Say an account without its time as age unknown, not as two thousand years (issue 160)

The architecture and kernel a machine reported were kept and read by nothing, and the facts the
node-engine now says (memory, filesystems, processor, distribution, virtual or physical, uptime,
timezone) would have joined them. node shows every one in one block with the age of the account,
and a fact the machine could not determine as unknown with its why, never as a zero.

cmd/mesh-builder/main.go

@@ -256,13 +256,7 @@ func answer(ctx context.Context, publisher builder.Publisher, on, workspace stri
 		v, err = builder.Check(building, builder.Command, checkSpecOf(request), workspace, registry, forgeFrom(), say)
 		if err == nil {
 			result.Check = &link.CheckOutcome{Verdict: v.Verdict, Summary: v.Summary, Report: v.Report,
-				Took: v.Took.Round(time.Second).String(), Gate: layerOf(v.Gate), RepoCheck: layerOf(v.Repo),
-				Head: v.Head, Trunk: v.Trunk, Beside: v.Beside}
-			// What each of a group's heads was judged as (novox/hq ADR 0323 §6).
-			for _, m := range v.Members {
-				result.Check.Members = append(result.Check.Members, link.CheckedMember{Owner: m.Owner, Repo: m.Repo,
-					Commit: m.Head, Trunk: m.Trunk})
-			}
+				Took: v.Took.Round(time.Second).String(), Gate: layerOf(v.Gate), RepoCheck: layerOf(v.Repo)}
 		}
 	} else if err == nil {
 		// The package-registry credential is a build input, so it is resolved before the clone: a
@@ -360,7 +354,7 @@ func checkSpecOf(request link.BuildRequest) builder.CheckSpec {
 	}
 	for _, m := range c.Members {
 		spec.Group = append(spec.Group, builder.GroupHead{Owner: m.Owner, Repo: m.Repo, Repository: m.Repository,
-			Ref: m.Ref, Paths: m.Paths, Base: m.Base})
+			Ref: m.Ref, Paths: m.Paths})
 	}
 	return spec
 }

cmd/mesh-controller/checks.go

@@ -161,7 +161,9 @@ func (f following) PullUpdated(ctx context.Context, p link.PullUpdated) error {
 		return u, err == nil
 	})
 	fmt.Print(planText(plan))
-	direct := directVerdict(p, plan)
+	direct := link.Checked{Owner: p.Owner, Repo: p.Repo, Number: p.Number, Commit: p.Commit,
+		ID: link.NewBuildID(time.Now()), Verdict: "pass", Summary: noModuleTouched,
+		Gate: &link.CheckLayer{Verdict: "pass", Summary: noModuleTouched}, Plan: &plan}
 	switch {
 	case !scope.gated() && !scope.Mesh:
 		fmt.Printf("%s/%s#%d (%.8s): %s, and the repository is not the mesh's: said, nothing run\n",
@@ -199,24 +201,6 @@ func (f following) PullUpdated(ctx context.Context, p link.PullUpdated) error {
 	return nil
 }
 
-// directVerdict is the verdict of a change no build judges — it touches no module, and either the repository is not
-// the mesh's or the head holds no merge-check.sh. **It names the trunk commit it holds for** (novox/hq ADR 0323 §3):
-// the base branch's head the forge announced with the head, so the merge tool can weigh it against the trunk's head
-// and does not refuse it for ever (a verdict naming no trunk is never the trunk's head's). Nothing was built to
-// judge: the trunk commit is the one the forge said the change was announced against.
-func directVerdict(p link.PullUpdated, plan link.ChangePlan) link.Checked {
-	trunk := p.BaseSHA
-	if len(trunk) > 12 {
-		trunk = trunk[:12]
-	}
-	if trunk != "" {
-		plan.Trunk = trunk
-	}
-	return link.Checked{Owner: p.Owner, Repo: p.Repo, Number: p.Number, Commit: p.Commit,
-		ID: link.NewBuildID(time.Now()), Verdict: "pass", Summary: noModuleTouched,
-		Gate: &link.CheckLayer{Verdict: "pass", Summary: noModuleTouched}, Plan: &plan, Trunk: trunk}
-}
-
 // checkRequestFor is the ask for one pull request's head: the repository as the mesh clones it, the head,
 // and what is read beside it.
 func checkRequestFor(ctx context.Context, open *stores, p link.PullUpdated, scope checkScope,
@@ -379,9 +363,6 @@ func checkedOf(result link.BuildResult) link.Checked {
 	case result.Check != nil:
 		c.Verdict, c.Summary, c.Report = result.Check.Verdict, result.Check.Summary, result.Check.Report
 		c.Gate, c.RepoCheck = result.Check.Gate, result.Check.RepoCheck
-		// What was judged (novox/hq ADR 0323 §3): the head merged into the trunk commit, and the commits of the
-		// repositories read beside it.
-		c.Trunk, c.Beside, c.Took = result.Check.Trunk, result.Check.Beside, result.Check.Took
 		if c.Gate == nil {
 			// A build seat from before the layers: its verdict is the gate's.
 			c.Gate = &link.CheckLayer{Verdict: c.Verdict, Summary: c.Summary}
@@ -407,20 +388,14 @@ func checkedOf(result link.BuildResult) link.Checked {
 	}
 	if result.Checked != nil {
 		c.Plan = result.Checked.Plan
-		if c.Plan != nil && c.Trunk != "" {
-			// The kept delivery plan records the trunk commit with its other inputs (ADR 0323 §3).
-			plan := *c.Plan
-			plan.Trunk = c.Trunk
-			c.Plan = &plan
-		}
 		// A delivery group's composed check (novox/hq ADR 0239): every head it judged, this one first.
 		if g := result.Checked; g.Group != "" {
 			c.Group = g.Group
 			c.Members = append(c.Members, link.CheckedMember{Owner: g.Owner, Repo: g.Repo, Number: g.Number,
-				Commit: result.Ref, Trunk: c.Trunk})
+				Commit: result.Ref})
 			for _, m := range g.Members {
 				c.Members = append(c.Members, link.CheckedMember{Owner: m.Owner, Repo: m.Repo, Number: m.Number,
-					Commit: m.Ref, Trunk: memberTrunk(result.Check, m)})
+					Commit: m.Ref})
 			}
 		}
 	}
@@ -435,20 +410,6 @@ func checkedOf(result link.BuildResult) link.Checked {
 	return c
 }
 
-// memberTrunk is the trunk commit the build seat merged one of a group's heads into (novox/hq ADR 0323 §6), empty
-// when it said none.
-func memberTrunk(outcome *link.CheckOutcome, m link.GroupMember) string {
-	if outcome == nil {
-		return ""
-	}
-	for _, j := range outcome.Members {
-		if strings.EqualFold(j.Owner, m.Owner) && strings.EqualFold(j.Repo, m.Repo) && strings.HasPrefix(m.Ref, j.Commit) {
-			return j.Trunk
-		}
-	}
-	return ""
-}
-
 func prefixedAll(prefix string, items []string) []string {
 	out := make([]string, 0, len(items))
 	for _, i := range items {
@@ -463,12 +424,8 @@ func sayChecked(ctx context.Context, c link.Checked) {
 	if c.RepoCheck != nil {
 		repo = strings.ToUpper(c.RepoCheck.Verdict) + " — " + c.RepoCheck.Summary
 	}
-	judged := ""
-	if c.Trunk != "" {
-		judged = " merged into trunk " + c.Trunk
-	}
-	fmt.Printf("%s: %s/%s#%d at %.8s%s checked on %s: gate %s — %s; repository %s\n", c.ID, c.Owner, c.Repo, c.Number,
-		c.Commit, judged, orSomewhere(c.On), strings.ToUpper(c.Verdict), c.Summary, repo)
+	fmt.Printf("%s: %s/%s#%d at %.8s checked on %s: gate %s — %s; repository %s\n", c.ID, c.Owner, c.Repo, c.Number,
+		c.Commit, orSomewhere(c.On), strings.ToUpper(c.Verdict), c.Summary, repo)
 	if checkEvents == nil {
 		return
 	}

cmd/mesh-controller/checks_test.go

@@ -210,81 +210,3 @@ func TestABuildOffTheTrunkIsNeverPublished(t *testing.T) {
 		t.Errorf("a build seat that said nothing was refused: %v", err)
 	}
 }
-
-// **A verdict names the trunk commit it judged** (novox/hq ADR 0323 §3, issue 341): the controller's `checked`
-// carries the head and the trunk commit the build seat merged it into, the commits of the repositories read beside
-// it, how long it took, and the kept delivery plan records the trunk commit with its other inputs. A group's
-// composed check names, per member, the trunk commit that head was merged into (§6).
-func TestAVerdictNamesTheTrunkCommitItJudged(t *testing.T) {
-	plan := &link.ChangePlan{Repository: "novox/mesh-host", Base: "main", Head: "dfb1415aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-		Summary: "builds mesh-host"}
-	asked := &link.CheckRequest{Owner: "novox", Repo: "mesh-host", Number: 66, Base: "main", Plan: plan}
-	c := checkedOf(link.BuildResult{ID: "b", Ref: "dfb1415aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", Checked: asked,
-		Check: &link.CheckOutcome{Verdict: "pass", Took: "4m12s", Head: "dfb1415aaaaa", Trunk: "d28ca95bbbbb",
-			Gate: &link.CheckLayer{Verdict: "pass"}, RepoCheck: &link.CheckLayer{Verdict: "pass"},
-			Beside: map[string]string{"mesh-catalog": "0123456789ab", "mesh-lab": "ba9876543210"}}})
-	if c.Trunk != "d28ca95bbbbb" || c.Commit != "dfb1415aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" {
-		t.Fatalf("the verdict names head %s and trunk %q", c.Commit, c.Trunk)
-	}
-	if c.Beside["mesh-catalog"] != "0123456789ab" || c.Beside["mesh-lab"] != "ba9876543210" {
-		t.Fatalf("the verdict names the repositories read beside it as %v", c.Beside)
-	}
-	if c.Took != "4m12s" {
-		t.Fatalf("the verdict says it took %q", c.Took)
-	}
-	if c.Plan == nil || c.Plan.Trunk != "d28ca95bbbbb" || c.Plan.Head != plan.Head {
-		t.Fatalf("the kept plan records %+v", c.Plan)
-	}
-	if plan.Trunk != "" {
-		t.Fatal("the plan the controller asked with was changed: the verdict's is a copy")
-	}
-
-	group := &link.CheckRequest{Owner: "novox", Repo: "mesh-controller", Number: 7, Base: "main", Group: "feat/x",
-		Members: []link.GroupMember{{Owner: "novox", Repo: "mesh-host", Number: 8, Ref: "cccccccccccc0000", Base: "main"}}}
-	c = checkedOf(link.BuildResult{ID: "g", Ref: "aaaaaaaaaaaa0000", Checked: group, Check: &link.CheckOutcome{
-		Verdict: "pass", Head: "aaaaaaaaaaaa", Trunk: "111111111111", Gate: &link.CheckLayer{Verdict: "pass"},
-		Members: []link.CheckedMember{{Owner: "novox", Repo: "mesh-host", Commit: "cccccccccccc", Trunk: "222222222222"}}}})
-	if len(c.Members) != 2 || c.Members[0].Trunk != "111111111111" || c.Members[1].Trunk != "222222222222" ||
-		c.Members[1].Commit != "cccccccccccc0000" {
-		t.Fatalf("the composed check names its members %+v", c.Members)
-	}
-}
-
-// **The merge made for a check is never registered** (novox/hq ADR 0323 §2): a build of it — a commit on no branch
-// of the forge — is refused, naming the trunk. The rule of ADR 0238 §1 stands unchanged; this holds it for the
-// merge commit a check makes.
-func TestABuildOfACheckMergeIsRefusedNamingTheTrunk(t *testing.T) {
-	merge := link.BuildResult{ID: "b", Commit: "4b5c6d7e8f90aabbccddeeff0011223344556677", Trunk: "main"}
-	err := publishable(merge, "")
-	if !errors.Is(err, errOffTheTrunk) || !strings.Contains(err.Error(), "not on main") {
-		t.Fatalf("a build of a check's merge was answered %v", err)
-	}
-}
-
-// **A verdict no build judges names its trunk commit too** (novox/hq ADR 0323 §3): a change touching no module of a
-// repository with no merge-check.sh (novox/mesh-tools-go) is answered by the controller itself. Naming no trunk, the
-// merge tool refused it, asked again, got the same verdict, and refused for ever.
-func TestADirectVerdictNamesTheTrunkTheForgeAnnounced(t *testing.T) {
-	p := link.PullUpdated{Owner: "novox", Repo: "mesh-tools-go", Number: 3, Base: "main", Commit: "1a2b3c4d5e6f7a8b9c0d",
-		BaseSHA: "7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b"}
-	c := directVerdict(p, link.ChangePlan{Repository: "novox/mesh-tools-go", Base: "main", Head: p.Commit})
-	if c.Trunk != "7a8b9c0d1e2f" || c.Plan == nil || c.Plan.Trunk != "7a8b9c0d1e2f" {
-		t.Fatalf("the direct verdict names trunk %q, its plan %+v", c.Trunk, c.Plan)
-	}
-	if c.Verdict != "pass" || c.Commit != p.Commit {
-		t.Fatalf("the direct verdict is %+v", c)
-	}
-	if c := directVerdict(link.PullUpdated{Owner: "novox", Repo: "x", Commit: "abc"}, link.ChangePlan{}); c.Trunk != "" {
-		t.Fatalf("a forge that said no base head gave the trunk %q", c.Trunk)
-	}
-}
-
-// A head checked again through mesh-delivery (`delivery check --members`, a recheck) reaches the same direct verdict:
-// it names the base head the forge last announced, kept on the member, or the merge tool would refuse it for ever.
-func TestARecheckedHeadsDirectVerdictNamesItsTrunk(t *testing.T) {
-	m := orderMember{ID: "novox/mesh-tools-go@1a2b3c4d5e6f", Repository: "novox/mesh-tools-go", Base: "main",
-		Head: "1a2b3c4d5e6f7a8b9c0d", Number: 3, BaseSHA: "7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b"}
-	if c := directVerdict(m.pull(), link.ChangePlan{}); c.Trunk != "7a8b9c0d1e2f" {
-		t.Fatalf("a rechecked head's direct verdict names trunk %q", c.Trunk)
-	}
-}

cmd/mesh-controller/core_downgrade.go

@@ -1,215 +0,0 @@
-package main
-
-import (
-	"context"
-	"fmt"
-	"sort"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/conditions"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/lease"
-)
-
-// **No send but a person's `push <node>` and a gate's own put-back moves the mesh's own core to a build older
-// than the one its machine was last sent** (novox/hq issue 201). Every send made through sendToEach keeps it — a
-// plan's, a release's, a healer's, a rotation's, and the bus step too, which is a person's act but composes under
-// sendKeeps like the rest. On 2026-10-02 two merges a minute apart made two plans;
-// the controller's plan rolled the new controller, which widened its seat's row, and the node-engine's plan then
-// sent the control node the controller build before it. The older binary read the row it could not serve and the
-// mesh lost its voice for ten minutes — the thing that would have corrected it was the thing that was down. ADR
-// 0185 took the outage out of it (a controller behind its row serves what it can); the race is closed here,
-// without needing its trigger: whatever made the mesh's record older, the send keeps the build.
-//
-// **Kept, not refused.** The send composes the controller or the node-engine at the build the machine was last
-// sent, as a recorded module is kept (ADR 0245), and carries everything else: no other module, secret, healer or
-// walk waits on it, and nothing is retried. The kept move is no move for a gate either: ungatedIn and gatedSend
-// leave it out (withoutKept), so a gate judges the other moves of its send. A plan whose own build is the older one finds its gate superseded by
-// the build kept there (issue 352) and ends. The mesh's record stays older, and a warning condition says so until
-// a send carries the record — a person's `push <node>` accepts the older build — or the record moves forward: a
-// newer merge, or `rebuild mesh-controller`.
-//
-// Older is by the builds' registration order — when each was asked (novox/hq issue 219) — never by the commits'
-// dates. So a retry or a rebuild of an old commit, asked anew, counts as newer: it is registered as the module's
-// current build by the same order, and the guard does not stop that move. A build that failed its gate is never
-// ahead: the machine was sent it and the record was put back before it (gateFailed), and if the put-back's own
-// send was refused, the next send completes it rather than keeping the failed build there. A gate's own put-back
-// carries its modules back whatever the order (sendScope.puttingBack); the controller's is held to the store's
-// schema already (issue 352).
-
-// kindCoreDowngrade is a core module kept at the build its machine was last sent, over an older record.
-const kindCoreDowngrade = "core-downgrade-kept"
-
-// coreDowngradeSource is the condition's source: the sends, which raise and clear it.
-const coreDowngradeSource = "sends"
-
-// downgradeGuarded is the core components a send may not move backwards: the controller, which reads the
-// store and its seat's row, and the node-engine, which reads what the controller declares.
-var downgradeGuarded = []string{lease.ComponentController, lease.ComponentEngine}
-
-// askedBuild is what the order needs of one build of a module: when it was asked, and whether it failed its gate.
-type askedBuild struct {
-	asked      time.Time
-	failedGate bool
-}
-
-// buildAsked is the newest build of a module from a commit that worked — when it was asked (or recorded, when
-// the request time is not known), and whether it failed its gate — and false when the records hold none. A
-// variable, so a test reads its own order.
-var buildAsked = func(ctx context.Context, inv *inventory.Inventory, module, commit string) (askedBuild, bool, error) {
-	builds, err := inv.Builds(ctx, module, askedLookBack)
-	if err != nil {
-		return askedBuild{}, false, err
-	}
-	for _, b := range builds {
-		if b.Worked() && sameCommit(b.Commit, commit) {
-			failed, err := inv.GateFailed(ctx, b.ID)
-			if err != nil {
-				return askedBuild{}, false, err
-			}
-			return askedBuild{asked: b.AskedOrAt(), failedGate: failed}, true, nil
-		}
-	}
-	return askedBuild{}, false, nil
-}
-
-// askedLookBack is how many of a module's newest builds are read for when a build was asked.
-const askedLookBack = 50
-
-// coreDowngrade is one core module a machine was last sent a build of that is newer than the mesh's record.
-type coreDowngrade struct {
-	module, node, component string
-	// sent is the build the machine was last sent, record the one the mesh holds.
-	sent, record           string
-	sentAsked, recordAsked time.Time
-}
-
-func (d coreDowngrade) String() string {
-	return fmt.Sprintf("%s was last sent %s %s, and the mesh holds the older %s (asked %s, before %s): a send there "+
-		"keeps %s; `push %s` sends the older build, and a newer merge or `rebuild %s` moves the record forward "+
-		"(novox/hq issue 201)", d.node, d.module, short(d.sent), short(d.record),
-		d.recordAsked.UTC().Format(time.RFC3339), d.sentAsked.UTC().Format(time.RFC3339), short(d.sent), d.node,
-		d.module)
-}
-
-// coreDowngrades is, for one machine, each guarded core module whose record is older than the build the machine
-// was last sent, leaving out what a gate's own put-back puts back and a sent build that failed its gate. A move
-// whose either build the records do not hold is not proved older and is left to the gate that judges it. Pure
-// but for asked.
-func coreDowngrades(node string, sent map[string]string, record map[string]string, scope sendScope,
-	asked func(module, commit string) (askedBuild, bool, error)) ([]coreDowngrade, error) {
-	var out []coreDowngrade
-	for module, was := range sent {
-		component := coreComponent(module)
-		now := record[module]
-		if !guarded(component) || was == "" || now == "" || sameCommit(was, now) {
-			continue
-		}
-		if scope.puttingBack && scope.modules[module] {
-			continue
-		}
-		from, known, err := asked(module, was)
-		if err != nil {
-			return nil, fmt.Errorf("when %s's build %s was asked cannot be read: %w", module, short(was), err)
-		}
-		if !known || from.failedGate {
-			continue
-		}
-		to, known, err := asked(module, now)
-		if err != nil {
-			return nil, fmt.Errorf("when %s's build %s was asked cannot be read: %w", module, short(now), err)
-		}
-		if known && to.asked.Before(from.asked) {
-			out = append(out, coreDowngrade{module: module, node: node, component: component, sent: was, record: now,
-				sentAsked: from.asked, recordAsked: to.asked})
-		}
-	}
-	sort.Slice(out, func(i, j int) bool { return out[i].module < out[j].module })
-	return out, nil
-}
-
-func guarded(component string) bool {
-	for _, c := range downgradeGuarded {
-		if c == component {
-			return true
-		}
-	}
-	return false
-}
-
-// coreKept is, for a send that keeps (sendKeeps), each guarded core module of a machine to keep at the build it
-// was last sent, module → commit, each said and raised as a condition.
-func coreKept(ctx context.Context, inv *inventory.Inventory, node string, sent map[string]string,
-	current map[string]inventory.CurrentBuild) (map[string]string, error) {
-	record := map[string]string{}
-	for m, c := range current {
-		record[m] = c.Commit
-	}
-	found, err := coreDowngrades(node, sent, record, scopeOf(ctx), func(module, commit string) (askedBuild, bool, error) {
-		return buildAsked(ctx, inv, module, commit)
-	})
-	if err != nil || len(found) == 0 {
-		return nil, err
-	}
-	out := map[string]string{}
-	for _, d := range found {
-		out[d.module] = d.sent
-		sayCoreDowngrade(ctx, d)
-	}
-	return out, nil
-}
-
-// coreDowngradeObservation is a kept core build as a condition: `core.<component>.<machine>.<kind>`.
-func coreDowngradeObservation(component, node, summary string) conditions.Observation {
-	return conditions.Observation{Scope: conditions.ScopeCore, ID: component + "." + node, Kind: kindCoreDowngrade,
-		Token: kindCoreDowngrade, Machine: node, Severity: conditions.Warning, Source: coreDowngradeSource,
-		Summary: summary}
-}
-
-func sayCoreDowngrade(ctx context.Context, d coreDowngrade) {
-	fmt.Printf("KEPT: %s\n", d)
-	keeper := conditionsFrom
-	if keeper == nil {
-		return
-	}
-	if _, err := keeper.Observe(ctx, coreDowngradeObservation(d.component, d.node, d.String())); err != nil {
-		fmt.Printf("the condition for %s kept on %s could not be raised: %v\n", d.module, d.node, err)
-	}
-}
-
-// settleCoreDowngrades clears, after a send to a machine is away, the condition of each guarded core module the
-// send carried at the mesh's record — a person's push that accepted the older build, or a send after the record
-// moved forward — or did not carry at all. A send that kept the newer build leaves it open.
-func settleCoreDowngrades(ctx context.Context, inv *inventory.Inventory, node string, carried map[string]string) {
-	keeper := conditionsFrom
-	if keeper == nil || carried == nil {
-		return
-	}
-	var open []string
-	for _, c := range downgradeGuarded {
-		if _, found, err := keeper.Get(ctx, coreDowngradeObservation(c, node, "").Key()); err == nil && found {
-			open = append(open, c)
-		}
-	}
-	if len(open) == 0 {
-		return
-	}
-	current, err := inv.CurrentBuilds(ctx)
-	if err != nil {
-		fmt.Printf("whether %s still keeps a core build over the mesh's record cannot be read: %v\n", node, err)
-		return
-	}
-	for module, now := range current {
-		component := coreComponent(module)
-		if !guarded(component) {
-			continue
-		}
-		if was, has := carried[module]; has && !sameCommit(was, now.Commit) {
-			continue
-		}
-		key := coreDowngradeObservation(component, node, "").Key()
-		if _, err := keeper.Clear(ctx, key, node+" was sent the "+component+" the mesh holds"); err != nil {
-			fmt.Printf("the condition %s could not be cleared: %v\n", key, err)
-		}
-	}
-}

cmd/mesh-controller/delivery.go

@@ -580,9 +580,6 @@ type orderMember struct {
 	CloneURL       string   `json:"clone_url,omitempty"`
 	// After are the repositories its pull request says it goes after (`after: <repository>`).
 	After []string `json:"after,omitempty"`
-	// BaseSHA is the base branch's head the forge last announced the head with (novox/hq ADR 0323): the trunk commit
-	// a verdict no build judges names when the head is checked again through mesh-delivery.
-	BaseSHA string `json:"base_sha,omitempty"`
 }
 
