Say the rotation test's whole trace on its failure's first line, and each judgement in it; an unreadable last declaration is cannot-judge (issue 1945)

The verdict keeps only a failure's first line (issue 1921), so the trace that names the cause rode on lines it dropped.

.gitignore

@@ -2,9 +2,11 @@
 
 # A built binary. The lab writes one here when pointed at the repository root by mistake;
 # built artifacts belong in build/, which is already ignored.
-/mesh-builder
 /mesh-controller
 /postgres-provisioner
 /redis-provisioner
 # And where `go build` in cmd/mesh-controller leaves it (novox/hq issue 233).
 /cmd/mesh-controller/mesh-controller
+
+# No repository commits its dependencies (issue 1305).
+vendor/

Dockerfile

@@ -21,17 +21,15 @@ ARG GO_BASE=golang@sha256:8ac98ca534ac3f51e1f420a1dd2c15e74c75cfa0f23f3ad27eb5d7
 FROM ${GO_BASE} AS build
 WORKDIR /src
 
-# **Nothing is fetched** (novox/hq to-be 45 Phase 1): every dependency is in vendor/, committed, so
-# the image builds from this repository alone — the host's validator among them, whose module no
-# public proxy is asked for. Dependencies first, so a change to the source does not re-copy them.
+# **No dependency is committed** (issue 1305): go.sum names each one's version and checksum, and the build
+# resolves them with -mod=mod. Dependencies first, so a change to the source does not re-copy them.
 COPY go.mod go.sum ./
-COPY vendor/ vendor/
 
 # `COPY . .` brings `.git` along, so Go is told not to stamp the commit: the version is said by -X, and a
 # rebuild of an unchanged program is the same bytes (novox/hq ADR 0267 rule 6, issue 363).
 COPY . .
 ARG VERSION=development
-RUN CGO_ENABLED=0 GOFLAGS=-mod=vendor GOPROXY=off go build -trimpath -buildvcs=false \
+RUN CGO_ENABLED=0 GOFLAGS=-mod=mod go build -trimpath -buildvcs=false \
         -ldflags "-s -w -X main.version=${VERSION}" \
         -o /mesh-controller ./cmd/mesh-controller
 

Makefile

@@ -46,17 +46,6 @@ image:
 	@echo
 	@docker image inspect $(IMAGE) --format 'built {{.RepoTags}}  {{.Size}} bytes'
 
-# The builder ships as an image too, because it is a module the mesh assigns rather than a program
-# somebody starts on a machine by hand.
-BUILDER_IMAGE ?= mesh-builder:$(VERSION)
-BUILDER_DEV_TAG ?= mesh-builder:development
-
-builder-image:
-	@test -n "$(GO_BASE)" || { echo "no GO_BASE; pass GO_BASE=<image>"; exit 1; }
-	docker build --build-arg GO_BASE=$(GO_BASE) -f cmd/mesh-builder/Dockerfile -t $(BUILDER_IMAGE) -t $(BUILDER_DEV_TAG) .
-	@echo
-	@docker image inspect $(BUILDER_IMAGE) --format 'built {{.RepoTags}}  {{.Size}} bytes'
-
 # The provisioner ships as an image too, because it is the thing that makes a sealed credential
 # true on a machine -- and the mesh cannot, having discarded the plaintext.
 PROVISIONER_IMAGE ?= mesh-provision-postgres:$(VERSION)
@@ -90,35 +79,6 @@ redis-provisioner-image:
 	@echo
 	@docker image inspect $(REDIS_PROVISIONER_IMAGE) --format 'built {{.RepoTags}}  {{.Size}} bytes'
 
-# The proxy that turns a route grant into traffic reaching a workload.
-PROXY_IMAGE ?= mesh-route-proxy:$(VERSION)
-PROXY_DEV_TAG ?= mesh-route-proxy:development
-
-proxy-image:
-	docker build --build-arg GO_BASE=$(GO_BASE) -f modules/route-proxy/Dockerfile -t $(PROXY_IMAGE) -t $(PROXY_DEV_TAG) .
-	@echo
-	@docker image inspect $(PROXY_IMAGE) --format 'built {{.RepoTags}}  {{.Size}} bytes'
-
-# The whole check. Raises a database, runs the repository's own check against it -- merge-check.sh,
-# the very script `mesh/repo-check` runs -- and takes the database down again, including when the
-# check fails, which is why the teardown is not conditional and the script's exit status is the
-# target's.
-#
-# **It calls the script rather than restating it** (novox/hq issue 431): this target used to list its
-# own steps, its formatting step walked vendor/ where the script's does not, and it failed on
-# third-party code no change could fix -- so a developer's check and the gate disagreed, and the steps
-# after formatting never ran through it. The script is the one list of steps; this target only gives it
-# a database (MESH_TEST_POSTGRES, exported above).
-#
-# **Two levels** (issue 895): the unit level, `go test ./...` untagged, timed and held to a bound; and the integration
-# level, `-tags integration`, the tests that start a bus, a store or another process. Each is said with its time.
-#
-# **Packages in parallel, under the race detector, each test on a bus of its own** (internal/testbus),
-# as the script runs them: a bus per test, of the release the mesh runs, makes the suite the same in any
-# order, and the timeout bounds a hang to a failure with a stack, never a stalled gate.
-check: postgres
-	@sh merge-check.sh ; status=$$? ; docker rm -f $(PG_CONTAINER) >/dev/null 2>&1 || true ; exit $$status
-
 # The unit level alone (untagged: no bus, no store, no other process), which a developer runs continuously. The tests
 # that need a bus or the store carry `//go:build integration` and run in `check`, not here; without a database the
 # store's tests would skip rather than fail anyway.
@@ -128,14 +88,13 @@ test:
 vet:
 	go vet ./...
 
-# Quick steps for a developer, not part of `check`. The directories gofmt reads must be the ones
-# merge-check.sh lists, never `.`, which walks vendor/ (novox/hq issue 431).
+# A quick step for a developer: the checker runs the build module's own formatting and vet (ADR 0501 §5, D7).
 fmt:
 	@unformatted=$$(gofmt -l cmd internal examples) ; \
 	if [ -n "$$unformatted" ] ; then echo "not gofmt'd:" ; echo "$$unformatted" ; exit 1 ; fi
 
 postgres:
-	@docker rm -f $(PG_CONTAINER) >/dev/null 2>&1 || true
+	@docker rm -f -v $(PG_CONTAINER) >/dev/null 2>&1 || true
 	@docker run -d --name $(PG_CONTAINER) -e POSTGRES_PASSWORD=check \
 		-p 127.0.0.1:$(PG_PORT):5432 $(PG_IMAGE) >/dev/null
 	@printf 'waiting for postgres'
@@ -147,7 +106,7 @@ postgres:
 	echo ' — never came up' ; docker logs $(PG_CONTAINER) | tail -20 ; exit 1
 
 postgres-stop:
-	@docker rm -f $(PG_CONTAINER) >/dev/null 2>&1 || true
+	@docker rm -f -v $(PG_CONTAINER) >/dev/null 2>&1 || true
 
 clean:
 	rm -rf build/

RELEASE-57.md

@@ -1,6 +0,0 @@
-# Release 57: config and provisioning
-
-This branch carries the work of hq design 57 (ADR 0348, ADR 0349) in this repository. Each package
-merges here through its own reviewed pull request; the branch reaches main as one pull request, in one
-delivery group with the branch of the same name in mesh-controller, mesh-host, mesh-sdk, mesh-catalog
-and hq, after a rehearsal in the lab. This file is deleted by the last commit before that pull request.

check-nested-modules.sh

@@ -1,29 +0,0 @@
-#!/bin/sh
-# The unit tests of every Go module of its own below this repository's root, run from the root, for merge-check.sh
-# and for the test that tries it on a tree (merge_check_nested_test.go). Its own file so that the test needs no
-# particular merge-check.sh: the check that judges a change to merge-check.sh is main's.
-set -eu
-cgo="${cgo:-0}"
-race="${race:-}"
-
-# nested_modules vets and tests every Go module of its own below the root, `modules/<name>/go.mod` (novox/hq ADR 0420
-# §5, issue 1025): `./...` stops at a nested go.mod, so a module that lives whole in this repository would have its
-# unit tests run by nobody. None is a pass. Each runs in its own directory, outside the vendor directory this
-# repository's own packages are built from; a nested module vendors what the forge holds (its own `vendor/`, so the
-# check runs offline), as this repository's root module does (issue 1019). A failing module fails the check; the others are still run.
-nested_modules() {
-	nested=0
-	for gomod in modules/*/go.mod; do
-		[ -e "$gomod" ] || continue
-		dir=$(dirname "$gomod")
-		echo "nested module $dir:"
-		if ! (cd "$dir" && GOFLAGS= CGO_ENABLED=0 go vet ./... &&
-			GOFLAGS= CGO_ENABLED="${cgo:-0}" go test ${race:-} -count=1 -timeout 30m ./...); then
-			echo "nested module $dir FAILED"
-			nested=1
-		fi
-	done
-	return $nested
-}
-
-nested_modules

cmd/mesh-builder/Dockerfile

@@ -1,22 +0,0 @@
-ARG ALPINE_BASE=alpine:3
-ARG GO_BASE=golang:1.25-alpine
-# The builder, as a module ships one.
-#
-# Not FROM scratch, unlike the control plane: this one runs git and a container client, so it
-# needs a filesystem with them on it. That is the honest cost of a machine whose job is to build —
-# and it is why building is a MODULE on a machine that has a runtime rather than something the
-# control plane does (novox/hq ADR 0005).
-FROM ${GO_BASE} AS build
-WORKDIR /src
-COPY go.mod go.sum ./
-RUN go mod download
-COPY . .
-RUN CGO_ENABLED=0 go build -trimpath -buildvcs=false -ldflags '-s -w' -o /mesh-builder ./cmd/mesh-builder
-
-FROM ${ALPINE_BASE}
-# git to clone what it is asked to build, and the docker client to build and push it. The daemon
-# is the machine's, reached through its socket — a build machine shares the runtime it was given
-# rather than running one inside itself.
-RUN apk add --no-cache git docker-cli
-COPY --from=build /mesh-builder /usr/local/bin/mesh-builder
-ENTRYPOINT ["/usr/local/bin/mesh-builder"]

cmd/mesh-builder/busy.go

@@ -1,146 +0,0 @@
-package main
-
-import (
-	"errors"
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-	"time"
-)
-
-// **The build agent says whether it is busy, and being asked drains it** (novox/hq ADR 0335 §1, §5). Its
-// container declares `busy` as `mesh-builder busy`: the node-engine runs it inside the container before it
-// replaces it. It exits 0 while a build is in hand and 1 when none is; and from the first ask the agent takes
-// no new build request, so its answer ends once the build in hand ends — a replaced builder finishes the check
-// it runs, instead of the build queue handing it out again from the start (issue 594).
-//
-// Two marks in the container's own temporary directory, as the ready mark (ready.go): a new container starts
-// without them, and a restarted one removes them before it takes work again.
-//
-//   - in hand: written by the agent when it claims a request, before it reads whether it is drained; removed
-//     when the build ends.
-//   - drained: written by the ask, before it reads whether a build is in hand.
-//
-// Each side writes its own mark before it reads the other's, so an ask racing a fetch sees the build in hand,
-// or the agent sees the drain and hands the request back; never neither.
-
-func inHandMark() string { return filepath.Join(os.TempDir(), "mesh-builder.in-hand") }
-func drainMark() string  { return filepath.Join(os.TempDir(), "mesh-builder.drained") }
-
-// The drain lapses when no ask has come for drainLapse: the node-engine asks every 20 seconds for as long as it
-// really waits, so an agent whose replacement was withdrawn — the declaration put back, the walk stopped —
-// takes work again rather than staying drained for ever (review of ADR 0335). And an agent drained for longer
-// than the node-engine's bound and the slack says it is not ready: the replacement it was drained for never
-// came, which is a fault to see.
-const (
-	drainLapse   = 2 * time.Minute
-	drainTooLong = 15*time.Minute + 5*time.Minute
-)
-
-// drainedAt is when the drain began and when it was last asked, from its mark; false when there is no mark.
-func drainedAt() (began, asked time.Time, ok bool) {
-	info, err := os.Stat(drainMark())
-	if err != nil {
-		return time.Time{}, time.Time{}, false
-	}
-	asked = info.ModTime()
-	began = asked
-	if raw, err := os.ReadFile(drainMark()); err == nil {
-		if t, err := time.Parse(time.RFC3339, strings.TrimSpace(string(raw))); err == nil && !t.After(asked) {
-			began = t
-		}
-	}
-	return began, asked, true
-}
-
-// drained says the agent was asked whether it is busy within drainLapse: it takes no new build request.
-func drained() bool { return drainedSince(time.Now()) }
-
-func drainedSince(now time.Time) bool {
-	_, asked, ok := drainedAt()
-	return ok && now.Sub(asked) < drainLapse
-}
-
-// drainedTooLong is the health check's second half: nil unless the agent has been drained, asked all along, for
-// longer than its node-engine's bound and the slack.
-func drainedTooLong(now time.Time) error {
-	began, asked, ok := drainedAt()
-	if !ok || now.Sub(asked) >= drainLapse || now.Sub(began) <= drainTooLong {
-		return nil
-	}
-	return fmt.Errorf("drained since %s and still asked: the replacement its node-engine waits for has not come "+
-		"within %s (novox/hq ADR 0335)", began.UTC().Format(time.RFC3339), drainTooLong)
-}
-
-// claim marks a request in hand, unless the agent is drained: then nothing is in hand, and the request goes
-// back to the queue.
-func claim() bool {
-	// Made, never written over: one build at a time, and a mark already there is a build in hand.
-	f, err := os.OpenFile(inHandMark(), os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0o644)
-	if err != nil {
-		// Unmarked, an ask would say idle while this build runs: the build is not taken.
-		fmt.Fprintf(os.Stderr, "cannot mark a build in hand (%s), so it is handed back: %v\n", inHandMark(), err)
-		return false
-	}
-	_, err = f.WriteString(time.Now().UTC().Format(time.RFC3339) + "\n")
-	if closeErr := f.Close(); err == nil {
-		err = closeErr
-	}
-	if err != nil {
-		_ = os.Remove(inHandMark())
-		fmt.Fprintf(os.Stderr, "cannot mark a build in hand (%s), so it is handed back: %v\n", inHandMark(), err)
-		return false
-	}
-	if drained() {
-		_ = os.Remove(inHandMark())
-		fmt.Fprintln(os.Stderr, "asked whether busy, so this agent takes no new build: handed back")
-		return false
-	}
-	return true
-}
-
-// holding says what is in hand, for the ask to print: written once the request is read.
-func holding(what string) {
-	_ = os.WriteFile(inHandMark(), []byte(time.Now().UTC().Format(time.RFC3339)+" "+what+"\n"), 0o644)
-}
-
-// released ends the build in hand.
-func released() {
-	if err := os.Remove(inHandMark()); err != nil && !errors.Is(err, os.ErrNotExist) {
-		fmt.Fprintf(os.Stderr, "cannot remove the mark of the build in hand (%s): %v\n", inHandMark(), err)
-	}
-}
-
-// undrained clears both marks at the start of a holder: a container started again is asked afresh.
-func undrained() error {
-	for _, mark := range []string{drainMark(), inHandMark()} {
-		if err := os.Remove(mark); err != nil && !errors.Is(err, os.ErrNotExist) {
-			return fmt.Errorf("cannot remove %s: %w", mark, err)
-		}
-	}
-	return nil
-}
-
-// busy is the ask: it drains the agent, then says whether a build is in hand. Nil — exit 0 — while one is.
-func busy() (string, error) {
-	// The mark keeps when the drain began while it is asked within drainLapse, and is written again on every
-	// ask: its time is the last ask.
-	began := time.Now().UTC()
-	if was, _, ok := drainedAt(); ok && drained() {
-		began = was.UTC()
-	}
-	if err := os.WriteFile(drainMark(), []byte(began.Format(time.RFC3339)+"\n"), 0o644); err != nil {
-		// Not drained, it could take the next build: said, and answered busy only for what is in hand now.
-		fmt.Fprintf(os.Stderr, "cannot mark this agent drained (%s): %v\n", drainMark(), err)
-	}
-	held, err := os.ReadFile(inHandMark())
-	if err != nil {
-		return "", errors.New("idle: no build in hand, and this agent takes no new one")
-	}
-	since, what, _ := strings.Cut(strings.TrimSpace(string(held)), " ")
-	if what == "" {
-		what = "a build"
-	}
-	return fmt.Sprintf("busy: %s, in hand since %s; taking no new build", what, since), nil
-}

cmd/mesh-builder/busy_test.go

@@ -1,162 +0,0 @@
-package main
-
-import (
-	"os"
-	"strings"
-	"sync"
-	"testing"
-	"time"
-)
-
-// `mesh-builder busy` answers 0 while a build is in hand and non-zero when idle, and after its first ask the
-// agent takes no new build request (novox/hq ADR 0335 §5).
-func TestBusyAnswersWhileABuildIsInHandAndDrainsTheAgent(t *testing.T) {
-	t.Setenv("TMPDIR", t.TempDir())
-	if err := undrained(); err != nil {
-		t.Fatal(err)
-	}
-	if drained() {
-		t.Fatal("an agent never asked is drained")
-	}
-	// A build is claimed and runs.
-	if !claim() {
-		t.Fatal("an agent never asked refused a build")
-	}
-	holding("novox/mesh-controller (check-280)")
-	said, err := busy()
-	if err != nil || !strings.Contains(said, "novox/mesh-controller (check-280)") {
-		t.Fatalf("an agent with a build in hand did not answer busy with what it holds: %q %v", said, err)
-	}
-	// From that ask on it takes nothing new: the fetch is not made, and one fetched is handed back.
-	if !drained() {
-		t.Fatal("the ask did not drain the agent")
-	}
-	if claim() {
-		t.Fatal("a drained agent took a new build")
-	}
-	// The build in hand is still in hand after the refused claim, and busy goes on saying so.
-	if _, err := busy(); err != nil {
-		t.Fatalf("a refused claim ended the build in hand: %v", err)
-	}
-	// It ends: idle, and still drained.
-	released()
-	if _, err := busy(); err == nil {
-		t.Fatal("an agent with nothing in hand answered busy")
-	}
-	if claim() {
-		t.Fatal("a drained agent took a build after its last one ended")
-	}
-	// Started again, it is asked afresh.
-	if err := undrained(); err != nil {
-		t.Fatal(err)
-	}
-	if drained() || !claim() {
-		t.Fatal("a holder started again is still drained")
-	}
-	released()
-}
-
-// An ask racing a fetch sees the build in hand, or the agent sees the drain and hands the request back: never
-// neither, which would replace the container under a build just taken.
-func TestAnAskRacingAFetchNeverMissesTheBuild(t *testing.T) {
-	t.Setenv("TMPDIR", t.TempDir())
-	for i := 0; i < 200; i++ {
-		if err := undrained(); err != nil {
-			t.Fatal(err)
-		}
-		var claimed bool
-		var askErr error
-		var wg sync.WaitGroup
-		wg.Add(2)
-		go func() { defer wg.Done(); claimed = claim() }()
-		go func() { defer wg.Done(); _, askErr = busy() }()
-		wg.Wait()
-		if claimed && askErr != nil {
-			t.Fatalf("round %d: the agent took a build and the ask said idle", i)
-		}
-		released()
-	}
-}
-
-// A drain no longer asked lapses: an agent whose replacement was withdrawn after the first ask (a put-back, a
-// revert, a stopped walk) takes work again after drainLapse, rather than staying drained with its health green.
-func TestADrainNoLongerAskedLapses(t *testing.T) {
-	t.Setenv("TMPDIR", t.TempDir())
-	if err := undrained(); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := busy(); err == nil {
-		t.Fatal("an idle agent answered busy")
-	}
-	if !drained() || claim() {
-		t.Fatal("an agent just asked takes work")
-	}
-	// The last ask was three minutes ago.
-	old := time.Now().Add(-3 * time.Minute)
-	if err := os.Chtimes(drainMark(), old, old); err != nil {
-		t.Fatal(err)
-	}
-	if drained() {
-		t.Fatal("a drain no longer asked for three minutes still holds")
-	}
-	if !claim() {
-		t.Fatal("an agent whose drain lapsed takes no work")
-	}
-	released()
-}
-
-// An agent drained, and asked all along, for longer than its node-engine's bound and the slack is not ready: the
-// replacement it was drained for never came. One asked again after a lapse starts a new drain.
-func TestAnAgentDrainedTooLongIsNotReady(t *testing.T) {
-	t.Setenv("TMPDIR", t.TempDir())
-	if err := undrained(); err != nil {
-		t.Fatal(err)
-	}
-	taking("mesh-build-machine")
-	if _, err := busy(); err == nil {
-		t.Fatal("an idle agent answered busy")
-	}
-	now := time.Now()
-	if err := drainedTooLong(now); err != nil {
-		t.Fatalf("an agent drained a moment ago is not ready: %v", err)
-	}
-	// The drain began 25 minutes ago, and the node-engine asked a moment ago.
-	began := now.Add(-25 * time.Minute).UTC().Format(time.RFC3339)
-	if err := os.WriteFile(drainMark(), []byte(began+"\n"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	err := drainedTooLong(time.Now())
-	if err == nil || !strings.Contains(err.Error(), "has not come") {
-		t.Fatalf("an agent drained for 25 minutes reads ready: %v", err)
-	}
-	// Each ask keeps when the drain began.
-	if _, err := busy(); err == nil {
-		t.Fatal("an idle agent answered busy")
-	}
-	if err := drainedTooLong(time.Now()); err == nil {
-		t.Fatal("an ask started the drain again")
-	}
-	// The asks stopped: the drain lapsed, and so did the fault.
-	old := time.Now().Add(-3 * time.Minute)
-	if err := os.Chtimes(drainMark(), old, old); err != nil {
-		t.Fatal(err)
-	}
-	if err := drainedTooLong(time.Now()); err != nil {
-		t.Fatalf("a lapsed drain still reads not ready: %v", err)
-	}
-}
-
-// An ask this build does not know exits non-zero: an older image asked `busy` reads idle, not busy for the
-// node-engine's whole bound.
-func TestAnUnknownCommandFails(t *testing.T) {
-	was := os.Args
-	t.Cleanup(func() { os.Args = was })
-	os.Args = []string{"mesh-builder", "some-later-word"}
-	if err := run(); err == nil {
-		t.Fatal("an unknown command exited 0")
-	}
-	os.Args = []string{"mesh-builder", "help"}
-	if err := run(); err != nil {
-		t.Fatalf("help failed: %v", err)
-	}
-}

cmd/mesh-builder/check_spec_test.go

@@ -1,38 +0,0 @@
-package main
-
-import (
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/builder"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// The build seat hands the check the judge cache the build agent declares (MESH_JUDGE_CACHE), never a path of its own.
-func TestTheBuildSeatHandsTheCheckTheJudgeCacheItDeclares(t *testing.T) {
-	t.Setenv("MESH_JUDGE_CACHE", "/var/lib/mesh/build-agent/judge-cache")
-	if got := judgeCache(); got != "/var/lib/mesh/build-agent/judge-cache" {
-		t.Fatalf("the judge cache the manifest declares is read as %q", got)
-	}
-	t.Setenv("MESH_JUDGE_CACHE", "")
-	if got := judgeCache(); got != "" {
-		t.Fatalf("with no judge cache declared, %q is used", got)
-	}
-}
-
-// The siblings a check is asked to read reach the build seat's spec and, as read, the outcome (novox/hq ADR 0382).
-func TestTheSiblingsAnAskNamesReachTheSpecAndTheOutcome(t *testing.T) {
-	spec := checkSpecOf(link.BuildRequest{Check: &link.CheckRequest{Owner: "novox", Repo: "mesh-host", Base: "main",
-		Siblings:        []link.CheckSibling{{Repository: "novox/mesh-controller", Number: 346, Head: "a", Base: "main", Dir: "mesh-controller"}},
-		SiblingsUnknown: "why"}})
-	if len(spec.Siblings) != 1 || spec.Siblings[0] != (builder.Sibling{Repository: "novox/mesh-controller", Number: 346,
-		Head: "a", Base: "main", Dir: "mesh-controller"}) || spec.SiblingsUnknown != "why" {
-		t.Fatalf("the spec reads %+v", spec)
-	}
-	out := siblingsOut([]builder.JudgedSibling{{Repository: "novox/mesh-controller", Number: 346, Head: "a", Base: "main", BaseCommit: "b"}})
-	if len(out) != 1 || out[0].BaseCommit != "b" || out[0].Number != 346 {
-		t.Fatalf("the outcome reads %+v", out)
-	}
-	if plain := checkSpecOf(link.BuildRequest{Check: &link.CheckRequest{Owner: "o", Repo: "r"}}); plain.Siblings != nil {
-		t.Fatalf("a request that names none has siblings %+v", plain.Siblings)
-	}
-}

cmd/mesh-builder/holder.go

@@ -1,433 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-	"sync"
-	"time"
-
-	"github.com/nats-io/nats.go/micro"
-
-	"github.com/novox/mesh-controller/internal/builder"
-	"github.com/novox/mesh-controller/internal/catalogue"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// What a holder of the build seat answers for, on its own machine (novox/hq ADR 0219).
-//
-// **The queue is the controller's; the build running here is this machine's.** The controller can
-// see and change what waits in the seat's queue, but an ask a holder already took is a process tree
-// on this machine and containers in this machine's runtime, and only this machine can end them. So
-// the holder serves four verbs on the seat's subjects for this machine: what it is building, kill
-// it, pause, resume.
-//
-// **One build at a time** (ADR 0190), which is also what builder.Said assumes — a package global
-// set per build — so "the build running here" is one or none, and kill names it by id so a call
-// that arrives as one build ends and the next begins cannot end the wrong one.
-
-// holder is this machine's state as a holder of the build seat.
-type holder struct {
-	on, seat string
-	// workspace is where the paused flag is kept, so a holder restarted while paused stays paused
-	// rather than silently taking work again.
-	workspace string
-	// say publishes this machine's state: whether it takes work (link.HolderState).
-	say func(link.HolderState) error
-	// remove runs what a kill needs outside the build: the containers left behind.
-	remove builder.Runner
-	// scratch is where check builds are kept (novox/hq ADR 0350 §5): what the week's sweep lets go of. Nil where
-	// this machine publishes to no artifact store.
-	scratch builder.Scratch
-
-	mu      sync.Mutex
-	paused  bool
-	running *running
-}
-
-// running is the build this machine is doing.
-type running struct {
-	request link.BuildRequest
-	step    string
-	started time.Time
-	cancel  context.CancelFunc
-	killed  bool
-	// returned is the build's own work having ended, before a kill or not; outcome is what was then
-	// announced, and announced whether it went out.
-	returned  bool
-	outcome   string
-	announced bool
-	done      chan struct{}
-}
-
-// pausedFile is where the flag lives in the workspace.
-func pausedFile(workspace string) string { return filepath.Join(workspace, ".mesh-builder-paused") }
-
-// newHolder reads the paused flag the workspace keeps.
-func newHolder(on, seat, workspace string, say func(link.HolderState) error) *holder {
-	h := &holder{on: on, seat: seat, workspace: workspace, say: say, remove: plainRun}
-	if _, err := os.Stat(pausedFile(workspace)); err == nil {
-		h.paused = true
-	}
-	return h
-}
-
-// Paused is asked by the taking loop before every fetch.
-func (h *holder) Paused() bool {
-	h.mu.Lock()
-	defer h.mu.Unlock()
-	return h.paused
-}
-
-// setPaused records the flag in the workspace first and then in memory, so what this holder says
-// it is and what it would be after a restart never differ.
-func (h *holder) setPaused(paused bool) error {
-	path := pausedFile(h.workspace)
-	if paused {
-		if err := os.MkdirAll(h.workspace, 0o755); err != nil {
-			return err
-		}
-		if err := os.WriteFile(path, []byte(time.Now().UTC().Format(time.RFC3339)+"\n"), 0o644); err != nil {
-			return fmt.Errorf("cannot keep the paused flag in %s: %w", path, err)
-		}
-	} else if err := os.Remove(path); err != nil && !errors.Is(err, os.ErrNotExist) {
-		return fmt.Errorf("cannot remove the paused flag %s: %w", path, err)
-	}
-	h.mu.Lock()
-	h.paused = paused
-	h.mu.Unlock()
-	h.announce()
-	return nil
-}
-
-// announce says whether this machine takes work. Never fatal: the flag is kept either way, and the
-// controller reading an older state is a plan read as late rather than a build lost.
-func (h *holder) announce() {
-	if h.say == nil {
-		return
-	}
-	if err := h.say(link.HolderState{On: h.on, Paused: h.Paused(), At: time.Now().UTC().Format(time.RFC3339Nano)}); err != nil {
-		fmt.Fprintf(os.Stderr, "cannot say whether this machine takes builds: %v\n", err)
-	}
-}
-
-// stateWhilePaused says this machine's state at start, and again every while it stays paused, so
-// a pause outlives the events stream's retention.
-func (h *holder) stateWhilePaused(ctx context.Context, every time.Duration) {
-	h.announce()
-	tick := time.NewTicker(every)
-	defer tick.Stop()
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-tick.C:
-			if h.Paused() {
-				h.announce()
-			}
-		}
-	}
-}
-
-// expireChecks lets go of every check build older than a week (novox/hq ADR 0350 §5), at start and every while
-// after. Every holder sweeps the one store; what one let go of, another finds gone.
-func (h *holder) expireChecks(ctx context.Context, every time.Duration, now func() time.Time) {
-	sweep := func() {
-		if h.scratch == nil {
-			return
-		}
-		n, err := h.scratch.Expire(ctx, builder.CheckBuildsKept, now())
-		switch {
-		case err != nil:
-			fmt.Fprintf(os.Stderr, "check builds older than %s: %d let go of, and not all: %v\n", builder.CheckBuildsKept, n, err)
-		case n > 0:
-			fmt.Fprintf(os.Stderr, "check builds older than %s: %d check(s)' builds let go of\n", builder.CheckBuildsKept, n)
-		}
-	}
-	sweep()
-	tick := time.NewTicker(every)
-	defer tick.Stop()
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-tick.C:
-			sweep()
-		}
-	}
-}
-
-// begin records the build this machine took, with the cancel that ends it.
-func (h *holder) begin(request link.BuildRequest, cancel context.CancelFunc) *running {
-	r := &running{request: request, started: time.Now(), cancel: cancel, done: make(chan struct{})}
-	h.mu.Lock()
-	h.running = r
-	h.mu.Unlock()
-	return r
-}
-
-// end clears it, and lets a kill waiting on it know it is over.
-func (h *holder) end(r *running) {
-	h.mu.Lock()
-	if h.running == r {
-		h.running = nil
-	}
-	h.mu.Unlock()
-	close(r.done)
-}
-
-// stepped records the step a build is at, for `current`.
-func (h *holder) stepped(r *running, step string) {
-	h.mu.Lock()
-	r.step = step
-	h.mu.Unlock()
-}
-
-// currentBuild is what `current` answers.
-type currentBuild struct {
-	On      string `json:"on"`
-	Paused  bool   `json:"paused"`
-	Running *struct {
-		ID         string `json:"id"`
-		Repository string `json:"repository"`
-		Path       string `json:"path,omitempty"`
-		Ref        string `json:"ref,omitempty"`
-		Step       string `json:"step,omitempty"`
-		Started    string `json:"started"`
-		Elapsed    string `json:"elapsed"`
-	} `json:"running,omitempty"`
-	Said string `json:"said"`
-}
-
-func (h *holder) current() currentBuild {
-	h.mu.Lock()
-	defer h.mu.Unlock()
-	out := currentBuild{On: h.on, Paused: h.paused}
-	taking := "taking builds"
-	if h.paused {
-		taking = "paused, taking no new build"
-	}
-	if h.running == nil {
-		out.Said = fmt.Sprintf("%s is building nothing; %s", h.on, taking)
-		return out
-	}
-	r := h.running
-	elapsed := time.Since(r.started).Round(time.Second)
-	out.Running = &struct {
-		ID         string `json:"id"`
-		Repository string `json:"repository"`
-		Path       string `json:"path,omitempty"`
-		Ref        string `json:"ref,omitempty"`
-		Step       string `json:"step,omitempty"`
-		Started    string `json:"started"`
-		Elapsed    string `json:"elapsed"`
-	}{r.request.ID, r.request.Repository, r.request.Path, r.request.Ref, r.step,
-		r.started.UTC().Format(time.RFC3339), elapsed.String()}
-	out.Said = fmt.Sprintf("%s is building %s (%s) at %s for %s; %s",
-		h.on, r.request.Repository, r.request.ID, orNothing(r.step), elapsed, taking)
-	return out
-}
-
-// The bounds a kill keeps: each pass removing containers, and the wait for the build to end between
-// them. The worst case — 15s, 20s, 15s — is inside what the controller waits for the answer
-// (killAnswer in the controller's queue.go, 75s).
-var (
-	killRemoves = 15 * time.Second
-	killWaits   = 20 * time.Second
-)
-
-// kill ends the build with this id, if it is the one running here and still working: its context
-// cancelled — which kills each command's process group — and the containers it started removed by
-// their label, once at once and again after the build has ended, so one created while it was being
-// killed is not left. The build's own goroutine announces it failed, killed by hand, and settles the
-// ask so it is not redelivered; the answer says whether that happened.
-func (h *holder) kill(id string) (string, error) {
-	h.mu.Lock()
-	r := h.running
-	if r == nil || r.request.ID != id {
-		doing := "nothing"
-		if r != nil {
-			doing = r.request.ID
-		}
-		h.mu.Unlock()
-		return "", fmt.Errorf("%s is not building %s; it is building %s. `queue` says where an ask is", h.on, id, doing)
-	}
-	if r.returned {
-		h.mu.Unlock()
-		return "", fmt.Errorf("%s on %s has already ended on its own and is saying how; `builds` shows it", id, h.on)
-	}
-	r.killed = true
-	cancel, done := r.cancel, r.done
-	h.mu.Unlock()
-
-	cancel()
-	removed, removeErr := h.removeContainers(id)
-	ended := false
-	select {
-	case <-done:
-		ended = true
-	case <-time.After(killWaits):
-	}
-	again, againErr := h.removeContainers(id)
-	removed += again
-	if removeErr == nil {
-		removeErr = againErr
-	}
-	containers := fmt.Sprintf("%d container(s) it started removed", removed)
-	if removeErr != nil {
-		containers = "its containers could not all be listed or removed: " + removeErr.Error()
-	}
-	if !ended {
-		return fmt.Sprintf("killed %s on %s: %s; the build has not finished ending yet — `builds` says when "+
-			"its outcome is in", id, h.on, containers), nil
-	}
-	h.mu.Lock()
-	outcome, announced := r.outcome, r.announced
-	h.mu.Unlock()
-	if !announced {
-		return fmt.Sprintf("killed %s (%s) on %s: its commands ended and %s, and its outcome could not be "+
-			"announced — the ask is not settled and will be handed out again", id, r.request.Repository, h.on,
-			containers), nil
-	}
-	return fmt.Sprintf("killed %s (%s) on %s: its commands ended, %s, and its outcome announced as failed, %s — "+
-		"settled, so it is not handed to another machine", id, r.request.Repository, h.on, containers, outcome), nil
-}
-
-// removeContainers is one pass of removing what the build left, bounded.
-func (h *holder) removeContainers(id string) (int, error) {
-	cleanup, stop := context.WithTimeout(context.Background(), killRemoves)
-	defer stop()
-	return builder.RemoveContainersOf(cleanup, h.remove, id)
-}
-
-// removeLeftBehind removes, once, what earlier holders on this machine left — called before anything is
-// taken, so none of it is this holder's — and says what it did. A runtime that cannot be asked is said
-// and the holder takes work all the same: what is left is waste, not a reason to stop building.
-func (h *holder) removeLeftBehind() int {
-	cleanup, stop := context.WithTimeout(context.Background(), killRemoves)
-	defer stop()
-	n, err := builder.RemoveLeftBehind(cleanup, h.remove)
-	switch {
-	case err != nil:
-		fmt.Fprintf(os.Stderr, "could not look for containers earlier builds left on %s: %v\n", h.on, err)
-	case n > 0:
-		fmt.Fprintf(os.Stderr, "removed %d container(s) earlier builds left on %s\n", n, h.on)
-	}
-	return n
-}
-
-// returned records that the build's work ended, and says whether a kill came first — only then is
-// the build killed; an error it ended with on its own is its own outcome.
-func (h *holder) returned(r *running) bool {
-	h.mu.Lock()
-	defer h.mu.Unlock()
-	r.returned = true
-	return r.killed
-}
-
-// said records the outcome announced, and whether it went out, for a kill to answer with.
-func (h *holder) said(r *running, outcome string, announced bool) {
-	h.mu.Lock()
-	r.outcome, r.announced = outcome, announced
-	h.mu.Unlock()
-}
-
-// handlers are the seat's verbs, as this machine answers them.
-func (h *holder) handlers() map[string]link.ToolHandler {
-	return map[string]link.ToolHandler{
-		"current": func(context.Context, json.RawMessage) (any, error) { return h.current(), nil },
-		"kill": func(_ context.Context, raw json.RawMessage) (any, error) {
-			var args struct {
-				ID string `json:"id"`
-			}
-			if err := json.Unmarshal(raw, &args); err != nil || strings.TrimSpace(args.ID) == "" {
-				return nil, errors.New("kill needs the build's id")
-			}
-			said, err := h.kill(strings.TrimSpace(args.ID))
-			if err != nil {
-				return nil, err
-			}
-			return map[string]any{"said": said}, nil
-		},
-		"pause": func(context.Context, json.RawMessage) (any, error) {
-			if err := h.setPaused(true); err != nil {
-				return nil, err
-			}
-			said := h.on + " is paused: it takes no new build until resumed"
-			if c := h.current(); c.Running != nil {
-				said += "; " + c.Running.ID + " runs on and finishes"
-			}
-			return map[string]any{"said": said, "paused": true}, nil
-		},
-		"resume": func(context.Context, json.RawMessage) (any, error) {
-			if err := h.setPaused(false); err != nil {
-				return nil, err
-			}
-			return map[string]any{"said": h.on + " takes builds again", "paused": false}, nil
-		},
-	}
-}
-
-func orNothing(s string) string {
-	if s == "" {
-		return "its start"
-	}
-	return s
-}
-
-// plainRun runs a command outside any build: no line reaches a build's log, because the build whose
-// log it would be is the one being ended.
-func plainRun(ctx context.Context, dir, name string, args ...string) (string, error) {
-	cmd := exec.CommandContext(ctx, name, args...)
-	cmd.Dir = dir
-	out, err := cmd.CombinedOutput()
-	if err != nil {
-		return string(out), fmt.Errorf("%s %s: %w: %s", name, strings.Join(args, " "), err, strings.TrimSpace(string(out)))
-	}
-	return string(out), nil
-}
-
-// announcement is what this holder answers discovery with (novox/hq ADR 0195, ADR 0197): this
-// machine's verbs of the seat, in the shape every tool runtime announces a seat's verb — kind seat,
-// the module answering, the seat, scope node, the machine, its description and argument schema — so
-// the console finds `<node>/node-build-agent.kill` by searching, as it finds any seat's verb.
-//
-// One service per machine, named for the seat and identified by the machine, so the answer is this
-// machine's four verbs and nothing more. The verbs are the compiled seat row's: a build machine has no
-// store, and what it serves is what this binary was built to serve.
-func announcement(seat, module, node string) micro.Info {
-	s, _ := catalogue.SeatNamed(seat)
-	var endpoints []micro.EndpointInfo
-	for _, v := range s.Serves {
-		schema, _ := json.Marshal(v.Input)
-		endpoints = append(endpoints, micro.EndpointInfo{
-			Name:    seat + "__" + v.Name,
-			Subject: link.NodeSeatToolSubject(seat, v.Name, node),
-			// The queue group the verbs are served in, as every runtime announces its own.
-			QueueGroup: "seat." + seat,
-			Metadata: map[string]string{
-				"kind": "seat", "module": module, "tool": v.Name, "seat": seat, "scope": "node",
-				"node": node, "interchangeable": "false", "description": v.Description, "schema": string(schema),
-			},
-		})
-	}
-	return micro.Info{
-		ServiceIdentity: micro.ServiceIdentity{Name: seat, ID: node, Version: "0.1.0",
-			Metadata: map[string]string{"seat": seat, "scope": "node", "node": node, "module": module}},
-		Description: "what the build running on " + node + " is, and ending, pausing and resuming it (novox/hq ADR 0219)",
-		Endpoints:   endpoints,
-	}
-}
-
-// moduleOf is the module a credential was issued for: its user is `<node>.<module>`.
-func moduleOf(user string) string {
-	if _, module, ok := strings.Cut(user, "."); ok && module != "" {
-		return module
-	}
-	return "build-agent"
-}

cmd/mesh-builder/holder_test.go

@@ -1,172 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"strings"
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// A holder paused stays paused across its restart: the flag is kept in its workspace (novox/hq ADR
-// 0219), and what it says about itself follows.
-func TestAPausedHolderStaysPausedAcrossARestart(t *testing.T) {
-	workspace := t.TempDir()
-	var said []link.HolderState
-	h := newHolder("ace", link.TheBuildMachine, workspace, func(s link.HolderState) error {
-		said = append(said, s)
-		return nil
-	})
-	if h.Paused() {
-		t.Fatal("a new holder starts paused")
-	}
-	if _, err := h.handlers()["pause"](context.Background(), json.RawMessage(`{}`)); err != nil {
-		t.Fatal(err)
-	}
-	if !h.Paused() || len(said) != 1 || !said[0].Paused || said[0].On != "ace" {
-		t.Fatalf("paused: %v, said %+v", h.Paused(), said)
-	}
-	again := newHolder("ace", link.TheBuildMachine, workspace, nil)
-	if !again.Paused() {
-		t.Fatal("restarted, the holder forgot it was paused")
-	}
-	if _, err := again.handlers()["resume"](context.Background(), json.RawMessage(`{}`)); err != nil {
-		t.Fatal(err)
-	}
-	if newHolder("ace", link.TheBuildMachine, workspace, nil).Paused() {
-		t.Fatal("resumed, the holder came back paused")
-	}
-}
-
-// kill ends the build with that id — its context, which ends its commands — removes what it left by
-// label, and refuses an id it is not building.
-func TestKillEndsTheBuildRunningHereAndNoOther(t *testing.T) {
-	h := newHolder("ace", link.TheBuildMachine, t.TempDir(), nil)
-	var removed []string
-	h.remove = func(_ context.Context, _ string, name string, args ...string) (string, error) {
-		removed = append(removed, name+" "+strings.Join(args, " "))
-		if args[0] == "ps" {
-			return "c1\n", nil
-		}
-		return "", nil
-	}
-	kill := h.handlers()["kill"]
-	if _, err := kill(context.Background(), json.RawMessage(`{"id":"build-1"}`)); err == nil {
-		t.Fatal("killed a build while none ran")
-	}
-
-	building, cancel := context.WithCancel(context.Background())
-	r := h.begin(link.BuildRequest{ID: "build-1", Repository: "novox/a"}, cancel)
-	h.stepped(r, "image")
-	if c := h.current(); c.Running == nil || c.Running.ID != "build-1" || c.Running.Step != "image" {
-		t.Fatalf("current says %+v", c)
-	}
-	if _, err := kill(context.Background(), json.RawMessage(`{"id":"build-2"}`)); err == nil ||
-		!strings.Contains(err.Error(), "build-1") {
-		t.Fatalf("killed another id: %v", err)
-	}
-	// The build's own goroutine: it ends when its context does, as a build's commands do, and
-	// announces what came of it.
-	go func() {
-		<-building.Done()
-		if h.returned(r) {
-			h.said(r, link.KilledByHand, true)
-		}
-		h.end(r)
-	}()
-	answer, err := kill(context.Background(), json.RawMessage(`{"id":"build-1"}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if building.Err() == nil {
-		t.Fatal("the build's context was not cancelled")
-	}
-	if !r.killed {
-		t.Error("the build is not marked killed, so it would be announced as an ordinary failure")
-	}
-	said := answer.(map[string]any)["said"].(string)
-	if !strings.Contains(said, "2 container(s)") || !strings.Contains(said, "announced as failed") || !strings.Contains(said, link.KilledByHand) {
-		t.Errorf("kill said %q", said)
-	}
-	// Removed at the kill and again once the build had ended: a container made in between is caught.
-	if len(removed) != 4 || !strings.Contains(removed[0], "label=mesh.build=build-1") || !strings.Contains(removed[2], "label=mesh.build=build-1") {
-		t.Errorf("removed %v", removed)
-	}
-	if c := h.current(); c.Running != nil {
-		t.Errorf("after the kill current says %+v", c)
-	}
-}
-
-// A holder announces this machine's verbs of the seat as the console reads a seat's verb, and no more.
-func TestAHolderAnnouncesItsMachinesVerbsForTheConsole(t *testing.T) {
-	info := announcement(link.TheBuildMachine, moduleOf("ace.build-agent"), "ace")
-	if info.Name != "node-build-agent" || info.ID != "ace" || len(info.Endpoints) != 4 {
-		t.Fatalf("announced %s/%s with %d endpoints", info.Name, info.ID, len(info.Endpoints))
-	}
-	kill := info.Endpoints[1]
-	md := kill.Metadata
-	if kill.Subject != "mesh.seat.node-build-agent.tool.kill.ace" || kill.QueueGroup != "seat.node-build-agent" || md["kind"] != "seat" || md["seat"] != "node-build-agent" ||
-		md["scope"] != "node" || md["node"] != "ace" || md["tool"] != "kill" || md["module"] != "build-agent" ||
-		!strings.Contains(md["description"], "killed by hand") || !strings.Contains(md["schema"], `"id"`) {
-		t.Fatalf("kill is announced as %+v", kill)
-	}
-	body, err := json.Marshal(info)
-	if err != nil || len(body) > 8*1024 {
-		t.Fatalf("the answer is %d bytes (%v)", len(body), err)
-	}
-}
-
-// A build that ended on its own as the kill arrived says what it did: the kill is refused, and its
-// own error is its outcome. One whose outcome could not be announced is not said to be settled.
-func TestAKillArrivingAfterTheBuildEndedIsRefusedAndAnUnannouncedKillSaysSo(t *testing.T) {
-	h := newHolder("ace", link.TheBuildMachine, t.TempDir(), nil)
-	h.remove = func(context.Context, string, string, ...string) (string, error) { return "", nil }
-	_, cancel := context.WithCancel(context.Background())
-	r := h.begin(link.BuildRequest{ID: "build-1"}, cancel)
-	if killed := h.returned(r); killed {
-		t.Fatal("a build nobody killed reads as killed")
-	}
-	if _, err := h.kill("build-1"); err == nil || !strings.Contains(err.Error(), "ended on its own") {
-		t.Fatalf("killed a build that had ended: %v", err)
-	}
-	h.end(r)
-
-	building, cancel := context.WithCancel(context.Background())
-	r = h.begin(link.BuildRequest{ID: "build-2"}, cancel)
-	go func() {
-		<-building.Done()
-		if h.returned(r) {
-			h.said(r, link.KilledByHand, false)
-		}
-		h.end(r)
-	}()
-	said, err := h.kill("build-2")
-	if err != nil || strings.Contains(said, "announced as failed") || !strings.Contains(said, "could not be announced") {
-		t.Fatalf("kill said %q (%v)", said, err)
-	}
-}
-
-// **Issue 306**: a holder starting removes the containers earlier builds left on its machine, through
-// the runner a kill uses, and a runtime that cannot be asked does not stop it.
-func TestAHolderStartingRemovesWhatEarlierBuildsLeftHere(t *testing.T) {
-	h := newHolder("novox", link.TheBuildMachine, t.TempDir(), nil)
-	var removed []string
-	h.remove = func(_ context.Context, _ string, name string, args ...string) (string, error) {
-		removed = append(removed, name+" "+strings.Join(args, " "))
-		if args[0] == "ps" {
-			return "c1 build-1\nc2 build-1\nc3 check-here-2\n", nil
-		}
-		return "", nil
-	}
-	if n := h.removeLeftBehind(); n != 2 || len(removed) != 2 || removed[1] != "docker rm -f c1 c2" {
-		t.Fatalf("removed %d: %v", n, removed)
-	}
-	h.remove = func(context.Context, string, string, ...string) (string, error) {
-		return "", errors.New("no runtime")
-	}
-	if n := h.removeLeftBehind(); n != 0 {
-		t.Errorf("a runtime that cannot be asked removed %d", n)
-	}
-}

cmd/mesh-builder/main.go

@@ -1,935 +0,0 @@
-// mesh-builder — the thing a build machine runs.
-//
-// It takes work from the mesh, turns a repository into artifacts, publishes them, and says what
-// came out. It is **not** the control plane and it is **not** the host:
-//
-//   - the control plane decides and never touches a machine. Building runs commands on one, and
-//     what the control plane may send a machine is bounded by the declaration language
-//     (novox/hq ADR 0005). "Run this build" is not in it, and widening the language so it could
-//     be would make the control plane able to run anything anywhere.
-//   - the host applies declarations and holds no opinion about what they contain. A host that
-//     also built things would need a container runtime and git, on every machine, to do something
-//     almost none of them will ever do.
-//
-// So it is a module: a program a machine runs because the mesh told it to, holding its own broker
-// credential and nothing else. Compromise of a build machine is compromise of a build machine.
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"log"
-	"net/url"
-	"os"
-	"os/signal"
-	"sort"
-	"strings"
-	"sync"
-	"sync/atomic"
-	"syscall"
-	"time"
-
-	"github.com/nats-io/nats.go"
-
-	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/builder"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// version is set at build time.
-var version = "development"
-
-func main() {
-	if err := run(); err != nil {
-		fmt.Fprintf(os.Stderr, "mesh-builder: %v\n", err)
-		os.Exit(1)
-	}
-}
-
-const usage = `mesh-builder — builds modules for the mesh
-
-It consumes build requests and answers with what it made. Nothing is listened on and nothing
-is dialled except the broker.
-
-  MESH_BROKER_FILE   a file the mesh sealed to this machine holding the same
-  MESH_REGISTRY      host:port to publish artifacts to, when the mesh has not said
-  MESH_BINDING       a file the mesh wrote saying where the artifact store is
-  MESH_PACKAGE_BINDING  a file the mesh wrote saying where the package registry is
-  MESH_NPM_TOKEN_FILE   a file the mesh sealed holding the token for it
-  MESH_GENESIS_PACKAGE_REGISTRY  the document the installer sealed at genesis, read while no
-                     binding is present (novox/hq ADR 0336)
-  MESH_NPM_REGISTRY  a package registry URL, when the mesh has not said (a person, the bootstrap)
-  MESH_NPM_TOKEN     the token for it, likewise
-  MESH_NPM_SCOPE     the scope it answers for (default: @novox)
-  MESH_WORKSPACE     where to clone and build (default: a temporary directory)
-
-It also builds one module and stops, which is how a mesh is raised — before there is a
-broker to take work from or a registry to publish into:
-
-  mesh-builder build <repository> [--path P] [--ref COMMIT] [--registry HOST:PORT]
-
-Without --registry the artifacts stay in this machine's container runtime, named by the
-digest of their own configuration. The result is printed as JSON.
-
-  mesh-builder ready
-
-exits 0 once the agent running in this container is bound to its build work and pulls it, and
-1 before: its container's health check.
-
-  mesh-builder busy
-
-exits 0 while the agent running in this container has a build in hand, and 1 when it has none;
-from the first ask the agent takes no new build: its container's busy command, asked before the
-container is replaced (novox/hq ADR 0335).
-`
-
-func run() error {
-	if len(os.Args) > 1 {
-		switch os.Args[1] {
-		case "version":
-			fmt.Println(version)
-			return nil
-		case "build":
-			return buildOnce(context.Background(), os.Args[2:])
-		case "ready":
-			// The container's health check (novox/hq issue 544): exits non-zero until the agent takes work, and
-			// once it has been drained longer than its node-engine would wait to replace it (ADR 0335).
-			if err := ready(); err != nil {
-				return err
-			}
-			return drainedTooLong(time.Now())
-		case "busy":
-			// The container's busy command (novox/hq ADR 0335): drains the agent, and exits non-zero once
-			// nothing is in hand.
-			said, err := busy()
-			if err != nil {
-				return err
-			}
-			fmt.Println(said)
-			return nil
-		case "help", "-h", "--help":
-			fmt.Print(usage)
-			return nil
-		default:
-			// **An ask this build does not know fails** (novox/hq ADR 0335): an image older than `busy`, asked
-			// it, must read as idle — exiting 0 would hold its container for the node-engine's whole bound.
-			fmt.Fprint(os.Stderr, usage)
-			return fmt.Errorf("%q is not a command this mesh-builder knows", os.Args[1])
-		}
-	}
-
-	if err := notReady(); err != nil {
-		return err
-	}
-	// **The builder's own version is part of every reuse key** (novox/hq ADR 0350 §1): a builder that builds
-	// differently never takes a build another one made.
-	builder.Version = builder.SelfVersion(version)
-	if err := undrained(); err != nil {
-		return err
-	}
-	credential, err := brokerFrom()
-	if err != nil {
-		return err
-	}
-	registry, err := whereToPublish()
-	if err != nil {
-		return err
-	}
-	workspace := os.Getenv("MESH_WORKSPACE")
-	if workspace == "" {
-		workspace = os.TempDir() + "/mesh-builder"
-	}
-	// **The mesh's name for this machine, not the container's.** A build is reported to the rest
-	// of the mesh, and a report whose origin reads `104cb10e105b` names something no other module
-	// can look up. The mesh already knows the answer and has a way to say it — `${machine:name}`
-	// in the environment file this module is handed — so the hostname is only what is left when
-	// nobody said.
-	on := os.Getenv("MESH_NODE")
-	if on == "" {
-		hostname, err := os.Hostname()
-		if err != nil {
-			return fmt.Errorf("this build machine has no name: nothing said MESH_NODE and the host would not say either: %w", err)
-		}
-		on = hostname
-	}
-
-	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
-	defer stop()
-
-	js, seat, err := dialFor(credential)
-	if err != nil {
-		return err
-	}
-	defer js.Close()
-
-	// **This machine's holder: paused or not, and the build it is running** (novox/hq ADR 0219). The
-	// paused flag is read from the workspace before anything is taken, so a holder restarted while
-	// paused takes nothing.
-	h := newHolder(on, seat, workspace, func(state link.HolderState) error {
-		body, err := json.Marshal(state)
-		if err != nil {
-			return err
-		}
-		_, err = js.Context().Publish(link.BuildPausedOf(seat, on), body)
-		return err
-	})
-	if h.Paused() {
-		fmt.Fprintf(os.Stderr, "paused (kept in %s): taking no build until resumed\n", pausedFile(workspace))
-	}
-	// **What an earlier holder here left goes before anything is taken** (novox/hq issue 306): a holder
-	// recreated mid-check left the check's store and bus running, and the ask went to another machine.
-	h.removeLeftBehind()
-	// Paused or drained, it takes nothing new (novox/hq ADR 0219, ADR 0335): a drained agent finishes the build
-	// in hand and then says idle, and its container is replaced between builds.
-	machine := link.MachineOverNATSWith(js, on, seat, link.MachineOptions{
-		Paused: func() bool { return h.Paused() || drained() },
-		Taking: func() { taking(seat) },
-		Claim:  claim,
-	})
-	defer machine.Close()
-
-	// The seat's verbs, on this machine's subjects. Only the seat that declares them: the retired
-	// one serves none, and a subscription its holder has no grant for would be refused for ever.
-	if seat == link.TheBuildMachine {
-		stopServing, err := link.OverNATS{Conn: js.Conn()}.ServeNodeSeatTools(seat, on, h.handlers(),
-			log.New(os.Stderr, "", 0))
-		if err != nil {
-			return err
-		}
-		defer stopServing()
-		// And says so, for the console to find (novox/hq ADR 0197).
-		stopAnnouncing, err := link.OverNATS{Conn: js.Conn()}.Announce(
-			announcement(seat, moduleOf(credential.User), on), log.New(os.Stderr, "", 0))
-		if err != nil {
-			return err
-		}
-		defer stopAnnouncing()
-		go h.stateWhilePaused(ctx, time.Hour)
-	}
-
-	fmt.Fprintf(os.Stderr, "building for the mesh, publishing to %s\n", registry)
-	publisher := builder.Registry{Address: registry, Run: builder.Command}
-	// Check builds are let go of after a week (novox/hq ADR 0350 §5).
-	h.scratch = publisher
-	go h.expireChecks(ctx, time.Hour, time.Now)
-
-	return machine.Take(ctx, func(ctx context.Context, work link.Build) {
-		defer released()
-		holding(work.Request().Repository + " (" + work.Request().ID + ")")
-		answer(ctx, publisher, on, workspace, work, h)
-	})
-}
-
-// dialFor opens this machine's link to whichever bus the mesh is on, and says which build seat it
-// holds.
-//
-// **One place chooses**, as everywhere else the bus change went (novox/hq ADR 0116 step 5): a build
-// machine told about both would take work from one and answer on the other, and every log line would
-// say it was fine.
-func dialFor(credential Credential) (*broker.JetStream, string, error) {
-	// **The credential names the bus, and there is one** (novox/hq ADR 0131, design 28 task 5.5).
-	// A credential for the mesh's bus carries user, password and fingerprint beside the address,
-	// and that is enough to dial it, pinned.
-	if !credential.onTheNewBus() {
-		return nil, "", fmt.Errorf("the credential at hand names %q, which is not the mesh's bus", credential.URL)
-	}
-	// Named for what it is, not the controller whose code dials it (novox/hq issue 327).
-	host, _ := os.Hostname()
-	js, err := broker.DialPinned(credential.natsURL(), credential.Fingerprint, nats.Name("build agent on "+host))
-	if err != nil {
-		return nil, "", err
-	}
-	// **The seat this machine serves is the one its credential claims** (novox/hq ADR 0190, the
-	// handover): the mesh issues a build machine's credential naming the seat its module claims,
-	// and one binary serves the old role as `builder` and the new as `build-agent` from that alone.
-	seat := link.BuildSeatClaimed(credential.seatsClaimed())
-	fmt.Fprintf(os.Stderr, "taking build work as a holder of %s\n", seat)
-	return js, seat, nil
-}
-
-// answer does one build and says what happened, whichever way it went.
-func answer(ctx context.Context, publisher builder.Publisher, on, workspace string, work link.Build, h *holder) {
-	request := work.Request()
-
-	// **Its own context, so it can be killed alone** (novox/hq ADR 0219): cancelled by `kill`, it ends
-	// this build's commands and nothing else; the machine's own context ending — a SIGTERM — still
-	// reaches it through the parent, and that keeps today's meaning below.
-	building, cancel := context.WithCancel(ctx)
-	defer cancel()
-	var mine *running
-	if h != nil {
-		mine = h.begin(request, cancel)
-		defer h.end(mine)
-	}
-
-	// **First thing, and to stdout.** A build request that arrives and produces no visible line until
-	// it either finishes or fails is indistinguishable from one that never arrived — which cost a long
-	// diagnosis against a running mesh, chasing "the handler never fired" when the truth was only that
-	// the handler said nothing until the end.
-	fmt.Fprintf(os.Stderr, "a build request arrived for %s (%s)\n", request.Repository, request.ID)
-
-	// **Everything a build says goes two ways**: to stderr, as always, and onto the bus as the
-	// role's own events under the build's id (novox/hq ADR 0157) — so whoever asked, and anybody
-	// watching, reads the same lines this container's log holds, live, and after the fact from the
-	// stream. Said first, before anything runs, so a build that hangs is one that visibly started.
-	// One line at a time: a check's builds for its merge say their lines while its tests say theirs (novox/hq
-	// issue 716).
-	var saying sync.Mutex
-	say := func(step, message string) {
-		saying.Lock()
-		defer saying.Unlock()
-		fmt.Fprintf(os.Stderr, "  [%s] %s\n", step, message)
-		work.Say(step, message)
-		if mine != nil && step != "run" && step != "output" {
-			h.stepped(mine, step)
-		}
-	}
-	builder.Said = say
-	defer func() { builder.Said = nil }()
-	if err := work.Began(ctx); err != nil {
-		fmt.Fprintf(os.Stderr, "cannot say a build started: %v\n", err)
-	}
-	// **A running check watches its pull request's key** (novox/hq ADR 0406 §4, issue 974): when the head or the trunk
-	// commit in it moves, the check is for a state nobody wants any more, and ends itself — nothing is asked of the forge
-	// (issue 726). A group's check, a try and a build watch nothing.
-	var superseded atomic.Bool
-	if w, ok := work.(interface {
-		WatchPull(context.Context, func(link.PullKey)) (func(), error)
-	}); ok && request.Check != nil {
-		stopWatching, err := w.WatchPull(building, func(k link.PullKey) {
-			superseded.Store(true)
-			say("superseded", fmt.Sprintf("the pull request's key moved to %.12s on %.12s while this checked %.12s on %.12s: stopped",
-				k.Head, k.Trunk, request.Ref, request.Check.Trunk))
-			cancel()
-		})
-		if err != nil {
-			fmt.Fprintf(os.Stderr, "the key of %s/%s#%d could not be watched, so its check runs on if the key moves: %v\n",
-				request.Check.Owner, request.Check.Repo, request.Check.Number, err)
-		} else {
-			defer stopWatching()
-		}
-	}
-
-	result := link.BuildResult{
-		ID: request.ID, Repository: request.Repository, Path: request.Path,
-		Ref: request.Ref, On: on, Source: request.Source, DryRun: request.DryRun,
-	}
-	what := "building " + request.Repository
-	if request.Path != "" {
-		what += " at " + request.Path
-	}
-	if request.Ref != "" {
-		what += " on " + request.Ref
-	}
-	say("build", what)
-
-	npmrc, err := packagesFrom(on)
-	if err == nil {
-		say("packages", saysRegistry(npmrc))
-	}
-	registryHere, isRegistry := publisher.(builder.Registry)
-	var built builder.Result
-	if request.Check != nil {
-		// **A pull request's merge check, not a build** (novox/hq to-be 45 §9): nothing is built,
-		// published or registered; the verdict is the outcome.
-		result.Checked = request.Check
-		registry := ""
-		if r, ok := publisher.(builder.Registry); ok {
-			registry = r.Address
-		}
-		spec := checkSpecOf(request)
-		// The judge cache the build agent declares as its own data, never in the workspace: only judge builds and
-		// mesh-lab's replays mount it, never a check's containers, so no pull request's script can write what a judge
-		// is built with or kept as, or what the replays run (novox/hq ADR 0358 §6, issue 709).
-		spec.JudgeCache = judgeCache()
-		// What the merge would move, built by the check for the walk to take (novox/hq ADR 0350 §1): into the
-		// scratch namespace. **Never with the package registry's credential**: this is code nobody has approved
-		// yet, and a recipe could read the credential it is handed (issue 462). A module that resolves packages
-		// at build time has no reuse key anyway, so nothing is lost by refusing it here.
-		if isRegistry && len(spec.Builds) > 0 {
-			spec.BuildWith = &builder.CheckBuilding{Publish: publisher, Scratch: registryHere, Held: request.Held,
-				Running: request.Check.Running, Seats: request.Seats, Named: namedOf(request.Check.Named)}
-		}
-		var v builder.CheckVerdict
-		v, err = builder.Check(building, builder.Command, spec, workspace, registry, forgeFrom(), say)
-		if err == nil {
-			result.Check = &link.CheckOutcome{Verdict: v.Verdict, Summary: v.Summary, Report: v.Report,
-				Took: v.Took.Round(time.Second).String(), Gate: layerOf(v.Gate), RepoCheck: layerOf(v.Repo),
-				Head: v.Head, Trunk: v.Trunk, Beside: v.Beside, Built: checkBuiltOf(v.Built),
-				Validator: v.Validator, Siblings: siblingsOut(v.Siblings), SiblingsUnknown: v.SiblingsUnknown, JudgeFrom: v.JudgeFrom}
-			// What each of a group's heads was judged as (novox/hq ADR 0323 §6).
-			for _, m := range v.Members {
-				result.Check.Members = append(result.Check.Members, link.CheckedMember{Owner: m.Owner, Repo: m.Repo,
-					Commit: m.Head, Trunk: m.Trunk})
-			}
-			// A branch tried before its pull request reads its outcome from this log, whole (novox/hq issue 686).
-			if request.Check.Try {
-				if line, err := json.Marshal(triedOf(v)); err == nil {
-					say(link.StepTried, string(line))
-				}
-			}
-		}
-	} else if err == nil {
-		// The package-registry credential is a build input, so it is resolved before the clone: a
-		// build that could not have resolved its dependencies is refused in front of the reason, not
-		// after a clone that then fails at npm ci.
-		// Every container it starts is labelled with its id, so a kill finds what outlived the
-		// docker client (ADR 0219).
-		if request.Reuse != nil && isRegistry && !request.DryRun {
-			// **A walk's build takes the check's build of the same key** (novox/hq ADR 0350 §2).
-			reuse := builder.Reuse{Scratch: registryHere}
-			for _, p := range request.Reuse.Pulls {
-				reuse.Pulls = append(reuse.Pulls, builder.PullRef{Owner: p.Owner, Repo: p.Repo, Number: p.Number})
-			}
-			// Only what a verdict names is taken (ADR 0350 §2).
-			reuse.Named = namedOf(request.Reuse.Builds)
-			built, err = builder.BuildReusing(building, builder.Labelled(builder.Command, request.ID), publisher, reuse,
-				request.Repository, request.Path, request.Ref, workspace, request.Held, npmrc,
-				forgeFrom(), say, request.Seats)
-		} else {
-			built, err = builder.Build(building, builder.Labelled(builder.Command, request.ID), publisher,
-				request.Repository, request.Path, request.Ref, workspace, request.Held, npmrc,
-				forgeFrom(), say, request.Seats)
-		}
-	}
-	// What it copied into the store, whatever became of the build (novox/hq ADR 0257).
-	result.Mirrored = built.Mirrored
-	// Only a build the kill ended: the kill came before its work did. One that finished — built, or
-	// failed on its own — in the moment the kill arrived says what it did, and the kill is refused.
-	killed := false
-	if mine != nil {
-		killed = h.returned(mine) && err != nil
-	}
-	if superseded.Load() && err != nil {
-		// Ended by its own key moving on (ADR 0406 §4): said as the check's failure, as a kill is.
-		result.Failed = link.SupersededByKey
-		say("failed", link.SupersededByKey)
-	} else if killed {
-		// **Killed by hand is the outcome, whatever the build was doing** (novox/hq ADR 0219): the
-		// error it ended with is the kill's consequence, not a fault of the source.
-		result.Failed = link.KilledByHand
-		say("failed", link.KilledByHand)
-	} else if err != nil {
-		// A failure is a result. A build that fails and says nothing is indistinguishable from a
-		// builder that is not running, and those want completely different responses.
-		result.Failed = err.Error()
-		say("failed", err.Error())
-	} else if request.Check != nil {
-		say("checked", result.Check.Verdict+": "+result.Check.Summary)
-	} else {
-		manifest, marshalErr := json.Marshal(built.Manifest)
-		if marshalErr != nil {
-			result.Failed = marshalErr.Error()
-		} else {
-			result.Commit = built.Commit
-			result.Manifest = manifest
-			for _, made := range built.Built {
-				result.Made = append(result.Made, link.MadeArtifact{
-					Name: made.Name, Kind: made.Kind, Reference: made.Reference,
-				})
-			}
-			result.Against = built.Against
-			result.SourceFingerprint = built.Source
-			// What the walk did instead of building, or why it built (novox/hq ADR 0350 §3, §4).
-			result.ReuseKey = built.ReuseKey
-			if built.Reused != nil {
-				f := built.Reused.From
-				result.Reused = built.Reused.Words()
-				result.ReusedFrom = &link.ReusedFrom{Pull: link.PullRef{Owner: f.Pull.Owner, Repo: f.Pull.Repo,
-					Number: f.Pull.Number}, Head: f.Head, Trunk: f.Trunk, Check: f.Check, Key: f.Key}
-			} else if request.Reuse != nil {
-				result.BuiltWhy = built.Why
-				if result.BuiltWhy == "" {
-					result.BuiltWhy = "it has no artifact to build"
-				}
-			}
-			result.Trunk, result.OnTrunk, result.Branches = built.Trunk, built.OnTrunk, built.Branches
-			for _, r := range built.Read {
-				result.Read = append(result.Read, link.ReadRepository{Repository: r.Repository, Ref: r.Ref})
-			}
-			for _, s := range built.Sources {
-				result.Sources = append(result.Sources, link.BuildSource{Repository: s.Repository, Ref: s.Ref, Paths: s.Paths})
-			}
-			// The list of predefined keys the manifest was judged against, for the controller to publish
-			// (novox/hq ADR 0348 §7).
-			if p := built.Predefined; p != nil {
-				result.Predefined = &link.PredefinedList{Keys: p.Keys, Generation: p.Generation}
-			}
-			say("built", built.Manifest.Module+" from "+short(built.Commit))
-		}
-	}
-
-	// A killed build is announced on a context of its own: the build's was the one cancelled, and the
-	// outcome must go out and the ask be settled — acknowledged, never redelivered to another machine
-	// to be built again. A machine being stopped is the other case and keeps its meaning: the
-	// parent's context is gone, nothing is announced or settled, and the ask is redelivered.
-	announcing := ctx
-	if killed {
-		fresh, stop := context.WithTimeout(context.Background(), 30*time.Second)
-		defer stop()
-		announcing = fresh
-	}
-	announceErr := work.Announce(announcing, result)
-	if mine != nil {
-		h.said(mine, result.Failed, announceErr == nil)
-	}
-	if err := announceErr; err != nil {
-		// Said, not fatal: the build happened. A build reported as failed because announcing it
-		// failed is a lie about work that was done — and the request stays unsettled below only if
-		// nothing was said at all, so another machine can try.
-		fmt.Fprintf(os.Stderr, "cannot say what came of a build: %v\n", err)
-		return
-	}
-
-	// Settled only once the outcome is away, so a machine that dies before answering leaves the work
-	// for another rather than losing it.
-	if err := work.Done(); err != nil {
-		fmt.Fprintf(os.Stderr, "the outcome is away and the request could not be settled: %v\n", err)
-	}
-}
-
-// checkSpecOf is a check request as the builder runs it.
-func checkSpecOf(request link.BuildRequest) builder.CheckSpec {
-	c := request.Check
-	spec := builder.CheckSpec{ID: request.ID, Repository: request.Repository, Ref: request.Ref,
-		Owner: c.Owner, Repo: c.Repo, Number: c.Number, Paths: c.Paths, Beside: map[string]builder.Beside{},
-		Modules: c.Modules, New: c.New, Manifests: c.Manifests, Judge: c.Judge, Base: c.Base,
-		Toolchain: builder.ToolchainOf(request.Held), Toolchains: builder.ToolchainsOf(request.Held),
-		Tests: c.Tests, StoreOnly: c.StoreOnly, SiblingsUnknown: c.SiblingsUnknown}
-	for _, s := range c.Siblings {
-		spec.Siblings = append(spec.Siblings, builder.Sibling{Repository: s.Repository, Number: s.Number, Head: s.Head,
-			Base: s.Base, Dir: s.Dir})
-	}
-	for dir, b := range c.Beside {
-		spec.Beside[dir] = builder.Beside{Repository: b.Repository, Ref: b.Ref}
-	}
-	for _, b := range c.Builds {
-		spec.Builds = append(spec.Builds, builder.CheckBuildSpec{Module: b.Module, Repository: b.Repository, Path: b.Path,
-			Ref: b.Ref, Merged: b.Merged, Tier: b.Tier, Skip: b.Skip})
-	}
-	for _, m := range c.Members {
-		spec.Group = append(spec.Group, builder.GroupHead{Owner: m.Owner, Repo: m.Repo, Repository: m.Repository,
-			Ref: m.Ref, Paths: m.Paths, Base: m.Base})
-	}
-	return spec
-}
-
-// siblingsOut is the siblings a check read as the outcome carries them (novox/hq ADR 0382 §4).
-func siblingsOut(read []builder.JudgedSibling) []link.CheckSibling {
-	var out []link.CheckSibling
-	for _, s := range read {
-		out = append(out, link.CheckSibling{Repository: s.Repository, Number: s.Number, Head: s.Head, Base: s.Base,
-			BaseCommit: s.BaseCommit})
-	}
-	return out
-}
-
-// judgeCache is the judge cache the build agent's manifest declares (MESH_JUDGE_CACHE, novox/hq ADR 0358 §6): a
-// directory mounted at the same path on the host, so a judge build's mounts name what the agent sees. Empty when the
-// agent declares none, and every judge is then built cold under its check's root.
-func judgeCache() string { return os.Getenv("MESH_JUDGE_CACHE") }
-
-// triedOf is a try's outcome as its log line says it (novox/hq issue 686): the repository's own check's verdict,
-// or the check's where that did not run — a head that does not merge — and the lines naming what failed.
-func triedOf(v builder.CheckVerdict) link.Tried {
-	t := link.Tried{Verdict: v.Verdict, Summary: v.Summary, Took: v.Took.Round(time.Second).String(),
-		Head: v.Head, Trunk: v.Trunk}
-	if v.Repo != nil && (v.Gate == nil || v.Gate.Verdict == "pass") {
-		t.Verdict, t.Summary = v.Repo.Verdict, v.Repo.Summary
-	}
-	if v.Repo != nil && v.Repo.Failed != "" {
-		t.Failed = strings.Split(v.Repo.Failed, "\n")
-	}
-	if t.Verdict == "" {
-		t.Verdict = "error"
-	}
-	return t
-}
-
-// namedOf are the builds the seat's verdicts name, as the builder believes a scratch record by them (novox/hq ADR
-// 0350 §2, issue 703): each module's key with every artifact's digest.
-func namedOf(builds []link.CheckedBuild) []builder.NamedBuild {
-	var out []builder.NamedBuild
-	for _, b := range builds {
-		named := builder.NamedBuild{Pull: builder.PullRef{Owner: b.Pull.Owner, Repo: b.Pull.Repo,
-			Number: b.Pull.Number}, Check: b.Check, Module: b.Built.Module, Key: b.Built.Key,
-			Digests: map[string]string{}}
-		for _, m := range b.Built.Made {
-			named.Digests[m.Name] = builder.DigestOf(m.Reference)
-		}
-		out = append(out, named)
-	}
-	return out
-}
-
-// checkBuiltOf is a check's builds for its merge as the outcome carries them (novox/hq ADR 0350 §1).
-func checkBuiltOf(built []builder.CheckBuilt) []link.CheckBuilt {
-	var out []link.CheckBuilt
-	for _, b := range built {
-		c := link.CheckBuilt{Module: b.Module, Key: b.Key, NotBuilt: b.NotBuilt, Took: b.Took.Round(time.Second).String(),
-			Kept: b.Kept, Same: b.Same, SameAs: b.SameAs}
-		for _, m := range b.Made {
-			c.Made = append(c.Made, link.MadeArtifact{Name: m.Name, Kind: m.Kind, Reference: m.Reference})
-		}
-		out = append(out, c)
-	}
-	return out
-}
-
-// layerOf is one layer of a check as the outcome carries it.
-func layerOf(l *builder.Layer) *link.CheckLayer {
-	if l == nil {
-		return nil
-	}
-	return &link.CheckLayer{Verdict: l.Verdict, Summary: l.Summary, Modules: l.Modules}
-}
-
-// packagesFrom is where a build resolves the mesh's own published packages — the SDK above all
-// (novox/hq ADR 0076, issue 053) — on this machine.
-//
-// **The binding wins, then the genesis document** (novox/hq ADR 0336 §3, §4). The build agent's
-// npm-package-registry requirement is optional: on genesis's node, before the gitea module is assigned,
-// nothing provides it, and the installer sealed the forge it raised to this agent as one document
-// instead. Once the requirement binds, the binding names the endpoint the way the artifact store's
-// does and a sealed token file the credential, and the genesis document is left unread. A binding
-// file named and absent is a requirement not bound here, never a fault: the environment names the
-// path whether or not the mesh wrote it.
-//
-// The environment variables remain for a builder run by a person. With none of the three the result
-// is disabled and says this machine, so a build that needs the registry is refused naming it (§6),
-// and a build that needs none builds anyway.
-func packagesFrom(machine string) (builder.Npmrc, error) {
-	scope := strings.TrimSpace(os.Getenv("MESH_NPM_SCOPE"))
-	if scope == "" {
-		scope = "@novox"
-	}
-	none := builder.Npmrc{Machine: machine}
-
-	if path := strings.TrimSpace(os.Getenv("MESH_PACKAGE_BINDING")); path != "" {
-		raw, err := os.ReadFile(path)
-		switch {
-		case errors.Is(err, os.ErrNotExist):
-			// Not bound on this machine: the genesis document, or nothing.
-		case err != nil:
-			return none, fmt.Errorf("cannot read what the mesh said about the package registry: %w", err)
-		default:
-			return fromBinding(path, raw, scope, machine)
-		}
-	}
-	if path := strings.TrimSpace(os.Getenv("MESH_GENESIS_PACKAGE_REGISTRY")); path != "" {
-		raw, err := os.ReadFile(path)
-		switch {
-		case errors.Is(err, os.ErrNotExist):
-			// Not this mesh's genesis node, or the installer has not sealed it yet.
-		case err != nil:
-			return none, fmt.Errorf("cannot read the genesis document for the package registry: %w", err)
-		default:
-			return fromGenesis(path, raw, scope, machine)
-		}
-	}
-
-	// A builder run by a person.
-	registry := strings.TrimSpace(os.Getenv("MESH_NPM_REGISTRY"))
-	secret := strings.TrimSpace(os.Getenv("MESH_NPM_TOKEN"))
-	username := strings.TrimSpace(os.Getenv("MESH_NPM_USER"))
-	if registry == "" && secret == "" {
-		return none, nil
-	}
-	n := builder.Npmrc{Scope: scope, Registry: registry, From: builder.FromEnvironment, Machine: machine}
-	if username != "" {
-		n.Username, n.Password = username, secret
-	} else {
-		n.Token = secret
-	}
-	return n, nil
-}
-
-// fromBinding composes the registry from the npm-package-registry binding the mesh wrote and the
-// credential it sealed beside it. The mesh authenticates the ordinary way — a generated password the
-// provider only applies (novox/hq ADR 0048) — so with a username the secret is a password (basic
-// auth); without one it is a bearer token a provider minted.
-func fromBinding(path string, raw []byte, scope, machine string) (builder.Npmrc, error) {
-	none := builder.Npmrc{Machine: machine}
-	var told struct {
-		From   string         `json:"from"`
-		At     string         `json:"at"`
-		As     string         `json:"as"`
-		Serves map[string]any `json:"serves"`
-	}
-	if err := json.Unmarshal(raw, &told); err != nil {
-		return none, fmt.Errorf("%s is not a binding: %w", path, err)
-	}
-	if told.At == "" {
-		return none, fmt.Errorf(
-			"%s says the package registry is on %q and gives no address for it", path, told.From)
-	}
-	// Composed from what the provider serves, so nothing here knows gitea's URL shape from
-	// another registry's: it states its port, the path its registry answers on, and the scheme.
-	scheme := "https"
-	if s, ok := told.Serves["scheme"]; ok {
-		scheme = fmt.Sprintf("%v", s)
-	}
-	port, ok := told.Serves["port"]
-	if !ok {
-		return none, fmt.Errorf("%s says nothing about which port the package registry answers on", path)
-	}
-	npmPath, ok := told.Serves["npm-path"]
-	if !ok {
-		return none, fmt.Errorf("%s says nothing about the path the package registry answers on", path)
-	}
-	secret := strings.TrimSpace(os.Getenv("MESH_NPM_TOKEN"))
-	if file := strings.TrimSpace(os.Getenv("MESH_NPM_TOKEN_FILE")); file != "" {
-		raw, err := os.ReadFile(file)
-		if err != nil {
-			return none, fmt.Errorf("cannot read this builder's package-registry credential: %w", err)
-		}
-		secret = strings.TrimSpace(string(raw))
-	}
-	n := builder.Npmrc{Scope: scope, Registry: fmt.Sprintf("%s://%s:%v%v", scheme, told.At, port, npmPath),
-		From: builder.FromBinding, Machine: machine}
-	if told.As != "" {
-		n.Username, n.Password = told.As, secret
-	} else {
-		n.Token = secret
-	}
-	return n, nil
-}
-
-// GenesisRegistry is the genesis document (novox/hq ADR 0336 §3): what the installer sealed to the
-// build agent on its node at genesis's packages step, as the `genesis-package-registry` own-secret —
-// the forge it raised, the port this node gave the package registry, its npm path, and the account it
-// made with that account's password. mesh-host writes it; the field names are the two repositories'
-// agreement.
-type GenesisRegistry struct {
-	Scheme   string `json:"scheme"`
-	At       string `json:"at"`
-	Port     int    `json:"port"`
-	NpmPath  string `json:"npm-path"`
-	As       string `json:"as"`
-	Password string `json:"password"`
-}
-
-// fromGenesis composes the registry from the genesis document.
-func fromGenesis(path string, raw []byte, scope, machine string) (builder.Npmrc, error) {
-	none := builder.Npmrc{Machine: machine}
-	var g GenesisRegistry
-	if err := json.Unmarshal(raw, &g); err != nil {
-		return none, fmt.Errorf("%s is not the genesis document for the package registry: %w", path, err)
-	}
-	var missing []string
-	for name, value := range map[string]string{"at": g.At, "npm-path": g.NpmPath, "as": g.As, "password": g.Password} {
-		if strings.TrimSpace(value) == "" {
-			missing = append(missing, name)
-		}
-	}
-	if g.Port <= 0 {
-		missing = append(missing, "port")
-	}
-	if len(missing) > 0 {
-		sort.Strings(missing)
-		return none, fmt.Errorf("%s, the genesis document for the package registry, says nothing of %s",
-			path, strings.Join(missing, ", "))
-	}
-	scheme := g.Scheme
-	if scheme == "" {
-		scheme = "http"
-	}
-	return builder.Npmrc{Scope: scope, Registry: fmt.Sprintf("%s://%s:%d%s", scheme, g.At, g.Port, g.NpmPath),
-		Username: g.As, Password: g.Password, From: builder.FromGenesis, Machine: machine}, nil
-}
-
-// saysRegistry is the line each build's log carries about the package registry (novox/hq ADR 0336
-// §4): which of the binding and the genesis document it resolved from, or that it has neither here.
-func saysRegistry(n builder.Npmrc) string {
-	if n.Enabled() {
-		return "the package registry is resolved from " + n.From
-	}
-	machine := n.Machine
-	if machine == "" {
-		machine = "this machine"
-	}
-	return fmt.Sprintf("no package registry: %s is unbound on %s and no genesis document is here; "+
-		"a build needing it is refused", builder.RegistryRequirement, machine)
-}
-
-// forgeFrom is the git credential this builder may offer a clone, composed from the same binding
-// and sealed secret its package-registry half already reads: the forge that answers npm is the
-// forge that hosts the repositories, and its provisioner applies one password to one user for
-// both. Anything missing means no credential, and every clone stays anonymous — which is all a
-// mesh of public repositories ever needs.
-//
-// The URL names the binding's own address — the machine the mesh says the forge is on — so a
-// private repository is registered and built by that address, and a clone of anything else is
-// never shown this credential (git's credential store matches the whole origin).
-func forgeFrom() builder.GitCredential {
-	path := strings.TrimSpace(os.Getenv("MESH_PACKAGE_BINDING"))
-	if path == "" {
-		return builder.GitCredential{}
-	}
-	raw, err := os.ReadFile(path)
-	if err != nil {
-		return builder.GitCredential{}
-	}
-	var told struct {
-		At     string         `json:"at"`
-		As     string         `json:"as"`
-		Serves map[string]any `json:"serves"`
-	}
-	if err := json.Unmarshal(raw, &told); err != nil || told.At == "" || told.As == "" {
-		return builder.GitCredential{}
-	}
-	secret := strings.TrimSpace(os.Getenv("MESH_NPM_TOKEN"))
-	if file := strings.TrimSpace(os.Getenv("MESH_NPM_TOKEN_FILE")); file != "" {
-		if raw, err := os.ReadFile(file); err == nil {
-			secret = strings.TrimSpace(string(raw))
-		}
-	}
-	if secret == "" {
-		return builder.GitCredential{}
-	}
-	scheme := "https"
-	if s, ok := told.Serves["scheme"]; ok {
-		scheme = fmt.Sprintf("%v", s)
-	}
-	host := told.At
-	if port, ok := told.Serves["port"]; ok {
-		host = fmt.Sprintf("%s:%v", told.At, port)
-	}
-	made := url.URL{Scheme: scheme, User: url.UserPassword(told.As, secret), Host: host}
-	return builder.GitCredential{URL: made.String()}
-}
-
-func short(commit string) string {
-	if len(commit) > 8 {
-		return commit[:8]
-	}
-	return commit
-}
-
-// whereToPublish is the artifact store this builder uses.
-//
-// **Preferably from the mesh.** A builder that is a module requires an artifact store, and the
-// mesh writes it a file saying which machine answers that and on what port — the same binding any
-// consumer of any provision gets. Reading it means the address is not a setting somebody keeps in
-// step by hand, and moving the store is an ordinary reassignment rather than an edit on every
-// build machine.
-//
-// The environment variable remains for a builder run by a person, which is how this started and
-// how it is still run while being developed.
-func whereToPublish() (string, error) {
-	binding := strings.TrimSpace(os.Getenv("MESH_BINDING"))
-	if binding == "" {
-		registry := strings.TrimSpace(os.Getenv("MESH_REGISTRY"))
-		if registry == "" {
-			return "", fmt.Errorf("neither MESH_BINDING nor MESH_REGISTRY: a built artifact " +
-				"nobody can fetch is not built")
-		}
-		return registry, nil
-	}
-
-	raw, err := os.ReadFile(binding)
-	if err != nil {
-		return "", fmt.Errorf("cannot read what the mesh said about the artifact store: %w", err)
-	}
-	var told struct {
-		From   string         `json:"from"`
-		At     string         `json:"at"`
-		Serves map[string]any `json:"serves"`
-	}
-	if err := json.Unmarshal(raw, &told); err != nil {
-		return "", fmt.Errorf("%s is not a binding: %w", binding, err)
-	}
-	if told.At == "" {
-		// The provider is not on the private network, so there is no name to reach it by. Said
-		// rather than falling back to the machine's own name, which would publish to a store on
-		// the wrong machine and be found out much later.
-		return "", fmt.Errorf(
-			"%s says the artifact store is on %q and gives no address for it", binding, told.From)
-	}
-	port, ok := told.Serves["port"]
-	if !ok {
-		return "", fmt.Errorf("%s says nothing about which port the artifact store answers on",
-			binding)
-	}
-	return fmt.Sprintf("%s:%v", told.At, port), nil
-}
-
-// brokerFrom is where this builder connects, and with what.
-//
-// **Preferably from a file the mesh sealed to this machine.** A builder that is a module is given
-// its credential the way every other module is given one: generated or accepted centrally, sealed
-// to the machine, written by the host. Putting it in an environment variable instead would mean
-// the one copy that matters passing through a terminal and a process listing.
-//
-// The variable remains for a builder run by a person.
-func brokerFrom() (Credential, error) {
-	if path := strings.TrimSpace(os.Getenv("MESH_BROKER_FILE")); path != "" {
-		raw, err := os.ReadFile(path)
-		if err != nil {
-			return Credential{}, fmt.Errorf("cannot read this builder's credential: %w", err)
-		}
-		said := strings.TrimSpace(string(raw))
-		if said == "" {
-			// An empty credential file is a machine that will connect as nobody and be refused,
-			// with the reason three layers away.
-			return Credential{}, fmt.Errorf("%s is empty, so this builder has no credential", path)
-		}
-		var held Credential
-		if err := json.Unmarshal([]byte(said), &held); err == nil && held.URL != "" {
-			return held, nil
-		}
-		// A file holding only a URL, which is what a person writing one by hand produces. The
-		// broker is then verified against whatever this machine already trusts.
-		return Credential{URL: said}, nil
-	}
-	return Credential{}, fmt.Errorf(
-		"no MESH_BROKER_FILE: a build machine with no credential for the bus has nothing to build")
-}
-
-// Credential is what a build machine is given so it can reach the broker.
-//
-// Two things, because reaching a broker over TLS needs both: who to connect as, and what to check
-// the certificate against. A mesh's broker presents a certificate of the mesh's own, which is in
-// no public trust store, so a URL alone can only connect to a broker somebody else vouches for.
-//
-// **The same shape a node gets, for the same reason** (novox/hq ADR 0004): the fingerprint travels
-// out of band — here, sealed with the credential — and the endpoint is verified once at connect.
-type Credential struct {
-	URL         string `json:"url"`
-	Fingerprint string `json:"fingerprint,omitempty"`
-	// User and Password ride beside the address on the bus being built (design 25): a credential
-	// embedded in a URL leaks into every log line that prints a connection, so the mesh seals them
-	// as two fields and this machine joins them once, here, to dial.
-	User     string `json:"user,omitempty"`
-	Password string `json:"password,omitempty"`
-	// Claims are the seats the module this credential was issued for claims, as the mesh writes
-	// them beside the credential (novox/hq ADR 0159). The first is the build role this machine
-	// serves; a credential naming none is from before claims travelled in it.
-	Claims []struct {
-		Seat string `json:"seat"`
-	} `json:"claims,omitempty"`
-}
-
-// seatsClaimed is the seats the credential names, in order.
-func (c Credential) seatsClaimed() []string {
-	out := make([]string, 0, len(c.Claims))
-	for _, claim := range c.Claims {
-		out = append(out, claim.Seat)
-	}
-	return out
-}
-
-// onTheNewBus is whether a credential is for the bus being built: its address says so, and the
-// mesh only ever seals such a credential with the user and password beside it.
-func (c Credential) onTheNewBus() bool { return strings.HasPrefix(strings.TrimSpace(c.URL), "nats://") }
-
-// natsURL is the address with this machine's credential in it, for the one dial that needs it.
-func (c Credential) natsURL() string {
-	rest := strings.TrimPrefix(strings.TrimSpace(c.URL), "nats://")
-	if c.User == "" {
-		return "nats://" + rest
-	}
-	return "nats://" + c.User + ":" + c.Password + "@" + rest
-}

