Hold a walk's first-machine gate while its busy container finishes its build

A merge into mesh-controller replaced every build agent and threw away the
checks in flight (issue 594). The manifest's container busy is checked and
sent only to an engine that reads it; a report's busy waits are kept, the
gate starts at the report that says the container replaced, and the wait is
a phase of the delivery time. mesh-builder busy drains the agent and answers
while a build is in hand (novox/hq ADR 0335).

vendor/github.com/novox/mesh-host/internal/declaration/busy.go

@@ -0,0 +1,87 @@
+package declaration
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"strings"
+	"time"
+)
+
+// Busy is how a long-running container says it holds work that would be lost if it were stopped now
+// (novox/hq ADR 0335 §1): a command run inside it, by its shell, as an exec health check is, that exits 0
+// while it is busy and non-zero when it is idle. Being asked is also the container's notice that it is
+// about to be replaced: from the first ask it takes no new work, so its answer ends once the work in hand
+// ends.
+//
+// **Not part of what the container is.** Busy is not in the container's spec: a changed command changes
+// when the container is replaced, never whether — a container is not recreated for its busy command alone.
+type Busy struct {
+	Command string `json:"command"`
+	// Timeout is how long one ask may take; empty is BusyTimeoutDefault.
+	Timeout string `json:"timeout,omitempty"`
+}
+
+// The bounds of an ask (novox/hq ADR 0335).
+const (
+	BusyTimeoutDefault = 10 * time.Second
+	// BusyTimeoutCeiling is the longest one ask may take: an ask runs inside an apply, and an apply waits
+	// for nothing longer than a look.
+	BusyTimeoutCeiling = time.Minute
+	// BusyBound is how long a container that says busy is left running after the first apply that would
+	// have replaced it (ADR 0335 §3). The node-engine's, not the module's: no module holds its own
+	// replacement for ever.
+	BusyBound = 15 * time.Minute
+)
+
+// UnmarshalJSON reads a busy strictly, as everything a declaration carries is read.
+func (b *Busy) UnmarshalJSON(raw []byte) error {
+	type plain Busy
+	var p plain
+	dec := json.NewDecoder(bytes.NewReader(raw))
+	dec.DisallowUnknownFields()
+	if err := dec.Decode(&p); err != nil {
+		return fmt.Errorf("busy: %w", err)
+	}
+	*b = Busy(p)
+	return nil
+}
+
+// Within is how long one ask may take. Validated on arrival, so an unreadable timeout is the default.
+func (b *Busy) Within() time.Duration {
+	if d, err := time.ParseDuration(b.Timeout); err == nil && d > 0 {
+		return d
+	}
+	return BusyTimeoutDefault
+}
+
+// problems holds a container's busy to its shape: a one-line command, a timeout within its bounds, and only
+// on a container that stays up.
+func (b *Busy) problems(where string, longRunning bool) []string {
+	if b == nil {
+		return nil
+	}
+	var problems []string
+	say := func(format string, args ...any) {
+		problems = append(problems, where+": "+fmt.Sprintf(format, args...))
+	}
+	if !longRunning {
+		say("busy is asked of a container that stays up; a step or a scheduled run is never replaced mid-run")
+	}
+	if strings.TrimSpace(b.Command) == "" {
+		say("busy needs a command")
+	}
+	if strings.ContainsAny(b.Command, "\n\r") {
+		say("busy's command is one line")
+	}
+	if b.Timeout != "" {
+		d, err := time.ParseDuration(b.Timeout)
+		switch {
+		case err != nil:
+			say("busy's timeout is a duration, not %q", b.Timeout)
+		case d <= 0 || d > BusyTimeoutCeiling:
+			say("an ask of busy takes more than nothing and at most %s, not %s", BusyTimeoutCeiling, d)
+		}
+	}
+	return problems
+}

vendor/github.com/novox/mesh-host/internal/declaration/declaration.go

@@ -12,6 +12,7 @@ import (
 	"fmt"
 	"io"
 	"net"
+	"path/filepath"
 	"reflect"
 	"regexp"
 	"slices"
@@ -132,7 +133,13 @@ func (d *Directory) validate(where string, _ bool) []string {
 	if d.Path == "" {
 		problems = append(problems, where+": a directory needs a path")
 	}
-	return append(problems, checkMode(where, d.Mode)...)
+	// A directory's mode may carry the setgid bit (2xxx), so what is made beneath it keeps its group (novox/hq ADR
+	// 0334 §1); never setuid or sticky, which mean nothing the mesh asks of a directory it owns.
+	mode := d.Mode
+	if len(mode) == 4 && mode[0] == '2' {
+		mode = "0" + mode[1:]
+	}
+	return append(problems, checkMode(where, mode)...)
 }
 