 // pull is the member as the forge announced it.
@@ -592,7 +589,7 @@ func (m orderMember) pull() link.PullUpdated {
 	if base == "" {
 		base = "main"
 	}
-	return link.PullUpdated{Owner: owner, Repo: repo, Number: m.Number, Base: base, Commit: m.Head, BaseSHA: m.BaseSHA,
+	return link.PullUpdated{Owner: owner, Repo: repo, Number: m.Number, Base: base, Commit: m.Head,
 		CloneURL: m.CloneURL, Paths: m.Paths, PathsTruncated: m.PathsTruncated, Removed: m.Removed,
 		ModuleDirs: m.ModuleDirs, ModuleDirsSaid: m.ModuleDirsSaid}
 }
@@ -1188,7 +1185,7 @@ func askGroupCheck(ctx context.Context, open *stores, group string, members []or
 			return "", fmt.Errorf("%s cannot be cloned for the group's check: %w", m.ID, err)
 		}
 		request.Check.Members = append(request.Check.Members, link.GroupMember{Owner: mp.Owner, Repo: mp.Repo,
-			Number: mp.Number, Repository: url, Ref: mp.Commit, Paths: mp.Paths, Base: mp.Base})
+			Number: mp.Number, Repository: url, Ref: mp.Commit, Paths: mp.Paths})
 	}
 	seat := buildSeatHeld(ctx)
 	ask, err := askOverOn(seat)

cmd/mesh-controller/gate.go

@@ -1039,7 +1039,7 @@ func gateFailed(ctx context.Context, open *stores, p *inventory.Plan, module str
 		}
 		return
 	}
-	sent, err := sendRollout(withScope(ctx, sendScope{modules: map[string]bool{module: true}, puttingBack: true}), open, g.Machines)
+	sent, err := sendRollout(withScope(ctx, sendScope{modules: map[string]bool{module: true}}), open, g.Machines)
 	if err != nil {
 		notBack(fmt.Sprintf("its registered build is back at %s, and sending it to %s was refused: %v — `push %s` "+
 			"sends it", short(previous.Commit), strings.Join(g.Machines, ", "), err, g.Machines[0]))
@@ -1132,7 +1132,7 @@ func sendRollbacks(ctx context.Context, open *stores, p *inventory.Plan, b *roll
 	}
 	inv := open.inventory
 	sort.Strings(b.machines)
-	sent, err := sendRollout(withScope(ctx, sendScope{modules: b.modules, puttingBack: true}), open, b.machines)
+	sent, err := sendRollout(withScope(ctx, sendScope{modules: b.modules}), open, b.machines)
 	var back []string
 	for _, r := range b.pending {
 		if err != nil {

cmd/mesh-controller/issue201_test.go

@@ -1,259 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/catalogue"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/lease"
-)
-
-// novox/hq issue 201: on 2026-10-02 a plan sent the control node a controller older than the one running there,
-// whose seat row the newer one had already widened; the older binary refused the row and the mesh went quiet for
-// ten minutes. No send but a person's push and a gate's own put-back moves the controller or the node-engine back
-// behind the build its machine was last sent: the send keeps it there, and carries the rest.
-
-// askedIn answers a build from a fixed table: module@commit → when it was asked; failed names those that failed
-// their gate.
-func askedIn(table map[string]time.Time, failed ...string) func(module, commit string) (askedBuild, bool, error) {
-	return func(module, commit string) (askedBuild, bool, error) {
-		at, known := table[module+"@"+commit]
-		b := askedBuild{asked: at}
-		for _, f := range failed {
-			if f == module+"@"+commit {
-				b.failedGate = true
-			}
-		}
-		return b, known, nil
-	}
-}
-
-func TestACoreModuleIsKeptOverAnOlderRecord(t *testing.T) {
-	old, now := t0, t0.Add(time.Minute)
-	table := map[string]time.Time{
-		"mesh-controller@c1": old, "mesh-controller@c2": now,
-		"mesh-host@h1": old, "mesh-host@h2": now,
-		"app@a1": old, "app@a2": now,
-	}
-	sent := map[string]string{"mesh-controller": "c2", "mesh-host": "h2", "app": "a2"}
-	record := map[string]string{"mesh-controller": "c1", "mesh-host": "h1", "app": "a1"}
-	found, err := coreDowngrades("anchor", sent, record, sendScope{judged: map[string]bool{"anchor": true}}, askedIn(table))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(found) != 2 || found[0].module != "mesh-controller" || found[0].component != lease.ComponentController ||
-		found[0].sent != "c2" || found[1].module != "mesh-host" || found[1].component != lease.ComponentEngine {
-		t.Fatalf("the controller and the node-engine over an older record are kept, and nothing else: %+v", found)
-	}
-	if said := found[0].String(); !strings.Contains(said, "anchor was last sent mesh-controller c2") ||
-		!strings.Contains(said, "`push anchor`") || !strings.Contains(said, "`rebuild mesh-controller`") {
-		t.Fatalf("it says the machine, the build kept and the two ways out: %s", said)
-	}
-
-	// The record forward, the same build, or a build the records do not hold: nothing kept.
-	for _, c := range [][2]string{{"c1", "c2"}, {"c2", "c2"}, {"c2", "c9"}, {"c9", "c1"}} {
-		found, err := coreDowngrades("anchor", map[string]string{"mesh-controller": c[0]},
-			map[string]string{"mesh-controller": c[1]}, sendScope{}, askedIn(table))
-		if err != nil || len(found) != 0 {
-			t.Fatalf("sent %s, record %s: no downgrade proved, nothing kept: %+v %v", c[0], c[1], found, err)
-		}
-	}
-
-	// A sent build that failed its gate is never ahead: the record put back before it is sent.
-	if found, _ := coreDowngrades("anchor", sent, record, sendScope{}, askedIn(table, "mesh-controller@c2")); len(found) != 1 ||
-		found[0].module != "mesh-host" {
-		t.Fatalf("a controller that failed its gate was kept over the build put back: %+v", found)
-	}
-
-	// A gate's own put-back carries its own modules back, and nothing else.
-	putBack := sendScope{modules: map[string]bool{"mesh-controller": true}, puttingBack: true}
-	if found, _ := coreDowngrades("anchor", sent, record, putBack, askedIn(table)); len(found) != 1 || found[0].module != "mesh-host" {
-		t.Fatalf("a put-back of the controller carries it back, and not the node-engine: %+v", found)
-	}
-	if found, _ := coreDowngrades("anchor", sent, record, sendScope{modules: map[string]bool{"mesh-controller": true}},
-		askedIn(table)); len(found) != 2 {
-		t.Fatalf("a send for the controller that is no put-back carries it back: %+v", found)
-	}
-}
-
-// core201 is a mesh whose control node, anchor, was sent the newer controller c2 while the mesh's record of the
-// controller is the build before it, c1, which passed its gate when it rolled out.
-func core201(t *testing.T) *stores {
-	t.Helper()
-	open := aMesh(t)
-	ctx := t.Context()
-	inv := open.inventory
-	old, now := time.Now().Add(-2*time.Hour), time.Now().Add(-time.Minute)
-	record := func(commit string, asked time.Time) inventory.Build {
-		manifest, _ := json.Marshal(catalogue.Manifest{Module: "mesh-controller", Version: "1"})
-		b := inventory.Build{ID: "build-mesh-controller-" + commit, Module: "mesh-controller", Commit: commit,
-			Repository: "novox/mesh-controller", Manifest: manifest, Asked: asked, At: asked,
-			Made: []inventory.Artifact{{Name: "x", Kind: "bundle", Reference: "sha256:" + commit + "0000000000000000"}}}
-		if err := inv.RecordBuild(ctx, b); err != nil {
-			t.Fatal(err)
-		}
-		return b
-	}
-	before := record("c1aaaaaaaaaa", old)
-	if err := inv.RecordGate(ctx, inventory.GateVerdict{Build: before.ID, Module: "mesh-controller", Commit: before.Commit,
-		Machines: []string{"anchor"}, Verdict: inventory.GatePassed}); err != nil {
-		t.Fatal(err)
-	}
-	record("c2bbbbbbbbbb", now)
-	if err := inv.RegisterModule(ctx, catalogue.Manifest{Module: "mesh-controller", Version: "1"}, inventory.Source{
-		Repository: "novox/mesh-controller", BuiltFrom: "c2bbbbbbbbbb", Head: "c2bbbbbbbbbb", Asked: now}); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := inv.Assign(ctx, "anchor", "mesh-controller"); err != nil {
-		t.Fatal(err)
-	}
-	if err := inv.RecordSent(ctx, nodeID(t, open, "anchor"), "d-anchor", map[string]string{"mesh-controller": "c2bbbbbbbbbb"}); err != nil {
-		t.Fatal(err)
-	}
-	if err := inv.RestoreModule(ctx, before); err != nil {
-		t.Fatal(err)
-	}
-	wasMoves := machineMoves
-	machineMoves = func(ctx context.Context, open *stores, f moveFacts, node string, all bool) ([]inventory.CarriedMove, error) {
-		modules, err := open.inventory.Assigned(ctx, node)
-		if err != nil {
-			return nil, err
-		}
-		sent, known, err := open.inventory.SentBuilds(ctx, node)
-		if err != nil {
-			return nil, err
-		}
-		return f.moves(node, modules, sent, known, all), nil
-	}
-	t.Cleanup(func() { machineMoves = wasMoves })
-	return open
-}
-
-// TestReplay201 replays the race on a store: the control node runs the newer controller and the mesh's record is
-// the build before it. A plan's send there — the node-engine's plan of 2026-10-02 — goes, keeps the newer
-// controller, and says so as a condition; the gate's own put-back carries it back; a send that carries the record,
-// as a person's push does, clears the condition.
-func TestReplay201(t *testing.T) {
-	open := core201(t)
-	ctx := t.Context()
-	k, _ := withConditionsInMemory(t)
-
-	judged := withScope(ctx, sendScope{judged: map[string]bool{"anchor": true}})
-	if kept, err := ungatedIn(judged, open, []string{"anchor"}, ""); err != nil || len(kept) != 1 {
-		t.Fatalf("a plan's send to the machine is made, the rest of it with it: %v %v", kept, err)
-	}
-	keeps, err := recordedKept(keepingRecorded(judged), open, "anchor")
-	if err != nil || keeps["mesh-controller"] != "c2bbbbbbbbbb" {
-		t.Fatalf("the send keeps the newer controller there: %v %v", keeps, err)
-	}
-	shelf := map[string]catalogue.Manifest{"mesh-controller": {Module: "mesh-controller", Version: "old"}}
-	if _, err := keepRecorded(keepingRecorded(judged), open, "anchor", shelf); err != nil || shelf["mesh-controller"].Version != "1" {
-		t.Fatalf("the send composes the kept build's manifest: %+v %v", shelf, err)
-	}
-	key := coreDowngradeObservation(lease.ComponentController, "anchor", "").Key()
-	if c, found, err := k.Get(ctx, key); err != nil || !found || !strings.Contains(c.Summary, "c2bbbbbb") {
-		t.Fatalf("the condition %s is raised, saying the build kept: %+v %v %v", key, c, found, err)
-	}
-
-	putBack := keepingRecorded(withScope(ctx, sendScope{modules: map[string]bool{"mesh-controller": true}, puttingBack: true}))
-	if keeps, err := recordedKept(putBack, open, "anchor"); err != nil || len(keeps) != 0 {
-		t.Fatalf("the gate's own put-back of the controller carries it back: %v %v", keeps, err)
-	}
-
-	settleCoreDowngrades(ctx, open.inventory, "anchor", map[string]string{"mesh-controller": "c2bbbbbbbbbb"})
-	if _, found, _ := k.Get(ctx, key); !found {
-		t.Fatal("a send that kept the newer controller cleared the condition")
-	}
-	settleCoreDowngrades(ctx, open.inventory, "anchor", map[string]string{"mesh-controller": "c1aaaaaaaaaa"})
-	if _, found, _ := k.Get(ctx, key); found {
-		t.Fatal("a send carrying the mesh's record — a person's push — leaves the condition open")
-	}
-}
-
-// The review of #273: a gate failed the newer controller, put the record back, and the put-back's own send was
-// refused. The next automatic send — a healer's, which judges nothing — completes the put-back: a build that
-// failed its gate is never kept.
-func TestARollbackWhoseSendWasRefusedIsCompletedByTheNextSend(t *testing.T) {
-	open := core201(t)
-	ctx := t.Context()
-	k, _ := withConditionsInMemory(t)
-	if err := open.inventory.RecordGate(ctx, inventory.GateVerdict{Build: "build-mesh-controller-c2bbbbbbbbbb",
-		Module: "mesh-controller", Commit: "c2bbbbbbbbbb", Previous: "c1aaaaaaaaaa", Machines: []string{"anchor"},
-		Verdict: inventory.GateFailed, Rollback: inventory.NotRolledBack}); err != nil {
-		t.Fatal(err)
-	}
-	healer := withScope(ctx, sendScope{})
-	if kept, err := ungatedIn(healer, open, []string{"anchor"}, ""); err != nil || len(kept) != 1 {
-		t.Fatalf("the healer's send is made: %v %v", kept, err)
-	}
-	if keeps, err := recordedKept(keepingRecorded(healer), open, "anchor"); err != nil || len(keeps) != 0 {
-		t.Fatalf("the failed controller was kept over the build put back: %v %v", keeps, err)
-	}
-	if open, _ := k.Open(ctx); len(open) != 0 {
-		t.Fatalf("a completed put-back raised a condition: %+v", open)
-	}
-}
-
-// Review 91 of #273: a gated send to a machine whose controller is kept over an older record leaves the kept
-// controller out of what its gate judges. Judged as moving back to the record, the gate would read the send's own
-// kept controller as another build sent there after it (issue 352) and be superseded, judging nothing.
-func TestAGateJudgesTheOtherMovesBesideAKeptCore(t *testing.T) {
-	open := core201(t)
-	ctx := t.Context()
-	withConditionsInMemory(t)
-	inv := open.inventory
-	old, now := time.Now().Add(-2*time.Hour), time.Now().Add(-time.Minute)
-	for _, b := range []struct {
-		commit string
-		at     time.Time
-	}{{"a1aaaaaaaaaa", old}, {"a2bbbbbbbbbb", now}} {
-		manifest, _ := json.Marshal(catalogue.Manifest{Module: "app", Version: "1"})
-		if err := inv.RecordBuild(ctx, inventory.Build{ID: "build-app-" + b.commit, Module: "app", Commit: b.commit,
-			Repository: "novox/mesh-catalog", Path: "modules/app", Manifest: manifest, Asked: b.at, At: b.at,
-			Made: []inventory.Artifact{{Name: "x", Kind: "bundle", Reference: "sha256:app-" + b.commit}}}); err != nil {
-			t.Fatal(err)
-		}
-		if err := inv.RegisterModule(ctx, catalogue.Manifest{Module: "app", Version: "1"}, inventory.Source{
-			Repository: "novox/mesh-catalog", Seat: "git", Path: "modules/app", BuiltFrom: b.commit, Head: b.commit,
-			Asked: b.at}); err != nil {
-			t.Fatal(err)
-		}
-	}
-	if _, err := inv.Assign(ctx, "anchor", "app"); err != nil {
-		t.Fatal(err)
-	}
-	if err := inv.RecordSent(ctx, nodeID(t, open, "anchor"), "d-anchor-2",
-		map[string]string{"mesh-controller": "c2bbbbbbbbbb", "app": "a1aaaaaaaaaa"}); err != nil {
-		t.Fatal(err)
-	}
-	// The send as it is made: the controller kept at c2, the app moved to the record.
-	wasSend := sendRollout
-	sendRollout = func(ctx context.Context, open *stores, names []string) ([]string, error) {
-		return names, open.inventory.RecordSent(ctx, nodeID(t, open, "anchor"), "d-anchor-3",
-			map[string]string{"mesh-controller": "c2bbbbbbbbbb", "app": "a2bbbbbbbbbb"})
-	}
-	t.Cleanup(func() { sendRollout = wasSend })
-
-	moves, sent, _, err := gatedSend(ctx, open, "anchor", nil)
-	if err != nil || len(sent) != 1 {
-		t.Fatalf("the gated send is made: %v %v", sent, err)
-	}
-	if len(moves) != 1 || moves[0].Module != "app" || moves[0].To != "a2bbbbbbbbbb" {
-		t.Fatalf("the gate judges the app's move and not the kept controller: %+v", moves)
-	}
-	builds, _, err := inv.SentBuilds(ctx, "anchor")
-	if err != nil {
-		t.Fatal(err)
-	}
-	g := &inventory.PlanGate{Carried: moves}
-	f := gateFacts{commits: judgedCommits(g, nil), sentBuilds: map[string]map[string]string{"anchor": builds}}
-	for _, m := range []string{"app", "mesh-controller"} {
-		if why, superseded := f.supersededOn(m, "anchor"); superseded {
-			t.Fatalf("the gate is superseded by its own send: %s", why)
-		}
-	}
-}

cmd/mesh-controller/machine_lines.go

@@ -0,0 +1,135 @@
+package main
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// machineLines is what a machine said it is made of (novox/hq issue 160), as `node` shows it: every fact in
+// one block with its age, the architecture and kernel the profile always carried among them, and each fact
+// the machine could not determine said as unknown with its why — never as a zero, and never left out.
+func machineLines(a inventory.MachineAccount, had bool, now time.Time) []string {
+	if !had {
+		return []string{"  what it is made of: never said — this machine has not reported a profile"}
+	}
+	m := a.Machine
+	if m == nil {
+		return []string{
+			"  what it is made of: not said — its node-engine is older than the one that says it",
+			"    " + factLine("architecture", orUnsaid(a.Architecture)),
+			"    " + factLine("kernel", orUnsaid(a.Kernel)),
+		}
+	}
+	age := roughly(now.Sub(m.ObservedAt)) + " ago"
+	if m.ObservedAt.IsZero() {
+		// Said with no time: its age is not known, and is never read as two thousand years.
+		age = "at a time it did not say (age unknown)"
+	}
+	out := []string{fmt.Sprintf("  what it is made of, as it said %s:", age)}
+	add := func(name, value string) { out = append(out, "    "+factLine(name, value)) }
+	unknown := map[string]string{}
+	for k, v := range m.Unknown {
+		unknown[k] = v
+	}
+	// said is the value, or the fact's own reason it is unknown; a fact neither said nor unknown is a
+	// node-engine that broke its own rule, and is said so rather than shown blank.
+	said := func(fact, value string) string {
+		if value != "" {
+			delete(unknown, fact)
+			return value
+		}
+		if why, ok := unknown[fact]; ok {
+			delete(unknown, fact)
+			return "unknown: " + why
+		}
+		return "unknown: the machine said neither it nor why"
+	}
+
+	add("architecture", orUnsaid(a.Architecture))
+	release := said("kernel release", m.KernelRelease)
+	if m.KernelRelease == "" {
+		release = "(release " + release + ")"
+	}
+	add("kernel", orUnsaid(a.Kernel)+" "+release)
+	dist := said("distribution", m.Distribution)
+	if m.Distribution != "" {
+		dist += " " + said("version", m.Version)
+	}
+	add("distribution", dist)
+	add("processor", said("processor", m.Processor))
+	add("cores", said("cores", countWords(m.Cores)))
+	add("threads", said("threads", countWords(m.Threads)))
+	add("memory", said("memory", bytesWords(m.MemoryBytes)))
+	add("virtual", said("virtual or physical", m.Virtual))
+	up := ""
+	if m.BootedAt != nil {
+		up = fmt.Sprintf("%s, since %s", roughly(now.Sub(*m.BootedAt)), m.BootedAt.Local().Format("2006-01-02 15:04"))
+	}
+	add("up", said("uptime", up))
+	add("timezone", said("timezone", m.Timezone))
+	if len(m.Filesystems) == 0 {
+		add("filesystems", said("filesystems", ""))
+	} else {
+		for i, f := range m.Filesystems {
+			name := ""
+			if i == 0 {
+				name = "filesystems"
+			}
+			add(name, fmt.Sprintf("%s  %s, %s free (%s %s)", f.Mount, bytesWords(f.SizeBytes),
+				bytesWords(f.FreeBytes), f.Type, f.Device))
+		}
+		if why, ok := unknown["filesystems"]; ok {
+			add("", "and some unknown: "+why)
+			delete(unknown, "filesystems")
+		}
+	}
+	add("public address", said("public address", ""))
+	// Any other fact a newer node-engine named unknown, so nothing it said is dropped.
+	rest := make([]string, 0, len(unknown))
+	for k := range unknown {
+		rest = append(rest, k)
+	}
+	sort.Strings(rest)
+	for _, k := range rest {
+		add(k, "unknown: "+unknown[k])
+	}
+	return out
+}
+
+func factLine(name, value string) string { return fmt.Sprintf("%-15s %s", name, value) }
+
+func orUnsaid(s string) string {
+	if strings.TrimSpace(s) == "" {
+		return "not said"
+	}
+	return s
+}
+
+// countWords is a number a machine said, or nothing when it said none (its unknown says why).
+func countWords(n int) string {
+	if n <= 0 {
+		return ""
+	}
+	return fmt.Sprint(n)
+}
+
+// bytesWords is an amount of bytes a person reads, in binary units; nothing when none was said.
+func bytesWords(n int64) string {
+	if n <= 0 {
+		return ""
+	}
+	units := []string{"B", "KiB", "MiB", "GiB", "TiB", "PiB"}
+	v, u := float64(n), 0
+	for v >= 1024 && u < len(units)-1 {
+		v /= 1024
+		u++
+	}
+	if u == 0 {
+		return fmt.Sprintf("%d B", n)
+	}
+	return fmt.Sprintf("%.1f %s", v, units[u])
+}

