Answer the review of hq issues 348 and 349: gaps, parts, the newest merge in any state

- A reopened fault keeps its gaps: it was there at a send unless the send
  fell in one, so a send that breaks a machine recovered before it still
  fails its gate (A2).
- An undecided part holds only the conditions that name it (A4).
- D2 holds a silent resolver for the next run again, refused or not: a
  burst of refusals is also a restart (A3).
- A late merge is planned at the newest planned merge of its branch in any
  state, not only an open one (A1); merge times to the nanosecond (A5).

cmd/mesh-controller/issue348_test.go

@@ -1,11 +1,7 @@
 package main
 
 import (
-	"errors"
-	"net"
-	"os"
 	"strings"
-	"syscall"
 	"testing"
 	"time"
 
@@ -95,8 +91,8 @@ func TestReplay348(t *testing.T) {
 	// 11:00:23 — its second look: unhealthy again, the same raising.
 	say(h0.Add(2*time.Minute), networkSaying(namesRefused(link.StateUnhealthy, 2)))
 	again, ok := network()
-	if !ok || !again.Began().Equal(raised.Raised) {
-		t.Fatalf("the same fault was said as one that began at %s (raised first at %s)", again.Began(), raised.Raised)
+	if !ok || !again.Raised.Equal(raised.Raised) || again.Count != 1 {
+		t.Fatalf("the same raising was not kept: raised %s (first %s), count %d", again.Raised, raised.Raised, again.Count)
 	}
 
 	// The gate on the control node, for a build sent after the fault began.
@@ -116,53 +112,98 @@ func TestReplay348(t *testing.T) {
 	}
 }
 
