Bring the look back for a tier the bus refused whole, clear the wait when it ends, and say the wait in plain words (issue 1334, review round 1)

Makefile

@@ -90,6 +90,15 @@ redis-provisioner-image:
 	@echo
 	@docker image inspect $(REDIS_PROVISIONER_IMAGE) --format 'built {{.RepoTags}}  {{.Size}} bytes'
 
+# The proxy that turns a route grant into traffic reaching a workload.
+PROXY_IMAGE ?= mesh-route-proxy:$(VERSION)
+PROXY_DEV_TAG ?= mesh-route-proxy:development
+
+proxy-image:
+	docker build --build-arg GO_BASE=$(GO_BASE) -f modules/route-proxy/Dockerfile -t $(PROXY_IMAGE) -t $(PROXY_DEV_TAG) .
+	@echo
+	@docker image inspect $(PROXY_IMAGE) --format 'built {{.RepoTags}}  {{.Size}} bytes'
+
 # The whole check. Raises a database, runs the repository's own check against it -- merge-check.sh,
 # the very script `mesh/repo-check` runs -- and takes the database down again, including when the
 # check fails, which is why the teardown is not conditional and the script's exit status is the
@@ -108,7 +117,7 @@ redis-provisioner-image:
 # as the script runs them: a bus per test, of the release the mesh runs, makes the suite the same in any
 # order, and the timeout bounds a hang to a failure with a stack, never a stalled gate.
 check: postgres
-	@sh merge-check.sh ; status=$$? ; docker rm -f -v $(PG_CONTAINER) >/dev/null 2>&1 || true ; exit $$status
+	@sh merge-check.sh ; status=$$? ; docker rm -f $(PG_CONTAINER) >/dev/null 2>&1 || true ; exit $$status
 
 # The unit level alone (untagged: no bus, no store, no other process), which a developer runs continuously. The tests
 # that need a bus or the store carry `//go:build integration` and run in `check`, not here; without a database the
@@ -126,7 +135,7 @@ fmt:
 	if [ -n "$$unformatted" ] ; then echo "not gofmt'd:" ; echo "$$unformatted" ; exit 1 ; fi
 
 postgres:
-	@docker rm -f -v $(PG_CONTAINER) >/dev/null 2>&1 || true
+	@docker rm -f $(PG_CONTAINER) >/dev/null 2>&1 || true
 	@docker run -d --name $(PG_CONTAINER) -e POSTGRES_PASSWORD=check \
 		-p 127.0.0.1:$(PG_PORT):5432 $(PG_IMAGE) >/dev/null
 	@printf 'waiting for postgres'
@@ -138,7 +147,7 @@ postgres:
 	echo ' — never came up' ; docker logs $(PG_CONTAINER) | tail -20 ; exit 1
 
 postgres-stop:
-	@docker rm -f -v $(PG_CONTAINER) >/dev/null 2>&1 || true
+	@docker rm -f $(PG_CONTAINER) >/dev/null 2>&1 || true
 
 clean:
 	rm -rf build/

cmd/mesh-builder/busy.go

@@ -6,11 +6,7 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
-	"sync"
-	"sync/atomic"
 	"time"
-
-	"github.com/novox/mesh-controller/internal/builder"
 )
 
 // **The build agent says whether it is busy, and being asked drains it** (novox/hq ADR 0335 §1, §5). Its
@@ -77,77 +73,14 @@ func drainedTooLong(now time.Time) error {
 		"within %s (novox/hq ADR 0335)", began.UTC().Format(time.RFC3339), drainTooLong)
 }
 
-// inHand is true while this process has claimed a build and not yet released it. The mark in the temporary directory
-// is only believed while it is: a mark with no build of this process behind it is stale (a crash, a fault in an
-// earlier path) and is removed, because left alone it hands back every ask for ever (issue 1768).
-var inHand atomic.Bool
-
-// markRetry is how long an agent that cannot mark a build in hand takes no work, and markFault when it last failed to.
-// Taking nothing is the point: an ask fetched and handed back at once, many times a second, spends all its deliveries.
-const markRetry = 30 * time.Second
-
-var (
-	markMu    sync.Mutex
-	markFault time.Time
-	markSaid  string
-)
-
-// markFaulty says the agent could not mark a build in hand and has not yet been able to since: it takes no work. Once
-// markRetry has passed it tries the mark itself, with no ask in hand, so that an ask is fetched only when marking works.
-func markFaulty(now time.Time) bool {
-	markMu.Lock()
-	failed := markFault
-	markMu.Unlock()
-	if failed.IsZero() {
-		return false
-	}
-	if now.Sub(failed) < markRetry {
-		return true
-	}
-	f, err := os.OpenFile(inHandMark(), os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0o644)
-	if err != nil && errors.Is(err, os.ErrExist) && !inHand.Load() {
-		_ = os.Remove(inHandMark())
-		f, err = os.OpenFile(inHandMark(), os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0o644)
-	}
-	if err != nil {
-		markFailed(err)
-		return true
-	}
-	_ = f.Close()
-	_ = os.Remove(inHandMark())
-	markMu.Lock()
-	markFault, markSaid = time.Time{}, ""
-	markMu.Unlock()
-	fmt.Fprintf(os.Stderr, "the mark of a build in hand can be made again (%s): taking builds\n", inHandMark())
-	return false
-}
-
-// markFailed notes that a build could not be marked in hand, and says it when it is a new reason.
-func markFailed(err error) {
-	markMu.Lock()
-	defer markMu.Unlock()
-	markFault = time.Now()
-	if said := err.Error(); said != markSaid {
-		markSaid = said
-		fmt.Fprintf(os.Stderr, "cannot mark a build in hand (%s), so this agent takes no build for %s and tries again: %v\n",
-			inHandMark(), markRetry, err)
-	}
-}
-
 // claim marks a request in hand, unless the agent is drained: then nothing is in hand, and the request goes
 // back to the queue.
 func claim() bool {
-	if !inHand.Load() {
-		// Nothing of this process is in hand, so a mark already there is stale.
-		if err := os.Remove(inHandMark()); err == nil {
-			fmt.Fprintf(os.Stderr, "removed the mark of a build in hand (%s): no build of this agent is in hand\n", inHandMark())
-		}
-	}
 	// Made, never written over: one build at a time, and a mark already there is a build in hand.
 	f, err := os.OpenFile(inHandMark(), os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0o644)
 	if err != nil {
 		// Unmarked, an ask would say idle while this build runs: the build is not taken.
-		markFailed(err)
+		fmt.Fprintf(os.Stderr, "cannot mark a build in hand (%s), so it is handed back: %v\n", inHandMark(), err)
 		return false
 	}
 	_, err = f.WriteString(time.Now().UTC().Format(time.RFC3339) + "\n")
@@ -156,7 +89,7 @@ func claim() bool {
 	}
 	if err != nil {
 		_ = os.Remove(inHandMark())
-		markFailed(err)
+		fmt.Fprintf(os.Stderr, "cannot mark a build in hand (%s), so it is handed back: %v\n", inHandMark(), err)
 		return false
 	}
 	if drained() {
@@ -164,7 +97,6 @@ func claim() bool {
 		fmt.Fprintln(os.Stderr, "asked whether busy, so this agent takes no new build: handed back")
 		return false
 	}
-	inHand.Store(true)
 	return true
 }
 
@@ -175,7 +107,6 @@ func holding(what string) {
 
 // released ends the build in hand.
 func released() {
-	inHand.Store(false)
 	if err := os.Remove(inHandMark()); err != nil && !errors.Is(err, os.ErrNotExist) {
 		fmt.Fprintf(os.Stderr, "cannot remove the mark of the build in hand (%s): %v\n", inHandMark(), err)
 	}
@@ -213,23 +144,3 @@ func busy() (string, error) {
 	}
 	return fmt.Sprintf("busy: %s, in hand since %s; taking no new build", what, since), nil
 }
-
-var (
-	roomMu   sync.Mutex
-	roomSaid bool
-)
-
-// noRoom says this node is under the floor of free space (novox/hq issue 1834): it takes no work, so another build node
-// takes the ask instead of this one taking it and ending it in an error. Said once when it starts and again when it ends.
-func noRoom(workspace string) bool {
-	err := builder.RoomToWork("/", workspace)
-	roomMu.Lock()
-	defer roomMu.Unlock()
-	if err != nil && !roomSaid {
-		fmt.Fprintf(os.Stderr, "taking no builds: %v\n", err)
-	} else if err == nil && roomSaid {
-		fmt.Fprintf(os.Stderr, "there is room again: taking builds\n")
-	}
-	roomSaid = err != nil
-	return err != nil
-}

cmd/mesh-builder/busy_test.go

@@ -1,7 +1,6 @@
 package main
 
 import (
-	"github.com/novox/mesh-controller/internal/builder"
 	"os"
 	"strings"
 	"sync"
@@ -161,79 +160,3 @@ func TestAnUnknownCommandFails(t *testing.T) {
 		t.Fatalf("help failed: %v", err)
 	}
 }
-
-// 1768/AC2: a mark naming no build of this agent (left by a crash or a fault) is stale: the next ask removes it and is
-// run, never fetched and handed back in a loop.
-func TestAStaleInHandMarkIsRemovedAndTheAskRuns(t *testing.T) {
-	t.Setenv("TMPDIR", t.TempDir())
-	inHand.Store(false)
-	if err := undrained(); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(inHandMark(), []byte("2026-10-21T18:45:06Z\n"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	if !claim() {
-		t.Fatal("a stale in-hand mark made the agent hand back an ask")
-	}
-	// A live one — this agent's own build in hand — is never taken over.
-	if claim() {
-		t.Fatal("a second build was taken while one is in hand")
-	}
-	if _, err := busy(); err != nil {
-		t.Fatalf("the build in hand was lost: %v", err)
-	}
-	released()
-}
-
-// 1768/AC3: an agent that cannot mark a build in hand for another reason takes no work, instead of fetching asks and
-// handing them back; it takes work again once marking works.
-func TestAnAgentThatCannotMarkABuildTakesNoWorkUntilItCan(t *testing.T) {
-	dir := t.TempDir()
-	t.Setenv("TMPDIR", dir)
-	inHand.Store(false)
-	markFault, markSaid = time.Time{}, ""
-	t.Cleanup(func() { markFault, markSaid = time.Time{}, "" })
-	if err := undrained(); err != nil {
-		t.Fatal(err)
-	}
-	// The mark's place is a directory that cannot be removed or made over: a directory named as the mark.
-	if err := os.MkdirAll(inHandMark()+"/x", 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if claim() {
-		t.Fatal("an agent that cannot mark a build took it")
-	}
-	if !markFaulty(time.Now()) {
-		t.Fatal("an agent that cannot mark a build still takes work")
-	}
-	// Still failing after the retry time: still takes nothing, and no ask was needed to find out.
-	if !markFaulty(time.Now().Add(2 * markRetry)) {
-		t.Fatal("an agent whose mark still cannot be made takes work")
-	}
-	if err := os.RemoveAll(inHandMark()); err != nil {
-		t.Fatal(err)
-	}
-	if markFaulty(time.Now().Add(4 * markRetry)) {
-		t.Fatal("an agent whose mark can be made again takes no work")
-	}
-	if !claim() {
-		t.Fatal("an agent that can mark takes no build")
-	}
-	released()
-}
-
-// 1834/AC4: given a node under the floor of free space, when the taking loop asks, then it takes nothing, and takes again
-// once there is room.
-func TestANodeUnderTheFloorOfFreeSpaceTakesNoWork(t *testing.T) {
-	was := builder.FreeBytes
-	t.Cleanup(func() { builder.FreeBytes = was })
-	builder.FreeBytes = func(string) (uint64, error) { return 2 << 30, nil }
-	if !noRoom(t.TempDir()) {
-		t.Error("a node with 2 GiB free took work")
-	}
-	builder.FreeBytes = func(string) (uint64, error) { return 200 << 30, nil }
-	if noRoom(t.TempDir()) {
-		t.Error("a node with 200 GiB free refused work")
-	}
-}

cmd/mesh-builder/check_spec_test.go

@@ -36,17 +36,3 @@ func TestTheSiblingsAnAskNamesReachTheSpecAndTheOutcome(t *testing.T) {
 		t.Fatalf("a request that names none has siblings %+v", plain.Siblings)
 	}
 }
-
-// 1826/AC2: the held values a check request carries reach the spec; a request that carries none leaves it empty.
-func TestTheHeldValuesAnAskCarriesReachTheSpec(t *testing.T) {
-	spec := checkSpecOf(link.BuildRequest{Check: &link.CheckRequest{Owner: "novox", Repo: "mesh-catalog",
-		HeldConfig: []link.HeldConfig{{Pull: "novox/mesh-catalog#434", Head: "a", Node: "ace", Module: "n8n", Key: "media-gid",
-			Value: []byte("2000"), Approved: "the operator"}}}})
-	if len(spec.Held) != 1 || spec.Held[0].Node != "ace" || spec.Held[0].Key != "media-gid" || string(spec.Held[0].Value) != "2000" ||
-		spec.Held[0].Approved != "the operator" {
-		t.Fatalf("the spec reads %+v", spec.Held)
-	}
-	if plain := checkSpecOf(link.BuildRequest{Check: &link.CheckRequest{Owner: "o", Repo: "r"}}); plain.Held != nil {
-		t.Fatalf("a request that carries none has %+v", plain.Held)
-	}
-}

cmd/mesh-builder/holder.go

@@ -14,8 +14,8 @@ import (
 
 	"github.com/nats-io/nats.go/micro"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/builder"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/link"
 )
 

cmd/mesh-builder/holder_test.go

@@ -91,7 +91,7 @@ func TestKillEndsTheBuildRunningHereAndNoOther(t *testing.T) {
 		t.Errorf("kill said %q", said)
 	}
 	// Removed at the kill and again once the build had ended: a container made in between is caught.
-	if len(removed) != 6 || !strings.Contains(removed[0], "label=mesh.build=build-1") || !strings.Contains(removed[3], "label=mesh.build=build-1") {
+	if len(removed) != 4 || !strings.Contains(removed[0], "label=mesh.build=build-1") || !strings.Contains(removed[2], "label=mesh.build=build-1") {
 		t.Errorf("removed %v", removed)
 	}
 	if c := h.current(); c.Running != nil {
@@ -160,7 +160,7 @@ func TestAHolderStartingRemovesWhatEarlierBuildsLeftHere(t *testing.T) {
 		}
 		return "", nil
 	}
-	if n := h.removeLeftBehind(); n != 2 || len(removed) != 3 || removed[2] != "docker rm -f -v c1 c2" {
+	if n := h.removeLeftBehind(); n != 2 || len(removed) != 2 || removed[1] != "docker rm -f c1 c2" {
 		t.Fatalf("removed %d: %v", n, removed)
 	}
 	h.remove = func(context.Context, string, string, ...string) (string, error) {

cmd/mesh-builder/main.go

@@ -64,8 +64,6 @@ is dialled except the broker.
   MESH_NPM_TOKEN     the token for it, likewise
   MESH_NPM_SCOPE     the scope it answers for (default: @novox)
   MESH_WORKSPACE     where to clone and build (default: a temporary directory)
-  MESH_BUILD_CGROUP_PARENT  the slice every container a build or check starts joins, which carries the
-                     machine's limits on builds (novox/hq issue 1798; default: the runtime's own)
 
 It also builds one module and stops, which is how a mesh is raised — before there is a
 broker to take work from or a registry to publish into:
@@ -139,10 +137,6 @@ func run() error {
 	if err != nil {
 		return err
 	}
-	// A build and a check run below the machine's own work (novox/hq issue 1798): the agent itself at the
-	// lowest priority, which its git and go children inherit, and every container in the build slice.
-	_ = syscall.Setpriority(syscall.PRIO_PROCESS, 0, 19)
-	builder.CgroupParent = strings.TrimSpace(os.Getenv("MESH_BUILD_CGROUP_PARENT"))
 	workspace := os.Getenv("MESH_WORKSPACE")
 	if workspace == "" {
 		workspace = os.TempDir() + "/mesh-builder"
@@ -190,7 +184,7 @@ func run() error {
 	// Paused or drained, it takes nothing new (novox/hq ADR 0219, ADR 0335): a drained agent finishes the build
 	// in hand and then says idle, and its container is replaced between builds.
 	machine := link.MachineOverNATSWith(js, on, seat, link.MachineOptions{
-		Paused: func() bool { return h.Paused() || drained() || markFaulty(time.Now()) || noRoom(workspace) },
+		Paused: func() bool { return h.Paused() || drained() },
 		Taking: func() { taking(seat) },
 		Claim:  claim,
 	})
@@ -505,10 +499,6 @@ func checkSpecOf(request link.BuildRequest) builder.CheckSpec {
 		Modules: c.Modules, New: c.New, Manifests: c.Manifests, Judge: c.Judge, Base: c.Base,
 		Toolchain: builder.ToolchainOf(request.Held), Toolchains: builder.ToolchainsOf(request.Held),
 		Tests: c.Tests, StoreOnly: c.StoreOnly, SiblingsUnknown: c.SiblingsUnknown}
-	for _, h := range c.HeldConfig {
-		spec.Held = append(spec.Held, builder.HeldValue{Pull: h.Pull, Head: h.Head, Node: h.Node, Module: h.Module, Key: h.Key,
-			Value: h.Value, Approved: h.Approved, By: h.By, At: h.At})
-	}
 	for _, s := range c.Siblings {
 		spec.Siblings = append(spec.Siblings, builder.Sibling{Repository: s.Repository, Number: s.Number, Head: s.Head,
 			Base: s.Base, Dir: s.Dir})

cmd/mesh-controller/accept_outside.go

@@ -6,7 +6,7 @@ import (
 	"sort"
 	"strings"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
@@ -55,8 +55,6 @@ func offeredOutsideBy(ctx context.Context, provision string) (string, error) {
 // its next send would, and the machines that could not be resolved, with why.
 func consumersFrom(ctx context.Context, open *stores, provider, providerModule, provision string) (
 	[]inventory.PairEnd, []string, error) {
-	// One reading of the mesh for every machine this looks at.
-	ctx = withInputCache(ctx)
 	nodes, err := open.inventory.Nodes(ctx)
 	if err != nil {
 		return nil, nil, err
@@ -64,7 +62,7 @@ func consumersFrom(ctx context.Context, open *stores, provider, providerModule,
 	var out []inventory.PairEnd
 	var unresolved []string
 	for _, n := range nodes {
-		plan, _, err := resolveNode(ctx, open, n.Name)
+		plan, _, err := planFor(ctx, open, n.Name)
 		if err != nil {
 			unresolved = append(unresolved, fmt.Sprintf("%s: %s", n.Name, oneLine(err.Error())))
 			continue

cmd/mesh-controller/acts.go

@@ -10,7 +10,7 @@ import (
 	"strings"
 	"time"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
@@ -314,7 +314,7 @@ type afterAct struct {
 // after the write, which can only find more unmet than the closure would: a seat said held there is
 // held in the closure too.
 func resolvedAfter(ctx context.Context, open *stores, shelf map[string]catalogue.Manifest, node string) afterAct {
-	plan, _, err := resolveNode(ctx, open, node)
+	plan, _, err := planFor(ctx, open, node)
 	if err == nil {
 		out := afterAct{plan: plan, unheld: plan.Unheld}
 		for _, m := range plan.Modules {
@@ -355,8 +355,6 @@ func splitModules(field string) []string {
 // Nothing here can fail the act it reports on. A mesh that cannot be read is worth saying and is
 // not a reason to claim the assignment did not happen — it did.
 func blockedElsewhere(ctx context.Context, open *stores, except string) string {
-	// One reading of the mesh for every machine this looks at.
-	ctx = withInputCache(ctx)
 	nodes, err := open.inventory.Nodes(ctx)
 	if err != nil {
 		return "\n\nThe rest of the mesh could not be checked: " + err.Error()
@@ -366,7 +364,7 @@ func blockedElsewhere(ctx context.Context, open *stores, except string) string {
 		if n.Name == except {
 			continue
 		}
-		if _, _, err := resolveNode(ctx, open, n.Name); err != nil {
+		if _, _, err := planFor(ctx, open, n.Name); err != nil {
 			blocked[n.Name] = err.Error()
 		}
 	}
@@ -408,21 +406,12 @@ func issueOnAssign(ctx context.Context, open *stores, node, module string) strin
 		return ""
 	}
 	user := broker.Principal{Kind: broker.KindModule, Node: node, Module: module}.Username()
-	_, reads := m.OwnSecrets["broker"]
-	if !reads && !runsTheProvisionerClient(m) {
-		// A module whose bus accounts are its processes' alone has none of its own: only the processes that
-		// are not issued yet are issued (issue 1226).
-		return processAccountsOnAssign(ctx, inv, m, node)
-	}
-	if !reads {
+	if _, reads := m.OwnSecrets["broker"]; !reads {
 		// A module running the provisioner client alone is minted the client's account (issue 917).
 		user = broker.Principal{Kind: broker.KindProvisioner, Node: node, Module: module}.Username()
 	}
-	if _, minted, err := inv.BusUserHash(ctx, user); err != nil {
+	if _, minted, err := inv.BusUserHash(ctx, user); err != nil || minted {
 		return ""
-	} else if minted {
-		// Its own account stands and is kept; a process it gained is not issued yet (issue 1226).
-		return processAccountsOnAssign(ctx, inv, m, node)
 	}
 	busAddress, err := broker.BusAddress()
 	if err == nil {
@@ -435,16 +424,6 @@ func issueOnAssign(ctx context.Context, open *stores, node, module string) strin
 	return fmt.Sprintf("its bus credential is issued and sealed to %s, and arrives with the push", node)
 }
 
-// processAccountsOnAssign issues the process accounts of an assigned module not issued yet, and says what it did.
-func processAccountsOnAssign(ctx context.Context, inv *inventory.Inventory, m catalogue.Manifest, node string) string {
-	line, err := issueMissingProcessAccounts(ctx, inv, m, node)
-	if err != nil {
-		return fmt.Sprintf("its process accounts are not issued (%v): `module issue %s --node %s` first — "+
-			"`push %s` refuses to send %s until it is", err, m.Module, node, node, m.Module)
-	}
-	return line
-}
-
 // refusedMovingTheController refuses assigning or unassigning the controller's module through a verb (review of
 // novox/hq ADR 0272): the node it is assigned to is the control-node, and the control-node's operator account is
 // the controller's terminal, so whoever moves the module chooses the terminal. At the terminal alone, as every

cmd/mesh-controller/acts_test.go

@@ -6,7 +6,7 @@ import (
 	"strings"
 	"testing"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-controller/internal/catalogue"
 )
 
 // What an assignment says about the machines it was not about.

cmd/mesh-controller/addresses_integration_test.go

@@ -8,7 +8,7 @@ import (
 	"strings"
 	"testing"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/licences"
 )

cmd/mesh-controller/addresses_test.go

@@ -5,7 +5,7 @@ import (
 	"strings"
 	"testing"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/link"
 )
 

cmd/mesh-controller/adopting_test.go

@@ -12,10 +12,10 @@ import (
 	"testing"
 	"time"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/overlay"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
+	"github.com/novox/mesh-controller/internal/overlay"
 )
 
 // novox/hq ADR 0100: taking a module is its cutover; converging a node is one act, previewed, and

cmd/mesh-controller/adoption.go

@@ -12,9 +12,9 @@ import (
 	"strings"
 	"time"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/overlay"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/overlay"
 )
 
 // A node is adopted or converged (novox/hq ADR 0100), and it is said to be adopted wherever the
@@ -243,7 +243,7 @@ func take(ctx context.Context, open *stores, node, module string, opts takeOptio
 		return "", err
 	}
 	if !slices.Contains(assigned, module) {
-		if plan, _, err := resolveNode(ctx, open, node); err == nil {
+		if plan, _, err := planFor(ctx, open, node); err == nil {
 			if why, runs := plan.Because[module]; runs {
 				return "", fmt.Errorf("%w: %s runs on %s because %s — assign it to %s to take it",
 					inventory.ErrNotAssigned, module, node, why, node)
@@ -649,7 +649,7 @@ func converge(ctx context.Context, open *stores, node string, yes bool, digest s
 	if err != nil {
 		return "", err
 	}
-	plan, _, err := resolveNode(ctx, open, node)
+	plan, settings, err := planFor(ctx, open, node)
 	if err != nil {
 		return "", err
 	}
@@ -706,8 +706,11 @@ func converge(ctx context.Context, open *stores, node string, yes bool, digest s
 			filter)
 	}
 
-	// What the filter is derived from: the rendering of this machine as a question reads it, with the private network.
-	with, err := renderingOf(ctx, open, node)
+	gens, err := generators(ctx, open)
+	if err != nil {
+		return "", err
+	}
+	with, _, err := renderingFor(ctx, open, node, plan, settings, gens, Reading)
 	if err != nil {
 		return "", err
 	}
@@ -773,7 +776,7 @@ func converge(ctx context.Context, open *stores, node string, yes bool, digest s
 		if _, err := inv.Assign(ctx, node, filter); err != nil {
 			return "", err
 		}
-		if _, _, err := resolveNode(ctx, open, node); err != nil {
+		if _, _, err := planFor(ctx, open, node); err != nil {
 			_ = inv.Unassign(ctx, node, filter)
 			return "", fmt.Errorf("%s cannot run %s, so it was not converged: %w", node, filter, err)
 		}

cmd/mesh-controller/agent_account_integration_test.go

@@ -7,8 +7,8 @@ import (
 	"testing"
 	"time"
 
-	snapshot "git.novox.be/novox/mesh-sdk/go/facts"
 	"github.com/novox/mesh-controller/internal/conditions"
+	snapshot "github.com/novox/mesh-controller/internal/facts"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 	"github.com/novox/mesh-host/rootsearch"

cmd/mesh-controller/agent_account_test.go

@@ -5,7 +5,7 @@ import (
 	"testing"
 	"time"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"

cmd/mesh-controller/ask_bus_look_integration_test.go

@@ -9,7 +9,7 @@ import (
 	"testing"
 	"time"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
@@ -31,7 +31,6 @@ func TestALookComesBackForATierTheBusRefusedWhole(t *testing.T) {
 		t.Fatal(err)
 	}
 	bus := false
-	asksOfEveryModule(t) // the one ask left is the builder's own (ADR 0453 §5): this test is of what a walk does around it
 	was := askABuild
 	askABuild = func(_ context.Context, source buildSource, _, _ string) (string, error) {
 		if !bus {
@@ -96,7 +95,6 @@ func TestALookFailsTheTierTheBusRefusedPastTheBound(t *testing.T) {
 	if err := inv.SavePlan(ctx, &p); err != nil {
 		t.Fatal(err)
 	}
-	asksOfEveryModule(t) // the one ask left is the builder's own (ADR 0453 §5): this test is of what a walk does around it
 	was := askABuild
 	askABuild = func(context.Context, buildSource, string, string) (string, error) {
 		return "", fmt.Errorf("%w: nats: no responders available for request", inventory.ErrNoChain)
@@ -116,6 +114,11 @@ func TestALookFailsTheTierTheBusRefusedPastTheBound(t *testing.T) {
 		t.Fatalf("a bus silent past its bound did not fail the plan in words: %s %q", got.State, got.Note)
 	}
 
+	// Rebuilt by hand while the bus still reloads: said as waiting, not as a failure and not with an empty reason.
+	joined, said, err := joinAPlan(ctx, open, "a")
+	if err != nil || !joined || !strings.Contains(said, "not asked yet: the bus did not answer") {
+		t.Fatalf("a rebuild left for the bus is said as %v %q %v", joined, said, err)
+	}
 	// And retried by hand: the module is named as waiting, not as asked again.
 	got, _ = inv.PlanByID(ctx, "plan-bus")
 	if got.State == inventory.PlanFailed {

cmd/mesh-controller/ask_bus_moment_test.go

@@ -15,15 +15,6 @@ import (
 // seconds) is not a failed build. The module is left unasked and the plan building, and the next look asks it again; only a
 // module's own fault, or a bus silent for ten minutes, fails the plan.
 
-// asksOfEveryModule makes every module a test names the builder's own, the one module a walk still asks build-agent
-// for (ADR 0453 §5): what a test of that ask's waits reads.
-func asksOfEveryModule(t *testing.T) {
-	t.Helper()
-	was := buildersOwn
-	buildersOwn = func(string) bool { return true }
-	t.Cleanup(func() { buildersOwn = was })
-}
-
 func aTierOfThree() (*inventory.Plan, map[string]inventory.Entry) {
 	p := &inventory.Plan{ID: "plan-1", State: inventory.PlanBuilding, Tiers: [][]string{{"a", "b", "c"}},
 		Modules: map[string]*inventory.PlanModule{}}
@@ -35,7 +26,6 @@ func aTierOfThree() (*inventory.Plan, map[string]inventory.Entry) {
 }
 
 func TestABusThatDoesNotAnswerForAMomentDoesNotFailTheTier(t *testing.T) {
-	asksOfEveryModule(t)
 	p, byName := aTierOfThree()
 	bus := false
 	was := askABuild
@@ -78,7 +68,6 @@ func TestABusThatDoesNotAnswerForAMomentDoesNotFailTheTier(t *testing.T) {
 }
 
 func TestABusSilentForTenMinutesFailsTheTierAsBefore(t *testing.T) {
-	asksOfEveryModule(t)
 	p, byName := aTierOfThree()
 	was := askABuild
 	askABuild = func(context.Context, buildSource, string, string) (string, error) {
@@ -130,7 +119,6 @@ func TestAPlanWithAModuleWaitingForTheBusIsOneTheLookComesBackTo(t *testing.T) {
 }
 
 func TestAModulesOwnFaultStillFailsThePlan(t *testing.T) {
-	asksOfEveryModule(t)
 	p, byName := aTierOfThree()
 	delete(byName, "a")
 	askModule(t.Context(), p, "a", byName)

cmd/mesh-controller/ask_bus_wait_test.go

@@ -1,23 +0,0 @@
-package main
-
-import (
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// A retry of a plan failed past the bus's bound, whose module the bus still does not answer, names that module as waiting:
-// read while the plan still says failed, it was named nowhere, and the retry said "asked" with nothing after it (issue
-// 1403, met again once the hand rebuild no longer resumed the plan first).
-func TestARetryNamesTheModulesStillWaitingForTheBus(t *testing.T) {
-	since := time.Now().UTC()
-	p := inventory.Plan{ID: "plan-bus", State: inventory.PlanFailed, Tiers: [][]string{{"a"}},
-		Modules: map[string]*inventory.PlanModule{"a": {BusWaitFrom: &since}}}
-	waiting := busWaitingOnRetry(p)
-	_, said := retryWords(p, []string{"a"}, nil, waiting)
-	if !strings.Contains(said, "a not asked yet: the bus did not answer") || strings.Contains(said, "asked ;") {
-		t.Fatalf("a retry left for the bus is said as %q", said)
-	}
-}

cmd/mesh-controller/asker.go

@@ -645,10 +645,6 @@ func doesWords(act conditions.Action) string {
 		return "the delivery is stopped"
 	case act.Verb == broker.ControllerSeat+".plans" && act.Arguments["retry"] != "":
 		return "the failed builds are asked again"
-	case act.Verb == broker.ControllerSeat+".push" && act.Arguments["node"] != "":
-		return "the held builds are sent to " + act.Arguments["node"]
-	case act.Verb == broker.ControllerSeat+".upgrade" && act.Arguments["release-backlog"] != "":
-		return "the builds held after the failed delivery are released"
 	case strings.HasSuffix(act.Verb, ".restart"):
 		return "its service is restarted on " + act.Machine
 	}

cmd/mesh-controller/asker_wire.go

@@ -19,8 +19,8 @@ import (
 
 	"git.novox.be/novox/mesh-sdk/go/asks"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"

cmd/mesh-controller/awaiting_push_integration_test.go

@@ -8,11 +8,10 @@ import (
 	"testing"
 	"time"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/compose"
-	"git.novox.be/novox/mesh-sdk/go/overlay"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/overlay"
 )
 
 func TestAModuleAssignedAndNotPushedIsAwaitingAPushNotUncomposable(t *testing.T) {
@@ -26,13 +25,21 @@ func TestAModuleAssignedAndNotPushedIsAwaitingAPushNotUncomposable(t *testing.T)
 
 	// The read the rest of the mesh asks still refuses it, with the composer's typed error: nothing
 	// can be compared about a secret that does not exist (status), and nothing here string-matches.
-	_, _, err := composeQuestion(ctx, open, "laptop", compose.Reading, false)
+	plan, settings, err := planFor(ctx, open, "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	gens, err := generators(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, err = declarationWith(ctx, open, "laptop", plan, settings, gens, Reading)
 	var notMade *catalogue.NotMadeError
 	if !errors.As(err, &notMade) || notMade.Module != "keeper" || notMade.Name != "repository" {
 		t.Fatalf("a read composition did not say which secret is not made, typed: %v", err)
 	}
 	// Foreseen, it composes, names what the push makes, and made nothing.
-	foreseen, _, err := composeQuestion(ctx, open, "laptop", compose.Foreseeing, false)
+	foreseen, err := declarationWith(ctx, open, "laptop", plan, settings, gens, Foreseeing)
 	if err != nil || len(foreseen.foreseen) != 1 || foreseen.foreseen[0] != "keeper/repository" {
 		t.Fatalf("foreseen: %v %v", foreseen.foreseen, err)
 	}

cmd/mesh-controller/awaiting_push_test.go

@@ -4,7 +4,7 @@ import (
 	"testing"
 	"time"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
@@ -29,7 +29,7 @@ func aKeeper() catalogue.Manifest {
 func pushedBy(t *testing.T, open *stores, node string) string {
 	t.Helper()
 	ctx := t.Context()
-	plan, settings, err := resolveNode(ctx, open, node)
+	plan, settings, err := planFor(ctx, open, node)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -54,10 +54,11 @@ func pushedBy(t *testing.T, open *stores, node string) string {
 		if err != nil {
 			t.Fatal(err)
 		}
-		builds = map[string]string{}
+		names := make([]string, 0, len(plan.Modules))
 		for _, m := range plan.Modules {
-			builds[m.Module] = current[m.Module].Commit
+			names = append(names, m.Module)
 		}
+		builds = carriedBuilds(names, nil, current, nil)
 	}
 	if err := open.inventory.RecordSent(ctx, record.ID, digest, builds); err != nil {
 		t.Fatal(err)

cmd/mesh-controller/away_integration_test.go

@@ -13,8 +13,8 @@ import (
 
 	"github.com/nats-io/nats.go"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 	"github.com/novox/mesh-controller/internal/testbus"
@@ -68,7 +68,6 @@ func TestAPlanGoesOnWithoutAMachineAwayWhenItsTierIsSent(t *testing.T) {
 	var mu sync.Mutex
 	var asks []string
 	var sends [][]string
-	asksOfEveryModule(t) // the one ask left is the builder's own (ADR 0453 §5): this test is of what a walk does around it
 	wasAsk := askABuild
 	askABuild = func(_ context.Context, source buildSource, _, _ string) (string, error) {
 		mu.Lock()

cmd/mesh-controller/backups_before_send_integration_test.go

@@ -10,9 +10,9 @@ import (
 	"testing"
 	"time"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/nats-io/nats.go"
 	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 	"github.com/novox/mesh-controller/internal/testbus"

cmd/mesh-controller/batches.go

@@ -3,7 +3,6 @@ package main
 import (
 	"context"
 	"encoding/json"
-	"errors"
 	"fmt"
 	"os"
 	"slices"
@@ -125,67 +124,6 @@ func durationSetting(v any) (time.Duration, bool) {
 	return 0, false
 }
 
-// mergeFacts is what hearMerge judges a merge by, kept apart so the catch-up (ADR 0457) judges a merge the way hearing it will.
-type mergeFacts struct {
-	merged             time.Time
-	touches            []inventory.Entry
-	later              []inventory.BatchedMerge
-	owed               bool
-	from, packaging    []inventory.Entry
-	already            int
-	addsModuleToBuilds bool // a first merge into a repository the mesh builds nothing from: firstBuilds acts on it
-}
-
-// factsOfMerge reads what hearing a merge turns on: the modules it touches whatever the history, the later merges of its
-// branch, whether it is owed late, and the modules it moves.
-func factsOfMerge(ctx context.Context, inv *inventory.Inventory, m link.SourceMoved, now time.Time,
-	entries []inventory.Entry, read map[string][]inventory.ReadRepository) (mergeFacts, error) {
-	repository := m.Owner + "/" + m.Repo
-	f := mergeFacts{}
-	var err error
-	f.merged, err = time.Parse(time.RFC3339Nano, m.MergedAt)
-	if err != nil {
-		f.merged = now
-	}
-	// **What it touches, history or not** (review of this change): a merge heard after a later merge of its
-	// branch was cut reads as history for every module that cut marked seen, and was dropped from the record
-	// here, never named by the walk that carried it.
-	raw := m
-	raw.MergedAt = ""
-	f.touches = wouldMove(raw, entries, read)
-	if len(f.touches) > 0 {
-		if f.later, err = inv.LaterMergesOf(ctx, repository, m.Base, f.merged.UTC()); err != nil {
-			return f, err
-		}
-	}
-	if f.owed, err = owedLate(ctx, inv, m, f.merged, f.touches); err != nil {
-		return f, err
-	}
-	f.from, f.packaging, f.already = mergeCandidates(m, entries, read)
-	f.addsModuleToBuilds = f.already == 0 && len(addedDirs(m, entries, read)) > 0
-	return f, nil
-}
-
-// plans says hearing the merge puts it in a batch or a walk.
-func (f mergeFacts) plans() bool {
-	return len(f.from) > 0 || len(f.packaging) > 0 || len(f.later) > 0 || f.owed
-}
-
-// heldMerge marks a failure to act on a merge, whatever it was, as "not now": the announcement is held on the bus and
-// handed over again, so the merge joins the next batch, never taken (issue 1583, after 921). The bus acknowledges it
-// only when hearMerge answers without ErrTryAgain, and a merge heard once is not announced again: the bus answering
-// "jetstream not enabled", a bucket missing for a moment or a store read cut short each lost the merge when only an
-// outage of a known kind (notNow) was held. The delay between hands-over is bounded (link.MergeRedeliverAfter).
-func heldMerge(err error) error {
-	if err == nil {
-		return nil
-	}
-	if errors.Is(err, link.ErrTryAgain) {
-		return err
-	}
-	return fmt.Errorf("%w: the merge is not kept yet: %w", link.ErrTryAgain, err)
-}
-
 // hearMerge puts a merge the forge announced into the batch that answers it, at the moment it was heard,
 // and cuts what is due.
 func (f following) hearMerge(ctx context.Context, m link.SourceMoved, now time.Time) error {
@@ -196,7 +134,7 @@ func (f following) hearMerge(ctx context.Context, m link.SourceMoved, now time.T
 	inv := f.open.inventory
 	repository := m.Owner + "/" + m.Repo
 	if kept, known, err := inv.MergeOf(ctx, repository, m.Commit); err != nil {
-		return heldMerge(err)
+		return notNow(err)
 	} else if known {
 		fmt.Printf("%s merged into %s (%.8s) was heard before; %s answers it\n", repository, m.Base, m.Commit,
 			orWords(kept.Plan, "a walk of its own commit, once the walks before it end"))
@@ -204,19 +142,33 @@ func (f following) hearMerge(ctx context.Context, m link.SourceMoved, now time.T
 	}
 	entries, err := inv.Catalogued(ctx)
 	if err != nil {
-		return heldMerge(err)
+		return notNow(err)
 	}
 	read, err := readForPlanning(ctx, inv)
 	if err != nil {
-		return heldMerge(err)
+		return notNow(err)
 	}
-	facts, err := factsOfMerge(ctx, inv, m, now, entries, read)
+	merged, err := time.Parse(time.RFC3339Nano, m.MergedAt)
 	if err != nil {
-		return heldMerge(err)
+		merged = now
 	}
-	merged, touches := facts.merged, facts.touches
-	if !facts.plans() {
-		already := facts.already
+	// **What it touches, history or not** (review of this change): a merge heard after a later merge of its
+	// branch was cut reads as history for every module that cut marked seen, and was dropped from the record
+	// here, never named by the walk that carried it.
+	raw := m
+	raw.MergedAt = ""
+	touches := wouldMove(raw, entries, read)
+	var later []inventory.BatchedMerge
+	if len(touches) > 0 {
+		if later, err = inv.LaterMergesOf(ctx, repository, m.Base, merged.UTC()); err != nil {
+			return notNow(err)
+		}
+	}
+	owed, err := owedLate(ctx, inv, m, merged, touches)
+	if err != nil {
+		return notNow(err)
+	}
+	if from, packaging, already := mergeCandidates(m, entries, read); len(from) == 0 && len(packaging) == 0 && len(later) == 0 && !owed {
 		// "Already built from it" and "nothing reads it" are different facts, and reading the first
 		// as the second sends somebody looking for a broken trigger when the mesh is up to date.
 		if already > 0 {
@@ -226,28 +178,26 @@ func (f following) hearMerge(ctx context.Context, m link.SourceMoved, now time.T
 		}
 		if already == 0 {
 			if done, err := f.firstBuilds(ctx, m, entries, read, now); err != nil || done {
-				return heldMerge(err)
+				return err
 			}
 		}
 		fmt.Print(nothingReadsIt(repository, m))
 		return nil
 	}
-	// A module the merge adds is registered from the builder's first done key of it, which the builder's write wakes
-	// (novox/hq ADR 0501 §6): nothing is asked here.
 	// **Its delivery group's word, before the plans are held** (ADR 0306 decision 2): a slow answer holds up no walk.
 	own := ownPath(touches)
 	waits, holding, err := groupWaitHolding(ctx, inv, m, deliverySeatHeld(entries))
 	if err != nil {
-		return heldMerge(err)
+		return notNow(err)
 	}
 	release, err := inv.HoldPlans(ctx, true)
 	if err != nil {
-		return heldMerge(err)
+		return notNow(err)
 	}
 	defer release()
 	// Again under the hold: a controller handing over may have kept it since.
 	if _, known, err := inv.MergeOf(ctx, repository, m.Commit); err != nil || known {
-		return heldMerge(err)
+		return notNow(err)
 	}
 	var moves []string
 	for _, e := range touches {
@@ -266,11 +216,11 @@ func (f following) hearMerge(ctx context.Context, m link.SourceMoved, now time.T
 	// word** (decided during the build, 2026-10-10): batched together, the catalogue's deliveries would start
 	// with the controller's and skip their turn. Each kind has a batch of its own.
 	if p, ok, err := answeredByALaterMerge(ctx, inv, heard, touches, own, deliverySeatHeld(entries)); err != nil {
-		return heldMerge(err)
+		return notNow(err)
 	} else if ok {
 		heard.Plan = p.ID
 		if _, err := inv.AddMerge(ctx, heard); err != nil {
-			return heldMerge(err)
+			return notNow(err)
 		}
 		if p.Batch() {
 			if err := keepBatch(ctx, inv, &p, now, ""); err != nil {
@@ -286,11 +236,11 @@ func (f following) hearMerge(ctx context.Context, m link.SourceMoved, now time.T
 
 	batch, why, err := batchToJoin(ctx, inv, heard, entries, read, now, own, waits)
 	if err != nil {
-		return heldMerge(err)
+		return notNow(err)
 	}
 	heard.Plan = batch.ID
 	if added, err := inv.AddMerge(ctx, heard); err != nil || !added {
-		return heldMerge(err)
+		return notNow(err)
 	}
 	holdFor(&batch, m.Head, waits, holding, own, now)
 	if err := keepBatch(ctx, inv, &batch, now, ""); err != nil {
@@ -800,9 +750,6 @@ type keptMerge struct {
 	// FirstBuild says the merge is a first merge into a repository the mesh builds nothing from, kept to ask the first
 	// build of its modules once mesh-delivery's word on it is kept (novox/hq ADR 0432, issue 1146).
 	FirstBuild bool `json:"first_build,omitempty"`
-	// Held says which first builds of the merge were refused for a word the running build-agent does not read: the merge
-	// waits for a build-agent that reads them, and is never failed (novox/hq ADR 0482 §5, issue 1173).
-	Held []heldFirstBuild `json:"held,omitempty"`
 }
 
 // announcedOf is a kept merge as the forge announced it, and what it moved; empty where the record says none.

cmd/mesh-controller/batches_integration_test.go

@@ -11,7 +11,7 @@ import (
 	"testing"
 	"time"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )

cmd/mesh-controller/batches_test.go

@@ -10,7 +10,7 @@ import (
 	"testing"
 	"time"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )

cmd/mesh-controller/bindings.go

@@ -4,7 +4,7 @@ import (
 	"context"
 	"fmt"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 )
 
@@ -73,8 +73,6 @@ func reportKept(ctx context.Context, plan catalogue.Resolution) {
 // sent, on every machine — the resolver kept it there (said, urgent, until a person pins), or a pin
 // moves it (said, so the data goes first), and never anything else.
 func probeBindings(ctx context.Context, d *doctor) ([]conditions.Observation, error) {
-	// One reading of the mesh for every machine this looks at.
-	ctx = withInputCache(ctx)
 	inv := d.open.inventory
 	nodes, err := inv.Nodes(ctx)
 	if err != nil {
@@ -82,7 +80,7 @@ func probeBindings(ctx context.Context, d *doctor) ([]conditions.Observation, er
 	}
 	var out []conditions.Observation
 	for _, n := range nodes {
-		plan, _, err := resolveNode(ctx, d.open, n.Name)
+		plan, _, err := planFor(ctx, d.open, n.Name)
 		if err != nil {
 			if unresolvable(err) {
 				// D1 says it, with the binding that refused it when that is why.

cmd/mesh-controller/bindings_integration_test.go

@@ -6,7 +6,7 @@ import (
 	"strings"
 	"testing"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 )
 
@@ -37,7 +37,7 @@ func TestTheIncidentAConsumerStaysBesideItsDataUntilAPersonPinsIt(t *testing.T)
 	assignAll([2]string{"laptop", "store"}, [2]string{"laptop", "resolver"}, [2]string{"laptop", "network"},
 		[2]string{"laptop", "board"})
 
-	plan, _, err := resolveNode(ctx, open, "laptop")
+	plan, _, err := planFor(ctx, open, "laptop")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -64,7 +64,7 @@ func TestTheIncidentAConsumerStaysBesideItsDataUntilAPersonPinsIt(t *testing.T)
 	if err := inv.Unassign(ctx, "laptop", "store"); err != nil {
 		t.Fatal(err)
 	}
-	if _, _, err := resolveNode(ctx, open, "laptop"); err == nil || !unresolvable(err) ||
+	if _, _, err := planFor(ctx, open, "laptop"); err == nil || !unresolvable(err) ||
 		!strings.Contains(err.Error(), "board on laptop is bound to laptop/store") ||
 		!strings.Contains(err.Error(), "pin laptop postgres-database anchor store") {
 		t.Fatalf("the consumer's store went and it was answered elsewhere: %v", err)
@@ -74,7 +74,7 @@ func TestTheIncidentAConsumerStaysBesideItsDataUntilAPersonPinsIt(t *testing.T)
 	if err := inv.PinProvision(ctx, "laptop", "postgres-database", "anchor", "store"); err != nil {
 		t.Fatal(err)
 	}
-	plan, _, err = resolveNode(ctx, open, "laptop")
+	plan, _, err = planFor(ctx, open, "laptop")
 	if err != nil {
 		t.Fatal(err)
 	}

cmd/mesh-controller/bindings_test.go

@@ -4,7 +4,7 @@ import (
 	"strings"
 	"testing"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 )
 

cmd/mesh-controller/build.go

@@ -15,9 +15,9 @@ import (
 
 	"github.com/nats-io/nats.go"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
 	"github.com/novox/mesh-controller/internal/builder"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
@@ -28,6 +28,112 @@ import (
 // cheapest next step. That is how novox/hq ADR 0001 records `hal/sdk` reaching 34,636:
 // nothing in it was wrong, and no one edit was the one that should have been a new file.
 
+// buildCommand builds a module from its source and records what came out.
+//
+// **Run where there is a container runtime**, which is why it is a command rather than something
+// the control plane does on its own: building needs to run things on a machine, and what the
+// control plane may send a machine is bounded by the declaration language. This is the shape the
+// builder module will take when it is given work over the broker; today a person runs it, and the
+// mesh records the result the same way either way.
+// buildOn rebuilds every module the mesh holds that stands on the named module's artifacts — the
+// rebuild a changed base needs, which nothing else asks for: their sources did not move, and
+// "behind" does not see a base that did (novox/hq 04-ISSUES/131). Bases first among them too.
+func buildOn(ctx context.Context, base string, wait time.Duration) error {
+	open, err := openStores(ctx)
+	if err != nil {
+		return err
+	}
+	defer open.Close()
+	held, err := open.inventory.Catalogued(ctx)
+	if err != nil {
+		return err
+	}
+	against, err := open.inventory.BuiltAgainst(ctx)
+	if err != nil {
+		return err
+	}
+	var on []inventory.Entry
+	for _, e := range held {
+		if standsOnModule(e, base, against) {
+			on = append(on, e)
+		}
+	}
+	if len(on) == 0 {
+		fmt.Printf("nothing the mesh holds stands on %s\n", base)
+		return nil
+	}
+	on = orderByBases(on, against)
+	fmt.Printf("%d module(s) stand on %s:\n", len(on), base)
+	var failed []string
+	for _, e := range on {
+		fmt.Printf("--- %s\n", e.Manifest.Module)
+		source := buildSource{Repository: e.Source.Repository, Seat: e.Source.Seat}
+		if err := buildOne(ctx, source, e.Source.Path, e.Source.Ref, wait); err != nil {
+			fmt.Printf("  %v\n", err)
+			failed = append(failed, e.Manifest.Module)
+		}
+	}
+	if len(failed) > 0 {
+		return fmt.Errorf("%d of %d could not be built: %s", len(failed), len(on), strings.Join(failed, ", "))
+	}
+	fmt.Printf("\n%d module(s) rebuilt on %s. `push --behind` sends them on\n", len(on), base)
+	return nil
+}
+
+func buildCommand(ctx context.Context, args []string) error {
+	set := flag.NewFlagSet("build", flag.ContinueOnError)
+	ref := set.String("ref", "", "the branch, tag or commit to build")
+	// A module is a repository and a path within it (novox/hq ADR 0069). Empty is the repository's
+	// root, which is the ordinary case and why this is a flag rather than a second argument.
+	path := set.String("path", "", "the module's directory inside the repository")
+	wait := set.Duration("wait", 10*time.Minute, "how long to wait for a builder to answer")
+	dryRun := set.Bool("dry-run", false, "build and print the manifest, recording nothing")
+	// Every module whose source has moved, rather than one named repository.
+	//
+	// **The mirror of `push --behind`, and the same argument** (novox/hq ADR 0010): the mesh
+	// already knows which modules are behind their source, so making a person read that list and
+	// retype each repository is asking them to be the loop. Naming a repository and asking which
+	// ones need building are different requests, so they are not combined.
+	behind := set.Bool("behind", false, "every module the mesh holds older than its source has")
+	on := set.String("on", "", "rebuild every module that stands on this module's artifacts — the rebuild a changed base needs")
+	// A repository on the mesh's own forge, named by its path there (novox/hq ADR 0111). Without it
+	// the repository is external, cloned exactly as given — see source.go.
+	self := set.Bool("self", false, "the repository is a path on the forge holding the git seat")
+	positionals, err := parseAround(set, args)
+	if err != nil {
+		return err
+	}
+	if *on != "" {
+		if len(positionals) != 0 || *behind || *self {
+			return errors.New("build --on <module> names a base and nothing else")
+		}
+		return buildOn(ctx, *on, *wait)
+	}
+
+	if *behind {
+		if len(positionals) != 0 || *self {
+			return errors.New("build <repository> or build --behind, not both: one names a " +
+				"repository and the other asks which need building")
+		}
+		return buildBehind(ctx, *wait)
+	}
+	if len(positionals) != 1 {
+		return errors.New("build <repository> [--self] [--path P] [--ref R] [--wait D] [--dry-run]  |  build --behind  |  build --on <module>")
+	}
+	source := buildSource{Repository: positionals[0]}
+	if *self {
+		if err := onASeat(source.Repository); err != nil {
+			return err
+		}
+		source.Seat = gitSeat
+	}
+
+	if *dryRun {
+		return buildAndShow(ctx, source, *path, *ref, *wait)
+	}
+	return buildOne(ctx, source, *path, *ref, *wait)
+}
+
 // buildFrom turns what a builder said into what the mesh keeps.
 //
 // **By digest and path, never by where it was pushed** (novox/hq 04-ISSUES/102). The builder
@@ -249,6 +355,86 @@ func builderCommand(ctx context.Context, args []string) error {
 	return issueOnTheNewBus(ctx, inv, m, node, address)
 }
 
