Empty the controller's repository: its jobs moved to the parts ADR 0590 and 0593 name, so nothing builds here against the new mesh-sdk

Nothing runs the controller (unassigned, out of the catalog) and the group's check builds every member; the repository is archived after the delivery. Issue 1126.

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

Dockerfile

@@ -1,43 +0,0 @@
-# The Go it builds with, pinned here because genesis builds this file with no arguments (novox/hq
-# issue 223) — the Makefile passes the same digest. A tag older than go.mod asks for is how
-# `make image` broke once before (issue 146).
-ARG GO_BASE=golang@sha256:8ac98ca534ac3f51e1f420a1dd2c15e74c75cfa0f23f3ad27eb5d7236c349a0c
-# The control plane's image — for genesis and the lab only. The mesh runs the controller as a Go
-# bundle the host starts as a process (module.json; novox/hq issue 213), and builds no image of it.
-# Genesis builds this file and raises it as the container the process replaces on the first push
-# (mesh-host internal/bootstrap, novox/hq issue 223).
-#
-# novox/hq ADR 0006: this image is pinned by digest in the bundle the host carries, fetched on a
-# machine where no mesh exists yet, and run before there is anything to check it against. So it
-# holds the program and nothing else — no shell, no package manager, no libc, nothing with a CVE
-# feed of its own. What a person has to audit before trusting a first node is one binary.
-#
-# There are no CA certificates in here on purpose. Nothing it does today makes an outbound TLS
-# connection to a public name: it reaches PostgreSQL on the machine it was raised on, and the
-# broker is verified against a fingerprint pinned in a token rather than against a public root
-# (novox/hq ADR 0004). Adding them "just in case" would put a trust store in the one image whose
-# whole argument is that it contains nothing to reason about.
-
-FROM ${GO_BASE} AS build
-WORKDIR /src
-
-# **No dependency is committed** (issue 1305): go.sum names each one's version and checksum, and the build
-# resolves them with -mod=mod. Dependencies first, so a change to the source does not re-copy them.
-COPY go.mod go.sum ./
-
-# `COPY . .` brings `.git` along, so Go is told not to stamp the commit: the version is said by -X, and a
-# rebuild of an unchanged program is the same bytes (novox/hq ADR 0267 rule 6, issue 363).
-COPY . .
-ARG VERSION=development
-RUN CGO_ENABLED=0 GOFLAGS=-mod=mod go build -trimpath -buildvcs=false \
-        -ldflags "-s -w -X main.version=${VERSION}" \
-        -o /mesh-controller ./cmd/mesh-controller
-
-FROM scratch
-COPY --from=build /mesh-controller /mesh-controller
-
-# Numeric because there is no /etc/passwd to look a name up in. Nothing here needs to be root:
-# it opens outbound connections and writes nothing to its own filesystem.
-USER 65534:65534
-
-ENTRYPOINT ["/mesh-controller"]

Makefile

@@ -1,112 +0,0 @@
-# novox/hq ADR 0006 — the control plane, in Go.
-#
-# The image the bundle pins holds the program and nothing else, so the build is static and the
-# container is built FROM scratch. That is not a size optimisation: this image is fetched by
-# digest and run on a machine where no mesh exists to check anything, and everything in it is
-# something a person would have to audit.
-
-VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo development)
-LDFLAGS := -s -w -X main.version=$(VERSION)
-
-# Where `make check` raises PostgreSQL. A high port and a throwaway container: nothing here
-# touches a database anybody else is using. Override PG_PORT if this one is taken -- the first
-# port chosen was already serving something that had been up for six days.
-PG_PORT      ?= 55532
-PG_CONTAINER ?= mesh-controller-check
-PG_IMAGE     ?= postgres:17-alpine
-export MESH_TEST_POSTGRES ?= postgres://postgres:check@127.0.0.1:$(PG_PORT)/postgres?sslmode=disable
-
-.PHONY: build image check test vet fmt postgres postgres-stop clean
-
-build:
-	CGO_ENABLED=0 go build -trimpath -ldflags '$(LDFLAGS)' -o build/mesh-controller ./cmd/mesh-controller
-
-# Tagged 'development' as well as by version, because the lab places images by name and a
-# scenario naming a version would have to be edited on every build. The version tag is what a
-# real bundle pins.
-IMAGE ?= mesh-controller:$(VERSION)
-DEV_TAG ?= mesh-controller:development
-
-# The Go base the image is built on.
-#
-# **`make image` was broken and stayed broken**, because the Dockerfile's fallback base was a Go
-# older than go.mod asks for: every build died at `go mod download` with "go.mod requires go >=
-# 1.26.0", and the pipeline never saw it because the pipeline passes the declared base in. Anybody
-# building the image by hand hit it and had to find the digest themselves (novox/hq 04-ISSUES/146,
-# what it cost).
-#
-# **Pinned here since the manifest stopped building an image** (novox/hq issue 213): the mesh builds
-# the controller as a Go bundle with its own toolchain, and only `make image` — genesis and the lab —
-# still needs a Go base. The digest is the one the manifest declared until then.
-GO_BASE ?= golang@sha256:8ac98ca534ac3f51e1f420a1dd2c15e74c75cfa0f23f3ad27eb5d7236c349a0c
-
-image:
-	@test -n "$(GO_BASE)" || { echo "no GO_BASE; pass GO_BASE=<image>"; exit 1; }
-	docker build --build-arg GO_BASE=$(GO_BASE) --build-arg VERSION=$(VERSION) -t $(IMAGE) -t $(DEV_TAG) .
-	@echo
-	@docker image inspect $(IMAGE) --format 'built {{.RepoTags}}  {{.Size}} bytes'
-
-# The provisioner ships as an image too, because it is the thing that makes a sealed credential
-# true on a machine -- and the mesh cannot, having discarded the plaintext.
-PROVISIONER_IMAGE ?= mesh-provision-postgres:$(VERSION)
-PROVISIONER_DEV_TAG ?= mesh-provision-postgres:development
-
-provisioner-image:
-	docker build --build-arg GO_BASE=$(GO_BASE) -f examples/postgres-provisioner/Dockerfile \
-		-t $(PROVISIONER_IMAGE) -t $(PROVISIONER_DEV_TAG) .
-	@echo
-	@docker image inspect $(PROVISIONER_IMAGE) --format 'built {{.RepoTags}}  {{.Size}} bytes'
-
-# The object store's provisioner, for the same reason: a bucket and a policy are not files, and
-# the mesh cannot make them -- it discarded the credential it would have to use.
-OBJECTSTORE_IMAGE ?= mesh-provision-objectstore:$(VERSION)
-OBJECTSTORE_DEV_TAG ?= mesh-provision-objectstore:development
-
-objectstore-image:
-	docker build --build-arg GO_BASE=$(GO_BASE) -f examples/objectstore-provisioner/Dockerfile \
-		-t $(OBJECTSTORE_IMAGE) -t $(OBJECTSTORE_DEV_TAG) .
-	@echo
-	@docker image inspect $(OBJECTSTORE_IMAGE) --format 'built {{.RepoTags}}  {{.Size}} bytes'
-
-# The cache's provisioner, for the same reason as the database's: an ACL user is not a file,
-# and the mesh cannot make one -- it discarded the credential it would have to use.
-REDIS_PROVISIONER_IMAGE ?= mesh-provision-redis:$(VERSION)
-REDIS_PROVISIONER_DEV_TAG ?= mesh-provision-redis:development
-
-redis-provisioner-image:
-	docker build --build-arg GO_BASE=$(GO_BASE) -f examples/redis-provisioner/Dockerfile \
-		-t $(REDIS_PROVISIONER_IMAGE) -t $(REDIS_PROVISIONER_DEV_TAG) .
-	@echo
-	@docker image inspect $(REDIS_PROVISIONER_IMAGE) --format 'built {{.RepoTags}}  {{.Size}} bytes'
-
-# The unit level alone (untagged: no bus, no store, no other process), which a developer runs continuously. The tests
-# that need a bus or the store carry `//go:build integration` and run in `check`, not here; without a database the
-# store's tests would skip rather than fail anyway.
-test:
-	go test -timeout 15m ./...
-
-vet:
-	go vet ./...
-
-# A quick step for a developer: the checker runs the build module's own formatting and vet (ADR 0501 §5, D7).
-fmt:
-	@unformatted=$$(gofmt -l cmd internal examples) ; \
-	if [ -n "$$unformatted" ] ; then echo "not gofmt'd:" ; echo "$$unformatted" ; exit 1 ; fi
-
-postgres:
-	@docker rm -f -v $(PG_CONTAINER) >/dev/null 2>&1 || true
-	@docker run -d --name $(PG_CONTAINER) -e POSTGRES_PASSWORD=check \
-		-p 127.0.0.1:$(PG_PORT):5432 $(PG_IMAGE) >/dev/null
-	@printf 'waiting for postgres'
-	@for i in $$(seq 1 60) ; do \
-		if docker exec $(PG_CONTAINER) pg_isready -U postgres >/dev/null 2>&1 ; then \
-			echo ' — ready' ; exit 0 ; fi ; \
-		printf '.' ; sleep 1 ; \
-	done ; \
-	echo ' — never came up' ; docker logs $(PG_CONTAINER) | tail -20 ; exit 1
-
-postgres-stop:
-	@docker rm -f -v $(PG_CONTAINER) >/dev/null 2>&1 || true
-
-clean:
-	rm -rf build/

README.md

@@ -1,218 +1,7 @@
 # mesh-controller
 
-**Tier 2 of Novox Mesh — the control plane.** Everything that needs to know about more than one
-node.
+The controller ended under issue 1126. Its jobs moved to the parts that ADR 0590 and ADR 0593 name: the indexer, the
+assigner, the provisioner, the grants part and the node-engine. Its last module, route-proxy, moved to mesh-networking.
 
-That is the whole test, and it draws the line the host cannot: the host applies and does not
-decide, *because deciding needs knowledge one machine does not have*. Which nodes should run the
-store, which peers belong in an overlay, whether a node has been unreachable for a week — nobody
-on a single machine can answer any of them.
-
-The reasoning lives in [novox/hq](https://git.novox.be/novox/hq); this repository carries no
-argument that is not settled there.
-
-## What it is not
-
-- **Not the thing that changes machines.** It decides; the host applies. It never reaches into a
-  node except through the host, over the link, in a bounded vocabulary.
-- **Not a database.** There is no mesh database. Each context owns its own store and nothing
-  outside a context touches it — including nodes, which hold no credential to any of them.
-- **Not privileged.** It has no more access to a machine than a declaration can express.
-
-## What exists today
-
-**One context of seven, and one of the things it will do.**
-
-| | |
-|---|---|
-| `inventory` | node records and enrolment tokens — **built, as far as identity** |
-| `identity` | the control plane's signing key, and the keys nodes are known by — **built** |
-| `config`, `connectivity`, `provisioning`, `delivery`, `observability` | not built |
-| the interface every surface speaks to | not built; its shape is not decided |
-
-```
-mesh-controller migrate                    bring each context's schema up to date
-mesh-controller node add <name>            create a node record
-mesh-controller node list                  the nodes this mesh knows about
-mesh-controller token issue --node <name>  a one-time right to join, for an existing record
-mesh-controller token issue --new <name>   create the record and issue for it
-mesh-controller identity show              this control plane's signing key
-mesh-controller broker show                where the broker is, and what to expect there
-mesh-controller version                    what this binary is
-```
-
-`migrate` is **step 3 of the foundation bootstrap** — the step the first node cannot get past, run
-against a database raised moments earlier from the bundle the host carries.
-
-### Tokens, and what they are missing
-
-A token is **a one-time right to join, issued for a node record** — which is where re-enrolment is
-decided, since what an identity binds to is settled when the token is made rather than when it is
-presented.
-
-What is built: the secret is 256 bits from the system's random source, shown once, and **stored
-only as a hash**, so a copy of this database is not a set of working credentials. It is usable
-exactly once and only before it expires, and both are read from the row rather than from a status
-something would have had to write. Issuing again for the same node invalidates the outstanding
-one — two live tokens are two machines able to join as the same node.
-
-Redemption is a single statement that both finds a live token and spends it, so eight concurrent
-attempts on one secret produce exactly one winner. There is a test that runs them.
-
-**A token now carries three of its four parts**, and is one line of base64 a person can copy. The
-signing key is real: an Ed25519 key this control plane generates once and keeps, whose public half
-travels in every token. A node believes a declaration because it carries a signature that key made
-— and pinning only the broker would not do, because it would make the control plane's authority
-transitive, so a compromised broker could forge declarations, and since the host applies whatever
-the link delivers that is the whole machine.
-
-**All four parts are built.** Given `MESH_BROKER_ADDRESS` and `MESH_BROKER_CERTIFICATE`, a token
-carries everything ADR 0004 requires. Without them it carries two, and `token issue` prints it
-**and names what is missing** rather than producing something that looks complete and cannot be
-used.
-
-**The fingerprint is derived from the certificate, never configured.** A configured one can drift
-from the certificate it describes, and a drifted pin is worse than none: every node issued a token
-during the drift refuses to connect, and the failure looks like an attack. It is computed over the
-DER bytes — what a client actually sees on the wire — so the same certificate re-wrapped with
-different line endings still produces the same pin.
-
-### Two contexts, and the rule between them is real
-
-`identity` is the second context and it exists partly to test a claim this repository had made and
-never checked: that a context reaches only its own store. It holds `MESH_STORE_IDENTITY`;
-`inventory` holds `MESH_STORE_INVENTORY`; there is no setting that reaches both and no way to ask
-for one. Run `migrate` with only one and it stops, naming the grant it does not have.
-
-A token needs a node record from one and a signing key from the other. Neither reads the other's
-store — the process holding both grants asks each for its part.
-
-### How a node is known
-
-**The node generates a keypair; the mesh records the public half.** The same principle as SSH, and
-the same rule `08-connectivity` already applies to the overlay keys — which is where this was
-settled all along, though it took being asked directly to notice.
-
-Only the public half is ever stored, and that is the property worth having: **a copy of this
-database grants nothing.** It is a list of who to believe, not a set of credentials, which is what
-makes *compromise of a node is compromise of that node* literally true.
-
-Exactly one key is live per node. Re-enrolment revokes the one it replaced, in the same
-transaction — two live identities for one node record is the stolen-laptop case, with the replaced
-machine still believed. The database enforces it as well as the code, and there is a test running
-six concurrent enrolments that fails when the constraint is removed.
-
-**Not the machine's SSH host key**, though that was the obvious economy. Host keys are regenerated
-by reinstalls and image clones, which would silently un-enrol a node; their lifecycle belongs to
-sshd rather than the mesh; and a partial host has no SSH daemon at all.
-
-## Reaching a store
-
-**A context is granted only what it exclusively owns.** No shared writes, no read-only role on
-another context's store, and no connection string that reaches more than one.
-
-That is a rule about credentials, so it is built as one. There is no mesh-wide connection setting
-and no way to ask for one:
-
-```
-MESH_STORE_INVENTORY=postgres://…/inventory
-```
-
-A process granted `inventory` holds that variable and no other. Reaching another context's store
-is not a matter of restraint — it has no address for it and no credential to present. And it is
-how the rule is *checked*: what a context can reach is visible in the declaration that runs it,
-as the list of variables it was given.
-
-Each context's database is named after the context. There is deliberately no database named for
-the mesh as a whole.
-
-## Migrations
-
-Numbered, embedded in the binary, applied in order, each in a transaction with the row recording
-it. The applying is four lines; the rest is refusals, and the refusals are the point:
-
-| it stops when | because |
-|---|---|
-| a migration that ran has since been edited | the database holds the old version, the repository holds the new one, and nothing holds the difference |
-| a migration is numbered below one that already ran | usually two branches taking the same next number — applying it now runs the schema in an order nobody tested |
-| two migrations share a number | order is the entire guarantee, and two files with one number have none |
-| a file in the directory is not a valid migration name | a misnamed migration would otherwise never run and nothing would say so |
-| a migration is empty | it records that something happened and changes nothing, which cannot be told from a mistake |
-
-All of them stop rather than warn. At the moment any of them is true, nobody knows what the
-database contains, and there is no correct guess about a schema.
-
-Running it again does nothing. Two copies running at once take an advisory lock, so a restart
-during a slow migration does not become two runners racing.
-
-## Building
-
-```
-make build      the binary
-make image      the container image
-make check      gofmt, vet, and every test against a real PostgreSQL
-```
-
-`make check` raises a throwaway PostgreSQL in a container and takes it down afterwards, including
-when the tests fail. Without one the tests that need a database **skip and say so** rather than
-passing quietly — `make test` is the honest subset, not the gate.
-
-Tests run against a real database rather than a fake because what is being tested *is* the
-database's behaviour: that DDL is transactional, that an advisory lock serialises, that a
-checksum mismatch is caught against a record PostgreSQL actually kept. A fake would assert that
-the fake behaves as expected.
-
-Every test here has been confirmed to fail when the behaviour it defends is removed. Two did not,
-when first written, and both are now commented with what they were missing.
-
-## Checks that cross into the host's repository
-
-Two things are agreed between this repository and `novox/mesh-host`, and each is a separate struct
-on each side. A field renamed on one of them fails **silently** — the crossing succeeds and
-something is simply absent — so both are checked by handing one side's real output to the other's
-real parser. Neither runs by default; each skips with a reason, because a repository that fails
-without its neighbour checked out is a repository nobody can build.
-
-**What this mesh sends, read by the host that receives it:**
-
-```
-mesh-controller:  ./build/mesh-controller plan <node> --json > /tmp/d.json
-mesh-host:     MESH_EMITTED=/tmp/d.json go test ./internal/declaration/ -v
-```
-
-**What a node says when it joins, read by this mesh:**
-
-```
-mesh-host:     MESH_ENROL_OUT=/tmp/enrol.json go test ./internal/link/
-mesh-controller:  MESH_ENROL=/tmp/enrol.json make check
-```
-
-The second does more than compare shapes: it seals something to the key that arrived and opens it
-with the private half the host kept. A key that is present, correctly named and simply *wrong*
-passes every check that only looks at the message.
-
-## The image
-
-**The mesh no longer runs the controller from it** (novox/hq issue 213). The module declares a Go
-bundle, `controller`, which the host on the controller's machine unpacks and runs as the process
-`mesh-controller` under the account of the same name (ADR 0188 §1, §3). The image stays for what
-still runs a container of the controller: genesis, which raises the first controller from it and
-installs the module from its manifest (mesh-host `internal/bootstrap`), and the lab. Neither is the
-mesh's own build any more — `make image` builds it.
-
-`FROM scratch`, holding one statically linked binary and nothing else — no shell, no package
-manager, no libc, no CA certificates.
-
-Not a size optimisation. The bundle a host carries pins this image by digest, and it is fetched
-and run on a machine where no mesh exists to check anything and a person is expected to have read
-the bundle and believed it. Everything in the image is something that person would have to audit.
-
-## Where the reasoning lives
-
-| | |
-|---|---|
-| what the control plane is | novox/hq ADR 0006 |
-| what it takes to run one, and why Go | novox/hq ADR 0006 |
-| a context owns its store, exclusively | novox/hq ADR 0008 |
-| schema changes are numbered migrations | novox/hq ADR 0013 |
-| a test defends a decision | novox/hq ADR 0017 |
+This repository holds no code and is archived once the delivery of the group that emptied it (release sdk1) is done.
+Its history stays here for reading.

cmd/mesh-controller/accept_outside.go

@@ -1,149 +0,0 @@
-package main
-
-import (
-	"context"
-	"fmt"
-	"sort"
-	"strings"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// A provision whose credential only a person outside the mesh can give (novox/hq ADR 0337, issue 164, issue 165):
-// given once for its provider, at the controller's terminal, and sealed in one act to every consumer that binds the
-// provision from that provider now. The value is never read back, printed or kept.
-
-// outsideOffer is the provider module's own name when `secret accept <node> <module> <name>` names a provision that
-// module offers with a credential issued outside the mesh, and "" when it names anything else (an own secret, or a
-// pair with --provider).
-func outsideOffer(ctx context.Context, module, name, provider string) (string, error) {
-	if provider != "" {
-		return "", nil
-	}
-	open, err := openStores(ctx)
-	if err != nil {
-		return "", err
-	}
-	defer open.Close()
-	shelf, err := open.inventory.Catalogue(ctx)
-	if err != nil {
-		return "", err
-	}
-	if m, known := shelf[module]; known && m.IssuedOutsideOf(name) {
-		return module, nil
-	}
-	return "", nil
-}
-
-// offeredOutsideBy is a module that offers the provision with a credential issued outside the mesh, or "".
-func offeredOutsideBy(ctx context.Context, provision string) (string, error) {
-	open, err := openStores(ctx)
-	if err != nil {
-		return "", err
-	}
-	defer open.Close()
-	shelf, err := open.inventory.Catalogue(ctx)
-	if err != nil {
-		return "", err
-	}
-	module, _ := catalogue.OffersIssuedOutside(shelf, provision)
-	return module, nil
-}
-
-// consumersFrom is every consumer that binds a provision from one provider now, found by resolving every machine as
-// its next send would, and the machines that could not be resolved, with why.
-func consumersFrom(ctx context.Context, open *stores, provider, providerModule, provision string) (
-	[]inventory.PairEnd, []string, error) {
-	// One reading of the mesh for every machine this looks at.
-	ctx = withInputCache(ctx)
-	nodes, err := open.inventory.Nodes(ctx)
-	if err != nil {
-		return nil, nil, err
-	}
-	var out []inventory.PairEnd
-	var unresolved []string
-	for _, n := range nodes {
-		plan, _, err := resolveNode(ctx, open, n.Name)
-		if err != nil {
-			unresolved = append(unresolved, fmt.Sprintf("%s: %s", n.Name, oneLine(err.Error())))
-			continue
-		}
-		out = append(out, bindsFrom(plan, n.Name, provider, providerModule, provision)...)
-	}
-	return out, unresolved, nil
-}
-
-// bindsFrom is every consumer on one machine whose resolution answers the provision from that provider. Pure.
-func bindsFrom(plan catalogue.Resolution, machine, provider, providerModule, provision string) []inventory.PairEnd {
-	var out []inventory.PairEnd
-	for _, need := range plan.Needs {
-		if need.ByRecord || need.Name != provision || need.From != provider {
-			continue
-		}
-		if need.Module != "" && need.Module != providerModule {
-			continue
-		}
-		out = append(out, inventory.PairEnd{Consumer: machine, ConsumerModule: need.For, Local: need.Local})
-	}
-	sort.Slice(out, func(i, j int) bool {
-		return out[i].ConsumerModule+"\x00"+out[i].Local < out[j].ConsumerModule+"\x00"+out[j].Local
-	})
-	return out
-}
-
-// acceptForProvision gives a provision's credential issued outside the mesh, once for its provider (ADR 0337 §3).
-func acceptForProvision(ctx context.Context, provider, providerModule, provision, value string) error {
-	open, err := openStores(ctx)
-	if err != nil {
-		return err
-	}
-	defer open.Close()
-	consumers, unresolved, err := consumersFrom(ctx, open, provider, providerModule, provision)
-	if err != nil {
-		return err
-	}
-	accepted, err := open.inventory.AcceptSecretForProvision(ctx, provision, provider, providerModule, value, consumers)
-	value = ""
-	if err != nil {
-		return err
-	}
-	fmt.Print(acceptedSaid(provider, providerModule, provision, accepted, unresolved))
-	if len(accepted.Sealed) == 0 {
-		return nil
-	}
-	// Composed into each consumer's composition (novox/hq ADR 0539 clause 5): a new revision its want then names.
-	if _, err := composeModules(ctx, open, accepted.Machines); err != nil {
-		return fmt.Errorf("%s is sealed and its compositions on %s could not be written: %w", provision,
-			strings.Join(accepted.Machines, ", "), err)
-	}
-	fmt.Printf("  composed for %s; each consumer starts again on it once its want names the new composition\n",
-		strings.Join(accepted.Machines, ", "))
-	return nil
-}
-
-// acceptedSaid is what one accept for a provider did, in words that never carry the value. Pure.
-func acceptedSaid(provider, providerModule, provision string, a inventory.ProvisionAccepted, unresolved []string) string {
-	var b strings.Builder
-	if len(a.Sealed) == 0 {
-		fmt.Fprintf(&b, "%s from %s on %s: no consumer binds it now, so nothing was sealed; a consumer that binds "+
-			"later waits for it, and this line given again seals it to every consumer then\n", provision,
-			providerModule, provider)
-	} else {
-		var names []string
-		for _, c := range a.Sealed {
-			names = append(names, fmt.Sprintf("%s on %s%s", c.ConsumerModule, c.Consumer, asLocal(c.Local)))
-		}
-		fmt.Fprintf(&b, "%s from %s on %s is given, sealed to %s and to %s\n", provision, providerModule, provider,
-			strings.Join(names, ", "), provider)
-		fmt.Fprintf(&b, "  the mesh cannot read it back, never makes one of its own for it, and will not rotate it\n")
-	}
-	for _, c := range a.Unsealable {
-		fmt.Fprintf(&b, "  not sealed to %s on %s: no sealing key on that machine; give it again once it has one\n",
-			c.ConsumerModule, c.Consumer)
-	}
-	for _, u := range unresolved {
-		fmt.Fprintf(&b, "  not known whether a consumer on %s binds it, which did not resolve; give it again once it does\n", u)
-	}
-	return b.String()
-}

cmd/mesh-controller/acting.go

@@ -1,414 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"os"
-	"strings"
-	"sync"
-	"time"
-
-	"github.com/nats-io/nats.go"
-	"github.com/nats-io/nats.go/jetstream"
-
-	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/conditions"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/lease"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// Acting under the lease (novox/hq to-be 45 §6, ADR 0227 rule 1).
-//
-// **Only the instance holding the lease acts**: sends a declaration, writes a plan, a condition or a
-// call. Every one of those passes theLease.epoch, which answers the epoch the act carries or why it may
-// not happen. Three ways a process stands to the lease:
-//
-//   - **The serving controller** takes it before it does anything else — before it asserts the bus's
-//     objects, which are the controller's to write — waiting while another holds it, and renews it.
-//     Another holder seen, or the key's age passed with no renewal made, is the lease lost: the gate
-//     closes at once and the process exits, so its service manager restarts it as a candidate (serve,
-//     in push.go). A renewal the bus does not answer in time is not a loss (novox/hq issue 477): the
-//     lease is kept, no new act starts once half the key's age passed unrenewed, and the next renewal
-//     made opens the gate again.
-//   - **A command run at a shell** — `push` in the installer, the lab, a person repairing a mesh whose
-//     controller is down (issue 201) — acts **under the holder's epoch** when a controller holds the
-//     lease: it is the same mesh's word, composed and sent under the store's hold of each machine like
-//     the serving controller's, and the epoch it carries is read at the moment it acts, so a handover
-//     between makes it stale and refused like any other. **When nobody holds the lease, the command
-//     takes it** for as long as it runs and gives it back; a controller starting meanwhile waits for
-//     it, as it would for another controller.
-//   - **A process with no bus** — a test, a command that only reads — acts with no epoch and is
-//     refused nothing: there is nothing to order against, and nothing it does reaches a machine.
-//
-// **Unleased, said and temporary.** A serving controller whose bus refuses it the lease's key — the bus's
-// user list is older than this build and does not grant the bucket yet — and that sees no other holder
-// serves without one, as every controller did before the lease: declarations carry no epoch, which no
-// node-engine refuses. Said once, kept as a condition (S12), and tried again every renewal interval; the
-// first push that sends the bus its new user list grants it, and the next try takes it. Refusing to act
-// instead would be a controller that can never send the user list that lets it act.
-
-// actor is this process's standing to the lease.
-type actor struct {
-	mu sync.Mutex
-	// held is the lease this process holds: the serving controller's, or a command's own.
-	held *lease.Lease
-	// unleased is why a serving controller acts without the lease; empty while it holds it or is not
-	// serving.
-	unleased string
-	// serving is a serving controller, which never borrows another's epoch.
-	serving bool
-	// kv is the lease bucket, for a command to read the holder's epoch from.
-	kv    jetstream.KeyValue
-	close func()
-	// noBus is a process with no bus configured.
-	noBus bool
-	// reset is when the lease bucket was found raised again from nothing and its revisions moved past
-	// the highest epoch issued, and what was said of it; zero when it was not (S12).
-	reset     time.Time
-	resetSaid string
-	// renewEvery and poll, when set, are how often the serving controller renews the lease it holds and
-	// looks again at one another holds, in place of the lease's own: a test's, so two controllers hand the
-	// lease over in a second rather than in a renewal of five (novox/hq issue 591). A renewal is given
-	// the lease's own RenewEvery to answer however often it is made, so a slow bus does not lose it.
-	renewEvery, poll time.Duration
-	// releasing is held for the whole of a release, so a second caller — the stop signal's and serve's own
-	// deferred one — waits until the lease is given back and its epoch recorded, never past it to the store's
-	// close (novox/hq issue 906).
-	releasing sync.Mutex
-	// keeper and inv are where a takeover is said (sayTakeover): set once the serving controller's condition
-	// store opens; nil before, and in a command.
-	keeper *conditions.Keeper
-	inv    *inventory.Inventory
-}
-
-// theLease is this process's standing to the lease.
-var theLease = &actor{}
-
-// instance names this process among controller instances: its machine, its process and when it
-// started. The lease's holder and every call this process keeps carry it.
-var instance = func() string {
-	host, _ := os.Hostname()
-	return fmt.Sprintf("controller@%s pid %d since %s", host, os.Getpid(), time.Now().UTC().Format(time.RFC3339))
-}()
-
-// epoch is the gate: the epoch an act carries — zero for none — or why it may not happen.
-func (a *actor) epoch(ctx context.Context) (uint64, error) {
-	a.mu.Lock()
-	held, serving, unleased, noBus := a.held, a.serving, a.unleased, a.noBus
-	a.mu.Unlock()
-	switch {
-	case held != nil:
-		return held.Epoch()
-	case serving && unleased != "":
-		return 0, nil
-	case serving:
-		return 0, lease.ErrNotHeld
-	case noBus:
-		return 0, nil
-	}
-	return a.forACommand(ctx)
-}
-
-// forACommand is a command's epoch: the holder's, or a lease of its own when nobody holds one.
-func (a *actor) forACommand(ctx context.Context) (uint64, error) {
-	a.mu.Lock()
-	defer a.mu.Unlock()
-	if a.held != nil {
-		return a.held.Epoch()
-	}
-	if a.kv == nil {
-		address, err := broker.BusAddress()
-		if err != nil {
-			// No bus: this process reaches no machine, and has nothing to order against.
-			a.noBus = true
-			return 0, nil
-		}
-		js, err := broker.Dial(address)
-		if err != nil {
-			return 0, fmt.Errorf("the bus cannot be reached, so whether a controller holds the lease cannot be "+
-				"read and nothing is done: %w", err)
-		}
-		api, err := jetstream.New(js.Conn())
-		if err != nil {
-			js.Close()
-			return 0, err
-		}
-		reading, cancel := context.WithTimeout(ctx, 10*time.Second)
-		defer cancel()
-		if err := broker.EnsureLeaseBucket(reading, api); err != nil {
-			js.Close()
-			return 0, err
-		}
-		kv, err := api.KeyValue(reading, broker.LeaseBucket)
-		if err != nil {
-			js.Close()
-			return 0, err
-		}
-		a.kv, a.close = kv, js.Close
-		if _, found, err := lease.Current(reading, kv); err == nil && !found {
-			// Nobody: this command takes it for as long as it runs.
-			l, err := lease.Open(reading, api, broker.LeaseBucket, lease.Options{Holder: holderOf(instance),
-				Say: func(format string, args ...any) { fmt.Printf(format+"\n", args...) }})
-			if err != nil {
-				return 0, err
-			}
-			epoch, err := l.TryTake(reading)
-			if err != nil {
-				return 0, fmt.Errorf("no controller holds the lease and this command could not take it: %w", err)
-			}
-			keeping, stop := context.WithCancel(context.Background())
-			go l.Keep(keeping)
-			a.held = l
-			closeBus := a.close
-			a.close = func() {
-				stop()
-				l.Release(context.Background())
-				closeBus()
-			}
-			return epoch, nil
-		}
-	}
-	reading, cancel := context.WithTimeout(ctx, 10*time.Second)
-	defer cancel()
-	holder, found, err := lease.Current(reading, a.kv)
-	if err != nil {
-		return 0, fmt.Errorf("who holds the controller lease cannot be read, so nothing is done: %w", err)
-	}
-	if !found {
-		return 0, errors.New("the controller that held the lease while this command ran let go of it; nothing " +
-			"more is done under an epoch nobody holds — run the command again")
-	}
-	return holder.Epoch, nil
-}
-
-// release gives back what this process holds, at its end — or at the stop signal, before the rest of the
-// process is taken down (serveUnderTheLease). A second call waits for the first to finish.
-func (a *actor) release() {
-	a.releasing.Lock()
-	defer a.releasing.Unlock()
-	a.mu.Lock()
-	closing := a.close
-	a.close = nil
-	a.mu.Unlock()
-	if closing != nil {
-		closing()
-	}
-}
-
-// holderOf is this process as the lease's holder.
-func holderOf(instance string) lease.Holder {
-	host, _ := os.Hostname()
-	build := runningBuild()
-	if build == "" {
-		build = version
-	}
-	return lease.Holder{Instance: instance, Host: host, Build: build}
-}
-
-// RunningBuildVar is where the declaration tells this process which build it is (module.json, the
-// controller process's env): the version its bundle is delivered as, `${version}` composed by the
-// catalogue from the bundle's digest. Empty for a process placed by hand.
-const RunningBuildVar = "MESH_CONTROLLER_VERSION"
-
-// runningBuild is the version of the build this process is, or empty when the declaration did not say.
-func runningBuild() string {
-	return strings.TrimSpace(os.Getenv(RunningBuildVar))
-}
-
-// serveUnderTheLease takes the lease for the serving controller, waiting while another holds it, and
-// keeps it until ctx ends. Lost is closed when it is lost; the caller exits on it.
-func (a *actor) serveUnderTheLease(ctx context.Context, inv *inventory.Inventory, address string) (lost <-chan struct{}, err error) {
-	a.mu.Lock()
-	a.serving = true
-	a.mu.Unlock()
-	// Its own connection, held as long as the lease, and named so (novox/hq issue 327).
-	js, err := broker.Dial(address, nats.Name(broker.ConnectionName+" lease"))
-	if err != nil {
-		return nil, fmt.Errorf("the mesh is on the bus at %s and this control plane cannot reach it to take the "+
-			"lease: %w", broker.BareAddress(address), err)
-	}
-	api, err := jetstream.New(js.Conn())
-	if err != nil {
-		js.Close()
-		return nil, err
-	}
-	asserting, cancel := context.WithTimeout(ctx, 10*time.Second)
-	err = broker.EnsureLeaseBucket(asserting, api)
-	cancel()
-	if err != nil {
-		js.Close()
-		return nil, err
-	}
-	say := func(format string, args ...any) { fmt.Printf(format+"\n", args...) }
-	l, err := lease.Open(ctx, api, broker.LeaseBucket, lease.Options{Holder: holderOf(instance),
-		RenewEvery: a.renewEvery, RenewWithin: lease.RenewEvery, Poll: a.poll, Floor: inv.HighestEpoch, Say: say, Health: controllerHealth, Moved: func(was, floor uint64) {
-			a.mu.Lock()
-			defer a.mu.Unlock()
-			a.reset = time.Now()
-			a.resetSaid = fmt.Sprintf("the lease bucket was at revision %d with epoch %d already issued: it was "+
-				"raised again from nothing (a bus whose data was replaced), and its revisions were moved past %d so "+
-				"no machine refuses the next epoch", was, floor, floor)
-		}})
-	if err != nil {
-		js.Close()
-		return nil, err
-	}
-	gone := make(chan struct{})
-	epoch, err := l.Take(ctx)
-	switch {
-	case ctx.Err() != nil:
-		js.Close()
-		return nil, ctx.Err()
-	case err != nil && !errors.Is(err, lease.ErrUnwritable):
-		// Whether another controller acts cannot be told: this one does not act, and exits to try again.
-		js.Close()
-		return nil, err
-	case err != nil:
-		// Nobody holds it and the bus will not let it be written: unleased, said, tried again (see above).
-		a.mu.Lock()
-		a.unleased = err.Error()
-		a.mu.Unlock()
-		say("this controller serves WITHOUT the lease: %v. Its declarations carry no epoch; it tries again "+
-			"every %s, and the first push that sends the bus its user list grants it", err, lease.RenewEvery)
-		go a.takeWhenGranted(ctx, l, inv, gone)
-	default:
-		a.took(ctx, l, inv, epoch, gone)
-	}
-	a.mu.Lock()
-	a.close = func() {
-		// Given back first, then recorded: an epoch is recorded released only when its key is gone, and
-		// whatever the gate says by then — a shutdown longer than half the key's age closed it, and the epoch
-		// was left open for the next holder to find "expired" (novox/hq issue 906, 2026-10-26).
-		if given := l.Release(context.Background()); given != 0 {
-			ending, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-			if err := inv.EndEpoch(ending, given, inventory.EpochReleased); err != nil {
-				say("how epoch %d ended could not be recorded: %v", given, err)
-			}
-			cancel()
-		}
-		js.Close()
-	}
-	a.mu.Unlock()
-	// **The stop signal gives the lease back first** (novox/hq issue 906): the moment ctx ends, before the rest
-	// of the process is taken down, the gate closes and the key goes, so the next controller takes the lease
-	// at once and the epoch is recorded released. Waiting for the process's own end left the key unrenewed for
-	// as long as the shutdown took — ten seconds on 2026-10-26, past the gate's half-age.
-	go func() {
-		<-ctx.Done()
-		if a.holds(l) {
-			say("stopping: the controller lease is given back first")
-		}
-		a.release()
-	}()
-	return gone, nil
-}
-
-// holds is whether this process holds l now.
-func (a *actor) holds(l *lease.Lease) bool {
-	a.mu.Lock()
-	defer a.mu.Unlock()
-	return a.held == l
-}
-
-// took is the lease taken: recorded, earlier epochs nobody gave back ended as expired, kept.
-func (a *actor) took(ctx context.Context, l *lease.Lease, inv *inventory.Inventory, epoch uint64, gone chan struct{}) {
-	a.mu.Lock()
-	a.held, a.unleased = l, ""
-	a.mu.Unlock()
-	h := holderOf(instance)
-	recording, cancel := context.WithTimeout(ctx, 10*time.Second)
-	expired, err := inv.TookEpoch(recording, inventory.Epoch{Epoch: epoch, Instance: h.Instance, Host: h.Host,
-		Build: h.Build, Taken: time.Now()}, l.GivenBack())
-	cancel()
-	if err != nil {
-		fmt.Printf("epoch %d could not be recorded as taken, so a stale refusal from it will not name it: %v\n", epoch, err)
-	}
-	if given := l.GivenBack(); given != 0 {
-		fmt.Printf("the lease was given back by the controller of epoch %d: taken at once, at epoch %d\n", given, epoch)
-	}
-	for _, e := range expired {
-		fmt.Printf("the controller of epoch %d (%s) stopped renewing the lease without giving it back: it is "+
-			"taken over at epoch %d\n", e.Epoch, e.Instance, epoch)
-	}
-	a.sayTakeover(ctx, epoch)
-	go l.Keep(ctx)
-	go func() {
-		<-l.Lost()
-		if ctx.Err() == nil {
-			why := l.LostWhy()
-			ending, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-			_ = inv.EndEpoch(ending, epoch, inventory.EpochLost)
-			cancel()
-			fmt.Printf("the controller lease was lost (epoch %d): %v — this controller stops and exits, to "+
-				"be started again as a candidate\n", epoch, why)
-		}
-		close(gone)
-	}()
-}
-
-// takeWhenGranted tries the lease again every renewal interval while serving unleased, and stops this
-// controller if another took it meanwhile: two serving at once is what the lease is for.
-func (a *actor) takeWhenGranted(ctx context.Context, l *lease.Lease, inv *inventory.Inventory, gone chan struct{}) {
-	tick := time.NewTicker(lease.RenewEvery)
-	defer tick.Stop()
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-tick.C:
-		}
-		epoch, err := l.TryTake(ctx)
-		if errors.Is(err, lease.ErrTaken) {
-			fmt.Printf("another controller took the lease while this one served without it: %v — this one "+
-				"stops and exits\n", err)
-			close(gone)
-			return
-		}
-		if err != nil {
-			// Still not written, or not readable this time: unleased, said by S12, tried again.
-			a.mu.Lock()
-			a.unleased = err.Error()
-			a.mu.Unlock()
-			continue
-		}
-		a.took(ctx, l, inv, epoch, gone)
-		return
-	}
-}
-
-// standing is what `status` and the self-check say of this process and the lease.
-type standing struct {
-	Epoch    uint64
-	Held     bool
-	Renewed  time.Time
-	Unleased string
-	// Reset is when the lease bucket was found raised again from nothing, and ResetSaid what of it.
-	Reset     time.Time
-	ResetSaid string
-}
-
-func (a *actor) standing() standing {
-	a.mu.Lock()
-	held, unleased, reset, resetSaid := a.held, a.unleased, a.reset, a.resetSaid
-	a.mu.Unlock()
-	st := standing{Unleased: unleased, Reset: reset, ResetSaid: resetSaid}
-	if held == nil {
-		return st
-	}
-	epoch, err := held.Epoch()
-	st.Epoch, st.Held, st.Renewed = epoch, err == nil, held.Renewed()
-	return st
-}
-
-// The gates, given to what acts: a declaration's send (link) and a plan's write (the inventory).
-func init() {
-	link.ActingGate = func(ctx context.Context) error {
-		_, err := theLease.epoch(ctx)
-		if err != nil {
-			return fmt.Errorf("this controller may not send: %w", err)
-		}
-		return nil
-	}
-}

cmd/mesh-controller/acts.go

@@ -1,479 +0,0 @@
-package main
-
-import (
-	"context"
-	"fmt"
-	"github.com/novox/mesh-controller/internal/broker"
-	"io"
-	"slices"
-	"sort"
-	"strings"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// The things the mesh can be asked to do, separated from how it was asked.
-//
-// **A surface is an adapter with no decisions in it** (novox/hq ADR 0035). The command line and
-// the command API call the same functions here, so an assignment refused at one is refused at the
-// other for the same reason and in the same words. The moment a surface can accept something
-// another would reject, the mesh has two answers to one question and people learn which to trust.
-//
-// Each returns what happened as text a person can read and a caller can pass on. Neither surface
-// composes its own explanation, because two explanations of one refusal drift.
-
-// assign puts a module on a node, and says at once what in the mesh no longer works out.
-//
-// The assignment is kept even when the node does not resolve: it is what a person meant, and
-// assignment is not an ordering. A consumer assigned before its provider does not resolve for as
-// long as it takes to assign the provider, and refusing the first half of a pair would make the
-// order somebody types two commands in part of the mesh's rules.
-//
-// **What is checked is the mesh, not the one machine** — because that is what the assignment
-// changes. novox/hq 04-ISSUES/017 names the shape: an action can succeed into a state its own
-// verify rejects, and it happens when the action's test is not the test the verify uses. Here the
-// action tested one node and the verify is resolution over all of them, so an assignment could be
-// reported as fine while it took a provision away from every other machine — a module offering a
-// mesh-scoped provision stops offering it the moment its own node stops resolving, and every
-// consumer elsewhere is then told *nothing in this mesh provides it*, with a remedy that names a
-// module already assigned. That was found on a four-node raise and read as a version bump breaking
-// provider recognition; it was neither the version nor the provider.
-//
-// It costs a resolution per machine. Assignment is a person typing a command, and being told which
-// machines this just blocked is worth more than the milliseconds.
-func assign(ctx context.Context, open *stores, node string, modules ...string) (string, error) {
-	return assignWith(ctx, open, node, assignOptions{}, modules...)
-}
-
-// assignWith is assign asked with its options: build, for a module known and not built (novox/hq issue 325).
-func assignWith(ctx context.Context, open *stores, node string, opts assignOptions, modules ...string) (string, error) {
-	if len(modules) == 0 {
-		return "", fmt.Errorf("assign %s names no module", node)
-	}
-	if err := refusedMovingTheController(modules); err != nil {
-		return "", err
-	}
-	// Every line of the answer comes from the one resolution after the write (novox/hq issue 237):
-	// what the reads before it would say about a machine left out is not the answer's.
-	ctx = leftOutSaidBy(ctx, io.Discard)
-	// **A module the catalogue does not hold is looked for further before it is refused** (novox/hq issue
-	// 325): a build in flight keeps the assignment pending, a module known and not built is said with how to
-	// build it, and only a name the mesh never heard of is refused as unknown. Several modules in one act
-	// are judged together (ADR 0207), so an act naming one not registered is not made in part.
-	if missing, err := notInCatalogue(ctx, open, modules); err != nil {
-		return "", err
-	} else if len(missing) > 0 {
-		if len(modules) == 1 {
-			return notRegistered(ctx, open, node, modules[0], opts)
-		}
-		var lines []string
-		for _, m := range missing {
-			where, err := whereIs(ctx, open.inventory, m, time.Now())
-			if err != nil {
-				return "", err
-			}
-			lines = append(lines, where.said)
-		}
-		return "", fmt.Errorf("%w: nothing was assigned, since modules assigned together are judged together "+
-			"(ADR 0207) and %s not registered:\n  %s\n  assign them together once each is registered, or each "+
-			"alone to keep it pending on its build", inventory.ErrNoSuchModule, strings.Join(missing, ", "),
-			strings.Join(lines, "\n  "))
-	}
-	// **The one assignment refused for what the node lacks** (novox/hq ADR 0207). Everything else
-	// an assignment leaves unresolved is kept, because assignment is not an ordering; a module whose
-	// resources are applied through a seat nothing on the node holds is refused, because that order
-	// — the service manager, the package manager and the runtime before anything that installs,
-	// runs or contains — is the mesh's to keep. Several modules in one act are judged together, so
-	// holders that depend on each other go on in one command.
-	shelf, before, err := seatDependenciesOnAssign(ctx, open, node, modules)
-	if err != nil {
-		return "", err
-	}
-	// **Before the new assignment can unsettle a seat somebody holds only by being alone**
-	// (novox/hq 04-ISSUES/170): what the mesh derived so far is written down, and then the
-	// assignment resolves against a record rather than against a coincidence.
-	settled, err := recordDerivedHolders(ctx, open)
-	if err != nil {
-		return "", err
-	}
-	var lines []string
-	var added []string
-	for _, module := range modules {
-		fresh, err := open.inventory.Assign(ctx, node, module)
-		if err != nil {
-			return strings.Join(lines, "\n"), err
-		}
-		if !fresh {
-			// Nothing changed, and saying "is assigned" would read as an action. One node runs one
-			// of each — the module's name is the assignment's identity (novox/hq ADR 0115).
-			lines = append(lines, fmt.Sprintf(
-				"%s already runs %s — one node runs one of each (ADR 0115); nothing changed", node, module))
-			continue
-		}
-		added = append(added, module)
-		lines = append(lines, fmt.Sprintf("%s is assigned %s", node, module))
-	}
-	if len(added) == 0 {
-		return strings.Join(lines, "\n"), nil
-	}
-	answer := strings.Join(lines, "\n")
-	for _, line := range settled {
-		answer += "\n  " + line
-	}
-	// Its bus credential, in the same act (novox/hq issue 203): an assignment pushed before its
-	// credential exists delivers a process that cannot authenticate and crash-loops until somebody
-	// runs a second verb and a second push. Issued here when the module speaks on the bus and has
-	// no credential yet; kept when it has one, so re-assigning rotates nothing.
-	var issued []string
-	for _, module := range added {
-		if line := issueOnAssign(ctx, open, node, module); line != "" {
-			issued = append(issued, line)
-		}
-	}
-	// **The one resolution the rest of the answer is said from** (novox/hq issue 237), taken after
-	// the write: what this act changed about this node's unmet seat dependencies, and nothing else
-	// (novox/hq ADR 0207) — a dependency of a module just assigned, or one this assignment met; the
-	// rest of the node's list, and every other node's, is `status`'s — and whether the node resolves.
-	after := resolvedAfter(ctx, open, shelf, node)
-	for _, line := range unheldChangeTo(shelf, node, before, after.modules, after.unheld) {
-		answer += "\n  " + line
-	}
-	for _, line := range issued {
-		answer += "\n  " + line
-	}
-	plan, err := after.plan, after.err
-	if err != nil {
-		// Kept, and still refused. Both halves are the answer, and the rest of the mesh is still
-		// worth reporting: this machine's refusal is rarely the only consequence.
-		return answer + blockedElsewhere(ctx, open, node), err
-	}
-	// Kept, and cannot be hosted here. Said at once rather than discovered at push: a module whose
-	// capability the machine lacks is on the wrong machine, and the assignment records what a person
-	// meant while this line says it will not run until it moves. The rest of the node still pushes.
-	isAdded := map[string]bool{}
-	for _, m := range added {
-		isAdded[m] = true
-	}
-	for _, u := range plan.Unhostable {
-		if !isAdded[u.Module] {
-			continue
-		}
-		for _, c := range u.Missing {
-			answer += "\n  but " + catalogue.WrongMachine(u.Module, c, node)
-		}
-	}
-	return answer + composedAfterAct(ctx, open, node) + blockedElsewhere(ctx, open, node), nil
-}
-
-// composedAfterAct composes the node an assignment or its end changed (novox/hq ADR 0539 clause 5): what the
-// answer says of it. The assigner then writes the node's wants by its rules; nothing is sent.
-func composedAfterAct(ctx context.Context, open *stores, node string) string {
-	wrote, err := composeModules(ctx, open, []string{node})
-	if err != nil {
-		return fmt.Sprintf("\n  but its compositions on %s could not all be written: %v", node, firstLine(err.Error()))
-	}
-	if len(wrote[node]) == 0 {
-		return fmt.Sprintf("\n  %s's compositions were already as composed now", node)
-	}
-	return fmt.Sprintf("\n  composed for %s (%d composition(s) written): its wants follow by the assigner's rules", node,
-		len(wrote[node]))
-}
-
-// seatDependenciesOnAssign is the refusal ADR 0207 makes at assignment, or nothing, with the
-// catalogue and the node's assignments it was judged against. Modules already assigned are not new
-// and are not judged again.
-func seatDependenciesOnAssign(ctx context.Context, open *stores, node string, modules []string) (
-	map[string]catalogue.Manifest, []string, error) {
-	shelf, err := open.inventory.Catalogue(ctx)
-	if err != nil {
-		return nil, nil, err
-	}
-	assigned, err := open.inventory.Assigned(ctx, node)
-	if err != nil {
-		return nil, nil, err
-	}
-	already := map[string]bool{}
-	for _, a := range assigned {
-		already[a] = true
-	}
-	var adding []string
-	for _, m := range modules {
-		if !already[m] {
-			adding = append(adding, m)
-		}
-	}
-	// The lines AssignRefusal says beside an assignment it lets through are said by unheldChange
-	// with everything else this act changed, so they are not said twice.
-	if _, err := catalogue.AssignRefusal(shelf, node, assigned, adding); err != nil {
-		return nil, nil, err
-	}
-	// Two modules declaring one path or unit, or one package present and absent, is refused before anything
-	// is recorded (novox/hq ADR 0210, ADR 0303, 04-ISSUES/235): kept, the node would not resolve until one came
-	// off again. Two modules declaring one package present is not a collision (ADR 0303, issue 628).
-	if err := catalogue.CollisionRefusal(shelf, node, assigned, adding); err != nil {
-		return nil, nil, err
-	}
-	return shelf, assigned, nil
-}
-
-// unassign takes modules off a node. What they leave behind is the host's business: a directory
-// holding anything the mesh did not put there is kept (novox/hq ADR 0030).
-//
-// It reports the rest of the mesh for the same reason assign does, and more sharply: taking a
-// module off one machine is the ordinary way to stop providing something to another, and nothing
-// about the command's own output would ever have said so.
-//
-// **Refused when it takes away the last holder of a seat a module left on the node depends on**
-// (novox/hq ADR 0207) — the other side of refusing that module's assignment without one. Several
-// modules in one act are judged together, so a holder and its dependents come off in one command.
-func unassign(ctx context.Context, open *stores, node string, modules ...string) (string, error) {
-	if err := refusedMovingTheController(modules); err != nil {
-		return "", err
-	}
-	if len(modules) == 0 {
-		return "", fmt.Errorf("unassign %s names no module", node)
-	}
-	// One resolution after the write, as assign's answer (novox/hq issue 237).
-	ctx = leftOutSaidBy(ctx, io.Discard)
-	shelf, err := open.inventory.Catalogue(ctx)
-	if err != nil {
-		return "", err
-	}
-	assigned, err := open.inventory.Assigned(ctx, node)
-	if err != nil {
-		return "", err
-	}
-	// Every one checked before any is taken off, so a refusal leaves the node as it was.
-	runs := map[string]bool{}
-	for _, a := range assigned {
-		runs[a] = true
-	}
-	// A module only pending on the node (novox/hq issue 325) is withdrawn, when it is the act's one module:
-	// that is the undo of an assignment kept while its build runs.
-	if len(modules) == 1 && !runs[modules[0]] {
-		said, withdrawn, err := withdrawPending(ctx, open.inventory, node, modules[0])
-		if err != nil {
-			return "", err
-		}
-		if withdrawn {
-			return said, nil
-		}
-	}
-	for _, module := range modules {
-		if !runs[module] {
-			return "", fmt.Errorf("%s is not assigned to %s", module, node)
-		}
-	}
-	if err := catalogue.UnassignRefusal(shelf, node, assigned, modules); err != nil {
-		return "", err
-	}
-	for _, module := range modules {
-		if err := open.inventory.Unassign(ctx, node, module); err != nil {
-			return "", err
-		}
-	}
-	answer := fmt.Sprintf("%s no longer runs %s: its want is written removed by the assigner",
-		node, strings.Join(modules, ", "))
-	after := resolvedAfter(ctx, open, shelf, node)
-	for _, line := range unheldChangeTo(shelf, node, assigned, after.modules, after.unheld) {
-		answer += "\n  " + line
-	}
-	// Whether the node itself still resolves, from the same resolution: before, only the rest of the
-	// mesh's reads said it, on standard error and once per other machine.
-	if after.err != nil {
-		if unresolvable(after.err) {
-			answer += fmt.Sprintf("\n  but %s does not resolve now, so nothing will be sent to it:", node)
-		} else {
-			answer += fmt.Sprintf("\n  but whether %s still resolves could not be read:", node)
-		}
-		for _, line := range strings.Split(strings.TrimRight(after.err.Error(), "\n"), "\n") {
-			answer += "\n    " + strings.TrimSpace(line)
-		}
-	}
-	// Its bus accounts on the node go with it once it no longer resolves there (a module another requires keeps running
-	// and keeps them), so an assignment again issues them afresh (issue 1945). The node's own provisioner account stays.
-	if after.err == nil {
-		for _, module := range modules {
-			if slices.Contains(after.modules, module) {
-				continue
-			}
-			forgot, err := open.inventory.ForgetBusAccountsOf(ctx, node, module, false)
-			switch {
-			case err != nil:
-				answer += fmt.Sprintf("\n  its bus accounts on %s are not forgotten: %v", node, err)
-			case len(forgot) > 0:
-				answer += fmt.Sprintf("\n  its bus accounts on %s forgotten: %s", node, strings.Join(forgot, ", "))
-			}
-		}
-	}
-	// What it leaves behind that is irreplaceable is kept and retired, never removed (novox/hq ADR 0233).
-	for _, line := range keptOnUnassign(ctx, open.inventory, node, modules) {
-		answer += "\n  " + line
-	}
-	return answer + composedAfterAct(ctx, open, node) + blockedElsewhere(ctx, open, node), nil
-}
-
-// afterAct is the one resolution of a node an act's answer is said from, taken after its write
-// (novox/hq issue 237): the plan or why there is none, the modules it has on the node, and its unmet
-// seat dependencies.
-type afterAct struct {
-	plan    catalogue.Resolution
-	err     error
-	modules []string
-	unheld  []catalogue.Unheld
-}
-
-// resolvedAfter resolves the node as `plan` does, once, after the act's write. When the node resolves,
-// its modules and unmet seat dependencies are the resolution's — the closure, so a holder pulled in by
-// a requirement counts as `plan` counts it. When it does not, they are judged over the assignments read
-// after the write, which can only find more unmet than the closure would: a seat said held there is
-// held in the closure too.
-func resolvedAfter(ctx context.Context, open *stores, shelf map[string]catalogue.Manifest, node string) afterAct {
-	plan, _, err := resolveNode(ctx, open, node)
-	if err == nil {
-		out := afterAct{plan: plan, unheld: plan.Unheld}
-		for _, m := range plan.Modules {
-			out.modules = append(out.modules, m.Module)
-		}
-		return out
-	}
-	out := afterAct{err: err}
-	assigned, readErr := open.inventory.Assigned(ctx, node)
-	if readErr != nil {
-		return out
-	}
-	out.modules, out.unheld = assigned, unheldOver(shelf, node, assigned)
-	return out
-}
-
-// splitModules is a surface's one `module` field as the modules it names: several, comma-separated,
-// are one act (novox/hq ADR 0207), so the holders that depend on each other go on together from the
-// command API and the controller seat's verbs as they do from the command line.
-func splitModules(field string) []string {
-	var out []string
-	for _, m := range strings.Split(field, ",") {
-		if m = strings.TrimSpace(m); m != "" {
-			out = append(out, m)
-		}
-	}
-	return out
-}
-
-// blockedElsewhere is every OTHER machine that cannot be worked out as things now stand.
-//
-// **The state, not the cause.** Saying "this assignment broke laptop" would mean resolving the
-// whole mesh twice and would still be a guess about which of several changes did it; saying
-// "laptop cannot be worked out, and here is what it says" is true, is what somebody has to fix,
-// and cannot mislead. The machine that was just changed is left out because its own refusal is
-// already the answer beside this one.
-//
-// Nothing here can fail the act it reports on. A mesh that cannot be read is worth saying and is
-// not a reason to claim the assignment did not happen — it did.
-func blockedElsewhere(ctx context.Context, open *stores, except string) string {
-	// One reading of the mesh for every machine this looks at.
-	ctx = withInputCache(ctx)
-	nodes, err := open.inventory.Nodes(ctx)
-	if err != nil {
-		return "\n\nThe rest of the mesh could not be checked: " + err.Error()
-	}
-	blocked := map[string]string{}
-	for _, n := range nodes {
-		if n.Name == except {
-			continue
-		}
-		if _, _, err := resolveNode(ctx, open, n.Name); err != nil {
-			blocked[n.Name] = err.Error()
-		}
-	}
-	if len(blocked) == 0 {
-		return ""
-	}
-	names := make([]string, 0, len(blocked))
-	for name := range blocked {
-		names = append(names, name)
-	}
-	sort.Strings(names)
-
-	var out strings.Builder
-	fmt.Fprintf(&out, "\n\nAND %d other machine(s) cannot be worked out as things stand, so "+
-		"nothing will be sent to them:\n", len(names))
-	for _, name := range names {
-		fmt.Fprintf(&out, "  %s\n", name)
-		for _, line := range strings.Split(strings.TrimRight(blocked[name], "\n"), "\n") {
-			fmt.Fprintf(&out, "    %s\n", strings.TrimSpace(line))
-		}
-	}
-	out.WriteString("\nThis may or may not be what just changed — it is what is true now.")
-	return out.String()
-}
-
-// issueOnAssign gives a newly assigned module its bus credential, the way `module issue` does, and
-// says what it did in one line. Nothing for a module that declares no broker secret and runs no
-// provisioner client; nothing for one whose user is already minted (a credential is rotated on
-// purpose, never by re-assigning); and when the bus cannot be reached from here, the line names the
-// verb and the push that would refuse the module until it is run — never a silent placeholder (novox/hq issue 203).
-func issueOnAssign(ctx context.Context, open *stores, node, module string) string {
-	// Mint only what no row names: the assignments' watch hears the same write and may issue at once (ADR 0543).
-	ctx = onlyIfAbsent(ctx)
-	inv := open.inventory
-	shelf, err := inv.Catalogue(ctx)
-	if err != nil {
-		return ""
-	}
-	m, known := shelf[module]
-	if !known || mayIssue(m) != nil {
-		return ""
-	}
-	user := broker.Principal{Kind: broker.KindModule, Node: node, Module: module}.Username()
-	_, reads := m.OwnSecrets["broker"]
-	if !reads && !runsTheProvisionerClient(m) {
-		// A module whose bus accounts are its processes' alone has none of its own: only the processes that
-		// are not issued yet are issued (issue 1226).
-		return processAccountsOnAssign(ctx, inv, m, node)
-	}
-	if !reads {
-		// A module running the provisioner client alone is minted the client's account (issue 917).
-		user = broker.Principal{Kind: broker.KindProvisioner, Node: node, Module: module}.Username()
-	}
-	if _, sealed, err := inv.BusAccountIssued(ctx, user); err != nil {
-		return ""
-	} else if sealed { // a row whose credential is not sealed to the node is not issued (issue 1945)
-		// Its own account stands and is kept; a process it gained is not issued yet (issue 1226).
-		return processAccountsOnAssign(ctx, inv, m, node)
-	}
-	busAddress, err := broker.BusAddress()
-	if err == nil {
-		err = issueOnTheNewBus(ctx, inv, m, node, busAddress)
-	}
-	if err != nil {
-		return fmt.Sprintf("its bus credential is not issued (%v): `module issue %s --node %s` first — "+
-			"`push %s` refuses to send %s until it is", err, module, node, node, module)
-	}
-	return fmt.Sprintf("its bus credential is issued and sealed to %s, and arrives with the push", node)
-}
-
-// processAccountsOnAssign issues the process accounts of an assigned module not issued yet, and says what it did.
-func processAccountsOnAssign(ctx context.Context, inv *inventory.Inventory, m catalogue.Manifest, node string) string {
-	line, err := issueMissingProcessAccounts(ctx, inv, m, node)
-	if err != nil {
-		return fmt.Sprintf("its process accounts are not issued (%v): `module issue %s --node %s` first — "+
-			"`push %s` refuses to send %s until it is", err, m.Module, node, node, m.Module)
-	}
-	return line
-}
-
-// refusedMovingTheController refuses assigning or unassigning the controller's module through a verb (review of
-// novox/hq ADR 0272): the node it is assigned to is the control-node, and the control-node's operator account is
-// the controller's terminal, so whoever moves the module chooses the terminal. At the terminal alone, as every
-// change that says who may change what.
-func refusedMovingTheController(modules []string) error {
-	verb, through := throughAVerb()
-	if !through || !slices.Contains(modules, controllerModule) {
-		return nil
-	}
-	return fmt.Errorf("%s is assigned and unassigned at the controller's terminal only (mesh-cli on the control-node), "+
-		"never through a verb (this came through %q): the node it runs on is the control-node, whose operator is the "+
-		"terminal (novox/hq ADR 0272). Nothing was assigned", controllerModule, verb)
-}

cmd/mesh-controller/acts_test.go

@@ -1,135 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"strings"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-)
-
-// What an assignment says about the machines it was not about.
-
-// **An assignment that blocks another machine says so.**
-//
-// The shape found on a four-node raise: a module offering a mesh-scoped provision stops offering it
-// the moment its own node stops resolving, so an assignment to the provider's machine silently took
-// a provision away from every consumer elsewhere. Those consumers were then told *nothing in this
-// mesh provides it*, naming as the remedy a module that was already assigned — which read, on the
-// way back, as a version bump breaking provider recognition. It was neither the version nor the
-// provider: it was one machine's set of assignments, and nothing said so.
-//
-// novox/hq 04-ISSUES/017 names the general shape — an action succeeding into a state its own verify
-// rejects, because the action's test is not the test the verify uses. `assign` tested one node; the
-// verify is resolution over all of them.
-func TestAnAssignmentThatBlocksAnotherMachineSaysWhichAndWhy(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-
-	// A provider on the hub and a consumer on the other machine, both resolving.
-	register(t, open, catalogue.Manifest{Module: "step-ca", Version: "1",
-		Provides: []catalogue.Offer{{Name: "acme-ca", Scope: catalogue.ScopeMesh}},
-		Serves:   map[string]map[string]any{"acme-ca": {"path": "/acme/directory"}}})
-	register(t, open, catalogue.Manifest{Module: "route-proxy", Version: "1",
-		Requires: []string{"acme-ca"}})
-	if _, err := assign(ctx, open, "anchor", "step-ca"); err != nil {
-		t.Fatal(err)
-	}
-	said, err := assign(ctx, open, "laptop", "route-proxy")
-	if err != nil {
-		t.Fatalf("a mesh that should resolve did not: %v\n%s", err, said)
-	}
-	if strings.Contains(said, "cannot be worked out") {
-		t.Fatalf("a well mesh was reported as blocked:\n%s", said)
-	}
-
-	// Now break the hub's own set, with nothing but the command a person has.
-	one, two := rivals()
-	register(t, open, one)
-	register(t, open, two)
-	if _, err := assign(ctx, open, "anchor", "rival-one"); err != nil {
-		t.Fatal(err)
-	}
-	said, err = assign(ctx, open, "anchor", "rival-two")
-	if err == nil {
-		t.Fatal("an assignment that makes its own node incoherent was not reported at all")
-	}
-
-	// The node's own refusal is the error, as it always was. What is new is that the machines this
-	// just took a provision away from are named in the same breath.
-	if !strings.Contains(said, "laptop") {
-		t.Fatalf("the machine this blocked is not named:\n%s\n\n%v", said, err)
-	}
-	if !strings.Contains(said, "acme-ca") {
-		t.Fatalf("what laptop is now missing is not said:\n%s", said)
-	}
-	if !strings.Contains(said, "cannot be worked out as things stand") {
-		t.Fatalf("the report does not say what state the mesh is in:\n%s", said)
-	}
-	// And the assignment is kept: it is what a person meant, and assignment is not an ordering.
-	assigned, err := open.inventory.Assigned(ctx, "anchor")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !contains(assigned, "rival-two") {
-		t.Fatalf("the assignment was not kept: %v", assigned)
-	}
-}
-
-// A consumer assigned before its provider is refused for itself and kept, because assignment is not
-// an ordering — refusing the first half of a pair would make the order somebody types two commands
-// in part of the mesh's rules.
-func TestAConsumerAssignedBeforeItsProviderIsStillAssigned(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	register(t, open, catalogue.Manifest{Module: "route-proxy", Version: "1",
-		Requires: []string{"acme-ca"}})
-
-	said, err := assign(ctx, open, "laptop", "route-proxy")
-	if err == nil {
-		t.Fatalf("a consumer with nothing to consume resolved:\n%s", said)
-	}
-	assigned, err := open.inventory.Assigned(ctx, "laptop")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !contains(assigned, "route-proxy") {
-		t.Fatalf("assignment became an ordering: %v", assigned)
-	}
-}
-
-// Unassigning is the ordinary way to stop providing something to another machine, and it reports
-// the same way for the same reason.
-func TestUnassigningAProviderNamesWhoIsNowBlocked(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	register(t, open, catalogue.Manifest{Module: "step-ca", Version: "1",
-		Provides: []catalogue.Offer{{Name: "acme-ca", Scope: catalogue.ScopeMesh}},
-		Serves:   map[string]map[string]any{"acme-ca": {"path": "/acme/directory"}}})
-	register(t, open, catalogue.Manifest{Module: "route-proxy", Version: "1",
-		Requires: []string{"acme-ca"}})
-	if _, err := assign(ctx, open, "anchor", "step-ca"); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := assign(ctx, open, "laptop", "route-proxy"); err != nil {
-		t.Fatal(err)
-	}
-
-	said, err := unassign(ctx, open, "anchor", "step-ca")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !strings.Contains(said, "laptop") || !strings.Contains(said, "acme-ca") {
-		t.Fatalf("taking the provider away said nothing about who was consuming it:\n%s", said)
-	}
-}
-
-func contains(all []string, one string) bool {
-	for _, s := range all {
-		if s == one {
-			return true
-		}
-	}
-	return false
-}

cmd/mesh-controller/addresses_integration_test.go

@@ -1,231 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"encoding/json"
-	"os"
-	"strings"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/licences"
-)
-
-func TestTheRegistryTrustAndEveryImageFollowThePortTheNodeGaveTheStore(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	register(t, open, aStore())
-	if _, err := assign(ctx, open, "anchor", "distribution"); err != nil {
-		t.Fatal(err)
-	}
-	if err := open.inventory.SetSettings(ctx, "anchor", "distribution",
-		map[string]any{catalogue.PortsSetting: map[string]any{"5000": 5101}}); err != nil {
-		t.Fatal(err)
-	}
-	// A module the mesh built, recorded by digest and path, running on the other machine.
-	if err := open.inventory.RecordBuild(ctx, inventory.Build{
-		ID: "b1", Repository: "r", Module: "app", Commit: "abc",
-		Made: []inventory.Artifact{{Name: "server", Kind: "image",
-			Reference: catalogue.ArtifactStoreScheme + "app/server@" + aDigest}},
-	}); err != nil {
-		t.Fatal(err)
-	}
-	register(t, open, catalogue.Manifest{Module: "app", Version: "1",
-		Resources: []map[string]any{{"id": "server", "type": "container", "name": "mesh-app",
-			"image": catalogue.ArtifactStoreScheme + "app/server@" + aDigest}}})
-	if _, err := assign(ctx, open, "laptop", "app"); err != nil {
-		t.Fatal(err)
-	}
-	// The runtime's trust is the runtime's module's to write (novox/hq ADR 0222): a stand-in for it
-	// asks where this machine reaches the store, as the docker module does.
-	register(t, open, catalogue.Manifest{Module: "runtime", Version: "1",
-		Resources: []map[string]any{{"id": "daemon", "type": "file", "path": "/etc/docker/daemon.json",
-			"into": "json", "content": `{"insecure-registries": ["${seat:mesh-artifact-store:reach}"]}` + "\n"}}})
-	if _, err := assign(ctx, open, "laptop", "runtime"); err != nil {
-		t.Fatal(err)
-	}
-
-	on := map[string]bool{"anchor": true, "laptop": true}
-	node, port, found, err := artifactStoreOnNetwork(ctx, open.inventory, on)
-	if err != nil || !found || node != "anchor" || port != "5101" {
-		t.Fatalf("the store is found on %q:%q (%v, %v); the node put it on 5101", node, port, found, err)
-	}
-
-	var trust string
-	for _, r := range composed(t, open, "laptop").Resources {
-		if r["path"] == "/etc/docker/daemon.json" {
-			trust, _ = r["content"].(string)
-		}
-		if r["id"] == "app.server" && r["image"] != "anchor.internal:5101/app/server@"+aDigest {
-			t.Errorf("the image the mesh built is fetched as %v", r["image"])
-		}
-	}
-	if !strings.Contains(trust, "anchor.internal:5101") || strings.Contains(trust, ":5000") {
-		t.Fatalf("the runtime is told to trust %q; the node put the store on 5101", trust)
-	}
-
-	// And a replay to the catalogue says where the store is now.
-	announced, err := following{open: open}.Announceable(ctx)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(announced) != 1 || announced[0].Made[0].Reference != "anchor.internal:5101/app/server@"+aDigest {
-		t.Fatalf("the replay announces %+v", announced)
-	}
-}
-
-func TestTheControlPlaneIsToldWhereTheNodePutTheStoreAndTheBroker(t *testing.T) {
-	open := aMesh(t)
-	// Issue 1126: the placement export over this fresh mesh, before anything below changes it.
-	placementExportIsEachNodesPlacementFromTheStore(t, open)
-	ctx := t.Context()
-	raw, err := os.ReadFile("../../module.json")
-	if err != nil {
-		t.Fatal(err)
-	}
-	m, err := catalogue.ParseManifest(raw)
-	if err != nil {
-		t.Fatal(err)
-	}
-	control, err := withSeatPorts(m).Resolve([]catalogue.Built{{Name: "controller", Kind: catalogue.ArtifactBundle,
-		Reference: "https://registry.example/mesh-controller/controller.tar.gz", Digest: aDigest}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	register(t, open, control)
-	register(t, open, catalogue.Manifest{Module: "postgres", Version: "1",
-		Claims:  []catalogue.Claim{{Name: "mesh-store", Scope: catalogue.ScopeMesh}},
-		Listens: []catalogue.Listening{{Port: 5432, From: catalogue.FromMesh}},
-		Resources: []map[string]any{{"id": "server", "type": "container", "name": "mesh-store",
-			"ports": []any{"5432:5432"}, "image": "pg@" + aDigest}}})
-	register(t, open, catalogue.Manifest{Module: "lavinmq", Version: "1",
-		Claims: []catalogue.Claim{{Name: "mesh-broker", Scope: catalogue.ScopeMesh}},
-		Listens: []catalogue.Listening{{Port: 5671, From: catalogue.FromMesh},
-			{Port: 5672, From: catalogue.FromMesh}},
-		Guards: []int{15672},
-		Resources: []map[string]any{{"id": "server", "type": "container", "name": "mesh-broker",
-			"ports": []any{"5671:5671", "5672:5672", "127.0.0.1:15672:15672"}, "image": "mq@" + aDigest}}})
-	// The control plane's own bus user is the installer's, seeded at genesis before the controller
-	// runs (SeedBusUser); without it a push now refuses the credential nobody issued (issue 203).
-	if err := open.inventory.SeedBusUser(ctx, inventory.BusUser{Username: "anchor.mesh-controller",
-		Kind: inventory.BusController, Node: "anchor", Module: "mesh-controller"}, "bootstrap"); err != nil {
-		t.Fatal(err)
-	}
-	// Seeded with the credential the controller already uses, so it is sealed: an account counts as issued only once
-	// sealed (ADR 0543 §2, PR #467), and genesis's seed is the credential in use.
-	if err := open.inventory.MarkBusAccountSealed(ctx, "anchor.mesh-controller"); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := assign(ctx, open, "anchor", "mesh-controller"); err != nil {
-		t.Fatal(err)
-	}
-	// The store's module is registered and given its port, and NOT assigned: the state genesis
-	// leaves a given-port node in before the foundation is adopted as modules (04-ISSUES/085).
-	if err := open.inventory.SetSettings(ctx, "anchor", "postgres",
-		map[string]any{catalogue.PortsSetting: map[string]any{"5432": 6852}}); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := assign(ctx, open, "anchor", "lavinmq"); err != nil {
-		t.Fatal(err)
-	}
-	if err := open.inventory.SetSettings(ctx, "anchor", "lavinmq",
-		map[string]any{catalogue.PortsSetting: map[string]any{"5672": 5679}}); err != nil {
-		t.Fatal(err)
-	}
-
-	var env map[string]any
-	for _, r := range composed(t, open, "anchor").Resources {
-		if r["id"] == "mesh-controller.controller" {
-			env, _ = r["env"].(map[string]any)
-		}
-	}
-	if env == nil {
-		t.Fatal("the control plane's process is not in its own node's declaration")
-	}
-	for key, want := range map[string]string{
-		"MESH_STORE_INVENTORY_PORT": "6852",
-		"MESH_STORE_IDENTITY_PORT":  "6852",
-		"MESH_STORE_LICENCES_PORT":  "6852",
-		"MESH_BROKER_AMQP_PORT":     "5679",
-		// Neither given nor assigned by the mesh: the manifest's own number is NOT the answer,
-		// because the sealed value beside it carries the port genesis wrote (finding F3).
-		"MESH_BROKER_ADDRESS_PORT":    "",
-		"MESH_BROKER_MANAGEMENT_PORT": "",
-	} {
-		if env[key] != want {
-			t.Errorf("the control plane is told %s=%v; the node says %q", key, env[key], want)
-		}
-	}
-}
-
-func aLoneNode(t *testing.T) *stores {
-	t.Helper()
-	inventory.ForTest(t)
-	licences.ForTest(t)
-	open, err := openStores(t.Context())
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(open.Close)
-	for _, m := range provided {
-		if err := open.inventory.Provide(t.Context(), m); err != nil {
-			t.Fatal(err)
-		}
-	}
-	record, err := open.inventory.AddNode(t.Context(), "anchor")
-	if err != nil {
-		t.Fatal(err)
-	}
-	reported, _ := json.Marshal(map[string]any{"capabilities": []map[string]any{
-		{"name": "container-runtime", "present": true}}})
-	var profile map[string]any
-	_ = json.Unmarshal(reported, &profile)
-	if err := open.inventory.RecordProfile(t.Context(), record.ID, profile); err != nil {
-		t.Fatal(err)
-	}
-	if err := open.inventory.RecordSealingKey(t.Context(), record.ID, aPublicKey(t)); err != nil {
-		t.Fatal(err)
-	}
-	return open
-}
-
-func TestOnANodeWithNoNetworkTheStoreIsReachedByLoopback(t *testing.T) {
-	open := aLoneNode(t)
-	ctx := t.Context()
-	register(t, open, aStore())
-	register(t, open, catalogue.Manifest{Module: "builder", Version: "1",
-		Requires: []string{catalogue.ArtifactStoreProvision},
-		Resources: []map[string]any{{"id": "server", "type": "container", "name": "mesh-builder",
-			"image": "registry.example/mesh-builder@" + aDigest}}})
-	if err := open.inventory.RecordBuild(ctx, inventory.Build{
-		ID: "b1", Repository: "r", Module: "postgres", Commit: "abc",
-		Made: []inventory.Artifact{{Name: "runtime", Kind: "image",
-			Reference: catalogue.ArtifactStoreScheme + "postgres/runtime@" + aDigest}},
-	}); err != nil {
-		t.Fatal(err)
-	}
-	register(t, open, catalogue.Manifest{Module: "postgres", Version: "1",
-		Resources: []map[string]any{{"id": "runtime", "type": "container", "name": "mesh-postgres",
-			"image": catalogue.ArtifactStoreScheme + "postgres/runtime@" + aDigest}}})
-	for _, module := range []string{"distribution", "builder", "postgres"} {
-		if _, err := assign(ctx, open, "anchor", module); err != nil {
-			t.Fatal(err)
-		}
-	}
-	if err := open.inventory.SetSettings(ctx, "anchor", "distribution",
-		map[string]any{catalogue.PortsSetting: map[string]any{"5000": 5100}}); err != nil {
-		t.Fatal(err)
-	}
-
-	var image any
-	for _, r := range composed(t, open, "anchor").Resources {
-		if r["id"] == "postgres.runtime" {
-			image = r["image"]
-		}
-	}
-	if image != "127.0.0.1:5100/postgres/runtime@"+aDigest {
-		t.Fatalf("on the store's own node, off any network, the image is fetched as %v", image)
-	}
-}

cmd/mesh-controller/addresses_test.go

@@ -1,80 +0,0 @@
-package main
-
-import (
-	"strings"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-)
-
-// An address is read from the node's settings where it is used, never recorded with a port
-// (novox/hq 04-ISSUES/102). Three readers did not follow the setting; each is held to it here.
-
-var aDigest = "sha256:" + strings.Repeat("e", 64)
-
-// aStore is a module offering the artifact store on 5000, published the long way as the
-// distribution module does, so a node may be given another number for it.
-func aStore() catalogue.Manifest {
-	return catalogue.Manifest{Module: "distribution", Version: "1",
-		Provides: []catalogue.Offer{{Name: catalogue.ArtifactStoreProvision, Scope: catalogue.ScopeMesh}},
-		Serves:   map[string]map[string]any{catalogue.ArtifactStoreProvision: {"port": float64(5000)}},
-		Listens:  []catalogue.Listening{{Port: 5000, From: catalogue.FromMesh}},
-		Resources: []map[string]any{{"id": "store", "type": "container", "name": "mesh-registry",
-			"ports": []any{"5000:5000"}, "image": "registry@" + aDigest}}}
-}
-
-// **The trust a machine writes for the store, and the address every built image is fetched
-// through, say the port the node gave the store** — not the catalogue's number.
-
-// **The control plane's own connections say the port the node gave the store and the broker.**
-//
-// Composed from the control plane's own manifest against a real inventory: the store's module is
-// given 6852 on this node the way genesis or an operator gives it, and the control plane's
-// process is told so beside the sealed connection genesis wrote.
-
-// withSeatPorts is the control plane's manifest with the seat placeholders in its environment —
-// added here until module.json carries them (the manifest lands one commit after the code that
-// fills it, so a control plane one build behind never sees a placeholder it cannot fill).
-func withSeatPorts(m catalogue.Manifest) catalogue.Manifest {
-	seatPorts := map[string]string{
-		"MESH_STORE_INVENTORY_PORT":   "${seat:mesh-store:5432}",
-		"MESH_STORE_IDENTITY_PORT":    "${seat:mesh-store:5432}",
-		"MESH_STORE_LICENCES_PORT":    "${seat:mesh-store:5432}",
-		"MESH_BROKER_AMQP_PORT":       "${seat:mesh-broker:5672}",
-		"MESH_BROKER_MANAGEMENT_PORT": "${seat:mesh-broker:15672}",
-		"MESH_BROKER_ADDRESS_PORT":    "${seat:mesh-broker:5671}",
-	}
-	out := m
-	out.Resources = nil
-	for _, r := range m.Resources {
-		if r["type"] != "container" && r["type"] != "process" {
-			out.Resources = append(out.Resources, r)
-			continue
-		}
-		copied := map[string]any{}
-		for k, v := range r {
-			copied[k] = v
-		}
-		env := map[string]any{}
-		if had, ok := r["env"].(map[string]any); ok {
-			for k, v := range had {
-				env[k] = v
-			}
-		}
-		for k, v := range seatPorts {
-			if _, said := env[k]; !said {
-				env[k] = v
-			}
-		}
-		copied["env"] = env
-		out.Resources = append(out.Resources, copied)
-	}
-	return out
-}
-
-// aLoneNode is one capable machine with nothing placed on any network — the control-node during
-// genesis, before the "network" step, which is after the store, the broker, the vault and the
-// catalogue have each been built and pushed (finding F2).
-
-// **Before the network exists, the store's own node reaches it by loopback** — never refused,
-// never handed the scheme: a genesis pushes the store, the broker, the vault and the catalogue to
-// a node on no network, and builds the catalogue on a base it must be able to pull.

cmd/mesh-controller/adopting_test.go

@@ -1,660 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
-	"github.com/nats-io/nats.go/jetstream"
-	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/testbus"
-	"net/http"
-	"reflect"
-	"strings"
-	"testing"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/overlay"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// novox/hq ADR 0100: taking a module is its cutover; converging a node is one act, previewed, and
-// refused while a found container is held; returning to adopted keeps what was taken.
-
-// anAdoptedAnchor is aMesh with the anchor adopted, running a served module the predecessor also
-// runs and a module with only a file, and a filter module in the catalogue.
-func anAdoptedAnchor(t *testing.T) (*stores, *[]string) {
-	t.Helper()
-	open := aMesh(t)
-	ctx := t.Context()
-	register(t, open, catalogue.Manifest{Module: "hello-web", Version: "1",
-		Listens: []catalogue.Listening{{Port: 8080, From: catalogue.FromEverywhere}},
-		Resources: []map[string]any{
-			{"id": "page", "type": "file", "path": "/var/lib/hello-web/index.html", "content": "hi"},
-			{"id": "server", "type": "container", "name": "hello-web", "ports": []any{"8080:80"},
-				"image": "registry.example/hello@sha256:" + strings.Repeat("a", 64)},
-		}})
-	register(t, open, catalogue.Manifest{Module: "notes", Version: "1",
-		Resources: []map[string]any{
-			{"id": "conf", "type": "file", "path": "/etc/notes.conf", "content": "x"},
-		}})
-	register(t, open, catalogue.Manifest{Module: "nftables", Version: "1",
-		Filtering: &catalogue.Filtering{Into: "/etc/nftables.conf"},
-		Resources: []map[string]any{{"id": "load", "type": "service", "unit": "mesh-filter.service",
-			"state": "running", "restart-on": []any{"filtering"}}}})
-	if err := open.inventory.SetAdopted(ctx, "anchor", true); err != nil {
-		t.Fatal(err)
-	}
-	for _, m := range []string{"hello-web", "notes"} {
-		if _, err := assign(ctx, open, "anchor", m); err != nil {
-			t.Fatal(err)
-		}
-	}
-	onTheBusWithItsHaves(t, open)
-	sent := &[]string{}
-	saved := sendNodes
-	sendNodes = func(_ context.Context, _ *stores, names []string) error {
-		*sent = append(*sent, names...)
-		return nil
-	}
-	t.Cleanup(func() { sendNodes = saved })
-	return open, sent
-}
-
-// reportsHolding has the anchor report, on what it was last sent, holding what is given.
-func reportsHolding(t *testing.T, open *stores, held ...link.Held) {
-	t.Helper()
-	reportsReaching(t, open, []link.Reach{
-		{Protocol: "tcp", Address: "0.0.0.0", Port: 22, By: "sshd"},
-		{Protocol: "tcp", Address: "0.0.0.0", Port: 8080, By: "hello-web", Published: true,
-			ContainerPort: 80},
-		{Protocol: "tcp", Address: "0.0.0.0", Port: 5000, By: "predecessor-registry",
-			Published: true, ContainerPort: 5000},
-		{Protocol: "tcp", Address: "127.0.0.1", Port: 15672, By: "mesh-broker",
-			Published: true, ContainerPort: 15672},
-	}, held...)
-}
-
-// reportsReaching has the anchor report, on what it was last sent, what is reachable on it and
-// holding what is given.
-func reportsReaching(t *testing.T, open *stores, reachable []link.Reach, held ...link.Held) {
-	t.Helper()
-	ctx := t.Context()
-	body, err := composed(t, open, "anchor").Body()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := (link.Enrolment{Inventory: open.inventory}).Heard(ctx, link.Report{
-		Node: "anchor", Applied: []string{"hello-web.x"}, Declared: digestOf(body),
-		Firewall: "ufw", Held: held, Reachable: reachable,
-		// A machine says which of its links face outside on every apply (novox/hq ADR 0140), and a
-		// filter is not sent to one that has not. The anchor reports one, as a real host does; this
-		// fixture lacked it from 2026-09-28 and nothing ran the test (issue 177).
-		Outward: []string{"eth0"},
-		// And what filters it (ADR 0168): its front end, the runtime's own, and a chain a
-		// predecessor left in the runtime's user chain.
-		Filters: anchorFilters,
-	}); err != nil {
-		t.Fatal(err)
-	}
-}
-
-// anchorFilters is what the adopted anchor says filters it: ufw's chains, the runtime's, and a
-// predecessor's chain the mesh did not write.
-var anchorFilters = []link.Filter{
-	{Where: "table ip filter, chain ufw-reject-input", Owner: "found-firewall", Refuses: "reject"},
-	{Where: "table ip filter, chain DOCKER", Owner: "runtime", Refuses: `iifname != "docker0" oifname "docker0" drop`},
-	{Where: "table ip filter, chain DOCKER-USER", Owner: "other", Refuses: `iifname "eth0" tcp dport 6000 drop`},
-}
-
-var (
-	heldContainer = link.Held{ID: "hello-web.server", Module: "hello-web", Kind: "container",
-		Target: "hello-web", Since: time.Now()}
-	heldFile = link.Held{ID: "notes.conf", Module: "notes", Kind: "file",
-		Target: "/etc/notes.conf", Since: time.Now(), Kept: "/var/lib/mesh-host/kept/abc-notes.conf"}
-)
-
-func TestTakingAModuleNotOnTheNodeIsRefused(t *testing.T) {
-	open, _ := anAdoptedAnchor(t)
-	if _, err := take(t.Context(), open, "anchor", "nftables", takeOptions{Yes: true}); !errors.Is(err, inventory.ErrNotAssigned) {
-		t.Fatalf("taking an unassigned module gave %v", err)
-	}
-	if _, err := take(t.Context(), open, "laptop", "network", takeOptions{Yes: true}); !errors.Is(err, inventory.ErrNotAdopted) {
-		t.Fatalf("taking on a converged node gave %v", err)
-	}
-}
-
-func TestConvergingIsRefusedOnAPreviewThatWouldBeStale(t *testing.T) {
-	open, sent := anAdoptedAnchor(t)
-	_, err := converge(t.Context(), open, "anchor", false, "", "")
-	if err == nil || !strings.Contains(err.Error(), "has not reported") {
-		t.Fatalf("a node that never reported was previewed: %v", err)
-	}
-	if len(*sent) != 0 {
-		t.Fatal("a refused converge sent something")
-	}
-}
-
-func TestTheFlipIsRefusedWhileAFoundContainerIsHeld(t *testing.T) {
-	open, sent := anAdoptedAnchor(t)
-	reportsHolding(t, open, heldContainer, heldFile)
-	_, err := converge(t.Context(), open, "anchor", true, "", "")
-	if err == nil || !strings.Contains(err.Error(), "take anchor hello-web once its data has moved") {
-		t.Fatalf("the flip was not refused while hello-web holds its found container: %v", err)
-	}
-	if n, _ := open.inventory.NodeByName(t.Context(), "anchor"); !n.Adopted || len(*sent) != 0 {
-		t.Fatal("a refused flip changed something")
-	}
-}
-
-func TestTakingNamesWhatItReplaces(t *testing.T) {
-	open, _ := anAdoptedAnchor(t)
-	reportsHolding(t, open, heldContainer, heldFile)
-	ctx := t.Context()
-	// The machine holds something for the module, so the take acts on the preview the operator
-	// saw and names its digest (novox/hq ADR 0163).
-	preview, err := take(ctx, open, "anchor", "hello-web", takeOptions{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	saw := takeDigestIn(t, preview)
-	if !strings.Contains(preview, "nothing taken; `take anchor hello-web --yes "+saw+"`") {
-		t.Fatalf("the preview does not say how to act on it:\n%s", preview)
-	}
-	if taken, _ := open.inventory.Taken(ctx, "anchor"); len(taken) != 0 {
-		t.Fatal("the preview took something")
-	}
-	if _, err := take(ctx, open, "anchor", "hello-web", takeOptions{Yes: true}); err == nil || !strings.Contains(err.Error(), "name its digest") {
-		t.Fatalf("--yes without the digest was not refused: %v", err)
-	}
-	said, err := take(ctx, open, "anchor", "hello-web", takeOptions{Yes: true, Digest: saw})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !strings.Contains(said, "container hello-web (hello-web.server)") ||
-		!strings.Contains(said, "compositions of anchor are written") {
-		t.Fatalf("taking did not say what it replaces and what to run:\n%s", said)
-	}
-}
-
-// takeDigestIn is the digest a take's preview printed.
-func takeDigestIn(t *testing.T, preview string) string {
-	t.Helper()
-	for _, line := range strings.Split(preview, "\n") {
-		if fields := strings.Fields(line); len(fields) == 2 && fields[0] == "preview" {
-			return fields[1]
-		}
-	}
-	t.Fatalf("the preview printed no digest:\n%s", preview)
-	return ""
-}
-
-// A take acts on the preview the operator saw, and on an account of the machine that is still the
-// machine: a changed preview and a stale account refuse (novox/hq ADR 0163, rule 1).
-func TestATakeIsRefusedOnAChangedPreviewOrAStaleAccount(t *testing.T) {
-	open, _ := anAdoptedAnchor(t)
-	ctx := t.Context()
-	reportsHolding(t, open, heldContainer, heldFile)
-	preview, err := take(ctx, open, "anchor", "hello-web", takeOptions{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	saw := takeDigestIn(t, preview)
-
-	// The machine reports again, and what it holds has changed: the found container now carries
-	// facts the preview never showed.
-	changed := heldContainer
-	changed.Facts = map[string]any{"image": "hello:2", "declared_image": "registry.example/hello"}
-	reportsHolding(t, open, changed, heldFile)
-	_, err = take(ctx, open, "anchor", "hello-web", takeOptions{Yes: true, Digest: saw})
-	if err == nil || !strings.Contains(err.Error(), "has changed since preview "+saw) {
-		t.Fatalf("a changed preview was acted on: %v", err)
-	}
-	if taken, _ := open.inventory.Taken(ctx, "anchor"); len(taken) != 0 {
-		t.Fatal("a refused take took something")
-	}
-
-	// And an account older than the flip allows.
-	preview, err = take(ctx, open, "anchor", "hello-web", takeOptions{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	saw = takeDigestIn(t, preview)
-	saved := reportFreshFor
-	reportFreshFor = -time.Second
-	defer func() { reportFreshFor = saved }()
-	_, err = take(ctx, open, "anchor", "hello-web", takeOptions{Yes: true, Digest: saw})
-	if err == nil || !strings.Contains(err.Error(), "a take acts only on an account newer than") {
-		t.Fatalf("a stale account was acted on: %v", err)
-	}
-	reportFreshFor = saved
-	if _, err := take(ctx, open, "anchor", "hello-web", takeOptions{Yes: true, Digest: saw}); err != nil {
-		t.Fatal(err)
-	}
-	// A module the machine holds nothing for has nothing to compare: --yes alone suffices.
-	if _, err := take(ctx, open, "anchor", "notes", takeOptions{Yes: true}); err == nil {
-		// notes holds a file, so this one needs the digest too.
-		t.Fatal("notes holds a found file and was taken without a digest")
-	}
-}
-
-func TestConvergingPreviewsThenChangesAndAdoptingKeepsWhatWasTaken(t *testing.T) {
-	open, sent := anAdoptedAnchor(t)
-	ctx := t.Context()
-	if _, err := take(ctx, open, "anchor", "hello-web", takeOptions{Yes: true}); err != nil {
-		t.Fatal(err)
-	}
-	*sent = nil // the take composed the node; what follows is judged from here
-	reportsHolding(t, open, heldFile)
-
-	preview, err := converge(ctx, open, "anchor", false, "", "")
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, want := range []string{
-		"tcp/8080 hello-web (published, container port 80)",
-		"declared by hello-web (from anywhere)",
-		"WILL CLOSE — no module assigned here declares it",
-		// The anchor faces inward and is on the private network: the derived filter admits ssh
-		// from the mesh only.
-		"WILL CLOSE to everything outside the private network — ssh stays open from the mesh",
-		"notes\n      replacing the found file /etc/notes.conf (notes.conf), original kept at",
-		"assigns nftables",
-		"the found firewall (ufw) is disabled, never flushed",
-		// What it routes is not a listener: said not to be previewed, and to be dropped.
-		"not previewed: traffic the machine routes that is not a published port",
-		"the derived filter drops it unless a module declares it",
-	} {
-		if !strings.Contains(preview, want) {
-			t.Errorf("the preview does not say %q:\n%s", want, preview)
-		}
-	}
-	if strings.Contains(preview, "15672") {
-		t.Errorf("a loopback listener is in the preview:\n%s", preview)
-	}
-	// What filters the machine now, and the fate of each (novox/hq ADR 0168): the predecessor's
-	// chain is named as not the mesh's and left, so the reader knows before the flip.
-	for _, want := range []string{
-		"table ip filter, chain DOCKER-USER",
-		"NOT THE MESH'S; left in force",
-		`iifname "eth0" tcp dport 6000 drop`,
-		"table ip filter, chain ufw-reject-input",
-		"the found firewall's; retired with it",
-		"the container runtime's own; left",
-	} {
-		if !strings.Contains(preview, want) {
-			t.Errorf("the preview does not say %q:\n%s", want, preview)
-		}
-	}
-	for _, line := range strings.Split(preview, "\n") {
-		if strings.Contains(line, "5000") && !strings.Contains(line, "WILL CLOSE") {
-			t.Errorf("an undeclared published port is not said to close: %s", line)
-		}
-	}
-	if n, _ := open.inventory.NodeByName(ctx, "anchor"); !n.Adopted || len(*sent) != 0 {
-		t.Fatal("the preview changed something")
-	}
-
-	if _, err := converge(ctx, open, "anchor", true, digestIn(t, preview), ""); err != nil {
-		t.Fatal(err)
-	}
-	n, _ := open.inventory.NodeByName(ctx, "anchor")
-	if n.Adopted {
-		t.Fatal("converge --yes left the node adopted")
-	}
-	taken, _ := open.inventory.Taken(ctx, "anchor")
-	if !reflect.DeepEqual(taken, []string{"hello-web", overlay.Name, "nftables", "notes"}) {
-		t.Fatalf("the flip took %v", taken)
-	}
-	if !reflect.DeepEqual(*sent, []string{"anchor"}) {
-		t.Fatalf("the flip sent %v", *sent)
-	}
-	declared := composed(t, open, "anchor")
-	if declared.Adoption != nil {
-		t.Fatal("a converged node is still sent an adoption envelope")
-	}
-	if !hasID(declared.Resources, "nftables.filtering") {
-		t.Fatal("the converged node is not declared the mesh's filter")
-	}
-
-	if _, err := adopt(ctx, open, "anchor"); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := adopt(ctx, open, "anchor"); err == nil {
-		t.Fatal("adopting an adopted node was not refused")
-	}
-	again, _ := open.inventory.Taken(ctx, "anchor")
-	if !reflect.DeepEqual(again, taken) {
-		t.Fatalf("returning to adopted lost what was taken: %v", again)
-	}
-	declared = composed(t, open, "anchor")
-	if declared.Adoption == nil || len(declared.Adoption.Untaken) != 0 {
-		t.Fatalf("returned to adopted, the envelope is %+v", declared.Adoption)
-	}
-	if hasID(declared.Resources, "nftables.filtering") || hasID(declared.Resources, "nftables.load") {
-		t.Fatal("returned to adopted, the mesh's filter is still declared")
-	}
-}
-
-func hasID(resources []map[string]any, id string) bool {
-	for _, r := range resources {
-		if r["id"] == id {
-			return true
-		}
-	}
-	return false
-}
-
-// The command API refuses a flip exactly as the command line does, in the same words.
-func TestTheApiRefusesTheFlipInTheCommandLinesWords(t *testing.T) {
-	open, _ := anAdoptedAnchor(t)
-	reportsHolding(t, open, heldContainer)
-	_, direct := converge(t.Context(), open, "anchor", true, "", "")
-	if direct == nil {
-		t.Fatal("the flip was not refused")
-	}
-	got := asking(t, letIn{}, "POST", "/converge", `{"node":"anchor","yes":true}`)
-	if got.Code != http.StatusConflict {
-		t.Fatalf("got %d: %s", got.Code, got.Body.String())
-	}
-	var said map[string]any
-	if err := json.Unmarshal(got.Body.Bytes(), &said); err != nil {
-		t.Fatal(err)
-	}
-	if said["refused"] != direct.Error() {
-		t.Fatalf("the API said %q and the command line %q", said["refused"], direct.Error())
-	}
-	if got := asking(t, letIn{}, "POST", "/take", `{"node":"anchor"}`); got.Code != http.StatusBadRequest {
-		t.Fatalf("a take naming no module got %d", got.Code)
-	}
-}
-
-// novox/hq ADR 0100: the preview says what the derived filter does, rendered as it is rendered. On
-// a machine that faces inward, ssh is admitted from the private network only, and a port a module
-// admits from the mesh only closes to everything outside it: both are said to close.
-func TestThePreviewSaysWhatNarrowsToTheMeshCloses(t *testing.T) {
-	open, _ := anAdoptedAnchor(t)
-	ctx := t.Context()
-	register(t, open, catalogue.Manifest{Module: "store", Version: "1",
-		Listens: []catalogue.Listening{{Port: 5432, From: catalogue.FromMesh}}})
-	if _, err := assign(ctx, open, "anchor", "store"); err != nil {
-		t.Fatal(err)
-	}
-	reportsReaching(t, open, []link.Reach{
-		{Protocol: "tcp", Address: "0.0.0.0", Port: 22, By: "sshd"},
-		{Protocol: "tcp", Address: "0.0.0.0", Port: 5432, By: "postgres"},
-		{Protocol: "tcp", Address: "10.77.0.1", Port: 5432, By: "postgres"},
-		{Protocol: "tcp", Address: "0.0.0.0", Port: 8080, By: "hello-web", Published: true,
-			ContainerPort: 80},
-	})
-	preview, err := converge(ctx, open, "anchor", false, "", "")
-	if err != nil {
-		t.Fatal(err)
-	}
-	lines := map[string]string{}
-	for _, line := range strings.Split(preview, "\n") {
-		fields := strings.Fields(line)
-		if len(fields) > 1 && strings.HasPrefix(fields[0], "tcp/") {
-			lines[fields[0]+" "+fields[1]] += line + "\n"
-		}
-	}
-	if got := lines["tcp/22 sshd"]; !strings.Contains(got, "WILL CLOSE to everything outside "+
-		"the private network") {
-		t.Errorf("ssh on an inward machine is not said to close outside the mesh:\n%s", preview)
-	}
-	store := lines["tcp/5432 postgres"]
-	if strings.Count(store, "WILL CLOSE to everything outside the private network") != 1 ||
-		!strings.Contains(store, "declared by store (from mesh)") {
-		t.Errorf("the store's narrowing is not said to close, or its mesh address is:\n%s", preview)
-	}
-	if got := lines["tcp/8080 hello-web"]; !strings.Contains(got, "declared by hello-web (from anywhere)") {
-		t.Errorf("a port open to everywhere is not said to stay:\n%s", preview)
-	}
-}
-
-// digestIn is the digest a converge preview printed.
-func digestIn(t *testing.T, preview string) string {
-	t.Helper()
-	for _, line := range strings.Split(preview, "\n") {
-		if fields := strings.Fields(line); len(fields) == 2 && fields[0] == "preview" {
-			return fields[1]
-		}
-	}
-	t.Fatalf("the preview printed no digest:\n%s", preview)
-	return ""
-}
-
-// The flip acts on the preview the operator saw: it names that preview's digest, and it is refused
-// when the digest is missing, when anything the preview says has changed since, or when the node's
-// account of itself is too old to be the machine as it is.
-func TestTheFlipActsOnlyOnThePreviewTheOperatorSaw(t *testing.T) {
-	open, sent := anAdoptedAnchor(t)
-	ctx := t.Context()
-	if _, err := take(ctx, open, "anchor", "hello-web", takeOptions{Yes: true}); err != nil {
-		t.Fatal(err)
-	}
-	*sent = nil // the take composed the node; what follows is judged from here
-	reportsHolding(t, open, heldFile)
-	preview, err := converge(ctx, open, "anchor", false, "", "")
-	if err != nil {
-		t.Fatal(err)
-	}
-	saw := digestIn(t, preview)
-	if !strings.Contains(preview, "converge anchor --yes "+saw) {
-		t.Fatalf("the preview does not say how to act on it:\n%s", preview)
-	}
-	unchanged := func() {
-		t.Helper()
-		if n, _ := open.inventory.NodeByName(ctx, "anchor"); !n.Adopted || len(*sent) != 0 {
-			t.Fatal("a refused flip changed something")
-		}
-	}
-
-	if _, err := converge(ctx, open, "anchor", true, "", ""); err == nil ||
-		!strings.Contains(err.Error(), "--yes "+saw) {
-		t.Fatalf("a flip naming no preview was not refused: %v", err)
-	}
-	unchanged()
-
-	// Something new is reachable: the preview the operator saw is not what would happen.
-	reportsReaching(t, open, []link.Reach{
-		{Protocol: "tcp", Address: "0.0.0.0", Port: 22, By: "sshd"},
-		{Protocol: "tcp", Address: "0.0.0.0", Port: 8080, By: "hello-web", Published: true,
-			ContainerPort: 80},
-		{Protocol: "tcp", Address: "0.0.0.0", Port: 6000, By: "something-new"},
-	}, heldFile)
-	_, err = converge(ctx, open, "anchor", true, saw, "")
-	if err == nil || !strings.Contains(err.Error(), "has changed since preview "+saw) {
-		t.Fatalf("a flip on a changed preview was not refused: %v", err)
-	}
-	unchanged()
-
-	// An account older than the flip trusts is refused, whatever digest is named.
-	again, err := converge(ctx, open, "anchor", false, "", "")
-	if err != nil {
-		t.Fatal(err)
-	}
-	saved := reportFreshFor
-	reportFreshFor = time.Nanosecond
-	_, err = converge(ctx, open, "anchor", true, digestIn(t, again), "")
-	reportFreshFor = saved
-	if err == nil || !strings.Contains(err.Error(), "wait for its next report") {
-		t.Fatalf("a flip on an old account was not refused: %v", err)
-	}
-	unchanged()
-
-	if _, err := converge(ctx, open, "anchor", true, digestIn(t, again), ""); err != nil {
-		t.Fatalf("the flip on the preview just seen was refused: %v", err)
-	}
-	if n, _ := open.inventory.NodeByName(ctx, "anchor"); n.Adopted {
-		t.Fatal("the flip did not converge the node")
-	}
-}
-
-// novox/hq ADR 0103: the preview names every kind of thing a module the flip takes holds as found,
-// not only its files, and the digest changes when any of them does.
-func TestThePreviewNamesEveryHeldKind(t *testing.T) {
-	open, _ := anAdoptedAnchor(t)
-	ctx := t.Context()
-	if _, err := take(ctx, open, "anchor", "hello-web", takeOptions{Yes: true}); err != nil {
-		t.Fatal(err)
-	}
-	since := time.Now()
-	held := []link.Held{heldFile,
-		{ID: "notes.data", Module: "notes", Kind: "directory", Target: "/var/lib/notes", Since: since},
-		{ID: "notes.daemon", Module: "notes", Kind: "service", Target: "notes.service", Since: since},
-		{ID: "notes.seed", Module: "notes", Kind: "archive", Target: "/srv/notes", Since: since},
-		{ID: "notes.worker", Module: "notes", Kind: "process", Target: "notes-worker", Since: since},
-		{ID: "notes.account", Module: "notes", Kind: "user", Target: "notes", Since: since},
-	}
-	reportsHolding(t, open, held...)
-	preview, err := converge(ctx, open, "anchor", false, "", "")
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, want := range []string{
-		"replacing the found directory /var/lib/notes (notes.data)",
-		"replacing the found service notes.service (notes.daemon)",
-		"replacing the found archive /srv/notes (notes.seed)",
-		"replacing the found process notes-worker (notes.worker)",
-		"replacing the found user notes (notes.account)",
-	} {
-		if !strings.Contains(preview, want) {
-			t.Errorf("the preview does not say %q:\n%s", want, preview)
-		}
-	}
-	reportsHolding(t, open, held[:len(held)-1]...)
-	fewer, err := converge(ctx, open, "anchor", false, "", "")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if digestIn(t, fewer) == digestIn(t, preview) {
-		t.Fatal("the digest does not change with what is held")
-	}
-}
-
-// novox/hq ADR 0100: the flip acts on what the node said is reachable, so an account naming nothing
-// is refused. Every machine that is up answers on ssh; nothing reported means the host's collectors
-// did not, and flipping would close ports the preview never named.
-func TestTheFlipIsRefusedOnAnAccountNamingNothingReachable(t *testing.T) {
-	open, sent := anAdoptedAnchor(t)
-	ctx := t.Context()
-	if _, err := take(ctx, open, "anchor", "hello-web", takeOptions{Yes: true}); err != nil {
-		t.Fatal(err)
-	}
-	*sent = nil // the take composed the node; what follows is judged from here
-	// Only a loopback listener: nothing off the machine, which is the same silence.
-	reportsReaching(t, open, []link.Reach{
-		{Protocol: "tcp", Address: "127.0.0.1", Port: 15672, By: "mesh-broker"},
-	}, heldFile)
-	preview, err := converge(ctx, open, "anchor", false, "", "")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !strings.Contains(preview, "this account looks partial") {
-		t.Errorf("the preview does not mark a partial account:\n%s", preview)
-	}
-	_, err = converge(ctx, open, "anchor", true, digestIn(t, preview), "")
-	if err == nil || !strings.Contains(err.Error(), "says nothing is reachable on it") {
-		t.Fatalf("the flip was not refused on an account naming nothing: %v", err)
-	}
-	if n, _ := open.inventory.NodeByName(ctx, "anchor"); !n.Adopted || len(*sent) != 0 {
-		t.Fatal("a refused flip changed something")
-	}
-}
-
-// onTheBusWithItsHaves gives the controller a bus that holds, for the anchor, a want and a have of its module that agree: the node
-// has everything wanted of it, as read from the haves (novox/hq ADR 0539 §9), so a flip is refused for what it is about and
-// not because the bus could not be read.
-func onTheBusWithItsHaves(t *testing.T, open *stores) {
-	t.Helper()
-	ctx := t.Context()
-	js, err := broker.Dial(testbus.URL(t))
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(js.Close)
-	servingBus.Store(js)
-	t.Cleanup(func() { servingBus.Store(nil) })
-	api, err := jetstream.New(js.Conn())
-	if err != nil {
-		t.Fatal(err)
-	}
-	fp := sdkdelivery.SourcePrefix2 + strings.Repeat("a", 64)
-	composed := "sha256:" + strings.Repeat("b", 64)
-	put := func(bucket, key string, value []byte) {
-		kv, err := api.CreateOrUpdateKeyValue(ctx, jetstream.KeyValueConfig{Bucket: bucket})
-		if err != nil {
-			t.Fatal(err)
-		}
-		if _, err := kv.Put(ctx, key, value); err != nil {
-			t.Fatal(err)
-		}
-	}
-	wantKey, err := sdkdelivery.WantKey("anchor", "hello-web")
-	if err != nil {
-		t.Fatal(err)
-	}
-	haveKey, err := sdkdelivery.HaveKey("anchor", "hello-web")
-	if err != nil {
-		t.Fatal(err)
-	}
-	want, err := sdkdelivery.EncodeWant(sdkdelivery.Want{FP: fp, Composed: composed})
-	if err != nil {
-		t.Fatal(err)
-	}
-	have, err := sdkdelivery.EncodeHave(sdkdelivery.Have{FP: fp, Composed: composed, Phase: sdkdelivery.PhaseRunning, Health: sdkdelivery.HealthOK})
-	if err != nil {
-		t.Fatal(err)
-	}
-	put(sdkdelivery.AssignerWantsBucket, wantKey, want)
-	put(sdkdelivery.HaveBucket, haveKey, have)
-}
-
-// **When the bus cannot be read, whether the machine runs what is wanted is not known, and the flip says exactly that** (issue
-// 1945): not "push", and not "has not reported".
-func TestTheFlipIsRefusedWithTheBusUnreachableSayingItCannotTell(t *testing.T) {
-	open, sent := anAdoptedAnchor(t)
-	reportsHolding(t, open, heldContainer, heldFile)
-	servingBus.Store(nil) // this process has no bus now, and no address to dial
-	_, err := converge(t.Context(), open, "anchor", true, "", "")
-	if err == nil || !strings.Contains(err.Error(), "cannot tell whether anchor runs what is wanted: the bus is not reachable") ||
-		strings.Contains(err.Error(), "push") {
-		t.Fatalf("the flip with the bus out of reach: %v", err)
-	}
-	if len(*sent) != 0 {
-		t.Fatal("a refused flip sent something")
-	}
-}
-
-// **A take composes the node only when it is performed** (issue 1945): a preview, a take that names no digest and a take refused
-// for a changed preview compose nothing; the performed take composes the machine once, and says so.
-func TestATakeComposesTheNodeOnlyWhenItIsPerformed(t *testing.T) {
-	open, sent := anAdoptedAnchor(t)
-	ctx := t.Context()
-	reportsHolding(t, open, heldContainer, heldFile)
-	preview, err := take(ctx, open, "anchor", "hello-web", takeOptions{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := take(ctx, open, "anchor", "hello-web", takeOptions{Yes: true}); err == nil {
-		t.Fatal("a take of a held module without the preview's digest was performed")
-	}
-	if _, err := take(ctx, open, "anchor", "hello-web", takeOptions{Yes: true, Digest: "not-the-digest"}); err == nil {
-		t.Fatal("a take naming another preview's digest was performed")
-	}
-	if len(*sent) != 0 {
-		t.Fatalf("a preview or a refused take composed %v", *sent)
-	}
-	said, err := take(ctx, open, "anchor", "hello-web", takeOptions{Yes: true, Digest: takeDigestIn(t, preview)})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(*sent) != 1 || (*sent)[0] != "anchor" || !strings.Contains(said, "compositions of anchor are written") {
-		t.Fatalf("the performed take composed %v and said:\n%s", *sent, said)
-	}
-}

