Take mesh-sdk at c8e3509, which counts an item's text as a placement of a config value (issue 1658)

cmd/mesh-controller/batches.go

@@ -232,8 +232,6 @@ func (f following) hearMerge(ctx context.Context, m link.SourceMoved, now time.T
 		fmt.Print(nothingReadsIt(repository, m))
 		return nil
 	}
-	// **A module the merge adds is asked for now** (novox/hq issue 1617), not when the batch is cut.
-	askNewModulesAtHearing(ctx, inv, m, entries, read, facts.from)
 	// **Its delivery group's word, before the plans are held** (ADR 0306 decision 2): a slow answer holds up no walk.
 	own := ownPath(touches)
 	waits, holding, err := groupWaitHolding(ctx, inv, m, deliverySeatHeld(entries))

cmd/mesh-controller/compose_sdk.go

@@ -366,7 +366,7 @@ func sayFound(ctx context.Context, d compose.Declared) {
 
 // sendableOf is a composed declaration as the controller's sends know it.
 func sendableOf(d compose.Declared) sendable {
-	out := sendable{Resources: compactKept(d.Resources), Sequence: d.Sequence, Epoch: d.Epoch, Generation: d.Generation,
+	out := sendable{Resources: d.Resources, Sequence: d.Sequence, Epoch: d.Epoch, Generation: d.Generation,
 		ReadsModules: d.ReadsModules, moduleOf: d.ModuleOf, buildIDs: d.BuildIDs, modules: d.Modules,
 		localNetwork: d.LocalNetwork, Received: d.Received, Mesh: d.Mesh, BusUsers: d.BusUsers,
 		LeftOut: d.LeftOut, leftOutWhy: d.LeftOutWhy, withheld: d.Withheld, unbound: d.Unbound, foreseen: d.Foreseen,

cmd/mesh-controller/declaration_room.go

@@ -1,96 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"fmt"
-	"strings"
-
-	"github.com/novox/mesh-controller/internal/conditions"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// **A declaration is one bus message, and the bus's largest message is a cliff** (novox/hq issue 1689). On 2026-10-21
-// the control node's declaration passed it by 2 KB and nothing reached that node until two assignments were undone.
-// So the size is measured at every send: a warning condition from 90% of the limit, urgent over it, cleared when
-// the declaration is back under 90%. The limit is the connection's own, not a constant.
-
-// kindDeclarationNearLimit is a declaration at or near the bus's largest message.
-const kindDeclarationNearLimit = "declaration-near-limit"
-
-// declarationRoomSource is the condition's source: the sends.
-const declarationRoomSource = "sends"
-
-func declarationRoomObservation(node string, size, limit int64) conditions.Observation {
-	o := conditions.Observation{Scope: conditions.ScopeMachine, ID: node, Kind: kindDeclarationNearLimit,
-		Token: kindDeclarationNearLimit, Machine: node, Severity: conditions.Warning, Source: declarationRoomSource}
-	if size > limit {
-		o.Severity = conditions.Urgent
-	}
-	o.Summary = fmt.Sprintf("%s's declaration is %d bytes on the wire, %d%% of the bus's largest message of %d bytes",
-		node, size, size*100/limit, limit)
-	if size > limit {
-		o.Summary += ": over it, so it cannot be sent"
-	}
-	return o
-}
-
-func init() {
-	link.DeclarationMeasured = func(ctx context.Context, node string, size, limit int64) {
-		settleDeclarationRoom(ctx, conditionsFrom, node, size, limit)
-	}
-}
-
-// settleDeclarationRoom raises or clears the condition of a declaration's size. A nil keeper (a tool, not the
-// serving controller) says nothing.
-func settleDeclarationRoom(ctx context.Context, keeper *conditions.Keeper, node string, size, limit int64) {
-	if keeper == nil || limit <= 0 {
-		return
-	}
-	obs := declarationRoomObservation(node, size, limit)
-	if float64(size) < link.NearTheLimit*float64(limit) {
-		if _, err := keeper.Clear(ctx, obs.Key(), fmt.Sprintf("%s's declaration is %d bytes, under the limit's margin", node, size)); err != nil {
-			fmt.Printf("the condition %s could not be cleared: %v\n", obs.Key(), err)
-		}
-		return
-	}
-	fmt.Printf("NEAR THE LIMIT: %s\n", obs.Summary)
-	if _, err := keeper.Observe(ctx, obs); err != nil {
-		fmt.Printf("the condition %s could not be raised: %v\n", obs.Key(), err)
-	}
-}
-
-// compactKept writes the vault's export compact. The composition (the SDK's keptFile) writes it indented, and its 334
-// sealed secrets were 164,763 bytes of it against 138,474 compact: a fifth of the declaration's room, in whitespace,
-// base64-encoded again on the wire. Every reader parses JSON, so the spacing is nobody's. A resource that is not
-// the export, or whose content is not JSON, is left as it is. The resources are copied, never changed in place.
-func compactKept(resources []map[string]any) []map[string]any {
-	out := make([]map[string]any, len(resources))
-	for i, r := range resources {
-		out[i] = r
-		id, _ := r["id"].(string)
-		path, _ := r["path"].(string)
-		content, ok := r["content"].(string)
-		if !ok || (id != "kept" && !strings.HasSuffix(id, ".kept")) || !strings.HasSuffix(path, "/export.json") {
-			continue
-		}
-		var dst bytes.Buffer
-		if json.Compact(&dst, []byte(content)) != nil {
-			continue
-		}
-		if strings.HasSuffix(content, "\n") {
-			dst.WriteByte('\n')
-		}
-		if dst.String() == content {
-			continue
-		}
-		c := make(map[string]any, len(r))
-		for k, v := range r {
-			c[k] = v
-		}
-		c["content"] = dst.String()
-		out[i] = c
-	}
-	return out
-}