+// buildBehind builds every module the mesh holds older than its source has.
+//
+// **This is the loop novox/hq ADR 0010 replaced a pipeline with, closed.** The mesh already
+// records where each module came from and what its source last had; until this, a person read
+// that list and retyped each repository — which is a person being the loop, and the thing a
+// pipeline was doing before it was taken away.
+//
+// Each is built and recorded on its own. **One failing does not stop the others**, for the same
+// reason one broken module no longer blocks a machine's whole declaration: a mesh where one bad
+// repository holds back nine good ones is a mesh where nobody dares add the tenth.
+func buildBehind(ctx context.Context, wait time.Duration) error {
+	open, err := openStores(ctx)
+	if err != nil {
+		return err
+	}
+	defer open.Close()
+	inv := open.inventory
+
+	held, err := inv.Catalogued(ctx)
+	if err != nil {
+		return err
+	}
+	var stale []inventory.Entry
+	for _, e := range held {
+		if !e.Source.Current() {
+			stale = append(stale, e)
+		}
+	}
+	if len(stale) == 0 {
+		// Said rather than doing nothing quietly: "nothing needed building" and "this did not
+		// run" must never look the same.
+		fmt.Println("every module the mesh holds is what its source last had")
+		return nil
+	}
+
+	fmt.Printf("%d module(s) behind their source:\n", len(stale))
+	for _, e := range stale {
+		fmt.Printf("  %s  %s < %s\n",
+			e.Manifest.Module, short(e.Source.BuiltFrom), short(e.Source.Head))
+	}
+	fmt.Println()
+
+	// Bases first: a module built before the module it stands on is built against the old one
+	// and reports success (novox/hq 04-ISSUES/131).
+	against, err := inv.BuiltAgainst(ctx)
+	if err != nil {
+		return err
+	}
+	stale = orderByBases(stale, against)
+
+	var failed []string
+	for _, e := range stale {
+		fmt.Printf("--- %s\n", e.Manifest.Module)
+		// Its own recorded ref, not its head commit: a module tracking a branch should be built
+		// from that branch, and pinning to the commit the mesh happened to notice would quietly
+		// turn a tracked branch into a pin.
+		source := buildSource{Repository: e.Source.Repository, Seat: e.Source.Seat}
+		if err := buildOne(ctx, source, e.Source.Path, e.Source.Ref, wait); err != nil {
+			fmt.Printf("  %v\n", err)
+			failed = append(failed, e.Manifest.Module)
+		}
+	}
+
+	if len(failed) > 0 {
+		return fmt.Errorf("%d of %d could not be built: %s",
+			len(failed), len(stale), strings.Join(failed, ", "))
+	}
+	fmt.Printf("\n%d module(s) built. `push --behind` sends them to the machines running them\n",
+		len(stale))
+	return nil
+}
+
+// buildOne asks a build machine for one repository and records everything that came back.
+//
+// Separated from the command so `--behind` can walk a list without a second path to the same act.
+func buildOne(ctx context.Context, source buildSource, path, ref string, wait time.Duration) error {
+	_, err := buildOneAsked(ctx, source, path, ref, wait, false, "build")
+	return err
+}
+
 // recordAsked keeps a build request once it is asked (novox/hq issue 325), with who asked it, in a store
 // opened for the purpose: the asks reach here from processes that hold none.
 func recordAsked(ctx context.Context, r inventory.BuildRequest) {
@@ -325,6 +511,7 @@ func buildOneAsked(ctx context.Context, source buildSource, path, ref string, wa
 		Seats:      seatBases(ctx),
 		DryRun:     dryRun,
 	}
+	request.Reuse = reuseAsked(ctx, dryRun)
 	fmt.Printf("asked for %s", source)
 	if source.Seat != "" {
 		fmt.Printf(" (%s)", repository)
@@ -492,6 +679,13 @@ func takeIn(ctx context.Context, inv *inventory.Inventory, result link.BuildResu
 			recorded.Ref = followedBranch(was.Ref)
 		}
 	}
+	if err := namesNoInstallation(manifest); err != nil {
+		return manifest, kept, fmt.Errorf("%s built %s (%s), and the mesh does not register it: %w",
+			result.On, result.Repository, short(result.Commit), err)
+	}
+	// **Only from the repository the catalogue builds the module from** (novox/hq ADR 0266): else the trunk
+	// below is the trunk of whatever repository was built, which may be one an agent made — and a module named
+	// `sudo` from it would be what the next push sends. Another repository is the operator's, at the terminal.
 	trunk := result.Trunk
 	if was, err := inv.SourceOf(ctx, manifest.Module); err == nil && followedBranch(was.Ref) != "" {
 		trunk = followedBranch(was.Ref)
@@ -499,111 +693,55 @@ func takeIn(ctx context.Context, inv *inventory.Inventory, result link.BuildResu
 	if trunk == "" {
 		trunk = "main"
 	}
-	j := takenBuild{kept: kept, manifest: manifest, recorded: recorded, ask: byBuild(result.ID), path: result.Path,
-		trunk: trunk, by: result.On, what: result.Repository, commit: result.Commit}
-	// The checks only an outcome of build-agent needs: a key is a trunk build by construction (ADR 0501 §2), in no
-	// scratch namespace, and carries no list of its own.
-	j.published = func() error {
-		// **Only a commit on the trunk is published** (novox/hq ADR 0238): a commit off its repository's
-		// default branch — a pull request's head, a feature branch built by hand, a `rebuild` or `replay
-		// --register` of one — is for checking, and is never a module's version; nothing could then send it.
-		// The branch the module already follows is its trunk — never the branch a build was asked at, or a
-		// build of a feature branch by name would make that branch its trunk.
-		follows := ""
-		if was, err := inv.SourceOf(ctx, manifest.Module); err == nil {
-			follows = followedBranch(was.Ref)
-		}
-		if err := publishable(result, follows); err != nil {
-			return err
-		}
-		// **Never a build in the scratch namespace** (novox/hq ADR 0239 §9, ADR 0350 §2): what a check builds is
-		// registered only as the walk's copy in the module's own namespace.
-		if scratch := inScratch(result.Made); scratch != "" {
-			return fmt.Errorf("%s is in the scratch namespace, which only a walk's copy leaves (ADR 0350)", scratch)
-		}
-		return nil
-	}
-	j.carried = func() error {
-		// **The newest trunk build's list of predefined keys is published** (novox/hq ADR 0348 §7): a build of the
-		// catalogue that may be registered keeps its list when its commit is newer than the one kept.
-		carried, err := carriedList(result)
-		if err != nil {
-			return err
-		}
-		if carried != nil {
-			if err := publishPredefined(ctx, inv, result, carried); err != nil {
-				fmt.Printf("%s: the list of predefined keys it carried is not published: %v\n", result.ID, err)
-			}
-		}
-		return nil
-	}
-	manifest, err = registerJudged(ctx, inv, j)
-	return manifest, kept, err
-}
-
-// takenBuild is a build the controller judges and registers, whatever told it of the build: build-agent's outcome (the
-// builder's own module's, until R4g, ADR 0453 §5) or the builder's done key (ADR 0501 §1). **One judging for both**:
-// the rules of who may register, the gate a build failed, the predefined keys and the rule that an unchanged build
-// source moves nothing are the same whichever part built it (ADR 0501 §1, §3).
-type takenBuild struct {
-	kept     inventory.Build
-	manifest catalogue.Manifest
-	recorded inventory.Source
-	ask      registrationAsk
-	path     string
-	trunk    string
-	// by and what name the build in what is said: who built it, and what was built ("ace", "novox/mesh-catalog").
-	by, what, commit string
-	// published refuses a build that may not become a module's version (off the trunk, in the scratch namespace);
-	// nil for a key, which is a trunk fingerprint's by construction (ADR 0501 §2).
-	published func() error
-	// carried publishes a list of predefined keys the build carried; nil when it carried none.
-	carried func() error
-}
-
-// registerJudged judges a recorded build and registers its module, or says why not.
-func registerJudged(ctx context.Context, inv *inventory.Inventory, j takenBuild) (catalogue.Manifest, error) {
-	manifest, kept := j.manifest, j.kept
-	notRegistered := func(err error) (catalogue.Manifest, error) {
-		return manifest, fmt.Errorf("%s built %s (%s), recorded and not registered: %w", j.by, manifest.Module,
-			short(j.commit), err)
-	}
-	if err := namesNoInstallation(manifest); err != nil {
-		return manifest, fmt.Errorf("%s built %s (%s), and the mesh does not register it: %w",
-			j.by, j.what, short(j.commit), err)
-	}
-	// **Only from the repository the catalogue builds the module from** (novox/hq ADR 0266): else the trunk
-	// below is the trunk of whatever repository was built, which may be one an agent made — and a module named
-	// `sudo` from it would be what the next push sends. Another repository is the operator's, at the terminal.
-	repoID, err := mayRegisterFrom(ctx, inv, manifest.Module, j.recorded, j.ask, j.path, j.trunk)
+	repoID, err := mayRegisterFrom(ctx, inv, manifest.Module, recorded, result.ID, result.Path, trunk)
 	if err != nil {
-		return notRegistered(err)
+		return manifest, kept, fmt.Errorf("%s built %s (%s), recorded and not registered: %w", result.On,
+			manifest.Module, short(result.Commit), err)
 	}
-	if j.published != nil {
-		if err := j.published(); err != nil {
-			return notRegistered(err)
-		}
+	// **Only a commit on the trunk is published** (novox/hq ADR 0238): a commit off its repository's
+	// default branch — a pull request's head, a feature branch built by hand, a `rebuild` or `replay
+	// --register` of one — is for checking, and is never a module's version; nothing could then send it.
+	// The branch the module already follows is its trunk — never the branch a build was asked at, or a
+	// build of a feature branch by name would make that branch its trunk.
+	follows := ""
+	if was, err := inv.SourceOf(ctx, manifest.Module); err == nil {
+		follows = followedBranch(was.Ref)
+	}
+	if err := publishable(result, follows); err != nil {
+		return manifest, kept, fmt.Errorf("%s built %s (%s), recorded and not registered: %w", result.On,
+			manifest.Module, short(result.Commit), err)
+	}
+	// **Never a build in the scratch namespace** (novox/hq ADR 0239 §9, ADR 0350 §2): what a check builds is
+	// registered only as the walk's copy in the module's own namespace.
+	if scratch := inScratch(result.Made); scratch != "" {
+		return manifest, kept, fmt.Errorf("%s built %s (%s), recorded and not registered: %s is in the scratch "+
+			"namespace, which only a walk's copy leaves (ADR 0350)", result.On, manifest.Module, short(result.Commit), scratch)
 	}
 	// **A build that failed its gate is never registered again** (novox/hq ADR 0236): an outcome heard
 	// twice, or replayed, would otherwise make the build a rollback put back what the module is again,
 	// and the next push would send it.
 	if failed, err := inv.GateFailed(ctx, kept.ID); err != nil {
-		return manifest, err
+		return manifest, kept, err
 	} else if failed {
-		return manifest, fmt.Errorf("%s built %s (%s), which failed its gate on its first machine and was put "+
-			"back: it is recorded and not registered again — a newer build is", j.by, manifest.Module,
-			short(j.commit))
+		return manifest, kept, fmt.Errorf("%s built %s (%s), which failed its gate on its first machine and was put "+
+			"back: it is recorded and not registered again — a newer build is", result.On, manifest.Module,
+			short(result.Commit))
 	}
-	// Then the module is judged against the list the mesh publishes, as every manifest read again is: one naming a
-	// key that list does not hold, or of another type, is refused here and never enters the catalogue.
-	if j.carried != nil {
-		if err := j.carried(); err != nil {
-			return manifest, err
+	// **The newest trunk build's list of predefined keys is published** (novox/hq ADR 0348 §7): a build of the
+	// catalogue that may be registered keeps its list when its commit is newer than the one kept. Then the module
+	// is judged against the list the mesh publishes, as every manifest read again is: one naming a key that list
+	// does not hold, or of another type, is refused here and never enters the catalogue.
+	if carried, err := carriedList(result); err != nil {
+		return manifest, kept, err
+	} else if carried != nil {
+		if err := publishPredefined(ctx, inv, result, carried); err != nil {
+			fmt.Printf("%s: the list of predefined keys it carried is not published: %v\n", result.ID, err)
 		}
 	}
 	if manifest.NamesPredefined() {
 		if _, err := catalogue.ParseManifest(kept.Manifest); err != nil {
-			return notRegistered(fmt.Errorf("judged against the list of predefined keys the mesh publishes, %w", err))
+			return manifest, kept, fmt.Errorf("%s built %s (%s), recorded and not registered: judged against the "+
+				"list of predefined keys the mesh publishes, %w", result.On, manifest.Module, short(result.Commit), err)
 		}
 	}
 	// **A build whose source is unchanged is never a move** (novox/hq issue 280): a rebuild made from
@@ -613,34 +751,32 @@ func registerJudged(ctx context.Context, inv *inventory.Inventory, j takenBuild)
 	if kept.SourceFingerprint != "" {
 		stands, raw, err := inv.StandingBuild(ctx, manifest.Module, kept.ID)
 		if err != nil {
-			return manifest, err
+			return manifest, kept, err
 		}
 		if stands != "" && stands != kept.ID && len(raw) > 0 {
-			if was, err := catalogue.ParseManifest(raw); err == nil && was.Module == manifest.Module {
+			if same, err := catalogue.ParseManifest(raw); err == nil && same.Module == manifest.Module {
 				fmt.Printf("%s at %s was made from the source %s was: registered with its artifacts, no move\n",
-					manifest.Module, short(j.commit), stands)
-				manifest = was
+					manifest.Module, short(result.Commit), stands)
+				manifest = same
 			}
 		}
 	}
-	if err := inv.RegisterModule(ctx, manifest, j.recorded); err != nil {
+	if err := inv.RegisterModule(ctx, manifest, recorded); err != nil {
 		if errors.Is(err, inventory.ErrSuperseded) {
-			return notRegistered(err)
+			return manifest, kept, fmt.Errorf("%s built %s (%s), recorded and not registered: %w",
+				result.On, manifest.Module, short(result.Commit), err)
 		}
-		return manifest, err
+		return manifest, kept, err
 	}
-	// A bus process the new definition gains gets its account now, on each machine assigned the module, so the
-	// next push composes a real account (issue 1226).
-	issueGainedProcessAccounts(ctx, inv, manifest)
 	// Which repository it is registered from, by the forge's own id (novox/hq ADR 0266).
 	if err := inv.SetSourceIdentity(ctx, manifest.Module, repoID); err != nil {
-		return manifest, err
+		return manifest, kept, err
 	}
 	// The keep set just moved, and new bytes just landed (novox/hq ADR 0189). Asked here rather
 	// than on a timer of its own: this is the only moment either is true. Never fatal — the build
 	// worked and the module is registered.
 	collect(ctx, inv)
-	return manifest, nil
+	return manifest, kept, nil
 }
 
 // inScratch is the first artifact a build made into the scratch namespace; empty when none is.
@@ -681,17 +817,64 @@ func publishable(result link.BuildResult, follows string) error {
 	return nil
 }
 
+// buildAndShow builds and prints the manifest without recording anything.
+func buildAndShow(ctx context.Context, source buildSource, path, ref string, wait time.Duration) error {
+	repository, err := cloneFrom(ctx, source)
+	if err != nil {
+		return err
+	}
+	if err := verbMayAsk(ctx, source, repository, path); err != nil {
+		return err
+	}
+	ident, err := openIdentity(ctx)
+	if err != nil {
+		return err
+	}
+	defer ident.Close()
+	server, err := connectLink(ctx, nil, nil, nil)
+	if err != nil {
+		return err
+	}
+	defer server.Close()
+
+	ask, err := askOverOn(buildSeatHeld(ctx))
+	if err != nil {
+		return err
+	}
+	defer ask.Close()
+
+	result, err := ask.Submit(ctx, link.BuildRequest{
+		ID:         link.NewBuildID(time.Now()),
+		Repository: repository, Path: path, Ref: ref,
+		Held: heldBy(ctx), Seats: seatBases(ctx),
+		DryRun: true,
+	}, wait)
+	if err != nil {
+		return err
+	}
+	if result.Failed != "" {
+		return fmt.Errorf("%s could not build %s:\n%s", result.On, result.Repository, result.Failed)
+	}
+	manifest, err := catalogue.ParseManifest(result.Manifest)
+	if err != nil {
+		return fmt.Errorf("%s built %s and what came back is not a manifest: %w",
+			result.On, result.Repository, err)
+	}
+	body, err := json.MarshalIndent(manifest, "", "  ")
+	if err != nil {
+		return err
+	}
+	fmt.Println(string(body))
+	return nil
+}
+
 // answers is what the three questions came back with, read once.
 type answers struct {
-	// notAnnounced are the owners some module reads the state of that have announced nothing yet (novox/hq ADR 0495,
-	// issue 1790): read from `reads` as before until they do; notAnnouncedWhy why that could not be read.
-	notAnnounced    []string
-	notAnnouncedWhy string
-	wrong           []inventory.Doing
-	nodes           []inventory.Node
-	quiet           []inventory.Node
-	behind          map[string][]string
-	sources         map[string]inventory.Source
+	wrong   []inventory.Doing
+	nodes   []inventory.Node
+	quiet   []inventory.Node
+	behind  map[string][]string
+	sources map[string]inventory.Source
 	// waiting is every machine not running what the mesh would send it.
 	waiting []inventory.Machine
 	// recordedWaits is, per machine, every move of a recorded module that waits there for a person (novox/hq ADR

cmd/mesh-controller/build_seat_test.go

@@ -3,7 +3,7 @@ package main
 import (
 	"testing"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )

cmd/mesh-controller/build_source.go

@@ -10,7 +10,7 @@ import (
 	"strings"
 	"time"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
@@ -75,94 +75,35 @@ func markServed() {
 type sourceForms struct {
 	bases map[string]string // the seat's clone base, `scheme://host:port`, by seat; "" where it is not known
 	base  func(seat string) string
-	// read is base with the reason it is unknown; nil where only base is given. again forces a fresh read past a
-	// failure kept for failedKept.
-	read func(ctx context.Context, seat string, again bool) (string, error)
 }
 
-// failedKept is how long an unreadable base is not read again for the callers that loop over every catalogue
-// entry: one composition of the mesh serves them all (novox/hq issue 1277).
-const failedKept = 5 * time.Second
-
-// newSourceForms reads the seats' bases from the mesh when first needed. A base that could not be read is not
-// kept as if it were known: it is read again at the next ask (novox/hq issue 1277).
+// newSourceForms reads the seats' bases from the mesh once, when first needed.
 func newSourceForms(ctx context.Context, inv *inventory.Inventory) *sourceForms {
-	return sourceFormsRead(ctx, time.Now, func(ctx context.Context) (catalogue.World, error) {
-		shelf, err := inv.Catalogue(ctx)
-		if err != nil {
-			return catalogue.World{}, fmt.Errorf("the catalogue cannot be read: %w", err)
-		}
-		read, err := restOfTheMeshOf(ctx, inv, shelf, "")
-		if err != nil {
-			return catalogue.World{}, fmt.Errorf("the mesh cannot be read: %w", err)
-		}
-		return read, nil
-	})
-}
-
-// sourceFormsRead is newSourceForms on how the mesh is read, handed in.
-func sourceFormsRead(ctx context.Context, now func() time.Time,
-	readWorld func(context.Context) (catalogue.World, error)) *sourceForms {
 	f := &sourceForms{bases: map[string]string{}}
-	var failedAt time.Time // when the last read failed; zero when it did not
-	var failure error
-	f.read = func(ctx context.Context, seat string, again bool) (string, error) {
-		if b, known := f.bases[seat]; known {
-			return b, nil
-		}
-		if failure != nil && !again && now().Sub(failedAt) < failedKept {
-			return "", failure
-		}
-		world, err := readWorld(ctx)
-		if err == nil {
-			var b string
-			if b, err = seatBase(world, seat); err == nil {
-				failure = nil
-				f.bases[seat] = b
-				return b, nil
-			}
-		}
-		failedAt, failure = now(), err // the holder may be changing now: only an unread base is kept, for a moment
-		return "", err
-	}
+	var world *catalogue.World
 	f.base = func(seat string) string {
-		b, _ := f.read(ctx, seat, false)
+		if b, known := f.bases[seat]; known {
+			return b
+		}
+		if world == nil {
+			w := catalogue.World{}
+			if shelf, err := inv.Catalogue(ctx); err == nil {
+				if read, err := theRestOfTheMesh(ctx, inv, shelf, ""); err == nil {
+					w = read
+				}
+			}
+			world = &w
+		}
+		b, err := seatBase(*world, seat)
+		if err != nil {
+			b = ""
+		}
+		f.bases[seat] = b
 		return b
 	}
 	return f
 }
 
-// forgeAddressWait is the registration's wait for the forge's address (novox/hq issue 1277): a fresh read every
-// 5 s for at most 60 s, as the wait for the forge's answer (issue 486). A variable so a test waits in no real time.
-var forgeAddressWait = waitOut{bound: 60 * time.Second, first: 5 * time.Second, most: 5 * time.Second,
-	now: time.Now, sleep: sleepOrDone}
-
-// forgeAddress is the git seat's base, read again within w's bound while it cannot be read. Where the forms have
-// no reader of their own (a test's), base says it.
-func (f *sourceForms) forgeAddress(ctx context.Context, w waitOut) (string, error) {
-	if f.read == nil {
-		return f.base(gitSeat), nil
-	}
-	began := w.now()
-	for {
-		b, err := f.read(ctx, gitSeat, true)
-		if err == nil {
-			return b, nil
-		}
-		if ctx.Err() != nil {
-			return "", err
-		}
-		if w.now().Sub(began)+w.first > w.bound {
-			return "", fmt.Errorf("after %s: %w", w.now().Sub(began).Round(time.Second), err)
-		}
-		fmt.Printf("the forge's address cannot be read now (%v); reading it again in %s, for at most %s in all "+
-			"(novox/hq issue 1277)\n", err, w.first, w.bound)
-		if serr := w.sleep(ctx, w.first); serr != nil {
-			return "", err
-		}
-	}
-}
-
 // canonical is one spelling of a repository: lower case, no `.git`, no trailing slash, and a seat's path as
 // the URL its holder serves it at where that is known.
 func (f *sourceForms) canonical(repository, seat string) string {
@@ -215,29 +156,11 @@ type forgeFacts struct {
 // protection, waiting out a forge not served for a moment (novox/hq issue 486). A variable so a test needs no
 // forge.
 var askTheForge = func(ctx context.Context, owner, repo, branch string) (forgeFacts, error) {
-	return askedWithinBudget(ctx, owner+"/"+repo, func(ctx context.Context) (forgeFacts, error) {
+	return forgeWaitedOut(ctx, forgeWait, owner+"/"+repo, func(ctx context.Context) (forgeFacts, error) {
 		return askTheForgeOnce(ctx, owner, repo, branch)
 	})
 }
 
-type forgeBudgetKey struct{}
-
-// withForgeBudget says how much of the registration's one wait is left for the forge's answer: the wait for its
-// address has used the rest (novox/hq issue 1277). The registration holds the controller's one receive loop, so the
-// two waits together keep to one bound.
-func withForgeBudget(ctx context.Context, left time.Duration) context.Context {
-	return context.WithValue(ctx, forgeBudgetKey{}, max(left, 0))
-}
-
-// askedWithinBudget is forgeWaitedOut with forgeWait's bound, or what is left of it when the address was waited for.
-func askedWithinBudget(ctx context.Context, repository string, ask func(context.Context) (forgeFacts, error)) (forgeFacts, error) {
-	w := forgeWait
-	if left, ok := ctx.Value(forgeBudgetKey{}).(time.Duration); ok {
-		w.bound = min(w.bound, left)
-	}
-	return forgeWaitedOut(ctx, w, repository, ask)
-}
-
 // waitOut bounds how long a question is asked again while its answer is "not now": a pause of first, doubling
 // to most, for at most bound in all. now and sleep are the clock, so a test waits in no real time.
 type waitOut struct {
@@ -373,7 +296,22 @@ type protectionRule struct {
 // branch, else the first glob rule, in the forge's order, that covers it (gitea's first matching rule). Never a
 // later rule that happens to be stronger: the forge does not read it.
 func judgedRule(rules []protectionRule, branch string) forgeFacts {
-	switch r := appliedRule(rules, branch); {
+	var applied *protectionRule
+	for i := range rules {
+		if rules[i].Rule == branch {
+			applied = &rules[i]
+			break
+		}
+	}
+	if applied == nil {
+		for i := range rules {
+			if ruleCovers(rules[i].Rule, branch) {
+				applied = &rules[i]
+				break
+			}
+		}
+	}
+	switch r := applied; {
 	case r == nil:
 		return forgeFacts{Why: fmt.Sprintf("no protection rule covers %s", branch)}
 	case r.Push:
@@ -386,22 +324,6 @@ func judgedRule(rules []protectionRule, branch string) forgeFacts {
 	return forgeFacts{Guarded: true}
 }
 
-// appliedRule is the one rule the forge applies to a branch: the rule named for it, else the first glob rule, in the
-// forge's order, that covers it; nil when none does.
-func appliedRule(rules []protectionRule, branch string) *protectionRule {
-	for i := range rules {
-		if rules[i].Rule == branch {
-			return &rules[i]
-		}
-	}
-	for i := range rules {
-		if ruleCovers(rules[i].Rule, branch) {
-			return &rules[i]
-		}
-	}
-	return nil
-}
-
 // ruleCovers says a protection rule's name — a branch, or a glob of them — covers a branch, as the forge reads it.
 func ruleCovers(rule, branch string) bool {
 	if rule == branch {
@@ -470,39 +392,8 @@ func (f *sourceForms) onTheForge(repository, seat string) (owner, name string, o
 // repository and path; or, for the build of a merge, when mesh-delivery announced it on the operator's Approve of
 // that head (novox/hq ADR 0420 §7 for a moved module, ADR 0432 for a new one), the forge's checks still holding. path is the module's directory as built; branch the trunk it is registered from.
 func mayRegisterFrom(ctx context.Context, inv *inventory.Inventory, module string, built inventory.Source,
-	ask registrationAsk, path, branch string) (int64, error) {
-	return mayRegisterIn(ctx, inv, newSourceForms(ctx, inv), module, built, ask, path, branch)
-}
-
-// registrationAsk is what a registration's warrant is read from (novox/hq ADR 0501 §3): the build an outcome answers,
-// whose kept request says whether it was asked at the terminal or for a merge (build-agent's outcome, the builder's own
-// module until R4g); or, for a take-in from the builder's done key, the merge the indexer's trunk value names and
-// whether the operator asked the registration at the controller's terminal (ADR 0501 §4). A key asks no build, so it
-// keeps no request.
-type registrationAsk struct {
-	// Build is the build whose kept request is read; empty for a take-in from a key.
-	Build string
-	// Merge is the commit of the merge a key's module is registered from (the indexer's trunk value); empty for an
-	// outcome, whose request names it.
-	Merge string
-	// Terminal is a key registration the operator asked at the controller's terminal for this repository and path.
-	Terminal bool
-}
-
-// byBuild is the warrant of a build's outcome: read from the request kept under its id.
-func byBuild(id string) registrationAsk { return registrationAsk{Build: id} }
-
-// String is the ask as the registration's words name it.
-func (a registrationAsk) String() string {
-	switch {
-	case a.Build != "":
-		return a.Build
-	case a.Terminal:
-		return "the registration asked at the terminal"
-	case a.Merge != "":
-		return fmt.Sprintf("the merge %.8s", a.Merge)
-	}
-	return "a key"
+	buildID, path, branch string) (int64, error) {
+	return mayRegisterIn(ctx, inv, newSourceForms(ctx, inv), module, built, buildID, path, branch)
 }
 
 // catalogueReader is the catalogue's manifests, as the router's records are found in them.
@@ -522,19 +413,15 @@ type registrations interface {
 
 // mayRegisterIn is mayRegisterFrom on what it reads of the mesh handed in.
 func mayRegisterIn(ctx context.Context, inv registrations, forms *sourceForms, module string, built inventory.Source,
-	ask registrationAsk, path, branch string) (int64, error) {
-	buildID := ask.String()
+	buildID, path, branch string) (int64, error) {
 	was, err := inv.SourceOf(ctx, module)
 	isNew := errors.Is(err, inventory.ErrNoSuchModule)
 	if err != nil && !isNew {
 		return 0, err
 	}
-	terminal := ask.Terminal
-	if ask.Build != "" {
-		var err error
-		if terminal, err = askedHereFor(ctx, inv, forms, ask.Build, built, path); err != nil {
-			return 0, err
-		}
+	terminal, err := askedHereFor(ctx, inv, forms, buildID, built, path)
+	if err != nil {
+		return 0, err
 	}
 	refuse := func(why string) (int64, error) {
 		return 0, fmt.Errorf("%w: %s. A module is registered from such a source only by a build asked at the "+
@@ -578,7 +465,7 @@ func mayRegisterIn(ctx context.Context, inv registrations, forms *sourceForms, m
 	// The forge's protection and the repository's identity are checked below as for every registration.
 	movedWhy := ""
 	if why != "" && !terminal {
-		accepted, err := approvedMove(ctx, inv, forms, ask, built)
+		accepted, err := approvedMove(ctx, inv, forms, buildID, built)
 		switch {
 		case err == nil:
 			movedWhy, why = accepted, ""
@@ -591,24 +478,6 @@ func mayRegisterIn(ctx context.Context, inv registrations, forms *sourceForms, m
 		return refuse(why)
 	}
 
-	if built.Seat == "" {
-		// A URL is judged against the forge's address: an address that cannot be read is no proof the source is
-		// elsewhere (novox/hq issue 1277).
-		began := forgeAddressWait.now()
-		addressCtx, cancel := context.WithTimeout(ctx, forgeAddressWait.bound)
-		_, err := forms.forgeAddress(addressCtx, forgeAddressWait)
-		cancel()
-		ctx = withForgeBudget(ctx, forgeAddressWait.bound-forgeAddressWait.now().Sub(began))
-		if err != nil {
-			if terminal {
-				fmt.Printf("%s: the forge's address could not be read (%v) — registered, as asked at the controller's "+
-					"terminal\n", buildID, err)
-				return 0, nil
-			}
-			return refuse(fmt.Sprintf("the forge's address could not be read (%v), so whether %s's trunk is "+
-				"protected cannot be read", err, sourceWords(built.Repository, built.Seat)))
-		}
-	}
 	owner, name, onForge := forms.onTheForge(built.Repository, built.Seat)
 	if !onForge {
 		if terminal {
@@ -698,6 +567,37 @@ func sourceWords(repository, seat string) string {
 	return buildSource{Repository: repository, Seat: seat}.String()
 }
 
+// firstBuildWarrant is what the controller checked before it asks the first build of the modules a merge adds to a
+// repository nothing is built from: the merge was made on the operator's Approve of its head (approvedAnnounced). It
+// travels in the context of that ask alone, in this process, so no verb carries one.
+type firstBuildWarrant struct {
+	repository string // owner/name on the git seat
+	paths      map[string]bool
+	why        string
+}
+
+type firstBuildWarrantKey struct{}
+
+// withFirstBuildWarrant is ctx carrying the warrant for asking the first builds of paths in repository.
+func withFirstBuildWarrant(ctx context.Context, repository string, paths []string, why string) context.Context {
+	w := &firstBuildWarrant{repository: repository, paths: map[string]bool{}, why: why}
+	for _, p := range paths {
+		w.paths[strings.Trim(p, "/")] = true
+	}
+	return context.WithValue(ctx, firstBuildWarrantKey{}, w)
+}
+
+func firstBuildWarrantIn(ctx context.Context) *firstBuildWarrant {
+	w, _ := ctx.Value(firstBuildWarrantKey{}).(*firstBuildWarrant)
+	return w
+}
+
+// covers says the warrant is for exactly this ask: the repository on the git seat, and a module path the merge holds.
+func (w *firstBuildWarrant) covers(source buildSource, path string) bool {
+	return w != nil && source.Seat == gitSeat && strings.EqualFold(strings.Trim(source.Repository, "/"), w.repository) &&
+		w.paths[strings.Trim(path, "/")]
+}
+
 // verbMayAsk refuses, for a call through a verb, a build of a repository the catalogue builds no module from
 // (novox/hq ADR 0266): the build node would run what an agent wrote, and its outcome could never be
 // registered anyway. url is the repository as it is cloned. At the terminal anything may be asked.
@@ -705,6 +605,11 @@ func verbMayAsk(ctx context.Context, source buildSource, url, path string) error
 	if startedAtTheTerminal() {
 		return nil
 	}
+	// **Or the first build of a module a merge adds on the operator's Approve** (novox/hq ADR 0432, issue 1146): the
+	// controller's own ask, carrying the warrant it checked, for that repository and the module paths the merge holds.
+	if firstBuildWarrantIn(ctx).covers(source, path) {
+		return nil
+	}
 	open, err := openStores(ctx)
 	if err != nil {
 		return err

cmd/mesh-controller/builder_on_the_bus_test.go

@@ -1,139 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"context"
-	"sync"
-	"testing"
-
-	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
-	"github.com/nats-io/nats.go/jetstream"
-	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/testbus"
-)
-
-// builderOnTheBus is the builder's and the indexer's buckets on a test's own bus, which the controller's connection for
-// the moment (servingBus) reaches: what a take-in from a key reads (R4e, issue 1851).
-type builderOnTheBus struct {
-	js                         *broker.JetStream
-	builds, modules, manifests jetstream.KeyValue
-}
-
-func aBuilderOnTheBus(t *testing.T) builderOnTheBus {
-	t.Helper()
-	js, err := broker.Dial(testbus.URL(t))
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(js.Close)
-	api, err := jetstream.New(js.Conn())
-	if err != nil {
-		t.Fatal(err)
-	}
-	ctx := t.Context()
-	b := builderOnTheBus{js: js}
-	for _, c := range []struct {
-		into    *jetstream.KeyValue
-		bucket  string
-		history uint8
-	}{
-		{&b.builds, sdkdelivery.BuilderBuildsBucket, sdkdelivery.BuilderBuildsHistory},
-		{&b.modules, sdkdelivery.ModulesBucket, sdkdelivery.ModulesHistory},
-		{&b.manifests, sdkdelivery.ManifestsBucket, 1},
-	} {
-		kv, err := api.CreateKeyValue(ctx, jetstream.KeyValueConfig{Bucket: c.bucket, History: c.history})
-		if err != nil {
-			t.Fatal(err)
-		}
-		*c.into = kv
-	}
-	servingBus.Store(js)
-	t.Cleanup(func() { servingBus.Store(nil) })
-	withTrunkList(t, true)
-	// The indexer on this bus is read, not the "not held" a mesh with no bus reads (aMeshOnTheStore).
-	wasIndexed := indexedModule
-	indexedModule = theIndexedModule
-	t.Cleanup(func() { indexedModule = wasIndexed })
-	return b
-}
-
-// indexed writes the indexer's trunk value of module at commit, naming fp, and its manifest: a module of one archive.
-func (b builderOnTheBus) indexed(t *testing.T, module, version, repository, path, commit, fp string) string {
-	t.Helper()
-	keys, trunk := aKeyFor(module, version, fp, repository, path, commit)
-	raw := keys.manifests[trunk.Manifest]
-	value, err := sdkdelivery.EncodeManifest(sdkdelivery.Manifest{Module: module, JSON: raw})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := b.manifests.Put(context.Background(), trunk.Manifest, value); err != nil {
-		t.Fatal(err)
-	}
-	trunk.FP = "src1:" + fp[len("src2:"):]
-	encoded, err := sdkdelivery.EncodeModule(trunk)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := b.modules.Put(context.Background(), module, encoded); err != nil {
-		t.Fatal(err)
-	}
-	return trunk.Manifest
-}
-
-// built writes the builder's key of module at fp: done, its one archive named with a reference, or in another state.
-func (b builderOnTheBus) built(t *testing.T, module, version, fp, manifest, state string) {
-	t.Helper()
-	keys, _ := aKeyFor(module, version, fp, "", "", "")
-	v := keys.keys[module].Build
-	v.Manifest = manifest
-	if state != sdkdelivery.BuildDone {
-		v = sdkdelivery.BuilderBuild{State: state, By: "ace"}
-		if state == sdkdelivery.BuildFailed {
-			v.Error = "digests differ: ace sha256:1, g14 sha256:2"
-		}
-	}
-	value, err := sdkdelivery.EncodeBuilderBuild(v)
-	if err != nil {
-		t.Fatal(err)
-	}
-	key, err := sdkdelivery.BuilderBuildKey(module, fp)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := b.builds.Put(context.Background(), key, value); err != nil {
-		t.Fatal(err)
-	}
-}
-
-// noBuildAsked fails the test if anything asks build-agent for a build (ADR 0501 §6, ADR 0503 §6).
-func noBuildAsked(t *testing.T) {
-	t.Helper()
-	was := askABuild
-	askABuild = func(_ context.Context, _ buildSource, path, _ string) (string, error) {
-		t.Errorf("a build was asked of build-agent, at %q", path)
-		return "", context.Canceled
-	}
-	t.Cleanup(func() { askABuild = was })
-}
-
-// asksWithPaths records every build a merge asks for, as repository, path and ref. The merge window's goroutine and
-// the test's own may ask at once, so the record is written under a lock (issue 1543).
-func asksWithPaths(t *testing.T) *[][3]string {
-	t.Helper()
-	asksOfEveryModule(t) // the one ask left is the builder's own (ADR 0453 §5): these tests are of what a walk does around it
-	var asked [][3]string
-	var mu sync.Mutex
-	was := askABuild
-	askABuild = func(_ context.Context, source buildSource, path, ref string) (string, error) {
-		mu.Lock()
-		defer mu.Unlock()
-		asked = append(asked, [3]string{source.Repository, path, ref})
-		return "b-" + path, nil
-	}
-	t.Cleanup(func() { askABuild = was })
-	return &asked
-}
-
-// theIndexedModule is the look at the indexer as the controller makes it, kept before any test replaces it.
-var theIndexedModule = indexedModule

cmd/mesh-controller/builders_own_test.go

@@ -1,112 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"strings"
-	"testing"
-)
-
-// A12 (ADR 0453 §5, ADR 0498 §7; issue 1851): the one function every ask goes through refuses any module but the
-// builder's own, naming the builder's key it is taken from instead; the builder's own module passes the refusal.
-func TestBuildAgentIsAskedForTheBuildersOwnModuleAlone(t *testing.T) {
-	was := askedModuleOf
-	t.Cleanup(func() { askedModuleOf = was })
-	askedModuleOf = func(_ context.Context, _ buildSource, path string) (string, error) {
-		return strings.TrimPrefix(path, "modules/"), nil
-	}
-	_, err := askABuild(t.Context(), buildSource{Repository: "novox/mesh-catalog", Seat: "git"}, "modules/sudo", "main")
-	if !errors.Is(err, errNotTheBuildersOwn) || !strings.Contains(err.Error(), "sudo is taken from the builder's done key") ||
-		!strings.Contains(err.Error(), "mesh-delivery-builder_builds") {
-		t.Fatalf("an ask of another module: %v", err)
-	}
-	if err := onlyTheBuildersOwn(t.Context(), buildSource{Repository: "novox/mesh-delivery", Seat: "git"},
-		"modules/mesh-delivery-builder"); err != nil {
-		t.Fatalf("the builder's own module is refused: %v", err)
-	}
-	askedModuleOf = func(context.Context, buildSource, string) (string, error) { return "", errors.New("no store") }
-	if err := onlyTheBuildersOwn(t.Context(), buildSource{Repository: "novox/x"}, ""); !errors.Is(err, errNotTheBuildersOwn) {
-		t.Fatalf("an ask whose module cannot be read went on: %v", err)
-	}
-}
-
-// A12: a walk of the builder's own module and one other asks build-agent for the first alone; the other is taken from
-// its key.
-func TestAWalkAsksBuildAgentForTheBuildersOwnModuleAlone(t *testing.T) {
-	var asked []string
-	was := askABuild
-	askABuild = func(_ context.Context, _ buildSource, path, _ string) (string, error) {
-		asked = append(asked, path)
-		return "build-1", nil
-	}
-	t.Cleanup(func() { askABuild = was })
-	p, byName := aWalkOfOne("sudo")
-	p.Tiers = [][]string{{"mesh-delivery-builder", "sudo"}}
-	byName["mesh-delivery-builder"] = byName["sudo"]
-	e := byName["mesh-delivery-builder"]
-	e.Source.Repository, e.Source.Path = "novox/mesh-delivery", "modules/mesh-delivery-builder"
-	byName["mesh-delivery-builder"] = e
-	for _, m := range p.Tiers[0] {
-		askModule(t.Context(), p, m, byName)
-	}
-	if len(asked) != 1 || asked[0] != "modules/mesh-delivery-builder" {
-		t.Fatalf("build-agent was asked for %v, want the builder's own module alone", asked)
-	}
-	if s := p.Modules["mesh-delivery-builder"]; s.Key || s.Build != "build-1" {
-		t.Fatalf("the builder's own module is not asked: %+v", s)
-	}
-	if s := p.Modules["sudo"]; !s.Key || s.Build != "" {
-		t.Fatalf("the other module is not taken from its key: %+v", s)
-	}
-}
-
-// ADR 0520 §1 (issue 1851): until R4g build-agent and mesh-tools, the toolchain image its builds stand on, are build-agent's
-// own, as the builder's module is: the builder writes no key of them, so a walk asks build-agent for them and reads no key;
-// mesh-tools-go (its key from mesh-build-image) and any other module of the same tier are still taken from their keys.
-func TestAWalkAsksBuildAgentForItselfAndMeshToolsAndReadsNoKeyOfThem(t *testing.T) {
-	own := []string{"build-agent", "mesh-tools"}
-	keyed := []string{"mesh-tools-go", "sudo"}
-	wasModule := askedModuleOf
-	askedModuleOf = func(_ context.Context, _ buildSource, path string) (string, error) {
-		return strings.TrimPrefix(path, "modules/"), nil
-	}
-	t.Cleanup(func() { askedModuleOf = wasModule })
-	for _, m := range own {
-		if err := onlyTheBuildersOwn(t.Context(), buildSource{Repository: "novox/x", Seat: "git"}, "modules/"+m); err != nil {
-			t.Fatalf("an ask of %s is refused: %v", m, err)
-		}
-	}
-	if err := onlyTheBuildersOwn(t.Context(), buildSource{Repository: "novox/x", Seat: "git"}, "modules/mesh-tools-go"); !errors.Is(err, errNotTheBuildersOwn) {
-		t.Fatalf("an ask of mesh-tools-go went on: %v", err)
-	}
-	var asked []string
-	was := askABuild
-	askABuild = func(_ context.Context, _ buildSource, path, _ string) (string, error) {
-		asked = append(asked, path)
-		return "build-" + strings.TrimPrefix(path, "modules/"), nil
-	}
-	t.Cleanup(func() { askABuild = was })
-	p, byName := aWalkOfOne("sudo")
-	p.Tiers = [][]string{append(append([]string{}, own...), keyed...)}
-	for _, m := range append(append([]string{}, own...), keyed...) {
-		e := byName["sudo"]
-		e.Source.Path = "modules/" + m
-		byName[m] = e
-	}
-	for _, m := range p.Tiers[0] {
-		askModule(t.Context(), p, m, byName)
-	}
-	if strings.Join(asked, " ") != "modules/build-agent modules/mesh-tools" {
-		t.Fatalf("build-agent was asked for %v", asked)
-	}
-	for _, m := range own {
-		if s := p.Modules[m]; s.Key || s.Build != "build-"+m || s.State != "asked" {
-			t.Fatalf("%s is not asked of build-agent, or is read from a key: %+v", m, s)
-		}
-	}
-	for _, m := range keyed {
-		if s := p.Modules[m]; !s.Key || s.Build != "" {
-			t.Fatalf("%s is not taken from its key: %+v", m, s)
-		}
-	}
-}

cmd/mesh-controller/bus_step.go

@@ -11,7 +11,7 @@ import (
 
 	"github.com/nats-io/nats.go"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"

cmd/mesh-controller/busobjects.go

@@ -32,13 +32,6 @@ func assertBusObjects(ctx context.Context, inv *inventory.Inventory, r broker.Ra
 	if err := broker.Raise(r, names); err != nil {
 		return nil, err
 	}
-	// And each node's bucket for the files of its declaration that travel by digest (novox/hq ADR 0486 §4), so a node finds its own
-	// whenever the bus is up.
-	if files, ok := r.(interface{ EnsureDeclarationFiles(nodes []string) error }); ok {
-		if err := files.EnsureDeclarationFiles(names); err != nil {
-			return nil, err
-		}
-	}
 	// The work queues of the mesh's own roles (novox/hq ADR 0121). The queue before the holder,
 	// deliberately: work queues until somebody arrives to do it, so assigning a build machine a week
 	// after something started asking for builds flushes the backlog instead of having lost it.

cmd/mesh-controller/busobjects_test.go

@@ -9,8 +9,8 @@ import (
 
 	"github.com/nats-io/nats.go"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 

cmd/mesh-controller/busy_test.go

@@ -5,7 +5,7 @@ import (
 	"testing"
 	"time"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 

cmd/mesh-controller/catch_up.go

@@ -1,643 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"net/url"
-	"path"
-	"regexp"
-	"slices"
-	"sort"
-	"strconv"
-	"strings"
-	"sync"
-	"time"
-
-	"github.com/nats-io/nats.go"
-	"github.com/nats-io/nats.go/jetstream"
-
-	"git.novox.be/novox/mesh-sdk/go/asks"
-	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
-
-	"github.com/novox/mesh-controller/internal/conditions"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// **The controller catches up on merges it did not hear** (novox/hq ADR 0457, issue 1336). A merge the forge announced while the
-// controller was being replaced was never heard, and nothing asked for it again: the trunk held a merge no walk answered. At its
-// start, and each time it hears a merge, the controller reads the last catchUpWindow merge commits of a trunk from the forge, and
-// hears each one it holds no record of as if the forge had announced it then, on the warrant the router holds for it.
-// It lasts until release 6 of design 47 deletes delivery plans and batches (ADR 0429 §7, §8).
-
-// catchUpWindow is how many of a trunk's newest merge commits are read; an older merge is a person's to decide.
-const catchUpWindow = 50
-
-// kindMergeNotHeard is the condition of a merge the controller did not hear and holds no warrant to plan.
-const kindMergeNotHeard = "merge-not-heard"
-
-// trunkMerge is a merge commit of a trunk as the forge lists it.
-type trunkMerge struct {
-	Commit string
-	// Head is the merge commit's second parent: the pull request's head that was merged.
-	Head    string
-	Subject string
-	At      time.Time
-}
-
-// trunkCommit is a commit of a trunk as the forge lists it, newest first: a merge commit has a second parent.
-type trunkCommit struct {
-	Commit, SecondParent, Subject string
-	At                            time.Time
-}
-
-// trunkCommitsPage is one page (fifty) of a trunk's commits, newest first; empty past the last. A variable so a test needs no
-// forge.
-var trunkCommitsPage = func(ctx context.Context, owner, repo, branch string, page int) ([]trunkCommit, error) {
-	var found struct {
-		Result []struct {
-			SHA     string `json:"sha"`
-			Parents []struct {
-				SHA string `json:"sha"`
-			} `json:"parents"`
-			Commit struct {
-				Message   string `json:"message"`
-				Committer struct {
-					Date string `json:"date"`
-				} `json:"committer"`
-			} `json:"commit"`
-		} `json:"result"`
-	}
-	apiPath := fmt.Sprintf("/repos/%s/%s/commits?sha=%s&limit=50&page=%d&stat=false&verification=false&files=false",
-		owner, repo, url.QueryEscape(branch), page)
-	missing, err := askForgeApi(ctx, apiPath, &found)
-	if err != nil {
-		return nil, err
-	}
-	if missing {
-		return nil, fmt.Errorf("the forge holds no branch %s of %s/%s", branch, owner, repo)
-	}
-	var out []trunkCommit
-	for _, c := range found.Result {
-		at, _ := time.Parse(time.RFC3339, c.Commit.Committer.Date)
-		tc := trunkCommit{Commit: c.SHA, Subject: firstLine(c.Commit.Message), At: at.UTC()}
-		if len(c.Parents) >= 2 {
-			tc.SecondParent = c.Parents[1].SHA
-		}
-		out = append(out, tc)
-	}
-	return out, nil
-}
-
-// readTrunkMerges is the last catchUpWindow merge commits of a repository's trunk, oldest first: pages are read until that many
-// merges are held or the trunk ends.
-func readTrunkMerges(ctx context.Context, owner, repo, branch string) ([]trunkMerge, error) {
-	var merges []trunkMerge
-	for page := 1; page <= 8 && len(merges) < catchUpWindow; page++ {
-		commits, err := trunkCommitsPage(ctx, owner, repo, branch, page)
-		if err != nil {
-			return nil, err
-		}
-		if len(commits) == 0 {
-			break
-		}
-		for _, c := range commits {
-			// A merge of the trunk is a pull request's merge into it. A commit with a second parent that is none is a merge made
-			// inside some branch ("Merge remote-tracking branch 'origin/main' into fix/..."), which the trunk's history lists too and
-			// which no Approve ever covered: read as a gap it would raise a condition for nothing a person decides.
-			if c.SecondParent != "" && mergesIntoTrunk(c.Subject, branch) {
-				merges = append(merges, trunkMerge{Commit: c.Commit, Head: c.SecondParent, Subject: c.Subject, At: c.At})
-			}
-		}
-	}
-	return lastMerges(merges), nil
-}
-
-// sinceTheRecord are the merges that can be gaps (novox/hq ADR 0463 §2): those made since the controller's record of merges begins on
-// the mesh (first, the earliest merge it holds of any repository and branch, less mergeGrace as owedLate judges). A merge before it is
-// history on every trunk, and a trunk with no merge kept of its own still has the merges made since as gaps. With no merge kept
-// anywhere there is no record to have a gap in.
-func sinceTheRecord(merges []trunkMerge, kept bool, first time.Time) []trunkMerge {
-	if !kept {
-		return nil
-	}
-	var out []trunkMerge
-	for _, m := range merges {
-		if !m.At.Before(first.Add(-mergeGrace)) {
-			out = append(out, m)
-		}
-	}
-	return out
-}
-
-// lastMerges is the newest catchUpWindow of merges, given newest first, oldest first.
-func lastMerges(newestFirst []trunkMerge) []trunkMerge {
-	if len(newestFirst) > catchUpWindow {
-		newestFirst = newestFirst[:catchUpWindow]
-	}
-	out := slices.Clone(newestFirst)
-	slices.Reverse(out)
-	return out
-}
-
-var mergeSubject = regexp.MustCompile(`^Merge pull request '(.*)' \(#(\d+)\) from (\S+) into (\S+)$`)
-
-// pullOfSubject is the pull request a merge commit's subject names: its title and number.
-func pullOfSubject(subject string) (title string, number int, ok bool) {
-	m := mergeSubject.FindStringSubmatch(strings.TrimSpace(subject))
-	if m == nil {
-		return "", 0, false
-	}
-	n, err := strconv.Atoi(m[2])
-	if err != nil || n <= 0 {
-		return "", 0, false
-	}
-	return m[1], n, true
-}
-
-// mergesIntoTrunk says a commit's subject is a pull request's merge into this trunk.
-func mergesIntoTrunk(subject, branch string) bool {
-	m := mergeSubject.FindStringSubmatch(strings.TrimSpace(subject))
-	return m != nil && m[4] == branch
-}
-
-// headBranchOfSubject is the branch a merge commit's subject says was merged.
-func headBranchOfSubject(subject string) string {
-	if m := mergeSubject.FindStringSubmatch(strings.TrimSpace(subject)); m != nil {
-		return m[3]
-	}
-	return ""
-}
-
-// readMergeEvent is the merge as the forge would have announced it: the commit, the pull request, the files it changed and the
-// directories among them that hold a module.json. A variable so a test needs no forge.
-var readMergeEvent = func(ctx context.Context, owner, repo, branch string, tm trunkMerge) (link.SourceMoved, error) {
-	m := link.SourceMoved{Owner: owner, Repo: repo, Base: branch, Head: headBranchOfSubject(tm.Subject), HeadSHA: tm.Head,
-		Commit: tm.Commit, MergedAt: tm.At.UTC().Format(time.RFC3339)}
-	if title, number, ok := pullOfSubject(tm.Subject); ok {
-		m.Number, m.Title = number, title
-	}
-	var found struct {
-		Result struct {
-			Files []struct {
-				Filename string `json:"filename"`
-				Status   string `json:"status"`
-			} `json:"files"`
-		} `json:"result"`
-	}
-	missing, err := askForgeApi(ctx, "/repos/"+owner+"/"+repo+"/git/commits/"+url.PathEscape(tm.Commit), &found)
-	if err != nil {
-		return m, err
-	}
-	if missing || len(found.Result.Files) == 0 {
-		return m, fmt.Errorf("the forge named no files for the merge %.8s of %s/%s", tm.Commit, owner, repo)
-	}
-	for _, f := range found.Result.Files {
-		m.Paths = append(m.Paths, f.Filename)
-		if f.Status == "removed" || f.Status == "deleted" {
-			m.Removed = append(m.Removed, f.Filename)
-		}
-	}
-	// The forge lists a merge's files by the page; a list as long as a page may be a beginning.
-	m.PathsTruncated = len(m.Paths) >= 300
-	dirs := map[string]bool{}
-	for _, p := range m.Paths {
-		for d := path.Dir(p); ; d = path.Dir(d) {
-			dirs[d] = true
-			if d == "." || d == "/" {
-				break
-			}
-		}
-	}
-	if len(dirs) > 64 {
-		return m, nil // too many to look at: the old rule stands, a directory is a module when its manifest changed
-	}
-	var holding []string
-	for d := range dirs {
-		file := "module.json"
-		if d != "." {
-			file = d + "/module.json"
-		}
-		_, exists, err := manifestCached(ctx, owner, repo, file, tm.Commit)
-		if err != nil {
-			return m, err
-		}
-		if exists {
-			holding = append(holding, d)
-		}
-	}
-	sort.Strings(holding)
-	m.ModuleDirs, m.ModuleDirsSaid = holding, true
-	return m, nil
-}
-
-// mergeAskPrefix is what the id of a merge ask made by the retired module mesh-delivery begins with: the pull request's number
-// and the head's first twelve digits (`merge-<number>-<head>-<try>`). The teller's ids name neither (see findMergeWarrant).
-func mergeAskPrefix(number int, head string) string {
-	if len(head) > 12 {
-		head = head[:12]
-	}
-	return fmt.Sprintf("merge-%d-%s-", number, head)
-}
-
-// askersOfMerges are the askers a merge's warrant is read under: the teller alone (ADR 0437 §6), since R4e stopped taking
-// mesh-delivery's (ADR 0450 §8; issue 1318).
-func askersOfMerges() []string { return []string{sdkdelivery.TellerModule} }
-
-// caughtUpWarrant judges a chosen merge ask of the router as the warrant of a merge: the ask is the operator's, the warrant
-// answers that very ask as it was published, and it is the operator's Approve proved by the channel it came through (ADR 0437
-// §6, as movedOnApprove judges an announced one). The heads the Approve was bound to are checked by the caller, where it can
-// name them.
-func caughtUpWarrant(asker string, ask *asks.Ask, w *asks.Warrant) (string, error) {
-	if err := askerAccepted(asker); err != nil {
-		return "", err
-	}
-	switch {
-	case ask == nil || w == nil:
-		return "", errors.New("the router holds no closed record of the ask")
-	case ask.Who != asks.Operator:
-		return "", fmt.Errorf("the ask %s is for %q to answer, not the operator", ask.ID, ask.Who)
-	}
-	option, err := w.For(asker, *ask)
-	if err != nil {
-		return "", err
-	}
-	if option.ID != optionApprove || w.Option != optionApprove {
-		return "", fmt.Errorf("the operator chose %q on the ask %s, not an Approve", w.Option, w.Ask)
-	}
-	if w.By == nil || w.By.Who != asks.Operator || w.By.Verified == "" {
-		return "", fmt.Errorf("the ask %s was not answered by the operator on a channel that proves who answered", w.Ask)
-	}
-	return w.Says() + " (ask " + w.Ask + ")", nil
-}
-
-// routerAskIDs are the ids of the asks an asker has in the router's record. A variable so a test needs no bus.
-var routerAskIDs = func(ctx context.Context, inv catalogueReader, asker string) ([]string, error) {
-	serving := servingBus.Load()
-	if serving == nil {
-		return nil, errors.New("only the serving controller reads the router's record")
-	}
-	bucket, err := asksRecords(ctx, inv)
-	if err != nil {
-		return nil, err
-	}
-	if bucket == "" {
-		return nil, errors.New("no module declares the operator channel's records")
-	}
-	api, err := jetstream.New(serving.Conn())
-	if err != nil {
-		return nil, err
-	}
-	kv, err := api.KeyValue(ctx, bucket)
-	if err != nil {
-		return nil, err
-	}
-	return askIDsOf(ctx, kv, asker)
-}
-
-// askIDsOf are the ids of the asks an asker has in the router's bucket.
-func askIDsOf(ctx context.Context, kv jetstream.KeyValue, asker string) ([]string, error) {
-	lister, err := kv.ListKeysFiltered(ctx, asker+".>")
-	if err != nil {
-		return nil, err
-	}
-	var ids []string
-	for key := range lister.Keys() {
-		ids = append(ids, strings.TrimPrefix(key, asker+"."))
-	}
-	// The lister stops its own watch when it has sent the last key, so a stop of ours finds it stopped: nats answers that with
-	// "invalid subscription", which is no failure of the read (issue 1336). Any other error stays one.
-	if err := lister.Stop(); err != nil && !errors.Is(err, nats.ErrBadSubscription) {
-		return nil, err
-	}
-	return ids, nil
-}
-
-// closedRecord is a router record of an ask that ended: it never changes, so it is read once.
-type closedRecord struct {
-	ask *asks.Ask
-	w   *asks.Warrant
-}
-
-var closedRecords sync.Map // asker + "." + id -> closedRecord
-
-// closedRecordOf is the router's record of an ask, kept once it is closed. A nil ask is an ask still open, ended without a
-// choice, or not there.
-func closedRecordOf(ctx context.Context, inv catalogueReader, asker, id string) (*asks.Ask, *asks.Warrant, error) {
-	if v, ok := closedRecords.Load(asker + "." + id); ok {
-		r := v.(closedRecord)
-		return r.ask, r.w, nil
-	}
-	ask, w, err := routerAskOf(ctx, inv, asker, id)
-	if err != nil {
-		return nil, nil, err
-	}
-	if ask != nil && w != nil {
-		closedRecords.Store(asker+"."+id, closedRecord{ask, w})
-	}
-	return ask, w, nil
-}
-
-// deliveryIDOf is the id the gate gives a delivery, and so the key of its head in the heads an Approve binds: the repository as
-// owner/name, lower-cased, `@` and the first twelve characters of the head.
-func deliveryIDOf(owner, repo, head string) string {
-	if len(head) > 12 {
-		head = head[:12]
-	}
-	return strings.ToLower(owner+"/"+repo) + "@" + head
-}
-
-// coversHead says an ask the operator approved is for this merge: its Approve is bound to the heads of the pull request alone
-// (mergeAct over {delivery id: head}, which is how a pull request not in a group is asked), or, for a group's ask, whose other
-// members' heads the router's record does not carry in full, the ask as published names this pull request at this head in its
-// details ("<repo>#<number> ... at <head>:"), and the digest the warrant answers covers those words.
-func coversHead(ask *asks.Ask, owner, repo string, number int, head string) (how string, ok bool) {
-	option, found := ask.Option(optionApprove)
-	if !found {
-		return "", false
-	}
-	heads := map[string]string{deliveryIDOf(owner, repo, head): head}
-	if option.Performs(mergeAct(ask.ID, optionApprove, heads)) == nil {
-		return "bound to the head of this pull request", true
-	}
-	short := head
-	if len(short) > 12 {
-		short = short[:12]
-	}
-	line := regexp.MustCompile(`(?m)^` + regexp.QuoteMeta(repo) + `#` + strconv.Itoa(number) + ` .* at ` + regexp.QuoteMeta(short) + `:`)
-	if line.MatchString(ask.Details) {
-		return "a group's ask naming this pull request at this head", true
-	}
-	return "", false
-}
-
-// findMergeWarrant finds the warrant of a merge, with no read the controller does not make today: the router's chosen merge
-// ask for it. Under the teller (releases 3e on) the id is `merge-<group>-<heads hash>-<tail>`, which names neither the pull
-// request nor the head, so the teller's closed asks are read and the one the operator approved whose heads cover the merge's
-// second parent is the warrant (coversHead). Under mesh-delivery, which made the earlier merges, the id names the pull request
-// and the head and is found by them. Why it holds; or found false with why not, for a person to read; or an error when the
-// router could not be read, which is no answer. A variable so a test needs no bus.
-var findMergeWarrant = func(ctx context.Context, inv catalogueReader, owner, repo string, number int, head string) (why string, found bool, reason string, err error) {
-	reason = "the router holds no chosen merge ask of " + strings.Join(askersOfMerges(), " or ") + " that covers the head " + head[:min(12, len(head))]
-	for _, asker := range askersOfMerges() {
-		ids, err := routerAskIDs(ctx, inv, asker)
-		if err != nil {
-			return "", false, "", err
-		}
-		for _, id := range ids {
-			named := number > 0 && strings.HasPrefix(id, mergeAskPrefix(number, head))
-			if asker == sdkdelivery.TellerModule && !strings.HasPrefix(id, sdkdelivery.AskKindMerge+"-") {
-				continue
-			}
-			ask, w, err := closedRecordOf(ctx, inv, asker, id)
-			if err != nil {
-				return "", false, "", err
-			}
-			if ask == nil || w == nil {
-				continue
-			}
-			warrant, err := caughtUpWarrant(asker, ask, w)
-			if err != nil {
-				if named {
-					reason = fmt.Sprintf("%s's ask %s holds no operator's Approve: %v", asker, id, err)
-				}
-				continue
-			}
-			how, covers := coversHead(ask, owner, repo, number, head)
-			if !covers && !named {
-				continue
-			}
-			if !covers {
-				how = "the ask's id names this pull request and head"
-			}
-			return warrant + ", " + how, true, "", nil
-		}
-	}
-	return "", false, reason, nil
-}
-
-// caughtTrunk is one trunk the catalogue builds from.
-type caughtTrunk struct{ Owner, Repo, Branch string }
-
-func (t caughtTrunk) repository() string { return t.Owner + "/" + t.Repo }
-
-// trunksOfCatalogue are the trunks of the repositories on the mesh's forge the catalogue builds a module from.
-func trunksOfCatalogue(forms *sourceForms, entries []inventory.Entry) []caughtTrunk {
-	var out []caughtTrunk
-	for _, e := range entries {
-		if e.Provided || e.Source.Repository == "" {
-			continue
-		}
-		owner, name, onForge := forms.onTheForge(e.Source.Repository, e.Source.Seat)
-		if !onForge {
-			continue
-		}
-		branch := followedBranch(e.Source.Ref)
-		if branch == "" {
-			branch = "main"
-		}
-		t := caughtTrunk{owner, name, branch}
-		if !slices.Contains(out, t) {
-			out = append(out, t)
-		}
-	}
-	return out
-}
-
-// catchUpBeside runs a catch-up beside the hearing of the merge that asked for it, so the bus's acknowledgement of that merge
-// waits for no forge. A variable so a test runs it where it stands.
-var catchUpBeside = func(run func()) { go run() }
-
-// catchingUp makes one catch-up at a time.
-var catchingUp sync.Mutex
-
-// settledMerges are the merges this process found nothing to plan for: heard, and no record kept, because nothing reads them.
-// They are not read from the forge again.
-var settledMerges sync.Map
-
-// catchUp hears the merges of the catalogue's trunks (only one, when only names it) that the controller holds no record of.
-// It says whether a trunk was left for later: the forge, the router or the store did not answer.
-func (f following) catchUp(ctx context.Context, only *caughtTrunk) (later bool) {
-	catchingUp.Lock()
-	defer catchingUp.Unlock()
-	inv := f.open.inventory
-	entries, err := inv.Catalogued(ctx)
-	if err != nil {
-		fmt.Printf("catch-up: the catalogue cannot be read, so no merge is caught up now: %v\n", err)
-		return true
-	}
-	kept, first, err := inv.EarliestKept(ctx)
-	if err != nil {
-		fmt.Printf("catch-up: what the controller kept cannot be read, so no merge is caught up now: %v\n", err)
-		return true
-	}
-	if kept {
-		fmt.Printf("catch-up: the controller's record of merges begins %s; a merge made before it, less %s, is history on every trunk\n",
-			first.UTC().Format(time.RFC3339), mergeGrace)
-	} else {
-		fmt.Println("catch-up: the controller holds no merge of any trunk yet, so none can have been missed")
-	}
-	trunks := trunksOfCatalogue(newSourceForms(ctx, inv), entries)
-	if only != nil {
-		trunks = slices.DeleteFunc(trunks, func(t caughtTrunk) bool {
-			return !strings.EqualFold(t.repository(), only.repository()) || t.Branch != only.Branch
-		})
-	}
-	for _, t := range trunks {
-		if f.catchUpTrunk(ctx, t, kept, first) {
-			later = true
-		}
-	}
-	return later
-}
-
-func (f following) catchUpTrunk(ctx context.Context, t caughtTrunk, kept bool, first time.Time) (later bool) {
-	inv := f.open.inventory
-	repository := t.repository()
-	merges, err := readTrunkMerges(ctx, t.Owner, t.Repo, t.Branch)
-	if err != nil {
-		// Not nothing to catch up: left for the next start or the next heard merge (ADR 0457 clause 3).
-		fmt.Printf("catch-up: the forge did not answer for the last merges of %s %s, so they are not caught up now; the next start "+
-			"or the next merge heard there does it: %v\n", repository, t.Branch, err)
-		return true
-	}
-	// **A merge made before the controller's record of merges begins is history, never a gap** (novox/hq ADR 0463 §2).
-	read := len(merges)
-	merges = sinceTheRecord(merges, kept, first)
-	fmt.Printf("catch-up: %s %s: %d of the last %d pull request merges were made since the record began\n", repository, t.Branch,
-		len(merges), read)
-	unwarranted := map[string]bool{}
-	for _, tm := range merges {
-		id := fmt.Sprintf("%s_%.8s", repository, tm.Commit)
-		if _, done := settledMerges.Load(repository + "@" + tm.Commit); done {
-			continue
-		}
-		if _, known, err := inv.MergeOf(ctx, repository, tm.Commit); err != nil {
-			fmt.Printf("catch-up: the record of %s cannot be read, so %s is not caught up now: %v\n", repository, tm.Commit[:8], err)
-			return true
-		} else if known {
-			continue
-		}
-		m, err := readMergeEvent(ctx, t.Owner, t.Repo, t.Branch, tm)
-		if err != nil {
-			fmt.Printf("catch-up: the merge %.8s of %s cannot be read from the forge, so it is not caught up now: %v\n", tm.Commit, repository, err)
-			later = true
-			continue
-		}
-		entries, err := inv.Catalogued(ctx)
-		if err != nil {
-			return true
-		}
-		read, err := readForPlanning(ctx, inv)
-		if err != nil {
-			return true
-		}
-		facts, err := factsOfMerge(ctx, inv, m, time.Now().UTC(), entries, read)
-		if err != nil {
-			fmt.Printf("catch-up: %s %.8s cannot be judged now: %v\n", repository, tm.Commit, err)
-			later = true
-			continue
-		}
-		// The very test hearMerge makes: a merge it would plan, or take as a first build, is a gap; any other it would say
-		// nothing reads, and is no gap for a person to decide.
-		if !facts.plans() && !facts.addsModuleToBuilds {
-			settledMerges.Store(repository+"@"+tm.Commit, true)
-			continue
-		}
-		why, found, reason, err := findMergeWarrant(ctx, inv, t.Owner, t.Repo, m.Number, tm.Head)
-		if err != nil {
-			fmt.Printf("catch-up: the router cannot be read, so %s %.8s is not caught up now: %v\n", repository, tm.Commit, err)
-			later = true
-			continue
-		}
-		if !found {
-			unwarranted[id] = true
-			f.raiseMergeNotHeard(ctx, repository, t.Branch, tm, m, reason)
-			continue
-		}
-		now := time.Now().UTC()
-		said := fmt.Sprintf("caught up: merged %s, not heard, planned %s", tm.At.Format(time.RFC3339), now.Format(time.RFC3339))
-		fmt.Printf("catch-up: %s merged into %s (%.8s) was not heard; %s; on the warrant %s\n", repository, t.Branch, tm.Commit, said, why)
-		m.Title = strings.TrimSpace(m.Title + " (" + said + ")")
-		if err := f.hearMerge(ctx, m, now); err != nil {
-			fmt.Printf("catch-up: %s %.8s could not be heard now: %v\n", repository, tm.Commit, err)
-			later = true
-			continue
-		}
-		if _, known, err := inv.MergeOf(ctx, repository, tm.Commit); err == nil && !known {
-			settledMerges.Store(repository+"@"+tm.Commit, true) // heard, and nothing reads it
-		}
-	}
-	// Cleared only when every gap was judged: one left for later may still be open.
-	if !later {
-		f.clearMergesHeard(ctx, repository, unwarranted)
-	}
-	return later
-}
-
-// raiseMergeNotHeard keeps open, and observes again, the condition of a merge with no warrant to plan it. One for each
-// repository and commit, however many catch-ups find it.
-func (f following) raiseMergeNotHeard(ctx context.Context, repository, branch string, tm trunkMerge, m link.SourceMoved, reason string) {
-	fmt.Printf("catch-up: %s merged into %s (%.8s) was not heard, and is not planned: %s\n", repository, branch, tm.Commit, reason)
-	if conditionsFrom == nil {
-		return
-	}
-	o := conditions.Observation{Scope: conditions.ScopeMerge, ID: fmt.Sprintf("%s_%.8s", repository, tm.Commit), Kind: kindMergeNotHeard,
-		Severity: conditions.Warning, Source: "catch-up", Resolver: conditions.ResolverOperator,
-		Summary: fmt.Sprintf("the merge %.8s of %s into %s was not heard by the controller, and no operator's Approve of it is on "+
-			"record to plan it on: a person decides", tm.Commit, repository, branch),
-		Said: fmt.Sprintf("%s %.8s (pull request %d, head %.8s, merged %s): %s", repository, tm.Commit, m.Number, tm.Head,
-			tm.At.Format(time.RFC3339), reason),
-		Headline: fmt.Sprintf("A merge into %s was never delivered", repository),
-		Explanation: fmt.Sprintf("A merge into %s was made while the controller did not hear it, and no Approve of yours for it is on "+
-			"record that the controller can plan it on. It stays open while the merge is among the latest %d merges of that repository. "+
-			"The details say what was looked for.", repository, catchUpWindow),
-		Needs:    "decide whether that merge should be delivered, and say so if it should.",
-		Resolved: "the merge is planned, or is no longer among the latest merges of its repository"}
-	if _, err := conditionsFrom.Observe(ctx, o); err != nil {
-		fmt.Printf("catch-up: the condition of %s %.8s could not be kept: %v\n", repository, tm.Commit, err)
-	}
-}
-
-// clearMergesHeard clears the open conditions of a repository's merges not heard that this catch-up did not find again: the
-// gap was planned, or left the window.
-func (f following) clearMergesHeard(ctx context.Context, repository string, still map[string]bool) {
-	if conditionsFrom == nil {
-		return
-	}
-	open, err := conditionsFrom.Open(ctx)
-	if err != nil {
-		fmt.Printf("catch-up: the open conditions cannot be read, so none is cleared now: %v\n", err)
-		return
-	}
-	for _, c := range open {
-		if c.Kind != kindMergeNotHeard || c.Subject.Scope != conditions.ScopeMerge ||
-			!strings.HasPrefix(c.Subject.ID, repository+"_") || still[c.Subject.ID] {
-			continue
-		}
-		if _, err := conditionsFrom.Clear(ctx, c.Key, "the merge is planned, or left the last merges of its trunk"); err != nil {
-			fmt.Printf("catch-up: the condition %s could not be cleared: %v\n", c.Key, err)
-		}
-	}
-}
-
-// catchUpAtStart catches up every trunk once the controller serves, and again every minute while a trunk was left for later.
-func catchUpAtStart(ctx context.Context, open *stores) {
-	select {
-	case <-ctx.Done():
-		return
-	case <-time.After(30 * time.Second):
-	}
-	for try := 0; try < 20; try++ {
-		if !(following{open: open}).catchUp(ctx, nil) {
-			return
-		}
-		select {
-		case <-ctx.Done():
-			return
-		case <-time.After(time.Minute):
-		}
-	}
-	fmt.Println("catch-up: a trunk is still left for later after twenty tries; the next merge heard there does it")
-}