 // File is a file with literal content. The host renders nothing.
@@ -456,14 +463,51 @@ const (
 // **The distinction 04-ISSUES/036 and 026 turn on.** A `directory` resource is the mesh's own —
 // it creates it, sets its owner and mode, and removes it when empty ([ADR 0030](novox/hq)). A
 // media library, a download spool is the operator's: it existed before the mesh, several modules
-// read and write it at once, and the mesh must not create, chown, reconcile or remove it. The
-// host confirms it is there and mounts it; nothing else.
+// read and write it at once, and the mesh must not create, chown, chmod or remove it. The host
+// confirms it is there and mounts it; nothing else. Library data is a library's (novox/hq ADR 0328),
+// not an access.
 type Access struct {
 	ID   string `json:"id"`
 	Type Type   `json:"type"`
 	Path string `json:"path"`
 	// Mode is how this module reaches the path: read or read-write. Absent narrows to read.
 	Mode string `json:"mode,omitempty"`
+
+	// Users and Taken are what a controller speaking ADR 0325 sends (the identities that use the folder, and
+	// that the operator's warrant was carried out): accepted, so its declaration is not refused whole, and not
+	// acted on since ADR 0328 superseded ADR 0325 — no ACL entry is kept.
+	Users []AccessUser `json:"users,omitempty"`
+	Taken bool         `json:"taken,omitempty"`
+
+	// Grant is what a controller older than ADR 0325 still sends (ADR 0312's group grant, superseded): accepted
+	// so its declaration is not refused whole, and never acted on — no account is put in a group for data (§5).
+	Grant json.RawMessage `json:"grant,omitempty"`
+}
+
+// The uses an access's user has (ADR 0051 §3), and where it runs (ADR 0325 §4).
+const (
+	FromContainer  = "container"
+	FromToolRunner = "tool-runner"
+)
+
+// AccessUser is one identity that uses an accessed folder: its name and uid as the controller allocated them, its
+// use, and where it runs. A tool runner's account may come with no uid (0 or absent): the engine reads it by name.
+type AccessUser struct {
+	Identity string `json:"identity"`
+	UID      int    `json:"uid,omitempty"`
+	Use      string `json:"use"`
+	From     string `json:"from"`
+}
+
+// UnmarshalJSON reads a user as strictly as a resource is read.
+func (u *AccessUser) UnmarshalJSON(raw []byte) error {
+	type plain AccessUser
+	var p plain
+	if err := strictDecode(raw, &p); err != nil {
+		return fmt.Errorf("an access's user: %w", err)
+	}
+	*u = AccessUser(p)
+	return nil
 }
 
 func (a *Access) Identity() string { return a.ID }
@@ -482,9 +526,43 @@ func (a *Access) validate(where string, _ bool) []string {
 		problems = append(problems, fmt.Sprintf(
 			"%s: an access is %q or %q, not %q", where, AccessRead, AccessReadWrite, a.Mode))
 	}
+	for _, u := range a.Users {
+		switch {
+		case u.Identity == "" || !accountName.MatchString(u.Identity):
+			problems = append(problems, fmt.Sprintf("%s: a user of an access is an account's name, and %q is not one",
+				where, u.Identity))
+		case u.UID < 0 || (u.UID == 0 && u.From != FromToolRunner):
+			// Never root (novox/hq ADR 0325 §11): an entry for uid 0 would be a right root has anyway, and a
+			// number below it is no account. A tool runner's account alone may come without its number: the
+			// controller cannot know the operator's account's, and the engine reads it by name
+			// (apply.ResolveRunners), refusing one that is root's.
+			problems = append(problems, fmt.Sprintf("%s: the user %s has uid %d, and a module's identity is never "+
+				"root or below it (novox/hq ADR 0325 §11)", where, u.Identity, u.UID))
+		}
+		if u.Use != AccessRead && u.Use != AccessReadWrite {
+			problems = append(problems, fmt.Sprintf("%s: the user %s uses it %q, and a use is %q or %q", where,
+				u.Identity, u.Use, AccessRead, AccessReadWrite))
+		}
+		if u.Use == AccessReadWrite && a.Mode != AccessReadWrite {
+			problems = append(problems, fmt.Sprintf("%s: the user %s writes an access declared %s", where,
+				u.Identity, orRead(a.Mode)))
+		}
+		if u.From != FromContainer && u.From != FromToolRunner {
+			problems = append(problems, fmt.Sprintf("%s: the user %s runs from %q, and that is %q or %q", where,
+				u.Identity, u.From, FromContainer, FromToolRunner))
+		}
+	}
 	return problems
 }
 
