Merge fix/1121-holds-released: delivery 2 on the builds' new layout (issue 1121)

Delivery 2 deleted the move and chain_moved, so the layout of the builds under their modules is made by the controller's start (LayBuildsOut), recorded by the key layout.done in the builds bucket, retried every half minute with an urgent condition while it fails; the chain on the bus is refused until it exists. Its source readers use the module and pointer reads.

internal/inventory/builds.go

@@ -17,9 +17,11 @@ import (
 
 // Build is one attempt, whichever way it went.
 type Build struct {
-	ID         string
-	Repository string
-	Ref        string
+	ID string
+	// ManifestDigest names the manifest in the manifests bucket, when a chain keeps it apart from the record (issue 1121).
+	ManifestDigest string
+	Repository     string
+	Ref            string
 	// Module is empty for a build that failed before it knew what it was building.
 	Module string
 	Commit string

internal/inventory/builds_test.go

@@ -216,7 +216,7 @@ func TestABuildsBuildSourceComesBackOverWhatItRead(t *testing.T) {
 	if got := read["build-agent"]; len(got) != 1 || got[0].Paths != nil || got[0].Own {
 		t.Fatalf("a build that said no build source reads as %+v", got)
 	}
-	kept, found, err := inv.chain.Builds.Get(ctx, "said")
+	kept, found, err := inv.chain.Builds.Get(ctx, "route-proxy.build.said")
 	if err != nil || !found {
 		t.Fatalf("the build is not on the bus: %v %v", found, err)
 	}

internal/inventory/chain.go

@@ -29,6 +29,22 @@ type chainState struct {
 	// is not saved yet.
 	view    *rolloutView
 	pending map[string]pendingMerge
+	// requireLayout is set for a chain on the bus: its builds are read only once the controller's start has laid them out
+	// under their modules (issue 1121), and laid is that seen.
+	requireLayout, laid bool
+}
+
+// RequireLayout makes every read of the chain refuse (ErrNotLaidOut) until the builds are laid out under their modules.
+func (i *Inventory) RequireLayout() {
+	i.state.mu.Lock()
+	i.state.requireLayout = true
+	i.state.mu.Unlock()
+}
+
+func (i *Inventory) markLaidOut() {
+	i.state.mu.Lock()
+	i.state.laid = true
+	i.state.mu.Unlock()
 }
 
 // ChainOpener opens the chain on the bus when a process first needs it: a command that reads and never moved anything has
@@ -39,6 +55,7 @@ type ChainOpener func(ctx context.Context) (*chain.Chain, error)
 func (i *Inventory) UseChainOpener(open ChainOpener) {
 	i.state.mu.Lock()
 	i.state.open = open
+	i.state.requireLayout = true
 	i.state.mu.Unlock()
 }
 
@@ -61,19 +78,30 @@ func (i *Inventory) attached() *chain.Chain {
 	return i.chain
 }
 
-// theChain is the chain this inventory writes and reads, opened if a command has not yet.
+// theChain is the chain this inventory writes and reads, opened if a command has not yet. On the bus it is refused until the
+// builds are laid out under their modules.
 func (i *Inventory) theChain(ctx context.Context) (*chain.Chain, error) {
 	i.state.mu.Lock()
-	defer i.state.mu.Unlock()
 	if i.chain == nil && i.state.open != nil {
 		c, err := i.state.open(ctx)
 		if err != nil {
+			i.state.mu.Unlock()
 			return nil, fmt.Errorf("%w: %v", ErrNoChain, err)
 		}
 		i.chain = c
 	}
-	if i.chain == nil {
+	c, check := i.chain, i.state.requireLayout && !i.state.laid
+	i.state.mu.Unlock()
+	if c == nil {
 		return nil, ErrNoChain
 	}
-	return i.chain, nil
+	if check {
+		if _, found, err := c.Builds.GetRaw(ctx, chain.LayoutMarkerKey); err != nil {
+			return nil, err
+		} else if !found {
+			return nil, ErrNotLaidOut
+		}
+		i.markLaidOut()
+	}
+	return c, nil
 }