cmd/mesh-controller/declaration_room_test.go

@@ -1,71 +0,0 @@
-package main
-
-import (
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/conditions"
-)
-
-// The vault's export is sent compact (issue 1689): same document, no indentation, one rewrite.
-func TestTheVaultsExportIsSentCompactAndNothingElseIsTouched(t *testing.T) {
-	indented := "{\n  \"export\": 1,\n  \"kept\": [\n    {\n      \"name\": \"a\"\n    }\n  ]\n}\n"
-	other := "{\n  \"x\": 1\n}\n"
-	in := []map[string]any{
-		{"id": "mesh-vault.kept", "type": "file", "path": "/srv/vault/export.json", "mode": "0600", "content": indented},
-		{"id": "mesh-vault.config", "type": "file", "path": "/srv/vault/config.json", "content": other},
-		{"id": "other.kept", "type": "file", "path": "/srv/other/notes.json", "content": other},
-	}
-	out := compactKept(in)
-	want := "{\"export\":1,\"kept\":[{\"name\":\"a\"}]}\n"
-	if out[0]["content"] != want || out[0]["mode"] != "0600" || out[0]["path"] != "/srv/vault/export.json" {
-		t.Fatalf("the export is %q (%v), expected %q with its mode and path kept", out[0]["content"], out[0], want)
-	}
-	if out[1]["content"] != other || out[2]["content"] != other {
-		t.Fatalf("a file that is not the export was rewritten: %v %v", out[1], out[2])
-	}
-	if in[0]["content"] != indented {
-		t.Fatalf("the composed resource was changed in place")
-	}
-	if again := compactKept(out); again[0]["content"] != want {
-		t.Fatalf("compacting twice changed it: %q", again[0]["content"])
-	}
-}
-
-// From 90% of the bus's largest message the declaration is a warning; over it, urgent; back under 90%, cleared.
-func TestADeclarationNearTheBusLimitRaisesAConditionAndClearsWhenSmaller(t *testing.T) {
-	store := conditions.NewInMemory()
-	k := conditions.NewKeeper(t.Context(), conditions.Options{Store: store, History: store,
-		Teller: &conditions.Told{}, Now: func() time.Time { return time.Date(2026, 10, 21, 14, 0, 0, 0, time.UTC) }})
-	t.Cleanup(func() { k.Close(t.Context()) })
-	const limit = 1000
-	key := declarationRoomObservation("novox", 0, limit).Key()
-	read := func() (conditions.Condition, bool) {
-		t.Helper()
-		c, found, err := conditions.ReadOne(t.Context(), store, key)
-		if err != nil {
-			t.Fatal(err)
-		}
-		return c, found
-	}
-
-	settleDeclarationRoom(t.Context(), k, "novox", 899, limit)
-	if _, found := read(); found {
-		t.Fatal("a declaration at 89.9% raised a condition")
-	}
-	settleDeclarationRoom(t.Context(), k, "novox", 900, limit)
-	c, found := read()
-	if !found || c.Severity != conditions.Warning || !strings.Contains(c.Summary, "900 bytes") ||
-		!strings.Contains(c.Summary, "1000") || c.Subject.Machine != "novox" {
-		t.Fatalf("at 90%% the condition is %v %+v", found, c)
-	}
-	settleDeclarationRoom(t.Context(), k, "novox", 1001, limit)
-	if c, _ := read(); c.Severity != conditions.Urgent {
-		t.Fatalf("over the limit the condition is %q, expected urgent", c.Severity)
-	}
-	settleDeclarationRoom(t.Context(), k, "novox", 850, limit)
-	if _, found := read(); found {
-		t.Fatal("the condition stayed after the declaration fell under 90%")
-	}
-}

cmd/mesh-controller/new_module_asked_once_test.go

@@ -1,37 +0,0 @@
-package main
-
-import (
-	"reflect"
-	"testing"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// 1617/AC2 (unit): a new module whose first build a merge's hearing asked is not asked again when its batch is cut,
-// and one whose ask failed, was never handed over or is long lost is.
-func TestAModuleWhoseBuildIsComingIsNotAskedAgain(t *testing.T) {
-	now := time.Date(2026, 10, 21, 12, 0, 0, 0, time.UTC)
-	source := buildSource{Repository: "http://forge/novox/mesh-catalog.git", Seat: "git"}
-	asked := func(path string, mod func(*inventory.RequestOutcome)) inventory.RequestOutcome {
-		r := inventory.RequestOutcome{BuildRequest: inventory.BuildRequest{ID: "b-" + path, Repository: source.Repository,
-			Seat: "git", Path: path, For: "merge", At: now.Add(-3 * time.Minute)}}
-		if mod != nil {
-			mod(&r)
-		}
-		return r
-	}
-	requests := []inventory.RequestOutcome{
-		asked("modules/go", nil),
-		asked("modules/failed", func(r *inventory.RequestOutcome) { r.Heard, r.Failed = true, "no module.json" }),
-		asked("modules/notasked", func(r *inventory.RequestOutcome) { r.NotAsked = "the bus is silent" }),
-		asked("modules/lost", func(r *inventory.RequestOutcome) { r.At = now.Add(-2 * time.Hour) }),
-		asked("modules/byhand", func(r *inventory.RequestOutcome) { r.For = "build" }),
-	}
-	got := unaskedDirs([]string{"modules/go", "modules/failed", "modules/notasked", "modules/lost", "modules/byhand",
-		"modules/nodejs"}, requests, source, now)
-	want := []string{"modules/failed", "modules/notasked", "modules/lost", "modules/byhand", "modules/nodejs"}
-	if !reflect.DeepEqual(got, want) {
-		t.Fatalf("asked again %v, want %v", got, want)
-	}
-}

cmd/mesh-controller/new_module_on_merge_test.go

@@ -6,7 +6,6 @@ import (
 	"context"
 	"sync"
 	"testing"
-	"time"
 