cmd/mesh-controller/advisories_counted_test.go

@@ -1,180 +0,0 @@
-package main
-
-import (
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/conditions"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// **A refusal the bus said once is counted once** (novox/hq issue 402). The bus refused the controller
-// one publish at 18:52:59 UTC on 2026-10-10 and never again, yet S9 looked at the one remembered
-// advisory every half minute for the hour it is kept, and the condition said "observed 15 time(s), last
-// 13s ago" with a refusal in its evidence every 30 seconds: two of us read it as a refusal going on and
-// went looking for a missing grant. The condition counts what the bus said, with when it last said it,
-// never how often the controller looked.
-func TestARefusalSaidOnceIsCountedOnceHoweverOftenItIsLookedAt(t *testing.T) {
-	refused := time.Date(2026, 10, 10, 18, 52, 59, 0, time.UTC)
-	now := refused.Add(10 * time.Second)
-	store := conditions.NewInMemory()
-	k := conditions.NewKeeper(t.Context(), conditions.Options{Store: store, History: store,
-		Teller: &conditions.Told{}, Now: func() time.Time { return now }})
-	t.Cleanup(func() { k.Close(t.Context()) })
-
-	// The words the live condition bus.controller.refused carried on 2026-10-10.
-	said := "the bus refused the controller: nats: permissions violation: Permissions Violation for " +
-		`Publish to "mesh.seat.mesh-delivery.tool.times"`
-	advisory := link.Advisory{Kind: link.AdvisoryRefused, ID: "controller", Said: said,
-		First: refused, Last: refused, Count: 1}
-	look := func() conditions.Condition {
-		t.Helper()
-		f := &signalFacts{now: now, host: "novox", advisories: []link.Advisory{advisory}}
-		if err := k.Reconcile(t.Context(), "S9", watchAdvisories(f)); err != nil {
-			t.Fatal(err)
-		}
-		c, found, err := conditions.ReadOne(t.Context(), store, "bus.controller.refused")
-		if err != nil || !found {
-			t.Fatalf("bus.controller.refused: found %v, %v", found, err)
-		}
-		return c
-	}
-
-	var c conditions.Condition
-	for range 15 {
-		c = look()
-		now = now.Add(30 * time.Second)
-	}
-	if c.Observations != 1 || len(c.Evidence) != 1 {
-		t.Fatalf("one refusal, looked at 15 times, reads as observed %d time(s) with %d evidence lines: %+v",
-			c.Observations, len(c.Evidence), c.Evidence)
-	}
-	if !c.LastObserved.Equal(refused) || !c.Evidence[0].At.Equal(refused) {
-		t.Fatalf("last observed %s, evidence at %s: the refusal was at %s", c.LastObserved, c.Evidence[0].At, refused)
-	}
-
-	// The bus refuses it three times more between two looks: the condition counts four refusals, says
-	// the newest, and adds one line of evidence for the look that saw them.
-	again := now.Add(-5 * time.Second)
-	advisory.Last, advisory.Count = again, 4
-	c = look()
-	if c.Observations != 4 || len(c.Evidence) != 2 || !c.LastObserved.Equal(again) || !c.Evidence[0].At.Equal(again) {
-		t.Fatalf("four refusals read as observed %d time(s), last %s, evidence %+v", c.Observations, c.LastObserved, c.Evidence)
-	}
-	if !strings.Contains(c.Summary, "(4 times since 18:52 UTC)") {
-		t.Fatalf("summary %q", c.Summary)
-	}
-	now = now.Add(30 * time.Second)
-	if c = look(); c.Observations != 4 || len(c.Evidence) != 2 {
-		t.Fatalf("a look with nothing new counted: observed %d time(s), evidence %+v", c.Observations, c.Evidence)
-	}
-}
-
-// **A condition that looks at the present still counts its looks** (novox/hq issue 402 changes only
-// what reads a record): a machine silent for three looks was observed three times, and says so.
-func TestAConditionOfThePresentCountsItsLooks(t *testing.T) {
-	now := time.Date(2026, 10, 10, 19, 0, 0, 0, time.UTC)
-	store := conditions.NewInMemory()
-	k := conditions.NewKeeper(t.Context(), conditions.Options{Store: store, History: store,
-		Teller: &conditions.Told{}, Now: func() time.Time { return now }})
-	t.Cleanup(func() { k.Close(t.Context()) })
-	var c conditions.Condition
-	for range 3 {
-		var err error
-		if c, err = k.Observe(t.Context(), conditions.Observation{Scope: conditions.ScopeMachine, ID: "ace",
-			Kind: "silent", Machine: "ace", Severity: conditions.Warning, Summary: "ace has not been heard from",
-			Source: "S1"}); err != nil {
-			t.Fatal(err)
-		}
-		now = now.Add(30 * time.Second)
-	}
-	if c.Observations != 3 || len(c.Evidence) != 3 || !c.LastObserved.Equal(now.Add(-30*time.Second)) {
-		t.Fatalf("observed %d time(s), %d evidence lines, last %s", c.Observations, len(c.Evidence), c.LastObserved)
-	}
-}
-
-// **One key, one watcher** (novox/hq issue 440). A consumer's max-deliveries condition is said from
-// DEAD_LETTERS while it holds a message the consumer gave up on (issue 330). A max-deliveries advisory
-// without a token names the same key; read beside it, each look added an observation and a line of
-// evidence through the dead-letter half, and the two summaries overwrote each other on every look. The
-// dead-letter row alone says that key, and counts the messages given up on, never the looks.
-func TestAHeldDeadLetterIsCountedByWhatWasGivenUpNotByTheLooks(t *testing.T) {
-	gaveUp := time.Date(2026, 10, 10, 21, 4, 0, 0, time.UTC)
-	now := gaveUp.Add(20 * time.Second)
-	store := conditions.NewInMemory()
-	k := conditions.NewKeeper(t.Context(), conditions.Options{Store: store, History: store,
-		Teller: &conditions.Told{}, Now: func() time.Time { return now }})
-	t.Cleanup(func() { k.Close(t.Context()) })
-
-	const key = "bus.EVENTS.media_sonarr.max-deliveries"
-	held := map[string]int{"EVENTS.media_sonarr": 1}
-	newest := map[string]time.Time{"EVENTS.media_sonarr": gaveUp}
-	advisory := link.Advisory{Kind: link.AdvisoryMaxDeliveries, ID: "EVENTS.media_sonarr", Stream: "EVENTS",
-		Consumer: "media_sonarr", Said: "sonarr on media handed message 7 over 5 times and gave up on it",
-		First: gaveUp, Last: gaveUp, Count: 1}
-	look := func() conditions.Condition {
-		t.Helper()
-		f := &signalFacts{now: now, host: "novox", advisories: []link.Advisory{advisory},
-			deadLetters: held, deadLettersNewest: newest}
-		if err := k.Reconcile(t.Context(), "S9", watchAdvisories(f)); err != nil {
-			t.Fatal(err)
-		}
-		c, found, err := conditions.ReadOne(t.Context(), store, key)
-		if err != nil || !found {
-			t.Fatalf("%s: found %v, %v", key, found, err)
-		}
-		if !strings.Contains(c.Summary, "dead-letters verb") {
-			t.Fatalf("the summary is not the dead-letter row's: %q", c.Summary)
-		}
-		return c
-	}
-
-	var c conditions.Condition
-	for range 5 {
-		c = look()
-		now = now.Add(30 * time.Second)
-	}
-	if c.Observations != 1 || len(c.Evidence) != 1 || !c.LastObserved.Equal(gaveUp) {
-		t.Fatalf("one message given up on, looked at five times, reads as observed %d time(s), last %s, "+
-			"with %d evidence lines: %+v", c.Observations, c.LastObserved, len(c.Evidence), c.Evidence)
-	}
-
-	// The consumer gives up on a second message between two looks: two given up on, one more line.
-	again := now.Add(-10 * time.Second)
-	held["EVENTS.media_sonarr"], newest["EVENTS.media_sonarr"] = 2, again
-	c = look()
-	if c.Observations != 2 || len(c.Evidence) != 2 || !c.LastObserved.Equal(again) {
-		t.Fatalf("two given up on read as observed %d time(s), last %s, evidence %+v", c.Observations,
-			c.LastObserved, c.Evidence)
-	}
-	now = now.Add(30 * time.Second)
-	if c = look(); c.Observations != 2 || len(c.Evidence) != 2 {
-		t.Fatalf("a look with nothing new counted: observed %d time(s), evidence %+v", c.Observations, c.Evidence)
-	}
-}
-
-// The advisory still says the max-deliveries it alone knows: a message given up on that could not be
-// kept, under a key of its own (issue 330), which issue 440's change leaves as it was.
-func TestAMessageThatCouldNotBeKeptIsStillSaidFromTheAdvisory(t *testing.T) {
-	at := time.Date(2026, 10, 10, 21, 4, 0, 0, time.UTC)
-	f := &signalFacts{now: at, host: "novox", advisories: []link.Advisory{{Kind: link.AdvisoryMaxDeliveries,
-		ID: "EVENTS.media_sonarr", Stream: "EVENTS", Consumer: "media_sonarr", Token: link.AdvisoryNotKept,
-		Said: "sonarr on media gave up on message 7, and it could not be kept", First: at, Last: at, Count: 1}}}
-	said := watchAdvisories(f)
-	if len(said) != 1 || said[0].Key() != "bus.EVENTS.media_sonarr.not-kept" {
-		t.Fatalf("%+v", said)
-	}
-}
-
-// A max-deliveries advisory without a token names a consumer's dead-letter key, which only DEAD_LETTERS
-// says (novox/hq issues 330 and 440): with nothing held, the advisory alone raises nothing.
-func TestAMaxDeliveriesAdvisoryAloneRaisesNothing(t *testing.T) {
-	at := time.Date(2026, 10, 10, 21, 4, 0, 0, time.UTC)
-	f := &signalFacts{now: at, host: "novox", advisories: []link.Advisory{{Kind: link.AdvisoryMaxDeliveries,
-		ID: "EVENTS.media_sonarr", Stream: "EVENTS", Consumer: "media_sonarr",
-		Said: "sonarr on media handed message 7 over 5 times and gave up on it", First: at, Last: at, Count: 1}}}
-	if said := watchAdvisories(f); len(said) != 0 {
-		t.Fatalf("said %+v", said)
-	}
-}

cmd/mesh-controller/agent_account.go

@@ -1,253 +0,0 @@
-package main
-
-// The account agents run as (novox/hq ADR 0266).
-//
-// On the control node every agent session ran as the operator's account, which may become root without a
-// password — so any agent there could become root without a person, and ADR 0259 §8 (an answer from the
-// operator's phone authorises an act) rests on that being false where the router and its channels run. The
-// decision: a node may name an account its agents run as, of their own and without sudo; the operator's
-// account keeps its sudo.
-//
-//   - **Named at the controller's terminal only** (`node agent-account`): not a verb, not a setting, so no
-//     agent can name itself another account. Empty is a real state: agents run as the operator there.
-//   - **Composed** as `${machine:agent-account}`, `${machine:agent-home}` and `${machine:agent-root}` for the
-//     agent's module, which declares the account with `root: never`, and as MESH_AGENT_ACCOUNT and
-//     MESH_AGENT_HOME for its tools (catalogue/machine_into_files.go, runtime.go).
-//   - **Judged by the machine itself.** The node-engine reads, on every look, whether an account declared
-//     `root: never` can become root without a person — uid 0, a group that grants root, a sudo rule, a
-//     secret of the mesh it may read — and says it as the declaring module's account verdict, marked
-//     Root "never". agentConfined reads that verdict; the self-check (probe DA) raises
-//     `agent-can-become-root` while it does not hold, and `node show` says it.
-//
-// A verdict not given is never a pass: an engine older than the judging, an account not yet declared, a
-// statement that says nothing of it — each is "not judged", and fails.
-
-import (
-	"context"
-	"fmt"
-	"sort"
-	"strings"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/conditions"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// kindAgentCanBecomeRoot is the condition raised while a machine's agent account can become root without
-// a person, or is not judged (ADR 0266).
-const kindAgentCanBecomeRoot = "agent-can-become-root"
-
-// agentAccountProbe is the self-check's probe of it.
-const agentAccountProbe = "DA"
-
-// agentConfined says whether the agents of a machine that names an agent account are confined: the
-// machine's newest statement holds a healthy account verdict, judged for root, on that account. named is
-// false for a machine that names none — agents run as the operator account there, which this does not
-// judge. why is said either way, in the mesh's words; err is a store that could not be read.
-//
-// The one judgement: `node show`, the self-check, and ADR 0259's router honouring a verified sender read
-// it here.
-// now is the judging clock, threaded so a caller judging several things at one instant judges them all at it.
-func agentConfined(ctx context.Context, inv *inventory.Inventory, node string, now time.Time) (named, confined bool, why string, err error) {
-	n, err := inv.NodeByName(ctx, node)
-	if err != nil {
-		return false, false, "", err
-	}
-	if n.AgentAccount == "" {
-		return false, false, fmt.Sprintf("%s names no agent account: agents run as the operator account (%s)",
-			node, orNoneKnown(n.Account)), nil
-	}
-	h, had, err := inv.HealthOf(ctx, node)
-	if err != nil {
-		return true, false, "", err
-	}
-	confined, why = judgedConfined(n.AgentAccount, h, had, now)
-	return true, confined, why, nil
-}
-
-// verdictFreshFor is how old the statement holding the verdict may be, by this controller's clock. A
-// node-engine states its health on every change and at least every five minutes (mesh-host's sayAnyway), so
-// three statements missed is a node-engine stopped, or a machine away. **A stale verdict is not a pass**: an
-// agent that stopped the node-engine must not leave "cannot become root" standing from before.
-const verdictFreshFor = 15 * time.Minute
-
-// judgedConfined is the judgement over one statement, without the store, at now.
-func judgedConfined(agent string, h inventory.NodeHealth, had bool, now time.Time) (bool, string) {
-	if !had {
-		return false, fmt.Sprintf("the agent account %s is not judged: the machine's node-engine has stated "+
-			"nothing of what it runs", agent)
-	}
-	if age := now.Sub(h.HeardAt); age > verdictFreshFor {
-		return false, fmt.Sprintf("the agent account %s is not judged: the machine's newest statement was heard at "+
-			"%s, more than %d minutes ago, and a verdict that old is not a verdict on now", agent,
-			h.HeardAt.Local().Format("2006-01-02 15:04"), int(verdictFreshFor.Minutes()))
-	}
-	if h.Contract < link.RootContract {
-		return false, fmt.Sprintf("the agent account %s is not judged: the machine's node-engine is older than "+
-			"the judging of an account's root (its statement's contract is %d, the judging is %d)",
-			agent, h.Contract, link.RootContract)
-	}
-	var verdicts []inventory.ResourceHealth
-	for _, r := range h.Resources {
-		if r.Kind == link.KindAccount && r.Target == agent && r.Root == link.RootNever {
-			verdicts = append(verdicts, r)
-		}
-	}
-	if len(verdicts) == 0 {
-		return false, fmt.Sprintf("the agent account %s is not judged: the machine's newest statement holds no "+
-			"verdict on it — no module there declares it never to become root, or the declaration naming it "+
-			"has not been applied", agent)
-	}
-	sort.Slice(verdicts, func(i, j int) bool {
-		return verdicts[i].Module+verdicts[i].Resource < verdicts[j].Module+verdicts[j].Resource
-	})
-	for _, v := range verdicts {
-		switch v.State {
-		case link.StateHealthy:
-		case link.StateUnhealthy:
-			// The engine's own words, which start with link.ReasonRoot when it found a way to root.
-			return false, fmt.Sprintf("the agent account %s %s (said by %s's %s)", agent,
-				orNoneKnown(v.Reason), v.Module, v.Resource)
-		default:
-			return false, fmt.Sprintf("the agent account %s is not judged: %s (%s's %s, %s)", agent,
-				orNoneKnown(v.Reason), v.Module, v.Resource, v.State)
-		}
-	}
-	return true, fmt.Sprintf("the agent account %s cannot become root without a person (judged %s)", agent,
-		h.SaidAt.Local().Format("2006-01-02 15:04"))
-}
-
-// searchQuietFor is how long the controller lets an agent account's verdict wait for the node-engine's setuid
-// search before that is itself the urgent condition: the longest a search is expected to take (link.RootSearchQuiet,
-// the engine's own value; novox/hq issue 361 — the search runs to completion, with no bound of its own), counted
-// from when this controller first saw it waiting, never from the engine's start. Quiet raises nothing; it never
-// makes the agent account confined, which only a healthy verdict from a complete, fresh search does.
-const searchQuietFor = link.RootSearchQuiet
-
-// The kinds of an agent account's verdict, for the quiet a search earns.
-const (
-	verdictOther    = iota // anything else: a stale statement, an older engine, no verdict, another unknown
-	verdictPending         // waiting for the search, and otherwise healthy
-	verdictComplete        // judged: healthy, or a way to root found
-)
-
-// rootVerdictKind reads a statement for the agent account (novox/hq ADR 0266): pending when every verdict on it
-// is healthy or not judged yet because the engine's setuid search runs, at least one of them that; complete when
-// every verdict is healthy or one found a way to root. The engine's own "since" is not read: it starts again at
-// every restart of the engine.
-func rootVerdictKind(agent string, h inventory.NodeHealth, had bool, now time.Time) int {
-	if !had || now.Sub(h.HeardAt) > verdictFreshFor || h.Contract < link.RootContract {
-		return verdictOther
-	}
-	pending, any := false, false
-	for _, r := range h.Resources {
-		if r.Kind != link.KindAccount || r.Target != agent || r.Root != link.RootNever {
-			continue
-		}
-		any = true
-		switch {
-		case r.State == link.StateHealthy:
-		case r.State == link.StateUnhealthy:
-			return verdictComplete
-		case r.State == link.StateUnknown && strings.HasPrefix(r.Reason, link.ReasonRootPending):
-			pending = true
-		default:
-			return verdictOther
-		}
-	}
-	switch {
-	case !any:
-		return verdictOther
-	case pending:
-		return verdictPending
-	}
-	return verdictComplete
-}
-
-// searchStillRunning says the one thing keeping an agent account from being judged is the node-engine's setuid
-// search, and that this controller first saw it waiting less than searchQuietFor ago — kept in the store, so a
-// node-engine restarted in a loop does not keep it quiet. A complete verdict forgets when it began.
-func searchStillRunning(ctx context.Context, inv *inventory.Inventory, node, agent string, h inventory.NodeHealth,
-	had bool, now time.Time) (bool, error) {
-	switch rootVerdictKind(agent, h, had, now) {
-	case verdictComplete:
-		return false, inv.RootSearchJudged(ctx, node)
-	case verdictPending:
-		since, err := inv.RootSearchPending(ctx, node, now)
-		if err != nil {
-			return false, err
-		}
-		return now.Sub(since) <= searchQuietFor, nil
-	}
-	return false, nil
-}
-
-// probeAgentAccounts is DA: every machine that names an agent account has it judged, on its node-engine's
-// newest statement, unable to become root without a person (ADR 0266).
-func probeAgentAccounts(ctx context.Context, d *doctor) ([]conditions.Observation, error) {
-	inv := d.open.inventory
-	nodes, err := inv.Nodes(ctx)
-	if err != nil {
-		return nil, err
-	}
-	var out []conditions.Observation
-	for _, n := range nodes {
-		if n.AgentAccount == "" {
-			continue
-		}
-		h, had, err := inv.HealthOf(ctx, n.Name)
-		if err != nil {
-			return nil, err
-		}
-		now := time.Now()
-		quiet, err := searchStillRunning(ctx, inv, n.Name, n.AgentAccount, h, had, now)
-		if err != nil {
-			return nil, err
-		}
-		confined, why := judgedConfined(n.AgentAccount, h, had, now)
-		if confined {
-			continue
-		}
-		// Not judged yet only because the node-engine's search runs and no complete, fresh one judges: not the
-		// urgent condition after every restart. The agent is still not confined — ADR 0259's router reads
-		// agentConfined, not this — and `node show` still says not judged. Loud again once the search fails,
-		// waits past searchQuietFor, or the statement goes stale.
-		if quiet {
-			continue
-		}
-		out = append(out, conditions.Observation{Scope: conditions.ScopeMachine, ID: n.Name, Token: "agent-root",
-			Machine: n.Name, Severity: conditions.Urgent,
-			Summary: fmt.Sprintf("on %s, %s (ADR 0266): an agent there may become root without a person, and "+
-				"no answer from a channel authorises an act there (ADR 0259 §8)", n.Name, why),
-			Said: why})
-	}
-	return sortedFound(out), nil
-}
-
-// agentAccountLines is what `node show` says of the account agents run as.
-func agentAccountLines(ctx context.Context, inv *inventory.Inventory, n inventory.Node) []string {
-	if n.AgentAccount == "" {
-		return []string{fmt.Sprintf("  agents run as      the operator account (%s); no agent account is named",
-			orNoneKnown(n.Account))}
-	}
-	_, confined, why, err := agentConfined(ctx, inv, n.Name, time.Now())
-	if err != nil {
-		return []string{fmt.Sprintf("  agents run as      %s (home %s); whether it can become root could NOT be read: %v",
-			n.AgentAccount, n.AgentHome(), err)}
-	}
-	verdict := "CAN become root, or is not judged: " + why
-	if confined {
-		verdict = why
-	}
-	return []string{fmt.Sprintf("  agents run as      %s (home %s)", n.AgentAccount, n.AgentHome()),
-		"                     " + verdict}
-}
-
-// orNoneKnown is a value, or that none is known.
-func orNoneKnown(s string) string {
-	if strings.TrimSpace(s) == "" {
-		return "none known"
-	}
-	return s
-}

cmd/mesh-controller/agent_account_integration_test.go

@@ -1,161 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"strings"
-	"testing"
-	"time"
-
-	snapshot "git.novox.be/novox/mesh-sdk/go/facts"
-	"github.com/novox/mesh-controller/internal/conditions"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-	"github.com/novox/mesh-host/rootsearch"
-)
-
-func TestTheSelfCheckSaysAnAgentAccountThatCanBecomeRoot(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	inv := open.inventory
-	for _, n := range []string{"anchor", "laptop"} {
-		if _, err := inv.NodeByName(ctx, n); err != nil {
-			if _, err := inv.AddNode(ctx, n); err != nil {
-				t.Fatal(err)
-			}
-		}
-		if err := inv.SetAccount(ctx, n, "ops", ""); err != nil {
-			t.Fatal(err)
-		}
-	}
-	if err := inv.SetAgentAccount(ctx, "anchor", "agent", ""); err != nil {
-		t.Fatal(err)
-	}
-	d := &doctor{open: open}
-	found, err := probeAgentAccounts(ctx, d)
-	if err != nil {
-		t.Fatal(err)
-	}
-	found = onlyMachine(found, "anchor")
-	if len(found) != 1 || found[0].Machine != "anchor" || found[0].Severity != conditions.Urgent ||
-		!strings.Contains(found[0].Said, "not judged") {
-		t.Fatalf("a named agent account with no verdict: %+v", found)
-	}
-	w := plainWordings[kindAgentCanBecomeRoot](conditions.Observation{Kind: kindAgentCanBecomeRoot, Machine: "anchor"})
-	if w.Headline == "" || w.Needs == "" || w.Resolved == "" {
-		t.Errorf("the condition has no plain words: %+v", w)
-	}
-
-	healthy := inventory.ResourceHealth{Module: "claude-code", Resource: "claude-code.agent-account",
-		Kind: link.KindAccount, Target: "agent", State: link.StateHealthy, Root: link.RootNever, Account: "agent"}
-	if _, err := inv.RecordHealth(ctx, inventory.NodeHealth{Node: "anchor", Contract: link.RootContract,
-		SaidAt: time.Now(), HeardAt: time.Now(), Resources: []inventory.ResourceHealth{healthy}}); err != nil {
-		t.Fatal(err)
-	}
-	if found, err = probeAgentAccounts(ctx, d); err != nil || len(onlyMachine(found, "anchor")) != 0 {
-		t.Fatalf("a judged agent account still fails: %+v %v", found, err)
-	}
-	if named, confined, why, err := agentConfined(ctx, inv, "anchor", time.Now()); err != nil || !named || !confined {
-		t.Fatalf("agentConfined on anchor: %v %v %q %v", named, confined, why, err)
-	}
-	if named, _, why, err := agentConfined(ctx, inv, "laptop", time.Now()); err != nil || named ||
-		!strings.Contains(why, "operator account") {
-		t.Fatalf("agentConfined on a machine naming none: %v %q %v", named, why, err)
-	}
-}
-
-func TestTheFactsCarryTheAgentAccountAsAPseudonym(t *testing.T) {
-	open, _ := aMeshWithSecrets(t)
-	ctx := t.Context()
-	if err := open.inventory.SetAccount(ctx, "anchor", "keeper", ""); err != nil {
-		t.Fatal(err)
-	}
-	if err := open.inventory.SetAgentAccount(ctx, "anchor", "warden", ""); err != nil {
-		t.Fatal(err)
-	}
-	f, err := gatherFacts(ctx, open, "2.11.17")
-	if err != nil {
-		t.Fatal(err)
-	}
-	body, _ := f.Encode()
-	if strings.Contains(string(body), "warden") {
-		t.Error("the agent account's name is in the snapshot")
-	}
-	m, ok := f.Machine(snapshot.Pseudonym("machine", "anchor"))
-	if !ok || m.AgentAccount != snapshot.Pseudonym("account", "warden") || m.Account == m.AgentAccount {
-		t.Fatalf("the anchor's agent account reads as %q (operator %q)", m.AgentAccount, m.Account)
-	}
-}
-
-func TestASearchStillRunningAfterARestartIsNotUrgent(t *testing.T) {
-	if searchQuietFor != rootsearch.Quiet {
-		t.Fatalf("the quiet is %s and the node-engine's %s: they are one value", searchQuietFor, rootsearch.Quiet)
-	}
-	// A daily search that finishes within the quiet never leaves the account unjudged between two of them.
-	if rootsearch.FreshFor < rootsearch.Every+rootsearch.Quiet {
-		t.Fatalf("a complete search judges for %s, less than a day's search (%s) and the quiet (%s)",
-			rootsearch.FreshFor, rootsearch.Every, rootsearch.Quiet)
-	}
-	open := aMesh(t)
-	ctx := t.Context()
-	inv := open.inventory
-	if _, err := inv.NodeByName(ctx, "anchor"); err != nil {
-		if _, err := inv.AddNode(ctx, "anchor"); err != nil {
-			t.Fatal(err)
-		}
-	}
-	if err := inv.SetAgentAccount(ctx, "anchor", "agent", ""); err != nil {
-		t.Fatal(err)
-	}
-	d := &doctor{open: open}
-	say := func(state, reason string) []conditions.Observation {
-		t.Helper()
-		// The engine's since is always now: it was just restarted.
-		v := inventory.ResourceHealth{Module: "claude-code", Resource: "claude-code.agent-account",
-			Kind: link.KindAccount, Target: "agent", State: state, Reason: reason, Root: link.RootNever,
-			Account: "agent", Since: time.Now()}
-		if _, err := inv.RecordHealth(ctx, inventory.NodeHealth{Node: "anchor", Contract: link.RootContract,
-			SaidAt: time.Now(), HeardAt: time.Now(), Resources: []inventory.ResourceHealth{v}}); err != nil {
-			t.Fatal(err)
-		}
-		found, err := probeAgentAccounts(ctx, d)
-		if err != nil {
-			t.Fatal(err)
-		}
-		return onlyMachine(found, "anchor")
-	}
-	running := link.ReasonRootPending + ": the search for setuid programs, started at 19:21, has not finished yet"
-	healthy := func() {
-		t.Helper()
-		if found := say(link.StateHealthy, ""); len(found) != 0 {
-			t.Fatalf("a healthy verdict raised: %+v", found)
-		}
-	}
-	if found := say(link.StateUnknown, running); len(found) != 0 {
-		t.Fatalf("a search first seen now was raised: %+v", found)
-	}
-	if _, confined, why, _ := agentConfined(ctx, inv, "anchor", time.Now()); confined || !strings.Contains(why, "not judged") {
-		t.Fatalf("an account whose search runs was read as confined: %q", why)
-	}
-	// The engine restarted again and again, each statement's own since fresh: the controller's clock runs on.
-	if _, err := inv.RootSearchPending(ctx, "anchor", time.Now().Add(-searchQuietFor-time.Minute)); err != nil {
-		t.Fatal(err)
-	}
-	healthy() // a complete verdict forgets when the waiting began …
-	if _, err := inv.RootSearchPending(ctx, "anchor", time.Now().Add(-searchQuietFor-time.Minute)); err != nil {
-		t.Fatal(err) // … and this restart loop began past the bound
-	}
-	if found := say(link.StateUnknown, running); len(found) != 1 || found[0].Severity != conditions.Urgent {
-		t.Fatalf("a search pending past the bound, by the controller's clock, was not urgent: %+v", found)
-	}
-	healthy()
-	incomplete := rootsearch.ReasonIncomplete + ": the search for setuid programs did not finish (last tried at " +
-		"19:23: timeout); it is tried again later"
-	if found := say(link.StateUnknown, incomplete); len(found) != 1 || found[0].Severity != conditions.Urgent {
-		t.Fatalf("a search that did not finish was not urgent: %+v", found)
-	}
-	if found := say(link.StateUnhealthy, link.ReasonRoot+": in the group docker; "+running); len(found) != 1 ||
-		found[0].Severity != conditions.Urgent {
-		t.Fatalf("a way to root found while the search runs was not urgent: %+v", found)
-	}
-}

cmd/mesh-controller/agent_account_test.go

@@ -1,134 +0,0 @@
-package main
-
-import (
-	"strings"
-	"testing"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"github.com/novox/mesh-controller/internal/conditions"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// The agent account's judgement (novox/hq ADR 0266): confined only on a healthy account verdict judged for
-// root, on the very account; every verdict not given — no statement, an older engine, no verdict on it, a
-// verdict of unknown — is "not judged" and fails, never a pass.
-func TestAnAgentAccountIsConfinedOnlyOnAHealthyVerdictJudgedForRoot(t *testing.T) {
-	at := time.Date(2026, 10, 8, 19, 21, 0, 0, time.UTC)
-	verdict := func(target, root, state, reason string) inventory.ResourceHealth {
-		return inventory.ResourceHealth{Module: "claude-code", Resource: "claude-code.agent-account",
-			Kind: link.KindAccount, Target: target, State: state, Reason: reason, Root: root, Account: target}
-	}
-	statement := func(contract int, rs ...inventory.ResourceHealth) inventory.NodeHealth {
-		return inventory.NodeHealth{Node: "anchor", Contract: contract, SaidAt: at, HeardAt: at, Resources: rs}
-	}
-	for _, c := range []struct {
-		name     string
-		h        inventory.NodeHealth
-		had      bool
-		confined bool
-		says     string
-	}{
-		{"judged and unable", statement(link.RootContract, verdict("agent", link.RootNever, link.StateHealthy, "")),
-			true, true, "cannot become root without a person"},
-		{"judged and able", statement(link.RootContract, verdict("agent", link.RootNever, link.StateUnhealthy,
-			link.ReasonRoot+": in the group docker, which grants root")), true, false, "in the group docker"},
-		{"a verdict of unknown", statement(link.RootContract, verdict("agent", link.RootNever, link.StateUnknown,
-			"sudo could not be read")), true, false, "not judged"},
-		{"no statement", inventory.NodeHealth{}, false, false, "not judged"},
-		{"an older engine", statement(link.ReadinessContract, verdict("agent", "", link.StateHealthy, "")),
-			true, false, "older than the judging"},
-		{"a verdict on groups only", statement(link.RootContract, verdict("agent", "", link.StateHealthy, "")),
-			true, false, "no verdict on it"},
-		{"a verdict on another account", statement(link.RootContract, verdict("ops", link.RootNever, link.StateHealthy, "")),
-			true, false, "no verdict on it"},
-	} {
-		confined, why := judgedConfined("agent", c.h, c.had, at.Add(time.Minute))
-		if confined != c.confined || !strings.Contains(why, c.says) {
-			t.Errorf("%s: confined %v, %q; want %v saying %q", c.name, confined, why, c.confined, c.says)
-		}
-	}
-	// A verdict heard longer ago than the bound is no verdict: an agent that stopped the node-engine must not
-	// leave "healthy" standing.
-	fresh := statement(link.RootContract, verdict("agent", link.RootNever, link.StateHealthy, ""))
-	if ok, _ := judgedConfined("agent", fresh, true, at.Add(verdictFreshFor)); !ok {
-		t.Error("a verdict exactly at the bound is still one")
-	}
-	if ok, why := judgedConfined("agent", fresh, true, at.Add(verdictFreshFor+time.Second)); ok ||
-		!strings.Contains(why, "not judged") {
-		t.Errorf("a stale healthy verdict passed: %q", why)
-	}
-}
-
-// DA raises an urgent condition, with plain words, on a machine whose agent account is not judged unable to
-// become root; a machine that names none is not its to judge.
-
-func TestTheAgentRootWordsArePlain(t *testing.T) {
-	w := plainWordings[kindAgentCanBecomeRoot](conditions.Observation{Kind: kindAgentCanBecomeRoot, Machine: "anchor"})
-	if why, ok := conditions.PlainWords(w, "anchor"); !ok {
-		t.Fatalf("not plain: %s: %+v", why, w)
-	}
-}
-
-func onlyMachine(obs []conditions.Observation, machine string) []conditions.Observation {
-	var out []conditions.Observation
-	for _, o := range obs {
-		if o.Machine == machine {
-			out = append(out, o)
-		}
-	}
-	return out
-}
-
-// The snapshot a merge check composes from carries the agent account as a pseudonym (novox/hq ADR 0266),
-// so a change is judged against machines that name one, and the name never leaves.
-
-// No verb runs a `node` command that sets something: through the generic `command` verb, `node account`,
-// `node agent-account` and every other `node` subcommand but list and show are refused, naming the terminal.
-func TestNoVerbSetsANodesAccounts(t *testing.T) {
-	for _, line := range []string{
-		"node agent-account novox --clear",
-		"node agent-account novox ops",
-		"node account novox agent",
-		"node account novox",
-		"node add intruder",
-		"node public-domain novox --clear",
-		"node",
-		"node frobnicate",
-	} {
-		argv, err := argvFor("command", map[string]any{"command": line})
-		if err == nil || !strings.Contains(err.Error(), "controller's terminal") ||
-			!strings.Contains(err.Error(), "ADR 0266") {
-			t.Errorf("%q ran as %v (%v); want a refusal naming the terminal", line, argv, err)
-		}
-	}
-	for _, line := range []string{"node show novox", "node list --json", "status --json"} {
-		if _, err := argvFor("command", map[string]any{"command": line}); err != nil {
-			t.Errorf("%q, a read, was refused: %v", line, err)
-		}
-	}
-	if err := terminalOnly([]string{"node", "account", "a", "b"}); err == nil {
-		t.Error("the refusal is not only the command verb's")
-	}
-}
-
-// Naming the agent account is the controller's terminal's alone: the `node` verb only shows.
-func TestTheNodeVerbOnlyShows(t *testing.T) {
-	argv, err := argvFor("node", map[string]any{"node": "anchor"})
-	if err != nil || strings.Join(argv, " ") != "node show anchor" {
-		t.Fatalf("the node verb runs %v (%v)", argv, err)
-	}
-	for _, v := range catalogue.ControllerVerbs {
-		if strings.Contains(v.Name, "agent") {
-			t.Errorf("a verb %q may name the agent account", v.Name)
-		}
-	}
-}
-
-// Until a complete search for setuid programs judges — none since the node-engine's state was kept, or the last
-// older than the engine lets one judge — the agent account is not judged, and the search runs to its end with no
-// bound (novox/hq issue 361). DA does not raise that as urgent within searchQuietFor, counted from when this
-// controller first saw it waiting — never from the engine's own "since", which a restart resets, so an engine
-// restarted in a loop does not keep it quiet. The account is still not confined, and `node show` still says not
-// judged; a search that failed, or a way to root found, is urgent at once.

cmd/mesh-controller/api.go

@@ -1,186 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"flag"
-	"fmt"
-	"net/http"
-	"strings"
-	"time"
-)
-
-// The command API: what the mesh can be asked to do, over a network.
-//
-// **An adapter and nothing else** (novox/hq ADR 0035). Every route here calls the same function
-// the command line calls, so a refusal is the same refusal in the same words. Nothing is decided
-// in this file — the moment it validates something the command line does not, the mesh has two
-// answers to one question.
-//
-// **It refuses everything unless it was told how to know who is asking.** The board is published
-// on a public name, and this is what stands behind it: an unauthenticated command surface reachable
-// from the internet is authority over the mesh handed to whoever finds it. So there is no
-// permissive default and no flag that removes the check — a mesh that has not been told how to
-// authenticate serves nothing, loudly.
-//
-// The intended authenticator is an OAuth2 provider (ADR 0035), which is an ordinary module. Until
-// one is configured this refuses, which is the correct behaviour rather than a placeholder: a
-// surface that worked without authentication would be one somebody left running.
-func apiCommand(ctx context.Context, args []string) error {
-	set := flag.NewFlagSet("api", flag.ContinueOnError)
-	listen := set.String("listen", "127.0.0.1:8081", "where to serve it")
-	issuer := set.String("issuer", "",
-		"the OAuth2 issuer whose tokens this accepts; without it, nothing is served")
-	if _, err := parseAround(set, args); err != nil {
-		return err
-	}
-	if strings.TrimSpace(*issuer) == "" {
-		// Refused at start rather than per request, so it is discovered by whoever ran it rather
-		// than by whoever finds it.
-		return errors.New(
-			"--issuer is not set, and this serves commands rather than pages: it will not run " +
-				"without being told whose tokens to believe. An OAuth2 provider is an ordinary " +
-				"module (novox/hq ADR 0035)")
-	}
-
-	server := &http.Server{
-		Addr:              *listen,
-		ReadHeaderTimeout: 10 * time.Second,
-		Handler:           commands(mustAuthenticate(*issuer)),
-	}
-	fmt.Printf("the command API is on http://%s\n", *listen)
-	fmt.Printf("  it accepts tokens from %s and refuses everything else\n", *issuer)
-	fmt.Printf("  every route calls what the command line calls\n")
-
-	go func() {
-		<-ctx.Done()
-		closing, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-		defer cancel()
-		_ = server.Shutdown(closing)
-	}()
-	if err := server.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
-		return err
-	}
-	return nil
-}
-
-// Authenticator says whether a request may act, and as whom.
-//
-// An interface so the check can be driven by a test without an identity provider, and so the one
-// real implementation is the only thing that has to be right.
-type Authenticator interface {
-	// Who returns the subject a request is acting as, or an error naming why it may not.
-	Who(r *http.Request) (string, error)
-}
-
-// mustAuthenticate is the real one: a bearer token from the configured issuer.
-//
-// **Not yet verifying the signature**, and it says so rather than pretending. Verification needs
-// the issuer's keys, which needs an identity provider to exist — so this refuses every request
-// until that is built, which is the same answer as having no API at all and is honest about why.
-func mustAuthenticate(issuer string) Authenticator { return notYet{issuer: issuer} }
-
-type notYet struct{ issuer string }
-
-func (n notYet) Who(*http.Request) (string, error) {
-	return "", fmt.Errorf(
-		"this mesh has no way to verify a token from %s yet: the identity provider is a module "+
-			"and none is running. Use the command line, which authenticates through nothing "+
-			"because it is already behind the machine's own login", n.issuer)
-}
-
-// commands is the routing, separate so a test can drive it without a listener.
-func commands(who Authenticator) http.Handler {
-	mux := http.NewServeMux()
-
-	mux.HandleFunc("POST /assign", acting(who, true, func(ctx context.Context, open *stores, in request) (string, error) {
-		return assign(ctx, open, in.Node, splitModules(in.Module)...)
-	}))
-	mux.HandleFunc("POST /unassign", acting(who, true, func(ctx context.Context, open *stores, in request) (string, error) {
-		return unassign(ctx, open, in.Node, splitModules(in.Module)...)
-	}))
-	// Adoption (novox/hq ADR 0100): the same acts as `take`, `converge` and `adopt`.
-	mux.HandleFunc("POST /take", acting(who, true, func(ctx context.Context, open *stores, in request) (string, error) {
-		return take(ctx, open, in.Node, in.Module, takeOptions{Yes: in.Yes, Digest: in.Digest})
-	}))
-	mux.HandleFunc("POST /converge", acting(who, false, func(ctx context.Context, open *stores, in request) (string, error) {
-		return converge(ctx, open, in.Node, in.Yes, in.Digest, in.Filter)
-	}))
-	mux.HandleFunc("POST /adopt", acting(who, false, func(ctx context.Context, open *stores, in request) (string, error) {
-		return adopt(ctx, open, in.Node)
-	}))
-
-	// Anything else is said plainly, because a command surface answering 404 to a verb somebody
-	// expected is indistinguishable from one that is down.
-	mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
-		refuse(w, http.StatusNotFound, fmt.Errorf(
-			"%s %s is not something this mesh can be asked; it accepts POST /assign, "+
-				"POST /unassign, POST /take, POST /converge and POST /adopt", r.Method, r.URL.Path))
-	})
-	return mux
-}
-
-type request struct {
-	Node   string `json:"node"`
-	Module string `json:"module"`
-	// Yes, Digest and Filter are converge's and take's: do it rather than preview it, the digest
-	// of the preview it acts on, and (converge) which module loads the mesh's filter.
-	Yes    bool   `json:"yes,omitempty"`
-	Digest string `json:"digest,omitempty"`
-	Filter string `json:"filter,omitempty"`
-}
-
-// acting is the shape every route shares: authenticate, read, act, answer.
-func acting(
-	who Authenticator,
-	needsModule bool,
-	do func(context.Context, *stores, request) (string, error),
-) http.HandlerFunc {
-	return func(w http.ResponseWriter, r *http.Request) {
-		if _, err := who.Who(r); err != nil {
-			refuse(w, http.StatusUnauthorized, err)
-			return
-		}
-		var in request
-		if err := json.NewDecoder(r.Body).Decode(&in); err != nil {
-			refuse(w, http.StatusBadRequest, fmt.Errorf("this is not a request this understands: %w", err))
-			return
-		}
-		if in.Node == "" || (needsModule && in.Module == "") {
-			if needsModule {
-				refuse(w, http.StatusBadRequest, errors.New(`both "node" and "module" are needed`))
-			} else {
-				refuse(w, http.StatusBadRequest, errors.New(`"node" is needed`))
-			}
-			return
-		}
-
-		open, err := openStores(r.Context())
-		if err != nil {
-			refuse(w, http.StatusServiceUnavailable, err)
-			return
-		}
-		defer open.Close()
-
-		said, err := do(r.Context(), open, in)
-		if err != nil {
-			// **The refusal the command line would have given, unchanged.** Carrying `said` with
-			// it matters: an assignment that was kept and still does not resolve is two facts,
-			// and dropping either makes the answer wrong.
-			answer(w, http.StatusConflict, map[string]any{"said": said, "refused": err.Error()})
-			return
-		}
-		answer(w, http.StatusOK, map[string]any{"said": said})
-	}
-}
-
-func answer(w http.ResponseWriter, status int, body map[string]any) {
-	w.Header().Set("Content-Type", "application/json")
-	w.WriteHeader(status)
-	_ = json.NewEncoder(w).Encode(body)
-}
-
-func refuse(w http.ResponseWriter, status int, err error) {
-	answer(w, status, map[string]any{"refused": err.Error()})
-}

cmd/mesh-controller/api_test.go

@@ -1,79 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-)
-
-type letIn struct{}
-
-func (letIn) Who(*http.Request) (string, error) { return "somebody", nil }
-
-func asking(t *testing.T, who Authenticator, method, path, body string) *httptest.ResponseRecorder {
-	t.Helper()
-	recorded := httptest.NewRecorder()
-	commands(who).ServeHTTP(recorded, httptest.NewRequest(method, path, strings.NewReader(body)))
-	return recorded
-}
-
-// **Nothing is served to somebody the mesh cannot identify**, and that is the default rather than
-// a setting. The board this stands behind is published on a public name (novox/hq 11-a-board), so
-// an unauthenticated command surface is authority over the mesh handed to whoever finds it.
-func TestAnUnauthenticatedRequestIsRefused(t *testing.T) {
-	got := asking(t, mustAuthenticate("https://identity.example/realms/mesh"),
-		"POST", "/assign", `{"node":"anchor","module":"umami"}`)
-	if got.Code != http.StatusUnauthorized {
-		t.Fatalf("an unidentified caller got %d", got.Code)
-	}
-	// And it says what to do instead, because the answer is not "give up".
-	if !strings.Contains(got.Body.String(), "command line") {
-		t.Errorf("the refusal does not say what still works: %s", got.Body.String())
-	}
-}
-
-// The API refuses to start at all without being told whose tokens to believe.
-//
-// At start rather than per request, so it is found by whoever ran it rather than by whoever
-// finds it.
-func TestTheApiWillNotRunWithoutAnIssuer(t *testing.T) {
-	err := apiCommand(context.Background(), []string{})
-	if err == nil {
-		t.Fatal("it served commands without being told who may give them")
-	}
-	if !strings.Contains(err.Error(), "issuer") {
-		t.Errorf("the refusal does not name what is missing: %v", err)
-	}
-}
-
-// A request missing what it acts on is refused before anything is opened.
-func TestARequestThatNamesNothingIsRefused(t *testing.T) {
-	// **The exact refusal, not merely "not accepted".** Asserting non-200 passes even when the
-	// request got as far as opening a store and failing there, which proves nothing about whether
-	// anything was checked — that is what the first version of this test did.
-	for _, body := range []string{`{}`, `{"node":"anchor"}`, `{"module":"umami"}`, `not json`} {
-		got := asking(t, letIn{}, "POST", "/assign", body)
-		if got.Code != http.StatusBadRequest {
-			t.Errorf("%s got %d, and a request naming nothing is a bad request", body, got.Code)
-		}
-	}
-}
-
-// A verb nobody implemented is said plainly. A command surface answering 404 to something
-// somebody expected is indistinguishable from one that is down.
-func TestAnUnknownRouteSaysWhatIsAccepted(t *testing.T) {
-	got := asking(t, letIn{}, "POST", "/rotate", `{}`)
-	if got.Code != http.StatusNotFound {
-		t.Fatalf("got %d", got.Code)
-	}
-	var said map[string]any
-	_ = json.Unmarshal(got.Body.Bytes(), &said)
-	if !strings.Contains(said["refused"].(string), "/assign") {
-		t.Errorf("it does not say what it does accept: %v", said)
-	}
-}

cmd/mesh-controller/apply_failing.go

@@ -1,164 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"sort"
-	"strings"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/conditions"
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// kindApplyFailing is S21's kind: a machine whose declarations have been refused, or applied only in part,
-// for longer than one apply interval (novox/hq issue 233).
-const kindApplyFailing = "apply-failing"
-
-// applyEvery is how often a node-engine applies what it was last told when nothing new arrives: its
-// ReconcileEvery. A failure still there after one more of them is not one the next apply clears.
-const applyEvery = 5 * time.Minute
-
-// packageManagerKey is how a node-engine names a package manager that does not answer among what failed
-// (mesh-host's probe.go): "the package manager (pacman)".
-const packageManagerKey = "the package manager ("
-
-// watchApplyFailing is S21: **a machine that does not apply what it was sent is said by the mesh, not only
-// to someone who asks for `status`** (novox/hq issue 233, issue 187's family). A workstation refused every
-// declaration for an hour and a half because its package manager did not answer, and the mesh's only word
-// on it was a line in `status`. Raised once the machine's first report of this failure is older than one apply
-// interval **while the machine is heard** — judged by time, not by how many reports said it: a node-engine
-// says a re-apply only when how it went changed, so the same failure is one report however long it lasts.
-// Names the refusal's or the failure's words; cleared by the clean apply the node-engine then says. Not while
-// the machine is silent, asleep or not known: S1 says silent, and asleep is not lost.
-func watchApplyFailing(f *signalFacts) []conditions.Observation {
-	heard := map[string]bool{}
-	for _, m := range f.machines {
-		if !m.asleep() && !m.lastHeard.IsZero() && !m.silent(f.now) {
-			heard[m.name] = true
-		}
-	}
-	var out []conditions.Observation
-	said := map[string]bool{}
-	for _, d := range f.doing {
-		if !d.Wrong() || d.Since == nil || f.now.Sub(*d.Since) <= applyEvery || !heard[d.Node] {
-			continue
-		}
-		out = append(out, applyFailing(d, f.now))
-		said[d.Node] = true
-	}
-	// **A module's files the provisioner failed to place are a failed apply too** (novox/hq ADR 0362 §3): its client's
-	// newest word, judged by the same bound — the client says a failure once, and fills again on every change —
-	// on a machine whose node-engine applied what it was sent.
-	failed := map[string][]inventory.ProvReport{}
-	for _, r := range f.provFailed {
-		if r.Status != inventory.ProvFailed || f.now.Sub(r.At) <= applyEvery || !heard[r.Node] || said[r.Node] {
-			continue
-		}
-		failed[r.Node] = append(failed[r.Node], r)
-	}
-	for _, node := range sortedNames(failed) {
-		out = append(out, provisioningFailing(node, failed[node], f.now))
-	}
-	return out
-}
-
-// provisioningFailing is one machine's S21 condition for the modules whose files its provisioner client failed to
-// place.
-func provisioningFailing(m string, failed []inventory.ProvReport, now time.Time) conditions.Observation {
-	sort.Slice(failed, func(a, b int) bool { return failed[a].Module < failed[b].Module })
-	var names, words []string
-	since := failed[0].At
-	for _, r := range failed {
-		names = append(names, r.Module)
-		words = append(words, r.Module+": "+oneLine(orNoReason(r.Reason)))
-		if r.At.Before(since) {
-			since = r.At
-		}
-	}
-	o := conditions.Observation{Scope: conditions.ScopeMachine, ID: m, Kind: kindApplyFailing, Machine: m,
-		Severity: conditions.Warning, Said: strings.Join(words, "; "),
-		Resolved: m + " applies what it is sent again"}
-	o.Summary = fmt.Sprintf("%s's provisioner has failed to place the files of %s since %s (bound %s)", m,
-		strings.Join(names, ", "), since.UTC().Format("2006-01-02 15:04 MST"), ago(applyEvery))
-	o.Headline = m + " is not applying its update"
-	o.Explanation = fmt.Sprintf("The provisioner on %s has not been able to write the files of %s for %s. The "+
-		"details say why.", m, strings.Join(names, ", "), humanDuration(now.Sub(since)))
-	return o
-}
-
-func orNoReason(s string) string {
-	if s == "" {
-		return "no reason given"
-	}
-	return s
-}
-
-// applyFailing is one machine's S21 condition.
-func applyFailing(d inventory.Doing, now time.Time) conditions.Observation {
-	m := d.Node
-	since := d.Since.UTC().Format("2006-01-02 15:04 MST")
-	o := conditions.Observation{Scope: conditions.ScopeMachine, ID: m, Kind: kindApplyFailing, Machine: m,
-		Severity: conditions.Warning, Said: doingWords(d),
-		Resolved: m + " applies what it is sent again"}
-	how := "refused its declaration whole"
-	if d.Outcome != inventory.OutcomeRefused {
-		how = "applied its declaration only in part"
-	}
-	o.Summary = fmt.Sprintf("%s has %s since %s (bound %s): %s", m, how, since, ago(applyEvery), failedNames(d))
-	o.Headline = m + " is not applying its update"
-	o.Explanation = fmt.Sprintf("%s has %s for %s, and trying again has not helped. The details say what fails.",
-		m, plainHow(d), humanDuration(now.Sub(*d.Since)))
-	if tool := unansweringTool(d); tool != "" {
-		o.Summary = fmt.Sprintf("%s: %s does not answer, so no package reaches it; everything else it was sent "+
-			"is applied, since %s (bound %s)", m, tool, since, ago(applyEvery))
-		o.Headline = fmt.Sprintf("%s cannot install packages", m)
-		o.Explanation = fmt.Sprintf("The package manager on %s (%s) has not answered for %s, so no package reaches "+
-			"it. Everything else is still applied, so an update that repairs it can land; if none does, it needs a "+
-			"look on the machine.", m, tool, humanDuration(now.Sub(*d.Since)))
-	}
-	return o
-}
-
-// plainHow is how a machine failed, as the operator reads it.
-func plainHow(d inventory.Doing) string {
-	if d.Outcome == inventory.OutcomeRefused {
-		return "refused every update"
-	}
-	return "applied its updates only in part"
-}
-
-// unansweringTool is the package manager a machine said does not answer, or "".
-func unansweringTool(d inventory.Doing) string {
-	for _, r := range d.Failed {
-		if rest, ok := strings.CutPrefix(r.ID, packageManagerKey); ok {
-			return strings.TrimSuffix(rest, ")")
-		}
-	}
-	return ""
-}
-
-// failedNames is what failed, by name: the refusal, or the failed resources' ids.
-func failedNames(d inventory.Doing) string {
-	if d.Outcome == inventory.OutcomeRefused {
-		return "refused"
-	}
-	ids := make([]string, 0, len(d.Failed))
-	for _, r := range d.Failed {
-		ids = append(ids, r.ID)
-	}
-	sort.Strings(ids)
-	return "failed " + strings.Join(ids, ", ")
-}
-
-// doingWords is the machine's own words on what failed: the evidence, kept inside the mesh.
-func doingWords(d inventory.Doing) string {
-	if d.Outcome == inventory.OutcomeRefused {
-		return "refused: " + oneLine(d.Refused)
-	}
-	var parts []string
-	for _, r := range d.Failed {
-		parts = append(parts, r.ID+": "+oneLine(r.Error))
-	}
-	sort.Strings(parts)
-	return strings.Join(parts, "; ")
-}

cmd/mesh-controller/apply_failing_test.go

@@ -1,123 +0,0 @@
-package main
-
-import (
-	"context"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/conditions"
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// unansweringPackageManager is anchor's last report as the workstation's read on 2026-10-04, once its
-// node-engine applies the rest (novox/hq issue 233): the package failed and the package manager did not answer,
-// the same failure on times reports since for before now.
-func unansweringPackageManager(now time.Time, forHowLong time.Duration, times int) inventory.Doing {
-	since := now.Add(-forHowLong)
-	return inventory.Doing{Node: "anchor", Outcome: inventory.OutcomeFailed, At: now.Add(-time.Second),
-		Since: &since, Times: times, Applied: 41, Failed: []inventory.FailedResource{
-			{ID: "apply", Error: `applying "pacman.base": nothing can be said about "base": this is the arch host and ` +
-				"pacman does not answer here. Either this machine is not Arch, or its package database is broken: " +
-				"pacman exited 1: error: config file /etc/pacman.conf could not be read: No such file or directory"},
-			{ID: "the package manager (pacman)", Error: "pacman does not answer here, so every package in this " +
-				"declaration fails and the rest of it is applied (novox/hq issue 233): pacman exited 1: error: config " +
-				"file /etc/pacman.conf could not be read: No such file or directory"}}}
-}
-
-// **A machine whose package manager does not answer is raised by the mesh itself, naming the tool and the
-// probe's words** (novox/hq issue 233): the words in the evidence, the path kept out of the summary.
-func TestAPackageManagerThatDoesNotAnswerIsRaisedNamingItsWords(t *testing.T) {
-	now := time.Date(2026, 10, 4, 14, 0, 0, 0, time.UTC)
-	f := calm(now)
-	f.doing = []inventory.Doing{unansweringPackageManager(now, 90*time.Minute, 18)}
-	got := watchApplyFailing(f)
-	if len(got) != 1 {
-		t.Fatalf("raised %d conditions, want one: %+v", len(got), got)
-	}
-	o := got[0]
-	if o.Key() != "machine.anchor.apply-failing" || o.Machine != "anchor" {
-		t.Errorf("the condition is not the machine's: %s", o.Key())
-	}
-	if !strings.Contains(o.Summary, "pacman does not answer") || !strings.Contains(o.Summary, "since 2026-10-04 12:30") {
-		t.Errorf("the summary does not name the tool and since when: %s", o.Summary)
-	}
-	if strings.Contains(o.Summary, "/etc/") {
-		t.Errorf("the summary carries a path, which belongs in the evidence: %s", o.Summary)
-	}
-	if !strings.Contains(o.Said, "could not be read") {
-		t.Errorf("the evidence does not carry the probe's words: %s", o.Said)
-	}
-	if !strings.Contains(o.Headline, "cannot install packages") || o.Explanation == "" || o.Resolved == "" {
-		t.Errorf("the plain words do not say it: %+v", o)
-	}
-}
-
-// **A whole refusal is raised too**, with the node-engine's words: what the workstation's report said before the
-// node-engine applied the rest.
-func TestARefusalThatGoesOnIsRaised(t *testing.T) {
-	now := time.Date(2026, 10, 4, 14, 0, 0, 0, time.UTC)
-	since := now.Add(-time.Hour)
-	f := calm(now)
-	f.doing = []inventory.Doing{{Node: "anchor", Outcome: inventory.OutcomeRefused, Since: &since, Times: 12,
-		Refused: "this is the arch host and pacman does not answer here", At: now.Add(-time.Minute)}}
-	got := watchApplyFailing(f)
-	if len(got) != 1 || !strings.Contains(got[0].Summary, "refused its declaration whole") ||
-		!strings.Contains(got[0].Said, "pacman does not answer") {
-		t.Fatalf("a refusal that went on for an hour was not raised with its words: %+v", got)
-	}
-}
-
-// **Judged by time while the machine is heard, not by how many reports said it** (review of novox/hq issue 233):
-// a node-engine says the same failure once, so one report an apply interval old is a fault that goes on; one
-// younger is not yet; and a silent or sleeping machine is S1's.
-func TestOneReportOlderThanAnApplyIsRaisedAndAQuietMachineIsNot(t *testing.T) {
-	now := time.Date(2026, 10, 4, 14, 0, 0, 0, time.UTC)
-	f := calm(now)
-	f.doing = []inventory.Doing{unansweringPackageManager(now, 6*time.Minute, 1)}
-	if got := watchApplyFailing(f); len(got) != 1 {
-		t.Errorf("one report of a failure six minutes old was not raised: %+v", got)
-	}
-	f.doing = []inventory.Doing{unansweringPackageManager(now, 4*time.Minute, 1)}
-	if got := watchApplyFailing(f); len(got) != 0 {
-		t.Errorf("a failure four minutes old was raised before one apply could clear it: %+v", got)
-	}
-	f.doing = []inventory.Doing{unansweringPackageManager(now, time.Hour, 1)}
-	f.machines[0].lastHeard = now.Add(-time.Hour)
-	if got := watchApplyFailing(f); len(got) != 0 {
-		t.Errorf("a silent machine was raised for its last report: %+v", got)
-	}
-	f = calm(now)
-	f.doing = []inventory.Doing{unansweringPackageManager(now, time.Hour, 1)}
-	f.doing[0].Node = "a-machine-the-mesh-does-not-know"
-	if got := watchApplyFailing(f); len(got) != 0 {
-		t.Errorf("a machine not heard of was raised: %+v", got)
-	}
-}
-
-// **A failed re-apply followed by a clean one clears S21** (review of novox/hq issue 233): the node-engine says
-// the clean re-apply, the store keeps it as applied with no failure since, and the condition the failure raised
-// is cleared through the keeper on the next tick.
-func TestACleanReapplyAfterAFailedOneClearsTheCondition(t *testing.T) {
-	now := time.Date(2026, 10, 4, 14, 0, 0, 0, time.UTC)
-	store := conditions.NewInMemory()
-	k := conditions.NewKeeper(t.Context(), conditions.Options{Store: store, History: store,
-		Teller: &conditions.Told{}, Now: func() time.Time { return now }})
-	defer k.Close(context.Background())
-	w := &watchdogs{keeper: k, started: now.Add(-time.Hour)}
-
-	failing := calm(now)
-	failing.doing = []inventory.Doing{unansweringPackageManager(now, 20*time.Minute, 1)}
-	w.see(t.Context(), failing)
-	open, err := k.Open(t.Context())
-	if err != nil || len(open) != 1 || open[0].Kind != kindApplyFailing {
-		t.Fatalf("the failed re-apply raised %+v (%v), want apply-failing", open, err)
-	}
-
-	clean := calm(now.Add(5 * time.Minute))
-	clean.doing = nil // the clean re-apply recorded: NotDoingWhatTheyWereTold no longer lists the machine
-	w.see(t.Context(), clean)
-	if open, _ := k.Open(t.Context()); len(open) != 0 {
-		t.Fatalf("the condition stayed open after the clean re-apply: %+v", open)
-	}
-}

cmd/mesh-controller/ask.go

@@ -1,62 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"flag"
-	"fmt"
-	"os"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// ask calls one of a module's tools, through the control plane's own broker connection.
-//
-// A module serves tools under an account scoped to exactly that (novox/hq ADR 0047), and nothing
-// else in the mesh held an account that could ask one — not an operator at a terminal, not an agent
-// acting for one (novox/hq 04-ISSUES/049). The control plane does, so it is the way in: one
-// process, one connection, one place a question can be seen to have been asked (ADR 0095).
-func askCommand(ctx context.Context, args []string) error {
-	positionals, flags := split(args)
-	set := flag.NewFlagSet("ask", flag.ContinueOnError)
-	wait := set.Duration("wait", 60*time.Second, "how long to wait for the module's answer")
-	if err := set.Parse(flags); err != nil {
-		return err
-	}
-	if len(positionals) < 2 || len(positionals) > 3 {
-		return errors.New("ask <module> <tool> [json arguments] [--wait 60s]")
-	}
-	module, tool := positionals[0], positionals[1]
-	var arguments json.RawMessage
-	if len(positionals) == 3 {
-		if !json.Valid([]byte(positionals[2])) {
-			return fmt.Errorf("the arguments are not JSON: %s", positionals[2])
-		}
-		arguments = json.RawMessage(positionals[2])
-	}
-
-	server, err := connectLink(ctx, nil, nil, nil)
-	if err != nil {
-		return err
-	}
-	defer server.Close()
-
-	answer, err := link.Ask(ctx, server.Bus(), module, tool, arguments, *wait)
-	if err != nil {
-		return err
-	}
-	// The answer as the module gave it, to standard output, for a person or a program. A tool
-	// that answered with an error has still answered: printed the same way, and the exit status
-	// says which.
-	body, err := json.Marshal(answer)
-	if err != nil {
-		return err
-	}
-	fmt.Fprintln(os.Stdout, string(body))
-	if answer.Error != "" {
-		return fmt.Errorf("%s.%s answered with an error: %s", module, tool, answer.Error)
-	}
-	return nil
-}

cmd/mesh-controller/asker_bus_test.go

@@ -1,153 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/nats-io/nats.go"
-	"github.com/nats-io/nats.go/jetstream"
-
-	"git.novox.be/novox/mesh-sdk/go/asks"
-
-	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/conditions"
-	"github.com/novox/mesh-controller/internal/link"
-	"github.com/novox/mesh-controller/internal/testbus"
-)
-
-// busAsker is an asker on a real bus's `asked` bucket, counting what it performs: two of them are two
-// controllers sharing one record.
-type busAskerRig struct {
-	mu     sync.Mutex
-	called int
-	acts   int
-	open   []conditions.Condition
-	sent   [][]byte
-}
-
-func (rig *busAskerRig) asker(t *testing.T, conn *nats.Conn, now time.Time) *asker {
-	return &asker{
-		open: func(context.Context) ([]conditions.Condition, error) {
-			rig.mu.Lock()
-			defer rig.mu.Unlock()
-			return rig.open, nil
-		},
-		silence: func(context.Context, string, time.Duration, string, string) error { return nil },
-		store:   busAsked{conn: conn},
-		publish: func(_ context.Context, subject string, body []byte, _ string) error {
-			rig.mu.Lock()
-			defer rig.mu.Unlock()
-			if subject == asks.AskSubject(askerName) {
-				rig.sent = append(rig.sent, body)
-			}
-			return nil
-		},
-		call: func(context.Context, conditions.Action, map[string]string) error {
-			time.Sleep(20 * time.Millisecond) // long enough for the other delivery to arrive meanwhile
-			rig.mu.Lock()
-			defer rig.mu.Unlock()
-			rig.called++
-			return nil
-		},
-		record: func(context.Context, link.HandAct) error {
-			rig.mu.Lock()
-			defer rig.mu.Unlock()
-			rig.acts++
-			return nil
-		},
-		now:  func() time.Time { return now },
-		logf: t.Logf,
-	}
-}
-
-func askedBus(t *testing.T) *nats.Conn {
-	t.Helper()
-	conn, err := nats.Connect(testbus.URL(t))
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(conn.Close)
-	js, err := jetstream.New(conn)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := js.CreateKeyValue(context.Background(), jetstream.KeyValueConfig{Bucket: broker.AskedBucket}); err != nil {
-		t.Fatal(err)
-	}
-	return conn
-}
-
-// The review of 2026-10-09 (L7): two deliveries of one warrant, to two controllers at once, perform its act
-// exactly once and record it once — the record's compare-and-set decides, never the warrant's message id.
-func TestTwoAnswersAtOnceActOnce(t *testing.T) {
-	conn := askedBus(t)
-	now := time.Date(2026, 10, 9, 14, 0, 0, 0, time.UTC)
-	rig := &busAskerRig{open: []conditions.Condition{heldCondition()}}
-	first, second := rig.asker(t, conn, now), rig.asker(t, conn, now)
-	if err := first.reconcile(context.Background()); err != nil {
-		t.Fatal(err)
-	}
-	if len(rig.sent) != 1 {
-		t.Fatalf("asked %d times", len(rig.sent))
-	}
-	var q asks.Ask
-	_ = json.Unmarshal(rig.sent[0], &q)
-	release, _ := q.Option("release")
-	w := asks.Warrant{Ask: q.ID, Asker: askerName, About: q.About, Outcome: asks.OutcomeChosen, Option: release.ID,
-		Label: release.Label, Level: release.Level, Channel: "telegram", Proofs: []string{"P1"}, At: now,
-		AskDigest: q.Digest(), By: &asks.Person{Who: asks.Operator, Kind: "telegram", Identity: "42", Verified: "user id verified"}}
-	body, _ := json.Marshal(w)
-	var wg sync.WaitGroup
-	for _, a := range []*asker{first, second, first, second} {
-		wg.Add(1)
-		go func(a *asker) {
-			defer wg.Done()
-			if err := a.Decided(context.Background(), body); err != nil {
-				t.Error(err)
-			}
-		}(a)
-	}
-	wg.Wait()
-	if rig.called != 1 || rig.acts != 1 {
-		t.Fatalf("performed %d time(s), recorded %d time(s)", rig.called, rig.acts)
-	}
-	got, err := busAsked{conn: conn}.Get(context.Background(), q.ID)
-	if err != nil || got == nil || got.Acted != "done" {
-		t.Fatalf("kept as %+v (%v)", got, err)
-	}
-}
-
-// The review of 2026-10-09 (L2): a write decided on a record read earlier never lands over one made since. A
-// cancel read before the answer was acted on leaves the act's record as it is.
-func TestAStaleCancelDoesNotWriteOverAnAct(t *testing.T) {
-	conn := askedBus(t)
-	now := time.Date(2026, 10, 9, 14, 0, 0, 0, time.UTC)
-	rig := &busAskerRig{open: []conditions.Condition{heldCondition()}}
-	a := rig.asker(t, conn, now)
-	if err := a.reconcile(context.Background()); err != nil {
-		t.Fatal(err)
-	}
-	var q asks.Ask
-	_ = json.Unmarshal(rig.sent[0], &q)
-	stale, _ := busAsked{conn: conn}.Get(context.Background(), q.ID)
-	release, _ := q.Option("release")
-	w := asks.Warrant{Ask: q.ID, Asker: askerName, About: q.About, Outcome: asks.OutcomeChosen, Option: release.ID,
-		Label: release.Label, Level: release.Level, Channel: "telegram", At: now, AskDigest: q.Digest(),
-		By: &asks.Person{Who: asks.Operator, Kind: "telegram", Identity: "42", Verified: "user id verified"}}
-	body, _ := json.Marshal(w)
-	if err := a.Decided(context.Background(), body); err != nil {
-		t.Fatal(err)
-	}
-	if err := a.cancel(context.Background(), *stale, "the condition ended"); err != nil {
-		t.Fatal(err)
-	}
-	got, _ := busAsked{conn: conn}.Get(context.Background(), q.ID)
-	if got.State != string(asks.OutcomeChosen) || got.Acted != "done" {
-		t.Errorf("a stale cancel wrote over the act: %+v", got)
-	}
-}

cmd/mesh-controller/asker_wire.go

@@ -1,613 +0,0 @@
-package main
-
-// The asker on the bus: its asks in the controller's bucket `asked`, its asks and cancels published on the
-// seat under the controller's name, the verbs a warrant chooses called with the controller's grant, and the
-// router's record of its asks read under its name (novox/hq ADR 0259).
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"sort"
-	"strings"
-	"sync"
-	"sync/atomic"
-	"time"
-
-	"github.com/nats-io/nats.go"
-	"github.com/nats-io/nats.go/jetstream"
-
-	"git.novox.be/novox/mesh-sdk/go/asks"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/conditions"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// askerFrom is the serving controller's asker; nil in any other process.
-var askerFrom atomic.Pointer[asker]
-
-// askWithin is how long a verb a warrant chose is given to answer.
-const askWithin = time.Minute
-
-type busAsked struct{ conn *nats.Conn }
-
-func (b busAsked) kv(ctx context.Context) (jetstream.KeyValue, error) {
-	js, err := jetstream.New(b.conn)
-	if err != nil {
-		return nil, err
-	}
-	return js.KeyValue(ctx, broker.AskedBucket)
-}
-
-func (b busAsked) Get(ctx context.Context, id string) (*asked, error) {
-	kv, err := b.kv(ctx)
-	if err != nil {
-		return nil, err
-	}
-	e, err := kv.Get(ctx, id)
-	if errors.Is(err, jetstream.ErrKeyNotFound) {
-		return nil, nil
-	}
-	if err != nil {
-		return nil, err
-	}
-	var r asked
-	return &r, json.Unmarshal(e.Value(), &r)
-}
-
-// Create keeps a new ask under its id, and only where none is kept: never over another.
-func (b busAsked) Create(ctx context.Context, r asked) error {
-	kv, err := b.kv(ctx)
-	if err != nil {
-		return err
-	}
-	body, err := json.Marshal(r)
-	if err != nil {
-		return err
-	}
-	_, err = kv.Create(ctx, r.ID, body)
-	return err
-}
-
-// Change applies change to the ask kept under id by compare-and-set on its key's revision (the review of
-// 2026-10-09, L2): read, changed, and written only over the revision read; when another write came between,
-// read again and asked again, at most askChangeTries times. change says whether to write at all.
-func (b busAsked) Change(ctx context.Context, id string, change func(*asked) bool) (bool, error) {
-	kv, err := b.kv(ctx)
-	if err != nil {
-		return false, err
-	}
-	for try := 0; try < askChangeTries; try++ {
-		e, err := kv.Get(ctx, id)
-		if errors.Is(err, jetstream.ErrKeyNotFound) {
-			return false, nil
-		}
-		if err != nil {
-			return false, err
-		}
-		var r asked
-		if err := json.Unmarshal(e.Value(), &r); err != nil {
-			return false, err
-		}
-		if !change(&r) {
-			return false, nil
-		}
-		body, err := json.Marshal(r)
-		if err != nil {
-			return false, err
-		}
-		if _, err := kv.Update(ctx, id, body, e.Revision()); err != nil {
-			var api *jetstream.APIError
-			if errors.Is(err, jetstream.ErrKeyExists) || (errors.As(err, &api) && api.ErrorCode == jetstream.JSErrCodeStreamWrongLastSequence) {
-				continue
-			}
-			return false, err
-		}
-		return true, nil
-	}
-	return false, fmt.Errorf("the ask %s changed under every one of %d tries", id, askChangeTries)
-}
-
-func (b busAsked) All(ctx context.Context) ([]asked, error) {
-	kv, err := b.kv(ctx)
-	if err != nil {
-		return nil, err
-	}
-	lister, err := kv.ListKeys(ctx)
-	if err != nil {
-		return nil, err
-	}
-	defer func() { _ = lister.Stop() }()
-	var out []asked
-	for k := range lister.Keys() {
-		e, err := kv.Get(ctx, k)
-		if err != nil {
-			continue
-		}
-		var r asked
-		if json.Unmarshal(e.Value(), &r) == nil {
-			out = append(out, r)
-		}
-	}
-	return out, nil
-}
-
-// verbRefused is a verb's own refusal of an act: the seat answered, and said no. Any other error of callAction (a bus
-// that did not answer, a grant that is refused) is not one: the verb may have run.
-type verbRefused struct{ verb, words string }
-
-func (e verbRefused) Error() string { return e.verb + " refused: " + e.words }
-
-// callAction performs an action's verb as the controller, through the grant that names it.
-func callAction(conn *nats.Conn) func(ctx context.Context, a conditions.Action, args map[string]string) error {
-	return func(ctx context.Context, a conditions.Action, args map[string]string) error {
-		seat, verb, ok := strings.Cut(a.Verb, ".")
-		if !ok {
-			return fmt.Errorf("%q names no seat and verb", a.Verb)
-		}
-		body := map[string]any{}
-		for k, v := range args {
-			body[k] = v
-		}
-		if seat == catalogue.DeliverySeat {
-			_, err := askDeliveryOwner(ctx, conn, verb, body)
-			return err
-		}
-		granted := false
-		for _, v := range broker.VerbsTheControllerActsOnAWarrant {
-			granted = granted || (v.Seat == seat && v.Verb == verb)
-		}
-		if !granted {
-			return fmt.Errorf("%s: %w", a.Verb, errNotGranted)
-		}
-		var answer link.Answer
-		var err error
-		if a.Machine != "" {
-			answer, err = link.AskSeatTool(ctx, conn, seat, verb, a.Machine, body, askWithin)
-		} else {
-			answer, err = link.AskMeshSeatTool(ctx, conn, seat, verb, body, askWithin)
-		}
-		if err != nil {
-			return err
-		}
-		if answer.Error != "" {
-			return verbRefused{verb: a.Verb, words: answer.Error}
-		}
-		return nil
-	}
-}
-
-// tellThrough tells the operator one plain notice through the operator channel's `tell`, over the controller's own
-// connection and grant (novox/hq ADR 0380); a holder's refusal is an error naming it.
-func tellThrough(conn *nats.Conn) func(ctx context.Context, headline string, lines []string) error {
-	return func(ctx context.Context, headline string, lines []string) error {
-		answer, err := link.AskMeshSeatTool(ctx, conn, "operator-channel", "tell",
-			map[string]any{"headline": headline, "lines": lines}, tellWithin)
-		if err != nil {
-			return err
-		}
-		if answer.Error != "" {
-			return fmt.Errorf("operator-channel.tell refused: %s", answer.Error)
-		}
-		return nil
-	}
-}
-
-// routerRecordOf reads the router's record of one of the controller's asks, under its name, and answers
-// how it ended when it did: the bucket is the one the asks seat's declarer names as its records.
-func routerRecordOf(conn *nats.Conn, inv *inventory.Inventory) func(ctx context.Context, id string) (*asks.Warrant, error) {
-	return func(ctx context.Context, id string) (*asks.Warrant, error) {
-		bucket, err := asksRecords(ctx, inv)
-		if err != nil || bucket == "" {
-			return nil, err
-		}
-		reply, err := conn.RequestWithContext(ctx, "$JS.API.DIRECT.GET.KV_"+bucket+".$KV."+bucket+"."+askerName+"."+id, nil)
-		if err != nil {
-			return nil, err
-		}
-		if reply.Header.Get("Status") != "" {
-			return nil, nil // none, or not readable: the event says it
-		}
-		var rec struct {
-			State   string        `json:"state"`
-			Warrant *asks.Warrant `json:"warrant"`
-		}
-		if json.Unmarshal(reply.Data, &rec) != nil || rec.State == "open" || rec.Warrant == nil {
-			return nil, nil
-		}
-		return rec.Warrant, nil
-	}
-}
-
-// asksRecords is the bucket the asks seat's declarer keeps its record of asks in.
-func asksRecords(ctx context.Context, inv catalogueReader) (string, error) {
-	declared, err := inv.Catalogue(ctx)
-	if err != nil {
-		return "", err
-	}
-	for _, m := range declared {
-		for _, s := range m.DefinesSeats {
-			if s.Name == broker.AsksSeat && len(s.Records) > 0 {
-				return broker.BucketName(m.Module, s.Records[0]), nil
-			}
-		}
-	}
-	return "", nil
-}
-
-// routerHereIn says whether a module declaring the asks seat, with its ask named by its caller, is assigned:
-// without it nothing takes an ask, and asking would only fill a queue nobody reads.
-func routerHereIn(inv *inventory.Inventory) func(ctx context.Context) (bool, error) {
-	return func(ctx context.Context) (bool, error) {
-		entries, err := inv.Catalogued(ctx)
-		if err != nil {
-			return false, err
-		}
-		for _, e := range entries {
-			for _, s := range e.Manifest.DefinesSeats {
-				if s.Name == broker.AsksSeat && s.NamedByCaller("ask") && len(e.On) > 0 {
-					return true, nil
-				}
-			}
-		}
-		return false, nil
-	}
-}
-
-// grantHeldIn says whether the bus holds the controller's grant to ask (novox/hq issue 353), judged on the two
-// facts that make it so, and failing closed on each:
-//
-//  1. **composed**: the user list the mesh composes now grants the controller itself to publish its ask
-//     (controllerMayAsk) — the controller's own grant, not whether any user of the list changed;
-//  2. **in force**: the bus's own module, on the machine holding the bus, says the user list there allows it
-//     and the server reloaded after that list was written (the nats module's `nats_user_can`, `in_force`) — a
-//     list sent is not a list the bus enforces until it reloads.
-//
-// Anything that cannot be worked out is not held, with why, so the conditions that need the operator are said
-// as undelivered rather than asked into a refusal.
-func grantHeldIn(open *stores, conn *nats.Conn) func(ctx context.Context) (bool, string, error) {
-	return grantHeldBy(composedGrantIn(open), busGrantIn(open, conn), time.Now)
-}
-
-// grantJudge is one of the two facts: whether it holds, and why not.
-type grantJudge func(ctx context.Context) (bool, string, error)
-
-// grantHeldBy is the judgement over the two facts, remembered for grantLookEvery: composing the list resolves
-// the bus's machine whole, and asking the bus's module is a call.
-func grantHeldBy(composed, inForce grantJudge, now func() time.Time) func(ctx context.Context) (bool, string, error) {
-	var mu sync.Mutex
-	var at time.Time
-	var held bool
-	var why string
-	return func(ctx context.Context) (bool, string, error) {
-		mu.Lock()
-		defer mu.Unlock()
-		if !at.IsZero() && now().Sub(at) < grantLookEvery {
-			return held, why, nil
-		}
-		held, why = judgeGrant(ctx, composed, inForce)
-		at = now()
-		return held, why, nil
-	}
-}
-
-// judgeGrant is held only when both facts hold; an error is a fact not known, never a yes. A fact that holds
-// with a caveat (a reload not confirmed) gives that caveat as the why of a yes.
-func judgeGrant(ctx context.Context, composed, inForce grantJudge) (bool, string) {
-	var caveat []string
-	for _, fact := range []struct {
-		judge grantJudge
-		what  string
-	}{{composed, "whether the mesh composes the controller a grant to ask"}, {inForce, "whether the bus enforces it"}} {
-		if fact.judge == nil {
-			return false, fact.what + " is not judged here"
-		}
-		ok, why, err := fact.judge(ctx)
-		if err != nil {
-			return false, fact.what + " could not be worked out: " + err.Error()
-		}
-		if !ok {
-			return false, why
-		}
-		if why != "" {
-			caveat = append(caveat, why)
-		}
-	}
-	return true, strings.Join(caveat, "; ")
-}
-
-// controllerMayAsk says whether the controller's own grant, as composed from these records, lets it publish its
-// ask (ADR 0259 §3: composed while a router that takes asks under its asker's name is assigned).
-func controllerMayAsk(records broker.Records) (bool, error) {
-	users, err := broker.Users(records)
-	if err != nil {
-		return false, err
-	}
-	for _, u := range users {
-		if u.Kind != broker.KindController {
-			continue
-		}
-		perms, err := broker.PermissionsFor(u)
-		if err != nil {
-			return false, err
-		}
-		return broker.MayPublish(perms, asks.AskSubject(askerName)), nil
-	}
-	return false, errors.New("the composition holds no controller")
-}
-
-// composedGrantIn is the first fact, from the mesh's records.
-func composedGrantIn(open *stores) grantJudge {
-	return func(ctx context.Context) (bool, string, error) {
-		if open == nil || open.inventory == nil {
-			return false, "", errors.New("the mesh's records are not open")
-		}
-		records, err := open.inventory.BusRecords(ctx)
-		if err != nil {
-			return false, "", err
-		}
-		may, err := controllerMayAsk(records)
-		if err != nil || may {
-			return may, "", err
-		}
-		return false, "the mesh composes the controller no grant to ask: no router that takes asks under its " +
-			"asker's name is assigned", nil
-	}
-}
-
-// busGrantIn is the second fact, asked of the bus's own module on the machine holding the bus, with the check
-// main made before it (novox/hq issue 353, PR 186: is the user list sent to the bus's machine the one composed
-// now) kept for the cases the module's word does not settle.
-func busGrantIn(open *stores, conn *nats.Conn) grantJudge {
-	ask := func(ctx context.Context) (string, json.RawMessage, error) {
-		if open == nil || open.inventory == nil || conn == nil {
-			return "", nil, errors.New("the mesh's records or the bus are not open")
-		}
-		holders, err := seatHolders(ctx, open.inventory)
-		if err != nil {
-			return "", nil, err
-		}
-		h, held := holders[theBrokerSeat]
-		if !held || h.Node == "" || h.Module == "" {
-			return "", nil, nil
-		}
-		a, err := link.AskModuleToolOn(ctx, conn, h.Module, busUserCanTool, h.Node, map[string]any{
-			"user": broker.ControllerName, "action": "publish", "subject": asks.AskSubject(askerName)}, 15*time.Second)
-		if err != nil {
-			return h.Node, nil, err
-		}
-		if a.Error != "" {
-			return h.Node, nil, errors.New(a.Error)
-		}
-		return h.Node, a.Result, nil
-	}
-	list := func(ctx context.Context) (busListState, error) {
-		if open == nil || open.inventory == nil {
-			return busListState{}, errors.New("the mesh's records are not open")
-		}
-		s, err := brokerListState(ctx, open, nil)
-		if err != nil || s.Machine == "" || !s.Behind {
-			return s, err
-		}
-		step, err := busHeld(ctx, open.inventory, []string{s.Machine})
-		if err != nil {
-			return busListState{}, err
-		}
-		s.BusStep = step[s.Machine]
-		return s, nil
-	}
-	return busGrantBy(ask, list)
-}
-
-// busListState is the user list on the bus's machine as the controller's record knows it: whether the list
-// sent there is behind the one composed now, why it could not be composed, and the bus step a send there waits
-// on (that machine cannot be pushed until a person's `bus upgrade`).
-type busListState struct {
-	Machine    string
-	Behind     bool
-	Uncomposed error
-	BusStep    string
-}
-
-// remedy is the one thing that sends the bus's machine the list composed now: the plan's own reason when it
-// cannot be composed, the bus upgrade while sends there wait on it, and otherwise a push of that machine.
-func (s busListState) remedy(node string) string {
-	if s.Machine != "" {
-		node = s.Machine
-	}
-	switch {
-	case s.Uncomposed != nil:
-		return fmt.Sprintf("the user list for %s cannot be composed (%v); `plan %s` says what to fix first",
-			node, s.Uncomposed, node)
-	case s.BusStep != "":
-		return fmt.Sprintf("sends to %s wait on the bus's planned step, so a push will not carry it: %s", node, s.BusStep)
-	}
-	return fmt.Sprintf("`push %s` carries it", node)
-}
-
-// busGrantBy judges the bus's word, and names for each way it is not held the one thing that makes it held:
-//
-//   - **in force**: held;
-//   - **allowed, from a module older than `in_force`**: held, with the caveat that the reload is not confirmed.
-//     The file allows the publish, and the bus reloads within about 5 s of a change to it, so the worst case is
-//     one ask refused in those seconds, which is asked again (issue 369). The list check is not consulted:
-//     while a bus step is pending the bus's machine cannot be pushed, so any change to the composed list would
-//     read as behind for good and silence every ask until a person's bus upgrade (the review of PR 188);
-//   - **allowed, written, not reloaded** (the module gives both times): wait about 5 s;
-//   - **allowed, in force not known** (the module could not read a time): what is not known, said;
-//   - **not allowed, or the module cannot answer**: the list check decides — the remedy that sends the list
-//     when it is behind (busListState.remedy), and, for a module that cannot answer, held while the list sent
-//     is current, as main judged it.
-//
-// ask answers the machine holding the bus and its module's answer ("" when nothing holds the bus); list is the
-// record's word on the list sent to that machine.
-func busGrantBy(ask func(ctx context.Context) (string, json.RawMessage, error),
-	list func(ctx context.Context) (busListState, error)) grantJudge {
-	return func(ctx context.Context) (bool, string, error) {
-		node, raw, askErr := ask(ctx)
-		if askErr == nil && node == "" {
-			return false, "no module holds the bus, so nothing says what it enforces", nil
-		}
-		var answer busAnswer
-		if askErr == nil {
-			if answer, askErr = readBusAnswer(raw); askErr != nil {
-				askErr = fmt.Errorf("its answer could not be read: %w", askErr)
-			}
-		}
-		if askErr != nil {
-			if node == "" {
-				node = "the bus's machine"
-			}
-			s, err := list(ctx)
-			if err != nil {
-				return false, "", fmt.Errorf("the bus module on %s could not answer (%v), and whether the list sent "+
-					"there is the one composed now could not be worked out: %w", node, askErr, err)
-			}
-			if s.Behind {
-				return false, fmt.Sprintf("the bus module on %s could not answer (%v), and the user list sent there is "+
-					"behind what the mesh composes; %s", node, askErr, s.remedy(node)), nil
-			}
-			return true, fmt.Sprintf("the bus module on %s could not answer (%v); judged by the user list sent there, "+
-				"which is the one composed now", node, askErr), nil
-		}
-		notAllowed := func(older string) (bool, string, error) {
-			s, err := list(ctx)
-			if err != nil {
-				return false, "", fmt.Errorf("the user list on %s does not allow the controller to ask%s, and whether "+
-					"the list sent there is the one composed now could not be worked out: %w", node, older, err)
-			}
-			if s.Behind {
-				return false, fmt.Sprintf("the user list on %s does not allow the controller to ask%s: it is behind "+
-					"what the mesh composes; %s", node, older, s.remedy(node)), nil
-			}
-			return false, fmt.Sprintf("the user list on %s does not allow the controller to ask%s, though the list "+
-				"sent there is the one composed now; %s again", node, older, s.remedy(node)), nil
-		}
-		switch {
-		case answer.InForce == nil && answer.Allowed:
-			return true, fmt.Sprintf("the user list on %s allows the controller to ask, but its reload is not "+
-				"confirmed: the bus module there is older than the answer whether a grant is in force, and the bus "+
-				"upgrade (`bus upgrade`) carries one that confirms it", node), nil
-		case answer.InForce == nil:
-			return notAllowed(" (the bus module there is older than the answer whether a grant is in force)")
-		case !answer.Allowed:
-			return notAllowed("")
-		case *answer.InForce:
-			return true, "", nil
-		case answer.FileWritten != "" && answer.ServerLoaded != "":
-			return false, fmt.Sprintf("the bus on %s has the controller's grant to ask written (%s) but has not "+
-				"reloaded since (last load %s); it reloads in place within about 5 s, so nothing is to be done but wait",
-				node, answer.FileWritten, answer.ServerLoaded), nil
-		}
-		why := answer.Why
-		if why == "" {
-			why = "it gives no reason"
-		}
-		return false, fmt.Sprintf("the user list on %s allows the controller to ask, but whether the bus enforces it "+
-			"is not known: %s", node, why), nil
-	}
-}
-
-// busUserCanTool is the bus module's answer to whether a user may do something, and whether it is in force.
-const busUserCanTool = "nats_user_can"
-
-// busAnswer is the bus module's answer to busUserCanTool; InForce is nil from a module older than that field,
-// and FileWritten and ServerLoaded are given only when it could read both times (mesh-catalog's nats InForce).
-type busAnswer struct {
-	Allowed      bool   `json:"allowed"`
-	InForce      *bool  `json:"in_force"`
-	Why          string `json:"why"`
-	FileWritten  string `json:"file_written"`
-	ServerLoaded string `json:"server_loaded"`
-}
-
-func readBusAnswer(raw json.RawMessage) (busAnswer, error) {
-	var answer busAnswer
-	err := json.Unmarshal(raw, &answer)
-	return answer, err
-}
-
-// grantLookEvery is how often the bus's user list is judged against the one its machine was last sent.
-const grantLookEvery = 30 * time.Second
-
-// channelsIn is what the channels are now, as a fingerprint: each module claiming a kind of the channel
-// bench, where, promising what, and whether of its own account. An ask the router refused is asked again
-// once this changes.
-func channelsIn(inv *inventory.Inventory) func(ctx context.Context) string {
-	return func(ctx context.Context) string {
-		entries, err := inv.Catalogued(ctx)
-		if err != nil {
-			return ""
-		}
-		var parts []string
-		for _, e := range entries {
-			for _, c := range e.Manifest.Claims {
-				if c.Kind == "" || !catalogue.KindedBenches[c.Name] {
-					continue
-				}
-				on := append([]string(nil), e.On...)
-				sort.Strings(on)
-				caps := append([]string(nil), c.Capabilities...)
-				sort.Strings(caps)
-				parts = append(parts, fmt.Sprintf("%s/%s=%s@%s[%s]own:%t", c.Name, c.Kind, e.Manifest.Module,
-					strings.Join(on, ","), strings.Join(caps, ","), e.Manifest.RunsAs != ""))
-			}
-		}
-		sort.Strings(parts)
-		return strings.Join(parts, ";")
-	}
-}
-
-// startAsking makes the serving controller's asker and hands it the router's words.
-func startAsking(ctx context.Context, open *stores, server *link.Server, conn *nats.Conn, keeper *conditions.Keeper) {
-	js, err := jetstream.New(conn)
-	if err != nil {
-		fmt.Printf("the operator cannot be asked: %v\n", err)
-		return
-	}
-	a := servingAsker(open, conn, js, keeper)
-	if err := server.Decides(a); err != nil {
-		fmt.Printf("the operator's answers cannot be heard, so nothing is asked: %v\n", err)
-		return
-	}
-	askerFrom.Store(a)
-	goServing(ctx, func() { a.keep(ctx) })
-}
-
-// servingAsker is the serving controller's asker, wired to the mesh: what it reads, publishes, performs and
-// records, and the judgements it asks by — the bus's grant to ask among them (novox/hq issue 353).
-func servingAsker(open *stores, conn *nats.Conn, js jetstream.JetStream, keeper *conditions.Keeper) *asker {
-	return &asker{
-		open: keeper.Open,
-		silence: func(ctx context.Context, key string, d time.Duration, by, why string) error {
-			_, err := keeper.Silence(ctx, key, d, by, why)
-			return err
-		},
-		store: busAsked{conn: conn},
-		publish: func(ctx context.Context, subject string, body []byte, id string) error {
-			_, err := js.Publish(ctx, subject, body, jetstream.WithMsgID(id))
-			return err
-		},
-		call: callAction(conn),
-		// A proposed settings layer is set by this controller itself on the warrant (novox/hq ADR 0277).
-		setLayer: setLayerIn(open),
-		record: func(ctx context.Context, act link.HandAct) error {
-			_, err := link.RecordHandAct(ctx, conn, act)
-			return err
-		},
-		tell:         tellThrough(conn),
-		routerRecord: routerRecordOf(conn, open.inventory),
-		routerHere:   routerHereIn(open.inventory),
-		grantHeld:    grantHeldIn(open, conn),
-		channels:     channelsIn(open.inventory),
-		raise: func(ctx context.Context, obs []conditions.Observation) error {
-			return keeper.Reconcile(ctx, sourceAsker, obs)
-		},
-		now:  time.Now,
-		logf: func(format string, args ...any) { fmt.Printf(format+"\n", args...) },
-	}
-}

cmd/mesh-controller/assignment_accounts.go

@@ -1,489 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"maps"
-	"slices"
-	"strings"
-	"sync"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-
-	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/chain"
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// An assignment that stands issues its node's bus accounts and the module's grant (novox/hq ADR 0543, issue 1945; a
-// step of research 072's grants: the memberships and credentials heard from placement, not from a send or a build).
-//
-// ADR 0539 clause 7 issues a module's credential and grant when its build is done. A module already built and assigned
-// to one more node never has a build done again, so nothing issued that node's account: on 2026-10-25 at 17:19
-// mesh-build-node and mesh-build-go were assigned to ace, composed for it, and the bus's user list never named
-// ace.mesh-build-node nor ace.mesh-build-go; one runtime found no credential, the other was refused by the bus, both
-// restarting every 5 s. The assign act composes the assigned node alone (composedAfterAct): never the node holding the
-// bus, never the grant.
-//
-// So the write of an assignments key is the event. When a key `<node>.<module>` of the assignments bucket comes to stand
-// (a new key, or one that was ended or pending), the lease holder issues the module's accounts on that node that are not
-// minted (idempotent: a minted account is never issued again, a rotation is on purpose), composes the node holding the
-// bus so its user list carries them, and writes the grants. A rewrite of an assignment that already stood (the
-// provisioner's plan kept in its value) does nothing. A starting controller looks at every standing assignment once,
-// from one reading of the catalogue: it issues what is missing, then composes the bus's node and writes the grants
-// once. The assign act issues too; both mint only an account no row names, in one statement, so exactly one of them
-// mints and seals it (mintBusUser, the review of issue 1945).
-
-// assignmentAccountSteps are what an assignment that comes to stand does, each a step a test may stand in for.
-type assignmentAccountSteps struct {
-	// holds says this controller holds the lease: only its holder issues.
-	holds func(ctx context.Context) bool
-	// forgetStale forgets every module's accounts on a node where the module no longer resolves, and answers a line for
-	// each (issue 1945: rows of an unassignment before this release, marked sealed by migration 0108).
-	forgetStale func(ctx context.Context) ([]string, error)
-	// catalogue reads the catalogue once, for every assignment a look issues for.
-	catalogue func(ctx context.Context) (map[string]catalogue.Manifest, error)
-	// issue issues the module's accounts on the node that are not minted, from the catalogue read; issued says it
-	// minted one, line what it did.
-	issue func(ctx context.Context, shelf map[string]catalogue.Manifest, node, module string) (issued bool, line string, err error)
-	// busHolder is the node holding the bus, "" for none.
-	busHolder func(ctx context.Context) (string, error)
-	// compose writes the nodes' compositions; grants writes the grants issued.
-	compose func(ctx context.Context, nodes []string) error
-	grants  func(ctx context.Context) error
-}
-
-// settle issues what the standing assignment of module on node lacks. fresh says the assignment just came to stand: the
-// bus's node is composed and the grants written even when every account was minted before (a module assigned again
-// keeps its account, and the bus's user list left it out while it was unassigned). It answers what it did, "" for
-// nothing.
-func (s assignmentAccountSteps) settle(ctx context.Context, node, module string) (string, error) {
-	if module == controllerModule {
-		// The controller's own module is issued at the terminal alone: its `broker` secret is the credential it is
-		// using (rollout.go), and it is assigned and unassigned there only (refusedMovingTheController).
-		return "", nil
-	}
-	if !s.holds(ctx) {
-		return "", errNotHolding
-	}
-	shelf, err := s.catalogue(ctx)
-	if err != nil {
-		return "", fmt.Errorf("the catalogue cannot be read: %w", err)
-	}
-	_, line, err := s.issue(ctx, shelf, node, module)
-	if err != nil {
-		return "", fmt.Errorf("its bus accounts on %s are not issued: %w", node, err)
-	}
-	said, err := s.cover(ctx)
-	prefix := module + " on " + node + ": "
-	if line != "" {
-		prefix += line + "; "
-	}
-	return prefix + said, err
-}
-
-// look is the start's look: the accounts every standing assignment lacks, issued one after another from one reading of
-// the catalogue, then the bus's node composed and the grants written once, when it looked at any assignment, whatever
-// it issued (an assignment that came to stand while no controller heard it may have its accounts and still lack its
-// place in the bus's user list or its grant). It answers what it did.
-func (s assignmentAccountSteps) look(ctx context.Context, standing []chain.Assignment) (string, error) {
-	var forgot []string
-	if len(standing) > 0 && s.forgetStale != nil {
-		// Only from a reading of the assignments that holds some: an empty or failed one would forget every account.
-		if !s.holds(ctx) {
-			return "", errNotHolding
-		}
-		var err error
-		if forgot, err = s.forgetStale(ctx); err != nil {
-			return "", fmt.Errorf("the accounts of modules no longer on their nodes are not forgotten: %w", err)
-		}
-	}
-	var looked []chain.Assignment
-	for _, a := range standing {
-		if a.Module != controllerModule {
-			looked = append(looked, a)
-		}
-	}
-	if len(looked) == 0 {
-		return strings.Join(forgot, "\n"), nil
-	}
-	if !s.holds(ctx) {
-		return "", errNotHolding
-	}
-	shelf, err := s.catalogue(ctx)
-	if err != nil {
-		return "", fmt.Errorf("the catalogue cannot be read: %w", err)
-	}
-	var lines []string
-	for _, a := range looked {
-		if ctx.Err() != nil {
-			return "", ctx.Err()
-		}
-		if _, line, err := s.issue(ctx, shelf, a.Node, a.Module); err != nil {
-			return "", fmt.Errorf("%s's bus accounts on %s are not issued: %w", a.Module, a.Node, err)
-		} else if line != "" {
-			lines = append(lines, a.Module+" on "+a.Node+": "+line)
-		}
-	}
-	said, err := s.cover(ctx)
-	lines = append(append(forgot, lines...), fmt.Sprintf("%d standing assignment(s) looked at; %s", len(looked), said))
-	return strings.Join(lines, "\n"), err
-}
-
-// errNotHolding is a controller that does not hold the lease: it issues nothing, and tries again until it holds it.
-var errNotHolding = errors.New("this controller does not hold the lease")
-
-// cover composes the node holding the bus and writes the grants, and says so.
-func (s assignmentAccountSteps) cover(ctx context.Context) (string, error) {
-	holder, err := s.busHolder(ctx)
-	if err != nil {
-		return "", fmt.Errorf("the node holding the bus cannot be read: %w", err)
-	}
-	if holder != "" {
-		if err := s.compose(ctx, []string{holder}); err != nil {
-			return "", fmt.Errorf("the bus's user list on %s is not composed: %w", holder, err)
-		}
-	}
-	if err := s.grants(ctx); err != nil {
-		return "", err
-	}
-	if holder != "" {
-		return "the bus's user list composed on " + holder + ", the grants written", nil
-	}
-	return "the grants written", nil
-}
-
-// assignmentStands says a value of the assignments bucket holds an assignment that stands: made (a module only pulled in
-// by another names no time assigned), not ended and in no state (chain.Assignment.Stands).
-func assignmentStands(a chain.Assignment) bool {
-	return !a.Assigned.IsZero() && a.Stands() && a.Node != "" && a.Module != ""
-}
-
-// assignmentTurns keeps which keys of the assignments bucket stood when last heard, to tell an assignment that comes to
-// stand from a rewrite of one that stood.
-type assignmentTurns struct {
-	mu    sync.Mutex
-	stood map[string]bool
-}
-
-// heard records a value of key (nil for a delete or a purge) and answers whether it holds an assignment that just came
-// to stand.
-func (t *assignmentTurns) heard(key string, value []byte) (chain.Assignment, bool) {
-	var a chain.Assignment
-	stands := false
-	if value != nil && json.Unmarshal(value, &a) == nil {
-		stands = assignmentStands(a)
-	}
-	t.mu.Lock()
-	defer t.mu.Unlock()
-	if t.stood == nil {
-		t.stood = map[string]bool{}
-	}
-	was := t.stood[key]
-	t.stood[key] = stands
-	return a, stands && !was
-}
-
-// ownAccountOf is the username of the account a module speaks on the bus with on node, its own and no process's: the
-// module's when it reads a `broker` own secret, else its provisioner client's when it runs one; false when it has none
-// (a module whose accounts are its processes' alone, or one that does not speak on the bus).
-func ownAccountOf(m catalogue.Manifest, node string) (string, bool) {
-	if _, reads := m.OwnSecrets["broker"]; reads {
-		return broker.Principal{Kind: broker.KindModule, Node: node, Module: m.Module}.Username(), true
-	}
-	if runsTheProvisionerClient(m) {
-		return broker.Principal{Kind: broker.KindProvisioner, Node: node, Module: m.Module}.Username(), true
-	}
-	return "", false
-}
-
-// issueAssignmentAccounts issues module's accounts on node that are not minted: its own (issueOnTheNewBus) and its
-// processes' (issueMissingProcessAccounts). A module the catalogue does not hold, or one with nowhere to deliver an
-// account (mayIssue), has nothing to issue; an account minted before is kept.
-func issueAssignmentAccounts(ctx context.Context, inv *inventory.Inventory, shelf map[string]catalogue.Manifest,
-	node, module string) (bool, string, error) {
-	// Mint only what no row names: the assign act hears its own write and may issue at once (the review of issue 1945).
-	ctx = onlyIfAbsent(ctx)
-	m, known := shelf[module]
-	if !known || mayIssue(m) != nil {
-		return false, "", nil
-	}
-	if _, own := ownAccountOf(m, node); own {
-		minted, err := inv.BusMinted(ctx) // sealed accounts alone: a row with no sealed credential is not issued
-		if err != nil {
-			return false, "", fmt.Errorf("the issued accounts cannot be read: %w", err)
-		}
-		if missingAccounts(m, node, minted) {
-			busAddress, err := broker.BusAddress()
-			if err != nil {
-				return false, "", err
-			}
-			// Its processes' and provisioner client's accounts too: issueOnTheNewBus issues each that is not issued.
-			ctx, got := withIssued(ctx)
-			if err := issueOnTheNewBus(ctx, inv, m, node, busAddress); err != nil {
-				return false, "", err
-			}
-			if issued := got.list(); len(issued) > 0 {
-				return true, "issued and sealed to " + node + ": " + strings.Join(issued, ", "), nil
-			}
-			return false, "", nil
-		}
-		return false, "its bus accounts on " + node + " stood issued and sealed", nil
-	}
-	line, err := issueMissingProcessAccounts(ctx, inv, m, node)
-	if err != nil {
-		return false, "", err
-	}
-	return line != "", line, nil
-}
-
-// missingAccounts says some account of m on node is not issued: its own, a process's, or its provisioner client's.
-func missingAccounts(m catalogue.Manifest, node string, minted []string) bool {
-	if user, own := ownAccountOf(m, node); own && !slices.Contains(minted, user) {
-		return true
-	}
-	if runsTheProvisionerClient(m) &&
-		!slices.Contains(minted, broker.Principal{Kind: broker.KindProvisioner, Node: node, Module: m.Module}.Username()) {
-		return true
-	}
-	return len(processAccountsMissing(m, node, minted)) > 0
-}
-
-// liveAssignmentAccountSteps are the steps on the controller's own stores and the bus: the composer's passes, as the
-// done keys' take-ins use them, so a node asked for by both is composed once a pass.
-func liveAssignmentAccountSteps(open *stores) assignmentAccountSteps {
-	inv := open.inventory
-	return assignmentAccountSteps{
-		holds: func(ctx context.Context) bool {
-			// The lease's gate, as every act's: a serving controller the bus does not grant the lease yet acts unleased.
-			_, err := theLease.epoch(ctx)
-			return err == nil
-		},
-		forgetStale: func(ctx context.Context) ([]string, error) { return forgetStaleAccounts(ctx, open) },
-		catalogue:   func(ctx context.Context) (map[string]catalogue.Manifest, error) { return inv.Catalogue(ctx) },
-		issue: func(ctx context.Context, shelf map[string]catalogue.Manifest, node, module string) (bool, string, error) {
-			return issueAssignmentAccounts(ctx, inv, shelf, node, module)
-		},
-		busHolder: func(ctx context.Context) (string, error) {
-			holders, err := seatHolders(ctx, inv)
-			if err != nil {
-				return "", err
-			}
-			return holders[catalogue.BrokerSeat].Node, nil
-		},
-		compose: func(ctx context.Context, nodes []string) error {
-			return composerFor(open).compose(ctx, nodes, false)
-		},
-		grants: func(ctx context.Context) error {
-			return composerFor(open).compose(ctx, nil, true)
-		},
-	}
-}
-
-// assignmentAccountsRetry is how long a settle that failed waits before it tries again.
-var assignmentAccountsRetry = 30 * time.Second
-
-// untilSettled runs settle until it works or ctx ends: a failure, or a controller not holding the lease, is said and
-// tried again every assignmentAccountsRetry, never dropped, since no later write of the key may come.
-func untilSettled(ctx context.Context, what string, settle func(context.Context) (string, error)) {
-	for {
-		said, err := settle(ctx)
-		if err == nil {
-			if said != "" {
-				for _, line := range strings.Split(said, "\n") {
-					fmt.Printf("assignments: %s\n", line)
-				}
-			}
-			return
-		}
-		if ctx.Err() != nil {
-			return
-		}
-		fmt.Printf("assignments: %s: %v; tried again in %s\n", what, err, assignmentAccountsRetry)
-		select {
-		case <-ctx.Done():
-			return
-		case <-time.After(assignmentAccountsRetry):
-		}
-	}
-}
-
-// watchAssignmentAccounts settles every assignment of the assignments bucket that comes to stand, for as long as ctx: the
-// bucket's current values first (the start's look, settled as not fresh), then each write. A watch that ends, or a
-// bucket not there yet, is watched again a minute later.
-func watchAssignmentAccounts(ctx context.Context, open *stores) {
-	steps := liveAssignmentAccountSteps(open)
-	goServing(ctx, func() {
-		runAssignmentWatches(ctx, open.inventory.WatchAssignments, func(a chain.Assignment) {
-			inBackground(ctx, func() {
-				untilSettled(ctx, a.Module+" on "+a.Node, func(ctx context.Context) (string, error) {
-					return steps.settle(ctx, a.Node, a.Module)
-				})
-			})
-		}, func(look []chain.Assignment) {
-			// The start's look, once in the process: one reading of the catalogue, one assignment after another,
-			// then one composition of the bus's node and the grants (issues 1945 and 1277).
-			inBackground(ctx, func() {
-				untilSettled(ctx, "the start's look", func(ctx context.Context) (string, error) {
-					return steps.look(ctx, look)
-				})
-			})
-		}, func() bool {
-			select {
-			case <-ctx.Done():
-				return false
-			case <-time.After(time.Minute):
-				return true
-			}
-		})
-	})
-}
-
-// runAssignmentWatches watches the assignments again each time a watch ends, until ctx ends or pause says stop: each
-// assignment that comes to stand is handed to fresh, and the standing ones of the first watch that reads them all (its
-// Caught mark) to look, once. A watch that ends, or fails to open, before the start's look ran is no start's look: the
-// next one is, with what it hears from nothing (a fresh assignmentTurns), so no key it handed is dropped and no burst of
-// fresh settles replaces the look (the review of issue 1945).
-func runAssignmentWatches(ctx context.Context, watch func(context.Context) (<-chan chain.Entry, error),
-	fresh func(chain.Assignment), look func([]chain.Assignment), pause func() bool) {
-	turns := &assignmentTurns{}
-	first := true
-	for {
-		var atStart []chain.Assignment
-		if err := watchAssignmentsOnce(ctx, watch, turns, first, func(a chain.Assignment, isFresh bool) {
-			if !isFresh {
-				atStart = append(atStart, a)
-				return
-			}
-			fresh(a)
-		}, func() {
-			first = false
-			look(atStart)
-			atStart = nil
-		}); err != nil && ctx.Err() == nil {
-			fmt.Printf("assignments: the assignments are not heard, so a new assignment's bus accounts wait: %v\n", err)
-		}
-		if first {
-			turns = &assignmentTurns{} // the start's look has not run: the next watch hears every standing key anew
-		}
-		if ctx.Err() != nil || !pause() {
-			return
-		}
-	}
-}
-
-// watchAssignmentsOnce watches the assignments until the watch or ctx ends, handing each assignment that comes to stand
-// to settle. On the process's first watch, the current values are the start's look (not fresh) and read is called once
-// they are all handed (the chain's Caught mark); every other value, and every value of a watch opened again after one
-// ended, is fresh: an assignment that came to stand while no watch heard it is settled whole, never as the start's look
-// (the review of issue 1945).
-func watchAssignmentsOnce(ctx context.Context, watch func(context.Context) (<-chan chain.Entry, error),
-	turns *assignmentTurns, first bool, settle func(a chain.Assignment, fresh bool), read func()) error {
-	ctx, stop := context.WithCancel(ctx)
-	defer stop()
-	entries, err := watch(ctx)
-	if err != nil {
-		return err
-	}
-	current := true
-	for {
-		select {
-		case <-ctx.Done():
-			return nil
-		case e, ok := <-entries:
-			if !ok {
-				if ctx.Err() != nil {
-					return nil
-				}
-				return fmt.Errorf("the watch ended")
-			}
-			if e.Caught {
-				if current {
-					current = false // the current values are read: what follows is written from now on
-					if first {
-						read()
-					}
-				}
-				continue
-			}
-			var value []byte
-			if !e.Deleted {
-				value = e.Value
-			}
-			if a, turned := turns.heard(e.Key, value); turned {
-				settle(a, !current || !first)
-			}
-		}
-	}
-}
-
-// staleAccounts is, by node, each module some account of which stands on a node where the module no longer resolves:
-// the accounts of a module's own, its processes' and its provisioner client's. A node whose resolution is unknown is
-// left alone.
-func staleAccounts(users map[string]inventory.BusUser, resolved map[string]map[string]bool) map[string][]string {
-	seen := map[string]map[string]bool{}
-	for _, u := range users {
-		switch u.Kind {
-		case inventory.BusModule, inventory.BusNodeTools, inventory.BusProcess, inventory.BusProvisioner:
-		default:
-			continue
-		}
-		on, known := resolved[u.Node]
-		if u.Node == "" || u.Module == "" || !known || on[u.Module] {
-			continue
-		}
-		if seen[u.Node] == nil {
-			seen[u.Node] = map[string]bool{}
-		}
-		seen[u.Node][u.Module] = true
-	}
-	out := map[string][]string{}
-	for node, modules := range seen {
-		out[node] = slices.Sorted(maps.Keys(modules))
-	}
-	return out
-}
-
-// forgetStaleAccounts forgets the accounts of every module on a node where it no longer resolves (assigned or
-// required), from each node's own resolution; a node that does not resolve is left alone.
-func forgetStaleAccounts(ctx context.Context, open *stores) ([]string, error) {
-	inv := open.inventory
-	users, err := inv.BusUsers(ctx)
-	if err != nil {
-		return nil, err
-	}
-	ctx = withInputCache(ctx) // one reading of the mesh for every node resolved
-	resolved := map[string]map[string]bool{}
-	for _, u := range users {
-		if _, done := resolved[u.Node]; done || u.Node == "" {
-			continue
-		}
-		plan, _, err := resolveNode(ctx, open, u.Node)
-		if err != nil {
-			continue // unknown: nothing of this node is forgotten
-		}
-		on := map[string]bool{}
-		for _, m := range plan.Modules {
-			on[m.Module] = true
-		}
-		resolved[u.Node] = on
-	}
-	var lines []string
-	stale := staleAccounts(users, resolved)
-	for _, node := range slices.Sorted(maps.Keys(stale)) {
-		for _, module := range stale[node] {
-			forgot, err := inv.ForgetBusAccountsOf(ctx, node, module, true)
-			if err != nil {
-				return lines, err
-			}
-			if len(forgot) > 0 {
-				lines = append(lines, fmt.Sprintf("%s no longer runs on %s: its bus accounts forgotten: %s", module, node,
-					strings.Join(forgot, ", ")))
-			}
-		}
-	}
-	return lines, nil
-}