cmd/mesh-builder/once.go

@@ -1,188 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"flag"
-	"fmt"
-	"os"
-	"strings"
-
-	"github.com/novox/mesh-controller/internal/builder"
-)
-
-// buildOnce is the builder doing one build and stopping, with no broker and no mesh.
-//
-// **This is how a mesh is raised** (novox/hq ADR 0073). The installer carries this program and runs
-// it once, before anything else exists, to produce the control plane from the same repository and
-// path that every later rebuild of it will use. What raises the mesh is therefore the same thing
-// that maintains it — not a second mechanism that has to be kept in step with the first and is
-// exercised once per new mesh, which is how often enough to rot.
-//
-// It takes no work from a queue and answers nobody: there is no broker yet, and the only thing
-// waiting for the answer is the installer that started it. So the result goes to standard output as
-// JSON, which is what the installer reads.
-//
-// With no --registry it publishes nowhere and the image stays in this machine's container runtime,
-// named by the digest of its own configuration (see builder.Local). That is the genesis case. With
-// one, it publishes as it always does — the same command is how an operator builds a module by hand
-// on a mesh that already exists.
-func buildOnce(ctx context.Context, args []string) error {
-	set := flag.NewFlagSet("build", flag.ContinueOnError)
-	path := set.String("path", "", "the module's directory inside the repository (default: its root)")
-	ref := set.String("ref", "", "the commit to build; a branch is a moving target somebody else controls")
-	registry := set.String("registry", "",
-		"host:port to publish to. Without it the artifacts stay in this machine's container runtime, which is the genesis case")
-	workspace := set.String("workspace", "", "where to clone and build (default: a temporary directory)")
-	on := multiple(set, "on",
-		"a base this build stands on, as <module>/<artifact>=<reference>. Repeatable")
-	positionals, err := parseAround(set, args)
-	if err != nil {
-		return err
-	}
-	if len(positionals) != 1 {
-		return errors.New("mesh-builder build <repository> [--path P] [--ref COMMIT] [--registry HOST:PORT]")
-	}
-	repository := positionals[0]
-
-	where := *workspace
-	if where == "" {
-		where = os.TempDir() + "/mesh-builder-once"
-	}
-
-	// What this build may stand on, said on the command line because there is no mesh to ask.
-	//
-	// **This is the genesis case and it is meant to be awkward.** On a running mesh the control
-	// plane answers this, because only it knows what this mesh holds. Here nothing has been built
-	// yet, so whoever runs this says what to use — and for the control plane, which is the one
-	// module raised before anything else exists, the answer is ordinarily nothing at all.
-	bases := map[string]string{}
-	for _, pair := range *on {
-		key, reference, found := strings.Cut(pair, "=")
-		if !found || key == "" || reference == "" {
-			return fmt.Errorf(
-				"--on takes <module>/<artifact>=<reference>, and %q is not that", pair)
-		}
-		bases[key] = reference
-	}
-
-	// Local unless told otherwise, because the moment this exists for has nowhere to publish. A
-	// default pointing at a registry would mean genesis failing at a push to something that is not
-	// there yet, one step away from the thing that could explain it.
-	var publisher builder.Publisher = builder.Local{Run: builder.Command}
-	if *registry != "" {
-		publisher = builder.Registry{Address: *registry, Run: builder.Command}
-	}
-
-	fmt.Fprintf(os.Stderr, "building %s", repository)
-	if *path != "" {
-		fmt.Fprintf(os.Stderr, " at %s", *path)
-	}
-	if *ref != "" {
-		fmt.Fprintf(os.Stderr, " at %s", *ref)
-	}
-	fmt.Fprintln(os.Stderr)
-
-	machine := os.Getenv("MESH_NODE")
-	if machine == "" {
-		machine, _ = os.Hostname()
-	}
-	npmrc, err := packagesFrom(machine)
-	if err != nil {
-		return err
-	}
-	fmt.Fprintf(os.Stderr, "  [packages] %s\n", saysRegistry(npmrc))
-	built, buildErr := builder.Build(ctx, builder.Command, publisher, repository, *path, *ref, where, bases, npmrc,
-		forgeFrom(),
-		func(step, message string) { fmt.Fprintf(os.Stderr, "  [%s] %s\n", step, message) })
-	if buildErr != nil {
-		return buildErr
-	}
-
-	// To standard output, and everything else to standard error, so the caller can read this
-	// without having to separate it from progress.
-	out := onceResult{
-		Module:     built.Manifest.Module,
-		Commit:     built.Commit,
-		Repository: repository,
-		Path:       *path,
-		Ref:        *ref,
-		Manifest:   built.Manifest,
-		Against:    built.Against,
-		Source:     built.Source,
-	}
-	for _, r := range built.Read {
-		out.Read = append(out.Read, readRepository{Repository: r.Repository, Ref: r.Ref})
-	}
-	for _, made := range built.Built {
-		out.Made = append(out.Made, madeArtifact{Name: made.Name, Kind: made.Kind, Reference: made.Reference})
-	}
-	body, err := json.MarshalIndent(out, "", "  ")
-	if err != nil {
-		return err
-	}
-	fmt.Println(string(body))
-	fmt.Fprintf(os.Stderr, "  built %s from %s\n", built.Manifest.Module, short(built.Commit))
-	return nil
-}
-
-// onceResult is what one build reports to whoever started it.
-//
-// The same fields the mesh records for a build, so a reader comparing a genesis build against an
-// ordinary one is comparing the same thing said the same way.
-type onceResult struct {
-	Module     string           `json:"module"`
-	Commit     string           `json:"commit"`
-	Repository string           `json:"repository"`
-	Path       string           `json:"path,omitempty"`
-	Ref        string           `json:"ref,omitempty"`
-	Manifest   any              `json:"manifest"`
-	Made       []madeArtifact   `json:"made"`
-	Against    []string         `json:"against,omitempty"`
-	Read       []readRepository `json:"read,omitempty"`
-	Source     string           `json:"source-fingerprint,omitempty"`
-}
-
-// readRepository is a repository this build read source from besides the module's own.
-type readRepository struct {
-	Repository string `json:"repository"`
-	Ref        string `json:"ref,omitempty"`
-}
-
-type madeArtifact struct {
-	Name      string `json:"name"`
-	Kind      string `json:"kind"`
-	Reference string `json:"reference"`
-}
-
-// parseAround lets flags appear on either side of the repository, because a person writing this by
-// hand will put them wherever reads best and the standard parser stops at the first thing that is
-// not a flag. The same helper the control plane's commands use, for the same reason.
-func parseAround(set *flag.FlagSet, args []string) ([]string, error) {
-	var positionals []string
-	rest := args
-	for {
-		if err := set.Parse(rest); err != nil {
-			return nil, err
-		}
-		rest = set.Args()
-		if len(rest) == 0 {
-			return positionals, nil
-		}
-		positionals = append(positionals, rest[0])
-		rest = rest[1:]
-	}
-}
-
-// multiple is a flag that may be given more than once.
-type repeated []string
-
-func (r *repeated) String() string     { return strings.Join(*r, ", ") }
-func (r *repeated) Set(v string) error { *r = append(*r, v); return nil }
-
-func multiple(set *flag.FlagSet, name, usage string) *[]string {
-	var values repeated
-	set.Var(&values, name, usage)
-	return (*[]string)(&values)
-}

cmd/mesh-builder/packages_test.go

@@ -1,102 +0,0 @@
-package main
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/builder"
-)
-
-// The build agent's package registry (novox/hq ADR 0336, issue 121): its npm-package-registry
-// requirement is optional, so the binding may be absent, and on genesis's node the installer seals
-// the forge it raised as one genesis document instead.
-
-// registryFiles names the three paths the build agent's environment always names, writing only those
-// given.
-func registryFiles(t *testing.T, binding, token, genesis string) {
-	t.Helper()
-	dir := t.TempDir()
-	for env, content := range map[string]string{
-		"MESH_PACKAGE_BINDING":          binding,
-		"MESH_NPM_TOKEN_FILE":           token,
-		"MESH_GENESIS_PACKAGE_REGISTRY": genesis,
-	} {
-		path := filepath.Join(dir, env)
-		t.Setenv(env, path)
-		if content != "" {
-			if err := os.WriteFile(path, []byte(content), 0o600); err != nil {
-				t.Fatal(err)
-			}
-		}
-	}
-	for _, env := range []string{"MESH_NPM_REGISTRY", "MESH_NPM_TOKEN", "MESH_NPM_USER", "MESH_NPM_SCOPE"} {
-		t.Setenv(env, "")
-	}
-}
-
-const (
-	aBinding = `{"from":"gitea","at":"anchor.mesh","as":"anchor-agent",
-	  "serves":{"scheme":"http","port":3000,"npm-path":"/api/packages/novox/npm/"}}`
-	aGenesisDocument = `{"scheme":"http","at":"127.0.0.1","port":3100,"npm-path":"/api/packages/novox/npm/",
-	  "as":"mesh-builder","password":"genesis-secret"}`
-)
-
-func TestUntilTheRequirementBindsTheGenesisDocumentIsRead(t *testing.T) {
-	registryFiles(t, "", "", aGenesisDocument)
-	n, err := packagesFrom("anchor")
-	if err != nil {
-		t.Fatalf("an absent binding beside a genesis document was refused: %v", err)
-	}
-	if n.From != builder.FromGenesis || n.Registry != "http://127.0.0.1:3100/api/packages/novox/npm/" ||
-		n.Username != "mesh-builder" || n.Password != "genesis-secret" || n.Scope != "@novox" {
-		t.Fatalf("the genesis document was not what the registry came from: %+v", n)
-	}
-	file, err := n.File()
-	if err != nil || !strings.Contains(file, "//127.0.0.1:3100/api/packages/novox/npm/:username=mesh-builder") {
-		t.Fatalf("the .npmrc is not written from the genesis document: %v\n%s", err, file)
-	}
-	if got := saysRegistry(n); !strings.Contains(got, "genesis document") {
-		t.Errorf("the log does not say the genesis document: %s", got)
-	}
-}
-
-func TestARealBindingWinsOverTheGenesisDocument(t *testing.T) {
-	registryFiles(t, aBinding, "bound-secret\n", aGenesisDocument)
-	n, err := packagesFrom("anchor")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if n.From != builder.FromBinding || n.Registry != "http://anchor.mesh:3000/api/packages/novox/npm/" ||
-		n.Username != "anchor-agent" || n.Password != "bound-secret" {
-		t.Fatalf("the binding did not win over the genesis document: %+v", n)
-	}
-	if got := saysRegistry(n); !strings.Contains(got, "binding") {
-		t.Errorf("the log does not say the binding: %s", got)
-	}
-}
-
-func TestWithNeitherTheAgentHasNoRegistryAndSaysWhere(t *testing.T) {
-	registryFiles(t, "", "", "")
-	n, err := packagesFrom("workstation")
-	if err != nil {
-		t.Fatalf("an unbound optional requirement was a fault: %v", err)
-	}
-	if n.Enabled() || n.Machine != "workstation" {
-		t.Fatalf("a registry came from nowhere: %+v", n)
-	}
-	got := saysRegistry(n)
-	for _, want := range []string{"npm-package-registry", "unbound", "workstation"} {
-		if !strings.Contains(got, want) {
-			t.Errorf("the log does not say %q: %s", want, got)
-		}
-	}
-}
-
-func TestAGenesisDocumentMissingAFieldIsRefusedByName(t *testing.T) {
-	registryFiles(t, "", "", `{"at":"127.0.0.1","port":3000,"npm-path":"/api/packages/novox/npm/","as":"mesh-builder"}`)
-	if _, err := packagesFrom("anchor"); err == nil || !strings.Contains(err.Error(), "password") {
-		t.Fatalf("a genesis document with no password was taken: %v", err)
-	}
-}

cmd/mesh-builder/ready.go

@@ -1,44 +0,0 @@
-package main
-
-import (
-	"errors"
-	"fmt"
-	"os"
-	"path/filepath"
-)
-
-// **The build agent says it is ready** (novox/hq issue 544). It listens on nothing, so no http or tcp
-// check can see it work; it writes a mark once it is bound to its worker and pulls build work, and its
-// container's health check runs `mesh-builder ready`, which passes only while the mark is there. Without
-// it the node-engine could judge the agent only alive, and every walk that moved it waited out the whole
-// grace on each machine.
-//
-// The mark lives in the container's own temporary directory, never in the workspace the machine keeps:
-// a new container starts without it, and a restarted one removes it before it binds again.
-func readyMark() string { return filepath.Join(os.TempDir(), "mesh-builder.ready") }
-
-// notReady removes the mark: a holder starting is not taking work until it says so again.
-func notReady() error {
-	if err := os.Remove(readyMark()); err != nil && !errors.Is(err, os.ErrNotExist) {
-		return fmt.Errorf("cannot remove the mark that this agent takes build work (%s): %w", readyMark(), err)
-	}
-	return nil
-}
-
-// taking writes the mark. A mark that cannot be written is said, and the agent goes on building: its
-// check then says it is not ready, which is the truth the gate should hear.
-func taking(seat string) {
-	if err := os.WriteFile(readyMark(), []byte(seat+"\n"), 0o644); err != nil {
-		fmt.Fprintf(os.Stderr, "cannot mark that this agent takes build work (%s): %v\n", readyMark(), err)
-		return
-	}
-	fmt.Fprintf(os.Stderr, "taking build work from %s\n", seat)
-}
-
-// ready is the health check: nil when this container's agent is bound and pulling build work.
-func ready() error {
-	if _, err := os.Stat(readyMark()); err != nil {
-		return fmt.Errorf("not taking build work yet: %s is not there", readyMark())
-	}
-	return nil
-}

cmd/mesh-builder/ready_test.go

@@ -1,32 +0,0 @@
-package main
-
-import (
-	"os"
-	"testing"
-)
-
-// The health check passes only between the agent saying it takes work and its next start (novox/hq
-// issue 544).
-func TestTheAgentIsReadyOnlyOnceItTakesWork(t *testing.T) {
-	t.Setenv("TMPDIR", t.TempDir())
-	if err := ready(); err == nil {
-		t.Fatal("an agent that never took work is ready")
-	}
-	taking("mesh-build-machine")
-	if err := ready(); err != nil {
-		t.Fatalf("an agent taking work is not ready: %v", err)
-	}
-	// Started again, it is not ready until it binds again.
-	if err := notReady(); err != nil {
-		t.Fatal(err)
-	}
-	if err := ready(); err == nil {
-		t.Fatal("an agent starting again is ready before it takes work")
-	}
-	if err := notReady(); err != nil {
-		t.Fatalf("removing a mark that is not there failed: %v", err)
-	}
-	if _, err := os.Stat(readyMark()); err == nil {
-		t.Fatal("the mark is still there")
-	}
-}

cmd/mesh-builder/seat_test.go

@@ -1,27 +0,0 @@
-package main
-
-import (
-	"encoding/json"
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// The seat a build machine serves comes from its credential (novox/hq ADR 0190 handover).
-func TestTheCredentialSaysWhichBuildRoleThisMachineServes(t *testing.T) {
-	var held Credential
-	if err := json.Unmarshal([]byte(`{"url":"nats://bus:4222","user":"anchor.builder","password":"x",
-		"claims":[{"seat":"mesh-build-machine","scope":"mesh","serves":[]}]}`), &held); err != nil {
-		t.Fatal(err)
-	}
-	if got := link.BuildSeatClaimed(held.seatsClaimed()); got != "mesh-build-machine" {
-		t.Errorf("the old builder's credential serves %q", got)
-	}
-	var bare Credential
-	if err := json.Unmarshal([]byte(`{"url":"nats://bus:4222","user":"anchor.build-agent","password":"x"}`), &bare); err != nil {
-		t.Fatal(err)
-	}
-	if got := link.BuildSeatClaimed(bare.seatsClaimed()); got != link.TheBuildMachine {
-		t.Errorf("a credential without claims serves %q, want %s", got, link.TheBuildMachine)
-	}
-}

cmd/mesh-builder/stdout_test.go

@@ -1,45 +0,0 @@
-package main
-
-import (
-	"os"
-	"strings"
-	"testing"
-)
-
-// **The genesis path writes its result to stdout and nothing else there.** The installer captures
-// stdout alone and parses it as JSON; one stray log line makes that fail with "invalid character"
-// — exactly what a builder fmt.Printf caused, breaking a build that had worked. This keeps
-// diagnostics on stderr so a future print cannot repeat it silently.
-func TestBuilderDiagnosticsStayOffStdout(t *testing.T) {
-	allowed := map[string]bool{
-		"string(body)": true, // once.go: the result JSON, which IS stdout
-		"version)":     true, // --version
-		`"stopping")`:  true, // the loop.s shutdown line
-		"usage)":       true, // --help text, for a human
-		"said)":        true, // busy: the answer its node-engine reads (novox/hq ADR 0335)
-	}
-	for _, file := range []string{"once.go", "main.go"} {
-		src, err := os.ReadFile(file)
-		if err != nil {
-			t.Fatal(err)
-		}
-		for i, raw := range strings.Split(string(src), "\n") {
-			line := strings.TrimSpace(raw)
-			if !strings.HasPrefix(line, "fmt.Printf(") &&
-				!strings.HasPrefix(line, "fmt.Println(") &&
-				!strings.HasPrefix(line, "fmt.Print(") {
-				continue
-			}
-			ok := false
-			for token := range allowed {
-				if strings.Contains(line, token) {
-					ok = true
-				}
-			}
-			if !ok {
-				t.Errorf("%s:%d writes a diagnostic to stdout, which the installer parses as JSON:\n  %s",
-					file, i+1, line)
-			}
-		}
-	}
-}

cmd/mesh-builder/tried_test.go

@@ -1,31 +0,0 @@
-package main
-
-import (
-	"testing"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/builder"
-)
-
-// A try's outcome, as the build seat says it in the build's log (novox/hq issue 686): the repository's own
-// check's verdict, how long it took, and each line naming what failed.
-func TestATrysOutcomeNamesWhatFailed(t *testing.T) {
-	tried := triedOf(builder.CheckVerdict{Verdict: "pass", Summary: "the change touches no module", Took: 303 * time.Second,
-		Head: "c0ffee", Trunk: "ca3f43c", Gate: &builder.Layer{Verdict: "pass"},
-		Repo: &builder.Layer{Verdict: "fail", Summary: "its merge-check.sh failed: TestX",
-			Failed: "--- FAIL: TestX (0.01s)\n    x_test.go:12: got 1, want 2"}})
-	if tried.Verdict != "fail" || tried.Took != "5m3s" || len(tried.Failed) != 2 || tried.Trunk != "ca3f43c" ||
-		tried.Summary != "its merge-check.sh failed: TestX" {
-		t.Fatalf("a failed try: %+v", tried)
-	}
-	// A head that does not merge fails both layers: the check's own word.
-	conflict := triedOf(builder.CheckVerdict{Verdict: "fail", Summary: "does not merge", Gate: &builder.Layer{Verdict: "fail"},
-		Repo: &builder.Layer{Verdict: "fail", Summary: "does not merge"}})
-	if conflict.Verdict != "fail" || conflict.Summary != "does not merge" {
-		t.Fatalf("a try that does not merge: %+v", conflict)
-	}
-	// No verdict is an error, never a pass.
-	if none := triedOf(builder.CheckVerdict{}); none.Verdict != "error" {
-		t.Fatalf("a try with no verdict: %+v", none)
-	}
-}

cmd/mesh-builder/where_test.go

@@ -1,225 +0,0 @@
-package main
-
-import (
-	"crypto/ed25519"
-	"crypto/rand"
-	"crypto/sha256"
-	"crypto/tls"
-	"crypto/x509"
-	"crypto/x509/pkix"
-	"encoding/hex"
-	"math/big"
-	"net"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/broker"
-)
-
-// Where a builder publishes.
-//
-// Preferably from the mesh: a builder that is a module requires an artifact store, and the mesh
-// writes it a binding saying which machine answers and on what port. Reading it means the address
-// is not a setting somebody keeps in step by hand.
-
-func binding(t *testing.T, body string) string {
-	t.Helper()
-	path := filepath.Join(t.TempDir(), "artifact-store.json")
-	if err := os.WriteFile(path, []byte(body), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	return path
-}
-
-func TestTheMeshSaysWhereToPublish(t *testing.T) {
-	t.Setenv("MESH_BINDING", binding(t, `{"binding":1,"provision":"artifact-store",
-		"from":"anchor","at":"anchor.internal","serves":{"port":5000,"scheme":"http"}}`))
-	where, err := whereToPublish()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if where != "anchor.internal:5000" {
-		t.Fatalf("got %q", where)
-	}
-}
-
-func TestABindingWithNoAddressIsRefused(t *testing.T) {
-	// The provider is not on the private network, so there is no name to reach it by. Falling
-	// back to anything would publish to a store on the wrong machine and be found out much later.
-	t.Setenv("MESH_BINDING", binding(t, `{"binding":1,"from":"anchor","serves":{"port":5000}}`))
-	_, err := whereToPublish()
-	if err == nil {
-		t.Fatal("a binding with nowhere to reach was accepted")
-	}
-	if !strings.Contains(err.Error(), "anchor") {
-		t.Fatalf("the failure does not name the machine: %v", err)
-	}
-}
-
-func TestABindingWithNoPortIsRefused(t *testing.T) {
-	t.Setenv("MESH_BINDING", binding(t, `{"binding":1,"from":"a","at":"a.internal","serves":{}}`))
-	if _, err := whereToPublish(); err == nil {
-		t.Fatal("a binding saying nothing about a port was accepted")
-	}
-}
-
-func TestTheVariableStillWorksForABuilderRunByAPerson(t *testing.T) {
-	// Which is how this started and how it is still run while being developed.
-	t.Setenv("MESH_BINDING", "")
-	t.Setenv("MESH_REGISTRY", "127.0.0.1:5000")
-	where, err := whereToPublish()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if where != "127.0.0.1:5000" {
-		t.Fatalf("got %q", where)
-	}
-}
-
-func TestNeitherIsRefusedRatherThanGuessed(t *testing.T) {
-	t.Setenv("MESH_BINDING", "")
-	t.Setenv("MESH_REGISTRY", "")
-	if _, err := whereToPublish(); err == nil {
-		t.Fatal("a builder with nowhere to publish reported somewhere")
-	}
-}
-
-func TestTheCredentialComesFromAFileTheMeshSealed(t *testing.T) {
-	// A builder that is a module is given its credential the way every module is: sealed to the
-	// machine and written by the host. An environment variable instead would put the one copy
-	// that matters through a terminal and a process listing.
-	path := filepath.Join(t.TempDir(), "broker")
-	if err := os.WriteFile(path, []byte("amqps://a-builder:secret@broker.internal:5671/\n"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	t.Setenv("MESH_BROKER_FILE", path)
-	t.Setenv("MESH_BROKER_AMQP", "amqp://should-not-be-used@nowhere/")
-
-	got, err := brokerFrom()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got.URL != "amqps://a-builder:secret@broker.internal:5671/" {
-		t.Fatalf("got %q", got.URL)
-	}
-}
-
-// The credential the mesh seals carries what to check the broker's certificate against, because a
-// mesh's broker presents a certificate of the mesh's own and no public trust store has it. A URL
-// alone can only reach a broker somebody else vouches for.
-func TestTheSealedCredentialCarriesWhatVerifiesTheBroker(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "broker")
-	if err := os.WriteFile(path, []byte(
-		`{"url":"amqps://a-builder:secret@broker.internal:5671/","fingerprint":"abc123"}`),
-		0o600); err != nil {
-		t.Fatal(err)
-	}
-	t.Setenv("MESH_BROKER_FILE", path)
-	t.Setenv("MESH_BROKER_AMQP", "")
-
-	got, err := brokerFrom()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got.URL != "amqps://a-builder:secret@broker.internal:5671/" {
-		t.Fatalf("the url was lost: %q", got.URL)
-	}
-	if got.Fingerprint != "abc123" {
-		t.Fatal("the builder was given nothing to check the broker against, so it can only " +
-			"connect to a broker some public authority vouches for")
-	}
-}
-
-func TestAnEmptyCredentialFileIsRefused(t *testing.T) {
-	// Otherwise the builder connects as nobody and is refused, with the reason three layers away.
-	path := filepath.Join(t.TempDir(), "broker")
-	if err := os.WriteFile(path, []byte("\n"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	t.Setenv("MESH_BROKER_FILE", path)
-	t.Setenv("MESH_BROKER_AMQP", "")
-	if _, err := brokerFrom(); err == nil {
-		t.Fatal("an empty credential was accepted")
-	}
-}
-
-func TestABuilderWithNoCredentialAtAllSaysSo(t *testing.T) {
-	t.Setenv("MESH_BROKER_FILE", "")
-	t.Setenv("MESH_BROKER_AMQP", "")
-	if _, err := brokerFrom(); err == nil {
-		t.Fatal("a builder with no broker reported one")
-	}
-}
-
-// The pin is compared in the spelling the mesh writes it.
-//
-// A bare digest against a written fingerprint never matches, and the failure is indistinguishable
-// from being pointed at the wrong broker — which is the one thing this check exists to report
-// truthfully. It cost a lab run.
-func TestThePinIsComparedInTheSpellingTheMeshWritesIt(t *testing.T) {
-	certificate, key := aServerCertificate(t)
-	der := certificate.Certificate[0]
-	sum := sha256.Sum256(der)
-	written := "sha256:" + hex.EncodeToString(sum[:])
-
-	listener, err := tls.Listen("tcp", "127.0.0.1:0", &tls.Config{
-		Certificates: []tls.Certificate{certificate}, MinVersion: tls.VersionTLS12,
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer listener.Close()
-	go func() {
-		for {
-			conn, err := listener.Accept()
-			if err != nil {
-				return
-			}
-			_ = conn.(*tls.Conn).Handshake()
-			conn.Close()
-		}
-	}()
-	_ = key
-
-	// The pin the mesh wrote must be accepted.
-	if err := handshakeWith(listener.Addr().String(), written); err != nil {
-		t.Fatalf("the broker this builder was told about was refused: %v", err)
-	}
-	// And a different one refused, or the check reports nothing.
-	other := "sha256:" + strings.Repeat("ab", 32)
-	if err := handshakeWith(listener.Addr().String(), other); err == nil {
-		t.Fatal("a broker this builder was not told about was accepted")
-	}
-}
-
-// handshakeWith runs the pin check the builder dials with against an address.
-func handshakeWith(address, pin string) error {
-	conn, err := tls.Dial("tcp", address, broker.PinnedToFingerprint(pin))
-	if err != nil {
-		return err
-	}
-	return conn.Close()
-}
-
-func aServerCertificate(t *testing.T) (tls.Certificate, ed25519.PrivateKey) {
-	t.Helper()
-	public, private, err := ed25519.GenerateKey(rand.Reader)
-	if err != nil {
-		t.Fatal(err)
-	}
-	template := &x509.Certificate{
-		SerialNumber: big.NewInt(1),
-		Subject:      pkix.Name{CommonName: "a broker"},
-		NotBefore:    time.Now().Add(-time.Hour),
-		NotAfter:     time.Now().Add(time.Hour),
-		IPAddresses:  []net.IP{net.ParseIP("127.0.0.1")},
-	}
-	der, err := x509.CreateCertificate(rand.Reader, template, template, public, private)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return tls.Certificate{Certificate: [][]byte{der}, PrivateKey: private}, private
-}

cmd/mesh-controller/accept_outside.go

@@ -6,7 +6,7 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
@@ -55,6 +55,8 @@ func offeredOutsideBy(ctx context.Context, provision string) (string, error) {
 // its next send would, and the machines that could not be resolved, with why.
 func consumersFrom(ctx context.Context, open *stores, provider, providerModule, provision string) (
 	[]inventory.PairEnd, []string, error) {
+	// One reading of the mesh for every machine this looks at.
+	ctx = withInputCache(ctx)
 	nodes, err := open.inventory.Nodes(ctx)
 	if err != nil {
 		return nil, nil, err
@@ -62,7 +64,7 @@ func consumersFrom(ctx context.Context, open *stores, provider, providerModule,
 	var out []inventory.PairEnd
 	var unresolved []string
 	for _, n := range nodes {
-		plan, _, err := planFor(ctx, open, n.Name)
+		plan, _, err := resolveNode(ctx, open, n.Name)
 		if err != nil {
 			unresolved = append(unresolved, fmt.Sprintf("%s: %s", n.Name, oneLine(err.Error())))
 			continue
@@ -110,11 +112,13 @@ func acceptForProvision(ctx context.Context, provider, providerModule, provision
 	if len(accepted.Sealed) == 0 {
 		return nil
 	}
-	if err := sendTo(ctx, open, accepted.Machines); err != nil {
-		return fmt.Errorf("%s is sealed and could not be sent: %w; `push %s` sends it", provision, err,
-			strings.Join(accepted.Machines, "`, `push "))
+	// Composed into each consumer's composition (novox/hq ADR 0539 clause 5): a new revision its want then names.
+	if _, err := composeModules(ctx, open, accepted.Machines); err != nil {
+		return fmt.Errorf("%s is sealed and its compositions on %s could not be written: %w", provision,
+			strings.Join(accepted.Machines, ", "), err)
 	}
-	fmt.Printf("  sent %s; each consumer starts again on it\n", strings.Join(accepted.Machines, ", "))
+	fmt.Printf("  composed for %s; each consumer starts again on it once its want names the new composition\n",
+		strings.Join(accepted.Machines, ", "))
 	return nil
 }
 

cmd/mesh-controller/acts.go

@@ -10,7 +10,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
@@ -58,13 +58,6 @@ func assignWith(ctx context.Context, open *stores, node string, opts assignOptio
 	// Every line of the answer comes from the one resolution after the write (novox/hq issue 237):
 	// what the reads before it would say about a machine left out is not the answer's.
 	ctx = leftOutSaidBy(ctx, io.Discard)
-	// Held while it is recorded, so it cannot land between a converge's preview and its flip and
-	// be taken without ever having been previewed (novox/hq ADR 0100).
-	ctx, release, err := holdNodes(ctx, open, []string{node})
-	if err != nil {
-		return "", err
-	}
-	defer release()
 	// **A module the catalogue does not hold is looked for further before it is refused** (novox/hq issue
 	// 325): a build in flight keeps the assignment pending, a module known and not built is said with how to
 	// build it, and only a name the mesh never heard of is refused as unknown. Several modules in one act
@@ -171,8 +164,21 @@ func assignWith(ctx context.Context, open *stores, node string, opts assignOptio
 			answer += "\n  but " + catalogue.WrongMachine(u.Module, c, node)
 		}
 	}
-	return answer + fmt.Sprintf("\n  run `push %s` to send it", node) +
-		blockedElsewhere(ctx, open, node), nil
+	return answer + composedAfterAct(ctx, open, node) + blockedElsewhere(ctx, open, node), nil
+}
+
+// composedAfterAct composes the node an assignment or its end changed (novox/hq ADR 0539 clause 5): what the
+// answer says of it. The assigner then writes the node's wants by its rules; nothing is sent.
+func composedAfterAct(ctx context.Context, open *stores, node string) string {
+	wrote, err := composeModules(ctx, open, []string{node})
+	if err != nil {
+		return fmt.Sprintf("\n  but its compositions on %s could not all be written: %v", node, firstLine(err.Error()))
+	}
+	if len(wrote[node]) == 0 {
+		return fmt.Sprintf("\n  %s's compositions were already as composed now", node)
+	}
+	return fmt.Sprintf("\n  composed for %s (%d composition(s) written): its wants follow by the assigner's rules", node,
+		len(wrote[node]))
 }
 
 // seatDependenciesOnAssign is the refusal ADR 0207 makes at assignment, or nothing, with the
@@ -231,11 +237,6 @@ func unassign(ctx context.Context, open *stores, node string, modules ...string)
 	}
 	// One resolution after the write, as assign's answer (novox/hq issue 237).
 	ctx = leftOutSaidBy(ctx, io.Discard)
-	ctx, release, err := holdNodes(ctx, open, []string{node})
-	if err != nil {
-		return "", err
-	}
-	defer release()
 	shelf, err := open.inventory.Catalogue(ctx)
 	if err != nil {
 		return "", err
@@ -273,8 +274,8 @@ func unassign(ctx context.Context, open *stores, node string, modules ...string)
 			return "", err
 		}
 	}
-	answer := fmt.Sprintf("%s no longer runs %s — run `push %s` to make it so",
-		node, strings.Join(modules, ", "), node)
+	answer := fmt.Sprintf("%s no longer runs %s: its want is written removed by the assigner",
+		node, strings.Join(modules, ", "))
 	after := resolvedAfter(ctx, open, shelf, node)
 	for _, line := range unheldChangeTo(shelf, node, assigned, after.modules, after.unheld) {
 		answer += "\n  " + line
@@ -295,7 +296,7 @@ func unassign(ctx context.Context, open *stores, node string, modules ...string)
 	for _, line := range keptOnUnassign(ctx, open.inventory, node, modules) {
 		answer += "\n  " + line
 	}
-	return answer + blockedElsewhere(ctx, open, node), nil
+	return answer + composedAfterAct(ctx, open, node) + blockedElsewhere(ctx, open, node), nil
 }
 
 // afterAct is the one resolution of a node an act's answer is said from, taken after its write
@@ -314,7 +315,7 @@ type afterAct struct {
 // after the write, which can only find more unmet than the closure would: a seat said held there is
 // held in the closure too.
 func resolvedAfter(ctx context.Context, open *stores, shelf map[string]catalogue.Manifest, node string) afterAct {
-	plan, _, err := planFor(ctx, open, node)
+	plan, _, err := resolveNode(ctx, open, node)
 	if err == nil {
 		out := afterAct{plan: plan, unheld: plan.Unheld}
 		for _, m := range plan.Modules {
@@ -355,6 +356,8 @@ func splitModules(field string) []string {
 // Nothing here can fail the act it reports on. A mesh that cannot be read is worth saying and is
 // not a reason to claim the assignment did not happen — it did.
 func blockedElsewhere(ctx context.Context, open *stores, except string) string {
+	// One reading of the mesh for every machine this looks at.
+	ctx = withInputCache(ctx)
 	nodes, err := open.inventory.Nodes(ctx)
 	if err != nil {
 		return "\n\nThe rest of the mesh could not be checked: " + err.Error()
@@ -364,7 +367,7 @@ func blockedElsewhere(ctx context.Context, open *stores, except string) string {
 		if n.Name == except {
 			continue
 		}
-		if _, _, err := planFor(ctx, open, n.Name); err != nil {
+		if _, _, err := resolveNode(ctx, open, n.Name); err != nil {
 			blocked[n.Name] = err.Error()
 		}
 	}
@@ -406,12 +409,21 @@ func issueOnAssign(ctx context.Context, open *stores, node, module string) strin
 		return ""
 	}
 	user := broker.Principal{Kind: broker.KindModule, Node: node, Module: module}.Username()
-	if _, reads := m.OwnSecrets["broker"]; !reads {
+	_, reads := m.OwnSecrets["broker"]
+	if !reads && !runsTheProvisionerClient(m) {
+		// A module whose bus accounts are its processes' alone has none of its own: only the processes that
+		// are not issued yet are issued (issue 1226).
+		return processAccountsOnAssign(ctx, inv, m, node)
+	}
+	if !reads {
 		// A module running the provisioner client alone is minted the client's account (issue 917).
 		user = broker.Principal{Kind: broker.KindProvisioner, Node: node, Module: module}.Username()
 	}
-	if _, minted, err := inv.BusUserHash(ctx, user); err != nil || minted {
+	if _, minted, err := inv.BusUserHash(ctx, user); err != nil {
 		return ""
+	} else if minted {
+		// Its own account stands and is kept; a process it gained is not issued yet (issue 1226).
+		return processAccountsOnAssign(ctx, inv, m, node)
 	}
 	busAddress, err := broker.BusAddress()
 	if err == nil {
@@ -424,6 +436,16 @@ func issueOnAssign(ctx context.Context, open *stores, node, module string) strin
 	return fmt.Sprintf("its bus credential is issued and sealed to %s, and arrives with the push", node)
 }
 
+// processAccountsOnAssign issues the process accounts of an assigned module not issued yet, and says what it did.
+func processAccountsOnAssign(ctx context.Context, inv *inventory.Inventory, m catalogue.Manifest, node string) string {
+	line, err := issueMissingProcessAccounts(ctx, inv, m, node)
+	if err != nil {
+		return fmt.Sprintf("its process accounts are not issued (%v): `module issue %s --node %s` first — "+
+			"`push %s` refuses to send %s until it is", err, m.Module, node, node, m.Module)
+	}
+	return line
+}
+
 // refusedMovingTheController refuses assigning or unassigning the controller's module through a verb (review of
 // novox/hq ADR 0272): the node it is assigned to is the control-node, and the control-node's operator account is
 // the controller's terminal, so whoever moves the module chooses the terminal. At the terminal alone, as every

cmd/mesh-controller/acts_test.go

@@ -6,7 +6,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // What an assignment says about the machines it was not about.

cmd/mesh-controller/addresses_integration_test.go

@@ -8,7 +8,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/licences"
 )
@@ -221,8 +221,4 @@ func TestOnANodeWithNoNetworkTheStoreIsReachedByLoopback(t *testing.T) {
 	if image != "127.0.0.1:5100/postgres/runtime@"+aDigest {
 		t.Fatalf("on the store's own node, off any network, the image is fetched as %v", image)
 	}
-	held := heldBy(ctx)
-	if got := held["postgres/runtime"]; got != "127.0.0.1:5100/postgres/runtime@"+aDigest {
-		t.Fatalf("a builder beside the store is handed the base %q", got)
-	}
 }

cmd/mesh-controller/addresses_test.go

@@ -1,12 +1,9 @@
 package main
 
 import (
-	"encoding/json"
 	"strings"
-	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
-	"github.com/novox/mesh-controller/internal/link"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // An address is read from the node's settings where it is used, never recorded with a port
@@ -14,62 +11,6 @@ import (
 
 var aDigest = "sha256:" + strings.Repeat("e", 64)
 
-// **A build is recorded by digest and path**, whatever address the builder pushed to — what it
-// made and what it stood on both; an image the module runs from elsewhere is left where it says.
-func TestABuildIsRecordedWithoutTheStoresAddress(t *testing.T) {
-	manifest, _ := json.Marshal(map[string]any{
-		"module": "gitea", "version": "1",
-		"resources": []map[string]any{
-			{"id": "server", "type": "container", "name": "mesh-gitea",
-				"image": "anchor.internal:5100/gitea/server@" + aDigest},
-			{"id": "config", "type": "archive", "path": "/etc/gitea", "digest": aDigest,
-				"source": "http://anchor.internal:5100/v2/gitea/config/blobs/" + aDigest},
-			{"id": "cache", "type": "container", "name": "mesh-gitea-cache",
-				"image": "valkey/valkey@" + aDigest},
-		},
-	})
-	kept := buildFrom(link.BuildResult{
-		ID: "b1", Repository: "https://forge.example/gitea.git", Commit: "abc", On: "laptop",
-		Manifest: manifest,
-		Made: []link.MadeArtifact{
-			{Name: "server", Kind: "image", Reference: "anchor.internal:5100/gitea/server@" + aDigest},
-			{Name: "config", Kind: "archive", Reference: "http://anchor.internal:5100/v2/gitea/config/blobs/" + aDigest},
-		},
-		Against: []string{"anchor.internal:5100/mesh-tools/runtime@" + aDigest},
-	})
-	if kept.Module != "gitea" {
-		t.Fatalf("the module was not read from the recorded manifest: %q", kept.Module)
-	}
-	if kept.Made[0].Reference != catalogue.ArtifactStoreScheme+"gitea/server@"+aDigest {
-		t.Errorf("the image is recorded as %q, address and all", kept.Made[0].Reference)
-	}
-	if kept.Made[1].Reference != catalogue.ArtifactStoreScheme+"gitea/config/blobs/"+aDigest {
-		t.Errorf("the archive is recorded as %q, address and all", kept.Made[1].Reference)
-	}
-	recorded, err := catalogue.ParseManifest(kept.Manifest)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got := recorded.Resources[0]["image"]; got != catalogue.ArtifactStoreScheme+"gitea/server@"+aDigest {
-		t.Errorf("the recorded manifest's image is %v", got)
-	}
-	if got := recorded.Resources[1]["source"]; got != catalogue.ArtifactStoreScheme+"gitea/config/blobs/"+aDigest {
-		t.Errorf("the recorded manifest's archive is %v", got)
-	}
-	if got := recorded.Resources[2]["image"]; got != "valkey/valkey@"+aDigest {
-		t.Errorf("an image the build did not make was rewritten: %v", got)
-	}
-	if strings.Contains(string(kept.Manifest), "anchor.internal:5100") {
-		t.Errorf("the recorded manifest still carries the store's address:\n%s", kept.Manifest)
-	}
-	// What the build stood on is an edge to another module's artifact, and it is recorded the way
-	// that artifact is: by path in the store, so the edge still names the same thing when the
-	// store answers at another address.
-	if kept.Against[0] != catalogue.ArtifactStoreScheme+"mesh-tools/runtime@"+aDigest {
-		t.Errorf("what the build stood on was recorded by address: %v", kept.Against)
-	}
-}
-
 // aStore is a module offering the artifact store on 5000, published the long way as the
 // distribution module does, so a node may be given another number for it.
 func aStore() catalogue.Manifest {

cmd/mesh-controller/adopting_test.go

@@ -6,16 +6,20 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
+	"github.com/nats-io/nats.go/jetstream"
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/testbus"
 	"net/http"
 	"reflect"
 	"strings"
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/overlay"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
-	"github.com/novox/mesh-controller/internal/overlay"
 )
 
 // novox/hq ADR 0100: taking a module is its cutover; converging a node is one act, previewed, and
@@ -50,6 +54,7 @@ func anAdoptedAnchor(t *testing.T) (*stores, *[]string) {
 			t.Fatal(err)
 		}
 	}
+	onTheBusWithItsHaves(t, open)
 	sent := &[]string{}
 	saved := sendNodes
 	sendNodes = func(_ context.Context, _ *stores, names []string) error {
@@ -83,13 +88,6 @@ func reportsReaching(t *testing.T, open *stores, reachable []link.Reach, held ..
 	if err != nil {
 		t.Fatal(err)
 	}
-	record, err := open.inventory.NodeByName(ctx, "anchor")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := open.inventory.RecordSent(ctx, record.ID, digestOf(body), nil); err != nil {
-		t.Fatal(err)
-	}
 	if _, err := (link.Enrolment{Inventory: open.inventory}).Heard(ctx, link.Report{
 		Node: "anchor", Applied: []string{"hello-web.x"}, Declared: digestOf(body),
 		Firewall: "ufw", Held: held, Reachable: reachable,
@@ -178,7 +176,7 @@ func TestTakingNamesWhatItReplaces(t *testing.T) {
 		t.Fatal(err)
 	}
 	if !strings.Contains(said, "container hello-web (hello-web.server)") ||
-		!strings.Contains(said, "push anchor") {
+		!strings.Contains(said, "compositions of anchor are written") {
 		t.Fatalf("taking did not say what it replaces and what to run:\n%s", said)
 	}
 }
@@ -250,6 +248,7 @@ func TestConvergingPreviewsThenChangesAndAdoptingKeepsWhatWasTaken(t *testing.T)
 	if _, err := take(ctx, open, "anchor", "hello-web", takeOptions{Yes: true}); err != nil {
 		t.Fatal(err)
 	}
+	*sent = nil // the take composed the node; what follows is judged from here
 	reportsHolding(t, open, heldFile)
 
 	preview, err := converge(ctx, open, "anchor", false, "", "")
@@ -438,6 +437,7 @@ func TestTheFlipActsOnlyOnThePreviewTheOperatorSaw(t *testing.T) {
 	if _, err := take(ctx, open, "anchor", "hello-web", takeOptions{Yes: true}); err != nil {
 		t.Fatal(err)
 	}
+	*sent = nil // the take composed the node; what follows is judged from here
 	reportsHolding(t, open, heldFile)
 	preview, err := converge(ctx, open, "anchor", false, "", "")
 	if err != nil {
@@ -495,52 +495,6 @@ func TestTheFlipActsOnlyOnThePreviewTheOperatorSaw(t *testing.T) {
 	}
 }
 
-// The flip holds the node from its checks to its send, so a push composed meanwhile waits and is
-// composed after it — never sent after it with the node still adopted. And the send inside the
-// flip is not made to wait on the flip's own hold.
-func TestTheFlipHoldsTheNodeWhileItSends(t *testing.T) {
-	open, _ := anAdoptedAnchor(t)
-	ctx := t.Context()
-	if _, err := take(ctx, open, "anchor", "hello-web", takeOptions{Yes: true}); err != nil {
-		t.Fatal(err)
-	}
-	reportsHolding(t, open, heldFile)
-	preview, err := converge(ctx, open, "anchor", false, "", "")
-	if err != nil {
-		t.Fatal(err)
-	}
-	var heldElsewhere, heldHere error
-	sendNodes = func(inner context.Context, open *stores, names []string) error {
-		// Another caller cannot hold the node while the flip sends it.
-		waiting, cancel := context.WithTimeout(ctx, 300*time.Millisecond)
-		defer cancel()
-		if release, err := open.inventory.HoldNodes(waiting, names); err == nil {
-			release()
-			heldElsewhere = errors.New("another caller held the node while the flip sent it")
-		}
-		// The flip's own send holds it without waiting on itself.
-		_, release, err := holdNodes(inner, open, names)
-		if err != nil {
-			heldHere = err
-			return err
-		}
-		release()
-		return nil
-	}
-	if _, err := converge(ctx, open, "anchor", true, digestIn(t, preview), ""); err != nil {
-		t.Fatal(err)
-	}
-	if heldElsewhere != nil || heldHere != nil {
-		t.Fatalf("%v %v", heldElsewhere, heldHere)
-	}
-	// And given back once it is done.
-	release, err := open.inventory.HoldNodes(ctx, []string{"anchor"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	release()
-}
-
 // novox/hq ADR 0103: the preview names every kind of thing a module the flip takes holds as found,
 // not only its files, and the digest changes when any of them does.
 func TestThePreviewNamesEveryHeldKind(t *testing.T) {
@@ -592,6 +546,7 @@ func TestTheFlipIsRefusedOnAnAccountNamingNothingReachable(t *testing.T) {
 	if _, err := take(ctx, open, "anchor", "hello-web", takeOptions{Yes: true}); err != nil {
 		t.Fatal(err)
 	}
+	*sent = nil // the take composed the node; what follows is judged from here
 	// Only a loopback listener: nothing off the machine, which is the same silence.
 	reportsReaching(t, open, []link.Reach{
 		{Protocol: "tcp", Address: "127.0.0.1", Port: 15672, By: "mesh-broker"},
@@ -612,32 +567,94 @@ func TestTheFlipIsRefusedOnAnAccountNamingNothingReachable(t *testing.T) {
 	}
 }
 
-// An assignment cannot land between a preview and the flip that takes every module: assigning
-// holds the node, so it waits for whatever is converging it.
-func TestAssigningWaitsForWhateverIsConvergingTheNode(t *testing.T) {
-	open, _ := anAdoptedAnchor(t)
+// onTheBusWithItsHaves gives the controller a bus that holds, for the anchor, a want and a have of its module that agree: the node
+// has everything wanted of it, as read from the haves (novox/hq ADR 0539 §9), so a flip is refused for what it is about and
+// not because the bus could not be read.
+func onTheBusWithItsHaves(t *testing.T, open *stores) {
+	t.Helper()
 	ctx := t.Context()
-	if _, err := take(ctx, open, "anchor", "hello-web", takeOptions{Yes: true}); err != nil {
-		t.Fatal(err)
-	}
-	reportsHolding(t, open, heldFile)
-	preview, err := converge(ctx, open, "anchor", false, "", "")
+	js, err := broker.Dial(testbus.URL(t))
 	if err != nil {
 		t.Fatal(err)
 	}
-	saved, savedPoll := inventory.HoldWaitFor, inventory.HoldPoll
-	inventory.HoldWaitFor, inventory.HoldPoll = time.Second, 50*time.Millisecond
-	defer func() { inventory.HoldWaitFor, inventory.HoldPoll = saved, savedPoll }()
-
-	var whileFlipping error
-	sendNodes = func(context.Context, *stores, []string) error {
-		_, whileFlipping = assign(ctx, open, "anchor", "notes")
-		return nil
-	}
-	if _, err := converge(ctx, open, "anchor", true, digestIn(t, preview), ""); err != nil {
+	t.Cleanup(js.Close)
+	servingBus.Store(js)
+	t.Cleanup(func() { servingBus.Store(nil) })
+	api, err := jetstream.New(js.Conn())
+	if err != nil {
 		t.Fatal(err)
 	}
-	if !errors.Is(whileFlipping, inventory.ErrNodeBusy) {
-		t.Fatalf("an assignment landed while the node was being converged: %v", whileFlipping)
+	fp := sdkdelivery.SourcePrefix2 + strings.Repeat("a", 64)
+	composed := "sha256:" + strings.Repeat("b", 64)
+	put := func(bucket, key string, value []byte) {
+		kv, err := api.CreateOrUpdateKeyValue(ctx, jetstream.KeyValueConfig{Bucket: bucket})
+		if err != nil {
+			t.Fatal(err)
+		}
+		if _, err := kv.Put(ctx, key, value); err != nil {
+			t.Fatal(err)
+		}
+	}
+	wantKey, err := sdkdelivery.WantKey("anchor", "hello-web")
+	if err != nil {
+		t.Fatal(err)
+	}
+	haveKey, err := sdkdelivery.HaveKey("anchor", "hello-web")
+	if err != nil {
+		t.Fatal(err)
+	}
+	want, err := sdkdelivery.EncodeWant(sdkdelivery.Want{FP: fp, Composed: composed})
+	if err != nil {
+		t.Fatal(err)
+	}
+	have, err := sdkdelivery.EncodeHave(sdkdelivery.Have{FP: fp, Composed: composed, Phase: sdkdelivery.PhaseRunning, Health: sdkdelivery.HealthOK})
+	if err != nil {
+		t.Fatal(err)
+	}
+	put(sdkdelivery.AssignerWantsBucket, wantKey, want)
+	put(sdkdelivery.HaveBucket, haveKey, have)
+}
+
+// **When the bus cannot be read, whether the machine runs what is wanted is not known, and the flip says exactly that** (issue
+// 1945): not "push", and not "has not reported".
+func TestTheFlipIsRefusedWithTheBusUnreachableSayingItCannotTell(t *testing.T) {
+	open, sent := anAdoptedAnchor(t)
+	reportsHolding(t, open, heldContainer, heldFile)
+	servingBus.Store(nil) // this process has no bus now, and no address to dial
+	_, err := converge(t.Context(), open, "anchor", true, "", "")
+	if err == nil || !strings.Contains(err.Error(), "cannot tell whether anchor runs what is wanted: the bus is not reachable") ||
+		strings.Contains(err.Error(), "push") {
+		t.Fatalf("the flip with the bus out of reach: %v", err)
+	}
+	if len(*sent) != 0 {
+		t.Fatal("a refused flip sent something")
+	}
+}
+
+// **A take composes the node only when it is performed** (issue 1945): a preview, a take that names no digest and a take refused
+// for a changed preview compose nothing; the performed take composes the machine once, and says so.
+func TestATakeComposesTheNodeOnlyWhenItIsPerformed(t *testing.T) {
+	open, sent := anAdoptedAnchor(t)
+	ctx := t.Context()
+	reportsHolding(t, open, heldContainer, heldFile)
+	preview, err := take(ctx, open, "anchor", "hello-web", takeOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := take(ctx, open, "anchor", "hello-web", takeOptions{Yes: true}); err == nil {
+		t.Fatal("a take of a held module without the preview's digest was performed")
+	}
+	if _, err := take(ctx, open, "anchor", "hello-web", takeOptions{Yes: true, Digest: "not-the-digest"}); err == nil {
+		t.Fatal("a take naming another preview's digest was performed")
+	}
+	if len(*sent) != 0 {
+		t.Fatalf("a preview or a refused take composed %v", *sent)
+	}
+	said, err := take(ctx, open, "anchor", "hello-web", takeOptions{Yes: true, Digest: takeDigestIn(t, preview)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(*sent) != 1 || (*sent)[0] != "anchor" || !strings.Contains(said, "compositions of anchor are written") {
+		t.Fatalf("the performed take composed %v and said:\n%s", *sent, said)
 	}
 }

cmd/mesh-controller/adoption.go

@@ -12,9 +12,9 @@ import (
 	"strings"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/overlay"
 	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/overlay"
 )
 
 // A node is adopted or converged (novox/hq ADR 0100), and it is said to be adopted wherever the
@@ -205,9 +205,9 @@ func adoptedNodes(nodes []inventory.Node) []string {
 // The operator's acts on an adopted node (novox/hq ADR 0100). Called by the command line and the
 // command API alike, so a refusal is the same refusal in the same words at both (ADR 0035).
 
-// sendNodes sends the named machines what they should be now. A variable so a test can see what
-// an act would send without a broker.
-var sendNodes = sendTo
+// sendNodes composes the named machines as they should be now (novox/hq ADR 0539 clause 5): each node's want then
+// names what changed. A variable so a test can see what an act would compose without a broker.
+var sendNodes = composeAndSay
 
 // DefaultFilter is the module converging a node assigns to load the mesh's derived filter.
 const DefaultFilter = "nftables"
@@ -243,7 +243,7 @@ func take(ctx context.Context, open *stores, node, module string, opts takeOptio
 		return "", err
 	}
 	if !slices.Contains(assigned, module) {
-		if plan, _, err := planFor(ctx, open, node); err == nil {
+		if plan, _, err := resolveNode(ctx, open, node); err == nil {
 			if why, runs := plan.Because[module]; runs {
 				return "", fmt.Errorf("%w: %s runs on %s because %s — assign it to %s to take it",
 					inventory.ErrNotAssigned, module, node, why, node)
@@ -276,8 +276,8 @@ func take(ctx context.Context, open *stores, node, module string, opts takeOptio
 		// is still the machine: the same two refusals the flip makes.
 		if age := time.Since(c.reported.At); age > reportFreshFor {
 			return preview, fmt.Errorf("%s last said what it holds %s ago, and a take acts only on "+
-				"an account newer than %s: run `push %s --wait 2m`, then preview again",
-				node, age.Round(time.Second), reportFreshFor, node)
+				"an account newer than %s: wait for its next report, then preview again",
+				node, age.Round(time.Second), reportFreshFor)
 		}
 		if opts.Digest == "" {
 			return preview, fmt.Errorf("taking %s on %s acts on the preview you saw: name its digest, "+
@@ -294,9 +294,12 @@ func take(ctx context.Context, open *stores, node, module string, opts takeOptio
 	}
 	said := fmt.Sprintf("%s is taken on %s", module, node)
 	if holds {
-		said += "; the next push replaces what the node found and holds for it:\n" + preview
+		said += "; its next composition replaces what the node found and holds for it:\n" + preview
 	}
-	return said + fmt.Sprintf("\n  run `push %s` to cut it over", node), nil
+	if err := sendNodes(ctx, open, []string{node}); err != nil {
+		return said + "\n  and its compositions could not be written yet: the next act that composes them carries it", err
+	}
+	return said + fmt.Sprintf("\n  the compositions of %s are written; its wants then cut it over", node), nil
 }
 
 // comparison is everything a take puts beside what the module declares: the machine's account of
@@ -433,7 +436,7 @@ func comparisonOf(module string, c comparison, opts takeOptions) (preview string
 		fmt.Fprintf(&b, "  settings from %s: %s\n", layer.From, strings.Join(keys, ", "))
 	}
 	if c.settingsRefused != "" {
-		fmt.Fprintf(&b, "  SETTINGS DO NOT COMPOSE with the module's definition, so the push leaves it out: %s\n", c.settingsRefused)
+		fmt.Fprintf(&b, "  SETTINGS DO NOT COMPOSE with the module's definition, so the composition leaves it out: %s\n", c.settingsRefused)
 	}
 	preview = strings.TrimRight(b.String(), "\n")
 	sum := sha256.Sum256([]byte(preview))
@@ -608,16 +611,6 @@ func converge(ctx context.Context, open *stores, node string, yes bool, digest s
 	if filter == "" {
 		filter = DefaultFilter
 	}
-	if yes {
-		// Held from the checks to the send, so no push composed before the flip is sent after it
-		// and returns the node to adopted.
-		held, release, err := holdNodes(ctx, open, []string{node})
-		if err != nil {
-			return "", err
-		}
-		defer release()
-		ctx = held
-	}
 	record, err := inv.NodeByName(ctx, node)
 	if err != nil {
 		return "", err
@@ -625,31 +618,34 @@ func converge(ctx context.Context, open *stores, node string, yes bool, digest s
 	if !record.Adopted {
 		return "", fmt.Errorf("%s is converged already; there is nothing to flip", node)
 	}
-	reports, err := inv.LastReports(ctx)
+	reports, err := lastReports(ctx, inv)
 	if err != nil {
 		return "", err
 	}
-	current := false
+	current, unknown := false, false
 	for _, r := range reports {
 		if r.Node == node {
-			current = r.Current
+			current, unknown = r.Current, r.CurrentUnknown
 		}
 	}
+	if unknown {
+		return "", fmt.Errorf("cannot tell whether %s runs what is wanted: the bus is not reachable", node)
+	}
 	reported, err := inv.AdoptionOf(ctx, node)
 	if err != nil {
 		return "", err
 	}
 	if !current || reported.At.IsZero() {
-		return "", fmt.Errorf("%s has not reported on the declaration it was last sent, so what it "+
-			"says is reachable may not be the machine as it is: run `push %s --wait 2m` and "+
-			"converge once it has applied", node, node)
+		return "", fmt.Errorf("%s does not run everything that is wanted of it yet, or has not reported, so what it "+
+			"says is reachable may not be the machine as it is: converge once its haves match its wants and it has "+
+			"reported", node)
 	}
 
 	assignedWhenPreviewed, err := inv.Assigned(ctx, node)
 	if err != nil {
 		return "", err
 	}
-	plan, settings, err := planFor(ctx, open, node)
+	plan, _, err := resolveNode(ctx, open, node)
 	if err != nil {
 		return "", err
 	}
@@ -706,11 +702,8 @@ func converge(ctx context.Context, open *stores, node string, yes bool, digest s
 			filter)
 	}
 
-	gens, err := generators(ctx, open)
-	if err != nil {
-		return "", err
-	}
-	with, _, err := renderingFor(ctx, open, node, plan, settings, gens, Reading)
+	// What the filter is derived from: the rendering of this machine as a question reads it, with the private network.
+	with, err := renderingOf(ctx, open, node)
 	if err != nil {
 		return "", err
 	}
@@ -741,13 +734,13 @@ func converge(ctx context.Context, open *stores, node string, yes bool, digest s
 	if yes && countReachable(reported) == 0 {
 		return preview, fmt.Errorf("%s says nothing is reachable on it, which no machine that is "+
 			"up ever is: its account looks partial — whatever reads what is listening, or what "+
-			"the container runtime publishes, did not answer. Fix that on the machine and run "+
-			"`push %s --wait 2m`, then preview again", node, node)
+			"the container runtime publishes, did not answer. Fix that on the machine, wait for its next report, "+
+			"then preview again", node)
 	}
 	if age := time.Since(reported.At); age > reportFreshFor {
 		return preview, fmt.Errorf("%s last said what is reachable on it %s ago, and the flip acts "+
-			"only on an account newer than %s: wait for its next report, or run `push %s --wait 2m`, "+
-			"then preview again", node, age.Round(time.Second), reportFreshFor, node)
+			"only on an account newer than %s: wait for its next report, then preview again", node,
+			age.Round(time.Second), reportFreshFor)
 	}
 	if digest == "" {
 		return preview, fmt.Errorf("converging %s acts on the preview you saw: name its digest, "+
@@ -776,7 +769,7 @@ func converge(ctx context.Context, open *stores, node string, yes bool, digest s
 		if _, err := inv.Assign(ctx, node, filter); err != nil {
 			return "", err
 		}
-		if _, _, err := planFor(ctx, open, node); err != nil {
+		if _, _, err := resolveNode(ctx, open, node); err != nil {
 			_ = inv.Unassign(ctx, node, filter)
 			return "", fmt.Errorf("%s cannot run %s, so it was not converged: %w", node, filter, err)
 		}
@@ -790,7 +783,7 @@ func converge(ctx context.Context, open *stores, node string, yes bool, digest s
 		said += "; took " + strings.Join(took, ", ")
 	}
 	if err := sendNodes(ctx, open, []string{node}); err != nil {
-		return said + "\n  and it could not be sent: run `push " + node + "`", err
+		return said + "\n  and its compositions could not be written yet: the next act that composes them carries it", err
 	}
 	return said + "\n  sent: the host loads the mesh's filter and disables the firewall it found", nil
 }
@@ -1034,18 +1027,12 @@ func adopt(ctx context.Context, open *stores, node string) (string, error) {
 	if record.Adopted {
 		return "", fmt.Errorf("%s is adopted already", node)
 	}
-	held, release, err := holdNodes(ctx, open, []string{node})
-	if err != nil {
-		return "", err
-	}
-	defer release()
-	ctx = held
 	if err := inv.SetAdopted(ctx, node, true); err != nil {
 		return "", err
 	}
 	said := fmt.Sprintf("%s is adopted; what was taken on it stays taken", node)
 	if err := sendNodes(ctx, open, []string{node}); err != nil {
-		return said + "\n  and it could not be sent: run `push " + node + "`", err
+		return said + "\n  and its compositions could not be written yet: the next act that composes them carries it", err
 	}
 	return said + "\n  sent: the host unloads the mesh's filter and enables the firewall it found", nil
 }

cmd/mesh-controller/agent_account_integration_test.go

@@ -7,8 +7,8 @@ import (
 	"testing"
 	"time"
 
+	snapshot "git.novox.be/novox/mesh-sdk/go/facts"
 	"github.com/novox/mesh-controller/internal/conditions"
-	snapshot "github.com/novox/mesh-controller/internal/facts"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 	"github.com/novox/mesh-host/rootsearch"

cmd/mesh-controller/agent_account_test.go

@@ -5,7 +5,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"

cmd/mesh-controller/apply_failing.go

@@ -33,7 +33,7 @@ const packageManagerKey = "the package manager ("
 func watchApplyFailing(f *signalFacts) []conditions.Observation {
 	heard := map[string]bool{}
 	for _, m := range f.machines {
-		if !m.asleep() && !m.lastHeard.IsZero() && f.now.Sub(m.lastHeard) <= heartbeatBound(m.every) {
+		if !m.asleep() && !m.lastHeard.IsZero() && !m.silent(f.now) {
 			heard[m.name] = true
 		}
 	}

cmd/mesh-controller/asker.go

@@ -208,8 +208,11 @@ type asker struct {
 	// raise keeps the asker's own condition (sourceAsker): which conditions needing the operator could not be
 	// asked, and why. Nil raises nothing (a test that does not look).
 	raise func(ctx context.Context, obs []conditions.Observation) error
-	now   func() time.Time
-	logf  func(string, ...any)
+	// tell tells the operator one plain notice that needs no answer (operator-channel.tell, novox/hq ADR 0380):
+	// the refusal of an answer to a plan's ask (ADR 0449 §3). Nil tells nothing (a test that does not look).
+	tell func(ctx context.Context, headline string, lines []string) error
+	now  func() time.Time
+	logf func(string, ...any)
 
 	saidNoRouter bool
 	saidNoGrant  bool
@@ -406,7 +409,9 @@ func (a *asker) reconcile(ctx context.Context) error {
 	for _, r := range all {
 		k := partKey(r.Condition, r.Part)
 		if r.State == string(asks.OutcomeChosen) && now.Sub(r.Ended) < askAgainAfterAnswer {
-			answered[k] = r
+			if prior, has := answered[k]; !has || r.Ended.After(prior.Ended) {
+				answered[k] = r
+			}
 		}
 		if r.State == string(asks.OutcomeRefused) {
 			if prior, has := refused[k]; !has || r.Opened.After(prior.Opened) {
@@ -497,7 +502,9 @@ func (a *asker) reconcile(ctx context.Context) error {
 					continue // refused lately, and nothing it was refused for has changed: asked again after the wait
 				}
 			}
-			if r, done := answered[key]; done && sameAsked(r.Actions, p.actions) {
+			// **A condition raised after the answered ask ended is a new one** (novox/hq ADR 0449 §2): a retried
+			// plan that fails again is asked again, not held back for the hour its earlier answer holds.
+			if r, done := answered[key]; done && sameAsked(r.Actions, p.actions) && !c.Raised.After(r.Ended) {
 				if _, held := byCondition[key]; !held {
 					continue
 				}
@@ -636,6 +643,12 @@ func doesWords(act conditions.Action) string {
 		return "the delivery starts"
 	case act.Verb == broker.ControllerSeat+".plans" && act.Arguments["stop"] != "":
 		return "the delivery is stopped"
+	case act.Verb == broker.ControllerSeat+".plans" && act.Arguments["retry"] != "":
+		return "the failed builds are asked again"
+	case act.Verb == broker.ControllerSeat+".push" && act.Arguments["node"] != "":
+		return "the held builds are sent to " + act.Arguments["node"]
+	case act.Verb == broker.ControllerSeat+".upgrade" && act.Arguments["release-backlog"] != "":
+		return "the builds held after the failed delivery are released"
 	case strings.HasSuffix(act.Verb, ".restart"):
 		return "its service is restarted on " + act.Machine
 	}
@@ -884,6 +897,7 @@ func (a *asker) Decided(ctx context.Context, body []byte) error {
 	ended := a.now()
 	if acted != nil {
 		outcome = "failed: " + acted.Error()
+		a.tellRefused(ctx, *r, act, acted)
 	}
 	r.Ended, r.Acted = ended, outcome
 	if _, err := a.store.Change(ctx, r.ID, func(x *asked) bool {
@@ -918,6 +932,55 @@ func (a *asker) Decided(ctx context.Context, body []byte) error {
 	return nil
 }
 
+// tellRefused tells the operator what became of the answer they gave to a plan's ask, when it was not done (novox/hq
+// ADR 0449 §3): the controller's `plans` verb refuses a Retry, Start or Stop when the plan moved on between the ask and
+// the answer, and the refusal was only recorded, so the operator who pressed the answer heard nothing. **A refusal is
+// told as one, and nothing else is**: a verb that said no changed nothing, but a call that got no answer (a timeout, a
+// refused grant) may have run, and is told as not known. One plain notice with the ask's headline, beside the hand act
+// the caller still records. An answer to any other ask is not told here. A notice that cannot be told is said in the
+// log and changes nothing.
+func (a *asker) tellRefused(ctx context.Context, r asked, act conditions.Action, failure error) {
+	if a.tell == nil || act.Verb != broker.ControllerSeat+".plans" {
+		return
+	}
+	var lines []string
+	var refused verbRefused
+	if errors.As(failure, &refused) {
+		lines = []string{
+			fmt.Sprintf("Your answer, %s, could not be done: %s.", act.Label, strings.TrimRight(refusalWords(refused.words, act), ".")),
+			"Nothing was changed.",
+		}
+	} else {
+		lines = []string{
+			fmt.Sprintf("Your answer, %s, was given, and it is not known whether it was done.", act.Label),
+			"Look at the delivery before you answer again.",
+		}
+	}
+	if err := a.tell(ctx, r.Ask.Headline, lines); err != nil {
+		a.logf("the operator could NOT be told that %s was refused (ask %s): %v", act.Label, r.ID, err)
+	}
+}
+
+// refusalWords is a verb's refusal as the operator reads it: the plans named as "the plan" (plainRefusal), and, where
+// the words still carry an identifier the operator's channel withholds, one sentence of the answer's own.
+func refusalWords(words string, act conditions.Action) string {
+	return plainRefusalOr(words, refusalFallback(act))
+}
+
+// refusalFallback is what an answer's refusal says when its own words cannot be said: one sentence for each answer
+// to a plan's ask, never another answer's.
+func refusalFallback(act conditions.Action) string {
+	switch {
+	case act.Arguments["retry"] != "":
+		return "a retry would not run now; the details say why"
+	case act.Arguments["go"] != "":
+		return "the delivery could not be started now; the details say why"
+	case act.Arguments["stop"] != "":
+		return "the delivery could not be stopped now; the details say why"
+	}
+	return "the controller refused it; the details say why"
+}
+
 // handActWarrant is the verb an act the operator chose on a warrant is recorded under: a person's decision,
 // never a repair (handActVerbs).
 const handActWarrant = "warrant"

cmd/mesh-controller/asker_test.go

@@ -77,6 +77,15 @@ type askerRig struct {
 	silenced []string
 	acts     []link.HandAct
 	now      time.Time
+	// refuses, when set, is what every verb the asker calls answers; told is every notice the operator was told.
+	refuses error
+	told    []told
+}
+
+// told is one plain notice the asker told the operator.
+type told struct {
+	headline string
+	lines    []string
 }
 
 func newAskerRig(t *testing.T) *askerRig {
@@ -102,6 +111,10 @@ func newAskerRig(t *testing.T) *askerRig {
 		call: func(_ context.Context, a conditions.Action, args map[string]string) error {
 			raw, _ := json.Marshal(args)
 			r.called = append(r.called, a.Verb+"@"+a.Machine+" "+string(raw))
+			return r.refuses
+		},
+		tell: func(_ context.Context, headline string, lines []string) error {
+			r.told = append(r.told, told{headline, lines})
 			return nil
 		},
 		record: func(_ context.Context, act link.HandAct) error { r.acts = append(r.acts, act); return nil },
@@ -112,8 +125,15 @@ func newAskerRig(t *testing.T) *askerRig {
 }
 
 func heldCondition() conditions.Condition {
-	o := stalledObservations([]stalledLine{{ID: "novox/hq@055550802096", State: "held", For: "36h2m6s",
-		Bound: "24h0m0s", H2: "none: the state is the operator's"}})[0]
+	release := conditions.Action{Label: "Release", Verb: "mesh-delivery.release", Level: conditions.LevelApprove,
+		Arguments: map[string]string{"id": "novox/hq@055550802096", "why": ""}}
+	stop := conditions.Action{Label: "Stop", Verb: "mesh-delivery.stop", Level: conditions.LevelApprove,
+		Arguments: map[string]string{"id": "novox/hq@055550802096", "why": ""}}
+	o := conditions.Observation{Scope: conditions.ScopeDelivery, ID: "novox/hq@055550802096", Kind: "delivery-stalled",
+		Severity: conditions.Warning, Resolver: conditions.ResolverOperator,
+		Headline:    "Delivery of hq held for 36 hours",
+		Explanation: "A delivery of hq has been held for 36 hours, past its limit.",
+		Needs:       "release it, or stop it, " + FromMeshMCPServer, Actions: []conditions.Action{release, stop}}
 	return conditions.Condition{Key: o.Key(), Kind: o.Kind, Severity: conditions.Warning, Headline: o.Headline,
 		Explanation: conditions.Verdict(o.Needs, o.Explanation), Needs: o.Needs, Actions: o.Actions}
 }
@@ -286,35 +306,6 @@ func TestAWarrantThatIsNotForItsOwnAskIsRefused(t *testing.T) {
 	}
 }
 
-func TestEachAnswerCallsExactlyItsVerb(t *testing.T) {
-	plan := "plan-1791454185265004861"
-	waiting := conditions.Condition{Key: "plan." + plan + ".waiting", Severity: conditions.Urgent,
-		Headline: "openrazer delivery waiting to start", Needs: "start it, or stop it.",
-		Explanation: "Needs you: start it, or stop it.", Actions: waitingActions(plan, conditions.Urgent)}
-	module := conditions.Condition{Key: "module.openrazer.g14.unhealthy", Severity: conditions.Warning,
-		Headline: "openrazer not working on g14", Needs: "restart its service openrazer-daemon on g14.",
-		Explanation: "Needs you: restart it.", Actions: []conditions.Action{{Label: "Restart",
-			Verb: "node-service-manager.restart", Machine: "g14", Level: conditions.LevelApprove,
-			Arguments: map[string]string{"unit": "openrazer-daemon.service", "scope": "user"}}}}
-	for _, tc := range []struct {
-		c     conditions.Condition
-		label string
-		want  string
-	}{
-		{waiting, "Start", `mesh-controller.plans@ {"cause":"operator-answer","go":"` + plan + `","why":"`},
-		{waiting, "Stop", `mesh-controller.plans@ {"cause":"operator-answer","stop":"` + plan + `","why":"`},
-		{module, "Restart", `node-service-manager.restart@g14 {"scope":"user","unit":"openrazer-daemon.service"}`},
-	} {
-		r := newAskerRig(t)
-		r.open = []conditions.Condition{tc.c}
-		_ = r.a.reconcile(context.Background())
-		answerWith(t, r, r.warrantFor(t, tc.c.Key, tc.label))
-		if len(r.called) != 1 || !strings.HasPrefix(r.called[0], tc.want) {
-			t.Errorf("%s: called %v, want %s…", tc.label, r.called, tc.want)
-		}
-	}
-}
-
 func TestASilenceChosenIsTheControllersOwnAndAnAnswerToAnAsk(t *testing.T) {
 	r := newAskerRig(t)
 	r.open = []conditions.Condition{unitsCondition()}

cmd/mesh-controller/asker_wire.go

@@ -19,8 +19,8 @@ import (
 
 	"git.novox.be/novox/mesh-sdk/go/asks"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
@@ -135,6 +135,12 @@ func (b busAsked) All(ctx context.Context) ([]asked, error) {
 	return out, nil
 }
 
