Judge an upstream pin's host like any name, and harden the upstream unpack (review 35, hq issue 345)

The url was skipped by the installation check, so an installation's host or
an address passed; it is judged whole now, the vendor's host declared in the
artifact's names-on-purpose, and an address or a reserved name as the host
is refused. Only the version's dotted-quad reading is skipped. The unpack
caps its entries, drains xz before waiting for it, reads a pax global
header and a nested within's parents, and a redirect off https is not
followed.

cmd/mesh-builder/Dockerfile

@@ -16,7 +16,8 @@ RUN CGO_ENABLED=0 go build -trimpath -ldflags '-s -w' -o /mesh-builder ./cmd/mes
 FROM ${ALPINE_BASE}
 # git to clone what it is asked to build, and the docker client to build and push it. The daemon
 # is the machine's, reached through its socket — a build machine shares the runtime it was given
-# rather than running one inside itself.
-RUN apk add --no-cache git docker-cli
+# rather than running one inside itself. xz to read an upstream release an archive is pinned to
+# (novox/hq ADR 0316): Go's standard library reads gzip and bzip2 and not xz.
+RUN apk add --no-cache git docker-cli xz
 COPY --from=build /mesh-builder /usr/local/bin/mesh-builder
 ENTRYPOINT ["/usr/local/bin/mesh-builder"]

cmd/mesh-controller/asker.go

@@ -213,8 +213,6 @@ type asker struct {
 
 	saidNoRouter bool
 	saidNoGrant  bool
-	// saidGrantCaveat is whether a grant held with a caveat was said, so it is said once.
-	saidGrantCaveat bool
 
 	mu     sync.Mutex
 	nudged chan struct{}
@@ -319,13 +317,6 @@ func (a *asker) reconcile(ctx context.Context) error {
 			}
 			return a.sayUnasked(ctx, unasked, "the bus does not hold the controller's grant to ask yet: "+why)
 		}
-		if why != "" && !a.saidGrantCaveat {
-			// Held, with a caveat worth one line (an older bus module cannot confirm the reload).
-			a.logf("the controller asks: %s", why)
-			a.saidGrantCaveat = true
-		} else if why == "" {
-			a.saidGrantCaveat = false
-		}
 		a.saidNoGrant = false
 	}
 	channels := ""

cmd/mesh-controller/asker_test.go

@@ -12,7 +12,6 @@ import (
 
 	"git.novox.be/novox/mesh-sdk/go/asks"
 
-	"github.com/novox/mesh-controller/internal/broker"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/link"
 )
@@ -809,207 +808,3 @@ func TestARefusalIsAskedAgainAndTheUndeliveredConditionClearsOnceTaken(t *testin
 		t.Errorf("the explanation says its verdict twice: %q", e)
 	}
 }
-
-// hq issue 353, the review: the bus holds the controller's grant to ask only when both facts hold — the mesh
-// composes the controller's own grant, and the bus's module says it is in force on the running server — and
-// each fact not known is not held, said with why.
-func TestTheGrantIsHeldOnlyWhenComposedAndInForceOnTheBus(t *testing.T) {
-	yes := func(context.Context) (bool, string, error) { return true, "", nil }
-	no := func(why string) grantJudge {
-		return func(context.Context) (bool, string, error) { return false, why, nil }
-	}
-	broken := func(context.Context) (bool, string, error) { return false, "", errors.New("the store is away") }
-	for _, c := range []struct {
-		name              string
-		composed, inForce grantJudge
-		held              bool
-		says              string
-	}{
-		{"composed and in force", yes, yes, true, ""},
-		{"not composed", no("no router is assigned"), yes, false, "no router is assigned"},
-		{"composed, written, not reloaded", yes, no("the server has not reloaded"), false, "has not reloaded"},
-		{"the composition unknown", broken, yes, false, "could not be worked out: the store is away"},
-		{"the bus unknown", yes, broken, false, "could not be worked out: the store is away"},
-		{"nothing judges the bus", yes, nil, false, "not judged"},
-	} {
-		held, why, err := grantHeldBy(c.composed, c.inForce, time.Now)(context.Background())
-		if err != nil || held != c.held || !strings.Contains(why, c.says) {
-			t.Errorf("%s: held %v (%q, %v)", c.name, held, why, err)
-		}
-	}
-	// Remembered for grantLookEvery, then judged again.
-	now := time.Date(2026, 10, 9, 18, 0, 0, 0, time.UTC)
-	inForce := false
-	judge := grantHeldBy(yes, func(context.Context) (bool, string, error) { return inForce, "not yet", nil },
-		func() time.Time { return now })
-	if held, _, _ := judge(context.Background()); held {
-		t.Fatal("held before the bus enforces it")
-	}
-	inForce = true
-	if held, _, _ := judge(context.Background()); held {
-		t.Error("judged again inside grantLookEvery")
-	}
-	now = now.Add(grantLookEvery)
-	if held, _, _ := judge(context.Background()); !held {
-		t.Error("not judged again after grantLookEvery")
-	}
-}
-
-// The controller's own grant, as composed: present while a router that takes asks is assigned, absent
-// otherwise — whatever else in the user list changes.
-func TestTheControllersOwnGrantToAskIsReadFromTheComposition(t *testing.T) {
-	router := broker.Declared{Module: "messenger", Holds: []broker.Seat{{Name: broker.AsksSeat, Scope: "mesh",
-		Accepts: []string{"ask", "cancel"}, Emits: []string{"decided"}, ByCaller: []string{"ask", "cancel", "decided"}}}}
-	other := broker.Declared{Module: "dunst"}
-	with := broker.Records{Nodes: []string{"anchor"}, Assigned: map[string][]broker.Declared{"anchor": {router, other}}}
-	without := broker.Records{Nodes: []string{"anchor"}, Assigned: map[string][]broker.Declared{"anchor": {other}}}
-	if may, err := controllerMayAsk(with); err != nil || !may {
-		t.Errorf("with a router assigned: %v %v", may, err)
-	}
-	if may, err := controllerMayAsk(without); err != nil || may {
-		t.Errorf("with no router assigned: %v %v", may, err)
-	}
-}
-
-// The bus module's answer, with the record's word on the list sent as the check only where the answer does
-// not settle it (reviews 22 and 31 of PR 188); each way it is not held names its own remedy.
-func TestTheBusModulesAnswerNamesTheRemedyForEachCase(t *testing.T) {
-	const (
-		reloaded   = `{"allowed":true,"in_force":true,"file_written":"2026-10-09T15:55:56Z","server_loaded":"2026-10-09T15:56:05Z"}`
-		notLoaded  = `{"allowed":true,"in_force":false,"why":"the user list on the machine allows it, and the server has not reloaded since it was written","file_written":"2026-10-09T15:55:56Z","server_loaded":"2026-10-09T15:50:00Z"}`
-		noVarz     = `{"allowed":true,"in_force":false,"why":"the server's last configuration load could not be read: refused"}`
-		noStat     = `{"allowed":true,"in_force":false,"why":"when the bus's user list was written could not be read inside mesh-broker-nats: exit 1"}`
-		notAllowed = `{"allowed":false,"in_force":false,"why":"the user list on the machine does not allow it"}`
-	)
-	current := busListState{Machine: "anchor"}
-	behind := busListState{Machine: "anchor", Behind: true}
-	stepped := busListState{Machine: "anchor", Behind: true, BusStep: "sending anchor would replace the bus; `bus upgrade --why …`"}
-	uncomposed := busListState{Machine: "anchor", Behind: true, Uncomposed: errors.New("module foo requires a provision nobody provides")}
-	for _, c := range []struct {
-		name, answer string
-		askErr       error
-		list         busListState
-		listErr      error
-		held         bool
-		says, not    string
-	}{
-		{"in force", reloaded, nil, behind, nil, true, "", "push"},
-		{"written, not reloaded", notLoaded, nil, current, nil, false, "within about 5 s", "push"},
-		{"in force not known: varz", noVarz, nil, current, nil, false, "is not known: the server's last configuration load", "wait"},
-		{"in force not known: stat", noStat, nil, current, nil, false, "is not known: when the bus's user list was written", "wait"},
-		{"not allowed, list behind", notAllowed, nil, behind, nil, false, "`push anchor` carries it", "5 s"},
-		{"not allowed, bus step pending", notAllowed, nil, stepped, nil, false, "`bus upgrade", "`push anchor`"},
-		{"not allowed, list uncomposed", notAllowed, nil, uncomposed, nil, false, "`plan anchor`", "`push anchor`"},
-		{"older module, allowed, list current", `{"allowed":true}`, nil, current, nil, true, "not confirmed", "push"},
-		{"older module, allowed, list behind", `{"allowed":true}`, nil, behind, nil, true, "not confirmed", "push"},
-		{"older module, allowed, list unknown", `{"allowed":true}`, nil, current, errors.New("the store is away"), true, "`bus upgrade`", "push"},
-		{"older module, not allowed, list behind", `{"allowed":false}`, nil, behind, nil, false, "`push anchor` carries it", "5 s"},
-		{"module cannot answer, list current", "", errors.New("no responders"), current, nil, true, "could not answer", "push"},
-		{"module cannot answer, list behind", "", errors.New("no responders"), behind, nil, false, "`push anchor` carries it", ""},
-		{"module cannot answer, list unknown", "", errors.New("no responders"), current, errors.New("the store is away"), false, "could not be worked out", ""},
-		{"answer unreadable, list behind", `not json`, nil, behind, nil, false, "could not be read", ""},
-	} {
-		judge := busGrantBy(
-			func(context.Context) (string, json.RawMessage, error) {
-				return "anchor", json.RawMessage(c.answer), c.askErr
-			},
-			func(context.Context) (busListState, error) { return c.list, c.listErr })
-		held, why, _ := judgeGrantOnce(judge)
-		if held != c.held || !strings.Contains(why, c.says) || (c.not != "" && strings.Contains(why, c.not)) {
-			t.Errorf("%s: held %v (%q)", c.name, held, why)
-		}
-	}
-	none := busGrantBy(func(context.Context) (string, json.RawMessage, error) { return "", nil, nil }, nil)
-	if held, why, _ := judgeGrantOnce(none); held || !strings.Contains(why, "no module holds the bus") {
-		t.Errorf("no bus: held %v (%q)", held, why)
-	}
-}
-
-// judgeGrantOnce is the whole judgement with the composed grant held, as the asker makes it.
-func judgeGrantOnce(bus grantJudge) (bool, string, error) {
-	yes := func(context.Context) (bool, string, error) { return true, "", nil }
-	return grantHeldBy(yes, bus, time.Now)(context.Background())
-}
-
-// The orders reviews 22 and 31 of PR 188 found: this controller live before the bus module that answers
-// in_force, with the bus's machine behind on its list — and, after mesh-catalog #166 merged, unpushable until a
-// person's bus upgrade. An older module that allows the ask asks (once, with the caveat said); a new module that
-// has not reloaded names the wait, not a push; one that cannot say whether it reloaded names what is not known.
-func TestAnOlderBusModuleNeitherSilencesTheAsksNorNamesTheWrongRemedy(t *testing.T) {
-	for _, c := range []struct {
-		name, answer string
-		list         busListState
-		asks         bool
-		says, not    string
-	}{
-		{"older module, list current", `{"allowed":true}`, busListState{Machine: "anchor"}, true, "not confirmed", ""},
-		{"older module, list behind, bus step pending", `{"allowed":true}`,
-			busListState{Machine: "anchor", Behind: true, BusStep: "a planned step"}, true, "not confirmed", ""},
-		{"new module, not reloaded",
-			`{"allowed":true,"in_force":false,"why":"not reloaded","file_written":"2026-10-09T15:55:56Z","server_loaded":"2026-10-09T15:50:00Z"}`,
-			busListState{Machine: "anchor"}, false, "within about 5 s", "push"},
-		{"new module, reload not known", `{"allowed":true,"in_force":false,"why":"the server's last configuration load could not be read: refused"}`,
-			busListState{Machine: "anchor"}, false, "is not known", "wait"},
-	} {
-		t.Run(c.name, func(t *testing.T) {
-			r := newAskerRig(t)
-			var said []string
-			r.a.logf = func(f string, a ...any) { said = append(said, fmt.Sprintf(f, a...)) }
-			var raised [][]conditions.Observation
-			r.a.raise = func(_ context.Context, obs []conditions.Observation) error {
-				raised = append(raised, obs)
-				return nil
-			}
-			yes := func(context.Context) (bool, string, error) { return true, "", nil }
-			r.a.grantHeld = grantHeldBy(yes, busGrantBy(
-				func(context.Context) (string, json.RawMessage, error) {
-					return "anchor", json.RawMessage(c.answer), nil
-				},
-				func(context.Context) (busListState, error) { return c.list, nil }),
-				func() time.Time { return r.now })
-			r.open = []conditions.Condition{heldCondition()}
-			_ = r.a.reconcile(context.Background())
-			_ = r.a.reconcile(context.Background())
-			sent := r.asksSent(t)
-			if c.asks {
-				if len(sent) != 1 || sent[0].About != heldCondition().Key {
-					t.Fatalf("not asked: %+v", sent)
-				}
-				n := 0
-				for _, s := range said {
-					if strings.Contains(s, c.says) {
-						n++
-					}
-				}
-				if n != 1 {
-					t.Errorf("the caveat said %d times: %q", n, said)
-				}
-				return
-			}
-			if len(sent) != 0 {
-				t.Fatalf("asked while the bus does not hold the grant: %+v", sent)
-			}
-			if len(raised) == 0 || len(raised[len(raised)-1]) != 1 ||
-				raised[len(raised)-1][0].Kind != "asks-undelivered" {
-				t.Fatalf("not said as undelivered: %+v", raised)
-			}
-			summary := raised[len(raised)-1][0].Summary
-			if !strings.Contains(summary, c.says) || (c.not != "" && strings.Contains(summary, c.not)) {
-				t.Errorf("the condition names the wrong remedy: %q", summary)
-			}
-		})
-	}
-}
-
-// The serving asker is wired to the real judgement: with records and a bus it cannot read, the grant is not
-// held, and so nothing is asked (a stub saying yes, or no judgement at all, would ask).
-func TestTheServingAskerJudgesTheGrantForReal(t *testing.T) {
-	a := servingAsker(&stores{}, nil, nil, nil)
-	if a.grantHeld == nil {
-		t.Fatal("the serving asker does not judge the bus's grant")
-	}
-	held, why, err := a.grantHeld(context.Background())
-	if err != nil || held || !strings.Contains(why, "could not be worked out") {
-		t.Errorf("held %v (%q, %v) with nothing to read", held, why, err)
-	}
-}

cmd/mesh-controller/asker_wire.go

@@ -235,27 +235,12 @@ func routerHereIn(inv *inventory.Inventory) func(ctx context.Context) (bool, err
 	}
 }
 
-// grantHeldIn says whether the bus holds the controller's grant to ask (novox/hq issue 353), judged on the two
-// facts that make it so, and failing closed on each:
-//
-//  1. **composed**: the user list the mesh composes now grants the controller itself to publish its ask
-//     (controllerMayAsk) — the controller's own grant, not whether any user of the list changed;
-//  2. **in force**: the bus's own module, on the machine holding the bus, says the user list there allows it
-//     and the server reloaded after that list was written (the nats module's `nats_user_can`, `in_force`) — a
-//     list sent is not a list the bus enforces until it reloads.
-//
-// Anything that cannot be worked out is not held, with why, so the conditions that need the operator are said
-// as undelivered rather than asked into a refusal.
-func grantHeldIn(open *stores, conn *nats.Conn) func(ctx context.Context) (bool, string, error) {
-	return grantHeldBy(composedGrantIn(open), busGrantIn(open, conn), time.Now)
-}
-
-// grantJudge is one of the two facts: whether it holds, and why not.
-type grantJudge func(ctx context.Context) (bool, string, error)
-
-// grantHeldBy is the judgement over the two facts, remembered for grantLookEvery: composing the list resolves
-// the bus's machine whole, and asking the bus's module is a call.
-func grantHeldBy(composed, inForce grantJudge, now func() time.Time) func(ctx context.Context) (bool, string, error) {
+// grantHeldIn says whether the bus holds the controller's grant to ask (novox/hq issue 353): the user list the
+// machine holding the bus was last sent is the one the mesh composes now (brokerBehind, the same judgement a
+// push makes to send that machine first). While it is behind, the controller's ask is refused by the bus,
+// whatever the record says of the router, so nothing is asked and the operator is told to push that machine.
+// Judged at most every grantLookEvery: composing the list resolves the bus's machine whole.
+func grantHeldIn(open *stores) func(ctx context.Context) (bool, string, error) {
 	var mu sync.Mutex
 	var at time.Time
 	var held bool
@@ -263,251 +248,22 @@ func grantHeldBy(composed, inForce grantJudge, now func() time.Time) func(ctx co
 	return func(ctx context.Context) (bool, string, error) {
 		mu.Lock()
 		defer mu.Unlock()
-		if !at.IsZero() && now().Sub(at) < grantLookEvery {
+		if !at.IsZero() && time.Since(at) < grantLookEvery {
 			return held, why, nil
 		}
-		held, why = judgeGrant(ctx, composed, inForce)
-		at = now()
-		return held, why, nil
-	}
-}
-
-// judgeGrant is held only when both facts hold; an error is a fact not known, never a yes. A fact that holds
-// with a caveat (a reload not confirmed) gives that caveat as the why of a yes.
-func judgeGrant(ctx context.Context, composed, inForce grantJudge) (bool, string) {
-	var caveat []string
-	for _, fact := range []struct {
-		judge grantJudge
-		what  string
-	}{{composed, "whether the mesh composes the controller a grant to ask"}, {inForce, "whether the bus enforces it"}} {
-		if fact.judge == nil {
-			return false, fact.what + " is not judged here"
-		}
-		ok, why, err := fact.judge(ctx)
-		if err != nil {
-			return false, fact.what + " could not be worked out: " + err.Error()
-		}
-		if !ok {
-			return false, why
-		}
-		if why != "" {
-			caveat = append(caveat, why)
-		}
-	}
-	return true, strings.Join(caveat, "; ")
-}
-
-// controllerMayAsk says whether the controller's own grant, as composed from these records, lets it publish its
-// ask (ADR 0259 §3: composed while a router that takes asks under its asker's name is assigned).
-func controllerMayAsk(records broker.Records) (bool, error) {
-	users, err := broker.Users(records)
-	if err != nil {
-		return false, err
-	}
-	for _, u := range users {
-		if u.Kind != broker.KindController {
-			continue
-		}
-		perms, err := broker.PermissionsFor(u)
-		if err != nil {
-			return false, err
-		}
-		return broker.MayPublish(perms, asks.AskSubject(askerName)), nil
-	}
-	return false, errors.New("the composition holds no controller")
-}
-
-// composedGrantIn is the first fact, from the mesh's records.
-func composedGrantIn(open *stores) grantJudge {
-	return func(ctx context.Context) (bool, string, error) {
-		if open == nil || open.inventory == nil {
-			return false, "", errors.New("the mesh's records are not open")
-		}
-		records, err := open.inventory.BusRecords(ctx)
+		machine, behind, err := brokerBehind(ctx, open, nil)
 		if err != nil {
 			return false, "", err
 		}
-		may, err := controllerMayAsk(records)
-		if err != nil || may {
-			return may, "", err
+		at, held, why = time.Now(), !behind, ""
+		if behind {
+			why = fmt.Sprintf("the bus's user list on %s is behind what the mesh composes, so the bus has not been "+
+				"given the controller's grant to ask; `push %s` carries it", machine, machine)
 		}
-		return false, "the mesh composes the controller no grant to ask: no router that takes asks under its " +
-			"asker's name is assigned", nil
+		return held, why, nil
 	}
 }
 
-// busGrantIn is the second fact, asked of the bus's own module on the machine holding the bus, with the check
-// main made before it (novox/hq issue 353, PR 186: is the user list sent to the bus's machine the one composed
-// now) kept for the cases the module's word does not settle.
-func busGrantIn(open *stores, conn *nats.Conn) grantJudge {
-	ask := func(ctx context.Context) (string, json.RawMessage, error) {
-		if open == nil || open.inventory == nil || conn == nil {
-			return "", nil, errors.New("the mesh's records or the bus are not open")
-		}
-		holders, err := seatHolders(ctx, open.inventory)
-		if err != nil {
-			return "", nil, err
-		}
-		h, held := holders[theBrokerSeat]
-		if !held || h.Node == "" || h.Module == "" {
-			return "", nil, nil
-		}
-		a, err := link.AskModuleToolOn(ctx, conn, h.Module, busUserCanTool, h.Node, map[string]any{
-			"user": broker.ControllerName, "action": "publish", "subject": asks.AskSubject(askerName)}, 15*time.Second)
-		if err != nil {
-			return h.Node, nil, err
-		}
-		if a.Error != "" {
-			return h.Node, nil, errors.New(a.Error)
-		}
-		return h.Node, a.Result, nil
-	}
-	list := func(ctx context.Context) (busListState, error) {
-		if open == nil || open.inventory == nil {
-			return busListState{}, errors.New("the mesh's records are not open")
-		}
-		s, err := brokerListState(ctx, open, nil)
-		if err != nil || s.Machine == "" || !s.Behind {
-			return s, err
-		}
-		step, err := busHeld(ctx, open.inventory, []string{s.Machine})
-		if err != nil {
-			return busListState{}, err
-		}
-		s.BusStep = step[s.Machine]
-		return s, nil
-	}
-	return busGrantBy(ask, list)
-}
-
-// busListState is the user list on the bus's machine as the controller's record knows it: whether the list
-// sent there is behind the one composed now, why it could not be composed, and the bus step a send there waits
-// on (that machine cannot be pushed until a person's `bus upgrade`).
-type busListState struct {
-	Machine    string
-	Behind     bool
-	Uncomposed error
-	BusStep    string
-}
-
-// remedy is the one thing that sends the bus's machine the list composed now: the plan's own reason when it
-// cannot be composed, the bus upgrade while sends there wait on it, and otherwise a push of that machine.
-func (s busListState) remedy(node string) string {
-	if s.Machine != "" {
-		node = s.Machine
-	}
-	switch {
-	case s.Uncomposed != nil:
-		return fmt.Sprintf("the user list for %s cannot be composed (%v); `plan %s` says what to fix first",
-			node, s.Uncomposed, node)
-	case s.BusStep != "":
-		return fmt.Sprintf("sends to %s wait on the bus's planned step, so a push will not carry it: %s", node, s.BusStep)
-	}
-	return fmt.Sprintf("`push %s` carries it", node)
-}
-
-// busGrantBy judges the bus's word, and names for each way it is not held the one thing that makes it held:
-//
-//   - **in force**: held;
-//   - **allowed, from a module older than `in_force`**: held, with the caveat that the reload is not confirmed.
-//     The file allows the publish, and the bus reloads within about 5 s of a change to it, so the worst case is
-//     one ask refused in those seconds, which is asked again (issue 369). The list check is not consulted:
-//     while a bus step is pending the bus's machine cannot be pushed, so any change to the composed list would
-//     read as behind for good and silence every ask until a person's bus upgrade (the review of PR 188);
-//   - **allowed, written, not reloaded** (the module gives both times): wait about 5 s;
-//   - **allowed, in force not known** (the module could not read a time): what is not known, said;
-//   - **not allowed, or the module cannot answer**: the list check decides — the remedy that sends the list
-//     when it is behind (busListState.remedy), and, for a module that cannot answer, held while the list sent
-//     is current, as main judged it.
-//
-// ask answers the machine holding the bus and its module's answer ("" when nothing holds the bus); list is the
-// record's word on the list sent to that machine.
-func busGrantBy(ask func(ctx context.Context) (string, json.RawMessage, error),
-	list func(ctx context.Context) (busListState, error)) grantJudge {
-	return func(ctx context.Context) (bool, string, error) {
-		node, raw, askErr := ask(ctx)
-		if askErr == nil && node == "" {
-			return false, "no module holds the bus, so nothing says what it enforces", nil
-		}
-		var answer busAnswer
-		if askErr == nil {
-			if answer, askErr = readBusAnswer(raw); askErr != nil {
-				askErr = fmt.Errorf("its answer could not be read: %w", askErr)
-			}
-		}
-		if askErr != nil {
-			if node == "" {
-				node = "the bus's machine"
-			}
-			s, err := list(ctx)
-			if err != nil {
-				return false, "", fmt.Errorf("the bus module on %s could not answer (%v), and whether the list sent "+
-					"there is the one composed now could not be worked out: %w", node, askErr, err)
-			}
-			if s.Behind {
-				return false, fmt.Sprintf("the bus module on %s could not answer (%v), and the user list sent there is "+
-					"behind what the mesh composes; %s", node, askErr, s.remedy(node)), nil
-			}
-			return true, fmt.Sprintf("the bus module on %s could not answer (%v); judged by the user list sent there, "+
-				"which is the one composed now", node, askErr), nil
-		}
-		notAllowed := func(older string) (bool, string, error) {
-			s, err := list(ctx)
-			if err != nil {
-				return false, "", fmt.Errorf("the user list on %s does not allow the controller to ask%s, and whether "+
-					"the list sent there is the one composed now could not be worked out: %w", node, older, err)
-			}
-			if s.Behind {
-				return false, fmt.Sprintf("the user list on %s does not allow the controller to ask%s: it is behind "+
-					"what the mesh composes; %s", node, older, s.remedy(node)), nil
-			}
-			return false, fmt.Sprintf("the user list on %s does not allow the controller to ask%s, though the list "+
-				"sent there is the one composed now; %s again", node, older, s.remedy(node)), nil
-		}
-		switch {
-		case answer.InForce == nil && answer.Allowed:
-			return true, fmt.Sprintf("the user list on %s allows the controller to ask, but its reload is not "+
-				"confirmed: the bus module there is older than the answer whether a grant is in force, and the bus "+
-				"upgrade (`bus upgrade`) carries one that confirms it", node), nil
-		case answer.InForce == nil:
-			return notAllowed(" (the bus module there is older than the answer whether a grant is in force)")
-		case !answer.Allowed:
-			return notAllowed("")
-		case *answer.InForce:
-			return true, "", nil
-		case answer.FileWritten != "" && answer.ServerLoaded != "":
-			return false, fmt.Sprintf("the bus on %s has the controller's grant to ask written (%s) but has not "+
-				"reloaded since (last load %s); it reloads in place within about 5 s, so nothing is to be done but wait",
-				node, answer.FileWritten, answer.ServerLoaded), nil
-		}
-		why := answer.Why
-		if why == "" {
-			why = "it gives no reason"
-		}
-		return false, fmt.Sprintf("the user list on %s allows the controller to ask, but whether the bus enforces it "+
-			"is not known: %s", node, why), nil
-	}
-}
-
-// busUserCanTool is the bus module's answer to whether a user may do something, and whether it is in force.
-const busUserCanTool = "nats_user_can"
-
-// busAnswer is the bus module's answer to busUserCanTool; InForce is nil from a module older than that field,
-// and FileWritten and ServerLoaded are given only when it could read both times (mesh-catalog's nats InForce).
-type busAnswer struct {
-	Allowed      bool   `json:"allowed"`
-	InForce      *bool  `json:"in_force"`
-	Why          string `json:"why"`
-	FileWritten  string `json:"file_written"`
-	ServerLoaded string `json:"server_loaded"`
-}
-
-func readBusAnswer(raw json.RawMessage) (busAnswer, error) {
-	var answer busAnswer
-	err := json.Unmarshal(raw, &answer)
-	return answer, err
-}
-
 // grantLookEvery is how often the bus's user list is judged against the one its machine was last sent.
 const grantLookEvery = 30 * time.Second
 
@@ -546,19 +302,7 @@ func startAsking(ctx context.Context, open *stores, server *link.Server, conn *n
 		fmt.Printf("the operator cannot be asked: %v\n", err)
 		return
 	}
-	a := servingAsker(open, conn, js, keeper)
-	if err := server.Decides(a); err != nil {
-		fmt.Printf("the operator's answers cannot be heard, so nothing is asked: %v\n", err)
-		return
-	}
-	askerFrom = a
-	go a.keep(ctx)
-}
-
-// servingAsker is the serving controller's asker, wired to the mesh: what it reads, publishes, performs and
-// records, and the judgements it asks by — the bus's grant to ask among them (novox/hq issue 353).
-func servingAsker(open *stores, conn *nats.Conn, js jetstream.JetStream, keeper *conditions.Keeper) *asker {
-	return &asker{
+	a := &asker{
 		open: keeper.Open,
 		silence: func(ctx context.Context, key string, d time.Duration, by, why string) error {
 			_, err := keeper.Silence(ctx, key, d, by, why)
@@ -578,7 +322,7 @@ func servingAsker(open *stores, conn *nats.Conn, js jetstream.JetStream, keeper
 		},
 		routerRecord: routerRecordOf(conn, open.inventory),
 		routerHere:   routerHereIn(open.inventory),
-		grantHeld:    grantHeldIn(open, conn),
+		grantHeld:    grantHeldIn(open),
 		channels:     channelsIn(open.inventory),
 		raise: func(ctx context.Context, obs []conditions.Observation) error {
 			return keeper.Reconcile(ctx, sourceAsker, obs)
@@ -586,4 +330,10 @@ func servingAsker(open *stores, conn *nats.Conn, js jetstream.JetStream, keeper
 		now:  time.Now,
 		logf: func(format string, args ...any) { fmt.Printf(format+"\n", args...) },
 	}
+	if err := server.Decides(a); err != nil {
+		fmt.Printf("the operator's answers cannot be heard, so nothing is asked: %v\n", err)
+		return
+	}
+	askerFrom = a
+	go a.keep(ctx)
 }

cmd/mesh-controller/batches.go

@@ -37,11 +37,6 @@ import (
 //     own commit, the newest first, one walk each, until one is delivered; the older ones are then answered
 //     by that one.
 //
-// **A merge waits only for a batch it shares something with** (novox/hq ADR 0304 decision 1, ADR 0306 decisions
-// 2 and 3, issue 525): it joins a batch it is related to, and one that is related to none and whose delivery
-// group has no member still to merge is a batch whose window is closed at once (batchToJoin). Walks stay one at
-// a time: such a batch is cut when no walk is open, and queued behind the one that is otherwise.
-//
 // A merge on the controller's own path (a module whose walk waits for nobody's word) never shares a batch with
 // one that waits for mesh-delivery's: each kind has a batch of its own, an own-path batch is cut first and folds
 // no waiting catalogue walk, and a catalogue walk let go while another walk runs starts once it ended — so no
@@ -178,12 +173,6 @@ func (f following) hearMerge(ctx context.Context, m link.SourceMoved, now time.T
 		fmt.Printf("%s merged into %s (%.8s); nothing the mesh holds reads it\n", repository, m.Base, m.Commit)
 		return nil
 	}
-	// **Its delivery group's word, before the plans are held** (ADR 0306 decision 2): a slow answer holds up no walk.
-	own := ownPath(touches)
-	waits, err := groupWait(ctx, inv, m, deliverySeatHeld(entries), own)
-	if err != nil {
-		return notNow(err)
-	}
 	release, err := inv.HoldPlans(ctx, true)
 	if err != nil {
 		return notNow(err)
@@ -209,6 +198,7 @@ func (f following) hearMerge(ctx context.Context, m link.SourceMoved, now time.T
 	// **A merge on the controller's own path never shares a batch with one that waits for the delivery's
 	// word** (decided during the build, 2026-10-10): batched together, the catalogue's deliveries would start
 	// with the controller's and skip their turn. Each kind has a batch of its own.
+	own := ownPath(touches)
 	if p, ok, err := answeredByALaterMerge(ctx, inv, heard, touches, own, deliverySeatHeld(entries)); err != nil {
 		return notNow(err)
 	} else if ok {
@@ -228,7 +218,7 @@ func (f following) hearMerge(ctx context.Context, m link.SourceMoved, now time.T
 		return cutBatchesHeld(ctx, f.open, now)
 	}
 
-	batch, why, err := batchToJoin(ctx, inv, heard, entries, read, now, own, waits)
+	batch, err := theOpenBatch(ctx, inv, heard, now, own)
 	if err != nil {
 		return notNow(err)
 	}
@@ -239,7 +229,7 @@ func (f following) hearMerge(ctx context.Context, m link.SourceMoved, now time.T
 	if err := keepBatch(ctx, inv, &batch, now, ""); err != nil {
 		return notNow(err)
 	}
-	fmt.Printf("%s merged into %s (%.8s); %s, it joins %s — %s\n", repository, m.Base, m.Commit, why, batch.ID,
+	fmt.Printf("%s merged into %s (%.8s); it joins %s — %s\n", repository, m.Base, m.Commit, batch.ID,
 		batchWords(batch, now))
 	return cutBatchesHeld(ctx, f.open, now)
 }
@@ -330,211 +320,22 @@ func ownPath(touches []inventory.Entry) bool {
 	return false
 }
 
-// **A merge waits only for a batch it shares something with** (novox/hq ADR 0304 decision 1, as ADR 0306
-// decisions 2 and 3 read it). batchToJoin is the batch a merge heard now joins, and why in words:
-//
-//   - an assembling or queued batch of its kind it is related to (related.go): it joins it and waits for the
-//     window, which its coming restarts. Related to two or more, the newer are folded into the oldest, which
-//     answers all their merges: a merge never waits in two windows, and what it shares with each walks in one.
-//   - none, and its delivery group has a member still to merge, or mesh-delivery could not say (groupWait, waits
-//     names why): a new batch, which waits for the window, beside the ones it shares nothing with; its words say
-//     why.
-//   - none, and no member of its group is still to merge: a new batch whose window is closed at once. Cut at
-//     once means only that: walks stay one at a time (ADR 0276 decision 4), so with a walk open the batch is
-//     queued behind it as any closed batch is.
-func batchToJoin(ctx context.Context, inv *inventory.Inventory, heard inventory.BatchedMerge, entries []inventory.Entry,
-	read map[string][]inventory.ReadRepository, now time.Time, own bool, waits string) (inventory.Plan, string, error) {
-	edges, err := inv.Dependencies(ctx)
-	if err != nil {
-		return inventory.Plan{}, "", err
-	}
-	joins, whys, _, err := relatedBatches(ctx, inv, []inventory.BatchedMerge{heard}, own, "", entries, read, edges)
-	if err != nil {
-		return inventory.Plan{}, "", err
-	}
-	if len(joins) > 0 {
-		into := joins[0]
-		why := "related to " + into.ID + " (" + whys[0] + ")"
-		if len(joins) > 1 {
-			plans, moves, err := foldInto(ctx, inv, &into, joins[1:])
-			if err != nil {
-				return inventory.Plan{}, "", err
-			}
-			if err := inv.SavePlansMoving(ctx, plans, moves); err != nil {
-				return inventory.Plan{}, "", err
-			}
-			var folded []string
-			for i, b := range joins[1:] {
-				folded = append(folded, b.ID+" ("+whys[i+1]+")")
-			}
-			why += ", and to " + strings.Join(folded, ", ") + ", folded into it"
-		}
-		into.Delivery.Batch.CutAtOnce = false
-		return into, why, nil
-	}
-	if waits != "" {
-		// Its own window, beside the batches it shares nothing with: waiting is for its group's members, which
-		// are related to it by their head and join it (ADR 0306 decision 2).
-		b, err := newBatch(ctx, inv, heard, now, own, false, waits)
-		return b, waits + ", it waits for the window in a batch of its own", err
-	}
-	b, err := newBatch(ctx, inv, heard, now, own, true, "")
-	return b, "it shares nothing with a batch assembling and no member of a group is still to merge: it is cut at once", err
-}
-
-// relatedBatches are the batches not yet cut of a kind, oldest first, parted into those related to merges (with
-// the first reason of each) and the others. Each batch is judged by what its cut would move (ADR 0306 decision
-// 3): its merges' moves as they were kept and as they read now — the catalogue may have moved since a merge was
-// heard — widened to their dependents, and, for a catalogue batch, every walk waiting for its word, which the
-// cut folds in (cutBatch's carry). A merge kept with no moves leaves its batch unknown, related to everything.
-// except is a walk not to count as folded: the one being stopped.
-func relatedBatches(ctx context.Context, inv *inventory.Inventory, merges []inventory.BatchedMerge, own bool,
-	except string, entries []inventory.Entry, read map[string][]inventory.ReadRepository,
-	edges []inventory.Edge) (joins []inventory.Plan, whys []string, others []inventory.Plan, err error) {
+// theOpenBatch is the batch a merge heard now joins: the one of its kind not yet cut, or a new one.
+func theOpenBatch(ctx context.Context, inv *inventory.Inventory, first inventory.BatchedMerge, now time.Time, own bool) (inventory.Plan, error) {
 	batches, err := inv.Batches(ctx)
 	if err != nil {
-		return nil, nil, nil, err
+		return inventory.Plan{}, err
 	}
-	var kind []inventory.Plan
 	for _, b := range batches {
 		if b.OwnPath() == own {
-			kind = append(kind, b)
+			return b, nil
 		}
 	}
-	if len(kind) == 0 {
-		return nil, nil, nil, nil
-	}
-	carry := newFootprint()
-	if !own {
-		// An own-path batch folds no waiting walk (cutBatchesHeld); a catalogue batch may fold every one.
-		plans, err := inv.OpenPlans(ctx)
-		if err != nil {
-			return nil, nil, nil, err
-		}
-		for _, p := range plans {
-			if p.Release != nil || !p.Waiting() || p.ID == except {
-				continue
-			}
-			kept, err := inv.MergesOf(ctx, p.ID)
-			if err != nil {
-				return nil, nil, nil, err
-			}
-			carry = unionFootprint(carry, footprintOfWalk(p, kept))
-		}
-	}
-	mine := footprintAsCut(merges, entries, read, edges)
-	for _, b := range kind {
-		held, err := inv.MergesOf(ctx, b.ID)
-		if err != nil {
-			return nil, nil, nil, err
-		}
-		if b.Delivery == nil {
-			b.Delivery = &inventory.PlanDelivery{}
-		}
-		if b.Delivery.Batch == nil {
-			b.Delivery.Batch = &inventory.PlanBatch{Own: own}
-		}
-		if ok, why := related(mine, unionFootprint(footprintAsCut(held, entries, read, edges), carry), edges); ok {
-			joins, whys = append(joins, b), append(whys, why)
-		} else {
-			others = append(others, b)
-		}
-	}
-	return joins, whys, others, nil
-}
-
-// footprintAsCut is a batch's footprint as a cut now would read it: footprintOfBatch, widened by the modules each
-// merge moves as the catalogue reads now (planBatch judges each merge again at the cut, so what it moves may
-// have changed since it was heard). Both are kept: when in doubt, related.
-func footprintAsCut(merges []inventory.BatchedMerge, entries []inventory.Entry,
-	read map[string][]inventory.ReadRepository, edges []inventory.Edge) footprint {
-	f := footprintOfBatch(merges, edges)
-	var moved []string
-	for _, m := range merges {
-		s := announcedOf(m).SourceMoved
-		if s.Owner == "" {
-			continue
-		}
-		s.MergedAt = "" // news, whatever a cut marked seen since (as planBatch reads it)
-		for _, e := range wouldMove(s, entries, read) {
-			moved = append(moved, e.Manifest.Module)
-		}
-	}
-	for _, name := range reachableFrom(moved, edges) {
-		f.modules[name] = true
-	}
-	return f
-}
-
-// unionFootprint is what two changes reach together.
-func unionFootprint(a, b footprint) footprint {
-	f := newFootprint()
-	for _, from := range []footprint{a, b} {
-		for k := range from.repos {
-			f.repos[k] = true
-		}
-		for k := range from.modules {
-			f.modules[k] = true
-		}
-		for k := range from.heads {
-			f.heads[k] = true
-		}
-	}
-	f.unknown = a.unknown
-	if f.unknown == "" {
-		f.unknown = b.unknown
-	}
-	return f
-}
-
-// foldInto folds batches into the oldest one related to a merge: the plans to write (into first, so no merge
-// names a plan the store does not hold) and the merges to move, for one SavePlansMoving. The folded batches name
-// the batch that took them over; a stop's closed window and its withheld modules (ADR 0299) go with their merges.
-func foldInto(ctx context.Context, inv *inventory.Inventory, into *inventory.Plan, from []inventory.Plan) ([]*inventory.Plan,
-	[]inventory.MergeMove, error) {
-	if into.Delivery == nil {
-		into.Delivery = &inventory.PlanDelivery{}
-	}
-	if into.Delivery.Batch == nil {
-		into.Delivery.Batch = &inventory.PlanBatch{Own: into.OwnPath()}
-	}
-	plans := []*inventory.Plan{into}
-	var moves []inventory.MergeMove
-	for i := range from {
-		f := from[i]
-		merges, err := inv.MergesOf(ctx, f.ID)
-		if err != nil {
-			return nil, nil, err
-		}
-		for _, m := range merges {
-			moves = append(moves, inventory.MergeMove{Repository: m.Repository, Commit: m.Commit, Plan: into.ID, Alone: m.Alone})
-		}
-		if f.Delivery == nil {
-			f.Delivery = &inventory.PlanDelivery{}
-		}
-		if w := f.Delivery.Batch; w != nil {
-			into.Delivery.Batch.Closed = into.Delivery.Batch.Closed || w.Closed
-			into.Delivery.Batch.Withheld = union(into.Delivery.Batch.Withheld, w.Withheld)
-			sort.Strings(into.Delivery.Batch.Withheld)
-		}
-		f.State = inventory.PlanSuperseded
-		f.Delivery.Batch = nil
-		f.Delivery.TakenOverBy = into.ID
-		f.Note = fmt.Sprintf("folded into %s before it was cut: a merge related to both joined it, and %s answers "+
-			"its merges", into.ID, into.ID)
-		plans = append(plans, &f)
-	}
-	return plans, moves, nil
-}
-
-// newBatch is a new batch of a kind, kept before its first merge names it: a merge never names a plan the store
-// does not hold. cutAtOnce closes its window at once; waits says why it waits for its group, when it does.
-func newBatch(ctx context.Context, inv *inventory.Inventory, first inventory.BatchedMerge, now time.Time, own,
-	cutAtOnce bool, waits string) (inventory.Plan, error) {
 	b := inventory.Plan{ID: fmt.Sprintf("plan-%d", now.UnixNano()), Repository: first.Repository, Branch: first.Branch,
 		Commit: first.Commit, Merged: first.Merged, Created: now, State: inventory.PlanAssembling,
 		Tiers: [][]string{}, Modules: map[string]*inventory.PlanModule{},
-		Delivery: &inventory.PlanDelivery{Batch: &inventory.PlanBatch{Own: own, CutAtOnce: cutAtOnce, Waits: waits}}}
+		Delivery: &inventory.PlanDelivery{Batch: &inventory.PlanBatch{Own: own}}}
+	// Kept before its first merge names it: a merge never names a plan the store does not hold.
 	if err := inv.SavePlan(ctx, &b); err != nil {
 		return inventory.Plan{}, err
 	}
@@ -566,16 +367,13 @@ func keepBatch(ctx context.Context, inv *inventory.Inventory, b *inventory.Plan,
 	}
 	closes, latest := windowOf(merges, b.Created, window, atMost)
 	b.Delivery.Merges = named
-	var closed, cutAtOnce bool
+	var closed bool
 	var withheld []string
-	var waits string
 	if was := b.Delivery.Batch; was != nil {
 		closed, withheld = was.Closed, was.Withheld // a stop's, which no look takes back (novox/hq ADR 0299)
-		cutAtOnce = was.CutAtOnce                   // the merge's, until another joins it (ADR 0304 decision 1)
-		waits = was.Waits                           // its group's, as said when it was made (ADR 0306 decision 2)
 	}
 	b.Delivery.Batch = &inventory.PlanBatch{ClosesAt: closes, AtMost: latest, Behind: behind, Own: b.OwnPath(),
-		Closed: closed, Withheld: withheld, CutAtOnce: cutAtOnce, Waits: waits}
+		Closed: closed, Withheld: withheld}
 	b.State = inventory.PlanAssembling
 	if behind != "" && windowClosed(*b, now) {
 		b.State = inventory.PlanQueued
@@ -604,14 +402,13 @@ func windowOf(merges []inventory.BatchedMerge, created time.Time, window, atMost
 	return last.Add(window), created.Add(atMost)
 }
 
-// windowClosed says a batch's window is closed: closed by a stop, closed at once for a merge that shares
-// nothing (ADR 0304 decision 1), no merge for the window's length, or its maximum reached.
+// windowClosed says a batch's window is closed: no merge for the window's length, or its maximum reached.
 func windowClosed(b inventory.Plan, now time.Time) bool {
 	if b.Delivery == nil || b.Delivery.Batch == nil {
 		return true
 	}
 	w := b.Delivery.Batch
-	return w.Closed || w.CutAtOnce || !now.Before(w.ClosesAt) || !now.Before(w.AtMost)
+	return w.Closed || !now.Before(w.ClosesAt) || !now.Before(w.AtMost)
 }
 