internal/inventory/chain_builds_layout_test.go

@@ -0,0 +1,428 @@
+package inventory
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"reflect"
+	"sort"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/chain"
+)
+
+// issue 1121: a build is under its module, so a lookup reads the keys it needs and no others.
+
+type readCounting struct {
+	chain.Backend
+	gets, watches atomic.Int32
+}
+
+func (r *readCounting) Get(ctx context.Context, key string) (chain.Entry, bool, error) {
+	r.gets.Add(1)
+	return r.Backend.Get(ctx, key)
+}
+
+func (r *readCounting) Watch(ctx context.Context) (<-chan chain.Entry, error) {
+	r.watches.Add(1)
+	return r.Backend.Watch(ctx)
+}
+
+func (r *readCounting) WatchFiltered(ctx context.Context, f string) (<-chan chain.Entry, error) {
+	r.watches.Add(1)
+	return r.Backend.WatchFiltered(ctx, f)
+}
+
+func layoutChain(builds chain.Backend) (*Inventory, *chain.Chain) {
+	c := chain.New(builds, chain.NewMemory(), chain.NewMemory(), func(context.Context) error { return nil }).
+		WithManifests(builds)
+	inv := &Inventory{state: &chainState{}}
+	inv.UseChain(c)
+	return inv, c
+}
+
+var layoutAt = time.Date(2026, 10, 18, 12, 0, 0, 0, time.UTC)
+
+func layoutBuild(module string, n int, commit, source string) Build {
+	return Build{ID: fmt.Sprintf("build-%d", n), Repository: "novox/" + module, Module: module, Commit: commit,
+		SourceFingerprint: source, ReuseKey: "v1:" + source, Made: []Artifact{{Name: module, Kind: "image", Reference: fmt.Sprintf("r/%s@sha256:%d", module, n)}},
+		Manifest: []byte(fmt.Sprintf(`{"module":%q,"n":%d}`, module, n)), At: layoutAt.Add(time.Duration(n) * time.Minute)}
+}
+
+func TestALookupOfOneModuleReadsThatModulesKeysOnly(t *testing.T) {
+	mem := chain.NewMemory()
+	inv, c := layoutChain(mem)
+	ctx := context.Background()
+	for n := 1; n <= 3; n++ {
+		for _, m := range []string{"alpha", "beta"} {
+			if err := inv.chainRecordBuild(ctx, c, layoutBuild(m, n, fmt.Sprintf("c%d", n), fmt.Sprintf("s%d", n))); err != nil {
+				t.Fatal(err)
+			}
+		}
+	}
+	got, err := inv.chainBuildList(ctx, c, "alpha", 10)
+	if err != nil || len(got) != 3 {
+		t.Fatalf("alpha's builds %+v: %v", got, err)
+	}
+	if want := map[string]int{"alpha.build.>": 1}; !reflect.DeepEqual(mem.Filtered(), want) {
+		t.Fatalf("the list of one module watched %v; want only %v", mem.Filtered(), want)
+	}
+	if _, err := inv.chainBuildFingerprints(ctx, c, "alpha"); err != nil {
+		t.Fatal(err)
+	}
+	for f := range mem.Filtered() {
+		if f != "alpha.build.>" && f != "alpha.commit.*" {
+			t.Errorf("a lookup of alpha watched %q", f)
+		}
+	}
+}
+
+func TestReuseBySourceFingerprintAndTheBuildOfACommitAreOneGet(t *testing.T) {
+	counting := &readCounting{Backend: chain.NewMemory()}
+	inv, c := layoutChain(counting)
+	ctx := context.Background()
+	for n := 1; n <= 20; n++ {
+		if err := inv.chainRecordBuild(ctx, c, layoutBuild("alpha", n, fmt.Sprintf("c%d", n), fmt.Sprintf("s%d", n))); err != nil {
+			t.Fatal(err)
+		}
+	}
+	counting.gets.Store(0)
+	counting.watches.Store(0)
+	id, err := inv.chainBuildOfSource(ctx, c, "alpha", "v1:s7")
+	if err != nil || id != "build-7" {
+		t.Fatalf("source s7 is %q: %v", id, err)
+	}
+	if counting.gets.Load() != 2 || counting.watches.Load() != 0 {
+		t.Fatalf("the reuse lookup made %d gets and %d watches; want 2 (the pointer, the record it names) and 0", counting.gets.Load(), counting.watches.Load())
+	}
+	counting.gets.Store(0)
+	if id, err = inv.chainBuildOf(ctx, c, "alpha", "c19"); err != nil || id != "build-19" {
+		t.Fatalf("commit c19 is %q: %v", id, err)
+	}
+	if counting.gets.Load() != 2 || counting.watches.Load() != 0 {
+		t.Fatalf("the build of a commit made %d gets and %d watches; want 2 and 0", counting.gets.Load(), counting.watches.Load())
+	}
+}
+
+func TestABuildWrittenIsFoundByCommitSourceIDAndRequest(t *testing.T) {
+	inv, c := layoutChain(chain.NewMemory())
+	ctx := context.Background()
+	ask := BuildRequest{ID: "build-5", Repository: "novox/alpha", Seat: "mesh-build-machine", At: layoutAt}