cmd/mesh-controller/catch_up_integration_test.go

@@ -1,352 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/conditions"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// The checks of ADR 0457 (issue 1336): what the controller does about merges it did not hear.
-
-// aTrunk is a forge's trunk as the catch-up reads it: its merges oldest first, the module each moves, and which of them the
-// router holds an operator's Approve for.
-type aTrunk struct {
-	merges   []trunkMerge
-	module   map[string]string
-	approved map[string]bool
-	read     []string // the trunks asked of the forge, as owner/repo
-	events   int      // merges read in full from the forge
-	silent   bool     // the forge does not answer
-}
-
-func aTrunkOf(t *testing.T, repo string, modules ...string) *aTrunk {
-	t.Helper()
-	tr := &aTrunk{module: map[string]string{}, approved: map[string]bool{}}
-	for i, m := range modules {
-		c := fmt.Sprintf("%s-c%02d", repo, i+1)
-		tr.merges = append(tr.merges, trunkMerge{Commit: c, Head: fmt.Sprintf("%shead%02d", repo, i+1),
-			Subject: fmt.Sprintf("Merge pull request 'change %d' (#%d) from pr/%s into main", i+1, 100+i, c),
-			At:      t0.Add(time.Duration(i) * time.Minute)})
-		tr.module[c] = m
-		tr.approved[c] = true
-	}
-	was, wasEvent, wasWarrant := trunkCommitsPage, readMergeEvent, findMergeWarrant
-	trunkCommitsPage = func(_ context.Context, owner, name, _ string, page int) ([]trunkCommit, error) {
-		tr.read = append(tr.read, owner+"/"+name)
-		if tr.silent {
-			return nil, errors.New("the forge did not answer")
-		}
-		if page > 1 || owner+"/"+name != "novox/"+repo {
-			return nil, nil
-		}
-		var newest []trunkCommit
-		for i := len(tr.merges) - 1; i >= 0; i-- {
-			m := tr.merges[i]
-			newest = append(newest, trunkCommit{Commit: m.Commit, SecondParent: m.Head, Subject: m.Subject, At: m.At})
-		}
-		return newest, nil
-	}
-	readMergeEvent = func(_ context.Context, owner, name, branch string, tm trunkMerge) (link.SourceMoved, error) {
-		tr.events++
-		m := catalogueMerge(tm.Commit, tr.module[tm.Commit], tm.At)
-		m.Owner, m.Repo, m.Base, m.HeadSHA = owner, name, branch, tm.Head
-		_, m.Number, _ = pullOfSubject(tm.Subject)
-		return m, nil
-	}
-	findMergeWarrant = func(_ context.Context, _ catalogueReader, _, _ string, number int, head string) (string, bool, string, error) {
-		for _, m := range tr.merges {
-			if strings.Contains(m.Subject, fmt.Sprintf("(#%d)", number)) && m.Head == head && tr.approved[m.Commit] {
-				return "the operator chose Approve (ask merge-" + fmt.Sprint(number) + ")", true, "", nil
-			}
-		}
-		return "", false, "the router holds no chosen merge ask for the pull request and head", nil
-	}
-	wasBeside := catchUpBeside
-	catchUpBeside = func(run func()) { run() }
-	t.Cleanup(func() {
-		trunkCommitsPage, readMergeEvent, findMergeWarrant, catchUpBeside = was, wasEvent, wasWarrant, wasBeside
-		settledMerges.Clear()
-	})
-	return tr
-}
-
-// aKeptMergeBefore is a merge the controller heard before the merges of a test: where its record begins, so what a trunk holds from
-// then on can be a gap (novox/hq ADR 0463 §2).
-func aKeptMergeBefore(t *testing.T, open *stores) {
-	t.Helper()
-	hear(t, open, catalogueMerge("mesh-catalog-seed", "app", t0.Add(-time.Hour)), t0.Add(-time.Hour))
-}
-
-func mergeKnown(t *testing.T, open *stores, commit string) bool {
-	t.Helper()
-	_, known, err := open.inventory.MergeOf(t.Context(), "novox/mesh-catalog", commit)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return known
-}
-
-// Clause 1: the trunk holds merges 1, 2 and 3 and the controller holds records of 1 and 3 only; at its start it plans 2, said
-// as caught up; a second start plans nothing new.
-func TestAGapBeforeANewerHeardMergeIsPlannedAtTheControllersStart(t *testing.T) {
-	open := windowed(t)
-	everyHeadWaits(t)
-	asksRecorded(t)
-	tr := aTrunkOf(t, "mesh-catalog", "app", "notes", "app")
-	hear(t, open, catalogueMerge("mesh-catalog-c01", "app", t0), t0.Add(time.Second))
-	hear(t, open, catalogueMerge("mesh-catalog-c03", "app", t0.Add(2*time.Minute)), t0.Add(2*time.Minute+time.Second))
-	if mergeKnown(t, open, "mesh-catalog-c02") {
-		t.Fatal("the merge to be caught up is known before the catch-up")
-	}
-	if (following{open: open}).catchUp(t.Context(), nil) {
-		t.Fatal("the catch-up says a trunk was left for later")
-	}
-	if !mergeKnown(t, open, "mesh-catalog-c02") {
-		t.Fatal("the merge the controller did not hear was not planned")
-	}
-	kept, _, _ := open.inventory.MergeOf(t.Context(), "novox/mesh-catalog", "mesh-catalog-c02")
-	if said := announcedOf(kept).Title; !strings.Contains(said, "caught up: merged ") || !strings.Contains(said, "not heard, planned ") {
-		t.Fatalf("the merge does not say it was caught up: %q", said)
-	}
-	cutAt(t, open, t0.Add(10*time.Minute))
-	ws, _ := walks(t, open)
-	if len(ws) == 0 {
-		t.Fatal("no walk answers the caught-up merge")
-	}
-	if _, in := ws[0].Modules["notes"]; !in {
-		t.Fatalf("the walk does not build notes, which the caught-up merge moved: %v", ws[0].Modules)
-	}
-	before := tr.events
-	if (following{open: open}).catchUp(t.Context(), nil) || tr.events != before {
-		t.Fatalf("a second start read %d merge(s) in full again", tr.events-before)
-	}
-}
-
-// Clause 1: a heard merge of a repository whose trunk holds earlier merges the controller has no record of plans them all, the
-// earlier first, and the forge is read for that repository's trunk only.
-func TestAHeardMergeCatchesUpTheEarlierOnesOfItsOwnTrunkOnly(t *testing.T) {
-	open := windowed(t)
-	everyHeadWaits(t)
-	asksRecorded(t)
-	tr := aTrunkOf(t, "mesh-catalog", "app", "notes", "app")
-	var order []string
-	inner := readMergeEvent
-	readMergeEvent = func(ctx context.Context, owner, name, branch string, tm trunkMerge) (link.SourceMoved, error) {
-		order = append(order, tm.Commit)
-		return inner(ctx, owner, name, branch, tm)
-	}
-	t.Cleanup(func() { readMergeEvent = inner })
-	tr.read = nil
-	heard := catalogueMerge("mesh-catalog-c03", "app", t0.Add(2*time.Minute))
-	if err := (following{open: open}).SourceMoved(t.Context(), heard); err != nil {
-		t.Fatal(err)
-	}
-	for _, c := range []string{"mesh-catalog-c01", "mesh-catalog-c02", "mesh-catalog-c03"} {
-		if !mergeKnown(t, open, c) {
-			t.Fatalf("%s is not planned: the heard merge and the earlier ones of its trunk are all wanted", c)
-		}
-	}
-	if len(order) != 2 || order[0] != "mesh-catalog-c01" || order[1] != "mesh-catalog-c02" {
-		t.Fatalf("the earlier merges were heard in the order %v, not the trunk's", order)
-	}
-	if len(tr.read) == 0 {
-		t.Fatal("the forge was not read for the trunk of the merge heard")
-	}
-	for _, r := range tr.read {
-		if r != "novox/mesh-catalog" {
-			t.Fatalf("the forge was read for %s, not only for the trunk of the merge heard: %v", r, tr.read)
-		}
-	}
-}
-
-// Clause 1: a trunk of fifty-one merges whose oldest is unheard plans nothing: the oldest is outside the window.
-func TestAMergeOlderThanTheLastFiftyIsNotRead(t *testing.T) {
-	open := windowed(t)
-	everyHeadWaits(t)
-	asksRecorded(t)
-	modules := make([]string, 51)
-	for i := range modules {
-		modules[i] = "app"
-	}
-	aTrunkOf(t, "mesh-catalog", modules...)
-	// Fifty are known; the oldest is not.
-	for i := 2; i <= 51; i++ {
-		c := fmt.Sprintf("mesh-catalog-c%02d", i)
-		hear(t, open, catalogueMerge(c, "app", t0.Add(time.Duration(i)*time.Minute)), t0.Add(time.Duration(i)*time.Minute+time.Second))
-	}
-	// Paged as the forge pages: fifty a page, and a trunk of another repository is empty (a short page, or none).
-	pages := trunkCommitsPage
-	trunkCommitsPage = func(ctx context.Context, owner, name, branch string, page int) ([]trunkCommit, error) {
-		all, err := pages(ctx, owner, name, branch, 1)
-		if err != nil || page < 1 || (page-1)*50 >= len(all) {
-			return nil, err
-		}
-		return all[(page-1)*50 : min(page*50, len(all))], nil
-	}
-	t.Cleanup(func() { trunkCommitsPage = pages })
-	(following{open: open}).catchUp(t.Context(), nil)
-	if mergeKnown(t, open, "mesh-catalog-c01") {
-		t.Fatal("the oldest of fifty-one merges was read and planned, outside the window")
-	}
-}
-
-// Clause 2: a gap with no chosen Approve in the router is not planned and raises one condition naming its repository and
-// commit; a second start leaves that one condition open, observed twice; planning the gap clears it.
-func TestAGapWithNoApproveRaisesOneConditionKeptOpenAndClearedWhenPlanned(t *testing.T) {
-	open := windowed(t)
-	everyHeadWaits(t)
-	asksRecorded(t)
-	aKeptMergeBefore(t, open)
-	keeper, _ := withConditionsInMemory(t)
-	tr := aTrunkOf(t, "mesh-catalog", "notes")
-	tr.approved["mesh-catalog-c01"] = false
-	catch := func() { (following{open: open}).catchUp(t.Context(), nil) }
-	catch()
-	if mergeKnown(t, open, "mesh-catalog-c01") {
-		t.Fatal("a merge with no Approve on record was planned")
-	}
-	raised := func() []conditions.Condition {
-		t.Helper()
-		all, err := keeper.Open(t.Context())
-		if err != nil {
-			t.Fatal(err)
-		}
-		var out []conditions.Condition
-		for _, c := range all {
-			if c.Kind == kindMergeNotHeard {
-				out = append(out, c)
-			}
-		}
-		return out
-	}
-	one := raised()
-	if len(one) != 1 || !strings.Contains(one[0].Subject.ID, "novox/mesh-catalog") || !strings.Contains(one[0].Subject.ID, "mesh-cata") {
-		t.Fatalf("the gap raised %+v, not one condition naming its repository and commit", one)
-	}
-	catch()
-	if again := raised(); len(again) != 1 || again[0].Observations < 2 {
-		t.Fatalf("a second catch-up left %+v: one condition, observed twice, was wanted", again)
-	}
-	tr.approved["mesh-catalog-c01"] = true
-	catch()
-	if !mergeKnown(t, open, "mesh-catalog-c01") {
-		t.Fatal("the gap was not planned once its Approve was on record")
-	}
-	if left := raised(); len(left) != 0 {
-		t.Fatalf("planning the gap left its condition open: %+v", left)
-	}
-}
-
-// Clause 3: a forge that does not answer leaves the catch-up undone and says so, and the next start does it.
-func TestAForgeThatDoesNotAnswerLeavesTheCatchUpForTheNextStart(t *testing.T) {
-	open := windowed(t)
-	everyHeadWaits(t)
-	asksRecorded(t)
-	aKeptMergeBefore(t, open)
-	tr := aTrunkOf(t, "mesh-catalog", "notes")
-	tr.silent = true
-	if later := (following{open: open}).catchUp(t.Context(), nil); !later {
-		t.Fatal("a forge that did not answer counted as nothing to catch up")
-	}
-	if mergeKnown(t, open, "mesh-catalog-c01") {
-		t.Fatal("a merge was planned without the forge's word")
-	}
-	tr.silent = false
-	if later := (following{open: open}).catchUp(t.Context(), nil); later || !mergeKnown(t, open, "mesh-catalog-c01") {
-		t.Fatalf("the next start did not catch up (left for later: %v)", later)
-	}
-}
-
-// Finding 2 of the review: a gap that adds a module is a gap, judged as hearMerge judges it. With the operator's Approve on record it
-// is heard (hearMerge asks the new module in its walk); without, it raises the condition and is not lost in silence.
-func TestAGapThatAddsAModuleIsHeardOnItsWarrantAndRaisedWithout(t *testing.T) {
-	open := windowed(t)
-	everyHeadWaits(t)
-	asksRecorded(t)
-	aKeptMergeBefore(t, open)
-	keeper, _ := withConditionsInMemory(t)
-	tr := aTrunkOf(t, "mesh-catalog", "newmodule")
-	tr.approved["mesh-catalog-c01"] = false
-	catch := func() { (following{open: open}).catchUp(t.Context(), nil) }
-	catch()
-	if mergeKnown(t, open, "mesh-catalog-c01") {
-		t.Fatal("a merge adding a module was heard with no Approve on record")
-	}
-	all, err := keeper.Open(t.Context())
-	if err != nil {
-		t.Fatal(err)
-	}
-	var raised int
-	for _, c := range all {
-		if c.Kind == kindMergeNotHeard {
-			raised++
-		}
-	}
-	if raised != 1 {
-		t.Fatalf("a merge adding a module with no Approve raised %d condition(s), not one: it was lost in silence", raised)
-	}
-	tr.approved["mesh-catalog-c01"] = true
-	catch()
-	if !mergeKnown(t, open, "mesh-catalog-c01") {
-		t.Fatal("a merge adding a module was not heard once its Approve was on record")
-	}
-}
-
-// A trunk with merges from before the controller began keeping merges, and merges since: only the later ones are gaps.
-func TestAMergeFromBeforeTheRecordBeganIsHistoryAndNoCondition(t *testing.T) {
-	open := windowed(t)
-	everyHeadWaits(t)
-	asksRecorded(t)
-	keeper, _ := withConditionsInMemory(t)
-	tr := aTrunkOf(t, "mesh-catalog", "notes", "notes", "notes")
-	tr.approved["mesh-catalog-c01"], tr.approved["mesh-catalog-c02"], tr.approved["mesh-catalog-c03"] = false, false, false
-	// The record begins at the second merge: the first is two days older.
-	tr.merges[0].At = t0.Add(-48 * time.Hour)
-	hear(t, open, catalogueMerge("mesh-catalog-c02", "notes", t0.Add(time.Minute)), t0.Add(time.Minute))
-	delete(tr.approved, "mesh-catalog-c02")
-	(following{open: open}).catchUp(t.Context(), nil)
-	// The first merge (two days before the record) was not even read from the forge: only the third, which is unknown, was.
-	if tr.events != 1 {
-		t.Fatalf("%d merge(s) were read from the forge: the one from before the record is history and is not read", tr.events)
-	}
-	all, err := keeper.Open(t.Context())
-	if err != nil {
-		t.Fatal(err)
-	}
-	var raised int
-	for _, c := range all {
-		if c.Kind == kindMergeNotHeard {
-			raised++
-		}
-	}
-	if raised != 1 {
-		t.Fatalf("%d condition(s) raised: only the merge since the record began (the third) is a gap", raised)
-	}
-}
-
-// novox/hq ADR 0463 §2: the record begins at the earliest merge kept on ANY trunk. A trunk the controller kept no merge of has the
-// merges made since as gaps (mesh-delivery #1 on novox), and the merges made before as history.
-func TestATrunkWithNoKeptMergeHasItsLaterMergesAsGapsAndItsEarlierOnesAsHistory(t *testing.T) {
-	open := windowed(t)
-	everyHeadWaits(t)
-	asksRecorded(t)
-	// The record begins on another trunk, at t0 less an hour.
-	hear(t, open, repoMerge("one", "c-one", t0.Add(-time.Hour)), t0.Add(-time.Hour))
-	tr := aTrunkOf(t, "mesh-catalog", "notes", "notes")
-	tr.merges[0].At = t0.Add(-72 * time.Hour) // before the record: history
-	(following{open: open}).catchUp(t.Context(), nil)
-	if mergeKnown(t, open, "mesh-catalog-c01") {
-		t.Fatal("a merge from before the record began was heard")
-	}
-	if !mergeKnown(t, open, "mesh-catalog-c02") {
-		t.Fatal("a merge since the record began, on a trunk with no merge kept, was not caught up")
-	}
-}

cmd/mesh-controller/catch_up_test.go

@@ -1,318 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"strings"
-	"testing"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/asks"
-	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
-
-	"github.com/novox/mesh-controller/internal/conditions"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// The pieces of the catch-up that need no store (novox/hq ADR 0457, issue 1336).
-
-func TestAMergeCommitsSubjectNamesItsPullRequest(t *testing.T) {
-	title, number, ok := pullOfSubject("Merge pull request 'Fix keycloak's sign-in (issue 1332)' (#378) from fix/1332-sign-in into main")
-	if !ok || number != 378 || title != "Fix keycloak's sign-in (issue 1332)" {
-		t.Fatalf("read %q %d %v", title, number, ok)
-	}
-	if b := headBranchOfSubject("Merge pull request 'x' (#378) from fix/1332-sign-in into main"); b != "fix/1332-sign-in" {
-		t.Fatalf("the head branch read as %q", b)
-	}
-	if _, _, ok := pullOfSubject("Merge branch 'main' of somewhere"); ok {
-		t.Fatal("a merge that names no pull request read as one")
-	}
-}
-
-func TestOnlyTheLastFiftyMergesOfATrunkAreRead(t *testing.T) {
-	pages := map[int][]trunkCommit{}
-	var all []trunkCommit // newest first: 51 merges, a plain commit between each pair
-	for i := 51; i >= 1; i-- {
-		all = append(all, trunkCommit{Commit: fmt.Sprintf("merge-%02d", i), SecondParent: fmt.Sprintf("head-%02d", i),
-			Subject: fmt.Sprintf("Merge pull request 'change %d' (#%d) from fix/x into main", i, i)},
-			trunkCommit{Commit: fmt.Sprintf("plain-%02d", i)})
-	}
-	for i := 0; i < len(all); i += 50 {
-		pages[i/50+1] = all[i:min(i+50, len(all))]
-	}
-	was := trunkCommitsPage
-	trunkCommitsPage = func(_ context.Context, _, _, _ string, page int) ([]trunkCommit, error) { return pages[page], nil }
-	t.Cleanup(func() { trunkCommitsPage = was })
-	got, err := readTrunkMerges(t.Context(), "novox", "mesh-catalog", "main")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(got) != catchUpWindow || got[0].Commit != "merge-02" || got[len(got)-1].Commit != "merge-51" {
-		t.Fatalf("read %d merges from %s to %s: the oldest of 51 is outside the window", len(got), got[0].Commit, got[len(got)-1].Commit)
-	}
-	if got[0].Head != "head-02" {
-		t.Fatalf("a merge's head is its second parent, not %q", got[0].Head)
-	}
-}
-
-func TestAForgeThatDoesNotAnswerIsAnErrorNotAnEmptyTrunk(t *testing.T) {
-	was := trunkCommitsPage
-	trunkCommitsPage = func(context.Context, string, string, string, int) ([]trunkCommit, error) {
-		return nil, errors.New("the forge did not answer")
-	}
-	t.Cleanup(func() { trunkCommitsPage = was })
-	if got, err := readTrunkMerges(t.Context(), "novox", "mesh-catalog", "main"); err == nil {
-		t.Fatalf("a forge that did not answer read as %d merges: nothing to catch up", len(got))
-	}
-}
-
-func TestACaughtUpMergeIsAcceptedOnTheSameWarrantAsAnAnnouncedOne(t *testing.T) {
-	ok := approvedMerge(t)
-	if _, err := caughtUpWarrant(sdkdelivery.TellerModule, &ok.ask, &ok.warrant); err != nil {
-		t.Errorf("the operator's Approve under the teller was refused: %v", err)
-	}
-	// 1318 (ADR 0450 §8): mesh-delivery's warrant of before the gate is no longer taken.
-	if _, err := caughtUpWarrant(theDelivery, &ok.ask, &ok.warrant); err == nil {
-		t.Error("a warrant under mesh-delivery was accepted")
-	}
-	if _, err := caughtUpWarrant("keycloak", &ok.ask, &ok.warrant); err == nil {
-		t.Error("a warrant of an asker the controller takes none from was accepted")
-	}
-	declined := ok.warrant
-	declined.Option, declined.Label = "decline", "Decline"
-	if _, err := caughtUpWarrant(theDelivery, &ok.ask, &declined); err == nil {
-		t.Error("a Decline was accepted as a warrant")
-	}
-	unproved := ok.warrant
-	by := *unproved.By
-	by.Verified = ""
-	unproved.By = &by
-	if _, err := caughtUpWarrant(theDelivery, &ok.ask, &unproved); err == nil {
-		t.Error("an answer whose channel proves nobody was accepted")
-	}
-	if _, err := caughtUpWarrant(theDelivery, nil, nil); err == nil {
-		t.Error("a router that holds nothing was accepted")
-	}
-}
-
-// aTellersAsk is the ask the delivery gate composes for a pull request, as the router holds it once the operator chose Approve
-// (the gate's composeMergeAsk: its id from sdkdelivery.AskingID of the group and the heads, its Approve bound to mergeAct over the
-// heads, the pull request and its head's first twelve digits in the details), with the warrant the router wrote.
-func aTellersAsk(t *testing.T, group string, members ...sdkdelivery.Head) (asks.Ask, asks.Warrant) {
-	t.Helper()
-	key, err := sdkdelivery.MergeAskKey(group, members)
-	if err != nil {
-		t.Fatal(err)
-	}
-	id := sdkdelivery.AskingID(key, 1)
-	heads := map[string]string{}
-	var details []string
-	for _, m := range members {
-		owner, repo, _ := strings.Cut(m.Repository, "/")
-		heads[deliveryIDOf(owner, repo, m.Head)] = m.Head
-		details = append(details, fmt.Sprintf("%s#%d %q at %s: issues: none named; review: approved; reaches: no delivery plan yet", repo, m.Number, "title", m.Head[:12]))
-	}
-	bind := func(option string) string {
-		d, err := asks.ActDigest(mergeAct(id, option, heads))
-		if err != nil {
-			t.Fatal(err)
-		}
-		return d
-	}
-	at := time.Date(2026, 10, 20, 12, 2, 1, 0, time.UTC)
-	ask := asks.Ask{ID: id, Headline: "Merge into main", Explanation: "passed its checks.", Who: asks.Operator, Expires: at.Add(24 * time.Hour),
-		OnExpiry: "nothing is merged; the ask is made again", Details: strings.Join(details, "\n"),
-		Options: []asks.Option{
-			{ID: optionApprove, Label: "Approve", Does: "merges", Level: asks.Approve, Binds: bind(optionApprove)},
-			{ID: "decline", Label: "Decline", Does: "nothing is merged", Level: asks.Approve, Binds: bind("decline")}}}
-	w := asks.Warrant{Ask: id, Asker: sdkdelivery.TellerModule, Outcome: asks.OutcomeChosen, Option: optionApprove, Label: "Approve",
-		Level: asks.Approve, By: &asks.Person{Who: asks.Operator, Kind: "telegram", Identity: "1", Verified: "user id"},
-		At: at.Add(time.Minute), AskDigest: ask.Digest()}
-	return ask, w
-}
-
-// withRouter hands findMergeWarrant these asks as the router's records, by asker.
-func withRouter(t *testing.T, records map[string]map[string]struct {
-	ask asks.Ask
-	w   asks.Warrant
-}) {
-	t.Helper()
-	wasIDs, wasAsk := routerAskIDs, routerAskOf
-	closedRecords.Range(func(k, _ any) bool { closedRecords.Delete(k); return true })
-	routerAskIDs = func(_ context.Context, _ catalogueReader, asker string) ([]string, error) {
-		var ids []string
-		for id := range records[asker] {
-			ids = append(ids, id)
-		}
-		return ids, nil
-	}
-	routerAskOf = func(_ context.Context, _ catalogueReader, asker, id string) (*asks.Ask, *asks.Warrant, error) {
-		r, ok := records[asker][id]
-		if !ok {
-			return nil, nil, nil
-		}
-		return &r.ask, &r.w, nil
-	}
-	t.Cleanup(func() {
-		routerAskIDs, routerAskOf = wasIDs, wasAsk
-		closedRecords.Range(func(k, _ any) bool { closedRecords.Delete(k); return true })
-	})
-}
-
-type aRouterRecord = struct {
-	ask asks.Ask
-	w   asks.Warrant
-}
-
-// The teller's asks, as the router held them on 2026-10-20: the id is the router's own key, rebuilt here from the group and the
-// head the gate composed it for (mesh-controller#405 at 8a330afd, mesh-catalog#381 at 1c702422, mesh-host#124 at 52600ec7). It names
-// neither the pull request nor the head, so the warrant is found by the heads the Approve is bound to.
-func TestATellersWarrantIsFoundByTheHeadItsApproveIsBoundTo(t *testing.T) {
-	real := []struct {
-		group, key, owner, repo string
-		number                  int
-		head                    string
-	}{
-		{"feat/r4b-sdk-users", "merge-feat_r4b_sdk_users-ba59b03220f8-989afe0a3bcf", "novox", "mesh-controller", 405, "8a330afd44ba852873339cf1210e90989dca46e1"},
-		{"fix/1351-remove-todays-delivery-module", "merge-fix_1351_remove_todays_delivery_module-64a353-d93b97b9697b", "novox", "mesh-catalog", 381, "1c7024224dd77c5b603299378883e0993b2e2fdd"},
-		{"feat/r4b-sdk-users", "merge-feat_r4b_sdk_users-6a59ba48da14-424e053ebc9c", "novox", "mesh-host", 124, "52600ec7bd61ee271a5cc7f4136bcf0a2a8f00fc"},
-	}
-	teller := map[string]aRouterRecord{}
-	for _, r := range real {
-		ask, w := aTellersAsk(t, r.group, sdkdelivery.Head{Repository: r.owner + "/" + r.repo, Number: r.number, Head: r.head})
-		if ask.ID != r.key {
-			t.Fatalf("the id of %s#%d is %q, and the router held it as %q: the fixture is not the router's", r.repo, r.number, ask.ID, r.key)
-		}
-		teller[ask.ID] = aRouterRecord{ask, w}
-	}
-	withRouter(t, map[string]map[string]aRouterRecord{sdkdelivery.TellerModule: teller})
-	for _, r := range real {
-		why, found, reason, err := findMergeWarrant(t.Context(), nil, r.owner, r.repo, r.number, r.head)
-		if err != nil || !found || !strings.Contains(why, r.key) || !strings.Contains(why, "bound to the head of this pull request") {
-			t.Errorf("%s#%d: the warrant was not found: %q %v %q %v", r.repo, r.number, why, found, reason, err)
-		}
-		// Another head of the same pull request is another merge: the Approve was not given for it.
-		if _, found, _, _ := findMergeWarrant(t.Context(), nil, r.owner, r.repo, r.number, "ffffffffffffffffffffffffffffffffffffffff"); found {
-			t.Errorf("%s#%d: another head found the warrant of this one", r.repo, r.number)
-		}
-	}
-	// One pull request's Approve is none for another repository's merge at the same head digits.
-	if _, found, _, _ := findMergeWarrant(t.Context(), nil, "novox", "mesh-tools", 405, real[0].head); found {
-		t.Error("a merge of another repository found mesh-controller#405's warrant")
-	}
-}
-
-// A group's ask binds several heads, and the router's record carries only twelve digits of the other members': the pull request is
-// found in the ask as it was published, which the warrant's digest covers.
-func TestAGroupsWarrantIsFoundByTheAsksWordsForThePullRequestAndItsHead(t *testing.T) {
-	a := sdkdelivery.Head{Repository: "novox/mesh-host", Number: 124, Head: "52600ec7bd61ee271a5cc7f4136bcf0a2a8f00fc"}
-	b := sdkdelivery.Head{Repository: "novox/mesh-controller", Number: 405, Head: "8a330afd44ba852873339cf1210e90989dca46e1"}
-	ask, w := aTellersAsk(t, "feat/r4b-sdk-users", a, b)
-	withRouter(t, map[string]map[string]aRouterRecord{sdkdelivery.TellerModule: {ask.ID: {ask, w}}})
-	for _, h := range []sdkdelivery.Head{a, b} {
-		owner, repo, _ := strings.Cut(h.Repository, "/")
-		why, found, reason, err := findMergeWarrant(t.Context(), nil, owner, repo, h.Number, h.Head)
-		if err != nil || !found || !strings.Contains(why, "a group's ask naming this pull request at this head") {
-			t.Errorf("%s#%d: not found in the group's ask: %q %v %q %v", repo, h.Number, why, found, reason, err)
-		}
-	}
-	if _, found, _, _ := findMergeWarrant(t.Context(), nil, "novox", "mesh-catalog", 381, a.Head); found {
-		t.Error("a pull request the group's ask does not name found its warrant")
-	}
-	// A Decline is no warrant.
-	declined := w
-	declined.Option, declined.Label = "decline", "Decline"
-	withRouter(t, map[string]map[string]aRouterRecord{sdkdelivery.TellerModule: {ask.ID: {ask, declined}}})
-	if _, found, _, _ := findMergeWarrant(t.Context(), nil, "novox", "mesh-host", 124, a.Head); found {
-		t.Error("a Decline found a warrant")
-	}
-}
-
-// A trunk shorter than a page, or with none, is read without a fault: the pages end when the forge's do.
-func TestAShortTrunkIsReadWholeAndAnEmptyOneIsNoMerges(t *testing.T) {
-	was := trunkCommitsPage
-	t.Cleanup(func() { trunkCommitsPage = was })
-	trunkCommitsPage = func(_ context.Context, _, _, _ string, page int) ([]trunkCommit, error) {
-		if page > 1 {
-			return nil, nil
-		}
-		return []trunkCommit{{Commit: "m2", SecondParent: "h2", Subject: "Merge pull request 'two' (#2) from fix/b into main"},
-			{Commit: "p"}, {Commit: "m1", SecondParent: "h1", Subject: "Merge pull request 'one' (#1) from fix/a into main"}}, nil
-	}
-	got, err := readTrunkMerges(t.Context(), "novox", "x", "main")
-	if err != nil || len(got) != 2 || got[0].Commit != "m1" || got[1].Commit != "m2" {
-		t.Fatalf("a short trunk read as %+v %v", got, err)
-	}
-	trunkCommitsPage = func(context.Context, string, string, string, int) ([]trunkCommit, error) { return nil, nil }
-	if got, err := readTrunkMerges(t.Context(), "novox", "x", "main"); err != nil || len(got) != 0 {
-		t.Fatalf("an empty trunk read as %+v %v", got, err)
-	}
-}
-
-// ADR 0253: what the operator reads of a merge not heard is plain: no hash, no identifier, nothing to do "by hand".
-func TestTheConditionOfAMergeNotHeardIsInPlainWords(t *testing.T) {
-	keeper, _ := withConditionsInMemory(t)
-	tm := trunkMerge{Commit: "c0880c4d1f2e3a4b5c6d7e8f9a0b1c2d3e4f5a6b", Head: "b9104454f9a5e0c4d3b2a1f0e9d8c7b6a5948372"}
-	(following{}).raiseMergeNotHeard(t.Context(), "novox/mesh-catalog", "main", tm, link.SourceMoved{Number: 378},
-		"the router holds no chosen merge ask of mesh-delivery-teller or mesh-delivery that covers the head b9104454f9a5")
-	open, err := keeper.Open(t.Context())
-	if err != nil || len(open) != 1 {
-		t.Fatalf("opened %d conditions, %v", len(open), err)
-	}
-	c := open[0]
-	if why, ok := conditions.PlainWords(conditions.Words{Headline: c.Headline, Explanation: c.Explanation, Needs: c.Needs,
-		Resolved: c.Resolved}); !ok {
-		t.Fatalf("the condition's words are not plain: %s\n%q\n%q\n%q", why, c.Headline, c.Explanation, c.Needs)
-	}
-}
-
-// The trunk's history lists the merges made inside a pull request's branch too. On novox (2026-10-20) 15 of the 15 non-pull-request
-// "gaps" of mesh-catalog and mesh-controller were such merges; only a pull request's merge into this trunk is a merge to catch up.
-func TestAMergeMadeInsideABranchIsNoMergeOfTheTrunk(t *testing.T) {
-	was := trunkCommitsPage
-	t.Cleanup(func() { trunkCommitsPage = was })
-	trunkCommitsPage = func(_ context.Context, _, _, _ string, page int) ([]trunkCommit, error) {
-		if page > 1 {
-			return nil, nil
-		}
-		return []trunkCommit{
-			{Commit: "c0880c4d", SecondParent: "b9104454", Subject: "Merge pull request 'Read the grant file' (#378) from fix/1332 into main"},
-			{Commit: "6394a62a", SecondParent: "x1", Subject: "Merge remote-tracking branch 'origin/main' into fix/1081-withdraw"},
-			{Commit: "896f1d28", SecondParent: "x2", Subject: "Merge feat/agents-write-git-ssh into feat/agents-write-git-ssh-f (issue 955 F)"},
-			{Commit: "4d03755c", SecondParent: "x3", Subject: "Bring the branch up to main after #354 (issue 1047)"},
-			{Commit: "other", SecondParent: "x4", Subject: "Merge pull request 'Elsewhere' (#5) from fix/y into nox-mesh"},
-		}, nil
-	}
-	got, err := readTrunkMerges(t.Context(), "novox", "mesh-catalog", "main")
-	if err != nil || len(got) != 1 || got[0].Commit != "c0880c4d" {
-		t.Fatalf("read %+v %v: only keycloak's pull request merge into main is a merge to catch up", got, err)
-	}
-}
-
-// novox/hq ADR 0463 §2: the record of merges begins at the earliest merge the controller holds on any trunk. A merge before it is
-// history on every trunk; a trunk with no merge kept of its own still has the merges made since as gaps (mesh-delivery #1 on novox).
-func TestOnlyTheMergesSinceTheRecordBeganAreGapsOnEveryTrunk(t *testing.T) {
-	first := time.Date(2026, 10, 17, 12, 0, 0, 0, time.UTC) // the first merge it heard, on some trunk of the mesh
-	trunk := func(prefix string) []trunkMerge {
-		return []trunkMerge{
-			{Commit: prefix + "-old-1", At: first.Add(-30 * 24 * time.Hour)},
-			{Commit: prefix + "-old-2", At: first.Add(-2 * time.Hour)},
-			{Commit: prefix + "-within-grace", At: first.Add(-mergeGrace / 2)},
-			{Commit: prefix + "-since", At: first.Add(24 * time.Hour)},
-		}
-	}
-	// Two trunks, one of which the controller has kept no merge of: both read by the one starting point.
-	for _, prefix := range []string{"kept-trunk", "trunk-with-no-kept-merge"} {
-		var commits []string
-		for _, m := range sinceTheRecord(trunk(prefix), true, first) {
-			commits = append(commits, m.Commit)
-		}
-		if want := prefix + "-within-grace " + prefix + "-since"; strings.Join(commits, " ") != want {
-			t.Errorf("%s: the gaps are %v, want %q: earlier ones are history on every trunk, later ones are gaps", prefix, commits, want)
-		}
-	}
-	if none := sinceTheRecord(trunk("x"), false, time.Time{}); len(none) != 0 {
-		t.Errorf("with no merge kept anywhere there are %d gap(s), but no record to have one in", len(none))
-	}
-}

cmd/mesh-controller/chain.go

@@ -51,13 +51,55 @@ func attachTheChain(ctx context.Context, inv *inventory.Inventory, server *link.
 		fmt.Printf("chain: the builds are not laid out under their modules yet, and none is read until they are: %v\n", err)
 		go layBuildsOutSoon(ctx, inv)
 	}
-	// The requests the move of delivery 1 found never handed over are not asked again: the controller asks no build
-	// (novox/hq ADR 0501; issue 1851, A10), and the builder builds every fingerprint the indexer writes.
+	// And the requests the move of delivery 1 found never handed over, asked again once (askAgain), once it is serving.
+	go askAgainSoon(ctx, inv)
 	// And what delivery 1 recorded of what each machine was sent, copied onto the keys of the assignments (CopySentBuilds).
 	go copySentBuildsSoon(ctx, inv)
 	return nil
 }
 
+// askAgain asks once more for each build request the move found never handed over (novox/hq issue 981 note 7 Q5): the
+// requests a merge could not ask for, which a person's hand `build` would otherwise have to repeat. **At most once**: a
+// request is claimed before it is asked and settled after, so a crash between loses the ask, which is where it stood.
+func askAgain(ctx context.Context, inv *inventory.Inventory) {
+	pending, err := inv.RequestsToAskAgain(ctx)
+	if err != nil {
+		fmt.Printf("chain: the requests never handed over cannot be read: %v\n", err)
+		return
+	}
+	for _, r := range pending {
+		if claimed, err := inv.ClaimToAskAgain(ctx, r.ID); err != nil || !claimed {
+			if err != nil {
+				fmt.Printf("chain: %s cannot be claimed to be asked again: %v\n", r.ID, err)
+			}
+			continue
+		}
+		id, err := askABuild(ctx, buildSource{Repository: r.Repository, Seat: r.Seat}, r.Path, r.Ref)
+		if err != nil {
+			if serr := inv.AskedAgainAs(ctx, r.ID, "not asked again: "+err.Error()); serr != nil {
+				fmt.Printf("chain: %s was not asked again, and that could not be kept: %v\n", r.ID, serr)
+			}
+			fmt.Printf("chain: %s was never handed over and cannot be asked again: %v\n", r.ID, err)
+			continue
+		}
+		recordBuildRequest(ctx, inv, inventory.BuildRequest{ID: id, Repository: r.Repository, Seat: r.Seat, Path: r.Path,
+			Ref: r.Ref, Commit: r.Commit, For: r.For})
+		if err := inv.AskedAgainAs(ctx, r.ID, id); err != nil {
+			fmt.Printf("chain: %s was asked again as %s, and that could not be kept: %v\n", r.ID, id, err)
+		}
+		fmt.Printf("chain: %s, never handed over, is asked again as %s\n", r.ID, id)
+	}
+}
+
+// askAgainSoon waits for the controller to be serving, which an ask needs, and then asks again.
+func askAgainSoon(ctx context.Context, inv *inventory.Inventory) {
+	select {
+	case <-ctx.Done():
+	case <-time.After(time.Minute):
+		askAgain(ctx, inv)
+	}
+}
+
 // kindSentBuildsNotCopied is the condition of the one-time copy of node.sent_builds onto the assignments' keys that has not
 // succeeded: until it has, a module an assignment pulled in may be missing from what a machine is read to run.
 const kindSentBuildsNotCopied = "sent-builds-not-copied"

cmd/mesh-controller/chain_integration_test.go

@@ -10,7 +10,7 @@ import (
 	"testing"
 	"time"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/chain"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/lease"

cmd/mesh-controller/changeplan.go

@@ -7,7 +7,7 @@ import (
 	"sort"
 	"strings"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )

cmd/mesh-controller/changeplan_test.go

@@ -4,7 +4,7 @@ import (
 	"strings"
 	"testing"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )

cmd/mesh-controller/check.go

@@ -10,7 +10,7 @@ import (
 	"strings"
 	"time"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/link"
 )
 

cmd/mesh-controller/check_builds.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"os"
+	"strconv"
 
 	"github.com/novox/mesh-controller/internal/builder"
 	"github.com/novox/mesh-controller/internal/inventory"
@@ -52,7 +53,7 @@ func forgetChecksOfWalk(ctx context.Context, inv *inventory.Inventory, p invento
 	if p.WalkSaid != inventory.WalkEnded || p.Delivery == nil {
 		return
 	}
-	for _, pull := range pullsOfWalk(&p) {
+	for _, pull := range reuseAskOf(&p).Pulls {
 		said, err := forgetChecks(ctx, inv, builder.PullRef{Owner: pull.Owner, Repo: pull.Repo, Number: pull.Number})
 		if err != nil {
 			fmt.Fprintf(os.Stderr, "%s: its check builds stay until the week's sweep: %v\n", p.ID, err)
@@ -61,3 +62,26 @@ func forgetChecksOfWalk(ctx context.Context, inv *inventory.Inventory, p invento
 		fmt.Printf("%s: %s\n", p.ID, said)
 	}
 }
+
+// forgetChecksCommand is `forget-checks <owner> <repo> <number>`: the verb the delivery's owner asks when the forge
+// says a pull request closed unmerged (novox/hq ADR 0350 §5).
+func forgetChecksCommand(ctx context.Context, args []string) error {
+	if len(args) != 3 {
+		return errors.New("forget-checks <owner> <repo> <number>")
+	}
+	number, err := strconv.Atoi(args[2])
+	if err != nil || number <= 0 {
+		return fmt.Errorf("%q is not a pull request's number", args[2])
+	}
+	open, err := openStores(ctx)
+	if err != nil {
+		return err
+	}
+	defer open.Close()
+	said, err := forgetChecks(ctx, open.inventory, builder.PullRef{Owner: args[0], Repo: args[1], Number: number})
+	if err != nil {
+		return err
+	}
+	fmt.Println(said)
+	return nil
+}

cmd/mesh-controller/check_builds_integration_test.go

@@ -9,17 +9,28 @@ import (
 	"testing"
 	"time"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
 
-func TestAWalkNamesThePullRequestsOfItsMergesOnce(t *testing.T) {
+func TestOnlyAWalksAskTakesAChecksBuildAndADryRunNever(t *testing.T) {
 	p := &inventory.Plan{Delivery: &inventory.PlanDelivery{Merges: []inventory.PlanMerge{
 		{Repository: "novox/shop", Number: 7}, {Repository: "http://forge.invalid/novox/web.git", Number: 3},
 		{Repository: "novox/shop", Number: 7}, {Repository: "novox/shop"}}}}
-	if want := []link.PullRef{{Owner: "novox", Repo: "shop", Number: 7}, {Owner: "novox", Repo: "web", Number: 3}}; !reflect.DeepEqual(pullsOfWalk(p), want) {
-		t.Fatalf("the walk names %+v", pullsOfWalk(p))
+	asked := reuseAskOf(p)
+	if want := []link.PullRef{{Owner: "novox", Repo: "shop", Number: 7}, {Owner: "novox", Repo: "web", Number: 3}}; !reflect.DeepEqual(asked.Pulls, want) {
+		t.Fatalf("the walk names %+v", asked.Pulls)
+	}
+	walk := withReuse(t.Context(), asked)
+	if reuseAsked(walk, false) != asked {
+		t.Fatal("a walk's ask does not carry its leave")
+	}
+	if reuseAsked(walk, true) != nil {
+		t.Fatal("a dry run carries a leave to take a check's build")
+	}
+	if reuseAsked(t.Context(), false) != nil {
+		t.Fatal("an ask that is not a walk's carries a leave")
 	}
 }
 

cmd/mesh-controller/check_builds_test.go

@@ -7,8 +7,8 @@ import (
 	"strings"
 	"testing"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/builder"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
@@ -104,6 +104,44 @@ func TestAWalksBuildSaysWhetherItReusedOrBuilt(t *testing.T) {
 // build as it judges one the walk built. A scratch reference is refused. Needs the store (MESH_TEST_POSTGRES), and
 // is named in testdata/store-tests.
 