cmd/mesh-controller/assignment_accounts_test.go

@@ -1,452 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"reflect"
-	"strings"
-	"testing"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/chain"
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// An assignment that comes to stand issues its node's bus accounts and the module's grant (ADR 0543, issue 1945): on
-// 2026-10-25 at 17:19 mesh-build-node and mesh-build-go, built long before, were assigned to ace, and nothing issued
-// ace's accounts nor put them in the bus's user list.
-
-func anAssignmentValue(t *testing.T, a chain.Assignment) []byte {
-	t.Helper()
-	raw, err := json.Marshal(a)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return raw
-}
-
-// Only a write that makes the key stand turns it: a rewrite of a standing assignment (the provisioner's plan kept in its
-// value), an ended one, a pending one or a module only pulled in by another does not. The process's first watch hands
-// the assignments standing when it starts to the start's look (not fresh), says once that they are all read, and hands
-// each assignment written afterwards as fresh; a watch opened again after one ended hands every standing assignment it
-// has not seen stand as fresh and never calls the start's look (the review of issue 1945).
-func TestAnAssignmentThatComesToStand(t *testing.T) {
-	at := time.Date(2026, 10, 25, 16, 19, 42, 0, time.UTC)
-	stands := chain.Assignment{Node: "ace", Module: "mesh-build-node", Assigned: at}
-	ended := stands
-	ended.Ended = at.Add(time.Hour)
-	pending := stands
-	pending.State = chain.StatePending
-	pulled := chain.Assignment{Node: "ace", Module: "mesh-build-node", RequiredBy: "mesh-build-go"}
-	replanned := stands
-	replanned.Provisioning = json.RawMessage(`{"plan":1}`)
-
-	type write struct {
-		value   *chain.Assignment // nil for a delete
-		turning bool
-	}
-	for _, c := range []struct {
-		name   string
-		writes []write
-	}{
-		{"a new assignment turns", []write{{&stands, true}}},
-		{"a rewrite of one that stands does not", []write{{&stands, true}, {&replanned, false}, {&stands, false}}},
-		{"an ended one does not", []write{{&ended, false}}},
-		{"assigned again after it ended turns again", []write{{&stands, true}, {&ended, false}, {&stands, true}}},
-		{"a pending one does not, and turns once made", []write{{&pending, false}, {&stands, true}}},
-		{"a module only pulled in does not", []write{{&pulled, false}}},
-		{"one deleted and written again turns again", []write{{&stands, true}, {nil, false}, {&stands, true}}},
-	} {
-		t.Run(c.name, func(t *testing.T) {
-			turns := &assignmentTurns{}
-			for i, w := range c.writes {
-				var value []byte
-				if w.value != nil {
-					value = anAssignmentValue(t, *w.value)
-				}
-				a, turned := turns.heard("ace.mesh-build-node", value)
-				if turned != w.turning {
-					t.Fatalf("write %d: turned %v, want %v", i, turned, w.turning)
-				}
-				if turned && (a.Node != "ace" || a.Module != "mesh-build-node") {
-					t.Fatalf("write %d: the assignment turned is %s on %s", i, a.Module, a.Node)
-				}
-			}
-		})
-	}
-
-	type handed struct {
-		key   string
-		fresh bool
-	}
-	for _, first := range []bool{true, false} {
-		t.Run(fmt.Sprintf("the watch, first %v", first), func(t *testing.T) {
-			bucket := chain.NewMemory()
-			put := func(a chain.Assignment) {
-				t.Helper()
-				value := anAssignmentValue(t, a)
-				if e, held, _ := bucket.Get(t.Context(), a.Key()); held {
-					if _, err := bucket.Update(t.Context(), a.Key(), value, e.Revision); err != nil {
-						t.Fatal(err)
-					}
-					return
-				}
-				if _, err := bucket.Create(t.Context(), a.Key(), value); err != nil {
-					t.Fatal(err)
-				}
-			}
-			put(chain.Assignment{Node: "g14", Module: "mesh-build-go", Assigned: at})
-			got := make(chan handed, 8)
-			read := make(chan struct{}, 8)
-			ctx, stop := context.WithCancel(t.Context())
-			done := make(chan error, 1)
-			go func() {
-				done <- watchAssignmentsOnce(ctx, bucket.Watch, &assignmentTurns{}, first,
-					func(a chain.Assignment, fresh bool) { got <- handed{a.Key(), fresh} },
-					func() { read <- struct{}{} })
-			}()
-			next := func() handed {
-				t.Helper()
-				select {
-				case h := <-got:
-					return h
-				case <-time.After(5 * time.Second):
-					t.Fatal("nothing handed")
-					return handed{}
-				}
-			}
-			// Standing when the watch opened: the start's look on the first watch, fresh on any other.
-			if h := next(); h != (handed{"g14.mesh-build-go", !first}) {
-				t.Fatalf("the standing assignment was handed %+v", h)
-			}
-			put(chain.Assignment{Node: "g14", Module: "mesh-build-go", Assigned: at, Provisioning: json.RawMessage(`{"plan":2}`)})
-			put(chain.Assignment{Node: "ace", Module: "mesh-build-node", Assigned: at})
-			if h := next(); h != (handed{"ace.mesh-build-node", true}) {
-				t.Fatalf("handed %+v, want ace.mesh-build-node as fresh (and nothing for the rewrite before it)", h)
-			}
-			stop()
-			if err := <-done; err != nil {
-				t.Fatal(err)
-			}
-			if want := map[bool]int{true: 1, false: 0}[first]; len(read) != want {
-				t.Fatalf("the start's look was called %d time(s), want %d", len(read), want)
-			}
-		})
-	}
-	// A first watch that fails to open, or ends before its Caught mark, is no start's look: the next watch is, and hands
-	// every standing assignment to it once, none as fresh (the review of issue 1945: a burst of fresh settles, or keys
-	// handed and dropped).
-	for _, firstWatch := range []string{"fails to open", "ends before its Caught mark"} {
-		t.Run("a first watch that "+firstWatch, func(t *testing.T) {
-			bucket := chain.NewMemory()
-			standing := chain.Assignment{Node: "g14", Module: "mesh-build-go", Assigned: at}
-			if _, err := bucket.Create(t.Context(), standing.Key(), anAssignmentValue(t, standing)); err != nil {
-				t.Fatal(err)
-			}
-			watches := 0
-			watch := func(ctx context.Context) (<-chan chain.Entry, error) {
-				watches++
-				if watches > 1 {
-					return bucket.Watch(ctx)
-				}
-				if firstWatch == "fails to open" {
-					return nil, errors.New("the chain is not open yet")
-				}
-				cut := make(chan chain.Entry, 1)
-				cut <- chain.Entry{Key: standing.Key(), Value: anAssignmentValue(t, standing)}
-				close(cut)
-				return cut, nil
-			}
-			var looks [][]chain.Assignment
-			var fresh []chain.Assignment
-			ctx, stop := context.WithCancel(t.Context())
-			defer stop()
-			runAssignmentWatches(ctx, watch, func(a chain.Assignment) { fresh = append(fresh, a) },
-				func(look []chain.Assignment) { looks = append(looks, look); stop() },
-				func() bool { return ctx.Err() == nil })
-			if len(looks) != 1 || len(looks[0]) != 1 || looks[0][0].Key() != standing.Key() || len(fresh) != 0 {
-				t.Fatalf("after %d watch(es): looks %v, fresh %v; want one look at %s and nothing fresh",
-					watches, looks, fresh, standing.Key())
-			}
-		})
-	}
-}
-
-// settle issues what is missing and then puts it on the bus: the node holding the bus composed (its user list) and the
-// grants written, even when every account was minted before (a module assigned again keeps its account). The start's
-// look reads the catalogue once, issues for each standing assignment, and composes the bus's node and writes the grants
-// once when it looked at any. Neither acts for a controller that does not hold the lease, nor for the controller's own
-// module.
-func TestSettlingAndTheStartsLook(t *testing.T) {
-	ace := func(m string) chain.Assignment { return chain.Assignment{Node: "ace", Module: m} }
-	cases := []struct {
-		name               string
-		look               []chain.Assignment // nil: settle mesh-build-node on ace
-		module             string
-		notHolding         bool
-		issued             bool
-		issueErr, composeE error
-		holder             string
-		wantIssues         int
-		wantComposed       []string
-		wantGrants         bool
-		wantErr            string
-		stale              []string // what forgetting the accounts of modules no longer on their nodes says
-	}{
-		{name: "an account not minted", module: "mesh-build-node", issued: true, holder: "novox", wantIssues: 1,
-			wantComposed: []string{"novox"}, wantGrants: true},
-		{name: "an account minted before: the bus and the grants still", module: "mesh-build-go", holder: "novox",
-			wantIssues: 1, wantComposed: []string{"novox"}, wantGrants: true},
-		{name: "no lease: nothing, and tried again", module: "mesh-build-node", notHolding: true, issued: true,
-			holder: "novox", wantErr: errNotHolding.Error()},
-		{name: "the controller's own module is the terminal's", module: controllerModule, issued: true, holder: "novox"},
-		{name: "no bus holder: the grants still", module: "mesh-build-node", issued: true, wantIssues: 1, wantGrants: true},
-		{name: "an issue that fails is the error, nothing composed", module: "mesh-build-node",
-			issueErr: errors.New("the bus cannot be reached"), holder: "novox", wantIssues: 1, wantErr: "the bus cannot be reached"},
-		{name: "a composition that fails is the error, no grant", module: "mesh-build-node", issued: true, holder: "novox",
-			composeE: errors.New("store refused"), wantIssues: 1, wantComposed: []string{"novox"}, wantErr: "store refused"},
-		{name: "the start's look: each issued, the bus and the grants once",
-			look: []chain.Assignment{ace("mesh-build-node"), ace(controllerModule), ace("mesh-build-go")}, issued: true,
-			holder: "novox", wantIssues: 2, wantComposed: []string{"novox"}, wantGrants: true},
-		{name: "the start's look with every account minted still covers once",
-			look: []chain.Assignment{ace("mesh-build-node"), ace("mesh-build-go")}, holder: "novox", wantIssues: 2,
-			wantComposed: []string{"novox"}, wantGrants: true},
-		{name: "the start's look at nothing does nothing", look: []chain.Assignment{ace(controllerModule)}, holder: "novox"},
-		{name: "the start's look forgets the accounts of modules no longer on their nodes first",
-			look: []chain.Assignment{ace("mesh-build-node")}, holder: "novox", wantIssues: 1, wantComposed: []string{"novox"},
-			wantGrants: true, stale: []string{"mesh-build-go no longer runs on ace: its bus accounts forgotten: ace.mesh-build-go"}},
-	}
-	for _, c := range cases {
-		t.Run(c.name, func(t *testing.T) {
-			var composed []string
-			issues, catalogues, grants := 0, 0, 0
-			forgets := 0
-			steps := assignmentAccountSteps{
-				holds: func(context.Context) bool { return !c.notHolding },
-				forgetStale: func(context.Context) ([]string, error) {
-					forgets++
-					return c.stale, nil
-				},
-				catalogue: func(context.Context) (map[string]catalogue.Manifest, error) {
-					catalogues++
-					return map[string]catalogue.Manifest{}, nil
-				},
-				issue: func(context.Context, map[string]catalogue.Manifest, string, string) (bool, string, error) {
-					issues++
-					if c.issued {
-						return true, "its bus credential issued", c.issueErr
-					}
-					return false, "", c.issueErr
-				},
-				busHolder: func(context.Context) (string, error) { return c.holder, nil },
-				compose: func(_ context.Context, nodes []string) error {
-					composed = append(composed, nodes...)
-					return c.composeE
-				},
-				grants: func(context.Context) error { grants++; return nil },
-			}
-			var said string
-			var err error
-			if c.look != nil {
-				said, err = steps.look(t.Context(), c.look)
-			} else {
-				said, err = steps.settle(t.Context(), "ace", c.module)
-			}
-			if c.wantErr != "" {
-				if err == nil || !strings.Contains(err.Error(), c.wantErr) {
-					t.Fatalf("error %v, want one saying %q", err, c.wantErr)
-				}
-			} else if err != nil {
-				t.Fatal(err)
-			}
-			if issues != c.wantIssues || catalogues > 1 {
-				t.Fatalf("%d issue(s) from %d reading(s) of the catalogue, want %d from at most one", issues, catalogues, c.wantIssues)
-			}
-			if strings.Join(composed, ",") != strings.Join(c.wantComposed, ",") {
-				t.Fatalf("composed %v, want %v", composed, c.wantComposed)
-			}
-			if want := map[bool]int{true: 1}[c.wantGrants]; grants != want {
-				t.Fatalf("grants written %d time(s), want %d", grants, want)
-			}
-			if want := map[bool]int{true: 1}[len(c.look) > 0 && !c.notHolding]; forgets != want {
-				t.Fatalf("forgot stale accounts %d time(s), want %d (only from a reading that holds assignments)", forgets, want)
-			}
-			for _, line := range c.stale {
-				if !strings.Contains(said, line) {
-					t.Fatalf("said %q, want it to say %q", said, line)
-				}
-			}
-			if c.wantGrants && c.wantErr == "" && !strings.Contains(said, "the grants written") {
-				t.Fatalf("said %q, want it to name the grants", said)
-			}
-		})
-	}
-}
-
-// The accounts a module speaks with on a node: the module's own when it reads `broker`, its provisioner client's when
-// it runs one alone, none when its accounts are its processes' or it does not speak on the bus. A process's account is
-// held in the provisioner client's form, named for the process and carrying no claims, and may be issued only when
-// the process declares its own secret broker-<process id> (ADR 0436 §2; issue 1181).
-func TestTheAccountsAModuleSpeaksWithOnANode(t *testing.T) {
-	client := aProvisioner()
-	delete(client.OwnSecrets, "broker")
-	for _, c := range []struct {
-		name string
-		m    catalogue.Manifest
-		user string
-		own  bool
-	}{
-		{"a module reading broker", catalogue.Manifest{Module: "mesh-build-node",
-			OwnSecrets: catalogue.OwnSecrets{"broker": {Path: "/var/lib/mesh-build-node/broker"}}},
-			broker.Principal{Kind: broker.KindModule, Node: "ace", Module: "mesh-build-node"}.Username(), true},
-		{"a module reading broker and running the client", aProvisioner(),
-			broker.Principal{Kind: broker.KindModule, Node: "ace", Module: "mesh-provisioner"}.Username(), true},
-		{"the provisioner client alone", client,
-			broker.Principal{Kind: broker.KindProvisioner, Node: "ace", Module: "mesh-provisioner"}.Username(), true},
-		{"no broker, no client", catalogue.Manifest{Module: "hello-web"}, "", false},
-	} {
-		t.Run(c.name, func(t *testing.T) {
-			user, own := ownAccountOf(c.m, "ace")
-			if user != c.user || own != c.own {
-				t.Fatalf("got %q %v, want %q %v", user, own, c.user, c.own)
-			}
-		})
-	}
-
-	t.Run("a process's account", func(t *testing.T) {
-		user := broker.Principal{Kind: broker.KindProcess, Node: "novox", Module: "mesh-mail", Process: "send"}.Username()
-		if user != "novox.mesh-mail.send" {
-			t.Fatalf("the process's username: %q", user)
-		}
-		held, err := heldProcessAccount(broker.Broker{Fingerprint: "abc"}, "novox.example:4222", "novox", "mesh-mail",
-			user, "a-password")
-		if err != nil {
-			t.Fatal(err)
-		}
-		var got map[string]any
-		if err := json.Unmarshal(held, &got); err != nil {
-			t.Fatal(err)
-		}
-		want := map[string]any{"url": "nats://novox.example:4222", "fingerprint": "abc", "node": "novox",
-			"module": "mesh-mail", "user": "novox.mesh-mail.send", "password": "a-password"}
-		for k, v := range want {
-			if got[k] != v {
-				t.Errorf("%s: %v, want %v", k, got[k], v)
-			}
-		}
-		if len(got) != len(want) {
-			t.Errorf("the held account carries %v; want exactly %v (never claims — a process holds no seat)", got, want)
-		}
-	})
-
-	// An issue mints and seals an account only when it is not issued: no row, or a row with no sealed credential (issue
-	// 1945, live on 2026-10-25 at 20:04: ace's mesh-build-go had a row from 17:19 and no credential), under the lock on
-	// the account; a seal that fails leaves it unsealed for the next issue. A rotation always mints.
-	for _, c := range []struct {
-		name           string
-		only           bool
-		minted, sealed bool
-		sealErr        error
-		want           string
-	}{
-		{"no row: minted unsealed, sealed, marked", true, false, false, nil, "lock mint-unsealed seal mark release"},
-		{"a row sealed: nothing", true, true, true, nil, "lock release"},
-		{"a row with no sealed credential: minted and sealed again", true, true, false, nil, "lock mint-unsealed seal mark release"},
-		{"a seal that fails: not marked", true, false, false, errors.New("the vault did not take it"), "lock mint-unsealed seal release"},
-		{"a rotation mints whatever stands", false, true, true, nil, "mint seal"},
-	} {
-		t.Run("issuing an account: "+c.name, func(t *testing.T) {
-			acts := &anAccountStore{minted: c.minted, sealed: c.sealed}
-			ctx, got := withIssued(t.Context())
-			if c.only {
-				ctx = onlyIfAbsent(ctx)
-			}
-			err := issueAccount(ctx, acts, inventory.BusUser{Username: "ace.mesh-build-go", Kind: inventory.BusModule},
-				func(password string) error {
-					acts.did("seal")
-					if password == "" {
-						t.Error("sealed no password")
-					}
-					return c.sealErr
-				})
-			if (err != nil) != (c.sealErr != nil) {
-				t.Fatalf("error %v, want %v", err, c.sealErr)
-			}
-			if strings.Join(acts.acts, " ") != c.want {
-				t.Fatalf("acts %q, want %q", strings.Join(acts.acts, " "), c.want)
-			}
-			if issued := len(got.list()) == 1; issued != (c.sealErr == nil && strings.Contains(c.want, "seal")) {
-				t.Fatalf("said issued %v", got.list())
-			}
-		})
-	}
-
-	// The accounts of a module that no longer resolves on its node are stale, its provisioner client's among them; a
-	// module still resolved (assigned or required), an account of another kind, and a node whose resolution is unknown
-	// are left alone (issue 1945: ace's mesh-build-go rows from 17:19, marked sealed by migration 0108).
-	t.Run("stale accounts", func(t *testing.T) {
-		u := func(kind, node, module string) inventory.BusUser {
-			return inventory.BusUser{Username: node + "." + module + "." + kind, Kind: kind, Node: node, Module: module}
-		}
-		users := map[string]inventory.BusUser{}
-		for _, b := range []inventory.BusUser{u(inventory.BusModule, "ace", "mesh-build-go"),
-			u(inventory.BusProcess, "ace", "mesh-build-go"), u(inventory.BusProvisioner, "ace", "mesh-provisioner"),
-			u(inventory.BusModule, "ace", "mesh-build-node"), u(inventory.BusNode, "ace", ""),
-			u(inventory.BusModule, "g14", "mesh-build-go")} {
-			users[b.Username] = b
-		}
-		got := staleAccounts(users, map[string]map[string]bool{"ace": {"mesh-build-node": true}})
-		if want := map[string][]string{"ace": {"mesh-build-go", "mesh-provisioner"}}; !reflect.DeepEqual(got, want) {
-			t.Fatalf("stale %v, want %v", got, want)
-		}
-	})
-
-	t.Run("a process may be issued only with its own broker secret", func(t *testing.T) {
-		// mesh-mail's real shape: no `broker` of its own, its process declaring bus (review round 1 of issue 1181).
-		if err := mayIssue(mailSenderWithProcess()); err != nil {
-			t.Fatalf("a module with no broker of its own, whose process declares bus, was refused: %v", err)
-		}
-		m := mailSenderWithProcess()
-		delete(m.OwnSecrets, "broker-send")
-		err := mayIssue(m)
-		if err == nil {
-			t.Fatal("a process with no broker-<id> own secret was issued an account")
-		}
-		for _, want := range []string{"mesh-mail", "send", "broker-send", "own-secrets"} {
-			if !strings.Contains(err.Error(), want) {
-				t.Errorf("the refusal does not say %q: %v", want, err)
-			}
-		}
-	})
-}
-
-// anAccountStore is an accountIssuer that writes down what was asked of it.
-type anAccountStore struct {
-	minted, sealed bool
-	acts           []string
-}
-
-func (a *anAccountStore) did(act string) { a.acts = append(a.acts, act) }
-func (a *anAccountStore) LockBusAccount(context.Context, string) (func(), error) {
-	a.did("lock")
-	return func() { a.did("release") }, nil
-}
-func (a *anAccountStore) BusAccountIssued(context.Context, string) (bool, bool, error) {
-	return a.minted, a.sealed, nil
-}
-func (a *anAccountStore) MintBusPassword(context.Context, inventory.BusUser) (string, error) {
-	a.did("mint")
-	return "a-password", nil
-}
-func (a *anAccountStore) MintBusPasswordUnsealed(context.Context, inventory.BusUser) (string, error) {
-	a.did("mint-unsealed")
-	return "a-password", nil
-}
-func (a *anAccountStore) MarkBusAccountSealed(context.Context, string) error {
-	a.did("mark")
-	return nil
-}

cmd/mesh-controller/bindings.go

@@ -1,127 +0,0 @@
-package main
-
-import (
-	"context"
-	"fmt"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"github.com/novox/mesh-controller/internal/conditions"
-)
-
-// A binding to data moves only by a person (novox/hq ADR 0232, issue 273).
-//
-// The resolver keeps each consumer of a provision that keeps its data at the provider it was last
-// sent (catalogue/bound.go) and says what it would have moved. This is where that is said: on the
-// push that composed it, and by the self-check's D12 every run, as an urgent condition naming the
-// consumer, both providers and the pin that confirms the move.
-
-// The condition kinds of D12.
-const (
-	// kindBindingKept is a move the resolver refused: the consumer is still where its data is.
-	kindBindingKept = "binding-kept"
-	// kindBindingMoved is a consumer about to be sent another provider than the one on record with
-	// no pin naming it — what the resolver exists to make impossible, said if it ever is not.
-	kindBindingMoved = "binding-moved"
-	// kindBindingMoving is a move a pin asked for, not yet sent: a person's act, said so that the
-	// data is moved before the push that carries it.
-	kindBindingMoving = "binding-moving"
-)
-
-// probeBindingsID is the self-check's id for this probe, and the source of what it raises.
-const probeBindingsID = "D12"
-
-// keptObservation is the urgent condition for one refused move.
-func keptObservation(k catalogue.KeptBinding) conditions.Observation {
-	return conditions.Observation{Scope: conditions.ScopeMachine, ID: bindingID(k.Machine, k.Consumer, k.Provision),
-		Token: kindBindingKept, Kind: kindBindingKept, Machine: k.Machine, Also: otherMachines(k.Machine, k.Bound.Node, k.Would.Node),
-		Severity: conditions.Urgent, Resolver: conditions.ResolverOperator,
-		Summary: fmt.Sprintf("on %s, the mesh %s", k.Machine, k.String())}
-}
-
-func bindingID(machine, consumer, provision string) string {
-	return machine + "." + consumer + "." + provision
-}
-
-func otherMachines(machine string, nodes ...string) []string {
-	var out []string
-	seen := map[string]bool{machine: true}
-	for _, n := range nodes {
-		if n != "" && !seen[n] {
-			seen[n] = true
-			out = append(out, n)
-		}
-	}
-	return out
-}
-
-// probeBindings is D12: every consumer of a provision that keeps its data is bound where it was last
-// sent, on every machine — the resolver kept it there (said, urgent, until a person pins), or a pin
-// moves it (said, so the data goes first), and never anything else.
-func probeBindings(ctx context.Context, d *doctor) ([]conditions.Observation, error) {
-	// One reading of the mesh for every machine this looks at.
-	ctx = withInputCache(ctx)
-	inv := d.open.inventory
-	nodes, err := inv.Nodes(ctx)
-	if err != nil {
-		return nil, err
-	}
-	var out []conditions.Observation
-	for _, n := range nodes {
-		plan, _, err := resolveNode(ctx, d.open, n.Name)
-		if err != nil {
-			if unresolvable(err) {
-				// D1 says it, with the binding that refused it when that is why.
-				continue
-			}
-			return nil, fmt.Errorf("%s cannot be worked out: %w", n.Name, err)
-		}
-		bound, err := inv.BindingsFor(ctx, n.Name)
-		if err != nil {
-			return nil, err
-		}
-		pins, err := inv.PinsFor(ctx, n.Name)
-		if err != nil {
-			return nil, err
-		}
-		out = append(out, bindingFindings(plan, bound, pins)...)
-	}
-	return out, nil
-}
-
-// bindingFindings is what one machine's resolution says against its record.
-func bindingFindings(plan catalogue.Resolution, bound map[string]map[string]catalogue.Chosen,
-	pins map[string]catalogue.Chosen) []conditions.Observation {
-	var out []conditions.Observation
-	for _, k := range plan.Kept {
-		out = append(out, keptObservation(k))
-	}
-	said := map[string]bool{}
-	for _, need := range plan.Needs {
-		if !need.KeepsData || need.ByRecord {
-			continue
-		}
-		was, recorded := bound[need.For][need.Name]
-		now := catalogue.Chosen{Node: need.From, Module: need.Module}
-		if !recorded || was == now || (was.Module == "" && was.Node == now.Node) {
-			continue
-		}
-		id := bindingID(plan.Node, need.For, need.Name)
-		if said[id] {
-			continue
-		}
-		said[id] = true
-		o := conditions.Observation{Scope: conditions.ScopeMachine, ID: id, Machine: plan.Node,
-			Also: otherMachines(plan.Node, was.Node, now.Node), Resolver: conditions.ResolverOperator}
-		if pin, pinned := pins[need.Name]; pinned && pin.Node == now.Node && (pin.Module == "" || pin.Module == now.Module) {
-			o.Token, o.Kind, o.Severity = kindBindingMoving, kindBindingMoving, conditions.Warning
-			o.Summary = fmt.Sprintf("on %s, %s's %s moves from %s to %s at the next push, by the pin — its data "+
-				"is on %s: move it first", plan.Node, need.For, need.Name, was, now, was)
-		} else {
-			o.Token, o.Kind, o.Severity = kindBindingMoved, kindBindingMoved, conditions.Urgent
-			o.Summary = fmt.Sprintf("on %s, %s's %s would be sent %s, and it is bound to %s, where its data is, "+
-				"with no pin naming %s — a move nothing asked for", plan.Node, need.For, need.Name, now, was, now)
-		}
-		out = append(out, o)
-	}
-	return out
-}

cmd/mesh-controller/bindings_integration_test.go

@@ -1,102 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"strings"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"github.com/novox/mesh-controller/internal/conditions"
-)
-
-func TestTheIncidentAConsumerStaysBesideItsDataUntilAPersonPinsIt(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	inv := open.inventory
-	if _, err := inv.SeedSeats(ctx, catalogue.DefaultSeats()); err != nil {
-		t.Fatal(err)
-	}
-	for _, m := range storeManifests() {
-		register(t, open, m)
-	}
-	assignAll := func(pairs ...[2]string) {
-		for _, a := range pairs {
-			if _, err := assign(ctx, open, a[0], a[1]); err != nil {
-				t.Fatalf("assign %s %s: %v", a[0], a[1], err)
-			}
-		}
-	}
-	// The anchor's store and resolver hold the mesh's seats, on record; the laptop runs its own of each.
-	assignAll([2]string{"anchor", "store"}, [2]string{"anchor", "resolver"})
-	for _, seat := range [][2]string{{"mesh-store", "store"}, {"mesh-dns-resolver", "resolver"}} {
-		if err := inv.HoldSeat(ctx, seat[0], catalogue.ScopeMesh, "anchor", seat[1]); err != nil {
-			t.Fatal(err)
-		}
-	}
-	assignAll([2]string{"laptop", "store"}, [2]string{"laptop", "resolver"}, [2]string{"laptop", "network"},
-		[2]string{"laptop", "board"})
-
-	plan, _, err := resolveNode(ctx, open, "laptop")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if n := need(t, plan, "board", "postgres-database"); n.From != "laptop" || n.Module != "store" || !n.KeepsData {
-		t.Fatalf("the consumer was bound to %s/%s (keeps data: %v); its data is beside it", n.From, n.Module, n.KeepsData)
-	}
-	if n := need(t, plan, "network", "wildcard-resolution"); n.From != "anchor" || n.KeepsData {
-		t.Fatalf("the resolver was bound to %s (keeps data: %v); its seat is held on anchor (issue 258)", n.From, n.KeepsData)
-	}
-
-	// Sent, and recorded: only the binding to data.
-	bindings := boundToData(plan, nil)
-	if len(bindings) != 1 || bindings[0].Provider != (catalogue.Chosen{Node: "laptop", Module: "store"}) {
-		t.Fatalf("recorded %+v", bindings)
-	}
-	if err := inv.RecordBindings(ctx, "laptop", bindings); err != nil {
-		t.Fatal(err)
-	}
-	if found, err := probeBindings(ctx, &doctor{open: open}); err != nil || len(found) != 0 {
-		t.Fatalf("a mesh bound where it was sent: %+v, %v", found, err)
-	}
-
-	// The laptop's store taken away: refused, not moved to the anchor's empty one.
-	if err := inv.Unassign(ctx, "laptop", "store"); err != nil {
-		t.Fatal(err)
-	}
-	if _, _, err := resolveNode(ctx, open, "laptop"); err == nil || !unresolvable(err) ||
-		!strings.Contains(err.Error(), "board on laptop is bound to laptop/store") ||
-		!strings.Contains(err.Error(), "pin laptop postgres-database anchor store") {
-		t.Fatalf("the consumer's store went and it was answered elsewhere: %v", err)
-	}
-
-	// A person pins the anchor's: it moves, said before it is sent, and the record keeps where it was.
-	if err := inv.PinProvision(ctx, "laptop", "postgres-database", "anchor", "store"); err != nil {
-		t.Fatal(err)
-	}
-	plan, _, err = resolveNode(ctx, open, "laptop")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if n := need(t, plan, "board", "postgres-database"); n.From != "anchor" {
-		t.Fatalf("pinned to the anchor and bound to %s", n.From)
-	}
-	found, err := probeBindings(ctx, &doctor{open: open})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(found) != 1 || found[0].Kind != kindBindingMoving || found[0].Severity != conditions.Warning ||
-		!strings.Contains(found[0].Summary, "board's postgres-database moves from laptop/store to anchor/store") {
-		t.Fatalf("a pinned move is not said before it is sent: %+v", found)
-	}
-	if err := inv.RecordBindings(ctx, "laptop", boundToData(plan, nil)); err != nil {
-		t.Fatal(err)
-	}
-	all, err := inv.Bindings(ctx)
-	if err != nil || len(all) != 1 || all[0].MovedFrom != "laptop/store" {
-		t.Fatalf("%+v, %v", all, err)
-	}
-	if found, err := probeBindings(ctx, &doctor{open: open}); err != nil || len(found) != 0 {
-		t.Fatalf("a move sent is still said: %+v, %v", found, err)
-	}
-}

cmd/mesh-controller/bindings_test.go

@@ -1,77 +0,0 @@
-package main
-
-import (
-	"strings"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"github.com/novox/mesh-controller/internal/conditions"
-)
-
-// novox/hq issue 273, ADR 0232: a consumer of a provision that keeps its data moves only by a pin.
-
-func storeManifests() []catalogue.Manifest {
-	return []catalogue.Manifest{
-		{Module: "store", Version: "1",
-			Provides: []catalogue.Offer{{Name: "postgres-database", Scope: catalogue.ScopeMesh}},
-			Claims:   []catalogue.Claim{{Name: "mesh-store", Scope: catalogue.ScopeMesh}},
-			Serves:   map[string]map[string]any{"postgres-database": {"port": 5432}},
-			Grants:   map[string]string{"postgres-database": "/var/lib/mesh/store/grants"}},
-		{Module: "resolver", Version: "1",
-			Provides: []catalogue.Offer{{Name: "wildcard-resolution", Scope: catalogue.ScopeMesh}},
-			Claims:   []catalogue.Claim{{Name: "mesh-dns-resolver", Scope: catalogue.ScopeMesh}}},
-		{Module: "network", Version: "1", Requires: []string{"wildcard-resolution"}},
-		{Module: "board", Version: "1", Requires: []string{"postgres-database"}},
-	}
-}
-
-func need(t *testing.T, plan catalogue.Resolution, consumer, provision string) catalogue.Needed {
-	t.Helper()
-	for _, n := range plan.Needs {
-		if n.For == consumer && n.Name == provision {
-			return n
-		}
-	}
-	t.Fatalf("no %s for %s: %+v", provision, consumer, plan.Needs)
-	return catalogue.Needed{}
-}
-
-// The incident through the stores: the laptop runs its own store and a consumer of it, the anchor's
-// store holds the mesh's seat. The consumer stays beside its data, the resolver follows its seat, the
-// binding is recorded as sent, and a pin — only a pin — moves it, said before the push that carries it.
-
-// What one machine's resolution says against its record.
-func TestBindingFindingsSayAKeptMoveAndAMoveNothingAskedFor(t *testing.T) {
-	home, anchor := catalogue.Chosen{Node: "home", Module: "store"}, catalogue.Chosen{Node: "anchor", Module: "store"}
-	plan := catalogue.Resolution{Node: "laptop",
-		Kept: []catalogue.KeptBinding{{Machine: "laptop", Consumer: "board", Provision: "postgres-database",
-			Bound: home, Would: anchor}},
-		Needs: []catalogue.Needed{
-			{Name: "postgres-database", For: "board", From: "home", Module: "store", KeepsData: true},
-			{Name: "postgres-database", For: "game", From: "anchor", Module: "store", KeepsData: true},
-			{Name: "wildcard-resolution", For: "network", From: "anchor", Module: "resolver"},
-		}}
-	bound := map[string]map[string]catalogue.Chosen{
-		"board":   {"postgres-database": home},
-		"game":    {"postgres-database": home},
-		"network": {"wildcard-resolution": {Node: "home", Module: "resolver"}},
-	}
-	found := linted(bindingFindings(plan, bound, nil))
-	if len(found) != 2 {
-		t.Fatalf("found %+v", found)
-	}
-	kept, moved := found[0], found[1]
-	if kept.Kind != kindBindingKept || kept.Severity != conditions.Urgent || kept.Machine != "laptop" ||
-		!strings.Contains(kept.Summary, "would move board's postgres-database from home/store to anchor/store") ||
-		!strings.Contains(kept.Summary, "its data is on home/store") ||
-		!strings.Contains(kept.Summary, "`pin laptop postgres-database anchor store` to confirm a move (and move the data first)") {
-		t.Errorf("kept: %+v", kept)
-	}
-	if moved.Kind != kindBindingMoved || moved.Severity != conditions.Urgent ||
-		!strings.Contains(moved.Summary, "game's postgres-database would be sent anchor/store") {
-		t.Errorf("moved: %+v", moved)
-	}
-	if kept.Key() == moved.Key() {
-		t.Error("two consumers, one condition")
-	}
-}

cmd/mesh-controller/board.go

@@ -1,324 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"flag"
-	"fmt"
-	"html/template"
-	"net/http"
-	"sort"
-	"strings"
-	"time"
-)
-
-// boardCommand serves the three questions as a page.
-//
-// **It reads through the same functions everything else does and holds nothing**
-// (novox/hq 03-DESIGN/01-to-be/11-a-board.md). The board being replaced is one service that reads
-// every context's database directly — [ADR 0008](novox/hq) violated by the one component with a
-// reason to violate it, and the cost is that a boundary nothing may cross can move, while one
-// thing crossing it is enough to freeze it. A board that reads the provisioning tables is a board
-// that breaks when provisioning changes its tables, and the change then gets weighed against the
-// board.
-//
-// **It stores nothing of its own.** No cache that can disagree, no table of what the mesh looked
-// like last time. Every request reads the mesh now; if that is slow, the answer belongs in the
-// context that owns it, where everything else asking gets it too.
-//
-// **Reading is the whole of it.** Every action a board could offer already exists as a command,
-// and a button that does something no command does is a second implementation of a decision.
-func boardCommand(ctx context.Context, args []string) error {
-	set := flag.NewFlagSet("board", flag.ContinueOnError)
-	// The private network, not everything. A board says which machines are broken and what they
-	// are running, which is exactly the map somebody attacking this would like — and there is no
-	// reason for it to be reachable from further away than the mesh.
-	listen := set.String("listen", "127.0.0.1:8080", "where to serve it")
-	if _, err := parseAround(set, args); err != nil {
-		return err
-	}
-
-	server := &http.Server{
-		Addr:              *listen,
-		ReadHeaderTimeout: 10 * time.Second,
-		Handler:           board(),
-	}
-	fmt.Printf("the board is on http://%s\n", *listen)
-	fmt.Printf("  it reads the mesh on every request and keeps nothing\n")
-
-	go func() {
-		<-ctx.Done()
-		closing, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-		defer cancel()
-		_ = server.Shutdown(closing)
-	}()
-	if err := server.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
-		return err
-	}
-	return nil
-}
-
-// board is the handler, separate so a test can drive it without a listener.
-func board() http.Handler {
-	mux := http.NewServeMux()
-	mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path != "/" {
-			http.NotFound(w, r)
-			return
-		}
-		asked, err := ask(r.Context())
-		if err != nil {
-			// **Said, not blank.** A board that cannot reach the mesh and renders an empty page
-			// says "nothing is wrong" in the one situation where nobody can know that.
-			w.Header().Set("Content-Type", "text/html; charset=utf-8")
-			w.WriteHeader(http.StatusServiceUnavailable)
-			_ = page.Execute(w, view{Unreachable: err.Error()})
-			return
-		}
-		w.Header().Set("Content-Type", "text/html; charset=utf-8")
-		if err := page.Execute(w, asked); err != nil {
-			// The page is half-written by now; there is nothing useful left to say to the
-			// browser, and saying it here is what stops the failure being silent.
-			fmt.Printf("the board could not render: %v\n", err)
-		}
-	})
-	// The same answers for something that is not a person, from the same read. A board and a
-	// script disagreeing about which machine is broken would be worse than either alone.
-	mux.HandleFunc("/mesh.json", func(w http.ResponseWriter, r *http.Request) {
-		open, err := openStores(r.Context())
-		if err != nil {
-			http.Error(w, err.Error(), http.StatusServiceUnavailable)
-			return
-		}
-		defer open.Close()
-		asked, err := theThreeQuestions(r.Context(), open)
-		if err != nil {
-			http.Error(w, err.Error(), http.StatusServiceUnavailable)
-			return
-		}
-		body, err := statusAsJSON(asked)
-		if err != nil {
-			http.Error(w, err.Error(), http.StatusInternalServerError)
-			return
-		}
-		w.Header().Set("Content-Type", "application/json")
-		_, _ = w.Write(append(body, '\n'))
-	})
-	return mux
-}
-
-// ask reads the mesh for one request.
-func ask(ctx context.Context) (view, error) {
-	open, err := openStores(ctx)
-	if err != nil {
-		return view{}, err
-	}
-	defer open.Close()
-
-	asked, err := theThreeQuestions(ctx, open)
-	if err != nil {
-		return view{}, err
-	}
-	return viewOf(asked), nil
-}
-
-// view is what the page is given. Nothing is derived here that the reader could not derive.
-type view struct {
-	Unreachable string
-	Machines    int
-	Broken      []brokenMachine
-	Quiet       []quietMachine
-	Behind      []staleModule
-	Waiting     []waitingMachine
-	// Unresolved is every machine that cannot be worked out at all. Shown above everything else,
-	// because a machine here is in none of the other lists: nothing was computed for it, so it is
-	// not broken, not quiet and not behind — and a page without this said "all well" about a mesh
-	// where nothing could be sent anywhere.
-	Unresolved []blockedMachine
-	// Network is why the private network could not be computed, when it could not.
-	Network string
-	// Adopted is every node still adopted (novox/hq ADR 0100). Not broken: nothing forces the
-	// flip, so a node left adopted is shown rather than read as converged.
-	Adopted []string
-	At      string
-}
-
-type blockedMachine struct {
-	Node string
-	// Said is the mesh's own words, a line at a time. Every unmet requirement, not the first:
-	// a machine is usually blocked by more than one and fixing one of them changes nothing.
-	Said []string
-}
-
-type waitingMachine struct {
-	Node string
-	// Never told is not out of date: nobody has ever asked this machine to be anything. Same
-	// remedy, different situation, and the page says which.
-	Never bool
-}
-
-type brokenMachine struct {
-	Node string
-	// Outcome is refused or failed, and stays distinct all the way to the page. **Refused means
-	// the machine is exactly as it was and what is wrong is in what was sent; failed means it is
-	// in a state nobody declared and what is wrong is on the machine.** They are fixed in
-	// different places, so one word for both would send half the readers to the wrong one.
-	Outcome string
-	Said    []string
-	When    string
-}
-
-type quietMachine struct {
-	Node string
-	// Heard is "never" or how long ago. Never heard from is not the same as quiet for a while:
-	// one may be a machine that was never sent anything.
-	Heard string
-}
-
-type staleModule struct {
-	Module  string
-	Holds   string
-	Source  string
-	Running []string
-}
-
-func viewOf(asked answers) view {
-	out := view{Machines: len(asked.nodes), At: time.Now().Format("15:04:05"),
-		Network: asked.network, Adopted: adoptedNodes(asked.nodes)}
-	var blocked []string
-	for name := range asked.refused {
-		blocked = append(blocked, name)
-	}
-	sort.Strings(blocked)
-	for _, name := range blocked {
-		one := blockedMachine{Node: name}
-		for _, line := range strings.Split(strings.TrimRight(asked.refused[name], "\n"), "\n") {
-			one.Said = append(one.Said, strings.TrimSpace(line))
-		}
-		out.Unresolved = append(out.Unresolved, one)
-	}
-	for _, d := range asked.wrong {
-		one := brokenMachine{Node: d.Node, Outcome: d.Outcome,
-			When: d.At.Local().Format("2006-01-02 15:04")}
-		if d.Refused != "" {
-			// The host's own words. It says exactly what it could not accept, and nothing
-			// written here would say it better.
-			one.Said = append(one.Said, firstLine(d.Refused))
-		}
-		for _, f := range d.Failed {
-			one.Said = append(one.Said, f.ID+": "+firstLine(f.Error))
-		}
-		out.Broken = append(out.Broken, one)
-	}
-	for _, n := range asked.quiet {
-		out.Quiet = append(out.Quiet, quietMachine{Node: n.Name, Heard: heardFrom(n)})
-	}
-	for _, m := range asked.waiting {
-		out.Waiting = append(out.Waiting, waitingMachine{Node: m.Node, Never: m.Never})
-	}
-	for module, on := range asked.behind {
-		from := asked.sources[module]
-		out.Behind = append(out.Behind, staleModule{
-			Module: module, Holds: short(from.BuiltFrom), Source: short(from.Head), Running: on,
-		})
-	}
-	return out
-}
-
-// The page. Deliberately one file with no assets: a board that cannot render without fetching
-// something is a board that is blank exactly when the mesh is unwell.
-var page = template.Must(template.New("board").Parse(`<!doctype html>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>the mesh</title>
-<style>
-  :root { color-scheme: light dark; }
-  body { font: 15px/1.5 ui-monospace, SFMono-Regular, Menlo, monospace; margin: 2rem auto;
-         max-width: 52rem; padding: 0 1rem; }
-  h1 { font-size: 1.1rem; font-weight: 600; margin: 0 0 1.5rem; }
-  h2 { font-size: 1rem; font-weight: 600; margin: 2rem 0 .5rem; }
-  .quiet { opacity: .65; }
-  .said { opacity: .8; padding-left: 1.5rem; }
-  .outcome { display: inline-block; min-width: 4.5rem; }
-  .refused { color: #b26b00; }
-  .failed { color: #c0392b; }
-  ul { list-style: none; padding: 0; margin: 0; }
-  li { padding: .15rem 0; }
-  footer { margin-top: 3rem; opacity: .6; font-size: .85rem; }
-</style>
-{{if .Unreachable}}
-<h1>the mesh cannot be read</h1>
-<p class="failed">{{.Unreachable}}</p>
-<p class="quiet">This says nothing about whether the mesh is well — only that this page could not
-find out.</p>
-{{else}}
-<h1>{{.Machines}} machine{{if ne .Machines 1}}s{{end}}</h1>
-
-{{if .Unresolved}}
-<h2>Can everything be worked out?</h2>
-<ul>
-  {{range .Unresolved}}
-  <li><span class="outcome failed">blocked</span> <strong>{{.Node}}</strong>
-    {{range .Said}}<div class="said">{{.}}</div>{{end}}
-  </li>
-  {{end}}
-</ul>
-<p class="quiet">Nothing can be sent to a machine here, and it appears in none of the lists below:
-nothing was computed for it, so there is nothing it can be behind.</p>
-{{end}}
-{{if .Network}}
-<p class="failed">The private network could not be computed: {{.Network}}</p>
-{{end}}
-
-<h2>Is anything broken?</h2>
-{{if .Broken}}
-<ul>
-  {{range .Broken}}
-  <li>
-    <span class="outcome {{.Outcome}}">{{.Outcome}}</span>
-    <strong>{{.Node}}</strong> <span class="quiet">{{.When}}</span>
-    {{range .Said}}<div class="said">{{.}}</div>{{end}}
-  </li>
-  {{end}}
-</ul>
-{{else}}<p class="quiet">No. Every machine is doing what it was told.</p>{{end}}
-
-<h2>Is anything not answering?</h2>
-{{if .Quiet}}
-<ul>{{range .Quiet}}<li><strong>{{.Node}}</strong> <span class="quiet">{{.Heard}}</span></li>{{end}}</ul>
-<p class="quiet">Not heard from is not the same as tried and could not — a machine here may be
-new, switched off, or unreachable.</p>
-{{else}}<p class="quiet">No. Every machine has been heard from.</p>{{end}}
-
-<h2>Is anything out of date?</h2>
-{{if .Behind}}
-<ul>
-  {{range .Behind}}
-  <li><strong>{{.Module}}</strong> holds {{.Holds}}, source has {{.Source}}
-    {{if .Running}}<div class="said">running on {{range $i, $n := .Running}}{{if $i}}, {{end}}{{$n}}{{end}}</div>
-    {{else}}<div class="said quiet">assigned to nothing</div>{{end}}
-  </li>
-  {{end}}
-</ul>
-{{else}}<p class="quiet">No. Every module is what its source last had.</p>{{end}}
-
-{{if .Waiting}}
-<ul>
-  {{range .Waiting}}
-  <li><strong>{{.Node}}</strong>
-    {{if .Never}}<span class="quiet">has never been sent anything</span>
-    {{else}}<span class="quiet">is not running what the mesh would send it</span>{{end}}
-  </li>
-  {{end}}
-</ul>
-<p class="quiet">Never told is not out of date: nobody has asked that machine to be anything yet.
-Both are sent by <code>push --behind</code>.</p>
-{{else}}<p class="quiet">Every machine is running what the mesh would send it.</p>{{end}}
-{{if .Adopted}}
-<h2>Which machines are adopted?</h2>
-<ul>{{range .Adopted}}<li><strong>{{.}}</strong> <span class="quiet">adopted — what was found on it is kept until each module is taken</span></li>{{end}}</ul>
-{{end}}
-{{end}}
-
-<footer>Read at {{.At}}. This page holds nothing and changes nothing.</footer>
-`))

cmd/mesh-controller/board_test.go

@@ -1,154 +0,0 @@
-package main
-
-import (
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// Refused and failed stay distinct all the way to the page.
-//
-// **Refused means the machine is exactly as it was and what is wrong is in what was sent; failed
-// means it is in a state nobody declared and what is wrong is on the machine.** They are fixed in
-// different places, so a page saying "error" for both sends half its readers to the wrong one.
-func TestRefusedAndFailedReachThePageAsDifferentThings(t *testing.T) {
-	rendered := render(t, viewOf(answers{
-		nodes: []inventory.Node{{Name: "anchor"}, {Name: "laptop"}},
-		wrong: []inventory.Doing{
-			{Node: "anchor", Outcome: "refused", Refused: "not a declaration this host speaks",
-				At: time.Now()},
-			{Node: "laptop", Outcome: "failed", At: time.Now(),
-				Failed: []inventory.FailedResource{{ID: "web.container", Error: "no such image"}}},
-		},
-	}))
-	// The rendered outcome, not the word anywhere on the page: both words appear in the
-	// stylesheet, so a plain Contains passes whatever the machine actually said. It did.
-	for _, want := range []string{`<span class="outcome refused">refused</span>`,
-		`<span class="outcome failed">failed</span>`} {
-		if !strings.Contains(rendered, want) {
-			t.Fatalf("the page does not distinguish the two — missing %s:\n%s", want, rendered)
-		}
-	}
-	// And the host's own words, which say exactly what it could not accept.
-	for _, want := range []string{"not a declaration this host speaks", "web.container", "no such image"} {
-		if !strings.Contains(rendered, want) {
-			t.Fatalf("the page does not say %q, so a reader must go and ask:\n%s", want, rendered)
-		}
-	}
-}
-
-// Nothing wrong is said, not left blank. An empty page and a well mesh must not look alike.
-func TestAWellMeshSaysSoRatherThanShowingNothing(t *testing.T) {
-	rendered := render(t, viewOf(answers{nodes: []inventory.Node{{Name: "anchor"}}}))
-	for _, want := range []string{
-		"Every machine is doing what it was told",
-		"Every machine has been heard from",
-		"Every module is what its source last had",
-	} {
-		if !strings.Contains(rendered, want) {
-			t.Fatalf("a well mesh does not say %q:\n%s", want, rendered)
-		}
-	}
-}
-
-// A board that cannot reach the mesh must not render an empty page: that says "nothing is wrong"
-// in the one situation where nobody can know it.
-func TestABoardThatCannotReadTheMeshSaysSo(t *testing.T) {
-	rendered := render(t, view{Unreachable: "the store did not answer"})
-	if !strings.Contains(rendered, "the store did not answer") {
-		t.Fatalf("the reason is not on the page:\n%s", rendered)
-	}
-	if strings.Contains(rendered, "Every machine is doing what it was told") {
-		t.Fatal("a board that could not read the mesh reported that the mesh is well")
-	}
-}
-
-// Quiet is not broken, and the page says which it is.
-func TestQuietIsNotReportedAsBroken(t *testing.T) {
-	rendered := render(t, viewOf(answers{
-		nodes: []inventory.Node{{Name: "laptop"}},
-		quiet: []inventory.Node{{Name: "laptop"}},
-	}))
-	if !strings.Contains(rendered, "not the same as tried and could not") {
-		t.Fatalf("the page does not separate quiet from broken:\n%s", rendered)
-	}
-	if !strings.Contains(rendered, "Every machine is doing what it was told") {
-		t.Fatalf("a quiet machine was counted as broken:\n%s", rendered)
-	}
-}
-
-// The page renders what a machine said, and a hostile string in it is not markup.
-//
-// What is on this page comes from machines, and a machine's own words are the whole reason the
-// page is useful. They are also the one thing here that nobody in this repository wrote.
-func TestWhatAMachineSaidIsNotMarkup(t *testing.T) {
-	rendered := render(t, viewOf(answers{
-		nodes: []inventory.Node{{Name: "anchor"}},
-		wrong: []inventory.Doing{{Node: "anchor", Outcome: "refused",
-			Refused: `<script>alert("from the machine")</script>`, At: time.Now()}},
-	}))
-	if strings.Contains(rendered, "<script>alert") {
-		t.Fatalf("a machine's words were rendered as markup:\n%s", rendered)
-	}
-	if !strings.Contains(rendered, "&lt;script&gt;") {
-		t.Fatalf("the words were not shown at all, so the reader cannot see what it said:\n%s", rendered)
-	}
-}
-
-// A module behind its source names the machines running the old one — the part with consequences.
-func TestBeingBehindNamesTheMachinesRunningTheOldOne(t *testing.T) {
-	rendered := render(t, viewOf(answers{
-		nodes:   []inventory.Node{{Name: "laptop"}},
-		behind:  map[string][]string{"web": {"laptop"}},
-		sources: map[string]inventory.Source{"web": {BuiltFrom: "aaaaaaaaaa", Head: "bbbbbbbbbb"}},
-	}))
-	for _, want := range []string{"web", "aaaaaaaa", "bbbbbbbb", "running on laptop"} {
-		if !strings.Contains(rendered, want) {
-			t.Fatalf("the page does not say %q:\n%s", want, rendered)
-		}
-	}
-}
-
-func render(t *testing.T, v view) string {
-	t.Helper()
-	var out strings.Builder
-	if err := page.Execute(&out, v); err != nil {
-		t.Fatal(err)
-	}
-	return out.String()
-}
-
-// The board and the command must answer the same question the same way.
-//
-// A machine not running what the mesh would send it was added to `status` and would have been
-// missing here — which is the one thing this page's design forbids: two answers to the same
-// question, disagreeing, with a person in front of each.
-func TestTheBoardSaysWhichMachinesHaveNotBeenSentWhatTheyShouldBe(t *testing.T) {
-	rendered := render(t, viewOf(answers{
-		nodes: []inventory.Node{{Name: "anchor"}, {Name: "laptop"}},
-		waiting: []inventory.Machine{
-			{Node: "anchor"},
-			{Node: "laptop", Never: true},
-		},
-	}))
-	if !strings.Contains(rendered, "is not running what the mesh would send it") {
-		t.Fatalf("the page does not say a machine is out of date:\n%s", rendered)
-	}
-	// Never told is a different situation with the same remedy, and the page keeps them apart.
-	if !strings.Contains(rendered, "has never been sent anything") {
-		t.Fatalf("the page does not separate never told from out of date:\n%s", rendered)
-	}
-	if !strings.Contains(rendered, "push --behind") {
-		t.Fatalf("the page does not say what sends them:\n%s", rendered)
-	}
-}
-
-// And says so when there is nothing waiting, rather than leaving the question unanswered.
-func TestAMeshWithNothingWaitingSaysSo(t *testing.T) {
-	rendered := render(t, viewOf(answers{nodes: []inventory.Node{{Name: "anchor"}}}))
-	if !strings.Contains(rendered, "Every machine is running what the mesh would send it") {
-		t.Fatalf("the page leaves the question unanswered:\n%s", rendered)
-	}
-}

cmd/mesh-controller/bucket_log_fill.go

@@ -1,207 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"sort"
-
-	"github.com/nats-io/nats.go"
-
-	"github.com/novox/mesh-controller/internal/conditions"
-)
-
-// **A filling bucket or log is said before it is full** (novox/hq ADR 0297 §6, issue 501).
-//
-// A module's bucket and its log each have a cap on the bus, and when either is full the bus refuses
-// the next write: the module stops doing what it writes for, and nothing said so before. On
-// 2026-10-11 the issue tracker's bucket held a sixth of its cap after two days, growing toward a stop
-// nobody would have heard coming. So the self-check reads every module's bucket and log, and one at
-// fillRaiseAt of its cap or more raises a condition naming the module, the bucket or log, and how full
-// it is.
-//
-// **Cleared by observation below fillClearBelow, not below fillRaiseAt**: a bucket or log hovering at
-// its threshold would otherwise be raised and cleared on every run. Between the two, an open condition
-// is kept and none is raised.
-//
-// **One that cannot be read is said, and the rest are still judged.** An unanswered question about one
-// stream is no reason to know nothing of the others: it is a finding of its own, naming the bucket or
-// log and why, and a fill condition already open for it is kept, because not knowing is not a pass.
-
-// The fill thresholds, in percent of a bucket's or log's cap.
-const (
-	fillRaiseAt    = 75
-	fillClearBelow = 70
-)
-
-// The conditions the fill probe raises: one filling, and one that could not be read.
-const (
-	kindBucketOrLogFilling = "bucket-or-log-filling"
-	kindBucketOrLogUnread  = "bucket-or-log-unread"
-)
-
-// probeFillID is the probe's id in the registry.
-const probeFillID = "D-fill"
-
-// bucketOrLog is one module's bucket or log as the fill probe reads it.
-type bucketOrLog struct {
-	Module string
-	// Kind is `bucket` or `log`; Name its local name; Stream the stream it is on the bus.
-	Kind, Name, Stream string
-}
-
-// filled is how full one bucket or log is, read from the bus.
-type filled struct {
-	Bytes, Max uint64
-}
-
-// percent is how full, in whole percent, rounded down.
-func (f filled) percent() uint64 {
-	if f.Max == 0 {
-		return 0
-	}
-	return f.Bytes * 100 / f.Max
-}
-
-// fillKey is where a bucket's or log's fill condition is kept.
-func fillKey(s bucketOrLog) string { return conditions.Key(conditions.ScopeBus, s.Stream, "filling") }
-
-// fillObservation is what one bucket's or log's fill says: a finding at fillRaiseAt or above, and,
-// while its condition is open, at fillClearBelow or above too; nothing otherwise, which is what clears
-// it. The operator's words are the kind's (plain_words.go); the summary and the evidence name the
-// module, the bucket or log, and the fill.
-func fillObservation(s bucketOrLog, f filled, open bool) (conditions.Observation, bool) {
-	if f.Max == 0 {
-		return conditions.Observation{}, false // one with no cap cannot fill
-	}
-	// Compared in bytes, not rounded percent: 74.9% is not 75%.
-	atRaise := f.Bytes*100 >= f.Max*fillRaiseAt
-	aboveClear := f.Bytes*100 >= f.Max*fillClearBelow
-	if !atRaise && !(open && aboveClear) {
-		return conditions.Observation{}, false
-	}
-	pct := f.percent()
-	return conditions.Observation{
-		Scope: conditions.ScopeBus, ID: s.Stream, Token: "filling", Kind: kindBucketOrLogFilling,
-		Severity: conditions.Warning,
-		Summary: fmt.Sprintf("%s's %s %s holds %s of %s, %d%%: at its cap the bus refuses the module's next write",
-			s.Module, s.Kind, s.Name, mibWords(f.Bytes), mibWords(f.Max), pct),
-		Said: fmt.Sprintf("module %s, %s %s (stream %s): %d of %d bytes, %d%%", s.Module, s.Kind, s.Name,
-			s.Stream, f.Bytes, f.Max, pct),
-	}, true
-}
-
-// unreadObservation says one bucket or log could not be read, and why. Asked over the network, so one
-// look can be wrong: raised on the second look in a row (confirm.go).
-func unreadObservation(s bucketOrLog, why error) conditions.Observation {
-	return conditions.Observation{
-		Scope: conditions.ScopeBus, ID: s.Stream, Token: "unread", Kind: kindBucketOrLogUnread,
-		Severity: conditions.Warning, Confirm: true,
-		Summary: fmt.Sprintf("%s's %s %s could not be read, so how full it is is not known", s.Module, s.Kind, s.Name),
-		Said:    fmt.Sprintf("module %s, %s %s (stream %s): %v", s.Module, s.Kind, s.Name, s.Stream, why),
-	}
-}
-
-// keptFilling is an open fill condition said again for a bucket or log that could not be read this
-// time: not knowing how full it is now is no reason to say it has room. Only ever made from a condition
-// read back as open — its own summary and severity, never words made up for it.
-func keptFilling(s bucketOrLog, open conditions.Condition, why error) conditions.Observation {
-	return conditions.Observation{
-		Scope: conditions.ScopeBus, ID: s.Stream, Token: "filling", Kind: kindBucketOrLogFilling,
-		Severity: open.Severity, Summary: open.Summary,
-		Said: fmt.Sprintf("module %s, %s %s (stream %s): not read this time (%v); kept open as it was",
-			s.Module, s.Kind, s.Name, s.Stream, why),
-	}
-}
-
-// mibWords is a size as a person reads it, in MiB with one decimal.
-func mibWords(b uint64) string {
-	return fmt.Sprintf("%.1f MiB", float64(b)/(1024*1024))
-}
-
-// readFill is how full one bucket or log is on the bus; found false when it is not on the bus.
-type readFill func(ctx context.Context, s bucketOrLog) (f filled, found bool, err error)
-
-// openFill is the fill condition open under a key, if one is, or why it could not be read.
-type openFill func(ctx context.Context, key string) (conditions.Condition, bool, error)
-
-// judgeFills judges every bucket and log on its own: one that cannot be read is said as unread, with
-// its fill condition kept only when that condition was read back and is open — when it cannot be read
-// either, nothing is said of its fill, which the unread finding already covers. Every other is judged
-// by its fill; for one of those, a condition that cannot be read is taken as open, so an unknown never
-// clears a fill measured between fillClearBelow and fillRaiseAt.
-func judgeFills(ctx context.Context, all []bucketOrLog, read readFill, open openFill) []conditions.Observation {
-	var out []conditions.Observation
-	for _, s := range all {
-		f, found, err := read(ctx, s)
-		if err != nil {
-			out = append(out, unreadObservation(s, err))
-			if c, isOpen, cerr := open(ctx, fillKey(s)); cerr == nil && isOpen {
-				out = append(out, keptFilling(s, c, err))
-			}
-			continue
-		}
-		if !found {
-			continue // not on the bus: created on the controller's next raise, and nothing there can fill
-		}
-		_, isOpen, cerr := open(ctx, fillKey(s))
-		isOpen = isOpen || cerr != nil
-		if o, said := fillObservation(s, f, isOpen); said {
-			out = append(out, o)
-		}
-	}
-	sort.SliceStable(out, func(i, j int) bool { return out[i].Key() < out[j].Key() })
-	return out
-}
-
-// declaredBucketsAndLogs is every module's bucket and log the catalogue declares, by its stream.
-func declaredBucketsAndLogs(ctx context.Context, d *doctor) ([]bucketOrLog, error) {
-	buckets, err := d.open.inventory.DeclaredBuckets(ctx)
-	if err != nil {
-		return nil, err
-	}
-	logs, err := d.open.inventory.DeclaredLogs(ctx)
-	if err != nil {
-		return nil, err
-	}
-	var out []bucketOrLog
-	for _, b := range buckets {
-		out = append(out, bucketOrLog{Module: b.Module, Kind: "bucket", Name: b.Name, Stream: "KV_" + b.Bucket()})
-	}
-	for _, l := range logs {
-		out = append(out, bucketOrLog{Module: l.Module, Kind: "log", Name: l.Name, Stream: l.Stream()})
-	}
-	return out, nil
-}
-
-// probeFill reads every module's bucket and log on the bus and says each one filling toward its cap,
-// and each one that could not be read.
-func probeFill(ctx context.Context, d *doctor) ([]conditions.Observation, error) {
-	all, err := declaredBucketsAndLogs(ctx, d)
-	if err != nil {
-		return nil, err
-	}
-	js := d.js.Context()
-	read := func(ctx context.Context, s bucketOrLog) (filled, bool, error) {
-		if err := ctx.Err(); err != nil {
-			return filled{}, false, err
-		}
-		info, err := js.StreamInfo(s.Stream, nats.Context(ctx))
-		switch {
-		case errors.Is(err, nats.ErrStreamNotFound):
-			return filled{}, false, nil
-		case err != nil:
-			return filled{}, false, err
-		case info.Config.MaxBytes <= 0:
-			return filled{}, true, nil
-		}
-		return filled{Bytes: info.State.Bytes, Max: uint64(info.Config.MaxBytes)}, true, nil
-	}
-	open := func(ctx context.Context, key string) (conditions.Condition, bool, error) {
-		if d.keeper == nil {
-			return conditions.Condition{}, false, nil
-		}
-		return d.keeper.Get(ctx, key)
-	}
-	return judgeFills(ctx, all, read, open), nil
-}

cmd/mesh-controller/bucket_log_fill_test.go

@@ -1,165 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"strings"
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/conditions"
-)
-
-// **A filling log or bucket is said at three quarters of its cap and cleared below seven tenths**
-// (novox/hq ADR 0297 §6): raised at 75% naming the module, the bucket or log and its fill; not at 74.9%;
-// kept between 70% and 75% while it is open, and not raised there when it is not; and cleared — said no
-// more — once it reads below 70%, open or not.
-func TestAFillingBucketOrLogIsRaisedAtThreeQuartersAndClearedBelowSevenTenths(t *testing.T) {
-	const mib = 1024 * 1024
-	log := bucketOrLog{Module: "mesh-issues", Kind: "log", Name: "changes", Stream: "LOG_mesh-issues_changes"}
-	bucket := bucketOrLog{Module: "mesh-issues", Kind: "bucket", Name: "issues", Stream: "KV_mesh-issues_issues"}
-	for _, c := range []struct {
-		name  string
-		of    bucketOrLog
-		bytes uint64
-		max   uint64
-		open  bool
-		said  bool
-	}{
-		{"a log at exactly 75%", log, 768 * mib, 1024 * mib, false, true},
-		{"a bucket at exactly 75%", bucket, 48 * mib, 64 * mib, false, true},
-		{"a bucket full", bucket, 64 * mib, 64 * mib, false, true},
-		{"a log just under 75%", log, 768*mib - 1, 1024 * mib, false, false},
-		{"a bucket at 72%, not open", bucket, 64 * mib * 72 / 100, 64 * mib, false, false},
-		{"a bucket at 72%, open: kept", bucket, 64 * mib * 72 / 100, 64 * mib, true, true},
-		{"a log at exactly 70%, open: kept", log, 700 * mib, 1000 * mib, true, true},
-		{"a log just under 70%, open: cleared", log, 700*mib - 1, 1000 * mib, true, false},
-		{"a bucket at 10%, open: cleared", bucket, 64 * mib / 10, 64 * mib, true, false},
-		{"a bucket with no cap", bucket, 100, 0, true, false},
-	} {
-		o, said := fillObservation(c.of, filled{Bytes: c.bytes, Max: c.max}, c.open)
-		if said != c.said {
-			t.Errorf("%s: said %v, want %v", c.name, said, c.said)
-			continue
-		}
-		if !said {
-			continue
-		}
-		if o.Key() != fillKey(c.of) || o.Kind != kindBucketOrLogFilling || o.Severity != conditions.Warning {
-			t.Errorf("%s: raised as %s (%s, %s)", c.name, o.Key(), o.Kind, o.Severity)
-		}
-		for _, part := range []string{c.of.Module, c.of.Kind + " " + c.of.Name, "%", " of "} {
-			if !strings.Contains(o.Summary, part) {
-				t.Errorf("%s: does not name %q: %q", c.name, part, o.Summary)
-			}
-		}
-		if !strings.Contains(o.Said, "bytes") {
-			t.Errorf("%s: the evidence does not say the fill in bytes: %q", c.name, o.Said)
-		}
-	}
-	o, _ := fillObservation(log, filled{Bytes: 800 * mib, Max: 1024 * mib}, false)
-	if !strings.Contains(o.Summary, "800.0 MiB of 1024.0 MiB, 78%") {
-		t.Errorf("the fill is said as %q", o.Summary)
-	}
-}
-
-// **One bucket or log that cannot be read does not stop the others being judged** (review of #231): it is
-// said as unread with its reason, a fill condition open for it is kept, and every other bucket and log
-// is judged by its own fill.
-func TestAnUnreadableBucketOrLogIsSaidAndTheRestAreStillJudged(t *testing.T) {
-	const mib = 1024 * 1024
-	broken := bucketOrLog{Module: "a", Kind: "bucket", Name: "broken", Stream: "KV_a_broken"}
-	brokenOpen := bucketOrLog{Module: "a", Kind: "log", Name: "was-filling", Stream: "LOG_a_was-filling"}
-	full := bucketOrLog{Module: "b", Kind: "log", Name: "changes", Stream: "LOG_b_changes"}
-	empty := bucketOrLog{Module: "c", Kind: "bucket", Name: "quiet", Stream: "KV_c_quiet"}
-	absent := bucketOrLog{Module: "d", Kind: "bucket", Name: "not-yet", Stream: "KV_d_not-yet"}
-	refusal := errors.New("the bus did not answer")
-	read := func(_ context.Context, s bucketOrLog) (filled, bool, error) {
-		switch s {
-		case broken, brokenOpen:
-			return filled{}, false, refusal
-		case full:
-			return filled{Bytes: 900 * mib, Max: 1000 * mib}, true, nil
-		case empty:
-			return filled{Bytes: 1, Max: 64 * mib}, true, nil
-		}
-		return filled{}, false, nil
-	}
-	open := func(_ context.Context, key string) (conditions.Condition, bool, error) {
-		if key == fillKey(brokenOpen) {
-			return conditions.Condition{Key: key, Severity: conditions.Warning,
-				Summary: "a's log was-filling holds 800.0 MiB of 1024.0 MiB, 78%"}, true, nil
-		}
-		return conditions.Condition{}, false, nil
-	}
-	got := map[string]conditions.Observation{}
-	for _, o := range judgeFills(context.Background(), []bucketOrLog{broken, brokenOpen, full, empty, absent}, read, open) {
-		got[o.Key()] = o
-	}
-	for _, s := range []bucketOrLog{broken, brokenOpen} {
-		o, said := got[conditions.Key(conditions.ScopeBus, s.Stream, "unread")]
-		if !said || o.Kind != kindBucketOrLogUnread || !o.Confirm || !strings.Contains(o.Said, refusal.Error()) {
-			t.Errorf("%s could not be read and was said as %+v", s.Stream, o)
-		}
-	}
-	if o, kept := got[fillKey(brokenOpen)]; !kept || !strings.Contains(o.Said, "kept open") {
-		t.Errorf("an open fill condition of a log not read this time was not kept: %+v", o)
-	}
-	if _, said := got[fillKey(broken)]; said {
-		t.Error("a bucket not read and not filling was said filling")
-	}
-	if o, said := got[fillKey(full)]; !said || o.Kind != kindBucketOrLogFilling {
-		t.Errorf("a log at 90%% beside an unreadable one was not judged: %+v", got)
-	}
-	if len(got) != 4 {
-		t.Errorf("said %d findings, want 4 (two unread, one kept, one filling): %v", len(got), got)
-	}
-}
-
-// Both kinds have plain words of their own, which hold to the plain rule (novox/hq ADR 0253).
-func TestAFillingOrUnreadBucketOrLogIsSaidInPlainWords(t *testing.T) {
-	for _, kind := range []string{kindBucketOrLogFilling, kindBucketOrLogUnread} {
-		wording, has := plainWordings[kind]
-		if !has {
-			t.Errorf("%s has no plain words", kind)
-			continue
-		}
-		if why, ok := conditions.PlainWords(wording(conditions.Observation{Kind: kind})); !ok {
-			t.Errorf("%s: %s", kind, why)
-		}
-	}
-}
-
-// **When neither the bucket or log nor its condition can be read, nothing is said of its fill** (second
-// review of #231): the unread finding covers it, and no fill is invented for it. For one that is read and
-// measured between seven tenths and three quarters, a condition that cannot be read is taken as open, so
-// an unknown never clears it.
-func TestNothingIsSaidOfAFillWhenNeitherItNorItsConditionCanBeRead(t *testing.T) {
-	const mib = 1024 * 1024
-	broken := bucketOrLog{Module: "a", Kind: "log", Name: "changes", Stream: "LOG_a_changes"}
-	between := bucketOrLog{Module: "b", Kind: "bucket", Name: "issues", Stream: "KV_b_issues"}
-	read := func(_ context.Context, s bucketOrLog) (filled, bool, error) {
-		if s == broken {
-			return filled{}, false, errors.New("the bus did not answer")
-		}
-		return filled{Bytes: 72 * mib, Max: 100 * mib}, true, nil
-	}
-	open := func(context.Context, string) (conditions.Condition, bool, error) {
-		return conditions.Condition{}, false, errors.New("the conditions bucket did not answer")
-	}
-	got := map[string]conditions.Observation{}
-	for _, o := range judgeFills(context.Background(), []bucketOrLog{broken, between}, read, open) {
-		got[o.Key()] = o
-	}
-	if o, said := got[fillKey(broken)]; said {
-		t.Fatalf("a fill was said for a log whose fill and condition could not be read: %+v", o)
-	}
-	if _, said := got[conditions.Key(conditions.ScopeBus, broken.Stream, "unread")]; !said {
-		t.Error("the log that could not be read was not said as unread")
-	}
-	if _, kept := got[fillKey(between)]; !kept {
-		t.Error("a bucket at 72% whose condition could not be read was cleared")
-	}
-	if len(got) != 2 {
-		t.Errorf("said %d findings, want 2: %v", len(got), got)
-	}
-}

cmd/mesh-controller/build.go

@@ -1,279 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"flag"
-	"fmt"
-	"github.com/novox/mesh-controller/internal/conditions"
-	"io"
-	"os"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// asking a build machine for a module, and what came back.
-//
-// Split out of main.go, which had reached 2,769 lines because appending was always the
-// cheapest next step. That is how novox/hq ADR 0001 records `hal/sdk` reaching 34,636:
-// nothing in it was wrong, and no one edit was the one that should have been a new file.
-
-// buildsCommand says what has been built lately.
-func buildsCommand(ctx context.Context, args []string) error {
-	set := flag.NewFlagSet("builds", flag.ContinueOnError)
-	limit := set.Int("n", 20, "how many to show")
-	positionals, err := parseAround(set, args)
-	if err != nil {
-		return err
-	}
-	module := ""
-	if len(positionals) == 1 {
-		module = positionals[0]
-	} else if len(positionals) > 1 {
-		return errors.New("builds [<module>] [-n N]")
-	}
-
-	open, err := openStores(ctx)
-	if err != nil {
-		return err
-	}
-	defer open.Close()
-	inv := open.inventory
-
-	builds, err := inv.Builds(ctx, module, *limit)
-	if err != nil {
-		return err
-	}
-	if len(builds) == 0 {
-		// Said rather than printed as nothing: an empty list and a failed read must never look
-		// the same, and getting here means the store answered.
-		if module != "" {
-			fmt.Printf("nothing has been built for %s\n", module)
-			return nil
-		}
-		fmt.Println("nothing has been built yet")
-		return nil
-	}
-
-	for _, b := range builds {
-		printBuild(os.Stdout, b)
-	}
-	return nil
-}
-
-// printBuild says one build: what, its outcome, where and when, what it made and published, its reuse key, and its
-// source fingerprint (novox/hq issue 1204: the one tool that reads what the builder recorded it was made from).
-func printBuild(w io.Writer, b inventory.Build) {
-	what := b.Module
-	if what == "" {
-		// It failed before knowing what it was building, which is most of the interesting
-		// failures. The repository is what a person has to go and look at.
-		what = "?"
-	}
-	outcome := "built " + short(b.Commit)
-	if !b.Worked() {
-		outcome = "failed"
-	}
-	fmt.Fprintf(w, "%-18s %-14s %-10s %s  %s\n",
-		what, outcome, b.On, b.At.Local().Format("2006-01-02 15:04"), b.ID)
-	fmt.Fprintf(w, "    %s", b.Repository)
-	if b.Ref != "" {
-		fmt.Fprintf(w, " at %s", b.Ref)
-	}
-	fmt.Fprintln(w)
-	for _, made := range b.Made {
-		fmt.Fprintf(w, "    %-10s %s\n", made.Kind, made.Reference)
-	}
-	// What it published and under what reuse key (novox/hq ADR 0408 §1).
-	if p := b.Published; p != nil {
-		if p.Artifact != "" {
-			fmt.Fprintf(w, "    published  %s\n", p.Artifact)
-		}
-		if p.Package != nil {
-			fmt.Fprintf(w, "    published  %s@%s\n", p.Package.Name, p.Package.Version)
-		}
-	}
-	if b.ReuseKey != "" {
-		fmt.Fprintf(w, "    reuse key  %s\n", b.ReuseKey)
-	}
-	if b.SourceFingerprint != "" {
-		fmt.Fprintf(w, "    source     %s\n", b.SourceFingerprint)
-	}
-	if !b.Worked() {
-		// The builder's own first line. The whole failure is often a build log, and printing
-		// it here would bury every other row.
-		fmt.Fprintf(w, "    %s\n", firstLine(b.Failed))
-	}
-}
-
-// takenBuild is a build the controller judges and registers, whatever told it of the build: build-agent's outcome (the
-// builder's own module's, until R4g, ADR 0453 §5) or the builder's done key (ADR 0501 §1). **One judging for both**:
-// the rules of who may register, the gate a build failed, the predefined keys and the rule that an unchanged build
-// source moves nothing are the same whichever part built it (ADR 0501 §1, §3).
-type takenBuild struct {
-	kept     inventory.Build
-	manifest catalogue.Manifest
-	recorded inventory.Source
-	ask      registrationAsk
-	path     string
-	trunk    string
-	// by and what name the build in what is said: who built it, and what was built ("ace", "novox/mesh-catalog").
-	by, what, commit string
-	// published refuses a build that may not become a module's version (off the trunk, in the scratch namespace);
-	// nil for a key, which is a trunk fingerprint's by construction (ADR 0501 §2).
-	published func() error
-	// carried publishes a list of predefined keys the build carried; nil when it carried none.
-	carried func() error
-}
-
-// registerJudged judges a recorded build and registers its module, or says why not.
-func registerJudged(ctx context.Context, inv *inventory.Inventory, j takenBuild) (catalogue.Manifest, error) {
-	manifest, kept := j.manifest, j.kept
-	notRegistered := func(err error) (catalogue.Manifest, error) {
-		return manifest, fmt.Errorf("%s built %s (%s), recorded and not registered: %w", j.by, manifest.Module,
-			short(j.commit), err)
-	}
-	if err := namesNoInstallation(manifest); err != nil {
-		return manifest, fmt.Errorf("%s built %s (%s), and the mesh does not register it: %w",
-			j.by, j.what, short(j.commit), err)
-	}
-	// **Only from the repository the catalogue builds the module from** (novox/hq ADR 0266): else the trunk
-	// below is the trunk of whatever repository was built, which may be one an agent made — and a module named
-	// `sudo` from it would be what the next push sends. Another repository is the operator's, at the terminal.
-	repoID, err := mayRegisterFrom(ctx, inv, manifest.Module, j.recorded, j.ask, j.path, j.trunk)
-	if err != nil {
-		return notRegistered(err)
-	}
-	if j.published != nil {
-		if err := j.published(); err != nil {
-			return notRegistered(err)
-		}
-	}
-	// Then the module is judged against the list the mesh publishes, as every manifest read again is: one naming a
-	// key that list does not hold, or of another type, is refused here and never enters the catalogue.
-	if j.carried != nil {
-		if err := j.carried(); err != nil {
-			return manifest, err
-		}
-	}
-	if manifest.NamesPredefined() {
-		if _, err := catalogue.ParseManifest(kept.Manifest); err != nil {
-			return notRegistered(fmt.Errorf("judged against the list of predefined keys the mesh publishes, %w", err))
-		}
-	}
-	// **A build whose source is unchanged is never a move** (novox/hq issue 280): a rebuild made from
-	// what the build the mesh stands on was made from registers that build's artifacts at the new
-	// commit, so no machine is sent a new digest for a source nobody changed — an image is not
-	// byte-reproducible, and the bus rebuilt for another module's merge demanded a planned upgrade.
-	if kept.SourceFingerprint != "" {
-		stands, raw, err := inv.StandingBuild(ctx, manifest.Module, kept.ID)
-		if err != nil {
-			return manifest, err
-		}
-		if stands != "" && stands != kept.ID && len(raw) > 0 {
-			if was, err := catalogue.ParseManifest(raw); err == nil && was.Module == manifest.Module {
-				fmt.Printf("%s at %s was made from the source %s was: registered with its artifacts, no move\n",
-					manifest.Module, short(j.commit), stands)
-				manifest = was
-			}
-		}
-	}
-	if err := inv.RegisterModule(ctx, manifest, j.recorded); err != nil {
-		if errors.Is(err, inventory.ErrSuperseded) {
-			return notRegistered(err)
-		}
-		return manifest, err
-	}
-	// A bus process the new definition gains gets its account now, on each machine assigned the module, so the
-	// next push composes a real account (issue 1226).
-	issueGainedProcessAccounts(ctx, inv, manifest)
-	// Which repository it is registered from, by the forge's own id (novox/hq ADR 0266).
-	if err := inv.SetSourceIdentity(ctx, manifest.Module, repoID); err != nil {
-		return manifest, err
-	}
-	// The keep set just moved, and new bytes just landed (novox/hq ADR 0189). Asked here rather
-	// than on a timer of its own: this is the only moment either is true. Never fatal — the build
-	// worked and the module is registered.
-	collect(ctx, inv)
-	return manifest, nil
-}
-
-// answers is what the three questions came back with, read once.
-type answers struct {
-	// notAnnounced are the owners some module reads the state of that have announced nothing yet (novox/hq ADR 0495,
-	// issue 1790): read from `reads` as before until they do; notAnnouncedWhy why that could not be read.
-	notAnnounced    []string
-	notAnnouncedWhy string
-	wrong           []inventory.Doing
-	nodes           []inventory.Node
-	quiet           []inventory.Node
-	behind          map[string][]string
-	sources         map[string]inventory.Source
-	// waiting is every machine not running what the mesh would send it.
-	waiting []inventory.Machine
-	// recordedWaits is, per machine, every move of a recorded module that waits there for a person (novox/hq ADR
-	// 0377 §6): the machine is behind for these, and `push <node>` sends them.
-	recordedWaits map[string][]string
-	// reported is every machine's last word beside when it was last sent a declaration — the
-	// pair that answers "has it caught up", which waiting alone cannot (the sent digest is
-	// recorded at send, not at apply).
-	reported []inventory.Reported
-	// refused is why a machine cannot be worked out at all, by name. A different thing from every
-	// other answer here: those are about a machine that was told something, and this is about one
-	// that cannot be told anything — it never reaches waiting, because nothing was computed for it
-	// to compare against, so without this a wholly blocked mesh reads as a well one.
-	refused map[string]string
-	// network is why the private network could not be computed, when it could not. Almost always
-	// a consequence of the refusals above: a node that does not resolve is not on the network, and
-	// a mesh whose hub is that node has no hub.
-	network string
-	// filtered is every converged machine that is not filtered by the mesh alone (novox/hq ADR
-	// 0168): what filters it beyond the mesh's own, the runtime's plumbing and bans, by name — a
-	// predecessor's chain, a found firewall in force again. Such a machine is not "all well".
-	filtered map[string]inventory.Filtering
-	// untaken is, per machine, each assigned module whose resources the machine is holding as it
-	// found them, and how many — a module that was assigned, sent, and is running none of what it
-	// declares because nothing has taken it (novox/hq ADR 0100, 04-ISSUES/125).
-	//
-	// **Its absence cost an outage.** The module was assigned, the push reported success, this
-	// command said the machine was doing everything it was told, and the module's three containers
-	// did not exist. On the strength of those reports the predecessor's proxy was stopped and every
-	// public name on the machine went dark. The holds were correct; they were recorded only in the
-	// machine's own state file, and the one visible symptom was a count that did not add up.
-	untaken map[string]map[string]int
-	// leftOut is, per machine, every module of its set its composition leaves out, and why (novox/hq issue
-	// 380): assigned and not applied, which every push said only in passing. Not well while there is any.
-	leftOut map[string][]leftOutModule
-	// unheld is every module on a machine whose resources are applied through a seat nothing on
-	// that machine holds (novox/hq ADR 0207), with the modules that could hold it. Reported, not
-	// refused, until the switch — and while there is any, the mesh is not all well: the order the
-	// machines' modules are built in is the mesh's to keep, and this is where it says it is not kept.
-	unheld []catalogue.Unheld
-	// conditions is every open condition (novox/hq to-be 45 §2), urgent first and then oldest first:
-	// what leads status, and what its all-well sentence needs to be none of, silenced ones included.
-	// A provider failing a consumer is one of them (ADR 0224). conditionsUnread says why they could
-	// not be read when they could not — never read as none.
-	conditions       []conditions.Condition
-	conditionsUnread string
-	// overflowing is every module whose identity overflows the bound of a provision it requires
-	// (novox/hq ADR 0225): its provider leaves it out of the grants and composes everything else, so
-	// this is the one place it is said across the mesh. Not well while there is any.
-	overflowing []catalogue.Overflow
-	// handActs is how many acts were done by hand in the last seven days (novox/hq to-be 45 §7), nil
-	// where the log is not on hand; handActsUnread why it could not be read when it could not.
-	handActs       *int
-	handActsUnread string
-	// heals is what the healers did in the last seven days (novox/hq to-be 45 §7): acts, and conditions
-	// handed to the operator; healsUnread why it could not be read.
-	heals       *healsCount
-	healsUnread string
-	// pending is every assignment waiting for its module's build, and every one ended in the last day
-	// (novox/hq issue 325); pendingUnread why they could not be read. One waiting, or one ended other than
-	// applied, is not well: an assignment somebody made is not made yet, or will not be.
-	pending       []inventory.PendingAssignment
-	pendingUnread string
-	// takeIn is the take-in's backlog of done keys on the bus (novox/hq ADR 0544 §6), nil where it cannot be read
-	// (a process with no bus, or a consumer not made yet).
-	takeIn *takeInBacklog
-}

cmd/mesh-controller/build_integration_test.go

@@ -1,131 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"encoding/json"
-	"errors"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-func TestABuildHeardIsRecordedAndRegistered(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	manifest, _ := json.Marshal(map[string]any{"module": "shop", "version": "3"})
-	m, _, err := takeIn(ctx, open.inventory, asTheOperator(t, open.inventory, link.BuildResult{
-		ID: "b-1", Repository: "http://forge.internal:20000/novox/shop.git", Path: "modules/shop",
-		Ref: "main", On: "anchor", Commit: "abcdef0123", Manifest: manifest,
-		Source: &link.SourceOnSeat{Seat: "git", Repository: "novox/shop"},
-	}))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if m.Module != "shop" {
-		t.Fatalf("registered %q", m.Module)
-	}
-	shelf, err := open.inventory.Catalogue(ctx)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, held := shelf["shop"]; !held {
-		t.Fatal("the module a heard build produced is not in the catalogue")
-	}
-	src, err := open.inventory.SourceOf(ctx, "shop")
-	if err != nil || src.Seat != "git" || src.Repository != "novox/shop" || src.BuiltFrom != "abcdef0123" {
-		t.Fatalf("the source is the seat and the path, never the URL: %+v %v", src, err)
-	}
-	builds, err := open.inventory.Builds(ctx, "shop", 5)
-	if err != nil || len(builds) != 1 || builds[0].ID != "b-1" {
-		t.Fatalf("the build is not recorded once: %v %v", builds, err)
-	}
-
-	named, _ := json.Marshal(map[string]any{"module": "idp", "version": "1", "resources": []any{
-		map[string]any{"id": "server", "type": "container", "image": "x@sha256:aa",
-			"env": map[string]any{"KC_HOSTNAME": "https://login.mesh-one.be"}}}})
-	_, _, err = takeIn(ctx, open.inventory, link.BuildResult{
-		ID: "b-2", Repository: "/r", On: "anchor", Commit: "0123456789", Manifest: named})
-	if err == nil || !strings.Contains(err.Error(), "does not register it") {
-		t.Fatalf("a definition naming an installation was taken in: %v", err)
-	}
-	if shelf, _ := open.inventory.Catalogue(ctx); shelf["idp"].Module != "" {
-		t.Fatal("the refused module was registered anyway")
-	}
-	if builds, _ := open.inventory.Builds(ctx, "idp", 5); len(builds) != 1 {
-		t.Fatalf("the refused build was not recorded: %v", builds)
-	}
-
-	_, _, err = takeIn(ctx, open.inventory, link.BuildResult{ID: "b-3", Repository: "/r", On: "anchor", Failed: "no compiler"})
-	if err == nil || !strings.Contains(err.Error(), "no compiler") {
-		t.Fatalf("a failure is said in the builder's words: %v", err)
-	}
-}
-
-func TestABuildAtACommitKeepsTheBranchTheModuleFollows(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	manifest, _ := json.Marshal(map[string]any{"module": "unifi", "version": "1"})
-	result := func(id, ref, commit string) link.BuildResult {
-		return link.BuildResult{ID: id, Repository: "http://forge.internal:20000/novox/mesh-catalog.git",
-			Path: "modules/unifi", Ref: ref, On: "anchor", Commit: commit, Manifest: manifest,
-			Source: &link.SourceOnSeat{Seat: "git", Repository: "novox/mesh-catalog"}}
-	}
-	if _, _, err := takeIn(ctx, open.inventory, asTheOperator(t, open.inventory, result("b-1", "main", "1111111aaaa"))); err != nil {
-		t.Fatal(err)
-	}
-	if _, _, err := takeIn(ctx, open.inventory, result("b-2", "9c97a8a", "9c97a8a1d2c3")); err != nil {
-		t.Fatal(err)
-	}
-	src, err := open.inventory.SourceOf(ctx, "unifi")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if src.Ref != "main" || src.BuiltFrom != "9c97a8a1d2c3" {
-		t.Errorf("after a build at a commit the module follows %q, built from %q; want main, 9c97a8a1d2c3", src.Ref, src.BuiltFrom)
-	}
-
-	// One new to the catalogue, first built at a commit, follows the default branch.
-	other, _ := json.Marshal(map[string]any{"module": "letta", "version": "1"})
-	r := result("b-3", "deadbeef", "deadbeefcafe")
-	r.Manifest, r.Path = other, "modules/letta"
-	if _, _, err := takeIn(ctx, open.inventory, r); err != nil {
-		t.Fatal(err)
-	}
-	if src, _ := open.inventory.SourceOf(ctx, "letta"); src.Ref != "" {
-		t.Errorf("a module first built at a commit follows %q, want the default branch", src.Ref)
-	}
-}
-
-func TestAnOlderBuildHeardLaterDoesNotReplaceTheNewer(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	older := time.Date(2026, 10, 3, 21, 33, 45, 0, time.UTC)
-	newer := time.Date(2026, 10, 3, 21, 51, 57, 0, time.UTC)
-	result := func(asked time.Time, image string) link.BuildResult {
-		manifest, _ := json.Marshal(map[string]any{"module": "postgres", "version": image})
-		return link.BuildResult{ID: link.NewBuildID(asked), Repository: "http://forge.internal:20000/novox/mesh-catalog.git",
-			Path: "modules/postgres", Ref: "main", On: "anchor", Commit: "efff5415", Manifest: manifest,
-			Source: &link.SourceOnSeat{Seat: "git", Repository: "novox/mesh-catalog"}}
-	}
-	if _, _, err := takeIn(ctx, open.inventory, asTheOperator(t, open.inventory, result(newer, "4bcd5f73"))); err != nil {
-		t.Fatal(err)
-	}
-	_, _, err := takeIn(ctx, open.inventory, result(older, "0ab07fa9"))
-	if !errors.Is(err, inventory.ErrSuperseded) {
-		t.Fatalf("the older request's outcome was taken in as current: %v", err)
-	}
-	shelf, err := open.inventory.Catalogue(ctx)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got := shelf["postgres"].Version; got != "4bcd5f73" {
-		t.Errorf("postgres is %q; want the newer request's 4bcd5f73", got)
-	}
-	if builds, _ := open.inventory.Builds(ctx, "postgres", 5); len(builds) != 2 {
-		t.Errorf("the late build was not recorded: %v", builds)
-	}
-}