 // carriedOf is a set of merges as a walk carries them: the latest merge of each repository's branch, and
@@ -820,9 +617,8 @@ func cutBatchesHeld(ctx context.Context, open *stores, now time.Time) error {
 		return err
 	}
 	// The oldest batch whose window closed is cut, an own-path one before a catalogue one (it goes first, and
-	// the catalogue batch queues behind it rather than being cut and overtaken). Several of a kind may be open
-	// since a merge that shares nothing is cut at once (ADR 0304 decision 1): walks stay one at a time, so one
-	// is cut per look, and once its walk started the others are queued behind it.
+	// the catalogue batch queues behind it rather than being cut and overtaken); one of each kind at most is
+	// open (theOpenBatch).
 	sort.SliceStable(batches, func(i, j int) bool { return batches[i].OwnPath() && !batches[j].OwnPath() })
 	for i := range batches {
 		b := &batches[i]
@@ -1090,9 +886,6 @@ func walkTimesAtCut(batch, walk inventory.Plan, entries []inventory.Entry, now t
 		if !w.AtMost.IsZero() && w.AtMost.Before(closed) {
 			closed = w.AtMost
 		}
-		if w.CutAtOnce && !batch.Created.IsZero() {
-			closed = batch.Created // closed when it was made (ADR 0304 decision 1)
-		}
 		if !closed.IsZero() {
 			if closed.After(now) {
 				closed = now
@@ -1349,10 +1142,6 @@ func batchWords(b inventory.Plan, now time.Time) string {
 	if b.State == inventory.PlanQueued {
 		return fmt.Sprintf("queued behind %s; grouped: %s; plan not yet calculated", w.Behind, grouped)
 	}
-	if w.CutAtOnce {
-		return fmt.Sprintf("cut at once, sharing nothing with a batch assembling; grouped: %s; plan not yet calculated",
-			grouped)
-	}
 	left := w.ClosesAt.Sub(now)
 	if w.AtMost.Before(w.ClosesAt) {
 		left = w.AtMost.Sub(now)
@@ -1360,12 +1149,8 @@ func batchWords(b inventory.Plan, now time.Time) string {
 	if left < 0 {
 		left = 0
 	}
-	waits := ""
-	if w.Waits != "" {
-		waits = " — " + w.Waits
-	}
-	return fmt.Sprintf("assembling: %s left (at the latest %s)%s; grouped: %s; plan not yet calculated",
-		secondsWords(left), w.AtMost.Local().Format("15:04:05"), waits, grouped)
+	return fmt.Sprintf("assembling: %s left (at the latest %s); grouped: %s; plan not yet calculated",
+		secondsWords(left), w.AtMost.Local().Format("15:04:05"), grouped)
 }
 
 // groupedWords is a batch's commits, each with the earlier merges it answers.

cmd/mesh-controller/batches_test.go

@@ -34,7 +34,6 @@ func windowed(t *testing.T) *stores {
 		t.Fatal(err)
 	}
 	t.Setenv(mergeWindowFileVar, settings)
-	noGroups(t)
 	if err := inv.RegisterModule(ctx, catalogue.Manifest{Module: "mesh-controller", Version: "1"},
 		inventory.Source{Repository: "novox/mesh-controller", Seat: "git", Ref: "main", BuiltFrom: "c0",
 			Head: "c0"}); err != nil {
@@ -59,70 +58,19 @@ func windowed(t *testing.T) *stores {
 // t0 is the moment a test's clock starts: merges are dated by it, and heard after it.
 var t0 = time.Now().UTC().Truncate(time.Second)
 
-// catalogueMerge is a merge of the catalogue changing one module's directory, made at a moment, from a pull
-// request's head branch of its own, as the forge announces every merge. Whether its head names a delivery group
-// with a member still to merge is mesh-delivery's word, which windowed stubs as no group at all (noGroups); a test
-// whose merges wait for the window as a group's says so (groupsWaiting).
+// catalogueMerge is a merge of the catalogue changing one module's directory, made at a moment.
 func catalogueMerge(commit, module string, made time.Time) link.SourceMoved {
-	return link.SourceMoved{Owner: "novox", Repo: "mesh-catalog", Base: "main", Head: "pr/" + commit, Commit: commit,
+	return link.SourceMoved{Owner: "novox", Repo: "mesh-catalog", Base: "main", Commit: commit,
 		MergedAt: made.Format(time.RFC3339Nano), Paths: []string{"modules/" + module + "/module.json"},
 		ModuleDirs: []string{"modules/" + module}, ModuleDirsSaid: true}
 }
 
-// repoMerge is a merge of a repository of one module's own, from a head branch of its own (catalogueMerge).
+// repoMerge is a merge of a repository of one module's own.
 func repoMerge(repo, commit string, made time.Time) link.SourceMoved {
-	return link.SourceMoved{Owner: "novox", Repo: repo, Base: "main", Head: "pr/" + commit, Commit: commit,
+	return link.SourceMoved{Owner: "novox", Repo: repo, Base: "main", Commit: commit,
 		MergedAt: made.Format(time.RFC3339Nano), Paths: []string{"main.go"}}
 }
 
-// noGroups stubs mesh-delivery's word on groups for a test: no head names a group.
-func noGroups(t *testing.T) {
-	t.Helper()
-	was := deliveryGroupOf
-	deliveryGroupOf = func(context.Context, bool, string) ([]groupMember, bool, error) { return nil, false, nil }
-	t.Cleanup(func() { deliveryGroupOf = was })
-}
-
-// groupsWaiting stubs mesh-delivery's word on groups for a test: each head named is a group with a member of another
-// repository whose pull request is open (novox/elsewhere, ready), so a merge from it waits for the window (ADR 0306
-// decision 2); every other head names no group.
-func groupsWaiting(t *testing.T, heads ...string) {
-	t.Helper()
-	was := deliveryGroupOf
-	deliveryGroupOf = func(_ context.Context, _ bool, head string) ([]groupMember, bool, error) {
-		if slices.Contains(heads, head) {
-			return []groupMember{{Repository: "novox/elsewhere", State: "ready"}}, true, nil
-		}
-		return nil, false, nil
-	}
-	t.Cleanup(func() { deliveryGroupOf = was })
-}
-
-// everyHeadWaits stubs mesh-delivery's word on groups for a test whose merges each wait for the window as they did
-// before novox/hq ADR 0304: every head is a group with a member of another repository still to merge.
-func everyHeadWaits(t *testing.T) {
-	t.Helper()
-	was := deliveryGroupOf
-	deliveryGroupOf = func(context.Context, bool, string) ([]groupMember, bool, error) {
-		return []groupMember{{Repository: "novox/elsewhere", State: "ready"}}, true, nil
-	}
-	t.Cleanup(func() { deliveryGroupOf = was })
-}
-
-// fromHead is a merge from a head branch a test names: merges from one head are members of one delivery group,
-// related by it (novox/hq ADR 0304 decision 1), so they share a batch whatever else they share.
-func fromHead(m link.SourceMoved, head string) link.SourceMoved {
-	m.Head = head
-	return m
-}
-
-// lone is a merge that names no head: known to be no delivery group's, it waits for no window unless it is
-// related to a batch assembling (ADR 0304 decision 1).
-func lone(m link.SourceMoved) link.SourceMoved {
-	m.Head = ""
-	return m
-}
-
 // hear is a merge heard at a moment.
 func hear(t *testing.T, open *stores, m link.SourceMoved, now time.Time) {
 	t.Helper()
@@ -160,7 +108,6 @@ func walks(t *testing.T, open *stores) (walks, batches []inventory.Plan) {
 // later commit, which names both merges — the earlier carried by the later.
 func TestTwoMergesSecondsApartAreOneWalkAtTheLaterCommit(t *testing.T) {
 	open := windowed(t)
-	everyHeadWaits(t)
 	asked := asksWithPaths(t)
 	claude := catalogueMerge("553b7191claude", "app", t0)
 	dunst := catalogueMerge("48bda475dunst", "notes", t0.Add(17*time.Second))
@@ -205,10 +152,9 @@ func TestTwoMergesSecondsApartAreOneWalkAtTheLaterCommit(t *testing.T) {
 // Merges of three repositories in one window are one walk, one commit for each.
 func TestThreeRepositoriesInOneWindowAreOneWalk(t *testing.T) {
 	open := windowed(t)
-	groupsWaiting(t, "feat/three")
 	asksRecorded(t)
 	for i, r := range []string{"one", "two", "three"} {
-		hear(t, open, fromHead(repoMerge(r, "c-"+r, t0.Add(time.Duration(i)*20*time.Second)), "feat/three"),
+		hear(t, open, repoMerge(r, "c-"+r, t0.Add(time.Duration(i)*20*time.Second)),
 			t0.Add(time.Duration(i)*20*time.Second+time.Second))
 	}
 	cutAt(t, open, t0.Add(41*time.Second+90*time.Second))
@@ -241,10 +187,9 @@ func TestThreeRepositoriesInOneWindowAreOneWalk(t *testing.T) {
 // closes at most ten minutes after its first merge however busy.
 func TestAMergeRestartsTheWindowAndTheMaximumClosesIt(t *testing.T) {
 	open := windowed(t)
-	groupsWaiting(t, "feat/both", "feat/busy")
 	asksWithPaths(t)
-	hear(t, open, fromHead(repoMerge("one", "c1", t0), "feat/both"), t0)
-	hear(t, open, fromHead(repoMerge("two", "c2", t0.Add(80*time.Second)), "feat/both"), t0.Add(80*time.Second))
+	hear(t, open, repoMerge("one", "c1", t0), t0)
+	hear(t, open, repoMerge("two", "c2", t0.Add(80*time.Second)), t0.Add(80*time.Second))
 	cutAt(t, open, t0.Add(100*time.Second))
 	if ws, _ := walks(t, open); len(ws) != 0 {
 		t.Fatal("the window closed 90 seconds after its first merge, not after its last")
@@ -255,13 +200,12 @@ func TestAMergeRestartsTheWindowAndTheMaximumClosesIt(t *testing.T) {
 	}
 
 	busy := windowed(t)
-	groupsWaiting(t, "feat/both", "feat/busy")
 	asksWithPaths(t)
 	var last time.Time
 	for i := 0; i < 12; i++ {
 		last = t0.Add(time.Duration(i) * time.Minute)
 		repo := []string{"one", "two", "three"}[i%3]
-		hear(t, busy, fromHead(repoMerge(repo, "c"+string(rune('a'+i)), last), "feat/busy"), last)
+		hear(t, busy, repoMerge(repo, "c"+string(rune('a'+i)), last), last)
 		if ws, _ := walks(t, busy); len(ws) > 0 {
 			if i != 10 {
 				t.Fatalf("a busy window closed at merge %d (minute %d), not at its maximum", i, i)
@@ -279,11 +223,10 @@ func TestAMergeRestartsTheWindowAndTheMaximumClosesIt(t *testing.T) {
 // what is grouped, and that the plan is not yet calculated. It says so on the bus as plan-moved, too.
 func TestTheAssemblingBatchIsShown(t *testing.T) {
 	open := windowed(t)
-	groupsWaiting(t, "pr/553b7191claude")
 	asksWithPaths(t)
 	var said []inventory.Plan
 	was := inventory.PlanSaved
-	inventory.PlanSaved = func(_ *inventory.Inventory, p inventory.Plan) { said = append(said, p) }
+	inventory.PlanSaved = func(p inventory.Plan) { said = append(said, p) }
 	t.Cleanup(func() { inventory.PlanSaved = was })
 	now := time.Now().UTC()
 	claude := catalogueMerge("553b7191claude", "app", now.Add(-20*time.Second))
@@ -292,7 +235,7 @@ func TestTheAssemblingBatchIsShown(t *testing.T) {
 	dunst.Number, dunst.Title = 175, "dunst: the font the operator chose"
 	hear(t, open, claude, now.Add(-19*time.Second))
 	hear(t, open, dunst, now.Add(-time.Second))
-	hear(t, open, fromHead(repoMerge("one", "a6bc0931one", now), dunst.Head), now)
+	hear(t, open, repoMerge("one", "a6bc0931one", now), now)
 	out := captured(t, func() error { return plansCommand(t.Context(), nil) })
 	lines := strings.Split(out, "\n")
 	first := lines[0]
@@ -417,7 +360,6 @@ func TestAWaitingWalkIsFoldedIntoTheNextBatch(t *testing.T) {
 // moves — named at once on a walk done — and joins the next batch when it does not.
 func TestALateMergeIsAnsweredByTheWalkOfTheLaterOne(t *testing.T) {
 	open := windowed(t)
-	everyHeadWaits(t)
 	asksWithPaths(t)
 	ctx := t.Context()
 	later := catalogueMerge("48bda475dunst", "notes", t0.Add(17*time.Second))
@@ -449,7 +391,6 @@ func TestALateMergeIsAnsweredByTheWalkOfTheLaterOne(t *testing.T) {
 // first; the first delivered answers the older ones, and the search stops.
 func TestAFailedWalkWalksItsEarlierMergesAlone(t *testing.T) {
 	open := windowed(t)
-	everyHeadWaits(t)
 	asked := asksWithPaths(t)
 	ctx := t.Context()
 	// Made before the cut marks their modules seen, as merges are: walked again, they are news all the same.
@@ -518,7 +459,6 @@ func TestAFailedWalkWalksItsEarlierMergesAlone(t *testing.T) {
 func TestAGroupsOrderBecomesTiersInsideTheWalk(t *testing.T) {
 	for _, grouped := range []bool{true, false} {
 		open := windowed(t)
-		everyHeadWaits(t)
 		asksWithPaths(t)
 		ctx := t.Context()
 		for _, m := range []string{"mesh-host"} {
@@ -556,10 +496,9 @@ func TestAGroupsOrderBecomesTiersInsideTheWalk(t *testing.T) {
 // store, a merge handed over again is not doubled, and the batch is cut when its window closes.
 func TestABatchSurvivesARestart(t *testing.T) {
 	open := windowed(t)
-	groupsWaiting(t, "feat/both")
 	asksWithPaths(t)
-	hear(t, open, fromHead(repoMerge("one", "c1", t0), "feat/both"), t0)
-	hear(t, open, fromHead(repoMerge("two", "c2", t0.Add(30*time.Second)), "feat/both"), t0.Add(30*time.Second))
+	hear(t, open, repoMerge("one", "c1", t0), t0)
+	hear(t, open, repoMerge("two", "c2", t0.Add(30*time.Second)), t0.Add(30*time.Second))
 
 	// A new controller: nothing of the first one's but the store.
 	again, err := openStores(t.Context())
@@ -567,7 +506,7 @@ func TestABatchSurvivesARestart(t *testing.T) {
 		t.Fatal(err)
 	}
 	t.Cleanup(again.Close)
-	hear(t, again, fromHead(repoMerge("one", "c1", t0), "feat/both"), t0.Add(60*time.Second)) // the bus hands it over again
+	hear(t, again, repoMerge("one", "c1", t0), t0.Add(60*time.Second)) // the bus hands it over again
 	cutAt(t, again, t0.Add(119*time.Second))
 	if ws, bs := walks(t, again); len(ws) != 0 || len(bs) != 1 || len(bs[0].Delivery.Merges) != 2 {
 		t.Fatalf("the restarted controller's batch: %d walk(s), %+v", len(ws), bs)
@@ -624,7 +563,6 @@ func TestAWaitingWalkNamesTheMergesItAnswers(t *testing.T) {
 // nothing, and the merge joins the next batch.
 func TestALateMergeOfAOneModuleRepositoryIsNamed(t *testing.T) {
 	open := windowed(t)
-	everyHeadWaits(t)
 	asksWithPaths(t)
 	ctx := t.Context()
 	c2 := repoMerge("one", "c2", t0.Add(-50*time.Second))
@@ -778,7 +716,6 @@ func TestTheCatchUpKeepsWhatACutMadeHistory(t *testing.T) {
 // still waits for the word, so no catalogue delivery skips its turn.
 func TestAMergeOnTheControllersPathNeverSharesABatch(t *testing.T) {
 	open := windowed(t)
-	everyHeadWaits(t)
 	asked := asksWithPaths(t)
 	ctx := t.Context()
 	if err := open.inventory.RegisterModule(ctx, catalogue.Manifest{Module: "mesh-delivery", Version: "1",
@@ -923,7 +860,6 @@ func sameMerge(a, b inventory.PlanMerge) bool {
 // its delivery would skip its turn. It joins the next catalogue batch.
 func TestALateCatalogueMergeIsNotAnsweredByAnOwnPathWalk(t *testing.T) {
 	open := windowed(t)
-	everyHeadWaits(t)
 	asksWithPaths(t)
 	ctx := t.Context()
 	for _, m := range []struct {

cmd/mesh-controller/batches_watch.go

@@ -48,10 +48,6 @@ func gatherBatches(ctx context.Context, inv *inventory.Inventory, now time.Time)
 			if f.atMost.Before(f.closed) {
 				f.closed = f.atMost
 			}
-			if w.Batch.CutAtOnce && !b.Created.IsZero() {
-				// Its window closed when it was made, which is its latest too (ADR 0304 decision 1).
-				f.atMost, f.closed = b.Created, b.Created
-			}
 		}
 		if f.behind != "" {
 			if walk, err := inv.PlanByID(ctx, f.behind); err == nil {

cmd/mesh-controller/delivery.go

@@ -10,7 +10,6 @@ import (
 	"slices"
 	"sort"
 	"strings"
-	"sync"
 	"time"
 
 	"github.com/nats-io/nats.go"
@@ -241,7 +240,7 @@ func stopWalkWithout(ctx context.Context, inv *inventory.Inventory, id, by, why
 		}
 		return p, said, inv.SavePlan(ctx, &p)
 	}
-	target, folded, foldMoves, err := batchToWalkAgain(ctx, inv, p.ID, again, now)
+	target, err := batchToWalkAgain(ctx, inv, again, now)
 	if err != nil {
 		return p, said, fmt.Errorf("%s is not stopped: %w", p.ID, err)
 	}
@@ -262,10 +261,8 @@ func stopWalkWithout(ctx context.Context, inv *inventory.Inventory, id, by, why
 	if len(said.Kept) > 0 {
 		p.Note += "; " + keptWords(said.Kept)
 	}
-	// The batch first, so no merge names a plan the store does not hold; all of it, or nothing (decision 7) — the
-	// batches folded into it too.
-	if err := inv.SavePlansMoving(ctx, append([]*inventory.Plan{&target, &p}, folded...),
-		append(moves, foldMoves...)); err != nil {
+	// The batch first, so no merge names a plan the store does not hold; all of it, or nothing (decision 7).
+	if err := inv.SavePlansMoving(ctx, []*inventory.Plan{&target, &p}, moves); err != nil {
 		return p, said, fmt.Errorf("%s is not stopped, and none of its merges moved: %w", p.ID, err)
 	}
 	// What the batch holds and names now: written again by the cutter's next look should this fail.
@@ -320,42 +317,36 @@ func stopInBatch(ctx context.Context, inv *inventory.Inventory, b *inventory.Pla
 	return nil
 }
 
-// batchToWalkAgain is the batch a stopped walk's merges join (novox/hq ADR 0299): a batch of their kind not yet cut
-// that they are related to (ADR 0304 decision 1, ADR 0306 decision 3), or a new one, not yet written. Related to
-// two or more, the newer are folded into the oldest: the plans and merge moves that fold them, to be written in
-// the stop's one act. The kind is read from what the merges moved; the stopped walk itself is no walk a cut folds.
-func batchToWalkAgain(ctx context.Context, inv *inventory.Inventory, stopping string, again []inventory.BatchedMerge,
-	now time.Time) (inventory.Plan, []*inventory.Plan, []inventory.MergeMove, error) {
+// batchToWalkAgain is the batch a stopped walk's merges join: the open batch of their kind, or a new one, not yet
+// written. The kind is read from what the merges moved.
+func batchToWalkAgain(ctx context.Context, inv *inventory.Inventory, again []inventory.BatchedMerge,
+	now time.Time) (inventory.Plan, error) {
 	own := false
 	for _, n := range movesOf(again) {
 		if _, on := onTheControllersPath[n]; on {
 			own = true
 		}
 	}
-	entries, read, edges, err := theGraph(ctx, inv)
+	batches, err := inv.Batches(ctx)
 	if err != nil {
-		return inventory.Plan{}, nil, nil, err
+		return inventory.Plan{}, err
 	}
-	joins, _, _, err := relatedBatches(ctx, inv, again, own, stopping, entries, read, edges)
-	if err != nil {
-		return inventory.Plan{}, nil, nil, err
-	}
-	if len(joins) > 0 {
-		into := joins[0]
-		if len(joins) == 1 {
-			return into, nil, nil, nil
+	for _, b := range batches {
+		if b.OwnPath() == own {
+			if b.Delivery == nil {
+				b.Delivery = &inventory.PlanDelivery{}
+			}
+			if b.Delivery.Batch == nil {
+				b.Delivery.Batch = &inventory.PlanBatch{Own: own}
+			}
+			return b, nil
 		}
-		plans, moves, err := foldInto(ctx, inv, &into, joins[1:])
-		if err != nil {
-			return inventory.Plan{}, nil, nil, err
-		}
-		return into, plans[1:], moves, nil
 	}
 	first := again[0]
 	return inventory.Plan{ID: fmt.Sprintf("plan-%d", now.UnixNano()), Repository: first.Repository, Branch: first.Branch,
 		Commit: first.Commit, Merged: first.Merged, Created: now, State: inventory.PlanAssembling,
 		Tiers: [][]string{}, Modules: map[string]*inventory.PlanModule{},
-		Delivery: &inventory.PlanDelivery{Batch: &inventory.PlanBatch{Own: own}}}, nil, nil, nil
+		Delivery: &inventory.PlanDelivery{Batch: &inventory.PlanBatch{Own: own}}}, nil
 }
 
 // leaveOut splits a walk's merges by the merges named to leave out, each `<repository>@<commit>` (a commit's
@@ -949,7 +940,7 @@ func deliveryCommand(ctx context.Context, args []string) error {
 		if *group == "" && len(members) == 1 {
 			// One head, checked again as the forge's announcement would have it (a recheck): the controller's
 			// own path for a pull request, run because the delivery's owner asked.
-			if err := sayingOnTheBus(ctx, inv, func() error { return (following{open}).PullUpdated(ctx, members[0].pull()) }); err != nil {
+			if err := sayingOnTheBus(ctx, func() error { return (following{open}).PullUpdated(ctx, members[0].pull()) }); err != nil {
 				return err
 			}
 			return answer(map[string]any{"rechecked": members[0].ID})
@@ -967,7 +958,7 @@ func deliveryCommand(ctx context.Context, args []string) error {
 			return errors.New("delivery go <plan> [--by <who>] [--why <text>]")
 		}
 		var p inventory.Plan
-		if err := sayingOnTheBus(ctx, inv, func() (err error) {
+		if err := sayingOnTheBus(ctx, func() (err error) {
 			p, err = letGo(ctx, inv, positionals[0], *by, strings.TrimSpace(*why))
 			return err
 		}); err != nil {
@@ -982,7 +973,7 @@ func deliveryCommand(ctx context.Context, args []string) error {
 		}
 		var p inventory.Plan
 		var said stopAnswer
-		if err := sayingOnTheBus(ctx, inv, func() (err error) {
+		if err := sayingOnTheBus(ctx, func() (err error) {
 			p, said, err = stopWalkWithout(ctx, inv, positionals[0], *by, strings.TrimSpace(*why), splitList(*without),
 				time.Now().UTC())
 			return err
@@ -1224,19 +1215,15 @@ func shelfOf(entries []inventory.Entry) map[string]catalogue.Manifest {
 // delivery it walks reads its steps from. Never in the way of the walk: said beside it, and a save that could
 // not be said is logged — the delivery's owner, which also asks for the walks it follows, finds it by
 // comparison. Records arriving out of order are told apart by the plan's revision.
-//
-// On the save that starts the walk and the one that ends it, the walk also says what it touches, its bound and,
-// at the end, its outcome (novox/hq ADR 0308 decision 1, walk_said.go), read from facts; nil facts say only what
-// the walk recorded.
-func sayPlanMoved(ctx context.Context, bus link.Bus, facts walkFacts, p inventory.Plan) {
-	go publishPlanMoved(ctx, bus, facts, p)
+func sayPlanMoved(ctx context.Context, bus link.Bus, p inventory.Plan) {
+	go publishPlanMoved(ctx, bus, p)
 }
 
-func publishPlanMoved(ctx context.Context, bus link.Bus, facts walkFacts, p inventory.Plan) {
+func publishPlanMoved(ctx context.Context, bus link.Bus, p inventory.Plan) {
 	// Its phases so far (novox/hq ADR 0282 decision 6): the rest's reports come after the walk ends, and are
 	// read by whoever asks for the walk (`delivery walks`).
 	p.Phases = p.WalkPhases(time.Now(), nil)
-	body, err := json.Marshal(planMovedBody{Plan: p, walkSaid: sayWalk(ctx, facts, p)})
+	body, err := json.Marshal(p)
 	if err != nil {
 		return
 	}
@@ -1251,7 +1238,7 @@ func publishPlanMoved(ctx context.Context, bus link.Bus, facts walkFacts, p inve
 // controller's, or a connection of the command's own — a verb runs as a command of its own, and what it kept
 // would otherwise be said by nobody until the delivery's owner read the walks back. Without a bus the command
 // still runs; what it did is found by comparison.
-func sayingOnTheBus(ctx context.Context, facts walkFacts, f func() error) error {
+func sayingOnTheBus(ctx context.Context, f func() error) error {
 	if checkEvents != nil {
 		return f()
 	}
@@ -1262,10 +1249,9 @@ func sayingOnTheBus(ctx context.Context, facts walkFacts, f func() error) error
 			return err
 		}
 		bus := link.OverNATS{Conn: conn, JS: js}
-		was := inventory.PlanSaved
 		checkEvents = bus
-		inventory.PlanSaved = func(_ *inventory.Inventory, p inventory.Plan) { publishPlanMoved(ctx, bus, facts, p) }
-		defer func() { checkEvents, inventory.PlanSaved = nil, was }()
+		inventory.PlanSaved = func(p inventory.Plan) { publishPlanMoved(ctx, bus, p) }
+		defer func() { checkEvents, inventory.PlanSaved = nil, nil }()
 		ran = true
 		return f()
 	})
@@ -1275,65 +1261,3 @@ func sayingOnTheBus(ctx context.Context, facts walkFacts, f func() error) error
 	}
 	return err
 }
-
-// sayingWhatAVerbKept is PlanSaved for a process that is not the serving controller: each walk the verb keeps is
-// said as `plan-moved` before the save returns, with the facts of the inventory that kept it, on the bus the verb
-// reaches. It reaches the bus on the first save and never for a verb that keeps no walk. When the bus cannot be
-// reached, a save that started or ended a walk says so on the verb's error output: its mark is kept and no later
-// save says it, so the router holds what the walk touched until its bound, or not at all for a start. done lets
-// the bus go and takes the hook back.
-func sayingWhatAVerbKept(ctx context.Context) (said func(*inventory.Inventory, inventory.Plan), done func()) {
-	var (
-		mu      sync.Mutex
-		reached bool
-		bus     link.Bus
-		closing func()
-		failed  error
-	)
-	said = func(inv *inventory.Inventory, p inventory.Plan) {
-		mu.Lock()
-		defer mu.Unlock()
-		if !reached {
-			reached = true
-			if handActConn != nil {
-				bus, failed = overNATS(handActConn)
-			} else if js, err := aBus(); err != nil {
-				failed = err
-			} else if bus, failed = overNATS(js.Conn()); failed == nil {
-				closing = js.Close
-			} else {
-				js.Close()
-			}
-		}
-		if bus == nil {
-			switch p.WalkSaid {
-			case inventory.WalkStarted:
-				fmt.Fprintf(os.Stderr, "%s: its start is kept and could NOT be said as plan-moved (%v): the router "+
-					"does not hold what it touches\n", p.ID, failed)
-			case inventory.WalkEnded:
-				fmt.Fprintf(os.Stderr, "%s: its end is kept and could NOT be said as plan-moved (%v): the router holds "+
-					"what it touched until its bound\n", p.ID, failed)
-			}
-			return
-		}
-		publishPlanMoved(ctx, bus, inv, p)
-	}
-	done = func() {
-		mu.Lock()
-		defer mu.Unlock()
-		inventory.PlanSaved = nil
-		if closing != nil {
-			closing()
-		}
-	}
-	return said, done
-}
-
-// overNATS is the bus a connection carries, with its JetStream.
-func overNATS(conn *nats.Conn) (link.Bus, error) {
-	js, err := conn.JetStream()
-	if err != nil {
-		return nil, err
-	}
-	return link.OverNATS{Conn: conn, JS: js}, nil
-}

cmd/mesh-controller/delivery_conditions.go

@@ -47,14 +47,10 @@ type stalledLine struct {
 	// issue 443): a time inside a finished sentence cannot be said again in another zone. A mesh-delivery from before
 	// says none, and Waiting is said as it reads.
 	Checks []waitingCheck `json:"checks,omitempty"`
-	// Held is the state of the delivery of a line of the state `unanswered`, ready or rejected, when one is held
-	// (novox/hq issues 441, 451): its check answered once, so a recheck is the step. Empty for a head with no
-	// delivery, and from a mesh-delivery that does not say it yet; the words are never read for it.
-	Held  string `json:"held,omitempty"`
-	For   string `json:"for"`
-	Bound string `json:"bound"`
-	H2    string `json:"h2"`
-	Says  string `json:"says"`
+	For    string         `json:"for"`
+	Bound  string         `json:"bound"`
+	H2     string         `json:"h2"`
+	Says   string         `json:"says"`
 }
 
 // waitingCheck is one merge check a stalled line waits on, as mesh-delivery gives it: its context, its state —

cmd/mesh-controller/delivery_order_test.go

@@ -119,13 +119,6 @@ func TestTheBusMachineIsBehindByItsUserListAlone(t *testing.T) {
 	if userListBehind("", "") {
 		t.Fatal("a machine sent no list reads as behind")
 	}
-	// A list that could not be composed is behind: not known is never "not behind" (the review of hq issue 353).
-	if !listBehind("", errors.New("the plan cannot be worked out"), digestOf([]byte(list))) {
-		t.Fatal("a list nobody could compose reads as current")
-	}
-	if listBehind(list, nil, digestOf([]byte(list))) || !listBehind(list, nil, "") {
-		t.Fatal("listBehind does not read the digest as userListBehind does")
-	}
 }
 
 // The machine holding the bus goes first: its declaration carries the user list the new grants are

cmd/mesh-controller/group_wait.go

@@ -1,158 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"strings"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/catalogue"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// **A delivery group still assembles** (novox/hq ADR 0306 decision 2): a merge whose delivery group has a member
-// not yet merged waits for the merge window, whether or not a batch is assembling, so the group's members walk in
-// one batch, in their order (ADR 0276 decision 5). Which groups exist and where each member stands is
-// mesh-delivery's record (ADR 0239): a group is the pull requests of two repositories or more sharing a head
-// branch name, which is its id. The controller asks it, through its `groups` verb, when a merge from a head is
-// heard; a member whose pull request is open (proposed, checked, ready or rejected) is still to merge. When
-// mesh-delivery does not answer within groupAskWithin, or answers something unreadable, the merge waits: the safe
-// error is to wait, and its batch says why.
-
-// groupAskWithin is how long mesh-delivery is given to say a merge's group, while the merge is being heard.
-var groupAskWithin = 3 * time.Second
-
-// openPullStates are the states of a delivery whose pull request is open and not merged (mesh-delivery's table):
-// a member in one of them is still to merge. Closed unmerged is stopped, final, and waits for nothing.
-var openPullStates = map[string]bool{"proposed": true, "checked": true, "ready": true, "rejected": true}
-
-// groupMember is one member of a delivery group as mesh-delivery's `groups` says it: `<owner/repo>@<commit> (state)`.
-type groupMember struct {
-	Repository, State string
-}
-
-// deliveryGroupOf is what mesh-delivery says of the group a head names: its members, and whether the head names a
-// group at all; an error when it cannot be asked or did not answer. A seam a test replaces.
-var deliveryGroupOf = func(ctx context.Context, held bool, head string) ([]groupMember, bool, error) {
-	if !held {
-		return nil, false, fmt.Errorf("no holder of %s is on record to say it", catalogue.DeliverySeat)
-	}
-	serving := servingBus.Load()
-	if serving == nil {
-		return nil, false, errors.New("this controller is not on the bus")
-	}
-	asking, cancel := context.WithTimeout(ctx, groupAskWithin)
-	defer cancel()
-	raw, err := askDeliveryOwner(asking, serving.Conn(), "groups", map[string]any{})
-	if err != nil {
-		if errors.Is(err, link.ErrNothingServes) {
-			return nil, false, fmt.Errorf("nothing serves %s.groups", catalogue.DeliverySeat)
-		}
-		return nil, false, err
-	}
-	var lines []struct {
-		ID      string   `json:"id"`
-		Members []string `json:"members"`
-	}
-	if err := json.Unmarshal(raw, &lines); err != nil {
-		return nil, false, fmt.Errorf("%s.groups answered something unreadable: %w", catalogue.DeliverySeat, err)
-	}
-	for _, l := range lines {
-		if l.ID != head {
-			continue
-		}
-		var members []groupMember
-		for _, s := range l.Members {
-			members = append(members, memberOf(s))
-		}
-		return members, true, nil
-	}
-	return nil, false, nil
-}
-
-// memberOf reads one member as `groups` says it: `novox/mesh-sdk@d41d255f28ad (held)`.
-func memberOf(s string) groupMember {
-	id, state := strings.TrimSpace(s), ""
-	if i := strings.LastIndex(id, " ("); i >= 0 && strings.HasSuffix(id, ")") {
-		id, state = id[:i], id[i+2:len(id)-1]
-	}
-	repository, _, _ := strings.Cut(id, "@")
-	return groupMember{Repository: repository, State: state}
-}
-
-// groupWait says whether a merge heard now waits for the window for its delivery group, and why in words; nothing
-// when it names no head, its head names no group, or every other member is merged or closed. own is the merge's
-// kind (ownPath).
-//
-// A member of another repository whose merge this controller already keeps in a batch not yet cut of the same
-// kind is merged, whatever mesh-delivery says yet (it marks a member merged once its walk opened): the merge joins
-// that batch by their head. One kept in a batch of the other kind keeps the merge waiting, whatever mesh-delivery
-// says (review of #250): kinds never share a batch, so the merge's batch is a new one, and cut at once it would
-// walk before that member's batch is cut and break the group's order (ADR 0276 decision 5). Waiting, the two
-// batches are cut in the order their windows close, an own-path one first at one look, as cutBatchesHeld cuts
-// every pair of kinds.
-//
-// Asked before the plans are held: a slow answer holds up no walk.
-func groupWait(ctx context.Context, inv *inventory.Inventory, m link.SourceMoved, held, own bool) (string, error) {
-	if m.Head == "" {
-		return "", nil
-	}
-	same, other, err := keptFromHead(ctx, inv, m.Head, own)
-	if err != nil {
-		return "", err
-	}
-	if len(other) > 0 {
-		return "group " + m.Head + " has a member waiting in a batch of the other kind: " + strings.Join(other, ", "), nil
-	}
-	members, isGroup, err := deliveryGroupOf(ctx, held, m.Head)
-	if err != nil {
-		return fmt.Sprintf("%s did not say whether group %s has a member still to merge (%v): it waits for the "+
-			"window, the safe side", catalogue.DeliverySeat, m.Head, err), nil
-	}
-	if !isGroup {
-		return "", nil
-	}
-	var open []string
-	for _, g := range members {
-		if strings.EqualFold(g.Repository, m.Owner+"/"+m.Repo) || same[strings.ToLower(g.Repository)] ||
-			!openPullStates[g.State] {
-			continue
-		}
-		open = append(open, g.Repository+" ("+g.State+")")
-	}
-	if len(open) == 0 {
-		return "", nil
-	}
-	return "group " + m.Head + " has a member still to merge: " + strings.Join(open, ", "), nil
-}
-
-// keptFromHead are the merges from a head that batches not yet cut hold: the repositories (lower case) of those in
-// a batch of the kind own says, and, in words, each of the other kind with its batch.
-func keptFromHead(ctx context.Context, inv *inventory.Inventory, head string, own bool) (map[string]bool, []string, error) {
-	batches, err := inv.Batches(ctx)
-	if err != nil {
-		return nil, nil, err
-	}
-	same := map[string]bool{}
-	var other []string
-	for _, b := range batches {
-		merges, err := inv.MergesOf(ctx, b.ID)
-		if err != nil {
-			return nil, nil, err
-		}
-		for _, k := range merges {
-			if announcedOf(k).Head != head {
-				continue
-			}
-			if b.OwnPath() == own {
-				same[strings.ToLower(k.Repository)] = true
-			} else {
-				other = append(other, fmt.Sprintf("%s@%s in %s", k.Repository, short(k.Commit), b.ID))
-			}
-		}
-	}
-	return same, other, nil
-}

cmd/mesh-controller/handover_test.go

@@ -167,54 +167,3 @@ func TestASetuidSearchAsksOnlyAKnownNodeAndFailsOnARefusal(t *testing.T) {
 		t.Fatalf("a start: %v, printed %q", err, out.String())
 	}
 }
-
-// The directory judgement's line asks only a known node, one name and nothing else, fails on a refusal, and says it
-// changed nothing (novox/hq issue 358).
-func TestADirectoryJudgementAsksOnlyAKnownNodeAndSaysItIsReadOnly(t *testing.T) {
-	t.Setenv(link.CallerVar, "jo through mesh-cli on anchor")
-	asked := 0
-	ask := func(answer link.HandOverAnswer) func(node, by string) (link.HandOverAnswer, error) {
-		return func(node, by string) (link.HandOverAnswer, error) {
-			asked++
-			if node != "novox" || by != "jo through mesh-cli on anchor" {
-				t.Fatalf("asked %q %q", node, by)
-			}
-			return answer, nil
-		}
-	}
-	known := func(string) error { return nil }
-	var out bytes.Buffer
-	for _, args := range [][]string{nil, {"novox", "extra"}, {"-x"}} {
-		if err := judgeDirectoriesAsked(args, known, ask(link.HandOverAnswer{Said: "x"}), &out); err == nil || asked != 0 {
-			t.Fatalf("%v was asked: %v", args, err)
-		}
-	}
-	if err := judgeDirectoriesAsked([]string{"novox"}, func(string) error { return errors.New("no node called novox") },
-		ask(link.HandOverAnswer{Said: "x"}), &out); err == nil || asked != 0 {
-		t.Fatalf("an unknown node: %v", err)
-	}
-	if err := judgeDirectoriesAsked([]string{"novox"}, known, ask(link.HandOverAnswer{Refused: "no; nothing was judged"}),
-		&out); err == nil || !strings.Contains(err.Error(), "novox refused") || out.Len() != 0 {
-		t.Fatalf("a refusal: %v, printed %q", err, out.String())
-	}
-	said := "2 directories declared: 1 placed, 1 would be refused\n/var/lib/a: placed\n/var/lib/b: would be refused: …"
-	if err := judgeDirectoriesAsked([]string{"novox"}, known, ask(link.HandOverAnswer{Said: said}), &out); err != nil ||
-		out.String() != "novox (read-only: nothing on novox was changed)\n"+said+"\n" {
-		t.Fatalf("a judgement: %v, printed %q", err, out.String())
-	}
-}
-
-// The judgement is a seat verb an agent may call — it reads, and changes nothing on the node — and runs exactly
-// `node judge-directories <node>` (novox/hq issue 358).
-func TestTheDirectoryJudgementIsAVerbThatOnlyReads(t *testing.T) {
-	argv, err := argvFor("judge-directories", map[string]any{"node": "novox"})
-	if err != nil || strings.Join(argv, " ") != "node judge-directories novox" {
-		t.Fatalf("the verb runs %v, %v", argv, err)
-	}
-	if _, err := argvFor("judge-directories", map[string]any{}); err == nil {
-		t.Fatal("the verb ran with no node")
-	}
-	if !readingVerbs["judge-directories"] {
-		t.Fatal("the judgement is not counted a reading verb")
-	}
-}

cmd/mesh-controller/issue459_test.go

@@ -123,12 +123,11 @@ func TestDeliveryStopTakesTheMergesToLeaveOut(t *testing.T) {
 // that builds the other repository's module alone.
 func TestAStopWithoutAMergeWalksTheOthersAgain(t *testing.T) {
 	open := windowed(t)
-	groupsWaiting(t, "pr/cat1aaaaaaaa")
 	endsItsLine(t)
 	asksRecorded(t)
 	ctx := t.Context()
 	cat := catalogueMerge("cat1aaaaaaaa", "app", t0)
-	one := fromHead(repoMerge("one", "one1bbbbbbbb", t0.Add(5*time.Second)), cat.Head)
+	one := repoMerge("one", "one1bbbbbbbb", t0.Add(5*time.Second))
 	hear(t, open, cat, t0.Add(time.Second))
 	hear(t, open, one, t0.Add(6*time.Second))
 	cutAt(t, open, t0.Add(2*time.Minute))
@@ -182,13 +181,12 @@ func TestAStopWithoutAMergeWalksTheOthersAgain(t *testing.T) {
 // ended. A merge the walk does not answer is refused, and nothing ends.
 func TestAStopWithoutAMergeEndsTheMergesThatContainIt(t *testing.T) {
 	open := windowed(t)
-	groupsWaiting(t, "pr/cat1aaaaaaaa")
 	endsItsLine(t)
 	asksRecorded(t)
 	ctx := t.Context()
 	first := catalogueMerge("cat1aaaaaaaa", "app", t0)
 	later := catalogueMerge("cat2cccccccc", "notes", t0.Add(10*time.Second))
-	one := fromHead(repoMerge("one", "one1bbbbbbbb", t0.Add(5*time.Second)), first.Head)
+	one := repoMerge("one", "one1bbbbbbbb", t0.Add(5*time.Second))
 	hear(t, open, first, t0.Add(time.Second))
 	hear(t, open, one, t0.Add(6*time.Second))
 	hear(t, open, later, t0.Add(11*time.Second))
@@ -240,12 +238,11 @@ func TestAStopWithoutAMergeEndsTheMergesThatContainIt(t *testing.T) {
 // (review of #232): its window closes, and its walk is at the newer commit, answering both.
 func TestAStopWalksTheOthersAgainInTheOpenBatch(t *testing.T) {
 	open := windowed(t)
-	groupsWaiting(t, "pr/cat1aaaaaaaa")
 	endsItsLine(t)
 	asksRecorded(t)
 	ctx := t.Context()
 	cat := catalogueMerge("cat1aaaaaaaa", "app", t0)
-	one1 := fromHead(repoMerge("one", "one1bbbbbbbb", t0.Add(5*time.Second)), cat.Head)
+	one1 := repoMerge("one", "one1bbbbbbbb", t0.Add(5*time.Second))
 	hear(t, open, cat, t0.Add(time.Second))
 	hear(t, open, one1, t0.Add(6*time.Second))
 	cutAt(t, open, t0.Add(2*time.Minute))
@@ -293,12 +290,11 @@ func TestAStopWalksTheOthersAgainInTheOpenBatch(t *testing.T) {
 // that walked its merges again is refused a retry, saying why.
 func TestAStopNamesWhatStaysOnTheMachinesAndWhatStillCarriesIt(t *testing.T) {
 	open := windowed(t)
-	groupsWaiting(t, "pr/cat1aaaaaaaa")
 	endsItsLine(t)
 	asksRecorded(t)
 	ctx := t.Context()
 	cat := catalogueMerge("cat1aaaaaaaa", "app", t0)
-	one1 := fromHead(repoMerge("one", "one1bbbbbbbb", t0.Add(5*time.Second)), cat.Head)
+	one1 := repoMerge("one", "one1bbbbbbbb", t0.Add(5*time.Second))
 	hear(t, open, cat, t0.Add(time.Second))
 	hear(t, open, one1, t0.Add(6*time.Second))
 	cutAt(t, open, t0.Add(2*time.Minute))
@@ -339,12 +335,11 @@ func TestAStopNamesWhatStaysOnTheMachinesAndWhatStillCarriesIt(t *testing.T) {
 // with the others and withholds the stopped merge's modules; with every merge left out, the batch is stopped.
 func TestAStopWithoutAMergeLeavesItOutOfABatch(t *testing.T) {
 	open := windowed(t)
-	everyHeadWaits(t)
 	endsItsLine(t)
 	asksRecorded(t)
 	ctx := t.Context()
 	cat := catalogueMerge("cat1aaaaaaaa", "app", t0)
-	one := fromHead(repoMerge("one", "one1bbbbbbbb", t0.Add(5*time.Second)), cat.Head)
+	one := repoMerge("one", "one1bbbbbbbb", t0.Add(5*time.Second))
 	hear(t, open, cat, t0.Add(time.Second))
 	hear(t, open, one, t0.Add(6*time.Second))
 	_, bs := walks(t, open)
@@ -387,7 +382,6 @@ func TestAStopWithoutAMergeLeavesItOutOfABatch(t *testing.T) {
 // else since it was read refuses all of it, and no merge moves, no plan is written.
 func TestSavingPlansAndMovingMergesIsOneAct(t *testing.T) {
 	open := windowed(t)
-	everyHeadWaits(t)
 	endsItsLine(t)
 	ctx := t.Context()
 	hear(t, open, catalogueMerge("cat1aaaaaaaa", "app", t0), t0.Add(time.Second))

