The store keeps what the records name (hq ADR 0189)

The mesh names what may go from its own build records — a digest it did not
record making is never named, which is what keeps the sweep away from the
images genesis pushed. An artifact stays because a definition the mesh holds
names it, or because it belongs to one of the five most recent successful
builds of its module.

internal/artifacts asks the store to let go of one; internal/inventory
decides and remembers (migration 0055); the sweep runs after a build the mesh
recorded, which is when both the bytes and the keep set moved. Never fatal to
a build.

And the manifest side of while-stopped, refused from the definition alone:
no schedule, run-once, a container the module does not declare, itself.

Dockerfile

@@ -1,11 +1,5 @@
-# The Go it builds with, pinned here because genesis builds this file with no arguments (novox/hq
-# issue 223) — the Makefile passes the same digest. A tag older than go.mod asks for is how
-# `make image` broke once before (issue 146).
-ARG GO_BASE=golang@sha256:8ac98ca534ac3f51e1f420a1dd2c15e74c75cfa0f23f3ad27eb5d7236c349a0c
-# The control plane's image — for genesis and the lab only. The mesh runs the controller as a Go
-# bundle the host starts as a process (module.json; novox/hq issue 213), and builds no image of it.
-# Genesis builds this file and raises it as the container the process replaces on the first push
-# (mesh-host internal/bootstrap, novox/hq issue 223).
+ARG GO_BASE=golang:1.25-alpine
+# The control plane's image.
 #
 # novox/hq ADR 0006: this image is pinned by digest in the bundle the host carries, fetched on a
 # machine where no mesh exists yet, and run before there is anything to check it against. So it

Makefile

@@ -27,21 +27,17 @@ build:
 IMAGE ?= mesh-controller:$(VERSION)
 DEV_TAG ?= mesh-controller:development
 
-# The Go base the image is built on.
+# The base the module declares, read from the manifest rather than written here twice.
 #
 # **`make image` was broken and stayed broken**, because the Dockerfile's fallback base was a Go
 # older than go.mod asks for: every build died at `go mod download` with "go.mod requires go >=
 # 1.26.0", and the pipeline never saw it because the pipeline passes the declared base in. Anybody
 # building the image by hand hit it and had to find the digest themselves (novox/hq 04-ISSUES/146,
 # what it cost).
-#
-# **Pinned here since the manifest stopped building an image** (novox/hq issue 213): the mesh builds
-# the controller as a Go bundle with its own toolchain, and only `make image` — genesis and the lab —
-# still needs a Go base. The digest is the one the manifest declared until then.
-GO_BASE ?= golang@sha256:8ac98ca534ac3f51e1f420a1dd2c15e74c75cfa0f23f3ad27eb5d7236c349a0c
+GO_BASE ?= $(shell python3 -c "import json;print(next(o['image'] for o in json.load(open('module.json'))['build']['on'] if o['arg']=='GO_BASE'))" 2>/dev/null)
 
 image:
-	@test -n "$(GO_BASE)" || { echo "no GO_BASE; pass GO_BASE=<image>"; exit 1; }
+	@test -n "$(GO_BASE)" || { echo "module.json declares no GO_BASE; pass GO_BASE=<image> or fix the manifest"; exit 1; }
 	docker build --build-arg GO_BASE=$(GO_BASE) --build-arg VERSION=$(VERSION) -t $(IMAGE) -t $(DEV_TAG) .
 	@echo
 	@docker image inspect $(IMAGE) --format 'built {{.RepoTags}}  {{.Size}} bytes'
@@ -52,7 +48,7 @@ BUILDER_IMAGE ?= mesh-builder:$(VERSION)
 BUILDER_DEV_TAG ?= mesh-builder:development
 
 builder-image:
-	@test -n "$(GO_BASE)" || { echo "no GO_BASE; pass GO_BASE=<image>"; exit 1; }
+	@test -n "$(GO_BASE)" || { echo "module.json declares no GO_BASE; pass GO_BASE=<image> or fix the manifest"; exit 1; }
 	docker build --build-arg GO_BASE=$(GO_BASE) -f cmd/mesh-builder/Dockerfile -t $(BUILDER_IMAGE) -t $(BUILDER_DEV_TAG) .
 	@echo
 	@docker image inspect $(BUILDER_IMAGE) --format 'built {{.RepoTags}}  {{.Size}} bytes'

README.md

@@ -193,13 +193,6 @@ passes every check that only looks at the message.
 
 ## The image
 
-**The mesh no longer runs the controller from it** (novox/hq issue 213). The module declares a Go
-bundle, `controller`, which the host on the controller's machine unpacks and runs as the process
-`mesh-controller` under the account of the same name (ADR 0188 §1, §3). The image stays for what
-still runs a container of the controller: genesis, which raises the first controller from it and
-installs the module from its manifest (mesh-host `internal/bootstrap`), and the lab. Neither is the
-mesh's own build any more — `make image` builds it.
-
 `FROM scratch`, holding one statically linked binary and nothing else — no shell, no package
 manager, no libc, no CA certificates.
 

cmd/mesh-builder/main.go

@@ -137,12 +137,7 @@ func takeWorkFrom(credential Credential, on string) (link.BuildMachine, error) {
 	if err != nil {
 		return nil, err
 	}
-	// **The seat this machine serves is the one its credential claims** (novox/hq ADR 0190, the
-	// handover): the mesh issues a build machine's credential naming the seat its module claims,
-	// and one binary serves the old role as `builder` and the new as `build-agent` from that alone.
-	seat := link.BuildSeatClaimed(credential.seatsClaimed())
-	fmt.Fprintf(os.Stderr, "taking build work as a holder of %s\n", seat)
-	return link.MachineOverNATSOn(js, on, seat), nil
+	return link.MachineOverNATS(js, on), nil
 }
 
 // answer does one build and says what happened, whichever way it went.
@@ -458,21 +453,6 @@ type Credential struct {
 	// as two fields and this machine joins them once, here, to dial.
 	User     string `json:"user,omitempty"`
 	Password string `json:"password,omitempty"`
-	// Claims are the seats the module this credential was issued for claims, as the mesh writes
-	// them beside the credential (novox/hq ADR 0159). The first is the build role this machine
-	// serves; a credential naming none is from before claims travelled in it.
-	Claims []struct {
-		Seat string `json:"seat"`
-	} `json:"claims,omitempty"`
-}
-
-// seatsClaimed is the seats the credential names, in order.
-func (c Credential) seatsClaimed() []string {
-	out := make([]string, 0, len(c.Claims))
-	for _, claim := range c.Claims {
-		out = append(out, claim.Seat)
-	}
-	return out
 }
 
 // onTheNewBus is whether a credential is for the bus being built: its address says so, and the

cmd/mesh-builder/seat_test.go

@@ -1,27 +0,0 @@
-package main
-
-import (
-	"encoding/json"
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// The seat a build machine serves comes from its credential (novox/hq ADR 0190 handover).
-func TestTheCredentialSaysWhichBuildRoleThisMachineServes(t *testing.T) {
-	var held Credential
-	if err := json.Unmarshal([]byte(`{"url":"nats://bus:4222","user":"anchor.builder","password":"x",
-		"claims":[{"seat":"mesh-build-machine","scope":"mesh","serves":[]}]}`), &held); err != nil {
-		t.Fatal(err)
-	}
-	if got := link.BuildSeatClaimed(held.seatsClaimed()); got != "mesh-build-machine" {
-		t.Errorf("the old builder's credential serves %q", got)
-	}
-	var bare Credential
-	if err := json.Unmarshal([]byte(`{"url":"nats://bus:4222","user":"anchor.build-agent","password":"x"}`), &bare); err != nil {
-		t.Fatal(err)
-	}
-	if got := link.BuildSeatClaimed(bare.seatsClaimed()); got != link.TheBuildMachine {
-		t.Errorf("a credential without claims serves %q, want %s", got, link.TheBuildMachine)
-	}
-}

cmd/mesh-controller/acts.go

@@ -3,8 +3,6 @@ package main
 import (
 	"context"
 	"fmt"
-	"github.com/novox/mesh-controller/internal/broker"
-	"slices"
 	"sort"
 	"strings"
 
@@ -40,10 +38,7 @@ import (
 //
 // It costs a resolution per machine. Assignment is a person typing a command, and being told which
 // machines this just blocked is worth more than the milliseconds.
-func assign(ctx context.Context, open *stores, node string, modules ...string) (string, error) {
-	if len(modules) == 0 {
-		return "", fmt.Errorf("assign %s names no module", node)
-	}
+func assign(ctx context.Context, open *stores, node, module string) (string, error) {
 	// Held while it is recorded, so it cannot land between a converge's preview and its flip and
 	// be taken without ever having been previewed (novox/hq ADR 0100).
 	ctx, release, err := holdNodes(ctx, open, []string{node})
@@ -51,16 +46,6 @@ func assign(ctx context.Context, open *stores, node string, modules ...string) (
 		return "", err
 	}
 	defer release()
-	// **The one assignment refused for what the node lacks** (novox/hq ADR 0207). Everything else
-	// an assignment leaves unresolved is kept, because assignment is not an ordering; a module whose
-	// resources are applied through a seat nothing on the node holds is refused, because that order
-	// — the service manager, the package manager and the runtime before anything that installs,
-	// runs or contains — is the mesh's to keep. Several modules in one act are judged together, so
-	// holders that depend on each other go on in one command.
-	shelf, before, err := seatDependenciesOnAssign(ctx, open, node, modules)
-	if err != nil {
-		return "", err
-	}
 	// **Before the new assignment can unsettle a seat somebody holds only by being alone**
 	// (novox/hq 04-ISSUES/170): what the mesh derived so far is written down, and then the
 	// assignment resolves against a record rather than against a coincidence.
@@ -68,171 +53,58 @@ func assign(ctx context.Context, open *stores, node string, modules ...string) (
 	if err != nil {
 		return "", err
 	}
-	var lines []string
-	var added []string
-	for _, module := range modules {
-		fresh, err := open.inventory.Assign(ctx, node, module)
-		if err != nil {
-			return strings.Join(lines, "\n"), err
-		}
-		if !fresh {
-			// Nothing changed, and saying "is assigned" would read as an action. One node runs one
-			// of each — the module's name is the assignment's identity (novox/hq ADR 0115).
-			lines = append(lines, fmt.Sprintf(
-				"%s already runs %s — one node runs one of each (ADR 0115); nothing changed", node, module))
-			continue
-		}
-		added = append(added, module)
-		lines = append(lines, fmt.Sprintf("%s is assigned %s", node, module))
+	fresh, err := open.inventory.Assign(ctx, node, module)
+	if err != nil {
+		return "", err
 	}
-	if len(added) == 0 {
-		return strings.Join(lines, "\n"), nil
+	if !fresh {
+		// Nothing changed, and saying "is assigned" would read as an action. One node runs one
+		// of each — the module's name is the assignment's identity (novox/hq ADR 0115).
+		return fmt.Sprintf("%s already runs %s — one node runs one of each (ADR 0115); nothing changed",
+			node, module), nil
 	}
-	answer := strings.Join(lines, "\n")
+	said := fmt.Sprintf("%s is assigned %s", node, module)
 	for _, line := range settled {
-		answer += "\n  " + line
-	}
-	// What this act changed about this node's unmet seat dependencies, and nothing else (novox/hq
-	// ADR 0207): a dependency of a module just assigned, or one this assignment met. The rest of the
-	// node's list, and every other node's, is `status`'s.
-	for _, line := range unheldChange(shelf, node, before, append(append([]string(nil), before...), added...)) {
-		answer += "\n  " + line
-	}
-	// Its bus credential, in the same act (novox/hq issue 203): an assignment pushed before its
-	// credential exists delivers a process that cannot authenticate and crash-loops until somebody
-	// runs a second verb and a second push. Issued here when the module speaks on the bus and has
-	// no credential yet; kept when it has one, so re-assigning rotates nothing.
-	for _, module := range added {
-		if line := issueOnAssign(ctx, open, node, module); line != "" {
-			answer += "\n  " + line
-		}
+		said += "\n  " + line
 	}
 	plan, _, err := planFor(ctx, open, node)
 	if err != nil {
 		// Kept, and still refused. Both halves are the answer, and the rest of the mesh is still
 		// worth reporting: this machine's refusal is rarely the only consequence.
-		return answer + blockedElsewhere(ctx, open, node), err
+		return said + blockedElsewhere(ctx, open, node), err
 	}
 	// Kept, and cannot be hosted here. Said at once rather than discovered at push: a module whose
 	// capability the machine lacks is on the wrong machine, and the assignment records what a person
 	// meant while this line says it will not run until it moves. The rest of the node still pushes.
-	isAdded := map[string]bool{}
-	for _, m := range added {
-		isAdded[m] = true
-	}
 	for _, u := range plan.Unhostable {
-		if !isAdded[u.Module] {
+		if u.Module != module {
 			continue
 		}
 		for _, c := range u.Missing {
-			answer += "\n  but " + catalogue.WrongMachine(u.Module, c, node)
+			said += "\n  but " + catalogue.WrongMachine(u.Module, c, node)
 		}
 	}
-	return answer + fmt.Sprintf("\n  run `push %s` to send it", node) +
+	return said + fmt.Sprintf("\n  run `push %s` to send it", node) +
 		blockedElsewhere(ctx, open, node), nil
 }
 
-// seatDependenciesOnAssign is the refusal ADR 0207 makes at assignment, or nothing, with the
-// catalogue and the node's assignments it was judged against. Modules already assigned are not new
-// and are not judged again.
-func seatDependenciesOnAssign(ctx context.Context, open *stores, node string, modules []string) (
-	map[string]catalogue.Manifest, []string, error) {
-	shelf, err := open.inventory.Catalogue(ctx)
-	if err != nil {
-		return nil, nil, err
-	}
-	assigned, err := open.inventory.Assigned(ctx, node)
-	if err != nil {
-		return nil, nil, err
-	}
-	already := map[string]bool{}
-	for _, a := range assigned {
-		already[a] = true
-	}
-	var adding []string
-	for _, m := range modules {
-		if !already[m] {
-			adding = append(adding, m)
-		}
-	}
-	// The lines AssignRefusal says beside an assignment it lets through are said by unheldChange
-	// with everything else this act changed, so they are not said twice.
-	if _, err := catalogue.AssignRefusal(shelf, node, assigned, adding); err != nil {
-		return nil, nil, err
-	}
-	return shelf, assigned, nil
-}
-
-// unassign takes modules off a node. What they leave behind is the host's business: a directory
+// unassign takes a module off a node. What it leaves behind is the host's business: a directory
 // holding anything the mesh did not put there is kept (novox/hq ADR 0030).
 //
 // It reports the rest of the mesh for the same reason assign does, and more sharply: taking a
 // module off one machine is the ordinary way to stop providing something to another, and nothing
 // about the command's own output would ever have said so.
-//
-// **Refused when it takes away the last holder of a seat a module left on the node depends on**
-// (novox/hq ADR 0207) — the other side of refusing that module's assignment without one. Several
-// modules in one act are judged together, so a holder and its dependents come off in one command.
-func unassign(ctx context.Context, open *stores, node string, modules ...string) (string, error) {
-	if len(modules) == 0 {
-		return "", fmt.Errorf("unassign %s names no module", node)
-	}
+func unassign(ctx context.Context, open *stores, node, module string) (string, error) {
 	ctx, release, err := holdNodes(ctx, open, []string{node})
 	if err != nil {
 		return "", err
 	}
 	defer release()
-	shelf, err := open.inventory.Catalogue(ctx)
-	if err != nil {
+	if err := open.inventory.Unassign(ctx, node, module); err != nil {
 		return "", err
 	}
-	assigned, err := open.inventory.Assigned(ctx, node)
-	if err != nil {
-		return "", err
-	}
-	// Every one checked before any is taken off, so a refusal leaves the node as it was.
-	runs := map[string]bool{}
-	for _, a := range assigned {
-		runs[a] = true
-	}
-	for _, module := range modules {
-		if !runs[module] {
-			return "", fmt.Errorf("%s is not assigned to %s", module, node)
-		}
-	}
-	if err := catalogue.UnassignRefusal(shelf, node, assigned, modules); err != nil {
-		return "", err
-	}
-	for _, module := range modules {
-		if err := open.inventory.Unassign(ctx, node, module); err != nil {
-			return "", err
-		}
-	}
-	answer := fmt.Sprintf("%s no longer runs %s — run `push %s` to make it so",
-		node, strings.Join(modules, ", "), node)
-	var left []string
-	for _, a := range assigned {
-		if !slices.Contains(modules, a) {
-			left = append(left, a)
-		}
-	}
-	for _, line := range unheldChange(shelf, node, assigned, left) {
-		answer += "\n  " + line
-	}
-	return answer + blockedElsewhere(ctx, open, node), nil
-}
-
-// splitModules is a surface's one `module` field as the modules it names: several, comma-separated,
-// are one act (novox/hq ADR 0207), so the holders that depend on each other go on together from the
-// command API and the controller seat's verbs as they do from the command line.
-func splitModules(field string) []string {
-	var out []string
-	for _, m := range strings.Split(field, ",") {
-		if m = strings.TrimSpace(m); m != "" {
-			out = append(out, m)
-		}
-	}
-	return out
+	return fmt.Sprintf("%s no longer runs %s — run `push %s` to make it so",
+		node, module, node) + blockedElsewhere(ctx, open, node), nil
 }
 
 // blockedElsewhere is every OTHER machine that cannot be worked out as things now stand.
@@ -280,33 +152,3 @@ func blockedElsewhere(ctx context.Context, open *stores, except string) string {
 	out.WriteString("\nThis may or may not be what just changed — it is what is true now.")
 	return out.String()
 }
-
-// issueOnAssign gives a newly assigned module its bus credential, the way `module issue` does, and
-// says what it did in one line. Nothing for a module that declares no broker secret; nothing for one
-// whose user is already minted (a credential is rotated on purpose, never by re-assigning); and when
-// the bus cannot be reached from here, the line names the verb and the push that would refuse the
-// module until it is run — never a silent placeholder (novox/hq issue 203).
-func issueOnAssign(ctx context.Context, open *stores, node, module string) string {
-	inv := open.inventory
-	shelf, err := inv.Catalogue(ctx)
-	if err != nil {
-		return ""
-	}
-	m, known := shelf[module]
-	if !known || mayIssue(m) != nil {
-		return ""
-	}
-	user := broker.Principal{Kind: broker.KindModule, Node: node, Module: module}.Username()
-	if _, minted, err := inv.BusUserHash(ctx, user); err != nil || minted {
-		return ""
-	}
-	busAddress, err := broker.BusAddress()
-	if err == nil {
-		err = issueOnTheNewBus(ctx, inv, m, node, busAddress)
-	}
-	if err != nil {
-		return fmt.Sprintf("its bus credential is not issued (%v): `module issue %s --node %s` first — "+
-			"`push %s` refuses to send %s until it is", err, module, node, node, module)
-	}
-	return fmt.Sprintf("its bus credential is issued and sealed to %s, and arrives with the push", node)
-}

cmd/mesh-controller/addresses_test.go

@@ -145,7 +145,7 @@ func TestTheRegistryTrustAndEveryImageFollowThePortTheNodeGaveTheStore(t *testin
 //
 // Composed from the control plane's own manifest against a real inventory: the store's module is
 // given 6852 on this node the way genesis or an operator gives it, and the control plane's
-// process is told so beside the sealed connection genesis wrote.
+// container is told so beside the sealed connection genesis wrote.
 func TestTheControlPlaneIsToldWhereTheNodePutTheStoreAndTheBroker(t *testing.T) {
 	open := aMesh(t)
 	ctx := t.Context()
@@ -157,8 +157,8 @@ func TestTheControlPlaneIsToldWhereTheNodePutTheStoreAndTheBroker(t *testing.T)
 	if err != nil {
 		t.Fatal(err)
 	}
-	control, err := withSeatPorts(m).Resolve([]catalogue.Built{{Name: "controller", Kind: catalogue.ArtifactBundle,
-		Reference: "https://registry.example/mesh-controller/controller.tar.gz", Digest: aDigest}})
+	control, err := withSeatPorts(m).Resolve([]catalogue.Built{{Name: "server", Kind: catalogue.ArtifactImage,
+		Reference: "registry.example/control@" + aDigest}})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -175,12 +175,6 @@ func TestTheControlPlaneIsToldWhereTheNodePutTheStoreAndTheBroker(t *testing.T)
 		Guards: []int{15672},
 		Resources: []map[string]any{{"id": "server", "type": "container", "name": "mesh-broker",
 			"ports": []any{"5671:5671", "5672:5672", "127.0.0.1:15672:15672"}, "image": "mq@" + aDigest}}})
-	// The control plane's own bus user is the installer's, seeded at genesis before the controller
-	// runs (SeedBusUser); without it a push now refuses the credential nobody issued (issue 203).
-	if err := open.inventory.SeedBusUser(ctx, inventory.BusUser{Username: "anchor.mesh-controller",
-		Kind: inventory.BusController, Node: "anchor", Module: "mesh-controller"}, "bootstrap"); err != nil {
-		t.Fatal(err)
-	}
 	if _, err := assign(ctx, open, "anchor", "mesh-controller"); err != nil {
 		t.Fatal(err)
 	}
@@ -200,12 +194,12 @@ func TestTheControlPlaneIsToldWhereTheNodePutTheStoreAndTheBroker(t *testing.T)
 
 	var env map[string]any
 	for _, r := range composed(t, open, "anchor").Resources {
-		if r["id"] == "mesh-controller.controller" {
+		if r["id"] == "mesh-controller.server" {
 			env, _ = r["env"].(map[string]any)
 		}
 	}
 	if env == nil {
-		t.Fatal("the control plane's process is not in its own node's declaration")
+		t.Fatal("the control plane's container is not in its own node's declaration")
 	}
 	for key, want := range map[string]string{
 		"MESH_STORE_INVENTORY_PORT": "6852",
@@ -238,7 +232,7 @@ func withSeatPorts(m catalogue.Manifest) catalogue.Manifest {
 	out := m
 	out.Resources = nil
 	for _, r := range m.Resources {
-		if r["type"] != "container" && r["type"] != "process" {
+		if r["type"] != "container" {
 			out.Resources = append(out.Resources, r)
 			continue
 		}

cmd/mesh-controller/api.go

@@ -95,10 +95,10 @@ func commands(who Authenticator) http.Handler {
 	mux := http.NewServeMux()
 
 	mux.HandleFunc("POST /assign", acting(who, true, func(ctx context.Context, open *stores, in request) (string, error) {
-		return assign(ctx, open, in.Node, splitModules(in.Module)...)
+		return assign(ctx, open, in.Node, in.Module)
 	}))
 	mux.HandleFunc("POST /unassign", acting(who, true, func(ctx context.Context, open *stores, in request) (string, error) {
-		return unassign(ctx, open, in.Node, splitModules(in.Module)...)
+		return unassign(ctx, open, in.Node, in.Module)
 	}))
 	// Adoption (novox/hq ADR 0100): the same acts as `take`, `converge` and `adopt`.
 	mux.HandleFunc("POST /take", acting(who, true, func(ctx context.Context, open *stores, in request) (string, error) {

cmd/mesh-controller/build.go

@@ -148,11 +148,6 @@ func buildFrom(result link.BuildResult) inventory.Build {
 		// rebuild the graph rather than a list of names.
 		Path: result.Path,
 	}
-	// When it was asked, which is what orders it against another build of the same module
-	// (novox/hq 04-ISSUES/219) — not when it was heard.
-	if asked, ok := link.BuildAskedAt(result.ID); ok {
-		kept.Asked = asked
-	}
 	for _, ref := range result.Against {
 		kept.Against = append(kept.Against, catalogue.Recorded(ref))
 	}
@@ -414,7 +409,7 @@ func buildOne(ctx context.Context, source buildSource, path, ref string, wait ti
 	// Correlated by something the control plane makes, not by the module's name: two builds of one
 	// module can be in flight, and the second answer is not the first one's.
 	request := link.BuildRequest{
-		ID:         link.NewBuildID(time.Now()),
+		ID:         fmt.Sprintf("%s-%d", "build", time.Now().UnixNano()),
 		Repository: repository,
 		Path:       path,
 		Ref:        ref,
@@ -435,13 +430,11 @@ func buildOne(ctx context.Context, source buildSource, path, ref string, wait ti
 	}
 	fmt.Println()
 
-	seat := buildSeatHeld(ctx)
-	ask, err := askOverOn(seat)
+	ask, err := askOver(server)
 	if err != nil {
 		return err
 	}
 	defer ask.Close()
-	fmt.Printf("  of %s\n", seat)
 
 	if wait == 0 {
 		// Asked and not waited for (novox/hq issue 176): the outcome is the role's event, and the
@@ -529,33 +522,15 @@ func takeIn(ctx context.Context, inv *inventory.Inventory, result link.BuildResu
 	recorded := inventory.Source{
 		Repository: result.Repository, Path: result.Path, Ref: result.Ref,
 		BuiltFrom: result.Commit, Head: result.Commit,
-		// What it stood on, so registration can judge a built manifest's base (to-be 38 WP2.4).
-		Against: kept.Against,
-		// When it was asked, so an older request heard later does not replace a newer one
-		// (novox/hq 04-ISSUES/219).
-		Asked: kept.Asked,
 	}
 	if result.Source != nil && result.Source.Seat != "" {
 		recorded.Repository, recorded.Seat = result.Source.Repository, result.Source.Seat
 	}
-	// **A build at a commit does not change the branch a module follows** (novox/hq 04-ISSUES/215):
-	// the commit is built and recorded as what it was built from, and the module keeps following
-	// what it followed before — the repository's default branch for one new to the catalogue.
-	if followedBranch(result.Ref) == "" && result.Ref != "" {
-		recorded.Ref = ""
-		if was, err := inv.SourceOf(ctx, manifest.Module); err == nil {
-			recorded.Ref = followedBranch(was.Ref)
-		}
-	}
 	if err := namesNoInstallation(manifest); err != nil {
 		return manifest, kept, fmt.Errorf("%s built %s (%s), and the mesh does not register it: %w",
 			result.On, result.Repository, short(result.Commit), err)
 	}
 	if err := inv.RegisterModule(ctx, manifest, recorded); err != nil {
-		if errors.Is(err, inventory.ErrSuperseded) {
-			return manifest, kept, fmt.Errorf("%s built %s (%s), recorded and not registered: %w",
-				result.On, manifest.Module, short(result.Commit), err)
-		}
 		return manifest, kept, err
 	}
 	// The keep set just moved, and new bytes just landed (novox/hq ADR 0189). Asked here rather
@@ -582,14 +557,14 @@ func buildAndShow(ctx context.Context, source buildSource, path, ref string, wai
 	}
 	defer server.Close()
 
-	ask, err := askOverOn(buildSeatHeld(ctx))
+	ask, err := askOver(server)
 	if err != nil {
 		return err
 	}
 	defer ask.Close()
 
 	result, err := ask.Submit(ctx, link.BuildRequest{
-		ID:         link.NewBuildID(time.Now()),
+		ID:         fmt.Sprintf("%s-%d", "build", time.Now().UnixNano()),
 		Repository: repository, Path: path, Ref: ref,
 		Held: heldBy(ctx), Seats: seatBases(ctx),
 	}, wait)
@@ -650,11 +625,6 @@ type answers struct {
 	// public name on the machine went dark. The holds were correct; they were recorded only in the
 	// machine's own state file, and the one visible symptom was a count that did not add up.
 	untaken map[string]map[string]int
-	// unheld is every module on a machine whose resources are applied through a seat nothing on
-	// that machine holds (novox/hq ADR 0207), with the modules that could hold it. Reported, not
-	// refused, until the switch — and while there is any, the mesh is not all well: the order the
-	// machines' modules are built in is the mesh's to keep, and this is where it says it is not kept.
-	unheld []catalogue.Unheld
 }
 
 // heldBy is every artifact this mesh has built, for a build that may need one as its base.
@@ -700,56 +670,12 @@ func heldBy(ctx context.Context) map[string]string {
 // **One place chooses**, as everywhere else the bus change went (novox/hq ADR 0116 step 5). On the bus
 // the mesh runs on today this needs the controller's own connection, so it is handed one; on the bus
 // being built it dials, because a build request is a one-shot and holds nothing else.
-func askOverOn(seat string) (link.Builders, error) {
+func askOver(_ *link.Server) (link.Builders, error) {
 	address, err := broker.BusAddress()
 	if err != nil {
 		return nil, err
 	}
-	return link.BuildsOverNATSOn(address, seat)
-}
-
-// buildSeatHeld is the build role to ask: the one some assigned module claims (novox/hq ADR 0190,
-// the handover). Read from the catalogue at ask time, because the answer changes exactly once, the
-// moment the first build-agent is assigned — and a controller that asked the new role before then
-// would queue work nothing takes, while the outcome that registers build-agent itself has to come
-// from the old builder. When the catalogue cannot be read the current role is asked, said aloud.
-func buildSeatHeld(ctx context.Context) string {
-	open, err := openStores(ctx)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "could not read what is assigned, so the build is asked of %s: %v\n",
-			link.TheBuildMachine, err)
-		return link.TheBuildMachine
-	}
-	defer open.Close()
-	entries, err := open.inventory.Catalogued(ctx)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "could not read the catalogue, so the build is asked of %s: %v\n",
-			link.TheBuildMachine, err)
-		return link.TheBuildMachine
-	}
-	return buildSeatAmong(entries)
-}
-
-// buildSeatAmong is the rule, over what the catalogue holds: the current build role when any
-// assigned module claims it; else the retired role while an assigned module still claims that; else
-// the current role, which is where every ask goes once the handover is done.
-func buildSeatAmong(entries []inventory.Entry) string {
-	heldBefore := false
-	for _, e := range entries {
-		if len(e.On) == 0 {
-			continue
-		}
-		if e.Manifest.ClaimsSeat(link.TheBuildMachine) {
-			return link.TheBuildMachine
-		}
-		if e.Manifest.ClaimsSeat(link.TheBuildMachineBefore) {
-			heldBefore = true
-		}
-	}
-	if heldBefore {
-		return link.TheBuildMachineBefore
-	}
-	return link.TheBuildMachine
+	return link.BuildsOverNATS(address)
 }
 
 // buildLog prints everything a build machine said about one build, read back from the bus.
@@ -769,13 +695,10 @@ func buildLog(ctx context.Context, id string) error {
 	}
 	defer js.Close()
 
-	// Under whichever build role did it: a build asked of the retired role during the handover
-	// (ADR 0190) said its lines as that role's events, and a reader should not have to know which.
-	lines := link.BuildLogOf("*", id)
-	sub, err := js.Context().PullSubscribe(lines, "",
+	sub, err := js.Context().PullSubscribe(link.BuildLog(id), "",
 		nats.BindStream(broker.EventsStream), nats.DeliverAll(), nats.AckNone())
 	if err != nil {
-		return fmt.Errorf("cannot read %s from the bus: %w", lines, err)
+		return fmt.Errorf("cannot read %s from the bus: %w", link.BuildLog(id), err)
 	}
 	defer func() { _ = sub.Unsubscribe() }()
 

cmd/mesh-controller/build_seat_test.go

@@ -1,43 +0,0 @@
-package main
-
-import (
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/catalogue"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-func claiming(module, seat string, on ...string) inventory.Entry {
-	return inventory.Entry{
-		Manifest: catalogue.Manifest{Module: module, Claims: []catalogue.Claim{{Name: seat}}},
-		On:       on,
-	}
-}
-
-// The controller asks the build role that has a holder (novox/hq ADR 0190 handover): the retired
-// one while only the builder is assigned, the current one from the first build-agent on, and the
-// current one when nothing holds either — where every ask goes once the handover is done.
-func TestTheControllerAsksTheBuildRoleThatHasAHolder(t *testing.T) {
-	onlyTheBuilder := []inventory.Entry{
-		claiming("builder", link.TheBuildMachineBefore, "anchor"),
-		claiming("build-agent", link.TheBuildMachine), // registered, assigned nowhere yet
-	}
-	if got := buildSeatAmong(onlyTheBuilder); got != link.TheBuildMachineBefore {
-		t.Errorf("with only the builder assigned, asked %q", got)
-	}
-	bothHeld := []inventory.Entry{
-		claiming("builder", link.TheBuildMachineBefore, "anchor"),
-		claiming("build-agent", link.TheBuildMachine, "home-server"),
-	}
-	if got := buildSeatAmong(bothHeld); got != link.TheBuildMachine {
-		t.Errorf("with a build-agent assigned anywhere, asked %q", got)
-	}
-	neither := []inventory.Entry{claiming("builder", link.TheBuildMachineBefore)}
-	if got := buildSeatAmong(neither); got != link.TheBuildMachine {
-		t.Errorf("with no holder of either, asked %q, want the current role", got)
-	}
-	if got := buildSeatAmong(nil); got != link.TheBuildMachine {
-		t.Errorf("an empty catalogue asks %q", got)
-	}
-}

cmd/mesh-controller/build_test.go

@@ -2,12 +2,9 @@ package main
 
 import (
 	"encoding/json"
-	"errors"
 	"strings"
 	"testing"
-	"time"
 
-	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
 
@@ -66,87 +63,3 @@ func TestABuildHeardIsRecordedAndRegistered(t *testing.T) {
 		t.Fatalf("a failure is said in the builder's words: %v", err)
 	}
 }
-
-// novox/hq 04-ISSUES/215: a build asked at a commit is recorded as built from that commit, and the
-// module keeps following the branch it followed — a new one, the default branch.
-func TestABuildAtACommitKeepsTheBranchTheModuleFollows(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	manifest, _ := json.Marshal(map[string]any{"module": "unifi", "version": "1"})
-	result := func(id, ref, commit string) link.BuildResult {
-		return link.BuildResult{ID: id, Repository: "http://forge.internal:20000/novox/mesh-catalog.git",
-			Path: "modules/unifi", Ref: ref, On: "anchor", Commit: commit, Manifest: manifest,
-			Source: &link.SourceOnSeat{Seat: "git", Repository: "novox/mesh-catalog"}}
-	}
-	if _, _, err := takeIn(ctx, open.inventory, result("b-1", "main", "1111111aaaa")); err != nil {
-		t.Fatal(err)
-	}
-	if _, _, err := takeIn(ctx, open.inventory, result("b-2", "9c97a8a", "9c97a8a1d2c3")); err != nil {
-		t.Fatal(err)
-	}
-	src, err := open.inventory.SourceOf(ctx, "unifi")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if src.Ref != "main" || src.BuiltFrom != "9c97a8a1d2c3" {
-		t.Errorf("after a build at a commit the module follows %q, built from %q; want main, 9c97a8a1d2c3", src.Ref, src.BuiltFrom)
-	}
-
-	// One new to the catalogue, first built at a commit, follows the default branch.
-	other, _ := json.Marshal(map[string]any{"module": "letta", "version": "1"})
-	r := result("b-3", "deadbeef", "deadbeefcafe")
-	r.Manifest, r.Path = other, "modules/letta"
-	if _, _, err := takeIn(ctx, open.inventory, r); err != nil {
-		t.Fatal(err)
-	}
-	if src, _ := open.inventory.SourceOf(ctx, "letta"); src.Ref != "" {
-		t.Errorf("a module first built at a commit follows %q, want the default branch", src.Ref)
-	}
-}
-
-// novox/hq 04-ISSUES/219: an older request heard after a newer one is recorded and not registered,
-// so a push sends what the newer request built.
-func TestAnOlderBuildHeardLaterDoesNotReplaceTheNewer(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	older := time.Date(2026, 10, 3, 21, 33, 45, 0, time.UTC)
-	newer := time.Date(2026, 10, 3, 21, 51, 57, 0, time.UTC)
-	result := func(asked time.Time, image string) link.BuildResult {
-		manifest, _ := json.Marshal(map[string]any{"module": "postgres", "version": image})
-		return link.BuildResult{ID: link.NewBuildID(asked), Repository: "http://forge.internal:20000/novox/mesh-catalog.git",
-			Path: "modules/postgres", Ref: "main", On: "anchor", Commit: "efff5415", Manifest: manifest,
-			Source: &link.SourceOnSeat{Seat: "git", Repository: "novox/mesh-catalog"}}
-	}
-	if _, _, err := takeIn(ctx, open.inventory, result(newer, "4bcd5f73")); err != nil {
-		t.Fatal(err)
-	}
-	_, _, err := takeIn(ctx, open.inventory, result(older, "0ab07fa9"))
-	if !errors.Is(err, inventory.ErrSuperseded) {
-		t.Fatalf("the older request's outcome was taken in as current: %v", err)
-	}
-	shelf, err := open.inventory.Catalogue(ctx)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got := shelf["postgres"].Version; got != "4bcd5f73" {
-		t.Errorf("postgres is %q; want the newer request's 4bcd5f73", got)
-	}
-	if builds, _ := open.inventory.Builds(ctx, "postgres", 5); len(builds) != 2 {
-		t.Errorf("the late build was not recorded: %v", builds)
-	}
-}
-
-func TestABuildIDSaysWhenItWasAsked(t *testing.T) {
-	at := time.Date(2026, 10, 3, 21, 51, 57, 392539762, time.UTC)
-	if got, ok := link.BuildAskedAt(link.NewBuildID(at)); !ok || !got.Equal(at) {
-		t.Errorf("read back %v %v; want %v", got, ok, at)
-	}
-	if got, ok := link.BuildAskedAt("build-1791064317392539762"); !ok || got.Format(time.TimeOnly) != "21:51:57" {
-		t.Errorf("the incident's id reads as %v %v", got, ok)
-	}
-	for _, id := range []string{"b-1", "build-2", "build-", "build-x", ""} {
-		if _, ok := link.BuildAskedAt(id); ok {
-			t.Errorf("%q read as a request time", id)
-		}
-	}
-}

cmd/mesh-controller/check.go

@@ -7,7 +7,6 @@ import (
 	"os"
 	"path/filepath"
 	"sort"
-	"strings"
 
 	"github.com/novox/mesh-controller/internal/catalogue"
 )
@@ -91,17 +90,6 @@ func moduleCheck(paths []string, out io.Writer) error {
 		if len(m.Invokes) > 0 {
 			fmt.Fprintf(out, ", invokes %s", joinInvokes(m.Invokes))
 		}
-		// The state it keeps and reads (novox/hq ADR 0201), so a reviewer sees what lands on the bus.
-		if len(m.State) > 0 {
-			kept := make([]string, 0, len(m.State))
-			for _, s := range m.State {
-				kept = append(kept, s.Name)
-			}
-			fmt.Fprintf(out, ", keeps state %s", strings.Join(kept, ", "))
-		}
-		if len(m.Reads) > 0 {
-			fmt.Fprintf(out, ", reads %s", strings.Join(m.Reads, ", "))
-		}
 		fmt.Fprintln(out)
 	}
 	if failed > 0 {

cmd/mesh-controller/collect.go

@@ -5,7 +5,6 @@ import (
 	"errors"
 	"fmt"
 	"os"
-	"time"
 
 	"github.com/novox/mesh-controller/internal/artifacts"
 	"github.com/novox/mesh-controller/internal/inventory"
@@ -50,55 +49,28 @@ func collect(ctx context.Context, inv *inventory.Inventory) {
 		return
 	}
 