+// A walk's leave names the builds its own pull requests' verdicts made at the head each merge merged — never an
+// earlier head's — read once per walk, and none when they cannot be read: the builder takes nothing a verdict does
+// not name (novox/hq ADR 0350 §2, issue 703).
+func TestAWalksLeaveNamesTheBuildsItsPullRequestsVerdictsMade(t *testing.T) {
+	was := checkedBuildsOf
+	forgetWalkVerdicts()
+	t.Cleanup(func() { checkedBuildsOf = was; forgetWalkVerdicts() })
+	var asked [][]link.PullRef
+	pull := link.PullRef{Owner: "novox", Repo: "shop", Number: 7}
+	atHead := link.CheckedBuild{Pull: pull, Check: "build-2", Head: "bbbbbbbbbbbb", Built: link.CheckBuilt{Module: "app", Key: "r1:2"}}
+	earlier := link.CheckedBuild{Pull: pull, Check: "build-1", Head: "aaaaaaaaaaaa", Built: link.CheckBuilt{Module: "app", Key: "r1:1"}}
+	checkedBuildsOf = func(_ context.Context, pulls []link.PullRef) ([]link.CheckedBuild, error) {
+		asked = append(asked, pulls)
+		return []link.CheckedBuild{atHead, earlier}, nil
+	}
+	pulls := []link.PullRef{pull}
+	heads := map[link.PullRef]string{pull: "bbbbbbbbbbbb0123456789"}
+	for range 3 {
+		if got := reuseWithVerdicts(t.Context(), "plan-1", &link.ReuseAsk{Pulls: pulls}, heads); !reflect.DeepEqual(got.Builds,
+			[]link.CheckedBuild{atHead}) {
+			t.Fatalf("the leave names %+v, not only the merged head's build", got.Builds)
+		}
+	}
+	if !reflect.DeepEqual(asked, [][]link.PullRef{pulls}) {
+		t.Fatalf("the verdicts were read %d times for one walk: %v", len(asked), asked)
+	}
+	// A merge whose head was not said takes nothing.
+	if got := reuseWithVerdicts(t.Context(), "plan-1", &link.ReuseAsk{Pulls: pulls}, nil); got.Builds != nil {
+		t.Fatalf("a merge of no said head names %+v", got.Builds)
+	}
+	checkedBuildsOf = func(context.Context, []link.PullRef) ([]link.CheckedBuild, error) {
+		return nil, errors.New("no bus")
+	}
+	if got := reuseWithVerdicts(t.Context(), "plan-2", &link.ReuseAsk{Pulls: pulls}, heads); got.Builds != nil {
+		t.Fatalf("verdicts that could not be read named %+v", got.Builds)
+	}
+}
+
 // A check is handed only the builds earlier checks of its own pull request at its own head made: another pull
 // request's build, or an earlier head's, is never kept (novox/hq issue 703). None when they cannot be read.
 func TestACheckIsHandedOnlyItsOwnHeadsBuilds(t *testing.T) {
@@ -132,3 +170,24 @@ func TestACheckIsHandedOnlyItsOwnHeadsBuilds(t *testing.T) {
 		t.Fatalf("verdicts that could not be read named %+v", got)
 	}
 }
+
+func forgetWalkVerdicts() {
+	walkVerdicts.Lock()
+	defer walkVerdicts.Unlock()
+	walkVerdicts.read = map[string]verdictsRead{}
+}
+
+// A walk's merged heads are the forge's word for each merge; a merge announced without its head, or a pull request
+// merged at two heads in one walk, has none, and its walk takes no check's build (novox/hq issue 703).
+func TestAWalksMergedHeadsAreTheForgesWord(t *testing.T) {
+	merge := func(number int, head string) inventory.PlanMerge {
+		return inventory.PlanMerge{Repository: "novox/shop", Number: number, Head: head}
+	}
+	p := &inventory.Plan{Delivery: &inventory.PlanDelivery{Merges: []inventory.PlanMerge{
+		merge(7, "aaaaaaaaaaaa1"), merge(8, ""), merge(9, "bbbbbbbbbbbb"), merge(9, "cccccccccccc")}}}
+	heads := mergedHeadsOf(p)
+	shop := func(n int) link.PullRef { return link.PullRef{Owner: "novox", Repo: "shop", Number: n} }
+	if heads[shop(7)] != "aaaaaaaaaaaa1" || heads[shop(8)] != "" || heads[shop(9)] != "" {
+		t.Fatalf("merged heads %v", heads)
+	}
+}

cmd/mesh-controller/check_here.go

@@ -11,8 +11,8 @@ import (
 	"strings"
 	"time"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/builder"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/link"
 )
 

cmd/mesh-controller/check_siblings.go

@@ -0,0 +1,165 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"regexp"
+	"sort"
+	"strings"
+
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// **A delivery group's member is checked beside the other members' heads** (novox/hq ADR 0382, issue 867).
+//
+// A mesh-host change and a mesh-controller change that need each other could not both pass their own merge checks:
+// each was read beside the other's repository at the commit the mesh runs, which holds neither change. So the
+// controller asks mesh-delivery's `groups` once for every pull request's check it asks (§1), and names, in the ask,
+// the group's other open pull requests into a base of the same name, in a repository the build seat reads beside the
+// check — mesh-lab never — each with its whole head. The build seat reads those repositories at the sibling's merge (§2).
+// A pull request for which mesh-delivery answered and named no sibling is asked exactly as before (§7).
+
+// wholeCommit is a commit as the forge says a head: forty hexadecimal characters.
+var wholeCommit = regexp.MustCompile(`^[0-9a-f]{40}$`)
+
+// besideRepositories are the repositories (lower case, owner/repo) a check reads beside its own, by the directory each
+// is found under — the core's, as besideOf clones them, and mesh-sdk beside the controller; never mesh-lab, which is
+// always read at its trunk.
+func besideRepositories(entries []inventory.Entry) map[string]string {
+	read := map[string]string{}
+	for _, e := range entries {
+		dir, core := coreModules[e.Manifest.Module]
+		if !core || e.Provided || e.Source.Repository == "" {
+			continue
+		}
+		read[nameOf(e.Source.Repository)] = dir
+		if dir == "mesh-controller" && e.Source.Seat != "" {
+			read[nameOf(siblingOf(e.Source.Repository, "mesh-sdk"))] = "mesh-sdk"
+		}
+	}
+	delete(read, "")
+	return read
+}
+
+// nameOf is a recorded repository as owner/repo in lower case, empty when it names no owner.
+func nameOf(repository string) string {
+	owner, repo := sourceOwner(repository), sourceName(repository)
+	if owner == "" || repo == "" {
+		return ""
+	}
+	return strings.ToLower(owner + "/" + repo)
+}
+
+// siblingsFor is the pull request's siblings, as mesh-delivery's groups say them (ADR 0382 §1): the other members of
+// the group its head branch names that are open, unmerged and into a base of its own base's name, in a repository the
+// check reads beside it (beside: the directories the ask already names). The second answer is why they could not be
+// learned, empty when they could: the group's members carry no head or base — a mesh-delivery from before the rule.
+func siblingsFor(p link.PullUpdated, entries []inventory.Entry, beside map[string]link.CheckedOut,
+	lines []groupsLine) ([]link.CheckSibling, string) {
+	own := strings.ToLower(p.Owner + "/" + p.Repo)
+	var group *groupsLine
+	if p.Head == "" {
+		// A recheck (mesh-delivery's `recheck` through `delivery check`) carries no head branch name: the group is the one
+		// whose members hold this very pull request, by repository and number.
+		learnable := false
+		for i := range lines {
+			for _, m := range lines[i].Details {
+				learnable = true
+				if p.Number != 0 && m.Number == p.Number && strings.ToLower(m.Repository) == own {
+					group = &lines[i]
+				}
+			}
+		}
+		if group == nil {
+			for _, l := range lines {
+				if len(l.Details) == 0 && len(l.Members) > 0 && !learnable {
+					return nil, "mesh-delivery named the groups' members without their pull requests (a mesh-delivery from before novox/hq ADR 0382): " +
+						"the group of a pull request announced without its head branch cannot be found"
+				}
+			}
+			return nil, "" // a lone pull request
+		}
+	} else {
+		for i := range lines {
+			if lines[i].ID == p.Head {
+				group = &lines[i]
+			}
+		}
+		if group == nil {
+			return nil, ""
+		}
+	}
+	if len(group.Details) == 0 && len(group.Members) > 0 {
+		return nil, "mesh-delivery named the group's members without their heads and bases (a mesh-delivery from before novox/hq ADR 0382)"
+	}
+	read := besideRepositories(entries)
+	var siblings []link.CheckSibling
+	for _, m := range group.Details {
+		repository := strings.ToLower(m.Repository)
+		if repository == own {
+			continue
+		}
+		if !m.Open {
+			continue
+		}
+		if m.Head == "" || m.Base == "" {
+			return nil, "mesh-delivery named " + m.ID + " without its head or base (a mesh-delivery from before novox/hq ADR 0382)"
+		}
+		dir, readBeside := read[repository]
+		if m.Base != p.Base || !readBeside || dir == "mesh-lab" {
+			continue
+		}
+		if _, there := beside[dir]; !there {
+			continue
+		}
+		head := strings.ToLower(m.Head)
+		if !wholeCommit.MatchString(head) {
+			return nil, fmt.Sprintf("mesh-delivery named %s with a head that is not a whole commit (%q)", m.ID, m.Head)
+		}
+		siblings = append(siblings, link.CheckSibling{Repository: m.Repository, Number: m.Number, Head: head, Base: m.Base, Dir: dir})
+	}
+	sort.Slice(siblings, func(i, j int) bool { return siblings[i].Dir < siblings[j].Dir })
+	return siblings, ""
+}
+
+// withSiblings asks mesh-delivery's `groups` once and says in the request the pull request's siblings, or why they
+// could not be learned (ADR 0382 §1): a check never waits on mesh-delivery past groupAskWithin and never fails for it,
+// so a fix to mesh-delivery is still checked without it.
+func withSiblings(ctx context.Context, request *link.BuildRequest, p link.PullUpdated, entries []inventory.Entry) {
+	lines, err := groupsAsked(ctx, deliverySeatHeld(entries))
+	siblingsFrom(request, p, entries, lines, err)
+}
+
+// siblingsFrom is withSiblings from mesh-delivery's answer already had.
+func siblingsFrom(request *link.BuildRequest, p link.PullUpdated, entries []inventory.Entry, lines []groupsLine, err error) {
+	if request.Check == nil {
+		return
+	}
+	if err != nil {
+		request.Check.SiblingsUnknown = fmt.Sprintf("mesh-delivery did not say the group's pull requests (%v): "+
+			"the check reads no siblings", err)
+		return
+	}
+	request.Check.Siblings, request.Check.SiblingsUnknown = siblingsFor(p, entries, request.Check.Beside, lines)
+}
+
+// composedMember says the pull request is a member of a delivery group whose gate is the composed check's (novox/hq
+// ADR 0403 clauses 1 and 7): the group has two members or more and mesh-delivery says so on its line. The group is
+// found as siblingsFor finds it, by its head branch name, or, for a recheck that carries none, by the pull request's
+// repository and number — not by siblings, which name only what the check reads beside it.
+func composedMember(p link.PullUpdated, lines []groupsLine) bool {
+	own := strings.ToLower(p.Owner + "/" + p.Repo)
+	for _, l := range lines {
+		found := p.Head != "" && l.ID == p.Head
+		for _, m := range l.Details {
+			if p.Head == "" && p.Number != 0 && m.Number == p.Number && strings.ToLower(m.Repository) == own {
+				found = true
+			}
+		}
+		if found {
+			return l.ComposedGate && max(len(l.Details), len(l.Members)) >= 2
+		}
+	}
+	return false
+}

cmd/mesh-controller/check_siblings_test.go

@@ -0,0 +1,248 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"strings"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// **A delivery group's member is checked beside the other members' heads** (novox/hq ADR 0382 §1, §7, issue 867): the
+// controller asks mesh-delivery's `groups` once for every check it asks, and names in the ask the group's other open
+// pull requests into a base of the same name, in a repository the build seat reads beside it — mesh-lab never.
+
+const (
+	headHost       = "1111111111111111111111111111111111111111"
+	headController = "2222222222222222222222222222222222222222"
+	headSDK        = "3333333333333333333333333333333333333333"
+	headLab        = "4444444444444444444444444444444444444444"
+	headHq         = "5555555555555555555555555555555555555555"
+)
+
+func theCoreOnTheGitSeat() []inventory.Entry {
+	onSeat := func(module, repository string) inventory.Entry {
+		e := fromRepo(module, repository, "")
+		e.Source.Seat = "git"
+		return e
+	}
+	nats := onSeat("nats", "novox/mesh-catalog")
+	nats.Source.Path = "modules/nats"
+	held := catalogue.Manifest{Module: "mesh-delivery", Claims: []catalogue.Claim{{Name: catalogue.DeliverySeat, Scope: catalogue.ScopeMesh}}}
+	return []inventory.Entry{onSeat("mesh-controller", "novox/mesh-controller"), onSeat("mesh-host", "novox/mesh-host"),
+		onSeat("node-tools", "novox/mesh-tools"), nats, {Manifest: held, On: []string{"anchor"}}}
+}
+
+func besideTheCore() map[string]link.CheckedOut {
+	return map[string]link.CheckedOut{"mesh-controller": {Repository: "c"}, "mesh-host": {Repository: "h"},
+		"mesh-tools": {Repository: "t"}, "mesh-catalog": {Repository: "k"}, "mesh-sdk": {Repository: "s"}, "mesh-lab": {Repository: "l"}}
+}
+
+func member(repository string, number int, head, base string, open bool) memberLine {
+	return memberLine{ID: repository + "@" + head[:12], Repository: repository, State: "checked", Number: number, Head: head,
+		Base: base, Open: open}
+}
+
+func group(id string, members ...memberLine) groupsLine {
+	line := groupsLine{ID: id, Details: members}
+	for _, m := range members {
+		line.Members = append(line.Members, m.ID+" ("+m.State+")")
+	}
+	return line
+}
+
+func TestASiblingIsTheGroupsOtherOpenPullRequestIntoABaseOfTheSameName(t *testing.T) {
+	entries := theCoreOnTheGitSeat()
+	pull := link.PullUpdated{Owner: "novox", Repo: "mesh-host", Number: 114, Base: "main", Head: "feat/x", Commit: headHost}
+	for _, c := range []struct {
+		what    string
+		lines   []groupsLine
+		want    []string
+		unknown string
+	}{
+		{"the other member, open, same base", []groupsLine{group("feat/x",
+			member("novox/mesh-host", 114, headHost, "main", true), member("novox/mesh-controller", 346, headController, "main", true))},
+			[]string{"mesh-controller=novox/mesh-controller#346@" + headController + " onto main"}, ""},
+		{"a member into a base of another name is not one", []groupsLine{group("feat/x",
+			member("novox/mesh-host", 114, headHost, "main", true), member("novox/mesh-controller", 346, headController, "release", true))},
+			nil, ""},
+		{"a member not open (merged or closed) is not one", []groupsLine{group("feat/x",
+			member("novox/mesh-host", 114, headHost, "main", true), member("novox/mesh-controller", 346, headController, "main", false))},
+			nil, ""},
+		{"mesh-lab is never one", []groupsLine{group("feat/x",
+			member("novox/mesh-host", 114, headHost, "main", true), member("novox/mesh-lab", 5, headLab, "main", true))},
+			nil, ""},
+		{"a repository the check reads nothing of is not one", []groupsLine{group("feat/x",
+			member("novox/mesh-host", 114, headHost, "main", true), member("novox/hq", 9, headHq, "main", true))},
+			nil, ""},
+		{"mesh-sdk, read beside the controller, is one", []groupsLine{group("feat/x",
+			member("novox/mesh-host", 114, headHost, "main", true), member("novox/mesh-sdk", 7, headSDK, "main", true))},
+			[]string{"mesh-sdk=novox/mesh-sdk#7@" + headSDK + " onto main"}, ""},
+		{"another group is none of its business", []groupsLine{group("feat/y",
+			member("novox/mesh-host", 114, headHost, "main", true), member("novox/mesh-controller", 346, headController, "main", true))},
+			nil, ""},
+		{"a group of its own alone has none", []groupsLine{group("feat/x", member("novox/mesh-host", 114, headHost, "main", true))},
+			nil, ""},
+		{"an older mesh-delivery names no heads", []groupsLine{{ID: "feat/x",
+			Members: []string{"novox/mesh-host@111111111111 (checked)", "novox/mesh-controller@222222222222 (checked)"}}},
+			nil, "without their heads and bases"},
+		{"a member without its base", []groupsLine{group("feat/x",
+			member("novox/mesh-host", 114, headHost, "main", true), member("novox/mesh-controller", 346, headController, "", true))},
+			nil, "without its head or base"},
+		{"a head that is no commit", []groupsLine{group("feat/x",
+			member("novox/mesh-host", 114, headHost, "main", true), member("novox/mesh-controller", 346, headController[:12]+"zzzzzzzzzzzzzzzzzzzzzzzzzzzz", "main", true))},
+			nil, "not a whole commit"},
+	} {
+		got, unknown := siblingsFor(pull, entries, besideTheCore(), c.lines)
+		var said []string
+		for _, s := range got {
+			said = append(said, s.Dir+"="+s.Repository+"#"+itoa(s.Number)+"@"+s.Head+" onto "+s.Base)
+		}
+		if strings.Join(said, ";") != strings.Join(c.want, ";") {
+			t.Errorf("%s: siblings %v, wanted %v", c.what, said, c.want)
+		}
+		if (c.unknown == "") != (unknown == "") || !strings.Contains(unknown, c.unknown) {
+			t.Errorf("%s: could not learn %q, wanted %q", c.what, unknown, c.unknown)
+		}
+	}
+	// A pull request into a release branch has siblings into the release branch of the same name (ADR 0358 §1).
+	release := pull
+	release.Base = "feat/57"
+	lines := []groupsLine{group("feat/x", member("novox/mesh-host", 114, headHost, "feat/57", true),
+		member("novox/mesh-controller", 346, headController, "feat/57", true), member("novox/mesh-tools", 8, headLab, "main", true))}
+	if got, _ := siblingsFor(release, entries, besideTheCore(), lines); len(got) != 1 || got[0].Dir != "mesh-controller" {
+		t.Errorf("into a release branch: %+v", got)
+	}
+	// A recheck announces the pull request without its head branch: its group is the one holding it (repository, number).
+	pull.Head = ""
+	got, unknown := siblingsFor(pull, entries, besideTheCore(), lines)
+	if len(got) != 1 || got[0].Dir != "mesh-tools" || unknown != "" {
+		t.Errorf("a recheck of a group member: %+v %q", got, unknown)
+	}
+	// A pull request in no group, rechecked, is alone: no sibling, and nothing said.
+	pull.Number = 999
+	if got, unknown := siblingsFor(pull, entries, besideTheCore(), lines); got != nil || unknown != "" {
+		t.Errorf("a lone pull request: %+v %q", got, unknown)
+	}
+	if got, unknown := siblingsFor(pull, entries, besideTheCore(), nil); got != nil || unknown != "" {
+		t.Errorf("no groups at all: %+v %q", got, unknown)
+	}
+	// A mesh-delivery that names members without their pull requests cannot find the group of a recheck: it says so.
+	older := []groupsLine{{ID: "feat/x", Members: []string{"novox/mesh-host@111111111111 (checked)"}}}
+	pull.Number = 114
+	if got, unknown := siblingsFor(pull, entries, besideTheCore(), older); got != nil || unknown == "" {
+		t.Errorf("an older mesh-delivery: %+v %q", got, unknown)
+	}
+}
+
+func itoa(n int) string { b, _ := json.Marshal(n); return string(b) }
+
+// Every check asks mesh-delivery's `groups` once; the ask names the sibling's repository, head and base.
+func TestEveryCheckAsksMeshDeliveryOnceAndNamesItsSiblings(t *testing.T) {
+	entries := theCoreOnTheGitSeat()
+	asked := 0
+	was := groupsAsked
+	t.Cleanup(func() { groupsAsked = was })
+	groupsAsked = func(_ context.Context, held bool) ([]groupsLine, error) {
+		asked++
+		if !held {
+			t.Error("the seat is held, yet it was asked as not held")
+		}
+		return []groupsLine{group("feat/x", member("novox/mesh-host", 114, headHost, "main", true),
+			member("novox/mesh-controller", 346, headController, "main", true))}, nil
+	}
+	request := link.BuildRequest{Check: &link.CheckRequest{Owner: "novox", Repo: "mesh-host", Base: "main", Beside: besideTheCore()}}
+	withSiblings(t.Context(), &request, link.PullUpdated{Owner: "novox", Repo: "mesh-host", Base: "main", Head: "feat/x"}, entries)
+	if asked != 1 {
+		t.Fatalf("mesh-delivery was asked %d times for one check", asked)
+	}
+	want := link.CheckSibling{Repository: "novox/mesh-controller", Number: 346, Head: headController, Base: "main", Dir: "mesh-controller"}
+	if got := request.Check.Siblings; len(got) != 1 || got[0] != want || request.Check.SiblingsUnknown != "" {
+		t.Fatalf("the ask names siblings %+v, unknown %q", got, request.Check.SiblingsUnknown)
+	}
+	body, _ := json.Marshal(request.Check)
+	if !strings.Contains(string(body), `"siblings":[{"repository":"novox/mesh-controller","number":346,"head":"`+headController+
+		`","base":"main","dir":"mesh-controller"}]`) {
+		t.Fatalf("on the wire: %s", body)
+	}
+}
+
+// When mesh-delivery does not answer in time (or is not held, or answered without the fields), the check reads no
+// sibling and its request says it could not learn them, so a fix to mesh-delivery is still checked without it.
+func TestWhenMeshDeliveryDoesNotAnswerTheCheckReadsNoSiblingAndSaysSo(t *testing.T) {
+	was := groupsAsked
+	t.Cleanup(func() { groupsAsked = was })
+	for _, c := range []struct {
+		what string
+		err  error
+		held bool
+	}{{"it did not answer", context.DeadlineExceeded, true}, {"nothing serves it", errors.New("nothing serves mesh-delivery.groups"), true},
+		{"no holder on record", errors.New("no holder of mesh-delivery is on record to say it"), false}} {
+		entries := theCoreOnTheGitSeat()
+		if !c.held {
+			entries = entries[:4]
+		}
+		groupsAsked = func(_ context.Context, held bool) ([]groupsLine, error) {
+			if held != c.held {
+				t.Errorf("%s: held %v", c.what, held)
+			}
+			return nil, c.err
+		}
+		request := link.BuildRequest{Check: &link.CheckRequest{Owner: "novox", Repo: "mesh-host", Base: "main", Beside: besideTheCore()}}
+		withSiblings(t.Context(), &request, link.PullUpdated{Owner: "novox", Repo: "mesh-host", Base: "main", Head: "feat/x"}, entries)
+		if len(request.Check.Siblings) != 0 || !strings.Contains(request.Check.SiblingsUnknown, c.err.Error()) ||
+			!strings.Contains(request.Check.SiblingsUnknown, "reads no siblings") {
+			t.Errorf("%s: siblings %+v, unknown %q", c.what, request.Check.Siblings, request.Check.SiblingsUnknown)
+		}
+	}
+}
+
+// **A pull request for which mesh-delivery answered and named no sibling is asked exactly as before** (ADR 0382 §7):
+// byte for byte the request it was without the rule.
+func TestAPullRequestWithNoSiblingIsAskedByteForByteAsBefore(t *testing.T) {
+	entries := theCoreOnTheGitSeat()
+	was := groupsAsked
+	t.Cleanup(func() { groupsAsked = was })
+	for _, answer := range [][]groupsLine{nil, {group("feat/other", member("novox/mesh-controller", 346, headController, "main", true))},
+		{group("feat/x", member("novox/mesh-host", 114, headHost, "main", true), member("novox/hq", 3, headHq, "main", true))}} {
+		groupsAsked = func(context.Context, bool) ([]groupsLine, error) { return answer, nil }
+		build := func() link.BuildRequest {
+			return link.BuildRequest{ID: "build-1", Repository: "r", Ref: headHost, Check: &link.CheckRequest{Owner: "novox",
+				Repo: "mesh-host", Number: 114, Base: "main", Beside: besideTheCore(), Modules: []string{"mesh-host"}, Judge: "validator"}}
+		}
+		before, _ := json.Marshal(build())
+		after := build()
+		withSiblings(t.Context(), &after, link.PullUpdated{Owner: "novox", Repo: "mesh-host", Base: "main", Head: "feat/x"}, entries)
+		got, _ := json.Marshal(after)
+		if string(before) != string(got) {
+			t.Fatalf("the request changed:\nbefore %s\nafter  %s", before, got)
+		}
+	}
+}
+
+// What the build seat's verdict says of its siblings reaches the forge's holder in the controller's `checked`.
+func TestTheVerdictCarriesTheSiblingsAndWhereTheJudgeCameFrom(t *testing.T) {
+	read := []link.CheckSibling{{Repository: "novox/mesh-controller", Number: 346, Head: headController, Base: "main", BaseCommit: headHost}}
+	c := checkedOf(link.BuildResult{ID: "b", Ref: headHost, Checked: &link.CheckRequest{Owner: "novox", Repo: "mesh-host", Number: 114},
+		Check: &link.CheckOutcome{Verdict: "pass", Summary: "ok", Siblings: read, JudgeFrom: "sibling novox/mesh-controller#346 merge abc",
+			Validator: "the change's own validator"}})
+	if len(c.Siblings) != 1 || c.Siblings[0] != read[0] || c.JudgeFrom == "" || c.Validator == "" {
+		t.Fatalf("the verdict says %+v", c)
+	}
+	body, _ := json.Marshal(c)
+	for _, want := range []string{`"siblings":[{"repository":"novox/mesh-controller","number":346,"head":"` + headController +
+		`","base":"main","base_commit":"` + headHost + `"}]`, `"judge_from":"sibling novox/mesh-controller#346 merge abc"`} {
+		if !strings.Contains(string(body), want) {
+			t.Fatalf("the verdict lacks %s:\n%s", want, body)
+		}
+	}
+	unknown := checkedOf(link.BuildResult{ID: "b", Check: &link.CheckOutcome{Verdict: "pass", SiblingsUnknown: "mesh-delivery did not answer"}})
+	if body, _ := json.Marshal(unknown); !strings.Contains(string(body), `"siblings_unknown":"mesh-delivery did not answer"`) ||
+		strings.Contains(string(body), `"siblings":`) {
+		t.Fatalf("the verdict that could not learn them says %s", body)
+	}
+}

cmd/mesh-controller/check_test.go

@@ -8,8 +8,8 @@ import (
 
 	"testing"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/beside"
+	"github.com/novox/mesh-controller/internal/catalogue"
 )
 
 // The check anybody can run is the check registration runs (novox/hq issue 148, ADR 0037): a manifest

cmd/mesh-controller/checks.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
 	"io"
 	"os"
 	"path"
@@ -15,8 +14,8 @@ import (
 	"strings"
 	"time"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
@@ -76,7 +75,7 @@ type checkScope struct {
 	// Mesh says the repository is the mesh's: modules are built from it on some branch, its owner is the
 	// core's, or the change adds a module to it.
 	Mesh bool
-	// Judge is who judges the gate (link.JudgeSelf, or the running controller).
+	// Judge is who judges the gate (link.JudgeSelf, link.JudgeValidator, or the running controller).
 	Judge string
 	// From is a module built from the repository, for how the mesh clones it; nil when none is.
 	From *inventory.Entry
@@ -102,6 +101,10 @@ func pullScope(p link.PullUpdated, entries []inventory.Entry, read map[string][]
 		switch e.Manifest.Module {
 		case "mesh-controller":
 			s.Judge = link.JudgeSelf
+		case "mesh-host":
+			if s.Judge == "" {
+				s.Judge = link.JudgeValidator
+			}
 		}
 	}
 	for _, d := range r.Added {
@@ -162,77 +165,56 @@ func (f following) pullUpdated(ctx context.Context, p link.PullUpdated, w io.Wri
 		return "", err
 	}
 	scope := pullScope(p, entries, read, edges)
-	// **The merge gate's checks stop** (novox/hq ADR 0503 §3, §5; issue 1299): the checker judges every repository whose
-	// trunk requires `mesh/check`. A repository whose trunk requires `mesh/repo-check` (hq), whatever else it requires
-	// (ADR 0513 §4), has its own merge-check.sh asked of build-agent, and said with that layer alone; any other is asked
-	// nothing and said nothing. What the forge's protection requires is read, never listed (lead decision L11).
-	// Mesh-config is still told what the head declares (ADR 0502), whatever judges it.
-	this := pullAtOf(p)
-	if this.Truncated {
-		this.Paths, this.Truncated = truncatedPaths(entries, p.Owner, p.Repo, scope.Modules), false
-	}
-	if scope.gated() || holdsModules(entries, p.Owner, p.Repo) {
-		tellPullDeclares(ctx, w, []pullAt{this})
-	}
-	required, err := requiredStatusesOf(ctx, p.Owner, p.Repo, p.Base)
-	switch {
-	case err != nil:
-		fmt.Fprintf(w, "%s/%s#%d (%.8s): what %s's protection requires cannot be read, so nothing is asked and nothing is "+
-			"said: %v\n", p.Owner, p.Repo, p.Number, p.Commit, p.Base, err)
-		return "", nil
-	case !asksRepoCheck(required):
-		fmt.Fprintf(w, "%s/%s#%d (%.8s): %s does not require %s, and %s; nothing is asked\n", p.Owner, p.Repo, p.Number,
-			p.Commit, p.Base, sdkdelivery.StatusContextRepoCheck, checkerWords(required))
+	// **A cycle of edges fails the check, naming every module and edge** (novox/hq ADR 0419 clause 6), a lone pull
+	// request's as a group's composed check is: no order exists for what it changes.
+	alone := orderMember{ID: p.Owner + "/" + p.Repo + "@" + twelve(p.Commit), Repository: p.Owner + "/" + p.Repo, Base: p.Base,
+		Head: p.Commit, Number: p.Number, Paths: p.Paths, PathsTruncated: p.PathsTruncated, Removed: p.Removed, BaseSHA: p.BaseSHA}
+	if failing, cyclic, err := cycleVerdict(ctx, "", []orderMember{alone},
+		map[string]orderReach{alone.ID: {Moved: scope.Modules}}, edges, entries); err != nil {
+		return "", err
+	} else if cyclic {
+		failing.Commit, failing.Trunk = p.Commit, twelve(p.BaseSHA)
+		fmt.Fprintf(w, "%s/%s#%d (%.8s): %s\n", p.Owner, p.Repo, p.Number, p.Commit, failing.Summary)
+		sayChecked(ctx, w, failing)
 		return "", nil
 	}
-	return f.repoCheckAlone(ctx, w, p, scope, entries)
-}
-
-// asksRepoCheck says what a trunk's protection has the controller ask: its repository's own merge-check.sh whenever the
-// trunk requires `mesh/repo-check`, whatever else it requires (ADR 0513 §4: a trunk requiring both has the checker judge
-// `mesh/check` and the repository check asked beside it), and nothing otherwise.
-func asksRepoCheck(required []string) bool {
-	return slices.Contains(required, sdkdelivery.StatusContextRepoCheck)
-}
-
-// checkerWords says who judges a trunk that requires no `mesh/repo-check`.
-func checkerWords(required []string) string {
-	if slices.Contains(required, sdkdelivery.StatusContextCheck) {
-		return "the checker judges its " + sdkdelivery.StatusContextCheck
-	}
-	return "does not require " + sdkdelivery.StatusContextCheck + " either, so nothing is said"
-}
-
-// repoCheckAlone asks build-agent for a repository's own merge-check.sh alone, for a pull request of a repository whose
-// trunk requires `mesh/repo-check`, whether or not it also requires `mesh/check` (ADR 0503 §5, ADR 0513 §4): no gate, no module built, its verdict said with the
-// repo-check layer alone.
-func (f following) repoCheckAlone(ctx context.Context, w io.Writer, p link.PullUpdated, scope checkScope,
-	entries []inventory.Entry) (string, error) {
-	inv := f.open.inventory
+	// **A member of a group whose gate is the composed check's runs its repository's check alone** (novox/hq ADR 0403
+	// clause 1): mesh-delivery is asked once, and says so on the group's line. Told nothing, the pull request is
+	// checked alone, gate included (clause 6).
+	lines, groupsErr := groupsAsked(ctx, deliverySeatHeld(entries))
+	composed := groupsErr == nil && composedMember(p, lines)
+	// The change plan of the commit at hand (ADR 0238): what a merge of it would build and send, posted
+	// with the verdict whatever the verdict is.
 	plan := changePlanOf(p.Owner+"/"+p.Repo, p.Base, p.Commit, scope.Reach, entries, func(module string) (inventory.Upgrade, bool) {
 		u, err := inv.UpgradeOf(ctx, module)
 		return u, err == nil
 	})
 	fmt.Fprint(w, planText(plan))
 	direct := directVerdict(p, plan)
+	if composed {
+		scope.Modules, scope.Dependents, scope.New, scope.Manifests = nil, nil, nil, nil
+		composedGate(&direct)
+	}
 	switch {
-	case !scope.Mesh:
-		direct.RepoCheck = &link.CheckLayer{Verdict: "warning", Summary: "the repository is not the mesh's: nothing run"}
-		fmt.Fprintf(w, "%s/%s#%d (%.8s): the repository is not the mesh's: said, nothing run\n", p.Owner, p.Repo, p.Number,
-			p.Commit)
+	case !scope.gated() && !scope.Mesh:
+		fmt.Fprintf(w, "%s/%s#%d (%.8s): %s, and the repository is not the mesh's: said, nothing run\n",
+			p.Owner, p.Repo, p.Number, p.Commit, noModuleTouched)
 		sayChecked(ctx, w, direct)
 		return "", nil
-	case p.MergeCheckSaid && !p.MergeCheck:
+	case !scope.gated() && p.MergeCheckSaid && !p.MergeCheck:
 		direct.RepoCheck = &link.CheckLayer{Verdict: "warning", Summary: noMergeCheck}
-		fmt.Fprintf(w, "%s/%s#%d (%.8s): %s\n", p.Owner, p.Repo, p.Number, p.Commit, noMergeCheck)
+		fmt.Fprintf(w, "%s/%s#%d (%.8s): %s; %s\n", p.Owner, p.Repo, p.Number, p.Commit, noModuleTouched, noMergeCheck)
 		sayChecked(ctx, w, direct)
 		return "", nil
 	}
-	request, err := checkRequestFor(ctx, f.open, p, checkScope{Mesh: true, From: scope.From}, entries)
+	request, err := checkRequestFor(ctx, f.open, p, scope, entries)
 	if err != nil {
 		return "", err
 	}
 	request.Check.Plan = &plan
+	request.Check.Composed = composed
+	// **The group's other open pull requests are read beside it** (novox/hq ADR 0382 §1).
+	siblingsFrom(&request, p, entries, lines, groupsErr)
 	seat := buildSeatHeld(ctx)
 	ask, err := askOverOn(seat)
 	if err != nil {
@@ -242,42 +224,23 @@ func (f following) repoCheckAlone(ctx context.Context, w io.Writer, p link.PullU
 	if err := ask.Ask(ctx, request); err != nil {
 		return "", err
 	}
-	fmt.Fprintf(w, "%s/%s#%d (%.8s): asked %s to run its own merge-check.sh alone, as %s\n", p.Owner, p.Repo, p.Number,
-		p.Commit, seat, request.ID)
+	// **A newer request replaces the one still waiting, and a newer key stops the one running** (novox/hq ADR 0406 §3, §4,
+	// issue 974): the check queue keeps one request a pull request, and a running check watches its key. Nothing is asked
+	// of the forge here (issue 726).
+	what := "its own merge-check.sh alone: " + noModuleTouched
+	if composed {
+		what = "its own merge-check.sh alone: the gate is its group's composed check's"
+	}
+	if scope.gated() {
+		what = fmt.Sprintf("the gate over %s (a merge would build %d module(s) in %d tier(s))",
+			strings.Join(append(append([]string{}, scope.Modules...), prefixedAll("new:", scope.New)...), ", "),
+			scope.Width, scope.Tiers)
+	}
+	fmt.Fprintf(w, "%s/%s#%d (%.8s): asked %s to check it before it merges — %s — as %s\n", p.Owner, p.Repo, p.Number,
+		p.Commit, seat, what, request.ID)
 	return request.ID, nil
 }
 
-// requiredStatusesOf is what the forge's protection of a repository's branch requires before a merge, as the forge
-// picks the rule it applies (the one named for the branch, else the first glob covering it). A variable so a test needs
-// no forge.
-var requiredStatusesOf = func(ctx context.Context, owner, repo, branch string) ([]string, error) {
-	var rules struct {
-		Rules []protectionRule `json:"rules"`
-	}
-	js, err := aBus()
-	if err != nil {
-		return nil, err
-	}
-	defer js.Close()
-	raw, _ := json.Marshal(map[string]any{"owner": owner, "repo": repo})
-	answer, err := link.Ask(ctx, link.OverNATS{Conn: js.Conn()}, "gitea", "gitea_branch_protection_get", raw, 30*time.Second)
-	if err != nil {
-		return nil, err
-	}
-	if answer.Error != "" {
-		return nil, fmt.Errorf("gitea.gitea_branch_protection_get: %s", answer.Error)
-	}
-	if err := json.Unmarshal(answer.Result, &rules); err != nil {
-		return nil, err
-	}
-	r := appliedRule(rules.Rules, branch)
-	if r == nil {
-		// empty-on-error: not an error; no rule covers the branch, so it requires nothing, which the caller says
-		return nil, nil
-	}
-	return r.RequiredStatuses, nil
-}
-
 // composedWords is what a group member's own verdict says of its gate layer (novox/hq ADR 0403 clause 1).
 const composedWords = "judged by its group's composed check"
 
@@ -318,7 +281,7 @@ func checkRequestFor(ctx context.Context, open *stores, p link.PullUpdated, scop
 	for _, e := range entries {
 		shelf[e.Manifest.Module] = e.Manifest
 	}
-	world, err := restOfTheMesh(ctx, open, shelf, "")
+	world, err := theRestOfTheMesh(ctx, open.inventory, shelf, "")
 	if err != nil {
 		return link.BuildRequest{}, err
 	}
@@ -406,6 +369,15 @@ func trunkOf(s inventory.Source) string {
 	return "main"
 }
 
+// sourceName is the name of a recorded repository, a path on the git seat or a URL: novox/mesh-host → mesh-host.
+func sourceName(repository string) string {
+	parts := strings.Split(strings.Trim(strings.TrimSuffix(repository, ".git"), "/"), "/")
+	if len(parts) < 2 {
+		return ""
+	}
+	return parts[len(parts)-1]
+}
+
 // namedForTheCheck are the builds earlier checks of the same pull request at the same head named, read once for the
 // check (novox/hq issue 703): asked again because only the trunk moved, the check keeps what they built of a key
 // still the same. Another pull request's build, or one of an earlier head, is never kept. None when they cannot be
@@ -626,13 +598,11 @@ func checkedOf(result link.BuildResult) link.Checked {
 		// A delivery group's composed check (novox/hq ADR 0239): every head it judged, this one first.
 		if g := result.Checked; g.Group != "" {
 			c.Group = g.Group
-			// Every member is named with its trunk commit (novox/hq issue 1106): the seat's word, else the one the forge
-			// announced with the head, so the forge's merge tool never meets a member whose verdict names none.
 			c.Members = append(c.Members, link.CheckedMember{Owner: g.Owner, Repo: g.Repo, Number: g.Number,
-				Commit: result.Ref, Trunk: firstTrunk(c.Trunk, g.Trunk)})
+				Commit: result.Ref, Trunk: c.Trunk})
 			for _, m := range g.Members {
 				c.Members = append(c.Members, link.CheckedMember{Owner: m.Owner, Repo: m.Repo, Number: m.Number,
-					Commit: m.Ref, Trunk: firstTrunk(memberTrunk(result.Check, m), m.Trunk)})
+					Commit: m.Ref, Trunk: memberTrunk(result.Check, m)})
 			}
 		}
 	}
@@ -661,16 +631,6 @@ func checkedOf(result link.BuildResult) link.Checked {
 	return c
 }
 
-// firstTrunk is the first trunk commit named, as twelve characters; empty when none is.
-func firstTrunk(named ...string) string {
-	for _, n := range named {
-		if n != "" {
-			return twelve(n)
-		}
-	}
-	return ""
-}
-
 // memberTrunk is the trunk commit the build seat merged one of a group's heads into (novox/hq ADR 0323 §6), empty
 // when it said none.
 func memberTrunk(outcome *link.CheckOutcome, m link.GroupMember) string {
@@ -695,9 +655,6 @@ func prefixedAll(prefix string, items []string) []string {
 
 // sayChecked says a merge check's verdict on the bus, where the forge's holder hears it.
 func sayChecked(ctx context.Context, w io.Writer, c link.Checked) {
-	// **No merge-gate layer from R4e, for any repository** (ADR 0503 §3, §5; issue 1299): the forge's holder writes
-	// `mesh/repo-check` from the repo-check layer alone, and the checker owes `mesh/check`.
-	c.Gate = nil
 	repo := "none"
 	if c.RepoCheck != nil {
 		repo = strings.ToUpper(c.RepoCheck.Verdict) + " — " + c.RepoCheck.Summary
@@ -706,8 +663,8 @@ func sayChecked(ctx context.Context, w io.Writer, c link.Checked) {
 	if c.Trunk != "" {
 		judged = " merged into trunk " + c.Trunk
 	}
-	fmt.Fprintf(w, "%s: %s/%s#%d at %.8s%s checked on %s: repository %s\n", c.ID, c.Owner, c.Repo, c.Number,
-		c.Commit, judged, orSomewhere(c.On), repo)
+	fmt.Fprintf(w, "%s: %s/%s#%d at %.8s%s checked on %s: gate %s — %s; repository %s\n", c.ID, c.Owner, c.Repo, c.Number,
+		c.Commit, judged, orSomewhere(c.On), strings.ToUpper(c.Verdict), c.Summary, repo)
 	if checkEvents == nil {
 		return
 	}

cmd/mesh-controller/checks_queue_test.go

@@ -0,0 +1,97 @@
+//go:build integration
+
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"testing"
+
+	"github.com/nats-io/nats.go"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// Acceptance 5 of milestone 2 (novox/hq ADR 0406 §3, issue 974), live, with the store and a real bus: two merges into one
+// repository within a minute, with two open pull requests, leave each pull request with exactly one queued check, by the
+// stream's rule. Each merge moves the trunk, and mesh-delivery asks the controller to check both open pull requests again
+// against it (`delivery check`, which is the controller's own path for a head announced); nothing moves a request, nothing
+// asks the forge, and the queue is read back whole.
+func TestTwoMergesWithinAMinuteLeaveEachOpenPullRequestOneQueuedCheck(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	js, _ := aBuildQueue(t)
+	servingBus.Store(js)
+	t.Cleanup(func() { servingBus.Store(nil) })
+	holdTheDeliverySeat(t, open)
+	was := askDeliveryOwner
+	t.Cleanup(func() { askDeliveryOwner = was })
+	askDeliveryOwner = func(_ context.Context, _ *nats.Conn, verb string, _ map[string]any) (json.RawMessage, error) {
+		if verb != "groups" {
+			t.Fatalf("asked the owner %s", verb)
+		}
+		return json.RawMessage(`[]`), nil
+	}
+	// The repository the two pull requests are into, as a module the mesh builds from it.
+	if err := open.inventory.RegisterModule(ctx, catalogue.Manifest{Module: "mesh-controller", Version: "1"},
+		inventory.Source{Repository: "novox/mesh-controller", Ref: "main", BuiltFrom: "c0", Head: "c0"}); err != nil {
+		t.Fatal(err)
+	}
+
+	heads := map[int]string{7: "7777777777777777777777777777777777777777", 8: "8888888888888888888888888888888888888888"}
+	check := func(number int, trunk string) {
+		t.Helper()
+		p := orderMember{ID: fmt.Sprintf("novox/mesh-controller@%.12s", heads[number]), Repository: "novox/mesh-controller",
+			Base: "main", Head: heads[number], Number: number, Paths: []string{"main.go"}, ModuleDirsSaid: true,
+			BaseSHA: trunk, Ready: number == 8}.pull()
+		p.MergeCheck, p.MergeCheckSaid = true, true
+		if err := (following{open: open, oneShot: true}).PullUpdated(ctx, p); err != nil {
+			t.Fatal(err)
+		}
+	}
+	// Announced against the trunk as it stands, then asked again after each of two merges.
+	for _, trunk := range []string{"1111111111111111111111111111111111111111", "2222222222222222222222222222222222222222",
+		"3333333333333333333333333333333333333333"} {
+		check(7, trunk)
+		check(8, trunk)
+	}
+
+	q, err := link.ReadQueue(ctx, js, link.TheBuildMachine)
+	if err != nil {
+		t.Fatal(err)
+	}
+	seen := map[int]string{}
+	for _, a := range q.Asks {
+		c := a.Request.Check
+		if c == nil {
+			t.Fatalf("%s is no check", a.ID)
+		}
+		if _, twice := seen[c.Number]; twice {
+			t.Errorf("pull request %d has two queued checks", c.Number)
+		}
+		seen[c.Number] = c.Trunk
+		if a.State != link.AskWaiting {
+			t.Errorf("%s is %s", a.ID, a.State)
+		}
+		if want := "3333333333333333333333333333333333333333"; c.Trunk != want {
+			t.Errorf("pull request %d is queued against %.8s; want the newest trunk %.8s", c.Number, c.Trunk, want)
+		}
+	}
+	if len(seen) != 2 {
+		t.Fatalf("queued checks for %v; want one for each of the two open pull requests", seen)
+	}
+	// By the streams' own count: the ready one on its stream, the other on its.
+	for stream, want := range map[string]uint64{broker.ChecksReadyStream: 1, broker.ChecksOtherStream: 1} {
+		info, err := js.Context().StreamInfo(stream)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if info.State.Msgs != want {
+			t.Errorf("%s holds %d request(s); want %d", stream, info.State.Msgs, want)
+		}
+	}
+}

cmd/mesh-controller/checks_stop_integration_test.go

@@ -1,109 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// C1 (ADR 0503 §3, §5; issue 1299, lead decision L11), with the store and a real build queue: a pull request of a
-// repository whose trunk requires mesh/check asks build-agent nothing and says nothing; one whose trunk requires
-// mesh/repo-check alone (hq) has its own merge-check.sh asked, and every verdict said names no gate layer; a protection
-// that cannot be read asks and says nothing.
-func TestThePullRequestChecksAreAskedOnlyForARepositoryTheCheckerDoesNotJudge(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	js, _ := aBuildQueue(t)
-	servingBus.Store(js)
-	t.Cleanup(func() { servingBus.Store(nil) })
-	said := &saidOnTheBus{}
-	checkEvents = said
-	t.Cleanup(func() { checkEvents = nil })
-	if err := open.inventory.RegisterModule(ctx, catalogue.Manifest{Module: "mesh-controller", Version: "1"},
-		inventory.Source{Repository: "novox/mesh-controller", Ref: "main", BuiltFrom: "c0", Head: "c0"}); err != nil {
-		t.Fatal(err)
-	}
-	// hq is cloned as a module built from it is, from its URL: no forge is held in this test.
-	if err := open.inventory.RegisterModule(ctx, catalogue.Manifest{Module: "hq-docs", Version: "1"},
-		inventory.Source{Repository: "http://forge.invalid/novox/hq.git", Ref: "main", Path: "docs", BuiltFrom: "c0",
-			Head: "c0"}); err != nil {
-		t.Fatal(err)
-	}
-	required := map[string][]string{"novox/mesh-controller": {"mesh/check"}, "novox/hq": {"mesh/repo-check"}}
-	was := requiredStatusesOf
-	requiredStatusesOf = func(_ context.Context, owner, repo, _ string) ([]string, error) {
-		if r, ok := required[owner+"/"+repo]; ok {
-			return r, nil
-		}
-		return nil, errors.New("the forge did not answer")
-	}
-	t.Cleanup(func() { requiredStatusesOf = was })
-	queued := func() int {
-		q, err := link.ReadQueue(ctx, js, link.TheBuildMachine)
-		if err != nil {
-			t.Fatal(err)
-		}
-		return len(q.Asks)
-	}
-	pull := func(repo string, number int, mergeCheck bool) link.PullUpdated {
-		p := link.PullUpdated{Owner: "novox", Repo: repo, Number: number, Base: "main", Commit: "abcdefabcdefabcdefabcdefabcdefabcdefabcd",
-			BaseSHA: "1111111111111111111111111111111111111111", Paths: []string{"main.go"}, ModuleDirsSaid: true}
-		p.MergeCheck, p.MergeCheckSaid = mergeCheck, true
-		return p
-	}
-	f := following{open: open, oneShot: true}
-
-	if err := f.PullUpdated(ctx, pull("mesh-controller", 7, true)); err != nil {
-		t.Fatal(err)
-	}
-	if n := queued(); n != 0 || len(said.events) != 0 {
-		t.Fatalf("0503 §3: a repository the checker judges asked %d check(s) and said %v", n, said.events)
-	}
-	if err := f.PullUpdated(ctx, pull("unread", 3, true)); err != nil {
-		t.Fatal(err)
-	}
-	if n := queued(); n != 0 || len(said.events) != 0 {
-		t.Fatalf("L11: a protection that cannot be read asked %d check(s) and said %v", n, said.events)
-	}
-	if err := f.PullUpdated(ctx, pull("hq", 9, true)); err != nil {
-		t.Fatal(err)
-	}
-	q, err := link.ReadQueue(ctx, js, link.TheBuildMachine)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(q.Asks) != 1 || q.Asks[0].Request.Check == nil || len(q.Asks[0].Request.Check.Modules) != 0 ||
-		q.Asks[0].Request.Check.Repo != "hq" {
-		t.Fatalf("0503 §5: hq's repository check is not the one ask: %+v", q.Asks)
-	}
-	// A head with no merge-check.sh is said at once, with the repo-check layer alone.
-	if err := f.PullUpdated(ctx, pull("hq", 10, false)); err != nil {
-		t.Fatal(err)
-	}
-	if len(said.events) != 1 {
-		t.Fatalf("hq's head with no merge-check.sh was said %d time(s)", len(said.events))
-	}
-	var c link.Checked
-	if err := json.Unmarshal(said.bodies[0], &c); err != nil {
-		t.Fatal(err)
-	}
-	if c.Gate != nil || c.RepoCheck == nil || c.RepoCheck.Verdict != "warning" {
-		t.Fatalf("0503 §5: the verdict said names a gate layer, or no repo-check layer: %+v", c)
-	}
-	// A trunk requiring both (hq, ADR 0513 §4): the checker judges mesh/check, and the repository check is still asked.
-	required["novox/hq"] = []string{"mesh/check", "mesh/repo-check"}
-	if err := f.PullUpdated(ctx, pull("hq", 11, true)); err != nil {
-		t.Fatal(err)
-	}
-	if q, err := link.ReadQueue(ctx, js, link.TheBuildMachine); err != nil || len(q.Asks) != 2 ||
-		q.Asks[1].Request.Check == nil || q.Asks[1].Request.Check.Repo != "hq" {
-		t.Fatalf("0513 §4: a trunk requiring both had no repository check asked: %+v %v", q.Asks, err)
-	}
-}

cmd/mesh-controller/checks_test.go

@@ -53,8 +53,8 @@ func TestThePullRequestIsMappedOntoTheModuleGraph(t *testing.T) {
 			"", "modules/newmod", "modules/newmod/module.json", true, ""},
 		{"the controller judges itself", pull("novox", "mesh-controller", "main", []string{"cmd/x.go"}),
 			"mesh-controller", "", "module.json", true, "self"},
-		{"the node-engine is judged by the controller the mesh runs, as any module is (issue 1391)",
-			pull("novox", "mesh-host", "main", []string{"validate/v.go"}), "mesh-host", "", "module.json", true, ""},
+		{"the node-engine is judged with its validator", pull("novox", "mesh-host", "main", []string{"validate/v.go"}),
+			"mesh-host", "", "module.json", true, "validator"},
 		{"the core's owner, no module: the mesh's, its own check alone", pull("novox", "hq", "main", []string{"README.md"}),
 			"", "", "", true, ""},
 		{"a branch nothing is built from: the mesh's repository, no module", pull("novox", "photos", "master",
@@ -250,31 +250,6 @@ func TestAVerdictNamesTheTrunkCommitItJudged(t *testing.T) {
 	}
 }
 
-// **A group's composed verdict names every member's trunk commit** (novox/hq issue 1106): a member the build seat named no
-// trunk for (an SDK member whose base the seat did not merge, or a seat from before the rule) is named by the trunk the forge
-// announced with its head, and the primary the same, so the merge tool never reads "names no trunk commit" on a member
-// whose trunk did not move.
-func TestAGroupVerdictNamesEveryMembersTrunkTheSDKMemberToo(t *testing.T) {
-	group := &link.CheckRequest{Owner: "novox", Repo: "mesh-catalog", Number: 7, Base: "main", Group: "feat/x",
-		Trunk: "dddddddddddd0000",
-		Members: []link.GroupMember{
-			{Owner: "novox", Repo: "mesh-sdk", Number: 8, Ref: "cccccccccccc0000", Base: "main", Trunk: "eeeeeeeeeeee0000"},
-			{Owner: "novox", Repo: "mesh-host", Number: 9, Ref: "bbbbbbbbbbbb0000", Base: "main", Trunk: "ffffffffffff0000"}}}
-	c := checkedOf(link.BuildResult{ID: "g", Ref: "aaaaaaaaaaaa0000", Checked: group, Check: &link.CheckOutcome{
-		Verdict: "pass", Head: "aaaaaaaaaaaa", Gate: &link.CheckLayer{Verdict: "pass"},
-		Members: []link.CheckedMember{{Owner: "novox", Repo: "mesh-host", Commit: "bbbbbbbbbbbb", Trunk: "222222222222"}}}})
-	want := []string{"dddddddddddd", "eeeeeeeeeeee", "222222222222"}
-	if len(c.Members) != 3 {
-		t.Fatalf("the composed check names its members %+v", c.Members)
-	}
-	for i, m := range c.Members {
-		if m.Trunk != want[i] {
-			t.Fatalf("member %d (%s/%s) is named with trunk %q, want %q (the seat's word first, else the announced one): %+v",
-				i, m.Owner, m.Repo, m.Trunk, want[i], c.Members)
-		}
-	}
-}
-
 // **The merge made for a check is never registered** (novox/hq ADR 0323 §2): a build of it — a commit on no branch
 // of the forge — is refused, naming the trunk. The rule of ADR 0238 §1 stands unchanged; this holds it for the
 // merge commit a check makes.
@@ -316,21 +291,3 @@ func TestARecheckedHeadsDirectVerdictNamesItsTrunk(t *testing.T) {
 