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
@@ -100,38 +99,3 @@ func TestAMergeBuildsItsNewModuleBesideItsPlan(t *testing.T) {
 		t.Fatalf("a merge adding no module asked for %v", *asked)
 	}
 }
-
-// 1617/AC1 (integration): a merge adding a module to a repository the mesh builds modules from, heard while a batch of
-// that repository is still assembling (its window running), asks the module's first build when it is heard, so the
-// module is registered while the batch waits; cutting the batch asks it no second time (1617/AC2).
-func TestAMergeAddingAModuleAsksItsBuildBeforeItsBatchIsCut(t *testing.T) {
-	open := windowed(t)
-	groupsWaiting(t, "pr/c1")
-	asked := asksWithPaths(t)
-	catalog := func(commit string, made time.Time, paths ...string) link.SourceMoved {
-		return link.SourceMoved{Owner: "novox", Repo: "mesh-catalog", Base: "main", Commit: commit,
-			Head: "pr/" + commit, MergedAt: made.Format(time.RFC3339Nano), Paths: paths}
-	}
-	hear(t, open, catalog("c1", t0, "modules/app/index.ts"), t0)
-	if len(*asked) != 0 {
-		t.Fatalf("a merge adding no module asked %v", *asked)
-	}
-	hear(t, open, lone(catalog("c2", t0.Add(10*time.Second), "modules/go/packages.json", "modules/go/module.json")), t0.Add(10*time.Second))
-	if ws, bs := walks(t, open); len(ws) != 0 || len(bs) != 1 {
-		t.Fatalf("the batch should still be assembling: %d walk(s), %d batch(es)", len(ws), len(bs))
-	}
-	want := [3]string{"novox/mesh-catalog", "modules/go", "main"}
-	if len(*asked) != 1 || (*asked)[0] != want {
-		t.Fatalf("heard with its batch assembling, the merge asked %v, not %v", *asked, want)
-	}
-	cutAt(t, open, t0.Add(10*time.Second+90*time.Second))
-	n := 0
-	for _, a := range *asked {
-		if a[1] == "modules/go" {
-			n++
-		}
-	}
-	if n != 1 {
-		t.Fatalf("modules/go was asked %d times: %v", n, *asked)
-	}
-}

cmd/mesh-controller/plain_words.go

@@ -195,21 +195,6 @@ var plainWordings = map[string]func(conditions.Observation) words{
 				"there yet is sealed by the controller until the vault holds it.", m, m),
 			Resolved: "Resolved: the vault gave " + m + " the core's credentials"}
 	}),
-	kindDeclarationNearLimit: worded(func(o conditions.Observation) words {
-		m := machineOr(o, "a machine")
-		if o.Severity == conditions.Urgent {
-			return words{Headline: m + " cannot be sent its instructions",
-				Needs: "make the instructions for " + m + " smaller, for example by taking a module off it.",
-				Explanation: fmt.Sprintf("The instructions for %s have grown past the largest message the bus takes, so "+
-					"nothing new reaches %s until they are smaller.", m, m),
-				Resolved: "Resolved: the instructions for " + m + " fit the bus again"}
-		}
-		return words{Headline: "The instructions for " + m + " are nearly too big",
-			Needs: "do not add more to " + m + " until this is dealt with; the details give the size.",
-			Explanation: fmt.Sprintf("The instructions for %s are close to the largest message the bus takes. "+
-				"One more module or secret may stop anything new from reaching %s.", m, m),
-			Resolved: "Resolved: the instructions for " + m + " have room again"}
-	}),
 	kindCoreDowngrade: worded(func(o conditions.Observation) words {
 		m := machineOr(o, "a machine")
 		component := idPart(o, 0)

cmd/mesh-controller/upgrades.go

@@ -415,59 +415,7 @@ func askNewModules(ctx context.Context, inv *inventory.Inventory, m link.SourceM
 	if len(added) == 0 || len(from) == 0 {
 		return nil
 	}
-	source := buildSource{Repository: from[0].Source.Repository, Seat: from[0].Source.Seat}
-	// Asked once (novox/hq issue 1617): a module is asked when its merge is heard, and again here when the batch is cut.
-	var requests []inventory.RequestOutcome
-	for _, dir := range added {
-		if got, err := inv.RequestsNamed(ctx, inventory.BuildRequest{Repository: source.Repository, Path: dir}.Name()); err == nil {
-			requests = append(requests, got...)
-		}
-	}
-	return askBuilds(ctx, inv, m, source, unaskedDirs(added, requests, source, time.Now()))
-}
-
-// askedInFlightFor is how long a merge's build request stands as the build coming for its module: past it, a lost one
-// is asked again.
-const askedInFlightFor = time.Hour
-
-// unaskedDirs are the directories of a new module no build of a merge is on its way for: a kept request of the same
-// repository and directory, asked for a merge and handed over, whose outcome has not come and is not given up on,
-// is the build coming (novox/hq issue 1617).
-func unaskedDirs(added []string, requests []inventory.RequestOutcome, source buildSource, now time.Time) []string {
-	var out []string
-	for _, dir := range added {
-		path := dir
-		if path == "." {
-			path = ""
-		}
-		coming := false
-		for _, r := range requests {
-			if r.For == "merge" && r.Repository == source.Repository && strings.Trim(r.Path, "/") == path &&
-				r.NotAsked == "" && r.OutcomeUnknown == "" && !r.Heard && now.Sub(r.At) < askedInFlightFor {
-				coming = true
-				break
-			}
-		}
-		if !coming {
-			out = append(out, dir)
-		}
-	}
-	return out
-}
-
-// askNewModulesAtHearing asks the first build of the modules a merge adds to a repository the mesh builds modules from,
-// when the merge is heard, not when its batch is cut (novox/hq issue 1617): a batch waits out its window and the walk
-// before it, and a module added by a merge delivered meanwhile could not be assigned. Outside the batch and its plan.
-func askNewModulesAtHearing(ctx context.Context, inv *inventory.Inventory, m link.SourceMoved, entries []inventory.Entry,
-	read map[string][]inventory.ReadRepository, from []inventory.Entry) {
-	if len(from) == 0 {
-		return
-	}
-	_, added, _ := touchedBy(from, entries, m, read)
-	if asked := askNewModules(ctx, inv, m, from, added); len(asked) > 0 {
-		fmt.Printf("%s/%s merged into %s (%.8s) adds %s: the first build is asked now, before its batch is cut\n",
-			m.Owner, m.Repo, m.Base, m.Commit, strings.Join(asked, ", "))
-	}
+	return askBuilds(ctx, inv, m, buildSource{Repository: from[0].Source.Repository, Seat: from[0].Source.Seat}, added)
 }
 