-	// **Bounded, because this runs inside somebody's build.** The first sweep of a mesh that has
-	// never collected has the whole history to get through, and a person waiting on `build` should
-	// not pay for it. Two bounds, and what is left over is simply offered again next time —
-	// builds are frequent, and the point is that the store stops growing, not that it empties
-	// tonight.
-	within, stop := context.WithTimeout(ctx, sweepBudget)
-	defer stop()
 	store := artifacts.Store{Address: address}
-
 	var done []string
-	var left, skipped int
-	for i, reference := range references {
-		if i >= mostPerSweep || within.Err() != nil {
-			left = len(references) - i
-			break
-		}
-		err := store.LetGo(within, reference)
-		if err == nil || errors.Is(err, artifacts.Gone) {
+	var refused int
+	for _, reference := range references {
+		switch err := store.LetGo(ctx, reference); {
+		case err == nil, errors.Is(err, artifacts.Gone):
 			// Gone is the outcome wanted, already true. Recorded so the next sweep does not ask
 			// again for ever.
 			done = append(done, reference)
-			continue
-		}
-		if errors.Is(err, artifacts.ErrNotOurs) {
-			// **A fact about this record, so this record is skipped** (novox/hq issue 226). Not
-			// marked collected — the mesh did not remove it and should not claim to — and not a
-			// reason to stop, because the store was never asked. One of these at the front of
-			// the oldest-first order ended every sweep until this.
-			skipped++
-			if skipped == 1 {
-				fmt.Fprintf(os.Stderr,
-					"the sweep will not address %s and went on: %v\n", reference, err)
+		default:
+			refused++
+			if refused == 1 {
+				// Once per sweep. A store that refuses one refuses all of them, and a hundred
+				// identical lines would bury the reason.
+				fmt.Fprintf(os.Stderr, "the artifact store kept %s: %v\n", reference, err)
 			}
-			continue
 		}
-		// **Stopped at the first refusal by the STORE, not pushed through.** A store that refuses
-		// one refuses all of them — deletion disabled, the store down, the network gone — so
-		// going on would be a hundred identical failures and a hundred identical log lines in
-		// front of whoever was building something.
-		fmt.Fprintf(os.Stderr, "the artifact store kept %s, so nothing more was asked of it: %v\n",
-			reference, err)
-		left = len(references) - i
-		break
 	}
-
 	if len(done) > 0 {
-		// Recorded outside `within`: the deletions happened, and losing the record of them because
-		// the sweep ran out of budget would mean asking about them again for ever.
 		if err := inv.MarkCollected(ctx, done); err != nil {
+			// Said, and that is all: the artifacts are gone either way, and the only cost of an
+			// unrecorded collection is that the next sweep asks about them again.
 			fmt.Fprintf(os.Stderr, "the store let go of %d artifact(s) and the record of it did not keep: %v\n",
 				len(done), err)
 			return
@@ -106,18 +78,7 @@ func collect(ctx context.Context, inv *inventory.Inventory) {
 		fmt.Fprintf(os.Stderr, "the artifact store let go of %d artifact(s) the mesh no longer keeps\n",
 			len(done))
 	}
-	if left > 0 {
-		fmt.Fprintf(os.Stderr, "%d more to collect; the next build asks again\n", left)
-	}
-	if skipped > 0 {
-		fmt.Fprintf(os.Stderr, "%d artifact(s) the sweep will not address were skipped\n", skipped)
+	if refused > 0 {
+		fmt.Fprintf(os.Stderr, "%d artifact(s) were not collected; the next build asks again\n", refused)
 	}
 }
-
-// mostPerSweep is how many artifacts one sweep will ask about. Enough that a mesh building
-// several times a day converges within days of this landing; small enough that no single build
-// waits on the whole backlog.
-const mostPerSweep = 200
-
-// sweepBudget is the longest a sweep will keep a build waiting.
-const sweepBudget = 60 * time.Second

cmd/mesh-controller/credential_on_assign_test.go

@@ -1,90 +0,0 @@
-package main
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/catalogue"
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// A fresh assignment is pushed before its credential exists (novox/hq issue 203): `assign` recorded
-// the module, `push` sealed a random own secret where the bus credential belongs, and the process
-// crash-looped until a person ran `module issue` and pushed again. Now assigning a module that speaks
-// on the bus issues its credential in the same act — or, when the bus cannot be reached from here,
-// says which verb to run — and a push never seals a placeholder in a credential's place.
-
-func aTalker() catalogue.Manifest {
-	return catalogue.Manifest{Module: "talker", Version: "1",
-		OwnSecrets: catalogue.OwnSecrets{"broker": {Path: "/var/lib/mesh/talker/broker"}},
-		Resources: []map[string]any{
-			{"id": "state", "type": "directory", "path": "/var/lib/mesh/talker", "mode": "0700"},
-		}}
-}
-
-func TestAssigningAModuleThatSpeaksOnTheBusNamesItsCredential(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	register(t, open, aTalker())
-
-	// No bus is known to this process, so the credential cannot be issued here: the assignment
-	// stands and says exactly what must happen before a push — never silently.
-	said, err := assign(ctx, open, "laptop", "talker")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !strings.Contains(said, "module issue talker --node laptop") {
-		t.Fatalf("an assignment whose credential could not be issued does not name the verb:\n%s", said)
-	}
-
-	// And the push refuses to send it, naming the same verb, rather than sealing a placeholder.
-	plan, settings, err := planFor(ctx, open, "laptop")
-	if err != nil {
-		t.Fatal(err)
-	}
-	_, err = declarationFor(ctx, open, "laptop", plan, settings)
-	if err == nil {
-		t.Fatal("a push sealed a placeholder where talker's bus credential belongs")
-	}
-	if !strings.Contains(err.Error(), "module issue talker --node laptop") || !strings.Contains(err.Error(), "issue 203") {
-		t.Fatalf("the refusal does not say what to run: %v", err)
-	}
-
-	// Once the user is minted, the push goes on to the credential the mesh sealed, and re-assigning
-	// does not mint again: a credential rotates on purpose, never by habit.
-	if _, err := open.inventory.MintBusPassword(ctx, inventory.BusUser{
-		Username: "laptop.talker", Kind: inventory.BusModule, Node: "laptop", Module: "talker"}); err != nil {
-		t.Fatal(err)
-	}
-	hash, _, err := open.inventory.BusUserHash(ctx, "laptop.talker")
-	if err != nil {
-		t.Fatal(err)
-	}
-	said, err = assign(ctx, open, "laptop", "talker")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if strings.Contains(said, "module issue") {
-		t.Fatalf("a module with a minted credential was told to issue one:\n%s", said)
-	}
-	again, _, err := open.inventory.BusUserHash(ctx, "laptop.talker")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if again != hash {
-		t.Fatal("re-assigning rotated the credential")
-	}
-}
-
-// A module that declares no broker secret is left alone: nothing to issue, nothing said.
-func TestAssigningAModuleThatDoesNotSpeakSaysNothingOfCredentials(t *testing.T) {
-	open := aMesh(t)
-	register(t, open, helloWeb())
-	said, err := assign(t.Context(), open, "laptop", "hello-web")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if strings.Contains(said, "credential") {
-		t.Fatalf("a module without a broker secret was told about credentials:\n%s", said)
-	}
-}

cmd/mesh-controller/foundation_scope_test.go

@@ -0,0 +1,33 @@
+package main
+
+// The broker opening belongs only on the node that listens on it (novox/hq: it leaked onto
+// every enrolled node's declaration, opening a from-anywhere hole for a port nothing there
+// serves). foundationPortsFor is the scope.
+
+import (
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+)
+
+func TestTheBrokerHostGetsTheFoundationOpening(t *testing.T) {
+	broker := catalogue.Manifest{Module: "lavinmq", Listens: []catalogue.Listening{
+		{Port: 5671, Protocol: "tcp", From: "mesh"},
+		{Port: 5672, Protocol: "tcp", From: "mesh"},
+	}}
+	got := foundationPortsFor(5671, []catalogue.Manifest{broker})
+	if len(got) != 1 || got[0] != 5671 {
+		t.Fatalf("the node that listens on the broker port keeps it; got %v", got)
+	}
+}
+
+func TestANodeThatOnlyDialsTheBrokerGetsNoOpening(t *testing.T) {
+	// ace's set: things that reach the broker as a client, none listening on 5671.
+	ace := []catalogue.Manifest{
+		{Module: "plex", Listens: []catalogue.Listening{{Port: 32400, Protocol: "tcp", From: "anywhere"}}},
+		{Module: "postgres", Listens: []catalogue.Listening{{Port: 5432, Protocol: "tcp", From: "mesh"}}},
+	}
+	if got := foundationPortsFor(5671, ace); got != nil {
+		t.Fatalf("a node that only dials out opens nothing for the broker; got %v", got)
+	}
+}

cmd/mesh-controller/issue_204_test.go

@@ -1,93 +0,0 @@
-package main
-
-import (
-	"context"
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// A declaration composed earlier is numbered lower than one composed later, whatever order the two
-// are sent in (novox/hq issue 204). The number used to be taken at send time, after composing, so a
-// declaration composed before an assignment changed and sent after a newer one carried the higher
-// number — and the machine, which refuses a lower number, took the older content as the mesh's
-// newest word. Taken before the composition reads anything, the order of numbers is the order of
-// compositions, and the host's refusal does what it is for.
-func TestADeclarationComposedEarlierIsNumberedLowerWhateverOrderItIsSent(t *testing.T) {
-	allot := numbered()
-	var composed []string
-	compose := func(stamp string) func(string) (sendable, error) {
-		return func(node string) (sendable, error) {
-			composed = append(composed, stamp)
-			return sendable{Resources: []map[string]any{{"id": node + "." + stamp}}}, nil
-		}
-	}
-	// Composed first — before an assignment changed — and sent last.
-	stale, _ := composeEach([]string{"anchor"}, allot, compose("before"))
-	// Composed after the change, sent first.
-	fresh, _ := composeEach([]string{"anchor"}, allot, compose("after"))
-
-	if stale[0].declared.Sequence != 1 || fresh[0].declared.Sequence != 2 {
-		t.Fatalf("the numbers do not follow the compositions: before=%d after=%d",
-			stale[0].declared.Sequence, fresh[0].declared.Sequence)
-	}
-	// Sent in the other order, the numbers do not change — so the machine that has applied the
-	// fresh one (2) refuses the stale one (1) when it arrives late.
-	if !(stale[0].declared.Sequence < fresh[0].declared.Sequence) {
-		t.Fatal("a declaration composed earlier must carry the lower number, however late it is sent")
-	}
-	if len(composed) != 2 || composed[0] != "before" {
-		t.Fatalf("compositions happened in an unexpected order: %v", composed)
-	}
-}
-
-// The number is taken before the first read of the composition, not after it: an allotter that
-// fails leaves nothing composed for that machine, and the others are still composed.
-func TestTheNumberIsTakenBeforeComposingAndItsFailureIsARefusal(t *testing.T) {
-	calls := 0
-	allot := func(node string) (int64, error) {
-		if node == "anchor" {
-			return 0, context.DeadlineExceeded
-		}
-		return 7, nil
-	}
-	sending, refusals := composeEach([]string{"anchor", "laptop"}, allot, func(node string) (sendable, error) {
-		calls++
-		if node == "anchor" {
-			t.Fatal("anchor was composed although its number could not be taken")
-		}
-		return sendable{}, nil
-	})
-	if calls != 1 || len(sending) != 1 || sending[0].node != "laptop" || sending[0].declared.Sequence != 7 {
-		t.Fatalf("laptop should be composed with its number and anchor refused: %v / %v", sending, refusals)
-	}
-	if len(refusals) != 1 {
-		t.Fatalf("anchor's failed number should be a refusal naming it: %v", refusals)
-	}
-}
-
-// What was sent is written down even when the sender's context is already cancelled (issue 204): a
-// controller replaced mid-send had told the machine and never recorded it, so status read "applied,
-// current" over a machine that had just been sent something else.
-func TestASendIsRecordedEvenWhenTheSenderIsBeingCancelled(t *testing.T) {
-	inv := inventory.ForTest(t)
-	ctx, cancel := context.WithCancel(t.Context())
-	if _, err := inv.AddNode(ctx, "anchor"); err != nil {
-		t.Fatal(err)
-	}
-	cancel() // the sender is going away: its context is cancelled between the send and the record
-	body := []byte(`{"declaration":1,"resources":[]}`)
-	digest, err := recordSent(ctx, inv, "anchor", body)
-	if err != nil {
-		// NodeByName on the cancelled context may itself refuse; the record must still be possible
-		// through the detached context, so look the node up again on a live one.
-		t.Fatalf("recording a send after cancellation failed: %v", err)
-	}
-	outstanding, err := inv.Outstanding(t.Context(), "anchor")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if outstanding != digest || digest != digestOf(body) {
-		t.Fatalf("the send was not recorded: outstanding %q, sent %q", outstanding, digest)
-	}
-}

cmd/mesh-controller/main.go

@@ -8,7 +8,6 @@ package main
 
 import (
 	"context"
-	"errors"
 	"flag"
 	"fmt"
 	"os"
@@ -179,8 +178,8 @@ func usage() {
   seat <name> --to <node>/<module>   hand a seat to that assignment as one act; never empty in between (ADR 0131)
   board [--listen ADDR]          the same three questions, as a page that holds nothing
   api --issuer URL [--listen A]  assign and unassign over http, for a surface that is not here
-  assign <node> <module>...      put modules on a node, judged together (ADR 0207)
-  unassign <node> <module>...    take them off
+  assign <node> <module>         put a module on a node
+  unassign <node> <module>       take it off
   take <node> <module>           preview a module's cutover on an adopted node: what runs beside
                                  what it declares; --yes <digest> cuts it over as previewed
   converge <node> [--yes <digest>] [--filter nftables]   preview, then make, an adopted node converged
@@ -254,34 +253,25 @@ func parseAround(set *flag.FlagSet, args []string) ([]string, error) {
 // became of a build nobody was watching.
 func (b builds) Built(ctx context.Context, result link.BuildResult) error {
 	manifest, _, err := takeIn(ctx, b.inv, result)
-	// When it was asked, so a plan takes as its outcome only a build asked for it or after it
-	// (novox/hq 04-ISSUES/219). Zero when the id does not say.
-	asked, _ := link.BuildAskedAt(result.ID)
 	switch {
 	case err != nil && result.Failed != "":
 		fmt.Printf("%s: %v\n", result.ID, err)
 		if result.Module != "" {
-			planBuilt(ctx, b.open, result.Module, result.Commit, result.Failed, asked)
+			planBuilt(ctx, b.open, result.Module, result.Commit, result.Failed)
 		} else {
 			planFailedBuild(ctx, b.open, result)
 		}
 		return nil
-	case errors.Is(err, inventory.ErrSuperseded):
-		// Not a failure: the module is already at what a later request built. A plan that asked
-		// before that later request is answered by it; one that asked after it ignores this.
-		fmt.Printf("%s: %v\n", result.ID, err)
-		planBuilt(ctx, b.open, manifest.Module, result.Commit, "", asked)
-		return nil
 	case err != nil:
 		fmt.Printf("%s: heard and recorded, and not registered: %v\n", result.ID, err)
 		if manifest.Module != "" {
-			planBuilt(ctx, b.open, manifest.Module, result.Commit, err.Error(), asked)
+			planBuilt(ctx, b.open, manifest.Module, result.Commit, err.Error())
 		}
 		return nil
 	}
 	fmt.Printf("%s: %s %s registered, built on %s from %s\n",
 		result.ID, manifest.Module, manifest.Version, result.On, short(result.Commit))
 	saysWhenThePolicyActs(ctx, b.inv, manifest.Module)
-	planBuilt(ctx, b.open, manifest.Module, result.Commit, "", asked)
+	planBuilt(ctx, b.open, manifest.Module, result.Commit, "")
 	return nil
 }

cmd/mesh-controller/modules.go

@@ -147,40 +147,6 @@ func moduleCommand(ctx context.Context, args []string) error {
 		if err != nil {
 			return err
 		}
-		// **The same list, for something other than a person** (novox/hq ADR 0195): what each module
-		// is, where it runs, whether it is current, and what it says of itself.
-		if len(args) > 1 && args[1] == "--json" {
-			type listed struct {
-				Module   string `json:"module"`
-				Version  string `json:"version"`
-				Built    string `json:"built,omitempty"`
-				Head     string `json:"head,omitempty"`
-				Current  bool   `json:"current"`
-				Provided bool   `json:"provided,omitempty"`
-				// Tools says whether the module answers tools anywhere it runs: a list of its own,
-				// a bundle the runtime serves, or a seat's verbs it claims (novox/hq ADR 0197) —
-				// what the console checks the bus's answers against.
-				Tools        bool     `json:"tools"`
-				On           []string `json:"on"`
-				Provides     []string `json:"provides,omitempty"`
-				Requires     []string `json:"requires,omitempty"`
-				Claims       []string `json:"claims,omitempty"`
-				Capabilities []string `json:"capabilities,omitempty"`
-			}
-			out := make([]listed, 0, len(entries))
-			for _, e := range entries {
-				m := e.Manifest
-				l := listed{Module: m.Module, Version: m.Version, Built: e.Source.BuiltFrom, Head: e.Source.Head,
-					Current: e.Provided || e.Source.Repository == "" || e.Source.Current(), Provided: e.Provided,
-					On: append([]string{}, e.On...), Provides: m.Offers(), Requires: m.Requires,
-					Capabilities: m.Capabilities, Tools: declaresTools(m)}
-				for _, c := range m.Claims {
-					l.Claims = append(l.Claims, c.At()+"/"+c.Name)
-				}
-				out = append(out, l)
-			}
-			return printJSON(out)
-		}
 		if len(entries) == 0 {
 			fmt.Println("this mesh knows about no modules yet")
 			return nil
@@ -334,10 +300,8 @@ func moduleCommand(ctx context.Context, args []string) error {
 }
 
 func assignCommand(ctx context.Context, verb string, args []string) error {
-	// Several modules in one act (novox/hq ADR 0207): holders that depend on each other — the
-	// service manager and the package manager — can only go on, or come off, together.
-	if len(args) < 2 {
-		return fmt.Errorf("%s <node> <module> [<module>…]", verb)
+	if len(args) != 2 {
+		return fmt.Errorf("%s <node> <module>", verb)
 	}
 	open, err := openStores(ctx)
 	if err != nil {
@@ -351,7 +315,7 @@ func assignCommand(ctx context.Context, verb string, args []string) error {
 	if verb == "unassign" {
 		act = unassign
 	}
-	said, err := act(ctx, open, args[0], args[1:]...)
+	said, err := act(ctx, open, args[0], args[1])
 	if said != "" {
 		fmt.Println(said)
 	}
@@ -593,7 +557,7 @@ func issueOnTheNewBus(ctx context.Context, inv *inventory.Inventory, m catalogue
 
 	user := broker.Principal{Kind: broker.KindModule, Node: node, Module: m.Module}.Username()
 	password, err := inv.MintBusPassword(ctx, inventory.BusUser{
-		Username: user, Kind: busKindOf(m.Module), Node: node, Module: m.Module,
+		Username: user, Kind: inventory.BusModule, Node: node, Module: m.Module,
 	})
 	if err != nil {
 		return err
@@ -613,16 +577,6 @@ func issueOnTheNewBus(ctx context.Context, inv *inventory.Inventory, m catalogue
 	return issueWith(ctx, inv, m, node, busAddress, known, reachable, user, password)
 }
 
-// busKindOf is what a module's bus user is recorded as: the node's tool runtime where the module is
-// the runtime (novox/hq ADR 0175), a module otherwise. The username is the same either way — the
-// runtime is issued through this same path — and the kind is what a reader of the records sees.
-func busKindOf(module string) string {
-	if module == catalogue.RuntimeModule {
-		return inventory.BusNodeTools
-	}
-	return inventory.BusModule
-}
-
 // issueWith is the delivery half: the minted password sealed to the machine as the module's broker
 // secret, and the module's consumer created where the bus can be reached. Split from the minting
 // so the move can issue every module against a bus whose address it worked out itself
@@ -769,23 +723,3 @@ func claimsFor(ctx context.Context, inv *inventory.Inventory, m catalogue.Manife
 	}
 	return out, nil
 }
-
-// declaresTools is whether a module answers tools wherever it runs (novox/hq ADR 0197): it names
-// tools of its own, its build delivers a bundle the node's runtime serves, or it claims a seat
-// whose verbs it serves. A module with none is never expected to announce anything.
-func declaresTools(m catalogue.Manifest) bool {
-	if len(m.Tools) > 0 {
-		return true
-	}
-	for _, b := range m.Bundles {
-		if len(b.Loads) > 0 {
-			return true
-		}
-	}
-	for _, c := range m.Claims {
-		if len(c.Serves) > 0 {
-			return true
-		}
-	}
-	return false
-}

cmd/mesh-controller/network_test.go

@@ -3,7 +3,6 @@ package main
 import (
 	"context"
 	"os"
-	"reflect"
 	"strings"
 	"testing"
 
@@ -266,12 +265,6 @@ func TestTheResolverIsToldEveryMachineOnTheNetworkAndToldAgainWhenOneLeaves(t *t
 	if _, err := assign(ctx, open, "anchor", "dnsmasq"); err != nil {
 		t.Fatal(err)
 	}
-	// Its bus credential, as assigning issues it where the bus is reachable (novox/hq issue 203):
-	// no bus is known to this test, so it is minted here, or composing refuses the placeholder.
-	if _, err := open.inventory.MintBusPassword(ctx, inventory.BusUser{
-		Username: "anchor.dnsmasq", Kind: inventory.BusModule, Node: "anchor", Module: "dnsmasq"}); err != nil {
-		t.Fatal(err)
-	}
 	zones := func() string {
 		t.Helper()
 		for _, r := range composed(t, open, "anchor").Resources {
@@ -310,28 +303,3 @@ func TestTheResolverIsToldEveryMachineOnTheNetworkAndToldAgainWhenOneLeaves(t *t
 		t.Fatalf("a machine that left the network is still a wildcard, or the one that stayed is not:\n%s", after)
 	}
 }
-
-// The roster is the machines and nothing else (novox/hq ADR 0191): each node's internal domain covers
-// every route on it, and a node's public domains are public DNS's. A routed name in `.Names` was a
-// private answer for a public name, handed by a resolver serving a LAN to a phone that could not use it.
-func TestTheRosterNamesOnlyTheMachines(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	gens, err := generators(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, node := range []string{"anchor", "laptop"} {
-		plan, settings, err := planFor(ctx, open, node)
-		if err != nil {
-			t.Fatal(err)
-		}
-		with, _, err := renderingFor(ctx, open, node, plan, settings, gens, Reading)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if !reflect.DeepEqual(with.Names, with.Machines) {
-			t.Fatalf("%s's roster names more than the machines:\n names    %v\n machines %v", node, with.Names, with.Machines)
-		}
-	}
-}

cmd/mesh-controller/nodes.go

@@ -2,7 +2,6 @@ package main
 
 import (
 	"context"
-	"encoding/json"
 	"errors"
 	"flag"
 	"fmt"
@@ -45,21 +44,6 @@ func nodeCommand(ctx context.Context, args []string) error {
 		if err != nil {
 			return err
 		}
-		// **The same list, for something other than a person** — the console's discovery reads it
-		// (novox/hq ADR 0195), and a reader that parses a printed column breaks when it is reworded.
-		if len(args) > 1 && args[1] == "--json" {
-			type listed struct {
-				Name  string `json:"name"`
-				Heard string `json:"heard"`
-				Mode  string `json:"mode"`
-				ID    string `json:"id"`
-			}
-			out := make([]listed, 0, len(nodes))
-			for _, n := range nodes {
-				out = append(out, listed{Name: n.Name, Heard: heardFrom(n), Mode: modeOf(n), ID: n.ID})
-			}
-			return printJSON(out)
-		}
 		if len(nodes) == 0 {
 			// Said rather than printed as nothing: an empty list and a failed read must never
 			// look the same, and this command answering "none" is only honest because getting
@@ -516,13 +500,3 @@ func orNotReported(s string) string {
 	}
 	return s
 }
-
-// printJSON prints a value as indented JSON, the shape every `--json` answers in.
-func printJSON(v any) error {
-	body, err := json.MarshalIndent(v, "", "  ")
-	if err != nil {
-		return err
-	}
-	fmt.Println(string(body))
-	return nil
-}

cmd/mesh-controller/order_test.go

@@ -1,7 +1,6 @@
 package main
 
 import (
-	"reflect"
 	"strings"
 	"testing"
 	"time"
@@ -192,7 +191,7 @@ func TestWhatAHandedOverModuleRecordsAboutItsSource(t *testing.T) {
 		t.Fatalf("the source records as %+v", from)
 	}
 	// A manifest with no provenance at all is legitimate: fixing something in a hurry.
-	if from, err := whereItComesFrom("", "", "", "", false); err != nil || !reflect.DeepEqual(from, inventory.Source{}) {
+	if from, err := whereItComesFrom("", "", "", "", false); err != nil || from != (inventory.Source{}) {
 		t.Fatalf("a manifest handed over with no provenance was refused: %+v, %v", from, err)
 	}
 	for _, c := range []struct {
@@ -211,27 +210,3 @@ func TestWhatAHandedOverModuleRecordsAboutItsSource(t *testing.T) {
 		}
 	}
 }
-
-// novox/hq 04-ISSUES/215: a module once built at a commit still follows its branch — a merge into it
-// matches the module, and a plan re-asks the branch, not the old commit.
-func TestAModuleBuiltAtACommitStillFollowsItsBranch(t *testing.T) {
-	m := link.SourceMoved{Owner: "novox", Repo: "mesh-catalog", Base: "main"}
-	pinned := inventory.Source{Repository: "novox/mesh-catalog", Seat: "git", Ref: "9c97a8a"}
-	if !sourceIs(pinned, m) {
-		t.Error("a module whose record names a commit is left out of a merge into its branch")
-	}
-	full := inventory.Source{Repository: "novox/mesh-catalog", Seat: "git", Ref: "9c97a8a1d2c3b4a5f60718293a4b5c6d7e8f9012"}
-	if !sourceIs(full, m) {
-		t.Error("a full commit hash is read as a branch")
-	}
-	if got := followedBranch("9c97a8a"); got != "" {
-		t.Errorf("a plan would re-ask the old commit %q", got)
-	}
-	if got := followedBranch("release"); got != "release" {
-		t.Errorf("a branch is not followed as named: %q", got)
-	}
-	// A module that follows another branch is still not this merge's.
-	if sourceIs(inventory.Source{Repository: "novox/mesh-catalog", Seat: "git", Ref: "release"}, m) {
-		t.Error("a module following another branch was matched")
-	}
-}

cmd/mesh-controller/plan.go

@@ -8,16 +8,16 @@ import (
 	"flag"
 	"fmt"
 	"os"
-	"slices"
 	"sort"
 	"strings"
-	"sync"
 
 	"github.com/novox/mesh-controller/internal/broker"
 	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/licences"
 	"github.com/novox/mesh-controller/internal/overlay"
+	"net"
+	"strconv"
 )
 
 // working out what one machine should be.
@@ -129,7 +129,6 @@ func planFor(ctx context.Context, open *stores, nodeName string) (catalogue.Reso
 		// a mesh-wide gatherer may pass over — see notResolvable.
 		return catalogue.Resolution{}, nil, notResolvable{err}
 	}
-	logUnheld(nodeName, resolved.Unheld)
 
 	// The credential for each thing this node takes from elsewhere. Made once and kept, so the
 	// password a provider is told to create is the one its consumer was given — and sealed to
@@ -536,23 +535,6 @@ func renderingFor(ctx context.Context, open *stores, node string,
 			var sealed string
 			var err error
 			if choosing == Allocating {
-				// **The broker credential is never invented here** (novox/hq issue 203). Every other
-				// own secret is the mesh's to make — a password nobody else knows — but this one
-				// is an account on the bus, minted by `module issue` and sealed by it; a push that
-				// made a random one would deliver a file the process cannot read and report the
-				// machine applied. Refused by name, with the verb.
-				if name == "broker" {
-					user := broker.Principal{Kind: broker.KindModule, Node: node, Module: m.Module}.Username()
-					if _, minted, err := inv.BusUserHash(ctx, user); err != nil {
-						return catalogue.Rendering{}, inventory.Node{}, err
-					} else if !minted {
-						return catalogue.Rendering{}, inventory.Node{}, fmt.Errorf(
-							"%s on %s has no bus credential: nothing was issued for %s, and a push "+
-								"would seal a placeholder its process cannot read (novox/hq issue 203). "+
-								"`module issue %s --node %s`, then push again",
-							m.Module, node, user, m.Module, node)
-					}
-				}
 				sealed, err = inv.SecretForModule(ctx, node, m.Module, name)
 			} else {
 				var held bool
@@ -648,24 +630,43 @@ func renderingFor(ctx context.Context, open *stores, node string,
 		}
 	}
 
-	// **The roster is the machines and nothing else** (novox/hq ADR 0191). Each node has one internal
-	// domain, `<node>.internal`, and every route on it is a name under that domain (ADR 0151), which
-	// the resolver answers with one wildcard per machine — so no route needs a line of its own. A
-	// node's public domains are the operator's and public DNS answers them; the mesh gives no private
-	// answer for any of them. The roster once carried every routed name, public ones included, and a
-	// resolver that also serves a LAN handed a phone a tunnel address for the mail server.
-	// `.Names` and `.Machines` stay two fields so a module's template keeps rendering (issue 111).
+	// And every routed name → the node that serves it (novox/hq ADR 0066). Alongside the
+	// `<node>.internal` names above, so a container — or an internal ACME validator — resolves a
+	// routed name to the proxy that serves it, mesh-wide. The mesh publishes the names it was told
+	// to serve and knows nothing about what they mean.
+	// Kept apart from the machines, because a fact about the machines must not be handed the names
+	// the mesh merely serves (novox/hq 04-ISSUES/111).
 	machines := make(map[string]string, len(names))
 	for name, at := range names {
 		machines[name] = at
 	}
+	routes, err := routeNamesInTheMesh(ctx, open)
+	if err != nil {
+		return catalogue.Rendering{}, inventory.Node{}, err
+	}
+	for name, at := range routes {
+		names[name] = at
+	}
 
-	// **The bus is never public** (novox/hq ADR 0169). It was a foundation port — widened from the
-	// broker's own `from: mesh` to from-anywhere on the broker's host, so a machine could enrol
-	// before it had an address on the private network. A machine joins through the tunnel now, and
-	// every link to the bus crosses it, so its reach is what the `nats` module declares: the mesh.
-	// Nothing the mesh itself needs is opened beyond what a module declares.
+	// The ports the mesh itself needs open, which no module declares. Read from the broker this
+	// control plane was told about rather than written down twice: the address a node is handed in
+	// its token and the port its machine must accept on are the same fact.
+	//
+	// **Only on the node that listens on it** (novox/hq issue: the broker opening leaked onto
+	// every node). The opening exists to WIDEN the broker's port to from-anywhere — a machine
+	// enrolling is not on the mesh yet, so the broker's own `from: mesh` listen would refuse its
+	// first dial. That widening belongs on the broker's host and nowhere else: a node that only
+	// dials out needs no incoming rule, and an opening for a port nothing here listens on is a
+	// from-anywhere hole for a dead port. So the foundation port is kept only when a module
+	// resolved onto THIS node actually listens on it.
 	var foundation []int
+	if b, err := broker.FromEnvironment(); err == nil {
+		if _, port, err := net.SplitHostPort(b.Address); err == nil {
+			if n, err := strconv.Atoi(port); err == nil {
+				foundation = foundationPortsFor(n, plan.Modules)
+			}
+		}
+	}
 
 	// And, for a module that keeps them, every operator-sealed secret in the mesh — the vault's
 	// copy, outside the store (novox/hq ADR 0085, amended). Read only; nothing here mints. The
@@ -737,6 +738,76 @@ func renderingFor(ctx context.Context, open *stores, node string,
 	}, record, nil
 }
 
+// routeNamesInTheMesh is every routed name and the address of the node that serves it (novox/hq
+// ADR 0066).
+//
+// **Mesh-wide, so any container resolves any routed name to its proxy** — including an internal
+// ACME validator, which cannot complete a challenge for a name it cannot reach. A routed name is
+// composed on the consumer's node (from its label and that node's public domain) and served by the
+// node answering the consumer's route requirement; this gathers both.
+//
+// It reads route names off resolutions rather than a table because there is no table: a route is a
+// contribution, computed from what each node runs. Name-agnostic — a contribution counts as a
+// routed name only because it carried a label the mesh composed, never because the mesh knows what
+// "route" means. A node that does not resolve is skipped, so one machine's broken set does not cost
+// the rest their names.
+//
+// **A node that could not be READ is a different matter and is raised.** Skipping one states, to
+// every machine at once, that its names do not exist — and since the roster is part of every
+// container's identity, that withdraws them and replaces every container (novox/hq 04-ISSUES/152,
+// 151). So every failure here says which machine and which read, because the alternative is a
+// mesh-wide refusal with nothing named in it.
+func routeNamesInTheMesh(ctx context.Context, open *stores) (map[string]string, error) {
+	inv := open.inventory
+	places, err := inv.Overlays(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("where the machines are cannot be read: %w", err)
+	}
+	address := map[string]string{}
+	for _, p := range places {
+		if strings.TrimSpace(p.Address) != "" {
+			address[p.Name] = p.Address
+		}
+	}
+
+	nodes, err := inv.Nodes(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("which machines the mesh has cannot be read: %w", err)
+	}
+
+	// Every machine's resolution first, then the names across them at once: which node serves a
+	// name is a question about the graph — the consumer on one machine, the provider on another —
+	// and answered wrongly by looking at one contribution at a time (novox/hq issue 178).
+	plans := map[string]catalogue.Resolution{}
+	settings := map[string]catalogue.SettingsBy{}
+	for _, n := range nodes {
+		plan, layers, err := planFor(ctx, open, n.Name)
+		switch {
+		case unresolvable(err):
+			// Their set does not compose, so they serve no names. Passed over, so one machine's
+			// broken set does not cost the rest theirs.
+			continue
+		case err != nil:
+			// The mesh could not be asked. Returning the roster without this machine's names would
+			// state that they do not exist — to every machine, and indistinguishably from the
+			// operator having withdrawn them (novox/hq 04-ISSUES/152).
+			return nil, fmt.Errorf("the names %s serves cannot be read: %w", n.Name, err)
+		}
+		plans[n.Name], settings[n.Name] = plan, layers
+	}
+	served, err := catalogue.NamesServed(plans, settings)
+	if err != nil {
+		return nil, err
+	}
+	out := map[string]string{}
+	for name, node := range served {
+		if at := address[node]; at != "" {
+			out[name] = at
+		}
+	}
+	return out, nil
+}
+
 // certificateFor is what the mesh certifies about one machine's internal name.
 //
 // It reaches across two contexts and reads neither one's store from the other: `inventory` knows
@@ -1309,6 +1380,23 @@ func composeBusUsers(ctx context.Context, inv *inventory.Inventory,
 	return broker.ComposeAccounts(filled)
 }
 
+// foundationPortsFor is the broker port, kept only when a module resolved onto this node listens
+// on it (novox/hq issue: the broker opening leaked onto every node). The foundation opening
+// exists to WIDEN the broker's `from: mesh` port to from-anywhere, because a machine enrolling is
+// not on the mesh yet and its first dial would be refused. That widening belongs on the broker's
+// host alone: a node that only dials out needs no incoming rule, and an opening for a port
+// nothing here listens on is a from-anywhere hole for a dead port.
+func foundationPortsFor(brokerPort int, modules []catalogue.Manifest) []int {
+	for _, m := range modules {
+		for _, l := range m.Listens {
+			if l.Port == brokerPort {
+				return []int{brokerPort}
+			}
+		}
+	}
+	return nil
+}
+
 // providerModuleOf is which module answers a need on the providing node: the one in this node's
 // own set when the provider is here, else the one the catalogue says offers it.
 func providerModuleOf(resolved catalogue.Resolution, open *stores, ctx context.Context, n catalogue.Needed) string {
@@ -1328,90 +1416,3 @@ func providerModuleOf(resolved catalogue.Resolution, open *stores, ctx context.C
 	}
 	return ""
 }
-
-// unheldLogged is what was last logged about each node's unmet seat dependencies, so the log says
-// each change once (novox/hq ADR 0207), on stderr so `status --json` stays a document.
-//
-// **The serving controller's log only.** planFor runs for every node on every push, assignment and
-// status — `blockedElsewhere` alone resolves the whole mesh — and a one-shot command starts with an
-// empty memory, so every node's report was "a change" and a push printed the whole mesh's list,
-// burying the line about the node it acted on. A command says what concerns its own act instead
-// (unheldChange, reportUnheldPushed); the full list is `status`'s.
-var (
-	unheldLogged     = map[string]string{}
-	unheldLoggedMu   sync.Mutex
-	logUnheldChanges bool
-)
-
-// logUnheld logs a node's unmet seat dependencies when they differ from what was last logged for
-// it, including when they become none — in the serving controller, and nowhere else.
-func logUnheld(node string, unheld []catalogue.Unheld) {
-	if !logUnheldChanges {
-		return
-	}
-	lines := make([]string, 0, len(unheld))
-	for _, u := range unheld {
-		lines = append(lines, u.String())
-	}
-	now := strings.Join(lines, "\n")
-	unheldLoggedMu.Lock()
-	before, seen := unheldLogged[node]
-	unheldLogged[node] = now
-	unheldLoggedMu.Unlock()
-	if (seen && before == now) || (!seen && now == "") {
-		return
-	}
-	if now == "" {
-		fmt.Fprintf(os.Stderr, "%s: every seat its modules depend on is held (novox/hq ADR 0207)\n", node)
-		return
-	}
-	fmt.Fprintf(os.Stderr, "%s: %d unmet seat dependenc(ies), reported and not refused (novox/hq ADR 0207):\n  %s\n",
-		node, len(lines), strings.Join(lines, "\n  "))
-}
-
-// unheldChange is what an act on one node changed about its unmet seat dependencies, judged over
-// its assignments before and after (novox/hq ADR 0207): each dependency now unmet that was not —
-// which includes every one of a module just assigned — and each now met that was not. Nothing about
-// any other node, and nothing that was already true before the act.
-func unheldChange(shelf map[string]catalogue.Manifest, node string, before, after []string) []string {
-	judge := func(names []string) map[string]catalogue.Unheld {
-		var set []catalogue.Manifest
-		for _, n := range names {
-			if m, known := shelf[n]; known {
-				set = append(set, m)
-			}
-		}
-		out := map[string]catalogue.Unheld{}
-		for _, u := range catalogue.UnheldDependencies(shelf, node, set, nil) {
-			out[u.Module+" "+u.Seat] = u
-		}
-		return out
-	}
-	was, now := judge(before), judge(after)
-	var lines []string
-	for _, k := range sortedNames(now) {
-		if _, already := was[k]; !already {
-			lines = append(lines, "but "+now[k].String())
-		}
-	}
-	for _, k := range sortedNames(was) {
-		if _, still := now[k]; still {
-			continue
-		}
-		u := was[k]
-		if !slices.Contains(after, u.Module) {
-			continue // went with its module, which says nothing about the seat
-		}
-		lines = append(lines, fmt.Sprintf("and %s on %s now has %s held", u.Module, node, u.Seat))
-	}
-	return lines
-}
-
-func sortedNames[V any](m map[string]V) []string {
-	out := make([]string, 0, len(m))
-	for k := range m {
-		out = append(out, k)
-	}
-	sort.Strings(out)
-	return out
-}

cmd/mesh-controller/plans_one_at_a_time_test.go

@@ -1,47 +0,0 @@
-package main
-
-import (
-	"testing"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// novox/hq issue 213: for the moment a machine hands its controller over, the container and the
-// process both run the plan timer on one store. Only the one holding the plans moves them; the other
-// leaves them alone, and moves them once they are let go.
-func TestAControllerLeavesThePlansToTheOneHoldingThem(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	now := time.Now().UTC()
-	// Every tier done: the next step is the plan's last, and needs nothing but the store.
-	plan := inventory.Plan{ID: "plan-213", Repository: "r", Commit: "abc", Created: now, Updated: now,
-		State: inventory.PlanRolling, Tier: 1, Tiers: [][]string{{"app"}},
-		Modules: map[string]*inventory.PlanModule{"app": {State: "built"}}}
-	if err := open.inventory.SavePlan(ctx, plan); err != nil {
-		t.Fatal(err)
-	}
-
-	// The other controller: its own connections to the same store, holding the plans.
-	other, err := inventory.Open(ctx)
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(other.Close)
-	release, err := other.HoldPlans(ctx, false)
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(release) // before the close above: a pool waits for a connection still held
-
-	advancePlans(ctx, open)
-	if p, err := open.inventory.PlanByID(ctx, "plan-213"); err != nil || !p.Open() {
-		t.Fatalf("a controller moved a plan another held: %+v %v", p, err)
-	}
-
-	release()
-	advancePlans(ctx, open)
-	if p, err := open.inventory.PlanByID(ctx, "plan-213"); err != nil || p.State != inventory.PlanDone {
-		t.Fatalf("the plan did not move once it was let go: %+v %v", p, err)
-	}
-}

cmd/mesh-controller/push.go

@@ -8,7 +8,6 @@ import (
 	"errors"
 	"flag"
 	"fmt"
-	"io"
 	"log"
 	"os"
 	"sort"
@@ -63,9 +62,6 @@ func connectLink(ctx context.Context, inv *inventory.Inventory, enroller link.En
 }
 
 func serve(ctx context.Context) error {
-	// The one process whose log is read over time, so the one that says each change to a node's
-	// unmet seat dependencies once (novox/hq ADR 0207).
-	logUnheldChanges = true
 	open, err := openStores(ctx)
 	if err != nil {
 		return err
@@ -155,12 +151,6 @@ func serve(ctx context.Context) error {
 		return err
 	}
 	defer stopServing()
-	// And says so on the bus (novox/hq ADR 0197): what it serves, as the NATS services protocol asks.
-	stopAnnouncing, err := bus.Announce(seatAnnouncement(handlers), log.New(os.Stdout, "", log.LstdFlags))
-	if err != nil {
-		return err
-	}
-	defer stopAnnouncing()
 
