Merge pull request 'Add issue 401's replay, written with what the controller had before its fix (hq issue 401)' (#274) from fix/401-replay into main

The fix's own test reads GivenOwnSecret, which the commit before does not have, so it cannot be laid over it. TestReplay401 asserts the same outcome with register, assign, planFor, declarationFor and the inventory's secret reads; it fails on 1e28342^1 and passes on main. Named in testdata/store-tests so a skip without the store fails the check. Replay for hq issue 401.

cmd/mesh-builder/Dockerfile

@@ -16,8 +16,7 @@ RUN CGO_ENABLED=0 go build -trimpath -ldflags '-s -w' -o /mesh-builder ./cmd/mes
 FROM ${ALPINE_BASE}
 # git to clone what it is asked to build, and the docker client to build and push it. The daemon
 # is the machine's, reached through its socket — a build machine shares the runtime it was given
-# rather than running one inside itself. xz to read an upstream release an archive is pinned to
-# (novox/hq ADR 0316): Go's standard library reads gzip and bzip2 and not xz.
-RUN apk add --no-cache git docker-cli xz
+# rather than running one inside itself.
+RUN apk add --no-cache git docker-cli
 COPY --from=build /mesh-builder /usr/local/bin/mesh-builder
 ENTRYPOINT ["/usr/local/bin/mesh-builder"]

cmd/mesh-controller/asker.go

@@ -117,13 +117,10 @@ type asked struct {
 	// Proposal is a settings layer proposed through a verb (proposals.go, novox/hq ADR 0277): about no
 	// condition, set on Approve by the serving controller itself, and left alone by the reconciling of conditions.
 	Proposal *settingsProposal `json:"proposal,omitempty"`
-	// Take is a shared folder the operator is asked to let the mesh keep (kept_folders.go, novox/hq ADR 0325 §8):
-	// about no condition, taken on Approve by the serving controller itself, asked once per folder and machine.
-	Take *folderTake `json:"take,omitempty"`
 }
 
 // ofACondition says an ask is one of a condition's: not a rehearsal, not a proposal.
-func (r asked) ofACondition() bool { return !r.Rehearsal && r.Proposal == nil && r.Take == nil }
+func (r asked) ofACondition() bool { return !r.Rehearsal && r.Proposal == nil }
 
 // partKey is an ask's place among what is asked: its condition and its part.
 func partKey(condition, part string) string { return condition + "#" + part }
@@ -195,11 +192,6 @@ type asker struct {
 	call func(ctx context.Context, a conditions.Action, args map[string]string) error
 	// setLayer sets a proposed settings layer on the operator's warrant (novox/hq ADR 0277); nil cannot.
 	setLayer setOnWarrant
-	// folders is every shared folder waiting to be kept (novox/hq ADR 0325 §8), and take what takes one on the
-	// operator's warrant; nil asks about none. machines are the mesh's machine names, allowed in an ask's words.
-	folders  func(ctx context.Context) ([]folderTake, error)
-	take     takeOnWarrant
-	machines func(ctx context.Context) ([]string, error)
 	// record writes the hand-act log.
 	record func(ctx context.Context, act link.HandAct) error
 	// routerRecord reads the router's record of an ask for a warrant missed; nil reads nothing.
@@ -562,10 +554,6 @@ func (a *asker) reconcile(ctx context.Context) error {
 			return err
 		}
 	}
-	// And every shared folder waiting to be kept, once per folder and machine (novox/hq ADR 0325 §8).
-	if err := a.askFolders(ctx); err != nil {
-		a.logf("the operator could not be asked about the folders waiting to be kept: %v", err)
-	}
 	why := "the router refused the ask"
 	if len(refusedWords) > 0 {
 		why += ": " + refusedWords[0]
@@ -830,7 +818,7 @@ func (a *asker) Decided(ctx context.Context, body []byte) error {
 	if err != nil {
 		return err
 	}
-	stillOpen := r.Rehearsal || r.Proposal != nil || r.Take != nil // a rehearsal, a proposal and a take are about no condition
+	stillOpen := r.Rehearsal || r.Proposal != nil // a rehearsal and a proposal are about no condition
 	for _, c := range open {
 		stillOpen = stillOpen || c.Key == r.Condition
 	}
@@ -888,15 +876,6 @@ func (a *asker) Decided(ctx context.Context, body []byte) error {
 		if acted == nil && outcome != "" && !strings.HasPrefix(outcome, "nothing") {
 			outcome = "done: " + outcome
 		}
-	case r.Take != nil && act.Verb == takeVerb:
-		// A shared folder taken on the operator's warrant (novox/hq ADR 0325 §8): the act is composed again from the
-		// record and held to what the option bound before the engine is asked.
-		outcome, acted = a.decideTake(ctx, *r, act, w)
-		if acted == nil {
-			outcome = "done: " + outcome
-		}
-	case r.Take != nil:
-		acted = fmt.Errorf("the take %s offers no act %s", r.ID, act.Verb)
 	case act.Arguments["silence"] != "":
 		acted = a.silence(ctx, act.Arguments["silence"], conditions.MaxSilence, byWords(w), why)
 	default:

cmd/mesh-controller/asker_wire.go

@@ -572,27 +572,6 @@ func servingAsker(open *stores, conn *nats.Conn, js jetstream.JetStream, keeper
 		call: callAction(conn),
 		// A proposed settings layer is set by this controller itself on the warrant (novox/hq ADR 0277).
 		setLayer: setLayerIn(open),
-		// A shared folder waiting to be kept is asked about once, and taken on the warrant (novox/hq ADR 0325 §8).
-		folders: foldersIn(open),
-		take: takeFolderIn(open, func(ctx context.Context, act link.AccessActAsk) (link.HandOverAnswer, error) {
-			ident, err := open.Identity(ctx)
-			if err != nil {
-				return link.HandOverAnswer{}, fmt.Errorf("the mesh's signing key cannot be read, so nothing was asked of "+
-					"%s: %w", act.Node, err)
-			}
-			return link.AskTake(ctx, conn, ident, act, link.TakeWithin)
-		}),
-		machines: func(ctx context.Context) ([]string, error) {
-			nodes, err := open.inventory.Nodes(ctx)
-			if err != nil {
-				return nil, err
-			}
-			names := make([]string, 0, len(nodes))
-			for _, n := range nodes {
-				names = append(names, n.Name)
-			}
-			return names, nil
-		},
 		record: func(ctx context.Context, act link.HandAct) error {
 			_, err := link.RecordHandAct(ctx, conn, act)
 			return err

cmd/mesh-controller/check.go

@@ -152,16 +152,6 @@ func moduleCheckFor(paths []string, longestMachine int, out io.Writer) error {
 		}
 	}
 
-	// **What ADR 0325 refuses once a module runs as its own identity is warned of until then** (novox/hq ADR 0325 §1–§3):
-	// a directory naming its owner, a container declaring no identity that mounts the module's own directory or a
-	// read-write access. Printed, never counted: every registered container module does one of them today, and the
-	// catalogues migrate against these lines. A module that declares identity is refused them instead (ParseManifest).
-	for _, name := range names {
-		for _, w := range catalogue.IdentityWarnings(shelf[name]) {
-			fmt.Fprintf(out, "warning: %s\n", w)
-		}
-	}
-
 	// **A file that asks for a setting and does not say whether it is trusted counts as trusted** (novox/hq issue
 	// 339): listed and counted, never refused, so an author can opt out a file nothing trusts.
 	unsaid := 0

cmd/mesh-controller/gate.go

@@ -154,10 +154,6 @@ type gateFacts struct {
 	// groupsAdded is, per module, whether the move judged puts an account in a group its previous build did
 	// not (issue 318 review): the only move whose wait for a new login is excused.
 	groupsAdded map[string]bool
-	// accessesChanged is, per module, whether the move judged changes its accesses (novox/hq ADR 0325): an access the
-	// engine cannot judge this look (unknown), or entries it left while a disk was away, of a module whose move leaves
-	// its accesses as they were is no fault of the move. A module absent here is taken to change them: judged as before.
-	accessesChanged map[string]bool
 	// waits is what the controller holds to check a module's wait for the operator (novox/hq ADR 0283): the
 	// manifest of each module's build judged, and the secrets given on each machine.
 	waits operatorWaitFacts
@@ -532,7 +528,6 @@ func judgeMoves(ctx context.Context, open *stores, g *inventory.PlanGate, pairs
 		return "", err
 	}
 	facts.groupsAdded = movesAddingGroups(ctx, open.inventory, g, pairs, shelf)
-	facts.accessesChanged = movesChangingAccesses(ctx, open.inventory, g, pairs, shelf)
 	facts.waits = gateWaitFacts(ctx, open.inventory, g, pairs, shelf, facts.health)
 	facts.sent = g.Sent
 	facts.commits, facts.sentBuilds = judgedCommits(g, pairs), map[string]map[string]string{}
@@ -788,50 +783,6 @@ func joinSaid(a, b string) string {
 	return a + "; " + b
 }
 
-// movesChangingAccesses is, per module a gate judges, whether its move changes its accesses — one added, dropped,
-// or given another use — read from the builds' manifests (novox/hq ADR 0325). A move not known changes them: an
-// access it cannot judge then holds the gate to its bound, and never passes unseen.
-func movesChangingAccesses(ctx context.Context, inv *inventory.Inventory, g *inventory.PlanGate, pairs []judged,
-	shelf map[string]catalogue.Manifest) map[string]bool {
-	out := map[string]bool{}
-	for _, j := range pairs {
-		if _, done := out[j.module]; done {
-			continue
-		}
-		from, to := g.From, g.To
-		for _, c := range g.Carried {
-			if c.Module == j.module {
-				from, to = c.From, c.To
-				break
-			}
-		}
-		target, found, err := inv.ManifestAt(ctx, j.module, to)
-		if err != nil || !found {
-			target = shelf[j.module]
-		}
-		before, had, err := inv.ManifestAt(ctx, j.module, from)
-		if from == "" || err != nil || !had {
-			out[j.module] = true
-			continue
-		}
-		out[j.module] = !sameAccesses(before.Accesses, target.Accesses)
-	}
-	return out
-}
-
-// sameAccesses says two manifests declare the same accesses, at the same use, in any order.
-func sameAccesses(a, b []catalogue.Access) bool {
-	key := func(as []catalogue.Access) string {
-		var out []string
-		for _, x := range as {
-			out = append(out, x.ID+"\x00"+x.Path+"\x00"+x.At())
-		}
-		sort.Strings(out)
-		return strings.Join(out, "\x01")
-	}
-	return key(a) == key(b)
-}
-
 // movesAddingGroups is, per module a gate judges, whether its move puts an account in a group the build it
 // moved from did not: read from the builds' manifests. A module whose move is not known adds none.
 func movesAddingGroups(ctx context.Context, inv *inventory.Inventory, g *inventory.PlanGate, pairs []judged,

cmd/mesh-controller/kept_folders.go

@@ -1,365 +0,0 @@
-package main
-
-// The mesh takes a shared folder that already holds data once, on the operator's word (novox/hq ADR 0325 §7, §8).
-//
-// **What waits.** A node-engine that keeps folders states an access waiting, naming it (inventory.Wait.Access), while
-// its folder is there and has not been taken; the controller excuses that wait only for a declared, placed folder not
-// yet taken (checkAccessWait), and the module is said as its needs-operator condition, in words with no path.
-//
-// **One ask per folder and machine.** The serving controller's asker asks the operator once for each such folder on
-// each machine — however many modules wait on it — at the level approve (ADR 0259), in the clause's words: "Let the
-// mesh keep <path> on <machine>, now for <modules>: …". It is kept in the controller's asks beside a proposal
-// (asked.Take), never a condition's: the condition is the module's, and two modules waiting on one folder are one
-// question. While it is open no second is asked; one that expired unanswered is asked again while the folder waits;
-// one about a folder that no longer waits is taken back. None is asked for a folder already taken, so a module that
-// joins a taken folder is asked nothing (its access wait is not excused, and its entries are added at apply).
-//
-// **On the warrant, and only on it**, the controller asks the machine's engine to take the folder (link.AskTake),
-// naming the access by its resource id and the warrant; the engine adds the entries of the users it was declared for
-// that folder. On its word that it started, the folder is recorded taken (kept_folder), and from the next send every
-// access to it says `taken`. Whether the filesystem must first allow ACLs is the engine's to see and set: its wait
-// does not say so to the controller, so the ask does not either.
-
-import (
-	"context"
-	"crypto/sha256"
-	"encoding/hex"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"path/filepath"
-	"sort"
-	"strings"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/asks"
-
-	"github.com/novox/mesh-controller/internal/conditions"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-	"github.com/novox/mesh-controller/internal/outward"
-)
-
-// folderTake is one folder the operator is asked to let the mesh keep, as the controller's ask keeps it
-// (asked.Take). Every field the ask is composed from is here, so the act on the warrant is composed from the record.
-type folderTake struct {
-	Node string `json:"node"`
-	Path string `json:"path"`
-	// Access is the resource id of one access to it in the machine's declaration: what the take act names.
-	Access string `json:"access"`
-	// Accesses are the access ids (each module's own) that place it, Modules the modules waiting on it, both sorted.
-	Accesses []string `json:"accesses"`
-	Modules  []string `json:"modules"`
-	// Placed is the filesystem the folder is on, as the engine names it without a path: the warrant is for that one.
-	Placed string    `json:"placed,omitempty"`
-	At     time.Time `json:"at"`
-}
-
-// takeVerb is the verb a take's answer binds: the controller's own, performed by itself on the warrant.
-const takeVerb = askerName + ".take"
-
-// key is the folder on its machine: what one ask is kept for.
-// The filesystem is part of it: a folder that moved to another disk is asked about again.
-func (t folderTake) key() string { return t.Node + "\x00" + filepath.Clean(t.Path) + "\x00" + t.Placed }
-
-// digest binds everything the take does and was said for: the machine, the folder, the access it names and the
-// modules the operator was told.
-func (t folderTake) digest() string {
-	raw, _ := json.Marshal(struct {
-		Node, Path, Access, Placed string
-		Modules                    []string
-	}{t.Node, filepath.Clean(t.Path), t.Access, t.Placed, t.Modules})
-	sum := sha256.Sum256(raw)
-	return "sha256:" + hex.EncodeToString(sum[:])
-}
-
-// actions is the take's one answer, at the level approve, binding the exact act through boundAct.
-func (t folderTake) actions(id string) []conditions.Action {
-	return []conditions.Action{{Label: "Let the mesh keep it", Verb: takeVerb, Machine: t.Node,
-		Level: conditions.LevelApprove, Arguments: map[string]string{"take": id, "node": t.Node,
-			"path": filepath.Clean(t.Path), "access": t.Access, "digest": t.digest()}}}
-}
-
-// takeWords is the clause's ask (ADR 0325 §8), with the folder as shown: "Let the mesh keep <path> on <machine>, now
-// for <modules>: …".
-func takeWords(shown, machine string, modules []string) string {
-	return fmt.Sprintf("Let the mesh keep %s on %s, now for %s: it adds their access entries, and those of any "+
-		"module given access later, to every folder and file there; the group bits `ls -l` shows become the "+
-		"entries' mask, and owners, groups and every other right stay as they are", shown, machine,
-		strings.Join(modules, ", "))
-}
-
-// ask is the take's ask, composed from it alone. The folder's path is said whole where the router's content rule
-// lets it leave the mesh, and otherwise named by the shared folder it is ("the shared folder movies"), which is the
-// access the module's wait names.
-func (t folderTake) ask(id string, machines []string) (asks.Ask, map[string]int) {
-	shown := filepath.Clean(t.Path)
-	if _, ok := outward.Check(shown, machines...); !ok {
-		shown = "the shared folder " + strings.Join(t.Accesses, ", ")
-	}
-	headline := fmt.Sprintf("Let the mesh keep a shared folder on %s?", t.Node)
-	if len([]rune(headline)) > asks.HeadlineLength {
-		headline = "Let the mesh keep a shared folder?"
-	}
-	explanation := takeWords(shown, t.Node, t.Modules) + "."
-	if _, ok := outward.Check(explanation, machines...); !ok {
-		explanation = sayable(explanation, machines)
-	}
-	q := asks.Ask{ID: id, Headline: headline, Explanation: explanation,
-		Who: asks.Operator, Expires: t.At.Add(askApproveFor),
-		OnExpiry: "nothing is changed, and you are asked again while the folder waits", About: "take." + t.Node}
-	options := map[string]int{}
-	for i, act := range t.actions(id) {
-		binds, _ := asks.ActDigest(boundAct(act))
-		oid := optionID(act.Label)
-		options[oid] = i
-		q.Options = append(q.Options, asks.Option{ID: oid, Label: act.Label, Level: asks.Level(act.Level), Binds: binds,
-			Does: "the mesh adds the access entries there, and keeps them from then on without asking"})
-	}
-	return q, options
-}
-
-// takeOnWarrant performs a take the operator approved: the engine is asked, and the folder recorded taken on its
-// word. It answers what the engine said.
-type takeOnWarrant func(ctx context.Context, t folderTake, askID, by string) (string, error)
-
-// askFolders asks the operator about every folder waiting to be kept that is not asked about yet, and takes back an
-// open ask about one that no longer waits. Called at the end of each reconcile, after the conditions' asks, within
-// the asks the router holds open at once.
-func (a *asker) askFolders(ctx context.Context) error {
-	if a.folders == nil {
-		return nil
-	}
-	wanted, err := a.folders(ctx)
-	if err != nil {
-		return err
-	}
-	now := a.now()
-	all, err := a.store.All(ctx)
-	if err != nil {
-		return err
-	}
-	open, openNow := map[string]asked{}, 0
-	for _, r := range all {
-		if r.State != askOpen || !now.Before(r.Ask.Expires) {
-			continue
-		}
-		openNow++
-		if r.Take != nil {
-			open[r.Take.key()] = r
-		}
-	}
-	want := map[string]bool{}
-	for _, t := range wanted {
-		want[t.key()] = true
-	}
-	for key, r := range open {
-		if !want[key] {
-			if err := a.cancel(ctx, r, "the folder no longer waits to be kept"); err != nil {
-				return err
-			}
-			openNow--
-		}
-	}
-	var machines []string
-	if a.machines != nil {
-		if machines, err = a.machines(ctx); err != nil {
-			return err
-		}
-	}
-	for _, t := range wanted {
-		if _, asking := open[t.key()]; asking {
-			continue // one ask per folder and machine (§8)
-		}
-		if openNow >= askMostOpen {
-			return nil // asked when one of the open ones ends
-		}
-		t.At = now
-		id := newAskID()
-		q, options := t.ask(id, machines)
-		if err := q.Check(now); err != nil {
-			a.logf("the operator could not be asked to let the mesh keep a folder on %s: %v", t.Node, err)
-			continue
-		}
-		body, err := json.Marshal(q)
-		if err != nil {
-			return err
-		}
-		take := t
-		if err := a.store.Create(ctx, asked{ID: id, Condition: q.About, Ask: q, Actions: t.actions(id),
-			Options: options, State: askOpen, Opened: now, Take: &take}); err != nil {
-			return fmt.Errorf("the take could not be kept in the controller's asks, so it was not asked: %w", err)
-		}
-		if err := a.publish(ctx, asks.AskSubject(askerName), body, "ask."+id); err != nil {
-			_, _ = a.store.Change(ctx, id, func(x *asked) bool {
-				if x.State != askOpen || x.Acted != "" {
-					return false
-				}
-				x.State, x.Ended, x.Acted = askUnsent, a.now(), "nothing: it could not be published: "+err.Error()
-				return true
-			})
-			a.logf("the operator could not be asked to let the mesh keep a folder on %s: %v", t.Node, err)
-			continue
-		}
-		openNow++
-		a.logf("asked the operator to let the mesh keep a folder on %s for %s (%s)", t.Node,
-			strings.Join(t.Modules, ", "), id)
-	}
-	return nil
-}
-
-// decideTake is what the asker does with a warrant for a take (asker.Decided): the act only when it is the one the
-// option bound — composed again from the record, the users' digest among it — and then the engine is asked.
-func (a *asker) decideTake(ctx context.Context, r asked, act conditions.Action, w asks.Warrant) (string, error) {
-	t := *r.Take
-	recomposed := t.actions(r.ID)
-	option, offered := r.Ask.Option(w.Option)
-	if !offered || len(recomposed) != 1 {
-		return "", fmt.Errorf("the take %s offers no answer %q: nothing is taken", r.ID, w.Option)
-	}
-	if err := option.Performs(boundAct(recomposed[0])); err != nil {
-		return "", fmt.Errorf("the take kept for %s is not the one the operator was shown: %v", r.ID, err)
-	}
-	if err := option.Performs(boundAct(act)); err != nil {
-		return "", fmt.Errorf("the act chosen for %s is not the one the operator was shown: %v", r.ID, err)
-	}
-	if a.take == nil {
-		return "", errors.New("this controller cannot take a folder on a warrant")
-	}
-	by := fmt.Sprintf("approved by %s via %s at %s (ask %s)", byWords(w), viaWords(w),
-		w.At.Local().Format("2006-01-02 15:04"), r.ID)
-	return a.take(ctx, t, r.ID, by)
-}
-
-// takeFolderIn is takeOnWarrant on this controller's stores and bus: the engine is asked with the mesh's key, naming the
-// ask the warrant answered; on its word that it started, the folder is recorded taken. A refusal records nothing.
-func takeFolderIn(open *stores, ask func(ctx context.Context, act link.AccessActAsk) (link.HandOverAnswer, error)) takeOnWarrant {
-	return func(ctx context.Context, t folderTake, askID, by string) (string, error) {
-		// Who asked, as one short line the engine takes (at most link.MaxHandOverBy): the ask names the rest.
-		short := by
-		if len(short) > 180 {
-			short = "the operator, on the warrant for ask " + askID
-		}
-		answer, err := ask(ctx, link.AccessActAsk{Node: t.Node, Path: filepath.Clean(t.Path), By: short,
-			Access: t.Access, Warrant: askID})
-		if err != nil {
-			return "", err
-		}
-		if answer.Refused != "" {
-			return "", fmt.Errorf("%s refused to take the folder: %s", t.Node, answer.Refused)
-		}
-		if err := open.inventory.RecordTaken(ctx, t.Node, inventory.TakenFolder{Path: t.Path, By: by, Ask: askID,
-			Warrant: askID, Said: answer.Said, Placed: t.Placed}); err != nil {
-			return "", fmt.Errorf("%s started the take (%s), and it could NOT be recorded: %w", t.Node, answer.Said, err)
-		}
-		return fmt.Sprintf("%s takes the folder for %s: %s", t.Node, strings.Join(t.Modules, ", "), answer.Said), nil
-	}
-}
-
-// waitingFolder is one access wait excused for a folder not yet taken, as foldersWaiting gathers them.
-type waitingFolder struct {
-	module, access string
-	// resource is the access's resource id on the machine, as the engine stated it; placed the filesystem its folder
-	// is on, without its path.
-	resource, placed string
-}
-
-// foldersWaiting is every folder waiting to be kept across the mesh (ADR 0325 §7, §8): from each machine's newest
-// statement, each access wait of a module that is excused (checkWaiting) and waits for the operator's word rather
-// than for a disk, grouped by machine and folder.
-func foldersWaiting(ctx context.Context, inv *inventory.Inventory, healths map[string]inventory.NodeHealth) (
-	map[string]map[string][]waitingFolder, operatorWaitFacts) {
-	var f operatorWaitFacts
-	out := map[string]map[string][]waitingFolder{}
-	machines := make([]string, 0, len(healths))
-	for m := range healths {
-		machines = append(machines, m)
-	}
-	sort.Strings(machines)
-	for _, machine := range machines {
-		rs := healths[machine].Resources
-		var modules []string
-		for _, r := range rs {
-			for _, w := range r.Waits {
-				if r.State == link.StateWaiting && w.Access != "" && !w.Disk {
-					modules = append(modules, r.Module)
-				}
-			}
-		}
-		if len(modules) == 0 {
-			continue
-		}
-		readWaitFacts(ctx, inv, machine, modules, nil, &f)
-		for _, r := range checkWaiting(machine, rs, f) {
-			if r.State != link.StateWaiting {
-				continue
-			}
-			for _, w := range r.Waits {
-				if w.Access == "" || w.Disk {
-					continue
-				}
-				path, placed := f.placed[r.Module+"@"+machine][w.Access]
-				if !placed {
-					continue
-				}
-				if out[machine] == nil {
-					out[machine] = map[string][]waitingFolder{}
-				}
-				out[machine][path] = append(out[machine][path], waitingFolder{module: r.Module, access: w.Access,
-					resource: r.Resource, placed: w.Placed})
-			}
-		}
-	}
-	return out, f
-}
-
-// foldersIn is the asker's folders on this controller's stores: every folder waiting to be kept, each with the
-// modules waiting on it and the access the take names (the first waiting module's, by its resource id). Who the
-// take adds entries for is what the engine was declared for that folder: the ask names the modules.
-func foldersIn(open *stores) func(ctx context.Context) ([]folderTake, error) {
-	return func(ctx context.Context) ([]folderTake, error) {
-		healths, err := open.inventory.Healths(ctx)
-		if err != nil {
-			return nil, err
-		}
-		waiting, _ := foldersWaiting(ctx, open.inventory, healths)
-		return takesOf(waiting), nil
-	}
-}
-
-// takesOf is one take per machine and folder from the waits gathered, sorted.
-func takesOf(waiting map[string]map[string][]waitingFolder) []folderTake {
-	var out []folderTake
-	for machine, folders := range waiting {
-		for path, all := range folders {
-			// One take per filesystem the waits name: they agree but for a moment while a disk is swapped.
-			byPlaced := map[string][]waitingFolder{}
-			for _, w := range all {
-				byPlaced[w.placed] = append(byPlaced[w.placed], w)
-			}
-			for placed, ws := range byPlaced {
-				t := folderTake{Node: machine, Path: path, Placed: placed}
-				seenM, seenA := map[string]bool{}, map[string]bool{}
-				var resources []string
-				for _, w := range ws {
-					if !seenM[w.module] {
-						seenM[w.module] = true
-						t.Modules = append(t.Modules, w.module)
-					}
-					if !seenA[w.access] {
-						seenA[w.access] = true
-						t.Accesses = append(t.Accesses, w.access)
-					}
-					resources = append(resources, w.resource)
-				}
-				sort.Strings(t.Modules)
-				sort.Strings(t.Accesses)
-				sort.Strings(resources)
-				t.Access = resources[0]
-				out = append(out, t)
-			}
-		}
-	}
-	sort.Slice(out, func(i, j int) bool { return out[i].key() < out[j].key() })
-	return out
-}

cmd/mesh-controller/kept_folders_test.go

@@ -1,461 +0,0 @@
-package main
-
-import (
-	"context"
-	"crypto/ed25519"
-	"encoding/json"
-	"errors"
-	"strings"
-	"testing"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/asks"
-
-	"github.com/novox/mesh-controller/internal/catalogue"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// novox/hq ADR 0325 §7 and §8 on the controller's side: an access wait is excused only for a declared, placed folder
-// not yet taken, or one whose disk is not there; the gate passes it as a wait for a person and the operator reads it
-// as needs-operator in words with no path; the operator is asked once per folder and machine, never about a folder
-// taken; and the folder is taken only on the warrant.
-
-var radarrManifest = catalogue.Manifest{Module: "radarr", Version: "1",
-	Accesses: []catalogue.Access{{ID: "movies", Path: "/services/media/movies", Mode: catalogue.AccessReadWrite}}}
-
-var plexManifest = catalogue.Manifest{Module: "plex", Version: "1",
-	Accesses: []catalogue.Access{{ID: "films", Path: "/services/media/movies", Mode: catalogue.AccessRead}}}
-
-const moviesAt = "/storage/media/movies"
-
-func keepWait(access string) inventory.Wait {
-	return inventory.Wait{Part: "radarr", Access: access, What: "let the mesh keep the shared folder " + access}
-}
-
-func placedWait(access, placed string) inventory.Wait {
-	w := keepWait(access)
-	w.Placed = placed
-	return w
-}
-
-func diskWait(access string) inventory.Wait {
-	return inventory.Wait{Part: "radarr", Access: access, Disk: true, What: "mount the disk that holds " + access}
-}
-
-// accessFacts is the facts with each folder given taken on the filesystem fs-000000000001.
-func accessFacts(taken ...string) operatorWaitFacts {
-	kept := map[string]string{}
-	for _, p := range taken {
-		kept[p] = "fs-000000000001"
-	}
-	return operatorWaitFacts{
-		manifests: map[string]catalogue.Manifest{"radarr": radarrManifest, "plex": plexManifest},
-		given:     map[string]map[string]time.Time{"radarr@ace": {}, "plex@ace": {}},
-		placed: map[string]map[string]string{"radarr@ace": {"movies": moviesAt}, "plex@ace": {"films": moviesAt},
-			"radarr@novox": {}},
-		taken: map[string]map[string]string{"ace": kept},
-	}
-}
-
-// Row 7: excused for a declared, placed folder not yet taken, and for an absent folder whose disk is not there (taken
-// or not); judged unhealthy when undeclared, unplaced, already taken, or naming a secret beside it. That a folder is
-// root's is the engine's to see: it states that unhealthy and never waiting (§12).
-func TestAnAccessWaitIsExcusedOnlyForAFolderTheMeshMayNotKeepYet(t *testing.T) {
-	for _, c := range []struct {
-		name    string
-		machine string
-		w       inventory.Wait
-		f       operatorWaitFacts
-		says    string
-	}{
-		{"declared, placed, not taken", "ace", keepWait("movies"), accessFacts(), ""},
-		{"its disk not there", "ace", diskWait("movies"), accessFacts(), ""},
-		{"its disk not there, the folder taken before", "ace", diskWait("movies"), accessFacts(moviesAt), ""},
-		{"already taken", "ace", keepWait("movies"), accessFacts(moviesAt), "taken on ace already"},
-		{"already taken on the filesystem it is on", "ace", placedWait("movies", "fs-000000000001"),
-			accessFacts(moviesAt), "taken on ace already"},
-		{"taken on another filesystem: it moved, and is asked about again", "ace",
-			placedWait("movies", "fs-0000000000ff"), accessFacts(moviesAt), ""},
-		{"undeclared", "ace", keepWait("books"), accessFacts(), "does not declare"},
-		{"unplaced", "novox", keepWait("movies"), accessFacts(), "not placed on novox"},
-		{"taken folders unread", "ace", keepWait("movies"), operatorWaitFacts{manifests: accessFacts().manifests,
-			placed: accessFacts().placed}, "could not be read"},
-		{"an access and a secret", "ace", inventory.Wait{Part: "p", Access: "movies", Secret: "x", What: "w"},
-			accessFacts(), "one secret or one setting, or one access"},
-	} {
-		err := checkWait("radarr", c.machine, c.w, c.f)
-		switch {
-		case c.says == "" && err != nil:
-			t.Errorf("%s: refused: %v", c.name, err)
-		case c.says != "" && (err == nil || !strings.Contains(err.Error(), c.says)):
-			t.Errorf("%s: %v; want a refusal saying %q", c.name, err, c.says)
-		}
-	}
-}
-
-func accessWaiting(module, access string, w inventory.Wait) inventory.ResourceHealth {
-	return inventory.ResourceHealth{Module: module, Resource: module + "." + catalogue.AccessID("/services/media/movies"),
-		Kind: "access", Target: moviesAt, State: link.StateWaiting, Waits: []inventory.Wait{w}}
-}
-
-// Row 7, the gate and the condition: both excused waits pass the first-node gate as a wait for a person, and the
-// module is said as needs-operator — in words that carry no path.
-func TestAnAccessWaitPassesTheGateAndAsksForTheOperatorWithoutAPath(t *testing.T) {
-	now := time.Now()
-	for _, w := range []inventory.Wait{keepWait("movies"), diskWait("movies")} {
-		w.What += " at " + moviesAt // an engine's words carrying a path never reach the operator's
-		f := gateFacts{now: now, waits: accessFacts(), groupsAdded: map[string]bool{"radarr": false},
-			health: map[string]inventory.NodeHealth{"ace": {Node: "ace", HeardAt: now,
-				Resources: []inventory.ResourceHealth{accessWaiting("radarr", "movies", w)}}}}
-		h, why := moduleHealthWord("radarr", "ace", now.Add(-time.Minute), f)
-		if h != healthPerson || !strings.Contains(why, "waits for the operator") {
-			t.Fatalf("an excused access wait reads %v %q; want a wait for a person", h, why)
-		}
-		if strings.Contains(why, "/") {
-			t.Errorf("the gate's verdict carries a path: %q", why)
-		}
-		o := needsOperatorObservation("radarr", "ace", []inventory.Wait{w}, nil)
-		if o.Kind != kindNeedsOperator {
-			t.Fatalf("raised as %s", o.Kind)
-		}
-		for _, words := range []string{o.Summary, o.Headline, o.Explanation, o.Needs} {
-			if strings.Contains(words, "/") {
-				t.Errorf("the operator reads a path: %q", words)
-			}
-		}
-		want := "let the mesh keep the shared folder movies on ace when you are asked"
-		if w.Disk {
-			want = "mount the disk that holds movies on ace"
-		}
-		if !strings.Contains(o.Needs, want) {
-			t.Errorf("needs-operator asks %q; want %q", o.Needs, want)
-		}
-	}
-	// Taken already: not excused, and the gate does not pass it.
-	f := gateFacts{now: now, waits: accessFacts(moviesAt), groupsAdded: map[string]bool{"radarr": false},
-		health: map[string]inventory.NodeHealth{"ace": {Node: "ace", HeardAt: now,
-			Resources: []inventory.ResourceHealth{accessWaiting("radarr", "movies", keepWait("movies"))}}}}
-	if h, why := moduleHealthWord("radarr", "ace", now.Add(-time.Minute), f); h != healthNotYet ||
-		!strings.Contains(why, "taken") {
-		t.Fatalf("a wait on a taken folder reads %v %q", h, why)
-	}
-}
-
-// The engine's access-waits are kept as waits naming the access, and its words tell a disk from a keep.
-func TestTheEnginesAccessWaitsAreReadAsWaits(t *testing.T) {
-	for what, disk := range map[string]bool{"let the mesh keep the shared folder movies": false,
-		"mount the disk that holds books": true} {
-		if got := (link.AccessWait{Kind: link.WaitKindAccess, Access: "movies", Part: "radarr", What: what}).WaitsForDisk(); got != disk {
-			t.Errorf("%q waits for a disk: %v", what, got)
-		}
-	}
-}
-
-// waitingOn is foldersWaiting's gathering for one folder: the given modules waiting on it by their access.
-func waitingOn(machine string, ws ...waitingFolder) map[string]map[string][]waitingFolder {
-	return map[string]map[string][]waitingFolder{machine: {moviesAt: ws}}
-}
-
-func takeRig(t *testing.T, waiting func() map[string]map[string][]waitingFolder) (*askerRig, *[]string) {
-	r := newAskerRig(t)
-	var taken []string
-	r.a.folders = func(context.Context) ([]folderTake, error) { return takesOf(waiting()), nil }
-	r.a.machines = func(context.Context) ([]string, error) { return []string{"ace", "novox"}, nil }
-	r.a.take = func(_ context.Context, ft folderTake, askID, by string) (string, error) {
-		taken = append(taken, ft.Node+" "+ft.Path+" "+ft.Access+" "+askID+" "+by)
-		return "taking", nil
-	}
-	return r, &taken
-}
-
-func takeAsks(r *askerRig) []asked {
-	var out []asked
-	for _, a := range r.store {
-		if a.Take != nil {
-			out = append(out, a)
-		}
-	}
-	return out
-}
-
-// Row 8, the controller's part: one ask per folder and machine however many modules wait on it, in the clause's
-// words; none again while it is open; taken back when the folder no longer waits; none for a folder taken (its waits
-// are not excused, so it is never gathered).
-func TestTheOperatorIsAskedOncePerFolderAndMachine(t *testing.T) {
-	both := waitingOn("ace",
-		waitingFolder{module: "radarr", access: "movies", resource: "radarr.access-services/media/movies"},
-		waitingFolder{module: "plex", access: "films", resource: "plex.access-services/media/movies"})
-	current := both
-	r, _ := takeRig(t, func() map[string]map[string][]waitingFolder { return current })
-	ctx := context.Background()
-	for i := 0; i < 3; i++ {
-		if err := r.a.reconcile(ctx); err != nil {
-			t.Fatal(err)
-		}
-	}
-	kept := takeAsks(r)
-	if len(kept) != 1 {
-		t.Fatalf("%d asks for one folder on one machine", len(kept))
-	}
-	q := kept[0].Ask
-	if err := q.Check(r.now); err != nil {
-		t.Fatal(err)
-	}
-	if q.Highest() != asks.Approve || len(q.Options) != 1 {
-		t.Fatalf("the ask offers %+v; want one answer at approve", q.Options)
-	}
-	// The path may not leave the mesh (the router's content rule): the folder is named by the shared folder it is.
-	want := "Let the mesh keep the shared folder films, movies on ace, now for plex, radarr: it adds their access " +
-		"entries, and those of any module given access later, to every folder and file there; the group bits `ls -l` " +
-		"shows become the entries' mask, and owners, groups and every other right stay as they are."
-	if q.Explanation != want {
-		t.Errorf("the ask says\n %q\nwant\n %q", q.Explanation, want)
-	}
-	if kept[0].Take.Access != "plex.access-services/media/movies" {
-		t.Errorf("the take names %q", kept[0].Take.Access)
-	}
-
-	// The folder no longer waits (taken, or no module uses it): the open ask is taken back, and nothing is asked.
-	current = nil
-	if err := r.a.reconcile(ctx); err != nil {
-		t.Fatal(err)
-	}
-	if got := takeAsks(r); len(got) != 1 || got[0].State != askCancelled {
-		t.Fatalf("the ask about a folder that no longer waits: %+v", got)
-	}
-	if err := r.a.reconcile(ctx); err != nil {
-		t.Fatal(err)
-	}
-	if len(takeAsks(r)) != 1 {
-		t.Fatal("asked about a folder nothing waits on")
-	}
-	// A module joining a folder already taken is never gathered: its wait is not excused.
-	f := accessFacts(moviesAt)
-	if err := checkWait("radarr", "ace", keepWait("movies"), f); err == nil {
-		t.Fatal("a wait on a taken folder was excused, and would have been asked about")
-	}
-}
-
-// Row 8: nothing is taken without the operator's warrant — an ask that ends without a choice, a warrant for another
-// ask, or an act other than the one the option bound takes nothing; the warrant takes it once.
-func TestAFolderIsTakenOnlyOnTheWarrant(t *testing.T) {
-	r, taken := takeRig(t, func() map[string]map[string][]waitingFolder {
-		return waitingOn("ace", waitingFolder{module: "radarr", access: "movies", resource: "radarr.access-movies"})
-	})
-	ctx := context.Background()
-	if err := r.a.reconcile(ctx); err != nil {
-		t.Fatal(err)
-	}
-	a := takeAsks(r)[0]
-	if len(*taken) != 0 {
-		t.Fatal("taken before any warrant")
-	}
-	// A warrant for another asker's ask.
-	other := warrantOn(a, "let-the-mesh-keep-it", r.now)
-	other.Asker = "someone-else"
-	answerWith(t, r, other)
-	// The record changed after the ask: the act no longer the one bound.
-	changed := r.store[a.ID]
-	changed.Take = &folderTake{Node: "ace", Path: "/", Access: "radarr.access-movies", Modules: a.Take.Modules}
-	r.store[a.ID] = changed
-	answerWith(t, r, warrantOn(a, "let-the-mesh-keep-it", r.now))
-	if len(*taken) != 0 || !strings.HasPrefix(r.store[a.ID].Acted, "failed") {
-		t.Fatalf("a take whose record changed after the ask: %v, %q", *taken, r.store[a.ID].Acted)
-	}
-
-	// Asked afresh, and the ask expires unanswered: nothing.
-	r2, taken2 := takeRig(t, func() map[string]map[string][]waitingFolder {
-		return waitingOn("ace", waitingFolder{module: "radarr", access: "movies", resource: "radarr.access-movies"})
-	})
-	if err := r2.a.reconcile(ctx); err != nil {
-		t.Fatal(err)
-	}
-	b := takeAsks(r2)[0]
-	expired := asks.Warrant{Ask: b.ID, Asker: "mesh-controller", Outcome: asks.OutcomeExpired, At: r2.now}
-	answerWith(t, r2, expired)
-	if len(*taken2) != 0 {
-		t.Fatal("taken on an ask that expired")
-	}
-
-	// The warrant: taken once, naming the access, the ask as the warrant, and who approved.
-	r3, taken3 := takeRig(t, func() map[string]map[string][]waitingFolder {
-		return waitingOn("ace", waitingFolder{module: "radarr", access: "movies", resource: "radarr.access-movies"})
-	})
-	if err := r3.a.reconcile(ctx); err != nil {
-		t.Fatal(err)
-	}
-	c := takeAsks(r3)[0]
-	w := warrantOn(c, "let-the-mesh-keep-it", r3.now)
-	answerWith(t, r3, w)
-	answerWith(t, r3, w)
-	if len(*taken3) != 1 || !strings.Contains((*taken3)[0], "ace "+moviesAt+" radarr.access-movies "+c.ID) ||
-		!strings.Contains((*taken3)[0], "telegram") {
-		t.Fatalf("the warrant took %v", *taken3)
-	}
-	if !strings.HasPrefix(r3.store[c.ID].Acted, "done") {
-		t.Fatalf("the take was recorded %q", r3.store[c.ID].Acted)
-	}
-}
-
-// The engine is asked only on a warrant, and the ask carries it: one with no warrant is never signed.
-func TestATakeAskCarriesItsWarrantAndIsSigned(t *testing.T) {
-	_, key, _ := ed25519.GenerateKey(nil)
-	signer := keySigner{key}
-	ask := link.AccessActAsk{Node: "ace", Path: moviesAt, By: "the operator", Access: "radarr.access-services/media/movies"}
-	if _, err := link.SignTake(context.Background(), signer, ask); err == nil {
-		t.Fatal("a take with no warrant was signed")
-	}
-	ask.Warrant = "c0123456789abcdef"
-	body, err := link.SignTake(context.Background(), signer, ask)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var signed link.SignedHandOver
-	if err := json.Unmarshal(body, &signed); err != nil {
-		t.Fatal(err)
-	}
-	if !ed25519.Verify(key.Public().(ed25519.PublicKey), append([]byte(link.AccessActContext), signed.Ask...), signed.Signature) {
-		t.Fatal("the take is not signed over its own context")
-	}
-	var got map[string]any
-	if err := json.Unmarshal(signed.Ask, &got); err != nil {
-		t.Fatal(err)
-	}
-	if got["act"] != "take" || got["warrant"] != "c0123456789abcdef" || got["access"] != ask.Access ||
-		got["path"] != moviesAt || got["nonce"] == "" {
-		t.Fatalf("the ask carries %v", got)
-	}
-	// And the controller records it taken only on the engine's word.
-	refusing := takeFolderIn(nil, func(context.Context, link.AccessActAsk) (link.HandOverAnswer, error) {
-		return link.HandOverAnswer{Refused: "the disk that holds the folder is not there"}, nil
-	})
-	if _, err := refusing(context.Background(), folderTake{Node: "ace", Path: moviesAt}, "c01", "the operator"); err == nil {
-		t.Fatal("a refused take was answered as done")
-	}
-	unreachable := takeFolderIn(nil, func(context.Context, link.AccessActAsk) (link.HandOverAnswer, error) {
-		return link.HandOverAnswer{}, errors.New("nothing on ace answers")
-	})
-	if _, err := unreachable(context.Background(), folderTake{Node: "ace", Path: moviesAt}, "c01", "the operator"); err == nil {
-		t.Fatal("an unanswered take was answered as done")
-	}
-}
-
-type keySigner struct{ key ed25519.PrivateKey }
-
-func (s keySigner) Sign(_ context.Context, b []byte) ([]byte, error) {
-	return ed25519.Sign(s.key, b), nil
-}
-
-// The envelope carries `identities` only when composed — for an engine at link.IdentityContract — and an older
-// engine's body is what it was.
-func TestTheDeclarationSaysItsIdentitiesOnlyWhenComposed(t *testing.T) {
-	older, err := sendable{Resources: []map[string]any{{"id": "a"}}}.Body()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if strings.Contains(string(older), "identities") {
-		t.Fatalf("an older engine's body names identities: %s", older)
-	}
-	newer, err := sendable{Resources: []map[string]any{{"id": "a"}}, Identities: []map[string]any{
-		{"module": "radarr", "name": "mesh-radarr", "uid": 50000, "gid": 50000}}}.Body()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !strings.Contains(string(newer), `"identities":[{"gid":50000,"module":"radarr","name":"mesh-radarr","uid":50000}]`) {
-		t.Fatalf("the body: %s", newer)
-	}
-	if link.IdentityContract != 5 {
-		t.Fatalf("the contract the engine states for ADR 0325 is 5, and this controller reads %d", link.IdentityContract)
-	}
-}
-
-// A folder that moved to another filesystem is asked about again: one ask per folder, machine and filesystem, and the
-// take records the filesystem it was for.
-func TestAFolderThatMovedIsAskedAboutAgain(t *testing.T) {
-	placed := "fs-000000000001"
-	r, taken := takeRig(t, func() map[string]map[string][]waitingFolder {
-		return waitingOn("ace", waitingFolder{module: "radarr", access: "movies", resource: "radarr.access-movies",
-			placed: placed})
-	})
-	ctx := context.Background()
-	if err := r.a.reconcile(ctx); err != nil {
-		t.Fatal(err)
-	}
-	placed = "fs-0000000000ff"
-	if err := r.a.reconcile(ctx); err != nil {
-		t.Fatal(err)
-	}
-	var open []asked
-	for _, a := range takeAsks(r) {
-		if a.State == askOpen {
-			open = append(open, a)
-		}
-	}
-	if len(open) != 1 || open[0].Take.Placed != "fs-0000000000ff" || len(takeAsks(r)) != 2 {
-		t.Fatalf("after the folder moved: %d asks, open %+v", len(takeAsks(r)), open)
-	}
-	answerWith(t, r, warrantOn(open[0], "let-the-mesh-keep-it", r.now))
-	if len(*taken) != 1 {
-		t.Fatalf("taken %v", *taken)
-	}
-}
-
-// The mesh's entries left while a disk was away (kind kept-entries), stated before the send, do not hold a delivery
-// that did not bring them; stated since, they do — and they may name an access no longer declared.
-func TestEntriesLeftWhileADiskWasAwayDoNotHoldADeliveryThatDidNotBringThem(t *testing.T) {
-	now := time.Now()
-	since := now.Add(-time.Minute)
-	left := inventory.ResourceHealth{Module: "radarr", Resource: "radarr.access-gone~entries", Kind: link.KindKeptEntries,
-		Target: moviesAt, State: link.StateUnhealthy, Reason: "the mesh's entries could not be taken out: its disk is away",
-		Since: since.Add(-time.Hour)}
-	f := gateFacts{now: now, waits: accessFacts(), groupsAdded: map[string]bool{"radarr": false},
-		health: map[string]inventory.NodeHealth{"ace": {Node: "ace", HeardAt: now,
-			Resources: []inventory.ResourceHealth{left}}}}
-	if h, why := moduleHealthWord("radarr", "ace", since, f); h != healthPerson || !strings.Contains(why, "access-gone~entries") {
-		t.Fatalf("entries left before the send read %v %q; want carried in a passing verdict", h, why)
-	}
-	left.Since = now
-	f.health["ace"] = inventory.NodeHealth{Node: "ace", HeardAt: now, Resources: []inventory.ResourceHealth{left}}
-	if h, _ := moduleHealthWord("radarr", "ace", since, f); h != healthNotYet {
-		t.Fatalf("entries left by this send read %v; want judged unhealthy", h)
-	}
-}
-
-// An access the engine reports unknown (its filesystem could not be named this look) carries no wait: of a module
-// whose move leaves its accesses as they were it is pre-existing and not counted; of one whose move changes them, or
-// whose move is not known, it is not yet healthy — held to the gate's bound, never waited on for ever. Entries left
-// while a disk was away follow the same rule whenever they were stated.
-func TestAnUnknownAccessAndLeftEntriesAreJudgedByWhetherTheMoveChangesAccesses(t *testing.T) {
-	now := time.Now()
-	since := now.Add(-time.Minute)
-	unknown := inventory.ResourceHealth{Module: "radarr", Resource: "radarr.access-movies", Kind: link.KindAccess,
-		Target: moviesAt, State: link.StateUnknown, Since: now}
-	left := inventory.ResourceHealth{Module: "radarr", Resource: "radarr.access-gone~entries", Kind: link.KindKeptEntries,
-		Target: moviesAt, State: link.StateUnhealthy, Since: now}
-	facts := func(changes map[string]bool, rs ...inventory.ResourceHealth) gateFacts {
-		return gateFacts{now: now, waits: accessFacts(), groupsAdded: map[string]bool{"radarr": false},
-			accessesChanged: changes, health: map[string]inventory.NodeHealth{"ace": {Node: "ace", HeardAt: now,
-				Resources: rs}}}
-	}
-	unchanged := map[string]bool{"radarr": false}
-	if h, why := moduleHealthWord("radarr", "ace", since, facts(unchanged, unknown)); h != healthGood {
-		t.Errorf("an unknown access of a move that leaves accesses as they were reads %v %q; want not counted", h, why)
-	}
-	for name, changes := range map[string]map[string]bool{"changes them": {"radarr": true}, "not known": nil} {
-		if h, _ := moduleHealthWord("radarr", "ace", since, facts(changes, unknown)); h != healthNotYet {
-			t.Errorf("an unknown access of a move that %s reads %v; want not yet, held to the bound", name, h)
-		}
-	}
-	if h, why := moduleHealthWord("radarr", "ace", since, facts(unchanged, left)); h != healthPerson ||
-		!strings.Contains(why, "access-gone~entries") {
-		t.Errorf("entries left, a move that leaves accesses as they were: %v %q; want carried", h, why)
-	}
-	if h, _ := moduleHealthWord("radarr", "ace", since, facts(map[string]bool{"radarr": true}, left)); h != healthNotYet {
-		t.Errorf("entries left since the send by a move that changes accesses read %v", h)
-	}
-	if !sameAccesses(radarrManifest.Accesses, []catalogue.Access{{ID: "movies", Path: "/services/media/movies",
-		Mode: catalogue.AccessReadWrite}}) || sameAccesses(radarrManifest.Accesses, plexManifest.Accesses) {
-		t.Error("sameAccesses does not tell a changed access from an unchanged one")
-	}
-}