cmd/mesh-controller/build_source.go

@@ -1,705 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"os"
-	"regexp"
-	"slices"
-	"strings"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// Where a build may register a module from (novox/hq ADR 0266).
-//
-// A build's outcome registers its module, and a registered module is what the next push sends. Before this,
-// an outcome registered whatever its manifest named, from whichever repository it was built from: an agent
-// that made a repository of its own, committed `modules/sudo/module.json` granting itself a rule without a
-// password, and asked the `build` verb for it had its repository registered as the module `sudo` — whose next
-// push made the agent root on every node. A fork of the node-engine did the same everywhere. The trunk rule
-// (ADR 0238) did not stop it: the trunk it checked was the trunk of the repository built, which was the
-// agent's own.
-//
-// So **an outcome registers a module only from the repository the catalogue already builds that module
-// from**; and a module new to the catalogue only from a repository the catalogue already builds another
-// module from — whose trunk takes a reviewed, approved merge, which is how a merge adds a module (novox/hq
-// issue 300). Anything else — a module moved to another repository, a module from a repository the
-// catalogue has never built — is the operator's, at the controller's terminal: allowed only when the build
-// request was kept as asked there. Judged at the take-in, which every outcome reaches whoever hears it and
-// whichever verb asked it (`build`, `rebuild`, `replay --register`, `assign` with build), and before the ask
-// for a call through a verb, so an agent cannot have a build node run a repository the catalogue does not
-// build from at all.
-
-// errNotItsSource is an outcome refused for where it was built from.
-var errNotItsSource = errors.New("not built from the repository the catalogue builds it from")
-
-// servedVar marks every process the serving controller starts — each verb's command, each child — and the serving
-// process itself, so none of them can read as the operator at the terminal (novox/hq ADR 0266). Set by serve
-// before it answers anything, inherited by every child through os.Environ.
-const servedVar = "MESH_SERVED_BY_THE_CONTROLLER"
-
-// startedAtTheTerminal says this process was started at the controller's terminal: not the serving controller,
-// not anything it started, not a verb's command, not a seat call's. The serving controller marks its own
-// environment (servedVar), so a build asked in it, or by any process it starts, never reads as the terminal's;
-// runVerb also names the verb and the caller.
-//
-// **And a line mesh-cli asked as the controller's terminal** (novox/hq ADR 0272 §4): the serving controller runs it
-// without the served mark and without a verb, names its caller, and marks it with cliTerminalVar — a mark only the
-// mesh-cli path sets and every other command line the controller runs is stripped of (commandEnvironment).
-func startedAtTheTerminal() bool {
-	if os.Getenv(servedVar) != "" || os.Getenv(verbVar) != "" {
-		return false
-	}
-	return os.Getenv(link.CallerVar) == "" || os.Getenv(cliTerminalVar) != ""
-}
-
-// cliTerminalVar marks a command line the serving controller runs as the controller's terminal for mesh-cli.
-const cliTerminalVar = "MESH_CLI_TERMINAL"
-
-// markServed marks this process, and so everything it starts, as the serving controller's.
-func markServed() {
-	if err := os.Setenv(servedVar, "1"); err != nil {
-		panic("the serving controller could not mark its environment: " + err.Error())
-	}
-}
-
-// sourceForms compares sources however each is spelled: a path on a seat's holder (ADR 0111) or a URL — a
-// build asked of a seat's path is registered with the URL composed from it when its outcome does not echo
-// the seat. A seat's path is composed into its URL where the seat's holder is known, so both spellings of
-// one repository are one; where it is not, a seat's path matches only the same seat's same path.
-type sourceForms struct {
-	bases map[string]string // the seat's clone base, `scheme://host:port`, by seat; "" where it is not known
-	base  func(seat string) string
-	// read is base with the reason it is unknown; nil where only base is given. again forces a fresh read past a
-	// failure kept for failedKept.
-	read func(ctx context.Context, seat string, again bool) (string, error)
-}
-
-// failedKept is how long an unreadable base is not read again for the callers that loop over every catalogue
-// entry: one composition of the mesh serves them all (novox/hq issue 1277).
-const failedKept = 5 * time.Second
-
-// newSourceForms reads the seats' bases from the mesh when first needed. A base that could not be read is not
-// kept as if it were known: it is read again at the next ask (novox/hq issue 1277).
-func newSourceForms(ctx context.Context, inv *inventory.Inventory) *sourceForms {
-	return sourceFormsRead(ctx, time.Now, func(ctx context.Context) (catalogue.World, error) {
-		shelf, err := inv.Catalogue(ctx)
-		if err != nil {
-			return catalogue.World{}, fmt.Errorf("the catalogue cannot be read: %w", err)
-		}
-		read, err := restOfTheMeshOf(ctx, inv, shelf, "")
-		if err != nil {
-			return catalogue.World{}, fmt.Errorf("the mesh cannot be read: %w", err)
-		}
-		return read, nil
-	})
-}
-
-// sourceFormsRead is newSourceForms on how the mesh is read, handed in.
-func sourceFormsRead(ctx context.Context, now func() time.Time,
-	readWorld func(context.Context) (catalogue.World, error)) *sourceForms {
-	f := &sourceForms{bases: map[string]string{}}
-	var failedAt time.Time // when the last read failed; zero when it did not
-	var failure error
-	f.read = func(ctx context.Context, seat string, again bool) (string, error) {
-		if b, known := f.bases[seat]; known {
-			return b, nil
-		}
-		if failure != nil && !again && now().Sub(failedAt) < failedKept {
-			return "", failure
-		}
-		world, err := readWorld(ctx)
-		if err == nil {
-			var b string
-			if b, err = seatBase(world, seat); err == nil {
-				failure = nil
-				f.bases[seat] = b
-				return b, nil
-			}
-		}
-		failedAt, failure = now(), err // the holder may be changing now: only an unread base is kept, for a moment
-		return "", err
-	}
-	f.base = func(seat string) string {
-		b, _ := f.read(ctx, seat, false)
-		return b
-	}
-	return f
-}
-
-// forgeAddressWait is the registration's wait for the forge's address (novox/hq issue 1277): a fresh read every
-// 5 s for at most 60 s, as the wait for the forge's answer (issue 486). A variable so a test waits in no real time.
-var forgeAddressWait = waitOut{bound: 60 * time.Second, first: 5 * time.Second, most: 5 * time.Second,
-	now: time.Now, sleep: sleepOrDone}
-
-// forgeAddress is the git seat's base, read again within w's bound while it cannot be read. Where the forms have
-// no reader of their own (a test's), base says it.
-func (f *sourceForms) forgeAddress(ctx context.Context, w waitOut) (string, error) {
-	if f.read == nil {
-		return f.base(gitSeat), nil
-	}
-	began := w.now()
-	for {
-		b, err := f.read(ctx, gitSeat, true)
-		if err == nil {
-			return b, nil
-		}
-		if ctx.Err() != nil {
-			return "", err
-		}
-		if w.now().Sub(began)+w.first > w.bound {
-			return "", fmt.Errorf("after %s: %w", w.now().Sub(began).Round(time.Second), err)
-		}
-		fmt.Printf("the forge's address cannot be read now (%v); reading it again in %s, for at most %s in all "+
-			"(novox/hq issue 1277)\n", err, w.first, w.bound)
-		if serr := w.sleep(ctx, w.first); serr != nil {
-			return "", err
-		}
-	}
-}
-
-// canonical is one spelling of a repository: lower case, no `.git`, no trailing slash, and a seat's path as
-// the URL its holder serves it at where that is known.
-func (f *sourceForms) canonical(repository, seat string) string {
-	trim := func(s string) string {
-		s = strings.TrimSpace(strings.ToLower(s))
-		s = strings.TrimRight(s, "/")
-		return strings.TrimRight(strings.TrimSuffix(s, ".git"), "/")
-	}
-	if seat == "" {
-		return trim(repository)
-	}
-	if b := f.base(seat); b != "" {
-		return trim(b + "/" + strings.Trim(repository, "/"))
-	}
-	return "seat:" + seat + ":" + trim(strings.Trim(repository, "/"))
-}
-
-// same says two sources are one repository.
-func (f *sourceForms) same(aRepository, aSeat, bRepository, bSeat string) bool {
-	if aRepository == "" || bRepository == "" {
-		return false
-	}
-	return f.canonical(aRepository, aSeat) == f.canonical(bRepository, bSeat)
-}
-
-// forgeFacts is what the mesh's forge says of a repository a module is registered from (novox/hq ADR 0266).
-type forgeFacts struct {
-	// ID is the forge's own id of the repository: what tells it from one deleted and made again by its name.
-	ID int64
-	// Guarded is whether the branch is protected as a module's trunk must be: no direct push, a merge whitelist naming
-	// the tools' account and no agent's account, and no administrator merging past the rule (novox/hq ADR 0534 §6; no
-	// required status, which the forge no longer asks, §1). Why says what is missing when it is not.
-	Guarded bool
-	Why     string
-}
-
-// askTheForge asks the forge, through its module's tools on the bus, for a repository's id and its branch's
-// protection, waiting out a forge not served for a moment (novox/hq issue 486). A variable so a test needs no
-// forge.
-var askTheForge = func(ctx context.Context, owner, repo, branch string) (forgeFacts, error) {
-	return askedWithinBudget(ctx, owner+"/"+repo, func(ctx context.Context) (forgeFacts, error) {
-		return askTheForgeOnce(ctx, owner, repo, branch)
-	})
-}
-
-type forgeBudgetKey struct{}
-
-// withForgeBudget says how much of the registration's one wait is left for the forge's answer: the wait for its
-// address has used the rest (novox/hq issue 1277). The registration holds the controller's one receive loop, so the
-// two waits together keep to one bound.
-func withForgeBudget(ctx context.Context, left time.Duration) context.Context {
-	return context.WithValue(ctx, forgeBudgetKey{}, max(left, 0))
-}
-
-// askedWithinBudget is forgeWaitedOut with forgeWait's bound, or what is left of it when the address was waited for.
-func askedWithinBudget(ctx context.Context, repository string, ask func(context.Context) (forgeFacts, error)) (forgeFacts, error) {
-	w := forgeWait
-	if left, ok := ctx.Value(forgeBudgetKey{}).(time.Duration); ok {
-		w.bound = min(w.bound, left)
-	}
-	return forgeWaitedOut(ctx, w, repository, ask)
-}
-
-// waitOut bounds how long a question is asked again while its answer is "not now": a pause of first, doubling
-// to most, for at most bound in all. now and sleep are the clock, so a test waits in no real time.
-type waitOut struct {
-	bound, first, most time.Duration
-	now                func() time.Time
-	sleep              func(context.Context, time.Duration) error
-}
-
-// forgeWait is the registration's wait for the forge (novox/hq issue 486). On 2026-10-11 a build's registration
-// asked the forge while node-tools on the control-node re-served after a rollout of the tool runner, heard
-// "nothing serves gitea.gitea_api", and failed its plan; the forge answered again seconds later. A re-serve takes
-// about 10 s, so 60 s waits one out with room to spare. It is a cap on the whole wait, an ask in flight included:
-// the registration holds the controller's one receive loop while it waits, and a loop held two minutes reads as
-// deaf. The pauses are those the build machine waits the registry with (novox/hq issue 457).
-var forgeWait = waitOut{bound: 60 * time.Second, first: time.Second, most: 10 * time.Second,
-	now: time.Now, sleep: sleepOrDone}
-
-// sleepOrDone pauses for d, or less when ctx ends first.
-func sleepOrDone(ctx context.Context, d time.Duration) error {
-	t := time.NewTimer(d)
-	defer t.Stop()
-	select {
-	case <-ctx.Done():
-		return ctx.Err()
-	case <-t.C:
-		return nil
-	}
-}
-
-// forgeNotNow is an answer that says the forge's tool is not served now — the tool runner re-serving — not that
-// the forge refused. Only that is asked again: a refusal, an unreadable answer or a repository with no id is the
-// forge's word, and a tool that did not answer in time has already held the receive loop its whole wait.
-func forgeNotNow(err error) bool { return errors.Is(err, link.ErrNothingServes) }
-
-// forgeWaitedOut asks the forge about repository, asking again while it answers "not served now", all of it
-// within w's bound, an ask in flight included (novox/hq issue 486). Past the bound it fails, saying it waited,
-// for how long, and what the forge last said; when the caller's own context ends, it says that instead.
-func forgeWaitedOut(ctx context.Context, w waitOut, repository string,
-	ask func(context.Context) (forgeFacts, error)) (forgeFacts, error) {
-	capped, cancel := context.WithTimeout(ctx, w.bound)
-	defer cancel()
-	began := w.now()
-	pause := w.first
-	for asked := 1; ; asked++ {
-		facts, err := ask(capped)
-		if err == nil {
-			if asked > 1 {
-				fmt.Printf("the forge answered about %s again, after %s (novox/hq issue 486)\n", repository,
-					w.now().Sub(began).Round(time.Second))
-			}
-			return facts, nil
-		}
-		if ctx.Err() != nil {
-			return forgeFacts{}, err // the caller's own context ended: no wait of ours to speak of
-		}
-		gaveUp := func() (forgeFacts, error) {
-			return forgeFacts{}, fmt.Errorf("waited %s for the forge to answer about %s, asking %d times, and it "+
-				"did not (novox/hq issue 486): %w", w.now().Sub(began).Round(time.Second), repository, asked, err)
-		}
-		if capped.Err() != nil {
-			return gaveUp() // the bound ended an ask in flight
-		}
-		if !forgeNotNow(err) {
-			return forgeFacts{}, err
-		}
-		if w.now().Sub(began)+pause > w.bound {
-			return gaveUp()
-		}
-		fmt.Printf("the forge cannot be asked about %s now (%v); asking again in %s, for at most %s in all "+
-			"(novox/hq issue 486)\n", repository, err, pause, w.bound)
-		if serr := w.sleep(capped, pause); serr != nil {
-			if ctx.Err() != nil {
-				return forgeFacts{}, fmt.Errorf("stopped waiting for the forge to answer about %s: %w", repository,
-					ctx.Err())
-			}
-			return gaveUp()
-		}
-		pause = min(2*pause, w.most)
-	}
-}
-
-// askTheForgeOnce asks the forge once, through its module's tools on the bus.
-func askTheForgeOnce(ctx context.Context, owner, repo, branch string) (forgeFacts, error) {
-	js, err := aBus()
-	if err != nil {
-		return forgeFacts{}, err
-	}
-	defer js.Close()
-	bus := link.OverNATS{Conn: js.Conn()}
-	ask := func(tool string, args map[string]any, into any) error {
-		raw, _ := json.Marshal(args)
-		answer, err := link.Ask(ctx, bus, "gitea", tool, raw, 30*time.Second)
-		if err != nil {
-			return err
-		}
-		if answer.Error != "" {
-			return fmt.Errorf("gitea.%s: %s", tool, answer.Error)
-		}
-		return json.Unmarshal(answer.Result, into)
-	}
-	var found struct {
-		Result struct {
-			ID       int64  `json:"id"`
-			FullName string `json:"full_name"`
-		} `json:"result"`
-	}
-	if err := ask("gitea_api", map[string]any{"path": "/repos/" + owner + "/" + repo}, &found); err != nil {
-		return forgeFacts{}, err
-	}
-	if found.Result.ID == 0 {
-		return forgeFacts{}, fmt.Errorf("the forge named no id for %s/%s", owner, repo)
-	}
-	var rules struct {
-		Rules []protectionRule `json:"rules"`
-	}
-	if err := ask("gitea_branch_protection_get", map[string]any{"owner": owner, "repo": repo}, &rules); err != nil {
-		return forgeFacts{}, err
-	}
-	facts := judgedRule(rules.Rules, branch)
-	facts.ID = found.Result.ID
-	return facts, nil
-}
-
-// forgeToolsAccount is the forge tools' account, which main's merge whitelist names for mesh-delivery (novox/hq ADR 0398
-// §2, the gitea module's tools-account.ts TOOLS_ACCOUNT); beside it the whitelist names only people's own logins, the
-// operator's (ADR 0534 §2), never an agent's account.
-const forgeToolsAccount = "mesh-tools"
-
-// isAgentAccount is whether a forge login is a node's agent's account, agent-<node> (novox/hq ADR 0398 §1): one that
-// may never merge into a module's trunk by itself.
-func isAgentAccount(login string) bool { return strings.HasPrefix(login, "agent-") }
-
-// protectionRule is a branch protection rule as the forge's tool summarises it.
-type protectionRule struct {
-	Rule             string   `json:"rule"`
-	Push             bool     `json:"push"`
-	RequiredStatuses []string `json:"required_statuses"`
-	AdminMayOverride bool     `json:"admin_may_override"`
-	// MergeWhitelist is who may merge into the branch; nil when the rule keeps no merge whitelist (anyone who writes).
-	MergeWhitelist []string `json:"merge_whitelist"`
-}
-
-// judgedRule judges the one rule the forge applies to a branch, as the forge picks it: the rule named for the
-// branch, else the first glob rule, in the forge's order, that covers it (gitea's first matching rule). Never a
-// later rule that happens to be stronger: the forge does not read it. A trunk is trusted for who can land a commit on
-// it, not for a status it requires (novox/hq ADR 0534 §6): no push, a merge whitelist naming the tools' account and
-// beside it only people's own logins, never an agent's, and no administrator merging past the rule; then a commit lands
-// there through mesh-delivery, on a passing mesh/check and the operator's Approve (ADR 0534 §4), or by the operator's
-// own hand at the forge (§2).
-func judgedRule(rules []protectionRule, branch string) forgeFacts {
-	switch r := appliedRule(rules, branch); {
-	case r == nil:
-		return forgeFacts{Why: fmt.Sprintf("no protection rule covers %s", branch)}
-	case r.Push:
-		return forgeFacts{Why: fmt.Sprintf("the rule %s lets a person push to %s directly", r.Rule, branch)}
-	case r.MergeWhitelist == nil || len(r.MergeWhitelist) == 0:
-		return forgeFacts{Why: fmt.Sprintf("the rule %s keeps no merge whitelist naming %s alone for %s", r.Rule, forgeToolsAccount, branch)}
-	case !slices.Contains(r.MergeWhitelist, forgeToolsAccount):
-		return forgeFacts{Why: fmt.Sprintf("the rule %s lets %s merge into %s, and not %s", r.Rule,
-			strings.Join(r.MergeWhitelist, ", "), branch, forgeToolsAccount)}
-	case slices.ContainsFunc(r.MergeWhitelist, isAgentAccount):
-		return forgeFacts{Why: fmt.Sprintf("the rule %s lets an agent's account merge into %s: %s", r.Rule, branch,
-			strings.Join(r.MergeWhitelist, ", "))}
-	case r.AdminMayOverride:
-		return forgeFacts{Why: fmt.Sprintf("the rule %s lets an administrator merge into %s past it", r.Rule, branch)}
-	}
-	return forgeFacts{Guarded: true}
-}
-
-// appliedRule is the one rule the forge applies to a branch: the rule named for it, else the first glob rule, in the
-// forge's order, that covers it; nil when none does.
-func appliedRule(rules []protectionRule, branch string) *protectionRule {
-	for i := range rules {
-		if rules[i].Rule == branch {
-			return &rules[i]
-		}
-	}
-	for i := range rules {
-		if ruleCovers(rules[i].Rule, branch) {
-			return &rules[i]
-		}
-	}
-	return nil
-}
-
-// ruleCovers says a protection rule's name — a branch, or a glob of them — covers a branch, as the forge reads it.
-func ruleCovers(rule, branch string) bool {
-	if rule == branch {
-		return true
-	}
-	if !strings.ContainsAny(rule, "*?[") {
-		return false
-	}
-	var re strings.Builder
-	re.WriteString("^")
-	for i := 0; i < len(rule); i++ {
-		switch c := rule[i]; {
-		case c == '*' && i+1 < len(rule) && rule[i+1] == '*':
-			re.WriteString(".*")
-			i++
-		case c == '*':
-			re.WriteString("[^/]*")
-		case c == '?':
-			re.WriteString("[^/]")
-		default:
-			re.WriteString(regexp.QuoteMeta(string(c)))
-		}
-	}
-	re.WriteString("$")
-	ok, _ := regexp.MatchString(re.String(), branch)
-	return ok
-}
-
-// onTheForge is a source's owner and name on the mesh's own forge (the git seat's holder), and whether it is
-// there at all.
-func (f *sourceForms) onTheForge(repository, seat string) (owner, name string, ok bool) {
-	var rest string
-	switch {
-	case seat == gitSeat:
-		rest = strings.Trim(repository, "/")
-	case seat == "":
-		base := f.base(gitSeat)
-		if base == "" {
-			return "", "", false
-		}
-		url, prefix := f.canonical(repository, ""), f.canonical(base, "")+"/"
-		if !strings.HasPrefix(url, prefix) {
-			return "", "", false
-		}
-		// The case the forge spells it with: the URL as given, past the base.
-		rest = strings.TrimSuffix(strings.Trim(repository[len(prefix):], "/"), ".git")
-	default:
-		return "", "", false
-	}
-	parts := strings.Split(rest, "/")
-	if len(parts) != 2 || parts[0] == "" || parts[1] == "" {
-		return "", "", false
-	}
-	return parts[0], parts[1], true
-}
-
-// mayRegisterFrom says whether a build's outcome may register module from the source it was built from, and the
-// forge's id of that repository to record (novox/hq ADR 0266). Through any verb, only:
-//
-//   - from the module's registered repository — the same repository by the forge's own id, not only its name; or,
-//     for a module new to the catalogue, from a repository the catalogue builds another module from;
-//   - and from a repository on the mesh's forge whose trunk is protected as a trunk must be: no direct push, at
-//     a merge whitelist naming the tools' account and no agent's, no administrator merging past the rule (ADR 0534 §6).
-//
-// Anything else only when the build request was kept as asked at the controller's terminal, for this very
-// repository and path; or, for the build of a merge, when mesh-delivery announced it on the operator's Approve of
-// that head (novox/hq ADR 0420 §7 for a moved module, ADR 0432 for a new one), the forge's checks still holding. path is the module's directory as built; branch the trunk it is registered from.
-func mayRegisterFrom(ctx context.Context, inv *inventory.Inventory, module string, built inventory.Source,
-	ask registrationAsk, path, branch string) (int64, error) {
-	return mayRegisterIn(ctx, inv, newSourceForms(ctx, inv), module, built, ask, path, branch)
-}
-
-// registrationAsk is what a registration's warrant is read from (novox/hq ADR 0501 §3): the build an outcome answers,
-// whose kept request says whether it was asked at the terminal or for a merge (build-agent's outcome, the builder's own
-// module until R4g); or, for a take-in from the builder's done key, the merge the indexer's trunk value names and
-// whether the operator asked the registration at the controller's terminal (ADR 0501 §4). A key asks no build, so it
-// keeps no request.
-type registrationAsk struct {
-	// Build is the build whose kept request is read; empty for a take-in from a key.
-	Build string
-	// Merge is the commit of the merge a key's module is registered from (the indexer's trunk value); empty for an
-	// outcome, whose request names it.
-	Merge string
-	// Terminal is a key registration the operator asked at the controller's terminal for this repository and path.
-	Terminal bool
-}
-
-// String is the ask as the registration's words name it.
-func (a registrationAsk) String() string {
-	switch {
-	case a.Build != "":
-		return a.Build
-	case a.Terminal:
-		return "the registration asked at the terminal"
-	case a.Merge != "":
-		return fmt.Sprintf("the merge %.8s", a.Merge)
-	}
-	return "a key"
-}
-
-// catalogueReader is the catalogue's manifests, as the router's records are found in them.
-type catalogueReader interface {
-	Catalogue(ctx context.Context) (map[string]catalogue.Manifest, error)
-}
-
-// registrations is what a registration's decision reads of the mesh: *inventory.Inventory, or a test's stand-in.
-type registrations interface {
-	catalogueReader
-	SourceOf(ctx context.Context, module string) (inventory.Source, error)
-	SourceIdentity(ctx context.Context, module string) (int64, error)
-	Catalogued(ctx context.Context) ([]inventory.Entry, error)
-	BuildRequestByID(ctx context.Context, id string) (inventory.BuildRequest, bool, error)
-}
-
-// mayRegisterIn is mayRegisterFrom on what it reads of the mesh handed in.
-func mayRegisterIn(ctx context.Context, inv registrations, forms *sourceForms, module string, built inventory.Source,
-	ask registrationAsk, path, branch string) (int64, error) {
-	buildID := ask.String()
-	was, err := inv.SourceOf(ctx, module)
-	isNew := errors.Is(err, inventory.ErrNoSuchModule)
-	if err != nil && !isNew {
-		return 0, err
-	}
-	terminal := ask.Terminal
-	if ask.Build != "" {
-		var err error
-		if terminal, err = askedHereFor(ctx, inv, forms, ask.Build, built, path); err != nil {
-			return 0, err
-		}
-	}
-	refuse := func(why string) (int64, error) {
-		return 0, fmt.Errorf("%w: %s. A module is registered from such a source only by a build asked at the "+
-			"controller's terminal, or by the build of a merge mesh-delivery announced on the operator's Approve of that "+
-			"head, never through a verb: a registered module is what the next push sends, and whoever "+
-			"may call a verb includes agents (novox/hq ADR 0266)", errNotItsSource, why)
-	}
-
-	var why string
-	var alongside []inventory.Entry // the modules a new one's repository already builds
-	switch {
-	case !isNew && forms.same(was.Repository, was.Seat, built.Repository, built.Seat):
-	case !isNew:
-		registered := was.Repository
-		if registered == "" {
-			registered = "no repository (it was handed over by hand)"
-		}
-		why = fmt.Sprintf("%s is built from %s, and this build is of %s", module, sourceWords(registered, was.Seat),
-			sourceWords(built.Repository, built.Seat))
-	default:
-		entries, err := inv.Catalogued(ctx)
-		if err != nil {
-			return 0, err
-		}
-		for _, e := range entries {
-			if !e.Provided && e.Source.Repository != "" &&
-				forms.same(e.Source.Repository, e.Source.Seat, built.Repository, built.Seat) {
-				alongside = append(alongside, e)
-			}
-		}
-		if len(alongside) == 0 {
-			why = fmt.Sprintf("%s is new to the catalogue, and %s is no repository the catalogue builds a module from",
-				module, sourceWords(built.Repository, built.Seat))
-		}
-	}
-	// **Or the move the operator approved** (novox/hq ADR 0420 §7, issue 1025): a known module built from another
-	// repository by a merge, whose pull request mesh-delivery merged on the operator's Approve of that head.
-	// A verb alone, or a merge with no such warrant, is refused as before.
-	// **Or a new module from a repository nothing registered is built from, on the same warrant** (novox/hq ADR 0432,
-	// issue 1146): the build of a merge mesh-delivery announced on the operator's Approve of that head registers it.
-	// The forge's protection and the repository's identity are checked below as for every registration.
-	movedWhy := ""
-	if why != "" && !terminal {
-		accepted, err := approvedMove(ctx, inv, forms, ask, built)
-		switch {
-		case err == nil:
-			movedWhy, why = accepted, ""
-		case !errors.Is(err, errNotAMerge):
-			fmt.Printf("%s: %s is built from another repository, and no approved move covers this build: %v\n",
-				buildID, module, err)
-		}
-	}
-	if why != "" && !terminal {
-		return refuse(why)
-	}
-
-	if built.Seat == "" {
-		// A URL is judged against the forge's address: an address that cannot be read is no proof the source is
-		// elsewhere (novox/hq issue 1277).
-		began := forgeAddressWait.now()
-		addressCtx, cancel := context.WithTimeout(ctx, forgeAddressWait.bound)
-		_, err := forms.forgeAddress(addressCtx, forgeAddressWait)
-		cancel()
-		ctx = withForgeBudget(ctx, forgeAddressWait.bound-forgeAddressWait.now().Sub(began))
-		if err != nil {
-			if terminal {
-				fmt.Printf("%s: the forge's address could not be read (%v) — registered, as asked at the controller's "+
-					"terminal\n", buildID, err)
-				return 0, nil
-			}
-			return refuse(fmt.Sprintf("the forge's address could not be read (%v), so whether %s's trunk is "+
-				"protected cannot be read", err, sourceWords(built.Repository, built.Seat)))
-		}
-	}
-	owner, name, onForge := forms.onTheForge(built.Repository, built.Seat)
-	if !onForge {
-		if terminal {
-			fmt.Printf("%s: %s is not on the mesh's forge — registered, as asked at the controller's terminal\n",
-				buildID, sourceWords(built.Repository, built.Seat))
-			return 0, nil
-		}
-		return refuse(fmt.Sprintf("%s is not on the mesh's forge, so whether its trunk is protected cannot be read",
-			sourceWords(built.Repository, built.Seat)))
-	}
-	facts, err := askTheForge(ctx, owner, name, branch)
-	if err != nil {
-		if terminal {
-			fmt.Printf("%s: the forge could not be asked about %s/%s (%v) — registered, as asked at the controller's "+
-				"terminal\n", buildID, owner, name, err)
-			return 0, nil
-		}
-		return refuse(fmt.Sprintf("the forge could not say whether %s/%s's %s is protected: %v", owner, name, branch, err))
-	}
-	if terminal {
-		if why != "" || !facts.Guarded {
-			fmt.Printf("%s: %s — registered, as asked at the controller's terminal\n", buildID,
-				strings.Trim(why+"; "+facts.Why, "; "))
-		}
-		return facts.ID, nil
-	}
-	if !facts.Guarded {
-		return refuse(fmt.Sprintf("%s/%s's %s is not protected as a module's trunk must be: %s", owner, name, branch,
-			facts.Why))
-	}
-	// The same repository by the forge's id, not only its name: one deleted and made again is another.
-	recorded := map[string]int64{}
-	// A moved module is registered from the repository the operator approved, not the one it was registered from.
-	if !isNew && movedWhy == "" {
-		id, err := inv.SourceIdentity(ctx, module)
-		if err != nil {
-			return 0, err
-		}
-		recorded[module] = id
-	}
-	for _, e := range alongside {
-		id, err := inv.SourceIdentity(ctx, e.Manifest.Module)
-		if err != nil {
-			return 0, err
-		}
-		recorded[e.Manifest.Module] = id
-	}
-	for m, id := range recorded {
-		if id != 0 && id != facts.ID {
-			return refuse(fmt.Sprintf("%s/%s is not the repository %s was registered from: the forge knows it as "+
-				"repository %d, and %s was registered from repository %d — one of that name deleted and made again",
-				owner, name, m, facts.ID, m, id))
-		}
-	}
-	if movedWhy != "" && isNew {
-		fmt.Printf("%s: %s is new, from %s/%s — registered at the operator's Approve: %s\n", buildID, module, owner, name,
-			movedWhy)
-	} else if movedWhy != "" {
-		fmt.Printf("%s: %s moved from %s to %s/%s — registered at the operator's Approve: %s\n", buildID, module,
-			sourceWords(was.Repository, was.Seat), owner, name, movedWhy)
-	}
-	return facts.ID, nil
-}
-
-// askedHereFor says the build was asked at the controller's terminal, for this repository and this path: a kept
-// request marked so, whose source is the outcome's (novox/hq ADR 0266).
-func askedHereFor(ctx context.Context, inv registrations, forms *sourceForms, buildID string,
-	built inventory.Source, path string) (bool, error) {
-	r, found, err := inv.BuildRequestByID(ctx, buildID)
-	if err != nil || !found || !r.AtTerminal {
-		return false, err
-	}
-	if !forms.same(r.Repository, r.Seat, built.Repository, built.Seat) ||
-		strings.Trim(r.Path, "/") != strings.Trim(path, "/") {
-		fmt.Printf("%s was asked at the terminal of %s at %q, and its outcome is of %s at %q: not the terminal's\n",
-			buildID, sourceWords(r.Repository, r.Seat), r.Path, sourceWords(built.Repository, built.Seat), path)
-		return false, nil
-	}
-	return true, nil
-}
-
-// sourceWords is a source as a person reads it.
-func sourceWords(repository, seat string) string {
-	if seat == "" {
-		return repository
-	}
-	return buildSource{Repository: repository, Seat: seat}.String()
-}

cmd/mesh-controller/build_source_integration_test.go

@@ -1,298 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"os"
-	"os/exec"
-	"slices"
-	"strings"
-	"testing"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/asks"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-func theCatalogue(t *testing.T) *stores {
-	t.Helper()
-	open := aMesh(t)
-	ctx := t.Context()
-	for _, b := range []link.BuildResult{
-		onTrunk("build-sudo", "novox/mesh-catalog", "git", "modules/sudo", map[string]any{"module": "sudo", "version": "1"}),
-		onTrunk("build-host", "novox/mesh-host", "git", "", map[string]any{"module": "mesh-host", "version": "1"}),
-	} {
-		keptAsked(t, open.inventory, b.ID, b.Source.Repository, b.Path, true)
-		if _, _, err := takeIn(ctx, open.inventory, b); err != nil {
-			t.Fatal(err)
-		}
-	}
-	return open
-}
-
-func TestABuildFromAnAgentsRepositoryIsNotRegisteredAsAModuleTheMeshHolds(t *testing.T) {
-	open := theCatalogue(t)
-	ctx := t.Context()
-	for _, c := range []struct {
-		name, repository, path, module string
-	}{
-		{"its own repository naming sudo", "agent/sudo", "modules/sudo", "sudo"},
-		{"a fork of the catalogue", "agent/mesh-catalog", "modules/sudo", "sudo"},
-		{"a fork of the node-engine", "agent/mesh-host", "", "mesh-host"},
-	} {
-		t.Run(c.name, func(t *testing.T) {
-			id := "build-" + strings.ReplaceAll(c.repository, "/", "-")
-			keptAsked(t, open.inventory, id, c.repository, c.path, false) // through the build verb
-			evil := onTrunk(id, c.repository, "git", c.path, map[string]any{"module": c.module, "version": "evil"})
-			_, _, err := takeIn(ctx, open.inventory, evil)
-			if !errors.Is(err, errNotItsSource) {
-				t.Fatalf("a build of %s was taken in as %s: %v", c.repository, c.module, err)
-			}
-			shelf, err := open.inventory.Catalogue(ctx)
-			if err != nil {
-				t.Fatal(err)
-			}
-			if got := shelf[c.module].Version; got != "1" {
-				t.Fatalf("%s is now %q, from %s", c.module, got, c.repository)
-			}
-			if _, found, _ := open.inventory.BuildByID(ctx, id); !found {
-				t.Errorf("the refused build %s is not recorded", id)
-			}
-		})
-	}
-}
-
-func TestANewModuleFromARepositoryTheCatalogueDoesNotBuildFromIsNotRegistered(t *testing.T) {
-	open := theCatalogue(t)
-	ctx := t.Context()
-	keptAsked(t, open.inventory, "build-new", "agent/tools", "", false)
-	_, _, err := takeIn(ctx, open.inventory, onTrunk("build-new", "agent/tools", "git", "",
-		map[string]any{"module": "agent-tools", "version": "1"}))
-	if !errors.Is(err, errNotItsSource) {
-		t.Fatalf("a new module from an agent's repository was taken in: %v", err)
-	}
-	// And one asked of nobody here — an outcome on the bus no request was kept for — the same.
-	_, _, err = takeIn(ctx, open.inventory, onTrunk("build-unasked", "agent/tools", "git", "",
-		map[string]any{"module": "agent-tools", "version": "1"}))
-	if !errors.Is(err, errNotItsSource) {
-		t.Fatalf("an outcome nobody asked for was taken in: %v", err)
-	}
-	if shelf, _ := open.inventory.Catalogue(ctx); shelf["agent-tools"].Module != "" {
-		t.Fatal("the refused module is in the catalogue")
-	}
-}
-
-func TestAtTheTerminalAnotherRepositoryIsRegistered(t *testing.T) {
-	open := theCatalogue(t)
-	ctx := t.Context()
-	keptAsked(t, open.inventory, "build-moved", "novox/sudo", "", true)
-	if _, _, err := takeIn(ctx, open.inventory, onTrunk("build-moved", "novox/sudo", "git", "",
-		map[string]any{"module": "sudo", "version": "2"})); err != nil {
-		t.Fatalf("a move the operator asked for at the terminal was refused: %v", err)
-	}
-	if src, _ := open.inventory.SourceOf(ctx, "sudo"); src.Repository != "novox/sudo" {
-		t.Fatalf("sudo is built from %q", src.Repository)
-	}
-	if err := open.inventory.RecordBuildRequest(ctx, inventory.BuildRequest{ID: "build-external",
-		Repository: "http://forge.internal:20000/someone/app.git", For: "build", AtTerminal: true}); err != nil {
-		t.Fatal(err)
-	}
-	if _, _, err := takeIn(ctx, open.inventory, onTrunk("build-external", "someone/app", "", "",
-		map[string]any{"module": "app", "version": "1"})); err != nil {
-		t.Fatalf("a new module the operator asked for at the terminal was refused: %v", err)
-	}
-}
-
-func TestADeliveryFromTheRegisteredRepositoryIsRegistered(t *testing.T) {
-	open := theCatalogue(t)
-	ctx := t.Context()
-	rebuilt := onTrunk("build-plan", "novox/mesh-catalog", "git", "modules/sudo", map[string]any{"module": "sudo", "version": "2"})
-	if err := open.inventory.RecordBuildRequest(ctx, inventory.BuildRequest{ID: rebuilt.ID,
-		Repository: "novox/mesh-catalog", Seat: "git", Path: "modules/sudo", For: "plan"}); err != nil {
-		t.Fatal(err)
-	}
-	if _, _, err := takeIn(ctx, open.inventory, rebuilt); err != nil {
-		t.Fatalf("a plan's build of the module's own repository was refused: %v", err)
-	}
-	added := onTrunk("build-merge", "novox/mesh-catalog", "git", "modules/zram", map[string]any{"module": "zram", "version": "1"})
-	if _, _, err := takeIn(ctx, open.inventory, added); err != nil {
-		t.Fatalf("a module a merge added to the catalogue repository was refused: %v", err)
-	}
-	shelf, _ := open.inventory.Catalogue(ctx)
-	if shelf["sudo"].Version != "2" || shelf["zram"].Module == "" {
-		t.Fatalf("not registered: sudo %q, zram %q", shelf["sudo"].Version, shelf["zram"].Module)
-	}
-}
-
-func TestATrunkTheForgeDoesNotProtectRegistersNothing(t *testing.T) {
-	open := theCatalogue(t)
-	ctx := t.Context()
-	theForge.Store("novox/unguarded", forgeFacts{ID: 7, Why: "the rule main lets a person push to main directly"})
-	t.Cleanup(func() { theForge.Delete("novox/unguarded") })
-	first := onTrunk("build-unguarded-1", "novox/unguarded", "git", "", map[string]any{"module": "unguarded", "version": "1"})
-	keptAsked(t, open.inventory, first.ID, "novox/unguarded", "", true)
-	if _, _, err := takeIn(ctx, open.inventory, first); err != nil {
-		t.Fatalf("at the terminal: %v", err)
-	}
-	again := onTrunk("build-unguarded-2", "novox/unguarded", "git", "", map[string]any{"module": "unguarded", "version": "2"})
-	if _, _, err := takeIn(ctx, open.inventory, again); !errors.Is(err, errNotItsSource) ||
-		!strings.Contains(err.Error(), "push to main directly") {
-		t.Fatalf("a rebuild from an unprotected trunk was taken in: %v", err)
-	}
-	theForge.Store("novox/unguarded", errors.New("nothing serves gitea.gitea_api"))
-	if _, _, err := takeIn(ctx, open.inventory, onTrunk("build-unguarded-3", "novox/unguarded", "git", "",
-		map[string]any{"module": "unguarded", "version": "3"})); !errors.Is(err, errNotItsSource) {
-		t.Fatalf("a forge that could not say was read as a protected trunk: %v", err)
-	}
-	if shelf, _ := open.inventory.Catalogue(ctx); shelf["unguarded"].Version != "1" {
-		t.Fatalf("unguarded is %q", shelf["unguarded"].Version)
-	}
-}
-
-func TestARepositoryMadeAgainUnderItsNameIsNotTheModulesSource(t *testing.T) {
-	open := theCatalogue(t)
-	ctx := t.Context()
-	theForge.Store("novox/remade", forgeFacts{ID: 100, Guarded: true})
-	t.Cleanup(func() { theForge.Delete("novox/remade") })
-	first := onTrunk("build-remade-1", "novox/remade", "git", "", map[string]any{"module": "remade", "version": "1"})
-	keptAsked(t, open.inventory, first.ID, "novox/remade", "", true)
-	if _, _, err := takeIn(ctx, open.inventory, first); err != nil {
-		t.Fatal(err)
-	}
-	if id, _ := open.inventory.SourceIdentity(ctx, "remade"); id != 100 {
-		t.Fatalf("the forge's id was not recorded: %d", id)
-	}
-	theForge.Store("novox/remade", forgeFacts{ID: 101, Guarded: true}) // deleted, and made again by an agent
-	if _, _, err := takeIn(ctx, open.inventory, onTrunk("build-remade-2", "novox/remade", "git", "",
-		map[string]any{"module": "remade", "version": "evil"})); !errors.Is(err, errNotItsSource) ||
-		!strings.Contains(err.Error(), "made again") {
-		t.Fatalf("a repository made again under the name was taken in: %v", err)
-	}
-	// And a new module from it, beside the one registered from the first, the same.
-	if _, _, err := takeIn(ctx, open.inventory, onTrunk("build-remade-3", "novox/remade", "git", "modules/other",
-		map[string]any{"module": "other", "version": "1"})); !errors.Is(err, errNotItsSource) {
-		t.Fatalf("a new module from a repository made again was taken in: %v", err)
-	}
-}
-
-func TestATerminalRequestCoversOnlyWhatItAsked(t *testing.T) {
-	open := theCatalogue(t)
-	ctx := t.Context()
-	if err := open.inventory.RecordBuildRequest(ctx, inventory.BuildRequest{ID: "build-asked", Repository: "novox/app",
-		Seat: "git", Path: "modules/app", For: "build", AtTerminal: true}); err != nil {
-		t.Fatal(err)
-	}
-	other := onTrunk("build-asked", "agent/sudo", "git", "modules/app", map[string]any{"module": "sudo", "version": "evil"})
-	if _, _, err := takeIn(ctx, open.inventory, other); !errors.Is(err, errNotItsSource) {
-		t.Fatalf("an outcome of another repository under a terminal request's id was taken in: %v", err)
-	}
-	elsewhere := onTrunk("build-asked", "novox/app", "git", "modules/sudo", map[string]any{"module": "sudo", "version": "evil"})
-	if _, _, err := takeIn(ctx, open.inventory, elsewhere); !errors.Is(err, errNotItsSource) {
-		t.Fatalf("an outcome of another path under a terminal request's id was taken in: %v", err)
-	}
-}
-
-func TestTheServingControllerIsNeverTheTerminal(t *testing.T) {
-	t.Setenv(verbVar, "")
-	t.Setenv(link.CallerVar, "")
-	t.Setenv(servedVar, "")
-	if !startedAtTheTerminal() {
-		t.Fatal("a process started by hand is not the terminal")
-	}
-	markServed()
-	if startedAtTheTerminal() {
-		t.Fatal("the serving controller reads as the terminal")
-	}
-	child := exec.Command(os.Args[0], "-test.run=^$")
-	child.Env = os.Environ()
-	if !slices.Contains(child.Env, servedVar+"=1") {
-		t.Fatal("what the serving controller starts does not carry its mark")
-	}
-}
-
-func TestAnUnknownIdentityKeepsTheRecordedOne(t *testing.T) {
-	open := theCatalogue(t)
-	ctx := t.Context()
-	if err := open.inventory.SetSourceIdentity(ctx, "sudo", 100); err != nil {
-		t.Fatal(err)
-	}
-	if err := open.inventory.SetSourceIdentity(ctx, "sudo", 0); err != nil {
-		t.Fatal(err)
-	}
-	if id, _ := open.inventory.SourceIdentity(ctx, "sudo"); id != 100 {
-		t.Fatalf("the recorded id became %d", id)
-	}
-}
-
-func TestAModuleMovesOnTheOperatorsApproveOfTheMergeThatMovedIt(t *testing.T) {
-	const commit = "c0ffee0123456789"
-	for _, c := range []struct {
-		what    string
-		change  func(*anApprovedMerge)
-		unkept  bool
-		request string // who asked: "merge", or "build" through a verb
-		moved   bool
-	}{
-		{what: "the operator's Approve of the merged head", request: "merge", moved: true},
-		{what: "no merge mesh-delivery announced", unkept: true, request: "merge"},
-		{what: "a warrant for other heads", request: "merge", change: func(a *anApprovedMerge) {
-			a.merge.Heads = map[string]string{"novox/mesh-host@aaaaaaaaaaaa": "e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5"}
-		}},
-		{what: "a Decline", request: "merge", change: func(a *anApprovedMerge) {
-			a.warrant.Option, a.warrant.Label, a.merge.Option = "decline", "Decline", "decline"
-		}},
-		{what: "a person who is not the operator", request: "merge", change: func(a *anApprovedMerge) { a.warrant.By.Who = "agent" }},
-		{what: "a build asked through a verb", request: "build"},
-	} {
-		open := theCatalogue(t)
-		ctx := t.Context()
-		inv := open.inventory
-		a := approvedMerge(t)
-		a.merge.Owner, a.merge.Repo, a.merge.Number, a.merge.HeadSHA = "novox", "mesh-host", 7, "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1"
-		if c.change != nil {
-			c.change(&a)
-		}
-		wasKept, wasAsk := keptDeliveryMerge, routerAskOf
-		keptDeliveryMerge = func(_ context.Context, owner, repo string, number int, head string) (deliveryMerge, bool, error) {
-			return a.merge, !c.unkept && owner == "novox" && repo == "mesh-host" && number == 7 && head == a.merge.HeadSHA, nil
-		}
-		routerAskOf = func(_ context.Context, _ catalogueReader, _, id string) (*asks.Ask, *asks.Warrant, error) {
-			if id != a.merge.AskID {
-				t.Errorf("%s: the router was asked for %q", c.what, id)
-			}
-			return &a.ask, &a.warrant, nil
-		}
-		t.Cleanup(func() { keptDeliveryMerge, routerAskOf = wasKept, wasAsk })
-		event, _ := json.Marshal(map[string]any{"owner": "novox", "repo": "mesh-host", "base": "main", "number": 7,
-			"head_sha": a.merge.HeadSHA, "merge_commit_sha": commit})
-		var forgeMerge keptMerge
-		_ = json.Unmarshal(event, &forgeMerge)
-		wasForge := keptForgeMerge
-		t.Cleanup(func() { keptForgeMerge = wasForge })
-		keptForgeMerge = func(context.Context, string, string, string) (keptMerge, bool, error) { return forgeMerge, true, nil }
-		id := fmt.Sprintf("build-%d", time.Now().Add(time.Hour).UnixNano())
-		if err := inv.RecordBuildRequest(ctx, inventory.BuildRequest{ID: id, Repository: "novox/mesh-host", Seat: "git",
-			Path: "modules/sudo", Ref: "main", Commit: commit, For: c.request}); err != nil {
-			t.Fatal(err)
-		}
-		moved := onTrunk(id, "novox/mesh-host", "git", "modules/sudo", map[string]any{"module": "sudo", "version": "2"})
-		moved.Commit = commit
-		_, _, err := takeIn(ctx, inv, moved)
-		src, _ := inv.SourceOf(ctx, "sudo")
-		switch {
-		case c.moved && err != nil:
-			t.Errorf("%s: the move was refused: %v", c.what, err)
-		case c.moved && src.Repository != "novox/mesh-host":
-			t.Errorf("%s: sudo is built from %q", c.what, src.Repository)
-		case !c.moved && !errors.Is(err, errNotItsSource):
-			t.Errorf("%s: the move was not refused as ADR 0266 has it: %v", c.what, err)
-		case !c.moved && src.Repository != "novox/mesh-catalog":
-			t.Errorf("%s: a refused move changed sudo's source to %q", c.what, src.Repository)
-		}
-	}
-}

cmd/mesh-controller/build_source_test.go

@@ -1,162 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"hash/fnv"
-	"strings"
-	"sync"
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// The routes to root a review of ADR 0266 found (novox/hq ADR 0266 §7): an agent makes a repository of its
-// own — or forks one the mesh builds from — commits a module.json naming a module the mesh runs everywhere
-// (`sudo`, granting itself a rule without a password; `mesh-host`, the node-engine), and asks the `build` verb
-// for it. Its outcome was registered under that name from the agent's repository, and the next push sent it.
-
-// onTrunk is an outcome of a commit on its repository's trunk, as the build seat says it.
-func onTrunk(id, repository, seat, path string, manifest map[string]any) link.BuildResult {
-	raw, _ := json.Marshal(manifest)
-	r := link.BuildResult{ID: id, Repository: "http://forge.internal:20000/" + repository + ".git", Path: path,
-		Ref: "main", On: "anchor", Commit: "c0ffee0123456789", Manifest: raw,
-		Trunk: "main", OnTrunk: true, Branches: []string{"main"}}
-	if seat != "" {
-		r.Source = &link.SourceOnSeat{Seat: seat, Repository: repository}
-	}
-	return r
-}
-
-// keptAsked keeps a build request as the asker would: through a verb, or at the terminal.
-func keptAsked(t *testing.T, inv *inventory.Inventory, id, repository, path string, atTerminal bool) {
-	t.Helper()
-	if err := inv.RecordBuildRequest(t.Context(), inventory.BuildRequest{ID: id, Repository: repository, Seat: "git",
-		Path: path, For: "build", AtTerminal: atTerminal}); err != nil {
-		t.Fatal(err)
-	}
-}
-
-// theCatalogue is a mesh whose sudo is built from the catalogue repository and whose node-engine from its own.
-
-// The operator at the terminal may still move a module, or add one from a new repository.
-
-// The delivery's flow is untouched: a merge's rebuild of a module from its own repository, and a merge adding
-// a module to a repository the catalogue builds from (novox/hq issue 300), are registered with no terminal.
-
-// Through a verb, a build of a repository the catalogue builds nothing from is not even asked: the build node
-// would run what the agent wrote.
-
-// asTheOperator keeps a build as asked at the controller's terminal, as the operator's first build of a module
-// from a repository the catalogue does not yet build from is (novox/hq ADR 0266), and hands it back.
-func asTheOperator(t *testing.T, inv *inventory.Inventory, b link.BuildResult) link.BuildResult {
-	t.Helper()
-	repository, seat := b.Repository, ""
-	if b.Source != nil {
-		repository, seat = b.Source.Repository, b.Source.Seat
-	}
-	if err := inv.RecordBuildRequest(t.Context(), inventory.BuildRequest{ID: b.ID, Repository: repository, Seat: seat,
-		Path: b.Path, For: "build", AtTerminal: true}); err != nil {
-		t.Fatal(err)
-	}
-	return b
-}
-
-// A rollback puts back only a build of the module's own repository: an agent's build of the module's name,
-// recorded and refused, at the very commit the machine ran before (a fork carries it), is never registered by
-// the back door of a failed gate.
-
-// theForge is what the forge says in a test, by owner/name: a repository not named here is protected as a
-// trunk must be, with an id of its own.
-var theForge sync.Map
-
-func init() {
-	askTheForge = func(_ context.Context, owner, repo, _ string) (forgeFacts, error) {
-		if said, ok := theForge.Load(owner + "/" + repo); ok {
-			switch f := said.(type) {
-			case error:
-				return forgeFacts{}, f
-			case forgeFacts:
-				return f, nil
-			}
-		}
-		h := fnv.New32a()
-		_, _ = h.Write([]byte(owner + "/" + repo))
-		return forgeFacts{ID: int64(h.Sum32()), Guarded: true}, nil
-	}
-}
-
-// A module's trunk the forge does not protect — direct pushes, no required status — or a forge that cannot say,
-// registers nothing through a verb: the trunk rule means nothing on a branch anyone pushes to.
-
-// A repository deleted and made again under the module's repository's name is another repository: the forge's
-// id, recorded at registration, tells them apart.
-
-// The terminal's mark is the operator's for the repository and path they asked: an outcome of another, under that
-// build's id, is not theirs.
-
-// The serving controller, and everything it starts, is never the terminal: a build asked in it reads as asked
-// through the mesh even when no verb and no caller is named.
-
-// The forge applies one rule to a branch: the rule named for it, else the first glob that covers it. A stronger
-// rule later in the list is not what guards the branch, and is not read as if it were (the confirmation review).
-func TestTheRuleJudgedIsTheOneTheForgeApplies(t *testing.T) {
-	tools := []string{forgeToolsAccount}
-	guarded := protectionRule{Rule: "*", MergeWhitelist: tools}
-	open := protectionRule{Rule: "main", Push: true, MergeWhitelist: tools}
-	if f := judgedRule([]protectionRule{guarded, open}, "main"); f.Guarded {
-		t.Error("an exact rule letting pushes was passed over for a glob that guards")
-	}
-	if f := judgedRule([]protectionRule{{Rule: "ma*", MergeWhitelist: nil}, {Rule: "*", MergeWhitelist: tools}},
-		"main"); f.Guarded || !strings.Contains(f.Why, "ma*") {
-		t.Errorf("the first glob covering the branch was not the one judged: %+v", f)
-	}
-	if f := judgedRule([]protectionRule{{Rule: "release/*"}, {Rule: "main", MergeWhitelist: tools}}, "main"); !f.Guarded {
-		t.Errorf("the rule named for the branch was not judged: %+v", f)
-	}
-	if f := judgedRule(nil, "main"); f.Guarded {
-		t.Error("no rule is no protection")
-	}
-}
-
-// **A module's trunk is trusted when it takes no push, only the tools' account and people's own logins merge into it,
-// and no administrator merges past its rule** (novox/hq ADR 0534 §2, §6): the forge requires no status to merge (§1), so
-// a rule requiring none is trusted; one with no merge whitelist, no tools' account in it, an agent's account in it, a
-// push allowed or an administrator's override is not.
-func TestATrunkIsTrustedForItsMergersNotForAStatus(t *testing.T) {
-	tools := []string{forgeToolsAccount}
-	for _, c := range []struct {
-		name string
-		rule protectionRule
-		want bool
-		why  string
-	}{
-		{"no status, no push, the tools alone merge", protectionRule{Rule: "main", MergeWhitelist: tools}, true, ""},
-		{"a status required as well", protectionRule{Rule: "main", MergeWhitelist: tools, RequiredStatuses: []string{"mesh/check"}}, true, ""},
-		{"no merge whitelist", protectionRule{Rule: "main"}, false, "merge whitelist"},
-		{"an empty merge whitelist", protectionRule{Rule: "main", MergeWhitelist: []string{}}, false, "merge whitelist"},
-		{"the operator's own login beside the tools", protectionRule{Rule: "main", MergeWhitelist: []string{forgeToolsAccount, "jschoubben"}}, true, ""},
-		{"an agent's account in the whitelist", protectionRule{Rule: "main", MergeWhitelist: []string{forgeToolsAccount, "agent-ace"}}, false, "agent-ace"},
-		{"an agent's account alone", protectionRule{Rule: "main", MergeWhitelist: []string{"agent-ace"}}, false, "agent-ace"},
-		{"a person's login without the tools", protectionRule{Rule: "main", MergeWhitelist: []string{"jschoubben"}}, false, forgeToolsAccount},
-		{"a push allowed", protectionRule{Rule: "main", Push: true, MergeWhitelist: tools}, false, "push"},
-		{"an administrator's override", protectionRule{Rule: "main", MergeWhitelist: tools, AdminMayOverride: true}, false, "administrator"},
-	} {
-		f := judgedRule([]protectionRule{c.rule}, "main")
-		if f.Guarded != c.want || !strings.Contains(f.Why, c.why) {
-			t.Errorf("%s: %+v, want guarded %v saying %q", c.name, f, c.want, c.why)
-		}
-		if strings.Contains(f.Why, "requires no status") {
-			t.Errorf("%s: a trunk is still judged on a required status: %s", c.name, f.Why)
-		}
-	}
-}
-
-// An id the forge could not give keeps the id already recorded.
-
-// **The operator's Approve of a reviewed group registers a moved module from its new repository** (novox/hq ADR 0420 §7,
-// issue 1025). sudo is built from the catalogue; a merge into the repository of node-engine's module, announced by
-// mesh-delivery with the ask it merged on, brings its build from there. Accepted with the operator's Approve of the
-// merged head; refused with no kept merge, a warrant for other heads, a Decline, a person who is not the operator, and
-// through a verb.

cmd/mesh-controller/build_test.go

@@ -1,68 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// A build's outcome is taken in the same way whoever hears it (novox/hq issue 176): recorded, and
-// the module registered with its source as the seat and path when the request said so — never the
-// URL. A definition naming an installation is recorded and not registered; a failure is recorded
-// and said.
-
-// novox/hq 04-ISSUES/215: a build asked at a commit is recorded as built from that commit, and the
-// module keeps following the branch it followed — a new one, the default branch.
-
-// novox/hq 04-ISSUES/219: an older request heard after a newer one is recorded and not registered,
-// so a push sends what the newer request built.
-
-func TestABuildIDSaysWhenItWasAsked(t *testing.T) {
-	at := time.Date(2026, 10, 3, 21, 51, 57, 392539762, time.UTC)
-	if got, ok := link.BuildAskedAt(link.NewBuildID(at)); !ok || !got.Equal(at) {
-		t.Errorf("read back %v %v; want %v", got, ok, at)
-	}
-	if got, ok := link.BuildAskedAt("build-1791064317392539762"); !ok || got.Format(time.TimeOnly) != "21:51:57" {
-		t.Errorf("the incident's id reads as %v %v", got, ok)
-	}
-	for _, id := range []string{"b-1", "build-2", "build-", "build-x", ""} {
-		if _, ok := link.BuildAskedAt(id); ok {
-			t.Errorf("%q read as a request time", id)
-		}
-	}
-}
-
-// novox/hq issue 1204: builds says the source fingerprint the builder recorded, the one tool that reads it.
-func TestBuildsSaysTheSourceFingerprint(t *testing.T) {
-	at := time.Date(2026, 10, 19, 10, 40, 0, 0, time.UTC)
-	built := inventory.Build{ID: "build-1", Module: "mailu", Commit: "b4527d9091e972f28cb365623d9280045e7741a3", On: "ace",
-		Repository: "novox/mesh-catalog", At: at, ReuseKey: "r1:abc",
-		SourceFingerprint: "src1:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"}
-
-	// 1204/AC1
-	var out bytes.Buffer
-	printBuild(&out, built)
-	lines := strings.Split(strings.TrimRight(out.String(), "\n"), "\n")
-	if last := lines[len(lines)-1]; last != "    source     "+built.SourceFingerprint {
-		t.Errorf("last line %q; want the source line after the reuse key:\n%s", last, out.String())
-	}
-	if !strings.Contains(lines[len(lines)-2], "reuse key  r1:abc") {
-		t.Errorf("the source line does not follow the reuse key:\n%s", out.String())
-	}
-
-	// 1204/AC2
-	without := built
-	without.SourceFingerprint = ""
-	var plain bytes.Buffer
-	printBuild(&plain, without)
-	if strings.Contains(plain.String(), "source") {
-		t.Errorf("a build with no fingerprint says a source line:\n%s", plain.String())
-	}
-	if want := strings.Join(lines[:len(lines)-1], "\n") + "\n"; plain.String() != want {
-		t.Errorf("the other lines changed:\n%s\nwant\n%s", plain.String(), want)
-	}
-}

cmd/mesh-controller/builder_on_the_bus_test.go

@@ -1,114 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"context"
-	"testing"
-
-	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
-	"github.com/nats-io/nats.go/jetstream"
-	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/testbus"
-)
-
-// builderOnTheBus is the builder's and the indexer's buckets on a test's own bus, which the controller's connection for
-// the moment (servingBus) reaches: what a take-in from a key reads (R4e, issue 1851).
-type builderOnTheBus struct {
-	js                         *broker.JetStream
-	builds, modules, manifests jetstream.KeyValue
-}
-
-func aBuilderOnTheBus(t *testing.T) builderOnTheBus {
-	t.Helper()
-	js, err := broker.Dial(testbus.URL(t))
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(js.Close)
-	api, err := jetstream.New(js.Conn())
-	if err != nil {
-		t.Fatal(err)
-	}
-	ctx := t.Context()
-	b := builderOnTheBus{js: js}
-	for _, c := range []struct {
-		into    *jetstream.KeyValue
-		bucket  string
-		history uint8
-	}{
-		{&b.builds, sdkdelivery.BuilderBuildsBucket, sdkdelivery.BuilderBuildsHistory},
-		{&b.modules, sdkdelivery.ModulesBucket, sdkdelivery.ModulesHistory},
-		{&b.manifests, sdkdelivery.ManifestsBucket, 1},
-	} {
-		kv, err := api.CreateKeyValue(ctx, jetstream.KeyValueConfig{Bucket: c.bucket, History: c.history})
-		if err != nil {
-			t.Fatal(err)
-		}
-		*c.into = kv
-	}
-	// And the controller's own buckets, as its start asserts them: a merge it hears is kept in the bucket of the merges
-	// (ADR 0539 §17), which no other test need have made on this bus first.
-	if err := js.EnsureControllerBuckets(); err != nil {
-		t.Fatal(err)
-	}
-	servingBus.Store(js)
-	t.Cleanup(func() { servingBus.Store(nil) })
-	withTrunkList(t, true)
-	// The indexer on this bus is read, not the "not held" a mesh with no bus reads (aMeshOnTheStore).
-	wasIndexed := indexedModule
-	indexedModule = theIndexedModule
-	t.Cleanup(func() { indexedModule = wasIndexed })
-	return b
-}
-
-// indexed writes the indexer's trunk value of module at commit, naming fp, and its manifest: a module of one archive.
-func (b builderOnTheBus) indexed(t *testing.T, module, version, repository, path, commit, fp string) string {
-	t.Helper()
-	keys, trunk := aKeyFor(module, version, fp, repository, path, commit)
-	raw := keys.manifests[trunk.Manifest]
-	value, err := sdkdelivery.EncodeManifest(sdkdelivery.Manifest{Module: module, JSON: raw})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := b.manifests.Put(context.Background(), trunk.Manifest, value); err != nil {
-		t.Fatal(err)
-	}
-	trunk.FP = "src1:" + fp[len("src2:"):]
-	encoded, err := sdkdelivery.EncodeModule(trunk)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := b.modules.Put(context.Background(), module, encoded); err != nil {
-		t.Fatal(err)
-	}
-	return trunk.Manifest
-}
-
-// built writes the builder's key of module at fp: done, its one archive named with a reference, or in another state.
-func (b builderOnTheBus) built(t *testing.T, module, version, fp, manifest, state string) {
-	t.Helper()
-	keys, _ := aKeyFor(module, version, fp, "", "", "")
-	v := keys.keys[module].Build
-	v.Manifest = manifest
-	if state != sdkdelivery.BuildDone {
-		v = sdkdelivery.BuilderBuild{State: state, By: "ace"}
-		if state == sdkdelivery.BuildFailed {
-			v.Error = "digests differ: ace sha256:1, g14 sha256:2"
-		}
-	}
-	value, err := sdkdelivery.EncodeBuilderBuild(v)
-	if err != nil {
-		t.Fatal(err)
-	}
-	key, err := sdkdelivery.BuilderBuildKey(module, fp)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := b.builds.Put(context.Background(), key, value); err != nil {
-		t.Fatal(err)
-	}
-}
-
-// theIndexedModule is the look at the indexer as the controller makes it, kept before any test replaces it.
-var theIndexedModule = indexedModule

cmd/mesh-controller/bus_runs_test.go

@@ -1,29 +0,0 @@
-package main
-
-import (
-	"context"
-	"testing"
-)
-
-// 1945 (dev-r6-controller's B8 follows it): what a bus machine runs is read from its have, not from a send kept, so a
-// machine whose have names the build the mesh holds is not moved by a bus upgrade, and one whose have names an older
-// build is.
-func TestABusMachineRunsWhatItsHaveNames(t *testing.T) {
-	was := busRuns
-	t.Cleanup(func() { busRuns = was })
-	busRuns = func(_ context.Context, node, _ string) (string, bool, error) {
-		return map[string]string{"novox": "src2:new", "ace": "src2:old"}[node], node != "g14", nil
-	}
-	b := busPending{module: "nats", to: "c-new", from: map[string]string{}, same: map[string]bool{}}
-	commitOf := map[string]string{"src2:new": "c-new", "src2:old": "c-old"}
-	for _, n := range []string{"novox", "ace", "g14"} {
-		fp, known, _ := busRuns(context.Background(), n, "nats")
-		if c, ok := commitOf[fp]; known && ok {
-			b.from[n] = c
-		}
-	}
-	if b.moves("novox") || !b.moves("ace") || !b.moves("g14") {
-		t.Errorf("novox moves %v (runs the new build), ace %v (an older one), g14 %v (says none)", b.moves("novox"),
-			b.moves("ace"), b.moves("g14"))
-	}
-}

cmd/mesh-controller/bus_step.go

@@ -1,504 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"flag"
-	"fmt"
-	"sort"
-	"strings"
-	"time"
-
-	"github.com/nats-io/nats.go"
-	"github.com/nats-io/nats.go/jetstream"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
-	"github.com/novox/mesh-controller/internal/conditions"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// The bus as a planned step (novox/hq to-be 45 §8, ADR 0227 rule 8, ADR 0236).
-//
-// **A bus upgrade is never rolled out.** The bus carries every declaration, every report and the
-// controller's own lease; a new bus build that does not come up is a mesh nobody can tell anything,
-// and a version whose data format moved (2.10 → 2.11) cannot be undone by putting the old one back.
-// So nothing sends a new bus build on its own: its policy is `record` whatever anyone says (the
-// catalogue's DerivedUpgrade, and `upgrade` refuses a roll-out), a plan builds it and sends nothing, a
-// cascade holds the machine (ADR 0221), and a push naming that machine is refused while a new bus build
-// waits for it (busHeld). The one way is this verb: a person, with why, the streams snapshotted first,
-// whether it can be reverted said before it starts, the step said as `bus-maintenance` while it runs,
-// and every stream, durable consumer and a round trip checked after (H-bus) — or the step said failed,
-// with its snapshot as the way back.
-
-// busStepProbe is the registry's row for the step; its kinds.
-const (
-	busStepProbe         = "DB"
-	kindBusMaintenance   = "bus-maintenance"
-	kindBusUpgradeFailed = "bus-upgrade-failed"
-)
-
-// busStepBound is how long after its start a bus upgrade must be followed by a healthy bus.
-var busStepBound = 15 * time.Minute
-
-// takeBusSnapshot snapshots every stream before a bus upgrade and answers where the snapshot is: the bus
-// machine's backup holder backs the bus module up now, whose dump is the streams' snapshot (novox/hq ADR
-// 0235). A variable so a test takes none. A person who took one by hand says where with --snapshot-taken,
-// and then none is taken — for a bus whose module does not yet carry the snapshot program.
-var takeBusSnapshot = snapshotTheBusNow
-
-// busPending is what a bus upgrade would do: the bus's module, the machines running it, and, per
-// machine, the build it was last sent against the build the mesh holds. Empty machines: the mesh holds
-// no bus module.
-type busPending struct {
-	module   string
-	machines []string
-	from     map[string]string
-	to       string
-	// same are the commits whose build was made from the same source as the build the mesh holds, or
-	// made the same artifacts and manifest (novox/hq issue 280).
-	same map[string]bool
-}
-
-// moves is whether sending the machine would replace its bus: a build it was not last sent, unless the
-// two builds were made from the same source, or made the same artifacts from the same manifest — a
-// rebuild of the same source for another module's merge changes nothing the machine runs, whatever
-// image digest it made (novox/hq issue 280).
-func (b busPending) moves(machine string) bool {
-	from, known := b.from[machine]
-	if b.module == "" || b.to == "" || (known && sameCommit(from, b.to)) {
-		return false
-	}
-	return !known || !b.same[from]
-}
-
-// pendingBus reads what a bus upgrade would do.
-func pendingBus(ctx context.Context, inv *inventory.Inventory) (busPending, error) {
-	var b busPending
-	shelf, err := inv.Catalogue(ctx)
-	if err != nil {
-		return b, err
-	}
-	for name, m := range shelf {
-		if catalogue.ProvidesBus(m) {
-			b.module = name
-		}
-	}
-	if b.module == "" {
-		return b, nil
-	}
-	current, err := inv.CurrentBuilds(ctx)
-	if err != nil {
-		return b, err
-	}
-	b.to = current[b.module].Commit
-	if b.machines, err = inv.Running(ctx, b.module); err != nil {
-		return b, err
-	}
-	b.from, b.same = map[string]string{}, map[string]bool{}
-	made, err := inv.BuildFingerprints(ctx, b.module)
-	if err != nil {
-		return b, err
-	}
-	for commit, refs := range made {
-		b.same[commit] = refs != "" && refs == made[b.to]
-	}
-	sources, err := inv.BuildSourceFingerprints(ctx, b.module)
-	if err != nil {
-		return b, err
-	}
-	for commit, src := range sources {
-		if src != "" && src == sources[b.to] {
-			b.same[commit] = true
-		}
-	}
-	// What each machine runs is its have's fingerprint (novox/hq ADR 0539 clause 9), the commit of the build of it.
-	commitOf := map[string]string{}
-	for commit, src := range sources {
-		if src != "" {
-			commitOf[src] = commit
-		}
-	}
-	for _, n := range b.machines {
-		fp, known, err := busRuns(ctx, n, b.module)
-		if err != nil {
-			return b, err
-		}
-		if c, ok := commitOf[fp]; known && ok {
-			b.from[n] = c
-		}
-	}
-	return b, nil
-}
-
-// busRuns is the fingerprint a machine's node-engine says it runs of a module, from its have; known is false when it
-// says none. A variable so a test reads it without a bus.
-var busRuns = func(ctx context.Context, node, module string) (string, bool, error) {
-	bus, err := aBus()
-	if err != nil {
-		return "", false, err
-	}
-	defer bus.Close()
-	js, err := jetstream.New(bus.Conn())
-	if err != nil {
-		return "", false, err
-	}
-	h, found, err := haveOn(ctx, js, node, module)
-	if err != nil || !found || h.FP == "" {
-		return "", false, err
-	}
-	return h.FP, true, nil
-}
-
-// busHeld names the machines a push may not send because sending them would replace the bus: the
-// planned step's, not a push's (ADR 0236). Said with the remedy.
-func busHeld(ctx context.Context, inv *inventory.Inventory, machines []string) (map[string]string, error) {
-	b, err := pendingBus(ctx, inv)
-	if err != nil {
-		return nil, err
-	}
-	out := map[string]string{}
-	for _, n := range machines {
-		for _, holder := range b.machines {
-			if n == holder && b.moves(n) {
-				out[n] = fmt.Sprintf("sending %s would replace the bus (%s %s → %s), which is a planned step: "+
-					"`bus upgrade --why …` snapshots its streams first and checks them after (novox/hq ADR 0236)",
-					n, b.module, short(orNotKnown(b.from[n])), short(b.to))
-			}
-		}
-	}
-	return out, nil
-}
-
-// busCommand is `bus` — what a bus upgrade would do and how the last went — and `bus upgrade`.
-func busCommand(ctx context.Context, args []string) error {
-	sub := ""
-	if len(args) > 0 && !strings.HasPrefix(args[0], "-") {
-		sub, args = args[0], args[1:]
-	}
-	set := flag.NewFlagSet("bus", flag.ContinueOnError)
-	snapshot := set.String("snapshot-taken", "", "where the streams' snapshot a person took is, while the mesh takes none itself")
-	reversible := set.Bool("reversible", false, "the new version can be undone by putting the old one back")
-	irreversible := set.Bool("irreversible", false, "the new version cannot be undone by putting the old one back, "+
-		"and this is the person's explicit word that it runs anyway")
-	why := addHandActFlags(set)
-	if rest, err := parseAround(set, args); err != nil {
-		return err
-	} else if len(rest) > 0 {
-		return errors.New("bus [upgrade --why … --reversible|--irreversible [--snapshot-taken <where>]]")
-	}
-	switch sub {
-	case "":
-		return busStatus(ctx)
-	case "upgrade":
-	default:
-		return fmt.Errorf("bus says what a bus upgrade would do, or `bus upgrade` — not %q", sub)
-	}
-	// Everything refused before anything is done.
-	if err := why.require("bus upgrade"); err != nil {
-		return err
-	}
-	if *reversible == *irreversible {
-		return errors.New("bus upgrade says, before it starts, whether the new version can be undone by putting the " +
-			"old one back: --reversible, or --irreversible as your explicit word that it runs anyway (to-be 45 §8). " +
-			"Nothing was done")
-	}
-	open, err := openStores(ctx)
-	if err != nil {
-		return err
-	}
-	defer open.Close()
-	inv := open.inventory
-	b, err := pendingBus(ctx, inv)
-	if err != nil {
-		return err
-	}
-	if b.module == "" {
-		return errors.New("the mesh holds no module that provides its bus: there is nothing to upgrade")
-	}
-	var moving []string
-	for _, n := range b.machines {
-		if b.moves(n) {
-			moving = append(moving, n)
-		}
-	}
-	if len(moving) == 0 {
-		fmt.Printf("every machine running %s runs the build the mesh holds (%s): nothing to upgrade\n", b.module, short(b.to))
-		return nil
-	}
-	where := strings.TrimSpace(*snapshot)
-	if where == "" {
-		for _, n := range moving {
-			fmt.Printf("snapshotting the bus's streams on %s first (its backup holder, ADR 0235)…\n", n)
-			if where, err = takeBusSnapshot(ctx, b.module, n); err != nil {
-				return fmt.Errorf("the streams could not be snapshotted, so the bus is not replaced: %w — a snapshot "+
-					"taken by hand is said with --snapshot-taken <where>", err)
-			}
-		}
-	}
-	from := map[string]bool{}
-	for _, n := range moving {
-		from[orNotKnown(b.from[n])] = true
-	}
-	step, err := inv.StartBusStep(ctx, inventory.BusStep{Module: b.module, Machines: moving,
-		From: strings.Join(sortedKeys(from), ", "), To: b.to, Snapshot: where, Reversible: *reversible,
-		By: link.Caller(), Why: strings.TrimSpace(*why.why)})
-	if err != nil {
-		return err
-	}
-	cause := "bus-upgrade"
-	if strings.TrimSpace(*why.cause) == "" {
-		why.cause = &cause
-	}
-	why.record(ctx, "bus upgrade", append([]string{b.module}, moving...))
-	fmt.Printf("bus upgrade %d: %s %s → %s on %s; streams snapshotted at %s; %s\n", step.ID, b.module, step.From,
-		short(b.to), strings.Join(moving, ", "), where, map[bool]string{true: "reversible: putting the old build back undoes it",
-			false: "NOT reversible: the snapshot is the only way back"}[*reversible])
-	// **Nothing is sent, and the assigner never moves the bus** (novox/hq ADR 0539 clause 15): the bus's machines are
-	// composed at the build the mesh holds, and the operator writes each machine's want with the operator's credential,
-	// recorded, naming that composition.
-	wants, err := busWantsToWrite(withBusStep(ctx), open, b.module, moving)
-	if err != nil {
-		_ = inv.EndBusStep(ctx, step.ID, "failed", "the bus's composition could not be written: "+err.Error())
-		return fmt.Errorf("the bus's machines could not be composed at its new build: %w — nothing was replaced", err)
-	}
-	fmt.Printf("composed %s at the bus's new build. Write each want below with the operator's credential, and record it "+
-		"in the hand-act log; `bus-maintenance` is open until the bus answers healthy again — every stream, every durable "+
-		"consumer, a round trip to the machines (H-bus) — within %s, or the step is said failed with its snapshot as the "+
-		"way back. `bus` says how it went\n", strings.Join(moving, ", "), busStepBound)
-	for _, w := range wants {
-		fmt.Println("  " + w)
-	}
-	return nil
-}
-
-// busWantsToWrite composes the bus's machines and answers, for each, the want the operator writes: its key in the
-// assigner's bucket and its value, naming the fingerprint the bus module is registered at and that machine's
-// composition of it.
-func busWantsToWrite(ctx context.Context, open *stores, module string, machines []string) ([]string, error) {
-	if _, err := composeModules(ctx, open, machines); err != nil {
-		return nil, err
-	}
-	fps, err := currentFingerprints(ctx, open.inventory)
-	if err != nil {
-		return nil, err
-	}
-	bus, err := aBus()
-	if err != nil {
-		return nil, err
-	}
-	defer bus.Close()
-	js, err := jetstream.New(bus.Conn())
-	if err != nil {
-		return nil, err
-	}
-	digests, err := js.KeyValue(ctx, sdkdelivery.ControllerComposedBucket)
-	if err != nil {
-		return nil, err
-	}
-	digestOf := func(node string) (string, error) {
-		key, err := sdkdelivery.ComposedKey(node, module, fps[module])
-		if err != nil {
-			return "", err
-		}
-		e, err := digests.Get(ctx, key)
-		if err != nil {
-			return "", fmt.Errorf("%s: %w", key, err)
-		}
-		v, err := sdkdelivery.DecodeComposedDigest(e.Value())
-		return v.Digest, err
-	}
-	return busWants(module, fps[module], machines, digestOf)
-}
-
-// busWants is each machine's want for the bus module, as the operator writes it: `<bucket> <key> <value>`.
-func busWants(module, fp string, machines []string, digestOf func(node string) (string, error)) ([]string, error) {
-	var out []string
-	for _, node := range machines {
-		digest, err := digestOf(node)
-		if err != nil {
-			return nil, err
-		}
-		key, err := sdkdelivery.WantKey(node, module)
-		if err != nil {
-			return nil, err
-		}
-		value, err := sdkdelivery.EncodeWant(sdkdelivery.Want{FP: fp, Composed: digest,
-			Words: "the bus moved by a person's step (bus upgrade, ADR 0539 clause 15)"})
-		if err != nil {
-			return nil, err
-		}
-		out = append(out, fmt.Sprintf("%s %s %s", sdkdelivery.AssignerWantsBucket, key, value))
-	}
-	return out, nil
-}
-
-// busStatus is `bus`: what an upgrade would do, and the last step.
-func busStatus(ctx context.Context) error {
-	open, err := openStores(ctx)
-	if err != nil {
-		return err
-	}
-	defer open.Close()
-	b, err := pendingBus(ctx, open.inventory)
-	if err != nil {
-		return err
-	}
-	if b.module == "" {
-		fmt.Println("the mesh holds no module that provides its bus")
-	} else {
-		fmt.Printf("the bus is %s, built %s, on %s; never rolled out — a planned step (`bus upgrade`)\n", b.module,
-			short(b.to), orNone(strings.Join(b.machines, ", ")))
-		for _, n := range b.machines {
-			state := "runs it"
-			if b.moves(n) {
-				state = "runs " + short(orNotKnown(b.from[n])) + ": `bus upgrade` replaces it"
-			}
-			fmt.Printf("  %-10s %s\n", n, state)
-		}
-	}
-	fmt.Println("  `bus upgrade` has the bus machine's backup holder snapshot the streams first (ADR 0235)")
-	s, found, err := open.inventory.LatestBusStep(ctx)
-	if err != nil || !found {
-		return err
-	}
-	state := "running since " + s.Started.Local().Format("2006-01-02 15:04")
-	if s.Ended != nil {
-		state = s.Outcome + " at " + s.Ended.Local().Format("2006-01-02 15:04")
-	}
-	fmt.Printf("last step %d: %s → %s on %s by %s (%s): %s; snapshot %s\n", s.ID, s.From, short(s.To),
-		strings.Join(s.Machines, ", "), orNone(s.By), s.Why, state, s.Snapshot)
-	if s.Found != "" {
-		fmt.Printf("  %s\n", s.Found)
-	}
-	return nil
-}
-
-// probeBusStep is DB: a bus upgrade running is said as `bus-maintenance`; the bus healthy again after
-// the machines reported the new build ends it done; past its bound, unhealthy, it ends failed and is
-// said — urgent, with its snapshot — while the bus is still not healthy.
-func probeBusStep(ctx context.Context, d *doctor) ([]conditions.Observation, error) {
-	inv := d.open.inventory
-	s, found, err := inv.LatestBusStep(ctx)
-	if err != nil || !found {
-		return nil, err
-	}
-	if s.Ended != nil && s.Outcome != "failed" {
-		return nil, nil
-	}
-	problems, err := busHealth(ctx, d)
-	if err != nil {
-		return nil, err
-	}
-	reports, err := lastReports(ctx, inv)
-	if err != nil {
-		return nil, err
-	}
-	applied := true
-	for _, r := range reports {
-		for _, n := range s.Machines {
-			if r.Node == n && (!r.Current || r.Outcome != inventory.OutcomeApplied || r.At == nil || r.At.Before(s.Started)) {
-				applied = false
-				problems = append(problems, n+" has not reported the new bus applied")
-			}
-		}
-	}
-	id := s.Module
-	if s.Ended == nil {
-		switch {
-		case applied && len(problems) == 0:
-			return nil, inv.EndBusStep(ctx, s.ID, "done", "the bus answered healthy after the upgrade")
-		case time.Since(s.Started) > busStepBound:
-			found := strings.Join(problems, "; ")
-			if err := inv.EndBusStep(ctx, s.ID, "failed", found); err != nil {
-				return nil, err
-			}
-			s.Found = found
-		default:
-			return []conditions.Observation{{Scope: conditions.ScopeBus, ID: id, Token: "maintenance",
-				Kind: kindBusMaintenance, Severity: conditions.Warning,
-				Summary: fmt.Sprintf("the bus is being upgraded (step %d, %s → %s on %s, by %s: %s); its snapshot is %s",
-					s.ID, s.From, short(s.To), strings.Join(s.Machines, ", "), orNone(s.By), s.Why, s.Snapshot),
-				Said: orNone(strings.Join(problems, "; "))}}, nil
-		}
-	}
-	if len(problems) == 0 {
-		return nil, nil // failed, and healthy since: nothing wrong now
-	}
-	way := "put the old build back"
-	if !s.Reversible {
-		way = "restore the snapshot"
-	}
-	return []conditions.Observation{{Scope: conditions.ScopeBus, ID: id, Token: "upgrade-failed",
-		Kind: kindBusUpgradeFailed, Severity: conditions.Urgent, Resolver: conditions.ResolverOperator,
-		Summary: fmt.Sprintf("the bus upgrade (step %d, %s → %s) did not end healthy within %s: %s — the way back is to %s (%s)",
-			s.ID, s.From, short(s.To), busStepBound, strings.Join(problems, "; "), way, s.Snapshot)}}, nil
-}
-
-func sortedKeys(set map[string]bool) []string {
-	out := make([]string, 0, len(set))
-	for k := range set {
-		out = append(out, k)
-	}
-	sort.Strings(out)
-	return out
-}
-
-// busSnapshotWithin is how long the bus machine's backup holder is given to take the bus's snapshot.
-var busSnapshotWithin = 15 * time.Minute
-
-// snapshotTheBusNow asks the bus machine's backup holder to back the bus module up now — its dump is
-// the streams' snapshot (novox/hq ADR 0235) — and waits until it says a backup newer than the ask:
-// where the snapshot is, as a person reads it. The serving controller's connection, or one of its own.
-func snapshotTheBusNow(ctx context.Context, module, node string) (string, error) {
-	var where string
-	err := onTheBus(func(conn *nats.Conn) error {
-		asked := time.Now()
-		answer, err := link.AskSeatTool(ctx, conn, catalogue.BackupSeat, "now", node,
-			map[string]any{"module": module}, 30*time.Second)
-		if err != nil {
-			return fmt.Errorf("%s's backup holder was not asked to take the bus's snapshot: %w", node, err)
-		}
-		if answer.Error != "" {
-			return fmt.Errorf("%s's backup holder would not take the bus's snapshot: %s", node, answer.Error)
-		}
-		deadline := time.Now().Add(busSnapshotWithin)
-		for {
-			answer, err := link.AskSeatTool(ctx, conn, catalogue.BackupSeat, "backed-up", node, map[string]any{}, 10*time.Second)
-			if err == nil && answer.Error == "" {
-				if measured, err := readHolder(answer.Result); err == nil {
-					for item, m := range measured[module] {
-						if m.LastBackup != nil && m.LastBackup.After(asked) && m.Error == "" {
-							where = fmt.Sprintf("%s's restore point of %s (%s) taken %s", node, module, item,
-								m.LastBackup.UTC().Format(time.RFC3339))
-							return nil
-						}
-					}
-				}
-			}
-			if time.Now().After(deadline) {
-				return fmt.Errorf("%s's backup holder did not say the bus's snapshot was taken within %s; the bus is "+
-					"not replaced", node, busSnapshotWithin)
-			}
-			select {
-			case <-ctx.Done():
-				return ctx.Err()
-			case <-time.After(10 * time.Second):
-			}
-		}
-	})
-	return where, err
-}
-
-// errBusWaits is a send refused because it would replace the bus outside its planned step.
-var errBusWaits = errors.New("a new bus build waits for its planned step")
-
-type busStepKey struct{}
-
-// withBusStep marks a send as the bus's planned step: the one send that may replace the bus.
-func withBusStep(ctx context.Context) context.Context {
-	return context.WithValue(ctx, busStepKey{}, true)
-}
-
-func busStepSending(ctx context.Context) bool { on, _ := ctx.Value(busStepKey{}).(bool); return on }

cmd/mesh-controller/bus_step_wants_test.go

@@ -1,33 +0,0 @@
-package main
-
-import (
-	"strings"
-	"testing"
-
-	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// 1945/AC7: a bus upgrade answers, for each machine, the want the operator writes: the assigner's bucket, the
-// machine's key for the bus module, and a want naming the bus's fingerprint and that machine's composition of it. It
-// sends nothing: nothing it calls publishes on a node's declaration subject (busWants composes no send at all).
-func TestABusUpgradeAnswersTheWantTheOperatorWrites(t *testing.T) {
-	fp := sdkdelivery.SourcePrefix2 + strings.Repeat("b", 64)
-	digests := map[string]string{"novox": "sha256:" + strings.Repeat("1", 64), "ace": "sha256:" + strings.Repeat("2", 64)}
-	lines, err := busWants("nats", fp, []string{"ace", "novox"}, func(node string) (string, error) { return digests[node], nil })
-	if err != nil || len(lines) != 2 {
-		t.Fatalf("busWants = %v, %v", lines, err)
-	}
-	for i, node := range []string{"ace", "novox"} {
-		parts := strings.SplitN(lines[i], " ", 3)
-		if len(parts) != 3 || parts[0] != sdkdelivery.AssignerWantsBucket || parts[1] != "want."+node+".nats" {
-			t.Fatalf("line %q", lines[i])
-		}
-		w, err := sdkdelivery.DecodeWant([]byte(parts[2]))
-		if err != nil || w.FP != fp || w.Composed != digests[node] {
-			t.Errorf("%s's want = %+v, %v", node, w, err)
-		}
-	}
-	if _, err := busWants("nats", fp, []string{"ace"}, func(string) (string, error) { return "", nil }); err == nil {
-		t.Errorf("a want naming no composition was answered")
-	}
-}

cmd/mesh-controller/bus_users_closed_test.go

@@ -1,92 +0,0 @@
-package main
-
-import (
-	"errors"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/conditions"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// **Every user's slow consumer is S9's, not the controller's alone** (novox/hq ADR 0357, issue 270). On
-// 2026-10-07 the bus closed two clients on the laptop as slow consumers and nothing raised a condition:
-// the controller heard only its own connection. Said by the bus module and read back, a user the bus
-// closes is one condition naming the module and its machine, raised at the first look and cleared an hour
-// after the last closure.
-func TestAUserTheBusClosedAsASlowConsumerIsOneConditionNamingItsModuleAndMachine(t *testing.T) {
-	closed := time.Date(2026, 10, 14, 12, 0, 0, 0, time.UTC)
-	now := closed.Add(20 * time.Second)
-	store := conditions.NewInMemory()
-	k := conditions.NewKeeper(t.Context(), conditions.Options{Store: store, History: store,
-		Teller: &conditions.Told{}, Now: func() time.Time { return now }})
-	t.Cleanup(func() { k.Close(t.Context()) })
-
-	advisories := link.BusClosures([]link.BusClosure{
-		{User: "laptop.claude-code", CID: 10, Reason: "Slow Consumer (Write Deadline)", Opened: closed.Add(-time.Hour),
-			Closed: closed.Add(-10 * time.Minute)},
-		{User: "laptop.claude-code", CID: 44, Reason: "Slow Consumer (Write Deadline)", Opened: closed.Add(-time.Minute),
-			Closed: closed},
-		{User: "anchor.desk", CID: 7, Reason: "Maximum Message Payload Exceeded", Opened: closed.Add(-time.Hour),
-			Closed: closed},
-	}, []string{link.AdvisorySlowConsumer, link.AdvisorySlowConsumer, link.AdvisoryConnectionClosed}, closed.Add(-time.Hour))
-	look := func() {
-		t.Helper()
-		f := &signalFacts{now: now, host: "anchor", advisories: advisories}
-		if err := k.Reconcile(t.Context(), "S9", watchAdvisories(f)); err != nil {
-			t.Fatal(err)
-		}
-	}
-	look()
-
-	slow, found, err := conditions.ReadOne(t.Context(), store, "bus.laptop.claude-code.slow-consumer")
-	if err != nil || !found {
-		t.Fatalf("no slow-consumer condition for the user: %v %v", found, err)
-	}
-	if slow.Subject.Machine != "laptop" || slow.Observations != 2 || !slow.LastObserved.Equal(closed) {
-		t.Fatalf("the slow consumer is said on %q, %d closure(s), last %s: %+v", slow.Subject.Machine, slow.Observations,
-			slow.LastObserved, slow)
-	}
-	if !strings.Contains(slow.Summary, "claude-code on laptop") || strings.Contains(slow.Summary, "laptop.claude-code") {
-		t.Fatalf("the summary does not name the module in words, or carries the dotted user: %q", slow.Summary)
-	}
-	if !strings.Contains(slow.Headline, "Claude-code on laptop") {
-		t.Fatalf("the headline is %q", slow.Headline)
-	}
-	cut, found, err := conditions.ReadOne(t.Context(), store, "bus.anchor.desk.connection-closed")
-	if err != nil || !found || cut.Subject.Machine != "anchor" || !strings.Contains(cut.Summary, "maximum message payload exceeded") {
-		t.Fatalf("the user cut off for breaking the bus's rules: %v %v %+v", found, err, cut)
-	}
-
-	// An hour after the newest closure without another, both clear.
-	now = closed.Add(time.Hour + time.Minute)
-	look()
-	for _, key := range []string{"bus.laptop.claude-code.slow-consumer", "bus.anchor.desk.connection-closed"} {
-		if _, found, _ := k.Get(t.Context(), key); found {
-			t.Fatalf("%s is still open an hour after the last closure", key)
-		}
-	}
-}
-
-// **A read of the bus module's events that fails does not blind S9** (review of #326): the controller's own
-// signals are still said, and the failed read is a condition of its own.
-func TestABusModuleReadThatFailsKeepsTheControllersOwnSignals(t *testing.T) {
-	at := time.Date(2026, 10, 14, 12, 0, 0, 0, time.UTC)
-	f := &signalFacts{now: at.Add(time.Minute), host: "anchor",
-		advisories: []link.Advisory{{Kind: link.AdvisorySlowConsumer, ID: "controller", Said: "the controller fell behind",
-			First: at, Last: at, Count: 1}},
-		busFaultsErr: errors.New("nats: timeout")}
-	keys := map[string]bool{}
-	for _, o := range watchAdvisories(f) {
-		keys[o.Key()] = true
-	}
-	if !keys["bus.controller.slow-consumer"] || !keys["bus.bus-module.bus-faults-unread"] {
-		t.Fatalf("observed %v: the controller's own slow consumer and the unread events, both", keys)
-	}
-	for _, row := range signalsTable {
-		if row.Row == "S9" && row.needs(f) != nil {
-			t.Fatal("the S9 row went blind for a read of the bus module's events")
-		}
-	}
-}

cmd/mesh-controller/buscertificate.go

@@ -1,258 +0,0 @@
-package main
-
-import (
-	"context"
-	"crypto/rand"
-	"crypto/rsa"
-	"crypto/x509"
-	"crypto/x509/pkix"
-	"encoding/pem"
-	"errors"
-	"fmt"
-	"math/big"
-	"net"
-	"os"
-	"path/filepath"
-	"strings"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/broker"
-)
-
-// The bus's own certificate, made by the mesh rather than borrowed from an image.
-//
-// **The foundation asked a third-party image for a tool it never said must be there** (novox/hq
-// 04-ISSUES/146). The bootstrap made this certificate by running `openssl` inside the broker's
-// image, which worked while the broker was one that happened to carry it and stopped the day the
-// bus changed: the new one has a shell and no openssl, so the step exited 127 and no mesh could be
-// raised. Substituting another image the bundle names does not help — none of them carry it
-// either.
-//
-// So the program that needs a certificate makes one. It is the mesh's own binary, already on the
-// machine at this point in the bootstrap (the schema step ran it), and it needs nothing from the
-// image it writes into but a mounted directory.
-//
-// **Self-signed, and that is the design** — a host pins this server's exact certificate and
-// authenticates with a password (novox/hq ADR 0004). There is no authority above it to ask, and at
-// this moment in a bootstrap there is no mesh to ask one of.
-//
-// Idempotent, because the step is applied again on every reconcile and a second certificate would
-// be one the hosts that pinned the first no longer believe.
-
-// busCertificateNames is what the bus is reached by: the container name on a mesh network, and the
-// loopback address the machine's own foundation dials.
-var busCertificateNames = []string{"mesh-broker"}
-
-const busCertificateLife = 10 * 365 * 24 * time.Hour
-
-// busCertificate makes the bus's certificate in a directory, or says whether one is there.
-//
-//	broker certificate --into /tls           make it if it is not there
-//	broker certificate --check --into /tls   exit non-zero unless a usable pair is
-func busCertificate(args []string) error {
-	into, check := "", false
-	for i := 0; i < len(args); i++ {
-		switch args[i] {
-		case "--check":
-			check = true
-		case "--into":
-			if i+1 >= len(args) {
-				return errors.New("--into needs a directory")
-			}
-			into = args[i+1]
-			i++
-		default:
-			return fmt.Errorf("broker certificate [--check] --into <directory>: %q", args[i])
-		}
-	}
-	if into == "" {
-		return errors.New("broker certificate [--check] --into <directory>")
-	}
-	crt, key := filepath.Join(into, "tls.crt"), filepath.Join(into, "tls.key")
-
-	if usable, err := busCertificateUsable(crt, key); err != nil {
-		return err
-	} else if usable {
-		fmt.Printf("the bus already has a certificate at %s, and it was left alone\n", crt)
-		return nil
-	}
-	if check {
-		// Said as a failure, because that is what the caller asked: a bootstrap's verify runs
-		// this and a false answer is what makes the step run.
-		return fmt.Errorf("no usable certificate and key at %s", into)
-	}
-	return writeBusCertificate(crt, key)
-}
-
-// busCertificateUsable says whether a certificate and its key are both there and parse.
-//
-// Both, and parsed rather than stat'ed: a half-written pair is the state a bootstrap interrupted
-// between the two files leaves behind, and a step that treated it as done would hand the server a
-// certificate with no key and report success.
-func busCertificateUsable(crt, key string) (bool, error) {
-	certPEM, err := os.ReadFile(crt)
-	if errors.Is(err, os.ErrNotExist) {
-		return false, nil
-	}
-	if err != nil {
-		return false, err
-	}
-	keyPEM, err := os.ReadFile(key)
-	if errors.Is(err, os.ErrNotExist) {
-		return false, nil
-	}
-	if err != nil {
-		return false, err
-	}
-	if _, err := tlsPairParses(certPEM, keyPEM); err != nil {
-		return false, nil
-	}
-	return true, nil
-}
-
-func tlsPairParses(certPEM, keyPEM []byte) (*x509.Certificate, error) {
-	block, _ := pem.Decode(certPEM)
-	if block == nil || block.Type != "CERTIFICATE" {
-		return nil, errors.New("not a certificate")
-	}
-	certificate, err := x509.ParseCertificate(block.Bytes)
-	if err != nil {
-		return nil, err
-	}
-	keyBlock, _ := pem.Decode(keyPEM)
-	if keyBlock == nil {
-		return nil, errors.New("not a key")
-	}
-	if _, err := x509.ParsePKCS8PrivateKey(keyBlock.Bytes); err != nil {
-		if _, err := x509.ParsePKCS1PrivateKey(keyBlock.Bytes); err != nil {
-			return nil, err
-		}
-	}
-	return certificate, nil
-}
-
-func writeBusCertificate(crt, key string) error {
-	private, err := rsa.GenerateKey(rand.Reader, 2048)
-	if err != nil {
-		return err
-	}
-	serial, err := rand.Int(rand.Reader, new(big.Int).Lsh(big.NewInt(1), 128))
-	if err != nil {
-		return err
-	}
-	template := &x509.Certificate{
-		SerialNumber:          serial,
-		Subject:               pkix.Name{CommonName: busCertificateNames[0]},
-		DNSNames:              busCertificateNames,
-		IPAddresses:           []net.IP{net.ParseIP("127.0.0.1")},
-		NotBefore:             time.Now().Add(-time.Hour),
-		NotAfter:              time.Now().Add(busCertificateLife),
-		KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
-		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
-		BasicConstraintsValid: true,
-	}
-	der, err := x509.CreateCertificate(rand.Reader, template, template, &private.PublicKey, private)
-	if err != nil {
-		return err
-	}
-	pkcs8, err := x509.MarshalPKCS8PrivateKey(private)
-	if err != nil {
-		return err
-	}
-
-	// **The key first, and only then the certificate**, so the pair a reader finds is never a
-	// certificate whose key has not been written yet — the one order in which an interruption
-	// leaves something that looks finished (novox/hq 04-ISSUES/014, a key present and unusable).
-	if err := os.WriteFile(key, pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: pkcs8}), 0o600); err != nil {
-		return err
-	}
-	if err := os.WriteFile(crt, pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der}), 0o644); err != nil {
-		return err
-	}
-	fmt.Printf("made the bus a certificate for %v, valid until %s\n  %s\n  %s\n",
-		busCertificateNames, template.NotAfter.Format(time.RFC3339), crt, key)
-	return nil
-}
-
-// busAccounts writes the mesh's composed user list to a file.
-//
-// **For genesis, where no declaration can deliver it** (novox/hq 04-ISSUES/146). Everywhere else
-// the list reaches the machine running the bus as a resource of the module that holds it — which
-// requires that machine to be an enrolled node, and at genesis it is not: the first node cannot
-// enrol because the account it would enrol with cannot be composed onto a bus it has no declaration
-// for. The installer breaks that circle by placing the file itself, once, and the module takes the
-// file over from its first push.
-//
-// The same composition, not a second one: this asks the store for the same records and renders them
-// with the same composer the declaration uses. A genesis that hand-wrote an account would be a
-// second statement of who may say what, able to disagree with the first.
-//
-// **It writes to standard output unless told a file**, and that is the point: the control plane
-// composes and says what it composed, and whoever is raising the machine puts it where that
-// machine's bus reads it. A control plane that wrote into the bus's own directory would have to
-// know where that is and how to make the server re-read it — which is the module's knowledge, and
-// the module is what takes this over on the first push.
-//
-//	broker accounts > /var/lib/mesh-bus-conf/accounts.conf
-func busAccounts(ctx context.Context, args []string) error {
-	into := ""
-	for i := 0; i < len(args); i++ {
-		switch args[i] {
-		case "--into":
-			if i+1 >= len(args) {
-				return errors.New("--into needs a file")
-			}
-			into = args[i+1]
-			i++
-		default:
-			return fmt.Errorf("broker accounts --into <file>: %q", args[i])
-		}
-	}
-
-	open, err := openStores(ctx)
-	if err != nil {
-		return err
-	}
-	defer open.Close()
-
-	records, err := open.inventory.BusRecords(ctx)
-	if err != nil {
-		return err
-	}
-	users, err := broker.Users(records)
-	if err != nil {
-		return err
-	}
-	kept, err := open.inventory.BusUsers(ctx)
-	if err != nil {
-		return err
-	}
-	hashes := make(map[string]string, len(kept))
-	for name, u := range kept {
-		hashes[name] = u.PasswordHash
-	}
-	filled, missing := broker.WithPasswords(users, hashes)
-	if len(missing) > 0 {
-		// To standard error, always: the composed file may be going to standard output, and a
-		// remark in the middle of it is a configuration the server refuses to parse.
-		fmt.Fprintf(os.Stderr, "leaving out %d user(s) the mesh has minted no credential for: %s\n",
-			len(missing), strings.Join(missing, ", "))
-	}
-	if len(filled) == 0 {
-		return errors.New("not one user has a credential, so this list would refuse every " +
-			"connection in the mesh")
-	}
-	accounts, err := broker.ComposeAccounts(filled)
-	if err != nil {
-		return err
-	}
-	if into == "" {
-		fmt.Print(accounts)
-		return nil
-	}
-	if err := os.WriteFile(into, []byte(accounts), 0o600); err != nil {
-		return err
-	}
-	fmt.Printf("wrote %d user(s) to %s\n", len(filled), into)
-	return nil
-}

cmd/mesh-controller/buscertificate_test.go

@@ -1,121 +0,0 @@
-package main
-
-import (
-	"crypto/tls"
-	"crypto/x509"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-// novox/hq 04-ISSUES/146. The bootstrap could not make the bus a certificate: it asked an image for
-// `openssl` and the image it asks has none. What replaces it is this command, so what is checked is
-// what the bootstrap needs from it — a pair a TLS server can actually load, made once and only once.
-
-func TestTheBusCertificateLoadsAsAServersWould(t *testing.T) {
-	into := t.TempDir()
-	if err := busCertificate([]string{"--into", into}); err != nil {
-		t.Fatalf("the bus could not be given a certificate: %v", err)
-	}
-
-	// The check a cheaper test would not make. The key was present and valid and the server could
-	// not start, once, because nothing loaded the pair the way a server loads it
-	// (novox/hq 04-ISSUES/014).
-	pair, err := tls.LoadX509KeyPair(filepath.Join(into, "tls.crt"), filepath.Join(into, "tls.key"))
-	if err != nil {
-		t.Fatalf("a TLS server cannot load what was written: %v", err)
-	}
-	leaf := pair.Leaf
-	if leaf == nil {
-		if leaf, err = x509.ParseCertificate(pair.Certificate[0]); err != nil {
-			t.Fatal(err)
-		}
-	}
-	if err := leaf.VerifyHostname("mesh-broker"); err != nil {
-		t.Errorf("the certificate is not for the name the bus is reached by: %v", err)
-	}
-	if len(leaf.IPAddresses) == 0 || leaf.IPAddresses[0].String() != "127.0.0.1" {
-		t.Errorf("the certificate does not cover the loopback address the foundation dials: %v", leaf.IPAddresses)
-	}
-
-	// The key is not readable by anything else on the machine; the certificate is public and is.
-	key, err := os.Stat(filepath.Join(into, "tls.key"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if key.Mode().Perm() != 0o600 {
-		t.Errorf("the key is %v", key.Mode().Perm())
-	}
-	crt, err := os.Stat(filepath.Join(into, "tls.crt"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if crt.Mode().Perm() != 0o644 {
-		t.Errorf("the certificate is %v, which the server runs as another user cannot read", crt.Mode().Perm())
-	}
-}
-
-// **Made once.** The step is applied again on every reconcile, and a second certificate is one the
-// hosts that pinned the first no longer believe (novox/hq ADR 0004).
-func TestTheBusCertificateIsMadeOnce(t *testing.T) {
-	into := t.TempDir()
-	if err := busCertificate([]string{"--into", into}); err != nil {
-		t.Fatal(err)
-	}
-	first, err := os.ReadFile(filepath.Join(into, "tls.crt"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := busCertificate([]string{"--into", into}); err != nil {
-		t.Fatal(err)
-	}
-	again, err := os.ReadFile(filepath.Join(into, "tls.crt"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if string(first) != string(again) {
-		t.Fatal("running it twice replaced the certificate every host had pinned")
-	}
-}
-
-// The verify half: false before, true after, which is what makes the bootstrap run the step at all.
-func TestTheCheckIsFalseUntilThereIsAPair(t *testing.T) {
-	into := t.TempDir()
-	if err := busCertificate([]string{"--check", "--into", into}); err == nil {
-		t.Fatal("an empty directory reported a usable certificate")
-	}
-	if err := busCertificate([]string{"--into", into}); err != nil {
-		t.Fatal(err)
-	}
-	if err := busCertificate([]string{"--check", "--into", into}); err != nil {
-		t.Fatalf("the certificate it just made does not satisfy its own check: %v", err)
-	}
-}
-
-// A half-written pair is not a pair. An interrupted bootstrap leaves exactly this, and a step that
-// called it done would hand the server a certificate with no key and report success.
-func TestACertificateWithoutItsKeyIsNotUsable(t *testing.T) {
-	into := t.TempDir()
-	if err := busCertificate([]string{"--into", into}); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.Remove(filepath.Join(into, "tls.key")); err != nil {
-		t.Fatal(err)
-	}
-	if err := busCertificate([]string{"--check", "--into", into}); err == nil {
-		t.Fatal("a certificate with no key passed the check")
-	}
-	if err := busCertificate([]string{"--into", into}); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := tls.LoadX509KeyPair(filepath.Join(into, "tls.crt"), filepath.Join(into, "tls.key")); err != nil {
-		t.Fatalf("it did not replace the unusable pair: %v", err)
-	}
-}
-
-func TestWhereToWriteIsRequired(t *testing.T) {
-	if err := busCertificate(nil); err == nil || !strings.Contains(err.Error(), "--into") {
-		t.Fatalf("it did not ask where to write: %v", err)
-	}
-}

cmd/mesh-controller/busobjects.go

@@ -1,260 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"fmt"
-
-	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/conditions"
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// The streams and durable consumers the mesh's own traffic needs, derived once (novox/hq to-be 45 §4,
-// D6 and D7).
-//
-// **What the controller asserts at its start and what the self-check expects to find are one
-// derivation**, run against the bus to make them and against a recorder to list them. Two lists would
-// drift, and a self-check comparing the bus with a second opinion of what should be there would find
-// the drift rather than the fault.
-
-// assertBusObjects brings every stream and consumer into being on r, and answers the machines that
-// can now hear a declaration.
-func assertBusObjects(ctx context.Context, inv *inventory.Inventory, r broker.Raiser) ([]string, error) {
-	nodes, err := inv.Nodes(ctx)
-	if err != nil {
-		return nil, err
-	}
-	names := make([]string, 0, len(nodes))
-	for _, n := range nodes {
-		names = append(names, n.Name)
-	}
-	// Once every node runs the node-engine that reads no declaration, the declarations' stream and the nodes'
-	// consumers on it are not asserted again (novox/hq ADR 0539 clause 11; composed_start.go retires them).
-	raise := func() error { return broker.Raise(r, names) }
-	if declarationsRetiredNow(ctx, inv) {
-		raise = func() error { return broker.RaiseAfterDeclarations(r) }
-	}
-	if err := raise(); err != nil {
-		return nil, err
-	}
-	// And each node's bucket for the files of its declaration that travel by digest (novox/hq ADR 0486 §4), so a node finds its own
-	// whenever the bus is up.
-	if files, ok := r.(interface{ EnsureDeclarationFiles(nodes []string) error }); ok {
-		if err := files.EnsureDeclarationFiles(names); err != nil {
-			return nil, err
-		}
-	}
-	// The work queues of the mesh's own roles (novox/hq ADR 0121). The queue before the holder,
-	// deliberately: work queues until somebody arrives to do it, so assigning a build machine a week
-	// after something started asking for builds flushes the backlog instead of having lost it.
-	// With the seats' holders, so each role's work queue gets the consumer its holder takes
-	// work from. Passed as nil until the first live raise, which left the build machine bound to a
-	// consumer nothing had created (2026-09-28).
-	holders, err := seatHolders(ctx, inv)
-	if err != nil {
-		return nil, err
-	}
-	if err := broker.RaiseSeats(r, inventory.MeshSeats(), holders); err != nil {
-		return nil, err
-	}
-	// And how every module hears what it consumes. Derived from the same records the user list is
-	// composed from, so a module the mesh grants a consumer's subjects has that consumer waiting.
-	// Done on every raise, not only when a credential is issued: every module moved onto this bus
-	// by the rollout was issued on the old one, and came up with nothing to bind to (2026-09-28).
-	consumers, records, err := moduleConsumersAndRecords(ctx, inv)
-	if err != nil {
-		return nil, err
-	}
-	// And a grant of a restricted stream that composes nothing, said on every raise and send (novox/hq ADR 0376 §2).
-	sayWithheld(records, "  ")
-	// And the work queues of seats that name their caller or their kind, with each holder's worker
-	// (novox/hq ADR 0259 §3): an ask queues until the router takes it, a channel's work until that kind
-	// takes it.
-	trafficStreams, trafficWorkers, err := seatTrafficObjects(ctx, inv)
-	if err != nil {
-		return nil, err
-	}
-	// And every module's own stream (novox/hq ADR 0363), from the catalogue, before the consumers on it.
-	modStreams, err := inv.DeclaredStreams(ctx)
-	if err != nil {
-		return nil, err
-	}
-	// Every one tried, and every failure named: one module's consumer the bus refuses is no reason
-	// the modules after it in the list hear nothing (novox/hq issue 208, where this runs on each send).
-	var failed []error
-	for _, s := range broker.ModuleStreams(modStreams) {
-		if err := r.EnsureStream(s); err != nil {
-			failed = append(failed, fmt.Errorf("the module stream %s: %w", s.Name, err))
-		}
-	}
-	for _, s := range trafficStreams {
-		if err := r.EnsureStream(s); err != nil {
-			failed = append(failed, fmt.Errorf("the work queue %s: %w", s.Name, err))
-		}
-	}
-	for _, c := range trafficWorkers {
-		if err := r.EnsureConsumer(c); err != nil {
-			failed = append(failed, fmt.Errorf("the worker %s on %s: %w", c.Name, c.Stream, err))
-		}
-	}
-	restricted := map[string]bool{}
-	for _, s := range modStreams {
-		restricted[s.Name] = s.Restricted
-	}
-	for _, c := range consumers {
-		if err := broker.EnsureHeard(r, c.Consumer, restricted[c.Consumer.Stream]); err != nil {
-			failed = append(failed, fmt.Errorf("how %s on %s hears what it consumes: %w", c.Module, c.Node, err))
-		}
-	}
-	// **And a consumer no longer granted loses what it reads through** (novox/hq ADR 0363 §6): every consumer
-	// on a module's stream the composition no longer asks for is removed, on this very send.
-	if p, prunes := r.(broker.Pruner); prunes && len(modStreams) > 0 {
-		var wanted []broker.Consumer
-		for _, c := range consumers {
-			wanted = append(wanted, c.Consumer)
-		}
-		removed, err := broker.PruneHeard(p, modStreams, wanted)
-		if err != nil {
-			failed = append(failed, err)
-		}
-		for _, gone := range removed {
-			fmt.Printf("  removed the consumer %s: its module is no longer granted that stream (novox/hq ADR 0363)\n", gone)
-		}
-	}
-	if len(failed) > 0 {
-		return nil, errors.Join(failed...)
-	}
-	return names, nil
-}
-
-// What raises the condition a send says when the objects it implies could not be asserted, and its kind.
-const (
-	sourceBusObjects         = "bus-objects"
-	kindBusObjectsUnasserted = "bus-objects-unasserted"
-)
-
-// assertOnSend asserts, on the bus a send is about to use, every object assertBusObjects derives —
-// **whenever a declaration is sent, not only when the controller starts** (novox/hq issue 208).
-//
-// A module assigned after the controller started was sent its declaration and found no consumer to
-// bind (`consumer not found`, messenger on 2026-10-06), and a seat holder assigned after it found no
-// worker: the objects a declaration implies were asserted at start and nowhere else, so they existed
-// only for what was assigned before the last restart. The same derivation, not a second list of what
-// a send needs: what start asserts, the self-check expects and a send asserts are one answer. Every
-// part is idempotent, so asserting the whole of it again is the no-op a restart already relies on.
-//
-// **A failure is said and raised, and the send goes on.** The objects are the mesh's, not the
-// machines' being sent: holding every machine back for one consumer that none of them may use would
-// turn one fault into all of them, and the declarations are not what is wrong. It is never silent —
-// said in the send's own output and raised as a condition, which the next send that asserts them
-// clears — and the start-time raise still refuses to serve without them.
-func assertOnSend(ctx context.Context, inv *inventory.Inventory, r broker.Raiser, indent string) error {
-	_, err := assertBusObjects(ctx, inv, r)
-	var observed []conditions.Observation
-	if err != nil {
-		fmt.Printf("%sTHE BUS DOES NOT HOLD WHAT THIS SEND IMPLIES: %v\n", indent, err)
-		fmt.Printf("%s  a module may find no consumer to bind, or a holder no worker; sent anyway, raised as "+
-			"condition %s, and asserted again by the next send\n", indent, unassertedObservation(err).Key())
-		observed = append(observed, unassertedObservation(err))
-	}
-	// Observed when it failed, cleared when it did not: a send that asserted everything is the
-	// observation that the bus holds what it should.
-	if kerr := withKeeper(ctx, func(k *conditions.Keeper) error {
-		return k.Reconcile(ctx, sourceBusObjects, observed)
-	}); kerr != nil {
-		fmt.Printf("%sand whether the bus holds what this send implies could not be kept as a condition: %v\n",
-			indent, kerr)
-	}
-	return err
-}
-
-// unassertedObservation is a send's failure to assert the bus's objects, as a condition.
-func unassertedObservation(err error) conditions.Observation {
-	return conditions.Observation{Scope: conditions.ScopeBus, ID: "objects", Token: "unasserted",
-		Kind: kindBusObjectsUnasserted, Severity: conditions.Warning, Source: sourceBusObjects,
-		Summary: "the bus's streams and consumers could not be asserted when a declaration was sent: " +
-			"a module may find no consumer to bind, or a seat's holder no worker",
-		Said: err.Error()}
-}
-
-// moduleConsumers is every module's durable consumer, from the records the user list is composed from.
-func moduleConsumers(ctx context.Context, inv *inventory.Inventory) ([]broker.ModuleConsumer, error) {
-	consumers, _, err := moduleConsumersAndRecords(ctx, inv)
-	return consumers, err
-}
-
-// moduleConsumersAndRecords is moduleConsumers with the records they were composed from.
-func moduleConsumersAndRecords(ctx context.Context, inv *inventory.Inventory) ([]broker.ModuleConsumer, broker.Records, error) {
-	records, err := inv.BusRecords(ctx)
-	if err != nil {
-		return nil, broker.Records{}, err
-	}
-	users, err := broker.Users(records)
-	if err != nil {
-		return nil, broker.Records{}, err
-	}
-	return broker.ConsumersOf(users), records, nil
-}
-
-// seatTrafficObjects is the work queues and workers of seats that name their caller or their kind, from
-// the records the user list is composed from.
-func seatTrafficObjects(ctx context.Context, inv *inventory.Inventory) ([]broker.Stream, []broker.Consumer, error) {
-	records, err := inv.BusRecords(ctx)
-	if err != nil {
-		return nil, nil, err
-	}
-	users, err := broker.Users(records)
-	if err != nil {
-		return nil, nil, err
-	}
-	streams, workers := broker.SeatTrafficObjects(users)
-	// And the queue of every such seat the catalogue declares, held or not: work queues from registration,
-	// so what is submitted before a holder is assigned waits for it (the correctness review of 2026-10-08).
-	declared, err := inv.DeclaredTrafficSeats(ctx)
-	if err != nil {
-		return nil, nil, err
-	}
-	have := map[string]bool{}
-	for _, s := range streams {
-		have[s.Name] = true
-	}
-	for _, s := range broker.TrafficQueues(declared) {
-		if !have[s.Name] {
-			streams = append(streams, s)
-			have[s.Name] = true
-		}
-	}
-	return streams, workers, nil
-}
-
-// moduleConsumerCount is how many modules hear what they consume, for the raise's one line.
-func moduleConsumerCount(ctx context.Context, inv *inventory.Inventory) (int, error) {
-	consumers, err := moduleConsumers(ctx, inv)
-	return len(consumers), err
-}
-
-// expectedBusObjects is every stream and consumer assertBusObjects would make, made nowhere.
-func expectedBusObjects(ctx context.Context, inv *inventory.Inventory) ([]broker.Stream, []broker.Consumer, error) {
-	var rec recordingRaiser
-	if _, err := assertBusObjects(ctx, inv, &rec); err != nil {
-		return nil, nil, fmt.Errorf("what the bus should hold cannot be worked out: %w", err)
-	}
-	return rec.streams, rec.consumers, nil
-}
-
-// recordingRaiser keeps what it was asked to assert and asserts nothing.
-type recordingRaiser struct {
-	streams   []broker.Stream
-	consumers []broker.Consumer
-}
-
-func (r *recordingRaiser) EnsureStream(s broker.Stream) error {
-	r.streams = append(r.streams, s)
-	return nil
-}
-
-func (r *recordingRaiser) EnsureConsumer(c broker.Consumer) error {
-	r.consumers = append(r.consumers, c)
-	return nil
-}

cmd/mesh-controller/busobjects_test.go

@@ -1,162 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"errors"
-	"strings"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// novox/hq issue 208: the bus's objects a declaration implies are asserted whenever one is sent, not
-// only when the controller starts.
-
-// aCarriedConsumer is the runtime on laptop and, carried by it, a module that consumes an event: the
-// shape of messenger on 2026-10-06, assigned after the controller started.
-func aCarriedConsumer(t *testing.T, open *stores) broker.Consumer {
-	t.Helper()
-	register(t, open, catalogue.Manifest{Module: catalogue.RuntimeModule, Version: "1",
-		OwnSecrets: catalogue.OwnSecrets{"broker": {Path: "/var/lib/mesh/node-tools/broker"}}})
-	register(t, open, catalogue.Manifest{Module: "messenger", Version: "1",
-		Consumes: []string{"billing.order.placed"}})
-	for _, m := range []string{catalogue.RuntimeModule, "messenger"} {
-		if _, err := open.inventory.Assign(t.Context(), "laptop", m); err != nil {
-			t.Fatal(err)
-		}
-	}
-	consumers, err := moduleConsumers(t.Context(), open.inventory)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, c := range consumers {
-		if c.Module == "messenger" && c.Node == "laptop" {
-			return c.Consumer
-		}
-	}
-	t.Fatalf("messenger on laptop is derived no consumer: %+v", consumers)
-	return broker.Consumer{}
-}
-
-// aLateHolder is a module holding a build seat (node-build-go) on anchor, assigned after the controller started, and
-// the worker its seat's queue should have for it: a build seat is pulled by kind, so the worker is the one for the
-// seat's first accepted kind (the build agent's seat, which had one worker for all, is gone with the builder).
-func aLateHolder(t *testing.T, open *stores) broker.Consumer {
-	t.Helper()
-	// With an account to read, as a holder has: a module with none is no bus user, so its seat's workers are not derived.
-	register(t, open, catalogue.Manifest{Module: "late-builder", Version: "1",
-		OwnSecrets: catalogue.OwnSecrets{"broker": {Path: "/var/lib/mesh/late-builder/broker"}},
-		Claims:     []catalogue.Claim{{Name: "node-build-go", Scope: catalogue.ScopeNode}}})
-	if _, err := open.inventory.Assign(t.Context(), "anchor", "late-builder"); err != nil {
-		t.Fatal(err)
-	}
-	_, workers, err := seatTrafficObjects(t.Context(), open.inventory)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, s := range inventory.MeshSeats() {
-		if s.Name != "node-build-go" || len(s.Accepts) == 0 {
-			continue
-		}
-		for _, w := range workers {
-			if w.Name == broker.WorkerName(s.Name, s.Accepts[0]) {
-				return w
-			}
-		}
-	}
-	t.Fatal("the build seat's holder is derived no worker")
-	return broker.Consumer{}
-}
-
-// asserted says whether a recording holds a consumer by stream and name.
-func asserted(rec *recordingRaiser, want broker.Consumer) bool {
-	for _, c := range rec.consumers {
-		if c.Stream == want.Stream && c.Name == want.Name {
-			return true
-		}
-	}
-	return false
-}
-
-// What a send asserts includes what was assigned after the start's assertion: a carried module's
-// consumer and a late holder's worker. The derivation is the start's own, so this holds without a bus.
-func TestASendAssertsWhatWasAssignedAfterStart(t *testing.T) {
-	open := aMesh(t)
-	var atStart recordingRaiser
-	if _, err := assertBusObjects(t.Context(), open.inventory, &atStart); err != nil {
-		t.Fatal(err)
-	}
-	consumer := aCarriedConsumer(t, open)
-	worker := aLateHolder(t, open)
-	if asserted(&atStart, consumer) || asserted(&atStart, worker) {
-		t.Fatal("the start asserted what was not yet assigned; the test proves nothing")
-	}
-	var onSend recordingRaiser
-	if err := assertOnSend(t.Context(), open.inventory, &onSend, ""); err != nil {
-		t.Fatal(err)
-	}
-	if !asserted(&onSend, consumer) {
-		t.Fatalf("messenger's consumer %s on %s is not asserted by the send: %+v", consumer.Name, consumer.Stream, onSend.consumers)
-	}
-	if !asserted(&onSend, worker) {
-		t.Fatalf("the late holder's worker %s on %s is not asserted by the send: %+v", worker.Name, worker.Stream, onSend.consumers)
-	}
-}
-
-// failingRaiser refuses one consumer by name and records everything it was asked.
-type failingRaiser struct {
-	recordingRaiser
-	refuse string
-}
-
-func (f *failingRaiser) EnsureConsumer(c broker.Consumer) error {
-	f.consumers = append(f.consumers, c)
-	if c.Name == f.refuse {
-		return errors.New("nats: API error: code=503 description=insufficient resources")
-	}
-	return nil
-}
-
-// A send whose objects cannot be asserted says so in its output and raises a condition — and the next
-// send that asserts them clears it. The consumers after the refused one are still asked for.
-func TestASendThatCannotAssertTheBusSaysSoAndRaisesACondition(t *testing.T) {
-	open := aMesh(t)
-	consumer := aCarriedConsumer(t, open)
-	worker := aLateHolder(t, open)
-	failing := &failingRaiser{refuse: consumer.Name}
-
-	var sendErr error
-	out := stdoutOf(t, func() error {
-		sendErr = assertOnSend(t.Context(), open.inventory, failing, "  ")
-		return nil
-	})
-	if sendErr == nil || !strings.Contains(sendErr.Error(), "how messenger on laptop hears what it consumes") {
-		t.Fatalf("the failure is not answered: %v", sendErr)
-	}
-	if !strings.Contains(out, "THE BUS DOES NOT HOLD WHAT THIS SEND IMPLIES") ||
-		!strings.Contains(out, "insufficient resources") || !strings.Contains(out, "bus.objects.unasserted") {
-		t.Fatalf("the failure is not said in the send's output:\n%s", out)
-	}
-	if !asserted(&failing.recordingRaiser, worker) {
-		t.Fatal("the seat's worker was not asked for")
-	}
-	c, open1, err := conditionsFrom.Get(t.Context(), "bus.objects.unasserted")
-	if err != nil || !open1 {
-		t.Fatalf("no condition raised: %v", err)
-	}
-	if c.Kind != kindBusObjectsUnasserted || c.Source != sourceBusObjects ||
-		len(c.Evidence) == 0 || !strings.Contains(c.Evidence[0].Said, "insufficient resources") {
-		t.Fatalf("the condition does not say what failed: %+v", c)
-	}
-
-	// The next send asserts them, and that observation clears it.
-	if err := assertOnSend(t.Context(), open.inventory, &recordingRaiser{}, ""); err != nil {
-		t.Fatal(err)
-	}
-	if _, stillOpen, err := conditionsFrom.Get(t.Context(), "bus.objects.unasserted"); err != nil || stillOpen {
-		t.Fatalf("a send that asserted everything left the condition open: %v", err)
-	}
-}

cmd/mesh-controller/calls_verb_integration_test.go

@@ -1,36 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"strings"
-	"testing"
-)
-
-func TestCallsIsServedAndSaysWhatItKeeps(t *testing.T) {
-	handlers, behind, err := seatToolHandlers()
-	if err != nil || len(behind) != 0 {
-		t.Fatalf("%v %v", behind, err)
-	}
-	calls, ok := handlers["calls"]
-	if !ok {
-		t.Fatal("calls is not served")
-	}
-	if _, err := calls(context.Background(), json.RawMessage(`{"node":"anchor"}`)); err == nil ||
-		!strings.Contains(err.Error(), `"node"`) {
-		t.Errorf("calls took an argument it does not declare: %v", err)
-	}
-	if _, err := calls(context.Background(), json.RawMessage(`{"call":"call-0-0"}`)); err == nil ||
-		!strings.Contains(err.Error(), "not across a restart") {
-		t.Errorf("an unknown call was not said plainly: %v", err)
-	}
-	got, err := calls(context.Background(), json.RawMessage(`{}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, listed := got.(map[string]any)["calls"]; !listed {
-		t.Errorf("calls answered %v", got)
-	}
-}

cmd/mesh-controller/calls_verb_test.go

@@ -1,27 +0,0 @@
-package main
-
-import (
-	"testing"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// consoleWaits is how long the console waits for an answer (mesh-tools node-tools/internal/bus
-// RequestTimeout) — the shortest wait of a caller the mesh ships.
-const consoleWaits = 30 * time.Second
-
-// **A call's one answer is never later than its caller or the bus allow** (novox/hq issue 265): a
-// holder answers within AnswerWithin, which must be inside both the console's wait and the window the
-// bus gives an answer. Before, the console waited 30s, the bus 60s, and a push ran as long as it ran.
-func TestAVerbAnswersInsideEveryWaitOnIt(t *testing.T) {
-	if link.AnswerWithin >= consoleWaits/2 {
-		t.Errorf("a call answers within %s: not well inside the console's %s", link.AnswerWithin, consoleWaits)
-	}
-	if link.AnswerWithin >= broker.ResponseTTL {
-		t.Errorf("a call answers within %s, after the bus stops permitting an answer at %s", link.AnswerWithin, broker.ResponseTTL)
-	}
-}
-
-// `calls` is served, takes a call's id and nothing else, and says plainly when it holds no such call.