 	return server.Serve(ctx)
 }
@@ -215,12 +205,6 @@ func declare(ctx context.Context, args []string) error {
 	if err := link.Declare(ctx, server.Bus(), ident, node, raw, 15*time.Second); err != nil {
 		return err
 	}
-	// Written down like every other send (novox/hq issue 204): a declaration a person sent by hand
-	// is still what the machine was last told, and status must not read it as current for the one
-	// the mesh would compose.
-	if _, err := recordSent(ctx, inv, node, raw); err != nil {
-		return err
-	}
 	fmt.Printf("sent %s a signed declaration (%d bytes)\n", node, len(raw))
 	return nil
 }
@@ -364,10 +348,7 @@ func pushCommand(ctx context.Context, args []string) error {
 	if err != nil {
 		return err
 	}
-	// Each machine's unmet seat dependencies (novox/hq ADR 0207), said after the sends: in full
-	// for a machine named, as a count for each of many — the full list is `status`'s.
-	unheld := map[string][]catalogue.Unheld{}
-	sending, refusals := composeEach(asked, allotting(held, inv), func(node string) (sendable, error) {
+	sending, refusals := composeEach(asked, func(node string) (sendable, error) {
 		plan, settings, err := planFor(held, open, node)
 		if err != nil {
 			return sendable{}, err
@@ -376,7 +357,6 @@ func pushCommand(ctx context.Context, args []string) error {
 		// healthy modules beside it are still resolved and sent. Reported so it is not silently
 		// dropped — the remedy is to move it, and until then the rest of the node converges.
 		reportUnhostable(node, plan)
-		unheld[node] = plan.Unheld
 		// The private network is in here with everything else. It used to be composed separately
 		// and prepended, which meant every machine with an address was on it and no machine could
 		// be kept off. It is a module now, so it arrives the way a module does.
@@ -390,8 +370,12 @@ func pushCommand(ctx context.Context, args []string) error {
 	sentDigest := map[string]string{}
 	defer release()
 	for _, s := range sending {
-		// The number is inside the signed bytes, so a replayed older declaration cannot borrow a
-		// newer one's (novox/hq 04-ISSUES/107); it was taken when the composition began (issue 204).
+		// Numbered under the hold, one higher than the last, before the body exists — the number is
+		// inside the signed bytes, so a replayed older declaration cannot borrow a newer one's
+		// (novox/hq 04-ISSUES/107).
+		if err := number(ctx, inv, &s); err != nil {
+			return err
+		}
 		body, err := s.declared.Body()
 		if err != nil {
 			return err
@@ -401,16 +385,19 @@ func pushCommand(ctx context.Context, args []string) error {
 		}
 		// After it is away, not before. A digest recorded for something that failed to send would
 		// make the machine look current for a declaration it never received.
-		digest, err := recordSent(ctx, inv, s.node, body)
+		record, err := inv.NodeByName(ctx, s.node)
 		if err != nil {
 			return err
 		}
+		digest := digestOf(body)
+		if err := inv.RecordSent(ctx, record.ID, digest); err != nil {
+			return err
+		}
 		sentDigest[s.node] = digest
 		fmt.Printf("sent %s %d resource(s)\n", s.node, len(s.declared.Resources))
 	}
 	release()
 	fmt.Printf("\n%d node(s) told\n", len(sending))
-	reportUnheldPushed(os.Stdout, len(args) == 1, asked, unheld)
 	// And each machine's memberships, as every other send does (ADR 0160): a push is the one most
 	// operators run, and on 2026-10-01 it was the one path that issued none.
 	if err := issueMemberships(ctx, open, server, sending); err != nil {
@@ -489,7 +476,11 @@ func pushCommand(ctx context.Context, args []string) error {
 						15*time.Second); err != nil {
 						return err
 					}
-					if _, err := recordSent(ctx, inv, s.node, body); err != nil {
+					record, err := inv.NodeByName(ctx, s.node)
+					if err != nil {
+						return err
+					}
+					if err := inv.RecordSent(ctx, record.ID, digestOf(body)); err != nil {
 						return err
 					}
 					fmt.Printf("sent %s %d resource(s)\n", s.node, len(s.declared.Resources))
@@ -578,31 +569,17 @@ type readyNode struct {
 //
 // The all-or-nothing rule is kept where it means something — sendTo, which rotates a credential
 // across two machines that must agree — and dropped here, where it never did.
-func composeEach(names []string, allot func(node string) (int64, error),
+func composeEach(names []string,
 	compose func(node string) (sendable, error)) ([]readyNode, []string) {
 
 	var sending []readyNode
 	var refusals []string
 	for _, name := range names {
-		// **Numbered before it is composed, not before it is sent** (novox/hq issue 204). The
-		// number says where this declaration stands against every other the mesh composed for the
-		// machine, and the host refuses one lower than the last it applied. Taken at send time, as
-		// it was, a declaration composed a minute ago — before an assignment changed — went out with
-		// a number higher than one composed after the change and sent before it, and the machine
-		// took the older content as the newer word: on 2026-10-02 a runtime assigned and applied on
-		// two machines was undone two seconds later by exactly that. Taken here, before the first
-		// read, what was composed earlier is numbered lower whatever order the sends happen in.
-		seq, err := allot(name)
-		if err != nil {
-			refusals = append(refusals, fmt.Sprintf("%s:\n%v", name, err))
-			continue
-		}
 		declared, err := compose(name)
 		if err != nil {
 			refusals = append(refusals, fmt.Sprintf("%s:\n%v", name, err))
 			continue
 		}
-		declared.Sequence = seq
 		if len(declared.Resources) == 0 {
 			// Sent, not skipped (novox/hq issue 127). A node whose declaration composes to
 			// nothing may have HELD something before — the broker opening a placement gave it,
@@ -630,10 +607,13 @@ func sendRound(ctx context.Context, open *stores, names []string,
 		return nil, err
 	}
 	defer release()
-	sending, refused := composeEach(names, allotting(held, open.inventory), func(node string) (sendable, error) {
+	sending, refused := composeEach(names, func(node string) (sendable, error) {
 		return compose(held, node)
 	})
 	for _, s := range sending {
+		if err := number(ctx, open.inventory, &s); err != nil {
+			return refused, err
+		}
 		body, err := s.declared.Body()
 		if err != nil {
 			return refused, err
@@ -690,12 +670,6 @@ func sendTo(ctx context.Context, open *stores, names []string) error {
 	var sending []readyNode
 	var refusals []string
 	for _, name := range names {
-		// Numbered before composing, for the reason composeEach gives (novox/hq issue 204).
-		seq, err := allot(ctx, inv, name)
-		if err != nil {
-			refusals = append(refusals, fmt.Sprintf("%s:\n%v", name, err))
-			continue
-		}
 		plan, settings, err := planFor(ctx, open, name)
 		if err != nil {
 			refusals = append(refusals, fmt.Sprintf("%s:\n%v", name, err))
@@ -707,7 +681,6 @@ func sendTo(ctx context.Context, open *stores, names []string) error {
 			refusals = append(refusals, fmt.Sprintf("%s:\n%v", name, err))
 			continue
 		}
-		declared.Sequence = seq
 		reportLeftOut(name, declared)
 		sending = append(sending, readyNode{name, declared})
 	}
@@ -723,6 +696,9 @@ func sendTo(ctx context.Context, open *stores, names []string) error {
 	defer server.Close()
 
 	for _, s := range sending {
+		if err := number(ctx, inv, &s); err != nil {
+			return err
+		}
 		body, err := s.declared.Body()
 		if err != nil {
 			return err
@@ -730,7 +706,11 @@ func sendTo(ctx context.Context, open *stores, names []string) error {
 		if err := link.Declare(ctx, server.Bus(), ident, s.node, body, 15*time.Second); err != nil {
 			return err
 		}
-		if _, err := recordSent(ctx, inv, s.node, body); err != nil {
+		record, err := inv.NodeByName(ctx, s.node)
+		if err != nil {
+			return err
+		}
+		if err := inv.RecordSent(ctx, record.ID, digestOf(body)); err != nil {
 			return err
 		}
 		fmt.Printf("  sent %s %d resource(s)\n", s.node, len(s.declared.Resources))
@@ -756,16 +736,6 @@ func issueMemberships(ctx context.Context, open *stores, server *link.Server, se
 	if !ok {
 		return nil
 	}
-	// **Every declared state's bucket, before the memberships that name it** (novox/hq ADR 0201). The
-	// raise at start asserts them too, but a module registered and assigned since would otherwise have
-	// its bucket only after the control plane next restarts — found the first time a module declared
-	// state: its bundle asked for a bucket that did not exist. Idempotent and cheap; a failure is said
-	// and the push stands, as a membership's is.
-	if buckets, err := open.inventory.DeclaredBuckets(ctx); err != nil {
-		fmt.Printf("  the modules' state could not be read, so no bucket was asserted: %v\n", err)
-	} else if _, err := broker.RaiseBuckets(broker.OnConn(bus.Conn), buckets); err != nil {
-		fmt.Printf("  the modules' state could not be asserted on the bus: %v — the next push tries again\n", err)
-	}
 	// The declarations are sent and recorded by now; a membership that cannot be issued is said
 	// and does not unsay them. Every runtime without one serves the shape it derives (ADR 0160), so
 	// the push stands, the first failure is named once, and the next push tries again.
@@ -917,21 +887,6 @@ func raiseTheBus(ctx context.Context, inv *inventory.Inventory, address string)
 	if err := broker.RaiseSeats(js, inventory.MeshSeats(), holders); err != nil {
 		return err
 	}
-	// Every module's state (novox/hq ADR 0201), from the catalogue: a bucket exists from
-	// registration, so a module reading one may watch it before its owner runs anywhere. One that
-	// nothing declares any more is said and kept — what it holds is data.
-	buckets, err := inv.DeclaredBuckets(ctx)
-	if err != nil {
-		return err
-	}
-	undeclared, err := broker.RaiseBuckets(js, buckets)
-	if err != nil {
-		return err
-	}
-	if len(undeclared) > 0 {
-		fmt.Printf("the bus holds state nothing declares any more, kept because it is data: %s — "+
-			"removing it is a person's act\n", strings.Join(undeclared, ", "))
-	}
 	// And how every module hears what it consumes. Derived from the same records the user list is
 	// composed from, so a module the mesh grants a consumer's subjects has that consumer waiting.
 	// Done on every raise, not only when a credential is issued: every module moved onto this bus
@@ -955,8 +910,8 @@ func raiseTheBus(ctx context.Context, inv *inventory.Inventory, address string)
 		}
 		hearing++
 	}
-	fmt.Printf("the bus at %s has its streams, %d machine(s) can hear a declaration, %d module(s) "+
-		"can hear what they consume, and %d bucket(s) of state\n", broker.BareAddress(address), len(names), hearing, len(buckets))
+	fmt.Printf("the bus at %s has its streams, %d machine(s) can hear a declaration, and %d module(s) "+
+		"can hear what they consume\n", broker.BareAddress(address), len(names), hearing)
 	return nil
 }
 
@@ -996,59 +951,15 @@ func seatHolders(ctx context.Context, inv *inventory.Inventory) (map[string]brok
 }
 
 // number gives one send the next sequence for its node (novox/hq 04-ISSUES/107).
-// allotting is allot over one inventory, in the shape composeEach takes.
-func allotting(ctx context.Context, inv *inventory.Inventory) func(node string) (int64, error) {
-	return func(node string) (int64, error) { return allot(ctx, inv, node) }
-}
-
-// allot takes the next sequence for a machine — the number its next declaration carries.
-func allot(ctx context.Context, inv *inventory.Inventory, node string) (int64, error) {
-	record, err := inv.NodeByName(ctx, node)
+func number(ctx context.Context, inv *inventory.Inventory, s *readyNode) error {
+	record, err := inv.NodeByName(ctx, s.node)
 	if err != nil {
-		return 0, err
+		return err
 	}
-	return inv.NextSequence(ctx, record.ID)
-}
-
-// recordSent writes down what a machine was just sent, and returns the digest.
-//
-// **On a context that outlives the caller's** (novox/hq issue 204). The record is written after the
-// declaration is away, so a send that failed is never recorded as current — and a controller being
-// replaced mid-send had its context cancelled between the two, so the machine was told and the mesh
-// never wrote it down: status read "applied, current" over a machine that had just been sent
-// something else. What was sent was sent; the record of it must not depend on the sender living
-// another second. Bounded, so a store that is away does not hold a dying process open for ever.
-func recordSent(ctx context.Context, inv *inventory.Inventory, node string, body []byte) (string, error) {
-	kept, cancel := context.WithTimeout(context.WithoutCancel(ctx), 10*time.Second)
-	defer cancel()
-	record, err := inv.NodeByName(kept, node)
+	seq, err := inv.NextSequence(ctx, record.ID)
 	if err != nil {
-		return "", err
-	}
-	digest := digestOf(body)
-	if err := inv.RecordSent(kept, record.ID, digest); err != nil {
-		return "", err
-	}
-	return digest, nil
-}
-
-// reportUnheldPushed says what a push's machines lack of the seats their modules depend on
-// (novox/hq ADR 0207): every line for a machine the push named, since that is the machine somebody
-// is looking at, and one line per machine otherwise — a list per machine across the mesh is the
-// hundred lines that buried the one that mattered. Nothing for a machine that lacks nothing.
-func reportUnheldPushed(w io.Writer, named bool, asked []string, unheld map[string][]catalogue.Unheld) {
-	for _, node := range asked {
-		lines := unheld[node]
-		if len(lines) == 0 {
-			continue
-		}
-		if named {
-			fmt.Fprintf(w, "\n%s has %d unmet seat dependenc(ies) (novox/hq ADR 0207):\n", node, len(lines))
-			for _, u := range lines {
-				fmt.Fprintf(w, "  %s\n", u)
-			}
-			continue
-		}
-		fmt.Fprintf(w, "%s: %d unmet seat dependenc(ies) — see `status`\n", node, len(lines))
+		return err
 	}
+	s.declared.Sequence = seq
+	return nil
 }

cmd/mesh-controller/push_test.go

@@ -17,7 +17,7 @@ import (
 // the wrong machine no longer refuses the whole node), applied one level up.
 func TestOneUnresolvableNodeStillLetsTheRestBeSent(t *testing.T) {
 	sending, refusals := composeEach(
-		[]string{"anchor", "home-server", "laptop"}, numbered(),
+		[]string{"anchor", "home-server", "laptop"},
 		func(node string) (sendable, error) {
 			if node == "anchor" {
 				return sendable{}, errors.New(`nothing provides "acme-ca", wanted by route-proxy`)
@@ -43,7 +43,7 @@ func TestOneUnresolvableNodeStillLetsTheRestBeSent(t *testing.T) {
 // (novox/hq issue 127): it may have held something before, and only sending the empty
 // declaration tells it to drop what the mesh owned. It is never a refusal.
 func TestAnEmptyDeclarationIsSentSoTheNodeDropsWhatItHeld(t *testing.T) {
-	sending, refusals := composeEach([]string{"spare"}, numbered(),
+	sending, refusals := composeEach([]string{"spare"},
 		func(string) (sendable, error) { return sendable{}, nil })
 	if len(sending) != 1 || len(refusals) != 0 {
 		t.Errorf("an empty declaration must be sent, not skipped or refused: %v / %v", sending, refusals)
@@ -74,9 +74,3 @@ func TestASkippedMachineIsStillAnError(t *testing.T) {
 		}
 	}
 }
-
-// numbered is an allotter for tests: one higher per call, as the inventory's is per machine.
-func numbered() func(string) (int64, error) {
-	var n int64
-	return func(string) (int64, error) { n++; return n, nil }
-}

cmd/mesh-controller/readable.go

@@ -3,7 +3,6 @@ package main
 import (
 	"encoding/json"
 	"fmt"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"sort"
 	"time"
@@ -74,10 +73,6 @@ type meshStatus struct {
 	// alone. A document without this called a machine well while a predecessor's chain refused
 	// what the mesh declared open.
 	Filtered []machineFiltered `json:"filtered,omitempty"`
-	// Unheld is every module on a machine whose resources are applied through a seat nothing on
-	// that machine holds, with the modules that could hold it (novox/hq ADR 0207). Absent when every
-	// dependency is met. Reported, not refused, until the switch.
-	Unheld []catalogue.Unheld `json:"unheld,omitempty"`
 }
 
 // machineFiltered is one rule set on a converged machine that the mesh did not write and that
@@ -209,7 +204,6 @@ func statusAsJSON(asked answers) ([]byte, error) {
 			out.Filtered = append(out.Filtered, machineFiltered{Node: name, Where: x.Where, Owner: x.Owner, Refuses: x.Refuses})
 		}
 	}
-	out.Unheld = asked.unheld
 	for name := range asked.refused {
 		out.Unresolved = append(out.Unresolved, machineUnresolved{
 			Node: name, Problem: asked.refused[name]})

cmd/mesh-controller/release_plan.go

@@ -2,7 +2,6 @@ package main
 
 import (
 	"context"
-	"errors"
 	"flag"
 	"fmt"
 	"sort"
@@ -37,29 +36,17 @@ func tiersOf(set []string, edges []inventory.Edge) [][]string {
 	for _, m := range set {
 		deps[m] = map[string]bool{}
 	}
-	// The build seat's holders follow the controller that defines their worker (EdgeWorkerOf,
-	// novox/hq issue 206), so the built-by edge from that controller to such a holder yields: the
-	// controller is built by whichever build machine is running, as the runtime image always was.
-	worker := map[string]map[string]bool{}
-	for _, e := range edges {
-		if e.Kind == inventory.EdgeWorkerOf && in[e.From] && in[e.To] {
-			if worker[e.To] == nil {
-				worker[e.To] = map[string]bool{}
-			}
-			worker[e.To][e.From] = true
-		}
-	}
 	for _, e := range edges {
 		// A code dependency — B packages A's source — rebuilds B with A, in the same tier: B's
 		// build needs nothing of A's first. The other kinds order: stands-on and declared after
 		// the base is built, built-by after the build machine is built and running — except for
-		// what the build machine itself stands on, and for the controller whose worker the build
-		// machine binds. The runtime image is built by the builder and the builder is built on the
-		// runtime image; the image comes first, built by the builder that is running.
+		// what the build machine itself stands on. The runtime image is built by the builder and
+		// the builder is built on the runtime image; the image comes first, built by the builder
+		// that is running, which is the only one there could be.
 		if !in[e.From] || !in[e.To] || e.From == e.To || e.Kind == inventory.EdgePackages {
 			continue
 		}
-		if e.Kind == inventory.EdgeBuiltBy && (isBaseOf(e.From, e.To, edges, in) || worker[e.From][e.To]) {
+		if e.Kind == inventory.EdgeBuiltBy && isBaseOf(e.From, e.To, edges, in) {
 			continue
 		}
 		deps[e.From][e.To] = true
@@ -135,10 +122,7 @@ func reachableFrom(moved []string, edges []inventory.Edge) []string {
 	for grew := true; grew; {
 		grew = false
 		for _, e := range edges {
-			// Built-by and worker-of order a plan; neither widens it. A new build machine changes
-			// nothing it builds, and a new controller changes nothing about the holder it orders —
-			// what packages the controller's source is already a code edge.
-			if e.Kind == inventory.EdgeBuiltBy || e.Kind == inventory.EdgeWorkerOf {
+			if e.Kind == inventory.EdgeBuiltBy {
 				continue
 			}
 			if in[e.To] && !in[e.From] {
@@ -273,8 +257,7 @@ func askTier(ctx context.Context, inv *inventory.Inventory, p *inventory.Plan) e
 		}
 		source := buildSource{Repository: e.Source.Repository, Seat: e.Source.Seat}
 		fmt.Printf("  tier %d: ", p.Tier)
-		// The branch it follows, never a commit a build once named (novox/hq 04-ISSUES/215).
-		if err := buildOne(ctx, source, e.Source.Path, followedBranch(e.Source.Ref), 0); err != nil {
+		if err := buildOne(ctx, source, e.Source.Path, e.Source.Ref, 0); err != nil {
 			state.State = "failed"
 			state.Why = err.Error()
 			p.State = inventory.PlanFailed
@@ -289,23 +272,8 @@ func askTier(ctx context.Context, inv *inventory.Inventory, p *inventory.Plan) e
 
 // planBuilt marks a module built (or failed) in every open plan whose current tier holds it, and
 // advances what that completes. Called from the daemon's take-in of every outcome.
-//
-// **Only a build asked at or after the plan's ask is its outcome** (novox/hq 04-ISSUES/219). Two
-// plans a few minutes apart both ask for a module; the earlier plan's build, finishing late, is not
-// the later plan's answer — it stood on the bases from before the later plan's merge, and taking it
-// would send machines, and the next tier, what the later merge replaced. asked is zero when the
-// build's request time is not known, and such an outcome is taken as before.
-func planBuilt(ctx context.Context, open *stores, module, commit, failed string, asked time.Time) {
+func planBuilt(ctx context.Context, open *stores, module, commit, failed string) {
 	inv := open.inventory
-	// One controller works the plans at a time (novox/hq issue 213); an outcome waits its turn rather
-	// than write over what the holder is about to save. Not taken, it is still in the build records,
-	// which the holder settles the plan from (issue 214).
-	release, err := inv.HoldPlans(ctx, true)
-	if err != nil {
-		fmt.Printf("plans: %s's outcome is left to the build records: %v\n", module, err)
-		return
-	}
-	defer release()
 	plans, err := inv.OpenPlans(ctx)
 	if err != nil {
 		fmt.Printf("plans: cannot read them: %v\n", err)
@@ -331,9 +299,6 @@ func planBuilt(ctx context.Context, open *stores, module, commit, failed string,
 			state = &inventory.PlanModule{}
 			p.Modules[module] = state
 		}
-		if askedBefore(asked, state.AskedAt) {
-			continue
-		}
 		if failed != "" {
 			state.State = "failed"
 			state.Why = failed
@@ -352,30 +317,13 @@ func planBuilt(ctx context.Context, open *stores, module, commit, failed string,
 			fmt.Printf("%s: %s; the tiers after it are not asked\n", p.ID, p.Note)
 		}
 	}
-	advanceHeld(ctx, open)
+	advancePlans(ctx, open)
 }
 
 // advancePlans moves every open plan as far as the facts allow: a tier whose modules are all built
 // and whose gates are applied gives way to the next; the last tier done is the plan done. Called
 // after every outcome and on a timer, so a plan waiting on a machine's report moves when it comes.
-//
-// **One controller at a time** (novox/hq issue 213). A plan is read, changed and saved whole; two
-// controllers — the old and the new while a machine hands its controller over — would each ask a
-// tier the other had just asked. Taken without waiting: whoever holds the plans is moving them.
 func advancePlans(ctx context.Context, open *stores) {
-	release, err := open.inventory.HoldPlans(ctx, false)
-	if err != nil {
-		if !errors.Is(err, inventory.ErrPlansBusy) {
-			fmt.Printf("plans: cannot hold them: %v\n", err)
-		}
-		return
-	}
-	defer release()
-	advanceHeld(ctx, open)
-}
-
-// advanceHeld is advancePlans for a caller already holding the plans.
-func advanceHeld(ctx context.Context, open *stores) {
 	inv := open.inventory
 	plans, err := inv.OpenPlans(ctx)
 	if err != nil {
@@ -436,24 +384,6 @@ func advanceOnce(ctx context.Context, open *stores, p *inventory.Plan,
 		}
 		return true, nil
 	}
-	// **Asked: settle from the build records first** (novox/hq 04-ISSUES/214). An outcome is taken
-	// in by whichever controller hears it, and a merge to the controller's own repository replaces
-	// the controller in its first tier: the build that produced the new one is recorded, and the
-	// plan never hears it. The record is the fact; a build recorded after the ask is that tier's
-	// outcome, whoever was listening.
-	recorded := map[string][]inventory.Build{}
-	for _, m := range tier {
-		if s := p.Modules[m]; s != nil && s.State == "asked" {
-			builds, err := inv.Builds(ctx, m, 5)
-			if err != nil {
-				return false, err
-			}
-			recorded[m] = builds
-		}
-	}
-	if settleFromRecords(p, tier, recorded) {
-		return true, nil
-	}
 	// Asked: wait for every build.
 	var latest time.Time
 	for _, m := range tier {
@@ -585,8 +515,7 @@ func planFailedBuild(ctx context.Context, open *stores, result link.BuildResult)
 	}
 	for _, e := range entries {
 		if repositoryMatches(e.Source.Repository, result.Repository) && e.Source.Path == result.Path {
-			asked, _ := link.BuildAskedAt(result.ID)
-			planBuilt(ctx, open, e.Manifest.Module, result.Commit, result.Failed, asked)
+			planBuilt(ctx, open, e.Manifest.Module, result.Commit, result.Failed)
 			return
 		}
 	}
@@ -703,19 +632,6 @@ func plansCommand(ctx context.Context, args []string) error {
 		}
 		p.State = inventory.PlanFailed
 		p.Note = "stopped by hand at tier " + fmt.Sprint(p.Tier)
-		release, err := inv.HoldPlans(ctx, true)
-		if err != nil {
-			return err
-		}
-		defer release()
-		if p, err = inv.PlanByID(ctx, positionals[1]); err != nil {
-			return err
-		}
-		if !p.Open() {
-			return fmt.Errorf("%s is already %s", p.ID, p.State)
-		}
-		p.State = inventory.PlanFailed
-		p.Note = "stopped by hand at tier " + fmt.Sprint(p.Tier)
 		if err := inv.SavePlan(ctx, p); err != nil {
 			return err
 		}
@@ -824,52 +740,3 @@ func splitList(s string) []string {
 	}
 	return out
 }
-
-// settleFromRecords marks every module of the tier still `asked` built — or failed — from a build
-// recorded after it was asked, and says whether it changed anything (novox/hq 04-ISSUES/214).
-// Newest first, as Builds answers: the first record after the ask is the outcome of that ask.
-func settleFromRecords(p *inventory.Plan, tier []string, recorded map[string][]inventory.Build) bool {
-	changed := false
-	for _, m := range tier {
-		s := p.Modules[m]
-		if s == nil || s.State != "asked" || s.AskedAt == nil {
-			continue
-		}
-		var outcome *inventory.Build
-		for i := range recorded[m] {
-			b := recorded[m][i]
-			if b.At.Before(*s.AskedAt) {
-				break
-			}
-			// Recorded after the ask and asked before it: an earlier ask's late outcome, not this
-			// one's (novox/hq 04-ISSUES/219).
-			if askedBefore(b.Asked, s.AskedAt) {
-				continue
-			}
-			outcome = &b
-		}
-		if outcome == nil {
-			continue
-		}
-		at := outcome.At
-		if outcome.Worked() {
-			s.State = "built"
-			s.BuiltAt = &at
-			s.Commit = outcome.Commit
-		} else {
-			s.State = "failed"
-			s.Why = outcome.Failed
-			p.State = inventory.PlanFailed
-			p.Note = fmt.Sprintf("%s failed to build in tier %d", m, p.Tier)
-		}
-		fmt.Printf("%s: %s settled from the build records as %s (%s)\n", p.ID, m, s.State, outcome.ID)
-		changed = true
-	}
-	return changed
-}
-
-// askedBefore is whether a build asked at asked was asked before a plan asked for its module — and
-// so is not that plan's outcome (novox/hq 04-ISSUES/219). False when either time is not known.
-func askedBefore(asked time.Time, planAsked *time.Time) bool {
-	return !asked.IsZero() && planAsked != nil && asked.Before(*planAsked)
-}

cmd/mesh-controller/release_plan_test.go

@@ -115,69 +115,3 @@ func TestACycleIsOneLastTierAndSaidSo(t *testing.T) {
 		t.Fatalf("a cycle should be one tier of two, said: %v", tiers)
 	}
 }
-
-// novox/hq 04-ISSUES/211: a merge moving the toolchain and a bundle compiled in it builds the
-// bundle a tier after the toolchain, not beside it.
-func TestABundleIsPlannedAfterTheToolchainItIsCompiledIn(t *testing.T) {
-	edges := []inventory.Edge{{From: "node-tools", To: "mesh-tools", Kind: inventory.EdgeStandsOn}}
-	p := planOfMerge(link.SourceMoved{Owner: "novox", Repo: "mesh-tools", Commit: "abc"},
-		[]string{"mesh-tools", "node-tools"}, edges)
-	if len(p.Tiers) != 2 || p.Tiers[0][0] != "mesh-tools" || p.Tiers[1][0] != "node-tools" {
-		t.Fatalf("the toolchain, then the bundle: %v", p.Tiers)
-	}
-}
-
-// novox/hq 04-ISSUES/214: a plan whose build outcome was recorded while no controller followed it —
-// the controller rebuilding itself — settles from the build records instead of waiting for ever.
-func TestAPlanSettlesAnAskedBuildFromTheRecords(t *testing.T) {
-	asked := time.Date(2026, 10, 3, 19, 20, 0, 0, time.UTC)
-	p := inventory.Plan{ID: "plan-1", Tiers: [][]string{{"mesh-controller", "builder"}, {"route-proxy"}},
-		Modules: map[string]*inventory.PlanModule{
-			"mesh-controller": {State: "asked", AskedAt: &asked},
-			"builder":         {State: "asked", AskedAt: &asked},
-		}}
-	records := map[string][]inventory.Build{
-		// Newest first, as Builds answers: the build after the ask is the outcome.
-		"mesh-controller": {
-			{ID: "build-2", Commit: "2ebbb799", At: asked.Add(4 * time.Minute)},
-			{ID: "build-1", Commit: "06ea2168", At: asked.Add(-10 * time.Minute)},
-		},
-		// Only a build from before the ask: not this ask's outcome.
-		"builder": {{ID: "build-0", Commit: "06ea2168", At: asked.Add(-time.Hour)}},
-	}
-	if !settleFromRecords(&p, p.Tiers[0], records) {
-		t.Fatal("nothing settled, though the controller's build is recorded after the ask")
-	}
-	if s := p.Modules["mesh-controller"]; s.State != "built" || s.Commit != "2ebbb799" || s.BuiltAt == nil {
-		t.Errorf("the controller's ask is %+v, want built from 2ebbb799", s)
-	}
-	if s := p.Modules["builder"]; s.State != "asked" {
-		t.Errorf("an ask with no record after it was settled: %+v", s)
-	}
-
-	// novox/hq 04-ISSUES/219: a build recorded after the ask but asked before it — an earlier
-	// plan's late outcome — is not this ask's, built or failed.
-	r := inventory.Plan{ID: "plan-3", Tiers: [][]string{{"postgres"}},
-		Modules: map[string]*inventory.PlanModule{"postgres": {State: "asked", AskedAt: &asked}}}
-	late := map[string][]inventory.Build{"postgres": {
-		{ID: "build-old", Commit: "efff5415", Asked: asked.Add(-18 * time.Minute), At: asked.Add(12 * time.Minute)},
-	}}
-	if settleFromRecords(&r, r.Tiers[0], late) || r.Modules["postgres"].State != "asked" {
-		t.Errorf("an earlier ask's late outcome settled this ask: %+v", r.Modules["postgres"])
-	}
-	// Newest heard first: the earlier ask's late outcome, then this ask's own, heard before it.
-	late["postgres"] = append(late["postgres"], inventory.Build{ID: "build-mine", Commit: "4bcd5f73",
-		Asked: asked.Add(time.Second), At: asked.Add(5 * time.Minute)})
-	if !settleFromRecords(&r, r.Tiers[0], late) || r.Modules["postgres"].State != "built" ||
-		r.Modules["postgres"].Commit != "4bcd5f73" {
-		t.Errorf("this ask's own outcome, heard before the earlier ask's, did not settle it: %+v", r.Modules["postgres"])
-	}
-
-	// A failure recorded after the ask fails the plan, as hearing it would have.
-	q := inventory.Plan{ID: "plan-2", Tiers: [][]string{{"x"}},
-		Modules: map[string]*inventory.PlanModule{"x": {State: "asked", AskedAt: &asked}}}
-	settleFromRecords(&q, q.Tiers[0], map[string][]inventory.Build{"x": {{ID: "b", Failed: "no", At: asked.Add(time.Minute)}}})
-	if q.State != inventory.PlanFailed || q.Modules["x"].State != "failed" {
-		t.Errorf("a recorded failure did not fail the plan: %+v %+v", q, q.Modules["x"])
-	}
-}

cmd/mesh-controller/rollout.go

@@ -346,9 +346,7 @@ func rolloutMint(ctx context.Context, again bool) error {
 			}
 			machines++
 
-		case broker.KindModule, broker.KindNodeTools:
-			// The runtime is minted and delivered exactly as a module is (novox/hq ADR 0175): it is
-			// issued as the module it stands for, to that module's `broker` secret.
+		case broker.KindModule:
 			if p.Module == "mesh-controller" {
 				// The control plane is a module too, and its `broker` secret is the old bus's
 				// credential it is still using while this runs. Writing the new bus's blob there
@@ -367,7 +365,7 @@ func rolloutMint(ctx context.Context, again bool) error {
 				skipped++
 				continue
 			}
-			password, err := inv.MintBusPassword(ctx, inventory.BusUser{Username: p.Username(), Kind: busKindOf(p.Module), Node: p.Node, Module: p.Module})
+			password, err := inv.MintBusPassword(ctx, inventory.BusUser{Username: p.Username(), Kind: inventory.BusModule, Node: p.Node, Module: p.Module})
 			if err != nil {
 				return err
 			}

cmd/mesh-controller/roster_failure_test.go

@@ -2,12 +2,13 @@ package main
 
 import (
 	"context"
+	"strings"
 	"testing"
 )
 
 // A node's own set failing to compose, and the mesh being unable to answer at all, are different
 // things, and only the first may be passed over when something is gathered across every machine
-// (novox/hq 04-ISSUES/152). These pin that distinction where the gatherers rely on it.
+// (novox/hq 04-ISSUES/152). These pin that distinction where the three gatherers rely on it.
 
 func TestASetThatDoesNotComposeIsMarkedAsTheNodesOwnProblem(t *testing.T) {
 	open := aMesh(t)
@@ -44,3 +45,55 @@ func TestAStoreThatCannotBeReadIsNotANodeThatDoesNotCompose(t *testing.T) {
 		t.Fatalf("a question the mesh could not answer was read as a node that runs nothing: %v", err)
 	}
 }
+
+func TestOneIncoherentNodeDoesNotCostTheRestTheirNames(t *testing.T) {
+	open := aMesh(t)
+	one, two := rivals()
+	register(t, open, one)
+	register(t, open, two)
+	for _, m := range []string{one.Module, two.Module} {
+		if _, err := open.inventory.Assign(t.Context(), "laptop", m); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	// laptop cannot compose. That is laptop's problem and nobody else's: the roster is still
+	// answerable, and anchor keeps whatever it serves.
+	if _, err := routeNamesInTheMesh(t.Context(), open); err != nil {
+		t.Fatalf("one node's broken set cost the whole mesh its roster: %v", err)
+	}
+}
+
+func TestARosterIsNeverReturnedWithNamesItCouldNotRead(t *testing.T) {
+	open := aMesh(t)
+
+	stopped, cancel := context.WithCancel(t.Context())
+	cancel()
+
+	names, err := routeNamesInTheMesh(stopped, open)
+	if err == nil {
+		t.Fatalf("a roster was composed from a store that could not be read: %v", names)
+	}
+	// The failure must be raised, not turned into an absence. A roster missing a machine's names
+	// is indistinguishable, on every machine that receives it, from the operator withdrawing them —
+	// and because the roster is part of every container's identity, it replaces all of them.
+	if names != nil {
+		t.Fatalf("a partial roster was returned beside the error: %v", names)
+	}
+}
+
+// Kept so the reason survives the next person reading it: the message the gatherer raises must say
+// which machine could not be read, or the operator is left with a mesh-wide failure and no name.
+func TestTheRaisedFailureNamesTheMachineItCouldNotRead(t *testing.T) {
+	open := aMesh(t)
+	stopped, cancel := context.WithCancel(t.Context())
+	cancel()
+
+	_, err := routeNamesInTheMesh(stopped, open)
+	if err == nil {
+		t.Fatal("no failure was raised")
+	}
+	if !strings.Contains(err.Error(), "cannot be read") {
+		t.Fatalf("the failure does not say the mesh could not be read: %v", err)
+	}
+}

cmd/mesh-controller/seat_dependencies_test.go

@@ -1,149 +0,0 @@
-package main
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/catalogue"
-)
-
-// Defends novox/hq ADR 0207 at the controller's acts: `assign` refuses a module whose resources a
-// seat nothing on the node holds applies, `unassign` refuses taking the last holder from under its
-// dependents, and `status` reports what composition does not yet refuse.
-
-func serviceManagerHolder() catalogue.Manifest {
-	return catalogue.Manifest{Module: "systemd", Version: "1",
-		Claims: []catalogue.Claim{{Name: catalogue.ServiceManagerSeat, Scope: catalogue.ScopeNode,
-			Serves: []string{"units", "status", "start", "stop", "restart", "enable", "disable", "journal"}}},
-		Resources: []map[string]any{{"id": "systemd", "type": "package", "package": "systemd"}}}
-}
-
-func packageManagerHolder() catalogue.Manifest {
-	return catalogue.Manifest{Module: "pacman", Version: "1",
-		Claims:    []catalogue.Claim{{Name: catalogue.PackageManagerSeat, Scope: catalogue.ScopeNode}},
-		Resources: []map[string]any{{"id": "refresh", "type": "service", "unit": "pacman-refresh.timer"}}}
-}
-
-func aDaemon() catalogue.Manifest {
-	return catalogue.Manifest{Module: "sshd", Version: "1",
-		Resources: []map[string]any{{"id": "sshd", "type": "service", "unit": "sshd.service"}}}
-}
-
-func TestAnAssignmentWithoutItsHolderIsRefusedAndNotKept(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	register(t, open, serviceManagerHolder())
-	register(t, open, packageManagerHolder())
-	register(t, open, aDaemon())
-
-	_, err := assign(ctx, open, "laptop", "sshd")
-	if err == nil {
-		t.Fatal("sshd went onto a machine nothing holds the service manager of")
-	}
-	for _, want := range []string{catalogue.ServiceManagerSeat, "systemd", "ADR 0207"} {
-		if !strings.Contains(err.Error(), want) {
-			t.Errorf("the refusal does not say %q:\n%v", want, err)
-		}
-	}
-	assigned, err := open.inventory.Assigned(ctx, "laptop")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if contains(assigned, "sshd") {
-		t.Fatalf("a refused assignment was kept: %v", assigned)
-	}
-
-	// The holders depend on each other, so neither goes on alone — and both go on in one act.
-	if _, err := assign(ctx, open, "laptop", "systemd"); err == nil {
-		t.Fatal("systemd went on alone though its package needs a package manager")
-	}
-	if said, err := assign(ctx, open, "laptop", "systemd", "pacman"); err != nil {
-		t.Fatalf("the two holders assigned together were refused: %v\n%s", err, said)
-	}
-	if said, err := assign(ctx, open, "laptop", "sshd"); err != nil {
-		t.Fatalf("sshd beside its holder was refused: %v\n%s", err, said)
-	}
-}
-
-func TestTheControllerSeatsAssignTakesSeveralModulesAsOneAct(t *testing.T) {
-	argv, err := argvFor("assign", map[string]any{"node": "laptop", "module": "systemd, pacman"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if strings.Join(argv, " ") != "assign laptop systemd pacman" {
-		t.Errorf("the seat's assign became %v", argv)
-	}
-}
-
-func TestUnassigningTheLastHolderUnderItsDependentsIsRefused(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	register(t, open, serviceManagerHolder())
-	register(t, open, packageManagerHolder())
-	register(t, open, aDaemon())
-	if _, err := assign(ctx, open, "laptop", "systemd", "pacman", "sshd"); err != nil {
-		t.Fatal(err)
-	}
-
-	_, err := unassign(ctx, open, "laptop", "systemd")
-	if err == nil {
-		t.Fatal("the service manager came off a machine still running services")
-	}
-	for _, want := range []string{catalogue.ServiceManagerSeat, "sshd", "pacman"} {
-		if !strings.Contains(err.Error(), want) {
-			t.Errorf("the refusal does not name %q:\n%v", want, err)
-		}
-	}
-	assigned, _ := open.inventory.Assigned(ctx, "laptop")
-	if !contains(assigned, "systemd") {
-		t.Fatalf("a refused unassignment took the module off anyway: %v", assigned)
-	}
-	if _, err := unassign(ctx, open, "laptop", "sshd"); err != nil {
-		t.Fatalf("a dependent could not come off: %v", err)
-	}
-}
-
-func TestStatusReportsAnUnheldDependencyWithoutRefusingTheMachine(t *testing.T) {
-	// The mesh as it ran before the switch (novox/hq ADR 0207 §4).
-	defer catalogue.EnforcingSeatDependencies(false)()
-	open := aMesh(t)
-	ctx := t.Context()
-	register(t, open, serviceManagerHolder())
-	register(t, open, aDaemon())
-	// Assigned straight into the store: a machine whose modules predate the rule, which is every
-	// machine on the day it ships.
-	if _, err := open.inventory.Assign(ctx, "laptop", "sshd"); err != nil {
-		t.Fatal(err)
-	}
-
-	asked, err := theThreeQuestions(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, refused := asked.refused["laptop"]; refused {
-		t.Fatalf("an unmet dependency refused the machine before the switch: %s", asked.refused["laptop"])
-	}
-	if asked.well() {
-		t.Error("a mesh with an unheld dependency reads as all well")
-	}
-	got := printed(t, func() error { return printStatus(asked) })
-	for _, want := range []string{"unheld", "laptop", "sshd", catalogue.ServiceManagerSeat, "systemd"} {
-		if !strings.Contains(got, want) {
-			t.Errorf("status does not say %q:\n%s", want, got)
-		}
-	}
-	body, err := statusAsJSON(asked)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var doc struct {
-		Unheld []catalogue.Unheld `json:"unheld"`
-	}
-	if err := json.Unmarshal(body, &doc); err != nil {
-		t.Fatal(err)
-	}
-	if len(doc.Unheld) != 1 || doc.Unheld[0].Module != "sshd" || doc.Unheld[0].Seat != catalogue.ServiceManagerSeat {
-		t.Errorf("the document's unheld is %+v", doc.Unheld)
-	}
-}

cmd/mesh-controller/seatverbs.go

@@ -6,10 +6,8 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"github.com/nats-io/nats.go/micro"
 	"os"
 	"os/exec"
-	"sort"
 	"strings"
 