 // A check stopped by its pull request's key moving on says no verdict (issue 974, review 2): an error said for it would name the
 // live head, and the newer request is the one that judges. A check that failed for any other reason still says its error.
-
-// C2 (ADR 0513 §4, ADR 0503 §5; issue 1299): a trunk requiring mesh/repo-check has its repository check asked, whether or
-// not it also requires mesh/check (hq requires both); a trunk requiring mesh/check alone, or neither, is asked nothing.
-func TestARepositoryCheckIsAskedWheneverTheTrunkRequiresIt(t *testing.T) {
-	for _, c := range []struct {
-		required []string
-		asks     bool
-	}{
-		{[]string{"mesh/check", "mesh/repo-check"}, true},
-		{[]string{"mesh/repo-check"}, true},
-		{[]string{"mesh/check"}, false},
-		{nil, false},
-	} {
-		if got := asksRepoCheck(c.required); got != c.asks {
-			t.Fatalf("a trunk requiring %v asks its repository check: %v, want %v", c.required, got, c.asks)
-		}
-	}
-}

cmd/mesh-controller/compose_callers_test.go

@@ -1,59 +0,0 @@
-package main
-
-import (
-	"go/ast"
-	"go/parser"
-	"go/token"
-	"path/filepath"
-	"sort"
-	"strings"
-	"testing"
-)
-
-// 1389: the controller's own composition is gone. No function of the package is named for it any more, and no function
-// calls one by that name: a name reappearing is a second copy of what mesh-sdk's go/compose holds (novox/hq ADR 0453).
-func TestTheControllersOwnCompositionIsGone(t *testing.T) {
-	gone := map[string]bool{"planFor": true, "declarationWith": true, "composedAndValidated": true, "generators": true,
-		"renderingFor": true, "theRestOfTheMesh": true, "whoResolves": true, "grantsFor": true, "namesInTheMesh": true,
-		"onThePrivateNetwork": true, "passSeatsOn": true, "theMeshPassesSeatsOn": true, "assignmentsOf": true,
-		"licencesFor": true, "seatsOn": true, "composeBusUsers": true, "adoptionFor": true, "localNetworksOf": true}
-	files, err := filepath.Glob("*.go")
-	if err != nil {
-		t.Fatal(err)
-	}
-	fset := token.NewFileSet()
-	var found []string
-	for _, f := range files {
-		if strings.HasSuffix(f, "_test.go") {
-			continue
-		}
-		file, err := parser.ParseFile(fset, f, nil, 0)
-		if err != nil {
-			t.Fatal(err)
-		}
-		for _, d := range file.Decls {
-			fn, ok := d.(*ast.FuncDecl)
-			if !ok {
-				continue
-			}
-			if gone[fn.Name.Name] {
-				found = append(found, f+": "+fn.Name.Name+" is declared")
-			}
-			if fn.Body == nil {
-				continue
-			}
-			ast.Inspect(fn.Body, func(n ast.Node) bool {
-				if c, ok := n.(*ast.CallExpr); ok {
-					if id, ok := c.Fun.(*ast.Ident); ok && gone[id.Name] {
-						found = append(found, f+": "+fn.Name.Name+" calls "+id.Name)
-					}
-				}
-				return true
-			})
-		}
-	}
-	sort.Strings(found)
-	for _, one := range found {
-		t.Errorf("%s: the controller's own composition is back; compose through mesh-sdk (compose_sdk.go)", one)
-	}
-}

cmd/mesh-controller/compose_fallbacks_test.go

@@ -1,114 +0,0 @@
-package main
-
-import (
-	"encoding/base64"
-	"errors"
-	"strings"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/compose"
-	"github.com/novox/mesh-controller/internal/broker"
-)
-
-// aCoreInput is an Input of one machine that takes a core module whose credential the vault has not boxed: the composition
-// stands in a vault box for it, and the machine holds the controller's own seal of it.
-func aCoreInput(t *testing.T) (*meshInput, string) {
-	t.Helper()
-	raw := make([]byte, 32)
-	raw[0] = 9
-	key := base64.StdEncoding.EncodeToString(raw)
-	client := catalogue.Manifest{Module: "mesh-provisioner-client", Version: "1",
-		Claims:     []catalogue.Claim{{Name: broker.NodeProvisionerSeat, Scope: catalogue.ScopeNode}},
-		OwnSecrets: catalogue.OwnSecrets{broker.ProvisionerSecret: {Path: "/var/lib/mesh-provisioner-client/broker"}}}
-	return &meshInput{Input: compose.Input{
-		Catalogue: map[string]catalogue.Manifest{client.Module: client},
-		Nodes: []compose.Node{{Name: "laptop", Assigned: []string{client.Module}, SealingKey: key, Stated: true,
-			Contract: compose.VaultBoxContract}},
-		OwnSecrets: []compose.OwnSecretRow{{Node: "laptop", Module: client.Module, Name: broker.ProvisionerSecret,
-			Origin: "made", SealedTo: key, Sealed: "SEALED-BY-THE-CONTROLLER"}},
-	}}, client.Module
-}
-
-// 1385 (the lead's answer 1): where the vault is silent and no box is kept, the declaration carries the controller's own seal
-// for the core credential, as ADR 0396 has it, and stands in for nothing. It failed first: the composition's declaration
-// carried the stand-in box, and a send was refused.
-func TestACoreCredentialTheVaultDidNotBoxIsSealedByTheController(t *testing.T) {
-	in, module := aCoreInput(t)
-	d, _, err := compose.ComposeIn(in.Input, "laptop", compose.Foreseeing)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(d.CoreBoxesWanted) != 1 || len(stillForeseen(d)) == 0 {
-		t.Fatalf("the composition does not stand in for the vault's box: %v", d.CoreBoxesWanted)
-	}
-	sealed, _, err := sealedByTheController(in, "laptop", d, []string{module})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if left := stillForeseen(sealed); len(left) != 0 {
-		t.Fatalf("the declaration still stands in for %v", left)
-	}
-	var file map[string]any
-	for _, r := range sealed.Resources {
-		if r["id"] == module+"."+catalogue.NeedID(broker.ProvisionerSecret) {
-			file = r
-		}
-	}
-	if file == nil || file["sealed"] != "SEALED-BY-THE-CONTROLLER" || file[catalogue.VaultSealedField] != nil {
-		t.Fatalf("the core credential is carried as %v: the controller's own seal, not the vault's box", file)
-	}
-	// And a module the vault did answer for is left as it is.
-	other, _, err := sealedByTheController(in, "laptop", d, []string{"another-module"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(stillForeseen(other)) == 0 {
-		t.Fatal("a module the vault answered for was sealed by the controller")
-	}
-}
-
-// 1383 (the lead's answer 4): the machine that runs the bus is refused where no user has a credential, with busUserList's
-// words, and a machine that does not run the bus is not. It failed first: the Input stood a list in and the bus node composed.
-func TestTheMachineThatRunsTheBusIsRefusedWhereNoUserHasACredential(t *testing.T) {
-	bus := catalogue.Manifest{Module: "nats", Version: "1", BusUsers: "/etc/nats/users.conf",
-		Claims: []catalogue.Claim{{Name: "mesh-broker", Scope: catalogue.ScopeMesh}}}
-	other := catalogue.Manifest{Module: "files", Version: "1"}
-	why := errors.New("this machine runs the bus and not one user has a credential, so the composed list would refuse every connection in the mesh")
-	in := &meshInput{busRefused: why, Input: compose.Input{
-		Catalogue: map[string]catalogue.Manifest{"nats": bus, "files": other},
-		Nodes:     []compose.Node{{Name: "anchor", Assigned: []string{"nats"}}, {Name: "laptop", Assigned: []string{"files"}}},
-	}}
-	if err := refusedBus(in, "anchor"); err == nil || !strings.Contains(err.Error(), "not one user has a credential") {
-		t.Fatalf("the machine that runs the bus is not refused: %v", err)
-	}
-	if err := refusedBus(in, "laptop"); err != nil {
-		t.Fatalf("a machine that does not run the bus is refused: %v", err)
-	}
-	if err := refusedBus(&meshInput{Input: in.Input}, "anchor"); err != nil {
-		t.Fatalf("a bus with users is refused: %v", err)
-	}
-}
-
-// The controller's seal replaces the stand-in box whatever path the resource carries: the path is the manifest's with the
-// machine's words filled in, not the manifest's own. It failed first, with the path compared (the live try: "composed twice and
-// still names ... asked of the vault by the next send").
-func TestTheControllersSealReplacesTheBoxWhateverPathTheFileCarries(t *testing.T) {
-	in, module := aCoreInput(t)
-	d, _, err := compose.ComposeIn(in.Input, "laptop", compose.Foreseeing)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, r := range d.Resources {
-		if _, box := r[catalogue.VaultSealedField]; box {
-			r["path"] = "/home/someone/.var/lib/mesh-provisioner-client/broker"
-		}
-	}
-	sealed, _, err := sealedByTheController(in, "laptop", d, []string{module})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if left := stillForeseen(sealed); len(left) != 0 {
-		t.Fatalf("the declaration still stands in for %v", left)
-	}
-}

cmd/mesh-controller/compose_helpers_test.go

@@ -1,33 +0,0 @@
-package main
-
-import (
-	"context"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/compose"
-)
-
-// grantsOf is the grants a provider creates for its consumers, the consumers whose identity overflows the provision's bound
-// and the credentials bound to another consumer, as mesh-sdk's rendering gives them for the machine (it replaced the
-// controller's grantsFor, issue 1389).
-func grantsOf(ctx context.Context, open *stores, node string) ([]catalogue.Grant, []catalogue.Overflow, []catalogue.Unbound, error) {
-	in, err := inputFor(ctx, open)
-	if err != nil {
-		return nil, nil, nil, err
-	}
-	rendered, err := compose.Render(in.Input, node, compose.Reading)
-	if err != nil {
-		return nil, nil, nil, err
-	}
-	return rendered.Rendering.Grants, rendered.Withheld, rendered.Unbound, nil
-}
-
-// madeAndRendered sends to the machine (so everything a send makes is made) and answers its rendering as a question reads it
-// afterwards: what the controller's Allocating rendering was.
-func madeAndRendered(ctx context.Context, open *stores, node string) (catalogue.Rendering, error) {
-	if _, err := composeSend(ctx, open, node); err != nil {
-		return catalogue.Rendering{}, err
-	}
-	forgetInput(ctx)
-	return renderingOf(ctx, open, node)
-}

cmd/mesh-controller/compose_input.go

@@ -1,461 +0,0 @@
-package main
-
-import (
-	"context"
-	"os"
-	"sort"
-	"strings"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/compose"
-	"git.novox.be/novox/mesh-sdk/go/overlay"
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// The controller's adapter from its stores to mesh-sdk's composition input (novox/hq ADR 0453 clause 3, design 47 R4b,
-// issues 1382 and 1383).
-//
-// **The adapter reads, and perform writes.** readComposeInput asks the stores once for everything the composition reads
-// and returns compose.Input, which the composition never changes; it makes, seals, allocates and records nothing. A
-// pair credential, a port, an own secret or a core box that the next send would make is not made here: the composition
-// names it foreseen, and compose_perform.go makes it for a send, then reads the stores again and composes again. A
-// question (status, facts, probes, the merge gate's reading) never performs.
-//
-// **The Input is built once per operation.** A verb that composes every node reads the stores once and hands the Input to
-// each node's composition of it.
-
-// composeInputBuilt is called once for each Input the adapter builds: the seam a test counts the reads of an operation by
-// (issue 1382, criterion 5).
-var composeInputBuilt = func() {}
-
-// readComposeInput reads the stores once and returns what the composition needs. ctx carries what a send keeps (the
-// recorded modules kept at the build their machine runs, recorded_kept.go): the same contexts every send composes under.
-func readComposeInput(ctx context.Context, open *stores) (*meshInput, error) {
-	in, shape, err := readMeshAndNodes(ctx, open)
-	if err != nil {
-		return nil, err
-	}
-	// What each node resolves to, with no credential given (the settings are read before it): the modules whose settings are read, and the
-	// needs whose pair credentials are asked of the stores. Nothing is written by it.
-	unread, err := readSettings(ctx, open, &in)
-	if err != nil {
-		return nil, err
-	}
-	plans := map[string]compose.Resolved{}
-	for _, n := range in.Nodes {
-		if shape.refused[n.Name] != nil {
-			continue // refused for what it keeps: nothing of it is read further
-		}
-		resolved, err := compose.Resolve(in, n.Name)
-		switch {
-		case compose.IsUnresolvable(err):
-			// Their set does not compose: nothing of theirs is read further, as the controller never read a thing for a
-			// node that did not resolve.
-			continue
-		case err != nil:
-			return nil, err
-		}
-		plans[n.Name] = resolved
-	}
-	if err := unreadSettings(unread, plans); err != nil {
-		return nil, err
-	}
-	var busRefused error
-	wouldMake, err := readCredentialsAndBuilds(ctx, open, &in, plans, shape, &busRefused)
-	if err != nil {
-		return nil, err
-	}
-	composeInputBuilt()
-	return &meshInput{Input: in, wouldMake: wouldMake, busRefused: busRefused, refused: shape.refused}, nil
-}
-
-// meshInput is the Input an operation composes over, and the pair credentials its reading found none held for: the ones the
-// next send makes, which perform makes.
-type meshInput struct {
-	compose.Input
-	wouldMake []inventory.PairCredential
-	// busRefused is why the bus's user list cannot be composed (no user has a credential): the machine that runs the bus is
-	// refused with it, as the controller's own composition refused it, and no other machine is.
-	busRefused error
-	// refused is, by node, why that machine alone cannot be composed (nodeRefusal).
-	refused map[string]error
-}
-
-// nodeOf is the node of that name in an Input.
-func nodeOf(in compose.Input, name string) (compose.Node, bool) {
-	for _, n := range in.Nodes {
-		if n.Name == name {
-			return n, true
-		}
-	}
-	return compose.Node{}, false
-}
-
-// inputShape is what the first half of the reading found that the second half needs.
-type inputShape struct {
-	sent    map[string]map[string]string // by node: module to the commit last sent
-	kept    map[string]map[string]string // by node: module to the commit kept
-	current map[string]inventory.CurrentBuild
-	// refused is, by node, why a recorded module cannot be kept at the build the machine runs (keepRecorded's refusal, in
-	// its words): that machine alone is refused with it, as planFor refused it, and nothing else of the mesh is.
-	refused map[string]error
-}
-
-// readMeshAndNodes is the mesh-wide and per-node half of the Input (issue 1382).
-func readMeshAndNodes(ctx context.Context, open *stores) (compose.Input, inputShape, error) {
-	inv := open.inventory
-	var in compose.Input
-	shape := inputShape{sent: map[string]map[string]string{}, kept: map[string]map[string]string{}, refused: map[string]error{}}
-
-	shelf, err := inv.Catalogue(ctx)
-	if err != nil {
-		return in, shape, err
-	}
-	in.Catalogue = shelf
-	if in.Holdings, err = inv.Holdings(ctx); err != nil {
-		return in, shape, err
-	}
-	if in.Licences, err = readLicences(ctx, open); err != nil {
-		return in, shape, err
-	}
-
-	nodes, err := inv.Nodes(ctx)
-	if err != nil {
-		return in, shape, err
-	}
-	places, err := inv.Overlays(ctx)
-	if err != nil {
-		return in, shape, err
-	}
-	placed := map[string]inventory.Overlay{}
-	for _, p := range places {
-		placed[p.Name] = p
-	}
-	if shape.current, err = inv.CurrentBuilds(ctx); err != nil {
-		return in, shape, err
-	}
-
-	// The range the mesh allocates from and what its internal names end in, read from the environment here and nowhere else.
-	in.OverlayCIDR = strings.TrimSpace(os.Getenv(OverlayCIDRVar))
-	in.InternalSuffix = overlay.Suffix()
-	if in.Tunnels, err = readTunnels(ctx, inv); err != nil {
-		return in, shape, err
-	}
-	if in.Adopted, err = readAdopted(ctx, inv); err != nil {
-		return in, shape, err
-	}
-	carried, err := inv.CarriedPeers(ctx)
-	if err != nil {
-		return in, shape, err
-	}
-	for _, c := range carried {
-		in.CarriedPeers = append(in.CarriedPeers, compose.CarriedPeer{
-			PublicKey: c.PublicKey, Address: c.Address, EnrolledAs: c.EnrolledAs, Named: c.Named})
-	}
-	if in.Joining, err = inv.NodesWithALiveToken(ctx); err != nil {
-		return in, shape, err
-	}
-
-	keepsSecrets := false
-	for _, m := range shelf {
-		keepsSecrets = keepsSecrets || m.Keeps != ""
-	}
-
-	for _, n := range nodes {
-		var refusal error
-		node, err := readNode(ctx, open, n, placed[n.Name], &refusal)
-		if err != nil {
-			return in, shape, err
-		}
-		if refusal != nil {
-			shape.refused[n.Name] = refusal
-		}
-		shape.sent[n.Name], shape.kept[n.Name] = node.SentBuilds, node.KeptBuilds
-		in.Nodes = append(in.Nodes, node)
-	}
-	if keepsSecrets {
-		if in.OperatorExport, err = inv.OperatorExport(ctx); err != nil {
-			return in, shape, err
-		}
-	}
-	return in, shape, nil
-}
-
-// readNode is one node of the Input: everything the composition reads about it, in the order the controller read it.
-func readNode(ctx context.Context, open *stores, n inventory.Node, place inventory.Overlay,
-	refused *error) (compose.Node, error) {
-	inv := open.inventory
-	out := compose.Node{
-		Name: n.Name,
-		Place: compose.Place{Key: place.Key, Endpoint: place.Endpoint, Site: place.Site, Hub: place.Hub,
-			Address: place.Address},
-		Account: n.Account, AccountHome: n.AccountHome, AgentAccount: n.AgentAccount, AgentAccountHome: n.AgentAccountHome,
-		Adopted: n.Adopted,
-	}
-	var err error
-	if out.Assigned, err = inv.Assigned(ctx, n.Name); err != nil {
-		return out, err
-	}
-	if out.Capabilities, err = inv.ProfileOf(ctx, n.Name); err != nil {
-		return out, err
-	}
-	if out.PublicDomain, err = inv.PublicDomainOf(ctx, n.Name); err != nil {
-		return out, err
-	}
-	if out.Pins, err = inv.PinsFor(ctx, n.Name); err != nil {
-		return out, err
-	}
-	if out.Bound, err = inv.BindingsFor(ctx, n.Name); err != nil {
-		return out, err
-	}
-	given, err := inv.PortsFor(ctx, n.Name)
-	if err != nil {
-		return out, err
-	}
-	for _, a := range given {
-		if out.Ports == nil {
-			out.Ports = map[string]map[int]int{}
-		}
-		if out.Ports[a.Module] == nil {
-			out.Ports[a.Module] = map[int]int{}
-		}
-		out.Ports[a.Module][a.Wanted] = a.Machine
-	}
-	if out.SealingKey, err = inv.SealingKeyOf(ctx, n.Name); err != nil {
-		return out, err
-	}
-	if n.Adopted {
-		if out.Taken, err = inv.Taken(ctx, n.Name); err != nil {
-			return out, err
-		}
-	}
-	if out.OutwardLinks, err = inv.OutwardLinksOf(ctx, n.Name); err != nil {
-		return out, err
-	}
-	account, had, err := inv.MachineOf(ctx, n.Name)
-	if err != nil {
-		return out, err
-	}
-	if had && account.Machine != nil {
-		out.NetworksSaid = true
-		for _, a := range account.Machine.Networks {
-			out.Networks = append(out.Networks, catalogue.AttachedNetwork{Link: a.Link, Network: a.Network})
-		}
-	}
-	if out.Sequence, err = inv.Sequence(ctx, n.ID); err != nil {
-		return out, err
-	}
-	if out.Epoch, err = inv.SentEpoch(ctx, n.ID); err != nil {
-		return out, err
-	}
-	if out.Generation, err = inv.SentGeneration(ctx, n.ID); err != nil {
-		return out, err
-	}
-	if out.ReadsModules, err = inv.ReadsModules(ctx, n.ID); err != nil {
-		return out, err
-	}
-	if out.SentBuilds, out.SentKnown, err = inv.SentBuilds(ctx, n.Name); err != nil {
-		return out, err
-	}
-	runs, err := inv.AssignmentRuns(ctx, n.Name)
-	if err != nil {
-		return out, err
-	}
-	if len(runs) > 0 {
-		out.Runs = make(map[string]compose.Run, len(runs))
-		for module, ref := range runs {
-			out.Runs[module] = compose.Run{Commit: ref.Commit, Build: ref.Build}
-		}
-	}
-	// A recorded module kept at the build this machine runs, in the context a send composes under (recorded_kept.go): its
-	// manifest and the commit, applied to this node's own resolution only.
-	// What cannot be kept refuses this machine alone (keepRecorded's refusal, as planFor returned it).
-	kept, err := recordedKept(ctx, open, n.Name)
-	if err != nil {
-		*refused = err
-	} else if len(kept) > 0 {
-		out.KeptBuilds = kept
-		if out.Kept, err = keptManifests(ctx, open, n.Name, kept); err != nil {
-			*refused = err
-			out.KeptBuilds, out.Kept = nil, nil
-		}
-	}
-	stated, has, err := inv.HealthOf(ctx, n.Name)
-	if err != nil {
-		return out, err
-	}
-	out.Stated = has
-	if has {
-		out.Contract = stated.Contract
-	}
-	return out, nil
-}
-
-// keptManifests is the manifest of each module kept at the build a machine runs: keepRecorded's reads, and its refusals in its
-// words, without putting any of it into a shelf (that is the node's own Kept, applied by the composition).
-func keptManifests(ctx context.Context, open *stores, node string, kept map[string]string) (map[string]catalogue.Manifest, error) {
-	// applyKept puts each manifest into the shelf it is given and refuses a build that cannot be read; the shelf here is a
-	// scratch one, whose entries are the kept manifests.
-	scratch := map[string]catalogue.Manifest{}
-	if err := applyKept(ctx, open, node, kept, scratch); err != nil {
-		return nil, err
-	}
-	return scratch, nil
-}
-
-func readTunnels(ctx context.Context, inv *inventory.Inventory) (map[string]compose.FoundTunnel, error) {
-	found, err := inv.Tunnels(ctx)
-	if err != nil {
-		return nil, err
-	}
-	if len(found) == 0 {
-		return nil, nil
-	}
-	out := make(map[string]compose.FoundTunnel, len(found))
-	for name, t := range found {
-		out[name] = compose.FoundTunnel{Tunnel: tunnelOf(t.Tunnel), NodeAdopted: t.NodeAdopted}
-	}
-	return out, nil
-}
-
-func readAdopted(ctx context.Context, inv *inventory.Inventory) (*compose.AdoptedTunnel, error) {
-	tunnel, hub, adopted, err := inv.AdoptedTunnel(ctx)
-	if err != nil {
-		return nil, err
-	}
-	if hub == "" {
-		return nil, nil
-	}
-	return &compose.AdoptedTunnel{Tunnel: tunnelOf(tunnel), Hub: hub, Adopted: adopted}, nil
-}
-
-func tunnelOf(t inventory.Tunnel) compose.Tunnel {
-	out := compose.Tunnel{Interface: t.Interface, Unit: t.Unit, Config: t.Config, Port: t.Port, MTU: t.MTU,
-		Address: t.Address, Range: t.Range, PublicKey: t.PublicKey}
-	for _, p := range t.Peers {
-		out.Peers = append(out.Peers, compose.TunnelPeer{PublicKey: p.PublicKey, Address: p.Address})
-	}
-	return out
-}
-
-// readLicences is every licence the mesh holds, with who uses it and the key sealed to each holder: given even where empty,
-// so a holder the mesh holds no key for composes as that, and not as a key that was not asked for.
-func readLicences(ctx context.Context, open *stores) ([]compose.Licence, error) {
-	held, err := open.Licences(ctx)
-	if err != nil {
-		return nil, err
-	}
-	all, err := held.All(ctx)
-	if err != nil {
-		return nil, err
-	}
-	var out []compose.Licence
-	for _, one := range all {
-		l := compose.Licence{Name: one.Name, Serves: one.Serves, Keys: map[compose.Holder]string{}}
-		holders, err := held.HoldersOf(ctx, one.Name)
-		if err != nil {
-			return nil, err
-		}
-		for _, h := range holders {
-			holder := compose.Holder{Node: h.Node, Module: h.Module}
-			l.Holders = append(l.Holders, holder)
-			key, err := held.KeyFor(ctx, one.Name, h.Node, h.Module)
-			if err != nil {
-				return nil, err
-			}
-			l.Keys[holder] = key
-		}
-		node, module, err := held.ManagerOf(ctx, one.Name)
-		if err != nil {
-			return nil, err
-		}
-		l.Manager = compose.Holder{Node: node, Module: module}
-		out = append(out, l)
-	}
-	return out, nil
-}
-
-// readSettings is each node's settings layers for every module that has any (a row, or config in mesh-config), read BEFORE any node is resolved: the first pass
-// resolves a node whose set takes a provider's served facts from the node that runs it, with that node's settings on them
-// (servedOnNode), so a mesh whose provider says ${setting:domain} resolves only with the settings in the Input. A module's
-// settings that fail to read are returned in unread, by node and module, and are an error only for a module a node resolves to
-// (unreadSettings): the controller read none for a module nothing runs.
-func readSettings(ctx context.Context, open *stores, in *compose.Input) (unread map[string]map[string]error, err error) {
-	have, err := open.inventory.ModulesWithSettings(ctx)
-	if err != nil {
-		return nil, err
-	}
-	names, err := modulesToRead(in.Catalogue, have, func(module string) (bool, error) {
-		return open.inventory.ReadsConfig(ctx, module)
-	})
-	if err != nil {
-		return nil, err
-	}
-	for i := range in.Nodes {
-		n := &in.Nodes[i]
-		for _, module := range names {
-			layers, err := open.inventory.SettingsFor(ctx, n.Name, module)
-			if err != nil {
-				if unread == nil {
-					unread = map[string]map[string]error{}
-				}
-				if unread[n.Name] == nil {
-					unread[n.Name] = map[string]error{}
-				}
-				unread[n.Name][module] = err
-				continue
-			}
-			if len(layers) == 0 {
-				continue
-			}
-			if n.Settings == nil {
-				n.Settings = map[string][]catalogue.Layer{}
-			}
-			n.Settings[module] = layers
-		}
-	}
-	return unread, nil
-}
-
-// modulesToRead is the modules on the shelf whose settings are read for a node: those with a settings row, and those in
-// the config form whose values mesh-config holds (readsConfig), which have no row when they were never in the settings
-// form (issue 1493: brother's scanner and printer, set only in mesh-config, composed empty). SettingsFor is where
-// mesh-config's values are laid in, so a gate on the settings table alone leaves them out.
-func modulesToRead(shelf map[string]catalogue.Manifest, have map[string]bool, readsConfig func(string) (bool, error)) ([]string, error) {
-	names := make([]string, 0, len(have))
-	for module, m := range shelf {
-		if have[module] {
-			names = append(names, module)
-			continue
-		}
-		if !m.DeclaresConfig() {
-			continue
-		}
-		reads, err := readsConfig(module)
-		if err != nil {
-			return nil, err
-		}
-		if reads {
-			names = append(names, module)
-		}
-	}
-	sort.Strings(names)
-	return names, nil
-}
-
-// unreadSettings is the error of a module's settings that did not read, for a module the node resolves to.
-func unreadSettings(unread map[string]map[string]error, plans map[string]compose.Resolved) error {
-	names := make([]string, 0, len(plans))
-	for node := range plans {
-		names = append(names, node)
-	}
-	sort.Strings(names)
-	for _, node := range names {
-		for _, m := range plans[node].Plan.Modules {
-			if err := unread[node][m.Module]; err != nil {
-				return err
-			}
-		}
-	}
-	return nil
-}

cmd/mesh-controller/compose_input_credentials.go

@@ -1,285 +0,0 @@
-package main
-
-import (
-	"context"
-	"sort"
-	"strings"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/compose"
-	"git.novox.be/novox/mesh-sdk/go/overlay"
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// The second half of the adapter (issue 1383): the credential and build fields of the Input, read and never made.
-
-// readCredentialsAndBuilds fills what the first half left: the credentials, the own secrets, the vault's boxes, the bus,
-// each node's serving key and certificate, and the builds.
-func readCredentialsAndBuilds(ctx context.Context, open *stores, in *compose.Input, plans map[string]compose.Resolved,
-	shape inputShape, busRefused *error) ([]inventory.PairCredential, error) {
-	if err := readIdentity(ctx, open, in); err != nil {
-		return nil, err
-	}
-	wouldMake, err := readCredentials(ctx, open, in, plans, busRefused)
-	if err != nil {
-		return nil, err
-	}
-	return wouldMake, readBuilds(ctx, open, in, plans, shape)
-}
-
-// readIdentity is the mesh's authority and each node's serving key and the certificate kept for it, for a mesh in which a
-// module asks for a certificate. It establishes and issues nothing: a certificate not kept yet is composed with a stand-in, and
-// issued by the send (certificateFor).
-func readIdentity(ctx context.Context, open *stores, in *compose.Input) error {
-	needs := false
-	for _, m := range in.Catalogue {
-		needs = needs || m.Certificate != nil
-	}
-	if !needs {
-		return nil
-	}
-	ident, err := open.Identity(ctx)
-	if err != nil {
-		return err
-	}
-	if certificate, known, err := ident.KnownAuthority(ctx); err != nil {
-		return err
-	} else if known {
-		in.Authority = certificate
-	}
-	nodes, err := open.inventory.Nodes(ctx)
-	if err != nil {
-		return err
-	}
-	ids := map[string]string{}
-	for _, n := range nodes {
-		ids[n.Name] = n.ID
-	}
-	for i := range in.Nodes {
-		n := &in.Nodes[i]
-		if n.ServingKey, err = ident.ServingKeyOf(ctx, ids[n.Name]); err != nil {
-			return err
-		}
-		if n.ServingKey == "" {
-			continue
-		}
-		if certificate, known, err := ident.KeptCertificate(ctx, overlay.InternalName(n.Name), n.ServingKey); err != nil {
-			return err
-		} else if known {
-			n.Certificate = certificate
-		}
-	}
-	return nil
-}
-
-// readCredentials is how each pair credential a node takes from elsewhere stands, the credentials made for each provider's
-// consumers, the own secrets, the vault's boxes and the bus. It reads and never makes: a credential a send would make is
-// left out (the composition's would-make), a credential only a person gives and nobody gave is not-given, and one the send
-// would be refused is refused with the controller's words.
-func readCredentials(ctx context.Context, open *stores, in *compose.Input, plans map[string]compose.Resolved,
-	busRefused *error) ([]inventory.PairCredential, error) {
-	var wouldMake []inventory.PairCredential
-	inv := open.inventory
-	shelf := in.Catalogue
-	nodeOf := map[string]compose.Node{}
-	for _, n := range in.Nodes {
-		nodeOf[n.Name] = n
-	}
-	names := make([]string, 0, len(plans))
-	for name := range plans {
-		names = append(names, name)
-	}
-	sort.Strings(names)
-	for _, name := range names {
-		resolved := plans[name]
-		nodeShelf := shelfWith(shelf, nodeOf[name].Kept)
-		for _, need := range resolved.Plan.Needs {
-			if need.ByRecord {
-				continue
-			}
-			p := inventory.PairCredential{Name: need.Name, Consumer: name, ConsumerModule: need.For,
-				Provider: need.From, Local: need.Local}
-			if module, outside := issuedOutsideBy(nodeShelf, need); outside {
-				p.Kind, p.ProviderModule = inventory.PairOutside, module
-			} else if need.SharedOwn != "" {
-				p.Kind, p.Own = inventory.PairShared, need.SharedOwn
-				p.ProviderModule = sharedProviderModule(resolved.Plan, shelf, need)
-			}
-			state, err := inv.PairCredentialState(ctx, p)
-			if err != nil {
-				return nil, err
-			}
-			c := compose.Credential{Provision: need.Name, Consumer: name, ConsumerModule: need.For,
-				Provider: need.From, Local: need.Local}
-			switch state.State {
-			case inventory.PairHeld:
-				c.State, c.Sealed = compose.CredentialHeld, state.Sealed
-			case inventory.PairNotGiven:
-				c.State, c.Why = compose.CredentialNotGiven, state.Why
-			case inventory.PairRefused:
-				c.State, c.Why = compose.CredentialRefused, state.Why
-			default:
-				// Left out: a need with no entry is the credential the next send makes, and perform makes it.
-				wouldMake = append(wouldMake, p)
-				continue
-			}
-			in.Credentials = append(in.Credentials, c)
-		}
-	}
-
-	// The credentials made for each provider's consumers, so the grants it must create are read from them.
-	for _, n := range in.Nodes {
-		rows, err := inv.SecretsFrom(ctx, n.Name)
-		if err != nil {
-			return nil, err
-		}
-		for _, s := range rows {
-			in.Issued = append(in.Issued, compose.Issued{Provision: s.Name, Consumer: s.Consumer,
-				ConsumerModule: s.ConsumerModule, Local: s.Local, Provider: n.Name, ForProvider: s.ForProvider})
-		}
-	}
-	own, err := inv.OwnSecretRows(ctx)
-	if err != nil {
-		return nil, err
-	}
-	for _, r := range own {
-		in.OwnSecrets = append(in.OwnSecrets, compose.OwnSecretRow{Node: r.Node, Module: r.Module, Name: r.Name,
-			Origin: r.Origin, SealedTo: r.SealedTo, Sealed: r.Sealed})
-	}
-	for _, n := range in.Nodes {
-		boxes, err := inv.KeptCoreBoxes(ctx, n.Name)
-		if err != nil {
-			return nil, err
-		}
-		for module, byName := range boxes {
-			for name, b := range byName {
-				in.KeptCoreBoxes = append(in.KeptCoreBoxes, compose.CoreBox{Node: n.Name, Module: module, Name: name,
-					Generation: b.Generation, SealedTo: b.SealedTo, Box: b.Box})
-			}
-		}
-	}
-	sort.Slice(in.KeptCoreBoxes, func(i, j int) bool {
-		a, b := in.KeptCoreBoxes[i], in.KeptCoreBoxes[j]
-		if a.Node != b.Node {
-			return a.Node < b.Node
-		}
-		if a.Module != b.Module {
-			return a.Module < b.Module
-		}
-		return a.Name < b.Name
-	})
-
-	// The bus: its user list as the controller composes it, for the machine that runs it, and who the mesh has minted a
-	// credential for.
-	var bus []catalogue.Manifest
-	for _, m := range shelf {
-		if m.BusUsers != "" && m.ClaimsSeat("mesh-broker") {
-			bus = append(bus, m)
-		}
-	}
-	if len(bus) > 0 {
-		list, missing, err := busUserList(ctx, inv, bus)
-		if err != nil && !strings.Contains(err.Error(), "not one user has a credential") {
-			return nil, err
-		}
-		if err != nil {
-			// The machine that runs the bus is refused, as the controller's own composition refused it: a list that
-			// refuses every connection in the mesh is never composed (refusedBus); the other machines compose.
-			*busRefused = err
-		}
-		in.BusUsers, in.BusMissing = list, missing
-	}
-	if in.BusMinted, err = inv.BusMinted(ctx); err != nil {
-		return nil, err
-	}
-	if in.BusMemberships, err = inv.BusMemberships(ctx); err != nil {
-		return nil, err
-	}
-	return wouldMake, nil
-}
-
-// readBuilds is the build half of the Input: every repository the mesh built, each module's current build, and the build made
-// from a commit of a module for the machines whose node-engine reads them.
-func readBuilds(ctx context.Context, open *stores, in *compose.Input, plans map[string]compose.Resolved, shape inputShape) error {
-	inv := open.inventory
-	held, err := inv.Held(ctx)
-	if err != nil {
-		return err
-	}
-	for repository := range held {
-		in.Built = append(in.Built, repository)
-	}
-	sort.Strings(in.Built)
-	in.CurrentBuilds = make(map[string]string, len(shape.current))
-	for module, b := range shape.current {
-		in.CurrentBuilds[module] = b.Commit
-	}
-	// The build made from each commit a declaration may carry, for the machines that read a build per module.
-	for _, n := range in.Nodes {
-		if !n.ReadsModules {
-			continue
-		}
-		resolved, ok := plans[n.Name]
-		if !ok {
-			continue
-		}
-		for _, m := range resolved.Plan.Modules {
-			for _, commit := range []string{shape.current[m.Module].Commit, shape.kept[n.Name][m.Module], shape.sent[n.Name][m.Module]} {
-				if commit == "" {
-					continue
-				}
-				if _, done := in.BuildIDs[m.Module][commit]; done {
-					continue
-				}
-				build, err := inv.BuildOf(ctx, m.Module, commit)
-				if err != nil {
-					return err
-				}
-				if in.BuildIDs == nil {
-					in.BuildIDs = map[string]map[string]string{}
-				}
-				if in.BuildIDs[m.Module] == nil {
-					in.BuildIDs[m.Module] = map[string]string{}
-				}
-				in.BuildIDs[m.Module][commit] = build
-			}
-		}
-	}
-	return nil
-}
-
-// shelfWith is the shelf with each module a node keeps at the build it runs put in place of the current one: a copy.
-func shelfWith(shelf map[string]catalogue.Manifest, kept map[string]catalogue.Manifest) map[string]catalogue.Manifest {
-	if len(kept) == 0 {
-		return shelf
-	}
-	out := make(map[string]catalogue.Manifest, len(shelf)+len(kept))
-	for name, m := range shelf {
-		out[name] = m
-	}
-	for name, m := range kept {
-		out[name] = m
-	}
-	return out
-}
-
-// sharedProviderModule is which module answers a shared credential on the providing node: the one in the plan, else the first
-// the catalogue names (providerModuleOf, in an order that does not move between calls).
-func sharedProviderModule(plan catalogue.Resolution, shelf map[string]catalogue.Manifest, n catalogue.Needed) string {
-	for _, m := range plan.Modules {
-		if _, shared := m.SharedCredentialOf(n.Name); shared {
-			return m.Module
-		}
-	}
-	names := make([]string, 0, len(shelf))
-	for name := range shelf {
-		names = append(names, name)
-	}
-	sort.Strings(names)
-	for _, name := range names {
-		if _, shared := shelf[name].SharedCredentialOf(n.Name); shared {
-			return name
-		}
-	}
-	return ""
-}

cmd/mesh-controller/compose_input_credentials_integration_test.go

@@ -1,354 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"encoding/json"
-	"fmt"
-	"sort"
-	"strings"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/compose"
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// tableState is every table's rows and every sequence's last value, as the adapter's reads must leave them.
-func tableState(t *testing.T, inv *inventory.Inventory) map[string]string {
-	t.Helper()
-	out := map[string]string{}
-	for _, row := range inv.QueryForTest(t, `select table_name from information_schema.tables
-		where table_schema = 'public' and table_type = 'BASE TABLE' order by table_name`) {
-		name := strings.Trim(row[0], `"`)
-		count := inv.QueryForTest(t, fmt.Sprintf(`select count(*)::text from %q`, name))
-		out["rows:"+name] = fmt.Sprint(count)
-		digest := inv.QueryForTest(t, fmt.Sprintf(`select coalesce(md5(string_agg(t::text, '|' order by t::text)), '') from %q t`, name))
-		out["content:"+name] = fmt.Sprint(digest)
-	}
-	for _, row := range inv.QueryForTest(t, `select sequencename, coalesce(last_value::text, '') from pg_sequences
-		where schemaname = 'public' order by sequencename`) {
-		out["sequence:"+row[0]] = row[1]
-	}
-	return out
-}
-
-// 1382/AC4 and 1383/AC6: building the Input writes nothing. The store's rows, their contents and its sequences are the same
-// before and after, on a mesh whose credentials are not made, whose ports are not given and which keeps a recorded build.
-func TestBuildingTheInputWritesNothing(t *testing.T) {
-	open, _ := aMeshWithSecrets(t)
-	ctx := t.Context()
-	inv := open.inventory
-	// A consumer whose credential nothing has made yet, on a mesh that already composed.
-	register(t, open, catalogue.Manifest{Module: "reports", Version: "1", Requires: []string{"s3-bucket"},
-		Resources: []map[string]any{{"id": "config", "type": "file", "path": "/etc/reports/config.json", "mode": "0600",
-			"content": "{}", "merge": "json"}}})
-	if _, err := inv.Assign(ctx, "laptop", "reports"); err != nil {
-		t.Fatal(err)
-	}
-	before := tableState(t, inv)
-	if _, err := readComposeInput(ctx, open); err != nil {
-		t.Fatal(err)
-	}
-	after := tableState(t, inv)
-	var moved []string
-	for k, v := range after {
-		if before[k] != v {
-			moved = append(moved, k)
-		}
-	}
-	sort.Strings(moved)
-	if len(moved) > 0 {
-		t.Fatalf("building the Input wrote: %v", moved)
-	}
-}
-
-// a consumer of the s3-bucket aMeshWithSecrets' provider offers, with a file the credential goes into.
-func aConsumerOfTheBucket(name string) catalogue.Manifest {
-	return catalogue.Manifest{Module: name, Version: "1", Requires: []string{"s3-bucket"},
-		Secrets: map[string]string{"s3-bucket": "/etc/" + name + "/s3"},
-		Resources: []map[string]any{{"id": "config", "type": "file", "path": "/etc/" + name + "/config.json", "mode": "0600",
-			"content": "{}", "merge": "json"}}}
-}
-
-// 1383/AC1: of a provider's three consumers, two have their credentials made and one has not: Issued holds the two rows, with
-// the copy sealed to the provider, the third is a credential the next send makes, and no row was inserted for it (planFor
-// inserted it, plan.go: SecretFor in every mode).
-func TestAPairCredentialNoRowHoldsIsAWouldMakeAndNoRowIsInserted(t *testing.T) {
-	open, _ := aMeshWithSecrets(t)
-	ctx := t.Context()
-	inv := open.inventory
-	register(t, open, aConsumerOfTheBucket("reports"))
-	if _, err := inv.Assign(ctx, "laptop", "reports"); err != nil {
-		t.Fatal(err)
-	}
-	// A send makes the credentials of files and reports; a question makes none.
-	if _, err := composeSend(ctx, open, "laptop"); err != nil {
-		t.Fatal(err)
-	}
-	register(t, open, aConsumerOfTheBucket("metrics"))
-	if _, err := inv.Assign(ctx, "laptop", "metrics"); err != nil {
-		t.Fatal(err)
-	}
-	before := tableState(t, inv)
-	in, err := readComposeInput(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var rows []compose.Issued
-	for _, r := range in.Issued {
-		if r.Provider == "anchor" && r.Provision == "s3-bucket" {
-			rows = append(rows, r)
-			if r.ForProvider == "" {
-				t.Errorf("the row of %s carries no copy sealed to the provider", r.ConsumerModule)
-			}
-		}
-	}
-	if len(rows) != 2 {
-		t.Fatalf("Issued holds %d row(s) for anchor's s3-bucket, want files and reports: %+v", len(rows), rows)
-	}
-	var would []string
-	for _, p := range in.wouldMake {
-		would = append(would, p.ConsumerModule)
-	}
-	if len(would) != 1 || would[0] != "metrics" {
-		t.Fatalf("the credentials the next send makes are %v, want metrics", would)
-	}
-	for _, c := range in.Credentials {
-		if c.ConsumerModule == "metrics" {
-			t.Errorf("a credential nobody holds has an entry: %+v", c)
-		}
-	}
-	after := tableState(t, inv)
-	for k, v := range after {
-		if before[k] != v {
-			t.Errorf("reading the Input moved %s", k)
-		}
-	}
-}
-
-// 1383/AC2: a credential only a person gives that nobody gave is not given, and so is one given under a key the machine no
-// longer has; a credential given by a person for the pair and sealed to a key one end no longer has is refused: in the words
-// plan.go and secrets.go use.
-func TestACredentialOnlyAPersonGivesIsNotGivenAndAGivenOneUnderAnOldKeyIsSaidSo(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	inv := open.inventory
-	register(t, open, catalogue.Manifest{Module: "indexers", Version: "1", Provides: []catalogue.Offer{{
-		Name: "indexer-api", Scope: catalogue.ScopeMesh, Credential: &catalogue.OfferCredential{IssuedBy: catalogue.IssuedOutside}}}})
-	register(t, open, catalogue.Manifest{Module: "grabber", Version: "1", Requires: []string{"indexer-api"},
-		Secrets: map[string]string{"indexer-api": "/etc/grabber/key"}})
-	register(t, open, aConsumerOfTheBucket("ledger"))
-	register(t, open, catalogue.Manifest{Module: "objects", Version: "1", Provides: catalogue.FromAnywhere("s3-bucket")})
-	for _, a := range [][2]string{{"anchor", "indexers"}, {"laptop", "grabber"}, {"anchor", "objects"}, {"laptop", "ledger"}} {
-		if _, err := inv.Assign(ctx, a[0], a[1]); err != nil {
-			t.Fatalf("assign %s %s: %v", a[0], a[1], err)
-		}
-	}
-	stateOf := func(provision, consumerModule string) (compose.Credential, bool) {
-		in, err := readComposeInput(ctx, open)
-		if err != nil {
-			t.Fatal(err)
-		}
-		for _, c := range in.Credentials {
-			if c.Provision == provision && c.ConsumerModule == consumerModule {
-				return c, true
-			}
-		}
-		return compose.Credential{}, false
-	}
-
-	c, found := stateOf("indexer-api", "grabber")
-	if !found || c.State != compose.CredentialNotGiven || !strings.Contains(c.Why, "nobody gave it") {
-		t.Fatalf("a credential nobody gave reads as %+v", c)
-	}
-	if err := inv.AcceptSecretForPair(ctx, "indexer-api", "laptop", "grabber", "anchor", "", "the-key"); err != nil {
-		t.Fatal(err)
-	}
-	if c, found := stateOf("indexer-api", "grabber"); !found || c.State != compose.CredentialHeld || c.Sealed == "" {
-		t.Fatalf("a credential a person gave reads as %+v", c)
-	}
-	// The consumer's machine generated a key of its own since.
-	if err := inv.RecordSealingKey(ctx, nodeID(t, open, "laptop"), aPublicKey(t)); err != nil {
-		t.Fatal(err)
-	}
-	if c, found := stateOf("indexer-api", "grabber"); !found || c.State != compose.CredentialNotGiven ||
-		!strings.Contains(c.Why, "a sealing key one end no longer has") {
-		t.Fatalf("a credential given under a key the machine no longer has reads as %+v", c)
-	}
-
-	// A credential for a pair, given by a person, under a key one end has since replaced: the mesh cannot make another.
-	if err := inv.RecordSealingKey(ctx, nodeID(t, open, "laptop"), aPublicKey(t)); err != nil {
-		t.Fatal(err)
-	}
-	if err := inv.AcceptSecretForPair(ctx, "s3-bucket", "laptop", "ledger", "anchor", "", "the-bucket-key"); err != nil {
-		t.Fatal(err)
-	}
-	if err := inv.RecordSealingKey(ctx, nodeID(t, open, "laptop"), aPublicKey(t)); err != nil {
-		t.Fatal(err)
-	}
-	if c, found := stateOf("s3-bucket", "ledger"); !found || c.State != compose.CredentialRefused ||
-		!strings.Contains(c.Why, "was accepted from a person, and a sealing key at one end has changed since") {
-		t.Fatalf("a credential given for the pair under an old key reads as %+v", c)
-	}
-}
-
-// 1383/AC3: the own secrets carry their origin, the key they are sealed to and the sealed value; the vault's kept boxes, the
-// licences (with their keys given, so an empty key means the mesh holds none), the users the bus has minted and the
-// memberships equal what the inventory answers.
-func TestTheAdaptersInputCarriesTheOwnSecretsTheBoxesTheLicencesAndTheBus(t *testing.T) {
-	open, _ := aMeshWithSecrets(t)
-	ctx := t.Context()
-	inv := open.inventory
-	key, err := inv.SealingKeyOf(ctx, "anchor")
-	if err != nil {
-		t.Fatal(err)
-	}
-	sealed, err := inv.SecretForModule(ctx, "anchor", "objects", "admin")
-	if err != nil {
-		t.Fatal(err)
-	}
-	box := json.RawMessage(`{"v":1,"eph":"e","iv":"i","tag":"t","ct":"c"}`)
-	if err := inv.KeepCoreBox(ctx, "anchor", inventory.CoreBox{Module: "objects", Name: "admin", Generation: 4,
-		SealedTo: key, Box: box}); err != nil {
-		t.Fatal(err)
-	}
-	if err := inv.SeedBusUser(ctx, inventory.BusUser{Username: "anchor.objects", Kind: "module", Node: "anchor",
-		Module: "objects"}, "a-password"); err != nil {
-		t.Fatal(err)
-	}
-	if err := inv.PutBusMembership(ctx, "laptop", "sealed-membership"); err != nil {
-		t.Fatal(err)
-	}
-	held, err := open.Licences(ctx)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := held.Add(ctx, "claude", "static", map[string]any{"model": "x"}); err != nil {
-		t.Fatal(err)
-	}
-
-	in, err := readComposeInput(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var own *compose.OwnSecretRow
-	for i := range in.OwnSecrets {
-		if r := &in.OwnSecrets[i]; r.Node == "anchor" && r.Module == "objects" && r.Name == "admin" {
-			own = r
-		}
-	}
-	if own == nil || own.Origin != "made" || own.SealedTo != key || own.Sealed != sealed {
-		t.Errorf("the own secret reads as %+v; the inventory holds %q sealed to %q", own, sealed, key)
-	}
-	var kept *compose.CoreBox
-	for i := range in.KeptCoreBoxes {
-		if b := &in.KeptCoreBoxes[i]; b.Node == "anchor" && b.Module == "objects" && b.Name == "admin" {
-			kept = b
-		}
-	}
-	if kept == nil || kept.Generation != 4 || kept.SealedTo != key || string(kept.Box) != string(box) {
-		t.Errorf("the kept box reads as %+v", kept)
-	}
-	if got := strings.Join(in.BusMinted, ","); !strings.Contains(got, "anchor.objects") {
-		t.Errorf("BusMinted is %v", in.BusMinted)
-	}
-	if in.BusMemberships["laptop"] != "sealed-membership" {
-		t.Errorf("BusMemberships is %v", in.BusMemberships)
-	}
-	if len(in.Licences) != 1 || in.Licences[0].Name != "claude" || in.Licences[0].Keys == nil {
-		t.Errorf("Licences read as %+v", in.Licences)
-	}
-}
-
-// 1383/AC4: the bus's user list is what busUserList gives for the machine that runs the bus, and the Input carries none when
-// no module of the shelf runs the bus.
-func TestTheBusUsersAreWhatTheControllerComposesForTheMachineThatRunsTheBus(t *testing.T) {
-	open, _ := aMeshWithSecrets(t)
-	ctx := t.Context()
-	in, err := readComposeInput(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if in.BusUsers != "" || len(in.BusMissing) != 0 {
-		t.Fatalf("a mesh whose shelf runs no bus carries a bus user list: %q %v", in.BusUsers, in.BusMissing)
-	}
-	bus := catalogue.Manifest{Module: "nats", Version: "1", BusUsers: "/etc/nats/users.conf",
-		Claims: []catalogue.Claim{{Name: "mesh-broker", Scope: catalogue.ScopeMesh}}}
-	register(t, open, bus)
-	if err := open.inventory.SeedBusUser(ctx, inventory.BusUser{Username: "controller", Kind: "controller"}, "pw"); err != nil {
-		t.Fatal(err)
-	}
-	in, err = readComposeInput(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
-	list, missing, _ := busUserList(ctx, open.inventory, []catalogue.Manifest{bus})
-	if in.BusUsers != list || fmt.Sprint(in.BusMissing) != fmt.Sprint(missing) {
-		t.Errorf("the Input carries %q (%v); busUserList gives %q (%v)", in.BusUsers, in.BusMissing, list, missing)
-	}
-}
-
-// 1383/AC5: Built, CurrentBuilds and BuildIDs equal the inventory's Held, CurrentBuilds and BuildOf, and the serving key and
-// the certificate are the machine's.
-func TestTheAdaptersInputCarriesTheBuildsAndTheMachinesKey(t *testing.T) {
-	open, _ := aMeshWithSecrets(t)
-	ctx := t.Context()
-	inv := open.inventory
-	in, err := readComposeInput(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
-	held, err := inv.Held(ctx)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var wantBuilt []string
-	for repository := range held {
-		wantBuilt = append(wantBuilt, repository)
-	}
-	sort.Strings(wantBuilt)
-	if fmt.Sprint(in.Built) != fmt.Sprint(wantBuilt) && !(len(in.Built) == 0 && len(wantBuilt) == 0) {
-		t.Errorf("Built is %v, the inventory's %v", in.Built, wantBuilt)
-	}
-	current, err := inv.CurrentBuilds(ctx)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for module, b := range current {
-		if in.CurrentBuilds[module] != b.Commit {
-			t.Errorf("CurrentBuilds[%s] is %q, the inventory's %q", module, in.CurrentBuilds[module], b.Commit)
-		}
-	}
-	for module, byCommit := range in.BuildIDs {
-		for commit, build := range byCommit {
-			if want, _ := inv.BuildOf(ctx, module, commit); want != build {
-				t.Errorf("BuildIDs[%s][%s] is %q, the inventory's %q", module, commit, build, want)
-			}
-		}
-	}
-}
-
-// The lead's answer 4: where the mesh holds no credential for any bus user, the machine that runs the bus is refused with
-// busUserList's words (the controller's composition refused it), the Input still builds, and another machine composes.
-func TestTheBusMachineIsRefusedWhereNoUserHasACredentialAndTheOthersCompose(t *testing.T) {
-	open, _ := aMeshWithSecrets(t)
-	ctx := t.Context()
-	bus := catalogue.Manifest{Module: "nats", Version: "1", BusUsers: "/etc/nats/users.conf",
-		Claims: []catalogue.Claim{{Name: "mesh-broker", Scope: catalogue.ScopeMesh}}}
-	register(t, open, bus)
-	register(t, open, aWebModule())
-	if _, err := assign(ctx, open, "anchor", "nats"); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := assign(ctx, open, "laptop", "web"); err != nil {
-		t.Fatal(err)
-	}
-	if _, _, err := composeQuestion(ctx, open, "anchor", compose.Foreseeing, false); err == nil ||
-		!strings.Contains(err.Error(), "not one user has a credential") {
-		t.Fatalf("the bus machine is composed: %v", err)
-	}
-	if _, _, err := composeQuestion(ctx, open, "laptop", compose.Foreseeing, false); err != nil {
-		t.Fatalf("a machine that does not run the bus is refused: %v", err)
-	}
-}