+// verbRefused is a verb's own refusal of an act: the seat answered, and said no. Any other error of callAction (a bus
+// that did not answer, a grant that is refused) is not one: the verb may have run.
+type verbRefused struct{ verb, words string }
+
+func (e verbRefused) Error() string { return e.verb + " refused: " + e.words }
+
 // callAction performs an action's verb as the controller, through the grant that names it.
 func callAction(conn *nats.Conn) func(ctx context.Context, a conditions.Action, args map[string]string) error {
 	return func(ctx context.Context, a conditions.Action, args map[string]string) error {
@@ -168,7 +174,23 @@ func callAction(conn *nats.Conn) func(ctx context.Context, a conditions.Action,
 			return err
 		}
 		if answer.Error != "" {
-			return fmt.Errorf("%s refused: %s", a.Verb, answer.Error)
+			return verbRefused{verb: a.Verb, words: answer.Error}
+		}
+		return nil
+	}
+}
+
+// tellThrough tells the operator one plain notice through the operator channel's `tell`, over the controller's own
+// connection and grant (novox/hq ADR 0380); a holder's refusal is an error naming it.
+func tellThrough(conn *nats.Conn) func(ctx context.Context, headline string, lines []string) error {
+	return func(ctx context.Context, headline string, lines []string) error {
+		answer, err := link.AskMeshSeatTool(ctx, conn, "operator-channel", "tell",
+			map[string]any{"headline": headline, "lines": lines}, tellWithin)
+		if err != nil {
+			return err
+		}
+		if answer.Error != "" {
+			return fmt.Errorf("operator-channel.tell refused: %s", answer.Error)
 		}
 		return nil
 	}
@@ -201,7 +223,7 @@ func routerRecordOf(conn *nats.Conn, inv *inventory.Inventory) func(ctx context.
 }
 
 // asksRecords is the bucket the asks seat's declarer keeps its record of asks in.
-func asksRecords(ctx context.Context, inv *inventory.Inventory) (string, error) {
+func asksRecords(ctx context.Context, inv catalogueReader) (string, error) {
 	declared, err := inv.Catalogue(ctx)
 	if err != nil {
 		return "", err
@@ -576,6 +598,7 @@ func servingAsker(open *stores, conn *nats.Conn, js jetstream.JetStream, keeper
 			_, err := link.RecordHandAct(ctx, conn, act)
 			return err
 		},
+		tell:         tellThrough(conn),
 		routerRecord: routerRecordOf(conn, open.inventory),
 		routerHere:   routerHereIn(open.inventory),
 		grantHeld:    grantHeldIn(open, conn),

cmd/mesh-controller/awaiting_push_integration_test.go

@@ -1,182 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"errors"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/catalogue"
-	"github.com/novox/mesh-controller/internal/conditions"
-	"github.com/novox/mesh-controller/internal/overlay"
-)
-
-func TestAModuleAssignedAndNotPushedIsAwaitingAPushNotUncomposable(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	register(t, open, aKeeper())
-	pushedBy(t, open, "laptop") // the machine was pushed before; then the module is assigned
-	if _, err := assign(ctx, open, "laptop", "keeper"); err != nil {
-		t.Fatal(err)
-	}
-
-	// The read the rest of the mesh asks still refuses it, with the composer's typed error: nothing
-	// can be compared about a secret that does not exist (status), and nothing here string-matches.
-	plan, settings, err := planFor(ctx, open, "laptop")
-	if err != nil {
-		t.Fatal(err)
-	}
-	gens, err := generators(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
-	_, err = declarationWith(ctx, open, "laptop", plan, settings, gens, Reading)
-	var notMade *catalogue.NotMadeError
-	if !errors.As(err, &notMade) || notMade.Module != "keeper" || notMade.Name != "repository" {
-		t.Fatalf("a read composition did not say which secret is not made, typed: %v", err)
-	}
-	// Foreseen, it composes, names what the push makes, and made nothing.
-	foreseen, err := declarationWith(ctx, open, "laptop", plan, settings, gens, Foreseeing)
-	if err != nil || len(foreseen.foreseen) != 1 || foreseen.foreseen[0] != "keeper/repository" {
-		t.Fatalf("foreseen: %v %v", foreseen.foreseen, err)
-	}
-	if _, held, err := open.inventory.ModuleSecretIfIssued(ctx, "laptop", "keeper", "repository"); err != nil || held {
-		t.Fatalf("asking ahead of the push made the secret (held %v, %v)", held, err)
-	}
-
-	// Within the bound: nothing at all — no urgent, no warning, nobody notified.
-	if got := d1(t, open); len(got) != 0 {
-		t.Fatalf("a machine waiting for a push raised %+v", got)
-	}
-
-	// Past the bound: a warning, not urgent, saying what the push will make.
-	before := awaitingPushBound
-	awaitingPushBound = -time.Minute
-	t.Cleanup(func() { awaitingPushBound = before })
-	got := d1(t, open)
-	if len(got) != 1 || got[0].Key() != "machine.laptop.awaiting-push" || got[0].Severity != conditions.Warning ||
-		!strings.Contains(got[0].Summary, "keeper/repository") || !strings.Contains(got[0].Summary, "push laptop") {
-		t.Fatalf("a machine left un-pushed past the bound: %+v", got)
-	}
-
-	// Pushed: the secret is made and D1 says nothing.
-	pushedBy(t, open, "laptop")
-	if got := d1(t, open); len(got) != 0 {
-		t.Fatalf("a pushed machine still raised %+v", got)
-	}
-}
-
-func TestASecretThePushCannotMakeIsStillUncomposable(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	register(t, open, aTalker())
-	if _, err := assign(ctx, open, "laptop", "talker"); err != nil {
-		t.Fatal(err)
-	}
-	got := d1(t, open)
-	if len(got) != 1 || got[0].Key() != "machine.laptop.uncomposable" || got[0].Severity != conditions.Urgent ||
-		!strings.Contains(got[0].Summary, "module issue talker --node laptop") {
-		t.Fatalf("a push that will be refused was not said urgently: %+v", got)
-	}
-
-	// And a machine whose composition fails for anything else, with a secret waiting beside it, is
-	// uncomposable for that — the stand-in hides nothing.
-	register(t, open, aKeeper())
-	if _, err := assign(ctx, open, "anchor", "keeper"); err != nil {
-		t.Fatal(err)
-	}
-	one, two := rivals()
-	register(t, open, one)
-	register(t, open, two)
-	_, _ = assign(ctx, open, "anchor", "rival-one")
-	_, _ = assign(ctx, open, "anchor", "rival-two")
-	keys := map[string]conditions.Severity{}
-	for _, o := range d1(t, open) {
-		keys[o.Key()] = o.Severity
-	}
-	if keys["machine.anchor.uncomposable"] != conditions.Urgent {
-		t.Fatalf("a real failure beside a waiting secret: %v", keys)
-	}
-}
-
-func TestAGivenSecretUnderAnOldKeyIsNotForeseen(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	register(t, open, aKeeper())
-	if _, err := assign(ctx, open, "laptop", "keeper"); err != nil {
-		t.Fatal(err)
-	}
-	if err := open.inventory.AcceptSecretForModule(ctx, "laptop", "keeper", "repository", "given"); err != nil {
-		t.Fatal(err)
-	}
-	record, err := open.inventory.NodeByName(ctx, "laptop")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := open.inventory.RecordSealingKey(ctx, record.ID, aPublicKey(t)); err != nil {
-		t.Fatal(err)
-	}
-	got := d1(t, open)
-	if len(got) != 1 || got[0].Key() != "machine.laptop.uncomposable" || !strings.Contains(got[0].Summary, "issue it again") {
-		t.Fatalf("a given secret under an old key: %+v", got)
-	}
-}
-
-func TestAMachineAwaitsAPushSinceItsOldestAssignmentSinceTheLastSend(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	register(t, open, aKeeper())
-	pushedBy(t, open, "laptop")
-	sent := time.Now()
-	since, err := open.inventory.AwaitingSince(ctx, "laptop")
-	if err != nil || since.After(sent) {
-		t.Fatalf("nothing assigned since the send: waiting since %v (%v), the send was before %v", since, err, sent)
-	}
-	if _, err := assign(ctx, open, "laptop", "keeper"); err != nil {
-		t.Fatal(err)
-	}
-	since, err = open.inventory.AwaitingSince(ctx, "laptop")
-	if err != nil || since.Before(sent.Add(-time.Second)) {
-		t.Fatalf("assigned after the send: waiting since %v (%v), not from the assignment", since, err)
-	}
-}
-
-func TestALastSendIsReadFromTheSendAndTheReport(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	register(t, open, aKeeper())
-	pushedBy(t, open, "laptop")
-	if _, err := assign(ctx, open, "laptop", "keeper"); err != nil {
-		t.Fatal(err)
-	}
-	sends, err := readDeliveries(ctx, open.inventory)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if sends["laptop"].settled("keeper", time.Now()) {
-		t.Fatal("a holder assigned and not pushed is expected to answer")
-	}
-	if !sends["laptop"].settled(overlay.Name, time.Now().Add(time.Hour)) {
-		t.Fatal("a module the machine was sent long ago is not expected to answer")
-	}
-	pushedBy(t, open, "laptop")
-	sends, err = readDeliveries(ctx, open.inventory)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if sends["laptop"].settled("keeper", time.Now()) {
-		t.Fatal("pushed a moment ago and not reported, a holder is already expected")
-	}
-	if !sends["laptop"].settled("keeper", time.Now().Add(reportGrace+time.Minute)) {
-		t.Fatal("pushed past the grace, a holder is not expected")
-	}
-	if _, ok := sends["laptop"].carried["keeper"]; !ok {
-		t.Fatalf("the send's builds do not carry keeper: %v", sends["laptop"].carried)
-	}
-	pushedAndApplied(t, open, "laptop")
-	if sends, err = readDeliveries(ctx, open.inventory); err != nil || !sends["laptop"].settled("keeper", time.Now()) {
-		t.Fatalf("pushed and reported applied, a holder is not expected to answer (%v)", err)
-	}
-}

cmd/mesh-controller/awaiting_push_test.go

@@ -1,115 +0,0 @@
-package main
-
-import (
-	"testing"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/catalogue"
-	"github.com/novox/mesh-controller/internal/conditions"
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// Between `assign` and `push` a module's own secrets are not made yet: the push makes them. D1 composed
-// the machine's declaration without making anything, failed on the missing secret, and raised an urgent
-// "nothing can be sent to <machine>" — seen live on 2026-10-06, a desktop notification for a machine
-// the next push sent to without a word (novox/hq issue 275). D1 now composes as the push would, with a
-// stand-in for what the push makes: pending, not broken, and said only past a bound, as a warning.
-
-// aKeeper is a module with an own secret the mesh makes — a backup repository's password.
-func aKeeper() catalogue.Manifest {
-	return catalogue.Manifest{Module: "keeper", Version: "1",
-		OwnSecrets: catalogue.OwnSecrets{"repository": {Path: "/var/lib/mesh/keeper/repository"}},
-		Resources: []map[string]any{
-			{"id": "state", "type": "directory", "path": "/var/lib/mesh/keeper", "mode": "0700"},
-		}}
-}
-
-// pushedBy records a send to a machine as a push does — composed on the send path, so its own secrets
-// are made — without a bus to carry it.
-func pushedBy(t *testing.T, open *stores, node string) string {
-	t.Helper()
-	ctx := t.Context()
-	plan, settings, err := planFor(ctx, open, node)
-	if err != nil {
-		t.Fatal(err)
-	}
-	declared, err := declarationFor(ctx, open, node, plan, settings)
-	if err != nil {
-		t.Fatal(err)
-	}
-	body, err := declared.Body()
-	if err != nil {
-		t.Fatal(err)
-	}
-	record, err := open.inventory.NodeByName(ctx, node)
-	if err != nil {
-		t.Fatal(err)
-	}
-	digest := digestOf(body)
-	if err := open.inventory.RecordSent(ctx, record.ID, digest, declared.Builds); err != nil {
-		t.Fatal(err)
-	}
-	return digest
-}
-
-// pushedAndApplied is pushedBy, and the machine reporting it applied that declaration.
-func pushedAndApplied(t *testing.T, open *stores, node string) {
-	t.Helper()
-	digest := pushedBy(t, open, node)
-	record, err := open.inventory.NodeByName(t.Context(), node)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := open.inventory.RecordDoing(t.Context(), record.ID, inventory.Doing{
-		Outcome: inventory.OutcomeApplied, Declared: digest}); err != nil {
-		t.Fatal(err)
-	}
-}
-
-// d1 runs D1 once.
-func d1(t *testing.T, open *stores) []conditions.Observation {
-	t.Helper()
-	got, err := probeDeclarations(t.Context(), &doctor{open: open})
-	if err != nil {
-		t.Fatal(err)
-	}
-	return got
-}
-
-// **THE WINDOW, REPRODUCED**: assigned and not pushed, a module whose own secret the push makes is
-// waiting, not uncomposable; past the bound it is a warning naming what the push makes; pushed, nothing.
-
-// **A REAL FAILURE IS STILL URGENT**: a secret the push would be refused on is not one it will make.
-// A bus credential nobody issued (issue 203) fails the push, so D1 says it — urgent, in the push's words.
-
-// A given secret sealed to a key the machine no longer has is not the mesh's to make again: the push is
-// refused on it, so D1 is too.
-
-// The bound is read from when the machine began waiting: the oldest assignment since its last send.
-
-// **D3 AND D13 WAIT FOR THE SEND**: a holder is expected to answer on a machine once the machine was sent
-// it and had time to report — never between assign and push.
-func TestAHolderIsExpectedOnlyOnceSentAndReported(t *testing.T) {
-	now := time.Now()
-	sent := now.Add(-time.Minute)
-	long := now.Add(-time.Hour)
-	cases := []struct {
-		name string
-		send lastSend
-		want bool
-	}{
-		{"never sent", lastSend{}, false},
-		{"sent without it", lastSend{sent: &long, current: true, carried: map[string]string{"other": "c"}}, false},
-		{"sent with it, not reported yet", lastSend{sent: &sent, carried: map[string]string{"keeper": "c"}}, false},
-		{"sent with it and reported", lastSend{sent: &sent, current: true, carried: map[string]string{"keeper": "c"}}, true},
-		{"sent with it long ago, never reported", lastSend{sent: &long, carried: map[string]string{"keeper": "c"}}, true},
-		{"sent before builds were kept", lastSend{sent: &long, current: true}, true},
-	}
-	for _, c := range cases {
-		if got := c.send.settled("keeper", now); got != c.want {
-			t.Errorf("%s: settled %v, want %v", c.name, got, c.want)
-		}
-	}
-}
-
-// And through the stores: assigned, not in the last send; pushed and reported, carried and settled.

cmd/mesh-controller/backups_before_send_integration_test.go

@@ -1,308 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"encoding/json"
-	"os"
-	"strings"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/nats-io/nats.go"
-	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-	"github.com/novox/mesh-controller/internal/testbus"
-)
-
-// aBackupSeatOnTheBus is one machine's node-backup holder as a test makes it: it counts the `now` asks it hears and
-// answers `backed-up` with the last night it is told (novox/hq ADR 0404).
-type aBackupSeatOnTheBus struct {
-	mu    sync.Mutex
-	nows  []string
-	night map[string]any // module → lastNight
-}
-
-func (f *aBackupSeatOnTheBus) serve(t *testing.T, conn *nats.Conn, node string) {
-	t.Helper()
-	reply := func(m *nats.Msg, result any) {
-		body, _ := json.Marshal(map[string]any{"result": result, "error": "", "node": node})
-		_ = m.Respond(body)
-	}
-	now, err := conn.Subscribe(link.NodeSeatToolSubject(catalogue.BackupSeat, "now", node), func(m *nats.Msg) {
-		var a struct {
-			Module string `json:"module"`
-		}
-		_ = json.Unmarshal(m.Data, &a)
-		f.mu.Lock()
-		f.nows = append(f.nows, a.Module)
-		f.mu.Unlock()
-		reply(m, map[string]any{"started": a.Module})
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	read, err := conn.Subscribe(link.NodeSeatToolSubject(catalogue.BackupSeat, "backed-up", node), func(m *nats.Msg) {
-		f.mu.Lock()
-		defer f.mu.Unlock()
-		var out []map[string]any
-		for module, n := range f.night {
-			out = append(out, map[string]any{"module": module, "lastNight": n})
-		}
-		reply(m, out)
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { _ = now.Unsubscribe(); _ = read.Unsubscribe() })
-	if err := conn.Flush(); err != nil {
-		t.Fatal(err)
-	}
-}
-
-func (f *aBackupSeatOnTheBus) answers(module string, ok bool, words string) {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	f.night = map[string]any{module: map[string]any{"ok": ok, "at": time.Now().UTC().Add(time.Second), "error": words}}
-}
-
-func (f *aBackupSeatOnTheBus) asks() int {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	return len(f.nows)
-}
-
-// Acceptance test 3 of design 47, on the controller's side: a delivery plan that moves a module keeping data waits
-// for its backups on both machines before it asks a build; a backup that fails holds it, with the machine, the
-// module and the backup's words, and a condition says the same; the verb the delivery's release calls asks the
-// backups again, and the plan goes on. One bus and one store for the scenarios.
-func TestADeliveryThatMovesABackedUpModuleWaitsForItsBackupAndAFailedOneHoldsItAndIsSaid(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	inv := open.inventory
-	asked := asksRecorded(t)
-	js, err := broker.Dial(testbus.URL(t))
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(js.Close)
-	before := handActConn
-	handActConn = js.Conn()
-	t.Cleanup(func() { handActConn = before })
-
-	if _, err := inv.SeedSeats(ctx, catalogue.DefaultSeats()); err != nil {
-		t.Fatal(err)
-	}
-	register(t, open, catalogue.Manifest{Module: "keeper", Version: "1",
-		Claims: []catalogue.Claim{{Name: catalogue.BackupSeat, Scope: catalogue.ScopeNode, Serves: []string{"backed-up", "now", "restore"}}}})
-	notes, err := catalogue.ParseManifest([]byte(`{"module":"notes","version":"1","data":{"own":[` +
-		`{"id":"files","path":"${dir:files}","class":"valuable","why":"people's notes"}]},` +
-		`"resources":[{"id":"files","type":"directory"}]}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := inv.RegisterModule(ctx, notes, inventory.Source{Repository: "novox/mesh-catalog", Seat: "git",
-		Path: "modules/notes", Ref: "main", BuiltFrom: "c0", Head: "c0"}); err != nil {
-		t.Fatal(err)
-	}
-	for _, node := range []string{"anchor", "laptop"} {
-		if _, err := assign(ctx, open, node, "keeper"); err != nil {
-			t.Fatal(err)
-		}
-		if _, err := assign(ctx, open, node, "notes"); err != nil {
-			t.Fatal(err)
-		}
-	}
-	seats := map[string]*aBackupSeatOnTheBus{"anchor": {}, "laptop": {}}
-	for node, s := range seats {
-		s.serve(t, js.Conn(), node)
-	}
-	// Short waits: the bound and the look are variables, so nothing here waits for the minutes of a real backup.
-	wasWithin, wasEvery := backupsWithin, backupsPollEvery
-	backupsWithin, backupsPollEvery = time.Minute, 10*time.Millisecond
-	t.Cleanup(func() { backupsWithin, backupsPollEvery = wasWithin, wasEvery })
-
-	newPlan := func(id string) {
-		t.Helper()
-		p := inventory.Plan{ID: id, Repository: "novox/mesh-catalog", Branch: "main", Commit: "c1", Created: time.Now().UTC(),
-			State: inventory.PlanBuilding, Tiers: [][]string{{"notes"}}, Modules: map[string]*inventory.PlanModule{"notes": {}}}
-		if err := inv.SavePlan(ctx, &p); err != nil {
-			t.Fatal(err)
-		}
-	}
-	read := func(id string) inventory.Plan {
-		t.Helper()
-		p, err := inv.PlanByID(ctx, id)
-		if err != nil {
-			t.Fatal(err)
-		}
-		return p
-	}
-
-	// 1. Both machines are asked; while one has not answered, no build is asked.
-	newPlan("plan-one")
-	advancePlans(ctx, open)
-	if seats["anchor"].asks() != 1 || seats["laptop"].asks() != 1 || len(*asked) != 0 {
-		t.Fatalf("asks anchor=%d laptop=%d builds=%v", seats["anchor"].asks(), seats["laptop"].asks(), *asked)
-	}
-	seats["anchor"].answers("notes", true, "")
-	advancePlans(ctx, open)
-	if len(*asked) != 0 || read("plan-one").Backups.State != inventory.BackupPending {
-		t.Fatalf("a tier was asked while a backup was pending: %v %+v", *asked, read("plan-one").Backups)
-	}
-	seats["laptop"].answers("notes", true, "")
-	advancePlans(ctx, open)
-	if len(*asked) != 1 || read("plan-one").Backups.State != inventory.BackupDone {
-		t.Fatalf("the tier was not asked once every backup was done: %v %+v", *asked, read("plan-one").Backups)
-	}
-	finish := read("plan-one")
-	finish.State = inventory.PlanDone
-	if err := inv.SavePlan(ctx, &finish); err != nil {
-		t.Fatal(err)
-	}
-
-	// 2. A backup that fails holds the plan: not failed, nothing asked, the words kept, a condition raised.
-	seats["anchor"].night, seats["laptop"].night = nil, nil
-	newPlan("plan-two")
-	advancePlans(ctx, open)
-	seats["anchor"].answers("notes", true, "")
-	seats["laptop"].answers("notes", false, "no space left on device")
-	advancePlans(ctx, open)
-	held := read("plan-two")
-	if held.State != inventory.PlanBuilding || held.Backups.State != inventory.BackupFailed || len(*asked) != 1 {
-		t.Fatalf("the plan was not held: %s %+v builds=%v", held.State, held.Backups, *asked)
-	}
-	var failed *inventory.PlanBackup
-	for i := range held.Backups.Asked {
-		if held.Backups.Asked[i].State == inventory.BackupFailed {
-			failed = &held.Backups.Asked[i]
-		}
-	}
-	if failed == nil || failed.Machine != "laptop" || failed.Module != "notes" || failed.Words != "no space left on device" ||
-		strings.Contains(held.Note, "tried again") {
-		t.Fatalf("the failed backup: %+v note=%q", failed, held.Note)
-	}
-	advancePlans(ctx, open) // not retried on the next look
-	if again := read("plan-two"); again.Backups.State != inventory.BackupFailed || len(*asked) != 1 ||
-		seats["laptop"].asks() != 2 {
-		t.Fatalf("a held plan was asked again by itself: %+v builds=%v asks=%d", again.Backups, *asked, seats["laptop"].asks())
-	}
-	said, err := probeBackupHeld(ctx, &doctor{open: open})
-	if err != nil || len(said) != 1 || said[0].Kind != kindBackupHeld || !strings.Contains(said[0].Said, "no space left on device") {
-		t.Fatalf("the condition: %+v %v", said, err)
-	}
-
-	// 3. The verb the release calls: the failed backup is asked again, and only it, and the plan goes on.
-	seats["laptop"].answers("notes", false, "no space left on device")
-	if err := deliveryCommand(ctx, []string{"backups-again", "plan-two", "--why", "a person released it", "--by",
-		"mesh-delivery for jochen"}); err != nil {
-		t.Fatal(err)
-	}
-	if err := deliveryCommand(ctx, []string{"backups-again", "plan-two", "--why", "again"}); err == nil {
-		t.Fatal("a plan with no failed backup was asked again")
-	}
-	seats["laptop"].night = nil
-	advancePlans(ctx, open)
-	if seats["laptop"].asks() != 3 || seats["anchor"].asks() != 2 {
-		t.Fatalf("asked again: laptop=%d anchor=%d", seats["laptop"].asks(), seats["anchor"].asks())
-	}
-	seats["laptop"].answers("notes", true, "")
-	advancePlans(ctx, open)
-	if got := read("plan-two"); got.Backups.State != inventory.BackupDone || len(*asked) != 2 {
-		t.Fatalf("the plan did not go on: %+v builds=%v", got.Backups, *asked)
-	}
-	if said, _ := probeBackupHeld(ctx, &doctor{open: open}); len(said) != 0 {
-		t.Fatalf("the condition stays: %+v", said)
-	}
-}
-
-// Issue 1086: a plan cut from a merge asked its first tier at the cut, so a module keeping data was sent without the
-// backup the plan promised. The cut now takes the backups first (askFirstTierAtCut, batches.go), and the walk's own
-// step asks the tier once they are done.
-func TestAPlanCutFromAMergeOfABackedUpModuleAsksItsBackupAndNotItsTierUntilItIsDone(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	inv := open.inventory
-	settings := t.TempDir() + "/merge-window.json"
-	if err := os.WriteFile(settings, []byte(`{"merge-window": "90s", "merge-window-at-most": "10m"}`), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	t.Setenv(mergeWindowFileVar, settings)
-	everyHeadWaits(t)
-	asked := asksRecorded(t)
-	js, err := broker.Dial(testbus.URL(t))
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(js.Close)
-	before := handActConn
-	handActConn = js.Conn()
-	t.Cleanup(func() { handActConn = before })
-
-	if _, err := inv.SeedSeats(ctx, catalogue.DefaultSeats()); err != nil {
-		t.Fatal(err)
-	}
-	register(t, open, catalogue.Manifest{Module: "keeper", Version: "1",
-		Claims: []catalogue.Claim{{Name: catalogue.BackupSeat, Scope: catalogue.ScopeNode, Serves: []string{"backed-up", "now", "restore"}}}})
-	if err := inv.RegisterModule(ctx, catalogue.Manifest{Module: "mesh-controller", Version: "1"},
-		inventory.Source{Repository: "novox/mesh-controller", Seat: "git", Ref: "main", BuiltFrom: "c0", Head: "c0"}); err != nil {
-		t.Fatal(err)
-	}
-	notes, err := catalogue.ParseManifest([]byte(`{"module":"notes","version":"1","data":{"own":[` +
-		`{"id":"files","path":"${dir:files}","class":"valuable","why":"people's notes"}]},` +
-		`"resources":[{"id":"files","type":"directory"}]}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := inv.RegisterModule(ctx, notes, inventory.Source{Repository: "novox/notes", Seat: "git", Ref: "main",
-		BuiltFrom: "c0", Head: "c0"}); err != nil {
-		t.Fatal(err)
-	}
-	for _, m := range []string{"keeper", "notes"} {
-		if _, err := assign(ctx, open, "anchor", m); err != nil {
-			t.Fatal(err)
-		}
-	}
-	seat := &aBackupSeatOnTheBus{}
-	seat.serve(t, js.Conn(), "anchor")
-	wasWithin, wasEvery := backupsWithin, backupsPollEvery
-	backupsWithin, backupsPollEvery = time.Minute, 10*time.Millisecond
-	t.Cleanup(func() { backupsWithin, backupsPollEvery = wasWithin, wasEvery })
-
-	// 1. A merge of notes is heard and its window closes: the batch is cut through cutBatch.
-	hear(t, open, repoMerge("notes", "c-notes", t0), t0.Add(time.Second))
-	cutAt(t, open, t0.Add(time.Second+90*time.Second))
-	ws, _ := walks(t, open)
-	if len(ws) != 1 {
-		t.Fatalf("%d walk(s)", len(ws))
-	}
-	// 2. Right after the cut no tier is asked, the record has anchor/notes pending, the seat heard one `now`.
-	cut, err := inv.PlanByID(ctx, ws[0].ID)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(*asked) != 0 || askedInTier(cut) {
-		t.Fatalf("the first tier was asked at the cut: %v %+v", *asked, cut.Modules)
-	}
-	if cut.Backups == nil || cut.Backups.State != inventory.BackupPending || len(cut.Backups.Asked) != 1 ||
-		cut.Backups.Asked[0].Machine != "anchor" || cut.Backups.Asked[0].Module != "notes" {
-		t.Fatalf("the backups of the cut: %+v", cut.Backups)
-	}
-	if seat.asks() != 1 {
-		t.Fatalf("the seat heard %d `now`", seat.asks())
-	}
-	// 3. The backup answers done: the walk's own step asks the first tier, once, and asks no second backup.
-	seat.answers("notes", true, "")
-	advancePlans(ctx, open)
-	advancePlans(ctx, open)
-	after, err := inv.PlanByID(ctx, ws[0].ID)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(*asked) != 1 || after.Backups.State != inventory.BackupDone || seat.asks() != 1 {
-		t.Fatalf("builds=%v backups=%+v asks=%d", *asked, after.Backups, seat.asks())
-	}
-}

cmd/mesh-controller/batches_integration_test.go

@@ -1,698 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"bytes"
-	"io"
-	"os"
-	"slices"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/catalogue"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-func windowed(t *testing.T) *stores {
-	t.Helper()
-	open := aMesh(t)
-	ctx := t.Context()
-	inv := open.inventory
-	settings := t.TempDir() + "/merge-window.json"
-	if err := os.WriteFile(settings, []byte(`{"merge-window": "90s", "merge-window-at-most": "10m"}`), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	t.Setenv(mergeWindowFileVar, settings)
-	noGroups(t)
-	if err := inv.RegisterModule(ctx, catalogue.Manifest{Module: "mesh-controller", Version: "1"},
-		inventory.Source{Repository: "novox/mesh-controller", Seat: "git", Ref: "main", BuiltFrom: "c0",
-			Head: "c0"}); err != nil {
-		t.Fatal(err)
-	}
-	for _, m := range []struct{ module, repository, path string }{
-		{"app", "novox/mesh-catalog", "modules/app"},
-		{"notes", "novox/mesh-catalog", "modules/notes"},
-		{"one", "novox/one", ""},
-		{"two", "novox/two", ""},
-		{"three", "novox/three", ""},
-	} {
-		if err := inv.RegisterModule(ctx, catalogue.Manifest{Module: m.module, Version: "1"},
-			inventory.Source{Repository: m.repository, Seat: "git", Path: m.path, Ref: "main", BuiltFrom: "c0",
-				Head: "c0"}); err != nil {
-			t.Fatal(err)
-		}
-	}
-	return open
-}
-
-func hear(t *testing.T, open *stores, m link.SourceMoved, now time.Time) {
-	t.Helper()
-	if err := (following{open: open}).hearMerge(t.Context(), m, now); err != nil {
-		t.Fatal(err)
-	}
-}
-
-func cutAt(t *testing.T, open *stores, now time.Time) {
-	t.Helper()
-	if err := cutBatchesHeld(t.Context(), open, now); err != nil {
-		t.Fatal(err)
-	}
-}
-
-func TestTwoMergesSecondsApartAreOneWalkAtTheLaterCommit(t *testing.T) {
-	open := windowed(t)
-	everyHeadWaits(t)
-	asked := asksWithPaths(t)
-	claude := catalogueMerge("553b7191claude", "app", t0)
-	dunst := catalogueMerge("48bda475dunst", "notes", t0.Add(17*time.Second))
-	hear(t, open, claude, t0.Add(time.Second))
-	hear(t, open, dunst, t0.Add(18*time.Second))
-	if ws, bs := walks(t, open); len(ws) != 0 || len(bs) != 1 {
-		t.Fatalf("within the window: %d walk(s), %d batch(es)", len(ws), len(bs))
-	}
-	cutAt(t, open, t0.Add(18*time.Second+89*time.Second))
-	if ws, _ := walks(t, open); len(ws) != 0 {
-		t.Fatalf("cut before the window closed: %+v", ws)
-	}
-	cutAt(t, open, t0.Add(18*time.Second+90*time.Second))
-	ws, bs := walks(t, open)
-	if len(ws) != 1 || len(bs) != 0 {
-		t.Fatalf("after the window: %d walk(s), %d batch(es)", len(ws), len(bs))
-	}
-	w := ws[0]
-	if w.Commit != dunst.Commit || len(w.Commits) != 1 || w.Commits[0].Commit != dunst.Commit {
-		t.Fatalf("the walk is at %s %+v, not the later commit", w.Commit, w.Commits)
-	}
-	for _, m := range []string{"app", "notes"} {
-		if _, in := w.Modules[m]; !in {
-			t.Fatalf("the walk does not build %s, which one of its merges moved: %v", m, w.Modules)
-		}
-	}
-	want := []inventory.PlanMerge{{Repository: "novox/mesh-catalog", Commit: claude.Commit, Carried: dunst.Commit},
-		{Repository: "novox/mesh-catalog", Commit: dunst.Commit}}
-	if w.Delivery == nil || !slices.EqualFunc(w.Delivery.Merges, want, sameMerge) {
-		t.Fatalf("the walk answers %+v, want %+v", w.Delivery, want)
-	}
-	if len(*asked) != 2 || (*asked)[0][2] != "main" || (*asked)[1][2] != "main" {
-		t.Fatalf("the walk did not ask its modules at the branch, which holds the commit it carries: %v", *asked)
-	}
-	// Heard again, as the bus may hand it over twice: never a second merge, nor a second walk.
-	hear(t, open, claude, t0.Add(5*time.Minute))
-	if ws, bs := walks(t, open); len(ws) != 1 || len(bs) != 0 {
-		t.Fatalf("a merge heard twice made %d walk(s) and %d batch(es)", len(ws), len(bs))
-	}
-}
-
-func TestThreeRepositoriesInOneWindowAreOneWalk(t *testing.T) {
-	open := windowed(t)
-	groupsWaiting(t, "feat/three")
-	asksRecorded(t)
-	for i, r := range []string{"one", "two", "three"} {
-		hear(t, open, fromHead(repoMerge(r, "c-"+r, t0.Add(time.Duration(i)*20*time.Second)), "feat/three"),
-			t0.Add(time.Duration(i)*20*time.Second+time.Second))
-	}
-	cutAt(t, open, t0.Add(41*time.Second+90*time.Second))
-	ws, bs := walks(t, open)
-	if len(ws) != 1 || len(bs) != 0 {
-		t.Fatalf("%d walk(s), %d batch(es)", len(ws), len(bs))
-	}
-	w := ws[0]
-	if len(w.Commits) != 3 || len(w.Delivery.Merges) != 3 {
-		t.Fatalf("the walk carries %+v and answers %+v", w.Commits, w.Delivery.Merges)
-	}
-	for _, r := range []string{"one", "two", "three"} {
-		if w.CommitOf("novox/"+r) != "c-"+r {
-			t.Fatalf("the walk carries %s at %q", r, w.CommitOf("novox/"+r))
-		}
-		if _, in := w.Modules[r]; !in {
-			t.Fatalf("the walk does not build %s: %v", r, w.Modules)
-		}
-	}
-	// Each module's ask is recorded at its own repository's commit.
-	for _, r := range []string{"one", "two", "three"} {
-		q, found, err := open.inventory.BuildRequestByID(t.Context(), w.Modules[r].Build)
-		if err != nil || !found || q.Commit != "c-"+r {
-			t.Fatalf("%s's build was not recorded at its own commit: %+v %v %v", r, q, found, err)
-		}
-	}
-}
-
-func TestAMergeRestartsTheWindowAndTheMaximumClosesIt(t *testing.T) {
-	open := windowed(t)
-	groupsWaiting(t, "feat/both", "feat/busy")
-	asksWithPaths(t)
-	hear(t, open, fromHead(repoMerge("one", "c1", t0), "feat/both"), t0)
-	hear(t, open, fromHead(repoMerge("two", "c2", t0.Add(80*time.Second)), "feat/both"), t0.Add(80*time.Second))
-	cutAt(t, open, t0.Add(100*time.Second))
-	if ws, _ := walks(t, open); len(ws) != 0 {
-		t.Fatal("the window closed 90 seconds after its first merge, not after its last")
-	}
-	cutAt(t, open, t0.Add(170*time.Second))
-	if ws, _ := walks(t, open); len(ws) != 1 || len(ws[0].Commits) != 2 {
-		t.Fatalf("the window did not close 90 seconds after its last merge: %+v", ws)
-	}
-
-	busy := windowed(t)
-	groupsWaiting(t, "feat/both", "feat/busy")
-	asksWithPaths(t)
-	var last time.Time
-	for i := 0; i < 12; i++ {
-		last = t0.Add(time.Duration(i) * time.Minute)
-		repo := []string{"one", "two", "three"}[i%3]
-		hear(t, busy, fromHead(repoMerge(repo, "c"+string(rune('a'+i)), last), "feat/busy"), last)
-		if ws, _ := walks(t, busy); len(ws) > 0 {
-			if i != 10 {
-				t.Fatalf("a busy window closed at merge %d (minute %d), not at its maximum", i, i)
-			}
-			break
-		}
-	}
-	ws, _ := walks(t, busy)
-	if len(ws) != 1 {
-		t.Fatalf("ten minutes of merges a minute apart were never cut: %d walk(s)", len(ws))
-	}
-}
-
-func TestTheAssemblingBatchIsShown(t *testing.T) {
-	open := windowed(t)
-	groupsWaiting(t, "pr/553b7191claude")
-	asksWithPaths(t)
-	var said []inventory.Plan
-	was := inventory.PlanSaved
-	inventory.PlanSaved = func(_ *inventory.Inventory, p inventory.Plan) { said = append(said, p) }
-	t.Cleanup(func() { inventory.PlanSaved = was })
-	now := time.Now().UTC()
-	claude := catalogueMerge("553b7191claude", "app", now.Add(-20*time.Second))
-	claude.Number, claude.Title = 174, "claude-code: an agent proposes a section"
-	dunst := catalogueMerge("48bda475dunst", "notes", now.Add(-2*time.Second))
-	dunst.Number, dunst.Title = 175, "dunst: the font the operator chose"
-	hear(t, open, claude, now.Add(-19*time.Second))
-	hear(t, open, dunst, now.Add(-time.Second))
-	hear(t, open, fromHead(repoMerge("one", "a6bc0931one", now), dunst.Head), now)
-	out := captured(t, func() error { return plansCommand(t.Context(), nil) })
-	lines := strings.Split(out, "\n")
-	first := lines[0]
-	for _, want := range []string{"assembling: ", " s left (at the latest ", "grouped: novox/mesh-catalog@48bda475 " +
-		"(answers 553b7191), novox/one@a6bc0931; plan not yet calculated"} {
-		if !strings.Contains(first, want) {
-			t.Fatalf("plans' first line %q does not say %q", first, want)
-		}
-	}
-	// Under it, one line per repository: the pull request, what it answers, what it moves.
-	if len(lines) < 3 || strings.TrimSpace(lines[1]) != "mesh-catalog #175 dunst: the font the operator chose (answers "+
-		"#174 claude-code: an agent proposes a section) · app, notes" ||
-		strings.TrimSpace(lines[2]) != "one a6bc0931 · one" {
-		t.Fatalf("the grouped list reads %q", lines[1:4])
-	}
-	if len(said) == 0 || said[len(said)-1].State != inventory.PlanAssembling || said[len(said)-1].Delivery.Batch == nil ||
-		len(said[len(said)-1].Delivery.Merges) != 3 {
-		t.Fatalf("the batch was not said as assembling with its merges: %+v", said)
-	}
-}
-
-func captured(t *testing.T, run func() error) string {
-	t.Helper()
-	r, w, err := os.Pipe()
-	if err != nil {
-		t.Fatal(err)
-	}
-	was := os.Stdout
-	os.Stdout = w
-	runErr := run()
-	os.Stdout = was
-	_ = w.Close()
-	var b bytes.Buffer
-	_, _ = io.Copy(&b, r)
-	if runErr != nil {
-		t.Fatal(runErr)
-	}
-	return b.String()
-}
-
-func TestAMergeDuringAWalkJoinsTheNextBatch(t *testing.T) {
-	open := windowed(t)
-	asksWithPaths(t)
-	hear(t, open, repoMerge("one", "c1", t0), t0)
-	cutAt(t, open, t0.Add(90*time.Second))
-	ws, _ := walks(t, open)
-	if len(ws) != 1 || !ws[0].Open() {
-		t.Fatalf("the first batch was not cut: %+v", ws)
-	}
-	first := ws[0]
-	hear(t, open, repoMerge("one", "c2", t0.Add(2*time.Minute)), t0.Add(2*time.Minute))
-	cutAt(t, open, t0.Add(5*time.Minute))
-	ws, bs := walks(t, open)
-	if len(ws) != 1 || len(bs) != 1 || bs[0].State != inventory.PlanQueued || bs[0].Delivery.Batch.Behind != first.ID {
-		t.Fatalf("the merge during the walk: %d walk(s), batches %+v", len(ws), bs)
-	}
-	if got, _ := open.inventory.PlanByID(t.Context(), first.ID); !got.Open() {
-		t.Fatalf("the started walk was %s by the next merge", got.State)
-	}
-	if !strings.HasPrefix(batchWords(bs[0], t0.Add(5*time.Minute)), "queued behind "+first.ID) {
-		t.Fatalf("a queued batch reads %q", batchWords(bs[0], t0.Add(5*time.Minute)))
-	}
-	first.State = inventory.PlanDone
-	if err := open.inventory.SavePlan(t.Context(), &first); err != nil {
-		t.Fatal(err)
-	}
-	cutAt(t, open, t0.Add(6*time.Minute))
-	ws, bs = walks(t, open)
-	if len(ws) != 2 || len(bs) != 0 || ws[0].Commit != "c2" {
-		t.Fatalf("the queued batch was not cut when the walk ended: %+v %+v", ws, bs)
-	}
-}
-
-func TestAWaitingWalkIsFoldedIntoTheNextBatch(t *testing.T) {
-	open := windowed(t)
-	asksWithPaths(t)
-	ctx := t.Context()
-	if err := open.inventory.RegisterModule(ctx, catalogue.Manifest{Module: "mesh-delivery", Version: "1",
-		Claims: []catalogue.Claim{{Name: catalogue.DeliverySeat, Scope: catalogue.ScopeMesh}}},
-		inventory.Source{Repository: "novox/mesh-catalog", Seat: "git", Path: "modules/mesh-delivery", Ref: "main",
-			BuiltFrom: "c0", Head: "c0"}); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := open.inventory.Assign(ctx, "anchor", "mesh-delivery"); err != nil {
-		t.Fatal(err)
-	}
-	hear(t, open, repoMerge("one", "c1", t0), t0)
-	cutAt(t, open, t0.Add(90*time.Second))
-	ws, _ := walks(t, open)
-	if len(ws) != 1 || !ws[0].Waiting() {
-		t.Fatalf("the walk does not wait for its word: %+v", ws)
-	}
-	waiting := ws[0]
-	hear(t, open, repoMerge("one", "c2", t0.Add(2*time.Minute)), t0.Add(2*time.Minute))
-	cutAt(t, open, t0.Add(2*time.Minute+90*time.Second))
-	ws, bs := walks(t, open)
-	if len(bs) != 0 || len(ws) != 2 {
-		t.Fatalf("%d walk(s), %d batch(es)", len(ws), len(bs))
-	}
-	folded, err := open.inventory.PlanByID(ctx, waiting.ID)
-	if err != nil {
-		t.Fatal(err)
-	}
-	newer := ws[0]
-	if folded.State != inventory.PlanSuperseded || folded.Delivery.TakenOverBy != newer.ID {
-		t.Fatalf("the waiting walk is %s, taken over by %q", folded.State, folded.Delivery.TakenOverBy)
-	}
-	if len(newer.Delivery.Merges) != 2 || newer.CommitOf("novox/one") != "c2" {
-		t.Fatalf("the newer walk answers %+v", newer.Delivery.Merges)
-	}
-	if _, in := newer.Modules["one"]; !in {
-		t.Fatalf("what the folded walk was to build is not built: %v", newer.Modules)
-	}
-}
-
-func TestALateMergeIsAnsweredByTheWalkOfTheLaterOne(t *testing.T) {
-	open := windowed(t)
-	everyHeadWaits(t)
-	asksWithPaths(t)
-	ctx := t.Context()
-	later := catalogueMerge("48bda475dunst", "notes", t0.Add(17*time.Second))
-	hear(t, open, later, t0.Add(18*time.Second))
-	cutAt(t, open, t0.Add(2*time.Minute))
-	ws, _ := walks(t, open)
-	w := ws[0]
-	w.State = inventory.PlanDone
-	if err := open.inventory.SavePlan(ctx, &w); err != nil {
-		t.Fatal(err)
-	}
-	// Moves only notes, which the done walk built from the branch after it: answered there, at once.
-	hear(t, open, catalogueMerge("553b7191early", "notes", t0), t0.Add(15*time.Minute))
-	got, _ := open.inventory.PlanByID(ctx, w.ID)
-	if got.State != inventory.PlanDone || len(got.Delivery.Merges) != 2 ||
-		!sameMerge(got.Delivery.Merges[0], inventory.PlanMerge{Repository: "novox/mesh-catalog", Commit: "553b7191early",
-			Carried: later.Commit}) {
-		t.Fatalf("the late merge is not named by the walk that carried it: %+v", got.Delivery.Merges)
-	}
-	// Moves app, which that walk never built: the next batch walks it.
-	hear(t, open, catalogueMerge("1111aaaaapp", "app", t0.Add(time.Second)), t0.Add(16*time.Minute))
-	_, bs := walks(t, open)
-	if len(bs) != 1 || bs[0].Delivery.Merges[0].Commit != "1111aaaaapp" {
-		t.Fatalf("a late merge moving what the walk never built did not join the next batch: %+v", bs)
-	}
-}
-
-func TestAFailedWalkWalksItsEarlierMergesAlone(t *testing.T) {
-	open := windowed(t)
-	everyHeadWaits(t)
-	asked := asksWithPaths(t)
-	ctx := t.Context()
-	// Made before the cut marks their modules seen, as merges are: walked again, they are news all the same.
-	oldest := catalogueMerge("aaaa0001", "app", t0.Add(-3*time.Minute))
-	middle := catalogueMerge("bbbb0002", "app", t0.Add(-3*time.Minute+10*time.Second))
-	newest := catalogueMerge("cccc0003", "notes", t0.Add(-3*time.Minute+20*time.Second))
-	for i, m := range []link.SourceMoved{oldest, middle, newest} {
-		hear(t, open, m, t0.Add(time.Duration(i)*10*time.Second+time.Second))
-	}
-	cutAt(t, open, t0.Add(2*time.Minute))
-	ws, _ := walks(t, open)
-	failed := ws[0]
-	failed.State, failed.Note = inventory.PlanFailed, "notes failed to build in tier 0"
-	if err := open.inventory.SavePlan(ctx, &failed); err != nil {
-		t.Fatal(err)
-	}
-	cutAt(t, open, t0.Add(3*time.Minute))
-	got, _ := open.inventory.PlanByID(ctx, failed.ID)
-	if got.State != inventory.PlanFailed || len(got.Delivery.Merges) != 3 {
-		t.Fatalf("the failed walk's record changed: %s %+v", got.State, got.Delivery.Merges)
-	}
-	ws, _ = walks(t, open)
-	alone := ws[0]
-	if alone.ID == failed.ID || alone.Commit != middle.Commit || len(alone.Delivery.Merges) != 1 ||
-		!sameMerge(alone.Delivery.Merges[0], inventory.PlanMerge{Repository: "novox/mesh-catalog", Commit: middle.Commit}) {
-		t.Fatalf("the newest earlier merge was not walked alone on its own commit: %+v", alone)
-	}
-	if _, in := alone.Modules["app"]; !in || (*asked)[len(*asked)-1] != [3]string{"novox/mesh-catalog", "modules/app",
-		middle.Commit} {
-		t.Fatalf("the merge walked alone does not build app at its own commit: %v, asked %v", alone.Modules, *asked)
-	}
-	// Retried, the failed walk would name merges the search answers now.
-	if _, err := retryPlan(ctx, open, failed.ID); err == nil || !strings.Contains(err.Error(), "walked alone") {
-		t.Fatalf("a failed walk whose merges are searched was retried: %v", err)
-	}
-	alone.State = inventory.PlanDone
-	if err := open.inventory.SavePlan(ctx, &alone); err != nil {
-		t.Fatal(err)
-	}
-	cutAt(t, open, t0.Add(4*time.Minute))
-	ws, bs := walks(t, open)
-	if ws[0].ID != alone.ID || len(bs) != 0 {
-		t.Fatalf("the search went on after a merge was delivered: %+v", ws[0])
-	}
-	done, _ := open.inventory.PlanByID(ctx, alone.ID)
-	if len(done.Delivery.Merges) != 2 || !sameMerge(done.Delivery.Merges[0], inventory.PlanMerge{Repository: "novox/mesh-catalog",
-		Commit: oldest.Commit, Carried: middle.Commit}) {
-		t.Fatalf("the oldest merge is not answered by the walk that delivered the one after it: %+v", done.Delivery.Merges)
-	}
-	// A stopped walk starts no search: a person ended it.
-	hear(t, open, catalogueMerge("dddd0004", "app", t0.Add(5*time.Minute)), t0.Add(5*time.Minute))
-	hear(t, open, catalogueMerge("eeee0005", "notes", t0.Add(5*time.Minute+time.Second)), t0.Add(5*time.Minute+time.Second))
-	cutAt(t, open, t0.Add(8*time.Minute))
-	ws, _ = walks(t, open)
-	if _, err := stopWalk(ctx, open.inventory, ws[0].ID, "mesh-delivery for jochen", "not now"); err != nil {
-		t.Fatal(err)
-	}
-	cutAt(t, open, t0.Add(9*time.Minute))
-	if again, _ := walks(t, open); again[0].ID != ws[0].ID {
-		t.Fatalf("a stopped walk's earlier merge was walked alone: %+v", again[0])
-	}
-}
-
-func TestAGroupsOrderBecomesTiersInsideTheWalk(t *testing.T) {
-	for _, grouped := range []bool{true, false} {
-		open := windowed(t)
-		everyHeadWaits(t)
-		asksWithPaths(t)
-		ctx := t.Context()
-		for _, m := range []string{"mesh-host"} {
-			if err := open.inventory.RegisterModule(ctx, catalogue.Manifest{Module: m, Version: "1"},
-				inventory.Source{Repository: "novox/" + m, Seat: "git", Ref: "main", BuiltFrom: "c0", Head: "c0"}); err != nil {
-				t.Fatal(err)
-			}
-		}
-		host := repoMerge("mesh-host", "h1", t0)
-		ctl := repoMerge("mesh-controller", "k1", t0.Add(time.Second))
-		host.Head, ctl.Head = "feat/together", "feat/together"
-		if !grouped {
-			ctl.Head = "feat/alone"
-		}
-		hear(t, open, ctl, t0.Add(2*time.Second))
-		hear(t, open, host, t0.Add(3*time.Second))
-		cutAt(t, open, t0.Add(2*time.Minute))
-		ws, _ := walks(t, open)
-		if len(ws) != 1 {
-			t.Fatalf("%d walks", len(ws))
-		}
-		tiers := ws[0].Tiers
-		if grouped {
-			if len(tiers) != 2 || !slices.Equal(tiers[0], []string{"mesh-host"}) ||
-				!slices.Equal(tiers[1], []string{"mesh-controller"}) {
-				t.Fatalf("the group's order is not the walk's tiers: %v", tiers)
-			}
-		} else if len(tiers) != 1 {
-			t.Fatalf("two merges of no group were ordered: %v", tiers)
-		}
-	}
-}
-
-func TestABatchSurvivesARestart(t *testing.T) {
-	open := windowed(t)
-	groupsWaiting(t, "feat/both")
-	asksWithPaths(t)
-	hear(t, open, fromHead(repoMerge("one", "c1", t0), "feat/both"), t0)
-	hear(t, open, fromHead(repoMerge("two", "c2", t0.Add(30*time.Second)), "feat/both"), t0.Add(30*time.Second))
-
-	// A new controller: nothing of the first one's but the store.
-	again, err := openStores(t.Context())
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(again.Close)
-	hear(t, again, fromHead(repoMerge("one", "c1", t0), "feat/both"), t0.Add(60*time.Second)) // the bus hands it over again
-	cutAt(t, again, t0.Add(119*time.Second))
-	if ws, bs := walks(t, again); len(ws) != 0 || len(bs) != 1 || len(bs[0].Delivery.Merges) != 2 {
-		t.Fatalf("the restarted controller's batch: %d walk(s), %+v", len(ws), bs)
-	}
-	cutAt(t, again, t0.Add(120*time.Second))
-	ws, bs := walks(t, again)
-	if len(ws) != 1 || len(bs) != 0 || len(ws[0].Delivery.Merges) != 2 {
-		t.Fatalf("the restarted controller did not cut the batch at its window: %+v %+v", ws, bs)
-	}
-}
-
-func TestALateMergeOfAOneModuleRepositoryIsNamed(t *testing.T) {
-	open := windowed(t)
-	everyHeadWaits(t)
-	asksWithPaths(t)
-	ctx := t.Context()
-	c2 := repoMerge("one", "c2", t0.Add(-50*time.Second))
-	hear(t, open, c2, t0)
-	cutAt(t, open, t0.Add(2*time.Minute))
-	ws, _ := walks(t, open)
-	w := ws[0]
-	w.State = inventory.PlanDone
-	if err := open.inventory.SavePlan(ctx, &w); err != nil {
-		t.Fatal(err)
-	}
-	hear(t, open, repoMerge("one", "c1", t0.Add(-60*time.Second)), t0.Add(15*time.Minute))
-	got, _ := open.inventory.PlanByID(ctx, w.ID)
-	if len(got.Delivery.Merges) != 2 || !sameMerge(got.Delivery.Merges[0], inventory.PlanMerge{Repository: "novox/one",
-		Commit: "c1", Carried: "c2"}) {
-		t.Fatalf("the late merge was not named by the walk that carried it: %+v", got.Delivery.Merges)
-	}
-
-	// A walk of two that built only two: a late merge of one is not its to name.
-	hear(t, open, repoMerge("two", "d2", t0.Add(16*time.Minute)), t0.Add(16*time.Minute))
-	cutAt(t, open, t0.Add(18*time.Minute))
-	ws, _ = walks(t, open)
-	w = ws[0]
-	delete(w.Modules, "two")
-	w.State = inventory.PlanDone
-	if err := open.inventory.SavePlan(ctx, &w); err != nil {
-		t.Fatal(err)
-	}
-	hear(t, open, repoMerge("two", "d1", t0.Add(15*time.Minute)), t0.Add(20*time.Minute))
-	if got, _ := open.inventory.PlanByID(ctx, w.ID); len(got.Delivery.Merges) != 1 {
-		t.Fatalf("a walk that never built what the late merge moves named it: %+v", got.Delivery.Merges)
-	}
-	if _, bs := walks(t, open); len(bs) != 1 || bs[0].Delivery.Merges[0].Commit != "d1" {
-		t.Fatalf("the late merge did not join the next batch: %+v", bs)
-	}
-}
-
-func TestAWalkLetGoBesideAStartedOneStartsOnceItEnded(t *testing.T) {
-	open := windowed(t)
-	asked := asksWithPaths(t)
-	ctx := t.Context()
-	hear(t, open, repoMerge("one", "c1", t0), t0)
-	cutAt(t, open, t0.Add(2*time.Minute))
-	started, _ := walks(t, open)
-	waiting := inventory.Plan{ID: "plan-waiting", Repository: "novox/one", Branch: "main", Commit: "d1", Created: t0,
-		State: inventory.PlanBuilding, Tiers: [][]string{{"one"}}, Modules: map[string]*inventory.PlanModule{"one": {}},
-		Delivery: &inventory.PlanDelivery{Awaits: catalogue.DeliverySeat}}
-	if err := open.inventory.SavePlan(ctx, &waiting); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := letGo(ctx, open.inventory, waiting.ID, catalogue.DeliverySeat, "its turn"); err != nil {
-		t.Fatalf("the word was refused beside %s: %v", started[0].ID, err)
-	}
-	before := len(*asked)
-	advanceHeld(ctx, open)
-	got, _ := open.inventory.PlanByID(ctx, waiting.ID)
-	if len(*asked) != before || !strings.Contains(got.Note, "starts once "+started[0].ID) {
-		t.Fatalf("a walk let go beside a started one asked (%d → %d) or does not say it waits: %q", before, len(*asked), got.Note)
-	}
-	// Read as a wait, an hour on: its note on the line, never LATE, and no tier of it late for S3.
-	later := time.Now().Add(time.Hour)
-	if line := planLine(got, later); !strings.Contains(line, "starts once "+started[0].ID) || strings.Contains(line, "LATE") {
-		t.Fatalf("a deferred walk reads %q", line)
-	}
-	facts, _, err := gatherPlans(ctx, open.inventory, later, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, f := range facts {
-		if f.id == got.ID {
-			t.Fatalf("a deferred walk is watched as a tier running late: %+v", f)
-		}
-	}
-	done := started[0]
-	done.State = inventory.PlanDone
-	if err := open.inventory.SavePlan(ctx, &done); err != nil {
-		t.Fatal(err)
-	}
-	advanceHeld(ctx, open)
-	if len(*asked) != before+1 {
-		t.Fatalf("the walk did not start once the started one ended: asked %v", *asked)
-	}
-}
-
-func TestAMergeOnTheControllersPathNeverSharesABatch(t *testing.T) {
-	open := windowed(t)
-	everyHeadWaits(t)
-	asked := asksWithPaths(t)
-	ctx := t.Context()
-	if err := open.inventory.RegisterModule(ctx, catalogue.Manifest{Module: "mesh-delivery", Version: "1",
-		Claims: []catalogue.Claim{{Name: catalogue.DeliverySeat, Scope: catalogue.ScopeMesh}}},
-		inventory.Source{Repository: "novox/mesh-catalog", Seat: "git", Path: "modules/mesh-delivery", Ref: "main",
-			BuiltFrom: "c0", Head: "c0"}); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := open.inventory.Assign(ctx, "anchor", "mesh-delivery"); err != nil {
-		t.Fatal(err)
-	}
-	hear(t, open, catalogueMerge("aaaa0001", "app", t0), t0)
-	hear(t, open, repoMerge("mesh-controller", "k1", t0.Add(10*time.Second)), t0.Add(10*time.Second))
-	hear(t, open, catalogueMerge("bbbb0002", "notes", t0.Add(20*time.Second)), t0.Add(20*time.Second))
-	_, bs := walks(t, open)
-	var ownBatch, catalogueBatch inventory.Plan
-	for _, b := range bs {
-		if b.OwnPath() {
-			ownBatch = b
-		} else {
-			catalogueBatch = b
-		}
-	}
-	if len(bs) != 2 || ownBatch.ID == "" || catalogueBatch.ID == "" || len(catalogueBatch.Delivery.Merges) != 2 ||
-		len(ownBatch.Delivery.Merges) != 1 {
-		t.Fatalf("a controller merge and two catalogue merges in one window: %+v", bs)
-	}
-	if !strings.Contains(batchWords(ownBatch, t0.Add(30*time.Second)), "own path") {
-		t.Fatalf("the own-path batch does not say so: %q", batchWords(ownBatch, t0.Add(30*time.Second)))
-	}
-	// Both windows closed, the controller's batch is cut first and starts; the catalogue batch queues behind it,
-	// is cut when the controller's walk ended, and waits for its word with both merges.
-	cutAt(t, open, t0.Add(2*time.Minute))
-	ws, bs := walks(t, open)
-	if len(ws) != 1 || ws[0].Waiting() || ws[0].CommitOf("novox/mesh-controller") != "k1" {
-		t.Fatalf("the controller's batch was not cut first into a started walk: %+v", ws)
-	}
-	ownWalk := ws[0]
-	for _, m := range []string{"app", "notes"} {
-		if _, in := ownWalk.Modules[m]; in {
-			t.Fatalf("the controller's walk builds %s, a catalogue module: it skipped its turn", m)
-		}
-	}
-	if len(bs) != 1 || bs[0].State != inventory.PlanQueued || bs[0].Delivery.Batch.Behind != ownWalk.ID || bs[0].OwnPath() {
-		t.Fatalf("the catalogue batch does not queue behind the controller's walk: %+v", bs)
-	}
-	ownWalk.State = inventory.PlanDone
-	if err := open.inventory.SavePlan(ctx, &ownWalk); err != nil {
-		t.Fatal(err)
-	}
-	cutAt(t, open, t0.Add(3*time.Minute))
-	ws, bs = walks(t, open)
-	if len(bs) != 0 || ws[0].ID != catalogueBatch.ID || !ws[0].Waiting() || len(ws[0].Delivery.Merges) != 2 {
-		t.Fatalf("the catalogue batch was not cut into a waiting walk once the controller's ended: %+v %+v", ws, bs)
-	}
-	for _, m := range []string{"app", "notes"} {
-		if _, in := ws[0].Modules[m]; !in {
-			t.Fatalf("the catalogue walk does not build %s: %v", m, ws[0].Modules)
-		}
-	}
-	for _, a := range *asked {
-		if a[1] == "modules/app" || a[1] == "modules/notes" {
-			t.Fatalf("a catalogue module was asked without the word: %v", *asked)
-		}
-	}
-
-	// A catalogue walk waiting for its word when an own-path batch is cut keeps waiting beside the own-path
-	// walk, is not folded into it, and its word is taken meanwhile: it starts once the own-path walk ended.
-	catalogueWalk := ws[0]
-	hear(t, open, repoMerge("mesh-controller", "k2", t0.Add(4*time.Minute)), t0.Add(4*time.Minute))
-	cutAt(t, open, t0.Add(6*time.Minute))
-	ws, _ = walks(t, open)
-	kept, _ := open.inventory.PlanByID(ctx, catalogueWalk.ID)
-	if !kept.Waiting() || ws[0].CommitOf("novox/mesh-controller") != "k2" || ws[0].Waiting() {
-		t.Fatalf("the waiting catalogue walk was not kept waiting beside the controller's walk: %s %+v", kept.State, ws)
-	}
-	if _, in := ws[0].Modules["app"]; in {
-		t.Fatalf("the controller's walk folded the waiting catalogue walk in: %v", ws[0].Modules)
-	}
-	if _, err := letGo(ctx, open.inventory, catalogueWalk.ID, catalogue.DeliverySeat, "its turn"); err != nil {
-		t.Fatal(err)
-	}
-	before := len(*asked)
-	advanceHeld(ctx, open)
-	if len(*asked) != before {
-		t.Fatalf("the catalogue walk started beside the controller's: asked %v", (*asked)[before:])
-	}
-	own2 := ws[0]
-	own2.State = inventory.PlanDone
-	if err := open.inventory.SavePlan(ctx, &own2); err != nil {
-		t.Fatal(err)
-	}
-	advanceHeld(ctx, open)
-	if len(*asked) < before+1 || (*asked)[before][1] != "modules/app" {
-		t.Fatalf("the catalogue walk did not start once the controller's ended: %v", (*asked)[before:])
-	}
-}
-
-func TestALateCatalogueMergeIsNotAnsweredByAnOwnPathWalk(t *testing.T) {
-	open := windowed(t)
-	everyHeadWaits(t)
-	asksWithPaths(t)
-	ctx := t.Context()
-	for _, m := range []struct {
-		module string
-		claims []catalogue.Claim
-	}{
-		{"nats", nil},
-		{"mesh-delivery", []catalogue.Claim{{Name: catalogue.DeliverySeat, Scope: catalogue.ScopeMesh}}},
-	} {
-		if err := open.inventory.RegisterModule(ctx, catalogue.Manifest{Module: m.module, Version: "1", Claims: m.claims},
-			inventory.Source{Repository: "novox/mesh-catalog", Seat: "git", Path: "modules/" + m.module, Ref: "main",
-				BuiltFrom: "c0", Head: "c0"}); err != nil {
-			t.Fatal(err)
-		}
-	}
-	if _, err := open.inventory.Assign(ctx, "anchor", "mesh-delivery"); err != nil {
-		t.Fatal(err)
-	}
-	mixed := link.SourceMoved{Owner: "novox", Repo: "mesh-catalog", Base: "main", Commit: "m1xed", MergedAt: t0.Format(time.RFC3339Nano),
-		Paths: []string{"modules/nats/module.json", "modules/app/module.json"}, ModuleDirs: []string{"modules/nats", "modules/app"},
-		ModuleDirsSaid: true}
-	hear(t, open, mixed, t0.Add(time.Second))
-	cutAt(t, open, t0.Add(2*time.Minute))
-	ws, _ := walks(t, open)
-	if len(ws) != 1 || ws[0].Waiting() {
-		t.Fatalf("the mixed merge's walk waited, or was not cut: %+v", ws)
-	}
-	done := ws[0]
-	done.State = inventory.PlanDone
-	if err := open.inventory.SavePlan(ctx, &done); err != nil {
-		t.Fatal(err)
-	}
-	hear(t, open, catalogueMerge("ear1ier", "app", t0.Add(-30*time.Second)), t0.Add(3*time.Minute))
-	got, _ := open.inventory.PlanByID(ctx, done.ID)
-	_, bs := walks(t, open)
-	if len(got.Delivery.Merges) != 1 || len(bs) != 1 || bs[0].OwnPath() || bs[0].Delivery.Merges[0].Commit != "ear1ier" {
-		t.Fatalf("the late catalogue merge was answered by the own-path walk (%+v) rather than the next catalogue batch (%+v)",
-			got.Delivery.Merges, bs)
-	}
-}

cmd/mesh-controller/batches_test.go

@@ -1,293 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"os"
-	"slices"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/catalogue"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// The suite's tests of a merge, but for the merge window's own (this file's), plan the merge as it is heard: a
-// window of nothing closes at once, so a merge with no walk open is cut into its walk at once, as every merge
-// was planned before novox/hq ADR 0276. The window's tests set it through the controller's settings.
-func init() {
-	mergeWindowDefault = 0
-	// No forge in a test: no manifest is found at any commit, so a merge draws no edge of the manifests' change
-	// (delivery_edges.go). A test that wants some replaces these (forgeHolding).
-	manifestAt = func(context.Context, string, string, string, string) (catalogue.Manifest, bool, error) {
-		return catalogue.Manifest{}, false, nil
-	}
-	parentOf = func(context.Context, string, string, string) (string, error) { return "", nil }
-}
-
-// windowed is a mesh whose controller's settings give a merge window of 90 seconds and at most 10 minutes, as its
-// settings file says them, and
-// modules built from the catalogue (app, notes) and from three repositories of their own.
-
-// t0 is the moment a test's clock starts: merges are dated by it, and heard after it.
-var t0 = time.Now().UTC().Truncate(time.Second)
-
-// catalogueMerge is a merge of the catalogue changing one module's directory, made at a moment, from a pull
-// request's head branch of its own, as the forge announces every merge. Whether its head names a delivery group
-// with a member still to merge is mesh-delivery's word, which windowed stubs as no group at all (noGroups); a test
-// whose merges wait for the window as a group's says so (groupsWaiting).
-func catalogueMerge(commit, module string, made time.Time) link.SourceMoved {
-	return link.SourceMoved{Owner: "novox", Repo: "mesh-catalog", Base: "main", Head: "pr/" + commit, Commit: commit,
-		MergedAt: made.Format(time.RFC3339Nano), Paths: []string{"modules/" + module + "/module.json"},
-		ModuleDirs: []string{"modules/" + module}, ModuleDirsSaid: true}
-}
-
-// repoMerge is a merge of a repository of one module's own, from a head branch of its own (catalogueMerge).
-func repoMerge(repo, commit string, made time.Time) link.SourceMoved {
-	return link.SourceMoved{Owner: "novox", Repo: repo, Base: "main", Head: "pr/" + commit, Commit: commit,
-		MergedAt: made.Format(time.RFC3339Nano), Paths: []string{"main.go"}}
-}
-
-// noGroups stubs mesh-delivery's word on groups for a test: no head names a group.
-func noGroups(t *testing.T) {
-	t.Helper()
-	was := deliveryGroupOf
-	deliveryGroupOf = func(context.Context, bool, string) ([]groupMember, bool, error) { return nil, false, nil }
-	t.Cleanup(func() { deliveryGroupOf = was })
-}
-
-// groupsWaiting stubs mesh-delivery's word on groups for a test of the merge window's own timing: each head named
-// is one whose group mesh-delivery cannot say, so a merge from it waits for the window (ADR 0306 decision 2) and
-// nothing holds the batch open; every other head names no group. A group with a member still to merge, which holds
-// its batch open however long it takes (ADR 0418 clause 3), is groupStates'.
-func groupsWaiting(t *testing.T, heads ...string) {
-	t.Helper()
-	was := deliveryGroupOf
-	deliveryGroupOf = func(_ context.Context, _ bool, head string) ([]groupMember, bool, error) {
-		if slices.Contains(heads, head) {
-			return nil, false, errors.New("the test's mesh-delivery does not say")
-		}
-		return nil, false, nil
-	}
-	t.Cleanup(func() { deliveryGroupOf = was })
-}
-
-// everyHeadWaits stubs mesh-delivery's word on groups for a test whose merges each wait for the window as they did
-// before novox/hq ADR 0304: mesh-delivery cannot say any head's group.
-func everyHeadWaits(t *testing.T) {
-	t.Helper()
-	was := deliveryGroupOf
-	deliveryGroupOf = func(context.Context, bool, string) ([]groupMember, bool, error) {
-		return nil, false, errors.New("the test's mesh-delivery does not say")
-	}
-	t.Cleanup(func() { deliveryGroupOf = was })
-}
-
-// groupStates stubs mesh-delivery's word on one group: its members and their states, which a test changes as the
-// members merge.
-func groupStates(t *testing.T, head string, states map[string]string) {
-	t.Helper()
-	groupStatesFrom(t, head, states, true)
-}
-
-// groupStatesFrom is groupStates for a mesh-delivery that does (composed) or does not yet say the group's gate is the
-// composed check's: only the first holds the group's batch open for its last member.
-func groupStatesFrom(t *testing.T, head string, states map[string]string, composed bool) {
-	t.Helper()
-	was := deliveryGroupOf
-	deliveryGroupOf = func(_ context.Context, _ bool, asked string) ([]groupMember, bool, error) {
-		if asked != head {
-			return nil, false, nil
-		}
-		var members []groupMember
-		for repository, state := range states {
-			members = append(members, groupMember{Repository: repository, State: state, Composed: composed})
-		}
-		return members, true, nil
-	}
-	t.Cleanup(func() { deliveryGroupOf = was })
-}
-
-// fromHead is a merge from a head branch a test names: merges from one head are members of one delivery group,
-// related by it (novox/hq ADR 0304 decision 1), so they share a batch whatever else they share.
-func fromHead(m link.SourceMoved, head string) link.SourceMoved {
-	m.Head = head
-	return m
-}
-
-// lone is a merge that names no head: known to be no delivery group's, it waits for no window unless it is
-// related to a batch assembling (ADR 0304 decision 1).
-func lone(m link.SourceMoved) link.SourceMoved {
-	m.Head = ""
-	return m
-}
-
-// hear is a merge heard at a moment.
-
-// cutAt is the cutter looking at a moment.
-
-// walks is every plan record that is a walk, newest first, and the batches not yet cut.
-func walks(t *testing.T, open *stores) (walks, batches []inventory.Plan) {
-	t.Helper()
-	recent, err := open.inventory.RecentPlans(t.Context(), 50)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, p := range recent {
-		if p.Batch() {
-			batches = append(batches, p)
-		} else {
-			walks = append(walks, p)
-		}
-	}
-	return walks, batches
-}
-
-// The replay of issue 362: two catalogue merges 18 seconds apart are one batch, cut once into one walk at the
-// later commit, which names both merges — the earlier carried by the later.
-
-// Merges of three repositories in one window are one walk, one commit for each.
-
-// Each merge restarts the window: a merge at second 80 keeps the batch open until second 170; the window
-// closes at most ten minutes after its first merge however busy.
-
-// `plans` lists the batch being assembled first, in the operator's words: how long is left, when at the latest,
-// what is grouped, and that the plan is not yet calculated. It says so on the bus as plan-moved, too.
-
-// captured is what a command printed.
-
-// A merge heard during a walk it is related to (the same repository, issue 973) joins the next batch, which is
-// cut when the walk ends; the walk that started is never superseded (ADR 0276 decision 4, ADR 0407 decision 4).
-
-// A walk waiting for its delivery's word is folded into the next batch's walk, which answers its merges; it
-// names the walk that took it over.
-
-// A merge heard after a later merge of its branch was walked is answered by that walk when it builds all it
-// moves — named at once on a walk done — and joins the next batch when it does not.
-
-// A failed walk marks nothing delivered: its earlier merges are walked alone, on their own commit, the newest
-// first; the first delivered answers the older ones, and the search stops.
-
-// A delivery group's order holds inside the walk (ADR 0249 unchanged): merges of two repositories from one head
-// branch name, the node-engine's before the controller's, are tiered so; without the group, one tier.
-
-// A restarted controller resumes the window where it stood: the batch, its merges and their times are in the
-// store, a merge handed over again is not doubled, and the batch is cut when its window closes.
-
-// The window's settings reach the controller in its settings file, read at every look; one that says no
-// duration, or no file, is the default.
-func TestTheWindowIsTheControllersSetting(t *testing.T) {
-	file := t.TempDir() + "/merge-window.json"
-	t.Setenv(mergeWindowFileVar, file)
-	for _, c := range []struct {
-		content        string
-		window, atMost time.Duration
-	}{
-		{`{"merge-window": "60s", "merge-window-at-most": "5m"}`, time.Minute, 5 * time.Minute},
-		{`{"merge-window": 30, "merge-window-at-most": ""}`, 30 * time.Second, mergeWindowAtMostDefault},
-		{`{"merge-window": "soon"}`, mergeWindowDefault, mergeWindowAtMostDefault},
-	} {
-		if err := os.WriteFile(file, []byte(c.content), 0o600); err != nil {
-			t.Fatal(err)
-		}
-		if w, m := mergeWindowOf(); w != c.window || m != c.atMost {
-			t.Errorf("%s reads as %s and %s, want %s and %s", c.content, w, m, c.window, c.atMost)
-		}
-	}
-	t.Setenv(mergeWindowFileVar, file+".gone")
-	if w, m := mergeWindowOf(); w != mergeWindowDefault || m != mergeWindowAtMostDefault {
-		t.Errorf("no file reads as %s and %s", w, m)
-	}
-}
-
-// S16 names every merge a waiting walk answers, never one commit a supersession may have ended (issue 362).
-func TestAWaitingWalkNamesTheMergesItAnswers(t *testing.T) {
-	f := calm(t0)
-	f.waits = []waitFacts{{id: "plan-2", repository: "novox/mesh-catalog", commit: "48bda475dunst", awaits: "mesh-delivery",
-		since: t0.Add(-31 * time.Minute), merges: []inventory.PlanMerge{
-			{Repository: "novox/mesh-catalog", Commit: "553b7191claude", Carried: "48bda475dunst"},
-			{Repository: "novox/mesh-catalog", Commit: "48bda475dunst"}}}}
-	got := watchWaits(f)
-	if len(got) != 1 || !strings.Contains(got[0].Summary, "novox/mesh-catalog@553b7191") ||
-		!strings.Contains(got[0].Summary, "novox/mesh-catalog@48bda475") {
-		t.Fatalf("the waiting walk does not name both merges: %+v", got)
-	}
-}
-
-// A merge heard after a later merge of its branch was cut is named by that walk however its modules read since
-// the cut, in a repository of one module (review of this change); a walk that never built what it moves names
-// nothing, and the merge joins the next batch.
-
-// A related walk waits for the delivery's word too: a waiting walk let go beside a started one it is related to
-// (the same repository, issue 973) takes the word and starts once that one ended, asking nothing before.
-
-// A file a merge of the batch removed and a later one brought back is not removed; one removed last is.
-func TestARemovedFileIsTheLastMergesWord(t *testing.T) {
-	ev := func(commit string, paths, removed []string) inventory.BatchedMerge {
-		m := link.SourceMoved{Owner: "novox", Repo: "one", Base: "main", Commit: commit, Paths: paths, Removed: removed}
-		b, _ := json.Marshal(m)
-		return inventory.BatchedMerge{Repository: "novox/one", Branch: "main", Commit: commit, Event: b,
-			Merged: t0.Add(time.Duration(len(commit)) * time.Second)}
-	}
-	got := combinedMerges([]inventory.BatchedMerge{
-		ev("a", []string{"x/module.json", "y/module.json"}, []string{"x/module.json", "y/module.json"}),
-		ev("bb", []string{"x/module.json"}, nil),
-		ev("ccc", []string{"z.go"}, nil)})
-	if len(got) != 1 || got[0].Commit != "ccc" || !slices.Equal(got[0].Removed, []string{"y/module.json"}) ||
-		len(got[0].Paths) != 3 {
-		t.Fatalf("combined as %+v", got)
-	}
-}
-
-// A merge on the controller's own path never shares a batch with one that waits for mesh-delivery's word
-// (decided during the build, 2026-10-10): the two are batches of their own, cut one after the other; a walk on
-// the own path folds no waiting catalogue walk but batches its merges again behind it; the catalogue's walk
-// still waits for the word, so no catalogue delivery skips its turn.
-
-// `plans` names a walk by what it moves (asked by the operator, 2026-10-10): the repository's pull request and
-// title, the modules it moves and the machines running them, then the state words; a record naming no pull
-// request is named by its commit, and a title is cut at fifty runes.
-func TestAPlanLineNamesWhatItMoves(t *testing.T) {
-	now := time.Date(2026, 10, 10, 12, 0, 0, 0, time.UTC)
-	p := inventory.Plan{ID: "plan-1", Repository: "novox/mesh-catalog", Branch: "main", Commit: "c1c1c1c1c1",
-		State: inventory.PlanBuilding, Tiers: [][]string{{"messenger", "telegram"}}, TierEntered: now.Add(-2 * time.Minute),
-		Modules: map[string]*inventory.PlanModule{"messenger": {State: "asked"}, "telegram": {State: "asked"}},
-		Commits: []inventory.PlanCommit{{Repository: "novox/mesh-catalog", Branch: "main", Commit: "c1c1c1c1c1"}},
-		Delivery: &inventory.PlanDelivery{Merges: []inventory.PlanMerge{{Repository: "novox/mesh-catalog",
-			Commit: "c1c1c1c1c1", Number: 175, Title: "a tap shows its outcome", Moves: []string{"telegram", "messenger"}}}}}
-	running := func(module string) []string {
-		if module == "messenger" || module == "telegram" {
-			return []string{"novox"}
-		}
-		return nil
-	}
-	if got, want := planLineOn(p, now, pauseView{}, tierAtLeast, running),
-		"mesh-catalog #175 a tap shows its outcome · messenger, telegram → novox · tier 1 of 1, building for 2m0s"; got != want {
-		t.Fatalf("the line reads %q, want %q", got, want)
-	}
-	if got := planLine(p, now); !strings.HasPrefix(got, "mesh-catalog #175 a tap shows its outcome · messenger, telegram · tier") {
-		t.Fatalf("without the machines the line reads %q", got)
-	}
-	old := p
-	old.Commits, old.Delivery = nil, nil
-	if got := planLine(old, now); !strings.HasPrefix(got, "mesh-catalog c1c1c1c1 · tier 1 of 1") {
-		t.Fatalf("a record naming no pull request reads %q", got)
-	}
-	long := p
-	long.Delivery.Merges[0].Title = strings.Repeat("abcdefghij", 6)
-	if got := planHeadline(long, nil); !strings.Contains(got, "#175 "+strings.Repeat("abcdefghij", 4)+"abcdefghi…") {
-		t.Fatalf("a long title is not cut at fifty runes: %q", got)
-	}
-}
-
-// sameMerge compares what a walk names of a merge: its repository, commit and the commit carrying it.
-func sameMerge(a, b inventory.PlanMerge) bool {
-	return a.Repository == b.Repository && a.Commit == b.Commit && a.Carried == b.Carried
-}
-
-// A catalogue merge heard after a later merge of its branch was walked without the word (a merge that touched
-// the bus too, on the controller's own path) is not answered by that walk while the delivery seat has a holder:
-// its delivery would skip its turn. It joins the next catalogue batch.