 	"github.com/novox/mesh-controller/internal/catalogue"
@@ -68,14 +66,14 @@ func argvFor(verb string, args map[string]any) ([]string, error) {
 	case "status":
 		return []string{"status", "--json"}, nil
 	case "nodes":
-		return []string{"node", "list", "--json"}, nil
+		return []string{"node", "list"}, nil
 	case "node":
 		if err := need("node"); err != nil {
 			return nil, err
 		}
 		return []string{"node", "show", str("node")}, nil
 	case "modules":
-		return []string{"module", "list", "--json"}, nil
+		return []string{"module", "list"}, nil
 	case "seats":
 		return []string{"seats", "--json"}, nil
 	case "builds":
@@ -113,9 +111,7 @@ func argvFor(verb string, args map[string]any) ([]string, error) {
 		if err := need("node", "module"); err != nil {
 			return nil, err
 		}
-		// Several modules comma-separated, judged as one act (novox/hq ADR 0207): the holders of
-		// the seats that apply resources depend on each other and go on together.
-		return append([]string{verb, str("node")}, splitModules(str("module"))...), nil
+		return []string{verb, str("node"), str("module")}, nil
 	case "pin":
 		if err := need("node", "provision", "from", "module"); err != nil {
 			return nil, err
@@ -383,46 +379,3 @@ func splitCommandLine(line string) ([]string, error) {
 	}
 	return words, nil
 }
-
-// seatAnnouncement is what the controller says it serves on the bus (novox/hq ADR 0197): the
-// mesh-controller seat, one endpoint per verb it answers, each with the seat's own description and
-// argument schema — the same facts `tools` answers from the records, as NATS's services format.
-func seatAnnouncement(handlers map[string]link.ToolHandler) micro.Info {
-	about := map[string]catalogue.Verb{}
-	for _, s := range catalogue.SeatsWithAProtocol() {
-		if s.Name == catalogue.ControllerSeatName {
-			for _, v := range s.Serves {
-				about[v.Name] = v
-			}
-		}
-	}
-	verbs := make([]string, 0, len(handlers))
-	for verb := range handlers {
-		verbs = append(verbs, verb)
-	}
-	sort.Strings(verbs)
-	var endpoints []micro.EndpointInfo
-	for _, verb := range verbs {
-		schema, _ := json.Marshal(about[verb].Input)
-		// The same shape every tool runtime announces in (node-tools' announce package): the name is
-		// `<seat>__<verb>`, as the protocol's characters allow; the metadata is what identifies it.
-		endpoints = append(endpoints, micro.EndpointInfo{
-			Name:       catalogue.ControllerSeatName + "__" + verb,
-			Subject:    link.SeatToolSubject(catalogue.ControllerSeatName, verb),
-			QueueGroup: "seat." + catalogue.ControllerSeatName,
-			Metadata: map[string]string{
-				"kind": "seat", "module": catalogue.ControllerSeatName, "tool": verb,
-				"seat": catalogue.ControllerSeatName, "scope": "mesh", "interchangeable": "false",
-				"description": about[verb].Description, "schema": string(schema),
-			},
-		})
-	}
-	return micro.Info{
-		ServiceIdentity: micro.ServiceIdentity{
-			Name: catalogue.ControllerSeatName, ID: "controller", Version: "0.1.0",
-			Metadata: map[string]string{"seat": catalogue.ControllerSeatName, "scope": "mesh"},
-		},
-		Description: "the mesh's own verbs, answered by the holder of the mesh-controller seat",
-		Endpoints:   endpoints,
-	}
-}

cmd/mesh-controller/seatverbs_test.go

@@ -2,8 +2,6 @@ package main
 
 import (
 	"context"
-	"fmt"
-	"github.com/novox/mesh-controller/internal/link"
 	"strings"
 	"testing"
 
@@ -251,48 +249,3 @@ func TestARowAheadOfThisBuildIsServedAnyway(t *testing.T) {
 		}
 	}
 }
-
-// novox/hq ADR 0195: the console's discovery reads the machines and the modules; they answer as JSON,
-// as status and seats do, so nothing parses a printed column.
-func TestTheNodesAndModulesVerbsAnswerAsJSON(t *testing.T) {
-	for verb, want := range map[string]string{"nodes": "[node list --json]", "modules": "[module list --json]"} {
-		argv, err := argvFor(verb, map[string]any{})
-		if err != nil {
-			t.Fatal(err)
-		}
-		if fmt.Sprint(argv) != want {
-			t.Errorf("%s runs %v, want %s", verb, argv, want)
-		}
-	}
-}
-
-// novox/hq ADR 0197: the controller announces exactly the verbs it serves, each on the subject and
-// queue it serves it on, with the seat's own description and schema, in NATS's services format.
-func TestTheControllerAnnouncesTheVerbsItServes(t *testing.T) {
-	handlers, _, err := seatToolHandlers()
-	if err != nil {
-		t.Fatal(err)
-	}
-	info := seatAnnouncement(handlers)
-	if info.Name != catalogue.ControllerSeatName || info.ID == "" || info.Version == "" {
-		t.Fatalf("the service is not named for the seat: %+v", info.ServiceIdentity)
-	}
-	if len(info.Endpoints) != len(handlers) {
-		t.Fatalf("%d endpoints announced for %d verbs served", len(info.Endpoints), len(handlers))
-	}
-	for _, e := range info.Endpoints {
-		verb := e.Metadata["tool"]
-		if _, served := handlers[verb]; !served || e.Name != catalogue.ControllerSeatName+"__"+verb {
-			t.Errorf("%s (%s) is announced and not served under that name", e.Name, verb)
-		}
-		if e.Metadata["kind"] != "seat" || e.Metadata["seat"] != catalogue.ControllerSeatName {
-			t.Errorf("%s is not announced as the seat's verb: %v", e.Name, e.Metadata)
-		}
-		if e.Subject != link.SeatToolSubject(catalogue.ControllerSeatName, verb) || e.QueueGroup != "seat."+catalogue.ControllerSeatName {
-			t.Errorf("%s is announced on %s/%s, not where it is served", e.Name, e.Subject, e.QueueGroup)
-		}
-		if e.Metadata["description"] == "" || e.Metadata["schema"] == "" || e.Metadata["scope"] != "mesh" {
-			t.Errorf("%s is announced without its description, schema or scope: %v", e.Name, e.Metadata)
-		}
-	}
-}

cmd/mesh-controller/status.go

@@ -282,22 +282,6 @@ func printStatus(asked answers) error {
 		fmt.Printf("\n  `take <node> <module>` compares what runs against what it declares, and runs it\n\n")
 	}
 
-	if len(asked.unheld) > 0 {
-		// **Reported, and not refused yet** (novox/hq ADR 0207 §4). Each machine still resolves and
-		// is sent what it would be; this says which of its modules depend on a seat nothing there
-		// holds, until every machine has its holders and the switch makes it a refusal.
-		fmt.Printf("%d module dependenc(ies) on a seat nothing on the machine holds (unheld, ADR 0207):\n",
-			len(asked.unheld))
-		for _, u := range asked.unheld {
-			holders := "no module in the catalogue claims it yet"
-			if len(u.Holders) > 0 {
-				holders = "could be held by " + strings.Join(u.Holders, ", ")
-			}
-			fmt.Printf("  %-12s %-24s %-24s %s\n", u.Node, u.Module, u.Seat, holders)
-		}
-		fmt.Printf("\n  `assign <node> <holder>` meets it; reported until every machine has its holders, then refused\n\n")
-	}
-
 	if adopted := adoptedNodes(nodes); len(adopted) > 0 {
 		// Said, because nothing forces the flip: a node left adopted is visible here rather than
 		// read as converged (novox/hq ADR 0100). Not a fault, so it does not break "all well".
@@ -402,20 +386,6 @@ func theThreeQuestions(ctx context.Context, open *stores) (answers, error) {
 	if err != nil {
 		return answers{}, err
 	}
-	// And which machines run a module whose resources a seat nothing there holds applies (novox/hq
-	// ADR 0207). Each machine resolved again rather than threaded through whoResolves, whose answer
-	// the private network is built from and should say nothing else; a machine that does not
-	// resolve is already in refused, and is passed over here.
-	for _, n := range out.nodes {
-		plan, _, err := planFor(ctx, open, n.Name)
-		if err != nil {
-			if unresolvable(err) {
-				continue
-			}
-			return answers{}, err
-		}
-		out.unheld = append(out.unheld, plan.Unheld...)
-	}
 	out.plans, err = inv.RecentPlans(ctx, 5)
 	if err != nil {
 		return answers{}, err
@@ -526,7 +496,7 @@ func untakenModules(ctx context.Context, inv *inventory.Inventory, nodes []inven
 func (a answers) well() bool {
 	return len(a.wrong) == 0 && len(a.quiet) == 0 && len(a.behind) == 0 &&
 		len(a.waiting) == 0 && len(a.refused) == 0 && a.network == "" && len(a.untaken) == 0 &&
-		len(a.filtered) == 0 && len(a.unheld) == 0
+		len(a.filtered) == 0
 }
 
 // hostSplit is which machines report which host version, for every version more than one machine

cmd/mesh-controller/unheld_report_test.go

@@ -1,108 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"os"
-	"strings"
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/catalogue"
-)
-
-// An act says what it changed about the node it acted on, and nothing about the rest of the mesh
-// (novox/hq ADR 0207): after the seat dependencies shipped, every `push <node>` and `assign` printed
-// every node's unmet dependencies, a hundred lines around the one about the module just assigned.
-
-func aContainer(name string) catalogue.Manifest {
-	return catalogue.Manifest{Module: name, Version: "1",
-		Resources: []map[string]any{{"id": name, "type": "container", "image": name}}}
-}
-
-func TestAnAssignmentSaysOnlyWhatItChangedOnItsOwnNode(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	register(t, open, aContainer("web"))
-	register(t, open, aContainer("db"))
-	// anchor already lacks a runtime for db: true, and not this act's to say.
-	if _, err := open.inventory.Assign(ctx, "anchor", "db"); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := open.inventory.Assign(ctx, "laptop", "db"); err != nil {
-		t.Fatal(err)
-	}
-	said, err := assign(ctx, open, "laptop", "web")
-	if err != nil {
-		t.Fatalf("%v\n%s", err, said)
-	}
-	if !strings.Contains(said, "web on laptop depends on "+catalogue.ContainerRuntimeSeat) {
-		t.Errorf("the assignment does not say what the module it assigned depends on:\n%s", said)
-	}
-	for _, not := range []string{"db on laptop", "db on anchor", "anchor:"} {
-		if strings.Contains(said, not) {
-			t.Errorf("the assignment says %q, which it did not change:\n%s", not, said)
-		}
-	}
-}
-
-func TestAnAssignmentThatMeetsADependencySaysSo(t *testing.T) {
-	shelf := map[string]catalogue.Manifest{
-		"web": aContainer("web"),
-		"docker": {Module: "docker", Claims: []catalogue.Claim{{Name: catalogue.ContainerRuntimeSeat}},
-			Resources: []map[string]any{{"id": "d", "type": "container", "image": "dind"}}},
-	}
-	lines := unheldChange(shelf, "laptop", []string{"web"}, []string{"web", "docker"})
-	if len(lines) != 1 || !strings.Contains(lines[0], "web on laptop now has "+catalogue.ContainerRuntimeSeat+" held") {
-		t.Errorf("meeting a dependency said %v", lines)
-	}
-	// Taking the dependent off says nothing: the dependency went with its module.
-	if lines := unheldChange(shelf, "laptop", []string{"web"}, nil); len(lines) != 0 {
-		t.Errorf("unassigning the dependent said %v", lines)
-	}
-}
-
-func TestAPushSaysANamedNodesDependenciesAndCountsTheRest(t *testing.T) {
-	unheld := map[string][]catalogue.Unheld{
-		"anchor": {{Node: "anchor", Module: "db", Seat: catalogue.ContainerRuntimeSeat}},
-		"laptop": {{Node: "laptop", Module: "web", Seat: catalogue.ContainerRuntimeSeat},
-			{Node: "laptop", Module: "sshd", Seat: catalogue.ServiceManagerSeat}},
-	}
-	var named bytes.Buffer
-	reportUnheldPushed(&named, true, []string{"laptop"}, unheld)
-	got := named.String()
-	if !strings.Contains(got, "laptop has 2 unmet") || !strings.Contains(got, "web on laptop") ||
-		!strings.Contains(got, "sshd on laptop") || strings.Contains(got, "anchor") {
-		t.Errorf("a named push said:\n%s", got)
-	}
-	var all bytes.Buffer
-	reportUnheldPushed(&all, false, []string{"anchor", "laptop", "quiet"}, unheld)
-	want := "anchor: 1 unmet seat dependenc(ies) — see `status`\nlaptop: 2 unmet seat dependenc(ies) — see `status`\n"
-	if all.String() != want {
-		t.Errorf("a push to every node said:\n%s\nwant\n%s", all.String(), want)
-	}
-}
-
-func TestOnlyTheServingControllerLogsEachChange(t *testing.T) {
-	read := func(f func()) string {
-		old := os.Stderr
-		r, w, _ := os.Pipe()
-		os.Stderr = w
-		f()
-		_ = w.Close()
-		os.Stderr = old
-		var b bytes.Buffer
-		_, _ = b.ReadFrom(r)
-		return b.String()
-	}
-	u := []catalogue.Unheld{{Node: "n1", Module: "web", Seat: catalogue.ContainerRuntimeSeat}}
-	if got := read(func() { logUnheld("n1", u) }); got != "" {
-		t.Errorf("a command logged:\n%s", got)
-	}
-	logUnheldChanges = true
-	defer func() { logUnheldChanges = false }()
-	if got := read(func() { logUnheld("n1", u) }); !strings.Contains(got, "web on n1") {
-		t.Errorf("the serving controller did not log a change:\n%s", got)
-	}
-	if got := read(func() { logUnheld("n1", u) }); got != "" {
-		t.Errorf("an unchanged report was logged again:\n%s", got)
-	}
-}

cmd/mesh-controller/upgrades.go

@@ -5,7 +5,6 @@ import (
 	"errors"
 	"flag"
 	"fmt"
-	"regexp"
 	"strings"
 	"time"
 
@@ -284,14 +283,6 @@ func (f following) SourceMoved(ctx context.Context, m link.SourceMoved) error {
 	if isHistory(m.MergedAt, lastLookAt(entries, m)) {
 		packaging = nil
 	}
-	// Said, never silent (novox/hq 04-ISSUES/215): a module built from this repository that follows
-	// another branch is not part of this merge, and whoever is waiting for its change should read why.
-	for _, e := range entries {
-		if sameRepository(e.Source.Repository, m) && !sourceIs(e.Source, m) {
-			fmt.Printf("  %s is built from %s/%s and follows %s, not %s; this merge leaves it out\n",
-				e.Manifest.Module, m.Owner, m.Repo, e.Source.Ref, m.Base)
-		}
-	}
 	touched := whatTheMergeTouched(from, entries, m)
 	for _, e := range touched {
 		if err := inv.SourceMoved(ctx, e.Manifest.Module, m.Commit); err != nil {
@@ -315,13 +306,6 @@ func (f following) SourceMoved(ctx context.Context, m link.SourceMoved) error {
 	for _, e := range moved {
 		movedNames = append(movedNames, e.Manifest.Module)
 	}
-	// Written and its first tier asked as one act on the plans (novox/hq issue 213): a timer on
-	// another controller reading it between the two would ask the tier again.
-	release, err := inv.HoldPlans(ctx, true)
-	if err != nil {
-		return notNow(err)
-	}
-	defer release()
 	plan := planOfMerge(m, movedNames, edges)
 	if hasCycle(plan.Tiers, edges) {
 		fmt.Printf("  the last tier depends on itself: %s — built together, in no order\n",
@@ -361,24 +345,7 @@ func sourceIs(s inventory.Source, m link.SourceMoved) bool {
 	if !sameRepository(s.Repository, m) {
 		return false
 	}
-	ref := followedBranch(s.Ref)
-	return ref == "" || ref == m.Base
-}
-
-// commitRef is a ref that names a commit rather than a branch: what `build --ref <commit>` asks for.
-var commitRef = regexp.MustCompile(`^[0-9a-f]{7,40}$`)
-
-// followedBranch is the branch a recorded ref means a module follows (novox/hq 04-ISSUES/215). **A
-// commit is never a branch to follow.** A build asked at a commit — to try one, or to pin it during a
-// fix — recorded that commit as the module's ref; every merge after it then failed to match the
-// module, its plan left it out without saying so, and every plan that rebuilt it asked for that same
-// old commit again. A commit recorded so is read as the repository's default branch, which is what
-// the module followed before it; a branch is followed as named.
-func followedBranch(ref string) string {
-	if commitRef.MatchString(strings.TrimSpace(ref)) {
-		return ""
-	}
-	return ref
+	return s.Ref == "" || s.Ref == m.Base
 }
 
 // sameRepository is whether a recorded repository is the one a merge names, in either spelling it

cmd/mesh-controller/worker_order_test.go

@@ -1,45 +0,0 @@
-package main
-
-import (
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// The holder of the build seat follows the controller that defines its worker (novox/hq issue 206).
-// On 2026-10-03 a plan put the build machine in tier 0 and the controller in tier 1; the new build
-// machine could not bind the worker the old controller had defined, and nothing could build the
-// controller that would have redefined it. The built-by edge from the controller to its build
-// machine yields to that order: the controller is built by whichever build machine is running.
-func TestTheBuildSeatsHolderFollowsTheControllerThatDefinesItsWorker(t *testing.T) {
-	edges := []inventory.Edge{
-		{From: "build-agent", To: "mesh-controller", Kind: inventory.EdgePackages},
-		{From: "build-agent", To: "mesh-controller", Kind: inventory.EdgeWorkerOf},
-		{From: "mesh-controller", To: "build-agent", Kind: inventory.EdgeBuiltBy},
-		{From: "route-proxy", To: "mesh-controller", Kind: inventory.EdgePackages},
-		{From: "route-proxy", To: "build-agent", Kind: inventory.EdgeBuiltBy},
-	}
-	set := reachableFrom([]string{"mesh-controller"}, edges)
-	if len(set) != 3 {
-		t.Fatalf("the controller, what packages it, and nothing more: %v", set)
-	}
-	tiers := tiersOf(set, edges)
-	pos := map[string]int{}
-	for i, tier := range tiers {
-		for _, m := range tier {
-			pos[m] = i
-		}
-	}
-	if pos["mesh-controller"] != 0 {
-		t.Fatalf("the controller first, built by the build machine that is running: %v", tiers)
-	}
-	if pos["build-agent"] <= pos["mesh-controller"] {
-		t.Fatalf("the build machine after the controller that defines its worker: %v", tiers)
-	}
-	if pos["route-proxy"] <= pos["build-agent"] {
-		t.Fatalf("what the build machine builds comes after it: %v", tiers)
-	}
-	if hasCycle(tiers, edges) {
-		t.Fatalf("no cycle here: %v", tiers)
-	}
-}

examples/route-proxy/forwarded_test.go

@@ -1,29 +0,0 @@
-package main
-
-import (
-	"crypto/tls"
-	"net/http"
-	"net/http/httptest"
-	"net/url"
-	"testing"
-)
-
-// A backend behind the proxy learns the client used TLS and which name it asked for, so the addresses
-// it writes into its own pages are the ones a client can use (2026-10-03: a forge's Go import tag
-// named an http clone URL, and Go refused the module path).
-func TestABackendIsToldTheRequestWasHTTPSAndForWhichName(t *testing.T) {
-	var proto, host, fwdHost, fwdFor string
-	backend := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		proto, host, fwdHost, fwdFor = r.Header.Get("X-Forwarded-Proto"), r.Host, r.Header.Get("X-Forwarded-Host"), r.Header.Get("X-Forwarded-For")
-	}))
-	defer backend.Close()
-	where, _ := url.Parse(backend.URL)
-	req := httptest.NewRequest(http.MethodGet, "https://git.example.org/novox/mesh-sdk/go?go-get=1", nil)
-	req.TLS = &tls.ConnectionState{}
-	req.Host = "git.example.org"
-	req.RemoteAddr = "192.0.2.7:51000"
-	towards(where).ServeHTTP(httptest.NewRecorder(), req)
-	if proto != "https" || fwdHost != "git.example.org" || host != "git.example.org" || fwdFor != "192.0.2.7" {
-		t.Errorf("the backend was told proto=%q host=%q forwarded-host=%q for=%q", proto, host, fwdHost, fwdFor)
-	}
-}

examples/route-proxy/main.go

@@ -273,7 +273,7 @@ func (t *table) set(routes map[string][]rule, public map[string]bool) {
 				log.Printf("route %s points at %q, which is not a URL: %v", host, r.target, err)
 				continue
 			}
-			r.to = towards(where)
+			r.to = httputil.NewSingleHostReverseProxy(where)
 			if r.insecure {
 				r.to.Transport = &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}}
 			}
@@ -1060,17 +1060,3 @@ func asPort(v any) (int, bool) {
 	}
 	return 0, false
 }
-
-// towards proxies to one backend and tells it what the client asked: **X-Forwarded-Proto, -Host and
-// -For**, set from the request this proxy received. A backend that builds its own addresses — a forge
-// writing its clone URL into a page, a login redirect — otherwise sees the plain HTTP hop from this
-// proxy and writes `http://`, though every client reached it over TLS: Go refused the forge's module
-// path for exactly that on 2026-10-03, its import tag naming an http clone URL.
-// The standard library's NewSingleHostReverseProxy sets only X-Forwarded-For.
-func towards(where *url.URL) *httputil.ReverseProxy {
-	return &httputil.ReverseProxy{Rewrite: func(pr *httputil.ProxyRequest) {
-		pr.SetURL(where)
-		pr.Out.Host = pr.In.Host
-		pr.SetXForwarded()
-	}}
-}

internal/artifacts/store.go

@@ -8,7 +8,6 @@ package artifacts
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"net/http"
 	"strings"
@@ -27,15 +26,7 @@ type Store struct {
 }
 
 // Gone is the answer when the store does not hold it: the outcome wanted, already true.
-var Gone = errors.New("the store does not hold it")
-
-// ErrNotOurs is a reference this sweep will not address: not the mesh's own, or naming nothing
-// the store holds by digest.
-//
-// **A fact about the record, not about the store** (novox/hq issue 226). The two deserve opposite
-// responses — skip one and go on, abandon the sweep for the other — and collapsing them into "an
-// error" is how a cautious loop became one that did nothing while reporting the right number.
-var ErrNotOurs = errors.New("not a reference into the mesh's artifact store")
+var Gone = fmt.Errorf("the store does not hold it")
 
 // LetGo asks the store to drop one artifact the mesh recorded making.
 //
@@ -47,17 +38,12 @@ var ErrNotOurs = errors.New("not a reference into the mesh's artifact store")
 // wants the artifact absent, and it is. It is distinguished from success only so a caller can say
 // which of the two happened.
 func (s Store) LetGo(ctx context.Context, reference string) error {
-	// **Strict, and deliberately** (novox/hq issue 226). Only a reference the mesh keeps in its
-	// own vocabulary is addressed here. `Recorded` would read `docker.io/library/registry@sha256:…`
-	// as the mesh's too — it cannot tell one registry host from another — so normalising belongs
-	// where the provenance is known, which is the sweep reading its own build records, not here
-	// where the only job is to refuse anything that is not plainly ours.
 	path, kept := catalogue.InArtifactStore(reference)
 	if !kept {
 		// Nothing the mesh put in its own store. Refused rather than attempted: composing a
 		// delete for a reference of unknown shape is how a sweep reaches something that is not
-		// the mesh's. Distinguished from a store that refuses, so a sweep skips this and goes on.
-		return fmt.Errorf("%w: %s", ErrNotOurs, reference)
+		// the mesh's.
+		return fmt.Errorf("%s is not a reference into the mesh's artifact store", reference)
 	}
 	if s.Address == "" {
 		return fmt.Errorf("this mesh has no artifact store on its network to ask about %s", reference)
@@ -109,5 +95,5 @@ func split(path string) (repository, kind, digest string, err error) {
 	if before, after, ok := strings.Cut(path, "/blobs/sha256:"); ok {
 		return before, "blobs", "sha256:" + after, nil
 	}
-	return "", "", "", fmt.Errorf("%w: %q names nothing the store holds by digest", ErrNotOurs, path)
+	return "", "", "", fmt.Errorf("%q names nothing the store holds by digest", path)
 }

internal/artifacts/store_test.go

@@ -92,26 +92,3 @@ func TestAReferenceThatIsNotTheMeshsOwnIsNeverAsked(t *testing.T) {
 		t.Fatalf("the store was asked about %v", *asked)
 	}
 }
-
-// A reference this sweep will not address says so as ErrNotOurs, which is a fact about the
-// record and not about the store (novox/hq issue 226).
-//
-// The sweep skips one and abandons itself for the other, so they cannot be the same error. The
-// first live run met a reference recorded with the store's old address, read the refusal as "the
-// store refuses everything", and collected none of the 1681 it had found.
-func TestAReferenceThisSweepWillNotAddressIsToldApartFromAStoreRefusing(t *testing.T) {
-	store, asked := fakeStore(t, http.StatusAccepted)
-	for _, reference := range []string{
-		"docker.io/library/registry@sha256:abc123",
-		"127.0.0.1:5100/mesh-tools/build@sha256:abc123",
-		"1.4.2",
-	} {
-		err := store.LetGo(context.Background(), reference)
-		if !errors.Is(err, ErrNotOurs) {
-			t.Errorf("%s answered %v; a sweep must be able to skip it and go on", reference, err)
-		}
-	}
-	if len(*asked) != 0 {
-		t.Fatalf("the store was asked about %v", *asked)
-	}
-}

internal/broker/agreement_catalogue_test.go

@@ -234,13 +234,3 @@ func admitsSubject(pattern, subject []string) bool {
 	}
 	return len(pattern) == len(subject)
 }
-
-// The two packages name the runtime module separately — the broker's types stay free of the
-// catalogue's on purpose — so this is what holds them to one string. A rename that reached only one
-// side would compose a runtime principal for a module nobody assigns, silently, and leave the one
-// that is assigned with a module's own grants.
-func TestTheBrokerAndTheCatalogueAgreeOnTheRuntimeModule(t *testing.T) {
-	if RuntimeModule != catalogue.RuntimeModule {
-		t.Fatalf("the broker calls the runtime %q and the catalogue %q", RuntimeModule, catalogue.RuntimeModule)
-	}
-}

internal/broker/derived.go

@@ -144,18 +144,12 @@ func ConsumerFor(p Principal) (Consumer, bool) {
 	}, true
 }
 
-// HolderConsumerFor is the worker a seat's holders share on that seat's work queue.
+// HolderConsumerFor is the worker a seat's holder gets on that seat's work queue.
 //
-// **One worker for every holder, and each holder pulls one ask when it is idle** (novox/hq ADR
-// 0190). The seat is *authority* — who may be the telegram sender — and the worker is *delivery*,
-// kept separate so that relaxing one changes nothing about the other: a node-scoped seat has a
-// holder per machine, and all of them take from this one consumer, so the work is shared without
-// any holder knowing about the others. Pulled rather than pushed because a push consumer hands the
-// next ask to whichever subscriber the server picks, busy or not, and a pulled one is asked for by
-// a holder that has just become free. Which is also what ends the race issue 186 describes — asks
-// delivered behind the one being worked, expiring unacknowledged and dropped after the fifth
-// redelivery: nothing is delivered that nobody asked for. A long build keeps its own ask alive
-// (stillWorking); the ack wait is for a holder that died.
+// **A queue group even though the seat guarantees one holder.** The seat is *authority* — who may
+// be the telegram sender — and the queue group is *delivery*. Tie delivery to the seat and the
+// day somebody allows two holders for throughput, every message is processed twice with nothing
+// reporting it. Kept separate, relaxing one changes nothing about the other.
 func HolderConsumerFor(node, module string, seat DeclaredSeat) (Consumer, bool) {
 	if len(seat.Accepts) == 0 {
 		return Consumer{}, false
@@ -164,13 +158,18 @@ func HolderConsumerFor(node, module string, seat DeclaredSeat) (Consumer, bool)
 		Name:           "SEAT_" + upperSnake(seat.Name) + "_worker",
 		Stream:         seatStreamName(seat.Name),
 		Filters:        []string{"mesh.seat." + seat.Name + ".accept.>"},
+		Queue:          "holders",
 		AckWaitSeconds: 60,
 		MaxDeliver:     5,
-		// As many in flight as there are holders working, which pulling bounds by itself: a holder
-		// fetches one and fetches again only after it acknowledged. The server's default stands.
-		Why: fmt.Sprintf("%s on %s holds %s; every holder pulls one ask at a time from this worker "+
-			"and acknowledges after the work is done, so a crash mid-work redelivers rather than "+
-			"loses and an idle holder is the one that takes the next ask", module, node, seat.Name),
+		// **One in flight.** A holder works one ask at a time, so the server hands it one at a
+		// time: with the default of many, every ask behind the one being worked was delivered,
+		// left unacknowledged for the length of the work, redelivered after the ack wait, and
+		// after the fifth time dropped — on 2026-10-01 twenty-six of forty-three builds asked in
+		// two minutes were never built, and the queue read as empty (novox/hq issue 186).
+		MaxAckPending: 1,
+		Why: fmt.Sprintf("%s on %s holds %s; it acknowledges after the work is done, so a "+
+			"crash mid-work redelivers rather than loses; one in flight, so a queue of asks is a "+
+			"queue and not a race against the ack wait", module, node, seat.Name),
 	}, true
 }
 

internal/broker/derived_test.go

@@ -88,20 +88,15 @@ func TestAModuleThatConsumesNothingGetsNoConsumer(t *testing.T) {
 	}
 }
 
-// The seat is authority and the worker is delivery (novox/hq ADR 0190): one worker per seat, shared
-// by every holder and pulled from, so a second holder takes the next ask rather than a copy of the
-// same one — which is what a queue group used to guard, and what pulling one durable gives outright.
-func TestAHoldersWorkerIsOneSharedByItsHolders(t *testing.T) {
+// The seat is authority and the queue group is delivery. Tie them together and the day somebody
+// allows two holders, every message is processed twice with nothing reporting it.
+func TestAHoldersWorkerUsesAQueueGroupAnyway(t *testing.T) {
 	c, ok := HolderConsumerFor("one", "telegram", telegramSeat())
 	if !ok {
 		t.Fatal("the holder of a seat with inbound work got no worker")
 	}
-	two, _ := HolderConsumerFor("two", "telegram", telegramSeat())
-	if c.Name != two.Name || c.Stream != two.Stream {
-		t.Fatal("two holders got two workers, so each would process every ask")
-	}
-	if c.Push || c.Queue != "" {
-		t.Fatal("the worker is pushed, so the server would hand an ask to a busy holder")
+	if c.Queue == "" {
+		t.Fatal("the worker is not in a queue group, so a second holder would double-process")
 	}
 	if c.Stream != "SEAT_TELEGRAM_SENDER" {
 		t.Fatalf("the worker reads %q, not the seat's own stream", c.Stream)
@@ -159,23 +154,15 @@ func TestANodesDeclarationConsumerIsWhatItsOwnGrantAllows(t *testing.T) {
 	has(t, perms.Subscribe, c.Filters[0])
 }
 
-// Every holder of a seat shares one worker and pulls from it (novox/hq ADR 0190): no queue group
-// and no delivery subject, because a push consumer hands the next ask to whichever subscriber the
-// server picks, busy or not; and no cap of one in flight, because pulling bounds the asks in flight
-// by the holders that are free — which is what ended the race of issue 186, where asks delivered
-// behind the one being worked expired and were dropped.
-func TestAHoldersWorkerIsPulledByEveryHolder(t *testing.T) {
-	c, found := HolderConsumerFor("anchor", "build-agent", DeclaredSeat{Name: "node-build-agent", Accepts: []string{"build"}})
+// A holder works one ask at a time, so the server hands it one at a time (novox/hq issue 186):
+// asks queued behind the one being worked wait in the stream rather than being delivered,
+// left to expire and dropped after the fifth redelivery.
+func TestAHoldersWorkerTakesOneAskAtATime(t *testing.T) {
+	c, found := HolderConsumerFor("anchor", "builder", DeclaredSeat{Name: "mesh-build-machine", Accepts: []string{"build"}})
 	if !found {
 		t.Fatal("a seat that accepts work has no worker")
 	}
-	if c.Queue != "" || c.Push {
-		t.Fatalf("the worker is pushed (queue %q, push %v); a holder pulls when it is free", c.Queue, c.Push)
-	}
-	if c.MaxAckPending != 0 {
-		t.Fatalf("the worker caps asks in flight at %d; pulling bounds them by the holders working", c.MaxAckPending)
-	}
-	if c.Name != "SEAT_NODE_BUILD_AGENT_worker" || c.Stream != "SEAT_NODE_BUILD_AGENT" {
-		t.Fatalf("the worker is %s on %s; one per seat, shared by its holders", c.Name, c.Stream)
+	if c.MaxAckPending != 1 {
+		t.Fatalf("the worker may have %d asks in flight; one, so a queue is a queue", c.MaxAckPending)
 	}
 }

internal/broker/jetstream.go

@@ -1,7 +1,6 @@
 package broker
 
 import (
-	"context"
 	"crypto/sha256"
 	"crypto/tls"
 	"crypto/x509"
@@ -13,7 +12,6 @@ import (
 	"time"
 
 	"github.com/nats-io/nats.go"
-	"github.com/nats-io/nats.go/jetstream"
 )
 
 // The JetStream side of the controller: the one place the mesh's streams and consumers are
@@ -86,13 +84,6 @@ func pinnedTo(path string) (*tls.Config, error) {
 	return PinnedToFingerprint(want), nil
 }
 
-// OnConn is the JetStream handle over a connection the caller already holds — the control plane's
-// link — for asserting what the bus holds without dialling a second time.
-func OnConn(conn *nats.Conn) *JetStream {
-	js, _ := conn.JetStream()
-	return &JetStream{conn: conn, js: js}
-}
-
 // DialPinned is Dial with the server's certificate pinned by a fingerprint the caller already holds
 // — a module or a build machine that was handed one beside its credential, and has no file.
 func DialPinned(url, fingerprint string, opts ...nats.Option) (*JetStream, error) {
@@ -223,51 +214,6 @@ func (j *JetStream) EnsureConsumer(c Consumer) error {
 
 	switch have, err := j.js.ConsumerInfo(c.Stream, c.Name); {
 	case err == nil:
-		// **The controller owns the worker's shape, type included** (novox/hq issue 206). A holder
-		// built for a pull worker cannot bind a push one — `cannot pull subscribe to push based
-		// consumer` — and on 2026-10-03 the build machine rolled before the controller that would
-		// have redefined its worker, restarted on that for an hour, and nothing could build the
-		// controller that would have ended it. The server cannot change a consumer's type in place,
-		// so one of the wrong type is re-made: on a work queue nothing is lost, because what was
-		// acknowledged is gone from the stream and what was not is delivered again from the start.
-		// On any other stream a re-made consumer would replay what this one acknowledged (issue
-		// 156), so there it is said and left, and the person re-makes it knowing the cost.
-		if havePush, wantPush := have.Config.DeliverSubject != "", want.DeliverSubject != ""; havePush != wantPush {
-			shape := func(push bool) string {
-				if push {
-					return "push"
-				}
-				return "pull"
-			}
-			info, err := j.js.StreamInfo(c.Stream)
-			if err != nil {
-				return fmt.Errorf("asking about stream %s to re-make consumer %s: %w", c.Stream, c.Name, err)
-			}
-			if info.Config.Retention != nats.WorkQueuePolicy {
-				// **A stream that keeps its history is re-made from now on, never from the start.**
-				// Left for a hand, the hand re-makes it with the server's default — everything the
-				// stream holds — which on 2026-10-03 replayed every build ask since 1 October and
-				// re-registered nine modules from the past (novox/hq issue 207). What this consumer
-				// had not yet acknowledged is lost with it, and said: on a history stream that is
-				// the smaller cost, and the asks in flight are visible to whoever asked.
-				j.note("consumer %s on %s changes from %s to %s delivery on a stream that keeps its history: "+
-					"re-made to deliver from now on, so nothing this one acknowledged comes back (novox/hq issue "+
-					"207); %d ask(s) it had not acknowledged are not carried over and must be asked again",
-					c.Name, c.Stream, shape(havePush), shape(wantPush), have.NumPending+uint64(have.NumAckPending))
-				want.DeliverPolicy = nats.DeliverNewPolicy
-			} else {
-				j.note("consumer %s on %s changes from %s to %s delivery: re-made where it left off, nothing "+
-					"acknowledged comes back and nothing pending is lost (novox/hq issue 206); a holder bound to "+
-					"the old shape binds again", c.Name, c.Stream, shape(havePush), shape(wantPush))
-			}
-			if err := j.js.DeleteConsumer(c.Stream, c.Name); err != nil {
-				return fmt.Errorf("re-making consumer %s on %s as %s: %w", c.Name, c.Stream, shape(wantPush), err)
-			}
-			if _, err := j.js.AddConsumer(c.Stream, want); err != nil {
-				return fmt.Errorf("re-making consumer %s on %s as %s: %w", c.Name, c.Stream, shape(wantPush), err)
-			}
-			return nil
-		}
 		// Where an existing consumer starts is its history, not something an assertion may move:
 		// the server refuses a changed deliver policy outright. Carried across, so asserting twice
 		// is the no-op a restart depends on.
@@ -325,50 +271,3 @@ func retentionOf(r Retention) nats.RetentionPolicy {
 		return nats.LimitsPolicy
 	}
 }
-
-// EnsureBucket creates a module's bucket if it is absent and brings its options to match if it is
-// present (novox/hq ADR 0201).
-//
-// **An update, never a delete and recreate**, for the reason a stream is updated: recreating
-// discards what the bucket holds, and what a module's state holds is data. The mesh's caps are
-// asserted with the owner's options, so a bucket made by hand converges to them.
-func (j *JetStream) EnsureBucket(b Bucket) error {
-	history := b.History
-	if history == 0 {
-		history = 1
-	}
-	js, err := jetstream.New(j.conn)
-	if err != nil {
-		return err
-	}
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-	if _, err := js.CreateOrUpdateKeyValue(ctx, jetstream.KeyValueConfig{
-		Bucket:       b.Bucket(),
-		Description:  b.Why(),
-		History:      uint8(history),
-		TTL:          time.Duration(b.TTLSeconds) * time.Second,
-		MaxValueSize: StateMaxValueBytes,
-		MaxBytes:     StateMaxBytes,
-		Storage:      jetstream.FileStorage,
-	}); err != nil {
-		return fmt.Errorf("asserting bucket %s: %w", b.Bucket(), err)
-	}
-	return nil
-}
-
-// BucketNames is every key-value bucket on the server, the mesh's and anybody else's.
-func (j *JetStream) BucketNames() ([]string, error) {
-	js, err := jetstream.New(j.conn)
-	if err != nil {
-		return nil, err
-	}
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-	lister := js.KeyValueStoreNames(ctx)
-	var out []string
-	for name := range lister.Name() {
-		out = append(out, name)
-	}
-	return out, lister.Error()
-}

internal/broker/membership.go

@@ -45,11 +45,6 @@ type Membership struct {
 	// module that must tell the mesh from the world, the route proxy serving an internal name, reads
 	// it here rather than keeping a definition of its own.
 	Mesh []string `json:"mesh,omitempty"`
-	// State is every bucket this module's code may reach, by the name it uses for each, and whether
-	// it may write it (novox/hq ADR 0201): the runtime answers a bundle's state verbs from this list
-	// and refuses, with the reason, what is not on it — the bus enforces only the union over every
-	// module on the machine.
-	State []StateIssued `json:"state,omitempty"`
 }
 