+	if err := inv.chainRecordBuildRequest(ctx, c, ask); err != nil {
+		t.Fatal(err)
+	}
+	if _, found, _ := inv.chainBuildByID(ctx, c, "build-5"); found {
+		t.Fatal("a request nobody answered was read as a build")
+	}
+	b := layoutBuild("alpha", 5, "c5", "s5")
+	if err := inv.chainRecordBuild(ctx, c, b); err != nil {
+		t.Fatal(err)
+	}
+	if id, _ := inv.chainBuildOf(ctx, c, "alpha", "c5"); id != "build-5" {
+		t.Errorf("by commit: %q", id)
+	}
+	if id, _ := inv.chainBuildOfSource(ctx, c, "alpha", "v1:s5"); id != "build-5" {
+		t.Errorf("by source: %q", id)
+	}
+	got, found, err := inv.chainBuildByID(ctx, c, "build-5")
+	if err != nil || !found || got.Module != "alpha" {
+		t.Fatalf("by id: %+v %v %v", got, found, err)
+	}
+	// The manifest is kept once, apart from the record, and read back whole.
+	raw, err := inv.chainManifestOf(ctx, c, "build-5")
+	if err != nil || !json.Valid(raw) || string(raw) != string(canonicalJSON(b.Manifest)) {
+		t.Fatalf("manifest %q: %v", raw, err)
+	}
+	k, _, _ := c.Builds.Get(ctx, "alpha.build.build-5")
+	if len(k.Value.Manifest) != 0 || k.Value.ManifestDigest == "" {
+		t.Errorf("the record keeps the manifest itself: %+v", k.Value)
+	}
+	if k.Value.Request == nil {
+		t.Error("the outcome lost the request it answers")
+	}
+	reqs, err := inv.chainRequests(ctx, c)
+	if err != nil || len(reqs) != 1 || !reqs[0].Heard || reqs[0].Module != "alpha" {
+		t.Fatalf("requests %+v: %v", reqs, err)
+	}
+}
+
+func legacyBuild(n int, module, commit string) chain.Build {
+	b := toChainBuild(layoutBuild(module, n, commit, "s"+commit))
+	return b
+}
+
+func keysOf(t *testing.T, mem chain.Backend) []string {
+	t.Helper()
+	keys, err := mem.Keys(context.Background())
+	if err != nil {
+		t.Fatal(err)
+	}
+	sort.Strings(keys)
+	return keys
+}
+
+// The layout of the bucket's keys is made once from the keys of before it: run again it changes nothing, the old keys stay,
+// and the pointers say the newest.
+func TestTheLayoutMigrationIsIdempotentAndKeepsTheOldKeys(t *testing.T) {
+	mem := chain.NewMemory()
+	inv, c := layoutChain(mem)
+	ctx := context.Background()
+	for n, m := range []string{"alpha", "alpha", "beta", "alpha"} {
+		old := legacyBuild(n+1, m, fmt.Sprintf("c%d", n+1))
+		if _, err := c.Builds.Create(ctx, old.ID, old); err != nil {
+			t.Fatal(err)
+		}
+	}
+	failed := legacyBuild(9, "alpha", "c9")
+	failed.Failed = "broke"
+	failed.SourceFingerprint = ""
+	if _, err := c.Builds.Create(ctx, failed.ID, failed); err != nil {
+		t.Fatal(err)
+	}
+	asked := chain.Build{ID: "build-10", State: chain.BuildAsked, Repository: "novox/alpha", Asked: layoutAt,
+		Request: &chain.Request{Repository: "novox/alpha", At: layoutAt}}
+	if _, err := c.Builds.Create(ctx, asked.ID, asked); err != nil {
+		t.Fatal(err)
+	}
+	first, err := inv.layoutBuilds(ctx, c, nil)
+	if err != nil || first.Written == 0 {
+		t.Fatalf("first run %+v: %v", first, err)
+	}
+	keys := keysOf(t, mem)
+	second, err := inv.layoutBuilds(ctx, c, nil)
+	if err != nil || second.Written != 0 {
+		t.Fatalf("second run %+v: %v", second, err)
+	}
+	if again := keysOf(t, mem); !reflect.DeepEqual(keys, again) {
+		t.Fatalf("keys changed on the second run:\n%v\n%v", keys, again)
+	}
+	has := func(k string) bool { return containsKey(keys, k) }
+	for _, k := range []string{"build-1", "build-9", "alpha.build.build-1", "alpha.build.build-4", "beta.build.build-3", "alpha.build.build-9", "req.build-10",
+		"id.build-3", "alpha.newest", "alpha.worked", "alpha.held", "alpha.commit.c4", "alpha.source.v1-sc4", "beta.worked"} {
+		if !has(k) {
+			t.Errorf("no key %s in %v", k, keys)
+		}
+	}
+	if e, _, _ := mem.Get(ctx, "alpha.newest"); string(e.Value) != "build-9" {
+		t.Errorf("alpha.newest = %q; want the failed build-9", e.Value)
+	}
+	if e, _, _ := mem.Get(ctx, "alpha.worked"); string(e.Value) != "build-4" {
+		t.Errorf("alpha.worked = %q; want build-4", e.Value)
+	}
+	if id, _ := inv.chainBuildOf(ctx, c, "alpha", "c4"); id != "build-4" {
+		t.Errorf("by commit after the layout: %q", id)
+	}
+	// No record is read from an old key.