cmd/mesh-controller/module_health.go

@@ -77,12 +77,6 @@ func stateHealth(ctx context.Context, inv *inventory.Inventory, k *conditions.Ke
 		for _, w := range r.Waits {
 			kept.Waits = append(kept.Waits, inventory.Wait{Part: w.Part, Secret: w.Secret, Setting: w.Setting, What: w.What})
 		}
-		// An access's waits (novox/hq ADR 0325 §7), kept beside the others as one more thing the operator gives: the
-		// access by its module's id, and whether it waits for a disk rather than for the operator's word.
-		for _, w := range r.AccessWaits {
-			kept.Waits = append(kept.Waits, inventory.Wait{Part: w.Part, Access: w.Access, Disk: w.WaitsForDisk(),
-				Placed: w.Placed, What: w.What})
-		}
 		resources = append(resources, kept)
 	}
 	// **A wait for the operator is checked before it is excused** (novox/hq ADR 0283): a waiting resource whose
@@ -650,7 +644,7 @@ func moduleHealthWord(module, machine string, since time.Time, f gateFacts) (hea
 	if waits && !f.groupsAdded[module] {
 		waits = false
 	}
-	var found, onWaiting, leftover []string
+	var found, onWaiting []string
 	var forOperator []inventory.Wait
 	for _, r := range resources {
 		if r.Module != module {
@@ -673,23 +667,6 @@ func moduleHealthWord(module, machine string, since time.Time, f gateFacts) (hea
 			found = append(found, r.Resource)
 			continue
 		}
-		// **The mesh's entries left on a folder whose disk was away are a condition this build found** when its move
-		// leaves the module's accesses as they were, or they were stated before this send (novox/hq ADR 0325 §8): they
-		// may name an access no longer declared, they wait for the disk, and a delivery that did not bring them is not
-		// held for them — said in the verdict, as a directory used as found is. Otherwise they are judged unhealthy.
-		changed, known := f.accessesChanged[module]
-		changes := !known || changed
-		if r.Kind == link.KindKeptEntries && r.State == link.StateUnhealthy && (!changes || r.Since.Before(since)) {
-			leftover = append(leftover, r.Resource)
-			continue
-		}
-		// **An access the engine could not judge this look** (its filesystem could not be named — a hung mount) carries
-		// no wait. Of a module whose move leaves its accesses as they were it is a condition the move found, not
-		// counted; of one whose move changes them it is not yet healthy, held to the gate's bound like anything still
-		// unsettled, so the gate fails safe at the bound and never waits for ever.
-		if r.Kind == link.KindAccess && r.State == link.StateUnknown && !changes {
-			continue
-		}
 		switch r.State {
 		case link.StateHealthy:
 		case link.StateStarting:
@@ -713,7 +690,7 @@ func moduleHealthWord(module, machine string, since time.Time, f gateFacts) (hea
 				reasonAfter(r.Reason))
 		}
 	}
-	if waits || len(found) > 0 || len(forOperator) > 0 || len(onWaiting) > 0 || len(leftover) > 0 {
+	if waits || len(found) > 0 || len(forOperator) > 0 || len(onWaiting) > 0 {
 		said := onWaiting
 		if waits {
 			said = append(said, wait)
@@ -725,10 +702,6 @@ func moduleHealthWord(module, machine string, since time.Time, f gateFacts) (hea
 			said = append(said, fmt.Sprintf("on %s, %s uses %s as found and waits for the operator to hand it over "+
 				"(`nox node hand-over %s <directory>` on the control-node)", machine, module, strings.Join(found, ", "), machine))
 		}
-		if len(leftover) > 0 {
-			said = append(said, fmt.Sprintf("on %s, the mesh's entries %s could not be taken out while their disk was "+
-				"away, stated before this send: they are taken out when it is back", machine, strings.Join(leftover, ", ")))
-		}
 		return healthPerson, strings.Join(said, "; ")
 	}
 	return healthGood, ""

cmd/mesh-controller/modules.go

@@ -487,15 +487,6 @@ func settingsCommand(ctx context.Context, args []string) error {
 		if err := inv.SetSettingsBy(ctx, *node, positionals[0], values, setByWords()); err != nil {
 			return err
 		}
-		// An owner a placement names is warned of (novox/hq ADR 0325 §1): accepted while registered modules still
-		// name one, refused once they have moved.
-		if shelf, err := inv.Catalogue(ctx); err == nil {
-			if m, known := shelf[positionals[0]]; known {
-				for _, w := range catalogue.PlacesOwnerWarnings(m, []catalogue.Layer{{From: where, Values: values}}) {
-					fmt.Println(w)
-				}
-			}
-		}
 		fmt.Printf("%s on %s:\n", positionals[0], where)
 		if len(added)+len(changed)+len(removed) == 0 {
 			fmt.Println("  nothing changed")

cmd/mesh-controller/operator_wait.go

@@ -44,12 +44,6 @@ func needsOperatorKey(module, node string) string {
 type operatorWaitFacts struct {
 	manifests map[string]catalogue.Manifest
 	given     map[string]map[string]time.Time
-	// placed is, per "<module>@<machine>", where each access of the module is on that machine, by id (novox/hq ADR
-	// 0325 §7); taken is, per machine, every folder the operator let the mesh keep there, with the filesystem it was
-	// taken on (empty when the engine named none). A machine absent from taken could not be read, and no access wait
-	// of it is excused.
-	placed map[string]map[string]string
-	taken  map[string]map[string]string
 }
 
 // checkWait is nil when a wait is excused, and otherwise why not, in words. Pure.
@@ -58,17 +52,9 @@ func checkWait(module, machine string, w inventory.Wait, f operatorWaitFacts) er
 	if !known {
 		return fmt.Errorf("says it waits for %s, and the mesh holds no manifest of %s to check it against", waitNames(w), module)
 	}
-	named := 0
-	for _, n := range []string{w.Secret, w.Setting, w.Access} {
-		if n != "" {
-			named++
-		}
-	}
 	switch {
-	case named != 1:
-		return fmt.Errorf("says it waits, naming %s, where a wait names one secret or one setting, or one access", waitNames(w))
-	case w.Access != "":
-		return checkAccessWait(module, machine, m, w, f)
+	case w.Secret != "" && w.Setting != "", w.Secret == "" && w.Setting == "":
+		return fmt.Errorf("says it waits, naming %s, where a wait names one secret or one setting", waitNames(w))
 	case w.Setting != "":
 		if _, declared := m.Settings[w.Setting]; !declared {
 			return fmt.Errorf("says it waits for the setting %s, which %s does not declare", w.Setting, module)
@@ -94,41 +80,6 @@ func checkWait(module, machine string, w inventory.Wait, f operatorWaitFacts) er
 	return nil
 }
 
-// checkAccessWait is nil when an access wait is excused (novox/hq ADR 0325 §7): the module's manifest declares the
-// access, its folder is placed on that machine, and either the folder is absent and its disk is not there (§9), or
-// it has not yet been taken under the operator's warrant (§8). That a folder that is there is not owned by root or a
-// root group is the node-engine's to see: it states such an access unhealthy and never waiting (§12). Any other
-// access wait is judged unhealthy, saying why: a module that gains an access to a folder already taken is given its
-// entries without a wait.
-func checkAccessWait(module, machine string, m catalogue.Manifest, w inventory.Wait, f operatorWaitFacts) error {
-	declared := false
-	for _, a := range m.Accesses {
-		declared = declared || a.ID == w.Access
-	}
-	if !declared {
-		return fmt.Errorf("says it waits for the access %s, which %s does not declare", w.Access, module)
-	}
-	path, placed := f.placed[module+"@"+machine][w.Access]
-	if !placed {
-		return fmt.Errorf("says it waits for the access %s, which is not placed on %s", w.Access, machine)
-	}
-	if w.Disk {
-		return nil
-	}
-	taken, readable := f.taken[machine]
-	if !readable {
-		return fmt.Errorf("says it waits for the access %s, and which folders are taken on %s could not be read",
-			w.Access, machine)
-	}
-	// A folder taken on another filesystem than the one it is on now (it moved to another disk) is not taken by that
-	// warrant: the wait is excused, and the operator is asked again (ADR 0325 §8).
-	if on, was := taken[path]; was && (w.Placed == "" || on == w.Placed) {
-		return fmt.Errorf("says it waits for the access %s, whose folder is taken on %s already: a module that gains "+
-			"an access to a taken folder is given its entries without a wait", w.Access, machine)
-	}
-	return nil
-}
-
 // waitRefusedPrefix opens every reason checkWait gives, so the words of a refused wait are told from a check's own.
 const waitRefusedPrefix = "says it waits"
 
@@ -137,10 +88,6 @@ func waitNames(w inventory.Wait) string {
 	switch {
 	case w.Secret != "" && w.Setting != "":
 		return "the secret " + w.Secret + " and the setting " + w.Setting
-	case w.Access != "" && (w.Secret != "" || w.Setting != ""):
-		return "the access " + w.Access + " and a secret or a setting"
-	case w.Access != "":
-		return "the access " + w.Access
 	case w.Secret != "":
 		return "the secret " + w.Secret
 	case w.Setting != "":
@@ -200,14 +147,6 @@ func operatorWaitSaid(module, machine string, waits []inventory.Wait) string {
 	var parts []string
 	for _, w := range waits {
 		part := fmt.Sprintf("%s (%s", w.What, waitNames(w))
-		// An access in the controller's own words, never the engine's: words with no path (novox/hq ADR 0325 §7).
-		switch {
-		case w.Access != "" && w.Disk:
-			part = fmt.Sprintf("the disk that holds %s mounted (%s", w.Access, waitNames(w))
-		case w.Access != "":
-			part = fmt.Sprintf("leave to keep the shared folder %s (%s, asked of you once for the folder", w.Access,
-				waitNames(w))
-		}
 		if w.Secret != "" {
 			part += fmt.Sprintf(", given with `nox secret ask %s %s %s`", machine, module, w.Secret)
 		}
@@ -241,11 +180,6 @@ func needsOperatorWords(module, node string, waits []inventory.Wait) words {
 			act, secret = fmt.Sprintf("type %s at %s's desk prompt", w.What, node), true
 		case w.Setting != "":
 			act = fmt.Sprintf("approve %s of %s on %s when it is proposed to you", w.Setting, module, node)
-		// An access, in words with no path (novox/hq ADR 0325 §7): the folder by the access's name.
-		case w.Access != "" && w.Disk:
-			act = fmt.Sprintf("mount the disk that holds %s on %s", w.Access, node)
-		case w.Access != "":
-			act = fmt.Sprintf("let the mesh keep the shared folder %s on %s when you are asked", w.Access, node)
 		}
 		if act != "" && !seen[act] {
 			seen[act] = true
@@ -283,12 +217,6 @@ func readWaitFacts(ctx context.Context, inv *inventory.Inventory, machine string
 	if f.given == nil {
 		f.given = map[string]map[string]time.Time{}
 	}
-	if f.placed == nil {
-		f.placed = map[string]map[string]string{}
-	}
-	if f.taken == nil {
-		f.taken = map[string]map[string]string{}
-	}
 	if inv == nil {
 		return
 	}
@@ -310,20 +238,6 @@ func readWaitFacts(ctx context.Context, inv *inventory.Inventory, machine string
 				}
 			}
 		}
-		// Where each access of it is placed there (ADR 0325 §7): read once per module and machine.
-		if m, known := f.manifests[module]; known && len(m.Accesses) > 0 {
-			if _, read := f.placed[module+"@"+machine]; !read {
-				if layers, err := inv.SettingsFor(ctx, machine, module); err == nil {
-					placed := map[string]string{}
-					for _, a := range m.Accesses {
-						if path, has := catalogue.AccessPathOn(m, layers, a.ID); has && a.ID != "" {
-							placed[a.ID] = path
-						}
-					}
-					f.placed[module+"@"+machine] = placed
-				}
-			}
-		}
 		if _, read := f.given[module+"@"+machine]; read {
 			continue
 		}
@@ -331,15 +245,6 @@ func readWaitFacts(ctx context.Context, inv *inventory.Inventory, machine string
 			f.given[module+"@"+machine] = given
 		}
 	}
-	if _, read := f.taken[machine]; !read {
-		if taken, err := inv.KeptFolders(ctx, machine); err == nil {
-			kept := map[string]string{}
-			for path, t := range taken {
-				kept[path] = t.Placed
-			}
-			f.taken[machine] = kept
-		}
-	}
 }
 
 // waitingModules is every module with a waiting resource in a statement.

cmd/mesh-controller/plan.go

@@ -9,7 +9,6 @@ import (
 	"fmt"
 	"io"
 	"os"
-	"path/filepath"
 	"slices"
 	"sort"
 	"strings"
@@ -448,7 +447,7 @@ func declarationWith(ctx context.Context, open *stores, node string,
 	if err != nil {
 		return sendable{}, err
 	}
-	out := sendable{Resources: composed.Resources, Adoption: adoption, Identities: composed.Identities,
+	out := sendable{Resources: composed.Resources, Adoption: adoption,
 		Received: composed.Received, Mesh: with.Mesh, BusUsers: with.BusUsers,
 		LeftOut: sortedKeysOf(composed.LeftOut), leftOutWhy: composed.LeftOut, withheld: with.Withheld,
 		unbound: with.Unbound, foreseen: composed.Foreseen, unplaced: composed.Unplaced,
@@ -976,17 +975,9 @@ func renderingFor(ctx context.Context, open *stores, node string,
 	if err != nil {
 		return catalogue.Rendering{}, inventory.Node{}, err
 	}
-	// Each module's identity and the folders taken here (novox/hq ADR 0325 §3, §8), to an engine that keeps folders.
-	keepsFolders, identities, keptFolders, err := folderFacts(ctx, inv, node, plan, choosing)
-	if err != nil {
-		return catalogue.Rendering{}, inventory.Node{}, err
-	}
 	return catalogue.Rendering{
 		ReadsHealth:   readsHealth,
 		JudgesRoot:    judgesRoot,
-		KeepsFolders:  keepsFolders,
-		Identities:    identities,
-		KeptFolders:   keptFolders,
 		BusMembership: memberships[node],
 		Settings:      settings, Generators: gens, Grants: grants, Needed: needed, Foreseen: foreseen, Ports: ports,
 		Certificate: certificate, Authority: authority, Mesh: private, Names: names,
@@ -1019,71 +1010,6 @@ func engineJudgesRoot(ctx context.Context, inv *inventory.Inventory, node string
 	return had && stated.Contract >= link.RootContract, nil
 }
 
-// engineKeepsFolders says whether a machine's node-engine gives modules their identities and keeps shared folders
-// (novox/hq ADR 0325), by its own newest statement, for the same reason as engineReadsHealth: an older engine parses
-// strictly, and is sent none of it.
-func engineKeepsFolders(ctx context.Context, inv *inventory.Inventory, node string) (bool, error) {
-	stated, had, err := inv.HealthOf(ctx, node)
-	if err != nil {
-		return false, err
-	}
-	return had && stated.Contract >= link.IdentityContract, nil
-}
-
-// folderFacts is what a machine's composition needs of ADR 0325: whether its engine keeps folders, each identity of
-// a module of it that declares one, and the folders taken there. **An identity is allocated only on the send path**
-// (Allocating), as a port is: a question about what would be sent reads what was allocated, and a module that has
-// none yet is composed without one. Nothing is read for an engine that does not keep folders.
-func folderFacts(ctx context.Context, inv *inventory.Inventory, node string, plan catalogue.Resolution,
-	choosing Choosing) (bool, map[string]catalogue.ModuleIdentity, map[string]bool, error) {
-	keeps, err := engineKeepsFolders(ctx, inv, node)
-	if err != nil || !keeps {
-		return false, nil, nil, err
-	}
-	identities := map[string]catalogue.ModuleIdentity{}
-	for _, m := range plan.Modules {
-		if !catalogue.DeclaresIdentity(m) {
-			continue
-		}
-		var id catalogue.ModuleIdentity
-		had := true
-		if choosing == Allocating {
-			id, err = inv.AllocateIdentity(ctx, m.Module)
-		} else {
-			id, had, err = inv.IdentityOf(ctx, m.Module)
-		}
-		if err != nil {
-			return false, nil, nil, err
-		}
-		if had {
-			identities[m.Module] = id
-		}
-	}
-	taken, err := inv.KeptFolders(ctx, node)
-	if err != nil {
-		return false, nil, nil, err
-	}
-	kept := map[string]bool{}
-	for path := range taken {
-		kept[path] = true
-	}
-	// **A folder that moved to another filesystem is not taken there until its new warrant** (ADR 0325 §8): the
-	// machine's newest statement names, without a path, the filesystem each folder waiting for the operator is on now.
-	if stated, had, err := inv.HealthOf(ctx, node); err != nil {
-		return false, nil, nil, err
-	} else if had {
-		for _, r := range stated.Resources {
-			for _, w := range r.Waits {
-				path := filepath.Clean(r.Target)
-				if t, was := taken[path]; was && w.Access != "" && !w.Disk && w.Placed != "" && w.Placed != t.Placed {
-					kept[path] = false
-				}
-			}
-		}
-	}
-	return true, identities, kept, nil
-}
-
 // zonesInTheMesh is every zone a module in the mesh declares, where the mesh placed it (novox/hq ADR
 // 0199): the zone settled from that node's settings, the node's private address, the port the
 // answering listen is published on there.

cmd/mesh-controller/plan_ids.go

@@ -0,0 +1,26 @@
+package main
+
+import (
+	"fmt"
+	"regexp"
+)
+
+// planID is every id the mesh gives a plan: a merge's walk or batch (plan-<nanoseconds>) or a release
+// (release-<nanoseconds>).
+var planID = regexp.MustCompile(`^(plan|release)-[0-9]+$`)
+
+// planIDArguments are the arguments of plans that name a plan. wait is among them for when it is declared
+// (novox/hq issue 229); an argument not declared is refused before this is asked.
+var planIDArguments = []string{"id", "wait", "stop", "close", "retry", "go"}
+
+// plainPlanIDs refuses a plans call naming a plan by anything but a plan's id (novox/hq issue 561): checked
+// once, where the call becomes a command line, so nothing else a caller sent reaches a command or the store.
+func plainPlanIDs(given map[string]string) error {
+	for _, arg := range planIDArguments {
+		if id, named := given[arg]; named && !planID.MatchString(id) {
+			return fmt.Errorf("plans %s: %q is not a plan's id (plan-<digits> or release-<digits>, as `plans` "+
+				"lists them); nothing was done", arg, id)
+		}
+	}
+	return nil
+}

cmd/mesh-controller/plan_ids_test.go

@@ -0,0 +1,37 @@
+package main
+
+import (
+	"strings"
+	"testing"
+)
+
+// **A plan's id is checked once, where a call becomes a command line** (novox/hq issue 561): every argument of
+// plans that names a plan is refused unless it is an id the mesh gives a plan, so a quote never reaches a
+// command, nor the store behind it.
+func TestAPlanIdThatIsNoPlansIdIsRefusedBeforeACommandStarts(t *testing.T) {
+	for _, arg := range []string{"id", "stop", "close", "retry", "go"} {
+		for _, bad := range []string{"x' or '1'='1", "plan-1'", "plan-", "plan-1 2", "batch-1", "PLAN-1"} {
+			args := map[string]any{arg: bad}
+			if arg == "stop" || arg == "close" || arg == "go" {
+				args["why"] = "a test"
+			}
+			argv, err := argvFor("plans", args)
+			if err == nil {
+				t.Errorf("plans %s %q was composed: %v", arg, bad, argv)
+				continue
+			}
+			if !strings.Contains(err.Error(), "is not a plan's id") {
+				t.Errorf("plans %s %q was refused for another reason: %v", arg, bad, err)
+			}
+		}
+		for _, good := range []string{"plan-1791813626034291775", "release-1791811938267404408"} {
+			args := map[string]any{arg: good}
+			if arg == "stop" || arg == "close" || arg == "go" {
+				args["why"] = "a test"
+			}
+			if _, err := argvFor("plans", args); err != nil {
+				t.Errorf("plans %s %q was refused: %v", arg, good, err)
+			}
+		}
+	}
+}

cmd/mesh-controller/plans_follow.go

@@ -0,0 +1,158 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// Following a plan (novox/hq issue 229): `plans wait <id>` holds its answer until the plan moves, reaches its
+// next tier or ends, or until its bound passes, and says which. Before it, an agent following a rollout had
+// `plans` answer once, in prose, and wrote a loop of its own round the mesh's tools to be told the plan moved.
+//
+// **No wait is longer than a call is answered within** (link.LongestAnswer, inside the console's thirty
+// seconds): a longer one would answer "still running" and leave its caller to ask `calls` — the loop again.
+// So a caller following a plan to its end asks again; each call answers the moment the plan moves.
+
+// maxPlanWait is the longest bound a wait takes, and the bound when none is given: what a call is answered
+// within, less the time a verb's command takes to start and read the store.
+var maxPlanWait = link.LongestAnswer - planWaitStart
+
+// planWaitStart is what the verb's window allows beyond the bound: starting the command and opening the stores.
+// A store slow enough to push the read and the answer past it degrades as any long call does: the caller is
+// answered that the call is still running, and `calls` with its id says what came of it.
+const planWaitStart = 5 * time.Second
+
+// planWaitEvery is how often a wait reads the plan again.
+const planWaitEvery = time.Second
+
+// The things a wait waits until.
+var planWaitUntil = []string{"moved", "tier", "done"}
+
+// planWaitAsked checks what a wait is asked for: until (moved when empty) and a bound (a duration, or a number
+// of seconds; maxPlanWait when empty).
+func planWaitAsked(until, bound string) (string, time.Duration, error) {
+	if until == "" {
+		until = "moved"
+	}
+	known := false
+	for _, u := range planWaitUntil {
+		known = known || u == until
+	}
+	if !known {
+		return "", 0, fmt.Errorf("a wait is until %s, not %q", strings.Join(planWaitUntil, ", "), until)
+	}
+	d := maxPlanWait
+	if bound = strings.TrimSpace(bound); bound != "" {
+		var err error
+		if secs, isNumber := strconv.Atoi(bound); isNumber == nil {
+			d = time.Duration(secs) * time.Second
+		} else if d, err = time.ParseDuration(bound); err != nil {
+			return "", 0, fmt.Errorf("the bound %q is not a duration (such as 20s) or a number of seconds", bound)
+		}
+		if d <= 0 || d > maxPlanWait {
+			return "", 0, fmt.Errorf("the bound is at most %s, the longest a call is answered within; %s was asked "+
+				"— to follow a plan longer, ask again: each call answers the moment the plan moves", maxPlanWait, d)
+		}
+	}
+	return until, d, nil
+}
+
+// planEnded is a plan that will not move again: done, failed or superseded. A batch being assembled is not one.
+func planEnded(p inventory.Plan) bool { return !p.Open() && !p.Batch() }
+
+// waitOnPlan reads the plan until what it waits for happens or the bound passes, and answers the plan as last
+// read and what ended the wait: moved (any save of it), tier (its tier changed), done (it ended — which ends
+// every wait, since nothing comes after it), or bound. Moved and tier are judged against the plan as first read.
+func waitOnPlan(ctx context.Context, read func(context.Context) (inventory.Plan, error), until string,
+	bound, every time.Duration) (inventory.Plan, string, error) {
+	first, err := read(ctx)
+	if err != nil {
+		return inventory.Plan{}, "", err
+	}
+	if planEnded(first) {
+		return first, "done", nil
+	}
+	deadline := time.Now().Add(bound)
+	tick := time.NewTicker(every)
+	defer tick.Stop()
+	last := first
+	for {
+		select {
+		case <-ctx.Done():
+			return last, "", ctx.Err()
+		case <-tick.C:
+		}
+		if !time.Now().Before(deadline) {
+			return last, "bound", nil
+		}
+		p, err := read(ctx)
+		if err != nil {
+			return last, "", err
+		}
+		last = p
+		switch {
+		case planEnded(p):
+			return p, "done", nil
+		case until == "moved" && p.Revision != first.Revision:
+			return p, "moved", nil
+		case until == "tier" && p.Tier != first.Tier:
+			return p, "tier", nil
+		}
+	}
+}
+
+// planWaited is what `plans wait` answers: the plan, what ended the wait, and the line a person reads (`text`,
+// which the verb answers as its output and not again in the data).
+type planWaited struct {
+	// Came is what ended the wait: moved, tier, done, or bound when nothing did.
+	Came   string     `json:"came"`
+	Until  string     `json:"until"`
+	Waited string     `json:"waited"`
+	Plan   planStatus `json:"plan"`
+	// Revision is the plan's as read: a caller asking again with the same plan sees whether it moved since.
+	Revision int64  `json:"revision"`
+	Text     string `json:"text"`
+}
+
+func planWaitedDoc(p inventory.Plan, st planStatus, until, came string, waited time.Duration, line string) planWaited {
+	said := map[string]string{
+		"moved": "moved", "tier": "reached another tier", "done": "ended",
+		"bound": "did not " + map[string]string{"moved": "move", "tier": "reach another tier", "done": "end"}[until],
+	}[came]
+	text := fmt.Sprintf("%s %s in %s (waited until %s)\n%s — %s\n", p.ID, said, waited.Round(time.Second), until,
+		p.ID, line)
+	return planWaited{Came: came, Until: until, Waited: waited.Round(time.Millisecond).String(), Plan: st,
+		Revision: p.Revision, Text: text}
+}
+
+// planWaitCommand is `plans wait <id>`: the plan followed until it moves, or the bound passes.
+func planWaitCommand(ctx context.Context, inv *inventory.Inventory, id, untilAsked, boundAsked string) error {
+	until, bound, err := planWaitAsked(untilAsked, boundAsked)
+	if err != nil {
+		return err
+	}
+	began := time.Now()
+	p, came, err := waitOnPlan(ctx, func(ctx context.Context) (inventory.Plan, error) {
+		return inv.PlanByID(ctx, id)
+	}, until, bound, planWaitEvery)
+	if err != nil {
+		return err
+	}
+	// Said as `plans <id>` says its first line, and as `status` says the plan.
+	now, one := time.Now(), []inventory.Plan{p}
+	bounds, pause := readTierBounds(ctx, inv, now), buildSeatPause(ctx, inv, one)
+	line := planLineSaid(p, now, pause, bounds.of(p.Repository), func(module string) []string {
+		on, _ := inv.Running(ctx, module)
+		return on
+	}, waitsOf(ctx, inv, one))
+	doc := planWaitedDoc(p, planStatuses(one, now, pause, bounds)[0], until, came, now.Sub(began), line)
+	return json.NewEncoder(os.Stdout).Encode(doc)
+}