+// orRead is an access's mode as said: absent narrows to read.
+func orRead(mode string) string {
+	if mode == "" {
+		return AccessRead
+	}
+	return mode
+}
+
 func (u *User) Identity() string { return u.ID }
 func (u *User) Kind() Type       { return TypeUser }
 func (u *User) Target() string   { return u.Name }
@@ -1160,6 +1238,83 @@ type Container struct {
 	// Health is how this resource is ready (novox/hq ADR 0240 rule 2, Phase B): one kind and its
 	// timing, judged by the node-engine beside liveness. Absent: judged alive or not, and nothing more.
 	Health *Health `json:"health,omitempty"`
+
+	// Busy is how this container says it holds work a replacement would lose (novox/hq ADR 0335): asked
+	// before it is replaced, and while it says busy it is left running, within the bound. Absent: never
+	// busy, and replaced at once, as before.
+	Busy *Busy `json:"busy,omitempty"`
+
+	// RunAs is who the container runs as, resolved by the controller from the module's identity and the
+	// image's declared interface (novox/hq ADR 0325 §2, §3): told by environment (the image reads PUID and
+	// PGID, say) or by the runtime's own user option. Part of the spec, so a change recreates it. Absent: the
+	// container runs as its image says. Its key is `identity`, the manifest's word; the field is not, because
+	// a resource's Identity is its id.
+	RunAs *ContainerIdentity `json:"identity,omitempty"`
+}
+
+// The ways an image is told who to run as (novox/hq ADR 0325 §2).
+const (
+	IdentityByEnv = "env"
+	IdentityByRun = "run"
+)
+
+// ContainerIdentity is who a container runs as, and how its image is told.
+type ContainerIdentity struct {
+	// Mode is IdentityByEnv or IdentityByRun.
+	Mode string `json:"mode"`
+	// UserEnv and GroupEnv are the variables the image reads the user's and the group's number from, for
+	// IdentityByEnv: "PUID", "PGID".
+	UserEnv  string `json:"user_env,omitempty"`
+	GroupEnv string `json:"group_env,omitempty"`
+	UID      int    `json:"uid"`
+	GID      int    `json:"gid"`
+}
+
+// UnmarshalJSON reads an identity as strictly as a resource is read.
+func (i *ContainerIdentity) UnmarshalJSON(raw []byte) error {
+	type plain ContainerIdentity
+	var p plain
+	if err := strictDecode(raw, &p); err != nil {
+		return fmt.Errorf("a container's identity: %w", err)
+	}
+	*i = ContainerIdentity(p)
+	return nil
+}
+
+// envName is a variable's name as a runtime takes it.
+var envName = regexp.MustCompile(`^[A-Za-z_][A-Za-z0-9_]*$`)
+
+func (i *ContainerIdentity) problems(where string, env map[string]string) []string {
+	if i == nil {
+		return nil
+	}
+	var problems []string
+	switch i.Mode {
+	case IdentityByEnv:
+		if !envName.MatchString(i.UserEnv) || (i.GroupEnv != "" && !envName.MatchString(i.GroupEnv)) {
+			problems = append(problems, fmt.Sprintf("%s: an identity told by environment names the variables "+
+				"it is told in, and %q and %q are not both names", where, i.UserEnv, i.GroupEnv))
+		}
+		for _, name := range []string{i.UserEnv, i.GroupEnv} {
+			if _, set := env[name]; set && name != "" {
+				problems = append(problems, fmt.Sprintf("%s: env sets %s, which the identity sets; one value "+
+					"for one variable", where, name))
+			}
+		}
+	case IdentityByRun:
+		if i.UserEnv != "" || i.GroupEnv != "" {
+			problems = append(problems, where+": an identity told by the runtime's user option names no variable")
+		}
+	default:
+		problems = append(problems, fmt.Sprintf("%s: an identity is told by %q or %q, not %q", where,
+			IdentityByEnv, IdentityByRun, i.Mode))
+	}
+	// Never root (novox/hq ADR 0325 §11): refused here, so nothing of the declaration is made or started.
+	if i.UID <= 0 || i.GID <= 0 {
+		problems = append(problems, fmt.Sprintf("%s: the identity is uid %d, gid %d, and a module's identity is "+
+			"never root, nor a number below it (novox/hq ADR 0325 §11)", where, i.UID, i.GID))
+	}
+	return problems
 }
 