+	list, err := inv.chainBuildList(ctx, c, "alpha", 10)
+	if err != nil || len(list) != 4 {
+		t.Fatalf("alpha's builds after the layout: %d %v", len(list), err)
+	}
+}
+
+func containsKey(s []string, k string) bool {
+	for _, x := range s {
+		if x == k {
+			return true
+		}
+	}
+	return false
+}
+
+// The manifest is kept once under its digest in the same bucket, and the moved record keeps none.
+func TestAMovedRecordHoldsNoManifestAndItsManifestIsUnderItsDigest(t *testing.T) {
+	mem := chain.NewMemory()
+	inv, c := layoutChain(mem)
+	ctx := context.Background()
+	old := legacyBuild(1, "alpha", "c1")
+	if _, err := c.Builds.Create(ctx, old.ID, old); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := inv.layoutBuilds(ctx, c, nil); err != nil {
+		t.Fatal(err)
+	}
+	k, found, err := c.Builds.Get(ctx, "alpha.build.build-1")
+	if err != nil || !found || len(k.Value.Manifest) != 0 || k.Value.ManifestDigest == "" {
+		t.Fatalf("moved record %+v %v %v", k.Value, found, err)
+	}
+	if !strings.HasPrefix(k.Value.ManifestDigest, "manifest.sha256-") {
+		t.Errorf("the digest %q is not a key under manifest.", k.Value.ManifestDigest)
+	}
+	e, found, _ := mem.Get(ctx, k.Value.ManifestDigest)
+	if !found || string(e.Value) != string(canonicalJSON([]byte(old.Manifest))) {
+		t.Errorf("the manifest under its digest is %q (found %v)", e.Value, found)
+	}
+	if got := chain.ManifestKey(e.Value); got != k.Value.ManifestDigest {
+		t.Errorf("the digest does not name the bytes: %s", got)
+	}
+}
+
+// A pointer is a hint: a record written without its pointers is found by reading the module's records, and the pointers are
+// repaired; a pointer that names a record that is not what it was for is not followed.
+func TestAMissingOrWrongPointerFallsBackToTheModulesRecordsAndIsRepaired(t *testing.T) {
+	mem := chain.NewMemory()
+	inv, c := layoutChain(mem)
+	ctx := context.Background()
+	for n := 1; n <= 3; n++ {
+		if err := inv.chainRecordBuild(ctx, c, layoutBuild("alpha", n, fmt.Sprintf("c%d", n), fmt.Sprintf("s%d", n))); err != nil {
+			t.Fatal(err)
+		}
+	}
+	// A record whose pointers the writer never made (a crash between the record and its pointers).
+	lost := toChainBuild(layoutBuild("alpha", 4, "c4", "s4"))
+	if _, err := c.Builds.Create(ctx, "alpha.build.build-4", lost); err != nil {
+		t.Fatal(err)
+	}
+	if id, err := inv.chainBuildOf(ctx, c, "alpha", "c4"); err != nil || id != "build-4" {
+		t.Fatalf("the build of c4 is %q: %v", id, err)
+	}
+	if e, found, _ := mem.Get(ctx, "alpha.commit.c4"); !found || pointedID(e.Value) != "build-4" {
+		t.Errorf("the commit pointer was not repaired: %q %v", e.Value, found)
+	}
+	if id, _ := inv.chainBuildOfSource(ctx, c, "alpha", "v1:s4"); id != "build-4" {
+		t.Errorf("the source pointer was not repaired: %q", id)
+	}
+	// A pointer to the wrong build is not followed.
+	e, _, _ := mem.Get(ctx, "alpha.commit.c2")
+	wrong, _ := json.Marshal(chain.CommitPointer{Build: "build-1"})
+	if _, err := mem.Update(ctx, "alpha.commit.c2", wrong, e.Revision); err != nil {
+		t.Fatal(err)
+	}
+	if id, err := inv.chainBuildOf(ctx, c, "alpha", "c2"); err != nil || id != "build-2" {
+		t.Fatalf("with a wrong pointer the build of c2 is %q: %v", id, err)
+	}
+	if e, _, _ := mem.Get(ctx, "alpha.commit.c2"); pointedID(e.Value) != "build-2" {
+		t.Errorf("the wrong pointer stayed: %s", e.Value)
+	}
+	// A commit nothing built is none.
+	if id, err := inv.chainBuildOf(ctx, c, "alpha", "nope"); err != nil || id != "" {
+		t.Errorf("an unbuilt commit is %q: %v", id, err)
+	}
+}
+
+type touchRecording struct {
+	chain.Backend
+	mu      sync.Mutex
+	touched []string
+}
+
+func (r *touchRecording) note(s string) { r.mu.Lock(); r.touched = append(r.touched, s); r.mu.Unlock() }
+func (r *touchRecording) Get(ctx context.Context, key string) (chain.Entry, bool, error) {
+	r.note("get " + key)
+	return r.Backend.Get(ctx, key)
+}
+func (r *touchRecording) Watch(ctx context.Context) (<-chan chain.Entry, error) {
+	r.note("watch >")
+	return r.Backend.Watch(ctx)
+}