cmd/mesh-controller/plans_follow_test.go

@@ -0,0 +1,196 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// A plan as the store would answer it at each read: the reads are counted, and each answers the next.
+type planReads struct {
+	plans []inventory.Plan
+	n     int
+}
+
+func (r *planReads) read(context.Context) (inventory.Plan, error) {
+	p := r.plans[min(r.n, len(r.plans)-1)]
+	r.n++
+	return p, nil
+}
+
+func followedPlan(rev int64, state string, tier int) inventory.Plan {
+	return inventory.Plan{ID: "plan-1", Repository: "novox/x", Commit: "abc", State: state, Tier: tier,
+		Tiers: [][]string{{"a"}, {"b"}}, Revision: rev}
+}
+
+// **`plans` waits for a plan, and says what ended the wait** (novox/hq issue 229): an agent following a
+// rollout is told when the plan moved, reached its next tier or ended, or that the bound passed — in one
+// call, without a loop of its own.
+func TestAWaitForAPlanEndsWhenWhatItWaitsForHappens(t *testing.T) {
+	cases := []struct {
+		name  string
+		until string
+		reads []inventory.Plan
+		came  string
+		times int
+	}{
+		{"moved: any save", "moved", []inventory.Plan{
+			followedPlan(1, inventory.PlanBuilding, 0), followedPlan(1, inventory.PlanBuilding, 0),
+			followedPlan(2, inventory.PlanBuilding, 0)}, "moved", 3},
+		{"tier: a save inside the tier is not enough", "tier", []inventory.Plan{
+			followedPlan(1, inventory.PlanBuilding, 0), followedPlan(2, inventory.PlanBuilding, 0),
+			followedPlan(3, inventory.PlanRolling, 1)}, "tier", 3},
+		{"tier: a plan that ended has no next tier to wait for", "tier", []inventory.Plan{
+			followedPlan(1, inventory.PlanBuilding, 0), followedPlan(2, inventory.PlanFailed, 0)}, "done", 2},
+		{"done: a new tier is not the end", "done", []inventory.Plan{
+			followedPlan(1, inventory.PlanBuilding, 0), followedPlan(2, inventory.PlanRolling, 1),
+			followedPlan(3, inventory.PlanDone, 1)}, "done", 3},
+		{"done: a plan already ended answers at once", "done", []inventory.Plan{
+			followedPlan(4, inventory.PlanSuperseded, 1)}, "done", 1},
+		{"the bound passes", "moved", []inventory.Plan{followedPlan(1, inventory.PlanBuilding, 0)}, "bound", -1},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			r := &planReads{plans: c.reads}
+			p, came, err := waitOnPlan(context.Background(), r.read, c.until, 50*time.Millisecond, time.Millisecond)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if came != c.came {
+				t.Fatalf("the wait ended as %q, want %q", came, c.came)
+			}
+			if c.times > 0 && r.n != c.times {
+				t.Errorf("read the plan %d times, want %d: it answered before or after what it waited for", r.n, c.times)
+			}
+			if want := c.reads[min(r.n, len(c.reads))-1]; p.Revision != want.Revision {
+				t.Errorf("answered revision %d, not the plan as it was last read (%d)", p.Revision, want.Revision)
+			}
+		})
+	}
+}
+
+// What a wait is asked for is checked before anything is read: what it waits until, and a bound no longer than
+// a call is answered within.
+func TestAWaitIsRefusedWhatItCannotDo(t *testing.T) {
+	for _, bad := range []struct{ until, bound string }{{"landed", ""}, {"", "1h"}, {"", "-3s"}, {"", "soon"}} {
+		if _, _, err := planWaitAsked(bad.until, bad.bound); err == nil {
+			t.Errorf("until %q, bound %q was taken", bad.until, bad.bound)
+		}
+	}
+	until, bound, err := planWaitAsked("", "")
+	if err != nil || until != "moved" || bound != maxPlanWait {
+		t.Fatalf("the defaults are %q %s %v, want moved and %s", until, bound, err, maxPlanWait)
+	}
+	if _, bound, _ := planWaitAsked("tier", "12"); bound != 12*time.Second {
+		t.Errorf("a bare number is seconds; read %s", bound)
+	}
+}
+
+// **The answer is data, with its prose as a field beside it** (novox/hq issue 229): the verb's `answer` carries
+// the plan and what ended the wait, and its output is the line a person reads — never JSON inside a string.
+func TestAWaitForAPlanAnswersAsData(t *testing.T) {
+	p := followedPlan(7, inventory.PlanRolling, 1)
+	st := planStatuses([]inventory.Plan{p}, time.Now(), pauseView{}, tierBounds{})[0]
+	doc := planWaitedDoc(p, st, "tier", "tier", 3*time.Second, "rolling, tier 2 of 2")
+	stdout, _ := json.Marshal(doc)
+	a := answerOf([]string{"plans", "wait", "plan-1"}, stdout, "", true)
+	data, ok := a.Answer.(map[string]any)
+	if !ok {
+		t.Fatalf("the answer is not data: %v", a.Answer)
+	}
+	if data["came"] != "tier" || data["revision"] != float64(7) {
+		t.Errorf("the data does not say what ended the wait: %v", data)
+	}
+	if plan, _ := data["plan"].(map[string]any); plan["state"] != "rolling" || plan["tier"] != float64(1) {
+		t.Errorf("the data does not carry the plan: %v", data["plan"])
+	}
+	if _, text := data["text"]; text {
+		t.Errorf("the prose is in the data too: %v", data)
+	}
+	if strings.Contains(a.Output, "{") || !strings.Contains(a.Output, "plan-1") || !strings.Contains(a.Output, "tier") {
+		t.Errorf("the output is not the line a person reads: %q", a.Output)
+	}
+}
+
+// The verb composes the wait, and asks for a window as long as its bound.
+func TestThePlansVerbComposesAWait(t *testing.T) {
+	argv, err := argvFor("plans", map[string]any{"wait": "plan-1", "until": "done", "bound": "15s"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := strings.Join(argv, " "); got != "plans wait plan-1 --until done --bound 15s" {
+		t.Fatalf("composed %q", got)
+	}
+	if _, err := argvFor("plans", map[string]any{"until": "done"}); err == nil {
+		t.Error("until without wait was taken")
+	}
+	if _, err := argvFor("plans", map[string]any{"wait": "plan-1", "bound": "1h"}); err == nil {
+		t.Error("a bound past what a call can wait was taken")
+	}
+}
+
+// Live, with the store: `plans wait` run as the verb runs it answers when the plan reaches its next tier, as
+// data, and says the bound passed when nothing moved (novox/hq issue 229).
+func TestAPlanFollowedFromTheStoreAnswersWhenItMoves(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	now := time.Now().UTC()
+	walk := inventory.Plan{ID: "plan-229", Repository: "novox/mesh-catalog", Branch: "main", Commit: "c229c229",
+		Created: now, State: inventory.PlanBuilding, Tiers: [][]string{{"a"}, {"b"}},
+		Modules: map[string]*inventory.PlanModule{"a": {}, "b": {}}}
+	if err := open.inventory.SavePlan(ctx, &walk); err != nil {
+		t.Fatal(err)
+	}
+	moved := make(chan error, 1)
+	go func() {
+		time.Sleep(1500 * time.Millisecond)
+		p, err := open.inventory.PlanByID(ctx, walk.ID)
+		if err == nil {
+			p.Tier, p.State = 1, inventory.PlanRolling
+			err = open.inventory.SavePlan(ctx, &p)
+		}
+		moved <- err
+	}()
+	began := time.Now()
+	var got planWaited
+	out := printed(t, func() error {
+		return plansCommand(ctx, []string{"wait", walk.ID, "--until", "tier", "--bound", "15s"})
+	})
+	if err := <-moved; err != nil {
+		t.Fatal(err)
+	}
+	if err := json.Unmarshal([]byte(out), &got); err != nil {
+		t.Fatalf("plans wait did not answer data: %v: %q", err, out)
+	}
+	if got.Came != "tier" || got.Plan.Tier != 1 || got.Plan.State != inventory.PlanRolling {
+		t.Fatalf("the wait answered %+v", got)
+	}
+	if waited := time.Since(began); waited > 10*time.Second {
+		t.Errorf("it answered after %s, not when the plan moved", waited)
+	}
+	out = printed(t, func() error {
+		return plansCommand(ctx, []string{"wait", walk.ID, "--bound", "2"})
+	})
+	if err := json.Unmarshal([]byte(out), &got); err != nil || got.Came != "bound" || got.Until != "moved" {
+		t.Fatalf("a plan that did not move answered %+v (%v)", got, err)
+	}
+}
+
+// The verb's schema says the longest bound in words, and the words are the value (review 75 on #266): the
+// catalogue cannot read maxPlanWait, so this holds them together.
+func TestThePlansSchemaSaysTheLongestBoundThereIs(t *testing.T) {
+	v, ok := controllerVerb("plans")
+	if !ok {
+		t.Fatal("no plans verb")
+	}
+	props, _ := v.Input["properties"].(map[string]any)
+	bound, _ := props["bound"].(map[string]any)
+	said, _ := bound["description"].(string)
+	if !strings.Contains(said, maxPlanWait.String()+", the default, is the longest") {
+		t.Fatalf("the schema says %q; the longest bound is %s", said, maxPlanWait)
+	}
+}

cmd/mesh-controller/release_plan.go

@@ -1463,6 +1463,10 @@ func plansCommand(ctx context.Context, args []string) error {
 	modules := set.String("modules", "", "or the modules it would change, comma-separated")
 	moduleDirs := set.String("module-dirs", "", "with --paths: the directories holding a module.json at the commit, "+
 		"comma-separated, as the forge's announcer says them (novox/hq issue 278)")
+	// Following a plan (novox/hq issue 229): `plans wait <id>`.
+	until := set.String("until", "", "with wait: what to wait for — moved (any change), tier (its next tier) or done (its end)")
+	bound := set.String("bound", "", "with wait: how long to wait at most, as 15s or seconds (default and at most the "+
+		"longest a call is answered within)")
 	// Ending a plan by hand is a repair, and says why (novox/hq to-be 45 §7).
 	why := addHandActFlags(set)
 	positionals, err := parseAround(set, args)
@@ -1482,6 +1486,9 @@ func plansCommand(ctx context.Context, args []string) error {
 	defer open.Close()
 	inv := open.inventory
 	now := time.Now()
+	if len(positionals) == 2 && positionals[0] == "wait" {
+		return planWaitCommand(ctx, inv, positionals[1], *until, *bound)
+	}
 	if len(positionals) == 1 {
 		p, err := inv.PlanByID(ctx, positionals[0])
 		if err != nil {

cmd/mesh-controller/replay401_test.go

@@ -0,0 +1,83 @@
+package main
+
+import (
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+)
+
+// TestReplay401 replays novox/hq issue 401 (2026-10-10): the mounts module's smb-credentials, an own secret
+// only an outside party issues, was given by nobody, and the send made a random value for it and placed it on
+// the machine; the module read it as a credential given and wrong. The outcome asserted (ADR 0228): the send
+// makes no value for an own secret issued outside the mesh that nobody gave and places none, and a value the
+// mesh made for it before is not placed either; once a person gives one, that value is placed. Written with
+// only what the controller had before its fix (mesh-controller #262) — register, assign, planFor,
+// declarationFor and the inventory's secret reads — so it is laid over the commit before. Needs the store
+// (MESH_TEST_POSTGRES), and is named in testdata/store-tests.
+func TestReplay401(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	const made, outside = "/var/lib/mesh/mounts/password", "/var/lib/mesh/mounts/smb-credentials"
+	register(t, open, catalogue.Manifest{Module: "mounts", Version: "1",
+		OwnSecrets: catalogue.OwnSecrets{
+			"password":        {Path: made, Taken: catalogue.TakenAtStart},
+			"smb-credentials": {Path: outside, Taken: catalogue.TakenAtStart, IssuedBy: catalogue.IssuedOutside},
+		},
+		Resources: []map[string]any{
+			{"id": "state", "type": "directory", "path": "/var/lib/mesh/mounts", "mode": "0700"},
+		}})
+	if _, err := assign(ctx, open, "laptop", "mounts"); err != nil {
+		t.Fatal(err)
+	}
+	sent := func() []map[string]any {
+		t.Helper()
+		plan, settings, err := planFor(ctx, open, "laptop")
+		if err != nil {
+			t.Fatal(err)
+		}
+		declared, err := declarationFor(ctx, open, "laptop", plan, settings)
+		if err != nil {
+			t.Fatalf("the send to laptop did not compose: %v", err)
+		}
+		return declared.Resources
+	}
+	placed := func(resources []map[string]any, path string) map[string]any {
+		for _, r := range resources {
+			if r["path"] == path && r["sealed"] != nil {
+				return r
+			}
+		}
+		return nil
+	}
+
+	first := sent()
+	if placed(first, made) == nil {
+		t.Fatal("the secret the mesh makes was not placed")
+	}
+	if got := placed(first, outside); got != nil {
+		t.Errorf("the send placed a value for smb-credentials, which nobody gave: %v", got)
+	}
+	if _, held, err := open.inventory.ModuleSecretIfIssued(ctx, "laptop", "mounts", "smb-credentials"); err != nil || held {
+		t.Fatalf("the send made a value for a secret issued outside the mesh (held %v, %v)", held, err)
+	}
+
+	// A value the mesh made for it before the rule is not one a person gave: it is not placed.
+	if _, err := open.inventory.SecretForModule(ctx, "laptop", "mounts", "smb-credentials"); err != nil {
+		t.Fatal(err)
+	}
+	if got := placed(sent(), outside); got != nil {
+		t.Fatalf("a value the mesh made for a secret issued outside was placed: %v", got)
+	}
+
+	// Given by a person, it is placed, as given.
+	if err := open.inventory.AcceptSecretForModule(ctx, "laptop", "mounts", "smb-credentials", "the share's credentials"); err != nil {
+		t.Fatal(err)
+	}
+	given, held, err := open.inventory.ModuleSecretIfIssued(ctx, "laptop", "mounts", "smb-credentials")
+	if err != nil || !held {
+		t.Fatalf("the value given is not held (%v)", err)
+	}
+	if got := placed(sent(), outside); got == nil || got["sealed"] != given {
+		t.Fatalf("the value given is placed as %v", got)
+	}
+}

cmd/mesh-controller/seatverbs.go

@@ -336,6 +336,9 @@ func (a *verbArguments) commandLine() ([]string, error) {
 		}
 		return argv, nil
 	case "plans":
+		if err := plainPlanIDs(a.given); err != nil {
+			return nil, err
+		}
 		if r := str("repository"); r != "" {
 			argv := []string{"plans", "--what-if", r}
 			if p := str("paths"); p != "" {
@@ -365,6 +368,21 @@ func (a *verbArguments) commandLine() ([]string, error) {
 				return argv, nil
 			}
 		}
+		if id := str("wait"); id != "" {
+			// Following a plan (novox/hq issue 229): checked here too, so a call asking what no wait can do is
+			// refused before a command is started.
+			if _, _, err := planWaitAsked(a.given["until"], a.given["bound"]); err != nil {
+				return nil, err
+			}
+			argv := []string{"plans", "wait", id}
+			if u := str("until"); u != "" {
+				argv = append(argv, "--until", u)
+			}
+			if b := str("bound"); b != "" {
+				argv = append(argv, "--bound", b)
+			}
+			return argv, nil
+		}
 		if id := str("id"); id != "" {
 			return []string{"plans", id}, nil
 		}
@@ -985,12 +1003,14 @@ var jsonVerbs = map[string]bool{"status": true, "seats": true, "plan": true, "co
 	// The delivery's owner's verbs answer JSON where they read (plan, order, check, walks) — novox/hq ADR 0239.
 	"delivery": true,
 	// The build queue, each ask with its position among the waiting (novox/hq issue 455).
-	"queue": true}
+	"queue": true,
+	// A plan followed (novox/hq issue 229): `plans wait` answers JSON; its other forms say text, and so answer no data.
+	"plans": true}
 
 // tableBesideVerbs are the JSON verbs whose document carries the table a person reads as its `text`: the
 // verb answers that table as its output, as it did before it answered data, and the rest as `answer` —
 // both from the one read, so they never disagree (novox/hq issue 455).
-var tableBesideVerbs = map[string]bool{"queue": true}
+var tableBesideVerbs = map[string]bool{"queue": true, "plans": true}
 
 // overviewVerbs are the JSON verbs whose answer is said once, as data, and not again as the text the
 // command printed: the overviews, which grow with the mesh (novox/hq issue 314). Every reader of theirs
@@ -1264,6 +1284,16 @@ func seatToolHandlers() (map[string]link.ToolHandler, []string, error) {
 				// Whatever it did, `status` is composed again once it has.
 				defer statusFrom.nudge()
 			}
+			if verb == "plans" && len(argv) > 1 && argv[1] == "wait" {
+				// A wait holds its answer up to its bound (novox/hq issue 229), and is answered in full inside it.
+				asked := ""
+				if i := slices.Index(argv, "--bound"); i > 0 && i+1 < len(argv) {
+					asked = argv[i+1]
+				}
+				if _, bound, err := planWaitAsked("", asked); err == nil {
+					link.AnswersWithin(ctx, bound+planWaitStart)
+				}
+			}
 			if answer, read := readHere(ctx, argv); read {
 				return answer, nil
 			}

cmd/mesh-controller/sendable.go

@@ -18,9 +18,6 @@ import (
 // make a machine look out of date for ever, or send something `plan` never showed.
 type sendable struct {
 	Resources []map[string]any
-	// Identities is the declaration's `identities` (novox/hq ADR 0325 §3): composed only for an engine that keeps
-	// folders, and not sent at all when empty — an older engine refuses a key it does not know, whole.
-	Identities []map[string]any
 	// Sequence orders this send against every other to the same node: one higher each time, taken
 	// under the node's hold just before the body is made (novox/hq 04-ISSUES/107). Zero is not sent
 	// at all, which a host reads as "no order claimed" — the shape of every declaration before this.
@@ -113,9 +110,6 @@ func (s sendable) Body() ([]byte, error) {
 	if s.Generation > 0 {
 		envelope["generation"] = s.Generation
 	}
-	if len(s.Identities) > 0 {
-		envelope["identities"] = s.Identities
-	}
 	// An empty declaration is deliberate here — the node owns nothing the mesh put there
 	// (novox/hq issue 127) — and the host refuses an empty body unless it is told the emptiness
 	// is meant, so a truncated or mis-composed body is never mistaken for "own nothing".

go.mod

@@ -8,6 +8,7 @@ require (
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 	github.com/novox/mesh-host v0.0.0
+	github.com/therootcompany/xz v1.0.1
 	golang.org/x/crypto v0.57.0
 	golang.org/x/net v0.58.0
 	golang.org/x/sys v0.48.0
@@ -35,4 +36,4 @@ require (
 // committed. Every build (the build agent's `go build`, the Dockerfile) compiles from vendor/ and
 // fetches nothing; go refuses to build when vendor/ and this file disagree, so a pin moved without
 // `go mod vendor` fails loudly, at once, everywhere.
-replace github.com/novox/mesh-host => git.novox.be/novox/mesh-host v0.0.0-20261012170302-d2d9fbbd7d1c
+replace github.com/novox/mesh-host => git.novox.be/novox/mesh-host v0.0.0-20261011092230-20d5af9b2d5f

go.sum

@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-host v0.0.0-20261012170302-d2d9fbbd7d1c h1:5k5y4bML7BQtFVPstHVHkQUdjKUpOQII4yTbu1MKMGY=
-git.novox.be/novox/mesh-host v0.0.0-20261012170302-d2d9fbbd7d1c/go.mod h1:tcTK4LMs1d6JpZUwy3hSHMFG/MIuDr/XFs7/nbeaW/c=
+git.novox.be/novox/mesh-host v0.0.0-20261011092230-20d5af9b2d5f h1:8N5OW2mdTNIck2pe4EciTYX5NsrPsHrTLENGNIWYNTU=
+git.novox.be/novox/mesh-host v0.0.0-20261011092230-20d5af9b2d5f/go.mod h1:tcTK4LMs1d6JpZUwy3hSHMFG/MIuDr/XFs7/nbeaW/c=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261010191001-33917f91ac3c h1:l5onJwoIeH8yE/PjVlEeoPyXBsHp2NQiWLllz2fwX7s=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261010191001-33917f91ac3c/go.mod h1:GFuZUElBZ9A++mxgIKo97aXXo+kV0uJ/UkbhQPPIbrY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
@@ -38,6 +38,8 @@ github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UV
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/therootcompany/xz v1.0.1 h1:CmOtsn1CbtmyYiusbfmhmkpAAETj0wBIH6kCYaX+xzw=
+github.com/therootcompany/xz v1.0.1/go.mod h1:3K3UH1yCKgBneZYhuQUvJ9HPD19UEXEI0BWbMn8qNMY=
 golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
 golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
 golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=

internal/broker/nats.go

@@ -343,11 +343,6 @@ func AskJudgeDirectoriesSubject(node string) string {
 	return "mesh.node." + node + ".ask.judge-directories"
 }
 
-// AskAccessActSubject is where the controller asks one machine's node-engine to take a shared folder on the
-// operator's warrant (novox/hq ADR 0325 §8; mesh-host internal/link AskAccessActSubject): a request answered once,
-// signed as a hand-over is (link.AccessActContext), for the same reason.
-func AskAccessActSubject(node string) string { return "mesh.node." + node + ".ask.access-act" }
-
 // inbox is a principal's own reply space. No user is ever granted a bare `_INBOX.>` (design 25
 // §4): with one account, inbox privacy is the permission list or it is nothing, so each user's
 // inbox is derived from its own identity and its permissions name that prefix and no other.
@@ -628,9 +623,7 @@ func PermissionsFor(p Principal) (Permissions, error) {
 			// And asking it for a fresh search for setuid programs (novox/hq issue 361), answered the same way.
 			AskSetuidSearchSubject(p.Node),
 			// And asking it to judge its declared directories, read-only (novox/hq issue 358), answered the same way.
-			AskJudgeDirectoriesSubject(p.Node),
-			// And asking it to take a shared folder on the operator's warrant (novox/hq ADR 0325 §8), answered the same way.
-			AskAccessActSubject(p.Node)}
+			AskJudgeDirectoriesSubject(p.Node)}
 		// The node-engine witnesses the core builds it places (novox/hq to-be 45 §8, ADR 0236; the
 		// contract is lease/witness.go): it asks its own machine's node tools PING, and, where the
 		// machine runs the controller, reads the lease's one key — read, never written.

internal/broker/testdata/composed.conf

@@ -34,7 +34,7 @@ accounts {
       } }
       { user: "node.one", password: "$2a$11$nnnnnnnnnnnnnnnnnnnnnn", permissions: {
         publish: { allow: ["$JS.ACK.NODES.one.>", "$JS.API.CONSUMER.INFO.NODES.one", "$SRV.PING.node-tools.one", "mesh.control.one.>"] }
-        subscribe: { allow: ["_DELIVER.one", "_DELIVER.one.>", "_INBOX.node.one.>", "mesh.node.one.ask.access-act", "mesh.node.one.ask.hand-over", "mesh.node.one.ask.judge-directories", "mesh.node.one.ask.report", "mesh.node.one.ask.setuid-search", "mesh.node.one.declare"] }
+        subscribe: { allow: ["_DELIVER.one", "_DELIVER.one.>", "_INBOX.node.one.>", "mesh.node.one.ask.hand-over", "mesh.node.one.ask.judge-directories", "mesh.node.one.ask.report", "mesh.node.one.ask.setuid-search", "mesh.node.one.declare"] }
         allow_responses: { max: 1, ttl: "1m" }
       } }
       { user: "one.nats", password: "$2a$11$bbbbbbbbbbbbbbbbbbbbbb", permissions: {

internal/broker/writers.go

@@ -101,11 +101,6 @@ var WritersTable = []WriterRow{
 	{State: "a judgement of a machine's directories asked of it", Writer: "controller",
 		KeptIn: "nowhere: the engine answers it and keeps nothing", Others: "the engine verifies the mesh's signature and answers, or refuses",
 		Subjects: []string{"mesh.node.*.ask.judge-directories"}, Writes: isController},
-	// The take of a shared folder asked of a machine's engine on the operator's warrant (novox/hq ADR 0325 §8):
-	// signed as a hand-over is, under a signing context of its own.
-	{State: "the take of a shared folder asked of a machine", Writer: "controller, on the operator's warrant",
-		KeptIn: "the machine, which records the act", Others: "the engine verifies the mesh's signature and takes it, or refuses",
-		Subjects: []string{"mesh.node.*.ask.access-act"}, Writes: isController},
 	{State: "a machine's applied state and its report", Writer: "the node-engine's apply queue",
 		KeptIn: "the machine; the report on the bus", Others: "the reconcile and a delivery enqueue, never apply",
 		// And its health statement between reports (novox/hq ADR 0240): the same writer stating the same

internal/broker/writers_test.go

@@ -18,7 +18,6 @@ var designRows = []string{
 	"a hand-over asked of a machine",
 	"a fresh setuid search asked of a machine",
 	"a judgement of a machine's directories asked of it",
-	"the take of a shared folder asked of a machine",
 	"a machine's applied state and its report",
 	"the controller lease",
 	"plans and their tiers",

internal/builder/check.go

@@ -939,16 +939,14 @@ func replaceGoFiles(from, into string) error {
 }
 
 // problemLines are the lines of a module check's output that name a problem: not a manifest found ok, not
-// the count, not the closing note, not a warning.
+// the count, not the closing note.
 func problemLines(s string) []string {
 	var out []string
 	for _, line := range strings.Split(s, "\n") {
 		line = strings.TrimSpace(line)
 		switch {
 		case line == "", strings.Contains(line, ": ok"), strings.Contains(line, "problem(s) in"),
-			strings.Contains(line, "manifest(s) checked"),
-			// A warning is said and fails nothing (novox/hq ADR 0325: what is refused once the catalogues moved).
-			strings.HasPrefix(line, "warning: "):
+			strings.Contains(line, "manifest(s) checked"):
 			continue
 		}
 		out = append(out, line)

internal/builder/upstream_file.go

@@ -14,13 +14,13 @@ import (
 	"io"
 	"net/http"
 	"os"
-	"os/exec"
 	"path"
 	"path/filepath"
 	"strings"
 	"time"
 
 	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/therootcompany/xz"
 )
 
 // An archive whose source is somebody else's published file, pinned by URL and sha256 (novox/hq ADR 0316
@@ -183,7 +183,6 @@ func unpackUpstream(ctx context.Context, file, into, within string) error {
 	buffered := bufio.NewReader(f)
 	magic, _ := buffered.Peek(6)
 	var stream io.Reader
-	var wait func() error
 	switch {
 	case bytes.HasPrefix(magic, []byte{0x1f, 0x8b}):
 		zipped, err := gzip.NewReader(buffered)
@@ -195,53 +194,33 @@ func unpackUpstream(ctx context.Context, file, into, within string) error {
 	case bytes.HasPrefix(magic, []byte("BZh")):
 		stream = bzip2.NewReader(buffered)
 	case bytes.HasPrefix(magic, []byte{0xfd, '7', 'z', 'X', 'Z', 0x00}):
-		// Go's standard library reads no xz; the build seat's image carries xz (cmd/mesh-builder/Dockerfile).
-		if _, err := exec.LookPath("xz"); err != nil {
-			return errors.New("it is compressed with xz, and this build seat has no xz to read it")
+		// Read in Go (github.com/therootcompany/xz, a port of xz-embedded), never by a tool the build seat's image
+		// may not carry: the seat's image is the catalogue's build-agent recipe, which installs git and docker-cli
+		// alone, and a release pinned as .tar.xz failed there on 2026-10-12 (hq issue 345). xzDictMax is a real
+		// maximum: a block whose LZMA2 dictionary is larger is refused before its dictionary is allocated
+		// (ErrMemlimit). The reader keeps a filter decoder for every block of a stream, so the file's framing is
+		// walked first and a file of more blocks than xzBlocksMax is refused before anything is decoded
+		// (xz_framing.go). What the stream unpacks to is bounded by untar (maxUpstream, maxEntries).
+		if err := xzWithinLimits(file); err != nil {
+			return err
 		}
-		cmd := exec.CommandContext(ctx, "xz", "-dc")
-		cmd.Stdin = buffered
-		var stderr bytes.Buffer
-		cmd.Stderr = &stderr
-		out, err := cmd.StdoutPipe()
+		zipped, err := xz.NewReader(buffered, xzDictMax)
 		if err != nil {
-			return err
+			return fmt.Errorf("it is not an xz stream this build seat reads (a dictionary of %d MiB at most): %v",
+				xzDictMax>>20, err)
 		}
-		if err := cmd.Start(); err != nil {
-			return err
-		}
-		stream = out
-		wait = func() error {
-			if err := cmd.Wait(); err != nil {
-				return fmt.Errorf("xz could not read it: %v %s", err, strings.TrimSpace(stderr.String()))
-			}
-			return nil
-		}
-		defer func() {
-			if wait != nil {
-				_ = cmd.Process.Kill()
-				_ = cmd.Wait()
-			}
-		}()
+		stream = zipped
 	default:
 		return errors.New("it is not a tar archive compressed with gzip, bzip2 or xz; a single file is kept " +
 			"whole by naming it in `file`")
 	}
-	if err := untar(stream, into, within); err != nil {
-		return err
-	}
-	if wait != nil {
-		// Whatever follows the tar's end is read before xz is waited for: xz blocks on a full pipe otherwise.
-		if _, err := io.Copy(io.Discard, stream); err != nil {
-			return err
-		}
-		w := wait
-		wait = nil
-		return w()
-	}
-	return nil
+	return untar(stream, into, within)
 }
 
+// xzDictMax is the largest xz dictionary read: xz's own presets use at most 64 MiB (-9); a stream asking for
+// more is refused rather than given the memory.
+const xzDictMax = 64 << 20
+
 // untar writes a tar stream's files and directories within `within` into a directory.
 func untar(stream io.Reader, into, within string) error {
 	reader := tar.NewReader(stream)

internal/builder/upstream_file_test.go

@@ -6,8 +6,10 @@ import (
 	"compress/gzip"
 	"context"
 	"crypto/sha256"
+	"encoding/binary"
 	"encoding/hex"
 	"fmt"
+	"hash/crc32"
 	"io"
 	"net"
 	"net/http"
@@ -15,6 +17,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"runtime"
 	"sort"
 	"strings"
 	"testing"
@@ -383,3 +386,84 @@ func TestARedirectOffHttpsIsNotFollowed(t *testing.T) {
 		t.Fatalf("%v", err)
 	}
 }
+
+func TestAnXzReleaseIsReadWithoutAnyXzToolOnTheBuildSeat(t *testing.T) {
+	// The build seat's image (the catalogue's build-agent recipe) carries git and docker-cli alone: Betterbird's
+	// .tar.xz failed there on 2026-10-12 with "this build seat has no xz to read it" (hq issue 345). It is
+	// read in Go, with nothing on PATH.
+	t.Setenv("PATH", "")
+	body, err := os.ReadFile(filepath.Join("testdata", "release.tar.xz"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	v := &vendor{files: map[string][]byte{"/r.tar.xz": body}}
+	base := serveVendor(t, v)
+	packed, err := upstreamArchive(context.Background(), t.TempDir(), catalogue.Artifact{Name: "archive", Kind: "archive",
+		URL: base + "/r.tar.xz", SHA256: sumHex(body), Version: "1", Within: "betterbird"}, func(string, string, ...any) {})
+	if err != nil {
+		t.Fatal(err)
+	}
+	e := entriesOf(t, packed)
+	if len(e) != 2 || e["betterbird"] != "#!/bin/sh\n -rwxr-xr-x" || e["defaults/p.js"] != "pref(\"a\", 1);\n -rw-r--r--" {
+		t.Fatalf("%v", e)
+	}
+}
+
+// withDictionary is an xz stream whose first block's LZMA2 dictionary property is props, its header's CRC32
+// recomputed: a stream asking for a dictionary of its own choosing.
+func withDictionary(t *testing.T, stream []byte, props byte) []byte {
+	t.Helper()
+	out := append([]byte{}, stream...)
+	const at = 12 // the stream header
+	size := (int(out[at]) + 1) * 4
+	header := out[at : at+size]
+	flags := header[1]
+	i := 2
+	readVarint := func() {
+		for header[i]&0x80 != 0 {
+			i++
+		}
+		i++
+	}
+	if flags&0x40 != 0 {
+		readVarint()
+	}
+	if flags&0x80 != 0 {
+		readVarint()
+	}
+	if header[i] != 0x21 || header[i+1] != 0x01 {
+		t.Fatalf("the fixture's first filter is not LZMA2: % x", header)
+	}
+	header[i+2] = props
+	binary.LittleEndian.PutUint32(header[size-4:], crc32.ChecksumIEEE(header[:size-4]))
+	return out
+}
+
+func TestAnXzStreamAskingForTooLargeADictionaryIsRefused(t *testing.T) {
+	body, err := os.ReadFile(filepath.Join("testdata", "release.tar.xz"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	// 1 GiB (props 36) and 4 GiB less one (props 40): over the 64 MiB maximum, refused before allocation.
+	for _, props := range []byte{36, 40} {
+		crafted := withDictionary(t, body, props)
+		v := &vendor{files: map[string][]byte{"/r.tar.xz": crafted}}
+		base := serveVendor(t, v)
+		var before, after runtime.MemStats
+		runtime.GC()
+		runtime.ReadMemStats(&before)
+		_, err := upstreamArchive(context.Background(), t.TempDir(), catalogue.Artifact{Name: "archive", Kind: "archive",
+			URL: base + "/r.tar.xz", SHA256: sumHex(crafted), Version: "1", Within: "betterbird"}, func(string, string, ...any) {})
+		runtime.ReadMemStats(&after)
+		if err == nil || !strings.Contains(err.Error(), "dictionary") {
+			t.Errorf("props %d: a dictionary over the maximum was not refused: %v", props, err)
+		}
+		if grew := after.TotalAlloc - before.TotalAlloc; grew > 256<<20 {
+			t.Errorf("props %d: %d bytes were allocated for a refused stream", props, grew)
+		}
+	}
+	// The fixture as it is (a small dictionary) still reads.
+	if crafted := withDictionary(t, body, 0); len(crafted) == 0 {
+		t.Fatal("no fixture")
+	}
+}

internal/builder/xz_framing.go

@@ -0,0 +1,290 @@
+package builder
+
+import (
+	"bufio"
+	"bytes"
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"hash/crc32"
+	"io"
+	"os"
+)
+
+// xzBlocksMax and xzStreamsMax are the most blocks and the most concatenated streams an xz file may hold for
+// the build seat to read it.
+//
+// **Why a block count is limited at all.** The xz reader (github.com/therootcompany/xz v1.0.1) keeps one
+// filter decoder for every block that names a delta or BCJ filter, and frees them only when a stream ends:
+// its block counters are reset per stream, not per block. A stream of many tiny blocks therefore grows the
+// heap with its length: an `xz --block-size=1 --delta` file of 6 MB kept about 67 MiB live, which comes to
+// about 5.6 GiB at the 512 MiB download cap (review 68 on mesh-controller pull request 264, hq issue 345).
+//
+// **Why 1,024.** At about 340 bytes of decoder a block, 1,024 blocks keep at most about 0.35 MiB live. A
+// real release is far below it: Betterbird's archive is 1 stream with 1 block, and multi-threaded xz cuts
+// blocks of three times the dictionary (24 MiB at the default preset), so even 512 MiB unpacked in blocks
+// of 512 KiB stays within it. Streams are limited to 16 because a release is one stream; the decoders are
+// reused from one stream to the next, so the stream limit only bounds the work of this walk.
+const (
+	xzBlocksMax  = 1024
+	xzStreamsMax = 16
+)
+
+// xzWithinLimits walks an xz file's framing, without decompressing anything, and refuses one holding more
+// blocks or streams than the build seat reads.
+//
+// **The framing, not the index.** Each stream's index at its end lists its blocks, but the reader compares
+// the index with the blocks only after it has decoded them all, so a file whose index lies would still be
+// decoded block by block. This walk follows the same framing the reader follows: stream header, each block
+// header, the block's LZMA2 chunks (each chunk header carries its own compressed size, so a chunk is skipped
+// without being decoded), its padding and check, then the index and the footer. It counts the blocks the
+// reader would decode, and it also refuses an index whose count of blocks is not the count walked.
+func xzWithinLimits(file string) error {
+	f, err := os.Open(file)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	_, _, err = xzFraming(bufio.NewReader(f))
+	if errors.Is(err, errXzTooManyBlocks) || errors.Is(err, errXzTooManyStreams) {
+		return err
+	}
+	if err != nil {
+		return fmt.Errorf("it is not an xz file this build seat reads: %v", err)
+	}
+	return nil
+}
+
+var (
+	errXzTooManyBlocks = fmt.Errorf("it holds more than %d xz blocks, the most this build seat reads: "+
+		"its xz reader keeps a filter decoder for every block (hq issue 345)", xzBlocksMax)
+	errXzTooManyStreams = fmt.Errorf("it holds more than %d concatenated xz streams, the most this build "+
+		"seat reads", xzStreamsMax)
+)
+
+// xzFraming counts the streams and blocks of an xz file, checking its framing as it goes. It stops with
+// errXzTooManyBlocks or errXzTooManyStreams at the first block or stream over the limit.
+func xzFraming(r *bufio.Reader) (streams, blocks int, err error) {
+	full := func(n int) ([]byte, error) {
+		b := make([]byte, n)
+		if _, err := io.ReadFull(r, b); err != nil {
+			if err == io.EOF {
+				err = io.ErrUnexpectedEOF
+			}
+			return nil, err
+		}
+		return b, nil
+	}
+	skip := func(n int) error {
+		if got, err := r.Discard(n); err != nil || got != n {
+			return io.ErrUnexpectedEOF
+		}
+		return nil
+	}
+	for {
+		header, err := full(12)
+		if err != nil {
+			return streams, blocks, fmt.Errorf("stream %d: header: %v", streams+1, err)
+		}
+		if !bytes.Equal(header[:6], []byte{0xfd, '7', 'z', 'X', 'Z', 0x00}) {
+			return streams, blocks, fmt.Errorf("stream %d: no xz stream header", streams+1)
+		}
+		if header[6] != 0 || header[7]&0xf0 != 0 ||
+			crc32.ChecksumIEEE(header[6:8]) != binary.LittleEndian.Uint32(header[8:12]) {
+			return streams, blocks, fmt.Errorf("stream %d: a corrupt stream header", streams+1)
+		}
+		if streams++; streams > xzStreamsMax {
+			return streams, blocks, errXzTooManyStreams
+		}
+		checkSize := 0
+		if check := int(header[7]); check != 0 {
+			checkSize = 4 << ((check - 1) / 3)
+		}
+		inStream := 0
+		for {
+			first, err := r.ReadByte()
+			if err != nil {
+				return streams, blocks, fmt.Errorf("stream %d: no index: %v", streams, io.ErrUnexpectedEOF)
+			}
+			if first == 0 {
+				break // the index indicator
+			}
+			rest, err := full(int(first)*4 + 3)
+			if err != nil {
+				return streams, blocks, fmt.Errorf("stream %d, block %d: header: %v", streams, inStream+1, err)
+			}
+			if err := xzBlockHeader(append([]byte{first}, rest...)); err != nil {
+				return streams, blocks, fmt.Errorf("stream %d, block %d: %v", streams, inStream+1, err)
+			}
+			inStream++
+			if blocks++; blocks > xzBlocksMax {
+				return streams, blocks, errXzTooManyBlocks
+			}
+			// The block's LZMA2 chunks, up to the end marker.
+			size := 0
+			for {
+				control, err := r.ReadByte()
+				if err != nil {
+					return streams, blocks, fmt.Errorf("stream %d, block %d: %v", streams, inStream, io.ErrUnexpectedEOF)
+				}
+				size++
+				if control == 0 {
+					break
+				}
+				switch {
+				case control == 1 || control == 2: // stored: a 16-bit size less one, then the bytes
+					b, err := full(2)
+					if err != nil {
+						return streams, blocks, err
+					}
+					n := int(binary.BigEndian.Uint16(b)) + 1
+					if err := skip(n); err != nil {
+						return streams, blocks, err
+					}
+					size += 2 + n
+				case control >= 0x80: // LZMA: unpacked and packed sizes, the properties byte on a reset
+					b, err := full(4)
+					if err != nil {
+						return streams, blocks, err
+					}
+					n := int(binary.BigEndian.Uint16(b[2:])) + 1
+					size += 4
+					if control >= 0xc0 {
+						if err := skip(1); err != nil {
+							return streams, blocks, err
+						}
+						size++
+					}
+					if err := skip(n); err != nil {
+						return streams, blocks, err
+					}
+					size += n
+				default:
+					return streams, blocks, fmt.Errorf("stream %d, block %d: an LZMA2 chunk of kind %#x",
+						streams, inStream, control)
+				}
+			}
+			if pad := (4 - size%4) % 4; pad > 0 {
+				b, err := full(pad)
+				if err != nil || !bytes.Equal(b, make([]byte, pad)) {
+					return streams, blocks, fmt.Errorf("stream %d, block %d: corrupt block padding", streams, inStream)
+				}
+			}
+			if err := skip(checkSize); err != nil {
+				return streams, blocks, err
+			}
+		}
+		// The index: its count of records, two numbers each, padding, CRC32.
+		used := 1
+		count, n, err := xzVLI(r)
+		if err != nil {
+			return streams, blocks, fmt.Errorf("stream %d: index: %v", streams, err)
+		}
+		used += n
+		if count != uint64(inStream) {
+			return streams, blocks, fmt.Errorf("stream %d: its index lists %d blocks, but it holds %d",
+				streams, count, inStream)
+		}
+		for i := 0; i < 2*inStream; i++ {
+			_, n, err := xzVLI(r)
+			if err != nil {
+				return streams, blocks, fmt.Errorf("stream %d: index: %v", streams, err)
+			}
+			used += n
+		}
+		if err := skip((4-used%4)%4 + 4); err != nil {
+			return streams, blocks, fmt.Errorf("stream %d: index: %v", streams, err)
+		}
+		footer, err := full(12)
+		if err != nil || footer[10] != 'Y' || footer[11] != 'Z' {
+			return streams, blocks, fmt.Errorf("stream %d: no stream footer", streams)
+		}
+		// Stream padding: zero bytes, a multiple of four, then the end or another stream.
+		zeros := 0
+		for {
+			b, err := r.ReadByte()
+			if err == io.EOF {
+				if zeros%4 != 0 {
+					return streams, blocks, errors.New("stream padding not a multiple of four bytes")
+				}
+				return streams, blocks, nil
+			}
+			if err != nil {
+				return streams, blocks, err
+			}
+			if b != 0 {
+				_ = r.UnreadByte()
+				break
+			}
+			zeros++
+		}
+		if zeros%4 != 0 {
+			return streams, blocks, errors.New("stream padding not a multiple of four bytes")
+		}
+	}
+}
+
+// xzBlockHeader checks one block header: its CRC32, its flags, and that its last filter is LZMA2, the only
+// one whose chunks this walk can skip (and the only last filter the reader decodes).
+func xzBlockHeader(h []byte) error {
+	size := len(h)
+	if crc32.ChecksumIEEE(h[:size-4]) != binary.LittleEndian.Uint32(h[size-4:]) {
+		return errors.New("a corrupt block header")
+	}
+	flags := h[1]
+	if flags&0x3c != 0 {
+		return errors.New("a block header with reserved flags")
+	}
+	body := bytes.NewReader(h[2 : size-4])
+	if flags&0x40 != 0 {
+		if _, _, err := xzVLI(body); err != nil {
+			return err
+		}
+	}
+	if flags&0x80 != 0 {
+		if _, _, err := xzVLI(body); err != nil {
+			return err
+		}
+	}
+	var last uint64
+	for i := 0; i <= int(flags&3); i++ {
+		id, _, err := xzVLI(body)
+		if err != nil {
+			return err
+		}
+		props, _, err := xzVLI(body)
+		if err != nil {
+			return err
+		}
+		if props > uint64(body.Len()) {
+			return errors.New("a corrupt block header")
+		}
+		if _, err := body.Seek(int64(props), io.SeekCurrent); err != nil {
+			return err
+		}
+		last = id
+	}
+	if last != 0x21 {
+		return fmt.Errorf("a block whose last filter is %#x, not LZMA2", last)
+	}
+	return nil
+}
+
+// xzVLI reads one of xz's variable-length integers (at most 9 bytes, 7 bits each), and how many bytes it took.
+func xzVLI(r io.ByteReader) (uint64, int, error) {
+	var v uint64
+	for i := 0; i < 9; i++ {
+		b, err := r.ReadByte()
+		if err != nil {
+			return 0, i, io.ErrUnexpectedEOF
+		}
+		v |= uint64(b&0x7f) << (7 * i)
+		if b&0x80 == 0 {
+			if i > 0 && b == 0 {
+				return 0, i + 1, errors.New("a number not in its shortest form")
+			}
+			return v, i + 1, nil
+		}
+	}
+	return 0, 9, errors.New("a number longer than nine bytes")
+}