cmd/mesh-controller/chain.go

@@ -1,105 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/chain"
-	"github.com/novox/mesh-controller/internal/conditions"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// The chain on the bus (novox/hq ADR 0408, design 47 milestone 5): builds, rollouts and assignments are keys of the
-// bus's key-value store, written by the controller that holds the lease, and the controller's store keeps none of them.
-
-// chainHolds is whether this process may write the chain now: the lease's gate, the one every act passes.
-func chainHolds(ctx context.Context) error {
-	_, err := theLease.epoch(ctx)
-	return err
-}
-
-// openTheChain opens the chain's buckets on the bus: the serving controller's connection, or one dialled for a command.
-func openTheChain(ctx context.Context) (*chain.Chain, error) {
-	js, err := aBus()
-	if err != nil {
-		return nil, err
-	}
-	// Not closed: a borrowed connection closes nothing, and a dialled one lasts as long as the command.
-	return chain.OnTheBus(ctx, js.Conn(), chainHolds)
-}
-
-// attachTheChain gives the inventory of the serving controller the chain on its connection.
-func attachTheChain(ctx context.Context, inv *inventory.Inventory, server *link.Server) error {
-	bus, ok := server.Bus().(link.OverNATS)
-	if !ok {
-		return errors.New("the chain lives on the bus, and this control plane is not on it")
-	}
-	c, err := chain.OnTheBus(ctx, bus.Conn, chainHolds)
-	if err != nil {
-		return err
-	}
-	inv.UseChain(c)
-	inv.RequireLayout()
-	// And the builds laid out under their modules, once, before they are read (issue 1121) — **before this returns**, so
-	// nothing the start goes on to read meets a chain not laid out yet: on 2026-10-18 the layout ran beside the start, a
-	// read of the start was refused, and the controller exited and was started again every five seconds. The layout of
-	// keys laid out before skips them, so this takes seconds; one that fails is tried again beside the serving, loudly.
-	if err := inv.LayBuildsOut(ctx, func(format string, args ...any) { fmt.Printf("chain: "+format+"\n", args...) }); err != nil {
-		fmt.Printf("chain: the builds are not laid out under their modules yet, and none is read until they are: %v\n", err)
-		goServing(ctx, func() { layBuildsOutSoon(ctx, inv) })
-	}
-	// The requests the move of delivery 1 found never handed over are not asked again: the controller asks no build
-	// (novox/hq ADR 0501; issue 1851, A10), and the builder builds every fingerprint the indexer writes.
-	// And what delivery 1 recorded of what each machine was sent, copied onto the keys of the assignments (CopySentBuilds).
-	return nil
-}
-
-// kindSentBuildsNotCopied is the condition of the one-time copy of node.sent_builds onto the assignments' keys that has not
-// succeeded: until it has, a module an assignment pulled in may be missing from what a machine is read to run.
-const kindSentBuildsNotCopied = "sent-builds-not-copied"
-
-// chainMoveRetry is how long the copy waits before it tries again.
-const chainMoveRetry = 30 * time.Second
-
-// kindBuildsNotLaidOut is the condition of the layout of the builds under their modules that has not succeeded: until it
-// has, no build is read, and a send that needs one is refused with the reason.
-const kindBuildsNotLaidOut = "builds-not-laid-out"
-
-// layBuildsOutSoon lays the builds out under their modules as soon as this controller holds the lease (the chain refuses a
-// write before), and tries again every half minute while it fails, loudly: each failure is printed, and the first raises an
-// urgent condition until it has worked. It is idempotent (LayBuildsOut).
-func layBuildsOutSoon(ctx context.Context, inv *inventory.Inventory) {
-	failed := false
-	for {
-		err := inv.LayBuildsOut(ctx, func(format string, args ...any) { fmt.Printf("chain: "+format+"\n", args...) })
-		o := conditions.Observation{Scope: conditions.ScopeBuild, ID: kindBuildsNotLaidOut, Token: kindBuildsNotLaidOut,
-			Kind: kindBuildsNotLaidOut, Severity: conditions.Urgent, Resolver: conditions.ResolverOperator,
-			Source: "chain", Summary: "the builds are not laid out under their modules, so none is read: "}
-		if err != nil {
-			fmt.Printf("chain: the builds are not laid out under their modules, and none is read until they are: %v\n", err)
-			if ctx.Err() != nil {
-				return // stopped: the next controller lays them out
-			}
-			// A cancelled layout is tried again and raises nothing: a cancellation is no fault of the chain (issue 1945).
-			if keeper := conditionsFrom; keeper != nil && !failed && !errors.Is(err, context.Canceled) {
-				o.Summary += err.Error()
-				if _, oerr := keeper.Observe(ctx, o); oerr == nil {
-					failed = true
-				}
-			}
-		} else {
-			if keeper := conditionsFrom; keeper != nil && failed {
-				_, _ = keeper.Clear(ctx, o.Key(), "laid out")
-			}
-			return
-		}
-		select {
-		case <-ctx.Done():
-			return
-		case <-time.After(chainMoveRetry):
-		}
-	}
-}

cmd/mesh-controller/check.go

@@ -1,337 +0,0 @@
-package main
-
-import (
-	"errors"
-	"fmt"
-	"io"
-	"os"
-	"path/filepath"
-	"sort"
-	"strings"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// moduleCheck judges manifests where they are written, with no mesh (novox/hq ADR 0037, issue 148).
-//
-// **The same functions registration runs, and nothing the command line adds** (ADR 0035): the strict
-// parse with every per-manifest problem, then the rules no single manifest can be judged against,
-// over exactly the manifests given. Somebody describing their own application in their own
-// repository runs this before pushing and finds out there, rather than when a running mesh refuses
-// the registration or, later, when a machine applies something that resolved and should not have.
-//
-// **What it cannot know without a store, it says.** The mesh's own seat set is the store's (ADR
-// 0122); this binary carries a compiled copy that the store overrides when loaded, so a claim on a
-// mesh seat is judged fully only at registration. A seat another module declares is unknown unless
-// that module's manifest is passed too. Both are printed as a note, not as a problem — a check that
-// refused what it could not see would teach people to ignore it.
-//
-// **And every identity against every bound it meets** (novox/hq ADR 0225, issue 263): each module's
-// identity, on a machine whose name is `longestMachine` characters, against the bound of every
-// provision it wants that a manifest given here offers. An overflow is refused in the pull request
-// that introduces it — a new requirement, a lowered bound, a longer slug — instead of on the
-// provider's machine when a real machine's name first meets the module's.
-// SomeManifestsVar, set by the merge gate, says the manifests given are only some of their repository's.
-const SomeManifestsVar = "MESH_MODULE_CHECK_SOME"
-
-func moduleCheck(paths []string, out io.Writer) error {
-	return moduleCheckFor(paths, catalogue.DefaultLongestMachine, out)
-}
-
-func moduleCheckFor(paths []string, longestMachine int, out io.Writer) error {
-	if len(paths) == 0 {
-		return errors.New("module check <manifest.json>... — one file per module; pass every " +
-			"manifest of a repository together so the rules between them are checked too")
-	}
-	shelf := catalogue.Shelf{}
-	faulted := map[string]bool{}
-	failed := 0
-	// The list of predefined keys at the root of the repository above each manifest (novox/hq ADR 0348 §7), read
-	// once per repository: a manifest naming a key is judged against the list its own tree holds.
-	lists := map[string]catalogue.PredefinedList{}
-	listOf := func(path string) (catalogue.PredefinedList, error) {
-		root := catalogue.RepositoryRoot(filepath.Dir(path))
-		if root == "" {
-			return nil, nil
-		}
-		if list, read := lists[root]; read {
-			return list, nil
-		}
-		list, err := catalogue.ReadPredefined(root)
-		if err != nil {
-			return nil, err
-		}
-		lists[root] = list
-		return list, nil
-	}
-	for _, path := range paths {
-		raw, err := os.ReadFile(path)
-		if err != nil {
-			fmt.Fprintf(out, "%s: %v\n", path, err)
-			failed++
-			continue
-		}
-		list, err := listOf(path)
-		if err != nil {
-			fmt.Fprintf(out, "%s: %v\n", path, err)
-			failed++
-			continue
-		}
-		m, err := catalogue.ParseManifestWith(raw, list)
-		if err == nil {
-			// Each template's text read from the tree beside the manifest, and judged as inline content is
-			// (novox/hq ADR 0349 §2): a missing template is refused by name.
-			m, err = catalogue.WithTemplatesFrom(m, filepath.Dir(path))
-		}
-		if err != nil {
-			fmt.Fprintf(out, "%s: %v\n", path, err)
-			failed++
-			continue
-		}
-		if first, twice := shelf[m.Module]; twice {
-			_ = first
-			fmt.Fprintf(out, "%s: %s was already given; two manifests name one module\n", path, m.Module)
-			failed++
-			continue
-		}
-		// A definition names no installation (novox/hq ADR 0112, ADR 0155): judged here, in the
-		// catalogue-wide test, and at registration, which refuses in the same words.
-		if wrong := catalogue.TrustProblems(m); len(wrong) > 0 {
-			for _, p := range wrong {
-				fmt.Fprintf(out, "%s: %s\n", path, p)
-			}
-			failed += len(wrong)
-			faulted[m.Module] = true
-		}
-		// A module that declares a setting names the keys of its mergeable files (novox/hq ADR 0326 §3,
-		// issue 574): judged where a definition is written, as at registration, never where a stored
-		// build is read again.
-		if wrong := catalogue.WrittenSettingsProblems(m); len(wrong) > 0 {
-			for _, p := range wrong {
-				fmt.Fprintf(out, "%s: %s\n", path, p)
-			}
-			failed += len(wrong)
-			faulted[m.Module] = true
-		}
-		// A module lives whole in one repository (novox/hq ADR 0420 §1, issue 1019): when the check is told the
-		// repository it runs for (MESH_CHECK_REPOSITORY, set by the build's check), an artifact building from
-		// another is refused, as the merge gate refuses it. A run by hand names no repository and judges none.
-		if repo := os.Getenv("MESH_CHECK_REPOSITORY"); repo != "" && m.Build != nil {
-			for _, a := range m.Build.Artifacts {
-				if a.Context != nil && a.Context.Repository != "" && !sameRepository(a.Context.Repository,
-					link.SourceMoved{Owner: ownerOf(repo), Repo: repoOf(repo)}) {
-					fmt.Fprintf(out, "%s: %s builds artifact %s from %s: a module lives whole in one repository "+
-						"(novox/hq ADR 0420 §1)\n", path, m.Module, a.Name, a.Context.Repository)
-					failed++
-					faulted[m.Module] = true
-				}
-			}
-		}
-		if named := catalogue.InstallationProblems(m); len(named) > 0 {
-			for _, p := range named {
-				fmt.Fprintf(out, "%s: %s\n", path, p)
-			}
-			failed += len(named)
-			faulted[m.Module] = true
-		}
-		shelf[m.Module] = m
-	}
-
-	// Between the manifests: a seat declared twice, a use of a seat nothing declares, a claim on
-	// a seat that does not exist. Run only over what parsed, because a problem inside one manifest
-	// has already been said and would be said again here in a worse form.
-	//
-	// **Over some of a repository's manifests, a seat none of them declares is a note** (novox/hq issue 364), as
-	// this command's own word says above: the merge gate passes only the manifests a change touches, and says so
-	// with SomeManifestsVar, so a module that uses or claims a seat another module declares (the operator
-	// channel's, a channel bench) was refused there for a manifest it was not given. Given every manifest — the
-	// catalogue's own check, and registration — it stays a refusal.
-	some := os.Getenv(SomeManifestsVar) != ""
-	problems := catalogue.CatalogueProblems(shelf)
-	sort.Strings(problems)
-	for _, p := range problems {
-		if some && catalogue.IsUndeclaredSeat(p) {
-			fmt.Fprintf(out, "note: %s among the manifests given; registration judges it against the whole catalogue, "+
-				"and passing the declaring module's manifest too judges it here\n", p)
-			continue
-		}
-		fmt.Fprintln(out, p)
-		failed++
-	}
-
-	// Between the manifests too: an identity against the bounds of the provisions it wants, which
-	// only the provider's manifest states.
-	identities := catalogue.IdentityProblems(shelf, longestMachine)
-	sort.Strings(identities)
-	for _, p := range identities {
-		fmt.Fprintln(out, p)
-	}
-	failed += len(identities)
-
-	// And the data each module keeps (novox/hq ADR 0233): a provider that grants says what it keeps for
-	// its consumers, a directory a container writes is declared, and no backup line is written by hand.
-	data := catalogue.DataProblems(shelf)
-	sort.Strings(data)
-	for _, p := range data {
-		fmt.Fprintln(out, p)
-	}
-	failed += len(data)
-
-	var names []string
-	for name := range shelf {
-		names = append(names, name)
-	}
-	sort.Strings(names)
-
-	// **Every long-running resource says how it is ready** (novox/hq ADR 0240 rule 8): warned until the
-	// date, refused from it. The count is the catalogue's: its merge check keeps the number and lets a
-	// change lower it, never raise it.
-	undeclared := 0
-	required := !checkNow().Before(catalogue.HealthRequiredFrom)
-	for _, name := range names {
-		missing := catalogue.Undeclared(shelf[name])
-		undeclared += len(missing)
-		if len(missing) == 0 {
-			continue
-		}
-		if required {
-			for _, id := range missing {
-				fmt.Fprintf(out, "%s: %s stays up and does not say how it is ready: a long-running resource declares "+
-					"health since %s (novox/hq ADR 0240 rule 8)\n", name, id, catalogue.HealthRequiredFrom.Format("2006-01-02"))
-			}
-			failed += len(missing)
-			faulted[name] = true
-		}
-	}
-
-	// **A file that asks for a setting and does not say whether it is trusted counts as trusted** (novox/hq issue
-	// 339): listed and counted, never refused, so an author can opt out a file nothing trusts.
-	unsaid := 0
-	for _, name := range names {
-		unsaid += len(catalogue.UnsaidTrust(shelf[name]))
-	}
-
-	for _, name := range names {
-		m := shelf[name]
-		if faulted[name] {
-			continue
-		}
-		fmt.Fprintf(out, "%s: ok", name)
-		if n := len(m.Tools); n > 0 {
-			fmt.Fprintf(out, ", %d tool(s)", n)
-		}
-		if len(m.Invokes) > 0 {
-			fmt.Fprintf(out, ", invokes %s", joinInvokes(m.Invokes))
-		}
-		// The state it keeps and reads (novox/hq ADR 0201), so a reviewer sees what lands on the bus.
-		if len(m.State) > 0 {
-			kept := make([]string, 0, len(m.State))
-			for _, s := range m.State {
-				kept = append(kept, s.Name)
-			}
-			fmt.Fprintf(out, ", keeps state %s", strings.Join(kept, ", "))
-		}
-		// And the logs it keeps, with their caps (novox/hq ADR 0297).
-		if len(m.Logs) > 0 {
-			kept := make([]string, 0, len(m.Logs))
-			for _, l := range m.Logs {
-				kept = append(kept, fmt.Sprintf("%s (%d MiB)", l.Name, l.Cap()))
-			}
-			fmt.Fprintf(out, ", keeps log %s", strings.Join(kept, ", "))
-		}
-		if len(m.Reads) > 0 {
-			fmt.Fprintf(out, ", reads %s", strings.Join(m.Reads, ", "))
-		}
-		// The data it keeps, by class, so a reviewer sees what the mesh will protect and how.
-		if items := m.DataItems(); len(items) > 0 {
-			kept := make([]string, 0, len(items))
-			for _, it := range items {
-				kept = append(kept, it.ID+" ("+it.Class+")")
-			}
-			fmt.Fprintf(out, ", keeps %s", strings.Join(kept, ", "))
-		}
-		// How what it runs is ready (ADR 0240): each declared check, and what is judged by liveness alone.
-		var checks []string
-		for _, r := range m.Resources {
-			if h, has, _ := catalogue.ReadHealth(r); has {
-				checks = append(checks, fmt.Sprintf("%v by %s", r["id"], catalogue.HealthWords(h)))
-			}
-		}
-		// And its own runtime's, where it runs as its own account (novox/hq ADR 0366).
-		if own, has := catalogue.OwnRuntimeHealth(m); has {
-			if h, _, _ := catalogue.ReadHealth(own); h.Kind != "" {
-				checks = append(checks, fmt.Sprintf("%v by %s", own["id"], catalogue.HealthWords(h)))
-			}
-		}
-		if len(checks) > 0 {
-			fmt.Fprintf(out, ", ready: %s", strings.Join(checks, "; "))
-		}
-		if missing := catalogue.UnsaidTrust(m); len(missing) > 0 {
-			fmt.Fprintf(out, "; WARNING: %s ask(s) for a setting and do(es) not say whether it is trusted, so it counts as "+
-				"trusted: set at the terminal alone; say %q false where nothing trusts it (novox/hq issue 339)",
-				strings.Join(missing, ", "), catalogue.TrustedField)
-		}
-		if missing := catalogue.Undeclared(m); len(missing) > 0 {
-			fmt.Fprintf(out, "; WARNING: %s stay(s) up and say(s) not how it is ready — judged by liveness alone, "+
-				"refused from %s (ADR 0240 rule 8)", strings.Join(missing, ", "), catalogue.HealthRequiredFrom.Format("2006-01-02"))
-		}
-		fmt.Fprintln(out)
-	}
-	// The count the catalogue keeps (ADR 0240 rule 8), in a line its merge check reads.
-	fmt.Fprintf(out, "%s %d\n", UndeclaredHealthLine, undeclared)
-	fmt.Fprintf(out, "%s %d\n", UnsaidTrustLine, unsaid)
-	if failed > 0 {
-		return fmt.Errorf("%d problem(s) in %d manifest(s)", failed, len(paths))
-	}
-	fmt.Fprintf(out, "%d manifest(s) checked. Judged against the seats this binary carries; a claim on "+
-		"one of the mesh's own seats is judged fully at registration, and a seat declared by a "+
-		"module not given here reads as unknown. Identities judged on a %d-character machine name, "+
-		"against the bounds of the providers given here\n", len(paths), longestMachine)
-	return nil
-}
-
-// UndeclaredHealthLine starts the line `module check` says the count of long-running resources without
-// `health` in, over the manifests given: the catalogue's merge check compares it with the number it keeps.
-const UndeclaredHealthLine = "long-running resources without health:"
-
-// UnsaidTrustLine starts the line `module check` says the count of files that ask for a setting and do not say
-// whether it is trusted, and so count as trusted (novox/hq issue 339).
-const UnsaidTrustLine = "files asking for a setting without saying whether it is trusted:"
-
-// checkNow is the clock `module check` judges the date by; a test sets it.
-var checkNow = time.Now
-
-func joinInvokes(invokes []string) string {
-	if len(invokes) == 1 && invokes[0] == "*" {
-		return "every tool"
-	}
-	s := ""
-	for i, t := range invokes {
-		if i > 0 {
-			s += ", "
-		}
-		s += t
-	}
-	return s
-}
-
-// manifestsUnder lists every module.json below a directory, for `module check <dir>`.
-func manifestsUnder(dir string) ([]string, error) {
-	var found []string
-	err := filepath.WalkDir(dir, func(path string, d os.DirEntry, err error) error {
-		if err != nil {
-			return err
-		}
-		if d.IsDir() && (d.Name() == "node_modules" || d.Name() == ".git" || d.Name() == "dist") {
-			return filepath.SkipDir
-		}
-		if !d.IsDir() && d.Name() == "module.json" {
-			found = append(found, path)
-		}
-		return nil
-	})
-	sort.Strings(found)
-	return found, err
-}

cmd/mesh-controller/check_test.go

@@ -1,167 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"os"
-	"path/filepath"
-	"strings"
-
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"github.com/novox/mesh-controller/internal/beside"
-)
-
-// The check anybody can run is the check registration runs (novox/hq issue 148, ADR 0037): a manifest
-// with a known fault is named, and one without passes, with no store opened.
-func TestModuleCheckNamesAFaultAndNeedsNoMesh(t *testing.T) {
-	dir := t.TempDir()
-	good := filepath.Join(dir, "good.json")
-	bad := filepath.Join(dir, "bad.json")
-	os.WriteFile(good, []byte(`{"module":"shop","version":"1","tools":["price"],"invokes":["mesh-catalog.catalog_modules"]}`), 0o600)
-	os.WriteFile(bad, []byte(`{"module":"till","version":"1","invokes":["shop"]}`), 0o600)
-
-	var out bytes.Buffer
-	if err := moduleCheck([]string{good}, &out); err != nil {
-		t.Fatalf("a sound manifest was refused: %v\n%s", err, out.String())
-	}
-	if !strings.Contains(out.String(), "shop: ok, 1 tool(s), invokes mesh-catalog.catalog_modules") {
-		t.Fatalf("the report does not say what it checked:\n%s", out.String())
-	}
-
-	out.Reset()
-	err := moduleCheck([]string{good, bad}, &out)
-	if err == nil {
-		t.Fatal("a manifest invoking a module and no tool passed")
-	}
-	if !strings.Contains(out.String(), `till invokes "shop", which does not name a tool`) {
-		t.Fatalf("the fault is not named in the manifest's words:\n%s", out.String())
-	}
-}
-
-// The rules between manifests run over what was given together: a seat two modules declare is
-// refused, which no single-manifest check can see.
-func TestModuleCheckJudgesBetweenTheManifestsGiven(t *testing.T) {
-	dir := t.TempDir()
-	a := filepath.Join(dir, "a.json")
-	b := filepath.Join(dir, "b.json")
-	os.WriteFile(a, []byte(`{"module":"a","version":"1","seats":[{"name":"printer","scope":"mesh"}]}`), 0o600)
-	os.WriteFile(b, []byte(`{"module":"b","version":"1","seats":[{"name":"printer","scope":"mesh"}]}`), 0o600)
-	var out bytes.Buffer
-	if err := moduleCheck([]string{a, b}, &out); err == nil {
-		t.Fatalf("two declarations of one seat passed:\n%s", out.String())
-	}
-	if !strings.Contains(out.String(), "a seat name means one protocol") {
-		t.Fatalf("the cross-manifest rule was not the one named:\n%s", out.String())
-	}
-}
-
-// The real catalogue passes the command, the way it passes the test that used to be the only check: the catalogue this
-// controller is released with, captured in testdata/beside at the commit CAPTURED names. Not the clone a merge check puts
-// beside, which is the catalogue's trunk even in a delivery group holding a catalogue pull request (ADR 0484 clause 4):
-// a controller whose check reads a word that group's catalogue brings would fail on the trunk's catalogue before the
-// group merges both (issue 774: the release's sdk refuses an offer that states no credential form, and the catalogue's
-// trunk states none until the release's catalogue merges). Moving CAPTURED to the catalogue a change is released with is
-// part of that change.
-func TestModuleCheckPassesTheCatalogue(t *testing.T) {
-	root := filepath.Join(beside.CapturedDir(t, "mesh-catalog"), "modules")
-	paths, err := manifestsUnder(root)
-	if err != nil || len(paths) == 0 {
-		t.Fatalf("no manifests under %s: %v", root, err)
-	}
-	var out bytes.Buffer
-	if err := moduleCheck(paths, &out); err != nil {
-		t.Fatalf("the catalogue does not pass its own check: %v\n%s", err, out.String())
-	}
-}
-
-func TestRegistrationRefusesADefinitionNamingAnInstallation(t *testing.T) {
-	// novox/hq ADR 0155: the check moves to registration once the catalogue passes it. Both
-	// ways in — `module add` and a build's result — go through this, and a name declared on
-	// purpose passes with its reason.
-	named := catalogue.Manifest{Module: "idp", Resources: []map[string]any{
-		{"id": "server", "type": "container", "image": "x@sha256:aa",
-			"env": map[string]any{"KC_HOSTNAME": "https://login.mesh-one.be"}},
-	}}
-	err := namesNoInstallation(named)
-	if err == nil || !strings.Contains(err.Error(), "login.mesh-one.be") ||
-		!strings.Contains(err.Error(), catalogue.NamesOnPurpose) {
-		t.Fatalf("a definition naming an installation is refused with the name and the way out; got %v", err)
-	}
-	meant := catalogue.Manifest{Module: "site", Resources: []map[string]any{
-		{"id": "server", "type": "container", "image": "registry.mesh-one.be/org/site@sha256:cc",
-			catalogue.NamesOnPurpose: map[string]any{
-				"registry.mesh-one.be": "built outside the mesh until its repository is a build source here"}},
-	}}
-	if err := namesNoInstallation(meant); err != nil {
-		t.Fatalf("a name declared on purpose passes; got %v", err)
-	}
-}
-
-// **The controller's own manifest names every verb of its seat** (novox/hq ADR 0132): its tools lagged
-// the seat's verbs for weeks, and `module check` — the gate's first step for a change touching it —
-// refused it. Held here, so a verb added to the table without the manifest fails this repository's
-// own suite rather than its next pull request's gate.
-func TestTheControllersManifestServesEveryVerbOfItsSeat(t *testing.T) {
-	var out strings.Builder
-	if err := moduleCheck([]string{"../../module.json"}, &out); err != nil {
-		t.Fatalf("the controller's own module.json fails module check: %v\n%s", err, out.String())
-	}
-}
-
-// A module that uses a seat another module declares (novox/hq issue 364): refused over the whole catalogue when the
-// declarer is missing, a note when the gate says it gives only the manifests a change touches.
-func TestASeatAnotherModuleDeclaresIsANoteOverSomeManifests(t *testing.T) {
-	dir := t.TempDir()
-	user := filepath.Join(dir, "user.json")
-	os.WriteFile(user, []byte(`{"module":"asker","version":"1","uses":["operator-channel"]}`), 0o600)
-	var out bytes.Buffer
-	if err := moduleCheck([]string{user}, &out); err == nil {
-		t.Fatalf("a use of a seat nothing given declares passed the whole-catalogue check:\n%s", out.String())
-	}
-	t.Setenv(SomeManifestsVar, "1")
-	out.Reset()
-	if err := moduleCheck([]string{user}, &out); err != nil {
-		t.Fatalf("over some manifests the use was refused:\n%s", out.String())
-	}
-	if !strings.Contains(out.String(), "note: asker uses the seat \"operator-channel\"") {
-		t.Fatalf("the note was not said:\n%s", out.String())
-	}
-}
-
-// **A module lives whole in one repository** (novox/hq ADR 0420 §1, issue 1019): `module check`, told the
-// repository it runs for, refuses an artifact whose build context names another; run by hand, it does not know.
-func TestModuleCheckRefusesAnArtifactContextNamingAnotherRepository(t *testing.T) {
-	dir := t.TempDir()
-	write := func(name, context string) string {
-		path := filepath.Join(dir, name+".json")
-		raw := `{"module":"` + name + `","version":"1","build":{"artifacts":[{"name":"server","kind":"image","from":"Dockerfile"` + context + `}]}}`
-		if err := os.WriteFile(path, []byte(raw), 0o600); err != nil {
-			t.Fatal(err)
-		}
-		return path
-	}
-	other := write("other", `,"context":{"seat":"git","repository":"novox/mesh-controller","ref":"main"}`)
-	own := write("own", `,"context":{"seat":"git","repository":"novox/mesh-catalog","ref":"main"}`)
-	none := write("none", ``)
-
-	t.Setenv("MESH_CHECK_REPOSITORY", "novox/mesh-catalog")
-	var out bytes.Buffer
-	if err := moduleCheck([]string{other}, &out); err == nil {
-		t.Fatalf("a context naming another repository passed:\n%s", out.String())
-	}
-	if !strings.Contains(out.String(), "other builds artifact server from novox/mesh-controller: a module lives whole in one repository (novox/hq ADR 0420 §1)") {
-		t.Errorf("the refusal is not in the words of the gate:\n%s", out.String())
-	}
-	for _, path := range []string{own, none} {
-		out.Reset()
-		if err := moduleCheck([]string{path}, &out); err != nil {
-			t.Errorf("%s was refused: %v\n%s", path, err, out.String())
-		}
-	}
-	t.Setenv("MESH_CHECK_REPOSITORY", "")
-	out.Reset()
-	if err := moduleCheck([]string{other}, &out); err != nil {
-		t.Errorf("a local run, with no repository named, refused it: %v\n%s", err, out.String())
-	}
-}

cmd/mesh-controller/checks.go

@@ -1,188 +0,0 @@
-package main
-
-import (
-	"context"
-	"io"
-	"os"
-	"path"
-	"regexp"
-	"runtime/debug"
-	"slices"
-	"sort"
-	"strings"
-
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// What a pull request reaches of the mesh's graph (novox/hq to-be 45 §9, issue 280). The controller no longer checks a
-// pull request or says a verdict on it (R4g, ADR 0503 §3, ADR 0501 §5): the checker judges the heads, and mesh-delivery
-// asks the operator's Approve on its verdict. What stays here is the mapping of a pull request's changed paths onto the
-// mesh's module graph by the planner's own answer (reachOfMerge, touchedBy), which the delivery verbs (`delivery order`,
-// the change plan) and the head's declared config (tellPullDeclares) read: **a changed file touches exactly the modules
-// whose build reads it** — a module's own directory (the whole repository for one built from its root), or a repository
-// its recipe packages — and a directory the change adds a module.json in is a new module.
-
-// coreModules are the modules whose repositories are the mesh's core, by the directory a check finds
-// each beside it — and whose owner is the mesh's own.
-var coreModules = map[string]string{"mesh-controller": "mesh-controller", "mesh-host": "mesh-host",
-	"node-tools": "mesh-tools", "nats": "mesh-catalog"}
-
-// checkScope is what a pull request reaches of the mesh's graph, as the planner reckons it.
-type checkScope struct {
-	// Modules are the modules a merge of the change would move itself — built from the repository into
-	// the pull request's base and reading a changed file, or packaging the repository's source — and
-	// Dependents those the plan would build after them; New the directories it adds a module in.
-	Modules    []string
-	Dependents []string
-	New        []string
-	// Manifests are the moved modules' and the new ones' manifests in the change's tree.
-	Manifests []string
-	// Unread the changed files no module's build reads.
-	Unread []string
-	// Mesh says the repository is the mesh's: modules are built from it on some branch, its owner is the
-	// core's, or the change adds a module to it.
-	Mesh bool
-	// From is a module built from the repository, for how the mesh clones it; nil when none is.
-	From *inventory.Entry
-	// Reach is the planner's whole answer, which the change plan is made from.
-	Reach mergeReach
-}
-
-func (s checkScope) gated() bool { return len(s.Modules)+len(s.New) > 0 }
-
-// pullScope is what a pull request reaches: **the planner's own answer** (reachOfMerge), asked as if the
-// head were merged into the base — never a mapping of its own, so a change to what a merge touches
-// changes what is checked with it (novox/hq ADR 0238).
-func pullScope(p link.PullUpdated, entries []inventory.Entry, read map[string][]inventory.ReadRepository,
-	edges []inventory.Edge) checkScope {
-	m := link.SourceMoved{Owner: p.Owner, Repo: p.Repo, Base: p.Base, CloneURL: p.CloneURL, Commit: p.Commit,
-		Paths: p.Paths, PathsTruncated: p.PathsTruncated, Removed: p.Removed, ModuleDirs: p.ModuleDirs,
-		ModuleDirsSaid: p.ModuleDirsSaid}
-	r := reachOfMerge(m, entries, read, edges)
-	s := checkScope{Modules: r.Moved(), Dependents: r.Dependents(), New: r.Added, Unread: r.Unread, Reach: r}
-	for _, e := range append(append([]inventory.Entry{}, r.Touched...), r.Deleted...) {
-		s.Manifests = append(s.Manifests, path.Join(strings.Trim(e.Source.Path, "/"), moduleManifestFile))
-	}
-	for _, d := range r.Added {
-		s.Manifests = append(s.Manifests, path.Join(d, moduleManifestFile))
-	}
-	sort.Strings(s.Manifests)
-	s.Manifests = slices.Compact(s.Manifests)
-
-	// Whose repository it is, for how it is cloned and whether its own check is the mesh's to run.
-	owners := map[string]bool{}
-	for i, e := range entries {
-		if e.Provided {
-			continue
-		}
-		if _, core := coreModules[e.Manifest.Module]; core {
-			if owner := sourceOwner(e.Source.Repository); owner != "" {
-				owners[owner] = true
-			}
-		}
-		if sameRepository(e.Source.Repository, m) && s.From == nil {
-			s.From = &entries[i]
-		}
-	}
-	s.Mesh = s.From != nil || owners[strings.ToLower(p.Owner)] || s.gated()
-	return s
-}
-
-// sourceOwner is the owner of a recorded repository, a path on the git seat or a URL: novox/mesh-host → novox.
-func sourceOwner(repository string) string {
-	parts := strings.Split(strings.Trim(strings.TrimSuffix(repository, ".git"), "/"), "/")
-	if len(parts) < 2 {
-		return ""
-	}
-	return strings.ToLower(parts[len(parts)-2])
-}
-
-// PullUpdated hears a pull request's new head. It asks no check and says no verdict (pullUpdated).
-func (f following) PullUpdated(ctx context.Context, p link.PullUpdated) error {
-	return f.pullUpdated(ctx, p, os.Stdout)
-}
-
-// pullUpdated is PullUpdated saying what it did to w. It asks nothing of anybody and says no verdict (R4g; ADR 0503 §3, §5,
-// ADR 0527): the checker judges every repository whose trunk requires `mesh/check`, hq included. All it still does is tell
-// mesh-config what the head declares (ADR 0502), whatever judges it.
-func (f following) pullUpdated(ctx context.Context, p link.PullUpdated, w io.Writer) error {
-	inv := f.open.inventory
-	entries, err := inv.Catalogued(ctx)
-	if err != nil {
-		return err
-	}
-	read, err := readForPlanning(ctx, inv)
-	if err != nil {
-		return err
-	}
-	edges, err := inv.Dependencies(ctx)
-	if err != nil {
-		return err
-	}
-	scope := pullScope(p, entries, read, edges)
-	this := pullAtOf(p)
-	if this.Truncated {
-		this.Paths, this.Truncated = truncatedPaths(entries, p.Owner, p.Repo, scope.Modules), false
-	}
-	if scope.gated() || holdsModules(entries, p.Owner, p.Repo) {
-		tellPullDeclares(ctx, w, []pullAt{this})
-	}
-	return nil
-}
-
-// besideRefs is the ref each repository is cloned at beside a check, by the directory it is found under:
-// a core repository at the commit the mesh runs of the module built from it (`running`) — but the
-// catalogue, whose checkout beside is what tests read its files from, at its main, what the next merge
-// builds from; and beside the controller its main, for a judge the running controller predates, and the
-// lab's main, whose replays every check runs. **One rule, read by the check the controller asks for and by
-// the facts snapshot** (Facts.Beside), so a check run by hand clones what the build seat clones. Beside the
-// controller also the SDK, checked out at the commit the running controller's go.mod pins (sdkPinned), not
-// one a desktop holds (novox/hq issue 449). The checkout only places the clone: the conformance test reads the
-// fixtures at the pin of the tree under check, from the clone's history, so a pull request moving the SDK is
-// judged against the SDK it moves to (internal/link/conformance_test.go).
-func besideRefs(dir, running string) map[string]string {
-	switch dir {
-	case "mesh-catalog":
-		return map[string]string{dir: "main"}
-	case "mesh-controller":
-		return map[string]string{dir: running, "mesh-controller-main": "main", "mesh-lab": "main",
-			"mesh-sdk": sdkPinned()}
-	}
-	return map[string]string{dir: running}
-}
-
-// sdkModule is the Go module of the SDK the controller is built against.
-const sdkModule = "git.novox.be/novox/mesh-sdk/go"
-
-// pseudoCommit is the commit a Go pseudo-version names: v0.1.11-0.20261009143344-f047d0a4a970 → f047d0a4a970.
-var pseudoCommit = regexp.MustCompile(`-([0-9a-f]{12})$`)
-
-// sdkPinned is the ref of the SDK repository this controller was built from, as its go.mod pins it and its
-// build records it: a pseudo-version's commit, or a release's tag (the SDK tags its Go module under go/).
-// "main" only for a binary that records no SDK version — a local replace — which a running controller is
-// not (novox/hq issue 449).
-func sdkPinned() string {
-	info, ok := debug.ReadBuildInfo()
-	if !ok {
-		return "main"
-	}
-	for _, dep := range info.Deps {
-		if dep.Path != sdkModule {
-			continue
-		}
-		if dep.Replace != nil {
-			dep = dep.Replace
-		}
-		if m := pseudoCommit.FindStringSubmatch(dep.Version); m != nil {
-			return m[1]
-		}
-		if strings.HasPrefix(dep.Version, "v") {
-			return "go/" + dep.Version
-		}
-	}
-	return "main"
-}
-
-// checkEvents is where the serving controller says a check's verdict; nil in a command.
-var checkEvents link.Bus

cmd/mesh-controller/checks_test.go

@@ -1,95 +0,0 @@
-package main
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// **The mesh's module graph decides what a pull request's check runs**, not the repository (novox/hq
-// ADR 0237 as amended): a change is mapped onto the graph by the rule a merge is (issue 278), the gate
-// runs when it touches a module — a new one included — and a repository that is the mesh's and touches
-// none still has its own merge-check.sh run.
-func TestThePullRequestIsMappedOntoTheModuleGraph(t *testing.T) {
-	const catalogue = "http://forge.internal:20000/novox/mesh-catalog.git"
-	const controller = "http://forge.internal:20000/novox/mesh-controller.git"
-	const host = "http://forge.internal:20000/novox/mesh-host.git"
-	photos := fromRepo("photos", "http://forge.internal:20000/novox/photos.git", "")
-	photos.Source.Ref = "nox-mesh"
-	snake := fromRepo("snake", "jschoubben/snake", "")
-	snake.Source.Seat = "git"
-	entries := []inventory.Entry{
-		fromRepo("gitea", catalogue, "modules/gitea"),
-		fromRepo("keycloak", catalogue, "modules/keycloak"),
-		fromRepo("nats", catalogue, "modules/nats"),
-		fromRepo("mesh-controller", controller, ""),
-		fromRepo("mesh-host", host, ""),
-		photos, snake,
-	}
-	pull := func(owner, repo, base string, paths []string, dirs ...string) link.PullUpdated {
-		return link.PullUpdated{Owner: owner, Repo: repo, Base: base, Commit: "abc", Paths: paths,
-			ModuleDirs: dirs, ModuleDirsSaid: true}
-	}
-	for _, c := range []struct {
-		what                   string
-		p                      link.PullUpdated
-		modules, new, manifest string
-		mesh                   bool
-		judge                  string
-	}{
-		{"one module's own files", pull("novox", "mesh-catalog", "main", []string{"modules/gitea/index.ts"}, "modules/gitea"),
-			"gitea", "", "modules/gitea/module.json", true, ""},
-		{"a file no module's build reads touches no module (issue 280)",
-			pull("novox", "mesh-catalog", "main", []string{"merge-check.sh", "README.md"}), "", "", "", true, ""},
-		{"files the announcer could not list: everything built from it",
-			link.PullUpdated{Owner: "novox", Repo: "mesh-catalog", Base: "main", Commit: "abc", PathsTruncated: true,
-				Paths: []string{"README.md"}}, "gitea,keycloak,nats", "",
-			"modules/gitea/module.json,modules/keycloak/module.json,modules/nats/module.json", true, ""},
-		{"a new module, said by the head", pull("novox", "mesh-catalog", "main",
-			[]string{"modules/newmod/index.ts", "modules/newmod/module.json"}, "modules/newmod"),
-			"", "modules/newmod", "modules/newmod/module.json", true, ""},
-		{"the controller judges itself", pull("novox", "mesh-controller", "main", []string{"cmd/x.go"}),
-			"mesh-controller", "", "module.json", true, "self"},
-		{"the node-engine is judged by the controller the mesh runs, as any module is (issue 1391)",
-			pull("novox", "mesh-host", "main", []string{"validate/v.go"}), "mesh-host", "", "module.json", true, ""},
-		{"the core's owner, no module: the mesh's, its own check alone", pull("novox", "hq", "main", []string{"README.md"}),
-			"", "", "", true, ""},
-		{"a branch nothing is built from: the mesh's repository, no module", pull("novox", "photos", "master",
-			[]string{"server/x.js"}), "", "", "", true, ""},
-		{"the branch a module is built from", pull("novox", "photos", "nox-mesh", []string{"server/x.js"}),
-			"photos", "", "module.json", true, ""},
-		{"a repository on the forge's seat", pull("jschoubben", "snake", "main", []string{"index.html"}),
-			"snake", "", "module.json", true, ""},
-		{"a repository of nobody's, touching nothing", pull("someone", "dotfiles", "main", []string{"x"}),
-			"", "", "", false, ""},
-		{"a repository adding a module at its root", pull("someone", "newapp", "main", []string{"module.json", "x.js"}),
-			"", ".", "module.json", true, ""},
-	} {
-		s := pullScope(c.p, entries, nil, nil)
-		got := []string{strings.Join(s.Modules, ","), strings.Join(s.New, ","), strings.Join(s.Manifests, ",")}
-		want := []string{c.modules, c.new, c.manifest}
-		for i, what := range []string{"modules", "new", "manifests"} {
-			if got[i] != want[i] {
-				t.Errorf("%s: %s %q, wanted %q", c.what, what, got[i], want[i])
-			}
-		}
-		if s.Mesh != c.mesh {
-			t.Errorf("%s: the mesh's %v, wanted %v", c.what, s.Mesh, c.mesh)
-		}
-		if s.gated() != (c.modules != "" || c.new != "") {
-			t.Errorf("%s: gated %v", c.what, s.gated())
-		}
-	}
-}
-
-// A module whose build packages another repository's source is touched by a change to it.
-func TestAPullRequestTouchesWhatPackagesItsRepository(t *testing.T) {
-	entries := []inventory.Entry{fromRepo("node-tools", "http://forge.internal:20000/novox/mesh-tools.git", "node-tools")}
-	read := map[string][]inventory.ReadRepository{"node-tools": {{Repository: "http://forge.internal:20000/novox/mesh-sdk.git"}}}
-	s := pullScope(link.PullUpdated{Owner: "novox", Repo: "mesh-sdk", Base: "main", Commit: "abc", Paths: []string{"go/x.go"}}, entries, read, nil)
-	if strings.Join(s.Modules, ",") != "node-tools" || len(s.Manifests) != 0 {
-		t.Fatalf("a change to what node-tools packages touched %v (manifests %v)", s.Modules, s.Manifests)
-	}
-}

cmd/mesh-controller/collect.go

@@ -1,285 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"os"
-	"strings"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/artifacts"
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// Letting the artifact store go of what the mesh no longer keeps (novox/hq ADR 0189, issue 108).
-//
-// **Run where the records change.** A build is the moment new bytes landed in the store and the
-// moment the keep set moved, so it is the moment to say what may go — and it needs no timer of
-// its own. Reclaiming the bytes is the store's own nightly step; this only decides.
-//
-// **And run when a person asks** (novox/hq ADR 0251): the `collect` verb is the same sweep, with
-// bounds of its own. One implementation, so what a person runs is exactly what a build runs.
-//
-// Never fatal to a build. The build succeeded, the module is registered, and a store that could
-// not be reached is a thing to say rather than a reason to undo any of that. The next build asks
-// again, and the references it could not collect are still uncollected, so nothing is lost by
-// having failed.
-
-// sweepBounds is how much one sweep may ask of the store.
-type sweepBounds struct {
-	// most is how many artifacts it lets go of at most.
-	most int
-	// budget is the longest it keeps its caller waiting.
-	budget time.Duration
-	// platforms is whether an index is let go of with its own platform manifests (novox/hq ADR 0257).
-	// Only a sweep a person confirmed, after its dry run listed what stays and names a platform: the
-	// records cannot see an unrecorded index, or a copy in progress, naming the same platform, and the
-	// store's tools can.
-	platforms bool
-}
-
-// afterBuild are the bounds of the sweep inside somebody's build.
-//
-// **Bounded, because this runs inside somebody's build.** The first sweep of a mesh that has never
-// collected has the whole history to get through, and a person waiting on `build` should not pay for
-// it. What is left over is simply offered again next time — builds are frequent, and the point is
-// that the store stops growing, not that it empties tonight.
-var afterBuild = sweepBounds{most: mostPerSweep, budget: sweepBudget}
-
-// sweepResult is what one sweep did.
-type sweepResult struct {
-	// HoldersWritten is how many kept archives the store now holds by a manifest it did not before.
-	HoldersWritten int
-	// Missing is how many kept archives the store does not have at all.
-	Missing int
-	// Held is whether every kept archive could be asked to be held; false stops the sweep before it
-	// lets anything go.
-	Held bool
-	// LetGo is what the store let go of, and the record now says collected.
-	LetGo []string
-	// Skipped is how many references the sweep will not address (novox/hq issue 226).
-	Skipped int
-	// Indexes is how many eligible indexes a sweep a person did not confirm left for one that is: an
-	// index goes only with its platform manifests (novox/hq ADR 0257 §4).
-	Indexes int
-	// Left is how many eligible references were not asked about this time.
-	Left int
-	// Bounded is whether it stopped at its bounds rather than at a refusal.
-	Bounded bool
-	// Stopped says why the sweep stopped before the end; empty when it did not.
-	Stopped string
-}
-
-// sweep holds every kept archive, then asks the store to let go of each reference in order, records
-// what it let go of, and says what it did.
-func sweep(ctx context.Context, inv *inventory.Inventory, store artifacts.Store, references, kept []string,
-	bounds sweepBounds) sweepResult {
-	within, stop := context.WithTimeout(ctx, bounds.budget)
-	defer stop()
-	var r sweepResult
-
-	// **Hold before letting go** (novox/hq issue 253). The store's collector keeps only what a
-	// manifest names, and archives were published as bare blobs, so every kept archive is first
-	// held by its manifest — which backfills the ones published before holders, a few at a time
-	// as builds come, and is two HEADs each once done. A kept archive that could not be held stops
-	// the sweep before it deletes anything: "everything kept is held" is the precondition the
-	// collector's safety rests on, and a store refusing a hold would refuse the deletes too.
-	// **An index goes with its platform manifests only when a person confirmed it** (novox/hq ADR
-	// 0257), and a kept index keeps its own: which platform manifests the kept indexes name is read
-	// from the store for every repository the sweep will touch, before the first delete. A single
-	// read that fails stops the sweep before it deletes anything, as a kept archive that cannot be
-	// held does. The sweep after a build leaves an eligible index for such a collect, below.
-	store.Spare = nil
-	if bounds.platforms {
-		if inv == nil {
-			r.Stopped = "no records to read which platform manifests a kept index names, so nothing was let go"
-			r.Left = len(references)
-			return r
-		}
-		images, err := inv.KeptImages(ctx)
-		if err == nil {
-			store.Spare, err = store.SpareKeptIndexes(within, images, references)
-		}
-		if err != nil {
-			r.Stopped = fmt.Sprintf("which platform manifests a kept index names could not be read, so nothing was let go: %v", err)
-			r.Left = len(references)
-			return r
-		}
-	}
-
-	wrote, missing, err := holdKept(within, store, kept)
-	r.HoldersWritten, r.Missing = wrote, missing
-	if err != nil {
-		r.Stopped = fmt.Sprintf("not every kept archive could be held, so nothing was let go: %v", err)
-		r.Left = len(references)
-		return r
-	}
-	r.Held = true
-
-	for i, reference := range references {
-		if i >= bounds.most || within.Err() != nil {
-			r.Left = len(references) - i
-			r.Bounded = true
-			if i >= bounds.most {
-				r.Stopped = fmt.Sprintf("asked about %d, the most one sweep asks", bounds.most)
-			} else {
-				r.Stopped = fmt.Sprintf("ran out of its %s", bounds.budget)
-			}
-			break
-		}
-		if !bounds.platforms {
-			// **An index waits for a confirmed collect** (novox/hq ADR 0257 §4). Let go of alone,
-			// its platform manifests would stay in the store and the record would say collected, so
-			// no later sweep would offer it again and they would stay for ever. Left eligible, the
-			// next collect a person confirms takes it with them.
-			index, err := store.IsIndex(within, reference)
-			if err != nil && !errors.Is(err, artifacts.Gone) && !errors.Is(err, artifacts.ErrNotOurs) {
-				r.Stopped = fmt.Sprintf("the artifact store could not say whether %s is an index, so nothing more was asked of it: %v", reference, err)
-				r.Left = len(references) - i
-				break
-			}
-			if index {
-				r.Indexes++
-				continue
-			}
-		}
-		err := store.LetGo(within, reference)
-		if err == nil || errors.Is(err, artifacts.Gone) {
-			// Gone is the outcome wanted, already true. Recorded so the next sweep does not ask
-			// again for ever.
-			r.LetGo = append(r.LetGo, reference)
-			continue
-		}
-		if errors.Is(err, artifacts.ErrNotOurs) {
-			// **A fact about this record, so this record is skipped** (novox/hq issue 226). Not
-			// marked collected — the mesh did not remove it and should not claim to — and not a
-			// reason to stop, because the store was never asked. One of these at the front of
-			// the oldest-first order ended every sweep until this.
-			r.Skipped++
-			if r.Skipped == 1 {
-				fmt.Fprintf(os.Stderr, "the sweep will not address %s and went on: %v\n", reference, err)
-			}
-			continue
-		}
-		// **Stopped at the first refusal by the STORE, not pushed through.** A store that refuses
-		// one refuses all of them — deletion disabled, the store down, the network gone — so
-		// going on would be a hundred identical failures and a hundred identical log lines in
-		// front of whoever was building something.
-		r.Stopped = fmt.Sprintf("the artifact store kept %s, so nothing more was asked of it: %v", reference, err)
-		r.Left = len(references) - i
-		break
-	}
-
-	if len(r.LetGo) > 0 {
-		// Recorded outside `within`: the deletions happened, and losing the record of them because
-		// the sweep ran out of budget would mean asking about them again for ever.
-		if err := inv.MarkCollected(ctx, r.LetGo); err != nil {
-			r.Stopped = fmt.Sprintf("the store let go of %d artifact(s) and the record of it did not keep: %v",
-				len(r.LetGo), err)
-		}
-	}
-	return r
-}
-
-// collect asks the store to let go of everything the mesh made and no longer keeps, and records
-// what it let go of — after a build. Says what it did and what it could not; returns nothing,
-// because nothing upstream should branch on it.
-func collect(ctx context.Context, inv *inventory.Inventory) {
-	references, err := inv.ToCollect(ctx)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "could not work out what the artifact store may let go of: %v\n", err)
-		return
-	}
-	kept, err := inv.KeptArchives(ctx)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "could not work out which archives the artifact store keeps: %v\n", err)
-		return
-	}
-	if len(references) == 0 && len(kept) == 0 {
-		return
-	}
-	shelf, err := inv.Catalogue(ctx)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "could not read the catalogue to find the artifact store: %v\n", err)
-		return
-	}
-	// As the mesh reaches it from the network. Empty means the store is not on the network — on a
-	// mesh being raised it is not yet, and there the store holds one build of anything and has
-	// nothing to collect.
-	address, err := artifactStoreAddress(ctx, inv, shelf, "")
-	if err != nil || address == "" {
-		if err != nil {
-			fmt.Fprintf(os.Stderr, "could not find the artifact store to collect from: %v\n", err)
-		}
-		return
-	}
-
-	r := sweep(ctx, inv, artifacts.Store{Address: address}, references, kept, afterBuild)
-	sayCollected(os.Stderr, r)
-}
-
-// sayCollected says what one sweep after a build did.
-func sayCollected(w io.Writer, r sweepResult) {
-	if r.HoldersWritten > 0 {
-		fmt.Fprintf(w, "the artifact store now holds %d more kept archive(s) by a manifest\n", r.HoldersWritten)
-	}
-	if r.Missing > 0 {
-		fmt.Fprintf(w, "%d archive(s) the mesh keeps are not in the artifact store at all; "+
-			"`collection` lists them\n", r.Missing)
-	}
-	if len(r.LetGo) > 0 {
-		// **Each one named** (novox/hq issue 1933): a count could not say which archive a machine's 404 was let go of.
-		fmt.Fprintf(w, "the artifact store let go of %d artifact(s) the mesh no longer keeps: %s\n", len(r.LetGo),
-			strings.Join(r.LetGo, ", "))
-	}
-	if r.Stopped != "" && !r.Bounded {
-		fmt.Fprintln(w, r.Stopped)
-	}
-	if r.Held && r.Left > 0 {
-		fmt.Fprintf(w, "%d more to collect; the next build asks again\n", r.Left)
-	}
-	if r.Skipped > 0 {
-		fmt.Fprintf(w, "%d artifact(s) the sweep will not address were skipped\n", r.Skipped)
-	}
-	if r.Indexes > 0 {
-		fmt.Fprintf(w, "%d eligible index(es) wait for a collect a person confirms, which takes their platforms too\n", r.Indexes)
-	}
-}
-
-// holdKept holds every kept archive by its manifest, stopping at the first refusal by the store.
-// Answers how many holders it wrote and how many kept archives the store does not have.
-//
-// A missing archive is counted rather than fatal: there is nothing to hold, and that is a fact
-// for an operator to read (`collection`), not a reason to stop collecting what is not kept. A
-// reference the store cannot be asked about is skipped as the deletion loop skips one
-// (novox/hq issue 226).
-func holdKept(ctx context.Context, store artifacts.Store, kept []string) (wrote, missing int, err error) {
-	for _, reference := range kept {
-		if err := ctx.Err(); err != nil {
-			return wrote, missing, fmt.Errorf("ran out of time before %s: %w", reference, err)
-		}
-		did, err := store.Hold(ctx, reference)
-		switch {
-		case err == nil:
-			if did {
-				wrote++
-			}
-		case errors.Is(err, artifacts.Gone):
-			missing++
-		case errors.Is(err, artifacts.ErrNotOurs):
-		default:
-			return wrote, missing, fmt.Errorf("holding %s: %w", reference, err)
-		}
-	}
-	return wrote, missing, nil
-}
-
-// mostPerSweep is how many artifacts one sweep will ask about. Enough that a mesh building
-// several times a day converges within days of this landing; small enough that no single build
-// waits on the whole backlog.
-const mostPerSweep = 200
-
-// sweepBudget is the longest a sweep will keep a build waiting.
-const sweepBudget = 60 * time.Second

cmd/mesh-controller/collection.go

@@ -1,166 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"flag"
-	"fmt"
-	"os"
-	"strings"
-
-	"github.com/novox/mesh-controller/internal/artifacts"
-)
-
-// What the artifact store keeps, whether each kept archive is held, and what the sweep may let go
-// (novox/hq issue 253, ADR 0189).
-//
-// **The question to answer before the store's collector runs for real.** The collector deletes
-// every blob no manifest names, and archives were published as bare blobs, so the nightly step
-// runs `--dry-run` until every archive the mesh keeps is held by its manifest. The sweep holds
-// them as builds come; this says how far that has got — "0 unheld" is the number that lets the
-// dry run go.
-//
-// Reads and changes nothing: each kept archive is asked about with HEADs only. Reached over the
-// console through the mesh-controller seat's `command` verb (`collection --json`), which needs no
-// new verb in the seat's row.
-
-type collectionReport struct {
-	// Store is the artifact store as this machine reached it; empty when it is not on the network.
-	Store string `json:"store"`
-	// KeptArchives is how many archives the mesh keeps, for either reason.
-	KeptArchives int `json:"kept_archives"`
-	// Held is how many of them the store holds by their manifest.
-	Held int `json:"held"`
-	// Unheld are the kept archives the collector would delete tonight if it ran for real.
-	Unheld []string `json:"unheld"`
-	// Missing are kept archives the store does not have at all.
-	Missing []string `json:"missing"`
-	// Unasked is how many could not be asked about, and why the asking stopped.
-	Unasked int    `json:"unasked"`
-	Stopped string `json:"stopped,omitempty"`
-	// Eligible is what the sweep may let go of: made by the mesh, kept for no reason, not yet
-	// collected — split by kind.
-	Eligible         int `json:"eligible"`
-	EligibleImages   int `json:"eligible_images"`
-	EligibleArchives int `json:"eligible_archives"`
-	// SafeToCollect is whether every kept archive was asked about and every one is held.
-	SafeToCollect bool `json:"safe_to_collect"`
-}
-
-func collectionCommand(ctx context.Context, args []string) error {
-	set := flag.NewFlagSet("collection", flag.ContinueOnError)
-	asJSON := set.Bool("json", false, "answer as JSON")
-	positionals, err := parseAround(set, args)
-	if err != nil {
-		return err
-	}
-	if len(positionals) != 0 {
-		return errors.New("collection [--json]")
-	}
-
-	open, err := openStores(ctx)
-	if err != nil {
-		return err
-	}
-	defer open.Close()
-	inv := open.inventory
-
-	kept, err := inv.KeptArchives(ctx)
-	if err != nil {
-		return err
-	}
-	eligible, err := inv.ToCollect(ctx)
-	if err != nil {
-		return err
-	}
-	report := collectionReport{KeptArchives: len(kept), Eligible: len(eligible), Unheld: []string{}, Missing: []string{}}
-	for _, reference := range eligible {
-		if strings.Contains(reference, "/blobs/") {
-			report.EligibleArchives++
-		} else {
-			report.EligibleImages++
-		}
-	}
-
-	shelf, err := inv.Catalogue(ctx)
-	if err != nil {
-		return err
-	}
-	report.Store, err = artifactStoreAddress(ctx, inv, shelf, "")
-	if err != nil {
-		return err
-	}
-	if report.Store == "" {
-		report.Unasked = len(kept)
-		report.Stopped = "this mesh has no artifact store on its network"
-	} else {
-		report.Unasked, report.Stopped = askHeld(ctx, artifacts.Store{Address: report.Store}, kept, &report)
-	}
-	report.SafeToCollect = report.Unasked == 0 && len(report.Unheld) == 0
-
-	if *asJSON {
-		encoder := json.NewEncoder(os.Stdout)
-		encoder.SetIndent("", "  ")
-		return encoder.Encode(report)
-	}
-	printCollection(report)
-	return nil
-}
-
-// askHeld asks the store about each kept archive, stopping at the first answer that is not about
-// the archive: a store that cannot be reached for one cannot be for the next, and a page of
-// identical failures says less than one line.
-func askHeld(ctx context.Context, store artifacts.Store, kept []string, report *collectionReport) (int, string) {
-	for i, reference := range kept {
-		held, err := store.Held(ctx, reference)
-		switch {
-		case err == nil && held:
-			report.Held++
-		case err == nil:
-			report.Unheld = append(report.Unheld, reference)
-		case errors.Is(err, artifacts.Gone):
-			report.Missing = append(report.Missing, reference)
-		case errors.Is(err, artifacts.ErrNotOurs):
-			// KeptArchives names only the mesh's own; counted as unasked if one ever is not.
-			report.Unasked++
-		default:
-			return report.Unasked + len(kept) - i, fmt.Sprintf("asking about %s: %v", reference, err)
-		}
-	}
-	return report.Unasked, ""
-}
-
-func printCollection(r collectionReport) {
-	store := r.Store
-	if store == "" {
-		store = "(not on the network)"
-	}
-	fmt.Printf("artifact store       %s\n", store)
-	fmt.Printf("kept archives        %d\n", r.KeptArchives)
-	fmt.Printf("  held               %d\n", r.Held)
-	fmt.Printf("  unheld             %d\n", len(r.Unheld))
-	fmt.Printf("  missing            %d\n", len(r.Missing))
-	if r.Unasked > 0 {
-		fmt.Printf("  not asked          %d (%s)\n", r.Unasked, r.Stopped)
-	}
-	fmt.Printf("eligible to let go   %d (%d images, %d archives)\n", r.Eligible, r.EligibleImages, r.EligibleArchives)
-	if len(r.Unheld) > 0 {
-		fmt.Println("\nunheld — the store's collector would delete these; the next build's sweep holds them:")
-		for _, reference := range r.Unheld {
-			fmt.Printf("  %s\n", reference)
-		}
-	}
-	if len(r.Missing) > 0 {
-		fmt.Println("\nmissing — kept by the mesh, not in the store:")
-		for _, reference := range r.Missing {
-			fmt.Printf("  %s\n", reference)
-		}
-	}
-	fmt.Println()
-	if r.SafeToCollect {
-		fmt.Println("every kept archive is held: the store's collector may run for real")
-	} else {
-		fmt.Println("NOT every kept archive is known to be held: keep the store's collector on --dry-run")
-	}
-}

cmd/mesh-controller/compose_callers_test.go

@@ -1,59 +0,0 @@
-package main
-
-import (
-	"go/ast"
-	"go/parser"
-	"go/token"
-	"path/filepath"
-	"sort"
-	"strings"
-	"testing"
-)
-
-// 1389: the controller's own composition is gone. No function of the package is named for it any more, and no function
-// calls one by that name: a name reappearing is a second copy of what mesh-sdk's go/compose holds (novox/hq ADR 0453).
-func TestTheControllersOwnCompositionIsGone(t *testing.T) {
-	gone := map[string]bool{"planFor": true, "declarationWith": true, "composedAndValidated": true, "generators": true,
-		"renderingFor": true, "theRestOfTheMesh": true, "whoResolves": true, "grantsFor": true, "namesInTheMesh": true,
-		"onThePrivateNetwork": true, "passSeatsOn": true, "theMeshPassesSeatsOn": true, "assignmentsOf": true,
-		"licencesFor": true, "seatsOn": true, "composeBusUsers": true, "adoptionFor": true, "localNetworksOf": true}
-	files, err := filepath.Glob("*.go")
-	if err != nil {
-		t.Fatal(err)
-	}
-	fset := token.NewFileSet()
-	var found []string
-	for _, f := range files {
-		if strings.HasSuffix(f, "_test.go") {
-			continue
-		}
-		file, err := parser.ParseFile(fset, f, nil, 0)
-		if err != nil {
-			t.Fatal(err)
-		}
-		for _, d := range file.Decls {
-			fn, ok := d.(*ast.FuncDecl)
-			if !ok {
-				continue
-			}
-			if gone[fn.Name.Name] {
-				found = append(found, f+": "+fn.Name.Name+" is declared")
-			}
-			if fn.Body == nil {
-				continue
-			}
-			ast.Inspect(fn.Body, func(n ast.Node) bool {
-				if c, ok := n.(*ast.CallExpr); ok {
-					if id, ok := c.Fun.(*ast.Ident); ok && gone[id.Name] {
-						found = append(found, f+": "+fn.Name.Name+" calls "+id.Name)
-					}
-				}
-				return true
-			})
-		}
-	}
-	sort.Strings(found)
-	for _, one := range found {
-		t.Errorf("%s: the controller's own composition is back; compose through mesh-sdk (compose_sdk.go)", one)
-	}
-}

cmd/mesh-controller/compose_fallbacks_test.go

@@ -1,114 +0,0 @@
-package main
-
-import (
-	"encoding/base64"
-	"errors"
-	"strings"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/compose"
-	"github.com/novox/mesh-controller/internal/broker"
-)
-
-// aCoreInput is an Input of one machine that takes a core module whose credential the vault has not boxed: the composition
-// stands in a vault box for it, and the machine holds the controller's own seal of it.
-func aCoreInput(t *testing.T) (*meshInput, string) {
-	t.Helper()
-	raw := make([]byte, 32)
-	raw[0] = 9
-	key := base64.StdEncoding.EncodeToString(raw)
-	client := catalogue.Manifest{Module: "mesh-provisioner-client", Version: "1",
-		Claims:     []catalogue.Claim{{Name: broker.NodeProvisionerSeat, Scope: catalogue.ScopeNode}},
-		OwnSecrets: catalogue.OwnSecrets{broker.ProvisionerSecret: {Path: "/var/lib/mesh-provisioner-client/broker"}}}
-	return &meshInput{Input: compose.Input{
-		Catalogue: map[string]catalogue.Manifest{client.Module: client},
-		Nodes: []compose.Node{{Name: "laptop", Assigned: []string{client.Module}, SealingKey: key, Stated: true,
-			Contract: compose.VaultBoxContract}},
-		OwnSecrets: []compose.OwnSecretRow{{Node: "laptop", Module: client.Module, Name: broker.ProvisionerSecret,
-			Origin: "made", SealedTo: key, Sealed: "SEALED-BY-THE-CONTROLLER"}},
-	}}, client.Module
-}
-
-// 1385 (the lead's answer 1): where the vault is silent and no box is kept, the declaration carries the controller's own seal
-// for the core credential, as ADR 0396 has it, and stands in for nothing. It failed first: the composition's declaration
-// carried the stand-in box, and a send was refused.
-func TestACoreCredentialTheVaultDidNotBoxIsSealedByTheController(t *testing.T) {
-	in, module := aCoreInput(t)
-	d, _, err := compose.ComposeIn(in.Input, "laptop", compose.Foreseeing)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(d.CoreBoxesWanted) != 1 || len(stillForeseen(d)) == 0 {
-		t.Fatalf("the composition does not stand in for the vault's box: %v", d.CoreBoxesWanted)
-	}
-	sealed, _, err := sealedByTheController(in, "laptop", d, []string{module})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if left := stillForeseen(sealed); len(left) != 0 {
-		t.Fatalf("the declaration still stands in for %v", left)
-	}
-	var file map[string]any
-	for _, r := range sealed.Resources {
-		if r["id"] == module+"."+catalogue.NeedID(broker.ProvisionerSecret) {
-			file = r
-		}
-	}
-	if file == nil || file["sealed"] != "SEALED-BY-THE-CONTROLLER" || file[catalogue.VaultSealedField] != nil {
-		t.Fatalf("the core credential is carried as %v: the controller's own seal, not the vault's box", file)
-	}
-	// And a module the vault did answer for is left as it is.
-	other, _, err := sealedByTheController(in, "laptop", d, []string{"another-module"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(stillForeseen(other)) == 0 {
-		t.Fatal("a module the vault answered for was sealed by the controller")
-	}
-}
-
-// 1383 (the lead's answer 4): the machine that runs the bus is refused where no user has a credential, with busUserList's
-// words, and a machine that does not run the bus is not. It failed first: the Input stood a list in and the bus node composed.
-func TestTheMachineThatRunsTheBusIsRefusedWhereNoUserHasACredential(t *testing.T) {
-	bus := catalogue.Manifest{Module: "nats", Version: "1", BusUsers: "/etc/nats/users.conf",
-		Claims: []catalogue.Claim{{Name: "mesh-broker", Scope: catalogue.ScopeMesh}}}
-	other := catalogue.Manifest{Module: "files", Version: "1"}
-	why := errors.New("this machine runs the bus and not one user has a credential, so the composed list would refuse every connection in the mesh")
-	in := &meshInput{busRefused: why, Input: compose.Input{
-		Catalogue: map[string]catalogue.Manifest{"nats": bus, "files": other},
-		Nodes:     []compose.Node{{Name: "anchor", Assigned: []string{"nats"}}, {Name: "laptop", Assigned: []string{"files"}}},
-	}}
-	if err := refusedBus(in, "anchor"); err == nil || !strings.Contains(err.Error(), "not one user has a credential") {
-		t.Fatalf("the machine that runs the bus is not refused: %v", err)
-	}
-	if err := refusedBus(in, "laptop"); err != nil {
-		t.Fatalf("a machine that does not run the bus is refused: %v", err)
-	}
-	if err := refusedBus(&meshInput{Input: in.Input}, "anchor"); err != nil {
-		t.Fatalf("a bus with users is refused: %v", err)
-	}
-}
-
-// The controller's seal replaces the stand-in box whatever path the resource carries: the path is the manifest's with the
-// machine's words filled in, not the manifest's own. It failed first, with the path compared (the live try: "composed twice and
-// still names ... asked of the vault by the next send").
-func TestTheControllersSealReplacesTheBoxWhateverPathTheFileCarries(t *testing.T) {
-	in, module := aCoreInput(t)
-	d, _, err := compose.ComposeIn(in.Input, "laptop", compose.Foreseeing)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, r := range d.Resources {
-		if _, box := r[catalogue.VaultSealedField]; box {
-			r["path"] = "/home/someone/.var/lib/mesh-provisioner-client/broker"
-		}
-	}
-	sealed, _, err := sealedByTheController(in, "laptop", d, []string{module})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if left := stillForeseen(sealed); len(left) != 0 {
-		t.Fatalf("the declaration still stands in for %v", left)
-	}
-}

cmd/mesh-controller/compose_helpers_test.go

@@ -1,33 +0,0 @@
-package main
-
-import (
-	"context"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/compose"
-)
-
-// grantsOf is the grants a provider creates for its consumers, the consumers whose identity overflows the provision's bound
-// and the credentials bound to another consumer, as mesh-sdk's rendering gives them for the machine (it replaced the
-// controller's grantsFor, issue 1389).
-func grantsOf(ctx context.Context, open *stores, node string) ([]catalogue.Grant, []catalogue.Overflow, []catalogue.Unbound, error) {
-	in, err := inputFor(ctx, open)
-	if err != nil {
-		return nil, nil, nil, err
-	}
-	rendered, err := compose.Render(in.Input, node, compose.Reading)
-	if err != nil {
-		return nil, nil, nil, err
-	}
-	return rendered.Rendering.Grants, rendered.Withheld, rendered.Unbound, nil
-}
-
-// madeAndRendered sends to the machine (so everything a send makes is made) and answers its rendering as a question reads it
-// afterwards: what the controller's Allocating rendering was.
-func madeAndRendered(ctx context.Context, open *stores, node string) (catalogue.Rendering, error) {
-	if _, err := composeSend(ctx, open, node); err != nil {
-		return catalogue.Rendering{}, err
-	}
-	forgetInput(ctx)
-	return renderingOf(ctx, open, node)
-}

cmd/mesh-controller/compose_input.go

@@ -1,416 +0,0 @@
-package main
-
-import (
-	"context"
-	"os"
-	"sort"
-	"strings"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/compose"
-	"git.novox.be/novox/mesh-sdk/go/overlay"
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// The controller's adapter from its stores to mesh-sdk's composition input (novox/hq ADR 0453 clause 3, design 47 R4b,
-// issues 1382 and 1383).
-//
-// **The adapter reads, and perform writes.** readComposeInput asks the stores once for everything the composition reads
-// and returns compose.Input, which the composition never changes; it makes, seals, allocates and records nothing. A
-// pair credential, a port, an own secret or a core box that the next send would make is not made here: the composition
-// names it foreseen, and compose_perform.go makes it for a send, then reads the stores again and composes again. A
-// question (status, facts, probes, the merge gate's reading) never performs.
-//
-// **The Input is built once per operation.** A verb that composes every node reads the stores once and hands the Input to
-// each node's composition of it.
-
-// composeInputBuilt is called once for each Input the adapter builds: the seam a test counts the reads of an operation by
-// (issue 1382, criterion 5).
-var composeInputBuilt = func() {}
-
-// readComposeInput reads the stores once and returns what the composition needs. ctx carries what a send keeps (the
-// recorded modules kept at the build their machine runs, recorded_kept.go): the same contexts every send composes under.
-func readComposeInput(ctx context.Context, open *stores) (*meshInput, error) {
-	in, shape, err := readMeshAndNodes(ctx, open)
-	if err != nil {
-		return nil, err
-	}
-	// What each node resolves to, with no credential given (the settings are read before it): the modules whose settings are read, and the
-	// needs whose pair credentials are asked of the stores. Nothing is written by it.
-	unread, err := readSettings(ctx, open, &in)
-	if err != nil {
-		return nil, err
-	}
-	plans := map[string]compose.Resolved{}
-	for _, n := range in.Nodes {
-		if shape.refused[n.Name] != nil {
-			continue // refused for what it keeps: nothing of it is read further
-		}
-		resolved, err := compose.Resolve(in, n.Name)
-		switch {
-		case compose.IsUnresolvable(err):
-			// Their set does not compose: nothing of theirs is read further, as the controller never read a thing for a
-			// node that did not resolve.
-			continue
-		case err != nil:
-			return nil, err
-		}
-		plans[n.Name] = resolved
-	}
-	if err := unreadSettings(unread, plans); err != nil {
-		return nil, err
-	}
-	var busRefused error
-	wouldMake, err := readCredentialsAndBuilds(ctx, open, &in, plans, shape, &busRefused)
-	if err != nil {
-		return nil, err
-	}
-	composeInputBuilt()
-	return &meshInput{Input: in, wouldMake: wouldMake, busRefused: busRefused, refused: shape.refused}, nil
-}
-
-// meshInput is the Input an operation composes over, and the pair credentials its reading found none held for: the ones the
-// next send makes, which perform makes.
-type meshInput struct {
-	compose.Input
-	wouldMake []inventory.PairCredential
-	// busRefused is why the bus's user list cannot be composed (no user has a credential): the machine that runs the bus is
-	// refused with it, as the controller's own composition refused it, and no other machine is.
-	busRefused error
-	// refused is, by node, why that machine alone cannot be composed (nodeRefusal).
-	refused map[string]error
-}
-
-// nodeOf is the node of that name in an Input.
-func nodeOf(in compose.Input, name string) (compose.Node, bool) {
-	for _, n := range in.Nodes {
-		if n.Name == name {
-			return n, true
-		}
-	}
-	return compose.Node{}, false
-}
-
-// inputShape is what the first half of the reading found that the second half needs.
-type inputShape struct {
-	sent    map[string]map[string]string // by node: module to the commit last sent
-	kept    map[string]map[string]string // by node: module to the commit kept
-	current map[string]inventory.CurrentBuild
-	// refused is, by node, why a recorded module cannot be kept at the build the machine runs (keepRecorded's refusal, in
-	// its words): that machine alone is refused with it, as planFor refused it, and nothing else of the mesh is.
-	refused map[string]error
-}
-
-// readMeshAndNodes is the mesh-wide and per-node half of the Input (issue 1382).
-func readMeshAndNodes(ctx context.Context, open *stores) (compose.Input, inputShape, error) {
-	inv := open.inventory
-	var in compose.Input
-	shape := inputShape{sent: map[string]map[string]string{}, kept: map[string]map[string]string{}, refused: map[string]error{}}
-
-	shelf, err := inv.Catalogue(ctx)
-	if err != nil {
-		return in, shape, err
-	}
-	in.Catalogue = shelf
-	if in.Holdings, err = inv.Holdings(ctx); err != nil {
-		return in, shape, err
-	}
-	if in.Licences, err = readLicences(ctx, open); err != nil {
-		return in, shape, err
-	}
-
-	nodes, err := inv.Nodes(ctx)
-	if err != nil {
-		return in, shape, err
-	}
-	places, err := inv.Overlays(ctx)
-	if err != nil {
-		return in, shape, err
-	}
-	placed := map[string]inventory.Overlay{}
-	for _, p := range places {
-		placed[p.Name] = p
-	}
-	if shape.current, err = inv.CurrentBuilds(ctx); err != nil {
-		return in, shape, err
-	}
-
-	// The range the mesh allocates from and what its internal names end in, read from the environment here and nowhere else.
-	in.OverlayCIDR = strings.TrimSpace(os.Getenv(OverlayCIDRVar))
-	in.InternalSuffix = overlay.Suffix()
-	if in.Tunnels, err = readTunnels(ctx, inv); err != nil {
-		return in, shape, err
-	}
-	if in.Adopted, err = readAdopted(ctx, inv); err != nil {
-		return in, shape, err
-	}
-	carried, err := inv.CarriedPeers(ctx)
-	if err != nil {
-		return in, shape, err
-	}
-	for _, c := range carried {
-		in.CarriedPeers = append(in.CarriedPeers, compose.CarriedPeer{
-			PublicKey: c.PublicKey, Address: c.Address, EnrolledAs: c.EnrolledAs, Named: c.Named})
-	}
-	if in.Joining, err = inv.NodesWithALiveToken(ctx); err != nil {
-		return in, shape, err
-	}
-
-	keepsSecrets := false
-	for _, m := range shelf {
-		keepsSecrets = keepsSecrets || m.Keeps != ""
-	}
-
-	for _, n := range nodes {
-		var refusal error
-		node, err := readNode(ctx, open, n, placed[n.Name], &refusal)
-		if err != nil {
-			return in, shape, err
-		}
-		if refusal != nil {
-			shape.refused[n.Name] = refusal
-		}
-		shape.sent[n.Name], shape.kept[n.Name] = node.SentBuilds, node.KeptBuilds
-		in.Nodes = append(in.Nodes, node)
-	}
-	if keepsSecrets {
-		if in.OperatorExport, err = inv.OperatorExport(ctx); err != nil {
-			return in, shape, err
-		}
-	}
-	return in, shape, nil
-}
-
-// readNode is one node of the Input: everything the composition reads about it, in the order the controller read it.
-func readNode(ctx context.Context, open *stores, n inventory.Node, place inventory.Overlay,
-	refused *error) (compose.Node, error) {
-	inv := open.inventory
-	out := compose.Node{
-		Name: n.Name,
-		Place: compose.Place{Key: place.Key, Endpoint: place.Endpoint, Site: place.Site, Hub: place.Hub,
-			Address: place.Address},
-		Account: n.Account, AccountHome: n.AccountHome, AgentAccount: n.AgentAccount, AgentAccountHome: n.AgentAccountHome,
-		Adopted: n.Adopted,
-	}
-	var err error
-	if out.Assigned, err = inv.Assigned(ctx, n.Name); err != nil {
-		return out, err
-	}
-	if out.Capabilities, err = inv.ProfileOf(ctx, n.Name); err != nil {
-		return out, err
-	}
-	if out.PublicDomain, err = inv.PublicDomainOf(ctx, n.Name); err != nil {
-		return out, err
-	}
-	if out.Pins, err = inv.PinsFor(ctx, n.Name); err != nil {
-		return out, err
-	}
-	if out.Bound, err = inv.BindingsFor(ctx, n.Name); err != nil {
-		return out, err
-	}
-	given, err := inv.PortsFor(ctx, n.Name)
-	if err != nil {
-		return out, err
-	}
-	for _, a := range given {
-		if out.Ports == nil {
-			out.Ports = map[string]map[int]int{}
-		}
-		if out.Ports[a.Module] == nil {
-			out.Ports[a.Module] = map[int]int{}
-		}
-		out.Ports[a.Module][a.Wanted] = a.Machine
-	}
-	if out.SealingKey, err = inv.SealingKeyOf(ctx, n.Name); err != nil {
-		return out, err
-	}
-	if n.Adopted {
-		if out.Taken, err = inv.Taken(ctx, n.Name); err != nil {
-			return out, err
-		}
-	}
-	if out.OutwardLinks, err = inv.OutwardLinksOf(ctx, n.Name); err != nil {
-		return out, err
-	}
-	account, had, err := inv.MachineOf(ctx, n.Name)
-	if err != nil {
-		return out, err
-	}
-	if had && account.Machine != nil {
-		out.NetworksSaid = true
-		for _, a := range account.Machine.Networks {
-			out.Networks = append(out.Networks, catalogue.AttachedNetwork{Link: a.Link, Network: a.Network})
-		}
-	}
-	if out.Sequence, err = inv.Sequence(ctx, n.ID); err != nil {
-		return out, err
-	}
-	// Every node-engine of release 6 reads a module per resource and a build per module.
-	out.ReadsModules = true
-	stated, has, err := inv.HealthOf(ctx, n.Name)
-	if err != nil {
-		return out, err
-	}
-	out.Stated = has
-	if has {
-		out.Contract = stated.Contract
-	}
-	return out, nil
-}
-
-func readTunnels(ctx context.Context, inv *inventory.Inventory) (map[string]compose.FoundTunnel, error) {
-	found, err := inv.Tunnels(ctx)
-	if err != nil {
-		return nil, err
-	}
-	if len(found) == 0 {
-		return nil, nil
-	}
-	out := make(map[string]compose.FoundTunnel, len(found))
-	for name, t := range found {
-		out[name] = compose.FoundTunnel{Tunnel: tunnelOf(t.Tunnel), NodeAdopted: t.NodeAdopted}
-	}
-	return out, nil
-}
-
-func readAdopted(ctx context.Context, inv *inventory.Inventory) (*compose.AdoptedTunnel, error) {
-	tunnel, hub, adopted, err := inv.AdoptedTunnel(ctx)
-	if err != nil {
-		return nil, err
-	}
-	if hub == "" {
-		return nil, nil
-	}
-	return &compose.AdoptedTunnel{Tunnel: tunnelOf(tunnel), Hub: hub, Adopted: adopted}, nil
-}
-
-func tunnelOf(t inventory.Tunnel) compose.Tunnel {
-	out := compose.Tunnel{Interface: t.Interface, Unit: t.Unit, Config: t.Config, Port: t.Port, MTU: t.MTU,
-		Address: t.Address, Range: t.Range, PublicKey: t.PublicKey}
-	for _, p := range t.Peers {
-		out.Peers = append(out.Peers, compose.TunnelPeer{PublicKey: p.PublicKey, Address: p.Address})
-	}
-	return out
-}
-
-// readLicences is every licence the mesh holds, with who uses it and the key sealed to each holder: given even where empty,
-// so a holder the mesh holds no key for composes as that, and not as a key that was not asked for.
-func readLicences(ctx context.Context, open *stores) ([]compose.Licence, error) {
-	held, err := open.Licences(ctx)
-	if err != nil {
-		return nil, err
-	}
-	all, err := held.All(ctx)
-	if err != nil {
-		return nil, err
-	}
-	var out []compose.Licence
-	for _, one := range all {
-		l := compose.Licence{Name: one.Name, Serves: one.Serves, Keys: map[compose.Holder]string{}}
-		holders, err := held.HoldersOf(ctx, one.Name)
-		if err != nil {
-			return nil, err
-		}
-		for _, h := range holders {
-			holder := compose.Holder{Node: h.Node, Module: h.Module}
-			l.Holders = append(l.Holders, holder)
-			key, err := held.KeyFor(ctx, one.Name, h.Node, h.Module)
-			if err != nil {
-				return nil, err
-			}
-			l.Keys[holder] = key
-		}
-		node, module, err := held.ManagerOf(ctx, one.Name)
-		if err != nil {
-			return nil, err
-		}
-		l.Manager = compose.Holder{Node: node, Module: module}
-		out = append(out, l)
-	}
-	return out, nil
-}
-
-// readSettings is each node's settings layers for every module that has any (a row, or config in mesh-config), read BEFORE any node is resolved: the first pass
-// resolves a node whose set takes a provider's served facts from the node that runs it, with that node's settings on them
-// (servedOnNode), so a mesh whose provider says ${setting:domain} resolves only with the settings in the Input. A module's
-// settings that fail to read are returned in unread, by node and module, and are an error only for a module a node resolves to
-// (unreadSettings): the controller read none for a module nothing runs.
-func readSettings(ctx context.Context, open *stores, in *compose.Input) (unread map[string]map[string]error, err error) {
-	have, err := open.inventory.ModulesWithSettings(ctx)
-	if err != nil {
-		return nil, err
-	}
-	names, err := modulesToRead(in.Catalogue, have, func(module string) (bool, error) {
-		return open.inventory.ReadsConfig(ctx, module)
-	})
-	if err != nil {
-		return nil, err
-	}
-	for i := range in.Nodes {
-		n := &in.Nodes[i]
-		for _, module := range names {
-			layers, err := open.inventory.SettingsFor(ctx, n.Name, module)
-			if err != nil {
-				if unread == nil {
-					unread = map[string]map[string]error{}
-				}
-				if unread[n.Name] == nil {
-					unread[n.Name] = map[string]error{}
-				}
-				unread[n.Name][module] = err
-				continue
-			}
-			if len(layers) == 0 {
-				continue
-			}
-			if n.Settings == nil {
-				n.Settings = map[string][]catalogue.Layer{}
-			}
-			n.Settings[module] = layers
-		}
-	}
-	return unread, nil
-}
-
-// modulesToRead is the modules on the shelf whose settings are read for a node: those with a settings row, and those in
-// the config form whose values mesh-config holds (readsConfig), which have no row when they were never in the settings
-// form (issue 1493: brother's scanner and printer, set only in mesh-config, composed empty). SettingsFor is where
-// mesh-config's values are laid in, so a gate on the settings table alone leaves them out.
-func modulesToRead(shelf map[string]catalogue.Manifest, have map[string]bool, readsConfig func(string) (bool, error)) ([]string, error) {
-	names := make([]string, 0, len(have))
-	for module, m := range shelf {
-		if have[module] {
-			names = append(names, module)
-			continue
-		}
-		if !m.DeclaresConfig() {
-			continue
-		}
-		reads, err := readsConfig(module)
-		if err != nil {
-			return nil, err
-		}
-		if reads {
-			names = append(names, module)
-		}
-	}
-	sort.Strings(names)
-	return names, nil
-}
-
-// unreadSettings is the error of a module's settings that did not read, for a module the node resolves to.
-func unreadSettings(unread map[string]map[string]error, plans map[string]compose.Resolved) error {
-	names := make([]string, 0, len(plans))
-	for node := range plans {
-		names = append(names, node)
-	}
-	sort.Strings(names)
-	for _, node := range names {
-		for _, m := range plans[node].Plan.Modules {
-			if err := unread[node][m.Module]; err != nil {
-				return err
-			}
-		}
-	}
-	return nil
-}

cmd/mesh-controller/compose_input_credentials.go

@@ -1,285 +0,0 @@
-package main
-
-import (
-	"context"
-	"sort"
-	"strings"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/compose"
-	"git.novox.be/novox/mesh-sdk/go/overlay"
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// The second half of the adapter (issue 1383): the credential and build fields of the Input, read and never made.
-
-// readCredentialsAndBuilds fills what the first half left: the credentials, the own secrets, the vault's boxes, the bus,
-// each node's serving key and certificate, and the builds.
-func readCredentialsAndBuilds(ctx context.Context, open *stores, in *compose.Input, plans map[string]compose.Resolved,
-	shape inputShape, busRefused *error) ([]inventory.PairCredential, error) {
-	if err := readIdentity(ctx, open, in); err != nil {
-		return nil, err
-	}
-	wouldMake, err := readCredentials(ctx, open, in, plans, busRefused)
-	if err != nil {
-		return nil, err
-	}
-	return wouldMake, readBuilds(ctx, open, in, plans, shape)
-}
-
-// readIdentity is the mesh's authority and each node's serving key and the certificate kept for it, for a mesh in which a
-// module asks for a certificate. It establishes and issues nothing: a certificate not kept yet is composed with a stand-in, and
-// issued by the send (certificateFor).
-func readIdentity(ctx context.Context, open *stores, in *compose.Input) error {
-	needs := false
-	for _, m := range in.Catalogue {
-		needs = needs || m.Certificate != nil
-	}
-	if !needs {
-		return nil
-	}
-	ident, err := open.Identity(ctx)
-	if err != nil {
-		return err
-	}
-	if certificate, known, err := ident.KnownAuthority(ctx); err != nil {
-		return err
-	} else if known {
-		in.Authority = certificate
-	}
-	nodes, err := open.inventory.Nodes(ctx)
-	if err != nil {
-		return err
-	}
-	ids := map[string]string{}
-	for _, n := range nodes {
-		ids[n.Name] = n.ID
-	}
-	for i := range in.Nodes {
-		n := &in.Nodes[i]
-		if n.ServingKey, err = ident.ServingKeyOf(ctx, ids[n.Name]); err != nil {
-			return err
-		}
-		if n.ServingKey == "" {
-			continue
-		}
-		if certificate, known, err := ident.KeptCertificate(ctx, overlay.InternalName(n.Name), n.ServingKey); err != nil {
-			return err
-		} else if known {
-			n.Certificate = certificate
-		}
-	}
-	return nil
-}
-
-// readCredentials is how each pair credential a node takes from elsewhere stands, the credentials made for each provider's
-// consumers, the own secrets, the vault's boxes and the bus. It reads and never makes: a credential a send would make is
-// left out (the composition's would-make), a credential only a person gives and nobody gave is not-given, and one the send
-// would be refused is refused with the controller's words.
-func readCredentials(ctx context.Context, open *stores, in *compose.Input, plans map[string]compose.Resolved,
-	busRefused *error) ([]inventory.PairCredential, error) {
-	var wouldMake []inventory.PairCredential
-	inv := open.inventory
-	shelf := in.Catalogue
-	nodeOf := map[string]compose.Node{}
-	for _, n := range in.Nodes {
-		nodeOf[n.Name] = n
-	}
-	names := make([]string, 0, len(plans))
-	for name := range plans {
-		names = append(names, name)
-	}
-	sort.Strings(names)
-	for _, name := range names {
-		resolved := plans[name]
-		nodeShelf := shelfWith(shelf, nodeOf[name].Kept)
-		for _, need := range resolved.Plan.Needs {
-			if need.ByRecord {
-				continue
-			}
-			p := inventory.PairCredential{Name: need.Name, Consumer: name, ConsumerModule: need.For,
-				Provider: need.From, Local: need.Local}
-			if module, outside := issuedOutsideBy(nodeShelf, need); outside {
-				p.Kind, p.ProviderModule = inventory.PairOutside, module
-			} else if need.SharedOwn != "" {
-				p.Kind, p.Own = inventory.PairShared, need.SharedOwn
-				p.ProviderModule = sharedProviderModule(resolved.Plan, shelf, need)
-			}
-			state, err := inv.PairCredentialState(ctx, p)
-			if err != nil {
-				return nil, err
-			}
-			c := compose.Credential{Provision: need.Name, Consumer: name, ConsumerModule: need.For,
-				Provider: need.From, Local: need.Local}
-			switch state.State {
-			case inventory.PairHeld:
-				c.State, c.Sealed = compose.CredentialHeld, state.Sealed
-			case inventory.PairNotGiven:
-				c.State, c.Why = compose.CredentialNotGiven, state.Why
-			case inventory.PairRefused:
-				c.State, c.Why = compose.CredentialRefused, state.Why
-			default:
-				// Left out: a need with no entry is the credential the next send makes, and perform makes it.
-				wouldMake = append(wouldMake, p)
-				continue
-			}
-			in.Credentials = append(in.Credentials, c)
-		}
-	}
-
-	// The credentials made for each provider's consumers, so the grants it must create are read from them.
-	for _, n := range in.Nodes {
-		rows, err := inv.SecretsFrom(ctx, n.Name)
-		if err != nil {
-			return nil, err
-		}
-		for _, s := range rows {
-			in.Issued = append(in.Issued, compose.Issued{Provision: s.Name, Consumer: s.Consumer,
-				ConsumerModule: s.ConsumerModule, Local: s.Local, Provider: n.Name, ForProvider: s.ForProvider})
-		}
-	}
-	own, err := inv.OwnSecretRows(ctx)
-	if err != nil {
-		return nil, err
-	}
-	for _, r := range own {
-		in.OwnSecrets = append(in.OwnSecrets, compose.OwnSecretRow{Node: r.Node, Module: r.Module, Name: r.Name,
-			Origin: r.Origin, SealedTo: r.SealedTo, Sealed: r.Sealed})
-	}
-	for _, n := range in.Nodes {
-		boxes, err := inv.KeptCoreBoxes(ctx, n.Name)
-		if err != nil {
-			return nil, err
-		}
-		for module, byName := range boxes {
-			for name, b := range byName {
-				in.KeptCoreBoxes = append(in.KeptCoreBoxes, compose.CoreBox{Node: n.Name, Module: module, Name: name,
-					Generation: b.Generation, SealedTo: b.SealedTo, Box: b.Box})
-			}
-		}
-	}
-	sort.Slice(in.KeptCoreBoxes, func(i, j int) bool {
-		a, b := in.KeptCoreBoxes[i], in.KeptCoreBoxes[j]
-		if a.Node != b.Node {
-			return a.Node < b.Node
-		}
-		if a.Module != b.Module {
-			return a.Module < b.Module
-		}
-		return a.Name < b.Name
-	})
-
-	// The bus: its user list as the controller composes it, for the machine that runs it, and who the mesh has minted a
-	// credential for.
-	var bus []catalogue.Manifest
-	for _, m := range shelf {
-		if m.BusUsers != "" && m.ClaimsSeat("mesh-broker") {
-			bus = append(bus, m)
-		}
-	}
-	if len(bus) > 0 {
-		list, missing, err := busUserList(ctx, inv, bus)
-		if err != nil && !strings.Contains(err.Error(), "not one user has a credential") {
-			return nil, err
-		}
-		if err != nil {
-			// The machine that runs the bus is refused, as the controller's own composition refused it: a list that
-			// refuses every connection in the mesh is never composed (refusedBus); the other machines compose.
-			*busRefused = err
-		}
-		in.BusUsers, in.BusMissing = list, missing
-	}
-	if in.BusMinted, err = inv.BusMinted(ctx); err != nil {
-		return nil, err
-	}
-	if in.BusMemberships, err = inv.BusMemberships(ctx); err != nil {
-		return nil, err
-	}
-	return wouldMake, nil
-}
-
-// readBuilds is the build half of the Input: every repository the mesh built, each module's current build, and the build made
-// from a commit of a module for the machines whose node-engine reads them.
-func readBuilds(ctx context.Context, open *stores, in *compose.Input, plans map[string]compose.Resolved, shape inputShape) error {
-	inv := open.inventory
-	held, err := inv.Held(ctx)
-	if err != nil {
-		return err
-	}
-	for repository := range held {
-		in.Built = append(in.Built, repository)
-	}
-	sort.Strings(in.Built)
-	in.CurrentBuilds = make(map[string]string, len(shape.current))
-	for module, b := range shape.current {
-		in.CurrentBuilds[module] = b.Commit
-	}
-	// The build made from each commit a declaration may carry, for the machines that read a build per module.
-	for _, n := range in.Nodes {
-		if !n.ReadsModules {
-			continue
-		}
-		resolved, ok := plans[n.Name]
-		if !ok {
-			continue
-		}
-		for _, m := range resolved.Plan.Modules {
-			for _, commit := range []string{shape.current[m.Module].Commit, shape.kept[n.Name][m.Module], shape.sent[n.Name][m.Module]} {
-				if commit == "" {
-					continue
-				}
-				if _, done := in.BuildIDs[m.Module][commit]; done {
-					continue
-				}
-				build, err := inv.BuildOf(ctx, m.Module, commit)
-				if err != nil {
-					return err
-				}
-				if in.BuildIDs == nil {
-					in.BuildIDs = map[string]map[string]string{}
-				}
-				if in.BuildIDs[m.Module] == nil {
-					in.BuildIDs[m.Module] = map[string]string{}
-				}
-				in.BuildIDs[m.Module][commit] = build
-			}
-		}
-	}
-	return nil
-}
-
-// shelfWith is the shelf with each module a node keeps at the build it runs put in place of the current one: a copy.
-func shelfWith(shelf map[string]catalogue.Manifest, kept map[string]catalogue.Manifest) map[string]catalogue.Manifest {
-	if len(kept) == 0 {
-		return shelf
-	}
-	out := make(map[string]catalogue.Manifest, len(shelf)+len(kept))
-	for name, m := range shelf {
-		out[name] = m
-	}
-	for name, m := range kept {
-		out[name] = m
-	}
-	return out
-}
-
-// sharedProviderModule is which module answers a shared credential on the providing node: the one in the plan, else the first
-// the catalogue names (providerModuleOf, in an order that does not move between calls).
-func sharedProviderModule(plan catalogue.Resolution, shelf map[string]catalogue.Manifest, n catalogue.Needed) string {
-	for _, m := range plan.Modules {
-		if _, shared := m.SharedCredentialOf(n.Name); shared {
-			return m.Module
-		}
-	}
-	names := make([]string, 0, len(shelf))
-	for name := range shelf {
-		names = append(names, name)
-	}
-	sort.Strings(names)
-	for _, name := range names {
-		if _, shared := shelf[name].SharedCredentialOf(n.Name); shared {
-			return name
-		}
-	}
-	return ""
-}

cmd/mesh-controller/compose_input_credentials_integration_test.go

@@ -1,359 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"encoding/json"
-	"fmt"
-	"sort"
-	"strings"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/compose"
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// tableState is every table's rows and every sequence's last value, as the adapter's reads must leave them.
-func tableState(t *testing.T, inv *inventory.Inventory) map[string]string {
-	t.Helper()
-	out := map[string]string{}
-	for _, row := range inv.QueryForTest(t, `select table_name from information_schema.tables
-		where table_schema = 'public' and table_type = 'BASE TABLE' order by table_name`) {
-		name := strings.Trim(row[0], `"`)
-		count := inv.QueryForTest(t, fmt.Sprintf(`select count(*)::text from %q`, name))
-		out["rows:"+name] = fmt.Sprint(count)
-		digest := inv.QueryForTest(t, fmt.Sprintf(`select coalesce(md5(string_agg(t::text, '|' order by t::text)), '') from %q t`, name))
-		out["content:"+name] = fmt.Sprint(digest)
-	}
-	for _, row := range inv.QueryForTest(t, `select sequencename, coalesce(last_value::text, '') from pg_sequences
-		where schemaname = 'public' order by sequencename`) {
-		out["sequence:"+row[0]] = row[1]
-	}
-	return out
-}
-
-// 1382/AC4 and 1383/AC6: building the Input writes nothing. The store's rows, their contents and its sequences are the same
-// before and after, on a mesh whose credentials are not made, whose ports are not given and which keeps a recorded build.
-func TestBuildingTheInputWritesNothing(t *testing.T) {
-	open, _ := aMeshWithSecrets(t)
-	ctx := t.Context()
-	inv := open.inventory
-	// A consumer whose credential nothing has made yet, on a mesh that already composed.
-	register(t, open, catalogue.Manifest{Module: "reports", Version: "1", Requires: []string{"s3-bucket"},
-		Resources: []map[string]any{{"id": "config", "type": "file", "path": "/etc/reports/config.json", "mode": "0600",
-			"content": "{}", "merge": "json"}}})
-	if _, err := inv.Assign(ctx, "laptop", "reports"); err != nil {
-		t.Fatal(err)
-	}
-	before := tableState(t, inv)
-	if _, err := readComposeInput(ctx, open); err != nil {
-		t.Fatal(err)
-	}
-	after := tableState(t, inv)
-	var moved []string
-	for k, v := range after {
-		if before[k] != v {
-			moved = append(moved, k)
-		}
-	}
-	sort.Strings(moved)
-	if len(moved) > 0 {
-		t.Fatalf("building the Input wrote: %v", moved)
-	}
-}
-
-// a consumer of the s3-bucket aMeshWithSecrets' provider offers, with a file the credential goes into.
-func aConsumerOfTheBucket(name string) catalogue.Manifest {
-	return catalogue.Manifest{Module: name, Version: "1", Requires: []string{"s3-bucket"},
-		Secrets: map[string]string{"s3-bucket": "/etc/" + name + "/s3"},
-		Resources: []map[string]any{{"id": "config", "type": "file", "path": "/etc/" + name + "/config.json", "mode": "0600",
-			"content": "{}", "merge": "json"}}}
-}
-
-// 1383/AC1: of a provider's three consumers, two have their credentials made and one has not: Issued holds the two rows, with
-// the copy sealed to the provider, the third is a credential the next send makes, and no row was inserted for it (planFor
-// inserted it, plan.go: SecretFor in every mode).
-func TestAPairCredentialNoRowHoldsIsAWouldMakeAndNoRowIsInserted(t *testing.T) {
-	open, _ := aMeshWithSecrets(t)
-	ctx := t.Context()
-	inv := open.inventory
-	register(t, open, aConsumerOfTheBucket("reports"))
-	if _, err := inv.Assign(ctx, "laptop", "reports"); err != nil {
-		t.Fatal(err)
-	}
-	// A send makes the credentials of files and reports; a question makes none.
-	if _, err := composeSend(ctx, open, "laptop"); err != nil {
-		t.Fatal(err)
-	}
-	register(t, open, aConsumerOfTheBucket("metrics"))
-	if _, err := inv.Assign(ctx, "laptop", "metrics"); err != nil {
-		t.Fatal(err)
-	}
-	before := tableState(t, inv)
-	in, err := readComposeInput(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var rows []compose.Issued
-	for _, r := range in.Issued {
-		if r.Provider == "anchor" && r.Provision == "s3-bucket" {
-			rows = append(rows, r)
-			if r.ForProvider == "" {
-				t.Errorf("the row of %s carries no copy sealed to the provider", r.ConsumerModule)
-			}
-		}
-	}
-	if len(rows) != 2 {
-		t.Fatalf("Issued holds %d row(s) for anchor's s3-bucket, want files and reports: %+v", len(rows), rows)
-	}
-	var would []string
-	for _, p := range in.wouldMake {
-		would = append(would, p.ConsumerModule)
-	}
-	if len(would) != 1 || would[0] != "metrics" {
-		t.Fatalf("the credentials the next send makes are %v, want metrics", would)
-	}
-	for _, c := range in.Credentials {
-		if c.ConsumerModule == "metrics" {
-			t.Errorf("a credential nobody holds has an entry: %+v", c)
-		}
-	}
-	after := tableState(t, inv)
-	for k, v := range after {
-		if before[k] != v {
-			t.Errorf("reading the Input moved %s", k)
-		}
-	}
-}
-
-// 1383/AC2: a credential only a person gives that nobody gave is not given, and so is one given under a key the machine no
-// longer has; a credential given by a person for the pair and sealed to a key one end no longer has is refused: in the words
-// plan.go and secrets.go use.
-func TestACredentialOnlyAPersonGivesIsNotGivenAndAGivenOneUnderAnOldKeyIsSaidSo(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	inv := open.inventory
-	register(t, open, catalogue.Manifest{Module: "indexers", Version: "1", Provides: []catalogue.Offer{{
-		Name: "indexer-api", Scope: catalogue.ScopeMesh, Credential: &catalogue.OfferCredential{IssuedBy: catalogue.IssuedOutside}}}})
-	register(t, open, catalogue.Manifest{Module: "grabber", Version: "1", Requires: []string{"indexer-api"},
-		Secrets: map[string]string{"indexer-api": "/etc/grabber/key"}})
-	register(t, open, aConsumerOfTheBucket("ledger"))
-	register(t, open, catalogue.Manifest{Module: "objects", Version: "1", Provides: catalogue.FromAnywhere("s3-bucket")})
-	for _, a := range [][2]string{{"anchor", "indexers"}, {"laptop", "grabber"}, {"anchor", "objects"}, {"laptop", "ledger"}} {
-		if _, err := inv.Assign(ctx, a[0], a[1]); err != nil {
-			t.Fatalf("assign %s %s: %v", a[0], a[1], err)
-		}
-	}
-	stateOf := func(provision, consumerModule string) (compose.Credential, bool) {
-		in, err := readComposeInput(ctx, open)
-		if err != nil {
-			t.Fatal(err)
-		}
-		for _, c := range in.Credentials {
-			if c.Provision == provision && c.ConsumerModule == consumerModule {
-				return c, true
-			}
-		}
-		return compose.Credential{}, false
-	}
-
-	c, found := stateOf("indexer-api", "grabber")
-	if !found || c.State != compose.CredentialNotGiven || !strings.Contains(c.Why, "nobody gave it") {
-		t.Fatalf("a credential nobody gave reads as %+v", c)
-	}
-	if err := inv.AcceptSecretForPair(ctx, "indexer-api", "laptop", "grabber", "anchor", "", "the-key"); err != nil {
-		t.Fatal(err)
-	}
-	if c, found := stateOf("indexer-api", "grabber"); !found || c.State != compose.CredentialHeld || c.Sealed == "" {
-		t.Fatalf("a credential a person gave reads as %+v", c)
-	}
-	// The consumer's machine generated a key of its own since.
-	if err := inv.RecordSealingKey(ctx, nodeID(t, open, "laptop"), aPublicKey(t)); err != nil {
-		t.Fatal(err)
-	}
-	if c, found := stateOf("indexer-api", "grabber"); !found || c.State != compose.CredentialNotGiven ||
-		!strings.Contains(c.Why, "a sealing key one end no longer has") {
-		t.Fatalf("a credential given under a key the machine no longer has reads as %+v", c)
-	}
-
-	// A credential for a pair, given by a person, under a key one end has since replaced: the mesh cannot make another.
-	if err := inv.RecordSealingKey(ctx, nodeID(t, open, "laptop"), aPublicKey(t)); err != nil {
-		t.Fatal(err)
-	}
-	if err := inv.AcceptSecretForPair(ctx, "s3-bucket", "laptop", "ledger", "anchor", "", "the-bucket-key"); err != nil {
-		t.Fatal(err)
-	}
-	if err := inv.RecordSealingKey(ctx, nodeID(t, open, "laptop"), aPublicKey(t)); err != nil {
-		t.Fatal(err)
-	}
-	if c, found := stateOf("s3-bucket", "ledger"); !found || c.State != compose.CredentialRefused ||
-		!strings.Contains(c.Why, "was accepted from a person, and a sealing key at one end has changed since") {
-		t.Fatalf("a credential given for the pair under an old key reads as %+v", c)
-	}
-}
-
-// 1383/AC3: the own secrets carry their origin, the key they are sealed to and the sealed value; the vault's kept boxes, the
-// licences (with their keys given, so an empty key means the mesh holds none), the users the bus has minted and the
-// memberships equal what the inventory answers.
-func TestTheAdaptersInputCarriesTheOwnSecretsTheBoxesTheLicencesAndTheBus(t *testing.T) {
-	open, _ := aMeshWithSecrets(t)
-	ctx := t.Context()
-	inv := open.inventory
-	key, err := inv.SealingKeyOf(ctx, "anchor")
-	if err != nil {
-		t.Fatal(err)
-	}
-	sealed, err := inv.SecretForModule(ctx, "anchor", "objects", "admin")
-	if err != nil {
-		t.Fatal(err)
-	}
-	box := json.RawMessage(`{"v":1,"eph":"e","iv":"i","tag":"t","ct":"c"}`)
-	if err := inv.KeepCoreBox(ctx, "anchor", inventory.CoreBox{Module: "objects", Name: "admin", Generation: 4,
-		SealedTo: key, Box: box}); err != nil {
-		t.Fatal(err)
-	}
-	if err := inv.SeedBusUser(ctx, inventory.BusUser{Username: "anchor.objects", Kind: "module", Node: "anchor",
-		Module: "objects"}, "a-password"); err != nil {
-		t.Fatal(err)
-	}
-	// Minted and sealed to its node: an account counts as issued, and is named among the minted, only once sealed
-	// (ADR 0543 §2, PR #467).
-	if err := inv.MarkBusAccountSealed(ctx, "anchor.objects"); err != nil {
-		t.Fatal(err)
-	}
-	if err := inv.PutBusMembership(ctx, "laptop", "sealed-membership"); err != nil {
-		t.Fatal(err)
-	}
-	held, err := open.Licences(ctx)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := held.Add(ctx, "claude", "static", map[string]any{"model": "x"}); err != nil {
-		t.Fatal(err)
-	}
-
-	in, err := readComposeInput(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var own *compose.OwnSecretRow
-	for i := range in.OwnSecrets {
-		if r := &in.OwnSecrets[i]; r.Node == "anchor" && r.Module == "objects" && r.Name == "admin" {
-			own = r
-		}
-	}
-	if own == nil || own.Origin != "made" || own.SealedTo != key || own.Sealed != sealed {
-		t.Errorf("the own secret reads as %+v; the inventory holds %q sealed to %q", own, sealed, key)
-	}
-	var kept *compose.CoreBox
-	for i := range in.KeptCoreBoxes {
-		if b := &in.KeptCoreBoxes[i]; b.Node == "anchor" && b.Module == "objects" && b.Name == "admin" {
-			kept = b
-		}
-	}
-	if kept == nil || kept.Generation != 4 || kept.SealedTo != key || string(kept.Box) != string(box) {
-		t.Errorf("the kept box reads as %+v", kept)
-	}
-	if got := strings.Join(in.BusMinted, ","); !strings.Contains(got, "anchor.objects") {
-		t.Errorf("BusMinted is %v", in.BusMinted)
-	}
-	if in.BusMemberships["laptop"] != "sealed-membership" {
-		t.Errorf("BusMemberships is %v", in.BusMemberships)
-	}
-	if len(in.Licences) != 1 || in.Licences[0].Name != "claude" || in.Licences[0].Keys == nil {
-		t.Errorf("Licences read as %+v", in.Licences)
-	}
-}
-
-// 1383/AC4: the bus's user list is what busUserList gives for the machine that runs the bus, and the Input carries none when
-// no module of the shelf runs the bus.
-func TestTheBusUsersAreWhatTheControllerComposesForTheMachineThatRunsTheBus(t *testing.T) {
-	open, _ := aMeshWithSecrets(t)
-	ctx := t.Context()
-	in, err := readComposeInput(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if in.BusUsers != "" || len(in.BusMissing) != 0 {
-		t.Fatalf("a mesh whose shelf runs no bus carries a bus user list: %q %v", in.BusUsers, in.BusMissing)
-	}
-	bus := catalogue.Manifest{Module: "nats", Version: "1", BusUsers: "/etc/nats/users.conf",
-		Claims: []catalogue.Claim{{Name: "mesh-broker", Scope: catalogue.ScopeMesh}}}
-	register(t, open, bus)
-	if err := open.inventory.SeedBusUser(ctx, inventory.BusUser{Username: "controller", Kind: "controller"}, "pw"); err != nil {
-		t.Fatal(err)
-	}
-	in, err = readComposeInput(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
-	list, missing, _ := busUserList(ctx, open.inventory, []catalogue.Manifest{bus})
-	if in.BusUsers != list || fmt.Sprint(in.BusMissing) != fmt.Sprint(missing) {
-		t.Errorf("the Input carries %q (%v); busUserList gives %q (%v)", in.BusUsers, in.BusMissing, list, missing)
-	}
-}
-
-// 1383/AC5: Built, CurrentBuilds and BuildIDs equal the inventory's Held, CurrentBuilds and BuildOf, and the serving key and
-// the certificate are the machine's.
-func TestTheAdaptersInputCarriesTheBuildsAndTheMachinesKey(t *testing.T) {
-	open, _ := aMeshWithSecrets(t)
-	ctx := t.Context()
-	inv := open.inventory
-	in, err := readComposeInput(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
-	held, err := inv.Held(ctx)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var wantBuilt []string
-	for repository := range held {
-		wantBuilt = append(wantBuilt, repository)
-	}
-	sort.Strings(wantBuilt)
-	if fmt.Sprint(in.Built) != fmt.Sprint(wantBuilt) && !(len(in.Built) == 0 && len(wantBuilt) == 0) {
-		t.Errorf("Built is %v, the inventory's %v", in.Built, wantBuilt)
-	}
-	current, err := inv.CurrentBuilds(ctx)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for module, b := range current {
-		if in.CurrentBuilds[module] != b.Commit {
-			t.Errorf("CurrentBuilds[%s] is %q, the inventory's %q", module, in.CurrentBuilds[module], b.Commit)
-		}
-	}
-	for module, byCommit := range in.BuildIDs {
-		for commit, build := range byCommit {
-			if want, _ := inv.BuildOf(ctx, module, commit); want != build {
-				t.Errorf("BuildIDs[%s][%s] is %q, the inventory's %q", module, commit, build, want)
-			}
-		}
-	}
-}
-
-// The lead's answer 4: where the mesh holds no credential for any bus user, the machine that runs the bus is refused with
-// busUserList's words (the controller's composition refused it), the Input still builds, and another machine composes.
-func TestTheBusMachineIsRefusedWhereNoUserHasACredentialAndTheOthersCompose(t *testing.T) {
-	open, _ := aMeshWithSecrets(t)
-	ctx := t.Context()
-	bus := catalogue.Manifest{Module: "nats", Version: "1", BusUsers: "/etc/nats/users.conf",
-		Claims: []catalogue.Claim{{Name: "mesh-broker", Scope: catalogue.ScopeMesh}}}
-	register(t, open, bus)
-	register(t, open, aWebModule())
-	if _, err := assign(ctx, open, "anchor", "nats"); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := assign(ctx, open, "laptop", "web"); err != nil {
-		t.Fatal(err)
-	}
-	if _, _, err := composeQuestion(ctx, open, "anchor", compose.Foreseeing, false); err == nil ||
-		!strings.Contains(err.Error(), "not one user has a credential") {
-		t.Fatalf("the bus machine is composed: %v", err)
-	}
-	if _, _, err := composeQuestion(ctx, open, "laptop", compose.Foreseeing, false); err != nil {
-		t.Fatalf("a machine that does not run the bus is refused: %v", err)
-	}
-}