+func (r *touchRecording) WatchFiltered(ctx context.Context, f string) (<-chan chain.Entry, error) {
+	r.note("watch " + f)
+	return r.Backend.WatchFiltered(ctx, f)
+}
+func (r *touchRecording) Keys(ctx context.Context) ([]string, error) {
+	r.note("keys")
+	return r.Backend.Keys(ctx)
+}
+
+// Once the layout is made, no read touches a key that is a build's id alone, or the bucket whole.
+func TestAfterTheLayoutNoReadTouchesABareBuildIDKey(t *testing.T) {
+	rec := &touchRecording{Backend: chain.NewMemory()}
+	inv, c := layoutChain(rec)
+	ctx := context.Background()
+	old := legacyBuild(1, "alpha", "c1")
+	if _, err := c.Builds.Create(ctx, old.ID, old); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := inv.layoutBuilds(ctx, c, nil); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.chainRecordBuild(ctx, c, layoutBuild("alpha", 2, "c2", "s2")); err != nil {
+		t.Fatal(err)
+	}
+	rec.mu.Lock()
+	rec.touched = nil
+	rec.mu.Unlock()
+	_, _ = inv.chainBuildList(ctx, c, "alpha", 5)
+	_, _ = inv.chainBuildList(ctx, c, "", 5)
+	_, _, _ = inv.chainBuildByID(ctx, c, "build-1")
+	_, _, _ = inv.chainBuildByID(ctx, c, "build-2")
+	_, _ = inv.chainBuildOf(ctx, c, "alpha", "c1")
+	_, _ = inv.chainBuildFingerprints(ctx, c, "alpha")
+	_, _ = inv.chainFingerprints(ctx, c)
+	_, _ = inv.chainManifestOf(ctx, c, "build-1")
+	_, _, _, _ = inv.chainManifestBuild(ctx, c, "alpha", "c1")
+	_, _ = chainBuilds(ctx, c)
+	_, _ = inv.chainRequests(ctx, c)
+	_, _ = inv.chainBuiltAgainst(ctx, c)
+	rec.mu.Lock()
+	defer rec.mu.Unlock()
+	for _, what := range rec.touched {
+		verb, key, _ := strings.Cut(what, " ")
+		if what == "keys" || what == "watch >" || what == "watch *" || (verb == "get" && !strings.Contains(key, ".")) {
+			t.Errorf("a read touched %q", what)
+		}
+	}
+}
+
+// A pointer follows the newest build, not the last write: two builds overlap and the older, asked first, finishes last.
+func TestAnOlderBuildFinishingLastLeavesThePointersOnTheNewer(t *testing.T) {
+	mem := chain.NewMemory()
+	inv, c := layoutChain(mem)
+	ctx := context.Background()
+	older := layoutBuild("alpha", 1, "c1", "s1")
+	older.Asked = layoutAt
+	older.At = layoutAt.Add(20 * time.Minute) // finished last
+	newer := layoutBuild("alpha", 2, "c1", "s2")
+	newer.Asked = layoutAt.Add(5 * time.Minute)
+	newer.At = layoutAt.Add(10 * time.Minute)
+	for _, b := range []Build{newer, older} {
+		if err := inv.chainRecordBuild(ctx, c, b); err != nil {
+			t.Fatal(err)
+		}
+	}
+	for _, key := range []string{"alpha.newest", "alpha.worked"} {
+		if e, _, _ := mem.Get(ctx, key); string(e.Value) != "build-2" {
+			t.Errorf("%s = %q; want the newer build-2", key, e.Value)
+		}
+	}
+	if e, _, _ := mem.Get(ctx, "alpha.commit.c1"); pointedID(e.Value) != "build-2" {
+		t.Errorf("the commit pointer = %s; want build-2", e.Value)
+	}
+	// The older build is still found by what only it has.
+	if id, _ := inv.chainBuildOfSource(ctx, c, "alpha", "v1:s1"); id != "build-1" {
+		t.Errorf("the older build's own reuse key finds %q", id)
+	}
+}
+
+// Nothing reads the chain on the bus until the controller's start has laid the builds out and written the marker; the layout
+// is done once.
+func TestTheChainIsRefusedUntilTheBuildsAreLaidOutAndTheLayoutIsDoneOnce(t *testing.T) {
+	mem := chain.NewMemory()
+	inv, c := layoutChain(mem)
+	inv.RequireLayout()
+	ctx := context.Background()
+	old := legacyBuild(1, "alpha", "c1")
+	if _, err := c.Builds.Create(ctx, old.ID, old); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := inv.theChain(ctx); !errors.Is(err, ErrNotLaidOut) {
+		t.Fatalf("a read before the layout answered %v", err)
+	}
+	if err := inv.LayBuildsOut(ctx, nil); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := inv.theChain(ctx); err != nil {
+		t.Fatalf("a read after the layout answered %v", err)
+	}
+	keys := keysOf(t, mem)
+	if !containsKey(keys, chain.LayoutMarkerKey) {
+		t.Fatalf("no marker among %v", keys)
+	}
+	if err := inv.LayBuildsOut(ctx, nil); err != nil || !reflect.DeepEqual(keys, keysOf(t, mem)) {
+		t.Fatalf("the second layout changed the bucket: %v", err)
+	}
+}