 // askBuilds asks the first build of each directory of a merge's repository, as askNewModules does, from the source given.

go.mod

@@ -3,7 +3,7 @@ module github.com/novox/mesh-controller
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021093645-465beb4ea5e3
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021105408-c8e35097e861
 	github.com/jackc/pgx/v5 v5.10.0
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0

go.sum

@@ -1,7 +1,7 @@
 git.novox.be/novox/mesh-host v0.0.0-20261018171808-9d9e3a46c4f5 h1:E5stfIeCN6uYgA9TCv+4K8JgaURg3zQppvUgJLaDMP4=
 git.novox.be/novox/mesh-host v0.0.0-20261018171808-9d9e3a46c4f5/go.mod h1:4wyoCr6IIIIarEUuROThWDj7DAvJvIidqMjWcpSnOwE=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021093645-465beb4ea5e3 h1:OKxU64kHN1yQ/GOa6LwoUwVmiQ74d83WMSZJRFPVm9c=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021093645-465beb4ea5e3/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021105408-c8e35097e861 h1:BsqolZMMsC5jLP8X88BwShqFssLgtREcgBIy6OfPSI8=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021105408-c8e35097e861/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=

internal/link/bus.go

@@ -184,14 +184,6 @@ func (b OverNATS) PublishMembershipAfter(ctx context.Context, node, module strin
 	return nil
 }
 
-// MaxPayload is the largest message the connected server takes, as the server told this connection.
-func (b OverNATS) MaxPayload() int64 {
-	if b.Conn == nil {
-		return 0
-	}
-	return b.Conn.MaxPayload()
-}
-
 func (b OverNATS) PublishDeclaration(ctx context.Context, node string, body []byte) error {
 	_, err := b.JS.Publish(DeclareSubject(node), body, nats.Context(ctx))
 	if err != nil {

internal/link/declare.go

@@ -46,41 +46,8 @@ func Declare(ctx context.Context, bus Bus, signer Signer, node string,
 		return err
 	}
 
-	// **Measured before it is sent** (novox/hq issue 1689): the bare bus error said only "maximum payload
-	// exceeded", on 2026-10-21 for the control node's declaration, 2 KB over. The limit is the connection's own.
-	if limit := payloadLimitOf(bus); limit > 0 {
-		size := int64(len(body))
-		if DeclarationMeasured != nil {
-			DeclarationMeasured(ctx, node, size, limit)
-		}
-		if size > limit {
-			return fmt.Errorf("%s's declaration is %d bytes on the wire (%d bytes of declaration, signed and encoded), "+
-				"over the bus's largest message of %d bytes by %d: it cannot be sent (novox/hq issue 1689)",
-				node, size, len(declaration), limit, size-limit)
-		}
-	}
-
 	publish, cancel := context.WithTimeout(ctx, timeout)
 	defer cancel()
 
 	return bus.PublishDeclaration(publish, node, body)
 }
-
-// NearTheLimit is the share of the bus's largest message at which a declaration is said to be near it.
-const NearTheLimit = 0.9
-
-// DeclarationMeasured is told, at every send of a declaration, its size on the wire and the bus's largest message,
-// so the controller raises a condition when it nears the limit and clears it when it is back under (issue 1689).
-// Set by the controller; nil in a test or a tool.
-var DeclarationMeasured func(ctx context.Context, node string, size, limit int64)
-
-// payloadLimiter is a bus that knows its largest message.
-type payloadLimiter interface{ MaxPayload() int64 }
-
-// payloadLimitOf is the bus's largest message in bytes, or 0 when the bus does not say.
-func payloadLimitOf(bus Bus) int64 {
-	if l, ok := bus.(payloadLimiter); ok {
-		return l.MaxPayload()
-	}
-	return 0
-}