 func (c *Container) Identity() string { return c.ID }
@@ -1168,6 +1323,7 @@ func (c *Container) Target() string   { return c.Name }
 
 func (c *Container) validate(where string, _ bool) []string {
 	problems := c.Health.problems(where, true, !c.RunOnce && c.Schedule == "")
+	problems = append(problems, c.Busy.problems(where, !c.RunOnce && c.Schedule == "")...)
 	if c.Name == "" {
 		problems = append(problems, where+": a container needs a name")
 	}
@@ -1242,6 +1398,7 @@ func (c *Container) validate(where string, _ bool) []string {
 		problems = append(problems, where+": networks is for a container that keeps running; a step "+
 			"runs and exits, and joins nothing afterwards")
 	}
+	problems = append(problems, c.RunAs.problems(where+": container "+c.Name, c.Env)...)
 	return append(problems, checkImage(where, c.Image)...)
 }
 
@@ -1392,6 +1549,185 @@ type Declaration struct {
 	// the generation of what it puts back, which may be older than what the machine applied, and is
 	// not refused for it.
 	PutBack bool
+
+	// Identities is the identity of every module assigned to this machine (novox/hq ADR 0328 §4): an account
+	// and a group `mesh-<module>` with the numbers the controller allocated once for the module, the same on
+	// every machine. The engine makes each before any resource is applied, and removes what it made of one no
+	// longer declared. Absent is a controller older than ADR 0325.
+	Identities []Identity
+
+	// Groups is the group of every library this machine is reached by (novox/hq ADR 0328 §3): `mesh-<library>`
+	// with the number the controller allocated once, mesh-wide. The engine makes each, and removes what it made of
+	// one no longer declared. Absent is a controller older than ADR 0328.
+	Groups []Group
+
+	// Libraries is every library this machine is reached by (ADR 0328 §1, §6, §9): its root here, its group, whether
+	// this is its home, whether the operator's warrant to take it was carried out, the sub-paths its modules ask for,
+	// and the tool runner's account to put in its group (§11). Absent is a controller older than ADR 0328.
+	Libraries []Library
+}
+
+// Identity is one module's identity, as the controller allocated it (ADR 0328 §4): its user `mesh-<module>` with
+// uid, its own group of the same name and number, its primary group gid (its own, or its first library's group),
+// and the groups of its other libraries as added groups.
+type Identity struct {
+	Module string `json:"module"`
+	Name   string `json:"name"`
+	UID    int    `json:"uid"`
+	GID    int    `json:"gid"`
+	Groups []int  `json:"groups,omitempty"`
+	// Runner is the tool runner's account, put in the module's own group (novox/hq ADR 0334 §2) when its tools run
+	// on this machine. Absent for a module that declares no tools here, and from a controller older than ADR 0334.
+	Runner string `json:"runner,omitempty"`
+}
+
+// Group is one library's group, as the controller allocated it (ADR 0328 §3).
+type Group struct {
+	Name string `json:"name"`
+	GID  int    `json:"gid"`
+}
+
+// GroupPrefix starts every library group's name, as IdentityPrefix starts every module's.
+const GroupPrefix = "mesh-"
+
+// LibraryAccessPrefix starts the access a library's wait and its take act name: `library:<name>`.
+const LibraryAccessPrefix = "library:"
+
+// Library is one library as this machine sees it (ADR 0328).
+type Library struct {
+	Library string `json:"library"`
+	// Root is the library's root on this machine: on its home the data itself, elsewhere the mount point the mounts
+	// module mounts it at.
+	Root  string `json:"root"`
+	Group string `json:"group"`
+	GID   int    `json:"gid"`
+	// Home is that the library's data lives on this machine: only there does the engine keep it.
+	Home bool `json:"home"`
+	// Taken is the controller saying the operator's warrant to take it was carried out (§7).
+	Taken bool `json:"taken,omitempty"`
+	// Paths are the sub-paths its modules ask for, relative to the root.
+	Paths []string `json:"paths,omitempty"`
+	// Runner is the tool runner's account, put in the library's group (§11). Absent when no module's tools use it.
+	Runner string `json:"runner,omitempty"`
+}
+
+// checkLibraries judges the groups and libraries on arrival: every library's group declared, named for it, never
+// root's number; paths that stay below the root; a runner that is an account's name; and no two roots that nest
+// (§13).
+func checkLibraries(groups []Group, libs []Library) []string {
+	var problems []string
+	byName := map[string]int{}
+	numbers := map[int]string{}
+	for _, g := range groups {
+		where := fmt.Sprintf("group %q", g.Name)
+		if !strings.HasPrefix(g.Name, GroupPrefix) || !accountName.MatchString(g.Name) {
