Judge the controller's module check against the catalogue it is released with, captured at the group's catalogue head f3a57dcc, so a group that brings a word the trunk's catalogue lacks does not fail on the trunk (issue 774)

The release's fourth check failed TestModuleCheckPassesTheCatalogue with 27 problems. The checker clones the catalogue
beside a controller's tests at its trunk, even in a group holding a catalogue pull request (mesh-delivery checker
internal/check/beside.go besideFor, ADR 0484 clause 4). The release's sdk refuses an offer stating no credential form,
and the trunk's catalogue states none until the release's catalogue merges.

- Quick fix (not chosen): recapture alone, which the test never reads while MESH_CHECK_BESIDE is set.
- Chosen: the test reads the captured copy, now at the group's catalogue f3a57dcc, through beside.CapturedDir. Every other
  beside test still reads the clone. The check itself is unchanged: every rule, every manifest. Moving CAPTURED to the
  catalogue a change is released with is part of that change.

Run as the checker runs it (catalogue at main, mesh-host at main, mesh-sdk at the pin, mesh-controller's trunk
beside): the whole unit and integration suite passes, 1706 tests, 8 skipped. The test also passes with the catalogue at
f3a57dcc beside, and with nothing beside.

cmd/mesh-controller/check_test.go

@@ -56,9 +56,15 @@ func TestModuleCheckJudgesBetweenTheManifestsGiven(t *testing.T) {
 	}
 }
 
-// The real catalogue passes the command, the way it passes the test that used to be the only check.
+// The real catalogue passes the command, the way it passes the test that used to be the only check: the catalogue this
+// controller is released with, captured in testdata/beside at the commit CAPTURED names. Not the clone a merge check puts
+// beside, which is the catalogue's trunk even in a delivery group holding a catalogue pull request (ADR 0484 clause 4):
+// a controller whose check reads a word that group's catalogue brings would fail on the trunk's catalogue before the
+// group merges both (issue 774: the release's sdk refuses an offer that states no credential form, and the catalogue's
+// trunk states none until the release's catalogue merges). Moving CAPTURED to the catalogue a change is released with is
+// part of that change.
 func TestModuleCheckPassesTheCatalogue(t *testing.T) {
-	root := beside.Catalogue(t)
+	root := filepath.Join(beside.CapturedDir(t, "mesh-catalog"), "modules")
 	paths, err := manifestsUnder(root)
 	if err != nil || len(paths) == 0 {
 		t.Fatalf("no manifests under %s: %v", root, err)

internal/beside/beside.go

@@ -53,6 +53,16 @@ func Dir(t testing.TB, repository string) string {
 		t.Logf("judged against %s as cloned beside this check", dir)
 		return dir
 	}
+	t.Logf("no %s beside this check: a merge check judges %s against its own clone", Env, repository)
+	return CapturedDir(t, repository)
+}
+
+// CapturedDir is the copy of the named repository captured in testdata/beside, laid out as Dir lays it out, whatever
+// MESH_CHECK_BESIDE says: for a test that judges this repository against the commit it was released with, which a
+// merge check does not clone (it clones the catalogue at its trunk even in a delivery group holding a catalogue pull
+// request, ADR 0484 clause 4).
+func CapturedDir(t testing.TB, repository string) string {
+	t.Helper()
 	from := filepath.Join(Captured(), repository)
 	if _, err := os.Stat(from); err != nil {
 		t.Fatalf("no captured copy of %s at %s: %v", repository, from, err)
@@ -81,8 +91,7 @@ func Dir(t testing.TB, repository string) string {
 	if err != nil {
 		t.Fatalf("the captured copy of %s could not be laid out: %v", repository, err)
 	}
-	t.Logf("judged against the copy of %s captured in testdata/beside (see CAPTURED); a merge check "+
+	t.Logf("judged against the copy of %s captured in testdata/beside (see CAPTURED)", repository)
-		"judges it against the repository's own clone", repository)
 	return dir
 }
 

testdata/beside/CAPTURED

@@ -7,7 +7,7 @@ The copy carries the catalogue's private details: domains, first names in module
 private addresses. That is acceptable while mesh-controller is private; if it ever goes public, this copy is
 a second place to clean besides the catalogue itself.
 
-mesh-catalog  8ae8e88dddc86c646de4d1be35919d109ab4c779  modules/*/module.json, modules/*/files, modules/*/templates, predefined.json
+mesh-catalog  f3a57dcc56fb6c198095cafd11d0decff9f720c4  modules/*/module.json, modules/*/files, modules/*/templates, predefined.json
 mesh-host     9d9e3a46c4f5943cfffb413d962ce48b75e2fd39  examples/foundation-first-node.lock
 mesh-sdk      2da0de75c3f0087cff9c2f5ef789ca6dc3c59045  conformance/events/module-event.json
 

testdata/beside/mesh-catalog/modules/gitea/module.json.captured

@@ -266,7 +266,8 @@
       "env": {
         "DB_TYPE": "postgres",
         "USER_UID": "1000",
-        "USER_GID": "1000"
+        "USER_GID": "1000",
+        "SSH_MAX_STARTUPS": "100:30:200"
       },
       "env-file": [
         "${dir:state}/server.env"

testdata/beside/mesh-catalog/modules/mesh-issues/files/settings.json

@@ -62,10 +62,13 @@
     "mesh-catalog modules/mesh-build-node",
     "mesh-catalog modules/mesh-catalog",
     "mesh-catalog modules/mesh-cli",
+    "mesh-catalog modules/mesh-conditions",
     "mesh-catalog modules/mesh-config",
     "mesh-catalog modules/mesh-delivery",
     "mesh-catalog modules/mesh-delivery-gate",
     "mesh-catalog modules/mesh-files",
+    "mesh-catalog modules/mesh-hand-acts",
+    "mesh-catalog modules/mesh-healers",
     "mesh-catalog modules/mesh-issues",
     "mesh-catalog modules/mesh-knowledge",
     "mesh-catalog modules/mesh-mail",
@@ -75,6 +78,7 @@
     "mesh-catalog modules/mesh-provisioner",
     "mesh-catalog modules/mesh-provisioner-client",
     "mesh-catalog modules/mesh-reads",
+    "mesh-catalog modules/mesh-self-check",
     "mesh-catalog modules/mesh-vault",
     "mesh-catalog modules/mesh-watcher",
     "mesh-catalog modules/messenger",

testdata/beside/mesh-catalog/modules/mesh-issues/module.json.captured

@@ -174,10 +174,13 @@
         "mesh-catalog modules/mesh-build-node",
         "mesh-catalog modules/mesh-catalog",
         "mesh-catalog modules/mesh-cli",
+        "mesh-catalog modules/mesh-conditions",
         "mesh-catalog modules/mesh-config",
         "mesh-catalog modules/mesh-delivery",
         "mesh-catalog modules/mesh-delivery-gate",
         "mesh-catalog modules/mesh-files",
+        "mesh-catalog modules/mesh-hand-acts",
+        "mesh-catalog modules/mesh-healers",
         "mesh-catalog modules/mesh-issues",
         "mesh-catalog modules/mesh-knowledge",
         "mesh-catalog modules/mesh-mail",
@@ -187,6 +190,7 @@
         "mesh-catalog modules/mesh-provisioner",
         "mesh-catalog modules/mesh-provisioner-client",
         "mesh-catalog modules/mesh-reads",
+        "mesh-catalog modules/mesh-self-check",
         "mesh-catalog modules/mesh-vault",
         "mesh-catalog modules/mesh-watcher",
         "mesh-catalog modules/messenger",