cmd/mesh-controller/machine_lines_test.go

@@ -0,0 +1,88 @@
+package main
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// Defends novox/hq issue 160: `node` shows every fact a machine said it is made of, in one block with its
+// age, the architecture and kernel among them; and a fact it could not determine as unknown with why.
+func TestNodeShowsWhatAMachineIsMadeOfWithItsAge(t *testing.T) {
+	now := time.Date(2026, 10, 12, 15, 0, 0, 0, time.UTC)
+	booted := now.Add(-75 * time.Hour)
+	a := inventory.MachineAccount{Architecture: "amd64", Kernel: "linux", Machine: &inventory.MadeOf{
+		ObservedAt: now.Add(-3 * time.Hour), KernelRelease: "7.2.8-arch1-2", Distribution: "Arch Linux",
+		Version: "rolling", Processor: "AMD Ryzen 9 8945HS", Cores: 8, Threads: 16, MemoryBytes: 32891494400,
+		Virtual: "physical", BootedAt: &booted, Timezone: "Europe/Brussels",
+		Filesystems: []inventory.MountedFilesystem{{Mount: "/", Device: "/dev/nvme0n1p3", Type: "ext4",
+			SizeBytes: 987978522624, FreeBytes: 31830110208}},
+		Unknown: map[string]string{"public address": "how it learns it is not decided yet"},
+	}}
+	got := strings.Join(machineLines(a, true, now), "\n")
+	t.Log("\n" + got)
+	for _, want := range []string{
+		"what it is made of, as it said 3h ago:",
+		"architecture    amd64",
+		"kernel          linux 7.2.8-arch1-2",
+		"distribution    Arch Linux rolling",
+		"processor       AMD Ryzen 9 8945HS",
+		"cores           8",
+		"threads         16",
+		"memory          30.6 GiB",
+		"virtual         physical",
+		"up              3d, since",
+		"timezone        Europe/Brussels",
+		"filesystems     /  920.1 GiB, 29.6 GiB free (ext4 /dev/nvme0n1p3)",
+		"public address  unknown: how it learns it is not decided yet",
+	} {
+		if !strings.Contains(got, want) {
+			t.Errorf("missing %q", want)
+		}
+	}
+}
+
+func TestAFactAMachineCouldNotReadIsShownUnknownNeverZero(t *testing.T) {
+	now := time.Date(2026, 10, 12, 15, 0, 0, 0, time.UTC)
+	a := inventory.MachineAccount{Architecture: "arm64", Kernel: "linux", Machine: &inventory.MadeOf{
+		ObservedAt: now, Unknown: map[string]string{"memory": "MemTotal not found in /proc/meminfo",
+			"cores": "/proc/cpuinfo says no core id", "kernel release": "permission denied"}}}
+	got := strings.Join(machineLines(a, true, now), "\n")
+	t.Log("\n" + got)
+	for _, want := range []string{
+		"memory          unknown: MemTotal not found in /proc/meminfo",
+		"cores           unknown: /proc/cpuinfo says no core id",
+		"kernel          linux (release unknown: permission denied)",
+		// Neither said nor named unknown: the node-engine broke its rule, and that is shown.
+		"timezone        unknown: the machine said neither it nor why",
+	} {
+		if !strings.Contains(got, want) {
+			t.Errorf("missing %q", want)
+		}
+	}
+	if strings.Contains(got, " 0 ") || strings.Contains(got, "0 B") {
+		t.Error("a fact the machine could not read was shown as a zero")
+	}
+}
+
+func TestAnOlderNodeEngineStillShowsArchitectureAndKernel(t *testing.T) {
+	got := strings.Join(machineLines(inventory.MachineAccount{Architecture: "amd64", Kernel: "linux"}, true,
+		time.Now()), "\n")
+	if !strings.Contains(got, "older than the one that says it") || !strings.Contains(got, "architecture    amd64") ||
+		!strings.Contains(got, "kernel          linux") {
+		t.Errorf("%s", got)
+	}
+	if got := strings.Join(machineLines(inventory.MachineAccount{}, false, time.Now()), "\n"); !strings.Contains(got, "never said") {
+		t.Errorf("%s", got)
+	}
+}
+
+func TestAnAccountWithoutItsTimeSaysAgeUnknown(t *testing.T) {
+	got := machineLines(inventory.MachineAccount{Architecture: "amd64", Kernel: "linux",
+		Machine: &inventory.MadeOf{KernelRelease: "7.2"}}, true, time.Now())[0]
+	if !strings.Contains(got, "age unknown") || strings.Contains(got, "d ago") {
+		t.Errorf("%s", got)
+	}
+}

cmd/mesh-controller/nodes.go

@@ -875,6 +875,17 @@ func showNode(ctx context.Context, stored *stores, name string) error {
 		}
 	}
 
+	// What it is made of, in one block with its age (novox/hq issue 160): collected and shown in the same
+	// breath, so no fact the machine says is kept and read by nothing.
+	if account, had, err := inv.MachineOf(ctx, name); err != nil {
+		fmt.Printf("\n  what it is made of could NOT be read: %v\n", err)
+	} else {
+		fmt.Println()
+		for _, line := range machineLines(account, had, time.Now()) {
+			fmt.Println(line)
+		}
+	}
+
 	held, err := inv.Profile(ctx, name)
 	if err != nil {
 		return err

cmd/mesh-controller/outside_not_given_test.go

@@ -1,120 +0,0 @@
-package main
-
-import (
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/catalogue"
-)
-
-// An own secret issued outside the mesh that nobody gave is never made (novox/hq issue 401, ADR 0228). Seen on
-// 2026-10-10: the send made a random value for the mounts module's smb-credentials and placed it, and the module read
-// it as a credential given and wrong. The send now makes none, places none, and places a value only once a person
-// gave one — and a value the mesh made for it before is not placed either.
-
-// anAssistant is a module with a secret the mesh makes and one only an outside party issues.
-func anAssistant() catalogue.Manifest {
-	return catalogue.Manifest{Module: "assistant", Version: "1",
-		OwnSecrets: catalogue.OwnSecrets{
-			"password":   {Path: "/var/lib/mesh/assistant/password", Taken: catalogue.TakenAtStart},
-			"vendor-key": {Path: "/var/lib/mesh/assistant/vendor-key", Taken: catalogue.TakenAtStart, IssuedBy: catalogue.IssuedOutside},
-		},
-		Resources: []map[string]any{
-			{"id": "state", "type": "directory", "path": "/var/lib/mesh/assistant", "mode": "0700"},
-		}}
-}
-
-// sentTo composes what a push sends to a machine, on the send path.
-func sentTo(t *testing.T, open *stores, node string) []map[string]any {
-	t.Helper()
-	plan, settings, err := planFor(t.Context(), open, node)
-	if err != nil {
-		t.Fatal(err)
-	}
-	declared, err := declarationFor(t.Context(), open, node, plan, settings)
-	if err != nil {
-		t.Fatalf("the send to %s did not compose: %v", node, err)
-	}
-	return declared.Resources
-}
-
-func placedAt(resources []map[string]any, path string) map[string]any {
-	for _, r := range resources {
-		if r["path"] == path && r["sealed"] != nil {
-			return r
-		}
-	}
-	return nil
-}
-
-func TestTheSendMakesNoValueForAnOutsideSecretNobodyGave(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	register(t, open, anAssistant())
-	if _, err := assign(ctx, open, "laptop", "assistant"); err != nil {
-		t.Fatal(err)
-	}
-
-	sent := sentTo(t, open, "laptop")
-	if placedAt(sent, "/var/lib/mesh/assistant/password") == nil {
-		t.Fatal("the secret the mesh makes was not placed")
-	}
-	if got := placedAt(sent, "/var/lib/mesh/assistant/vendor-key"); got != nil {
-		t.Fatalf("a secret nobody gave was placed: %v", got)
-	}
-	if _, held, err := open.inventory.ModuleSecretIfIssued(ctx, "laptop", "assistant", "vendor-key"); err != nil || held {
-		t.Fatalf("the send made a value for a secret issued outside the mesh (held %v, %v)", held, err)
-	}
-
-	// A value the mesh made before this rule is not one a person gave: it is not placed.
-	if _, err := open.inventory.SecretForModule(ctx, "laptop", "assistant", "vendor-key"); err != nil {
-		t.Fatal(err)
-	}
-	if got := placedAt(sentTo(t, open, "laptop"), "/var/lib/mesh/assistant/vendor-key"); got != nil {
-		t.Fatalf("a value the mesh made for a secret issued outside was placed: %v", got)
-	}
-
-	// Given, it is placed.
-	if err := open.inventory.AcceptSecretForModule(ctx, "laptop", "assistant", "vendor-key", "the vendor's key"); err != nil {
-		t.Fatal(err)
-	}
-	given, ok, err := open.inventory.GivenOwnSecret(ctx, "laptop", "assistant", "vendor-key")
-	if err != nil || !ok || !given.Current {
-		t.Fatalf("the value given is not read as given: %+v %v %v", given, ok, err)
-	}
-	placed := placedAt(sentTo(t, open, "laptop"), "/var/lib/mesh/assistant/vendor-key")
-	if placed == nil || placed["sealed"] != given.Sealed {
-		t.Fatalf("the value given is placed as %v", placed)
-	}
-}
-
-// The read paths answer as the send does: a question about the machine composes without the secret nobody gave, and
-// asking writes nothing.
-func TestAQuestionComposesWithoutAnOutsideSecretNobodyGave(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	register(t, open, anAssistant())
-	if _, err := assign(ctx, open, "laptop", "assistant"); err != nil {
-		t.Fatal(err)
-	}
-	pushedBy(t, open, "laptop") // the mesh's own secret is made by the send
-	plan, settings, err := planFor(ctx, open, "laptop")
-	if err != nil {
-		t.Fatal(err)
-	}
-	gens, err := generators(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, choosing := range []Choosing{Reading, Foreseeing} {
-		got, err := declarationWith(ctx, open, "laptop", plan, settings, gens, choosing)
-		if err != nil {
-			t.Fatalf("%v: %v", choosing, err)
-		}
-		if placedAt(got.Resources, "/var/lib/mesh/assistant/vendor-key") != nil || len(got.foreseen) != 0 {
-			t.Fatalf("%v: a secret nobody gave is composed (foreseen %v)", choosing, got.foreseen)
-		}
-	}
-	if _, held, err := open.inventory.ModuleSecretIfIssued(ctx, "laptop", "assistant", "vendor-key"); err != nil || held {
-		t.Fatalf("a question made a value (held %v, %v)", held, err)
-	}
-}

cmd/mesh-controller/plain_words.go

@@ -182,20 +182,6 @@ var plainWordings = map[string]func(conditions.Observation) words{
 				"register it, so it was not made.", module, m),
 			Resolved: "Resolved: " + module + " on " + m + " is settled"}
 	}),
-	// The controller or the node-engine kept at the build a machine was last sent, over an older record (novox/hq
-	// issue 201).
-	kindCoreDowngrade: worded(func(o conditions.Observation) words {
-		m := machineOr(o, "a machine")
-		component := idPart(o, 0)
-		if o.Scope != conditions.ScopeCore || !guarded(component) {
-			component = "core component"
-		}
-		return words{Headline: m + " keeps a newer " + component + " than the mesh holds",
-			Needs: fmt.Sprintf("push %s to take the older build, or a newer merge or rebuild moves the record forward.", m),
-			Explanation: fmt.Sprintf("The mesh's record of its own %s is older than the build %s was last sent, so "+
-				"the mesh's sends keep the newer one there rather than put it back.", component, m),
-			Resolved: "Resolved: " + m + " runs the " + component + " the mesh holds"}
-	}),
 	kindBindingKept: worded(func(o conditions.Observation) words {
 		m := machineOr(o, "a machine")
 		return words{Headline: "A module's data source is held on " + m,

cmd/mesh-controller/plan.go

@@ -590,13 +590,6 @@ func busCredentialIssued(ctx context.Context, inv *inventory.Inventory, node, mo
 	return nil
 }
 
-// givenUnderAnOldKey is the refusal for a value a person gave — a family's member, or an own secret issued outside
-// the mesh — sealed to a key the machine no longer holds: the mesh cannot make another, so it is given again.
-func givenUnderAnOldKey(module, node, name string) error {
-	return fmt.Errorf("%s on %s holds %q, which was given to the mesh rather than made by it, and %s has "+
-		"since generated a new sealing key. The mesh cannot make another; give it again", module, node, name, node)
-}
-
 // renderingFor is everything a node's declaration is composed with, and the node's record.
 func renderingFor(ctx context.Context, open *stores, node string,
 	plan catalogue.Resolution, settings catalogue.SettingsBy,
@@ -715,7 +708,10 @@ func renderingFor(ctx context.Context, open *stores, node string,
 				}
 				if !g.Current {
 					if choosing == Allocating {
-						return catalogue.Rendering{}, inventory.Node{}, givenUnderAnOldKey(m.Module, node, g.Name)
+						return catalogue.Rendering{}, inventory.Node{}, fmt.Errorf(
+							"%s on %s holds %q, which was given to the mesh rather than made by it, and %s has "+
+								"since generated a new sealing key. The mesh cannot make another; give it again",
+							m.Module, node, g.Name, node)
 					}
 					continue
 				}
@@ -725,31 +721,7 @@ func renderingFor(ctx context.Context, open *stores, node string,
 				needed[m.Module][g.Name] = g.Sealed
 			}
 		}
-		for name, own := range m.OwnSecrets.Plain() {
-			// **An own secret issued outside the mesh is never made** (novox/hq issue 401, ADR 0228; ADR 0283 for
-			// a family): only a value a person gave is placed. One not given is nothing — no file, and an empty
-			// value where a file of the module names it — so the module can tell it was not given, where a value
-			// the mesh made looked given and wrong. A value the mesh made for it before is not one either.
-			if own.IssuedBy == catalogue.IssuedOutside {
-				g, given, err := inv.GivenOwnSecret(ctx, node, m.Module, name)
-				if err != nil {
-					return catalogue.Rendering{}, inventory.Node{}, err
-				}
-				if !given {
-					continue
-				}
-				if !g.Current {
-					if choosing == Allocating {
-						return catalogue.Rendering{}, inventory.Node{}, givenUnderAnOldKey(m.Module, node, name)
-					}
-					continue
-				}
-				if needed[m.Module] == nil {
-					needed[m.Module] = map[string]string{}
-				}
-				needed[m.Module][name] = g.Sealed
-				continue
-			}
+		for name := range m.OwnSecrets.Plain() {
 			// Minted on the send path and only read on every other. Making one is an insert, and
 			// a question that writes is a question that can block against the machine it is about.
 			var sealed string
@@ -975,9 +947,14 @@ func renderingFor(ctx context.Context, open *stores, node string,
 	if err != nil {
 		return catalogue.Rendering{}, inventory.Node{}, err
 	}
+	grantsGroups, err := engineGrantsGroups(ctx, inv, node)
+	if err != nil {
+		return catalogue.Rendering{}, inventory.Node{}, err
+	}
 	return catalogue.Rendering{
 		ReadsHealth:   readsHealth,
 		JudgesRoot:    judgesRoot,
+		GrantsGroups:  grantsGroups,
 		BusMembership: memberships[node],
 		Settings:      settings, Generators: gens, Grants: grants, Needed: needed, Foreseen: foreseen, Ports: ports,
 		Certificate: certificate, Authority: authority, Mesh: private, Names: names,
@@ -1010,6 +987,16 @@ func engineJudgesRoot(ctx context.Context, inv *inventory.Inventory, node string
 	return had && stated.Contract >= link.RootContract, nil
 }
 
+// engineGrantsGroups says whether a machine's node-engine reads an access's `grant` (novox/hq ADR 0312), by its own
+// newest statement, for the same reason as engineReadsHealth: an older engine parses strictly.
+func engineGrantsGroups(ctx context.Context, inv *inventory.Inventory, node string) (bool, error) {
+	stated, had, err := inv.HealthOf(ctx, node)
+	if err != nil {
+		return false, err
+	}
+	return had && stated.Contract >= link.GrantContract, nil
+}
+
 // zonesInTheMesh is every zone a module in the mesh declares, where the mesh placed it (novox/hq ADR
 // 0199): the zone settled from that node's settings, the node's private address, the port the
 // answering listen is published on there.

cmd/mesh-controller/plan_ids.go

@@ -1,26 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"regexp"
-)
-
-// planID is every id the mesh gives a plan: a merge's walk or batch (plan-<nanoseconds>) or a release
-// (release-<nanoseconds>).
-var planID = regexp.MustCompile(`^(plan|release)-[0-9]+$`)
-
-// planIDArguments are the arguments of plans that name a plan. wait is among them for when it is declared
-// (novox/hq issue 229); an argument not declared is refused before this is asked.
-var planIDArguments = []string{"id", "wait", "stop", "close", "retry", "go"}
-
-// plainPlanIDs refuses a plans call naming a plan by anything but a plan's id (novox/hq issue 561): checked
-// once, where the call becomes a command line, so nothing else a caller sent reaches a command or the store.
-func plainPlanIDs(given map[string]string) error {
-	for _, arg := range planIDArguments {
-		if id, named := given[arg]; named && !planID.MatchString(id) {
-			return fmt.Errorf("plans %s: %q is not a plan's id (plan-<digits> or release-<digits>, as `plans` "+
-				"lists them); nothing was done", arg, id)
-		}
-	}
-	return nil
-}

cmd/mesh-controller/plan_ids_test.go

@@ -1,37 +0,0 @@
-package main
-
-import (
-	"strings"
-	"testing"
-)
-
-// **A plan's id is checked once, where a call becomes a command line** (novox/hq issue 561): every argument of
-// plans that names a plan is refused unless it is an id the mesh gives a plan, so a quote never reaches a
-// command, nor the store behind it.
-func TestAPlanIdThatIsNoPlansIdIsRefusedBeforeACommandStarts(t *testing.T) {
-	for _, arg := range []string{"id", "stop", "close", "retry", "go"} {
-		for _, bad := range []string{"x' or '1'='1", "plan-1'", "plan-", "plan-1 2", "batch-1", "PLAN-1"} {
-			args := map[string]any{arg: bad}
-			if arg == "stop" || arg == "close" || arg == "go" {
-				args["why"] = "a test"
-			}
-			argv, err := argvFor("plans", args)
-			if err == nil {
-				t.Errorf("plans %s %q was composed: %v", arg, bad, argv)
-				continue
-			}
-			if !strings.Contains(err.Error(), "is not a plan's id") {
-				t.Errorf("plans %s %q was refused for another reason: %v", arg, bad, err)
-			}
-		}
-		for _, good := range []string{"plan-1791813626034291775", "release-1791811938267404408"} {
-			args := map[string]any{arg: good}
-			if arg == "stop" || arg == "close" || arg == "go" {
-				args["why"] = "a test"
-			}
-			if _, err := argvFor("plans", args); err != nil {
-				t.Errorf("plans %s %q was refused: %v", arg, good, err)
-			}
-		}
-	}
-}

cmd/mesh-controller/plans_follow.go

@@ -1,158 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"os"
-	"strconv"
-	"strings"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// Following a plan (novox/hq issue 229): `plans wait <id>` holds its answer until the plan moves, reaches its
-// next tier or ends, or until its bound passes, and says which. Before it, an agent following a rollout had
-// `plans` answer once, in prose, and wrote a loop of its own round the mesh's tools to be told the plan moved.
-//
-// **No wait is longer than a call is answered within** (link.LongestAnswer, inside the console's thirty
-// seconds): a longer one would answer "still running" and leave its caller to ask `calls` — the loop again.
-// So a caller following a plan to its end asks again; each call answers the moment the plan moves.
-
-// maxPlanWait is the longest bound a wait takes, and the bound when none is given: what a call is answered
-// within, less the time a verb's command takes to start and read the store.
-var maxPlanWait = link.LongestAnswer - planWaitStart
-
-// planWaitStart is what the verb's window allows beyond the bound: starting the command and opening the stores.
-// A store slow enough to push the read and the answer past it degrades as any long call does: the caller is
-// answered that the call is still running, and `calls` with its id says what came of it.
-const planWaitStart = 5 * time.Second
-
-// planWaitEvery is how often a wait reads the plan again.
-const planWaitEvery = time.Second
-
-// The things a wait waits until.
-var planWaitUntil = []string{"moved", "tier", "done"}
-
-// planWaitAsked checks what a wait is asked for: until (moved when empty) and a bound (a duration, or a number
-// of seconds; maxPlanWait when empty).
-func planWaitAsked(until, bound string) (string, time.Duration, error) {
-	if until == "" {
-		until = "moved"
-	}
-	known := false
-	for _, u := range planWaitUntil {
-		known = known || u == until
-	}
-	if !known {
-		return "", 0, fmt.Errorf("a wait is until %s, not %q", strings.Join(planWaitUntil, ", "), until)
-	}
-	d := maxPlanWait
-	if bound = strings.TrimSpace(bound); bound != "" {
-		var err error
-		if secs, isNumber := strconv.Atoi(bound); isNumber == nil {
-			d = time.Duration(secs) * time.Second
-		} else if d, err = time.ParseDuration(bound); err != nil {
-			return "", 0, fmt.Errorf("the bound %q is not a duration (such as 20s) or a number of seconds", bound)
-		}
-		if d <= 0 || d > maxPlanWait {
-			return "", 0, fmt.Errorf("the bound is at most %s, the longest a call is answered within; %s was asked "+
-				"— to follow a plan longer, ask again: each call answers the moment the plan moves", maxPlanWait, d)
-		}
-	}
-	return until, d, nil
-}
-
-// planEnded is a plan that will not move again: done, failed or superseded. A batch being assembled is not one.
-func planEnded(p inventory.Plan) bool { return !p.Open() && !p.Batch() }
-
-// waitOnPlan reads the plan until what it waits for happens or the bound passes, and answers the plan as last
-// read and what ended the wait: moved (any save of it), tier (its tier changed), done (it ended — which ends
-// every wait, since nothing comes after it), or bound. Moved and tier are judged against the plan as first read.
-func waitOnPlan(ctx context.Context, read func(context.Context) (inventory.Plan, error), until string,
-	bound, every time.Duration) (inventory.Plan, string, error) {
-	first, err := read(ctx)
-	if err != nil {
-		return inventory.Plan{}, "", err
-	}
-	if planEnded(first) {
-		return first, "done", nil
-	}
-	deadline := time.Now().Add(bound)
-	tick := time.NewTicker(every)
-	defer tick.Stop()
-	last := first
-	for {
-		select {
-		case <-ctx.Done():
-			return last, "", ctx.Err()
-		case <-tick.C:
-		}
-		if !time.Now().Before(deadline) {
-			return last, "bound", nil
-		}
-		p, err := read(ctx)
-		if err != nil {
-			return last, "", err
-		}
-		last = p
-		switch {
-		case planEnded(p):
-			return p, "done", nil
-		case until == "moved" && p.Revision != first.Revision:
-			return p, "moved", nil
-		case until == "tier" && p.Tier != first.Tier:
-			return p, "tier", nil
-		}
-	}
-}
-
-// planWaited is what `plans wait` answers: the plan, what ended the wait, and the line a person reads (`text`,
-// which the verb answers as its output and not again in the data).
-type planWaited struct {
-	// Came is what ended the wait: moved, tier, done, or bound when nothing did.
-	Came   string     `json:"came"`
-	Until  string     `json:"until"`
-	Waited string     `json:"waited"`
-	Plan   planStatus `json:"plan"`
-	// Revision is the plan's as read: a caller asking again with the same plan sees whether it moved since.
-	Revision int64  `json:"revision"`
-	Text     string `json:"text"`
-}
-
-func planWaitedDoc(p inventory.Plan, st planStatus, until, came string, waited time.Duration, line string) planWaited {
-	said := map[string]string{
-		"moved": "moved", "tier": "reached another tier", "done": "ended",
-		"bound": "did not " + map[string]string{"moved": "move", "tier": "reach another tier", "done": "end"}[until],
-	}[came]
-	text := fmt.Sprintf("%s %s in %s (waited until %s)\n%s — %s\n", p.ID, said, waited.Round(time.Second), until,
-		p.ID, line)
-	return planWaited{Came: came, Until: until, Waited: waited.Round(time.Millisecond).String(), Plan: st,
-		Revision: p.Revision, Text: text}
-}
-
-// planWaitCommand is `plans wait <id>`: the plan followed until it moves, or the bound passes.
-func planWaitCommand(ctx context.Context, inv *inventory.Inventory, id, untilAsked, boundAsked string) error {
-	until, bound, err := planWaitAsked(untilAsked, boundAsked)
-	if err != nil {
-		return err
-	}
-	began := time.Now()
-	p, came, err := waitOnPlan(ctx, func(ctx context.Context) (inventory.Plan, error) {
-		return inv.PlanByID(ctx, id)
-	}, until, bound, planWaitEvery)
-	if err != nil {
-		return err
-	}
-	// Said as `plans <id>` says its first line, and as `status` says the plan.
-	now, one := time.Now(), []inventory.Plan{p}
-	bounds, pause := readTierBounds(ctx, inv, now), buildSeatPause(ctx, inv, one)
-	line := planLineSaid(p, now, pause, bounds.of(p.Repository), func(module string) []string {
-		on, _ := inv.Running(ctx, module)
-		return on
-	}, waitsOf(ctx, inv, one))
-	doc := planWaitedDoc(p, planStatuses(one, now, pause, bounds)[0], until, came, now.Sub(began), line)
-	return json.NewEncoder(os.Stdout).Encode(doc)
-}