cmd/mesh-controller/lone_merge_test.go

@@ -1,398 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/catalogue"
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// The tests of novox/hq issue 525's window skip: a merge waits for the merge window only when a batch assembling
-// holds a merge related to it, or its delivery group may have a member still to merge (ADR 0304 decision 1, ADR
-// 0306 decisions 2 and 3). Walks stay one at a time.
-
-// A merge from no head that shares nothing, with no walk open, is cut into its walk when it is heard: no window.
-func TestALoneMergeSharingNothingIsCutAtOnce(t *testing.T) {
-	open := windowed(t)
-	asksWithPaths(t)
-	hear(t, open, lone(repoMerge("one", "c1", t0)), t0)
-	ws, bs := walks(t, open)
-	if len(ws) != 1 || len(bs) != 0 || !ws[0].Open() || ws[0].Commit != "c1" {
-		t.Fatalf("a lone merge sharing nothing: %d walk(s) %+v, %d batch(es)", len(ws), ws, len(bs))
-	}
-	if ws[0].Times == nil || ws[0].Times.WindowClosed == nil || !ws[0].Times.WindowClosed.Equal(t0) {
-		t.Fatalf("its window closed at %+v; want when it was heard, %s", ws[0].Times, t0)
-	}
-}
-
-// A merge related to the batch assembling joins it and waits for the window, which its coming restarts: by its
-// repository, by a module in common (a dependent of what the batch moves), by an edge of the module graph between
-// their modules (one that widens nothing), or by its delivery group's head.
-func TestARelatedMergeJoinsTheBatchAndWaitsForTheWindow(t *testing.T) {
-	ctx := t.Context()
-	for _, c := range []string{"same repository", "a module in common", "an edge of the graph", "the same group head"} {
-		t.Run(c, func(t *testing.T) {
-			open := windowed(t)
-			groupsWaiting(t, "pr/c1")
-			asksWithPaths(t)
-			inv := open.inventory
-			first := repoMerge("one", "c1", t0)
-			second := lone(repoMerge("two", "c2", t0.Add(10*time.Second)))
-			why := map[string]string{"same repository": "both change novox/one", "a module in common": "both move two",
-				"an edge of the graph": "two depends on builder (built-by)",
-				"the same group head":  "both are members of group " + first.Head}[c]
-			switch c {
-			case "same repository":
-				second = lone(repoMerge("one", "c2", t0.Add(10*time.Second)))
-			case "a module in common":
-				// two is built on one: a merge of one moves two too.
-				if err := inv.RegisterModule(ctx, catalogue.Manifest{Module: "two", Version: "1",
-					Build: &catalogue.Build{On: []catalogue.BuildsOn{{Arg: "BASE", Module: "one"}}}},
-					inventory.Source{Repository: "novox/two", Seat: "git", Ref: "main", BuiltFrom: "c0", Head: "c0"}); err != nil {
-					t.Fatal(err)
-				}
-			case "an edge of the graph":
-				// two is built by the build machine: an edge that orders and widens nothing.
-				if err := inv.RegisterModule(ctx, catalogue.Manifest{Module: "builder", Version: "1",
-					Claims: []catalogue.Claim{{Name: "mesh-build-machine", Scope: catalogue.ScopeMesh}}},
-					inventory.Source{Repository: "novox/builder", Seat: "git", Ref: "main", BuiltFrom: "c0", Head: "c0"}); err != nil {
-					t.Fatal(err)
-				}
-				first = repoMerge("builder", "c1", t0)
-			case "the same group head":
-				second = fromHead(repoMerge("two", "c2", t0.Add(10*time.Second)), first.Head)
-			}
-			hear(t, open, first, t0)
-			said := captured(t, func() error {
-				return (following{open: open}).hearMerge(ctx, second, t0.Add(10*time.Second))
-			})
-			if !strings.Contains(said, "("+why+")") {
-				t.Fatalf("the merge was not said related by %q: %s", why, said)
-			}
-			ws, bs := walks(t, open)
-			if len(ws) != 0 || len(bs) != 1 || len(bs[0].Delivery.Merges) != 2 {
-				t.Fatalf("the related merge: %d walk(s), batches %+v", len(ws), bs)
-			}
-			if bs[0].Delivery.Batch.CutAtOnce {
-				t.Fatal("a batch a related merge joined is cut at once")
-			}
-			cutAt(t, open, t0.Add(99*time.Second))
-			if ws, _ := walks(t, open); len(ws) != 0 {
-				t.Fatalf("cut before the window the related merge restarted closed: %+v", ws)
-			}
-			cutAt(t, open, t0.Add(100*time.Second))
-			ws, bs = walks(t, open)
-			if len(ws) != 1 || len(bs) != 0 || len(ws[0].Delivery.Merges) != 2 {
-				t.Fatalf("after the window: %d walk(s), %d batch(es)", len(ws), len(bs))
-			}
-		})
-	}
-}
-
-// A merge from a head whose delivery group has a member still to merge waits for the window, even with no batch
-// assembling, and says why; its sibling joins the same batch by their head (ADR 0306 decision 2). A merge from a
-// head that names no group shares nothing and is cut at once, as one from no head is.
-func TestAMergeOfAGroupWaitsEvenAlone(t *testing.T) {
-	open := windowed(t)
-	asksWithPaths(t)
-	groupsWaiting(t, "feat/x")
-	hear(t, open, fromHead(repoMerge("one", "c1", t0), "feat/x"), t0)
-	ws, bs := walks(t, open)
-	if len(ws) != 0 || len(bs) != 1 || bs[0].Delivery.Batch.CutAtOnce || windowClosed(bs[0], t0) {
-		t.Fatalf("a group's merge alone: %d walk(s), batches %+v", len(ws), bs)
-	}
-	if words := batchWords(bs[0], t0); !strings.HasPrefix(words, "assembling: 90 s left") ||
-		!strings.Contains(words, "group feat/x has a member still to merge: novox/elsewhere (ready)") {
-		t.Fatalf("it reads %q", words)
-	}
-	hear(t, open, fromHead(repoMerge("two", "c2", t0.Add(5*time.Second)), "feat/x"), t0.Add(5*time.Second))
-	if _, bs := walks(t, open); len(bs) != 1 || len(bs[0].Delivery.Merges) != 2 {
-		t.Fatalf("the group's second member did not join the first: %+v", bs)
-	}
-	cutAt(t, open, t0.Add(94*time.Second))
-	if ws, _ := walks(t, open); len(ws) != 0 {
-		t.Fatalf("cut before its window closed: %+v", ws)
-	}
-	cutAt(t, open, t0.Add(95*time.Second))
-	ws, bs = walks(t, open)
-	if len(ws) != 1 || len(bs) != 0 || ws[0].CommitOf("novox/one") != "c1" || ws[0].CommitOf("novox/two") != "c2" {
-		t.Fatalf("at its window: %d walk(s) %+v, %d batch(es)", len(ws), ws, len(bs))
-	}
-}
-
-// A merge from a head that names no group, sharing nothing, with no walk open, is cut at once.
-func TestAHeadedMergeInNoGroupIsCutAtOnce(t *testing.T) {
-	open := windowed(t)
-	asksWithPaths(t)
-	hear(t, open, fromHead(repoMerge("one", "c1", t0), "fix/alone"), t0)
-	if ws, bs := walks(t, open); len(ws) != 1 || len(bs) != 0 || !ws[0].Open() {
-		t.Fatalf("a headed merge in no group: %d walk(s), %d batch(es)", len(ws), len(bs))
-	}
-}
-
-// When mesh-delivery cannot say a head's group, the merge waits for the window, the safe side, and its batch says
-// why.
-func TestAGroupNobodyCanSayWaits(t *testing.T) {
-	open := windowed(t)
-	asksWithPaths(t)
-	was := deliveryGroupOf
-	deliveryGroupOf = func(context.Context, bool, string) ([]groupMember, bool, error) {
-		return nil, false, errors.New("nothing serves mesh-delivery.groups")
-	}
-	t.Cleanup(func() { deliveryGroupOf = was })
-	hear(t, open, fromHead(repoMerge("one", "c1", t0), "feat/x"), t0)
-	ws, bs := walks(t, open)
-	if len(ws) != 0 || len(bs) != 1 || bs[0].Delivery.Batch.CutAtOnce {
-		t.Fatalf("a merge whose group nobody could say: %d walk(s), batches %+v", len(ws), bs)
-	}
-	if words := batchWords(bs[0], t0); !strings.Contains(words, "mesh-delivery did not say whether group feat/x has a "+
-		"member still to merge (nothing serves mesh-delivery.groups): it waits for the window, the safe side") {
-		t.Fatalf("it reads %q", words)
-	}
-}
-
-// A member counts as still to merge only while its pull request is open, and not once this controller keeps its
-// merge: a group whose other members are merged or closed makes nobody wait.
-func TestAGroupsMergedOrClosedMembersMakeNobodyWait(t *testing.T) {
-	open := windowed(t)
-	asksWithPaths(t)
-	ctx := t.Context()
-	members := []groupMember{{Repository: "novox/one", State: "ready"}, {Repository: "novox/two", State: "published"},
-		{Repository: "novox/three", State: "stopped"}}
-	was := deliveryGroupOf
-	deliveryGroupOf = func(context.Context, bool, string) ([]groupMember, bool, error) { return members, true, nil }
-	t.Cleanup(func() { deliveryGroupOf = was })
-	m := fromHead(repoMerge("one", "c1", t0), "feat/x")
-	if why, err := groupWait(ctx, open.inventory, m, true, false); err != nil || why != "" {
-		t.Fatalf("the group's other members are merged or closed, yet: %q %v", why, err)
-	}
-	members = append(members, groupMember{Repository: "novox/four", State: "checked"})
-	if why, _ := groupWait(ctx, open.inventory, m, true, false); !strings.Contains(why, "novox/four (checked)") {
-		t.Fatalf("an open member: %q", why)
-	}
-	// novox/four's merge is kept in a batch already: merged, whatever mesh-delivery says yet.
-	hear(t, open, fromHead(repoMerge("two", "c4", t0), "feat/x"), t0)
-	members[3].Repository = "novox/two"
-	if why, _ := groupWait(ctx, open.inventory, m, true, false); why != "" {
-		t.Fatalf("a member this controller keeps the merge of still waits: %q", why)
-	}
-	if got := memberOf("novox/mesh-sdk@d41d255f28ad (held)"); got != (groupMember{Repository: "novox/mesh-sdk", State: "held"}) {
-		t.Fatalf("a member reads %+v", got)
-	}
-}
-
-// A merge related to two batches assembling folds the newer into the older, which answers every merge of both
-// and names nothing twice; the folded one names the batch that took it over.
-func TestAMergeRelatedToTwoBatchesFoldsThem(t *testing.T) {
-	open := windowed(t)
-	groupsWaiting(t, "feat/a", "feat/b")
-	asksWithPaths(t)
-	ctx := t.Context()
-	hear(t, open, fromHead(repoMerge("one", "c1", t0), "feat/a"), t0)
-	hear(t, open, fromHead(repoMerge("two", "c2", t0.Add(5*time.Second)), "feat/b"), t0.Add(5*time.Second))
-	_, bs := walks(t, open)
-	if len(bs) != 2 {
-		t.Fatalf("two merges sharing nothing: %d batch(es)", len(bs))
-	}
-	older, newer := bs[1], bs[0] // newest first
-	// Of one's repository and from two's head: related to both.
-	hear(t, open, fromHead(repoMerge("one", "c3", t0.Add(10*time.Second)), "feat/b"), t0.Add(10*time.Second))
-	_, bs = walks(t, open)
-	if len(bs) != 1 || bs[0].ID != older.ID || len(bs[0].Delivery.Merges) != 3 {
-		t.Fatalf("after a merge related to both: batches %+v; want %s answering three merges", bs, older.ID)
-	}
-	folded, err := open.inventory.PlanByID(ctx, newer.ID)
-	if err != nil || folded.State != inventory.PlanSuperseded || folded.Delivery == nil ||
-		folded.Delivery.TakenOverBy != older.ID {
-		t.Fatalf("the newer batch reads %s %+v (%v)", folded.State, folded.Delivery, err)
-	}
-	if left, _ := open.inventory.MergesOf(ctx, newer.ID); len(left) != 0 {
-		t.Fatalf("the folded batch still answers %+v", left)
-	}
-	cutAt(t, open, t0.Add(100*time.Second))
-	ws, bs := walks(t, open)
-	var cut []inventory.Plan
-	for _, w := range ws {
-		if w.State != inventory.PlanSuperseded {
-			cut = append(cut, w)
-		}
-	}
-	if len(cut) != 1 || len(bs) != 0 || cut[0].ID != older.ID || cut[0].CommitOf("novox/one") != "c3" ||
-		cut[0].CommitOf("novox/two") != "c2" {
-		t.Fatalf("the folded batch's walk: %+v, %d batch(es)", cut, len(bs))
-	}
-}
-
-// With a walk open, a batch cut at once still waits for it, said queued behind it (walks stay one at a time, ADR
-// 0276 decision 4); it is cut once that walk ended, with no window to wait for.
-func TestACutAtOnceBatchQueuesBehindAnOpenWalk(t *testing.T) {
-	open := windowed(t)
-	groupsWaiting(t, "pr/c1")
-	asksWithPaths(t)
-	hear(t, open, repoMerge("one", "c1", t0), t0)
-	cutAt(t, open, t0.Add(90*time.Second))
-	ws, _ := walks(t, open)
-	if len(ws) != 1 || !ws[0].Open() {
-		t.Fatalf("no walk open: %+v", ws)
-	}
-	first := ws[0]
-	heard := t0.Add(100 * time.Second)
-	hear(t, open, lone(repoMerge("two", "c2", heard)), heard)
-	ws, bs := walks(t, open)
-	if len(ws) != 1 || len(bs) != 1 || bs[0].State != inventory.PlanQueued || bs[0].Delivery.Batch.Behind != first.ID ||
-		!bs[0].Delivery.Batch.CutAtOnce {
-		t.Fatalf("a lone merge during a walk: %d walk(s), batches %+v", len(ws), bs)
-	}
-	if !strings.HasPrefix(batchWords(bs[0], heard), "queued behind "+first.ID) {
-		t.Fatalf("it reads %q", batchWords(bs[0], heard))
-	}
-	first.State = inventory.PlanDone
-	if err := open.inventory.SavePlan(t.Context(), &first); err != nil {
-		t.Fatal(err)
-	}
-	cutAt(t, open, heard.Add(time.Second))
-	ws, bs = walks(t, open)
-	if len(ws) != 2 || len(bs) != 0 || ws[0].Commit != "c2" {
-		t.Fatalf("the queued batch was not cut once the walk ended: %+v %+v", ws, bs)
-	}
-	if ws[0].Times == nil || ws[0].Times.WindowClosed == nil || !ws[0].Times.WindowClosed.Equal(heard) {
-		t.Fatalf("its window closed at %+v; want when its merge was heard, %s", ws[0].Times, heard)
-	}
-}
-
-// A stopped walk's other merges are walked again in a batch they are related to, and a batch of their own when
-// they share nothing with the one assembling (ADR 0299, ADR 0304 decision 1): never in a batch of another
-// change, whose window the stop would close.
-func TestAStopWalksTheOthersAgainInABatchOfTheirOwnWhenTheyShareNothing(t *testing.T) {
-	open := windowed(t)
-	groupsWaiting(t, "pr/cat1aaaaaaaa")
-	endsItsLine(t)
-	asksRecorded(t)
-	ctx := t.Context()
-	cat := catalogueMerge("cat1aaaaaaaa", "app", t0)
-	one := fromHead(repoMerge("one", "one1bbbbbbbb", t0.Add(5*time.Second)), cat.Head)
-	hear(t, open, cat, t0.Add(time.Second))
-	hear(t, open, one, t0.Add(6*time.Second))
-	cutAt(t, open, t0.Add(2*time.Minute))
-	ws, _ := walks(t, open)
-	walk := ws[0]
-	hear(t, open, repoMerge("two", "two1cccccccc", t0.Add(3*time.Minute)), t0.Add(3*time.Minute))
-	_, bs := walks(t, open)
-	if len(bs) != 1 {
-		t.Fatalf("the merge heard while the walk ran is in %d batches", len(bs))
-	}
-	other := bs[0]
-	_, said, err := stopWalkWithout(ctx, open.inventory, walk.ID, "mesh-delivery for jochen", "its group stopped",
-		[]string{"novox/mesh-catalog@" + cat.Commit}, t0.Add(3*time.Minute+10*time.Second))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if said.WalkedAgainBy == "" || said.WalkedAgainBy == other.ID {
-		t.Fatalf("walked again by %q; want a batch of its own, not %s", said.WalkedAgainBy, other.ID)
-	}
-	b, _ := open.inventory.PlanByID(ctx, other.ID)
-	if b.Delivery.Batch == nil || b.Delivery.Batch.Closed || len(b.Delivery.Merges) != 1 {
-		t.Fatalf("the other change's batch reads %+v; want it untouched by the stop", b.Delivery)
-	}
-}
-
-// A catalogue batch's cut folds in every walk waiting for its delivery's word (cutBatch's carry), so what that
-// walk moves is the batch's too: a lone merge related to the waiting walk joins the batch assembling and waits for
-// its window, rather than being cut at once as sharing nothing with what the batch's own merges move.
-func TestALoneMergeRelatedToAWalkTheCutFoldsJoinsTheBatch(t *testing.T) {
-	open := windowed(t)
-	groupsWaiting(t, "pr/c3")
-	asksWithPaths(t)
-	ctx := t.Context()
-	if err := open.inventory.RegisterModule(ctx, catalogue.Manifest{Module: "mesh-delivery", Version: "1",
-		Claims: []catalogue.Claim{{Name: catalogue.DeliverySeat, Scope: catalogue.ScopeMesh}}},
-		inventory.Source{Repository: "novox/mesh-catalog", Seat: "git", Path: "modules/mesh-delivery", Ref: "main",
-			BuiltFrom: "c0", Head: "c0"}); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := open.inventory.Assign(ctx, "anchor", "mesh-delivery"); err != nil {
-		t.Fatal(err)
-	}
-	hear(t, open, repoMerge("one", "c1", t0), t0)
-	cutAt(t, open, t0.Add(90*time.Second))
-	if ws, _ := walks(t, open); len(ws) != 1 || !ws[0].Waiting() {
-		t.Fatalf("the walk does not wait for its word: %+v", ws)
-	}
-	hear(t, open, repoMerge("three", "c3", t0.Add(2*time.Minute)), t0.Add(2*time.Minute))
-	hear(t, open, lone(repoMerge("one", "c2", t0.Add(2*time.Minute+5*time.Second))), t0.Add(2*time.Minute+5*time.Second))
-	_, bs := walks(t, open)
-	if len(bs) != 1 || len(bs[0].Delivery.Merges) != 2 || bs[0].Delivery.Batch.CutAtOnce {
-		t.Fatalf("a lone merge related to the waiting walk: batches %+v", bs)
-	}
-}
-
-// A delivery group with a member of each kind (review of #250): a merge on the controller's own path and a
-// catalogue merge never share a batch, so the later member cannot join the earlier one's. Kept in a batch of the
-// other kind, the earlier member keeps the later one waiting, whatever mesh-delivery says yet — never cut at once
-// to walk before it. The two batches are then cut in the order their windows close (cutBatchesHeld: the oldest
-// closed batch first, an own-path one first at one look, and the other queued behind a walk that started): the
-// earlier member's window closes first, so it walks first, in both orders.
-func TestAGroupAcrossBothKindsKeepsItsOrder(t *testing.T) {
-	for _, ownFirst := range []bool{true, false} {
-		name := "catalogue member first"
-		if ownFirst {
-			name = "controller member first"
-		}
-		t.Run(name, func(t *testing.T) {
-			open := windowed(t)
-			asksWithPaths(t)
-			ctx := t.Context()
-			was := deliveryGroupOf
-			// mesh-delivery still says both members ready: it marks one merged only once its walk opened.
-			deliveryGroupOf = func(context.Context, bool, string) ([]groupMember, bool, error) {
-				return []groupMember{{Repository: "novox/mesh-controller", State: "ready"},
-					{Repository: "novox/mesh-catalog", State: "ready"}}, true, nil
-			}
-			t.Cleanup(func() { deliveryGroupOf = was })
-			own := fromHead(repoMerge("mesh-controller", "k1", t0), "feat/both-kinds")
-			cat := fromHead(catalogueMerge("cat1aaaaaaaa", "app", t0), "feat/both-kinds")
-			first, second := cat, own
-			if ownFirst {
-				first, second = own, cat
-			}
-			second.MergedAt = t0.Add(10 * time.Second).Format(time.RFC3339Nano)
-			hear(t, open, first, t0)
-			hear(t, open, second, t0.Add(10*time.Second))
-			ws, bs := walks(t, open)
-			if len(ws) != 0 || len(bs) != 2 {
-				t.Fatalf("both members heard: %d walk(s), %d batch(es); want two batches, nothing cut", len(ws), len(bs))
-			}
-			later := bs[0] // newest first
-			if later.Delivery.Batch.CutAtOnce || !strings.Contains(later.Delivery.Batch.Waits,
-				"has a member waiting in a batch of the other kind: novox/"+first.Repo+"@") {
-				t.Fatalf("the later member's batch reads %+v; want it waiting for the earlier member", later.Delivery.Batch)
-			}
-			// The earlier member's window closes first: its batch alone is cut.
-			cutAt(t, open, t0.Add(90*time.Second))
-			ws, bs = walks(t, open)
-			if len(ws) != 1 || !ws[0].Open() || ws[0].CommitOf("novox/"+first.Repo) != first.Commit || len(bs) != 1 ||
-				bs[0].ID != later.ID {
-				t.Fatalf("at the earlier window: walks %+v, batches %+v; want the earlier member alone cut", ws, bs)
-			}
-			earlier := ws[0]
-			// The later member's window closes while the earlier walk runs: it queues behind it.
-			cutAt(t, open, t0.Add(100*time.Second))
-			if _, bs := walks(t, open); len(bs) != 1 || bs[0].State != inventory.PlanQueued || bs[0].Delivery.Batch.Behind != earlier.ID {
-				t.Fatalf("the later member's batch does not queue behind the earlier walk: %+v", bs)
-			}
-			earlier.State = inventory.PlanDone
-			if err := open.inventory.SavePlan(ctx, &earlier); err != nil {
-				t.Fatal(err)
-			}
-			cutAt(t, open, t0.Add(101*time.Second))
-			got, err := open.inventory.PlanByID(ctx, later.ID)
-			if err != nil || got.Batch() || got.CommitOf("novox/"+second.Repo) != second.Commit {
-				t.Fatalf("the later member was not walked after the earlier: %s %v", got.State, err)
-			}
-		})
-	}
-}

cmd/mesh-controller/main.go

@@ -63,15 +63,6 @@ func run() error {
 	// 45 §6), so the next controller takes it at once rather than after its age.
 	defer theLease.release()
 
-	// Every walk a verb keeps is said on the bus, whichever verb kept it (novox/hq ADR 0308 decision 1): the save
-	// that starts or ends a walk keeps its mark, and no later save says it again. The serving controller says its
-	// own saves.
-	if args[0] != "serve" {
-		said, done := sayingWhatAVerbKept(ctx)
-		inventory.PlanSaved = said
-		defer done()
-	}
-
 	switch args[0] {
 	case "build":
 		return buildCommand(ctx, args[1:])

cmd/mesh-controller/nodes.go

@@ -127,14 +127,9 @@ func nodeCommand(ctx context.Context, args []string) error {
 		// and whoever may call a verb includes agents.
 		return nodeSetuidSearch(ctx, open, args[1:])
 
-	case "judge-directories":
-		// Which of a node's declared directories the walk that follows no link another account could make would
-		// refuse (novox/hq issue 358). Read-only on the node and here, so a verb may run it too.
-		return nodeJudgeDirectories(ctx, open, args[1:])
-
 	default:
-		return fmt.Errorf("node has no %q; it has add, list, show, public-domain, account, agent-account, hand-over, "+
-			"setuid-search and judge-directories", args[0])
+		return fmt.Errorf("node has no %q; it has add, list, show, public-domain, account, agent-account, hand-over "+
+			"and setuid-search", args[0])
 	}
 }
 
@@ -942,57 +937,3 @@ func printJSONTo(w io.Writer, v any) error {
 	fmt.Fprintln(w, string(body))
 	return nil
 }
-
-const judgeDirectoriesUsage = "node judge-directories <node> — read-only: which of the directories <node> is " +
-	"declared the node-engine's walk that follows no link another account could make would refuse, one line each " +
-	"(novox/hq issue 358). Nothing is made, chmodded or chowned"
-
-// nodeJudgeDirectories asks the node's engine to judge its declared directories, signed with the mesh's key as a
-// hand-over is. Read-only: the engine changes nothing and keeps nothing.
-func nodeJudgeDirectories(ctx context.Context, open *stores, args []string) error {
-	known := func(node string) error {
-		_, err := open.inventory.NodeByName(ctx, node)
-		return err
-	}
-	ask := func(node, by string) (link.HandOverAnswer, error) {
-		ident, err := open.Identity(ctx)
-		if err != nil {
-			return link.HandOverAnswer{}, fmt.Errorf("the mesh's signing key cannot be read, so nothing was asked of %s: %w",
-				node, err)
-		}
-		address, err := broker.BusAddress()
-		if err != nil {
-			return link.HandOverAnswer{}, err
-		}
-		js, err := broker.Dial(address)
-		if err != nil {
-			return link.HandOverAnswer{}, fmt.Errorf("cannot reach the bus, so nothing was asked of %s: %w", node, err)
-		}
-		defer js.Close()
-		return link.AskJudgeDirectories(ctx, js.Conn(), ident, node, by, link.HandOverWithin)
-	}
-	return judgeDirectoriesAsked(args, known, ask, os.Stdout)
-}
-
-// judgeDirectoriesAsked is the line with its two acts given: whether the mesh knows the node, and the ask. The
-// engine's refusal is this command's failure.
-func judgeDirectoriesAsked(args []string, known func(node string) error,
-	ask func(node, by string) (link.HandOverAnswer, error), out io.Writer) error {
-	if len(args) != 1 || args[0] == "" || strings.HasPrefix(args[0], "-") {
-		return errors.New(judgeDirectoriesUsage)
-	}
-	node := args[0]
-	if err := known(node); err != nil {
-		return fmt.Errorf("nothing was asked: %w", err)
-	}
-	answer, err := ask(node, handOverBy())
-	if err != nil {
-		return err
-	}
-	if answer.Refused != "" {
-		return fmt.Errorf("%s refused: %s", node, answer.Refused)
-	}
-	fmt.Fprintf(out, "%s (read-only: nothing on %s was changed)\n", node, node)
-	fmt.Fprintln(out, answer.Said)
-	return nil
-}

cmd/mesh-controller/plain_words.go

@@ -885,11 +885,6 @@ func stalledWords(l stalledLine, o conditions.Observation) (headline, explanatio
 // within its bound (novox/hq issue 438): mesh-delivery holds no delivery of it, so there is nothing to stop, release
 // or close, and no action is offered. The operator's acts are a new commit, which asks the check again, or a look
 // at the build queue, where a check that never ran may still wait.
-//
-// A head whose delivery is held in ready or rejected is said the same way (novox/hq issue 441), and mesh-delivery
-// names that state as data (Held). Its check answered once, so the build queue is the wrong place to look: the step
-// is a recheck of the delivery, named by its id, which asks the check again (novox/hq issue 451). It is advised, not
-// offered as an action, since the controller is not granted the recheck.
 func unansweredWords(l stalledLine, o conditions.Observation) (headline, explanation, resolved, needs string,
 	actions []conditions.Action) {
 	repository, _, _ := strings.Cut(l.ID, "@")
@@ -904,23 +899,13 @@ func unansweredWords(l stalledLine, o conditions.Observation) (headline, explana
 	if d, err := time.ParseDuration(l.Bound); err == nil {
 		limit = ", past its limit of " + humanDuration(d)
 	}
-	check := "merge check"
+	which := "Its merge check"
 	if said := uncheckedWaitWords(l); len(said) > 0 {
-		check = "merge check (" + strings.Join(said, ", ") + ")"
+		which = "Its merge check (" + strings.Join(said, ", ") + ")"
 	}
-	which := "Its " + check
-	switch l.Held {
-	case "ready", "rejected":
-		which = "Its delivery is " + l.Held + ", but on the forge its " + check
-		if o.Resolver == conditions.ResolverOperator {
-			needs = "recheck its delivery, which asks its check again — mesh-delivery.recheck with id " + l.ID +
-				" and why — or push a new commit to its branch, " + FromMeshMCPServer
-		}
-	default:
-		if o.Resolver == conditions.ResolverOperator {
-			needs = "push a new commit to its branch, which asks the check again, or see whether its check still " +
-				"waits in the build queue: mesh-controller.queue."
-		}
+	if o.Resolver == conditions.ResolverOperator {
+		needs = "push a new commit to its branch, which asks the check again, or see whether its check still waits " +
+			"in the build queue: mesh-controller.queue."
 	}
 	return fmt.Sprintf("%s's merge check has not answered %s", pull, long),
 		fmt.Sprintf("%s is open on a branch that requires the merge check. %s was asked and has not answered %s%s. "+

cmd/mesh-controller/plain_words_test.go

@@ -452,49 +452,3 @@ func TestAnUnansweredMergeChecksTimeIsSaidInLocalTime(t *testing.T) {
 		t.Fatalf("a pending check without its time reads %q", o.Explanation)
 	}
 }
-
-// **An unanswered merge check on a ready or rejected delivery is told to recheck it** (novox/hq issue 451):
-// mesh-delivery says such a line too (issue 441) and names the delivery's state as data, `held`. That check already
-// answered once, so the build queue is the wrong place to look; a recheck of the delivery, named by its id, asks the
-// check again. A line with no delivery held keeps the advice of issue 438, and so does a line from a mesh-delivery
-// that does not say `held` yet: the controller never guesses the state from the words.
-func TestAnUnansweredMergeCheckOnAReadyOrRejectedDeliveryOffersARecheck(t *testing.T) {
-	line := func(held string) stalledLine {
-		var l stalledLine
-		raw := `{"id":"novox/mesh-controller@c11222026a3b","number":212,"state":"unanswered",` +
-			`"waiting":["mesh/merge-gate pending since 2026-10-11T00:11:39Z"],"for":"1h1m0s","bound":"1h0m0s",` +
-			`"h2":"none: its delivery is ` + held + `, a state the operator moves — the operator's",` +
-			`"says":"novox/mesh-controller#212 is open on main, which requires the merge check, and its delivery is ` +
-			held + ` here, but on the forge its check has not answered: mesh/merge-gate pending since ` +
-			`2026-10-11T00:11:39Z. The pull request waits on that status and nothing asks it again. A recheck of the ` +
-			`delivery asks its check again, as does a new commit on its branch"`
-		if held != "" {
-			raw += `,"held":"` + held + `"`
-		}
-		if err := json.Unmarshal([]byte(raw+`}`), &l); err != nil {
-			t.Fatal(err)
-		}
-		return l
-	}
-	for _, held := range []string{"ready", "rejected"} {
-		o := stalledObservations([]stalledLine{line(held)})[0]
-		t.Logf("%s: %s\nneeds: %s", held, o.Explanation, o.Needs)
-		if !strings.Contains(o.Needs, "mesh-delivery.recheck") || !strings.Contains(o.Needs, "novox/mesh-controller@c11222026a3b") {
-			t.Fatalf("a %s delivery's unanswered check is not offered its recheck: %q", held, o.Needs)
-		}
-		if strings.Contains(o.Needs, "build queue") || strings.Contains(o.Needs, "mesh-controller.queue") {
-			t.Fatalf("a %s delivery's unanswered check, which answered once, is sent to the build queue: %q", held, o.Needs)
-		}
-		if !strings.Contains(o.Explanation, "Its delivery is "+held) {
-			t.Fatalf("a %s delivery's explanation does not say its state: %q", held, o.Explanation)
-		}
-		if len(o.Actions) != 0 {
-			t.Fatalf("it offers an action the controller is not granted: %+v", o.Actions)
-		}
-	}
-	// No delivery held, or a mesh-delivery that does not say: the advice of issue 438, and no recheck.
-	o := stalledObservations([]stalledLine{line("")})[0]
-	if !strings.Contains(o.Needs, "in the build queue: mesh-controller.queue") || strings.Contains(o.Needs, "recheck") {
-		t.Fatalf("a line with no delivery held says to %q", o.Needs)
-	}
-}

cmd/mesh-controller/plan_retry.go

@@ -251,16 +251,6 @@ func resumed(p *inventory.Plan, why string) {
 	if p.State == inventory.PlanFailed && len(failedIn(*p)) == 0 {
 		p.State = inventory.PlanBuilding
 		p.Note = why
-		goesOnAgain(p)
-	}
-}
-
-// goesOnAgain clears a stop from a walk that walks again: a stop said why the walk ended, and a walk resumed has
-// not ended. Kept, it would end a retried walk that fails again as stopped, not failed (novox/hq ADR 0308
-// decision 1), and keep the search for the merge that brought the failure from running (searchAfterFailures).
-func goesOnAgain(p *inventory.Plan) {
-	if p.Delivery != nil {
-		p.Delivery.Stopped, p.Delivery.StoppedWhy = "", ""
 	}
 }
 
@@ -470,7 +460,6 @@ func retryRollouts(ctx context.Context, open *stores, p *inventory.Plan) (string
 		said = append(said, m+" to "+strings.Join(again, ", "))
 	}
 	p.State = inventory.PlanRolling
-	goesOnAgain(p)
 	p.Note = fmt.Sprintf("tier %d retried by hand; sent %s first again", p.Tier, strings.Join(said, "; "))
 	if err := open.inventory.SavePlan(ctx, p); err != nil {
 		return "", err
@@ -536,7 +525,6 @@ func retryTierWhole(ctx context.Context, open *stores, p *inventory.Plan, again
 	}
 	if p.State == inventory.PlanFailed && len(failedIn(*p)) == 0 {
 		p.State = inventory.PlanBuilding
-		goesOnAgain(p)
 		p.Note = fmt.Sprintf("tier %d retried by hand: %s asked again; %s sent again with the tier", p.Tier,
 			strings.Join(again, ", "), orNone(strings.Join(resent, ", ")))
 	}

cmd/mesh-controller/proposals.go

@@ -591,7 +591,7 @@ func proposeCommand(ctx context.Context, module, node, valuesArg string, clear,
 			return err
 		},
 		routerHere: routerHereIn(open.inventory),
-		grantHeld:  grantHeldIn(open, conn),
+		grantHeld:  grantHeldIn(open),
 		routerRecord: func(ctx context.Context, id string) (string, error) {
 			bucket, err := asksRecords(ctx, open.inventory)
 			if err != nil || bucket == "" {

cmd/mesh-controller/push.go

@@ -249,7 +249,7 @@ func serve(ctx context.Context) (err error) {
 	// (novox/hq to-be 45 §9).
 	checkEvents = bus
 	// And every walk this controller keeps in a new state, for the delivery it walks (novox/hq ADR 0239).
-	inventory.PlanSaved = func(_ *inventory.Inventory, p inventory.Plan) { sayPlanMoved(ctx, bus, open.inventory, p) }
+	inventory.PlanSaved = func(p inventory.Plan) { sayPlanMoved(ctx, bus, p) }
 	if err := server.Checks(following{open}); err != nil {
 		return err
 	}
@@ -1084,58 +1084,42 @@ func brokerFirst(names []string, holder string, behind bool) []string {
 // send anywhere, and a module running there always put it in its first wave. A digest of the list
 // last sent is kept for this (ADR 0043: the list is composed on each push, never kept itself).
 func brokerBehind(ctx context.Context, open *stores, names []string) (string, bool, error) {
-	s, err := brokerListState(ctx, open, names)
-	return s.Machine, s.Behind, err
-}
-
-// brokerListState is brokerBehind with why the list could not be composed, when it could not: the plan's own
-// reason, which a remedy names rather than a push that would fail on it (the review of hq issue 353).
-func brokerListState(ctx context.Context, open *stores, names []string) (busListState, error) {
 	inv := open.inventory
 	holders, err := seatHolders(ctx, inv)
 	if err != nil {
-		return busListState{}, err
+		return "", false, err
 	}
 	h, held := holders[theBrokerSeat]
 	if !held || h.Node == "" {
-		return busListState{}, nil
+		return "", false, nil
 	}
 	shelf, err := inv.Catalogue(ctx)
 	if err != nil {
-		return busListState{}, err
+		return "", false, err
 	}
 	if m, known := shelf[h.Module]; !known || m.BusUsers == "" {
 		// A holder that is sent no user list carries no grant: nothing to send first.
-		return busListState{}, nil
+		return "", false, nil
 	}
 	for _, n := range names {
 		if n == h.Node {
-			return busListState{Machine: h.Node}, nil
+			return h.Node, false, nil
 		}
 	}
-	// **What cannot be worked out is behind** (the review of hq issue 353). The list it would be sent cannot be
-	// composed, so whether it carries the grants a send relies on is not known; it is taken as behind, so a push
-	// sends that machine first and says why it cannot (`plan` says it too), and a rollout that needs the list
-	// refuses rather than sending code whose grants the bus may not hold. It said "not behind" until then: a
-	// send went ahead as if the bus held a list nobody could compose.
-	list, composeErr := "", error(nil)
 	plan, _, err := planFor(ctx, open, h.Node)
 	if err != nil {
-		composeErr = err
-	} else if list, _, err = busUserList(ctx, inv, plan.Modules); err != nil {
-		composeErr = err
+		// It cannot be worked out: sending it would refuse the whole send, and `plan` says why.
+		return h.Node, false, nil
+	}
+	list, _, err := busUserList(ctx, inv, plan.Modules)
+	if err != nil {
+		return h.Node, false, nil
 	}
 	sent, err := inv.SentBusUsers(ctx, h.Node)
 	if err != nil {
-		return busListState{}, err
+		return "", false, err
 	}
-	return busListState{Machine: h.Node, Behind: listBehind(list, composeErr, sent), Uncomposed: composeErr}, nil
-}
-
-// listBehind is whether the bus's machine is behind: the list composed now is not the one last sent, or it
-// could not be composed at all — not known is behind, never "not behind".
-func listBehind(list string, composeErr error, sentDigest string) bool {
-	return composeErr != nil || userListBehind(list, sentDigest)
+	return h.Node, userListBehind(list, sent), nil
 }
 
 // userListBehind is whether the user list composed now is not the one last sent, by its digest. An

cmd/mesh-controller/queue.go

@@ -8,7 +8,6 @@ import (
 	"fmt"
 	"io"
 	"os"
-	"regexp"
 	"sort"
 	"strings"
 	"time"
@@ -68,95 +67,18 @@ func listQueue(ctx context.Context, args []string, w io.Writer) error {
 	if err != nil {
 		return err
 	}
-	now := time.Now()
 	if *asJSON {
-		body, err := json.MarshalIndent(queueAnswerOf(q, now), "", "  ")
+		body, err := json.MarshalIndent(q, "", "  ")
 		if err != nil {
 			return err
 		}
 		fmt.Fprintln(w, string(body))
 		return nil
 	}
-	fmt.Fprint(w, queueText(q, now))
+	fmt.Fprint(w, queueText(q, time.Now()))
 	return nil
 }
 