 // Served is one address a tool is answered on.
@@ -108,7 +103,6 @@ func MembershipFor(node string, d Declared, where Placements) Membership {
 			m.Seats = append(m.Seats, SeatServed{Seat: s.Name, Verb: verb, Subject: seatToolSubject(s, verb, node)})
 		}
 	}
-	m.State = stateIssuedFor(d)
 	if len(d.Invokes) > 0 {
 		m.Reaches = map[string][]string{}
 		for _, t := range d.Invokes {

internal/broker/membership_test.go

@@ -73,37 +73,3 @@ func TestAnAccountMayReadItsOwnMembershipAndNoOthers(t *testing.T) {
 	has(t, perms.Publish, "$JS.API.DIRECT.GET.ASSIGNMENTS.mesh.assignment.anchor.postgres")
 	hasNot(t, perms.Subscribe, "mesh.assignment.>")
 }
-
-// The runtime arriving on a machine changes nothing about what each module is issued (to-be 38 WP2):
-// the memberships are composed as before and the runtime reads several of them. What the machine's
-// user list gains is one runtime principal, and loses nothing but the runtime module's own.
-func TestTheRuntimeArrivingLeavesEveryMembershipAsItWas(t *testing.T) {
-	filter := Seat{Name: "node-packet-filter", Scope: "node", Serves: []string{"rules", "reload"}}
-	three := []Declared{
-		{Module: "nftables", Holds: []Seat{filter}, Serves: []string{"firewall_rules"}},
-		{Module: "zsh", Serves: []string{"execute"}},
-		{Module: "systemd", Serves: []string{"units"}},
-	}
-	before := Records{Nodes: []string{"anchor"}, Assigned: map[string][]Declared{"anchor": three}}
-	after := Records{Nodes: []string{"anchor"}, Assigned: map[string][]Declared{
-		"anchor": append(append([]Declared{}, three...), Declared{Module: RuntimeModule}),
-	}}
-	for _, d := range three {
-		was := MembershipFor("anchor", d, PlacementsOf(before, nil))
-		is := MembershipFor("anchor", d, PlacementsOf(after, nil))
-		if !reflect.DeepEqual(was, is) {
-			t.Errorf("%s's membership changed when the runtime arrived:\n%+v\n%+v", d.Module, was, is)
-		}
-	}
-	users, err := Users(after)
-	if err != nil {
-		t.Fatal(err)
-	}
-	kinds := map[Kind]int{}
-	for _, p := range users {
-		kinds[p.Kind]++
-	}
-	if kinds[KindNodeTools] != 1 || kinds[KindModule] != 3 || kinds[KindNode] != 1 || kinds[KindController] != 1 {
-		t.Errorf("the machine's users are %v; one runtime, the three modules, the host and the controller", kinds)
-	}
-}

internal/broker/nats.go

@@ -34,20 +34,8 @@ const (
 	// authority is a list of tools and nothing else — not control, not declarations, not builds,
 	// and no ability to answer anything, because a person asks.
 	KindPerson Kind = "person"
-	// KindNodeTools is a machine's tool runtime (novox/hq ADR 0175, to-be 38): one process per
-	// node, on the host side, serving every assigned module's tools and every held seat's verbs.
-	// Its authority is the union of what the modules it carries would each have had for their
-	// tools — and nothing of what they consume, because tools are what it runs, not reactions.
-	KindNodeTools Kind = "node-tools"
 )
 
-// RuntimeModule is the module that IS the node's tool runtime (novox/hq ADR 0175). Where it is
-// assigned, the mesh composes one runtime principal for the machine in place of that module's own,
-// and the per-module containers that served tools until then stop being the way tools reach a node.
-// Mirrored in the catalogue package, which the agreement test holds to the same string; one
-// constant, so a rename is one edit and the two packages cannot drift.
-const RuntimeModule = "node-tools"
-
 // Seat is a role on the bus as a principal relates to it: the subjects it accepts, and those it
 // emits (novox/hq ADR 0118, design 29 §5).
 type Seat struct {
@@ -86,13 +74,6 @@ type Principal struct {
 	// a namespace no such module owns. Every service started and the graph stayed empty.
 	Watches []Seat
 
-	// Carries are the modules whose tools this principal serves, for a KindNodeTools principal
-	// (novox/hq ADR 0175): every module assigned to its node, as each declares itself. Its
-	// serving authority is the union of theirs — each module's own tool namespace and each held
-	// seat's verbs on this node — derived from the same declarations the modules' own principals
-	// are, so the runtime can serve nothing a module could not have served for itself.
-	Carries []Declared
-
 	// Invokes are the tools this principal may call, as `<module>.<tool>`; a single `*` is every
 	// tool. A person's whole authority (design 25 §7), and a module's only if its manifest says so
 	// (novox/hq ADR 0152) — the console's does, and nothing else's.
@@ -103,12 +84,6 @@ type Principal struct {
 	// permission and nothing beside it.
 	Invokes []string
 
-	// State is the local names of the state this principal's module keeps, and Reads the state of
-	// others it reads as `<module>.<name>` (novox/hq ADR 0201): a bucket each, kept by the owner's
-	// instances and read by whoever declares it.
-	State []string
-	Reads []string
-
 	// PasswordHash is the bcrypt hash the mesh minted. The plaintext is sealed to the principal
 	// and never appears here: this file is written to a node's disk and read by a server, and a
 	// secret that can be read from a configuration file is a secret with a wider blast radius
@@ -116,13 +91,10 @@ type Principal struct {
 	PasswordHash string
 }
 
-// seatsTheControllerAsks are the roles the mesh's own flows submit work to. Named rather than
+// meshSeatsTheControllerUses are the roles the mesh's own flows submit work to. Named rather than
 // derived from the seat set: the controller is not a module and declares no `uses`, so its side of a
 // seat has to be stated, and a list is what makes "which roles does the mesh itself talk to" answerable.
-// Both build roles while the handover runs (novox/hq ADR 0190): the controller asks whichever has a
-// holder, and the retired one has one until build-agent replaces the builder. The second entry
-// goes with the retired seat row.
-var seatsTheControllerAsks = []string{"node-build-agent", "mesh-build-machine"}
+var meshSeatsTheControllerUses = []string{"mesh-build-machine"}
 
 // enrolmentPrefix is the space every enrolling node's user and inbox live under, so the one place the
 // controller may answer an enrolment is derived from the same constant the user is named from.
@@ -140,10 +112,7 @@ func (p Principal) Username() string {
 	switch p.Kind {
 	case KindPerson:
 		return "person." + p.Module
-	case KindModule, KindNodeTools:
-		// The runtime is named exactly as the module it stands for would have been: the mesh
-		// issues its credential through the same path a module's takes (`module issue`), and
-		// that path knows the node and the module, not the kind.
+	case KindModule:
 		return p.Node + "." + p.Module
 	case KindNode:
 		return "node." + p.Node
@@ -217,9 +186,7 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		// Work the mesh's own flows submit to a role, and the outcomes they wait on (ADR 0121). A
 		// build is the one today: the controller asks, and reads the answer from the seat's event
 		// like the catalogue does — which is why no holder needs to publish into anybody's inbox.
-		// A node-scoped seat's work subject carries no node (novox/hq ADR 0190): the ask goes to
-		// the role, and whichever machine holding it is idle takes it.
-		for _, seat := range seatsTheControllerAsks {
+		for _, seat := range meshSeatsTheControllerUses {
 			pub = append(pub, "mesh.seat."+seat+".accept.>")
 		}
 		// **And what the mesh says it did** (novox/hq ADR 0134). The control plane states its own
@@ -242,8 +209,6 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		// which this package mirrors rather than reads, and a verb the seat does not declare is a
 		// subject nothing publishes.
 		sub = append(sub, "mesh.seat."+ControllerSeat+".tool.>")
-		// And says so (novox/hq ADR 0197): it answers discovery for the seat it serves.
-		sub = append(sub, announcing(ControllerSeat)...)
 
 		// The two events it reacts to, and its ack subject on the stream they arrive from
 		// (streams.go). **Each named, not a pattern**: `mesh.mod.*.event.>` would make the
@@ -279,9 +244,6 @@ func PermissionsFor(p Principal) (Permissions, error) {
 			return Permissions{}, err
 		}
 		pub = append(pub, invoked...)
-		// And may ask what answers (novox/hq ADR 0197): a question every service answers about
-		// itself, its replies to the asker's own inbox.
-		pub = append(pub, discovering()...)
 
 	case KindEnrolment:
 		// A leaked token is useless for anything but enrolling: it cannot read a declaration, hear
@@ -338,15 +300,6 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		// away — no other principal may subscribe this namespace, and a caller's authority is
 		// still granted per tool, by name, on the publish side.
 		sub = append(sub, own+".tool.>")
-		// It says what it serves (novox/hq ADR 0197): discovery for its own name and every seat it
-		// holds a verb of, answered by the runtime that serves them.
-		announced := []string{p.Module}
-		for _, s := range p.Holds {
-			if len(s.Serves) > 0 {
-				announced = append(announced, s.Name)
-			}
-		}
-		sub = append(sub, announcing(announced...)...)
 		// Its own membership (ADR 0160): the one subject a runtime derives for itself, read
 		// directly from the stream and followed live. Nothing else's.
 		sub = append(sub, MembershipSubject(p.Node, p.Module))
@@ -393,17 +346,13 @@ func PermissionsFor(p Principal) (Permissions, error) {
 
 		// 3. Seats it holds: full participation.
 		for _, s := range p.Holds {
-			// Taking work from the role's queue: the worker consumer every holder shares (asked
-			// about, pulled from, acknowledged), on the seat's own stream (novox/hq ADR 0190). A
-			// holder pulls — asks the consumer for its next message, answered on its own inbox —
-			// so what it needs is MSG.NEXT on that worker and nothing delivered to it. The first
-			// machine to take work over the new bus was refused the asking (2026-09-28).
+			// Taking work from the role's queue: the worker consumer it binds (asked about,
+			// delivered on, acknowledged), each on the seat's own stream. The first machine to
+			// take work over the new bus was refused the asking (2026-09-28).
 			worker := "SEAT_" + upperSnake(s.Name) + "_worker"
 			stream := seatStreamName(s.Name)
-			pub = append(pub,
-				"$JS.API.CONSUMER.INFO."+stream+"."+worker,
-				"$JS.API.CONSUMER.MSG.NEXT."+stream+"."+worker,
-				"$JS.ACK."+stream+"."+worker+".>")
+			sub = append(sub, "_DELIVER."+worker, "_DELIVER."+worker+".>")
+			pub = append(pub, "$JS.API.CONSUMER.INFO."+stream+"."+worker, "$JS.ACK."+stream+"."+worker+".>")
 			for _, a := range s.Accepts {
 				sub = append(sub, seatSubject(s, "accept", a))
 			}
@@ -426,86 +375,6 @@ func PermissionsFor(p Principal) (Permissions, error) {
 				pub = append(pub, seatToolSubject(s, t, "*"))
 			}
 		}
-
-		// 5. Its state, and the state of others it reads (novox/hq ADR 0201): every one read and
-		//    watched, its own written too.
-		pub = append(pub, stateGrants(p.Module, p.State, p.Reads)...)
-
-	case KindNodeTools:
-		// **One process serves what every module on the machine would have served for itself**
-		// (novox/hq ADR 0175). Each carried module's whole tool namespace — the same grant that
-		// module's own principal has, for the same reason: the tools a module serves are what its
-		// code answers, and a list here would be a second copy of it. Each held seat's verbs on
-		// this node, as the holder's own principal would be granted them.
-		var serves []string
-		for _, d := range p.Carries {
-			if !safeSubject.MatchString(d.Module) {
-				return Permissions{}, fmt.Errorf(
-					"%q cannot be part of a subject: a permission is a subject pattern, and this would widen it", d.Module)
-			}
-			serves = append(serves, d.Module)
-			for _, s := range d.Holds {
-				serves = append(serves, s.Name)
-			}
-			own := "mesh.mod." + d.Module
-			sub = append(sub, own+".tool.>")
-			// A tool that emits an event is the module's code and emits under the module's name
-			// (ADR 0042); the runtime carrying that code may publish what the module declared it
-			// emits, and nothing it did not.
-			for _, e := range d.Emits {
-				pub = append(pub, own+".event."+e)
-			}
-			for _, s := range d.Holds {
-				for _, t := range s.Serves {
-					sub = append(sub, seatToolSubject(s, t, p.Node))
-				}
-			}
-		}
-		// Every assigned module's membership on this node (ADR 0160): one per module, read
-		// directly from the stream and followed live. This node's and no other's — the one token
-		// that varies is the module, so the pattern is the machine's own assignments.
-		sub = append(sub, "mesh.assignment."+p.Node+".*")
-		pub = append(pub, "$JS.API.DIRECT.GET."+AssignmentsStream+".mesh.assignment."+p.Node+".*")
-		// And every tool on the mesh (ADR 0175, decision 5): any node may call any tool on any
-		// node, as the console already could — the runtime is the console's serving mode.
-		invoked, err := invokedSubjects([]string{"*"})
-		if err != nil {
-			return Permissions{}, err
-		}
-		pub = append(pub, invoked...)
-		// It says what it serves and may ask what answers (novox/hq ADR 0197): the runtime answers
-		// discovery for each module and seat it carries, and the console it is asks the bus.
-		// One service per runtime process, named for the runtime: the bus lets a principal answer each
-		// request once, so the runtime announces everything it carries under its own name.
-		sub = append(sub, announcing(append([]string{RuntimeModule}, serves...)...)...)
-		pub = append(pub, discovering()...)
-		// **And it consumes for the modules it carries** (novox/hq ADR 0198, which changes ADR 0175's
-		// "it consumes nothing"): a module's long-running code is a bundle this runtime launches, and
-		// the runtime is its bus — it reads the module's own durable consumer and acknowledges what
-		// the module's code took. Exactly the grants the module's own principal has for that consumer,
-		// on its name and no other's: asking about it, pulling from it, acknowledging it. The
-		// consumer is still the controller's to make, from the module's own principal.
-		for _, d := range p.Carries {
-			own := Principal{Kind: KindModule, Node: p.Node, Module: d.Module, Emits: d.Emits,
-				Consumes: d.Consumes, Serves: d.Serves, Holds: d.Holds, Uses: d.Uses, Watches: d.Watches}
-			if _, consumes := ConsumerFor(own); !consumes {
-				continue
-			}
-			stream, durable := consumerStream(own), consumerDurable(own)
-			pub = append(pub,
-				"$JS.API.CONSUMER.INFO."+stream+"."+durable,
-				"$JS.API.CONSUMER.MSG.NEXT."+stream+"."+durable,
-				"$JS.ACK."+stream+"."+durable+".>")
-		}
-		// **And it keeps and reads state for the modules it carries** (novox/hq ADR 0201): the union
-		// of what each may do with a bucket — an owner's write, a reader's read. That one module's code
-		// does not write another's bucket through it is the runtime's to keep, from the membership
-		// each assignment is issued, as it keeps each module's events under that module's own name.
-		for _, d := range p.Carries {
-			pub = append(pub, stateGrants(d.Module, stateNames(d.State), d.Reads)...)
-		}
-		sub = unique(sub)
-		pub = unique(pub)
 	}
 
 	if p.Kind == KindPerson {
@@ -513,11 +382,6 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		// consumer, because nothing is delivered to a person — they ask and are answered.
 		sub = append(sub, p.inbox())
 	}
-	if p.Kind == KindNodeTools {
-		// Its reply space, so the answers to what its tools call come back to it. No ack subject
-		// for the same reason a person has none: nothing is delivered to it.
-		sub = append(sub, p.inbox())
-	}
 
 	if p.Kind == KindModule || p.Kind == KindNode || p.Kind == KindController {
 		// Its own reply space, and nothing wider.
@@ -539,7 +403,7 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		// A module answers what it was asked — a tool call reaches it on its own namespace, so the
 		// authority is bounded by having been asked — and so does the controller. A node and a
 		// person are never asked anything, and are granted nothing here.
-		AllowResponses: p.Kind == KindModule || p.Kind == KindController || p.Kind == KindNodeTools,
+		AllowResponses: p.Kind == KindModule || p.Kind == KindController,
 	}, nil
 }
 
@@ -761,20 +625,6 @@ func ComposeAccounts(principals []Principal) (string, error) {
 	return b.String(), nil
 }
 
-// unique is a sorted list with each subject once. Two carried modules holding seats with the same
-// verb, or the runtime module itself carried beside the others, would otherwise write a grant twice
-// — harmless to the server, and noise in a file that is read as the mesh's authority model.
-func unique(values []string) []string {
-	sort.Strings(values)
-	out := values[:0]
-	for i, v := range values {
-		if i == 0 || v != values[i-1] {
-			out = append(out, v)
-		}
-	}
-	return out
-}
-
 func quoted(values []string) string {
 	if len(values) == 0 {
 		return ""
@@ -823,25 +673,3 @@ func invokedSubjects(invokes []string) ([]string, error) {
 	}
 	return out, nil
 }
-
-// announcing is what a principal that serves tools subscribes to answer the NATS services
-// protocol's discovery (novox/hq ADR 0197): the questions asked of every service, and those asked of
-// each name it serves — its own and no other's, so it cannot answer for a service it is not.
-func announcing(names ...string) []string {
-	out := []string{"$SRV.PING", "$SRV.INFO", "$SRV.STATS"}
-	for _, n := range names {
-		if !safeSubject.MatchString(n) {
-			continue
-		}
-		for _, verb := range []string{"PING", "INFO", "STATS"} {
-			out = append(out, "$SRV."+verb+"."+n, "$SRV."+verb+"."+n+".>")
-		}
-	}
-	return out
-}
-
-// discovering is what a principal publishes to ask what answers (novox/hq ADR 0197): the services
-// protocol's discovery requests, whose replies come to its own inbox.
-func discovering() []string {
-	return []string{"$SRV.PING", "$SRV.PING.>", "$SRV.INFO", "$SRV.INFO.>"}
-}

internal/broker/nats_test.go

@@ -233,9 +233,7 @@ func TestAPersonReachesNothingButTools(t *testing.T) {
 	perms, _ := PermissionsFor(Principal{Kind: KindPerson, Module: "jo",
 		Invokes: []string{"*"}, PasswordHash: "x"})
 	for _, p := range perms.Publish {
-		// A tool call, or asking what answers (novox/hq ADR 0197) — a question every service
-		// answers about itself, which claims nothing and controls nothing.
-		if !strings.Contains(p, ".tool.") && !strings.HasPrefix(p, "$SRV.") {
+		if !strings.Contains(p, ".tool.") {
 			t.Errorf("a person may publish %q, which is not a tool call", p)
 		}
 	}
@@ -373,109 +371,3 @@ func TestAModulePullsItsOwnConsumerAndNoOthers(t *testing.T) {
 		}
 	}
 }
-
-// The runtime's authority is the union of what the modules it carries would have been granted for
-// their tools (novox/hq ADR 0175): every carried module's tool namespace, every held seat's verbs
-// on this node, every module's membership on this node, and a call to anything. Nothing it
-// consumes, because it reacts to nothing.
-func TestTheRuntimeServesTheUnionAndConsumesForItsModules(t *testing.T) {
-	filter := Seat{Name: "node-packet-filter", Scope: "node", Serves: []string{"rules", "reload"}}
-	p := Principal{Kind: KindNodeTools, Node: "anchor", Module: RuntimeModule, Carries: []Declared{
-		{Module: "nftables", Holds: []Seat{filter}, Serves: []string{"firewall_rules"}},
-		{Module: "zsh", Emits: []string{"shell.opened"}, Consumes: []string{"shop.order.placed"}},
-		{Module: RuntimeModule},
-	}}
-	perms, err := PermissionsFor(p)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, want := range []string{
-		"mesh.mod.nftables.tool.>", "mesh.mod.zsh.tool.>", "mesh.mod." + RuntimeModule + ".tool.>",
-		"mesh.seat.node-packet-filter.tool.rules.anchor", "mesh.seat.node-packet-filter.tool.reload.anchor",
-		"mesh.assignment.anchor.*",
-		"_INBOX.anchor." + RuntimeModule + ".>",
-	} {
-		if !contains(perms.Subscribe, want) {
-			t.Errorf("the runtime may not subscribe %s: %v", want, perms.Subscribe)
-		}
-	}
-	for _, want := range []string{
-		"mesh.mod.*.tool.>", "mesh.seat.*.tool.>",
-		"$JS.API.DIRECT.GET.ASSIGNMENTS.mesh.assignment.anchor.*",
-		"mesh.mod.zsh.event.shell.opened",
-	} {
-		if !contains(perms.Publish, want) {
-			t.Errorf("the runtime may not publish %s: %v", want, perms.Publish)
-		}
-	}
-	// It reads the consumer of every carried module that consumes — that module's, by its name, as
-	// the module's own principal could (novox/hq ADR 0198) — and of no module that consumes nothing.
-	for _, want := range []string{
-		"$JS.API.CONSUMER.INFO.EVENTS.anchor_zsh",
-		"$JS.API.CONSUMER.MSG.NEXT.EVENTS.anchor_zsh",
-		"$JS.ACK.EVENTS.anchor_zsh.>",
-	} {
-		if !contains(perms.Publish, want) {
-			t.Errorf("the runtime may not read zsh's consumer: %s missing from %v", want, perms.Publish)
-		}
-	}
-	for _, s := range perms.Publish {
-		if (strings.HasPrefix(s, "$JS.ACK.") || strings.Contains(s, "CONSUMER")) && !strings.Contains(s, "anchor_zsh") {
-			t.Errorf("the runtime was granted a consumer no carried module of it consumes on: %s", s)
-		}
-	}
-	// It pulls; nothing is pushed to it, and it subscribes no event subject directly.
-	for _, s := range perms.Subscribe {
-		if strings.Contains(s, ".event.") || strings.HasPrefix(s, "_DELIVER.") {
-			t.Errorf("the runtime was granted a delivery: %s", s)
-		}
-	}
-	if !perms.AllowResponses {
-		t.Error("the runtime answers what it is asked, and may not reply")
-	}
-	if _, needed := ConsumerFor(p); needed {
-		t.Error("a consumer would be made for the runtime itself; it reads its modules' consumers, never one of its own")
-	}
-	// Each subject once in each list: the file is read as the mesh's authority model. One subject may
-	// stand in both — the runtime answers discovery on `$SRV.INFO` and, as the console, asks it
-	// (novox/hq ADR 0197) — because subscribing and publishing are two different grants.
-	for _, list := range [][]string{perms.Subscribe, perms.Publish} {
-		seen := map[string]bool{}
-		for _, s := range list {
-			if seen[s] {
-				t.Errorf("%s is granted twice", s)
-			}
-			seen[s] = true
-		}
-	}
-}
-
-func contains(list []string, want string) bool {
-	for _, s := range list {
-		if s == want {
-			return true
-		}
-	}
-	return false
-}
-
-// A node-scoped seat's work is shared (novox/hq ADR 0190): its holder on any machine subscribes the
-// seat's one work subject, with no node in it, so holders on several machines read one queue. The
-// node token belongs to a seat's tools, which are asked of one machine (design 33 §4), not to its work.
-func TestANodeSeatsWorkSubjectCarriesNoNode(t *testing.T) {
-	seat := Seat{Name: "node-build-agent", Scope: "node", Accepts: []string{"build"}, Serves: []string{"status"}}
-	perms, err := PermissionsFor(Principal{Kind: KindModule, Node: "anchor", Module: "build-agent", Holds: []Seat{seat}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	has(t, perms.Subscribe, "mesh.seat.node-build-agent.accept.build")
-	hasNot(t, perms.Subscribe, "mesh.seat.node-build-agent.accept.build.anchor")
-	// And its tools still carry the machine.
-	has(t, perms.Subscribe, "mesh.seat.node-build-agent.tool.status.anchor")
-	// The controller asks the role, not a machine.
-	controller, err := PermissionsFor(Principal{Kind: KindController})
-	if err != nil {
-		t.Fatal(err)
-	}
-	has(t, controller.Publish, "mesh.seat.node-build-agent.accept.>")
-}

internal/broker/state.go

@@ -1,169 +0,0 @@
-package broker
-
-import (
-	"fmt"
-	"sort"
-	"strings"
-)
-
-// A module's state on the bus (novox/hq ADR 0201, design 32 §4, design 25 §3).
-//
-// A module names the state it keeps (`state`) and the state of others it reads (`reads`), and each
-// is a key-value bucket: the server's own last-per-subject stream with direct reads, delete markers
-// and watches, which is the state relationship the mesh already uses for declarations, opened to
-// modules. The controller creates every bucket from the catalogue — from registration, like a
-// seat's stream, so a reader may watch before the owner runs anywhere — and no module can.
-//
-// Pure, like everything else in this package that decides what the bus holds; jetstream.go is the
-// part that asks a server.
-
-// The mesh's caps on a bucket, the same for every module: a value is a piece of state, not a file,
-// and a bucket that grew without bound would be one module filling the bus's disk for everyone.
-const (
-	StateMaxValueBytes = 256 * 1024
-	StateMaxBytes      = 64 * 1024 * 1024
-)
-
-// A Bucket is one module's declared state as the bus holds it.
-type Bucket struct {
-	Module string
-	Name   string
-	// History is how many values a key keeps; zero is one.
-	History int
-	// TTLSeconds is how long a value lives; zero is until replaced or deleted.
-	TTLSeconds int
-}
-
-// BucketName is the bucket a module's state lives in: the module and the local name joined by an
-// underscore, which neither may contain, so two modules can never derive one bucket.
-func BucketName(module, name string) string { return module + "_" + name }
-
-// Bucket is this bucket's name on the bus.
-func (b Bucket) Bucket() string { return BucketName(b.Module, b.Name) }
-
-// Why is carried into the server's description of the bucket, so somebody reading the server's
-// own state finds whose it is and why it is kept.
-func (b Bucket) Why() string {
-	return fmt.Sprintf("%s's state %q (novox/hq ADR 0201): its current value per key, written by %s, "+
-		"read by whatever declares it reads it; kept when %s is unassigned, because it is data",
-		b.Module, b.Name, b.Module, b.Module)
-}
-
-// bucketOfRead is the bucket a read names, `<module>.<name>`, or false when it names none.
-func bucketOfRead(read string) (string, bool) {
-	at := strings.LastIndex(read, ".")
-	if at <= 0 || at == len(read)-1 {
-		return "", false
-	}
-	module, name := read[:at], read[at+1:]
-	if !safeSubject.MatchString(module) || !safeSubject.MatchString(name) {
-		return "", false
-	}
-	return BucketName(module, name), true
-}
-
-// stateGrants is what a principal publishes to reach the state its modules keep and read: for every
-// bucket, binding to it, reading a key directly, and an ordered consumer for listing and watching,
-// created and deleted on the bucket's own stream, with its flow control answered; for a bucket an
-// owner keeps, writing under the bucket's own subjects too.
-//
-// **Measured against a running server, 2026-10-04** (novox/hq research 024), and each one is there
-// because leaving it out failed: without STREAM.INFO nothing binds; without DIRECT.GET nothing is
-// read; without CONSUMER.CREATE no key is listed and nothing is watched; without CONSUMER.DELETE a
-// watch cannot be stopped and lingers on the server. A write outside these is refused by the server
-// — and reaches the writer as a timeout, not a refusal, which is why the runtime refuses first.
-func stateGrants(module string, keeps []string, reads []string) []string {
-	var out []string
-	read := func(bucket string) {
-		stream := "KV_" + bucket
-		out = append(out,
-			"$JS.API.STREAM.INFO."+stream,
-			"$JS.API.DIRECT.GET."+stream+".>",
-			"$JS.API.CONSUMER.CREATE."+stream+".>",
-			"$JS.API.CONSUMER.DELETE."+stream+".>",
-			"$JS.FC."+stream+".>")
-	}
-	for _, name := range keeps {
-		if !safeSubject.MatchString(name) {
-			continue
-		}
-		bucket := BucketName(module, name)
-		read(bucket)
-		out = append(out, "$KV."+bucket+".>")
-	}
-	for _, r := range reads {
-		if bucket, ok := bucketOfRead(r); ok {
-			read(bucket)
-		}
-	}
-	return out
-}
-
-// StateIssued is one bucket an assignment may reach, by the name its module uses for it: its own
-// state by the local name, another's as `<module>.<name>` (novox/hq ADR 0201).
-type StateIssued struct {
-	Name   string `json:"name"`
-	Bucket string `json:"bucket"`
-	Writes bool   `json:"writes,omitempty"`
-}
-
-// stateIssuedFor is every bucket a module's code may reach, as its membership lists them.
-func stateIssuedFor(d Declared) []StateIssued {
-	var out []StateIssued
-	for _, b := range d.State {
-		out = append(out, StateIssued{Name: b.Name, Bucket: BucketName(d.Module, b.Name), Writes: true})
-	}
-	for _, r := range d.Reads {
-		if bucket, ok := bucketOfRead(r); ok {
-			out = append(out, StateIssued{Name: r, Bucket: bucket})
-		}
-	}
-	return out
-}
-
-// stateNames is the local names of a module's own buckets.
-func stateNames(buckets []Bucket) []string {
-	out := make([]string, 0, len(buckets))
-	for _, b := range buckets {
-		out = append(out, b.Name)
-	}
-	return out
-}
-
-// A BucketAsserter is the part of a JetStream connection bucket assertion needs.
-type BucketAsserter interface {
-	// EnsureBucket creates the bucket if absent and brings its options to match if present, never
-	// discarding what it holds.
-	EnsureBucket(b Bucket) error
-	// BucketNames is every key-value bucket on the server.
-	BucketNames() ([]string, error)
-}
-
-// RaiseBuckets asserts every declared bucket and answers the buckets on the server that nothing
-// declares any more.
-//
-// **Those are reported, never removed** (novox/hq ADR 0201, ADR 0030): what a module stored is
-// data, and a manifest edited, a module renamed or a catalogue entry dropped is an ordinary day's
-// work that must not take data with it. Removing one is a person's act.
-func RaiseBuckets(a BucketAsserter, buckets []Bucket) (undeclared []string, err error) {
-	sorted := append([]Bucket(nil), buckets...)
-	sort.Slice(sorted, func(i, j int) bool { return sorted[i].Bucket() < sorted[j].Bucket() })
-	declared := map[string]bool{}
-	for _, b := range sorted {
-		if err := a.EnsureBucket(b); err != nil {
-			return nil, fmt.Errorf("asserting %s's state %q: %w", b.Module, b.Name, err)
-		}
-		declared[b.Bucket()] = true
-	}
-	names, err := a.BucketNames()
-	if err != nil {
-		return nil, fmt.Errorf("listing the bus's state: %w", err)
-	}
-	for _, n := range names {
-		if !declared[n] {
-			undeclared = append(undeclared, n)
-		}
-	}
-	sort.Strings(undeclared)
-	return undeclared, nil
-}

internal/broker/state_test.go

@@ -1,180 +0,0 @@
-package broker
-
-import (
-	"slices"
-	"strings"
-	"testing"
-
-	"github.com/nats-io/nats.go"
-)
-
-// The grants measured against a running server (novox/hq research 024): an owner reads and writes
-// its bucket, a reader only reads, and neither reaches any other bucket.
-func TestAnOwnerWritesItsStateAndAReaderOnlyReads(t *testing.T) {
-	owner, err := PermissionsFor(Principal{Kind: KindModule, Node: "one", Module: "claude-code",
-		State: []string{"servers"}, PasswordHash: "x"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, s := range []string{
-		"$KV.claude-code_servers.>",
-		"$JS.API.STREAM.INFO.KV_claude-code_servers",
-		"$JS.API.DIRECT.GET.KV_claude-code_servers.>",
-		"$JS.API.CONSUMER.CREATE.KV_claude-code_servers.>",
-		"$JS.API.CONSUMER.DELETE.KV_claude-code_servers.>",
-		"$JS.FC.KV_claude-code_servers.>",
-	} {
-		has(t, owner.Publish, s)
-	}
-	hasNot(t, owner.Publish, "$KV.>")
-	hasNot(t, owner.Publish, "$JS.API.>")
-
-	reader, err := PermissionsFor(Principal{Kind: KindModule, Node: "one", Module: "console",
-		Reads: []string{"claude-code.servers"}, PasswordHash: "x"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	has(t, reader.Publish, "$JS.API.DIRECT.GET.KV_claude-code_servers.>")
-	has(t, reader.Publish, "$JS.API.CONSUMER.CREATE.KV_claude-code_servers.>")
-	hasNot(t, reader.Publish, "$KV.claude-code_servers.>")
-	for _, s := range reader.Subscribe {
-		if s == "$KV.claude-code_servers.>" {
-			t.Fatalf("a reader subscribes the bucket's subjects directly: %v", reader.Subscribe)
-		}
-	}
-}
-
-// One runtime carries every module on its machine, so its grant is the union: the owner's write
-// where an owner is carried, a read where only a reader is.
-func TestTheRuntimeKeepsAndReadsStateForItsModules(t *testing.T) {
-	perms, err := PermissionsFor(Principal{Kind: KindNodeTools, Node: "one", Module: RuntimeModule,
-		Carries: []Declared{
-			{Module: "claude-code", State: []Bucket{{Module: "claude-code", Name: "servers"}},
-				Reads: []string{"licence-manager.bindings"}},
-			{Module: "audit"},
-		}, PasswordHash: "x"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	has(t, perms.Publish, "$KV.claude-code_servers.>")
-	has(t, perms.Publish, "$JS.API.DIRECT.GET.KV_licence-manager_bindings.>")
-	hasNot(t, perms.Publish, "$KV.licence-manager_bindings.>")
-}
-
-// A module with no state is granted nothing of any bucket — the composition of every module that
-// existed before this is unchanged.
-func TestAModuleWithNoStateReachesNoBucket(t *testing.T) {
-	perms, err := PermissionsFor(Principal{Kind: KindModule, Node: "one", Module: "billing",
-		Emits: []string{"order.placed"}, PasswordHash: "x"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, s := range perms.Publish {
-		if strings.HasPrefix(s, "$KV.") || strings.HasPrefix(s, "$JS.FC.") || strings.Contains(s, ".KV_") {
-			t.Fatalf("granted %q without declaring state", s)
-		}
-	}
-}
-
-// A read that names no bucket grants nothing rather than something that happens to parse.
-func TestAReadThatNamesNoBucketGrantsNothing(t *testing.T) {
-	if got := stateGrants("a", nil, []string{"nodot", "x.", ".y", "a.b>"}); len(got) != 0 {
-		t.Fatalf("granted %v for reads that name no bucket", got)
-	}
-}
-
-// The membership lists every bucket the module's code may reach, by the name the module uses for
-// it, and whether it may write it — the list the runtime refuses from.
-func TestAMembershipListsTheStateItsModuleMayReach(t *testing.T) {
-	m := MembershipFor("one", Declared{Module: "claude-code",
-		State: []Bucket{{Module: "claude-code", Name: "servers"}},
-		Reads: []string{"licence-manager.bindings"}}, Placements{})
-	want := []StateIssued{
-		{Name: "servers", Bucket: "claude-code_servers", Writes: true},
-		{Name: "licence-manager.bindings", Bucket: "licence-manager_bindings"},
-	}
-	if !slices.Equal(m.State, want) {
-		t.Fatalf("issued %+v, want %+v", m.State, want)
-	}
-	if none := MembershipFor("one", Declared{Module: "audit"}, Placements{}); none.State != nil {
-		t.Fatalf("a module with no state was issued %+v", none.State)
-	}
-}
-
-type buckets struct {
-	ensured []string
-	on      []string
-}
-
-func (b *buckets) EnsureBucket(x Bucket) error {
-	b.ensured = append(b.ensured, x.Bucket())
-	return nil
-}
-func (b *buckets) BucketNames() ([]string, error) { return b.on, nil }
-
-// Every declared bucket is asserted; one on the server that nothing declares is said, not removed.
-func TestRaisingStateReportsWhatNothingDeclares(t *testing.T) {
-	b := &buckets{on: []string{"claude-code_servers", "gone_old", "ours_by_hand"}}
-	undeclared, err := RaiseBuckets(b, []Bucket{{Module: "claude-code", Name: "servers"}, {Module: "a", Name: "b"}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !slices.Equal(b.ensured, []string{"a_b", "claude-code_servers"}) {
-		t.Fatalf("asserted %v", b.ensured)
-	}
-	if !slices.Equal(undeclared, []string{"gone_old", "ours_by_hand"}) {
-		t.Fatalf("reported %v", undeclared)
-	}
-}
-
-// Against a real server: a bucket is created with the owner's options and the mesh's caps,
-// asserting it again changes nothing and keeps what it holds, and a changed option is brought to
-// match in place.
-func TestABucketIsAssertedInPlace(t *testing.T) {
-	js := aLiveBus(t)
-	b := Bucket{Module: "statetest", Name: "servers"}
-	if _, err := RaiseBuckets(js, []Bucket{b}); err != nil {
-		t.Fatalf("a real server refused a module's bucket: %v", err)
-	}
-	kv, err := js.Context().KeyValue(b.Bucket())
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := kv.Put("all.one", []byte(`{"kept":true}`)); err != nil {
-		t.Fatal(err)
-	}
-	b.History = 3
-	if _, err := RaiseBuckets(js, []Bucket{b}); err != nil {
-		t.Fatalf("asserting the bucket again failed, so a restart would: %v", err)
-	}
-	got, err := kv.Get("all.one")
-	if err != nil || string(got.Value()) != `{"kept":true}` {
-		t.Fatalf("asserting again lost what the bucket held: %v %v", got, err)
-	}
-	status, err := kv.Status()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if status.History() != 3 {
-		t.Fatalf("history is %d, the owner declared 3", status.History())
-	}
-	if s, ok := status.(*nats.KeyValueBucketStatus); ok {
-		if c := s.StreamInfo().Config; c.MaxMsgSize != StateMaxValueBytes || c.MaxBytes != StateMaxBytes {
-			t.Fatalf("the mesh's caps are not on the bucket: value %d, bucket %d", c.MaxMsgSize, c.MaxBytes)
-		}
-	}
-}
-
-// Against a real server: the handle over a connection the control plane already holds asserts a
-// bucket as Dial's does — what a push uses, so a module registered since the last start has its
-// bucket before its membership names it.
-func TestABucketIsAssertedOverAHeldConnection(t *testing.T) {
-	js := aLiveBus(t)
-	held := OnConn(js.Conn())
-	if _, err := RaiseBuckets(held, []Bucket{{Module: "statetest", Name: "held"}}); err != nil {
-		t.Fatalf("asserting over a held connection failed: %v", err)
-	}
-	if _, err := js.Context().KeyValue("statetest_held"); err != nil {
-		t.Fatalf("the bucket is not there: %v", err)
-	}
-}

internal/broker/streams.go

@@ -217,15 +217,10 @@ var ControllerFollows = []string{
 	// A build's outcome, which is the build-machine role's own event now (ADR 0121) rather than a
 	// message on the control branch. Same three audiences, one publish: whoever asked, this, and the
 	// catalogue.
-	seatEventSubject("node-build-agent", "built"),
+	seatEventSubject("mesh-build-machine", "built"),
 	// The forge's merges: what moved a source, so the mesh builds what that source produces
 	// without anybody telling it (novox/hq 04-ISSUES/131). Appended, because the index is a name.
 	moduleEventSubject("gitea", "pull.merged"),
-	// The retired build role's outcome too, while the handover runs (novox/hq ADR 0190): the one
-	// build machine keeps answering on its seat until build-agent replaces it, and the outcome that
-	// registers build-agent itself comes from there. Appended, for the same reason as above; goes
-	// with the retired seat row.
-	seatEventSubject("mesh-build-machine", "built"),
 }
 
