting for build build-old") {
+		t.Fatalf("known and not built with a pending assignment waiting: %v", err)
+	}
+	asked := asksWithPaths(t)
+	said, err := assignWith(ctx, open, "laptop", assignOptions{Build: true}, "sensors")
+	if err != nil || !strings.Contains(said, "which waited for build build-old, now waits for build b-modules/sensors") {
+		t.Fatalf("assign with build: %q %v", said, err)
+	}
+	if len(*asked) != 1 {
+		t.Fatalf("asked %v", *asked)
+	}
+	pending := pendingOf(t, open)
+	if len(pending) != 1 || pending[0].Build != "b-modules/sensors" || pending[0].State != inventory.PendingWaiting {
+		t.Fatalf("pending: %+v", pending)
+	}
+	// The new build in flight now: build "true" again asks nothing.
+	if said, err := assignWith(ctx, open, "laptop", assignOptions{Build: true}, "sensors"); err != nil ||
+		!strings.Contains(said, "no second build was asked") || len(*asked) != 1 {
+		t.Fatalf("a second build true while the build runs: %q %v, asked %v", said, err, *asked)
+	}
+}
+
+// **A failed ask never reads as in flight** (review point 2): a merge whose ask could not be made keeps the
+// request as not asked, and assign says the merge could not ask; a request whose asker could not hand it over
+// or stopped waiting reads the same, unless its outcome was heard.
+func TestAFailedAskIsNotABuildInFlight(t *testing.T) {
+	open := aCatalogueMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	was := askABuild
+	askABuild = func(context.Context, buildSource, string, string) (string, error) {
+		return "", errors.New("cannot submit a build: nats: timeout")
+	}
+	t.Cleanup(func() { askABuild = was })
+	mergeAdding(t, open, "modules/sensors", "3da80a4b00aa")
+	_, err := assign(ctx, open, "laptop", "sensors")
+	if err == nil || !strings.Contains(err.Error(), "the merge that added it (3da80a4b) could not ask for its build: cannot submit") {
+		t.Fatalf("a merge that could not ask: %v", err)
+	}
+	if len(pendingOf(t, open)) != 0 {
+		t.Fatal("a pending assignment waits on a build never asked")
+	}
+
+	if err := inv.RecordBuildRequest(ctx, inventory.BuildRequest{ID: "build-waited", Repository: "novox/mesh-catalog",
+		Seat: "git", Path: "modules/gauges", Ref: "main", For: "build"}); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.MarkNotAsked(ctx, "build-waited", "cannot submit a build: no responders"); err != nil {
+		t.Fatal(err)
+	}
+	_, err = assign(ctx, open, "laptop", "gauges")
+	if err == nil || !strings.Contains(err.Error(), "build build-waited, asked by build, was not handed over or not waited for") {
+		t.Fatalf("a build not handed over: %v", err)
+	}
+	// Heard first, the outcome stands: marking it afterwards changes nothing.
+	if err := inv.RecordBuild(ctx, inventory.Build{ID: "build-waited", Repository: "novox/mesh-catalog", Ref: "main",
+		Path: "modules/gauges", On: "anchor", Failed: "the real failure"}); err != nil {
+		t.Fatal(err)
+	}
+	_, err = assign(ctx, open, "laptop", "gauges")
+	if err == nil || !strings.Contains(err.Error(), "failed: the real failure") {
+		t.Fatalf("an outcome heard after a failed wait: %v", err)
+	}
+}
+
+// A plan's tier keeps its requests as the plan's (review point 3).
+func TestAPlansBuildRequestIsThePlans(t *testing.T) {
+	open := aCatalogueMesh(t)
+	ctx := t.Context()
+	asksWithPaths(t)
+	if err := open.inventory.RegisterModule(ctx, catalogue.Manifest{Module: "app", Version: "1"},
+		inventory.Source{Repository: "novox/mesh-catalog", Seat: "git", Path: "modules/app", Ref: "main",
+			BuiltFrom: "c0", Head: "c0"}); err != nil {
+		t.Fatal(err)
+	}
+	m := link.SourceMoved{Owner: "novox", Repo: "mesh-catalog", Base: "main", Commit: "c1aaaaaaaa",
+		Paths: []string{"modules/app/index.ts"}, ModuleDirs: []string{"modules/app"}, ModuleDirsSaid: true}
+	if err := (following{open: open}).SourceMoved(ctx, m); err != nil {
+		t.Fatal(err)
+	}
+	requests, err := open.inventory.RequestsNamed(ctx, "app")
+	if err != nil || len(requests) != 1 || requests[0].For != "plan" {
+		t.Fatalf("the plan's request: %+v %v", requests, err)
+	}
+}
+
+// **A build heard as built and not registered yet is in flight** (review point 4): the outcome is recorded
+// before the module is registered; for that moment assign keeps the assignment pending. Past the grace it is
+// recorded and not registered, and the tick ends the pending assignment with that.