+			problems = append(problems, fmt.Sprintf("%s: a library's group is named %s<library>", where, GroupPrefix))
+		}
+		if g.GID <= 0 {
+			problems = append(problems, fmt.Sprintf("%s: gid %d, and a library's group is never root, nor a number "+
+				"below it (novox/hq ADR 0328 §15); nothing of this declaration was made", where, g.GID))
+		}
+		if _, twice := byName[g.Name]; twice {
+			problems = append(problems, where+": declared twice")
+		}
+		if other, used := numbers[g.GID]; used {
+			problems = append(problems, fmt.Sprintf("%s: gid %d is %s's too", where, g.GID, other))
+		}
+		byName[g.Name], numbers[g.GID] = g.GID, g.Name
+	}
+	seen := map[string]bool{}
+	for _, l := range libs {
+		where := fmt.Sprintf("library %q", l.Library)
+		switch {
+		case l.Library == "" || strings.ContainsAny(l.Library, "/ \t\n"):
+			problems = append(problems, where+": a library is named by one word")
+		case seen[l.Library]:
+			problems = append(problems, where+": declared twice")
+		}
+		seen[l.Library] = true
+		if !filepath.IsAbs(l.Root) || filepath.Clean(l.Root) != l.Root || l.Root == "/" {
+			problems = append(problems, fmt.Sprintf("%s: its root %q is not an absolute, clean path below /", where,
+				l.Root))
+		}
+		if gid, ok := byName[l.Group]; !ok || gid != l.GID {
+			problems = append(problems, fmt.Sprintf("%s: its group %s (gid %d) is not one this declaration makes",
+				where, l.Group, l.GID))
+		}
+		if l.Group != GroupPrefix+l.Library {
+			problems = append(problems, fmt.Sprintf("%s: its group is %s%s, and %s is not", where, GroupPrefix,
+				l.Library, l.Group))
+		}
+		for _, p := range l.Paths {
+			if p == "" || filepath.IsAbs(p) || filepath.Clean(p) != p || p == ".." || strings.HasPrefix(p, "../") {
+				problems = append(problems, fmt.Sprintf("%s: the path %q is not a clean path below its root", where, p))
+			}
+		}
+		if l.Runner != "" && !accountName.MatchString(l.Runner) {
+			problems = append(problems, fmt.Sprintf("%s: its runner %q is not an account's name", where, l.Runner))
+		}
+	}
+	for i, a := range libs {
+		for _, b := range libs[i+1:] {
+			if a.Root != "" && b.Root != "" && (a.Root == b.Root || strings.HasPrefix(a.Root, b.Root+"/") ||
+				strings.HasPrefix(b.Root, a.Root+"/")) {
+				problems = append(problems, fmt.Sprintf("library %q: its root and library %q's nest, and libraries "+
+					"never overlap (novox/hq ADR 0328 §13)", a.Library, b.Library))
+			}
+		}
+	}
+	return problems
+}
+
+// IdentityPrefix starts every module identity's name.
+const IdentityPrefix = "mesh-"
+
+// checkIdentities judges the identities on arrival: each named for its module, never root, and no name or number
+// twice — two modules with one account would write as each other.
+func checkIdentities(ids []Identity, groups []Group) []string {
+	var problems []string
+	names, uids := map[string]bool{}, map[int]string{}
+	libraryGroups := map[int]bool{}
+	for _, g := range groups {
+		libraryGroups[g.GID] = true
+	}
+	for _, id := range ids {
+		where := fmt.Sprintf("identity %q", id.Name)
+		if id.Module == "" || id.Name != IdentityPrefix+id.Module || !accountName.MatchString(id.Name) {
+			problems = append(problems, fmt.Sprintf("%s: a module's identity is named %s<module>, and this one is "+
+				"for the module %q", where, IdentityPrefix, id.Module))
+		}
+		if id.UID <= 0 || id.GID <= 0 {
+			problems = append(problems, fmt.Sprintf("%s: uid %d, gid %d, and a module's identity is never root, "+
+				"nor a number below it (novox/hq ADR 0328 §15); nothing of this declaration was made", where,
+				id.UID, id.GID))
+		}
+		if names[id.Name] {
+			problems = append(problems, where+": declared twice")
+		}
+		if other, used := uids[id.UID]; used {
+			problems = append(problems, fmt.Sprintf("%s: uid %d is %s's too", where, id.UID, other))
+		}
+		// Its primary group is its own (gid == uid) or a library's this declaration makes (ADR 0328 §4); so is
+		// every added group. A module's own number is never a library group's.
+		if id.GID != id.UID && !libraryGroups[id.GID] {
+			problems = append(problems, fmt.Sprintf("%s: its primary group gid %d is neither its own (%d) nor a "+
+				"library's this declaration makes", where, id.GID, id.UID))
+		}
+		if libraryGroups[id.UID] {
+			problems = append(problems, fmt.Sprintf("%s: uid %d is a library group's number too", where, id.UID))
+		}
+		for _, g := range id.Groups {
+			if !libraryGroups[g] {
+				problems = append(problems, fmt.Sprintf("%s: its added group gid %d is not a library's this "+
+					"declaration makes", where, g))
+			}
+		}
+		if id.Runner != "" && !accountName.MatchString(id.Runner) {
+			problems = append(problems, fmt.Sprintf("%s: its runner %q is not an account's name", where, id.Runner))
+		}
+		names[id.Name], uids[id.UID] = true, id.Name
+	}
+	return problems
 }
 