cmd/mesh-controller/plans_follow_test.go

@@ -1,196 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// A plan as the store would answer it at each read: the reads are counted, and each answers the next.
-type planReads struct {
-	plans []inventory.Plan
-	n     int
-}
-
-func (r *planReads) read(context.Context) (inventory.Plan, error) {
-	p := r.plans[min(r.n, len(r.plans)-1)]
-	r.n++
-	return p, nil
-}
-
-func followedPlan(rev int64, state string, tier int) inventory.Plan {
-	return inventory.Plan{ID: "plan-1", Repository: "novox/x", Commit: "abc", State: state, Tier: tier,
-		Tiers: [][]string{{"a"}, {"b"}}, Revision: rev}
-}
-
-// **`plans` waits for a plan, and says what ended the wait** (novox/hq issue 229): an agent following a
-// rollout is told when the plan moved, reached its next tier or ended, or that the bound passed — in one
-// call, without a loop of its own.
-func TestAWaitForAPlanEndsWhenWhatItWaitsForHappens(t *testing.T) {
-	cases := []struct {
-		name  string
-		until string
-		reads []inventory.Plan
-		came  string
-		times int
-	}{
-		{"moved: any save", "moved", []inventory.Plan{
-			followedPlan(1, inventory.PlanBuilding, 0), followedPlan(1, inventory.PlanBuilding, 0),
-			followedPlan(2, inventory.PlanBuilding, 0)}, "moved", 3},
-		{"tier: a save inside the tier is not enough", "tier", []inventory.Plan{
-			followedPlan(1, inventory.PlanBuilding, 0), followedPlan(2, inventory.PlanBuilding, 0),
-			followedPlan(3, inventory.PlanRolling, 1)}, "tier", 3},
-		{"tier: a plan that ended has no next tier to wait for", "tier", []inventory.Plan{
-			followedPlan(1, inventory.PlanBuilding, 0), followedPlan(2, inventory.PlanFailed, 0)}, "done", 2},
-		{"done: a new tier is not the end", "done", []inventory.Plan{
-			followedPlan(1, inventory.PlanBuilding, 0), followedPlan(2, inventory.PlanRolling, 1),
-			followedPlan(3, inventory.PlanDone, 1)}, "done", 3},
-		{"done: a plan already ended answers at once", "done", []inventory.Plan{
-			followedPlan(4, inventory.PlanSuperseded, 1)}, "done", 1},
-		{"the bound passes", "moved", []inventory.Plan{followedPlan(1, inventory.PlanBuilding, 0)}, "bound", -1},
-	}
-	for _, c := range cases {
-		t.Run(c.name, func(t *testing.T) {
-			r := &planReads{plans: c.reads}
-			p, came, err := waitOnPlan(context.Background(), r.read, c.until, 50*time.Millisecond, time.Millisecond)
-			if err != nil {
-				t.Fatal(err)
-			}
-			if came != c.came {
-				t.Fatalf("the wait ended as %q, want %q", came, c.came)
-			}
-			if c.times > 0 && r.n != c.times {
-				t.Errorf("read the plan %d times, want %d: it answered before or after what it waited for", r.n, c.times)
-			}
-			if want := c.reads[min(r.n, len(c.reads))-1]; p.Revision != want.Revision {
-				t.Errorf("answered revision %d, not the plan as it was last read (%d)", p.Revision, want.Revision)
-			}
-		})
-	}
-}
-
-// What a wait is asked for is checked before anything is read: what it waits until, and a bound no longer than
-// a call is answered within.
-func TestAWaitIsRefusedWhatItCannotDo(t *testing.T) {
-	for _, bad := range []struct{ until, bound string }{{"landed", ""}, {"", "1h"}, {"", "-3s"}, {"", "soon"}} {
-		if _, _, err := planWaitAsked(bad.until, bad.bound); err == nil {
-			t.Errorf("until %q, bound %q was taken", bad.until, bad.bound)
-		}
-	}
-	until, bound, err := planWaitAsked("", "")
-	if err != nil || until != "moved" || bound != maxPlanWait {
-		t.Fatalf("the defaults are %q %s %v, want moved and %s", until, bound, err, maxPlanWait)
-	}
-	if _, bound, _ := planWaitAsked("tier", "12"); bound != 12*time.Second {
-		t.Errorf("a bare number is seconds; read %s", bound)
-	}
-}
-
-// **The answer is data, with its prose as a field beside it** (novox/hq issue 229): the verb's `answer` carries
-// the plan and what ended the wait, and its output is the line a person reads — never JSON inside a string.
-func TestAWaitForAPlanAnswersAsData(t *testing.T) {
-	p := followedPlan(7, inventory.PlanRolling, 1)
-	st := planStatuses([]inventory.Plan{p}, time.Now(), pauseView{}, tierBounds{})[0]
-	doc := planWaitedDoc(p, st, "tier", "tier", 3*time.Second, "rolling, tier 2 of 2")
-	stdout, _ := json.Marshal(doc)
-	a := answerOf([]string{"plans", "wait", "plan-1"}, stdout, "", true)
-	data, ok := a.Answer.(map[string]any)
-	if !ok {
-		t.Fatalf("the answer is not data: %v", a.Answer)
-	}
-	if data["came"] != "tier" || data["revision"] != float64(7) {
-		t.Errorf("the data does not say what ended the wait: %v", data)
-	}
-	if plan, _ := data["plan"].(map[string]any); plan["state"] != "rolling" || plan["tier"] != float64(1) {
-		t.Errorf("the data does not carry the plan: %v", data["plan"])
-	}
-	if _, text := data["text"]; text {
-		t.Errorf("the prose is in the data too: %v", data)
-	}
-	if strings.Contains(a.Output, "{") || !strings.Contains(a.Output, "plan-1") || !strings.Contains(a.Output, "tier") {
-		t.Errorf("the output is not the line a person reads: %q", a.Output)
-	}
-}
-
-// The verb composes the wait, and asks for a window as long as its bound.
-func TestThePlansVerbComposesAWait(t *testing.T) {
-	argv, err := argvFor("plans", map[string]any{"wait": "plan-1", "until": "done", "bound": "15s"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got := strings.Join(argv, " "); got != "plans wait plan-1 --until done --bound 15s" {
-		t.Fatalf("composed %q", got)
-	}
-	if _, err := argvFor("plans", map[string]any{"until": "done"}); err == nil {
-		t.Error("until without wait was taken")
-	}
-	if _, err := argvFor("plans", map[string]any{"wait": "plan-1", "bound": "1h"}); err == nil {
-		t.Error("a bound past what a call can wait was taken")
-	}
-}
-
-// Live, with the store: `plans wait` run as the verb runs it answers when the plan reaches its next tier, as
-// data, and says the bound passed when nothing moved (novox/hq issue 229).
-func TestAPlanFollowedFromTheStoreAnswersWhenItMoves(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	now := time.Now().UTC()
-	walk := inventory.Plan{ID: "plan-229", Repository: "novox/mesh-catalog", Branch: "main", Commit: "c229c229",
-		Created: now, State: inventory.PlanBuilding, Tiers: [][]string{{"a"}, {"b"}},
-		Modules: map[string]*inventory.PlanModule{"a": {}, "b": {}}}
-	if err := open.inventory.SavePlan(ctx, &walk); err != nil {
-		t.Fatal(err)
-	}
-	moved := make(chan error, 1)
-	go func() {
-		time.Sleep(1500 * time.Millisecond)
-		p, err := open.inventory.PlanByID(ctx, walk.ID)
-		if err == nil {
-			p.Tier, p.State = 1, inventory.PlanRolling
-			err = open.inventory.SavePlan(ctx, &p)
-		}
-		moved <- err
-	}()
-	began := time.Now()
-	var got planWaited
-	out := printed(t, func() error {
-		return plansCommand(ctx, []string{"wait", walk.ID, "--until", "tier", "--bound", "15s"})
-	})
-	if err := <-moved; err != nil {
-		t.Fatal(err)
-	}
-	if err := json.Unmarshal([]byte(out), &got); err != nil {
-		t.Fatalf("plans wait did not answer data: %v: %q", err, out)
-	}
-	if got.Came != "tier" || got.Plan.Tier != 1 || got.Plan.State != inventory.PlanRolling {
-		t.Fatalf("the wait answered %+v", got)
-	}
-	if waited := time.Since(began); waited > 10*time.Second {
-		t.Errorf("it answered after %s, not when the plan moved", waited)
-	}
-	out = printed(t, func() error {
-		return plansCommand(ctx, []string{"wait", walk.ID, "--bound", "2"})
-	})
-	if err := json.Unmarshal([]byte(out), &got); err != nil || got.Came != "bound" || got.Until != "moved" {
-		t.Fatalf("a plan that did not move answered %+v (%v)", got, err)
-	}
-}
-
-// The verb's schema says the longest bound in words, and the words are the value (review 75 on #266): the
-// catalogue cannot read maxPlanWait, so this holds them together.
-func TestThePlansSchemaSaysTheLongestBoundThereIs(t *testing.T) {
-	v, ok := controllerVerb("plans")
-	if !ok {
-		t.Fatal("no plans verb")
-	}
-	props, _ := v.Input["properties"].(map[string]any)
-	bound, _ := props["bound"].(map[string]any)
-	said, _ := bound["description"].(string)
-	if !strings.Contains(said, maxPlanWait.String()+", the default, is the longest") {
-		t.Fatalf("the schema says %q; the longest bound is %s", said, maxPlanWait)
-	}
-}

cmd/mesh-controller/push.go

@@ -1027,9 +1027,6 @@ func (b overTheBus) declare(ctx context.Context, s readyNode, body []byte) (stri
 	if err != nil {
 		return "", err
 	}
-	// A send that carried the mesh's record of the controller and the node-engine — a person's push included —
-	// ends the condition of one kept over it (novox/hq issue 201).
-	settleCoreDowngrades(ctx, b.open.inventory, s.node, s.declared.Builds)
 	if len(s.declared.Bindings) > 0 {
 		// And where it bound each consumer of a provision that keeps its data (novox/hq ADR 0232):
 		// what the next resolution keeps it at. On the same outliving context as the send's record.

cmd/mesh-controller/recorded_kept.go

@@ -135,17 +135,6 @@ func recordedKept(ctx context.Context, open *stores, node string) (map[string]st
 		}
 		out[m] = was
 	}
-	// **And the controller and the node-engine at the build the machine was last sent, over an older record**
-	// (novox/hq issue 201, core_downgrade.go). Under keepingEveryBuild they are kept already.
-	if !every {
-		core, err := coreKept(ctx, inv, node, sent, current)
-		if err != nil {
-			return nil, err
-		}
-		for m, was := range core {
-			out[m] = was
-		}
-	}
 	return out, nil
 }
 
@@ -170,12 +159,6 @@ func keepRecorded(ctx context.Context, open *stores, node string, shelf map[stri
 			return nil, fmt.Errorf("%s runs %s's build %s, which the build records no longer hold: the bus's user "+
 				"list cannot be sent there alone with it kept (novox/hq issue 490)", node, m, short(kept[m]))
 		}
-		if !found && guarded(coreComponent(m)) {
-			return nil, fmt.Errorf("%s was last sent %s's build %s, newer than the one the mesh holds, and the build records "+
-				"no longer hold it: this send cannot keep it and does not move it back — `push %s` sends the older build on "+
-				"a person's word, and a newer merge or `rebuild %s` moves the record forward (novox/hq issue 201)",
-				node, m, short(kept[m]), node, m)
-		}
 		if !found {
 			return nil, fmt.Errorf("%s records rather than rolls out, and %s runs its build %s, which the build "+
 				"records no longer hold: this send cannot keep it and does not move it — `push %s` sends the new "+

cmd/mesh-controller/release.go

@@ -51,9 +51,6 @@ type sendScope struct {
 	modules map[string]bool
 	// person is a person's act: it carries what it carries.
 	person bool
-	// puttingBack is a gate's own put-back of its modules: the one send that may carry a core module to a build
-	// older than the one its machine runs (novox/hq issue 201).
-	puttingBack bool
 }
 
 type sendScopeKey struct{}
@@ -240,32 +237,6 @@ var machineMoves = func(ctx context.Context, open *stores, f moveFacts, node str
 	return f.moves(node, modules, sent, known, all), nil
 }
 
-// withoutKept is a machine's moves less those its send keeps at the build the machine was last sent, and so does
-// not make: the grants step keeps every module (novox/hq issue 490), and every send keeps the controller and the
-// node-engine over an older record (issue 201). Read as the send composes it (sendKeeps, set after the checks that
-// call this), so a move it could not keep is still counted.
-func withoutKept(ctx context.Context, open *stores, node string, moves []inventory.CarriedMove) ([]inventory.CarriedMove, error) {
-	if len(moves) == 0 {
-		return moves, nil
-	}
-	keeping := ctx
-	if _, on := keptExcept(ctx); !on {
-		keeping = keepingRecorded(ctx)
-	}
-	keeps, err := recordedKept(keeping, open, node)
-	if err != nil || len(keeps) == 0 {
-		return moves, err
-	}
-	var out []inventory.CarriedMove
-	for _, mv := range moves {
-		if was, kept := keeps[mv.Module]; kept && sameCommit(was, mv.From) {
-			continue
-		}
-		out = append(out, mv)
-	}
-	return out, nil
-}
-
 // ungatedIn refuses a send whose machines would move a build no gate has seen, outside its scope: the
 // machines named, and why; the machine holding the bus, added only for its user list, is left instead.
 func ungatedIn(ctx context.Context, open *stores, names []string, addedHolder string) ([]string, error) {
@@ -283,11 +254,19 @@ func ungatedIn(ctx context.Context, open *stores, names []string, addedHolder st
 		if err != nil {
 			return nil, err
 		}
-		if moves, err = withoutKept(ctx, open, n, moves); err != nil {
-			return nil, err
+		// The grants step composes every module at the build its machine was last sent (novox/hq issue 490):
+		// a move it keeps is not made. Read, not assumed, so a move it could not keep is still refused here.
+		var keeps map[string]string
+		if everyBuildKept(ctx, n) {
+			if keeps, err = recordedKept(ctx, open, n); err != nil {
+				return nil, err
+			}
 		}
 		var waiting []string
 		for _, mv := range moves {
+			if was, kept := keeps[mv.Module]; kept && sameCommit(was, mv.From) {
+				continue
+			}
 			if !scope.judged[n] && !scope.modules[mv.Module] {
 				waiting = append(waiting, fmt.Sprintf("%s %s → %s", mv.Module, short(mv.From), short(mv.To)))
 			}
@@ -329,11 +308,6 @@ func gatedSend(ctx context.Context, open *stores, node string, owns []inventory.
 	if err != nil {
 		return nil, nil, nil, err
 	}
-	// A move the send keeps is not made, and is no move for the gate to judge (novox/hq issue 201): a core module
-	// kept over an older record judged as moving back to it would read the gate as superseded by its own send.
-	if moves, err = withoutKept(ctx, open, node, moves); err != nil {
-		return nil, nil, nil, err
-	}
 	own := func(module string) bool {
 		return slices.ContainsFunc(owns, func(o inventory.CarriedMove) bool { return o.Module == module })
 	}

cmd/mesh-controller/release_plan.go

@@ -1463,10 +1463,6 @@ func plansCommand(ctx context.Context, args []string) error {
 	modules := set.String("modules", "", "or the modules it would change, comma-separated")
 	moduleDirs := set.String("module-dirs", "", "with --paths: the directories holding a module.json at the commit, "+
 		"comma-separated, as the forge's announcer says them (novox/hq issue 278)")
-	// Following a plan (novox/hq issue 229): `plans wait <id>`.
-	until := set.String("until", "", "with wait: what to wait for — moved (any change), tier (its next tier) or done (its end)")
-	bound := set.String("bound", "", "with wait: how long to wait at most, as 15s or seconds (default and at most the "+
-		"longest a call is answered within)")
 	// Ending a plan by hand is a repair, and says why (novox/hq to-be 45 §7).
 	why := addHandActFlags(set)
 	positionals, err := parseAround(set, args)
@@ -1486,9 +1482,6 @@ func plansCommand(ctx context.Context, args []string) error {
 	defer open.Close()
 	inv := open.inventory
 	now := time.Now()
-	if len(positionals) == 2 && positionals[0] == "wait" {
-		return planWaitCommand(ctx, inv, positionals[1], *until, *bound)
-	}
 	if len(positionals) == 1 {
 		p, err := inv.PlanByID(ctx, positionals[0])
 		if err != nil {

cmd/mesh-controller/seatverbs.go

@@ -336,9 +336,6 @@ func (a *verbArguments) commandLine() ([]string, error) {
 		}
 		return argv, nil
 	case "plans":
-		if err := plainPlanIDs(a.given); err != nil {
-			return nil, err
-		}
 		if r := str("repository"); r != "" {
 			argv := []string{"plans", "--what-if", r}
 			if p := str("paths"); p != "" {
@@ -368,21 +365,6 @@ func (a *verbArguments) commandLine() ([]string, error) {
 				return argv, nil
 			}
 		}
-		if id := str("wait"); id != "" {
-			// Following a plan (novox/hq issue 229): checked here too, so a call asking what no wait can do is
-			// refused before a command is started.
-			if _, _, err := planWaitAsked(a.given["until"], a.given["bound"]); err != nil {
-				return nil, err
-			}
-			argv := []string{"plans", "wait", id}
-			if u := str("until"); u != "" {
-				argv = append(argv, "--until", u)
-			}
-			if b := str("bound"); b != "" {
-				argv = append(argv, "--bound", b)
-			}
-			return argv, nil
-		}
 		if id := str("id"); id != "" {
 			return []string{"plans", id}, nil
 		}
@@ -1003,14 +985,12 @@ var jsonVerbs = map[string]bool{"status": true, "seats": true, "plan": true, "co
 	// The delivery's owner's verbs answer JSON where they read (plan, order, check, walks) — novox/hq ADR 0239.
 	"delivery": true,
 	// The build queue, each ask with its position among the waiting (novox/hq issue 455).
-	"queue": true,
-	// A plan followed (novox/hq issue 229): `plans wait` answers JSON; its other forms say text, and so answer no data.
-	"plans": true}
+	"queue": true}
 
 // tableBesideVerbs are the JSON verbs whose document carries the table a person reads as its `text`: the
 // verb answers that table as its output, as it did before it answered data, and the rest as `answer` —
 // both from the one read, so they never disagree (novox/hq issue 455).
-var tableBesideVerbs = map[string]bool{"queue": true, "plans": true}
+var tableBesideVerbs = map[string]bool{"queue": true}
 