cmd/mesh-controller/compose_input_integration_test.go

@@ -1,329 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"reflect"
-	"strings"
-	"testing"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/compose"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// 1382: the adapter's Input names, for every node, what the inventory answers for it, each compared with the read named
-// beside the field in go/compose/input.go (novox/hq ADR 0453 clause 3).
-func TestTheAdaptersInputNamesWhatTheInventoryAnswersForEachNode(t *testing.T) {
-	open, _ := aMeshWithSecrets(t)
-	ctx := t.Context()
-	inv := open.inventory
-	if err := inv.SetPublicDomain(ctx, "anchor", "example.test"); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := inv.PortFor(ctx, "laptop", "files", 8080, false); err != nil {
-		t.Fatal(err)
-	}
-	in, err := readComposeInput(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	shelf, err := inv.Catalogue(ctx)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !reflect.DeepEqual(in.Catalogue, shelf) {
-		t.Error("the Input's Catalogue is not the shelf the inventory holds")
-	}
-	nodes, err := inv.Nodes(ctx)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(in.Nodes) != len(nodes) {
-		t.Fatalf("the Input names %d node(s), the inventory has %d", len(in.Nodes), len(nodes))
-	}
-	places, err := inv.Overlays(ctx)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, record := range nodes {
-		n, ok := nodeOf(in.Input, record.Name)
-		if !ok {
-			t.Fatalf("%s is not in the Input", record.Name)
-		}
-		for _, p := range places {
-			if p.Name == record.Name {
-				if want := (compose.Place{Key: p.Key, Endpoint: p.Endpoint, Site: p.Site, Hub: p.Hub, Address: p.Address}); n.Place != want {
-					t.Errorf("%s: Place is %+v, the inventory's %+v", record.Name, n.Place, want)
-				}
-			}
-		}
-		assigned, _ := inv.Assigned(ctx, record.Name)
-		if !reflect.DeepEqual(n.Assigned, assigned) {
-			t.Errorf("%s: Assigned is %v, the inventory's %v", record.Name, n.Assigned, assigned)
-		}
-		caps, _ := inv.ProfileOf(ctx, record.Name)
-		if !reflect.DeepEqual(n.Capabilities, caps) {
-			t.Errorf("%s: Capabilities are %v, the inventory's %v", record.Name, n.Capabilities, caps)
-		}
-		domain, _ := inv.PublicDomainOf(ctx, record.Name)
-		if n.PublicDomain != domain {
-			t.Errorf("%s: PublicDomain is %q, the inventory's %q", record.Name, n.PublicDomain, domain)
-		}
-		if n.Account != record.Account || n.AccountHome != record.AccountHome || n.AgentAccount != record.AgentAccount ||
-			n.AgentAccountHome != record.AgentAccountHome || n.Adopted != record.Adopted {
-			t.Errorf("%s: the accounts or the mode differ from the inventory's: %+v", record.Name, n)
-		}
-		pins, _ := inv.PinsFor(ctx, record.Name)
-		if len(pins) != len(n.Pins) || (len(pins) > 0 && !reflect.DeepEqual(n.Pins, pins)) {
-			t.Errorf("%s: Pins are %v, the inventory's %v", record.Name, n.Pins, pins)
-		}
-		bound, _ := inv.BindingsFor(ctx, record.Name)
-		if len(bound) != len(n.Bound) || (len(bound) > 0 && !reflect.DeepEqual(n.Bound, bound)) {
-			t.Errorf("%s: Bound is %v, the inventory's %v", record.Name, n.Bound, bound)
-		}
-		key, _ := inv.SealingKeyOf(ctx, record.Name)
-		if n.SealingKey != key {
-			t.Errorf("%s: SealingKey is %q, the inventory's %q", record.Name, n.SealingKey, key)
-		}
-		ports, _ := inv.PortsFor(ctx, record.Name)
-		want := map[string]map[int]int{}
-		for _, a := range ports {
-			if want[a.Module] == nil {
-				want[a.Module] = map[int]int{}
-			}
-			want[a.Module][a.Wanted] = a.Machine
-		}
-		if len(want) != len(n.Ports) || (len(want) > 0 && !reflect.DeepEqual(n.Ports, want)) {
-			t.Errorf("%s: Ports are %v, the inventory's %v", record.Name, n.Ports, want)
-		}
-		// The settings of every module it resolves to, layer for layer.
-		resolved, err := compose.Resolve(in.Input, record.Name)
-		if err != nil {
-			continue
-		}
-		for _, m := range resolved.Plan.Modules {
-			layers, err := inv.SettingsFor(ctx, record.Name, m.Module)
-			if err != nil {
-				t.Fatal(err)
-			}
-			if len(layers) != len(n.Settings[m.Module]) || (len(layers) > 0 && !reflect.DeepEqual(n.Settings[m.Module], layers)) {
-				t.Errorf("%s: the settings of %s are %v, the inventory's %v", record.Name, m.Module, n.Settings[m.Module], layers)
-			}
-		}
-	}
-	if domain := nodeDomain(in.Input, "anchor"); domain != "example.test" {
-		t.Errorf("anchor's PublicDomain is %q", domain)
-	}
-	if got := nodePorts(in.Input, "laptop"); got["files"][8080] == 0 {
-		t.Errorf("laptop's port for files:8080 is not in the Input: %v", got)
-	}
-}
-
-func nodeDomain(in compose.Input, name string) string {
-	n, _ := nodeOf(in, name)
-	return n.PublicDomain
-}
-
-func nodePorts(in compose.Input, name string) map[string]map[int]int {
-	n, _ := nodeOf(in, name)
-	return n.Ports
-}
-
-// 1382/AC2: a node keeping a recorded module at the build it runs has that module in Kept and KeptBuilds, and the Input's
-// Catalogue is the current shelf, not the kept manifest (R4a review round 1, finding 1).
-func TestANodeKeepingARecordedBuildHasItInKeptAndTheCatalogueStaysCurrent(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	inv := open.inventory
-	start := time.Now().Add(-time.Hour)
-	image := "registry.invalid:5000/postgres/server@sha256:" + strings.Repeat("a", 64)
-	for _, b := range []link.BuildResult{
-		aContainerBuild(t, "postgres", "c1111111", catalogue.PolicyRecord, start, map[string][2]string{"server": {image, ""}}),
-	} {
-		if _, _, err := takeIn(ctx, inv, asTheOperator(t, inv, b)); err != nil {
-			t.Fatal(err)
-		}
-	}
-	if _, err := inv.Assign(ctx, "anchor", "postgres"); err != nil {
-		t.Fatal(err)
-	}
-	if err := inv.RecordSent(ctx, nodeID(t, open, "anchor"), "d-anchor", map[string]string{"postgres": "c1111111"}); err != nil {
-		t.Fatal(err)
-	}
-	if _, _, err := takeIn(ctx, inv, aContainerBuild(t, "postgres", "c2222222", catalogue.PolicyRecord, start.Add(time.Minute),
-		map[string][2]string{"server": {image, "runtime"}})); err != nil {
-		t.Fatal(err)
-	}
-
-	// A send that is not a person's push keeps the build the machine runs.
-	in, err := readComposeInput(keepingRecorded(ctx), open)
-	if err != nil {
-		t.Fatal(err)
-	}
-	anchor, _ := nodeOf(in.Input, "anchor")
-	if anchor.KeptBuilds["postgres"] != "c1111111" {
-		t.Fatalf("anchor keeps %v, want postgres at c1111111", anchor.KeptBuilds)
-	}
-	kept, found := anchor.Kept["postgres"]
-	if !found {
-		t.Fatalf("the kept manifest of postgres is not in anchor's Kept: %v", anchor.Kept)
-	}
-	current, err := inv.Catalogue(ctx)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !reflect.DeepEqual(in.Catalogue["postgres"], current["postgres"]) {
-		t.Error("the Input's Catalogue is not the current shelf")
-	}
-	if reflect.DeepEqual(kept, current["postgres"]) {
-		t.Error("the kept manifest is the current one: nothing is kept")
-	}
-	if laptop, _ := nodeOf(in.Input, "laptop"); len(laptop.Kept) != 0 || len(laptop.KeptBuilds) != 0 {
-		t.Errorf("laptop keeps what only anchor runs: %v", laptop.KeptBuilds)
-	}
-
-	// A person's push keeps nothing.
-	pushed, err := readComposeInput(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if a, _ := nodeOf(pushed.Input, "anchor"); len(a.Kept) != 0 || len(a.KeptBuilds) != 0 {
-		t.Errorf("a person's push keeps %v", a.KeptBuilds)
-	}
-}
-
-// 1382/AC3: the seats on record, the tunnels, the adopted tunnel, its carried peers and the nodes joining equal the
-// inventory's answers; the range and the suffix are read from the environment once, here.
-func TestTheAdaptersInputCarriesTheNetworkAsTheInventoryHoldsIt(t *testing.T) {
-	open, _ := aMeshWithSecrets(t)
-	ctx := t.Context()
-	inv := open.inventory
-	t.Setenv(OverlayCIDRVar, "10.99.0.0/16")
-	t.Setenv("MESH_INTERNAL_SUFFIX", "mesh.test")
-	in, err := readComposeInput(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
-	holdings, err := inv.Holdings(ctx)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !reflect.DeepEqual(in.Holdings, holdings) {
-		t.Errorf("Holdings are %v, the inventory's %v", in.Holdings, holdings)
-	}
-	tunnels, err := inv.Tunnels(ctx)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(tunnels) != len(in.Tunnels) {
-		t.Errorf("Tunnels are %v, the inventory's %v", in.Tunnels, tunnels)
-	}
-	if _, hub, _, err := inv.AdoptedTunnel(ctx); err != nil {
-		t.Fatal(err)
-	} else if (hub == "") != (in.Adopted == nil) {
-		t.Errorf("Adopted is %v, the inventory's hub is %q", in.Adopted, hub)
-	}
-	carried, err := inv.CarriedPeers(ctx)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(carried) != len(in.CarriedPeers) {
-		t.Errorf("CarriedPeers are %v, the inventory's %v", in.CarriedPeers, carried)
-	}
-	joining, err := inv.NodesWithALiveToken(ctx)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(joining) != len(in.Joining) {
-		t.Errorf("Joining is %v, the inventory's %v", in.Joining, joining)
-	}
-	if in.OverlayCIDR != "10.99.0.0/16" || in.InternalSuffix != "mesh.test" {
-		t.Errorf("the range and the suffix are %q and %q", in.OverlayCIDR, in.InternalSuffix)
-	}
-	// Read once: what the environment says afterwards moves nothing already read.
-	t.Setenv(OverlayCIDRVar, "10.1.0.0/16")
-	if in.OverlayCIDR != "10.99.0.0/16" {
-		t.Error("the range moved with the environment")
-	}
-}
-
-// The lead's equality finding (build 1792487777757012513): a provider on one machine serves a fact that says ${setting:domain},
-// the setting is set for it, and a consumer on another machine takes that fact. The first pass of the adapter resolved every
-// node with no settings in the Input, so the served fact could not be settled and the whole Input failed. The settings are in
-// the Input before any node is resolved, and the Input builds, with the same plan for the consumer as the controller's own
-// composition. It failed first, with the finding's words.
-func TestAServedFactThatSaysASettingIsResolvedWithTheSettingInTheInput(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	register(t, open, catalogue.Manifest{Module: "step-ca", Version: "1",
-		Provides: []catalogue.Offer{{Name: "acme-ca", Scope: catalogue.ScopeMesh}},
-		Serves:   map[string]map[string]any{"acme-ca": {"domain": "${setting:domain}"}}})
-	register(t, open, catalogue.Manifest{Module: "route-proxy", Version: "1", Requires: []string{"acme-ca"}})
-	// The setting is there before the machines are assigned: an assignment resolves the mesh, and a served fact that says
-	// ${setting:domain} resolves only with it.
-	if err := open.inventory.KeepSettings(ctx, "", "step-ca", map[string]any{"domain": "example.test"}); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := assign(ctx, open, "anchor", "step-ca"); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := assign(ctx, open, "laptop", "route-proxy"); err != nil {
-		t.Fatal(err)
-	}
-	in, err := readComposeInput(ctx, open)
-	if err != nil {
-		t.Fatalf("the Input cannot be built: %v", err)
-	}
-	if anchor, _ := nodeOf(in.Input, "anchor"); len(anchor.Settings["step-ca"]) == 0 {
-		t.Fatalf("the Input does not carry the setting of the provider: %v", anchor.Settings)
-	}
-	oldPlan, _, err := resolveNode(ctx, open, "laptop")
-	if err != nil {
-		t.Fatal(err)
-	}
-	newPlan, _, err := resolveNode(withInputCache(ctx), open, "laptop")
-	if err != nil {
-		t.Fatalf("the consumer does not resolve: %v", err)
-	}
-	if !reflect.DeepEqual(oldPlan.Needs, newPlan.Needs) {
-		t.Errorf("the consumer's needs are %+v, the controller's own %+v", newPlan.Needs, oldPlan.Needs)
-	}
-	t.Logf("a served fact that says a setting resolves with the setting in the Input: the Input builds and the consumer's needs equal planFor's")
-}
-
-// A setting that nothing sets, in a fact a provider serves, is not the adapter's to hide: the controller's own composition
-// refuses it as well (theRestOfTheMesh returns servedOnNode's error), and the adapter refuses with the same words rather than
-// building an Input that composes a placeholder.
-func TestAServedFactThatSaysAnUnsetSettingIsRefusedAsTheControllerRefusesIt(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	register(t, open, catalogue.Manifest{Module: "step-ca", Version: "1",
-		Provides: []catalogue.Offer{{Name: "acme-ca", Scope: catalogue.ScopeMesh}},
-		Serves:   map[string]map[string]any{"acme-ca": {"domain": "${setting:domain}"}}})
-	register(t, open, catalogue.Manifest{Module: "route-proxy", Version: "1", Requires: []string{"acme-ca"}})
-	// Assigned with the setting there, then the setting is cleared: the mesh the controller holds when someone clears it.
-	if err := open.inventory.KeepSettings(ctx, "", "step-ca", map[string]any{"domain": "example.test"}); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := assign(ctx, open, "anchor", "step-ca"); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := assign(ctx, open, "laptop", "route-proxy"); err != nil {
-		t.Fatal(err)
-	}
-	if err := open.inventory.ClearSettings(ctx, "", "step-ca"); err != nil {
-		t.Fatal(err)
-	}
-	_, _, oldErr := resolveNode(ctx, open, "laptop")
-	_, newErr := readComposeInput(ctx, open)
-	if (oldErr == nil) != (newErr == nil) {
-		t.Fatalf("the controller's composition says %v, the adapter says %v", oldErr, newErr)
-	}
-	if oldErr != nil && !strings.Contains(newErr.Error(), "nothing sets \"domain\"") {
-		t.Errorf("the adapter's words are %q, the controller's %q", newErr, oldErr)
-	}
-	t.Logf("an unset setting in a served fact is refused alike: the controller says %v, the adapter says %v", oldErr != nil, newErr != nil)
-}

cmd/mesh-controller/compose_input_settings_integration_test.go

@@ -1,45 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"context"
-	"testing"
-)
-
-// Issue 1493: a module in the config form whose value is set only in mesh-config, with no settings row, reaches the
-// node's settings in the composition's input.
-func TestAConfigModuleWithoutASettingsRowIsReadFromConfig(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	inv := open.inventory
-	register(t, open, configForm(t, "brother"))
-	if _, err := assign(ctx, open, "anchor", "brother"); err != nil {
-		t.Fatal(err)
-	}
-	inv.ExecForTest(t, `insert into config_move (moved_by, why) values ('a test', 'issue 1493')`)
-	inv.ReadsConfigFrom(func(_ context.Context, node, module string) (map[string]any, error) {
-		if node == "anchor" && module == "brother" {
-			return map[string]any{"level": "debug"}, nil
-		}
-		return nil, nil
-	})
-	in, _, err := readMeshAndNodes(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := readSettings(ctx, open, &in); err != nil {
-		t.Fatal(err)
-	}
-	for _, n := range in.Nodes {
-		if n.Name != "anchor" {
-			continue
-		}
-		layers := n.Settings["brother"]
-		if len(layers) != 1 || layers[0].Values["level"] != "debug" {
-			t.Fatalf("anchor's settings for brother are %+v, want level debug from mesh-config", layers)
-		}
-		return
-	}
-	t.Fatal("no anchor node in the input")
-}

cmd/mesh-controller/compose_input_settings_test.go

@@ -1,45 +0,0 @@
-package main
-
-import (
-	"errors"
-	"reflect"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-)
-
-// configForm is a module in the config form, shaped as a real one (inventory's config_move_test).
-func configForm(t *testing.T, name string) catalogue.Manifest {
-	t.Helper()
-	m, err := catalogue.ParseManifest([]byte(`{"module": "` + name + `", "version": "1",
-		"config": {"level": {"type": "string", "description": "how much it says", "default": "info"}},
-		"resources": [{"id": "conf", "type": "file", "path": "/etc/` + name + `.json", "mode": "0640",
-			"content": "{\"level\": \"info\"}", "merge": "json", "takes-config": ["level"]}]}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	return m
-}
-
-// Issue 1493: a module in the config form whose values are set only in mesh-config has no settings row, and its
-// settings are still read, because SettingsFor is where mesh-config's values are laid in.
-func TestSettingsAreReadForAConfigModuleWithoutASettingsRow(t *testing.T) {
-	shelf := map[string]catalogue.Manifest{
-		"brother": configForm(t, "brother"),        // config only in mesh-config: no settings row
-		"older":   {Module: "older", Version: "1"}, // settings form, with a row
-		"idle":    {Module: "idle", Version: "1"},  // settings form, no row: nothing to read
-		"newer":   configForm(t, "newer"),          // config form, but the switch is off for it
-	}
-	have := map[string]bool{"older": true, "gone": true} // "gone" has a row and is not on the shelf
-	reads := func(module string) (bool, error) { return module == "brother", nil }
-	got, err := modulesToRead(shelf, have, reads)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if want := []string{"brother", "older"}; !reflect.DeepEqual(got, want) {
-		t.Errorf("settings are read for %v, want %v", got, want)
-	}
-	if _, err := modulesToRead(shelf, have, func(string) (bool, error) { return false, errors.New("store down") }); err == nil {
-		t.Error("a failing ReadsConfig is not returned")
-	}
-}

cmd/mesh-controller/compose_made_integration_test.go

@@ -1,54 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"context"
-	"fmt"
-	"sort"
-)
-
-// made is what a send made in a store, by key and never by value: the machine ports given, the pair credentials and the
-// own secrets.
-type made struct {
-	Ports      []string
-	Pairs      []string
-	OwnSecrets []string
-}
-
-// madeIn is what a store holds that a send makes, by key and never by value.
-func madeIn(ctx context.Context, open *stores) (made, error) {
-	var out made
-	inv := open.inventory
-	nodes, err := inv.Nodes(ctx)
-	if err != nil {
-		return out, err
-	}
-	for _, n := range nodes {
-		ports, err := inv.PortsFor(ctx, n.Name)
-		if err != nil {
-			return out, err
-		}
-		for _, p := range ports {
-			out.Ports = append(out.Ports, fmt.Sprintf("%s %s:%d->%d", n.Name, p.Module, p.Wanted, p.Machine))
-		}
-		rows, err := inv.SecretsFrom(ctx, n.Name)
-		if err != nil {
-			return out, err
-		}
-		for _, s := range rows {
-			out.Pairs = append(out.Pairs, fmt.Sprintf("%s %s on %s from %s local=%s", s.Name, s.ConsumerModule, s.Consumer, n.Name, s.Local))
-		}
-	}
-	own, err := inv.OwnSecretRows(ctx)
-	if err != nil {
-		return out, err
-	}
-	for _, r := range own {
-		out.OwnSecrets = append(out.OwnSecrets, fmt.Sprintf("%s %s/%s (%s)", r.Node, r.Module, r.Name, r.Origin))
-	}
-	sort.Strings(out.Ports)
-	sort.Strings(out.Pairs)
-	sort.Strings(out.OwnSecrets)
-	return out, nil
-}

cmd/mesh-controller/compose_once_integration_test.go

@@ -1,44 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/compose"
-)
-
-// 1382/AC5: composing every node of one operation builds the Input once; without an operation's cache, once for each.
-func TestComposingEveryNodeOfAnOperationBuildsTheInputOnce(t *testing.T) {
-	open, _ := aMeshWithSecrets(t)
-	built := 0
-	was := composeInputBuilt
-	composeInputBuilt = func() { built++ }
-	t.Cleanup(func() { composeInputBuilt = was })
-	ctx := withInputCache(t.Context())
-	nodes, err := open.inventory.Nodes(ctx)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, n := range nodes {
-		if _, _, err := resolveNode(ctx, open, n.Name); err != nil && !unresolvable(err) {
-			t.Fatal(err)
-		}
-		if _, _, err := composeQuestion(ctx, open, n.Name, compose.Reading, false); err != nil && !unresolvable(err) {
-			t.Fatal(err)
-		}
-	}
-	if _, err := generatorsOf(ctx, open); err != nil {
-		t.Fatal(err)
-	}
-	if built != 1 {
-		t.Fatalf("an operation over %d node(s) built the Input %d time(s)", len(nodes), built)
-	}
-	built = 0
-	if _, _, err := resolveNode(t.Context(), open, nodes[0].Name); err != nil && !unresolvable(err) {
-		t.Fatal(err)
-	}
-	if built != 1 {
-		t.Fatalf("a composition with no cache built the Input %d time(s)", built)
-	}
-}

cmd/mesh-controller/compose_perform.go

@@ -1,265 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"os"
-	"slices"
-	"sort"
-	"strconv"
-	"strings"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/compose"
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// perform makes what a composition named foreseen (novox/hq ADR 0453 clause 3, design 47 R4b, issue 1385).
-//
-// **The composition makes nothing; a send does.** mesh-sdk's composition over an Input names what the next send would make
-// (the ports it would assign, the credentials it would seal, the core boxes it would ask the vault for, the seats it would
-// pass on, the certificate it would issue) and stands in for each. A send composes, performs, reads the stores again and
-// composes again (send in compose_sdk.go), and refuses to send a declaration that still names anything foreseen. A question
-// (status, facts, probes, the merge gate's reading) never reaches this file.
-//
-// What is made is exactly what the controller's own composition made on the way to a declaration it was going to send:
-//   - every pair credential no row holds, for every machine that resolves, since planning one node resolved them all;
-//   - the seats the mesh passes on, with the hand act (not on a throwaway mesh, whose hand act has nowhere to go);
-//   - the machine ports the node's modules were given none for;
-//   - the node's own secrets, by the controller's own rules (a bus credential nobody issued was refused by the composition);
-//   - the core credentials, asked of the vault every send, so a rotated one reaches the machine;
-//   - the certificate of a machine that was never certified.
-//
-// perform returns whether it made or recorded anything: the reason the caller reads the stores again.
-func perform(ctx context.Context, open *stores, in *meshInput, node string, d compose.Declared) (bool, error) {
-	did := false
-	inv := open.inventory
-
-	// The seats passed on: recorded in the store with the controller's own hand act (ADR 0449 §4, issue 1317).
-	if len(d.Passes.Passes) > 0 {
-		var w io.Writer = os.Stderr
-		if lw, ok := ctx.Value(leftOutKey{}).(io.Writer); ok {
-			w = lw
-		}
-		for _, line := range d.Passes.Said {
-			fmt.Fprintln(w, line)
-		}
-		if performSeatPasses(ctx, seatPassingOn(inv, w), d.Passes.Passes) {
-			did = true
-		}
-	}
-
-	// Every pair credential the stores hold none for: made once and kept, and sealed to both ends before it was ever written
-	// down. The error is the one planFor met: the machine that needs it, and why none could be made.
-	for _, p := range in.wouldMake {
-		if err := makePair(ctx, inv, p); err != nil {
-			return did, fmt.Errorf("%s on %s needs %s from %s and no credential could be made for it: %w",
-				p.ConsumerModule, p.Consumer, p.Name, p.Provider, err)
-		}
-		did = true
-	}
-
-	// The ports this node's modules were given none for.
-	if len(d.ForeseenPorts) > 0 {
-		shelf, err := inv.Catalogue(ctx)
-		if err != nil {
-			return did, err
-		}
-		for _, one := range d.ForeseenPorts {
-			module, port, ok := strings.Cut(one, ":")
-			wanted, perr := strconv.Atoi(port)
-			if !ok || perr != nil {
-				return did, fmt.Errorf("the composition named a port the controller cannot read: %q", one)
-			}
-			fixed := false
-			for _, l := range nodeShelf(in, shelf, node)[module].Listens {
-				if l.Port == wanted {
-					fixed = l.Fixed
-				}
-			}
-			if _, err := inv.PortFor(ctx, node, module, wanted, fixed); err != nil {
-				return did, fmt.Errorf("%s needs %d reachable on %s and it could not be assigned: %w", module, wanted, node, err)
-			}
-			did = true
-		}
-	}
-
-	// The node's own secrets: a module's superuser password, an administrator, an account. The composition refused what the
-	// send refuses (a bus credential nobody issued, a given value under an old key).
-	for _, one := range d.StoodIn {
-		module, name, ok := strings.Cut(one, "/")
-		if !ok || strings.Contains(one, " ") {
-			continue // a grant's sealed copy, the certificate or the bus's list: made below or by nobody
-		}
-		if _, err := inv.SecretForModule(ctx, node, module, name); err != nil {
-			return did, err
-		}
-		did = true
-	}
-
-	// The certificate of a machine that was never certified: issued and kept, with the authority when there is none yet.
-	for _, one := range d.StoodIn {
-		if strings.HasPrefix(one, "the certificate and the authority of ") {
-			if _, _, err := certificateFor(ctx, open, node); err != nil {
-				return did, err
-			}
-			did = true
-			break
-		}
-	}
-	return did, nil
-}
-
-// makePair makes one pair credential by the controller's own read of it: the credential for the pair, or the provider's one
-// credential sealed to this consumer too. A credential only a person gives is never made (it is not a would-make).
-func makePair(ctx context.Context, inv *inventory.Inventory, p inventory.PairCredential) error {
-	var err error
-	switch p.Kind {
-	case inventory.PairShared:
-		_, err = inv.SharedSecretFor(ctx, p.Name, p.Consumer, p.ConsumerModule, p.Provider, p.ProviderModule, p.Local, p.Own)
-	case inventory.PairPlain:
-		_, err = inv.SecretFor(ctx, p.Name, p.Consumer, p.ConsumerModule, p.Provider, p.Local)
-	default:
-		return errors.New("a credential only a person gives is not made")
-	}
-	if inventory.IsNotGiven(err) {
-		return nil
-	}
-	return err
-}
-
-// stillForeseen says what a composed declaration still stands in for: the lists the composition names, and the stand-in itself
-// anywhere in the body (a pair credential's stand-in is not in any list). A declaration that has any is never sent.
-func stillForeseen(d compose.Declared) []string {
-	var left []string
-	left = append(left, d.Foreseen...)
-	left = append(left, d.StoodIn...)
-	for _, p := range d.ForeseenPorts {
-		left = append(left, "the port "+p)
-	}
-	for _, c := range d.CoreBoxesWanted {
-		left = append(left, "the vault's box for "+c.Module+"/"+c.Name)
-	}
-	for _, p := range d.Passes.Passes {
-		left = append(left, "the pass of "+p.Seat.Name+" to "+p.To.Module+" on "+p.To.Node)
-	}
-	if body, err := d.Body(); err == nil {
-		for _, marker := range []string{catalogue.ForeseenSealed, "asked of the vault by the next send", compose.ForeseenCertificate,
-			compose.ForeseenBusUsers} {
-			if strings.Contains(string(body), marker) {
-				left = append(left, "a stand-in: "+marker)
-			}
-		}
-	}
-	sort.Strings(left)
-	return slicesCompact(left)
-}
-
-func slicesCompact(in []string) []string {
-	var out []string
-	for _, s := range in {
-		if len(out) == 0 || out[len(out)-1] != s {
-			out = append(out, s)
-		}
-	}
-	return out
-}
-
-// nodeShelf is the shelf as one node composes its own set: the current one with each module it keeps at the build it runs put
-// in place of the current.
-func nodeShelf(in *meshInput, shelf map[string]catalogue.Manifest, node string) map[string]catalogue.Manifest {
-	n, _ := nodeOf(in.Input, node)
-	return shelfWith(shelf, n.Kept)
-}
-
-// prepareSend is what a send does before it composes, every send and whatever the composition would have named: the
-// controller's own composition did it on the way, so a module's file that names an own secret composes (mesh-sdk's
-// composition can stand in for none: a file naming a secret not made yet is refused in every mode), and the core's credentials
-// are asked of the vault on every send, so a rotated one reaches the machine and a silent vault is said (core_box.go).
-//
-//   - Each own secret of a module the node runs (not one handed to the provisioner, not one issued outside the mesh, not one a
-//     person gives) that no row holds is made, unless the composition would refuse it (a bus credential nobody issued): that
-//     refusal is the composition's to say, in its words.
-//   - The core's credentials are asked of the vault, the boxes newly answered are kept, and the modules the vault did not answer
-//     for with no box kept are returned: the controller seals those itself until the vault holds them (ADR 0396).
-func prepareSend(ctx context.Context, open *stores, node string) ([]string, error) {
-	in, err := inputFor(ctx, open)
-	if err != nil {
-		return nil, err
-	}
-	if in.refused[node] != nil {
-		return nil, nil // empty-on-error: refused alone for what it keeps; the composition that follows says so, in its words
-	}
-	resolved, err := compose.Resolve(in.Input, node)
-	if err != nil {
-		return nil, nil // empty-on-error: it does not compose for its own reasons; the composition that follows says them
-	}
-	n, _ := nodeOf(in.Input, node)
-	hands := n.Stated && n.Contract >= compose.HandedContract
-	handing := catalogue.Rendering{Hands: hands, Provisioner: provisionerAccount(resolved.Plan)}
-	inv := open.inventory
-	did := false
-	if n.SealingKey != "" {
-		held := map[string]bool{}
-		for _, r := range in.OwnSecrets {
-			// Held only when sealed to the key the machine has now, or given by a person (which is not the mesh's
-			// to make again): a made row under an old key is re-made, as SecretForModule did.
-			if r.Node == node && (r.SealedTo == n.SealingKey || r.Origin == inventory.OriginAccepted) {
-				held[r.Module+"/"+r.Name] = true
-			}
-		}
-		for _, m := range resolved.Plan.Modules {
-			if handing.Handing(m) {
-				continue
-			}
-			plain := m.OwnSecrets.Plain()
-			names := make([]string, 0, len(plain))
-			for name := range plain {
-				names = append(names, name)
-			}
-			sort.Strings(names)
-			for _, name := range names {
-				if plain[name].IssuedBy == catalogue.IssuedOutside || held[m.Module+"/"+name] {
-					continue
-				}
-				switch name {
-				case "broker":
-					if !slices.Contains(in.BusMinted, node+"."+m.Module) {
-						continue
-					}
-				case compose.ProvisionerSecret:
-					if !slices.Contains(in.BusMinted, "provisioner."+node) {
-						continue
-					}
-				default:
-					// A bus process's account nobody issued still gets the stand-in, until the composition leaves
-					// the module off (issue 1753): the warning names the verb (issue 1226).
-					if line := processAccountWarning(m, node, name, in.BusMinted); line != "" {
-						sayWarning(ctx, line)
-					}
-				}
-				if _, err := inv.SecretForModule(ctx, node, m.Module, name); err == nil {
-					did = true
-				}
-			}
-		}
-	}
-	var byController []string
-	if n.Stated && n.Contract >= compose.VaultBoxContract {
-		boxes, err := coreBoxesFor(ctx, inv, node, resolved.Plan.Modules, func(m catalogue.Manifest) bool {
-			return handing.Handing(m)
-		}, true)
-		if err != nil {
-			return nil, err
-		}
-		did = did || len(boxes.keep) > 0
-		byController = boxes.byController
-	}
-	if did {
-		// What was made is in the stores now: the composition reads them afresh.
-		forgetInput(ctx)
-	}
-	return byController, nil
-}

cmd/mesh-controller/compose_perform_integration_test.go

@@ -1,235 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"errors"
-	"fmt"
-	"strings"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/compose"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-func aWebModule() catalogue.Manifest {
-	return catalogue.Manifest{Module: "web", Version: "1",
-		Listens:    []catalogue.Listening{{Port: 8080, From: catalogue.FromEverywhere}},
-		OwnSecrets: catalogue.OwnSecrets{"admin": {Path: "/etc/web/admin"}},
-		Resources: []map[string]any{
-			{"id": "server", "type": "container", "name": "web", "ports": []any{"8080"},
-				"image": "registry.example/web@sha256:" + strings.Repeat("a", 64)},
-		}}
-}
-
-// 1385/AC1: a port the composition names foreseen is allocated with the inventory's PortFor for that module and port, a second
-// composition names it no more, and the number is the one the controller's own Allocating composition gives in the same store.
-func TestPerformAllocatesAForeseenPortAndTheNumberIsTheControllers(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	register(t, open, aWebModule())
-	if _, err := assign(ctx, open, "laptop", "web"); err != nil {
-		t.Fatal(err)
-	}
-	in, err := readComposeInput(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
-	d, _, err := compose.ComposeIn(in.Input, "laptop", compose.Foreseeing)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(d.ForeseenPorts) != 1 || d.ForeseenPorts[0] != "web:8080" {
-		t.Fatalf("the composition names the ports %v foreseen, want web:8080", d.ForeseenPorts)
-	}
-	did, err := perform(ctx, open, in, "laptop", d)
-	if err != nil || !did {
-		t.Fatalf("perform did %v: %v", did, err)
-	}
-	held, err := open.inventory.PortsFor(ctx, "laptop")
-	if err != nil || len(held) != 1 || held[0].Module != "web" || held[0].Wanted != 8080 {
-		t.Fatalf("the port perform allocated reads %+v: %v", held, err)
-	}
-	in, err = readComposeInput(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if again, _, err := compose.ComposeIn(in.Input, "laptop", compose.Foreseeing); err != nil || len(again.ForeseenPorts) != 0 {
-		t.Fatalf("a second composition names %v foreseen: %v", again.ForeseenPorts, err)
-	}
-	// The number is the one the controller allocates in the same store.
-	plan, settings, err := resolveNode(ctx, open, "laptop")
-	if err != nil {
-		t.Fatal(err)
-	}
-	old, err := declarationFor(ctx, open, "laptop", plan, settings)
-	if err != nil {
-		t.Fatal(err)
-	}
-	after, _, err := compose.ComposeIn(in.Input, "laptop", compose.Foreseeing)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got, want := portsOf(after.Resources), portsOf(old.Resources); got != want {
-		t.Fatalf("the declaration publishes %s; the controller's allocation publishes %s", got, want)
-	}
-}
-
-func portsOf(resources []map[string]any) string {
-	var out []string
-	for _, r := range resources {
-		if r["type"] == "container" {
-			out = append(out, fmt.Sprint(r["name"], r["ports"]))
-		}
-	}
-	return strings.Join(out, ";")
-}
-
-// 1385/AC2: an own secret named foreseen is made with SecretForModule, and a pair credential the Input names would-make is
-// made as planFor chose; both exist after the send's composition and a second composition names neither.
-func TestPerformMakesTheOwnSecretsAndThePairCredentialsTheCompositionNamed(t *testing.T) {
-	open, _ := aMeshWithSecrets(t)
-	ctx := t.Context()
-	inv := open.inventory
-	register(t, open, aWebModule())
-	register(t, open, aConsumerOfTheBucket("reports"))
-	for _, m := range []string{"web", "reports"} {
-		if _, err := assign(ctx, open, "laptop", m); err != nil {
-			t.Fatal(err)
-		}
-	}
-	before, err := madeIn(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
-	declared, err := composeSend(ctx, open, "laptop")
-	if err != nil {
-		t.Fatalf("the send is refused: %v", err)
-	}
-	if len(declared.foreseen) != 0 {
-		t.Fatalf("the declaration still names %v foreseen", declared.foreseen)
-	}
-	after, err := madeIn(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
-	madeNow := func(have, was []string) []string {
-		seen := map[string]bool{}
-		for _, s := range was {
-			seen[s] = true
-		}
-		var out []string
-		for _, s := range have {
-			if !seen[s] {
-				out = append(out, s)
-			}
-		}
-		return out
-	}
-	if got := madeNow(after.OwnSecrets, before.OwnSecrets); len(got) != 1 || !strings.Contains(got[0], "web/admin") {
-		t.Errorf("the own secrets made are %v, want laptop web/admin", got)
-	}
-	if got := madeNow(after.Pairs, before.Pairs); len(got) != 1 || !strings.Contains(got[0], "reports") {
-		t.Errorf("the pair credentials made are %v, want the one of reports", got)
-	}
-	// And the credential is the one a second composition reads as held.
-	in, err := readComposeInput(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(in.wouldMake) != 0 {
-		t.Errorf("after the send the next send would still make %v", in.wouldMake)
-	}
-	if _, err := inv.SecretsFrom(ctx, "anchor"); err != nil {
-		t.Fatal(err)
-	}
-}
-
-// 1385/AC3 (the lead's answer 1): with the vault unreachable and no box of the credential kept, the send carries the
-// controller's own seal for it (ADR 0396), says so as a condition, and keeps no box.
-func TestAVaultThatIsSilentSealsTheSendByTheControllerWhereNoBoxIsKept(t *testing.T) {
-	open, vault := aCoreMesh(t, link.VaultBoxContract)
-	vault.silent = errors.New("no responders")
-	declared, err := composeSend(t.Context(), open, "laptop")
-	if err != nil {
-		t.Fatalf("the send is refused: %v", err)
-	}
-	f := clientsBroker(declared.Resources)
-	if f == nil || f["sealed"] == nil || f[catalogue.VaultSealedField] != nil {
-		t.Fatalf("the core credential is composed as %v: the controller's own seal, until the vault holds it", f)
-	}
-	if len(declared.foreseen) != 0 {
-		t.Fatalf("the declaration still names %v foreseen", declared.foreseen)
-	}
-	if c, found := vaultSilence(t, "laptop"); !found || !strings.Contains(c.Summary, "sealed by the controller until the vault holds it") {
-		t.Fatalf("no condition says why: %+v", c)
-	}
-	kept, err := open.inventory.KeptCoreBoxes(t.Context(), "laptop")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(kept["mesh-provisioner-client"]) != 0 {
-		t.Fatalf("a box was kept for a credential the vault never boxed: %v", kept)
-	}
-}
-
-// 1385/AC6: perform is idempotent: a second send's composition over the stores it left makes and records nothing.
-func TestAFinishedSendMakesNothingTheSecondTime(t *testing.T) {
-	open, _ := aMeshWithSecrets(t)
-	ctx := t.Context()
-	register(t, open, aWebModule())
-	if _, err := assign(ctx, open, "laptop", "web"); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := composeSend(ctx, open, "laptop"); err != nil {
-		t.Fatal(err)
-	}
-	before := tableState(t, open.inventory)
-	if _, err := composeSend(ctx, open, "laptop"); err != nil {
-		t.Fatal(err)
-	}
-	for k, v := range tableState(t, open.inventory) {
-		if before[k] != v {
-			t.Errorf("a second send of the same machine moved %s", k)
-		}
-	}
-}
-
-// Review round 1, finding 1: a machine that rejoined with a new sealing key keeps its made rows sealed to the old key. A
-// send re-makes them for the new key, as SecretForModule did on main, and the file naming the secret is not refused.
-func TestASendReMakesAnOwnSecretSealedToAKeyTheMachineNoLongerHas(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	inv := open.inventory
-	register(t, open, aBot("bot", false))
-	if _, err := assign(ctx, open, "laptop", "bot"); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := composeSend(ctx, open, "laptop"); err != nil {
-		t.Fatalf("the first send is refused: %v", err)
-	}
-	if err := inv.RecordSealingKey(ctx, nodeID(t, open, "laptop"), aPublicKey(t)); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := composeSend(ctx, open, "laptop"); err != nil {
-		t.Fatalf("a machine that rejoined cannot be sent to: %v", err)
-	}
-	in, err := readComposeInput(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
-	n, _ := nodeOf(in.Input, "laptop")
-	found := false
-	for _, r := range in.OwnSecrets {
-		if r.Node == "laptop" && r.Module == "bot" && r.Name == "token" {
-			found = true
-			if r.SealedTo != n.SealingKey {
-				t.Fatalf("the own secret is still sealed to a key the machine no longer has")
-			}
-		}
-	}
-	if !found {
-		t.Fatal("the own secret has no row")
-	}
-}

cmd/mesh-controller/compose_sdk.go

@@ -1,506 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"fmt"
-	"io"
-	"os"
-	"slices"
-	"sort"
-	"strings"
-	"sync"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/compose"
-	"git.novox.be/novox/mesh-sdk/go/validate"
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// The controller's composition on mesh-sdk's (novox/hq ADR 0453 clause 3, design 47 R4b, issues 1386 to 1388): every
-// caller that planned or composed a node reads the Input once for its operation (compose_input.go), asks the SDK to
-// compose over it, and, when it sends, performs what the composition names foreseen (compose_perform.go) and composes again.
-
-// inputCacheKey carries an operation's Input in its context, so the planning of every node of one verb reads the stores once.
-type inputCacheKey struct{}
-
-type inputCache struct {
-	mu sync.Mutex
-	by map[string]*meshInput
-}
-
-// withInputCache is ctx for an operation: the Input read for it is kept until a send changes what it read. A context that
-// carries none reads the stores for each composition, which is correct and slow.
-func withInputCache(ctx context.Context) context.Context {
-	if _, ok := ctx.Value(inputCacheKey{}).(*inputCache); ok {
-		return ctx
-	}
-	return context.WithValue(ctx, inputCacheKey{}, &inputCache{by: map[string]*meshInput{}})
-}
-
-// freshInput is ctx for one composition whose Input is read afresh and kept only until the composition makes something: a
-// send that is composed after another one made and recorded things (a push's machines, one after the other).
-func freshInput(ctx context.Context) context.Context {
-	return context.WithValue(ctx, inputCacheKey{}, &inputCache{by: map[string]*meshInput{}})
-}
-
-// keptSignature is what the Input read depends on in ctx: which recorded modules each machine keeps at the build it runs
-// (recorded_kept.go), so an Input read for a person's push is never taken for one read for a gated send.
-func keptSignature(ctx context.Context) string {
-	skip, on := keptExcept(ctx)
-	var names []string
-	for m := range skip {
-		names = append(names, m)
-	}
-	sort.Strings(names)
-	every, _ := ctx.Value(keepEveryBuildKey{}).(string)
-	settings, _ := ctx.Value(keepForSettingsKey{}).(string)
-	return fmt.Sprintf("kept=%v;except=%v;every=%s;settings=%s", on, names, every, settings)
-}
-
-// inputFor is the Input for ctx's operation.
-func inputFor(ctx context.Context, open *stores) (*meshInput, error) {
-	cache, ok := ctx.Value(inputCacheKey{}).(*inputCache)
-	if !ok {
-		return readComposeInput(ctx, open)
-	}
-	sig := keptSignature(ctx)
-	cache.mu.Lock()
-	defer cache.mu.Unlock()
-	if in := cache.by[sig]; in != nil {
-		return in, nil
-	}
-	in, err := readComposeInput(ctx, open)
-	if err != nil {
-		return nil, err
-	}
-	cache.by[sig] = in
-	return in, nil
-}
-
-// forgetInput drops what the operation read, because a send made or recorded something it read.
-func forgetInput(ctx context.Context) {
-	if cache, ok := ctx.Value(inputCacheKey{}).(*inputCache); ok {
-		cache.mu.Lock()
-		cache.by = map[string]*meshInput{}
-		cache.mu.Unlock()
-	}
-}
-
-// resolveNode works out everything a node should run, from what was assigned to it (planFor on the SDK): over the Input,
-// writing nothing. A failure to compose the node's own modules is marked notResolvable, as planFor marked it; every other
-// failure is returned as it is.
-func resolveNode(ctx context.Context, open *stores, node string) (catalogue.Resolution, catalogue.SettingsBy, error) {
-	in, err := inputFor(ctx, open)
-	if err != nil {
-		return catalogue.Resolution{}, nil, err
-	}
-	if err := in.refused[node]; err != nil {
-		return catalogue.Resolution{}, nil, err
-	}
-	resolved, err := compose.Resolve(in.Input, node)
-	if err != nil {
-		if compose.IsUnresolvable(err) {
-			return catalogue.Resolution{}, nil, notResolvable{err}
-		}
-		return catalogue.Resolution{}, nil, err
-	}
-	logUnheld(node, resolved.Plan.Unheld)
-	return resolved.Plan, resolved.Settings, nil
-}
-
-// generatorsOf is what every node's declaration is composed with, over the whole mesh (generators on the SDK).
-func generatorsOf(ctx context.Context, open *stores) (map[string]catalogue.Generator, error) {
-	in, err := inputFor(ctx, open)
-	if err != nil {
-		return nil, err
-	}
-	return compose.Generators(in.Input)
-}
-
-// renderingOf is what a machine is rendered with as a question reads it (nothing made), with the private network: what the
-// filter's rules, the roster and the like are derived from.
-func renderingOf(ctx context.Context, open *stores, node string) (catalogue.Rendering, error) {
-	in, err := inputFor(ctx, open)
-	if err != nil {
-		return catalogue.Rendering{}, err
-	}
-	rendered, err := compose.Render(in.Input, node, compose.Reading)
-	if err != nil {
-		return catalogue.Rendering{}, markUnresolvable(err)
-	}
-	with := rendered.Rendering
-	if with.Generators, err = compose.Generators(in.Input); err != nil {
-		return catalogue.Rendering{}, err
-	}
-	return with, nil
-}
-
-// whoResolvesOn is the machines whose resolution answers a requirement, and why the others did not (whoResolves over the
-// Input): by what a module provides, not by its name. A machine whose set does not compose is in refused, said; one the mesh
-// could not be asked about is an error, never a refusal (novox/hq 04-ISSUES/152).
-func whoResolvesOn(ctx context.Context, open *stores, requirement string) (map[string]bool, map[string]string, error) {
-	in, err := inputFor(ctx, open)
-	if err != nil {
-		return nil, nil, err
-	}
-	on := map[string]bool{}
-	refused := map[string]string{}
-	for _, n := range in.sortedNodes() {
-		if err := in.refused[n.Name]; err != nil {
-			return nil, nil, fmt.Errorf("whether %s answers %q cannot be read: %w", n.Name, requirement, err)
-		}
-		resolved, err := compose.Resolve(in.Input, n.Name)
-		switch {
-		case compose.IsUnresolvable(err):
-			refused[n.Name] = err.Error()
-			continue
-		case err != nil:
-			return nil, nil, fmt.Errorf("whether %s answers %q cannot be read: %w", n.Name, requirement, err)
-		}
-		for _, m := range resolved.Plan.Modules {
-			for _, offered := range m.Offers() {
-				if offered == requirement {
-					on[n.Name] = true
-				}
-			}
-		}
-	}
-	return on, refused, nil
-}
-
-// sortedNodes is the Input's nodes by name, the order the controller reads them in.
-func (in *meshInput) sortedNodes() []compose.Node {
-	out := append([]compose.Node(nil), in.Nodes...)
-	sort.Slice(out, func(i, j int) bool { return out[i].Name < out[j].Name })
-	return out
-}
-
-// composeQuestion composes a node's declaration as a question asks it: nothing is made, and what a send would make is a
-// stand-in (Foreseeing) or left out (Reading). It also answers what the node-engine's validator refuses of it. The lines the
-// composition found are said where the controller says its own (standard error, or the writer an act gave).
-//
-// withOrder says the declaration carries the order it was last sent under (composedAndValidated's, which a comparison with the
-// last send needs); without it the order is none, as declarationWith left it for the sender to stamp.
-func composeQuestion(ctx context.Context, open *stores, node string, mode compose.Mode, withOrder bool) (sendable, []string, error) {
-	in, err := inputFor(ctx, open)
-	if err != nil {
-		return sendable{}, nil, err
-	}
-	if err := in.refused[node]; err != nil {
-		return sendable{}, nil, err
-	}
-	d, problems, err := compose.ComposeIn(in.Input, node, mode)
-	if err != nil {
-		return sendable{}, nil, markUnresolvable(err)
-	}
-	if err := refusedBus(in, node); err != nil {
-		return sendable{}, nil, err
-	}
-	sayFound(ctx, d)
-	out := sendableOf(d)
-	out.fileReferences = readsFileReferences(in.Input, node)
-	if !withOrder {
-		out.Sequence, out.Epoch, out.Generation = 0, 0, 0
-	}
-	return out, problems, nil
-}
-
-// refusedBus is why the node cannot be composed because it runs the bus and the bus's user list cannot be: no user has a
-// credential, so the list would refuse every connection in the mesh (busUserList). The controller's own composition refused that
-// machine with those words; no other machine is refused for it. nil when nothing refuses the node.
-func refusedBus(in *meshInput, node string) error {
-	if in.busRefused == nil {
-		return nil
-	}
-	resolved, err := compose.Resolve(in.Input, node)
-	if err != nil {
-		return nil // it does not compose for its own reasons, which are said
-	}
-	for _, m := range resolved.Plan.Modules {
-		if m.BusUsers != "" && m.ClaimsSeat("mesh-broker") {
-			return in.busRefused
-		}
-	}
-	return nil
-}
-
-// markUnresolvable is an error of a node whose own set does not compose, as planFor marked it.
-func markUnresolvable(err error) error {
-	if compose.IsUnresolvable(err) {
-		return notResolvable{err}
-	}
-	return err
-}
-
-// composeSend composes a node's declaration to send it, as the Allocating composition did: composed over what is read,
-// then what it named foreseen is made (perform), the stores are read again and it is composed again. A declaration that
-// still names anything foreseen is refused, said, and never sent.
-func composeSend(ctx context.Context, open *stores, node string) (sendable, error) {
-	declared, _, err := composeSendValidated(ctx, open, node)
-	if err != nil {
-		return declared, err
-	}
-	// Never a declaration naming an image the store does not hold (novox/hq issue 1742): that module is left out.
-	return withoutMissingImages(ctx, open, node, declared), nil
-}
-
-// composeSendValidated is composeSend and what the node-engine's validator refuses of the declaration it composed, for the
-// merge gate's two passes (composedAndValidated in its Allocating mode).
-func composeSendValidated(ctx context.Context, open *stores, node string) (sendable, []string, error) {
-	// The core modules whose credentials the controller sealed itself because the vault was silent and no box was kept
-	// (ADR 0396): the composition stands in a vault box for each, and a send carries the controller's own seal instead.
-	byController, err := prepareSend(ctx, open, node)
-	if err != nil {
-		return sendable{}, nil, err
-	}
-	for attempt := 0; ; attempt++ {
-		in, err := inputFor(ctx, open)
-		if err != nil {
-			return sendable{}, nil, err
-		}
-		if err := in.refused[node]; err != nil {
-			return sendable{}, nil, err
-		}
-		d, problems, err := compose.ComposeIn(in.Input, node, compose.Foreseeing)
-		if err != nil {
-			return sendable{}, nil, markUnresolvable(err)
-		}
-		if err := refusedBus(in, node); err != nil {
-			return sendable{}, nil, err
-		}
-		if len(byController) > 0 {
-			if d, problems, err = sealedByTheController(in, node, d, byController); err != nil {
-				return sendable{}, nil, err
-			}
-		}
-		left := stillForeseen(d)
-		resolved, rerr := compose.Resolve(in.Input, node)
-		if rerr != nil {
-			return sendable{}, nil, markUnresolvable(rerr)
-		}
-		if len(resolved.Foreseen) > 0 {
-			left = append(left, resolved.Foreseen...)
-		}
-		if len(left) == 0 && len(in.wouldMake) == 0 {
-			sayFound(ctx, d)
-			out := sendableOf(d)
-			out.fileReferences = readsFileReferences(in.Input, node)
-			// The sender stamps the order it allots (order.stamp); a composition for a send carries none of its own.
-			out.Sequence, out.Epoch, out.Generation = 0, 0, 0
-			here, _ := nodeOf(in.Input, node)
-			out.Builds = buildsOf(in.Input, here, resolved.Plan, d.LeftOutWhy)
-			out.Bindings = boundToData(resolved.Plan, d.LeftOutWhy)
-			if len(d.Filled) > 0 {
-				if out.plans, err = handedPlans(in, node, resolved); err != nil {
-					return sendable{}, nil, err
-				}
-			}
-			return out, problems, nil
-		}
-		if attempt > 0 {
-			return sendable{}, nil, fmt.Errorf("%s was composed twice and still names what only a send makes (%s): nothing is sent "+
-				"that stands in for a value", node, strings.Join(left, "; "))
-		}
-		if _, err := perform(ctx, open, in, node, d); err != nil {
-			return sendable{}, nil, err
-		}
-		// What was made is in the stores now: the next read is a fresh one.
-		forgetInput(ctx)
-	}
-}
-
-// restOfTheMesh is what every other machine holds and offers (theRestOfTheMesh over the Input), for a question: the lines it
-// finds are said where the controller says its own, and a seat it would pass on is passed by the next send (perform), not by
-// the question. shelf, when given, replaces the Input's catalogue: a caller composing a change's shelf.
-func restOfTheMesh(ctx context.Context, open *stores, shelf map[string]catalogue.Manifest, exclude string) (catalogue.World, error) {
-	in, err := inputFor(ctx, open)
-	if err != nil {
-		return catalogue.World{}, err
-	}
-	input := in.Input
-	if shelf != nil {
-		input.Catalogue = shelf
-	}
-	world, passes, left, err := compose.TheRestOfTheMesh(input, exclude)
-	if err != nil {
-		return catalogue.World{}, err
-	}
-	var w io.Writer = os.Stderr
-	if lw, ok := ctx.Value(leftOutKey{}).(io.Writer); ok {
-		w = lw
-	}
-	for _, l := range left {
-		fmt.Fprintln(w, l.String())
-	}
-	for _, line := range passes.Said {
-		fmt.Fprintln(w, line)
-	}
-	return world, nil
-}
-
-// restOfTheMeshOf is restOfTheMesh for a caller that holds the inventory alone: the other stores the Input reads are opened for
-// the call and let go of again.
-func restOfTheMeshOf(ctx context.Context, inv *inventory.Inventory, shelf map[string]catalogue.Manifest, exclude string) (catalogue.World, error) {
-	open := &stores{inventory: inv}
-	defer func() {
-		if open.licences != nil {
-			open.licences.Close()
-		}
-		if open.identity != nil {
-			open.identity.Close()
-		}
-	}()
-	return restOfTheMesh(ctx, open, shelf, exclude)
-}
-
-// sayFound says the lines a composition found while composing, once each: a machine left out of the rest of the mesh, a seat
-// that two claimants could take, the bus's users left out for want of a credential.
-func sayFound(ctx context.Context, d compose.Declared) {
-	if len(d.Said) == 0 {
-		return
-	}
-	var w io.Writer = os.Stderr
-	if lw, ok := ctx.Value(leftOutKey{}).(io.Writer); ok {
-		w = lw
-	}
-	for _, line := range d.Said {
-		fmt.Fprintln(w, line)
-	}
-}
-
-// sendableOf is a composed declaration as the controller's sends know it.
-func sendableOf(d compose.Declared) sendable {
-	out := sendable{Resources: compactKept(d.Resources), Sequence: d.Sequence, Epoch: d.Epoch, Generation: d.Generation,
-		ReadsModules: d.ReadsModules, moduleOf: d.ModuleOf, buildIDs: d.BuildIDs, modules: d.Modules,
-		localNetwork: d.LocalNetwork, Received: d.Received, Mesh: d.Mesh, BusUsers: d.BusUsers,
-		LeftOut: d.LeftOut, leftOutWhy: d.LeftOutWhy, withheld: d.Withheld, unbound: d.Unbound, foreseen: d.Foreseen,
-		unplaced: d.Unplaced, handedOnly: d.HandedOnly, Filled: d.Filled, Provisioner: d.Provisioner,
-		requiredBy: d.RequiredBy}
-	if d.Adoption != nil {
-		out.Adoption = &adoptionEnvelope{Taken: d.Adoption.Taken, Untaken: d.Adoption.Untaken}
-	}
-	return out
-}
-
-// buildsOf is the build of each module a declaration for the node carries, as a send records it (novox/hq issue 259): the
-// module's current build for each module in it, the build it was last sent for one left out of it, and a module kept at the
-// build the machine runs carried at that one (ADR 0245). Never nil.
-func buildsOf(in compose.Input, node compose.Node, plan catalogue.Resolution, leftOut map[string]string) map[string]string {
-	before := node.SentBuilds
-	if !node.SentKnown {
-		before = nil
-	}
-	out := map[string]string{}
-	for _, m := range plan.Modules {
-		if _, left := leftOut[m.Module]; left {
-			if was, kept := before[m.Module]; kept {
-				out[m.Module] = was
-			}
-			continue
-		}
-		out[m.Module] = in.CurrentBuilds[m.Module]
-	}
-	for m, was := range node.KeptBuilds {
-		if _, carried := out[m]; carried {
-			out[m] = was
-		}
-	}
-	return out
-}
-
-// handedPlans is the plan of each module handed to the provisioner, which the assignments mirror keeps with the send (design
-// 57 P6): the composition's declaration does not carry it, so it is composed from the same rendering again.
-func handedPlans(in *meshInput, node string, resolved compose.Resolved) (map[string]catalogue.Plan, error) {
-	rendered, err := compose.Render(in.Input, node, compose.Foreseeing)
-	if err != nil {
-		return nil, err
-	}
-	gens, err := compose.Generators(in.Input)
-	if err != nil {
-		return nil, err
-	}
-	with := rendered.Rendering
-	with.Generators = gens
-	composed, err := resolved.Plan.Compose(with)
-	if err != nil {
-		return nil, err
-	}
-	return composed.Plans, nil
-}
-
-// sealedByTheController is the declaration with the controller's own seal in place of the vault's box for each core module the
-// vault did not answer for and no box was kept for (core_box.go, ADR 0396): the file carries "sealed", as the controller's
-// composition sent it, until the vault holds the credential. What the composition stood in for the box is replaced and no longer
-// wanted; the validator is run again over the body.
-func sealedByTheController(in *meshInput, node string, d compose.Declared, modules []string) (compose.Declared, []string, error) {
-	rendered, err := compose.Render(in.Input, node, compose.Foreseeing)
-	if err != nil {
-		return d, nil, err
-	}
-	stood, _ := compactBox(catalogue.ForeseenVaultBox)
-	var wanted []compose.CoreBoxWanted
-	var foreseen []string
-	for _, w := range d.CoreBoxesWanted {
-		if !slices.Contains(modules, w.Module) {
-			wanted = append(wanted, w)
-			continue
-		}
-		sealed := rendered.Rendering.Needed[w.Module][w.Name]
-		if sealed == "" {
-			return d, nil, fmt.Errorf("%s/%s on %s has no seal of the controller's to carry until the vault holds it", w.Module, w.Name, node)
-		}
-		for _, r := range d.Resources {
-			box, isBox := r[catalogue.VaultSealedField]
-			// By the resource's id alone: its path is the manifest's with the machine's words filled in, and so is not the
-			// manifest's own.
-			if !isBox || r["id"] != w.Module+"."+catalogue.NeedID(w.Name) {
-				continue
-			}
-			if had, err := compactBox(box); err != nil || had != stood {
-				continue
-			}
-			delete(r, catalogue.VaultSealedField)
-			r["sealed"] = sealed
-		}
-	}
-	// A stand-in box that is left is said by its resource, never sent and never guessed at.
-	for _, r := range d.Resources {
-		if box, has := r[catalogue.VaultSealedField]; has {
-			if had, err := compactBox(box); err == nil && had == stood {
-				if id, _ := r["id"].(string); slices.ContainsFunc(modules, func(m string) bool { return strings.HasPrefix(id, m+".") }) {
-					return d, nil, fmt.Errorf("%s on %s still carries a stand-in for the vault's box, and the controller has "+
-						"no seal of its own for it", id, node)
-				}
-			}
-		}
-	}
-	d.CoreBoxesWanted = wanted
-	for _, f := range d.Foreseen {
-		module, _, _ := strings.Cut(f, "/")
-		if !slices.Contains(modules, module) {
-			foreseen = append(foreseen, f)
-		}
-	}
-	d.Foreseen = foreseen
-	body, err := d.Body()
-	if err != nil {
-		return d, nil, err
-	}
-	return d, validate.Declaration(body), nil
-}
-
-// compactBox is a value as the compact JSON it marshals to, so a box is compared by what it says and not by the type that
-// holds it.
-func compactBox(v any) (string, error) {
-	raw, err := json.Marshal(v)
-	if err != nil {
-		return "", err
-	}
-	var out bytes.Buffer
-	if err := json.Compact(&out, raw); err != nil {
-		return "", err
-	}
-	return out.String(), nil
-}