cmd/mesh-controller/batches_watch.go

@@ -1,153 +0,0 @@
-package main
-
-import (
-	"context"
-	"fmt"
-	"sort"
-	"strings"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/conditions"
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// **Every wait of a batch has a bound and a condition** (novox/hq ADR 0276 decision 9): a batch still
-// assembling a minute past its maximum while no walk is open is a cut the controller failed to make (S18),
-// and a batch waiting behind an open walk longer than that walk's bound waits on a walk gone wrong (S19).
-
-// The kinds S18 and S19 raise.
-const (
-	kindBatchNotCut     = "batch-not-cut"
-	kindBatchBehindWalk = "batch-behind-walk"
-	// kindGroupNotMerged is raised for a group whose last member has not merged by the merge window's maximum after
-	// its first (novox/hq ADR 0418 clause 3).
-	kindGroupNotMerged = "group-not-merged"
-)
-
-// batchFacts is one batch not yet cut, as the watchdogs read it.
-type batchFacts struct {
-	id, state, grouped string
-	// atMost is when its window closes at the latest; closed when it closed.
-	atMost, closed time.Time
-	// behind is the open walk it waits behind, and walkBound that walk's bound: a tier's bound for each of its
-	// tiers.
-	behind    string
-	walkBound time.Duration
-	// holds are the groups the batch is held for, by head, with why; created is when the batch was made, the first
-	// merge of the group heard; atMostWindow is the maximum a window may take (the controller's setting).
-	holds        map[string]string
-	created      time.Time
-	atMostWindow time.Duration
-}
-
-// gatherBatches is every batch not yet cut, with the bound of the walk it waits behind.
-func gatherBatches(ctx context.Context, inv *inventory.Inventory, now time.Time) ([]batchFacts, error) {
-	batches, err := inv.Batches(ctx)
-	if err != nil || len(batches) == 0 {
-		return nil, err
-	}
-	bounds, err := measuredTierBounds(ctx, inv, now)
-	if err != nil {
-		return nil, err
-	}
-	var out []batchFacts
-	for _, b := range batches {
-		_, atMostWindow := mergeWindowOf()
-		f := batchFacts{id: b.ID, state: b.State, grouped: groupedWords(b), created: b.Created, atMostWindow: atMostWindow}
-		if w := b.Delivery; w != nil && w.Batch != nil {
-			f.holds = w.Batch.Holds
-			f.atMost, f.closed, f.behind = w.Batch.AtMost, w.Batch.ClosesAt, w.Batch.Behind
-			if f.atMost.Before(f.closed) {
-				f.closed = f.atMost
-			}
-			if w.Batch.CutAtOnce && !b.Created.IsZero() {
-				// Its window closed when it was made, which is its latest too (ADR 0304 decision 1).
-				f.atMost, f.closed = b.Created, b.Created
-			}
-		}
-		if f.behind != "" {
-			if walk, err := inv.PlanByID(ctx, f.behind); err == nil {
-				f.walkBound = bounds.of(walk.Repository) * time.Duration(max(1, len(walk.Tiers)))
-			}
-		}
-		out = append(out, f)
-	}
-	return out, nil
-}
-
-// watchBatchesNotCut is S18: a batch still assembling a minute past its maximum, while no walk is open.
-func watchBatchesNotCut(f *signalFacts) []conditions.Observation {
-	var out []conditions.Observation
-	for _, b := range f.batches {
-		if b.state != inventory.PlanAssembling || b.atMost.IsZero() || f.now.Sub(b.atMost) <= batchLateAfter ||
-			len(b.holds) > 0 { // a batch held for a group waits on a member, which has its own condition
-			continue
-		}
-		late := f.now.Sub(b.atMost)
-		out = append(out, conditions.Observation{Scope: conditions.ScopePlan, ID: b.id, Kind: kindBatchNotCut,
-			Severity: conditions.Warning,
-			Summary: fmt.Sprintf("the batch %s is still assembling %s past its latest close (%s), with no walk open: "+
-				"the controller did not cut it; grouped: %s", b.id, ago(late), b.atMost.UTC().Format(time.RFC3339), b.grouped),
-			Said:     fmt.Sprintf("assembling since %s past its maximum", ago(late)),
-			Headline: "Merged changes are not being delivered",
-			Explanation: fmt.Sprintf("Merges collected for one delivery should have been planned %s ago and were not. "+
-				"Nothing is lost; the mesh keeps them until it plans them.", humanDuration(late)),
-			Resolved: "Merged changes are being delivered again"})
-	}
-	return out
-}
-
-// watchBatchesBehind is S19: a batch waiting behind an open walk longer than that walk's bound, naming it.
-func watchBatchesBehind(f *signalFacts) []conditions.Observation {
-	var out []conditions.Observation
-	for _, b := range f.batches {
-		if b.state != inventory.PlanQueued || b.behind == "" || b.walkBound <= 0 || f.now.Sub(b.closed) <= b.walkBound {
-			continue
-		}
-		in := f.now.Sub(b.closed)
-		out = append(out, conditions.Observation{Scope: conditions.ScopePlan, ID: b.id, Kind: kindBatchBehindWalk,
-			Severity: conditions.Warning,
-			Summary: fmt.Sprintf("the batch %s has waited %s behind the walk %s, longer than that walk's bound (%s); "+
-				"grouped: %s; `plans %s` says where that walk stands", b.id, ago(in), b.behind, ago(b.walkBound),
-				b.grouped, b.behind),
-			Said:     fmt.Sprintf("queued behind %s for %s", b.behind, ago(in)),
-			Headline: "Merged changes wait behind a slow delivery",
-			Explanation: fmt.Sprintf("Merges collected for the next delivery have waited %s for the delivery before "+
-				"them, which is taking longer than it should. Nothing is lost.", humanDuration(in)),
-			Resolved: "Merged changes no longer wait behind a slow delivery"})
-	}
-	return out
-}
-
-// watchGroupsNotMerged is the condition of a batch held for a group whose last member has not merged by the merge
-// window's maximum after the first member merged, naming the member and why (novox/hq ADR 0418 clause 3): nothing of
-// the group is delivered while it waits.
-func watchGroupsNotMerged(f *signalFacts) []conditions.Observation {
-	var out []conditions.Observation
-	for _, b := range f.batches {
-		if len(b.holds) == 0 || b.created.IsZero() || f.now.Sub(b.created) <= b.atMostWindow {
-			continue
-		}
-		heads := make([]string, 0, len(b.holds))
-		for h := range b.holds {
-			heads = append(heads, h)
-		}
-		sort.Strings(heads)
-		var why []string
-		for _, h := range heads {
-			why = append(why, b.holds[h])
-		}
-		waited := f.now.Sub(b.created)
-		out = append(out, conditions.Observation{Scope: conditions.ScopePlan, ID: b.id,
-			Kind: kindGroupNotMerged, Severity: conditions.Warning,
-			Summary: fmt.Sprintf("%s; its first member merged %s ago, past the merge window's maximum (%s), and nothing "+
-				"of the group is delivered while it waits (batch %s)", strings.Join(why, "; "), ago(waited), ago(b.atMostWindow), b.id),
-			Said:     "a group waits for a member that has not merged",
-			Headline: "A change waits for the rest of its group to merge",
-			Explanation: fmt.Sprintf("The changes of a group are delivered together, once the last one is merged. "+
-				"One has not merged in %s. Nothing is lost; the merged ones are kept and delivered with it.",
-				humanDuration(waited)),
-			Resolved: "The group's last change merged"})
-	}
-	return out
-}

cmd/mesh-controller/beside_test.go

@@ -1,108 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// An unrelated closed batch is cut into a walk beside an open one, and that walk asks its first tier at once
-// (issue 973, novox/hq ADR 0407 decision 4): a hotfix is never held by an unrelated delivery.
-func TestAnUnrelatedBatchWalksBesideAnOpenWalk(t *testing.T) {
-	open := windowed(t)
-	asksWithPaths(t)
-	ctx := t.Context()
-	hear(t, open, repoMerge("one", "c1", t0), t0)
-	cutAt(t, open, t0.Add(90*time.Second))
-	if ws, _ := walks(t, open); len(ws) != 1 || !ws[0].Open() {
-		t.Fatalf("the first walk is not open: %+v", ws)
-	}
-	heard := t0.Add(100 * time.Second)
-	hear(t, open, lone(repoMerge("two", "c2", heard)), heard)
-	advanceHeld(ctx, open)
-	ws, bs := walks(t, open)
-	if len(ws) != 2 || len(bs) != 0 {
-		t.Fatalf("%d walk(s) and %d batch(es); want the unrelated batch cut beside the open walk", len(ws), len(bs))
-	}
-	for _, w := range ws {
-		if !w.Open() || w.Waiting() || deferred(w) || !askedAny(w) {
-			t.Errorf("%s (%s) is not walking: open %v, deferred %v, asked %v, note %q", w.ID, w.Named(), w.Open(),
-				deferred(w), askedAny(w), w.Note)
-		}
-	}
-}
-
-// A closed batch related to an open walk is queued behind it with the reason, while one that shares nothing is
-// cut beside it; the walk that started is never superseded (ADR 0276 decision 4, issue 973).
-func TestARelatedBatchWaitsBehindTheOpenWalk(t *testing.T) {
-	open := windowed(t)
-	asksWithPaths(t)
-	ctx := t.Context()
-	hear(t, open, repoMerge("one", "c1", t0), t0)
-	cutAt(t, open, t0.Add(90*time.Second))
-	first := func() inventory.Plan { ws, _ := walks(t, open); return ws[len(ws)-1] }()
-	heard := t0.Add(100 * time.Second)
-	hear(t, open, lone(repoMerge("one", "c2", heard)), heard)
-	hear(t, open, lone(repoMerge("three", "c3", heard.Add(time.Second))), heard.Add(time.Second))
-	ws, bs := walks(t, open)
-	if len(ws) != 2 || len(bs) != 1 {
-		t.Fatalf("%d walk(s) and %d batch(es); want the unrelated merge walking and the related one queued", len(ws), len(bs))
-	}
-	b := bs[0]
-	words := batchWords(b, heard)
-	if b.State != inventory.PlanQueued || b.Delivery.Batch.Behind != first.ID || b.CommitOf("novox/one") != "c2" ||
-		!strings.Contains(words, "queued behind "+first.ID) || !strings.Contains(words, "both change novox/one") {
-		t.Fatalf("the related batch is %s, behind %q, reading %q", b.State, b.Delivery.Batch.Behind, words)
-	}
-	if got, _ := open.inventory.PlanByID(ctx, first.ID); !got.Open() {
-		t.Fatalf("the started walk was %s by the related merge", got.State)
-	}
-	first.State = inventory.PlanDone
-	if err := open.inventory.SavePlan(ctx, &first); err != nil {
-		t.Fatal(err)
-	}
-	cutAt(t, open, heard.Add(2*time.Second))
-	if _, bs := walks(t, open); len(bs) != 0 {
-		t.Fatalf("the queued batch was not cut once the walk it waited for ended: %+v", bs)
-	}
-}
-
-// A batch on the controller's own path never walks beside another walk, and nothing walks beside it, whatever
-// the two share (issue 973): it replaces the controller, so it goes alone.
-func TestAnOwnPathBatchNeverWalksBeside(t *testing.T) {
-	open := windowed(t)
-	asksWithPaths(t)
-	ctx := t.Context()
-	hear(t, open, repoMerge("one", "c1", t0), t0)
-	cutAt(t, open, t0.Add(90*time.Second))
-	ws, _ := walks(t, open)
-	first := ws[0]
-	heard := t0.Add(100 * time.Second)
-	hear(t, open, lone(repoMerge("mesh-controller", "k1", heard)), heard)
-	ws, bs := walks(t, open)
-	if len(ws) != 1 || len(bs) != 1 || !bs[0].OwnPath() || bs[0].State != inventory.PlanQueued ||
-		bs[0].Delivery.Batch.Behind != first.ID || !strings.Contains(batchWords(bs[0], heard), "own path") {
-		t.Fatalf("an own-path batch beside an open walk: %d walk(s), batches %+v", len(ws), bs)
-	}
-	first.State = inventory.PlanDone
-	if err := open.inventory.SavePlan(ctx, &first); err != nil {
-		t.Fatal(err)
-	}
-	cutAt(t, open, heard.Add(time.Second))
-	ws, _ = walks(t, open)
-	if len(ws) != 2 || !ws[0].Open() || ws[0].CommitOf("novox/mesh-controller") != "k1" {
-		t.Fatalf("the own-path batch was not cut once the walk ended: %+v", ws)
-	}
-	own := ws[0]
-	// Unrelated to the own-path walk by every footprint, a merge still waits for it.
-	later := heard.Add(time.Minute)
-	hear(t, open, lone(repoMerge("two", "c2", later)), later)
-	ws, bs = walks(t, open)
-	if len(ws) != 2 || len(bs) != 1 || bs[0].State != inventory.PlanQueued || bs[0].Delivery.Batch.Behind != own.ID {
-		t.Fatalf("a merge beside the own-path walk: %d walk(s), batches %+v", len(ws), bs)
-	}
-}

cmd/mesh-controller/bindings.go

@@ -4,7 +4,7 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 )
 
@@ -54,25 +54,12 @@ func otherMachines(machine string, nodes ...string) []string {
 	return out
 }
 
-// reportKept says every move a machine's resolution refused, on the push composing it, and raises its
-// condition at once where this process keeps the conditions: a push is when a person is looking.
-func reportKept(ctx context.Context, plan catalogue.Resolution) {
-	for _, k := range plan.Kept {
-		fmt.Printf("%s: the mesh %s\n", plan.Node, k)
-		if conditionsFrom != nil {
-			o := keptObservation(k)
-			o.Source = probeBindingsID
-			if _, err := conditionsFrom.Observe(ctx, o); err != nil {
-				fmt.Printf("%s: and the condition for it could not be raised: %v\n", plan.Node, err)
-			}
-		}
-	}
-}
-
 // probeBindings is D12: every consumer of a provision that keeps its data is bound where it was last
 // sent, on every machine — the resolver kept it there (said, urgent, until a person pins), or a pin
 // moves it (said, so the data goes first), and never anything else.
 func probeBindings(ctx context.Context, d *doctor) ([]conditions.Observation, error) {
+	// One reading of the mesh for every machine this looks at.
+	ctx = withInputCache(ctx)
 	inv := d.open.inventory
 	nodes, err := inv.Nodes(ctx)
 	if err != nil {
@@ -80,7 +67,7 @@ func probeBindings(ctx context.Context, d *doctor) ([]conditions.Observation, er
 	}
 	var out []conditions.Observation
 	for _, n := range nodes {
-		plan, _, err := planFor(ctx, d.open, n.Name)
+		plan, _, err := resolveNode(ctx, d.open, n.Name)
 		if err != nil {
 			if unresolvable(err) {
 				// D1 says it, with the binding that refused it when that is why.

cmd/mesh-controller/bindings_integration_test.go

@@ -6,7 +6,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 )
 
@@ -37,7 +37,7 @@ func TestTheIncidentAConsumerStaysBesideItsDataUntilAPersonPinsIt(t *testing.T)
 	assignAll([2]string{"laptop", "store"}, [2]string{"laptop", "resolver"}, [2]string{"laptop", "network"},
 		[2]string{"laptop", "board"})
 
-	plan, _, err := planFor(ctx, open, "laptop")
+	plan, _, err := resolveNode(ctx, open, "laptop")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -64,7 +64,7 @@ func TestTheIncidentAConsumerStaysBesideItsDataUntilAPersonPinsIt(t *testing.T)
 	if err := inv.Unassign(ctx, "laptop", "store"); err != nil {
 		t.Fatal(err)
 	}
-	if _, _, err := planFor(ctx, open, "laptop"); err == nil || !unresolvable(err) ||
+	if _, _, err := resolveNode(ctx, open, "laptop"); err == nil || !unresolvable(err) ||
 		!strings.Contains(err.Error(), "board on laptop is bound to laptop/store") ||
 		!strings.Contains(err.Error(), "pin laptop postgres-database anchor store") {
 		t.Fatalf("the consumer's store went and it was answered elsewhere: %v", err)
@@ -74,7 +74,7 @@ func TestTheIncidentAConsumerStaysBesideItsDataUntilAPersonPinsIt(t *testing.T)
 	if err := inv.PinProvision(ctx, "laptop", "postgres-database", "anchor", "store"); err != nil {
 		t.Fatal(err)
 	}
-	plan, _, err = planFor(ctx, open, "laptop")
+	plan, _, err = resolveNode(ctx, open, "laptop")
 	if err != nil {
 		t.Fatal(err)
 	}

cmd/mesh-controller/bindings_test.go

@@ -4,7 +4,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 )
 
@@ -75,19 +75,3 @@ func TestBindingFindingsSayAKeptMoveAndAMoveNothingAskedFor(t *testing.T) {
 		t.Error("two consumers, one condition")
 	}
 }
-
-// A push says the move it refused, and raises its condition at once.
-func TestAPushSaysAKeptMoveAndRaisesItsCondition(t *testing.T) {
-	k, _ := withConditionsInMemory(t)
-	reportKept(t.Context(), catalogue.Resolution{Node: "laptop", Kept: []catalogue.KeptBinding{{Machine: "laptop",
-		Consumer: "board", Provision: "postgres-database", Bound: catalogue.Chosen{Node: "home", Module: "store"},
-		Would: catalogue.Chosen{Node: "anchor", Module: "store"}}}})
-	open, err := k.Open(t.Context())
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(open) != 1 || open[0].Kind != kindBindingKept || open[0].Severity != conditions.Urgent ||
-		open[0].Source != probeBindingsID {
-		t.Fatalf("raised %+v", open)
-	}
-}

cmd/mesh-controller/build_seat_test.go

@@ -1,43 +0,0 @@
-package main
-
-import (
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/catalogue"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-func claiming(module, seat string, on ...string) inventory.Entry {
-	return inventory.Entry{
-		Manifest: catalogue.Manifest{Module: module, Claims: []catalogue.Claim{{Name: seat}}},
-		On:       on,
-	}
-}
-
-// The controller asks the build role that has a holder (novox/hq ADR 0190 handover): the retired
-// one while only the builder is assigned, the current one from the first build-agent on, and the
-// current one when nothing holds either — where every ask goes once the handover is done.
-func TestTheControllerAsksTheBuildRoleThatHasAHolder(t *testing.T) {
-	onlyTheBuilder := []inventory.Entry{
-		claiming("builder", link.TheBuildMachineBefore, "anchor"),
-		claiming("build-agent", link.TheBuildMachine), // registered, assigned nowhere yet
-	}
-	if got := buildSeatAmong(onlyTheBuilder); got != link.TheBuildMachineBefore {
-		t.Errorf("with only the builder assigned, asked %q", got)
-	}
-	bothHeld := []inventory.Entry{
-		claiming("builder", link.TheBuildMachineBefore, "anchor"),
-		claiming("build-agent", link.TheBuildMachine, "home-server"),
-	}
-	if got := buildSeatAmong(bothHeld); got != link.TheBuildMachine {
-		t.Errorf("with a build-agent assigned anywhere, asked %q", got)
-	}
-	neither := []inventory.Entry{claiming("builder", link.TheBuildMachineBefore)}
-	if got := buildSeatAmong(neither); got != link.TheBuildMachine {
-		t.Errorf("with no holder of either, asked %q, want the current role", got)
-	}
-	if got := buildSeatAmong(nil); got != link.TheBuildMachine {
-		t.Errorf("an empty catalogue asks %q", got)
-	}
-}

cmd/mesh-controller/build_source.go

@@ -7,10 +7,11 @@ import (
 	"fmt"
 	"os"
 	"regexp"
+	"slices"
 	"strings"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
@@ -75,35 +76,94 @@ func markServed() {
 type sourceForms struct {
 	bases map[string]string // the seat's clone base, `scheme://host:port`, by seat; "" where it is not known
 	base  func(seat string) string
+	// read is base with the reason it is unknown; nil where only base is given. again forces a fresh read past a
+	// failure kept for failedKept.
+	read func(ctx context.Context, seat string, again bool) (string, error)
 }
 
-// newSourceForms reads the seats' bases from the mesh once, when first needed.
+// failedKept is how long an unreadable base is not read again for the callers that loop over every catalogue
+// entry: one composition of the mesh serves them all (novox/hq issue 1277).
+const failedKept = 5 * time.Second
+
+// newSourceForms reads the seats' bases from the mesh when first needed. A base that could not be read is not
+// kept as if it were known: it is read again at the next ask (novox/hq issue 1277).
 func newSourceForms(ctx context.Context, inv *inventory.Inventory) *sourceForms {
-	f := &sourceForms{bases: map[string]string{}}
-	var world *catalogue.World
-	f.base = func(seat string) string {
-		if b, known := f.bases[seat]; known {
-			return b
-		}
-		if world == nil {
-			w := catalogue.World{}
-			if shelf, err := inv.Catalogue(ctx); err == nil {
-				if read, err := theRestOfTheMesh(ctx, inv, shelf, ""); err == nil {
-					w = read
-				}
-			}
-			world = &w
-		}
-		b, err := seatBase(*world, seat)
+	return sourceFormsRead(ctx, time.Now, func(ctx context.Context) (catalogue.World, error) {
+		shelf, err := inv.Catalogue(ctx)
 		if err != nil {
-			b = ""
+			return catalogue.World{}, fmt.Errorf("the catalogue cannot be read: %w", err)
 		}
-		f.bases[seat] = b
+		read, err := restOfTheMeshOf(ctx, inv, shelf, "")
+		if err != nil {
+			return catalogue.World{}, fmt.Errorf("the mesh cannot be read: %w", err)
+		}
+		return read, nil
+	})
+}
+
+// sourceFormsRead is newSourceForms on how the mesh is read, handed in.
+func sourceFormsRead(ctx context.Context, now func() time.Time,
+	readWorld func(context.Context) (catalogue.World, error)) *sourceForms {
+	f := &sourceForms{bases: map[string]string{}}
+	var failedAt time.Time // when the last read failed; zero when it did not
+	var failure error
+	f.read = func(ctx context.Context, seat string, again bool) (string, error) {
+		if b, known := f.bases[seat]; known {
+			return b, nil
+		}
+		if failure != nil && !again && now().Sub(failedAt) < failedKept {
+			return "", failure
+		}
+		world, err := readWorld(ctx)
+		if err == nil {
+			var b string
+			if b, err = seatBase(world, seat); err == nil {
+				failure = nil
+				f.bases[seat] = b
+				return b, nil
+			}
+		}
+		failedAt, failure = now(), err // the holder may be changing now: only an unread base is kept, for a moment
+		return "", err
+	}
+	f.base = func(seat string) string {
+		b, _ := f.read(ctx, seat, false)
 		return b
 	}
 	return f
 }
 
+// forgeAddressWait is the registration's wait for the forge's address (novox/hq issue 1277): a fresh read every
+// 5 s for at most 60 s, as the wait for the forge's answer (issue 486). A variable so a test waits in no real time.
+var forgeAddressWait = waitOut{bound: 60 * time.Second, first: 5 * time.Second, most: 5 * time.Second,
+	now: time.Now, sleep: sleepOrDone}
+
+// forgeAddress is the git seat's base, read again within w's bound while it cannot be read. Where the forms have
+// no reader of their own (a test's), base says it.
+func (f *sourceForms) forgeAddress(ctx context.Context, w waitOut) (string, error) {
+	if f.read == nil {
+		return f.base(gitSeat), nil
+	}
+	began := w.now()
+	for {
+		b, err := f.read(ctx, gitSeat, true)
+		if err == nil {
+			return b, nil
+		}
+		if ctx.Err() != nil {
+			return "", err
+		}
+		if w.now().Sub(began)+w.first > w.bound {
+			return "", fmt.Errorf("after %s: %w", w.now().Sub(began).Round(time.Second), err)
+		}
+		fmt.Printf("the forge's address cannot be read now (%v); reading it again in %s, for at most %s in all "+
+			"(novox/hq issue 1277)\n", err, w.first, w.bound)
+		if serr := w.sleep(ctx, w.first); serr != nil {
+			return "", err
+		}
+	}
+}
+
 // canonical is one spelling of a repository: lower case, no `.git`, no trailing slash, and a seat's path as
 // the URL its holder serves it at where that is known.
 func (f *sourceForms) canonical(repository, seat string) string {
@@ -129,25 +189,13 @@ func (f *sourceForms) same(aRepository, aSeat, bRepository, bSeat string) bool {
 	return f.canonical(aRepository, aSeat) == f.canonical(bRepository, bSeat)
 }
 
-// buildsFrom says the catalogue builds some module from this repository.
-func (f *sourceForms) buildsFrom(entries []inventory.Entry, repository, seat string) bool {
-	for _, e := range entries {
-		if e.Provided || e.Source.Repository == "" {
-			continue
-		}
-		if f.same(e.Source.Repository, e.Source.Seat, repository, seat) {
-			return true
-		}
-	}
-	return false
-}
-
 // forgeFacts is what the mesh's forge says of a repository a module is registered from (novox/hq ADR 0266).
 type forgeFacts struct {
 	// ID is the forge's own id of the repository: what tells it from one deleted and made again by its name.
 	ID int64
-	// Guarded is whether the branch is protected as a module's trunk must be: no direct push, at least one
-	// required status, and no administrator merging past one. Why says what is missing when it is not.
+	// Guarded is whether the branch is protected as a module's trunk must be: no direct push, a merge whitelist naming
+	// the tools' account and no agent's account, and no administrator merging past the rule (novox/hq ADR 0534 §6; no
+	// required status, which the forge no longer asks, §1). Why says what is missing when it is not.
 	Guarded bool
 	Why     string
 }
@@ -156,11 +204,29 @@ type forgeFacts struct {
 // protection, waiting out a forge not served for a moment (novox/hq issue 486). A variable so a test needs no
 // forge.
 var askTheForge = func(ctx context.Context, owner, repo, branch string) (forgeFacts, error) {
-	return forgeWaitedOut(ctx, forgeWait, owner+"/"+repo, func(ctx context.Context) (forgeFacts, error) {
+	return askedWithinBudget(ctx, owner+"/"+repo, func(ctx context.Context) (forgeFacts, error) {
 		return askTheForgeOnce(ctx, owner, repo, branch)
 	})
 }
 
+type forgeBudgetKey struct{}
+
+// withForgeBudget says how much of the registration's one wait is left for the forge's answer: the wait for its
+// address has used the rest (novox/hq issue 1277). The registration holds the controller's one receive loop, so the
+// two waits together keep to one bound.
+func withForgeBudget(ctx context.Context, left time.Duration) context.Context {
+	return context.WithValue(ctx, forgeBudgetKey{}, max(left, 0))
+}
+
+// askedWithinBudget is forgeWaitedOut with forgeWait's bound, or what is left of it when the address was waited for.
+func askedWithinBudget(ctx context.Context, repository string, ask func(context.Context) (forgeFacts, error)) (forgeFacts, error) {
+	w := forgeWait
+	if left, ok := ctx.Value(forgeBudgetKey{}).(time.Duration); ok {
+		w.bound = min(w.bound, left)
+	}
+	return forgeWaitedOut(ctx, w, repository, ask)
+}
+
 // waitOut bounds how long a question is asked again while its answer is "not now": a pause of first, doubling
 // to most, for at most bound in all. now and sleep are the clock, so a test waits in no real time.
 type waitOut struct {
@@ -284,46 +350,68 @@ func askTheForgeOnce(ctx context.Context, owner, repo, branch string) (forgeFact
 	return facts, nil
 }
 
+// forgeToolsAccount is the forge tools' account, which main's merge whitelist names for mesh-delivery (novox/hq ADR 0398
+// §2, the gitea module's tools-account.ts TOOLS_ACCOUNT); beside it the whitelist names only people's own logins, the
+// operator's (ADR 0534 §2), never an agent's account.
+const forgeToolsAccount = "mesh-tools"
+
+// isAgentAccount is whether a forge login is a node's agent's account, agent-<node> (novox/hq ADR 0398 §1): one that
+// may never merge into a module's trunk by itself.
+func isAgentAccount(login string) bool { return strings.HasPrefix(login, "agent-") }
+
 // protectionRule is a branch protection rule as the forge's tool summarises it.
 type protectionRule struct {
 	Rule             string   `json:"rule"`
 	Push             bool     `json:"push"`
 	RequiredStatuses []string `json:"required_statuses"`
 	AdminMayOverride bool     `json:"admin_may_override"`
+	// MergeWhitelist is who may merge into the branch; nil when the rule keeps no merge whitelist (anyone who writes).
+	MergeWhitelist []string `json:"merge_whitelist"`
 }
 
 // judgedRule judges the one rule the forge applies to a branch, as the forge picks it: the rule named for the
 // branch, else the first glob rule, in the forge's order, that covers it (gitea's first matching rule). Never a
-// later rule that happens to be stronger: the forge does not read it.
+// later rule that happens to be stronger: the forge does not read it. A trunk is trusted for who can land a commit on
+// it, not for a status it requires (novox/hq ADR 0534 §6): no push, a merge whitelist naming the tools' account and
+// beside it only people's own logins, never an agent's, and no administrator merging past the rule; then a commit lands
+// there through mesh-delivery, on a passing mesh/check and the operator's Approve (ADR 0534 §4), or by the operator's
+// own hand at the forge (§2).
 func judgedRule(rules []protectionRule, branch string) forgeFacts {
-	var applied *protectionRule
-	for i := range rules {
-		if rules[i].Rule == branch {
-			applied = &rules[i]
-			break
-		}
-	}
-	if applied == nil {
-		for i := range rules {
-			if ruleCovers(rules[i].Rule, branch) {
-				applied = &rules[i]
-				break
-			}
-		}
-	}
-	switch r := applied; {
+	switch r := appliedRule(rules, branch); {
 	case r == nil:
 		return forgeFacts{Why: fmt.Sprintf("no protection rule covers %s", branch)}
 	case r.Push:
 		return forgeFacts{Why: fmt.Sprintf("the rule %s lets a person push to %s directly", r.Rule, branch)}
-	case len(r.RequiredStatuses) == 0:
-		return forgeFacts{Why: fmt.Sprintf("the rule %s requires no status before a merge into %s", r.Rule, branch)}
+	case r.MergeWhitelist == nil || len(r.MergeWhitelist) == 0:
+		return forgeFacts{Why: fmt.Sprintf("the rule %s keeps no merge whitelist naming %s alone for %s", r.Rule, forgeToolsAccount, branch)}
+	case !slices.Contains(r.MergeWhitelist, forgeToolsAccount):
+		return forgeFacts{Why: fmt.Sprintf("the rule %s lets %s merge into %s, and not %s", r.Rule,
+			strings.Join(r.MergeWhitelist, ", "), branch, forgeToolsAccount)}
+	case slices.ContainsFunc(r.MergeWhitelist, isAgentAccount):
+		return forgeFacts{Why: fmt.Sprintf("the rule %s lets an agent's account merge into %s: %s", r.Rule, branch,
+			strings.Join(r.MergeWhitelist, ", "))}
 	case r.AdminMayOverride:
-		return forgeFacts{Why: fmt.Sprintf("the rule %s lets an administrator merge into %s past a status", r.Rule, branch)}
+		return forgeFacts{Why: fmt.Sprintf("the rule %s lets an administrator merge into %s past it", r.Rule, branch)}
 	}
 	return forgeFacts{Guarded: true}
 }
 
+// appliedRule is the one rule the forge applies to a branch: the rule named for it, else the first glob rule, in the
+// forge's order, that covers it; nil when none does.
+func appliedRule(rules []protectionRule, branch string) *protectionRule {
+	for i := range rules {
+		if rules[i].Rule == branch {
+			return &rules[i]
+		}
+	}
+	for i := range rules {
+		if ruleCovers(rules[i].Rule, branch) {
+			return &rules[i]
+		}
+	}
+	return nil
+}
+
 // ruleCovers says a protection rule's name — a branch, or a glob of them — covers a branch, as the forge reads it.
 func ruleCovers(rule, branch string) bool {
 	if rule == branch {
@@ -386,25 +474,78 @@ func (f *sourceForms) onTheForge(repository, seat string) (owner, name string, o
 //   - from the module's registered repository — the same repository by the forge's own id, not only its name; or,
 //     for a module new to the catalogue, from a repository the catalogue builds another module from;
 //   - and from a repository on the mesh's forge whose trunk is protected as a trunk must be: no direct push, at
-//     least one required status, no administrator merging past one.
+//     a merge whitelist naming the tools' account and no agent's, no administrator merging past the rule (ADR 0534 §6).
 //
 // Anything else only when the build request was kept as asked at the controller's terminal, for this very
-// repository and path. path is the module's directory as built; branch the trunk it is registered from.
+// repository and path; or, for the build of a merge, when mesh-delivery announced it on the operator's Approve of
+// that head (novox/hq ADR 0420 §7 for a moved module, ADR 0432 for a new one), the forge's checks still holding. path is the module's directory as built; branch the trunk it is registered from.
 func mayRegisterFrom(ctx context.Context, inv *inventory.Inventory, module string, built inventory.Source,
-	buildID, path, branch string) (int64, error) {
-	forms := newSourceForms(ctx, inv)
+	ask registrationAsk, path, branch string) (int64, error) {
+	return mayRegisterIn(ctx, inv, newSourceForms(ctx, inv), module, built, ask, path, branch)
+}
+
+// registrationAsk is what a registration's warrant is read from (novox/hq ADR 0501 §3): the build an outcome answers,
+// whose kept request says whether it was asked at the terminal or for a merge (build-agent's outcome, the builder's own
+// module until R4g); or, for a take-in from the builder's done key, the merge the indexer's trunk value names and
+// whether the operator asked the registration at the controller's terminal (ADR 0501 §4). A key asks no build, so it
+// keeps no request.
+type registrationAsk struct {
+	// Build is the build whose kept request is read; empty for a take-in from a key.
+	Build string
+	// Merge is the commit of the merge a key's module is registered from (the indexer's trunk value); empty for an
+	// outcome, whose request names it.
+	Merge string
+	// Terminal is a key registration the operator asked at the controller's terminal for this repository and path.
+	Terminal bool
+}
+
+// String is the ask as the registration's words name it.
+func (a registrationAsk) String() string {
+	switch {
+	case a.Build != "":
+		return a.Build
+	case a.Terminal:
+		return "the registration asked at the terminal"
+	case a.Merge != "":
+		return fmt.Sprintf("the merge %.8s", a.Merge)
+	}
+	return "a key"
+}
+
+// catalogueReader is the catalogue's manifests, as the router's records are found in them.
+type catalogueReader interface {
+	Catalogue(ctx context.Context) (map[string]catalogue.Manifest, error)
+}
+
+// registrations is what a registration's decision reads of the mesh: *inventory.Inventory, or a test's stand-in.
+type registrations interface {
+	catalogueReader
+	SourceOf(ctx context.Context, module string) (inventory.Source, error)
+	SourceIdentity(ctx context.Context, module string) (int64, error)
+	Catalogued(ctx context.Context) ([]inventory.Entry, error)
+	BuildRequestByID(ctx context.Context, id string) (inventory.BuildRequest, bool, error)
+}
+
+// mayRegisterIn is mayRegisterFrom on what it reads of the mesh handed in.
+func mayRegisterIn(ctx context.Context, inv registrations, forms *sourceForms, module string, built inventory.Source,
+	ask registrationAsk, path, branch string) (int64, error) {
+	buildID := ask.String()
 	was, err := inv.SourceOf(ctx, module)
 	isNew := errors.Is(err, inventory.ErrNoSuchModule)
 	if err != nil && !isNew {
 		return 0, err
 	}
-	terminal, err := askedHereFor(ctx, inv, forms, buildID, built, path)
-	if err != nil {
-		return 0, err
+	terminal := ask.Terminal
+	if ask.Build != "" {
+		var err error
+		if terminal, err = askedHereFor(ctx, inv, forms, ask.Build, built, path); err != nil {
+			return 0, err
+		}
 	}
 	refuse := func(why string) (int64, error) {
 		return 0, fmt.Errorf("%w: %s. A module is registered from such a source only by a build asked at the "+
-			"controller's terminal, never through a verb: a registered module is what the next push sends, and whoever "+
+			"controller's terminal, or by the build of a merge mesh-delivery announced on the operator's Approve of that "+
+			"head, never through a verb: a registered module is what the next push sends, and whoever "+
 			"may call a verb includes agents (novox/hq ADR 0266)", errNotItsSource, why)
 	}
 
@@ -438,9 +579,12 @@ func mayRegisterFrom(ctx context.Context, inv *inventory.Inventory, module strin
 	// **Or the move the operator approved** (novox/hq ADR 0420 §7, issue 1025): a known module built from another
 	// repository by a merge, whose pull request mesh-delivery merged on the operator's Approve of that head.
 	// A verb alone, or a merge with no such warrant, is refused as before.
+	// **Or a new module from a repository nothing registered is built from, on the same warrant** (novox/hq ADR 0432,
+	// issue 1146): the build of a merge mesh-delivery announced on the operator's Approve of that head registers it.
+	// The forge's protection and the repository's identity are checked below as for every registration.
 	movedWhy := ""
-	if why != "" && !terminal && !isNew {
-		accepted, err := approvedMove(ctx, inv, forms, buildID, built)
+	if why != "" && !terminal {
+		accepted, err := approvedMove(ctx, inv, forms, ask, built)
 		switch {
 		case err == nil:
 			movedWhy, why = accepted, ""
@@ -453,6 +597,24 @@ func mayRegisterFrom(ctx context.Context, inv *inventory.Inventory, module strin
 		return refuse(why)
 	}
 
+	if built.Seat == "" {
+		// A URL is judged against the forge's address: an address that cannot be read is no proof the source is
+		// elsewhere (novox/hq issue 1277).
+		began := forgeAddressWait.now()
+		addressCtx, cancel := context.WithTimeout(ctx, forgeAddressWait.bound)
+		_, err := forms.forgeAddress(addressCtx, forgeAddressWait)
+		cancel()
+		ctx = withForgeBudget(ctx, forgeAddressWait.bound-forgeAddressWait.now().Sub(began))
+		if err != nil {
+			if terminal {
+				fmt.Printf("%s: the forge's address could not be read (%v) — registered, as asked at the controller's "+
+					"terminal\n", buildID, err)
+				return 0, nil
+			}
+			return refuse(fmt.Sprintf("the forge's address could not be read (%v), so whether %s's trunk is "+
+				"protected cannot be read", err, sourceWords(built.Repository, built.Seat)))
+		}
+	}
 	owner, name, onForge := forms.onTheForge(built.Repository, built.Seat)
 	if !onForge {
 		if terminal {
@@ -507,7 +669,10 @@ func mayRegisterFrom(ctx context.Context, inv *inventory.Inventory, module strin
 				owner, name, m, facts.ID, m, id))
 		}
 	}
-	if movedWhy != "" {
+	if movedWhy != "" && isNew {
+		fmt.Printf("%s: %s is new, from %s/%s — registered at the operator's Approve: %s\n", buildID, module, owner, name,
+			movedWhy)
+	} else if movedWhy != "" {
 		fmt.Printf("%s: %s moved from %s to %s/%s — registered at the operator's Approve: %s\n", buildID, module,
 			sourceWords(was.Repository, was.Seat), owner, name, movedWhy)
 	}
@@ -516,7 +681,7 @@ func mayRegisterFrom(ctx context.Context, inv *inventory.Inventory, module strin
 
 // askedHereFor says the build was asked at the controller's terminal, for this repository and this path: a kept
 // request marked so, whose source is the outcome's (novox/hq ADR 0266).
-func askedHereFor(ctx context.Context, inv *inventory.Inventory, forms *sourceForms, buildID string,
+func askedHereFor(ctx context.Context, inv registrations, forms *sourceForms, buildID string,
 	built inventory.Source, path string) (bool, error) {
 	r, found, err := inv.BuildRequestByID(ctx, buildID)
 	if err != nil || !found || !r.AtTerminal {
@@ -538,29 +703,3 @@ func sourceWords(repository, seat string) string {
 	}
 	return buildSource{Repository: repository, Seat: seat}.String()
 }
-
-// verbMayAsk refuses, for a call through a verb, a build of a repository the catalogue builds no module from
-// (novox/hq ADR 0266): the build node would run what an agent wrote, and its outcome could never be
-// registered anyway. url is the repository as it is cloned. At the terminal anything may be asked.
-func verbMayAsk(ctx context.Context, source buildSource, url string) error {
-	if startedAtTheTerminal() {
-		return nil
-	}
-	open, err := openStores(ctx)
-	if err != nil {
-		return err
-	}
-	defer open.Close()
-	entries, err := open.inventory.Catalogued(ctx)
-	if err != nil {
-		return err
-	}
-	forms := newSourceForms(ctx, open.inventory)
-	if forms.buildsFrom(entries, source.Repository, source.Seat) || forms.buildsFrom(entries, url, "") {
-		return nil
-	}
-	return terminalRefusal("%s is no repository the catalogue builds a module from, and a build of any other is "+
-		"asked at the controller's terminal only, never through a verb: a build node runs what the repository "+
-		"says, and its outcome would register a module the next push sends — whoever may call a verb includes "+
-		"agents (novox/hq ADR 0266). Nothing was asked", source)
-}

cmd/mesh-controller/build_source_integration_test.go

@@ -129,62 +129,6 @@ func TestADeliveryFromTheRegisteredRepositoryIsRegistered(t *testing.T) {
 	}
 }
 
-func TestAVerbAsksNoBuildOfARepositoryTheCatalogueDoesNotBuildFrom(t *testing.T) {
-	theCatalogue(t)
-	ctx := t.Context()
-	t.Setenv(verbVar, "build")
-	t.Setenv(link.CallerVar, "node-tools.anchor, through the mesh-controller seat")
-	err := verbMayAsk(ctx, buildSource{Repository: "agent/sudo", Seat: "git"}, "http://forge.internal:20000/agent/sudo.git")
-	var policy *heldAtTheTerminal
-	if !errors.As(err, &policy) {
-		t.Fatalf("a verb's build of an agent's repository was asked: %v", err)
-	}
-	if err := verbMayAsk(ctx, buildSource{Repository: "novox/mesh-catalog", Seat: "git"},
-		"http://forge.internal:20000/novox/mesh-catalog.git"); err != nil {
-		t.Fatalf("a verb's build of the catalogue repository was refused: %v", err)
-	}
-	t.Setenv(verbVar, "")
-	t.Setenv(link.CallerVar, "")
-	if err := verbMayAsk(ctx, buildSource{Repository: "agent/sudo", Seat: "git"}, ""); err != nil {
-		t.Fatalf("the terminal was refused: %v", err)
-	}
-}
-
-func TestARollbackNeverPutsBackABuildFromAnotherRepository(t *testing.T) {
-	open := theCatalogue(t)
-	ctx := t.Context()
-	inv := open.inventory
-	fork := onTrunk("build-1791500000000000000", "agent/mesh-catalog", "git", "modules/sudo",
-		map[string]any{"module": "sudo", "version": "evil"})
-	fork.Commit = "c0ffee0123456789" // the commit sudo was registered at
-	keptAsked(t, inv, fork.ID, "agent/mesh-catalog", "modules/sudo", false)
-	if _, _, err := takeIn(ctx, inv, fork); !errors.Is(err, errNotItsSource) {
-		t.Fatalf("the fork's build was taken in: %v", err)
-	}
-	// Asked after the registered build, whenever the test runs: an id naming a fixed moment read as older
-	// than the registered build once the clock passed it (2026-10-10 02:40 UTC), and the test failed on main.
-	failed := onTrunk(fmt.Sprintf("build-%d", time.Now().Add(time.Hour).UnixNano()), "novox/mesh-catalog", "git", "modules/sudo",
-		map[string]any{"module": "sudo", "version": "2"})
-	failed.Commit = "badbadbad0123456"
-	if _, _, err := takeIn(ctx, inv, failed); err != nil {
-		t.Fatal(err)
-	}
-	record, _, err := inv.BuildByID(ctx, failed.ID)
-	if err != nil {
-		t.Fatal(err)
-	}
-	previous, found, err := inv.PreviousBuild(ctx, "sudo", "c0ffee0123456789", record)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if found && previous.ID == fork.ID {
-		t.Fatalf("a rollback would put back the fork's build %s", previous.ID)
-	}
-	if !found || previous.ID != "build-sudo" {
-		t.Fatalf("a rollback puts back %q (found %v), want the registered build-sudo", previous.ID, found)
-	}
-}
-
 func TestATrunkTheForgeDoesNotProtectRegistersNothing(t *testing.T) {
 	open := theCatalogue(t)
 	ctx := t.Context()
@@ -317,7 +261,7 @@ func TestAModuleMovesOnTheOperatorsApproveOfTheMergeThatMovedIt(t *testing.T) {
 		keptDeliveryMerge = func(_ context.Context, owner, repo string, number int, head string) (deliveryMerge, bool, error) {
 			return a.merge, !c.unkept && owner == "novox" && repo == "mesh-host" && number == 7 && head == a.merge.HeadSHA, nil
 		}
-		routerAskOf = func(_ context.Context, _ *inventory.Inventory, id string) (*asks.Ask, *asks.Warrant, error) {
+		routerAskOf = func(_ context.Context, _ catalogueReader, _, id string) (*asks.Ask, *asks.Warrant, error) {
 			if id != a.merge.AskID {
 				t.Errorf("%s: the router was asked for %q", c.what, id)
 			}
@@ -326,10 +270,11 @@ func TestAModuleMovesOnTheOperatorsApproveOfTheMergeThatMovedIt(t *testing.T) {
 		t.Cleanup(func() { keptDeliveryMerge, routerAskOf = wasKept, wasAsk })
 		event, _ := json.Marshal(map[string]any{"owner": "novox", "repo": "mesh-host", "base": "main", "number": 7,
 			"head_sha": a.merge.HeadSHA, "merge_commit_sha": commit})
-		if _, err := inv.AddMerge(ctx, inventory.BatchedMerge{Repository: "novox/mesh-host", Branch: "main", Commit: commit,
-			Merged: time.Now(), Heard: time.Now(), Event: event}); err != nil {
-			t.Fatal(err)
-		}
+		var forgeMerge keptMerge
+		_ = json.Unmarshal(event, &forgeMerge)
+		wasForge := keptForgeMerge
+		t.Cleanup(func() { keptForgeMerge = wasForge })
+		keptForgeMerge = func(context.Context, string, string, string) (keptMerge, bool, error) { return forgeMerge, true, nil }
 		id := fmt.Sprintf("build-%d", time.Now().Add(time.Hour).UnixNano())
 		if err := inv.RecordBuildRequest(ctx, inventory.BuildRequest{ID: id, Repository: "novox/mesh-host", Seat: "git",
 			Path: "modules/sudo", Ref: "main", Commit: commit, For: c.request}); err != nil {

cmd/mesh-controller/build_source_test.go

@@ -102,16 +102,17 @@ func init() {
 // The forge applies one rule to a branch: the rule named for it, else the first glob that covers it. A stronger
 // rule later in the list is not what guards the branch, and is not read as if it were (the confirmation review).
 func TestTheRuleJudgedIsTheOneTheForgeApplies(t *testing.T) {
-	guarded := protectionRule{Rule: "*", RequiredStatuses: []string{"mesh/merge-gate"}}
-	open := protectionRule{Rule: "main", Push: true, RequiredStatuses: []string{"mesh/merge-gate"}}
+	tools := []string{forgeToolsAccount}
+	guarded := protectionRule{Rule: "*", MergeWhitelist: tools}
+	open := protectionRule{Rule: "main", Push: true, MergeWhitelist: tools}
 	if f := judgedRule([]protectionRule{guarded, open}, "main"); f.Guarded {
 		t.Error("an exact rule letting pushes was passed over for a glob that guards")
 	}
-	if f := judgedRule([]protectionRule{{Rule: "ma*", RequiredStatuses: nil}, {Rule: "*", RequiredStatuses: []string{"x"}}},
+	if f := judgedRule([]protectionRule{{Rule: "ma*", MergeWhitelist: nil}, {Rule: "*", MergeWhitelist: tools}},
 		"main"); f.Guarded || !strings.Contains(f.Why, "ma*") {
 		t.Errorf("the first glob covering the branch was not the one judged: %+v", f)
 	}
-	if f := judgedRule([]protectionRule{{Rule: "release/*"}, {Rule: "main", RequiredStatuses: []string{"x"}}}, "main"); !f.Guarded {
+	if f := judgedRule([]protectionRule{{Rule: "release/*"}, {Rule: "main", MergeWhitelist: tools}}, "main"); !f.Guarded {
 		t.Errorf("the rule named for the branch was not judged: %+v", f)
 	}
 	if f := judgedRule(nil, "main"); f.Guarded {
@@ -119,6 +120,39 @@ func TestTheRuleJudgedIsTheOneTheForgeApplies(t *testing.T) {
 	}
 }
 
+// **A module's trunk is trusted when it takes no push, only the tools' account and people's own logins merge into it,
+// and no administrator merges past its rule** (novox/hq ADR 0534 §2, §6): the forge requires no status to merge (§1), so
+// a rule requiring none is trusted; one with no merge whitelist, no tools' account in it, an agent's account in it, a
+// push allowed or an administrator's override is not.
+func TestATrunkIsTrustedForItsMergersNotForAStatus(t *testing.T) {
+	tools := []string{forgeToolsAccount}
+	for _, c := range []struct {
+		name string
+		rule protectionRule
+		want bool
+		why  string
+	}{
+		{"no status, no push, the tools alone merge", protectionRule{Rule: "main", MergeWhitelist: tools}, true, ""},
+		{"a status required as well", protectionRule{Rule: "main", MergeWhitelist: tools, RequiredStatuses: []string{"mesh/check"}}, true, ""},
+		{"no merge whitelist", protectionRule{Rule: "main"}, false, "merge whitelist"},
+		{"an empty merge whitelist", protectionRule{Rule: "main", MergeWhitelist: []string{}}, false, "merge whitelist"},
+		{"the operator's own login beside the tools", protectionRule{Rule: "main", MergeWhitelist: []string{forgeToolsAccount, "jschoubben"}}, true, ""},
+		{"an agent's account in the whitelist", protectionRule{Rule: "main", MergeWhitelist: []string{forgeToolsAccount, "agent-ace"}}, false, "agent-ace"},
+		{"an agent's account alone", protectionRule{Rule: "main", MergeWhitelist: []string{"agent-ace"}}, false, "agent-ace"},
+		{"a person's login without the tools", protectionRule{Rule: "main", MergeWhitelist: []string{"jschoubben"}}, false, forgeToolsAccount},
+		{"a push allowed", protectionRule{Rule: "main", Push: true, MergeWhitelist: tools}, false, "push"},
+		{"an administrator's override", protectionRule{Rule: "main", MergeWhitelist: tools, AdminMayOverride: true}, false, "administrator"},
+	} {
+		f := judgedRule([]protectionRule{c.rule}, "main")
+		if f.Guarded != c.want || !strings.Contains(f.Why, c.why) {
+			t.Errorf("%s: %+v, want guarded %v saying %q", c.name, f, c.want, c.why)
+		}
+		if strings.Contains(f.Why, "requires no status") {
+			t.Errorf("%s: a trunk is still judged on a required status: %s", c.name, f.Why)
+		}
+	}
+}
+
 // An id the forge could not give keeps the id already recorded.
 
 // **The operator's Approve of a reviewed group registers a moved module from its new repository** (novox/hq ADR 0420 §7,

cmd/mesh-controller/build_test.go

@@ -1,9 +1,12 @@
 package main
 
 import (
+	"bytes"
+	"strings"
 	"testing"
 	"time"
 
+	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
 
@@ -32,3 +35,34 @@ func TestABuildIDSaysWhenItWasAsked(t *testing.T) {
 		}
 	}
 }
+
+// novox/hq issue 1204: builds says the source fingerprint the builder recorded, the one tool that reads it.
+func TestBuildsSaysTheSourceFingerprint(t *testing.T) {
+	at := time.Date(2026, 10, 19, 10, 40, 0, 0, time.UTC)
+	built := inventory.Build{ID: "build-1", Module: "mailu", Commit: "b4527d9091e972f28cb365623d9280045e7741a3", On: "ace",
+		Repository: "novox/mesh-catalog", At: at, ReuseKey: "r1:abc",
+		SourceFingerprint: "src1:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"}
+
+	// 1204/AC1
+	var out bytes.Buffer
+	printBuild(&out, built)
+	lines := strings.Split(strings.TrimRight(out.String(), "\n"), "\n")
+	if last := lines[len(lines)-1]; last != "    source     "+built.SourceFingerprint {
+		t.Errorf("last line %q; want the source line after the reuse key:\n%s", last, out.String())
+	}
+	if !strings.Contains(lines[len(lines)-2], "reuse key  r1:abc") {
+		t.Errorf("the source line does not follow the reuse key:\n%s", out.String())
+	}
+
+	// 1204/AC2
+	without := built
+	without.SourceFingerprint = ""
+	var plain bytes.Buffer
+	printBuild(&plain, without)
+	if strings.Contains(plain.String(), "source") {
+		t.Errorf("a build with no fingerprint says a source line:\n%s", plain.String())
+	}
+	if want := strings.Join(lines[:len(lines)-1], "\n") + "\n"; plain.String() != want {
+		t.Errorf("the other lines changed:\n%s\nwant\n%s", plain.String(), want)
+	}
+}

cmd/mesh-controller/builder_on_the_bus_test.go

@@ -0,0 +1,109 @@
+//go:build integration
+
+package main
+
+import (
+	"context"
+	"testing"
+
+	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
+	"github.com/nats-io/nats.go/jetstream"
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/testbus"
+)
+
+// builderOnTheBus is the builder's and the indexer's buckets on a test's own bus, which the controller's connection for
+// the moment (servingBus) reaches: what a take-in from a key reads (R4e, issue 1851).
+type builderOnTheBus struct {
+	js                         *broker.JetStream
+	builds, modules, manifests jetstream.KeyValue
+}
+
+func aBuilderOnTheBus(t *testing.T) builderOnTheBus {
+	t.Helper()
+	js, err := broker.Dial(testbus.URL(t))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(js.Close)
+	api, err := jetstream.New(js.Conn())
+	if err != nil {
+		t.Fatal(err)
+	}
+	ctx := t.Context()
+	b := builderOnTheBus{js: js}
+	for _, c := range []struct {
+		into    *jetstream.KeyValue
+		bucket  string
+		history uint8
+	}{
+		{&b.builds, sdkdelivery.BuilderBuildsBucket, sdkdelivery.BuilderBuildsHistory},
+		{&b.modules, sdkdelivery.ModulesBucket, sdkdelivery.ModulesHistory},
+		{&b.manifests, sdkdelivery.ManifestsBucket, 1},
+	} {
+		kv, err := api.CreateKeyValue(ctx, jetstream.KeyValueConfig{Bucket: c.bucket, History: c.history})
+		if err != nil {
+			t.Fatal(err)
+		}
+		*c.into = kv
+	}
+	servingBus.Store(js)
+	t.Cleanup(func() { servingBus.Store(nil) })
+	withTrunkList(t, true)
+	// The indexer on this bus is read, not the "not held" a mesh with no bus reads (aMeshOnTheStore).
+	wasIndexed := indexedModule
+	indexedModule = theIndexedModule
+	t.Cleanup(func() { indexedModule = wasIndexed })
+	return b
+}
+
+// indexed writes the indexer's trunk value of module at commit, naming fp, and its manifest: a module of one archive.
+func (b builderOnTheBus) indexed(t *testing.T, module, version, repository, path, commit, fp string) string {
+	t.Helper()
+	keys, trunk := aKeyFor(module, version, fp, repository, path, commit)
+	raw := keys.manifests[trunk.Manifest]
+	value, err := sdkdelivery.EncodeManifest(sdkdelivery.Manifest{Module: module, JSON: raw})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := b.manifests.Put(context.Background(), trunk.Manifest, value); err != nil {
+		t.Fatal(err)
+	}
+	trunk.FP = "src1:" + fp[len("src2:"):]
+	encoded, err := sdkdelivery.EncodeModule(trunk)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := b.modules.Put(context.Background(), module, encoded); err != nil {
+		t.Fatal(err)
+	}
+	return trunk.Manifest
+}
+
+// built writes the builder's key of module at fp: done, its one archive named with a reference, or in another state.
+func (b builderOnTheBus) built(t *testing.T, module, version, fp, manifest, state string) {
+	t.Helper()
+	keys, _ := aKeyFor(module, version, fp, "", "", "")
+	v := keys.keys[module].Build
+	v.Manifest = manifest
+	if state != sdkdelivery.BuildDone {
+		v = sdkdelivery.BuilderBuild{State: state, By: "ace"}
+		if state == sdkdelivery.BuildFailed {
+			v.Error = "digests differ: ace sha256:1, g14 sha256:2"
+		}
+	}
+	value, err := sdkdelivery.EncodeBuilderBuild(v)
+	if err != nil {
+		t.Fatal(err)
+	}
+	key, err := sdkdelivery.BuilderBuildKey(module, fp)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := b.builds.Put(context.Background(), key, value); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// theIndexedModule is the look at the indexer as the controller makes it, kept before any test replaces it.
+var theIndexedModule = indexedModule

cmd/mesh-controller/bus_runs_test.go

@@ -0,0 +1,29 @@
+package main
+
+import (
+	"context"
+	"testing"
+)
+
+// 1945 (dev-r6-controller's B8 follows it): what a bus machine runs is read from its have, not from a send kept, so a
+// machine whose have names the build the mesh holds is not moved by a bus upgrade, and one whose have names an older
+// build is.
+func TestABusMachineRunsWhatItsHaveNames(t *testing.T) {
+	was := busRuns
+	t.Cleanup(func() { busRuns = was })
+	busRuns = func(_ context.Context, node, _ string) (string, bool, error) {
+		return map[string]string{"novox": "src2:new", "ace": "src2:old"}[node], node != "g14", nil
+	}
+	b := busPending{module: "nats", to: "c-new", from: map[string]string{}, same: map[string]bool{}}
+	commitOf := map[string]string{"src2:new": "c-new", "src2:old": "c-old"}
+	for _, n := range []string{"novox", "ace", "g14"} {
+		fp, known, _ := busRuns(context.Background(), n, "nats")
+		if c, ok := commitOf[fp]; known && ok {
+			b.from[n] = c
+		}
+	}
+	if b.moves("novox") || !b.moves("ace") || !b.moves("g14") {
+		t.Errorf("novox moves %v (runs the new build), ace %v (an older one), g14 %v (says none)", b.moves("novox"),
+			b.moves("ace"), b.moves("g14"))
+	}
+}

cmd/mesh-controller/bus_step.go

@@ -10,8 +10,10 @@ import (
 	"time"
 
 	"github.com/nats-io/nats.go"
+	"github.com/nats-io/nats.go/jetstream"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
@@ -111,20 +113,44 @@ func pendingBus(ctx context.Context, inv *inventory.Inventory) (busPending, erro
 			b.same[commit] = true
 		}
 	}
+	// What each machine runs is its have's fingerprint (novox/hq ADR 0539 clause 9), the commit of the build of it.
+	commitOf := map[string]string{}
+	for commit, src := range sources {
+		if src != "" {
+			commitOf[src] = commit
+		}
+	}
 	for _, n := range b.machines {
-		sent, known, err := inv.SentBuilds(ctx, n)
+		fp, known, err := busRuns(ctx, n, b.module)
 		if err != nil {
 			return b, err
 		}
-		if known {
-			if c, carried := sent[b.module]; carried {
-				b.from[n] = c
-			}
+		if c, ok := commitOf[fp]; known && ok {
+			b.from[n] = c
 		}
 	}
 	return b, nil
 }
 
+// busRuns is the fingerprint a machine's node-engine says it runs of a module, from its have; known is false when it
+// says none. A variable so a test reads it without a bus.
+var busRuns = func(ctx context.Context, node, module string) (string, bool, error) {
+	bus, err := aBus()
+	if err != nil {
+		return "", false, err
+	}
+	defer bus.Close()
+	js, err := jetstream.New(bus.Conn())
+	if err != nil {
+		return "", false, err
+	}
+	h, found, err := haveOn(ctx, js, node, module)
+	if err != nil || !found || h.FP == "" {
+		return "", false, err
+	}
+	return h.FP, true, nil
+}
+
 // busHeld names the machines a push may not send because sending them would replace the bus: the
 // planned step's, not a push's (ADR 0236). Said with the remedy.
 func busHeld(ctx context.Context, inv *inventory.Inventory, machines []string) (map[string]string, error) {
@@ -229,17 +255,85 @@ func busCommand(ctx context.Context, args []string) error {
 	fmt.Printf("bus upgrade %d: %s %s → %s on %s; streams snapshotted at %s; %s\n", step.ID, b.module, step.From,
 		short(b.to), strings.Join(moving, ", "), where, map[bool]string{true: "reversible: putting the old build back undoes it",
 			false: "NOT reversible: the snapshot is the only way back"}[*reversible])
-	sent, err := sendRollout(withBusStep(withScope(ctx, sendScope{person: true})), open, moving)
+	// **Nothing is sent, and the assigner never moves the bus** (novox/hq ADR 0539 clause 15): the bus's machines are
+	// composed at the build the mesh holds, and the operator writes each machine's want with the operator's credential,
+	// recorded, naming that composition.
+	wants, err := busWantsToWrite(withBusStep(ctx), open, b.module, moving)
 	if err != nil {
-		_ = inv.EndBusStep(ctx, step.ID, "failed", "the send was refused: "+err.Error())
-		return fmt.Errorf("the bus's machine could not be sent its new build: %w — nothing was replaced", err)
+		_ = inv.EndBusStep(ctx, step.ID, "failed", "the bus's composition could not be written: "+err.Error())
+		return fmt.Errorf("the bus's machines could not be composed at its new build: %w — nothing was replaced", err)
+	}
+	fmt.Printf("composed %s at the bus's new build. Write each want below with the operator's credential, and record it "+
+		"in the hand-act log; `bus-maintenance` is open until the bus answers healthy again — every stream, every durable "+
+		"consumer, a round trip to the machines (H-bus) — within %s, or the step is said failed with its snapshot as the "+
+		"way back. `bus` says how it went\n", strings.Join(moving, ", "), busStepBound)
+	for _, w := range wants {
+		fmt.Println("  " + w)
 	}
-	fmt.Printf("sent %s; `bus-maintenance` is open until the bus answers healthy again — every stream, every durable "+
-		"consumer, a round trip to the machines (H-bus) — within %s, or the step is said failed with its snapshot "+
-		"as the way back. `bus` says how it went\n", strings.Join(sent, ", "), busStepBound)
 	return nil
 }
 
+// busWantsToWrite composes the bus's machines and answers, for each, the want the operator writes: its key in the
+// assigner's bucket and its value, naming the fingerprint the bus module is registered at and that machine's
+// composition of it.
+func busWantsToWrite(ctx context.Context, open *stores, module string, machines []string) ([]string, error) {
+	if _, err := composeModules(ctx, open, machines); err != nil {
+		return nil, err
+	}
+	fps, err := currentFingerprints(ctx, open.inventory)
+	if err != nil {
+		return nil, err
+	}
+	bus, err := aBus()
+	if err != nil {
+		return nil, err
+	}
+	defer bus.Close()
+	js, err := jetstream.New(bus.Conn())
+	if err != nil {
+		return nil, err
+	}
+	digests, err := js.KeyValue(ctx, sdkdelivery.ControllerComposedBucket)
+	if err != nil {
+		return nil, err
+	}
+	digestOf := func(node string) (string, error) {
+		key, err := sdkdelivery.ComposedKey(node, module, fps[module])
+		if err != nil {
+			return "", err
+		}
+		e, err := digests.Get(ctx, key)
+		if err != nil {
+			return "", fmt.Errorf("%s: %w", key, err)
+		}
+		v, err := sdkdelivery.DecodeComposedDigest(e.Value())
+		return v.Digest, err
+	}
+	return busWants(module, fps[module], machines, digestOf)
+}
+
+// busWants is each machine's want for the bus module, as the operator writes it: `<bucket> <key> <value>`.
+func busWants(module, fp string, machines []string, digestOf func(node string) (string, error)) ([]string, error) {
+	var out []string
+	for _, node := range machines {
+		digest, err := digestOf(node)
+		if err != nil {
+			return nil, err
+		}
+		key, err := sdkdelivery.WantKey(node, module)
+		if err != nil {
+			return nil, err
+		}
+		value, err := sdkdelivery.EncodeWant(sdkdelivery.Want{FP: fp, Composed: digest,
+			Words: "the bus moved by a person's step (bus upgrade, ADR 0539 clause 15)"})
+		if err != nil {
+			return nil, err
+		}
+		out = append(out, fmt.Sprintf("%s %s %s", sdkdelivery.AssignerWantsBucket, key, value))
+	}
+	return out, nil
+}
+
 // busStatus is `bus`: what an upgrade would do, and the last step.
 func busStatus(ctx context.Context) error {
 	open, err := openStores(ctx)
@@ -297,7 +391,7 @@ func probeBusStep(ctx context.Context, d *doctor) ([]conditions.Observation, err
 	if err != nil {
 		return nil, err
 	}
-	reports, err := inv.LastReports(ctx)
+	reports, err := lastReports(ctx, inv)
 	if err != nil {
 		return nil, err
 	}

cmd/mesh-controller/bus_step_wants_test.go

@@ -0,0 +1,33 @@
+package main
+
+import (
+	"strings"
+	"testing"
+
+	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// 1945/AC7: a bus upgrade answers, for each machine, the want the operator writes: the assigner's bucket, the
+// machine's key for the bus module, and a want naming the bus's fingerprint and that machine's composition of it. It
+// sends nothing: nothing it calls publishes on a node's declaration subject (busWants composes no send at all).
+func TestABusUpgradeAnswersTheWantTheOperatorWrites(t *testing.T) {
+	fp := sdkdelivery.SourcePrefix2 + strings.Repeat("b", 64)
+	digests := map[string]string{"novox": "sha256:" + strings.Repeat("1", 64), "ace": "sha256:" + strings.Repeat("2", 64)}
+	lines, err := busWants("nats", fp, []string{"ace", "novox"}, func(node string) (string, error) { return digests[node], nil })
+	if err != nil || len(lines) != 2 {
+		t.Fatalf("busWants = %v, %v", lines, err)
+	}
+	for i, node := range []string{"ace", "novox"} {
+		parts := strings.SplitN(lines[i], " ", 3)
+		if len(parts) != 3 || parts[0] != sdkdelivery.AssignerWantsBucket || parts[1] != "want."+node+".nats" {
+			t.Fatalf("line %q", lines[i])
+		}
+		w, err := sdkdelivery.DecodeWant([]byte(parts[2]))
+		if err != nil || w.FP != fp || w.Composed != digests[node] {
+			t.Errorf("%s's want = %+v, %v", node, w, err)
+		}
+	}
+	if _, err := busWants("nats", fp, []string{"ace"}, func(string) (string, error) { return "", nil }); err == nil {
+		t.Errorf("a want naming no composition was answered")
+	}
+}

cmd/mesh-controller/bus_waits.go

@@ -1,195 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"sort"
-	"strings"
-	"sync"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/conditions"
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// A send held for the bus's planned step (novox/hq issue 336).
-//
-// **A wait only a person can end is said to that person at once.** No send replaces the bus but its planned
-// step (sendToEach, ADR 0236), and the step is a person's `bus upgrade`. So while a new bus build waits, every
-// walk whose tier sends to the bus's machine is refused, and tries again each tick. The refusal was kept only
-// as the walk's note; nothing was raised, and the operator found the hold by asking why a walk did not move.
-// Row S17 raises it on the first tick after the first refusal, in the bus's scope, for the operator: what
-// waits, behind which bus build, since when, and the verb. A walk held only by it is not late, so S3 leaves it
-// out, as it leaves out a walk under a paused build seat. It clears once the bus's machine has been sent the
-// build the mesh holds — the step was taken, and no send is refused for the bus any more — whatever the walks'
-// notes still say. Whether the new bus came up healthy is the step's own condition (probe DB).
-
-// kindBusStepWaiting is S17's kind: bus.<module>.step-waiting.
-const kindBusStepWaiting = "bus-step-waiting"
-
-// busFacts is a new bus build waiting for its planned step, and the sends held for it.
-type busFacts struct {
-	module, to string
-	// from is the build each machine of the bus runs; machines those whose bus the step would replace.
-	from     map[string]string
-	machines []string
-	waits    []busWaitFacts
-}
-
-// busWaitFacts is one walk whose send was refused because it would replace the bus.
-type busWaitFacts struct {
-	plan, repository, commit string
-	// modules are what its tier sends: what waits.
-	modules []string
-	// since is the first refusal: as this controller saw it, or, read back, the save that kept the refusal.
-	since time.Time
-}
-
-// busRefusedFirst is when this controller first saw each walk refused for the bus's step. The walk's note
-// keeps the refusal across a restart; this keeps its moment more exactly than the walk's last save.
-var busRefusedFirst = &firstSeen{at: map[string]time.Time{}}
-
-type firstSeen struct {
-	mu sync.Mutex
-	at map[string]time.Time
-}
-
-// mark keeps the first moment an id was seen.
-func (s *firstSeen) mark(id string, at time.Time) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	if _, seen := s.at[id]; !seen {
-		s.at[id] = at
-	}
-}
-
-// of is when an id was first seen; zero when it was not.
-func (s *firstSeen) of(id string) time.Time {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	return s.at[id]
-}
-
-// keepOnly forgets every id not given: a walk no longer held is not held since then.
-func (s *firstSeen) keepOnly(ids map[string]bool) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	for id := range s.at {
-		if !ids[id] {
-			delete(s.at, id)
-		}
-	}
-}
-
-// refusedForTheBus is whether an error is the refusal of a send for the bus's planned step.
-func refusedForTheBus(err error) bool {
-	return err != nil && strings.Contains(err.Error(), errBusWaits.Error())
-}
-
-// busWaitsOf is the sends held for the bus's step, from the open walks: each walk not waiting for its
-// delivery's word whose note keeps a refusal for this very bus build, while the build would still replace
-// the bus on a machine. first is when this controller first saw a walk refused, zero when it did not.
-func busWaitsOf(plans []inventory.Plan, b busPending, first func(string) time.Time) busFacts {
-	f := busFacts{module: b.module, to: b.to, from: b.from}
-	for _, n := range b.machines {
-		if b.moves(n) {
-			f.machines = append(f.machines, n)
-		}
-	}
-	if len(f.machines) == 0 {
-		return f
-	}
-	for _, p := range plans {
-		if !p.Open() || p.Waiting() || !strings.Contains(p.Note, errBusWaits.Error()) || !strings.Contains(p.Note, short(b.to)) {
-			continue
-		}
-		since := p.Updated
-		if seen := first(p.ID); !seen.IsZero() && (since.IsZero() || seen.Before(since)) {
-			since = seen
-		}
-		var modules []string
-		if p.Tier >= 0 && p.Tier < len(p.Tiers) {
-			modules = append(modules, p.Tiers[p.Tier]...)
-		} else {
-			modules = planModules(p)
-		}
-		sort.Strings(modules)
-		f.waits = append(f.waits, busWaitFacts{plan: p.ID, repository: p.Repository, commit: p.Commit, modules: modules,
-			since: since})
-	}
-	sort.Slice(f.waits, func(i, j int) bool { return f.waits[i].since.Before(f.waits[j].since) })
-	return f
-}
-
-// heldByTheBus is the walks of a bus's facts, by id: what S3 leaves out.
-func (b busFacts) heldByTheBus() map[string]bool {
-	out := map[string]bool{}
-	for _, w := range b.waits {
-		out[w.plan] = true
-	}
-	return out
-}
-
-// busUpgradeVerb is the call that ends the wait, as the summary names it: through the mesh MCP server, with
-// why, saying whether the new version can be undone ("reversible": "true") or not ("irreversible": "true").
-const busUpgradeVerb = "`mesh_call mesh-controller.bus {\"upgrade\": \"true\", \"why\": \"…\", \"reversible\" or \"irreversible\": \"true\"}`"
-
-// watchBusWaits is S17: a send held for the bus's planned step, said at once to the operator.
-func watchBusWaits(f *signalFacts) []conditions.Observation {
-	b := f.bus
-	if len(b.waits) == 0 || len(b.machines) == 0 {
-		return nil
-	}
-	since := b.waits[0].since
-	var walks, what []string
-	for _, w := range b.waits {
-		walks = append(walks, fmt.Sprintf("%s (%s %s, tier: %s)", w.plan, w.repository, short(w.commit),
-			strings.Join(w.modules, ", ")))
-		what = append(what, deliveryWhat(w.modules, w.repository))
-	}
-	var from []string
-	for _, n := range b.machines {
-		from = append(from, short(orNotKnown(b.from[n])))
-	}
-	machines := namesWords(b.machines, 3)
-	in := f.now.Sub(since)
-	return []conditions.Observation{{Scope: conditions.ScopeBus, ID: b.module, Token: "step-waiting",
-		Kind: kindBusStepWaiting, Severity: conditions.Warning, Resolver: conditions.ResolverOperator,
-		Machine: b.machines[0], Also: b.machines[1:],
-		Summary: fmt.Sprintf("sends to %s wait for the bus's planned step: a new bus build (%s %s → %s) would replace "+
-			"the bus there, which only a person's %s does; waiting since %s: %s", strings.Join(b.machines, ", "),
-			b.module, strings.Join(sortedUnique(from), ", "), short(b.to), busUpgradeVerb,
-			since.UTC().Format(time.RFC3339), strings.Join(walks, "; ")),
-		Said:     fmt.Sprintf("%d walk(s) refused since %s", len(b.waits), since.UTC().Format(time.RFC3339)),
-		Headline: clipWords("Sends to "+machines+" wait for a bus upgrade", conditions.HeadlineMax),
-		Explanation: clipWords(fmt.Sprintf("A new version of the mesh's message system is built, and only a person "+
-			"installs it. Until then nothing else is sent to %s: %s waits, for %s so far.", machines,
-			namesWords(sortedUnique(what), 3), humanDuration(in)), conditions.ExplanationMax),
-		Needs:    "start the bus upgrade " + FromMeshMCPServer,
-		Resolved: "Resolved: the bus upgrade started, and sends go on"}}
-}
-
-// sortedUnique is a list sorted, each once.
-func sortedUnique(xs []string) []string {
-	seen := map[string]bool{}
-	var out []string
-	for _, x := range xs {
-		if !seen[x] {
-			seen[x] = true
-			out = append(out, x)
-		}
-	}
-	sort.Strings(out)
-	return out
-}
-
-// clipWords keeps a plain sentence within a bound, at a word.
-func clipWords(s string, n int) string {
-	if len(s) <= n {
-		return s
-	}
-	cut := strings.LastIndex(s[:n-1], " ")
-	if cut <= 0 {
-		cut = n - 1
-	}
-	return s[:cut] + "…"
-}

cmd/mesh-controller/bus_waits_integration_test.go

@@ -1,70 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-func TestASendHeldForTheBusStepIsFoundFromTheWalksItHolds(t *testing.T) {
-	now := time.Date(2026, 10, 8, 18, 30, 0, 0, time.UTC)
-	b := aBusOnAnchor()
-	walk := func(id, repo, note string, updated time.Time) inventory.Plan {
-		return inventory.Plan{ID: id, Repository: repo, Commit: "c0ffee001122", State: inventory.PlanRolling, Tier: 0,
-			Tiers: [][]string{{"mesh-host"}}, Modules: map[string]*inventory.PlanModule{"mesh-host": {}}, Note: note,
-			Updated: updated}
-	}
-	for _, c := range []struct {
-		name  string
-		bus   busPending
-		plans []inventory.Plan
-		first map[string]time.Time
-		want  []string
-		since time.Time
-	}{
-		{"a walk refused for the bus", b,
-			[]inventory.Plan{walk("plan-1", "novox/mesh-host", refusedNote(b, 0), now.Add(-27*time.Minute))}, nil,
-			[]string{"plan-1"}, now.Add(-27 * time.Minute)},
-		{"refused earlier than its last save, as this controller saw it", b,
-			[]inventory.Plan{walk("plan-1", "novox/mesh-host", refusedNote(b, 0), now.Add(-5*time.Minute))},
-			map[string]time.Time{"plan-1": now.Add(-28 * time.Minute)}, []string{"plan-1"}, now.Add(-28 * time.Minute)},
-		{"a walk refused for another reason", b,
-			[]inventory.Plan{walk("plan-1", "novox/mesh-host", "tier 0: the build seat is paused — tried again", now)}, nil,
-			nil, time.Time{}},
-		{"refused for an older bus build than the one held now", func() busPending { o := b; o.to = "99999999cccc"; return o }(),
-			[]inventory.Plan{walk("plan-1", "novox/mesh-host", refusedNote(b, 0), now)}, nil, nil, time.Time{}},
-		{"the bus already runs the build held: its step started", func() busPending {
-			o := aBusOnAnchor()
-			o.from = map[string]string{"anchor": o.to}
-			return o
-		}(), []inventory.Plan{walk("plan-1", "novox/mesh-host", refusedNote(b, 0), now)}, nil, nil, time.Time{}},
-		{"a walk waiting for its delivery's word asks no send", b, func() []inventory.Plan {
-			p := walk("plan-1", "novox/mesh-host", refusedNote(b, 0), now)
-			p.Delivery = &inventory.PlanDelivery{Awaits: "mesh-delivery"}
-			return []inventory.Plan{p}
-		}(), nil, nil, time.Time{}},
-	} {
-		t.Run(c.name, func(t *testing.T) {
-			got := busWaitsOf(c.plans, c.bus, func(id string) time.Time { return c.first[id] })
-			var ids []string
-			for _, w := range got.waits {
-				ids = append(ids, w.plan)
-			}
-			if strings.Join(ids, ",") != strings.Join(c.want, ",") {
-				t.Fatalf("held for the bus: %v, want %v", ids, c.want)
-			}
-			if len(c.want) > 0 {
-				if !got.waits[0].since.Equal(c.since) {
-					t.Errorf("waiting since %s, want %s", got.waits[0].since, c.since)
-				}
-				if strings.Join(got.machines, ",") != "anchor" || got.to != b.to || got.module != "nats" {
-					t.Errorf("behind %+v", got)
-				}
-			}
-		})
-	}
-}

cmd/mesh-controller/bus_waits_test.go

@@ -1,99 +0,0 @@
-package main
-
-import (
-	"context"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/conditions"
-)
-
-// novox/hq issue 336: a send held because it would replace the bus outside its planned step waits for a
-// person, so a person is told at once — what waits, behind which bus build, since when, and the verb that
-// ends it — and the wait is not read as a walk running late.
-
-// aBusOnAnchor is a new bus build waiting for its step on anchor: nats 88135ad0 there, 32307bd1 held.
-func aBusOnAnchor() busPending {
-	return busPending{module: "nats", machines: []string{"anchor"}, from: map[string]string{"anchor": "88135ad0aaaa"},
-		to: "32307bd1bbbb", same: map[string]bool{}}
-}
-
-// refusedNote is the note a walk keeps when its send was refused for the bus, as advanceHeld writes it.
-func refusedNote(b busPending, tier int) string {
-	held := "sending anchor would replace the bus (nats " + short(b.from["anchor"]) + " → " + short(b.to) +
-		"), which is a planned step: `bus upgrade --why …` snapshots its streams first and checks them after (novox/hq ADR 0236)"
-	return "tier " + string(rune('0'+tier)) + ": " + errBusWaits.Error() + ": " + held + " — tried again"
-}
-
-// **Said at once, not as lateness, and cleared when the step starts**: the walk held only for the bus raises
-// the bus's condition on the first tick, before any tier bound, naming what waits, the bus build from and to,
-// since when and `bus upgrade`, for the operator; S3 says nothing of it even past its bound; and the
-// condition clears once the bus's machine runs the new build.
-func TestASendHeldForTheBusStepIsSaidAtOnceAndNotAsLateness(t *testing.T) {
-	now := time.Date(2026, 10, 8, 18, 30, 0, 0, time.UTC)
-	b := aBusOnAnchor()
-	held := func(entered time.Duration) *signalFacts {
-		f := calm(now)
-		f.plans = []planFacts{{id: "plan-1", repository: "novox/mesh-host", commit: "c0ffee00", tier: 0, tiers: 1,
-			entered: now.Add(-entered), bound: 30 * time.Minute, waiting: refusedNote(b, 0), bus: true}}
-		f.bus = busFacts{module: "nats", to: b.to, from: b.from, machines: []string{"anchor"},
-			waits: []busWaitFacts{{plan: "plan-1", repository: "novox/mesh-host", commit: "c0ffee001122",
-				modules: []string{"mesh-host"}, since: now.Add(-time.Minute)}}}
-		return f
-	}
-
-	f := held(time.Minute)
-	got := watchBusWaits(f)
-	if len(got) != 1 {
-		t.Fatalf("a send held for the bus a minute ago raised %+v", got)
-	}
-	o := got[0]
-	if o.Key() != "bus.nats.step-waiting" || o.Kind != kindBusStepWaiting || o.Resolver != conditions.ResolverOperator {
-		t.Fatalf("raised %s (%s), resolver %q", o.Key(), o.Kind, o.Resolver)
-	}
-	for _, want := range []string{"anchor", "mesh-host", "88135ad0", "32307bd1", "mesh_call mesh-controller.bus",
-		`"upgrade": "true"`, `"reversible"`, `"irreversible"`, "2026-10-08T18:29:00Z", "plan-1"} {
-		if !strings.Contains(o.Summary, want) {
-			t.Errorf("its summary does not say %q: %s", want, o.Summary)
-		}
-	}
-	if !strings.Contains(o.Explanation, "mesh-host") || !strings.Contains(o.Headline, "bus upgrade") || o.Needs == "" {
-		t.Errorf("its words do not say what waits and what the operator does: %+v", o)
-	}
-	if why, ok := conditions.PlainWords(conditions.Words{Headline: o.Headline, Explanation: o.Explanation,
-		Resolved: o.Resolved, Needs: o.Needs}, "anchor"); !ok {
-		t.Errorf("its words are not plain: %s", why)
-	}
-
-	// Past S3's bound: still the bus's wait, never a stalled walk.
-	late := held(45 * time.Minute)
-	if s3 := watchPlans(late); len(s3) != 0 {
-		t.Fatalf("a walk held only by the bus step was said stalled: %+v", s3)
-	}
-	// A walk held for something else past its bound is still stalled.
-	other := held(45 * time.Minute)
-	other.plans[0].bus = false
-	if s3 := watchPlans(other); len(s3) != 1 {
-		t.Fatalf("a walk held for something else past its bound raised %+v", s3)
-	}
-
-	// Through the keeper: open at the first tick, cleared when the step started.
-	store := conditions.NewInMemory()
-	k := conditions.NewKeeper(t.Context(), conditions.Options{Store: store, History: store, Teller: &conditions.Told{},
-		Now: func() time.Time { return now }})
-	defer k.Close(context.Background())
-	w := &watchdogs{keeper: k, started: now.Add(-time.Hour)}
-	w.see(t.Context(), held(time.Minute))
-	open, err := k.Open(t.Context())
-	if err != nil || len(open) != 1 || open[0].Key != "bus.nats.step-waiting" {
-		t.Fatalf("after the first tick, open: %+v (%v)", open, err)
-	}
-	started := held(time.Minute)
-	started.bus = busFacts{module: "nats", to: b.to}
-	started.plans[0].bus = false
-	w.see(t.Context(), started)
-	if open, _ := k.Open(t.Context()); len(open) != 0 {
-		t.Fatalf("the step started, and open: %+v", open)
-	}
-}

cmd/mesh-controller/busobjects.go

@@ -29,9 +29,22 @@ func assertBusObjects(ctx context.Context, inv *inventory.Inventory, r broker.Ra
 	for _, n := range nodes {
 		names = append(names, n.Name)
 	}
-	if err := broker.Raise(r, names); err != nil {
+	// Once every node runs the node-engine that reads no declaration, the declarations' stream and the nodes'
+	// consumers on it are not asserted again (novox/hq ADR 0539 clause 11; composed_start.go retires them).
+	raise := func() error { return broker.Raise(r, names) }
+	if declarationsRetiredNow(ctx, inv) {
+		raise = func() error { return broker.RaiseAfterDeclarations(r) }
+	}
+	if err := raise(); err != nil {
 		return nil, err
 	}
+	// And each node's bucket for the files of its declaration that travel by digest (novox/hq ADR 0486 §4), so a node finds its own
+	// whenever the bus is up.
+	if files, ok := r.(interface{ EnsureDeclarationFiles(nodes []string) error }); ok {
+		if err := files.EnsureDeclarationFiles(names); err != nil {
+			return nil, err
+		}
+	}
 	// The work queues of the mesh's own roles (novox/hq ADR 0121). The queue before the holder,
 	// deliberately: work queues until somebody arrives to do it, so assigning a build machine a week
 	// after something started asking for builds flushes the backlog instead of having lost it.

