Raise the mesh as it is in the gate, call a baseline that does not compose an error, and let a check run by hand as the seat runs it

The gate composed 0 of 4 machines with the change and without, and passed every change: the store it
raised held each module's bus credential but no account for it (issue 203's refusal), no outward links
(so no filter could be composed), and refused settings the mesh holds. Now the account is minted with
its credential, the facts carry each machine's outward links (a stand-in for an older snapshot), the
mesh's layers are kept as held, and a withheld path keeps a path's shape. A machine the mesh composes
that the gate cannot raise makes the verdict an error, never a pass; the verdict alone is on stdout.

A merge-check.sh that passed on an agent's machine failed on the build seat: a newer gofmt, siblings at
a feature branch, another user. `mesh-controller check-here` runs builder.Check with the ask the
controller would make, from facts that now name the toolchains and the refs cloned beside; a failed
script is said by what failed. (novox/hq issues 282, 283)

cmd/mesh-controller/merge_gate_test.go

@@ -6,6 +6,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/novox/mesh-controller/internal/broker"
 	"github.com/novox/mesh-controller/internal/catalogue"
 	snapshot "github.com/novox/mesh-controller/internal/facts"
 	"github.com/novox/mesh-controller/internal/inventory"
@@ -281,3 +282,133 @@ func catalogueMeshWithAnApp(t *testing.T) (snapshot.Facts, map[string]string) {
 	}
 	return f, manifests
 }
+
+// busMesh is aMesh with a module on the bus on the laptop, its account issued as `module issue` issues
+// one: minted, and its credential held as the module's own secret named broker.
+func busMesh(t *testing.T) snapshot.Facts {
+	t.Helper()
+	open := aMesh(t)
+	ctx := t.Context()
+	m, err := catalogue.ParseManifest([]byte(`{"module":"speaker","version":"1",
+		"own-secrets":{"broker":"/var/lib/speaker/broker"}}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := open.inventory.RegisterModule(ctx, m, inventory.Source{Repository: "novox/mesh-catalog",
+		Path: "modules/speaker", BuiltFrom: "c0ffee"}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := assign(ctx, open, "laptop", "speaker"); err != nil {
+		t.Fatal(err)
+	}
+	user := broker.Principal{Kind: broker.KindModule, Node: "laptop", Module: "speaker"}.Username()
+	password, err := open.inventory.MintBusPassword(ctx, inventory.BusUser{Username: user, Kind: inventory.BusModule,
+		Node: "laptop", Module: "speaker"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := open.inventory.AcceptSecretForModule(ctx, "laptop", "speaker", "broker",
+		`{"user":"`+user+`","password":"`+password+`"}`); err != nil {
+		t.Fatal(err)
+	}
+	f, err := gatherFacts(ctx, open, "2.11.17")
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, mc := range f.Machines {
+		if !mc.Declaration.Composes {
+			t.Fatalf("the mesh itself does not compose: %+v", mc.Declaration)
+		}
+	}
+	return f
+}
+
+// **Issue 282**: every machine running a module on the bus failed to compose in the gate's store, with
+// the change and without — the store held the module's credential and no account for it, which
+// composition refuses (issue 203) — and the gate passed every change, "0 of 4 compose". The account the
+// mesh issued is raised with its credential, so the machine composes in the gate as on the mesh.
+func TestIssue282AModuleOnTheBusComposesInTheGate(t *testing.T) {
+	f := busMesh(t)
+	v := gateJudged(t, f, "")
+	if v.Verdict != "pass" {
+		t.Fatalf("the mesh as it is does not pass:\n%s", v.Report())
+	}
+	for _, m := range v.Machines {
+		if !m.Base.Composes {
+			t.Errorf("%s composes on the mesh and not in the gate: %v", m.Described, m.Base.Problems)
+		}
+	}
+	if !strings.Contains(v.Summary, "2 of 2 compose") {
+		t.Errorf("the summary does not say every machine composes: %s", v.Summary)
+	}
+}
+
+// **Issue 282**: a machine the mesh composes that the gate cannot raise as it is leaves the change judged
+// against a machine that is not the mesh's — broken against broken, which passes whatever the change does.
+// That is an error, never a pass.
+func TestIssue282AMachineTheGateCannotRaiseIsAnErrorNeverAPass(t *testing.T) {
+	f := busMesh(t)
+	for i := range f.Machines {
+		// A fact the snapshot does not carry: the module's credential, gone from the laptop's.
+		var kept []snapshot.Accepted
+		for _, a := range f.Machines[i].Accepted {
+			if a.Name != "broker" {
+				kept = append(kept, a)
+			}
+		}
+		f.Machines[i].Accepted = kept
+	}
+	v := gateJudged(t, f, "")
+	if v.Verdict != "error" {
+		t.Fatalf("a gate whose mesh does not compose said %s:\n%s", v.Verdict, v.Report())
+	}
+	if len(v.Errors) != 1 || !strings.Contains(v.Errors[0], "speaker") {
+		t.Errorf("the error does not name what could not be raised: %v", v.Errors)
+	}
+}
+
+// A path the snapshot withheld is given a path of its own where an access or a place needs one: a bare
+// "withheld" is no absolute path, and a machine whose setting composes on the mesh would not in the gate.
+func TestAWithheldPathIsStoodInForByAPath(t *testing.T) {
+	got := standInPaths(map[string]any{
+		"accesses": map[string]any{"races": "withheld", "films": "/media/films", "shows": "/withheld"},
+		"places":   map[string]any{"config": map[string]any{"path": "withheld", "owner": "1000:1000"}},
+		"puid":     1000,
+	})
+	accesses := got["accesses"].(map[string]any)
+	if accesses["races"] == accesses["shows"] || !strings.HasPrefix(accesses["races"].(string), "/") ||
+		!strings.HasPrefix(accesses["shows"].(string), "/") || accesses["films"] != "/media/films" {
+		t.Errorf("accesses: %v", accesses)
+	}
+	place := got["places"].(map[string]any)["config"].(map[string]any)
+	if !strings.HasPrefix(place["path"].(string), "/") || place["owner"] != "1000:1000" || got["puid"] != 1000 {
+		t.Errorf("places: %v", got)
+	}
+}
+
+// **Issue 283**: a check run by hand clones beside a change what the seat clones — one rule, read by the
+// controller's ask and by the facts — and finds the repository it checks from its origin.
+func TestACheckByHandClonesWhatTheSeatClones(t *testing.T) {
+	for dir, refs := range map[string]map[string]string{
+		"mesh-catalog":    {"mesh-catalog": "main"},
+		"mesh-host":       {"mesh-host": "c0ffee"},
+		"mesh-controller": {"mesh-controller": "c0ffee", "mesh-controller-main": "main", "mesh-lab": "main"},
+	} {
+		got := besideRefs(dir, "c0ffee")
+		for d, ref := range refs {
+			if got[d] != ref {
+				t.Errorf("beside %s, %s is cloned at %q, not %q", dir, d, got[d], ref)
+			}
+		}
+	}
+	for owner, want := range map[string][3]string{
+		"ssh://git@git.example:222/novox/mesh-host.git": {"novox", "mesh-host", "ssh://git@git.example:222/novox"},
+		"git@git.example:novox/mesh-tools.git":          {"novox", "mesh-tools", "git@git.example:novox"},
+		"http://git.example/novox/hq":                   {"novox", "hq", "http://git.example/novox"},
+	} {
+		o, r, p := ownerRepoOf(owner)
+		if [3]string{o, r, p} != want {
+			t.Errorf("%s reads as %s %s %s", owner, o, r, p)
+		}
+	}
+}