internal/builder/xz_framing_test.go

@@ -0,0 +1,207 @@
+package builder
+
+import (
+	"archive/tar"
+	"bufio"
+	"bytes"
+	"context"
+	"encoding/binary"
+	"errors"
+	"hash/crc32"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+)
+
+// xzStream is one xz stream (no integrity check) of data cut into blocks of blockSize bytes, each block's
+// LZMA2 data stored uncompressed, each block a delta filter before LZMA2 when delta is set: the shape of
+// `xz --block-size=N --filters=delta,lzma2`, built without any xz tool. listed is how many blocks its index
+// lists (-1: as many as it holds), so a stream whose index lies can be built too.
+func xzStream(data []byte, blockSize int, delta bool, listed int) []byte {
+	var out bytes.Buffer
+	flags := []byte{0, 0}
+	out.Write([]byte{0xfd, '7', 'z', 'X', 'Z', 0x00})
+	out.Write(flags)
+	out.Write(binary.LittleEndian.AppendUint32(nil, crc32.ChecksumIEEE(flags)))
+	type record struct{ unpadded, uncompressed uint64 }
+	var records []record
+	for at := 0; at < len(data); at += blockSize {
+		block := data[at:min(at+blockSize, len(data))]
+		if delta {
+			// Delta-encoded with a distance of one; the decoder's history starts empty at each block.
+			encoded := make([]byte, len(block))
+			for i := range block {
+				encoded[i] = block[i]
+				if i > 0 {
+					encoded[i] -= block[i-1]
+				}
+			}
+			block = encoded
+		}
+		header := []byte{2, 0} // 12 bytes
+		if delta {
+			header[1] = 1 // two filters
+			header = append(header, 0x03, 0x01, 0x00)
+		}
+		header = append(header, 0x21, 0x01, 0x00) // LZMA2, a 4 KiB dictionary
+		for len(header) < 8 {
+			header = append(header, 0)
+		}
+		header = binary.LittleEndian.AppendUint32(header, crc32.ChecksumIEEE(header))
+		out.Write(header)
+		size := 0
+		for i, chunk := 0, block; len(chunk) > 0; i++ {
+			n := min(len(chunk), 1<<16)
+			control := byte(2)
+			if i == 0 {
+				control = 1 // the first chunk of a block resets the dictionary
+			}
+			out.WriteByte(control)
+			out.Write(binary.BigEndian.AppendUint16(nil, uint16(n-1)))
+			out.Write(chunk[:n])
+			size += 3 + n
+			chunk = chunk[n:]
+		}
+		out.WriteByte(0)
+		size++
+		out.Write(make([]byte, (4-size%4)%4))
+		records = append(records, record{uint64(len(header) + size), uint64(len(block))})
+	}
+	if listed >= 0 {
+		for len(records) < listed {
+			records = append(records, records[0])
+		}
+		records = records[:listed]
+	}
+	vli := func(b []byte, v uint64) []byte {
+		for v >= 0x80 {
+			b = append(b, byte(v)|0x80)
+			v >>= 7
+		}
+		return append(b, byte(v))
+	}
+	index := vli([]byte{0}, uint64(len(records)))
+	for _, r := range records {
+		index = vli(vli(index, r.unpadded), r.uncompressed)
+	}
+	for len(index)%4 != 0 {
+		index = append(index, 0)
+	}
+	index = binary.LittleEndian.AppendUint32(index, crc32.ChecksumIEEE(index))
+	out.Write(index)
+	footer := binary.LittleEndian.AppendUint32(nil, uint32(len(index)/4-1))
+	footer = append(footer, flags...)
+	out.Write(binary.LittleEndian.AppendUint32(nil, crc32.ChecksumIEEE(footer)))
+	out.Write(footer)
+	out.WriteString("YZ")
+	return out.Bytes()
+}
+
+// tarHolding is a tar holding betterbird/data with body.
+func tarHolding(t *testing.T, body []byte) []byte {
+	t.Helper()
+	var out bytes.Buffer
+	w := tar.NewWriter(&out)
+	if err := w.WriteHeader(&tar.Header{Name: "betterbird/data", Mode: 0o644, Size: int64(len(body)),
+		Typeflag: tar.TypeReg}); err != nil {
+		t.Fatal(err)
+	}
+	w.Write(body)
+	if err := w.Close(); err != nil {
+		t.Fatal(err)
+	}
+	return out.Bytes()
+}
+
+func writeTemp(t *testing.T, body []byte) string {
+	t.Helper()
+	file := filepath.Join(t.TempDir(), "r.tar.xz")
+	if err := os.WriteFile(file, body, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	return file
+}
+
+func TestAnXzFileOfAFewDeltaBlocksAndTwoStreamsIsRead(t *testing.T) {
+	// The streams this test builds are ones the reader decodes, so what the walk refuses below is the
+	// same framing the reader follows.
+	body := bytes.Repeat([]byte("betterbird "), 300)
+	whole := tarHolding(t, body)
+	half := len(whole) / 2
+	for name, file := range map[string][]byte{
+		"one stream of delta blocks": xzStream(whole, 512, true, -1),
+		"two streams with padding": append(append(xzStream(whole[:half], 700, true, -1), 0, 0, 0, 0),
+			xzStream(whole[half:], 100, false, -1)...),
+	} {
+		path := writeTemp(t, file)
+		if xzPath, err := exec.LookPath("xz"); err == nil {
+			if out, err := exec.Command(xzPath, "-t", path).CombinedOutput(); err != nil {
+				t.Fatalf("%s: xz itself refuses the built stream: %v %s", name, err, out)
+			}
+		}
+		into := t.TempDir()
+		if err := unpackUpstream(context.Background(), path, into, "betterbird"); err != nil {
+			t.Fatalf("%s: %v", name, err)
+		}
+		got, err := os.ReadFile(filepath.Join(into, "data"))
+		if err != nil || !bytes.Equal(got, body) {
+			t.Fatalf("%s: unpacked %d bytes, want %d: %v", name, len(got), len(body), err)
+		}
+	}
+}
+
+func TestAnXzFileOfManyDeltaBlocksIsRefusedBeforeItIsDecoded(t *testing.T) {
+	// Review 68 on pull request 264: `xz --block-size=1 --delta` of a 200 kB tar kept about 67 MiB live in
+	// the reader, one delta decoder per block. Its index here lists one block, as a file crafted to pass a
+	// check of the index alone would; the walk counts the blocks the reader would decode.
+	body := make([]byte, 200_000)
+	for i := range body {
+		body[i] = byte(i * 7)
+	}
+	crafted := xzStream(tarHolding(t, body), 1, true, 1)
+	path := writeTemp(t, crafted)
+	var before, after runtime.MemStats
+	runtime.GC()
+	runtime.ReadMemStats(&before)
+	err := unpackUpstream(context.Background(), path, t.TempDir(), "betterbird")
+	runtime.ReadMemStats(&after)
+	if err == nil || !strings.Contains(err.Error(), "more than 1024 xz blocks") {
+		t.Fatalf("a file of %d bytes in blocks of one byte was not refused for its blocks: %v", len(crafted), err)
+	}
+	if grew := after.TotalAlloc - before.TotalAlloc; grew > 4<<20 {
+		t.Fatalf("%d bytes were allocated for a refused file", grew)
+	}
+}
+
+func TestTheXzBlockLimitIsExact(t *testing.T) {
+	data := make([]byte, xzBlocksMax+1)
+	streams, blocks, err := xzFraming(bufio.NewReader(bytes.NewReader(xzStream(data[:xzBlocksMax], 1, true, -1))))
+	if err != nil || streams != 1 || blocks != xzBlocksMax {
+		t.Fatalf("%d blocks: %d streams, %d blocks, %v", xzBlocksMax, streams, blocks, err)
+	}
+	if _, _, err := xzFraming(bufio.NewReader(bytes.NewReader(xzStream(data, 1, true, -1)))); !errors.Is(err, errXzTooManyBlocks) {
+		t.Fatalf("%d blocks: %v", xzBlocksMax+1, err)
+	}
+}
+
+func TestAnXzFileOfTooManyStreamsIsRefused(t *testing.T) {
+	var file []byte
+	for i := 0; i <= xzStreamsMax; i++ {
+		file = append(file, xzStream([]byte("x"), 1, false, -1)...)
+	}
+	err := unpackUpstream(context.Background(), writeTemp(t, file), t.TempDir(), "")
+	if err == nil || !strings.Contains(err.Error(), "more than 16 concatenated xz streams") {
+		t.Fatalf("%v", err)
+	}
+}
+
+func TestAnXzIndexThatDoesNotListItsBlocksIsRefused(t *testing.T) {
+	file := xzStream(tarHolding(t, []byte("x")), 512, false, 1)
+	err := unpackUpstream(context.Background(), writeTemp(t, file), t.TempDir(), "betterbird")
+	if err == nil || !strings.Contains(err.Error(), "its index lists 1 blocks, but it holds 4") {
+		t.Fatalf("%v", err)
+	}
+}

internal/catalogue/declaration.go

@@ -246,21 +246,6 @@ type Rendering struct {
 	// statement's contract is link.RootContract or later). To an older, strict engine the field is not
 	// sent, and the account it names is not judged — which the self-check says, as not judged.
 	JudgesRoot bool
-
-	// KeepsFolders says this machine's node-engine gives modules their identities and keeps shared folders
-	// (novox/hq ADR 0325: its statement's contract is link.IdentityContract or later). To an older, strict engine none of
-	// it is sent — no `identities`, no container `identity`, no access `users` or `taken`, no owner derived from an
-	// identity — and what it runs is composed as before.
-	KeepsFolders bool
-	// Identities is each module's allocated identity, by module (ADR 0325 §3): the same on every machine. A module
-	// that declares `identity` and has none here is composed without one, as to an older engine.
-	Identities map[string]ModuleIdentity
-	// KeptFolders is every folder the operator let the mesh keep on this machine (ADR 0325 §8), by its clean path.
-	KeptFolders map[string]bool
-	// AccountUIDs is the user number of each account a tool runner runs as here, where the mesh knows it: an access
-	// names the runner's account only with its number, which the node-engine requires (ADR 0325 §4). Nothing states
-	// it to the controller yet, so it is empty and no runner entry is sent.
-	AccountUIDs map[string]int
 }
 
 // RootField is a user resource's field saying the account must never become root without a person
@@ -335,9 +320,6 @@ type Composed struct {
 	// naming its module and why (novox/hq ADR 0255): that piece is left out and the machine is told
 	// everything else. Push and plan say it; the merge gate refuses a change that adds one.
 	Unplaced []string
-	// Identities is the declaration's `identities` (novox/hq ADR 0325 §3): [{module, name, uid, gid}] for each
-	// module composed with an identity. Empty to an engine that does not keep folders.
-	Identities []map[string]any
 }
 
 // ForeseenSealed is what stands for an own secret a send will make, in a composition asked ahead of
@@ -376,9 +358,7 @@ func (r Resolution) LeftOutBecause(settings SettingsBy, adopted bool) map[string
 			out[m.Module] = &UnreadManifestError{Module: m.Module, said: why}
 			continue
 		}
-		// A placement stored ahead of the build that declares its access is passed by, not a reason to leave the
-		// module out (novox/hq issue 575): it was judged against that build where it was stored.
-		if err := ComposesWith(m, settings[m.Module], adopted); err != nil {
+		if err := JudgeSettings(m, settings[m.Module], adopted); err != nil {
 			out[m.Module] = err
 		}
 	}
@@ -400,8 +380,7 @@ func (r Resolution) Compose(with Rendering) (Composed, error) {
 	received := map[string]map[string][]Contribution{}
 	leftOut := map[string]string{}
 	var foreseen, unplaced []string
-	var identities []ModuleIdentity
-	resources, err := r.compose(with, owner, received, leftOut, &foreseen, &unplaced, &identities)
+	resources, err := r.compose(with, owner, received, leftOut, &foreseen, &unplaced)
 	if err != nil {
 		return Composed{}, err
 	}
@@ -415,12 +394,8 @@ func (r Resolution) Compose(with Rendering) (Composed, error) {
 		})
 	}
 	sort.Strings(unplaced)
-	composed := Composed{Resources: resources, Owner: owner, Received: received, LeftOut: leftOut,
-		Foreseen: foreseen, Unplaced: unplaced}
-	if len(identities) > 0 {
-		composed.Identities = identitiesOf(identities)
-	}
-	return composed, nil
+	return Composed{Resources: resources, Owner: owner, Received: received, LeftOut: leftOut,
+		Foreseen: foreseen, Unplaced: unplaced}, nil
 }
 
 // BusMembershipID names the resource carrying a machine's membership for the new bus, and
@@ -431,7 +406,7 @@ const BusMembershipPath = "/var/lib/mesh/membership-next.json"
 
 func (r Resolution) compose(with Rendering, owner map[string]string,
 	received map[string]map[string][]Contribution, leftOut map[string]string,
-	foreseen, unplaced *[]string, identities *[]ModuleIdentity) ([]map[string]any, error) {
+	foreseen, unplaced *[]string) ([]map[string]any, error) {
 	// **A setting is judged where it is stored, and an impossible one costs a module, not a
 	// machine** (novox/hq ADR 0163, rule 6). A definition that moved under a stored setting makes
 	// this module uncomposable; it is left out of the declaration — its held things kept, its
@@ -578,16 +553,6 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 		}
 		resources := m.Resources
 
-		// The identity it runs as here (novox/hq ADR 0325 §3, §11): none to an older engine, nor without an allocation.
-		ident, hasIdent, err := identityFor(m, with)
-		if err != nil {
-			return nil, err
-		}
-		if hasIdent && identities != nil {
-			*identities = append(*identities, ident)
-		}
-		mountedByIdentity := dirsMountedByIdentity(m)
-
 		// What the mesh computes for this module goes FIRST, before the module's own resources.
 		//
 		// **Order is stated, not derived — the host does not sort** (novox/hq ADR 0005), so
@@ -1038,11 +1003,6 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 				return nil, err
 			}
 			ownerInto(copied, placed)
-			// And its identity (novox/hq ADR 0325 §2, §3): a container's resolved, or taken out where none is composed;
-			// the owner of a directory its identity's containers mount. After the placement's owner: the identity wins.
-			if err := identityInto(copied, m, ident, hasIdent, mountedByIdentity); err != nil {
-				return nil, err
-			}
 			// **After settings, and that is the whole reason it is here.** A module's file
 			// content is where a setting lands, so a placeholder may only exist once the setting
 			// has been put in — filling secrets first would look at content that is not yet what
@@ -1160,12 +1120,6 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 			out = append(out, copied)
 		}
 
-		// **Who uses each of its shared folders** (novox/hq ADR 0325 §4, §5, §8): the access's `users` and `taken`, to
-		// an engine that keeps folders.
-		if with.KeepsFolders {
-			usersInto(out, owner, m, ident, hasIdent, r.toolsAccount(m, with), with)
-		}
-
 		// **What only the mesh knows, where this module asked for it.** The graph is the control
 		// plane's; making a name resolve is the module's software. Emitted as ordinary files under
 		// this module's name, so they are applied, reported and removed exactly as anything else

internal/catalogue/manifest.go

@@ -1860,8 +1860,6 @@ func ParseManifest(raw []byte) (Manifest, error) {
 	problems = append(problems, replacesProblems(m)...)
 	problems = append(problems, UnitSettingProblems(m)...)
 	problems = append(problems, OwnerSettingProblems(m)...)
-	// How each container's image is told who to run as, and what a module that says so is held to (novox/hq ADR 0325).
-	problems = append(problems, identityProblems(m)...)
 	problems = append(problems, endpointNameProblems(m)...)
 	problems = append(problems, RouteProblems(m)...)
 	for _, port := range m.Guards {

internal/catalogue/module_identity.go

@@ -1,514 +0,0 @@
-package catalogue
-
-import (
-	"fmt"
-	"path/filepath"
-	"regexp"
-	"sort"
-	"strings"
-)
-
-// Every module is given an identity of its own, and a container that declares `identity` runs as it (novox/hq ADR
-// 0325 §2, §3, §11).
-//
-// **The manifest says how its image is told who to run as, and nothing else.** A container resource may declare
-// `identity`: `{"user": "env:PUID", "group": "env:PGID"}` for an image that reads its user and group from its
-// environment, or `{"user": "run"}` for the container runtime's own user option. It is the image's interface, as its
-// ports are. The mesh fills it in: the controller allocates the module one user and group number, mesh-wide, once,
-// from a range of its own (IdentityLow–IdentityHigh), and the node-engine makes the account `mesh-<module>` on each
-// machine the module is assigned to and tells the image those numbers.
-//
-// **The range is 50000–59999, and a module's user and group numbers are one number.** Chosen above the numbers
-// distributions give people (1000 up) and below the 60000s Debian keeps for its own daemons, and far from root's 0
-// and every root group a distribution ships (0, adm's 4, wheel's 10): no number in it is 0 or a root group's, so §11
-// holds by the range alone, and the store refuses a row outside it. Both numbers come from one sequence, so a
-// module's uid and gid are equal; a number once given is never given again, even after the module is forgotten
-// (the store keeps the row, inventory.AllocateIdentity).
-//
-// **What the controller sends, and only to an engine that reads it** (Rendering.KeepsFolders: its statement's
-// contract is link.IdentityContract or later):
-//
-//   - the declaration's `identities`: [{module, name, uid, gid}] for each module of the machine that declares
-//     `identity` on a container;
-//   - a container's `identity` resolved: {"mode": "env", "user_env", "group_env", "uid", "gid"} or {"mode": "run",
-//     "uid", "gid"};
-//   - the owner of each of the module's directories a container declaring `identity` mounts: the identity's
-//     uid:gid (§3). A directory only a process or the tools write keeps the owner it had: what writes it is not the
-//     identity, and owning it by the identity would lock its writer out;
-//   - an access's `users`: the module's identity where a container of it that declares `identity` mounts the
-//     access, and the tool runner's account where the module's tools run there and the account's number is known,
-//     each at the access's use — the node-engine keeps one entry per user on a folder at the widest use any access
-//     to it gives (§4, §5), so the runner's entry is the widest of the modules whose tools use it; and `taken`,
-//     whether the operator let the mesh keep that folder on that machine (§8).
-//
-// To an older engine none of it is sent, and a container's `identity` is taken out: it runs as its image says, as
-// before. A module that declares no `identity` is composed exactly as before, on any engine.
-
-// The range module identities are allocated from (novox/hq ADR 0325 §3, §11). The store holds the same bounds.
-const (
-	IdentityLow  = 50000
-	IdentityHigh = 59999
-)
-
-// AllocatableID says whether n is a number the mesh may give a module's identity: inside the range, so never 0
-// nor a root group's.
-func AllocatableID(n int) bool { return n >= IdentityLow && n <= IdentityHigh }
-
-// IdentityField is a container resource's field saying how its image is told who to run as.
-const IdentityField = "identity"
-
-// The two ways an image is told who to run as.
-const (
-	IdentityEnv = "env"
-	IdentityRun = "run"
-)
-
-// IdentitySpec is a container's `identity` as its manifest declares it.
-type IdentitySpec struct {
-	// Mode is IdentityEnv or IdentityRun.
-	Mode string
-	// UserEnv and GroupEnv are the environment variables an env image reads, such as PUID and PGID.
-	UserEnv, GroupEnv string
-}
-
-// ModuleIdentity is one module's allocated identity: its numbers, the same on every machine.
-type ModuleIdentity struct {
-	Module string
-	UID    int
-	GID    int
-}
-
-// IdentityName is the account a module's identity is on every machine it is assigned to.
-func IdentityName(module string) string { return "mesh-" + module }
-
-// Where an access's user comes from (novox/hq ADR 0325 §4, §5).
-const (
-	FromContainer  = "container"
-	FromToolRunner = "tool-runner"
-)
-
-// AccessUser is one identity that uses a shared folder, as an access's `users` names it (mesh-host internal/declaration
-// AccessUser): the account, its user number, the use, and where it runs. The node-engine refuses a user with no
-// number, so the tool runner's account is named only where its number is known (Rendering.AccountUIDs).
-type AccessUser struct {
-	Identity string `json:"identity"`
-	UID      int    `json:"uid"`
-	Use      string `json:"use"`
-	From     string `json:"from"`
-}
-
-var envName = regexp.MustCompile(`^[A-Z_][A-Z0-9_]*$`)
-
-// ParseIdentity reads a container's `identity`, or refuses it in words.
-func ParseIdentity(v any) (IdentitySpec, error) {
-	fields, ok := v.(map[string]any)
-	if !ok {
-		return IdentitySpec{}, fmt.Errorf("identity is {\"user\": \"env:<NAME>\", \"group\": \"env:<NAME>\"} or " +
-			"{\"user\": \"run\"}")
-	}
-	for k := range fields {
-		if k != "user" && k != "group" {
-			return IdentitySpec{}, fmt.Errorf("identity says %q, and it says only how the image is told its user "+
-				"and group: \"user\" and \"group\", never an owner or a number (%s §1, §2)", k, ADR0325)
-		}
-	}
-	user, _ := fields["user"].(string)
-	group, hasGroup := fields["group"]
-	switch {
-	case user == IdentityRun:
-		if hasGroup {
-			return IdentitySpec{}, fmt.Errorf("identity {\"user\": \"run\"} takes no group: the runtime's user " +
-				"option carries both numbers")
-		}
-		return IdentitySpec{Mode: IdentityRun}, nil
-	case strings.HasPrefix(user, "env:"):
-		g, _ := group.(string)
-		if !strings.HasPrefix(g, "env:") {
-			return IdentitySpec{}, fmt.Errorf("identity names its user as %q and its group as %v; an image told "+
-				"its user by its environment is told its group the same way, \"env:<NAME>\"", user, group)
-		}
-		u, gr := strings.TrimPrefix(user, "env:"), strings.TrimPrefix(g, "env:")
-		if !envName.MatchString(u) || !envName.MatchString(gr) || u == gr {
-			return IdentitySpec{}, fmt.Errorf("identity names the variables %q and %q; each is an environment "+
-				"variable's name, upper-case letters, digits and underscores, and the two differ", u, gr)
-		}
-		return IdentitySpec{Mode: IdentityEnv, UserEnv: u, GroupEnv: gr}, nil
-	}
-	return IdentitySpec{}, fmt.Errorf("identity says its user is %q; it is \"env:<NAME>\" or \"run\"", user)
-}
-
-// DeclaresIdentity says a module has a container that declares `identity`: it is given one (§3).
-func DeclaresIdentity(m Manifest) bool {
-	for _, r := range m.Resources {
-		if fmt.Sprint(r["type"]) == "container" {
-			if _, has := r[IdentityField]; has {
-				return true
-			}
-		}
-	}
-	return false
-}
-
-// containerMounts is what a container of the manifest mounts, read from its volumes as written: the module's own
-// directories by id, and its accesses by id — or, for a literal source, as "path:<path>".
-func containerMounts(r map[string]any) (dirs, accesses []string) {
-	volumes, _ := r["volumes"].([]any)
-	for _, v := range volumes {
-		s, _ := v.(string)
-		source := volumeSource(s)
-		if strings.HasPrefix(source, "/") {
-			accesses = append(accesses, "path:"+filepath.Clean(source))
-			continue
-		}
-		for _, m := range dirRef.FindAllStringSubmatch(source, -1) {
-			dirs = append(dirs, m[1])
-		}
-		for _, m := range accessRef.FindAllStringSubmatch(source, -1) {
-			accesses = append(accesses, m[1])
-		}
-	}
-	return dirs, accesses
-}
-
-// volumeSource is a volume's source as written: up to its first colon outside a ${…} placeholder, so
-// "${dir:config}:/config" is "${dir:config}".
-func volumeSource(v string) string {
-	depth := 0
-	for i, r := range v {
-		switch {
-		case r == '{' && i > 0 && v[i-1] == '$':
-			depth++
-		case r == '}' && depth > 0:
-			depth--
-		case r == ':' && depth == 0:
-			return v[:i]
-		}
-	}
-	return v
-}
-
-// accessMode is the mode an access a container mounts was declared at, by id or by "path:<path>"; "" when the
-// manifest declares no such access.
-func accessMode(m Manifest, ref string) string {
-	for _, a := range m.Accesses {
-		if (a.ID != "" && a.ID == ref) || (a.Path != "" && ref == "path:"+filepath.Clean(a.Path)) {
-			return a.At()
-		}
-	}
-	return ""
-}
-
-// ADR0325 is how the module check names the decision its identity rules come from.
-const ADR0325 = "novox/hq ADR 0325"
-
-// identityProblems is what the module check refuses of a manifest's identities (novox/hq ADR 0325 §1, §2, §3):
-//
-//   - an `identity` on anything but a container, or one that is neither env:<NAME> for both nor run;
-//   - **in a module that declares `identity` on a container** — it says it runs as its own identity, so it is held
-//     to the decision whole: a directory of it naming an owner (§1, §3), and a container of it that declares none
-//     and mounts one of the module's directories or a read-write access (§2).
-//
-// A module that declares no `identity` is warned of the last two (IdentityWarnings), never refused for them yet:
-// every registered container module mounts its own directories without one, and refusing them would stop the
-// catalogues composing before they can migrate. **This is the narrowest rule that breaks nothing registered**: no
-// registered manifest declares `identity`, so no registered module is refused anything new.
-func identityProblems(m Manifest) []string {
-	var problems []string
-	for _, r := range m.Resources {
-		v, has := r[IdentityField]
-		if !has {
-			continue
-		}
-		if fmt.Sprint(r["type"]) != "container" {
-			problems = append(problems, fmt.Sprintf("%s: %v is a %v and says identity; only a container says how its "+
-				"image is told who to run as (%s §2)", m.Module, r["id"], r["type"], ADR0325))
-			continue
-		}
-		if _, err := ParseIdentity(v); err != nil {
-			problems = append(problems, fmt.Sprintf("%s: the container %v: %v (%s §2)", m.Module, r["id"], err, ADR0325))
-		}
-	}
-	if !DeclaresIdentity(m) {
-		return problems
-	}
-	return append(problems, identityRules(m)...)
-}
-
-// IdentityWarnings is what the module check warns of a module that declares no `identity` (novox/hq ADR 0325): each
-// thing the decision refuses once the module migrates, said now so the catalogues can. Refusing comes when no
-// registered module still does any of it. Empty for a module that declares `identity`: it is refused these instead.
-func IdentityWarnings(m Manifest) []string {
-	if DeclaresIdentity(m) {
-		return nil
-	}
-	var out []string
-	for _, p := range identityRules(m) {
-		out = append(out, p+"; accepted while registered modules still do it, refused once they have moved")
-	}
-	return out
-}
-
-// identityRules is every place a manifest breaks what ADR 0325 §1–§3 refuse: a directory naming an owner, and a
-// container declaring no identity that mounts the module's own directory or a read-write access.
-func identityRules(m Manifest) []string {
-	var out []string
-	for _, r := range m.Resources {
-		switch fmt.Sprint(r["type"]) {
-		case "directory":
-			if owner, said := r["owner"]; said {
-				out = append(out, fmt.Sprintf("%s: the directory %v names its owner %v; a directory a module owns is "+
-					"owned by the module's identity, and no manifest names an owner (%s §1, §3)", m.Module, r["id"],
-					owner, ADR0325))
-			}
-		case "container":
-			if _, has := r[IdentityField]; has {
-				continue
-			}
-			dirs, accesses := containerMounts(r)
-			seen := map[string]bool{}
-			for _, d := range dirs {
-				if !seen[d] {
-					seen[d] = true
-					out = append(out, fmt.Sprintf("%s: the container %v declares no identity and mounts the module's "+
-						"own directory %s; only a container that declares identity mounts its module's directories, "+
-						"so what writes them is the module's identity (%s §2)", m.Module, r["id"], d, ADR0325))
-				}
-			}
-			for _, a := range accesses {
-				if accessMode(m, a) == AccessReadWrite && !seen["access:"+a] {
-					seen["access:"+a] = true
-					out = append(out, fmt.Sprintf("%s: the container %v declares no identity and mounts the read-write "+
-						"access %s; a container that runs as its image says is given no entry on a shared folder, so "+
-						"it is refused write (%s §2)", m.Module, r["id"], strings.TrimPrefix(a, "path:"), ADR0325))
-				}
-			}
-		}
-	}
-	return out
-}
-
-// PlacesOwnerProblem refuses an owner a `places` setting names for a module that declares `identity` (novox/hq ADR
-// 0325 §1, §3): its directories are owned by its identity. Nil for a module that declares none, whose placed owner
-// is still applied, and warned of by PlacesOwnerWarnings.
-func PlacesOwnerProblem(m Manifest, layers []Layer) error {
-	if !DeclaresIdentity(m) {
-		return nil
-	}
-	if owned := placedOwners(m, layers); len(owned) > 0 {
-		return fmt.Errorf("%s places %s with an owner, and declares identity: its directories are owned by its "+
-			"identity, and no setting names an owner (%s §1, §3)", m.Module, strings.Join(owned, ", "), ADR0325)
-	}
-	return nil
-}
-
-// PlacesOwnerWarnings is a warning for each directory a `places` setting gives an owner, for a module that declares
-// no `identity` (novox/hq ADR 0325 §1): accepted while registered modules still do it, refused once they have moved.
-func PlacesOwnerWarnings(m Manifest, layers []Layer) []string {
-	if DeclaresIdentity(m) {
-		return nil
-	}
-	var out []string
-	for _, id := range placedOwners(m, layers) {
-		out = append(out, fmt.Sprintf("warning: %s's setting places.%s.owner names an owner; a directory a module owns "+
-			"is owned by the module's identity, and no setting names an owner (%s §1, §3). Accepted while "+
-			"registered modules still do it, refused once they have moved", m.Module, id, ADR0325))
-	}
-	return out
-}
-
-func placedOwners(m Manifest, layers []Layer) []string {
-	placed, err := Places(m, layers)
-	if err != nil {
-		// empty-on-error: a placement Places refuses is refused by name where it is judged and composed; it names no owner here
-		return nil
-	}
-	var out []string
-	for id, p := range placed {
-		if p.Owner != "" {
-			out = append(out, id)
-		}
-	}
-	sort.Strings(out)
-	return out
-}
-
-// resolvedIdentity is a container's `identity` as the node-engine is told it: the mode, the variables an env image
-// reads, and the module's numbers.
-func resolvedIdentity(spec IdentitySpec, id ModuleIdentity) map[string]any {
-	out := map[string]any{"mode": spec.Mode, "uid": id.UID, "gid": id.GID}
-	if spec.Mode == IdentityEnv {
-		out["user_env"], out["group_env"] = spec.UserEnv, spec.GroupEnv
-	}
-	return out
-}
-
-// identityFor is the identity module m runs as here, and whether one is composed: a module that declares `identity`,
-// to an engine that keeps folders, with an allocation the composition was given. A number outside the range is
-// refused (§11), never sent.
-func identityFor(m Manifest, with Rendering) (ModuleIdentity, bool, error) {
-	if !with.KeepsFolders || !DeclaresIdentity(m) {
-		return ModuleIdentity{}, false, nil
-	}
-	id, allocated := with.Identities[m.Module]
-	if !allocated {
-		return ModuleIdentity{}, false, nil
-	}
-	if !AllocatableID(id.UID) || !AllocatableID(id.GID) {
-		return ModuleIdentity{}, false, fmt.Errorf("%s's identity is %d:%d, outside %d–%d: no module identity is root "+
-			"or a root group's, and none is sent (%s §11)", m.Module, id.UID, id.GID, IdentityLow, IdentityHigh, ADR0325)
-	}
-	id.Module = m.Module
-	return id, true, nil
-}
-
-// identityInto composes one resource of module m for its identity: a container's `identity` resolved, or taken out
-// where none is composed; and the owner of a directory one of its identity's containers mounts.
-func identityInto(resource map[string]any, m Manifest, id ModuleIdentity, has bool, mountedByIdentity map[string]bool) error {
-	switch fmt.Sprint(resource["type"]) {
-	case "container":
-		v, declared := resource[IdentityField]
-		if !declared {
-			return nil
-		}
-		if !has {
-			delete(resource, IdentityField)
-			return nil
-		}
-		spec, err := ParseIdentity(v)
-		if err != nil {
-			return fmt.Errorf("%s: the container %v: %w", m.Module, resource["id"], err)
-		}
-		resource[IdentityField] = resolvedIdentity(spec, id)
-	case "directory":
-		if has && mountedByIdentity[fmt.Sprint(resource["id"])] {
-			resource["owner"] = fmt.Sprintf("%d:%d", id.UID, id.GID)
-		}
-	}
-	return nil
-}
-
-// dirsMountedByIdentity is the ids of module m's directories one of its containers declaring `identity` mounts.
-func dirsMountedByIdentity(m Manifest) map[string]bool {
-	out := map[string]bool{}
-	for _, r := range m.Resources {
-		if fmt.Sprint(r["type"]) != "container" {
-			continue
-		}
-		if _, has := r[IdentityField]; !has {
-			continue
-		}
-		dirs, _ := containerMounts(r)
-		for _, d := range dirs {
-			out[d] = true
-		}
-	}
-	return out
-}
-
-// identitiesOf is the declaration's `identities`, by module.
-func identitiesOf(ids []ModuleIdentity) []map[string]any {
-	sort.Slice(ids, func(i, j int) bool { return ids[i].Module < ids[j].Module })
-	out := make([]map[string]any, 0, len(ids))
-	for _, id := range ids {
-		out = append(out, map[string]any{"module": id.Module, "name": IdentityName(id.Module), "uid": id.UID,
-			"gid": id.GID})
-	}
-	return out
-}
-
-// toolsAccount is the account module m's tools run as on this machine, or empty where they run nowhere as one: no
-// runtime here, no bundle it loads, or a module left out of an adopted machine's declaration.
-func (r Resolution) toolsAccount(m Manifest, with Rendering) string {
-	if !r.runtimeHere() || (with.Adopted && m.Filtering != nil) {
-		return ""
-	}
-	loads := false
-	for _, b := range m.Bundles {
-		if len(b.Loads) > 0 {
-			loads = true
-		}
-	}
-	if !loads {
-		return ""
-	}
-	if m.RunsAs != "" {
-		return m.RunsAs
-	}
-	return r.Account
-}
-
-// usersInto writes `users` and `taken` on every access of module m among the resources composed so far: its identity
-// where a container of it that declares `identity` mounts the access's path, and the tool runner's account where the
-// module's tools run as it and its number is known, each at the access's use (§4: the engine keeps the widest).
-func usersInto(out []map[string]any, owner map[string]string, m Manifest, id ModuleIdentity, has bool, account string,
-	with Rendering) {
-	var containers []map[string]any
-	for _, res := range out {
-		if res["type"] == "container" && owner[fmt.Sprint(res["id"])] == m.Module {
-			if _, declares := res[IdentityField]; declares && has {
-				containers = append(containers, res)
-			}
-		}
-	}
-	runnerUID, runnerKnown := with.AccountUIDs[account]
-	for _, res := range out {
-		if res["type"] != "access" || owner[fmt.Sprint(res["id"])] != m.Module {
-			continue
-		}
-		path, _ := res["path"].(string)
-		mode, _ := res["mode"].(string)
-		if mode == "" {
-			mode = AccessRead
-		}
-		users := []AccessUser{}
-		for _, c := range containers {
-			if mounts(c, path) {
-				users = append(users, AccessUser{Identity: IdentityName(m.Module), UID: id.UID, Use: mode, From: FromContainer})
-				break // one identity per module, whichever of its containers mounts it
-			}
-		}
-		if account != "" && runnerKnown && runnerUID > 0 {
-			users = append(users, AccessUser{Identity: account, UID: runnerUID, Use: mode, From: FromToolRunner})
-		}
-		if len(users) > 0 {
-			res["users"] = users
-		}
-		res["taken"] = with.KeptFolders[filepath.Clean(path)]
-	}
-}
-
-// mounts says whether a composed container mounts path, or something below it, from the machine. A path that merely
-// begins with the same letters — /storage/media2 beside /storage/media — is another path.
-func mounts(container map[string]any, path string) bool {
-	volumes, _ := container["volumes"].([]any)
-	path = filepath.Clean(path)
-	for _, v := range volumes {
-		s, ok := v.(string)
-		if !ok {
-			continue
-		}
-		source, _, _ := strings.Cut(s, ":")
-		if !strings.HasPrefix(source, "/") {
-			continue // a named volume: the runtime's, not the operator's path
-		}
-		source = filepath.Clean(source)
-		if source == path || strings.HasPrefix(source, path+"/") {
-			return true
-		}
-	}
-	return false
-}
-
-// AccessPathOn is where access id of module m is on a machine with these settings: its placement, else the
-// definition's default; false where neither says, or the module declares no such access.
-func AccessPathOn(m Manifest, layers []Layer, id string) (string, bool) {
-	_, byID, err := accessesFor(m, layers)
-	if err != nil {
-		return "", false
-	}
-	path, has := byID[id]
-	if !has || path == "" {
-		return "", false
-	}
-	return filepath.Clean(path), true
-}