-// A reopening is the same fault: it began when it was first raised, and the gate reads when it began. The
-// controller that cleared it on an undecided statement — or any clearing and raising within ReopenWithin —
-// no longer makes a fault from before a send into one raised since it.
-func TestAReopenedFaultFromBeforeTheSendIsNotRaisedSinceIt(t *testing.T) {
+// A fault there at the send, cleared and reopened after it, is not raised since the send; one that cleared
+// before the send and came back after it is — a send that breaks a recovered machine fails its gate (review
+// of mesh-controller PR 179, A2). Read through OpenAt, by both of the gate's readings.
+func TestAFaultThatFlappedAfterTheSendIsNotTheSendsAndOneThatRecoveredBeforeItIs(t *testing.T) {
 	since := h0
-	c := conditions.Condition{Key: "machine.anchor.network", Kind: kindMachineNetwork,
-		Subject: conditions.Subject{Scope: conditions.ScopeMachine, ID: "anchor", Machine: "anchor"},
-		Summary: "anchor's network is not healthy", Source: sourceNetwork, Count: 2,
-		First: since.Add(-time.Minute), Raised: since.Add(time.Minute)}
-	f := gateFacts{judged: true, open: []conditions.Condition{c}}
-	if w := aboutTheMachine("anchor", []string{"mesh-controller"}, since, f); w.whole != "" || len(w.on) != 0 {
-		t.Fatalf("a fault reopened after the send, first raised before it, held the machine: %+v", w)
+	network := func(first time.Time, gaps ...conditions.Gap) conditions.Condition {
+		raised := since.Add(time.Minute)
+		if len(gaps) > 0 {
+			raised = gaps[len(gaps)-1].Reopened
+		}
+		return conditions.Condition{Key: "machine.anchor.network", Kind: kindMachineNetwork,
+			Subject: conditions.Subject{Scope: conditions.ScopeMachine, ID: "anchor", Machine: "anchor"},
+			Summary: "anchor's network is not healthy", Source: sourceNetwork, First: first, Gaps: gaps, Raised: raised}
 	}
-	// The same raised first after the send is the send's to answer for.
-	c.First = since.Add(30 * time.Second)
-	f.open = []conditions.Condition{c}
-	if w := aboutTheMachine("anchor", []string{"mesh-controller"}, since, f); w.whole == "" {
-		t.Fatalf("a fault that began after the send held nothing: %+v", w)
+	held := func(c conditions.Condition) bool {
+		return aboutTheMachine("anchor", []string{"mesh-controller"}, since, gateFacts{judged: true,
+			open: []conditions.Condition{c}}).whole != ""
 	}
-	// And a module's own: judgeHealth reads it the same way.
+	// The day's case: raised before the send, cleared 8 s after it, reopened 49 s after it.
+	flapped := network(since.Add(-49*time.Second),
+		conditions.Gap{Cleared: since.Add(8 * time.Second), Reopened: since.Add(49 * time.Second)})
+	if held(flapped) {
+		t.Fatal("a fault there at the send, flapping after it, held the machine")
+	}
+	// Recovered before the send, broken again after it: the send's.
+	recovered := network(since.Add(-time.Hour),
+		conditions.Gap{Cleared: since.Add(-30 * time.Second), Reopened: since.Add(20 * time.Second)})
+	if !held(recovered) {
+		t.Fatal("a machine recovered at the send and broken after it passed the gate")
+	}
+	// An older gap, before the send, and the fault there at the send: not the send's.
+	twice := network(since.Add(-time.Hour),
+		conditions.Gap{Cleared: since.Add(-50 * time.Minute), Reopened: since.Add(-45 * time.Minute)},
+		conditions.Gap{Cleared: since.Add(10 * time.Second), Reopened: since.Add(30 * time.Second)})
+	if held(twice) {
+		t.Fatal("a fault there at the send, with an older gap, held the machine")
+	}
+	// Raised after the send, never cleared: the send's.
+	if !held(network(time.Time{})) {
+		t.Fatal("a fault raised after the send held nothing")
+	}
+	// And a module's own, through judgeHealth.
 	at := since.Add(2 * time.Minute)
 	g := gateFacts{judged: true, now: at, reports: map[string]inventory.Reported{"anchor": {Node: "anchor",
 		Outcome: inventory.OutcomeApplied, At: &at, Current: true}}, engines: map[string]string{},
 		served: map[string]served{}, rolledBack: map[string][]lease.Rollback{},
 		open: []conditions.Condition{{Key: "provider.app.anchor.x.failing", Subject: conditions.Subject{
 			Scope: conditions.ScopeProvider, ID: "app.anchor.x", Machine: "anchor"}, Summary: "failing",
-			First: since.Add(-time.Hour), Raised: since.Add(time.Minute)}}}
-	if h, why := judgeHealth("app", "", catalogue.Manifest{Module: "app"}, "anchor", since, g); strings.HasPrefix(why, "raised since it was sent") {
-		t.Fatalf("a module's own fault, reopened after its send and first raised before it: %v (%s)", h, why)
+			First: since.Add(-time.Hour), Raised: since.Add(time.Minute),
+			Gaps: []conditions.Gap{{Cleared: since.Add(5 * time.Second), Reopened: since.Add(time.Minute)}}}}}
+	if _, why := judgeHealth("app", "", catalogue.Manifest{Module: "app"}, "anchor", since, g); strings.HasPrefix(why, "raised since it was sent") {
+		t.Fatalf("a module's own fault there at the send: %s", why)
 	}
-	g.open[0].First = time.Time{}
+	g.open[0].Gaps[0].Cleared = since.Add(-5 * time.Second)
 	if _, why := judgeHealth("app", "", catalogue.Manifest{Module: "app"}, "anchor", since, g); !strings.HasPrefix(why, "raised since it was sent") {
-		t.Fatalf("a module's own fault raised after its send was not counted: %s", why)
+		t.Fatalf("a module's own fault, recovered at the send and back after it, was not counted: %s", why)
 	}
 }
 