-// queueAnswer is the queue as data (novox/hq issue 455): what a caller reads to say how far back an ask
-// waits — "waiting in the build queue behind 2" — which the table alone could not tell it. Text is the
-// table, written from the same read: the verb answers it as its output and the rest as its answer, so the
-// two never disagree.
-type queueAnswer struct {
-	Seat       string         `json:"seat"`
-	Waiting    int            `json:"waiting"`
-	InFlight   int            `json:"in-flight"`
-	Dead       int            `json:"dead"`
-	MaxDeliver int            `json:"max-deliver"`
-	Asks       []queuedAnswer `json:"asks"`
-	Text       string         `json:"text"`
-}
-
-// queuedAnswer is one ask as data. Never what the request carries beyond its source — not `held`, every
-// artifact the mesh has built, nor a check's checkouts beside it.
-type queuedAnswer struct {
-	ID    string `json:"id"`
-	State string `json:"state"`
-	// Kind is "check" for a pull request's merge check, "build" for anything else.
-	Kind       string `json:"kind"`
-	Repository string `json:"repository"`
-	Path       string `json:"path,omitempty"`
-	Ref        string `json:"ref,omitempty"`
-	// Commit is the ref when it names a commit; empty when the ask follows a branch or the default.
-	Commit string `json:"commit,omitempty"`
-	// Machine is the one building an ask in flight; WasOn the one that started it and handed it back.
-	Machine string    `json:"machine,omitempty"`
-	WasOn   string    `json:"was-on,omitempty"`
-	AskedAt time.Time `json:"asked-at,omitzero"`
-	// Since is when the ask came to its state: its start on the machine for one in flight that a
-	// machine said it started, otherwise when it was asked.
-	Since time.Time `json:"since,omitzero"`
-	// Position is its place among the waiting, 1 being handed out next; 0 for an ask not waiting.
-	Position int    `json:"position,omitempty"`
-	Seq      uint64 `json:"seq"`
-}
-
-// aCommitRef is a ref that names a commit by its full hash (SHA-1 or SHA-256).
-var aCommitRef = regexp.MustCompile(`^(?:[0-9a-f]{40}|[0-9a-f]{64})$`)
-
-// queueAnswerOf is the queue as data, in the table's order: in flight, the waiting from the next one to
-// be handed out, then the dead. A pure function of one read (novox/hq issue 455).
-func queueAnswerOf(q link.Queue, now time.Time) queueAnswer {
-	waiting, running, dead := q.Of(link.AskWaiting), q.Of(link.AskInFlight), q.Of(link.AskDead)
-	out := queueAnswer{Seat: q.Seat, Waiting: len(waiting), InFlight: len(running), Dead: len(dead),
-		MaxDeliver: q.MaxDeliver, Asks: []queuedAnswer{}, Text: queueText(q, now)}
-	one := func(a link.QueuedAsk, position int) queuedAnswer {
-		kind := "build"
-		if a.Request.Check != nil {
-			kind = "check"
-		}
-		since := a.AskedAt
-		if a.State == link.AskInFlight && a.On != "" && !a.Started.IsZero() {
-			since = a.Started
-		}
-		commit := ""
-		if aCommitRef.MatchString(a.Ref) {
-			commit = a.Ref
-		}
-		return queuedAnswer{ID: a.ID, State: a.State, Kind: kind, Repository: link.WithoutPassword(a.Repository), Path: a.Path,
-			Ref: a.Ref, Commit: commit, Machine: a.On, WasOn: a.Was, AskedAt: a.AskedAt, Since: since,
-			Position: position, Seq: a.Seq}
-	}
-	for _, a := range running {
-		out.Asks = append(out.Asks, one(a, 0))
-	}
-	for i, a := range waiting {
-		out.Asks = append(out.Asks, one(a, i+1))
-	}
-	for _, a := range dead {
-		out.Asks = append(out.Asks, one(a, 0))
-	}
-	return out
-}
-
 // queueText is the queue as a person reads it: a summary line, then each kind in queue order.
 // Never what an ask carries as `held` — that is every artifact the mesh has built.
 func queueText(q link.Queue, now time.Time) string {
@@ -170,7 +92,7 @@ func queueText(q link.Queue, now time.Time) string {
 		return "asked " + now.Sub(t).Round(time.Second).String() + " ago"
 	}
 	what := func(a link.QueuedAsk) string {
-		s := link.WithoutPassword(a.Repository)
+		s := a.Repository
 		if a.Path != "" {
 			s += " at " + a.Path
 		}

cmd/mesh-controller/queue_answer_test.go

@@ -1,137 +0,0 @@
-package main
-
-import (
-	"encoding/json"
-	"reflect"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// The queue answers as data as well as text (novox/hq issue 455): each ask's repository, commit, kind,
-// machine, since and position among the waiting, read from the same queue the table is written from.
-
-const aCommit = "0123456789abcdef0123456789abcdef01234567"
-
-func aQueueOfEachKind(now time.Time) link.Queue {
-	asked := now.Add(-5 * time.Minute)
-	started := now.Add(-2 * time.Minute)
-	return link.Queue{Seat: link.TheBuildMachine, Delivered: 2, AckPending: 1, MaxDeliver: 5, Asks: []link.QueuedAsk{
-		{Seq: 1, ID: "build-dead", Repository: "ssh://forge/novox/x", AskedAt: asked, State: link.AskDead},
-		{Seq: 2, ID: "build-running", Repository: "ssh://forge/novox/mesh-host", Ref: aCommit, AskedAt: asked,
-			State: link.AskInFlight, On: "ace", Started: started,
-			Request: link.BuildRequest{ID: "build-running", Check: &link.CheckRequest{Owner: "novox", Repo: "mesh-host"}}},
-		{Seq: 3, ID: "build-first", Repository: "ssh://forge/novox/mesh-catalog", Ref: "main", AskedAt: asked,
-			State: link.AskWaiting},
-		{Seq: 4, ID: "build-second", Repository: "ssh://forge/novox/mesh-catalog", Path: "modules/gitea", Ref: aCommit,
-			AskedAt: now.Add(-time.Minute), State: link.AskWaiting,
-			Request: link.BuildRequest{ID: "build-second", Check: &link.CheckRequest{Owner: "novox", Repo: "mesh-catalog"}}},
-	}}
-}
-
-func TestTheQueueVerbAnswersEachAskAsData(t *testing.T) {
-	now := time.Date(2026, 10, 12, 12, 0, 0, 0, time.UTC)
-	q := aQueueOfEachKind(now)
-	got := queueAnswerOf(q, now)
-	if got.Waiting != 2 || got.InFlight != 1 || got.Dead != 1 || got.Seat != link.TheBuildMachine {
-		t.Fatalf("counts: %+v", got)
-	}
-	if got.Text != queueText(q, now) {
-		t.Fatalf("the data's text is not the table read from the same queue:\n%s", got.Text)
-	}
-	byID := map[string]queuedAnswer{}
-	for _, a := range got.Asks {
-		byID[a.ID] = a
-	}
-	running := byID["build-running"]
-	if running.Kind != "check" || running.Machine != "ace" || running.Commit != aCommit || running.Position != 0 ||
-		!running.Since.Equal(now.Add(-2*time.Minute)) || running.State != link.AskInFlight {
-		t.Errorf("in flight: %+v", running)
-	}
-	first, second := byID["build-first"], byID["build-second"]
-	if first.Position != 1 || first.Kind != "build" || first.Commit != "" || first.Ref != "main" || first.Machine != "" ||
-		!first.Since.Equal(now.Add(-5*time.Minute)) {
-		t.Errorf("first waiting: %+v", first)
-	}
-	if second.Position != 2 || second.Kind != "check" || second.Commit != aCommit || second.Path != "modules/gitea" ||
-		second.Repository != "ssh://forge/novox/mesh-catalog" {
-		t.Errorf("second waiting: %+v", second)
-	}
-	if dead := byID["build-dead"]; dead.Position != 0 || dead.State != link.AskDead {
-		t.Errorf("dead: %+v", dead)
-	}
-	// In the table's order: in flight, then the waiting by position, then the dead.
-	var order []string
-	for _, a := range got.Asks {
-		order = append(order, a.ID)
-	}
-	if want := []string{"build-running", "build-first", "build-second", "build-dead"}; !reflect.DeepEqual(order, want) {
-		t.Errorf("order %v, want %v", order, want)
-	}
-}
-
-// The verb asks its command for JSON, and its answer carries the data while its output stays the table a
-// person reads, so a text caller reads what it always did.
-func TestTheQueueVerbKeepsTheTableAndCarriesTheData(t *testing.T) {
-	argv, err := argvFor("queue", nil)
-	if err != nil || !reflect.DeepEqual(argv, []string{"queue", "--json"}) {
-		t.Fatalf("queue's command line: %v %v", argv, err)
-	}
-	now := time.Now()
-	q := aQueueOfEachKind(now)
-	body, err := json.Marshal(queueAnswerOf(q, now))
-	if err != nil {
-		t.Fatal(err)
-	}
-	answer := answerOf(argv, body, "", true)
-	if answer.Output != queueText(q, now) {
-		t.Fatalf("the output is not the table:\n%s", answer.Output)
-	}
-	data, ok := answer.Answer.(map[string]any)
-	if !ok {
-		t.Fatalf("no data: %#v", answer.Answer)
-	}
-	if _, doubled := data["text"]; doubled {
-		t.Error("the table is said twice: once as the output and again inside the data")
-	}
-	asks, _ := data["asks"].([]any)
-	if len(asks) != 4 || data["waiting"] != float64(2) {
-		t.Fatalf("data: %v", data)
-	}
-	second := asks[2].(map[string]any)
-	if second["position"] != float64(2) || second["kind"] != "check" || second["commit"] != aCommit {
-		t.Errorf("second waiting: %v", second)
-	}
-	for _, a := range asks {
-		if _, held := a.(map[string]any)["held"]; held {
-			t.Error("an ask carries what the mesh holds")
-		}
-	}
-	// A failure is said as text, as before.
-	failed := answerOf(argv, nil, "mesh-controller: the bus cannot be reached\n", false)
-	if failed.Answer != nil || !strings.Contains(failed.Output, "cannot be reached") {
-		t.Errorf("a failure: %+v", failed)
-	}
-}
-
-// A repository named with a password never shows it, in the table or the data.
-func TestTheQueueNeverShowsARepositorysPassword(t *testing.T) {
-	if got := link.WithoutPassword("https://agent:s3cret@forge.example/novox/x.git"); strings.Contains(got, "s3cret") ||
-		!strings.Contains(got, "agent@forge.example/novox/x.git") {
-		t.Errorf("redacted: %s", got)
-	}
-	now := time.Now()
-	q := link.Queue{Seat: link.TheBuildMachine, Asks: []link.QueuedAsk{{Seq: 1, ID: "build-1",
-		Repository: "https://agent:s3cret@forge.example/novox/x.git", State: link.AskWaiting}}}
-	body, _ := json.Marshal(queueAnswerOf(q, now))
-	if strings.Contains(string(body), "s3cret") {
-		t.Errorf("the queue said a password: %s", body)
-	}
-	for _, kept := range []string{"ssh://git@forge:222/novox/x.git", "novox/x", "git@forge:novox/x.git", ""} {
-		if got := link.WithoutPassword(kept); got != kept {
-			t.Errorf("%q became %q", kept, got)
-		}
-	}
-}

cmd/mesh-controller/queue_test.go

@@ -326,7 +326,7 @@ func TestTheQueueVerbsRunTheirCommands(t *testing.T) {
 		args map[string]any
 		want []string
 	}{
-		{"queue", nil, []string{"queue", "--json"}},
+		{"queue", nil, []string{"queue"}},
 		{"cancel", map[string]any{"id": "build-1"}, []string{"cancel", "build-1"}},
 		{"clear", nil, []string{"clear"}},
 		{"clear", map[string]any{"dead": "true"}, []string{"clear", "--dead"}},

cmd/mesh-controller/reconnects_test.go

@@ -80,7 +80,7 @@ func TestAVerbsOwnProcessNamesItsConnection(t *testing.T) {
 	// A silence acts, so it is still its own process; it dials, and finds no such condition.
 	_, _ = handlers["conditions"](context.Background(),
 		json.RawMessage(`{"silence":"bus.nothing.here","for":"1h","why":"a test"}`))
-	names := closedNames(t, bus, "mesh-controller verb conditions")
+	names := closedNames(t, bus)
 	found := false
 	for _, n := range names {
 		found = found || n == "mesh-controller verb conditions"

cmd/mesh-controller/release.go

@@ -812,19 +812,14 @@ func backlogCommand(ctx context.Context, sub string, args []string) error {
 	}
 	defer open.Close()
 	if sub == "release-backlog" {
-		// Said on the bus (novox/hq ADR 0308 decision 1): the release plan starts walking here, and its start is
-		// said by the verb that opens it.
-		var p *inventory.Plan
-		if err := sayingOnTheBus(ctx, open.inventory, func() error {
-			release, err := open.inventory.HoldPlans(ctx, true)
-			if err != nil {
-				return err
-			}
-			defer release()
-			why.record(ctx, "upgrade release-backlog", nil)
-			p, err = releaseBacklog(ctx, open, link.Caller())
+		release, err := open.inventory.HoldPlans(ctx, true)
+		if err != nil {
 			return err
-		}); err != nil {
+		}
+		defer release()
+		why.record(ctx, "upgrade release-backlog", nil)
+		p, err := releaseBacklog(ctx, open, link.Caller())
+		if err != nil {
 			return err
 		}
 		if p == nil {

cmd/mesh-controller/release_plan.go

@@ -1559,7 +1559,7 @@ func plansCommand(ctx context.Context, args []string) error {
 	if len(positionals) == 2 && positionals[0] == "go" {
 		why.record(ctx, "plans go", positionals[1:])
 		var p inventory.Plan
-		if err := sayingOnTheBus(ctx, inv, func() (err error) {
+		if err := sayingOnTheBus(ctx, func() (err error) {
 			p, err = letGo(ctx, inv, positionals[1], "a person ("+whoAsked()+")", strings.TrimSpace(*why.why))
 			return err
 		}); err != nil {
@@ -1571,13 +1571,8 @@ func plansCommand(ctx context.Context, args []string) error {
 	}
 	// `retry` (novox/hq ADR 0219): a failed plan's failed builds asked again, and the plan goes on.
 	if len(positionals) == 2 && positionals[0] == "retry" {
-		// Said on the bus (novox/hq ADR 0308 decision 1): a retried walk starts again, and its start is said
-		// by the verb that starts it.
-		var said string
-		if err := sayingOnTheBus(ctx, inv, func() (err error) {
-			said, err = retryPlan(ctx, open, positionals[1])
-			return err
-		}); err != nil {
+		said, err := retryPlan(ctx, open, positionals[1])
+		if err != nil {
 			return err
 		}
 		fmt.Println(said)
@@ -1591,29 +1586,26 @@ func plansCommand(ctx context.Context, args []string) error {
 		if positionals[0] == "close" {
 			how = "closed"
 		}
-		// Said on the bus (novox/hq ADR 0308 decision 1): the walk's end, outcome stopped, is said by the verb
-		// that ends it, so what it touched is not held until its bound.
-		var p inventory.Plan
-		if err := sayingOnTheBus(ctx, inv, func() error {
-			release, err := inv.HoldPlans(ctx, true)
-			if err != nil {
-				return err
-			}
-			defer release()
-			if p, err = inv.PlanByID(ctx, positionals[1]); err != nil {
-				return err
-			}
-			if !p.Open() {
-				return fmt.Errorf("%s is already %s", p.ID, p.State)
-			}
-			why.record(ctx, "plans "+positionals[0], positionals[1:])
-			stopByHand(&p, how, "a person ("+whoAsked()+")", strings.TrimSpace(*why.why))
-			sayUnsent(&p, func(m string) bool {
-				u, err := inv.UpgradeOf(ctx, m)
-				return err == nil && u.RollOut
-			})
-			return inv.SavePlan(ctx, &p)
-		}); err != nil {
+		release, err := inv.HoldPlans(ctx, true)
+		if err != nil {
+			return err
+		}
+		defer release()
+		p, err := inv.PlanByID(ctx, positionals[1])
+		if err != nil {
+			return err
+		}
+		if !p.Open() {
+			return fmt.Errorf("%s is already %s", p.ID, p.State)
+		}
+		why.record(ctx, "plans "+positionals[0], positionals[1:])
+		p.State = inventory.PlanFailed
+		p.Note = how + " by hand at tier " + fmt.Sprint(p.Tier) + ": " + strings.TrimSpace(*why.why)
+		sayUnsent(&p, func(m string) bool {
+			u, err := inv.UpgradeOf(ctx, m)
+			return err == nil && u.RollOut
+		})
+		if err := inv.SavePlan(ctx, &p); err != nil {
 			return err
 		}
 		fmt.Printf("%s %s at tier %d of %d; what was asked still builds and registers, nothing further is asked\n",
@@ -1932,15 +1924,3 @@ func forgetDeleted(ctx context.Context, inv *inventory.Inventory, module string,
 			"`module forget %s`: %v\n", p.ID, module, module, firstLine(err.Error()))
 	}
 }
-
-// stopByHand ends a walk a person stopped or closed (`plans stop|close`): failed, with who stopped it and why
-// kept as the delivery's owner keeps its own stop, so the walk ends with outcome stopped, not failed (novox/hq
-// ADR 0308 decision 1).
-func stopByHand(p *inventory.Plan, how, by, why string) {
-	p.State = inventory.PlanFailed
-	p.Note = how + " by hand at tier " + fmt.Sprint(p.Tier) + ": " + why
-	if p.Delivery == nil {
-		p.Delivery = &inventory.PlanDelivery{}
-	}
-	p.Delivery.Stopped, p.Delivery.StoppedWhy = by, why
-}

cmd/mesh-controller/replay327_test.go

@@ -84,12 +84,8 @@ func asAProcess(t *testing.T, url string) {
 	t.Setenv(broker.CertificateVar, "")
 }
 
-// closedNames are the names of the connections the bus saw closed, waited for by want's own name: the
-// bus can register another connection's close first (the test's own setup connection, say), so returning
-// on the first non-empty list names whichever closed first, not necessarily the one being waited for
-// (novox/hq issue 543). closedNames instead waits until want itself appears among the closed connections,
-// or the deadline passes, and returns whatever names it last saw either way.
-func closedNames(t *testing.T, bus *server.Server, want string) []string {
+// closedNames are the names of the connections the bus saw closed.
+func closedNames(t *testing.T, bus *server.Server) []string {
 	t.Helper()
 	deadline := time.Now().Add(5 * time.Second)
 	var names []string
@@ -99,14 +95,10 @@ func closedNames(t *testing.T, bus *server.Server, want string) []string {
 			t.Fatal(err)
 		}
 		names = names[:0]
-		found := false
 		for _, c := range connz.Conns {
 			names = append(names, c.Name)
-			if c.Name == want {
-				found = true
-			}
 		}
-		if found {
+		if len(names) > 0 {
 			return names
 		}
 		time.Sleep(50 * time.Millisecond)

cmd/mesh-controller/seat_dependencies_test.go

@@ -15,8 +15,7 @@ import (
 func serviceManagerHolder() catalogue.Manifest {
 	return catalogue.Manifest{Module: "systemd", Version: "1",
 		Claims: []catalogue.Claim{{Name: catalogue.ServiceManagerSeat, Scope: catalogue.ScopeNode,
-			Serves: []string{"units", "status", "start", "stop", "restart", "enable", "disable", "journal",
-				"reset-failed", "wanted-by", "unlink-dangling"}}},
+			Serves: []string{"units", "status", "start", "stop", "restart", "enable", "disable", "journal"}}},
 		Resources: []map[string]any{{"id": "systemd", "type": "package", "package": "systemd"}}}
 }
 

cmd/mesh-controller/seatverbs.go

@@ -314,11 +314,6 @@ func (a *verbArguments) commandLine() ([]string, error) {
 			return nil, err
 		}
 		return []string{"node", "show", str("node")}, nil
-	case "judge-directories":
-		if err := need("node"); err != nil {
-			return nil, err
-		}
-		return []string{"node", "judge-directories", str("node")}, nil
 	case "modules":
 		return []string{"module", "list", "--json"}, nil
 	case "seats":
@@ -431,8 +426,7 @@ func (a *verbArguments) commandLine() ([]string, error) {
 		return argv, nil
 	// The build queue (novox/hq ADR 0219).
 	case "queue":
-		// As data, the table its output (novox/hq issue 455).
-		return []string{"queue", "--json"}, nil
+		return []string{"queue"}, nil
 	case "cancel", "kill":
 		if err := need("id"); err != nil {
 			return nil, err
@@ -983,14 +977,7 @@ var jsonVerbs = map[string]bool{"status": true, "seats": true, "plan": true, "co
 	// What the records say the registries may keep (novox/hq ADR 0251).
 	"artifacts": true, "collect": true, "images": true, "mirrors": true,
 	// The delivery's owner's verbs answer JSON where they read (plan, order, check, walks) — novox/hq ADR 0239.
-	"delivery": true,
-	// The build queue, each ask with its position among the waiting (novox/hq issue 455).
-	"queue": true}
-
-// tableBesideVerbs are the JSON verbs whose document carries the table a person reads as its `text`: the
-// verb answers that table as its output, as it did before it answered data, and the rest as `answer` —
-// both from the one read, so they never disagree (novox/hq issue 455).
-var tableBesideVerbs = map[string]bool{"queue": true}
+	"delivery": true}
 
 // overviewVerbs are the JSON verbs whose answer is said once, as data, and not again as the text the
 // command printed: the overviews, which grow with the mesh (novox/hq issue 314). Every reader of theirs
@@ -1110,12 +1097,6 @@ func answerOf(argv []string, stdout []byte, stderr string, ok bool) verbAnswer {
 		var parsed any
 		if json.Unmarshal(bytes.TrimSpace(stdout), &parsed) == nil {
 			answer.Answer = parsed
-			if doc, isDoc := parsed.(map[string]any); isDoc && tableBesideVerbs[argv[0]] {
-				if table, said := doc["text"].(string); said {
-					answer.Output = table + stderr
-					delete(doc, "text")
-				}
-			}
 			if overviewVerbs[argv[0]] {
 				// Once, as data: the same document again as text doubled an answer that already
 				// outgrew one message of the bus (novox/hq issue 314).
@@ -1498,9 +1479,7 @@ func seatAnnouncement(handlers map[string]link.ToolHandler) micro.Info {
 }
 
 // nodeReads are the `node` subcommands a verb may run: the ones that only read.
-var nodeReads = map[string]bool{"list": true, "show": true,
-	// Read-only on the node too: the engine judges its directories and changes nothing (novox/hq issue 358).
-	"judge-directories": true}
+var nodeReads = map[string]bool{"list": true, "show": true}
 
 // flagsOnly says a command line's rest names no subcommand: empty, or beginning with a flag. For a command
 // with no subcommands every word is a flag, its value or a name it reads.

cmd/mesh-controller/seatverbs_schema_test.go

@@ -256,7 +256,7 @@ func stringLit(e ast.Expr) (string, bool) {
 var accountedFlags = map[string]map[string]string{
 	"status": {"json": "set by the verb: the answer is data"},
 	"seats":  {"json": "set by the verb: the answer is data"},
-	"queue":  {"json": "set by the verb: the answer is data, its output the table (novox/hq issue 455)"},
+	"queue":  {"json": "not set: the verb answers the table a person reads"},
 	"plan":   {"json": "set by the verb unless files is asked"},
 	"push": {
 		"wait": "set by the verb to 0: a tool call cannot hold a connection for a whole apply",

cmd/mesh-controller/status_summary.go

@@ -172,7 +172,7 @@ func composeStatus(open *stores) func(context.Context) ([]byte, error) {
 var readingVerbs = map[string]bool{
 	"tools": true, "calls": true, "status": true, "nodes": true, "node": true, "modules": true,
 	"seats": true, "builds": true, "plan": true, "queue": true, "durations": true, "hand-acts": true,
-	"doctor": true, "conditions": true, "healers": true, "judge-directories": true,
+	"doctor": true, "conditions": true, "healers": true,
 }
 
 // nudgingListener is the enrolment, nudging the summary when a machine said something new.

cmd/mesh-controller/walk_said.go

@@ -1,334 +0,0 @@
-package main
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"slices"
-	"sort"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// What a walk touches, its bound and its outcome (novox/hq ADR 0308 decision 1, decision 5): said in
-// `plan-moved` on the save that starts the walk and the save that ends it, beside the walk whole, for the holder
-// of the operator's channel to hold what the walk touches while it runs and tell its result once.
-//
-// **What a walk touches** is every module it moves on every machine it sends it to, and every module a moved
-// tool runner (node-tools) or node-engine (mesh-host) carries on that machine: what restarts there. At the start
-// that is what the walk will send — each module of its tiers whose policy rolls it out, on every machine running
-// it; at the end it is what it reached — the machines each module was sent to, first and rest, and what a gated
-// send carried with it.
-//
-// **Its bound** is twice the largest delivery budget among the walk's deliveries (deliveryBudgets: a core
-// module's ten minutes, a leaf module's budget in force), and fifteen minutes, not doubled, for a walk none of
-// whose deliveries has a budget: a release plan (builds waiting for a person's gate), a walk whose every module's
-// policy records rather than rolls out (held for a person, ADR 0282 decision 1), or a walk kept without a class.
-
-// walkNoBudgetBound is the bound of a walk with no budget (ADR 0308 decision 5): not doubled.
-const walkNoBudgetBound = 15 * time.Minute
-
-// budgetNone is the budget class of a walk none of whose deliveries has a budget.
-const budgetNone = "none"
-
-// walkSaid is what `plan-moved` adds on a walk's start and end, beside the walk whole.
-type walkSaid struct {
-	Walk  string `json:"walk"`
-	Phase string `json:"phase"`
-	// Touches is, per machine, the modules the walk moves or reaches there and what a moved tool runner or
-	// node-engine carries there; never null.
-	Touches []walkTouch `json:"touches"`
-	// Outcome is on the end only: delivered, failed or stopped.
-	Outcome string `json:"outcome,omitempty"`
-	// BoundSeconds and BudgetClass are said on both, read from the walk's class at the start.
-	BoundSeconds int    `json:"bound_seconds"`
-	BudgetClass  string `json:"budget_class"`
-	// StartedAt is when the walk was said started, on both; EndedAt when it was said ended, on the end: the
-	// bound runs from StartedAt, whenever the event is heard.
-	StartedAt *time.Time `json:"started_at,omitempty"`
-	EndedAt   *time.Time `json:"ended_at,omitempty"`
-}
-
-// walkTouch is what a walk touches on one machine.
-type walkTouch struct {
-	Machine string   `json:"machine"`
-	Modules []string `json:"modules"`
-	// Carried names those of Modules that are there only because a moved tool runner or node-engine carries
-	// them: what restarts with it, not what the walk builds.
-	Carried []string `json:"carried,omitempty"`
-}
-
-// planMovedBody is `plan-moved`'s body: the walk whole, as before, and on its start and end what it touches.
-type planMovedBody struct {
-	inventory.Plan
-	*walkSaid
-}
-
-// walkFacts is what the touches are read from: the controller's inventory.
-type walkFacts interface {
-	Running(ctx context.Context, module string) ([]string, error)
-	UpgradeOf(ctx context.Context, module string) (inventory.Upgrade, error)
-	Assigned(ctx context.Context, node string) ([]string, error)
-	SentBuilds(ctx context.Context, node string) (map[string]string, bool, error)
-	Catalogue(ctx context.Context) (map[string]catalogue.Manifest, error)
-}
-
-// sayWalk is what `plan-moved` adds to the save that started or ended the walk; nil on every other save. A fact
-// that cannot be read is said on the controller's log and left out, never in the way of the event: a walk said
-// with fewer touches is held less, never longer.
-func sayWalk(ctx context.Context, facts walkFacts, p inventory.Plan) *walkSaid {
-	if p.WalkSaid == "" {
-		return nil
-	}
-	w := &walkSaid{Walk: p.ID, Phase: p.WalkSaid}
-	if p.Times != nil {
-		w.StartedAt = p.Times.Started
-		if p.WalkSaid == inventory.WalkEnded {
-			w.EndedAt, w.Outcome = p.Times.Ended, p.Outcome()
-		}
-	}
-	read := readWalkFacts(ctx, facts, p)
-	w.BudgetClass = walkBudgetClass(p, read.rollsOut)
-	w.BoundSeconds = int(walkBound(w.BudgetClass) / time.Second)
-	var moved map[string][]string
-	if p.WalkSaid == inventory.WalkStarted {
-		moved = walkSends(p, read.running, read.rollsOut)
-	} else {
-		moved = walkReached(p, read.running)
-	}
-	var shelf map[string]catalogue.Manifest
-	if len(moved[broker.RuntimeModule]) > 0 {
-		// Which modules the tool runner serves is the catalogue's: read only when the walk moves it.
-		shelf = read.shelf()
-	}
-	w.Touches = touchesOf(moved, read.onMachine(moved), shelf)
-	return w
-}
-
-// walkBudgetClass is the largest budget class among the walk's deliveries: its class read at the cut when one of
-// its modules rolls out, and none when it has no budget.
-func walkBudgetClass(p inventory.Plan, rollsOut func(string) bool) string {
-	if p.Release != nil || p.Times == nil {
-		return budgetNone
-	}
-	if _, budgeted := deliveryBudgets[p.Times.Class]; !budgeted {
-		return budgetNone
-	}
-	for _, tier := range p.Tiers {
-		for _, m := range tier {
-			if rollsOut(m) {
-				return p.Times.Class
-			}
-		}
-	}
-	return budgetNone
-}
-
-// walkBound is a walk's bound by its budget class: twice its budget, or fifteen minutes with none.
-func walkBound(class string) time.Duration {
-	if b, ok := deliveryBudgets[class]; ok {
-		return 2 * b
-	}
-	return walkNoBudgetBound
-}
-
-// walkSends is what a walk will send at its start, per module the machines it goes to: each module of its tiers
-// whose policy rolls it out, on every machine running it (for a release plan, those of its order).
-func walkSends(p inventory.Plan, running func(string) []string, rollsOut func(string) bool) map[string][]string {
-	out := map[string][]string{}
-	for _, tier := range p.Tiers {
-		for _, m := range tier {
-			if s := p.Modules[m]; s != nil && s.State == planDeleted {
-				continue
-			}
-			if p.Release == nil && !rollsOut(m) {
-				continue
-			}
-			for _, n := range running(m) {
-				if p.Release != nil && !slices.Contains(p.Release.Order, n) {
-					continue
-				}
-				out[m] = appendNew(out[m], n)
-			}
-		}
-	}
-	return out
-}
-
-// walkReached is what a walk sent by its end, per module the machines it reached: its first machines, its rest,
-// and every module a gated send carried with it. A release plan reached the machines it walked: those done and
-// the one being judged.
-func walkReached(p inventory.Plan, running func(string) []string) map[string][]string {
-	out := map[string][]string{}
-	carried := func(g *inventory.PlanGate) {
-		if g == nil {
-			return
-		}
-		for _, c := range g.Carried {
-			out[c.Module] = appendNew(out[c.Module], c.Node)
-		}
-	}
-	if r := p.Release; r != nil {
-		reached := append([]string{}, r.Done...)
-		if r.Gate != nil {
-			reached = appendNew(reached, r.Gate.Machines...)
-			carried(r.Gate)
-		}
-		for _, tier := range p.Tiers {
-			for _, m := range tier {
-				for _, n := range running(m) {
-					if slices.Contains(reached, n) {
-						out[m] = appendNew(out[m], n)
-					}
-				}
-			}
-		}
-		return out
-	}
-	for m, s := range p.Modules {
-		if s == nil {
-			continue
-		}
-		out[m] = appendNew(out[m], s.First...)
-		for n := range s.Rest {
-			out[m] = appendNew(out[m], n)
-		}
-		carried(s.Gate)
-		if len(out[m]) == 0 {
-			delete(out, m)
-		}
-	}
-	return out
-}
-
-// touchesOf turns what a walk moves, per module, into what it touches, per machine: the modules it moves there,
-// and, where it moves the tool runner, every module there whose tools it serves, and where it moves the
-// node-engine, every module there. Sorted by machine and module.
-func touchesOf(moved map[string][]string, on map[string][]string, shelf map[string]catalogue.Manifest) []walkTouch {
-	byMachine := map[string][]string{}
-	for m, machines := range moved {
-		for _, n := range machines {
-			byMachine[n] = appendNew(byMachine[n], m)
-		}
-	}
-	out := make([]walkTouch, 0, len(byMachine))
-	for n, modules := range byMachine {
-		t := walkTouch{Machine: n, Modules: modules}
-		engine, runner := slices.Contains(modules, hostModule), slices.Contains(modules, broker.RuntimeModule)
-		if engine || runner {
-			for _, m := range on[n] {
-				if slices.Contains(t.Modules, m) || (!engine && !servesTools(shelf[m])) {
-					continue
-				}
-				t.Modules = append(t.Modules, m)
-				t.Carried = append(t.Carried, m)
-			}
-		}
-		sort.Strings(t.Modules)
-		sort.Strings(t.Carried)
-		out = append(out, t)
-	}
-	sort.Slice(out, func(i, j int) bool { return out[i].Machine < out[j].Machine })
-	return out
-}
-
-// servesTools says the tool runner serves something of this module: a bundle it loads entrypoints from, or the
-// module's own tools.
-func servesTools(m catalogue.Manifest) bool {
-	if len(m.Tools) > 0 {
-		return true
-	}
-	for _, b := range m.Bundles {
-		if len(b.Loads) > 0 {
-			return true
-		}
-	}
-	return false
-}
-
-// walkRead is the facts a walk's touches are worked out from, read once per event.
-type walkRead struct {
-	running   func(string) []string
-	rollsOut  func(string) bool
-	onMachine func(moved map[string][]string) map[string][]string
-	shelf     func() map[string]catalogue.Manifest
-}
-
-// readWalkFacts reads what the walk's touches need. Without facts (a test, a command with no store), nothing runs
-// anywhere and every module rolls out: the touches are then what the walk itself recorded.
-func readWalkFacts(ctx context.Context, facts walkFacts, p inventory.Plan) walkRead {
-	cantRead := func(what string, err error) {
-		fmt.Fprintf(os.Stderr, "%s: %s cannot be read for what the walk touches: %v\n", p.ID, what, err)
-	}
-	r := walkRead{
-		running:   func(string) []string { return nil },
-		rollsOut:  func(string) bool { return true },
-		onMachine: func(map[string][]string) map[string][]string { return nil },
-		shelf:     func() map[string]catalogue.Manifest { return nil },
-	}
-	if facts == nil {
-		return r
-	}
-	running := map[string][]string{}
-	r.running = func(m string) []string {
-		if on, read := running[m]; read {
-			return on
-		}
-		on, err := facts.Running(ctx, m)
-		if err != nil {
-			cantRead("where "+m+" runs", err)
-		}
-		running[m] = on
-		return on
-	}
-	rolls := map[string]bool{}
-	r.rollsOut = func(m string) bool {
-		if yes, read := rolls[m]; read {
-			return yes
-		}
-		u, err := facts.UpgradeOf(ctx, m)
-		if err != nil {
-			cantRead(m+"'s policy", err)
-		}
-		// A policy that cannot be read is taken to roll out: the walk is then held more, never less.
-		rolls[m] = err != nil || u.RollOut
-		return rolls[m]
-	}
-	r.onMachine = func(moved map[string][]string) map[string][]string {
-		out := map[string][]string{}
-		for _, core := range []string{hostModule, broker.RuntimeModule} {
-			for _, n := range moved[core] {
-				if _, read := out[n]; read {
-					continue
-				}
-				var there []string
-				if sent, known, err := facts.SentBuilds(ctx, n); err != nil {
-					cantRead("what "+n+" was sent", err)
-				} else if known {
-					for m := range sent {
-						there = append(there, m)
-					}
-				}
-				if assigned, err := facts.Assigned(ctx, n); err != nil {
-					cantRead("what "+n+" is assigned", err)
-				} else {
-					there = appendNew(there, assigned...)
-				}
-				sort.Strings(there)
-				out[n] = there
-			}
-		}
-		return out
-	}
-	r.shelf = func() map[string]catalogue.Manifest {
-		shelf, err := facts.Catalogue(ctx)
-		if err != nil {
-			cantRead("the catalogue", err)
-		}
-		return shelf
-	}
-	return r
-}