 // overviewVerbs are the JSON verbs whose answer is said once, as data, and not again as the text the
 // command printed: the overviews, which grow with the mesh (novox/hq issue 314). Every reader of theirs
@@ -1284,16 +1264,6 @@ func seatToolHandlers() (map[string]link.ToolHandler, []string, error) {
 				// Whatever it did, `status` is composed again once it has.
 				defer statusFrom.nudge()
 			}
-			if verb == "plans" && len(argv) > 1 && argv[1] == "wait" {
-				// A wait holds its answer up to its bound (novox/hq issue 229), and is answered in full inside it.
-				asked := ""
-				if i := slices.Index(argv, "--bound"); i > 0 && i+1 < len(argv) {
-					asked = argv[i+1]
-				}
-				if _, bound, err := planWaitAsked("", asked); err == nil {
-					link.AnswersWithin(ctx, bound+planWaitStart)
-				}
-			}
 			if answer, read := readHere(ctx, argv); read {
 				return answer, nil
 			}

go.mod

@@ -35,4 +35,4 @@ require (
 // committed. Every build (the build agent's `go build`, the Dockerfile) compiles from vendor/ and
 // fetches nothing; go refuses to build when vendor/ and this file disagree, so a pin moved without
 // `go mod vendor` fails loudly, at once, everywhere.
-replace github.com/novox/mesh-host => git.novox.be/novox/mesh-host v0.0.0-20261011092230-20d5af9b2d5f
+replace github.com/novox/mesh-host => git.novox.be/novox/mesh-host v0.0.0-20261012112256-3f7f797168d3

go.sum

@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-host v0.0.0-20261011092230-20d5af9b2d5f h1:8N5OW2mdTNIck2pe4EciTYX5NsrPsHrTLENGNIWYNTU=
-git.novox.be/novox/mesh-host v0.0.0-20261011092230-20d5af9b2d5f/go.mod h1:tcTK4LMs1d6JpZUwy3hSHMFG/MIuDr/XFs7/nbeaW/c=
+git.novox.be/novox/mesh-host v0.0.0-20261012112256-3f7f797168d3 h1:VpH8CesuBOo7k8GcXZq1eRUfbvUoktfmcUynI5N3IFQ=
+git.novox.be/novox/mesh-host v0.0.0-20261012112256-3f7f797168d3/go.mod h1:tcTK4LMs1d6JpZUwy3hSHMFG/MIuDr/XFs7/nbeaW/c=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261010191001-33917f91ac3c h1:l5onJwoIeH8yE/PjVlEeoPyXBsHp2NQiWLllz2fwX7s=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261010191001-33917f91ac3c/go.mod h1:GFuZUElBZ9A++mxgIKo97aXXo+kV0uJ/UkbhQPPIbrY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=

internal/builder/check.go

@@ -49,10 +49,8 @@ import (
 //
 // One check:
 //
-//  1. clones the repository at the pull request's head and **makes the merge of that head into the trunk's
-//     head**, the check's trunk commit, in its own clone (novox/hq ADR 0323, issue 341; check_merge.go): what
-//     is judged is what merging makes, never pushed. Beside it the repositories its check reads — the
-//     controller the mesh runs, the catalogue, the host, the lab — each at the ref asked;
+//  1. clones the repository at the pull request's head, and beside it the repositories its check
+//     reads — the controller the mesh runs, the catalogue, the host, the lab — each at the ref asked;
 //  2. reads the facts snapshot the controller keeps, and with it **the versions the mesh runs**: the
 //     store a check's tests stand on is the store's own release, and the bus the bus's;
 //  3. raises a throwaway PostgreSQL and a throwaway bus of those versions, labelled with the ask so a
@@ -81,8 +79,7 @@ type CheckSpec struct {
 	Modules   []string
 	New       []string
 	Manifests []string
-	// Base is the branch the pull request merges into: what the gate compares the change against, and the trunk
-	// whose head the change is merged into before it is judged (novox/hq ADR 0323). Empty judges the head alone.
+	// Base is the branch the pull request merges into: what the gate compares the change against.
 	Base string
 	// Judge is who judges the gate: "" the controller the mesh runs, "self" the change's own, "validator"
 	// the running one with the change's validator.
@@ -107,9 +104,6 @@ type GroupHead struct {
 	Repository string
 	Ref        string
 	Paths      []string
-	// Base is the branch it merges into: the head is merged into that trunk's head before it is composed
-	// (novox/hq ADR 0323 §6). Empty composes the head alone, as a controller from before it asks.
-	Base string
 }
 
 // Gated is whether the change touches the mesh's graph, and so whether the gate runs.
@@ -145,16 +139,6 @@ type CheckVerdict struct {
 	Took    time.Duration
 	Gate    *Layer
 	Repo    *Layer
-	// Head and Trunk are what was judged (novox/hq ADR 0323 §3): the pull request's head merged into the trunk
-	// commit, each as twelve characters. Trunk is empty for a check asked with no trunk, which judged the head
-	// alone. Merge is the merge commit made for the check, whole: only checked, never pushed or registered.
-	Head, Trunk, Merge string
-	// Beside are the commits of the repositories the check read beside its own, by the directory each was
-	// cloned under, as twelve characters: named, not judged against (ADR 0323 §3, issue 568).
-	Beside map[string]string
-	// Members are a delivery group's other heads as the composed check judged them, each with the trunk
-	// commit it was merged into (ADR 0323 §6).
-	Members []JudgedHead
 }
 
 // Layer is one layer of a check, judged.
@@ -297,34 +281,6 @@ func Check(ctx context.Context, run Runner, spec CheckSpec, workspace, registry
 		return CheckVerdict{}, err
 	}
 	tree := filepath.Join(root, name)
-	// **What merging makes is judged, not the head** (novox/hq ADR 0323, issue 341): the head merged into the
-	// trunk's head as this clone found it, in this clone alone. A head that does not merge cleanly fails here.
-	judged := CheckVerdict{Head: twelve(spec.Ref)}
-	paths := spec.Paths
-	if spec.Base != "" {
-		m, err := mergeIntoTrunk(ctx, run, tree, spec.Base, spec.Ref)
-		if err != nil {
-			return CheckVerdict{}, err
-		}
-		judged.Head, judged.Trunk = twelve(m.Head), twelve(m.Trunk)
-		if len(m.Conflicts) > 0 {
-			said := conflictWords(m)
-			say("check", "%s", said)
-			return CheckVerdict{Verdict: "fail", Summary: said, Report: said, Took: time.Since(began),
-				Gate: &Layer{Verdict: "fail", Summary: said}, Repo: &Layer{Verdict: "fail", Summary: said},
-				Head: judged.Head, Trunk: judged.Trunk}, nil
-		}
-		judged.Merge = m.Merge
-		if changed := changedByMerge(ctx, run, tree, m); len(changed) > 0 {
-			paths = changed
-		}
-		say("check", "head %s merged into trunk %s (%s): the merge is judged, and never pushed", judged.Head,
-			judged.Trunk, spec.Base)
-	}
-	named := func(v CheckVerdict) CheckVerdict {
-		v.Head, v.Trunk, v.Merge, v.Beside, v.Members = judged.Head, judged.Trunk, judged.Merge, judged.Beside, judged.Members
-		return v
-	}
 	// **The base branch's check judges the change** (novox/hq issue 310), never the one the change brings.
 	judging, err := TheCheckThatJudges(ctx, tree, spec.Base)
 	if err != nil {
@@ -341,7 +297,7 @@ func Check(ctx context.Context, run Runner, spec CheckSpec, workspace, registry
 		v := CheckVerdict{Verdict: "pass", Summary: noModule, Took: time.Since(began),
 			Gate: &Layer{Verdict: "pass", Summary: noModule}, Repo: &Layer{Verdict: "warning", Summary: noScript}}
 		say("check", "%s; %s", noModule, noScript)
-		return named(v), nil
+		return v, nil
 	}
 	for dir, b := range spec.Beside {
 		if dir == name || !safeName.MatchString(dir) {
@@ -350,13 +306,6 @@ func Check(ctx context.Context, run Runner, spec CheckSpec, workspace, registry
 		if err := clone(b.Repository, b.Ref, dir); err != nil {
 			return CheckVerdict{}, fmt.Errorf("beside it, %w", err)
 		}
-		// The commit each one read is named in the verdict (ADR 0323 §3): its move is issue 568's question.
-		if at := headAt(ctx, run, filepath.Join(root, dir)); at != "" {
-			if judged.Beside == nil {
-				judged.Beside = map[string]string{}
-			}
-			judged.Beside[dir] = at
-		}
 		say("check", "beside it %s at %s", dir, short(b.Ref))
 	}
 
@@ -373,26 +322,6 @@ func Check(ctx context.Context, run Runner, spec CheckSpec, workspace, registry
 				return CheckVerdict{}, fmt.Errorf("a head of the group, %w", err)
 			}
 			say("check", "with it, of its group, %s/%s at %s", g.Owner, g.Repo, short(g.Ref))
-			// Each member is composed as its merge into its own trunk's head (ADR 0323 §6).
-			member := JudgedHead{Owner: g.Owner, Repo: g.Repo, Head: twelve(g.Ref)}
-			if g.Base != "" {
-				m, err := mergeIntoTrunk(ctx, run, filepath.Join(root, dir), g.Base, g.Ref)
-				if err != nil {
-					return CheckVerdict{}, fmt.Errorf("a head of the group, %s/%s: %w", g.Owner, g.Repo, err)
-				}
-				member.Head, member.Trunk = twelve(m.Head), twelve(m.Trunk)
-				if len(m.Conflicts) > 0 {
-					said := fmt.Sprintf("%s/%s: %s", g.Owner, g.Repo, conflictWords(m))
-					say("check", "%s", said)
-					judged.Members = append(judged.Members, member)
-					return named(CheckVerdict{Verdict: "fail", Summary: said, Report: said, Took: time.Since(began),
-						Gate: &Layer{Verdict: "fail", Summary: said}, Repo: &Layer{Verdict: "fail", Summary: said}}), nil
-				}
-				if changed := changedByMerge(ctx, run, filepath.Join(root, dir), m); len(changed) > 0 {
-					g.Paths = changed
-				}
-			}
-			judged.Members = append(judged.Members, member)
 			heads = append(heads, map[string]any{"repository": g.Owner + "/" + g.Repo,
 				"tree": filepath.Join(root, dir), "changed": g.Paths})
 		}
@@ -504,7 +433,7 @@ func Check(ctx context.Context, run Runner, spec CheckSpec, workspace, registry
 	verdictFile := filepath.Join(root, "verdict.json")
 	env := []string{EnvFacts + "=" + factsFile, EnvGate + "=" + gate, EnvGateStore + "=" + storeURL,
 		EnvTestStore + "=" + storeURL, EnvTestBus + "=nats://" + bus, EnvRepository + "=" + spec.Owner + "/" + spec.Repo,
-		EnvChanged + "=" + strings.Join(paths, ","), EnvBeside + "=" + root,
+		EnvChanged + "=" + strings.Join(spec.Paths, ","), EnvBeside + "=" + root,
 		EnvModules + "=" + strings.Join(append(append([]string{}, spec.Modules...), spec.New...), ","),
 		EnvGroup + "=" + groupFile,
 		"GOCACHE=" + filepath.Join(workspace, "go-cache"), "GOMODCACHE=" + filepath.Join(workspace, "go-modules")}
@@ -572,7 +501,7 @@ func Check(ctx context.Context, run Runner, spec CheckSpec, workspace, registry
 	v.Report, v.Took = redact.redact(withWhatFailed(out.String(), v.Repo)), time.Since(began)
 	say("check", "gate %s — %s; repository %s — %s (%s)", strings.ToUpper(v.Gate.Verdict), v.Gate.Summary,
 		strings.ToUpper(v.Repo.Verdict), v.Repo.Summary, v.Took.Round(time.Second))
-	return named(v), nil
+	return v, nil
 }
 
 // ownCheck runs the repository's own check, part by part, each in its toolchain's own container: the

internal/builder/check_merge.go

@@ -1,115 +0,0 @@
-package builder
-
-import (
-	"context"
-	"fmt"
-	"strings"
-)
-
-// **A merge check judges the merge, not the head** (novox/hq ADR 0323, issue 341).
-//
-// On 2026-10-09 a node-engine pull request was checked green at its head and broke the trunk when it merged:
-// a merge an hour earlier had added a field under the same JSON key on other lines, git merged the two edits
-// without a conflict, and the result did not compile. The check had judged the head alone. So a check now
-// takes the trunk the pull request merges into, its head at the moment the check clones it as the check's
-// **trunk commit**, and makes in its own clone the merge of the head into that commit, as the forge's
-// default merge would. The gate and the repository's own check judge that merge.
-//
-// **The merge is only checked** (ADR 0323 §2, ADR 0238 §1): it is a commit off the trunk, made in the
-// check's own clone, never pushed to the forge and never registered; the clone is removed when the check
-// ends. Nothing here writes to a remote.
-//
-// The forge keeps no merge reference for a pull request, only its head, so the builder makes it itself.
-
-// TrunkMerge is the merge a check made: the head and the trunk commit it was merged into, whole, and the merge
-// commit; or the files in conflict when the head does not merge cleanly.
-type TrunkMerge struct {
-	Head, Trunk, Merge string
-	Conflicts          []string
-}
-
-// JudgedHead is one head a check judged, with the trunk commit it merged that head into, each as twelve
-// characters (ADR 0323 §3, §6).
-type JudgedHead struct {
-	Owner, Repo string
-	Head, Trunk string
-}
-
-// mergeIdentity is who a check's merge is made as: it is never pushed, so it names nobody's account. No hook of the
-// clone's or the build machine's git configuration runs, and no setting there changes the merge.
-var mergeIdentity = []string{"-c", "user.name=mesh merge check", "-c", "user.email=merge-check@mesh.invalid",
-	"-c", "commit.gpgsign=false", "-c", "core.hooksPath=/dev/null", "-c", "merge.verifySignatures=false"}
-
-// mergeIntoTrunk makes, in the clone at tree, the merge of head into the head of origin/<base> as it stands in
-// that fresh clone: the trunk commit. A head that does not merge cleanly answers the files in conflict and leaves
-// the tree at the trunk commit; an error is that the merge could not be tried at all.
-func mergeIntoTrunk(ctx context.Context, run Runner, tree, base, head string) (TrunkMerge, error) {
-	var m TrunkMerge
-	revParse := func(ref string) (string, error) {
-		out, err := run(ctx, tree, "git", "rev-parse", "--verify", "--quiet", ref+"^{commit}")
-		return strings.TrimSpace(out), err
-	}
-	var err error
-	if m.Head, err = revParse(head); err != nil || m.Head == "" {
-		return m, fmt.Errorf("the head %s cannot be read in the check's clone: %v", head, err)
-	}
-	if m.Trunk, err = revParse("refs/remotes/origin/" + base); err != nil || m.Trunk == "" {
-		return m, fmt.Errorf("the trunk %s cannot be read, and a check judges the head merged into it "+
-			"(novox/hq ADR 0323): %v", base, err)
-	}
-	if _, err := run(ctx, tree, "git", "checkout", "--quiet", "--detach", m.Trunk); err != nil {
-		return m, fmt.Errorf("the trunk commit %s cannot be checked out: %w", twelve(m.Trunk), err)
-	}
-	message := fmt.Sprintf("Check the merge of %s into %s at %s (made for a merge check, never pushed)",
-		twelve(m.Head), base, twelve(m.Trunk))
-	args := append(append([]string{}, mergeIdentity...), "merge", "--no-ff", "--no-edit", "--no-verify", "--quiet", "-m", message, m.Head)
-	if _, err := run(ctx, tree, "git", args...); err != nil {
-		out, _ := run(ctx, tree, "git", "diff", "--name-only", "--diff-filter=U")
-		m.Conflicts = strings.Fields(out)
-		_, _ = run(ctx, tree, "git", "merge", "--abort")
-		if len(m.Conflicts) == 0 {
-			return m, fmt.Errorf("the head %s could not be merged into trunk %s: %w", twelve(m.Head), twelve(m.Trunk), err)
-		}
-		return m, nil
-	}
-	if m.Merge, err = revParse("HEAD"); err != nil {
-		return m, fmt.Errorf("the merge made for the check cannot be read: %w", err)
-	}
-	return m, nil
-}
-
-// changedByMerge is every path the merge changes against the trunk commit: what the gate's delivery plan is
-// computed from (ADR 0323 §1). Nil when it cannot be read; the caller keeps the pull request's own list.
-func changedByMerge(ctx context.Context, run Runner, tree string, m TrunkMerge) []string {
-	if m.Merge == "" || m.Trunk == "" {
-		return nil
-	}
-	out, err := run(ctx, tree, "git", "diff", "--name-only", "--no-renames", m.Trunk, m.Merge)
-	if err != nil {
-		return nil // empty-on-error: the caller keeps the pull request's own list of changed files, the safe one
-	}
-	return strings.Fields(out)
-}
-
-// conflictWords is a head that does not merge cleanly, said as its check's failure.
-func conflictWords(m TrunkMerge) string {
-	return fmt.Sprintf("head %s does not merge cleanly into trunk %s: in conflict %s", twelve(m.Head), twelve(m.Trunk),
-		strings.Join(m.Conflicts, ", "))
-}
-
-// headAt is the commit a clone is checked out at, as twelve characters; empty when it cannot be read.
-func headAt(ctx context.Context, run Runner, tree string) string {
-	out, err := run(ctx, tree, "git", "rev-parse", "--verify", "--quiet", "HEAD^{commit}")
-	if err != nil {
-		return ""
-	}
-	return twelve(strings.TrimSpace(out))
-}
-
-// twelve is a commit as a verdict names it: its first twelve characters.
-func twelve(commit string) string {
-	if len(commit) > 12 {
-		return commit[:12]
-	}
-	return commit
-}

internal/builder/check_merge_test.go

@@ -1,212 +0,0 @@
-package builder
-
-import (
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-// **A merge check judges the merge, not the head** (novox/hq ADR 0323, issue 341): the head merged into the trunk
-// commit in the check's own clone, never pushed; a head that does not merge cleanly fails, naming the files; the
-// verdict names the head, the trunk commit and the commits of the repositories read beside it.
-
-// aTrunkAndABranch is a repository whose main moved after the branch was cut: main holds trunkFiles over the
-// common files, the branch headFiles. It answers the repository, the branch's head and main's head.
-func aTrunkAndABranch(t *testing.T, common, trunkFiles, headFiles map[string]string) (string, string, string) {
-	t.Helper()
-	dir := t.TempDir()
-	git := func(args ...string) string {
-		t.Helper()
-		cmd := exec.Command("git", args...)
-		cmd.Dir = dir
-		cmd.Env = append(os.Environ(), "GIT_AUTHOR_NAME=t", "GIT_AUTHOR_EMAIL=t@example.org",
-			"GIT_COMMITTER_NAME=t", "GIT_COMMITTER_EMAIL=t@example.org")
-		out, err := cmd.CombinedOutput()
-		if err != nil {
-			t.Fatalf("git %v: %v\n%s", args, err, out)
-		}
-		return strings.TrimSpace(string(out))
-	}
-	write := func(files map[string]string) {
-		for name, body := range files {
-			if err := os.MkdirAll(filepath.Dir(filepath.Join(dir, name)), 0o755); err != nil {
-				t.Fatal(err)
-			}
-			if err := os.WriteFile(filepath.Join(dir, name), []byte(body), 0o755); err != nil {
-				t.Fatal(err)
-			}
-		}
-		git("add", "-A")
-	}
-	git("init", "--quiet", "-b", "main")
-	write(common)
-	git("commit", "--quiet", "-m", "common")
-	git("checkout", "--quiet", "-b", "change")
-	write(headFiles)
-	git("commit", "--quiet", "-m", "the change")
-	head := git("rev-parse", "HEAD")
-	git("checkout", "--quiet", "main")
-	write(trunkFiles)
-	git("commit", "--quiet", "-m", "the trunk moved")
-	return dir, head, git("rev-parse", "HEAD")
-}
-
-func TestACheckJudgesTheHeadMergedIntoTheTrunk(t *testing.T) {
-	// main's script passes only in a tree holding both the trunk's file and the head's: the merge.
-	repo, head, trunk := aTrunkAndABranch(t,
-		map[string]string{CheckScript: "test -f trunk-only && test -f head-only || { echo 'FAIL: not the merge'; exit 1; }\n"},
-		map[string]string{"trunk-only": "t"}, map[string]string{"head-only": "h"})
-	beside, besideHead := aCheckedRepository(t, map[string]string{"README": "the catalogue"})
-	registry := aFactsRegistry(t)
-	aRuntimeOnThisMachine(t)
-
-	v, err := Check(t.Context(), Command, CheckSpec{ID: "check-341", Repository: repo, Ref: head, Owner: "novox",
-		Repo: "mesh-lab", Number: 1, Base: "main", Toolchain: "golang",
-		Beside: map[string]Beside{"mesh-catalog": {Repository: beside, Ref: besideHead}}}, t.TempDir(), registry,
-		GitCredential{}, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if v.Repo == nil || v.Repo.Verdict != "pass" {
-		t.Fatalf("the check did not judge the head merged into the trunk: %+v\n%s", v.Repo, v.Report)
-	}
-	if v.Head != head[:12] || v.Trunk != trunk[:12] {
-		t.Fatalf("the verdict names head %q and trunk %q, not %s and %s", v.Head, v.Trunk, head[:12], trunk[:12])
-	}
-	if v.Beside["mesh-catalog"] != besideHead[:12] {
-		t.Fatalf("the verdict names the catalogue read beside it as %q, not %s: %v", v.Beside["mesh-catalog"],
-			besideHead[:12], v.Beside)
-	}
-	if v.Merge == "" || v.Merge == head || v.Merge == trunk {
-		t.Fatalf("no merge of the head into the trunk was made for the check: %q", v.Merge)
-	}
-}
-
-func TestAHeadThatDoesNotMergeCleanlyFailsNamingTheFiles(t *testing.T) {
-	repo, head, trunk := aTrunkAndABranch(t,
-		map[string]string{"store.go": "package store\n\nconst Declared = 1\n", "other.go": "package store\n"},
-		map[string]string{"store.go": "package store\n\nconst Declared = 2\n"},
-		map[string]string{"store.go": "package store\n\nconst Declared = 3\n"})
-
-	// No artifact store and no container runtime: a head that does not merge is judged before either is needed.
-	v, err := Check(t.Context(), Command, CheckSpec{ID: "check-341-conflict", Repository: repo, Ref: head,
-		Owner: "novox", Repo: "mesh-lab", Number: 2, Base: "main", Toolchain: "golang"}, t.TempDir(), "",
-		GitCredential{}, nil)
-	if err != nil {
-		t.Fatalf("a head that does not merge cleanly was not judged: %v", err)
-	}
-	want := "does not merge cleanly into trunk " + trunk[:12]
-	for name, l := range map[string]*Layer{"gate": v.Gate, "repository": v.Repo} {
-		if l == nil || l.Verdict != "fail" || !strings.Contains(l.Summary, want) || !strings.Contains(l.Summary, "store.go") {
-			t.Fatalf("its %s layer said %+v, not a failure saying %q and naming store.go", name, l, want)
-		}
-	}
-	if strings.Contains(v.Summary, "other.go") {
-		t.Fatalf("a file not in conflict is named: %s", v.Summary)
-	}
-	if v.Head != head[:12] || v.Trunk != trunk[:12] {
-		t.Fatalf("the failure names head %q and trunk %q", v.Head, v.Trunk)
-	}
-}
-
-// **The merge made for a check is only checked** (ADR 0323 §2): the forge never receives it.
-func TestTheMergeMadeForACheckIsNeverPushed(t *testing.T) {
-	repo, head, trunk := aTrunkAndABranch(t, map[string]string{CheckScript: "true\n"},
-		map[string]string{"trunk-only": "t"}, map[string]string{"head-only": "h"})
-	registry := aFactsRegistry(t)
-	aRuntimeOnThisMachine(t)
-	refsBefore := gitOut(t, repo, "for-each-ref")
-
-	v, err := Check(t.Context(), Command, CheckSpec{ID: "check-341-push", Repository: repo, Ref: head, Owner: "novox",
-		Repo: "mesh-lab", Number: 3, Base: "main", Toolchain: "golang"}, t.TempDir(), registry, GitCredential{}, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if v.Merge == "" {
-		t.Fatal("the check made no merge of the head into the trunk")
-	}
-	if err := exec.Command("git", "-C", repo, "cat-file", "-e", v.Merge+"^{commit}").Run(); err == nil {
-		t.Fatalf("the merge %s made for the check reached the forge's repository", v.Merge)
-	}
-	if after := gitOut(t, repo, "for-each-ref"); after != refsBefore {
-		t.Fatalf("the check moved a ref of the forge's repository:\nbefore %s\nafter %s", refsBefore, after)
-	}
-	if got := gitOut(t, repo, "rev-parse", "main"); got != trunk {
-		t.Fatalf("the trunk moved to %s", got)
-	}
-}
-
-// A delivery group's composed check merges each member's head into its own trunk's head (ADR 0323 §6), and names
-// both for each; a member that does not merge cleanly fails the composed check, naming it.
-func TestAGroupsComposedCheckMergesEachMemberIntoItsTrunk(t *testing.T) {
-	repo, head, trunk := aTrunkAndABranch(t, map[string]string{CheckScript: "true\n"},
-		map[string]string{"trunk-only": "t"}, map[string]string{"head-only": "h"})
-	member, memberHead, memberTrunk := aTrunkAndABranch(t, map[string]string{"a": "1"},
-		map[string]string{"b": "trunk"}, map[string]string{"c": "head"})
-	registry := aFactsRegistry(t)
-	aRuntimeOnThisMachine(t)
-
-	v, err := Check(t.Context(), Command, CheckSpec{ID: "check-341-group", Repository: repo, Ref: head, Owner: "novox",
-		Repo: "mesh-controller", Number: 4, Base: "main", Toolchain: "golang", Group: []GroupHead{{Owner: "novox",
-			Repo: "mesh-host", Repository: member, Ref: memberHead, Base: "main"}}}, t.TempDir(), registry,
-		GitCredential{}, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if v.Head != head[:12] || v.Trunk != trunk[:12] {
-		t.Fatalf("the composed check names its first head %q into %q", v.Head, v.Trunk)
-	}
-	if len(v.Members) != 1 || v.Members[0].Head != memberHead[:12] || v.Members[0].Trunk != memberTrunk[:12] {
-		t.Fatalf("the composed check names its members %+v, not mesh-host %s into %s", v.Members, memberHead[:12],
-			memberTrunk[:12])
-	}
-
-	conflicting, conflictHead, _ := aTrunkAndABranch(t, map[string]string{"a": "1"}, map[string]string{"a": "2"},
-		map[string]string{"a": "3"})
-	v, err = Check(t.Context(), Command, CheckSpec{ID: "check-341-group-conflict", Repository: repo, Ref: head,
-		Owner: "novox", Repo: "mesh-controller", Number: 4, Base: "main", Toolchain: "golang", Group: []GroupHead{{
-			Owner: "novox", Repo: "mesh-host", Repository: conflicting, Ref: conflictHead, Base: "main"}}}, t.TempDir(),
-		registry, GitCredential{}, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if v.Verdict != "fail" || !strings.Contains(v.Summary, "novox/mesh-host") ||
-		!strings.Contains(v.Summary, "does not merge cleanly") {
-		t.Fatalf("a member that does not merge cleanly was answered %s: %s", v.Verdict, v.Summary)
-	}
-}
-
-func gitOut(t *testing.T, dir string, args ...string) string {
-	t.Helper()
-	out, err := exec.Command("git", append([]string{"-C", dir}, args...)...).CombinedOutput()
-	if err != nil {
-		t.Fatalf("git %v: %v\n%s", args, err, out)
-	}
-	return strings.TrimSpace(string(out))
-}
-
-// No hook runs when a check makes its merge: not one in the clone, whatever the build machine's git configuration says.
-func TestACheckMergeRunsNoHook(t *testing.T) {
-	repo, head, _ := aTrunkAndABranch(t, map[string]string{"a": "1"}, map[string]string{"b": "trunk"},
-		map[string]string{"c": "head"})
-	clone := filepath.Join(t.TempDir(), "clone")
-	if out, err := exec.Command("git", "clone", "--quiet", repo, clone).CombinedOutput(); err != nil {
-		t.Fatalf("%v\n%s", err, out)
-	}
-	ran := filepath.Join(t.TempDir(), "ran")
-	for _, hook := range []string{"pre-merge-commit", "commit-msg", "prepare-commit-msg", "post-merge"} {
-		if err := os.WriteFile(filepath.Join(clone, ".git", "hooks", hook),
-			[]byte("#!/bin/sh\necho "+hook+" >> "+ran+"\n"), 0o755); err != nil {
-			t.Fatal(err)
-		}
-	}
-	m, err := mergeIntoTrunk(t.Context(), Command, clone, "main", head)
-	if err != nil || m.Merge == "" {
-		t.Fatalf("the merge was not made: %+v, %v", m, err)
-	}
-	if said, err := os.ReadFile(ran); err == nil {
-		t.Fatalf("a hook ran when the check made its merge: %s", said)
-	}
-}