internal/link/declare_room_integration_test.go

@@ -1,52 +0,0 @@
-//go:build integration
-
-package link
-
-import (
-	"context"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/nats-io/nats.go"
-	"github.com/novox/mesh-controller/internal/testbus"
-)
-
-// Against a real bus whose largest message is small: the limit is read from the connection, the one that fits goes
-// through, the one over is refused by us with its size and the limit, not by the client's bare error (issue 1689).
-func TestADeclarationIsMeasuredAgainstTheRealBusLimit(t *testing.T) {
-	s := testbus.StartWithMaxPayload(t, 2048)
-	conn, err := nats.Connect(s.ClientURL())
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer conn.Close()
-	js, err := conn.JetStream()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := js.AddStream(&nats.StreamConfig{Name: "NODES", Subjects: []string{"mesh.node.*.declare"}}); err != nil {
-		t.Fatal(err)
-	}
-	bus := OverNATS{Conn: conn, JS: js}
-	if bus.MaxPayload() != 2048 {
-		t.Fatalf("the limit read from the connection is %d, expected 2048", bus.MaxPayload())
-	}
-	var told []int64
-	was := DeclarationMeasured
-	DeclarationMeasured = func(_ context.Context, _ string, size, limit int64) { told = append(told, size, limit) }
-	t.Cleanup(func() { DeclarationMeasured = was })
-
-	fits := []byte(`{"a":"` + strings.Repeat("x", 600) + `"}`)
-	if err := Declare(t.Context(), bus, fixedSigner{}, "novox", fits, 5*time.Second); err != nil {
-		t.Fatalf("a declaration under the limit: %v", err)
-	}
-	over := []byte(`{"a":"` + strings.Repeat("x", 1600) + `"}`)
-	err = Declare(t.Context(), bus, fixedSigner{}, "novox", over, 5*time.Second)
-	if err == nil || !strings.Contains(err.Error(), "2048 bytes") || strings.Contains(err.Error(), "maximum payload exceeded") {
-		t.Fatalf("a declaration over the limit: %v", err)
-	}
-	if len(told) != 4 || told[1] != 2048 || told[2] <= 2048 {
-		t.Fatalf("measured %v", told)
-	}
-}

internal/link/declare_room_test.go

@@ -1,57 +0,0 @@
-package link
-
-import (
-	"context"
-	"strings"
-	"testing"
-	"time"
-)
-
-type roomBus struct {
-	Bus
-	limit int64
-	sent  [][]byte
-}
-
-func (b *roomBus) MaxPayload() int64 { return b.limit }
-func (b *roomBus) PublishDeclaration(_ context.Context, _ string, body []byte) error {
-	b.sent = append(b.sent, body)
-	return nil
-}
-
-type fixedSigner struct{}
-
-func (fixedSigner) Sign(context.Context, []byte) ([]byte, error) { return []byte("sig"), nil }
-
-// A declaration is measured as it goes on the wire against the bus's own limit; one over it is refused saying size and
-// limit, and what the measure sees is told to whoever raises a condition (issue 1689).
-func TestADeclarationOverTheBusLimitIsRefusedSayingSizeAndLimit(t *testing.T) {
-	var seen []int64
-	was := DeclarationMeasured
-	DeclarationMeasured = func(_ context.Context, node string, size, limit int64) {
-		if node != "novox" || limit != 400 {
-			t.Errorf("measured %s against %d", node, limit)
-		}
-		seen = append(seen, size)
-	}
-	t.Cleanup(func() { DeclarationMeasured = was })
-
-	bus := &roomBus{limit: 400}
-	small := []byte(`{"a":"` + strings.Repeat("x", 100) + `"}`)
-	if err := Declare(t.Context(), bus, fixedSigner{}, "novox", small, time.Second); err != nil || len(bus.sent) != 1 {
-		t.Fatalf("a small declaration: %v, %d sent", err, len(bus.sent))
-	}
-	if int64(len(bus.sent[0])) != seen[0] {
-		t.Fatalf("measured %d bytes, sent %d", seen[0], len(bus.sent[0]))
-	}
-
-	big := []byte(`{"a":"` + strings.Repeat("x", 300) + `"}`)
-	err := Declare(t.Context(), bus, fixedSigner{}, "novox", big, time.Second)
-	if err == nil || !strings.Contains(err.Error(), "400 bytes") || !strings.Contains(err.Error(), "novox") ||
-		!strings.Contains(err.Error(), "over") || strings.Contains(err.Error(), "maximum payload exceeded") {
-		t.Fatalf("an oversize declaration: %v", err)
-	}
-	if len(bus.sent) != 1 || len(seen) != 2 || seen[1] <= 400 {
-		t.Fatalf("it was sent (%d) or not measured (%v)", len(bus.sent), seen)
-	}
-}

internal/testbus/testbus.go

@@ -56,14 +56,10 @@ var buses sync.Map
 
 // Start is a server with JetStream, for this test alone: on loopback, on a port the system chooses, its
 // store in the test's own directory.
-func Start(t testing.TB) *server.Server { return StartWithMaxPayload(t, 0) }
-
-// StartWithMaxPayload is Start with the largest message the server takes set to maxPayload bytes; zero keeps the
-// server's default (1 MiB, as the mesh's bus has).
-func StartWithMaxPayload(t testing.TB, maxPayload int32) *server.Server {
+func Start(t testing.TB) *server.Server {
 	t.Helper()
 	opts := &server.Options{Host: "127.0.0.1", Port: server.RANDOM_PORT, JetStream: true, StoreDir: t.TempDir(),
-		NoLog: true, NoSigs: true, MaxPayload: maxPayload}
+		NoLog: true, NoSigs: true}
 	s, err := server.NewServer(opts)
 	if err != nil {
 		t.Fatalf("a bus for this test could not be made: %v", err)

modules/route-proxy/go.mod

@@ -1,5 +1,5 @@
 module route-proxy
 
-go 1.26.0
+go 1.25.0
 
-require git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021114014-66e8fdaa62e2
+require git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261018003858-f185aedbf5d6