internal/catalogue/module_identity_test.go

@@ -1,339 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"fmt"
-	"sort"
-	"strings"
-	"testing"
-
-	"github.com/novox/mesh-host/validate"
-)
-
-// Defends novox/hq ADR 0325 on the controller's side, row by row of its "How it is checked" table: the module check
-// (rows 1, 2), the identity composed (row 3), the tool runner's entry (row 4), no identity root (row 11) — and none
-// of it sent to a node-engine older than the contract, which would refuse the whole declaration.
-
-const identityImage = "x@sha256:1111111111111111111111111111111111111111111111111111111111111111"
-
-// aLibrarian files films: a container told its identity by PUID and PGID that mounts its config and the movies it
-// writes; a sidecar that declares none and reads the music; a directory only its tools write; and tools served by the
-// machine's runtime.
-func aLibrarian(t *testing.T) Manifest {
-	t.Helper()
-	m := aToolsModule(t, "librarian", "tools/index.js")
-	m.Accesses = []Access{
-		{ID: "movies", Path: "/storage/media/movies", Mode: AccessReadWrite},
-		{ID: "music", Path: "/storage/media/music", Mode: AccessRead},
-	}
-	m.Resources = []map[string]any{
-		{"id": "config", "type": "directory", "mode": "0750"},
-		{"id": "notes", "type": "directory", "mode": "0700"},
-		{"id": "app", "type": "container", "name": "librarian", "image": identityImage,
-			"identity": map[string]any{"user": "env:PUID", "group": "env:PGID"},
-			"volumes":  []any{"${dir:config}:/config", "${access:movies}:/movies"}},
-		{"id": "sidecar", "type": "container", "name": "librarian-sidecar", "image": identityImage,
-			"volumes": []any{"${access:music}:/music:ro"}},
-	}
-	return m
-}
-
-// aPlayer reads the movies the librarian writes, as its own identity through the runtime's user option, and has
-// tools of its own that read them too.
-func aPlayer(t *testing.T) Manifest {
-	t.Helper()
-	m := aToolsModule(t, "player", "tools/index.js")
-	m.Accesses = []Access{{ID: "movies", Path: "/storage/media/movies", Mode: AccessRead}}
-	m.Resources = []map[string]any{
-		{"id": "app", "type": "container", "name": "player", "image": identityImage,
-			"identity": map[string]any{"user": "run"}, "volumes": []any{"${access:movies}:/movies:ro"}},
-	}
-	return m
-}
-
-func keepingFolders(ids map[string]ModuleIdentity, kept ...string) Rendering {
-	with := Rendering{KeepsFolders: true, Identities: ids, KeptFolders: map[string]bool{}}
-	for _, k := range kept {
-		with.KeptFolders[k] = true
-	}
-	return with
-}
-
-func composeFolders(t *testing.T, r Resolution, with Rendering) Composed {
-	t.Helper()
-	with.Needed = map[string]map[string]string{RuntimeModule: {"broker": "sealed-credential"}}
-	with.ArtifactStore = "anchor.internal:5101"
-	composed, err := r.Compose(with)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return composed
-}
-
-var identities = map[string]ModuleIdentity{"librarian": {UID: 50001, GID: 50001}, "player": {UID: 50002, GID: 50002}}
-
-// Row 3: the identity composed — the same on every machine, the container told it, the module's directories its
-// containers mount owned by it, and the declaration's identities naming the account.
-func TestAModuleRunsAsItsIdentityTheSameOnEveryMachine(t *testing.T) {
-	var seen []string
-	for _, node := range []string{"ace", "novox"} {
-		r := Resolution{Node: node, Account: "jochen", Modules: []Manifest{aLibrarian(t), aPlayer(t), theRuntime(t)}}
-		composed := composeFolders(t, r, keepingFolders(identities))
-		got := byID(composed.Resources)
-
-		app := got["librarian.app"]
-		ident, _ := app[IdentityField].(map[string]any)
-		want := map[string]any{"mode": "env", "user_env": "PUID", "group_env": "PGID", "uid": 50001, "gid": 50001}
-		if fmt.Sprint(ident) != fmt.Sprint(want) {
-			t.Errorf("%s: the container is told %v; want %v", node, ident, want)
-		}
-		player, _ := got["player.app"][IdentityField].(map[string]any)
-		if fmt.Sprint(player) != fmt.Sprint(map[string]any{"mode": "run", "uid": 50002, "gid": 50002}) {
-			t.Errorf("%s: the player is told %v", node, player)
-		}
-		if _, has := got["librarian.sidecar"][IdentityField]; has {
-			t.Errorf("%s: a container declaring no identity was given one", node)
-		}
-		if owner := got["librarian.config"]["owner"]; owner != "50001:50001" {
-			t.Errorf("%s: the directory its identity's container mounts is owned by %v", node, owner)
-		}
-		if owner, has := got["librarian.notes"]["owner"]; has {
-			t.Errorf("%s: a directory no identity container mounts was given the owner %v: what writes it is not "+
-				"the identity", node, owner)
-		}
-		raw, _ := json.Marshal(composed.Identities)
-		seen = append(seen, string(raw))
-		if !strings.Contains(string(raw), `"name":"mesh-librarian"`) || !strings.Contains(string(raw), `"uid":50001`) {
-			t.Errorf("%s: the declaration's identities are %s", node, raw)
-		}
-	}
-	// What the node-engine this controller pins (the ADR 0325 half) makes of it: nothing refused.
-	r := Resolution{Node: "ace", Account: "jochen", Modules: []Manifest{aLibrarian(t), aPlayer(t), theRuntime(t)}}
-	with := keepingFolders(identities, "/storage/media/movies")
-	with.AccountUIDs = map[string]int{"jochen": 1000}
-	composed := composeFolders(t, r, with)
-	body, err := json.Marshal(map[string]any{"declaration": validate.Version, "resources": composed.Resources,
-		"identities": composed.Identities})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if problems := validate.Declaration(body); len(problems) > 0 {
-		t.Fatalf("the pinned node-engine refuses it: %v", problems)
-	}
-	if seen[0] != seen[1] {
-		t.Fatalf("the identities differ between machines: %s and %s", seen[0], seen[1])
-	}
-}
-
-// Rows 2, 4 and 8's composed part: each access names its users — the module's identity where a container declaring
-// identity mounts it, never a container declaring none — and the tool runner's account where its number is known,
-// each at the access's own use (the node-engine keeps one entry per user at the widest use any access gives it, so
-// the runner's is the widest among the modules whose tools use the folder); and whether the folder is taken.
-func TestAnAccessNamesItsUsers(t *testing.T) {
-	r := Resolution{Node: "ace", Account: "jochen", Modules: []Manifest{aLibrarian(t), aPlayer(t), theRuntime(t)}}
-	with := keepingFolders(identities, "/storage/media/movies")
-	with.AccountUIDs = map[string]int{"jochen": 1000}
-	got := byID(composeFolders(t, r, with).Resources)
-
-	users := func(id string) string {
-		raw, _ := json.Marshal(got[id]["users"])
-		return string(raw)
-	}
-	movies := "librarian." + AccessID("/storage/media/movies")
-	if want := `[{"identity":"mesh-librarian","uid":50001,"use":"read-write","from":"container"},` +
-		`{"identity":"jochen","uid":1000,"use":"read-write","from":"tool-runner"}]`; users(movies) != want {
-		t.Errorf("the librarian's movies name %s; want %s", users(movies), want)
-	}
-	played := "player." + AccessID("/storage/media/movies")
-	if want := `[{"identity":"mesh-player","uid":50002,"use":"read","from":"container"},` +
-		`{"identity":"jochen","uid":1000,"use":"read","from":"tool-runner"}]`; users(played) != want {
-		t.Errorf("the player's movies name %s; want %s", users(played), want)
-	}
-	// The sidecar declares no identity: no entry for it (§2); the runner reads the music for the librarian's tools.
-	music := "librarian." + AccessID("/storage/media/music")
-	if want := `[{"identity":"jochen","uid":1000,"use":"read","from":"tool-runner"}]`; users(music) != want {
-		t.Errorf("the music names %s; want only the tool runner's read", users(music))
-	}
-	if got[movies]["taken"] != true || got[music]["taken"] != false {
-		t.Errorf("taken is %v for the movies (taken) and %v for the music (not)", got[movies]["taken"], got[music]["taken"])
-	}
-
-	// The runner's number unknown: no entry for it, never one the engine refuses for uid 0.
-	got = byID(composeFolders(t, r, keepingFolders(identities)).Resources)
-	if want := `[{"identity":"mesh-librarian","uid":50001,"use":"read-write","from":"container"}]`; users(movies) != want {
-		t.Errorf("with no number for the runner's account, the movies name %s; want %s", users(movies), want)
-	}
-	if _, has := got[music]["users"]; has {
-		t.Errorf("an access nobody with a known number uses names users: %s", users(music))
-	}
-}
-
-// The contract: to an engine that does not state link.IdentityContract nothing of ADR 0325 is sent — no identities, no
-// container identity, no users, no taken, no owner from an identity — and what is sent is what the pinned node-engine
-// accepts, as before.
-func TestNothingOfTheIdentityIsSentToAnOlderEngine(t *testing.T) {
-	r := Resolution{Node: "ace", Account: "jochen", Modules: []Manifest{aLibrarian(t), aPlayer(t), theRuntime(t)}}
-	composed := composeFolders(t, r, Rendering{Identities: identities})
-	if len(composed.Identities) > 0 {
-		t.Fatalf("identities were composed for an older engine: %v", composed.Identities)
-	}
-	for _, res := range composed.Resources {
-		for _, field := range []string{IdentityField, "users", "taken"} {
-			if _, has := res[field]; has {
-				t.Errorf("%v carries %s for an older engine", res["id"], field)
-			}
-		}
-		if res["id"] == "librarian.config" && res["owner"] != nil {
-			t.Errorf("the directory was given the owner %v for an older engine", res["owner"])
-		}
-	}
-	body, err := json.Marshal(map[string]any{"declaration": validate.Version, "resources": composed.Resources})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if problems := validate.Declaration(body); len(problems) > 0 {
-		t.Fatalf("the pinned node-engine refuses it: %v", problems)
-	}
-	// An engine that keeps folders, with no allocation yet (a question asked before the first send): composed
-	// without an identity, never with a made-up one.
-	none := composeFolders(t, r, keepingFolders(nil))
-	if len(none.Identities) > 0 || byID(none.Resources)["librarian.app"][IdentityField] != nil {
-		t.Fatal("an identity was composed with no allocation")
-	}
-}
-
-// Row 11: no identity outside the range is ever sent — 0 above all — and the composition says why.
-func TestNoModuleIdentityIsRoot(t *testing.T) {
-	for _, n := range []int{0, 4, 10, 1000, IdentityLow - 1, IdentityHigh + 1} {
-		if AllocatableID(n) {
-			t.Errorf("%d is allocatable", n)
-		}
-		r := Resolution{Node: "ace", Account: "jochen", Modules: []Manifest{aLibrarian(t), theRuntime(t)}}
-		with := keepingFolders(map[string]ModuleIdentity{"librarian": {UID: n, GID: n}})
-		with.Needed = map[string]map[string]string{RuntimeModule: {"broker": "sealed-credential"}}
-		with.ArtifactStore = "anchor.internal:5101"
-		if _, err := r.Compose(with); err == nil || !strings.Contains(err.Error(), "§11") {
-			t.Errorf("an identity of %d composed: %v", n, err)
-		}
-	}
-	for _, n := range []int{IdentityLow, IdentityHigh} {
-		if !AllocatableID(n) {
-			t.Errorf("%d is not allocatable", n)
-		}
-	}
-}
-
-func manifestJSON(t *testing.T, m map[string]any) []byte {
-	t.Helper()
-	raw, err := json.Marshal(m)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return raw
-}
-
-func aContainerModule(name string, resources ...map[string]any) map[string]any {
-	return map[string]any{"module": name, "version": "1", "capabilities": []any{"container-runtime"},
-		"accesses":  []any{map[string]any{"id": "movies", "path": "/storage/media/movies", "mode": "read-write"}},
-		"resources": resources}
-}
-
-// Rows 1 and 2: the module check accepts identity as env:<NAME> or run and refuses every other shape and an owner in
-// it; a module that declares identity is refused a directory naming its owner and a container declaring none that
-// mounts its own directory or a read-write access; a directory's mode is accepted.
-func TestTheModuleCheckHoldsAnIdentityModuleToTheDecision(t *testing.T) {
-	ok := func(identity any) map[string]any {
-		return map[string]any{"id": "app", "type": "container", "name": "app", "image": identityImage,
-			"identity": identity, "volumes": []any{"${dir:config}:/config", "${access:movies}:/movies"}}
-	}
-	config := map[string]any{"id": "config", "type": "directory", "mode": "0750"}
-	for _, identity := range []any{
-		map[string]any{"user": "env:PUID", "group": "env:PGID"},
-		map[string]any{"user": "run"},
-	} {
-		if _, err := ParseManifest(manifestJSON(t, aContainerModule("app", config, ok(identity)))); err != nil {
-			t.Errorf("identity %v refused: %v", identity, err)
-		}
-	}
-	for _, c := range []struct {
-		identity any
-		want     string
-	}{
-		{map[string]any{"user": "1000", "group": "1000"}, `"env:<NAME>" or "run"`},
-		{map[string]any{"user": "env:PUID"}, "told its group the same way"},
-		{map[string]any{"user": "run", "group": "env:PGID"}, "takes no group"},
-		{map[string]any{"user": "env:puid", "group": "env:PGID"}, "environment variable's name"},
-		{map[string]any{"user": "env:PUID", "group": "env:PGID", "owner": "1000:1000"}, "never an owner or a number"},
-		{"run", "identity is"},
-	} {
-		_, err := ParseManifest(manifestJSON(t, aContainerModule("app", config, ok(c.identity))))
-		if err == nil || !strings.Contains(err.Error(), c.want) || !strings.Contains(err.Error(), "ADR 0325") {
-			t.Errorf("identity %v: %v, want it refused saying %q", c.identity, err, c.want)
-		}
-	}
-	// An identity on anything but a container.
-	onAFile := map[string]any{"id": "f", "type": "directory", "mode": "0750", "identity": map[string]any{"user": "run"}}
-	if _, err := ParseManifest(manifestJSON(t, aContainerModule("app", onAFile))); err == nil {
-		t.Error("an identity on a directory was accepted")
-	}
-
-	// Held to the decision whole once it declares identity (§1, §2, §3).
-	owned := map[string]any{"id": "config", "type": "directory", "mode": "0750", "owner": "1000:1000"}
-	bare := map[string]any{"id": "helper", "type": "container", "name": "helper", "image": identityImage,
-		"volumes": []any{"${dir:config}:/config", "${access:movies}:/movies"}}
-	_, err := ParseManifest(manifestJSON(t, aContainerModule("app", owned, ok(map[string]any{"user": "run"}), bare)))
-	for _, want := range []string{"names its owner 1000:1000", "declares no identity and mounts the module's own directory config",
-		"declares no identity and mounts the read-write access movies"} {
-		if err == nil || !strings.Contains(err.Error(), want) {
-			t.Errorf("an identity module: %v, want it refused saying %q", err, want)
-		}
-	}
-	// A setting's owner too.
-	settingOwned := map[string]any{"id": "config", "type": "directory", "mode": "0750", "owner": "${setting:puid}:${setting:pgid}"}
-	identityModule := aContainerModule("app", settingOwned, ok(map[string]any{"user": "run"}))
-	identityModule["settings"] = map[string]any{"puid": map[string]any{"default": "1000"}, "pgid": map[string]any{"default": "1000"}}
-	if _, err := ParseManifest(manifestJSON(t, identityModule)); err == nil || !strings.Contains(err.Error(), "names its owner") {
-		t.Errorf("a setting's owner in an identity module: %v", err)
-	}
-}
-
-// Rows 1 and 2 for what is registered today: a module that declares no identity is warned, never refused — a
-// directory naming its owner, a container mounting its own directory or a read-write access — and each warning
-// names ADR 0325. A placement's owner is refused for an identity module and warned of for any other.
-func TestAModuleWithoutIdentityIsWarnedNotRefused(t *testing.T) {
-	owned := map[string]any{"id": "config", "type": "directory", "mode": "0750", "owner": "1000:1000"}
-	bare := map[string]any{"id": "app", "type": "container", "name": "app", "image": identityImage,
-		"volumes": []any{"${dir:config}:/config", "${access:movies}:/movies"}}
-	m, err := ParseManifest(manifestJSON(t, aContainerModule("legacy", owned, bare)))
-	if err != nil {
-		t.Fatalf("a registered shape was refused: %v", err)
-	}
-	warnings := IdentityWarnings(m)
-	sort.Strings(warnings)
-	if len(warnings) != 3 {
-		t.Fatalf("warned %d times: %q", len(warnings), warnings)
-	}
-	for _, w := range warnings {
-		if !strings.Contains(w, "ADR 0325") || !strings.Contains(w, "refused once they have moved") {
-			t.Errorf("a warning that does not name ADR 0325 or say refusal comes later: %q", w)
-		}
-	}
-
-	placed := []Layer{{From: "ace", Values: map[string]any{PlacesSetting: map[string]any{
-		"config": map[string]any{"path": "/srv/legacy", "owner": "1000:1000"}}}}}
-	if err := PlacesOwnerProblem(m, placed); err != nil {
-		t.Errorf("a placement's owner refused for a module without identity: %v", err)
-	}
-	if w := PlacesOwnerWarnings(m, placed); len(w) != 1 || !strings.Contains(w[0], "places.config.owner") {
-		t.Errorf("a placement's owner warned %q", w)
-	}
-	withIdentity := aLibrarian(t)
-	placedLibrarian := []Layer{{From: "ace", Values: map[string]any{PlacesSetting: map[string]any{
-		"config": map[string]any{"path": "/srv/librarian", "owner": "1000:1000"}}}}}
-	if err := PlacesOwnerProblem(withIdentity, placedLibrarian); err == nil || !strings.Contains(err.Error(), "ADR 0325") {
-		t.Errorf("a placement's owner for an identity module: %v", err)
-	}
-	if len(IdentityWarnings(withIdentity)) != 0 {
-		t.Error("an identity module was warned rather than refused")
-	}
-}

internal/catalogue/placement.go

@@ -1,7 +1,6 @@
 package catalogue
 
 import (
-	"errors"
 	"fmt"
 	"path/filepath"
 	"regexp"
@@ -271,31 +270,6 @@ func Places(m Manifest, layers []Layer) (map[string]Placement, error) {
 // It refuses an id the module declares no access under, and a path that is not absolute. An
 // access declared by path alone cannot be placed — it has no name to place it by.
 func AccessPlaces(m Manifest, layers []Layer) (map[string]string, error) {
-	return accessPlaces(m, layers, true)
-}
-
-// UndeclaredAccessError is a layer placing an access the definition does not declare (novox/hq issue 575): refused
-// where a setting is stored, unless a newer build of the module declares it; passed by where a machine is composed.
-type UndeclaredAccessError struct {
-	Module, ID string
-	said       string
-}
-
-func (e *UndeclaredAccessError) Error() string { return e.said }
-
-// UndeclaredAccessPlaces refuses a layer that places an access the definition does not declare.
-func UndeclaredAccessPlaces(m Manifest, layers []Layer) error {
-	_, err := accessPlaces(m, layers, true)
-	var undeclared *UndeclaredAccessError
-	if errors.As(err, &undeclared) {
-		return err
-	}
-	return nil
-}
-
-// accessPlaces is AccessPlaces; where strict is false an access the definition does not declare is passed by
-// (novox/hq issue 575), as a placement stored ahead of the build that declares it.
-func accessPlaces(m Manifest, layers []Layer, strict bool) (map[string]string, error) {
 	declared := map[string]bool{}
 	for _, a := range m.Accesses {
 		if a.ID != "" {
@@ -315,12 +289,9 @@ func accessPlaces(m Manifest, layers []Layer, strict bool) (map[string]string, e
 		}
 		for id, body := range blocks {
 			if !declared[id] {
-				if !strict {
-					continue
-				}
-				return nil, &UndeclaredAccessError{Module: m.Module, ID: id, said: fmt.Sprintf(
+				return nil, fmt.Errorf(
 					"%s places the access %q, which it does not declare — the setting reaches "+
-						"nothing. It declares %s", m.Module, id, orNothing(namesOfAccesses(m)))}
+						"nothing. It declares %s", m.Module, id, orNothing(namesOfAccesses(m)))
 			}
 			path, _ := body.(string)
 			path = strings.TrimSpace(path)
@@ -353,7 +324,7 @@ type placedAccess struct {
 // placed one, the definition's where it carries a default, and refused where neither says — an
 // access that resolves to nowhere would reach the machine as a mount of nothing.
 func accessesFor(m Manifest, layers []Layer) ([]placedAccess, map[string]string, error) {
-	placed, err := accessPlaces(m, layers, false)
+	placed, err := AccessPlaces(m, layers)
 	if err != nil {
 		return nil, nil, err
 	}

internal/catalogue/settings.go

@@ -509,18 +509,6 @@ var networkName = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9_.-]*$`)
 // refused where it is stored (SetSettings, with UnusedSettings) and said where a plan is read,
 // and never costs a module its place.
 func JudgeSettings(m Manifest, layers []Layer, adopted bool) error {
-	if err := UndeclaredAccessPlaces(m, layers); err != nil {
-		return err
-	}
-	return ComposesWith(m, layers, adopted)
-}
-
-// ComposesWith is JudgeSettings for a layer stored ahead of the definition that reads it (novox/hq issue 575): an
-// access placed that this definition does not declare yet is not refused, because composition passes it by — it
-// reaches nothing until the build that declares it registers, and then it places that access. Where a machine is
-// declared (LeftOutBecause), and where a setting judged against a newer build of the module is held to still compose
-// with the one registered.
-func ComposesWith(m Manifest, layers []Layer, adopted bool) error {
 	if err := settingsHoldOneLine(m.Module, layers); err != nil {
 		return err
 	}

internal/catalogue/verbs.go

@@ -116,9 +116,15 @@ var ControllerVerbs = []Verb{
 			"limit":  "how many builds to list (default 20); not with log",
 		}, nil)},
 	{Name: "plans", Description: "What the last merges produced and where each stands (novox/hq ADR 0162): " +
-		"the tiers, the tier a plan is at, what it waits for and since when; one plan whole, given its id.",
+		"the tiers, the tier a plan is at, what it waits for and since when; one plan whole, given its id; " +
+		"or, given wait, one plan followed until it moves.",
 		Input: schema(map[string]string{
-			"id":    "a plan's id (as `plans` lists them): that plan, tier by tier",
+			"id": "a plan's id (as `plans` lists them): that plan, tier by tier",
+			"wait": "a plan's id: wait until it moves, then answer it as data — the plan, and what ended the wait " +
+				"(moved, tier, done, or bound); ask again to follow it further (novox/hq issue 229)",
+			"until": "with wait: moved (any change, the default), tier (it reaches another tier) or done (it ends)",
+			"bound": "with wait: how long to wait at most, as 15s or seconds — 20s, the default, is the longest, " +
+				"inside what a call is answered within",
 			"stop":  "a plan's id: stop it — what was asked still builds, nothing further is asked",
 			"close": "a plan's id: close a plan that will not move again, as failed by hand (novox/hq issue 254)",
 			"retry": "a failed plan's id: ask its failed builds again under new ids, and carry the plan on from that tier (novox/hq ADR 0219)",

internal/inventory/catalogue.go

@@ -958,28 +958,7 @@ func (i *Inventory) judgeSettings(ctx context.Context, nodeName, module string,
 	}
 	layers = append(layers, catalogue.Layer{From: from, Values: values})
 	if err := catalogue.JudgeSettings(m, layers, adopted); err != nil {
-		// **A placement for an access the module's newer build brings** (novox/hq issue 575): judged against the
-		// manifest of the module's newest build on the branch it follows, where the registered one does not declare
-		// the access yet — so an access can be placed before or with the delivery that adds it. It must still compose
-		// with the registered manifest, which passes the placement by until the build registers.
-		var undeclared *catalogue.UndeclaredAccessError
-		if !errors.As(err, &undeclared) {
-			return fmt.Errorf("refused: %s on %s cannot compose with the layer %q — %w", module, where, from, err)
-		}
-		ahead, has, aerr := i.NewestManifestOnBranch(ctx, module)
-		if aerr != nil {
-			return aerr
-		}
-		if !has || catalogue.JudgeSettings(ahead, layers, adopted) != nil || catalogue.ComposesWith(m, layers, adopted) != nil {
-			return fmt.Errorf("refused: %s on %s cannot compose with the layer %q — %w; nor does the newest build of "+
-				"%s on the branch it follows declare it", module, where, from, err, module)
-		}
-		m = ahead
-	}
-	// A module that runs as its own identity owns its directories by it: no setting names their owner (novox/hq ADR
-	// 0325 §1, §3). A module that does not yet keeps its placed owner, warned of where it is set.
-	if err := catalogue.PlacesOwnerProblem(m, layers); err != nil {
-		return fmt.Errorf("refused: %w", err)
+		return fmt.Errorf("refused: %s on %s cannot compose with the layer %q — %w", module, where, from, err)
 	}
 	// And a key that reaches nothing, refused here where somebody can still fix the spelling:
 	// stored, it would be a setting somebody believes they made.
@@ -990,29 +969,6 @@ func (i *Inventory) judgeSettings(ctx context.Context, nodeName, module string,
 	return nil
 }
 
-// NewestManifestOnBranch is the manifest of a module's newest successful build on the branch its record follows
-// (novox/hq issue 575): what the delivery under way brings, before it registers — or the registered one's own, when
-// nothing newer was built. False when no build of the module with a manifest is kept.
-func (i *Inventory) NewestManifestOnBranch(ctx context.Context, module string) (catalogue.Manifest, bool, error) {
-	var raw []byte
-	err := i.store.Pool().QueryRow(ctx,
-		`select b.manifest from build b join module m on m.name = b.module
-		  where b.module = $1 and b.failed = '' and b.manifest is not null and b.manifest::text <> 'null'
-		    and (coalesce(m.ref, '') = '' or b.ref = '' or b.ref = m.ref)
-		  order by b.at desc limit 1`, module).Scan(&raw)
-	if errors.Is(err, pgx.ErrNoRows) {
-		return catalogue.Manifest{}, false, nil
-	}
-	if err != nil {
-		return catalogue.Manifest{}, false, err
-	}
-	m, err := catalogue.ParseManifest(raw)
-	if err != nil {
-		return catalogue.Manifest{}, false, nil // a build the mesh cannot read judges nothing
-	}
-	return m, true, nil
-}
-
 // givenIn is the machine ports a node-level settings layer gives a module, software port →
 // machine port (novox/hq ADR 0100). Nothing when the layer gives none; what is not a port is left
 // for composition to refuse in its own words.

internal/inventory/health.go

@@ -38,20 +38,13 @@ type ResourceHealth struct {
 	Waits []Wait `json:"waits,omitempty"`
 }
 
-// Wait is one thing a waiting resource waits for the operator to give: exactly one of Secret, Setting and Access
-// (novox/hq ADR 0283, ADR 0325 §7), as link.Wait carries it.
+// Wait is one thing a waiting resource waits for the operator to give: exactly one of Secret and Setting
+// (novox/hq ADR 0283), as link.Wait carries it.
 type Wait struct {
 	Part    string `json:"part"`
 	Secret  string `json:"secret,omitempty"`
 	Setting string `json:"setting,omitempty"`
-	// Access is an access of the module by its own id for it, from the engine's access-waits, and Disk that it
-	// waits for the disk that holds its folder rather than for the operator's word (novox/hq ADR 0325 §7, §9).
-	Access string `json:"access,omitempty"`
-	Disk   bool   `json:"disk,omitempty"`
-	// Placed is the filesystem the folder is on now, without its path (ADR 0325 §8): a warrant for another does not
-	// answer the wait.
-	Placed string `json:"placed,omitempty"`
-	What   string `json:"what"`
+	What    string `json:"what"`
 }
 
 // NodeHealth is a machine's newest statement, as kept.

internal/inventory/identities.go

@@ -1,127 +0,0 @@
-package inventory
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"path/filepath"
-	"strings"
-
-	"github.com/jackc/pgx/v5"
-
-	"github.com/novox/mesh-controller/internal/catalogue"
-)
-
-// Module identities and taken folders (novox/hq ADR 0325 §3, §8, §11; migration 0096).
-
-// AllocateIdentity is module's identity, allocated now when it has none: one number from the range of its own,
-// mesh-wide, kept for ever. Two controllers allocating at once agree: the second's insert finds the first's row.
-func (i *Inventory) AllocateIdentity(ctx context.Context, module string) (catalogue.ModuleIdentity, error) {
-	if strings.TrimSpace(module) == "" {
-		return catalogue.ModuleIdentity{}, errors.New("an identity is allocated for a module, and none was named")
-	}
-	if id, had, err := i.IdentityOf(ctx, module); err != nil || had {
-		return id, err
-	}
-	// The number is drawn only when the row is new; a draw lost to a concurrent insert is a gap in the range, never
-	// a number given twice.
-	_, err := i.store.Pool().Exec(ctx,
-		`insert into module_identity (module, uid, gid)
-		 select $1, n, n from (select nextval('module_identity_number')::integer as n) drawn
-		 on conflict (module) do nothing`, module)
-	if err != nil {
-		return catalogue.ModuleIdentity{}, fmt.Errorf("%s could not be given an identity: %w", module, err)
-	}
-	id, had, err := i.IdentityOf(ctx, module)
-	if err == nil && !had {
-		err = fmt.Errorf("%s was given an identity and it cannot be read back", module)
-	}
-	return id, err
-}
-
-// IdentityOf is module's identity, and false when it was never allocated one.
-func (i *Inventory) IdentityOf(ctx context.Context, module string) (catalogue.ModuleIdentity, bool, error) {
-	id := catalogue.ModuleIdentity{Module: module}
-	err := i.store.Pool().QueryRow(ctx, `select uid, gid from module_identity where module = $1`, module).
-		Scan(&id.UID, &id.GID)
-	if errors.Is(err, pgx.ErrNoRows) {
-		return catalogue.ModuleIdentity{}, false, nil
-	}
-	if err != nil {
-		return catalogue.ModuleIdentity{}, false, err
-	}
-	return id, true, nil
-}
-
-// Identities is every module's identity, by module.
-func (i *Inventory) Identities(ctx context.Context) (map[string]catalogue.ModuleIdentity, error) {
-	rows, err := i.store.Pool().Query(ctx, `select module, uid, gid from module_identity`)
-	if err != nil {
-		return nil, err
-	}
-	defer rows.Close()
-	out := map[string]catalogue.ModuleIdentity{}
-	for rows.Next() {
-		var id catalogue.ModuleIdentity
-		if err := rows.Scan(&id.Module, &id.UID, &id.GID); err != nil {
-			return nil, err
-		}
-		out[id.Module] = id
-	}
-	return out, rows.Err()
-}
-
-// TakenFolder is one folder the operator let the mesh keep on a machine (ADR 0325 §8).
-type TakenFolder struct {
-	Path    string
-	By      string
-	Ask     string
-	Warrant string
-	Said    string
-	// Placed is the filesystem the folder was on when taken, without its path (ADR 0325 §8).
-	Placed string
-}
-
-// KeptFolders is every folder taken on a machine, by its clean path.
-func (i *Inventory) KeptFolders(ctx context.Context, nodeName string) (map[string]TakenFolder, error) {
-	rows, err := i.store.Pool().Query(ctx,
-		`select k.path, k.taken_by, k.ask, k.warrant, k.said, k.placed from kept_folder k join node n on n.id = k.node
-		  where n.name = $1`, nodeName)
-	if err != nil {
-		return nil, err
-	}
-	defer rows.Close()
-	out := map[string]TakenFolder{}
-	for rows.Next() {
-		var t TakenFolder
-		if err := rows.Scan(&t.Path, &t.By, &t.Ask, &t.Warrant, &t.Said, &t.Placed); err != nil {
-			return nil, err
-		}
-		out[t.Path] = t
-	}
-	return out, rows.Err()
-}
-
-// RecordTaken keeps that a folder was taken on a machine, under the operator's warrant. A take is recorded once per
-// filesystem: a second for the same folder on the same filesystem keeps the first, and one for the folder on another
-// filesystem (it moved, and the operator was asked again) replaces it.
-func (i *Inventory) RecordTaken(ctx context.Context, nodeName string, t TakenFolder) error {
-	switch {
-	case !strings.HasPrefix(t.Path, "/"):
-		return fmt.Errorf("a taken folder is an absolute path, not %q", t.Path)
-	case strings.TrimSpace(t.Warrant) == "" || strings.TrimSpace(t.Ask) == "":
-		return errors.New("a folder is taken only on the operator's warrant, and this names none")
-	}
-	node, err := i.NodeByName(ctx, nodeName)
-	if err != nil {
-		return err
-	}
-	_, err = i.store.Pool().Exec(ctx,
-		`insert into kept_folder (node, path, taken_by, ask, warrant, said, placed) values ($1, $2, $3, $4, $5, $6, $7)
-		 on conflict (node, path) do update
-		   set taken_at = now(), taken_by = excluded.taken_by, ask = excluded.ask, warrant = excluded.warrant,
-		       said = excluded.said, placed = excluded.placed
-		 where kept_folder.placed is distinct from excluded.placed`, node.ID, filepath.Clean(t.Path), t.By, t.Ask,
-		t.Warrant, t.Said, t.Placed)
-	return err
-}

internal/inventory/identities_test.go

@@ -1,170 +0,0 @@
-package inventory
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/catalogue"
-)
-
-// novox/hq ADR 0325 §3, §11: a module gets one allocation, the same whoever asks and however often, from the range
-// of its own; no allocation is 0 or a root group's; a number once given is never given again.
-func TestAModuleIsGivenOneIdentityOnceAndNeverRoot(t *testing.T) {
-	inv := fresh(t)
-	ctx := t.Context()
-	radarr, err := inv.AllocateIdentity(ctx, "radarr")
-	if err != nil {
-		t.Fatal(err)
-	}
-	again, err := inv.AllocateIdentity(ctx, "radarr")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if radarr != again {
-		t.Fatalf("radarr was given %+v, then %+v: one allocation per module", radarr, again)
-	}
-	plex, err := inv.AllocateIdentity(ctx, "plex")
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, id := range []catalogue.ModuleIdentity{radarr, plex} {
-		if id.UID == 0 || id.GID == 0 || !catalogue.AllocatableID(id.UID) || !catalogue.AllocatableID(id.GID) ||
-			id.UID != id.GID {
-			t.Errorf("%s was given %d:%d: within %d–%d, never 0, uid and gid one number", id.Module, id.UID, id.GID,
-				catalogue.IdentityLow, catalogue.IdentityHigh)
-		}
-	}
-	if radarr.UID == plex.UID {
-		t.Fatalf("radarr and plex share %d", plex.UID)
-	}
-
-	// Read back as composition reads it, from another connection's view: the same numbers (stable across restarts
-	// and machines, since every machine's composition reads this one row).
-	all, err := inv.Identities(ctx)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if all["radarr"].UID != radarr.UID || all["plex"].UID != plex.UID {
-		t.Fatalf("the identities read back are %+v", all)
-	}
-
-	// A module forgotten keeps its row, and the next module is given a new number: never one given before.
-	if _, err := inv.store.Pool().Exec(ctx, `delete from module_identity where module = 'plex'`); err != nil {
-		t.Fatal(err)
-	}
-	sonarr, err := inv.AllocateIdentity(ctx, "sonarr")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if sonarr.UID == plex.UID || sonarr.UID == radarr.UID {
-		t.Fatalf("sonarr was given %d, a number given before", sonarr.UID)
-	}
-
-	// The store itself refuses a number outside the range, root's above all: no write by hand makes one root.
-	for _, n := range []int{0, 10, 1000, 49999, 60000} {
-		if _, err := inv.store.Pool().Exec(ctx,
-			`insert into module_identity (module, uid, gid) values ($1, $2, $2)`, "byhand", n); err == nil {
-			t.Errorf("the store took %d as an identity", n)
-		}
-	}
-}
-
-// novox/hq ADR 0325 §8: a folder taken is recorded once per machine, under a warrant, and read back by its path.
-func TestAFolderIsTakenOnceUnderAWarrant(t *testing.T) {
-	inv := fresh(t)
-	ctx := t.Context()
-	if _, err := inv.AddNode(ctx, "ace"); err != nil {
-		t.Fatal(err)
-	}
-	if err := inv.RecordTaken(ctx, "ace", TakenFolder{Path: "/storage/media/movies/", By: "the operator"}); err == nil {
-		t.Fatal("a folder was recorded taken with no warrant")
-	}
-	first := TakenFolder{Path: "/storage/media/movies/", By: "the operator", Ask: "c01", Warrant: "c01", Said: "started"}
-	if err := inv.RecordTaken(ctx, "ace", first); err != nil {
-		t.Fatal(err)
-	}
-	if err := inv.RecordTaken(ctx, "ace", TakenFolder{Path: "/storage/media/movies", By: "someone else", Ask: "c02",
-		Warrant: "c02"}); err != nil {
-		t.Fatal(err)
-	}
-	kept, err := inv.KeptFolders(ctx, "ace")
-	if err != nil {
-		t.Fatal(err)
-	}
-	got, has := kept["/storage/media/movies"]
-	if !has || got.Ask != "c01" || got.By != "the operator" {
-		t.Fatalf("the taken folder reads %+v (%v): the first take, by its clean path", got, has)
-	}
-	// The folder moved to another filesystem and the operator was asked again: the new take replaces the old.
-	if err := inv.RecordTaken(ctx, "ace", TakenFolder{Path: "/storage/media/movies", By: "the operator", Ask: "c03",
-		Warrant: "c03", Placed: "fs-0000000000ff"}); err != nil {
-		t.Fatal(err)
-	}
-	kept, err = inv.KeptFolders(ctx, "ace")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got := kept["/storage/media/movies"]; got.Ask != "c03" || got.Placed != "fs-0000000000ff" {
-		t.Fatalf("after a take on another filesystem the folder reads %+v", got)
-	}
-}
-
-// novox/hq issue 575: a module registered without the access movies, whose newest build on its branch declares it —
-// the build the delivery under way brings — takes a proposal placing movies: judged against that build, not refused.
-// Without such a build it is refused, as before.
-func TestAPlacementIsJudgedAgainstTheBuildThatBringsTheAccess(t *testing.T) {
-	inv := fresh(t)
-	ctx := t.Context()
-	if _, err := inv.AddNode(ctx, "ace"); err != nil {
-		t.Fatal(err)
-	}
-	registered := catalogue.Manifest{Module: "media-importer", Version: "1",
-		Accesses: []catalogue.Access{{ID: "downloads", Path: "/services/media/downloads", Mode: catalogue.AccessReadWrite}},
-		Resources: []map[string]any{{"id": "server", "type": "container", "name": "importer", "image": "x",
-			"volumes": []any{"${access:downloads}:/downloads"}}}}
-	if err := inv.RegisterModule(ctx, registered, Source{Repository: "https://forge.invalid/media.git",
-		Ref: "main", BuiltFrom: "c0ffee33"}); err != nil {
-		t.Fatal(err)
-	}
-	placing := map[string]any{catalogue.AccessesSetting: map[string]any{"movies": "/storage/media/movies"}}
-
-	err := inv.JudgeSettings(ctx, "ace", "media-importer", placing)
-	if err == nil || !strings.Contains(err.Error(), `places the access "movies", which it does not declare`) {
-		t.Fatalf("a placement no build declares: %v", err)
-	}
-
-	// main's manifest — the build of #34 — declares movies.
-	ahead := registered
-	ahead.Accesses = append([]catalogue.Access{}, registered.Accesses...)
-	ahead.Accesses = append(ahead.Accesses, catalogue.Access{ID: "movies", Path: "/services/media/movies",
-		Mode: catalogue.AccessReadWrite})
-	raw, err := json.Marshal(ahead)
-	if err != nil {
-		t.Fatal(err)
-	}
-	b := aBuild("b34", "media-importer", "")
-	b.Ref, b.Manifest = "main", raw
-	if err := inv.RecordBuild(ctx, b); err != nil {
-		t.Fatal(err)
-	}
-	if err := inv.JudgeSettings(ctx, "ace", "media-importer", placing); err != nil {
-		t.Fatalf("the proposal placing movies, which main's build declares, was refused: %v", err)
-	}
-	if err := inv.SetSettings(ctx, "ace", "media-importer", placing); err != nil {
-		t.Fatalf("the layer placing movies was not stored: %v", err)
-	}
-	// Stored ahead, it does not cost the registered module its place: composition passes it by.
-	layers, err := inv.SettingsFor(ctx, "ace", "media-importer")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := catalogue.ComposesWith(registered, layers, false); err != nil {
-		t.Fatalf("the registered module no longer composes with the layer stored ahead: %v", err)
-	}
-	// A typo is still a typo: an access neither build declares is refused.
-	typo := map[string]any{catalogue.AccessesSetting: map[string]any{"moveis": "/storage/media/movies"}}
-	if err := inv.JudgeSettings(ctx, "ace", "media-importer", typo); err == nil {
-		t.Fatal("a placement no build declares was taken")
-	}
-}

internal/inventory/migrations/0096-a-module-is-given-an-identity-and-a-folder-is-taken.sql