 // moduleEventSubject is where one module's event lands. The same derivation PermissionsFor uses, so

internal/broker/testdata/composed.conf

@@ -24,8 +24,8 @@ accounts {
     jetstream: enabled
     users = [
       { user: "controller", password: "$2a$11$cccccccccccccccccccccc", permissions: {
-        publish: { allow: ["$JS.ACK.CONTROL.controller.>", "$JS.ACK.EVENTS.controller.>", "$JS.API.>", "_INBOX.enrol.>", "mesh.assignment.>", "mesh.control.>", "mesh.mod.*.tool.>", "mesh.node.>", "mesh.seat.mesh-build-machine.accept.>", "mesh.seat.mesh-controller.event.applied", "mesh.seat.mesh-controller.event.built-before", "mesh.seat.mesh-controller.event.refused", "mesh.seat.node-build-agent.accept.>"] }
-        subscribe: { allow: ["$JS.API.>", "$SRV.INFO", "$SRV.INFO.mesh-controller", "$SRV.INFO.mesh-controller.>", "$SRV.PING", "$SRV.PING.mesh-controller", "$SRV.PING.mesh-controller.>", "$SRV.STATS", "$SRV.STATS.mesh-controller", "$SRV.STATS.mesh-controller.>", "_DELIVER.controller", "_DELIVER.controller.>", "_INBOX.controller.>", "mesh.control.>", "mesh.mod.gitea.event.pull.merged", "mesh.mod.mesh-catalog.event.catching-up", "mesh.mod.mesh-catalog.event.upgraded", "mesh.seat.mesh-build-machine.event.built", "mesh.seat.mesh-controller.tool.>", "mesh.seat.node-build-agent.event.built"] }
+        publish: { allow: ["$JS.ACK.CONTROL.controller.>", "$JS.ACK.EVENTS.controller.>", "$JS.API.>", "_INBOX.enrol.>", "mesh.assignment.>", "mesh.control.>", "mesh.mod.*.tool.>", "mesh.node.>", "mesh.seat.mesh-build-machine.accept.>", "mesh.seat.mesh-controller.event.applied", "mesh.seat.mesh-controller.event.built-before", "mesh.seat.mesh-controller.event.refused"] }
+        subscribe: { allow: ["$JS.API.>", "_DELIVER.controller", "_DELIVER.controller.>", "_INBOX.controller.>", "mesh.control.>", "mesh.mod.gitea.event.pull.merged", "mesh.mod.mesh-catalog.event.catching-up", "mesh.mod.mesh-catalog.event.upgraded", "mesh.seat.mesh-build-machine.event.built", "mesh.seat.mesh-controller.tool.>"] }
         allow_responses: { max: 1, ttl: "1m" }
       } }
       { user: "enrol.one", password: "$2a$11$eeeeeeeeeeeeeeeeeeeeee", permissions: {
@@ -37,18 +37,18 @@ accounts {
         subscribe: { allow: ["_DELIVER.one", "_DELIVER.one.>", "_INBOX.node.one.>", "mesh.node.one.declare"] }
       } }
       { user: "one.telegram", password: "$2a$11$tttttttttttttttttttttt", permissions: {
-        publish: { allow: ["$JS.ACK.EVENTS.one_telegram.>", "$JS.ACK.SEAT_TELEGRAM_SENDER.SEAT_TELEGRAM_SENDER_worker.>", "$JS.API.CONSUMER.INFO.EVENTS.one_telegram", "$JS.API.CONSUMER.INFO.SEAT_TELEGRAM_SENDER.SEAT_TELEGRAM_SENDER_worker", "$JS.API.CONSUMER.MSG.NEXT.EVENTS.one_telegram", "$JS.API.CONSUMER.MSG.NEXT.SEAT_TELEGRAM_SENDER.SEAT_TELEGRAM_SENDER_worker", "$JS.API.DIRECT.GET.ASSIGNMENTS.mesh.assignment.one.telegram", "mesh.seat.telegram-sender.event.delivered", "mesh.seat.telegram-sender.event.failed"] }
-        subscribe: { allow: ["$SRV.INFO", "$SRV.INFO.telegram", "$SRV.INFO.telegram.>", "$SRV.PING", "$SRV.PING.telegram", "$SRV.PING.telegram.>", "$SRV.STATS", "$SRV.STATS.telegram", "$SRV.STATS.telegram.>", "_INBOX.one.telegram.>", "mesh.assignment.one.telegram", "mesh.mod.telegram.tool.>", "mesh.seat.telegram-sender.accept.send"] }
+        publish: { allow: ["$JS.ACK.EVENTS.one_telegram.>", "$JS.ACK.SEAT_TELEGRAM_SENDER.SEAT_TELEGRAM_SENDER_worker.>", "$JS.API.CONSUMER.INFO.EVENTS.one_telegram", "$JS.API.CONSUMER.INFO.SEAT_TELEGRAM_SENDER.SEAT_TELEGRAM_SENDER_worker", "$JS.API.CONSUMER.MSG.NEXT.EVENTS.one_telegram", "$JS.API.DIRECT.GET.ASSIGNMENTS.mesh.assignment.one.telegram", "mesh.seat.telegram-sender.event.delivered", "mesh.seat.telegram-sender.event.failed"] }
+        subscribe: { allow: ["_DELIVER.SEAT_TELEGRAM_SENDER_worker", "_DELIVER.SEAT_TELEGRAM_SENDER_worker.>", "_INBOX.one.telegram.>", "mesh.assignment.one.telegram", "mesh.mod.telegram.tool.>", "mesh.seat.telegram-sender.accept.send"] }
         allow_responses: { max: 1, ttl: "1m" }
       } }
       { user: "two.audit", password: "$2a$11$aaaaaaaaaaaaaaaaaaaaaa", permissions: {
         publish: { allow: ["$JS.ACK.EVENTS.two_audit.>", "$JS.API.CONSUMER.INFO.EVENTS.two_audit", "$JS.API.CONSUMER.MSG.NEXT.EVENTS.two_audit", "$JS.API.DIRECT.GET.ASSIGNMENTS.mesh.assignment.two.audit"] }
-        subscribe: { allow: ["$SRV.INFO", "$SRV.INFO.audit", "$SRV.INFO.audit.>", "$SRV.PING", "$SRV.PING.audit", "$SRV.PING.audit.>", "$SRV.STATS", "$SRV.STATS.audit", "$SRV.STATS.audit.>", "_INBOX.two.audit.>", "mesh.assignment.two.audit", "mesh.mod.audit.tool.>", "mesh.mod.shop.event.order.placed"] }
+        subscribe: { allow: ["_INBOX.two.audit.>", "mesh.assignment.two.audit", "mesh.mod.audit.tool.>", "mesh.mod.shop.event.order.placed"] }
         allow_responses: { max: 1, ttl: "1m" }
       } }
       { user: "two.shop", password: "$2a$11$ssssssssssssssssssssss", permissions: {
         publish: { allow: ["$JS.ACK.EVENTS.two_shop.>", "$JS.API.CONSUMER.INFO.EVENTS.two_shop", "$JS.API.CONSUMER.MSG.NEXT.EVENTS.two_shop", "$JS.API.DIRECT.GET.ASSIGNMENTS.mesh.assignment.two.shop", "mesh.mod.shop.event.order.placed", "mesh.seat.telegram-sender.accept.send"] }
-        subscribe: { allow: ["$SRV.INFO", "$SRV.INFO.shop", "$SRV.INFO.shop.>", "$SRV.PING", "$SRV.PING.shop", "$SRV.PING.shop.>", "$SRV.STATS", "$SRV.STATS.shop", "$SRV.STATS.shop.>", "_INBOX.two.shop.>", "mesh.assignment.two.shop", "mesh.mod.shop.tool.>"] }
+        subscribe: { allow: ["_INBOX.two.shop.>", "mesh.assignment.two.shop", "mesh.mod.shop.tool.>"] }
         allow_responses: { max: 1, ttl: "1m" }
       } }
     ]

internal/broker/users.go

@@ -33,10 +33,6 @@ type Declared struct {
 	Watches []Seat
 	// Invokes are the tools it calls, `<module>.<tool>` or `*` (novox/hq ADR 0152).
 	Invokes []string
-	// State is the state it keeps, each a bucket its instances write (novox/hq ADR 0201).
-	State []Bucket
-	// Reads are other modules' state it reads, each `<module>.<name>` (novox/hq ADR 0201).
-	Reads []string
 }
 
 // Records is what composing a user list needs to know about the mesh, and nothing more.
@@ -66,32 +62,11 @@ func Users(r Records) ([]Principal, error) {
 
 	for _, node := range sortedCopy(r.Nodes) {
 		out = append(out, Principal{Kind: KindNode, Node: node})
-		// **Where the runtime is assigned, the machine gets one runtime principal in place of the
-		// runtime module's own** (novox/hq ADR 0175, to-be 38). It carries every module on the
-		// node: its serving grants are the union of theirs. Every other module keeps its own
-		// principal — a module still serving tools from its own container holds its own
-		// credential until it moves, and the two serve side by side in the meantime.
-		runtimeHere := false
 		for _, d := range r.Assigned[node] {
-			if d.Module == RuntimeModule {
-				runtimeHere = true
-			}
-		}
-		for _, d := range r.Assigned[node] {
-			if runtimeHere && d.Module == RuntimeModule {
-				continue
-			}
 			out = append(out, Principal{
 				Kind: KindModule, Node: node, Module: d.Module,
 				Emits: d.Emits, Consumes: d.Consumes, Serves: d.Serves,
 				Holds: d.Holds, Uses: d.Uses, Watches: d.Watches, Invokes: d.Invokes,
-				State: stateNames(d.State), Reads: d.Reads,
-			})
-		}
-		if runtimeHere {
-			out = append(out, Principal{
-				Kind: KindNodeTools, Node: node, Module: RuntimeModule,
-				Carries: append([]Declared(nil), r.Assigned[node]...),
 			})
 		}
 	}

internal/broker/users_test.go

@@ -245,54 +245,3 @@ func TestAUserListIsComposedBeforeAnythingMovesOntoTheBus(t *testing.T) {
 		t.Errorf("the composed list does not contain the machine running the bus")
 	}
 }
-
-// Where the runtime module is assigned, the machine gets one runtime principal in place of the
-// runtime module's own (novox/hq ADR 0175, to-be 38). Every other module keeps its own: a module
-// still serving tools from its own container holds its own credential until it moves.
-func TestTheRuntimeModuleBecomesTheMachinesRuntimePrincipal(t *testing.T) {
-	r := someRecords()
-	r.Assigned["one"] = append(r.Assigned["one"], Declared{Module: RuntimeModule})
-	users, err := Users(r)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var runtime *Principal
-	for i := range users {
-		p := &users[i]
-		if p.Node == "one" && p.Module == RuntimeModule {
-			if p.Kind == KindModule {
-				t.Fatalf("%s on one was composed as an ordinary module beside the runtime", RuntimeModule)
-			}
-			runtime = p
-		}
-	}
-	if runtime == nil || runtime.Kind != KindNodeTools {
-		t.Fatalf("one runs %s and got no runtime principal: %v", RuntimeModule, namesOf(t, r))
-	}
-	if runtime.Username() != "one."+RuntimeModule {
-		t.Errorf("the runtime is named %q; `module issue` names it as the module it stands for", runtime.Username())
-	}
-	carried := map[string]bool{}
-	for _, d := range runtime.Carries {
-		carried[d.Module] = true
-	}
-	if !carried["telegram"] || !carried[RuntimeModule] {
-		t.Errorf("the runtime carries %v; it carries every module on its node", carried)
-	}
-	// And the other node, where the runtime is not assigned, is exactly as before.
-	for _, p := range users {
-		if p.Node == "two" && p.Kind == KindNodeTools {
-			t.Fatal("two runs no runtime and was given a runtime principal")
-		}
-	}
-	// A module serving its own tools beside the runtime keeps its own principal.
-	found := false
-	for _, p := range users {
-		if p.Kind == KindModule && p.Node == "one" && p.Module == "telegram" {
-			found = true
-		}
-	}
-	if !found {
-		t.Error("telegram lost its own principal when the runtime arrived on its node")
-	}
-}

internal/broker/worker_type_change_test.go

@@ -1,167 +0,0 @@
-package broker
-
-import (
-	"os"
-	"testing"
-	"time"
-
-	"github.com/nats-io/nats.go"
-)
-
-// A seat's worker that changed from push to pull delivery strands a holder built for the new shape
-// (novox/hq issue 206): the server refuses a pull subscription on a push consumer, and the controller
-// that would redefine it was the build that nobody could take. The controller owns the worker's
-// shape, type included: on a work queue it re-makes one of the wrong type, losing nothing, and a
-// pull subscription then binds and takes what was pending.
-//
-//	docker run -d --rm --name t -p 14231:4222 nats:2.10-alpine -js
-//	MESH_TEST_NATS=nats://127.0.0.1:14231 go test ./internal/broker/ -run TestAWorker
-func TestAWorkerOfTheWrongTypeIsRemadeOnAWorkQueueAndAPullThenBinds(t *testing.T) {
-	url := os.Getenv("MESH_TEST_NATS")
-	if url == "" {
-		t.Skip("MESH_TEST_NATS unset")
-	}
-	js, err := Dial(url)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer js.Close()
-
-	const stream, worker, filter = "SEAT_T_SHELF", "SEAT_T_SHELF_worker", "mesh.seat.t-shelf.accept.>"
-	_ = js.js.DeleteStream(stream)
-	if _, err := js.js.AddStream(&nats.StreamConfig{
-		Name: stream, Subjects: []string{filter}, Retention: nats.WorkQueuePolicy, Storage: nats.MemoryStorage,
-	}); err != nil {
-		t.Fatal(err)
-	}
-	defer func() { _ = js.js.DeleteStream(stream) }()
-
-	// The worker as the previous controller defined it: push, in a queue group.
-	if _, err := js.js.AddConsumer(stream, &nats.ConsumerConfig{
-		Durable: worker, AckPolicy: nats.AckExplicitPolicy, AckWait: 60 * time.Second, MaxDeliver: 5,
-		FilterSubject: filter, DeliverSubject: "_DELIVER." + worker, DeliverGroup: "holders",
-	}); err != nil {
-		t.Fatal(err)
-	}
-	for _, body := range []string{"one", "two", "three"} {
-		if _, err := js.js.Publish("mesh.seat.t-shelf.accept.build", []byte(body)); err != nil {
-			t.Fatal(err)
-		}
-	}
-	// The old holder took and acknowledged the first ask, then went away.
-	old, err := js.js.QueueSubscribeSync(filter, "holders", nats.Bind(stream, worker))
-	if err != nil {
-		t.Fatal(err)
-	}
-	m, err := old.NextMsg(twoSeconds)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if string(m.Data) != "one" {
-		t.Fatalf("the first ask is %q", m.Data)
-	}
-	if err := m.AckSync(); err != nil {
-		t.Fatal(err)
-	}
-	if err := old.Unsubscribe(); err != nil {
-		t.Fatal(err)
-	}
-
-	// The new controller asserts the worker as the mesh derives it now: pull.
-	if err := js.EnsureConsumer(Consumer{
-		Name: worker, Stream: stream, Filters: []string{filter}, AckWaitSeconds: 60, MaxDeliver: 5,
-		Why: "the test's worker",
-	}); err != nil {
-		t.Fatal(err)
-	}
-	have, err := js.js.ConsumerInfo(stream, worker)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if have.Config.DeliverSubject != "" || have.Config.DeliverGroup != "" {
-		t.Fatalf("the worker is still push: %+v", have.Config)
-	}
-
-	// A holder built for the new shape binds, and takes exactly what the old one left.
-	sub, err := js.js.PullSubscribe(filter, worker, nats.Bind(stream, worker), nats.ManualAck())
-	if err != nil {
-		t.Fatalf("a pull subscription does not bind the re-made worker: %v", err)
-	}
-	got, err := sub.Fetch(3, nats.MaxWait(twoSeconds))
-	if err != nil && len(got) == 0 {
-		t.Fatalf("nothing pending was delivered: %v", err)
-	}
-	var bodies []string
-	for _, g := range got {
-		bodies = append(bodies, string(g.Data))
-		_ = g.Ack()
-	}
-	if len(bodies) != 2 || bodies[0] != "two" || bodies[1] != "three" {
-		t.Fatalf("the pending asks after the acknowledged one, in order: %v", bodies)
-	}
-
-	// Asserted again, the pull worker is the no-op a restart depends on.
-	if err := js.EnsureConsumer(Consumer{
-		Name: worker, Stream: stream, Filters: []string{filter}, AckWaitSeconds: 60, MaxDeliver: 5,
-	}); err != nil {
-		t.Fatal(err)
-	}
-}
-
-// On a stream that keeps its history, a worker of the wrong type is re-made to deliver from now on:
-// re-making it from the start would replay what it acknowledged (novox/hq issue 156), and leaving it
-// for a hand re-made it exactly that way on 2026-10-03 (issue 207).
-func TestAWorkerOfTheWrongTypeOnAHistoryStreamIsRemadeFromNowOn(t *testing.T) {
-	url := os.Getenv("MESH_TEST_NATS")
-	if url == "" {
-		t.Skip("MESH_TEST_NATS unset")
-	}
-	js, err := Dial(url)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer js.Close()
-	const stream, worker, filter = "EVENTS_T", "EVENTS_T_reader", "mesh.t.event.>"
-	_ = js.js.DeleteStream(stream)
-	if _, err := js.js.AddStream(&nats.StreamConfig{Name: stream, Subjects: []string{filter}, Storage: nats.MemoryStorage}); err != nil {
-		t.Fatal(err)
-	}
-	defer func() { _ = js.js.DeleteStream(stream) }()
-	if _, err := js.js.AddConsumer(stream, &nats.ConsumerConfig{
-		Durable: worker, AckPolicy: nats.AckExplicitPolicy, AckWait: 60 * time.Second,
-		FilterSubject: filter, DeliverSubject: "_DELIVER." + worker,
-	}); err != nil {
-		t.Fatal(err)
-	}
-	// History the old consumer would have acknowledged long ago, and must not come back.
-	for i := 0; i < 3; i++ {
-		if _, err := js.js.Publish("mesh.t.event.old", []byte("old")); err != nil {
-			t.Fatal(err)
-		}
-	}
-	if err := js.EnsureConsumer(Consumer{Name: worker, Stream: stream, Filters: []string{filter}, AckWaitSeconds: 60}); err != nil {
-		t.Fatal(err)
-	}
-	have, err := js.js.ConsumerInfo(stream, worker)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if have.Config.DeliverSubject != "" {
-		t.Fatal("a history stream's consumer of the wrong type was left as it was")
-	}
-	if have.Config.DeliverPolicy != nats.DeliverNewPolicy || have.NumPending != 0 {
-		t.Fatalf("re-made consumer delivers %v with %d pending; it must deliver from now on with nothing of the past", have.Config.DeliverPolicy, have.NumPending)
-	}
-	// And what arrives from now on is delivered.
-	if _, err := js.js.Publish("mesh.t.event.new", []byte("new")); err != nil {
-		t.Fatal(err)
-	}
-	sub, err := js.js.PullSubscribe(filter, worker, nats.Bind(stream, worker))
-	if err != nil {
-		t.Fatal(err)
-	}
-	got, err := sub.Fetch(1, nats.MaxWait(3*time.Second))
-	if err != nil || len(got) != 1 || string(got[0].Data) != "new" {
-		t.Fatalf("the re-made consumer delivered %v, %v; want the one new message", got, err)
-	}
-}

internal/builder/builder.go

@@ -215,7 +215,7 @@ func Build(ctx context.Context, run Runner, publish Publisher,
 		sort.Slice(artifacts, func(i, j int) bool { return artifacts[i].Name < artifacts[j].Name })
 		for _, a := range artifacts {
 			say("artifact", "%s (%s%s) — starting", a.Name, a.Kind, langSuffix(a))
-			made, err := one(ctx, run, publish, manifest.Module, within, workspace, commit, credentials, a, args, held, npmrcPath, npmrc, seatBases, say)
+			made, err := one(ctx, run, publish, manifest.Module, within, workspace, commit, credentials, a, args, held, npmrcPath, seatBases, say)
 			if err != nil {
 				say("artifact", "%s FAILED: %v", a.Name, err)
 				return Result{}, err
@@ -443,7 +443,7 @@ func wantsPackages(manifest catalogue.Manifest, within string) bool {
 
 func one(ctx context.Context, run Runner, publish Publisher,
 	module, tree, workspace, commit, credentials string, a catalogue.Artifact, args []string,
-	held map[string]string, npmrc string, registry Npmrc, seats map[string]string,
+	held map[string]string, npmrc string, seats map[string]string,
 	say func(step, format string, args ...any)) (catalogue.Built, error) {
 
 	switch a.Kind {
@@ -582,28 +582,11 @@ func one(ctx context.Context, run Runner, publish Publisher,
 					"holds no copy of it. Build %s first",
 				module, a.Name, chain.Language, chain.Base, chain.Artifact, chain.Base)
 		}
-		// The module's own packages first, where the compiler and the bundler resolve them from
-		// (dependencies.go); nothing at all for a module whose package.json names only the SDK.
-		if err := installOwn(ctx, run, tree, chain, base, registry, say); err != nil {
-			return catalogue.Built{}, fmt.Errorf("%s: %s: %w", module, a.Name, err)
-		}
 		say("bundle", "compiling %s in %s's toolchain", a.Language, chain.Base)
 		compiled, err := compile(ctx, run, tree, chain, base, a)
 		if err != nil {
 			return catalogue.Built{}, fmt.Errorf("%s: compiling %s failed: %w", module, a.Name, err)
 		}
-		// **Every entrypoint the runtime may serve is executable** (novox/hq ADR 0193). The runtime
-		// knows no language; for one that runs through an interpreter the build writes the launcher.
-		launchers, err := writeLaunchers(compiled, chain, a)
-		if err != nil {
-			return catalogue.Built{}, fmt.Errorf("%s: writing %s's launchers failed: %w", module, a.Name, err)
-		}
-		if chain.Bundler != "" {
-			say("bundle", "bundling each entrypoint into one file")
-			if compiled, err = bundled(ctx, run, tree, chain, base, a, launchers); err != nil {
-				return catalogue.Built{}, fmt.Errorf("%s: bundling %s failed: %w", module, a.Name, err)
-			}
-		}
 		say("bundle", "compiled, packing")
 		body, err := pack(compiled)
 		if err != nil {
@@ -615,7 +598,7 @@ func one(ctx context.Context, run Runner, publish Publisher,
 		if err != nil {
 			return catalogue.Built{}, err
 		}
-		return catalogue.Built{Name: a.Name, Kind: a.Kind, Reference: where, Digest: digest, Launchers: launchers}, nil
+		return catalogue.Built{Name: a.Name, Kind: a.Kind, Reference: where, Digest: digest}, nil
 
 	case catalogue.ArtifactPackage:
 		// Built and published on a public base, to the mesh's package registry, by version
@@ -985,26 +968,6 @@ func compile(ctx context.Context, run Runner, tree string, chain Toolchain,
 	if _, err := run(ctx, tree, "docker", invocation...); err != nil {
 		return "", err
 	}
-	if chain.Dependencies != "" && chain.Bundler == "" {
-		// **What the bundle runs with, from the image it was compiled in** (Toolchain.Dependencies).
-		// A second run in the same image rather than a shell wrapped around the compiler: the
-		// compile line stays a plain command a reader can run by hand, and the copy is one more
-		// plain command beside it. Refused by name when the image carries no such directory — an
-		// older toolchain image — because a bundle packed without its dependencies starts nowhere
-		// and says so three layers away from here.
-		copying := []string{
-			"run", "--rm",
-			"--volume", tree + ":" + within,
-			"--workdir", within,
-			base,
-			"sh", "-c",
-			`test -d "$1" || { echo "the toolchain image carries no $1: it predates the mesh shipping a bundle's dependencies, rebuild $2 first" >&2; exit 1; }; cp -a "$1/." "$3/"`,
-			"dependencies", chain.Dependencies, chain.Base, out,
-		}
-		if _, err := run(ctx, tree, "docker", copying...); err != nil {
-			return "", fmt.Errorf("copying the %s dependencies a bundle runs with: %w", chain.Language, err)
-		}
-	}
 	return filepath.Join(tree, out), nil
 }
 
@@ -1182,9 +1145,6 @@ func readBy(manifest catalogue.Manifest) []catalogue.ArtifactContext {
 // binaryName is what a compiled bundle's executable is called: what the artifact says, or the name of
 // the package it is built from, which is what a compiler would have chosen anyway.
 func binaryName(a catalogue.Artifact) string {
-	if name := catalogue.BinaryOf(a); name != "" {
-		return name
-	}
 	if name := strings.TrimSpace(a.Binary); name != "" {
 		return name
 	}
@@ -1193,137 +1153,3 @@ func binaryName(a catalogue.Artifact) string {
 	}
 	return a.Name
 }
-
-// launcherSuffix is what a TypeScript entrypoint's launcher is called beside it: index.js is
-// started as index.serve.mjs (novox/hq ADR 0193). An ES module by its own extension, whatever the
-// bundle's package.json says.
-const launcherSuffix = ".serve.mjs"
-
-// writeLaunchers writes, beside every entrypoint of a TypeScript bundle, an executable that
-// imports the entrypoint and serves what it registered over MCP on stdio — through the bundle's
-// own copy of the SDK, so registering and serving meet in one registry (novox/hq ADR 0193). Its
-// answer is each entrypoint's launcher, by entrypoint, relative to the bundle's root; nothing for
-// a language whose build is already executable.
-func writeLaunchers(root string, chain Toolchain, a catalogue.Artifact) (map[string]string, error) {
-	if chain.Language != "typescript" {
-		return nil, nil
-	}
-	out := map[string]string{}
-	for _, entry := range a.Entrypoints {
-		if !strings.HasSuffix(entry, ".js") {
-			continue
-		}
-		launcher := strings.TrimSuffix(entry, ".js") + launcherSuffix
-		body := "#!/usr/bin/env node\n" +
-			"// Written by the mesh's builder (novox/hq ADR 0193): serve what " + entry + " registers,\n" +
-			"// over MCP on stdio, as the module the node's runtime names in MESH_SERVED_MODULE.\n" +
-			"import { serveRegisteredOverStdio } from \"@novox/mesh-sdk/stdio\";\n" +
-			"await import(\"./" + filepath.Base(entry) + "\");\n" +
-			"await serveRegisteredOverStdio();\n"
-		path := filepath.Join(root, filepath.FromSlash(launcher))
-		if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
-			return nil, err
-		}
-		if err := os.WriteFile(path, []byte(body), 0o755); err != nil {
-			return nil, err
-		}
-		// WriteFile honours the umask; the mode a machine unpacks is the one packed, so it is set.
-		if err := os.Chmod(path, 0o755); err != nil {
-			return nil, err
-		}
-		out[entry] = launcher
-	}
-	return out, nil
-}
-
-// bundledSuffix is where a bundle's one-file output is written, beside what the compiler wrote.
-const bundledSuffix = ".bundled"
-
-// bundled makes every entrypoint and every launcher of a compiled bundle ONE file, in the toolchain
-// image's bundler, and answers the directory to pack (novox/hq ADR 0193).
-//
-// **What a launched bundle runs is what it imports, and nothing else.** Every served bundle is its
-// own process, so it carries its own copy of the SDK and its own dependencies inlined — the
-// toolchain's whole node_modules no longer travels in every bundle. An entrypoint a process runs by
-// name (`node daemon/index.js`) is bundled in place under its own name; a launcher keeps its name
-// and its first line, and stays executable. A package the bundler cannot inline is named by the
-// artifact (`external`), kept as an import, and only then is the toolchain's runtime directory
-// copied beside the files. CommonJS inlined into an ES module still finds `require`.
-func bundled(ctx context.Context, run Runner, tree string, chain Toolchain, base string,
-	a catalogue.Artifact, launchers map[string]string) (string, error) {
-	const within = "/app/modules/module"
-	out, final := Out(a.Name), Out(a.Name)+bundledSuffix
-	if err := os.RemoveAll(filepath.Join(tree, final)); err != nil {
-		return "", err
-	}
-	if err := os.MkdirAll(filepath.Join(tree, final), 0o755); err != nil {
-		return "", err
-	}
-	common := []string{"--bundle", "--platform=node", "--format=esm", "--target=node22",
-		"--outbase=" + out, "--outdir=" + final, "--log-level=warning",
-		"--banner:js=import { createRequire as __meshRequire } from 'node:module'; const require = __meshRequire(import.meta.url);"}
-	for _, x := range a.External {
-		common = append(common, "--external:"+x)
-	}
-	var plain []string
-	for _, e := range a.Entrypoints {
-		if strings.HasSuffix(e, ".js") {
-			plain = append(plain, out+"/"+e)
-		}
-	}
-	var launch []string
-	for _, l := range sortedValues(launchers) {
-		launch = append(launch, out+"/"+l)
-	}
-	// Refused by name in an image that predates the bundler, as the dependencies copy is: a bundle
-	// packed without it would carry nothing it imports. Run as itself: npm installs esbuild's native
-	// binary in place of its script, which `node` cannot run.
-	guard := `test -x "$0" || { echo "the toolchain image carries no bundler at $0: it predates one-file bundles, rebuild mesh-tools first" >&2; exit 1; }; exec "$0" "$@"`
-	step := func(entries []string, extra ...string) error {
-		if len(entries) == 0 {
-			return nil
-		}
-		invocation := []string{"run", "--rm", "--volume", tree + ":" + within, "--workdir", within, base,
-			"sh", "-c", guard, chain.Bundler}
-		invocation = append(invocation, entries...)
-		invocation = append(invocation, common...)
-		invocation = append(invocation, extra...)
-		_, err := run(ctx, tree, "docker", invocation...)
-		return err
-	}
-	if err := step(plain); err != nil {
-		return "", err
-	}
-	if err := step(launch, "--out-extension:.js=.mjs"); err != nil {
-		return "", err
-	}
-	// Plain `.js` output is an ES module; said once, as the runtime directory used to say it.
-	if err := os.WriteFile(filepath.Join(tree, final, "package.json"), []byte(`{"type":"module","private":true}`+"\n"), 0o644); err != nil {
-		return "", err
-	}
-	for _, l := range launchers {
-		path := filepath.Join(tree, final, filepath.FromSlash(l))
-		if _, err := os.Stat(path); err == nil {
-			if err := os.Chmod(path, 0o755); err != nil {
-				return "", err
-			}
-		}
-	}
-	if len(a.External) > 0 && chain.Dependencies != "" {
-		copying := []string{"run", "--rm", "--volume", tree + ":" + within, "--workdir", within, base,
-			"sh", "-c", `cp -a "$0/node_modules" "$1/"`, chain.Dependencies, final}
-		if _, err := run(ctx, tree, "docker", copying...); err != nil {
-			return "", fmt.Errorf("copying the packages %s keeps external: %w", a.Name, err)
-		}
-	}
-	return filepath.Join(tree, final), nil
-}
-
-func sortedValues(m map[string]string) []string {
-	out := make([]string, 0, len(m))
-	for _, v := range m {
-		out = append(out, v)
-	}
-	sort.Strings(out)
-	return out
-}

internal/builder/bundle_test.go

@@ -82,65 +82,6 @@ func TestABundleIsCompiledAndPackedWithNoDockerfile(t *testing.T) {
 	if !strings.HasPrefix(digest, "sha256:") {
 		t.Fatalf("the bundle was not pinned: %v", got.Manifest.Resources[0])
 	}
-
-	// **One file per entrypoint and launcher, in the toolchain's bundler** (novox/hq ADR 0193). A
-	// second run in the same toolchain image bundles each into the artifact's bundled output, the SDK
-	// inlined, refusing by name in an image that predates the bundler; and the toolchain's
-	// node_modules is no longer copied into a bundle that keeps nothing external.
-	var bundling []string
-	for _, line := range r.ran {
-		if strings.HasPrefix(line, "docker run") && strings.Contains(line, "esbuild") {
-			bundling = append(bundling, line)
-		}
-	}
-	if len(bundling) != 2 {
-		t.Fatalf("want one bundling run for the entrypoints and one for the launchers:\n%s", strings.Join(r.ran, "\n"))
-	}
-	for _, want := range []string{"mesh-tools/build@sha256:", "predates one-file bundles", "--bundle", "--format=esm",
-		"--platform=node", "--outdir=" + Out("code") + ".bundled", Out("code") + "/index.js"} {
-		if !strings.Contains(bundling[0], want) {
-			t.Errorf("the entrypoints' bundling lacks %q: %s", want, bundling[0])
-		}
-	}
-	if !strings.Contains(bundling[1], Out("code")+"/index.serve.mjs") || !strings.Contains(bundling[1], "--out-extension:.js=.mjs") {
-		t.Errorf("the launcher is not bundled under its own name: %s", bundling[1])
-	}
-	if strings.Contains(strings.Join(r.ran, "\n"), "/app/runtime") {
-		t.Errorf("the toolchain's node_modules was copied into a bundle that keeps nothing external:\n%s", strings.Join(r.ran, "\n"))
-	}
-	if strings.Index(strings.Join(r.ran, "\n"), "--outDir") > strings.Index(strings.Join(r.ran, "\n"), "esbuild") {
-		t.Fatal("the bundler ran before the compile wrote its output")
-	}
-}
-
-// A bundle naming packages it keeps external is bundled with them as imports, and carries the
-// toolchain's node_modules for them — the one case it still does.
-func TestABundleKeepingAPackageExternalCarriesTheToolchainsModules(t *testing.T) {
-	manifest := strings.Replace(aBundle, `"entrypoints":["index.js"]`, `"entrypoints":["index.js"],"external":["sharp"]`, 1)
-	r, workspace := aRepository(t, manifest, map[string]string{"index.ts": "console.log(1)"})
-	held := map[string]string{"mesh-tools/build": "registry.invalid/mesh-tools/build@sha256:" + strings.Repeat("b", 64)}
-	if _, err := Build(context.Background(), compiling{r}.run, r,
-		"https://forge.invalid/greeter.git", "", "", workspace, held, Npmrc{}, GitCredential{}, nil); err != nil {
-		t.Fatal(err)
-	}
-	all := strings.Join(r.ran, "\n")
-	if !strings.Contains(all, "--external:sharp") || !strings.Contains(all, "/app/runtime") {
-		t.Errorf("an external package was not kept as an import with the toolchain's modules beside it:\n%s", all)
-	}
-}
-
-// A language whose bundle carries its own dependencies copies nothing in: a Go binary is static.
-func TestOnlyALanguageWithARuntimeDirectoryCopiesDependenciesIn(t *testing.T) {
-	ts, _ := ToolchainFor("typescript")
-	if ts.Dependencies != "/app/runtime" {
-		t.Fatalf("typescript bundles run with %q", ts.Dependencies)
-	}
-	for _, language := range []string{"go", "python"} {
-		chain, _ := ToolchainFor(language)
-		if chain.Dependencies != "" {
-			t.Fatalf("%s copies %q into every bundle, and its bundles carry their own", language, chain.Dependencies)
-		}
-	}
 }
 
 // **Refused before anything is built, naming what to build first.** A base the mesh has not built
@@ -204,13 +145,9 @@ func TestTwoBundlesInOneModuleArePackedSeparately(t *testing.T) {
 		t.Fatalf("a module with two bundles did not build: %v", err)
 	}
 
-	// Compiled into two different places. Only the compile lines: the copy of each bundle's
-	// dependencies names the same directory again, deliberately.
+	// Compiled into two different places.
 	var outputs []string
 	for _, line := range r.ran {
-		if !strings.Contains(line, "--outDir") {
-			continue
-		}
 		for _, part := range strings.Fields(line) {
 			if strings.HasPrefix(part, ".mesh-build/") {
 				outputs = append(outputs, part)

internal/builder/dependencies.go

@@ -1,147 +0,0 @@
-package builder
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"os"
-	"path/filepath"
-	"sort"
-	"strings"
-)
-
-// A module's own packages, installed before its bundle is compiled, so the bundler inlines them.
-//
-// **A bundle could only import what the toolchain happened to carry.** The compiler and the bundler
-// resolve an import by walking up from the module's source: the module's own directory first, then
-// the toolchain image's node_modules. Nothing ever put anything in the first, so a module needing a
-// database driver (`pg`, `mongodb`, `mssql`) could not be a bundle at all, and kept a container whose
-// recipe installed it by hand (novox/hq ADR 0198 §4: "the backend's own driver inside the bundle").
-// Now the module's `package.json` says what it depends on, as any Node package does, and the build
-// installs exactly that into the module's own directory before compiling.
-//
-// **The SDK the toolchain carries is the one a bundle is built with, whatever the module says**
-// (novox/hq issue 212: the toolchain is rebuilt on every SDK release and every bundle after it). A
-// module's `package.json` names `@novox/mesh-sdk` with a range — it has to, to type-check on a
-// workstation — and installing that range would shadow the toolchain's copy for this module alone:
-// one module compiled against an older SDK than its neighbours, chosen by a caret nobody re-reads.
-// So the SDK is taken out of what is installed (and never fetched), and any copy something else
-// pulls in is removed afterwards; every import of it resolves past the module's node_modules to the
-// toolchain's. A module therefore cannot pin a different SDK, by design: the toolchain is the pin.
-//
-// **Correctness before speed.** Every build installs afresh into a fresh clone, from the lockfile
-// when the module has one (`npm ci`, exact) and from its ranges otherwise; nothing installed is kept
-// between builds. What is shared is npm's own download cache, a named volume, which is
-// content-addressed and verified by integrity on every read — it saves the network, never the
-// install. Install scripts do not run: the build node runs nobody's postinstall, and what a script
-// would build natively could not be inlined into one file anyway.
-
-// sdkPackage is the package a TypeScript bundle's launcher serves through, and the one package a
-// module's own dependencies never supply (above).
-const sdkPackage = "@novox/mesh-sdk"
-
-// npmCache is the named volume npm's download cache lives in across builds on one build node.
-const npmCache = "mesh-builder-npm-cache"
-
-// ownDependencies is what a module's package.json depends on beyond the SDK, sorted; nothing when
-// the module has no package.json or depends on nothing else — which builds exactly as before.
-func ownDependencies(tree string) ([]string, error) {
-	raw, err := os.ReadFile(filepath.Join(tree, "package.json"))
-	if errors.Is(err, os.ErrNotExist) {
-		return nil, nil
-	}
-	if err != nil {
-		return nil, err
-	}
-	var p struct {
-		Dependencies map[string]string `json:"dependencies"`
-	}
-	if err := json.Unmarshal(raw, &p); err != nil {
-		return nil, fmt.Errorf("the module's package.json is not JSON: %w", err)
-	}
-	var names []string
-	for name := range p.Dependencies {
-		if name != sdkPackage {
-			names = append(names, name)
-		}
-	}
-	sort.Strings(names)
-	return names, nil
-}
-
-// installSteps is the script run inside the toolchain image, from the module's own directory ($0).
-// It works in a scratch copy so the module's package.json and lockfile are never rewritten, takes
-// the SDK out of what is installed, installs production dependencies only, removes any copy of the
-// SDK something pulled in, and puts the result at the module's node_modules.
-const installSteps = `set -e
-work="$(mktemp -d)"
-cp "$0/package.json" "$work/"
-if [ -f "$0/package-lock.json" ]; then cp "$0/package-lock.json" "$work/"; fi
-cd "$work"
-node -e '
-const fs = require("fs"), sdk = process.argv[1];
-const p = JSON.parse(fs.readFileSync("package.json", "utf8"));
-for (const k of ["dependencies", "peerDependencies", "optionalDependencies"]) if (p[k]) delete p[k][sdk];
-delete p.devDependencies; delete p.scripts;
-fs.writeFileSync("package.json", JSON.stringify(p));
-' "$1"
-shift
-if [ -f package-lock.json ]; then
-  npm ci --omit=dev --omit=peer --ignore-scripts --no-audit --no-fund "$@"
-else
-  npm install --omit=dev --omit=peer --ignore-scripts --no-audit --no-fund --no-package-lock "$@"
-fi
-find node_modules -depth -type d -path "*/node_modules/@novox/mesh-sdk" -exec rm -rf {} +
-rm -rf "$0/node_modules"
-cp -a node_modules "$0/node_modules"
-`
-
-// installOwn installs a TypeScript module's own production dependencies into its directory, in the
-// toolchain image, before the compile — or does nothing at all for a module that has none.
-func installOwn(ctx context.Context, run Runner, tree string, chain Toolchain, base string,
-	registry Npmrc, say func(step, format string, args ...any)) error {
-	if chain.Language != "typescript" {
-		return nil
-	}
-	deps, err := ownDependencies(tree)
-	if err != nil || len(deps) == 0 {
-		return err
-	}
-	scoped := strings.TrimSpace(registry.Scope)
-	if !registry.Enabled() {
-		// **No registry, no scoped package.** Without the mesh's registry a scoped name resolves on
-		// the public one, where anybody may have published it: a dependency that installs is not
-		// the dependency the module meant.
-		for _, d := range deps {
-			if strings.HasPrefix(d, "@novox/") {
-				return fmt.Errorf("the module depends on %s, and this build knows no package registry "+
-					"for its scope; it would resolve from the public registry, which is not where the "+
-					"mesh publishes it", d)
-			}
-		}
-	}
-	const within = "/app/modules/module"
-	invocation := []string{"run", "--rm",
-		"--volume", tree + ":" + within,
-		"--volume", npmCache + ":/root/.npm",
-		"--workdir", within}
-	var flags []string
-	if registry.Enabled() {
-		// The registry is reached where the binding says it is, which may be this machine's own
-		// loopback — the reason an image build that resolves packages runs on the host network too.
-		invocation = append(invocation, "--network", "host")
-		reg := strings.TrimSpace(registry.Registry)
-		if !strings.HasSuffix(reg, "/") {
-			reg += "/"
-		}
-		flags = append(flags, "--"+scoped+":registry="+reg)
-	}
-	invocation = append(invocation, base, "sh", "-c", installSteps, within, sdkPackage)
-	invocation = append(invocation, flags...)
-	say("bundle", "installing the module's own packages: %s", strings.Join(deps, ", "))
-	if _, err := run(ctx, tree, "docker", invocation...); err != nil {
-		return fmt.Errorf("installing the module's own packages (%s): %w", strings.Join(deps, ", "), err)
-	}
-	return nil
-}