+func TestABuildBeingRegisteredIsInFlight(t *testing.T) {
+	open := aCatalogueMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	if err := inv.RecordBuildRequest(ctx, inventory.BuildRequest{ID: "build-done", Repository: "novox/mesh-catalog",
+		Seat: "git", Path: "modules/sensors", Ref: "main", For: "merge"}); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.RecordBuild(ctx, inventory.Build{ID: "build-done", Repository: "novox/mesh-catalog", Ref: "main",
+		Path: "modules/sensors", Module: "sensors", On: "anchor"}); err != nil {
+		t.Fatal(err)
+	}
+	said, err := assign(ctx, open, "laptop", "sensors")
+	if err != nil || !strings.Contains(said, "built and being registered") || !strings.Contains(said, "kept as pending") {
+		t.Fatalf("a build being registered: %q %v", said, err)
+	}
+	settlePending(ctx, open, time.Now().Add(registerGrace+time.Minute))
+	p := pendingOf(t, open)
+	if len(p) != 1 || p[0].State != inventory.PendingExpired || !strings.Contains(p[0].Note, "recorded and not registered") {
+		t.Fatalf("past the grace: %+v", p)
+	}
+}
+
+// Unknown: refused as no module of that name, claiming only what was looked at, with the closest names; build
+// asks for nothing.
 func TestAnUnknownModuleIsRefusedWithTheClosestNames(t *testing.T) {
 	open := aCatalogueMesh(t)
 	ctx := t.Context()
@@ -224,12 +442,16 @@ func TestAnUnknownModuleIsRefusedWithTheClosestNames(t *testing.T) {
 	if !errors.Is(err, inventory.ErrNoSuchModule) {
 		t.Fatalf("an unknown module: %v", err)
 	}
-	for _, want := range []string{"no module of that name: sensors", "no module, build request or merge by that name",
-		"the closest it holds: sensord", "asks for nothing here"} {
+	for _, want := range []string{"no module of that name: sensors", "the catalogue holds no module of that name",
+		"no build request the controller kept (the last 30 days)", "the closest names it holds: sensord",
+		"asks for nothing here"} {
 		if !strings.Contains(err.Error(), want) {
 			t.Fatalf("the refusal does not say %q:\n%v", want, err)
 		}
 	}
+	if strings.Contains(err.Error(), "merge") {
+		t.Fatalf("the refusal claims a merge it never looked at: %v", err)
+	}
 	if len(*asked) != 0 || len(pendingOf(t, open)) != 0 {
 		t.Fatalf("an unknown module asked %v, pending %+v", *asked, pendingOf(t, open))
 	}
@@ -252,7 +474,8 @@ func TestAnActWithAModuleNotRegisteredIsRefusedWhole(t *testing.T) {
 	}
 }

-// unassign withdraws a pending assignment; the build goes on and registers the module assigned nowhere.
+// unassign withdraws a waiting pending assignment; the build goes on and registers the module assigned
+// nowhere: a withdrawn row is never claimed.
 func TestUnassignWithdrawsAPendingAssignment(t *testing.T) {
 	open := aCatalogueMesh(t)
 	ctx := t.Context()
@@ -269,13 +492,80 @@ func TestUnassignWithdrawsAPendingAssignment(t *testing.T) {
 		"3da80a4b00aa", "sensors", "")); err != nil {
 		t.Fatal(err)
 	}
+	settlePending(ctx, open, time.Now())
 	if slices.Contains(assignedTo(t, open, "laptop"), "sensors") {
 		t.Fatal("a withdrawn assignment was made")
 	}
 }

-// A build that says nothing within the bound: the pending assignment expires at the next look, saying so,
-// rather than waiting for ever; and a build heard by another process meanwhile is made at the next look.
+// **A claim is never overridden** (review point 1): a pending assignment being made is claimed
+// (waiting → applying); an unassign meanwhile is refused and says so, and leaves the claim; making a row
+// already withdrawn makes nothing. A claim left by a controller that stopped is settled by the tick from what
+// the mesh holds: back to waiting when the module is not assigned, applied when it is.
+func TestAWithdrawalNeverOverridesAClaim(t *testing.T) {
+	open := aCatalogueMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	asksWithPaths(t)
+	mergeAdding(t, open, "modules/sensors", "3da80a4b00aa")
+	if _, err := assign(ctx, open, "laptop", "sensors"); err != nil {
+		t.Fatal(err)
+	}
+	p := pendingOf(t, open)[0]
+	if ok, err := inv.ClaimPending(ctx, p.ID); err != nil || !ok {
+		t.Fatalf("claim: %v %v", ok, err)
+	}
+	_, err := unassign(ctx, open, "laptop", "sensors")
+	if err == nil || !strings.Contains(err.Error(), "is being assigned sensors now") {
+		t.Fatalf("unassign of a claimed pending assignment: %v", err)
+	}
+	if got := pendingOf(t, open)[0]; got.State != inventory.PendingApplying {
+		t.Fatalf("the claim was overridden: %+v", got)
+	}
+	// Pending(zero) is the waiting ones alone (review point 7).