cmd/mesh-controller/compose_sdk_test.go

@@ -1,111 +0,0 @@
-package main
-
-import (
-	"context"
-	"reflect"
-	"strings"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/compose"
-)
-
-// A declaration as the SDK composes it is the one the controller sends, byte for byte, whatever it carries: the body is the
-// envelope's only marshaller on either side (design 47 R4b, issue 1386).
-func TestASendableIsTheComposedDeclarationByteForByte(t *testing.T) {
-	d := compose.Declared{
-		Resources: []map[string]any{{"id": "files.config", "type": "file"}, {"id": "mesh.hosts", "type": "file"}},
-		Sequence:  7, Epoch: 3, Generation: 9, ReadsModules: true,
-		ModuleOf: map[string]string{"files.config": "files"}, BuildIDs: map[string]string{"files": "b-1"},
-		Adoption: &compose.Adoption{Taken: []string{"files"}, Untaken: map[string][]string{"nats": {"nats.server"}}},
-		Filled:   []string{"/etc/files/filled.json"}, Provisioner: "mesh-provisioner",
-		LeftOut: []string{"cache"}, LeftOutWhy: map[string]string{"cache": "a setting cannot compose"},
-	}
-	want, err := d.Body()
-	if err != nil {
-		t.Fatal(err)
-	}
-	got, err := sendableOf(d).Body()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if string(got) != string(want) {
-		t.Fatalf("the controller would send\n%s\nand the composition made\n%s", got, want)
-	}
-	if empty, err := sendableOf(compose.Declared{}).Body(); err != nil || !strings.Contains(string(empty), `"owns_nothing":true`) {
-		t.Fatalf("an empty declaration is not deliberate: %s %v", empty, err)
-	}
-}
-
-// 1386: what a send records as carried: the current build of each module it carries, the build a module left out of it was last
-// sent (when that is known), and a module kept at the build the machine runs at that one. (The controller's carriedOn recorded
-// the same; mesh-sdk's node_test TestAModuleLeftOutKeepsTheBuildItWasLastSent holds the left-out case.)
-func TestWhatASendRecordsAsCarriedIsWhatTheControllerRecorded(t *testing.T) {
-	plan := catalogue.Resolution{Modules: []catalogue.Manifest{{Module: "postgres"}, {Module: "files"}, {Module: "cache"}}}
-	leftOut := map[string]string{"cache": "a setting cannot compose"}
-	for name, c := range map[string]struct {
-		sent  map[string]string
-		known bool
-		kept  map[string]string
-		want  map[string]string
-	}{
-		"nothing sent": {want: map[string]string{"postgres": "p2", "files": "f2"}},
-		"sent and kept": {sent: map[string]string{"postgres": "p1", "cache": "c1", "files": "f1"}, known: true,
-			kept: map[string]string{"postgres": "p1"}, want: map[string]string{"postgres": "p1", "files": "f2", "cache": "c1"}},
-		"sent but not known":   {sent: map[string]string{"cache": "c1"}, want: map[string]string{"postgres": "p2", "files": "f2"}},
-		"kept a module not in": {known: true, kept: map[string]string{"mail": "m1"}, want: map[string]string{"postgres": "p2", "files": "f2"}},
-	} {
-		in := compose.Input{CurrentBuilds: map[string]string{"postgres": "p2", "files": "f2", "cache": "c2"}}
-		node := compose.Node{SentBuilds: c.sent, SentKnown: c.known, KeptBuilds: c.kept}
-		if got := buildsOf(in, node, plan, leftOut); !reflect.DeepEqual(got, c.want) {
-			t.Errorf("%s: a send records %v, want %v", name, got, c.want)
-		}
-	}
-}
-
-// 1385: a declaration that stands in for a value anywhere is still foreseen, in a list the composition names or in the body
-// alone (a pair credential's stand-in is in no list); one that stands in for nothing is not. It failed first, before the body
-// was scanned.
-func TestADeclarationThatStandsInForAValueIsStillForeseen(t *testing.T) {
-	clean := compose.Declared{Resources: []map[string]any{{"id": "files.config", "type": "file", "content": "ok"}}}
-	if left := stillForeseen(clean); len(left) != 0 {
-		t.Fatalf("a declaration that stands in for nothing is foreseen: %v", left)
-	}
-	for name, d := range map[string]compose.Declared{
-		"an own secret":     {StoodIn: []string{"files/admin"}},
-		"a port":            {ForeseenPorts: []string{"files:80"}},
-		"a core box":        {CoreBoxesWanted: []compose.CoreBoxWanted{{Node: "anchor", Module: "mesh-vault", Name: "root"}}},
-		"a pass of a seat":  {Passes: compose.Passes{Passes: []catalogue.SeatPass{{Seat: catalogue.Seat{Name: "mesh-store"}}}}},
-		"a pair credential": {Resources: []map[string]any{{"id": "files.needs-db", "sealed": catalogue.ForeseenSealed}}},
-		"the certificate":   {Resources: []map[string]any{{"id": "proxy.cert", "content": compose.ForeseenCertificate}}},
-		"the bus's list":    {Resources: []map[string]any{{"id": "nats.users", "content": compose.ForeseenBusUsers}}},
-		"the vault's box":   {Resources: []map[string]any{{"id": "x", "box": catalogue.ForeseenVaultBox}}},
-	} {
-		if left := stillForeseen(d); len(left) == 0 {
-			t.Errorf("%s: a declaration that stands in for it is not foreseen", name)
-		}
-	}
-}
-
-// 1386: an Input read for a person's push is never the one read for a send that keeps recorded builds, and the cache is
-// emptied by what a send made.
-func TestAnInputIsCachedPerWhatItKeepsAndForgottenAfterASend(t *testing.T) {
-	ctx := withInputCache(context.Background())
-	plain := keptSignature(ctx)
-	kept := keptSignature(keepingRecorded(ctx))
-	bus := keptSignature(keepingRecorded(ctx, "nats"))
-	every := keptSignature(keepingEveryBuild(ctx, "anchor"))
-	for name, sig := range map[string]string{"a push": plain, "a kept send": kept, "the bus step": bus, "the grants step": every} {
-		for other, o := range map[string]string{"a push": plain, "a kept send": kept, "the bus step": bus, "the grants step": every} {
-			if name != other && sig == o {
-				t.Errorf("%s and %s read the same Input", name, other)
-			}
-		}
-	}
-	cache := ctx.Value(inputCacheKey{}).(*inputCache)
-	cache.by[plain] = &meshInput{}
-	forgetInput(ctx)
-	if len(cache.by) != 0 {
-		t.Fatal("what a send made left the Input it read in the cache")
-	}
-}

cmd/mesh-controller/composed_member_check_test.go

@@ -0,0 +1,68 @@
+//go:build integration
+
+package main
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// A member of a group whose gate is the composed check's is asked of the build seat with no module: its repository's
+// check alone (novox/hq ADR 0403 clause 1). With no word from mesh-delivery, or one that does not say the gate is
+// composed, it is checked alone with its gate (clause 6).
+
+func askedForMember(t *testing.T, answer []groupsLine, answerErr error) link.CheckRequest {
+	t.Helper()
+	open := aMesh(t)
+	ctx := t.Context()
+	js, _ := aBuildQueue(t)
+	servingBus.Store(js)
+	t.Cleanup(func() { servingBus.Store(nil) })
+	if err := open.inventory.RegisterModule(ctx, catalogue.Manifest{Module: "mesh-controller", Version: "1"},
+		inventory.Source{Repository: "novox/mesh-controller", Ref: "main", BuiltFrom: "c0", Head: "c0"}); err != nil {
+		t.Fatal(err)
+	}
+	was := groupsAsked
+	groupsAsked = func(context.Context, bool) ([]groupsLine, error) { return answer, answerErr }
+	t.Cleanup(func() { groupsAsked = was })
+	p := link.PullUpdated{Owner: "novox", Repo: "mesh-controller", Number: 346, Base: "main", Head: "feat/x", Commit: headController,
+		Paths: []string{"main.go"}, ModuleDirsSaid: true, MergeCheck: true, MergeCheckSaid: true}
+	if err := (following{open: open, oneShot: true}).PullUpdated(ctx, p); err != nil {
+		t.Fatal(err)
+	}
+	q, err := link.ReadQueue(ctx, js, link.TheBuildMachine)
+	if err != nil || len(q.Asks) != 1 {
+		t.Fatalf("asks %d: %v", len(q.Asks), err)
+	}
+	return *q.Asks[0].Request.Check
+}
+
+func TestAComposedMembersCheckIsItsRepositoryChecksAlone(t *testing.T) {
+	line := group("feat/x", member("novox/mesh-controller", 346, headController, "main", true), member("novox/mesh-catalog", 350, headHost, "main", true))
+	line.ComposedGate = true
+	c := askedForMember(t, []groupsLine{line}, nil)
+	if len(c.Modules) != 0 || len(c.New) != 0 || len(c.Dependents) != 0 || !c.Composed {
+		t.Fatalf("the member's check is asked as %+v; want no module and composed", c)
+	}
+}
+
+func TestAMemberOfAGroupOfAnOlderMeshDeliveryKeepsItsOwnGate(t *testing.T) {
+	line := group("feat/x", member("novox/mesh-controller", 346, headController, "main", true), member("novox/mesh-catalog", 350, headHost, "main", true))
+	c := askedForMember(t, []groupsLine{line}, nil)
+	if !strings.Contains(strings.Join(c.Modules, ","), "mesh-controller") || c.Composed {
+		t.Fatalf("an older mesh-delivery's member is asked as %+v; want its own gate", c)
+	}
+}
+
+func TestAMemberWhoseGroupCannotBeLearnedIsCheckedAloneWithItsGate(t *testing.T) {
+	c := askedForMember(t, nil, context.DeadlineExceeded)
+	if !strings.Contains(strings.Join(c.Modules, ","), "mesh-controller") || c.Composed ||
+		!strings.Contains(c.SiblingsUnknown, "reads no siblings") {
+		t.Fatalf("the member is asked as %+v; want its gate and why its siblings are unknown", c)
+	}
+}

cmd/mesh-controller/composed_verdict_test.go

@@ -1,21 +1,50 @@
 package main
 
 import (
+	"context"
 	"encoding/json"
 	"strings"
 	"testing"
 
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
 
 // A delivery group's gate is the composed check's, and its members' own checks run their repository's check alone
 // (novox/hq ADR 0403 clauses 1 and 7). Pure: no store, no bus.
 
-// The heads of a group's members, by repository.
-const (
-	headHost       = "1111111111111111111111111111111111111111"
-	headController = "2222222222222222222222222222222222222222"
-)
+// A member of a group whose line says composed_gate is a composed member; one whose group says nothing of it (an older
+// mesh-delivery), one of a group of a single pull request and a lone pull request are not.
+func TestAMemberOfAComposedGroupIsKnownByTheGroupsLine(t *testing.T) {
+	two := func(composed bool) groupsLine {
+		l := group("feat/x", member("novox/mesh-host", 114, headHost, "main", true), member("novox/mesh-controller", 346, headController, "main", true))
+		l.ComposedGate = composed
+		return l
+	}
+	p := link.PullUpdated{Owner: "novox", Repo: "mesh-host", Number: 114, Base: "main", Head: "feat/x", Commit: headHost}
+	recheck := link.PullUpdated{Owner: "novox", Repo: "mesh-host", Number: 114, Base: "main", Commit: headHost}
+	for name, c := range map[string]struct {
+		p     link.PullUpdated
+		lines []groupsLine
+		want  bool
+	}{
+		"composed":                 {p, []groupsLine{two(true)}, true},
+		"a recheck, by its number": {recheck, []groupsLine{two(true)}, true},
+		"an older mesh-delivery":   {p, []groupsLine{two(false)}, false},
+		"another group":            {p, []groupsLine{group("feat/y", member("novox/mesh-host", 1, headHost, "main", true))}, false},
+		"no group":                 {p, nil, false},
+	} {
+		if got := composedMember(c.p, c.lines); got != c.want {
+			t.Errorf("%s: composed %v, want %v", name, got, c.want)
+		}
+	}
+	alone := group("feat/x", member("novox/mesh-host", 114, headHost, "main", true))
+	alone.ComposedGate = true
+	if composedMember(p, []groupsLine{alone}) {
+		t.Error("a group of a single pull request is composed")
+	}
+}
 
 // A composed member's verdict never says its gate passed: the gate layer, and the verdict that is the gate's, read
 // "composed"; a failure or an error stays what it was.
@@ -59,3 +88,49 @@ func TestTheComposedVerdictCarriesEveryMember(t *testing.T) {
 		}
 	}
 }
+
+// Members whose manifests order their modules in a cycle fail the composed check, naming every module and edge, and no
+// ask is made of the build seat.
+func TestAGroupInACycleFailsItsComposedCheckWithoutABuild(t *testing.T) {
+	members := []orderMember{
+		{ID: "novox/x@" + headHost[:12], Repository: "novox/x", Base: "main", Head: headHost, Number: 7, Paths: []string{"module.json"}},
+		{ID: "novox/y@" + headController[:12], Repository: "novox/y", Base: "main", Head: headController, Number: 9, Paths: []string{"module.json"}},
+	}
+	reach := map[string]orderReach{members[0].ID: {Moved: []string{"mx"}}, members[1].ID: {Moved: []string{"my"}}}
+	was, wasParent := manifestAt, parentOf
+	t.Cleanup(func() { manifestAt, parentOf = was, wasParent })
+	parentOf = func(context.Context, string, string, string) (string, error) { return "", nil }
+	manifestAt = func(_ context.Context, _, repo, _, ref string) (catalogue.Manifest, bool, error) {
+		if ref == "main" {
+			return catalogue.Manifest{}, false, nil // what the pull requests merge into holds no such manifest
+		}
+		if repo == "x" {
+			return catalogue.Manifest{Module: "mx", DefinesSeats: []catalogue.SeatDeclaration{{Name: "s", Serves: []catalogue.Verb{{Name: "a"}}}},
+				Invokes: []string{"seat:s.b"}}, true, nil
+		}
+		return catalogue.Manifest{Module: "my", DefinesSeats: []catalogue.SeatDeclaration{{Name: "s", Serves: []catalogue.Verb{{Name: "b"}}}},
+			Invokes: []string{"seat:s.a"}}, true, nil
+	}
+	c, cyclic, err := cycleVerdict(context.Background(), "feat/cycle", members, reach, []inventory.Edge(nil), nil)
+	if err != nil || !cyclic {
+		t.Fatalf("no cycle found: %v", err)
+	}
+	if c.Verdict != "fail" || c.Group != "feat/cycle" || len(c.Members) != 2 || c.Gate == nil || c.Gate.Verdict != "fail" {
+		t.Fatalf("the verdict is %+v", c)
+	}
+	for _, w := range []string{"mx", "my", "s.a", "s.b"} {
+		if !strings.Contains(c.Summary, w) {
+			t.Errorf("the cycle does not name %s: %s", w, c.Summary)
+		}
+	}
+	// Members with no edge between them are no cycle.
+	manifestsReadMu.Lock()
+	clear(manifestsRead)
+	manifestsReadMu.Unlock()
+	manifestAt = func(context.Context, string, string, string, string) (catalogue.Manifest, bool, error) {
+		return catalogue.Manifest{}, false, nil
+	}
+	if _, cyclic, err := cycleVerdict(context.Background(), "feat/cycle", members, reach, nil, nil); err != nil || cyclic {
+		t.Fatalf("a cycle where there is none: %v %v", cyclic, err)
+	}
+}

cmd/mesh-controller/config_move.go

@@ -15,8 +15,8 @@ import (
 	"github.com/nats-io/nats.go"
 	"github.com/nats-io/nats.go/jetstream"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )

cmd/mesh-controller/config_moved_integration_test.go

@@ -13,8 +13,8 @@ import (
 	"testing"
 	"time"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/overlay"
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/overlay"
 )
 
 func aConfiguredMesh(t *testing.T) (*stores, configuredMesh, map[string]map[string]any) {

cmd/mesh-controller/config_moved_test.go

@@ -7,8 +7,8 @@ import (
 	"strings"
 	"testing"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	snapshot "git.novox.be/novox/mesh-sdk/go/facts"
+	"github.com/novox/mesh-controller/internal/catalogue"
+	snapshot "github.com/novox/mesh-controller/internal/facts"
 	"github.com/novox/mesh-controller/internal/link"
 )
 
@@ -127,17 +127,21 @@ type snapshotFacts = snapshot.Facts
 func toldEveryMachine(t *testing.T, open *stores, served map[string]map[string]any, on map[string][]string) map[string]string {
 	t.Helper()
 	ctx := t.Context()
+	gens, err := generators(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
 	shelf, err := open.inventory.Catalogue(ctx)
 	if err != nil {
 		t.Fatal(err)
 	}
 	told := map[string]string{}
 	for _, node := range fourMachines {
-		plan, _, err := resolveNode(ctx, open, node)
+		plan, settings, err := planFor(ctx, open, node)
 		if err != nil {
 			t.Fatalf("%s: %v", node, err)
 		}
-		with, err := madeAndRendered(ctx, open, node)
+		with, _, err := renderingFor(ctx, open, node, plan, settings, gens, Allocating)
 		if err != nil {
 			t.Fatalf("%s: %v", node, err)
 		}

cmd/mesh-controller/container_groups_test.go

@@ -1,65 +0,0 @@
-package main
-
-import (
-	"io"
-	"os"
-	"strings"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-)
-
-// Issue 1638 (novox/hq ADR 0480 clause 7), taken in with mesh-sdk's container `groups`: the controller sends a container's
-// groups only to a node-engine that reports the capability container-groups, and holds the module on any other, naming it.
-
-const n8nWithAGroup = `{"module":"n8n","version":"1",
-  "config":{"media-gid":{"type":"number","minimum":1,"required":true,"description":"the group that owns the media library"}},
-  "resources":[{"id":"server","type":"container","name":"n8n",
-    "image":"n8nio/n8n@sha256:4846eb2f4b874ab04cde7fc1e249d2ddaec66e9aea64439beb2972cfea88e3c0",
-    "groups":["${config:media-gid}"]}]}`
-
-// printedBy runs reportUnhostable and returns what it printed.
-func printedBy(t *testing.T, node string, plan catalogue.Resolution) string {
-	t.Helper()
-	stdout := os.Stdout
-	r, w, err := os.Pipe()
-	if err != nil {
-		t.Fatal(err)
-	}
-	os.Stdout = w
-	reportUnhostable(node, plan)
-	w.Close()
-	os.Stdout = stdout
-	out, _ := io.ReadAll(r)
-	return string(out)
-}
-
-// 1638/AC1: a node that reports the capability gets the module; one that does not has it held, the capability named.
-func TestAModuleWithGroupsIsHeldOnANodeThatDoesNotReportTheCapability(t *testing.T) {
-	m, err := catalogue.ParseManifest([]byte(n8nWithAGroup))
-	if err != nil {
-		t.Fatal(err)
-	}
-	shelf := catalogue.Shelf{"n8n": m}
-	reads := catalogue.Node{Name: "ace", Capabilities: map[string]bool{"container-runtime": true, "container-groups": true}}
-	old := catalogue.Node{Name: "g14", Capabilities: map[string]bool{"container-runtime": true}}
-
-	got, err := catalogue.Resolve(shelf, []string{"n8n"}, reads, catalogue.World{})
-	if err != nil || len(got.Unhostable) != 0 || len(got.Modules) != 1 {
-		t.Fatalf("a node that reads groups: %v, held %+v", err, got.Unhostable)
-	}
-	if out := printedBy(t, "ace", got); out != "" {
-		t.Errorf("a node that reads groups was told: %q", out)
-	}
-
-	got, err = catalogue.Resolve(shelf, []string{"n8n"}, old, catalogue.World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(got.Modules) != 0 || len(got.Unhostable) != 1 {
-		t.Fatalf("n8n was sent to a node that does not report container-groups: hosted %d, held %+v", len(got.Modules), got.Unhostable)
-	}
-	if out := printedBy(t, "g14", got); !strings.Contains(out, "n8n") || !strings.Contains(out, "container-groups") {
-		t.Errorf("the hold does not name the module and the capability: %q", out)
-	}
-}

cmd/mesh-controller/core_box.go

@@ -13,9 +13,10 @@ import (
 	"sort"
 	"strings"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
 )
 
 // The core's own credentials, sealed by the vault (novox/hq ADR 0349 §16, issue 755; the lead's decision on issue 755,
@@ -39,6 +40,15 @@ import (
 // the vault and the machine, cleared by the first send the vault answers whole. Only a machine with no sealing key, or
 // one whose key cannot be read, leaves its module out.
 
+// engineOpensVaultBox says whether a machine's node-engine opens the vault's box, by its own newest statement.
+func engineOpensVaultBox(ctx context.Context, inv *inventory.Inventory, node string) (bool, error) {
+	stated, had, err := inv.HealthOf(ctx, node)
+	if err != nil {
+		return false, err
+	}
+	return had && stated.Contract >= link.VaultBoxContract, nil
+}
+
 // coreAnswer is the vault's `get` answer as the controller reads it: the name, the generation and the box, never
 // opened.
 type coreAnswer struct {
@@ -111,7 +121,7 @@ func sealingKeyPEM(raw string) (string, error) {
 // own seal where nothing was kept; on any other question, the kept box, or a stand-in the next send asks for. Pure: what to keep and what to
 // say is answered, not done.
 func coreBoxesOf(node, sealingKey string, core map[string][]string, kept map[string]map[string]inventory.CoreBox,
-	allocating bool, ask coreAsk) coreBoxes {
+	choosing Choosing, ask coreAsk) coreBoxes {
 	out := coreBoxes{sealed: map[string]map[string]json.RawMessage{}, notPlaced: map[string]string{}}
 	modules := make([]string, 0, len(core))
 	for m := range core {
@@ -133,7 +143,7 @@ func coreBoxesOf(node, sealingKey string, core map[string][]string, kept map[str
 		for _, name := range core[module] {
 			k, has := kept[module][name]
 			valid := has && k.SealedTo == sealingKey && len(k.Box) > 0
-			if !allocating {
+			if choosing != Allocating {
 				if valid {
 					boxes[name] = k.Box
 				} else {
@@ -208,10 +218,10 @@ var coreVault = func(ctx context.Context) coreAsk {
 
 // coreBoxesFor is coreBoxesOf for one machine, read from and kept in the store, and said on a send.
 func coreBoxesFor(ctx context.Context, inv *inventory.Inventory, node string, modules []catalogue.Manifest,
-	handed func(catalogue.Manifest) bool, allocating bool) (coreBoxes, error) {
+	handed func(catalogue.Manifest) bool, choosing Choosing) (coreBoxes, error) {
 	core := coreModulesOf(modules, handed)
 	if len(core) == 0 {
-		if allocating {
+		if choosing == Allocating {
 			settleVaultSilent(ctx, node)
 		}
 		return coreBoxes{}, nil
@@ -225,16 +235,16 @@ func coreBoxesFor(ctx context.Context, inv *inventory.Inventory, node string, mo
 		return coreBoxes{}, err
 	}
 	var ask coreAsk
-	if allocating {
+	if choosing == Allocating {
 		ask = coreVault(ctx)
 	}
-	out := coreBoxesOf(node, key, core, kept, allocating, ask)
+	out := coreBoxesOf(node, key, core, kept, choosing, ask)
 	for _, b := range out.keep {
 		if err := inv.KeepCoreBox(ctx, node, b); err != nil {
 			return coreBoxes{}, err
 		}
 	}
-	if allocating {
+	if choosing == Allocating {
 		sayVaultSilent(ctx, node, out)
 	}
 	return out, nil

cmd/mesh-controller/core_box_integration_test.go

@@ -10,8 +10,8 @@ import (
 	"testing"
 	"time"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
@@ -96,7 +96,7 @@ func TestASilentVaultHoldsTheKeptBoxAndSaysSo(t *testing.T) {
 func TestACoreModuleFirstPlacedWhileTheVaultIsSilentIsSealedByTheController(t *testing.T) {
 	open, vault := aCoreMesh(t, link.VaultBoxContract)
 	vault.silent = errors.New("no responders")
-	plan, settings, err := resolveNode(t.Context(), open, "laptop")
+	plan, settings, err := planFor(t.Context(), open, "laptop")
 	if err != nil {
 		t.Fatal(err)
 	}

cmd/mesh-controller/core_box_test.go

@@ -8,8 +8,8 @@ import (
 	"strings"
 	"testing"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
@@ -68,7 +68,7 @@ func TestReplay908(t *testing.T) {
 	key := "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8="
 	core := map[string][]string{"nats": {"password"}}
 	ask := func(name, publicKey string) (coreAnswer, error) { return coreAnswer{}, errors.New("no responders") }
-	got := coreBoxesOf("novox", key, core, nil, true, ask)
+	got := coreBoxesOf("novox", key, core, nil, Allocating, ask)
 	if _, sealed := got.sealed["nats"]; sealed || len(got.notPlaced) != 0 {
 		t.Fatalf("nats is vault-sealed %v or not placed %v", got.sealed, got.notPlaced)
 	}
@@ -81,7 +81,7 @@ func TestReplay908(t *testing.T) {
 	}
 	// A kept box is still carried while the vault is silent.
 	kept := map[string]map[string]inventory.CoreBox{"nats": {"password": {SealedTo: key, Box: json.RawMessage(`{"v":1}`)}}}
-	got = coreBoxesOf("novox", key, core, kept, true, ask)
+	got = coreBoxesOf("novox", key, core, kept, Allocating, ask)
 	if string(got.sealed["nats"]["password"]) != `{"v":1}` || len(got.byController) != 0 {
 		t.Fatalf("the kept box was not held: %+v", got)
 	}
@@ -99,17 +99,17 @@ func TestOnlyASendAsksTheVault(t *testing.T) {
 		t.Fatal("the vault was asked by a question that is not a send")
 		return coreAnswer{}, nil
 	}
-	for _, allocating := range []bool{false} {
-		if got := coreBoxesOf("anchor", key, core, kept, allocating, never); string(got.sealed["nats"]["broker"]) != `{"v":1}` {
+	for _, choosing := range []Choosing{Reading, Foreseeing} {
+		if got := coreBoxesOf("anchor", key, core, kept, choosing, never); string(got.sealed["nats"]["broker"]) != `{"v":1}` {
 			t.Errorf("read %s", got.sealed["nats"]["broker"])
 		}
-		if got := coreBoxesOf("anchor", key, core, nil, allocating, never); string(got.sealed["nats"]["broker"]) !=
+		if got := coreBoxesOf("anchor", key, core, nil, choosing, never); string(got.sealed["nats"]["broker"]) !=
 			string(catalogue.ForeseenVaultBox) {
 			t.Errorf("with none kept, read %s", got.sealed["nats"]["broker"])
 		}
 	}
 	// A box kept for another key of the machine is never carried.
-	other := coreBoxesOf("anchor", aPublicKey(t), core, kept, true,
+	other := coreBoxesOf("anchor", aPublicKey(t), core, kept, Allocating,
 		func(string, string) (coreAnswer, error) { return coreAnswer{}, errors.New("silent") })
 	if _, vaultSealed := other.sealed["nats"]; vaultSealed || !reflect.DeepEqual(other.byController, []string{"nats"}) {
 		t.Fatalf("a box sealed to the machine's old key was carried: %+v", other)

cmd/mesh-controller/credential_on_assign_test.go

@@ -6,7 +6,7 @@ import (
 	"strings"
 	"testing"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
@@ -40,7 +40,7 @@ func TestAssigningAModuleThatSpeaksOnTheBusNamesItsCredential(t *testing.T) {
 	}
 
 	// And the push refuses to send it, naming the same verb, rather than sealing a placeholder.
-	plan, settings, err := resolveNode(ctx, open, "laptop")
+	plan, settings, err := planFor(ctx, open, "laptop")
 	if err != nil {
 		t.Fatal(err)
 	}

cmd/mesh-controller/data.go

@@ -14,7 +14,7 @@ import (
 
 	"github.com/nats-io/nats.go"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
@@ -152,8 +152,6 @@ type consumerCopy struct {
 
 // probeData is D13.
 func probeData(ctx context.Context, d *doctor) ([]conditions.Observation, error) {
-	// One reading of the mesh for every machine this looks at.
-	ctx = withInputCache(ctx)
 	if d.js == nil {
 		return nil, errors.New("no bus to ask the machines over")
 	}
@@ -182,7 +180,7 @@ func probeData(ctx context.Context, d *doctor) ([]conditions.Observation, error)
 	}
 	var machines []*machine
 	for _, n := range nodes {
-		plan, _, err := resolveNode(ctx, open, n.Name)
+		plan, _, err := planFor(ctx, open, n.Name)
 		if err != nil {
 			if ctx.Err() != nil {
 				return nil, ctx.Err()
@@ -851,7 +849,7 @@ func deleteRetiredData(ctx context.Context, conn *nats.Conn, open *stores, r inv
 		return fmt.Errorf("%s of %s on %s was never measured, so where it is was never said; nothing was deleted",
 			r.Item, r.Module, r.Machine)
 	}
-	if plan, _, err := resolveNode(ctx, open, r.Machine); err == nil {
+	if plan, _, err := planFor(ctx, open, r.Machine); err == nil {
 		for _, m := range plan.Modules {
 			if _, still := m.DataItem(r.Item); still && m.Module == r.Module {
 				return fmt.Errorf("%s runs on %s again and declares %s: it is not retired any more. Nothing was done",

cmd/mesh-controller/data_integration_test.go

@@ -8,8 +8,8 @@ import (
 	"testing"
 	"time"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/testbus"

cmd/mesh-controller/data_test.go

@@ -11,7 +11,7 @@ import (
 
 	"github.com/novox/mesh-controller/internal/link"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 )

cmd/mesh-controller/deadletters.go

@@ -9,8 +9,8 @@ import (
 
 	"github.com/nats-io/nats.go"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/link"
 )

cmd/mesh-controller/declaration_capability_integration_test.go

@@ -1,110 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"encoding/json"
-	"fmt"
-	"strings"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	sdkdecl "git.novox.be/novox/mesh-sdk/go/declaration"
-	"git.novox.be/novox/mesh-sdk/go/overlay"
-
-	"git.novox.be/novox/mesh-sdk/go/compose"
-)
-
-// 1696/AC2, ADR 0486 §5: a node is sent a file by digest only when its profile reports the capability. A node whose profile lacks
-// it, and a node the mesh has no profile of, are sent every content inline; a node that reports it is sent the reference. The test
-// goes through composeQuestion and composeSend, the two places readsFileReferences is read (compose_sdk.go).
-func TestAFileTravelsByDigestOnlyToANodeThatReportsTheCapability(t *testing.T) {
-	open := aMesh(t) // anchor and laptop report no file-references
-	ctx := t.Context()
-	big := strings.Repeat("0123456789abcdef", 8<<10) // 128 KiB
-	register(t, open, catalogue.Manifest{Module: "bigfile", Version: "1",
-		Resources: []map[string]any{{"id": "blob", "type": "file", "path": "/etc/bigfile/blob", "mode": "0644", "content": big}}})
-
-	// reader reports the capability; bare has never reported a profile at all.
-	for i, n := range []struct {
-		name    string
-		profile map[string]any
-	}{
-		{"reader", map[string]any{"capabilities": []any{
-			map[string]any{"name": "container-runtime", "present": true},
-			map[string]any{"name": "systemd", "present": true},
-			map[string]any{"name": sdkdecl.FileReferencesCapability, "present": true}}}},
-		{"bare", nil},
-	} {
-		record, err := open.inventory.AddNode(ctx, n.name)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if err := open.inventory.SetPlace(ctx, n.name, n.name+".example:51820", "here", false, fmt.Sprintf("10.77.0.%d", i+10)); err != nil {
-			t.Fatal(err)
-		}
-		if n.profile != nil {
-			if err := open.inventory.RecordProfile(ctx, record.ID, n.profile); err != nil {
-				t.Fatal(err)
-			}
-		}
-		if err := open.inventory.RecordSealingKey(ctx, record.ID, aPublicKey(t)); err != nil {
-			t.Fatal(err)
-		}
-		if err := open.inventory.RecordOverlayKey(ctx, record.ID, aPublicKey(t)); err != nil {
-			t.Fatal(err)
-		}
-		if _, err := open.inventory.Assign(ctx, n.name, overlay.Name); err != nil {
-			t.Fatal(err)
-		}
-	}
-	for _, node := range []string{"laptop", "reader", "bare"} {
-		if _, err := assign(ctx, open, node, "bigfile"); err != nil {
-			t.Fatalf("assign %s: %v", node, err)
-		}
-	}
-
-	byDigest := map[string]bool{"laptop": false, "bare": false, "reader": true}
-	for node, want := range byDigest {
-		asked, _, err := composeQuestion(ctx, open, node, compose.Reading, false)
-		if err != nil {
-			t.Fatalf("%s: %v", node, err)
-		}
-		sent, err := composeSend(ctx, open, node)
-		if err != nil {
-			t.Fatalf("%s: %v", node, err)
-		}
-		for what, s := range map[string]sendable{"question": asked, "send": sent} {
-			if s.fileReferences != want {
-				t.Fatalf("%s, %s: fileReferences %v, want %v", node, what, s.fileReferences, want)
-			}
-			body, err := s.Body()
-			if err != nil {
-				t.Fatal(err)
-			}
-			var got struct {
-				Resources []map[string]any `json:"resources"`
-			}
-			if err := json.Unmarshal(body, &got); err != nil {
-				t.Fatal(err)
-			}
-			var found bool
-			for _, r := range got.Resources {
-				if r["path"] != "/etc/bigfile/blob" {
-					continue
-				}
-				found = true
-				inline := r["content"] == big
-				if want && (inline || r["digest"] == nil || r["size"] == nil) {
-					t.Fatalf("%s, %s: a node that reads references is sent the content inline", node, what)
-				}
-				if !want && (!inline || r["digest"] != nil) {
-					t.Fatalf("%s, %s: a node that does not report the capability is sent a reference", node, what)
-				}
-			}
-			if !found {
-				t.Fatalf("%s, %s: the file is not in the declaration", node, what)
-			}
-		}
-	}
-}

cmd/mesh-controller/declaration_files.go

@@ -1,253 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"sort"
-	"sync"
-
-	"git.novox.be/novox/mesh-sdk/go/compose"
-	sdkdecl "git.novox.be/novox/mesh-sdk/go/declaration"
-	"github.com/nats-io/nats.go"
-	"github.com/nats-io/nats.go/jetstream"
-
-	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/conditions"
-)
-
-// **A declaration's large files travel by their digest to a node that can read one** (novox/hq ADR 0486 §1, §5, issue 1696).
-//
-// The declaration to a node that reports sdkdecl.FileReferencesCapability carries, in place of the content of every
-// file resource of more than sdkdecl.FileReferenceThreshold bytes that may travel so (File.TravelsByDigest: plain content or
-// bytes, not sealed, not filled with secrets, not written into another file), its sha256 digest and size. The content is put
-// into the bucket of the bus under the hex of the digest before the declaration is sent. A node that does not report the
-// capability is sent every content inline, as before: an older node-engine refuses a field it does not know, whole.
-
-// readsFileReferences says the node reports the capability of reading a file given by digest (ADR 0486 §5). A node the mesh has
-// no profile of reads none.
-func readsFileReferences(in compose.Input, node string) bool {
-	n, ok := nodeOf(in, node)
-	return ok && n.Capabilities[sdkdecl.FileReferencesCapability]
-}
-
-// referencing is the resources as a node that reads references is sent them, and the content of each file that went by
-// digest, by the name of its object (the hex of its digest). The resources it is given are not changed. A file that does not
-// travel by digest is passed as it is.
-func referencing(resources []map[string]any) ([]map[string]any, map[string][]byte, error) {
-	out := make([]map[string]any, len(resources))
-	var objects map[string][]byte
-	for i, r := range resources {
-		out[i] = r
-		if kind, _ := r["type"].(string); kind != string(sdkdecl.TypeFile) {
-			continue
-		}
-		// Cheap first: only a file with a content or bytes of the size is worth reading whole.
-		content, _ := r["content"].(string)
-		bytesField, _ := r["bytes"].(string)
-		if len(content) <= sdkdecl.FileReferenceThreshold && len(bytesField) <= sdkdecl.FileReferenceThreshold {
-			continue
-		}
-		raw, err := json.Marshal(r)
-		if err != nil {
-			return nil, nil, fmt.Errorf("resource %v: %w", r["id"], err)
-		}
-		var f sdkdecl.File
-		if err := json.Unmarshal(raw, &f); err != nil {
-			return nil, nil, fmt.Errorf("resource %v is not a file the controller can read: %w", r["id"], err)
-		}
-		if !f.TravelsByDigest() {
-			continue
-		}
-		ref, body, err := f.AsReference()
-		if err != nil {
-			return nil, nil, err
-		}
-		name, err := sdkdecl.ObjectName(ref.Digest)
-		if err != nil {
-			return nil, nil, err
-		}
-		with := make(map[string]any, len(r)+2)
-		for k, v := range r {
-			with[k] = v
-		}
-		delete(with, "content")
-		delete(with, "bytes")
-		with["digest"], with["size"] = ref.Digest, ref.Size
-		out[i] = with
-		if objects == nil {
-			objects = map[string][]byte{}
-		}
-		objects[name] = body
-	}
-	return out, objects, nil
-}
-
-// namedObjects are the objects of the bucket a body names: the object name of every file resource given by reference,
-// with its size. It reads a declaration as the node does, so it also reads the latest one the bus holds.
-func namedObjects(body []byte) (map[string]int64, error) {
-	var envelope struct {
-		Resources []struct {
-			Type   string `json:"type"`
-			Digest string `json:"digest"`
-			Size   int64  `json:"size"`
-		} `json:"resources"`
-	}
-	if err := json.Unmarshal(body, &envelope); err != nil {
-		return nil, err
-	}
-	var out map[string]int64
-	for _, r := range envelope.Resources {
-		if r.Type != string(sdkdecl.TypeFile) || r.Digest == "" {
-			continue
-		}
-		name, err := sdkdecl.ObjectName(r.Digest)
-		if err != nil {
-			return nil, err
-		}
-		if out == nil {
-			out = map[string]int64{}
-		}
-		out[name] = r.Size
-	}
-	return out, nil
-}
-
-// objectStore is what putting the objects needs of a node's bucket.
-type objectStore interface {
-	// Has says whether an object of that name is there, complete, and whether it carries the sweep's mark of being named by no
-	// node's latest declaration.
-	Has(ctx context.Context, name string) (have, marked bool, err error)
-	// Put writes the object under that name, replacing one of the same name (and so erasing its mark).
-	Put(ctx context.Context, name string, content []byte) error
-}
-
-// putObjects makes sure every object of the declaration is in the bucket before the declaration that names it is sent: a node
-// that reads the declaration finds each object. An object already there (the same content, the same name) is not written again,
-// **unless the sweep marked it unnamed**: then it is written again, so the mark that would have it removed is gone with the
-// old object (issue 1696, review: a mark read just before a send must not take an object the send relies on). Refuses on the
-// first it cannot put, naming it, so the declaration is not sent.
-func putObjects(ctx context.Context, store objectStore, objects map[string][]byte) error {
-	names := make([]string, 0, len(objects))
-	for name := range objects {
-		names = append(names, name)
-	}
-	sort.Strings(names)
-	for _, name := range names {
-		have, marked, err := store.Has(ctx, name)
-		if err != nil {
-			return fmt.Errorf("whether the object %s is in the bucket: %w", name[:12], err)
-		}
-		if have && !marked {
-			continue
-		}
-		if err := store.Put(ctx, name, objects[name]); err != nil {
-			return fmt.Errorf("putting the object %s (%d bytes) in the bucket: %w", name[:12], len(objects[name]), err)
-		}
-	}
-	return nil
-}
-
-// busObjects is a node's bucket on the controller's own connection.
-type busObjects struct{ store jetstream.ObjectStore }
-
-// openBucket opens the bucket of a node's files, making it first if it is not there (it is asserted for every node at the
-// controller's start; a node adopted since is covered here).
-func openBucket(ctx context.Context, conn *nats.Conn, node string) (busObjects, error) {
-	js, err := jetstream.New(conn)
-	if err != nil {
-		return busObjects{}, err
-	}
-	bucket, err := broker.DeclarationFilesBucketOf(node)
-	if err != nil {
-		return busObjects{}, fmt.Errorf("the object bucket of node %q: %w", node, err)
-	}
-	store, err := js.ObjectStore(ctx, bucket)
-	if errors.Is(err, jetstream.ErrBucketNotFound) {
-		if err = broker.EnsureDeclarationFiles(ctx, js, node); err == nil {
-			store, err = js.ObjectStore(ctx, bucket)
-		}
-	}
-	if err != nil {
-		return busObjects{}, fmt.Errorf("the object bucket %s: %w", bucket, err)
-	}
-	return busObjects{store}, nil
-}
-
-func (b busObjects) Has(ctx context.Context, name string) (bool, bool, error) {
-	info, err := b.store.GetInfo(ctx, name)
-	switch {
-	case errors.Is(err, jetstream.ErrObjectNotFound):
-		return false, false, nil
-	case err != nil:
-		return false, false, err
-	}
-	_, marked := info.Metadata[declarationUnnamed]
-	return !info.Deleted, marked, nil
-}
-
-func (b busObjects) Put(ctx context.Context, name string, content []byte) error {
-	_, err := b.store.PutBytes(ctx, name, content)
-	return err
-}
-
-// filesLocks hold a node's bucket for one act at a time in this process: a send puts its objects and publishes the declaration that
-// names them under the node's lock, and the sweep judges the node's bucket under the same one, so the sweep never removes an
-// object between a send's put and its declaration. Another process (a person's push) is covered by the put erasing a mark and by
-// the sweep looking at an object again just before it removes it.
-var filesLocks sync.Map
-
-func lockFilesOf(node string) func() {
-	l, _ := filesLocks.LoadOrStore(node, &sync.Mutex{})
-	mu := l.(*sync.Mutex)
-	mu.Lock()
-	return mu.Unlock
-}
-
-// kindFilesNotPut is a node whose files that travel by digest could not be put in its bucket, send after send.
-const kindFilesNotPut = "declaration-files-not-put"
-
-// filesNotPutAfter is how many sends in a row may fail to put before the condition is raised: the first send to the machine holding
-// the bus fails for want of the grant that very send delivers, and says so, and is not yet a fault.
-const filesNotPutAfter = 2
-
-var (
-	filesFailMu sync.Mutex
-	filesFailed = map[string]int{}
-)
-
-func filesNotPutObservation(node, summary string) conditions.Observation {
-	return conditions.Observation{Scope: conditions.ScopeMachine, ID: node, Kind: kindFilesNotPut, Token: kindFilesNotPut,
-		Machine: node, Severity: conditions.Warning, Source: "sends", Summary: summary}
-}
-
-// notePut records how putting a send's objects went: a failure counts, the second in a row raises the condition, a success
-// clears the count and the condition.
-func notePut(ctx context.Context, node string, put error) {
-	filesFailMu.Lock()
-	if put == nil {
-		delete(filesFailed, node)
-	} else {
-		filesFailed[node]++
-	}
-	n := filesFailed[node]
-	filesFailMu.Unlock()
-	keeper := conditionsFrom
-	if keeper == nil {
-		return
-	}
-	key := filesNotPutObservation(node, "").Key()
-	switch {
-	case put == nil:
-		if _, err := keeper.Clear(ctx, key, node+" was sent its files by digest"); err != nil {
-			fmt.Printf("the condition %s could not be cleared: %v\n", key, err)
-		}
-	case n >= filesNotPutAfter:
-		summary := fmt.Sprintf("%s's files that travel by digest could not be put in its bucket %d sends in a row, so it is sent them "+
-			"inline: %v", node, n, put)
-		if _, err := keeper.Observe(ctx, filesNotPutObservation(node, summary)); err != nil {
-			fmt.Printf("the condition %s could not be raised: %v\n", key, err)
-		}
-	}
-}

cmd/mesh-controller/declaration_files_integration_test.go

@@ -1,246 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"strings"
-	"testing"
-	"time"
-
-	sdkdecl "git.novox.be/novox/mesh-sdk/go/declaration"
-	"github.com/nats-io/nats.go"
-	"github.com/nats-io/nats.go/jetstream"
-
-	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/link"
-	"github.com/novox/mesh-controller/internal/testbus"
-)
-
-type sigOf struct{}
-
-func (sigOf) Sign(context.Context, []byte) ([]byte, error) { return make([]byte, 64), nil }
-
-// 1696/AC7 (ADR 0486 §1): on a real bus with its default largest message of 1 MiB, a declaration whose files add up to more than
-// 3 MiB is sent as references, its objects are in the bucket, each fetched back whole and verified against the digest and size the
-// declaration names; the same declaration inline is refused by the controller, naming size and limit. A changed byte in an object
-// fails the verification.
-func TestADeclarationOfMoreThanThreeMiBIsSentByReferenceOnARealBus(t *testing.T) { // 1696/AC7
-	s := testbus.Start(t)
-	conn, err := nats.Connect(s.ClientURL())
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer conn.Close()
-	nc, err := conn.JetStream()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := nc.AddStream(&nats.StreamConfig{Name: "NODES", Subjects: []string{"mesh.node.*.declare"},
-		MaxMsgsPerSubject: 1}); err != nil {
-		t.Fatal(err)
-	}
-	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
-	defer cancel()
-	api, err := jetstream.New(conn)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := broker.EnsureDeclarationFiles(ctx, api, "novox"); err != nil {
-		t.Fatal(err)
-	}
-	// Run twice: an assertion of an existing bucket is no error and no change.
-	if err := broker.EnsureDeclarationFiles(ctx, api, "novox"); err != nil {
-		t.Fatalf("asserting the bucket again: %v", err)
-	}
-
-	var resources []map[string]any
-	for i := 0; i < 3; i++ {
-		resources = append(resources, aFileResource("big-"+string(rune('a'+i)), contentOf("big"+string(rune('a'+i)), 1200<<10)))
-	}
-	resources = append(resources, aFileResource("small", "tiny\n"))
-	inline := sendable{Resources: resources}
-	byDigest := sendable{fileReferences: true, Resources: resources}
-
-	bus := link.OverNATS{Conn: conn, JS: nc}
-	body, err := inline.Body()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := link.Declare(ctx, bus, sigOf{}, "novox", body, 5*time.Second); err == nil ||
-		!strings.Contains(err.Error(), "1048576") || strings.Contains(err.Error(), "maximum payload exceeded") {
-		t.Fatalf("the inline declaration of more than 3 MiB: %v", err)
-	}
-
-	bucket, err := openBucket(ctx, conn, "novox")
-	if err != nil {
-		t.Fatal(err)
-	}
-	objects, err := byDigest.objects()
-	if err != nil || len(objects) != 3 {
-		t.Fatalf("objects: %d %v", len(objects), err)
-	}
-	if err := putObjects(ctx, bucket, objects); err != nil {
-		t.Fatal(err)
-	}
-	if err := putObjects(ctx, bucket, objects); err != nil {
-		t.Fatalf("putting them again: %v", err)
-	}
-	refBody, err := byDigest.Body()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := link.Declare(ctx, bus, sigOf{}, "novox", refBody, 5*time.Second); err != nil {
-		t.Fatalf("the declaration by reference: %v", err)
-	}
-
-	// What the stream holds for the node is the reference form, and it names exactly the three objects.
-	latest, err := latestDeclarations(ctx, conn, []string{"novox", "ace"})
-	if err != nil || len(latest) != 1 {
-		t.Fatalf("the latest declarations: %v %v", len(latest), err)
-	}
-	named, err := namedByLatest("novox", latest["novox"])
-	if err != nil || len(named) != 3 {
-		t.Fatalf("what the latest declaration names: %v %v", named, err)
-	}
-	novoxBucket, err := broker.DeclarationFilesBucketOf("novox")
-	if err != nil {
-		t.Fatal(err)
-	}
-	store, err := api.ObjectStore(ctx, novoxBucket)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var envelope struct {
-		Resources []sdkdecl.File `json:"resources"`
-	}
-	if err := json.Unmarshal(refBody, &envelope); err != nil {
-		t.Fatal(err)
-	}
-	for _, f := range envelope.Resources {
-		if !f.IsReference() {
-			continue
-		}
-		name, _ := sdkdecl.ObjectName(f.Digest)
-		got, err := store.GetBytes(ctx, name)
-		if err != nil {
-			t.Fatalf("the object of %s: %v", f.ID, err)
-		}
-		if err := f.Verify(got); err != nil {
-			t.Errorf("the object does not verify: %v", err)
-		}
-		got[len(got)/2] ^= 1
-		if err := f.Verify(got); err == nil {
-			t.Errorf("a changed byte in the object of %s passed the verification", f.ID)
-		}
-	}
-
-	// The sweep against the real bucket: all named, nothing marked; a fourth object named by none is marked, kept a day less a
-	// minute, and removed at the day.
-	extra := bytes.Repeat([]byte("x"), 100)
-	extraName := strings.Repeat("e", 64)
-	if err := putObjects(ctx, bucket, map[string][]byte{extraName: extra}); err != nil {
-		t.Fatal(err)
-	}
-	b := busSweptBucket{store}
-	t0 := time.Now()
-	if r, err := sweepDeclarationFiles(ctx, b, named, t0); err != nil || r.Marked != 1 || r.Removed != 0 || r.Kept != 3 {
-		t.Fatalf("first sweep: %+v %v", r, err)
-	}
-	if r, err := sweepDeclarationFiles(ctx, b, named, t0.Add(24*time.Hour-time.Minute)); err != nil || r.Removed != 0 {
-		t.Fatalf("a minute short of a day: %+v %v", r, err)
-	}
-	if r, err := sweepDeclarationFiles(ctx, b, named, t0.Add(24*time.Hour+time.Second)); err != nil || r.Removed != 1 {
-		t.Fatalf("a day after: %+v %v", r, err)
-	}
-	if infos, err := store.List(ctx); err != nil || len(infos) != 3 {
-		t.Fatalf("the bucket holds %d objects (%v), want the 3 the declaration names", len(infos), err)
-	}
-}
-
-// 1696/AC8 on a real bucket: the sweep removes an object only if it still carries the mark it judged it by. An object marked
-// unnamed, then put again by a send (which erases the mark), is kept when the sweep deletes it by the old mark.
-func TestTheSweepsDeleteLeavesAnObjectASendPutAgainAfterItWasMarked(t *testing.T) { // 1696/AC8
-	s := testbus.Start(t)
-	conn, err := nats.Connect(s.ClientURL())
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer conn.Close()
-	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
-	defer cancel()
-	bucket, err := openBucket(ctx, conn, "novox")
-	if err != nil {
-		t.Fatal(err)
-	}
-	name := strings.Repeat("a", 64)
-	content := map[string][]byte{name: bytes.Repeat([]byte("y"), 100)}
-	if err := putObjects(ctx, bucket, content); err != nil {
-		t.Fatal(err)
-	}
-	b := busSweptBucket{bucket.store}
-	judged := time.Now().Add(-25 * time.Hour).Truncate(time.Second)
-	if err := b.MarkUnnamed(ctx, name, judged); err != nil {
-		t.Fatal(err)
-	}
-	if _, marked, err := bucket.Has(ctx, name); err != nil || !marked {
-		t.Fatalf("the object was not marked: %v %v", marked, err)
-	}
-	// The sweep has read the mark; a send now puts the object again, which erases it.
-	if err := putObjects(ctx, bucket, content); err != nil {
-		t.Fatal(err)
-	}
-	if have, marked, err := bucket.Has(ctx, name); err != nil || !have || marked {
-		t.Fatalf("a send did not put the marked object again: have %v marked %v %v", have, marked, err)
-	}
-	gone, err := b.Delete(ctx, name, judged)
-	if err != nil || gone {
-		t.Fatalf("the sweep deleted by an old mark: gone %v, %v", gone, err)
-	}
-	if have, _, err := bucket.Has(ctx, name); err != nil || !have {
-		t.Fatalf("the object a send relies on is gone: %v %v", have, err)
-	}
-	// And the mark still on it is honoured: marked again and deleted by that mark, it goes.
-	if err := b.MarkUnnamed(ctx, name, judged); err != nil {
-		t.Fatal(err)
-	}
-	if gone, err := b.Delete(ctx, name, judged); err != nil || !gone {
-		t.Fatalf("an object still carrying the mark it was judged by is kept: gone %v, %v", gone, err)
-	}
-}
-
-// 1696/AC9 on a real bus: the sweep of a node's bucket takes the node's lock first, so it waits for a send that has put its objects
-// and not yet published the declaration that names them.
-func TestTheSweepOfANodesBucketHoldsTheNodesLock(t *testing.T) { // 1696/AC9
-	s := testbus.Start(t)
-	conn, err := nats.Connect(s.ClientURL())
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer conn.Close()
-	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
-	defer cancel()
-	const node = "sweep-lock-node"
-	if _, err := openBucket(ctx, conn, node); err != nil { // the bucket exists, or the sweep would return before the lock
-		t.Fatal(err)
-	}
-	release := lockFilesOf(node) // a send is between its put and its publication
-	done := make(chan struct{})
-	go func() {
-		_, _ = sweepNode(ctx, conn, node)
-		close(done)
-	}()
-	select {
-	case <-done:
-		t.Fatal("the sweep judged the node's bucket while a send held it")
-	case <-time.After(300 * time.Millisecond):
-	}
-	release()
-	select {
-	case <-done:
-	case <-time.After(20 * time.Second):
-		t.Fatal("the sweep did not go on once the send let go")
-	}
-}