cmd/mesh-controller/compose_input_integration_test.go

@@ -1,264 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"reflect"
-	"strings"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/compose"
-)
-
-// 1382: the adapter's Input names, for every node, what the inventory answers for it, each compared with the read named
-// beside the field in go/compose/input.go (novox/hq ADR 0453 clause 3).
-func TestTheAdaptersInputNamesWhatTheInventoryAnswersForEachNode(t *testing.T) {
-	open, _ := aMeshWithSecrets(t)
-	ctx := t.Context()
-	inv := open.inventory
-	if err := inv.SetPublicDomain(ctx, "anchor", "example.test"); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := inv.PortFor(ctx, "laptop", "files", 8080, false); err != nil {
-		t.Fatal(err)
-	}
-	in, err := readComposeInput(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	shelf, err := inv.Catalogue(ctx)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !reflect.DeepEqual(in.Catalogue, shelf) {
-		t.Error("the Input's Catalogue is not the shelf the inventory holds")
-	}
-	nodes, err := inv.Nodes(ctx)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(in.Nodes) != len(nodes) {
-		t.Fatalf("the Input names %d node(s), the inventory has %d", len(in.Nodes), len(nodes))
-	}
-	places, err := inv.Overlays(ctx)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, record := range nodes {
-		n, ok := nodeOf(in.Input, record.Name)
-		if !ok {
-			t.Fatalf("%s is not in the Input", record.Name)
-		}
-		for _, p := range places {
-			if p.Name == record.Name {
-				if want := (compose.Place{Key: p.Key, Endpoint: p.Endpoint, Site: p.Site, Hub: p.Hub, Address: p.Address}); n.Place != want {
-					t.Errorf("%s: Place is %+v, the inventory's %+v", record.Name, n.Place, want)
-				}
-			}
-		}
-		assigned, _ := inv.Assigned(ctx, record.Name)
-		if !reflect.DeepEqual(n.Assigned, assigned) {
-			t.Errorf("%s: Assigned is %v, the inventory's %v", record.Name, n.Assigned, assigned)
-		}
-		caps, _ := inv.ProfileOf(ctx, record.Name)
-		if !reflect.DeepEqual(n.Capabilities, caps) {
-			t.Errorf("%s: Capabilities are %v, the inventory's %v", record.Name, n.Capabilities, caps)
-		}
-		domain, _ := inv.PublicDomainOf(ctx, record.Name)
-		if n.PublicDomain != domain {
-			t.Errorf("%s: PublicDomain is %q, the inventory's %q", record.Name, n.PublicDomain, domain)
-		}
-		if n.Account != record.Account || n.AccountHome != record.AccountHome || n.AgentAccount != record.AgentAccount ||
-			n.AgentAccountHome != record.AgentAccountHome || n.Adopted != record.Adopted {
-			t.Errorf("%s: the accounts or the mode differ from the inventory's: %+v", record.Name, n)
-		}
-		pins, _ := inv.PinsFor(ctx, record.Name)
-		if len(pins) != len(n.Pins) || (len(pins) > 0 && !reflect.DeepEqual(n.Pins, pins)) {
-			t.Errorf("%s: Pins are %v, the inventory's %v", record.Name, n.Pins, pins)
-		}
-		bound, _ := inv.BindingsFor(ctx, record.Name)
-		if len(bound) != len(n.Bound) || (len(bound) > 0 && !reflect.DeepEqual(n.Bound, bound)) {
-			t.Errorf("%s: Bound is %v, the inventory's %v", record.Name, n.Bound, bound)
-		}
-		key, _ := inv.SealingKeyOf(ctx, record.Name)
-		if n.SealingKey != key {
-			t.Errorf("%s: SealingKey is %q, the inventory's %q", record.Name, n.SealingKey, key)
-		}
-		ports, _ := inv.PortsFor(ctx, record.Name)
-		want := map[string]map[int]int{}
-		for _, a := range ports {
-			if want[a.Module] == nil {
-				want[a.Module] = map[int]int{}
-			}
-			want[a.Module][a.Wanted] = a.Machine
-		}
-		if len(want) != len(n.Ports) || (len(want) > 0 && !reflect.DeepEqual(n.Ports, want)) {
-			t.Errorf("%s: Ports are %v, the inventory's %v", record.Name, n.Ports, want)
-		}
-		// The settings of every module it resolves to, layer for layer.
-		resolved, err := compose.Resolve(in.Input, record.Name)
-		if err != nil {
-			continue
-		}
-		for _, m := range resolved.Plan.Modules {
-			layers, err := inv.SettingsFor(ctx, record.Name, m.Module)
-			if err != nil {
-				t.Fatal(err)
-			}
-			if len(layers) != len(n.Settings[m.Module]) || (len(layers) > 0 && !reflect.DeepEqual(n.Settings[m.Module], layers)) {
-				t.Errorf("%s: the settings of %s are %v, the inventory's %v", record.Name, m.Module, n.Settings[m.Module], layers)
-			}
-		}
-	}
-	if domain := nodeDomain(in.Input, "anchor"); domain != "example.test" {
-		t.Errorf("anchor's PublicDomain is %q", domain)
-	}
-	if got := nodePorts(in.Input, "laptop"); got["files"][8080] == 0 {
-		t.Errorf("laptop's port for files:8080 is not in the Input: %v", got)
-	}
-}
-
-func nodeDomain(in compose.Input, name string) string {
-	n, _ := nodeOf(in, name)
-	return n.PublicDomain
-}
-
-func nodePorts(in compose.Input, name string) map[string]map[int]int {
-	n, _ := nodeOf(in, name)
-	return n.Ports
-}
-
-// 1382/AC3: the seats on record, the tunnels, the adopted tunnel, its carried peers and the nodes joining equal the
-// inventory's answers; the range and the suffix are read from the environment once, here.
-func TestTheAdaptersInputCarriesTheNetworkAsTheInventoryHoldsIt(t *testing.T) {
-	open, _ := aMeshWithSecrets(t)
-	ctx := t.Context()
-	inv := open.inventory
-	t.Setenv(OverlayCIDRVar, "10.99.0.0/16")
-	t.Setenv("MESH_INTERNAL_SUFFIX", "mesh.test")
-	in, err := readComposeInput(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
-	holdings, err := inv.Holdings(ctx)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !reflect.DeepEqual(in.Holdings, holdings) {
-		t.Errorf("Holdings are %v, the inventory's %v", in.Holdings, holdings)
-	}
-	tunnels, err := inv.Tunnels(ctx)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(tunnels) != len(in.Tunnels) {
-		t.Errorf("Tunnels are %v, the inventory's %v", in.Tunnels, tunnels)
-	}
-	if _, hub, _, err := inv.AdoptedTunnel(ctx); err != nil {
-		t.Fatal(err)
-	} else if (hub == "") != (in.Adopted == nil) {
-		t.Errorf("Adopted is %v, the inventory's hub is %q", in.Adopted, hub)
-	}
-	carried, err := inv.CarriedPeers(ctx)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(carried) != len(in.CarriedPeers) {
-		t.Errorf("CarriedPeers are %v, the inventory's %v", in.CarriedPeers, carried)
-	}
-	joining, err := inv.NodesWithALiveToken(ctx)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(joining) != len(in.Joining) {
-		t.Errorf("Joining is %v, the inventory's %v", in.Joining, joining)
-	}
-	if in.OverlayCIDR != "10.99.0.0/16" || in.InternalSuffix != "mesh.test" {
-		t.Errorf("the range and the suffix are %q and %q", in.OverlayCIDR, in.InternalSuffix)
-	}
-	// Read once: what the environment says afterwards moves nothing already read.
-	t.Setenv(OverlayCIDRVar, "10.1.0.0/16")
-	if in.OverlayCIDR != "10.99.0.0/16" {
-		t.Error("the range moved with the environment")
-	}
-}
-
-// The lead's equality finding (build 1792487777757012513): a provider on one machine serves a fact that says ${setting:domain},
-// the setting is set for it, and a consumer on another machine takes that fact. The first pass of the adapter resolved every
-// node with no settings in the Input, so the served fact could not be settled and the whole Input failed. The settings are in
-// the Input before any node is resolved, and the Input builds, with the same plan for the consumer as the controller's own
-// composition. It failed first, with the finding's words.
-func TestAServedFactThatSaysASettingIsResolvedWithTheSettingInTheInput(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	register(t, open, catalogue.Manifest{Module: "step-ca", Version: "1",
-		Provides: []catalogue.Offer{{Name: "acme-ca", Scope: catalogue.ScopeMesh}},
-		Serves:   map[string]map[string]any{"acme-ca": {"domain": "${setting:domain}"}}})
-	register(t, open, catalogue.Manifest{Module: "route-proxy", Version: "1", Requires: []string{"acme-ca"}})
-	// The setting is there before the machines are assigned: an assignment resolves the mesh, and a served fact that says
-	// ${setting:domain} resolves only with it.
-	if err := open.inventory.KeepSettings(ctx, "", "step-ca", map[string]any{"domain": "example.test"}); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := assign(ctx, open, "anchor", "step-ca"); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := assign(ctx, open, "laptop", "route-proxy"); err != nil {
-		t.Fatal(err)
-	}
-	in, err := readComposeInput(ctx, open)
-	if err != nil {
-		t.Fatalf("the Input cannot be built: %v", err)
-	}
-	if anchor, _ := nodeOf(in.Input, "anchor"); len(anchor.Settings["step-ca"]) == 0 {
-		t.Fatalf("the Input does not carry the setting of the provider: %v", anchor.Settings)
-	}
-	oldPlan, _, err := resolveNode(ctx, open, "laptop")
-	if err != nil {
-		t.Fatal(err)
-	}
-	newPlan, _, err := resolveNode(withInputCache(ctx), open, "laptop")
-	if err != nil {
-		t.Fatalf("the consumer does not resolve: %v", err)
-	}
-	if !reflect.DeepEqual(oldPlan.Needs, newPlan.Needs) {
-		t.Errorf("the consumer's needs are %+v, the controller's own %+v", newPlan.Needs, oldPlan.Needs)
-	}
-	t.Logf("a served fact that says a setting resolves with the setting in the Input: the Input builds and the consumer's needs equal planFor's")
-}
-
-// A setting that nothing sets, in a fact a provider serves, is not the adapter's to hide: the controller's own composition
-// refuses it as well (theRestOfTheMesh returns servedOnNode's error), and the adapter refuses with the same words rather than
-// building an Input that composes a placeholder.
-func TestAServedFactThatSaysAnUnsetSettingIsRefusedAsTheControllerRefusesIt(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	register(t, open, catalogue.Manifest{Module: "step-ca", Version: "1",
-		Provides: []catalogue.Offer{{Name: "acme-ca", Scope: catalogue.ScopeMesh}},
-		Serves:   map[string]map[string]any{"acme-ca": {"domain": "${setting:domain}"}}})
-	register(t, open, catalogue.Manifest{Module: "route-proxy", Version: "1", Requires: []string{"acme-ca"}})
-	// Assigned with the setting there, then the setting is cleared: the mesh the controller holds when someone clears it.
-	if err := open.inventory.KeepSettings(ctx, "", "step-ca", map[string]any{"domain": "example.test"}); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := assign(ctx, open, "anchor", "step-ca"); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := assign(ctx, open, "laptop", "route-proxy"); err != nil {
-		t.Fatal(err)
-	}
-	if err := open.inventory.ClearSettings(ctx, "", "step-ca"); err != nil {
-		t.Fatal(err)
-	}
-	_, _, oldErr := resolveNode(ctx, open, "laptop")
-	_, newErr := readComposeInput(ctx, open)
-	if (oldErr == nil) != (newErr == nil) {
-		t.Fatalf("the controller's composition says %v, the adapter says %v", oldErr, newErr)
-	}
-	if oldErr != nil && !strings.Contains(newErr.Error(), "nothing sets \"domain\"") {
-		t.Errorf("the adapter's words are %q, the controller's %q", newErr, oldErr)
-	}
-	t.Logf("an unset setting in a served fact is refused alike: the controller says %v, the adapter says %v", oldErr != nil, newErr != nil)
-}

cmd/mesh-controller/compose_input_settings_integration_test.go

@@ -1,45 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"context"
-	"testing"
-)
-
-// Issue 1493: a module in the config form whose value is set only in mesh-config, with no settings row, reaches the
-// node's settings in the composition's input.
-func TestAConfigModuleWithoutASettingsRowIsReadFromConfig(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	inv := open.inventory
-	register(t, open, configForm(t, "brother"))
-	if _, err := assign(ctx, open, "anchor", "brother"); err != nil {
-		t.Fatal(err)
-	}
-	inv.ExecForTest(t, `insert into config_move (moved_by, why) values ('a test', 'issue 1493')`)
-	inv.ReadsConfigFrom(func(_ context.Context, node, module string) (map[string]any, error) {
-		if node == "anchor" && module == "brother" {
-			return map[string]any{"level": "debug"}, nil
-		}
-		return nil, nil
-	})
-	in, _, err := readMeshAndNodes(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := readSettings(ctx, open, &in); err != nil {
-		t.Fatal(err)
-	}
-	for _, n := range in.Nodes {
-		if n.Name != "anchor" {
-			continue
-		}
-		layers := n.Settings["brother"]
-		if len(layers) != 1 || layers[0].Values["level"] != "debug" {
-			t.Fatalf("anchor's settings for brother are %+v, want level debug from mesh-config", layers)
-		}
-		return
-	}
-	t.Fatal("no anchor node in the input")
-}

cmd/mesh-controller/compose_input_settings_test.go

@@ -1,45 +0,0 @@
-package main
-
-import (
-	"errors"
-	"reflect"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-)
-
-// configForm is a module in the config form, shaped as a real one (inventory's config_move_test).
-func configForm(t *testing.T, name string) catalogue.Manifest {
-	t.Helper()
-	m, err := catalogue.ParseManifest([]byte(`{"module": "` + name + `", "version": "1",
-		"config": {"level": {"type": "string", "description": "how much it says", "default": "info"}},
-		"resources": [{"id": "conf", "type": "file", "path": "/etc/` + name + `.json", "mode": "0640",
-			"content": "{\"level\": \"info\"}", "merge": "json", "takes-config": ["level"]}]}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	return m
-}
-
-// Issue 1493: a module in the config form whose values are set only in mesh-config has no settings row, and its
-// settings are still read, because SettingsFor is where mesh-config's values are laid in.
-func TestSettingsAreReadForAConfigModuleWithoutASettingsRow(t *testing.T) {
-	shelf := map[string]catalogue.Manifest{
-		"brother": configForm(t, "brother"),        // config only in mesh-config: no settings row
-		"older":   {Module: "older", Version: "1"}, // settings form, with a row
-		"idle":    {Module: "idle", Version: "1"},  // settings form, no row: nothing to read
-		"newer":   configForm(t, "newer"),          // config form, but the switch is off for it
-	}
-	have := map[string]bool{"older": true, "gone": true} // "gone" has a row and is not on the shelf
-	reads := func(module string) (bool, error) { return module == "brother", nil }
-	got, err := modulesToRead(shelf, have, reads)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if want := []string{"brother", "older"}; !reflect.DeepEqual(got, want) {
-		t.Errorf("settings are read for %v, want %v", got, want)
-	}
-	if _, err := modulesToRead(shelf, have, func(string) (bool, error) { return false, errors.New("store down") }); err == nil {
-		t.Error("a failing ReadsConfig is not returned")
-	}
-}

cmd/mesh-controller/compose_made_integration_test.go

@@ -1,54 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"context"
-	"fmt"
-	"sort"
-)
-
-// made is what a send made in a store, by key and never by value: the machine ports given, the pair credentials and the
-// own secrets.
-type made struct {
-	Ports      []string
-	Pairs      []string
-	OwnSecrets []string
-}
-
-// madeIn is what a store holds that a send makes, by key and never by value.
-func madeIn(ctx context.Context, open *stores) (made, error) {
-	var out made
-	inv := open.inventory
-	nodes, err := inv.Nodes(ctx)
-	if err != nil {
-		return out, err
-	}
-	for _, n := range nodes {
-		ports, err := inv.PortsFor(ctx, n.Name)
-		if err != nil {
-			return out, err
-		}
-		for _, p := range ports {
-			out.Ports = append(out.Ports, fmt.Sprintf("%s %s:%d->%d", n.Name, p.Module, p.Wanted, p.Machine))
-		}
-		rows, err := inv.SecretsFrom(ctx, n.Name)
-		if err != nil {
-			return out, err
-		}
-		for _, s := range rows {
-			out.Pairs = append(out.Pairs, fmt.Sprintf("%s %s on %s from %s local=%s", s.Name, s.ConsumerModule, s.Consumer, n.Name, s.Local))
-		}
-	}
-	own, err := inv.OwnSecretRows(ctx)
-	if err != nil {
-		return out, err
-	}
-	for _, r := range own {
-		out.OwnSecrets = append(out.OwnSecrets, fmt.Sprintf("%s %s/%s (%s)", r.Node, r.Module, r.Name, r.Origin))
-	}
-	sort.Strings(out.Ports)
-	sort.Strings(out.Pairs)
-	sort.Strings(out.OwnSecrets)
-	return out, nil
-}

cmd/mesh-controller/compose_once_integration_test.go

@@ -1,44 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/compose"
-)
-
-// 1382/AC5: composing every node of one operation builds the Input once; without an operation's cache, once for each.
-func TestComposingEveryNodeOfAnOperationBuildsTheInputOnce(t *testing.T) {
-	open, _ := aMeshWithSecrets(t)
-	built := 0
-	was := composeInputBuilt
-	composeInputBuilt = func() { built++ }
-	t.Cleanup(func() { composeInputBuilt = was })
-	ctx := withInputCache(t.Context())
-	nodes, err := open.inventory.Nodes(ctx)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, n := range nodes {
-		if _, _, err := resolveNode(ctx, open, n.Name); err != nil && !unresolvable(err) {
-			t.Fatal(err)
-		}
-		if _, _, err := composeQuestion(ctx, open, n.Name, compose.Reading, false); err != nil && !unresolvable(err) {
-			t.Fatal(err)
-		}
-	}
-	if _, err := generatorsOf(ctx, open); err != nil {
-		t.Fatal(err)
-	}
-	if built != 1 {
-		t.Fatalf("an operation over %d node(s) built the Input %d time(s)", len(nodes), built)
-	}
-	built = 0
-	if _, _, err := resolveNode(t.Context(), open, nodes[0].Name); err != nil && !unresolvable(err) {
-		t.Fatal(err)
-	}
-	if built != 1 {
-		t.Fatalf("a composition with no cache built the Input %d time(s)", built)
-	}
-}

cmd/mesh-controller/compose_perform.go

@@ -1,265 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"os"
-	"slices"
-	"sort"
-	"strconv"
-	"strings"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/compose"
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// perform makes what a composition named foreseen (novox/hq ADR 0453 clause 3, design 47 R4b, issue 1385).
-//
-// **The composition makes nothing; a send does.** mesh-sdk's composition over an Input names what the next send would make
-// (the ports it would assign, the credentials it would seal, the core boxes it would ask the vault for, the seats it would
-// pass on, the certificate it would issue) and stands in for each. A send composes, performs, reads the stores again and
-// composes again (send in compose_sdk.go), and refuses to send a declaration that still names anything foreseen. A question
-// (status, facts, probes, the merge gate's reading) never reaches this file.
-//
-// What is made is exactly what the controller's own composition made on the way to a declaration it was going to send:
-//   - every pair credential no row holds, for every machine that resolves, since planning one node resolved them all;
-//   - the seats the mesh passes on, with the hand act (not on a throwaway mesh, whose hand act has nowhere to go);
-//   - the machine ports the node's modules were given none for;
-//   - the node's own secrets, by the controller's own rules (a bus credential nobody issued was refused by the composition);
-//   - the core credentials, asked of the vault every send, so a rotated one reaches the machine;
-//   - the certificate of a machine that was never certified.
-//
-// perform returns whether it made or recorded anything: the reason the caller reads the stores again.
-func perform(ctx context.Context, open *stores, in *meshInput, node string, d compose.Declared) (bool, error) {
-	did := false
-	inv := open.inventory
-
-	// The seats passed on: recorded in the store with the controller's own hand act (ADR 0449 §4, issue 1317).
-	if len(d.Passes.Passes) > 0 {
-		var w io.Writer = os.Stderr
-		if lw, ok := ctx.Value(leftOutKey{}).(io.Writer); ok {
-			w = lw
-		}
-		for _, line := range d.Passes.Said {
-			fmt.Fprintln(w, line)
-		}
-		if performSeatPasses(ctx, seatPassingOn(inv, w), d.Passes.Passes) {
-			did = true
-		}
-	}
-
-	// Every pair credential the stores hold none for: made once and kept, and sealed to both ends before it was ever written
-	// down. The error is the one planFor met: the machine that needs it, and why none could be made.
-	for _, p := range in.wouldMake {
-		if err := makePair(ctx, inv, p); err != nil {
-			return did, fmt.Errorf("%s on %s needs %s from %s and no credential could be made for it: %w",
-				p.ConsumerModule, p.Consumer, p.Name, p.Provider, err)
-		}
-		did = true
-	}
-
-	// The ports this node's modules were given none for.
-	if len(d.ForeseenPorts) > 0 {
-		shelf, err := inv.Catalogue(ctx)
-		if err != nil {
-			return did, err
-		}
-		for _, one := range d.ForeseenPorts {
-			module, port, ok := strings.Cut(one, ":")
-			wanted, perr := strconv.Atoi(port)
-			if !ok || perr != nil {
-				return did, fmt.Errorf("the composition named a port the controller cannot read: %q", one)
-			}
-			fixed := false
-			for _, l := range nodeShelf(in, shelf, node)[module].Listens {
-				if l.Port == wanted {
-					fixed = l.Fixed
-				}
-			}
-			if _, err := inv.PortFor(ctx, node, module, wanted, fixed); err != nil {
-				return did, fmt.Errorf("%s needs %d reachable on %s and it could not be assigned: %w", module, wanted, node, err)
-			}
-			did = true
-		}
-	}
-
-	// The node's own secrets: a module's superuser password, an administrator, an account. The composition refused what the
-	// send refuses (a bus credential nobody issued, a given value under an old key).
-	for _, one := range d.StoodIn {
-		module, name, ok := strings.Cut(one, "/")
-		if !ok || strings.Contains(one, " ") {
-			continue // a grant's sealed copy, the certificate or the bus's list: made below or by nobody
-		}
-		if _, err := inv.SecretForModule(ctx, node, module, name); err != nil {
-			return did, err
-		}
-		did = true
-	}
-
-	// The certificate of a machine that was never certified: issued and kept, with the authority when there is none yet.
-	for _, one := range d.StoodIn {
-		if strings.HasPrefix(one, "the certificate and the authority of ") {
-			if _, _, err := certificateFor(ctx, open, node); err != nil {
-				return did, err
-			}
-			did = true
-			break
-		}
-	}
-	return did, nil
-}
-
-// makePair makes one pair credential by the controller's own read of it: the credential for the pair, or the provider's one
-// credential sealed to this consumer too. A credential only a person gives is never made (it is not a would-make).
-func makePair(ctx context.Context, inv *inventory.Inventory, p inventory.PairCredential) error {
-	var err error
-	switch p.Kind {
-	case inventory.PairShared:
-		_, err = inv.SharedSecretFor(ctx, p.Name, p.Consumer, p.ConsumerModule, p.Provider, p.ProviderModule, p.Local, p.Own)
-	case inventory.PairPlain:
-		_, err = inv.SecretFor(ctx, p.Name, p.Consumer, p.ConsumerModule, p.Provider, p.Local)
-	default:
-		return errors.New("a credential only a person gives is not made")
-	}
-	if inventory.IsNotGiven(err) {
-		return nil
-	}
-	return err
-}
-
-// stillForeseen says what a composed declaration still stands in for: the lists the composition names, and the stand-in itself
-// anywhere in the body (a pair credential's stand-in is not in any list). A declaration that has any is never sent.
-func stillForeseen(d compose.Declared) []string {
-	var left []string
-	left = append(left, d.Foreseen...)
-	left = append(left, d.StoodIn...)
-	for _, p := range d.ForeseenPorts {
-		left = append(left, "the port "+p)
-	}
-	for _, c := range d.CoreBoxesWanted {
-		left = append(left, "the vault's box for "+c.Module+"/"+c.Name)
-	}
-	for _, p := range d.Passes.Passes {
-		left = append(left, "the pass of "+p.Seat.Name+" to "+p.To.Module+" on "+p.To.Node)
-	}
-	if body, err := d.Body(); err == nil {
-		for _, marker := range []string{catalogue.ForeseenSealed, "asked of the vault by the next send", compose.ForeseenCertificate,
-			compose.ForeseenBusUsers} {
-			if strings.Contains(string(body), marker) {
-				left = append(left, "a stand-in: "+marker)
-			}
-		}
-	}
-	sort.Strings(left)
-	return slicesCompact(left)
-}
-
-func slicesCompact(in []string) []string {
-	var out []string
-	for _, s := range in {
-		if len(out) == 0 || out[len(out)-1] != s {
-			out = append(out, s)
-		}
-	}
-	return out
-}
-
-// nodeShelf is the shelf as one node composes its own set: the current one with each module it keeps at the build it runs put
-// in place of the current.
-func nodeShelf(in *meshInput, shelf map[string]catalogue.Manifest, node string) map[string]catalogue.Manifest {
-	n, _ := nodeOf(in.Input, node)
-	return shelfWith(shelf, n.Kept)
-}
-
-// prepareSend is what a send does before it composes, every send and whatever the composition would have named: the
-// controller's own composition did it on the way, so a module's file that names an own secret composes (mesh-sdk's
-// composition can stand in for none: a file naming a secret not made yet is refused in every mode), and the core's credentials
-// are asked of the vault on every send, so a rotated one reaches the machine and a silent vault is said (core_box.go).
-//
-//   - Each own secret of a module the node runs (not one handed to the provisioner, not one issued outside the mesh, not one a
-//     person gives) that no row holds is made, unless the composition would refuse it (a bus credential nobody issued): that
-//     refusal is the composition's to say, in its words.
-//   - The core's credentials are asked of the vault, the boxes newly answered are kept, and the modules the vault did not answer
-//     for with no box kept are returned: the controller seals those itself until the vault holds them (ADR 0396).
-func prepareSend(ctx context.Context, open *stores, node string) ([]string, error) {
-	in, err := inputFor(ctx, open)
-	if err != nil {
-		return nil, err
-	}
-	if in.refused[node] != nil {
-		return nil, nil // empty-on-error: refused alone for what it keeps; the composition that follows says so, in its words
-	}
-	resolved, err := compose.Resolve(in.Input, node)
-	if err != nil {
-		return nil, nil // empty-on-error: it does not compose for its own reasons; the composition that follows says them
-	}
-	n, _ := nodeOf(in.Input, node)
-	hands := n.Stated && n.Contract >= compose.HandedContract
-	handing := catalogue.Rendering{Hands: hands, Provisioner: provisionerAccount(resolved.Plan)}
-	inv := open.inventory
-	did := false
-	if n.SealingKey != "" {
-		held := map[string]bool{}
-		for _, r := range in.OwnSecrets {
-			// Held only when sealed to the key the machine has now, or given by a person (which is not the mesh's
-			// to make again): a made row under an old key is re-made, as SecretForModule did.
-			if r.Node == node && (r.SealedTo == n.SealingKey || r.Origin == inventory.OriginAccepted) {
-				held[r.Module+"/"+r.Name] = true
-			}
-		}
-		for _, m := range resolved.Plan.Modules {
-			if handing.Handing(m) {
-				continue
-			}
-			plain := m.OwnSecrets.Plain()
-			names := make([]string, 0, len(plain))
-			for name := range plain {
-				names = append(names, name)
-			}
-			sort.Strings(names)
-			for _, name := range names {
-				if plain[name].IssuedBy == catalogue.IssuedOutside || held[m.Module+"/"+name] {
-					continue
-				}
-				switch name {
-				case "broker":
-					if !slices.Contains(in.BusMinted, node+"."+m.Module) {
-						continue
-					}
-				case compose.ProvisionerSecret:
-					if !slices.Contains(in.BusMinted, "provisioner."+node) {
-						continue
-					}
-				default:
-					// A bus process's account nobody issued still gets the stand-in, until the composition leaves
-					// the module off (issue 1753): the warning names the verb (issue 1226).
-					if line := processAccountWarning(m, node, name, in.BusMinted); line != "" {
-						sayWarning(ctx, line)
-					}
-				}
-				if _, err := inv.SecretForModule(ctx, node, m.Module, name); err == nil {
-					did = true
-				}
-			}
-		}
-	}
-	var byController []string
-	if n.Stated && n.Contract >= compose.VaultBoxContract {
-		boxes, err := coreBoxesFor(ctx, inv, node, resolved.Plan.Modules, func(m catalogue.Manifest) bool {
-			return handing.Handing(m)
-		}, true)
-		if err != nil {
-			return nil, err
-		}
-		did = did || len(boxes.keep) > 0
-		byController = boxes.byController
-	}
-	if did {
-		// What was made is in the stores now: the composition reads them afresh.
-		forgetInput(ctx)
-	}
-	return byController, nil
-}

cmd/mesh-controller/compose_perform_integration_test.go

@@ -1,235 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"errors"
-	"fmt"
-	"strings"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/compose"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-func aWebModule() catalogue.Manifest {
-	return catalogue.Manifest{Module: "web", Version: "1",
-		Listens:    []catalogue.Listening{{Port: 8080, From: catalogue.FromEverywhere}},
-		OwnSecrets: catalogue.OwnSecrets{"admin": {Path: "/etc/web/admin"}},
-		Resources: []map[string]any{
-			{"id": "server", "type": "container", "name": "web", "ports": []any{"8080"},
-				"image": "registry.example/web@sha256:" + strings.Repeat("a", 64)},
-		}}
-}
-
-// 1385/AC1: a port the composition names foreseen is allocated with the inventory's PortFor for that module and port, a second
-// composition names it no more, and the number is the one the controller's own Allocating composition gives in the same store.
-func TestPerformAllocatesAForeseenPortAndTheNumberIsTheControllers(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	register(t, open, aWebModule())
-	if _, err := assign(ctx, open, "laptop", "web"); err != nil {
-		t.Fatal(err)
-	}
-	in, err := readComposeInput(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
-	d, _, err := compose.ComposeIn(in.Input, "laptop", compose.Foreseeing)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(d.ForeseenPorts) != 1 || d.ForeseenPorts[0] != "web:8080" {
-		t.Fatalf("the composition names the ports %v foreseen, want web:8080", d.ForeseenPorts)
-	}
-	did, err := perform(ctx, open, in, "laptop", d)
-	if err != nil || !did {
-		t.Fatalf("perform did %v: %v", did, err)
-	}
-	held, err := open.inventory.PortsFor(ctx, "laptop")
-	if err != nil || len(held) != 1 || held[0].Module != "web" || held[0].Wanted != 8080 {
-		t.Fatalf("the port perform allocated reads %+v: %v", held, err)
-	}
-	in, err = readComposeInput(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if again, _, err := compose.ComposeIn(in.Input, "laptop", compose.Foreseeing); err != nil || len(again.ForeseenPorts) != 0 {
-		t.Fatalf("a second composition names %v foreseen: %v", again.ForeseenPorts, err)
-	}
-	// The number is the one the controller allocates in the same store.
-	plan, settings, err := resolveNode(ctx, open, "laptop")
-	if err != nil {
-		t.Fatal(err)
-	}
-	old, err := declarationFor(ctx, open, "laptop", plan, settings)
-	if err != nil {
-		t.Fatal(err)
-	}
-	after, _, err := compose.ComposeIn(in.Input, "laptop", compose.Foreseeing)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got, want := portsOf(after.Resources), portsOf(old.Resources); got != want {
-		t.Fatalf("the declaration publishes %s; the controller's allocation publishes %s", got, want)
-	}
-}
-
-func portsOf(resources []map[string]any) string {
-	var out []string
-	for _, r := range resources {
-		if r["type"] == "container" {
-			out = append(out, fmt.Sprint(r["name"], r["ports"]))
-		}
-	}
-	return strings.Join(out, ";")
-}
-
-// 1385/AC2: an own secret named foreseen is made with SecretForModule, and a pair credential the Input names would-make is
-// made as planFor chose; both exist after the send's composition and a second composition names neither.
-func TestPerformMakesTheOwnSecretsAndThePairCredentialsTheCompositionNamed(t *testing.T) {
-	open, _ := aMeshWithSecrets(t)
-	ctx := t.Context()
-	inv := open.inventory
-	register(t, open, aWebModule())
-	register(t, open, aConsumerOfTheBucket("reports"))
-	for _, m := range []string{"web", "reports"} {
-		if _, err := assign(ctx, open, "laptop", m); err != nil {
-			t.Fatal(err)
-		}
-	}
-	before, err := madeIn(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
-	declared, err := composeSend(ctx, open, "laptop")
-	if err != nil {
-		t.Fatalf("the send is refused: %v", err)
-	}
-	if len(declared.foreseen) != 0 {
-		t.Fatalf("the declaration still names %v foreseen", declared.foreseen)
-	}
-	after, err := madeIn(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
-	madeNow := func(have, was []string) []string {
-		seen := map[string]bool{}
-		for _, s := range was {
-			seen[s] = true
-		}
-		var out []string
-		for _, s := range have {
-			if !seen[s] {
-				out = append(out, s)
-			}
-		}
-		return out
-	}
-	if got := madeNow(after.OwnSecrets, before.OwnSecrets); len(got) != 1 || !strings.Contains(got[0], "web/admin") {
-		t.Errorf("the own secrets made are %v, want laptop web/admin", got)
-	}
-	if got := madeNow(after.Pairs, before.Pairs); len(got) != 1 || !strings.Contains(got[0], "reports") {
-		t.Errorf("the pair credentials made are %v, want the one of reports", got)
-	}
-	// And the credential is the one a second composition reads as held.
-	in, err := readComposeInput(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(in.wouldMake) != 0 {
-		t.Errorf("after the send the next send would still make %v", in.wouldMake)
-	}
-	if _, err := inv.SecretsFrom(ctx, "anchor"); err != nil {
-		t.Fatal(err)
-	}
-}
-
-// 1385/AC3 (the lead's answer 1): with the vault unreachable and no box of the credential kept, the send carries the
-// controller's own seal for it (ADR 0396), says so as a condition, and keeps no box.
-func TestAVaultThatIsSilentSealsTheSendByTheControllerWhereNoBoxIsKept(t *testing.T) {
-	open, vault := aCoreMesh(t, link.VaultBoxContract)
-	vault.silent = errors.New("no responders")
-	declared, err := composeSend(t.Context(), open, "laptop")
-	if err != nil {
-		t.Fatalf("the send is refused: %v", err)
-	}
-	f := clientsBroker(declared.Resources)
-	if f == nil || f["sealed"] == nil || f[catalogue.VaultSealedField] != nil {
-		t.Fatalf("the core credential is composed as %v: the controller's own seal, until the vault holds it", f)
-	}
-	if len(declared.foreseen) != 0 {
-		t.Fatalf("the declaration still names %v foreseen", declared.foreseen)
-	}
-	if c, found := vaultSilence(t, "laptop"); !found || !strings.Contains(c.Summary, "sealed by the controller until the vault holds it") {
-		t.Fatalf("no condition says why: %+v", c)
-	}
-	kept, err := open.inventory.KeptCoreBoxes(t.Context(), "laptop")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(kept["mesh-provisioner-client"]) != 0 {
-		t.Fatalf("a box was kept for a credential the vault never boxed: %v", kept)
-	}
-}
-
-// 1385/AC6: perform is idempotent: a second send's composition over the stores it left makes and records nothing.
-func TestAFinishedSendMakesNothingTheSecondTime(t *testing.T) {
-	open, _ := aMeshWithSecrets(t)
-	ctx := t.Context()
-	register(t, open, aWebModule())
-	if _, err := assign(ctx, open, "laptop", "web"); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := composeSend(ctx, open, "laptop"); err != nil {
-		t.Fatal(err)
-	}
-	before := tableState(t, open.inventory)
-	if _, err := composeSend(ctx, open, "laptop"); err != nil {
-		t.Fatal(err)
-	}
-	for k, v := range tableState(t, open.inventory) {
-		if before[k] != v {
-			t.Errorf("a second send of the same machine moved %s", k)
-		}
-	}
-}
-
-// Review round 1, finding 1: a machine that rejoined with a new sealing key keeps its made rows sealed to the old key. A
-// send re-makes them for the new key, as SecretForModule did on main, and the file naming the secret is not refused.
-func TestASendReMakesAnOwnSecretSealedToAKeyTheMachineNoLongerHas(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	inv := open.inventory
-	register(t, open, aBot("bot", false))
-	if _, err := assign(ctx, open, "laptop", "bot"); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := composeSend(ctx, open, "laptop"); err != nil {
-		t.Fatalf("the first send is refused: %v", err)
-	}
-	if err := inv.RecordSealingKey(ctx, nodeID(t, open, "laptop"), aPublicKey(t)); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := composeSend(ctx, open, "laptop"); err != nil {
-		t.Fatalf("a machine that rejoined cannot be sent to: %v", err)
-	}
-	in, err := readComposeInput(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
-	n, _ := nodeOf(in.Input, "laptop")
-	found := false
-	for _, r := range in.OwnSecrets {
-		if r.Node == "laptop" && r.Module == "bot" && r.Name == "token" {
-			found = true
-			if r.SealedTo != n.SealingKey {
-				t.Fatalf("the own secret is still sealed to a key the machine no longer has")
-			}
-		}
-	}
-	if !found {
-		t.Fatal("the own secret has no row")
-	}
-}

cmd/mesh-controller/compose_sdk.go

@@ -1,499 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"fmt"
-	"io"
-	"os"
-	"slices"
-	"sort"
-	"strings"
-	"sync"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/compose"
-	"git.novox.be/novox/mesh-sdk/go/validate"
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// The controller's composition on mesh-sdk's (novox/hq ADR 0453 clause 3, design 47 R4b, issues 1386 to 1388): every
-// caller that planned or composed a node reads the Input once for its operation (compose_input.go), asks the SDK to
-// compose over it, and, when it sends, performs what the composition names foreseen (compose_perform.go) and composes again.
-
-// inputCacheKey carries an operation's Input in its context, so the planning of every node of one verb reads the stores once.
-type inputCacheKey struct{}
-
-type inputCache struct {
-	mu sync.Mutex
-	by map[string]*meshInput
-}
-
-// withInputCache is ctx for an operation: the Input read for it is kept until a send changes what it read. A context that
-// carries none reads the stores for each composition, which is correct and slow.
-func withInputCache(ctx context.Context) context.Context {
-	if _, ok := ctx.Value(inputCacheKey{}).(*inputCache); ok {
-		return ctx
-	}
-	return context.WithValue(ctx, inputCacheKey{}, &inputCache{by: map[string]*meshInput{}})
-}
-
-// keptSignature is what the Input read depends on in ctx: which recorded modules each machine keeps at the build it runs
-// (recorded_kept.go), so an Input read for a person's push is never taken for one read for a gated send.
-func keptSignature(ctx context.Context) string {
-	return ""
-}
-
-// inputFor is the Input for ctx's operation.
-func inputFor(ctx context.Context, open *stores) (*meshInput, error) {
-	cache, ok := ctx.Value(inputCacheKey{}).(*inputCache)
-	if !ok {
-		return readComposeInput(ctx, open)
-	}
-	sig := keptSignature(ctx)
-	cache.mu.Lock()
-	defer cache.mu.Unlock()
-	if in := cache.by[sig]; in != nil {
-		return in, nil
-	}
-	in, err := readComposeInput(ctx, open)
-	if err != nil {
-		return nil, err
-	}
-	cache.by[sig] = in
-	return in, nil
-}
-
-// forgetInput drops what the operation read, because a send made or recorded something it read.
-func forgetInput(ctx context.Context) {
-	if cache, ok := ctx.Value(inputCacheKey{}).(*inputCache); ok {
-		cache.mu.Lock()
-		cache.by = map[string]*meshInput{}
-		cache.mu.Unlock()
-	}
-}
-
-// resolveNode works out everything a node should run, from what was assigned to it (planFor on the SDK): over the Input,
-// writing nothing. A failure to compose the node's own modules is marked notResolvable, as planFor marked it; every other
-// failure is returned as it is.
-func resolveNode(ctx context.Context, open *stores, node string) (catalogue.Resolution, catalogue.SettingsBy, error) {
-	in, err := inputFor(ctx, open)
-	if err != nil {
-		return catalogue.Resolution{}, nil, err
-	}
-	if err := in.refused[node]; err != nil {
-		return catalogue.Resolution{}, nil, err
-	}
-	resolved, err := compose.Resolve(in.Input, node)
-	if err != nil {
-		if compose.IsUnresolvable(err) {
-			return catalogue.Resolution{}, nil, notResolvable{err}
-		}
-		return catalogue.Resolution{}, nil, err
-	}
-	logUnheld(node, resolved.Plan.Unheld)
-	return resolved.Plan, resolved.Settings, nil
-}
-
-// generatorsOf is what every node's declaration is composed with, over the whole mesh (generators on the SDK).
-func generatorsOf(ctx context.Context, open *stores) (map[string]catalogue.Generator, error) {
-	in, err := inputFor(ctx, open)
-	if err != nil {
-		return nil, err
-	}
-	return compose.Generators(in.Input)
-}
-
-// renderingOf is what a machine is rendered with as a question reads it (nothing made), with the private network: what the
-// filter's rules, the roster and the like are derived from.
-func renderingOf(ctx context.Context, open *stores, node string) (catalogue.Rendering, error) {
-	in, err := inputFor(ctx, open)
-	if err != nil {
-		return catalogue.Rendering{}, err
-	}
-	rendered, err := compose.Render(in.Input, node, compose.Reading)
-	if err != nil {
-		return catalogue.Rendering{}, markUnresolvable(err)
-	}
-	with := rendered.Rendering
-	if with.Generators, err = compose.Generators(in.Input); err != nil {
-		return catalogue.Rendering{}, err
-	}
-	return with, nil
-}
-
-// whoResolvesOn is the machines whose resolution answers a requirement, and why the others did not (whoResolves over the
-// Input): by what a module provides, not by its name. A machine whose set does not compose is in refused, said; one the mesh
-// could not be asked about is an error, never a refusal (novox/hq 04-ISSUES/152).
-func whoResolvesOn(ctx context.Context, open *stores, requirement string) (map[string]bool, map[string]string, error) {
-	in, err := inputFor(ctx, open)
-	if err != nil {
-		return nil, nil, err
-	}
-	on := map[string]bool{}
-	refused := map[string]string{}
-	for _, n := range in.sortedNodes() {
-		if err := in.refused[n.Name]; err != nil {
-			return nil, nil, fmt.Errorf("whether %s answers %q cannot be read: %w", n.Name, requirement, err)
-		}
-		resolved, err := compose.Resolve(in.Input, n.Name)
-		switch {
-		case compose.IsUnresolvable(err):
-			refused[n.Name] = err.Error()
-			continue
-		case err != nil:
-			return nil, nil, fmt.Errorf("whether %s answers %q cannot be read: %w", n.Name, requirement, err)
-		}
-		for _, m := range resolved.Plan.Modules {
-			for _, offered := range m.Offers() {
-				if offered == requirement {
-					on[n.Name] = true
-				}
-			}
-		}
-	}
-	return on, refused, nil
-}
-
-// sortedNodes is the Input's nodes by name, the order the controller reads them in.
-func (in *meshInput) sortedNodes() []compose.Node {
-	out := append([]compose.Node(nil), in.Nodes...)
-	sort.Slice(out, func(i, j int) bool { return out[i].Name < out[j].Name })
-	return out
-}
-
-// composeQuestion composes a node's declaration as a question asks it: nothing is made, and what a send would make is a
-// stand-in (Foreseeing) or left out (Reading). It also answers what the node-engine's validator refuses of it. The lines the
-// composition found are said where the controller says its own (standard error, or the writer an act gave).
-//
-// withOrder says the declaration carries the order it was last sent under (composedAndValidated's, which a comparison with the
-// last send needs); without it the order is none, as declarationWith left it for the sender to stamp.
-func composeQuestion(ctx context.Context, open *stores, node string, mode compose.Mode, withOrder bool) (sendable, []string, error) {
-	in, err := inputFor(ctx, open)
-	if err != nil {
-		return sendable{}, nil, err
-	}
-	if err := in.refused[node]; err != nil {
-		return sendable{}, nil, err
-	}
-	d, problems, err := compose.ComposeIn(in.Input, node, mode)
-	if err != nil {
-		return sendable{}, nil, markUnresolvable(err)
-	}
-	if err := refusedBus(in, node); err != nil {
-		return sendable{}, nil, err
-	}
-	sayFound(ctx, d)
-	out := sendableOf(d)
-	out.fileReferences = readsFileReferences(in.Input, node)
-	if !withOrder {
-		out.Sequence, out.Epoch, out.Generation = 0, 0, 0
-	}
-	return out, problems, nil
-}
-
-// refusedBus is why the node cannot be composed because it runs the bus and the bus's user list cannot be: no user has a
-// credential, so the list would refuse every connection in the mesh (busUserList). The controller's own composition refused that
-// machine with those words; no other machine is refused for it. nil when nothing refuses the node.
-func refusedBus(in *meshInput, node string) error {
-	if in.busRefused == nil {
-		return nil
-	}
-	resolved, err := compose.Resolve(in.Input, node)
-	if err != nil {
-		return nil // it does not compose for its own reasons, which are said
-	}
-	for _, m := range resolved.Plan.Modules {
-		if m.BusUsers != "" && m.ClaimsSeat("mesh-broker") {
-			return in.busRefused
-		}
-	}
-	return nil
-}
-
-// markUnresolvable is an error of a node whose own set does not compose, as planFor marked it.
-func markUnresolvable(err error) error {
-	if compose.IsUnresolvable(err) {
-		return notResolvable{err}
-	}
-	return err
-}
-
-// composeSend composes a node's declaration to send it, as the Allocating composition did: composed over what is read,
-// then what it named foreseen is made (perform), the stores are read again and it is composed again. A declaration that
-// still names anything foreseen is refused, said, and never sent.
-func composeSend(ctx context.Context, open *stores, node string) (sendable, error) {
-	declared, _, err := composeSendValidated(ctx, open, node)
-	if err != nil {
-		return declared, err
-	}
-	// Never a declaration naming an image the store does not hold (novox/hq issue 1742): that module is left out.
-	return withoutMissingImages(ctx, open, node, declared), nil
-}
-
-// composeSendValidated is composeSend and what the node-engine's validator refuses of the declaration it composed, for the
-// merge gate's two passes (composedAndValidated in its Allocating mode).
-func composeSendValidated(ctx context.Context, open *stores, node string) (sendable, []string, error) {
-	// The core modules whose credentials the controller sealed itself because the vault was silent and no box was kept
-	// (ADR 0396): the composition stands in a vault box for each, and a send carries the controller's own seal instead.
-	byController, err := prepareSend(ctx, open, node)
-	if err != nil {
-		return sendable{}, nil, err
-	}
-	for attempt := 0; ; attempt++ {
-		in, err := inputFor(ctx, open)
-		if err != nil {
-			return sendable{}, nil, err
-		}
-		if err := in.refused[node]; err != nil {
-			return sendable{}, nil, err
-		}
-		d, problems, err := compose.ComposeIn(in.Input, node, compose.Foreseeing)
-		if err != nil {
-			return sendable{}, nil, markUnresolvable(err)
-		}
-		if err := refusedBus(in, node); err != nil {
-			return sendable{}, nil, err
-		}
-		if len(byController) > 0 {
-			if d, problems, err = sealedByTheController(in, node, d, byController); err != nil {
-				return sendable{}, nil, err
-			}
-		}
-		left := stillForeseen(d)
-		resolved, rerr := compose.Resolve(in.Input, node)
-		if rerr != nil {
-			return sendable{}, nil, markUnresolvable(rerr)
-		}
-		if len(resolved.Foreseen) > 0 {
-			left = append(left, resolved.Foreseen...)
-		}
-		if len(left) == 0 && len(in.wouldMake) == 0 {
-			sayFound(ctx, d)
-			out := sendableOf(d)
-			out.fileReferences = readsFileReferences(in.Input, node)
-			// The sender stamps the order it allots (order.stamp); a composition for a send carries none of its own.
-			out.Sequence, out.Epoch, out.Generation = 0, 0, 0
-			here, _ := nodeOf(in.Input, node)
-			out.Builds = buildsOf(in.Input, here, resolved.Plan, d.LeftOutWhy)
-			out.Bindings = boundToData(resolved.Plan, d.LeftOutWhy)
-			if len(d.Filled) > 0 {
-				if out.plans, err = handedPlans(in, node, resolved); err != nil {
-					return sendable{}, nil, err
-				}
-			}
-			return out, problems, nil
-		}
-		if attempt > 0 {
-			return sendable{}, nil, fmt.Errorf("%s was composed twice and still names what only a send makes (%s): nothing is sent "+
-				"that stands in for a value", node, strings.Join(left, "; "))
-		}
-		if _, err := perform(ctx, open, in, node, d); err != nil {
-			return sendable{}, nil, err
-		}
-		// What was made is in the stores now: the next read is a fresh one.
-		forgetInput(ctx)
-	}
-}
-
-// restOfTheMesh is what every other machine holds and offers (theRestOfTheMesh over the Input), for a question: the lines it
-// finds are said where the controller says its own, and a seat it would pass on is passed by the next send (perform), not by
-// the question. shelf, when given, replaces the Input's catalogue: a caller composing a change's shelf.
-func restOfTheMesh(ctx context.Context, open *stores, shelf map[string]catalogue.Manifest, exclude string) (catalogue.World, error) {
-	in, err := inputFor(ctx, open)
-	if err != nil {
-		return catalogue.World{}, err
-	}
-	input := in.Input
-	if shelf != nil {
-		input.Catalogue = shelf
-	}
-	world, passes, left, err := compose.TheRestOfTheMesh(input, exclude)
-	if err != nil {
-		return catalogue.World{}, err
-	}
-	var w io.Writer = os.Stderr
-	if lw, ok := ctx.Value(leftOutKey{}).(io.Writer); ok {
-		w = lw
-	}
-	for _, l := range left {
-		fmt.Fprintln(w, l.String())
-	}
-	for _, line := range passes.Said {
-		fmt.Fprintln(w, line)
-	}
-	return world, nil
-}
-
-// restOfTheMeshOf is restOfTheMesh for a caller that holds the inventory alone: on the serving controller's stores where it
-// lends them (sharedStores), never a pool per call; elsewhere (a verb run as its own process) the other stores the Input
-// reads are opened for the call and let go of again.
-func restOfTheMeshOf(ctx context.Context, inv *inventory.Inventory, shelf map[string]catalogue.Manifest, exclude string) (catalogue.World, error) {
-	if shared, ok := sharedStoresOf(inv); ok {
-		return restOfTheMeshOn(ctx, shared, shelf, exclude)
-	}
-	open := &stores{inventory: inv}
-	defer func() {
-		if open.licences != nil {
-			open.licences.Close()
-		}
-		if open.identity != nil {
-			open.identity.Close()
-		}
-	}()
-	return restOfTheMeshOn(ctx, open, shelf, exclude)
-}
-
-// restOfTheMeshOn is restOfTheMesh; a variable so a test reads which stores it is handed.
-var restOfTheMeshOn = restOfTheMesh
-
-// sayFound says the lines a composition found while composing, once each: a machine left out of the rest of the mesh, a seat
-// that two claimants could take, the bus's users left out for want of a credential.
-func sayFound(ctx context.Context, d compose.Declared) {
-	if len(d.Said) == 0 {
-		return
-	}
-	var w io.Writer = os.Stderr
-	if lw, ok := ctx.Value(leftOutKey{}).(io.Writer); ok {
-		w = lw
-	}
-	for _, line := range d.Said {
-		fmt.Fprintln(w, line)
-	}
-}
-
-// sendableOf is a composed declaration as the controller's sends know it.
-func sendableOf(d compose.Declared) sendable {
-	out := sendable{Resources: compactKept(d.Resources), Sequence: d.Sequence, Epoch: d.Epoch, Generation: d.Generation,
-		ReadsModules: d.ReadsModules, moduleOf: d.ModuleOf, buildIDs: d.BuildIDs, modules: d.Modules,
-		localNetwork: d.LocalNetwork, Received: d.Received, Mesh: d.Mesh, BusUsers: d.BusUsers,
-		LeftOut: d.LeftOut, leftOutWhy: d.LeftOutWhy, withheld: d.Withheld, unbound: d.Unbound, foreseen: d.Foreseen,
-		unplaced: d.Unplaced, handedOnly: d.HandedOnly, Filled: d.Filled, Provisioner: d.Provisioner,
-		requiredBy: d.RequiredBy}
-	if d.Adoption != nil {
-		out.Adoption = &adoptionEnvelope{Taken: d.Adoption.Taken, Untaken: d.Adoption.Untaken}
-	}
-	return out
-}
-
-// buildsOf is the build of each module a declaration for the node carries, as a send records it (novox/hq issue 259): the
-// module's current build for each module in it, the build it was last sent for one left out of it, and a module kept at the
-// build the machine runs carried at that one (ADR 0245). Never nil.
-func buildsOf(in compose.Input, node compose.Node, plan catalogue.Resolution, leftOut map[string]string) map[string]string {
-	before := node.SentBuilds
-	if !node.SentKnown {
-		before = nil
-	}
-	out := map[string]string{}
-	for _, m := range plan.Modules {
-		if _, left := leftOut[m.Module]; left {
-			if was, kept := before[m.Module]; kept {
-				out[m.Module] = was
-			}
-			continue
-		}
-		out[m.Module] = in.CurrentBuilds[m.Module]
-	}
-	for m, was := range node.KeptBuilds {
-		if _, carried := out[m]; carried {
-			out[m] = was
-		}
-	}
-	return out
-}
-
-// handedPlans is the plan of each module handed to the provisioner, which the assignments mirror keeps with the send (design
-// 57 P6): the composition's declaration does not carry it, so it is composed from the same rendering again.
-func handedPlans(in *meshInput, node string, resolved compose.Resolved) (map[string]catalogue.Plan, error) {
-	rendered, err := compose.Render(in.Input, node, compose.Foreseeing)
-	if err != nil {
-		return nil, err
-	}
-	gens, err := compose.Generators(in.Input)
-	if err != nil {
-		return nil, err
-	}
-	with := rendered.Rendering
-	with.Generators = gens
-	composed, err := resolved.Plan.Compose(with)
-	if err != nil {
-		return nil, err
-	}
-	return composed.Plans, nil
-}
-
-// sealedByTheController is the declaration with the controller's own seal in place of the vault's box for each core module the
-// vault did not answer for and no box was kept for (core_box.go, ADR 0396): the file carries "sealed", as the controller's
-// composition sent it, until the vault holds the credential. What the composition stood in for the box is replaced and no longer
-// wanted; the validator is run again over the body.
-func sealedByTheController(in *meshInput, node string, d compose.Declared, modules []string) (compose.Declared, []string, error) {
-	rendered, err := compose.Render(in.Input, node, compose.Foreseeing)
-	if err != nil {
-		return d, nil, err
-	}
-	stood, _ := compactBox(catalogue.ForeseenVaultBox)
-	var wanted []compose.CoreBoxWanted
-	var foreseen []string
-	for _, w := range d.CoreBoxesWanted {
-		if !slices.Contains(modules, w.Module) {
-			wanted = append(wanted, w)
-			continue
-		}
-		sealed := rendered.Rendering.Needed[w.Module][w.Name]
-		if sealed == "" {
-			return d, nil, fmt.Errorf("%s/%s on %s has no seal of the controller's to carry until the vault holds it", w.Module, w.Name, node)
-		}
-		for _, r := range d.Resources {
-			box, isBox := r[catalogue.VaultSealedField]
-			// By the resource's id alone: its path is the manifest's with the machine's words filled in, and so is not the
-			// manifest's own.
-			if !isBox || r["id"] != w.Module+"."+catalogue.NeedID(w.Name) {
-				continue
-			}
-			if had, err := compactBox(box); err != nil || had != stood {
-				continue
-			}
-			delete(r, catalogue.VaultSealedField)
-			r["sealed"] = sealed
-		}
-	}
-	// A stand-in box that is left is said by its resource, never sent and never guessed at.
-	for _, r := range d.Resources {
-		if box, has := r[catalogue.VaultSealedField]; has {
-			if had, err := compactBox(box); err == nil && had == stood {
-				if id, _ := r["id"].(string); slices.ContainsFunc(modules, func(m string) bool { return strings.HasPrefix(id, m+".") }) {
-					return d, nil, fmt.Errorf("%s on %s still carries a stand-in for the vault's box, and the controller has "+
-						"no seal of its own for it", id, node)
-				}
-			}
-		}
-	}
-	d.CoreBoxesWanted = wanted
-	for _, f := range d.Foreseen {
-		module, _, _ := strings.Cut(f, "/")
-		if !slices.Contains(modules, module) {
-			foreseen = append(foreseen, f)
-		}
-	}
-	d.Foreseen = foreseen
-	body, err := d.Body()
-	if err != nil {
-		return d, nil, err
-	}
-	return d, validate.Declaration(body), nil
-}
-
-// compactBox is a value as the compact JSON it marshals to, so a box is compared by what it says and not by the type that
-// holds it.
-func compactBox(v any) (string, error) {
-	raw, err := json.Marshal(v)
-	if err != nil {
-		return "", err
-	}
-	var out bytes.Buffer
-	if err := json.Compact(&out, raw); err != nil {
-		return "", err
-	}
-	return out.String(), nil
-}

cmd/mesh-controller/compose_sdk_test.go

@@ -1,87 +0,0 @@
-package main
-
-import (
-	"reflect"
-	"strings"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/compose"
-)
-
-// A declaration as the SDK composes it is the one the controller sends, byte for byte, whatever it carries: the body is the
-// envelope's only marshaller on either side (design 47 R4b, issue 1386).
-func TestASendableIsTheComposedDeclarationByteForByte(t *testing.T) {
-	d := compose.Declared{
-		Resources: []map[string]any{{"id": "files.config", "type": "file"}, {"id": "mesh.hosts", "type": "file"}},
-		Sequence:  7, Epoch: 3, Generation: 9, ReadsModules: true,
-		ModuleOf: map[string]string{"files.config": "files"}, BuildIDs: map[string]string{"files": "b-1"},
-		Adoption: &compose.Adoption{Taken: []string{"files"}, Untaken: map[string][]string{"nats": {"nats.server"}}},
-		Filled:   []string{"/etc/files/filled.json"}, Provisioner: "mesh-provisioner",
-		LeftOut: []string{"cache"}, LeftOutWhy: map[string]string{"cache": "a setting cannot compose"},
-	}
-	want, err := d.Body()
-	if err != nil {
-		t.Fatal(err)
-	}
-	got, err := sendableOf(d).Body()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if string(got) != string(want) {
-		t.Fatalf("the controller would send\n%s\nand the composition made\n%s", got, want)
-	}
-	if empty, err := sendableOf(compose.Declared{}).Body(); err != nil || !strings.Contains(string(empty), `"owns_nothing":true`) {
-		t.Fatalf("an empty declaration is not deliberate: %s %v", empty, err)
-	}
-}
-
-// 1386: what a send records as carried: the current build of each module it carries, the build a module left out of it was last
-// sent (when that is known), and a module kept at the build the machine runs at that one. (The controller's carriedOn recorded
-// the same; mesh-sdk's node_test TestAModuleLeftOutKeepsTheBuildItWasLastSent holds the left-out case.)
-func TestWhatASendRecordsAsCarriedIsWhatTheControllerRecorded(t *testing.T) {
-	plan := catalogue.Resolution{Modules: []catalogue.Manifest{{Module: "postgres"}, {Module: "files"}, {Module: "cache"}}}
-	leftOut := map[string]string{"cache": "a setting cannot compose"}
-	for name, c := range map[string]struct {
-		sent  map[string]string
-		known bool
-		kept  map[string]string
-		want  map[string]string
-	}{
-		"nothing sent": {want: map[string]string{"postgres": "p2", "files": "f2"}},
-		"sent and kept": {sent: map[string]string{"postgres": "p1", "cache": "c1", "files": "f1"}, known: true,
-			kept: map[string]string{"postgres": "p1"}, want: map[string]string{"postgres": "p1", "files": "f2", "cache": "c1"}},
-		"sent but not known":   {sent: map[string]string{"cache": "c1"}, want: map[string]string{"postgres": "p2", "files": "f2"}},
-		"kept a module not in": {known: true, kept: map[string]string{"mail": "m1"}, want: map[string]string{"postgres": "p2", "files": "f2"}},
-	} {
-		in := compose.Input{CurrentBuilds: map[string]string{"postgres": "p2", "files": "f2", "cache": "c2"}}
-		node := compose.Node{SentBuilds: c.sent, SentKnown: c.known, KeptBuilds: c.kept}
-		if got := buildsOf(in, node, plan, leftOut); !reflect.DeepEqual(got, c.want) {
-			t.Errorf("%s: a send records %v, want %v", name, got, c.want)
-		}
-	}
-}
-
-// 1385: a declaration that stands in for a value anywhere is still foreseen, in a list the composition names or in the body
-// alone (a pair credential's stand-in is in no list); one that stands in for nothing is not. It failed first, before the body
-// was scanned.
-func TestADeclarationThatStandsInForAValueIsStillForeseen(t *testing.T) {
-	clean := compose.Declared{Resources: []map[string]any{{"id": "files.config", "type": "file", "content": "ok"}}}
-	if left := stillForeseen(clean); len(left) != 0 {
-		t.Fatalf("a declaration that stands in for nothing is foreseen: %v", left)
-	}
-	for name, d := range map[string]compose.Declared{
-		"an own secret":     {StoodIn: []string{"files/admin"}},
-		"a port":            {ForeseenPorts: []string{"files:80"}},
-		"a core box":        {CoreBoxesWanted: []compose.CoreBoxWanted{{Node: "anchor", Module: "mesh-vault", Name: "root"}}},
-		"a pass of a seat":  {Passes: compose.Passes{Passes: []catalogue.SeatPass{{Seat: catalogue.Seat{Name: "mesh-store"}}}}},
-		"a pair credential": {Resources: []map[string]any{{"id": "files.needs-db", "sealed": catalogue.ForeseenSealed}}},
-		"the certificate":   {Resources: []map[string]any{{"id": "proxy.cert", "content": compose.ForeseenCertificate}}},
-		"the bus's list":    {Resources: []map[string]any{{"id": "nats.users", "content": compose.ForeseenBusUsers}}},
-		"the vault's box":   {Resources: []map[string]any{{"id": "x", "box": catalogue.ForeseenVaultBox}}},
-	} {
-		if left := stillForeseen(d); len(left) == 0 {
-			t.Errorf("%s: a declaration that stands in for it is not foreseen", name)
-		}
-	}
-}

cmd/mesh-controller/composed_digest_race_test.go

@@ -1,78 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"testing"
-
-	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
-	"github.com/nats-io/nats.go/jetstream"
-)
-
-// raceKV is a digests bucket in which another writer writes its composition and digest just before this writer reads
-// the digest key: what two take-ins composing one node at once do.
-type raceKV struct {
-	*fakeComposedKV
-	before func()
-}
-
-func (r *raceKV) Get(ctx context.Context, key string) (jetstream.KeyValueEntry, error) {
-	if r.before != nil {
-		b := r.before
-		r.before = nil
-		b()
-	}
-	return r.fakeComposedKV.Get(ctx, key)
-}
-
-// The digest kept beside a composition is always the digest of the composition the bucket holds: when another writer
-// writes its composition and its digest between this writer's composition and its digest, this writer's digest must not
-// win, or the assigner's want names a composition the bucket no longer holds and the node applies nothing (issue 1945,
-// live on 2026-10-25: shanks' node-tools composition had digest 575a5c96, its want named a36e63c8).
-func TestTheDigestKeptIsTheDigestOfTheCompositionHeld(t *testing.T) {
-	at, _, _, _ := aPlace(t, "shanks")
-	key, _ := sdkdelivery.ComposedKey("shanks", "node-tools", fp2Of('a'))
-	file := func(content string) json.RawMessage {
-		return json.RawMessage(`{"id":"node-tools.f","type":"file","module":"node-tools","path":"/etc/nt","mode":"0644","content":"` +
-			content + `"}`)
-	}
-	ours := sdkdelivery.Composed{Node: "shanks", Module: "node-tools", FP: fp2Of('a'), Resources: []json.RawMessage{file("ours")}}
-	theirs := sdkdelivery.Composed{Node: "shanks", Module: "node-tools", FP: fp2Of('a'), Resources: []json.RawMessage{file("theirs")}}
-	race := &raceKV{fakeComposedKV: at.digests.(*fakeComposedKV)}
-	at.digests = race
-	race.before = func() {
-		// The other writer: its composition over ours, then its digest.
-		other := at
-		other.digests = race.fakeComposedKV
-		if _, err := writeComposed(context.Background(), other, key, theirs); err != nil {
-			t.Fatal(err)
-		}
-	}
-	if _, err := writeComposed(context.Background(), at, key, ours); err != nil {
-		t.Fatal(err)
-	}
-	held, _, err := readComposed(context.Background(), at.bucket, key)
-	if err != nil {
-		t.Fatal(err)
-	}
-	heldDigest, _ := sdkdelivery.ComposedDigestOf(held)
-	e, err := race.fakeComposedKV.Get(context.Background(), key)
-	if err != nil {
-		t.Fatal(err)
-	}
-	kept, err := sdkdelivery.DecodeComposedDigest(e.Value())
-	if err != nil {
-		t.Fatal(err)
-	}
-	if kept.Digest != heldDigest {
-		t.Fatalf("the digest kept is %s and the composition held has %s", kept.Digest, heldDigest)
-	}
-}
-
-func fp2Of(c byte) string {
-	b := make([]byte, 64)
-	for i := range b {
-		b[i] = c
-	}
-	return sdkdelivery.SourcePrefix2 + string(b)
-}

cmd/mesh-controller/composed_integration_test.go

@@ -1,182 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"context"
-	"errors"
-	"sync"
-	"testing"
-
-	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
-	"github.com/nats-io/nats.go"
-	"github.com/nats-io/nats.go/jetstream"
-
-	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/builderkeys"
-	"github.com/novox/mesh-controller/internal/identity"
-	"github.com/novox/mesh-controller/internal/link"
-	"github.com/novox/mesh-controller/internal/testbus"
-)
-
-// A mesh that composes (novox/hq ADR 0539): the real store (theCatalogue: sudo from the catalogue, mesh-host from the
-// node-engine's repository, the private network on anchor and laptop), the controller's signing key in its own
-// identity store, and a real bus server this process composes onto, its lease taken by the act as a command's is. Every
-// subject published on the bus is heard, so a test can say nothing went to a node's declaration subject.
-type composingMesh struct {
-	open  *stores
-	js    jetstream.JetStream
-	conn  *nats.Conn
-	mu    sync.Mutex
-	heard []string
-}
-
-func aComposingMesh(t *testing.T) *composingMesh {
-	t.Helper()
-	open := theCatalogue(t)
-	ident := identity.ForTest(t)
-	if _, err := ident.Establish(t.Context()); err != nil {
-		t.Fatal(err)
-	}
-	s := testbus.Start(t)
-	t.Setenv(broker.NATSVar, s.ClientURL())
-	was := theLease
-	theLease = &actor{}
-	t.Cleanup(func() { theLease.release(); theLease = was })
-	conn, err := nats.Connect(s.ClientURL())
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(conn.Close)
-	js, err := jetstream.New(conn)
-	if err != nil {
-		t.Fatal(err)
-	}
-	m := &composingMesh{open: open, js: js, conn: conn}
-	sub, err := conn.Subscribe(">", func(msg *nats.Msg) {
-		m.mu.Lock()
-		m.heard = append(m.heard, msg.Subject)
-		m.mu.Unlock()
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { _ = sub.Unsubscribe() })
-	legacy, err := conn.JetStream()
-	if err != nil {
-		t.Fatal(err)
-	}
-	// The controller's seat events, kept as the mesh's events stream keeps them.
-	if _, err := legacy.AddStream(&nats.StreamConfig{Name: "CONTROLLER_EVENTS", Subjects: []string{"mesh.seat.mesh-controller.event.>"}}); err != nil {
-		t.Fatal(err)
-	}
-	wasEvents := checkEvents
-	checkEvents = link.OverNATS{Conn: conn, JS: legacy}
-	t.Cleanup(func() { checkEvents = wasEvents })
-	withTrunkList(t, true)
-	return m
-}
-
-// trunkKeys are a done key and the indexer's trunk value naming it. The indexer holds that value at the trunk's commit
-// alone, as the real one does: answering it for any commit made a module registered at an older commit look already
-// registered at the trunk's fingerprint, so the take-in only moved its commit and recorded no build (issue 1945).
-type trunkKeys struct {
-	keyBuckets
-	trunk sdkdelivery.Module
-}
-
-func (k trunkKeys) ModuleAt(_ context.Context, _ string, commit string) (sdkdelivery.Module, error) {
-	if commit != "" && !sameCommitID(commit, k.trunk.Commit) {
-		return sdkdelivery.Module{}, builderkeys.ErrNoValue
-	}
-	return k.trunk, nil
-}
-
-// 1945/AC14: the declarations' stream stays while one node's have names another node-engine than the one registered,
-// and goes, said once, when every node's names it (ADR 0539 clause 11).
-func TestTheDeclarationsStreamGoesOnceEveryNodeRunsTheNewEngine(t *testing.T) {
-	m := aComposingMesh(t)
-	ctx := t.Context()
-	legacy, err := m.conn.JetStream()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := legacy.AddStream(&nats.StreamConfig{Name: broker.DeclarationsStream, Subjects: []string{"mesh.node.*.declare"},
-		MaxMsgsPerSubject: 1}); err != nil {
-		t.Fatal(err)
-	}
-	// The new node-engine registered at its fingerprint, from its done key.
-	n6 := fpOf('6')
-	keys, trunk := aKeyFor("mesh-host", "6", n6, "novox/mesh-host", "", "f00d0123456789ab")
-	settled, _ := liveTakeInSteps(m.open, trunkKeys{keyBuckets: keys, trunk: trunk}, m.js).batch(ctx,
-		[]delivered{{module: "mesh-host", again: true}}, map[string]string{})
-	if len(settled) != 1 || settled[0].err != nil || settled[0].verdict != acknowledged {
-		t.Fatalf("the take-in of mesh-host: %+v", settled)
-	}
-	if _, err := m.js.CreateOrUpdateKeyValue(ctx, jetstream.KeyValueConfig{Bucket: sdkdelivery.HaveBucket, History: sdkdelivery.HaveHistory}); err != nil {
-		t.Fatal(err)
-	}
-	haves, err := m.js.KeyValue(ctx, sdkdelivery.HaveBucket)
-	if err != nil {
-		t.Fatal(err)
-	}
-	have := func(node, fp string) {
-		key, _ := sdkdelivery.HaveKey(node, "mesh-host")
-		raw, _ := sdkdelivery.EncodeHave(sdkdelivery.Have{FP: fp, Phase: sdkdelivery.PhaseRunning, Health: sdkdelivery.HealthOK})
-		if _, err := haves.Put(ctx, key, raw); err != nil {
-			t.Fatal(err)
-		}
-	}
-	have("anchor", n6)
-	have("laptop", fpOf('5'))
-	if done, err := retireDeclarations(ctx, m.open); err != nil || done {
-		t.Fatalf("with laptop on the old node-engine: done %v (%v)", done, err)
-	}
-	if _, err := m.js.Stream(ctx, broker.DeclarationsStream); err != nil {
-		t.Fatalf("the stream went while laptop runs the old node-engine: %v", err)
-	}
-	have("laptop", n6)
-	if done, err := retireDeclarations(ctx, m.open); err != nil || !done {
-		t.Fatalf("with every node on the new node-engine: done %v (%v)", done, err)
-	}
-	if _, err := m.js.Stream(ctx, broker.DeclarationsStream); !errors.Is(err, jetstream.ErrStreamNotFound) {
-		t.Errorf("the stream is still there: %v", err)
-	}
-	if done, err := retireDeclarations(ctx, m.open); err != nil || !done {
-		t.Errorf("a second look: done %v (%v)", done, err)
-	}
-	if !declarationsRetiredNow(ctx, m.open.inventory) {
-		t.Errorf("a raise after the retirement would assert the stream again")
-	}
-
-	// Issue 1945: a node-engine other than the registered one landing on laptop (a newer build on its way) leaves the
-	// declarations retired, so what the health check, the probes and healer H3 expect of the bus names neither the
-	// stream nor a node's consumer on it, and asserting the bus's objects again does not make the stream anew.
-	have("laptop", fpOf('7'))
-	if !declarationsRetiredNow(ctx, m.open.inventory) {
-		t.Fatalf("with laptop on another node-engine after the stream went, the declarations are no longer retired")
-	}
-	streams, consumers, err := expectedBusObjects(ctx, m.open.inventory)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, s := range streams {
-		if s.Name == broker.DeclarationsStream {
-			t.Errorf("the bus's health check and probe D7 still expect the stream %s", s.Name)
-		}
-	}
-	for _, c := range consumers {
-		if c.Stream == broker.DeclarationsStream {
-			t.Errorf("the bus's health check and probe D6 still expect %s on %s", c.Name, c.Stream)
-		}
-	}
-	bus, err := broker.Dial(m.conn.ConnectedUrl())
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(bus.Close)
-	_ = assertOnSend(ctx, m.open.inventory, bus, "  ")
-	if _, err := m.js.Stream(ctx, broker.DeclarationsStream); !errors.Is(err, jetstream.ErrStreamNotFound) {
-		t.Errorf("healer H3's assertion of the bus's objects made the stream anew: %v", err)
-	}
-}

cmd/mesh-controller/composed_judge.go

@@ -1,343 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"path"
-	"sort"
-	"strings"
-
-	sdkdecl "git.novox.be/novox/mesh-sdk/go/declaration"
-	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
-	"github.com/nats-io/nats.go/jetstream"
-)
-
-// The judgement of a move (novox/hq ADR 0539 clauses 2 and 14, by ADR 0377 §3's tests): beside each composition's digest
-// the controller writes whether moving the node from the composition it runs, as its have names it, to this one
-// recreates a container, moves the module's data, or neither, or that it cannot be judged. The assigner holds a move of
-// a module of policy record from it until a person allows it.
-//
-// ADR 0377 §3 over two compositions of one module: **recreates** when a container resource is changed, added or
-// removed; **moves data** when, with no container changed, a directory or file resource is changed, added or removed
-// that a container of the module mounts or that holds or lies within one of its directories (where a module keeps its
-// data), when its `data` declaration changes, or, for a module that declares data, when one of its long-running
-// processes changes; **neither** otherwise, and for a module the node has never run. **Cannot judge** when the
-// composition the node runs is gone or cannot be read. A held composition never becomes what is judged against: with A
-// running, B held and C composed, C is judged against A, the one the have names.
-
-// judgeMove is the value written beside a composition whose digest is digest: its judgement against what the node's have
-// names for the module, and the module's policy.
-func judgeMove(ctx context.Context, at composedPlace, key string, to sdkdelivery.Composed, digest string) (sdkdelivery.ComposedDigest, error) {
-	out := sdkdelivery.ComposedDigest{Digest: digest}
-	if at.policy != nil && to.Module != "" {
-		out.Policy, out.PolicyFrom, out.PolicyWhy = at.policy(to.Module)
-	}
-	if to.Module == "" {
-		// The node's own composition: no module's containers or data are judged; its want is written as any.
-		out.Judgement = sdkdelivery.JudgedNeither
-		return out, nil
-	}
-	have, found, err := at.ran(ctx, to.Module)
-	if err != nil {
-		return out, err
-	}
-	// A node whose have names no composition yet (the switch: it runs the declaration it last applied) is judged
-	// against that module's slice of that declaration (novox/hq ADR 0540 clause 9): equal is unchanged, a want that
-	// changes nothing on the node; otherwise by ADR 0377 §3's tests, as any move.
-	if found && have.Composed == "" && have.FP != "" && have.Phase != sdkdelivery.PhaseRemoved && at.lastApplied != nil {
-		slice, declared, applied, err := at.lastApplied(ctx, to.Module)
-		if err != nil {
-			// Unread is not judged: a person's yes holds it, and the words say why.
-			out.Judgement = sdkdelivery.JudgedCannot
-			out.Words = fmt.Sprintf("%s's have on %s names no composition, and the declaration it last applied cannot be read: %v",
-				to.Module, at.node, err)
-			return out, nil
-		}
-		if applied {
-			from := sdkdelivery.Composed{Node: at.node, Module: to.Module, FP: have.FP, Data: to.Data, Resources: slice}
-			if sameResources(from, to) {
-				out.Judgement, out.Words = sdkdelivery.JudgedUnchanged, "equal to the declaration "+at.node+" last applied"
-				return out, nil
-			}
-			// Against names the declaration, by its digest: the composition the node runs is that declaration's slice.
-			out.Against = declared
-			if onlyTheUserList(from, to) {
-				// Only the bus's user list, as against a composition (ADR 0539 clause 7): no yes waits on it at the switch.
-				out.Judgement, out.UserListOnly = sdkdelivery.JudgedNeither, true
-				out.Words = "only the bus's user list changes, against the declaration " + at.node + " last applied"
-				return out, nil
-			}
-			j, words := judged(from, to)
-			out.Judgement, out.Words = j, words+", against the declaration "+at.node+" last applied"
-			return out, nil
-		}
-	}
-	if !found || have.Phase == sdkdelivery.PhaseRemoved || (have.Composed == "" && have.FP == "") {
-		out.Judgement, out.Words = sdkdelivery.JudgedNeither, "the node runs no composition of "+to.Module
-		return out, nil
-	}
-	if have.Composed == "" {
-		out.Judgement = sdkdelivery.JudgedCannot
-		out.Words = fmt.Sprintf("%s's have on %s names no composition, only the fingerprint %s", to.Module, at.node, have.FP)
-		return out, nil
-	}
-	out.Against = have.Composed
-	if have.Composed == digest {
-		out.Judgement, out.Words = sdkdelivery.JudgedNeither, "the node runs this composition"
-		return out, nil
-	}
-	from, found, err := composedByDigest(ctx, at, to.Module, have.FP, have.Composed)
-	if err != nil {
-		return out, err
-	}
-	if !found {
-		out.Judgement = sdkdelivery.JudgedCannot
-		out.Words = fmt.Sprintf("the composition %s runs on %s (%s) is gone", to.Module, at.node, short(strings.TrimPrefix(have.Composed, "sha256:")))
-		return out, nil
-	}
-	if onlyTheUserList(from, to) {
-		// Only the bus's user list (ADR 0539 clause 7): a file change and a reload of the bus, no move of it, written
-		// into its want at once.
-		out.Judgement, out.UserListOnly, out.Words = sdkdelivery.JudgedNeither, true, "only the bus's user list changes"
-		return out, nil
-	}
-	out.Judgement, out.Words = judged(from, to)
-	return out, nil
-}
-
-// busUsersSuffix ends the id of the bus module's user list as the composer writes it: `<module>.bus-users`.
-const busUsersSuffix = ".bus-users"
-
-// onlyTheUserList says two compositions of a module differ, and only in its file of the bus's user list.
-func onlyTheUserList(from, to sdkdelivery.Composed) bool {
-	if from.Data != to.Data {
-		return false
-	}
-	before, after := resourcesByID(from), resourcesByID(to)
-	if len(before) != len(after) {
-		return false
-	}
-	changed := false
-	for id, now := range after {
-		was, ok := before[id]
-		if !ok {
-			return false
-		}
-		if bytes.Equal(was.raw, now.raw) {
-			continue
-		}
-		if !strings.HasSuffix(id, busUsersSuffix) || now.kind != string(sdkdecl.TypeFile) {
-			return false
-		}
-		changed = true
-	}
-	return changed
-}
-
-// composedByDigest finds, in the node's bucket, the composition of module at fingerprint fp whose digest is digest: the
-// key's current value or one of the revisions it keeps.
-func composedByDigest(ctx context.Context, at composedPlace, module, fp, digest string) (sdkdelivery.Composed, bool, error) {
-	if fp == "" {
-		return sdkdelivery.Composed{}, false, nil
-	}
-	key, err := sdkdelivery.ComposedKey(at.node, module, fp)
-	if err != nil {
-		return sdkdelivery.Composed{}, false, nil
-	}
-	values, err := historyOf(ctx, at.bucket, key)
-	if err != nil {
-		return sdkdelivery.Composed{}, false, err
-	}
-	for _, v := range values {
-		c, err := sdkdelivery.DecodeComposed(v)
-		if err != nil {
-			continue
-		}
-		if d, err := sdkdelivery.ComposedDigestOf(c); err == nil && d == digest {
-			return c, true, nil
-		}
-	}
-	return sdkdelivery.Composed{}, false, nil
-}
-
-// historyOf is every value a key keeps, the newest first; none when there is no such key.
-func historyOf(ctx context.Context, kv composedBucketsKV, key string) ([][]byte, error) {
-	if h, ok := kv.(interface {
-		History(ctx context.Context, key string, opts ...jetstream.WatchOpt) ([]jetstream.KeyValueEntry, error)
-	}); ok {
-		entries, err := h.History(ctx, key)
-		if errors.Is(err, jetstream.ErrKeyNotFound) {
-			return nil, nil
-		}
-		if err != nil {
-			return nil, err
-		}
-		out := make([][]byte, 0, len(entries))
-		for i := len(entries) - 1; i >= 0; i-- {
-			if entries[i].Operation() == jetstream.KeyValuePut {
-				out = append(out, entries[i].Value())
-			}
-		}
-		return out, nil
-	}
-	e, err := kv.Get(ctx, key)
-	if errors.Is(err, jetstream.ErrKeyNotFound) {
-		return nil, nil
-	}
-	if err != nil {
-		return nil, err
-	}
-	return [][]byte{e.Value()}, nil
-}
-
-// judged applies ADR 0377 §3 to two compositions of one module.
-func judged(from, to sdkdelivery.Composed) (sdkdelivery.Judgement, string) {
-	before, after := resourcesByID(from), resourcesByID(to)
-	if ids := changedOf(before, after, func(kind string) bool { return kind == string(sdkdecl.TypeContainer) }); len(ids) > 0 {
-		return sdkdelivery.JudgedRecreates, "it recreates " + strings.Join(ids, ", ")
-	}
-	if from.Data != to.Data {
-		return sdkdelivery.JudgedMovesData, "its data declaration changes"
-	}
-	places := dataPlaces(before, after)
-	held := func(kind string) bool {
-		return kind == string(sdkdecl.TypeDirectory) || kind == string(sdkdecl.TypeFile)
-	}
-	var moved []string
-	for _, id := range changedOf(before, after, held) {
-		r := before[id]
-		if r == nil {
-			r = after[id]
-		}
-		if withinPlaces(r.path, places) {
-			moved = append(moved, id)
-		}
-	}
-	if to.Data || from.Data {
-		moved = append(moved, changedOf(before, after, func(kind string) bool { return kind == string(sdkdecl.TypeProcess) })...)
-	}
-	if len(moved) > 0 {
-		sort.Strings(moved)
-		return sdkdelivery.JudgedMovesData, "it changes where its data is kept: " + strings.Join(moved, ", ")
-	}
-	return sdkdelivery.JudgedNeither, "it recreates no container and moves no data"
-}
-
-// judgedResource is a resource as the judgement reads it: its kind, the path it acts on, what its containers mount,
-// and its canonical bytes.
-type judgedResource struct {
-	kind   string
-	path   string
-	mounts []string
-	raw    []byte
-}
-
-func resourcesByID(c sdkdelivery.Composed) map[string]*judgedResource {
-	out := map[string]*judgedResource{}
-	for _, raw := range c.Resources {
-		var head struct {
-			ID   string `json:"id"`
-			Type string `json:"type"`
-			Path string `json:"path"`
-			// A container's volumes, `<path on the machine>:<path inside>[:<options>]`.
-			Volumes []string `json:"volumes"`
-		}
-		if err := json.Unmarshal(raw, &head); err != nil {
-			continue
-		}
-		r := &judgedResource{kind: head.Type, path: head.Path, raw: compactComposed(raw)}
-		for _, v := range head.Volumes {
-			source, _, _ := strings.Cut(v, ":")
-			r.mounts = append(r.mounts, source)
-		}
-		out[head.ID] = r
-	}
-	return out
-}
-
-// compactComposed is a resource's bytes canonical: its keys sorted, its spacing dropped, its numbers as written, so
-// two compositions that say the same compare equal however each was written.
-func compactComposed(raw []byte) []byte {
-	var v any
-	d := json.NewDecoder(bytes.NewReader(raw))
-	d.UseNumber()
-	if err := d.Decode(&v); err != nil {
-		return raw
-	}
-	out, err := json.Marshal(v)
-	if err != nil {
-		return raw
-	}
-	return out
-}
-
-// changedOf are the ids of the resources of the kinds counted that are changed, added or removed, sorted.
-func changedOf(before, after map[string]*judgedResource, counted func(kind string) bool) []string {
-	var out []string
-	for id, now := range after {
-		if !counted(now.kind) {
-			continue
-		}
-		if was, ok := before[id]; !ok || !bytes.Equal(was.raw, now.raw) {
-			out = append(out, id)
-		}
-	}
-	for id, was := range before {
-		if _, ok := after[id]; !ok && counted(was.kind) {
-			out = append(out, id)
-		}
-	}
-	sort.Strings(out)
-	return out
-}
-
-// dataPlaces are the paths where the module keeps what a move must not lose: what its containers mount, and its
-// directories, before and after.
-func dataPlaces(before, after map[string]*judgedResource) []string {
-	var out []string
-	for _, rs := range []map[string]*judgedResource{before, after} {
-		for _, r := range rs {
-			if r.kind == string(sdkdecl.TypeContainer) {
-				out = append(out, r.mounts...)
-			}
-			if r.kind == string(sdkdecl.TypeDirectory) && r.path != "" {
-				out = append(out, r.path)
-			}
-		}
-	}
-	return out
-}
-
-// withinPlaces says p is one of places, or lies within one, or holds one.
-func withinPlaces(p string, places []string) bool {
-	if p == "" {
-		return false
-	}
-	p = path.Clean(p)
-	for _, place := range places {
-		if place == "" || !strings.HasPrefix(place, "/") {
-			continue
-		}
-		place = path.Clean(place)
-		if p == place || strings.HasPrefix(p, place+"/") || strings.HasPrefix(place, p+"/") {
-			return true
-		}
-	}
-	return false
-}
-
-// sameResources says two compositions of a module hold the same resources in the same order, each compared canonical.
-func sameResources(a, b sdkdelivery.Composed) bool {
-	if len(a.Resources) != len(b.Resources) {
-		return false
-	}
-	for i := range a.Resources {
-		if !bytes.Equal(compactComposed(a.Resources[i]), compactComposed(b.Resources[i])) {
-			return false
-		}
-	}
-	return true
-}

cmd/mesh-controller/composed_judge_test.go

@@ -1,212 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"strings"
-	"testing"
-
-	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
-
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// mailOn is a composition of mesh-mail on ace at fingerprint c, from the given resources, each saying its module.
-func mailOn(t *testing.T, c byte, data bool, resources ...string) sdkdelivery.Composed {
-	t.Helper()
-	out := sdkdelivery.Composed{Node: "ace", Module: "mesh-mail", FP: sdkdelivery.SourcePrefix2 + strings.Repeat(string(c), 64), Data: data}
-	for _, r := range resources {
-		out.Resources = append(out.Resources, json.RawMessage(r))
-	}
-	return out
-}
-
-const (
-	mailContainer  = `{"id":"mesh-mail.server","type":"container","module":"mesh-mail","name":"mail","image":"mail@sha256:1111111111111111111111111111111111111111111111111111111111111111","volumes":["/var/lib/mesh-mail/spool:/spool"]}`
-	mailContainer2 = `{"id":"mesh-mail.server","type":"container","module":"mesh-mail","name":"mail","image":"mail@sha256:2222222222222222222222222222222222222222222222222222222222222222","volumes":["/var/lib/mesh-mail/spool:/spool"]}`
-	mailSpool      = `{"id":"mesh-mail.spool","type":"directory","module":"mesh-mail","path":"/var/lib/mesh-mail/spool"}`
-	mailSpoolMoved = `{"id":"mesh-mail.spool","type":"directory","module":"mesh-mail","path":"/srv/mesh-mail/spool"}`
-	mailTools      = `{"id":"mesh-mail.tools","type":"file","module":"mesh-mail","path":"/usr/lib/mesh-mail/tools.json","content":"a"}`
-	mailTools2     = `{"id":"mesh-mail.tools","type":"file","module":"mesh-mail","path":"/usr/lib/mesh-mail/tools.json","content":"b"}`
-	mailConfig     = `{"id":"mesh-mail.conf","type":"file","module":"mesh-mail","path":"/var/lib/mesh-mail/spool/conf","content":"a"}`
-	mailConfig2    = `{"id":"mesh-mail.conf","type":"file","module":"mesh-mail","path":"/var/lib/mesh-mail/spool/conf","content":"b"}`
-)
-
-// 1945/AC12: captured pairs of compositions are judged by ADR 0377 §3's tests: a changed container recreates; with no
-// container changed, a directory moved, a file within the data a container mounts changed, or the data declaration
-// changed moves data; a tools file nothing mounts changed is neither.
-func TestAMoveIsJudgedByWhatItRecreatesOrMoves(t *testing.T) {
-	cases := []struct {
-		name     string
-		from, to sdkdelivery.Composed
-		want     sdkdelivery.Judgement
-	}{
-		{"a new image", mailOn(t, 'a', true, mailContainer, mailSpool, mailTools), mailOn(t, 'b', true, mailContainer2, mailSpool, mailTools), sdkdelivery.JudgedRecreates},
-		{"a container gone", mailOn(t, 'a', true, mailContainer, mailSpool), mailOn(t, 'b', true, mailSpool), sdkdelivery.JudgedRecreates},
-		{"its spool moved", mailOn(t, 'a', true, mailContainer, mailSpool), mailOn(t, 'b', true, mailContainer, mailSpoolMoved), sdkdelivery.JudgedMovesData},
-		{"a file in its spool", mailOn(t, 'a', true, mailContainer, mailSpool, mailConfig), mailOn(t, 'b', true, mailContainer, mailSpool, mailConfig2), sdkdelivery.JudgedMovesData},
-		{"its data declaration", mailOn(t, 'a', false, mailContainer, mailSpool), mailOn(t, 'b', true, mailContainer, mailSpool), sdkdelivery.JudgedMovesData},
-		{"its tools only", mailOn(t, 'a', true, mailContainer, mailSpool, mailTools), mailOn(t, 'b', true, mailContainer, mailSpool, mailTools2), sdkdelivery.JudgedNeither},
-	}
-	for _, c := range cases {
-		if got, words := judged(c.from, c.to); got != c.want || words == "" {
-			t.Errorf("%s: judged %s (%q), want %s", c.name, got, words, c.want)
-		}
-	}
-}
-
-// 1945/AC12: a move is judged against the composition the node's have names: one the node never ran is neither; one
-// whose composition is gone cannot be judged and says why; and with A running, B held and C composed, C is judged
-// against A, and judged again when the have changes.
-func TestAMoveIsJudgedAgainstWhatTheNodeRuns(t *testing.T) {
-	at, _, _, haves := aPlace(t, "ace")
-	ctx := context.Background()
-	a := mailOn(t, 'a', true, mailContainer, mailSpool, mailTools)
-	b := mailOn(t, 'b', true, mailContainer2, mailSpool, mailTools)
-	c := mailOn(t, 'c', true, mailContainer, mailSpool, mailTools2)
-	write := func(comp sdkdelivery.Composed) (string, string) {
-		key, _ := sdkdelivery.ComposedKey("ace", comp.Module, comp.FP)
-		if _, err := writeComposed(ctx, at, key, comp); err != nil {
-			t.Fatal(err)
-		}
-		d, _ := sdkdelivery.ComposedDigestOf(comp)
-		return key, d
-	}
-	judgedNow := func(key string) sdkdelivery.ComposedDigest {
-		e, err := at.digests.Get(ctx, key)
-		if err != nil {
-			t.Fatal(err)
-		}
-		v, err := sdkdelivery.DecodeComposedDigest(e.Value())
-		if err != nil {
-			t.Fatal(err)
-		}
-		return v
-	}
-	keyA, digestA := write(a)
-	if v := judgedNow(keyA); v.Judgement != sdkdelivery.JudgedNeither || v.Against != "" {
-		t.Errorf("a module the node never ran: %+v", v)
-	}
-	if v := judgedNow(keyA); v.Policy != "roll" || v.PolicyFrom != "default" {
-		t.Errorf("the policy beside the judgement: %+v", v)
-	}
-	haves["mesh-mail"] = sdkdelivery.Have{FP: a.FP, Composed: digestA, Phase: sdkdelivery.PhaseRunning, Health: sdkdelivery.HealthOK}
-	keyB, _ := write(b)
-	if v := judgedNow(keyB); v.Judgement != sdkdelivery.JudgedRecreates || v.Against != digestA {
-		t.Errorf("B against A: %+v", v)
-	}
-	// B is held (the assigner writes no want for it); the node still runs A.
-	keyC, digestC := write(c)
-	if v := judgedNow(keyC); v.Judgement != sdkdelivery.JudgedNeither || v.Against != digestA {
-		t.Errorf("C against A, B held: %+v", v)
-	}
-	// The have changes to C: every judgement of the module is written again, against what runs now (the have watch).
-	haves["mesh-mail"] = sdkdelivery.Have{FP: c.FP, Composed: digestC, Phase: sdkdelivery.PhaseRunning, Health: sdkdelivery.HealthOK}
-	if n, err := rejudge(ctx, at, "mesh-mail"); err != nil || n == 0 {
-		t.Fatalf("rejudged %d (%v)", n, err)
-	}
-	if v := judgedNow(keyC); v.Against != digestC || v.Judgement != sdkdelivery.JudgedNeither {
-		t.Errorf("C once the node runs it: %+v", v)
-	}
-	if v := judgedNow(keyB); v.Against != digestC || v.Judgement != sdkdelivery.JudgedRecreates {
-		t.Errorf("B once the node runs C: %+v", v)
-	}
-	// A person sets the module's policy: written beside every composition of it.
-	at.policy = func(string) (string, string, string) { return "record", "person", "its spool" }
-	if _, err := rejudge(ctx, at, "mesh-mail"); err != nil {
-		t.Fatal(err)
-	}
-	if v := judgedNow(keyB); v.Policy != "record" || v.PolicyFrom != "person" || v.PolicyWhy != "its spool" {
-		t.Errorf("the person's policy beside B: %+v", v)
-	}
-	// A have naming a composition the buckets no longer hold.
-	haves["mesh-mail"] = sdkdelivery.Have{FP: sdkdelivery.SourcePrefix2 + strings.Repeat("9", 64), Composed: "sha256:" + strings.Repeat("9", 64),
-		Phase: sdkdelivery.PhaseRunning, Health: sdkdelivery.HealthOK}
-	write(b)
-	if v := judgedNow(keyB); v.Judgement != sdkdelivery.JudgedCannot || !strings.Contains(v.Words, "gone") {
-		t.Errorf("against a composition that is gone: %+v", v)
-	}
-}
-
-const (
-	busServer  = `{"id":"nats.server","type":"container","module":"nats","name":"nats","image":"nats@sha256:4444444444444444444444444444444444444444444444444444444444444444"}`
-	busServer2 = `{"id":"nats.server","type":"container","module":"nats","name":"nats","image":"nats@sha256:5555555555555555555555555555555555555555555555555555555555555555"}`
-	busUsers   = `{"id":"nats.bus-users","type":"file","module":"nats","path":"/etc/nats/users.conf","content":"users: [a]"}`
-	busUsers2  = `{"id":"nats.bus-users","type":"file","module":"nats","path":"/etc/nats/users.conf","content":"users: [a, b]"}`
-)
-
-// busOn is a composition of the bus on ace from the given resources.
-func busOn(t *testing.T, resources ...string) sdkdelivery.Composed {
-	t.Helper()
-	out := sdkdelivery.Composed{Node: "ace", Module: "nats", FP: sdkdelivery.SourcePrefix2 + strings.Repeat("b", 64)}
-	for _, r := range resources {
-		out.Resources = append(out.Resources, json.RawMessage(r))
-	}
-	return out
-}
-
-// ADR 0540 clause 9: a have that names no composition, only a fingerprint (the switch: the node runs the declaration it
-// last applied), is judged against the module's slice of that declaration, read from the kept stream of declarations:
-// an equal slice is unchanged; a slice differing only in the bus's user list is that (round 1's A2, so no yes waits on it at the switch); a changed setting is judged as any move; no declaration to read cannot be judged.
-func TestAHaveWithNoCompositionIsJudgedAgainstTheLastDeclaration(t *testing.T) {
-	ctx := context.Background()
-	other := `{"id":"mesh-calendar.server","type":"container","module":"mesh-calendar","name":"calendar","image":"cal@sha256:3333333333333333333333333333333333333333333333333333333333333333"}`
-	unsaid := `{"id":"mesh-mail.tools","type":"file","path":"/usr/lib/mesh-mail/tools.json","content":"a"}`
-	declared := func(resources ...string) []byte {
-		body, err := json.Marshal(map[string]any{"node": "ace", "resources": json.RawMessage("[" + strings.Join(resources, ",") + "]")})
-		if err != nil {
-			t.Fatal(err)
-		}
-		signed, err := json.Marshal(link.Signed{Declaration: body, Signature: []byte("s")}) // as link.Envelope sent it
-		if err != nil {
-			t.Fatal(err)
-		}
-		return signed
-	}
-	cases := []struct {
-		name     string
-		last     []byte // the node's last declaration on the stream; nil when there is none
-		to       sdkdelivery.Composed
-		want     sdkdelivery.Judgement
-		inWords  string
-		userList bool
-	}{
-		{"an equal slice", declared(mailContainer, other, mailSpool, mailTools), mailOn(t, 'b', true, mailContainer, mailSpool, mailTools), sdkdelivery.JudgedUnchanged, "last applied", false},
-		{"a declared resource saying no module is not equal", declared(mailContainer, other, mailSpool, unsaid), mailOn(t, 'b', true, mailContainer, mailSpool, mailTools), sdkdelivery.JudgedNeither, "last applied", false},
-		{"a changed image", declared(mailContainer, other, mailSpool, mailTools), mailOn(t, 'b', true, mailContainer2, mailSpool, mailTools), sdkdelivery.JudgedRecreates, "last applied", false},
-		{"a changed setting in its spool", declared(mailContainer, mailSpool, mailConfig), mailOn(t, 'b', true, mailContainer, mailSpool, mailConfig2), sdkdelivery.JudgedMovesData, "last applied", false},
-		{"a changed tools file", declared(mailContainer, mailSpool, mailTools), mailOn(t, 'b', true, mailContainer, mailSpool, mailTools2), sdkdelivery.JudgedNeither, "last applied", false},
-		{"only the bus's user list", declared(busServer, busUsers, other), busOn(t, busServer, busUsers2), sdkdelivery.JudgedNeither, "only the bus's user list", true},
-		{"the bus's user list and its container", declared(busServer, busUsers), busOn(t, busServer2, busUsers2), sdkdelivery.JudgedRecreates, "last applied", false},
-		{"no declaration kept", nil, mailOn(t, 'b', true, mailContainer, mailSpool, mailTools), sdkdelivery.JudgedCannot, "names no composition", false},
-	}
-	for _, c := range cases {
-		at, _, _, haves := aPlace(t, "ace")
-		last := c.last
-		at.lastApplied = func(_ context.Context, module string) ([]json.RawMessage, string, bool, error) {
-			if last == nil {
-				return nil, "", false, nil
-			}
-			return sliceOfDeclaration(last, module)
-		}
-		haves[c.to.Module] = sdkdelivery.Have{FP: sdkdelivery.SourcePrefix2 + strings.Repeat("a", 64), Phase: sdkdelivery.PhaseRunning, Health: sdkdelivery.HealthOK}
-		key, _ := sdkdelivery.ComposedKey("ace", c.to.Module, c.to.FP)
-		digest, err := sdkdelivery.ComposedDigestOf(c.to)
-		if err != nil {
-			t.Fatalf("%s: %v", c.name, err)
-		}
-		got, err := judgeMove(ctx, at, key, c.to, digest)
-		if err != nil {
-			t.Fatalf("%s: %v", c.name, err)
-		}
-		if got.UserListOnly != c.userList {
-			t.Errorf("%s: user list only %v, want %v", c.name, got.UserListOnly, c.userList)
-		}
-		if got.Judgement != c.want || !strings.Contains(got.Words, c.inWords) {
-			t.Errorf("%s: judged %s (%q), want %s", c.name, got.Judgement, got.Words, c.want)
-		}
-		if _, err := sdkdelivery.EncodeComposedDigest(got); err != nil {
-			t.Errorf("%s: the judgement written is refused: %v", c.name, err)
-		}
-	}
-}