+	if waiting, err := inv.Pending(ctx, time.Time{}); err != nil || len(waiting) != 0 {
+		t.Fatalf("Pending(zero) read a claimed row: %+v %v", waiting, err)
+	}
+
+	// Left by a controller that stopped: back to waiting, since sensors is not assigned.
+	settlePending(ctx, open, time.Now().Add(claimStaleAfter+time.Minute))
+	if got := pendingOf(t, open)[0]; got.State != inventory.PendingWaiting {
+		t.Fatalf("a stale claim was not released: %+v", got)
+	}
+
+	// Withdrawn, then the build registers it: applyPending finds nothing to claim.
+	if _, err := unassign(ctx, open, "laptop", "sensors"); err != nil {
+		t.Fatal(err)
+	}
+	register(t, open, catalogue.Manifest{Module: "sensors", Version: "1"})
+	if line := applyPending(ctx, open, p, "b-modules/sensors"); line != "" {
+		t.Fatalf("a withdrawn pending assignment was made: %s", line)
+	}
+	if slices.Contains(assignedTo(t, open, "laptop"), "sensors") {
+		t.Fatal("a withdrawn pending assignment was assigned")
+	}
+
+	// A stale claim whose module was assigned is applied.
+	q, err := inv.RecordPending(ctx, inventory.PendingAssignment{Node: "anchor", Module: "sensors", Build: "b-x"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if ok, _ := inv.ClaimPending(ctx, q.ID); !ok {
+		t.Fatal("claim")
+	}
+	if _, err := inv.Assign(ctx, "anchor", "sensors"); err != nil {
+		t.Fatal(err)
+	}
+	settlePending(ctx, open, time.Now().Add(claimStaleAfter+time.Minute))
+	rows, _ := inv.PendingFor(ctx, "anchor", "sensors")
+	if len(rows) != 1 || rows[0].State != inventory.PendingApplied {
+		t.Fatalf("a stale claim of an assigned module: %+v", rows)
+	}
+}
+
+// A build that says nothing within the bound: the pending assignment expires at the next tick, saying so,
+// rather than waiting for ever; and a module registered by a process that kept no pending assignment is
+// assigned at the next tick.
 func TestAPendingAssignmentNeverWaitsSilently(t *testing.T) {
 	open := aCatalogueMesh(t)
 	ctx := t.Context()
@@ -295,15 +585,11 @@ func TestAPendingAssignmentNeverWaitsSilently(t *testing.T) {
 			t.Fatal(err)
 		}
 	}
-	// Heard by a process that kept no pending assignment: registered, and nothing made it.
 	register(t, open, catalogue.Manifest{Module: "heard", Version: "1"})

-	said := settleStalePending(ctx, open, time.Now().Add(buildRequestBound))
-	if len(said) != 2 {
-		t.Fatalf("settled %v", said)
-	}
+	settlePending(ctx, open, time.Now().Add(buildRequestBound))
 	if !slices.Contains(assignedTo(t, open, "laptop"), "heard") {
-		t.Fatal("a module registered meanwhile was not assigned at the next look")
+		t.Fatal("a module registered meanwhile was not assigned at the next tick")
 	}
 	byModule := map[string]inventory.PendingAssignment{}
 	for _, p := range pendingOf(t, open) {
@@ -315,6 +601,21 @@ func TestAPendingAssignmentNeverWaitsSilently(t *testing.T) {
 	if p := byModule["heard"]; p.State != inventory.PendingApplied {
 		t.Fatalf("a module registered meanwhile: %+v", p)
 	}
+
+	// Ended rows are deleted after KeptFor (review point 7); open ones never.
+	if _, err := inv.RecordPending(ctx, inventory.PendingAssignment{Node: "anchor", Module: "lost", Build: "build-lost"}); err != nil {
+		t.Fatal(err)
+	}
+	said := settlePending(ctx, open, time.Now().Add(inventory.KeptFor+time.Hour))
+	rows, err := inv.Pending(ctx, time.Unix(0, 0))
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, r := range rows {
+		if !r.Open() {
+			t.Fatalf("an ended pending assignment outlived %s: %+v (%v)", inventory.KeptFor, r, said)
+		}
+	}
 }

 // The seat's assign passes build on; unassign takes none.
@@ -327,3 +628,16 @@ func TestTheSeatsAssignPassesBuild(t *testing.T) {
 		t.Fatal("unassign took build")
 	}
 }
+
+// The condition's words are plain.
+func TestAnAssignmentNotMadeIsSaidPlainly(t *testing.T) {
+	o := pendingObservation(inventory.PendingAssignment{Node: "g14", Module: "sensors",
+		Note: "the pending assignment of sensors to g14 expired: build b-1 of modules/sensors failed: boom"})
+	w := plainWordings[kindPendingEnded](o)
+	if why, ok := conditions.PlainWords(w, "g14"); !ok {
+		t.Fatalf("not plain: %s %+v", why, w)
+	}
+	if w.Headline != "sensors was not put on g14" {
+		t.Fatalf("headline %q", w.Headline)
+	}
+}