@@ -1,44 +0,0 @@
--- Every module is given an identity of its own, and the mesh takes a shared folder once, on the operator's word
--- (novox/hq ADR 0325 §3, §8, §11).
---
--- **One number per module, mesh-wide, allocated once and never again.** The node-engine makes the account
--- mesh-<module> on each machine the module is assigned to, with these numbers, so a container that declares
--- `identity` runs as the same uid and gid everywhere and a folder's entries mean the same on every machine. The
--- numbers come from a sequence of their own, 50000–59999 (catalogue.IdentityLow and IdentityHigh): above the
--- numbers distributions give people, below the 60000s Debian keeps for its daemons, and nowhere near root's 0 or a
--- root group's (0, 4, 10). The checks refuse a row outside the range, so no write, by hand or by a later bug, can make
--- an identity root (§11). uid and gid are one number. A sequence never hands a number back, and a row is kept after
--- its module is forgotten, so a number once given is never given to another module: a file left owned by a removed
--- module's identity is never inherited by a new one.
-create sequence module_identity_number as integer minvalue 50000 maxvalue 59999 start 50000 no cycle;
-
-create table module_identity (
-    module    text        primary key,
-    uid       integer     not null unique check (uid between 50000 and 59999),
-    gid       integer     not null unique check (gid between 50000 and 59999),
-    allocated timestamptz not null default now(),
-    check (uid = gid)
-);
-
--- **A folder taken, per machine** (§8). The first time a placed folder that already holds data is to be kept, the
--- operator is asked once for that folder on that machine; on the warrant the node-engine adds the entries to
--- everything there, and the folder is taken: kept from then on without asking, a module that gains the access
--- added with no wait. The row is the record of that act — who approved it, under which warrant — and what tells a
--- later module's access that it joins a taken folder (`taken` on the access). The path is the folder as placed,
--- clean and absolute. A new warrant for the same folder on another filesystem replaces the row.
-create table kept_folder (
-    node     uuid        not null references node (id) on delete cascade,
-    path     text        not null check (path like '/%'),
-    taken_at timestamptz not null default now(),
-    -- Who approved it, as the hand-act log says it, and the ask and warrant it was taken under.
-    taken_by text        not null,
-    ask      text        not null,
-    warrant  text        not null,
-    -- What the node-engine answered when it started the take.
-    said     text        not null default '',
-    -- The filesystem the folder was on when it was taken, as the engine names it without a path ("fs-<12 hex>"):
-    -- a wait naming another (the folder moved to another disk) is not answered by this take, and the operator is
-    -- asked again; until the new warrant the folder is not taken there. Empty from an engine that names none.
-    placed   text        not null default '',
-    primary key (node, path)
-);

internal/inventory/plan_id_test.go

@@ -0,0 +1,45 @@
+package inventory
+
+import (
+	"strings"
+	"testing"
+	"time"
+)
+
+// **A plan's id is a value, never SQL** (novox/hq issue 561): the id reaches PlanByID from a caller of the
+// controller's plans verb, so an id holding a quote is read as a plain id — no error from the store, and no
+// other plan answered for it.
+func TestAPlanIdHoldingAQuoteIsReadAsAPlainId(t *testing.T) {
+	inv := ForTest(t)
+	ctx := t.Context()
+	p := Plan{ID: "plan-561", Repository: "novox/mesh-controller", Commit: "abc", Created: time.Now().UTC(),
+		State: PlanBuilding, Tiers: [][]string{{"a"}}, Modules: map[string]*PlanModule{"a": {}}}
+	if err := inv.SavePlan(ctx, &p); err != nil {
+		t.Fatal(err)
+	}
+	for _, id := range []string{
+		"x' or '1'='1",            // every plan, when pasted into the query
+		"plan-561' or id like '%", // the plan above, by a pattern
+		"it's",                    // a quote alone: a syntax error, when pasted
+	} {
+		got, err := inv.PlanByID(ctx, id)
+		if err == nil {
+			t.Fatalf("PlanByID(%q) answered %s, a plan of another id", id, got.ID)
+		}
+		if want := "no plan " + id; err.Error() != want {
+			t.Fatalf("PlanByID(%q) failed with %q, not as a plain id no plan has (%q)", id, err, want)
+		}
+	}
+	// A plan whose id holds a quote is found by it, and by nothing else.
+	quoted := p
+	quoted.ID, quoted.Revision = "plan-'561'", 0
+	if err := inv.SavePlan(ctx, &quoted); err != nil {
+		t.Fatal(err)
+	}
+	if got, err := inv.PlanByID(ctx, quoted.ID); err != nil || got.ID != quoted.ID {
+		t.Fatalf("the plan with a quote in its id was not read back: %v %+v", err, got.ID)
+	}
+	if recent, err := inv.RecentPlans(ctx, 1); err != nil || len(recent) != 1 || !strings.HasPrefix(recent[0].ID, "plan-") {
+		t.Fatalf("RecentPlans with a parameter: %v %+v", err, recent)
+	}
+}

internal/inventory/plans.go

@@ -623,7 +623,7 @@ func (i *Inventory) PlansSince(ctx context.Context, since time.Time) ([]Plan, er
 
 // RecentPlans is the last few plans, newest first, open or not — what the overview shows.
 func (i *Inventory) RecentPlans(ctx context.Context, limit int) ([]Plan, error) {
-	return i.plans(ctx, fmt.Sprintf(`order by created desc limit %d`, limit))
+	return i.plans(ctx, `order by created desc limit $1`, limit)
 }
 
 // NewestMergeOf is the plan, in any state, of the newest merge into a repository's branch that the mesh
@@ -638,9 +638,10 @@ func (i *Inventory) NewestMergeOf(ctx context.Context, repository, branch string
 	return plans[0], true, nil
 }
 
-// PlanByID is one plan.
+// PlanByID is one plan. The id is a parameter, never part of the query (novox/hq issue 561): it comes from a
+// caller of the plans verb.
 func (i *Inventory) PlanByID(ctx context.Context, id string) (Plan, error) {
-	plans, err := i.plans(ctx, `where id = '`+id+`'`)
+	plans, err := i.plans(ctx, `where id = $1`, id)
 	if err != nil {
 		return Plan{}, err
 	}

internal/link/calls.go

@@ -601,6 +601,24 @@ func Acknowledge(ctx context.Context) {
 	}
 }
 
+// LongestAnswer is the longest a handler that waits on purpose may hold its caller's one answer
+// (AnswersWithin, novox/hq issue 229): inside the console's thirty seconds with room for the trip back,
+// and inside the bus's window for an answer (broker.ResponseTTL). A variable so a test need not wait.
+var LongestAnswer = 25 * time.Second
+
+type answerWithinKey struct{}
+
+// AnswersWithin asks that the call's caller be answered in full if the handler ends within d of the
+// call's start, rather than within AnswerWithin: for a handler that waits on purpose, with a bound —
+// `plans` waiting for a plan to move (novox/hq issue 229). Past d, or past LongestAnswer whichever is
+// shorter, its caller is told it is running, as for any call. Never shortens the window; without effect
+// outside a served call, and once the caller was answered.
+func AnswersWithin(ctx context.Context, d time.Duration) {
+	if f, ok := ctx.Value(answerWithinKey{}).(func(time.Duration)); ok {
+		f(d)
+	}
+}
+
 // running is the interim answer: what a caller reads when the call has not finished.
 func running(c *Call, within time.Duration, acknowledged bool, follow string) []byte {
 	why := fmt.Sprintf("it has not finished in %s", within)
@@ -645,6 +663,13 @@ func (l *CallLog) serveCallWithin(seat, verb string, args json.RawMessage, reply
 	acknowledged := make(chan struct{})
 	var once sync.Once
 	ctx = context.WithValue(ctx, answerNowKey{}, func() { once.Do(func() { close(acknowledged) }) })
+	longer := make(chan time.Duration, 1)
+	ctx = context.WithValue(ctx, answerWithinKey{}, func(d time.Duration) {
+		select {
+		case longer <- d:
+		default:
+		}
+	})
 
 	type outcome struct {
 		body   []byte
@@ -703,17 +728,29 @@ func (l *CallLog) serveCallWithin(seat, verb string, args json.RawMessage, reply
 			}
 		}
 	}
-	timer := time.NewTimer(AnswerWithin)
+	within, start := AnswerWithin, time.Now()
+	timer := time.NewTimer(within)
 	defer timer.Stop()
-	select {
-	case o := <-done:
-		l.finish(c, o.body, o.failed, false)
-		say(o.body)
-		return
-	case <-acknowledged:
-		say(running(c, AnswerWithin, true, l.Follow))
-	case <-timer.C:
-		say(running(c, AnswerWithin, false, l.Follow))
+waiting:
+	for {
+		select {
+		case o := <-done:
+			l.finish(c, o.body, o.failed, false)
+			say(o.body)
+			return
+		case <-acknowledged:
+			say(running(c, within, true, l.Follow))
+			break waiting
+		case d := <-longer:
+			// A handler waiting on purpose (AnswersWithin): its window is stretched, never past LongestAnswer.
+			if d = min(d, LongestAnswer); d > within {
+				within = d
+				timer.Reset(time.Until(start.Add(d)))
+			}
+		case <-timer.C:
+			say(running(c, within, false, l.Follow))
+			break waiting
+		}
 	}
 	o := <-done
 	l.finish(c, o.body, o.failed, true)

internal/link/calls_wait_test.go

@@ -0,0 +1,55 @@
+package link
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+	"time"
+)
+
+// **A handler that waits on purpose is answered in full when it ends inside the window it asked for**
+// (novox/hq issue 229): `plans` asked to wait for a plan holds its caller's one answer until the plan
+// moves or its bound passes, rather than being answered "still running" at AnswerWithin.
+func TestAHandlerThatWaitsOnPurposeIsAnsweredInFullInsideItsWindow(t *testing.T) {
+	shortWindow(t, 20*time.Millisecond)
+	l, a := NewCallLog(), newAnswers(t)
+	l.serveCall("mesh-controller", "plans", json.RawMessage(`{"wait":"plan-1"}`), "_INBOX.x.3",
+		func(ctx context.Context, _ json.RawMessage) (any, error) {
+			AnswersWithin(ctx, 200*time.Millisecond)
+			time.Sleep(80 * time.Millisecond) // past AnswerWithin, inside what it asked for
+			return "plan-1 moved", nil
+		}, a.respond, nil)
+	if got := a.only()["result"]; got != "plan-1 moved" {
+		t.Fatalf("a waiting handler inside its window was answered %v, not in full", got)
+	}
+}
+
+// What a handler may ask for is bounded: past LongestAnswer its caller is told it is running, as any
+// call is, so no answer is ever later than the console waits.
+func TestAWaitIsNeverLongerThanTheLongestAnswer(t *testing.T) {
+	shortWindow(t, 10*time.Millisecond)
+	was := LongestAnswer
+	LongestAnswer = 30 * time.Millisecond
+	t.Cleanup(func() { LongestAnswer = was })
+	l, a := NewCallLog(), newAnswers(t)
+	release := make(chan struct{})
+	finished := make(chan struct{})
+	go func() {
+		l.serveCall("mesh-controller", "plans", nil, "_INBOX.x.4", func(ctx context.Context, _ json.RawMessage) (any, error) {
+			AnswersWithin(ctx, time.Hour)
+			<-release
+			return "late", nil
+		}, a.respond, nil)
+		close(finished)
+	}()
+	select {
+	case <-a.sent:
+	case <-time.After(2 * time.Second):
+		t.Fatal("a handler asking for an hour held its caller past LongestAnswer")
+	}
+	if got, _ := a.only()["result"].(map[string]any); got["running"] != true {
+		t.Fatalf("past LongestAnswer the caller was answered %v, not that it is running", a.only())
+	}
+	close(release)
+	<-finished
+}

internal/link/protocol.go

@@ -8,7 +8,6 @@ package link
 
 import (
 	"encoding/base64"
-	"encoding/json"
 	"github.com/novox/mesh-host/rootsearch"
 	"strconv"
 	"strings"
@@ -437,14 +436,6 @@ const ReadinessContract = 2
 // parses strictly and would refuse the whole declaration for it.
 const RootContract = 3
 
-// IdentityContract is the statement of an engine that gives each module its identity and keeps shared folders
-// (novox/hq ADR 0325; mesh-host internal/link IdentityContract): it reads a declaration's `identities`, a container's
-// resolved `identity`, an access's `users` and `taken`, states an access it may not keep yet as waiting
-// (ResourceHealth.AccessWaits), and hears the take act (AskAccessAct). Only to such an engine is any of it sent: an
-// older one parses strictly and would refuse the whole declaration for it. Four, the grant's number (ADR 0312,
-// superseded), is what engines stated before; the controller sends no grant to any engine (#270).
-const IdentityContract = 5
-
 // ReasonRoot starts the reason of an account verdict that found a way to root (ADR 0266); the node-engine's
 // own words (mesh-host internal/accounts ReasonRoot).
 const ReasonRoot = "can become root without a person"
@@ -589,50 +580,6 @@ type Wait struct {
 	What    string `json:"what"`
 }
 
-// WaitKindAccess is the kind of a wait on an access (novox/hq ADR 0325 §7; mesh-host internal/link).
-const WaitKindAccess = "access"
-
-// AccessWait is one access waiting for the operator (novox/hq ADR 0325 §7): the access by its module's own id for
-// it, the part (its module), and what the operator gives, in words with no path — "let the mesh keep the shared
-// folder movies", or "mount the disk that holds books". Beside Waits because mesh-sdk's health.Wait names a secret or
-// a setting and nothing else. From an engine at IdentityContract or later.
-type AccessWait struct {
-	Kind   string `json:"kind"`
-	Access string `json:"access"`
-	Part   string `json:"part"`
-	What   string `json:"what"`
-	// Placed names, with no path, the filesystem the folder is on now ("fs-<12 hex>"), on a wait for the operator's
-	// word: a warrant given for another filesystem (the folder moved) does not answer it, and the controller asks
-	// again (mesh-host internal/link AccessWait.Placed).
-	Placed string `json:"placed,omitempty"`
-}
-
-// WaitsForDisk says an access wait is for a disk that is not there (ADR 0325 §9) rather than for the operator's word
-// to keep a folder: read from the engine's words, the one thing its wait says of which it is.
-func (w AccessWait) WaitsForDisk() bool {
-	return strings.HasPrefix(strings.TrimSpace(w.What), "mount the disk")
-}
-
-// KindAccess is an access's verdict (novox/hq ADR 0325; mesh-host internal/link KindAccess): healthy while each user
-// has its right, waiting while the mesh may not keep its folder yet or its disk is not there, unhealthy otherwise —
-// and unknown when its filesystem could not be named this look (a hung mount), carrying no wait.
-const KindAccess = "access"
-
-// KindKeptEntries is the mesh's entries on a shared folder that nobody wants and that could not be taken out yet
-// because its disk was away (novox/hq ADR 0325 §8; mesh-host internal/link): unhealthy, said under the access that
-// last named it (`<access id>~entries`), which may no longer be declared. The node-engine's own.
-const KindKeptEntries = "kept-entries"
-
-// KeptEntry is one user of a kept folder as the engine's listing says it (ADR 0325 §4), with a note beside the tool
-// runner's entry.
-type KeptEntry struct {
-	Identity string `json:"identity"`
-	UID      int    `json:"uid"`
-	Use      string `json:"use"`
-	From     string `json:"from"`
-	Note     string `json:"note,omitempty"`
-}
-
 // ResourceHealth is one long-running resource's state.
 type ResourceHealth struct {
 	Module   string    `json:"module"`
@@ -659,11 +606,6 @@ type ResourceHealth struct {
 	// Waits is what a resource in StateWaiting waits for (novox/hq ADR 0283). Empty otherwise, and from an
 	// engine older than that.
 	Waits []Wait `json:"waits,omitempty"`
-	// AccessWaits is what an access stated waiting waits for (novox/hq ADR 0325 §7); Act the last walk under its
-	// folder, kept as the engine said it; Entries the kept folder's listing. From an engine at IdentityContract only.
-	AccessWaits []AccessWait    `json:"access-waits,omitempty"`
-	Act         json.RawMessage `json:"act,omitempty"`
-	Entries     []KeptEntry     `json:"entries,omitempty"`
 }
 
 // HealthSaid is the health event's body: the machine and its statement. The machine is read from the

internal/link/take.go

@@ -1,114 +0,0 @@
-package link
-
-import (
-	"context"
-	"crypto/rand"
-	"encoding/hex"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"strings"
-	"time"
-
-	"github.com/nats-io/nats.go"
-
-	"github.com/novox/mesh-controller/internal/broker"
-)
-
-// The take act: a shared folder that already holds data is taken by the mesh once, on the operator's word
-// (novox/hq ADR 0325 §8).
-//
-// The controller asks the operator once for that folder on that machine (ADR 0259, at the level approve). On the
-// warrant it asks the machine's node-engine, on the engine's own subject (broker.AskAccessActSubject), signed with
-// the mesh's key as a hand-over is (SignedHandOver) under a signing context of its own (AccessActContext), to take
-// the folder: the engine adds the entries of the users it was declared for that folder to everything under it —
-// following no link, entering no other filesystem — answers at once that it started or why it refused, and states
-// the walk on the access's verdict. **Nothing is taken without a warrant**: the ask names the warrant the operator
-// gave, and the controller sends it only from the warrant (cmd/mesh-controller decideTake).
-//
-// The engine's own shape (mesh-host internal/link AccessActAsk, AnswerAccessAct): a hand-over's fields and
-// {act: "take", access: <the access's resource id in the declaration>, warrant}.
-
-// AccessActContext is prefixed to an act ask's bytes before signing: never another ask's signature, nor a
-// declaration's. The engine holds the same words.
-const AccessActContext = "novox-mesh access-act v2\n"
-
-// ActTake is the one act the controller asks.
-const ActTake = "take"
-
-// AccessActAsk is what the controller asks: a hand-over's fields — the node it is for, the folder's absolute path as
-// the declaration places it, who asked, when the ask stops being good and a nonce the engine takes once — and the
-// act's own: which act, the access by its resource id, and the warrant the operator gave.
-type AccessActAsk struct {
-	Node    string    `json:"node"`
-	Path    string    `json:"path"`
-	By      string    `json:"by"`
-	Expires time.Time `json:"expires"`
-	Nonce   string    `json:"nonce"`
-	Act     string    `json:"act"`
-	Access  string    `json:"access"`
-	Warrant string    `json:"warrant"`
-}
-
-// MaxActField bounds an access id and a warrant, as the engine does.
-const MaxActField = 200
-
-// TakeWithin is how long the controller waits for the engine's answer: it starts the walk and answers, and the
-// walk's end is stated on the access's verdict.
-const TakeWithin = 30 * time.Second
-
-// SignTake fills a take ask's act, expiry and nonce and signs it with the mesh's key over AccessActContext. It refuses
-// an ask with no warrant, no path or no access — and one the engine would refuse for its shape: nothing is ever asked
-// of an engine that it would have to refuse.
-func SignTake(ctx context.Context, signer Signer, ask AccessActAsk) ([]byte, error) {
-	ask.Access, ask.Warrant = strings.TrimSpace(ask.Access), strings.TrimSpace(ask.Warrant)
-	switch {
-	case signer == nil:
-		return nil, errors.New("no signing key, so nothing can be asked of an engine")
-	case ask.Warrant == "":
-		return nil, errors.New("a take is asked only on the operator's warrant, and this one names none")
-	case ask.Node == "" || !strings.HasPrefix(ask.Path, "/"):
-		return nil, errors.New("a take names its machine and the folder's absolute path")
-	case ask.Access == "":
-		return nil, errors.New("a take names the access whose folder it takes")
-	}
-	// The warrant is one short name; the access is the resource id the declaration gave it, which may hold a path's
-	// slashes (catalogue.AccessID) — the engine judges it against what it was declared.
-	if len(ask.Warrant) > MaxActField || strings.ContainsAny(ask.Warrant, "\r\n\x00/") {
-		return nil, fmt.Errorf("the take's warrant %q is not one short name", ask.Warrant)
-	}
-	if len(ask.Access) > MaxActField || strings.ContainsAny(ask.Access, "\r\n\x00") {
-		return nil, fmt.Errorf("the take's access %q is not one line", ask.Access)
-	}
-	nonce := make([]byte, 16)
-	if _, err := rand.Read(nonce); err != nil {
-		return nil, err
-	}
-	ask.Act, ask.Nonce, ask.Expires = ActTake, hex.EncodeToString(nonce), time.Now().UTC().Add(HandOverGood)
-	raw, err := json.Marshal(ask)
-	if err != nil {
-		return nil, err
-	}
-	signature, err := signer.Sign(ctx, append([]byte(AccessActContext), raw...))
-	if err != nil {
-		return nil, fmt.Errorf("cannot sign the ask: %w", err)
-	}
-	return json.Marshal(SignedHandOver{Ask: raw, Signature: signature})
-}
-
-// AskTake asks one machine's node-engine to take a shared folder on the operator's warrant, and reads its answer. An
-// error is the ask not reaching an engine, or an answer that is not one; a refusal is the engine's and comes back in
-// the answer.
-func AskTake(ctx context.Context, conn *nats.Conn, signer Signer, ask AccessActAsk, timeout time.Duration) (HandOverAnswer, error) {
-	if conn == nil {
-		return HandOverAnswer{}, errors.New("this controller is not on the bus")
-	}
-	body, err := SignTake(ctx, signer, ask)
-	if err != nil {
-		return HandOverAnswer{}, err
-	}
-	return askSigned(ctx, conn, broker.AskAccessActSubject(ask.Node), body, ask.Node, timeout, askWords{
-		what: "the take of a shared folder", nothing: "nothing was taken", issue: "ADR 0325",
-		unknown: "whether it started is not known — the access's verdict on the machine says whether it is kept",
-		record:  "a start"})
-}

testdata/beside/CAPTURED

@@ -8,7 +8,7 @@ private addresses. That is acceptable while mesh-controller is private; if it ev
 a second place to clean besides the catalogue itself.
 
 mesh-catalog  b9de001833b1b61b297182b8e3bcdae1cbdeace9  modules/*/module.json, modules/nats/Dockerfile
-mesh-host     d2d9fbbd7d1cb92efaf404ebe0bd8dd91896277f  examples/foundation-first-node-nats.lock
+mesh-host     a76baa4b47f07a8b2bab065603414530bd02b53a  examples/foundation-first-node-nats.lock
 mesh-sdk      33917f91ac3cc213b879b32f3c70e2aa70395f98  conformance/events/module-event.json
 
 To move them, from this repository's root, with the two repositories checked out beside it:

testdata/beside/mesh-host/internal/apply/placement_guard.go.captured

@@ -523,20 +523,6 @@ func refusedPlaces(resources []declaration.Resource) map[string]error {
 		switch res := r.(type) {
 		case *declaration.Directory:
 			err = refusePath(res.Path, placingDirectory, moduleOfID(res.ID), res.Owner)
-			// And outside every home, the walk's judgement before anything is applied (novox/hq issue 358): a
-			// link another account could make in its path refuses it, and with it what is below it, whatever
-			// order they are declared in. The apply walks again at the moment of use. A directory handed over
-			// keeps its own, stricter walk (issue 356), which refuses any link at all.
-			if err == nil && meshDirsByDescriptor && homeAbove(res.Path) == "" &&
-				!HandedOver()[handOverKey(res.ID, res.Path)] {
-				if judged := judgeMeshDir(res.Path); judged != nil {
-					err = judged
-					var link *LinkInPathError
-					if errors.As(judged, &link) {
-						err = &PlacementRefusedError{Path: res.Path, Why: "it " + link.why()}
-					}
-				}
-			}
 		case *declaration.Access:
 			err = refusePath(res.Path, placingAccess, moduleOfID(res.ID), "")
 		default:

testdata/store-tests

@@ -7,12 +7,14 @@
 ./cmd/mesh-controller TestAStopNamesWhatStaysOnTheMachinesAndWhatStillCarriesIt
 ./cmd/mesh-controller TestAStopWithoutAMergeLeavesItOutOfABatch
 ./cmd/mesh-controller TestSavingPlansAndMovingMergesIsOneAct
+./cmd/mesh-controller TestAPlanFollowedFromTheStoreAnswersWhenItMoves
 ./internal/inventory TestTheLastSendSaysWhatTheMachineAnswered
 ./internal/inventory TestAReportIsTheLastSendsAnswerOnlyWhenItIsAboutThatSend
 ./cmd/mesh-controller TestNodeShowAndStatusReadTheLastSendFromTheStore
 ./internal/inventory TestAnIssuedValueIsSealedToEveryHolderOnceAndNotAgain
 ./internal/inventory TestAnIssuedValueIsSealedAgainAfterAKeyChangeOrAnAcceptance
 ./internal/inventory TestAConditionsLooksAreKeptBesideTheBucket
+./internal/inventory TestAPlanIdHoldingAQuoteIsReadAsAPlainId
 ./cmd/mesh-controller TestTheConditionsVerbReadsTheLooksTheBucketNoLongerHolds
 ./internal/inventory TestAWalksStartIsKeptAndARefusedSaveLeavesItUnsaid
 ./cmd/mesh-controller TestAWalkLetGoAndStoppedByVerbsIsSaidStartedAndEnded
@@ -29,8 +31,4 @@
 ./cmd/mesh-controller TestADirectoryOwnersKeyIsRefusedThroughAVerb
 ./cmd/mesh-controller TestTheSendMakesNoValueForAnOutsideSecretNobodyGave
 ./cmd/mesh-controller TestAQuestionComposesWithoutAnOutsideSecretNobodyGave
-# novox/hq ADR 0325 §3, §8, §11 and issue 575: identities allocated once and never root, a folder taken under a
-# warrant, a placement judged against the build that brings its access.
-./internal/inventory TestAModuleIsGivenOneIdentityOnceAndNeverRoot
-./internal/inventory TestAFolderIsTakenOnceUnderAWarrant
-./internal/inventory TestAPlacementIsJudgedAgainstTheBuildThatBringsTheAccess
+./cmd/mesh-controller TestReplay401

vendor/github.com/novox/mesh-host/internal/declaration/declaration.go

@@ -456,56 +456,14 @@ const (
 // **The distinction 04-ISSUES/036 and 026 turn on.** A `directory` resource is the mesh's own —
 // it creates it, sets its owner and mode, and removes it when empty ([ADR 0030](novox/hq)). A
 // media library, a download spool is the operator's: it existed before the mesh, several modules
-// read and write it at once, and the mesh must not chown, chmod or remove it. The host confirms it
-// is there and mounts it, and keeps it usable by the identities that use it through ACL entries it
-// adds and nothing else (novox/hq ADR 0325 §5); a missing one is made only below a parent on the
-// filesystem the data was placed on (§9).
+// read and write it at once, and the mesh must not create, chown, reconcile or remove it. The
+// host confirms it is there and mounts it; nothing else.
 type Access struct {
 	ID   string `json:"id"`
 	Type Type   `json:"type"`
 	Path string `json:"path"`
 	// Mode is how this module reaches the path: read or read-write. Absent narrows to read.
 	Mode string `json:"mode,omitempty"`
-
-	// Users are the identities that use the folder, resolved by the controller (novox/hq ADR 0325 §3, §4): each
-	// module identity whose container mounts it, and the tool runner's account standing for every module whose
-	// tools use it. The engine keeps one ACL entry per user on the folder and as its default (§5); several
-	// accesses naming one folder are kept as one, each uid at the widest use any of them gives it. Absent is a
-	// controller older than ADR 0325, or an access nobody but others' bits reach (§2): nothing is kept.
-	Users []AccessUser `json:"users,omitempty"`
-	// Taken is the controller saying the operator's warrant for this folder was carried out (§8): the folder is
-	// kept although it holds data. The engine also keeps a folder it took itself, on the act, or found empty.
-	Taken bool `json:"taken,omitempty"`
-
-	// Grant is what a controller older than ADR 0325 still sends (ADR 0312's group grant, superseded): accepted
-	// so its declaration is not refused whole, and never acted on — no account is put in a group for data (§5).
-	Grant json.RawMessage `json:"grant,omitempty"`
-}
-
-// The uses an access's user has (ADR 0051 §3), and where it runs (ADR 0325 §4).
-const (
-	FromContainer  = "container"
-	FromToolRunner = "tool-runner"
-)
-
-// AccessUser is one identity that uses an accessed folder: its name and uid as the controller allocated them, its
-// use, and where it runs.
-type AccessUser struct {
-	Identity string `json:"identity"`
-	UID      int    `json:"uid"`
-	Use      string `json:"use"`
-	From     string `json:"from"`
-}
-
-// UnmarshalJSON reads a user as strictly as a resource is read.
-func (u *AccessUser) UnmarshalJSON(raw []byte) error {
-	type plain AccessUser
-	var p plain
-	if err := strictDecode(raw, &p); err != nil {
-		return fmt.Errorf("an access's user: %w", err)
-	}
-	*u = AccessUser(p)
-	return nil
 }
 
 func (a *Access) Identity() string { return a.ID }
@@ -524,41 +482,9 @@ func (a *Access) validate(where string, _ bool) []string {
 		problems = append(problems, fmt.Sprintf(
 			"%s: an access is %q or %q, not %q", where, AccessRead, AccessReadWrite, a.Mode))
 	}
-	for _, u := range a.Users {
-		switch {
-		case u.Identity == "" || !accountName.MatchString(u.Identity):
-			problems = append(problems, fmt.Sprintf("%s: a user of an access is an account's name, and %q is not one",
-				where, u.Identity))
-		case u.UID <= 0:
-			// Never root (novox/hq ADR 0325 §11): an entry for uid 0 would be a right root has anyway, and a
-			// number below it is no account.
-			problems = append(problems, fmt.Sprintf("%s: the user %s has uid %d, and a module's identity is never "+
-				"root or below it (novox/hq ADR 0325 §11)", where, u.Identity, u.UID))
-		}
-		if u.Use != AccessRead && u.Use != AccessReadWrite {
-			problems = append(problems, fmt.Sprintf("%s: the user %s uses it %q, and a use is %q or %q", where,
-				u.Identity, u.Use, AccessRead, AccessReadWrite))
-		}
-		if u.Use == AccessReadWrite && a.Mode != AccessReadWrite {
-			problems = append(problems, fmt.Sprintf("%s: the user %s writes an access declared %s", where,
-				u.Identity, orRead(a.Mode)))
-		}
-		if u.From != FromContainer && u.From != FromToolRunner {
-			problems = append(problems, fmt.Sprintf("%s: the user %s runs from %q, and that is %q or %q", where,
-				u.Identity, u.From, FromContainer, FromToolRunner))
-		}
-	}
 	return problems
 }
 
-// orRead is an access's mode as said: absent narrows to read.
-func orRead(mode string) string {
-	if mode == "" {
-		return AccessRead
-	}
-	return mode
-}
-
 func (u *User) Identity() string { return u.ID }
 func (u *User) Kind() Type       { return TypeUser }
 func (u *User) Target() string   { return u.Name }
@@ -1234,78 +1160,6 @@ type Container struct {
 	// Health is how this resource is ready (novox/hq ADR 0240 rule 2, Phase B): one kind and its
 	// timing, judged by the node-engine beside liveness. Absent: judged alive or not, and nothing more.
 	Health *Health `json:"health,omitempty"`
-
-	// RunAs is who the container runs as, resolved by the controller from the module's identity and the
-	// image's declared interface (novox/hq ADR 0325 §2, §3): told by environment (the image reads PUID and
-	// PGID, say) or by the runtime's own user option. Part of the spec, so a change recreates it. Absent: the
-	// container runs as its image says. Its key is `identity`, the manifest's word; the field is not, because
-	// a resource's Identity is its id.
-	RunAs *ContainerIdentity `json:"identity,omitempty"`
-}
-
-// The ways an image is told who to run as (novox/hq ADR 0325 §2).
-const (
-	IdentityByEnv = "env"
-	IdentityByRun = "run"
-)
-
-// ContainerIdentity is who a container runs as, and how its image is told.
-type ContainerIdentity struct {
-	// Mode is IdentityByEnv or IdentityByRun.
-	Mode string `json:"mode"`
-	// UserEnv and GroupEnv are the variables the image reads the user's and the group's number from, for
-	// IdentityByEnv: "PUID", "PGID".
-	UserEnv  string `json:"user_env,omitempty"`
-	GroupEnv string `json:"group_env,omitempty"`
-	UID      int    `json:"uid"`
-	GID      int    `json:"gid"`
-}
-
-// UnmarshalJSON reads an identity as strictly as a resource is read.
-func (i *ContainerIdentity) UnmarshalJSON(raw []byte) error {
-	type plain ContainerIdentity
-	var p plain
-	if err := strictDecode(raw, &p); err != nil {
-		return fmt.Errorf("a container's identity: %w", err)
-	}
-	*i = ContainerIdentity(p)
-	return nil
-}
-
-// envName is a variable's name as a runtime takes it.
-var envName = regexp.MustCompile(`^[A-Za-z_][A-Za-z0-9_]*$`)
-
-func (i *ContainerIdentity) problems(where string, env map[string]string) []string {
-	if i == nil {
-		return nil
-	}
-	var problems []string
-	switch i.Mode {
-	case IdentityByEnv:
-		if !envName.MatchString(i.UserEnv) || (i.GroupEnv != "" && !envName.MatchString(i.GroupEnv)) {
-			problems = append(problems, fmt.Sprintf("%s: an identity told by environment names the variables "+
-				"it is told in, and %q and %q are not both names", where, i.UserEnv, i.GroupEnv))
-		}
-		for _, name := range []string{i.UserEnv, i.GroupEnv} {
-			if _, set := env[name]; set && name != "" {
-				problems = append(problems, fmt.Sprintf("%s: env sets %s, which the identity sets; one value "+
-					"for one variable", where, name))
-			}
-		}
-	case IdentityByRun:
-		if i.UserEnv != "" || i.GroupEnv != "" {
-			problems = append(problems, where+": an identity told by the runtime's user option names no variable")
-		}
-	default:
-		problems = append(problems, fmt.Sprintf("%s: an identity is told by %q or %q, not %q", where,
-			IdentityByEnv, IdentityByRun, i.Mode))
-	}
-	// Never root (novox/hq ADR 0325 §11): refused here, so nothing of the declaration is made or started.
-	if i.UID <= 0 || i.GID <= 0 {
-		problems = append(problems, fmt.Sprintf("%s: the identity is uid %d, gid %d, and a module's identity is "+
-			"never root, nor a number below it (novox/hq ADR 0325 §11)", where, i.UID, i.GID))
-	}
-	return problems
 }
 
 func (c *Container) Identity() string { return c.ID }
@@ -1388,7 +1242,6 @@ func (c *Container) validate(where string, _ bool) []string {
 		problems = append(problems, where+": networks is for a container that keeps running; a step "+
 			"runs and exits, and joins nothing afterwards")
 	}
-	problems = append(problems, c.RunAs.problems(where+": container "+c.Name, c.Env)...)
 	return append(problems, checkImage(where, c.Image)...)
 }
 