modules/route-proxy/go.sum

@@ -1,2 +1,4 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021114014-66e8fdaa62e2 h1:Cdl5N56QPfmFBoLHrDfvvyc5Q+PUnTjf3fgYD7imcco=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021114014-66e8fdaa62e2/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261016174426-a4e7f480b3b0 h1:EK84so3Y8JdFT3BHrzj9cPQQrDUPa/d+IdOGnerlmEI=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261016174426-a4e7f480b3b0/go.mod h1:GFuZUElBZ9A++mxgIKo97aXXo+kV0uJ/UkbhQPPIbrY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261018003858-f185aedbf5d6 h1:Sv1Qzix+U1RpaUkw5IbB0IJEyZ+FqgzHmbZrCZkcWf0=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261018003858-f185aedbf5d6/go.mod h1:GFuZUElBZ9A++mxgIKo97aXXo+kV0uJ/UkbhQPPIbrY=

modules/route-proxy/vendor/git.novox.be/novox/mesh-sdk/go/README.md

@@ -17,5 +17,3 @@ at the same version as the TypeScript package.
 What it holds, under ADR 0039's test: the stdio loop and the tool type, and `cli`, the local protocol
 `mesh-cli` speaks to the node-engine on its machine (novox/hq ADR 0272): the socket's path and one request and one
 answer; and `seal`, the mesh's sealed box (novox/hq ADR 0206: X25519, HKDF-SHA256, AES-256-GCM, `{v, eph, iv, tag, ct}`), byte for byte the box the licence manager made before it lived here and the TypeScript `@novox/mesh-sdk/seal` makes. Nothing else — no bus, no client, nothing of any module's. `go build ./example` and pipe a `tools/list` request into it.
-
-From release 4a of design 47 (novox/hq ADR 0453 clause 3, ADR 0446 clause 4) it also holds the composition of a machine's declaration, over a plain input and with nothing behind it: `declaration` and `validate`, the node-engine's parser and its validator, copied from mesh-host; `catalogue`, the manifests, their resolution and rendering, and `overlay`, the private network's generator, copied from mesh-controller; `compose`, the controller's planFor, renderingFor and declarationWith as functions of an `Input` (the composition never allocates, makes, keeps or writes: what a send would do it names as foreseen or returns); `sdkversion`, which mesh-sdk version a program was built with; and, in `delivery`, the layouts of the keys the builder, the checker and the indexer write (the source fingerprint's new form, the builds, the verdicts and kept verdicts, the manifests by digest). None of them holds a bus, a store or a vault client, which `go list -deps` of `compose` shows.

modules/route-proxy/vendor/git.novox.be/novox/mesh-sdk/go/merge-check.sh

@@ -5,127 +5,16 @@
 # seat in the mesh's Go toolchain, its own container, because the SDK's merge-check.sh declares it
 # (`# mesh-check-also: go go/merge-check.sh`) — and by hand, from anywhere: `sh go/merge-check.sh`.
 #
-# Formatted, vetted (with and without the build tag `integration`), and run at two levels (novox/hq ADR 0391):
-#
-#   1. the unit level: `go test ./...` untagged, no bus or other process, timed and held to a bound
-#      (unit_bound below); over it the check fails and names the slowest tests (issue 895);
-#   2. the integration level: the whole suite with `-tags integration`, each test against a bus of its
-#      own (internal/testbus, which issue 1171 brings with the first test that needs a bus) so nothing is
-#      serialised. With no tagged test yet, the level runs the unit tests again and says their count.
-#
-# **A test that starts a bus or another process carries `//go:build integration`** as the first line of
-# its file; a file that held both kinds is two files (`<name>_integration_test.go` beside `<name>_test.go`).
-# Each level says its test count and its time.
-#
-# No dependency is committed (no vendor directory: .gitignore; the operator, 2026-10-19; issue 1304). Every dependency
-# is resolved by the version and checksum go.sum names (novox/hq ADR 0405 §5), from its public source: this binding
-# requires nothing of the mesh's own forge. `go mod verify` fails by module name when a downloaded dependency does not
-# match go.sum, and -mod=readonly fails a build whose go.sum lacks an entry instead of writing it. gofmt reads only
-# the binding's own files.
-#
-# Exit 0 is a pass; anything else fails `mesh/repo-check` with the last line printed.
+# Formatted, vetted, and its whole suite run: the stdio loop and the local protocol mesh-cli speaks to the
+# node-engine. Standard library only, so nothing is fetched.
 set -eu
 cd "$(dirname "$0")"
-# The toolchain the check runs in sets -mod=vendor; there is no vendor directory, so it is replaced.
-GOFLAGS="$(printf '%s' "${GOFLAGS:-}" | sed 's/-mod=[a-z]*//g') -mod=readonly"
-export GOFLAGS
-export GOPRIVATE=git.novox.be
 