cmd/mesh-controller/composed_keys.go

@@ -1,446 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"maps"
-	"slices"
-	"sort"
-	"strings"
-	"sync"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
-	"github.com/nats-io/nats.go/jetstream"
-	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/builderkeys"
-	"github.com/novox/mesh-controller/internal/conditions"
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// A new fingerprint of a registered module, from its done key to its compositions (novox/hq ADR 0539 clauses 5 and 7,
-// ADR 0501 §2, ADR 0544). With no delivery plan left to take a module's done key in, a write of the builder's or the
-// indexer's keys does it: the controller takes in the done key of the fingerprint the indexer's trunk value names
-// (registers the module at it, as a plan's take-in did), composes every node the module is assigned to (which makes what
-// a module's new manifest needs, a credential among it), composes the node holding the bus (its user list now carries
-// the module's permissions at the new fingerprint), and writes `grants.<module>.<fp>`. The assigner's sixth and seventh
-// rules then let a want name the fingerprint.
-//
-// **A durable pull consumer, not a watch** (ADR 0544; research 072, milestones 2 and 4). The writes are read from two
-// durable consumers (take_in_consumer.go): the bus keeps what is not taken in yet, so a restart takes in only what the
-// controller before it left unacknowledged, and the start's look is the consumers' own catch-up. A batch of keys asks the
-// composer twice whatever its size, and a key with nothing new composes nothing.
-
-// takeInSteps are what taking a batch of done keys in does, each a step a test may stand in for.
-type takeInSteps struct {
-	// catalogue is every module the catalogue holds, with the nodes it is assigned to: read once a batch. A module it
-	// does not hold is the new-module take-in's (new_modules.go).
-	catalogue func(ctx context.Context) (map[string][]string, error)
-	// trunk is the indexer's trunk value of the module.
-	trunk func(ctx context.Context, module string) (sdkdelivery.Module, error)
-	// registered says whether the module is registered at the trunk's commit, and whether at its fingerprint: a commit
-	// that moves while the fingerprint stays (a catalogue merge that leaves the module's sources alone) is no new build.
-	registered func(ctx context.Context, module string, trunk sdkdelivery.Module) (atCommit, atFP bool, err error)
-	// recordCommit records the module's registration at the trunk's commit, its fingerprint unchanged: nothing composed.
-	recordCommit func(ctx context.Context, module, commit string) error
-	// takeIn registers the module from the builder's done key of the trunk's fingerprint (takeInKey).
-	takeIn func(ctx context.Context, module string, trunk sdkdelivery.Module) error
-	// taken says the module's compositions at fp exist for every node and its grant is written: nothing to compose.
-	taken func(ctx context.Context, module, fp string, nodes []string) (bool, error)
-	// busHolder is the node holding the bus, "" for none.
-	busHolder func(ctx context.Context) (string, error)
-	// compose composes the nodes, and writes the grants after when grants: each node's error, and the grants'.
-	compose func(ctx context.Context, nodes []string, grants bool) (map[string]error, error, error)
-}
-
-// delivered is one key a consumer delivered: its module, and whether it was delivered before (a take-in that may have
-// stopped half-way, so it is taken in whole).
-type delivered struct {
-	module string
-	again  bool
-	// deliveries is how often the bus delivered it, this time included: what a refusal's delay grows with.
-	deliveries uint64
-}
-
-// verdict is what becomes of a module's delivered keys.
-type verdict int
-
-const (
-	// acknowledged: taken in, nothing new, a wait a later write ends, or a build key that failed.
-	acknowledged verdict = iota
-	// refused: delivered again by the bus after doneKeyRetry (a wait on a read, or a failure).
-	refused
-)
-
-// settledKey is what a batch did with one module.
-type settledKey struct {
-	module  string
-	verdict verdict
-	// taken: registered, composed and granted now (not nothing new); its condition is cleared.
-	taken bool
-	// nothingNew: registered and composed before, so nothing was done.
-	nothingNew bool
-	// waits is why it waits, "" when it does not.
-	waits string
-	// err is a failure: raised as the module's condition.
-	err error
-	// said is the line said of it, "" for none.
-	said string
-}
-
-// batch takes the delivered keys in, each module once: it answers one settledKey per module in the order first
-// delivered, and the number of composer passes it asked. memo is, per module, the trunk (fingerprint and commit) this
-// process took in last; a module at the same trunk delivered for the first time has nothing new.
-func (s takeInSteps) batch(ctx context.Context, keys []delivered, memo map[string]string) ([]settledKey, int) {
-	var order []string
-	again := map[string]bool{}
-	for _, k := range keys {
-		if _, seen := again[k.module]; !seen {
-			order = append(order, k.module)
-		}
-		again[k.module] = again[k.module] || k.again
-	}
-	out := make([]settledKey, 0, len(order))
-	all := func(v verdict, err error) ([]settledKey, int) {
-		for _, m := range order {
-			out = append(out, settledKey{module: m, verdict: v, err: err})
-		}
-		return out, 0
-	}
-	held, err := s.catalogue(ctx)
-	if err != nil {
-		return all(refused, fmt.Errorf("the catalogue cannot be read: %w", err))
-	}
-	type toCompose struct {
-		at    int
-		nodes []string
-		mark  string
-		said  string
-	}
-	var need []toCompose
-	for _, m := range order {
-		r := settledKey{module: m}
-		nodes, isHeld := held[m]
-		if !isHeld {
-			out = append(out, r)
-			continue
-		}
-		trunk, err := s.trunk(ctx, m)
-		if errors.Is(err, builderkeys.ErrNoValue) {
-			out = append(out, r)
-			continue
-		}
-		if err == nil && !strings.HasPrefix(trunk.FP2, sdkdelivery.SourcePrefix2) {
-			// The indexer's next write names one: said once, as every wait for a write (ADR 0544 §4).
-			why := trunk.None2
-			if why == "" {
-				why = "the indexer wrote no fingerprint of the new form"
-			}
-			r.waits = fmt.Sprintf("%v: %s at %.8s has no fingerprint to take a build by: %s", errWaitsForAWrite, m,
-				trunk.Commit, why)
-			out = append(out, r)
-			continue
-		}
-		if err != nil {
-			r.verdict, r.err = refused, err
-			out = append(out, r)
-			continue
-		}
-		mark := trunk.FP2 + "@" + trunk.Commit
-		if !again[m] && memo[m] == mark {
-			r.nothingNew = true
-			out = append(out, r)
-			continue
-		}
-		at, atFP, err := s.registered(ctx, m, trunk)
-		if err == nil && !at && atFP {
-			// Only the commit moved (issue 1945: every catalogue merge took about 200 modules in again, 25 minutes): the
-			// new commit is recorded, and the module is judged as one registered, composed only if something is missing.
-			if err = s.recordCommit(ctx, m, trunk.Commit); err == nil {
-				at = true
-			}
-		}
-		if err != nil {
-			r.verdict, r.err = refused, err
-			out = append(out, r)
-			continue
-		}
-		said := ""
-		if !at {
-			if err := s.takeIn(ctx, m, trunk); err != nil {
-				switch {
-				case errors.Is(err, errWaitsForAWrite):
-					r.waits = err.Error()
-				case errors.Is(err, errKeyWaits):
-					r.verdict, r.waits = refused, err.Error()
-				case errors.Is(err, errKeyFailed):
-					r.err = err // acknowledged: only a new build ends it, and its key is delivered then
-				default:
-					r.verdict, r.err = refused, err
-				}
-				out = append(out, r)
-				continue
-			}
-			said = fmt.Sprintf("%s registered from the builder's done key %s (%s)", m, short(trunk.FP2), short(trunk.Commit))
-		} else if !again[m] {
-			// Registered at its trunk already: composed and granted by a take-in before this one, or at this
-			// controller's start, unless that take-in stopped half-way, which leaves a composition or the grant missing.
-			if done, err := s.taken(ctx, m, trunk.FP2, nodes); err == nil && done {
-				memo[m] = mark
-				r.nothingNew = true
-				out = append(out, r)
-				continue
-			}
-		}
-		if len(nodes) == 0 {
-			memo[m] = mark
-			r.taken, r.said = true, said
-			out = append(out, r)
-			continue
-		}
-		if said == "" {
-			said = fmt.Sprintf("%s at %s", m, short(trunk.FP2))
-		}
-		need = append(need, toCompose{at: len(out), nodes: nodes, mark: mark, said: said})
-		out = append(out, r)
-	}
-	if len(need) == 0 {
-		return out, 0
-	}
-	refuseNeed := func(err error) ([]settledKey, int) {
-		for _, n := range need {
-			out[n.at].verdict, out[n.at].err = refused, err
-		}
-		return out, 0
-	}
-	holder, err := s.busHolder(ctx)
-	if err != nil {
-		return refuseNeed(fmt.Errorf("the node holding the bus cannot be read: %w", err))
-	}
-	// The modules' nodes first, in one pass: composing them makes what their new manifests need, credentials among it.
-	var union []string
-	for _, n := range need {
-		for _, node := range n.nodes {
-			if node != holder && !slices.Contains(union, node) {
-				union = append(union, node)
-			}
-		}
-	}
-	sort.Strings(union)
-	passes := 0
-	failed := map[string]error{}
-	if len(union) > 0 {
-		f, _, err := s.compose(ctx, union, false)
-		passes++
-		if err != nil {
-			return refuseNeed(err)
-		}
-		maps.Copy(failed, f)
-	}
-	// Then the bus's user list, which carries the modules' permissions at their new fingerprints, and the grants, which
-	// with the compositions let a want name each fingerprint (rules 6 and 7).
-	var bus []string
-	if holder != "" {
-		bus = []string{holder}
-	}
-	f, grantsErr, err := s.compose(ctx, bus, true)
-	passes++
-	if err != nil {
-		return refuseNeed(err)
-	}
-	maps.Copy(failed, f)
-	for _, n := range need {
-		var errs []error
-		for _, node := range append(slices.Clone(n.nodes), bus...) {
-			if e := failed[node]; e != nil && !slices.ContainsFunc(errs, func(x error) bool { return x == e }) {
-				errs = append(errs, e)
-			}
-		}
-		if grantsErr != nil {
-			errs = append(errs, grantsErr)
-		}
-		r := &out[n.at]
-		if len(errs) > 0 {
-			r.verdict, r.err = refused, errors.Join(errs...)
-			continue
-		}
-		memo[r.module] = n.mark
-		r.taken = true
-		r.said = n.said + "; composed for " + strings.Join(n.nodes, ", ") + ", its grant written"
-	}
-	return out, passes
-}
-
-// doneKeysSay says a line of the take-ins; a variable so a test may hear it.
-var doneKeysSay = func(s string) { fmt.Println(s) }
-
-// doneKeyRetry is how long the bus waits before it delivers again a key whose take-in was refused the first time; each
-// refusal after doubles it, up to doneKeyRetryMost, so a key refused for long (a manifest word this controller does not
-// read yet, a node whose composition keeps failing) costs a take-in every few minutes, not every half minute.
-var doneKeyRetry = 30 * time.Second
-
-// doneKeyRetryMost is the longest a refused key waits before it is delivered again.
-const doneKeyRetryMost = 10 * time.Minute
-
-// refusalDelay is how long the bus waits before it delivers again a key refused on its deliveries-th delivery.
-func refusalDelay(deliveries uint64) time.Duration {
-	d := doneKeyRetry
-	for i := uint64(1); i < deliveries && d < doneKeyRetryMost; i++ {
-		d *= 2
-	}
-	return min(d, doneKeyRetryMost)
-}
-
-// kindNotComposed is the condition of a module's new fingerprint whose compositions or grant are not written: until
-// they are, no want can name it.
-const kindNotComposed = "fingerprint-not-composed"
-
-func doneKeyObservation(module string) conditions.Observation {
-	return conditions.Observation{Scope: conditions.ScopeBuild, ID: module, Token: kindNotComposed, Kind: kindNotComposed,
-		Severity: conditions.Urgent, Resolver: conditions.ResolverOperator, Source: "done keys",
-		Summary: module + "'s new fingerprint is not composed or granted, so no want can name it: "}
-}
-
-// liveTakeInSteps are the steps on the controller's own stores and the bus.
-func liveTakeInSteps(open *stores, keys registerKeys, js jetstream.JetStream) takeInSteps {
-	inv := open.inventory
-	return takeInSteps{
-		catalogue: func(ctx context.Context) (map[string][]string, error) {
-			entries, err := inv.Catalogued(ctx)
-			if err != nil {
-				return nil, err
-			}
-			out := make(map[string][]string, len(entries))
-			for _, e := range entries {
-				out[e.Manifest.Module] = e.On
-			}
-			return out, nil
-		},
-		trunk: func(ctx context.Context, module string) (sdkdelivery.Module, error) {
-			return keys.ModuleAt(ctx, module, "")
-		},
-		registered: func(ctx context.Context, module string, trunk sdkdelivery.Module) (bool, bool, error) {
-			src, err := inv.SourceOf(ctx, module)
-			if err != nil {
-				return false, false, err
-			}
-			if sameCommitID(src.BuiltFrom, trunk.Commit) {
-				return true, true, nil
-			}
-			fp, err := registeredFingerprint(ctx, inv, keys, module, src.BuiltFrom)
-			return false, err == nil && fp != "" && fp == trunk.FP2, nil
-		},
-		recordCommit: func(ctx context.Context, module, commit string) error {
-			return inv.RecordBuiltFrom(ctx, module, commit)
-		},
-		takeIn: func(ctx context.Context, module string, trunk sdkdelivery.Module) error {
-			_, _, err := takeInKey(ctx, inv, keys, keyTake{Module: module, Trunk: trunk, Ask: registrationAsk{Merge: trunk.Commit}})
-			if errors.Is(err, inventory.ErrSuperseded) {
-				return nil
-			}
-			return err
-		},
-		taken: func(ctx context.Context, module, fp string, nodes []string) (bool, error) {
-			return composedAndGranted(ctx, js, module, fp, nodes)
-		},
-		busHolder: func(ctx context.Context) (string, error) {
-			holders, err := seatHolders(ctx, inv)
-			if err != nil {
-				return "", err
-			}
-			return holders[catalogue.BrokerSeat].Node, nil
-		},
-		// The composer's, never the take-in's own: one pass at a time composes each node asked for once, and writes the
-		// grants once (issue 1945, composer.go).
-		compose: func(ctx context.Context, nodes []string, grants bool) (map[string]error, error, error) {
-			return composerFor(open).composeEach(ctx, nodes, grants)
-		},
-	}
-}
-
-// registeredFingerprint is the fingerprint a module is registered at, as currentFingerprints reads it: its commit's
-// newest build's, or the indexer's value at the commit when the commit has no build of its own; "" when neither says.
-func registeredFingerprint(ctx context.Context, inv *inventory.Inventory, keys registerKeys, module, commit string) (string, error) {
-	if commit == "" {
-		return "", nil
-	}
-	if id, err := inv.BuildOf(ctx, module, commit); err == nil && id != "" {
-		if b, found, err := inv.BuildByID(ctx, id); err == nil && found && b.SourceFingerprint != "" {
-			return b.SourceFingerprint, nil
-		}
-	}
-	at, err := keys.ModuleAt(ctx, module, commit)
-	if err != nil {
-		return "", err
-	}
-	return at.FP2, nil
-}
-
-// composedAndGranted says the bus holds module's grant at fp and its composition at fp for every node: a few reads of
-// keys, never a composition.
-func composedAndGranted(ctx context.Context, js jetstream.JetStream, module, fp string, nodes []string) (bool, error) {
-	grants, err := js.KeyValue(ctx, broker.GrantsBucket)
-	if err != nil {
-		return false, err
-	}
-	key, err := sdkdelivery.ControllerGrantKey(module, fp)
-	if err != nil {
-		return false, err
-	}
-	if _, err := grants.Get(ctx, key); err != nil {
-		if errors.Is(err, jetstream.ErrKeyNotFound) {
-			return false, nil
-		}
-		return false, err
-	}
-	digests, err := js.KeyValue(ctx, sdkdelivery.ControllerComposedBucket)
-	if err != nil {
-		return false, err
-	}
-	for _, node := range nodes {
-		key, err := sdkdelivery.ComposedKey(node, module, fp)
-		if err != nil {
-			return false, err
-		}
-		if _, err := digests.Get(ctx, key); err != nil {
-			if errors.Is(err, jetstream.ErrKeyNotFound) {
-				return false, nil
-			}
-			return false, err
-		}
-	}
-	return true, nil
-}
-
-// doneKeysComposers are the composers of the done keys' take-ins in this process, one for each set of stores (a test
-// runs several meshes), each started at its first use and run for as long as the process serves.
-var doneKeysComposers sync.Map
-
-// composerFor is the composer of the stores, its passes composing on them and writing the grants on the bus.
-func composerFor(open *stores) *composer {
-	if c, ok := doneKeysComposers.Load(open); ok {
-		return c.(*composer)
-	}
-	c := newComposer(func(ctx context.Context, nodes []string) map[string]error {
-		_, failed := composeModulesByNode(ctx, open, nodes)
-		return failed
-	}, func(ctx context.Context) error {
-		bus, err := aBus()
-		if err != nil {
-			return err
-		}
-		defer bus.Close()
-		js, err := jetstream.New(bus.Conn())
-		if err != nil {
-			return err
-		}
-		return grantsIssued(ctx, open.inventory, js, "done keys: ")
-	})
-	if was, loaded := doneKeysComposers.LoadOrStore(open, c); loaded {
-		return was.(*composer)
-	}
-	go c.run(context.Background())
-	return c
-}

cmd/mesh-controller/composed_keys_test.go

@@ -1,338 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"slices"
-	"strings"
-	"testing"
-	"time"
-
-	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
-	"github.com/nats-io/nats.go/jetstream"
-	"github.com/novox/mesh-controller/internal/builderkeys"
-)
-
-// aTakeIn is a mesh for the take-in's steps: per module its registered commit, its trunk (commit, fingerprint), its
-// nodes, whether its compositions and grant exist, and what its take-in answers; every act is written to acts.
-type aTakeIn struct {
-	registered map[string]string
-	sameFP     map[string]bool   // registered at another commit, at the trunk's fingerprint
-	trunks     map[string]string // module -> commit; no entry: no trunk value
-	nodes      map[string][]string
-	taken      map[string]bool
-	takeInErr  map[string]error
-	composeErr map[string]error
-	grantsErr  error
-	holder     string
-	acts       []string
-}
-
-func (m *aTakeIn) steps() takeInSteps {
-	fp := func(module string) string { return sdkdelivery.SourcePrefix2 + strings.Repeat(module[:1], 64) }
-	return takeInSteps{
-		catalogue: func(context.Context) (map[string][]string, error) {
-			m.acts = append(m.acts, "catalogue")
-			out := map[string][]string{}
-			for k, v := range m.nodes {
-				out[k] = v
-			}
-			return out, nil
-		},
-		trunk: func(_ context.Context, module string) (sdkdelivery.Module, error) {
-			commit, ok := m.trunks[module]
-			if !ok {
-				return sdkdelivery.Module{}, builderkeys.ErrNoValue
-			}
-			return sdkdelivery.Module{Commit: commit, FP2: fp(module)}, nil
-		},
-		registered: func(_ context.Context, module string, trunk sdkdelivery.Module) (bool, bool, error) {
-			if m.registered[module] == trunk.Commit {
-				return true, true, nil
-			}
-			return false, m.sameFP[module], nil
-		},
-		recordCommit: func(_ context.Context, module, commit string) error {
-			m.acts = append(m.acts, "record "+module+" at "+commit)
-			return nil
-		},
-		takeIn: func(_ context.Context, module string, trunk sdkdelivery.Module) error {
-			m.acts = append(m.acts, "take in "+module+" at "+trunk.Commit)
-			return m.takeInErr[module]
-		},
-		taken:     func(_ context.Context, module, _ string, _ []string) (bool, error) { return m.taken[module], nil },
-		busHolder: func(context.Context) (string, error) { return m.holder, nil },
-		compose: func(_ context.Context, nodes []string, grants bool) (map[string]error, error, error) {
-			act := "compose " + strings.Join(nodes, ",")
-			if grants {
-				act += " and grants"
-			}
-			m.acts = append(m.acts, act)
-			failed := map[string]error{}
-			for _, n := range nodes {
-				if e := m.composeErr[n]; e != nil {
-					failed[n] = e
-				}
-			}
-			if grants {
-				return failed, m.grantsErr, nil
-			}
-			return failed, nil, nil
-		},
-	}
-}
-
-// A batch of done keys takes each module in once and asks the composer at most twice, whatever its size: once for the
-// nodes of every module with something new, then once for the node holding the bus with the grants (ADR 0544 §5). A
-// module registered at its trunk whose compositions and grant exist, or that this process took in at the same trunk,
-// composes nothing (§3): the old take-in composed it three times over, every key and every start (issue 1945, 17:36 on
-// 2026-10-25). A key delivered again is taken in whole. A wait for a write is acknowledged, a wait on a read and a
-// failure refused, a failed build key acknowledged with its condition (§4).
-func TestATakeInBatch(t *testing.T) {
-	waitsForAWrite := fmt.Errorf("%w: the key is building", errWaitsForAWrite)
-	waitsOnARead := fmt.Errorf("%w: the store is away", errKeyWaits)
-	keyFailed := fmt.Errorf("%w: the build failed", errKeyFailed)
-	type want struct {
-		verdict           verdict
-		taken, nothingNew bool
-		waits, err        bool
-	}
-	cases := []struct {
-		name   string
-		mesh   aTakeIn
-		keys   []delivered
-		memo   map[string]string
-		acts   []string
-		passes int
-		want   map[string]want
-	}{
-		{name: "a new fingerprint: taken in, its nodes, then the bus's node and the grants",
-			mesh: aTakeIn{registered: map[string]string{"mail": "old"}, trunks: map[string]string{"mail": "new"},
-				nodes: map[string][]string{"mail": {"ace", "g14", "novox"}}, holder: "novox"},
-			keys: []delivered{{module: "mail"}},
-			acts: []string{"catalogue", "take in mail at new", "compose ace,g14", "compose novox and grants"}, passes: 2,
-			want: map[string]want{"mail": {taken: true}}},
-		{name: "registered, composed and granted: nothing composed (fails on the old take-in)",
-			mesh: aTakeIn{registered: map[string]string{"mail": "new", "nats": "n"}, trunks: map[string]string{"mail": "new", "nats": "n"},
-				nodes: map[string][]string{"mail": {"ace"}, "nats": {"novox"}}, taken: map[string]bool{"mail": true, "nats": true},
-				holder: "novox"},
-			keys: []delivered{{module: "mail"}, {module: "nats"}, {module: "mail"}},
-			acts: []string{"catalogue"},
-			want: map[string]want{"mail": {nothingNew: true}, "nats": {nothingNew: true}}},
-		{name: "a catalogue merge that moved the commit and not the fingerprint: recorded, nothing composed",
-			mesh: aTakeIn{registered: map[string]string{"mail": "a85d9037"}, sameFP: map[string]bool{"mail": true},
-				trunks: map[string]string{"mail": "2df05030"}, nodes: map[string][]string{"mail": {"ace"}},
-				taken: map[string]bool{"mail": true}, holder: "novox"},
-			keys: []delivered{{module: "mail"}},
-			acts: []string{"catalogue", "record mail at 2df05030"}, want: map[string]want{"mail": {nothingNew: true}}},
-		{name: "taken in by this process at the same trunk: nothing new, not even a look at its keys",
-			mesh: aTakeIn{registered: map[string]string{"mail": "new"}, trunks: map[string]string{"mail": "new"},
-				nodes: map[string][]string{"mail": {"ace"}}, holder: "novox"},
-			keys: []delivered{{module: "mail"}},
-			memo: map[string]string{"mail": sdkdelivery.SourcePrefix2 + strings.Repeat("m", 64) + "@new"},
-			acts: []string{"catalogue"}, want: map[string]want{"mail": {nothingNew: true}}},
-		{name: "delivered again: taken in whole, even when it looks done",
-			mesh: aTakeIn{registered: map[string]string{"mail": "new"}, trunks: map[string]string{"mail": "new"},
-				nodes: map[string][]string{"mail": {"ace"}}, taken: map[string]bool{"mail": true}, holder: "novox"},
-			keys: []delivered{{module: "mail", again: true}},
-			acts: []string{"catalogue", "compose ace", "compose novox and grants"}, passes: 2,
-			want: map[string]want{"mail": {taken: true}}},
-		{name: "a take-in that stopped half-way: composed",
-			mesh: aTakeIn{registered: map[string]string{"mail": "new"}, trunks: map[string]string{"mail": "new"},
-				nodes: map[string][]string{"mail": {"ace"}}, holder: "novox"},
-			keys: []delivered{{module: "mail"}},
-			acts: []string{"catalogue", "compose ace", "compose novox and grants"}, passes: 2,
-			want: map[string]want{"mail": {taken: true}}},
-		{name: "three modules, one pass for their nodes and one for the bus",
-			mesh: aTakeIn{registered: map[string]string{}, trunks: map[string]string{"mail": "1", "web": "2", "bus": "3"},
-				nodes: map[string][]string{"mail": {"ace", "novox"}, "web": {"g14", "ace"}, "bus": {"novox"}}, holder: "novox"},
-			keys: []delivered{{module: "mail"}, {module: "web"}, {module: "bus"}},
-			acts: []string{"catalogue", "take in mail at 1", "take in web at 2", "take in bus at 3", "compose ace,g14",
-				"compose novox and grants"}, passes: 2,
-			want: map[string]want{"mail": {taken: true}, "web": {taken: true}, "bus": {taken: true}}},
-		{name: "assigned nowhere, held by no catalogue, no trunk value: nothing composed",
-			mesh: aTakeIn{registered: map[string]string{}, trunks: map[string]string{"mail": "1", "odd": "2"},
-				nodes: map[string][]string{"mail": nil, "none": {"ace"}}, holder: "novox"},
-			keys: []delivered{{module: "mail"}, {module: "odd"}, {module: "none"}},
-			acts: []string{"catalogue", "take in mail at 1"},
-			want: map[string]want{"mail": {taken: true}, "odd": {}, "none": {}}},
-		{name: "a grant not written refuses the key, never swallowed",
-			mesh: aTakeIn{registered: map[string]string{}, trunks: map[string]string{"mail": "1"},
-				nodes: map[string][]string{"mail": {"ace"}}, holder: "novox", grantsErr: errors.New("the bucket mesh-controller_grants: not found")},
-			keys: []delivered{{module: "mail"}},
-			acts: []string{"catalogue", "take in mail at 1", "compose ace", "compose novox and grants"}, passes: 2,
-			want: map[string]want{"mail": {verdict: refused, err: true}}},
-		{name: "a node that fails refuses only its modules",
-			mesh: aTakeIn{registered: map[string]string{}, trunks: map[string]string{"mail": "1", "web": "2"},
-				nodes: map[string][]string{"mail": {"ace"}, "web": {"g14"}}, holder: "novox",
-				composeErr: map[string]error{"ace": errors.New("store refused")}},
-			keys:   []delivered{{module: "mail"}, {module: "web"}},
-			acts:   []string{"catalogue", "take in mail at 1", "take in web at 2", "compose ace,g14", "compose novox and grants"},
-			passes: 2, want: map[string]want{"mail": {verdict: refused, err: true}, "web": {taken: true}}},
-		{name: "waits and failures: a write's wait acknowledged, a read's refused, a failed key acknowledged",
-			mesh: aTakeIn{registered: map[string]string{}, trunks: map[string]string{"a": "1", "b": "2", "c": "3"},
-				nodes: map[string][]string{"a": {"ace"}, "b": {"ace"}, "c": {"ace"}}, holder: "novox",
-				takeInErr: map[string]error{"a": waitsForAWrite, "b": waitsOnARead, "c": keyFailed}},
-			keys: []delivered{{module: "a"}, {module: "b"}, {module: "c"}},
-			acts: []string{"catalogue", "take in a at 1", "take in b at 2", "take in c at 3"},
-			want: map[string]want{"a": {waits: true}, "b": {verdict: refused, waits: true}, "c": {err: true}}},
-	}
-	for _, c := range cases {
-		t.Run(c.name, func(t *testing.T) {
-			memo := c.memo
-			if memo == nil {
-				memo = map[string]string{}
-			}
-			settled, passes := c.mesh.steps().batch(t.Context(), c.keys, memo)
-			if !slices.Equal(c.mesh.acts, c.acts) {
-				t.Fatalf("the acts were\n  %q\nwant\n  %q", c.mesh.acts, c.acts)
-			}
-			if passes != c.passes {
-				t.Fatalf("%d composer pass(es), want %d", passes, c.passes)
-			}
-			if len(settled) != len(c.want) {
-				t.Fatalf("settled %d module(s), want %d: %+v", len(settled), len(c.want), settled)
-			}
-			for _, r := range settled {
-				w := c.want[r.module]
-				got := want{verdict: r.verdict, taken: r.taken, nothingNew: r.nothingNew, waits: r.waits != "", err: r.err != nil}
-				if got != w {
-					t.Errorf("%s: %+v, want %+v (%v)", r.module, got, w, r.err)
-				}
-				if r.taken && memo[r.module] == "" {
-					t.Errorf("%s was taken in and not remembered", r.module)
-				}
-			}
-		})
-	}
-
-	// And each delivered key is acknowledged or refused by its module's verdict, the refused with the retry's delay.
-	t.Run("acknowledged and refused", func(t *testing.T) {
-		mesh := aTakeIn{registered: map[string]string{}, trunks: map[string]string{"a": "1", "b": "2"},
-			nodes: map[string][]string{"a": {"ace"}, "b": {"ace"}}, takeInErr: map[string]error{"b": waitsOnARead}}
-		var acked, naked []string
-		msg := func(module string) takeInMsg {
-			return takeInMsg{delivered: delivered{module: module, deliveries: 3}, ack: func() { acked = append(acked, module) },
-				nak: func(d time.Duration) {
-					if d != refusalDelay(3) {
-						t.Errorf("refused with a delay of %s", d)
-					}
-					naked = append(naked, module)
-				}}
-		}
-		state := &takeInState{memo: map[string]string{}, raised: map[string]bool{}, saidWait: map[string]string{}}
-		said := state.take(t.Context(), mesh.steps(), []takeInMsg{msg("a"), msg("b"), msg("a")})
-		if !slices.Equal(acked, []string{"a", "a"}) || !slices.Equal(naked, []string{"b"}) {
-			t.Fatalf("acknowledged %v and refused %v", acked, naked)
-		}
-		if !strings.Contains(said, "1 taken in") || !strings.Contains(said, "1 waiting") {
-			t.Fatalf("said %q", said)
-		}
-	})
-
-	// A key refused for long holds no slot the others need: each consumer leaves far more keys unacknowledged than a
-	// batch takes, so 8 keys refused on each stop no ninth (the review of ADR 0544: with 8 a consumer, they stopped it
-	// for good), and a refusal waits longer each time, up to ten minutes.
-	t.Run("refused keys stop no other", func(t *testing.T) {
-		for _, bucket := range []string{sdkdelivery.ModulesBucket, sdkdelivery.BuilderBuildsBucket} {
-			if c := takeInConfig(bucket); c.MaxAckPending < 8+startTakeIns || c.AckPolicy != jetstream.AckExplicitPolicy {
-				t.Errorf("%s: %d unacknowledged at most (%v): 8 refused keys and a batch do not fit", bucket,
-					c.MaxAckPending, c.AckPolicy)
-			}
-		}
-		was := time.Duration(0)
-		for n := uint64(1); n <= 8; n++ {
-			d := refusalDelay(n)
-			if d < was || d > doneKeyRetryMost || (n == 1 && d != doneKeyRetry) {
-				t.Fatalf("the %d. refusal waits %s (the one before %s)", n, d, was)
-			}
-			was = d
-		}
-		if was != doneKeyRetryMost {
-			t.Fatalf("the 8. refusal waits %s, want %s", was, doneKeyRetryMost)
-		}
-	})
-}
-
-// The take-in stalls when it holds work (keys not delivered yet, or a batch handed and not settled) and settles none
-// for five minutes; refused keys waiting for their delay are no work, so a quiet mesh is no stall. The first look
-// always says what it found, so a stall raised before a restart is cleared once this controller moves (ADR 0544 §6
-// and its second review).
-func TestATakeInStallsWhenItHoldsWorkAndSettlesNone(t *testing.T) {
-	at := time.Date(2026, 10, 25, 17, 36, 0, 0, time.UTC)
-	type reading struct {
-		after            time.Duration
-		pending, taking  uint64
-		handed, settled  uint64
-		stalled, changed bool
-	}
-	for _, c := range []struct {
-		name     string
-		readings []reading
-	}{
-		{"keys not delivered and nothing settled", []reading{
-			{0, 190, 8, 50, 50, false, true}, // the first look always says what it found
-			{4 * time.Minute, 190, 8, 50, 50, false, false},
-			{5 * time.Minute, 190, 8, 50, 50, true, true},
-			{6 * time.Minute, 190, 8, 50, 50, true, false},
-			{7 * time.Minute, 180, 8, 60, 60, false, true},
-			{20 * time.Minute, 0, 0, 60, 60, false, false},
-		}},
-		{"refused keys waiting alone are no stall", []reading{
-			{0, 0, 3, 40, 40, false, true},
-			{30 * time.Minute, 0, 3, 40, 40, false, false},
-		}},
-		{"every key settled, one of them refused by the bus, nothing pending: no stall", []reading{
-			{0, 0, 1, 3, 3, false, true},
-			{6 * time.Minute, 0, 1, 3, 3, false, false},
-		}},
-		{"a batch handed and never settled is a stall", []reading{
-			{0, 0, 16, 56, 40, false, true},
-			{5 * time.Minute, 0, 16, 56, 40, true, true},
-		}},
-	} {
-		t.Run(c.name, func(t *testing.T) {
-			w := &stallWatch{}
-			for i, r := range c.readings {
-				stalled, changed := w.look(takeInBacklog{Pending: r.pending, Taking: r.taking}, r.handed, r.settled,
-					at.Add(r.after))
-				if stalled != r.stalled || changed != r.changed {
-					t.Fatalf("reading %d: stalled %v changed %v, want %v %v", i, stalled, changed, r.stalled, r.changed)
-				}
-			}
-		})
-	}
-}
-
-// 1945/AC4: the bus's user list is a file of the bus module's composition (ADR 0539 clause 7): a change of the composed
-// users is a new revision of that composition alone, every other composition of the node keeping its digest.
-func TestAChangedUserListIsANewRevisionOfTheBusModulesCompositionAlone(t *testing.T) {
-	body, fps := capturedBody(t, "g14")
-	fps["nats"] = sdkdelivery.SourcePrefix2 + strings.Repeat("e", 64)
-	withUsers := func(users string) map[string]sdkdelivery.Composed {
-		var d map[string]any
-		if err := json.Unmarshal(body, &d); err != nil {
-			t.Fatal(err)
-		}
-		// As the composer writes it for the module holding mesh-broker (mesh-sdk catalogue: BusUsersID, owned by the module).
-		d["resources"] = append(d["resources"].([]any), map[string]any{"id": "nats.bus-users", "type": "file",
-			"module": "nats", "path": "/var/lib/mesh/nats/users.conf", "content": users, "mode": "0600"})
-		raw, _ := json.Marshal(d)
-		comps, _, _, err := compositionsOf("g14", raw, fps, nil, nil, nil)
-		if err != nil {
-			t.Fatal(err)
-		}
-		return comps
-	}
-	before, after := withUsers("authorization { users = [ {user: a} ] }\n"), withUsers("authorization { users = [ {user: a}, {user: b} ] }\n")
-	natsKey, _ := sdkdelivery.ComposedKey("g14", "nats", fps["nats"])
-	for key, c := range before {
-		d1, _ := sdkdelivery.ComposedDigestOf(c)
-		d2, _ := sdkdelivery.ComposedDigestOf(after[key])
-		if changed := d1 != d2; changed != (key == natsKey) {
-			t.Errorf("%s changed %v; only the bus module's composition changes with its user list", key, changed)
-		}
-	}
-}

cmd/mesh-controller/composed_live.go

@@ -1,447 +0,0 @@
-package main
-
-import (
-	"context"
-	"crypto/sha256"
-	"encoding/hex"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"sort"
-	"strings"
-	"sync"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	sdkdecl "git.novox.be/novox/mesh-sdk/go/declaration"
-	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
-	"github.com/nats-io/nats.go"
-	"github.com/nats-io/nats.go/jetstream"
-
-	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// composeModules composes each named node and writes its compositions that differ (ADR 0539 clause 5): what each act
-// that once sent a declaration calls instead. A node that cannot compose is that node's: the others are written, and
-// every refusal is named in the error. It answers the keys it wrote, by node. Under the lease only: a controller that
-// does not hold it writes nothing and says so.
-func composeModules(ctx context.Context, open *stores, nodes []string) (map[string][]string, error) {
-	out, byNode := composeModulesByNode(ctx, open, nodes)
-	names := make([]string, 0, len(byNode))
-	for n := range byNode {
-		names = append(names, n)
-	}
-	sort.Strings(names)
-	var errs []error
-	for _, n := range names {
-		errs = append(errs, byNode[n])
-	}
-	return out, errors.Join(errs...)
-}
-
-// composeModulesByNode is composeModules with each node's error apart: a failure before any node is composed is every
-// node's (the composer gives each caller only the errors of the nodes it asked for, issue 1945).
-func composeModulesByNode(ctx context.Context, open *stores, nodes []string) (map[string][]string, map[string]error) {
-	all := func(err error) (map[string][]string, map[string]error) {
-		byNode := map[string]error{}
-		for _, n := range nodes {
-			byNode[n] = err
-		}
-		return nil, byNode
-	}
-	if _, err := theLease.epoch(ctx); err != nil {
-		return all(fmt.Errorf("nothing is composed: %w", err))
-	}
-	bus, err := aBus()
-	if err != nil {
-		return all(fmt.Errorf("nothing is composed: the bus: %w", err))
-	}
-	defer bus.Close()
-	js, err := jetstream.New(bus.Conn())
-	if err != nil {
-		return all(err)
-	}
-	sign, err := controllerSigner(ctx, open)
-	if err != nil {
-		return all(fmt.Errorf("nothing is composed: the controller's signing key: %w", err))
-	}
-	fps, err := currentFingerprints(ctx, open.inventory)
-	if err != nil {
-		return all(err)
-	}
-	entries, err := open.inventory.Catalogued(ctx)
-	if err != nil {
-		return all(err)
-	}
-	manifests := make(map[string]catalogue.Manifest, len(entries))
-	for _, e := range entries {
-		manifests[e.Manifest.Module] = e.Manifest
-	}
-	upgrades, err := open.inventory.Upgrades(ctx)
-	if err != nil {
-		return all(err)
-	}
-	policy := func(module string) (string, string, string) {
-		u, ok := upgrades[module]
-		if !ok {
-			return "", "", ""
-		}
-		return u.Policy(), u.From, u.Why
-	}
-	sort.Strings(nodes)
-	out := map[string][]string{}
-	errsOf := map[string][]error{}
-	for _, node := range nodes {
-		// One composition of a node at a time in this process: two at once collided on its keys' revisions (issue 1945).
-		unlock := lockComposing(node)
-		func() {
-			defer unlock()
-			at, err := openComposedPlace(ctx, js, bus.Conn(), node)
-			if err != nil {
-				errsOf[node] = append(errsOf[node], fmt.Errorf("%s: %w", node, err))
-				return
-			}
-			at.sign, at.policy = sign, policy
-			if composeTrace != nil {
-				traceInput(ctx, open, node)
-			}
-			declared, err := composeSend(ctx, open, node)
-			if err != nil {
-				errsOf[node] = append(errsOf[node], fmt.Errorf("%s: %w", node, err))
-				return
-			}
-			body, err := compositionBody(declared)
-			if err != nil {
-				errsOf[node] = append(errsOf[node], fmt.Errorf("%s: %w", node, err))
-				return
-			}
-			// The provisioner's plans of the modules the node's composition hands to it, for the assignments mirror.
-			if err := open.inventory.RecordComposedPlans(ctx, node, plansKept(declared)); err != nil {
-				errsOf[node] = append(errsOf[node], fmt.Errorf("%s: its provisioner's plans: %w", node, err))
-			}
-			comps, moved, left, err := compositionsOf(node, body, fps, manifests, declared.modules, namedByOwnComposition(ctx, at))
-			if err != nil {
-				errsOf[node] = append(errsOf[node], fmt.Errorf("%s: %w", node, err))
-				return
-			}
-			if len(moved) > 0 {
-				fmt.Printf("compositions: %s's %s compose with the node's own: no fingerprint of the new form names them\n",
-					node, strings.Join(moved, ", "))
-			}
-			if len(left) > 0 {
-				fmt.Printf("compositions: %s's %s are left out of the node's own: the controller knows no fingerprint of the "+
-					"new form for them, and the node's want or have names their own composition (issue 1945)\n",
-					node, strings.Join(left, ", "))
-			}
-			if composeTrace != nil {
-				traceComposed(ctx, at, node, comps)
-			}
-			wrote, err := writeNodeCompositions(ctx, at, comps)
-			if len(wrote) > 0 {
-				out[node] = wrote
-				fmt.Printf("compositions: %s: wrote %s\n", node, strings.Join(wrote, ", "))
-			}
-			// And where a data-keeping provision bound each consumer: what the next resolution keeps it at (novox/hq ADR 0232).
-			if len(declared.Bindings) > 0 {
-				if err := open.inventory.RecordBindings(ctx, node, declared.Bindings); err != nil {
-					errsOf[node] = append(errsOf[node], fmt.Errorf("%s: where its consumers are bound to their data: %w", node, err))
-				}
-			}
-			if err != nil {
-				errsOf[node] = append(errsOf[node], fmt.Errorf("%s: %w", node, err))
-			}
-		}()
-	}
-	byNode := map[string]error{}
-	for node, errs := range errsOf {
-		if len(errs) > 0 {
-			byNode[node] = errors.Join(errs...)
-		}
-	}
-	return out, byNode
-}
-
-// namedByOwnComposition says a module's want or have on the node names a composition of its own: a fingerprint of the
-// new form (issue 1945).
-func namedByOwnComposition(ctx context.Context, at composedPlace) func(module string) (bool, error) {
-	return func(module string) (bool, error) {
-		if at.wanted != nil {
-			fp, err := at.wanted(ctx, module)
-			if err != nil {
-				return false, err
-			}
-			if strings.HasPrefix(fp, sdkdelivery.SourcePrefix2) {
-				return true, nil
-			}
-		}
-		if at.ran != nil {
-			h, found, err := at.ran(ctx, module)
-			if err != nil {
-				return false, err
-			}
-			if found && strings.HasPrefix(h.FP, sdkdelivery.SourcePrefix2) {
-				return true, nil
-			}
-		}
-		return false, nil
-	}
-}
-
-// composeAndSay is composeModules for an act that has nothing to do with its answer but say it: what each former send
-// of a verb or an event calls.
-func composeAndSay(ctx context.Context, open *stores, nodes []string) error {
-	if len(nodes) == 0 {
-		return nil
-	}
-	_, err := composeModules(ctx, open, nodes)
-	if err != nil {
-		fmt.Printf("compositions: %v\n", err)
-	}
-	return err
-}
-
-// openComposedPlace opens a node's buckets: its compositions, the digests, its files, and reads its want and have.
-func openComposedPlace(ctx context.Context, js jetstream.JetStream, conn *nats.Conn, node string) (composedPlace, error) {
-	if err := broker.EnsureComposed(ctx, js, node); err != nil {
-		return composedPlace{}, err
-	}
-	name, err := sdkdelivery.ComposedBucketFor(node)
-	if err != nil {
-		return composedPlace{}, err
-	}
-	bucket, err := js.KeyValue(ctx, name)
-	if err != nil {
-		return composedPlace{}, fmt.Errorf("the bucket %s: %w", name, err)
-	}
-	digests, err := js.KeyValue(ctx, sdkdelivery.ControllerComposedBucket)
-	if err != nil {
-		return composedPlace{}, fmt.Errorf("the bucket %s: %w", sdkdelivery.ControllerComposedBucket, err)
-	}
-	objects, err := openBucket(ctx, conn, node)
-	if err != nil {
-		return composedPlace{}, err
-	}
-	return composedPlace{node: node, bucket: bucket, digests: digests, objects: objects,
-		wanted: func(ctx context.Context, module string) (string, error) { return wantedOn(ctx, js, node, module) },
-		ran: func(ctx context.Context, module string) (sdkdelivery.Have, bool, error) {
-			return haveOn(ctx, js, node, module)
-		},
-		lastApplied: lastAppliedOn(js, node),
-	}, nil
-}
-
-// wantedOn is the fingerprint the assigner's want names for a module on a node; "" when there is none or the bucket is
-// not there yet.
-func wantedOn(ctx context.Context, js jetstream.JetStream, node, module string) (string, error) {
-	kv, err := js.KeyValue(ctx, sdkdelivery.AssignerWantsBucket)
-	if errors.Is(err, jetstream.ErrBucketNotFound) {
-		return "", nil
-	}
-	if err != nil {
-		return "", err
-	}
-	key, err := sdkdelivery.WantKey(node, module)
-	if err != nil {
-		return "", err
-	}
-	e, err := kv.Get(ctx, key)
-	if errors.Is(err, jetstream.ErrKeyNotFound) {
-		return "", nil
-	}
-	if err != nil {
-		return "", err
-	}
-	w, err := sdkdelivery.DecodeWant(e.Value())
-	if err != nil {
-		return "", nil // a want of release 5, naming no composition: no fingerprint a composition must be kept for
-	}
-	return w.FP, nil
-}
-
-// haveOn is what a node's node-engine says it runs of a module.
-func haveOn(ctx context.Context, js jetstream.JetStream, node, module string) (sdkdelivery.Have, bool, error) {
-	kv, err := js.KeyValue(ctx, sdkdelivery.HaveBucket)
-	if errors.Is(err, jetstream.ErrBucketNotFound) {
-		return sdkdelivery.Have{}, false, nil
-	}
-	if err != nil {
-		return sdkdelivery.Have{}, false, err
-	}
-	key, err := sdkdelivery.HaveKey(node, module)
-	if err != nil {
-		return sdkdelivery.Have{}, false, err
-	}
-	e, err := kv.Get(ctx, key)
-	if errors.Is(err, jetstream.ErrKeyNotFound) {
-		return sdkdelivery.Have{}, false, nil
-	}
-	if err != nil {
-		return sdkdelivery.Have{}, false, err
-	}
-	h, err := sdkdelivery.DecodeHave(e.Value())
-	if err != nil {
-		return sdkdelivery.Have{}, false, nil
-	}
-	return h, true, nil
-}
-
-// wantedOnTheBus is every fingerprint a want names, as `<module> <fingerprint>`: what the keep set keeps the builds of
-// (ADR 0539 clause 1). Read from the assigner's bucket on each look; no bucket yet names none.
-func wantedOnTheBus(ctx context.Context) (map[string]bool, error) {
-	bus, err := aBus()
-	if err != nil {
-		return nil, err
-	}
-	defer bus.Close()
-	js, err := jetstream.New(bus.Conn())
-	if err != nil {
-		return nil, err
-	}
-	kv, err := js.KeyValue(ctx, sdkdelivery.AssignerWantsBucket)
-	if errors.Is(err, jetstream.ErrBucketNotFound) {
-		return map[string]bool{}, nil
-	}
-	if err != nil {
-		return nil, err
-	}
-	lister, err := kv.ListKeys(ctx)
-	if errors.Is(err, jetstream.ErrNoKeysFound) {
-		return map[string]bool{}, nil
-	}
-	if err != nil {
-		return nil, err
-	}
-	out := map[string]bool{}
-	for key := range lister.Keys() {
-		_, module, err := sdkdelivery.ParseWantKey(key)
-		if err != nil {
-			continue
-		}
-		e, err := kv.Get(ctx, key)
-		if err != nil {
-			continue
-		}
-		w, err := sdkdelivery.DecodeWant(e.Value())
-		if err != nil || w.FP == "" {
-			continue
-		}
-		out[module+" "+w.FP] = true
-	}
-	return out, nil
-}
-
-// plansKept is a composition's provisioner's plans as the store keeps them: by module, each plan and what requires a
-// module only pulled in by another (design 57 P6, issue 765); nil when it hands none.
-func plansKept(d sendable) []byte {
-	if len(d.plans) == 0 {
-		return nil
-	}
-	kept := map[string]composedPlan{}
-	for module, p := range d.plans {
-		kept[module] = composedPlan{Plan: p, RequiredBy: d.requiredBy[module]}
-	}
-	raw, _ := json.Marshal(kept) // plain strings and slices: it marshals
-	return raw
-}
-
-// composedPlan is one handed module's plan as the store keeps it, the shape inventory.SentProvisioningPlans reads.
-type composedPlan struct {
-	catalogue.Plan
-	RequiredBy string `json:"required-by,omitempty"`
-}
-
-// lastAppliedOn reads, once, the declaration the node was last sent from the kept stream of declarations (the last
-// message on `mesh.node.<node>.declare`), and answers each module's slice of it (its resources that say the module, or
-// whose id names it) with the declaration's digest. None when the stream or the node's message is gone.
-func lastAppliedOn(js jetstream.JetStream, node string) func(ctx context.Context, module string) ([]json.RawMessage, string, bool, error) {
-	var once sync.Once
-	var last []byte
-	var found bool
-	var readErr error
-	return func(ctx context.Context, module string) ([]json.RawMessage, string, bool, error) {
-		once.Do(func() { last, found, readErr = lastDeclaration(ctx, js, node) })
-		if readErr != nil || !found {
-			return nil, "", false, readErr
-		}
-		return sliceOfDeclaration(last, module)
-	}
-}
-
-// lastDeclaration is the node's last signed declaration on the kept stream, as the stream holds it.
-func lastDeclaration(ctx context.Context, js jetstream.JetStream, node string) ([]byte, bool, error) {
-	stream, err := js.Stream(ctx, broker.DeclarationsStream)
-	if errors.Is(err, jetstream.ErrStreamNotFound) {
-		return nil, false, nil
-	}
-	if err != nil {
-		return nil, false, err
-	}
-	msg, err := stream.GetLastMsgForSubject(ctx, "mesh.node."+node+".declare")
-	if errors.Is(err, jetstream.ErrMsgNotFound) {
-		return nil, false, nil
-	}
-	if err != nil {
-		return nil, false, err
-	}
-	return msg.Data, true, nil
-}
-
-// sliceOfDeclaration is module's slice of a signed declaration as the stream holds it, and the digest of the
-// declaration it was signed over.
-func sliceOfDeclaration(data []byte, module string) ([]json.RawMessage, string, bool, error) {
-	var signed link.Signed
-	if err := json.Unmarshal(data, &signed); err != nil {
-		return nil, "", false, fmt.Errorf("the last declaration is not readable: %w", err)
-	}
-	var envelope struct {
-		Resources []json.RawMessage `json:"resources"`
-	}
-	if err := json.Unmarshal(signed.Declaration, &envelope); err != nil {
-		return nil, "", false, fmt.Errorf("the last declaration is not readable: %w", err)
-	}
-	sum := sha256.Sum256(signed.Declaration)
-	return sliceOfModule(envelope.Resources, module), "sha256:" + hex.EncodeToString(sum[:]), true, nil
-}
-
-// sliceOfModule is, of a declaration's resources in their order, those of module: saying it, or with no module said
-// and an id that names it (sdkdecl.ModuleGuess).
-func sliceOfModule(resources []json.RawMessage, module string) []json.RawMessage {
-	var out []json.RawMessage
-	for _, r := range resources {
-		var head struct {
-			ID     string `json:"id"`
-			Module string `json:"module"`
-		}
-		if json.Unmarshal(r, &head) != nil {
-			continue
-		}
-		owner := head.Module
-		if owner == "" {
-			owner, _ = sdkdecl.ModuleGuess(head.ID)
-		}
-		if owner == module {
-			out = append(out, r)
-		}
-	}
-	return out
-}
-
-// compositionBody is the body a node's compositions are split from: every file's content inline, never by digest, so
-// writeComposed puts each object of a file over 64 KiB in the node's bucket before it writes the composition that names
-// it (ADR 0539 §4). A send's body names those files by digest for a node that reads references, and a send put their
-// objects itself; with sends gone, a composition split from that body named objects nothing put (issue 1945, live on
-// 2026-10-25: novox's nats.bus-users).
-func compositionBody(declared sendable) ([]byte, error) {
-	declared.fileReferences = false
-	return declared.Body()
-}
-
-// composingLocks hold one composition of a node at a time in this process (issue 1945).
-var composingLocks sync.Map
-
-func lockComposing(node string) func() {
-	l, _ := composingLocks.LoadOrStore(node, &sync.Mutex{})
-	mu := l.(*sync.Mutex)
-	mu.Lock()
-	return mu.Unlock
-}

cmd/mesh-controller/composed_node_last_test.go

@@ -1,56 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"testing"
-
-	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// The node's own composition is written last, and not at all in a pass where a module's composition failed: written
-// without the resources that moved to that module, it would have the node-engine remove them while the module's own
-// composition is not there to take them (issue 1945, the review's gap 1).
-func TestTheNodesOwnIsWrittenLastAndNotAfterAModuleFailed(t *testing.T) {
-	own, _ := sdkdelivery.ComposedNodeKey("ace")
-	// "aaa" sorts before "ace.node"... and "zzz" after: the node's own must still come last.
-	a, _ := sdkdelivery.ComposedKey("ace", "aaa", fp2For('a'))
-	z, _ := sdkdelivery.ComposedKey("ace", "zzz", fp2For('b'))
-	file := func(module string) json.RawMessage {
-		return json.RawMessage(`{"id":"` + module + `.f","type":"file","module":"` + module + `","path":"/etc/` + module +
-			`","mode":"0644","content":"x"}`)
-	}
-	comps := map[string]sdkdelivery.Composed{
-		own: {Node: "ace", Resources: []json.RawMessage{}},
-		a:   {Node: "ace", Module: "aaa", FP: fp2For('a'), Resources: []json.RawMessage{file("aaa")}},
-		z:   {Node: "ace", Module: "zzz", FP: fp2For('b'), Resources: []json.RawMessage{file("zzz")}},
-	}
-	at, _, _, _ := aPlace(t, "ace")
-	wrote, err := writeNodeCompositions(context.Background(), at, comps)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(wrote) != 3 || wrote[2] != own {
-		t.Fatalf("written in the order %v, the node's own last", wrote)
-	}
-
-	// A module's composition that cannot be written: the node's own is not written in that pass.
-	at, _, _, _ = aPlace(t, "ace")
-	broken := comps[z]
-	broken.Resources = []json.RawMessage{file("other")} // a resource of another module: refused
-	comps[z] = broken
-	if _, err := writeNodeCompositions(context.Background(), at, comps); err == nil {
-		t.Fatal("a composition that cannot be written was not said")
-	}
-	if _, rev, _ := readComposed(context.Background(), at.bucket, own); rev != 0 {
-		t.Fatal("the node's own composition was written in a pass where a module's failed")
-	}
-}
-
-func fp2For(c byte) string {
-	b := make([]byte, 64)
-	for i := range b {
-		b[i] = c
-	}
-	return sdkdelivery.SourcePrefix2 + string(b)
-}

cmd/mesh-controller/composed_objects_test.go

@@ -1,102 +0,0 @@
-package main
-
-import (
-	"context"
-	"crypto/sha256"
-	"encoding/hex"
-	"strings"
-	"testing"
-
-	"encoding/json"
-
-	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
-
-	sdkdecl "git.novox.be/novox/mesh-sdk/go/declaration"
-)
-
-// A composition's file over 64 KiB reaches the node by its digest, and its object is in the node's bucket before the
-// composition is written (ADR 0539 §4; issue 1945, live on 2026-10-25 at 01:22: novox's node-engine could not fetch
-// nats.bus-users, because the body the compositions were split from already named the file by digest, so the writer
-// found no content to put, and nothing else put it once sends were gone).
-func TestALargeFileOfACompositionHasItsObjectInTheBucket(t *testing.T) {
-	big := strings.Repeat("user = x\n", sdkdecl.FileReferenceThreshold/8)
-	declared := sendable{fileReferences: true, Resources: []map[string]any{{"id": "nats.bus-users", "type": "file",
-		"path": "/var/lib/nats-module/conf/accounts.conf", "mode": "0644", "content": big}}}
-	body, err := compositionBody(declared)
-	if err != nil {
-		t.Fatal(err)
-	}
-	comps, _, _, err := compositionsOf("novox", body, nil, nil, nil, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	at, _, _, _ := aPlace(t, "novox")
-	if _, err := writeNodeCompositions(context.Background(), at, comps); err != nil {
-		t.Fatal(err)
-	}
-	sum := sha256.Sum256([]byte(big))
-	if _, ok := at.objects.(fakeObjects)[hex.EncodeToString(sum[:])]; !ok {
-		t.Fatalf("the object of nats.bus-users is not in the bucket: %d objects", len(at.objects.(fakeObjects)))
-	}
-}
-
-// A composition that names a file by a digest whose object the bucket does not hold is refused, never written: a node
-// that read it could not apply it.
-func TestACompositionNamingAnObjectTheBucketLacksIsRefused(t *testing.T) {
-	big := strings.Repeat("user = x\n", sdkdecl.FileReferenceThreshold/8)
-	declared := sendable{fileReferences: true, Resources: []map[string]any{{"id": "nats.bus-users", "type": "file",
-		"path": "/var/lib/nats-module/conf/accounts.conf", "mode": "0644", "content": big}}}
-	body, err := declared.Body() // the body as a send named it: by digest, the content gone
-	if err != nil {
-		t.Fatal(err)
-	}
-	comps, _, _, err := compositionsOf("novox", body, nil, nil, nil, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	at, _, _, _ := aPlace(t, "novox")
-	if _, err := writeNodeCompositions(context.Background(), at, comps); err == nil ||
-		!strings.Contains(err.Error(), "does not hold") {
-		t.Fatalf("a composition naming a missing object was written: %v", err)
-	}
-}
-
-// Every file the provisioner fills stays filled in the compositions, a moved module's too: the node's own composition
-// carries the path, so the node-engine leaves its content to the provisioner (issue 1945, live on 2026-10-25 at 01:22:
-// ace's node-engine wrote claude-code's, node-env's and power's filled files empty, because the compositions dropped the
-// filled paths of every module moved into the node's own, and their resources say no content).
-func TestEveryFilledFileStaysFilledInTheCompositions(t *testing.T) {
-	for _, node := range []string{"ace", "g14"} {
-		body, fps := capturedBody(t, node)
-		var d struct {
-			Filled []string `json:"filled_files"`
-		}
-		if err := json.Unmarshal(body, &d); err != nil || len(d.Filled) == 0 {
-			t.Fatalf("%s: the captured declaration fills nothing (%v)", node, err)
-		}
-		// power, claude-code and node-env have no fingerprint of the new form, so they move into the node's own.
-		for _, m := range []string{"power", "claude-code", "node-env"} {
-			delete(fps, m)
-		}
-		comps, _, _, err := compositionsOf(node, body, fps, nil, nil, nil)
-		if err != nil {
-			t.Fatalf("%s: %v", node, err)
-		}
-		filled := map[string]bool{}
-		for _, c := range comps {
-			for _, p := range c.Filled {
-				filled[p] = true
-			}
-		}
-		for _, p := range d.Filled {
-			if !filled[p] {
-				t.Errorf("%s: %s is filled by the provisioner, and no composition says so", node, p)
-			}
-		}
-		for key, c := range comps {
-			if _, err := sdkdelivery.EncodeComposed(c); err != nil {
-				t.Errorf("%s: %s: %v", node, key, err)
-			}
-		}
-	}
-}

cmd/mesh-controller/composed_operator_keys_test.go

@@ -1,58 +0,0 @@
-package main
-
-import (
-	"encoding/json"
-	"os"
-	"strings"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/compose"
-	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// 1945/AC13: the node-engine's composition on a node carries the operator's public keys as its file operator-keys,
-// from its setting operator-signers, beside the controller's key it already trusts (ADR 0539 clause 3, decided with the
-// lead 2026-10-24: the switch's last declaration carries it because today's controller composes the same file from
-// the same manifest). The manifest is mesh-host's module.json at 20d0998c (testdata/mesh-host-module.json), never
-// typed by hand.
-func TestTheNodeEnginesCompositionCarriesTheOperatorsKeys(t *testing.T) {
-	raw, err := os.ReadFile("testdata/mesh-host-module.json")
-	if err != nil {
-		t.Fatal(err)
-	}
-	var m catalogue.Manifest
-	if err := json.Unmarshal(raw, &m); err != nil {
-		t.Fatal(err)
-	}
-	// Its archive names a build artifact, which only its registration turns into a reference: left out here, the rest of
-	// the manifest as captured.
-	var kept []map[string]any
-	for _, r := range m.Resources {
-		if r["type"] != "archive" {
-			kept = append(kept, r)
-		}
-	}
-	m.Resources = kept
-	const key = "MCowBQYDK2VwAyEAb3BlcmF0b3Itc2lnbmluZy1rZXktZm9yLXRlc3RzLW9ubHk="
-	in := compose.Input{Catalogue: map[string]catalogue.Manifest{m.Module: m},
-		Nodes: []compose.Node{{Name: "ace", Assigned: []string{m.Module}, Stated: true,
-			Settings: map[string][]catalogue.Layer{m.Module: {{From: "mesh", Values: map[string]any{"operator-signers": key}}}}}}}
-	fp := sdkdelivery.SourcePrefix2 + strings.Repeat("6", 64)
-	all, _, err := compose.Compositions(in, "ace", map[string]string{m.Module: fp}, compose.Reading)
-	if err != nil {
-		t.Fatal(err)
-	}
-	k, _ := sdkdelivery.ComposedKey("ace", m.Module, fp)
-	var file struct{ Path, Content string }
-	for _, r := range all[k].Resources {
-		var head struct{ ID, Path, Content string }
-		_ = json.Unmarshal(r, &head)
-		if strings.HasSuffix(head.ID, "operator-keys") {
-			file.Path, file.Content = head.Path, head.Content
-		}
-	}
-	if file.Path != "/var/lib/mesh-host/operator-keys" || file.Content != key+"\n" {
-		t.Errorf("the node-engine's composition carries operator-keys at %q with %q, want the operator's key", file.Path, file.Content)
-	}
-}

cmd/mesh-controller/composed_plans_test.go

@@ -1,29 +0,0 @@
-package main
-
-import (
-	"encoding/json"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-)
-
-// 1945 (dev-r6-controller's finding): the provisioner's plans a composition hands are kept in the shape the
-// assignments mirror reads (inventory.SentProvisioningPlans: each module's plan and what requires it), and a
-// composition that hands none keeps none.
-func TestAComposedNodesProvisionerPlansAreKept(t *testing.T) {
-	if plansKept(sendable{}) != nil {
-		t.Errorf("a composition that hands nothing kept plans")
-	}
-	d := sendable{plans: map[string]catalogue.Plan{"umami": {Placement: map[string]string{"dir:state": "/var/lib/umami"}}},
-		requiredBy: map[string]string{"umami": "analytics"}}
-	var kept map[string]struct {
-		Placement  map[string]string `json:"placement"`
-		RequiredBy string            `json:"required-by"`
-	}
-	if err := json.Unmarshal(plansKept(d), &kept); err != nil {
-		t.Fatal(err)
-	}
-	if kept["umami"].Placement["dir:state"] != "/var/lib/umami" || kept["umami"].RequiredBy != "analytics" {
-		t.Errorf("kept %+v", kept)
-	}
-}

cmd/mesh-controller/composed_rejudge.go

@@ -1,169 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"fmt"
-
-	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
-	"github.com/nats-io/nats.go/jetstream"
-)
-
-// The judgement beside each composition is rewritten when what it is judged against or with changes (novox/hq ADR
-// 0539 clauses 2 and 14): when the node's have of the module changes (it runs another composition, or holds), and when
-// a person sets the module's policy. Heard as the have bucket's writes and the `upgrade` verb, never on a timer.
-
-// rejudge writes again the judgement and policy beside every composition of module on the node at, where they differ.
-func rejudge(ctx context.Context, at composedPlace, module string) (int, error) {
-	lister, err := at.bucket.ListKeys(ctx)
-	if errors.Is(err, jetstream.ErrNoKeysFound) {
-		return 0, nil
-	}
-	if err != nil {
-		return 0, err
-	}
-	wrote := 0
-	var errs []error
-	for key := range lister.Keys() {
-		node, m, _, isNode, err := sdkdelivery.ParseComposedKey(key)
-		if err != nil || isNode || node != at.node || m != module {
-			continue
-		}
-		c, revision, err := readComposed(ctx, at.bucket, key)
-		if err != nil || revision == 0 {
-			continue
-		}
-		c.Signature = nil
-		digest, err := sdkdelivery.ComposedDigestOf(c)
-		if err != nil {
-			continue
-		}
-		judged, err := judgeMove(ctx, at, key, c, digest)
-		if err != nil {
-			errs = append(errs, err)
-			continue
-		}
-		w, err := keepDigest(ctx, at.digests, key, judged)
-		if err != nil {
-			errs = append(errs, err)
-		}
-		if w {
-			wrote++
-		}
-	}
-	return wrote, errors.Join(errs...)
-}
-
-// rejudgeOn opens the node's buckets and rejudges module there, under the lease.
-func rejudgeOn(ctx context.Context, open *stores, nodes []string, module string) error {
-	if _, err := theLease.epoch(ctx); err != nil {
-		return err
-	}
-	bus, err := aBus()
-	if err != nil {
-		return err
-	}
-	defer bus.Close()
-	js, err := jetstream.New(bus.Conn())
-	if err != nil {
-		return err
-	}
-	upgrades, err := open.inventory.Upgrades(ctx)
-	if err != nil {
-		return err
-	}
-	var errs []error
-	for _, node := range nodes {
-		at, err := openComposedPlace(ctx, js, bus.Conn(), node)
-		if err != nil {
-			errs = append(errs, err)
-			continue
-		}
-		at.policy = func(m string) (string, string, string) {
-			u, ok := upgrades[m]
-			if !ok {
-				return "", "", ""
-			}
-			return u.Policy(), u.From, u.Why
-		}
-		if _, err := rejudge(ctx, at, module); err != nil {
-			errs = append(errs, err)
-		}
-	}
-	return errors.Join(errs...)
-}
-
-// rejudgeModule rejudges a module on every node it is assigned to: what a person's policy changes.
-func rejudgeModule(ctx context.Context, open *stores, module string) {
-	entries, err := open.inventory.Catalogued(ctx)
-	if err != nil {
-		fmt.Printf("compositions: %s's policy is not written beside its compositions: %v\n", module, err)
-		return
-	}
-	for _, e := range entries {
-		if e.Manifest.Module == module && len(e.On) > 0 {
-			if err := rejudgeOn(ctx, open, e.On, module); err != nil {
-				fmt.Printf("compositions: %s's policy is not written beside its compositions: %v\n", module, err)
-			}
-		}
-	}
-}
-
-// watchHavesForJudgement rejudges a node's module each time its have changes, until ctx ends: never on the watch's own
-// goroutine.
-func watchHavesForJudgement(ctx context.Context, open *stores) {
-	bus, err := aBus()
-	if err != nil {
-		fmt.Printf("compositions: the haves are not watched: %v\n", err)
-		return
-	}
-	js, err := jetstream.New(bus.Conn())
-	if err != nil {
-		bus.Close()
-		return
-	}
-	kv, err := js.KeyValue(ctx, sdkdelivery.HaveBucket)
-	if err != nil {
-		bus.Close()
-		fmt.Printf("compositions: the haves are not watched: %v\n", err)
-		return
-	}
-	w, err := kv.WatchAll(ctx, jetstream.UpdatesOnly())
-	if err != nil {
-		bus.Close()
-		fmt.Printf("compositions: the haves are not watched: %v\n", err)
-		return
-	}
-	goServing(ctx, func() {
-		defer bus.Close()
-		defer w.Stop()
-		for {
-			select {
-			case <-ctx.Done():
-				return
-			case e, ok := <-w.Updates():
-				if !ok {
-					return
-				}
-				if e == nil || e.Operation() != jetstream.KeyValuePut {
-					continue
-				}
-				node, module, isNode, err := sdkdelivery.ParseHaveKey(e.Key())
-				if err != nil || isNode {
-					continue
-				}
-				inBackground(ctx, func() {
-					if err := rejudgeOn(ctx, open, []string{node}, module); err != nil {
-						fmt.Printf("compositions: %s on %s is not judged again: %v\n", module, node, err)
-					}
-					// A node's node-engine moved: the declarations' stream goes once every node runs the new one.
-					if module == nodeEngineModule {
-						if _, err := retireDeclarations(ctx, open); err != nil {
-							fmt.Printf("compositions: whether the declarations' stream may go cannot be read: %v\n", err)
-						}
-					}
-				})
-			}
-		}
-	})
-}

cmd/mesh-controller/composed_served_integration_test.go

@@ -1,618 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"net/url"
-	"os"
-	"path/filepath"
-	"strings"
-	"sync"
-	"testing"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/overlay"
-	"github.com/nats-io/nats-server/v2/server"
-	"github.com/nats-io/nats.go"
-	"github.com/nats-io/nats.go/jetstream"
-	"golang.org/x/crypto/bcrypt"
-
-	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/builderkeys"
-	"github.com/novox/mesh-controller/internal/chain"
-	"github.com/novox/mesh-controller/internal/identity"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// The compositions through the controller whole (novox/hq ADR 0539; the review's G1): the real store, the controller's
-// signing key, and a bus that runs the user list the controller composes from that store, so a subject release 6 uses
-// and the list does not grant is refused as it would be on the mesh. serve() runs whole on it; the builder and the
-// indexer are their own accounts writing their own keys; a rotation is the operator's verb.
-type servedMesh struct {
-	open       *stores
-	controller jetstream.JetStream
-	builder    jetstream.JetStream
-	indexer    jetstream.JetStream
-}
-
-// keyOfManifest is a done key of a module at fp with no artifacts, its manifest the given one, and the indexer's trunk
-// value naming it in the catalogue's repository at commit.
-func keyOfManifest(t *testing.T, m catalogue.Manifest, fp, commit string) (raw []byte, k sdkdelivery.BuilderBuild, trunk sdkdelivery.Module) {
-	t.Helper()
-	raw, err := json.Marshal(m)
-	if err != nil {
-		t.Fatal(err)
-	}
-	digest := sdkdelivery.ManifestDigest(raw)
-	return raw, sdkdelivery.BuilderBuild{State: sdkdelivery.BuildDone, By: "anchor", Manifest: digest},
-		sdkdelivery.Module{FP2: fp, Manifest: digest, Repository: "novox/mesh-catalog", Commit: commit, Path: "modules/" + m.Module}
-}
-
-func aServedMesh(t *testing.T) *servedMesh {
-	t.Helper()
-	open := theCatalogue(t)
-	ctx := t.Context()
-	inv := open.inventory
-	withTrunkList(t, true)
-	ident := identity.ForTest(t)
-	if _, err := ident.Establish(ctx); err != nil {
-		t.Fatal(err)
-	}
-
-	// The bus, running the user list the controller composes from the store, with the builder and the indexer as the
-	// accounts their own manifests make (each writes its own state).
-	records, err := inv.BusRecords(ctx)
-	if err != nil {
-		t.Fatal(err)
-	}
-	users, err := broker.Users(records)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var controller broker.Principal
-	for _, p := range users {
-		if p.Kind == broker.KindController {
-			controller = p
-		}
-	}
-	password, err := inv.MintBusPassword(ctx, inventory.BusUser{Username: controller.Username(), Kind: inventory.BusController})
-	if err != nil {
-		t.Fatal(err)
-	}
-	builder := broker.Principal{Kind: broker.KindModule, Node: "anchor", Module: sdkdelivery.BuilderModule, State: []string{"builds"}}
-	indexer := broker.Principal{Kind: broker.KindModule, Node: "anchor", Module: sdkdelivery.IndexerModule, State: []string{"modules", "manifests"}}
-	kept, err := inv.BusUsers(ctx)
-	if err != nil {
-		t.Fatal(err)
-	}
-	hashes := map[string]string{}
-	for name, u := range kept {
-		hashes[name] = u.PasswordHash
-	}
-	fixture, _ := bcrypt.GenerateFromPassword([]byte("pw"), bcrypt.MinCost)
-	hashes[builder.Username()], hashes[indexer.Username()] = string(fixture), string(fixture)
-	filled, missing := broker.WithPasswords([]broker.Principal{controller, builder, indexer}, hashes)
-	if len(missing) > 0 {
-		t.Fatalf("no password for %v", missing)
-	}
-	accounts, err := broker.ComposeAccounts(filled)
-	if err != nil {
-		t.Fatal(err)
-	}
-	conf := filepath.Join(t.TempDir(), "bus.conf")
-	if err := os.WriteFile(conf, []byte("listen: 127.0.0.1:-1\njetstream { store_dir: "+`"`+t.TempDir()+`"`+" }\n"+accounts), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	opts, err := server.ProcessConfigFile(conf)
-	if err != nil {
-		t.Fatalf("the composed user list does not parse: %v", err)
-	}
-	opts.NoLog, opts.NoSigs = true, true
-	s, err := server.NewServer(opts)
-	if err != nil {
-		t.Fatal(err)
-	}
-	go s.Start()
-	if !s.ReadyForConnections(10 * time.Second) {
-		t.Fatal("the bus did not come up")
-	}
-	t.Cleanup(s.Shutdown)
-	u, _ := url.Parse(s.ClientURL())
-	u.User = url.UserPassword(controller.Username(), password)
-	t.Setenv(broker.NATSVar, u.String())
-
-	connect := func(user, pw string) jetstream.JetStream {
-		t.Helper()
-		nc, err := nats.Connect(s.ClientURL(), nats.UserInfo(user, pw), nats.CustomInboxPrefix("_INBOX."+user))
-		if err != nil {
-			t.Fatalf("%s cannot connect: %v", user, err)
-		}
-		t.Cleanup(nc.Close)
-		js, err := jetstream.New(nc)
-		if err != nil {
-			t.Fatal(err)
-		}
-		return js
-	}
-	m := &servedMesh{open: open, controller: connect(controller.Username(), password),
-		builder: connect(builder.Username(), "pw"), indexer: connect(indexer.Username(), "pw")}
-
-	// The test's own inventory on the bus's chain, as the serving controller's will be: what is registered and assigned
-	// below is in the chain it reads (assignments and builds live on the bus, ADR 0408).
-	chainConn, err := nats.Connect(s.ClientURL(), nats.UserInfo(controller.Username(), password),
-		nats.CustomInboxPrefix("_INBOX."+controller.Username()))
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(chainConn.Close)
-	// The controller's own buckets, the chain's among them, as it asserts them at its start.
-	asserter, err := broker.Dial(u.String())
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(asserter.Close)
-	if err := asserter.EnsureControllerBuckets(); err != nil {
-		t.Fatalf("the controller's buckets: %v", err)
-	}
-	c, err := chain.OnTheBus(ctx, chainConn, func(context.Context) error { return nil })
-	if err != nil {
-		t.Fatal(err)
-	}
-	inv.UseChain(c)
-
-	// A provider and its consumer (bindings_test.go's store and board), registered from done keys of the catalogue's
-	// repository, so each has a fingerprint of the new form; the store holds the mesh's seat on anchor, the board on
-	// laptop is bound to it.
-	shelf := map[string]catalogue.Manifest{}
-	for _, m := range storeManifests() {
-		shelf[m.Module] = m
-	}
-	// The board is given its credential in a file, as a consumer of a database is.
-	board := shelf["board"]
-	board.Secrets = map[string]string{"postgres-database": "/var/lib/board/database-password"}
-	shelf["board"] = board
-	for i, module := range []string{"store", "board"} {
-		raw, k, trunk := keyOfManifest(t, shelf[module], fpOf(byte('a'+i)), "c0ffee0123456789")
-		keys := trunkKeys{keyBuckets: keyBuckets{keys: map[string]builderkeys.Key{module: aBuilderKey(module, trunk.FP2, k)},
-			manifests: map[string]string{trunk.Manifest: string(raw)}}, trunk: trunk}
-		if _, _, err := takeInKey(ctx, inv, keys, keyTake{Module: module, Trunk: trunk, Ask: registrationAsk{Merge: trunk.Commit}}); err != nil {
-			t.Fatalf("%s is not registered from its key: %v", module, err)
-		}
-	}
-	// The private network on both machines, as aMesh assigns it, now on the chain the controller reads.
-	for _, node := range []string{"anchor", "laptop"} {
-		if _, err := inv.Assign(ctx, node, overlay.Name); err != nil {
-			t.Fatal(err)
-		}
-	}
-	if _, err := inv.SeedSeats(ctx, catalogue.DefaultSeats()); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := inv.Assign(ctx, "anchor", "store"); err != nil {
-		t.Fatal(err)
-	}
-	if err := inv.HoldSeat(ctx, "mesh-store", catalogue.ScopeMesh, "anchor", "store"); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := inv.Assign(ctx, "laptop", "board"); err != nil {
-		t.Fatal(err)
-	}
-	if err := inv.PinProvision(ctx, "laptop", "postgres-database", "anchor", "store"); err != nil {
-		t.Fatal(err)
-	}
-
-	// The builder's and the indexer's buckets as their own parts make them, there before the controller starts (its
-	// watch of their keys begins at its start); and the plans' buckets a controller of release 5 left.
-	for _, b := range []string{sdkdelivery.BuilderBuildsBucket, sdkdelivery.ModulesBucket, sdkdelivery.ManifestsBucket} {
-		if _, err := m.controller.CreateKeyValue(ctx, jetstream.KeyValueConfig{Bucket: b, History: 5}); err != nil {
-			t.Fatalf("the bucket %s: %v", b, err)
-		}
-	}
-	for _, b := range broker.PlanStateBuckets {
-		if _, err := m.controller.CreateKeyValue(ctx, jetstream.KeyValueConfig{Bucket: b}); err != nil {
-			t.Fatal(err)
-		}
-	}
-
-	keepWhatServeSets(t)
-	serving, stop := context.WithCancel(context.Background())
-	done := make(chan error, 1)
-	go func() { done <- serve(serving) }()
-	t.Cleanup(func() {
-		stop()
-		select {
-		case <-done:
-		case <-time.After(30 * time.Second):
-			t.Log("the controller did not stop within 30 s")
-		}
-		// A stopping controller refuses every verb from then on as a handover (issue 289), which its process exits
-		// after; this one is the test process, so a later test's verb would be refused without running (issue 1945:
-		// the conditions verb's own process was never started). Its stop marks it once the serving context ends.
-		for deadline := time.Now().Add(5 * time.Second); !handingOver.Load() && time.Now().Before(deadline); {
-			time.Sleep(10 * time.Millisecond)
-		}
-		handingOver.Store(false)
-	})
-	// Served once both nodes have their own composition and their module's: the start's pass wrote them all. A node's
-	// compositions are written in key order, so anchor's own comes before its store's (issue 1945: a test that reads the
-	// revisions at once must not catch the pass midway).
-	for _, k := range []struct{ node, module, fp string }{{"anchor", "", ""}, {"laptop", "", ""}, {"anchor", "store", fpOf('a')},
-		{"laptop", "board", fpOf('b')}} {
-		key, _ := sdkdelivery.ComposedNodeKey(k.node)
-		if k.module != "" {
-			key, _ = sdkdelivery.ComposedKey(k.node, k.module, k.fp)
-		}
-		m.waitFor(t, done, k.node, key, 0)
-	}
-	return m
-}
-
-// aBuilderKey is the builder's done key of module at fp, as the take-in reads it.
-func aBuilderKey(module, fp string, b sdkdelivery.BuilderBuild) builderkeys.Key {
-	return builderkeys.Key{Module: module, Fingerprint: fp, Found: true, Revision: 1, Build: b}
-}
-
-// waitFor waits until the node's composition bucket holds key at a revision above after, failing when the controller
-// stops or a minute passes: a test's wait for what an event made, never a loop of the code under test.
-func (m *servedMesh) waitFor(t *testing.T, done chan error, node, key string, after uint64) uint64 {
-	t.Helper()
-	bucket, _ := sdkdelivery.ComposedBucketFor(node)
-	deadline := time.Now().Add(time.Minute)
-	for time.Now().Before(deadline) {
-		select {
-		case err := <-done:
-			t.Fatalf("the controller stopped: %v", err)
-		default:
-		}
-		if kv, err := m.controller.KeyValue(t.Context(), bucket); err == nil {
-			if e, err := kv.Get(t.Context(), key); err == nil && e.Revision() > after {
-				return e.Revision()
-			}
-		}
-		time.Sleep(200 * time.Millisecond)
-	}
-	t.Fatalf("%s in %s was not written within a minute; %s", key, bucket, m.whatIsThere(t, node))
-	return 0
-}
-
-// whatIsThere says, for a failure, what the node's bucket holds, the ids its own composition carries and the
-// fingerprints the controller has registered.
-func (m *servedMesh) whatIsThere(t *testing.T, node string) string {
-	t.Helper()
-	bucket, _ := sdkdelivery.ComposedBucketFor(node)
-	out := "keys:"
-	kv, err := m.controller.KeyValue(context.Background(), bucket)
-	if err != nil {
-		return out + " " + err.Error()
-	}
-	lister, err := kv.ListKeys(context.Background())
-	if err == nil {
-		for k := range lister.Keys() {
-			out += " " + k
-		}
-	}
-	if lister, err := kv.ListKeys(context.Background()); err == nil {
-		for k := range lister.Keys() {
-			if e, err := kv.Get(context.Background(), k); err == nil {
-				if c, err := sdkdelivery.DecodeComposed(e.Value()); err == nil {
-					out += fmt.Sprintf("; %s at revision %d carries", k, e.Revision())
-					for _, r := range c.Resources {
-						var head struct{ ID string }
-						_ = json.Unmarshal(r, &head)
-						out += " " + head.ID
-					}
-				}
-			}
-		}
-	}
-	holders, herr := m.open.inventory.HoldersOf(context.Background(), "postgres-database", "")
-	out += fmt.Sprintf("; holders of postgres-database: %+v (%v)", holders, herr)
-	own, _ := sdkdelivery.ComposedNodeKey(node)
-	if e, err := kv.Get(context.Background(), own); err == nil {
-		if c, err := sdkdelivery.DecodeComposed(e.Value()); err == nil {
-			out += "; its own carries:"
-			for _, r := range c.Resources {
-				var head struct{ ID string }
-				_ = json.Unmarshal(r, &head)
-				out += " " + head.ID
-			}
-		}
-	}
-	fps, err := currentFingerprints(context.Background(), m.open.inventory)
-	out += fmt.Sprintf("; fingerprints registered: %v (%v)", fps, err)
-	// And what composing the node says now, in this process, under the serving controller's lease.
-	_, cerr := composeModules(context.Background(), m.open, []string{node})
-	return out + fmt.Sprintf("; composing %s now: %v", node, cerr)
-}
-
-// revisions are a node's composition keys and their revisions.
-func (m *servedMesh) revisions(t *testing.T, node string) map[string]uint64 {
-	t.Helper()
-	bucket, _ := sdkdelivery.ComposedBucketFor(node)
-	kv, err := m.controller.KeyValue(t.Context(), bucket)
-	if err != nil {
-		t.Fatal(err)
-	}
-	lister, err := kv.ListKeys(t.Context())
-	if err != nil {
-		t.Fatal(err)
-	}
-	out := map[string]uint64{}
-	for k := range lister.Keys() {
-		if e, err := kv.Get(t.Context(), k); err == nil {
-			out[k] = e.Revision()
-		}
-	}
-	return out
-}
-
-// declarationsSent is how many declarations the bus's stream of them holds: none is ever sent in release 6.
-func (m *servedMesh) declarationsSent(t *testing.T) uint64 {
-	t.Helper()
-	s, err := m.controller.Stream(t.Context(), broker.DeclarationsStream)
-	if errors.Is(err, jetstream.ErrStreamNotFound) {
-		return 0
-	}
-	if err != nil {
-		t.Fatal(err)
-	}
-	info, err := s.Info(t.Context())
-	if err != nil {
-		t.Fatal(err)
-	}
-	return info.State.Msgs
-}
-
-// 1945/AC6, AC14: started whole on a bus running its own user list, the controller composes every node and every
-// assigned module, deletes the plans' buckets and says each as bucket-deleted, and sends no declaration.
-func TestServedTheStartComposesEveryNodeAndDeletesThePlansBuckets(t *testing.T) {
-	m := aServedMesh(t)
-	for _, k := range []struct{ node, module string }{{"anchor", "store"}, {"laptop", "board"}} {
-		fp := map[string]string{"store": fpOf('a'), "board": fpOf('b')}[k.module]
-		key, _ := sdkdelivery.ComposedKey(k.node, k.module, fp)
-		m.waitFor(t, nil, k.node, key, 0)
-	}
-	for _, b := range broker.PlanStateBuckets {
-		if _, err := m.controller.KeyValue(t.Context(), b); !errors.Is(err, jetstream.ErrBucketNotFound) {
-			t.Errorf("%s is still there: %v", b, err)
-		}
-	}
-	if n := m.declarationsSent(t); n != 0 {
-		t.Errorf("%d declarations were sent", n)
-	}
-}
-
-// 1945/AC3: the builder writes the done key of a new fingerprint of an assigned module and the indexer its trunk
-// value: the controller, hearing the keys, registers it, writes its composition on the node it is assigned to and
-// `grants.<module>.<fp>`; nothing is sent.
-func TestServedADoneKeyIsComposedAndGranted(t *testing.T) {
-	m := aServedMesh(t)
-	ctx := t.Context()
-	shelf := map[string]catalogue.Manifest{}
-	for _, mf := range storeManifests() {
-		shelf[mf.Module] = mf
-	}
-	next := shelf["board"]
-	next.Secrets = map[string]string{"postgres-database": "/var/lib/board/database-password"}
-	next.Version = "2"
-	fp := fpOf('c')
-	raw, k, trunk := keyOfManifest(t, next, fp, "d00d0123456789ab")
-	manifests, err := m.indexer.KeyValue(ctx, sdkdelivery.ManifestsBucket)
-	if err != nil {
-		t.Fatal(err)
-	}
-	value, _ := sdkdelivery.EncodeManifest(sdkdelivery.Manifest{Module: "board", JSON: string(raw)})
-	if _, err := manifests.Put(ctx, trunk.Manifest, value); err != nil {
-		t.Fatalf("the indexer cannot write its manifest: %v", err)
-	}
-	builds, err := m.builder.KeyValue(ctx, sdkdelivery.BuilderBuildsBucket)
-	if err != nil {
-		t.Fatal(err)
-	}
-	key, _ := sdkdelivery.BuilderBuildKey("board", fp)
-	value, _ = sdkdelivery.EncodeBuilderBuild(k)
-	if _, err := builds.Put(ctx, key, value); err != nil {
-		t.Fatalf("the builder cannot write its key: %v", err)
-	}
-	modules, err := m.indexer.KeyValue(ctx, sdkdelivery.ModulesBucket)
-	if err != nil {
-		t.Fatal(err)
-	}
-	mk, _ := sdkdelivery.ModulesKey("board")
-	value, _ = sdkdelivery.EncodeModule(trunk)
-	if _, err := modules.Put(ctx, mk, value); err != nil {
-		t.Fatalf("the indexer cannot write its trunk value: %v", err)
-	}
-	composed, _ := sdkdelivery.ComposedKey("laptop", "board", fp)
-	m.waitFor(t, nil, "laptop", composed, 0)
-	grants, err := m.controller.KeyValue(ctx, broker.GrantsBucket)
-	if err != nil {
-		t.Fatal(err)
-	}
-	gk, _ := sdkdelivery.ControllerGrantKey("board", fp)
-	// The take-in writes the grant after the compositions (composed_keys.go), so it is waited for, not read in the instant
-	// the composition shows: a loaded build node read it a moment early (issue 1945).
-	becomes(t, 10*time.Second, "grants."+gk+" written", func() bool {
-		_, err := grants.Get(ctx, gk)
-		return err == nil
-	})
-	if n := m.declarationsSent(t); n != 0 {
-		t.Errorf("%d declarations were sent", n)
-	}
-}
-
-// 1945/AC2: the operator rotates the store's credential, the real verb: the compositions that carry it (the store's
-// grants on anchor, and the board's on laptop when it carries the credential) get a new revision, every other
-// composition keeps its own, and nothing is sent.
-func TestServedARotationRewritesOnlyTheCompositionsThatUseIt(t *testing.T) {
-	m := aServedMesh(t)
-	// Everything that writes or discards a credential row, and what composing each node saw and decided, in order, with the
-	// callers: one failure shows the cause (issue 1945).
-	var traceMu sync.Mutex
-	var trace []string
-	note := func(line string) {
-		traceMu.Lock()
-		defer traceMu.Unlock()
-		trace = append(trace, time.Now().Format("15:04:05.000")+" "+line)
-	}
-	inventory.SecretTrace = func(op, what string) { note("secret " + op + ": " + what) }
-	composeTrace = func(line string) { note("compose " + line) }
-	t.Cleanup(func() { inventory.SecretTrace, composeTrace = nil, nil })
-	traced := func() string {
-		traceMu.Lock()
-		defer traceMu.Unlock()
-		return strings.Join(trace, "\n    ")
-	}
-	defer func() {
-		if t.Failed() {
-			t.Logf("TRACE\n    %s", traced())
-		}
-	}()
-	before := map[string]map[string]uint64{"anchor": m.revisions(t, "anchor"), "laptop": m.revisions(t, "laptop")}
-	holders, _ := m.open.inventory.HoldersOf(t.Context(), "postgres-database", "")
-	var waited uint64
-	// The verb runs here as its child process runs it: its inventory takes the chain from the bus the served controller keeps it
-	// on (the registrations and assignments are there), not the one in memory the fixture's store was made with.
-	inventory.OnTheBusChainForTest(t)
-	said, err := capturedOutput(func() error {
-		if err := rotateCommand(t.Context(), []string{"postgres-database"}); err != nil {
-			return err
-		}
-		// The serving controller's own lines while the rotation lands are captured too.
-		boardKey, _ := sdkdelivery.ComposedKey("laptop", "board", fpOf('b'))
-		waited = m.waitForOrSay(t, "laptop", boardKey, before["laptop"][boardKey])
-		return nil
-	})
-	if err != nil {
-		t.Fatalf("rotate: %v\n%s", err, said)
-	}
-	t.Logf("rotate said (holders before: %+v):\n%s", holders, said)
-	defer func() {
-		if t.Failed() {
-			t.Logf("rotate said:\n%s", said)
-		}
-	}()
-	boardKey, _ := sdkdelivery.ComposedKey("laptop", "board", fpOf('b'))
-	storeKey, _ := sdkdelivery.ComposedKey("anchor", "store", fpOf('a'))
-	// The board's sealed credential file is new: its composition moves with the rotation.
-	if rev := waited; rev == 0 {
-		var kept []string
-		for _, line := range strings.Split(said, "\n") {
-			for _, w := range []string{"board", "postgres", "secret", "credential", "laptop", "withdr", "retir", "error", "refused"} {
-				if strings.Contains(line, w) {
-					kept = append(kept, line)
-					break
-				}
-			}
-		}
-		said = strings.Join(kept, " | ")
-		after, _ := m.open.inventory.HoldersOf(t.Context(), "postgres-database", "")
-		in, ierr := inputFor(t.Context(), m.open)
-		var credentials string
-		if ierr == nil {
-			credentials = fmt.Sprintf("would make %+v; credentials %+v", in.wouldMake, in.Credentials)
-		}
-		state, serr := m.open.inventory.PairCredentialState(t.Context(), inventory.PairCredential{Name: "postgres-database",
-			Consumer: "laptop", ConsumerModule: "board", Provider: "anchor"})
-		d, derr := composeSend(t.Context(), m.open, "laptop")
-		var sealed []string
-		for _, r := range d.Resources {
-			if r["id"] == "board.secret-postgres-database" {
-				sealed = append(sealed, fmt.Sprint(r["sealed"])[:min(24, len(fmt.Sprint(r["sealed"])))])
-			}
-		}
-		diag := fmt.Sprintf("state %+v %v; compose now %v sealed %v; %s %v", state, serr, derr, sealed, credentials, ierr)
-		// One line: the verdict keeps only a failure's first line (issue 1921).
-		t.Fatalf("the board's composition did not move within a minute after the rotation (revision before %d); TRACE %s; LINES %s; "+
-			"holders before %+v, after %+v; DIAG %s; %s", before["laptop"][boardKey],
-			strings.Join(strings.Fields(strings.ReplaceAll(traced(), "\n", " | ")), " "), strings.Join(strings.Fields(said), " "),
-			holders, after, diag, strings.Join(strings.Fields(m.whatIsThere(t, "laptop")), " "))
-	}
-	moved := map[string]bool{}
-	for node, was := range before {
-		for k, rev := range m.revisions(t, node) {
-			if rev != was[k] {
-				moved[k] = true
-			}
-		}
-	}
-	for k := range moved {
-		if k != boardKey && k != storeKey {
-			t.Errorf("%s moved: only the compositions carrying the credential do", k)
-		}
-	}
-	if !moved[boardKey] {
-		t.Errorf("the board's composition did not move: %v", moved)
-	}
-	if n := m.declarationsSent(t); n != 0 {
-		t.Errorf("%d declarations were sent", n)
-	}
-}
-
-// waitForOrSay is waitFor that answers 0 instead of failing, for a caller that says more.
-func (m *servedMesh) waitForOrSay(t *testing.T, node, key string, after uint64) uint64 {
-	t.Helper()
-	bucket, _ := sdkdelivery.ComposedBucketFor(node)
-	deadline := time.Now().Add(time.Minute)
-	for time.Now().Before(deadline) {
-		if kv, err := m.controller.KeyValue(t.Context(), bucket); err == nil {
-			if e, err := kv.Get(t.Context(), key); err == nil && e.Revision() > after {
-				return e.Revision()
-			}
-		}
-		time.Sleep(200 * time.Millisecond)
-	}
-	return 0
-}
-
-// capturedOutput runs act with this process's standard output captured, and answers what it printed.
-func capturedOutput(act func() error) (string, error) {
-	r, w, err := os.Pipe()
-	if err != nil {
-		return "", act()
-	}
-	was := os.Stdout
-	os.Stdout = w
-	done := make(chan string)
-	go func() {
-		var b strings.Builder
-		buf := make([]byte, 4096)
-		for {
-			n, err := r.Read(buf)
-			b.Write(buf[:n])
-			if err != nil {
-				break
-			}
-		}
-		done <- b.String()
-	}()
-	actErr := act()
-	os.Stdout = was
-	w.Close()
-	return <-done, actErr
-}
-
-// keepWhatServeSets gives back, once the served controller stopped, what serve sets for the rest of its process, which
-// a controller's process exits after and the test process does not (issue 1945): the served mark in the environment, the
-// hand-act log's connection, the keeper, the status and the event publishers. Registered before the controller starts, so
-// it runs after the cleanup that stops it.
-func keepWhatServeSets(t *testing.T) {
-	t.Helper()
-	t.Setenv(servedVar, "")
-	unheld, status, given, check, follow, keeper, hand := logUnheldChanges, statusFrom, givenEvents, checkEvents,
-		link.Calls.Follow, conditionsFrom, handActConn
-	doctor, asker := doctorFrom, askerFrom.Load()
-	t.Cleanup(func() {
-		logUnheldChanges, statusFrom, givenEvents, checkEvents, link.Calls.Follow, conditionsFrom, handActConn =
-			unheld, status, given, check, follow, keeper, hand
-		doctorFrom = doctor
-		askerFrom.Store(asker)
-	})
-}

cmd/mesh-controller/composed_start.go

@@ -1,358 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"sort"
-	"strings"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/compose"
-	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
-	"github.com/nats-io/nats.go/jetstream"
-
-	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// What the controller does at its start under the lease (novox/hq ADR 0539 clauses 10 and 13):
-//
-//   - it deletes the buckets of the plans' state this release deleted, each said once in its log and as its event
-//     `bucket-deleted`: a later start finds none and says nothing;
-//   - it composes every node, so every assigned module has its composition at the fingerprint it is registered at
-//     and each node its own (ADR 0539 clause 11: the new controller writes every composition at its start);
-//   - and it composes, on the control-node, the controller it replaced at that controller's own fingerprint, from that
-//     build's manifest, so the operator's way back is one key at the terminal (clause 10).
-
-// planStateBucketDeleter is what deleting the plans' buckets needs of the bus: jetstream.JetStream, or a test's.
-type planStateBucketDeleter interface {
-	DeleteKeyValue(ctx context.Context, bucket string) error
-}
-
-// deletePlanStateBuckets deletes each bucket of the plans' state the bus still holds and says each it deleted; it
-// answers those it deleted. A bucket not there is no error and is not said.
-func deletePlanStateBuckets(ctx context.Context, js planStateBucketDeleter, say func(bucket string)) ([]string, error) {
-	var deleted []string
-	var errs []error
-	for _, bucket := range broker.PlanStateBuckets {
-		err := js.DeleteKeyValue(ctx, bucket)
-		switch {
-		case errors.Is(err, jetstream.ErrBucketNotFound), errors.Is(err, jetstream.ErrStreamNotFound):
-			continue
-		case err != nil:
-			errs = append(errs, fmt.Errorf("deleting %s: %w", bucket, err))
-			continue
-		}
-		deleted = append(deleted, bucket)
-		say(bucket)
-	}
-	return deleted, errors.Join(errs...)
-}
-
-// BucketDeleted is the body of the controller's event `bucket-deleted`.
-type BucketDeleted struct {
-	Bucket string    `json:"bucket"`
-	Why    string    `json:"why"`
-	At     time.Time `json:"at"`
-}
-
-// sayBucketDeleted says a deleted bucket in the log and as the controller's event.
-func sayBucketDeleted(ctx context.Context, bucket string) {
-	sayDeleted(ctx, bucket, "a bucket of the plans' state, which release 6 deleted (novox/hq ADR 0539 clause 13)")
-}
-
-// sayDeleted says a deleted bucket or stream, with why, in the log and as the controller's event bucket-deleted.
-func sayDeleted(ctx context.Context, bucket, why string) {
-	fmt.Printf("start: deleted %s: %s\n", bucket, why)
-	bus := checkEvents
-	if bus == nil {
-		return
-	}
-	body, err := json.Marshal(BucketDeleted{Bucket: bucket, Why: why, At: time.Now().UTC()})
-	if err != nil {
-		return
-	}
-	saying, stop := context.WithTimeout(context.WithoutCancel(ctx), 10*time.Second)
-	defer stop()
-	if err := bus.PublishSeatEvent(saying, link.MeshControllerSeat, "bucket-deleted", body); err != nil {
-		fmt.Printf("start: that %s was deleted could not be said as the event bucket-deleted: %v\n", bucket, err)
-	}
-}
-
-// composeAtStart is the start's pass: the plans' buckets deleted, every node composed, the replaced controller
-// composed. Said, never fatal: what is not composed now is composed by the next act that touches it.
-func composeAtStart(ctx context.Context, open *stores) {
-	if bus, err := aBus(); err != nil {
-		fmt.Printf("start: the plans' buckets are not looked at: %v\n", err)
-	} else {
-		if js, err := jetstream.New(bus.Conn()); err == nil {
-			if _, err := deletePlanStateBuckets(ctx, js, func(b string) { sayBucketDeleted(ctx, b) }); err != nil {
-				fmt.Printf("start: %v\n", err)
-			}
-		}
-		bus.Close()
-	}
-	nodes, err := open.inventory.Nodes(ctx)
-	if err != nil {
-		fmt.Printf("start: nothing is composed: %v\n", err)
-		return
-	}
-	names := make([]string, 0, len(nodes))
-	for _, n := range nodes {
-		names = append(names, n.Name)
-	}
-	sort.Strings(names)
-	if _, err := composeModules(ctx, open, names); err != nil {
-		fmt.Printf("start: %v\n", err)
-	}
-	if err := composeReplacedController(ctx, open); err != nil {
-		fmt.Printf("start: the controller this one replaced is not composed: %v\n", err)
-	}
-	if _, err := retireDeclarations(ctx, open); err != nil {
-		fmt.Printf("start: whether the declarations' stream may go cannot be read: %v\n", err)
-	}
-}
-
-// nodeEngineModule is the node-engine's module.
-const nodeEngineModule = "mesh-host"
-
-// declarationsDone says every node runs the node-engine at fingerprint current, as its have names: no node still reads
-// a declaration, and none away will need its last one (ADR 0539 clause 11). No node, or no fingerprint of the new
-// form, is not done.
-func declarationsDone(nodes []string, runs map[string]string, current string) bool {
-	if len(nodes) == 0 || !strings.HasPrefix(current, sdkdelivery.SourcePrefix2) {
-		return false
-	}
-	for _, n := range nodes {
-		if runs[n] != current {
-			return false
-		}
-	}
-	return true
-}
-
-// declarationsRetiredOn reads whether the declarations are done on the mesh now: their stream gone from the bus, or
-// every node's have of the node-engine against the fingerprint it is registered at.
-//
-// **A stream that is gone stays gone** (issue 1945). Release 6 sends no declaration (ADR 0539 clauses 5 and 11), so a
-// stream made again would hold no node's last declaration and help no node; and the done test alone is not lasting:
-// a node-engine newer than the one registered landing, or a node asleep on an older have, makes it false again after
-// the start deleted the stream, and then the raise, the bus's health check (H-bus), the probes (D6, D7) and healer H3
-// expected the stream and every node's consumer again, raised them missing and made them anew (2026-10-25 14:52).
-func declarationsRetiredOn(ctx context.Context, inv *inventory.Inventory, js jetstream.JetStream) (bool, error) {
-	if _, err := js.Stream(ctx, broker.DeclarationsStream); errors.Is(err, jetstream.ErrStreamNotFound) {
-		return true, nil
-	}
-	fps, err := currentFingerprints(ctx, inv)
-	if err != nil {
-		return false, err
-	}
-	nodes, err := inv.Nodes(ctx)
-	if err != nil {
-		return false, err
-	}
-	names := make([]string, 0, len(nodes))
-	runs := map[string]string{}
-	for _, n := range nodes {
-		names = append(names, n.Name)
-		h, found, err := haveOn(ctx, js, n.Name, nodeEngineModule)
-		if err != nil {
-			return false, err
-		}
-		if found {
-			runs[n.Name] = h.FP
-		}
-	}
-	return declarationsDone(names, runs, fps[nodeEngineModule]), nil
-}
-
-// retireDeclarations deletes the declarations' stream, with every node's consumer on it, once every node runs the new
-// node-engine, and says it once; a stream already gone is said by nobody, and is done. It answers whether the
-// declarations are done.
-func retireDeclarations(ctx context.Context, open *stores) (bool, error) {
-	if _, err := theLease.epoch(ctx); err != nil {
-		return false, err
-	}
-	bus, err := aBus()
-	if err != nil {
-		return false, err
-	}
-	defer bus.Close()
-	js, err := jetstream.New(bus.Conn())
-	if err != nil {
-		return false, err
-	}
-	done, err := declarationsRetiredOn(ctx, open.inventory, js)
-	if err != nil || !done {
-		return done, err
-	}
-	err = js.DeleteStream(ctx, broker.DeclarationsStream)
-	switch {
-	case errors.Is(err, jetstream.ErrStreamNotFound):
-		return true, nil
-	case err != nil:
-		return true, fmt.Errorf("deleting the stream %s: %w", broker.DeclarationsStream, err)
-	}
-	sayDeleted(ctx, broker.DeclarationsStream, "the stream of each node's last declaration: every node runs the new "+
-		"node-engine, which reads none (novox/hq ADR 0539 clause 11)")
-	return true, nil
-}
-
-// replacedController is the controller a control-node ran before this one: its fingerprint and manifest.
-type replacedController struct {
-	node, fp string
-	manifest catalogue.Manifest
-}
-
-// replacedControllers are, for each node the controller is assigned to, the controller it replaced: the newest build of
-// the controller that worked, whose fingerprint is of the new form and not the one the controller is registered at now
-// (the assignments name no build since ADR 0539 §12, so the build records say it). None when there is no such build.
-func replacedControllers(ctx context.Context, open *stores) ([]replacedController, error) {
-	inv := open.inventory
-	fps, err := currentFingerprints(ctx, inv)
-	if err != nil {
-		return nil, err
-	}
-	entries, err := inv.Catalogued(ctx)
-	if err != nil {
-		return nil, err
-	}
-	var on []string
-	for _, e := range entries {
-		if e.Manifest.Module == controllerModule {
-			on = e.On
-		}
-	}
-	if len(on) == 0 {
-		return nil, nil
-	}
-	builds, err := inv.Builds(ctx, controllerModule, 20)
-	if err != nil {
-		return nil, err
-	}
-	before, found := replacedBuild(builds, fps[controllerModule])
-	if !found {
-		return nil, nil
-	}
-	var m catalogue.Manifest
-	if err := json.Unmarshal(before.Manifest, &m); err != nil {
-		return nil, fmt.Errorf("the manifest of %s's build %s: %w", controllerModule, before.ID, err)
-	}
-	var out []replacedController
-	for _, node := range on {
-		out = append(out, replacedController{node: node, fp: before.SourceFingerprint, manifest: m})
-	}
-	return out, nil
-}
-
-// replacedBuild is, of a module's builds newest first, the newest that worked, kept its manifest, and names a
-// fingerprint of the new form other than current.
-func replacedBuild(builds []inventory.Build, current string) (inventory.Build, bool) {
-	for _, b := range builds {
-		if b.Worked() && b.SourceFingerprint != current && strings.HasPrefix(b.SourceFingerprint, sdkdelivery.SourcePrefix2) &&
-			len(b.Manifest) > 0 {
-			return b, true
-		}
-	}
-	return inventory.Build{}, false
-}
-
-// composeReplacedController writes, on each control-node, the controller's composition at the fingerprint of the one
-// it replaced: the node composed with that build's manifest in place of the controller's registered one, in the
-// reading mode (nothing made), and only the controller's composition of it kept.
-func composeReplacedController(ctx context.Context, open *stores) error {
-	if _, err := theLease.epoch(ctx); err != nil {
-		return err
-	}
-	replaced, err := replacedControllers(ctx, open)
-	if err != nil || len(replaced) == 0 {
-		return err
-	}
-	bus, err := aBus()
-	if err != nil {
-		return err
-	}
-	defer bus.Close()
-	js, err := jetstream.New(bus.Conn())
-	if err != nil {
-		return err
-	}
-	sign, err := controllerSigner(ctx, open)
-	if err != nil {
-		return err
-	}
-	var errs []error
-	for _, r := range replaced {
-		in, err := inputFor(ctx, open)
-		if err != nil {
-			return err
-		}
-		c, err := replacedComposition(in.Input, r)
-		if err != nil {
-			errs = append(errs, fmt.Errorf("%s: %w", r.node, err))
-			continue
-		}
-		at, err := openComposedPlace(ctx, js, bus.Conn(), r.node)
-		if err != nil {
-			errs = append(errs, err)
-			continue
-		}
-		at.sign = sign
-		key, _ := sdkdelivery.ComposedKey(r.node, controllerModule, r.fp)
-		if wrote, err := writeComposed(ctx, at, key, c); err != nil {
-			errs = append(errs, err)
-		} else if wrote {
-			fmt.Printf("start: composed %s, the controller this one replaced, on %s: the way back is want.%s.%s naming it\n",
-				short(r.fp), r.node, r.node, controllerModule)
-		}
-	}
-	return errors.Join(errs...)
-}
-
-// replacedComposition is the controller's composition on r's node at r's fingerprint: in composed with r's manifest
-// in place of the controller's registered one.
-func replacedComposition(in compose.Input, r replacedController) (sdkdelivery.Composed, error) {
-	return keptComposition(in, r.node, controllerModule, r.fp, r.manifest)
-}
-
-// keptComposition is module's composition on node at fp: in composed with manifest, that fingerprint's own, in place of
-// the module's registered one, in the reading mode (nothing made). in is not changed.
-func keptComposition(in compose.Input, node, module, fp string, manifest catalogue.Manifest) (sdkdelivery.Composed, error) {
-	shelf := make(map[string]catalogue.Manifest, len(in.Catalogue))
-	for k, v := range in.Catalogue {
-		shelf[k] = v
-	}
-	shelf[module] = manifest
-	in.Catalogue = shelf
-	all, _, err := compose.Compositions(in, node, map[string]string{module: fp}, compose.Reading)
-	if err != nil {
-		return sdkdelivery.Composed{}, err
-	}
-	key, _ := sdkdelivery.ComposedKey(node, module, fp)
-	c, ok := all[key]
-	if !ok {
-		return sdkdelivery.Composed{}, fmt.Errorf("%s composes no %s with the manifest of %s", node, module, short(fp))
-	}
-	return c, nil
-}
-
-// declarationsRetiredNow says the declarations are done on the mesh now, for a raise of the bus's objects and for what
-// the health check, the probes and the healers expect of the bus; a bus or a store it cannot read is not done, so a
-// stream still there is asserted as before.
-func declarationsRetiredNow(ctx context.Context, inv *inventory.Inventory) bool {
-	bus, err := aBus()
-	if err != nil {
-		return false
-	}
-	defer bus.Close()
-	js, err := jetstream.New(bus.Conn())
-	if err != nil {
-		return false
-	}
-	done, err := declarationsRetiredOn(ctx, inv, js)
-	return err == nil && done
-}

cmd/mesh-controller/composed_start_test.go

@@ -1,185 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"slices"
-	"strings"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/compose"
-	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
-	"github.com/nats-io/nats.go/jetstream"
-
-	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// fakeBuckets is the bus's buckets by name, for deleting.
-type fakeBuckets map[string]bool
-
-func (f fakeBuckets) DeleteKeyValue(_ context.Context, bucket string) error {
-	if !f[bucket] {
-		return jetstream.ErrBucketNotFound
-	}
-	delete(f, bucket)
-	return nil
-}
-
-// 1945/AC14 (unit half): the first start deletes the merge window's, the silent sends' and the building plans' buckets
-// and says each once; a later start finds none and says nothing; a bucket of anything else is left alone.
-func TestTheFirstStartDeletesThePlansBucketsAndSaysEachOnce(t *testing.T) {
-	bus := fakeBuckets{"mesh-controller_merge-window": true, "mesh-controller_rollout-silent": true,
-		"mesh-controller_plans-building": true, "mesh-controller_grants": true}
-	var said []string
-	deleted, err := deletePlanStateBuckets(context.Background(), bus, func(b string) { said = append(said, b) })
-	if err != nil || len(deleted) != 3 || strings.Join(said, " ") != strings.Join(broker.PlanStateBuckets, " ") {
-		t.Fatalf("first start: deleted %v, said %v, %v", deleted, said, err)
-	}
-	if !bus["mesh-controller_grants"] || len(bus) != 1 {
-		t.Errorf("the bus holds %v after the first start", bus)
-	}
-	said = nil
-	if deleted, err := deletePlanStateBuckets(context.Background(), bus, func(b string) { said = append(said, b) }); err != nil || len(deleted)+len(said) != 0 {
-		t.Errorf("a later start deleted %v and said %v (%v)", deleted, said, err)
-	}
-}
-
-// An earlier fingerprint is composed from its own build's manifest with today's inputs: the controller this one
-// replaced (1945/AC6), and every kept composition of a module whose config changed (ADR 0545: on 2026-10-25 a want back
-// to an earlier mesh-build-go on g14 applied the capacity of 0 its kept composition was made with). The composition
-// holds what that manifest declares and today's config, the kept keys are those of the touched modules at a
-// fingerprint other than the registered one, the build of a fingerprint is its newest that worked, and a write of
-// mesh-config's resolved values names the node and module it touches.
-func TestAnEarlierFingerprintIsComposedFromItsOwnManifest(t *testing.T) {
-	fp := func(c string) string { return sdkdelivery.SourcePrefix2 + strings.Repeat(c, 64) }
-	t.Run("from its own manifest, with today's inputs", func(t *testing.T) {
-		manifest := func(version string) catalogue.Manifest {
-			return catalogue.Manifest{Module: controllerModule, Version: version,
-				Settings: map[string]catalogue.SettingDeclaration{
-					"capacity": {Kind: catalogue.KindPreference, Default: float64(0), Why: "how many builds at once"}},
-				Resources: []map[string]any{{"id": "settings", "type": "file", "path": "/etc/mesh-controller/settings",
-					"content": version + " ${setting:capacity}\n"}}}
-		}
-		now, before := manifest("six"), manifest("five")
-		in := compose.Input{Catalogue: map[string]catalogue.Manifest{controllerModule: now},
-			Nodes: []compose.Node{{Name: "anchor", Assigned: []string{controllerModule}, Stated: true,
-				Settings: map[string][]catalogue.Layer{controllerModule: {{From: "mesh", Values: map[string]any{"capacity": float64(4)}}}}}}}
-		for name, compose := range map[string]func() (sdkdelivery.Composed, error){
-			"the replaced controller": func() (sdkdelivery.Composed, error) {
-				return replacedComposition(in, replacedController{node: "anchor", fp: fp("5"), manifest: before})
-			},
-			"a kept composition": func() (sdkdelivery.Composed, error) {
-				return keptComposition(in, "anchor", controllerModule, fp("5"), before)
-			},
-		} {
-			c, err := compose()
-			if err != nil {
-				t.Fatalf("%s: %v", name, err)
-			}
-			if c.Module != controllerModule || c.FP != fp("5") || c.Node != "anchor" || len(c.Resources) != 1 {
-				t.Fatalf("%s: composed %s at %s on %s with %d resources", name, c.Module, c.FP, c.Node, len(c.Resources))
-			}
-			var f struct{ Content string }
-			_ = json.Unmarshal(c.Resources[0], &f)
-			if f.Content != "five 4\n" {
-				t.Errorf("%s holds %q, want its own manifest's five with today's capacity 4", name, f.Content)
-			}
-		}
-		if in.Catalogue[controllerModule].Version != "six" {
-			t.Errorf("composing an earlier fingerprint changed the Input's catalogue")
-		}
-	})
-
-	t.Run("which build, which keys, which touch", func(t *testing.T) {
-		m := []byte(`{"module":"mesh-controller","version":"5"}`)
-		builds := []inventory.Build{
-			{ID: "c6", SourceFingerprint: fp("6"), Manifest: m},
-			{ID: "c5-failed", SourceFingerprint: fp("5"), Failed: "no", Manifest: m},
-			{ID: "c5", SourceFingerprint: fp("5"), Manifest: m},
-			{ID: "c4", SourceFingerprint: fp("4"), Manifest: m},
-		}
-		if b, ok := replacedBuild(builds, fp("6")); !ok || b.ID != "c5" {
-			t.Errorf("the replaced build is %+v (%v), want c5", b, ok)
-		}
-		if _, ok := replacedBuild(builds[:1], fp("6")); ok {
-			t.Errorf("a controller with no earlier build replaced one")
-		}
-		if b, ok := buildAt(builds, fp("5")); !ok || b.ID != "c5" {
-			t.Errorf("the build at 5 is %+v (%v), want c5, the one that worked", b, ok)
-		}
-		if _, ok := buildAt(builds, fp("3")); ok {
-			t.Errorf("a fingerprint with no build has one")
-		}
-		key := func(node, module, f string) string { k, _ := sdkdelivery.ComposedKey(node, module, f); return k }
-		keys := []string{key("g14", "mesh-build-go", fp("2")), key("g14", "mesh-build-go", fp("1")),
-			key("g14", "mesh-build-go", fp("3")), key("g14", "hello-web", fp("1")), key("ace", "mesh-build-go", fp("1"))}
-		registered := map[string]string{"mesh-build-go": fp("3"), "hello-web": fp("9")}
-		got := keptToFollow(keys, "g14", map[string]bool{"mesh-build-go": true}, registered)
-		if want := []keptKey{{"mesh-build-go", fp("1")}, {"mesh-build-go", fp("2")}}; !slices.Equal(got, want) {
-			t.Errorf("kept to follow %v, want %v", got, want)
-		}
-		if got := keptToFollow(keys, "g14", nil, registered); len(got) != 3 {
-			t.Errorf("every module's kept compositions: %v", got)
-		}
-		for k, want := range map[string][2]string{"g14.mesh-build-go.capacity": {"g14", "mesh-build-go"},
-			"g14.mesh-build-go.limits.cpu": {"g14", "mesh-build-go"}, "g14.mesh-build-go": {}, "": {}} {
-			node, module, ok := configTouched(k)
-			if [2]string{node, module} != want || ok != (want[0] != "") {
-				t.Errorf("%q touches %s %s (%v), want %v", k, node, module, ok, want)
-			}
-		}
-		// A value set before the consumer was made reaches the kept compositions: it reads each key once at creation.
-		if c := configFollowConfig(); c.DeliverPolicy != jetstream.DeliverLastPerSubjectPolicy ||
-			c.AckPolicy != jetstream.AckExplicitPolicy {
-			t.Errorf("the config consumer delivers %v, acknowledged %v; want each key's last value, acknowledged",
-				c.DeliverPolicy, c.AckPolicy)
-		}
-	})
-}
-
-// 1945/AC14 (unit half): the declarations' stream stays while one node's have names another node-engine than the one
-// registered, or none, and goes once every node's names it.
-func TestTheDeclarationsGoOnlyOnceEveryNodeRunsTheNewEngine(t *testing.T) {
-	n6 := sdkdelivery.SourcePrefix2 + strings.Repeat("6", 64)
-	nodes := []string{"ace", "g14", "novox"}
-	if declarationsDone(nodes, map[string]string{"ace": n6, "novox": n6}, n6) {
-		t.Errorf("done while g14 says nothing (it sleeps)")
-	}
-	if declarationsDone(nodes, map[string]string{"ace": n6, "g14": "src2:old", "novox": n6}, n6) {
-		t.Errorf("done while g14 runs the old node-engine")
-	}
-	if !declarationsDone(nodes, map[string]string{"ace": n6, "g14": n6, "novox": n6}, n6) {
-		t.Errorf("not done with every node on the new node-engine")
-	}
-	if declarationsDone(nodes, map[string]string{"ace": "", "g14": "", "novox": ""}, "") || declarationsDone(nil, nil, n6) {
-		t.Errorf("done with no fingerprint registered, or no node")
-	}
-}
-
-// streamsGone is a bus that holds none of the streams asked for; every other part of it is unread.
-type streamsGone struct{ jetstream.JetStream }
-
-func (streamsGone) Stream(context.Context, string) (jetstream.Stream, error) {
-	return nil, jetstream.ErrStreamNotFound
-}
-
-// Issue 1945 (the alarm of a stream the start deleted): once the declarations' stream is gone from the bus, the
-// declarations are retired whatever the nodes run now, so no raise, health check, probe or healer expects the stream
-// or a node's consumer on it again. A node-engine newer than the registered one, or a node asleep on an older have,
-// made the done test false after the stream went, and the bus's objects named it missing again (2026-10-25 14:52).
-func TestTheDeclarationsStayRetiredOnceTheirStreamIsGone(t *testing.T) {
-	retired, err := func() (retired bool, err error) {
-		defer func() {
-			if p := recover(); p != nil {
-				err = fmt.Errorf("it read what the nodes run although the stream is gone: %v", p)
-			}
-		}()
-		return declarationsRetiredOn(t.Context(), nil, streamsGone{})
-	}()
-	if err != nil || !retired {
-		t.Fatalf("with no declarations' stream on the bus: retired %v (%v), want retired", retired, err)
-	}
-}