-// An undecided statement — unknown or starting — keeps the machine's network conditions; a decided one
-// does not. Pure.
-func TestAnUndecidedStatementKeepsTheMachinesNetworkConditions(t *testing.T) {
+// Only an undecided part holds a condition that names it; a condition about another part clears, and a
+// statement unknown as a whole holds every part (review of PR 179, A4). Pure.
+func TestAnUndecidedPartHoldsOnlyWhatNamesIt(t *testing.T) {
 	f := netFacts(map[string]*inventory.NetworkHealth{
-		"anchor": aNetwork(link.StateUnknown, inventory.NetworkPart{Part: link.PartNames, State: link.StateUnknown, Streak: 1}),
+		"anchor": aNetwork(link.StateUnknown, inventory.NetworkPart{Part: link.PartNames, State: link.StateUnknown, Streak: 1},
+			inventory.NetworkPart{Part: link.PartRoute, State: link.StateHealthy}),
 		"laptop": aNetwork(link.StateHealthy, inventory.NetworkPart{Part: link.PartNames, State: link.StateHealthy}),
-		"spare":  aNetwork(link.StateUnhealthy, noRoute),
+		"spare":  aNetwork(link.StateStarting, inventory.NetworkPart{Part: link.PartTunnel, State: link.StateHealthy}),
+		"other":  aNetwork(link.StateStarting, inventory.NetworkPart{Part: link.PartTunnel, State: link.StateStarting}),
 	})
-	got := undecidedMachines(f)
-	if !got["anchor"] || got["laptop"] || got["spare"] || len(got) != 1 {
-		t.Fatalf("undecided: %v", got)
+	u := undecidedParts(f)
+	if !u["anchor"][link.PartNames] || u["anchor"][link.PartRoute] || u["laptop"] != nil || !u["spare"]["*"] ||
+		!u["other"][link.PartTunnel] || u["other"]["*"] {
+		t.Fatalf("undecided: %v", u)
+	}
+	about := func(machine, said string, also ...string) conditions.Condition {
+		return conditions.Condition{Subject: conditions.Subject{Scope: conditions.ScopeMachine, ID: machine,
+			Machine: machine, Also: also}, Evidence: []conditions.Evidence{{Said: said}}}
+	}
+	for _, c := range []struct {
+		c    conditions.Condition
+		held bool
+	}{
+		{about("anchor", "names since 2026-10-09 10:58:45 UTC: 10.77.0.1 — refused"), true},
+		{about("anchor", "route since 2026-10-09 10:58:45 UTC: no default route"), false},
+		{about("laptop", "names since 2026-10-09 10:58:45 UTC: refused"), false},
+		{about("spare", "route since …: no default route"), true},
+		{about("hub", "anchor: names: refused", "anchor"), true},
+		{about("hub", "anchor: tunnel: no handshake", "anchor"), false},
+	} {
+		if got := heldUndecided(c.c, u); got != c.held {
+			t.Errorf("%s %q held %v, want %v", c.c.Subject.Machine, c.c.Evidence[0].Said, got, c.held)
+		}
 	}
 }
 
@@ -178,35 +219,3 @@ func TestAReleaseRollsOutWhatItsTierNames(t *testing.T) {
 		t.Fatalf("rolling: %v", got)
 	}
 }
-
-// A resolver that refuses every try — nothing listens on its port — is said at once, not held for the
-// next run five minutes later: a refusal is the machine's answer, not a loaded resolver (issue 277).
-func TestAResolverThatRefusesEveryTryIsSaidAtOnce(t *testing.T) {
-	conn, err := net.ListenPacket("udp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatal(err)
-	}
-	_, port, _ := net.SplitHostPort(conn.LocalAddr().String())
-	_ = conn.Close() // nothing listens there now: every question is refused
-	quickResolvers(t, port)
-	got := askEveryResolver(t.Context(), map[string]string{"anchor.internal": "127.0.0.1"}, anchorOnTheNetwork, "internal")
-	if len(got) != 1 {
-		t.Fatalf("%+v", got)
-	}
-	if got[0].Confirm || !strings.Contains(got[0].Said, "refused") {
-		t.Fatalf("a resolver refusing every try was held for the next run: %+v", got[0])
-	}
-}
-
-func TestOnlyARefusalOnEveryTryIsAllRefused(t *testing.T) {
-	refused := &net.OpError{Op: "read", Net: "udp", Err: os.NewSyscallError("read", syscall.ECONNREFUSED)}
-	if !(resolverAsked{errs: []error{refused, refused}}).allRefused() {
-		t.Fatal("refused on every try is not all refused")
-	}
-	if (resolverAsked{errs: []error{refused, errors.New("i/o timeout")}}).allRefused() {
-		t.Fatal("a timeout among the tries is all refused")
-	}
-	if (resolverAsked{answered: true, errs: []error{refused}}).allRefused() || (resolverAsked{}).allRefused() {
-		t.Fatal("an answered question, or one never asked, is all refused")
-	}
-}