-# **The unit level's bound, in seconds** (issue 895): the slowest package's own test time of the untagged run,
-# the compile not counted. A run over it fails the check and names the slowest tests. The SDK's unit suite is
-# small (its slowest package measured well under a second on a quiet machine), so 2 s leaves room for a busier
-# build node without hiding a test that should carry `integration` instead.
-unit_bound=2
-
-# judge_unit_run says the unit level as `go test -v` reported it and fails when it was over the bound: $1 the
-# file holding the output of the untagged `go test -v` of every package (packages one after another, each
-# ending in its `ok <package> <time>` line), $2 the bound in seconds. Packages run side by side, so the
-# level's time is that of its slowest package; the five slowest tests of the run are named when it is over,
-# so that the bound is kept by making them cheap or by tagging them `integration`, and never by raising it
-# (issue 895).
-judge_unit_run() {
-	out=$1 bound=$2
-	awk '
-		/^--- (PASS|FAIL|SKIP): / {
-			name = $3; took = $4; gsub(/[()s]/, "", took)
-			pending[++n] = took "\t" name
-			if ($2 == "SKIP:") skipped++
-			next
-		}
-		/^(ok|FAIL)[ \t]/ && NF >= 3 && $3 ~ /^[0-9.]+s$/ {
-			t = $3; sub(/s$/, "", t)
-			for (i = 1; i <= n; i++) print "T\t" pending[i] "\t" $2
-			n = 0
-			print "P\t" t "\t" $2
-		}
-		END { print "S\t" skipped + 0 }
-	' "$out" >"$out.judged"
-	tests=$(grep -c '^T' "$out.judged" || true)
-	skipped=$(awk -F'\t' '$1 == "S" {print $2}' "$out.judged")
-	level=$(awk -F'\t' '$1 == "P" && $2 + 0 > m {m = $2 + 0} END {printf "%.2f", m}' "$out.judged")
-	echo "unit level: $tests tests ($skipped skipped), $level s (bound $bound s)"
-	if awk -v t="$level" -v b="$bound" 'BEGIN {exit !(t + 0 > b + 0)}'; then
-		echo "the unit level took $level s, over its bound of $bound s; the slowest tests:"
-		awk -F'\t' '$1 == "T" {print $2 "\t" $4 "\t" $3}' "$out.judged" | sort -t"$(printf '\t')" -k1,1 -nr | head -n 5 |
-			awk -F'\t' '{printf "  %s s  %s  %s\n", $1, $3, $2}'
-		echo "make them cheap (no wait, no process), or give their files //go:build integration if they start a bus or another process"
-		return 1
-	fi
-}
-# `sh go/merge-check.sh judge-unit-run <output> <bound>` runs only the judging of the unit level, on a
-# recorded output.
-if [ "${1:-}" = judge-unit-run ]; then
-	shift
-	judge_unit_run "$@"
-	exit
-fi
-
-if ! fetched=$(go mod download 2>&1); then
-	echo "FAILED: the dependencies cannot be fetched: $(printf '%s\n' "$fetched" | tail -n 1)"
-	exit 1
-fi
-if ! verified=$(go mod verify 2>&1); then
-	echo "FAILED: a dependency does not match go.sum: $verified"
-	exit 1
-fi
-
-unformatted=$(find . -name '*.go' -not -path './vendor/*' | xargs gofmt -l)
+unformatted=$(gofmt -l .)
 if [ -n "$unformatted" ]; then
 	echo "not gofmt'd:"
 	echo "$unformatted"
 	exit 1
 fi
 go vet ./...
-# The files tagged `integration` are vetted too, or nothing would read them.
-go vet -tags integration ./...
-
-# NOT RACE-CHECKED here: the SDK's suite is small and carries no store or other shared state between
-# packages, so the race detector is not required of this check (novox/hq issue 1175); a module that needs
-# it asks for it in its own merge-check.sh.
-echo "NOT RACE-CHECKED: the Go binding's check runs without the race detector"
-
-work=$(mktemp -d)
-trap 'rm -rf "$work"' EXIT
-
-# The unit level first and alone: every package untagged, no bus or other process (judged above).
-status=0
-go test -count=1 -v ./... >"$work/unit.out" 2>&1 || status=$?
-if [ "$status" -ne 0 ]; then
-	grep -vE '^(=== |[[:space:]]*--- PASS)' "$work/unit.out"
-	echo "the unit level failed (go test exited $status)"
-	exit 1
-fi
-judge_unit_run "$work/unit.out" "$unit_bound"
-
-# The integration level: the whole suite with the tag, each test against its own bus (internal/testbus).
-integration_start=$(date +%s)
-status=0
-go test -tags integration -count=1 -v ./... >"$work/integration.out" 2>&1 || status=$?
-grep -vE '^(=== |[[:space:]]*--- PASS)' "$work/integration.out" || true
-tests=$(grep -cE '^--- (PASS|FAIL|SKIP): ' "$work/integration.out" || true)
-skipped=$(grep -cE '^--- SKIP: ' "$work/integration.out" || true)
-echo "integration level: $tests tests ($skipped skipped), $(($(date +%s) - integration_start)) s"
-if [ "$status" -ne 0 ]; then
-	echo "the integration level failed (go test exited $status)"
-	exit 1
-fi
+go test -count=1 ./...

modules/route-proxy/vendor/git.novox.be/novox/mesh-sdk/go/stdio.go

@@ -57,11 +57,7 @@ type message struct {
 // channel is the one conversation with the runtime: what this bundle writes, serialised, and what
 // it asked and waits for.
 type channel struct {
-	mu sync.Mutex
-	// wmu orders the writes to the runtime and nothing else: a write waits on the pipe for as long as
-	// the runtime does not read, and mu must never wait with it, or the loop that reads the runtime's
-	// answers stops (issue 1286).
-	wmu       sync.Mutex
+	mu        sync.Mutex
 	enc       *json.Encoder
 	next      int
 	waiting   map[string]chan message
@@ -94,8 +90,8 @@ type Envelope struct {
 
 func (c *channel) say(m map[string]any) {
 	m["jsonrpc"] = "2.0"
-	c.wmu.Lock()
-	defer c.wmu.Unlock()
+	c.mu.Lock()
+	defer c.mu.Unlock()
 	_ = c.enc.Encode(m)
 }
 
@@ -476,15 +472,10 @@ func matchFrom(p []string, pi int, k []string, ki int) bool {
 	return matchFrom(p, pi+1, k, ki+1)
 }
 