cmd/mesh-controller/walk_said_test.go

@@ -1,514 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"os"
-	"reflect"
-	"testing"
-	"time"
-
-	"github.com/nats-io/nats.go"
-
-	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-	"github.com/novox/mesh-controller/internal/testbus"
-)
-
-// fakeWalkFacts is the inventory as far as a walk's touches read it.
-type fakeWalkFacts struct {
-	running  map[string][]string
-	records  map[string]bool // modules whose policy records rather than rolls out
-	sent     map[string]map[string]string
-	assigned map[string][]string
-	shelf    map[string]catalogue.Manifest
-}
-
-func (f fakeWalkFacts) Running(_ context.Context, m string) ([]string, error) {
-	return f.running[m], nil
-}
-func (f fakeWalkFacts) UpgradeOf(_ context.Context, m string) (inventory.Upgrade, error) {
-	return inventory.Upgrade{RollOut: !f.records[m]}, nil
-}
-func (f fakeWalkFacts) Assigned(_ context.Context, n string) ([]string, error) {
-	return f.assigned[n], nil
-}
-func (f fakeWalkFacts) SentBuilds(_ context.Context, n string) (map[string]string, bool, error) {
-	s, ok := f.sent[n]
-	return s, ok, nil
-}
-func (f fakeWalkFacts) Catalogue(context.Context) (map[string]catalogue.Manifest, error) {
-	return f.shelf, nil
-}
-
-// theMesh is four machines: the tool runner on each, messenger and mesh-issues on novox, gitea on ace.
-func theMesh() fakeWalkFacts {
-	return fakeWalkFacts{
-		running: map[string][]string{
-			broker.RuntimeModule: {"ace", "g14", "novox", "shanks"},
-			"messenger":          {"novox"},
-			"gitea":              {"ace"},
-			"plex":               {"ace"},
-		},
-		sent: map[string]map[string]string{
-			"novox": {broker.RuntimeModule: "c0", "messenger": "c1", "mesh-issues": "c2", "postgres": "c3"},
-			"ace":   {broker.RuntimeModule: "c0", "gitea": "c4"},
-		},
-		assigned: map[string][]string{"g14": {broker.RuntimeModule, "desktop"}, "shanks": {broker.RuntimeModule}},
-		shelf: map[string]catalogue.Manifest{
-			"messenger":   {Module: "messenger", Tools: []string{"notify"}},
-			"mesh-issues": {Module: "mesh-issues", Bundles: []catalogue.Bundle{{Name: "tools", Loads: []string{"main"}}}},
-			"postgres":    {Module: "postgres"},
-			"gitea":       {Module: "gitea", Tools: []string{"gitea_api"}},
-			"desktop":     {Module: "desktop", Tools: []string{"notify_send"}},
-		},
-	}
-}
-
-func walkOfTiers(class string, tiers ...[]string) inventory.Plan {
-	cut := time.Date(2026, 10, 12, 11, 0, 0, 0, time.UTC)
-	started := cut.Add(time.Second)
-	p := inventory.Plan{ID: "plan-308", State: inventory.PlanBuilding, Tiers: tiers,
-		Modules: map[string]*inventory.PlanModule{}, Times: &inventory.PlanTimes{Cut: &cut, Class: class, Started: &started}}
-	for _, tier := range tiers {
-		for _, m := range tier {
-			p.Modules[m] = &inventory.PlanModule{}
-		}
-	}
-	p.WalkSaid = inventory.WalkStarted
-	return p
-}
-
-// novox/hq ADR 0308 How it is checked §1: the start names the modules the walk moves and the machines it sends
-// them to, and every module a moved tool runner carries there.
-func TestAWalksStartNamesWhatItTouchesWithWhatTheToolRunnerCarries(t *testing.T) {
-	p := walkOfTiers(inventory.ClassCore, []string{broker.RuntimeModule}, []string{"messenger"})
-	w := sayWalk(t.Context(), theMesh(), p)
-	if w == nil || w.Walk != "plan-308" || w.Phase != inventory.WalkStarted || w.Outcome != "" {
-		t.Fatalf("the start is said: %+v", w)
-	}
-	want := []walkTouch{
-		{Machine: "ace", Modules: []string{"gitea", broker.RuntimeModule}, Carried: []string{"gitea"}},
-		{Machine: "g14", Modules: []string{"desktop", broker.RuntimeModule}, Carried: []string{"desktop"}},
-		// postgres serves no tools: the tool runner does not carry it.
-		{Machine: "novox", Modules: []string{"mesh-issues", "messenger", broker.RuntimeModule}, Carried: []string{"mesh-issues"}},
-		{Machine: "shanks", Modules: []string{broker.RuntimeModule}},
-	}
-	if !reflect.DeepEqual(w.Touches, want) {
-		t.Fatalf("touches:\n got %+v\nwant %+v", w.Touches, want)
-	}
-	if w.BudgetClass != inventory.ClassCore || w.BoundSeconds != 1200 || w.StartedAt == nil {
-		t.Fatalf("a core walk is bound at 20 minutes: %+v", w)
-	}
-}
-
-// A moved node-engine carries every module on its machine; a module whose policy records is not sent, and not
-// touched.
-func TestAMovedNodeEngineCarriesEverythingOnItsMachine(t *testing.T) {
-	f := theMesh()
-	f.running[hostModule] = []string{"novox"}
-	f.records = map[string]bool{"plex": true}
-	p := walkOfTiers(inventory.ClassCore, []string{hostModule, "plex"})
-	w := sayWalk(t.Context(), f, p)
-	want := []walkTouch{{Machine: "novox",
-		Modules: []string{"mesh-host", "mesh-issues", "messenger", "node-tools", "postgres"},
-		Carried: []string{"mesh-issues", "messenger", "node-tools", "postgres"}}}
-	if !reflect.DeepEqual(w.Touches, want) {
-		t.Fatalf("touches:\n got %+v\nwant %+v", w.Touches, want)
-	}
-}
-
-// The end names what the walk reached — its first machines, its rest, what a gated send carried — and its
-// outcome; the modules a reached tool runner carries are touched there too.
-func TestAWalksEndNamesWhatItReachedAndItsOutcome(t *testing.T) {
-	p := walkOfTiers(inventory.ClassCore, []string{broker.RuntimeModule}, []string{"messenger"})
-	ended := p.Times.Started.Add(4 * time.Minute)
-	p.Times.Ended = &ended
-	p.State, p.WalkSaid = inventory.PlanDone, inventory.WalkEnded
-	p.Modules[broker.RuntimeModule] = &inventory.PlanModule{First: []string{"shanks"},
-		Rest: map[string]inventory.SentDeclaration{"novox": {}},
-		Gate: &inventory.PlanGate{Carried: []inventory.CarriedMove{{Module: "gitea", Node: "shanks"}}}}
-	// messenger was built and found unchanged: no move, not reached.
-	p.Modules["messenger"] = &inventory.PlanModule{Why: "no move"}
-	w := sayWalk(t.Context(), theMesh(), p)
-	if w.Phase != inventory.WalkEnded || w.Outcome != inventory.WalkDelivered || w.EndedAt == nil {
-		t.Fatalf("the end is said with its outcome: %+v", w)
-	}
-	want := []walkTouch{
-		{Machine: "novox", Modules: []string{"mesh-issues", "messenger", broker.RuntimeModule},
-			Carried: []string{"mesh-issues", "messenger"}},
-		{Machine: "shanks", Modules: []string{"gitea", broker.RuntimeModule}},
-	}
-	if !reflect.DeepEqual(w.Touches, want) {
-		t.Fatalf("touches:\n got %+v\nwant %+v", w.Touches, want)
-	}
-	for outcome, end := range map[string]func(*inventory.Plan){
-		inventory.WalkFailed: func(p *inventory.Plan) { p.State = inventory.PlanFailed },
-		inventory.WalkStopped: func(p *inventory.Plan) {
-			p.State, p.Delivery = inventory.PlanFailed, &inventory.PlanDelivery{Stopped: "a person"}
-		},
-	} {
-		q := p
-		end(&q)
-		if got := sayWalk(t.Context(), theMesh(), q).Outcome; got != outcome {
-			t.Errorf("outcome %q, want %q", got, outcome)
-		}
-	}
-}
-
-// novox/hq ADR 0308 How it is checked §1 and decision 5: the bound is twice the largest budget in force among
-// the walk's deliveries — 20 minutes for a core walk, twice the leaf budget for a leaf walk — and 15 minutes, not
-// doubled, for a walk none of whose deliveries has a budget.
-func TestAWalksBoundIsTwiceItsBudgetOrFifteenMinutesWithNone(t *testing.T) {
-	f := theMesh()
-	f.records = map[string]bool{"plex": true}
-	release := walkOfTiers("", []string{"gitea"})
-	release.Times, release.Release = &inventory.PlanTimes{}, &inventory.PlanRelease{Order: []string{"ace"}}
-	for name, c := range map[string]struct {
-		p     inventory.Plan
-		class string
-		bound int
-	}{
-		"core":                 {walkOfTiers(inventory.ClassCore, []string{"messenger"}), inventory.ClassCore, 1200},
-		"leaf":                 {walkOfTiers(inventory.ClassLeaf, []string{"messenger"}), inventory.ClassLeaf, int(2 * deliveryBudgets[inventory.ClassLeaf] / time.Second)},
-		"held for a person":    {walkOfTiers(inventory.ClassLeaf, []string{"plex"}), budgetNone, 900},
-		"a release":            {release, budgetNone, 900},
-		"kept without a class": {walkOfTiers("", []string{"messenger"}), budgetNone, 900},
-	} {
-		w := sayWalk(t.Context(), f, c.p)
-		if w.BudgetClass != c.class || w.BoundSeconds != c.bound {
-			t.Errorf("%s: %s bound %ds, want %s %ds", name, w.BudgetClass, w.BoundSeconds, c.class, c.bound)
-		}
-	}
-	// The leaf budget in force is three minutes (ADR 0304 decision 4): a leaf walk is bound at six.
-	if deliveryBudgets[inventory.ClassLeaf] == 3*time.Minute {
-		if w := sayWalk(t.Context(), f, walkOfTiers(inventory.ClassLeaf, []string{"messenger"})); w.BoundSeconds != 360 {
-			t.Errorf("a leaf walk at a three-minute budget is bound at 360 s: %d", w.BoundSeconds)
-		}
-	}
-}
-
-// plan-moved's body: the walk whole as before, and on its start the walk's fields beside it; on any other save
-// none of them.
-func TestPlanMovedCarriesTheWalkWholeAndOnItsStartWhatItTouches(t *testing.T) {
-	p := walkOfTiers(inventory.ClassLeaf, []string{"messenger"})
-	body, err := json.Marshal(planMovedBody{Plan: p, walkSaid: sayWalk(t.Context(), theMesh(), p)})
-	if err != nil {
-		t.Fatal(err)
-	}
-	var said map[string]any
-	if err := json.Unmarshal(body, &said); err != nil {
-		t.Fatal(err)
-	}
-	for _, k := range []string{"id", "state", "tiers", "modules", "times", "walk", "phase", "touches", "bound_seconds", "budget_class", "started_at"} {
-		if _, ok := said[k]; !ok {
-			t.Errorf("plan-moved lacks %q: %s", k, body)
-		}
-	}
-	if _, ok := said["outcome"]; ok {
-		t.Errorf("a start says no outcome: %s", body)
-	}
-	if said["walk"] != "plan-308" || said["phase"] != "started" || said["budget_class"] != "leaf" {
-		t.Errorf("the walk's fields: %s", body)
-	}
-	p.WalkSaid = ""
-	body, _ = json.Marshal(planMovedBody{Plan: p, walkSaid: sayWalk(t.Context(), theMesh(), p)})
-	said = map[string]any{}
-	_ = json.Unmarshal(body, &said)
-	for _, k := range []string{"walk", "phase", "touches", "bound_seconds"} {
-		if _, ok := said[k]; ok {
-			t.Errorf("a save neither starting nor ending the walk says %q: %s", k, body)
-		}
-	}
-	// A walk that touches nothing says an empty list, never null.
-	q := walkOfTiers(inventory.ClassLeaf, []string{"nobody-runs-this"})
-	body, _ = json.Marshal(planMovedBody{Plan: q, walkSaid: sayWalk(t.Context(), theMesh(), q)})
-	said = map[string]any{}
-	_ = json.Unmarshal(body, &said)
-	if touches, ok := said["touches"].([]any); !ok || len(touches) != 0 {
-		t.Errorf("touches nothing: %s", body)
-	}
-}
-
-// Live, with the store and a bus: a walk let go by the delivery's verb is said started with what it touches and
-// its bound, and stopped by the verb is said ended, stopped (novox/hq ADR 0308 How it is checked §1).
-func TestAWalkLetGoAndStoppedByVerbsIsSaidStartedAndEnded(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	next := planMovedHeard(t)
-	register(t, open, catalogue.Manifest{Module: "app", Version: "1"})
-	if _, err := assign(ctx, open, "anchor", "app"); err != nil {
-		t.Fatal(err)
-	}
-	cut := time.Now().UTC()
-	waiting := inventory.Plan{ID: "plan-308-live", Repository: "novox/mesh-catalog", Branch: "main", Commit: "c8c8c8c8",
-		Created: cut, State: inventory.PlanBuilding, Tiers: [][]string{{"app"}},
-		Modules:  map[string]*inventory.PlanModule{"app": {}},
-		Delivery: &inventory.PlanDelivery{Awaits: catalogue.DeliverySeat},
-		Times:    &inventory.PlanTimes{Cut: &cut, Class: inventory.ClassLeaf}}
-	if err := open.inventory.SavePlan(ctx, &waiting); err != nil {
-		t.Fatal(err)
-	}
-	if err := deliveryCommand(ctx, []string{"go", waiting.ID, "--why", "its turn"}); err != nil {
-		t.Fatal(err)
-	}
-	started := next(inventory.WalkStarted)
-	touches, _ := json.Marshal(started["touches"])
-	if started["walk"] != waiting.ID || string(touches) != `[{"machine":"anchor","modules":["app"]}]` ||
-		started["budget_class"] != inventory.ClassLeaf ||
-		started["bound_seconds"] != float64(2*deliveryBudgets[inventory.ClassLeaf]/time.Second) {
-		t.Fatalf("the start: %v", started)
-	}
-	if err := deliveryCommand(ctx, []string{"stop", waiting.ID, "--why", "a test", "--by", "a person"}); err != nil {
-		t.Fatal(err)
-	}
-	ended := next(inventory.WalkEnded)
-	touches, _ = json.Marshal(ended["touches"])
-	if ended["walk"] != waiting.ID || ended["outcome"] != inventory.WalkStopped || string(touches) != `[]` {
-		t.Fatalf("the end, which sent nothing: %v", ended)
-	}
-}
-
-// planMovedHeard raises a bus of the test's own, points the verbs' hand-act connection at it, and returns what
-// waits for the next plan-moved said with the given phase, failing the test when none comes within 5 s.
-func planMovedHeard(t *testing.T) func(phase string) map[string]any {
-	t.Helper()
-	js, err := broker.Dial(testbus.URL(t))
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(js.Close)
-	if err := broker.AssertMeshStreams(js); err != nil {
-		t.Fatal(err)
-	}
-	before := handActConn
-	handActConn = js.Conn()
-	t.Cleanup(func() { handActConn = before })
-	heard := make(chan *nats.Msg, 64)
-	sub, err := js.Conn().ChanSubscribe(link.SeatEventSubject(link.MeshControllerSeat, link.KeyPlanMoved), heard)
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { _ = sub.Unsubscribe() })
-	return func(phase string) map[string]any {
-		t.Helper()
-		deadline := time.After(5 * time.Second)
-		for {
-			select {
-			case m := <-heard:
-				var said map[string]any
-				if err := json.Unmarshal(m.Data, &said); err != nil {
-					t.Fatal(err)
-				}
-				if said["phase"] == phase {
-					return said
-				}
-			case <-deadline:
-				t.Fatalf("no walk was said %s", phase)
-			}
-		}
-	}
-}
-
-// Live, with the store and a bus: a walk a person stops with `plans stop` is said ended, outcome stopped, by the
-// verb itself, and is kept stopped by that person; `plans close` ends one the same way (novox/hq ADR 0308
-// decision 1, review 15 on mesh-controller#247).
-func TestAWalkStoppedOrClosedByAPersonIsSaidEndedStopped(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	next := planMovedHeard(t)
-	register(t, open, catalogue.Manifest{Module: "app", Version: "1"})
-	if _, err := assign(ctx, open, "anchor", "app"); err != nil {
-		t.Fatal(err)
-	}
-	for _, verb := range []string{"stop", "close"} {
-		cut := time.Now().UTC()
-		walk := inventory.Plan{ID: "plan-308-" + verb, Repository: "novox/mesh-catalog", Branch: "main",
-			Commit: "c8c8c8c8", Created: cut, State: inventory.PlanBuilding, Tiers: [][]string{{"app"}},
-			Modules: map[string]*inventory.PlanModule{"app": {}},
-			Times:   &inventory.PlanTimes{Cut: &cut, Started: &cut, Class: inventory.ClassLeaf}}
-		if err := open.inventory.SavePlan(ctx, &walk); err != nil {
-			t.Fatal(err)
-		}
-		if err := plansCommand(ctx, []string{verb, walk.ID, "--why", "a test"}); err != nil {
-			t.Fatal(err)
-		}
-		ended := next(inventory.WalkEnded)
-		if ended["walk"] != walk.ID || ended["outcome"] != inventory.WalkStopped {
-			t.Fatalf("plans %s: the end is %v", verb, ended)
-		}
-		p, err := open.inventory.PlanByID(ctx, walk.ID)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if p.Outcome() != inventory.WalkStopped || p.Delivery == nil || p.Delivery.StoppedWhy != "a test" {
-			t.Fatalf("plans %s kept the walk %s, %+v", verb, p.Outcome(), p.Delivery)
-		}
-	}
-}
-
-// Live, with the store and a bus: a failed walk retried with `plans retry` starts again, and the verb says its
-// start (novox/hq ADR 0308 decision 1, review 15 on mesh-controller#247).
-func TestAWalkRetriedByAPersonIsSaidStartedAgain(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	asksRecorded(t)
-	next := planMovedHeard(t)
-	twoTiers(t, open)
-	before := time.Now().UTC().Add(-time.Hour)
-	ended := before.Add(time.Minute)
-	failed := inventory.Plan{ID: "plan-308-retry", Repository: "novox/a", Branch: "main", Commit: "c0ffee",
-		Created: before, State: inventory.PlanFailed, Tier: 0, Tiers: [][]string{{"a"}, {"b"}},
-		Note: "a failed to build in tier 0",
-		Modules: map[string]*inventory.PlanModule{"a": {State: "failed", AskedAt: &before, Build: "build-1",
-			Why: link.KilledByHand}},
-		Times: &inventory.PlanTimes{Cut: &before, Started: &before, Ended: &ended, Class: inventory.ClassLeaf}}
-	if err := open.inventory.SavePlan(ctx, &failed); err != nil {
-		t.Fatal(err)
-	}
-	if err := plansCommand(ctx, []string{"retry", failed.ID}); err != nil {
-		t.Fatal(err)
-	}
-	started := next(inventory.WalkStarted)
-	if started["walk"] != failed.ID || started["budget_class"] != inventory.ClassLeaf {
-		t.Fatalf("the retried start: %v", started)
-	}
-}
-
-// Live, with the store and a bus: the release plan `upgrade release-backlog` opens is said started by the verb
-// (novox/hq ADR 0308 decision 1, review 15 on mesh-controller#247).
-func TestABacklogReleasedByAPersonIsSaidStarted(t *testing.T) {
-	b := aBacklog(t)
-	next := planMovedHeard(t)
-	if err := backlogCommand(t.Context(), "release-backlog", []string{"--why", "a test"}); err != nil {
-		t.Fatal(err)
-	}
-	started := next(inventory.WalkStarted)
-	if p := b.release(t); started["walk"] != p.ID {
-		t.Fatalf("the release's start: %v", started)
-	}
-}
-
-// asTyped runs a verb as the controller's command line runs it, through run, as a person's terminal would.
-func asTyped(t *testing.T, args ...string) error {
-	t.Helper()
-	was := os.Args
-	os.Args = append([]string{"mesh-controller"}, args...)
-	t.Cleanup(func() { os.Args = was })
-	err := run()
-	// run gives back the lease as the process would end; the test's process goes on, and takes it again.
-	theLease.mu.Lock()
-	theLease.held, theLease.kv, theLease.noBus = nil, nil, false
-	theLease.mu.Unlock()
-	return err
-}
-
-// aStartedWalkAsking keeps a live walk, said started, whose first tier asked a as build.
-func aStartedWalkAsking(t *testing.T, open *stores, id, build string, asked time.Time) inventory.Plan {
-	t.Helper()
-	walk := inventory.Plan{ID: id, Repository: "novox/a", Branch: "main", Commit: "c0ffee", Created: asked,
-		State: inventory.PlanBuilding, Tiers: [][]string{{"a"}, {"b"}},
-		Modules: map[string]*inventory.PlanModule{"a": {State: "asked", AskedAt: &asked, Build: build}},
-		Times:   &inventory.PlanTimes{Cut: &asked, Started: &asked, Class: inventory.ClassLeaf}}
-	if err := open.inventory.SavePlan(t.Context(), &walk); err != nil {
-		t.Fatal(err)
-	}
-	return walk
-}
-
-// Live, with the store and a bus: `cancel <build>` and `clear` fail the walk that asked the build, and the verb
-// says its end, failed (novox/hq ADR 0308 decision 1, review 21 on mesh-controller#247).
-func TestAWalkEndedByCancelOrClearIsSaidEnded(t *testing.T) {
-	_, ask := aBuildQueue(t)
-	open := aMesh(t)
-	next := planMovedHeard(t)
-	twoTiers(t, open)
-	for _, verb := range [][]string{{"cancel"}, {"clear"}} {
-		id := link.NewBuildID(time.Now())
-		ask(id, "https://forge.example/novox/a.git")
-		asked, _ := link.BuildAskedAt(id)
-		walk := aStartedWalkAsking(t, open, "plan-308-"+verb[0], id, asked)
-		args := verb
-		if verb[0] == "cancel" {
-			args = append(args, id)
-		}
-		if err := asTyped(t, args...); err != nil {
-			t.Fatal(err)
-		}
-		ended := next(inventory.WalkEnded)
-		if ended["walk"] != walk.ID || ended["outcome"] != inventory.WalkFailed {
-			t.Fatalf("%s: the end is %v", verb[0], ended)
-		}
-		// Ended, and so the next walk may be cut on the same repository.
-		p, _ := open.inventory.PlanByID(t.Context(), walk.ID)
-		if p.State != inventory.PlanFailed {
-			t.Fatalf("%s left the walk %s", verb[0], p.State)
-		}
-	}
-}
-
-// Live, with the store and a bus: `rebuild <module>` joining a failed walk sets it building again, and the verb
-// says its start (novox/hq ADR 0308 decision 1, review 21 on mesh-controller#247).
-func TestAWalkRestartedByARebuildIsSaidStarted(t *testing.T) {
-	open := aMesh(t)
-	asksRecorded(t)
-	next := planMovedHeard(t)
-	twoTiers(t, open)
-	before := time.Now().UTC().Add(-time.Hour)
-	ended := before.Add(time.Minute)
-	failed := inventory.Plan{ID: "plan-308-rebuild", Repository: "novox/a", Branch: "main", Commit: "c0ffee",
-		Created: before, State: inventory.PlanFailed, Tiers: [][]string{{"a"}, {"b"}},
-		Modules: map[string]*inventory.PlanModule{"a": {State: "failed", AskedAt: &before, Build: "build-1",
-			Why: link.CancelledByHand}},
-		Times: &inventory.PlanTimes{Cut: &before, Started: &before, Ended: &ended, Class: inventory.ClassLeaf}}
-	if err := open.inventory.SavePlan(t.Context(), &failed); err != nil {
-		t.Fatal(err)
-	}
-	if err := asTyped(t, "rebuild", "a"); err != nil {
-		t.Fatal(err)
-	}
-	if started := next(inventory.WalkStarted); started["walk"] != failed.ID {
-		t.Fatalf("the rebuilt walk's start: %v", started)
-	}
-}
-
-// Live, with the store: a walk a person stopped and then retried, by `plans retry` or by `rebuild`, walks again
-// without the stop, so when it fails again it ends failed, not stopped, and the search for the merge that
-// brought the failure is not kept from it (novox/hq ADR 0308 decision 1, review 21 on mesh-controller#247).
-func TestAWalkStoppedByHandAndRetriedEndsFailedWhenItFailsAgain(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	asksRecorded(t)
-	twoTiers(t, open)
-	for _, again := range [][]string{{"plans", "retry"}, {"rebuild", "a"}} {
-		before := time.Now().UTC().Add(-time.Hour)
-		walk := aStartedWalkAsking(t, open, "plan-308-again-"+again[0], "build-1", before)
-		if err := asTyped(t, "plans", "stop", walk.ID, "--why", "a test"); err != nil {
-			t.Fatal(err)
-		}
-		// The build asked before the stop fails after it.
-		p, _ := open.inventory.PlanByID(ctx, walk.ID)
-		p.Modules["a"].State, p.Modules["a"].Why = "failed", "it broke"
-		if err := open.inventory.SavePlan(ctx, &p); err != nil {
-			t.Fatal(err)
-		}
-		args := again
-		if again[0] == "plans" {
-			args = append(append([]string(nil), again...), walk.ID)
-		}
-		if err := asTyped(t, args...); err != nil {
-			t.Fatal(err)
-		}
-		p, _ = open.inventory.PlanByID(ctx, walk.ID)
-		if p.State != inventory.PlanBuilding || (p.Delivery != nil && p.Delivery.Stopped != "") {
-			t.Fatalf("%s: the walk is %s and keeps its stop: %+v", again[0], p.State, p.Delivery)
-		}
-		asking, _ := link.BuildAskedAt(p.Modules["a"].Build)
-		planBuilt(ctx, open, "a", "c0ffee", "it broke again", asking, p.Modules["a"].Build)
-		if p, _ = open.inventory.PlanByID(ctx, walk.ID); p.State != inventory.PlanFailed || p.Outcome() != inventory.WalkFailed {
-			t.Fatalf("%s: failing again, the walk is %s and ends %s", again[0], p.State, p.Outcome())
-		}
-	}
-}

go.mod

@@ -8,7 +8,6 @@ require (
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 	github.com/novox/mesh-host v0.0.0
-	github.com/therootcompany/xz v1.0.1
 	golang.org/x/crypto v0.57.0
 	golang.org/x/net v0.58.0
 	golang.org/x/sys v0.48.0

go.sum

@@ -38,8 +38,6 @@ github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UV
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/therootcompany/xz v1.0.1 h1:CmOtsn1CbtmyYiusbfmhmkpAAETj0wBIH6kCYaX+xzw=
-github.com/therootcompany/xz v1.0.1/go.mod h1:3K3UH1yCKgBneZYhuQUvJ9HPD19UEXEI0BWbMn8qNMY=
 golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
 golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
 golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=

internal/broker/nats.go

@@ -262,12 +262,9 @@ func MaySubscribe(perms Permissions, subject string) bool {
 // delivery held past its bound, and calls them on the operator's warrant, with its why.
 //
 // And, since novox/hq ADR 0282, `times`: the self-check reads the delivery times to say a delivery over its budget.
-//
-// And, since novox/hq ADR 0306, `groups`: a merge heard from a head waits for the window while its delivery group
-// has a member still to merge.
 var VerbsTheControllerAsksTheDeliveryOwner = []SeatVerb{{Seat: "mesh-delivery", Verb: "stalled"},
 	{Seat: "mesh-delivery", Verb: "close"}, {Seat: "mesh-delivery", Verb: "release"}, {Seat: "mesh-delivery", Verb: "stop"},
-	{Seat: "mesh-delivery", Verb: "times"}, {Seat: "mesh-delivery", Verb: "groups"}}
+	{Seat: "mesh-delivery", Verb: "times"}}
 
 // VerbsTheControllerActsOnAWarrant are the other seat verbs the controller calls when the operator's warrant
 // chooses them (novox/hq ADR 0259): a machine's service restarted, and a walk started or stopped through the
@@ -336,13 +333,6 @@ func AskHandOverSubject(node string) string { return "mesh.node." + node + ".ask
 // a hand-over is (link.SetuidSearchContext), for the same reason.
 func AskSetuidSearchSubject(node string) string { return "mesh.node." + node + ".ask.setuid-search" }
 
-// AskJudgeDirectoriesSubject is where the controller asks one machine's node-engine to judge, read-only, which of
-// its declared directories the walk that follows no link another account could make would refuse (novox/hq issue
-// 358): a request answered once, signed as a hand-over is (link.JudgeDirectoriesContext), for the same reason.
-func AskJudgeDirectoriesSubject(node string) string {
-	return "mesh.node." + node + ".ask.judge-directories"
-}
-
 // inbox is a principal's own reply space. No user is ever granted a bare `_INBOX.>` (design 25
 // §4): with one account, inbox privacy is the permission list or it is nothing, so each user's
 // inbox is derived from its own identity and its permissions name that prefix and no other.
@@ -621,9 +611,7 @@ func PermissionsFor(p Principal) (Permissions, error) {
 			// issue 356), which it answers on the request's reply: the one request a node is asked.
 			AskHandOverSubject(p.Node),
 			// And asking it for a fresh search for setuid programs (novox/hq issue 361), answered the same way.
-			AskSetuidSearchSubject(p.Node),
-			// And asking it to judge its declared directories, read-only (novox/hq issue 358), answered the same way.
-			AskJudgeDirectoriesSubject(p.Node)}
+			AskSetuidSearchSubject(p.Node)}
 		// The node-engine witnesses the core builds it places (novox/hq to-be 45 §8, ADR 0236; the
 		// contract is lease/witness.go): it asks its own machine's node tools PING, and, where the
 		// machine runs the controller, reads the lease's one key — read, never written.

internal/broker/nats_test.go

@@ -114,9 +114,7 @@ func TestOnlyWhatCanBeAskedMayAnswer(t *testing.T) {
 	node, _ := PermissionsFor(Principal{Kind: KindNode, Node: "one", PasswordHash: "x"})
 	if !node.AllowResponses || !slices.Contains(node.Subscribe, AskHandOverSubject("one")) ||
 		!slices.Contains(node.Subscribe, AskSetuidSearchSubject("one")) ||
-		slices.Contains(node.Subscribe, AskSetuidSearchSubject("two")) ||
-		!slices.Contains(node.Subscribe, AskJudgeDirectoriesSubject("one")) ||
-		slices.Contains(node.Subscribe, AskJudgeDirectoriesSubject("two")) {
+		slices.Contains(node.Subscribe, AskSetuidSearchSubject("two")) {
 		t.Fatalf("a node cannot answer the hand-over it is asked: %v %v", node.AllowResponses, node.Subscribe)
 	}
 	person, _ := PermissionsFor(Principal{Kind: KindPerson, Node: "one", Module: "jo", PasswordHash: "x"})

internal/broker/testdata/composed.conf

@@ -24,7 +24,7 @@ accounts {
     jetstream: enabled
     users = [
       { user: "controller", password: "$2a$11$cccccccccccccccccccccc", permissions: {
-        publish: { allow: ["$JS.ACK.CONTROL.controller.>", "$JS.ACK.DEAD_LETTER_NOTICES.controller.>", "$JS.ACK.EVENTS.controller.>", "$JS.API.>", "$KV.SEAT_MESH_BUILD_MACHINE_cancelled.>", "$KV.SEAT_NODE_BUILD_AGENT_cancelled.>", "$KV.mesh-controller_asked.>", "$KV.mesh-controller_calls.>", "$KV.mesh-controller_condition-history.>", "$KV.mesh-controller_conditions.>", "$KV.mesh-controller_hand-acts.>", "$KV.mesh-controller_lease.>", "$SRV.INFO", "_INBOX.enrol.>", "mesh.again.>", "mesh.assignment.>", "mesh.events.dead.>", "mesh.mod.*.tool.>", "mesh.node.>", "mesh.seat.mesh-build-machine.accept.>", "mesh.seat.mesh-build-machine.tool.>", "mesh.seat.mesh-controller.event.applied", "mesh.seat.mesh-controller.event.built-before", "mesh.seat.mesh-controller.event.checked", "mesh.seat.mesh-controller.event.condition-changed", "mesh.seat.mesh-controller.event.condition-cleared", "mesh.seat.mesh-controller.event.condition-raised", "mesh.seat.mesh-controller.event.doctor-heartbeat", "mesh.seat.mesh-controller.event.healer-acted", "mesh.seat.mesh-controller.event.plan-moved", "mesh.seat.mesh-controller.event.refused", "mesh.seat.mesh-controller.event.rolled-back", "mesh.seat.mesh-controller.event.secret-replaced", "mesh.seat.mesh-controller.tool.plans", "mesh.seat.mesh-delivery.tool.close", "mesh.seat.mesh-delivery.tool.groups", "mesh.seat.mesh-delivery.tool.release", "mesh.seat.mesh-delivery.tool.stalled", "mesh.seat.mesh-delivery.tool.stop", "mesh.seat.mesh-delivery.tool.times", "mesh.seat.node-backup.tool.backed-up.*", "mesh.seat.node-backup.tool.now.*", "mesh.seat.node-build-agent.accept.>", "mesh.seat.node-build-agent.tool.>", "mesh.seat.node-intrusion-prevention.tool.banned.*", "mesh.seat.node-launcher.tool.secret.*", "mesh.seat.node-service-manager.tool.restart.*"] }
+        publish: { allow: ["$JS.ACK.CONTROL.controller.>", "$JS.ACK.DEAD_LETTER_NOTICES.controller.>", "$JS.ACK.EVENTS.controller.>", "$JS.API.>", "$KV.SEAT_MESH_BUILD_MACHINE_cancelled.>", "$KV.SEAT_NODE_BUILD_AGENT_cancelled.>", "$KV.mesh-controller_asked.>", "$KV.mesh-controller_calls.>", "$KV.mesh-controller_condition-history.>", "$KV.mesh-controller_conditions.>", "$KV.mesh-controller_hand-acts.>", "$KV.mesh-controller_lease.>", "$SRV.INFO", "_INBOX.enrol.>", "mesh.again.>", "mesh.assignment.>", "mesh.events.dead.>", "mesh.mod.*.tool.>", "mesh.node.>", "mesh.seat.mesh-build-machine.accept.>", "mesh.seat.mesh-build-machine.tool.>", "mesh.seat.mesh-controller.event.applied", "mesh.seat.mesh-controller.event.built-before", "mesh.seat.mesh-controller.event.checked", "mesh.seat.mesh-controller.event.condition-changed", "mesh.seat.mesh-controller.event.condition-cleared", "mesh.seat.mesh-controller.event.condition-raised", "mesh.seat.mesh-controller.event.doctor-heartbeat", "mesh.seat.mesh-controller.event.healer-acted", "mesh.seat.mesh-controller.event.plan-moved", "mesh.seat.mesh-controller.event.refused", "mesh.seat.mesh-controller.event.rolled-back", "mesh.seat.mesh-controller.event.secret-replaced", "mesh.seat.mesh-controller.tool.plans", "mesh.seat.mesh-delivery.tool.close", "mesh.seat.mesh-delivery.tool.release", "mesh.seat.mesh-delivery.tool.stalled", "mesh.seat.mesh-delivery.tool.stop", "mesh.seat.mesh-delivery.tool.times", "mesh.seat.node-backup.tool.backed-up.*", "mesh.seat.node-backup.tool.now.*", "mesh.seat.node-build-agent.accept.>", "mesh.seat.node-build-agent.tool.>", "mesh.seat.node-intrusion-prevention.tool.banned.*", "mesh.seat.node-launcher.tool.secret.*", "mesh.seat.node-service-manager.tool.restart.*"] }
         subscribe: { allow: ["$JS.API.>", "$JS.EVENT.ADVISORY.CONSUMER.DELETED.>", "$JS.EVENT.ADVISORY.CONSUMER.MAX_DELIVERIES.>", "$SRV.INFO", "$SRV.INFO.mesh-controller", "$SRV.INFO.mesh-controller.>", "$SRV.PING", "$SRV.PING.mesh-controller", "$SRV.PING.mesh-controller.>", "$SRV.STATS", "$SRV.STATS.mesh-controller", "$SRV.STATS.mesh-controller.>", "_DELIVER.controller", "_DELIVER.controller.>", "_INBOX.controller.>", "mesh.control.>", "mesh.mod.*.event.provisioner.failing", "mesh.mod.*.event.provisioner.recovered", "mesh.mod.*.event.provisioner.retirement", "mesh.mod.gitea.event.pull.merged", "mesh.mod.gitea.event.pull.updated", "mesh.mod.mesh-catalog.event.catching-up", "mesh.mod.mesh-catalog.event.upgraded", "mesh.seat.mesh-build-machine.event.built", "mesh.seat.mesh-controller.tool.>", "mesh.seat.node-build-agent.event.built", "mesh.seat.operator-channel.event.decided.mesh-controller"] }
         allow_responses: { max: 1, ttl: "1m" }
       } }
@@ -34,7 +34,7 @@ accounts {
       } }
       { user: "node.one", password: "$2a$11$nnnnnnnnnnnnnnnnnnnnnn", permissions: {
         publish: { allow: ["$JS.ACK.NODES.one.>", "$JS.API.CONSUMER.INFO.NODES.one", "$SRV.PING.node-tools.one", "mesh.control.one.>"] }
-        subscribe: { allow: ["_DELIVER.one", "_DELIVER.one.>", "_INBOX.node.one.>", "mesh.node.one.ask.hand-over", "mesh.node.one.ask.judge-directories", "mesh.node.one.ask.report", "mesh.node.one.ask.setuid-search", "mesh.node.one.declare"] }
+        subscribe: { allow: ["_DELIVER.one", "_DELIVER.one.>", "_INBOX.node.one.>", "mesh.node.one.ask.hand-over", "mesh.node.one.ask.report", "mesh.node.one.ask.setuid-search", "mesh.node.one.declare"] }
         allow_responses: { max: 1, ttl: "1m" }
       } }
       { user: "one.nats", password: "$2a$11$bbbbbbbbbbbbbbbbbbbbbb", permissions: {

internal/broker/writers.go

@@ -96,11 +96,6 @@ var WritersTable = []WriterRow{
 	{State: "a fresh setuid search asked of a machine", Writer: "controller, at its terminal",
 		KeptIn: "the machine, which throws its last search away", Others: "the engine verifies the mesh's signature and starts it, or refuses",
 		Subjects: []string{"mesh.node.*.ask.setuid-search"}, Writes: isController},
-	// A read-only judgement of a machine's declared directories asked of its engine (novox/hq issue 358): signed as a
-	// hand-over is, under a signing context of its own. It changes nothing on the machine.
-	{State: "a judgement of a machine's directories asked of it", Writer: "controller",
-		KeptIn: "nowhere: the engine answers it and keeps nothing", Others: "the engine verifies the mesh's signature and answers, or refuses",
-		Subjects: []string{"mesh.node.*.ask.judge-directories"}, Writes: isController},
 	{State: "a machine's applied state and its report", Writer: "the node-engine's apply queue",
 		KeptIn: "the machine; the report on the bus", Others: "the reconcile and a delivery enqueue, never apply",
 		// And its health statement between reports (novox/hq ADR 0240): the same writer stating the same

internal/broker/writers_test.go

@@ -17,7 +17,6 @@ var designRows = []string{
 	"a machine's declaration",
 	"a hand-over asked of a machine",
 	"a fresh setuid search asked of a machine",
-	"a judgement of a machine's directories asked of it",
 	"a machine's applied state and its report",
 	"the controller lease",
 	"plans and their tiers",
@@ -187,21 +186,3 @@ func TestASetuidSearchAskHasOnePublisher(t *testing.T) {
 		}
 	}
 }
-
-// **A judgement of a machine's directories asked of it has one publisher, the controller** (novox/hq issue 358), as a
-// hand-over has.
-func TestADirectoryJudgementAskHasOnePublisher(t *testing.T) {
-	for _, p := range []Principal{
-		{Kind: KindNode, Node: "laptop"},
-		{Kind: KindNodeTools, Node: "laptop", Module: RuntimeModule},
-		{Kind: KindModule, Node: "laptop", Module: "notes"},
-	} {
-		err := CheckWriters(p, []string{AskJudgeDirectoriesSubject("laptop")})
-		if err == nil || !strings.Contains(err.Error(), "a judgement of a machine's directories asked of it") {
-			t.Errorf("%s may ask a judgement of directories: %v", p.Username(), err)
-		}
-	}
-	if err := CheckWriters(Principal{Kind: KindController}, []string{AskJudgeDirectoriesSubject("laptop")}); err != nil {
-		t.Fatalf("the controller may not ask a judgement: %v", err)
-	}
-}

internal/builder/upstream_file.go

@@ -14,13 +14,13 @@ import (
 	"io"
 	"net/http"
 	"os"
+	"os/exec"
 	"path"
 	"path/filepath"
 	"strings"
 	"time"
 
 	"github.com/novox/mesh-controller/internal/catalogue"
-	"github.com/therootcompany/xz"
 )
 
 // An archive whose source is somebody else's published file, pinned by URL and sha256 (novox/hq ADR 0316
@@ -183,6 +183,7 @@ func unpackUpstream(ctx context.Context, file, into, within string) error {
 	buffered := bufio.NewReader(f)
 	magic, _ := buffered.Peek(6)
 	var stream io.Reader
+	var wait func() error
 	switch {
 	case bytes.HasPrefix(magic, []byte{0x1f, 0x8b}):
 		zipped, err := gzip.NewReader(buffered)
@@ -194,33 +195,53 @@ func unpackUpstream(ctx context.Context, file, into, within string) error {
 	case bytes.HasPrefix(magic, []byte("BZh")):
 		stream = bzip2.NewReader(buffered)
 	case bytes.HasPrefix(magic, []byte{0xfd, '7', 'z', 'X', 'Z', 0x00}):
-		// Read in Go (github.com/therootcompany/xz, a port of xz-embedded), never by a tool the build seat's image
-		// may not carry: the seat's image is the catalogue's build-agent recipe, which installs git and docker-cli
-		// alone, and a release pinned as .tar.xz failed there on 2026-10-12 (hq issue 345). xzDictMax is a real
-		// maximum: a block whose LZMA2 dictionary is larger is refused before its dictionary is allocated
-		// (ErrMemlimit). The reader keeps a filter decoder for every block of a stream, so the file's framing is
-		// walked first and a file of more blocks than xzBlocksMax is refused before anything is decoded
-		// (xz_framing.go). What the stream unpacks to is bounded by untar (maxUpstream, maxEntries).
-		if err := xzWithinLimits(file); err != nil {
+		// Go's standard library reads no xz; the build seat's image carries xz (cmd/mesh-builder/Dockerfile).
+		if _, err := exec.LookPath("xz"); err != nil {
+			return errors.New("it is compressed with xz, and this build seat has no xz to read it")
+		}
+		cmd := exec.CommandContext(ctx, "xz", "-dc")
+		cmd.Stdin = buffered
+		var stderr bytes.Buffer
+		cmd.Stderr = &stderr
+		out, err := cmd.StdoutPipe()
+		if err != nil {
 			return err
 		}
-		zipped, err := xz.NewReader(buffered, xzDictMax)
-		if err != nil {
-			return fmt.Errorf("it is not an xz stream this build seat reads (a dictionary of %d MiB at most): %v",
-				xzDictMax>>20, err)
+		if err := cmd.Start(); err != nil {
+			return err
 		}
-		stream = zipped
+		stream = out
+		wait = func() error {
+			if err := cmd.Wait(); err != nil {
+				return fmt.Errorf("xz could not read it: %v %s", err, strings.TrimSpace(stderr.String()))
+			}
+			return nil
+		}
+		defer func() {
+			if wait != nil {
+				_ = cmd.Process.Kill()
+				_ = cmd.Wait()
+			}
+		}()
 	default:
 		return errors.New("it is not a tar archive compressed with gzip, bzip2 or xz; a single file is kept " +
 			"whole by naming it in `file`")
 	}
-	return untar(stream, into, within)
+	if err := untar(stream, into, within); err != nil {
+		return err
+	}
+	if wait != nil {
+		// Whatever follows the tar's end is read before xz is waited for: xz blocks on a full pipe otherwise.
+		if _, err := io.Copy(io.Discard, stream); err != nil {
+			return err
+		}
+		w := wait
+		wait = nil
+		return w()
+	}
+	return nil
 }
 
-// xzDictMax is the largest xz dictionary read: xz's own presets use at most 64 MiB (-9); a stream asking for
-// more is refused rather than given the memory.
-const xzDictMax = 64 << 20
-
 // untar writes a tar stream's files and directories within `within` into a directory.
 func untar(stream io.Reader, into, within string) error {
 	reader := tar.NewReader(stream)

internal/builder/upstream_file_test.go

@@ -6,10 +6,8 @@ import (
 	"compress/gzip"
 	"context"
 	"crypto/sha256"
-	"encoding/binary"
 	"encoding/hex"
 	"fmt"
-	"hash/crc32"
 	"io"
 	"net"
 	"net/http"
@@ -17,7 +15,6 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
-	"runtime"
 	"sort"
 	"strings"
 	"testing"
@@ -386,84 +383,3 @@ func TestARedirectOffHttpsIsNotFollowed(t *testing.T) {
 		t.Fatalf("%v", err)
 	}
 }
-
-func TestAnXzReleaseIsReadWithoutAnyXzToolOnTheBuildSeat(t *testing.T) {
-	// The build seat's image (the catalogue's build-agent recipe) carries git and docker-cli alone: Betterbird's
-	// .tar.xz failed there on 2026-10-12 with "this build seat has no xz to read it" (hq issue 345). It is
-	// read in Go, with nothing on PATH.
-	t.Setenv("PATH", "")
-	body, err := os.ReadFile(filepath.Join("testdata", "release.tar.xz"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	v := &vendor{files: map[string][]byte{"/r.tar.xz": body}}
-	base := serveVendor(t, v)
-	packed, err := upstreamArchive(context.Background(), t.TempDir(), catalogue.Artifact{Name: "archive", Kind: "archive",
-		URL: base + "/r.tar.xz", SHA256: sumHex(body), Version: "1", Within: "betterbird"}, func(string, string, ...any) {})
-	if err != nil {
-		t.Fatal(err)
-	}
-	e := entriesOf(t, packed)
-	if len(e) != 2 || e["betterbird"] != "#!/bin/sh\n -rwxr-xr-x" || e["defaults/p.js"] != "pref(\"a\", 1);\n -rw-r--r--" {
-		t.Fatalf("%v", e)
-	}
-}
-
-// withDictionary is an xz stream whose first block's LZMA2 dictionary property is props, its header's CRC32
-// recomputed: a stream asking for a dictionary of its own choosing.
-func withDictionary(t *testing.T, stream []byte, props byte) []byte {
-	t.Helper()
-	out := append([]byte{}, stream...)
-	const at = 12 // the stream header
-	size := (int(out[at]) + 1) * 4
-	header := out[at : at+size]
-	flags := header[1]
-	i := 2
-	readVarint := func() {
-		for header[i]&0x80 != 0 {
-			i++
-		}
-		i++
-	}
-	if flags&0x40 != 0 {
-		readVarint()
-	}
-	if flags&0x80 != 0 {
-		readVarint()
-	}
-	if header[i] != 0x21 || header[i+1] != 0x01 {
-		t.Fatalf("the fixture's first filter is not LZMA2: % x", header)
-	}
-	header[i+2] = props
-	binary.LittleEndian.PutUint32(header[size-4:], crc32.ChecksumIEEE(header[:size-4]))
-	return out
-}
-
-func TestAnXzStreamAskingForTooLargeADictionaryIsRefused(t *testing.T) {
-	body, err := os.ReadFile(filepath.Join("testdata", "release.tar.xz"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	// 1 GiB (props 36) and 4 GiB less one (props 40): over the 64 MiB maximum, refused before allocation.
-	for _, props := range []byte{36, 40} {
-		crafted := withDictionary(t, body, props)
-		v := &vendor{files: map[string][]byte{"/r.tar.xz": crafted}}
-		base := serveVendor(t, v)
-		var before, after runtime.MemStats
-		runtime.GC()
-		runtime.ReadMemStats(&before)
-		_, err := upstreamArchive(context.Background(), t.TempDir(), catalogue.Artifact{Name: "archive", Kind: "archive",
-			URL: base + "/r.tar.xz", SHA256: sumHex(crafted), Version: "1", Within: "betterbird"}, func(string, string, ...any) {})
-		runtime.ReadMemStats(&after)
-		if err == nil || !strings.Contains(err.Error(), "dictionary") {
-			t.Errorf("props %d: a dictionary over the maximum was not refused: %v", props, err)
-		}
-		if grew := after.TotalAlloc - before.TotalAlloc; grew > 256<<20 {
-			t.Errorf("props %d: %d bytes were allocated for a refused stream", props, grew)
-		}
-	}
-	// The fixture as it is (a small dictionary) still reads.
-	if crafted := withDictionary(t, body, 0); len(crafted) == 0 {
-		t.Fatal("no fixture")
-	}
-}

internal/builder/xz_framing.go

@@ -1,290 +0,0 @@
-package builder
-
-import (
-	"bufio"
-	"bytes"
-	"encoding/binary"
-	"errors"
-	"fmt"
-	"hash/crc32"
-	"io"
-	"os"
-)
-
-// xzBlocksMax and xzStreamsMax are the most blocks and the most concatenated streams an xz file may hold for
-// the build seat to read it.
-//
-// **Why a block count is limited at all.** The xz reader (github.com/therootcompany/xz v1.0.1) keeps one
-// filter decoder for every block that names a delta or BCJ filter, and frees them only when a stream ends:
-// its block counters are reset per stream, not per block. A stream of many tiny blocks therefore grows the
-// heap with its length: an `xz --block-size=1 --delta` file of 6 MB kept about 67 MiB live, which comes to
-// about 5.6 GiB at the 512 MiB download cap (review 68 on mesh-controller pull request 264, hq issue 345).
-//
-// **Why 1,024.** At about 340 bytes of decoder a block, 1,024 blocks keep at most about 0.35 MiB live. A
-// real release is far below it: Betterbird's archive is 1 stream with 1 block, and multi-threaded xz cuts
-// blocks of three times the dictionary (24 MiB at the default preset), so even 512 MiB unpacked in blocks
-// of 512 KiB stays within it. Streams are limited to 16 because a release is one stream; the decoders are
-// reused from one stream to the next, so the stream limit only bounds the work of this walk.
-const (
-	xzBlocksMax  = 1024
-	xzStreamsMax = 16
-)
-
-// xzWithinLimits walks an xz file's framing, without decompressing anything, and refuses one holding more
-// blocks or streams than the build seat reads.
-//
-// **The framing, not the index.** Each stream's index at its end lists its blocks, but the reader compares
-// the index with the blocks only after it has decoded them all, so a file whose index lies would still be
-// decoded block by block. This walk follows the same framing the reader follows: stream header, each block
-// header, the block's LZMA2 chunks (each chunk header carries its own compressed size, so a chunk is skipped
-// without being decoded), its padding and check, then the index and the footer. It counts the blocks the
-// reader would decode, and it also refuses an index whose count of blocks is not the count walked.
-func xzWithinLimits(file string) error {
-	f, err := os.Open(file)
-	if err != nil {
-		return err
-	}
-	defer f.Close()
-	_, _, err = xzFraming(bufio.NewReader(f))
-	if errors.Is(err, errXzTooManyBlocks) || errors.Is(err, errXzTooManyStreams) {
-		return err
-	}
-	if err != nil {
-		return fmt.Errorf("it is not an xz file this build seat reads: %v", err)
-	}
-	return nil
-}
-
-var (
-	errXzTooManyBlocks = fmt.Errorf("it holds more than %d xz blocks, the most this build seat reads: "+
-		"its xz reader keeps a filter decoder for every block (hq issue 345)", xzBlocksMax)
-	errXzTooManyStreams = fmt.Errorf("it holds more than %d concatenated xz streams, the most this build "+
-		"seat reads", xzStreamsMax)
-)
-
-// xzFraming counts the streams and blocks of an xz file, checking its framing as it goes. It stops with
-// errXzTooManyBlocks or errXzTooManyStreams at the first block or stream over the limit.
-func xzFraming(r *bufio.Reader) (streams, blocks int, err error) {
-	full := func(n int) ([]byte, error) {
-		b := make([]byte, n)
-		if _, err := io.ReadFull(r, b); err != nil {
-			if err == io.EOF {
-				err = io.ErrUnexpectedEOF
-			}
-			return nil, err
-		}
-		return b, nil
-	}
-	skip := func(n int) error {
-		if got, err := r.Discard(n); err != nil || got != n {
-			return io.ErrUnexpectedEOF
-		}
-		return nil
-	}
-	for {
-		header, err := full(12)
-		if err != nil {
-			return streams, blocks, fmt.Errorf("stream %d: header: %v", streams+1, err)
-		}
-		if !bytes.Equal(header[:6], []byte{0xfd, '7', 'z', 'X', 'Z', 0x00}) {
-			return streams, blocks, fmt.Errorf("stream %d: no xz stream header", streams+1)
-		}
-		if header[6] != 0 || header[7]&0xf0 != 0 ||
-			crc32.ChecksumIEEE(header[6:8]) != binary.LittleEndian.Uint32(header[8:12]) {
-			return streams, blocks, fmt.Errorf("stream %d: a corrupt stream header", streams+1)
-		}
-		if streams++; streams > xzStreamsMax {
-			return streams, blocks, errXzTooManyStreams
-		}
-		checkSize := 0
-		if check := int(header[7]); check != 0 {
-			checkSize = 4 << ((check - 1) / 3)
-		}
-		inStream := 0
-		for {
-			first, err := r.ReadByte()
-			if err != nil {
-				return streams, blocks, fmt.Errorf("stream %d: no index: %v", streams, io.ErrUnexpectedEOF)
-			}
-			if first == 0 {
-				break // the index indicator
-			}
-			rest, err := full(int(first)*4 + 3)
-			if err != nil {
-				return streams, blocks, fmt.Errorf("stream %d, block %d: header: %v", streams, inStream+1, err)
-			}
-			if err := xzBlockHeader(append([]byte{first}, rest...)); err != nil {
-				return streams, blocks, fmt.Errorf("stream %d, block %d: %v", streams, inStream+1, err)
-			}
-			inStream++
-			if blocks++; blocks > xzBlocksMax {
-				return streams, blocks, errXzTooManyBlocks
-			}
-			// The block's LZMA2 chunks, up to the end marker.
-			size := 0
-			for {
-				control, err := r.ReadByte()
-				if err != nil {
-					return streams, blocks, fmt.Errorf("stream %d, block %d: %v", streams, inStream, io.ErrUnexpectedEOF)
-				}
-				size++
-				if control == 0 {
-					break
-				}
-				switch {
-				case control == 1 || control == 2: // stored: a 16-bit size less one, then the bytes
-					b, err := full(2)
-					if err != nil {
-						return streams, blocks, err
-					}
-					n := int(binary.BigEndian.Uint16(b)) + 1
-					if err := skip(n); err != nil {
-						return streams, blocks, err
-					}
-					size += 2 + n
-				case control >= 0x80: // LZMA: unpacked and packed sizes, the properties byte on a reset
-					b, err := full(4)
-					if err != nil {
-						return streams, blocks, err
-					}
-					n := int(binary.BigEndian.Uint16(b[2:])) + 1
-					size += 4
-					if control >= 0xc0 {
-						if err := skip(1); err != nil {
-							return streams, blocks, err
-						}
-						size++
-					}
-					if err := skip(n); err != nil {
-						return streams, blocks, err
-					}
-					size += n
-				default:
-					return streams, blocks, fmt.Errorf("stream %d, block %d: an LZMA2 chunk of kind %#x",
-						streams, inStream, control)
-				}
-			}
-			if pad := (4 - size%4) % 4; pad > 0 {
-				b, err := full(pad)
-				if err != nil || !bytes.Equal(b, make([]byte, pad)) {
-					return streams, blocks, fmt.Errorf("stream %d, block %d: corrupt block padding", streams, inStream)
-				}
-			}
-			if err := skip(checkSize); err != nil {
-				return streams, blocks, err
-			}
-		}
-		// The index: its count of records, two numbers each, padding, CRC32.
-		used := 1
-		count, n, err := xzVLI(r)
-		if err != nil {
-			return streams, blocks, fmt.Errorf("stream %d: index: %v", streams, err)
-		}
-		used += n
-		if count != uint64(inStream) {
-			return streams, blocks, fmt.Errorf("stream %d: its index lists %d blocks, but it holds %d",
-				streams, count, inStream)
-		}
-		for i := 0; i < 2*inStream; i++ {
-			_, n, err := xzVLI(r)
-			if err != nil {
-				return streams, blocks, fmt.Errorf("stream %d: index: %v", streams, err)
-			}
-			used += n
-		}
-		if err := skip((4-used%4)%4 + 4); err != nil {
-			return streams, blocks, fmt.Errorf("stream %d: index: %v", streams, err)
-		}
-		footer, err := full(12)
-		if err != nil || footer[10] != 'Y' || footer[11] != 'Z' {
-			return streams, blocks, fmt.Errorf("stream %d: no stream footer", streams)
-		}
-		// Stream padding: zero bytes, a multiple of four, then the end or another stream.
-		zeros := 0
-		for {
-			b, err := r.ReadByte()
-			if err == io.EOF {
-				if zeros%4 != 0 {
-					return streams, blocks, errors.New("stream padding not a multiple of four bytes")
-				}
-				return streams, blocks, nil
-			}
-			if err != nil {
-				return streams, blocks, err
-			}
-			if b != 0 {
-				_ = r.UnreadByte()
-				break
-			}
-			zeros++
-		}
-		if zeros%4 != 0 {
-			return streams, blocks, errors.New("stream padding not a multiple of four bytes")
-		}
-	}
-}
-
-// xzBlockHeader checks one block header: its CRC32, its flags, and that its last filter is LZMA2, the only
-// one whose chunks this walk can skip (and the only last filter the reader decodes).
-func xzBlockHeader(h []byte) error {
-	size := len(h)
-	if crc32.ChecksumIEEE(h[:size-4]) != binary.LittleEndian.Uint32(h[size-4:]) {
-		return errors.New("a corrupt block header")
-	}
-	flags := h[1]
-	if flags&0x3c != 0 {
-		return errors.New("a block header with reserved flags")
-	}
-	body := bytes.NewReader(h[2 : size-4])
-	if flags&0x40 != 0 {
-		if _, _, err := xzVLI(body); err != nil {
-			return err
-		}
-	}
-	if flags&0x80 != 0 {
-		if _, _, err := xzVLI(body); err != nil {
-			return err
-		}
-	}
-	var last uint64
-	for i := 0; i <= int(flags&3); i++ {
-		id, _, err := xzVLI(body)
-		if err != nil {
-			return err
-		}
-		props, _, err := xzVLI(body)
-		if err != nil {
-			return err
-		}
-		if props > uint64(body.Len()) {
-			return errors.New("a corrupt block header")
-		}
-		if _, err := body.Seek(int64(props), io.SeekCurrent); err != nil {
-			return err
-		}
-		last = id
-	}
-	if last != 0x21 {
-		return fmt.Errorf("a block whose last filter is %#x, not LZMA2", last)
-	}
-	return nil
-}
-
-// xzVLI reads one of xz's variable-length integers (at most 9 bytes, 7 bits each), and how many bytes it took.
-func xzVLI(r io.ByteReader) (uint64, int, error) {
-	var v uint64
-	for i := 0; i < 9; i++ {
-		b, err := r.ReadByte()
-		if err != nil {
-			return 0, i, io.ErrUnexpectedEOF
-		}
-		v |= uint64(b&0x7f) << (7 * i)
-		if b&0x80 == 0 {
-			if i > 0 && b == 0 {
-				return 0, i + 1, errors.New("a number not in its shortest form")
-			}
-			return v, i + 1, nil
-		}
-	}
-	return 0, 9, errors.New("a number longer than nine bytes")
-}