internal/builder/replay341_test.go

@@ -1,139 +0,0 @@
-package builder
-
-import (
-	"net"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-// TestReplay341 is the replay of novox/hq issue 341, written with only what the build agent had before its fix,
-// so mesh-lab's prover can lay it over the commit before. On 2026-10-09 node-engine #64/#65 merged at 00:15 and
-// added Applied.Declared, under the JSON key `declared`, to the store record. #66, checked at 00:49 at its head,
-// had added its own Applied.Declared under the same key on other lines. Its check passed; git merged the two
-// edits without a conflict, and the trunk no longer compiled: "Declared redeclared". Before the fix the check
-// judged the head alone and passed. After it (novox/hq ADR 0323), the check judges the head merged into the
-// trunk commit that held the other field, and fails saying the trunk does not compile.
-//
-// It runs the check whole, with a container runtime that runs each container's command on this machine
-// (aRuntimeOnThisMachine): the repository's own check is `go build ./...`.
-func TestReplay341(t *testing.T) {
-	origin, head := theNinthOfOctober(t)
-	registry := aFactsRegistry(t)
-	aRuntimeOnThisMachine(t)
-
-	v, err := Check(t.Context(), Command, CheckSpec{ID: "replay-341", Repository: origin, Ref: head, Owner: "novox",
-		Repo: "mesh-host", Number: 66, Base: "main", Toolchain: "golang"}, t.TempDir(), registry, GitCredential{}, nil)
-	if err != nil {
-		t.Fatalf("the check could not run: %v", err)
-	}
-	if v.Repo == nil || v.Repo.Verdict != "fail" {
-		t.Fatalf("node-engine #66 at its head was answered %+v: the merge it makes into the trunk that holds #65's "+
-			"field does not compile, and the check let it merge", v.Repo)
-	}
-	if said := v.Repo.Summary + "\n" + v.Repo.Failed + "\n" + v.Report; !strings.Contains(said, "Declared redeclared") {
-		t.Fatalf("the check failed without saying the trunk does not compile:\n%s", said)
-	}
-}
-
-// theNinthOfOctober is the node-engine's repository as it stood at 00:49 on 2026-10-09, in miniature: a trunk
-// holding #65's Applied.Declared (a string, key `declared`), and #66's head, branched before it, holding its own
-// Applied.Declared (a *FoundUnit, the same key) on other lines. Each compiles alone; their merge does not.
-func theNinthOfOctober(t *testing.T) (string, string) {
-	t.Helper()
-	origin := t.TempDir()
-	git := func(args ...string) string {
-		t.Helper()
-		cmd := exec.Command("git", args...)
-		cmd.Dir = origin
-		cmd.Env = append(os.Environ(), "GIT_AUTHOR_NAME=t", "GIT_AUTHOR_EMAIL=t@example.org",
-			"GIT_COMMITTER_NAME=t", "GIT_COMMITTER_EMAIL=t@example.org")
-		out, err := cmd.CombinedOutput()
-		if err != nil {
-			t.Fatalf("git %v: %v\n%s", args, err, out)
-		}
-		return strings.TrimSpace(string(out))
-	}
-	write := func(name, body string) {
-		t.Helper()
-		if err := os.MkdirAll(filepath.Dir(filepath.Join(origin, name)), 0o755); err != nil {
-			t.Fatal(err)
-		}
-		if err := os.WriteFile(filepath.Join(origin, name), []byte(body), 0o755); err != nil {
-			t.Fatal(err)
-		}
-	}
-	store := func(declared65, declared66 string) string {
-		return "package store\n\n// FoundUnit is a unit found on the machine.\ntype FoundUnit struct{ Name string }\n\n" +
-			"// Applied is what the node-engine applied.\ntype Applied struct {\n\tGeneration int `json:\"generation\"`\n" +
-			declared66 + "\tModules []string `json:\"modules\"`\n\tFiles []string `json:\"files\"`\n" +
-			"\tUnits []string `json:\"units\"`\n\tAt string `json:\"at\"`\n" + declared65 + "}\n"
-	}
-	git("init", "--quiet", "-b", "main")
-	write("go.mod", "module example.org/mesh-host\n\ngo 1.21\n")
-	write("internal/store/store.go", store("", ""))
-	write(CheckScript, "# mesh-check-toolchain: go\nset -e\nGOFLAGS= GOWORK=off GOTOOLCHAIN=local GOPROXY=off go build ./...\n")
-	git("add", "-A")
-	git("commit", "--quiet", "-m", "#63: the store record")
-	git("checkout", "--quiet", "-b", "adr-0269")
-	write("internal/store/store.go", store("", "\tDeclared *FoundUnit `json:\"declared\"`\n"))
-	git("commit", "--quiet", "-am", "#66: the unit a declaration names")
-	head := git("rev-parse", "HEAD")
-	git("checkout", "--quiet", "main")
-	write("internal/store/store.go", store("\tDeclared string `json:\"declared\"`\n", ""))
-	git("commit", "--quiet", "-am", "#65: the declaration applied")
-	return origin, head
-}
-
-// aRuntimeOnThisMachine puts a container runtime on PATH that runs a container's command on this machine, in the
-// directory and with the environment the check gives it: a store and a bus that answer, a judge that is never
-// built, and the repository's own check run as written. Only for a check whose code is the test's own.
-func aRuntimeOnThisMachine(t *testing.T) {
-	t.Helper()
-	bus, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { bus.Close() })
-	go func() {
-		for {
-			c, err := bus.Accept()
-			if err != nil {
-				return
-			}
-			c.Close()
-		}
-	}()
-	dir := t.TempDir()
-	runtime := `#!/bin/sh
-cmd="$1"; shift
-case "$cmd" in
-ps|rm|exec) exit 0 ;;
-port) echo "` + bus.Addr().String() + `"; exit 0 ;;
-run)
-  workdir=""; detached=""
-  while [ $# -gt 0 ]; do
-    case "$1" in
-      -d) detached=1; shift ;;
-      --rm) shift ;;
-      --workdir) workdir="$2"; shift 2 ;;
-      --env) export "$2"; shift 2 ;;
-      --network|--volume|--user|--label|--name|-p|-e) shift 2 ;;
-      *) break ;;
-    esac
-  done
-  if [ -n "$detached" ]; then echo replay-container; exit 0; fi
-  shift
-  if [ "$1" = "sh" ] && [ -n "$workdir" ]; then cd "$workdir" && exec "$@"; fi
-  echo "no such image on this machine" >&2
-  exit 1 ;;
-esac
-exit 1
-`
-	if err := os.WriteFile(filepath.Join(dir, "docker"), []byte(runtime), 0o755); err != nil {
-		t.Fatal(err)
-	}
-	t.Setenv("PATH", dir+string(os.PathListSeparator)+os.Getenv("PATH"))
-}

internal/catalogue/declaration.go

@@ -246,6 +246,11 @@ type Rendering struct {
 	// statement's contract is link.RootContract or later). To an older, strict engine the field is not
 	// sent, and the account it names is not judged — which the self-check says, as not judged.
 	JudgesRoot bool
+
+	// GrantsGroups says this machine's node-engine reads an access's `grant` (novox/hq ADR 0312: its statement's
+	// contract is link.GrantContract or later). To an older, strict engine the field is not sent, nor the
+	// runtime's restarts on it, and a read-write access is reached as before: by whoever owns the path.
+	GrantsGroups bool
 }
 
 // RootField is a user resource's field saying the account must never become root without a person
@@ -543,6 +548,9 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 	}
 
 	var out []map[string]any
+	// The read-write accesses each module grants its tools' account, by module (novox/hq ADR 0312): the runtime
+	// that runs as that account is restarted on them.
+	grantedToTools := map[string][]string{}
 	for _, m := range r.Modules {
 		if with.Adopted && m.Filtering != nil {
 			// Nothing of a module that loads a filter, on an adopted node: its table would drop
@@ -645,11 +653,6 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 				sealed = ForeseenSealed
 				*foreseen = append(*foreseen, m.Module+"/"+name)
 			}
-			if sealed == "" && m.OwnSecrets[name].IssuedBy == IssuedOutside {
-				// **Not given, and the mesh never makes it** (novox/hq issue 401, ADR 0228): no file, as for a
-				// family's member (ADR 0283), so the module reads its absence as not given.
-				continue
-			}
 			if sealed == "" {
 				// Declared and not made. Refused rather than skipped: a module whose own
 				// credential is silently absent starts, fails to authenticate, and the reason is
@@ -1007,7 +1010,7 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 			// content is where a setting lands, so a placeholder may only exist once the setting
 			// has been put in — filling secrets first would look at content that is not yet what
 			// the machine receives.
-			if err := intoFile(copied, sealed, outsideNotGiven(m, with.Needed[m.Module]), m.Module); err != nil {
+			if err := intoFile(copied, sealed, m.Module); err != nil {
 				return nil, err
 			}
 			// **Substituted here, not on the machine.** A bound value is not secret — the mesh
@@ -1120,6 +1123,13 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 			out = append(out, copied)
 		}
 
+		// **A read-write access grants its path's group to what runs this module's code** (novox/hq ADR 0312):
+		// the containers composed above that mount it, and the account its tools run as. Only to an engine that
+		// reads the field.
+		if with.GrantsGroups {
+			grantedToTools[m.Module] = grantAccesses(out, owner, m.Module, r.toolsAccount(m, with))
+		}
+
 		// **What only the mesh knows, where this module asked for it.** The graph is the control
 		// plane's; making a name resolve is the module's software. Emitted as ordinary files under
 		// this module's name, so they are applied, reported and removed exactly as anything else
@@ -1146,6 +1156,12 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 		}
 		owner[fmt.Sprint(process["id"])] = RuntimeModule
 		out = append(out, process)
+		// Restarted when an access moved its account's groups, so its process holds them (novox/hq ADR 0312 §6).
+		for _, m := range r.Modules {
+			if m.RunsAs == "" {
+				restartOnGrants(process, grantedToTools[m.Module])
+			}
+		}
 		// And a runtime of its own for each module of its own account, after it (novox/hq ADR 0259 §8).
 		owns, err := r.ownRuntimes(with)
 		if err != nil {
@@ -1154,6 +1170,7 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 		for _, p := range owns {
 			id := fmt.Sprint(p["id"])
 			owner[id] = strings.TrimSuffix(id, "."+OwnRuntimeID())
+			restartOnGrants(p, grantedToTools[owner[id]])
 			out = append(out, p)
 		}
 		// What each module's bundles are given is read as the account the runtime runs as — not what a
@@ -2436,9 +2453,6 @@ func secretsReadBy(resource map[string]any, m Manifest, given map[string]string)
 	}
 	paths := map[string]string{}
 	for name, own := range m.OwnSecrets.Plain() {
-		if own.IssuedBy == IssuedOutside && given[name] == "" {
-			continue // not given, so not placed: nothing to restart on (novox/hq issue 401)
-		}
 		paths[name] = own.Path
 	}
 	for name, sealed := range given {

internal/catalogue/grants.go

@@ -0,0 +1,134 @@
+package catalogue
+
+import (
+	"fmt"
+	"path/filepath"
+	"sort"
+	"strings"
+)
+
+// A read-write access grants the path's own group to what runs the module's code (novox/hq ADR 0312, issue 537).
+//
+// **The controller says who; the node-engine reads which group.** Which group owns the operator's path is a fact
+// of the machine the controller cannot know, and the path is never changed (§2): so each read-write access
+// reaches a machine naming the identities its module's code runs as, and the node-engine reads the path's group
+// at apply and grants it to them. Two kinds of identity run a module's code here:
+//
+//   - each of its containers that mounts the path — the source of one of its volumes is the path, or below it —
+//     which gains the group as a supplementary group of its process and is recreated with it;
+//   - the account its tools run as, where it has a tools bundle the machine's runtime loads: the operator's
+//     account the runtime runs as, or the module's own account for a module served by a runtime of its own
+//     (ADR 0259 §8). That runtime names the access under its `restart-on`, so it is restarted when the access
+//     moved the account's groups, and its new process holds the group with no new login (§6).
+//
+// A read access grants nothing (§3): it is sent as before. A read-write access whose module runs nothing here is
+// sent an empty grant, so the node-engine still states it unhealthy while its group cannot write (§2).
+//
+// **Only to an engine that reads it.** An older node-engine parses strictly and refuses a whole declaration for a
+// field it does not know; the field and the restarts it brings are composed only where the engine's statement
+// says link.GrantContract or later (Rendering.GrantsGroups).
+
+// GrantField is an access's field naming who its path's group is granted to (novox/hq ADR 0312).
+const GrantField = "grant"
+
+// toolsAccount is the account module m's tools run as on this machine, or empty where they run nowhere as one:
+// no runtime here, no bundle it loads, a module left out of an adopted machine's declaration, or a runtime
+// running as root on a machine with no account.
+func (r Resolution) toolsAccount(m Manifest, with Rendering) string {
+	if !r.runtimeHere() || (with.Adopted && m.Filtering != nil) {
+		return ""
+	}
+	loads := false
+	for _, b := range m.Bundles {
+		if len(b.Loads) > 0 {
+			loads = true
+		}
+	}
+	if !loads {
+		return ""
+	}
+	if m.RunsAs != "" {
+		return m.RunsAs
+	}
+	return r.Account
+}
+
+// grantAccesses writes the grant of every read-write access of module, among the resources composed so far: the
+// module's containers that mount the access's path, and account when it is not empty. The ids of the accesses
+// that grant to account, for the runtime that runs as it to be restarted on.
+func grantAccesses(out []map[string]any, owner map[string]string, module, account string) []string {
+	var containers []map[string]any
+	for _, res := range out {
+		if res["type"] == "container" && owner[fmt.Sprint(res["id"])] == module {
+			containers = append(containers, res)
+		}
+	}
+	var toAccount []string
+	for _, res := range out {
+		if res["type"] != "access" || owner[fmt.Sprint(res["id"])] != module || res["mode"] != AccessReadWrite {
+			continue
+		}
+		path, _ := res["path"].(string)
+		grant := map[string]any{}
+		var mounting []any
+		for _, c := range containers {
+			if mounts(c, path) {
+				mounting = append(mounting, fmt.Sprint(c["id"]))
+			}
+		}
+		if len(mounting) > 0 {
+			grant["containers"] = mounting
+		}
+		if account != "" {
+			grant["account"] = account
+			toAccount = append(toAccount, fmt.Sprint(res["id"]))
+		}
+		res[GrantField] = grant
+	}
+	sort.Strings(toAccount)
+	return toAccount
+}
+
+// mounts says whether a container mounts path, or something below it, from the machine. A path that merely
+// begins with the same letters — /storage/media2 beside /storage/media — is another path. A read-only mount of a
+// read-write access still counts: the module declared the access read-write, the engine grants the group to what
+// mounts it, and a read-only mount only means that container chose not to write through it.
+func mounts(container map[string]any, path string) bool {
+	volumes, _ := container["volumes"].([]any)
+	path = filepath.Clean(path)
+	for _, v := range volumes {
+		s, ok := v.(string)
+		if !ok {
+			continue
+		}
+		source, _, _ := strings.Cut(s, ":")
+		if !strings.HasPrefix(source, "/") {
+			continue // a named volume: the runtime's, not the operator's path
+		}
+		source = filepath.Clean(source)
+		if source == path || strings.HasPrefix(source, path+"/") {
+			return true
+		}
+	}
+	return false
+}
+
+// restartOnGrants adds to a runtime process's restart-on the accesses that grant to the account it runs as, so it
+// is restarted to hold a group the account was put in or taken out of (novox/hq ADR 0312 §6).
+func restartOnGrants(process map[string]any, ids []string) {
+	if process == nil || len(ids) == 0 {
+		return
+	}
+	restarts, _ := process["restart-on"].([]any)
+	seen := map[string]bool{}
+	for _, id := range restarts {
+		seen[fmt.Sprint(id)] = true
+	}
+	for _, id := range ids {
+		if !seen[id] {
+			restarts = append(restarts, id)
+			seen[id] = true
+		}
+	}
+	process["restart-on"] = restarts
+}