internal/inventory/chain_requests.go

@@ -35,7 +35,14 @@ func (i *Inventory) chainRecordBuildRequest(ctx context.Context, c *chain.Chain,
 	if a.At.IsZero() {
 		a.At = time.Now().UTC()
 	}
-	key := chainBuildKey(a.ID)
+	key := chain.RequestKey(a.ID)
+	// An outcome under a module that came first has no request beside it: the request is kept on it, and its own record says
+	// it was answered (issue 1121).
+	if ptr, found, err := c.Builds.GetRaw(ctx, chain.IDKey(a.ID)); err != nil {
+		return err
+	} else if found && string(ptr.Value) != chain.RequestPrefix {
+		return i.keepAnsweredRequest(ctx, c, string(ptr.Value), a)
+	}
 	for try := 0; try < casTries; try++ {
 		_, err := c.Builds.Create(ctx, key, askedRecord(a))
 		if err == nil {
@@ -65,8 +72,35 @@ func (i *Inventory) chainRecordBuildRequest(ctx context.Context, c *chain.Chain,
 	return fmt.Errorf("build request %s is not kept on the bus: it kept moving under the write", a.ID)
 }
 
+// keepAnsweredRequest puts a request on the outcome that answered it before the request was kept, and keeps the request's
+// own record as answered.
+func (i *Inventory) keepAnsweredRequest(ctx context.Context, c *chain.Chain, module string, a BuildRequest) error {
+	outKey := chain.BuildKey(module, a.ID)
+	for try := 0; try < casTries; try++ {
+		out, found, err := c.Builds.Get(ctx, outKey)
+		if err != nil || !found {
+			return err
+		}
+		if out.Value.Request == nil {
+			out.Value.Request = toRequest(a)
+			if _, err := c.Builds.Update(ctx, outKey, out.Value, out.Revision); errors.Is(err, chain.ErrMoved) {
+				continue
+			} else if err != nil {
+				return fmt.Errorf("build request %s is not kept on the bus: %w", a.ID, err)
+			}
+		}
+		rec := askedRecord(a)
+		rec.State, rec.Module, rec.Failed, rec.At = chain.BuildAnswered, module, out.Value.Failed, out.Value.At
+		if _, err := c.Builds.Create(ctx, chain.RequestKey(a.ID), rec); err != nil && !errors.Is(err, chain.ErrExists) {
+			return fmt.Errorf("build request %s is not kept on the bus: %w", a.ID, err)
+		}
+		return nil
+	}
+	return fmt.Errorf("build request %s is not kept: it kept moving under the write", a.ID)
+}
+
 func (i *Inventory) chainBuildRequestByID(ctx context.Context, c *chain.Chain, id string) (BuildRequest, bool, error) {
-	k, found, err := c.Builds.Get(ctx, chainBuildKey(id))
+	k, found, err := c.Builds.Get(ctx, chain.RequestKey(id))
 	if err != nil || !found || k.Value.Request == nil {
 		return BuildRequest{}, false, err
 	}
@@ -75,7 +109,7 @@ func (i *Inventory) chainBuildRequestByID(ctx context.Context, c *chain.Chain, i
 