internal/builder/xz_framing_test.go

@@ -1,207 +0,0 @@
-package builder
-
-import (
-	"archive/tar"
-	"bufio"
-	"bytes"
-	"context"
-	"encoding/binary"
-	"errors"
-	"hash/crc32"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"runtime"
-	"strings"
-	"testing"
-)
-
-// xzStream is one xz stream (no integrity check) of data cut into blocks of blockSize bytes, each block's
-// LZMA2 data stored uncompressed, each block a delta filter before LZMA2 when delta is set: the shape of
-// `xz --block-size=N --filters=delta,lzma2`, built without any xz tool. listed is how many blocks its index
-// lists (-1: as many as it holds), so a stream whose index lies can be built too.
-func xzStream(data []byte, blockSize int, delta bool, listed int) []byte {
-	var out bytes.Buffer
-	flags := []byte{0, 0}
-	out.Write([]byte{0xfd, '7', 'z', 'X', 'Z', 0x00})
-	out.Write(flags)
-	out.Write(binary.LittleEndian.AppendUint32(nil, crc32.ChecksumIEEE(flags)))
-	type record struct{ unpadded, uncompressed uint64 }
-	var records []record
-	for at := 0; at < len(data); at += blockSize {
-		block := data[at:min(at+blockSize, len(data))]
-		if delta {
-			// Delta-encoded with a distance of one; the decoder's history starts empty at each block.
-			encoded := make([]byte, len(block))
-			for i := range block {
-				encoded[i] = block[i]
-				if i > 0 {
-					encoded[i] -= block[i-1]
-				}
-			}
-			block = encoded
-		}
-		header := []byte{2, 0} // 12 bytes
-		if delta {
-			header[1] = 1 // two filters
-			header = append(header, 0x03, 0x01, 0x00)
-		}
-		header = append(header, 0x21, 0x01, 0x00) // LZMA2, a 4 KiB dictionary
-		for len(header) < 8 {
-			header = append(header, 0)
-		}
-		header = binary.LittleEndian.AppendUint32(header, crc32.ChecksumIEEE(header))
-		out.Write(header)
-		size := 0
-		for i, chunk := 0, block; len(chunk) > 0; i++ {
-			n := min(len(chunk), 1<<16)
-			control := byte(2)
-			if i == 0 {
-				control = 1 // the first chunk of a block resets the dictionary
-			}
-			out.WriteByte(control)
-			out.Write(binary.BigEndian.AppendUint16(nil, uint16(n-1)))
-			out.Write(chunk[:n])
-			size += 3 + n
-			chunk = chunk[n:]
-		}
-		out.WriteByte(0)
-		size++
-		out.Write(make([]byte, (4-size%4)%4))
-		records = append(records, record{uint64(len(header) + size), uint64(len(block))})
-	}
-	if listed >= 0 {
-		for len(records) < listed {
-			records = append(records, records[0])
-		}
-		records = records[:listed]
-	}
-	vli := func(b []byte, v uint64) []byte {
-		for v >= 0x80 {
-			b = append(b, byte(v)|0x80)
-			v >>= 7
-		}
-		return append(b, byte(v))
-	}
-	index := vli([]byte{0}, uint64(len(records)))
-	for _, r := range records {
-		index = vli(vli(index, r.unpadded), r.uncompressed)
-	}
-	for len(index)%4 != 0 {
-		index = append(index, 0)
-	}
-	index = binary.LittleEndian.AppendUint32(index, crc32.ChecksumIEEE(index))
-	out.Write(index)
-	footer := binary.LittleEndian.AppendUint32(nil, uint32(len(index)/4-1))
-	footer = append(footer, flags...)
-	out.Write(binary.LittleEndian.AppendUint32(nil, crc32.ChecksumIEEE(footer)))
-	out.Write(footer)
-	out.WriteString("YZ")
-	return out.Bytes()
-}
-
-// tarHolding is a tar holding betterbird/data with body.
-func tarHolding(t *testing.T, body []byte) []byte {
-	t.Helper()
-	var out bytes.Buffer
-	w := tar.NewWriter(&out)
-	if err := w.WriteHeader(&tar.Header{Name: "betterbird/data", Mode: 0o644, Size: int64(len(body)),
-		Typeflag: tar.TypeReg}); err != nil {
-		t.Fatal(err)
-	}
-	w.Write(body)
-	if err := w.Close(); err != nil {
-		t.Fatal(err)
-	}
-	return out.Bytes()
-}
-
-func writeTemp(t *testing.T, body []byte) string {
-	t.Helper()
-	file := filepath.Join(t.TempDir(), "r.tar.xz")
-	if err := os.WriteFile(file, body, 0o644); err != nil {
-		t.Fatal(err)
-	}
-	return file
-}
-
-func TestAnXzFileOfAFewDeltaBlocksAndTwoStreamsIsRead(t *testing.T) {
-	// The streams this test builds are ones the reader decodes, so what the walk refuses below is the
-	// same framing the reader follows.
-	body := bytes.Repeat([]byte("betterbird "), 300)
-	whole := tarHolding(t, body)
-	half := len(whole) / 2
-	for name, file := range map[string][]byte{
-		"one stream of delta blocks": xzStream(whole, 512, true, -1),
-		"two streams with padding": append(append(xzStream(whole[:half], 700, true, -1), 0, 0, 0, 0),
-			xzStream(whole[half:], 100, false, -1)...),
-	} {
-		path := writeTemp(t, file)
-		if xzPath, err := exec.LookPath("xz"); err == nil {
-			if out, err := exec.Command(xzPath, "-t", path).CombinedOutput(); err != nil {
-				t.Fatalf("%s: xz itself refuses the built stream: %v %s", name, err, out)
-			}
-		}
-		into := t.TempDir()
-		if err := unpackUpstream(context.Background(), path, into, "betterbird"); err != nil {
-			t.Fatalf("%s: %v", name, err)
-		}
-		got, err := os.ReadFile(filepath.Join(into, "data"))
-		if err != nil || !bytes.Equal(got, body) {
-			t.Fatalf("%s: unpacked %d bytes, want %d: %v", name, len(got), len(body), err)
-		}
-	}
-}
-
-func TestAnXzFileOfManyDeltaBlocksIsRefusedBeforeItIsDecoded(t *testing.T) {
-	// Review 68 on pull request 264: `xz --block-size=1 --delta` of a 200 kB tar kept about 67 MiB live in
-	// the reader, one delta decoder per block. Its index here lists one block, as a file crafted to pass a
-	// check of the index alone would; the walk counts the blocks the reader would decode.
-	body := make([]byte, 200_000)
-	for i := range body {
-		body[i] = byte(i * 7)
-	}
-	crafted := xzStream(tarHolding(t, body), 1, true, 1)
-	path := writeTemp(t, crafted)
-	var before, after runtime.MemStats
-	runtime.GC()
-	runtime.ReadMemStats(&before)
-	err := unpackUpstream(context.Background(), path, t.TempDir(), "betterbird")
-	runtime.ReadMemStats(&after)
-	if err == nil || !strings.Contains(err.Error(), "more than 1024 xz blocks") {
-		t.Fatalf("a file of %d bytes in blocks of one byte was not refused for its blocks: %v", len(crafted), err)
-	}
-	if grew := after.TotalAlloc - before.TotalAlloc; grew > 4<<20 {
-		t.Fatalf("%d bytes were allocated for a refused file", grew)
-	}
-}
-
-func TestTheXzBlockLimitIsExact(t *testing.T) {
-	data := make([]byte, xzBlocksMax+1)
-	streams, blocks, err := xzFraming(bufio.NewReader(bytes.NewReader(xzStream(data[:xzBlocksMax], 1, true, -1))))
-	if err != nil || streams != 1 || blocks != xzBlocksMax {
-		t.Fatalf("%d blocks: %d streams, %d blocks, %v", xzBlocksMax, streams, blocks, err)
-	}
-	if _, _, err := xzFraming(bufio.NewReader(bytes.NewReader(xzStream(data, 1, true, -1)))); !errors.Is(err, errXzTooManyBlocks) {
-		t.Fatalf("%d blocks: %v", xzBlocksMax+1, err)
-	}
-}
-
-func TestAnXzFileOfTooManyStreamsIsRefused(t *testing.T) {
-	var file []byte
-	for i := 0; i <= xzStreamsMax; i++ {
-		file = append(file, xzStream([]byte("x"), 1, false, -1)...)
-	}
-	err := unpackUpstream(context.Background(), writeTemp(t, file), t.TempDir(), "")
-	if err == nil || !strings.Contains(err.Error(), "more than 16 concatenated xz streams") {
-		t.Fatalf("%v", err)
-	}
-}
-
-func TestAnXzIndexThatDoesNotListItsBlocksIsRefused(t *testing.T) {
-	file := xzStream(tarHolding(t, []byte("x")), 512, false, 1)
-	err := unpackUpstream(context.Background(), writeTemp(t, file), t.TempDir(), "betterbird")
-	if err == nil || !strings.Contains(err.Error(), "its index lists 1 blocks, but it holds 4") {
-		t.Fatalf("%v", err)
-	}
-}

internal/catalogue/operators_machine_test.go

@@ -68,10 +68,9 @@ func TestFailedIsAnOptionalVerbOfTheServiceManager(t *testing.T) {
 	holder := func(serves ...string) Manifest {
 		return Manifest{Module: "systemd", Version: "1", Claims: []Claim{{Name: ServiceManagerSeat, Scope: ScopeNode, Serves: serves}}}
 	}
-	eight := []string{"units", "status", "start", "stop", "restart", "enable", "disable", "journal",
-		"reset-failed", "wanted-by", "unlink-dangling"}
+	eight := []string{"units", "status", "start", "stop", "restart", "enable", "disable", "journal"}
 	if err := CanHold(holder(eight...), seat); err != nil {
-		t.Fatalf("a holder without failed is refused: %v", err)
+		t.Fatalf("today's holder, without failed, is refused: %v", err)
 	}
 	if err := CanHold(holder(append(eight, "failed")...), seat); err != nil {
 		t.Fatalf("a holder serving failed is refused: %v", err)
@@ -82,7 +81,7 @@ func TestFailedIsAnOptionalVerbOfTheServiceManager(t *testing.T) {
 	if err := CanHold(holder(eight[1:]...), seat); err == nil || !strings.Contains(err.Error(), "does not serve units") {
 		t.Fatalf("a holder missing a required verb was accepted: %v", err)
 	}
-	optional := map[string]bool{"failed": true}
+	optional := map[string]bool{"failed": true, "reset-failed": true, "wanted-by": true, "unlink-dangling": true}
 	for _, v := range seat.Serves {
 		if v.Optional != optional[v.Name] {
 			t.Errorf("%s optional: %v", v.Name, v.Optional)
@@ -90,35 +89,26 @@ func TestFailedIsAnOptionalVerbOfTheServiceManager(t *testing.T) {
 	}
 }
 
-// **`reset-failed`, `wanted-by` and `unlink-dangling` are required** (novox/hq issue 332, ADR 0246 step 3):
-// every holder serves them, so a holder serving only the nine verbs before them is refused by the verb it
-// lacks; a holder serving all twelve holds the seat; each replaces the shell command it names; and read
-// back from the store's row they stay required.
-func TestResetFailedWantedByAndUnlinkDanglingAreRequiredVerbsOfTheServiceManager(t *testing.T) {
+// **`reset-failed` and `wanted-by` join the seat optional** (novox/hq issue 332, ADR 0246 step 1): the
+// holder running today, serving the nine verbs, still holds the seat; a holder serving all eleven is not
+// refused; each replaces the shell command it names; and read back from the store's row they stay optional.
+func TestResetFailedAndWantedByAreOptionalVerbsOfTheServiceManager(t *testing.T) {
 	defer UseSeats(DefaultSeats())
 	nine := []string{"units", "status", "start", "stop", "restart", "enable", "disable", "journal", "failed"}
-	all := append(slices.Clone(nine), "reset-failed", "wanted-by", "unlink-dangling")
 	holder := func(serves ...string) Manifest {
 		return Manifest{Module: "systemd", Version: "1", Claims: []Claim{{Name: ServiceManagerSeat, Scope: ScopeNode, Serves: serves}}}
 	}
-	refusedWithout := func(seat Seat) {
-		t.Helper()
-		for _, verb := range []string{"reset-failed", "wanted-by", "unlink-dangling"} {
-			serves := slices.DeleteFunc(slices.Clone(all), func(v string) bool { return v == verb })
-			if err := CanHold(holder(serves...), seat); err == nil || !strings.Contains(err.Error(), "does not serve "+verb) {
-				t.Errorf("a holder not serving %s holds the seat: %v", verb, err)
-			}
-		}
-	}
 	seat, _ := SeatNamed(ServiceManagerSeat)
-	if err := CanHold(holder(nine...), seat); err == nil {
-		t.Fatal("a holder serving only the nine verbs before issue 332 holds the seat")
+	if err := CanHold(holder(nine...), seat); err != nil {
+		t.Fatalf("today's holder, without the two verbs, is refused: %v", err)
 	}
-	refusedWithout(seat)
-	if err := CanHold(holder(all...), seat); err != nil {
-		t.Fatalf("a holder serving all twelve is refused: %v", err)
+	if err := CanHold(holder(append(nine, "reset-failed", "wanted-by")...), seat); err != nil {
+		t.Fatalf("a holder serving both is refused: %v", err)
 	}
-	if err := CanHold(holder(append(slices.Clone(all), "why-started")...), seat); err == nil || !strings.Contains(err.Error(), "does not promise") {
+	if err := CanHold(holder(append(nine, "reset-failed", "wanted-by", "unlink-dangling")...), seat); err != nil {
+		t.Fatalf("a holder serving unlink-dangling too is refused: %v", err)
+	}
+	if err := CanHold(holder(append(nine, "why-started")...), seat); err == nil || !strings.Contains(err.Error(), "does not promise") {
 		t.Fatalf("a verb the seat does not promise was accepted: %v", err)
 	}
 	replaces := map[string]string{"reset-failed": "systemctl reset-failed", "wanted-by": "systemctl list-dependencies --reverse",
@@ -128,9 +118,6 @@ func TestResetFailedWantedByAndUnlinkDanglingAreRequiredVerbsOfTheServiceManager
 		if !ok {
 			continue
 		}
-		if v.Optional {
-			t.Errorf("%s is still optional", v.Name)
-		}
 		if !slices.Contains(v.Replaces, want) {
 			t.Errorf("%s does not say it replaces %q: %v", v.Name, want, v.Replaces)
 		}
@@ -161,9 +148,8 @@ func TestResetFailedWantedByAndUnlinkDanglingAreRequiredVerbsOfTheServiceManager
 	}
 	UseSeats(rows)
 	seat, _ = SeatNamed(ServiceManagerSeat)
-	refusedWithout(seat)
-	if err := CanHold(holder(all...), seat); err != nil {
-		t.Fatalf("read back from the row, a holder serving all twelve is refused: %v", err)
+	if err := CanHold(holder(nine...), seat); err != nil {
+		t.Fatalf("read back from the row, the two verbs are required: %v", err)
 	}
 }
 
@@ -183,9 +169,8 @@ func TestAnOptionalVerbStaysOptionalInASetReadFromTheStore(t *testing.T) {
 	UseSeats(rows)
 	seat, _ := SeatNamed(ServiceManagerSeat)
 	holder := Manifest{Module: "systemd", Version: "1", Claims: []Claim{{Name: ServiceManagerSeat, Scope: ScopeNode,
-		Serves: []string{"units", "status", "start", "stop", "restart", "enable", "disable", "journal",
-			"reset-failed", "wanted-by", "unlink-dangling"}}}}
+		Serves: []string{"units", "status", "start", "stop", "restart", "enable", "disable", "journal"}}}}
 	if err := CanHold(holder, seat); err != nil {
-		t.Fatalf("a set read from rows refuses a holder without the optional failed: %v", err)
+		t.Fatalf("a set read from rows refuses today's holder: %v", err)
 	}
 }

internal/catalogue/seats.go

@@ -678,13 +678,13 @@ func serviceManagerVerbs() []Verb {
 			Replaces: []string{"systemctl --failed"}},
 		// **Clearing a failed record, and finding what starts a unit** (novox/hq issue 332): a unit whose
 		// file is gone stays failed in its manager until the record is reset, and what keeps asking for it
-		// is a dependency or an enable link no verb could show. Required since every holder serves them
-		// (ADR 0246 step 3).
-		{Name: "reset-failed", Description: "Clear one unit's failed record in its manager — " +
+		// is a dependency or an enable link no verb could show. Both optional while their holders catch up
+		// (ADR 0246 step 1); a later change requires them.
+		{Name: "reset-failed", Optional: true, Description: "Clear one unit's failed record in its manager — " +
 			"its failed state and its start-limit count — and answer its state after. It removes no file and " +
 			"starts nothing.",
 			Input: scoped(unit, []string{"unit"}), Replaces: []string{"systemctl reset-failed"}},
-		{Name: "wanted-by", Description: "What wants, requires or triggers one unit, read-only: the " +
+		{Name: "wanted-by", Optional: true, Description: "What wants, requires or triggers one unit, read-only: the " +
 			"manager's reverse dependencies (WantedBy, RequiredBy, UpheldBy, BoundBy, TriggeredBy and the rest) and " +
 			"every enable link naming it in the scope's configuration directories (*.wants, *.requires, *.upholds), " +
 			"each with where it points and whether it dangles — the account's own directory included in user scope.",
@@ -692,9 +692,9 @@ func serviceManagerVerbs() []Verb {
 			Replaces: []string{"systemctl list-dependencies --reverse", "systemctl show -p WantedBy",
 				"ls ~/.config/systemd/user/*.wants"}},
 		// **A dangling enable link removed on the person's word** (novox/hq issue 332): `systemctl disable`
-		// leaves a link whose unit file is gone, so the manager keeps asking for the unit. Required since
-		// every holder serves it (ADR 0246 step 3).
-		{Name: "unlink-dangling", Description: "Remove the dangling enable links named for one " +
+		// leaves a link whose unit file is gone, so the manager keeps asking for the unit. Optional until its
+		// holders serve it (ADR 0246 step 1).
+		{Name: "unlink-dangling", Optional: true, Description: "Remove the dangling enable links named for one " +
 			"unit — links in a *.wants, *.requires or *.upholds directory of the account's or the machine's own " +
 			"configuration whose target does not exist, which `disable` leaves once the unit's file is gone — on " +
 			"the person's word: `why` is required. Each is recorded (its path, its target, the reason) before it is " +

internal/catalogue/verbs.go

@@ -333,9 +333,7 @@ var ControllerVerbs = []Verb{
 	// The build queue, controlled by hand (novox/hq ADR 0219). Every verb that drops an ask leaves a
 	// failed outcome for it, so a plan waiting on it fails visibly instead of hanging.
 	{Name: "queue", Description: "Every ask in the build queue: waiting, in flight (on which machine, for how long), " +
-		"and dead (handed out as often as allowed and never settled) — each with its id, repository, path, ref and when it was asked. " +
-		"Answers the table as text and, as data, each ask's state, kind (check or build), repository, commit, machine, since " +
-		"and position among the waiting (novox/hq issue 455).",
+		"and dead (handed out as often as allowed and never settled) — each with its id, repository, path, ref and when it was asked.",
 		Input: schema(nil, nil)},
 	{Name: "cancel", Description: "Drop one waiting or dead ask from the build queue; its outcome is recorded failed, " +
 		"cancelled by hand, and a plan that asked for it fails. One in flight is refused: `kill` ends it where it runs.",
@@ -492,13 +490,6 @@ var ControllerVerbs = []Verb{
 			"why":        "with consumer or older-than: why — required, and recorded in the hand-act log",
 			"cause":      "with consumer or older-than: the cause in a word (cleanup-waiting when absent)",
 		}, nil, "confirm")},
-	{Name: "judge-directories", Description: "Read-only: which of the directories one machine is declared its " +
-		"node-engine's walk that follows no link another account could make would refuse (novox/hq issue 358), one line " +
-		"each: placed, would be refused and why (the link and who could replace it), refused already by the placement " +
-		"guard, or below a home. The engine judges the declaration it keeps and makes, chmods and chowns nothing.",
-		Input: schema(map[string]string{
-			"node": "the machine's name",
-		}, []string{"node"})},
 	// What a consumer gave up on (novox/hq issue 330): kept in DEAD_LETTERS until a person acts on it.
 	{Name: "root-free", Description: "Whether each machine named is root-free now (novox/hq ADR 0259 §8): no agent " +
 		"there can become root without a person. Judged when asked, never from a condition: free only when the machine " +

internal/inventory/plans.go

@@ -61,10 +61,6 @@ type Plan struct {
 	// Phases is the walk's time from its merge, phase by phase (ADR 0282 decision 6): never kept, worked out
 	// from the walk's own moments by whoever says the walk (`delivery walks`, `plan-moved`).
 	Phases *WalkPhases `json:"phases,omitempty"`
-	// WalkSaid is, on the save that started or ended the walk, which of the two it was (novox/hq ADR 0308
-	// decision 1): set by the save, never kept, read by whoever says the save (`plan-moved`). Empty on every
-	// other save.
-	WalkSaid string `json:"-"`
 }
 
 // PlanTimes are a walk's own moments beside its modules' (novox/hq ADR 0282 decision 6).
@@ -77,10 +73,6 @@ type PlanTimes struct {
 	// Class is the walk's module class, read at its cut: core when it moves a module on the controller's own
 	// path or the mesh's resolver, leaf otherwise (ADR 0282 decision 1).
 	Class string `json:"class,omitempty"`
-	// Started is when the walk was said started, and Ended when it was said ended (novox/hq ADR 0308 decision
-	// 1): each said once, on the save that marked it.
-	Started *time.Time `json:"started,omitempty"`
-	Ended   *time.Time `json:"ended,omitempty"`
 }
 
 // PlanCommit is one repository's commit a walk carries: the latest merge of its branch in the batch.
@@ -125,14 +117,6 @@ type PlanBatch struct {
 	// the batch's walk does not build them.
 	Closed   bool     `json:"closed,omitempty"`
 	Withheld []string `json:"withheld,omitempty"`
-	// CutAtOnce says the batch's window closed when it was made: its merge shares nothing with a batch
-	// assembling and has no delivery group member still to merge, so it waits for no window (novox/hq ADR 0304
-	// decision 1, ADR 0306 decisions 2 and 3). A merge that joins it later opens its window again. It is not
-	// Closed, which is a stop's.
-	CutAtOnce bool `json:"cut_at_once,omitempty"`
-	// Waits says why a batch made for one merge waits for the window: its delivery group has a member still to
-	// merge, or mesh-delivery could not say whether it has (novox/hq ADR 0306 decision 2).
-	Waits string `json:"waits,omitempty"`
 }
 
 // OwnPath says the record is a batch of merges on the controller's own path.
@@ -199,8 +183,8 @@ type PlanDelivery struct {
 	Go  *time.Time `json:"go,omitempty"`
 	By  string     `json:"by,omitempty"`
 	Why string     `json:"why,omitempty"`
-	// Stopped is who ended the walk, through the delivery's owner or by hand (`plans stop|close`), and StoppedWhy
-	// why: the walk is failed, and the delivery reads it as stopped, not as a build that failed.
+	// Stopped is who ended the walk through the delivery's owner, and StoppedWhy why: the walk is failed,
+	// and the delivery reads it as stopped, not as a build that failed.
 	Stopped    string `json:"stopped,omitempty"`
 	StoppedWhy string `json:"stopped_why,omitempty"`
 	// Merges is every merge the walk or batch answers (novox/hq ADR 0276): its own commits, and the earlier
@@ -252,12 +236,10 @@ func (p Plan) Waiting() bool {
 	return p.Delivery != nil && p.Delivery.Awaits != "" && p.Delivery.Go == nil
 }
 
-// PlanSaved is told every plan this process kept, after it is kept, with the inventory that kept it (novox/hq
-// ADR 0239): the serving controller says it on the bus as `plan-moved`, and so does a command (the controller's
-// run installs it for every verb, novox/hq ADR 0308 decision 1), so the save that starts or ends a walk is said
-// whichever process made it. Nil says nothing; whoever follows a walk also asks for it, and finds an unsaid save
-// by comparison.
-var PlanSaved func(*Inventory, Plan)
+// PlanSaved is told every plan this process kept, after it is kept (novox/hq ADR 0239): the serving
+// controller says it on the bus as `plan-moved`. Nil in a command, which says nothing; whoever follows a
+// walk also asks for it, so a save made by a command is found by comparison.
+var PlanSaved func(Plan)
 
 // ErrPlanMoved is a save against a plan written by somebody else since it was read.
 var ErrPlanMoved = errors.New("the plan was written by somebody else since it was read")
@@ -469,7 +451,7 @@ type MergeMove struct {
 // leaves a merge answered by two plans, nor a walk stopped whose merges were not moved). A plan written by
 // somebody else since it was read refuses the whole act with ErrPlanMoved. Each plan is said (PlanSaved) once
 // the transaction is committed, in order.
-func (i *Inventory) SavePlansMoving(ctx context.Context, plans []*Plan, moves []MergeMove) (err error) {
+func (i *Inventory) SavePlansMoving(ctx context.Context, plans []*Plan, moves []MergeMove) error {
 	epoch, err := i.actingEpoch(ctx)
 	if err != nil {
 		if len(plans) > 0 {
@@ -490,20 +472,6 @@ func (i *Inventory) SavePlansMoving(ctx context.Context, plans []*Plan, moves []
 		entered  time.Time
 	}
 	done := make([]written, len(plans))
-	// **The save that starts or ends a walk is marked** (novox/hq ADR 0308 decision 1), in the same write, and
-	// unmarked should the write not be made, so the next save marks it again.
-	marked := time.Now()
-	undo := make([]func(), 0, len(plans))
-	defer func() {
-		if err != nil {
-			for _, u := range undo {
-				u()
-			}
-		}
-	}()
-	for _, p := range plans {
-		undo = append(undo, p.markWalk(marked))
-	}
 	for n, p := range plans {
 		revision, entered, err := writePlan(ctx, tx, p, epoch)
 		if err != nil {
@@ -529,7 +497,7 @@ func (i *Inventory) SavePlansMoving(ctx context.Context, plans []*Plan, moves []
 			p.Epoch = 0
 		}
 		if PlanSaved != nil {
-			PlanSaved(i, *p)
+			PlanSaved(*p)
 		}
 	}
 	return nil

internal/inventory/seats_test.go

@@ -202,15 +202,14 @@ func TestASeatsVerbGainsTheArgumentsTheBinaryNames(t *testing.T) {
 		t.Fatal("failed was not added to the row")
 	}
 	// The optional mark is not stored; the working set read from the rows takes it from the compiled seat,
-	// so a holder that does not serve the optional failed still holds the seat.
+	// so today's holder, which does not serve failed, still holds the seat.
 	catalogue.UseSeats(seats)
 	defer catalogue.UseSeats(catalogue.DefaultSeats())
 	live, _ := catalogue.SeatNamed(catalogue.ServiceManagerSeat)
 	holder := catalogue.Manifest{Module: "systemd", Version: "1", Claims: []catalogue.Claim{{Name: catalogue.ServiceManagerSeat,
-		Scope: catalogue.ScopeNode, Serves: []string{"units", "status", "start", "stop", "restart", "enable", "disable", "journal",
-			"reset-failed", "wanted-by", "unlink-dangling"}}}}
+		Scope: catalogue.ScopeNode, Serves: []string{"units", "status", "start", "stop", "restart", "enable", "disable", "journal"}}}}
 	if err := catalogue.CanHold(holder, live); err != nil {
-		t.Fatalf("the seat read from the store refuses a holder without the optional failed: %v", err)
+		t.Fatalf("the seat read from the store refuses today's holder: %v", err)
 	}
 	// Seeding again changes nothing more.
 	before := verbs["journal"]

internal/inventory/walksaid.go

@@ -1,81 +0,0 @@
-package inventory
-
-import "time"
-
-// A walk says when it starts and when it ends (novox/hq ADR 0308 decision 1): the save that starts it and the
-// save that ends it are marked, so `plan-moved` names what the walk touches, its bound and its outcome on those
-// two saves, and on no other. The marks are kept in the walk's times, so a controller replaced mid-walk (a core
-// walk replaces it) neither says a start again nor misses the end.
-
-// The moments of a walk `plan-moved` names.
-const (
-	WalkStarted = "started"
-	WalkEnded   = "ended"
-)
-
-// The outcomes of an ended walk (ADR 0308 decision 1).
-const (
-	WalkDelivered = "delivered"
-	WalkFailed    = "failed"
-	WalkStopped   = "stopped"
-)
-
-// Live says the walk is walking: cut, not waiting for its delivery's word, and not ended.
-func (p Plan) Live() bool { return p.Open() && !p.Batch() && !p.Waiting() }
-
-// Ended says the walk is in a state it does not leave by itself: done, failed or superseded.
-func (p Plan) Ended() bool {
-	return p.State == PlanDone || p.State == PlanFailed || p.State == PlanSuperseded
-}
-
-// Outcome is how an ended walk ended: delivered when done; stopped when a person or the delivery's owner stopped
-// it, or a newer walk took it over; failed otherwise. Empty for a walk not ended.
-func (p Plan) Outcome() string {
-	switch {
-	case p.State == PlanDone:
-		return WalkDelivered
-	case p.State == PlanSuperseded:
-		return WalkStopped
-	case p.State == PlanFailed && p.Delivery != nil && p.Delivery.Stopped != "":
-		return WalkStopped
-	case p.State == PlanFailed:
-		return WalkFailed
-	}
-	return ""
-}
-
-// markWalk marks the save that starts or ends the walk, in its times and in WalkSaid, and returns what undoes
-// the mark should the save not be written. A walk starts on the first save that finds it live — when it is cut
-// and needs no word, or when it is let go — which is before its first tier is asked, and so before anything is
-// sent: what it restarts is held from its first send on. It starts again when a failed walk is retried. It ends
-// on the first save that finds it ended after it started; one that ends without ever starting (a batch that
-// moved nothing, a walk stopped while it waited for its word) touched nothing and says neither. A walk kept
-// before its times were (ADR 0282 decision 6) is not marked; a release plan is, its times holding only these.
-func (p *Plan) markWalk(now time.Time) (undo func()) {
-	p.WalkSaid = ""
-	if p.Batch() || (p.Times == nil && p.Release == nil) {
-		return func() {}
-	}
-	var was *PlanTimes
-	if p.Times != nil {
-		kept := *p.Times
-		was = &kept
-	}
-	times := PlanTimes{}
-	if p.Times != nil {
-		times = *p.Times
-	}
-	at := now.UTC()
-	switch {
-	case p.Live() && (times.Started == nil || times.Ended != nil):
-		times.Started, times.Ended = &at, nil
-		p.WalkSaid = WalkStarted
-	case p.Ended() && times.Started != nil && times.Ended == nil:
-		times.Ended = &at
-		p.WalkSaid = WalkEnded
-	default:
-		return func() {}
-	}
-	p.Times = &times
-	return func() { p.Times, p.WalkSaid = was, "" }
-}

internal/inventory/walksaid_test.go

@@ -1,130 +0,0 @@
-package inventory
-
-import (
-	"testing"
-	"time"
-)
-
-// A walk is said started on the save that finds it live, ended on the save that finds it ended after it started,
-// and neither on any other save (novox/hq ADR 0308 decision 1).
-func TestAWalkIsSaidStartedOnceAndEndedOnce(t *testing.T) {
-	now := time.Date(2026, 10, 12, 11, 0, 0, 0, time.UTC)
-	cut := now.Add(-time.Second)
-	p := Plan{ID: "plan-1", State: PlanBuilding, Tiers: [][]string{{"messenger"}},
-		Modules: map[string]*PlanModule{"messenger": {}}, Times: &PlanTimes{Cut: &cut, Class: ClassLeaf}}
-	p.markWalk(now)
-	if p.WalkSaid != WalkStarted || p.Times.Started == nil || !p.Times.Started.Equal(now) {
-		t.Fatalf("a live walk's first save starts it: %q %+v", p.WalkSaid, p.Times)
-	}
-	p.State = PlanRolling
-	p.markWalk(now.Add(time.Minute))
-	if p.WalkSaid != "" || !p.Times.Started.Equal(now) {
-		t.Fatalf("a later save says nothing and keeps the start: %q %+v", p.WalkSaid, p.Times)
-	}
-	p.State = PlanDone
-	p.markWalk(now.Add(2 * time.Minute))
-	if p.WalkSaid != WalkEnded || p.Times.Ended == nil || p.Outcome() != WalkDelivered {
-		t.Fatalf("the save that finds it done ends it, delivered: %q %+v %q", p.WalkSaid, p.Times, p.Outcome())
-	}
-	p.markWalk(now.Add(3 * time.Minute))
-	if p.WalkSaid != "" {
-		t.Fatalf("an ended walk saved again says nothing: %q", p.WalkSaid)
-	}
-	// Retried, it walks again: a new start.
-	p.State = PlanBuilding
-	p.markWalk(now.Add(4 * time.Minute))
-	if p.WalkSaid != WalkStarted || p.Times.Ended != nil || !p.Times.Started.Equal(now.Add(4*time.Minute)) {
-		t.Fatalf("a retried walk starts again: %q %+v", p.WalkSaid, p.Times)
-	}
-}
-
-// What is never said: a batch, a walk waiting for its word, a walk that ends without having started, and a walk
-// kept before its times were. A release plan is said.
-func TestWhatIsNotAWalkStartIsNotSaid(t *testing.T) {
-	now := time.Now()
-	for name, p := range map[string]Plan{
-		"a batch":             {State: PlanAssembling, Times: &PlanTimes{}},
-		"waiting for a word":  {State: PlanBuilding, Times: &PlanTimes{}, Delivery: &PlanDelivery{Awaits: "mesh-delivery"}},
-		"ended, never begun":  {State: PlanDone, Times: &PlanTimes{}},
-		"kept before times":   {State: PlanBuilding},
-		"stopped while waits": {State: PlanFailed, Times: &PlanTimes{}, Delivery: &PlanDelivery{Awaits: "mesh-delivery", Stopped: "x"}},
-	} {
-		p.markWalk(now)
-		if p.WalkSaid != "" {
-			t.Errorf("%s: said %q", name, p.WalkSaid)
-		}
-	}
-	r := Plan{State: PlanRolling, Release: &PlanRelease{Order: []string{"ace"}}}
-	r.markWalk(now)
-	if r.WalkSaid != WalkStarted || r.Times == nil || r.Times.Started == nil || r.Times.Class != "" {
-		t.Fatalf("a release plan is said started, its times holding only that: %q %+v", r.WalkSaid, r.Times)
-	}
-	// Let go, the walk starts.
-	go1 := now
-	w := Plan{State: PlanBuilding, Times: &PlanTimes{}, Delivery: &PlanDelivery{Awaits: "mesh-delivery", Go: &go1}}
-	w.markWalk(now)
-	if w.WalkSaid != WalkStarted {
-		t.Fatalf("a walk let go starts: %q", w.WalkSaid)
-	}
-}
-
-// An ended walk's outcome: delivered, failed, or stopped by a person or the delivery's owner, or by a newer walk.
-func TestAWalksOutcome(t *testing.T) {
-	for want, p := range map[string]Plan{
-		WalkDelivered: {State: PlanDone},
-		WalkFailed:    {State: PlanFailed},
-		WalkStopped:   {State: PlanFailed, Delivery: &PlanDelivery{Stopped: "mesh-delivery"}},
-		"":            {State: PlanRolling},
-	} {
-		if got := p.Outcome(); got != want {
-			t.Errorf("%s: outcome %q, want %q", p.State, got, want)
-		}
-	}
-	if (Plan{State: PlanSuperseded}).Outcome() != WalkStopped {
-		t.Error("a superseded walk is stopped")
-	}
-}
-
-// The marks are kept with the walk, so a controller replaced mid-walk neither says its start again nor misses
-// its end; and a save refused leaves the walk unmarked, so the save that is made says it.
-func TestAWalksStartIsKeptAndARefusedSaveLeavesItUnsaid(t *testing.T) {
-	inv := ForTest(t)
-	ctx := t.Context()
-	cut := time.Now().UTC().Add(-time.Minute)
-	p := Plan{ID: "plan-308", Repository: "novox/mesh-catalog", Commit: "abc", Created: cut, State: PlanBuilding,
-		Tiers: [][]string{{"messenger"}}, Modules: map[string]*PlanModule{"messenger": {}},
-		Times: &PlanTimes{Cut: &cut, Class: ClassLeaf}}
-	var said []string
-	was := PlanSaved
-	PlanSaved = func(_ *Inventory, p Plan) { said = append(said, p.WalkSaid) }
-	t.Cleanup(func() { PlanSaved = was })
-	if err := inv.SavePlan(ctx, &p); err != nil {
-		t.Fatal(err)
-	}
-	back, err := inv.PlanByID(ctx, p.ID)
-	if err != nil || back.Times == nil || back.Times.Started == nil || back.Times.Class != ClassLeaf {
-		t.Fatalf("the start is kept with the walk: %v %+v", err, back.Times)
-	}
-	// Read back by another controller and saved: not said again.
-	back.State = PlanRolling
-	if err := inv.SavePlan(ctx, &back); err != nil {
-		t.Fatal(err)
-	}
-	// A stale copy ending it is refused, and unmarked.
-	stale := p
-	stale.Revision = 1
-	stale.State = PlanDone
-	if err := inv.SavePlan(ctx, &stale); err == nil {
-		t.Fatal("a stale save is refused")
-	}
-	if stale.WalkSaid != "" || stale.Times.Ended != nil {
-		t.Fatalf("a refused save is unmarked: %q %+v", stale.WalkSaid, stale.Times)
-	}
-	back.State = PlanDone
-	if err := inv.SavePlan(ctx, &back); err != nil {
-		t.Fatal(err)
-	}
-	if len(said) != 3 || said[0] != WalkStarted || said[1] != "" || said[2] != WalkEnded {
-		t.Fatalf("said: %q, want started, nothing, ended", said)
-	}
-}

internal/link/handover.go

@@ -148,28 +148,6 @@ func AskSetuidSearch(ctx context.Context, conn *nats.Conn, signer Signer, node,
 			"there", record: "a start"})
 }
 
-// JudgeDirectoriesContext is prefixed to a directory judgement ask's bytes before signing (novox/hq issue 358): never
-// another ask's signature, nor a declaration's. The engine holds the same words.
-const JudgeDirectoriesContext = "novox-mesh judge-directories v1\n"
-
-// AskJudgeDirectories asks one machine's node-engine to judge, read-only, which of the directories it is declared
-// the walk that follows no link another account could make would refuse (novox/hq issue 358): the ask a hand-over
-// is, naming no path, signed under JudgeDirectoriesContext. The engine changes nothing and answers one line per
-// directory.
-func AskJudgeDirectories(ctx context.Context, conn *nats.Conn, signer Signer, node, by string,
-	timeout time.Duration) (HandOverAnswer, error) {
-	if conn == nil {
-		return HandOverAnswer{}, errors.New("this controller is not on the bus")
-	}
-	body, err := signAsk(ctx, signer, JudgeDirectoriesContext, HandOverAsk{Node: node, By: by})
-	if err != nil {
-		return HandOverAnswer{}, err
-	}
-	return askSigned(ctx, conn, broker.AskJudgeDirectoriesSubject(node), body, node, timeout, askWords{
-		what: "a judgement of its directories", nothing: "nothing was judged, and nothing is changed by one",
-		issue: "issue 358", unknown: "ask again: a judgement changes nothing", record: "a judgement"})
-}
-
 // SignHandOver fills the ask's expiry and nonce and signs it with the mesh's key, over HandOverContext and the
 // ask's bytes exactly as they travel.
 func SignHandOver(ctx context.Context, signer Signer, ask HandOverAsk) ([]byte, error) {

internal/link/judge_directories_test.go

@@ -1,60 +0,0 @@
-package link
-
-import (
-	"context"
-	"crypto/ed25519"
-	"encoding/json"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/nats-io/nats.go"
-
-	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/testbus"
-)
-
-// A judgement of a machine's directories is asked of the machine on its own subject, signed under its own context
-// (never a hand-over's), naming no path, and the engine's answer comes back (novox/hq issue 358). The engine holds the
-// same subject and context (mesh-host internal/link, TestTheDirectoryJudgementAskKeepsItsSubjectAndContext).
-func TestADirectoryJudgementIsAskedOfTheMachineSignedUnderItsOwnContext(t *testing.T) {
-	if broker.AskJudgeDirectoriesSubject("laptop") != "mesh.node.laptop.ask.judge-directories" ||
-		JudgeDirectoriesContext != "novox-mesh judge-directories v1\n" {
-		t.Fatalf("the subject %q, the context %q", broker.AskJudgeDirectoriesSubject("laptop"), JudgeDirectoriesContext)
-	}
-	conn, err := nats.Connect(testbus.URL(t))
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(conn.Close)
-	signer, public := testSigner(t)
-	var heard HandOverAsk
-	engine, err := conn.Subscribe(broker.AskJudgeDirectoriesSubject("laptop"), func(msg *nats.Msg) {
-		var signed SignedHandOver
-		_ = json.Unmarshal(msg.Data, &signed)
-		if ed25519.Verify(public, append([]byte(HandOverContext), signed.Ask...), signed.Signature) ||
-			ed25519.Verify(public, append([]byte(SetuidSearchContext), signed.Ask...), signed.Signature) ||
-			!ed25519.Verify(public, append([]byte(JudgeDirectoriesContext), signed.Ask...), signed.Signature) {
-			_ = msg.Respond([]byte(`{"refused":"not signed as a judgement"}`))
-			return
-		}
-		_ = json.Unmarshal(signed.Ask, &heard)
-		body, _ := json.Marshal(HandOverAnswer{Said: "3 directories declared, asked by " + heard.By})
-		_ = msg.Respond(body)
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { _ = engine.Unsubscribe() })
-	a, err := AskJudgeDirectories(context.Background(), conn, signer, "laptop", "jo", 5*time.Second)
-	if err != nil || a.Said != "3 directories declared, asked by jo" {
-		t.Fatalf("answered %+v, %v", a, err)
-	}
-	if heard.Node != "laptop" || heard.Path != "" || heard.Nonce == "" || heard.Expires.IsZero() {
-		t.Fatalf("the engine heard %+v", heard)
-	}
-	if _, err := AskJudgeDirectories(context.Background(), conn, signer, "anchor", "jo", 5*time.Second); err == nil ||
-		!strings.Contains(err.Error(), "nothing was judged") {
-		t.Fatalf("a machine with no engine listening: %v", err)
-	}
-}

internal/link/queue.go

@@ -7,7 +7,6 @@ import (
 	"fmt"
 	"regexp"
 	"sort"
-	"strings"
 	"time"
 