cmd/mesh-controller/composed_trace.go

@@ -1,51 +0,0 @@
-package main
-
-import (
-	"context"
-	"fmt"
-	"sort"
-
-	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// composeTrace, when set, is told what composing a node saw and decided: the Input's credential state before it composes, and for
-// each module the digest it composed against the digest already written. A test sets it to read why a composition did or did not
-// move; the controller never does.
-var composeTrace func(string)
-
-// traceInput says what the node's composition will read of the pair credentials: those no row holds (would-make) and those held.
-func traceInput(ctx context.Context, open *stores, node string) {
-	in, err := inputFor(ctx, open)
-	if err != nil {
-		composeTrace(fmt.Sprintf("%s: the Input cannot be read: %v", node, err))
-		return
-	}
-	composeTrace(fmt.Sprintf("%s: before composing, would make %+v; credentials held %+v", node, in.wouldMake, in.Credentials))
-}
-
-// traceComposed says, per composition of a node, the digest composed now against the one written.
-func traceComposed(ctx context.Context, at composedPlace, node string, comps map[string]sdkdelivery.Composed) {
-	keys := make([]string, 0, len(comps))
-	for k := range comps {
-		keys = append(keys, k)
-	}
-	sort.Strings(keys)
-	for _, key := range keys {
-		now, err := sdkdelivery.ComposedDigestOf(comps[key])
-		if err != nil {
-			composeTrace(fmt.Sprintf("%s: %s: no digest: %v", node, key, err))
-			continue
-		}
-		written := "none"
-		if e, err := at.digests.Get(ctx, key); err == nil {
-			if v, err := sdkdelivery.DecodeComposedDigest(e.Value()); err == nil {
-				written = v.Digest
-			}
-		}
-		same := "CHANGED"
-		if written == now {
-			same = "same"
-		}
-		composeTrace(fmt.Sprintf("%s: %s: composed %.19s, written %.19s: %s", node, key, now, written, same))
-	}
-}

cmd/mesh-controller/composed_userlist_test.go

@@ -1,108 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/base64"
-	"encoding/json"
-	"os"
-	"strings"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/compose"
-	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// natsComposedWith is the bus module's composition on novox with the given user list: the catalogue's nats manifest as
-// captured (testdata/beside/mesh-catalog/modules/nats/module.json.captured), its archives, which only a registration
-// turns into references, left out, and its container's built image given as a reference.
-func natsComposedWith(t *testing.T, users string) sdkdelivery.Composed {
-	t.Helper()
-	raw, err := os.ReadFile("../../testdata/beside/mesh-catalog/modules/nats/module.json.captured")
-	if err != nil {
-		t.Fatal(err)
-	}
-	var m catalogue.Manifest
-	if err := json.Unmarshal(raw, &m); err != nil {
-		t.Fatal(err)
-	}
-	var kept []map[string]any
-	for _, r := range m.Resources {
-		if _, templated := r["template"]; templated {
-			continue // a template is rendered from the build's templates archive, which only a registration fetches
-		}
-		switch r["type"] {
-		case "archive":
-			continue
-		case "container":
-			// Its image is named by a build's artifact, which only a registration records: given here as a reference.
-			delete(r, "artifact")
-			r["image"] = "nats@sha256:" + strings.Repeat("1", 64)
-		}
-		kept = append(kept, r)
-	}
-	m.Resources = kept
-	key := base64.StdEncoding.EncodeToString(make([]byte, 32))
-	in := compose.Input{Catalogue: map[string]catalogue.Manifest{m.Module: m}, BusUsers: users,
-		OwnSecrets: []compose.OwnSecretRow{{Node: "novox", Module: m.Module, Name: "broker", Origin: "made", SealedTo: key,
-			Sealed: "SEALED-BY-THE-TEST"}},
-		Nodes: []compose.Node{{Name: "novox", Assigned: []string{m.Module}, Stated: true, SealingKey: key,
-			Capabilities: map[string]bool{"container-runtime": true, "systemd": true}}}}
-	fp := sdkdelivery.SourcePrefix2 + strings.Repeat("e", 64)
-	all, _, err := compose.Compositions(in, "novox", map[string]string{m.Module: fp}, compose.Foreseeing)
-	if err != nil {
-		t.Fatal(err)
-	}
-	k, _ := sdkdelivery.ComposedKey("novox", m.Module, fp)
-	c, ok := all[k]
-	if !ok {
-		t.Fatalf("no composition of %s: %v", m.Module, all)
-	}
-	return c
-}
-
-// 1945/AC12 and the review's A2 (ADR 0539 clause 7): a revision of the bus module's composition that changes only its
-// user list, a file in a directory its container mounts, is judged neither and said to change only the user list, so
-// a new credential never waits for a person's yes; a revision that changes anything else beside it is judged as any.
-func TestARevisionOfOnlyTheUserListMovesNothing(t *testing.T) {
-	at, _, _, haves := aPlace(t, "novox")
-	ctx := context.Background()
-	before := natsComposedWith(t, "authorization { users = [ {user: a} ] }\n")
-	after := natsComposedWith(t, "authorization { users = [ {user: a}, {user: b} ] }\n")
-	if d1, _ := sdkdelivery.ComposedDigestOf(before); d1 == func() string { d, _ := sdkdelivery.ComposedDigestOf(after); return d }() {
-		t.Fatal("the two user lists composed the same")
-	}
-	key, _ := sdkdelivery.ComposedKey("novox", before.Module, before.FP)
-	if _, err := writeComposed(ctx, at, key, before); err != nil {
-		t.Fatal(err)
-	}
-	runs, _ := sdkdelivery.ComposedDigestOf(before)
-	haves[before.Module] = sdkdelivery.Have{FP: before.FP, Composed: runs, Phase: sdkdelivery.PhaseRunning, Health: sdkdelivery.HealthOK}
-	digest, _ := sdkdelivery.ComposedDigestOf(after)
-	v, err := judgeMove(ctx, at, key, after, digest)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if v.Judgement != sdkdelivery.JudgedNeither || !v.UserListOnly || v.Against != runs {
-		t.Errorf("a user-list-only revision is judged %+v", v)
-	}
-	// The user list and a container's image beside it: judged as any move, and not user-list-only.
-	other := after
-	other.Resources = append([]json.RawMessage{}, after.Resources...)
-	for i, r := range other.Resources {
-		var head map[string]any
-		_ = json.Unmarshal(r, &head)
-		if head["type"] == "container" {
-			head["image"] = "nats@sha256:" + strings.Repeat("9", 64)
-			other.Resources[i], _ = json.Marshal(head)
-		}
-	}
-	d2, _ := sdkdelivery.ComposedDigestOf(other)
-	v, err = judgeMove(ctx, at, key, other, d2)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if v.UserListOnly || v.Judgement != sdkdelivery.JudgedRecreates {
-		t.Errorf("a new image beside the user list is judged %+v", v)
-	}
-}

cmd/mesh-controller/composed_writer.go

@@ -1,488 +0,0 @@
-package main
-
-import (
-	"context"
-	"crypto/ed25519"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"sort"
-	"strings"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	sdkdecl "git.novox.be/novox/mesh-sdk/go/declaration"
-	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
-	"github.com/nats-io/nats.go/jetstream"
-)
-
-// The compositions (novox/hq ADR 0539 clauses 1 to 5). Every act that sent a declaration writes compositions instead:
-// the controller composes a node as it composed a send (composeSend: the same composition, the same makes), splits the
-// declaration by module into one composition per module at the fingerprint the module is registered at, and the node's
-// own resources, signs each with its key, and writes those that differ, by compare-and-set while it holds the lease:
-// the composition into the node's bucket `composed-<node>`, which only that node reads, and its digest with the
-// judgement of the move (composed_judge.go) into `mesh-controller_composed`, which the assigner reads. A file over 64
-// KiB goes by digest into the node's object bucket first. Nothing is published on a node's declaration subject.
-//
-// **A module with no fingerprint of the new form goes with the node's own composition.** The mesh composes resources
-// of modules it provides itself, built by nobody (the private network's mesh-wireguard), and a module registered
-// before fingerprints of the new form has none either: no want can ever name such a module (the assigner's first rule
-// asks for its done build), so its resources ride in `<node>.node`, which the node's own want names, their `module`
-// taken off (a composition holds only its own module's resources); their ids still name the module.
-//
-// **Derived state, pruned** (clause 4): a module's compositions on a node are kept for its five newest fingerprints and
-// for any a want or the node's have names; the rest are deleted with their digests.
-
-// composedBucketsKV is what the writer needs of a key-value bucket: jetstream.KeyValue, or a test's.
-type composedBucketsKV interface {
-	Get(ctx context.Context, key string) (jetstream.KeyValueEntry, error)
-	Create(ctx context.Context, key string, value []byte, opts ...jetstream.KVCreateOpt) (uint64, error)
-	Update(ctx context.Context, key string, value []byte, revision uint64) (uint64, error)
-	Delete(ctx context.Context, key string, opts ...jetstream.KVDeleteOpt) error
-	ListKeys(ctx context.Context, opts ...jetstream.WatchOpt) (jetstream.KeyLister, error)
-}
-
-// composedPlace is where the writer writes a node's compositions and reads what decides them: the node's bucket, the
-// digests, the node's object bucket, the wants and the haves.
-type composedPlace struct {
-	node    string
-	bucket  composedBucketsKV
-	digests composedBucketsKV
-	objects objectStore
-	// wanted is the fingerprint the node's want names for a module, "" when none; ran the composition digest its have
-	// names (the move's judgement reads it) and the fingerprint it runs.
-	wanted func(ctx context.Context, module string) (string, error)
-	ran    func(ctx context.Context, module string) (sdkdelivery.Have, bool, error)
-	// lastApplied is the module's slice of the declaration the node last applied, from the kept stream of declarations
-	// (ADR 0540 clause 9), and that declaration's digest; false when there is none to read. Nil judges without it.
-	lastApplied func(ctx context.Context, module string) (slice []json.RawMessage, digest string, found bool, err error)
-	// policy is a module's upgrade policy, where it comes from and why (catalogue.UpgradeOf), carried beside the
-	// judgement for the assigner's hold (ADR 0539 clause 14).
-	policy func(module string) (policy, from, why string)
-	// sign signs a composition with the controller's key.
-	sign func(c sdkdelivery.Composed) (sdkdelivery.Composed, error)
-}
-
-// compositionsOf splits a node's declaration body, as a send composed it, into its compositions: each module's at the
-// fingerprint fps gives it, the node's own with its adoption and provisioner, and every resource of a module fps names
-// no fingerprint for in the node's own, its module taken off it and named in moved. Data says the module's manifest
-// declares data.
-//
-// **A module a want or a have names by its own composition is never in the node's own** (issue 1945): the node-engine
-// runs that module's composition, and the same resources in the node's own were declared twice, which it refuses
-// whole ("2 resources declare X", every node's apply failing from 2026-10-25 12:43). named says, for a module fps names
-// no fingerprint of the new form for, that the node's want or have names a fingerprint of the new form; such a module's
-// resources and filled paths are left out of this pass (its own composition, as written before, stays what the node
-// runs) and it is named in left.
-func compositionsOf(node string, body []byte, fps map[string]string, manifests map[string]catalogue.Manifest, runs []string,
-	named func(module string) (bool, error)) (out map[string]sdkdelivery.Composed, moved, left []string, err error) {
-
-	var envelope struct {
-		Resources   []map[string]json.RawMessage `json:"resources"`
-		Adoption    *sdkdecl.Adoption            `json:"adoption"`
-		Filled      []string                     `json:"filled_files"`
-		Provisioner string                       `json:"provisioner_account"`
-	}
-	if err := json.Unmarshal(body, &envelope); err != nil {
-		return nil, nil, nil, fmt.Errorf("%s's declaration: %w", node, err)
-	}
-	inModule, ownComposition := map[string]bool{}, map[string]bool{}
-	resources := make([]json.RawMessage, 0, len(envelope.Resources))
-	for _, r := range envelope.Resources {
-		var module string
-		if raw, ok := r["module"]; ok {
-			_ = json.Unmarshal(raw, &module)
-		}
-		if module != "" && !strings.HasPrefix(fps[module], sdkdelivery.SourcePrefix2) {
-			if !inModule[module] && !ownComposition[module] {
-				isNamed := false
-				if named != nil {
-					if isNamed, err = named(module); err != nil {
-						return nil, nil, nil, fmt.Errorf("whether %s's want or have names %s's own composition: %w",
-							node, module, err)
-					}
-				}
-				if isNamed {
-					ownComposition[module] = true
-					left = append(left, module)
-				} else {
-					inModule[module] = true
-					moved = append(moved, module)
-				}
-			}
-			if ownComposition[module] {
-				continue
-			}
-			delete(r, "module")
-		}
-		raw, err := json.Marshal(r)
-		if err != nil {
-			return nil, nil, nil, err
-		}
-		resources = append(resources, raw)
-	}
-	// A filled file of a module moved into the node's own composition is no module's file any more, and the provisioner
-	// fills it all the same: the node's own composition carries its path, so the node-engine leaves the content to the
-	// provisioner and accepts its write. Dropping the path had the node-engine write those files empty, since their
-	// resources say no content (issue 1945, live on 2026-10-25: claude-code's, node-env's and power's files on ace, g14
-	// and shanks).
-	var filled, ownFilled []string
-	for _, p := range envelope.Filled {
-		switch {
-		case filledByMoved(envelope.Resources, p, ownComposition):
-			// The file of a module whose own composition the node runs: that composition names it, not this pass.
-		case filledByMoved(envelope.Resources, p, inModule):
-			ownFilled = append(ownFilled, p)
-		default:
-			filled = append(filled, p)
-		}
-	}
-	sort.Strings(moved)
-	sort.Strings(left)
-	out, err = sdkdelivery.SplitComposed(node, resources, fps, filled,
-		sdkdelivery.NodeOwn{Adoption: envelope.Adoption, Provisioner: envelope.Provisioner})
-	if err != nil {
-		return nil, nil, nil, err
-	}
-	if len(ownFilled) > 0 {
-		own, err := sdkdelivery.ComposedNodeKey(node)
-		if err != nil {
-			return nil, nil, nil, err
-		}
-		c := out[own]
-		c.Filled = append(c.Filled, ownFilled...)
-		out[own] = c
-	}
-	// A module the node runs that composes no resource of its own (all its needs met by others) still has its
-	// composition, empty, at its fingerprint: its want names that composition (the assigner's seventh rule), and without
-	// one no want could ever be written.
-	for _, module := range runs {
-		fp := fps[module]
-		if !strings.HasPrefix(fp, sdkdelivery.SourcePrefix2) {
-			continue
-		}
-		key, err := sdkdelivery.ComposedKey(node, module, fp)
-		if err != nil {
-			continue
-		}
-		if _, ok := out[key]; !ok {
-			out[key] = sdkdelivery.Composed{Node: node, Module: module, FP: fp, Resources: []json.RawMessage{}}
-		}
-	}
-	for key, c := range out {
-		if m, ok := manifests[c.Module]; ok && c.Module != "" {
-			c.Data = len(m.DataItems()) > 0
-			out[key] = c
-		}
-	}
-	return out, moved, left, nil
-}
-
-// filledByMoved says a filled path is a file of a module whose resources were moved into the node's own composition.
-func filledByMoved(resources []map[string]json.RawMessage, path string, moved map[string]bool) bool {
-	for _, r := range resources {
-		var kind, at, id string
-		_ = json.Unmarshal(r["type"], &kind)
-		_ = json.Unmarshal(r["path"], &at)
-		_ = json.Unmarshal(r["id"], &id)
-		if kind == string(sdkdecl.TypeFile) && at == path {
-			if module, ok := sdkdecl.ModuleGuess(id); ok && moved[module] {
-				return true
-			}
-		}
-	}
-	return false
-}
-
-// writeComposed writes one composition and its digest where they differ from what the buckets hold: the files by
-// digest first, then the composition, then its digest and judgement, so a reader that finds the digest finds the
-// composition and its files. It answers whether it wrote anything.
-func writeComposed(ctx context.Context, at composedPlace, key string, c sdkdelivery.Composed) (bool, error) {
-	c, objects, err := c.ByDigest()
-	if err != nil {
-		return false, err
-	}
-	if len(objects) > 0 {
-		if at.objects == nil {
-			return false, fmt.Errorf("%s holds a file over 64 KiB and %s's object bucket is not open", key, at.node)
-		}
-		named := make(map[string][]byte, len(objects))
-		for digest, body := range objects {
-			name, err := sdkdecl.ObjectName(digest)
-			if err != nil {
-				return false, err
-			}
-			named[name] = body
-		}
-		if err := putObjects(ctx, at.objects, named); err != nil {
-			return false, err
-		}
-	}
-	if err := objectsHeld(ctx, at, key, c, objects); err != nil {
-		return false, err
-	}
-	digest, err := sdkdelivery.ComposedDigestOf(c)
-	if err != nil {
-		return false, err
-	}
-	wrote := false
-	held, revision, err := readComposed(ctx, at.bucket, key)
-	if err != nil {
-		return false, err
-	}
-	if heldDigest, _ := sdkdelivery.ComposedDigestOf(held); revision == 0 || heldDigest != digest {
-		signed, err := at.sign(c)
-		if err != nil {
-			return false, err
-		}
-		value, err := sdkdelivery.EncodeComposed(signed)
-		if err != nil {
-			return false, err
-		}
-		if err := casWrite(ctx, at.bucket, key, value, revision); err != nil {
-			return false, err
-		}
-		wrote = true
-	}
-	// **The digest kept is the digest of the composition the bucket holds** (issue 1945): another writer may write its
-	// composition and its digest between this one's composition and its digest, and the digest written last must not be
-	// of a composition the bucket no longer holds, or the assigner's want names it and the node applies nothing. After
-	// its digest, this writer reads the composition again and, when another holds the key, keeps that one's digest.
-	written := false
-	for follows := 0; ; follows++ {
-		judged, err := judgeMove(ctx, at, key, c, digest)
-		if composeTrace != nil {
-			composeTrace(fmt.Sprintf("%s: %s: written %v, judged %s %q user-list-only %v against %.19s, err %v", at.node, key,
-				wrote, judged.Judgement, judged.Words, judged.UserListOnly, judged.Against, err))
-		}
-		if err != nil {
-			return wrote || written, err
-		}
-		w, err := keepDigest(ctx, at.digests, key, judged)
-		written = written || w
-		if err != nil {
-			return wrote || written, err
-		}
-		now, rev, err := readComposed(ctx, at.bucket, key)
-		if err != nil {
-			return wrote || written, err
-		}
-		nowDigest, err := sdkdelivery.ComposedDigestOf(now)
-		if rev == 0 || err != nil || nowDigest == digest {
-			return wrote || written, nil
-		}
-		if follows >= 3 {
-			return wrote || written, fmt.Errorf("%s moved under this writer %d times; its digest is kept by the next pass",
-				key, follows+1)
-		}
-		c, digest = now, nowDigest
-	}
-}
-
-// objectsHeld refuses a composition that names a file by a digest whose object the node's bucket does not hold: a node
-// that read it could not apply it (issue 1945). An object this write just put is held.
-func objectsHeld(ctx context.Context, at composedPlace, key string, c sdkdelivery.Composed, put map[string][]byte) error {
-	for _, raw := range c.Resources {
-		r, err := sdkdecl.ParseResource(raw)
-		if err != nil {
-			return err
-		}
-		f, ok := r.(*sdkdecl.File)
-		if !ok || !f.IsReference() {
-			continue
-		}
-		if _, ok := put[f.Digest]; ok {
-			continue
-		}
-		name, err := sdkdecl.ObjectName(f.Digest)
-		if err != nil {
-			return fmt.Errorf("%s: file %s: %w", key, f.ID, err)
-		}
-		if at.objects == nil {
-			return fmt.Errorf("%s names file %s by digest and %s's object bucket is not open", key, f.ID, at.node)
-		}
-		have, _, err := at.objects.Has(ctx, name)
-		if err != nil {
-			return fmt.Errorf("%s: whether the object %s of file %s is in the bucket: %w", key, name[:12], f.ID, err)
-		}
-		if !have {
-			return fmt.Errorf("%s names file %s by the object %s, which %s's bucket does not hold: not written", key, f.ID,
-				name[:12], at.node)
-		}
-	}
-	return nil
-}
-
-// readComposed is the composition a bucket holds under key and its revision; revision 0 when there is none.
-func readComposed(ctx context.Context, kv composedBucketsKV, key string) (sdkdelivery.Composed, uint64, error) {
-	e, err := kv.Get(ctx, key)
-	if errors.Is(err, jetstream.ErrKeyNotFound) {
-		return sdkdelivery.Composed{}, 0, nil
-	}
-	if err != nil {
-		return sdkdelivery.Composed{}, 0, err
-	}
-	c, err := sdkdelivery.DecodeComposed(e.Value())
-	if err != nil {
-		// A value this controller cannot read is written over: it is derived, and composed again here.
-		return sdkdelivery.Composed{}, e.Revision(), nil
-	}
-	return c, e.Revision(), nil
-}
-
-// keepDigest writes the digest and judgement beside a composition when it differs from what the bucket holds.
-func keepDigest(ctx context.Context, kv composedBucketsKV, key string, v sdkdelivery.ComposedDigest) (bool, error) {
-	value, err := sdkdelivery.EncodeComposedDigest(v)
-	if err != nil {
-		return false, err
-	}
-	v.V = sdkdelivery.Version
-	var revision uint64
-	e, err := kv.Get(ctx, key)
-	switch {
-	case errors.Is(err, jetstream.ErrKeyNotFound):
-	case err != nil:
-		return false, err
-	default:
-		revision = e.Revision()
-		if held, derr := sdkdelivery.DecodeComposedDigest(e.Value()); derr == nil && sdkdelivery.SameComposedDigest(held, v) {
-			return false, nil
-		}
-	}
-	return true, casWrite(ctx, kv, key, value, revision)
-}
-
-// casWrite creates key when revision is 0 and otherwise replaces the revision read: a second writer that wrote in
-// between makes this one fail, said, and the next event composes again.
-func casWrite(ctx context.Context, kv composedBucketsKV, key string, value []byte, revision uint64) error {
-	var err error
-	if revision == 0 {
-		_, err = kv.Create(ctx, key, value)
-	} else {
-		_, err = kv.Update(ctx, key, value, revision)
-	}
-	if err != nil {
-		return fmt.Errorf("writing %s: %w", key, err)
-	}
-	return nil
-}
-
-// writeNodeCompositions writes every composition of a node that differs, and prunes what is no longer kept. It answers
-// the keys it wrote.
-func writeNodeCompositions(ctx context.Context, at composedPlace, comps map[string]sdkdelivery.Composed) ([]string, error) {
-	// The modules' compositions first and the node's own last, and the node's own not at all in a pass where a module's
-	// failed: written without the resources that moved to that module, it would have the node-engine remove them while
-	// the module's own composition is not there to take them (issue 1945, the review's gap 1).
-	own, err := sdkdelivery.ComposedNodeKey(at.node)
-	if err != nil {
-		return nil, err
-	}
-	keys := make([]string, 0, len(comps))
-	for k := range comps {
-		if k != own {
-			keys = append(keys, k)
-		}
-	}
-	sort.Strings(keys)
-	var wrote []string
-	var errs []error
-	for _, key := range keys {
-		w, err := writeComposed(ctx, at, key, comps[key])
-		if err != nil {
-			errs = append(errs, err)
-			continue
-		}
-		if w {
-			wrote = append(wrote, key)
-		}
-	}
-	if c, ok := comps[own]; ok {
-		if len(errs) > 0 {
-			errs = append(errs, fmt.Errorf("%s is not written: a module's composition of this pass was not", own))
-		} else if w, err := writeComposed(ctx, at, own, c); err != nil {
-			errs = append(errs, err)
-		} else if w {
-			wrote = append(wrote, own)
-		}
-	}
-	if err := pruneCompositions(ctx, at); err != nil {
-		errs = append(errs, err)
-	}
-	return wrote, errors.Join(errs...)
-}
-
-// pruneCompositions deletes, for each module of the node, the compositions outside its ComposedKeep newest fingerprints
-// that neither its want nor its have names, each with its digest (ADR 0539 clause 4). Newest is by when each was last
-// written: the controller writes only the fingerprint a module is registered at, so an older one is never written again.
-func pruneCompositions(ctx context.Context, at composedPlace) error {
-	lister, err := at.bucket.ListKeys(ctx)
-	if err != nil {
-		if errors.Is(err, jetstream.ErrNoKeysFound) {
-			return nil
-		}
-		return err
-	}
-	type kept struct {
-		key, fp string
-		at      time.Time
-	}
-	byModule := map[string][]kept{}
-	for key := range lister.Keys() {
-		node, module, fp, isNode, err := sdkdelivery.ParseComposedKey(key)
-		if err != nil || isNode || node != at.node {
-			continue
-		}
-		e, err := at.bucket.Get(ctx, key)
-		if err != nil {
-			continue
-		}
-		byModule[module] = append(byModule[module], kept{key, fp, e.Created()})
-	}
-	var errs []error
-	for module, ks := range byModule {
-		if len(ks) <= sdkdelivery.ComposedKeep {
-			continue
-		}
-		sort.Slice(ks, func(i, j int) bool { return ks[i].at.After(ks[j].at) })
-		wanted, err := at.wanted(ctx, module)
-		if err != nil {
-			errs = append(errs, err)
-			continue
-		}
-		have, _, err := at.ran(ctx, module)
-		if err != nil {
-			errs = append(errs, err)
-			continue
-		}
-		for _, k := range ks[sdkdelivery.ComposedKeep:] {
-			if k.fp == wanted || k.fp == have.FP {
-				continue
-			}
-			if err := at.bucket.Delete(ctx, k.key); err != nil && !errors.Is(err, jetstream.ErrKeyNotFound) {
-				errs = append(errs, err)
-				continue
-			}
-			if err := at.digests.Delete(ctx, k.key); err != nil && !errors.Is(err, jetstream.ErrKeyNotFound) {
-				errs = append(errs, err)
-			}
-		}
-	}
-	return errors.Join(errs...)
-}
-
-// controllerSigner signs a composition with the controller's active key, which its identity store keeps and never hands
-// out (as it signed declarations).
-func controllerSigner(ctx context.Context, open *stores) (func(sdkdelivery.Composed) (sdkdelivery.Composed, error), error) {
-	ident, err := open.Identity(ctx)
-	if err != nil {
-		return nil, err
-	}
-	key, err := ident.Active(ctx)
-	if err != nil {
-		return nil, err
-	}
-	public := ed25519.PublicKey(key.Public)
-	return func(c sdkdelivery.Composed) (sdkdelivery.Composed, error) {
-		return sdkdelivery.SignComposedBy(c, public, func(m []byte) ([]byte, error) { return ident.Sign(ctx, m) })
-	}, nil
-}

cmd/mesh-controller/composed_writer_test.go

@@ -1,413 +0,0 @@
-package main
-
-import (
-	"compress/gzip"
-	"context"
-	"crypto/ed25519"
-	"crypto/rand"
-	"encoding/json"
-	"fmt"
-	"io"
-	"os"
-	"sort"
-	"strings"
-	"testing"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
-	"github.com/nats-io/nats.go/jetstream"
-)
-
-// fakeComposedKV is a key-value bucket in memory: revisions, a creation time per write, history, compare-and-set.
-type fakeComposedKV struct {
-	name    string
-	rev     uint64
-	clock   time.Time
-	history map[string][]fakeComposedEntry
-	writes  int
-	deletes int
-}
-
-type fakeComposedEntry struct {
-	bucket, key string
-	value       []byte
-	rev         uint64
-	at          time.Time
-	op          jetstream.KeyValueOp
-}
-
-func (e fakeComposedEntry) Bucket() string                  { return e.bucket }
-func (e fakeComposedEntry) Key() string                     { return e.key }
-func (e fakeComposedEntry) Value() []byte                   { return e.value }
-func (e fakeComposedEntry) Revision() uint64                { return e.rev }
-func (e fakeComposedEntry) Created() time.Time              { return e.at }
-func (e fakeComposedEntry) Delta() uint64                   { return 0 }
-func (e fakeComposedEntry) Operation() jetstream.KeyValueOp { return e.op }
-
-func newFakeComposedKV(name string) *fakeComposedKV {
-	return &fakeComposedKV{name: name, clock: time.Date(2026, 10, 24, 17, 0, 0, 0, time.UTC), history: map[string][]fakeComposedEntry{}}
-}
-
-func (f *fakeComposedKV) last(key string) (fakeComposedEntry, bool) {
-	h := f.history[key]
-	if len(h) == 0 || h[len(h)-1].op != jetstream.KeyValuePut {
-		return fakeComposedEntry{}, false
-	}
-	return h[len(h)-1], true
-}
-
-func (f *fakeComposedKV) put(key string, value []byte, op jetstream.KeyValueOp) uint64 {
-	f.rev++
-	f.clock = f.clock.Add(time.Second)
-	f.history[key] = append(f.history[key], fakeComposedEntry{f.name, key, value, f.rev, f.clock, op})
-	return f.rev
-}
-
-func (f *fakeComposedKV) Get(_ context.Context, key string) (jetstream.KeyValueEntry, error) {
-	e, ok := f.last(key)
-	if !ok {
-		return nil, jetstream.ErrKeyNotFound
-	}
-	return e, nil
-}
-
-func (f *fakeComposedKV) Create(_ context.Context, key string, value []byte, _ ...jetstream.KVCreateOpt) (uint64, error) {
-	if _, ok := f.last(key); ok {
-		return 0, jetstream.ErrKeyExists
-	}
-	f.writes++
-	return f.put(key, value, jetstream.KeyValuePut), nil
-}
-
-func (f *fakeComposedKV) Update(_ context.Context, key string, value []byte, revision uint64) (uint64, error) {
-	e, ok := f.last(key)
-	if !ok || e.rev != revision {
-		return 0, fmt.Errorf("wrong last sequence")
-	}
-	f.writes++
-	return f.put(key, value, jetstream.KeyValuePut), nil
-}
-
-func (f *fakeComposedKV) Delete(_ context.Context, key string, _ ...jetstream.KVDeleteOpt) error {
-	if _, ok := f.last(key); !ok {
-		return jetstream.ErrKeyNotFound
-	}
-	f.deletes++
-	f.put(key, nil, jetstream.KeyValueDelete)
-	return nil
-}
-
-func (f *fakeComposedKV) History(_ context.Context, key string, _ ...jetstream.WatchOpt) ([]jetstream.KeyValueEntry, error) {
-	h := f.history[key]
-	if len(h) == 0 {
-		return nil, jetstream.ErrKeyNotFound
-	}
-	out := make([]jetstream.KeyValueEntry, len(h))
-	for i, e := range h {
-		out[i] = e
-	}
-	return out, nil
-}
-
-type fakeLister struct{ keys chan string }
-
-func (l fakeLister) Keys() <-chan string { return l.keys }
-func (l fakeLister) Stop() error         { return nil }
-
-func (f *fakeComposedKV) ListKeys(_ context.Context, _ ...jetstream.WatchOpt) (jetstream.KeyLister, error) {
-	var keys []string
-	for k := range f.history {
-		if _, ok := f.last(k); ok {
-			keys = append(keys, k)
-		}
-	}
-	sort.Strings(keys)
-	ch := make(chan string, len(keys))
-	for _, k := range keys {
-		ch <- k
-	}
-	close(ch)
-	return fakeLister{ch}, nil
-}
-
-// fakeObjects is a node's object bucket in memory.
-type fakeObjects map[string][]byte
-
-func (o fakeObjects) Has(_ context.Context, name string) (bool, bool, error) {
-	_, ok := o[name]
-	return ok, false, nil
-}
-func (o fakeObjects) Put(_ context.Context, name string, content []byte) error {
-	o[name] = content
-	return nil
-}
-
-// aPlace is a node's buckets in memory, signed with a key of the test's, the want and the have given.
-func aPlace(t *testing.T, node string) (composedPlace, ed25519.PublicKey, map[string]string, map[string]sdkdelivery.Have) {
-	t.Helper()
-	pub, priv, err := ed25519.GenerateKey(rand.Reader)
-	if err != nil {
-		t.Fatal(err)
-	}
-	wants, haves := map[string]string{}, map[string]sdkdelivery.Have{}
-	at := composedPlace{node: node, bucket: newFakeComposedKV("composed-" + node), digests: newFakeComposedKV("mesh-controller_composed"),
-		objects: fakeObjects{},
-		wanted:  func(_ context.Context, module string) (string, error) { return wants[module], nil },
-		ran: func(_ context.Context, module string) (sdkdelivery.Have, bool, error) {
-			h, ok := haves[module]
-			return h, ok, nil
-		},
-		policy: func(string) (string, string, string) { return catalogue.PolicyRoll, catalogue.FromDefault, "" },
-		sign:   func(c sdkdelivery.Composed) (sdkdelivery.Composed, error) { return sdkdelivery.SignComposed(c, priv) },
-	}
-	return at, pub, wants, haves
-}
-
-// capturedBody is a node's declaration as the controller's `plan` verb answered it on 2026-10-24 at 16:19, the body a
-// send of declarationFor carries (testdata/declaration-<node>.json.gz, copied from mesh-sdk's; the resources carrying
-// a sealed value or a secret taken out), and a fingerprint standing in for each module's build.
-func capturedBody(t *testing.T, node string) ([]byte, map[string]string) {
-	t.Helper()
-	f, err := os.Open("testdata/declaration-" + node + ".json.gz")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer f.Close()
-	z, err := gzip.NewReader(f)
-	if err != nil {
-		t.Fatal(err)
-	}
-	raw, err := io.ReadAll(z)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var d struct {
-		Builds map[string]string `json:"builds"`
-	}
-	if err := json.Unmarshal(raw, &d); err != nil {
-		t.Fatal(err)
-	}
-	fps := map[string]string{}
-	for m, b := range d.Builds {
-		fps[m] = sdkdelivery.SourcePrefix2 + fmt.Sprintf("%064x", []byte(b))[:64]
-	}
-	return raw, fps
-}
-
-func resourceIDs(t *testing.T, raws []json.RawMessage) []string {
-	t.Helper()
-	var out []string
-	for _, r := range raws {
-		var head struct{ ID string }
-		if err := json.Unmarshal(r, &head); err != nil {
-			t.Fatal(err)
-		}
-		out = append(out, head.ID)
-	}
-	return out
-}
-
-// 1945/AC1: for a captured node's declaration, the union of its module compositions and its own is the declaration's
-// resources, each once; each module's at its fingerprint; a module with no fingerprint of the new form (the private
-// network's mesh-wireguard, which nobody builds) rides in the node's own.
-func TestTheCompositionsOfANodeAreItsDeclaration(t *testing.T) {
-	for _, node := range []string{"ace", "g14"} {
-		body, fps := capturedBody(t, node)
-		var d struct {
-			Resources []json.RawMessage `json:"resources"`
-		}
-		_ = json.Unmarshal(body, &d)
-		comps, moved, _, err := compositionsOf(node, body, fps, nil, nil, nil)
-		if err != nil {
-			t.Fatalf("%s: %v", node, err)
-		}
-		if strings.Join(moved, ",") != "mesh-wireguard" {
-			t.Errorf("%s: moved into the node's own %v, want mesh-wireguard", node, moved)
-		}
-		var union []string
-		for key, c := range comps {
-			_, module, fp, isNode, err := sdkdelivery.ParseComposedKey(key)
-			if err != nil || (!isNode && fp != fps[module]) {
-				t.Errorf("%s: %s is at %s (%v)", node, key, fp, err)
-			}
-			if _, err := sdkdelivery.EncodeComposed(c); err != nil {
-				t.Errorf("%s: %s: %v", node, key, err)
-			}
-			union = append(union, resourceIDs(t, c.Resources)...)
-		}
-		want := resourceIDs(t, d.Resources)
-		sort.Strings(union)
-		sort.Strings(want)
-		if strings.Join(union, " ") != strings.Join(want, " ") {
-			t.Errorf("%s: the compositions hold %d resources, the declaration %d, or they differ", node, len(union), len(want))
-		}
-		own, _ := sdkdelivery.ComposedNodeKey(node)
-		if ids := strings.Join(resourceIDs(t, comps[own].Resources), " "); !strings.Contains(ids, "mesh-wireguard.") {
-			t.Errorf("%s: the node's own composition does not hold mesh-wireguard's resources: %s", node, ids)
-		}
-	}
-}
-
-// 1945/AC1: a composition is written signed by the controller's key with its digest beside it; written again
-// unchanged it writes nothing; a changed input writes a new revision of that key alone, by compare-and-set.
-func TestACompositionIsWrittenOnceAndAgainOnlyWhenItChanges(t *testing.T) {
-	body, fps := capturedBody(t, "g14")
-	comps, _, _, err := compositionsOf("g14", body, fps, nil, nil, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	at, pub, _, _ := aPlace(t, "g14")
-	wrote, err := writeNodeCompositions(context.Background(), at, comps)
-	if err != nil || len(wrote) != len(comps) {
-		t.Fatalf("first write: %d of %d (%v)", len(wrote), len(comps), err)
-	}
-	for key := range comps {
-		e, err := at.bucket.Get(context.Background(), key)
-		if err != nil {
-			t.Fatal(err)
-		}
-		c, err := sdkdelivery.DecodeComposed(e.Value())
-		if err != nil {
-			t.Fatal(err)
-		}
-		digest, err := sdkdelivery.VerifyComposed(c, []ed25519.PublicKey{pub})
-		if err != nil {
-			t.Fatalf("%s: %v", key, err)
-		}
-		d, err := at.digests.Get(context.Background(), key)
-		if err != nil {
-			t.Fatal(err)
-		}
-		v, err := sdkdelivery.DecodeComposedDigest(d.Value())
-		if err != nil || v.Digest != digest {
-			t.Errorf("%s: the digest beside it is %q, the composition's %s (%v)", key, v.Digest, digest, err)
-		}
-	}
-	writes := at.bucket.(*fakeComposedKV).writes + at.digests.(*fakeComposedKV).writes
-	if again, err := writeNodeCompositions(context.Background(), at, comps); err != nil || len(again) != 0 {
-		t.Errorf("written again unchanged: %v (%v)", again, err)
-	}
-	if now := at.bucket.(*fakeComposedKV).writes + at.digests.(*fakeComposedKV).writes; now != writes {
-		t.Errorf("an unchanged write wrote %d values", now-writes)
-	}
-
-	key, _ := sdkdelivery.ComposedKey("g14", "fail2ban", fps["fail2ban"])
-	changed := comps[key]
-	changed.Data = true
-	comps[key] = changed
-	wrote, err = writeNodeCompositions(context.Background(), at, comps)
-	if err != nil || len(wrote) != 1 || wrote[0] != key {
-		t.Errorf("a changed composition wrote %v (%v), want %s alone", wrote, err, key)
-	}
-}
-
-// 1945/AC1: a module's compositions outside its five newest fingerprints are deleted with their digests, unless its
-// want or its have names one.
-func TestCompositionsOutsideTheFiveNewestAreDeleted(t *testing.T) {
-	at, _, wants, haves := aPlace(t, "ace")
-	file := json.RawMessage(`{"id":"m.f","type":"file","module":"m","path":"/etc/m","content":"x"}`)
-	fp := func(i int) string { return sdkdelivery.SourcePrefix2 + strings.Repeat(fmt.Sprintf("%x", i), 64) }
-	for i := 1; i <= 8; i++ {
-		c := sdkdelivery.Composed{Node: "ace", Module: "m", FP: fp(i), Resources: []json.RawMessage{file}}
-		key, _ := sdkdelivery.ComposedKey("ace", "m", fp(i))
-		if _, err := writeNodeCompositions(context.Background(), at, map[string]sdkdelivery.Composed{key: c}); err != nil {
-			t.Fatal(err)
-		}
-		if i == 1 {
-			wants["m"] = fp(1)
-		}
-		if i == 2 {
-			haves["m"] = sdkdelivery.Have{FP: fp(2), Phase: sdkdelivery.PhaseRunning, Health: sdkdelivery.HealthOK}
-		}
-	}
-	if err := pruneCompositions(context.Background(), at); err != nil {
-		t.Fatal(err)
-	}
-	for i := 1; i <= 8; i++ {
-		key, _ := sdkdelivery.ComposedKey("ace", "m", fp(i))
-		_, err := at.bucket.Get(context.Background(), key)
-		_, derr := at.digests.Get(context.Background(), key)
-		kept := err == nil && derr == nil
-		wantKept := i >= 4 || i == 1 || i == 2
-		if kept != wantKept {
-			t.Errorf("fingerprint %d kept %v, want %v (the wanted 1, the run 2, the five newest 4 to 8)", i, kept, wantKept)
-		}
-	}
-}
-
-// 1945 (found by the served test): a module the node runs that composes no resource of its own still has its
-// composition, empty, at its fingerprint, so a want can name it; a module the node runs with no fingerprint of the new
-// form gets none.
-func TestAModuleWithNoResourceOfItsOwnStillHasItsComposition(t *testing.T) {
-	body := []byte(`{"declaration":1,"resources":[]}`)
-	fp := sdkdelivery.SourcePrefix2 + strings.Repeat("b", 64)
-	comps, _, _, err := compositionsOf("laptop", body, map[string]string{"board": fp}, nil, []string{"board", "legacy"}, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	key, _ := sdkdelivery.ComposedKey("laptop", "board", fp)
-	c, ok := comps[key]
-	if !ok || len(c.Resources) != 0 {
-		t.Fatalf("the board's composition: %+v (%v)", c, ok)
-	}
-	if _, err := sdkdelivery.EncodeComposed(c); err != nil {
-		t.Errorf("an empty composition does not encode: %v", err)
-	}
-	for k := range comps {
-		if strings.Contains(k, "legacy") {
-			t.Errorf("a module with no fingerprint of the new form was composed: %s", k)
-		}
-	}
-}
-
-// 1945/AC16 (unit): a module the controller knows no fingerprint of the new form for, whose want or have on the node
-// names its own composition, is never in the node's own composition, neither its resources nor its filled paths, and is
-// named as left; a module neither names still goes with the node's own, its filled path with it. (Live from 2026-10-25
-// 12:43: zsh, power, restic and more were in both, and every node refused "2 resources declare X".)
-func TestAModuleItsWantNamesIsNeverInTheNodesOwnComposition(t *testing.T) {
-	body := []byte(`{"declaration":1,"resources":[
-		{"id":"zsh.rc","type":"file","module":"zsh","path":"/etc/zsh/zshrc"},
-		{"id":"power.unit","type":"file","module":"power","path":"/etc/power.conf"},
-		{"id":"mesh-wireguard.conf","type":"file","module":"mesh-wireguard","path":"/etc/wireguard/mesh0.conf"}],
-		"filled_files":["/etc/zsh/zshrc","/etc/power.conf","/etc/wireguard/mesh0.conf"]}`)
-	asked := map[string]int{}
-	named := func(module string) (bool, error) {
-		asked[module]++
-		return module == "zsh" || module == "power", nil
-	}
-	comps, moved, left, err := compositionsOf("ace", body, map[string]string{}, nil, nil, named)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if strings.Join(left, ",") != "power,zsh" || strings.Join(moved, ",") != "mesh-wireguard" {
-		t.Errorf("left %v, moved %v; want power,zsh left and mesh-wireguard moved", left, moved)
-	}
-	if asked["zsh"] != 1 || asked["power"] != 1 {
-		t.Errorf("asked each module once: %v", asked)
-	}
-	own, _ := sdkdelivery.ComposedNodeKey("ace")
-	for key, c := range comps {
-		for _, id := range resourceIDs(t, c.Resources) {
-			if strings.HasPrefix(id, "zsh.") || strings.HasPrefix(id, "power.") {
-				t.Errorf("%s holds %s, which the module's own composition declares", key, id)
-			}
-		}
-		for _, p := range c.Filled {
-			if p == "/etc/zsh/zshrc" || p == "/etc/power.conf" {
-				t.Errorf("%s names %s as filled, which the module's own composition names", key, p)
-			}
-		}
-	}
-	if ids := strings.Join(resourceIDs(t, comps[own].Resources), " "); ids != "mesh-wireguard.conf" {
-		t.Errorf("the node's own composition holds %q, want mesh-wireguard.conf alone", ids)
-	}
-	if f := strings.Join(comps[own].Filled, " "); f != "/etc/wireguard/mesh0.conf" {
-		t.Errorf("the node's own composition names %q as filled, want mesh-wireguard's file alone", f)
-	}
-
-	if _, _, _, err := compositionsOf("ace", body, map[string]string{}, nil, nil,
-		func(string) (bool, error) { return false, fmt.Errorf("the wants bucket is gone") }); err == nil {
-		t.Errorf("a want that cannot be read composed the node anyway")
-	}
-}

cmd/mesh-controller/composer.go

@@ -1,127 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"sort"
-	"sync"
-)
-
-// **One composer, one pass at a time, each node once per pass** (issue 1945). A done key's take-in registers its module
-// and asks the composer for its nodes; the composer gathers every node asked for while a pass runs and composes them in
-// the next pass, in one composition of each node, then writes the grants once. Before, each take-in of a burst composed
-// every node of its module itself, at once: they collided on the compositions' revisions ("wrong last sequence … key
-// revision mismatch"), retried every 30 s, and the take-in that mattered waited behind them (2026-10-25 at 11:18 and
-// 12:32). A caller waits for the pass that began after it asked, and hears that pass's error.
-type composer struct {
-	composeNodes func(ctx context.Context, nodes []string) map[string]error
-	writeGrants  func(ctx context.Context) error
-
-	mu      sync.Mutex
-	pending map[string]bool
-	grants  bool
-	waiters []waiter
-	wake    chan struct{}
-}
-
-// waiter is a caller waiting for its pass: the nodes it asked for, whether it asked for the grants, and where its answer
-// goes.
-type waiter struct {
-	nodes  []string
-	grants bool
-	done   chan passResult
-}
-
-// passResult is a waiter's answer: the error of each of its nodes that failed, and of the grants when it asked for them.
-type passResult struct {
-	failed map[string]error
-	grants error
-}
-
-func newComposer(compose func(context.Context, []string) map[string]error, grants func(context.Context) error) *composer {
-	return &composer{composeNodes: compose, writeGrants: grants, pending: map[string]bool{}, wake: make(chan struct{}, 1)}
-}
-
-// compose asks for the nodes to be composed, and the grants written after when grants is true, and waits for the pass
-// that does it, with the errors of its own nodes alone.
-func (c *composer) compose(ctx context.Context, nodes []string, grants bool) error {
-	failed, grantsErr, err := c.composeEach(ctx, nodes, grants)
-	if err != nil {
-		return err
-	}
-	var errs []error
-	for _, n := range nodes {
-		if e := failed[n]; e != nil {
-			errs = append(errs, e)
-		}
-	}
-	return errors.Join(append(errs, grantsErr)...)
-}
-
-// composeEach is compose answering each node's error apart, and the grants' (ADR 0544 §5: a batch of take-ins asks one
-// pass and settles each module by its own nodes); err is ctx's when it ends first.
-func (c *composer) composeEach(ctx context.Context, nodes []string, grants bool) (map[string]error, error, error) {
-	done := make(chan passResult, 1)
-	c.mu.Lock()
-	for _, n := range nodes {
-		c.pending[n] = true
-	}
-	c.grants = c.grants || grants
-	c.waiters = append(c.waiters, waiter{nodes: nodes, grants: grants, done: done})
-	c.mu.Unlock()
-	select {
-	case c.wake <- struct{}{}:
-	default:
-	}
-	select {
-	case r := <-done:
-		return r.failed, r.grants, nil
-	case <-ctx.Done():
-		return nil, nil, ctx.Err()
-	}
-}
-
-// run makes the passes until ctx ends: each takes everything asked for since the last began.
-func (c *composer) run(ctx context.Context) {
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-c.wake:
-		}
-		c.mu.Lock()
-		nodes := make([]string, 0, len(c.pending))
-		for n := range c.pending {
-			nodes = append(nodes, n)
-		}
-		grants, waiters := c.grants, c.waiters
-		c.pending, c.grants, c.waiters = map[string]bool{}, false, nil
-		c.mu.Unlock()
-		if len(waiters) == 0 {
-			continue
-		}
-		sort.Strings(nodes)
-		var failed map[string]error
-		if len(nodes) > 0 {
-			failed = c.composeNodes(ctx, nodes)
-		}
-		// The grants whenever a caller asked for them, whatever a node's composition said: a node that failed fails its
-		// own callers alone (issue 1945).
-		var grantsErr error
-		if grants {
-			grantsErr = c.writeGrants(ctx)
-		}
-		for _, w := range waiters {
-			r := passResult{failed: map[string]error{}}
-			for _, n := range w.nodes {
-				if err := failed[n]; err != nil {
-					r.failed[n] = err
-				}
-			}
-			if w.grants {
-				r.grants = grantsErr
-			}
-			w.done <- r
-		}
-	}
-}

cmd/mesh-controller/composer_test.go

@@ -1,143 +0,0 @@
-package main
-
-import (
-	"context"
-	"slices"
-	"sort"
-	"sync"
-	"testing"
-	"time"
-)
-
-// A burst of done keys composes each node once per pass and writes the grants once, never two passes at a time: the
-// take-ins of a burst each composed every node of their module at once, collided on the compositions' revisions and
-// retried every 30 s, while the one that mattered (mesh-host's) waited (issue 1945, live on 2026-10-25 at 11:18 and
-// 12:32).
-func TestABurstComposesEachNodeOncePerPass(t *testing.T) {
-	var mu sync.Mutex
-	var passes [][]string
-	grants := 0
-	running, maxRunning := 0, 0
-	release := make(chan struct{})
-	first := true
-	c := newComposer(func(_ context.Context, nodes []string) map[string]error {
-		mu.Lock()
-		running++
-		maxRunning = max(maxRunning, running)
-		passes = append(passes, slices.Clone(nodes))
-		wait := first
-		first = false
-		mu.Unlock()
-		if wait {
-			<-release // the first pass runs while the rest of the burst arrives
-		}
-		mu.Lock()
-		running--
-		mu.Unlock()
-		return nil
-	}, func(context.Context) error {
-		mu.Lock()
-		grants++
-		mu.Unlock()
-		return nil
-	})
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	go c.run(ctx)
-
-	var wg sync.WaitGroup
-	wg.Add(1)
-	go func() { defer wg.Done(); _ = c.compose(ctx, []string{"ace"}, true) }()
-	time.Sleep(20 * time.Millisecond)
-	for _, nodes := range [][]string{{"ace", "g14"}, {"g14"}, {"shanks", "ace"}, {"novox"}, {"ace"}} {
-		wg.Add(1)
-		go func() { defer wg.Done(); _ = c.compose(ctx, nodes, true) }()
-	}
-	time.Sleep(20 * time.Millisecond)
-	close(release)
-	wg.Wait()
-
-	mu.Lock()
-	defer mu.Unlock()
-	if maxRunning != 1 {
-		t.Fatalf("%d passes ran at once", maxRunning)
-	}
-	if len(passes) != 2 {
-		t.Fatalf("passes %v: want the first and one more for the rest of the burst", passes)
-	}
-	second := slices.Clone(passes[1])
-	sort.Strings(second)
-	if !slices.Equal(second, []string{"ace", "g14", "novox", "shanks"}) {
-		t.Fatalf("the second pass composed %v: each node once", passes[1])
-	}
-	if grants != 2 {
-		t.Fatalf("the grants were written %d times for two passes", grants)
-	}
-}
-
-// A caller hears its own pass's failure, and only a pass that began after it asked counts as its own.
-func TestACallerHearsThePassThatComposedItsNodes(t *testing.T) {
-	calls := 0
-	c := newComposer(func(_ context.Context, nodes []string) map[string]error {
-		calls++
-		if calls == 1 {
-			return map[string]error{"ace": context.DeadlineExceeded}
-		}
-		return nil
-	}, func(context.Context) error { return nil })
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	go c.run(ctx)
-	if err := c.compose(ctx, []string{"ace"}, false); err == nil {
-		t.Fatal("a failed pass was not heard")
-	}
-	if err := c.compose(ctx, []string{"ace"}, false); err != nil {
-		t.Fatalf("a good pass said %v", err)
-	}
-}
-
-// One node that fails its composition fails only the callers that asked for it, and the grants are written whenever a
-// caller asked for them (the review of issue 1945: one joined error failed every take-in of the pass and stopped their
-// grants).
-func TestANodeThatFailsFailsOnlyItsCallers(t *testing.T) {
-	grants := 0
-	release := make(chan struct{})
-	first := true
-	c := newComposer(func(_ context.Context, nodes []string) map[string]error {
-		if first {
-			first = false
-			<-release
-		}
-		out := map[string]error{}
-		for _, n := range nodes {
-			if n == "broken" {
-				out[n] = context.DeadlineExceeded
-			}
-		}
-		return out
-	}, func(context.Context) error { grants++; return nil })
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	go c.run(ctx)
-	go func() { _ = c.compose(ctx, []string{"warm"}, false) }()
-	time.Sleep(20 * time.Millisecond)
-	errs := make(chan error, 2)
-	go func() { errs <- c.compose(ctx, []string{"ace"}, true) }()
-	go func() { errs <- c.compose(ctx, []string{"broken"}, false) }()
-	time.Sleep(20 * time.Millisecond)
-	close(release)
-	var failed, fine int
-	for range 2 {
-		if err := <-errs; err != nil {
-			failed++
-		} else {
-			fine++
-		}
-	}
-	if failed != 1 || fine != 1 {
-		t.Fatalf("failed %d, fine %d: only the caller of the broken node fails", failed, fine)
-	}
-	if grants != 1 {
-		t.Fatalf("the grants were written %d times; a caller asked for them", grants)
-	}
-}

cmd/mesh-controller/condition_looks.go

@@ -1,76 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/novox/mesh-controller/internal/conditions"
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// The looks of the open conditions — how often each was observed, when last, its newest evidence — are
-// kept in the controller's store, not the conditions bucket (novox/hq issue 420, ADR 0289 §1): the bucket
-// is written when what a condition says changes, never for a look that saw it as it was.
-
-// storeLooks keeps the conditions' looks in the inventory.
-type storeLooks struct{ inv *inventory.Inventory }
-
-func (s storeLooks) KeepLooks(ctx context.Context, key string, l conditions.Looks) error {
-	evidence, err := json.Marshal(l.Evidence)
-	if err != nil {
-		return err
-	}
-	return s.inv.KeepConditionLooks(ctx, inventory.ConditionLooks{Key: key, Observations: l.Observations,
-		LastObserved: l.LastObserved, Evidence: evidence})
-}
-
-func (s storeLooks) Looked(ctx context.Context, key string) (conditions.Looks, bool, error) {
-	row, kept, err := s.inv.ConditionLooksOf(ctx, key)
-	if err != nil || !kept {
-		return conditions.Looks{}, kept, err
-	}
-	l, err := looksOf(row)
-	return l, err == nil, err
-}
-
-func (s storeLooks) AllLooks(ctx context.Context) (map[string]conditions.Looks, error) {
-	rows, err := s.inv.AllConditionLooks(ctx)
-	if err != nil {
-		return nil, err
-	}
-	out := make(map[string]conditions.Looks, len(rows))
-	for key, row := range rows {
-		l, err := looksOf(row)
-		if err != nil {
-			return nil, err
-		}
-		out[key] = l
-	}
-	return out, nil
-}
-
-func (s storeLooks) ForgetLooks(ctx context.Context, key string) error {
-	return s.inv.ForgetConditionLooks(ctx, key)
-}
-
-func looksOf(row inventory.ConditionLooks) (conditions.Looks, error) {
-	l := conditions.Looks{Observations: row.Observations, LastObserved: row.LastObserved.UTC()}
-	if len(row.Evidence) > 0 {
-		if err := json.Unmarshal(row.Evidence, &l.Evidence); err != nil {
-			return conditions.Looks{}, fmt.Errorf("the evidence kept for the condition %s cannot be read: %w", row.Key, err)
-		}
-	}
-	return l, nil
-}
-
-// looksHere is where a process that is not the serving controller reads the conditions' looks: the store,
-// opened for it, closed by the function returned. A store that cannot be opened is said on every condition
-// read through it, never read as none.
-func looksHere(ctx context.Context) (conditions.LookStore, func()) {
-	inv, err := openInventory(ctx)
-	if err != nil {
-		return conditions.NoLooks{Err: err}, func() {}
-	}
-	return storeLooks{inv}, inv.Close
-}

cmd/mesh-controller/condition_looks_test.go

@@ -1,89 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"testing"
-	"time"
-
-	"github.com/nats-io/nats.go/jetstream"
-
-	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/conditions"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/testbus"
-)
-
-// **Looks at an unchanged condition write the bucket once, and `conditions` still says how often and when
-// it was seen** (novox/hq issue 420): the looks are in the controller's store, and the verb, run as a
-// process of its own, reads them from there. On 2026-10-10 one open condition had rewritten the bucket 7 003
-// times in two days.
-func TestTheConditionsVerbReadsTheLooksTheBucketNoLongerHolds(t *testing.T) {
-	inv := inventory.ForTest(t)
-	bus := testbus.Start(t)
-	serving, err := broker.Dial(bus.ClientURL())
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer serving.Close()
-	if err := serving.EnsureControllerBuckets(); err != nil {
-		t.Fatal(err)
-	}
-	ctx := t.Context()
-	store, history, err := conditions.OnTheBus(ctx, serving.Conn())
-	if err != nil {
-		t.Fatal(err)
-	}
-	k := conditions.NewKeeper(ctx, conditions.Options{Store: store, History: history, Looks: storeLooks{inv}})
-	defer k.Close(context.Background())
-	look := conditions.Observation{Scope: conditions.ScopeMachine, ID: "anchor", Kind: "silent", Machine: "anchor",
-		Severity: conditions.Warning, Summary: "anchor has not been heard from", Source: "S1"}
-	for range 4 {
-		if _, err := k.Observe(ctx, look); err != nil {
-			t.Fatal(err)
-		}
-	}
-
-	api, err := jetstream.New(serving.Conn())
-	if err != nil {
-		t.Fatal(err)
-	}
-	stream, err := api.Stream(ctx, "KV_"+broker.ConditionsBucket)
-	if err != nil {
-		t.Fatal(err)
-	}
-	info, err := stream.Info(ctx)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if info.State.LastSeq != 1 {
-		t.Fatalf("four looks at one unchanged condition wrote the bucket %d times, want 1", info.State.LastSeq)
-	}
-
-	// The verb as a process other than the serving controller: it reads the bucket and the store.
-	keptBefore := conditionsFrom
-	conditionsFrom = nil
-	defer func() { conditionsFrom = keptBefore }()
-	t.Setenv(broker.NATSVar, bus.ClientURL())
-	t.Setenv(broker.CertificateVar, "")
-	var shown bytes.Buffer
-	if err := showCondition(ctx, []string{"machine.anchor.silent", "--json"}, &shown); err != nil {
-		t.Fatal(err)
-	}
-	var c conditions.Condition
-	if err := json.Unmarshal(shown.Bytes(), &c); err != nil {
-		t.Fatalf("%v: %s", err, shown.String())
-	}
-	if c.Observations != 4 || len(c.Evidence) != 4 || c.LastObserved.IsZero() || c.LooksUnread != "" ||
-		time.Since(c.LastObserved) > time.Minute {
-		t.Fatalf("conditions show reads %d observation(s), %d evidence line(s), last %s (%q)", c.Observations,
-			len(c.Evidence), c.LastObserved, c.LooksUnread)
-	}
-	listed, err := openConditions(ctx)
-	if err != nil || len(listed) != 1 || listed[0].Observations != 4 {
-		t.Fatalf("conditions lists %+v: %v", listed, err)
-	}
-}

cmd/mesh-controller/conditions.go

@@ -1,491 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"flag"
-	"fmt"
-	"io"
-	"os"
-	"slices"
-	"strconv"
-	"strings"
-	"time"
-
-	"github.com/nats-io/nats.go"
-
-	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/conditions"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// What is wrong, kept until observation says it is not (novox/hq to-be 45 §2, ADR 0227).
-//
-// **`status` used to be the only place the mesh said it was wrong, and only to whoever asked.** Every
-// core failure of research 031 was found by a person looking. A condition is the mesh saying it: raised
-// by a watchdog when a signal is late (signals.go), by a probe when an invariant does not hold
-// (doctor.go), or by an event a provider sends (standing.go); kept on the bus with since-when, and its
-// looks — how often, when last, the newest evidence — in the controller's store (condition_looks.go,
-// novox/hq issue 420); said on the bus as it changes, for the operator's channel to carry; and cleared when an
-// observation says it is resolved. Nobody resolves one by hand. A person who knows silences it, for a
-// while, with a reason, and that is recorded as a hand act.
-
-// conditionsFrom is the serving controller's keeper; nil in any other process, which opens its own.
-var conditionsFrom *conditions.Keeper
-
-// keeperOn is a keeper over the store on a connection, saying its transitions on that connection, with
-// the conditions' looks kept in looks (condition_looks.go).
-func keeperOn(ctx context.Context, conn *nats.Conn, looks conditions.LookStore) (*conditions.Keeper, error) {
-	store, history, err := conditions.OnTheBus(ctx, conn)
-	if err != nil {
-		return nil, err
-	}
-	js, err := conn.JetStream()
-	if err != nil {
-		return nil, err
-	}
-	return conditions.NewKeeper(ctx, conditions.Options{Store: store, History: history, Looks: looks,
-		Teller: link.OverNATS{Conn: conn, JS: js},
-		Say:    func(format string, args ...any) { fmt.Fprintf(os.Stderr, format+"\n", args...) },
-		// What status leads with changed: composed again soon (a nudge outside the serving controller
-		// does nothing).
-		Changed: func() { statusFrom.nudge(); askerFrom.Load().nudge() },
-		// Written under the lease, carrying its epoch (novox/hq to-be 45 §6).
-		Epoch: func() (uint64, error) { return theLease.epoch(context.WithoutCancel(ctx)) }}), nil
-}
-
-// withKeeper runs f with the serving controller's keeper, or one of its own that says everything
-// it was given before it returns.
-func withKeeper(ctx context.Context, f func(*conditions.Keeper) error) error {
-	if conditionsFrom != nil {
-		return f(conditionsFrom)
-	}
-	looks, closeLooks := looksHere(ctx)
-	defer closeLooks()
-	return onTheBus(func(conn *nats.Conn) error {
-		k, err := keeperOn(ctx, conn, looks)
-		if err != nil {
-			return err
-		}
-		defer func() {
-			flushing, cancel := context.WithTimeout(context.Background(), 15*time.Second)
-			defer cancel()
-			k.Close(flushing)
-		}()
-		return f(k)
-	})
-}
-
-// openConditions is every open condition, for `status` and `node show`: from the serving keeper, or
-// read from the bus. Where there is no bus to read it from, it says so — never "none open".
-func openConditions(ctx context.Context) ([]conditions.Condition, error) {
-	if conditionsFrom != nil {
-		return conditionsFrom.Open(ctx)
-	}
-	if _, err := broker.BusAddress(); err != nil {
-		return nil, fmt.Errorf("this process has no bus to read the conditions from: %w", err)
-	}
-	var out []conditions.Condition
-	looks, closeLooks := looksHere(ctx)
-	defer closeLooks()
-	err := onTheBus(func(conn *nats.Conn) error {
-		store, _, err := conditions.OnTheBus(ctx, conn)
-		if err != nil {
-			return err
-		}
-		reading, cancel := context.WithTimeout(ctx, 5*time.Second)
-		defer cancel()
-		out, err = conditions.ReadWith(reading, store, looks)
-		return err
-	})
-	return out, err
-}
-
-// conditionsUsage is how the verb is typed.
-const conditionsUsage = "conditions [--scope S] [--severity urgent|warning] [--machine M] [--json] | " +
-	"conditions show <key> | conditions silence <key> --for <duration> --why <text> | " +
-	"conditions history [--days N] [--key K] [--json]"
-
-// conditionsCommand is `conditions`, `conditions show`, `conditions silence` and `conditions history`.
-func conditionsCommand(ctx context.Context, args []string) error {
-	sub := "list"
-	if len(args) > 0 && !strings.HasPrefix(args[0], "-") {
-		sub, args = args[0], args[1:]
-	}
-	switch sub {
-	case "list":
-		return listConditions(ctx, args, os.Stdout)
-	case "show":
-		return showCondition(ctx, args, os.Stdout)
-	case "silence":
-		return silenceCondition(ctx, args)
-	case "history":
-		return conditionHistory(ctx, args, os.Stdout)
-	}
-	return errors.New(conditionsUsage)
-}
-
-func listConditions(ctx context.Context, args []string, w io.Writer) error {
-	set := flag.NewFlagSet("conditions", flag.ContinueOnError)
-	usageTo(set, w)
-	scope := set.String("scope", "", "only this scope: "+strings.Join(conditions.Scopes, ", "))
-	severity := set.String("severity", "", "only urgent, or only warning")
-	machine := set.String("machine", "", "only those about this machine")
-	asJSON := set.Bool("json", false, "as data")
-	if rest, err := parseAround(set, args); err != nil {
-		return err
-	} else if len(rest) > 0 {
-		return errors.New(conditionsUsage)
-	}
-	if *severity != "" && *severity != string(conditions.Urgent) && *severity != string(conditions.Warning) {
-		return fmt.Errorf("a severity is urgent or warning, not %q", *severity)
-	}
-	open, err := openConditions(ctx)
-	if err != nil {
-		return err
-	}
-	var out []conditions.Condition
-	for _, c := range open {
-		if (*scope == "" || c.Subject.Scope == *scope) && (*severity == "" || string(c.Severity) == *severity) &&
-			(*machine == "" || concerns(c, *machine)) {
-			out = append(out, c)
-		}
-	}
-	if *asJSON {
-		return printJSONTo(w, map[string]any{"conditions": inBrief(out), "open": len(open), "counted": counted(out),
-			"note": "urgent first, then oldest first; a condition clears when observation says so, never by hand; " +
-				"each with its newest evidence — `conditions key=<key>` gives one whole"})
-	}
-	if len(out) == 0 {
-		if len(open) == 0 {
-			fmt.Fprintln(w, "no open conditions")
-		} else {
-			fmt.Fprintf(w, "none of the %d open condition(s) is about that\n", len(open))
-		}
-		return nil
-	}
-	for _, line := range conditionLines(out, time.Now()) {
-		fmt.Fprintln(w, line)
-	}
-	return nil
-}
-
-// briefEvidence is how many observations a condition carries in a list of them: its newest. The store
-// keeps ten, and a list of hundreds of conditions with ten each was the larger half of an answer more
-// than the bus carries in one message (novox/hq issue 314). One condition whole is `conditions key=`.
-const briefEvidence = 1
-
-// conditionInBrief is a condition as a list carries it: its newest evidence, with how much more there is
-// and where to read it. Everything else of it, so a reader of the list — the operator's channel among
-// them — reads the same condition it always did.
-type conditionInBrief struct {
-	conditions.Condition
-	// EvidenceKept is how many observations the condition keeps, when the list shows fewer.
-	EvidenceKept int    `json:"evidence-kept,omitempty"`
-	More         string `json:"more,omitempty"`
-}
-
-// inBrief is a list of conditions in brief; never null.
-func inBrief(list []conditions.Condition) []conditionInBrief {
-	out := make([]conditionInBrief, 0, len(list))
-	for _, c := range list {
-		b := conditionInBrief{Condition: c}
-		if len(c.Evidence) > briefEvidence {
-			b.EvidenceKept = len(c.Evidence)
-			b.Evidence = c.Evidence[:briefEvidence:briefEvidence]
-			b.More = c.Show()
-		}
-		out = append(out, b)
-	}
-	return out
-}
-
-// counted is how many of a list each source raised of each kind — `D14 stalled: 689` — so a list of
-// hundreds says its shape before its lines.
-func counted(list []conditions.Condition) map[string]int {
-	out := map[string]int{}
-	for _, c := range list {
-		out[c.Source+" "+c.Kind]++
-	}
-	return out
-}
-
-// concerns says whether a condition is about a machine: it names it, or its key does.
-func concerns(c conditions.Condition, machine string) bool {
-	if c.Subject.Machine == machine || slices.Contains(c.Subject.Also, machine) {
-		return true
-	}
-	for _, part := range strings.Split(c.Key, ".") {
-		if part == machine {
-			return true
-		}
-	}
-	return false
-}
-
-// conditionLines is how a list of conditions reads: one line each, its silence under it.
-func conditionLines(list []conditions.Condition, now time.Time) []string {
-	var out []string
-	for _, c := range list {
-		times := ""
-		if c.Count > 1 {
-			times = fmt.Sprintf(", raised %d times", c.Count)
-		}
-		out = append(out, fmt.Sprintf("  %-7s %s — %s (since %s%s)", strings.ToUpper(string(c.Severity)),
-			c.Key, c.Summary, c.Raised.Local().Format("2006-01-02 15:04"), times))
-		if c.SilencedAt(now) {
-			out = append(out, fmt.Sprintf("          silenced until %s by %s: %s",
-				c.Silenced.Until.Local().Format("2006-01-02 15:04"), c.Silenced.By, c.Silenced.Why))
-		}
-	}
-	return out
-}
-
-func showCondition(ctx context.Context, args []string, w io.Writer) error {
-	set := flag.NewFlagSet("conditions show", flag.ContinueOnError)
-	usageTo(set, w)
-	asJSON := set.Bool("json", false, "as data")
-	rest, err := parseAround(set, args)
-	if err != nil {
-		return err
-	}
-	if len(rest) != 1 {
-		return errors.New("conditions show <key>")
-	}
-	key := rest[0]
-	var c conditions.Condition
-	var found bool
-	if conditionsFrom != nil {
-		c, found, err = conditionsFrom.Get(ctx, key)
-	} else {
-		looks, closeLooks := looksHere(ctx)
-		defer closeLooks()
-		err = onTheBus(func(conn *nats.Conn) error {
-			store, _, err := conditions.OnTheBus(ctx, conn)
-			if err != nil {
-				return err
-			}
-			c, found, err = conditions.ReadOneWith(ctx, store, looks, key)
-			return err
-		})
-	}
-	if err != nil {
-		return err
-	}
-	if !found {
-		return fmt.Errorf("no condition %s is open — `conditions` lists those that are, and `conditions "+
-			"history --key %s` what became of it", key, key)
-	}
-	if *asJSON {
-		return printJSONTo(w, c)
-	}
-	now := time.Now()
-	fmt.Fprintf(w, "%s  %s\n  %s\n\n", strings.ToUpper(string(c.Severity)), c.Key, c.Summary)
-	fmt.Fprintf(w, "  kind       %s\n  about      %s %s", c.Kind, c.Subject.Scope, c.Subject.ID)
-	if c.Subject.Machine != "" {
-		fmt.Fprintf(w, ", on %s", c.Subject.Machine)
-	}
-	fmt.Fprintf(w, "\n  raised by  %s\n  since      %s (%s ago), observed %d time(s), last %s ago\n",
-		c.Source, c.Raised.Local().Format("2006-01-02 15:04:05"), roughly(now.Sub(c.Raised)), c.Observations,
-		now.Sub(c.LastObserved).Round(time.Second))
-	if c.Count > 1 {
-		fmt.Fprintf(w, "  raised     %d times, each within ten minutes of clearing\n", c.Count)
-	}
-	fmt.Fprintf(w, "  resolved   by %s\n", resolverWords(c.Resolver))
-	if c.Silenced != nil {
-		fmt.Fprintf(w, "  silenced   until %s by %s: %s\n", c.Silenced.Until.Local().Format("2006-01-02 15:04"),
-			c.Silenced.By, c.Silenced.Why)
-	}
-	if len(c.Tried) > 0 {
-		fmt.Fprintln(w, "\n  tried:")
-		for _, t := range c.Tried {
-			fmt.Fprintf(w, "    %s  %s — %s: %s\n", t.At.Local().Format("2006-01-02 15:04"), orHealer(t.By), t.What, t.Outcome)
-		}
-	}
-	fmt.Fprintln(w, "\n  evidence, newest first:")
-	for _, e := range c.Evidence {
-		fmt.Fprintf(w, "    %s  %s\n", e.At.Local().Format("2006-01-02 15:04:05"), e.Said)
-	}
-	return nil
-}
-
-func resolverWords(r string) string {
-	switch r {
-	case conditions.ResolverSelf:
-		return "itself: it clears when observation says it is resolved"
-	case conditions.ResolverOperator:
-		return "the operator: nothing in the mesh will repair it"
-	case conditions.ResolverAgent:
-		return "an agent"
-	}
-	return r
-}
-
-// silenceCondition stops a condition's messages for a while (to-be 45 §2). A hand act: recorded with
-// who and why before it is done, its cause the condition's kind unless one is given.
-func silenceCondition(ctx context.Context, args []string) error {
-	set := flag.NewFlagSet("conditions silence", flag.ContinueOnError)
-	forFlag := set.String("for", "", "how long: 30m, 4h, 2d — at most 7d")
-	acts := addHandActFlags(set)
-	rest, err := parseAround(set, args)
-	if err != nil {
-		return err
-	}
-	if len(rest) != 1 {
-		return errors.New("conditions silence <key> --for <duration> --why <text>")
-	}
-	key := rest[0]
-	if err := acts.require("conditions silence"); err != nil {
-		return err
-	}
-	d, err := parseFor(*forFlag)
-	if err != nil {
-		return err
-	}
-	if d > conditions.MaxSilence {
-		return fmt.Errorf("a condition is silenced for at most %s at once; past it, say so again", conditions.MaxSilence)
-	}
-	return withKeeper(ctx, func(k *conditions.Keeper) error {
-		c, found, err := k.Get(ctx, key)
-		if err != nil {
-			return err
-		}
-		if !found {
-			return fmt.Errorf("no condition %s is open — `conditions` lists them. Nothing was silenced", key)
-		}
-		if strings.TrimSpace(*acts.cause) == "" {
-			*acts.cause = c.Kind
-		}
-		*acts.condition = key
-		acts.record(ctx, "conditions silence", []string{key, "--for", *forFlag})
-		held, err := k.Silence(ctx, key, d, link.Caller(), *acts.why)
-		if err != nil {
-			return err
-		}
-		fmt.Printf("%s is silenced until %s: no message is sent for it until then. It is still open, and "+
-			"`status` still says it; it clears when observation says it is resolved\n",
-			held.Key, held.Silenced.Until.Local().Format("2006-01-02 15:04"))
-		return nil
-	})
-}
-
-// parseFor reads a duration, days included.
-func parseFor(s string) (time.Duration, error) {
-	s = strings.TrimSpace(s)
-	if s == "" {
-		return 0, errors.New("say for how long: --for 30m, 4h or 2d")
-	}
-	if days, ok := strings.CutSuffix(s, "d"); ok {
-		n, err := strconv.Atoi(days)
-		if err != nil || n <= 0 {
-			return 0, fmt.Errorf("%q is not a number of days", s)
-		}
-		return time.Duration(n) * 24 * time.Hour, nil
-	}
-	d, err := time.ParseDuration(s)
-	if err != nil || d <= 0 {
-		return 0, fmt.Errorf("%q is not a duration: 30m, 4h or 2d", s)
-	}
-	return d, nil
-}
-
-func conditionHistory(ctx context.Context, args []string, w io.Writer) error {
-	set := flag.NewFlagSet("conditions history", flag.ContinueOnError)
-	usageTo(set, w)
-	days := set.Int("days", 7, "how many days back, at most 90")
-	key := set.String("key", "", "only this condition")
-	asJSON := set.Bool("json", false, "as data")
-	if rest, err := parseAround(set, args); err != nil {
-		return err
-	} else if len(rest) > 0 {
-		return errors.New("conditions history [--days N] [--key K] [--json]")
-	}
-	since := time.Now().Add(-time.Duration(*days) * 24 * time.Hour)
-	var events []conditions.Event
-	read := func(h conditions.History) error {
-		var err error
-		events, err = h.Since(ctx, since)
-		return err
-	}
-	var err error
-	if conditionsFrom != nil {
-		events, err = conditionsFrom.HistorySince(ctx, since)
-	} else {
-		err = onTheBus(func(conn *nats.Conn) error {
-			_, history, err := conditions.OnTheBus(ctx, conn)
-			if err != nil {
-				return err
-			}
-			return read(history)
-		})
-	}
-	if err != nil {
-		return err
-	}
-	var out []conditions.Event
-	for _, e := range events {
-		if *key == "" || e.Key == *key {
-			out = append(out, e)
-		}
-	}
-	if *asJSON {
-		if out == nil {
-			out = []conditions.Event{}
-		}
-		return printJSONTo(w, map[string]any{"history": out, "days": *days})
-	}
-	if len(out) == 0 {
-		fmt.Fprintf(w, "nothing was raised, changed or cleared in the last %d day(s)\n", *days)
-		return nil
-	}
-	for _, e := range out {
-		line := fmt.Sprintf("%s  %-13s %s", e.At.Local().Format("2006-01-02 15:04:05"), e.Change, e.Key)
-		switch e.Change {
-		case conditions.ChangeRaised, conditions.ChangeReopened:
-			line += " — " + e.Summary
-		case conditions.ChangeSeverity:
-			line += fmt.Sprintf(" — %s, was %s", e.Severity, e.Was)
-		case conditions.ChangeResolver:
-			line += fmt.Sprintf(" — %s, was %s", e.Resolver, e.Was)
-		default:
-			if e.Why != "" {
-				line += " — " + e.Why
-			}
-		}
-		fmt.Fprintln(w, line)
-	}
-	return nil
-}
-
-// printConditions is the status section that leads it: every open condition, urgent first, oldest
-// first, silenced ones with their expiry (to-be 45 §2). A store that could not be read is said, and
-// is not "none open".
-func printConditions(list []conditions.Condition, unread string, now time.Time) {
-	if unread != "" {
-		fmt.Printf("the open conditions could NOT be read, so whether anything is wrong is not known: %s\n\n", unread)
-		return
-	}
-	if len(list) == 0 {
-		return
-	}
-	urgent := 0
-	for _, c := range list {
-		if c.Severity == conditions.Urgent {
-			urgent++
-		}
-	}
-	fmt.Printf("%d open condition(s), %d urgent:\n\n", len(list), urgent)
-	for _, line := range conditionLines(list, now) {
-		fmt.Println(line)
-	}
-	fmt.Printf("\n  `conditions show <key>` says more; each clears when observation says it is resolved, " +
-		"never by hand — `conditions silence <key> --for <d> --why <text>` stops its messages\n\n")
-}
-
-// orHealer is who tried, as an attempt names it.
-func orHealer(by string) string {
-	if by == "" {
-		return "a healer"
-	}
-	return by
-}

cmd/mesh-controller/conditions_brief_integration_test.go

@@ -1,43 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"fmt"
-	"strings"
-	"testing"
-	"time"
-)
-
-func TestAVerdictCarriesAProbesFindingsInBrief(t *testing.T) {
-	var found []string
-	for i := 0; i < 689; i++ {
-		found = append(found, fmt.Sprintf("delivery d-%012x has been checking for 13h, past its bound of 45m", i))
-	}
-	run := doctorRun{Run: "run-1", Probes: []probeVerdict{{ID: "D14", Verdict: "failed", Found: found},
-		{ID: "D1", Verdict: "passed"}}}
-	answer, err := verdictAnswer(run, time.Now(), "")
-	if err != nil {
-		t.Fatal(err)
-	}
-	brief := answer["run"].(doctorRun).Probes[0]
-	if len(brief.Found) != overviewFindings || brief.FoundCount != 689 || !strings.Contains(brief.More, "probe=D14") {
-		t.Fatalf("the verdict carries %d findings of D14, count %d, more %q", len(brief.Found), brief.FoundCount, brief.More)
-	}
-	if len(run.Probes[0].Found) != 689 {
-		t.Fatal("the overview cut the run it was made from")
-	}
-	whole, err := verdictAnswer(run, time.Now(), "d14")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if p := whole["run"].(doctorRun).Probes; len(p) != 1 || len(p[0].Found) != 689 || p[0].More != "" {
-		t.Fatalf("doctor probe=D14 answered %+v", p)
-	}
-	if _, err := verdictAnswer(run, time.Now(), "D99"); err == nil {
-		t.Fatal("a probe the run does not have was answered")
-	}
-	if !strings.Contains(doctorText(answer), "probe=D14` gives them all") {
-		t.Fatalf("the text does not say how to read them all:\n%s", doctorText(answer))
-	}
-}

cmd/mesh-controller/conditions_integration_test.go

@@ -1,32 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"errors"
-	"strings"
-	"testing"
-)
-
-func TestUnreadableConditionsAreNotAWellMesh(t *testing.T) {
-	open := aMesh(t)
-	_, store := withConditionsInMemory(t)
-	store.SetFail(errors.New("the bus is away"))
-	asked, err := theThreeQuestions(t.Context(), open)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if asked.well() || asked.conditionsUnread == "" {
-		t.Fatalf("well with its conditions unread: %+v", asked.conditionsUnread)
-	}
-	said := printed(t, func() error { return printStatus(asked) })
-	if !strings.HasPrefix(said, "the open conditions could NOT be read") || strings.Contains(said, "no open conditions") {
-		t.Fatalf("%s", said)
-	}
-	store.SetFail(nil)
-	asked, _ = theThreeQuestions(t.Context(), open)
-	said = printed(t, func() error { return printStatus(asked) })
-	if asked.well() && !strings.Contains(said, "no open conditions;") {
-		t.Fatalf("the all-well sentence does not say no conditions are open:\n%s", said)
-	}
-}

cmd/mesh-controller/conditions_test.go

@@ -1,84 +0,0 @@
-package main
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/conditions"
-)
-
-// The verbs of the condition store (novox/hq to-be 45 §2) as the console reaches them, and status led
-// by what is open.
-
-func TestTheConditionsVerbComposesEachShape(t *testing.T) {
-	for _, c := range []struct {
-		args map[string]any
-		want string
-	}{
-		{map[string]any{}, "conditions --json"},
-		{map[string]any{"severity": "urgent", "machine": "ace"}, "conditions --json --severity urgent --machine ace"},
-		{map[string]any{"key": "machine.ace.silent"}, "conditions show machine.ace.silent --json"},
-		{map[string]any{"history": "true", "days": "3", "key": "machine.ace.silent"},
-			"conditions history --json --days 3 --key machine.ace.silent"},
-		{map[string]any{"silence": "machine.ace.silent", "for": "2h", "why": "on the train"},
-			"conditions silence machine.ace.silent --for 2h --why on the train"},
-		{map[string]any{"run": "true"}, "doctor run --json"},
-		{map[string]any{}, "doctor --json"},
-	} {
-		verb := "conditions"
-		if strings.HasPrefix(c.want, "doctor") {
-			verb = "doctor"
-		}
-		argv, err := argvFor(verb, c.args)
-		if err != nil || strings.Join(argv, " ") != c.want {
-			t.Errorf("%s %v composed %q (%v), want %q", verb, c.args, strings.Join(argv, " "), err, c.want)
-		}
-	}
-	for _, c := range []struct {
-		verb string
-		args map[string]any
-	}{
-		{"conditions", map[string]any{"silence": "machine.ace.silent", "why": "x"}},                           // no for
-		{"doctor", map[string]any{"run": "true", "signals": "true"}},                                          // two at once
-		{"conditions", map[string]any{"silence": "machine.ace.silent", "for": "1h", "why": "x", "days": "3"}}, // passed over
-	} {
-		if argv, err := argvFor(c.verb, c.args); err == nil {
-			t.Errorf("%s %v composed %v", c.verb, c.args, argv)
-		}
-	}
-	if repairingCommand([]string{"conditions", "silence", "k"}) != "conditions silence" {
-		t.Error("a silence is not a hand act")
-	}
-}
-
-// **A silence through the verb is recorded and bounded**; the condition stays open.
-func TestASilenceThroughTheVerbHoldsAndTheConditionStaysOpen(t *testing.T) {
-	k, _ := withConditionsInMemory(t)
-	ctx := t.Context()
-	if _, err := k.Observe(ctx, conditions.Observation{Scope: conditions.ScopeMachine, ID: "ace", Kind: "silent",
-		Severity: conditions.Warning, Summary: "ace is silent", Source: "S1"}); err != nil {
-		t.Fatal(err)
-	}
-	if err := conditionsCommand(ctx, []string{"silence", "machine.ace.silent", "--for", "2d"}); err == nil {
-		t.Fatal("silenced without saying why")
-	}
-	if err := conditionsCommand(ctx, []string{"silence", "machine.ace.silent", "--for", "8d", "--why", "x"}); err == nil {
-		t.Fatal("silenced for more than a week")
-	}
-	said := printed(t, func() error {
-		return conditionsCommand(ctx, []string{"silence", "machine.ace.silent", "--for", "2d", "--why", "on the train"})
-	})
-	if !strings.Contains(said, "is silenced until") {
-		t.Fatalf("%s", said)
-	}
-	c, found, _ := k.Get(ctx, "machine.ace.silent")
-	if !found || c.Silenced == nil || c.Silenced.Why != "on the train" {
-		t.Fatalf("%+v", c)
-	}
-	listed := printed(t, func() error { return conditionsCommand(ctx, nil) })
-	if !strings.Contains(listed, "machine.ace.silent") || !strings.Contains(listed, "silenced until") {
-		t.Fatalf("%s", listed)
-	}
-}
-
-// **Conditions that cannot be read are not none open**: status says so, and is not well.

cmd/mesh-controller/config_move.go

@@ -1,616 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"flag"
-	"fmt"
-	"os"
-	"reflect"
-	"sort"
-	"strings"
-	"time"
-
-	"github.com/nats-io/nats.go"
-	"github.com/nats-io/nats.go/jetstream"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// **The move of config** (novox/hq ADR 0348 §9 and its consequences, design 57 K5, issue 664): every config value a
-// settings layer holds is set in mesh-config, one of the moves of data a release runs once after its delivery, after
-// the move of placement. A module's layer on a node becomes its own value on that node (`module.<node>.<module>.<key>`).
-// A whole-mesh layer has no module value for the whole mesh (ADR 0348 §3): its value becomes mesh config for the
-// predefined key it falls back to where that module alone falls back to the key (claude-code's managed settings
-// become `agent-managed-settings`), and otherwise the module's own value on each node it is assigned to, laid under
-// that node's layer as composition lays it. A key a layer still says by its file's name (nodered's `timeZone`) is
-// set under its config key (`time-zone`, issue 751).
-//
-// **Every node composes byte for byte as before.** The move sets the values, reads every module's resolved values
-// back through mesh-config and compares them with what the layers lay today; only when they agree does it empty the
-// layers it moved (each kept whole in its history first) and turn on the switch (inventory.FinishConfigMove), after
-// which the controller reads mesh-config where it read the layers. A module still in the settings form keeps its
-// layers and is said so. Anything that cannot move as it composes refuses the whole move, by name, before anything
-// is set. Asked again, it sets nothing that is set already.
-
-// configLevel is where mesh-config keeps a value: mesh config, node config, or a module's own value on a node.
-type configLevel struct {
-	Level  string `json:"level"`
-	Node   string `json:"node,omitempty"`
-	Module string `json:"module,omitempty"`
-}
-
-func (l configLevel) valueKey(key string) string {
-	switch l.Level {
-	case "node":
-		return "node." + l.Node + "." + key
-	case "module":
-		return "module." + l.Node + "." + l.Module + "." + key
-	}
-	return "mesh." + key
-}
-
-func (l configLevel) String() string {
-	switch l.Level {
-	case "node":
-		return "node config on " + l.Node
-	case "module":
-		return l.Module + "'s own value on " + l.Node
-	}
-	return "mesh config"
-}
-
-// configSet is one value the move sets in mesh-config, and the layers it comes from.
-type configSet struct {
-	configLevel
-	Key     string `json:"key"`
-	Value   any    `json:"value"`
-	Trusted bool   `json:"trusted,omitempty"`
-	// From is the layers it comes from, as `<module> on <where>: <key as the layer says it>`.
-	From []string `json:"from"`
-	// Already is true when mesh-config holds this value at this level already: nothing is set.
-	Already bool `json:"already,omitempty"`
-}
-
-// configMoveAnswer is what the move of config says it did, or would do.
-type configMoveAnswer struct {
-	// DryRun is true when nothing was set: asked without --confirm.
-	DryRun bool        `json:"dry-run"`
-	Sets   []configSet `json:"sets"`
-	// Moved is each layer whose values the move sets, emptied once they read back.
-	Moved []string `json:"moved"`
-	// Stays is each layer of a module still in the settings form: kept, and composed from as before.
-	Stays []string `json:"stays,omitempty"`
-	// Unread is each layer that composes nothing (its module is not assigned where it says): kept in the history,
-	// emptied, and set nowhere.
-	Unread []string `json:"unread,omitempty"`
-	// Problems is why the move refuses, each by name; nothing is set while there is one.
-	Problems []string `json:"problems,omitempty"`
-	// Switched is true once the controller reads mesh-config where it read the layers.
-	Switched bool `json:"switched"`
-}
-
-// configMovePlan is the move worked out from the layers, before anything is asked of mesh-config.
-type configMovePlan struct {
-	answer configMoveAnswer
-	// moved is the layers the move empties once the values read back.
-	moved []inventory.LayerToMove
-	// expected is, for each module the move reaches, keyed `<node>.<module>`, every value composition lays over
-	// its files today: what mesh-config must resolve for it from mesh config, node config or its own value.
-	expected map[string]map[string]any
-	// modules is each module in the config form, by the nodes it is assigned to: whose resolved values are read back.
-	modules map[string][]string
-}
-
-func whereOf(node string) string {
-	if node == "" {
-		return "the whole mesh"
-	}
-	return node
-}
-
-// planConfigMove works out the move from every layer that holds a value, the catalogue, and where each module is
-// assigned.
-func planConfigMove(layers []inventory.LayerToMove, shelf map[string]catalogue.Manifest,
-	on map[string][]string) configMovePlan {
-	p := configMovePlan{answer: configMoveAnswer{Sets: []configSet{}, Moved: []string{}},
-		expected: map[string]map[string]any{}, modules: map[string][]string{}}
-	problem := func(format string, a ...any) {
-		p.answer.Problems = append(p.answer.Problems, fmt.Sprintf(format, a...))
-	}
-	for name, m := range shelf {
-		if m.DeclaresConfig() {
-			p.modules[name] = on[name]
-		}
-	}
-
-	byModule := map[string]*layersOfModule{}
-	var names []string
-	for _, l := range layers {
-		said := fmt.Sprintf("%s on %s", l.Module, whereOf(l.Node))
-		m, known := shelf[l.Module]
-		if !known || !m.DeclaresConfig() {
-			p.answer.Stays = append(p.answer.Stays, said+" (its module is in the settings form)")
-			continue
-		}
-		if _, placement := catalogue.SplitPlacement(l.Values); len(placement) > 0 {
-			problem("%s still holds placement (%s): run move-placement first", said, strings.Join(movedKeys(placement), ", "))
-			continue
-		}
-		assigned := on[l.Module]
-		if (l.Node == "" && len(assigned) == 0) || (l.Node != "" && !containsString(assigned, l.Node)) {
-			p.answer.Unread = append(p.answer.Unread, said+" (the module is not assigned there, so it composes nothing)")
-			p.moved = append(p.moved, l)
-			continue
-		}
-		// The layer's keys as config keys: a key the file names otherwise is set under its config key.
-		as := catalogue.TakenAs(m)
-		values := map[string]any{}
-		from := map[string]string{}
-		for _, k := range movedKeys(l.Values) {
-			key := k
-			if _, declared := m.Settings[k]; !declared {
-				if renamed, ok := as[k]; ok {
-					key = renamed
-				} else {
-					problem("%s says %q, which %s does not declare: declare it, or clear it from the layer", said, k, l.Module)
-					continue
-				}
-			}
-			if _, both := values[key]; both {
-				// The layer says the key and the file's name for it: the config key wins, as composition has it (issue 751).
-				if key != k {
-					continue
-				}
-			}
-			values[key] = l.Values[k]
-			from[key] = said + ": " + k
-		}
-		om := byModule[l.Module]
-		if om == nil {
-			om = &layersOfModule{nodes: map[string]map[string]any{}, saidAt: map[string]map[string]string{}}
-			byModule[l.Module] = om
-			names = append(names, l.Module)
-		}
-		om.saidAt[l.Node] = from
-		if l.Node == "" {
-			om.mesh = values
-		} else {
-			om.nodes[l.Node] = values
-		}
-		p.moved = append(p.moved, l)
-		p.answer.Moved = append(p.answer.Moved, said)
-	}
-	sort.Strings(names)
-
-	// Which predefined key each module falls back to, so a whole-mesh value goes to mesh config only where no other
-	// module's value moves with it.
-	fallingBack := map[string][]string{}
-	for name, m := range shelf {
-		for _, d := range m.Settings {
-			if d.Predefined != "" && !containsString(fallingBack[d.Predefined], name) {
-				fallingBack[d.Predefined] = append(fallingBack[d.Predefined], name)
-			}
-		}
-	}
-
-	for _, name := range names {
-		m, om := shelf[name], byModule[name]
-		asked := catalogue.AskedKeys(m)
-		keys := map[string]bool{}
-		for k := range om.mesh {
-			keys[k] = true
-		}
-		for _, values := range om.nodes {
-			for k := range values {
-				keys[k] = true
-			}
-		}
-		for _, key := range movedKeys(keys) {
-			d := m.Settings[key]
-			meshValue, meshSays := om.mesh[key]
-			alone := d.Predefined != "" && len(fallingBack[d.Predefined]) == 1
-			if meshSays && alone {
-				p.set(configLevel{Level: "mesh"}, d.Predefined, meshValue, d, om.said("", key))
-			}
-			for _, node := range on[name] {
-				nodeValue, nodeSays := om.nodes[node][key]
-				value := meshValue
-				switch {
-				case nodeSays && meshSays:
-					_, under := meshValue.(map[string]any)
-					_, over := nodeValue.(map[string]any)
-					if under && over && asked[key] {
-						problem("%s on %s lays an object for %q over the whole mesh's, and a placeholder takes it whole "+
-							"where its file merges the two: say the value on %s whole, then move", name, node, key, node)
-						continue
-					}
-					value = catalogue.LaidOver(meshValue, nodeValue)
-				case nodeSays:
-					value = nodeValue
-				case !meshSays:
-					continue
-				}
-				p.expect(node, name, key, value)
-				if nodeSays || !alone {
-					saidBy := om.said(node, key)
-					if meshSays {
-						saidBy = append(om.said("", key), saidBy...)
-					}
-					p.set(configLevel{Level: "module", Node: node, Module: name}, key, value, d, saidBy)
-				}
-			}
-		}
-	}
-	sort.Strings(p.answer.Problems)
-	return p
-}
-
-// layersOfModule is one module's layers as the move reads them: its whole-mesh layer's config values, each node's,
-// and where each key was said, by node ("" for the whole mesh).
-type layersOfModule struct {
-	mesh   map[string]any
-	nodes  map[string]map[string]any
-	saidAt map[string]map[string]string
-}
-
-func (om *layersOfModule) said(node, key string) []string {
-	if s, ok := om.saidAt[node][key]; ok {
-		return []string{s}
-	}
-	return nil
-}
-
-// set is one value the move sets, judged against its declaration as mesh-config will judge it.
-func (p *configMovePlan) set(level configLevel, key string, value any, d catalogue.SettingDeclaration, from []string) {
-	p.answer.Sets = append(p.answer.Sets, configSet{configLevel: level, Key: key, Value: value, Trusted: d.Trusted,
-		From: from})
-	for _, wrong := range catalogue.ValueProblems(d, value) {
-		p.answer.Problems = append(p.answer.Problems, fmt.Sprintf("%s at %s: %s", key, level, wrong))
-	}
-}
-
-func (p *configMovePlan) expect(node, module, key string, value any) {
-	k := node + "." + module
-	if p.expected[k] == nil {
-		p.expected[k] = map[string]any{}
-	}
-	p.expected[k][key] = value
-}
-
-func movedKeys[V any](m map[string]V) []string {
-	out := make([]string, 0, len(m))
-	for k := range m {
-		out = append(out, k)
-	}
-	sort.Strings(out)
-	return out
-}
-
-// configService is mesh-config as the move asks it: what it holds at each level, what it resolved, and a value set
-// as the controller carries it from its terminal.
-type configService interface {
-	// Values is every value set, by its key in mesh-config_values (`mesh.<key>`, `node.<node>.<key>`,
-	// `module.<node>.<module>.<key>`).
-	Values(ctx context.Context) (map[string]json.RawMessage, error)
-	// Resolved is every resolved value.
-	Resolved(ctx context.Context) ([]resolvedEntry, error)
-	// Set sets one value at its level, by whom and why.
-	Set(ctx context.Context, level configLevel, key string, value any, by, why string) error
-}
-
-// runConfigMove is the move against a store and mesh-config: a dry run says what it would set.
-func runConfigMove(ctx context.Context, inv *inventory.Inventory, config configService, apply bool, by,
-	why string) (configMoveAnswer, error) {
-	layers, holding, err := inv.LayersToMove(ctx)
-	if err != nil {
-		return configMoveAnswer{}, err
-	}
-	entries, err := inv.Catalogued(ctx)
-	if err != nil {
-		return configMoveAnswer{}, err
-	}
-	shelf := map[string]catalogue.Manifest{}
-	on := map[string][]string{}
-	for _, e := range entries {
-		shelf[e.Manifest.Module] = e.Manifest
-		on[e.Manifest.Module] = e.On
-	}
-	p := planConfigMove(layers, shelf, on)
-	if len(holding) > 0 && len(p.answer.Problems) == 0 {
-		p.answer.Problems = append(p.answer.Problems, "a layer still holds placement ("+strings.Join(holding, "; ")+
-			"): run move-placement first")
-	}
-	moved, err := inv.ConfigMoved(ctx)
-	if err != nil {
-		return configMoveAnswer{}, err
-	}
-	p.answer.Switched = moved.Moved
-	if config == nil {
-		return p.answer, errors.New("mesh-config cannot be asked, so nothing was moved")
-	}
-	held, err := config.Values(ctx)
-	if err != nil {
-		return p.answer, fmt.Errorf("what mesh-config holds cannot be read, so nothing was moved: %w", err)
-	}
-	for i := range p.answer.Sets {
-		s := &p.answer.Sets[i]
-		if was, ok := held[s.valueKey(s.Key)]; ok && sameJSON(was, s.Value) {
-			s.Already = true
-		}
-	}
-	p.answer.DryRun = !apply
-	if !apply || len(p.answer.Problems) > 0 {
-		if apply {
-			return p.answer, fmt.Errorf("the move of config refuses, and nothing was set: %s",
-				strings.Join(p.answer.Problems, "; "))
-		}
-		return p.answer, nil
-	}
-	if len(p.moved) == 0 && moved.Moved {
-		return p.answer, nil
-	}
-	for _, s := range p.answer.Sets {
-		if s.Already {
-			continue
-		}
-		said := "moved from the settings layer of " + strings.Join(s.From, " and ") + " (issue 664): " + why
-		if err := config.Set(ctx, s.configLevel, s.Key, s.Value, by, said); err != nil {
-			return p.answer, fmt.Errorf("%s at %s was not set, and no layer was emptied; ask the move again: %w",
-				s.Key, s.configLevel, err)
-		}
-	}
-	// Read back through mesh-config before anything points at it (design 57): every module the move reaches, and
-	// every other in the config form, must resolve exactly what its layers lay today.
-	if differs, err := readsBack(ctx, config, p); err != nil {
-		return p.answer, err
-	} else if len(differs) > 0 {
-		return p.answer, fmt.Errorf("mesh-config does not resolve what the layers lay today, so no layer was emptied and "+
-			"the controller still composes from the layers: %s", strings.Join(differs, "; "))
-	}
-	if err := inv.FinishConfigMove(ctx, p.moved, by, why); err != nil {
-		return p.answer, err
-	}
-	p.answer.Switched = true
-	return p.answer, nil
-}
-
-// readsBack compares what mesh-config resolved with what the layers lay, for every module in the config form on
-// every node it is assigned to, and says each difference. A value the layers do not lay and mesh-config resolves from
-// a level would be laid once the switch is on: a difference too.
-func readsBack(ctx context.Context, config configService, p configMovePlan) ([]string, error) {
-	var resolved []resolvedEntry
-	var err error
-	// mesh-config writes the resolved values with each set; a pass that missed one is put right by its next
-	// resolution, so a difference is read again for a little while before it is said.
-	for wait := 0; ; wait++ {
-		if resolved, err = config.Resolved(ctx); err != nil {
-			return nil, fmt.Errorf("mesh-config's resolved values cannot be read back, so no layer was emptied: %w", err)
-		}
-		differs, err := differences(resolved, p)
-		if err != nil || len(differs) == 0 || wait >= readBackTries {
-			return differs, err
-		}
-		select {
-		case <-ctx.Done():
-			return nil, ctx.Err()
-		case <-time.After(readBackEvery):
-		}
-	}
-}
-
-// How often, and how many times, the move reads mesh-config's resolved values back before it says they differ.
-var (
-	readBackEvery = 2 * time.Second
-	readBackTries = 15
-)
-
-func differences(resolved []resolvedEntry, p configMovePlan) ([]string, error) {
-	var differs []string
-	for _, module := range movedKeys(p.modules) {
-		for _, node := range p.modules[module] {
-			laid, err := configLaid(resolved, node, module)
-			if err != nil {
-				return nil, err
-			}
-			want := p.expected[node+"."+module]
-			if want == nil {
-				want = map[string]any{}
-			}
-			for _, k := range movedKeys(mergedKeys(laid, want)) {
-				got, has := laid[k]
-				w, wants := want[k]
-				switch {
-				case !wants:
-					differs = append(differs, fmt.Sprintf("%s on %s resolves %s from a level no layer says; clear it "+
-						"there, or set it in a layer first", module, node, k))
-				case !has:
-					differs = append(differs, fmt.Sprintf("%s on %s does not resolve %s from the value moved", module, node, k))
-				case !reflect.DeepEqual(normalJSON(got), normalJSON(w)):
-					differs = append(differs, fmt.Sprintf("%s on %s resolves %s as %s, and its layers lay %s", module,
-						node, k, compactJSON(got), compactJSON(w)))
-				}
-			}
-		}
-	}
-	return differs, nil
-}
-
-func mergedKeys(a, b map[string]any) map[string]bool {
-	out := map[string]bool{}
-	for k := range a {
-		out[k] = true
-	}
-	for k := range b {
-		out[k] = true
-	}
-	return out
-}
-
-func normalJSON(v any) any {
-	raw, _ := json.Marshal(v)
-	var out any
-	_ = json.Unmarshal(raw, &out)
-	return out
-}
-
-func compactJSON(v any) string {
-	raw, _ := json.Marshal(v)
-	return string(raw)
-}
-
-func sameJSON(raw json.RawMessage, v any) bool {
-	var held any
-	if err := json.Unmarshal(raw, &held); err != nil {
-		return false
-	}
-	return reflect.DeepEqual(held, normalJSON(v))
-}
-
-// busConfig is mesh-config on this controller's bus: its buckets read directly, a value set through its verb in
-// the controller's own name, so mesh-config takes a trusted value as given at the controller's terminal (ADR 0348 §8).
-type busConfig struct{}
-
-func (busConfig) Values(ctx context.Context) (map[string]json.RawMessage, error) {
-	out := map[string]json.RawMessage{}
-	err := onTheBus(func(conn *nats.Conn) error {
-		js, err := jetstream.New(conn)
-		if err != nil {
-			return err
-		}
-		ctx, cancel := context.WithTimeout(ctx, 20*time.Second)
-		defer cancel()
-		kv, err := js.KeyValue(ctx, broker.BucketName("mesh-config", "values"))
-		if err != nil {
-			return err
-		}
-		w, err := kv.WatchAll(ctx, jetstream.IgnoreDeletes())
-		if err != nil {
-			return err
-		}
-		defer func() { _ = w.Stop() }()
-		for e := range w.Updates() {
-			if e == nil {
-				return nil
-			}
-			var v struct {
-				Value json.RawMessage `json:"value"`
-			}
-			if err := json.Unmarshal(e.Value(), &v); err != nil {
-				return fmt.Errorf("mesh-config holds %q, which is not a value: %w", e.Key(), err)
-			}
-			out[e.Key()] = v.Value
-		}
-		return errors.New("mesh-config's values stopped answering")
-	})
-	return out, err
-}
-
-func (busConfig) Resolved(ctx context.Context) ([]resolvedEntry, error) { return readResolved(ctx) }
-
-func (busConfig) Set(ctx context.Context, level configLevel, key string, value any, by, why string) error {
-	args := map[string]any{"action": "set", "key": key, "value": value, "why": why, "by": by}
-	if level.Node != "" {
-		args["node"] = level.Node
-	}
-	if level.Module != "" {
-		args["module"] = level.Module
-	}
-	return onTheBus(func(conn *nats.Conn) error {
-		answer, err := link.AskMeshSeatToolAs(ctx, conn, broker.ControllerName, "mesh-config", "config", args, 30*time.Second)
-		if err != nil {
-			return err
-		}
-		if answer.Error != "" {
-			return errors.New(answer.Error)
-		}
-		return nil
-	})
-}
-
-// moveConfigCommand is `move-config`: the move of config (issue 664).
-func moveConfigCommand(ctx context.Context, args []string) error {
-	set := flag.NewFlagSet("move-config", flag.ContinueOnError)
-	asJSON := set.Bool("json", false, "answer as JSON")
-	confirm := set.Bool("confirm", false, "set the values and switch, rather than only say what would move")
-	f := addHandActFlags(set)
-	positionals, err := parseAround(set, args)
-	if err != nil {
-		return err
-	}
-	if len(positionals) != 0 {
-		return errors.New("move-config [--json] [--confirm --why <text>]")
-	}
-	if !*confirm && f.given() {
-		return errors.New("move-config takes --why only with --confirm: without it nothing is moved. Nothing was done")
-	}
-	if *confirm {
-		if err := f.require("move-config"); err != nil {
-			return err
-		}
-	}
-	open, err := openStores(ctx)
-	if err != nil {
-		return err
-	}
-	defer open.Close()
-	if *confirm {
-		f.record(ctx, "move-config", nil)
-	}
-	why := ""
-	if *confirm {
-		why = strings.TrimSpace(*f.why)
-	}
-	answer, err := runConfigMove(ctx, open.inventory, busConfig{}, *confirm, "the move of config, run by "+link.Caller(), why)
-	if *asJSON {
-		encoder := json.NewEncoder(os.Stdout)
-		encoder.SetIndent("", " ")
-		if encErr := encoder.Encode(answer); encErr != nil {
-			return encErr
-		}
-		return err
-	}
-	fmt.Print(describeConfigMove(answer))
-	return err
-}
-
-// describeConfigMove says the answer as a person reads it.
-func describeConfigMove(a configMoveAnswer) string {
-	var b strings.Builder
-	verb := "set"
-	if a.DryRun {
-		verb = "would set"
-	}
-	for _, s := range a.Sets {
-		state := verb
-		if s.Already {
-			state = "holds already"
-		}
-		fmt.Fprintf(&b, "%s %s = %s at %s (from %s)\n", state, s.Key, compactJSON(s.Value), s.configLevel,
-			strings.Join(s.From, " and "))
-	}
-	for _, s := range a.Unread {
-		fmt.Fprintf(&b, "emptied, set nowhere: %s\n", s)
-	}
-	for _, s := range a.Stays {
-		fmt.Fprintf(&b, "stays: %s\n", s)
-	}
-	for _, s := range a.Problems {
-		fmt.Fprintf(&b, "refused: %s\n", s)
-	}
-	switch {
-	case len(a.Problems) > 0:
-		b.WriteString("nothing was set: the move refuses until each is put right\n")
-	case a.DryRun:
-		fmt.Fprintf(&b, "%d layer(s), %d value(s); nothing was set — with --confirm --why <text> they are\n",
-			len(a.Moved), len(a.Sets))
-	case a.Switched:
-		fmt.Fprintf(&b, "%d layer(s) moved into mesh-config, each kept whole in its history first; the controller "+
-			"reads mesh-config where it read them\n", len(a.Moved))
-	}
-	return b.String()
-}