cmd/mesh-controller/declaration_files_test.go

@@ -1,534 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/base64"
-	"encoding/hex"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"strings"
-	"testing"
-	"time"
-
-	sdkdecl "git.novox.be/novox/mesh-sdk/go/declaration"
-
-	"github.com/novox/mesh-controller/internal/conditions"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// contentOf is a deterministic content of n bytes that does not compress to nothing and holds no character JSON escapes.
-func contentOf(seed string, n int) string {
-	var b strings.Builder
-	for i := 0; b.Len() < n; i++ {
-		fmt.Fprintf(&b, "%s-%07d-%x;", seed, i, i*2654435761%1000003)
-	}
-	return b.String()[:n]
-}
-
-func aFileResource(id, content string) map[string]any {
-	return map[string]any{"id": id, "type": "file", "path": "/etc/" + id, "mode": "0644", "content": content}
-}
-
-// controlNodeShape is a declaration shaped like the control node's on 2026-10-21 (issue 1689), the sizes measured then: a bus users
-// file of 252,678 bytes, the vault's export of 138,475 bytes (compact), the tool runtime 21 KB, the packet filter 19 KB, the launcher
-// 14 KB, and about 600 small resources for the rest (about 286 KB). `more` scales the count of small ones: 1 is the shape, 1.4 forty
-// percent more of them.
-func controlNodeShape(more float64) []map[string]any {
-	res := []map[string]any{
-		aFileResource("nats.bus-users", contentOf("users", 252678)),
-		aFileResource("mesh-vault.kept", contentOf("kept", 138475)),
-		aFileResource("node-tools.runtime", contentOf("runtime", 21<<10)),
-		aFileResource("nftables.filtering", contentOf("filter", 19<<10)),
-		aFileResource("mesh-host.launcher", contentOf("launcher", 14<<10)),
-	}
-	for i := 0; i < int(600*more); i++ {
-		res = append(res, aFileResource(fmt.Sprintf("module-%03d.config", i), contentOf(fmt.Sprintf("small%d", i), 380)))
-	}
-	return res
-}
-
-func wireSizeOf(t *testing.T, s sendable) int {
-	t.Helper()
-	body, err := s.Body()
-	if err != nil {
-		t.Fatal(err)
-	}
-	// The signature the controller's key makes is 64 bytes.
-	msg, err := link.Envelope(body, make([]byte, 64))
-	if err != nil {
-		t.Fatal(err)
-	}
-	return len(msg)
-}
-
-// 1696/AC1: for a node that reports the capability, the two big files of a control-node-shaped declaration carry their digest and size
-// and no content, and the declaration is far under the bus's 1 MiB.
-func TestAFileOver64KiBTravelsByDigestToANodeThatReadsOne(t *testing.T) { // 1696/AC1
-	users, kept := contentOf("users", 252678), contentOf("kept", 138475)
-	s := sendable{fileReferences: true, Resources: []map[string]any{
-		aFileResource("nats.bus-users", users), aFileResource("mesh-vault.kept", kept),
-		aFileResource("small", "tiny\n"),
-	}}
-	body, err := s.Body()
-	if err != nil {
-		t.Fatal(err)
-	}
-	var got struct {
-		Resources []map[string]any `json:"resources"`
-	}
-	if err := json.Unmarshal(body, &got); err != nil {
-		t.Fatal(err)
-	}
-	for i, want := range []string{users, kept} {
-		r := got.Resources[i]
-		digest := sdkdecl.DigestOf([]byte(want))
-		if _, has := r["content"]; has || r["digest"] != digest || r["size"] != float64(len(want)) {
-			t.Errorf("%v goes with content %v, digest %v, size %v; want no content, %s and %d", r["id"], r["content"] != nil,
-				r["digest"], r["size"], digest, len(want))
-		}
-		if r["path"] == nil || r["mode"] != "0644" {
-			t.Errorf("%v lost its path or mode: %v", r["id"], r)
-		}
-	}
-	if got.Resources[2]["content"] != "tiny\n" || got.Resources[2]["digest"] != nil {
-		t.Errorf("a small file is not inline: %v", got.Resources[2])
-	}
-	if strings.Contains(string(body), users[:200]) || strings.Contains(string(body), kept[:200]) {
-		t.Error("the content of a file that went by digest is in the body")
-	}
-	if n := wireSizeOf(t, s); n > 100<<10 {
-		t.Errorf("the declaration is %d bytes on the wire, want under 100 KB", n)
-	}
-	// The objects to put are the contents, each under the hex of its digest, and a reference verifies against its object.
-	objects, err := s.objects()
-	if err != nil || len(objects) != 2 {
-		t.Fatalf("objects: %v %v", objects, err)
-	}
-	for _, want := range []string{users, kept} {
-		name, _ := sdkdecl.ObjectName(sdkdecl.DigestOf([]byte(want)))
-		if string(objects[name]) != want {
-			t.Errorf("the object %s does not hold the content", name[:12])
-		}
-	}
-	named, err := namedObjects(body)
-	if err != nil || len(named) != 2 {
-		t.Fatalf("the objects the body names: %v %v", named, err)
-	}
-	for name := range objects {
-		if _, ok := named[name]; !ok {
-			t.Errorf("the body does not name the object %s it was sent with", name[:12])
-		}
-		if _, err := hex.DecodeString(name); err != nil || len(name) != 64 {
-			t.Errorf("the object name %q is not 64 hex characters", name)
-		}
-	}
-}
-
-// 1696/AC2: a node that does not report the capability is sent every content inline, as before, and has no object put.
-func TestANodeWithoutTheCapabilityIsSentEveryContentInline(t *testing.T) { // 1696/AC2
-	users := contentOf("users", 252678)
-	s := sendable{Resources: []map[string]any{aFileResource("nats.bus-users", users)}}
-	body, err := s.Body()
-	if err != nil {
-		t.Fatal(err)
-	}
-	var got struct {
-		Resources []map[string]any `json:"resources"`
-	}
-	if err := json.Unmarshal(body, &got); err != nil {
-		t.Fatal(err)
-	}
-	if got.Resources[0]["content"] != users || got.Resources[0]["digest"] != nil || got.Resources[0]["size"] != nil {
-		t.Fatalf("a node that reads no references is not sent the content inline: %v", got.Resources[0]["digest"])
-	}
-	if objects, err := s.objects(); err != nil || len(objects) != 0 {
-		t.Fatalf("objects for a node that reads none: %v %v", len(objects), err)
-	}
-}
-
-// 1696/AC3: only a file that may travel by digest does: one of exactly 64 KiB, a sealed one, one filled with secrets, one written
-// into another file, and a directory stay inline, whatever the node reads.
-func TestOnlyAFileThatMayTravelByDigestDoes(t *testing.T) { // 1696/AC3
-	exact := contentOf("exact", 64<<10)
-	big := contentOf("big", 64<<10+1)
-	sealed := aFileResource("sealed", big)
-	sealed["sealed"], sealed["content"] = "box", ""
-	sealed["content"] = big // a sealed file's content is none; the body must pass it as it is, whatever it holds
-	secret := aFileResource("secret", big)
-	secret["secrets"] = map[string]any{"token": "x"}
-	into := aFileResource("into", big)
-	into["into"] = "/etc/other"
-	s := sendable{fileReferences: true, Resources: []map[string]any{
-		aFileResource("exact", exact), sealed, secret, into,
-		{"id": "dir", "type": "directory", "path": "/etc/d", "content": big},
-		aFileResource("big", big),
-	}}
-	body, err := s.Body()
-	if err != nil {
-		t.Fatal(err)
-	}
-	var got struct {
-		Resources []map[string]any `json:"resources"`
-	}
-	if err := json.Unmarshal(body, &got); err != nil {
-		t.Fatal(err)
-	}
-	for i, id := range []string{"exact", "sealed", "secret", "into", "dir"} {
-		if got.Resources[i]["id"] != id || got.Resources[i]["digest"] != nil || got.Resources[i]["content"] == nil {
-			t.Errorf("%s went by digest or lost its content: %v", id, got.Resources[i]["digest"])
-		}
-	}
-	if big := got.Resources[5]; big["id"] != "big" || big["digest"] == nil || big["content"] != nil {
-		t.Errorf("a plain file of 64 KiB and a byte did not go by digest: %v", big["digest"])
-	}
-}
-
-// A file given as bytes goes by digest on its decoded length, with the decoded bytes in the object.
-func TestAFileOfBytesTravelsByDigestOnItsDecodedLength(t *testing.T) {
-	raw := []byte(contentOf("png", 70<<10))
-	r := map[string]any{"id": "icon", "type": "file", "path": "/usr/share/icon.png", "bytes": stdBase64(raw)}
-	s := sendable{fileReferences: true, Resources: []map[string]any{r}}
-	objects, err := s.objects()
-	if err != nil || len(objects) != 1 {
-		t.Fatalf("%v %v", len(objects), err)
-	}
-	name, _ := sdkdecl.ObjectName(sdkdecl.DigestOf(raw))
-	if string(objects[name]) != string(raw) {
-		t.Fatal("the object is not the decoded bytes")
-	}
-	if r["bytes"] == nil {
-		t.Fatal("the composed resource was changed in place")
-	}
-}
-
-type memObjects struct {
-	have   map[string][]byte
-	marked map[string]bool
-	puts   []string
-	fail   map[string]error
-}
-
-func (m *memObjects) Has(_ context.Context, name string) (bool, bool, error) {
-	_, ok := m.have[name]
-	return ok, m.marked[name], nil
-}
-func (m *memObjects) Put(_ context.Context, name string, c []byte) error {
-	if err := m.fail[name]; err != nil {
-		return err
-	}
-	m.puts = append(m.puts, name)
-	m.have[name] = c
-	delete(m.marked, name)
-	return nil
-}
-
-// 1696/AC4: an object already in the bucket is not put again, one absent is, and a put that fails stops the send, naming the object.
-func TestObjectsAreInTheBucketBeforeTheDeclarationIsSent(t *testing.T) { // 1696/AC4
-	objects := map[string][]byte{strings.Repeat("a", 64): []byte("one"), strings.Repeat("b", 64): []byte("two")}
-	b := &memObjects{have: map[string][]byte{strings.Repeat("a", 64): []byte("one")}}
-	if err := putObjects(t.Context(), b, objects); err != nil || len(b.puts) != 1 || b.puts[0] != strings.Repeat("b", 64) {
-		t.Fatalf("put %v (%v), want the one absent", b.puts, err)
-	}
-	// An object the sweep marked unnamed is put again, which erases the mark: a send relies on it.
-	b = &memObjects{have: map[string][]byte{strings.Repeat("a", 64): []byte("one"), strings.Repeat("b", 64): []byte("two")},
-		marked: map[string]bool{strings.Repeat("a", 64): true}}
-	if err := putObjects(t.Context(), b, objects); err != nil || len(b.puts) != 1 || b.puts[0] != strings.Repeat("a", 64) || b.marked[strings.Repeat("a", 64)] {
-		t.Fatalf("a marked object: put %v (%v) marked %v, want it put again and the mark gone", b.puts, err, b.marked)
-	}
-	b = &memObjects{have: map[string][]byte{}, fail: map[string]error{strings.Repeat("a", 64): errors.New("permissions violation")}}
-	err := putObjects(t.Context(), b, objects)
-	if err == nil || !strings.Contains(err.Error(), "aaaaaaaaaaaa") || !strings.Contains(err.Error(), "permissions violation") {
-		t.Fatalf("a failed put: %v", err)
-	}
-}
-
-// fallbackDelivery refuses the first declaration it is sent with the bucket's failure, as a bus that has not yet been given the
-// controller's grant does, and takes the second.
-type fallbackDelivery struct {
-	bodies [][]byte
-	first  error
-}
-
-func (f *fallbackDelivery) grant(context.Context, []readyNode) error { return nil }
-func (f *fallbackDelivery) declare(_ context.Context, _ readyNode, body []byte) (string, error) {
-	f.bodies = append(f.bodies, body)
-	if len(f.bodies) == 1 && f.first != nil {
-		return "", fmt.Errorf("x: %w: %w", errFilesNotPut, f.first)
-	}
-	return "digest", nil
-}
-
-// 1696/AC5: when the bucket cannot be written yet (the grant travels in the declaration of the machine holding the bus), that send goes
-// with every content inline and is made; a send that fails for another reason is not retried inline.
-func TestASendWhoseFilesCannotBePutGoesInlineOnce(t *testing.T) { // 1696/AC5
-	users := contentOf("users", 100<<10)
-	s := readyNode{node: "novox", declared: sendable{fileReferences: true, Resources: []map[string]any{aFileResource("nats.bus-users", users)}}}
-	f := &fallbackDelivery{first: errors.New("timeout")}
-	digests, err := deliver(t.Context(), f, "novox", []readyNode{s})
-	if err != nil || digests["novox"] != "digest" || len(f.bodies) != 2 {
-		t.Fatalf("%v %v %d", digests, err, len(f.bodies))
-	}
-	if strings.Contains(string(f.bodies[0]), users[:100]) || !strings.Contains(string(f.bodies[1]), users[:100]) {
-		t.Error("the first body should name the file by digest and the second carry it inline")
-	}
-	other := &fallbackDelivery{}
-	other.first = nil
-	failing := &failingDelivery{err: errors.New("the bus is down")}
-	if _, err := deliver(t.Context(), failing, "novox", []readyNode{s}); err == nil || failing.calls != 1 {
-		t.Fatalf("a failure of another kind: %v after %d send(s)", err, failing.calls)
-	}
-}
-
-type failingDelivery struct {
-	err   error
-	calls int
-}
-
-func (f *failingDelivery) grant(context.Context, []readyNode) error { return nil }
-func (f *failingDelivery) declare(context.Context, readyNode, []byte) (string, error) {
-	f.calls++
-	return "", f.err
-}
-
-// A bucket for the sweep.
-type sweepBucketFake struct {
-	objects map[string]time.Time // zero: named at the last look
-	deleted []string
-}
-
-func (b *sweepBucketFake) Objects(context.Context) ([]bucketObject, error) {
-	var out []bucketObject
-	for n, at := range b.objects {
-		out = append(out, bucketObject{Name: n, UnnamedSince: at})
-	}
-	return out, nil
-}
-func (b *sweepBucketFake) MarkUnnamed(_ context.Context, n string, at time.Time) error {
-	b.objects[n] = at
-	return nil
-}
-func (b *sweepBucketFake) ClearUnnamed(_ context.Context, n string) error {
-	b.objects[n] = time.Time{}
-	return nil
-}
-func (b *sweepBucketFake) Delete(_ context.Context, n string, markedAt time.Time) (bool, error) {
-	if at, ok := b.objects[n]; !ok || !at.Equal(markedAt) {
-		return false, nil // put again since it was judged: its mark is gone
-	}
-	delete(b.objects, n)
-	b.deleted = append(b.deleted, n)
-	return true, nil
-}
-
-// 1696/AC6: an object a latest declaration still names is not removed, however long; one unnamed is marked at the first look and removed
-// only when the mark is 24 hours old; one named again loses its mark.
-func TestAnObjectIsRemovedADayAfterNoLatestDeclarationNamesIt(t *testing.T) { // 1696/AC6
-	named, unnamed, back := strings.Repeat("1", 64), strings.Repeat("2", 64), strings.Repeat("3", 64)
-	t0 := time.Date(2026, 10, 21, 12, 0, 0, 0, time.UTC)
-	b := &sweepBucketFake{objects: map[string]time.Time{named: t0.Add(-100 * time.Hour), unnamed: {}, back: t0.Add(-5 * time.Hour)}}
-	named3 := map[string]bool{named: true, back: true}
-	r, err := sweepDeclarationFiles(t.Context(), b, named3, t0)
-	if err != nil || r.Marked != 1 || r.Cleared != 2 || r.Removed != 0 || len(b.deleted) != 0 {
-		t.Fatalf("first look: %+v %v %v", r, err, b.deleted)
-	}
-	if !b.objects[named].IsZero() || !b.objects[back].IsZero() || !b.objects[unnamed].Equal(t0) {
-		t.Fatalf("marks after the first look: %v", b.objects)
-	}
-	// Still unnamed 23 hours 59 minutes later: kept. A day after the mark: removed. The named ones stay for ever.
-	if r, err = sweepDeclarationFiles(t.Context(), b, map[string]bool{named: true, back: true}, t0.Add(24*time.Hour-time.Minute)); err != nil ||
-		r.Removed != 0 || len(b.deleted) != 0 {
-		t.Fatalf("a minute short of a day: %+v %v %v", r, err, b.deleted)
-	}
-	if r, err = sweepDeclarationFiles(t.Context(), b, map[string]bool{named: true, back: true}, t0.Add(24*time.Hour)); err != nil ||
-		r.Removed != 1 || len(b.deleted) != 1 || b.deleted[0] != unnamed {
-		t.Fatalf("a day after: %+v %v %v", r, err, b.deleted)
-	}
-	if _, ok := b.objects[named]; !ok {
-		t.Fatal("an object a latest declaration names was removed")
-	}
-	// An object named again before the day is up loses its mark and is not removed.
-	b = &sweepBucketFake{objects: map[string]time.Time{unnamed: t0}}
-	if _, err := sweepDeclarationFiles(t.Context(), b, map[string]bool{unnamed: true}, t0.Add(23*time.Hour)); err != nil || !b.objects[unnamed].IsZero() {
-		t.Fatalf("named again: %v %v", b.objects, err)
-	}
-}
-
-// What a node's latest declaration names is read from the signed envelope as stored on the bus; an unreadable one is an error and
-// never "names none", which would mark an object a node needs.
-func TestTheObjectsALatestDeclarationNamesAreReadFromTheBus(t *testing.T) {
-	s := sendable{fileReferences: true, Resources: []map[string]any{aFileResource("a", contentOf("a", 70<<10))}}
-	body, _ := s.Body()
-	msg, _ := link.Envelope(body, []byte("sig"))
-	named, err := namedByLatest("novox", msg)
-	name, _ := sdkdecl.ObjectName(sdkdecl.DigestOf([]byte(contentOf("a", 70<<10))))
-	if err != nil || len(named) != 1 || !named[name] {
-		t.Fatalf("%v %v", named, err)
-	}
-	if none, err := namedByLatest("ace", []byte(`{"declaration":"e30=","signature":""}`)); err != nil || len(none) != 0 {
-		t.Fatalf("a declaration naming none: %v %v", none, err)
-	}
-	if _, err := namedByLatest("novox", []byte("not json")); err == nil {
-		t.Fatal("an unreadable latest declaration was read as naming none")
-	}
-}
-
-// 1698/AC2 (ADR 0486 §9): a declaration shaped like the control node's, for a node that reads references, stays under half of the
-// bus's largest message on the wire; the inline form of the same does not fit at all; and the same shape with 40 percent more resources
-// fails the test's own limit, so a change that eats the room fails in a pull request and not on the live mesh.
-func TestTheControlNodesDeclarationInTheReferenceFormStaysUnderHalfTheBusLimit(t *testing.T) { // 1698/AC2
-	const limit = 1048576
-	shape := sendable{fileReferences: true, Resources: controlNodeShape(1)}
-	n := wireSizeOf(t, shape)
-	t.Logf("the control node's shape in the reference form: %d bytes on the wire, %.1f%% of %d", n, 100*float64(n)/limit, limit)
-	if n > limit/2 {
-		t.Errorf("the reference form is %d bytes on the wire, over half (%d) of the bus's largest message", n, limit/2)
-	}
-	if inline := wireSizeOf(t, sendable{Resources: controlNodeShape(1)}); inline < limit*3/4 {
-		t.Errorf("the inline form is %d bytes, which is not the shape that was over the limit", inline)
-	}
-	grown := wireSizeOf(t, sendable{fileReferences: true, Resources: controlNodeShape(1.4)})
-	if grown <= limit/2 {
-		t.Errorf("the shape with 40%% more resources is %d bytes, which the test would let pass", grown)
-	}
-}
-
-func stdBase64(b []byte) string { return base64.StdEncoding.EncodeToString(b) }
-
-// A sweep that read an object's mark before a send put it again must not remove it: the object, now without the mark, is left.
-func TestASweepDoesNotRemoveAnObjectASendPutAgainAfterItWasJudged(t *testing.T) { // 1696/AC8
-	n := strings.Repeat("4", 64)
-	t0 := time.Date(2026, 10, 21, 12, 0, 0, 0, time.UTC)
-	b := &sweepBucketFake{objects: map[string]time.Time{n: t0}}
-	judged := bucketObject{Name: n, UnnamedSince: t0}
-	b.objects[n] = time.Time{} // the send put it again: no mark
-	if gone, err := b.Delete(t.Context(), judged.Name, judged.UnnamedSince); err != nil || gone || len(b.deleted) != 0 {
-		t.Fatalf("an object put again was removed: %v %v %v", gone, err, b.deleted)
-	}
-}
-
-// One node's bucket is held by one act at a time in this process: the sweep waits for a send that has put its objects and not yet
-// published the declaration that names them (1696/AC9).
-func TestTheSweepOfANodesBucketWaitsForASendThatHasPutItsObjects(t *testing.T) { // 1696/AC9
-	unlock := lockFilesOf("lock-test-node")
-	got := make(chan struct{})
-	go func() {
-		defer lockFilesOf("lock-test-node")()
-		close(got)
-	}()
-	select {
-	case <-got:
-		t.Fatal("the sweep took the node's bucket while a send held it")
-	case <-time.After(50 * time.Millisecond):
-	}
-	other := lockFilesOf("lock-test-other-node") // another node's bucket is not held
-	other()
-	unlock()
-	select {
-	case <-got:
-	case <-time.After(2 * time.Second):
-		t.Fatal("the sweep did not take the node's bucket once the send was done")
-	}
-}
-
-// A put that fails send after send raises a condition; the first failure does not (the grant it waits for travels in that very
-// declaration), and a put that works clears it (1696/AC10).
-func TestAPutThatFailsSendAfterSendRaisesAConditionAndClearsWhenItWorks(t *testing.T) { // 1696/AC10
-	store := conditions.NewInMemory()
-	k := conditions.NewKeeper(t.Context(), conditions.Options{Store: store, History: store,
-		Teller: &conditions.Told{}, Now: func() time.Time { return time.Date(2026, 10, 21, 14, 0, 0, 0, time.UTC) }})
-	t.Cleanup(func() { k.Close(t.Context()) })
-	was := conditionsFrom
-	conditionsFrom = k
-	t.Cleanup(func() { conditionsFrom = was })
-	key := filesNotPutObservation("cond-node", "").Key()
-	open := func() bool {
-		_, found, err := conditions.ReadOne(t.Context(), store, key)
-		if err != nil {
-			t.Fatal(err)
-		}
-		return found
-	}
-	boom := errors.New("permissions violation")
-	notePut(t.Context(), "cond-node", boom)
-	if open() {
-		t.Fatal("the first failure raised the condition")
-	}
-	notePut(t.Context(), "cond-node", boom)
-	if !open() {
-		t.Fatal("the second failure in a row did not raise the condition")
-	}
-	notePut(t.Context(), "cond-node", nil)
-	if open() {
-		t.Fatal("a put that worked did not clear the condition")
-	}
-	notePut(t.Context(), "cond-node", boom)
-	if open() {
-		t.Fatal("the count did not start again after a put that worked")
-	}
-}
-
-// aBusThatSays is a bus that keeps the declarations published to it and, at each, asks whether the node's bucket is held.
-type aBusThatSays struct {
-	link.Bus
-	published     chan string
-	heldAtPublish func() bool
-}
-
-func (b *aBusThatSays) PublishDeclaration(_ context.Context, node string, _ []byte) error {
-	if b.heldAtPublish != nil && !b.heldAtPublish() {
-		return errors.New("published while the node's bucket was not held")
-	}
-	b.published <- node
-	return errors.New("stop here: nothing is recorded")
-}
-
-type aSignerOfZeros struct{}
-
-func (aSignerOfZeros) Sign(context.Context, []byte) ([]byte, error) { return make([]byte, 64), nil }
-
-// whileHeld says whether the node's lock is held by someone right now, without keeping it.
-func whileHeld(node string) bool {
-	got := make(chan struct{})
-	go func() {
-		defer lockFilesOf(node)()
-		close(got)
-	}()
-	select {
-	case <-got:
-		return false
-	case <-time.After(100 * time.Millisecond):
-		// held: the goroutine stays waiting and takes and releases the lock once it is let go.
-		return true
-	}
-}
-
-// 1696/AC9: a send holds the node's lock from the put to the publication, so the sweep never removes an object between them. The
-// test goes through overTheBus.declare: while another holds the lock the declaration is not published, and at the publication the
-// lock is held.
-func TestASendHoldsTheNodesLockFromThePutToThePublication(t *testing.T) { // 1696/AC9
-	const node = "lock-send-node"
-	bus := &aBusThatSays{published: make(chan string, 1)}
-	bus.heldAtPublish = func() bool { return whileHeld(node) }
-	send := overTheBus{server: link.SendingOn(bus), signer: aSignerOfZeros{}}
-	release := lockFilesOf(node) // a sweep is judging this node's bucket
-	done := make(chan error, 1)
-	go func() {
-		_, err := send.declare(t.Context(), readyNode{node: node}, []byte(`{}`))
-		done <- err
-	}()
-	select {
-	case n := <-bus.published:
-		t.Fatalf("%s was sent its declaration while the sweep held the node's bucket", n)
-	case <-time.After(150 * time.Millisecond):
-	}
-	release()
-	select {
-	case <-bus.published:
-	case <-time.After(5 * time.Second):
-		t.Fatal("the send did not go on once the sweep let go")
-	}
-	if err := <-done; err == nil || !strings.Contains(err.Error(), "nothing is recorded") {
-		t.Fatalf("the send did not reach the publication (a lock held at it): %v", err)
-	}
-}

cmd/mesh-controller/declaration_room.go

@@ -1,96 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"fmt"
-	"strings"
-
-	"github.com/novox/mesh-controller/internal/conditions"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// **A declaration is one bus message, and the bus's largest message is a cliff** (novox/hq issue 1689). On 2026-10-21
-// the control node's declaration passed it by 2 KB and nothing reached that node until two assignments were undone.
-// So the size is measured at every send: a warning condition from 75% of the limit (ADR 0486 §8, issue 1698: it was 90% while every file travelled inline), urgent over it, cleared when
-// the declaration is back under 75%. The limit is the connection's own, not a constant.
-
-// kindDeclarationNearLimit is a declaration at or near the bus's largest message.
-const kindDeclarationNearLimit = "declaration-near-limit"
-
-// declarationRoomSource is the condition's source: the sends.
-const declarationRoomSource = "sends"
-
-func declarationRoomObservation(node string, size, limit int64) conditions.Observation {
-	o := conditions.Observation{Scope: conditions.ScopeMachine, ID: node, Kind: kindDeclarationNearLimit,
-		Token: kindDeclarationNearLimit, Machine: node, Severity: conditions.Warning, Source: declarationRoomSource}
-	if size > limit {
-		o.Severity = conditions.Urgent
-	}
-	o.Summary = fmt.Sprintf("%s's declaration is %d bytes on the wire, %d%% of the bus's largest message of %d bytes",
-		node, size, size*100/limit, limit)
-	if size > limit {
-		o.Summary += ": over it, so it cannot be sent"
-	}
-	return o
-}
-
-func init() {
-	link.DeclarationMeasured = func(ctx context.Context, node string, size, limit int64) {
-		settleDeclarationRoom(ctx, conditionsFrom, node, size, limit)
-	}
-}
-
-// settleDeclarationRoom raises or clears the condition of a declaration's size. A nil keeper (a tool, not the
-// serving controller) says nothing.
-func settleDeclarationRoom(ctx context.Context, keeper *conditions.Keeper, node string, size, limit int64) {
-	if keeper == nil || limit <= 0 {
-		return
-	}
-	obs := declarationRoomObservation(node, size, limit)
-	if float64(size) < link.NearTheLimit*float64(limit) {
-		if _, err := keeper.Clear(ctx, obs.Key(), fmt.Sprintf("%s's declaration is %d bytes, under the limit's margin", node, size)); err != nil {
-			fmt.Printf("the condition %s could not be cleared: %v\n", obs.Key(), err)
-		}
-		return
-	}
-	fmt.Printf("NEAR THE LIMIT: %s\n", obs.Summary)
-	if _, err := keeper.Observe(ctx, obs); err != nil {
-		fmt.Printf("the condition %s could not be raised: %v\n", obs.Key(), err)
-	}
-}
-
-// compactKept writes the vault's export compact. The composition (the SDK's keptFile) writes it indented, and its 334
-// sealed secrets were 164,763 bytes of it against 138,474 compact: a fifth of the declaration's room, in whitespace,
-// base64-encoded again on the wire. Every reader parses JSON, so the spacing is nobody's. A resource that is not
-// the export, or whose content is not JSON, is left as it is. The resources are copied, never changed in place.
-func compactKept(resources []map[string]any) []map[string]any {
-	out := make([]map[string]any, len(resources))
-	for i, r := range resources {
-		out[i] = r
-		id, _ := r["id"].(string)
-		path, _ := r["path"].(string)
-		content, ok := r["content"].(string)
-		if !ok || (id != "kept" && !strings.HasSuffix(id, ".kept")) || !strings.HasSuffix(path, "/export.json") {
-			continue
-		}
-		var dst bytes.Buffer
-		if json.Compact(&dst, []byte(content)) != nil {
-			continue
-		}
-		if strings.HasSuffix(content, "\n") {
-			dst.WriteByte('\n')
-		}
-		if dst.String() == content {
-			continue
-		}
-		c := make(map[string]any, len(r))
-		for k, v := range r {
-			c[k] = v
-		}
-		c["content"] = dst.String()
-		out[i] = c
-	}
-	return out
-}

cmd/mesh-controller/declaration_room_test.go

@@ -1,71 +0,0 @@
-package main
-
-import (
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/conditions"
-)
-
-// The vault's export is sent compact (issue 1689): same document, no indentation, one rewrite.
-func TestTheVaultsExportIsSentCompactAndNothingElseIsTouched(t *testing.T) {
-	indented := "{\n  \"export\": 1,\n  \"kept\": [\n    {\n      \"name\": \"a\"\n    }\n  ]\n}\n"
-	other := "{\n  \"x\": 1\n}\n"
-	in := []map[string]any{
-		{"id": "mesh-vault.kept", "type": "file", "path": "/srv/vault/export.json", "mode": "0600", "content": indented},
-		{"id": "mesh-vault.config", "type": "file", "path": "/srv/vault/config.json", "content": other},
-		{"id": "other.kept", "type": "file", "path": "/srv/other/notes.json", "content": other},
-	}
-	out := compactKept(in)
-	want := "{\"export\":1,\"kept\":[{\"name\":\"a\"}]}\n"
-	if out[0]["content"] != want || out[0]["mode"] != "0600" || out[0]["path"] != "/srv/vault/export.json" {
-		t.Fatalf("the export is %q (%v), expected %q with its mode and path kept", out[0]["content"], out[0], want)
-	}
-	if out[1]["content"] != other || out[2]["content"] != other {
-		t.Fatalf("a file that is not the export was rewritten: %v %v", out[1], out[2])
-	}
-	if in[0]["content"] != indented {
-		t.Fatalf("the composed resource was changed in place")
-	}
-	if again := compactKept(out); again[0]["content"] != want {
-		t.Fatalf("compacting twice changed it: %q", again[0]["content"])
-	}
-}
-
-// From 75% of the bus's largest message (ADR 0486 §8, issue 1698) the declaration is a warning; over it, urgent; back under 75%, cleared.
-func TestADeclarationNearTheBusLimitRaisesAConditionAndClearsWhenSmaller(t *testing.T) {
-	store := conditions.NewInMemory()
-	k := conditions.NewKeeper(t.Context(), conditions.Options{Store: store, History: store,
-		Teller: &conditions.Told{}, Now: func() time.Time { return time.Date(2026, 10, 21, 14, 0, 0, 0, time.UTC) }})
-	t.Cleanup(func() { k.Close(t.Context()) })
-	const limit = 1000
-	key := declarationRoomObservation("novox", 0, limit).Key()
-	read := func() (conditions.Condition, bool) {
-		t.Helper()
-		c, found, err := conditions.ReadOne(t.Context(), store, key)
-		if err != nil {
-			t.Fatal(err)
-		}
-		return c, found
-	}
-
-	settleDeclarationRoom(t.Context(), k, "novox", 749, limit)
-	if _, found := read(); found {
-		t.Fatal("a declaration at 74.9% raised a condition")
-	}
-	settleDeclarationRoom(t.Context(), k, "novox", 750, limit)
-	c, found := read()
-	if !found || c.Severity != conditions.Warning || !strings.Contains(c.Summary, "750 bytes") ||
-		!strings.Contains(c.Summary, "1000") || c.Subject.Machine != "novox" {
-		t.Fatalf("at 75%% the condition is %v %+v", found, c)
-	}
-	settleDeclarationRoom(t.Context(), k, "novox", 1001, limit)
-	if c, _ := read(); c.Severity != conditions.Urgent {
-		t.Fatalf("over the limit the condition is %q, expected urgent", c.Severity)
-	}
-	settleDeclarationRoom(t.Context(), k, "novox", 700, limit)
-	if _, found := read(); found {
-		t.Fatal("the condition stayed after the declaration fell under 75%")
-	}
-}

cmd/mesh-controller/declaration_sweep.go

@@ -1,273 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"sort"
-	"strings"
-	"time"
-
-	"github.com/nats-io/nats.go"
-	"github.com/nats-io/nats.go/jetstream"
-
-	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// **An object is removed a day after no node's latest declaration names it** (novox/hq ADR 0486 §3, issue 1696), so a node that is
-// asleep and receives its latest declaration later still finds every object that declaration names. What each node's latest
-// declaration names is read from the bus itself, the last message of that node's subject of the stream NODES: nothing else
-// is kept of it. When an object is first found named by none, the time is written in its own metadata (declarationUnnamed);
-// found named again, that is erased; found unnamed for a day, it is removed. Each node has a bucket of its own, judged against that
-// node's latest declaration alone. Objects are immutable and regenerable from the
-// controller's state, so a removal loses nothing.
-
-// declarationUnnamed is the key of an object's metadata holding when it was first found named by no node's latest declaration.
-const declarationUnnamed = "unnamed-since"
-
-// sweepEvery is how often the bucket is judged: the removal is exact to within this.
-const sweepEvery = time.Hour
-
-// bucketObject is one object of the bucket as the sweep sees it.
-type bucketObject struct {
-	Name string
-	// UnnamedSince is when it was first found named by none, zero when it was named at the last look.
-	UnnamedSince time.Time
-}
-
-// sweptBucket is what the sweep needs of the bucket.
-type sweptBucket interface {
-	Objects(ctx context.Context) ([]bucketObject, error)
-	MarkUnnamed(ctx context.Context, name string, since time.Time) error
-	ClearUnnamed(ctx context.Context, name string) error
-	// Delete removes the object if it still carries the mark it was judged by, and says whether it did: a send that put it again
-	// since has erased the mark, and the object is left.
-	Delete(ctx context.Context, name string, markedAt time.Time) (bool, error)
-}
-
-// filesSweep says what a sweep did.
-type filesSweep struct{ Kept, Marked, Cleared, Removed int }
-
-// sweepDeclarationFiles judges every object against the names of the latest declarations: named ones are kept (and a
-// mark of being unnamed is erased), unnamed ones are marked at the first look and removed once the mark is a day old.
-func sweepDeclarationFiles(ctx context.Context, bucket sweptBucket, named map[string]bool, now time.Time) (filesSweep, error) {
-	var r filesSweep
-	objects, err := bucket.Objects(ctx)
-	if err != nil {
-		return r, err
-	}
-	sort.Slice(objects, func(i, j int) bool { return objects[i].Name < objects[j].Name })
-	for _, o := range objects {
-		switch {
-		case named[o.Name]:
-			r.Kept++
-			if !o.UnnamedSince.IsZero() {
-				if err := bucket.ClearUnnamed(ctx, o.Name); err != nil {
-					return r, fmt.Errorf("the object %s: %w", o.Name[:12], err)
-				}
-				r.Cleared++
-			}
-		case o.UnnamedSince.IsZero():
-			if err := bucket.MarkUnnamed(ctx, o.Name, now); err != nil {
-				return r, fmt.Errorf("the object %s: %w", o.Name[:12], err)
-			}
-			r.Marked++
-		case now.Sub(o.UnnamedSince) >= broker.DeclarationFilesKeptFor:
-			gone, err := bucket.Delete(ctx, o.Name, o.UnnamedSince)
-			if err != nil {
-				return r, fmt.Errorf("the object %s: %w", o.Name[:12], err)
-			}
-			if gone {
-				r.Removed++
-			} else {
-				r.Kept++
-			}
-		default:
-			r.Kept++
-		}
-	}
-	return r, nil
-}
-
-// namedByLatest is the name of every object this latest declaration of a node names. A body that cannot be read is an error, never
-// "names none": an object the node still needs would be marked for removal.
-func namedByLatest(node string, signed []byte) (map[string]bool, error) {
-	var s link.Signed
-	if err := json.Unmarshal(signed, &s); err != nil {
-		return nil, fmt.Errorf("%s's latest declaration is not readable: %w", node, err)
-	}
-	names, err := namedObjects(s.Declaration)
-	if err != nil {
-		return nil, fmt.Errorf("%s's latest declaration is not readable: %w", node, err)
-	}
-	named := make(map[string]bool, len(names))
-	for name := range names {
-		named[name] = true
-	}
-	return named, nil
-}
-
-// latestDeclarations are the last signed declarations of the nodes, by node, as the stream NODES holds them. A node with none has
-// no entry.
-func latestDeclarations(ctx context.Context, conn *nats.Conn, nodes []string) (map[string][]byte, error) {
-	js, err := conn.JetStream(nats.Context(ctx))
-	if err != nil {
-		return nil, err
-	}
-	out := map[string][]byte{}
-	for _, node := range nodes {
-		msg, err := js.GetLastMsg("NODES", link.DeclareSubject(node), nats.Context(ctx))
-		if errors.Is(err, nats.ErrMsgNotFound) {
-			continue
-		}
-		if err != nil {
-			return nil, fmt.Errorf("the latest declaration of %s: %w", node, err)
-		}
-		out[node] = msg.Data
-	}
-	return out, nil
-}
-
-// busSweptBucket is the bucket on the controller's connection.
-type busSweptBucket struct{ store jetstream.ObjectStore }
-
-func (b busSweptBucket) Objects(ctx context.Context) ([]bucketObject, error) {
-	infos, err := b.store.List(ctx)
-	if errors.Is(err, jetstream.ErrNoObjectsFound) {
-		return nil, nil
-	}
-	if err != nil {
-		return nil, err
-	}
-	out := make([]bucketObject, 0, len(infos))
-	for _, info := range infos {
-		o := bucketObject{Name: info.Name}
-		if at, err := time.Parse(time.RFC3339, info.Metadata[declarationUnnamed]); err == nil {
-			o.UnnamedSince = at
-		}
-		out = append(out, o)
-	}
-	return out, nil
-}
-
-func (b busSweptBucket) meta(ctx context.Context, name string, change func(map[string]string)) error {
-	info, err := b.store.GetInfo(ctx, name)
-	if err != nil {
-		return err
-	}
-	meta := info.ObjectMeta
-	kept := map[string]string{}
-	for k, v := range meta.Metadata {
-		kept[k] = v
-	}
-	change(kept)
-	meta.Metadata = kept
-	return b.store.UpdateMeta(ctx, name, meta)
-}
-
-func (b busSweptBucket) MarkUnnamed(ctx context.Context, name string, since time.Time) error {
-	return b.meta(ctx, name, func(m map[string]string) { m[declarationUnnamed] = since.UTC().Format(time.RFC3339) })
-}
-
-func (b busSweptBucket) ClearUnnamed(ctx context.Context, name string) error {
-	return b.meta(ctx, name, func(m map[string]string) { delete(m, declarationUnnamed) })
-}
-
-func (b busSweptBucket) Delete(ctx context.Context, name string, markedAt time.Time) (bool, error) {
-	info, err := b.store.GetInfo(ctx, name)
-	if errors.Is(err, jetstream.ErrObjectNotFound) {
-		return false, nil
-	}
-	if err != nil {
-		return false, err
-	}
-	if at, perr := time.Parse(time.RFC3339, info.Metadata[declarationUnnamed]); perr != nil || !at.Equal(markedAt) {
-		return false, nil
-	}
-	return true, b.store.Delete(ctx, name)
-}
-
-// sweepingDeclarationFiles judges the bucket every sweepEvery for as long as this controller serves and holds the lease.
-func sweepingDeclarationFiles(ctx context.Context, inv *inventory.Inventory, conn *nats.Conn) {
-	tick := time.NewTicker(sweepEvery)
-	defer tick.Stop()
-	failing := ""
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-tick.C:
-		}
-		if epoch, err := theLease.epoch(ctx); err != nil || epoch == 0 {
-			continue
-		}
-		why := sweepOnce(ctx, inv, conn)
-		if why != failing {
-			if why != "" {
-				fmt.Printf("the bucket of declaration files cannot be swept: %s\n", why)
-			} else {
-				fmt.Printf("the bucket of declaration files is swept again\n")
-			}
-			failing = why
-		}
-	}
-}
-
-// sweepOnce judges the bucket of every node against that node's latest declaration, one bucket at a time under the node's lock, with
-// the declaration read again under it: a send that put an object and published its declaration is seen, and one that has not yet
-// is waiting for the lock.
-func sweepOnce(ctx context.Context, inv *inventory.Inventory, conn *nats.Conn) string {
-	nodes, err := inv.Nodes(ctx)
-	if err != nil {
-		return fmt.Sprintf("the nodes cannot be read: %v", err)
-	}
-	var problems []string
-	var total filesSweep
-	for _, n := range nodes {
-		r, err := sweepNode(ctx, conn, n.Name)
-		total.Kept, total.Marked, total.Cleared, total.Removed = total.Kept+r.Kept, total.Marked+r.Marked, total.Cleared+r.Cleared, total.Removed+r.Removed
-		if err != nil {
-			problems = append(problems, fmt.Sprintf("%s: %v", n.Name, err))
-		}
-	}
-	if total.Removed+total.Marked+total.Cleared > 0 {
-		fmt.Printf("the buckets of declaration files: %d object(s) kept, %d found unnamed, %d named again, %d removed\n",
-			total.Kept, total.Marked, total.Cleared, total.Removed)
-	}
-	return strings.Join(problems, "; ")
-}
-
-func sweepNode(ctx context.Context, conn *nats.Conn, node string) (filesSweep, error) {
-	working, cancel := context.WithTimeout(ctx, 2*time.Minute)
-	defer cancel()
-	js, err := jetstream.New(conn)
-	if err != nil {
-		return filesSweep{}, err
-	}
-	bucket, err := broker.DeclarationFilesBucketOf(node)
-	if err != nil {
-		return filesSweep{}, fmt.Errorf("the bucket of node %q: %w", node, err)
-	}
-	store, err := js.ObjectStore(working, bucket)
-	if errors.Is(err, jetstream.ErrBucketNotFound) {
-		return filesSweep{}, nil // a node never sent a reference has no bucket yet
-	}
-	if err != nil {
-		return filesSweep{}, fmt.Errorf("the bucket cannot be read: %w", err)
-	}
-	defer lockFilesOf(node)()
-	latest, err := latestDeclarations(working, conn, []string{node})
-	if err != nil {
-		return filesSweep{}, err
-	}
-	named := map[string]bool{}
-	if body, ok := latest[node]; ok {
-		if named, err = namedByLatest(node, body); err != nil {
-			return filesSweep{}, err
-		}
-	}
-	return sweepDeclarationFiles(working, busSweptBucket{store}, named, time.Now())
-}

cmd/mesh-controller/declared_packages_integration_test.go

@@ -1,89 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"encoding/json"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// 1840/AC5 (ADR 0507 §5): the source of the declared-packages mirror composes each node and names, for a package two modules
-// declare and one declared absent, the modules that declare it; the same records give the same bytes on a second pass, so
-// the mirror writes nothing; a node with no package has a key that says so.
-func TestTheDeclaredPackagesMirrorNamesWhatEachNodesModulesDeclare(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	register(t, open, catalogue.Manifest{Module: "viewer", Version: "1", Resources: []map[string]any{
-		{"id": "pkg-curl", "type": "package", "package": "curl"},
-		{"id": "pkg-nano", "type": "package", "package": "nano", "absent": true}}})
-	register(t, open, catalogue.Manifest{Module: "fetcher", Version: "1", Resources: []map[string]any{
-		{"id": "pkg-curl", "type": "package", "package": "curl"}}})
-	for _, module := range []string{"viewer", "fetcher"} {
-		if _, err := assign(ctx, open, "anchor", module); err != nil {
-			t.Fatalf("assign anchor %s: %v", module, err)
-		}
-	}
-	source := declaredPackagesMirror(open)
-	first, err := source(ctx)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var got inventory.DeclaredPackagesMirrored
-	if err := json.Unmarshal(first["anchor"], &got); err != nil {
-		t.Fatalf("anchor has no value: %v", err)
-	}
-	// Every node also runs the mesh's own modules, which declare packages of their own: curl and nano are looked
-	// up by name, and no package names viewer or fetcher but those they declare.
-	byName := map[string]inventory.PackageDeclared{}
-	for _, p := range got.Packages {
-		byName[p.Package] = p
-	}
-	same := func(a, b []string) bool {
-		if len(a) != len(b) {
-			return false
-		}
-		for i := range a {
-			if a[i] != b[i] {
-				return false
-			}
-		}
-		return true
-	}
-	for _, p := range []inventory.PackageDeclared{{Package: "curl", Modules: []string{"fetcher", "viewer"}},
-		{Package: "nano", Modules: []string{"viewer"}, Absent: true}} {
-		if g, ok := byName[p.Package]; !ok || g.Absent != p.Absent || !same(g.Modules, p.Modules) {
-			t.Errorf("anchor declares %s as %+v, want %+v (all: %+v)", p.Package, g, p, got.Packages)
-		}
-	}
-	for _, p := range got.Packages {
-		if p.Package == "curl" || p.Package == "nano" {
-			continue
-		}
-		for _, m := range p.Modules {
-			if m == "viewer" || m == "fetcher" {
-				t.Errorf("%s is said to be declared by %s, which does not declare it", p.Package, m)
-			}
-		}
-	}
-	var laptop inventory.DeclaredPackagesMirrored
-	if err := json.Unmarshal(first["laptop"], &laptop); err != nil || laptop.Node != "laptop" || laptop.Packages == nil {
-		t.Errorf("a node assigned neither module has no value of its own: %s (%v)", first["laptop"], err)
-	}
-	for _, p := range laptop.Packages {
-		if p.Package == "curl" || p.Package == "nano" {
-			t.Errorf("laptop is assigned neither module and declares %+v", p)
-		}
-	}
-	second, err := source(ctx)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for node, value := range first {
-		if string(second[node]) != string(value) {
-			t.Errorf("the value of %s changed between two passes over the same records:\n%s\n%s", node, value, second[node])
-		}
-	}
-}

cmd/mesh-controller/delivery.go

@@ -15,7 +15,7 @@ import (
 
 	"github.com/nats-io/nats.go"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
@@ -815,14 +815,16 @@ func deliveryPlanDocument(m orderMember, entries []inventory.Entry, read map[str
 //	delivery walks [-n 50] [--plan <id>]
 func deliveryCommand(ctx context.Context, args []string) error {
 	if len(args) == 0 {
-		return errors.New("delivery order|check|go|stop|walks")
+		return errors.New("delivery plan|order|check|go|stop|walks")
 	}
 	sub, rest := args[0], args[1:]
-	if sub == "plan" {
-		// Removed (ADR 0450 §8; issue 1318): refused by name before any flag is read, naming its replacement.
-		return removedByName("delivery-plan")
-	}
 	set := flag.NewFlagSet("delivery "+sub, flag.ContinueOnError)
+	repository := set.String("repository", "", "owner/repository")
+	base := set.String("base", "main", "the branch it merges into")
+	head := set.String("head", "", "the commit at hand")
+	paths := set.String("paths", "", "the files it changes, comma-separated")
+	moduleDirs := set.String("module-dirs", "", "the directories holding a module.json at the head, comma-separated")
+	removed := set.String("removed", "", "the files it deletes, comma-separated")
 	membersJSON := set.String("members", "", "a group's members, as JSON")
 	membersFile := set.String("members-file", "", "a file of a group's members, as JSON: the same as --members, for a list "+
 		"too long for an argument (novox/hq issue 1272)")
@@ -870,6 +872,19 @@ func deliveryCommand(ctx context.Context, args []string) error {
 		return enc.Encode(v)
 	}
 	switch sub {
+	case "plan":
+		if *repository == "" || *head == "" && *paths == "" {
+			return errors.New("delivery plan --repository owner/repo --head <commit> --paths a,b")
+		}
+		m := changeMember(*repository, *base, *head, splitList(*paths), splitList(*removed), moduleDirsOf(*moduleDirs))
+		entries, read, edges, err := theGraph(ctx, inv)
+		if err != nil {
+			return err
+		}
+		return answer(deliveryPlanDocument(m, entries, read, edges, func(module string) (inventory.Upgrade, bool) {
+			u, err := inv.UpgradeOf(ctx, module)
+			return u, err == nil
+		}))
 	case "order":
 		if len(members) == 0 {
 			return errors.New("delivery order --members <json>: a group has members")
@@ -899,9 +914,11 @@ func deliveryCommand(ctx context.Context, args []string) error {
 		if *group == "" || len(members) < 2 {
 			return errors.New("delivery check --group <id> --members <json> (two heads or more), or --members <one head>")
 		}
-		// **The group's composed check is the checker's** (novox/hq ADR 0503 §3; issue 1299, C2): nothing is asked of
-		// build-agent, and the answer says who judges it.
-		return answer(groupCheckAnswer(*group))
+		id, err := askGroupCheck(ctx, open, *group, members)
+		if err != nil {
+			return err
+		}
+		return answer(map[string]any{"asked": id, "group": *group})
 	case "go":
 		if len(positionals) != 1 {
 			return errors.New("delivery go <plan> [--by <who>] [--why <text>]")
@@ -1076,6 +1093,38 @@ func theGraph(ctx context.Context, inv *inventory.Inventory) ([]inventory.Entry,
 	return entries, read, edges, nil
 }
 
+// cycleVerdict is the failing verdict of a group whose modules are ordered in a cycle, and whether there is one: the
+// group's composed check, said without a build. The manifests' change is read from the forge; an answer it cannot give
+// is an error, never read as no cycle.
+func cycleVerdict(ctx context.Context, group string, members []orderMember, reach map[string]orderReach,
+	edges []inventory.Edge, entries []inventory.Entry) (link.Checked, bool, error) {
+	changes, err := changesOf(ctx, changeSourcesOf(members, entries, reach))
+	if err != nil {
+		return link.Checked{}, false, fmt.Errorf("what the group's members say of their manifests cannot be read: %w", err)
+	}
+	var moved []string
+	for _, m := range members {
+		moved = appendNew(moved, reach[m.ID].Moved...)
+	}
+	said := orderEdges(moved, changes, edges).CycleSaid()
+	if said == "" {
+		return link.Checked{}, false, nil
+	}
+	first := members[0].pull()
+	c := link.Checked{ID: link.NewBuildID(time.Now()), Owner: first.Owner, Repo: first.Repo, Number: first.Number,
+		Commit: first.Commit, Verdict: "fail", Summary: said, Report: said, Group: group,
+		Gate: &link.CheckLayer{Verdict: "fail", Summary: said}}
+	for _, m := range members {
+		if group == "" {
+			break // a lone pull request's verdict names no group and no member
+		}
+		p := m.pull()
+		c.Members = append(c.Members, link.CheckedMember{Owner: p.Owner, Repo: p.Repo, Number: p.Number, Commit: p.Commit,
+			Trunk: twelve(p.BaseSHA)})
+	}
+	return c, true, nil
+}
+
 // twelve is a commit as twelve characters.
 func twelve(c string) string {
 	if len(c) > 12 {
@@ -1084,6 +1133,93 @@ func twelve(c string) string {
 	return c
 }
 
+// groupPrimary is the head a group's composed check is run from: the one moving the controller, which then
+// judges the group by itself; else the one moving the node-engine, whose validator judges; else the first.
+func groupPrimary(members []orderMember, reach map[string]orderReach) int {
+	for _, want := range []string{"mesh-controller", "mesh-host"} {
+		for i, m := range members {
+			if slices.Contains(reach[m.ID].Moved, want) {
+				return i
+			}
+		}
+	}
+	return 0
+}
+
+// askGroupCheck asks the build seat for a group's composed check: every head laid over the mesh in turn,
+// judged as one future state (novox/hq ADR 0239). The verdict comes back as `checked` with the group's id,
+// for mesh-delivery; the forge's holder sets no status from it.
+func askGroupCheck(ctx context.Context, open *stores, group string, members []orderMember) (string, error) {
+	entries, read, edges, err := theGraph(ctx, open.inventory)
+	if err != nil {
+		return "", err
+	}
+	reach := reachOfMembers(members, entries, read, edges)
+	// **A cycle of edges fails the group's composed check, naming every module and edge** (novox/hq ADR 0419 clause 6),
+	// before the build seat is asked: no composition of the heads has an order to be sent in.
+	if failing, cyclic, err := cycleVerdict(ctx, group, members, reach, edges, entries); err != nil {
+		return "", err
+	} else if cyclic {
+		sayChecked(ctx, os.Stderr, failing)
+		return failing.ID, nil
+	}
+	primary := groupPrimary(members, reach)
+	p := members[primary].pull()
+	scope := pullScope(p, entries, read, edges)
+	// The gate runs over what any member moves; a judge from the primary alone.
+	for _, m := range members {
+		r := reach[m.ID]
+		scope.Modules = appendNew(scope.Modules, r.Moved...)
+		scope.Dependents = appendNew(scope.Dependents, r.Dependents...)
+	}
+	request, err := checkRequestFor(ctx, open, p, scope, entries)
+	if err != nil {
+		return "", err
+	}
+	request.Check.Group = group
+	// A group's check is queued as ready when any member's pull request is marked ready.
+	request.Check.Ready = slices.ContainsFunc(members, func(m orderMember) bool { return m.Ready })
+	world, err := theRestOfTheMesh(ctx, open.inventory, shelfOf(entries), "")
+	if err != nil {
+		return "", err
+	}
+	for i, m := range members {
+		if i == primary {
+			continue
+		}
+		mp := m.pull()
+		// As the mesh clones a module built from it; a repository no module is built from, from the forge.
+		source := inventory.Source{Seat: gitSeat, Repository: mp.Owner + "/" + mp.Repo}
+		for _, e := range entries {
+			if !e.Provided && sameRepository(e.Source.Repository, link.SourceMoved{Owner: mp.Owner, Repo: mp.Repo}) {
+				source = e.Source
+				break
+			}
+		}
+		url := source.Repository
+		if source.Seat != "" {
+			url, err = clonedFromSeat(world, source.Seat, source.Repository)
+		}
+		if err != nil {
+			return "", fmt.Errorf("%s cannot be cloned for the group's check: %w", m.ID, err)
+		}
+		request.Check.Members = append(request.Check.Members, link.GroupMember{Owner: mp.Owner, Repo: mp.Repo,
+			Number: mp.Number, Repository: url, Ref: mp.Commit, Paths: mp.Paths, Base: mp.Base})
+	}
+	seat := buildSeatHeld(ctx)
+	ask, err := askOverOn(seat)
+	if err != nil {
+		return "", err
+	}
+	defer ask.Close()
+	if err := ask.Ask(ctx, request); err != nil {
+		return "", err
+	}
+	fmt.Fprintf(os.Stderr, "group %s: asked %s to check %d head(s) composed together, as %s\n", group, seat,
+		len(members), request.ID)
+	return request.ID, nil
+}
+
 // appendNew appends what is not there yet.
 func appendNew(to []string, items ...string) []string {
 	for _, i := range items {
@@ -1094,6 +1230,15 @@ func appendNew(to []string, items ...string) []string {
 	return to
 }
 
+// shelfOf is the catalogue's manifests by name.
+func shelfOf(entries []inventory.Entry) map[string]catalogue.Manifest {
+	shelf := map[string]catalogue.Manifest{}
+	for _, e := range entries {
+		shelf[e.Manifest.Module] = e.Manifest
+	}
+	return shelf
+}
+
 // sayPlanMoved says a walk kept in a new state as the controller's `plan-moved`, the plan whole: what the
 // delivery it walks reads its steps from. Never in the way of the walk: said beside it, and a save that could
 // not be said is logged — the delivery's owner, which also asks for the walks it follows, finds it by
@@ -1257,10 +1402,3 @@ func recheckOneHead(member string, answer func(any) error, ask func() (string, e
 	}
 	return answer(recheckAnswer(asked, member))
 }
-
-// groupCheckAnswer is what `delivery check` of a group answers from R4e: who judges it, and that nothing was asked
-// (novox/hq ADR 0503 §3; issue 1299, C2).
-func groupCheckAnswer(group string) map[string]any {
-	return map[string]any{"asked": "", "group": group, "judged-by": checkerModule,
-		"said": "the checker judges a delivery group's heads merged together (ADR 0503 §3): nothing was asked"}
-}

cmd/mesh-controller/delivery_changes.go

@@ -12,7 +12,7 @@ import (
 	"sync"
 	"time"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )

cmd/mesh-controller/delivery_check_answer_test.go

@@ -41,7 +41,7 @@ func TestSayCheckedWritesTheSameLineToItsWriter(t *testing.T) {
 	var w bytes.Buffer
 	sayChecked(context.Background(), &w, link.Checked{ID: "c1", Owner: "novox", Repo: "x", Number: 7, Commit: "0123456789abcdef",
 		Verdict: "pass", Summary: "fine"})
-	want := "c1: novox/x#7 at 01234567 checked on a machine that did not say which: repository none\n"
+	want := "c1: novox/x#7 at 01234567 checked on a machine that did not say which: gate PASS — fine; repository none\n"
 	if w.String() != want {
 		t.Fatalf("sayChecked said %q; want %q", w.String(), want)
 	}

cmd/mesh-controller/delivery_conditions.go

@@ -10,8 +10,8 @@ import (
 
 	"github.com/nats-io/nats.go"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/link"
 )
@@ -58,17 +58,8 @@ type stalledLine struct {
 	// Severity is "urgent" for a group held or half merged and a refused member (novox/hq issues 1275, 1278); empty
 	// or anything else is a warning, as before.
 	Severity string `json:"severity,omitempty"`
-	// Needs is "new-head" for a delivery whose cure is its author's new head (novox/hq ADR 0505 §5), Author that author
-	// as the operator reads it ("the author of feat/x", with the session that pushed it when its pull request names one)
-	// and Branch its branch. A mesh-delivery from before says none, and the words are as before.
-	Needs  string `json:"needs,omitempty"`
-	Author string `json:"author,omitempty"`
-	Branch string `json:"branch,omitempty"`
 }
 
-// needsNewHead is what a stalled line needs when its cure is its author's new head (ADR 0505 §5).
-const needsNewHead = "new-head"
-
 // severity is the condition's severity a stalled line asks: urgent when it says so, a warning otherwise.
 func (l stalledLine) severity() conditions.Severity {
 	if l.Severity == string(conditions.Urgent) {