cmd/mesh-controller/busobjects_test.go

@@ -7,14 +7,9 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/nats-io/nats.go"
-
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-
-	"github.com/novox/mesh-controller/internal/testbus"
 )
 
 // novox/hq issue 208: the bus's objects a declaration implies are asserted whenever one is sent, not
@@ -46,25 +41,33 @@ func aCarriedConsumer(t *testing.T, open *stores) broker.Consumer {
 	return broker.Consumer{}
 }
 
-// aLateHolder is a module holding the build agent's seat on anchor, assigned after the controller
-// started, and the worker its seat's queue should have for it.
+// aLateHolder is a module holding a build seat (node-build-go) on anchor, assigned after the controller started, and
+// the worker its seat's queue should have for it: a build seat is pulled by kind, so the worker is the one for the
+// seat's first accepted kind (the build agent's seat, which had one worker for all, is gone with the builder).
 func aLateHolder(t *testing.T, open *stores) broker.Consumer {
 	t.Helper()
+	// With an account to read, as a holder has: a module with none is no bus user, so its seat's workers are not derived.
 	register(t, open, catalogue.Manifest{Module: "late-builder", Version: "1",
-		Claims: []catalogue.Claim{{Name: "node-build-agent", Scope: catalogue.ScopeNode}}})
+		OwnSecrets: catalogue.OwnSecrets{"broker": {Path: "/var/lib/mesh/late-builder/broker"}},
+		Claims:     []catalogue.Claim{{Name: "node-build-go", Scope: catalogue.ScopeNode}}})
 	if _, err := open.inventory.Assign(t.Context(), "anchor", "late-builder"); err != nil {
 		t.Fatal(err)
 	}
+	_, workers, err := seatTrafficObjects(t.Context(), open.inventory)
+	if err != nil {
+		t.Fatal(err)
+	}
 	for _, s := range inventory.MeshSeats() {
-		if s.Name == "node-build-agent" {
-			c, needed := broker.HolderConsumerFor("anchor", "late-builder", s)
-			if !needed {
-				t.Fatal("the build agent's seat needs no worker")
+		if s.Name != "node-build-go" || len(s.Accepts) == 0 {
+			continue
+		}
+		for _, w := range workers {
+			if w.Name == broker.WorkerName(s.Name, s.Accepts[0]) {
+				return w
 			}
-			return c
 		}
 	}
-	t.Fatal("the mesh declares no build agent's seat")
+	t.Fatal("the build seat's holder is derived no worker")
 	return broker.Consumer{}
 }
 
@@ -157,43 +160,3 @@ func TestASendThatCannotAssertTheBusSaysSoAndRaisesACondition(t *testing.T) {
 		t.Fatalf("a send that asserted everything left the condition open: %v", err)
 	}
 }
-
-// Against a real bus, through the send's own grant: a module assigned after start has its consumer
-// once a declaration is sent, and a holder assigned after start its seat's worker.
-func TestNatsAModuleAssignedAfterStartGetsItsConsumerAtItsFirstSend(t *testing.T) {
-	url := testbus.URL(t)
-	open := aMesh(t)
-	js, err := broker.Dial(url)
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(js.Close)
-	for _, s := range []string{"CONTROL", "NODES", "ASSIGNMENTS", "EVENTS"} {
-		_ = js.Context().DeleteStream(s)
-	}
-	// The controller starting, before either was assigned.
-	if _, err := assertBusObjects(t.Context(), open.inventory, js); err != nil {
-		t.Fatal(err)
-	}
-	consumer := aCarriedConsumer(t, open)
-	worker := aLateHolder(t, open)
-	_ = js.Context().DeleteConsumer(worker.Stream, worker.Name)
-	for _, c := range []broker.Consumer{consumer, worker} {
-		if _, err := js.Context().ConsumerInfo(c.Stream, c.Name); !errors.Is(err, nats.ErrConsumerNotFound) {
-			t.Fatalf("%s on %s exists before any send; the test proves nothing: %v", c.Name, c.Stream, err)
-		}
-	}
-
-	server := link.ConnectNats(js, nil, nil)
-	if err := (overTheBus{open: open, server: server}).grant(t.Context(), nil); err != nil {
-		t.Fatal(err)
-	}
-	for _, c := range []broker.Consumer{consumer, worker} {
-		if _, err := js.Context().ConsumerInfo(c.Stream, c.Name); err != nil {
-			t.Fatalf("%s on %s is not on the bus after a send: %v", c.Name, c.Stream, err)
-		}
-	}
-	if _, raised, _ := conditionsFrom.Get(t.Context(), "bus.objects.unasserted"); raised {
-		t.Fatal("a send that asserted everything raised a condition")
-	}
-}

cmd/mesh-controller/busy.go

@@ -1,103 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// A first-node gate waits for a busy container (novox/hq ADR 0335 §4).
-//
-// When a machine reports, on what the gate sent it, that a container of a judged module was left running
-// because it said busy, the judging has not started: the build is not yet what runs there. The walk says it
-// waits for a busy container on that machine, counts no pass and no bound, and starts the judging — its
-// Since — at the report that no longer lists the container waiting. The wait is the node-engine's, bounded
-// at 15 minutes; the controller's own bound (busyGateBound past the engine's) is for an engine that stopped
-// reporting while it waited, so no walk waits for ever. An engine older than the field never lists one, and
-// its gate starts as before.
-
-// busyGateSlack is how long past the engine's bound the controller still waits for the report that says the
-// container replaced: a pass of the engine (its asks every 20 seconds) and the report's way here.
-var busyGateSlack = 5 * time.Minute
-
-// busyEngineBound is the node-engine's bound on a wait (novox/hq ADR 0335 §3), counted again here on this
-// controller's clock from when it first read the wait.
-const busyEngineBound = 15 * time.Minute
-
-// busyGateEnds is when the gate stops waiting: the engine's own word on its bound, or this controller's count of
-// it from when it first read the wait, whichever is sooner, and the slack — so neither a clock ahead on the
-// machine nor a wrong word from it holds a walk longer.
-func busyGateEnds(b *inventory.GateBusy) time.Time {
-	until := b.Seen.Add(busyEngineBound)
-	if !b.Until.IsZero() && b.Until.Before(until) {
-		until = b.Until
-	}
-	return until.Add(busyGateSlack)
-}
-
-// busyWait decides, before a judging, whether the gate waits for a busy container on a machine it judges:
-// true while it waits, the gate saying so. False when nothing waits, or no longer: a wait that ended moves the
-// gate's Since to its end. Pure but for the gate it is handed.
-func busyWait(g *inventory.PlanGate, pairs []judged, f gateFacts, now time.Time) bool {
-	if g.Busy != nil && g.Busy.Ended != nil {
-		return false
-	}
-	for _, j := range pairs {
-		b, waits := busyOn(j, f)
-		if !waits {
-			continue
-		}
-		if g.Busy == nil {
-			g.Busy = &inventory.GateBusy{Machine: j.node, Module: j.module, Container: b.Container, Since: b.Since,
-				Seen: now}
-		}
-		if g.Busy.Seen.IsZero() {
-			g.Busy.Seen = now
-		}
-		g.Busy.Until, g.Busy.Said = b.Until, b.Said
-		if now.After(busyGateEnds(g.Busy)) {
-			// The engine said it would have replaced it by now: the judging starts, and finds the module not
-			// yet healthy while the machine still lists it waiting (busyStill), until the gate's own bound.
-			end := now
-			g.Busy.Ended, g.Busy.PastBound = &end, true
-			g.Since, g.Passes, g.LastPass, g.Healthy, g.HealthyAt, g.Applied = &end, 0, nil, nil, nil, nil
-			return false
-		}
-		g.Passes, g.LastPass, g.Last, g.Failing = 0, nil, g.Busy.Words(), nil
-		g.Read(now, false, g.Busy.Words())
-		return true
-	}
-	if g.Busy == nil {
-		return false
-	}
-	// Replaced: the judging starts at the report that said so.
-	end := now
-	if r, said := f.reports[g.Busy.Machine]; said && r.At != nil && r.At.After(g.Busy.Since) && r.At.Before(now) {
-		end = r.At.UTC()
-	}
-	g.Busy.Ended = &end
-	g.Since, g.Passes, g.LastPass, g.Last, g.Healthy, g.HealthyAt, g.Applied = &end, 0, nil, "", nil, nil, nil
-	return false
-}
-
-// busyOn is the container of a judged module its machine last reported, on what the gate sent it, as left
-// running because it said busy.
-func busyOn(j judged, f gateFacts) (inventory.BusyWait, bool) {
-	r, said := f.reports[j.node]
-	if !said || r.At == nil || !f.reportedOn(j.node, r) {
-		return inventory.BusyWait{}, false
-	}
-	return inventory.WaitingFor(r.Busy, j.module)
-}
-
-// busyStill is a judged module whose container its machine still lists waiting once the gate stopped waiting
-// for it: not yet what was sent, so not healthy, whatever its health says of the container still running.
-func busyStill(j judged, f gateFacts) (string, bool) {
-	b, waits := busyOn(j, f)
-	if !waits {
-		return "", false
-	}
-	return fmt.Sprintf("%s still runs its busy container %s, past its node-engine's bound of %s",
-		j.node, b.Container, b.Until.UTC().Format(time.RFC3339)), true
-}

cmd/mesh-controller/busy_test.go

@@ -1,148 +0,0 @@
-package main
-
-import (
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/catalogue"
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// A walk whose module's container waits as busy on its first machine says so, and starts that machine's
-// first-machine gate only once the machine reports the container replaced (novox/hq ADR 0335 §4).
-func TestAGateWaitsForABusyContainerAndStartsWhenItIsReplaced(t *testing.T) {
-	sent := time.Date(2026, 10, 13, 1, 0, 0, 0, time.UTC)
-	g := &inventory.PlanGate{Machines: []string{"novox"}, Since: &sent,
-		Sent: map[string]inventory.SentDeclaration{"novox": {Digest: "d1", Sequence: 7}}}
-	pairs := []judged{{module: "build-agent", node: "novox"}, {module: "mesh-controller", node: "novox"}}
-	reported := sent.Add(20 * time.Second)
-	waiting := []inventory.BusyWait{{ID: "build-agent.server", Container: "mesh-build-agent",
-		State: inventory.BusyWaiting, Since: reported, Until: reported.Add(15 * time.Minute),
-		Said: "busy: novox/mesh-controller (check of #280), in hand since 00:58:00Z"}}
-	facts := func(at time.Time, busy []inventory.BusyWait) gateFacts {
-		// As judgeMoves hands it: the report held against the gate's own send.
-		return gateFacts{sent: g.Sent, reports: map[string]inventory.Reported{"novox": {Node: "novox",
-			Outcome: inventory.OutcomeApplied, At: &at, Declared: "d1", ReportedSequence: 7, Busy: busy}}}
-	}
-
-	now := reported.Add(time.Minute)
-	if !busyWait(g, pairs, facts(reported, waiting), now) {
-		t.Fatal("a gate whose module's container waits as busy judged it")
-	}
-	if !g.Since.Equal(sent) || g.Busy == nil || g.Busy.Machine != "novox" || g.Busy.Ended != nil {
-		t.Fatalf("the gate does not keep the wait: %+v %+v", g.Since, g.Busy)
-	}
-	for _, said := range []string{gateLine(g), g.Last} {
-		if !strings.Contains(said, "waits for a busy container on novox") {
-			t.Errorf("the walk does not say it waits for a busy container there: %s", said)
-		}
-	}
-	if !strings.Contains(g.Last, "check of #280") {
-		t.Errorf("the wait does not say what the container holds: %s", g.Last)
-	}
-
-	// Ten minutes on, still busy, within the engine's bound: still waiting, nothing judged, no bound run.
-	now = reported.Add(10 * time.Minute)
-	if !busyWait(g, pairs, facts(reported.Add(9*time.Minute), waiting), now) || g.Passes != 0 {
-		t.Fatalf("the gate stopped waiting within the bound: %+v", g)
-	}
-
-	// The machine reports it replaced: the judging starts at that report.
-	replacedAt := reported.Add(12 * time.Minute)
-	now = replacedAt.Add(5 * time.Second)
-	replaced := []inventory.BusyWait{{ID: "build-agent.server", Container: "mesh-build-agent",
-		State: "replaced-when-idle", Since: reported, Until: reported.Add(15 * time.Minute)}}
-	if busyWait(g, pairs, facts(replacedAt, replaced), now) {
-		t.Fatal("the gate still waits after the container was replaced")
-	}
-	if g.Since == nil || !g.Since.Equal(replacedAt) || g.Busy.Ended == nil || !g.Busy.Ended.Equal(replacedAt) {
-		t.Fatalf("the gate does not start at the report that said it replaced: since %v, %+v", g.Since, g.Busy)
-	}
-	if strings.Contains(gateLine(g), "waits for a busy container") {
-		t.Errorf("a gate judging still says it waits: %s", gateLine(g))
-	}
-	// And a later report listing it waiting again does not hold a gate that started.
-	if busyWait(g, pairs, facts(now, waiting), now.Add(time.Minute)) {
-		t.Error("a gate that started waits again")
-	}
-}
-
-// An engine that stops reporting while it waits holds no walk for ever: past the engine's bound and the slack,
-// the judging starts, and finds the module not yet healthy while its container is still listed waiting.
-func TestAGateWaitsNoLongerThanTheEnginesBound(t *testing.T) {
-	sent := time.Date(2026, 10, 13, 1, 0, 0, 0, time.UTC)
-	g := &inventory.PlanGate{Machines: []string{"novox"}, Since: &sent}
-	pairs := []judged{{module: "build-agent", node: "novox"}}
-	waiting := []inventory.BusyWait{{ID: "build-agent.server", Container: "mesh-build-agent",
-		State: inventory.BusyWaiting, Since: sent, Until: sent.Add(15 * time.Minute)}}
-	f := gateFacts{reports: map[string]inventory.Reported{"novox": {Node: "novox", Outcome: inventory.OutcomeApplied,
-		At: &sent, Current: true, Busy: waiting}}}
-	now := sent.Add(15*time.Minute + busyGateSlack + time.Second)
-	if busyWait(g, pairs, f, now) {
-		t.Fatal("a gate waited past the engine's bound and the slack")
-	}
-	if !g.Busy.PastBound || !g.Since.Equal(now) {
-		t.Fatalf("the gate does not start, said past the bound: %+v %v", g.Busy, g.Since)
-	}
-	if why, still := busyStill(pairs[0], f); !still || !strings.Contains(why, "past its node-engine's bound") {
-		t.Fatalf("a module still running its busy container reads as what was sent: %q", why)
-	}
-}
-
-// A report from an engine older than the field lists nothing: the gate starts at the send, as before; and a
-// report not about the gate's send says nothing of it.
-func TestAGateOfAnEngineThatNeverWaitsStartsAsBefore(t *testing.T) {
-	sent := time.Date(2026, 10, 13, 1, 0, 0, 0, time.UTC)
-	g := &inventory.PlanGate{Machines: []string{"ace"}, Since: &sent,
-		Sent: map[string]inventory.SentDeclaration{"ace": {Digest: "d2", Sequence: 9}}}
-	pairs := []judged{{module: "build-agent", node: "ace"}}
-	at := sent.Add(time.Minute)
-	older := gateFacts{sent: g.Sent, reports: map[string]inventory.Reported{"ace": {Node: "ace", Outcome: inventory.OutcomeApplied,
-		At: &at, Declared: "d2", ReportedSequence: 9}}}
-	if busyWait(g, pairs, older, at) || g.Busy != nil || !g.Since.Equal(sent) {
-		t.Fatalf("a gate on an engine that never waits did not start at the send: %+v %v", g.Busy, g.Since)
-	}
-	elsewhere := gateFacts{sent: g.Sent, reports: map[string]inventory.Reported{"ace": {Node: "ace", Outcome: inventory.OutcomeApplied,
-		At: &at, Declared: "d1", ReportedSequence: 8, Busy: []inventory.BusyWait{{ID: "build-agent.server",
-			State: inventory.BusyWaiting, Until: at.Add(time.Hour)}}}}}
-	if busyWait(g, pairs, elsewhere, at) {
-		t.Fatal("a wait reported about an earlier declaration held the gate")
-	}
-}
-
-// The wait is bounded on this controller's clock: an engine whose clock runs an hour ahead, saying it waits until
-// then, holds the gate no longer than 15 minutes and the slack from when the controller first read the wait.
-func TestAGateWaitIsBoundedOnTheControllersClock(t *testing.T) {
-	seen := time.Date(2026, 10, 13, 1, 0, 0, 0, time.UTC)
-	g := &inventory.PlanGate{Machines: []string{"novox"}, Since: &seen}
-	pairs := []judged{{module: "build-agent", node: "novox"}}
-	ahead := seen.Add(time.Hour)
-	f := gateFacts{reports: map[string]inventory.Reported{"novox": {Node: "novox", Outcome: inventory.OutcomeApplied,
-		At: &seen, Current: true, Busy: []inventory.BusyWait{{ID: "build-agent.server", Container: "mesh-build-agent",
-			State: inventory.BusyWaiting, Since: ahead, Until: ahead.Add(15 * time.Minute)}}}}}
-	if !busyWait(g, pairs, f, seen) || !g.Busy.Seen.Equal(seen) {
-		t.Fatalf("the gate did not start waiting, seen now: %+v", g.Busy)
-	}
-	if !busyWait(g, pairs, f, seen.Add(15*time.Minute+busyGateSlack-time.Second)) {
-		t.Fatal("the gate stopped waiting within the bound on its own clock")
-	}
-	if busyWait(g, pairs, f, seen.Add(15*time.Minute+busyGateSlack+time.Second)) || !g.Busy.PastBound {
-		t.Fatalf("an engine's later word held the gate past the controller's bound: %+v", g.Busy)
-	}
-}
-
-// `plan` says, for a machine whose node-engine is older than the field, each container whose busy is not sent.
-func TestAPlanSaysABusyAnOlderEngineIsNotSent(t *testing.T) {
-	modules := []catalogue.Manifest{{Module: "build-agent", Resources: []map[string]any{
-		{"id": "server", "type": "container", "busy": map[string]any{"command": "mesh-builder busy"}},
-		{"id": "agent-env", "type": "file"}}}}
-	lines := busyNotSent(modules, false)
-	if len(lines) != 1 || !strings.Contains(lines[0], "build-agent.server declares busy") ||
-		!strings.Contains(lines[0], "replaced at once") {
-		t.Fatalf("the plan does not say the busy not sent: %v", lines)
-	}
-	if lines := busyNotSent(modules, true); len(lines) != 0 {
-		t.Fatalf("a busy sent is said as not sent: %v", lines)
-	}
-}

cmd/mesh-controller/calls_verb_test.go

@@ -24,28 +24,4 @@ func TestAVerbAnswersInsideEveryWaitOnIt(t *testing.T) {
 	}
 }
 
-// A push — named or through command — answers before it runs: it sends the machine holding the bus
-// first, and the broker reloading its user list forgets the answer it was about to permit.
-func TestAPushAnswersBeforeItSends(t *testing.T) {
-	for _, c := range []struct {
-		verb string
-		args map[string]any
-		want bool
-	}{
-		{"push", map[string]any{"node": "anchor", "why": "w"}, true},
-		{"push", map[string]any{"why": "w"}, true},
-		{"command", map[string]any{"command": "builds"}, false},
-		{"status", map[string]any{}, false},
-		{"assign", map[string]any{"node": "anchor", "module": "m"}, false},
-	} {
-		argv, err := argvFor(c.verb, c.args)
-		if err != nil {
-			t.Fatalf("%s %v: %v", c.verb, c.args, err)
-		}
-		if got := answersFirst(argv); got != c.want {
-			t.Errorf("%s %v answers first: %v, want %v", c.verb, c.args, got, c.want)
-		}
-	}
-}
-
 // `calls` is served, takes a call's id and nothing else, and says plainly when it holds no such call.

cmd/mesh-controller/chain.go

@@ -13,9 +13,7 @@ import (
 )
 
 // The chain on the bus (novox/hq ADR 0408, design 47 milestone 5): builds, rollouts and assignments are keys of the
-// bus's key-value store, written by the controller that holds the lease. The tables of the controller's store are
-// copied into them once, by the serving controller at its start, and a kind is read from its bucket only once the move
-// has recorded it (inventory.ChainReads).
+// bus's key-value store, written by the controller that holds the lease, and the controller's store keeps none of them.
 
 // chainHolds is whether this process may write the chain now: the lease's gate, the one every act passes.
 func chainHolds(ctx context.Context) error {
@@ -33,97 +31,7 @@ func openTheChain(ctx context.Context) (*chain.Chain, error) {
 	return chain.OnTheBus(ctx, js.Conn(), chainHolds)
 }
 
-// kindChainMoveRefused is the condition of a move that stopped without switching a kind.
-const kindChainMoveRefused = "chain-move-refused"
-
-// chainMoveRetry is how long a move that failed for want of the bus waits before it tries again.
-const chainMoveRetry = 30 * time.Second
-
-// movingTheChain copies the tables into the buckets and records it, at the serving controller's start: after the buckets
-// exist and the lease is held, before anything reads a kind that has not moved. **The first try is made here, before the
-// controller serves**, so what it serves is read from one place. A move that fails for want of the bus is tried again
-// every half minute while the controller serves from the tables; one that is refused — a count that differs, a value
-// over the bus's largest — is raised as an urgent condition, and the tables stay what is read: nothing is half-switched.
-func movingTheChain(ctx context.Context, inv *inventory.Inventory) {
-	say := func(format string, args ...any) { fmt.Printf("chain: "+format+"\n", args...) }
-	// The first try is made here, before the controller serves; the tries after it, while it serves.
-	if movedOrStopped(ctx, inv, say) {
-		return
-	}
-	go func() {
-		for {
-			select {
-			case <-ctx.Done():
-				return
-			case <-time.After(chainMoveRetry):
-			}
-			if movedOrStopped(ctx, inv, say) {
-				return
-			}
-		}
-	}()
-}
-
-// movedOrStopped makes one try at the move and says whether there is nothing more to try: moved, refused, or the controller
-// ending. False for a failure of the kind that is tried again (the bus away, a write not granted yet, the lease not held).
-func movedOrStopped(ctx context.Context, inv *inventory.Inventory, say func(string, ...any)) bool {
-	_, err := inv.MoveChain(ctx, say)
-	var refusal *inventory.Refusal
-	switch {
-	case err == nil:
-		go clearChainMove(ctx)
-		go askAgainSoon(ctx, inv)
-		return true
-	case errors.As(err, &refusal):
-		say("%v", err)
-		go raiseChainMove(ctx, refusal)
-		return true
-	case ctx.Err() != nil:
-		return true
-	}
-	say("the move to the bus did not finish, and the tables are read until it does: %v", err)
-	return false
-}
-
-// chainMoveObservation is the urgent condition for a refused move.
-func chainMoveObservation(r *inventory.Refusal) conditions.Observation {
-	return conditions.Observation{Scope: conditions.ScopeBus, ID: "chain." + r.Kind, Token: kindChainMoveRefused,
-		Kind: kindChainMoveRefused, Severity: conditions.Urgent, Resolver: conditions.ResolverOperator,
-		Summary: "the controller's " + r.Kind + " were not moved to the bus: " + r.Why, Source: "chain move"}
-}
-
-// whenKept runs f once the serving controller keeps conditions: the move runs before they are kept.
-func whenKept(ctx context.Context, f func(k *conditions.Keeper)) {
-	for conditionsFrom == nil {
-		select {
-		case <-ctx.Done():
-			return
-		case <-time.After(time.Second):
-		}
-	}
-	f(conditionsFrom)
-}
-
-func raiseChainMove(ctx context.Context, r *inventory.Refusal) {
-	whenKept(ctx, func(k *conditions.Keeper) {
-		if _, err := k.Observe(ctx, chainMoveObservation(r)); err != nil {
-			fmt.Printf("chain: the condition for the refused move could not be raised: %v\n", err)
-		}
-	})
-}
-
-func clearChainMove(ctx context.Context) {
-	whenKept(ctx, func(k *conditions.Keeper) {
-		for _, kind := range []string{inventory.KindBuilds, inventory.KindRollouts, inventory.KindAssignments} {
-			key := chainMoveObservation(&inventory.Refusal{Kind: kind}).Key()
-			if _, err := k.Clear(ctx, key, "the "+kind+" are on the bus"); err != nil {
-				fmt.Printf("chain: the condition for the move of the %s could not be cleared: %v\n", kind, err)
-			}
-		}
-	})
-}
-
-// attachTheChain gives the inventory of the serving controller the chain on its connection, then moves what has not moved.
+// attachTheChain gives the inventory of the serving controller the chain on its connection.
 func attachTheChain(ctx context.Context, inv *inventory.Inventory, server *link.Server) error {
 	bus, ok := server.Bus().(link.OverNATS)
 	if !ok {
@@ -134,48 +42,60 @@ func attachTheChain(ctx context.Context, inv *inventory.Inventory, server *link.
 		return err
 	}
 	inv.UseChain(c)
-	movingTheChain(ctx, inv)
+	inv.RequireLayout()
+	// And the builds laid out under their modules, once, before they are read (issue 1121) — **before this returns**, so
+	// nothing the start goes on to read meets a chain not laid out yet: on 2026-10-18 the layout ran beside the start, a
+	// read of the start was refused, and the controller exited and was started again every five seconds. The layout of
+	// keys laid out before skips them, so this takes seconds; one that fails is tried again beside the serving, loudly.
+	if err := inv.LayBuildsOut(ctx, func(format string, args ...any) { fmt.Printf("chain: "+format+"\n", args...) }); err != nil {
+		fmt.Printf("chain: the builds are not laid out under their modules yet, and none is read until they are: %v\n", err)
+		go layBuildsOutSoon(ctx, inv)
+	}
+	// The requests the move of delivery 1 found never handed over are not asked again: the controller asks no build
+	// (novox/hq ADR 0501; issue 1851, A10), and the builder builds every fingerprint the indexer writes.
+	// And what delivery 1 recorded of what each machine was sent, copied onto the keys of the assignments (CopySentBuilds).
 	return nil
 }
 
-// askAgain asks once more for each build request the move found never handed over (novox/hq issue 981 note 7 Q5): the
-// requests a merge could not ask for, which a person's hand `build` would otherwise have to repeat. **At most once**: a
-// request is claimed before it is asked and settled after, so a crash between loses the ask, which is where it stood.
-func askAgain(ctx context.Context, inv *inventory.Inventory) {
-	pending, err := inv.RequestsToAskAgain(ctx)
-	if err != nil {
-		fmt.Printf("chain: the requests never handed over cannot be read: %v\n", err)
-		return
-	}
-	for _, r := range pending {
-		if claimed, err := inv.ClaimToAskAgain(ctx, r.ID); err != nil || !claimed {
-			if err != nil {
-				fmt.Printf("chain: %s cannot be claimed to be asked again: %v\n", r.ID, err)
-			}
-			continue
-		}
-		id, err := askABuild(ctx, buildSource{Repository: r.Repository, Seat: r.Seat}, r.Path, r.Ref)
-		if err != nil {
-			if serr := inv.AskedAgainAs(ctx, r.ID, "not asked again: "+err.Error()); serr != nil {
-				fmt.Printf("chain: %s was not asked again, and that could not be kept: %v\n", r.ID, serr)
-			}
-			fmt.Printf("chain: %s was never handed over and cannot be asked again: %v\n", r.ID, err)
-			continue
-		}
-		recordBuildRequest(ctx, inv, inventory.BuildRequest{ID: id, Repository: r.Repository, Seat: r.Seat, Path: r.Path,
-			Ref: r.Ref, Commit: r.Commit, For: r.For})
-		if err := inv.AskedAgainAs(ctx, r.ID, id); err != nil {
-			fmt.Printf("chain: %s was asked again as %s, and that could not be kept: %v\n", r.ID, id, err)
-		}
-		fmt.Printf("chain: %s, never handed over, is asked again as %s\n", r.ID, id)
-	}
-}
+// kindSentBuildsNotCopied is the condition of the one-time copy of node.sent_builds onto the assignments' keys that has not
+// succeeded: until it has, a module an assignment pulled in may be missing from what a machine is read to run.
+const kindSentBuildsNotCopied = "sent-builds-not-copied"
 
-// askAgainSoon waits for the controller to be serving, which an ask needs, and then asks again.
-func askAgainSoon(ctx context.Context, inv *inventory.Inventory) {
-	select {
-	case <-ctx.Done():
-	case <-time.After(time.Minute):
-		askAgain(ctx, inv)
+// chainMoveRetry is how long the copy waits before it tries again.
+const chainMoveRetry = 30 * time.Second
+
+// kindBuildsNotLaidOut is the condition of the layout of the builds under their modules that has not succeeded: until it
+// has, no build is read, and a send that needs one is refused with the reason.
+const kindBuildsNotLaidOut = "builds-not-laid-out"
+
+// layBuildsOutSoon lays the builds out under their modules as soon as this controller holds the lease (the chain refuses a
+// write before), and tries again every half minute while it fails, loudly: each failure is printed, and the first raises an
+// urgent condition until it has worked. It is idempotent (LayBuildsOut).
+func layBuildsOutSoon(ctx context.Context, inv *inventory.Inventory) {
+	failed := false
+	for {
+		err := inv.LayBuildsOut(ctx, func(format string, args ...any) { fmt.Printf("chain: "+format+"\n", args...) })
+		o := conditions.Observation{Scope: conditions.ScopeBuild, ID: kindBuildsNotLaidOut, Token: kindBuildsNotLaidOut,
+			Kind: kindBuildsNotLaidOut, Severity: conditions.Urgent, Resolver: conditions.ResolverOperator,
+			Source: "chain", Summary: "the builds are not laid out under their modules, so none is read: "}
+		if err != nil {
+			fmt.Printf("chain: the builds are not laid out under their modules, and none is read until they are: %v\n", err)
+			if keeper := conditionsFrom; keeper != nil && !failed {
+				o.Summary += err.Error()
+				if _, oerr := keeper.Observe(ctx, o); oerr == nil {
+					failed = true
+				}
+			}
+		} else {
+			if keeper := conditionsFrom; keeper != nil && failed {
+				_, _ = keeper.Clear(ctx, o.Key(), "laid out")
+			}
+			return
+		}
+		select {
+		case <-ctx.Done():
+			return
+		case <-time.After(chainMoveRetry):
+		}
 	}
 }

cmd/mesh-controller/chain_integration_test.go

@@ -1,209 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"context"
-	"fmt"
-	"slices"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/catalogue"
-	"github.com/novox/mesh-controller/internal/chain"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/lease"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// **Acceptance 10 of design 47: one read of an assignment names the commit, the build and the rollout that put it there,
-// and one read of the rollout lists the assignments it changed** (novox/hq ADR 0408, issue 1095). It enters by the live
-// trigger — a merge heard, its batch cut into a plan when the window closed, its build answered through the build seat's
-// path, the plan advanced — and writes no key and no row by hand. Only the machine's end of the send is the test's: the send
-// is recorded as the controller records one it made, and the gate's facts are the store's.
-func TestOneReadOfAnAssignmentNamesItsCommitBuildAndRolloutAndOneReadOfTheRolloutListsItsAssignments(t *testing.T) {
-	open := windowed(t)
-	everyHeadWaits(t)
-	asked := asksRecorded(t)
-	ctx := t.Context()
-	inv := open.inventory
-	if _, err := assign(ctx, open, "anchor", "notes"); err != nil {
-		t.Fatal(err)
-	}
-
-	var sent [][]string
-	wasSend := sendRollout
-	sendRollout = func(ctx context.Context, open *stores, names []string) ([]string, error) {
-		sent = append(sent, append([]string(nil), names...))
-		current, err := open.inventory.CurrentBuilds(ctx)
-		if err != nil {
-			return nil, err
-		}
-		for _, node := range names {
-			digest := fmt.Sprintf("d-%s-%d", node, len(sent))
-			if err := open.inventory.RecordSent(ctx, nodeID(t, open, node), digest,
-				map[string]string{"notes": current["notes"].Commit}); err != nil {
-				return nil, err
-			}
-		}
-		return names, nil
-	}
-	t.Cleanup(func() { sendRollout = wasSend })
-	wasGather := gatherGateFacts
-	gatherGateFacts = func(ctx context.Context, open *stores, component string) (gateFacts, error) {
-		f := gateFacts{now: time.Now(), reports: map[string]inventory.Reported{}, engines: map[string]string{},
-			rolledBack: map[string][]lease.Rollback{}, served: map[string]served{}}
-		reports, err := open.inventory.LastReports(ctx)
-		if err != nil {
-			return f, err
-		}
-		for _, r := range reports {
-			f.reports[r.Node] = r
-		}
-		return f, nil
-	}
-	t.Cleanup(func() { gatherGateFacts = wasGather })
-
-	// A merge of notes is heard, and its window closes: the batch is cut into the walk.
-	hear(t, open, catalogueMerge("c-notes", "notes", t0), t0.Add(time.Second))
-	cutAt(t, open, t0.Add(time.Second+90*time.Second))
-	ws, _ := walks(t, open)
-	if len(ws) != 1 {
-		t.Fatalf("%d walk(s) after the cut", len(ws))
-	}
-	rollout := ws[0].ID
-
-	// The walk asks its first tier (at the cut, or at its next step); the build seat answers, and the controller takes the
-	// outcome in as it does.
-	asking, err := inv.PlanByID(ctx, rollout)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for try := 0; try < 3 && (asking.Modules["notes"] == nil || asking.Modules["notes"].Build == ""); try++ {
-		advancePlans(ctx, open)
-		if asking, err = inv.PlanByID(ctx, rollout); err != nil {
-			t.Fatal(err)
-		}
-	}
-	buildID := asking.Modules["notes"].Build
-	if buildID == "" || len(*asked) != 1 || !strings.HasSuffix((*asked)[0], "#"+buildID) {
-		t.Fatalf("the walk asked %v, and notes' build is %q", *asked, buildID)
-	}
-	digest := "sha256:" + strings.Repeat("a", 64)
-	result := outcome(buildID, "modules/notes", "c-notes", "notes", "")
-	result.ReuseKey = "rk-notes"
-	result.Made = []link.MadeArtifact{{Name: "notes", Kind: "image", Reference: "artifact-store://notes/notes@" + digest}}
-	if err := (builds{inv: inv, open: open}).Built(ctx, result); err != nil {
-		t.Fatal(err)
-	}
-
-	// The walk sends the tier to its first machine.
-	for try := 0; try < 3 && len(sent) == 0; try++ {
-		advancePlans(ctx, open)
-	}
-	if !slices.Equal(slices.Concat(sent...), []string{"anchor"}) {
-		t.Fatalf("sent %v", sent)
-	}
-
-	// One read of the assignment.
-	on, err := inv.AssignmentsOn(ctx, "anchor")
-	a, ok := assignmentOf(on, "notes")
-	if err != nil || !ok {
-		t.Fatalf("the assignments of anchor: %+v %v", on, err)
-	}
-	// Beside it a module pulled in by the assignment, which no send of this walk put anywhere.
-	if wireguard, pulled := assignmentOf(on, "mesh-wireguard"); pulled && (wireguard.Build != "" || wireguard.Rollout != "") {
-		t.Fatalf("a module this rollout did not send names a build or a rollout: %+v", wireguard)
-	}
-	if a.Module != "notes" || a.Commit != "c-notes" || a.Build != buildID || a.Rollout != rollout || a.Artifact != digest ||
-		a.Since.IsZero() || a.Assigned.IsZero() || !a.Stands() {
-		t.Fatalf("the assignment names %+v, not commit c-notes, build %s, artifact %s, rollout %s", a, buildID, digest, rollout)
-	}
-	// One read of the rollout.
-	p, err := inv.PlanByID(ctx, rollout)
-	if err != nil {
-		t.Fatal(err)
-	}
-	wantChange := chain.Change{Node: "anchor", Module: "notes", After: chain.Ref{Build: buildID, Commit: "c-notes"}}
-	if !slices.Contains(p.Changed, wantChange) || !slices.Contains(p.Builds, buildID) || len(p.Steps) != 1 ||
-		p.Steps[0].Node != "anchor" || p.Steps[0].Sent == nil {
-		t.Fatalf("the rollout lists changed %+v, builds %v, steps %+v; want %+v", p.Changed, p.Builds, p.Steps, wantChange)
-	}
-	// And one read of the build names the same commit, with what it published and its reuse key.
-	built, found, err := inv.BuildByID(ctx, buildID)
-	if err != nil || !found || built.Commit != "c-notes" || built.Module != "notes" {
-		t.Fatalf("the build: %+v %v %v", built, found, err)
-	}
-	lately, err := inv.Builds(ctx, "notes", 1)
-	if err != nil || len(lately) != 1 || lately[0].ReuseKey != "rk-notes" || lately[0].Published == nil ||
-		lately[0].Published.Artifact != digest {
-		t.Fatalf("what the build published: %+v %v", lately, err)
-	}
-	// The verbs say the links.
-	if lines := changedLines(p); len(lines) != 2 || !strings.Contains(lines[1], "anchor/notes") ||
-		!strings.Contains(lines[1], buildID) {
-		t.Fatalf("`plans` says %v", lines)
-	}
-	if lines := runLines(on); len(lines) != 2 || !strings.Contains(lines[1], buildID) || !strings.Contains(lines[1], rollout) {
-		t.Fatalf("`node show` says %v", lines)
-	}
-}
-
-// A machine sent again what it runs says nothing new, and a push by hand with no rollout fills what is missing and blanks
-// nothing (issue 1095).
-func TestASendOfWhatAMachineRunsAlreadyChangesNoLinkOfItsAssignment(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	inv := open.inventory
-	register(t, open, catalogue.Manifest{Module: "notes", Version: "1"})
-	if _, err := assign(ctx, open, "anchor", "notes"); err != nil {
-		t.Fatal(err)
-	}
-	if err := inv.RecordBuild(ctx, inventory.Build{ID: "build-1", Module: "notes", Commit: "c1", Repository: "novox/notes"}); err != nil {
-		t.Fatal(err)
-	}
-	node := nodeID(t, open, "anchor")
-	inRollout := inventory.WithRollout(ctx, "plan-1", map[string]inventory.RolloutModule{"notes": {Commit: "c1", Build: "build-1"}})
-	if err := inv.RecordSent(inRollout, node, "d1", map[string]string{"notes": "c1"}); err != nil {
-		t.Fatal(err)
-	}
-	// Sent again by hand, with no rollout: the assignment still names the rollout that put the build there.
-	if err := inv.RecordSent(ctx, node, "d2", map[string]string{"notes": "c1"}); err != nil {
-		t.Fatal(err)
-	}
-	on, _ := inv.AssignmentsOn(ctx, "anchor")
-	if a, _ := assignmentOf(on, "notes"); a.Rollout != "plan-1" || a.Build != "build-1" || a.Commit != "c1" {
-		t.Fatalf("the assignment names %+v", on)
-	}
-	// A declaration sent by hand with no builds known says nothing of them.
-	if err := inv.RecordSent(ctx, node, "d3", nil); err != nil {
-		t.Fatal(err)
-	}
-	if on, _ = inv.AssignmentsOn(ctx, "anchor"); runOf(on, "notes").Commit != "c1" {
-		t.Fatalf("a send of unknown builds changed %+v", on)
-	}
-	// A module sent a commit no build is kept of is named by its commit alone.
-	if err := inv.RecordSent(ctx, node, "d4", map[string]string{"notes": "c2"}); err != nil {
-		t.Fatal(err)
-	}
-	if on, _ = inv.AssignmentsOn(ctx, "anchor"); runOf(on, "notes").Commit != "c2" || runOf(on, "notes").Build != "" ||
-		runOf(on, "notes").Rollout != "" {
-		t.Fatalf("the assignment after a push of c2 by hand names %+v", on)
-	}
-}
-
-// assignmentOf is one module's assignment among those of a machine: assigning a module assigns what it requires beside it.
-func assignmentOf(on []chain.Assignment, module string) (chain.Assignment, bool) {
-	for _, a := range on {
-		if a.Module == module {
-			return a, true
-		}
-	}
-	return chain.Assignment{}, false
-}
-
-func runOf(on []chain.Assignment, module string) chain.Assignment {
-	a, _ := assignmentOf(on, module)
-	return a
-}

cmd/mesh-controller/chain_links.go

@@ -1,121 +0,0 @@
-package main
-
-import (
-	"context"
-	"fmt"
-	"slices"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/chain"
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// The links a rollout makes (novox/hq ADR 0408 §1, design 47 acceptance 10, issue 1095): the send of a plan's tier puts a
-// build on a machine; the assignment of the module there names the build, its commit and the rollout (written by the record of
-// the send, inventory.RecordSent, from the context a send is made in), and the rollout lists the assignments it changed with the
-// build before and after.
-
-// rolloutModules is what a plan sends of each module: the commit and the build of it.
-func rolloutModules(p *inventory.Plan) map[string]inventory.RolloutModule {
-	out := make(map[string]inventory.RolloutModule, len(p.Modules))
-	for m, s := range p.Modules {
-		if s != nil && s.Commit != "" {
-			out[m] = inventory.RolloutModule{Commit: s.Commit, Build: s.Build}
-		}
-	}
-	return out
-}
-
-// sendingAs is the context a plan's send is made in: what is recorded of the send names this rollout.
-func sendingAs(ctx context.Context, p *inventory.Plan) context.Context {
-	return inventory.WithRollout(ctx, p.ID, rolloutModules(p))
-}
-
-// ranBefore is what each module on a machine ran before a send, as the chain names it: its assignment's build and commit,
-// else the commit the machine was last sent for it. Read before the send, which writes the new ones.
-func ranBefore(ctx context.Context, inv *inventory.Inventory, node string) map[string]chain.Ref {
-	was := map[string]chain.Ref{}
-	if sent, known, err := inv.SentBuilds(ctx, node); err == nil && known {
-		for m, commit := range sent {
-			was[m] = chain.Ref{Commit: commit}
-		}
-	}
-	if ran, err := inv.AssignmentRuns(ctx, node); err == nil {
-		for m, r := range ran {
-			was[m] = r
-		}
-	}
-	return was
-}
-
-// noteChanges writes into a plan that a send to a machine changed the assignments of the modules it carried: the build and
-// commit before and after, the builds the rollout carried, and the step taken. A change noted already for the machine and the
-// module is replaced, so a send made again says it once.
-func noteChanges(p *inventory.Plan, node string, modules []string, was map[string]chain.Ref, at time.Time) {
-	for _, m := range modules {
-		s := p.Modules[m]
-		if s == nil {
-			continue
-		}
-		change := chain.Change{Node: node, Module: m, Before: was[m], After: chain.Ref{Build: s.Build, Commit: s.Commit}}
-		if at := slices.IndexFunc(p.Changed, func(c chain.Change) bool { return c.Node == node && c.Module == m }); at >= 0 {
-			change.Before = p.Changed[at].Before
-			p.Changed[at] = change
-		} else {
-			p.Changed = append(p.Changed, change)
-		}
-		if s.Build != "" && !slices.Contains(p.Builds, s.Build) {
-			p.Builds = append(p.Builds, s.Build)
-		}
-	}
-	if !slices.ContainsFunc(p.Steps, func(s chain.Step) bool { return s.Tier == p.Tier && s.Node == node }) {
-		sent := at.UTC()
-		p.Steps = append(p.Steps, chain.Step{Tier: p.Tier, Node: node, Sent: &sent})
-	}
-}
-
-// refSaid is a build and the commit it was made from as a person reads them; "nothing" for a module that ran none.
-func refSaid(r chain.Ref) string {
-	switch {
-	case r.Build == "" && r.Commit == "":
-		return "nothing"
-	case r.Build == "":
-		return "commit " + short(r.Commit)
-	}
-	return r.Build + " (" + short(r.Commit) + ")"
-}
-
-// changedLines say the assignments a rollout changed: the machine, the module, and the build before and after.
-func changedLines(p inventory.Plan) []string {
-	if len(p.Changed) == 0 {
-		return nil
-	}
-	out := []string{"  changed:"}
-	for _, c := range p.Changed {
-		out = append(out, fmt.Sprintf("    %s/%s  %s → %s", c.Node, c.Module, refSaid(c.Before), refSaid(c.After)))
-	}
-	return out
-}
-
-// runLines say what each module assigned to a machine runs there, as its assignment names it: the build, the commit, the
-// rollout that put it there and since when.
-func runLines(assigned []chain.Assignment) []string {
-	var out []string
-	for _, a := range assigned {
-		if a.Build == "" && a.Commit == "" {
-			continue
-		}
-		line := fmt.Sprintf("    %-22s %s", a.Module, refSaid(chain.Ref{Build: a.Build, Commit: a.Commit}))
-		if a.Rollout != "" {
-			line += ", sent by " + a.Rollout
-		}
-		if !a.Since.IsZero() {
-			line += " at " + a.Since.Local().Format("2006-01-02 15:04")
-		}
-		out = append(out, line)
-	}
-	if len(out) == 0 {
-		return nil
-	}
-	return append([]string{"  what they run, as the chain names it:"}, out...)
-}

cmd/mesh-controller/chain_links_test.go

@@ -1,69 +0,0 @@
-package main
-
-import (
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/chain"
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// **A rollout lists the assignments it changed, each with the build before and after** (ADR 0408 §1, issue 1095): one
-// change for a machine and a module however often the send is noted, the build before kept from the first, the builds the
-// rollout carried once each, and one step for a machine and a tier.
-func TestARolloutListsTheAssignmentsItChangedWithTheBuildBeforeAndAfter(t *testing.T) {
-	at := time.Date(2026, 10, 18, 3, 0, 0, 0, time.UTC)
-	p := inventory.Plan{ID: "plan-1", Tier: 1, Modules: map[string]*inventory.PlanModule{
-		"notes": {Commit: "c2", Build: "b2"}, "wiki": {Commit: "c2w", Build: "b2w"}, "nothing": nil}}
-	was := map[string]chain.Ref{"notes": {Build: "b1", Commit: "c1"}, "wiki": {Commit: "c1w"}}
-
-	noteChanges(&p, "anchor", []string{"notes", "wiki", "nothing"}, was, at)
-	noteChanges(&p, "laptop", []string{"notes"}, nil, at)
-	// The send noted again, after what was sent had become what the machine runs: the first before stands.
-	noteChanges(&p, "anchor", []string{"notes"}, map[string]chain.Ref{"notes": {Build: "b2", Commit: "c2"}}, at.Add(time.Minute))
-
-	want := []chain.Change{
-		{Node: "anchor", Module: "notes", Before: chain.Ref{Build: "b1", Commit: "c1"}, After: chain.Ref{Build: "b2", Commit: "c2"}},
-		{Node: "anchor", Module: "wiki", Before: chain.Ref{Commit: "c1w"}, After: chain.Ref{Build: "b2w", Commit: "c2w"}},
-		{Node: "laptop", Module: "notes", After: chain.Ref{Build: "b2", Commit: "c2"}},
-	}
-	if len(p.Changed) != len(want) {
-		t.Fatalf("changed %+v", p.Changed)
-	}
-	for k := range want {
-		if p.Changed[k] != want[k] {
-			t.Errorf("change %d is %+v, want %+v", k, p.Changed[k], want[k])
-		}
-	}
-	if len(p.Builds) != 2 || p.Builds[0] != "b2" || p.Builds[1] != "b2w" {
-		t.Errorf("builds %v", p.Builds)
-	}
-	if len(p.Steps) != 2 || p.Steps[0].Node != "anchor" || p.Steps[0].Tier != 1 || p.Steps[0].Sent == nil || p.Steps[1].Node != "laptop" {
-		t.Errorf("steps %+v", p.Steps)
-	}
-	lines := changedLines(p)
-	if len(lines) != 4 || !strings.Contains(lines[1], "anchor/notes  b1 (c1) → b2 (c2)") ||
-		!strings.Contains(lines[3], "laptop/notes  nothing → b2 (c2)") {
-		t.Errorf("changed lines %q", lines)
-	}
-	if got := changedLines(inventory.Plan{}); got != nil {
-		t.Errorf("a plan that changed nothing says %q", got)
-	}
-}
-
-func TestWhatAMachineRunsIsSaidAsItsAssignmentNamesIt(t *testing.T) {
-	at := time.Date(2026, 10, 18, 3, 0, 0, 0, time.UTC)
-	lines := runLines([]chain.Assignment{
-		{Node: "anchor", Module: "notes", Build: "b2", Commit: "c2c2c2c2c2c2", Rollout: "plan-1", Since: at},
-		{Node: "anchor", Module: "web", Commit: "c3"},
-		{Node: "anchor", Module: "never-sent"},
-	})
-	if len(lines) != 3 || !strings.Contains(lines[1], "notes") || !strings.Contains(lines[1], "b2 (c2c2c2c2)") ||
-		!strings.Contains(lines[1], "sent by plan-1") || !strings.Contains(lines[2], "web") || !strings.Contains(lines[2], "commit c3") {
-		t.Fatalf("lines %q", lines)
-	}
-	if runLines([]chain.Assignment{{Node: "a", Module: "m"}}) != nil {
-		t.Fatal("a module never sent is said to run something")
-	}
-}

cmd/mesh-controller/changeplan.go

@@ -1,221 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"path"
-	"slices"
-	"sort"
-	"strings"
-
-	"github.com/novox/mesh-controller/internal/catalogue"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// The change plan (novox/hq ADR 0238): **one commit, one plan** — what a change does to the mesh, computed
-// from its diffset (a repository, the branch it merges into, the commit at hand) by the planner, never by
-// a mapping of its own. reachOfMerge answers what moves and what follows it; this adds where each module
-// goes — the deploy plan, machine by machine in the build plan's order — and what is not an ordinary
-// send. A pull request's check posts it with its verdict; the release a merge makes follows the same
-// planner, so the two can be compared.
-
-// policyOf is a module's upgrade policy, as the controller holds it; false when it cannot be read.
-type policyOf func(module string) (inventory.Upgrade, bool)
-
-// changePlanOf is the change plan of a reach: pure, so it is tested without a store.
-func changePlanOf(repository, base, head string, r mergeReach, entries []inventory.Entry, policy policyOf) link.ChangePlan {
-	p := link.ChangePlan{Repository: repository, Base: base, Head: head, Moved: r.Moved(), Dependents: r.Dependents(),
-		New: r.Added, Unread: r.Unread, Tiers: r.Plan.Tiers}
-	byName := map[string]inventory.Entry{}
-	for _, e := range entries {
-		byName[e.Manifest.Module] = e
-	}
-	// The machine holding the bus, whose declaration carries every module's grants (novox/hq issue 490).
-	holder := ""
-	for _, e := range entries {
-		if e.Manifest.BusUsers != "" && e.Manifest.ClaimsSeat(catalogue.BrokerSeat) && len(e.On) > 0 {
-			holder = e.On[0]
-		}
-	}
-	var granting []string
-	machines := map[string]*link.MachinePlan{}
-	machine := func(name string) *link.MachinePlan {
-		if machines[name] == nil {
-			machines[name] = &link.MachinePlan{Machine: name}
-		}
-		return machines[name]
-	}
-	for _, tier := range r.Plan.Tiers {
-		for _, name := range tier {
-			e, held := byName[name]
-			if !held {
-				continue
-			}
-			u, known := policy(name)
-			waits := known && !u.RollOut
-			for _, on := range e.On {
-				if waits {
-					machine(on).Waits = append(machine(on).Waits, name)
-				} else {
-					machine(on).Receives = append(machine(on).Receives, name)
-				}
-			}
-			if !waits && holder != "" && !(len(e.On) == 1 && e.On[0] == holder) && len(e.On) > 0 &&
-				!slices.Contains(granting, name) {
-				granting = append(granting, name)
-			}
-			switch {
-			case (name == "nats" || catalogue.ProvidesBus(e.Manifest)) && len(e.On) > 0:
-				// Said before the merge (novox/hq issue 336): a new bus build holds every send to the bus's machine
-				// until a person takes the step, so merging it is a promise to take it.
-				p.Steps = append(p.Steps, fmt.Sprintf("%s: %s is never sent by an ordinary send, and until %s runs, "+
-					"nothing else is sent to %s either — unless the new build turns out the same as the one running there "+
-					"(issue 280)", busUpgradeNeeded, name, busUpgradeVerb, strings.Join(e.On, ", ")))
-			case name == "nats" || catalogue.ProvidesBus(e.Manifest):
-				p.Steps = append(p.Steps, "a planned bus step: the bus is upgraded by `bus upgrade`, never by an ordinary send")
-			case waits && len(e.On) > 0 && (u.From == catalogue.FromModule || u.From == catalogue.FromData):
-				// Judged per machine by the walk, against the build each was last sent (novox/hq ADR 0377).
-				p.Steps = append(p.Steps, fmt.Sprintf("%s waits for a person: its policy records (%s) — unless on a machine "+
-					"its move recreates none of its containers and moves none of its data, which the walk judges and then sends",
-					name, orNone(u.From)))
-			case waits && len(e.On) > 0:
-				p.Steps = append(p.Steps, fmt.Sprintf("%s waits for a person: its policy records (%s)", name,
-					orNone(u.From)))
-			}
-			if len(e.Manifest.Provides) > 0 && len(e.On) > 0 {
-				var offers []string
-				for _, o := range e.Manifest.Provides {
-					offers = append(offers, o.Name)
-				}
-				p.Steps = append(p.Steps, fmt.Sprintf("%s provides %s: its consumers are sent again after it",
-					name, strings.Join(offers, ", ")))
-			}
-			if e.Manifest.Data != nil && len(e.On) > 0 {
-				p.Steps = append(p.Steps, fmt.Sprintf("%s keeps data (ADR 0233): what it holds is backed up before it moves", name))
-			}
-		}
-	}
-	if len(granting) > 0 {
-		// Said before the merge (novox/hq issue 490): what the walk does when the change alters the bus's
-		// user list. Whether it does is known only once the builds are registered, so it is said as a rule.
-		p.Steps = append(p.Steps, fmt.Sprintf("%s: if this changes what the bus's user list says (a new tool, "+
-			"subject or user), %s is sent that list alone, every build there kept, before %s is judged on its first "+
-			"machine", grantsStepWord, holder, strings.Join(granting, ", ")))
-	}
-	var names []string
-	for name := range machines {
-		names = append(names, name)
-	}
-	sort.Strings(names)
-	for _, name := range names {
-		p.Machines = append(p.Machines, *machines[name])
-	}
-	p.Summary = summaryOf(p)
-	p.Class = changeClassOf(p, entries)
-	return p
-}
-
-// classNone is the class of a change that moves no module: nothing for a walk to move (novox/hq ADR 0313 §2).
-const classNone = "none"
-
-// changeClassOf is a change plan's class (novox/hq ADR 0313 §2): that of the slowest-budgeted module it moves,
-// itself or as a dependent — core when one is on the controller's own path or holds the mesh's resolver, leaf
-// otherwise — and none when it moves nothing. A module it adds a directory for counts by its own class: the
-// catalogue names a module's directory by the module, so the directory's last element is its name. The graph holds
-// no manifest of it yet, so a new module is core by its name alone (on the controller's own path), never by a
-// resolver claim its manifest makes.
-func changeClassOf(p link.ChangePlan, entries []inventory.Entry) string {
-	if len(p.Moved) == 0 && len(p.Dependents) == 0 && len(p.New) == 0 {
-		return classNone
-	}
-	modules := append(append([]string{}, p.Moved...), p.Dependents...)
-	for _, dir := range p.New {
-		if name := path.Base(strings.Trim(dir, "/")); name != "." && name != "/" && name != "" {
-			modules = append(modules, name)
-		}
-	}
-	return classOfModules(modules, entries)
-}
-
-// grantsStepWord names the grants step (novox/hq issue 490): the bus's user list sent alone to the machine
-// holding the bus ahead of a walk's gate. Not the bus step, which replaces the bus itself.
-const grantsStepWord = "grants step"
-
-// busUpgradeNeeded is how a change plan says that merging it holds the bus's machine for a person's step.
-const busUpgradeNeeded = "merging this needs a person's bus upgrade"
-
-// summaryOf is a change plan in one line: what it builds, where it goes, and whether the bus moves.
-func summaryOf(p link.ChangePlan) string {
-	if len(p.Moved) == 0 && len(p.New) == 0 {
-		return "builds nothing: the change touches no module of the mesh's graph"
-	}
-	var parts []string
-	what := strings.Join(p.Moved, ", ")
-	if len(p.Dependents) > 0 {
-		what += fmt.Sprintf(" (+%d dependent(s))", len(p.Dependents))
-	}
-	if len(p.New) > 0 {
-		if what != "" {
-			what += ", "
-		}
-		what += "new: " + strings.Join(p.New, ", ")
-	}
-	var to []string
-	for _, m := range p.Machines {
-		if len(m.Receives) > 0 {
-			to = append(to, m.Machine)
-		}
-	}
-	if len(to) > 0 {
-		parts = append(parts, "builds "+what+" → "+strings.Join(to, ", "))
-	} else {
-		parts = append(parts, "builds "+what+", sent nowhere")
-	}
-	bus := "no bus step"
-	for _, s := range p.Steps {
-		switch {
-		case strings.HasPrefix(s, busUpgradeNeeded):
-			bus = busUpgradeNeeded
-		case strings.HasPrefix(s, "a planned bus step") && bus == "no bus step":
-			bus = "a bus step"
-		}
-	}
-	parts = append(parts, bus)
-	waiting := 0
-	for _, m := range p.Machines {
-		waiting += len(m.Waits)
-	}
-	if waiting > 0 {
-		parts = append(parts, fmt.Sprintf("%d wait(s) for a person", waiting))
-	}
-	return strings.Join(parts, "; ")
-}
-
-// planText is a change plan as a person reads it, for the pull request's comment.
-func planText(p link.ChangePlan) string {
-	var b strings.Builder
-	fmt.Fprintf(&b, "change plan of %s at %.8s into %s: %s\n", p.Repository, p.Head, p.Base, p.Summary)
-	for i, tier := range p.Tiers {
-		fmt.Fprintf(&b, "  tier %d: %s\n", i, strings.Join(tier, ", "))
-	}
-	for _, m := range p.Machines {
-		line := "  " + m.Machine + ": "
-		if len(m.Receives) > 0 {
-			line += "receives " + strings.Join(m.Receives, ", ")
-		}
-		if len(m.Waits) > 0 {
-			if len(m.Receives) > 0 {
-				line += "; "
-			}
-			line += "waits for a person: " + strings.Join(m.Waits, ", ")
-		}
-		b.WriteString(line + "\n")
-	}
-	for _, s := range p.Steps {
-		b.WriteString("  - " + s + "\n")
-	}
-	if len(p.Unread) > 0 {
-		fmt.Fprintf(&b, "  read by no module's build: %s\n", strings.Join(p.Unread, ", "))
-	}
-	return b.String()
-}

cmd/mesh-controller/changeplan_test.go

@@ -1,78 +0,0 @@
-package main
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/catalogue"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// **One commit, one change plan** (novox/hq ADR 0238): the planner's reach, laid out machine by machine in
-// the build plan's order, with what is not an ordinary send said — the bus step, a module that waits for a
-// person, a provider whose consumers follow it.
-func TestAChangePlanSaysWhatEachMachineReceives(t *testing.T) {
-	const catalogue_ = "http://forge.internal:20000/novox/mesh-catalog.git"
-	entry := func(name, path string, on ...string) inventory.Entry {
-		e := fromRepo(name, catalogue_, path)
-		e.Source.BuiltFrom = "old"
-		e.On = on
-		return e
-	}
-	nats := entry("nats", "modules/nats", "anchor")
-	nats.Manifest.Provides = []catalogue.Offer{{Name: "mesh-bus"}}
-	gitea := entry("gitea", "modules/gitea", "anchor")
-	held := entry("photos", "modules/photos", "anchor", "laptop")
-	tools := fromRepo("node-tools", "http://forge.internal:20000/novox/mesh-tools.git", "node-tools")
-	tools.On = []string{"anchor", "laptop"}
-	entries := []inventory.Entry{nats, gitea, held, tools}
-	edges := []inventory.Edge{{From: "node-tools", To: "nats", Kind: inventory.EdgeStandsOn}}
-	policy := func(module string) (inventory.Upgrade, bool) {
-		if module == "photos" {
-			return inventory.Upgrade{RollOut: false, From: "a person"}, true
-		}
-		return inventory.Upgrade{RollOut: true}, true
-	}
-	plan := func(paths ...string) link.ChangePlan {
-		m := link.SourceMoved{Owner: "novox", Repo: "mesh-catalog", Base: "main", Commit: "head", Paths: paths}
-		return changePlanOf("novox/mesh-catalog", "main", "head", reachOfMerge(m, entries, nil, edges), entries, policy)
-	}
-
-	p := plan("modules/gitea/index.ts")
-	if p.Summary != "builds gitea → anchor; no bus step" {
-		t.Errorf("one module's change reads %q", p.Summary)
-	}
-
-	p = plan("modules/nats/Dockerfile", "modules/photos/x.js")
-	if !strings.Contains(p.Summary, "needs a person's bus upgrade") || !strings.Contains(p.Summary, "2 wait(s) for a person") ||
-		!strings.Contains(p.Summary, "(+1 dependent(s))") {
-		t.Errorf("the bus and a held module read %q", p.Summary)
-	}
-	got := map[string]string{}
-	for _, m := range p.Machines {
-		got[m.Machine] = strings.Join(m.Receives, ",") + "|" + strings.Join(m.Waits, ",")
-	}
-	// The bus first, what stands on it after: the build plan's order, per machine.
-	if got["anchor"] != "nats,node-tools|photos" || got["laptop"] != "node-tools|photos" {
-		t.Errorf("the deploy plan reads %v", got)
-	}
-	text := strings.Join(p.Steps, "\n")
-	// Said before the merge (novox/hq issue 336): merging it holds every send to the bus's machine until a
-	// person runs the bus's step, and the verb that does.
-	for _, want := range []string{"merging this needs a person's bus upgrade", "nothing else is sent to anchor",
-		"mesh_call mesh-controller.bus", "the same as the one running there", "photos waits for a person",
-		"nats provides mesh-bus"} {
-		if !strings.Contains(text, want) {
-			t.Errorf("the steps do not say %q:\n%s", want, text)
-		}
-	}
-
-	p = plan("merge-check.sh")
-	if !strings.HasPrefix(p.Summary, "builds nothing") || len(p.Machines) != 0 || strings.Join(p.Unread, ",") != "merge-check.sh" {
-		t.Errorf("a root file's plan reads %+v", p)
-	}
-	if !strings.Contains(planText(p), "read by no module's build: merge-check.sh") {
-		t.Errorf("the plan's text does not say why nothing is built:\n%s", planText(p))
-	}
-}

cmd/mesh-controller/check.go

@@ -10,7 +10,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/link"
 )
 

cmd/mesh-controller/check_builds.go

@@ -1,87 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"os"
-	"strconv"
-
-	"github.com/novox/mesh-controller/internal/builder"
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// A pull request's check builds go when it closes (novox/hq ADR 0350 §5): the build seat keeps them in the artifact
-// store's scratch namespace for the walk of its merge to take. **Let go of where the moment is heard**: the
-// controller ends the walk answering a merge — after that walk took what it reuses — and the delivery's owner, which
-// hears the forge say a pull request closed unmerged, asks the `forget-checks` verb; both let go through the store,
-// as the controller's own collection does. The build seat's holders let go of anything a week old on their own,
-// so a word lost here leaves a week's builds, never more.
-
-// checkBuildsIn is the scratch namespace as the controller reaches the artifact store.
-func checkBuildsIn(ctx context.Context, inv *inventory.Inventory) (builder.Scratch, error) {
-	shelf, err := inv.Catalogue(ctx)
-	if err != nil {
-		return nil, err
-	}
-	address, err := artifactStoreAddress(ctx, inv, shelf, "")
-	if err != nil {
-		return nil, err
-	}
-	if address == "" {
-		return nil, errors.New("the artifact store is not on the mesh's network")
-	}
-	return builder.Registry{Address: address}, nil
-}
-
-// forgetChecks lets go of a pull request's check builds and answers what it did.
-var forgetChecks = func(ctx context.Context, inv *inventory.Inventory, pull builder.PullRef) (string, error) {
-	scratch, err := checkBuildsIn(ctx, inv)
-	if err != nil {
-		return "", err
-	}
-	n, err := scratch.Forget(ctx, pull)
-	if err != nil {
-		return "", fmt.Errorf("%s: %d check(s)' builds let go of, and not all: %w", pull, n, err)
-	}
-	return fmt.Sprintf("%s: %d check(s)' builds let go of", pull, n), nil
-}
-
-// forgetChecksOfWalk lets go, on the save that ends a walk, of the check builds of every pull request whose merge
-// it answers: the walk took what it reuses. Said, never fatal.
-func forgetChecksOfWalk(ctx context.Context, inv *inventory.Inventory, p inventory.Plan) {
-	if p.WalkSaid != inventory.WalkEnded || p.Delivery == nil {
-		return
-	}
-	for _, pull := range reuseAskOf(&p).Pulls {
-		said, err := forgetChecks(ctx, inv, builder.PullRef{Owner: pull.Owner, Repo: pull.Repo, Number: pull.Number})
-		if err != nil {
-			fmt.Fprintf(os.Stderr, "%s: its check builds stay until the week's sweep: %v\n", p.ID, err)
-			continue
-		}
-		fmt.Printf("%s: %s\n", p.ID, said)
-	}
-}
-
-// forgetChecksCommand is `forget-checks <owner> <repo> <number>`: the verb the delivery's owner asks when the forge
-// says a pull request closed unmerged (novox/hq ADR 0350 §5).
-func forgetChecksCommand(ctx context.Context, args []string) error {
-	if len(args) != 3 {
-		return errors.New("forget-checks <owner> <repo> <number>")
-	}
-	number, err := strconv.Atoi(args[2])
-	if err != nil || number <= 0 {
-		return fmt.Errorf("%q is not a pull request's number", args[2])
-	}
-	open, err := openStores(ctx)
-	if err != nil {
-		return err
-	}
-	defer open.Close()
-	said, err := forgetChecks(ctx, open.inventory, builder.PullRef{Owner: args[0], Repo: args[1], Number: number})
-	if err != nil {
-		return err
-	}
-	fmt.Println(said)
-	return nil
-}

cmd/mesh-controller/check_builds_integration_test.go

@@ -1,102 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"encoding/json"
-	"reflect"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/catalogue"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-func TestOnlyAWalksAskTakesAChecksBuildAndADryRunNever(t *testing.T) {
-	p := &inventory.Plan{Delivery: &inventory.PlanDelivery{Merges: []inventory.PlanMerge{
-		{Repository: "novox/shop", Number: 7}, {Repository: "http://forge.invalid/novox/web.git", Number: 3},
-		{Repository: "novox/shop", Number: 7}, {Repository: "novox/shop"}}}}
-	asked := reuseAskOf(p)
-	if want := []link.PullRef{{Owner: "novox", Repo: "shop", Number: 7}, {Owner: "novox", Repo: "web", Number: 3}}; !reflect.DeepEqual(asked.Pulls, want) {
-		t.Fatalf("the walk names %+v", asked.Pulls)
-	}
-	walk := withReuse(t.Context(), asked)
-	if reuseAsked(walk, false) != asked {
-		t.Fatal("a walk's ask does not carry its leave")
-	}
-	if reuseAsked(walk, true) != nil {
-		t.Fatal("a dry run carries a leave to take a check's build")
-	}
-	if reuseAsked(t.Context(), false) != nil {
-		t.Fatal("an ask that is not a walk's carries a leave")
-	}
-}
-
-func TestAReusedCheckBuildIsRegisteredByItsDigestAndGatedAsABuiltOne(t *testing.T) {
-	withTheGate(t) // the first-machine gate's own path (novox/hq ADR 0360 keeps it for earlier walks)
-	g := aGateMesh(t)
-	ctx := t.Context()
-	inv := g.open.inventory
-	gateEvery = 0
-
-	digest := "sha256:" + strings.Repeat("c", 64)
-	reused := func(id, reference string) link.BuildResult {
-		manifest := mustJSON(t, catalogue.Manifest{Module: "app", Version: "c3", Resources: []map[string]any{
-			{"id": "svc", "type": "container", "name": "app", "image": reference}}})
-		return link.BuildResult{ID: id, Repository: "novox/mesh-catalog", Path: "modules/app", Ref: "main", On: "anchor",
-			Commit: "c3", Manifest: manifest, Trunk: "main", OnTrunk: true, Branches: []string{"main"},
-			Made:   []link.MadeArtifact{{Name: "server", Kind: "image", Reference: reference}},
-			Source: &link.SourceOnSeat{Seat: "git", Repository: "novox/mesh-catalog"},
-			Reused: "reused from the check of novox/mesh-catalog#9 at head abcdefabcdef (merged into trunk 123456123456): server " + digest,
-			ReusedFrom: &link.ReusedFrom{Pull: link.PullRef{Owner: "novox", Repo: "mesh-catalog", Number: 9},
-				Head: "abcdefabcdef", Trunk: "123456123456", Key: "r1:" + strings.Repeat("1", 64)}}
-	}
-	if _, _, err := takeIn(ctx, inv, reused(link.NewBuildID(time.Now()), "store.internal:5000/scratch/app/server@"+digest)); err == nil ||
-		!strings.Contains(err.Error(), "scratch") {
-		t.Fatalf("a build in the scratch namespace was registered: %v", err)
-	}
-	id := link.NewBuildID(time.Now().Add(time.Second))
-	result := reused(id, "store.internal:5000/app/server@"+digest)
-	if _, _, err := takeIn(ctx, inv, result); err != nil {
-		t.Fatal(err)
-	}
-	current, err := inv.CurrentBuilds(ctx)
-	if err != nil || current["app"].Commit != "c3" {
-		t.Fatalf("the reused build is not what app is registered at: %+v %v", current["app"], err)
-	}
-	shelf, err := inv.Catalogue(ctx)
-	if err != nil {
-		t.Fatal(err)
-	}
-	raw, _ := json.Marshal(shelf["app"].Resources)
-	if !strings.Contains(string(raw), "app/server@"+digest) {
-		t.Fatalf("app is registered as %s, not by the check's digest in its own namespace", raw)
-	}
-
-	// The walk asked it: the walk keeps what its build did, and its gate judges the registered build.
-	asked := time.Now().UTC()
-	p := g.plan(t)
-	p.Commit = "c3"
-	p.Modules["app"] = &inventory.PlanModule{State: "asked", AskedAt: &asked, Build: id}
-	if err := inv.SavePlan(ctx, &p); err != nil {
-		t.Fatal(err)
-	}
-	planBuiltSaying(ctx, g.open, "app", "c3", "", asked, id, result.MadeWords())
-	p = g.plan(t)
-	if m := p.Modules["app"]; m.State != "built" || !strings.HasPrefix(m.Made, "reused from the check of novox/mesh-catalog#9") {
-		t.Fatalf("the walk keeps %+v", m)
-	}
-	for i := 0; i < 6; i++ {
-		advancePlans(ctx, g.open)
-	}
-	p = g.plan(t)
-	gate := p.Modules["app"].Gate
-	if gate == nil || gate.To != "c3" || gate.Verdict != inventory.GatePassed {
-		t.Fatalf("the gate judged %+v, not the reused build", gate)
-	}
-	if sent, _, _ := inv.SentBuilds(ctx, "anchor"); sent["app"] != "c3" {
-		t.Fatalf("the first machine was sent %v, not the reused build", sent)
-	}
-}

cmd/mesh-controller/check_builds_test.go

@@ -1,193 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"reflect"
-	"strings"
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/builder"
-	"github.com/novox/mesh-controller/internal/catalogue"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// One build per change (novox/hq ADR 0350), as the controller asks it and takes it in.
-
-// The check of a change is asked to build what a merge of it would move, in the walk's order: a module of the
-// repository checked from the merge, one standing on it from its own repository as the walk builds it, and one
-// that reads the repository through a context not at all. A change that moves no module builds nothing.
-func TestACheckIsAskedToBuildWhatTheMergeWouldMove(t *testing.T) {
-	entries := []inventory.Entry{
-		{Manifest: catalogue.Manifest{Module: "app"}, Source: inventory.Source{Repository: "novox/shop", Seat: "git", Path: "modules/app"}},
-		{Manifest: catalogue.Manifest{Module: "web"}, Source: inventory.Source{Repository: "novox/web", Seat: "git", Ref: "main"}},
-		{Manifest: catalogue.Manifest{Module: "docs"}, Source: inventory.Source{Repository: "novox/docs", Seat: "git"}},
-	}
-	p := link.PullUpdated{Owner: "novox", Repo: "shop", Number: 7, Base: "main", Commit: "abc"}
-	scope := checkScope{Reach: mergeReach{Packaging: entries[2:], Plan: inventory.Plan{Tiers: [][]string{{"app", "docs"}, {"web"}}}}}
-	clone := func(s inventory.Source) (string, error) { return "http://forge.invalid/" + s.Repository + ".git", nil }
-
-	got := checkBuildsOf(p, scope, entries, clone)
-	want := []link.CheckBuild{
-		{Module: "app", Path: "modules/app", Merged: true, Tier: 0},
-		{Module: "docs", Tier: 0, Skip: "its build reads novox/shop through a context, which a check cannot hand the merge"},
-		{Module: "web", Repository: "http://forge.invalid/novox/web.git", Ref: "main", Tier: 1},
-	}
-	if !reflect.DeepEqual(got, want) {
-		t.Fatalf("the check is asked to build\n%+v\nwant\n%+v", got, want)
-	}
-	if got := checkBuildsOf(p, checkScope{}, entries, clone); got != nil {
-		t.Fatalf("a change that moves no module asks for builds: %+v", got)
-	}
-}
-
-// A walk's ask carries its leave to take a check's build, naming the pull requests of the merges it answers; a dry
-// run never does, and neither does an ask that is not a walk's.
-
-// A walk ended lets go of its merges' check builds — only once it ended, after it took what it reuses.
-func TestAWalkEndedLetsGoOfItsMergesCheckBuilds(t *testing.T) {
-	var forgot []builder.PullRef
-	was := forgetChecks
-	forgetChecks = func(_ context.Context, _ *inventory.Inventory, pull builder.PullRef) (string, error) {
-		forgot = append(forgot, pull)
-		return "", nil
-	}
-	t.Cleanup(func() { forgetChecks = was })
-	p := inventory.Plan{ID: "plan-1", Delivery: &inventory.PlanDelivery{Merges: []inventory.PlanMerge{
-		{Repository: "novox/shop", Number: 7}}}}
-
-	p.WalkSaid = inventory.WalkStarted
-	forgetChecksOfWalk(t.Context(), nil, p)
-	p.WalkSaid = ""
-	forgetChecksOfWalk(t.Context(), nil, p)
-	if len(forgot) != 0 {
-		t.Fatalf("a walk not ended let go of %v, which it may still take", forgot)
-	}
-	p.WalkSaid = inventory.WalkEnded
-	forgetChecksOfWalk(t.Context(), nil, p)
-	if want := []builder.PullRef{{Owner: "novox", Repo: "shop", Number: 7}}; !reflect.DeepEqual(forgot, want) {
-		t.Fatalf("the walk ended let go of %v", forgot)
-	}
-}
-
-// A build in the scratch namespace is never registered: only the walk's copy in the module's own namespace is.
-func TestABuildInTheScratchNamespaceIsNeverRegistered(t *testing.T) {
-	if got := inScratch([]link.MadeArtifact{{Name: "server", Reference: "store.internal:5000/app/server@sha256:aa"}}); got != "" {
-		t.Fatalf("a module's own build reads as a scratch build: %s", got)
-	}
-	scratch := "store.internal:5000/scratch/app/server@sha256:aa"
-	if got := inScratch([]link.MadeArtifact{{Name: "server", Reference: scratch}}); got != scratch {
-		t.Fatalf("a scratch build was not found: %q", got)
-	}
-	if got := inScratch([]link.MadeArtifact{{Name: "look", Reference: "http://store.internal:5000/v2/scratch/app/look/blobs/sha256:bb"}}); got == "" {
-		t.Fatal("a scratch archive was not found")
-	}
-}
-
-// The walk says per module what it did: "reused from …" or "built: <why>" — and a build seat from before says
-// neither, which is said.
-func TestAWalksBuildSaysWhetherItReusedOrBuilt(t *testing.T) {
-	if got := (link.BuildResult{Reused: "reused from the check of novox/shop#7"}).MadeWords(); got != "reused from the check of novox/shop#7" {
-		t.Fatalf("said %q", got)
-	}
-	if got := (link.BuildResult{BuiltWhy: "no check built it"}).MadeWords(); got != "built: no check built it" {
-		t.Fatalf("said %q", got)
-	}
-	if got := (link.BuildResult{}).MadeWords(); !strings.Contains(got, "predates ADR 0350") {
-		t.Fatalf("said %q", got)
-	}
-}
-
-// A walk's module the check's build stood in for is registered by the digest the check built — the copy in the
-// module's namespace — and the walk keeps "reused from …" for it; its first-node gate judges that registered
-// build as it judges one the walk built. A scratch reference is refused. Needs the store (MESH_TEST_POSTGRES), and
-// is named in testdata/store-tests.
-
-// A walk's leave names the builds its own pull requests' verdicts made at the head each merge merged — never an
-// earlier head's — read once per walk, and none when they cannot be read: the builder takes nothing a verdict does
-// not name (novox/hq ADR 0350 §2, issue 703).
-func TestAWalksLeaveNamesTheBuildsItsPullRequestsVerdictsMade(t *testing.T) {
-	was := checkedBuildsOf
-	forgetWalkVerdicts()
-	t.Cleanup(func() { checkedBuildsOf = was; forgetWalkVerdicts() })
-	var asked [][]link.PullRef
-	pull := link.PullRef{Owner: "novox", Repo: "shop", Number: 7}
-	atHead := link.CheckedBuild{Pull: pull, Check: "build-2", Head: "bbbbbbbbbbbb", Built: link.CheckBuilt{Module: "app", Key: "r1:2"}}
-	earlier := link.CheckedBuild{Pull: pull, Check: "build-1", Head: "aaaaaaaaaaaa", Built: link.CheckBuilt{Module: "app", Key: "r1:1"}}
-	checkedBuildsOf = func(_ context.Context, pulls []link.PullRef) ([]link.CheckedBuild, error) {
-		asked = append(asked, pulls)
-		return []link.CheckedBuild{atHead, earlier}, nil
-	}
-	pulls := []link.PullRef{pull}
-	heads := map[link.PullRef]string{pull: "bbbbbbbbbbbb0123456789"}
-	for range 3 {
-		if got := reuseWithVerdicts(t.Context(), "plan-1", &link.ReuseAsk{Pulls: pulls}, heads); !reflect.DeepEqual(got.Builds,
-			[]link.CheckedBuild{atHead}) {
-			t.Fatalf("the leave names %+v, not only the merged head's build", got.Builds)
-		}
-	}
-	if !reflect.DeepEqual(asked, [][]link.PullRef{pulls}) {
-		t.Fatalf("the verdicts were read %d times for one walk: %v", len(asked), asked)
-	}
-	// A merge whose head was not said takes nothing.
-	if got := reuseWithVerdicts(t.Context(), "plan-1", &link.ReuseAsk{Pulls: pulls}, nil); got.Builds != nil {
-		t.Fatalf("a merge of no said head names %+v", got.Builds)
-	}
-	checkedBuildsOf = func(context.Context, []link.PullRef) ([]link.CheckedBuild, error) {
-		return nil, errors.New("no bus")
-	}
-	if got := reuseWithVerdicts(t.Context(), "plan-2", &link.ReuseAsk{Pulls: pulls}, heads); got.Builds != nil {
-		t.Fatalf("verdicts that could not be read named %+v", got.Builds)
-	}
-}
-
-// A check is handed only the builds earlier checks of its own pull request at its own head made: another pull
-// request's build, or an earlier head's, is never kept (novox/hq issue 703). None when they cannot be read.
-func TestACheckIsHandedOnlyItsOwnHeadsBuilds(t *testing.T) {
-	was := checkedBuildsOf
-	t.Cleanup(func() { checkedBuildsOf = was })
-	pull := link.PullRef{Owner: "novox", Repo: "shop", Number: 7}
-	mine := link.CheckedBuild{Pull: pull, Check: "build-1", Head: "bbbbbbbbbbbb", Built: link.CheckBuilt{Module: "app", Key: "r1:1"}}
-	earlier := link.CheckedBuild{Pull: pull, Check: "build-0", Head: "aaaaaaaaaaaa", Built: link.CheckBuilt{Module: "app", Key: "r1:1"}}
-	another := link.CheckedBuild{Pull: link.PullRef{Owner: "novox", Repo: "shop", Number: 8}, Check: "build-9",
-		Head: "bbbbbbbbbbbb", Built: link.CheckBuilt{Module: "app", Key: "r1:1"}}
-	var asked [][]link.PullRef
-	checkedBuildsOf = func(_ context.Context, pulls []link.PullRef) ([]link.CheckedBuild, error) {
-		asked = append(asked, pulls)
-		return []link.CheckedBuild{mine, earlier, another}, nil
-	}
-	p := link.PullUpdated{Owner: "novox", Repo: "shop", Number: 7, Commit: "bbbbbbbbbbbb0123456789"}
-	builds := []link.CheckBuild{{Module: "app"}}
-	if got := namedForTheCheck(t.Context(), p, builds); !reflect.DeepEqual(got, []link.CheckedBuild{mine}) ||
-		!reflect.DeepEqual(asked, [][]link.PullRef{{pull}}) {
-		t.Fatalf("the check is handed %+v, read for %v", got, asked)
-	}
-	checkedBuildsOf = func(context.Context, []link.PullRef) ([]link.CheckedBuild, error) {
-		return nil, errors.New("no bus")
-	}
-	if got := namedForTheCheck(t.Context(), p, builds); got != nil {
-		t.Fatalf("verdicts that could not be read named %+v", got)
-	}
-}
-
-func forgetWalkVerdicts() {
-	walkVerdicts.Lock()
-	defer walkVerdicts.Unlock()
-	walkVerdicts.read = map[string]verdictsRead{}
-}
-
-// A walk's merged heads are the forge's word for each merge; a merge announced without its head, or a pull request
-// merged at two heads in one walk, has none, and its walk takes no check's build (novox/hq issue 703).
-func TestAWalksMergedHeadsAreTheForgesWord(t *testing.T) {
-	merge := func(number int, head string) inventory.PlanMerge {
-		return inventory.PlanMerge{Repository: "novox/shop", Number: number, Head: head}
-	}
-	p := &inventory.Plan{Delivery: &inventory.PlanDelivery{Merges: []inventory.PlanMerge{
-		merge(7, "aaaaaaaaaaaa1"), merge(8, ""), merge(9, "bbbbbbbbbbbb"), merge(9, "cccccccccccc")}}}
-	heads := mergedHeadsOf(p)
-	shop := func(n int) link.PullRef { return link.PullRef{Owner: "novox", Repo: "shop", Number: n} }
-	if heads[shop(7)] != "aaaaaaaaaaaa1" || heads[shop(8)] != "" || heads[shop(9)] != "" {
-		t.Fatalf("merged heads %v", heads)
-	}
-}