@@ -1539,53 +1392,6 @@ type Declaration struct {
 	// the generation of what it puts back, which may be older than what the machine applied, and is
 	// not refused for it.
 	PutBack bool
-
-	// Identities is the identity of every module assigned to this machine (novox/hq ADR 0325 §3): an account
-	// and a group `mesh-<module>` with the numbers the controller allocated once for the module, the same on
-	// every machine. The engine makes each before any resource is applied, and removes what it made of one no
-	// longer declared. Absent is a controller older than ADR 0325.
-	Identities []Identity
-}
-
-// Identity is one module's identity, as the controller allocated it.
-type Identity struct {
-	Module string `json:"module"`
-	Name   string `json:"name"`
-	UID    int    `json:"uid"`
-	GID    int    `json:"gid"`
-}
-
-// IdentityPrefix starts every module identity's name.
-const IdentityPrefix = "mesh-"
-
-// checkIdentities judges the identities on arrival: each named for its module, never root, and no name or number
-// twice — two modules with one account would write as each other.
-func checkIdentities(ids []Identity) []string {
-	var problems []string
-	names, uids, gids := map[string]bool{}, map[int]string{}, map[int]string{}
-	for _, id := range ids {
-		where := fmt.Sprintf("identity %q", id.Name)
-		if id.Module == "" || id.Name != IdentityPrefix+id.Module || !accountName.MatchString(id.Name) {
-			problems = append(problems, fmt.Sprintf("%s: a module's identity is named %s<module>, and this one is "+
-				"for the module %q", where, IdentityPrefix, id.Module))
-		}
-		if id.UID <= 0 || id.GID <= 0 {
-			problems = append(problems, fmt.Sprintf("%s: uid %d, gid %d, and a module's identity is never root, "+
-				"nor a number below it (novox/hq ADR 0325 §11); nothing of this declaration was made", where,
-				id.UID, id.GID))
-		}
-		if names[id.Name] {
-			problems = append(problems, where+": declared twice")
-		}
-		if other, used := uids[id.UID]; used {
-			problems = append(problems, fmt.Sprintf("%s: uid %d is %s's too", where, id.UID, other))
-		}
-		if other, used := gids[id.GID]; used {
-			problems = append(problems, fmt.Sprintf("%s: gid %d is %s's too", where, id.GID, other))
-		}
-		names[id.Name], uids[id.UID], gids[id.GID] = true, id.Name, id.Name
-	}
-	return problems
 }
 
 // LeftOutModuleOf says which left-out module a recorded resource belongs to, if any: its id is the
@@ -1755,9 +1561,6 @@ type envelope struct {
 	// sends them only to a host whose reports say `reads_generation`.
 	Generation int64 `json:"generation,omitempty"`
 	PutBack    bool  `json:"put_back,omitempty"`
-	// Identities is optional on the wire too (novox/hq ADR 0325 §3). **An older host refuses this key**; a
-	// controller sends it only to a host whose health says link.IdentityContract.
-	Identities []Identity `json:"identities,omitempty"`
 }
 
 func parse(raw []byte, allowActions bool) (*Declaration, error) {
@@ -1775,9 +1578,8 @@ func parse(raw []byte, allowActions bool) (*Declaration, error) {
 	}
 
 	d := &Declaration{Version: env.Version, For: env.For, Adoption: env.Adoption, Sequence: env.Sequence,
-		Epoch: env.Epoch, LeftOut: env.LeftOut, Generation: env.Generation, PutBack: env.PutBack,
-		Identities: env.Identities}
-	problems := checkIdentities(env.Identities)
+		Epoch: env.Epoch, LeftOut: env.LeftOut, Generation: env.Generation, PutBack: env.PutBack}
+	var problems []string
 	if env.Generation < 0 {
 		// Below zero would read as "none claimed" and pass every refusal of an older generation.
 		problems = append(problems, fmt.Sprintf("an assignment generation below zero (%d) is not one the "+
@@ -1930,10 +1732,6 @@ func checkWhileStopped(resources []Resource) []string {
 	return problems
 }
 
-// accountName is what an identity's or an access user's name may be: the portable account name the user tools
-// take, optionally ending in `$`, never starting with a dash — it is handed to them as an argument.
-var accountName = regexp.MustCompile(`^[A-Za-z0-9_.][A-Za-z0-9_.-]*\$?$`)
-
 func strictDecode(raw []byte, into any) error {
 	// DisallowUnknownFields is the whole point rather than strictness for its own sake: a
 	// field the host does not know is a thing the control plane believes it asked for.

vendor/github.com/therootcompany/xz/AUTHORS

@@ -0,0 +1,8 @@
+# Package xz authors
+
+Michael Cross <https://github.com/xi2>
+
+# XZ Embedded authors
+
+Lasse Collin <lasse.collin@tukaani.org>
+Igor Pavlov <http://7-zip.org/>

vendor/github.com/therootcompany/xz/LICENSE

@@ -0,0 +1,86 @@
+Creative Commons CC0 1.0 Universal
+
+CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE LEGAL
+SERVICES. DISTRIBUTION OF THIS DOCUMENT DOES NOT CREATE AN ATTORNEY-CLIENT
+RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS INFORMATION ON AN "AS-IS" BASIS.
+CREATIVE COMMONS MAKES NO WARRANTIES REGARDING THE USE OF THIS DOCUMENT OR THE
+INFORMATION OR WORKS PROVIDED HEREUNDER, AND DISCLAIMS LIABILITY FOR DAMAGES
+RESULTING FROM THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED
+HEREUNDER.
+
+Statement of Purpose
+
+The laws of most jurisdictions throughout the world automatically confer
+exclusive Copyright and Related Rights (defined below) upon the creator and
+subsequent owner(s) (each and all, an "owner") of an original work of
+authorship and/or a database (each, a "Work").
+
+Certain owners wish to permanently relinquish those rights to a Work for the
+purpose of contributing to a commons of creative, cultural and scientific
+works ("Commons") that the public can reliably and without fear of later
+claims of infringement build upon, modify, incorporate in other works, reuse
+and redistribute as freely as possible in any form whatsoever and for any
+purposes, including without limitation commercial purposes. These owners may
+contribute to the Commons to promote the ideal of a free culture and the
+further production of creative, cultural and scientific works, or to gain
+reputation or greater distribution for their Work in part through the use and
+efforts of others.
+
+For these and/or other purposes and motivations, and without any expectation
+of additional consideration or compensation, the person associating CC0 with a
+Work (the "Affirmer"), to the extent that he or she is an owner of Copyright
+and Related Rights in the Work, voluntarily elects to apply CC0 to the Work
+and publicly distribute the Work under its terms, with knowledge of his or her
+Copyright and Related Rights in the Work and the meaning and intended legal
+effect of CC0 on those rights.
+
+1. Copyright and Related Rights. A Work made available under CC0 may be protected by copyright and related or neighboring rights ("Copyright and Related Rights"). Copyright and Related Rights include, but are not limited to, the following: 
+
+i. the right to reproduce, adapt, distribute, perform, display, communicate,
+and translate a Work;
+
+ii. moral rights retained by the original author(s) and/or performer(s);
+
+iii. publicity and privacy rights pertaining to a person's image or
+likeness depicted in a Work;
+
+iv. rights protecting against unfair competition in regards to a Work, subject
+to the limitations in paragraph 4(a), below;
+
+v. rights protecting the extraction, dissemination, use and reuse of data in a
+Work;
+
+vi. database rights (such as those arising under Directive 96/9/EC of the
+European Parliament and of the Council of 11 March 1996 on the legal
+protection of databases, and under any national implementation thereof,
+including any amended or successor version of such directive); and
+
+vii. other similar, equivalent or corresponding rights throughout the world
+based on applicable law or treaty, and any national implementations thereof.
+
+2. Waiver. To the greatest extent permitted by, but not in contravention of, applicable law, Affirmer hereby overtly, fully, permanently, irrevocably and unconditionally waives, abandons, and surrenders all of Affirmer's Copyright and Related Rights and associated claims and causes of action, whether now known or unknown (including existing as well as future claims and causes of action), in the Work (i) in all territories worldwide, (ii) for the maximum duration provided by applicable law or treaty (including future time extensions), (iii) in any current or future medium and for any number of copies, and (iv) for any purpose whatsoever, including without limitation commercial, advertising or promotional purposes (the "Waiver"). Affirmer makes the Waiver for the benefit of each member of the public at large and to the detriment of Affirmer's heirs and successors, fully intending that such Waiver shall not be subject to revocation, rescission, cancellation, termination, or any other legal or equitable action to disrupt the quiet enjoyment of the Work by the public as contemplated by Affirmer's express Statement of Purpose. 
+
+3. Public License Fallback. Should any part of the Waiver for any reason be judged legally invalid or ineffective under applicable law, then the Waiver shall be preserved to the maximum extent permitted taking into account Affirmer's express Statement of Purpose. In addition, to the extent the Waiver is so judged Affirmer hereby grants to each affected person a royalty-free, non transferable, non sublicensable, non exclusive, irrevocable and unconditional license to exercise Affirmer's Copyright and Related Rights in the Work (i) in all territories worldwide, (ii) for the maximum duration provided by applicable law or treaty (including future time extensions), (iii) in any current or future medium and for any number of copies, and (iv) for any purpose whatsoever, including without limitation commercial, advertising or promotional purposes (the "License"). The License shall be deemed effective as of the date CC0 was applied by Affirmer to the Work. Should any part of the License for any reason be judged legally invalid or ineffective under applicable law, such partial invalidity or ineffectiveness shall not invalidate the remainder of the License, and in such case Affirmer hereby affirms that he or she will not (i) exercise any of his or her remaining Copyright and Related Rights in the Work or (ii) assert any associated claims and causes of action with respect to the Work, in either case contrary to Affirmer's express Statement of Purpose. 
+
+4. Limitations and Disclaimers. 
+
+a. No trademark or patent rights held by Affirmer are waived, abandoned,
+surrendered, licensed or otherwise affected by this document.
+
+b. Affirmer offers the Work as-is and makes no representations or warranties
+of any kind concerning the Work, express, implied, statutory or otherwise,
+including without limitation warranties of title, merchantability, fitness for
+a particular purpose, non infringement, or the absence of latent or other
+defects, accuracy, or the present or absence of errors, whether or not
+discoverable, all to the greatest extent permissible under applicable law.
+
+c. Affirmer disclaims responsibility for clearing rights of other persons that
+may apply to the Work or any use thereof, including without limitation any
+person's Copyright and Related Rights in the Work. Further, Affirmer
+disclaims responsibility for obtaining any necessary consents, permissions or
+other rights required for any use of the Work.
+
+d. Affirmer understands and acknowledges that Creative Commons is not a party
+to this document and has no duty or obligation with respect to this CC0 or use
+of the Work.
+

vendor/github.com/therootcompany/xz/README.md

@@ -0,0 +1,19 @@
+# Xz
+
+Package xz implements XZ decompression natively in Go.
+
+Documentation at <https://pkg.go.dev/github.com/therootcompany/xz>.
+
+Download and install with `go get github.com/xi2/xz`.
+
+If you need compression as well as decompression, you might want to
+look at <https://github.com/ulikunitz/xz>.
+
+# LICENSE
+
+This was originally released into the public domain by the AUTHORS.
+
+Here it is licensed more explicitly as Creative Commons CC0 1.0 Universal
+(CC0-1.0) so that it can be detected by automated tooling, and satisfy the legal
+requirements for vendor integration for cases in which a "public domain"
+statement is not sufficient.

vendor/github.com/therootcompany/xz/dec_bcj.go

@@ -0,0 +1,461 @@
+/*
+ * Branch/Call/Jump (BCJ) filter decoders
+ *
+ * Authors: Lasse Collin <lasse.collin@tukaani.org>
+ *          Igor Pavlov <http://7-zip.org/>
+ *
+ * Translation to Go: Michael Cross <https://github.com/xi2>
+ *
+ * This file has been put into the public domain.
+ * You can do whatever you want with this file.
+ */
+
+package xz
+
+/* from linux/lib/xz/xz_dec_bcj.c *************************************/
+
+type xzDecBCJ struct {
+	/* Type of the BCJ filter being used */
+	typ xzFilterID
+	/*
+	 * Return value of the next filter in the chain. We need to preserve
+	 * this information across calls, because we must not call the next
+	 * filter anymore once it has returned xzStreamEnd
+	 */
+	ret xzRet
+	/*
+	 * Absolute position relative to the beginning of the uncompressed
+	 * data (in a single .xz Block).
+	 */
+	pos int
+	/* x86 filter state */
+	x86PrevMask uint32
+	/* Temporary space to hold the variables from xzBuf */
+	out    []byte
+	outPos int
+	temp   struct {
+		/* Amount of already filtered data in the beginning of buf */
+		filtered int
+		/*
+		 * Buffer to hold a mix of filtered and unfiltered data. This
+		 * needs to be big enough to hold Alignment + 2 * Look-ahead:
+		 *
+		 * Type         Alignment   Look-ahead
+		 * x86              1           4
+		 * PowerPC          4           0
+		 * IA-64           16           0
+		 * ARM              4           0
+		 * ARM-Thumb        2           2
+		 * SPARC            4           0
+		 */
+		buf      []byte // slice buf will be backed by bufArray
+		bufArray [16]byte
+	}
+}
+
+/*
+ * This is used to test the most significant byte of a memory address
+ * in an x86 instruction.
+ */
+func bcjX86TestMSByte(b byte) bool {
+	return b == 0x00 || b == 0xff
+}
+
+func bcjX86Filter(s *xzDecBCJ, buf []byte) int {
+	var maskToAllowedStatus = []bool{
+		true, true, true, false, true, false, false, false,
+	}
+	var maskToBitNum = []byte{0, 1, 2, 2, 3, 3, 3, 3}
+	var i int
+	var prevPos int = -1
+	var prevMask uint32 = s.x86PrevMask
+	var src uint32
+	var dest uint32
+	var j uint32
+	var b byte
+	if len(buf) <= 4 {
+		return 0
+	}
+	for i = 0; i < len(buf)-4; i++ {
+		if buf[i]&0xfe != 0xe8 {
+			continue
+		}
+		prevPos = i - prevPos
+		if prevPos > 3 {
+			prevMask = 0
+		} else {
+			prevMask = (prevMask << (uint(prevPos) - 1)) & 7
+			if prevMask != 0 {
+				b = buf[i+4-int(maskToBitNum[prevMask])]
+				if !maskToAllowedStatus[prevMask] || bcjX86TestMSByte(b) {
+					prevPos = i
+					prevMask = prevMask<<1 | 1
+					continue
+				}
+			}
+		}
+		prevPos = i
+		if bcjX86TestMSByte(buf[i+4]) {
+			src = getLE32(buf[i+1:])
+			for {
+				dest = src - uint32(s.pos+i+5)
+				if prevMask == 0 {
+					break
+				}
+				j = uint32(maskToBitNum[prevMask]) * 8
+				b = byte(dest >> (24 - j))
+				if !bcjX86TestMSByte(b) {
+					break
+				}
+				src = dest ^ (1<<(32-j) - 1)
+			}
+			dest &= 0x01FFFFFF
+			dest |= 0 - dest&0x01000000
+			putLE32(dest, buf[i+1:])
+			i += 4
+		} else {
+			prevMask = prevMask<<1 | 1
+		}
+	}
+	prevPos = i - prevPos
+	if prevPos > 3 {
+		s.x86PrevMask = 0
+	} else {
+		s.x86PrevMask = prevMask << (uint(prevPos) - 1)
+	}
+	return i
+}
+
+func bcjPowerPCFilter(s *xzDecBCJ, buf []byte) int {
+	var i int
+	var instr uint32
+	for i = 0; i+4 <= len(buf); i += 4 {
+		instr = getBE32(buf[i:])
+		if instr&0xFC000003 == 0x48000001 {
+			instr &= 0x03FFFFFC
+			instr -= uint32(s.pos + i)
+			instr &= 0x03FFFFFC
+			instr |= 0x48000001
+			putBE32(instr, buf[i:])
+		}
+	}
+	return i
+}
+
+var bcjIA64BranchTable = [...]byte{
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	4, 4, 6, 6, 0, 0, 7, 7,
+	4, 4, 0, 0, 4, 4, 0, 0,
+}
+
+func bcjIA64Filter(s *xzDecBCJ, buf []byte) int {
+	var branchTable = bcjIA64BranchTable[:]
+	/*
+	 * The local variables take a little bit stack space, but it's less
+	 * than what LZMA2 decoder takes, so it doesn't make sense to reduce
+	 * stack usage here without doing that for the LZMA2 decoder too.
+	 */
+	/* Loop counters */
+	var i int
+	var j int
+	/* Instruction slot (0, 1, or 2) in the 128-bit instruction word */
+	var slot uint32
+	/* Bitwise offset of the instruction indicated by slot */
+	var bitPos uint32
+	/* bit_pos split into byte and bit parts */
+	var bytePos uint32
+	var bitRes uint32
+	/* Address part of an instruction */
+	var addr uint32
+	/* Mask used to detect which instructions to convert */
+	var mask uint32
+	/* 41-bit instruction stored somewhere in the lowest 48 bits */
+	var instr uint64
+	/* Instruction normalized with bit_res for easier manipulation */
+	var norm uint64
+	for i = 0; i+16 <= len(buf); i += 16 {
+		mask = uint32(branchTable[buf[i]&0x1f])
+		for slot, bitPos = 0, 5; slot < 3; slot, bitPos = slot+1, bitPos+41 {
+			if (mask>>slot)&1 == 0 {
+				continue
+			}
+			bytePos = bitPos >> 3
+			bitRes = bitPos & 7
+			instr = 0
+			for j = 0; j < 6; j++ {
+				instr |= uint64(buf[i+j+int(bytePos)]) << (8 * uint(j))
+			}
+			norm = instr >> bitRes
+			if (norm>>37)&0x0f == 0x05 && (norm>>9)&0x07 == 0 {
+				addr = uint32((norm >> 13) & 0x0fffff)
+				addr |= (uint32(norm>>36) & 1) << 20
+				addr <<= 4
+				addr -= uint32(s.pos + i)
+				addr >>= 4
+				norm &= ^(uint64(0x8fffff) << 13)
+				norm |= uint64(addr&0x0fffff) << 13
+				norm |= uint64(addr&0x100000) << (36 - 20)
+				instr &= 1<<bitRes - 1
+				instr |= norm << bitRes
+				for j = 0; j < 6; j++ {
+					buf[i+j+int(bytePos)] = byte(instr >> (8 * uint(j)))
+				}
+			}
+		}
+	}
+	return i
+}
+
+func bcjARMFilter(s *xzDecBCJ, buf []byte) int {
+	var i int
+	var addr uint32
+	for i = 0; i+4 <= len(buf); i += 4 {
+		if buf[i+3] == 0xeb {
+			addr = uint32(buf[i]) | uint32(buf[i+1])<<8 |
+				uint32(buf[i+2])<<16
+			addr <<= 2
+			addr -= uint32(s.pos + i + 8)
+			addr >>= 2
+			buf[i] = byte(addr)
+			buf[i+1] = byte(addr >> 8)
+			buf[i+2] = byte(addr >> 16)
+		}
+	}
+	return i
+}
+
+func bcjARMThumbFilter(s *xzDecBCJ, buf []byte) int {
+	var i int
+	var addr uint32
+	for i = 0; i+4 <= len(buf); i += 2 {
+		if buf[i+1]&0xf8 == 0xf0 && buf[i+3]&0xf8 == 0xf8 {
+			addr = uint32(buf[i+1]&0x07)<<19 |
+				uint32(buf[i])<<11 |
+				uint32(buf[i+3]&0x07)<<8 |
+				uint32(buf[i+2])
+			addr <<= 1
+			addr -= uint32(s.pos + i + 4)
+			addr >>= 1
+			buf[i+1] = byte(0xf0 | (addr>>19)&0x07)
+			buf[i] = byte(addr >> 11)
+			buf[i+3] = byte(0xf8 | (addr>>8)&0x07)
+			buf[i+2] = byte(addr)
+			i += 2
+		}
+	}
+	return i
+}
+
+func bcjSPARCFilter(s *xzDecBCJ, buf []byte) int {
+	var i int
+	var instr uint32
+	for i = 0; i+4 <= len(buf); i += 4 {
+		instr = getBE32(buf[i:])
+		if instr>>22 == 0x100 || instr>>22 == 0x1ff {
+			instr <<= 2
+			instr -= uint32(s.pos + i)
+			instr >>= 2
+			instr = (0x40000000 - instr&0x400000) |
+				0x40000000 | (instr & 0x3FFFFF)
+			putBE32(instr, buf[i:])
+		}
+	}
+	return i
+}
+
+/*
+ * Apply the selected BCJ filter. Update *pos and s.pos to match the amount
+ * of data that got filtered.
+ */
+func bcjApply(s *xzDecBCJ, buf []byte, pos *int) {
+	var filtered int
+	buf = buf[*pos:]
+	switch s.typ {
+	case idBCJX86:
+		filtered = bcjX86Filter(s, buf)
+	case idBCJPowerPC:
+		filtered = bcjPowerPCFilter(s, buf)
+	case idBCJIA64:
+		filtered = bcjIA64Filter(s, buf)
+	case idBCJARM:
+		filtered = bcjARMFilter(s, buf)
+	case idBCJARMThumb:
+		filtered = bcjARMThumbFilter(s, buf)
+	case idBCJSPARC:
+		filtered = bcjSPARCFilter(s, buf)
+	default:
+		/* Never reached */
+	}
+	*pos += filtered
+	s.pos += filtered
+}
+
+/*
+ * Flush pending filtered data from temp to the output buffer.
+ * Move the remaining mixture of possibly filtered and unfiltered
+ * data to the beginning of temp.
+ */
+func bcjFlush(s *xzDecBCJ, b *xzBuf) {
+	var copySize int
+	copySize = len(b.out) - b.outPos
+	if copySize > s.temp.filtered {
+		copySize = s.temp.filtered
+	}
+	copy(b.out[b.outPos:], s.temp.buf[:copySize])
+	b.outPos += copySize
+	s.temp.filtered -= copySize
+	copy(s.temp.buf, s.temp.buf[copySize:])
+	s.temp.buf = s.temp.buf[:len(s.temp.buf)-copySize]
+}
+
+/*
+ * Decode raw stream which has a BCJ filter as the first filter.
+ *
+ * The BCJ filter functions are primitive in sense that they process the
+ * data in chunks of 1-16 bytes. To hide this issue, this function does
+ * some buffering.
+ */
+func xzDecBCJRun(s *xzDecBCJ, b *xzBuf, chain func(*xzBuf) xzRet) xzRet {
+	var outStart int
+	/*
+	 * Flush pending already filtered data to the output buffer. Return
+	 * immediately if we couldn't flush everything, or if the next
+	 * filter in the chain had already returned xzStreamEnd.
+	 */
+	if s.temp.filtered > 0 {
+		bcjFlush(s, b)
+		if s.temp.filtered > 0 {
+			return xzOK
+		}
+		if s.ret == xzStreamEnd {
+			return xzStreamEnd
+		}
+	}
+	/*
+	 * If we have more output space than what is currently pending in
+	 * temp, copy the unfiltered data from temp to the output buffer
+	 * and try to fill the output buffer by decoding more data from the
+	 * next filter in the chain. Apply the BCJ filter on the new data
+	 * in the output buffer. If everything cannot be filtered, copy it
+	 * to temp and rewind the output buffer position accordingly.
+	 *
+	 * This needs to be always run when len(temp.buf) == 0 to handle a special
+	 * case where the output buffer is full and the next filter has no
+	 * more output coming but hasn't returned xzStreamEnd yet.
+	 */
+	if len(s.temp.buf) < len(b.out)-b.outPos || len(s.temp.buf) == 0 {
+		outStart = b.outPos
+		copy(b.out[b.outPos:], s.temp.buf)
+		b.outPos += len(s.temp.buf)
+		s.ret = chain(b)
+		if s.ret != xzStreamEnd && s.ret != xzOK {
+			return s.ret
+		}
+		bcjApply(s, b.out[:b.outPos], &outStart)
+		/*
+		 * As an exception, if the next filter returned xzStreamEnd,
+		 * we can do that too, since the last few bytes that remain
+		 * unfiltered are meant to remain unfiltered.
+		 */
+		if s.ret == xzStreamEnd {
+			return xzStreamEnd
+		}
+		s.temp.buf = s.temp.bufArray[:b.outPos-outStart]
+		b.outPos -= len(s.temp.buf)
+		copy(s.temp.buf, b.out[b.outPos:])
+		/*
+		 * If there wasn't enough input to the next filter to fill
+		 * the output buffer with unfiltered data, there's no point
+		 * to try decoding more data to temp.
+		 */
+		if b.outPos+len(s.temp.buf) < len(b.out) {
+			return xzOK
+		}
+	}
+	/*
+	 * We have unfiltered data in temp. If the output buffer isn't full
+	 * yet, try to fill the temp buffer by decoding more data from the
+	 * next filter. Apply the BCJ filter on temp. Then we hopefully can
+	 * fill the actual output buffer by copying filtered data from temp.
+	 * A mix of filtered and unfiltered data may be left in temp; it will
+	 * be taken care on the next call to this function.
+	 */
+	if b.outPos < len(b.out) {
+		/* Make b.out temporarily point to s.temp. */
+		s.out = b.out
+		s.outPos = b.outPos
+		b.out = s.temp.bufArray[:]
+		b.outPos = len(s.temp.buf)
+		s.ret = chain(b)
+		s.temp.buf = s.temp.bufArray[:b.outPos]
+		b.out = s.out
+		b.outPos = s.outPos
+		if s.ret != xzOK && s.ret != xzStreamEnd {
+			return s.ret
+		}
+		bcjApply(s, s.temp.buf, &s.temp.filtered)
+		/*
+		 * If the next filter returned xzStreamEnd, we mark that
+		 * everything is filtered, since the last unfiltered bytes
+		 * of the stream are meant to be left as is.
+		 */
+		if s.ret == xzStreamEnd {
+			s.temp.filtered = len(s.temp.buf)
+		}
+		bcjFlush(s, b)
+		if s.temp.filtered > 0 {
+			return xzOK
+		}
+	}
+	return s.ret
+}
+
+/*
+ * Allocate memory for BCJ decoders. xzDecBCJReset must be used before
+ * calling xzDecBCJRun.
+ */
+func xzDecBCJCreate() *xzDecBCJ {
+	return new(xzDecBCJ)
+}
+
+/*
+ * Decode the Filter ID of a BCJ filter and check the start offset is
+ * valid. Returns xzOK if the given Filter ID and offset is
+ * supported. Otherwise xzOptionsError is returned.
+ */
+func xzDecBCJReset(s *xzDecBCJ, id xzFilterID, offset int) xzRet {
+	switch id {
+	case idBCJX86:
+	case idBCJPowerPC:
+	case idBCJIA64:
+	case idBCJARM:
+	case idBCJARMThumb:
+	case idBCJSPARC:
+	default:
+		/* Unsupported Filter ID */
+		return xzOptionsError
+	}
+	// check offset is a multiple of alignment
+	switch id {
+	case idBCJPowerPC, idBCJARM, idBCJSPARC:
+		if offset%4 != 0 {
+			return xzOptionsError
+		}
+	case idBCJIA64:
+		if offset%16 != 0 {
+			return xzOptionsError
+		}
+	case idBCJARMThumb:
+		if offset%2 != 0 {
+			return xzOptionsError
+		}
+	}
+	s.typ = id
+	s.ret = xzOK
+	s.pos = offset
+	s.x86PrevMask = 0
+	s.temp.filtered = 0
+	s.temp.buf = nil
+	return xzOK
+}

vendor/github.com/therootcompany/xz/dec_delta.go

@@ -0,0 +1,55 @@
+/*
+ * Delta decoder
+ *
+ * Author: Lasse Collin <lasse.collin@tukaani.org>
+ *
+ * Translation to Go: Michael Cross <https://github.com/xi2>
+ *
+ * This file has been put into the public domain.
+ * You can do whatever you want with this file.
+ */
+
+package xz
+
+type xzDecDelta struct {
+	delta    [256]byte
+	pos      byte
+	distance int // in range [1, 256]
+}
+
+/*
+ * Decode raw stream which has a delta filter as the first filter.
+ */
+func xzDecDeltaRun(s *xzDecDelta, b *xzBuf, chain func(*xzBuf) xzRet) xzRet {
+	outStart := b.outPos
+	ret := chain(b)
+	for i := outStart; i < b.outPos; i++ {
+		tmp := b.out[i] + s.delta[byte(s.distance+int(s.pos))]
+		s.delta[s.pos] = tmp
+		b.out[i] = tmp
+		s.pos--
+	}
+	return ret
+}
+
+/*
+ * Allocate memory for a delta decoder. xzDecDeltaReset must be used
+ * before calling xzDecDeltaRun.
+ */
+func xzDecDeltaCreate() *xzDecDelta {
+	return new(xzDecDelta)
+}
+
+/*
+ * Returns xzOK if the given distance is valid. Otherwise
+ * xzOptionsError is returned.
+ */
+func xzDecDeltaReset(s *xzDecDelta, distance int) xzRet {
+	if distance < 1 || distance > 256 {
+		return xzOptionsError
+	}
+	s.delta = [256]byte{}
+	s.pos = 0
+	s.distance = distance
+	return xzOK
+}

