Take every catalogued module's done key once at the start, beside the updates-only watch, so a key written or interrupted across a restart is registered (issue 1945)

cmd/mesh-controller/composed_keys.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"sort"
 	"strings"
 	"sync"
 	"time"
@@ -24,7 +25,7 @@ import (
 // carries the module's permissions at the new fingerprint: a new revision of the bus module's composition alone,
 // written into its want at once by the assigner), and writes `grants.<module>.<fp>`. The assigner's sixth and seventh
 // rules then let a want name the fingerprint. **No timer**: woken by the keys, and a starting controller looks at every
-// module once (B5's start pass).
+// module once (doneKeysAtStart).
 
 // doneKeySteps are what taking a module's done key in does, each a step a test may stand in for.
 type doneKeySteps struct {
@@ -261,4 +262,55 @@ func watchDoneKeys(ctx context.Context, open *stores) {
 		<-ctx.Done()
 		closeKeys()
 	}()
+	// And every module once now, after the watch is open so no write falls between the two.
+	inBackground(func() {
+		doneKeysAtStart(ctx, catalogedModules(open), func(module string) { takeDoneKeyAtStart(ctx, open, module) })
+	})
+}
+
+// doneKeysAtStart takes in the done key of every catalogued module once, one after another: the start's look the watch of
+// new writes cannot give (it hears updates only). A done key written while no controller served, or whose take-in the
+// controller this one replaced was stopped in, is taken here; without it the module stays in the node's own composition
+// with no credential until its keys are written again (issue 1945, live on 2026-10-25 at 02:34). A take-in with nothing
+// to do does nothing; a catalogue that cannot be read is said.
+func doneKeysAtStart(ctx context.Context, modules func(context.Context) ([]string, error), take func(module string)) {
+	names, err := modules(ctx)
+	if err != nil {
+		fmt.Printf("done keys: the modules are not looked at once at the start: %v\n", err)
+		return
+	}
+	sort.Strings(names)
+	for _, m := range names {
+		if ctx.Err() != nil {
+			return
+		}
+		take(m)
+	}
+}
+
+// takeDoneKeyAtStart is one take-in of the start's look, under the module's lock; one that fails is handed to takeDoneKey,
+// which tries again every doneKeyRetry, loudly, so a failing module never holds up the look at the others.
+func takeDoneKeyAtStart(ctx context.Context, open *stores, module string) {
+	mu, _ := doneKeysMu.LoadOrStore(module, &sync.Mutex{})
+	mu.(*sync.Mutex).Lock()
+	err := takeDoneKeyOnce(ctx, open, module)
+	mu.(*sync.Mutex).Unlock()
+	if err != nil && !errors.Is(err, errKeyWaits) {
+		inBackground(func() { takeDoneKey(ctx, open, module) })
+	}
+}
+
+// catalogedModules are the names of every module the catalogue holds.
+func catalogedModules(open *stores) func(context.Context) ([]string, error) {
+	return func(ctx context.Context) ([]string, error) {
+		entries, err := open.inventory.Catalogued(ctx)
+		if err != nil {
+			return nil, err
+		}
+		out := make([]string, 0, len(entries))
+		for _, e := range entries {
+			out = append(out, e.Manifest.Module)
+		}
+		return out, nil
+	}
 }