 	"github.com/nats-io/nats.go"
@@ -269,30 +268,6 @@ func ReadQueue(ctx context.Context, js *broker.JetStream, seat string) (Queue, e
 	return q, nil
 }
 
-// WithoutPassword is a repository as a listing may say it: a URL's password, should one ever be written
-// into it, left out (novox/hq issue 455). Only for what is shown: the ask itself keeps what it was given,
-// which a cancel's outcome and a rebuild's match are read from.
-func WithoutPassword(repository string) string {
-	scheme, rest, found := strings.Cut(repository, "://")
-	if !found {
-		return repository
-	}
-	authority, path, _ := strings.Cut(rest, "/")
-	at := strings.LastIndex(authority, "@")
-	if at < 0 {
-		return repository
-	}
-	user, _, password := strings.Cut(authority[:at], ":")
-	if !password {
-		return repository
-	}
-	out := scheme + "://" + user + authority[at:]
-	if len(rest) > len(authority) {
-		out += "/" + path
-	}
-	return out
-}
-
 // ReadBuildEvents is every start and outcome the seat announced since a moment, from the events
 // stream, with a consumer of its own that is gone when this returns.
 func ReadBuildEvents(ctx context.Context, js *broker.JetStream, seat string, since time.Time) (BuildHeard, error) {

module.json

@@ -89,7 +89,6 @@
     "cleanup",
     "dead-letters",
     "root-free",
-    "judge-directories",
     "data",
     "build",
     "artifacts",

testdata/beside/CAPTURED

@@ -8,7 +8,7 @@ private addresses. That is acceptable while mesh-controller is private; if it ev
 a second place to clean besides the catalogue itself.
 
 mesh-catalog  b9de001833b1b61b297182b8e3bcdae1cbdeace9  modules/*/module.json, modules/nats/Dockerfile
-mesh-host     a76baa4b47f07a8b2bab065603414530bd02b53a  examples/foundation-first-node-nats.lock
+mesh-host     bd5cc6980419c1bd4824be6d58dfebd2381a9de3  examples/foundation-first-node-nats.lock
 mesh-sdk      33917f91ac3cc213b879b32f3c70e2aa70395f98  conformance/events/module-event.json
 
 To move them, from this repository's root, with the two repositories checked out beside it:

testdata/beside/mesh-host/examples/foundation-first-node-nats.lock

@@ -161,7 +161,7 @@
       "type": "file",
       "path": "/var/lib/mesh-bus-conf/accounts.conf",
       "mode": "0600",
-      "content": "// The first user list, carried by the installer because at genesis there is no mesh to\n// compose one. A bootstrap credential, rotated with the store's and replaced by the\n// controller's own composition from its first start onward.\naccounts {\n  MESH {\n    jetstream: enabled\n    users = [\n      { user: \"controller\", password: \"$2a$10$AHqJgOifIVbU41KmATiMhuXFs8xa7Wl2HuN4UVBCXdN2jIQzjqApy\", permissions: {\n        publish: { allow: [\"$JS.ACK.CONTROL.controller.>\", \"$JS.ACK.EVENTS.controller.>\", \"$JS.ACK.DEAD_LETTER_NOTICES.controller.>\", \"$JS.API.>\", \"$KV.mesh-controller_asked.>\", \"$KV.mesh-controller_calls.>\", \"$KV.mesh-controller_hand-acts.>\", \"$KV.mesh-controller_conditions.>\", \"$KV.mesh-controller_condition-history.>\", \"$KV.mesh-controller_lease.>\", \"$KV.SEAT_MESH_BUILD_MACHINE_cancelled.>\", \"$KV.SEAT_NODE_BUILD_AGENT_cancelled.>\", \"_INBOX.enrol.>\", \"mesh.assignment.>\", \"mesh.mod.*.tool.>\", \"mesh.node.>\", \"mesh.seat.mesh-build-machine.accept.>\", \"mesh.seat.node-build-agent.accept.>\", \"mesh.seat.mesh-build-machine.tool.>\", \"mesh.seat.node-build-agent.tool.>\", \"mesh.seat.mesh-controller.event.applied\", \"mesh.seat.mesh-controller.event.built-before\", \"mesh.seat.mesh-controller.event.refused\", \"mesh.seat.mesh-controller.event.rolled-back\", \"mesh.seat.mesh-controller.event.checked\", \"mesh.seat.mesh-controller.event.plan-moved\", \"mesh.seat.mesh-controller.event.condition-raised\", \"mesh.seat.mesh-controller.event.condition-changed\", \"mesh.seat.mesh-controller.event.condition-cleared\", \"mesh.seat.mesh-controller.event.doctor-heartbeat\", \"mesh.seat.mesh-controller.event.secret-replaced\", \"mesh.seat.mesh-controller.event.healer-acted\", \"$SRV.INFO\", \"mesh.seat.node-intrusion-prevention.tool.banned.*\", \"mesh.seat.node-backup.tool.backed-up.*\", \"mesh.seat.node-backup.tool.now.*\", \"mesh.seat.mesh-delivery.tool.stalled\", \"mesh.seat.mesh-delivery.tool.close\", \"mesh.seat.node-launcher.tool.secret.*\", \"mesh.seat.mesh-delivery.tool.release\", \"mesh.seat.mesh-delivery.tool.stop\", \"mesh.seat.mesh-delivery.tool.times\", \"mesh.seat.mesh-delivery.tool.groups\", \"mesh.seat.node-service-manager.tool.restart.*\", \"mesh.seat.mesh-controller.tool.plans\", \"mesh.events.dead.>\", \"mesh.again.>\"] }\n        subscribe: { allow: [\"$JS.API.>\", \"$JS.EVENT.ADVISORY.CONSUMER.MAX_DELIVERIES.>\", \"$JS.EVENT.ADVISORY.CONSUMER.DELETED.>\", \"_DELIVER.controller\", \"_DELIVER.controller.>\", \"_INBOX.controller.>\", \"mesh.control.>\", \"mesh.mod.*.event.provisioner.failing\", \"mesh.mod.*.event.provisioner.recovered\", \"mesh.mod.*.event.provisioner.retirement\", \"mesh.mod.gitea.event.pull.merged\", \"mesh.mod.gitea.event.pull.updated\", \"mesh.mod.mesh-catalog.event.catching-up\", \"mesh.mod.mesh-catalog.event.upgraded\", \"mesh.seat.mesh-build-machine.event.built\", \"mesh.seat.node-build-agent.event.built\", \"mesh.seat.operator-channel.event.decided.mesh-controller\", \"mesh.seat.mesh-controller.tool.>\", \"$SRV.PING\", \"$SRV.INFO\", \"$SRV.PING.mesh-controller\", \"$SRV.PING.mesh-controller.>\", \"$SRV.INFO.mesh-controller\", \"$SRV.INFO.mesh-controller.>\", \"$SRV.STATS\", \"$SRV.STATS.mesh-controller\", \"$SRV.STATS.mesh-controller.>\"] }\n        allow_responses: { max: 1, ttl: \"1m\" }\n      } }\n    ]\n  }\n}\n"
+      "content": "// The first user list, carried by the installer because at genesis there is no mesh to\n// compose one. A bootstrap credential, rotated with the store's and replaced by the\n// controller's own composition from its first start onward.\naccounts {\n  MESH {\n    jetstream: enabled\n    users = [\n      { user: \"controller\", password: \"$2a$10$AHqJgOifIVbU41KmATiMhuXFs8xa7Wl2HuN4UVBCXdN2jIQzjqApy\", permissions: {\n        publish: { allow: [\"$JS.ACK.CONTROL.controller.>\", \"$JS.ACK.EVENTS.controller.>\", \"$JS.ACK.DEAD_LETTER_NOTICES.controller.>\", \"$JS.API.>\", \"$KV.mesh-controller_asked.>\", \"$KV.mesh-controller_calls.>\", \"$KV.mesh-controller_hand-acts.>\", \"$KV.mesh-controller_conditions.>\", \"$KV.mesh-controller_condition-history.>\", \"$KV.mesh-controller_lease.>\", \"$KV.SEAT_MESH_BUILD_MACHINE_cancelled.>\", \"$KV.SEAT_NODE_BUILD_AGENT_cancelled.>\", \"_INBOX.enrol.>\", \"mesh.assignment.>\", \"mesh.mod.*.tool.>\", \"mesh.node.>\", \"mesh.seat.mesh-build-machine.accept.>\", \"mesh.seat.node-build-agent.accept.>\", \"mesh.seat.mesh-build-machine.tool.>\", \"mesh.seat.node-build-agent.tool.>\", \"mesh.seat.mesh-controller.event.applied\", \"mesh.seat.mesh-controller.event.built-before\", \"mesh.seat.mesh-controller.event.refused\", \"mesh.seat.mesh-controller.event.rolled-back\", \"mesh.seat.mesh-controller.event.checked\", \"mesh.seat.mesh-controller.event.plan-moved\", \"mesh.seat.mesh-controller.event.condition-raised\", \"mesh.seat.mesh-controller.event.condition-changed\", \"mesh.seat.mesh-controller.event.condition-cleared\", \"mesh.seat.mesh-controller.event.doctor-heartbeat\", \"mesh.seat.mesh-controller.event.secret-replaced\", \"mesh.seat.mesh-controller.event.healer-acted\", \"$SRV.INFO\", \"mesh.seat.node-intrusion-prevention.tool.banned.*\", \"mesh.seat.node-backup.tool.backed-up.*\", \"mesh.seat.node-backup.tool.now.*\", \"mesh.seat.mesh-delivery.tool.stalled\", \"mesh.seat.mesh-delivery.tool.close\", \"mesh.seat.node-launcher.tool.secret.*\", \"mesh.seat.mesh-delivery.tool.release\", \"mesh.seat.mesh-delivery.tool.stop\", \"mesh.seat.mesh-delivery.tool.times\", \"mesh.seat.node-service-manager.tool.restart.*\", \"mesh.seat.mesh-controller.tool.plans\", \"mesh.events.dead.>\", \"mesh.again.>\"] }\n        subscribe: { allow: [\"$JS.API.>\", \"$JS.EVENT.ADVISORY.CONSUMER.MAX_DELIVERIES.>\", \"$JS.EVENT.ADVISORY.CONSUMER.DELETED.>\", \"_DELIVER.controller\", \"_DELIVER.controller.>\", \"_INBOX.controller.>\", \"mesh.control.>\", \"mesh.mod.*.event.provisioner.failing\", \"mesh.mod.*.event.provisioner.recovered\", \"mesh.mod.*.event.provisioner.retirement\", \"mesh.mod.gitea.event.pull.merged\", \"mesh.mod.gitea.event.pull.updated\", \"mesh.mod.mesh-catalog.event.catching-up\", \"mesh.mod.mesh-catalog.event.upgraded\", \"mesh.seat.mesh-build-machine.event.built\", \"mesh.seat.node-build-agent.event.built\", \"mesh.seat.operator-channel.event.decided.mesh-controller\", \"mesh.seat.mesh-controller.tool.>\", \"$SRV.PING\", \"$SRV.INFO\", \"$SRV.PING.mesh-controller\", \"$SRV.PING.mesh-controller.>\", \"$SRV.INFO.mesh-controller\", \"$SRV.INFO.mesh-controller.>\", \"$SRV.STATS\", \"$SRV.STATS.mesh-controller\", \"$SRV.STATS.mesh-controller.>\"] }\n        allow_responses: { max: 1, ttl: \"1m\" }\n      } }\n    ]\n  }\n}\n"
     },
     {
       "id": "broker",

testdata/beside/mesh-host/internal/apply/placement_guard.go.captured

@@ -31,13 +31,6 @@ package apply
 //  5. **A mount source that is a refused directory or a refused access is refused with it**: the container
 //     would otherwise bind the very path the engine would not place, and the runtime creates a missing one
 //     as root.
-//  6. **A file is judged as a directory is** (novox/hq issue 495): never one of the machine's own roots, nor
-//     in a tree nothing is placed in (rule 2), and never below a directory or an access refused here. A file
-//     or an archive below a refused path is refused with it, whichever module declares it and in whatever
-//     order. Rules 3 and 4 are a directory's owner and do not reach a file: a file below /etc is the mesh's
-//     ordinary configuration, and one below a home is judged by home_links.go and agent_home_guard.go.
-//     A refused directory also gates the rest of its module, as a step that did not complete does
-//     (apply.go's `gated`): what a module declares after its directory was written for that directory.
 //
 // Each is a failed resource with its reason in the node's report; nothing is touched. Paths are judged as
 // declared and again with every link in them resolved, so a link at /srv/x pointing at /etc places nothing.
@@ -407,7 +400,6 @@ const (
 	placingDirectory placing = iota
 	placingAccess
 	placingMount
-	placingFile
 )
 
 // refusePath says why a path is not placed or mounted; nil when it may be. module is the resource's module,
@@ -474,7 +466,7 @@ func refuseOne(path string, kind placing, module, owner string) *PlacementRefuse
 	for _, part := range strings.Split(path, "/") {
 		ssh = ssh || part == ".ssh"
 	}
-	if ssh && (kind == placingAccess || kind == placingMount) {
+	if ssh && kind != placingDirectory {
 		return &PlacementRefusedError{Path: path, Why: "it is an account's .ssh, which holds its keys and who may " +
 			"log in as it, and is never an access or a mount"}
 	}
@@ -510,12 +502,8 @@ func moduleOfID(id string) string {
 	return module
 }
 
-// refusedPlaces judges every directory, access, file and archive of a declaration before anything is applied,
-// and answers each refusal by path: what is refused is refused again as a container's mount source.
-//
-// Directories and accesses first, so a file or an archive below one of them is refused with it whatever order
-// they are declared in (novox/hq issue 495): the engine refused Docker's data root as a directory and then wrote
-// a file into it, because nothing judged the file's path.
+// refusedPlaces judges every directory and access of a declaration before anything is applied, and answers
+// each refusal by path: what is refused is refused again as a container's mount source.
 func refusedPlaces(resources []declaration.Resource) map[string]error {
 	out := map[string]error{}
 	for _, r := range resources {
@@ -532,60 +520,9 @@ func refusedPlaces(resources []declaration.Resource) map[string]error {
 			out[filepath.Clean(r.Target())] = err
 		}
 	}
-	trees := make(map[string]error, len(out))
-	for path, err := range out {
-		trees[path] = err
-	}
-	for _, r := range resources {
-		var err error
-		switch res := r.(type) {
-		case *declaration.File:
-			if err = belowRefused(res.Path, trees); err == nil {
-				err = refusePath(res.Path, placingFile, moduleOfID(res.ID), "")
-			}
-		case *declaration.Archive:
-			// Only below a refused path: where an archive may unpack is otherwise the archive's own judgement
-			// (archive.go), and the engine's own module unpacks its versions into its own tree.
-			err = belowRefused(res.Path, trees)
-		default:
-			continue
-		}
-		if err != nil {
-			out[filepath.Clean(r.Target())] = err
-		}
-	}
 	return out
 }
 
-// belowRefused says why a path below a refused directory or access is refused with it; nil when it is below
-// none. Judged as declared and with its links resolved, as refusePath judges.
-func belowRefused(path string, refused map[string]error) error {
-	clean := filepath.Clean(path)
-	if !filepath.IsAbs(clean) {
-		return nil
-	}
-	for _, p := range []string{clean, resolved(clean)} {
-		// The deepest refused tree it is below, so the same declaration always gives the same reason.
-		var tree string
-		for t := range refused {
-			if below(p, t) && len(t) > len(tree) {
-				tree = t
-			}
-		}
-		if tree == "" {
-			continue
-		}
-		why := refused[tree]
-		reason := why.Error()
-		var refusal *PlacementRefusedError
-		if errors.As(why, &refusal) {
-			reason = refusal.Why
-		}
-		return &PlacementRefusedError{Path: clean, Why: "it is below " + tree + ", which is refused: " + reason}
-	}
-	return nil
-}
-
 // refuseMounts says why a container's mounts are not made; nil when they may be.
 func refuseMounts(c *declaration.Container, refused map[string]error) error {
 	for _, v := range c.Volumes {

testdata/store-tests

@@ -14,11 +14,3 @@
 ./internal/inventory TestAnIssuedValueIsSealedAgainAfterAKeyChangeOrAnAcceptance
 ./internal/inventory TestAConditionsLooksAreKeptBesideTheBucket
 ./cmd/mesh-controller TestTheConditionsVerbReadsTheLooksTheBucketNoLongerHolds
-./internal/inventory TestAWalksStartIsKeptAndARefusedSaveLeavesItUnsaid
-./cmd/mesh-controller TestAWalkLetGoAndStoppedByVerbsIsSaidStartedAndEnded
-./cmd/mesh-controller TestAWalkStoppedOrClosedByAPersonIsSaidEndedStopped
-./cmd/mesh-controller TestAWalkRetriedByAPersonIsSaidStartedAgain
-./cmd/mesh-controller TestABacklogReleasedByAPersonIsSaidStarted
-./cmd/mesh-controller TestAWalkEndedByCancelOrClearIsSaidEnded
-./cmd/mesh-controller TestAWalkRestartedByARebuildIsSaidStarted
-./cmd/mesh-controller TestAWalkStoppedByHandAndRetriedEndsFailedWhenItFailsAgain

vendor/github.com/therootcompany/xz/AUTHORS

@@ -1,8 +0,0 @@
-# Package xz authors
-
-Michael Cross <https://github.com/xi2>
-
-# XZ Embedded authors
-
-Lasse Collin <lasse.collin@tukaani.org>
-Igor Pavlov <http://7-zip.org/>

vendor/github.com/therootcompany/xz/LICENSE

@@ -1,86 +0,0 @@
-Creative Commons CC0 1.0 Universal
-
-CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE LEGAL
-SERVICES. DISTRIBUTION OF THIS DOCUMENT DOES NOT CREATE AN ATTORNEY-CLIENT
-RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS INFORMATION ON AN "AS-IS" BASIS.
-CREATIVE COMMONS MAKES NO WARRANTIES REGARDING THE USE OF THIS DOCUMENT OR THE
-INFORMATION OR WORKS PROVIDED HEREUNDER, AND DISCLAIMS LIABILITY FOR DAMAGES
-RESULTING FROM THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED
-HEREUNDER.
-
-Statement of Purpose
-
-The laws of most jurisdictions throughout the world automatically confer
-exclusive Copyright and Related Rights (defined below) upon the creator and
-subsequent owner(s) (each and all, an "owner") of an original work of
-authorship and/or a database (each, a "Work").
-
-Certain owners wish to permanently relinquish those rights to a Work for the
-purpose of contributing to a commons of creative, cultural and scientific
-works ("Commons") that the public can reliably and without fear of later
-claims of infringement build upon, modify, incorporate in other works, reuse
-and redistribute as freely as possible in any form whatsoever and for any
-purposes, including without limitation commercial purposes. These owners may
-contribute to the Commons to promote the ideal of a free culture and the
-further production of creative, cultural and scientific works, or to gain
-reputation or greater distribution for their Work in part through the use and
-efforts of others.
-
-For these and/or other purposes and motivations, and without any expectation
-of additional consideration or compensation, the person associating CC0 with a
-Work (the "Affirmer"), to the extent that he or she is an owner of Copyright
-and Related Rights in the Work, voluntarily elects to apply CC0 to the Work
-and publicly distribute the Work under its terms, with knowledge of his or her
-Copyright and Related Rights in the Work and the meaning and intended legal
-effect of CC0 on those rights.
-
-1. Copyright and Related Rights. A Work made available under CC0 may be protected by copyright and related or neighboring rights ("Copyright and Related Rights"). Copyright and Related Rights include, but are not limited to, the following: 
-
-i. the right to reproduce, adapt, distribute, perform, display, communicate,
-and translate a Work;
-
-ii. moral rights retained by the original author(s) and/or performer(s);
-
-iii. publicity and privacy rights pertaining to a person's image or
-likeness depicted in a Work;
-
-iv. rights protecting against unfair competition in regards to a Work, subject
-to the limitations in paragraph 4(a), below;
-
-v. rights protecting the extraction, dissemination, use and reuse of data in a
-Work;
-
-vi. database rights (such as those arising under Directive 96/9/EC of the
-European Parliament and of the Council of 11 March 1996 on the legal
-protection of databases, and under any national implementation thereof,
-including any amended or successor version of such directive); and
-
-vii. other similar, equivalent or corresponding rights throughout the world
-based on applicable law or treaty, and any national implementations thereof.
-
-2. Waiver. To the greatest extent permitted by, but not in contravention of, applicable law, Affirmer hereby overtly, fully, permanently, irrevocably and unconditionally waives, abandons, and surrenders all of Affirmer's Copyright and Related Rights and associated claims and causes of action, whether now known or unknown (including existing as well as future claims and causes of action), in the Work (i) in all territories worldwide, (ii) for the maximum duration provided by applicable law or treaty (including future time extensions), (iii) in any current or future medium and for any number of copies, and (iv) for any purpose whatsoever, including without limitation commercial, advertising or promotional purposes (the "Waiver"). Affirmer makes the Waiver for the benefit of each member of the public at large and to the detriment of Affirmer's heirs and successors, fully intending that such Waiver shall not be subject to revocation, rescission, cancellation, termination, or any other legal or equitable action to disrupt the quiet enjoyment of the Work by the public as contemplated by Affirmer's express Statement of Purpose. 
-
-3. Public License Fallback. Should any part of the Waiver for any reason be judged legally invalid or ineffective under applicable law, then the Waiver shall be preserved to the maximum extent permitted taking into account Affirmer's express Statement of Purpose. In addition, to the extent the Waiver is so judged Affirmer hereby grants to each affected person a royalty-free, non transferable, non sublicensable, non exclusive, irrevocable and unconditional license to exercise Affirmer's Copyright and Related Rights in the Work (i) in all territories worldwide, (ii) for the maximum duration provided by applicable law or treaty (including future time extensions), (iii) in any current or future medium and for any number of copies, and (iv) for any purpose whatsoever, including without limitation commercial, advertising or promotional purposes (the "License"). The License shall be deemed effective as of the date CC0 was applied by Affirmer to the Work. Should any part of the License for any reason be judged legally invalid or ineffective under applicable law, such partial invalidity or ineffectiveness shall not invalidate the remainder of the License, and in such case Affirmer hereby affirms that he or she will not (i) exercise any of his or her remaining Copyright and Related Rights in the Work or (ii) assert any associated claims and causes of action with respect to the Work, in either case contrary to Affirmer's express Statement of Purpose. 
-
-4. Limitations and Disclaimers. 
-
-a. No trademark or patent rights held by Affirmer are waived, abandoned,
-surrendered, licensed or otherwise affected by this document.
-
-b. Affirmer offers the Work as-is and makes no representations or warranties
-of any kind concerning the Work, express, implied, statutory or otherwise,
-including without limitation warranties of title, merchantability, fitness for
-a particular purpose, non infringement, or the absence of latent or other
-defects, accuracy, or the present or absence of errors, whether or not
-discoverable, all to the greatest extent permissible under applicable law.
-
-c. Affirmer disclaims responsibility for clearing rights of other persons that
-may apply to the Work or any use thereof, including without limitation any
-person's Copyright and Related Rights in the Work. Further, Affirmer
-disclaims responsibility for obtaining any necessary consents, permissions or
-other rights required for any use of the Work.
-
-d. Affirmer understands and acknowledges that Creative Commons is not a party
-to this document and has no duty or obligation with respect to this CC0 or use
-of the Work.
-

vendor/github.com/therootcompany/xz/README.md

@@ -1,19 +0,0 @@
-# Xz
-
-Package xz implements XZ decompression natively in Go.
-
-Documentation at <https://pkg.go.dev/github.com/therootcompany/xz>.
-
-Download and install with `go get github.com/xi2/xz`.
-
-If you need compression as well as decompression, you might want to
-look at <https://github.com/ulikunitz/xz>.
-
-# LICENSE
-
-This was originally released into the public domain by the AUTHORS.
-
-Here it is licensed more explicitly as Creative Commons CC0 1.0 Universal
-(CC0-1.0) so that it can be detected by automated tooling, and satisfy the legal
-requirements for vendor integration for cases in which a "public domain"
-statement is not sufficient.

vendor/github.com/therootcompany/xz/dec_bcj.go

@@ -1,461 +0,0 @@
-/*
- * Branch/Call/Jump (BCJ) filter decoders
- *
- * Authors: Lasse Collin <lasse.collin@tukaani.org>
- *          Igor Pavlov <http://7-zip.org/>
- *
- * Translation to Go: Michael Cross <https://github.com/xi2>
- *
- * This file has been put into the public domain.
- * You can do whatever you want with this file.
- */
-
-package xz
-
-/* from linux/lib/xz/xz_dec_bcj.c *************************************/
-
-type xzDecBCJ struct {
-	/* Type of the BCJ filter being used */
-	typ xzFilterID
-	/*
-	 * Return value of the next filter in the chain. We need to preserve
-	 * this information across calls, because we must not call the next
-	 * filter anymore once it has returned xzStreamEnd
-	 */
-	ret xzRet
-	/*
-	 * Absolute position relative to the beginning of the uncompressed
-	 * data (in a single .xz Block).
-	 */
-	pos int
-	/* x86 filter state */
-	x86PrevMask uint32
-	/* Temporary space to hold the variables from xzBuf */
-	out    []byte
-	outPos int
-	temp   struct {
-		/* Amount of already filtered data in the beginning of buf */
-		filtered int
-		/*
-		 * Buffer to hold a mix of filtered and unfiltered data. This
-		 * needs to be big enough to hold Alignment + 2 * Look-ahead:
-		 *
-		 * Type         Alignment   Look-ahead
-		 * x86              1           4
-		 * PowerPC          4           0
-		 * IA-64           16           0
-		 * ARM              4           0
-		 * ARM-Thumb        2           2
-		 * SPARC            4           0
-		 */
-		buf      []byte // slice buf will be backed by bufArray
-		bufArray [16]byte
-	}
-}
-
-/*
- * This is used to test the most significant byte of a memory address
- * in an x86 instruction.
- */
-func bcjX86TestMSByte(b byte) bool {
-	return b == 0x00 || b == 0xff
-}
-
-func bcjX86Filter(s *xzDecBCJ, buf []byte) int {
-	var maskToAllowedStatus = []bool{
-		true, true, true, false, true, false, false, false,
-	}
-	var maskToBitNum = []byte{0, 1, 2, 2, 3, 3, 3, 3}
-	var i int
-	var prevPos int = -1
-	var prevMask uint32 = s.x86PrevMask
-	var src uint32
-	var dest uint32
-	var j uint32
-	var b byte
-	if len(buf) <= 4 {
-		return 0
-	}
-	for i = 0; i < len(buf)-4; i++ {
-		if buf[i]&0xfe != 0xe8 {
-			continue
-		}
-		prevPos = i - prevPos
-		if prevPos > 3 {
-			prevMask = 0
-		} else {
-			prevMask = (prevMask << (uint(prevPos) - 1)) & 7
-			if prevMask != 0 {
-				b = buf[i+4-int(maskToBitNum[prevMask])]
-				if !maskToAllowedStatus[prevMask] || bcjX86TestMSByte(b) {
-					prevPos = i
-					prevMask = prevMask<<1 | 1
-					continue
-				}
-			}
-		}
-		prevPos = i
-		if bcjX86TestMSByte(buf[i+4]) {
-			src = getLE32(buf[i+1:])
-			for {
-				dest = src - uint32(s.pos+i+5)
-				if prevMask == 0 {
-					break
-				}
-				j = uint32(maskToBitNum[prevMask]) * 8
-				b = byte(dest >> (24 - j))
-				if !bcjX86TestMSByte(b) {
-					break
-				}
-				src = dest ^ (1<<(32-j) - 1)
-			}
-			dest &= 0x01FFFFFF
-			dest |= 0 - dest&0x01000000
-			putLE32(dest, buf[i+1:])
-			i += 4
-		} else {
-			prevMask = prevMask<<1 | 1
-		}
-	}
-	prevPos = i - prevPos
-	if prevPos > 3 {
-		s.x86PrevMask = 0
-	} else {
-		s.x86PrevMask = prevMask << (uint(prevPos) - 1)
-	}
-	return i
-}
-
-func bcjPowerPCFilter(s *xzDecBCJ, buf []byte) int {
-	var i int
-	var instr uint32
-	for i = 0; i+4 <= len(buf); i += 4 {
-		instr = getBE32(buf[i:])
-		if instr&0xFC000003 == 0x48000001 {
-			instr &= 0x03FFFFFC
-			instr -= uint32(s.pos + i)
-			instr &= 0x03FFFFFC
-			instr |= 0x48000001
-			putBE32(instr, buf[i:])
-		}
-	}
-	return i
-}
-
-var bcjIA64BranchTable = [...]byte{
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	4, 4, 6, 6, 0, 0, 7, 7,
-	4, 4, 0, 0, 4, 4, 0, 0,
-}
-
-func bcjIA64Filter(s *xzDecBCJ, buf []byte) int {
-	var branchTable = bcjIA64BranchTable[:]
-	/*
-	 * The local variables take a little bit stack space, but it's less
-	 * than what LZMA2 decoder takes, so it doesn't make sense to reduce
-	 * stack usage here without doing that for the LZMA2 decoder too.
-	 */
-	/* Loop counters */
-	var i int
-	var j int
-	/* Instruction slot (0, 1, or 2) in the 128-bit instruction word */
-	var slot uint32
-	/* Bitwise offset of the instruction indicated by slot */
-	var bitPos uint32
-	/* bit_pos split into byte and bit parts */
-	var bytePos uint32
-	var bitRes uint32
-	/* Address part of an instruction */
-	var addr uint32
-	/* Mask used to detect which instructions to convert */
-	var mask uint32
-	/* 41-bit instruction stored somewhere in the lowest 48 bits */
-	var instr uint64
-	/* Instruction normalized with bit_res for easier manipulation */
-	var norm uint64
-	for i = 0; i+16 <= len(buf); i += 16 {
-		mask = uint32(branchTable[buf[i]&0x1f])
-		for slot, bitPos = 0, 5; slot < 3; slot, bitPos = slot+1, bitPos+41 {
-			if (mask>>slot)&1 == 0 {
-				continue
-			}
-			bytePos = bitPos >> 3
-			bitRes = bitPos & 7
-			instr = 0
-			for j = 0; j < 6; j++ {
-				instr |= uint64(buf[i+j+int(bytePos)]) << (8 * uint(j))
-			}
-			norm = instr >> bitRes
-			if (norm>>37)&0x0f == 0x05 && (norm>>9)&0x07 == 0 {
-				addr = uint32((norm >> 13) & 0x0fffff)
-				addr |= (uint32(norm>>36) & 1) << 20
-				addr <<= 4
-				addr -= uint32(s.pos + i)
-				addr >>= 4
-				norm &= ^(uint64(0x8fffff) << 13)
-				norm |= uint64(addr&0x0fffff) << 13
-				norm |= uint64(addr&0x100000) << (36 - 20)
-				instr &= 1<<bitRes - 1
-				instr |= norm << bitRes
-				for j = 0; j < 6; j++ {
-					buf[i+j+int(bytePos)] = byte(instr >> (8 * uint(j)))
-				}
-			}
-		}
-	}
-	return i
-}
-
-func bcjARMFilter(s *xzDecBCJ, buf []byte) int {
-	var i int
-	var addr uint32
-	for i = 0; i+4 <= len(buf); i += 4 {
-		if buf[i+3] == 0xeb {
-			addr = uint32(buf[i]) | uint32(buf[i+1])<<8 |
-				uint32(buf[i+2])<<16
-			addr <<= 2
-			addr -= uint32(s.pos + i + 8)
-			addr >>= 2
-			buf[i] = byte(addr)
-			buf[i+1] = byte(addr >> 8)
-			buf[i+2] = byte(addr >> 16)
-		}
-	}
-	return i
-}
-
-func bcjARMThumbFilter(s *xzDecBCJ, buf []byte) int {
-	var i int
-	var addr uint32
-	for i = 0; i+4 <= len(buf); i += 2 {
-		if buf[i+1]&0xf8 == 0xf0 && buf[i+3]&0xf8 == 0xf8 {
-			addr = uint32(buf[i+1]&0x07)<<19 |
-				uint32(buf[i])<<11 |
-				uint32(buf[i+3]&0x07)<<8 |
-				uint32(buf[i+2])
-			addr <<= 1
-			addr -= uint32(s.pos + i + 4)
-			addr >>= 1
-			buf[i+1] = byte(0xf0 | (addr>>19)&0x07)
-			buf[i] = byte(addr >> 11)
-			buf[i+3] = byte(0xf8 | (addr>>8)&0x07)
-			buf[i+2] = byte(addr)
-			i += 2
-		}
-	}
-	return i
-}
-
-func bcjSPARCFilter(s *xzDecBCJ, buf []byte) int {
-	var i int
-	var instr uint32
-	for i = 0; i+4 <= len(buf); i += 4 {
-		instr = getBE32(buf[i:])
-		if instr>>22 == 0x100 || instr>>22 == 0x1ff {
-			instr <<= 2
-			instr -= uint32(s.pos + i)
-			instr >>= 2
-			instr = (0x40000000 - instr&0x400000) |
-				0x40000000 | (instr & 0x3FFFFF)
-			putBE32(instr, buf[i:])
-		}
-	}
-	return i
-}
-
-/*
- * Apply the selected BCJ filter. Update *pos and s.pos to match the amount
- * of data that got filtered.
- */
-func bcjApply(s *xzDecBCJ, buf []byte, pos *int) {
-	var filtered int
-	buf = buf[*pos:]
-	switch s.typ {
-	case idBCJX86:
-		filtered = bcjX86Filter(s, buf)
-	case idBCJPowerPC:
-		filtered = bcjPowerPCFilter(s, buf)
-	case idBCJIA64:
-		filtered = bcjIA64Filter(s, buf)
-	case idBCJARM:
-		filtered = bcjARMFilter(s, buf)
-	case idBCJARMThumb:
-		filtered = bcjARMThumbFilter(s, buf)
-	case idBCJSPARC:
-		filtered = bcjSPARCFilter(s, buf)
-	default:
-		/* Never reached */
-	}
-	*pos += filtered
-	s.pos += filtered
-}
-
-/*
- * Flush pending filtered data from temp to the output buffer.
- * Move the remaining mixture of possibly filtered and unfiltered
- * data to the beginning of temp.
- */
-func bcjFlush(s *xzDecBCJ, b *xzBuf) {
-	var copySize int
-	copySize = len(b.out) - b.outPos
-	if copySize > s.temp.filtered {
-		copySize = s.temp.filtered
-	}
-	copy(b.out[b.outPos:], s.temp.buf[:copySize])
-	b.outPos += copySize
-	s.temp.filtered -= copySize
-	copy(s.temp.buf, s.temp.buf[copySize:])
-	s.temp.buf = s.temp.buf[:len(s.temp.buf)-copySize]
-}
-
-/*
- * Decode raw stream which has a BCJ filter as the first filter.
- *
- * The BCJ filter functions are primitive in sense that they process the
- * data in chunks of 1-16 bytes. To hide this issue, this function does
- * some buffering.
- */
-func xzDecBCJRun(s *xzDecBCJ, b *xzBuf, chain func(*xzBuf) xzRet) xzRet {
-	var outStart int
-	/*
-	 * Flush pending already filtered data to the output buffer. Return
-	 * immediately if we couldn't flush everything, or if the next
-	 * filter in the chain had already returned xzStreamEnd.
-	 */
-	if s.temp.filtered > 0 {
-		bcjFlush(s, b)
-		if s.temp.filtered > 0 {
-			return xzOK
-		}
-		if s.ret == xzStreamEnd {
-			return xzStreamEnd
-		}
-	}
-	/*
-	 * If we have more output space than what is currently pending in
-	 * temp, copy the unfiltered data from temp to the output buffer
-	 * and try to fill the output buffer by decoding more data from the
-	 * next filter in the chain. Apply the BCJ filter on the new data
-	 * in the output buffer. If everything cannot be filtered, copy it
-	 * to temp and rewind the output buffer position accordingly.
-	 *
-	 * This needs to be always run when len(temp.buf) == 0 to handle a special
-	 * case where the output buffer is full and the next filter has no
-	 * more output coming but hasn't returned xzStreamEnd yet.
-	 */
-	if len(s.temp.buf) < len(b.out)-b.outPos || len(s.temp.buf) == 0 {
-		outStart = b.outPos
-		copy(b.out[b.outPos:], s.temp.buf)
-		b.outPos += len(s.temp.buf)
-		s.ret = chain(b)
-		if s.ret != xzStreamEnd && s.ret != xzOK {
-			return s.ret
-		}
-		bcjApply(s, b.out[:b.outPos], &outStart)
-		/*
-		 * As an exception, if the next filter returned xzStreamEnd,
-		 * we can do that too, since the last few bytes that remain
-		 * unfiltered are meant to remain unfiltered.
-		 */
-		if s.ret == xzStreamEnd {
-			return xzStreamEnd
-		}
-		s.temp.buf = s.temp.bufArray[:b.outPos-outStart]
-		b.outPos -= len(s.temp.buf)
-		copy(s.temp.buf, b.out[b.outPos:])
-		/*
-		 * If there wasn't enough input to the next filter to fill
-		 * the output buffer with unfiltered data, there's no point
-		 * to try decoding more data to temp.
-		 */
-		if b.outPos+len(s.temp.buf) < len(b.out) {
-			return xzOK
-		}
-	}
-	/*
-	 * We have unfiltered data in temp. If the output buffer isn't full
-	 * yet, try to fill the temp buffer by decoding more data from the
-	 * next filter. Apply the BCJ filter on temp. Then we hopefully can
-	 * fill the actual output buffer by copying filtered data from temp.
-	 * A mix of filtered and unfiltered data may be left in temp; it will
-	 * be taken care on the next call to this function.
-	 */
-	if b.outPos < len(b.out) {
-		/* Make b.out temporarily point to s.temp. */
-		s.out = b.out
-		s.outPos = b.outPos
-		b.out = s.temp.bufArray[:]
-		b.outPos = len(s.temp.buf)
-		s.ret = chain(b)
-		s.temp.buf = s.temp.bufArray[:b.outPos]
-		b.out = s.out
-		b.outPos = s.outPos
-		if s.ret != xzOK && s.ret != xzStreamEnd {
-			return s.ret
-		}
-		bcjApply(s, s.temp.buf, &s.temp.filtered)
-		/*
-		 * If the next filter returned xzStreamEnd, we mark that
-		 * everything is filtered, since the last unfiltered bytes
-		 * of the stream are meant to be left as is.
-		 */
-		if s.ret == xzStreamEnd {
-			s.temp.filtered = len(s.temp.buf)
-		}
-		bcjFlush(s, b)
-		if s.temp.filtered > 0 {
-			return xzOK
-		}
-	}
-	return s.ret
-}
-
-/*
- * Allocate memory for BCJ decoders. xzDecBCJReset must be used before
- * calling xzDecBCJRun.
- */
-func xzDecBCJCreate() *xzDecBCJ {
-	return new(xzDecBCJ)
-}
-
-/*
- * Decode the Filter ID of a BCJ filter and check the start offset is
- * valid. Returns xzOK if the given Filter ID and offset is
- * supported. Otherwise xzOptionsError is returned.
- */
-func xzDecBCJReset(s *xzDecBCJ, id xzFilterID, offset int) xzRet {
-	switch id {
-	case idBCJX86:
-	case idBCJPowerPC:
-	case idBCJIA64:
-	case idBCJARM:
-	case idBCJARMThumb:
-	case idBCJSPARC:
-	default:
-		/* Unsupported Filter ID */
-		return xzOptionsError
-	}
-	// check offset is a multiple of alignment
-	switch id {
-	case idBCJPowerPC, idBCJARM, idBCJSPARC:
-		if offset%4 != 0 {
-			return xzOptionsError
-		}
-	case idBCJIA64:
-		if offset%16 != 0 {
-			return xzOptionsError
-		}
-	case idBCJARMThumb:
-		if offset%2 != 0 {
-			return xzOptionsError
-		}
-	}
-	s.typ = id
-	s.ret = xzOK
-	s.pos = offset
-	s.x86PrevMask = 0
-	s.temp.filtered = 0
-	s.temp.buf = nil
-	return xzOK
-}

vendor/github.com/therootcompany/xz/dec_delta.go

@@ -1,55 +0,0 @@
-/*
- * Delta decoder
- *
- * Author: Lasse Collin <lasse.collin@tukaani.org>
- *
- * Translation to Go: Michael Cross <https://github.com/xi2>
- *
- * This file has been put into the public domain.
- * You can do whatever you want with this file.
- */
-
-package xz
-
-type xzDecDelta struct {
-	delta    [256]byte
-	pos      byte
-	distance int // in range [1, 256]
-}
-
-/*
- * Decode raw stream which has a delta filter as the first filter.
- */
-func xzDecDeltaRun(s *xzDecDelta, b *xzBuf, chain func(*xzBuf) xzRet) xzRet {
-	outStart := b.outPos
-	ret := chain(b)
-	for i := outStart; i < b.outPos; i++ {
-		tmp := b.out[i] + s.delta[byte(s.distance+int(s.pos))]
-		s.delta[s.pos] = tmp
-		b.out[i] = tmp
-		s.pos--
-	}
-	return ret
-}
-
-/*
- * Allocate memory for a delta decoder. xzDecDeltaReset must be used
- * before calling xzDecDeltaRun.
- */
-func xzDecDeltaCreate() *xzDecDelta {
-	return new(xzDecDelta)
-}
-
-/*
- * Returns xzOK if the given distance is valid. Otherwise
- * xzOptionsError is returned.
- */
-func xzDecDeltaReset(s *xzDecDelta, distance int) xzRet {
-	if distance < 1 || distance > 256 {
-		return xzOptionsError
-	}
-	s.delta = [256]byte{}
-	s.pos = 0
-	s.distance = distance
-	return xzOK
-}