internal/catalogue/grants_test.go

@@ -0,0 +1,174 @@
+package catalogue
+
+import (
+	"encoding/json"
+	"fmt"
+	"testing"
+
+	"github.com/novox/mesh-host/validate"
+)
+
+// Defends novox/hq ADR 0312 and issue 537 on the controller's side: each read-write access reaches the machine
+// naming who its path's group is granted to — the module's containers that mount it, and the account its tools
+// run as — and the tool runner is restarted on it; a read access grants nothing; and none of it is sent to a
+// node-engine older than the field, which would refuse the whole declaration.
+
+const anImage = "x@sha256:1111111111111111111111111111111111111111111111111111111111111111"
+
+// anImporter files into one library it writes and reads another: a container mounting both, a step mounting
+// neither, and tools served by the machine's runtime.
+func anImporter(t *testing.T) Manifest {
+	t.Helper()
+	m := aToolsModule(t, "importer", "tools/index.js")
+	m.Accesses = []Access{
+		{ID: "music", Path: "/storage/media/music", Mode: AccessReadWrite},
+		{ID: "movies", Path: "/storage/media/movies", Mode: AccessRead},
+	}
+	m.Resources = []map[string]any{
+		{"id": "app", "type": "container", "name": "importer", "image": anImage,
+			"volumes": []any{"${access:music}/incoming:/music", "${access:movies}:/movies:ro"}},
+		{"id": "sidecar", "type": "container", "name": "importer-sidecar", "image": anImage},
+	}
+	return m
+}
+
+func composeImporter(t *testing.T, r Resolution, with Rendering) map[string]map[string]any {
+	t.Helper()
+	with.Needed = map[string]map[string]string{RuntimeModule: {"broker": "sealed-credential"}}
+	with.ArtifactStore = "anchor.internal:5101"
+	out, err := r.Declaration(with)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// What the node-engine this controller pins would make of it: nothing refused.
+	body, err := json.Marshal(map[string]any{"declaration": validate.Version, "resources": out})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if problems := validate.Declaration(body); len(problems) > 0 {
+		t.Fatalf("composed into something the node-engine refuses: %v", problems)
+	}
+	return byID(out)
+}
+
+func TestAReadWriteAccessNamesTheContainersThatMountItAndTheToolsAccount(t *testing.T) {
+	r := Resolution{Node: "ace", Account: "jochen", Modules: []Manifest{anImporter(t), theRuntime(t)}}
+	got := composeImporter(t, r, Rendering{GrantsGroups: true})
+
+	music := got["importer."+AccessID("/storage/media/music")]
+	if music == nil {
+		t.Fatalf("no access resource for the library: %v", keysOf(got))
+	}
+	grant, _ := music[GrantField].(map[string]any)
+	if fmt.Sprint(grant["containers"]) != "[importer.app]" || grant["account"] != "jochen" {
+		t.Errorf("the read-write access grants %v; want the container that mounts it and the tools' account", grant)
+	}
+	// A read access grants nothing (§3).
+	if movies := got["importer."+AccessID("/storage/media/movies")]; movies[GrantField] != nil {
+		t.Errorf("a read access names a grant: %v", movies[GrantField])
+	}
+	// The tool runner is restarted when the access moved its account's groups (§6).
+	runtime := got[RuntimeModule+"."+RuntimeProcessID()]
+	found := false
+	for _, id := range runtime["restart-on"].([]any) {
+		if id == "importer."+AccessID("/storage/media/music") {
+			found = true
+		}
+	}
+	if !found {
+		t.Errorf("the tool runner is not restarted on the access that grants its account: %v", runtime["restart-on"])
+	}
+}
+
+func TestAModuleOfItsOwnAccountIsGrantedAsThatAccount(t *testing.T) {
+	m := anImporter(t)
+	m.RunsAs = "importer"
+	m.OwnSecrets = OwnSecrets{"broker": {Path: "/var/lib/mesh/importer/broker"}}
+	runtime := theRuntime(t)
+	runtime.Bundles[0].Binary = "node-tools"
+	r := Resolution{Node: "ace", Account: "jochen", Modules: []Manifest{m, runtime}}
+	with := Rendering{GrantsGroups: true}
+	with.Needed = map[string]map[string]string{RuntimeModule: {"broker": "sealed"}, "importer": {"broker": "sealed"}}
+	with.ArtifactStore = "anchor.internal:5101"
+	out, err := r.Declaration(with)
+	if err != nil {
+		t.Fatal(err)
+	}
+	got := byID(out)
+	grant, _ := got["importer."+AccessID("/storage/media/music")][GrantField].(map[string]any)
+	if grant["account"] != "importer" {
+		t.Errorf("the access grants %v; want the module's own account", grant)
+	}
+	own := got["importer."+OwnRuntimeID()]
+	if fmt.Sprint(own["restart-on"]) == "" || !restartsOnIt(own["restart-on"], "importer."+AccessID("/storage/media/music")) {
+		t.Errorf("the module's own runtime is not restarted on its access: %v", own["restart-on"])
+	}
+	if restartsOnIt(got[RuntimeModule+"."+RuntimeProcessID()]["restart-on"], "importer."+AccessID("/storage/media/music")) {
+		t.Error("the machine's runtime is restarted on an access of a module it does not serve")
+	}
+}
+
+func TestAModuleThatRunsNothingHereSendsAnEmptyGrant(t *testing.T) {
+	m := mod("spool", nil, nil, nil)
+	m.Accesses = []Access{{Path: "/storage/downloads", Mode: AccessReadWrite}}
+	out, err := Resolution{Node: "ace", Account: "jochen", Modules: []Manifest{m}}.Declaration(Rendering{GrantsGroups: true})
+	if err != nil {
+		t.Fatal(err)
+	}
+	grant, has := byID(out)["spool."+AccessID("/storage/downloads")][GrantField].(map[string]any)
+	if !has || len(grant) != 0 {
+		t.Errorf("a read-write access of a module running nothing here is sent %v (sent %v); want an empty grant, "+
+			"so its group is still judged", grant, has)
+	}
+}
+
+func TestNoGrantIsSentToAnEngineOlderThanTheField(t *testing.T) {
+	r := Resolution{Node: "ace", Account: "jochen", Modules: []Manifest{anImporter(t), theRuntime(t)}}
+	got := composeImporter(t, r, Rendering{})
+	for id, res := range got {
+		if _, has := res[GrantField]; has {
+			t.Errorf("%s names a grant to an engine that does not read it", id)
+		}
+	}
+	if restartsOnIt(got[RuntimeModule+"."+RuntimeProcessID()]["restart-on"], "importer."+AccessID("/storage/media/music")) {
+		t.Error("the tool runner is restarted on an access an older engine grants nothing for")
+	}
+}
+
+func restartsOnIt(list any, want string) bool {
+	items, _ := list.([]any)
+	for _, i := range items {
+		if fmt.Sprint(i) == want {
+			return true
+		}
+	}
+	return false
+}
+
+func keysOf(m map[string]map[string]any) []string {
+	var out []string
+	for k := range m {
+		out = append(out, k)
+	}
+	return out
+}
+
+// Only a container that mounts the access's path, or below it, is named: a path that begins with the same letters is
+// another path. A read-only mount of a read-write access is still named — the access is read-write, and the grant
+// follows what mounts it, not how.
+func TestOnlyAContainerMountingThePathIsNamedReadOnlyIncluded(t *testing.T) {
+	m := mod("library", nil, nil, nil)
+	m.Accesses = []Access{{ID: "media", Path: "/storage/media", Mode: AccessReadWrite}}
+	m.Resources = []map[string]any{
+		{"id": "beside", "type": "container", "name": "beside", "image": anImage, "volumes": []any{"/storage/media2:/x"}},
+		{"id": "reader", "type": "container", "name": "reader", "image": anImage, "volumes": []any{"${access:media}:/media:ro"}},
+	}
+	out, err := Resolution{Node: "ace", Modules: []Manifest{m}}.Declaration(Rendering{GrantsGroups: true})
+	if err != nil {
+		t.Fatal(err)
+	}
+	grant, _ := byID(out)["library."+AccessID("/storage/media")][GrantField].(map[string]any)
+	if fmt.Sprint(grant["containers"]) != "[library.reader]" {
+		t.Errorf("the access grants %v; want the read-only mount and not /storage/media2", grant)
+	}
+}

internal/catalogue/outside_not_given_test.go

@@ -1,106 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// An own secret issued outside the mesh that nobody gave (novox/hq issue 401, ADR 0228): the mesh makes no value for it,
-// so the composition places no file, a file of the module that names it says empty there, and nothing restarts on it.
-// Given, it is placed and filled like any own secret.
-
-func outsideManifest(t *testing.T) Manifest {
-	t.Helper()
-	m, err := ParseManifest([]byte(`{"module":"assistant","version":"1",
-	  "own-secrets":{
-	    "password":{"path":"/var/lib/assistant/password.secret","taken":"at-start"},
-	    "vendor-key":{"path":"/var/lib/assistant/vendor-key.secret","taken":"at-start","issued-by":"outside"}},
-	  "resources":[
-	    {"id":"env","type":"file","path":"/var/lib/assistant/env","mode":"0600",
-	     "content":"PASSWORD=${secret:password}\nVENDOR_KEY=${secret:vendor-key}\n"},
-	    {"id":"server","type":"container","name":"assistant","image":"assistant:1",
-	     "env-file":["/var/lib/assistant/env"],
-	     "volumes":["/var/lib/assistant/vendor-key.secret:/run/vendor-key:ro"],
-	     "secrets-in-environment":"reads its settings from the environment only"}]}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	return m
-}
-
-func resourceAt(out []map[string]any, path string) map[string]any {
-	for _, r := range out {
-		if r["path"] == path {
-			return r
-		}
-	}
-	return nil
-}
-
-func resourceNamed(out []map[string]any, name string) map[string]any {
-	for _, r := range out {
-		if r["name"] == name {
-			return r
-		}
-	}
-	return nil
-}
-
-func TestAnOutsideSecretNotGivenIsNoFileAndAFileNamingItSaysEmpty(t *testing.T) {
-	r := Resolution{Node: "server", Modules: []Manifest{outsideManifest(t)}}
-	out, err := r.Declaration(Rendering{Needed: map[string]map[string]string{"assistant": {"password": "sealed-password"}}})
-	if err != nil {
-		t.Fatalf("a module whose outside secret nobody gave did not compose: %v", err)
-	}
-	if got := resourceAt(out, "/var/lib/assistant/vendor-key.secret"); got != nil {
-		t.Fatalf("a secret nobody gave was placed: %v", got)
-	}
-	env := resourceAt(out, "/var/lib/assistant/env")
-	if env == nil {
-		t.Fatal("the module's own file is not composed")
-	}
-	if content := env["content"].(string); content != "PASSWORD=${secret:password}\nVENDOR_KEY=\n" {
-		t.Fatalf("the file names the secret nobody gave as %q", content)
-	}
-	secrets, _ := env["secrets"].(map[string]any)
-	if len(secrets) != 1 || secrets["password"] != "sealed-password" {
-		t.Fatalf("the file is filled from %v", secrets)
-	}
-	server := resourceNamed(out, "assistant")
-	if on := strings.Join(stringsIn(server["restart-on"]), " "); strings.Contains(on, "vendor-key") {
-		t.Fatalf("the container restarts on a secret nobody gave: %q", on)
-	}
-}
-
-func TestAnOutsideSecretGivenIsPlacedAndFilled(t *testing.T) {
-	r := Resolution{Node: "server", Modules: []Manifest{outsideManifest(t)}}
-	out, err := r.Declaration(Rendering{Needed: map[string]map[string]string{"assistant": {
-		"password": "sealed-password", "vendor-key": "sealed-vendor-key"}}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	placed := resourceAt(out, "/var/lib/assistant/vendor-key.secret")
-	if placed == nil || placed["sealed"] != "sealed-vendor-key" {
-		t.Fatalf("the secret given is placed as %v", placed)
-	}
-	env := resourceAt(out, "/var/lib/assistant/env")
-	if content := env["content"].(string); content != "PASSWORD=${secret:password}\nVENDOR_KEY=${secret:vendor-key}\n" {
-		t.Fatalf("the file was changed: %q", content)
-	}
-	if secrets, _ := env["secrets"].(map[string]any); secrets["vendor-key"] != "sealed-vendor-key" {
-		t.Fatalf("the file is filled from %v", secrets)
-	}
-	server := resourceNamed(out, "assistant")
-	if on := strings.Join(stringsIn(server["restart-on"]), " "); !strings.Contains(on, "assistant."+NeedID("vendor-key")) {
-		t.Fatalf("the container does not restart on the secret given: %q", on)
-	}
-}
-
-// A secret the mesh makes is still refused when it was not made: only an outside one is left out.
-func TestAnOwnSecretTheMeshMakesIsStillRefusedWhenNotMade(t *testing.T) {
-	r := Resolution{Node: "server", Modules: []Manifest{outsideManifest(t)}}
-	_, err := r.Declaration(Rendering{})
-	if nm, ok := err.(*NotMadeError); !ok || nm.Name != "password" {
-		t.Fatalf("a secret the mesh makes, not made: %v", err)
-	}
-}

internal/catalogue/secrets_into_files.go

@@ -156,11 +156,7 @@ func secretFilesOf(resources []map[string]any) map[string]bool {
 // A name the module never declared is refused here rather than on the machine. The host would
 // refuse it too — but it would do so having already been handed a declaration, which reads as the
 // mesh sending something broken, and the name it could not find is a manifest's typo.
-//
-// **An own secret issued outside the mesh that nobody gave is filled with nothing** (novox/hq issue 401): the mesh
-// never makes one (ADR 0228), and a file is where the module reads it, so the place says empty — the module sees it
-// was not given, where a value the mesh made looked given and wrong. notGiven names those secrets.
-func intoFile(resource map[string]any, sealed map[string]string, notGiven map[string]bool, module string) error {
+func intoFile(resource map[string]any, sealed map[string]string, module string) error {
 	if fmt.Sprint(resource["type"]) != "file" {
 		return nil
 	}
@@ -175,10 +171,6 @@ func intoFile(resource map[string]any, sealed map[string]string, notGiven map[st
 	into := map[string]any{}
 	for _, name := range used {
 		value := sealed[name]
-		if value == "" && notGiven[name] {
-			content = strings.ReplaceAll(content, "${secret:"+name+"}", "")
-			continue
-		}
 		if value == "" {
 			return fmt.Errorf(
 				"%s has a file that says ${secret:%s}, and %s has no secret of its own by that "+
@@ -187,25 +179,10 @@ func intoFile(resource map[string]any, sealed map[string]string, notGiven map[st
 		}
 		into[name] = value
 	}
-	resource["content"] = content
-	if len(into) > 0 {
-		resource["secrets"] = into
-	}
+	resource["secrets"] = into
 	return nil
 }
 
-// outsideNotGiven is each own secret of a module issued outside the mesh that this composition holds no value for
-// (novox/hq issue 401): what intoFile fills with nothing, and what nothing restarts on.
-func outsideNotGiven(m Manifest, given map[string]string) map[string]bool {
-	out := map[string]bool{}
-	for name, own := range m.OwnSecrets.Plain() {
-		if own.IssuedBy == IssuedOutside && given[name] == "" {
-			out[name] = true
-		}
-	}
-	return out
-}
-
 // namesOr says what a module could have written, because the answer to "that name is wrong" is
 // almost always one of two or three right ones.
 func namesOr(sealed map[string]string) string {

internal/catalogue/verbs.go

@@ -116,15 +116,9 @@ var ControllerVerbs = []Verb{
 			"limit":  "how many builds to list (default 20); not with log",
 		}, nil)},
 	{Name: "plans", Description: "What the last merges produced and where each stands (novox/hq ADR 0162): " +
-		"the tiers, the tier a plan is at, what it waits for and since when; one plan whole, given its id; " +
-		"or, given wait, one plan followed until it moves.",
+		"the tiers, the tier a plan is at, what it waits for and since when; one plan whole, given its id.",
 		Input: schema(map[string]string{
-			"id": "a plan's id (as `plans` lists them): that plan, tier by tier",
-			"wait": "a plan's id: wait until it moves, then answer it as data — the plan, and what ended the wait " +
-				"(moved, tier, done, or bound); ask again to follow it further (novox/hq issue 229)",
-			"until": "with wait: moved (any change, the default), tier (it reaches another tier) or done (it ends)",
-			"bound": "with wait: how long to wait at most, as 15s or seconds — 20s, the default, is the longest, " +
-				"inside what a call is answered within",
+			"id":    "a plan's id (as `plans` lists them): that plan, tier by tier",
 			"stop":  "a plan's id: stop it — what was asked still builds, nothing further is asked",
 			"close": "a plan's id: close a plan that will not move again, as failed by hand (novox/hq issue 254)",
 			"retry": "a failed plan's id: ask its failed builds again under new ids, and carry the plan on from that tier (novox/hq ADR 0219)",

internal/inventory/machine.go

@@ -0,0 +1,74 @@
+package inventory
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+)
+
+// MachineAccount is what a machine said it is made of (novox/hq issue 160), from the profile it last
+// reported: the architecture and kernel family the profile always carried, and the facts a node-engine that
+// knows how says beside them. Read by `node`, so what a machine says of itself is visible in one place —
+// collected and shown in the same breath, not collected and read by nothing (issue 160's pattern).
+type MachineAccount struct {
+	Architecture string `json:"architecture"`
+	Kernel       string `json:"kernel"`
+	// Machine is nil when the node-engine that reported is older than the one that says it.
+	Machine *MadeOf `json:"machine"`
+}
+
+// MadeOf is the node-engine's account of what it is made of, as it put it on the wire. A fact it could
+// not determine is absent here and named in Unknown with why — never a zero.
+type MadeOf struct {
+	ObservedAt    time.Time           `json:"observed_at"`
+	KernelRelease string              `json:"kernel_release"`
+	Distribution  string              `json:"distribution"`
+	Version       string              `json:"version"`
+	Processor     string              `json:"processor"`
+	Cores         int                 `json:"cores"`
+	Threads       int                 `json:"threads"`
+	MemoryBytes   int64               `json:"memory_bytes"`
+	Virtual       string              `json:"virtual"`
+	BootedAt      *time.Time          `json:"booted_at"`
+	Timezone      string              `json:"timezone"`
+	Filesystems   []MountedFilesystem `json:"filesystems"`
+	Unknown       map[string]string   `json:"unknown"`
+}
+
+// MountedFilesystem is one local filesystem a machine has mounted.
+type MountedFilesystem struct {
+	Mount     string `json:"mount"`
+	Device    string `json:"device"`
+	Type      string `json:"type"`
+	SizeBytes int64  `json:"size_bytes"`
+	FreeBytes int64  `json:"free_bytes"`
+}
+
+// MachineOf is what a node last said it is made of. had is false for a node that has never reported a
+// profile at all, which is a different answer from one whose node-engine does not say the facts yet.
+func (i *Inventory) MachineOf(ctx context.Context, nodeName string) (account MachineAccount, had bool, err error) {
+	var raw []byte
+	err = i.store.Pool().QueryRow(ctx, `select profile from node where name = $1`, nodeName).Scan(&raw)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return MachineAccount{}, false, fmt.Errorf("%w: %s", ErrNoSuchNode, nodeName)
+	}
+	if err != nil {
+		return MachineAccount{}, false, err
+	}
+	return machineFrom(raw)
+}
+
+func machineFrom(raw []byte) (MachineAccount, bool, error) {
+	if len(raw) == 0 {
+		return MachineAccount{}, false, nil
+	}
+	var account MachineAccount
+	if err := json.Unmarshal(raw, &account); err != nil {
+		return MachineAccount{}, false, err
+	}
+	return account, true, nil
+}

internal/inventory/machine_test.go

@@ -0,0 +1,42 @@
+package inventory
+
+import (
+	"testing"
+)
+
+// The node-engine's words for a machine's facts (novox/hq issue 160), as mesh-host's profile.Machine puts
+// them on the wire. A rename on either side fails here rather than as a blank on a real machine.
+func TestAMachinesAccountIsReadInTheNodeEnginesWords(t *testing.T) {
+	raw := []byte(`{"architecture":"amd64","kernel":"linux","capabilities":[],
+		"machine":{"observed_at":"2026-10-12T15:00:00Z","kernel_release":"7.2.8-arch1-2",
+		"distribution":"Arch Linux","version":"rolling","processor":"AMD Ryzen 9","cores":8,"threads":16,
+		"memory_bytes":32891494400,"virtual":"physical","booted_at":"2026-10-09T08:50:34Z",
+		"timezone":"Europe/Brussels",
+		"filesystems":[{"mount":"/","device":"/dev/nvme0n1p3","type":"ext4","size_bytes":100,"free_bytes":40}],
+		"unknown":{"public address":"not decided"}}}`)
+	a, had, err := machineFrom(raw)
+	if err != nil || !had {
+		t.Fatalf("had %v, err %v", had, err)
+	}
+	m := a.Machine
+	if a.Architecture != "amd64" || a.Kernel != "linux" || m == nil {
+		t.Fatalf("%+v", a)
+	}
+	if m.KernelRelease != "7.2.8-arch1-2" || m.Distribution != "Arch Linux" || m.Version != "rolling" ||
+		m.Processor != "AMD Ryzen 9" || m.Cores != 8 || m.Threads != 16 || m.MemoryBytes != 32891494400 ||
+		m.Virtual != "physical" || m.BootedAt == nil || m.Timezone != "Europe/Brussels" ||
+		len(m.Filesystems) != 1 || m.Filesystems[0].FreeBytes != 40 || m.Unknown["public address"] == "" ||
+		m.ObservedAt.IsZero() {
+		t.Errorf("%+v", m)
+	}
+}
+
+func TestAProfileWithoutTheFactsIsAnOlderNodeEngineNotNothing(t *testing.T) {
+	a, had, err := machineFrom([]byte(`{"architecture":"amd64","kernel":"linux","capabilities":[]}`))
+	if err != nil || !had || a.Machine != nil || a.Architecture != "amd64" {
+		t.Errorf("%+v had %v err %v", a, had, err)
+	}
+	if _, had, _ := machineFrom(nil); had {
+		t.Error("a node that never reported read as having reported")
+	}
+}

internal/inventory/plan_id_test.go

@@ -1,45 +0,0 @@
-package inventory
-
-import (
-	"strings"
-	"testing"
-	"time"
-)
-
-// **A plan's id is a value, never SQL** (novox/hq issue 561): the id reaches PlanByID from a caller of the
-// controller's plans verb, so an id holding a quote is read as a plain id — no error from the store, and no
-// other plan answered for it.
-func TestAPlanIdHoldingAQuoteIsReadAsAPlainId(t *testing.T) {
-	inv := ForTest(t)
-	ctx := t.Context()
-	p := Plan{ID: "plan-561", Repository: "novox/mesh-controller", Commit: "abc", Created: time.Now().UTC(),
-		State: PlanBuilding, Tiers: [][]string{{"a"}}, Modules: map[string]*PlanModule{"a": {}}}
-	if err := inv.SavePlan(ctx, &p); err != nil {
-		t.Fatal(err)
-	}
-	for _, id := range []string{
-		"x' or '1'='1",            // every plan, when pasted into the query
-		"plan-561' or id like '%", // the plan above, by a pattern
-		"it's",                    // a quote alone: a syntax error, when pasted
-	} {
-		got, err := inv.PlanByID(ctx, id)
-		if err == nil {
-			t.Fatalf("PlanByID(%q) answered %s, a plan of another id", id, got.ID)
-		}
-		if want := "no plan " + id; err.Error() != want {
-			t.Fatalf("PlanByID(%q) failed with %q, not as a plain id no plan has (%q)", id, err, want)
-		}
-	}
-	// A plan whose id holds a quote is found by it, and by nothing else.
-	quoted := p
-	quoted.ID, quoted.Revision = "plan-'561'", 0
-	if err := inv.SavePlan(ctx, &quoted); err != nil {
-		t.Fatal(err)
-	}
-	if got, err := inv.PlanByID(ctx, quoted.ID); err != nil || got.ID != quoted.ID {
-		t.Fatalf("the plan with a quote in its id was not read back: %v %+v", err, got.ID)
-	}
-	if recent, err := inv.RecentPlans(ctx, 1); err != nil || len(recent) != 1 || !strings.HasPrefix(recent[0].ID, "plan-") {
-		t.Fatalf("RecentPlans with a parameter: %v %+v", err, recent)
-	}
-}

internal/inventory/plans.go

@@ -623,7 +623,7 @@ func (i *Inventory) PlansSince(ctx context.Context, since time.Time) ([]Plan, er
 
 // RecentPlans is the last few plans, newest first, open or not — what the overview shows.
 func (i *Inventory) RecentPlans(ctx context.Context, limit int) ([]Plan, error) {
-	return i.plans(ctx, `order by created desc limit $1`, limit)
+	return i.plans(ctx, fmt.Sprintf(`order by created desc limit %d`, limit))
 }
 
 // NewestMergeOf is the plan, in any state, of the newest merge into a repository's branch that the mesh
@@ -638,10 +638,9 @@ func (i *Inventory) NewestMergeOf(ctx context.Context, repository, branch string
 	return plans[0], true, nil
 }
 
-// PlanByID is one plan. The id is a parameter, never part of the query (novox/hq issue 561): it comes from a
-// caller of the plans verb.
+// PlanByID is one plan.
 func (i *Inventory) PlanByID(ctx context.Context, id string) (Plan, error) {
-	plans, err := i.plans(ctx, `where id = $1`, id)
+	plans, err := i.plans(ctx, `where id = '`+id+`'`)
 	if err != nil {
 		return Plan{}, err
 	}

internal/inventory/secrets.go

@@ -325,8 +325,6 @@ func (i *Inventory) ModuleSecretIfIssued(
 	return sealed, true, nil
 }
 