 // LeftOutModuleOf says which left-out module a recorded resource belongs to, if any: its id is the
@@ -1561,6 +1897,13 @@ type envelope struct {
 	// sends them only to a host whose reports say `reads_generation`.
 	Generation int64 `json:"generation,omitempty"`
 	PutBack    bool  `json:"put_back,omitempty"`
+	// Identities is optional on the wire too (novox/hq ADR 0325 §3, ADR 0328 §4). **An older host refuses this key**; a
+	// controller sends it only to a host whose health says link.IdentityContract.
+	Identities []Identity `json:"identities,omitempty"`
+	// Groups and Libraries are optional too (novox/hq ADR 0328). **An older host refuses these keys**; a controller
+	// sends them only to a host whose health says link.LibraryContract.
+	Groups    []Group   `json:"groups,omitempty"`
+	Libraries []Library `json:"libraries,omitempty"`
 }
 
 func parse(raw []byte, allowActions bool) (*Declaration, error) {
@@ -1578,8 +1921,10 @@ func parse(raw []byte, allowActions bool) (*Declaration, error) {
 	}
 
 	d := &Declaration{Version: env.Version, For: env.For, Adoption: env.Adoption, Sequence: env.Sequence,
-		Epoch: env.Epoch, LeftOut: env.LeftOut, Generation: env.Generation, PutBack: env.PutBack}
-	var problems []string
+		Epoch: env.Epoch, LeftOut: env.LeftOut, Generation: env.Generation, PutBack: env.PutBack,
+		Identities: env.Identities, Groups: env.Groups, Libraries: env.Libraries}
+	problems := checkIdentities(env.Identities, env.Groups)
+	problems = append(problems, checkLibraries(env.Groups, env.Libraries)...)
 	if env.Generation < 0 {
 		// Below zero would read as "none claimed" and pass every refusal of an older generation.
 		problems = append(problems, fmt.Sprintf("an assignment generation below zero (%d) is not one the "+
@@ -1732,6 +2077,10 @@ func checkWhileStopped(resources []Resource) []string {
 	return problems
 }
 
+// accountName is what an identity's or an access user's name may be: the portable account name the user tools
+// take, optionally ending in `$`, never starting with a dash — it is handed to them as an argument.
+var accountName = regexp.MustCompile(`^[A-Za-z0-9_.][A-Za-z0-9_.-]*\$?$`)
+
 func strictDecode(raw []byte, into any) error {
 	// DisallowUnknownFields is the whole point rather than strictness for its own sake: a
 	// field the host does not know is a thing the control plane believes it asked for.