cmd/mesh-controller/check_here.go

@@ -1,203 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"flag"
-	"fmt"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/builder"
-	"github.com/novox/mesh-controller/internal/catalogue"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// `check-here` is a pull request's merge check run on the machine at hand **exactly as the build seat
-// runs it** (novox/hq issue 286): the same code (builder.Check), the same ask the controller would make of
-// the seat — the gate's modules and judge by the planner's own answer over the facts snapshot, the
-// repositories beside it at the refs the snapshot says the seat clones them at — in the toolchain image
-// the mesh holds, as the user the build seat runs as, against a throwaway store and bus of the versions
-// the mesh runs.
-//
-// **The build seat is the reference.** A merge-check.sh that passed on an agent's machine failed on the
-// seat for three reasons that were each the agent's environment, never the change: a newer Go whose gofmt
-// lays a file out differently, a sibling checkout at the agent's feature branch where the seat had the
-// commit the mesh runs, and a different user. Run here, a check sees what the seat will.
-//
-//	check-here [--tree <checkout>] [--base main] [--registry <artifact store>] [--forge <url of the owner>]
-//	           [--number <n>] [--user uid:gid] [--facts store|<file>] [--keep]
-//
-// The checkout's HEAD is what is checked, and it must be committed: the seat checks a commit, never a
-// working tree.
-func checkHereCommand(ctx context.Context, args []string) error {
-	set := flag.NewFlagSet("check-here", flag.ContinueOnError)
-	tree := set.String("tree", ".", "the change's checkout; its HEAD is checked")
-	base := set.String("base", "main", "the branch the change would merge into")
-	registry := set.String("registry", os.Getenv("MESH_REGISTRY"), "the artifact store holding the facts and the toolchains")
-	forge := set.String("forge", "", "where the repositories beside it are cloned from, as <forge>/<repository>.git; "+
-		"the checkout's origin without its own name when not given")
-	number := set.Int("number", 0, "the pull request's number, when there is one")
-	// The build seat's service runs as root, and its check containers run as the builder does.
-	user := set.String("user", "0:0", "the user the check's containers run as: the build seat's")
-	keep := set.Bool("keep", false, "keep the workspace afterwards")
-	factsFrom := set.String("facts", "store", "the facts snapshot: `store`, the one the artifact store holds — "+
-		"what the seat reads — or a file")
-	if _, err := parseAround(set, args); err != nil {
-		return err
-	}
-	if *registry == "" {
-		return errors.New("check-here reads the facts and the toolchains from the artifact store: --registry <host:port> or MESH_REGISTRY")
-	}
-	dir, err := filepath.Abs(*tree)
-	if err != nil {
-		return err
-	}
-	git := func(args ...string) (string, error) {
-		cmd := exec.CommandContext(ctx, "git", args...)
-		cmd.Dir = dir
-		out, err := cmd.Output()
-		return strings.TrimSpace(string(out)), err
-	}
-	if dirty, err := git("status", "--porcelain", "--untracked-files=no"); err != nil {
-		return fmt.Errorf("%s is not a checkout: %w", dir, err)
-	} else if dirty != "" {
-		return errors.New("the checkout has changes not committed: the build seat checks a commit, so commit first")
-	}
-	head, err := git("rev-parse", "HEAD")
-	if err != nil {
-		return err
-	}
-	origin, err := git("remote", "get-url", "origin")
-	if err != nil {
-		return fmt.Errorf("the checkout has no origin to say which repository it is: %w", err)
-	}
-	owner, repo, prefix := ownerRepoOf(origin)
-	if *forge == "" {
-		*forge = prefix
-	}
-	if _, err := git("fetch", "--quiet", "origin", *base); err != nil {
-		return fmt.Errorf("cannot fetch %s to say what the change touches: %w", *base, err)
-	}
-	// Without rename detection, so a file moved out of a build source is said under its old name as well:
-	// its going is a change to the build that held it (novox/hq ADR 0267).
-	changedText, err := git("diff", "--name-only", "--no-renames", "origin/"+*base+"...HEAD")
-	if err != nil {
-		return err
-	}
-	var paths, removed []string
-	for _, p := range strings.Split(changedText, "\n") {
-		if p = strings.TrimSpace(p); p == "" {
-			continue
-		}
-		paths = append(paths, p)
-		if _, err := os.Stat(filepath.Join(dir, p)); os.IsNotExist(err) {
-			removed = append(removed, p)
-		}
-	}
-
-	_ = os.Setenv("MESH_REGISTRY", *registry)
-	f, err := readFacts(ctx, *factsFrom)
-	if err != nil {
-		return fmt.Errorf("the facts snapshot cannot be read: %w", err)
-	}
-	entries, read, edges, err := graphOfFacts(f)
-	if err != nil {
-		return err
-	}
-	p := link.PullUpdated{Owner: owner, Repo: repo, Number: *number, Base: *base, Commit: head, Paths: paths,
-		Removed: removed, ModuleDirs: moduleDirsIn(dir, paths), ModuleDirsSaid: true}
-	scope := pullScope(p, entries, read, edges)
-	_, scriptErr := os.Stat(filepath.Join(dir, builder.CheckScript))
-	if !scope.gated() && !scope.Mesh {
-		fmt.Printf("%s: %s, and the repository is not the mesh's: the build seat runs nothing for it\n",
-			owner+"/"+repo, noModuleTouched)
-		return nil
-	}
-	if !scope.gated() && scriptErr != nil {
-		fmt.Printf("%s: %s; %s\n", owner+"/"+repo, noModuleTouched, noMergeCheck)
-		return nil
-	}
-
-	toolchains := map[string]string{}
-	for language, reference := range f.Versions.Toolchains {
-		toolchains[language] = catalogue.Rerouted(reference, *registry)
-	}
-	if len(toolchains) == 0 {
-		return errors.New("the facts snapshot names no toolchain: it was taken by a controller from before " +
-			"issue 286, and the seat's toolchain cannot be known here")
-	}
-	beside := map[string]builder.Beside{}
-	for d, ref := range f.Beside {
-		from := d
-		if d == "mesh-controller-main" {
-			from = "mesh-controller"
-		}
-		beside[d] = builder.Beside{Repository: strings.TrimSuffix(*forge, "/") + "/" + from + ".git", Ref: ref}
-	}
-	id := fmt.Sprintf("check-here-%d", time.Now().UnixNano())
-	spec := builder.CheckSpec{ID: id, Repository: dir, Ref: head, Owner: owner, Repo: repo, Number: *number,
-		Paths: paths, Beside: beside, Modules: scope.Modules, New: scope.New, Manifests: scope.Manifests,
-		Base: *base, Judge: scope.Judge, Toolchain: toolchains["go"], Toolchains: toolchains, User: *user}
-
-	workspace, err := os.MkdirTemp("", "mesh-check-here-")
-	if err != nil {
-		return err
-	}
-	if !*keep {
-		defer removeWorkspace(spec.Toolchain, workspace, *user)
-	}
-	fmt.Fprintf(os.Stderr, "checking %s/%s at %.8s as the build seat would, against the facts of %s, in %s\n",
-		owner, repo, head, f.Taken.Format(time.RFC3339), workspace)
-	v, err := builder.Check(ctx, builder.Command, spec, workspace, *registry, builder.GitCredential{},
-		func(step, message string) {
-			if step != "output" {
-				fmt.Fprintf(os.Stderr, "  [%s] %s\n", step, message)
-			}
-		})
-	if err != nil {
-		return fmt.Errorf("the check could not run — on the seat an error, never a pass: %w", err)
-	}
-	fmt.Println(v.Report)
-	fmt.Println()
-	fmt.Printf("mesh/merge-gate: %s — %s\n", strings.ToUpper(v.Gate.Verdict), v.Gate.Summary)
-	if v.Repo != nil {
-		fmt.Printf("mesh/repo-check: %s — %s\n", strings.ToUpper(v.Repo.Verdict), v.Repo.Summary)
-	}
-	for _, l := range []*builder.Layer{v.Gate, v.Repo} {
-		if l != nil && l.Verdict != "pass" && l.Verdict != "warning" {
-			return errors.New("the build seat would not pass this change")
-		}
-	}
-	return nil
-}
-
-// ownerRepoOf reads owner, repository and the owner's URL from a remote: ssh://git@host:222/novox/mesh-host.git
-// → novox, mesh-host, ssh://git@host:222/novox.
-func ownerRepoOf(remote string) (string, string, string) {
-	trimmed := strings.TrimSuffix(strings.TrimSuffix(remote, "/"), ".git")
-	cut := strings.LastIndexAny(trimmed, "/:")
-	if cut < 0 {
-		return "", trimmed, ""
-	}
-	repo, prefix := trimmed[cut+1:], trimmed[:cut]
-	owner := prefix
-	if at := strings.LastIndexAny(prefix, "/:"); at >= 0 {
-		owner = prefix[at+1:]
-	}
-	return owner, repo, prefix
-}
-
-// removeWorkspace removes what the check left, written as the seat's user: by a container of that user
-// when it is not this one.
-func removeWorkspace(image, workspace, user string) {
-	if image != "" && user != fmt.Sprintf("%d:%d", os.Getuid(), os.Getgid()) {
-		// Everything in it — the check's HOME is the workspace, so the toolchain's own files are there too.
-		_ = exec.Command("docker", "run", "--rm", "--user", user, "--volume", workspace+":/workspace", image,
-			"sh", "-c", "rm -rf /workspace/* /workspace/.[!.]*").Run()
-	}
-	_ = os.RemoveAll(workspace)
-}

cmd/mesh-controller/check_siblings.go

@@ -1,165 +0,0 @@
-package main
-
-import (
-	"context"
-	"fmt"
-	"regexp"
-	"sort"
-	"strings"
-
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// **A delivery group's member is checked beside the other members' heads** (novox/hq ADR 0382, issue 867).
-//
-// A mesh-host change and a mesh-controller change that need each other could not both pass their own merge checks:
-// each was read beside the other's repository at the commit the mesh runs, which holds neither change. So the
-// controller asks mesh-delivery's `groups` once for every pull request's check it asks (§1), and names, in the ask,
-// the group's other open pull requests into a base of the same name, in a repository the build seat reads beside the
-// check — mesh-lab never — each with its whole head. The build seat reads those repositories at the sibling's merge (§2).
-// A pull request for which mesh-delivery answered and named no sibling is asked exactly as before (§7).
-
-// wholeCommit is a commit as the forge says a head: forty hexadecimal characters.
-var wholeCommit = regexp.MustCompile(`^[0-9a-f]{40}$`)
-
-// besideRepositories are the repositories (lower case, owner/repo) a check reads beside its own, by the directory each
-// is found under — the core's, as besideOf clones them, and mesh-sdk beside the controller; never mesh-lab, which is
-// always read at its trunk.
-func besideRepositories(entries []inventory.Entry) map[string]string {
-	read := map[string]string{}
-	for _, e := range entries {
-		dir, core := coreModules[e.Manifest.Module]
-		if !core || e.Provided || e.Source.Repository == "" {
-			continue
-		}
-		read[nameOf(e.Source.Repository)] = dir
-		if dir == "mesh-controller" && e.Source.Seat != "" {
-			read[nameOf(siblingOf(e.Source.Repository, "mesh-sdk"))] = "mesh-sdk"
-		}
-	}
-	delete(read, "")
-	return read
-}
-
-// nameOf is a recorded repository as owner/repo in lower case, empty when it names no owner.
-func nameOf(repository string) string {
-	owner, repo := sourceOwner(repository), sourceName(repository)
-	if owner == "" || repo == "" {
-		return ""
-	}
-	return strings.ToLower(owner + "/" + repo)
-}
-
-// siblingsFor is the pull request's siblings, as mesh-delivery's groups say them (ADR 0382 §1): the other members of
-// the group its head branch names that are open, unmerged and into a base of its own base's name, in a repository the
-// check reads beside it (beside: the directories the ask already names). The second answer is why they could not be
-// learned, empty when they could: the group's members carry no head or base — a mesh-delivery from before the rule.
-func siblingsFor(p link.PullUpdated, entries []inventory.Entry, beside map[string]link.CheckedOut,
-	lines []groupsLine) ([]link.CheckSibling, string) {
-	own := strings.ToLower(p.Owner + "/" + p.Repo)
-	var group *groupsLine
-	if p.Head == "" {
-		// A recheck (mesh-delivery's `recheck` through `delivery check`) carries no head branch name: the group is the one
-		// whose members hold this very pull request, by repository and number.
-		learnable := false
-		for i := range lines {
-			for _, m := range lines[i].Details {
-				learnable = true
-				if p.Number != 0 && m.Number == p.Number && strings.ToLower(m.Repository) == own {
-					group = &lines[i]
-				}
-			}
-		}
-		if group == nil {
-			for _, l := range lines {
-				if len(l.Details) == 0 && len(l.Members) > 0 && !learnable {
-					return nil, "mesh-delivery named the groups' members without their pull requests (a mesh-delivery from before novox/hq ADR 0382): " +
-						"the group of a pull request announced without its head branch cannot be found"
-				}
-			}
-			return nil, "" // a lone pull request
-		}
-	} else {
-		for i := range lines {
-			if lines[i].ID == p.Head {
-				group = &lines[i]
-			}
-		}
-		if group == nil {
-			return nil, ""
-		}
-	}
-	if len(group.Details) == 0 && len(group.Members) > 0 {
-		return nil, "mesh-delivery named the group's members without their heads and bases (a mesh-delivery from before novox/hq ADR 0382)"
-	}
-	read := besideRepositories(entries)
-	var siblings []link.CheckSibling
-	for _, m := range group.Details {
-		repository := strings.ToLower(m.Repository)
-		if repository == own {
-			continue
-		}
-		if !m.Open {
-			continue
-		}
-		if m.Head == "" || m.Base == "" {
-			return nil, "mesh-delivery named " + m.ID + " without its head or base (a mesh-delivery from before novox/hq ADR 0382)"
-		}
-		dir, readBeside := read[repository]
-		if m.Base != p.Base || !readBeside || dir == "mesh-lab" {
-			continue
-		}
-		if _, there := beside[dir]; !there {
-			continue
-		}
-		head := strings.ToLower(m.Head)
-		if !wholeCommit.MatchString(head) {
-			return nil, fmt.Sprintf("mesh-delivery named %s with a head that is not a whole commit (%q)", m.ID, m.Head)
-		}
-		siblings = append(siblings, link.CheckSibling{Repository: m.Repository, Number: m.Number, Head: head, Base: m.Base, Dir: dir})
-	}
-	sort.Slice(siblings, func(i, j int) bool { return siblings[i].Dir < siblings[j].Dir })
-	return siblings, ""
-}
-
-// withSiblings asks mesh-delivery's `groups` once and says in the request the pull request's siblings, or why they
-// could not be learned (ADR 0382 §1): a check never waits on mesh-delivery past groupAskWithin and never fails for it,
-// so a fix to mesh-delivery is still checked without it.
-func withSiblings(ctx context.Context, request *link.BuildRequest, p link.PullUpdated, entries []inventory.Entry) {
-	lines, err := groupsAsked(ctx, deliverySeatHeld(entries))
-	siblingsFrom(request, p, entries, lines, err)
-}
-
-// siblingsFrom is withSiblings from mesh-delivery's answer already had.
-func siblingsFrom(request *link.BuildRequest, p link.PullUpdated, entries []inventory.Entry, lines []groupsLine, err error) {
-	if request.Check == nil {
-		return
-	}
-	if err != nil {
-		request.Check.SiblingsUnknown = fmt.Sprintf("mesh-delivery did not say the group's pull requests (%v): "+
-			"the check reads no siblings", err)
-		return
-	}
-	request.Check.Siblings, request.Check.SiblingsUnknown = siblingsFor(p, entries, request.Check.Beside, lines)
-}
-
-// composedMember says the pull request is a member of a delivery group whose gate is the composed check's (novox/hq
-// ADR 0403 clauses 1 and 7): the group has two members or more and mesh-delivery says so on its line. The group is
-// found as siblingsFor finds it, by its head branch name, or, for a recheck that carries none, by the pull request's
-// repository and number — not by siblings, which name only what the check reads beside it.
-func composedMember(p link.PullUpdated, lines []groupsLine) bool {
-	own := strings.ToLower(p.Owner + "/" + p.Repo)
-	for _, l := range lines {
-		found := p.Head != "" && l.ID == p.Head
-		for _, m := range l.Details {
-			if p.Head == "" && p.Number != 0 && m.Number == p.Number && strings.ToLower(m.Repository) == own {
-				found = true
-			}
-		}
-		if found {
-			return l.ComposedGate && max(len(l.Details), len(l.Members)) >= 2
-		}
-	}
-	return false
-}

cmd/mesh-controller/check_siblings_test.go

@@ -1,248 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"strings"
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/catalogue"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// **A delivery group's member is checked beside the other members' heads** (novox/hq ADR 0382 §1, §7, issue 867): the
-// controller asks mesh-delivery's `groups` once for every check it asks, and names in the ask the group's other open
-// pull requests into a base of the same name, in a repository the build seat reads beside it — mesh-lab never.
-
-const (
-	headHost       = "1111111111111111111111111111111111111111"
-	headController = "2222222222222222222222222222222222222222"
-	headSDK        = "3333333333333333333333333333333333333333"
-	headLab        = "4444444444444444444444444444444444444444"
-	headHq         = "5555555555555555555555555555555555555555"
-)
-
-func theCoreOnTheGitSeat() []inventory.Entry {
-	onSeat := func(module, repository string) inventory.Entry {
-		e := fromRepo(module, repository, "")
-		e.Source.Seat = "git"
-		return e
-	}
-	nats := onSeat("nats", "novox/mesh-catalog")
-	nats.Source.Path = "modules/nats"
-	held := catalogue.Manifest{Module: "mesh-delivery", Claims: []catalogue.Claim{{Name: catalogue.DeliverySeat, Scope: catalogue.ScopeMesh}}}
-	return []inventory.Entry{onSeat("mesh-controller", "novox/mesh-controller"), onSeat("mesh-host", "novox/mesh-host"),
-		onSeat("node-tools", "novox/mesh-tools"), nats, {Manifest: held, On: []string{"anchor"}}}
-}
-
-func besideTheCore() map[string]link.CheckedOut {
-	return map[string]link.CheckedOut{"mesh-controller": {Repository: "c"}, "mesh-host": {Repository: "h"},
-		"mesh-tools": {Repository: "t"}, "mesh-catalog": {Repository: "k"}, "mesh-sdk": {Repository: "s"}, "mesh-lab": {Repository: "l"}}
-}
-
-func member(repository string, number int, head, base string, open bool) memberLine {
-	return memberLine{ID: repository + "@" + head[:12], Repository: repository, State: "checked", Number: number, Head: head,
-		Base: base, Open: open}
-}
-
-func group(id string, members ...memberLine) groupsLine {
-	line := groupsLine{ID: id, Details: members}
-	for _, m := range members {
-		line.Members = append(line.Members, m.ID+" ("+m.State+")")
-	}
-	return line
-}
-
-func TestASiblingIsTheGroupsOtherOpenPullRequestIntoABaseOfTheSameName(t *testing.T) {
-	entries := theCoreOnTheGitSeat()
-	pull := link.PullUpdated{Owner: "novox", Repo: "mesh-host", Number: 114, Base: "main", Head: "feat/x", Commit: headHost}
-	for _, c := range []struct {
-		what    string
-		lines   []groupsLine
-		want    []string
-		unknown string
-	}{
-		{"the other member, open, same base", []groupsLine{group("feat/x",
-			member("novox/mesh-host", 114, headHost, "main", true), member("novox/mesh-controller", 346, headController, "main", true))},
-			[]string{"mesh-controller=novox/mesh-controller#346@" + headController + " onto main"}, ""},
-		{"a member into a base of another name is not one", []groupsLine{group("feat/x",
-			member("novox/mesh-host", 114, headHost, "main", true), member("novox/mesh-controller", 346, headController, "release", true))},
-			nil, ""},
-		{"a member not open (merged or closed) is not one", []groupsLine{group("feat/x",
-			member("novox/mesh-host", 114, headHost, "main", true), member("novox/mesh-controller", 346, headController, "main", false))},
-			nil, ""},
-		{"mesh-lab is never one", []groupsLine{group("feat/x",
-			member("novox/mesh-host", 114, headHost, "main", true), member("novox/mesh-lab", 5, headLab, "main", true))},
-			nil, ""},
-		{"a repository the check reads nothing of is not one", []groupsLine{group("feat/x",
-			member("novox/mesh-host", 114, headHost, "main", true), member("novox/hq", 9, headHq, "main", true))},
-			nil, ""},
-		{"mesh-sdk, read beside the controller, is one", []groupsLine{group("feat/x",
-			member("novox/mesh-host", 114, headHost, "main", true), member("novox/mesh-sdk", 7, headSDK, "main", true))},
-			[]string{"mesh-sdk=novox/mesh-sdk#7@" + headSDK + " onto main"}, ""},
-		{"another group is none of its business", []groupsLine{group("feat/y",
-			member("novox/mesh-host", 114, headHost, "main", true), member("novox/mesh-controller", 346, headController, "main", true))},
-			nil, ""},
-		{"a group of its own alone has none", []groupsLine{group("feat/x", member("novox/mesh-host", 114, headHost, "main", true))},
-			nil, ""},
-		{"an older mesh-delivery names no heads", []groupsLine{{ID: "feat/x",
-			Members: []string{"novox/mesh-host@111111111111 (checked)", "novox/mesh-controller@222222222222 (checked)"}}},
-			nil, "without their heads and bases"},
-		{"a member without its base", []groupsLine{group("feat/x",
-			member("novox/mesh-host", 114, headHost, "main", true), member("novox/mesh-controller", 346, headController, "", true))},
-			nil, "without its head or base"},
-		{"a head that is no commit", []groupsLine{group("feat/x",
-			member("novox/mesh-host", 114, headHost, "main", true), member("novox/mesh-controller", 346, headController[:12]+"zzzzzzzzzzzzzzzzzzzzzzzzzzzz", "main", true))},
-			nil, "not a whole commit"},
-	} {
-		got, unknown := siblingsFor(pull, entries, besideTheCore(), c.lines)
-		var said []string
-		for _, s := range got {
-			said = append(said, s.Dir+"="+s.Repository+"#"+itoa(s.Number)+"@"+s.Head+" onto "+s.Base)
-		}
-		if strings.Join(said, ";") != strings.Join(c.want, ";") {
-			t.Errorf("%s: siblings %v, wanted %v", c.what, said, c.want)
-		}
-		if (c.unknown == "") != (unknown == "") || !strings.Contains(unknown, c.unknown) {
-			t.Errorf("%s: could not learn %q, wanted %q", c.what, unknown, c.unknown)
-		}
-	}
-	// A pull request into a release branch has siblings into the release branch of the same name (ADR 0358 §1).
-	release := pull
-	release.Base = "feat/57"
-	lines := []groupsLine{group("feat/x", member("novox/mesh-host", 114, headHost, "feat/57", true),
-		member("novox/mesh-controller", 346, headController, "feat/57", true), member("novox/mesh-tools", 8, headLab, "main", true))}
-	if got, _ := siblingsFor(release, entries, besideTheCore(), lines); len(got) != 1 || got[0].Dir != "mesh-controller" {
-		t.Errorf("into a release branch: %+v", got)
-	}
-	// A recheck announces the pull request without its head branch: its group is the one holding it (repository, number).
-	pull.Head = ""
-	got, unknown := siblingsFor(pull, entries, besideTheCore(), lines)
-	if len(got) != 1 || got[0].Dir != "mesh-tools" || unknown != "" {
-		t.Errorf("a recheck of a group member: %+v %q", got, unknown)
-	}
-	// A pull request in no group, rechecked, is alone: no sibling, and nothing said.
-	pull.Number = 999
-	if got, unknown := siblingsFor(pull, entries, besideTheCore(), lines); got != nil || unknown != "" {
-		t.Errorf("a lone pull request: %+v %q", got, unknown)
-	}
-	if got, unknown := siblingsFor(pull, entries, besideTheCore(), nil); got != nil || unknown != "" {
-		t.Errorf("no groups at all: %+v %q", got, unknown)
-	}
-	// A mesh-delivery that names members without their pull requests cannot find the group of a recheck: it says so.
-	older := []groupsLine{{ID: "feat/x", Members: []string{"novox/mesh-host@111111111111 (checked)"}}}
-	pull.Number = 114
-	if got, unknown := siblingsFor(pull, entries, besideTheCore(), older); got != nil || unknown == "" {
-		t.Errorf("an older mesh-delivery: %+v %q", got, unknown)
-	}
-}
-
-func itoa(n int) string { b, _ := json.Marshal(n); return string(b) }
-
-// Every check asks mesh-delivery's `groups` once; the ask names the sibling's repository, head and base.
-func TestEveryCheckAsksMeshDeliveryOnceAndNamesItsSiblings(t *testing.T) {
-	entries := theCoreOnTheGitSeat()
-	asked := 0
-	was := groupsAsked
-	t.Cleanup(func() { groupsAsked = was })
-	groupsAsked = func(_ context.Context, held bool) ([]groupsLine, error) {
-		asked++
-		if !held {
-			t.Error("the seat is held, yet it was asked as not held")
-		}
-		return []groupsLine{group("feat/x", member("novox/mesh-host", 114, headHost, "main", true),
-			member("novox/mesh-controller", 346, headController, "main", true))}, nil
-	}
-	request := link.BuildRequest{Check: &link.CheckRequest{Owner: "novox", Repo: "mesh-host", Base: "main", Beside: besideTheCore()}}
-	withSiblings(t.Context(), &request, link.PullUpdated{Owner: "novox", Repo: "mesh-host", Base: "main", Head: "feat/x"}, entries)
-	if asked != 1 {
-		t.Fatalf("mesh-delivery was asked %d times for one check", asked)
-	}
-	want := link.CheckSibling{Repository: "novox/mesh-controller", Number: 346, Head: headController, Base: "main", Dir: "mesh-controller"}
-	if got := request.Check.Siblings; len(got) != 1 || got[0] != want || request.Check.SiblingsUnknown != "" {
-		t.Fatalf("the ask names siblings %+v, unknown %q", got, request.Check.SiblingsUnknown)
-	}
-	body, _ := json.Marshal(request.Check)
-	if !strings.Contains(string(body), `"siblings":[{"repository":"novox/mesh-controller","number":346,"head":"`+headController+
-		`","base":"main","dir":"mesh-controller"}]`) {
-		t.Fatalf("on the wire: %s", body)
-	}
-}
-
-// When mesh-delivery does not answer in time (or is not held, or answered without the fields), the check reads no
-// sibling and its request says it could not learn them, so a fix to mesh-delivery is still checked without it.
-func TestWhenMeshDeliveryDoesNotAnswerTheCheckReadsNoSiblingAndSaysSo(t *testing.T) {
-	was := groupsAsked
-	t.Cleanup(func() { groupsAsked = was })
-	for _, c := range []struct {
-		what string
-		err  error
-		held bool
-	}{{"it did not answer", context.DeadlineExceeded, true}, {"nothing serves it", errors.New("nothing serves mesh-delivery.groups"), true},
-		{"no holder on record", errors.New("no holder of mesh-delivery is on record to say it"), false}} {
-		entries := theCoreOnTheGitSeat()
-		if !c.held {
-			entries = entries[:4]
-		}
-		groupsAsked = func(_ context.Context, held bool) ([]groupsLine, error) {
-			if held != c.held {
-				t.Errorf("%s: held %v", c.what, held)
-			}
-			return nil, c.err
-		}
-		request := link.BuildRequest{Check: &link.CheckRequest{Owner: "novox", Repo: "mesh-host", Base: "main", Beside: besideTheCore()}}
-		withSiblings(t.Context(), &request, link.PullUpdated{Owner: "novox", Repo: "mesh-host", Base: "main", Head: "feat/x"}, entries)
-		if len(request.Check.Siblings) != 0 || !strings.Contains(request.Check.SiblingsUnknown, c.err.Error()) ||
-			!strings.Contains(request.Check.SiblingsUnknown, "reads no siblings") {
-			t.Errorf("%s: siblings %+v, unknown %q", c.what, request.Check.Siblings, request.Check.SiblingsUnknown)
-		}
-	}
-}
-
-// **A pull request for which mesh-delivery answered and named no sibling is asked exactly as before** (ADR 0382 §7):
-// byte for byte the request it was without the rule.
-func TestAPullRequestWithNoSiblingIsAskedByteForByteAsBefore(t *testing.T) {
-	entries := theCoreOnTheGitSeat()
-	was := groupsAsked
-	t.Cleanup(func() { groupsAsked = was })
-	for _, answer := range [][]groupsLine{nil, {group("feat/other", member("novox/mesh-controller", 346, headController, "main", true))},
-		{group("feat/x", member("novox/mesh-host", 114, headHost, "main", true), member("novox/hq", 3, headHq, "main", true))}} {
-		groupsAsked = func(context.Context, bool) ([]groupsLine, error) { return answer, nil }
-		build := func() link.BuildRequest {
-			return link.BuildRequest{ID: "build-1", Repository: "r", Ref: headHost, Check: &link.CheckRequest{Owner: "novox",
-				Repo: "mesh-host", Number: 114, Base: "main", Beside: besideTheCore(), Modules: []string{"mesh-host"}, Judge: "validator"}}
-		}
-		before, _ := json.Marshal(build())
-		after := build()
-		withSiblings(t.Context(), &after, link.PullUpdated{Owner: "novox", Repo: "mesh-host", Base: "main", Head: "feat/x"}, entries)
-		got, _ := json.Marshal(after)
-		if string(before) != string(got) {
-			t.Fatalf("the request changed:\nbefore %s\nafter  %s", before, got)
-		}
-	}
-}
-
-// What the build seat's verdict says of its siblings reaches the forge's holder in the controller's `checked`.
-func TestTheVerdictCarriesTheSiblingsAndWhereTheJudgeCameFrom(t *testing.T) {
-	read := []link.CheckSibling{{Repository: "novox/mesh-controller", Number: 346, Head: headController, Base: "main", BaseCommit: headHost}}
-	c := checkedOf(link.BuildResult{ID: "b", Ref: headHost, Checked: &link.CheckRequest{Owner: "novox", Repo: "mesh-host", Number: 114},
-		Check: &link.CheckOutcome{Verdict: "pass", Summary: "ok", Siblings: read, JudgeFrom: "sibling novox/mesh-controller#346 merge abc",
-			Validator: "the change's own validator"}})
-	if len(c.Siblings) != 1 || c.Siblings[0] != read[0] || c.JudgeFrom == "" || c.Validator == "" {
-		t.Fatalf("the verdict says %+v", c)
-	}
-	body, _ := json.Marshal(c)
-	for _, want := range []string{`"siblings":[{"repository":"novox/mesh-controller","number":346,"head":"` + headController +
-		`","base":"main","base_commit":"` + headHost + `"}]`, `"judge_from":"sibling novox/mesh-controller#346 merge abc"`} {
-		if !strings.Contains(string(body), want) {
-			t.Fatalf("the verdict lacks %s:\n%s", want, body)
-		}
-	}
-	unknown := checkedOf(link.BuildResult{ID: "b", Check: &link.CheckOutcome{Verdict: "pass", SiblingsUnknown: "mesh-delivery did not answer"}})
-	if body, _ := json.Marshal(unknown); !strings.Contains(string(body), `"siblings_unknown":"mesh-delivery did not answer"`) ||
-		strings.Contains(string(body), `"siblings":`) {
-		t.Fatalf("the verdict that could not learn them says %s", body)
-	}
-}

cmd/mesh-controller/check_test.go

@@ -8,8 +8,8 @@ import (
 
 	"testing"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/beside"
-	"github.com/novox/mesh-controller/internal/catalogue"
 )
 
 // The check anybody can run is the check registration runs (novox/hq issue 148, ADR 0037): a manifest

cmd/mesh-controller/checks.go

@@ -2,53 +2,26 @@ package main
 
 import (
 	"context"
-	"encoding/json"
-	"fmt"
+	"io"
+	"os"
 	"path"
 	"regexp"
 	"runtime/debug"
 	"slices"
 	"sort"
 	"strings"
-	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
 
-// A pull request's merge check (novox/hq to-be 45 §9, ADR 0237 as amended 2026-10-06): the forge
-// announces every pull request's new head, the controller decides what is checked, asks the build seat to
-// check it, and says the verdict as `checked`, which the forge's holder sets as the pull request's
-// statuses. **Before merge, never after**: every check the mesh had ran after a merge, on a machine.
-//
-// **The mesh's module graph decides, not the repository.** The controller holds the graph — every module,
-// the repository and directory it is built from — and maps the pull request's changed paths onto it by
-// the planner's own answer (reachOfMerge, touchedBy — the one place a changed file is mapped onto modules,
-// for the merge handler, the release planner, the merge gate and this check; issue 280): **a changed file
-// touches exactly the modules whose build reads it** — a module's own directory (the whole repository for
-// one built from its root), or a repository its recipe packages. A file no build reads — a script at the
-// root, a README — touches no module. A directory the change adds a module.json in, which the graph does
-// not hold yet (said by the head, issue 278), is a new module and is checked too.
-//
-//   - touches a module: the build seat runs **the gate** — `mesh/merge-gate`, the touched manifests, every
-//     machine composed with the change, the replays — and the repository's own merge-check.sh beside it;
-//   - touches none, in a repository that is the mesh's (it sources a module on some branch, or shares the
-//     core's owner): the gate is a pass that says so — a fact, not a missing check — and the repository's
-//     own merge-check.sh runs as `mesh/repo-check`, a warning when it has none;
-//   - touches none, anywhere else: the gate is a pass that says so, and nothing more is said.
-//
-// What is checked is decided here and run there (internal/builder/check.go).
-
-// checkTimeout is how long one check may run on the build seat. Said here so the ask's watchdog (S6)
-// and the builder agree on what late means.
-const checkTimeout = 45 * time.Minute
-
-// noModuleTouched is the gate's word for a change that touches nothing of the graph.
-const noModuleTouched = "the change touches no module of the mesh's graph"
-
-// noMergeCheck is the repository layer's word for a repository of the mesh with no merge-check.sh.
-const noMergeCheck = "the repository declares no merge-check.sh: none of its own tests run before it merges"
+// What a pull request reaches of the mesh's graph (novox/hq to-be 45 §9, issue 280). The controller no longer checks a
+// pull request or says a verdict on it (R4g, ADR 0503 §3, ADR 0501 §5): the checker judges the heads, and mesh-delivery
+// asks the operator's Approve on its verdict. What stays here is the mapping of a pull request's changed paths onto the
+// mesh's module graph by the planner's own answer (reachOfMerge, touchedBy), which the delivery verbs (`delivery order`,
+// the change plan) and the head's declared config (tellPullDeclares) read: **a changed file touches exactly the modules
+// whose build reads it** — a module's own directory (the whole repository for one built from its root), or a repository
+// its recipe packages — and a directory the change adds a module.json in is a new module.
 
 // coreModules are the modules whose repositories are the mesh's core, by the directory a check finds
 // each beside it — and whose owner is the mesh's own.
@@ -65,15 +38,11 @@ type checkScope struct {
 	New        []string
 	// Manifests are the moved modules' and the new ones' manifests in the change's tree.
 	Manifests []string
-	// Width is how many modules a merge would build, in how many tiers; Unread the changed files no
-	// module's build reads.
-	Width, Tiers int
-	Unread       []string
+	// Unread the changed files no module's build reads.
+	Unread []string
 	// Mesh says the repository is the mesh's: modules are built from it on some branch, its owner is the
 	// core's, or the change adds a module to it.
 	Mesh bool
-	// Judge is who judges the gate (link.JudgeSelf, link.JudgeValidator, or the running controller).
-	Judge string
 	// From is a module built from the repository, for how the mesh clones it; nil when none is.
 	From *inventory.Entry
 	// Reach is the planner's whole answer, which the change plan is made from.
@@ -91,18 +60,9 @@ func pullScope(p link.PullUpdated, entries []inventory.Entry, read map[string][]
 		Paths: p.Paths, PathsTruncated: p.PathsTruncated, Removed: p.Removed, ModuleDirs: p.ModuleDirs,
 		ModuleDirsSaid: p.ModuleDirsSaid}
 	r := reachOfMerge(m, entries, read, edges)
-	s := checkScope{Modules: r.Moved(), Dependents: r.Dependents(), New: r.Added, Unread: r.Unread,
-		Width: len(r.Plan.Modules), Tiers: len(r.Plan.Tiers), Reach: r}
+	s := checkScope{Modules: r.Moved(), Dependents: r.Dependents(), New: r.Added, Unread: r.Unread, Reach: r}
 	for _, e := range append(append([]inventory.Entry{}, r.Touched...), r.Deleted...) {
 		s.Manifests = append(s.Manifests, path.Join(strings.Trim(e.Source.Path, "/"), moduleManifestFile))
-		switch e.Manifest.Module {
-		case "mesh-controller":
-			s.Judge = link.JudgeSelf
-		case "mesh-host":
-			if s.Judge == "" {
-				s.Judge = link.JudgeValidator
-			}
-		}
 	}
 	for _, d := range r.Added {
 		s.Manifests = append(s.Manifests, path.Join(d, moduleManifestFile))
@@ -138,8 +98,15 @@ func sourceOwner(repository string) string {
 	return strings.ToLower(parts[len(parts)-2])
 }
 
-// PullUpdated decides a pull request's merge check, and asks for it when there is something to run.
+// PullUpdated hears a pull request's new head. It asks no check and says no verdict (pullUpdated).
 func (f following) PullUpdated(ctx context.Context, p link.PullUpdated) error {
+	return f.pullUpdated(ctx, p, os.Stdout)
+}
+
+// pullUpdated is PullUpdated saying what it did to w. It asks nothing of anybody and says no verdict (R4g; ADR 0503 §3, §5,
+// ADR 0527): the checker judges every repository whose trunk requires `mesh/check`, hq included. All it still does is tell
+// mesh-config what the head declares (ADR 0502), whatever judges it.
+func (f following) pullUpdated(ctx context.Context, p link.PullUpdated, w io.Writer) error {
 	inv := f.open.inventory
 	entries, err := inv.Catalogued(ctx)
 	if err != nil {
@@ -154,287 +121,16 @@ func (f following) PullUpdated(ctx context.Context, p link.PullUpdated) error {
 		return err
 	}
 	scope := pullScope(p, entries, read, edges)
-	// **A cycle of edges fails the check, naming every module and edge** (novox/hq ADR 0419 clause 6), a lone pull
-	// request's as a group's composed check is: no order exists for what it changes.
-	alone := orderMember{ID: p.Owner + "/" + p.Repo + "@" + twelve(p.Commit), Repository: p.Owner + "/" + p.Repo, Base: p.Base,
-		Head: p.Commit, Number: p.Number, Paths: p.Paths, PathsTruncated: p.PathsTruncated, Removed: p.Removed, BaseSHA: p.BaseSHA}
-	if failing, cyclic, err := cycleVerdict(ctx, "", []orderMember{alone},
-		map[string]orderReach{alone.ID: {Moved: scope.Modules}}, edges, entries); err != nil {
-		return err
-	} else if cyclic {
-		failing.Commit, failing.Trunk = p.Commit, twelve(p.BaseSHA)
-		fmt.Printf("%s/%s#%d (%.8s): %s\n", p.Owner, p.Repo, p.Number, p.Commit, failing.Summary)
-		sayChecked(ctx, failing)
-		return nil
+	this := pullAtOf(p)
+	if this.Truncated {
+		this.Paths, this.Truncated = truncatedPaths(entries, p.Owner, p.Repo, scope.Modules), false
 	}
-	// **A member of a group whose gate is the composed check's runs its repository's check alone** (novox/hq ADR 0403
-	// clause 1): mesh-delivery is asked once, and says so on the group's line. Told nothing, the pull request is
-	// checked alone, gate included (clause 6).
-	lines, groupsErr := groupsAsked(ctx, deliverySeatHeld(entries))
-	composed := groupsErr == nil && composedMember(p, lines)
-	// The change plan of the commit at hand (ADR 0238): what a merge of it would build and send, posted
-	// with the verdict whatever the verdict is.
-	plan := changePlanOf(p.Owner+"/"+p.Repo, p.Base, p.Commit, scope.Reach, entries, func(module string) (inventory.Upgrade, bool) {
-		u, err := inv.UpgradeOf(ctx, module)
-		return u, err == nil
-	})
-	fmt.Print(planText(plan))
-	direct := directVerdict(p, plan)
-	if composed {
-		scope.Modules, scope.Dependents, scope.New, scope.Manifests = nil, nil, nil, nil
-		composedGate(&direct)
+	if scope.gated() || holdsModules(entries, p.Owner, p.Repo) {
+		tellPullDeclares(ctx, w, []pullAt{this})
 	}
-	switch {
-	case !scope.gated() && !scope.Mesh:
-		fmt.Printf("%s/%s#%d (%.8s): %s, and the repository is not the mesh's: said, nothing run\n",
-			p.Owner, p.Repo, p.Number, p.Commit, noModuleTouched)
-		sayChecked(ctx, direct)
-		return nil
-	case !scope.gated() && p.MergeCheckSaid && !p.MergeCheck:
-		direct.RepoCheck = &link.CheckLayer{Verdict: "warning", Summary: noMergeCheck}
-		fmt.Printf("%s/%s#%d (%.8s): %s; %s\n", p.Owner, p.Repo, p.Number, p.Commit, noModuleTouched, noMergeCheck)
-		sayChecked(ctx, direct)
-		return nil
-	}
-	request, err := checkRequestFor(ctx, f.open, p, scope, entries)
-	if err != nil {
-		return err
-	}
-	request.Check.Plan = &plan
-	request.Check.Composed = composed
-	// **The group's other open pull requests are read beside it** (novox/hq ADR 0382 §1).
-	siblingsFrom(&request, p, entries, lines, groupsErr)
-	seat := buildSeatHeld(ctx)
-	ask, err := askOverOn(seat)
-	if err != nil {
-		return err
-	}
-	defer ask.Close()
-	if err := ask.Ask(ctx, request); err != nil {
-		return err
-	}
-	// **A newer request replaces the one still waiting, and a newer key stops the one running** (novox/hq ADR 0406 §3, §4,
-	// issue 974): the check queue keeps one request a pull request, and a running check watches its key. Nothing is asked
-	// of the forge here (issue 726).
-	what := "its own merge-check.sh alone: " + noModuleTouched
-	if composed {
-		what = "its own merge-check.sh alone: the gate is its group's composed check's"
-	}
-	if scope.gated() {
-		what = fmt.Sprintf("the gate over %s (a merge would build %d module(s) in %d tier(s))",
-			strings.Join(append(append([]string{}, scope.Modules...), prefixedAll("new:", scope.New)...), ", "),
-			scope.Width, scope.Tiers)
-	}
-	fmt.Printf("%s/%s#%d (%.8s): asked %s to check it before it merges — %s — as %s\n", p.Owner, p.Repo, p.Number,
-		p.Commit, seat, what, request.ID)
 	return nil
 }
 
-// composedWords is what a group member's own verdict says of its gate layer (novox/hq ADR 0403 clause 1).
-const composedWords = "judged by its group's composed check"
-
-// gateComposed is a gate layer's verdict when no gate was run for the member alone: never a pass. Mesh-delivery reads it
-// as the composed check's to judge, and the forge's holder sets no mesh/merge-gate from it.
-const gateComposed = "composed"
-
-// composedGate says a group member's own verdict has no gate of its own: its gate layer, and the verdict that is
-// the gate's, read "composed" in place of a pass.
-func composedGate(c *link.Checked) {
-	c.Verdict, c.Summary = gateComposed, composedWords
-	c.Gate = &link.CheckLayer{Verdict: gateComposed, Summary: composedWords}
-}
-
-// directVerdict is the verdict of a change no build judges — it touches no module, and either the repository is not
-// the mesh's or the head holds no merge-check.sh. **It names the trunk commit it holds for** (novox/hq ADR 0323 §3):
-// the base branch's head the forge announced with the head, so the merge tool can weigh it against the trunk's head
-// and does not refuse it for ever (a verdict naming no trunk is never the trunk's head's). Nothing was built to
-// judge: the trunk commit is the one the forge said the change was announced against.
-func directVerdict(p link.PullUpdated, plan link.ChangePlan) link.Checked {
-	trunk := p.BaseSHA
-	if len(trunk) > 12 {
-		trunk = trunk[:12]
-	}
-	if trunk != "" {
-		plan.Trunk = trunk
-	}
-	return link.Checked{Owner: p.Owner, Repo: p.Repo, Number: p.Number, Commit: p.Commit,
-		ID: link.NewBuildID(time.Now()), Verdict: "pass", Summary: noModuleTouched,
-		Gate: &link.CheckLayer{Verdict: "pass", Summary: noModuleTouched}, Plan: &plan, Trunk: trunk}
-}
-
-// checkRequestFor is the ask for one pull request's head: the repository as the mesh clones it, the head,
-// and what is read beside it.
-func checkRequestFor(ctx context.Context, open *stores, p link.PullUpdated, scope checkScope,
-	entries []inventory.Entry) (link.BuildRequest, error) {
-	shelf := map[string]catalogue.Manifest{}
-	for _, e := range entries {
-		shelf[e.Manifest.Module] = e.Manifest
-	}
-	world, err := theRestOfTheMesh(ctx, open.inventory, shelf, "")
-	if err != nil {
-		return link.BuildRequest{}, err
-	}
-	clone := func(s inventory.Source) (string, error) {
-		if s.Seat == "" {
-			return s.Repository, nil
-		}
-		return clonedFromSeat(world, s.Seat, s.Repository)
-	}
-	// As the mesh clones a module built from it; a repository no module is built from, from the forge.
-	source := inventory.Source{Seat: gitSeat, Repository: p.Owner + "/" + p.Repo}
-	if scope.From != nil {
-		source = scope.From.Source
-	}
-	repository, err := clone(source)
-	if err != nil {
-		return link.BuildRequest{}, err
-	}
-	current, err := open.inventory.CurrentBuilds(ctx)
-	if err != nil {
-		return link.BuildRequest{}, err
-	}
-	beside, err := besideOf(entries, func(module string) string { return current[module].Commit }, clone)
-	if err != nil {
-		return link.BuildRequest{}, err
-	}
-	builds := checkBuildsOf(p, scope, entries, clone)
-	return link.BuildRequest{
-		ID:         link.NewBuildID(time.Now()),
-		Repository: repository,
-		Ref:        p.Commit,
-		Held:       heldBy(ctx),
-		Seats:      seatBases(ctx),
-		Source:     sourceOnSeat(source),
-		Check: &link.CheckRequest{Owner: p.Owner, Repo: p.Repo, Number: p.Number, Base: p.Base, Trunk: p.BaseSHA, Ready: p.Ready,
-			Paths: p.Paths, Beside: beside, Modules: scope.Modules, Dependents: scope.Dependents, New: scope.New,
-			Manifests: scope.Manifests, Judge: scope.Judge, Builds: builds, Named: namedForTheCheck(ctx, p, builds),
-			Running: runningBy(ctx)},
-	}, nil
-}
-
-// besideOf is what a check reads beside its own repository, by the directory it is found under: each core repository
-// by the module the mesh builds from it, at besideRefs. running is the commit the mesh runs of a module.
-func besideOf(entries []inventory.Entry, running func(module string) string,
-	clone func(inventory.Source) (string, error)) (map[string]link.CheckedOut, error) {
-	beside := map[string]link.CheckedOut{}
-	for _, e := range entries {
-		dir, core := coreModules[e.Manifest.Module]
-		if !core || e.Provided || e.Source.Repository == "" {
-			continue
-		}
-		url, err := clone(e.Source)
-		if err != nil {
-			return nil, err
-		}
-		refs := besideRefs(dir, running(e.Manifest.Module))
-		beside[dir] = link.CheckedOut{Repository: url, Ref: refs[dir]}
-		if dir == "mesh-controller" {
-			// The controller's main stays its main: it judges only a check the running controller predates.
-			beside["mesh-controller-main"] = link.CheckedOut{Repository: url, Ref: refs["mesh-controller-main"]}
-			if e.Source.Seat != "" {
-				for _, sibling := range []string{"mesh-lab", "mesh-sdk"} {
-					if url, err := clone(inventory.Source{Seat: e.Source.Seat, Repository: siblingOf(e.Source.Repository,
-						sibling)}); err == nil {
-						beside[sibling] = link.CheckedOut{Repository: url, Ref: refs[sibling]}
-					}
-				}
-			}
-		}
-	}
-	return beside, nil
-}
-
-// trunkOf is the branch a module's source follows: main when it records none, or records a commit.
-func trunkOf(s inventory.Source) string {
-	if t := strings.TrimSpace(followedBranch(s.Ref)); t != "" {
-		return t
-	}
-	return "main"
-}
-
-// sourceName is the name of a recorded repository, a path on the git seat or a URL: novox/mesh-host → mesh-host.
-func sourceName(repository string) string {
-	parts := strings.Split(strings.Trim(strings.TrimSuffix(repository, ".git"), "/"), "/")
-	if len(parts) < 2 {
-		return ""
-	}
-	return parts[len(parts)-1]
-}
-
-// namedForTheCheck are the builds earlier checks of the same pull request at the same head named, read once for the
-// check (novox/hq issue 703): asked again because only the trunk moved, the check keeps what they built of a key
-// still the same. Another pull request's build, or one of an earlier head, is never kept. None when they cannot be
-// read, and the check builds, as before.
-func namedForTheCheck(ctx context.Context, p link.PullUpdated, builds []link.CheckBuild) []link.CheckedBuild {
-	if len(builds) == 0 || p.Commit == "" {
-		return nil
-	}
-	pull := link.PullRef{Owner: p.Owner, Repo: p.Repo, Number: p.Number}
-	read, err := checkedBuildsOf(ctx, []link.PullRef{pull})
-	if err != nil {
-		fmt.Printf("  the earlier checks' builds of %s/%s#%d could not be read, so the check builds: %v\n",
-			p.Owner, p.Repo, p.Number, err)
-		// empty-on-error: said above; a check handed no named build builds every module, as before issue 703
-		return nil
-	}
-	var named []link.CheckedBuild
-	for _, b := range read {
-		if b.Pull == pull && link.SameHead(b.Head, p.Commit) {
-			named = append(named, b)
-		}
-	}
-	return named
-}
-
-// checkBuildsOf are the modules a merge of the change would build, in the walk's order, as the check builds them
-// for the walk to take (novox/hq ADR 0350 §1): a module built from the repository checked, at the branch it merges
-// into, from the merge the check makes; any other — a module standing on one — from its own repository at the
-// branch it follows, as the walk builds it. A module whose build reads the repository checked through a context,
-// or that the merge deletes, cannot be built as the walk would: said, and nothing after it is built. A change that
-// moves no module builds nothing.
-func checkBuildsOf(p link.PullUpdated, scope checkScope, entries []inventory.Entry,
-	clone func(inventory.Source) (string, error)) []link.CheckBuild {
-	if len(scope.Reach.Plan.Tiers) == 0 {
-		return nil
-	}
-	m := link.SourceMoved{Owner: p.Owner, Repo: p.Repo, Base: p.Base, CloneURL: p.CloneURL}
-	byName := map[string]inventory.Entry{}
-	for _, e := range entries {
-		byName[e.Manifest.Module] = e
-	}
-	skip := map[string]string{}
-	for _, e := range scope.Reach.Packaging {
-		skip[e.Manifest.Module] = "its build reads " + p.Owner + "/" + p.Repo + " through a context, which a check " +
-			"cannot hand the merge"
-	}
-	for _, e := range scope.Reach.Deleted {
-		skip[e.Manifest.Module] = "the merge deletes it"
-	}
-	var out []link.CheckBuild
-	for tier, names := range scope.Reach.Plan.Tiers {
-		for _, name := range names {
-			e, known := byName[name]
-			b := link.CheckBuild{Module: name, Tier: tier, Skip: skip[name]}
-			switch {
-			case !known:
-				b.Skip = "the catalogue does not hold it"
-			case b.Skip != "":
-			case sourceIs(e.Source, m):
-				b.Merged, b.Path = true, e.Source.Path
-			default:
-				url, err := clone(e.Source)
-				if err != nil {
-					b.Skip = "its repository cannot be cloned: " + err.Error()
-					break
-				}
-				b.Repository, b.Path, b.Ref = url, e.Source.Path, followedBranch(e.Source.Ref)
-			}
-			out = append(out, b)
-		}
-	}
-	return out
-}
-
 // besideRefs is the ref each repository is cloned at beside a check, by the directory it is found under:
 // a core repository at the commit the mesh runs of the module built from it (`running`) — but the
 // catalogue, whose checkout beside is what tests read its files from, at its main, what the next merge
@@ -488,176 +184,5 @@ func sdkPinned() string {
 	return "main"
 }
 
-// siblingOf is another repository of the same owner: novox/mesh-controller → novox/mesh-lab.
-func siblingOf(repository, name string) string {
-	if cut := strings.LastIndex(repository, "/"); cut >= 0 {
-		return repository[:cut+1] + name
-	}
-	return name
-}
-
-// sourceOnSeat is a source's seat form, nil for one on no seat.
-func sourceOnSeat(s inventory.Source) *link.SourceOnSeat {
-	if s.Seat == "" {
-		return nil
-	}
-	return &link.SourceOnSeat{Seat: s.Seat, Repository: s.Repository}
-}
-
 // checkEvents is where the serving controller says a check's verdict; nil in a command.
 var checkEvents link.Bus
-
-// maxCheckReport is how much of a check's report travels in its verdict: enough for the failures and
-// the machines, never a log.
-const maxCheckReport = 60 << 10
-
-// checked says a merge check's verdict as the controller's `checked`. Nothing is recorded or
-// registered: a check builds nothing (issue 240's rule for a dry run, kept for a check).
-func checked(ctx context.Context, result link.BuildResult) {
-	// **A check stopped by its key says nothing** (novox/hq ADR 0406 §4, issue 974, review 2): it stopped because the head or
-	// the trunk commit moved on, and the newer request will judge. Said as an error it would name the live head — red
-	// statuses on the forge, a delivery refused — and written to the key it would stand in the newer request's way.
-	if result.Failed == link.SupersededByKey {
-		fmt.Printf("%s: stopped, its pull request's key moved on; the newer check will judge\n", result.ID)
-		return
-	}
-	sayChecked(ctx, checkedOf(result))
-}
-
-// checkedOf is what a check's outcome says: each layer, and an error — never a pass — for a check that
-// could not run.
-func checkedOf(result link.BuildResult) link.Checked {
-	c := link.Checked{ID: result.ID, On: result.On, Commit: result.Ref}
-	if result.Checked != nil {
-		c.Owner, c.Repo, c.Number = result.Checked.Owner, result.Checked.Repo, result.Checked.Number
-	}
-	switch {
-	case result.Check != nil:
-		c.Verdict, c.Summary, c.Report = result.Check.Verdict, result.Check.Summary, result.Check.Report
-		c.Gate, c.RepoCheck = result.Check.Gate, result.Check.RepoCheck
-		// What was judged (novox/hq ADR 0323 §3): the head merged into the trunk commit, and the commits of the
-		// repositories read beside it.
-		c.Trunk, c.Beside, c.Took = result.Check.Trunk, result.Check.Beside, result.Check.Took
-		c.Built = result.Check.Built
-		c.Validator = result.Check.Validator
-		c.Siblings, c.SiblingsUnknown, c.JudgeFrom = result.Check.Siblings, result.Check.SiblingsUnknown, result.Check.JudgeFrom
-		if c.Gate == nil {
-			// A build seat from before the layers: its verdict is the gate's.
-			c.Gate = &link.CheckLayer{Verdict: c.Verdict, Summary: c.Summary}
-		}
-	case result.Failed != "":
-		// The check could not run: an error, never read as a pass — on both layers it was asked for.
-		c.Verdict, c.Summary = "error", "the check could not run: "+firstLine(result.Failed)
-	default:
-		c.Verdict, c.Summary = "error", "the build seat answered the check with no verdict"
-	}
-	if c.Verdict == "" {
-		c.Verdict = "error"
-	}
-	if result.Check == nil {
-		c.Gate = &link.CheckLayer{Verdict: c.Verdict, Summary: c.Summary}
-		c.RepoCheck = &link.CheckLayer{Verdict: c.Verdict, Summary: c.Summary}
-	}
-	// **A group member's own check has no gate of its own** (novox/hq ADR 0403 clause 1): what ran was the repository's
-	// check alone, and its gate layer is "composed", never a pass. A failure or an error stays what it was.
-	if result.Checked != nil && result.Checked.Composed && result.Check != nil && c.Gate != nil &&
-		(c.Gate.Verdict == "pass" || c.Gate.Verdict == "warning") {
-		composedGate(&c)
-	}
-	if result.Checked != nil && c.Gate != nil && len(c.Gate.Modules) == 0 {
-		c.Gate.Modules = append(append([]string{}, result.Checked.Modules...), prefixedAll("new:", result.Checked.New)...)
-	}
-	if result.Checked != nil && c.Gate != nil && len(c.Gate.Dependents) == 0 {
-		c.Gate.Dependents = result.Checked.Dependents
-	}
-	if result.Checked != nil {
-		c.Plan = result.Checked.Plan
-		if c.Plan != nil && c.Trunk != "" {
-			// The kept delivery plan records the trunk commit with its other inputs (ADR 0323 §3).
-			plan := *c.Plan
-			plan.Trunk = c.Trunk
-			c.Plan = &plan
-		}
-		// A delivery group's composed check (novox/hq ADR 0239): every head it judged, this one first.
-		if g := result.Checked; g.Group != "" {
-			c.Group = g.Group
-			c.Members = append(c.Members, link.CheckedMember{Owner: g.Owner, Repo: g.Repo, Number: g.Number,
-				Commit: result.Ref, Trunk: c.Trunk})
-			for _, m := range g.Members {
-				c.Members = append(c.Members, link.CheckedMember{Owner: m.Owner, Repo: m.Repo, Number: m.Number,
-					Commit: m.Ref, Trunk: memberTrunk(result.Check, m)})
-			}
-		}
-	}
-	for _, l := range []*link.CheckLayer{c.Gate, c.RepoCheck} {
-		if l != nil && l.Verdict == "" {
-			l.Verdict = "error"
-		}
-	}
-	// **A check run again says so** (novox/hq issue 594). The summaries are the lines the pull request
-	// shows, clipped by the forge to a few words, so they get only a short marker after the verdict's own
-	// words; the report gets the whole sentence. Layers copied, so the build's own outcome is left as it came.
-	if mark := link.RunMarker(result.Delivery); mark != "" {
-		c.Summary += " " + mark
-		for _, l := range []**link.CheckLayer{&c.Gate, &c.RepoCheck} {
-			if *l != nil {
-				layer := **l
-				layer.Summary += " " + mark
-				*l = &layer
-			}
-		}
-		c.Report = link.Restarted(result.Delivery) + "\n\n" + c.Report
-	}
-	if len(c.Report) > maxCheckReport {
-		c.Report = "…" + c.Report[len(c.Report)-maxCheckReport:]
-	}
-	return c
-}
-
-// memberTrunk is the trunk commit the build seat merged one of a group's heads into (novox/hq ADR 0323 §6), empty
-// when it said none.
-func memberTrunk(outcome *link.CheckOutcome, m link.GroupMember) string {
-	if outcome == nil {
-		return ""
-	}
-	for _, j := range outcome.Members {
-		if strings.EqualFold(j.Owner, m.Owner) && strings.EqualFold(j.Repo, m.Repo) && strings.HasPrefix(m.Ref, j.Commit) {
-			return j.Trunk
-		}
-	}
-	return ""
-}
-
-func prefixedAll(prefix string, items []string) []string {
-	out := make([]string, 0, len(items))
-	for _, i := range items {
-		out = append(out, prefix+i)
-	}
-	return out
-}
-
-// sayChecked says a merge check's verdict on the bus, where the forge's holder hears it.
-func sayChecked(ctx context.Context, c link.Checked) {
-	repo := "none"
-	if c.RepoCheck != nil {
-		repo = strings.ToUpper(c.RepoCheck.Verdict) + " — " + c.RepoCheck.Summary
-	}
-	judged := ""
-	if c.Trunk != "" {
-		judged = " merged into trunk " + c.Trunk
-	}
-	fmt.Printf("%s: %s/%s#%d at %.8s%s checked on %s: gate %s — %s; repository %s\n", c.ID, c.Owner, c.Repo, c.Number,
-		c.Commit, judged, orSomewhere(c.On), strings.ToUpper(c.Verdict), c.Summary, repo)
-	if checkEvents == nil {
-		return
-	}
-	body, err := json.Marshal(c)
-	if err != nil {
-		return
-	}
-	stating, stop := context.WithTimeout(context.WithoutCancel(ctx), 10*time.Second)
-	defer stop()
-	if err := checkEvents.PublishSeatEvent(stating, link.MeshControllerSeat, link.KeyChecked, body); err != nil {
-		fmt.Printf("%s: the verdict could not be said, so the pull request is not told it: %v\n", c.ID, err)
-	}
-}

cmd/mesh-controller/checks_integration_test.go

@@ -1,56 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"encoding/json"
-	"testing"
-	"time"
-
-	"github.com/nats-io/nats.go"
-	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/link"
-	"github.com/novox/mesh-controller/internal/testbus"
-)
-
-func TestACheckStoppedByItsKeyIsAnnouncedAsNoVerdict(t *testing.T) {
-	js, err := broker.Dial(testbus.URL(t))
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(js.Close)
-	if err := broker.AssertMeshStreams(js); err != nil {
-		t.Fatal(err)
-	}
-	legacy, err := js.Conn().JetStream()
-	if err != nil {
-		t.Fatal(err)
-	}
-	was := checkEvents
-	checkEvents = link.OverNATS{Conn: js.Conn(), JS: legacy}
-	t.Cleanup(func() { checkEvents = was })
-	heard := make(chan *nats.Msg, 4)
-	sub, err := js.Conn().ChanSubscribe(link.SeatEventSubject(link.MeshControllerSeat, link.KeyChecked), heard)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer func() { _ = sub.Unsubscribe() }()
-	asked := &link.CheckRequest{Owner: "novox", Repo: "mesh-catalog", Number: 3}
-	checked(t.Context(), link.BuildResult{ID: "stopped", Ref: "abc", Checked: asked, Failed: link.SupersededByKey})
-	checked(t.Context(), link.BuildResult{ID: "broken", Ref: "abc", Checked: asked, Failed: "the facts snapshot cannot be read"})
-	select {
-	case m := <-heard:
-		var c link.Checked
-		_ = json.Unmarshal(m.Data, &c)
-		if c.ID != "broken" || c.Verdict != "error" {
-			t.Fatalf("the first verdict said is %+v; want only the broken check's error", c)
-		}
-	case <-time.After(5 * time.Second):
-		t.Fatal("nothing was said")
-	}
-	select {
-	case m := <-heard:
-		t.Fatalf("a second verdict was said: %s", m.Data)
-	case <-time.After(300 * time.Millisecond):
-	}
-}

cmd/mesh-controller/checks_queue_test.go

@@ -1,97 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"testing"
-
-	"github.com/nats-io/nats.go"
-
-	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// Acceptance 5 of milestone 2 (novox/hq ADR 0406 §3, issue 974), live, with the store and a real bus: two merges into one
-// repository within a minute, with two open pull requests, leave each pull request with exactly one queued check, by the
-// stream's rule. Each merge moves the trunk, and mesh-delivery asks the controller to check both open pull requests again
-// against it (`delivery check`, which is the controller's own path for a head announced); nothing moves a request, nothing
-// asks the forge, and the queue is read back whole.
-func TestTwoMergesWithinAMinuteLeaveEachOpenPullRequestOneQueuedCheck(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	js, _ := aBuildQueue(t)
-	servingBus.Store(js)
-	t.Cleanup(func() { servingBus.Store(nil) })
-	holdTheDeliverySeat(t, open)
-	was := askDeliveryOwner
-	t.Cleanup(func() { askDeliveryOwner = was })
-	askDeliveryOwner = func(_ context.Context, _ *nats.Conn, verb string, _ map[string]any) (json.RawMessage, error) {
-		if verb != "groups" {
-			t.Fatalf("asked the owner %s", verb)
-		}
-		return json.RawMessage(`[]`), nil
-	}
-	// The repository the two pull requests are into, as a module the mesh builds from it.
-	if err := open.inventory.RegisterModule(ctx, catalogue.Manifest{Module: "mesh-controller", Version: "1"},
-		inventory.Source{Repository: "novox/mesh-controller", Ref: "main", BuiltFrom: "c0", Head: "c0"}); err != nil {
-		t.Fatal(err)
-	}
-
-	heads := map[int]string{7: "7777777777777777777777777777777777777777", 8: "8888888888888888888888888888888888888888"}
-	check := func(number int, trunk string) {
-		t.Helper()
-		p := orderMember{ID: fmt.Sprintf("novox/mesh-controller@%.12s", heads[number]), Repository: "novox/mesh-controller",
-			Base: "main", Head: heads[number], Number: number, Paths: []string{"main.go"}, ModuleDirsSaid: true,
-			BaseSHA: trunk, Ready: number == 8}.pull()
-		p.MergeCheck, p.MergeCheckSaid = true, true
-		if err := (following{open: open, oneShot: true}).PullUpdated(ctx, p); err != nil {
-			t.Fatal(err)
-		}
-	}
-	// Announced against the trunk as it stands, then asked again after each of two merges.
-	for _, trunk := range []string{"1111111111111111111111111111111111111111", "2222222222222222222222222222222222222222",
-		"3333333333333333333333333333333333333333"} {
-		check(7, trunk)
-		check(8, trunk)
-	}
-
-	q, err := link.ReadQueue(ctx, js, link.TheBuildMachine)
-	if err != nil {
-		t.Fatal(err)
-	}
-	seen := map[int]string{}
-	for _, a := range q.Asks {
-		c := a.Request.Check
-		if c == nil {
-			t.Fatalf("%s is no check", a.ID)
-		}
-		if _, twice := seen[c.Number]; twice {
-			t.Errorf("pull request %d has two queued checks", c.Number)
-		}
-		seen[c.Number] = c.Trunk
-		if a.State != link.AskWaiting {
-			t.Errorf("%s is %s", a.ID, a.State)
-		}
-		if want := "3333333333333333333333333333333333333333"; c.Trunk != want {
-			t.Errorf("pull request %d is queued against %.8s; want the newest trunk %.8s", c.Number, c.Trunk, want)
-		}
-	}
-	if len(seen) != 2 {
-		t.Fatalf("queued checks for %v; want one for each of the two open pull requests", seen)
-	}
-	// By the streams' own count: the ready one on its stream, the other on its.
-	for stream, want := range map[string]uint64{broker.ChecksReadyStream: 1, broker.ChecksOtherStream: 1} {
-		info, err := js.Context().StreamInfo(stream)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if info.State.Msgs != want {
-			t.Errorf("%s holds %d request(s); want %d", stream, info.State.Msgs, want)
-		}
-	}
-}

cmd/mesh-controller/checks_test.go

@@ -1,7 +1,6 @@
 package main
 
 import (
-	"errors"
 	"strings"
 	"testing"
 
@@ -53,8 +52,8 @@ func TestThePullRequestIsMappedOntoTheModuleGraph(t *testing.T) {
 			"", "modules/newmod", "modules/newmod/module.json", true, ""},
 		{"the controller judges itself", pull("novox", "mesh-controller", "main", []string{"cmd/x.go"}),
 			"mesh-controller", "", "module.json", true, "self"},
-		{"the node-engine is judged with its validator", pull("novox", "mesh-host", "main", []string{"validate/v.go"}),
-			"mesh-host", "", "module.json", true, "validator"},
+		{"the node-engine is judged by the controller the mesh runs, as any module is (issue 1391)",
+			pull("novox", "mesh-host", "main", []string{"validate/v.go"}), "mesh-host", "", "module.json", true, ""},
 		{"the core's owner, no module: the mesh's, its own check alone", pull("novox", "hq", "main", []string{"README.md"}),
 			"", "", "", true, ""},
 		{"a branch nothing is built from: the mesh's repository, no module", pull("novox", "photos", "master",
@@ -76,8 +75,8 @@ func TestThePullRequestIsMappedOntoTheModuleGraph(t *testing.T) {
 				t.Errorf("%s: %s %q, wanted %q", c.what, what, got[i], want[i])
 			}
 		}
-		if s.Mesh != c.mesh || s.Judge != c.judge {
-			t.Errorf("%s: the mesh's %v judged by %q, wanted %v by %q", c.what, s.Mesh, s.Judge, c.mesh, c.judge)
+		if s.Mesh != c.mesh {
+			t.Errorf("%s: the mesh's %v, wanted %v", c.what, s.Mesh, c.mesh)
 		}
 		if s.gated() != (c.modules != "" || c.new != "") {
 			t.Errorf("%s: gated %v", c.what, s.gated())
@@ -94,200 +93,3 @@ func TestAPullRequestTouchesWhatPackagesItsRepository(t *testing.T) {
 		t.Fatalf("a change to what node-tools packages touched %v (manifests %v)", s.Modules, s.Manifests)
 	}
 }
-
-// Each layer is said; a check that could not run is an error on both, never a pass; a build seat from
-// before the layers is read as the gate.
-func TestAChecksLayersAreEachSaidAndAnErrorIsNeverAPass(t *testing.T) {
-	asked := &link.CheckRequest{Owner: "novox", Repo: "mesh-catalog", Number: 3, Modules: []string{"gitea"}}
-	c := checkedOf(link.BuildResult{ID: "b", Ref: "abc", Checked: asked, Failed: "the facts snapshot cannot be read"})
-	if c.Verdict != "error" || c.Gate == nil || c.Gate.Verdict != "error" || c.RepoCheck == nil || c.RepoCheck.Verdict != "error" {
-		t.Fatalf("a check that could not run said %+v", c)
-	}
-	if strings.Join(c.Gate.Modules, ",") != "gitea" {
-		t.Errorf("the gate names %v", c.Gate.Modules)
-	}
-	c = checkedOf(link.BuildResult{ID: "b", Ref: "abc", Checked: asked, Check: &link.CheckOutcome{Verdict: "warning", Summary: "wide"}})
-	if c.Gate == nil || c.Gate.Verdict != "warning" || c.RepoCheck != nil {
-		t.Fatalf("an outcome without layers said %+v", c)
-	}
-	c = checkedOf(link.BuildResult{ID: "b", Ref: "abc", Checked: asked, Check: &link.CheckOutcome{Verdict: "pass",
-		Gate: &link.CheckLayer{Verdict: "pass"}, RepoCheck: &link.CheckLayer{Verdict: "fail", Summary: "its merge-check.sh failed"}}})
-	if c.RepoCheck.Verdict != "fail" || c.Gate.Verdict != "pass" {
-		t.Fatalf("the layers said %+v / %+v", c.Gate, c.RepoCheck)
-	}
-}
-
-// **The check asks the planner, never a mapping of its own** (novox/hq ADR 0238): what a pull request
-// reaches is reachOfMerge's answer — the same that plans a merge — so a file at the root touches no
-// module in both, and what stands on a touched module is named as its dependents in both.
-func TestAPullRequestReachesWhatAMergeOfItWouldPlan(t *testing.T) {
-	const catalogue = "http://forge.internal:20000/novox/mesh-catalog.git"
-	nats := fromRepo("nats", catalogue, "modules/nats")
-	nats.Source.BuiltFrom = "old"
-	gitea := fromRepo("gitea", catalogue, "modules/gitea")
-	gitea.Source.BuiltFrom = "old"
-	tools := fromRepo("node-tools", "http://forge.internal:20000/novox/mesh-tools.git", "node-tools")
-	entries := []inventory.Entry{nats, gitea, tools}
-	// node-tools stands on the bus's image; a code edge, so a plan takes it along.
-	edges := []inventory.Edge{{From: "node-tools", To: "nats", Kind: inventory.EdgeStandsOn}}
-	read := map[string][]inventory.ReadRepository{}
-
-	for _, c := range []struct {
-		what              string
-		paths             []string
-		moved, dependents string
-		width             int
-		unread            string
-	}{
-		{"a file at the root, read by no build", []string{"merge-check.sh"}, "", "", 0, "merge-check.sh"},
-		{"the bus's own directory", []string{"modules/nats/Dockerfile"}, "nats", "node-tools", 2, ""},
-		{"both, and a README", []string{"modules/gitea/index.ts", "modules/nats/x", "README.md"}, "gitea,nats", "node-tools", 3, "README.md"},
-	} {
-		p := link.PullUpdated{Owner: "novox", Repo: "mesh-catalog", Base: "main", Commit: "head", Paths: c.paths}
-		s := pullScope(p, entries, read, edges)
-		m := link.SourceMoved{Owner: "novox", Repo: "mesh-catalog", Base: "main", Commit: "head", Paths: c.paths}
-		r := reachOfMerge(m, entries, read, edges)
-		if got := strings.Join(s.Modules, ","); got != c.moved || got != strings.Join(r.Moved(), ",") {
-			t.Errorf("%s: the check reaches %q, the planner %v, wanted %q", c.what, got, r.Moved(), c.moved)
-		}
-		if got := strings.Join(s.Dependents, ","); got != c.dependents {
-			t.Errorf("%s: dependents %q, wanted %q", c.what, got, c.dependents)
-		}
-		if s.Width != c.width || s.Width != len(r.Plan.Modules) {
-			t.Errorf("%s: a merge would build %d, the planner says %d, wanted %d", c.what, s.Width, len(r.Plan.Modules), c.width)
-		}
-		if got := strings.Join(s.Unread, ","); got != c.unread {
-			t.Errorf("%s: unread %q, wanted %q", c.what, got, c.unread)
-		}
-	}
-
-	// A repository whose build another module's recipe packages: that module is reached through the
-	// planner's `read`, and what stands on it after it.
-	read["gitea"] = []inventory.ReadRepository{{Repository: "http://forge.internal:20000/novox/mesh-sdk.git"}}
-	s := pullScope(link.PullUpdated{Owner: "novox", Repo: "mesh-sdk", Base: "main", Commit: "head",
-		Paths: []string{"src/index.ts"}}, entries, read, edges)
-	if strings.Join(s.Modules, ",") != "gitea" || len(s.Manifests) != 0 {
-		t.Fatalf("a change to the source gitea packages reaches %v (manifests %v)", s.Modules, s.Manifests)
-	}
-}
-
-// **Only a commit on the trunk is published** (novox/hq ADR 0238): a build of a commit off its repository's
-// default branch — a pull request's head, a branch built by hand, a rebuild or replay of one — is recorded
-// and never registered, so nothing can send it; a check or a dry run never is either.
-func TestABuildOffTheTrunkIsNeverPublished(t *testing.T) {
-	on := link.BuildResult{ID: "b", Commit: "abc", Trunk: "main", OnTrunk: true}
-	if err := publishable(on, ""); err != nil {
-		t.Errorf("a build on the trunk was refused: %v", err)
-	}
-	off := link.BuildResult{ID: "b", Commit: "abc", Trunk: "main"}
-	if err := publishable(off, ""); !errors.Is(err, errOffTheTrunk) || !strings.Contains(err.Error(), "main") {
-		t.Errorf("a build off the trunk was let through: %v", err)
-	}
-	for _, r := range []link.BuildResult{
-		{ID: "c", Trunk: "main", OnTrunk: true, Check: &link.CheckOutcome{Verdict: "pass"}},
-		{ID: "d", Trunk: "main", OnTrunk: true, Checked: &link.CheckRequest{}},
-		{ID: "e", Trunk: "main", OnTrunk: true, DryRun: true},
-	} {
-		if publishable(r, "") == nil {
-			t.Errorf("%s, a check or a dry run, was publishable", r.ID)
-		}
-	}
-	// A module that follows a branch other than the default: that branch is its trunk, and the default
-	// is not.
-	follows := link.BuildResult{ID: "g", Commit: "abc", Trunk: "master", Branches: []string{"nox-mesh"}}
-	if err := publishable(follows, "nox-mesh"); err != nil {
-		t.Errorf("a commit on the branch a module follows was refused: %v", err)
-	}
-	if err := publishable(link.BuildResult{ID: "h", Commit: "abc", Trunk: "master", OnTrunk: true,
-		Branches: []string{"master"}}, "nox-mesh"); err == nil {
-		t.Error("a commit on the default but not on the branch the module follows was published")
-	}
-	if err := publishable(link.BuildResult{ID: "i", Commit: "abc", Trunk: "main", Branches: []string{"feat/x"}}, ""); err == nil {
-		t.Error("a feature branch's commit was published")
-	}
-	// A build seat older than the rule says nothing: let through and said, so the rule can reach the mesh.
-	if err := publishable(link.BuildResult{ID: "f", Commit: "abc"}, ""); err != nil {
-		t.Errorf("a build seat that said nothing was refused: %v", err)
-	}
-}
-
-// **A verdict names the trunk commit it judged** (novox/hq ADR 0323 §3, issue 341): the controller's `checked`
-// carries the head and the trunk commit the build seat merged it into, the commits of the repositories read beside
-// it, how long it took, and the kept delivery plan records the trunk commit with its other inputs. A group's
-// composed check names, per member, the trunk commit that head was merged into (§6).
-func TestAVerdictNamesTheTrunkCommitItJudged(t *testing.T) {
-	plan := &link.ChangePlan{Repository: "novox/mesh-host", Base: "main", Head: "dfb1415aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-		Summary: "builds mesh-host"}
-	asked := &link.CheckRequest{Owner: "novox", Repo: "mesh-host", Number: 66, Base: "main", Plan: plan}
-	c := checkedOf(link.BuildResult{ID: "b", Ref: "dfb1415aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", Checked: asked,
-		Check: &link.CheckOutcome{Verdict: "pass", Took: "4m12s", Head: "dfb1415aaaaa", Trunk: "d28ca95bbbbb",
-			Gate: &link.CheckLayer{Verdict: "pass"}, RepoCheck: &link.CheckLayer{Verdict: "pass"},
-			Beside: map[string]string{"mesh-catalog": "0123456789ab", "mesh-lab": "ba9876543210"}}})
-	if c.Trunk != "d28ca95bbbbb" || c.Commit != "dfb1415aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" {
-		t.Fatalf("the verdict names head %s and trunk %q", c.Commit, c.Trunk)
-	}
-	if c.Beside["mesh-catalog"] != "0123456789ab" || c.Beside["mesh-lab"] != "ba9876543210" {
-		t.Fatalf("the verdict names the repositories read beside it as %v", c.Beside)
-	}
-	if c.Took != "4m12s" {
-		t.Fatalf("the verdict says it took %q", c.Took)
-	}
-	if c.Plan == nil || c.Plan.Trunk != "d28ca95bbbbb" || c.Plan.Head != plan.Head {
-		t.Fatalf("the kept plan records %+v", c.Plan)
-	}
-	if plan.Trunk != "" {
-		t.Fatal("the plan the controller asked with was changed: the verdict's is a copy")
-	}
-
-	group := &link.CheckRequest{Owner: "novox", Repo: "mesh-controller", Number: 7, Base: "main", Group: "feat/x",
-		Members: []link.GroupMember{{Owner: "novox", Repo: "mesh-host", Number: 8, Ref: "cccccccccccc0000", Base: "main"}}}
-	c = checkedOf(link.BuildResult{ID: "g", Ref: "aaaaaaaaaaaa0000", Checked: group, Check: &link.CheckOutcome{
-		Verdict: "pass", Head: "aaaaaaaaaaaa", Trunk: "111111111111", Gate: &link.CheckLayer{Verdict: "pass"},
-		Members: []link.CheckedMember{{Owner: "novox", Repo: "mesh-host", Commit: "cccccccccccc", Trunk: "222222222222"}}}})
-	if len(c.Members) != 2 || c.Members[0].Trunk != "111111111111" || c.Members[1].Trunk != "222222222222" ||
-		c.Members[1].Commit != "cccccccccccc0000" {
-		t.Fatalf("the composed check names its members %+v", c.Members)
-	}
-}
-
-// **The merge made for a check is never registered** (novox/hq ADR 0323 §2): a build of it — a commit on no branch
-// of the forge — is refused, naming the trunk. The rule of ADR 0238 §1 stands unchanged; this holds it for the
-// merge commit a check makes.
-func TestABuildOfACheckMergeIsRefusedNamingTheTrunk(t *testing.T) {
-	merge := link.BuildResult{ID: "b", Commit: "4b5c6d7e8f90aabbccddeeff0011223344556677", Trunk: "main"}
-	err := publishable(merge, "")
-	if !errors.Is(err, errOffTheTrunk) || !strings.Contains(err.Error(), "not on main") {
-		t.Fatalf("a build of a check's merge was answered %v", err)
-	}
-}
-
-// **A verdict no build judges names its trunk commit too** (novox/hq ADR 0323 §3): a change touching no module of a
-// repository with no merge-check.sh (novox/mesh-tools-go) is answered by the controller itself. Naming no trunk, the
-// merge tool refused it, asked again, got the same verdict, and refused for ever.
-func TestADirectVerdictNamesTheTrunkTheForgeAnnounced(t *testing.T) {
-	p := link.PullUpdated{Owner: "novox", Repo: "mesh-tools-go", Number: 3, Base: "main", Commit: "1a2b3c4d5e6f7a8b9c0d",
-		BaseSHA: "7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b"}
-	c := directVerdict(p, link.ChangePlan{Repository: "novox/mesh-tools-go", Base: "main", Head: p.Commit})
-	if c.Trunk != "7a8b9c0d1e2f" || c.Plan == nil || c.Plan.Trunk != "7a8b9c0d1e2f" {
-		t.Fatalf("the direct verdict names trunk %q, its plan %+v", c.Trunk, c.Plan)
-	}
-	if c.Verdict != "pass" || c.Commit != p.Commit {
-		t.Fatalf("the direct verdict is %+v", c)
-	}
-	if c := directVerdict(link.PullUpdated{Owner: "novox", Repo: "x", Commit: "abc"}, link.ChangePlan{}); c.Trunk != "" {
-		t.Fatalf("a forge that said no base head gave the trunk %q", c.Trunk)
-	}
-}
-
-// A head checked again through mesh-delivery (`delivery check --members`, a recheck) reaches the same direct verdict:
-// it names the base head the forge last announced, kept on the member, or the merge tool would refuse it for ever.
-func TestARecheckedHeadsDirectVerdictNamesItsTrunk(t *testing.T) {
-	m := orderMember{ID: "novox/mesh-tools-go@1a2b3c4d5e6f", Repository: "novox/mesh-tools-go", Base: "main",
-		Head: "1a2b3c4d5e6f7a8b9c0d", Number: 3, BaseSHA: "7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b"}
-	if c := directVerdict(m.pull(), link.ChangePlan{}); c.Trunk != "7a8b9c0d1e2f" {
-		t.Fatalf("a rechecked head's direct verdict names trunk %q", c.Trunk)
-	}
-}
-
-// A check stopped by its pull request's key moving on says no verdict (issue 974, review 2): an error said for it would name the
-// live head, and the newer request is the one that judges. A check that failed for any other reason still says its error.