-// SecretForModule makes what is not held, so it is never asked for an own secret issued outside the mesh: the
-// composition reads only a value a person gave for one (GivenOwnSecret; novox/hq issue 401, ADR 0228).
 func (i *Inventory) SecretForModule(ctx context.Context, node, module, name string) (string, error) {
 	key, err := i.SealingKeyOf(ctx, node)
 	if err != nil {
@@ -657,35 +655,6 @@ func (i *Inventory) GivenMembers(ctx context.Context, node, module, family strin
 	return out, rows.Err()
 }
 
-// GivenOwnSecret is an own secret issued outside the mesh as a person gave it on a machine (novox/hq issue 401, ADR
-// 0228): its value sealed to the machine and whether that is the key the machine holds now. Not given is false: a
-// value the mesh made for it is not one a person gave, and is never read as one; a machine with no sealing key
-// holds none either.
-func (i *Inventory) GivenOwnSecret(ctx context.Context, node, module, name string) (GivenMember, bool, error) {
-	key, err := i.SealingKeyOf(ctx, node)
-	if err != nil || key == "" {
-		return GivenMember{}, false, err
-	}
-	record, err := i.NodeByName(ctx, node)
-	if err != nil {
-		return GivenMember{}, false, err
-	}
-	g := GivenMember{Name: name}
-	var against string
-	err = i.store.Pool().QueryRow(ctx,
-		`select sealed, node_key from module_secret
-		  where node = $1 and module = $2 and name = $3 and origin = 'accepted'`,
-		record.ID, module, name).Scan(&g.Sealed, &against)
-	if errors.Is(err, pgx.ErrNoRows) {
-		return GivenMember{}, false, nil
-	}
-	if err != nil {
-		return GivenMember{}, false, err
-	}
-	g.Current = against == key
-	return g, true, nil
-}
-
 // GivenOwnSecrets is every own secret of a module a person gave on a machine, by name, with when (novox/hq ADR
 // 0283): what the controller checks a module's wait for a secret against. A value the mesh made is not one.
 func (i *Inventory) GivenOwnSecrets(ctx context.Context, node, module string) (map[string]time.Time, error) {

internal/link/build.go

@@ -138,9 +138,6 @@ type GroupMember struct {
 	Repository string   `json:"repository"`
 	Ref        string   `json:"ref"`
 	Paths      []string `json:"paths,omitempty"`
-	// Base is the branch it merges into: the build seat merges the head into that trunk's head before the
-	// group is composed (novox/hq ADR 0323 §6). A build seat from before it composes the head alone.
-	Base string `json:"base,omitempty"`
 }
 
 // Who judges a merge check's gate.
@@ -167,14 +164,6 @@ type CheckOutcome struct {
 	// Gate and RepoCheck are its two layers; Verdict and Summary above are the gate's.
 	Gate      *CheckLayer `json:"gate,omitempty"`
 	RepoCheck *CheckLayer `json:"repo-check,omitempty"`
-	// Head and Trunk are what was judged (novox/hq ADR 0323 §3): the pull request's head merged into the trunk
-	// commit, each as twelve characters. Trunk is empty from a build seat from before it, which judged the head
-	// alone. Beside are the commits of the repositories read beside it, by directory, named and not judged
-	// against (issue 568); Members a delivery group's other heads, each with the trunk commit it merged into.
-	Head    string            `json:"head,omitempty"`
-	Trunk   string            `json:"trunk,omitempty"`
-	Beside  map[string]string `json:"beside,omitempty"`
-	Members []CheckedMember   `json:"members,omitempty"`
 }
 
 // SourceOnSeat names a repository by the seat whose holder serves it and its path there.

internal/link/calls.go

@@ -601,24 +601,6 @@ func Acknowledge(ctx context.Context) {
 	}
 }
 
-// LongestAnswer is the longest a handler that waits on purpose may hold its caller's one answer
-// (AnswersWithin, novox/hq issue 229): inside the console's thirty seconds with room for the trip back,
-// and inside the bus's window for an answer (broker.ResponseTTL). A variable so a test need not wait.
-var LongestAnswer = 25 * time.Second
-
-type answerWithinKey struct{}
-
-// AnswersWithin asks that the call's caller be answered in full if the handler ends within d of the
-// call's start, rather than within AnswerWithin: for a handler that waits on purpose, with a bound —
-// `plans` waiting for a plan to move (novox/hq issue 229). Past d, or past LongestAnswer whichever is
-// shorter, its caller is told it is running, as for any call. Never shortens the window; without effect
-// outside a served call, and once the caller was answered.
-func AnswersWithin(ctx context.Context, d time.Duration) {
-	if f, ok := ctx.Value(answerWithinKey{}).(func(time.Duration)); ok {
-		f(d)
-	}
-}
-
 // running is the interim answer: what a caller reads when the call has not finished.
 func running(c *Call, within time.Duration, acknowledged bool, follow string) []byte {
 	why := fmt.Sprintf("it has not finished in %s", within)
@@ -663,13 +645,6 @@ func (l *CallLog) serveCallWithin(seat, verb string, args json.RawMessage, reply
 	acknowledged := make(chan struct{})
 	var once sync.Once
 	ctx = context.WithValue(ctx, answerNowKey{}, func() { once.Do(func() { close(acknowledged) }) })
-	longer := make(chan time.Duration, 1)
-	ctx = context.WithValue(ctx, answerWithinKey{}, func(d time.Duration) {
-		select {
-		case longer <- d:
-		default:
-		}
-	})
 
 	type outcome struct {
 		body   []byte
@@ -728,29 +703,17 @@ func (l *CallLog) serveCallWithin(seat, verb string, args json.RawMessage, reply
 			}
 		}
 	}
-	within, start := AnswerWithin, time.Now()
-	timer := time.NewTimer(within)
+	timer := time.NewTimer(AnswerWithin)
 	defer timer.Stop()
-waiting:
-	for {
-		select {
-		case o := <-done:
-			l.finish(c, o.body, o.failed, false)
-			say(o.body)
-			return
-		case <-acknowledged:
-			say(running(c, within, true, l.Follow))
-			break waiting
-		case d := <-longer:
-			// A handler waiting on purpose (AnswersWithin): its window is stretched, never past LongestAnswer.
-			if d = min(d, LongestAnswer); d > within {
-				within = d
-				timer.Reset(time.Until(start.Add(d)))
-			}
-		case <-timer.C:
-			say(running(c, within, false, l.Follow))
-			break waiting
-		}
+	select {
+	case o := <-done:
+		l.finish(c, o.body, o.failed, false)
+		say(o.body)
+		return
+	case <-acknowledged:
+		say(running(c, AnswerWithin, true, l.Follow))
+	case <-timer.C:
+		say(running(c, AnswerWithin, false, l.Follow))
 	}
 	o := <-done
 	l.finish(c, o.body, o.failed, true)

internal/link/calls_wait_test.go

@@ -1,55 +0,0 @@
-package link
-
-import (
-	"context"
-	"encoding/json"
-	"testing"
-	"time"
-)
-
-// **A handler that waits on purpose is answered in full when it ends inside the window it asked for**
-// (novox/hq issue 229): `plans` asked to wait for a plan holds its caller's one answer until the plan
-// moves or its bound passes, rather than being answered "still running" at AnswerWithin.
-func TestAHandlerThatWaitsOnPurposeIsAnsweredInFullInsideItsWindow(t *testing.T) {
-	shortWindow(t, 20*time.Millisecond)
-	l, a := NewCallLog(), newAnswers(t)
-	l.serveCall("mesh-controller", "plans", json.RawMessage(`{"wait":"plan-1"}`), "_INBOX.x.3",
-		func(ctx context.Context, _ json.RawMessage) (any, error) {
-			AnswersWithin(ctx, 200*time.Millisecond)
-			time.Sleep(80 * time.Millisecond) // past AnswerWithin, inside what it asked for
-			return "plan-1 moved", nil
-		}, a.respond, nil)
-	if got := a.only()["result"]; got != "plan-1 moved" {
-		t.Fatalf("a waiting handler inside its window was answered %v, not in full", got)
-	}
-}
-
-// What a handler may ask for is bounded: past LongestAnswer its caller is told it is running, as any
-// call is, so no answer is ever later than the console waits.
-func TestAWaitIsNeverLongerThanTheLongestAnswer(t *testing.T) {
-	shortWindow(t, 10*time.Millisecond)
-	was := LongestAnswer
-	LongestAnswer = 30 * time.Millisecond
-	t.Cleanup(func() { LongestAnswer = was })
-	l, a := NewCallLog(), newAnswers(t)
-	release := make(chan struct{})
-	finished := make(chan struct{})
-	go func() {
-		l.serveCall("mesh-controller", "plans", nil, "_INBOX.x.4", func(ctx context.Context, _ json.RawMessage) (any, error) {
-			AnswersWithin(ctx, time.Hour)
-			<-release
-			return "late", nil
-		}, a.respond, nil)
-		close(finished)
-	}()
-	select {
-	case <-a.sent:
-	case <-time.After(2 * time.Second):
-		t.Fatal("a handler asking for an hour held its caller past LongestAnswer")
-	}
-	if got, _ := a.only()["result"].(map[string]any); got["running"] != true {
-		t.Fatalf("past LongestAnswer the caller was answered %v, not that it is running", a.only())
-	}
-	close(release)
-	<-finished
-}

internal/link/events.go

@@ -221,17 +221,13 @@ type SourceMoved struct {
 // PullUpdated is what the forge announces when an open pull request's head moves — opened, or pushed
 // to (novox/hq to-be 45 §9): what the controller asks the build seat to check before it merges.
 type PullUpdated struct {
-	Owner  string `json:"owner"`
-	Repo   string `json:"repo"`
-	Number int    `json:"number"`
-	Title  string `json:"title,omitempty"`
-	Base   string `json:"base"`
-	Head   string `json:"head"`
-	Commit string `json:"head_sha"`
-	// BaseSHA is the base branch's head when the forge announced the head (novox/hq ADR 0323): the trunk commit a
-	// verdict the controller gives without the build seat — a change that runs no build — is judged against. Empty
-	// from a forge module from before it.
-	BaseSHA  string `json:"base_sha,omitempty"`
+	Owner    string `json:"owner"`
+	Repo     string `json:"repo"`
+	Number   int    `json:"number"`
+	Title    string `json:"title,omitempty"`
+	Base     string `json:"base"`
+	Head     string `json:"head"`
+	Commit   string `json:"head_sha"`
 	CloneURL string `json:"clone_url"`
 	HTMLURL  string `json:"html_url,omitempty"`
 	// Paths are the files the pull request changes; PathsTruncated says there were more.
@@ -282,24 +278,14 @@ type Checked struct {
 	// status from it — the group's verdict is its owner's, mesh-delivery, to say on each member's head.
 	Group   string          `json:"group,omitempty"`
 	Members []CheckedMember `json:"members,omitempty"`
-	// Trunk is the trunk commit the head was merged into and judged as, twelve characters (novox/hq ADR 0323
-	// §3): the verdict holds for that merge only, and goes out of date when the trunk moves. Empty from a build
-	// seat that judged the head alone. Beside are the commits of the other repositories the check read, by
-	// directory, named and not judged against (issue 568). Took is how long the check ran, for the merge tool
-	// to say how long the next one may take (ADR 0323 §5).
-	Trunk  string            `json:"trunk,omitempty"`
-	Beside map[string]string `json:"beside,omitempty"`
-	Took   string            `json:"took,omitempty"`
 }
 
-// CheckedMember is one head a group's composed check judged, and the trunk commit it was merged into (novox/hq
-// ADR 0323 §6), twelve characters; empty from a build seat that composed the head alone.
+// CheckedMember is one head a group's composed check judged.
 type CheckedMember struct {
 	Owner  string `json:"owner"`
 	Repo   string `json:"repo"`
 	Number int    `json:"number,omitempty"`
 	Commit string `json:"commit"`
-	Trunk  string `json:"trunk,omitempty"`
 }
 
 // ChangePlan is what a change does to the mesh, computed from its diffset — a repository, the branch it
@@ -325,9 +311,6 @@ type ChangePlan struct {
 	Steps []string `json:"steps,omitempty"`
 	// Summary is the plan in one line, for a commit status.
 	Summary string `json:"summary"`
-	// Trunk is the trunk commit the head was merged into when it was judged (novox/hq ADR 0323 §3), twelve
-	// characters: set on the plan a verdict carries, which mesh-delivery keeps with its other inputs.
-	Trunk string `json:"trunk,omitempty"`
 }
 
 // MachinePlan is one machine's part of a change plan.

internal/link/protocol.go

@@ -436,6 +436,12 @@ const ReadinessContract = 2
 // parses strictly and would refuse the whole declaration for it.
 const RootContract = 3
 
+// GrantContract is the statement of an engine that also reads an access's `grant` (novox/hq ADR 0312): it grants a
+// read-write access's path group to the containers and the account the grant names, takes it back, and states the
+// access unhealthy while the group cannot write. Only to such an engine is the field sent: an older one parses
+// strictly and would refuse the whole declaration for it.
+const GrantContract = 4
+
 // ReasonRoot starts the reason of an account verdict that found a way to root (ADR 0266); the node-engine's
 // own words (mesh-host internal/accounts ReasonRoot).
 const ReasonRoot = "can become root without a person"
@@ -487,6 +493,11 @@ const KindAccount = "account"
 // ReasonUsedAsFound.
 const KindDirectory = "directory"
 
+// KindAccess is a read-write access that grants its path's group (novox/hq ADR 0312): healthy while the group may
+// write the path, unhealthy while it cannot — the operator's to decide, since the mesh changes nothing on the path
+// — or while the path is owned by a group that is never granted. The node-engine's own (mesh-host internal/link).
+const KindAccess = "access"
+
 // ReasonUsedAsFound starts the reason of a directory used as found.
 const ReasonUsedAsFound = "used as found:"
 

testdata/beside/CAPTURED

@@ -8,7 +8,7 @@ private addresses. That is acceptable while mesh-controller is private; if it ev
 a second place to clean besides the catalogue itself.
 
 mesh-catalog  b9de001833b1b61b297182b8e3bcdae1cbdeace9  modules/*/module.json, modules/nats/Dockerfile
-mesh-host     a76baa4b47f07a8b2bab065603414530bd02b53a  examples/foundation-first-node-nats.lock
+mesh-host     3f7f797168d33ec22241bdd6ef2c64de86eea914  examples/foundation-first-node-nats.lock
 mesh-sdk      33917f91ac3cc213b879b32f3c70e2aa70395f98  conformance/events/module-event.json
 
 To move them, from this repository's root, with the two repositories checked out beside it:

testdata/store-tests

@@ -7,14 +7,12 @@
 ./cmd/mesh-controller TestAStopNamesWhatStaysOnTheMachinesAndWhatStillCarriesIt
 ./cmd/mesh-controller TestAStopWithoutAMergeLeavesItOutOfABatch
 ./cmd/mesh-controller TestSavingPlansAndMovingMergesIsOneAct
-./cmd/mesh-controller TestAPlanFollowedFromTheStoreAnswersWhenItMoves
 ./internal/inventory TestTheLastSendSaysWhatTheMachineAnswered
 ./internal/inventory TestAReportIsTheLastSendsAnswerOnlyWhenItIsAboutThatSend
 ./cmd/mesh-controller TestNodeShowAndStatusReadTheLastSendFromTheStore
 ./internal/inventory TestAnIssuedValueIsSealedToEveryHolderOnceAndNotAgain
 ./internal/inventory TestAnIssuedValueIsSealedAgainAfterAKeyChangeOrAnAcceptance
 ./internal/inventory TestAConditionsLooksAreKeptBesideTheBucket
-./internal/inventory TestAPlanIdHoldingAQuoteIsReadAsAPlainId
 ./cmd/mesh-controller TestTheConditionsVerbReadsTheLooksTheBucketNoLongerHolds
 ./internal/inventory TestAWalksStartIsKeptAndARefusedSaveLeavesItUnsaid
 ./cmd/mesh-controller TestAWalkLetGoAndStoppedByVerbsIsSaidStartedAndEnded
@@ -29,8 +27,3 @@
 ./cmd/mesh-controller TestAnUnassignThatLeavesItsNodeResolvedSaysNothingOfIt
 ./cmd/mesh-controller TestAnAssignThatLeavesItsNodeUnresolvedSaysOnlyThePlansRefusal
 ./cmd/mesh-controller TestADirectoryOwnersKeyIsRefusedThroughAVerb
-./cmd/mesh-controller TestTheSendMakesNoValueForAnOutsideSecretNobodyGave
-./cmd/mesh-controller TestAQuestionComposesWithoutAnOutsideSecretNobodyGave
-./cmd/mesh-controller TestReplay201
-./cmd/mesh-controller TestARollbackWhoseSendWasRefusedIsCompletedByTheNextSend
-./cmd/mesh-controller TestAGateJudgesTheOtherMovesBesideAKeptCore

vendor/github.com/novox/mesh-host/internal/declaration/declaration.go

@@ -464,6 +464,35 @@ type Access struct {
 	Path string `json:"path"`
 	// Mode is how this module reaches the path: read or read-write. Absent narrows to read.
 	Mode string `json:"mode,omitempty"`
+
+	// Grant is who the path's own group is granted to, for a read-write access (novox/hq ADR 0312 §1): the
+	// identities the module's code runs as. The controller says who; the node-engine reads which group owns
+	// the path when it applies, because only the machine knows, and never changes the path (§2). Absent is a
+	// controller older than the grant, or an access that grants nothing — and a read access always is one (§3).
+	Grant *AccessGrant `json:"grant,omitempty"`
+}
+
+// AccessGrant is the identities a read-write access grants its path's group to (novox/hq ADR 0312 §1).
+type AccessGrant struct {
+	// Containers are the module's containers that mount the path, by id: each is created with the group as a
+	// supplementary group of its process, and recreated when the group moves (§6).
+	Containers []string `json:"containers,omitempty"`
+	// Account is the account that runs the module's tools: put in the group as an account group, as ADR 0252
+	// §1 puts one, and taken out again as §3 takes back (§5). Empty for a module whose code runs nowhere as
+	// an account.
+	Account string `json:"account,omitempty"`
+}
+
+// UnmarshalJSON reads a grant as strictly as a resource is read: a field the engine does not know is a
+// thing the controller believes it asked for, and is refused rather than ignored.
+func (g *AccessGrant) UnmarshalJSON(raw []byte) error {
+	type plain AccessGrant
+	var p plain
+	if err := strictDecode(raw, &p); err != nil {
+		return fmt.Errorf("a grant: %w", err)
+	}
+	*g = AccessGrant(p)
+	return nil
 }
 
 func (a *Access) Identity() string { return a.ID }
@@ -482,6 +511,24 @@ func (a *Access) validate(where string, _ bool) []string {
 		problems = append(problems, fmt.Sprintf(
 			"%s: an access is %q or %q, not %q", where, AccessRead, AccessReadWrite, a.Mode))
 	}
+	if a.Grant != nil && a.Mode != AccessReadWrite {
+		// A read access reads as any account may, and gains no group (novox/hq ADR 0312 §3).
+		problems = append(problems, where+": a read access grants nothing, and this one names a grant; "+
+			"only a read-write access grants its path's group (novox/hq ADR 0312 §3)")
+	}
+	if a.Grant != nil {
+		for _, id := range a.Grant.Containers {
+			if id == "" {
+				problems = append(problems, where+": a grant names a container with no id")
+			}
+		}
+		if a.Grant.Account != "" && !accountName.MatchString(a.Grant.Account) {
+			// Handed to id, usermod and gpasswd as an argument: a name starting with a dash would be read as an
+			// option by each of them.
+			problems = append(problems, fmt.Sprintf("%s: a grant's account is an account's name — letters, digits, "+
+				"dots, underscores and dashes, not starting with a dash — and %q is not one", where, a.Grant.Account))
+		}
+	}
 	return problems
 }
 
@@ -1668,6 +1715,7 @@ func parse(raw []byte, allowActions bool) (*Declaration, error) {
 		d.Resources = append(d.Resources, resource)
 	}
 	problems = append(problems, checkWhileStopped(d.Resources)...)
+	problems = append(problems, checkGrants(d.Resources)...)
 	problems = append(problems, checkAdoption(env.Adoption, d.Resources, allowActions)...)
 	problems = append(problems, checkReplaces(d.Resources)...)
 	if env.Adoption == nil {
@@ -1732,6 +1780,36 @@ func checkWhileStopped(resources []Resource) []string {
 	return problems
 }
 
+// accountName is what a grant's account may be: the portable account name the user tools take, optionally ending
+// in `$`, never starting with a dash.
+var accountName = regexp.MustCompile(`^[A-Za-z0-9_.][A-Za-z0-9_.-]*\$?$`)
+
+// checkGrants judges each access's grant against the whole declaration (novox/hq ADR 0312): a container it
+// names is a container of this declaration, as a maintenance window's are. A grant to a container the machine
+// is not told about would be a group given to nothing, said as granted.
+func checkGrants(resources []Resource) []string {
+	containers := map[string]bool{}
+	for _, r := range resources {
+		if r.Kind() == TypeContainer {
+			containers[r.Identity()] = true
+		}
+	}
+	var problems []string
+	for _, r := range resources {
+		a, ok := r.(*Access)
+		if !ok || a.Grant == nil {
+			continue
+		}
+		for _, id := range a.Grant.Containers {
+			if id != "" && !containers[id] {
+				problems = append(problems, fmt.Sprintf("resource %q: its grant names %q, and this declaration "+
+					"has no container by that id", a.ID, id))
+			}
+		}
+	}
+	return problems
+}
+
 func strictDecode(raw []byte, into any) error {
 	// DisallowUnknownFields is the whole point rather than strictness for its own sake: a
 	// field the host does not know is a thing the control plane believes it asked for.

vendor/modules.txt

@@ -78,7 +78,7 @@ github.com/nats-io/nkeys
 # github.com/nats-io/nuid v1.0.1
 ## explicit
 github.com/nats-io/nuid
-# github.com/novox/mesh-host v0.0.0 => git.novox.be/novox/mesh-host v0.0.0-20261011092230-20d5af9b2d5f
+# github.com/novox/mesh-host v0.0.0 => git.novox.be/novox/mesh-host v0.0.0-20261012112256-3f7f797168d3
 ## explicit; go 1.26.0
 github.com/novox/mesh-host/internal/declaration
 github.com/novox/mesh-host/rootsearch
@@ -135,4 +135,4 @@ golang.org/x/text/width
 # golang.org/x/time v0.15.0
 ## explicit; go 1.25.0
 golang.org/x/time/rate
-# github.com/novox/mesh-host => git.novox.be/novox/mesh-host v0.0.0-20261011092230-20d5af9b2d5f
+# github.com/novox/mesh-host => git.novox.be/novox/mesh-host v0.0.0-20261012112256-3f7f797168d3