 // chainMarkRequest changes a request that has no outcome yet, by compare-and-set; one answered, or none kept, is left.
 func (i *Inventory) chainMarkRequest(ctx context.Context, c *chain.Chain, id string, mark func(*chain.Request)) error {
-	key := chainBuildKey(id)
+	key := chain.RequestKey(id)
 	for try := 0; try < casTries; try++ {
 		cur, found, err := c.Builds.Get(ctx, key)
 		if err != nil || !found || cur.Value.State != chain.BuildAsked || cur.Value.Request == nil {
@@ -94,13 +128,14 @@ func (i *Inventory) chainMarkRequest(ctx context.Context, c *chain.Chain, id str
 // chainRequests is every request kept, newest first, each with its outcome where its build was heard. Requests older than
 // KeptFor are not listed: the bucket keeps them, and no reader needs them.
 func (i *Inventory) chainRequests(ctx context.Context, c *chain.Chain) ([]RequestOutcome, error) {
-	all, err := c.Builds.All(ctx)
+	all, err := requestRecords(ctx, c)
 	if err != nil {
-		return nil, fmt.Errorf("the builds cannot be read from the bus: %w", err)
+		return nil, err
 	}
 	oldest := time.Now().Add(-KeptFor)
 	var out []RequestOutcome
-	for id, k := range all {
+	for _, k := range all {
+		id := strings.TrimPrefix(k.Key, chain.RequestPrefix+".")
 		r := k.Value.Request
 		if r == nil || !r.At.After(oldest) {
 			continue
@@ -120,6 +155,11 @@ func (i *Inventory) chainRequests(ctx context.Context, c *chain.Chain) ([]Reques
 	return out, nil
 }
 
+// requestRecords are the records under `req.`: the requests, and the builds that knew no module.
+func requestRecords(ctx context.Context, c *chain.Chain) ([]chain.Kept[chain.Build], error) {
+	return buildsIn(ctx, c, chain.RequestPrefix+".*")
+}
+
 // RequestsToAskAgain are the requests the move found never handed over (issue 981 note 7 Q5), not yet asked again: each is
 // asked once, and never twice.
 func (i *Inventory) RequestsToAskAgain(ctx context.Context) ([]BuildRequest, error) {
@@ -127,12 +167,13 @@ func (i *Inventory) RequestsToAskAgain(ctx context.Context) ([]BuildRequest, err
 	if err != nil {
 		return nil, err
 	}
-	all, err := c.Builds.All(ctx)
+	all, err := requestRecords(ctx, c)
 	if err != nil {
 		return nil, err
 	}
 	var out []BuildRequest
-	for id, k := range all {
+	for _, k := range all {
+		id := strings.TrimPrefix(k.Key, chain.RequestPrefix+".")
 		if k.Value.State == chain.BuildAsked && k.Value.Request != nil && k.Value.Request.Reask == chain.ReaskPending {
 			out = append(out, fromRequest(id, *k.Value.Request))
 		}
@@ -148,12 +189,12 @@ func (i *Inventory) ClaimToAskAgain(ctx context.Context, id string) (bool, error
 	if err != nil {
 		return false, err
 	}
-	cur, found, err := c.Builds.Get(ctx, chainBuildKey(id))
+	cur, found, err := c.Builds.Get(ctx, chain.RequestKey(id))
 	if err != nil || !found || cur.Value.Request == nil || cur.Value.Request.Reask != chain.ReaskPending {
 		return false, err
 	}
 	cur.Value.Request.Reask = chain.ReaskClaimed
-	if _, err := c.Builds.Update(ctx, chainBuildKey(id), cur.Value, cur.Revision); err != nil {
+	if _, err := c.Builds.Update(ctx, chain.RequestKey(id), cur.Value, cur.Revision); err != nil {
 		if errors.Is(err, chain.ErrMoved) {
 			return false, nil
 		}

internal/inventory/chain_sent_copy_test.go

@@ -15,7 +15,7 @@ func TestWhatTheColumnRecordedIsCopiedOntoTheKeysAndOverwritesNothing(t *testing
 	inv, c := anInventoryOnTheChain(t)
 	ctx := t.Context()
 	at := time.Date(2026, 10, 18, 4, 0, 0, 0, time.UTC)
-	if _, err := c.Builds.Create(ctx, "b-wg", chain.Build{ID: "b-wg", Module: "mesh-wireguard", Commit: "c-wg"}); err != nil {
+	if err := inv.chainRecordBuild(ctx, c, Build{ID: "b-wg", Module: "mesh-wireguard", Commit: "c-wg"}); err != nil {
 		t.Fatal(err)
 	}
 	put := func(module string, a chain.Assignment) {

internal/inventory/chain_store_test.go

@@ -12,6 +12,7 @@ import (
 	"time"
 
 	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/chain"
 )
 