cmd/mesh-controller/collect.go

@@ -4,7 +4,9 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"io"
 	"os"
+	"strings"
 	"time"
 
 	"github.com/novox/mesh-controller/internal/artifacts"
@@ -215,27 +217,34 @@ func collect(ctx context.Context, inv *inventory.Inventory) {
 	}
 
 	r := sweep(ctx, inv, artifacts.Store{Address: address}, references, kept, afterBuild)
+	sayCollected(os.Stderr, r)
+}
+
+// sayCollected says what one sweep after a build did.
+func sayCollected(w io.Writer, r sweepResult) {
 	if r.HoldersWritten > 0 {
-		fmt.Fprintf(os.Stderr, "the artifact store now holds %d more kept archive(s) by a manifest\n", r.HoldersWritten)
+		fmt.Fprintf(w, "the artifact store now holds %d more kept archive(s) by a manifest\n", r.HoldersWritten)
 	}
 	if r.Missing > 0 {
-		fmt.Fprintf(os.Stderr, "%d archive(s) the mesh keeps are not in the artifact store at all; "+
+		fmt.Fprintf(w, "%d archive(s) the mesh keeps are not in the artifact store at all; "+
 			"`collection` lists them\n", r.Missing)
 	}
 	if len(r.LetGo) > 0 {
-		fmt.Fprintf(os.Stderr, "the artifact store let go of %d artifact(s) the mesh no longer keeps\n", len(r.LetGo))
+		// **Each one named** (novox/hq issue 1933): a count could not say which archive a machine's 404 was let go of.
+		fmt.Fprintf(w, "the artifact store let go of %d artifact(s) the mesh no longer keeps: %s\n", len(r.LetGo),
+			strings.Join(r.LetGo, ", "))
 	}
 	if r.Stopped != "" && !r.Bounded {
-		fmt.Fprintln(os.Stderr, r.Stopped)
+		fmt.Fprintln(w, r.Stopped)
 	}
 	if r.Held && r.Left > 0 {
-		fmt.Fprintf(os.Stderr, "%d more to collect; the next build asks again\n", r.Left)
+		fmt.Fprintf(w, "%d more to collect; the next build asks again\n", r.Left)
 	}
 	if r.Skipped > 0 {
-		fmt.Fprintf(os.Stderr, "%d artifact(s) the sweep will not address were skipped\n", r.Skipped)
+		fmt.Fprintf(w, "%d artifact(s) the sweep will not address were skipped\n", r.Skipped)
 	}
 	if r.Indexes > 0 {
-		fmt.Fprintf(os.Stderr, "%d eligible index(es) wait for a collect a person confirms, which takes their platforms too\n", r.Indexes)
+		fmt.Fprintf(w, "%d eligible index(es) wait for a collect a person confirms, which takes their platforms too\n", r.Indexes)
 	}
 }
 

cmd/mesh-controller/compose_callers_test.go

@@ -0,0 +1,59 @@
+package main
+
+import (
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"path/filepath"
+	"sort"
+	"strings"
+	"testing"
+)
+
+// 1389: the controller's own composition is gone. No function of the package is named for it any more, and no function
+// calls one by that name: a name reappearing is a second copy of what mesh-sdk's go/compose holds (novox/hq ADR 0453).
+func TestTheControllersOwnCompositionIsGone(t *testing.T) {
+	gone := map[string]bool{"planFor": true, "declarationWith": true, "composedAndValidated": true, "generators": true,
+		"renderingFor": true, "theRestOfTheMesh": true, "whoResolves": true, "grantsFor": true, "namesInTheMesh": true,
+		"onThePrivateNetwork": true, "passSeatsOn": true, "theMeshPassesSeatsOn": true, "assignmentsOf": true,
+		"licencesFor": true, "seatsOn": true, "composeBusUsers": true, "adoptionFor": true, "localNetworksOf": true}
+	files, err := filepath.Glob("*.go")
+	if err != nil {
+		t.Fatal(err)
+	}
+	fset := token.NewFileSet()
+	var found []string
+	for _, f := range files {
+		if strings.HasSuffix(f, "_test.go") {
+			continue
+		}
+		file, err := parser.ParseFile(fset, f, nil, 0)
+		if err != nil {
+			t.Fatal(err)
+		}
+		for _, d := range file.Decls {
+			fn, ok := d.(*ast.FuncDecl)
+			if !ok {
+				continue
+			}
+			if gone[fn.Name.Name] {
+				found = append(found, f+": "+fn.Name.Name+" is declared")
+			}
+			if fn.Body == nil {
+				continue
+			}
+			ast.Inspect(fn.Body, func(n ast.Node) bool {
+				if c, ok := n.(*ast.CallExpr); ok {
+					if id, ok := c.Fun.(*ast.Ident); ok && gone[id.Name] {
+						found = append(found, f+": "+fn.Name.Name+" calls "+id.Name)
+					}
+				}
+				return true
+			})
+		}
+	}
+	sort.Strings(found)
+	for _, one := range found {
+		t.Errorf("%s: the controller's own composition is back; compose through mesh-sdk (compose_sdk.go)", one)
+	}
+}

cmd/mesh-controller/compose_fallbacks_test.go

@@ -0,0 +1,114 @@
+package main
+
+import (
+	"encoding/base64"
+	"errors"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/compose"
+	"github.com/novox/mesh-controller/internal/broker"
+)
+
+// aCoreInput is an Input of one machine that takes a core module whose credential the vault has not boxed: the composition
+// stands in a vault box for it, and the machine holds the controller's own seal of it.
+func aCoreInput(t *testing.T) (*meshInput, string) {
+	t.Helper()
+	raw := make([]byte, 32)
+	raw[0] = 9
+	key := base64.StdEncoding.EncodeToString(raw)
+	client := catalogue.Manifest{Module: "mesh-provisioner-client", Version: "1",
+		Claims:     []catalogue.Claim{{Name: broker.NodeProvisionerSeat, Scope: catalogue.ScopeNode}},
+		OwnSecrets: catalogue.OwnSecrets{broker.ProvisionerSecret: {Path: "/var/lib/mesh-provisioner-client/broker"}}}
+	return &meshInput{Input: compose.Input{
+		Catalogue: map[string]catalogue.Manifest{client.Module: client},
+		Nodes: []compose.Node{{Name: "laptop", Assigned: []string{client.Module}, SealingKey: key, Stated: true,
+			Contract: compose.VaultBoxContract}},
+		OwnSecrets: []compose.OwnSecretRow{{Node: "laptop", Module: client.Module, Name: broker.ProvisionerSecret,
+			Origin: "made", SealedTo: key, Sealed: "SEALED-BY-THE-CONTROLLER"}},
+	}}, client.Module
+}
+
+// 1385 (the lead's answer 1): where the vault is silent and no box is kept, the declaration carries the controller's own seal
+// for the core credential, as ADR 0396 has it, and stands in for nothing. It failed first: the composition's declaration
+// carried the stand-in box, and a send was refused.
+func TestACoreCredentialTheVaultDidNotBoxIsSealedByTheController(t *testing.T) {
+	in, module := aCoreInput(t)
+	d, _, err := compose.ComposeIn(in.Input, "laptop", compose.Foreseeing)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(d.CoreBoxesWanted) != 1 || len(stillForeseen(d)) == 0 {
+		t.Fatalf("the composition does not stand in for the vault's box: %v", d.CoreBoxesWanted)
+	}
+	sealed, _, err := sealedByTheController(in, "laptop", d, []string{module})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if left := stillForeseen(sealed); len(left) != 0 {
+		t.Fatalf("the declaration still stands in for %v", left)
+	}
+	var file map[string]any
+	for _, r := range sealed.Resources {
+		if r["id"] == module+"."+catalogue.NeedID(broker.ProvisionerSecret) {
+			file = r
+		}
+	}
+	if file == nil || file["sealed"] != "SEALED-BY-THE-CONTROLLER" || file[catalogue.VaultSealedField] != nil {
+		t.Fatalf("the core credential is carried as %v: the controller's own seal, not the vault's box", file)
+	}
+	// And a module the vault did answer for is left as it is.
+	other, _, err := sealedByTheController(in, "laptop", d, []string{"another-module"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(stillForeseen(other)) == 0 {
+		t.Fatal("a module the vault answered for was sealed by the controller")
+	}
+}
+
+// 1383 (the lead's answer 4): the machine that runs the bus is refused where no user has a credential, with busUserList's
+// words, and a machine that does not run the bus is not. It failed first: the Input stood a list in and the bus node composed.
+func TestTheMachineThatRunsTheBusIsRefusedWhereNoUserHasACredential(t *testing.T) {
+	bus := catalogue.Manifest{Module: "nats", Version: "1", BusUsers: "/etc/nats/users.conf",
+		Claims: []catalogue.Claim{{Name: "mesh-broker", Scope: catalogue.ScopeMesh}}}
+	other := catalogue.Manifest{Module: "files", Version: "1"}
+	why := errors.New("this machine runs the bus and not one user has a credential, so the composed list would refuse every connection in the mesh")
+	in := &meshInput{busRefused: why, Input: compose.Input{
+		Catalogue: map[string]catalogue.Manifest{"nats": bus, "files": other},
+		Nodes:     []compose.Node{{Name: "anchor", Assigned: []string{"nats"}}, {Name: "laptop", Assigned: []string{"files"}}},
+	}}
+	if err := refusedBus(in, "anchor"); err == nil || !strings.Contains(err.Error(), "not one user has a credential") {
+		t.Fatalf("the machine that runs the bus is not refused: %v", err)
+	}
+	if err := refusedBus(in, "laptop"); err != nil {
+		t.Fatalf("a machine that does not run the bus is refused: %v", err)
+	}
+	if err := refusedBus(&meshInput{Input: in.Input}, "anchor"); err != nil {
+		t.Fatalf("a bus with users is refused: %v", err)
+	}
+}
+
+// The controller's seal replaces the stand-in box whatever path the resource carries: the path is the manifest's with the
+// machine's words filled in, not the manifest's own. It failed first, with the path compared (the live try: "composed twice and
+// still names ... asked of the vault by the next send").
+func TestTheControllersSealReplacesTheBoxWhateverPathTheFileCarries(t *testing.T) {
+	in, module := aCoreInput(t)
+	d, _, err := compose.ComposeIn(in.Input, "laptop", compose.Foreseeing)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, r := range d.Resources {
+		if _, box := r[catalogue.VaultSealedField]; box {
+			r["path"] = "/home/someone/.var/lib/mesh-provisioner-client/broker"
+		}
+	}
+	sealed, _, err := sealedByTheController(in, "laptop", d, []string{module})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if left := stillForeseen(sealed); len(left) != 0 {
+		t.Fatalf("the declaration still stands in for %v", left)
+	}
+}

cmd/mesh-controller/compose_helpers_test.go

@@ -0,0 +1,33 @@
+package main
+
+import (
+	"context"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/compose"
+)
+
+// grantsOf is the grants a provider creates for its consumers, the consumers whose identity overflows the provision's bound
+// and the credentials bound to another consumer, as mesh-sdk's rendering gives them for the machine (it replaced the
+// controller's grantsFor, issue 1389).
+func grantsOf(ctx context.Context, open *stores, node string) ([]catalogue.Grant, []catalogue.Overflow, []catalogue.Unbound, error) {
+	in, err := inputFor(ctx, open)
+	if err != nil {
+		return nil, nil, nil, err
+	}
+	rendered, err := compose.Render(in.Input, node, compose.Reading)
+	if err != nil {
+		return nil, nil, nil, err
+	}
+	return rendered.Rendering.Grants, rendered.Withheld, rendered.Unbound, nil
+}
+
+// madeAndRendered sends to the machine (so everything a send makes is made) and answers its rendering as a question reads it
+// afterwards: what the controller's Allocating rendering was.
+func madeAndRendered(ctx context.Context, open *stores, node string) (catalogue.Rendering, error) {
+	if _, err := composeSend(ctx, open, node); err != nil {
+		return catalogue.Rendering{}, err
+	}
+	forgetInput(ctx)
+	return renderingOf(ctx, open, node)
+}

cmd/mesh-controller/compose_input.go

@@ -0,0 +1,416 @@
+package main
+
+import (
+	"context"
+	"os"
+	"sort"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/compose"
+	"git.novox.be/novox/mesh-sdk/go/overlay"
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// The controller's adapter from its stores to mesh-sdk's composition input (novox/hq ADR 0453 clause 3, design 47 R4b,
+// issues 1382 and 1383).
+//
+// **The adapter reads, and perform writes.** readComposeInput asks the stores once for everything the composition reads
+// and returns compose.Input, which the composition never changes; it makes, seals, allocates and records nothing. A
+// pair credential, a port, an own secret or a core box that the next send would make is not made here: the composition
+// names it foreseen, and compose_perform.go makes it for a send, then reads the stores again and composes again. A
+// question (status, facts, probes, the merge gate's reading) never performs.
+//
+// **The Input is built once per operation.** A verb that composes every node reads the stores once and hands the Input to
+// each node's composition of it.
+
+// composeInputBuilt is called once for each Input the adapter builds: the seam a test counts the reads of an operation by
+// (issue 1382, criterion 5).
+var composeInputBuilt = func() {}
+
+// readComposeInput reads the stores once and returns what the composition needs. ctx carries what a send keeps (the
+// recorded modules kept at the build their machine runs, recorded_kept.go): the same contexts every send composes under.
+func readComposeInput(ctx context.Context, open *stores) (*meshInput, error) {
+	in, shape, err := readMeshAndNodes(ctx, open)
+	if err != nil {
+		return nil, err
+	}
+	// What each node resolves to, with no credential given (the settings are read before it): the modules whose settings are read, and the
+	// needs whose pair credentials are asked of the stores. Nothing is written by it.
+	unread, err := readSettings(ctx, open, &in)
+	if err != nil {
+		return nil, err
+	}
+	plans := map[string]compose.Resolved{}
+	for _, n := range in.Nodes {
+		if shape.refused[n.Name] != nil {
+			continue // refused for what it keeps: nothing of it is read further
+		}
+		resolved, err := compose.Resolve(in, n.Name)
+		switch {
+		case compose.IsUnresolvable(err):
+			// Their set does not compose: nothing of theirs is read further, as the controller never read a thing for a
+			// node that did not resolve.
+			continue
+		case err != nil:
+			return nil, err
+		}
+		plans[n.Name] = resolved
+	}
+	if err := unreadSettings(unread, plans); err != nil {
+		return nil, err
+	}
+	var busRefused error
+	wouldMake, err := readCredentialsAndBuilds(ctx, open, &in, plans, shape, &busRefused)
+	if err != nil {
+		return nil, err
+	}
+	composeInputBuilt()
+	return &meshInput{Input: in, wouldMake: wouldMake, busRefused: busRefused, refused: shape.refused}, nil
+}
+
+// meshInput is the Input an operation composes over, and the pair credentials its reading found none held for: the ones the
+// next send makes, which perform makes.
+type meshInput struct {
+	compose.Input
+	wouldMake []inventory.PairCredential
+	// busRefused is why the bus's user list cannot be composed (no user has a credential): the machine that runs the bus is
+	// refused with it, as the controller's own composition refused it, and no other machine is.
+	busRefused error
+	// refused is, by node, why that machine alone cannot be composed (nodeRefusal).
+	refused map[string]error
+}
+
+// nodeOf is the node of that name in an Input.
+func nodeOf(in compose.Input, name string) (compose.Node, bool) {
+	for _, n := range in.Nodes {
+		if n.Name == name {
+			return n, true
+		}
+	}
+	return compose.Node{}, false
+}
+
+// inputShape is what the first half of the reading found that the second half needs.
+type inputShape struct {
+	sent    map[string]map[string]string // by node: module to the commit last sent
+	kept    map[string]map[string]string // by node: module to the commit kept
+	current map[string]inventory.CurrentBuild
+	// refused is, by node, why a recorded module cannot be kept at the build the machine runs (keepRecorded's refusal, in
+	// its words): that machine alone is refused with it, as planFor refused it, and nothing else of the mesh is.
+	refused map[string]error
+}
+
+// readMeshAndNodes is the mesh-wide and per-node half of the Input (issue 1382).
+func readMeshAndNodes(ctx context.Context, open *stores) (compose.Input, inputShape, error) {
+	inv := open.inventory
+	var in compose.Input
+	shape := inputShape{sent: map[string]map[string]string{}, kept: map[string]map[string]string{}, refused: map[string]error{}}
+
+	shelf, err := inv.Catalogue(ctx)
+	if err != nil {
+		return in, shape, err
+	}
+	in.Catalogue = shelf
+	if in.Holdings, err = inv.Holdings(ctx); err != nil {
+		return in, shape, err
+	}
+	if in.Licences, err = readLicences(ctx, open); err != nil {
+		return in, shape, err
+	}
+
+	nodes, err := inv.Nodes(ctx)
+	if err != nil {
+		return in, shape, err
+	}
+	places, err := inv.Overlays(ctx)
+	if err != nil {
+		return in, shape, err
+	}
+	placed := map[string]inventory.Overlay{}
+	for _, p := range places {
+		placed[p.Name] = p
+	}
+	if shape.current, err = inv.CurrentBuilds(ctx); err != nil {
+		return in, shape, err
+	}
+
+	// The range the mesh allocates from and what its internal names end in, read from the environment here and nowhere else.
+	in.OverlayCIDR = strings.TrimSpace(os.Getenv(OverlayCIDRVar))
+	in.InternalSuffix = overlay.Suffix()
+	if in.Tunnels, err = readTunnels(ctx, inv); err != nil {
+		return in, shape, err
+	}
+	if in.Adopted, err = readAdopted(ctx, inv); err != nil {
+		return in, shape, err
+	}
+	carried, err := inv.CarriedPeers(ctx)
+	if err != nil {
+		return in, shape, err
+	}
+	for _, c := range carried {
+		in.CarriedPeers = append(in.CarriedPeers, compose.CarriedPeer{
+			PublicKey: c.PublicKey, Address: c.Address, EnrolledAs: c.EnrolledAs, Named: c.Named})
+	}
+	if in.Joining, err = inv.NodesWithALiveToken(ctx); err != nil {
+		return in, shape, err
+	}
+
+	keepsSecrets := false
+	for _, m := range shelf {
+		keepsSecrets = keepsSecrets || m.Keeps != ""
+	}
+
+	for _, n := range nodes {
+		var refusal error
+		node, err := readNode(ctx, open, n, placed[n.Name], &refusal)
+		if err != nil {
+			return in, shape, err
+		}
+		if refusal != nil {
+			shape.refused[n.Name] = refusal
+		}
+		shape.sent[n.Name], shape.kept[n.Name] = node.SentBuilds, node.KeptBuilds
+		in.Nodes = append(in.Nodes, node)
+	}
+	if keepsSecrets {
+		if in.OperatorExport, err = inv.OperatorExport(ctx); err != nil {
+			return in, shape, err
+		}
+	}
+	return in, shape, nil
+}
+
+// readNode is one node of the Input: everything the composition reads about it, in the order the controller read it.
+func readNode(ctx context.Context, open *stores, n inventory.Node, place inventory.Overlay,
+	refused *error) (compose.Node, error) {
+	inv := open.inventory
+	out := compose.Node{
+		Name: n.Name,
+		Place: compose.Place{Key: place.Key, Endpoint: place.Endpoint, Site: place.Site, Hub: place.Hub,
+			Address: place.Address},
+		Account: n.Account, AccountHome: n.AccountHome, AgentAccount: n.AgentAccount, AgentAccountHome: n.AgentAccountHome,
+		Adopted: n.Adopted,
+	}
+	var err error
+	if out.Assigned, err = inv.Assigned(ctx, n.Name); err != nil {
+		return out, err
+	}
+	if out.Capabilities, err = inv.ProfileOf(ctx, n.Name); err != nil {
+		return out, err
+	}
+	if out.PublicDomain, err = inv.PublicDomainOf(ctx, n.Name); err != nil {
+		return out, err
+	}
+	if out.Pins, err = inv.PinsFor(ctx, n.Name); err != nil {
+		return out, err
+	}
+	if out.Bound, err = inv.BindingsFor(ctx, n.Name); err != nil {
+		return out, err
+	}
+	given, err := inv.PortsFor(ctx, n.Name)
+	if err != nil {
+		return out, err
+	}
+	for _, a := range given {
+		if out.Ports == nil {
+			out.Ports = map[string]map[int]int{}
+		}
+		if out.Ports[a.Module] == nil {
+			out.Ports[a.Module] = map[int]int{}
+		}
+		out.Ports[a.Module][a.Wanted] = a.Machine
+	}
+	if out.SealingKey, err = inv.SealingKeyOf(ctx, n.Name); err != nil {
+		return out, err
+	}
+	if n.Adopted {
+		if out.Taken, err = inv.Taken(ctx, n.Name); err != nil {
+			return out, err
+		}
+	}
+	if out.OutwardLinks, err = inv.OutwardLinksOf(ctx, n.Name); err != nil {
+		return out, err
+	}
+	account, had, err := inv.MachineOf(ctx, n.Name)
+	if err != nil {
+		return out, err
+	}
+	if had && account.Machine != nil {
+		out.NetworksSaid = true
+		for _, a := range account.Machine.Networks {
+			out.Networks = append(out.Networks, catalogue.AttachedNetwork{Link: a.Link, Network: a.Network})
+		}
+	}
+	if out.Sequence, err = inv.Sequence(ctx, n.ID); err != nil {
+		return out, err
+	}
+	// Every node-engine of release 6 reads a module per resource and a build per module.
+	out.ReadsModules = true
+	stated, has, err := inv.HealthOf(ctx, n.Name)
+	if err != nil {
+		return out, err
+	}
+	out.Stated = has
+	if has {
+		out.Contract = stated.Contract
+	}
+	return out, nil
+}
+
+func readTunnels(ctx context.Context, inv *inventory.Inventory) (map[string]compose.FoundTunnel, error) {
+	found, err := inv.Tunnels(ctx)
+	if err != nil {
+		return nil, err
+	}
+	if len(found) == 0 {
+		return nil, nil
+	}
+	out := make(map[string]compose.FoundTunnel, len(found))
+	for name, t := range found {
+		out[name] = compose.FoundTunnel{Tunnel: tunnelOf(t.Tunnel), NodeAdopted: t.NodeAdopted}
+	}
+	return out, nil
+}
+
+func readAdopted(ctx context.Context, inv *inventory.Inventory) (*compose.AdoptedTunnel, error) {
+	tunnel, hub, adopted, err := inv.AdoptedTunnel(ctx)
+	if err != nil {
+		return nil, err
+	}
+	if hub == "" {
+		return nil, nil
+	}
+	return &compose.AdoptedTunnel{Tunnel: tunnelOf(tunnel), Hub: hub, Adopted: adopted}, nil
+}
+
+func tunnelOf(t inventory.Tunnel) compose.Tunnel {
+	out := compose.Tunnel{Interface: t.Interface, Unit: t.Unit, Config: t.Config, Port: t.Port, MTU: t.MTU,
+		Address: t.Address, Range: t.Range, PublicKey: t.PublicKey}
+	for _, p := range t.Peers {
+		out.Peers = append(out.Peers, compose.TunnelPeer{PublicKey: p.PublicKey, Address: p.Address})
+	}
+	return out
+}
+
+// readLicences is every licence the mesh holds, with who uses it and the key sealed to each holder: given even where empty,
+// so a holder the mesh holds no key for composes as that, and not as a key that was not asked for.
+func readLicences(ctx context.Context, open *stores) ([]compose.Licence, error) {
+	held, err := open.Licences(ctx)
+	if err != nil {
+		return nil, err
+	}
+	all, err := held.All(ctx)
+	if err != nil {
+		return nil, err
+	}
+	var out []compose.Licence
+	for _, one := range all {
+		l := compose.Licence{Name: one.Name, Serves: one.Serves, Keys: map[compose.Holder]string{}}
+		holders, err := held.HoldersOf(ctx, one.Name)
+		if err != nil {
+			return nil, err
+		}
+		for _, h := range holders {
+			holder := compose.Holder{Node: h.Node, Module: h.Module}
+			l.Holders = append(l.Holders, holder)
+			key, err := held.KeyFor(ctx, one.Name, h.Node, h.Module)
+			if err != nil {
+				return nil, err
+			}
+			l.Keys[holder] = key
+		}
+		node, module, err := held.ManagerOf(ctx, one.Name)
+		if err != nil {
+			return nil, err
+		}
+		l.Manager = compose.Holder{Node: node, Module: module}
+		out = append(out, l)
+	}
+	return out, nil
+}
+
+// readSettings is each node's settings layers for every module that has any (a row, or config in mesh-config), read BEFORE any node is resolved: the first pass
+// resolves a node whose set takes a provider's served facts from the node that runs it, with that node's settings on them
+// (servedOnNode), so a mesh whose provider says ${setting:domain} resolves only with the settings in the Input. A module's
+// settings that fail to read are returned in unread, by node and module, and are an error only for a module a node resolves to
+// (unreadSettings): the controller read none for a module nothing runs.
+func readSettings(ctx context.Context, open *stores, in *compose.Input) (unread map[string]map[string]error, err error) {
+	have, err := open.inventory.ModulesWithSettings(ctx)
+	if err != nil {
+		return nil, err
+	}
+	names, err := modulesToRead(in.Catalogue, have, func(module string) (bool, error) {
+		return open.inventory.ReadsConfig(ctx, module)
+	})
+	if err != nil {
+		return nil, err
+	}
+	for i := range in.Nodes {
+		n := &in.Nodes[i]
+		for _, module := range names {
+			layers, err := open.inventory.SettingsFor(ctx, n.Name, module)
+			if err != nil {
+				if unread == nil {
+					unread = map[string]map[string]error{}
+				}
+				if unread[n.Name] == nil {
+					unread[n.Name] = map[string]error{}
+				}
+				unread[n.Name][module] = err
+				continue
+			}
+			if len(layers) == 0 {
+				continue
+			}
+			if n.Settings == nil {
+				n.Settings = map[string][]catalogue.Layer{}
+			}
+			n.Settings[module] = layers
+		}
+	}
+	return unread, nil
+}
+
+// modulesToRead is the modules on the shelf whose settings are read for a node: those with a settings row, and those in
+// the config form whose values mesh-config holds (readsConfig), which have no row when they were never in the settings
+// form (issue 1493: brother's scanner and printer, set only in mesh-config, composed empty). SettingsFor is where
+// mesh-config's values are laid in, so a gate on the settings table alone leaves them out.
+func modulesToRead(shelf map[string]catalogue.Manifest, have map[string]bool, readsConfig func(string) (bool, error)) ([]string, error) {
+	names := make([]string, 0, len(have))
+	for module, m := range shelf {
+		if have[module] {
+			names = append(names, module)
+			continue
+		}
+		if !m.DeclaresConfig() {
+			continue
+		}
+		reads, err := readsConfig(module)
+		if err != nil {
+			return nil, err
+		}
+		if reads {
+			names = append(names, module)
+		}
+	}
+	sort.Strings(names)
+	return names, nil
+}
+
+// unreadSettings is the error of a module's settings that did not read, for a module the node resolves to.
+func unreadSettings(unread map[string]map[string]error, plans map[string]compose.Resolved) error {
+	names := make([]string, 0, len(plans))
+	for node := range plans {
+		names = append(names, node)
+	}
+	sort.Strings(names)
+	for _, node := range names {
+		for _, m := range plans[node].Plan.Modules {
+			if err := unread[node][m.Module]; err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}

cmd/mesh-controller/compose_input_credentials.go

@@ -0,0 +1,285 @@
+package main
+
+import (
+	"context"
+	"sort"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/compose"
+	"git.novox.be/novox/mesh-sdk/go/overlay"
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// The second half of the adapter (issue 1383): the credential and build fields of the Input, read and never made.
+
+// readCredentialsAndBuilds fills what the first half left: the credentials, the own secrets, the vault's boxes, the bus,
+// each node's serving key and certificate, and the builds.
+func readCredentialsAndBuilds(ctx context.Context, open *stores, in *compose.Input, plans map[string]compose.Resolved,
+	shape inputShape, busRefused *error) ([]inventory.PairCredential, error) {
+	if err := readIdentity(ctx, open, in); err != nil {
+		return nil, err
+	}
+	wouldMake, err := readCredentials(ctx, open, in, plans, busRefused)
+	if err != nil {
+		return nil, err
+	}
+	return wouldMake, readBuilds(ctx, open, in, plans, shape)
+}
+
+// readIdentity is the mesh's authority and each node's serving key and the certificate kept for it, for a mesh in which a
+// module asks for a certificate. It establishes and issues nothing: a certificate not kept yet is composed with a stand-in, and
+// issued by the send (certificateFor).
+func readIdentity(ctx context.Context, open *stores, in *compose.Input) error {
+	needs := false
+	for _, m := range in.Catalogue {
+		needs = needs || m.Certificate != nil
+	}
+	if !needs {
+		return nil
+	}
+	ident, err := open.Identity(ctx)
+	if err != nil {
+		return err
+	}
+	if certificate, known, err := ident.KnownAuthority(ctx); err != nil {
+		return err
+	} else if known {
+		in.Authority = certificate
+	}
+	nodes, err := open.inventory.Nodes(ctx)
+	if err != nil {
+		return err
+	}
+	ids := map[string]string{}
+	for _, n := range nodes {
+		ids[n.Name] = n.ID
+	}
+	for i := range in.Nodes {
+		n := &in.Nodes[i]
+		if n.ServingKey, err = ident.ServingKeyOf(ctx, ids[n.Name]); err != nil {
+			return err
+		}
+		if n.ServingKey == "" {
+			continue
+		}
+		if certificate, known, err := ident.KeptCertificate(ctx, overlay.InternalName(n.Name), n.ServingKey); err != nil {
+			return err
+		} else if known {
+			n.Certificate = certificate
+		}
+	}
+	return nil
+}
+
+// readCredentials is how each pair credential a node takes from elsewhere stands, the credentials made for each provider's
+// consumers, the own secrets, the vault's boxes and the bus. It reads and never makes: a credential a send would make is
+// left out (the composition's would-make), a credential only a person gives and nobody gave is not-given, and one the send
+// would be refused is refused with the controller's words.
+func readCredentials(ctx context.Context, open *stores, in *compose.Input, plans map[string]compose.Resolved,
+	busRefused *error) ([]inventory.PairCredential, error) {
+	var wouldMake []inventory.PairCredential
+	inv := open.inventory
+	shelf := in.Catalogue
+	nodeOf := map[string]compose.Node{}
+	for _, n := range in.Nodes {
+		nodeOf[n.Name] = n
+	}
+	names := make([]string, 0, len(plans))
+	for name := range plans {
+		names = append(names, name)
+	}
+	sort.Strings(names)
+	for _, name := range names {
+		resolved := plans[name]
+		nodeShelf := shelfWith(shelf, nodeOf[name].Kept)
+		for _, need := range resolved.Plan.Needs {
+			if need.ByRecord {
+				continue
+			}
+			p := inventory.PairCredential{Name: need.Name, Consumer: name, ConsumerModule: need.For,
+				Provider: need.From, Local: need.Local}
+			if module, outside := issuedOutsideBy(nodeShelf, need); outside {
+				p.Kind, p.ProviderModule = inventory.PairOutside, module
+			} else if need.SharedOwn != "" {
+				p.Kind, p.Own = inventory.PairShared, need.SharedOwn
+				p.ProviderModule = sharedProviderModule(resolved.Plan, shelf, need)
+			}
+			state, err := inv.PairCredentialState(ctx, p)
+			if err != nil {
+				return nil, err
+			}
+			c := compose.Credential{Provision: need.Name, Consumer: name, ConsumerModule: need.For,
+				Provider: need.From, Local: need.Local}
+			switch state.State {
+			case inventory.PairHeld:
+				c.State, c.Sealed = compose.CredentialHeld, state.Sealed
+			case inventory.PairNotGiven:
+				c.State, c.Why = compose.CredentialNotGiven, state.Why
+			case inventory.PairRefused:
+				c.State, c.Why = compose.CredentialRefused, state.Why
+			default:
+				// Left out: a need with no entry is the credential the next send makes, and perform makes it.
+				wouldMake = append(wouldMake, p)
+				continue
+			}
+			in.Credentials = append(in.Credentials, c)
+		}
+	}
+
+	// The credentials made for each provider's consumers, so the grants it must create are read from them.
+	for _, n := range in.Nodes {
+		rows, err := inv.SecretsFrom(ctx, n.Name)
+		if err != nil {
+			return nil, err
+		}
+		for _, s := range rows {
+			in.Issued = append(in.Issued, compose.Issued{Provision: s.Name, Consumer: s.Consumer,
+				ConsumerModule: s.ConsumerModule, Local: s.Local, Provider: n.Name, ForProvider: s.ForProvider})
+		}
+	}
+	own, err := inv.OwnSecretRows(ctx)
+	if err != nil {
+		return nil, err
+	}
+	for _, r := range own {
+		in.OwnSecrets = append(in.OwnSecrets, compose.OwnSecretRow{Node: r.Node, Module: r.Module, Name: r.Name,
+			Origin: r.Origin, SealedTo: r.SealedTo, Sealed: r.Sealed})
+	}
+	for _, n := range in.Nodes {
+		boxes, err := inv.KeptCoreBoxes(ctx, n.Name)
+		if err != nil {
+			return nil, err
+		}
+		for module, byName := range boxes {
+			for name, b := range byName {
+				in.KeptCoreBoxes = append(in.KeptCoreBoxes, compose.CoreBox{Node: n.Name, Module: module, Name: name,
+					Generation: b.Generation, SealedTo: b.SealedTo, Box: b.Box})
+			}
+		}
+	}
+	sort.Slice(in.KeptCoreBoxes, func(i, j int) bool {
+		a, b := in.KeptCoreBoxes[i], in.KeptCoreBoxes[j]
+		if a.Node != b.Node {
+			return a.Node < b.Node
+		}
+		if a.Module != b.Module {
+			return a.Module < b.Module
+		}
+		return a.Name < b.Name
+	})
+
+	// The bus: its user list as the controller composes it, for the machine that runs it, and who the mesh has minted a
+	// credential for.
+	var bus []catalogue.Manifest
+	for _, m := range shelf {
+		if m.BusUsers != "" && m.ClaimsSeat("mesh-broker") {
+			bus = append(bus, m)
+		}
+	}
+	if len(bus) > 0 {
+		list, missing, err := busUserList(ctx, inv, bus)
+		if err != nil && !strings.Contains(err.Error(), "not one user has a credential") {
+			return nil, err
+		}
+		if err != nil {
+			// The machine that runs the bus is refused, as the controller's own composition refused it: a list that
+			// refuses every connection in the mesh is never composed (refusedBus); the other machines compose.
+			*busRefused = err
+		}
+		in.BusUsers, in.BusMissing = list, missing
+	}
+	if in.BusMinted, err = inv.BusMinted(ctx); err != nil {
+		return nil, err
+	}
+	if in.BusMemberships, err = inv.BusMemberships(ctx); err != nil {
+		return nil, err
+	}
+	return wouldMake, nil
+}
+
+// readBuilds is the build half of the Input: every repository the mesh built, each module's current build, and the build made
+// from a commit of a module for the machines whose node-engine reads them.
+func readBuilds(ctx context.Context, open *stores, in *compose.Input, plans map[string]compose.Resolved, shape inputShape) error {
+	inv := open.inventory
+	held, err := inv.Held(ctx)
+	if err != nil {
+		return err
+	}
+	for repository := range held {
+		in.Built = append(in.Built, repository)
+	}
+	sort.Strings(in.Built)
+	in.CurrentBuilds = make(map[string]string, len(shape.current))
+	for module, b := range shape.current {
+		in.CurrentBuilds[module] = b.Commit
+	}
+	// The build made from each commit a declaration may carry, for the machines that read a build per module.
+	for _, n := range in.Nodes {
+		if !n.ReadsModules {
+			continue
+		}
+		resolved, ok := plans[n.Name]
+		if !ok {
+			continue
+		}
+		for _, m := range resolved.Plan.Modules {
+			for _, commit := range []string{shape.current[m.Module].Commit, shape.kept[n.Name][m.Module], shape.sent[n.Name][m.Module]} {
+				if commit == "" {
+					continue
+				}
+				if _, done := in.BuildIDs[m.Module][commit]; done {
+					continue
+				}
+				build, err := inv.BuildOf(ctx, m.Module, commit)
+				if err != nil {
+					return err
+				}
+				if in.BuildIDs == nil {
+					in.BuildIDs = map[string]map[string]string{}
+				}
+				if in.BuildIDs[m.Module] == nil {
+					in.BuildIDs[m.Module] = map[string]string{}
+				}
+				in.BuildIDs[m.Module][commit] = build
+			}
+		}
+	}
+	return nil
+}
+
+// shelfWith is the shelf with each module a node keeps at the build it runs put in place of the current one: a copy.
+func shelfWith(shelf map[string]catalogue.Manifest, kept map[string]catalogue.Manifest) map[string]catalogue.Manifest {
+	if len(kept) == 0 {
+		return shelf
+	}
+	out := make(map[string]catalogue.Manifest, len(shelf)+len(kept))
+	for name, m := range shelf {
+		out[name] = m
+	}
+	for name, m := range kept {
+		out[name] = m
+	}
+	return out
+}
+
+// sharedProviderModule is which module answers a shared credential on the providing node: the one in the plan, else the first
+// the catalogue names (providerModuleOf, in an order that does not move between calls).
+func sharedProviderModule(plan catalogue.Resolution, shelf map[string]catalogue.Manifest, n catalogue.Needed) string {
+	for _, m := range plan.Modules {
+		if _, shared := m.SharedCredentialOf(n.Name); shared {
+			return m.Module
+		}
+	}
+	names := make([]string, 0, len(shelf))
+	for name := range shelf {
+		names = append(names, name)
+	}
+	sort.Strings(names)
+	for _, name := range names {
+		if _, shared := shelf[name].SharedCredentialOf(n.Name); shared {
+			return name
+		}
+	}
+	return ""
+}

cmd/mesh-controller/compose_input_credentials_integration_test.go

@@ -0,0 +1,354 @@
+//go:build integration
+
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"sort"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/compose"
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// tableState is every table's rows and every sequence's last value, as the adapter's reads must leave them.
+func tableState(t *testing.T, inv *inventory.Inventory) map[string]string {
+	t.Helper()
+	out := map[string]string{}
+	for _, row := range inv.QueryForTest(t, `select table_name from information_schema.tables
+		where table_schema = 'public' and table_type = 'BASE TABLE' order by table_name`) {
+		name := strings.Trim(row[0], `"`)
+		count := inv.QueryForTest(t, fmt.Sprintf(`select count(*)::text from %q`, name))
+		out["rows:"+name] = fmt.Sprint(count)
+		digest := inv.QueryForTest(t, fmt.Sprintf(`select coalesce(md5(string_agg(t::text, '|' order by t::text)), '') from %q t`, name))
+		out["content:"+name] = fmt.Sprint(digest)
+	}
+	for _, row := range inv.QueryForTest(t, `select sequencename, coalesce(last_value::text, '') from pg_sequences
+		where schemaname = 'public' order by sequencename`) {
+		out["sequence:"+row[0]] = row[1]
+	}
+	return out
+}
+
+// 1382/AC4 and 1383/AC6: building the Input writes nothing. The store's rows, their contents and its sequences are the same
+// before and after, on a mesh whose credentials are not made, whose ports are not given and which keeps a recorded build.
+func TestBuildingTheInputWritesNothing(t *testing.T) {
+	open, _ := aMeshWithSecrets(t)
+	ctx := t.Context()
+	inv := open.inventory
+	// A consumer whose credential nothing has made yet, on a mesh that already composed.
+	register(t, open, catalogue.Manifest{Module: "reports", Version: "1", Requires: []string{"s3-bucket"},
+		Resources: []map[string]any{{"id": "config", "type": "file", "path": "/etc/reports/config.json", "mode": "0600",
+			"content": "{}", "merge": "json"}}})
+	if _, err := inv.Assign(ctx, "laptop", "reports"); err != nil {
+		t.Fatal(err)
+	}
+	before := tableState(t, inv)
+	if _, err := readComposeInput(ctx, open); err != nil {
+		t.Fatal(err)
+	}
+	after := tableState(t, inv)
+	var moved []string
+	for k, v := range after {
+		if before[k] != v {
+			moved = append(moved, k)
+		}
+	}
+	sort.Strings(moved)
+	if len(moved) > 0 {
+		t.Fatalf("building the Input wrote: %v", moved)
+	}
+}
+
+// a consumer of the s3-bucket aMeshWithSecrets' provider offers, with a file the credential goes into.
+func aConsumerOfTheBucket(name string) catalogue.Manifest {
+	return catalogue.Manifest{Module: name, Version: "1", Requires: []string{"s3-bucket"},
+		Secrets: map[string]string{"s3-bucket": "/etc/" + name + "/s3"},
+		Resources: []map[string]any{{"id": "config", "type": "file", "path": "/etc/" + name + "/config.json", "mode": "0600",
+			"content": "{}", "merge": "json"}}}
+}
+
+// 1383/AC1: of a provider's three consumers, two have their credentials made and one has not: Issued holds the two rows, with
+// the copy sealed to the provider, the third is a credential the next send makes, and no row was inserted for it (planFor
+// inserted it, plan.go: SecretFor in every mode).
+func TestAPairCredentialNoRowHoldsIsAWouldMakeAndNoRowIsInserted(t *testing.T) {
+	open, _ := aMeshWithSecrets(t)
+	ctx := t.Context()
+	inv := open.inventory
+	register(t, open, aConsumerOfTheBucket("reports"))
+	if _, err := inv.Assign(ctx, "laptop", "reports"); err != nil {
+		t.Fatal(err)
+	}
+	// A send makes the credentials of files and reports; a question makes none.
+	if _, err := composeSend(ctx, open, "laptop"); err != nil {
+		t.Fatal(err)
+	}
+	register(t, open, aConsumerOfTheBucket("metrics"))
+	if _, err := inv.Assign(ctx, "laptop", "metrics"); err != nil {
+		t.Fatal(err)
+	}
+	before := tableState(t, inv)
+	in, err := readComposeInput(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var rows []compose.Issued
+	for _, r := range in.Issued {
+		if r.Provider == "anchor" && r.Provision == "s3-bucket" {
+			rows = append(rows, r)
+			if r.ForProvider == "" {
+				t.Errorf("the row of %s carries no copy sealed to the provider", r.ConsumerModule)
+			}
+		}
+	}
+	if len(rows) != 2 {
+		t.Fatalf("Issued holds %d row(s) for anchor's s3-bucket, want files and reports: %+v", len(rows), rows)
+	}
+	var would []string
+	for _, p := range in.wouldMake {
+		would = append(would, p.ConsumerModule)
+	}
+	if len(would) != 1 || would[0] != "metrics" {
+		t.Fatalf("the credentials the next send makes are %v, want metrics", would)
+	}
+	for _, c := range in.Credentials {
+		if c.ConsumerModule == "metrics" {
+			t.Errorf("a credential nobody holds has an entry: %+v", c)
+		}
+	}
+	after := tableState(t, inv)
+	for k, v := range after {
+		if before[k] != v {
+			t.Errorf("reading the Input moved %s", k)
+		}
+	}
+}
+
+// 1383/AC2: a credential only a person gives that nobody gave is not given, and so is one given under a key the machine no
+// longer has; a credential given by a person for the pair and sealed to a key one end no longer has is refused: in the words
+// plan.go and secrets.go use.
+func TestACredentialOnlyAPersonGivesIsNotGivenAndAGivenOneUnderAnOldKeyIsSaidSo(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	register(t, open, catalogue.Manifest{Module: "indexers", Version: "1", Provides: []catalogue.Offer{{
+		Name: "indexer-api", Scope: catalogue.ScopeMesh, Credential: &catalogue.OfferCredential{IssuedBy: catalogue.IssuedOutside}}}})
+	register(t, open, catalogue.Manifest{Module: "grabber", Version: "1", Requires: []string{"indexer-api"},
+		Secrets: map[string]string{"indexer-api": "/etc/grabber/key"}})
+	register(t, open, aConsumerOfTheBucket("ledger"))
+	register(t, open, catalogue.Manifest{Module: "objects", Version: "1", Provides: catalogue.FromAnywhere("s3-bucket")})
+	for _, a := range [][2]string{{"anchor", "indexers"}, {"laptop", "grabber"}, {"anchor", "objects"}, {"laptop", "ledger"}} {
+		if _, err := inv.Assign(ctx, a[0], a[1]); err != nil {
+			t.Fatalf("assign %s %s: %v", a[0], a[1], err)
+		}
+	}
+	stateOf := func(provision, consumerModule string) (compose.Credential, bool) {
+		in, err := readComposeInput(ctx, open)
+		if err != nil {
+			t.Fatal(err)
+		}
+		for _, c := range in.Credentials {
+			if c.Provision == provision && c.ConsumerModule == consumerModule {
+				return c, true
+			}
+		}
+		return compose.Credential{}, false
+	}
+
+	c, found := stateOf("indexer-api", "grabber")
+	if !found || c.State != compose.CredentialNotGiven || !strings.Contains(c.Why, "nobody gave it") {
+		t.Fatalf("a credential nobody gave reads as %+v", c)
+	}
+	if err := inv.AcceptSecretForPair(ctx, "indexer-api", "laptop", "grabber", "anchor", "", "the-key"); err != nil {
+		t.Fatal(err)
+	}
+	if c, found := stateOf("indexer-api", "grabber"); !found || c.State != compose.CredentialHeld || c.Sealed == "" {
+		t.Fatalf("a credential a person gave reads as %+v", c)
+	}
+	// The consumer's machine generated a key of its own since.
+	if err := inv.RecordSealingKey(ctx, nodeID(t, open, "laptop"), aPublicKey(t)); err != nil {
+		t.Fatal(err)
+	}
+	if c, found := stateOf("indexer-api", "grabber"); !found || c.State != compose.CredentialNotGiven ||
+		!strings.Contains(c.Why, "a sealing key one end no longer has") {
+		t.Fatalf("a credential given under a key the machine no longer has reads as %+v", c)
+	}
+
+	// A credential for a pair, given by a person, under a key one end has since replaced: the mesh cannot make another.
+	if err := inv.RecordSealingKey(ctx, nodeID(t, open, "laptop"), aPublicKey(t)); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.AcceptSecretForPair(ctx, "s3-bucket", "laptop", "ledger", "anchor", "", "the-bucket-key"); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.RecordSealingKey(ctx, nodeID(t, open, "laptop"), aPublicKey(t)); err != nil {
+		t.Fatal(err)
+	}
+	if c, found := stateOf("s3-bucket", "ledger"); !found || c.State != compose.CredentialRefused ||
+		!strings.Contains(c.Why, "was accepted from a person, and a sealing key at one end has changed since") {
+		t.Fatalf("a credential given for the pair under an old key reads as %+v", c)
+	}
+}
+
+// 1383/AC3: the own secrets carry their origin, the key they are sealed to and the sealed value; the vault's kept boxes, the
+// licences (with their keys given, so an empty key means the mesh holds none), the users the bus has minted and the
+// memberships equal what the inventory answers.
+func TestTheAdaptersInputCarriesTheOwnSecretsTheBoxesTheLicencesAndTheBus(t *testing.T) {
+	open, _ := aMeshWithSecrets(t)
+	ctx := t.Context()
+	inv := open.inventory
+	key, err := inv.SealingKeyOf(ctx, "anchor")
+	if err != nil {
+		t.Fatal(err)
+	}
+	sealed, err := inv.SecretForModule(ctx, "anchor", "objects", "admin")
+	if err != nil {
+		t.Fatal(err)
+	}
+	box := json.RawMessage(`{"v":1,"eph":"e","iv":"i","tag":"t","ct":"c"}`)
+	if err := inv.KeepCoreBox(ctx, "anchor", inventory.CoreBox{Module: "objects", Name: "admin", Generation: 4,
+		SealedTo: key, Box: box}); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.SeedBusUser(ctx, inventory.BusUser{Username: "anchor.objects", Kind: "module", Node: "anchor",
+		Module: "objects"}, "a-password"); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.PutBusMembership(ctx, "laptop", "sealed-membership"); err != nil {
+		t.Fatal(err)
+	}
+	held, err := open.Licences(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := held.Add(ctx, "claude", "static", map[string]any{"model": "x"}); err != nil {
+		t.Fatal(err)
+	}
+
+	in, err := readComposeInput(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var own *compose.OwnSecretRow
+	for i := range in.OwnSecrets {
+		if r := &in.OwnSecrets[i]; r.Node == "anchor" && r.Module == "objects" && r.Name == "admin" {
+			own = r
+		}
+	}
+	if own == nil || own.Origin != "made" || own.SealedTo != key || own.Sealed != sealed {
+		t.Errorf("the own secret reads as %+v; the inventory holds %q sealed to %q", own, sealed, key)
+	}
+	var kept *compose.CoreBox
+	for i := range in.KeptCoreBoxes {
+		if b := &in.KeptCoreBoxes[i]; b.Node == "anchor" && b.Module == "objects" && b.Name == "admin" {
+			kept = b
+		}
+	}
+	if kept == nil || kept.Generation != 4 || kept.SealedTo != key || string(kept.Box) != string(box) {
+		t.Errorf("the kept box reads as %+v", kept)
+	}
+	if got := strings.Join(in.BusMinted, ","); !strings.Contains(got, "anchor.objects") {
+		t.Errorf("BusMinted is %v", in.BusMinted)
+	}
+	if in.BusMemberships["laptop"] != "sealed-membership" {
+		t.Errorf("BusMemberships is %v", in.BusMemberships)
+	}
+	if len(in.Licences) != 1 || in.Licences[0].Name != "claude" || in.Licences[0].Keys == nil {
+		t.Errorf("Licences read as %+v", in.Licences)
+	}
+}
+
+// 1383/AC4: the bus's user list is what busUserList gives for the machine that runs the bus, and the Input carries none when
+// no module of the shelf runs the bus.
+func TestTheBusUsersAreWhatTheControllerComposesForTheMachineThatRunsTheBus(t *testing.T) {
+	open, _ := aMeshWithSecrets(t)
+	ctx := t.Context()
+	in, err := readComposeInput(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if in.BusUsers != "" || len(in.BusMissing) != 0 {
+		t.Fatalf("a mesh whose shelf runs no bus carries a bus user list: %q %v", in.BusUsers, in.BusMissing)
+	}
+	bus := catalogue.Manifest{Module: "nats", Version: "1", BusUsers: "/etc/nats/users.conf",
+		Claims: []catalogue.Claim{{Name: "mesh-broker", Scope: catalogue.ScopeMesh}}}
+	register(t, open, bus)
+	if err := open.inventory.SeedBusUser(ctx, inventory.BusUser{Username: "controller", Kind: "controller"}, "pw"); err != nil {
+		t.Fatal(err)
+	}
+	in, err = readComposeInput(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	list, missing, _ := busUserList(ctx, open.inventory, []catalogue.Manifest{bus})
+	if in.BusUsers != list || fmt.Sprint(in.BusMissing) != fmt.Sprint(missing) {
+		t.Errorf("the Input carries %q (%v); busUserList gives %q (%v)", in.BusUsers, in.BusMissing, list, missing)
+	}
+}
+
+// 1383/AC5: Built, CurrentBuilds and BuildIDs equal the inventory's Held, CurrentBuilds and BuildOf, and the serving key and
+// the certificate are the machine's.
+func TestTheAdaptersInputCarriesTheBuildsAndTheMachinesKey(t *testing.T) {
+	open, _ := aMeshWithSecrets(t)
+	ctx := t.Context()
+	inv := open.inventory
+	in, err := readComposeInput(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	held, err := inv.Held(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var wantBuilt []string
+	for repository := range held {
+		wantBuilt = append(wantBuilt, repository)
+	}
+	sort.Strings(wantBuilt)
+	if fmt.Sprint(in.Built) != fmt.Sprint(wantBuilt) && !(len(in.Built) == 0 && len(wantBuilt) == 0) {
+		t.Errorf("Built is %v, the inventory's %v", in.Built, wantBuilt)
+	}
+	current, err := inv.CurrentBuilds(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for module, b := range current {
+		if in.CurrentBuilds[module] != b.Commit {
+			t.Errorf("CurrentBuilds[%s] is %q, the inventory's %q", module, in.CurrentBuilds[module], b.Commit)
+		}
+	}
+	for module, byCommit := range in.BuildIDs {
+		for commit, build := range byCommit {
+			if want, _ := inv.BuildOf(ctx, module, commit); want != build {
+				t.Errorf("BuildIDs[%s][%s] is %q, the inventory's %q", module, commit, build, want)
+			}
+		}
+	}
+}
+
+// The lead's answer 4: where the mesh holds no credential for any bus user, the machine that runs the bus is refused with
+// busUserList's words (the controller's composition refused it), the Input still builds, and another machine composes.
+func TestTheBusMachineIsRefusedWhereNoUserHasACredentialAndTheOthersCompose(t *testing.T) {
+	open, _ := aMeshWithSecrets(t)
+	ctx := t.Context()
+	bus := catalogue.Manifest{Module: "nats", Version: "1", BusUsers: "/etc/nats/users.conf",
+		Claims: []catalogue.Claim{{Name: "mesh-broker", Scope: catalogue.ScopeMesh}}}
+	register(t, open, bus)
+	register(t, open, aWebModule())
+	if _, err := assign(ctx, open, "anchor", "nats"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := assign(ctx, open, "laptop", "web"); err != nil {
+		t.Fatal(err)
+	}
+	if _, _, err := composeQuestion(ctx, open, "anchor", compose.Foreseeing, false); err == nil ||
+		!strings.Contains(err.Error(), "not one user has a credential") {
+		t.Fatalf("the bus machine is composed: %v", err)
+	}
+	if _, _, err := composeQuestion(ctx, open, "laptop", compose.Foreseeing, false); err != nil {
+		t.Fatalf("a machine that does not run the bus is refused: %v", err)
+	}
+}

cmd/mesh-controller/compose_input_integration_test.go

@@ -0,0 +1,264 @@
+//go:build integration
+
+package main
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/compose"
+)
+
+// 1382: the adapter's Input names, for every node, what the inventory answers for it, each compared with the read named
+// beside the field in go/compose/input.go (novox/hq ADR 0453 clause 3).
+func TestTheAdaptersInputNamesWhatTheInventoryAnswersForEachNode(t *testing.T) {
+	open, _ := aMeshWithSecrets(t)
+	ctx := t.Context()
+	inv := open.inventory
+	if err := inv.SetPublicDomain(ctx, "anchor", "example.test"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := inv.PortFor(ctx, "laptop", "files", 8080, false); err != nil {
+		t.Fatal(err)
+	}
+	in, err := readComposeInput(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	shelf, err := inv.Catalogue(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(in.Catalogue, shelf) {
+		t.Error("the Input's Catalogue is not the shelf the inventory holds")
+	}
+	nodes, err := inv.Nodes(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(in.Nodes) != len(nodes) {
+		t.Fatalf("the Input names %d node(s), the inventory has %d", len(in.Nodes), len(nodes))
+	}
+	places, err := inv.Overlays(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, record := range nodes {
+		n, ok := nodeOf(in.Input, record.Name)
+		if !ok {
+			t.Fatalf("%s is not in the Input", record.Name)
+		}
+		for _, p := range places {
+			if p.Name == record.Name {
+				if want := (compose.Place{Key: p.Key, Endpoint: p.Endpoint, Site: p.Site, Hub: p.Hub, Address: p.Address}); n.Place != want {
+					t.Errorf("%s: Place is %+v, the inventory's %+v", record.Name, n.Place, want)
+				}
+			}
+		}
+		assigned, _ := inv.Assigned(ctx, record.Name)
+		if !reflect.DeepEqual(n.Assigned, assigned) {
+			t.Errorf("%s: Assigned is %v, the inventory's %v", record.Name, n.Assigned, assigned)
+		}
+		caps, _ := inv.ProfileOf(ctx, record.Name)
+		if !reflect.DeepEqual(n.Capabilities, caps) {
+			t.Errorf("%s: Capabilities are %v, the inventory's %v", record.Name, n.Capabilities, caps)
+		}
+		domain, _ := inv.PublicDomainOf(ctx, record.Name)
+		if n.PublicDomain != domain {
+			t.Errorf("%s: PublicDomain is %q, the inventory's %q", record.Name, n.PublicDomain, domain)
+		}
+		if n.Account != record.Account || n.AccountHome != record.AccountHome || n.AgentAccount != record.AgentAccount ||
+			n.AgentAccountHome != record.AgentAccountHome || n.Adopted != record.Adopted {
+			t.Errorf("%s: the accounts or the mode differ from the inventory's: %+v", record.Name, n)
+		}
+		pins, _ := inv.PinsFor(ctx, record.Name)
+		if len(pins) != len(n.Pins) || (len(pins) > 0 && !reflect.DeepEqual(n.Pins, pins)) {
+			t.Errorf("%s: Pins are %v, the inventory's %v", record.Name, n.Pins, pins)
+		}
+		bound, _ := inv.BindingsFor(ctx, record.Name)
+		if len(bound) != len(n.Bound) || (len(bound) > 0 && !reflect.DeepEqual(n.Bound, bound)) {
+			t.Errorf("%s: Bound is %v, the inventory's %v", record.Name, n.Bound, bound)
+		}
+		key, _ := inv.SealingKeyOf(ctx, record.Name)
+		if n.SealingKey != key {
+			t.Errorf("%s: SealingKey is %q, the inventory's %q", record.Name, n.SealingKey, key)
+		}
+		ports, _ := inv.PortsFor(ctx, record.Name)
+		want := map[string]map[int]int{}
+		for _, a := range ports {
+			if want[a.Module] == nil {
+				want[a.Module] = map[int]int{}
+			}
+			want[a.Module][a.Wanted] = a.Machine
+		}
+		if len(want) != len(n.Ports) || (len(want) > 0 && !reflect.DeepEqual(n.Ports, want)) {
+			t.Errorf("%s: Ports are %v, the inventory's %v", record.Name, n.Ports, want)
+		}
+		// The settings of every module it resolves to, layer for layer.
+		resolved, err := compose.Resolve(in.Input, record.Name)
+		if err != nil {
+			continue
+		}
+		for _, m := range resolved.Plan.Modules {
+			layers, err := inv.SettingsFor(ctx, record.Name, m.Module)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if len(layers) != len(n.Settings[m.Module]) || (len(layers) > 0 && !reflect.DeepEqual(n.Settings[m.Module], layers)) {
+				t.Errorf("%s: the settings of %s are %v, the inventory's %v", record.Name, m.Module, n.Settings[m.Module], layers)
+			}
+		}
+	}
+	if domain := nodeDomain(in.Input, "anchor"); domain != "example.test" {
+		t.Errorf("anchor's PublicDomain is %q", domain)
+	}
+	if got := nodePorts(in.Input, "laptop"); got["files"][8080] == 0 {
+		t.Errorf("laptop's port for files:8080 is not in the Input: %v", got)
+	}
+}
+
+func nodeDomain(in compose.Input, name string) string {
+	n, _ := nodeOf(in, name)
+	return n.PublicDomain
+}
+
+func nodePorts(in compose.Input, name string) map[string]map[int]int {
+	n, _ := nodeOf(in, name)
+	return n.Ports
+}
+
+// 1382/AC3: the seats on record, the tunnels, the adopted tunnel, its carried peers and the nodes joining equal the
+// inventory's answers; the range and the suffix are read from the environment once, here.
+func TestTheAdaptersInputCarriesTheNetworkAsTheInventoryHoldsIt(t *testing.T) {
+	open, _ := aMeshWithSecrets(t)
+	ctx := t.Context()
+	inv := open.inventory
+	t.Setenv(OverlayCIDRVar, "10.99.0.0/16")
+	t.Setenv("MESH_INTERNAL_SUFFIX", "mesh.test")
+	in, err := readComposeInput(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	holdings, err := inv.Holdings(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(in.Holdings, holdings) {
+		t.Errorf("Holdings are %v, the inventory's %v", in.Holdings, holdings)
+	}
+	tunnels, err := inv.Tunnels(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(tunnels) != len(in.Tunnels) {
+		t.Errorf("Tunnels are %v, the inventory's %v", in.Tunnels, tunnels)
+	}
+	if _, hub, _, err := inv.AdoptedTunnel(ctx); err != nil {
+		t.Fatal(err)
+	} else if (hub == "") != (in.Adopted == nil) {
+		t.Errorf("Adopted is %v, the inventory's hub is %q", in.Adopted, hub)
+	}
+	carried, err := inv.CarriedPeers(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(carried) != len(in.CarriedPeers) {
+		t.Errorf("CarriedPeers are %v, the inventory's %v", in.CarriedPeers, carried)
+	}
+	joining, err := inv.NodesWithALiveToken(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(joining) != len(in.Joining) {
+		t.Errorf("Joining is %v, the inventory's %v", in.Joining, joining)
+	}
+	if in.OverlayCIDR != "10.99.0.0/16" || in.InternalSuffix != "mesh.test" {
+		t.Errorf("the range and the suffix are %q and %q", in.OverlayCIDR, in.InternalSuffix)
+	}
+	// Read once: what the environment says afterwards moves nothing already read.
+	t.Setenv(OverlayCIDRVar, "10.1.0.0/16")
+	if in.OverlayCIDR != "10.99.0.0/16" {
+		t.Error("the range moved with the environment")
+	}
+}
+
+// The lead's equality finding (build 1792487777757012513): a provider on one machine serves a fact that says ${setting:domain},
+// the setting is set for it, and a consumer on another machine takes that fact. The first pass of the adapter resolved every
+// node with no settings in the Input, so the served fact could not be settled and the whole Input failed. The settings are in
+// the Input before any node is resolved, and the Input builds, with the same plan for the consumer as the controller's own
+// composition. It failed first, with the finding's words.
+func TestAServedFactThatSaysASettingIsResolvedWithTheSettingInTheInput(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	register(t, open, catalogue.Manifest{Module: "step-ca", Version: "1",
+		Provides: []catalogue.Offer{{Name: "acme-ca", Scope: catalogue.ScopeMesh}},
+		Serves:   map[string]map[string]any{"acme-ca": {"domain": "${setting:domain}"}}})
+	register(t, open, catalogue.Manifest{Module: "route-proxy", Version: "1", Requires: []string{"acme-ca"}})
+	// The setting is there before the machines are assigned: an assignment resolves the mesh, and a served fact that says
+	// ${setting:domain} resolves only with it.
+	if err := open.inventory.KeepSettings(ctx, "", "step-ca", map[string]any{"domain": "example.test"}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := assign(ctx, open, "anchor", "step-ca"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := assign(ctx, open, "laptop", "route-proxy"); err != nil {
+		t.Fatal(err)
+	}
+	in, err := readComposeInput(ctx, open)
+	if err != nil {
+		t.Fatalf("the Input cannot be built: %v", err)
+	}
+	if anchor, _ := nodeOf(in.Input, "anchor"); len(anchor.Settings["step-ca"]) == 0 {
+		t.Fatalf("the Input does not carry the setting of the provider: %v", anchor.Settings)
+	}
+	oldPlan, _, err := resolveNode(ctx, open, "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	newPlan, _, err := resolveNode(withInputCache(ctx), open, "laptop")
+	if err != nil {
+		t.Fatalf("the consumer does not resolve: %v", err)
+	}
+	if !reflect.DeepEqual(oldPlan.Needs, newPlan.Needs) {
+		t.Errorf("the consumer's needs are %+v, the controller's own %+v", newPlan.Needs, oldPlan.Needs)
+	}
+	t.Logf("a served fact that says a setting resolves with the setting in the Input: the Input builds and the consumer's needs equal planFor's")
+}
+
+// A setting that nothing sets, in a fact a provider serves, is not the adapter's to hide: the controller's own composition
+// refuses it as well (theRestOfTheMesh returns servedOnNode's error), and the adapter refuses with the same words rather than
+// building an Input that composes a placeholder.
+func TestAServedFactThatSaysAnUnsetSettingIsRefusedAsTheControllerRefusesIt(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	register(t, open, catalogue.Manifest{Module: "step-ca", Version: "1",
+		Provides: []catalogue.Offer{{Name: "acme-ca", Scope: catalogue.ScopeMesh}},
+		Serves:   map[string]map[string]any{"acme-ca": {"domain": "${setting:domain}"}}})
+	register(t, open, catalogue.Manifest{Module: "route-proxy", Version: "1", Requires: []string{"acme-ca"}})
+	// Assigned with the setting there, then the setting is cleared: the mesh the controller holds when someone clears it.
+	if err := open.inventory.KeepSettings(ctx, "", "step-ca", map[string]any{"domain": "example.test"}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := assign(ctx, open, "anchor", "step-ca"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := assign(ctx, open, "laptop", "route-proxy"); err != nil {
+		t.Fatal(err)
+	}
+	if err := open.inventory.ClearSettings(ctx, "", "step-ca"); err != nil {
+		t.Fatal(err)
+	}
+	_, _, oldErr := resolveNode(ctx, open, "laptop")
+	_, newErr := readComposeInput(ctx, open)
+	if (oldErr == nil) != (newErr == nil) {
+		t.Fatalf("the controller's composition says %v, the adapter says %v", oldErr, newErr)
+	}
+	if oldErr != nil && !strings.Contains(newErr.Error(), "nothing sets \"domain\"") {
+		t.Errorf("the adapter's words are %q, the controller's %q", newErr, oldErr)
+	}
+	t.Logf("an unset setting in a served fact is refused alike: the controller says %v, the adapter says %v", oldErr != nil, newErr != nil)
+}

cmd/mesh-controller/compose_input_settings_integration_test.go

@@ -0,0 +1,45 @@
+//go:build integration
+
+package main
+
+import (
+	"context"
+	"testing"
+)
+
+// Issue 1493: a module in the config form whose value is set only in mesh-config, with no settings row, reaches the
+// node's settings in the composition's input.
+func TestAConfigModuleWithoutASettingsRowIsReadFromConfig(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	register(t, open, configForm(t, "brother"))
+	if _, err := assign(ctx, open, "anchor", "brother"); err != nil {
+		t.Fatal(err)
+	}
+	inv.ExecForTest(t, `insert into config_move (moved_by, why) values ('a test', 'issue 1493')`)
+	inv.ReadsConfigFrom(func(_ context.Context, node, module string) (map[string]any, error) {
+		if node == "anchor" && module == "brother" {
+			return map[string]any{"level": "debug"}, nil
+		}
+		return nil, nil
+	})
+	in, _, err := readMeshAndNodes(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := readSettings(ctx, open, &in); err != nil {
+		t.Fatal(err)
+	}
+	for _, n := range in.Nodes {
+		if n.Name != "anchor" {
+			continue
+		}
+		layers := n.Settings["brother"]
+		if len(layers) != 1 || layers[0].Values["level"] != "debug" {
+			t.Fatalf("anchor's settings for brother are %+v, want level debug from mesh-config", layers)
+		}
+		return
+	}
+	t.Fatal("no anchor node in the input")
+}

cmd/mesh-controller/compose_input_settings_test.go

@@ -0,0 +1,45 @@
+package main
+
+import (
+	"errors"
+	"reflect"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// configForm is a module in the config form, shaped as a real one (inventory's config_move_test).
+func configForm(t *testing.T, name string) catalogue.Manifest {
+	t.Helper()
+	m, err := catalogue.ParseManifest([]byte(`{"module": "` + name + `", "version": "1",
+		"config": {"level": {"type": "string", "description": "how much it says", "default": "info"}},
+		"resources": [{"id": "conf", "type": "file", "path": "/etc/` + name + `.json", "mode": "0640",
+			"content": "{\"level\": \"info\"}", "merge": "json", "takes-config": ["level"]}]}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	return m
+}
+
+// Issue 1493: a module in the config form whose values are set only in mesh-config has no settings row, and its
+// settings are still read, because SettingsFor is where mesh-config's values are laid in.
+func TestSettingsAreReadForAConfigModuleWithoutASettingsRow(t *testing.T) {
+	shelf := map[string]catalogue.Manifest{
+		"brother": configForm(t, "brother"),        // config only in mesh-config: no settings row
+		"older":   {Module: "older", Version: "1"}, // settings form, with a row
+		"idle":    {Module: "idle", Version: "1"},  // settings form, no row: nothing to read
+		"newer":   configForm(t, "newer"),          // config form, but the switch is off for it
+	}
+	have := map[string]bool{"older": true, "gone": true} // "gone" has a row and is not on the shelf
+	reads := func(module string) (bool, error) { return module == "brother", nil }
+	got, err := modulesToRead(shelf, have, reads)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if want := []string{"brother", "older"}; !reflect.DeepEqual(got, want) {
+		t.Errorf("settings are read for %v, want %v", got, want)
+	}
+	if _, err := modulesToRead(shelf, have, func(string) (bool, error) { return false, errors.New("store down") }); err == nil {
+		t.Error("a failing ReadsConfig is not returned")
+	}
+}

cmd/mesh-controller/compose_made_integration_test.go

@@ -0,0 +1,54 @@
+//go:build integration
+
+package main
+
+import (
+	"context"
+	"fmt"
+	"sort"
+)
+
+// made is what a send made in a store, by key and never by value: the machine ports given, the pair credentials and the
+// own secrets.
+type made struct {
+	Ports      []string
+	Pairs      []string
+	OwnSecrets []string
+}
+
+// madeIn is what a store holds that a send makes, by key and never by value.
+func madeIn(ctx context.Context, open *stores) (made, error) {
+	var out made
+	inv := open.inventory
+	nodes, err := inv.Nodes(ctx)
+	if err != nil {
+		return out, err
+	}
+	for _, n := range nodes {
+		ports, err := inv.PortsFor(ctx, n.Name)
+		if err != nil {
+			return out, err
+		}
+		for _, p := range ports {
+			out.Ports = append(out.Ports, fmt.Sprintf("%s %s:%d->%d", n.Name, p.Module, p.Wanted, p.Machine))
+		}
+		rows, err := inv.SecretsFrom(ctx, n.Name)
+		if err != nil {
+			return out, err
+		}
+		for _, s := range rows {
+			out.Pairs = append(out.Pairs, fmt.Sprintf("%s %s on %s from %s local=%s", s.Name, s.ConsumerModule, s.Consumer, n.Name, s.Local))
+		}
+	}
+	own, err := inv.OwnSecretRows(ctx)
+	if err != nil {
+		return out, err
+	}
+	for _, r := range own {
+		out.OwnSecrets = append(out.OwnSecrets, fmt.Sprintf("%s %s/%s (%s)", r.Node, r.Module, r.Name, r.Origin))
+	}
+	sort.Strings(out.Ports)
+	sort.Strings(out.Pairs)
+	sort.Strings(out.OwnSecrets)
+	return out, nil
+}

cmd/mesh-controller/compose_once_integration_test.go

@@ -0,0 +1,44 @@
+//go:build integration
+
+package main
+
+import (
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/compose"
+)
+
+// 1382/AC5: composing every node of one operation builds the Input once; without an operation's cache, once for each.
+func TestComposingEveryNodeOfAnOperationBuildsTheInputOnce(t *testing.T) {
+	open, _ := aMeshWithSecrets(t)
+	built := 0
+	was := composeInputBuilt
+	composeInputBuilt = func() { built++ }
+	t.Cleanup(func() { composeInputBuilt = was })
+	ctx := withInputCache(t.Context())
+	nodes, err := open.inventory.Nodes(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, n := range nodes {
+		if _, _, err := resolveNode(ctx, open, n.Name); err != nil && !unresolvable(err) {
+			t.Fatal(err)
+		}
+		if _, _, err := composeQuestion(ctx, open, n.Name, compose.Reading, false); err != nil && !unresolvable(err) {
+			t.Fatal(err)
+		}
+	}
+	if _, err := generatorsOf(ctx, open); err != nil {
+		t.Fatal(err)
+	}
+	if built != 1 {
+		t.Fatalf("an operation over %d node(s) built the Input %d time(s)", len(nodes), built)
+	}
+	built = 0
+	if _, _, err := resolveNode(t.Context(), open, nodes[0].Name); err != nil && !unresolvable(err) {
+		t.Fatal(err)
+	}
+	if built != 1 {
+		t.Fatalf("a composition with no cache built the Input %d time(s)", built)
+	}
+}

