A mesh seat's holder elsewhere answers before this machine's own provider (issue 258)

A mesh-wide provision a machine could answer itself was bound to the local provider, with the
seat's holder and any pin consulted only for a provider on another machine. With every machine
still running its own resolver, each bound its resolver configuration to itself while the mesh's
one resolver was held and pinned elsewhere.

internal/catalogue/resolve.go

@@ -341,7 +341,7 @@ func Resolve(catalogue map[string]Manifest, assigned []string, node Node, world
 		// trust boundary the moment both ends are containers**, and treating it as one gave the
 		// commonest arrangement of all — a service and its database on one node — the weakest
 		// handling, silently.
-		if satisfied[want] && !isModule(catalogue, want) {
+		if satisfied[want] && !isModule(catalogue, want) && !answeredElsewhere(want, node, world, brokered) {
 			here := func(name string) bool { return chosen[name] || assignedHere[name] }
 			local := providersHere(catalogue, here, want)
 			// Which of them it matters to choose between. A plain capability — a shell, a display
@@ -1134,3 +1134,28 @@ func machineReachRemedy(catalogue map[string]Manifest, want, node string) string
 	}
 	return fmt.Sprintf("assign one to %s: %s", node, strings.Join(named, "; "))
 }
+
+// answeredElsewhere says that a mesh-wide provision this machine could answer itself is answered by
+// another machine all the same: one this machine was pinned to, or the holder of the mesh seat that
+// delivers it (novox/hq ADR 0110, ADR 0194).
+//
+// **A provider on the machine was taken before either was asked.** The branch for a provision
+// answered here bound the consumer to the local provider and consulted a pin only between two local
+// ones, and the seat's holder never; both were read only for a provider on another machine. So when
+// every machine ran a provider of `wildcard-resolution` — each machine's own resolver, still assigned
+// while the mesh moved to one — every machine bound its resolver configuration to itself, with the
+// mesh's one resolver recorded, held and pinned (novox/hq issue 258). The seat is the mesh's choice of
+// who answers, made once; a provider that merely runs here does not overrule it, and neither does it
+// overrule a pin somebody set on this machine.
+//
+// Not in the first pass, which asks only what this machine offers and has no providers to read.
+func answeredElsewhere(want string, node Node, world World, brokered map[string]bool) bool {
+	if world.Unchecked || !brokered[want] {
+		return false
+	}
+	if c, pinned := world.Pinned[want]; pinned {
+		return c.Node != node.Name
+	}
+	holder, held := HolderAmong(want, world.Offered[want], world.Held)
+	return held && holder.Node != node.Name
+}

internal/catalogue/seat_answers_before_local_test.go

@@ -0,0 +1,67 @@
+package catalogue
+
+import "testing"
+
+// A mesh-wide provision whose seat is held on another machine is answered by that holder, even on a
+// machine that runs a provider of its own (novox/hq issue 258). Every machine ran its own resolver
+// while the mesh moved to one; each bound its resolver configuration to itself, with the mesh's
+// resolver held elsewhere and pinned.
+func resolverMesh() map[string]Manifest {
+	return map[string]Manifest{
+		"resolver": {Module: "resolver", Version: "1",
+			Provides: []Offer{{Name: "wildcard-resolution", Scope: ScopeMesh}},
+			Claims:   []Claim{{Name: "mesh-dns-resolver", Scope: ScopeMesh}}},
+		"asker": {Module: "asker", Version: "1", Requires: []string{"wildcard-resolution"}},
+	}
+}
+
+func resolverWorld(held string, pin *Chosen) World {
+	w := World{
+		Offered: map[string][]Provider{"wildcard-resolution": {
+			{Node: "anchor", At: "anchor.internal", Module: "resolver"},
+			{Node: "laptop", At: "laptop.internal", Module: "resolver"},
+		}},
+	}
+	// Held is who holds it across the mesh; Holdings is the same holder on record, which lets this
+	// machine's own claimant stand beside it (ADR 0131).
+	w.Held = []Held{{Claim: "mesh-dns-resolver", Scope: ScopeMesh, Node: held, Module: "resolver"}}
+	w.Holdings = w.Held
+	if pin != nil {
+		w.Pinned = map[string]Chosen{"wildcard-resolution": *pin}
+	}
+	return w
+}
+
+func answeredFrom(t *testing.T, world World) string {
+	t.Helper()
+	laptop := Node{Name: "laptop", At: "laptop.internal"}
+	got, err := Resolve(resolverMesh(), []string{"resolver", "asker"}, laptop, world)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, n := range got.Needs {
+		if n.Name == "wildcard-resolution" {
+			return n.From
+		}
+	}
+	t.Fatalf("no binding for wildcard-resolution: %+v", got.Needs)
+	return ""
+}
+
+func TestTheSeatsHolderElsewhereAnswersBeforeThisMachinesOwnProvider(t *testing.T) {
+	if from := answeredFrom(t, resolverWorld("anchor", nil)); from != "anchor" {
+		t.Fatalf("bound to %s; the seat is held on anchor", from)
+	}
+}
+
+func TestAPinElsewhereAnswersBeforeThisMachinesOwnProvider(t *testing.T) {
+	if from := answeredFrom(t, resolverWorld("laptop", &Chosen{Node: "anchor", Module: "resolver"})); from != "anchor" {
+		t.Fatalf("bound to %s; this machine was pinned to anchor", from)
+	}
+}
+
+func TestTheHolderOnThisMachineStillAnswersHere(t *testing.T) {
+	if from := answeredFrom(t, resolverWorld("laptop", nil)); from != "laptop" {
+		t.Fatalf("bound to %s; the seat is held here", from)
+	}
+}