internal/builder/dependencies_test.go

@@ -1,131 +0,0 @@
-package builder
-
-import (
-	"context"
-	"strings"
-	"testing"
-)
-
-// A module's own packages (dependencies.go): installed into its own directory, in the toolchain,
-// before the compile, so the bundler inlines them — the SDK always the toolchain's.
-
-func buildWithPackageJSON(t *testing.T, pkg string, extra map[string]string, registry Npmrc) (*recorded, error) {
-	t.Helper()
-	files := map[string]string{"index.ts": "console.log(1)"}
-	if pkg != "" {
-		files["package.json"] = pkg
-	}
-	for k, v := range extra {
-		files[k] = v
-	}
-	r, workspace := aRepository(t, aBundle, files)
-	held := map[string]string{"mesh-tools/build": "registry.invalid/mesh-tools/build@sha256:" + strings.Repeat("b", 64)}
-	_, err := Build(context.Background(), compiling{r}.run, r,
-		"https://forge.invalid/greeter.git", "", "", workspace, held, registry, GitCredential{}, nil)
-	return r, err
-}
-
-func installs(r *recorded) []string {
-	var out []string
-	for _, line := range r.ran {
-		if strings.HasPrefix(line, "docker run") && strings.Contains(line, "npm ci") {
-			out = append(out, line)
-		}
-	}
-	return out
-}
-
-func compileIndex(r *recorded) int {
-	for i, line := range r.ran {
-		if strings.Contains(line, "--outDir") {
-			return i
-		}
-	}
-	return -1
-}
-
-func TestAModulesOwnPackagesAreInstalledInTheToolchainBeforeTheCompile(t *testing.T) {
-	r, err := buildWithPackageJSON(t, `{"type":"module","dependencies":{"@novox/mesh-sdk":"^0.1.0","pg":"^8"},"devDependencies":{"typescript":"^5"}}`,
-		nil, Npmrc{Scope: "@novox", Registry: "https://forge.invalid/api/packages/novox/npm"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	got := installs(r)
-	if len(got) != 1 {
-		t.Fatalf("want one install of the module's own packages:\n%s", strings.Join(r.ran, "\n"))
-	}
-	line := got[0]
-	for _, want := range []string{
-		"mesh-tools/build@sha256:",       // in the toolchain image
-		":/app/modules/module",           // into the module's own directory
-		"--workdir /app/modules/module",  //
-		npmCache + ":/root/.npm",         // npm's verified download cache, and only that
-		"--omit=dev", "--ignore-scripts", // production packages, no build-node scripts
-		"npm ci", "npm install", "--no-package-lock", // the lockfile when there is one, else the ranges
-		"--@novox:registry=https://forge.invalid/api/packages/novox/npm/", // the scope from the mesh's registry
-		"--network host",
-		"@novox/mesh-sdk", // named, to be taken out of what is installed
-	} {
-		if !strings.Contains(line, want) {
-			t.Errorf("the install lacks %q:\n%s", want, line)
-		}
-	}
-	// The SDK is the toolchain's: never installed from the module's range, and any copy removed.
-	if !strings.Contains(line, `delete p[k][sdk]`) || !strings.Contains(line, `-path "*/node_modules/@novox/mesh-sdk" -exec rm -rf`) {
-		t.Errorf("the module's own SDK range could shadow the toolchain's SDK:\n%s", line)
-	}
-	if i, c := strings.Index(strings.Join(r.ran, "\n"), "npm ci"), compileIndex(r); c < 0 ||
-		i > strings.Index(strings.Join(r.ran, "\n"), "--outDir") {
-		t.Fatalf("the install did not run before the compile:\n%s", strings.Join(r.ran, "\n"))
-	}
-}
-
-// **A module with nothing beyond the SDK builds exactly as before**: the same commands, no install.
-func TestAModuleDependingOnlyOnTheSDKBuildsExactlyAsBefore(t *testing.T) {
-	without, err := buildWithPackageJSON(t, "", nil, Npmrc{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, pkg := range []string{
-		`{"type":"module","dependencies":{"@novox/mesh-sdk":"^0.1.0"},"devDependencies":{"typescript":"^5"}}`,
-		`{"type":"module"}`,
-	} {
-		with, err := buildWithPackageJSON(t, pkg, map[string]string{"package-lock.json": "{}"}, Npmrc{Scope: "@novox", Registry: "https://forge.invalid/npm/"})
-		if err != nil {
-			t.Fatal(err)
-		}
-		if strings.Contains(strings.Join(with.ran, "\n"), "npm ") {
-			t.Fatalf("a module depending on nothing but the SDK ran npm:\n%s", strings.Join(with.ran, "\n"))
-		}
-		if len(with.ran) != len(without.ran) {
-			t.Fatalf("a module depending only on the SDK built differently from one with no package.json:\n%s\n---\n%s",
-				strings.Join(with.ran, "\n"), strings.Join(without.ran, "\n"))
-		}
-	}
-}
-
-// Without the mesh's registry a scoped package would resolve on the public one: refused by name.
-func TestAScopedPackageWithNoRegistryIsRefused(t *testing.T) {
-	r, err := buildWithPackageJSON(t, `{"dependencies":{"@novox/mesh-sdk":"^0.1.0","@novox/other":"^1"}}`, nil, Npmrc{})
-	if err == nil || !strings.Contains(err.Error(), "@novox/other") {
-		t.Fatalf("a scoped package was installed with no registry for its scope: %v", err)
-	}
-	if strings.Contains(strings.Join(r.ran, "\n"), "--outDir") {
-		t.Fatal("the compile ran after the refusal")
-	}
-	// A public package installs without one, from the public registry and nothing else.
-	r, err = buildWithPackageJSON(t, `{"dependencies":{"mssql":"^11"}}`, nil, Npmrc{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got := installs(r); len(got) != 1 || strings.Contains(got[0], ":registry=") || strings.Contains(got[0], "--network host") {
-		t.Fatalf("a public package's install: %v", got)
-	}
-}
-
-func TestAnUnreadablePackageJSONIsRefusedByName(t *testing.T) {
-	_, err := buildWithPackageJSON(t, `{"dependencies":`, nil, Npmrc{})
-	if err == nil || !strings.Contains(err.Error(), "package.json") {
-		t.Fatalf("a broken package.json was not refused by name: %v", err)
-	}
-}

internal/builder/launchers_test.go

@@ -1,49 +0,0 @@
-package builder
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/catalogue"
-)
-
-// novox/hq ADR 0193: every entrypoint the runtime may serve is executable, and the runtime knows no
-// language — so a TypeScript bundle carries a launcher beside each entrypoint.
-func TestATypeScriptBundleCarriesAnExecutableLauncherBesideEachEntrypoint(t *testing.T) {
-	root := t.TempDir()
-	chain, err := ToolchainFor("typescript")
-	if err != nil {
-		t.Fatal(err)
-	}
-	got, err := writeLaunchers(root, chain, catalogue.Artifact{Name: "tools", Kind: catalogue.ArtifactBundle,
-		Language: "typescript", Entrypoints: []string{"tools/index.js", "index.js"}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got["tools/index.js"] != "tools/index.serve.mjs" || got["index.js"] != "index.serve.mjs" {
-		t.Fatalf("launchers: %v", got)
-	}
-	path := filepath.Join(root, "tools", "index.serve.mjs")
-	info, err := os.Stat(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if info.Mode().Perm() != 0o755 {
-		t.Errorf("the launcher is %v, not executable 0755", info.Mode().Perm())
-	}
-	body, _ := os.ReadFile(path)
-	for _, want := range []string{"#!/usr/bin/env node\n", `from "@novox/mesh-sdk/stdio"`, `await import("./index.js")`, "serveRegisteredOverStdio()"} {
-		if !strings.Contains(string(body), want) {
-			t.Errorf("the launcher lacks %q:\n%s", want, body)
-		}
-	}
-
-	// A compiled language's build is executable already: no launcher.
-	goChain, _ := ToolchainFor("go")
-	none, err := writeLaunchers(t.TempDir(), goChain, catalogue.Artifact{Name: "tools", Kind: catalogue.ArtifactBundle, Language: "go"})
-	if err != nil || len(none) != 0 {
-		t.Errorf("a Go bundle was given launchers: %v %v", none, err)
-	}
-}

internal/builder/standing_on_test.go

@@ -200,23 +200,3 @@ func TestWhatABuildReadIsTheRepositoriesItsRecipesName(t *testing.T) {
 		t.Fatal("a module whose recipes name no other repository read one")
 	}
 }
-
-// novox/hq 04-ISSUES/212: a toolchain stands on the SDK's published package, and is built with the
-// exact version the mesh published — an argument that changes when the SDK does, so a rebuild after
-// a release never reuses an install of the version before it.
-func TestAPackageTheMeshPublishedIsPassedByItsExactVersion(t *testing.T) {
-	manifest := catalogue.Manifest{
-		Module: "mesh-tools",
-		Build: &catalogue.Build{
-			On: []catalogue.BuildsOn{{Arg: "MESH_SDK", Module: "mesh-sdk", Artifact: "lib"}},
-		},
-	}
-	held := map[string]string{"mesh-sdk/lib": "@novox/mesh-sdk@0.1.6"}
-	args, resolved, err := standingOn(context.Background(), manifest, held, noMirror)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if fmt.Sprint(args) != "[--build-arg MESH_SDK=@novox/mesh-sdk@0.1.6]" || fmt.Sprint(resolved) != "[@novox/mesh-sdk@0.1.6]" {
-		t.Errorf("the package was passed as %v, recorded as %v", args, resolved)
-	}
-}

internal/builder/toolchain.go

@@ -57,33 +57,6 @@ type Toolchain struct {
 	// carrying its debug info. The mistake was believing a comment rather than reading the file it
 	// produced (novox/hq 04-ISSUES/161).
 	LinkerFlags []string
-	// Dependencies is a directory inside the toolchain image whose contents a bundle in this
-	// language runs with, copied whole into the compiled output's root after the compile.
-	//
-	// **A bundle that compiles is not yet a bundle that runs.** The compiler resolves `import
-	// "nats"` from the toolchain image's own node_modules and the pack takes only what the compiler
-	// wrote, so what a machine unpacked could not find a single dependency — and no TypeScript bundle
-	// had ever run live to show it (novox/hq to-be 38 WP3). For TypeScript the directory holds a
-	// `package.json` saying `"type": "module"` — Node reads a bare `.js` as CommonJS otherwise, so a
-	// bundle with its dependencies and without that line still fails to start — and the pruned,
-	// production-only node_modules the runtime itself ships with: the SDK's and the runtime's
-	// dependencies, and nothing module-specific (a module's own npm dependencies are installed into
-	// its own directory before the compile and inlined by the bundler: dependencies.go). Empty for a
-	// language whose bundle carries its own —
-	// a Go binary is static, a Python bundle is installed with its dependencies.
-	//
-	// A toolchain image without the directory fails the build by name rather than packing a bundle
-	// that starts nowhere: the image predates this and must be rebuilt first.
-	//
-	// *Since the bundler (below):* copied only for a bundle that names packages it keeps external,
-	// which cannot be inlined; a bundle with none carries no node_modules at all.
-	Dependencies string
-	// Bundler is the bundler inside the toolchain image that makes each compiled entrypoint and each
-	// launcher ONE self-contained file (novox/hq ADR 0193): every served bundle is its own process
-	// now, so each carries its own copy of what it imports — the SDK included — and nothing else.
-	// A bundle shrinks from the toolchain's whole node_modules to the code it runs. Empty for a
-	// language whose build is already one file.
-	Bundler string
 	// SystemStamp is the variable this language's linker fills with the artifact's declared system,
 	// for a language whose binaries are pinned to one at link time (novox/hq ADR 0005).
 	//
@@ -134,22 +107,14 @@ var toolchains = []Toolchain{
 		// symlinks to a launcher that requires its library relatively — and the base image's own
 		// assembly resolves them away, leaving a launcher whose relative require points nowhere.
 		// Every module's hand-written Dockerfile had to know this. Now none of them does.
-		// **Rooted at the module, so an entrypoint lands where it is named.** Without a root the
-		// compiler takes the common directory of the files it is given: a module compiling only
-		// `tools/index.ts` had its output at `index.js`, and the entrypoint it declared —
-		// `tools/index.js`, "named as it will be found" — named a file the bundle did not
-		// contain. The runtime that loads bundles by their declared entrypoints (novox/hq ADR
-		// 0175) is what made this visible.
 		Compile: []string{
 			"node", "/app/node_modules/typescript/bin/tsc",
 			"--module", "NodeNext", "--moduleResolution", "NodeNext",
-			"--target", "ES2022", "--rootDir", ".",
+			"--target", "ES2022",
 		},
-		OutputFlag:   "--outDir",
-		Unit:         UnitSources,
-		SourceExt:    ".ts",
-		Dependencies: "/app/runtime",
-		Bundler:      "/app/node_modules/esbuild/bin/esbuild",
+		OutputFlag: "--outDir",
+		Unit:       UnitSources,
+		SourceExt:  ".ts",
 	},
 	{
 		Language: "go",

internal/catalogue/a_service_process_test.go

@@ -1,166 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-)
-
-// novox/hq issue 213 (ADR 0188 §1, §3): a module's own Go service is a bundle the host runs as a
-// process, not an image. Each test holds one thing that had to change in the composer for the
-// controller to be declared that way.
-
-const aServiceDigest = "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
-
-// aServiceModule is the controller's shape in miniature: it answers tools of its own, its code is a
-// Go bundle a process runs as an account it declares, its secrets belong to that account, it
-// prepares its state, and its process replaces the container it used to run as.
-func aServiceModule(t *testing.T) Manifest {
-	t.Helper()
-	raw := `{
-	  "module": "svc", "version": "1", "tools": ["status"], "prepares": true,
-	  "own-secrets": {"store": "${dir:state}/store"},
-	  "secrets-owner": "svc",
-	  "resources": [
-	    {"id": "state", "type": "directory", "mode": "0700", "place": "mesh", "owner": "svc"},
-	    {"id": "service", "type": "process", "name": "svc", "artifact": "code",
-	     "run": ["./svc", "serve"], "user": "svc", "replaces": ["server"],
-	     "env": {"SVC_STORE_FILE": "${dir:state}/store", "SVC_STORE_PORT": "${seat:mesh-store:5432}"}},
-	    {"id": "account", "type": "user", "name": "svc", "shell": "/usr/bin/nologin", "home": "/var/lib/svc"}
-	  ],
-	  "build": {"artifacts": [{"name": "code", "kind": "bundle", "language": "go", "system": "arch",
-	    "from": "cmd/svc", "binary": "svc"}]}
-	}`
-	m, err := ParseManifest([]byte(raw))
-	if err != nil {
-		t.Fatalf("the service's manifest is refused: %v", err)
-	}
-	resolved, err := m.Resolve([]Built{{Name: "code", Kind: ArtifactBundle,
-		Reference: ArtifactStoreScheme + "svc/code@" + aServiceDigest, Digest: aServiceDigest}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	return resolved
-}
-
-func composeTheService(t *testing.T, with Rendering) []map[string]any {
-	t.Helper()
-	with.Needed = map[string]map[string]string{"svc": {"store": "sealed-store"}}
-	with.ArtifactStore = "anchor.internal:5100"
-	out, err := Resolution{Node: "anchor", Modules: []Manifest{aServiceModule(t)}}.Declaration(with)
-	if err != nil {
-		t.Fatalf("the service does not compose: %v", err)
-	}
-	return out
-}
-
-func indexOf(out []map[string]any, id string) int {
-	for i, r := range out {
-		if r["id"] == id {
-			return i
-		}
-	}
-	return -1
-}
-
-// A module that declares tools has every bundle served by the node's runtime unless it says
-// otherwise — and the controller declares the verbs it answers as tools. Its service bundle is run
-// by its own process; launched a second time by the runtime it would be a second controller
-// pretending to be an MCP server.
-func TestABundleItsOwnProcessRunsIsNotServedByTheRuntime(t *testing.T) {
-	m := aServiceModule(t)
-	if len(m.Bundles) != 1 {
-		t.Fatalf("the service's bundle was not kept: %+v", m.Bundles)
-	}
-	if loads := m.Bundles[0].Loads; len(loads) != 0 {
-		t.Fatalf("the runtime would launch the service's own bundle as tools: %v", loads)
-	}
-	// And a bundle no resource runs still is served, as a module declaring tools always had it.
-	tools := Manifest{Module: "t", Version: "1", Tools: []string{"x"},
-		Build: &Build{Artifacts: []Artifact{{Name: "tools", Kind: ArtifactBundle, Language: "go",
-			System: "arch", From: "cmd/t"}}}}
-	resolved, err := tools.Resolve([]Built{{Name: "tools", Kind: ArtifactBundle,
-		Reference: ArtifactStoreScheme + "t/tools@" + aServiceDigest, Digest: aServiceDigest}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if loads := resolved.Bundles[0].Loads; len(loads) != 1 || loads[0] != "t" {
-		t.Fatalf("a tools bundle nothing runs is no longer served: %v", loads)
-	}
-}
-
-// The account is created before anything is given to it. Its secrets are mesh-computed and so
-// placed before the module's own resources; given to a user the machine did not have yet, they were
-// refused on the first apply and the process started without them.
-func TestAModulesAccountComesBeforeWhatBelongsToIt(t *testing.T) {
-	out := composeTheService(t, Rendering{})
-	account, secret := indexOf(out, "svc.account"), indexOf(out, "svc."+NeedID("store"))
-	if account < 0 || secret < 0 {
-		t.Fatalf("the account or the secret is missing: %v", out)
-	}
-	if account > secret {
-		t.Fatalf("the secret owned by svc is written before svc exists: account at %d, secret at %d",
-			account, secret)
-	}
-	if owner := out[secret]["owner"]; owner != "svc" {
-		t.Errorf("the secret belongs to %v, not the account its process runs as", owner)
-	}
-}
-
-// The process is the module's program; its preparation is the same program asked to prepare, as a
-// step before it — with the same account and environment, and handing nothing over.
-func TestAProcessIsPreparedByItsOwnProgram(t *testing.T) {
-	out := composeTheService(t, Rendering{})
-	step, process := indexOf(out, "svc.service-prepare"), indexOf(out, "svc.service")
-	if step < 0 || process < 0 || step > process {
-		t.Fatalf("the preparation is not a step before the process (%d, %d): %v", step, process, out)
-	}
-	s := out[step]
-	if s["type"] != "process" || s["run-once"] != true || s["name"] != "svc-prepare" {
-		t.Errorf("the preparation is not a run-once process: %v", s)
-	}
-	if run, _ := json.Marshal(s["run"]); string(run) != `["./svc","prepare"]` {
-		t.Errorf("the preparation runs %s", run)
-	}
-	if s["user"] != "svc" || s["source"] != out[process]["source"] {
-		t.Errorf("the preparation does not run the same bundle as the same account: %v", s)
-	}
-	if env, _ := s["env"].(map[string]any); env["SVC_STORE_FILE"] == nil {
-		t.Errorf("the preparation is not given the process's environment: %v", s["env"])
-	}
-	if _, has := s["replaces"]; has {
-		t.Errorf("the preparation would hand over what the process replaces: %v", s)
-	}
-	if _, has := s["args"]; has {
-		t.Errorf("the preparation carries a container's args: %v", s)
-	}
-}
-
-// What the process replaces is named as the host recorded it, `<module>.<id>`; unprefixed, the host
-// matches nothing and removes the container first, as before.
-func TestWhatAProcessReplacesIsNamedAsTheHostRecordedIt(t *testing.T) {
-	out := composeTheService(t, Rendering{})
-	p := out[indexOf(out, "svc.service")]
-	if got, _ := json.Marshal(p["replaces"]); string(got) != `["svc.server"]` {
-		t.Fatalf("the process replaces %s", got)
-	}
-}
-
-func TestWhatReplacesMayNameIsRefusedNearItsAuthor(t *testing.T) {
-	for what, resource := range map[string]string{
-		"a container":        `{"id":"c","type":"container","name":"c","image":"x@` + aServiceDigest + `","replaces":["old"]}`,
-		"a step":             `{"id":"p","type":"process","name":"p","run":["./p"],"run-once":true,"replaces":["old"]}`,
-		"something declared": `{"id":"p","type":"process","name":"p","run":["./p"],"replaces":["p"]}`,
-		"another module's":   `{"id":"p","type":"process","name":"p","run":["./p"],"replaces":["other.old"]}`,
-		"not a list":         `{"id":"p","type":"process","name":"p","run":["./p"],"replaces":"old"}`,
-	} {
-		raw := `{"module":"m","version":"1","resources":[` + resource + `]}`
-		if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), "replace") {
-			t.Errorf("replaces on %s was accepted: %v", what, err)
-		}
-	}
-	ok := `{"module":"m","version":"1","resources":[{"id":"p","type":"process","name":"p","run":["./p"],"replaces":["old"]}]}`
-	if _, err := ParseManifest([]byte(ok)); err != nil {
-		t.Errorf("a process replacing what its module no longer declares was refused: %v", err)
-	}
-}

internal/catalogue/bound_into_files.go

@@ -61,7 +61,7 @@ func knownFor(m Manifest, needs []Needed, node string) (map[string]map[string]st
 				"as":   as,
 			}
 			// What the provider derives for this consumer rather than for all of them
-			// (novox/hq ADR 0201). Filled here, the one place a provision and the module
+			// (novox/hq ADR 0188). Filled here, the one place a provision and the module
 			// requiring it are both in hand.
 			served, err := ServedTo(n.Serves, as)
 			if err != nil {

internal/catalogue/build.go

@@ -2,7 +2,6 @@ package catalogue
 
 import (
 	"fmt"
-	"path"
 	"sort"
 	"strings"
 )
@@ -29,9 +28,6 @@ type Built struct {
 	Reference string
 	// Digest is "sha256:<hex>", for an archive. An image reference already ends in one.
 	Digest string
-	// Launchers are, for a bundle in an interpreted language, the executable the build wrote beside
-	// each entrypoint, by entrypoint (novox/hq ADR 0193): what the node's runtime starts to serve it.
-	Launchers map[string]string
 }
 
 // Resolve fills a manifest's resources in from what was built.
@@ -71,49 +67,6 @@ func (m Manifest) Resolve(built []Built) (Manifest, error) {
 	out := m
 	out.Build = nil
 	out.Resources = nil
-	// What the build compiled, kept on the resolved manifest (novox/hq ADR 0175): a tools bundle is
-	// named by no resource of the module's own — the node's runtime loads it — so this is the only
-	// place the mesh would otherwise not have it. In artifact order, so two resolutions of one
-	// build compare equal.
-	out.Bundles = nil
-	if m.Build != nil {
-		run := runByAResource(m)
-		for _, a := range m.Build.Artifacts {
-			if a.Kind != ArtifactBundle {
-				continue
-			}
-			made := by[a.Name]
-			// What the runtime loads: what the artifact said, else every entrypoint of a module
-			// that declares tools, else nothing (the field's own rule; see Artifact.Loads).
-			//
-			// **Never, unasked, a bundle one of the module's own resources runs** (novox/hq issue 213).
-			// A process the host runs is the module's service, not its tools: the controller declares
-			// the verbs it answers as `tools` and serves them itself, and its bundle would otherwise
-			// have been launched a second time by the node's runtime, as an MCP child it is not.
-			loads := append([]string(nil), a.Loads...)
-			if a.Loads == nil && len(m.Tools) > 0 && !run[a.Name] {
-				loads = append([]string(nil), a.Entrypoints...)
-				// A bundle compiled to a binary has no entrypoints: the binary is what it is, and what
-				// the runtime starts to serve it (novox/hq ADR 0193). So a Go tools bundle is served
-				// as Go — the runtime execs it — exactly as a TypeScript one is through its launcher.
-				if bin := BinaryOf(a); bin != "" {
-					loads = []string{bin}
-				}
-			}
-			// **Kept, never routed** (ADR 0155): the builder publishes to the store at the address
-			// it reached it by, and a manifest carrying that address names an installation —
-			// registration refused node-tools for exactly this on 2026-10-02. The build record
-			// already keeps the store-relative form; the resolved manifest keeps the same, and
-			// composition routes it through the store a machine reaches (Routed).
-			out.Bundles = append(out.Bundles, Bundle{
-				Name: a.Name, Source: Recorded(made.Reference), Digest: made.Digest,
-				Language: a.Language, Entrypoints: append([]string(nil), a.Entrypoints...),
-				Loads: loads, Env: copyWords(a.Env), Launchers: copyWords(made.Launchers),
-				Binary: BinaryOf(a),
-			})
-		}
-		sort.Slice(out.Bundles, func(i, j int) bool { return out.Bundles[i].Name < out.Bundles[j].Name })
-	}
 	for _, r := range m.Resources {
 		named, _ := r["artifact"].(string)
 		if named == "" {
@@ -157,8 +110,7 @@ func (m Manifest) Resolve(built []Built) (Manifest, error) {
 			// The same on the wire: both are bytes fetched by digest and unpacked. They differ in
 			// how they were made — one packed as it stood, the other compiled first — and a
 			// machine has no reason to care which.
-			// Kept, not routed, for the reason the bundles above are (ADR 0155).
-			filled["source"] = Recorded(artifact.Reference)
+			filled["source"] = artifact.Reference
 			filled["digest"] = artifact.Digest
 			// **And `${version}`, so a resource can name a place that is this build's alone**
 			// (novox/hq ADR 0141, 04-ISSUES/142). A component is unpacked into a directory named
@@ -220,17 +172,6 @@ func (b *Build) problems(module string) []string {
 		// A bundle's source is the module's own directory by definition, and what it needs to say
 		// is which compiler — because the mesh chooses that, and cannot choose for a module that
 		// has not said.
-		if len(a.External) > 0 && (a.Kind != ArtifactBundle || a.Language != "typescript") {
-			problems = append(problems, fmt.Sprintf(
-				"%s: %q names packages it keeps external, and only a TypeScript bundle is bundled into "+
-					"one file with some kept out (novox/hq ADR 0193)", module, a.Name))
-		}
-		if len(a.Env) > 0 && a.Kind != ArtifactBundle {
-			problems = append(problems, fmt.Sprintf(
-				"%s: %q is a %q and says what it is given (env). Only a bundle the node's runtime "+
-					"serves is given words (novox/hq ADR 0192); a container says its own environment",
-				module, a.Name, a.Kind))
-		}
 		if a.Kind == ArtifactBundle || a.Kind == ArtifactPackage {
 			// **Except for a language that compiles to a binary, where it names which one**
 			// (novox/hq 04-ISSUES/142). A bundle in an interpreted language is the module's own
@@ -250,26 +191,6 @@ func (b *Build) problems(module string) []string {
 					"%s: %q is a bundle and says no language, so nothing can choose a compiler "+
 						"for it", module, a.Name))
 			}
-			problems = append(problems, bundleEnvProblems(module, a)...)
-			// What the runtime loads is among what was compiled (ADR 0175): a name here that is
-			// not an entrypoint is a file the bundle does not contain, and the runtime would
-			// fail to import it on every machine rather than here.
-			for _, load := range a.Loads {
-				found := false
-				for _, e := range a.Entrypoints {
-					found = found || e == load
-				}
-				// A bundle compiled to a binary is one executable: the runtime loads that or nothing
-				// (novox/hq ADR 0193).
-				if bin := BinaryOf(a); bin != "" {
-					found = load == bin
-				}
-				if !found {
-					problems = append(problems, fmt.Sprintf(
-						"%s: %q says the runtime loads %q, which is not among its entrypoints — "+
-							"what is loaded is compiled, so it is named there too", module, a.Name, load))
-				}
-			}
 			// **A system, for a language that compiles to a binary** (novox/hq ADR 0142). A binary
 			// is pinned to one operating system at link time so a host refuses to touch a machine
 			// it was not built for (novox/hq ADR 0005); an artifact that says nothing would be
@@ -394,104 +315,3 @@ func versionOf(digest string) string {
 	}
 	return hex
 }
-
-// bundleEnvWords are the words the runtime sets for itself; a bundle that named one would be
-// telling the runtime what it is, which is the mesh's to say (novox/hq ADR 0192).
-var bundleEnvWords = map[string]bool{
-	RuntimeToolModules: true, RuntimeBrokerFile: true, RuntimeOperatorAccount: true,
-	RuntimeOperatorHome: true, RuntimeToolEnv: true,
-}
-
-// bundleEnvProblems says what is wrong with what a bundle says it is given (novox/hq ADR 0192):
-// a value is a path or a constant written with the references a container's environment may use
-// for a place or a port, and never a secret's content or another module's binding — a secret
-// reaches a tool as a file whose path is named.
-func bundleEnvProblems(module string, a Artifact) []string {
-	if len(a.Env) == 0 {
-		return nil
-	}
-	var problems []string
-	for _, word := range sortedKeys(a.Env) {
-		value := a.Env[word]
-		if bundleEnvWords[word] {
-			problems = append(problems, fmt.Sprintf(
-				"%s: %q gives itself %s, which the node's runtime sets for itself; a bundle is "+
-					"given its own words beside the runtime's, never in place of them (novox/hq ADR 0192)",
-				module, a.Name, word))
-		}
-		rest := ofPort.ReplaceAllString(dirRef.ReplaceAllString(value, ""), "")
-		if strings.Contains(rest, "${") {
-			problems = append(problems, fmt.Sprintf(
-				"%s: %q gives %s the value %q. A bundle's word is a path or a constant, written with "+
-					"${dir:…} and ${port:…} only; a secret reaches a tool as a file the mesh places, "+
-					"named by its path, never as its content (novox/hq ADR 0192)",
-				module, a.Name, word, value))
-		}
-	}
-	return problems
-}
-
-func copyWords(in map[string]string) map[string]string {
-	if len(in) == 0 {
-		return nil
-	}
-	out := make(map[string]string, len(in))
-	for k, v := range in {
-		out[k] = v
-	}
-	return out
-}
-
-// BinaryOf is what a bundle compiled to a binary is called once built: what the artifact names, else
-// the package it is built from, else the artifact's own name (novox/hq 04-ISSUES/142). Empty for a
-// language that does not compile to one. The builder writes the binary under this name, and the
-// composer runs it by it, so both ask here.
-func BinaryOf(a Artifact) string {
-	if !compilesToABinary(a.Language) {
-		return ""
-	}
-	if name := strings.TrimSpace(a.Binary); name != "" {
-		return name
-	}
-	if from := strings.Trim(a.From, "./"); from != "" {
-		return path.Base(from)
-	}
-	return a.Name
-}
-
-// runByAResource is the artifacts one of a module's own resources names — a process that runs it,
-// a step, an archive that unpacks it — by name.
-func runByAResource(m Manifest) map[string]bool {
-	named := map[string]bool{}
-	for _, r := range m.Resources {
-		if a, ok := r["artifact"].(string); ok && a != "" {
-			named[a] = true
-		}
-	}
-	return named
-}
-
-// undeliveredBundles says which of a module's bundles nothing would ever put on a machine (novox/hq
-// 04-ISSUES/216). A bundle reaches a machine three ways: the node's runtime serves it (it says
-// `loads`, or its module declares `tools`), a resource names it (a process, a step, an archive), or
-// it is the runtime itself. One reached by none of them was built, recorded and pushed as success,
-// and was simply absent — seven modules' tools went missing that way on 2026-10-03. Refused here,
-// naming the field that would deliver it.
-func undeliveredBundles(m Manifest) []string {
-	if m.Build == nil || m.Module == RuntimeModule {
-		return nil
-	}
-	named := runByAResource(m)
-	var problems []string
-	for _, a := range m.Build.Artifacts {
-		if a.Kind != ArtifactBundle || named[a.Name] || len(a.Loads) > 0 || len(m.Tools) > 0 {
-			continue
-		}
-		problems = append(problems, fmt.Sprintf(
-			"%s: the bundle %q would be built and never reach a machine: nothing loads it, runs it or "+
-				"unpacks it. A tools bundle says `loads` (the entrypoints the node's runtime serves) or its "+
-				"module lists its `tools`; a daemon or a step is a resource naming it (novox/hq 04-ISSUES/216)",
-			m.Module, a.Name))
-	}
-	return problems
-}

internal/catalogue/consumer_into_serves.go

@@ -8,7 +8,7 @@ import (
 )
 
 // What a provider derives for one consumer, said once in the provider's definition and delivered
-// to both ends (novox/hq ADR 0201, issue 124).
+// to both ends (novox/hq ADR 0188, issue 124).
 //
 // A `serves` block is otherwise literal: the same values for every consumer. Where the provider
 // *names the resource* — a bucket, a database, a vhost — the name is derived from who is asking,
@@ -165,7 +165,7 @@ func sortedAnyKeys(values map[string]any) []string {
 }
 
 // derivedFor is what the provider on this machine derives for one consumer of one provision
-// (novox/hq ADR 0201).
+// (novox/hq ADR 0188).
 //
 // Settled first, then derived: an operator may set a prefix on what the provider serves and the
 // mesh still fills the consumer's half of it ([ADR 0174]). Only the keys that actually name the
@@ -177,7 +177,7 @@ func sortedAnyKeys(values map[string]any) []string {
 // choice servedOnThisMachine makes for the consumer's half. Nothing serving it on this machine is
 // not an error: a contribution can reach a machine whose provider is a record or an adapter, and
 // then there is nothing derived to tell.
-func (r Resolution) derivedFor(provision, as, consumer, local string, settings SettingsBy) (map[string]any, error) {
+func (r Resolution) derivedFor(provision, as string, settings SettingsBy) (map[string]any, error) {
 	for _, m := range r.Modules {
 		serves, said := m.Serves[provision]
 		if !said {
@@ -195,27 +195,6 @@ func (r Resolution) derivedFor(provision, as, consumer, local string, settings S
 		if names == nil {
 			return nil, nil
 		}
-		// **A consumer that keeps several holders of this provision is refused** — this is issue
-		// 124's own failure one case to the side, and it would be just as quiet.
-		//
-		// Each holder gets its own login, `…_<local>` (ADR 0094), and a provider derives from the
-		// login, so it would make one resource per holder. The consumer's side has no such
-		// dimension: one binding file per provision, one `${bound:<provision>:<key>}`, both
-		// derived from the un-suffixed identity. So the provider would create the holder's
-		// resource and the consumer would be configured against a name nothing made — it would
-		// authenticate successfully and be refused on every object, which reads like a credential
-		// fault and is not one.
-		//
-		// Lifting this means giving the consumer's side a local dimension. That is a decision,
-		// not an omission, and until it is taken the mesh says so rather than guessing.
-		if local != "" {
-			return nil, fmt.Errorf(
-				"%s keeps several holders of %s (this one is %q), and %s derives %s for each "+
-					"consumer from the login the mesh minted. Each holder has its own login, and a "+
-					"consumer is told one value per requirement — so the two ends would name "+
-					"different things and nothing would compare them (novox/hq ADR 0201)",
-				consumer, local, provision, m.Module, orNothing(sortedAnyKeys(names)))
-		}
 		settled, err := Settle(names, settings[m.Module])
 		if err != nil {
 			return nil, fmt.Errorf("%s serving %s: %w", m.Module, provision, err)
@@ -230,7 +209,7 @@ func (r Resolution) derivedFor(provision, as, consumer, local string, settings S
 }
 
 // notTranscribed refuses a consumer's file that writes out the value its provider derives for it,
-// instead of asking for it (novox/hq ADR 0201, issue 124).
+// instead of asking for it (novox/hq ADR 0188, issue 124).
 //
 // **What would have caught the one wrong instance.** The object store's three consumers each wrote
 // their bucket into their own configuration by hand. One of them named a predecessor's bucket, and

internal/catalogue/controller_is_a_process_test.go

@@ -1,131 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"fmt"
-	"os"
-	"strings"
-	"testing"
-)
-
-// novox/hq issue 213: the controller is a Go program and was the one piece of the mesh's own Go
-// code still shipped as an image (ADR 0188 §1). Its own manifest, composed for the machine that runs
-// it, is a Go bundle run by the host as a process — and no container.
-func TestTheControllerIsAProcessAndNoContainer(t *testing.T) {
-	raw, err := os.ReadFile("../../module.json")
-	if err != nil {
-		t.Fatal(err)
-	}
-	m, err := ParseManifest(raw)
-	if err != nil {
-		t.Fatalf("the controller's own manifest does not parse:\n%v", err)
-	}
-	if m.Build == nil || len(m.Build.Artifacts) != 1 {
-		t.Fatalf("the controller builds %+v; it is one bundle", m.Build)
-	}
-	a := m.Build.Artifacts[0]
-	if a.Kind != ArtifactBundle || a.Language != "go" || a.System == "" || BinaryOf(a) != "mesh-controller" {
-		t.Fatalf("the controller's artifact is %+v, not a Go bundle naming its system and binary", a)
-	}
-	for _, c := range m.Capabilities {
-		if c == "container-runtime" {
-			t.Error("the controller still requires a container runtime on its machine")
-		}
-	}
-
-	digest := "sha256:" + strings.Repeat("c", 64)
-	control, err := m.Resolve([]Built{{Name: a.Name, Kind: ArtifactBundle,
-		Reference: ArtifactStoreScheme + "mesh-controller/" + a.Name + "@" + digest, Digest: digest}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	// The node's runtime does not launch it: it serves its seat's verbs itself.
-	if loads := control.Bundles[0].Loads; len(loads) != 0 {
-		t.Errorf("the node's runtime would launch the controller as a tools bundle: %v", loads)
-	}
-
-	needed := map[string]map[string]string{"mesh-controller": {}}
-	for name := range m.OwnSecrets {
-		needed["mesh-controller"][name] = "sealed-" + name
-	}
-	out, err := Resolution{Node: "anchor", Modules: []Manifest{control}}.Declaration(Rendering{
-		Needed: needed, ArtifactStore: "anchor.internal:5100",
-		Seats: map[string]map[int]int{"mesh-store": {5432: 6852}},
-	})
-	if err != nil {
-		t.Fatalf("the controller does not compose: %v", err)
-	}
-
-	var process, step map[string]any
-	account, firstSecret := -1, -1
-	for i, r := range out {
-		switch {
-		case r["type"] == "container":
-			t.Errorf("the controller's declaration still runs a container: %v", r)
-		case r["id"] == "mesh-controller.controller":
-			process = r
-		case r["id"] == "mesh-controller.controller-prepare":
-			step = r
-			if process != nil {
-				t.Error("the controller's preparation is placed after the process it prepares for")
-			}
-		case r["type"] == "user" && r["name"] == "mesh-controller":
-			account = i
-		case strings.HasPrefix(fmt.Sprint(r["id"]), "mesh-controller.needs-") && firstSecret < 0:
-			firstSecret = i
-		}
-	}
-	if process == nil {
-		t.Fatalf("the controller's process is not in its declaration: %v", out)
-	}
-	if run, _ := json.Marshal(process["run"]); string(run) != `["./mesh-controller","serve"]` {
-		t.Errorf("the controller is run as %s, not its own bundle's binary", run)
-	}
-	if process["source"] != "anchor.internal:5100/mesh-controller/"+a.Name+"@"+digest || process["digest"] != digest {
-		t.Errorf("the controller's bundle is fetched from %v (%v)", process["source"], process["digest"])
-	}
-	// The user: an account the host declares, which owns what the process reads.
-	if process["user"] != "mesh-controller" || account < 0 {
-		t.Errorf("the controller runs as %v, and the account declared is at %d", process["user"], account)
-	}
-	if firstSecret >= 0 && account > firstSecret {
-		t.Error("the controller's secrets are written before the account they belong to exists")
-	}
-	for _, r := range out {
-		if strings.HasPrefix(fmt.Sprint(r["id"]), "mesh-controller.needs-") && r["owner"] != "mesh-controller" {
-			t.Errorf("%v belongs to %v, which the controller's process cannot read", r["id"], r["owner"])
-		}
-	}
-	if dir := fileNamed(out, "mesh-controller.mesh-state"); dir == nil || dir["owner"] != "mesh-controller" {
-		t.Errorf("the controller's state directory is not its account's to enter: %v", dir)
-	}
-	// Each mount became a path the process reads: nothing it is told is a path inside a container.
-	state := fmt.Sprint(fileNamed(out, "mesh-controller.mesh-state")["path"])
-	env, _ := process["env"].(map[string]any)
-	for key, value := range env {
-		v := fmt.Sprint(value)
-		if strings.HasPrefix(v, "/run/secrets") || strings.HasPrefix(v, "/broker-tls") {
-			t.Errorf("%s=%s is a path inside the container the controller no longer runs in", key, v)
-		}
-		if strings.HasSuffix(key, "_FILE") && !strings.HasPrefix(v, state+"/") {
-			t.Errorf("%s=%s is not one of the files the mesh places for it", key, v)
-		}
-	}
-	if env["MESH_BROKER_CERTIFICATE"] != "/var/lib/mesh-broker-tls/tls.crt" {
-		t.Errorf("the controller reads the broker's certificate from %v", env["MESH_BROKER_CERTIFICATE"])
-	}
-	if env["MESH_STORE_INVENTORY_PORT"] != "6852" {
-		t.Errorf("the controller is told the store is on %v; the node put it on 6852", env["MESH_STORE_INVENTORY_PORT"])
-	}
-	// The handover: the container it ran as goes only once this is running.
-	if got, _ := json.Marshal(process["replaces"]); string(got) != `["mesh-controller.server"]` {
-		t.Errorf("the controller's process replaces %s, not the container it ran as", got)
-	}
-	// And its state is prepared first, by the same program as the same account.
-	if step == nil || step["run-once"] != true || step["user"] != "mesh-controller" {
-		t.Fatalf("the controller's preparation is %v", step)
-	}
-	if run, _ := json.Marshal(step["run"]); string(run) != `["./mesh-controller","prepare"]` {
-		t.Errorf("the controller's preparation runs %s", run)
-	}
-}

internal/catalogue/declaration.go

@@ -415,13 +415,6 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 	filtering := AsNftables(rules, with.Mesh, r.PublicDomain != "", with.Foundation,
 		with.OutwardLinks, with.TunnelInterface)
 
-	// **A variable two modules set is refused whether or not anything places it** (novox/hq ADR
-	// 0203 §5): the account has one environment, and a machine whose holder arrives later should not
-	// be the moment two modules are found to disagree about it.
-	if err := variablesSetOnce(r.Modules); err != nil {
-		return nil, err
-	}
-
 	var out []map[string]any
 	for _, m := range r.Modules {
 		if with.Adopted && m.Filtering != nil {
@@ -515,27 +508,10 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 				return nil, fmt.Errorf(
 					"%s needs a secret called %q and none was made for it", m.Module, name)
 			}
-			// The runtime's credential belongs to the account the runtime runs as (novox/hq ADR 0175,
-			// to-be 38 WP3): its process is composed `user: <account>` where the node has one, and a
-			// root-owned 0600 file is one that process cannot read. Composed here rather than said in
-			// the manifest, because a manifest cannot say ${machine:account} safely — a node with no
-			// account has nothing to resolve it to, and then the runtime runs as root and the file
-			// stays root's.
-			owner := m.SecretsOwner
-			if m.Module == RuntimeModule && r.Account != "" {
-				owner = r.Account
-			}
-			first = append(first, ownedBy(owner, map[string]any{
+			first = append(first, ownedBy(m.SecretsOwner, map[string]any{
 				"id": NeedID(name), "type": "file", "path": m.OwnSecrets[name].Path, "sealed": sealed,
 			}))
 		}
-		// This module's tools bundles, where the machine runs the node's tool runtime (novox/hq
-		// ADR 0175, to-be 38 WP2). Mesh-computed like everything above it, and before the module's
-		// own resources for the same reason: the runtime's process names the files inside these
-		// and is restarted when one changes, so they are on the machine before it is.
-		if r.runtimeHere() {
-			first = append(first, bundleArchives(m)...)
-		}
 		// Operator-owned paths this module is granted use of (novox/hq ADR 0051). Written before
 		// the module's own resources, and so before the container that mounts them: the host must
 		// find each present — refusing clearly if the operator has not provided it — before it
@@ -610,14 +586,14 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 					// and nothing would say so.
 					continue
 				}
-				first = append(first, ownedBy(r.provisionsAs(m), map[string]any{
+				first = append(first, map[string]any{
 					// One file per holder — the consumer's module with its local name after it
 					// where it keeps several (ADR 0094); the lab found two files with one id.
 					"id":     GrantID(to, g.Consumer+"."+holderAs(g.From, g.Local)),
 					"type":   "file",
 					"path":   grantPath(m.Grants[to], g.Consumer, holderAs(g.From, g.Local)),
 					"sealed": g.Sealed,
-				}))
+				})
 			}
 		}
 		for _, to := range sortedKeys(m.Binds) {
@@ -654,7 +630,7 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 			}
 			as := ConsumerIdentity(r.Node, IdentitySource(m.Slug, m.Module))
 			// What the provider derives for THIS consumer, filled here where the consumer is
-			// known (novox/hq ADR 0201). The same fill knownFor does below, so the binding file
+			// known (novox/hq ADR 0188). The same fill knownFor does below, so the binding file
 			// and the module's `${bound:…}` substitutions cannot say different things.
 			told := *found
 			told.Serves, err = ServedTo(told.Serves, as)
@@ -709,15 +685,7 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 
 		// Now, and not before: a module whose resources are computed replaces them wholesale, and
 		// merging earlier would throw away the files it still needs.
-		//
-		// **Except the module's own accounts, which go before even those** (novox/hq issue 213). What
-		// the mesh computes may belong to one: a module whose code runs as an account it declares has
-		// its secrets written owned by that account, and a file given to a user the machine does not
-		// have yet fails — so on the first apply the secrets were refused, the process started without
-		// them, and the second apply healed it, which is the fault the paragraph above describes.
-		// An account depends on nothing the mesh computes.
-		accounts, rest := accountsFirst(resources)
-		resources = append(append(accounts, first...), rest...)
+		resources = append(append([]map[string]any{}, first...), resources...)
 