 // **Once builds are on the bus every reader of them reads the bucket** (issue 1090): a build recorded is the key of its
@@ -32,11 +33,11 @@ func TestBuildsOnTheBusAreReadBackByEveryReader(t *testing.T) {
 			t.Fatal(err)
 		}
 	}
-	kept, found, err := inv.chain.Builds.Get(ctx, "build-1")
+	kept, found, err := inv.chain.Builds.Get(ctx, chain.BuildKey("notes", "build-1"))
 	if err != nil || !found || kept.Value.ReuseKey != "rk-1" {
 		t.Fatalf("build-1 on the bus: %+v %v %v", kept.Value, found, err)
 	}
-	if history, _ := inv.chain.Builds.History(ctx, "build-1"); len(history) != 1 {
+	if history, _ := inv.chain.Builds.History(ctx, chain.BuildKey("notes", "build-1")); len(history) != 1 {
 		t.Fatalf("a build recorded twice has %d values", len(history))
 	}
 	list, err := inv.Builds(ctx, "notes", 10)
@@ -130,7 +131,7 @@ func TestARequestIsTheBuildInStateAskedAndItsOutcomeTakesItsPlace(t *testing.T)
 	if again, _, _ := inv.BuildRequestByID(ctx, "build-1"); again.NotAsked != "" {
 		t.Fatalf("an answered request was marked not asked: %+v", again)
 	}
-	if history, _ := inv.chain.Builds.History(ctx, "build-1"); len(history) != 3 {
+	if history, _ := inv.chain.Builds.History(ctx, chain.RequestKey("build-1")); len(history) != 3 {
 		// asked, marked unknown, answered.
 		t.Fatalf("the record has %d values", len(history))
 	}

internal/inventory/source.go

@@ -2,7 +2,8 @@ package inventory
 
 import (
 	"context"
-	"encoding/json"
+
+	"github.com/novox/mesh-controller/internal/chain"
 )
 
 // A build whose source is unchanged is never a move (novox/hq issue 280).
@@ -26,6 +27,7 @@ type sourceRow struct {
 	id, commit, fingerprint string
 	made                    []byte
 	manifest                []byte
+	manifestDigest          string
 	failedGate              bool
 }
 
@@ -69,6 +71,15 @@ func (i *Inventory) StandingBuild(ctx context.Context, module, build string) (st
 	for k, b := range builds {
 		if b.id == build {
 			s := builds[standing(builds, k)]
+			if len(s.manifest) == 0 && s.manifestDigest != "" {
+				// The manifest is kept apart from the record (issue 1121): one Get.
+				c, err := i.theChain(ctx)
+				if err != nil {
+					return "", nil, err
+				}
+				raw, err := manifestOfRecord(ctx, c, chain.Build{ID: s.id, ManifestDigest: s.manifestDigest})
+				return s.id, raw, err
+			}
 			return s.id, s.manifest, nil
 		}
 	}
@@ -78,59 +89,32 @@ func (i *Inventory) StandingBuild(ctx context.Context, module, build string) (st
 // SourceFingerprints is, per module, per commit, the source fingerprint of the newest successful build
 // from it that has one: module → commit → fingerprint. A commit whose builds carry none is absent.
 func (i *Inventory) SourceFingerprints(ctx context.Context) (map[string]map[string]string, error) {
-	all, _, err := i.sourceRows(ctx, "")
+	c, err := i.theChain(ctx)
 	if err != nil {
 		return nil, err
 	}
-	out := map[string]map[string]string{}
-	for m, builds := range all {
-		for _, b := range builds {
-			if b.fingerprint == "" || b.commit == "" {
-				continue
-			}
-			if out[m] == nil {
-				out[m] = map[string]string{}
-			}
-			if _, seen := out[m][b.commit]; !seen {
-				out[m][b.commit] = b.fingerprint
-			}
-		}
-	}
-	return out, nil
+	// Read from the commit pointers, which carry each commit's source fingerprint: no record is read (issue 1121).
+	return i.chainSourceFingerprints(ctx, c)
 }
 
 // BuildSourceFingerprints is SourceFingerprints for one module: commit → fingerprint.
 func (i *Inventory) BuildSourceFingerprints(ctx context.Context, module string) (map[string]string, error) {
-	all, err := i.SourceFingerprints(ctx)
+	c, err := i.theChain(ctx)
 	if err != nil {
 		return nil, err
 	}
-	if all[module] == nil {
-		return map[string]string{}, nil
-	}
-	return all[module], nil
+	// This module's commit pointers only (issue 1121).
+	return i.chainBuildSourceFingerprints(ctx, c, module)
 }
 
 // heldMade is, per module, what the build standing for its newest successful build made — what Held
 // answers (novox/hq issue 280).
 func (i *Inventory) heldMade(ctx context.Context) (map[string][]Artifact, error) {
-	all, _, err := i.sourceRows(ctx, "")
+	c, err := i.theChain(ctx)
 	if err != nil {
 		return nil, err
 	}
-	out := map[string][]Artifact{}
-	for m, builds := range all {
-		if len(builds) == 0 {
-			continue
-		}
-		var made []Artifact
-		if err := json.Unmarshal(builds[standing(builds, 0)].made, &made); err != nil {
-			// Skipped rather than fatal, as Held always did: the build that needs it says it is missing.
-			continue
-		}
-		out[m] = made
-	}
-	return out, nil
+	return i.chainHeldMade(ctx, c)
 }
 
 // SameSourceCommits is the commits of the builds in a build's run (novox/hq issue 280): the build and