-// EmitOptions is the provenance an emitter may attach (ADR 0042), and the message id it may choose.
+// EmitOptions is the provenance an emitter may attach (ADR 0042).
 type EmitOptions struct {
 	CausationID string
 	Schema      string
-	// MessageID is the id this emit is sent under, as x-event-id (and, by the tool runner, as the bus's
-	// own Nats-Msg-Id): chosen by the emitter so a repeated publish inside the stream's duplicate window
-	// is kept to one, never generated once an id is given (novox/hq ADR 0436 clause 4). Empty is a random
-	// one, as on main.
-	MessageID string
 }
 
 // Emit asks the runtime to publish an event as this bundle's module, and returns once the bus has
@@ -504,17 +495,8 @@ func Emit(eventType string, body any, opts ...EmitOptions) error {
 	if node == "" {
 		node = "unknown"
 	}
-	id := ""
-	for _, o := range opts {
-		if o.MessageID != "" {
-			id = o.MessageID
-		}
-	}
-	if id == "" {
-		id = eventID()
-	}
 	headers := map[string]string{
-		"x-event-id": id, "x-source": source, "x-node": node,
+		"x-event-id": eventID(), "x-source": source, "x-node": node,
 		"x-time": time.Now().UTC().Format(time.RFC3339Nano), "content-type": "application/json",
 	}
 	for _, o := range opts {

modules/route-proxy/vendor/modules.txt

@@ -1,4 +1,4 @@
-# git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021114014-66e8fdaa62e2
-## explicit; go 1.26.0
+# git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261018003858-f185aedbf5d6
+## explicit; go 1.22
 git.novox.be/novox/mesh-sdk/go
 git.novox.be/novox/mesh-sdk/go/provider

testdata/beside/CAPTURED

@@ -9,7 +9,7 @@ a second place to clean besides the catalogue itself.
 
 mesh-catalog  e0bc919d4945bb5f13f971f74643a0b714cf45da  modules/*/module.json, modules/nats/Dockerfile
 mesh-host     9d9e3a46c4f5943cfffb413d962ce48b75e2fd39  examples/foundation-first-node.lock
-mesh-sdk      465beb4ea5e37eb36f6ba7fc60274de2d5a0d060  conformance/events/module-event.json
+mesh-sdk      c8e35097e8611c174c7937d9ade86ed292314e9a  conformance/events/module-event.json
 
 To move them, from this repository's root, with the two repositories checked out beside it:
 

vendor/git.novox.be/novox/mesh-sdk/go/catalogue/setting_into.go

@@ -324,7 +324,7 @@ func settingKeysUsedBy(m Manifest) map[string]bool {
 	return used
 }
 
-// settingKeysAskedOutsideOwners is every key a module's files, units, contributions and served facts
+// settingKeysAskedOutsideOwners is every key a module's files, units, items, contributions and served facts
 // ask for: what a directory's owner may follow (OwnerSettingProblems).
 func settingKeysAskedOutsideOwners(m Manifest) map[string]bool {
 	used := map[string]bool{}
@@ -345,6 +345,10 @@ func settingKeysAskedOutsideOwners(m Manifest) map[string]bool {
 			}
 		}
 	}
+	// An item's text, filled from its template (WithTemplatesFrom), places a key as a file's does (issue 1658).
+	for _, it := range m.Items {
+		note(it.Content)
+	}
 	inValues := func(values map[string]any) {
 		for _, v := range values {
 			if s, ok := v.(string); ok {

vendor/git.novox.be/novox/mesh-sdk/go/delivery/source.go

@@ -389,11 +389,20 @@ type Module struct {
 	Src        uint64       `json:"src,omitempty"`
 	Repository string       `json:"repository"`
 	Commit     string       `json:"commit"`
-	// Path is the module's directory in its repository, trimmed of slashes, empty when its manifest is the repository's
-	// root (novox/hq ADR 0478 clause 8): the build tools need it. A value written before has none.
+	// Path is the module's directory in its repository, trimmed of slashes, and RootPath (".") when its manifest is the
+	// repository's root (novox/hq ADR 0478 clause 8, issue 1615): the build tools need it. Empty means not known: a value
+	// written before the indexer learned paths has none.
 	Path string `json:"path,omitempty"`
+	// Toolchains are the toolchains FP2 was computed with, by language (go, typescript): the version installed and the
+	// build module's recipe version the build nodes agreed on then (novox/hq ADR 0477 clause 2, ADR 0478 clause 3). A builder
+	// builds the fingerprint only with these. Empty when FP2 is empty or the module has no toolchain; a value written
+	// before has none (issue 1615).
+	Toolchains map[string]ToolchainUsed `json:"toolchains,omitempty"`
 }
 
+// RootPath is Module.Path of a module whose manifest is its repository's root.
+const RootPath = "."
+
 // KeptInputs2 are SourceInputs2 without the module's name (the key has it) and without toolchains (those come from
 // the build modules' toolchain keys when the fingerprint is computed): what a Module keeps of a merge.
 type KeptInputs2 struct {
@@ -421,6 +430,11 @@ func (m Module) check() error {
 	case m.FP2 != "" && m.None2 != "":
 		return fmt.Errorf("delivery: a module has both fp2 and none2")
 	}
+	for language, t := range m.Toolchains {
+		if t.Version == "" || t.Recipe == "" {
+			return fmt.Errorf("delivery: the module's toolchain of %q needs its version and its recipe version", language)
+		}
+	}
 	if m.Inputs2 != nil && m.Manifest == "" {
 		return fmt.Errorf("delivery: a module keeps new-form inputs but has no manifest digest")
 	}

vendor/modules.txt

@@ -1,4 +1,4 @@
-# git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021093645-465beb4ea5e3
+# git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021105408-c8e35097e861
 ## explicit; go 1.26.0
 git.novox.be/novox/mesh-sdk/go/asks
 git.novox.be/novox/mesh-sdk/go/catalogue