vendor/github.com/therootcompany/xz/dec_stream.go

@@ -0,0 +1,932 @@
+/*
+ * .xz Stream decoder
+ *
+ * Author: Lasse Collin <lasse.collin@tukaani.org>
+ *
+ * Translation to Go: Michael Cross <https://github.com/xi2>
+ *
+ * This file has been put into the public domain.
+ * You can do whatever you want with this file.
+ */
+
+package xz
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"hash"
+	"hash/crc32"
+	"hash/crc64"
+)
+
+/* from linux/lib/xz/xz_stream.h **************************************/
+
+/*
+ * See the .xz file format specification at
+ * http://tukaani.org/xz/xz-file-format.txt
+ * to understand the container format.
+ */
+const (
+	streamHeaderSize = 12
+	headerMagic      = "\xfd7zXZ\x00"
+	footerMagic      = "YZ"
+)
+
+/*
+ * Variable-length integer can hold a 63-bit unsigned integer or a special
+ * value indicating that the value is unknown.
+ */
+type vliType uint64
+
+const (
+	vliUnknown vliType = ^vliType(0)
+	/* Maximum encoded size of a VLI */
+	vliBytesMax = 8 * 8 / 7 // (Sizeof(vliType) * 8 / 7)
+)
+
+/* from linux/lib/xz/xz_dec_stream.c **********************************/
+
+/* Hash used to validate the Index field */
+type xzDecHash struct {
+	unpadded     vliType
+	uncompressed vliType
+	sha256       hash.Hash
+}
+
+// type of xzDec.sequence
+type xzDecSeq int
+
+const (
+	seqStreamHeader xzDecSeq = iota
+	seqBlockStart
+	seqBlockHeader
+	seqBlockUncompress
+	seqBlockPadding
+	seqBlockCheck
+	seqIndex
+	seqIndexPadding
+	seqIndexCRC32
+	seqStreamFooter
+)
+
+// type of xzDec.index.sequence
+type xzDecIndexSeq int
+
+const (
+	seqIndexCount xzDecIndexSeq = iota
+	seqIndexUnpadded
+	seqIndexUncompressed
+)
+
+/**
+ * xzDec - Opaque type to hold the XZ decoder state
+ */
+type xzDec struct {
+	/* Position in decMain */
+	sequence xzDecSeq
+	/* Position in variable-length integers and Check fields */
+	pos int
+	/* Variable-length integer decoded by decVLI */
+	vli vliType
+	/* Saved inPos and outPos */
+	inStart  int
+	outStart int
+	/* CRC32 checksum hash used in Index */
+	crc32 hash.Hash
+	/* Hashes used in Blocks */
+	checkCRC32  hash.Hash
+	checkCRC64  hash.Hash
+	checkSHA256 hash.Hash
+	/* for checkTypes CRC32/CRC64/SHA256, check is one of the above 3 hashes */
+	check hash.Hash
+	/* Embedded stream header struct containing CheckType */
+	*Header
+	/*
+	 * True if the next call to xzDecRun is allowed to return
+	 * xzBufError.
+	 */
+	allowBufError bool
+	/* Information stored in Block Header */
+	blockHeader struct {
+		/*
+		 * Value stored in the Compressed Size field, or
+		 * vliUnknown if Compressed Size is not present.
+		 */
+		compressed vliType
+		/*
+		 * Value stored in the Uncompressed Size field, or
+		 * vliUnknown if Uncompressed Size is not present.
+		 */
+		uncompressed vliType
+		/* Size of the Block Header field */
+		size int
+	}
+	/* Information collected when decoding Blocks */
+	block struct {
+		/* Observed compressed size of the current Block */
+		compressed vliType
+		/* Observed uncompressed size of the current Block */
+		uncompressed vliType
+		/* Number of Blocks decoded so far */
+		count vliType
+		/*
+		 * Hash calculated from the Block sizes. This is used to
+		 * validate the Index field.
+		 */
+		hash xzDecHash
+	}
+	/* Variables needed when verifying the Index field */
+	index struct {
+		/* Position in decIndex */
+		sequence xzDecIndexSeq
+		/* Size of the Index in bytes */
+		size vliType
+		/* Number of Records (matches block.count in valid files) */
+		count vliType
+		/*
+		 * Hash calculated from the Records (matches block.hash in
+		 * valid files).
+		 */
+		hash xzDecHash
+	}
+	/*
+	 * Temporary buffer needed to hold Stream Header, Block Header,
+	 * and Stream Footer. The Block Header is the biggest (1 KiB)
+	 * so we reserve space according to that. bufArray has to be aligned
+	 * to a multiple of four bytes; the variables before it
+	 * should guarantee this.
+	 */
+	temp struct {
+		pos      int
+		buf      []byte // slice buf will be backed by bufArray
+		bufArray [1024]byte
+	}
+	// chain is the function (or to be more precise, closure) which
+	// does the decompression and will call into the lzma2 and other
+	// filter code as needed. It is constructed by decBlockHeader
+	chain func(b *xzBuf) xzRet
+	// lzma2 holds the state of the last filter (which must be LZMA2)
+	lzma2 *xzDecLZMA2
+	// pointers to allocated BCJ/Delta filters
+	bcjs   []*xzDecBCJ
+	deltas []*xzDecDelta
+	// number of currently in use BCJ/Delta filters from the above
+	bcjsUsed   int
+	deltasUsed int
+}
+
+/* Sizes of the Check field with different Check IDs */
+var checkSizes = [...]byte{
+	0,
+	4, 4, 4,
+	8, 8, 8,
+	16, 16, 16,
+	32, 32, 32,
+	64, 64, 64,
+}
+
+/*
+ * Fill s.temp by copying data starting from b.in[b.inPos]. Caller
+ * must have set s.temp.pos to indicate how much data we are supposed
+ * to copy into s.temp.buf. Return true once s.temp.pos has reached
+ * len(s.temp.buf).
+ */
+func fillTemp(s *xzDec, b *xzBuf) bool {
+	copySize := len(b.in) - b.inPos
+	tempRemaining := len(s.temp.buf) - s.temp.pos
+	if copySize > tempRemaining {
+		copySize = tempRemaining
+	}
+	copy(s.temp.buf[s.temp.pos:], b.in[b.inPos:])
+	b.inPos += copySize
+	s.temp.pos += copySize
+	if s.temp.pos == len(s.temp.buf) {
+		s.temp.pos = 0
+		return true
+	}
+	return false
+}
+
+/* Decode a variable-length integer (little-endian base-128 encoding) */
+func decVLI(s *xzDec, in []byte, inPos *int) xzRet {
+	var byte byte
+	if s.pos == 0 {
+		s.vli = 0
+	}
+	for *inPos < len(in) {
+		byte = in[*inPos]
+		*inPos++
+		s.vli |= vliType(byte&0x7f) << uint(s.pos)
+		if byte&0x80 == 0 {
+			/* Don't allow non-minimal encodings. */
+			if byte == 0 && s.pos != 0 {
+				return xzDataError
+			}
+			s.pos = 0
+			return xzStreamEnd
+		}
+		s.pos += 7
+		if s.pos == 7*vliBytesMax {
+			return xzDataError
+		}
+	}
+	return xzOK
+}
+
+/*
+ * Decode the Compressed Data field from a Block. Update and validate
+ * the observed compressed and uncompressed sizes of the Block so that
+ * they don't exceed the values possibly stored in the Block Header
+ * (validation assumes that no integer overflow occurs, since vliType
+ * is uint64). Update s.check if presence of the CRC32/CRC64/SHA256
+ * field was indicated in Stream Header.
+ *
+ * Once the decoding is finished, validate that the observed sizes match
+ * the sizes possibly stored in the Block Header. Update the hash and
+ * Block count, which are later used to validate the Index field.
+ */
+func decBlock(s *xzDec, b *xzBuf) xzRet {
+	var ret xzRet
+	s.inStart = b.inPos
+	s.outStart = b.outPos
+	ret = s.chain(b)
+	s.block.compressed += vliType(b.inPos - s.inStart)
+	s.block.uncompressed += vliType(b.outPos - s.outStart)
+	/*
+	 * There is no need to separately check for vliUnknown since
+	 * the observed sizes are always smaller than vliUnknown.
+	 */
+	if s.block.compressed > s.blockHeader.compressed ||
+		s.block.uncompressed > s.blockHeader.uncompressed {
+		return xzDataError
+	}
+	switch s.CheckType {
+	case CheckCRC32, CheckCRC64, CheckSHA256:
+		_, _ = s.check.Write(b.out[s.outStart:b.outPos])
+	}
+	if ret == xzStreamEnd {
+		if s.blockHeader.compressed != vliUnknown &&
+			s.blockHeader.compressed != s.block.compressed {
+			return xzDataError
+		}
+		if s.blockHeader.uncompressed != vliUnknown &&
+			s.blockHeader.uncompressed != s.block.uncompressed {
+			return xzDataError
+		}
+		s.block.hash.unpadded +=
+			vliType(s.blockHeader.size) + s.block.compressed
+		s.block.hash.unpadded += vliType(checkSizes[s.CheckType])
+		s.block.hash.uncompressed += s.block.uncompressed
+		var buf [2 * 8]byte // 2*Sizeof(vliType)
+		putLE64(uint64(s.block.hash.unpadded), buf[:])
+		putLE64(uint64(s.block.hash.uncompressed), buf[8:])
+		_, _ = s.block.hash.sha256.Write(buf[:])
+		s.block.count++
+	}
+	return ret
+}
+
+/* Update the Index size and the CRC32 hash. */
+func indexUpdate(s *xzDec, b *xzBuf) {
+	inUsed := b.inPos - s.inStart
+	s.index.size += vliType(inUsed)
+	_, _ = s.crc32.Write(b.in[s.inStart : s.inStart+inUsed])
+}
+
+/*
+ * Decode the Number of Records, Unpadded Size, and Uncompressed Size
+ * fields from the Index field. That is, Index Padding and CRC32 are not
+ * decoded by this function.
+ *
+ * This can return xzOK (more input needed), xzStreamEnd (everything
+ * successfully decoded), or xzDataError (input is corrupt).
+ */
+func decIndex(s *xzDec, b *xzBuf) xzRet {
+	var ret xzRet
+	for {
+		ret = decVLI(s, b.in, &b.inPos)
+		if ret != xzStreamEnd {
+			indexUpdate(s, b)
+			return ret
+		}
+		switch s.index.sequence {
+		case seqIndexCount:
+			s.index.count = s.vli
+			/*
+			 * Validate that the Number of Records field
+			 * indicates the same number of Records as
+			 * there were Blocks in the Stream.
+			 */
+			if s.index.count != s.block.count {
+				return xzDataError
+			}
+			s.index.sequence = seqIndexUnpadded
+		case seqIndexUnpadded:
+			s.index.hash.unpadded += s.vli
+			s.index.sequence = seqIndexUncompressed
+		case seqIndexUncompressed:
+			s.index.hash.uncompressed += s.vli
+			var buf [2 * 8]byte // 2*Sizeof(vliType)
+			putLE64(uint64(s.index.hash.unpadded), buf[:])
+			putLE64(uint64(s.index.hash.uncompressed), buf[8:])
+			_, _ = s.index.hash.sha256.Write(buf[:])
+			s.index.count--
+			s.index.sequence = seqIndexUnpadded
+		}
+		if !(s.index.count > 0) {
+			break
+		}
+	}
+	return xzStreamEnd
+}
+
+/*
+ * Validate that the next 4 bytes match s.crc32.Sum(nil). s.pos must
+ * be zero when starting to validate the first byte.
+ */
+func crcValidate(s *xzDec, b *xzBuf) xzRet {
+	sum := s.crc32.Sum(nil)
+	// CRC32 - reverse slice
+	sum[0], sum[1], sum[2], sum[3] = sum[3], sum[2], sum[1], sum[0]
+	for {
+		if b.inPos == len(b.in) {
+			return xzOK
+		}
+		if sum[s.pos] != b.in[b.inPos] {
+			return xzDataError
+		}
+		b.inPos++
+		s.pos++
+		if !(s.pos < 4) {
+			break
+		}
+	}
+	s.crc32.Reset()
+	s.pos = 0
+	return xzStreamEnd
+}
+
+/*
+ * Validate that the next 4/8/32 bytes match s.check.Sum(nil). s.pos
+ * must be zero when starting to validate the first byte.
+ */
+func checkValidate(s *xzDec, b *xzBuf) xzRet {
+	sum := s.check.Sum(nil)
+	if s.CheckType == CheckCRC32 || s.CheckType == CheckCRC64 {
+		// CRC32/64 - reverse slice
+		for i, j := 0, len(sum)-1; i < j; i, j = i+1, j-1 {
+			sum[i], sum[j] = sum[j], sum[i]
+		}
+	}
+	for {
+		if b.inPos == len(b.in) {
+			return xzOK
+		}
+		if sum[s.pos] != b.in[b.inPos] {
+			return xzDataError
+		}
+		b.inPos++
+		s.pos++
+		if !(s.pos < len(sum)) {
+			break
+		}
+	}
+	s.check.Reset()
+	s.pos = 0
+	return xzStreamEnd
+}
+
+/*
+ * Skip over the Check field when the Check ID is not supported.
+ * Returns true once the whole Check field has been skipped over.
+ */
+func checkSkip(s *xzDec, b *xzBuf) bool {
+	for s.pos < int(checkSizes[s.CheckType]) {
+		if b.inPos == len(b.in) {
+			return false
+		}
+		b.inPos++
+		s.pos++
+	}
+	s.pos = 0
+	return true
+}
+
+/* polynomial table used in decStreamHeader below */
+var xzCRC64Table = crc64.MakeTable(crc64.ECMA)
+
+/* Decode the Stream Header field (the first 12 bytes of the .xz Stream). */
+func decStreamHeader(s *xzDec) xzRet {
+	if string(s.temp.buf[:len(headerMagic)]) != headerMagic {
+		return xzFormatError
+	}
+	if crc32.ChecksumIEEE(s.temp.buf[len(headerMagic):len(headerMagic)+2]) !=
+		getLE32(s.temp.buf[len(headerMagic)+2:]) {
+		return xzDataError
+	}
+	if s.temp.buf[len(headerMagic)] != 0 {
+		return xzOptionsError
+	}
+	/*
+	 * Of integrity checks, we support none (Check ID = 0),
+	 * CRC32 (Check ID = 1), CRC64 (Check ID = 4) and SHA256 (Check ID = 10)
+	 * However, we will accept other check types too, but then the check
+	 * won't be verified and a warning (xzUnsupportedCheck) will be given.
+	 */
+	s.CheckType = CheckID(s.temp.buf[len(headerMagic)+1])
+	if s.CheckType > checkMax {
+		return xzOptionsError
+	}
+	switch s.CheckType {
+	case CheckNone:
+		// CheckNone: no action needed
+	case CheckCRC32:
+		if s.checkCRC32 == nil {
+			s.checkCRC32 = crc32.NewIEEE()
+		} else {
+			s.checkCRC32.Reset()
+		}
+		s.check = s.checkCRC32
+	case CheckCRC64:
+		if s.checkCRC64 == nil {
+			s.checkCRC64 = crc64.New(xzCRC64Table)
+		} else {
+			s.checkCRC64.Reset()
+		}
+		s.check = s.checkCRC64
+	case CheckSHA256:
+		if s.checkSHA256 == nil {
+			s.checkSHA256 = sha256.New()
+		} else {
+			s.checkSHA256.Reset()
+		}
+		s.check = s.checkSHA256
+	default:
+		return xzUnsupportedCheck
+	}
+	return xzOK
+}
+
+/* Decode the Stream Footer field (the last 12 bytes of the .xz Stream) */
+func decStreamFooter(s *xzDec) xzRet {
+	if string(s.temp.buf[10:10+len(footerMagic)]) != footerMagic {
+		return xzDataError
+	}
+	if crc32.ChecksumIEEE(s.temp.buf[4:10]) != getLE32(s.temp.buf) {
+		return xzDataError
+	}
+	/*
+	 * Validate Backward Size. Note that we never added the size of the
+	 * Index CRC32 field to s->index.size, thus we use s->index.size / 4
+	 * instead of s->index.size / 4 - 1.
+	 */
+	if s.index.size>>2 != vliType(getLE32(s.temp.buf[4:])) {
+		return xzDataError
+	}
+	if s.temp.buf[8] != 0 || CheckID(s.temp.buf[9]) != s.CheckType {
+		return xzDataError
+	}
+	/*
+	 * Use xzStreamEnd instead of xzOK to be more convenient
+	 * for the caller.
+	 */
+	return xzStreamEnd
+}
+
+/* Decode the Block Header and initialize the filter chain. */
+func decBlockHeader(s *xzDec) xzRet {
+	var ret xzRet
+	/*
+	 * Validate the CRC32. We know that the temp buffer is at least
+	 * eight bytes so this is safe.
+	 */
+	crc := getLE32(s.temp.buf[len(s.temp.buf)-4:])
+	s.temp.buf = s.temp.buf[:len(s.temp.buf)-4]
+	if crc32.ChecksumIEEE(s.temp.buf) != crc {
+		return xzDataError
+	}
+	s.temp.pos = 2
+	/*
+	 * Catch unsupported Block Flags.
+	 */
+	if s.temp.buf[1]&0x3C != 0 {
+		return xzOptionsError
+	}
+	/* Compressed Size */
+	if s.temp.buf[1]&0x40 != 0 {
+		if decVLI(s, s.temp.buf, &s.temp.pos) != xzStreamEnd {
+			return xzDataError
+		}
+		if s.vli >= 1<<63-8 {
+			// the whole block must stay smaller than 2^63 bytes
+			// the block header cannot be smaller than 8 bytes
+			return xzDataError
+		}
+		if s.vli == 0 {
+			// compressed size must be non-zero
+			return xzDataError
+		}
+		s.blockHeader.compressed = s.vli
+	} else {
+		s.blockHeader.compressed = vliUnknown
+	}
+	/* Uncompressed Size */
+	if s.temp.buf[1]&0x80 != 0 {
+		if decVLI(s, s.temp.buf, &s.temp.pos) != xzStreamEnd {
+			return xzDataError
+		}
+		s.blockHeader.uncompressed = s.vli
+	} else {
+		s.blockHeader.uncompressed = vliUnknown
+	}
+	// get total number of filters (1-4)
+	filterTotal := int(s.temp.buf[1]&0x03) + 1
+	// slice to hold decoded filters
+	filterList := make([]struct {
+		id    xzFilterID
+		props uint32
+	}, filterTotal)
+	// decode the non-last filters which cannot be LZMA2
+	for i := 0; i < filterTotal-1; i++ {
+		/* Valid Filter Flags always take at least two bytes. */
+		if len(s.temp.buf)-s.temp.pos < 2 {
+			return xzDataError
+		}
+		s.temp.pos += 2
+		switch id := xzFilterID(s.temp.buf[s.temp.pos-2]); id {
+		case idDelta:
+			// delta filter
+			if s.temp.buf[s.temp.pos-1] != 0x01 {
+				return xzOptionsError
+			}
+			/* Filter Properties contains distance - 1 */
+			if len(s.temp.buf)-s.temp.pos < 1 {
+				return xzDataError
+			}
+			props := uint32(s.temp.buf[s.temp.pos])
+			s.temp.pos++
+			filterList[i] = struct {
+				id    xzFilterID
+				props uint32
+			}{id: id, props: props}
+		case idBCJX86, idBCJPowerPC, idBCJIA64,
+			idBCJARM, idBCJARMThumb, idBCJSPARC:
+			// bcj filter
+			var props uint32
+			switch s.temp.buf[s.temp.pos-1] {
+			case 0x00:
+				props = 0
+			case 0x04:
+				if len(s.temp.buf)-s.temp.pos < 4 {
+					return xzDataError
+				}
+				props = getLE32(s.temp.buf[s.temp.pos:])
+				s.temp.pos += 4
+			default:
+				return xzOptionsError
+			}
+			filterList[i] = struct {
+				id    xzFilterID
+				props uint32
+			}{id: id, props: props}
+		default:
+			return xzOptionsError
+		}
+	}
+	/*
+	 * decode the last filter which must be LZMA2
+	 */
+	if len(s.temp.buf)-s.temp.pos < 2 {
+		return xzDataError
+	}
+	/* Filter ID = LZMA2 */
+	if xzFilterID(s.temp.buf[s.temp.pos]) != idLZMA2 {
+		return xzOptionsError
+	}
+	s.temp.pos++
+	/* Size of Properties = 1-byte Filter Properties */
+	if s.temp.buf[s.temp.pos] != 0x01 {
+		return xzOptionsError
+	}
+	s.temp.pos++
+	/* Filter Properties contains LZMA2 dictionary size. */
+	if len(s.temp.buf)-s.temp.pos < 1 {
+		return xzDataError
+	}
+	props := uint32(s.temp.buf[s.temp.pos])
+	s.temp.pos++
+	filterList[filterTotal-1] = struct {
+		id    xzFilterID
+		props uint32
+	}{id: idLZMA2, props: props}
+	/*
+	 * Process the filter list and create s.chain, going from last
+	 * filter (LZMA2) to first filter
+	 *
+	 * First, LZMA2.
+	 */
+	ret = xzDecLZMA2Reset(s.lzma2, byte(filterList[filterTotal-1].props))
+	if ret != xzOK {
+		return ret
+	}
+	s.chain = func(b *xzBuf) xzRet {
+		return xzDecLZMA2Run(s.lzma2, b)
+	}
+	/*
+	 * Now the non-last filters
+	 */
+	for i := filterTotal - 2; i >= 0; i-- {
+		switch id := filterList[i].id; id {
+		case idDelta:
+			// delta filter
+			var delta *xzDecDelta
+			if s.deltasUsed < len(s.deltas) {
+				delta = s.deltas[s.deltasUsed]
+			} else {
+				delta = xzDecDeltaCreate()
+				s.deltas = append(s.deltas, delta)
+			}
+			s.deltasUsed++
+			ret = xzDecDeltaReset(delta, int(filterList[i].props)+1)
+			if ret != xzOK {
+				return ret
+			}
+			chain := s.chain
+			s.chain = func(b *xzBuf) xzRet {
+				return xzDecDeltaRun(delta, b, chain)
+			}
+		case idBCJX86, idBCJPowerPC, idBCJIA64,
+			idBCJARM, idBCJARMThumb, idBCJSPARC:
+			// bcj filter
+			var bcj *xzDecBCJ
+			if s.bcjsUsed < len(s.bcjs) {
+				bcj = s.bcjs[s.bcjsUsed]
+			} else {
+				bcj = xzDecBCJCreate()
+				s.bcjs = append(s.bcjs, bcj)
+			}
+			s.bcjsUsed++
+			ret = xzDecBCJReset(bcj, id, int(filterList[i].props))
+			if ret != xzOK {
+				return ret
+			}
+			chain := s.chain
+			s.chain = func(b *xzBuf) xzRet {
+				return xzDecBCJRun(bcj, b, chain)
+			}
+		}
+	}
+	/* The rest must be Header Padding. */
+	for s.temp.pos < len(s.temp.buf) {
+		if s.temp.buf[s.temp.pos] != 0x00 {
+			return xzOptionsError
+		}
+		s.temp.pos++
+	}
+	s.temp.pos = 0
+	s.block.compressed = 0
+	s.block.uncompressed = 0
+	return xzOK
+}
+
+func decMain(s *xzDec, b *xzBuf) xzRet {
+	var ret xzRet
+	/*
+	 * Store the start position for the case when we are in the middle
+	 * of the Index field.
+	 */
+	s.inStart = b.inPos
+	for {
+		switch s.sequence {
+		case seqStreamHeader:
+			/*
+			 * Stream Header is copied to s.temp, and then
+			 * decoded from there. This way if the caller
+			 * gives us only little input at a time, we can
+			 * still keep the Stream Header decoding code
+			 * simple. Similar approach is used in many places
+			 * in this file.
+			 */
+			if !fillTemp(s, b) {
+				return xzOK
+			}
+			/*
+			 * If decStreamHeader returns
+			 * xzUnsupportedCheck, it is still possible
+			 * to continue decoding. Thus, update s.sequence
+			 * before calling decStreamHeader.
+			 */
+			s.sequence = seqBlockStart
+			ret = decStreamHeader(s)
+			if ret != xzOK {
+				return ret
+			}
+			fallthrough
+		case seqBlockStart:
+			/* We need one byte of input to continue. */
+			if b.inPos == len(b.in) {
+				return xzOK
+			}
+			/* See if this is the beginning of the Index field. */
+			if b.in[b.inPos] == 0 {
+				s.inStart = b.inPos
+				b.inPos++
+				s.sequence = seqIndex
+				break
+			}
+			/*
+			 * Calculate the size of the Block Header and
+			 * prepare to decode it.
+			 */
+			s.blockHeader.size = (int(b.in[b.inPos]) + 1) * 4
+			s.temp.buf = s.temp.bufArray[:s.blockHeader.size]
+			s.temp.pos = 0
+			s.sequence = seqBlockHeader
+			fallthrough
+		case seqBlockHeader:
+			if !fillTemp(s, b) {
+				return xzOK
+			}
+			ret = decBlockHeader(s)
+			if ret != xzOK {
+				return ret
+			}
+			s.sequence = seqBlockUncompress
+			fallthrough
+		case seqBlockUncompress:
+			ret = decBlock(s, b)
+			if ret != xzStreamEnd {
+				return ret
+			}
+			s.sequence = seqBlockPadding
+			fallthrough
+		case seqBlockPadding:
+			/*
+			 * Size of Compressed Data + Block Padding
+			 * must be a multiple of four. We don't need
+			 * s->block.compressed for anything else
+			 * anymore, so we use it here to test the size
+			 * of the Block Padding field.
+			 */
+			for s.block.compressed&3 != 0 {
+				if b.inPos == len(b.in) {
+					return xzOK
+				}
+				if b.in[b.inPos] != 0 {
+					return xzDataError
+				}
+				b.inPos++
+				s.block.compressed++
+			}
+			s.sequence = seqBlockCheck
+			fallthrough
+		case seqBlockCheck:
+			switch s.CheckType {
+			case CheckCRC32, CheckCRC64, CheckSHA256:
+				ret = checkValidate(s, b)
+				if ret != xzStreamEnd {
+					return ret
+				}
+			default:
+				if !checkSkip(s, b) {
+					return xzOK
+				}
+			}
+			s.sequence = seqBlockStart
+		case seqIndex:
+			ret = decIndex(s, b)
+			if ret != xzStreamEnd {
+				return ret
+			}
+			s.sequence = seqIndexPadding
+			fallthrough
+		case seqIndexPadding:
+			for (s.index.size+vliType(b.inPos-s.inStart))&3 != 0 {
+				if b.inPos == len(b.in) {
+					indexUpdate(s, b)
+					return xzOK
+				}
+				if b.in[b.inPos] != 0 {
+					return xzDataError
+				}
+				b.inPos++
+			}
+			/* Finish the CRC32 value and Index size. */
+			indexUpdate(s, b)
+			/* Compare the hashes to validate the Index field. */
+			if !bytes.Equal(
+				s.block.hash.sha256.Sum(nil), s.index.hash.sha256.Sum(nil)) {
+				return xzDataError
+			}
+			s.sequence = seqIndexCRC32
+			fallthrough
+		case seqIndexCRC32:
+			ret = crcValidate(s, b)
+			if ret != xzStreamEnd {
+				return ret
+			}
+			s.temp.buf = s.temp.bufArray[:streamHeaderSize]
+			s.sequence = seqStreamFooter
+			fallthrough
+		case seqStreamFooter:
+			if !fillTemp(s, b) {
+				return xzOK
+			}
+			return decStreamFooter(s)
+		}
+	}
+	/* Never reached */
+}
+
+/**
+ * xzDecRun - Run the XZ decoder
+ * @s:         Decoder state allocated using xzDecInit
+ * @b:         Input and output buffers
+ *
+ * See xzRet for details of return values.
+ *
+ * xzDecRun is a wrapper for decMain to handle some special cases.
+ *
+ * We must return xzBufError when it seems clear that we are not
+ * going to make any progress anymore. This is to prevent the caller
+ * from calling us infinitely when the input file is truncated or
+ * otherwise corrupt. Since zlib-style API allows that the caller
+ * fills the input buffer only when the decoder doesn't produce any
+ * new output, we have to be careful to avoid returning xzBufError
+ * too easily: xzBufError is returned only after the second
+ * consecutive call to xzDecRun that makes no progress.
+ */
+func xzDecRun(s *xzDec, b *xzBuf) xzRet {
+	inStart := b.inPos
+	outStart := b.outPos
+	ret := decMain(s, b)
+	if ret == xzOK && inStart == b.inPos && outStart == b.outPos {
+		if s.allowBufError {
+			ret = xzBufError
+		}
+		s.allowBufError = true
+	} else {
+		s.allowBufError = false
+	}
+	return ret
+}
+
+/**
+ * xzDecInit - Allocate and initialize a XZ decoder state
+ * @dictMax:    Maximum size of the LZMA2 dictionary (history buffer) for
+ *              decoding. LZMA2 dictionary is always 2^n bytes
+ *              or 2^n + 2^(n-1) bytes (the latter sizes are less common
+ *              in practice), so other values for dictMax don't make sense.
+ *
+ * dictMax specifies the maximum allowed dictionary size that xzDecRun
+ * may allocate once it has parsed the dictionary size from the stream
+ * headers. This way excessive allocations can be avoided while still
+ * limiting the maximum memory usage to a sane value to prevent running the
+ * system out of memory when decompressing streams from untrusted sources.
+ *
+ * xzDecInit returns a pointer to an xzDec, which is ready to be used with
+ * xzDecRun.
+ */
+func xzDecInit(dictMax uint32, header *Header) *xzDec {
+	s := new(xzDec)
+	s.crc32 = crc32.NewIEEE()
+	s.Header = header
+	s.block.hash.sha256 = sha256.New()
+	s.index.hash.sha256 = sha256.New()
+	s.lzma2 = xzDecLZMA2Create(dictMax)
+	xzDecReset(s)
+	return s
+}
+
+/**
+ * xzDecReset - Reset an already allocated decoder state
+ * @s:          Decoder state allocated using xzDecInit
+ *
+ * This function can be used to reset the decoder state without
+ * reallocating memory with xzDecInit.
+ */
+func xzDecReset(s *xzDec) {
+	s.sequence = seqStreamHeader
+	s.allowBufError = false
+	s.pos = 0
+	s.crc32.Reset()
+	s.check = nil
+	s.CheckType = checkUnset
+	s.block.compressed = 0
+	s.block.uncompressed = 0
+	s.block.count = 0
+	s.block.hash.unpadded = 0
+	s.block.hash.uncompressed = 0
+	s.block.hash.sha256.Reset()
+	s.index.sequence = seqIndexCount
+	s.index.size = 0
+	s.index.count = 0
+	s.index.hash.unpadded = 0
+	s.index.hash.uncompressed = 0
+	s.index.hash.sha256.Reset()
+	s.temp.pos = 0
+	s.temp.buf = s.temp.bufArray[:streamHeaderSize]
+	s.chain = nil
+	s.bcjsUsed = 0
+	s.deltasUsed = 0
+}

vendor/github.com/therootcompany/xz/dec_util.go

@@ -0,0 +1,52 @@
+/*
+ * XZ decompressor utility functions
+ *
+ * Author: Michael Cross <https://github.com/xi2>
+ *
+ * This file has been put into the public domain.
+ * You can do whatever you want with this file.
+ */
+
+package xz
+
+func getLE32(buf []byte) uint32 {
+	return uint32(buf[0]) |
+		uint32(buf[1])<<8 |
+		uint32(buf[2])<<16 |
+		uint32(buf[3])<<24
+}
+
+func getBE32(buf []byte) uint32 {
+	return uint32(buf[0])<<24 |
+		uint32(buf[1])<<16 |
+		uint32(buf[2])<<8 |
+		uint32(buf[3])
+}
+
+func putLE32(val uint32, buf []byte) {
+	buf[0] = byte(val)
+	buf[1] = byte(val >> 8)
+	buf[2] = byte(val >> 16)
+	buf[3] = byte(val >> 24)
+	return
+}
+
+func putBE32(val uint32, buf []byte) {
+	buf[0] = byte(val >> 24)
+	buf[1] = byte(val >> 16)
+	buf[2] = byte(val >> 8)
+	buf[3] = byte(val)
+	return
+}
+
+func putLE64(val uint64, buf []byte) {
+	buf[0] = byte(val)
+	buf[1] = byte(val >> 8)
+	buf[2] = byte(val >> 16)
+	buf[3] = byte(val >> 24)
+	buf[4] = byte(val >> 32)
+	buf[5] = byte(val >> 40)
+	buf[6] = byte(val >> 48)
+	buf[7] = byte(val >> 56)
+	return
+}

vendor/github.com/therootcompany/xz/dec_xz.go

@@ -0,0 +1,124 @@
+/*
+ * XZ decompressor
+ *
+ * Authors: Lasse Collin <lasse.collin@tukaani.org>
+ *          Igor Pavlov <http://7-zip.org/>
+ *
+ * Translation to Go: Michael Cross <https://github.com/xi2>
+ *
+ * This file has been put into the public domain.
+ * You can do whatever you want with this file.
+ */
+
+package xz
+
+/* from linux/include/linux/xz.h **************************************/
+
+/**
+ * xzRet - Return codes
+ * @xzOK:                   Everything is OK so far. More input or more
+ *                          output space is required to continue.
+ * @xzStreamEnd:            Operation finished successfully.
+ * @xzUnSupportedCheck:     Integrity check type is not supported. Decoding
+ *                          is still possible by simply calling xzDecRun
+ *                          again.
+ * @xzMemlimitError:        A bigger LZMA2 dictionary would be needed than
+ *                          allowed by the dictMax argument given to
+ *                          xzDecInit.
+ * @xzFormatError:          File format was not recognized (wrong magic
+ *                          bytes).
+ * @xzOptionsError:         This implementation doesn't support the requested
+ *                          compression options. In the decoder this means
+ *                          that the header CRC32 matches, but the header
+ *                          itself specifies something that we don't support.
+ * @xzDataError:            Compressed data is corrupt.
+ * @xzBufError:             Cannot make any progress.
+ *
+ * xzBufError is returned when two consecutive calls to XZ code cannot
+ * consume any input and cannot produce any new output.  This happens
+ * when there is no new input available, or the output buffer is full
+ * while at least one output byte is still pending. Assuming your code
+ * is not buggy, you can get this error only when decoding a
+ * compressed stream that is truncated or otherwise corrupt.
+ */
+type xzRet int
+
+const (
+	xzOK xzRet = iota
+	xzStreamEnd
+	xzUnsupportedCheck
+	xzMemlimitError
+	xzFormatError
+	xzOptionsError
+	xzDataError
+	xzBufError
+)
+
+/**
+ * xzBuf - Passing input and output buffers to XZ code
+ * @in:         Input buffer.
+ * @inPos:      Current position in the input buffer. This must not exceed
+ *              input buffer size.
+ * @out:        Output buffer.
+ * @outPos:     Current position in the output buffer. This must not exceed
+ *              output buffer size.
+ *
+ * Only the contents of the output buffer from out[outPos] onward, and
+ * the variables inPos and outPos are modified by the XZ code.
+ */
+type xzBuf struct {
+	in     []byte
+	inPos  int
+	out    []byte
+	outPos int
+}
+
+/* All XZ filter IDs */
+type xzFilterID int64
+
+const (
+	idDelta       xzFilterID = 0x03
+	idBCJX86      xzFilterID = 0x04
+	idBCJPowerPC  xzFilterID = 0x05
+	idBCJIA64     xzFilterID = 0x06
+	idBCJARM      xzFilterID = 0x07
+	idBCJARMThumb xzFilterID = 0x08
+	idBCJSPARC    xzFilterID = 0x09
+	idLZMA2       xzFilterID = 0x21
+)
+
+// CheckID is the type of the data integrity check in an XZ stream
+// calculated from the uncompressed data.
+type CheckID int
+
+func (id CheckID) String() string {
+	switch id {
+	case CheckNone:
+		return "None"
+	case CheckCRC32:
+		return "CRC32"
+	case CheckCRC64:
+		return "CRC64"
+	case CheckSHA256:
+		return "SHA256"
+	default:
+		return "Unknown"
+	}
+}
+
+const (
+	CheckNone   CheckID = 0x00
+	CheckCRC32  CheckID = 0x01
+	CheckCRC64  CheckID = 0x04
+	CheckSHA256 CheckID = 0x0A
+	checkMax    CheckID = 0x0F
+	checkUnset  CheckID = -1
+)
+
+// An XZ stream contains a stream header which holds information about
+// the stream. That information is exposed as fields of the
+// Reader. Currently it contains only the stream's data integrity
+// check type.
+type Header struct {
+	CheckType CheckID // type of the stream's data integrity check
+}

vendor/github.com/therootcompany/xz/doc.go

@@ -0,0 +1,35 @@
+// Package xz implements XZ decompression natively in Go.
+//
+// Usage
+//
+// For ease of use, this package is designed to have a similar API to
+// compress/gzip. See the examples for further details.
+//
+// Implementation
+//
+// This package is a translation from C to Go of XZ Embedded
+// (http://tukaani.org/xz/embedded.html) with enhancements made so as
+// to implement all mandatory and optional parts of the XZ file format
+// specification v1.0.4. It supports all filters and block check
+// types, supports multiple streams, and performs index verification
+// using SHA-256 as recommended by the specification.
+//
+// Speed
+//
+// On the author's Intel Ivybridge i5, decompression speed is about
+// half that of the standard XZ Utils (tested with a recent linux
+// kernel tarball).
+//
+// Thanks
+//
+// Thanks are due to Lasse Collin and Igor Pavlov, the authors of XZ
+// Embedded, on whose code package xz is based. It would not exist
+// without their decision to allow others to modify and reuse their
+// code.
+//
+// Bug reports
+//
+// For bug reports relating to this package please contact the author
+// through https://github.com/xi2/xz/issues, and not the authors of XZ
+// Embedded.
+package xz

vendor/github.com/therootcompany/xz/reader.go

@@ -0,0 +1,256 @@
+/*
+ * Package xz Go Reader API
+ *
+ * Author: Michael Cross <https://github.com/xi2>
+ *
+ * This file has been put into the public domain.
+ * You can do whatever you want with this file.
+ */
+
+package xz
+
+import (
+	"errors"
+	"io"
+)
+
+// Package specific errors.
+var (
+	ErrUnsupportedCheck = errors.New("xz: integrity check type not supported")
+	ErrMemlimit         = errors.New("xz: LZMA2 dictionary size exceeds max")
+	ErrFormat           = errors.New("xz: file format not recognized")
+	ErrOptions          = errors.New("xz: compression options not supported")
+	ErrData             = errors.New("xz: data is corrupt")
+	ErrBuf              = errors.New("xz: data is truncated or corrupt")
+)
+
+// DefaultDictMax is the default maximum dictionary size in bytes used
+// by the decoder. This value is sufficient to decompress files
+// created with XZ Utils "xz -9".
+const DefaultDictMax = 1 << 26 // 64 MiB
+
+// inBufSize is the input buffer size used by the decoder.
+const inBufSize = 1 << 13 // 8 KiB
+
+// A Reader is an io.Reader that can be used to retrieve uncompressed
+// data from an XZ file.
+//
+// In general, an XZ file can be a concatenation of other XZ
+// files. Reads from the Reader return the concatenation of the
+// uncompressed data of each.
+type Reader struct {
+	Header
+	r           io.Reader       // the wrapped io.Reader
+	multistream bool            // true if reader is in multistream mode
+	rEOF        bool            // true after io.EOF received on r
+	dEOF        bool            // true after decoder has completed
+	padding     int             // bytes of stream padding read (or -1)
+	in          [inBufSize]byte // backing array for buf.in
+	buf         *xzBuf          // decoder input/output buffers
+	dec         *xzDec          // decoder state
+	err         error           // the result of the last decoder call
+}
+
+// NewReader creates a new Reader reading from r. The decompressor
+// will use an LZMA2 dictionary size up to dictMax bytes in
+// size. Passing a value of zero sets dictMax to DefaultDictMax.  If
+// an individual XZ stream requires a dictionary size greater than
+// dictMax in order to decompress, Read will return ErrMemlimit.
+//
+// If NewReader is passed a value of nil for r then a Reader is
+// created such that all read attempts will return io.EOF. This is
+// useful if you just want to allocate memory for a Reader which will
+// later be initialized with Reset.
+//
+// Due to internal buffering, the Reader may read more data than
+// necessary from r.
+func NewReader(r io.Reader, dictMax uint32) (*Reader, error) {
+	if dictMax == 0 {
+		dictMax = DefaultDictMax
+	}
+	z := &Reader{
+		r:           r,
+		multistream: true,
+		padding:     -1,
+		buf:         &xzBuf{},
+	}
+	if r == nil {
+		z.rEOF, z.dEOF = true, true
+	}
+	z.dec = xzDecInit(dictMax, &z.Header)
+	var err error
+	if r != nil {
+		_, err = z.Read(nil) // read stream header
+	}
+	return z, err
+}
+
+// decode is a wrapper around xzDecRun that additionally handles
+// stream padding. It treats the padding as a kind of stream that
+// decodes to nothing.
+//
+// When decoding padding, z.padding >= 0
+// When decoding a real stream, z.padding == -1
+func (z *Reader) decode() (ret xzRet) {
+	if z.padding >= 0 {
+		// read all padding in input buffer
+		for z.buf.inPos < len(z.buf.in) &&
+			z.buf.in[z.buf.inPos] == 0 {
+			z.buf.inPos++
+			z.padding++
+		}
+		switch {
+		case z.buf.inPos == len(z.buf.in) && z.rEOF:
+			// case: out of padding. no more input data available
+			if z.padding%4 != 0 {
+				ret = xzDataError
+			} else {
+				ret = xzStreamEnd
+			}
+		case z.buf.inPos == len(z.buf.in):
+			// case: read more padding next loop iteration
+			ret = xzOK
+		default:
+			// case: out of padding. more input data available
+			if z.padding%4 != 0 {
+				ret = xzDataError
+			} else {
+				xzDecReset(z.dec)
+				ret = xzStreamEnd
+			}
+		}
+	} else {
+		ret = xzDecRun(z.dec, z.buf)
+	}
+	return
+}
+
+func (z *Reader) Read(p []byte) (n int, err error) {
+	// restore err
+	err = z.err
+	// set decoder output buffer to p
+	z.buf.out = p
+	z.buf.outPos = 0
+	for {
+		// update n
+		n = z.buf.outPos
+		// if last call to decoder ended with an error, return that error
+		if err != nil {
+			break
+		}
+		// if decoder has finished, return with err == io.EOF
+		if z.dEOF {
+			err = io.EOF
+			break
+		}
+		// if p full, return with err == nil, unless we have not yet
+		// read the stream header with Read(nil)
+		if n == len(p) && z.CheckType != checkUnset {
+			break
+		}
+		// if needed, read more data from z.r
+		if z.buf.inPos == len(z.buf.in) && !z.rEOF {
+			rn, e := z.r.Read(z.in[:])
+			if e != nil && e != io.EOF {
+				// read error
+				err = e
+				break
+			}
+			if e == io.EOF {
+				z.rEOF = true
+			}
+			// set new input buffer in z.buf
+			z.buf.in = z.in[:rn]
+			z.buf.inPos = 0
+		}
+		// decode more data
+		ret := z.decode()
+		switch ret {
+		case xzOK:
+			// no action needed
+		case xzStreamEnd:
+			if z.padding >= 0 {
+				z.padding = -1
+				if !z.multistream || z.rEOF {
+					z.dEOF = true
+				}
+			} else {
+				z.padding = 0
+			}
+		case xzUnsupportedCheck:
+			err = ErrUnsupportedCheck
+		case xzMemlimitError:
+			err = ErrMemlimit
+		case xzFormatError:
+			err = ErrFormat
+		case xzOptionsError:
+			err = ErrOptions
+		case xzDataError:
+			err = ErrData
+		case xzBufError:
+			err = ErrBuf
+		}
+		// save err
+		z.err = err
+	}
+	return
+}
+
+// Multistream controls whether the reader is operating in multistream
+// mode.
+//
+// If enabled (the default), the Reader expects the input to be a
+// sequence of XZ streams, possibly interspersed with stream padding,
+// which it reads one after another. The effect is that the
+// concatenation of a sequence of XZ streams or XZ files is
+// treated as equivalent to the compressed result of the concatenation
+// of the sequence. This is standard behaviour for XZ readers.
+//
+// Calling Multistream(false) disables this behaviour; disabling the
+// behaviour can be useful when reading file formats that distinguish
+// individual XZ streams. In this mode, when the Reader reaches the
+// end of the stream, Read returns io.EOF. To start the next stream,
+// call z.Reset(nil) followed by z.Multistream(false). If there is no
+// next stream, z.Reset(nil) will return io.EOF.
+func (z *Reader) Multistream(ok bool) {
+	z.multistream = ok
+}
+
+// Reset, for non-nil values of io.Reader r, discards the Reader z's
+// state and makes it equivalent to the result of its original state
+// from NewReader, but reading from r instead. This permits reusing a
+// Reader rather than allocating a new one.
+//
+// If you wish to leave r unchanged use z.Reset(nil). This keeps r
+// unchanged and ensures internal buffering is preserved. If the
+// Reader was at the end of a stream it is then ready to read any
+// follow on streams. If there are no follow on streams z.Reset(nil)
+// returns io.EOF. If the Reader was not at the end of a stream then
+// z.Reset(nil) does nothing.
+func (z *Reader) Reset(r io.Reader) error {
+	switch {
+	case r == nil:
+		z.multistream = true
+		if !z.dEOF {
+			return nil
+		}
+		if z.rEOF {
+			return io.EOF
+		}
+		z.dEOF = false
+		_, err := z.Read(nil) // read stream header
+		return err
+	default:
+		z.r = r
+		z.multistream = true
+		z.rEOF = false
+		z.dEOF = false
+		z.padding = -1
+		z.buf.in = nil
+		z.buf.inPos = 0
+		xzDecReset(z.dec)
+		z.err = nil
+		_, err := z.Read(nil) // read stream header
+		return err
+	}
+}

vendor/modules.txt

@@ -78,11 +78,14 @@ github.com/nats-io/nkeys
 # github.com/nats-io/nuid v1.0.1
 ## explicit
 github.com/nats-io/nuid
-# github.com/novox/mesh-host v0.0.0 => git.novox.be/novox/mesh-host v0.0.0-20261012170302-d2d9fbbd7d1c
+# github.com/novox/mesh-host v0.0.0 => git.novox.be/novox/mesh-host v0.0.0-20261011092230-20d5af9b2d5f
 ## explicit; go 1.26.0
 github.com/novox/mesh-host/internal/declaration
 github.com/novox/mesh-host/rootsearch
 github.com/novox/mesh-host/validate
+# github.com/therootcompany/xz v1.0.1
+## explicit; go 1.15
+github.com/therootcompany/xz
 # golang.org/x/crypto v0.57.0
 ## explicit; go 1.26.0
 golang.org/x/crypto/acme
@@ -135,4 +138,4 @@ golang.org/x/text/width
 # golang.org/x/time v0.15.0
 ## explicit; go 1.25.0
 golang.org/x/time/rate
-# github.com/novox/mesh-host => git.novox.be/novox/mesh-host v0.0.0-20261012170302-d2d9fbbd7d1c
+# github.com/novox/mesh-host => git.novox.be/novox/mesh-host v0.0.0-20261011092230-20d5af9b2d5f