cmd/mesh-controller/compose_perform.go

@@ -0,0 +1,265 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"slices"
+	"sort"
+	"strconv"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/compose"
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// perform makes what a composition named foreseen (novox/hq ADR 0453 clause 3, design 47 R4b, issue 1385).
+//
+// **The composition makes nothing; a send does.** mesh-sdk's composition over an Input names what the next send would make
+// (the ports it would assign, the credentials it would seal, the core boxes it would ask the vault for, the seats it would
+// pass on, the certificate it would issue) and stands in for each. A send composes, performs, reads the stores again and
+// composes again (send in compose_sdk.go), and refuses to send a declaration that still names anything foreseen. A question
+// (status, facts, probes, the merge gate's reading) never reaches this file.
+//
+// What is made is exactly what the controller's own composition made on the way to a declaration it was going to send:
+//   - every pair credential no row holds, for every machine that resolves, since planning one node resolved them all;
+//   - the seats the mesh passes on, with the hand act (not on a throwaway mesh, whose hand act has nowhere to go);
+//   - the machine ports the node's modules were given none for;
+//   - the node's own secrets, by the controller's own rules (a bus credential nobody issued was refused by the composition);
+//   - the core credentials, asked of the vault every send, so a rotated one reaches the machine;
+//   - the certificate of a machine that was never certified.
+//
+// perform returns whether it made or recorded anything: the reason the caller reads the stores again.
+func perform(ctx context.Context, open *stores, in *meshInput, node string, d compose.Declared) (bool, error) {
+	did := false
+	inv := open.inventory
+
+	// The seats passed on: recorded in the store with the controller's own hand act (ADR 0449 §4, issue 1317).
+	if len(d.Passes.Passes) > 0 {
+		var w io.Writer = os.Stderr
+		if lw, ok := ctx.Value(leftOutKey{}).(io.Writer); ok {
+			w = lw
+		}
+		for _, line := range d.Passes.Said {
+			fmt.Fprintln(w, line)
+		}
+		if performSeatPasses(ctx, seatPassingOn(inv, w), d.Passes.Passes) {
+			did = true
+		}
+	}
+
+	// Every pair credential the stores hold none for: made once and kept, and sealed to both ends before it was ever written
+	// down. The error is the one planFor met: the machine that needs it, and why none could be made.
+	for _, p := range in.wouldMake {
+		if err := makePair(ctx, inv, p); err != nil {
+			return did, fmt.Errorf("%s on %s needs %s from %s and no credential could be made for it: %w",
+				p.ConsumerModule, p.Consumer, p.Name, p.Provider, err)
+		}
+		did = true
+	}
+
+	// The ports this node's modules were given none for.
+	if len(d.ForeseenPorts) > 0 {
+		shelf, err := inv.Catalogue(ctx)
+		if err != nil {
+			return did, err
+		}
+		for _, one := range d.ForeseenPorts {
+			module, port, ok := strings.Cut(one, ":")
+			wanted, perr := strconv.Atoi(port)
+			if !ok || perr != nil {
+				return did, fmt.Errorf("the composition named a port the controller cannot read: %q", one)
+			}
+			fixed := false
+			for _, l := range nodeShelf(in, shelf, node)[module].Listens {
+				if l.Port == wanted {
+					fixed = l.Fixed
+				}
+			}
+			if _, err := inv.PortFor(ctx, node, module, wanted, fixed); err != nil {
+				return did, fmt.Errorf("%s needs %d reachable on %s and it could not be assigned: %w", module, wanted, node, err)
+			}
+			did = true
+		}
+	}
+
+	// The node's own secrets: a module's superuser password, an administrator, an account. The composition refused what the
+	// send refuses (a bus credential nobody issued, a given value under an old key).
+	for _, one := range d.StoodIn {
+		module, name, ok := strings.Cut(one, "/")
+		if !ok || strings.Contains(one, " ") {
+			continue // a grant's sealed copy, the certificate or the bus's list: made below or by nobody
+		}
+		if _, err := inv.SecretForModule(ctx, node, module, name); err != nil {
+			return did, err
+		}
+		did = true
+	}
+
+	// The certificate of a machine that was never certified: issued and kept, with the authority when there is none yet.
+	for _, one := range d.StoodIn {
+		if strings.HasPrefix(one, "the certificate and the authority of ") {
+			if _, _, err := certificateFor(ctx, open, node); err != nil {
+				return did, err
+			}
+			did = true
+			break
+		}
+	}
+	return did, nil
+}
+
+// makePair makes one pair credential by the controller's own read of it: the credential for the pair, or the provider's one
+// credential sealed to this consumer too. A credential only a person gives is never made (it is not a would-make).
+func makePair(ctx context.Context, inv *inventory.Inventory, p inventory.PairCredential) error {
+	var err error
+	switch p.Kind {
+	case inventory.PairShared:
+		_, err = inv.SharedSecretFor(ctx, p.Name, p.Consumer, p.ConsumerModule, p.Provider, p.ProviderModule, p.Local, p.Own)
+	case inventory.PairPlain:
+		_, err = inv.SecretFor(ctx, p.Name, p.Consumer, p.ConsumerModule, p.Provider, p.Local)
+	default:
+		return errors.New("a credential only a person gives is not made")
+	}
+	if inventory.IsNotGiven(err) {
+		return nil
+	}
+	return err
+}
+
+// stillForeseen says what a composed declaration still stands in for: the lists the composition names, and the stand-in itself
+// anywhere in the body (a pair credential's stand-in is not in any list). A declaration that has any is never sent.
+func stillForeseen(d compose.Declared) []string {
+	var left []string
+	left = append(left, d.Foreseen...)
+	left = append(left, d.StoodIn...)
+	for _, p := range d.ForeseenPorts {
+		left = append(left, "the port "+p)
+	}
+	for _, c := range d.CoreBoxesWanted {
+		left = append(left, "the vault's box for "+c.Module+"/"+c.Name)
+	}
+	for _, p := range d.Passes.Passes {
+		left = append(left, "the pass of "+p.Seat.Name+" to "+p.To.Module+" on "+p.To.Node)
+	}
+	if body, err := d.Body(); err == nil {
+		for _, marker := range []string{catalogue.ForeseenSealed, "asked of the vault by the next send", compose.ForeseenCertificate,
+			compose.ForeseenBusUsers} {
+			if strings.Contains(string(body), marker) {
+				left = append(left, "a stand-in: "+marker)
+			}
+		}
+	}
+	sort.Strings(left)
+	return slicesCompact(left)
+}
+
+func slicesCompact(in []string) []string {
+	var out []string
+	for _, s := range in {
+		if len(out) == 0 || out[len(out)-1] != s {
+			out = append(out, s)
+		}
+	}
+	return out
+}
+
+// nodeShelf is the shelf as one node composes its own set: the current one with each module it keeps at the build it runs put
+// in place of the current.
+func nodeShelf(in *meshInput, shelf map[string]catalogue.Manifest, node string) map[string]catalogue.Manifest {
+	n, _ := nodeOf(in.Input, node)
+	return shelfWith(shelf, n.Kept)
+}
+
+// prepareSend is what a send does before it composes, every send and whatever the composition would have named: the
+// controller's own composition did it on the way, so a module's file that names an own secret composes (mesh-sdk's
+// composition can stand in for none: a file naming a secret not made yet is refused in every mode), and the core's credentials
+// are asked of the vault on every send, so a rotated one reaches the machine and a silent vault is said (core_box.go).
+//
+//   - Each own secret of a module the node runs (not one handed to the provisioner, not one issued outside the mesh, not one a
+//     person gives) that no row holds is made, unless the composition would refuse it (a bus credential nobody issued): that
+//     refusal is the composition's to say, in its words.
+//   - The core's credentials are asked of the vault, the boxes newly answered are kept, and the modules the vault did not answer
+//     for with no box kept are returned: the controller seals those itself until the vault holds them (ADR 0396).
+func prepareSend(ctx context.Context, open *stores, node string) ([]string, error) {
+	in, err := inputFor(ctx, open)
+	if err != nil {
+		return nil, err
+	}
+	if in.refused[node] != nil {
+		return nil, nil // empty-on-error: refused alone for what it keeps; the composition that follows says so, in its words
+	}
+	resolved, err := compose.Resolve(in.Input, node)
+	if err != nil {
+		return nil, nil // empty-on-error: it does not compose for its own reasons; the composition that follows says them
+	}
+	n, _ := nodeOf(in.Input, node)
+	hands := n.Stated && n.Contract >= compose.HandedContract
+	handing := catalogue.Rendering{Hands: hands, Provisioner: provisionerAccount(resolved.Plan)}
+	inv := open.inventory
+	did := false
+	if n.SealingKey != "" {
+		held := map[string]bool{}
+		for _, r := range in.OwnSecrets {
+			// Held only when sealed to the key the machine has now, or given by a person (which is not the mesh's
+			// to make again): a made row under an old key is re-made, as SecretForModule did.
+			if r.Node == node && (r.SealedTo == n.SealingKey || r.Origin == inventory.OriginAccepted) {
+				held[r.Module+"/"+r.Name] = true
+			}
+		}
+		for _, m := range resolved.Plan.Modules {
+			if handing.Handing(m) {
+				continue
+			}
+			plain := m.OwnSecrets.Plain()
+			names := make([]string, 0, len(plain))
+			for name := range plain {
+				names = append(names, name)
+			}
+			sort.Strings(names)
+			for _, name := range names {
+				if plain[name].IssuedBy == catalogue.IssuedOutside || held[m.Module+"/"+name] {
+					continue
+				}
+				switch name {
+				case "broker":
+					if !slices.Contains(in.BusMinted, node+"."+m.Module) {
+						continue
+					}
+				case compose.ProvisionerSecret:
+					if !slices.Contains(in.BusMinted, "provisioner."+node) {
+						continue
+					}
+				default:
+					// A bus process's account nobody issued still gets the stand-in, until the composition leaves
+					// the module off (issue 1753): the warning names the verb (issue 1226).
+					if line := processAccountWarning(m, node, name, in.BusMinted); line != "" {
+						sayWarning(ctx, line)
+					}
+				}
+				if _, err := inv.SecretForModule(ctx, node, m.Module, name); err == nil {
+					did = true
+				}
+			}
+		}
+	}
+	var byController []string
+	if n.Stated && n.Contract >= compose.VaultBoxContract {
+		boxes, err := coreBoxesFor(ctx, inv, node, resolved.Plan.Modules, func(m catalogue.Manifest) bool {
+			return handing.Handing(m)
+		}, true)
+		if err != nil {
+			return nil, err
+		}
+		did = did || len(boxes.keep) > 0
+		byController = boxes.byController
+	}
+	if did {
+		// What was made is in the stores now: the composition reads them afresh.
+		forgetInput(ctx)
+	}
+	return byController, nil
+}

cmd/mesh-controller/compose_perform_integration_test.go

@@ -0,0 +1,235 @@
+//go:build integration
+
+package main
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/compose"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+func aWebModule() catalogue.Manifest {
+	return catalogue.Manifest{Module: "web", Version: "1",
+		Listens:    []catalogue.Listening{{Port: 8080, From: catalogue.FromEverywhere}},
+		OwnSecrets: catalogue.OwnSecrets{"admin": {Path: "/etc/web/admin"}},
+		Resources: []map[string]any{
+			{"id": "server", "type": "container", "name": "web", "ports": []any{"8080"},
+				"image": "registry.example/web@sha256:" + strings.Repeat("a", 64)},
+		}}
+}
+
+// 1385/AC1: a port the composition names foreseen is allocated with the inventory's PortFor for that module and port, a second
+// composition names it no more, and the number is the one the controller's own Allocating composition gives in the same store.
+func TestPerformAllocatesAForeseenPortAndTheNumberIsTheControllers(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	register(t, open, aWebModule())
+	if _, err := assign(ctx, open, "laptop", "web"); err != nil {
+		t.Fatal(err)
+	}
+	in, err := readComposeInput(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	d, _, err := compose.ComposeIn(in.Input, "laptop", compose.Foreseeing)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(d.ForeseenPorts) != 1 || d.ForeseenPorts[0] != "web:8080" {
+		t.Fatalf("the composition names the ports %v foreseen, want web:8080", d.ForeseenPorts)
+	}
+	did, err := perform(ctx, open, in, "laptop", d)
+	if err != nil || !did {
+		t.Fatalf("perform did %v: %v", did, err)
+	}
+	held, err := open.inventory.PortsFor(ctx, "laptop")
+	if err != nil || len(held) != 1 || held[0].Module != "web" || held[0].Wanted != 8080 {
+		t.Fatalf("the port perform allocated reads %+v: %v", held, err)
+	}
+	in, err = readComposeInput(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if again, _, err := compose.ComposeIn(in.Input, "laptop", compose.Foreseeing); err != nil || len(again.ForeseenPorts) != 0 {
+		t.Fatalf("a second composition names %v foreseen: %v", again.ForeseenPorts, err)
+	}
+	// The number is the one the controller allocates in the same store.
+	plan, settings, err := resolveNode(ctx, open, "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	old, err := declarationFor(ctx, open, "laptop", plan, settings)
+	if err != nil {
+		t.Fatal(err)
+	}
+	after, _, err := compose.ComposeIn(in.Input, "laptop", compose.Foreseeing)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got, want := portsOf(after.Resources), portsOf(old.Resources); got != want {
+		t.Fatalf("the declaration publishes %s; the controller's allocation publishes %s", got, want)
+	}
+}
+
+func portsOf(resources []map[string]any) string {
+	var out []string
+	for _, r := range resources {
+		if r["type"] == "container" {
+			out = append(out, fmt.Sprint(r["name"], r["ports"]))
+		}
+	}
+	return strings.Join(out, ";")
+}
+
+// 1385/AC2: an own secret named foreseen is made with SecretForModule, and a pair credential the Input names would-make is
+// made as planFor chose; both exist after the send's composition and a second composition names neither.
+func TestPerformMakesTheOwnSecretsAndThePairCredentialsTheCompositionNamed(t *testing.T) {
+	open, _ := aMeshWithSecrets(t)
+	ctx := t.Context()
+	inv := open.inventory
+	register(t, open, aWebModule())
+	register(t, open, aConsumerOfTheBucket("reports"))
+	for _, m := range []string{"web", "reports"} {
+		if _, err := assign(ctx, open, "laptop", m); err != nil {
+			t.Fatal(err)
+		}
+	}
+	before, err := madeIn(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	declared, err := composeSend(ctx, open, "laptop")
+	if err != nil {
+		t.Fatalf("the send is refused: %v", err)
+	}
+	if len(declared.foreseen) != 0 {
+		t.Fatalf("the declaration still names %v foreseen", declared.foreseen)
+	}
+	after, err := madeIn(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	madeNow := func(have, was []string) []string {
+		seen := map[string]bool{}
+		for _, s := range was {
+			seen[s] = true
+		}
+		var out []string
+		for _, s := range have {
+			if !seen[s] {
+				out = append(out, s)
+			}
+		}
+		return out
+	}
+	if got := madeNow(after.OwnSecrets, before.OwnSecrets); len(got) != 1 || !strings.Contains(got[0], "web/admin") {
+		t.Errorf("the own secrets made are %v, want laptop web/admin", got)
+	}
+	if got := madeNow(after.Pairs, before.Pairs); len(got) != 1 || !strings.Contains(got[0], "reports") {
+		t.Errorf("the pair credentials made are %v, want the one of reports", got)
+	}
+	// And the credential is the one a second composition reads as held.
+	in, err := readComposeInput(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(in.wouldMake) != 0 {
+		t.Errorf("after the send the next send would still make %v", in.wouldMake)
+	}
+	if _, err := inv.SecretsFrom(ctx, "anchor"); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// 1385/AC3 (the lead's answer 1): with the vault unreachable and no box of the credential kept, the send carries the
+// controller's own seal for it (ADR 0396), says so as a condition, and keeps no box.
+func TestAVaultThatIsSilentSealsTheSendByTheControllerWhereNoBoxIsKept(t *testing.T) {
+	open, vault := aCoreMesh(t, link.VaultBoxContract)
+	vault.silent = errors.New("no responders")
+	declared, err := composeSend(t.Context(), open, "laptop")
+	if err != nil {
+		t.Fatalf("the send is refused: %v", err)
+	}
+	f := clientsBroker(declared.Resources)
+	if f == nil || f["sealed"] == nil || f[catalogue.VaultSealedField] != nil {
+		t.Fatalf("the core credential is composed as %v: the controller's own seal, until the vault holds it", f)
+	}
+	if len(declared.foreseen) != 0 {
+		t.Fatalf("the declaration still names %v foreseen", declared.foreseen)
+	}
+	if c, found := vaultSilence(t, "laptop"); !found || !strings.Contains(c.Summary, "sealed by the controller until the vault holds it") {
+		t.Fatalf("no condition says why: %+v", c)
+	}
+	kept, err := open.inventory.KeptCoreBoxes(t.Context(), "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(kept["mesh-provisioner-client"]) != 0 {
+		t.Fatalf("a box was kept for a credential the vault never boxed: %v", kept)
+	}
+}
+
+// 1385/AC6: perform is idempotent: a second send's composition over the stores it left makes and records nothing.
+func TestAFinishedSendMakesNothingTheSecondTime(t *testing.T) {
+	open, _ := aMeshWithSecrets(t)
+	ctx := t.Context()
+	register(t, open, aWebModule())
+	if _, err := assign(ctx, open, "laptop", "web"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := composeSend(ctx, open, "laptop"); err != nil {
+		t.Fatal(err)
+	}
+	before := tableState(t, open.inventory)
+	if _, err := composeSend(ctx, open, "laptop"); err != nil {
+		t.Fatal(err)
+	}
+	for k, v := range tableState(t, open.inventory) {
+		if before[k] != v {
+			t.Errorf("a second send of the same machine moved %s", k)
+		}
+	}
+}
+
+// Review round 1, finding 1: a machine that rejoined with a new sealing key keeps its made rows sealed to the old key. A
+// send re-makes them for the new key, as SecretForModule did on main, and the file naming the secret is not refused.
+func TestASendReMakesAnOwnSecretSealedToAKeyTheMachineNoLongerHas(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	register(t, open, aBot("bot", false))
+	if _, err := assign(ctx, open, "laptop", "bot"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := composeSend(ctx, open, "laptop"); err != nil {
+		t.Fatalf("the first send is refused: %v", err)
+	}
+	if err := inv.RecordSealingKey(ctx, nodeID(t, open, "laptop"), aPublicKey(t)); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := composeSend(ctx, open, "laptop"); err != nil {
+		t.Fatalf("a machine that rejoined cannot be sent to: %v", err)
+	}
+	in, err := readComposeInput(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	n, _ := nodeOf(in.Input, "laptop")
+	found := false
+	for _, r := range in.OwnSecrets {
+		if r.Node == "laptop" && r.Module == "bot" && r.Name == "token" {
+			found = true
+			if r.SealedTo != n.SealingKey {
+				t.Fatalf("the own secret is still sealed to a key the machine no longer has")
+			}
+		}
+	}
+	if !found {
+		t.Fatal("the own secret has no row")
+	}
+}

cmd/mesh-controller/compose_sdk.go

@@ -0,0 +1,492 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"slices"
+	"sort"
+	"strings"
+	"sync"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/compose"
+	"git.novox.be/novox/mesh-sdk/go/validate"
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// The controller's composition on mesh-sdk's (novox/hq ADR 0453 clause 3, design 47 R4b, issues 1386 to 1388): every
+// caller that planned or composed a node reads the Input once for its operation (compose_input.go), asks the SDK to
+// compose over it, and, when it sends, performs what the composition names foreseen (compose_perform.go) and composes again.
+
+// inputCacheKey carries an operation's Input in its context, so the planning of every node of one verb reads the stores once.
+type inputCacheKey struct{}
+
+type inputCache struct {
+	mu sync.Mutex
+	by map[string]*meshInput
+}
+
+// withInputCache is ctx for an operation: the Input read for it is kept until a send changes what it read. A context that
+// carries none reads the stores for each composition, which is correct and slow.
+func withInputCache(ctx context.Context) context.Context {
+	if _, ok := ctx.Value(inputCacheKey{}).(*inputCache); ok {
+		return ctx
+	}
+	return context.WithValue(ctx, inputCacheKey{}, &inputCache{by: map[string]*meshInput{}})
+}
+
+// keptSignature is what the Input read depends on in ctx: which recorded modules each machine keeps at the build it runs
+// (recorded_kept.go), so an Input read for a person's push is never taken for one read for a gated send.
+func keptSignature(ctx context.Context) string {
+	return ""
+}
+
+// inputFor is the Input for ctx's operation.
+func inputFor(ctx context.Context, open *stores) (*meshInput, error) {
+	cache, ok := ctx.Value(inputCacheKey{}).(*inputCache)
+	if !ok {
+		return readComposeInput(ctx, open)
+	}
+	sig := keptSignature(ctx)
+	cache.mu.Lock()
+	defer cache.mu.Unlock()
+	if in := cache.by[sig]; in != nil {
+		return in, nil
+	}
+	in, err := readComposeInput(ctx, open)
+	if err != nil {
+		return nil, err
+	}
+	cache.by[sig] = in
+	return in, nil
+}
+
+// forgetInput drops what the operation read, because a send made or recorded something it read.
+func forgetInput(ctx context.Context) {
+	if cache, ok := ctx.Value(inputCacheKey{}).(*inputCache); ok {
+		cache.mu.Lock()
+		cache.by = map[string]*meshInput{}
+		cache.mu.Unlock()
+	}
+}
+
+// resolveNode works out everything a node should run, from what was assigned to it (planFor on the SDK): over the Input,
+// writing nothing. A failure to compose the node's own modules is marked notResolvable, as planFor marked it; every other
+// failure is returned as it is.
+func resolveNode(ctx context.Context, open *stores, node string) (catalogue.Resolution, catalogue.SettingsBy, error) {
+	in, err := inputFor(ctx, open)
+	if err != nil {
+		return catalogue.Resolution{}, nil, err
+	}
+	if err := in.refused[node]; err != nil {
+		return catalogue.Resolution{}, nil, err
+	}
+	resolved, err := compose.Resolve(in.Input, node)
+	if err != nil {
+		if compose.IsUnresolvable(err) {
+			return catalogue.Resolution{}, nil, notResolvable{err}
+		}
+		return catalogue.Resolution{}, nil, err
+	}
+	logUnheld(node, resolved.Plan.Unheld)
+	return resolved.Plan, resolved.Settings, nil
+}
+
+// generatorsOf is what every node's declaration is composed with, over the whole mesh (generators on the SDK).
+func generatorsOf(ctx context.Context, open *stores) (map[string]catalogue.Generator, error) {
+	in, err := inputFor(ctx, open)
+	if err != nil {
+		return nil, err
+	}
+	return compose.Generators(in.Input)
+}
+
+// renderingOf is what a machine is rendered with as a question reads it (nothing made), with the private network: what the
+// filter's rules, the roster and the like are derived from.
+func renderingOf(ctx context.Context, open *stores, node string) (catalogue.Rendering, error) {
+	in, err := inputFor(ctx, open)
+	if err != nil {
+		return catalogue.Rendering{}, err
+	}
+	rendered, err := compose.Render(in.Input, node, compose.Reading)
+	if err != nil {
+		return catalogue.Rendering{}, markUnresolvable(err)
+	}
+	with := rendered.Rendering
+	if with.Generators, err = compose.Generators(in.Input); err != nil {
+		return catalogue.Rendering{}, err
+	}
+	return with, nil
+}
+
+// whoResolvesOn is the machines whose resolution answers a requirement, and why the others did not (whoResolves over the
+// Input): by what a module provides, not by its name. A machine whose set does not compose is in refused, said; one the mesh
+// could not be asked about is an error, never a refusal (novox/hq 04-ISSUES/152).
+func whoResolvesOn(ctx context.Context, open *stores, requirement string) (map[string]bool, map[string]string, error) {
+	in, err := inputFor(ctx, open)
+	if err != nil {
+		return nil, nil, err
+	}
+	on := map[string]bool{}
+	refused := map[string]string{}
+	for _, n := range in.sortedNodes() {
+		if err := in.refused[n.Name]; err != nil {
+			return nil, nil, fmt.Errorf("whether %s answers %q cannot be read: %w", n.Name, requirement, err)
+		}
+		resolved, err := compose.Resolve(in.Input, n.Name)
+		switch {
+		case compose.IsUnresolvable(err):
+			refused[n.Name] = err.Error()
+			continue
+		case err != nil:
+			return nil, nil, fmt.Errorf("whether %s answers %q cannot be read: %w", n.Name, requirement, err)
+		}
+		for _, m := range resolved.Plan.Modules {
+			for _, offered := range m.Offers() {
+				if offered == requirement {
+					on[n.Name] = true
+				}
+			}
+		}
+	}
+	return on, refused, nil
+}
+
+// sortedNodes is the Input's nodes by name, the order the controller reads them in.
+func (in *meshInput) sortedNodes() []compose.Node {
+	out := append([]compose.Node(nil), in.Nodes...)
+	sort.Slice(out, func(i, j int) bool { return out[i].Name < out[j].Name })
+	return out
+}
+
+// composeQuestion composes a node's declaration as a question asks it: nothing is made, and what a send would make is a
+// stand-in (Foreseeing) or left out (Reading). It also answers what the node-engine's validator refuses of it. The lines the
+// composition found are said where the controller says its own (standard error, or the writer an act gave).
+//
+// withOrder says the declaration carries the order it was last sent under (composedAndValidated's, which a comparison with the
+// last send needs); without it the order is none, as declarationWith left it for the sender to stamp.
+func composeQuestion(ctx context.Context, open *stores, node string, mode compose.Mode, withOrder bool) (sendable, []string, error) {
+	in, err := inputFor(ctx, open)
+	if err != nil {
+		return sendable{}, nil, err
+	}
+	if err := in.refused[node]; err != nil {
+		return sendable{}, nil, err
+	}
+	d, problems, err := compose.ComposeIn(in.Input, node, mode)
+	if err != nil {
+		return sendable{}, nil, markUnresolvable(err)
+	}
+	if err := refusedBus(in, node); err != nil {
+		return sendable{}, nil, err
+	}
+	sayFound(ctx, d)
+	out := sendableOf(d)
+	out.fileReferences = readsFileReferences(in.Input, node)
+	if !withOrder {
+		out.Sequence, out.Epoch, out.Generation = 0, 0, 0
+	}
+	return out, problems, nil
+}
+
+// refusedBus is why the node cannot be composed because it runs the bus and the bus's user list cannot be: no user has a
+// credential, so the list would refuse every connection in the mesh (busUserList). The controller's own composition refused that
+// machine with those words; no other machine is refused for it. nil when nothing refuses the node.
+func refusedBus(in *meshInput, node string) error {
+	if in.busRefused == nil {
+		return nil
+	}
+	resolved, err := compose.Resolve(in.Input, node)
+	if err != nil {
+		return nil // it does not compose for its own reasons, which are said
+	}
+	for _, m := range resolved.Plan.Modules {
+		if m.BusUsers != "" && m.ClaimsSeat("mesh-broker") {
+			return in.busRefused
+		}
+	}
+	return nil
+}
+
+// markUnresolvable is an error of a node whose own set does not compose, as planFor marked it.
+func markUnresolvable(err error) error {
+	if compose.IsUnresolvable(err) {
+		return notResolvable{err}
+	}
+	return err
+}
+
+// composeSend composes a node's declaration to send it, as the Allocating composition did: composed over what is read,
+// then what it named foreseen is made (perform), the stores are read again and it is composed again. A declaration that
+// still names anything foreseen is refused, said, and never sent.
+func composeSend(ctx context.Context, open *stores, node string) (sendable, error) {
+	declared, _, err := composeSendValidated(ctx, open, node)
+	if err != nil {
+		return declared, err
+	}
+	// Never a declaration naming an image the store does not hold (novox/hq issue 1742): that module is left out.
+	return withoutMissingImages(ctx, open, node, declared), nil
+}
+
+// composeSendValidated is composeSend and what the node-engine's validator refuses of the declaration it composed, for the
+// merge gate's two passes (composedAndValidated in its Allocating mode).
+func composeSendValidated(ctx context.Context, open *stores, node string) (sendable, []string, error) {
+	// The core modules whose credentials the controller sealed itself because the vault was silent and no box was kept
+	// (ADR 0396): the composition stands in a vault box for each, and a send carries the controller's own seal instead.
+	byController, err := prepareSend(ctx, open, node)
+	if err != nil {
+		return sendable{}, nil, err
+	}
+	for attempt := 0; ; attempt++ {
+		in, err := inputFor(ctx, open)
+		if err != nil {
+			return sendable{}, nil, err
+		}
+		if err := in.refused[node]; err != nil {
+			return sendable{}, nil, err
+		}
+		d, problems, err := compose.ComposeIn(in.Input, node, compose.Foreseeing)
+		if err != nil {
+			return sendable{}, nil, markUnresolvable(err)
+		}
+		if err := refusedBus(in, node); err != nil {
+			return sendable{}, nil, err
+		}
+		if len(byController) > 0 {
+			if d, problems, err = sealedByTheController(in, node, d, byController); err != nil {
+				return sendable{}, nil, err
+			}
+		}
+		left := stillForeseen(d)
+		resolved, rerr := compose.Resolve(in.Input, node)
+		if rerr != nil {
+			return sendable{}, nil, markUnresolvable(rerr)
+		}
+		if len(resolved.Foreseen) > 0 {
+			left = append(left, resolved.Foreseen...)
+		}
+		if len(left) == 0 && len(in.wouldMake) == 0 {
+			sayFound(ctx, d)
+			out := sendableOf(d)
+			out.fileReferences = readsFileReferences(in.Input, node)
+			// The sender stamps the order it allots (order.stamp); a composition for a send carries none of its own.
+			out.Sequence, out.Epoch, out.Generation = 0, 0, 0
+			here, _ := nodeOf(in.Input, node)
+			out.Builds = buildsOf(in.Input, here, resolved.Plan, d.LeftOutWhy)
+			out.Bindings = boundToData(resolved.Plan, d.LeftOutWhy)
+			if len(d.Filled) > 0 {
+				if out.plans, err = handedPlans(in, node, resolved); err != nil {
+					return sendable{}, nil, err
+				}
+			}
+			return out, problems, nil
+		}
+		if attempt > 0 {
+			return sendable{}, nil, fmt.Errorf("%s was composed twice and still names what only a send makes (%s): nothing is sent "+
+				"that stands in for a value", node, strings.Join(left, "; "))
+		}
+		if _, err := perform(ctx, open, in, node, d); err != nil {
+			return sendable{}, nil, err
+		}
+		// What was made is in the stores now: the next read is a fresh one.
+		forgetInput(ctx)
+	}
+}
+
+// restOfTheMesh is what every other machine holds and offers (theRestOfTheMesh over the Input), for a question: the lines it
+// finds are said where the controller says its own, and a seat it would pass on is passed by the next send (perform), not by
+// the question. shelf, when given, replaces the Input's catalogue: a caller composing a change's shelf.
+func restOfTheMesh(ctx context.Context, open *stores, shelf map[string]catalogue.Manifest, exclude string) (catalogue.World, error) {
+	in, err := inputFor(ctx, open)
+	if err != nil {
+		return catalogue.World{}, err
+	}
+	input := in.Input
+	if shelf != nil {
+		input.Catalogue = shelf
+	}
+	world, passes, left, err := compose.TheRestOfTheMesh(input, exclude)
+	if err != nil {
+		return catalogue.World{}, err
+	}
+	var w io.Writer = os.Stderr
+	if lw, ok := ctx.Value(leftOutKey{}).(io.Writer); ok {
+		w = lw
+	}
+	for _, l := range left {
+		fmt.Fprintln(w, l.String())
+	}
+	for _, line := range passes.Said {
+		fmt.Fprintln(w, line)
+	}
+	return world, nil
+}
+
+// restOfTheMeshOf is restOfTheMesh for a caller that holds the inventory alone: the other stores the Input reads are opened for
+// the call and let go of again.
+func restOfTheMeshOf(ctx context.Context, inv *inventory.Inventory, shelf map[string]catalogue.Manifest, exclude string) (catalogue.World, error) {
+	open := &stores{inventory: inv}
+	defer func() {
+		if open.licences != nil {
+			open.licences.Close()
+		}
+		if open.identity != nil {
+			open.identity.Close()
+		}
+	}()
+	return restOfTheMesh(ctx, open, shelf, exclude)
+}
+
+// sayFound says the lines a composition found while composing, once each: a machine left out of the rest of the mesh, a seat
+// that two claimants could take, the bus's users left out for want of a credential.
+func sayFound(ctx context.Context, d compose.Declared) {
+	if len(d.Said) == 0 {
+		return
+	}
+	var w io.Writer = os.Stderr
+	if lw, ok := ctx.Value(leftOutKey{}).(io.Writer); ok {
+		w = lw
+	}
+	for _, line := range d.Said {
+		fmt.Fprintln(w, line)
+	}
+}
+
+// sendableOf is a composed declaration as the controller's sends know it.
+func sendableOf(d compose.Declared) sendable {
+	out := sendable{Resources: compactKept(d.Resources), Sequence: d.Sequence, Epoch: d.Epoch, Generation: d.Generation,
+		ReadsModules: d.ReadsModules, moduleOf: d.ModuleOf, buildIDs: d.BuildIDs, modules: d.Modules,
+		localNetwork: d.LocalNetwork, Received: d.Received, Mesh: d.Mesh, BusUsers: d.BusUsers,
+		LeftOut: d.LeftOut, leftOutWhy: d.LeftOutWhy, withheld: d.Withheld, unbound: d.Unbound, foreseen: d.Foreseen,
+		unplaced: d.Unplaced, handedOnly: d.HandedOnly, Filled: d.Filled, Provisioner: d.Provisioner,
+		requiredBy: d.RequiredBy}
+	if d.Adoption != nil {
+		out.Adoption = &adoptionEnvelope{Taken: d.Adoption.Taken, Untaken: d.Adoption.Untaken}
+	}
+	return out
+}
+
+// buildsOf is the build of each module a declaration for the node carries, as a send records it (novox/hq issue 259): the
+// module's current build for each module in it, the build it was last sent for one left out of it, and a module kept at the
+// build the machine runs carried at that one (ADR 0245). Never nil.
+func buildsOf(in compose.Input, node compose.Node, plan catalogue.Resolution, leftOut map[string]string) map[string]string {
+	before := node.SentBuilds
+	if !node.SentKnown {
+		before = nil
+	}
+	out := map[string]string{}
+	for _, m := range plan.Modules {
+		if _, left := leftOut[m.Module]; left {
+			if was, kept := before[m.Module]; kept {
+				out[m.Module] = was
+			}
+			continue
+		}
+		out[m.Module] = in.CurrentBuilds[m.Module]
+	}
+	for m, was := range node.KeptBuilds {
+		if _, carried := out[m]; carried {
+			out[m] = was
+		}
+	}
+	return out
+}
+
+// handedPlans is the plan of each module handed to the provisioner, which the assignments mirror keeps with the send (design
+// 57 P6): the composition's declaration does not carry it, so it is composed from the same rendering again.
+func handedPlans(in *meshInput, node string, resolved compose.Resolved) (map[string]catalogue.Plan, error) {
+	rendered, err := compose.Render(in.Input, node, compose.Foreseeing)
+	if err != nil {
+		return nil, err
+	}
+	gens, err := compose.Generators(in.Input)
+	if err != nil {
+		return nil, err
+	}
+	with := rendered.Rendering
+	with.Generators = gens
+	composed, err := resolved.Plan.Compose(with)
+	if err != nil {
+		return nil, err
+	}
+	return composed.Plans, nil
+}
+
+// sealedByTheController is the declaration with the controller's own seal in place of the vault's box for each core module the
+// vault did not answer for and no box was kept for (core_box.go, ADR 0396): the file carries "sealed", as the controller's
+// composition sent it, until the vault holds the credential. What the composition stood in for the box is replaced and no longer
+// wanted; the validator is run again over the body.
+func sealedByTheController(in *meshInput, node string, d compose.Declared, modules []string) (compose.Declared, []string, error) {
+	rendered, err := compose.Render(in.Input, node, compose.Foreseeing)
+	if err != nil {
+		return d, nil, err
+	}
+	stood, _ := compactBox(catalogue.ForeseenVaultBox)
+	var wanted []compose.CoreBoxWanted
+	var foreseen []string
+	for _, w := range d.CoreBoxesWanted {
+		if !slices.Contains(modules, w.Module) {
+			wanted = append(wanted, w)
+			continue
+		}
+		sealed := rendered.Rendering.Needed[w.Module][w.Name]
+		if sealed == "" {
+			return d, nil, fmt.Errorf("%s/%s on %s has no seal of the controller's to carry until the vault holds it", w.Module, w.Name, node)
+		}
+		for _, r := range d.Resources {
+			box, isBox := r[catalogue.VaultSealedField]
+			// By the resource's id alone: its path is the manifest's with the machine's words filled in, and so is not the
+			// manifest's own.
+			if !isBox || r["id"] != w.Module+"."+catalogue.NeedID(w.Name) {
+				continue
+			}
+			if had, err := compactBox(box); err != nil || had != stood {
+				continue
+			}
+			delete(r, catalogue.VaultSealedField)
+			r["sealed"] = sealed
+		}
+	}
+	// A stand-in box that is left is said by its resource, never sent and never guessed at.
+	for _, r := range d.Resources {
+		if box, has := r[catalogue.VaultSealedField]; has {
+			if had, err := compactBox(box); err == nil && had == stood {
+				if id, _ := r["id"].(string); slices.ContainsFunc(modules, func(m string) bool { return strings.HasPrefix(id, m+".") }) {
+					return d, nil, fmt.Errorf("%s on %s still carries a stand-in for the vault's box, and the controller has "+
+						"no seal of its own for it", id, node)
+				}
+			}
+		}
+	}
+	d.CoreBoxesWanted = wanted
+	for _, f := range d.Foreseen {
+		module, _, _ := strings.Cut(f, "/")
+		if !slices.Contains(modules, module) {
+			foreseen = append(foreseen, f)
+		}
+	}
+	d.Foreseen = foreseen
+	body, err := d.Body()
+	if err != nil {
+		return d, nil, err
+	}
+	return d, validate.Declaration(body), nil
+}
+
+// compactBox is a value as the compact JSON it marshals to, so a box is compared by what it says and not by the type that
+// holds it.
+func compactBox(v any) (string, error) {
+	raw, err := json.Marshal(v)
+	if err != nil {
+		return "", err
+	}
+	var out bytes.Buffer
+	if err := json.Compact(&out, raw); err != nil {
+		return "", err
+	}
+	return out.String(), nil
+}

cmd/mesh-controller/compose_sdk_test.go

@@ -0,0 +1,87 @@
+package main
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/compose"
+)
+
+// A declaration as the SDK composes it is the one the controller sends, byte for byte, whatever it carries: the body is the
+// envelope's only marshaller on either side (design 47 R4b, issue 1386).
+func TestASendableIsTheComposedDeclarationByteForByte(t *testing.T) {
+	d := compose.Declared{
+		Resources: []map[string]any{{"id": "files.config", "type": "file"}, {"id": "mesh.hosts", "type": "file"}},
+		Sequence:  7, Epoch: 3, Generation: 9, ReadsModules: true,
+		ModuleOf: map[string]string{"files.config": "files"}, BuildIDs: map[string]string{"files": "b-1"},
+		Adoption: &compose.Adoption{Taken: []string{"files"}, Untaken: map[string][]string{"nats": {"nats.server"}}},
+		Filled:   []string{"/etc/files/filled.json"}, Provisioner: "mesh-provisioner",
+		LeftOut: []string{"cache"}, LeftOutWhy: map[string]string{"cache": "a setting cannot compose"},
+	}
+	want, err := d.Body()
+	if err != nil {
+		t.Fatal(err)
+	}
+	got, err := sendableOf(d).Body()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(got) != string(want) {
+		t.Fatalf("the controller would send\n%s\nand the composition made\n%s", got, want)
+	}
+	if empty, err := sendableOf(compose.Declared{}).Body(); err != nil || !strings.Contains(string(empty), `"owns_nothing":true`) {
+		t.Fatalf("an empty declaration is not deliberate: %s %v", empty, err)
+	}
+}
+
+// 1386: what a send records as carried: the current build of each module it carries, the build a module left out of it was last
+// sent (when that is known), and a module kept at the build the machine runs at that one. (The controller's carriedOn recorded
+// the same; mesh-sdk's node_test TestAModuleLeftOutKeepsTheBuildItWasLastSent holds the left-out case.)
+func TestWhatASendRecordsAsCarriedIsWhatTheControllerRecorded(t *testing.T) {
+	plan := catalogue.Resolution{Modules: []catalogue.Manifest{{Module: "postgres"}, {Module: "files"}, {Module: "cache"}}}
+	leftOut := map[string]string{"cache": "a setting cannot compose"}
+	for name, c := range map[string]struct {
+		sent  map[string]string
+		known bool
+		kept  map[string]string
+		want  map[string]string
+	}{
+		"nothing sent": {want: map[string]string{"postgres": "p2", "files": "f2"}},
+		"sent and kept": {sent: map[string]string{"postgres": "p1", "cache": "c1", "files": "f1"}, known: true,
+			kept: map[string]string{"postgres": "p1"}, want: map[string]string{"postgres": "p1", "files": "f2", "cache": "c1"}},
+		"sent but not known":   {sent: map[string]string{"cache": "c1"}, want: map[string]string{"postgres": "p2", "files": "f2"}},
+		"kept a module not in": {known: true, kept: map[string]string{"mail": "m1"}, want: map[string]string{"postgres": "p2", "files": "f2"}},
+	} {
+		in := compose.Input{CurrentBuilds: map[string]string{"postgres": "p2", "files": "f2", "cache": "c2"}}
+		node := compose.Node{SentBuilds: c.sent, SentKnown: c.known, KeptBuilds: c.kept}
+		if got := buildsOf(in, node, plan, leftOut); !reflect.DeepEqual(got, c.want) {
+			t.Errorf("%s: a send records %v, want %v", name, got, c.want)
+		}
+	}
+}
+
+// 1385: a declaration that stands in for a value anywhere is still foreseen, in a list the composition names or in the body
+// alone (a pair credential's stand-in is in no list); one that stands in for nothing is not. It failed first, before the body
+// was scanned.
+func TestADeclarationThatStandsInForAValueIsStillForeseen(t *testing.T) {
+	clean := compose.Declared{Resources: []map[string]any{{"id": "files.config", "type": "file", "content": "ok"}}}
+	if left := stillForeseen(clean); len(left) != 0 {
+		t.Fatalf("a declaration that stands in for nothing is foreseen: %v", left)
+	}
+	for name, d := range map[string]compose.Declared{
+		"an own secret":     {StoodIn: []string{"files/admin"}},
+		"a port":            {ForeseenPorts: []string{"files:80"}},
+		"a core box":        {CoreBoxesWanted: []compose.CoreBoxWanted{{Node: "anchor", Module: "mesh-vault", Name: "root"}}},
+		"a pass of a seat":  {Passes: compose.Passes{Passes: []catalogue.SeatPass{{Seat: catalogue.Seat{Name: "mesh-store"}}}}},
+		"a pair credential": {Resources: []map[string]any{{"id": "files.needs-db", "sealed": catalogue.ForeseenSealed}}},
+		"the certificate":   {Resources: []map[string]any{{"id": "proxy.cert", "content": compose.ForeseenCertificate}}},
+		"the bus's list":    {Resources: []map[string]any{{"id": "nats.users", "content": compose.ForeseenBusUsers}}},
+		"the vault's box":   {Resources: []map[string]any{{"id": "x", "box": catalogue.ForeseenVaultBox}}},
+	} {
+		if left := stillForeseen(d); len(left) == 0 {
+			t.Errorf("%s: a declaration that stands in for it is not foreseen", name)
+		}
+	}
+}

cmd/mesh-controller/composed_integration_test.go

@@ -0,0 +1,143 @@
+//go:build integration
+
+package main
+
+import (
+	"context"
+	"errors"
+	"sync"
+	"testing"
+
+	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
+	"github.com/nats-io/nats.go"
+	"github.com/nats-io/nats.go/jetstream"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/identity"
+	"github.com/novox/mesh-controller/internal/link"
+	"github.com/novox/mesh-controller/internal/testbus"
+)
+
+// A mesh that composes (novox/hq ADR 0539): the real store (theCatalogue: sudo from the catalogue, mesh-host from the
+// node-engine's repository, the private network on anchor and laptop), the controller's signing key in its own
+// identity store, and a real bus server this process composes onto, its lease taken by the act as a command's is. Every
+// subject published on the bus is heard, so a test can say nothing went to a node's declaration subject.
+type composingMesh struct {
+	open  *stores
+	js    jetstream.JetStream
+	conn  *nats.Conn
+	mu    sync.Mutex
+	heard []string
+}
+
+func aComposingMesh(t *testing.T) *composingMesh {
+	t.Helper()
+	open := theCatalogue(t)
+	ident := identity.ForTest(t)
+	if _, err := ident.Establish(t.Context()); err != nil {
+		t.Fatal(err)
+	}
+	s := testbus.Start(t)
+	t.Setenv(broker.NATSVar, s.ClientURL())
+	was := theLease
+	theLease = &actor{}
+	t.Cleanup(func() { theLease.release(); theLease = was })
+	conn, err := nats.Connect(s.ClientURL())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(conn.Close)
+	js, err := jetstream.New(conn)
+	if err != nil {
+		t.Fatal(err)
+	}
+	m := &composingMesh{open: open, js: js, conn: conn}
+	sub, err := conn.Subscribe(">", func(msg *nats.Msg) {
+		m.mu.Lock()
+		m.heard = append(m.heard, msg.Subject)
+		m.mu.Unlock()
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = sub.Unsubscribe() })
+	legacy, err := conn.JetStream()
+	if err != nil {
+		t.Fatal(err)
+	}
+	// The controller's seat events, kept as the mesh's events stream keeps them.
+	if _, err := legacy.AddStream(&nats.StreamConfig{Name: "CONTROLLER_EVENTS", Subjects: []string{"mesh.seat.mesh-controller.event.>"}}); err != nil {
+		t.Fatal(err)
+	}
+	wasEvents := checkEvents
+	checkEvents = link.OverNATS{Conn: conn, JS: legacy}
+	t.Cleanup(func() { checkEvents = wasEvents })
+	withTrunkList(t, true)
+	return m
+}
+
+// trunkKeys are a done key and the indexer's trunk value naming it.
+type trunkKeys struct {
+	keyBuckets
+	trunk sdkdelivery.Module
+}
+
+func (k trunkKeys) ModuleAt(context.Context, string, string) (sdkdelivery.Module, error) {
+	return k.trunk, nil
+}
+
+// 1945/AC14: the declarations' stream stays while one node's have names another node-engine than the one registered,
+// and goes, said once, when every node's names it (ADR 0539 clause 11).
+func TestTheDeclarationsStreamGoesOnceEveryNodeRunsTheNewEngine(t *testing.T) {
+	m := aComposingMesh(t)
+	ctx := t.Context()
+	legacy, err := m.conn.JetStream()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := legacy.AddStream(&nats.StreamConfig{Name: broker.DeclarationsStream, Subjects: []string{"mesh.node.*.declare"},
+		MaxMsgsPerSubject: 1}); err != nil {
+		t.Fatal(err)
+	}
+	// The new node-engine registered at its fingerprint, from its done key.
+	n6 := fpOf('6')
+	keys, trunk := aKeyFor("mesh-host", "6", n6, "novox/mesh-host", "", "f00d0123456789ab")
+	if _, err := liveDoneKeySteps(m.open, trunkKeys{keyBuckets: keys, trunk: trunk}).take(ctx, "mesh-host"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := m.js.CreateOrUpdateKeyValue(ctx, jetstream.KeyValueConfig{Bucket: sdkdelivery.HaveBucket, History: sdkdelivery.HaveHistory}); err != nil {
+		t.Fatal(err)
+	}
+	haves, err := m.js.KeyValue(ctx, sdkdelivery.HaveBucket)
+	if err != nil {
+		t.Fatal(err)
+	}
+	have := func(node, fp string) {
+		key, _ := sdkdelivery.HaveKey(node, "mesh-host")
+		raw, _ := sdkdelivery.EncodeHave(sdkdelivery.Have{FP: fp, Phase: sdkdelivery.PhaseRunning, Health: sdkdelivery.HealthOK})
+		if _, err := haves.Put(ctx, key, raw); err != nil {
+			t.Fatal(err)
+		}
+	}
+	have("anchor", n6)
+	have("laptop", fpOf('5'))
+	if done, err := retireDeclarations(ctx, m.open); err != nil || done {
+		t.Fatalf("with laptop on the old node-engine: done %v (%v)", done, err)
+	}
+	if _, err := m.js.Stream(ctx, broker.DeclarationsStream); err != nil {
+		t.Fatalf("the stream went while laptop runs the old node-engine: %v", err)
+	}
+	have("laptop", n6)
+	if done, err := retireDeclarations(ctx, m.open); err != nil || !done {
+		t.Fatalf("with every node on the new node-engine: done %v (%v)", done, err)
+	}
+	if _, err := m.js.Stream(ctx, broker.DeclarationsStream); !errors.Is(err, jetstream.ErrStreamNotFound) {
+		t.Errorf("the stream is still there: %v", err)
+	}
+	if done, err := retireDeclarations(ctx, m.open); err != nil || !done {
+		t.Errorf("a second look: done %v (%v)", done, err)
+	}
+	if !declarationsRetiredNow(ctx, m.open.inventory) {
+		t.Errorf("a raise after the retirement would assert the stream again")
+	}
+}

cmd/mesh-controller/composed_judge.go

@@ -0,0 +1,343 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"path"
+	"sort"
+	"strings"
+
+	sdkdecl "git.novox.be/novox/mesh-sdk/go/declaration"
+	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
+	"github.com/nats-io/nats.go/jetstream"
+)
+
+// The judgement of a move (novox/hq ADR 0539 clauses 2 and 14, by ADR 0377 §3's tests): beside each composition's digest
+// the controller writes whether moving the node from the composition it runs, as its have names it, to this one
+// recreates a container, moves the module's data, or neither, or that it cannot be judged. The assigner holds a move of
+// a module of policy record from it until a person allows it.
+//
+// ADR 0377 §3 over two compositions of one module: **recreates** when a container resource is changed, added or
+// removed; **moves data** when, with no container changed, a directory or file resource is changed, added or removed
+// that a container of the module mounts or that holds or lies within one of its directories (where a module keeps its
+// data), when its `data` declaration changes, or, for a module that declares data, when one of its long-running
+// processes changes; **neither** otherwise, and for a module the node has never run. **Cannot judge** when the
+// composition the node runs is gone or cannot be read. A held composition never becomes what is judged against: with A
+// running, B held and C composed, C is judged against A, the one the have names.
+
+// judgeMove is the value written beside a composition whose digest is digest: its judgement against what the node's have
+// names for the module, and the module's policy.
+func judgeMove(ctx context.Context, at composedPlace, key string, to sdkdelivery.Composed, digest string) (sdkdelivery.ComposedDigest, error) {
+	out := sdkdelivery.ComposedDigest{Digest: digest}
+	if at.policy != nil && to.Module != "" {
+		out.Policy, out.PolicyFrom, out.PolicyWhy = at.policy(to.Module)
+	}
+	if to.Module == "" {
+		// The node's own composition: no module's containers or data are judged; its want is written as any.
+		out.Judgement = sdkdelivery.JudgedNeither
+		return out, nil
+	}
+	have, found, err := at.ran(ctx, to.Module)
+	if err != nil {
+		return out, err
+	}
+	// A node whose have names no composition yet (the switch: it runs the declaration it last applied) is judged
+	// against that module's slice of that declaration (novox/hq ADR 0540 clause 9): equal is unchanged, a want that
+	// changes nothing on the node; otherwise by ADR 0377 §3's tests, as any move.
+	if found && have.Composed == "" && have.FP != "" && have.Phase != sdkdelivery.PhaseRemoved && at.lastApplied != nil {
+		slice, declared, applied, err := at.lastApplied(ctx, to.Module)
+		if err != nil {
+			// Unread is not judged: a person's yes holds it, and the words say why.
+			out.Judgement = sdkdelivery.JudgedCannot
+			out.Words = fmt.Sprintf("%s's have on %s names no composition, and the declaration it last applied cannot be read: %v",
+				to.Module, at.node, err)
+			return out, nil
+		}
+		if applied {
+			from := sdkdelivery.Composed{Node: at.node, Module: to.Module, FP: have.FP, Data: to.Data, Resources: slice}
+			if sameResources(from, to) {
+				out.Judgement, out.Words = sdkdelivery.JudgedUnchanged, "equal to the declaration "+at.node+" last applied"
+				return out, nil
+			}
+			// Against names the declaration, by its digest: the composition the node runs is that declaration's slice.
+			out.Against = declared
+			if onlyTheUserList(from, to) {
+				// Only the bus's user list, as against a composition (ADR 0539 clause 7): no yes waits on it at the switch.
+				out.Judgement, out.UserListOnly = sdkdelivery.JudgedNeither, true
+				out.Words = "only the bus's user list changes, against the declaration " + at.node + " last applied"
+				return out, nil
+			}
+			j, words := judged(from, to)
+			out.Judgement, out.Words = j, words+", against the declaration "+at.node+" last applied"
+			return out, nil
+		}
+	}
+	if !found || have.Phase == sdkdelivery.PhaseRemoved || (have.Composed == "" && have.FP == "") {
+		out.Judgement, out.Words = sdkdelivery.JudgedNeither, "the node runs no composition of "+to.Module
+		return out, nil
+	}
+	if have.Composed == "" {
+		out.Judgement = sdkdelivery.JudgedCannot
+		out.Words = fmt.Sprintf("%s's have on %s names no composition, only the fingerprint %s", to.Module, at.node, have.FP)
+		return out, nil
+	}
+	out.Against = have.Composed
+	if have.Composed == digest {
+		out.Judgement, out.Words = sdkdelivery.JudgedNeither, "the node runs this composition"
+		return out, nil
+	}
+	from, found, err := composedByDigest(ctx, at, to.Module, have.FP, have.Composed)
+	if err != nil {
+		return out, err
+	}
+	if !found {
+		out.Judgement = sdkdelivery.JudgedCannot
+		out.Words = fmt.Sprintf("the composition %s runs on %s (%s) is gone", to.Module, at.node, short(strings.TrimPrefix(have.Composed, "sha256:")))
+		return out, nil
+	}
+	if onlyTheUserList(from, to) {
+		// Only the bus's user list (ADR 0539 clause 7): a file change and a reload of the bus, no move of it, written
+		// into its want at once.
+		out.Judgement, out.UserListOnly, out.Words = sdkdelivery.JudgedNeither, true, "only the bus's user list changes"
+		return out, nil
+	}
+	out.Judgement, out.Words = judged(from, to)
+	return out, nil
+}
+
+// busUsersSuffix ends the id of the bus module's user list as the composer writes it: `<module>.bus-users`.
+const busUsersSuffix = ".bus-users"
+
+// onlyTheUserList says two compositions of a module differ, and only in its file of the bus's user list.
+func onlyTheUserList(from, to sdkdelivery.Composed) bool {
+	if from.Data != to.Data {
+		return false
+	}
+	before, after := resourcesByID(from), resourcesByID(to)
+	if len(before) != len(after) {
+		return false
+	}
+	changed := false
+	for id, now := range after {
+		was, ok := before[id]
+		if !ok {
+			return false
+		}
+		if bytes.Equal(was.raw, now.raw) {
+			continue
+		}
+		if !strings.HasSuffix(id, busUsersSuffix) || now.kind != string(sdkdecl.TypeFile) {
+			return false
+		}
+		changed = true
+	}
+	return changed
+}
+
+// composedByDigest finds, in the node's bucket, the composition of module at fingerprint fp whose digest is digest: the
+// key's current value or one of the revisions it keeps.
+func composedByDigest(ctx context.Context, at composedPlace, module, fp, digest string) (sdkdelivery.Composed, bool, error) {
+	if fp == "" {
+		return sdkdelivery.Composed{}, false, nil
+	}
+	key, err := sdkdelivery.ComposedKey(at.node, module, fp)
+	if err != nil {
+		return sdkdelivery.Composed{}, false, nil
+	}
+	values, err := historyOf(ctx, at.bucket, key)
+	if err != nil {
+		return sdkdelivery.Composed{}, false, err
+	}
+	for _, v := range values {
+		c, err := sdkdelivery.DecodeComposed(v)
+		if err != nil {
+			continue
+		}
+		if d, err := sdkdelivery.ComposedDigestOf(c); err == nil && d == digest {
+			return c, true, nil
+		}
+	}
+	return sdkdelivery.Composed{}, false, nil
+}
+
+// historyOf is every value a key keeps, the newest first; none when there is no such key.
+func historyOf(ctx context.Context, kv composedBucketsKV, key string) ([][]byte, error) {
+	if h, ok := kv.(interface {
+		History(ctx context.Context, key string, opts ...jetstream.WatchOpt) ([]jetstream.KeyValueEntry, error)
+	}); ok {
+		entries, err := h.History(ctx, key)
+		if errors.Is(err, jetstream.ErrKeyNotFound) {
+			return nil, nil
+		}
+		if err != nil {
+			return nil, err
+		}
+		out := make([][]byte, 0, len(entries))
+		for i := len(entries) - 1; i >= 0; i-- {
+			if entries[i].Operation() == jetstream.KeyValuePut {
+				out = append(out, entries[i].Value())
+			}
+		}
+		return out, nil
+	}
+	e, err := kv.Get(ctx, key)
+	if errors.Is(err, jetstream.ErrKeyNotFound) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	return [][]byte{e.Value()}, nil
+}
+
+// judged applies ADR 0377 §3 to two compositions of one module.
+func judged(from, to sdkdelivery.Composed) (sdkdelivery.Judgement, string) {
+	before, after := resourcesByID(from), resourcesByID(to)
+	if ids := changedOf(before, after, func(kind string) bool { return kind == string(sdkdecl.TypeContainer) }); len(ids) > 0 {
+		return sdkdelivery.JudgedRecreates, "it recreates " + strings.Join(ids, ", ")
+	}
+	if from.Data != to.Data {
+		return sdkdelivery.JudgedMovesData, "its data declaration changes"
+	}
+	places := dataPlaces(before, after)
+	held := func(kind string) bool {
+		return kind == string(sdkdecl.TypeDirectory) || kind == string(sdkdecl.TypeFile)
+	}
+	var moved []string
+	for _, id := range changedOf(before, after, held) {
+		r := before[id]
+		if r == nil {
+			r = after[id]
+		}
+		if withinPlaces(r.path, places) {
+			moved = append(moved, id)
+		}
+	}
+	if to.Data || from.Data {
+		moved = append(moved, changedOf(before, after, func(kind string) bool { return kind == string(sdkdecl.TypeProcess) })...)
+	}
+	if len(moved) > 0 {
+		sort.Strings(moved)
+		return sdkdelivery.JudgedMovesData, "it changes where its data is kept: " + strings.Join(moved, ", ")
+	}
+	return sdkdelivery.JudgedNeither, "it recreates no container and moves no data"
+}
+
+// judgedResource is a resource as the judgement reads it: its kind, the path it acts on, what its containers mount,
+// and its canonical bytes.
+type judgedResource struct {
+	kind   string
+	path   string
+	mounts []string
+	raw    []byte
+}
+
+func resourcesByID(c sdkdelivery.Composed) map[string]*judgedResource {
+	out := map[string]*judgedResource{}
+	for _, raw := range c.Resources {
+		var head struct {
+			ID   string `json:"id"`
+			Type string `json:"type"`
+			Path string `json:"path"`
+			// A container's volumes, `<path on the machine>:<path inside>[:<options>]`.
+			Volumes []string `json:"volumes"`
+		}
+		if err := json.Unmarshal(raw, &head); err != nil {
+			continue
+		}
+		r := &judgedResource{kind: head.Type, path: head.Path, raw: compactComposed(raw)}
+		for _, v := range head.Volumes {
+			source, _, _ := strings.Cut(v, ":")
+			r.mounts = append(r.mounts, source)
+		}
+		out[head.ID] = r
+	}
+	return out
+}
+
+// compactComposed is a resource's bytes canonical: its keys sorted, its spacing dropped, its numbers as written, so
+// two compositions that say the same compare equal however each was written.
+func compactComposed(raw []byte) []byte {
+	var v any
+	d := json.NewDecoder(bytes.NewReader(raw))
+	d.UseNumber()
+	if err := d.Decode(&v); err != nil {
+		return raw
+	}
+	out, err := json.Marshal(v)
+	if err != nil {
+		return raw
+	}
+	return out
+}
+
+// changedOf are the ids of the resources of the kinds counted that are changed, added or removed, sorted.
+func changedOf(before, after map[string]*judgedResource, counted func(kind string) bool) []string {
+	var out []string
+	for id, now := range after {
+		if !counted(now.kind) {
+			continue
+		}
+		if was, ok := before[id]; !ok || !bytes.Equal(was.raw, now.raw) {
+			out = append(out, id)
+		}
+	}
+	for id, was := range before {
+		if _, ok := after[id]; !ok && counted(was.kind) {
+			out = append(out, id)
+		}
+	}
+	sort.Strings(out)
+	return out
+}
+
+// dataPlaces are the paths where the module keeps what a move must not lose: what its containers mount, and its
+// directories, before and after.
+func dataPlaces(before, after map[string]*judgedResource) []string {
+	var out []string
+	for _, rs := range []map[string]*judgedResource{before, after} {
+		for _, r := range rs {
+			if r.kind == string(sdkdecl.TypeContainer) {
+				out = append(out, r.mounts...)
+			}
+			if r.kind == string(sdkdecl.TypeDirectory) && r.path != "" {
+				out = append(out, r.path)
+			}
+		}
+	}
+	return out
+}
+
+// withinPlaces says p is one of places, or lies within one, or holds one.
+func withinPlaces(p string, places []string) bool {
+	if p == "" {
+		return false
+	}
+	p = path.Clean(p)
+	for _, place := range places {
+		if place == "" || !strings.HasPrefix(place, "/") {
+			continue
+		}
+		place = path.Clean(place)
+		if p == place || strings.HasPrefix(p, place+"/") || strings.HasPrefix(place, p+"/") {
+			return true
+		}
+	}
+	return false
+}
+
+// sameResources says two compositions of a module hold the same resources in the same order, each compared canonical.
+func sameResources(a, b sdkdelivery.Composed) bool {
+	if len(a.Resources) != len(b.Resources) {
+		return false
+	}
+	for i := range a.Resources {
+		if !bytes.Equal(compactComposed(a.Resources[i]), compactComposed(b.Resources[i])) {
+			return false
+		}
+	}
+	return true
+}

cmd/mesh-controller/composed_judge_test.go

@@ -0,0 +1,212 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"strings"
+	"testing"
+
+	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
+
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// mailOn is a composition of mesh-mail on ace at fingerprint c, from the given resources, each saying its module.
+func mailOn(t *testing.T, c byte, data bool, resources ...string) sdkdelivery.Composed {
+	t.Helper()
+	out := sdkdelivery.Composed{Node: "ace", Module: "mesh-mail", FP: sdkdelivery.SourcePrefix2 + strings.Repeat(string(c), 64), Data: data}
+	for _, r := range resources {
+		out.Resources = append(out.Resources, json.RawMessage(r))
+	}
+	return out
+}
+
+const (
+	mailContainer  = `{"id":"mesh-mail.server","type":"container","module":"mesh-mail","name":"mail","image":"mail@sha256:1111111111111111111111111111111111111111111111111111111111111111","volumes":["/var/lib/mesh-mail/spool:/spool"]}`
+	mailContainer2 = `{"id":"mesh-mail.server","type":"container","module":"mesh-mail","name":"mail","image":"mail@sha256:2222222222222222222222222222222222222222222222222222222222222222","volumes":["/var/lib/mesh-mail/spool:/spool"]}`
+	mailSpool      = `{"id":"mesh-mail.spool","type":"directory","module":"mesh-mail","path":"/var/lib/mesh-mail/spool"}`
+	mailSpoolMoved = `{"id":"mesh-mail.spool","type":"directory","module":"mesh-mail","path":"/srv/mesh-mail/spool"}`
+	mailTools      = `{"id":"mesh-mail.tools","type":"file","module":"mesh-mail","path":"/usr/lib/mesh-mail/tools.json","content":"a"}`
+	mailTools2     = `{"id":"mesh-mail.tools","type":"file","module":"mesh-mail","path":"/usr/lib/mesh-mail/tools.json","content":"b"}`
+	mailConfig     = `{"id":"mesh-mail.conf","type":"file","module":"mesh-mail","path":"/var/lib/mesh-mail/spool/conf","content":"a"}`
+	mailConfig2    = `{"id":"mesh-mail.conf","type":"file","module":"mesh-mail","path":"/var/lib/mesh-mail/spool/conf","content":"b"}`
+)
+
+// 1945/AC12: captured pairs of compositions are judged by ADR 0377 §3's tests: a changed container recreates; with no
+// container changed, a directory moved, a file within the data a container mounts changed, or the data declaration
+// changed moves data; a tools file nothing mounts changed is neither.
+func TestAMoveIsJudgedByWhatItRecreatesOrMoves(t *testing.T) {
+	cases := []struct {
+		name     string
+		from, to sdkdelivery.Composed
+		want     sdkdelivery.Judgement
+	}{
+		{"a new image", mailOn(t, 'a', true, mailContainer, mailSpool, mailTools), mailOn(t, 'b', true, mailContainer2, mailSpool, mailTools), sdkdelivery.JudgedRecreates},
+		{"a container gone", mailOn(t, 'a', true, mailContainer, mailSpool), mailOn(t, 'b', true, mailSpool), sdkdelivery.JudgedRecreates},
+		{"its spool moved", mailOn(t, 'a', true, mailContainer, mailSpool), mailOn(t, 'b', true, mailContainer, mailSpoolMoved), sdkdelivery.JudgedMovesData},
+		{"a file in its spool", mailOn(t, 'a', true, mailContainer, mailSpool, mailConfig), mailOn(t, 'b', true, mailContainer, mailSpool, mailConfig2), sdkdelivery.JudgedMovesData},
+		{"its data declaration", mailOn(t, 'a', false, mailContainer, mailSpool), mailOn(t, 'b', true, mailContainer, mailSpool), sdkdelivery.JudgedMovesData},
+		{"its tools only", mailOn(t, 'a', true, mailContainer, mailSpool, mailTools), mailOn(t, 'b', true, mailContainer, mailSpool, mailTools2), sdkdelivery.JudgedNeither},
+	}
+	for _, c := range cases {
+		if got, words := judged(c.from, c.to); got != c.want || words == "" {
+			t.Errorf("%s: judged %s (%q), want %s", c.name, got, words, c.want)
+		}
+	}
+}
+
+// 1945/AC12: a move is judged against the composition the node's have names: one the node never ran is neither; one
+// whose composition is gone cannot be judged and says why; and with A running, B held and C composed, C is judged
+// against A, and judged again when the have changes.
+func TestAMoveIsJudgedAgainstWhatTheNodeRuns(t *testing.T) {
+	at, _, _, haves := aPlace(t, "ace")
+	ctx := context.Background()
+	a := mailOn(t, 'a', true, mailContainer, mailSpool, mailTools)
+	b := mailOn(t, 'b', true, mailContainer2, mailSpool, mailTools)
+	c := mailOn(t, 'c', true, mailContainer, mailSpool, mailTools2)
+	write := func(comp sdkdelivery.Composed) (string, string) {
+		key, _ := sdkdelivery.ComposedKey("ace", comp.Module, comp.FP)
+		if _, err := writeComposed(ctx, at, key, comp); err != nil {
+			t.Fatal(err)
+		}
+		d, _ := sdkdelivery.ComposedDigestOf(comp)
+		return key, d
+	}
+	judgedNow := func(key string) sdkdelivery.ComposedDigest {
+		e, err := at.digests.Get(ctx, key)
+		if err != nil {
+			t.Fatal(err)
+		}
+		v, err := sdkdelivery.DecodeComposedDigest(e.Value())
+		if err != nil {
+			t.Fatal(err)
+		}
+		return v
+	}
+	keyA, digestA := write(a)
+	if v := judgedNow(keyA); v.Judgement != sdkdelivery.JudgedNeither || v.Against != "" {
+		t.Errorf("a module the node never ran: %+v", v)
+	}
+	if v := judgedNow(keyA); v.Policy != "roll" || v.PolicyFrom != "default" {
+		t.Errorf("the policy beside the judgement: %+v", v)
+	}
+	haves["mesh-mail"] = sdkdelivery.Have{FP: a.FP, Composed: digestA, Phase: sdkdelivery.PhaseRunning, Health: sdkdelivery.HealthOK}
+	keyB, _ := write(b)
+	if v := judgedNow(keyB); v.Judgement != sdkdelivery.JudgedRecreates || v.Against != digestA {
+		t.Errorf("B against A: %+v", v)
+	}
+	// B is held (the assigner writes no want for it); the node still runs A.
+	keyC, digestC := write(c)
+	if v := judgedNow(keyC); v.Judgement != sdkdelivery.JudgedNeither || v.Against != digestA {
+		t.Errorf("C against A, B held: %+v", v)
+	}
+	// The have changes to C: every judgement of the module is written again, against what runs now (the have watch).
+	haves["mesh-mail"] = sdkdelivery.Have{FP: c.FP, Composed: digestC, Phase: sdkdelivery.PhaseRunning, Health: sdkdelivery.HealthOK}
+	if n, err := rejudge(ctx, at, "mesh-mail"); err != nil || n == 0 {
+		t.Fatalf("rejudged %d (%v)", n, err)
+	}
+	if v := judgedNow(keyC); v.Against != digestC || v.Judgement != sdkdelivery.JudgedNeither {
+		t.Errorf("C once the node runs it: %+v", v)
+	}
+	if v := judgedNow(keyB); v.Against != digestC || v.Judgement != sdkdelivery.JudgedRecreates {
+		t.Errorf("B once the node runs C: %+v", v)
+	}
+	// A person sets the module's policy: written beside every composition of it.
+	at.policy = func(string) (string, string, string) { return "record", "person", "its spool" }
+	if _, err := rejudge(ctx, at, "mesh-mail"); err != nil {
+		t.Fatal(err)
+	}
+	if v := judgedNow(keyB); v.Policy != "record" || v.PolicyFrom != "person" || v.PolicyWhy != "its spool" {
+		t.Errorf("the person's policy beside B: %+v", v)
+	}
+	// A have naming a composition the buckets no longer hold.
+	haves["mesh-mail"] = sdkdelivery.Have{FP: sdkdelivery.SourcePrefix2 + strings.Repeat("9", 64), Composed: "sha256:" + strings.Repeat("9", 64),
+		Phase: sdkdelivery.PhaseRunning, Health: sdkdelivery.HealthOK}
+	write(b)
+	if v := judgedNow(keyB); v.Judgement != sdkdelivery.JudgedCannot || !strings.Contains(v.Words, "gone") {
+		t.Errorf("against a composition that is gone: %+v", v)
+	}
+}
+
+const (
+	busServer  = `{"id":"nats.server","type":"container","module":"nats","name":"nats","image":"nats@sha256:4444444444444444444444444444444444444444444444444444444444444444"}`
+	busServer2 = `{"id":"nats.server","type":"container","module":"nats","name":"nats","image":"nats@sha256:5555555555555555555555555555555555555555555555555555555555555555"}`
+	busUsers   = `{"id":"nats.bus-users","type":"file","module":"nats","path":"/etc/nats/users.conf","content":"users: [a]"}`
+	busUsers2  = `{"id":"nats.bus-users","type":"file","module":"nats","path":"/etc/nats/users.conf","content":"users: [a, b]"}`
+)
+
+// busOn is a composition of the bus on ace from the given resources.
+func busOn(t *testing.T, resources ...string) sdkdelivery.Composed {
+	t.Helper()
+	out := sdkdelivery.Composed{Node: "ace", Module: "nats", FP: sdkdelivery.SourcePrefix2 + strings.Repeat("b", 64)}
+	for _, r := range resources {
+		out.Resources = append(out.Resources, json.RawMessage(r))
+	}
+	return out
+}
+
+// ADR 0540 clause 9: a have that names no composition, only a fingerprint (the switch: the node runs the declaration it
+// last applied), is judged against the module's slice of that declaration, read from the kept stream of declarations:
+// an equal slice is unchanged; a slice differing only in the bus's user list is that (round 1's A2, so no yes waits on it at the switch); a changed setting is judged as any move; no declaration to read cannot be judged.
+func TestAHaveWithNoCompositionIsJudgedAgainstTheLastDeclaration(t *testing.T) {
+	ctx := context.Background()
+	other := `{"id":"mesh-calendar.server","type":"container","module":"mesh-calendar","name":"calendar","image":"cal@sha256:3333333333333333333333333333333333333333333333333333333333333333"}`
+	unsaid := `{"id":"mesh-mail.tools","type":"file","path":"/usr/lib/mesh-mail/tools.json","content":"a"}`
+	declared := func(resources ...string) []byte {
+		body, err := json.Marshal(map[string]any{"node": "ace", "resources": json.RawMessage("[" + strings.Join(resources, ",") + "]")})
+		if err != nil {
+			t.Fatal(err)
+		}
+		signed, err := json.Marshal(link.Signed{Declaration: body, Signature: []byte("s")}) // as link.Envelope sent it
+		if err != nil {
+			t.Fatal(err)
+		}
+		return signed
+	}
+	cases := []struct {
+		name     string
+		last     []byte // the node's last declaration on the stream; nil when there is none
+		to       sdkdelivery.Composed
+		want     sdkdelivery.Judgement
+		inWords  string
+		userList bool
+	}{
+		{"an equal slice", declared(mailContainer, other, mailSpool, mailTools), mailOn(t, 'b', true, mailContainer, mailSpool, mailTools), sdkdelivery.JudgedUnchanged, "last applied", false},
+		{"a declared resource saying no module is not equal", declared(mailContainer, other, mailSpool, unsaid), mailOn(t, 'b', true, mailContainer, mailSpool, mailTools), sdkdelivery.JudgedNeither, "last applied", false},
+		{"a changed image", declared(mailContainer, other, mailSpool, mailTools), mailOn(t, 'b', true, mailContainer2, mailSpool, mailTools), sdkdelivery.JudgedRecreates, "last applied", false},
+		{"a changed setting in its spool", declared(mailContainer, mailSpool, mailConfig), mailOn(t, 'b', true, mailContainer, mailSpool, mailConfig2), sdkdelivery.JudgedMovesData, "last applied", false},
+		{"a changed tools file", declared(mailContainer, mailSpool, mailTools), mailOn(t, 'b', true, mailContainer, mailSpool, mailTools2), sdkdelivery.JudgedNeither, "last applied", false},
+		{"only the bus's user list", declared(busServer, busUsers, other), busOn(t, busServer, busUsers2), sdkdelivery.JudgedNeither, "only the bus's user list", true},
+		{"the bus's user list and its container", declared(busServer, busUsers), busOn(t, busServer2, busUsers2), sdkdelivery.JudgedRecreates, "last applied", false},
+		{"no declaration kept", nil, mailOn(t, 'b', true, mailContainer, mailSpool, mailTools), sdkdelivery.JudgedCannot, "names no composition", false},
+	}
+	for _, c := range cases {
+		at, _, _, haves := aPlace(t, "ace")
+		last := c.last
+		at.lastApplied = func(_ context.Context, module string) ([]json.RawMessage, string, bool, error) {
+			if last == nil {
+				return nil, "", false, nil
+			}
+			return sliceOfDeclaration(last, module)
+		}
+		haves[c.to.Module] = sdkdelivery.Have{FP: sdkdelivery.SourcePrefix2 + strings.Repeat("a", 64), Phase: sdkdelivery.PhaseRunning, Health: sdkdelivery.HealthOK}
+		key, _ := sdkdelivery.ComposedKey("ace", c.to.Module, c.to.FP)
+		digest, err := sdkdelivery.ComposedDigestOf(c.to)
+		if err != nil {
+			t.Fatalf("%s: %v", c.name, err)
+		}
+		got, err := judgeMove(ctx, at, key, c.to, digest)
+		if err != nil {
+			t.Fatalf("%s: %v", c.name, err)
+		}
+		if got.UserListOnly != c.userList {
+			t.Errorf("%s: user list only %v, want %v", c.name, got.UserListOnly, c.userList)
+		}
+		if got.Judgement != c.want || !strings.Contains(got.Words, c.inWords) {
+			t.Errorf("%s: judged %s (%q), want %s", c.name, got.Judgement, got.Words, c.want)
+		}
+		if _, err := sdkdelivery.EncodeComposedDigest(got); err != nil {
+			t.Errorf("%s: the judgement written is refused: %v", c.name, err)
+		}
+	}
+}

cmd/mesh-controller/composed_keys.go

@@ -0,0 +1,264 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"sync"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
+	"github.com/nats-io/nats.go/jetstream"
+	"github.com/novox/mesh-controller/internal/builderkeys"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// A new fingerprint of a registered module, from its done key to its compositions (novox/hq ADR 0539 clauses 5 and 7,
+// ADR 0501 §2). With no delivery plan left to take a module's done key in, a write of the builder's or the indexer's
+// keys does it: the controller takes in the done key of the fingerprint the indexer's trunk value names (registers the
+// module at it, as a plan's take-in did), composes every node the module is assigned to (which makes what a module's
+// new manifest needs, a credential among it, as a send made it), composes the node holding the bus (its user list now
+// carries the module's permissions at the new fingerprint: a new revision of the bus module's composition alone,
+// written into its want at once by the assigner), and writes `grants.<module>.<fp>`. The assigner's sixth and seventh
+// rules then let a want name the fingerprint. **No timer**: woken by the keys, and a starting controller looks at every
+// module once (B5's start pass).
+
+// doneKeySteps are what taking a module's done key in does, each a step a test may stand in for.
+type doneKeySteps struct {
+	// held says the catalogue holds the module (a new one is the new-module take-in's, new_modules.go).
+	held func(ctx context.Context, module string) (bool, error)
+	// trunk is the indexer's trunk value of the module.
+	trunk func(ctx context.Context, module string) (sdkdelivery.Module, error)
+	// registeredAt says the module is registered at the commit.
+	registeredAt func(ctx context.Context, module, commit string) (bool, error)
+	// takeIn registers the module from the builder's done key of the trunk's fingerprint (takeInKey); errKeyWaits when
+	// the key is not done yet.
+	takeIn func(ctx context.Context, module string, trunk sdkdelivery.Module) error
+	// nodesOf are the nodes the module is assigned to; busHolder the node holding the bus, "" for none.
+	nodesOf   func(ctx context.Context, module string) ([]string, error)
+	busHolder func(ctx context.Context) (string, error)
+	// compose writes the nodes' compositions; grants writes the grants issued.
+	compose func(ctx context.Context, nodes []string) error
+	grants  func(ctx context.Context) error
+}
+
+// take takes module's done key in and composes what it changed. It answers what it did in a line, "" when there was
+// nothing to do.
+func (s doneKeySteps) take(ctx context.Context, module string) (string, error) {
+	held, err := s.held(ctx, module)
+	if err != nil || !held {
+		return "", err
+	}
+	trunk, err := s.trunk(ctx, module)
+	if errors.Is(err, builderkeys.ErrNoValue) {
+		return "", nil
+	}
+	if err != nil {
+		return "", err
+	}
+	if !strings.HasPrefix(trunk.FP2, sdkdelivery.SourcePrefix2) {
+		return "", nil
+	}
+	at, err := s.registeredAt(ctx, module, trunk.Commit)
+	if err != nil {
+		return "", err
+	}
+	said := ""
+	if !at {
+		if err := s.takeIn(ctx, module, trunk); err != nil {
+			return "", err
+		}
+		said = fmt.Sprintf("%s registered from the builder's done key %s (%s)", module, short(trunk.FP2), short(trunk.Commit))
+	}
+	nodes, err := s.nodesOf(ctx, module)
+	if err != nil {
+		return said, err
+	}
+	if len(nodes) == 0 {
+		return said, nil
+	}
+	// The module's nodes first: composing them makes what the new manifest needs, its credentials among it.
+	if err := s.compose(ctx, nodes); err != nil {
+		return said, err
+	}
+	// Then the bus's user list, which carries the module's permissions at its new fingerprint.
+	holder, err := s.busHolder(ctx)
+	if err != nil {
+		return said, err
+	}
+	if holder != "" && !inList(nodes, holder) {
+		if err := s.compose(ctx, []string{holder}); err != nil {
+			return said, err
+		}
+	}
+	// Then the grant, which with the composition lets a want name the fingerprint (rules 6 and 7).
+	if err := s.grants(ctx); err != nil {
+		return said, err
+	}
+	if said == "" {
+		said = fmt.Sprintf("%s at %s", module, short(trunk.FP2))
+	}
+	return said + "; composed for " + strings.Join(nodes, ", ") + ", its grant written", nil
+}
+
+func inList(list []string, s string) bool {
+	for _, v := range list {
+		if v == s {
+			return true
+		}
+	}
+	return false
+}
+
+// doneKeysMu keeps one take-in of a module's done key at a time in this process, per module.
+var doneKeysMu sync.Map
+
+// takeDoneKey is a woken module's take-in on the live stores and buckets, said. A take-in that fails (its compositions
+// or its grant not written) is tried again every doneKeyRetry while it fails, loudly: printed each time, and an urgent
+// condition raised by the first until it has worked, as the chain's own moves are (layBuildsOutSoon). A key not done
+// yet is no failure: its next write wakes this again.
+func takeDoneKey(ctx context.Context, open *stores, module string) {
+	mu, _ := doneKeysMu.LoadOrStore(module, &sync.Mutex{})
+	mu.(*sync.Mutex).Lock()
+	defer mu.(*sync.Mutex).Unlock()
+	failed := false
+	for {
+		err := takeDoneKeyOnce(ctx, open, module)
+		o := doneKeyObservation(module)
+		if err == nil || errors.Is(err, errKeyWaits) {
+			if keeper := conditionsFrom; keeper != nil && failed {
+				_, _ = keeper.Clear(ctx, o.Key(), "composed and granted")
+			}
+			return
+		}
+		fmt.Printf("done keys: %s: %v; tried again in %s\n", module, err, doneKeyRetry)
+		if keeper := conditionsFrom; keeper != nil && !failed {
+			o.Summary += err.Error()
+			if _, oerr := keeper.Observe(ctx, o); oerr == nil {
+				failed = true
+			}
+		}
+		select {
+		case <-ctx.Done():
+			return
+		case <-time.After(doneKeyRetry):
+		}
+	}
+}
+
+// doneKeyRetry is how long a failed take-in of a done key waits before it tries again.
+var doneKeyRetry = 30 * time.Second
+
+// kindNotComposed is the condition of a module's new fingerprint whose compositions or grant are not written: until
+// they are, no want can name it.
+const kindNotComposed = "fingerprint-not-composed"
+
+func doneKeyObservation(module string) conditions.Observation {
+	return conditions.Observation{Scope: conditions.ScopeBuild, ID: module, Token: kindNotComposed, Kind: kindNotComposed,
+		Severity: conditions.Urgent, Resolver: conditions.ResolverOperator, Source: "done keys",
+		Summary: module + "'s new fingerprint is not composed or granted, so no want can name it: "}
+}
+
+// takeDoneKeyOnce is one take-in of a module's done key.
+func takeDoneKeyOnce(ctx context.Context, open *stores, module string) error {
+	keys, closeKeys, err := openBuilderKeys()
+	if err != nil {
+		return fmt.Errorf("the builder's keys cannot be read: %w", err)
+	}
+	defer closeKeys()
+	said, err := liveDoneKeySteps(open, keys).take(ctx, module)
+	if err == nil && said != "" {
+		fmt.Printf("done keys: %s\n", said)
+	}
+	return err
+}
+
+// liveDoneKeySteps are the steps on the controller's own stores and the bus.
+func liveDoneKeySteps(open *stores, keys registerKeys) doneKeySteps {
+	inv := open.inventory
+	return doneKeySteps{
+		held: func(ctx context.Context, module string) (bool, error) {
+			_, err := inv.SourceOf(ctx, module)
+			if errors.Is(err, inventory.ErrNoSuchModule) {
+				return false, nil
+			}
+			return err == nil, err
+		},
+		trunk: func(ctx context.Context, module string) (sdkdelivery.Module, error) {
+			return keys.ModuleAt(ctx, module, "")
+		},
+		registeredAt: func(ctx context.Context, module, commit string) (bool, error) {
+			src, err := inv.SourceOf(ctx, module)
+			if err != nil {
+				return false, err
+			}
+			return sameCommitID(src.BuiltFrom, commit), nil
+		},
+		takeIn: func(ctx context.Context, module string, trunk sdkdelivery.Module) error {
+			_, _, err := takeInKey(ctx, inv, keys, keyTake{Module: module, Trunk: trunk, Ask: registrationAsk{Merge: trunk.Commit}})
+			if errors.Is(err, inventory.ErrSuperseded) {
+				return nil
+			}
+			return err
+		},
+		nodesOf: func(ctx context.Context, module string) ([]string, error) {
+			entries, err := inv.Catalogued(ctx)
+			if err != nil {
+				return nil, err
+			}
+			for _, e := range entries {
+				if e.Manifest.Module == module {
+					return e.On, nil
+				}
+			}
+			return nil, nil
+		},
+		busHolder: func(ctx context.Context) (string, error) {
+			holders, err := seatHolders(ctx, inv)
+			if err != nil {
+				return "", err
+			}
+			return holders[catalogue.BrokerSeat].Node, nil
+		},
+		compose: func(ctx context.Context, nodes []string) error {
+			_, err := composeModules(ctx, open, nodes)
+			return err
+		},
+		grants: func(ctx context.Context) error {
+			bus, err := aBus()
+			if err != nil {
+				return err
+			}
+			defer bus.Close()
+			js, err := jetstream.New(bus.Conn())
+			if err != nil {
+				return err
+			}
+			return grantsIssued(ctx, inv, js, "done keys: ")
+		},
+	}
+}
+
+// watchDoneKeys wakes the take-in of a module's done key for each module the builder or the indexer writes, until ctx
+// ends: never on the watch's own goroutine.
+func watchDoneKeys(ctx context.Context, open *stores) {
+	keys, closeKeys, err := openBuilderKeys()
+	if err != nil {
+		fmt.Printf("done keys: the builder's keys are not watched: %v\n", err)
+		return
+	}
+	if err := builderkeys.Watch(ctx, keys.JS, func(module string) {
+		inBackground(func() { takeDoneKey(ctx, open, module) })
+	}); err != nil {
+		closeKeys()
+		fmt.Printf("done keys: the builder's keys are not watched: %v\n", err)
+		return
+	}
+	go func() {
+		<-ctx.Done()
+		closeKeys()
+	}()
+}