vendor/github.com/therootcompany/xz/dec_stream.go

@@ -1,932 +0,0 @@
-/*
- * .xz Stream decoder
- *
- * Author: Lasse Collin <lasse.collin@tukaani.org>
- *
- * Translation to Go: Michael Cross <https://github.com/xi2>
- *
- * This file has been put into the public domain.
- * You can do whatever you want with this file.
- */
-
-package xz
-
-import (
-	"bytes"
-	"crypto/sha256"
-	"hash"
-	"hash/crc32"
-	"hash/crc64"
-)
-
-/* from linux/lib/xz/xz_stream.h **************************************/
-
-/*
- * See the .xz file format specification at
- * http://tukaani.org/xz/xz-file-format.txt
- * to understand the container format.
- */
-const (
-	streamHeaderSize = 12
-	headerMagic      = "\xfd7zXZ\x00"
-	footerMagic      = "YZ"
-)
-
-/*
- * Variable-length integer can hold a 63-bit unsigned integer or a special
- * value indicating that the value is unknown.
- */
-type vliType uint64
-
-const (
-	vliUnknown vliType = ^vliType(0)
-	/* Maximum encoded size of a VLI */
-	vliBytesMax = 8 * 8 / 7 // (Sizeof(vliType) * 8 / 7)
-)
-
-/* from linux/lib/xz/xz_dec_stream.c **********************************/
-
-/* Hash used to validate the Index field */
-type xzDecHash struct {
-	unpadded     vliType
-	uncompressed vliType
-	sha256       hash.Hash
-}
-
-// type of xzDec.sequence
-type xzDecSeq int
-
-const (
-	seqStreamHeader xzDecSeq = iota
-	seqBlockStart
-	seqBlockHeader
-	seqBlockUncompress
-	seqBlockPadding
-	seqBlockCheck
-	seqIndex
-	seqIndexPadding
-	seqIndexCRC32
-	seqStreamFooter
-)
-
-// type of xzDec.index.sequence
-type xzDecIndexSeq int
-
-const (
-	seqIndexCount xzDecIndexSeq = iota
-	seqIndexUnpadded
-	seqIndexUncompressed
-)
-
-/**
- * xzDec - Opaque type to hold the XZ decoder state
- */
-type xzDec struct {
-	/* Position in decMain */
-	sequence xzDecSeq
-	/* Position in variable-length integers and Check fields */
-	pos int
-	/* Variable-length integer decoded by decVLI */
-	vli vliType
-	/* Saved inPos and outPos */
-	inStart  int
-	outStart int
-	/* CRC32 checksum hash used in Index */
-	crc32 hash.Hash
-	/* Hashes used in Blocks */
-	checkCRC32  hash.Hash
-	checkCRC64  hash.Hash
-	checkSHA256 hash.Hash
-	/* for checkTypes CRC32/CRC64/SHA256, check is one of the above 3 hashes */
-	check hash.Hash
-	/* Embedded stream header struct containing CheckType */
-	*Header
-	/*
-	 * True if the next call to xzDecRun is allowed to return
-	 * xzBufError.
-	 */
-	allowBufError bool
-	/* Information stored in Block Header */
-	blockHeader struct {
-		/*
-		 * Value stored in the Compressed Size field, or
-		 * vliUnknown if Compressed Size is not present.
-		 */
-		compressed vliType
-		/*
-		 * Value stored in the Uncompressed Size field, or
-		 * vliUnknown if Uncompressed Size is not present.
-		 */
-		uncompressed vliType
-		/* Size of the Block Header field */
-		size int
-	}
-	/* Information collected when decoding Blocks */
-	block struct {
-		/* Observed compressed size of the current Block */
-		compressed vliType
-		/* Observed uncompressed size of the current Block */
-		uncompressed vliType
-		/* Number of Blocks decoded so far */
-		count vliType
-		/*
-		 * Hash calculated from the Block sizes. This is used to
-		 * validate the Index field.
-		 */
-		hash xzDecHash
-	}
-	/* Variables needed when verifying the Index field */
-	index struct {
-		/* Position in decIndex */
-		sequence xzDecIndexSeq
-		/* Size of the Index in bytes */
-		size vliType
-		/* Number of Records (matches block.count in valid files) */
-		count vliType
-		/*
-		 * Hash calculated from the Records (matches block.hash in
-		 * valid files).
-		 */
-		hash xzDecHash
-	}
-	/*
-	 * Temporary buffer needed to hold Stream Header, Block Header,
-	 * and Stream Footer. The Block Header is the biggest (1 KiB)
-	 * so we reserve space according to that. bufArray has to be aligned
-	 * to a multiple of four bytes; the variables before it
-	 * should guarantee this.
-	 */
-	temp struct {
-		pos      int
-		buf      []byte // slice buf will be backed by bufArray
-		bufArray [1024]byte
-	}
-	// chain is the function (or to be more precise, closure) which
-	// does the decompression and will call into the lzma2 and other
-	// filter code as needed. It is constructed by decBlockHeader
-	chain func(b *xzBuf) xzRet
-	// lzma2 holds the state of the last filter (which must be LZMA2)
-	lzma2 *xzDecLZMA2
-	// pointers to allocated BCJ/Delta filters
-	bcjs   []*xzDecBCJ
-	deltas []*xzDecDelta
-	// number of currently in use BCJ/Delta filters from the above
-	bcjsUsed   int
-	deltasUsed int
-}
-
-/* Sizes of the Check field with different Check IDs */
-var checkSizes = [...]byte{
-	0,
-	4, 4, 4,
-	8, 8, 8,
-	16, 16, 16,
-	32, 32, 32,
-	64, 64, 64,
-}
-
-/*
- * Fill s.temp by copying data starting from b.in[b.inPos]. Caller
- * must have set s.temp.pos to indicate how much data we are supposed
- * to copy into s.temp.buf. Return true once s.temp.pos has reached
- * len(s.temp.buf).
- */
-func fillTemp(s *xzDec, b *xzBuf) bool {
-	copySize := len(b.in) - b.inPos
-	tempRemaining := len(s.temp.buf) - s.temp.pos
-	if copySize > tempRemaining {
-		copySize = tempRemaining
-	}
-	copy(s.temp.buf[s.temp.pos:], b.in[b.inPos:])
-	b.inPos += copySize
-	s.temp.pos += copySize
-	if s.temp.pos == len(s.temp.buf) {
-		s.temp.pos = 0
-		return true
-	}
-	return false
-}
-
-/* Decode a variable-length integer (little-endian base-128 encoding) */
-func decVLI(s *xzDec, in []byte, inPos *int) xzRet {
-	var byte byte
-	if s.pos == 0 {
-		s.vli = 0
-	}
-	for *inPos < len(in) {
-		byte = in[*inPos]
-		*inPos++
-		s.vli |= vliType(byte&0x7f) << uint(s.pos)
-		if byte&0x80 == 0 {
-			/* Don't allow non-minimal encodings. */
-			if byte == 0 && s.pos != 0 {
-				return xzDataError
-			}
-			s.pos = 0
-			return xzStreamEnd
-		}
-		s.pos += 7
-		if s.pos == 7*vliBytesMax {
-			return xzDataError
-		}
-	}
-	return xzOK
-}
-
-/*
- * Decode the Compressed Data field from a Block. Update and validate
- * the observed compressed and uncompressed sizes of the Block so that
- * they don't exceed the values possibly stored in the Block Header
- * (validation assumes that no integer overflow occurs, since vliType
- * is uint64). Update s.check if presence of the CRC32/CRC64/SHA256
- * field was indicated in Stream Header.
- *
- * Once the decoding is finished, validate that the observed sizes match
- * the sizes possibly stored in the Block Header. Update the hash and
- * Block count, which are later used to validate the Index field.
- */
-func decBlock(s *xzDec, b *xzBuf) xzRet {
-	var ret xzRet
-	s.inStart = b.inPos
-	s.outStart = b.outPos
-	ret = s.chain(b)
-	s.block.compressed += vliType(b.inPos - s.inStart)
-	s.block.uncompressed += vliType(b.outPos - s.outStart)
-	/*
-	 * There is no need to separately check for vliUnknown since
-	 * the observed sizes are always smaller than vliUnknown.
-	 */
-	if s.block.compressed > s.blockHeader.compressed ||
-		s.block.uncompressed > s.blockHeader.uncompressed {
-		return xzDataError
-	}
-	switch s.CheckType {
-	case CheckCRC32, CheckCRC64, CheckSHA256:
-		_, _ = s.check.Write(b.out[s.outStart:b.outPos])
-	}
-	if ret == xzStreamEnd {
-		if s.blockHeader.compressed != vliUnknown &&
-			s.blockHeader.compressed != s.block.compressed {
-			return xzDataError
-		}
-		if s.blockHeader.uncompressed != vliUnknown &&
-			s.blockHeader.uncompressed != s.block.uncompressed {
-			return xzDataError
-		}
-		s.block.hash.unpadded +=
-			vliType(s.blockHeader.size) + s.block.compressed
-		s.block.hash.unpadded += vliType(checkSizes[s.CheckType])
-		s.block.hash.uncompressed += s.block.uncompressed
-		var buf [2 * 8]byte // 2*Sizeof(vliType)
-		putLE64(uint64(s.block.hash.unpadded), buf[:])
-		putLE64(uint64(s.block.hash.uncompressed), buf[8:])
-		_, _ = s.block.hash.sha256.Write(buf[:])
-		s.block.count++
-	}
-	return ret
-}
-
-/* Update the Index size and the CRC32 hash. */
-func indexUpdate(s *xzDec, b *xzBuf) {
-	inUsed := b.inPos - s.inStart
-	s.index.size += vliType(inUsed)
-	_, _ = s.crc32.Write(b.in[s.inStart : s.inStart+inUsed])
-}
-
-/*
- * Decode the Number of Records, Unpadded Size, and Uncompressed Size
- * fields from the Index field. That is, Index Padding and CRC32 are not
- * decoded by this function.
- *
- * This can return xzOK (more input needed), xzStreamEnd (everything
- * successfully decoded), or xzDataError (input is corrupt).
- */
-func decIndex(s *xzDec, b *xzBuf) xzRet {
-	var ret xzRet
-	for {
-		ret = decVLI(s, b.in, &b.inPos)
-		if ret != xzStreamEnd {
-			indexUpdate(s, b)
-			return ret
-		}
-		switch s.index.sequence {
-		case seqIndexCount:
-			s.index.count = s.vli
-			/*
-			 * Validate that the Number of Records field
-			 * indicates the same number of Records as
-			 * there were Blocks in the Stream.
-			 */
-			if s.index.count != s.block.count {
-				return xzDataError
-			}
-			s.index.sequence = seqIndexUnpadded
-		case seqIndexUnpadded:
-			s.index.hash.unpadded += s.vli
-			s.index.sequence = seqIndexUncompressed
-		case seqIndexUncompressed:
-			s.index.hash.uncompressed += s.vli
-			var buf [2 * 8]byte // 2*Sizeof(vliType)
-			putLE64(uint64(s.index.hash.unpadded), buf[:])
-			putLE64(uint64(s.index.hash.uncompressed), buf[8:])
-			_, _ = s.index.hash.sha256.Write(buf[:])
-			s.index.count--
-			s.index.sequence = seqIndexUnpadded
-		}
-		if !(s.index.count > 0) {
-			break
-		}
-	}
-	return xzStreamEnd
-}
-
-/*
- * Validate that the next 4 bytes match s.crc32.Sum(nil). s.pos must
- * be zero when starting to validate the first byte.
- */
-func crcValidate(s *xzDec, b *xzBuf) xzRet {
-	sum := s.crc32.Sum(nil)
-	// CRC32 - reverse slice
-	sum[0], sum[1], sum[2], sum[3] = sum[3], sum[2], sum[1], sum[0]
-	for {
-		if b.inPos == len(b.in) {
-			return xzOK
-		}
-		if sum[s.pos] != b.in[b.inPos] {
-			return xzDataError
-		}
-		b.inPos++
-		s.pos++
-		if !(s.pos < 4) {
-			break
-		}
-	}
-	s.crc32.Reset()
-	s.pos = 0
-	return xzStreamEnd
-}
-
-/*
- * Validate that the next 4/8/32 bytes match s.check.Sum(nil). s.pos
- * must be zero when starting to validate the first byte.
- */
-func checkValidate(s *xzDec, b *xzBuf) xzRet {
-	sum := s.check.Sum(nil)
-	if s.CheckType == CheckCRC32 || s.CheckType == CheckCRC64 {
-		// CRC32/64 - reverse slice
-		for i, j := 0, len(sum)-1; i < j; i, j = i+1, j-1 {
-			sum[i], sum[j] = sum[j], sum[i]
-		}
-	}
-	for {
-		if b.inPos == len(b.in) {
-			return xzOK
-		}
-		if sum[s.pos] != b.in[b.inPos] {
-			return xzDataError
-		}
-		b.inPos++
-		s.pos++
-		if !(s.pos < len(sum)) {
-			break
-		}
-	}
-	s.check.Reset()
-	s.pos = 0
-	return xzStreamEnd
-}
-
-/*
- * Skip over the Check field when the Check ID is not supported.
- * Returns true once the whole Check field has been skipped over.
- */
-func checkSkip(s *xzDec, b *xzBuf) bool {
-	for s.pos < int(checkSizes[s.CheckType]) {
-		if b.inPos == len(b.in) {
-			return false
-		}
-		b.inPos++
-		s.pos++
-	}
-	s.pos = 0
-	return true
-}
-
-/* polynomial table used in decStreamHeader below */
-var xzCRC64Table = crc64.MakeTable(crc64.ECMA)
-
-/* Decode the Stream Header field (the first 12 bytes of the .xz Stream). */
-func decStreamHeader(s *xzDec) xzRet {
-	if string(s.temp.buf[:len(headerMagic)]) != headerMagic {
-		return xzFormatError
-	}
-	if crc32.ChecksumIEEE(s.temp.buf[len(headerMagic):len(headerMagic)+2]) !=
-		getLE32(s.temp.buf[len(headerMagic)+2:]) {
-		return xzDataError
-	}
-	if s.temp.buf[len(headerMagic)] != 0 {
-		return xzOptionsError
-	}
-	/*
-	 * Of integrity checks, we support none (Check ID = 0),
-	 * CRC32 (Check ID = 1), CRC64 (Check ID = 4) and SHA256 (Check ID = 10)
-	 * However, we will accept other check types too, but then the check
-	 * won't be verified and a warning (xzUnsupportedCheck) will be given.
-	 */
-	s.CheckType = CheckID(s.temp.buf[len(headerMagic)+1])
-	if s.CheckType > checkMax {
-		return xzOptionsError
-	}
-	switch s.CheckType {
-	case CheckNone:
-		// CheckNone: no action needed
-	case CheckCRC32:
-		if s.checkCRC32 == nil {
-			s.checkCRC32 = crc32.NewIEEE()
-		} else {
-			s.checkCRC32.Reset()
-		}
-		s.check = s.checkCRC32
-	case CheckCRC64:
-		if s.checkCRC64 == nil {
-			s.checkCRC64 = crc64.New(xzCRC64Table)
-		} else {
-			s.checkCRC64.Reset()
-		}
-		s.check = s.checkCRC64
-	case CheckSHA256:
-		if s.checkSHA256 == nil {
-			s.checkSHA256 = sha256.New()
-		} else {
-			s.checkSHA256.Reset()
-		}
-		s.check = s.checkSHA256
-	default:
-		return xzUnsupportedCheck
-	}
-	return xzOK
-}
-
-/* Decode the Stream Footer field (the last 12 bytes of the .xz Stream) */
-func decStreamFooter(s *xzDec) xzRet {
-	if string(s.temp.buf[10:10+len(footerMagic)]) != footerMagic {
-		return xzDataError
-	}
-	if crc32.ChecksumIEEE(s.temp.buf[4:10]) != getLE32(s.temp.buf) {
-		return xzDataError
-	}
-	/*
-	 * Validate Backward Size. Note that we never added the size of the
-	 * Index CRC32 field to s->index.size, thus we use s->index.size / 4
-	 * instead of s->index.size / 4 - 1.
-	 */
-	if s.index.size>>2 != vliType(getLE32(s.temp.buf[4:])) {
-		return xzDataError
-	}
-	if s.temp.buf[8] != 0 || CheckID(s.temp.buf[9]) != s.CheckType {
-		return xzDataError
-	}
-	/*
-	 * Use xzStreamEnd instead of xzOK to be more convenient
-	 * for the caller.
-	 */
-	return xzStreamEnd
-}
-
-/* Decode the Block Header and initialize the filter chain. */
-func decBlockHeader(s *xzDec) xzRet {
-	var ret xzRet
-	/*
-	 * Validate the CRC32. We know that the temp buffer is at least
-	 * eight bytes so this is safe.
-	 */
-	crc := getLE32(s.temp.buf[len(s.temp.buf)-4:])
-	s.temp.buf = s.temp.buf[:len(s.temp.buf)-4]
-	if crc32.ChecksumIEEE(s.temp.buf) != crc {
-		return xzDataError
-	}
-	s.temp.pos = 2
-	/*
-	 * Catch unsupported Block Flags.
-	 */
-	if s.temp.buf[1]&0x3C != 0 {
-		return xzOptionsError
-	}
-	/* Compressed Size */
-	if s.temp.buf[1]&0x40 != 0 {
-		if decVLI(s, s.temp.buf, &s.temp.pos) != xzStreamEnd {
-			return xzDataError
-		}
-		if s.vli >= 1<<63-8 {
-			// the whole block must stay smaller than 2^63 bytes
-			// the block header cannot be smaller than 8 bytes
-			return xzDataError
-		}
-		if s.vli == 0 {
-			// compressed size must be non-zero
-			return xzDataError
-		}
-		s.blockHeader.compressed = s.vli
-	} else {
-		s.blockHeader.compressed = vliUnknown
-	}
-	/* Uncompressed Size */
-	if s.temp.buf[1]&0x80 != 0 {
-		if decVLI(s, s.temp.buf, &s.temp.pos) != xzStreamEnd {
-			return xzDataError
-		}
-		s.blockHeader.uncompressed = s.vli
-	} else {
-		s.blockHeader.uncompressed = vliUnknown
-	}
-	// get total number of filters (1-4)
-	filterTotal := int(s.temp.buf[1]&0x03) + 1
-	// slice to hold decoded filters
-	filterList := make([]struct {
-		id    xzFilterID
-		props uint32
-	}, filterTotal)
-	// decode the non-last filters which cannot be LZMA2
-	for i := 0; i < filterTotal-1; i++ {
-		/* Valid Filter Flags always take at least two bytes. */
-		if len(s.temp.buf)-s.temp.pos < 2 {
-			return xzDataError
-		}
-		s.temp.pos += 2
-		switch id := xzFilterID(s.temp.buf[s.temp.pos-2]); id {
-		case idDelta:
-			// delta filter
-			if s.temp.buf[s.temp.pos-1] != 0x01 {
-				return xzOptionsError
-			}
-			/* Filter Properties contains distance - 1 */
-			if len(s.temp.buf)-s.temp.pos < 1 {
-				return xzDataError
-			}
-			props := uint32(s.temp.buf[s.temp.pos])
-			s.temp.pos++
-			filterList[i] = struct {
-				id    xzFilterID
-				props uint32
-			}{id: id, props: props}
-		case idBCJX86, idBCJPowerPC, idBCJIA64,
-			idBCJARM, idBCJARMThumb, idBCJSPARC:
-			// bcj filter
-			var props uint32
-			switch s.temp.buf[s.temp.pos-1] {
-			case 0x00:
-				props = 0
-			case 0x04:
-				if len(s.temp.buf)-s.temp.pos < 4 {
-					return xzDataError
-				}
-				props = getLE32(s.temp.buf[s.temp.pos:])
-				s.temp.pos += 4
-			default:
-				return xzOptionsError
-			}
-			filterList[i] = struct {
-				id    xzFilterID
-				props uint32
-			}{id: id, props: props}
-		default:
-			return xzOptionsError
-		}
-	}
-	/*
-	 * decode the last filter which must be LZMA2
-	 */
-	if len(s.temp.buf)-s.temp.pos < 2 {
-		return xzDataError
-	}
-	/* Filter ID = LZMA2 */
-	if xzFilterID(s.temp.buf[s.temp.pos]) != idLZMA2 {
-		return xzOptionsError
-	}
-	s.temp.pos++
-	/* Size of Properties = 1-byte Filter Properties */
-	if s.temp.buf[s.temp.pos] != 0x01 {
-		return xzOptionsError
-	}
-	s.temp.pos++
-	/* Filter Properties contains LZMA2 dictionary size. */
-	if len(s.temp.buf)-s.temp.pos < 1 {
-		return xzDataError
-	}
-	props := uint32(s.temp.buf[s.temp.pos])
-	s.temp.pos++
-	filterList[filterTotal-1] = struct {
-		id    xzFilterID
-		props uint32
-	}{id: idLZMA2, props: props}
-	/*
-	 * Process the filter list and create s.chain, going from last
-	 * filter (LZMA2) to first filter
-	 *
-	 * First, LZMA2.
-	 */
-	ret = xzDecLZMA2Reset(s.lzma2, byte(filterList[filterTotal-1].props))
-	if ret != xzOK {
-		return ret
-	}
-	s.chain = func(b *xzBuf) xzRet {
-		return xzDecLZMA2Run(s.lzma2, b)
-	}
-	/*
-	 * Now the non-last filters
-	 */
-	for i := filterTotal - 2; i >= 0; i-- {
-		switch id := filterList[i].id; id {
-		case idDelta:
-			// delta filter
-			var delta *xzDecDelta
-			if s.deltasUsed < len(s.deltas) {
-				delta = s.deltas[s.deltasUsed]
-			} else {
-				delta = xzDecDeltaCreate()
-				s.deltas = append(s.deltas, delta)
-			}
-			s.deltasUsed++
-			ret = xzDecDeltaReset(delta, int(filterList[i].props)+1)
-			if ret != xzOK {
-				return ret
-			}
-			chain := s.chain
-			s.chain = func(b *xzBuf) xzRet {
-				return xzDecDeltaRun(delta, b, chain)
-			}
-		case idBCJX86, idBCJPowerPC, idBCJIA64,
-			idBCJARM, idBCJARMThumb, idBCJSPARC:
-			// bcj filter
-			var bcj *xzDecBCJ
-			if s.bcjsUsed < len(s.bcjs) {
-				bcj = s.bcjs[s.bcjsUsed]
-			} else {
-				bcj = xzDecBCJCreate()
-				s.bcjs = append(s.bcjs, bcj)
-			}
-			s.bcjsUsed++
-			ret = xzDecBCJReset(bcj, id, int(filterList[i].props))
-			if ret != xzOK {
-				return ret
-			}
-			chain := s.chain
-			s.chain = func(b *xzBuf) xzRet {
-				return xzDecBCJRun(bcj, b, chain)
-			}
-		}
-	}
-	/* The rest must be Header Padding. */
-	for s.temp.pos < len(s.temp.buf) {
-		if s.temp.buf[s.temp.pos] != 0x00 {
-			return xzOptionsError
-		}
-		s.temp.pos++
-	}
-	s.temp.pos = 0
-	s.block.compressed = 0
-	s.block.uncompressed = 0
-	return xzOK
-}
-
-func decMain(s *xzDec, b *xzBuf) xzRet {
-	var ret xzRet
-	/*
-	 * Store the start position for the case when we are in the middle
-	 * of the Index field.
-	 */
-	s.inStart = b.inPos
-	for {
-		switch s.sequence {
-		case seqStreamHeader:
-			/*
-			 * Stream Header is copied to s.temp, and then
-			 * decoded from there. This way if the caller
-			 * gives us only little input at a time, we can
-			 * still keep the Stream Header decoding code
-			 * simple. Similar approach is used in many places
-			 * in this file.
-			 */
-			if !fillTemp(s, b) {
-				return xzOK
-			}
-			/*
-			 * If decStreamHeader returns
-			 * xzUnsupportedCheck, it is still possible
-			 * to continue decoding. Thus, update s.sequence
-			 * before calling decStreamHeader.
-			 */
-			s.sequence = seqBlockStart
-			ret = decStreamHeader(s)
-			if ret != xzOK {
-				return ret
-			}
-			fallthrough
-		case seqBlockStart:
-			/* We need one byte of input to continue. */
-			if b.inPos == len(b.in) {
-				return xzOK
-			}
-			/* See if this is the beginning of the Index field. */
-			if b.in[b.inPos] == 0 {
-				s.inStart = b.inPos
-				b.inPos++
-				s.sequence = seqIndex
-				break
-			}
-			/*
-			 * Calculate the size of the Block Header and
-			 * prepare to decode it.
-			 */
-			s.blockHeader.size = (int(b.in[b.inPos]) + 1) * 4
-			s.temp.buf = s.temp.bufArray[:s.blockHeader.size]
-			s.temp.pos = 0
-			s.sequence = seqBlockHeader
-			fallthrough
-		case seqBlockHeader:
-			if !fillTemp(s, b) {
-				return xzOK
-			}
-			ret = decBlockHeader(s)
-			if ret != xzOK {
-				return ret
-			}
-			s.sequence = seqBlockUncompress
-			fallthrough
-		case seqBlockUncompress:
-			ret = decBlock(s, b)
-			if ret != xzStreamEnd {
-				return ret
-			}
-			s.sequence = seqBlockPadding
-			fallthrough
-		case seqBlockPadding:
-			/*
-			 * Size of Compressed Data + Block Padding
-			 * must be a multiple of four. We don't need
-			 * s->block.compressed for anything else
-			 * anymore, so we use it here to test the size
-			 * of the Block Padding field.
-			 */
-			for s.block.compressed&3 != 0 {
-				if b.inPos == len(b.in) {
-					return xzOK
-				}
-				if b.in[b.inPos] != 0 {
-					return xzDataError
-				}
-				b.inPos++
-				s.block.compressed++
-			}
-			s.sequence = seqBlockCheck
-			fallthrough
-		case seqBlockCheck:
-			switch s.CheckType {
-			case CheckCRC32, CheckCRC64, CheckSHA256:
-				ret = checkValidate(s, b)
-				if ret != xzStreamEnd {
-					return ret
-				}
-			default:
-				if !checkSkip(s, b) {
-					return xzOK
-				}
-			}
-			s.sequence = seqBlockStart
-		case seqIndex:
-			ret = decIndex(s, b)
-			if ret != xzStreamEnd {
-				return ret
-			}
-			s.sequence = seqIndexPadding
-			fallthrough
-		case seqIndexPadding:
-			for (s.index.size+vliType(b.inPos-s.inStart))&3 != 0 {
-				if b.inPos == len(b.in) {
-					indexUpdate(s, b)
-					return xzOK
-				}
-				if b.in[b.inPos] != 0 {
-					return xzDataError
-				}
-				b.inPos++
-			}
-			/* Finish the CRC32 value and Index size. */
-			indexUpdate(s, b)
-			/* Compare the hashes to validate the Index field. */
-			if !bytes.Equal(
-				s.block.hash.sha256.Sum(nil), s.index.hash.sha256.Sum(nil)) {
-				return xzDataError
-			}
-			s.sequence = seqIndexCRC32
-			fallthrough
-		case seqIndexCRC32:
-			ret = crcValidate(s, b)
-			if ret != xzStreamEnd {
-				return ret
-			}
-			s.temp.buf = s.temp.bufArray[:streamHeaderSize]
-			s.sequence = seqStreamFooter
-			fallthrough
-		case seqStreamFooter:
-			if !fillTemp(s, b) {
-				return xzOK
-			}
-			return decStreamFooter(s)
-		}
-	}
-	/* Never reached */
-}
-
-/**
- * xzDecRun - Run the XZ decoder
- * @s:         Decoder state allocated using xzDecInit
- * @b:         Input and output buffers
- *
- * See xzRet for details of return values.
- *
- * xzDecRun is a wrapper for decMain to handle some special cases.
- *
- * We must return xzBufError when it seems clear that we are not
- * going to make any progress anymore. This is to prevent the caller
- * from calling us infinitely when the input file is truncated or
- * otherwise corrupt. Since zlib-style API allows that the caller
- * fills the input buffer only when the decoder doesn't produce any
- * new output, we have to be careful to avoid returning xzBufError
- * too easily: xzBufError is returned only after the second
- * consecutive call to xzDecRun that makes no progress.
- */
-func xzDecRun(s *xzDec, b *xzBuf) xzRet {
-	inStart := b.inPos
-	outStart := b.outPos
-	ret := decMain(s, b)
-	if ret == xzOK && inStart == b.inPos && outStart == b.outPos {
-		if s.allowBufError {
-			ret = xzBufError
-		}
-		s.allowBufError = true
-	} else {
-		s.allowBufError = false
-	}
-	return ret
-}
-
-/**
- * xzDecInit - Allocate and initialize a XZ decoder state
- * @dictMax:    Maximum size of the LZMA2 dictionary (history buffer) for
- *              decoding. LZMA2 dictionary is always 2^n bytes
- *              or 2^n + 2^(n-1) bytes (the latter sizes are less common
- *              in practice), so other values for dictMax don't make sense.
- *
- * dictMax specifies the maximum allowed dictionary size that xzDecRun
- * may allocate once it has parsed the dictionary size from the stream
- * headers. This way excessive allocations can be avoided while still
- * limiting the maximum memory usage to a sane value to prevent running the
- * system out of memory when decompressing streams from untrusted sources.
- *
- * xzDecInit returns a pointer to an xzDec, which is ready to be used with
- * xzDecRun.
- */
-func xzDecInit(dictMax uint32, header *Header) *xzDec {
-	s := new(xzDec)
-	s.crc32 = crc32.NewIEEE()
-	s.Header = header
-	s.block.hash.sha256 = sha256.New()
-	s.index.hash.sha256 = sha256.New()
-	s.lzma2 = xzDecLZMA2Create(dictMax)
-	xzDecReset(s)
-	return s
-}
-
-/**
- * xzDecReset - Reset an already allocated decoder state
- * @s:          Decoder state allocated using xzDecInit
- *
- * This function can be used to reset the decoder state without
- * reallocating memory with xzDecInit.
- */
-func xzDecReset(s *xzDec) {
-	s.sequence = seqStreamHeader
-	s.allowBufError = false
-	s.pos = 0
-	s.crc32.Reset()
-	s.check = nil
-	s.CheckType = checkUnset
-	s.block.compressed = 0
-	s.block.uncompressed = 0
-	s.block.count = 0
-	s.block.hash.unpadded = 0
-	s.block.hash.uncompressed = 0
-	s.block.hash.sha256.Reset()
-	s.index.sequence = seqIndexCount
-	s.index.size = 0
-	s.index.count = 0
-	s.index.hash.unpadded = 0
-	s.index.hash.uncompressed = 0
-	s.index.hash.sha256.Reset()
-	s.temp.pos = 0
-	s.temp.buf = s.temp.bufArray[:streamHeaderSize]
-	s.chain = nil
-	s.bcjsUsed = 0
-	s.deltasUsed = 0
-}

vendor/github.com/therootcompany/xz/dec_util.go

@@ -1,52 +0,0 @@
-/*
- * XZ decompressor utility functions
- *
- * Author: Michael Cross <https://github.com/xi2>
- *
- * This file has been put into the public domain.
- * You can do whatever you want with this file.
- */
-
-package xz
-
-func getLE32(buf []byte) uint32 {
-	return uint32(buf[0]) |
-		uint32(buf[1])<<8 |
-		uint32(buf[2])<<16 |
-		uint32(buf[3])<<24
-}
-
-func getBE32(buf []byte) uint32 {
-	return uint32(buf[0])<<24 |
-		uint32(buf[1])<<16 |
-		uint32(buf[2])<<8 |
-		uint32(buf[3])
-}
-
-func putLE32(val uint32, buf []byte) {
-	buf[0] = byte(val)
-	buf[1] = byte(val >> 8)
-	buf[2] = byte(val >> 16)
-	buf[3] = byte(val >> 24)
-	return
-}
-
-func putBE32(val uint32, buf []byte) {
-	buf[0] = byte(val >> 24)
-	buf[1] = byte(val >> 16)
-	buf[2] = byte(val >> 8)
-	buf[3] = byte(val)
-	return
-}
-
-func putLE64(val uint64, buf []byte) {
-	buf[0] = byte(val)
-	buf[1] = byte(val >> 8)
-	buf[2] = byte(val >> 16)
-	buf[3] = byte(val >> 24)
-	buf[4] = byte(val >> 32)
-	buf[5] = byte(val >> 40)
-	buf[6] = byte(val >> 48)
-	buf[7] = byte(val >> 56)
-	return
-}

vendor/github.com/therootcompany/xz/dec_xz.go

@@ -1,124 +0,0 @@
-/*
- * XZ decompressor
- *
- * Authors: Lasse Collin <lasse.collin@tukaani.org>
- *          Igor Pavlov <http://7-zip.org/>
- *
- * Translation to Go: Michael Cross <https://github.com/xi2>
- *
- * This file has been put into the public domain.
- * You can do whatever you want with this file.
- */
-
-package xz
-
-/* from linux/include/linux/xz.h **************************************/
-
-/**
- * xzRet - Return codes
- * @xzOK:                   Everything is OK so far. More input or more
- *                          output space is required to continue.
- * @xzStreamEnd:            Operation finished successfully.
- * @xzUnSupportedCheck:     Integrity check type is not supported. Decoding
- *                          is still possible by simply calling xzDecRun
- *                          again.
- * @xzMemlimitError:        A bigger LZMA2 dictionary would be needed than
- *                          allowed by the dictMax argument given to
- *                          xzDecInit.
- * @xzFormatError:          File format was not recognized (wrong magic
- *                          bytes).
- * @xzOptionsError:         This implementation doesn't support the requested
- *                          compression options. In the decoder this means
- *                          that the header CRC32 matches, but the header
- *                          itself specifies something that we don't support.
- * @xzDataError:            Compressed data is corrupt.
- * @xzBufError:             Cannot make any progress.
- *
- * xzBufError is returned when two consecutive calls to XZ code cannot
- * consume any input and cannot produce any new output.  This happens
- * when there is no new input available, or the output buffer is full
- * while at least one output byte is still pending. Assuming your code
- * is not buggy, you can get this error only when decoding a
- * compressed stream that is truncated or otherwise corrupt.
- */
-type xzRet int
-
-const (
-	xzOK xzRet = iota
-	xzStreamEnd
-	xzUnsupportedCheck
-	xzMemlimitError
-	xzFormatError
-	xzOptionsError
-	xzDataError
-	xzBufError
-)
-
-/**
- * xzBuf - Passing input and output buffers to XZ code
- * @in:         Input buffer.
- * @inPos:      Current position in the input buffer. This must not exceed
- *              input buffer size.
- * @out:        Output buffer.
- * @outPos:     Current position in the output buffer. This must not exceed
- *              output buffer size.
- *
- * Only the contents of the output buffer from out[outPos] onward, and
- * the variables inPos and outPos are modified by the XZ code.
- */
-type xzBuf struct {
-	in     []byte
-	inPos  int
-	out    []byte
-	outPos int
-}
-
-/* All XZ filter IDs */
-type xzFilterID int64
-
-const (
-	idDelta       xzFilterID = 0x03
-	idBCJX86      xzFilterID = 0x04
-	idBCJPowerPC  xzFilterID = 0x05
-	idBCJIA64     xzFilterID = 0x06
-	idBCJARM      xzFilterID = 0x07
-	idBCJARMThumb xzFilterID = 0x08
-	idBCJSPARC    xzFilterID = 0x09
-	idLZMA2       xzFilterID = 0x21
-)
-
-// CheckID is the type of the data integrity check in an XZ stream
-// calculated from the uncompressed data.
-type CheckID int
-
-func (id CheckID) String() string {
-	switch id {
-	case CheckNone:
-		return "None"
-	case CheckCRC32:
-		return "CRC32"
-	case CheckCRC64:
-		return "CRC64"
-	case CheckSHA256:
-		return "SHA256"
-	default:
-		return "Unknown"
-	}
-}
-
-const (
-	CheckNone   CheckID = 0x00
-	CheckCRC32  CheckID = 0x01
-	CheckCRC64  CheckID = 0x04
-	CheckSHA256 CheckID = 0x0A
-	checkMax    CheckID = 0x0F
-	checkUnset  CheckID = -1
-)
-
-// An XZ stream contains a stream header which holds information about
-// the stream. That information is exposed as fields of the
-// Reader. Currently it contains only the stream's data integrity
-// check type.
-type Header struct {
-	CheckType CheckID // type of the stream's data integrity check
-}

vendor/github.com/therootcompany/xz/doc.go

@@ -1,35 +0,0 @@
-// Package xz implements XZ decompression natively in Go.
-//
-// Usage
-//
-// For ease of use, this package is designed to have a similar API to
-// compress/gzip. See the examples for further details.
-//
-// Implementation
-//
-// This package is a translation from C to Go of XZ Embedded
-// (http://tukaani.org/xz/embedded.html) with enhancements made so as
-// to implement all mandatory and optional parts of the XZ file format
-// specification v1.0.4. It supports all filters and block check
-// types, supports multiple streams, and performs index verification
-// using SHA-256 as recommended by the specification.
-//
-// Speed
-//
-// On the author's Intel Ivybridge i5, decompression speed is about
-// half that of the standard XZ Utils (tested with a recent linux
-// kernel tarball).
-//
-// Thanks
-//
-// Thanks are due to Lasse Collin and Igor Pavlov, the authors of XZ
-// Embedded, on whose code package xz is based. It would not exist
-// without their decision to allow others to modify and reuse their
-// code.
-//
-// Bug reports
-//
-// For bug reports relating to this package please contact the author
-// through https://github.com/xi2/xz/issues, and not the authors of XZ
-// Embedded.
-package xz

vendor/github.com/therootcompany/xz/reader.go

@@ -1,256 +0,0 @@
-/*
- * Package xz Go Reader API
- *
- * Author: Michael Cross <https://github.com/xi2>
- *
- * This file has been put into the public domain.
- * You can do whatever you want with this file.
- */
-
-package xz
-
-import (
-	"errors"
-	"io"
-)
-
-// Package specific errors.
-var (
-	ErrUnsupportedCheck = errors.New("xz: integrity check type not supported")
-	ErrMemlimit         = errors.New("xz: LZMA2 dictionary size exceeds max")
-	ErrFormat           = errors.New("xz: file format not recognized")
-	ErrOptions          = errors.New("xz: compression options not supported")
-	ErrData             = errors.New("xz: data is corrupt")
-	ErrBuf              = errors.New("xz: data is truncated or corrupt")
-)
-
-// DefaultDictMax is the default maximum dictionary size in bytes used
-// by the decoder. This value is sufficient to decompress files
-// created with XZ Utils "xz -9".
-const DefaultDictMax = 1 << 26 // 64 MiB
-
-// inBufSize is the input buffer size used by the decoder.
-const inBufSize = 1 << 13 // 8 KiB
-
-// A Reader is an io.Reader that can be used to retrieve uncompressed
-// data from an XZ file.
-//
-// In general, an XZ file can be a concatenation of other XZ
-// files. Reads from the Reader return the concatenation of the
-// uncompressed data of each.
-type Reader struct {
-	Header
-	r           io.Reader       // the wrapped io.Reader
-	multistream bool            // true if reader is in multistream mode
-	rEOF        bool            // true after io.EOF received on r
-	dEOF        bool            // true after decoder has completed
-	padding     int             // bytes of stream padding read (or -1)
-	in          [inBufSize]byte // backing array for buf.in
-	buf         *xzBuf          // decoder input/output buffers
-	dec         *xzDec          // decoder state
-	err         error           // the result of the last decoder call
-}
-
-// NewReader creates a new Reader reading from r. The decompressor
-// will use an LZMA2 dictionary size up to dictMax bytes in
-// size. Passing a value of zero sets dictMax to DefaultDictMax.  If
-// an individual XZ stream requires a dictionary size greater than
-// dictMax in order to decompress, Read will return ErrMemlimit.
-//
-// If NewReader is passed a value of nil for r then a Reader is
-// created such that all read attempts will return io.EOF. This is
-// useful if you just want to allocate memory for a Reader which will
-// later be initialized with Reset.
-//
-// Due to internal buffering, the Reader may read more data than
-// necessary from r.
-func NewReader(r io.Reader, dictMax uint32) (*Reader, error) {
-	if dictMax == 0 {
-		dictMax = DefaultDictMax
-	}
-	z := &Reader{
-		r:           r,
-		multistream: true,
-		padding:     -1,
-		buf:         &xzBuf{},
-	}
-	if r == nil {
-		z.rEOF, z.dEOF = true, true
-	}
-	z.dec = xzDecInit(dictMax, &z.Header)
-	var err error
-	if r != nil {
-		_, err = z.Read(nil) // read stream header
-	}
-	return z, err
-}
-
-// decode is a wrapper around xzDecRun that additionally handles
-// stream padding. It treats the padding as a kind of stream that
-// decodes to nothing.
-//
-// When decoding padding, z.padding >= 0
-// When decoding a real stream, z.padding == -1
-func (z *Reader) decode() (ret xzRet) {
-	if z.padding >= 0 {
-		// read all padding in input buffer
-		for z.buf.inPos < len(z.buf.in) &&
-			z.buf.in[z.buf.inPos] == 0 {
-			z.buf.inPos++
-			z.padding++
-		}
-		switch {
-		case z.buf.inPos == len(z.buf.in) && z.rEOF:
-			// case: out of padding. no more input data available
-			if z.padding%4 != 0 {
-				ret = xzDataError
-			} else {
-				ret = xzStreamEnd
-			}
-		case z.buf.inPos == len(z.buf.in):
-			// case: read more padding next loop iteration
-			ret = xzOK
-		default:
-			// case: out of padding. more input data available
-			if z.padding%4 != 0 {
-				ret = xzDataError
-			} else {
-				xzDecReset(z.dec)
-				ret = xzStreamEnd
-			}
-		}
-	} else {
-		ret = xzDecRun(z.dec, z.buf)
-	}
-	return
-}
-
-func (z *Reader) Read(p []byte) (n int, err error) {
-	// restore err
-	err = z.err
-	// set decoder output buffer to p
-	z.buf.out = p
-	z.buf.outPos = 0
-	for {
-		// update n
-		n = z.buf.outPos
-		// if last call to decoder ended with an error, return that error
-		if err != nil {
-			break
-		}
-		// if decoder has finished, return with err == io.EOF
-		if z.dEOF {
-			err = io.EOF
-			break
-		}
-		// if p full, return with err == nil, unless we have not yet
-		// read the stream header with Read(nil)
-		if n == len(p) && z.CheckType != checkUnset {
-			break
-		}
-		// if needed, read more data from z.r
-		if z.buf.inPos == len(z.buf.in) && !z.rEOF {
-			rn, e := z.r.Read(z.in[:])
-			if e != nil && e != io.EOF {
-				// read error
-				err = e
-				break
-			}
-			if e == io.EOF {
-				z.rEOF = true
-			}
-			// set new input buffer in z.buf
-			z.buf.in = z.in[:rn]
-			z.buf.inPos = 0
-		}
-		// decode more data
-		ret := z.decode()
-		switch ret {
-		case xzOK:
-			// no action needed
-		case xzStreamEnd:
-			if z.padding >= 0 {
-				z.padding = -1
-				if !z.multistream || z.rEOF {
-					z.dEOF = true
-				}
-			} else {
-				z.padding = 0
-			}
-		case xzUnsupportedCheck:
-			err = ErrUnsupportedCheck
-		case xzMemlimitError:
-			err = ErrMemlimit
-		case xzFormatError:
-			err = ErrFormat
-		case xzOptionsError:
-			err = ErrOptions
-		case xzDataError:
-			err = ErrData
-		case xzBufError:
-			err = ErrBuf
-		}
-		// save err
-		z.err = err
-	}
-	return
-}
-
-// Multistream controls whether the reader is operating in multistream
-// mode.
-//
-// If enabled (the default), the Reader expects the input to be a
-// sequence of XZ streams, possibly interspersed with stream padding,
-// which it reads one after another. The effect is that the
-// concatenation of a sequence of XZ streams or XZ files is
-// treated as equivalent to the compressed result of the concatenation
-// of the sequence. This is standard behaviour for XZ readers.
-//
-// Calling Multistream(false) disables this behaviour; disabling the
-// behaviour can be useful when reading file formats that distinguish
-// individual XZ streams. In this mode, when the Reader reaches the
-// end of the stream, Read returns io.EOF. To start the next stream,
-// call z.Reset(nil) followed by z.Multistream(false). If there is no
-// next stream, z.Reset(nil) will return io.EOF.
-func (z *Reader) Multistream(ok bool) {
-	z.multistream = ok
-}
-
-// Reset, for non-nil values of io.Reader r, discards the Reader z's
-// state and makes it equivalent to the result of its original state
-// from NewReader, but reading from r instead. This permits reusing a
-// Reader rather than allocating a new one.
-//
-// If you wish to leave r unchanged use z.Reset(nil). This keeps r
-// unchanged and ensures internal buffering is preserved. If the
-// Reader was at the end of a stream it is then ready to read any
-// follow on streams. If there are no follow on streams z.Reset(nil)
-// returns io.EOF. If the Reader was not at the end of a stream then
-// z.Reset(nil) does nothing.
-func (z *Reader) Reset(r io.Reader) error {
-	switch {
-	case r == nil:
-		z.multistream = true
-		if !z.dEOF {
-			return nil
-		}
-		if z.rEOF {
-			return io.EOF
-		}
-		z.dEOF = false
-		_, err := z.Read(nil) // read stream header
-		return err
-	default:
-		z.r = r
-		z.multistream = true
-		z.rEOF = false
-		z.dEOF = false
-		z.padding = -1
-		z.buf.in = nil
-		z.buf.inPos = 0
-		xzDecReset(z.dec)
-		z.err = nil
-		_, err := z.Read(nil) // read stream header
-		return err
-	}
-}

vendor/modules.txt

@@ -83,9 +83,6 @@ github.com/nats-io/nuid
 github.com/novox/mesh-host/internal/declaration
 github.com/novox/mesh-host/rootsearch
 github.com/novox/mesh-host/validate
-# github.com/therootcompany/xz v1.0.1
-## explicit; go 1.15
-github.com/therootcompany/xz
 # golang.org/x/crypto v0.57.0
 ## explicit; go 1.26.0
 golang.org/x/crypto/acme