 		// No container is given the mesh's names (novox/hq ADR 0148). It used to be: every
 		// container got the whole roster as `--add-host` entries at creation, and a name that
@@ -784,7 +752,7 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 		// And the machine underneath, which no binding of its own can tell it.
 		thisMachine := machineFacts(r, with.Names, with.MeshRange)
 
-		// **A definition that already holds the answer transcribed it** (novox/hq ADR 0201).
+		// **A definition that already holds the answer transcribed it** (novox/hq ADR 0188).
 		// Judged over what the module itself declares, and before anything is substituted: the
 		// mesh's own generated files — the binding, the contributions — legitimately carry the
 		// derived value, and after substitution so does every consumer's file, so this is the one
@@ -896,13 +864,6 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 				return nil, err
 			}
 			publishedOn(copied, m.Module, with)
-			// The account's environment and every module's shell code, where this module holds the
-			// seat that places them (novox/hq ADR 0203, ADR 0204). Gathered from every module on
-			// the node, as the jails are, and **last of every placeholder pass**: shell code is a
-			// shell's own syntax, full of `${…}` no pass above should ever be shown.
-			if err := contributionsInto(copied, m, r.Modules, thisMachine); err != nil {
-				return nil, err
-			}
 			copied["id"] = m.Module + "." + fmt.Sprint(resource["id"])
 			// A service saying what it reflects names resources within its own module, so those
 			// are prefixed too or they would point at nothing.
@@ -921,30 +882,6 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 			if renamed := reflectsRenamed(m.Module, resource["reload-on"]); renamed != nil {
 				copied["reload-on"] = renamed
 			}
-			// And which of its module's containers a scheduled step holds still (novox/hq ADR 0189).
-			// **The loudest of the three when it is missed.** An unprefixed `restart-on` matches
-			// nothing and a service quietly never restarts; an unprefixed `while-stopped` names a
-			// container the declaration does not contain, and the host refuses the whole
-			// declaration — so the machine takes nothing at all, for every push, until this is
-			// right. That is what it did on the control node (2026-10-04).
-			if renamed := reflectsRenamed(m.Module, resource[WhileStopped]); renamed != nil {
-				copied[WhileStopped] = renamed
-			}
-			// And what a process replaces (novox/hq issue 213): a resource of this module's that it
-			// no longer declares, named as the host recorded it, or the host hands nothing over and
-			// removes it first.
-			if renamed := reflectsRenamed(m.Module, resource["replaces"]); renamed != nil {
-				copied["replaces"] = renamed
-			}
-			// **What reads one of this module's own secrets is restarted when it changes** (novox/hq
-			// issue 203, issue 206). A credential is re-issued by the mesh, and a container that
-			// mounted the old file keeps the old one open: the build machine ran for an hour on a
-			// credential the mesh had replaced, because its manifest restarted it on its
-			// environment file and nobody had thought to name the credential too. Composed here so
-			// no manifest has to say it, for a container or a daemon that names the secret's path.
-			if reads := secretsReadBy(copied, m); len(reads) > 0 {
-				copied["restart-on"] = withRestartOn(copied["restart-on"], reads)
-			}
 			// **A version prepares its state before it runs** (novox/hq ADR 0135). Derived from the
 			// module's own resource rather than declared beside it: what prepares the state is the
 			// module's own code, so what it is given has to be what that code is given — and a
@@ -975,41 +912,6 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 			out = append(out, fact)
 		}
 	}
-	// The node's tool runtime, last (novox/hq ADR 0175, to-be 38 WP2.3): one process loading every
-	// bundle delivered above and holding the credential sealed above, so both exist before it starts
-	// — the order written here is the order the machine applies.
-	if r.runtimeHere() {
-		process, err := r.runtimeProcess(with)
-		if err != nil {
-			return nil, err
-		}
-		owner[fmt.Sprint(process["id"])] = RuntimeModule
-		out = append(out, process)
-		// What each module's bundles are given is read as the account the runtime runs as.
-		words := map[string]map[string]string{}
-		for _, m := range r.Modules {
-			w, err := bundleWords(m, with)
-			if err != nil {
-				return nil, err
-			}
-			words[m.Module] = w
-		}
-		// And a file a module's words name is one the runtime is restarted for when it changes.
-		if named := givenTo(out, owner, words, r.Account); len(named) > 0 {
-			restarts, _ := process["restart-on"].([]any)
-			seen := map[string]bool{}
-			for _, id := range restarts {
-				seen[fmt.Sprint(id)] = true
-			}
-			for _, id := range named {
-				if !seen[id] {
-					restarts = append(restarts, id)
-					seen[id] = true
-				}
-			}
-			process["restart-on"] = restarts
-		}
-	}
 	if with.Adopted {
 		// First, before anything a module declares: what the mesh needs reachable, then its guard.
 		// The order a machine applies is the order written here.
@@ -1226,7 +1128,7 @@ type Contribution struct {
 	// is what makes swapping one for another cost nothing.
 	Values map[string]any `json:"values"`
 	// Derived is what this provider's own definition said it derives for this consumer, already
-	// derived (novox/hq ADR 0201).
+	// derived (novox/hq ADR 0188).
 	//
 	// **The provider is told, rather than recomputing it.** A served value may name the consumer's
 	// identity — a bucket named for who is asking, a database prefixed with it — and before this
@@ -1240,28 +1142,6 @@ type Contribution struct {
 	Derived map[string]any `json:"derived,omitempty"`
 }
 
-// provisionsAs is the account that reads what the mesh writes for this provider: the one secret
-// per consumer it must open to set that consumer's password (novox/hq issue 225).
-//
-// **A root-owned 0600 file is one that process cannot read**, which is the same sentence already
-// written above for a module's own secrets — and the grant secret is the other kind of secret
-// the mesh writes for a module, so it is the same rule.
-//
-// Which account depends on where the module's code runs. A module whose code is a bundle is run
-// by the node's tool runtime, as the node's account ([ADR 0198](0198)); one still in a container
-// is whatever it declares as its secrets owner. Nothing names these paths, so the rule that
-// claims a bundle's other files by the words that name them (givenTo) cannot reach them: the
-// harness composes a grant secret's path from the contributions file, not from a word.
-//
-// Empty is root, which is what it was and what a module with no bundle and no declared owner
-// still wants.
-func (r Resolution) provisionsAs(m Manifest) string {
-	if len(m.Bundles) > 0 && r.Account != "" {
-		return r.Account
-	}
-	return m.SecretsOwner
-}
-
 // grantPath is where one consumer's sealed credential lands on the providing machine.
 //
 // Suffixed, so the directory can also hold whatever the module writing it keeps there and so a
@@ -1352,7 +1232,7 @@ func (r Resolution) contributions(settings SettingsBy, grants []Grant,
 			continue
 		}
 		as := holderAs(ConsumerIdentity(g.Consumer, IdentitySource(g.Slug, g.From)), g.Local)
-		derived, err := r.derivedFor(g.Provision, as, g.From, g.Local, settings)
+		derived, err := r.derivedFor(g.Provision, as, settings)
 		if err != nil {
 			return nil, err
 		}
@@ -2114,18 +1994,12 @@ func preparationTarget(m Manifest) string {
 		return ""
 	}
 	for _, r := range m.Resources {
-		// A container, or a process the host runs from a bundle the module built (novox/hq issue
-		// 213): the same program in the same context, hosted as a unit rather than a container.
-		kind := fmt.Sprint(r["type"])
-		if (kind != "container" && kind != "process") || !ownArtifact(r, m.Module) {
+		if fmt.Sprint(r["type"]) != "container" || !ownArtifact(r, m.Module) {
 			continue
 		}
 		if once, _ := r["run-once"].(bool); once {
 			continue
 		}
-		if r["schedule"] != nil {
-			continue
-		}
 		return fmt.Sprint(r["id"])
 	}
 	return ""
@@ -2139,10 +2013,7 @@ func ownArtifact(resource map[string]any, module string) bool {
 		return true
 	}
 	image, _ := resource["image"].(string)
-	// A process or an archive carries what was built as its source (novox/hq issue 213).
-	source, _ := resource["source"].(string)
-	return strings.HasPrefix(image, ArtifactStoreScheme+module+"/") ||
-		strings.HasPrefix(source, ArtifactStoreScheme+module+"/")
+	return strings.HasPrefix(image, ArtifactStoreScheme+module+"/")
 }
 
 // prepared is the module's own resource as the step that prepares its state: the same image, the same
@@ -2164,19 +2035,7 @@ func prepared(from map[string]any) map[string]any {
 	step["id"] = fmt.Sprint(from["id"]) + "-prepare"
 	step["name"] = fmt.Sprint(from["name"]) + "-prepare"
 	step["run-once"] = true
-	if fmt.Sprint(from["type"]) == "process" {
-		// A process says its whole command: the program, then its arguments. The step is the same
-		// program asked to prepare (novox/hq issue 213). It replaces nothing — what the process
-		// replaces is handed over to the process, never to the step that runs before it — and a
-		// step is not restarted, it runs again when what it reads changed, which `restart-on` says.
-		run := stringsIn(from["run"])
-		if len(run) > 0 {
-			step["run"] = []any{run[0], PreparationArgument}
-		}
-		delete(step, "replaces")
-	} else {
-		step["args"] = []any{PreparationArgument}
-	}
+	step["args"] = []any{PreparationArgument}
 	delete(step, "ports")
 	delete(step, "ip")
 	delete(step, "schedule")
@@ -2237,100 +2096,3 @@ func portOfEndpoint(values map[string]any, ports map[string]int) {
 		values["port"] = port
 	}
 }
-
-// secretsReadBy is the file resources of this module's own secrets that a container or a daemon reads
-// — named in its volumes, its environment or its env-files by the secret's placed path — as
-// restart-on ids. Nothing for other shapes, and nothing for a scheduled or run-once process, which
-// the host refuses a restart-on for (it runs again anyway, and reads the file afresh).
-func secretsReadBy(resource map[string]any, m Manifest) []string {
-	kind := fmt.Sprint(resource["type"])
-	if kind != "container" && kind != "process" {
-		return nil
-	}
-	if resource["schedule"] != nil || resource["run-once"] == true {
-		return nil
-	}
-	var mentioned []string
-	for _, key := range []string{"volumes", "env", "env-file"} {
-		mentioned = append(mentioned, stringsIn(resource[key])...)
-	}
-	var out []string
-	for _, name := range sortedKeys(m.OwnSecrets) {
-		path := m.OwnSecrets[name].Path
-		if path == "" {
-			continue
-		}
-		for _, s := range mentioned {
-			// A volume is `source:destination[:mode]`; an env value or an env-file is the path itself.
-			if s == path || strings.HasPrefix(s, path+":") {
-				out = append(out, m.Module+"."+NeedID(name))
-				break
-			}
-		}
-	}
-	return out
-}
-
-// stringsIn is every string in a list or a map's values; nothing for anything else.
-func stringsIn(v any) []string {
-	switch x := v.(type) {
-	case []any:
-		var out []string
-		for _, item := range x {
-			if s, ok := item.(string); ok {
-				out = append(out, s)
-			}
-		}
-		return out
-	case []string:
-		return x
-	case map[string]any:
-		var out []string
-		for _, k := range sortedKeys(x) {
-			if s, ok := x[k].(string); ok {
-				out = append(out, s)
-			}
-		}
-		return out
-	case map[string]string:
-		var out []string
-		for _, k := range sortedKeys(x) {
-			out = append(out, x[k])
-		}
-		return out
-	}
-	return nil
-}
-
-// withRestartOn is a resource's restart-on list with these ids added once each.
-func withRestartOn(have any, add []string) []any {
-	var out []any
-	seen := map[string]bool{}
-	for _, id := range reflectsRenamed("", have) {
-		s := fmt.Sprint(id)
-		if !seen[s] {
-			seen[s] = true
-			out = append(out, s)
-		}
-	}
-	for _, id := range add {
-		if !seen[id] {
-			seen[id] = true
-			out = append(out, id)
-		}
-	}
-	return out
-}
-
-// accountsFirst splits a module's resources into its accounts and everything else, each in the order
-// written.
-func accountsFirst(resources []map[string]any) (accounts, rest []map[string]any) {
-	for _, r := range resources {
-		if fmt.Sprint(r["type"]) == "user" {
-			accounts = append(accounts, r)
-			continue
-		}
-		rest = append(rest, r)
-	}
-	return accounts, rest
-}

internal/catalogue/derived_for_consumer_test.go

@@ -7,7 +7,7 @@ import (
 )
 
 // What a provider derives for each consumer, said once and delivered to both ends
-// (novox/hq ADR 0201, issue 124).
+// (novox/hq ADR 0188, issue 124).
 //
 // The failure these are written against: the object store's provisioner derived each consumer's
 // bucket from the login the mesh minted, in its own code, and the mesh had no channel to tell the
@@ -295,49 +295,3 @@ func storeGrants(t *testing.T, out []map[string]any) []Contribution {
 	t.Fatalf("the provider was given no contributions file: %v", out)
 	return nil
 }
-
-// A consumer that keeps SEVERAL holders of one provision is refused, rather than told one thing
-// while its provider is told another.
-//
-// **This is issue 124's own failure, one case to the side.** The mesh gives each holder its own
-// login — `mesh_node_mod_<local>` (ADR 0094) — and the provider derives from the login, so it
-// would make one resource per holder. The consumer's side has no such dimension: there is one
-// binding file per provision and one `${bound:<provision>:<key>}`, both derived from the
-// un-suffixed identity. So the provider would create `…-mod-cold` and the consumer would be
-// configured against `…-mod`: it would authenticate successfully and be refused on every object,
-// which is exactly the fault this whole record exists to end.
-//
-// Refused, loudly, at the one place that can see both halves. Lifting it means giving the
-// consumer's side a local dimension, which is a decision and not an omission.
-func TestAConsumerWithSeveralHoldersOfADerivingProviderIsRefused(t *testing.T) {
-	m := files()
-	// Two holders of the one provision, the shape ADR 0094 gives a module that keeps several.
-	m.Secrets = nil
-	m.SecretsMany = map[string]map[string]string{"s3-bucket": {
-		"hot":  "/var/lib/files/hot.secret",
-		"cold": "/var/lib/files/cold.secret",
-	}}
-	m.Resources = []map[string]any{{
-		"id": "env", "type": "file", "path": "/var/lib/files/env", "mode": "0600",
-		"content": "BUCKET=${bound:s3-bucket:bucket}\n",
-	}}
-	r, err := Resolve(shelf(store(), m), []string{"store", "files"}, reachable(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	_, err = r.Declaration(Rendering{Grants: []Grant{
-		{Provision: "s3-bucket", Consumer: "workstation", From: "files", Slug: "files",
-			Local: "hot", Values: map[string]any{}, Sealed: "c2VhbGVk"},
-		{Provision: "s3-bucket", Consumer: "workstation", From: "files", Slug: "files",
-			Local: "cold", Values: map[string]any{}, Sealed: "c2VhbGVk"},
-	}})
-	if err == nil {
-		t.Fatal("a consumer with several holders of a deriving provider was accepted; " +
-			"its two ends would have disagreed in silence")
-	}
-	for _, want := range []string{"files", "s3-bucket", "bucket"} {
-		if !strings.Contains(err.Error(), want) {
-			t.Errorf("the refusal does not name %q: %v", want, err)
-		}
-	}
-}

internal/catalogue/environment_into.go

@@ -1,558 +0,0 @@
-package catalogue
-
-import (
-	"fmt"
-	"regexp"
-	"sort"
-	"strings"
-)
-
-// The account's environment and the login shell's code, composed from the modules a node runs
-// (novox/hq ADR 0203, ADR 0204).
-//
-// **The same shape as the jails.** Every module may contribute — a toolchain its directory on PATH,
-// a version manager a variable naming its home, a prompt the code that loads it — naming no node, no
-// path and no file of the shell's (ADR 0112). The one module holding the matching seat places the
-// result with a placeholder in its own file, and the controller fills it from every module on the
-// node. A node not running a module has none of its contribution, and unassigning one takes its
-// lines away at the next composition.
-//
-// **Two kinds of contribution, kept apart on purpose.** The environment is facts, which the
-// controller writes in two standard formats — POSIX assignment and the service manager's
-// environment.d — so a terminal, a script, the login shell's `execute` and a graphical session all
-// read the same values (ADR 0203). Shell code is not a fact: it is text in one shell's syntax, which
-// the controller sorts into a slot and pastes without reading, as it pastes a jail's stanza (ADR
-// 0204).
-
-// EnvironmentSeat and LoginShellSeat are the seats whose holders may place what the modules
-// contributed: the account's environment, and the login shell's code.
-const (
-	EnvironmentSeat = "node-environment"
-	LoginShellSeat  = "node-login-shell"
-)
-
-// Where an environment entry on PATH goes: before the account's existing PATH, or after it.
-const (
-	PathAtStart = "start"
-	PathAtEnd   = "end"
-)
-
-// Environment is what one module adds to the account's environment (novox/hq ADR 0203).
-type Environment struct {
-	// Variables are names and literal values. A value may name the machine's own facts with
-	// ${machine:…}, resolved before anything is written, and nothing else that expands.
-	Variables map[string]string `json:"variables,omitempty"`
-	// Path is entries on the account's PATH, each at its start or its end, in the order declared.
-	Path []PathEntry `json:"path,omitempty"`
-}
-
-// PathEntry is one directory a module puts on the account's PATH.
-type PathEntry struct {
-	Entry string `json:"entry"`
-	At    string `json:"at"`
-}
-
-// ShellCode is one piece of code a module adds to a shell's startup (novox/hq ADR 0204).
-type ShellCode struct {
-	// For is the shell the code is written in.
-	For string `json:"for"`
-	// Slot is where it runs among the other modules' code: first, normal or last. Named rather
-	// than numbered, because every contributor would guess a number and a collision says nothing.
-	Slot string `json:"slot"`
-	// Code is never interpreted — it is the shell's syntax, and only the shell reads it.
-	Code string `json:"code"`
-}
-
-// The shells and slots a contribution may name (novox/hq ADR 0204). Closed, so a typo is a refusal
-// at the check rather than code that silently lands in no placeholder.
-var (
-	knownShells = []string{"zsh", "bash", "fish"}
-	knownSlots  = []string{"first", "normal", "last"}
-	// sessionFiles are the two files of the graphical session's start that read no directory, so a
-	// contribution to them is a slot rather than a drop-in (novox/hq ADR 0208 §4): `xinitrc` is POSIX
-	// code the session's start runs, `xresources` X resources merged at its start. Placed by the
-	// display server's holder, as a shell's slots are placed by the login shell's.
-	sessionFiles = []string{"xinitrc", "xresources"}
-)
-
-// contributionTargets is every name a contribution's `for` may take.
-func contributionTargets() []string {
-	return append(append([]string(nil), knownShells...), sessionFiles...)
-}
-
-// placerOf is the seat whose holder places a contribution for this target (novox/hq ADR 0204,
-// ADR 0208 §4).
-func placerOf(target string) string {
-	if oneOf(sessionFiles, target) {
-		return DisplayServerSeat
-	}
-	return LoginShellSeat
-}
-
-// The two renderings of the environment a holder may place (novox/hq ADR 0203, decision 3).
-const (
-	EnvironmentPOSIX   = "posix"
-	EnvironmentSystemd = "systemd"
-)
-
-// ofEnvironment and ofShell are where a holder places what was contributed: ${environment:posix},
-// ${environment:systemd} and ${shell:<shell>:<slot>}. Loose inside the braces on purpose, so a
-// misspelt key is found and refused rather than left in a file as a literal nobody reads.
-var (
-	ofEnvironment = regexp.MustCompile(`\$\{environment:([^}]*)\}`)
-	ofShell       = regexp.MustCompile(`\$\{shell:([^}]*)\}`)
-)
-
-// variableName is a POSIX shell variable name, which is also what environment.d accepts.
-var variableName = regexp.MustCompile(`^[A-Za-z_][A-Za-z0-9_]*$`)
-
-// environmentProblems is what is wrong with this module's environment contribution, from the
-// manifest alone.
-func (m Manifest) environmentProblems() []string {
-	if m.Environment == nil {
-		return nil
-	}
-	var problems []string
-	for _, n := range sortedKeys(m.Environment.Variables) {
-		switch {
-		case !variableName.MatchString(n):
-			problems = append(problems, fmt.Sprintf(
-				"%s sets the variable %q, which is not a name a shell accepts: a letter or an "+
-					"underscore, then letters, digits and underscores", m.Module, n))
-			continue
-		case n == "PATH":
-			// PATH is the one variable every module shares, so no module may set it whole: a second
-			// setter would replace the first's entries, and the account's own PATH with them.
-			problems = append(problems, fmt.Sprintf(
-				"%s sets PATH as a variable; a module adds an entry under environment.path, at the "+
-					"start or the end, and PATH is composed from every module's (novox/hq ADR 0203)", m.Module))
-			continue
-		}
-		if why := literalProblem(m.Environment.Variables[n]); why != "" {
-			problems = append(problems, fmt.Sprintf(
-				"%s sets %s to %q, which %s — %s", m.Module, n, m.Environment.Variables[n], why, literalRule))
-		}
-	}
-	seen := map[string]bool{}
-	for i, p := range m.Environment.Path {
-		switch {
-		case p.Entry == "":
-			problems = append(problems, fmt.Sprintf("%s's PATH entry %d names no directory", m.Module, i+1))
-		case strings.Contains(ofMachine.ReplaceAllString(p.Entry, ""), ":"):
-			// A colon is PATH's own separator, so an entry holding one is two entries, and the
-			// check that it is already present would look for the wrong thing.
-			problems = append(problems, fmt.Sprintf(
-				"%s puts %q on PATH, which holds a colon, PATH's own separator", m.Module, p.Entry))
-		case seen[p.Entry]:
-			problems = append(problems, fmt.Sprintf("%s puts %q on PATH twice", m.Module, p.Entry))
-		default:
-			if why := literalProblem(p.Entry); why != "" {
-				problems = append(problems, fmt.Sprintf(
-					"%s puts %q on PATH, which %s — %s", m.Module, p.Entry, why, literalRule))
-			}
-		}
-		seen[p.Entry] = true
-		if p.At != PathAtStart && p.At != PathAtEnd {
-			problems = append(problems, fmt.Sprintf(
-				"%s puts %q on PATH at %q; an entry goes at %q or %q of the account's PATH",
-				m.Module, p.Entry, p.At, PathAtStart, PathAtEnd))
-		}
-	}
-	return problems
-}
-
-// literalRule is why a value must be literal, said with every refusal of one.
-const literalRule = "a value is literal, so a POSIX shell and the service manager read it alike, and " +
-	"names the machine only through the mesh's own ${machine:…} facts (novox/hq ADR 0203)"
-
-// literalProblem is why a value cannot be written, unquoted by either reader, as the same string in
-// both formats — or nothing. A `$` would expand differently in each; a quote or a backslash is
-// quoting in one and a character in the other; a line break ends the line in both.
-func literalProblem(v string) string {
-	switch {
-	case strings.ContainsAny(v, `'"`):
-		return "holds a quote"
-	case strings.Contains(v, `\`):
-		return "holds a backslash"
-	case strings.ContainsAny(v, "\n\r"):
-		return "holds a line break"
-	case strings.ContainsRune(v, 0):
-		return "holds a NUL"
-	case strings.Contains(ofMachine.ReplaceAllString(v, ""), "$"):
-		return "holds a $ that is not one of the machine's ${machine:…} facts"
-	}
-	return ""
-}
-
-// shellProblems is what is wrong with this module's shell code, from the manifest alone. The code
-// itself is not judged: it is the shell's syntax, which the controller does not read.
-func (m Manifest) shellProblems() []string {
-	var problems []string
-	for i, c := range m.Shell {
-		if !oneOf(contributionTargets(), c.For) {
-			problems = append(problems, fmt.Sprintf(
-				"%s's shell code %d is for %q; the shells are %s, and the session's files %s",
-				m.Module, i+1, c.For, strings.Join(knownShells, ", "), strings.Join(sessionFiles, ", ")))
-		}
-		if !oneOf(knownSlots, c.Slot) {
-			problems = append(problems, fmt.Sprintf(
-				"%s's shell code %d goes in the slot %q; the slots are %s", m.Module, i+1, c.Slot,
-				strings.Join(knownSlots, ", ")))
-		}
-		if strings.TrimSpace(c.Code) == "" {
-			problems = append(problems, fmt.Sprintf("%s's shell code %d has no code", m.Module, i+1))
-		}
-	}
-	return problems
-}
-
-// contributionPlaceholderProblems is every place this module's resources name the environment or
-// the shell's code and may not — judged from the manifest, so the catalogue check refuses it before
-// a mesh does, and again at composition in the same words.
-func (m Manifest) contributionPlaceholderProblems() []string {
-	var problems []string
-	for _, r := range m.Resources {
-		problems = append(problems, placeholderProblems(m, r)...)
-	}
-	return problems
-}
-
-// placeholderProblems is what is wrong with one resource's ${environment:…} and ${shell:…}.
-//
-// **The seat authorises it, not the placeholder** (novox/hq ADR 0203 §5, ADR 0204 §3), as the seat
-// authorises the bus's user list: a module that does not hold the account's environment writing it
-// would be a second writer of a file there is one of, and a module that does not hold the login
-// shell writing every module's shell code would be a second shell.
-func placeholderProblems(m Manifest, r map[string]any) []string {
-	var problems []string
-	for _, field := range sortedKeys(r) {
-		s, ok := r[field].(string)
-		if !ok {
-			continue
-		}
-		env := ofEnvironment.FindAllStringSubmatch(s, -1)
-		code := ofShell.FindAllStringSubmatch(s, -1)
-		if len(env)+len(code) == 0 {
-			continue
-		}
-		if field != "content" {
-			// Placed only where a file's bytes are, which is where every one of them is meant to go:
-			// a path or an owner holding several lines of shell is nothing the host could act on.
-			problems = append(problems, fmt.Sprintf(
-				"%s's resource %v names %s in its %s; the environment and the shell's code are placed "+
-					"only in a file's content", m.Module, r["id"], placeholderOf(env, code), field))
-			continue
-		}
-		for _, e := range env {
-			if e[1] != EnvironmentPOSIX && e[1] != EnvironmentSystemd {
-				problems = append(problems, fmt.Sprintf(
-					"%s's resource %v names %s; the environment is ${environment:%s} or ${environment:%s}",
-					m.Module, r["id"], e[0], EnvironmentPOSIX, EnvironmentSystemd))
-			}
-		}
-		if len(env) > 0 && !m.ClaimsSeat(EnvironmentSeat) {
-			problems = append(problems, fmt.Sprintf(
-				"%s's resource %v names %s and %s does not claim %s; the account's environment is "+
-					"written by that seat's holder alone (novox/hq ADR 0203)",
-				m.Module, r["id"], env[0][0], m.Module, EnvironmentSeat))
-		}
-		// Each placeholder judged by its own target: a shell's code is the login shell's holder's to
-		// place (ADR 0204), the session's files the display server's (ADR 0208 §4) — and a holder of
-		// one placing the other's would be a second writer of a file there is one of.
-		refusedFor := map[string]bool{}
-		for _, c := range code {
-			target, slot, two := strings.Cut(c[1], ":")
-			if !two || !oneOf(contributionTargets(), target) || !oneOf(knownSlots, slot) {
-				problems = append(problems, fmt.Sprintf(
-					"%s's resource %v names %s; shell code is ${shell:<shell>:<slot>}, the shell one of "+
-						"%s or the session's file one of %s, and the slot one of %s", m.Module, r["id"], c[0],
-					strings.Join(knownShells, ", "), strings.Join(sessionFiles, ", "),
-					strings.Join(knownSlots, ", ")))
-				continue
-			}
-			seat := placerOf(target)
-			if m.ClaimsSeat(seat) || refusedFor[seat] {
-				continue
-			}
-			refusedFor[seat] = true
-			if seat == DisplayServerSeat {
-				problems = append(problems, fmt.Sprintf(
-					"%s's resource %v names %s and %s does not claim %s; every module's %s is placed by "+
-						"the display server's holder alone (novox/hq ADR 0208)",
-					m.Module, r["id"], c[0], m.Module, seat, target))
-				continue
-			}
-			problems = append(problems, fmt.Sprintf(
-				"%s's resource %v names %s and %s does not claim %s; every module's shell code is "+
-					"placed by the login shell's holder alone (novox/hq ADR 0204)",
-				m.Module, r["id"], c[0], m.Module, seat))
-		}
-	}
-	return problems
-}
-
-func placeholderOf(env, code [][]string) string {
-	if len(env) > 0 {
-		return env[0][0]
-	}
-	return code[0][0]
-}
-
-// contributedEnvironment is one node's environment, gathered and in the order it is written.
-type contributedEnvironment struct {
-	// variables is by module in name order, each module's sorted by name.
-	variables []setBy
-	// start and end are PATH's entries in their final order, each once.
-	start, end []placedOn
-}
-
-type setBy struct {
-	module string
-	names  []string
-	values map[string]string
-}
-
-type placedOn struct {
-	module, entry string
-}
-
-// inModuleOrder is the modules sorted by name — the order contributions are written in (novox/hq
-// ADR 0203, ADR 0204), so the same set composes byte for byte whatever order they were assigned in.
-func inModuleOrder(modules []Manifest) []Manifest {
-	out := append([]Manifest(nil), modules...)
-	sort.SliceStable(out, func(a, b int) bool { return out[a].Module < out[b].Module })
-	return out
-}
-
-// variablesSetOnce refuses a variable two modules on one node both set (novox/hq ADR 0203 §5),
-// naming both. Neither is chosen: whichever was written last would win in one reader and not
-// necessarily in the other, and the module that lost would not be told.
-func variablesSetOnce(modules []Manifest) error {
-	setter := map[string]string{}
-	for _, m := range inModuleOrder(modules) {
-		if m.Environment == nil {
-			continue
-		}
-		for _, n := range sortedKeys(m.Environment.Variables) {
-			if first, taken := setter[n]; taken {
-				return fmt.Errorf(
-					"%s and %s both set %s on this machine; the account has one environment, so one "+
-						"of them must stop setting it (novox/hq ADR 0203)", first, m.Module, n)
-			}
-			setter[n] = m.Module
-		}
-	}
-	return nil
-}
-
-// environmentOn gathers every module's environment on a node, with the machine's facts in place.
-//
-// A PATH entry two modules both add is written once, where the first puts it: two toolchains
-// sharing ~/.local/bin is ordinary, and nothing about it is in conflict.
-func environmentOn(modules []Manifest, facts map[string]string) (contributedEnvironment, error) {
-	var env contributedEnvironment
-	if err := variablesSetOnce(modules); err != nil {
-		return env, err
-	}
-	placed := map[string]bool{}
-	for _, m := range inModuleOrder(modules) {
-		if m.Environment == nil {
-			continue
-		}
-		if len(m.Environment.Variables) > 0 {
-			set := setBy{module: m.Module, values: map[string]string{}}
-			for _, n := range sortedKeys(m.Environment.Variables) {
-				v, err := factsIn(m.Environment.Variables[n], facts, m.Module, n)
-				if err != nil {
-					return env, err
-				}
-				set.names = append(set.names, n)
-				set.values[n] = v
-			}
-			env.variables = append(env.variables, set)
-		}
-		for _, p := range m.Environment.Path {
-			entry, err := factsIn(p.Entry, facts, m.Module, "a PATH entry")
-			if err != nil {
-				return env, err
-			}
-			if strings.Contains(entry, ":") {
-				return env, fmt.Errorf("%s puts %q on PATH on this machine, which holds a colon, PATH's own separator",
-					m.Module, entry)
-			}
-			if placed[entry] {
-				continue
-			}
-			placed[entry] = true
-			if p.At == PathAtEnd {
-				env.end = append(env.end, placedOn{m.Module, entry})
-			} else {
-				env.start = append(env.start, placedOn{m.Module, entry})
-			}
-		}
-	}
-	return env, nil
-}
-
-// factsIn resolves a contributed value's ${machine:…} facts with this machine's — first, before
-// either format is written, so both say the same thing (novox/hq ADR 0203).
-func factsIn(v string, facts map[string]string, module, what string) (string, error) {
-	for _, key := range machineUsed(v) {
-		value, has := facts[key]
-		if !has {
-			return "", fmt.Errorf("%s sets %s to a value that says ${machine:%s}, and this machine says %s",
-				module, what, key, orNothing(namesOfFacts(facts)))
-		}
-		v = strings.ReplaceAll(v, fmt.Sprintf("${machine:%s}", key), value)
-	}
-	// Judged again once filled: a fact is the mesh's, and still has to be a literal both readers
-	// take alike.
-	if why := literalProblem(v); why != "" {
-		return "", fmt.Errorf("%s sets %s to %q on this machine, which %s — %s", module, what, v, why, literalRule)
-	}
-	return v, nil
-}
-
-// posix is the environment as lines a POSIX shell sources (novox/hq ADR 0203 §3): every variable
-// exported, every PATH entry added only when it is missing, so sourcing the file twice — a login
-// shell that starts another — changes nothing. POSIX sh only, because sh, bash and zsh all read it.
-//
-// The start entries are written last-first: each is put in front of PATH, so the last written ends
-// up first, and the result reads in module order, then the order each module declared.
-func (e contributedEnvironment) posix() string {
-	var b strings.Builder
-	for _, set := range e.variables {
-		fmt.Fprintf(&b, "# %s\n", set.module)
-		for _, n := range set.names {
-			fmt.Fprintf(&b, "export %s='%s'\n", n, set.values[n])
-		}
-	}
-	named := ""
-	for i := len(e.start) - 1; i >= 0; i-- {
-		p := e.start[i]
-		if p.module != named {
-			fmt.Fprintf(&b, "# %s\n", p.module)
-			named = p.module
-		}
-		fmt.Fprintf(&b, "case \":${PATH}:\" in *':%s:'*) ;; *) PATH='%s'\"${PATH:+:${PATH}}\" ;; esac\n",
-			p.entry, p.entry)
-	}
-	named = ""
-	for _, p := range e.end {
-		if p.module != named {
-			fmt.Fprintf(&b, "# %s\n", p.module)
-			named = p.module
-		}
-		fmt.Fprintf(&b, "case \":${PATH}:\" in *':%s:'*) ;; *) PATH=\"${PATH:+${PATH}:}\"'%s' ;; esac\n",
-			p.entry, p.entry)
-	}
-	if len(e.start)+len(e.end) > 0 {
-		b.WriteString("export PATH\n")
-	}
-	return b.String()
-}
-
-// systemd is the same environment as the service manager's environment.d reads it (novox/hq ADR
-// 0203 §3), for the account's user manager and so for everything a graphical session starts. Read
-// once per manager start, so it needs no guard against running twice; the account's existing PATH
-// sits between the start and the end entries.
-func (e contributedEnvironment) systemd() string {
-	var b strings.Builder
-	for _, set := range e.variables {
-		fmt.Fprintf(&b, "# %s\n", set.module)
-		for _, n := range set.names {
-			fmt.Fprintf(&b, "%s=%s\n", n, set.values[n])
-		}
-	}
-	if len(e.start) > 0 {
-		fmt.Fprintf(&b, "# %s\nPATH=%s${PATH:+:$PATH}\n", modulesOf(e.start), entriesOf(e.start))
-	}
-	if len(e.end) > 0 {
-		fmt.Fprintf(&b, "# %s\nPATH=${PATH:+$PATH:}%s\n", modulesOf(e.end), entriesOf(e.end))
-	}
-	return b.String()
-}
-
-// modulesOf names who contributed a line holding several modules' entries, in the order they appear.
-func modulesOf(entries []placedOn) string {
-	var names []string
-	seen := map[string]bool{}
-	for _, p := range entries {
-		if !seen[p.module] {
-			seen[p.module] = true
-			names = append(names, p.module)
-		}
-	}
-	return strings.Join(names, ", ")
-}
-
-func entriesOf(entries []placedOn) string {
-	out := make([]string, len(entries))
-	for i, p := range entries {
-		out[i] = p.entry
-	}
-	return strings.Join(out, ":")
-}
-
-// shellCode is every module's code for one shell and one slot (novox/hq ADR 0204 §3): in module
-// order, each module's pieces in the order it declared them, each preceded by a line naming the
-// module, and empty when nothing is contributed.
-func shellCode(modules []Manifest, shell, slot string) string {
-	var b strings.Builder
-	for _, m := range inModuleOrder(modules) {
-		named := false
-		for _, c := range m.Shell {
-			if c.For != shell || c.Slot != slot {
-				continue
-			}
-			if !named {
-				fmt.Fprintf(&b, "# %s\n", m.Module)
-				named = true
-			}
-			b.WriteString(c.Code)
-			if !strings.HasSuffix(c.Code, "\n") {
-				b.WriteString("\n")
-			}
-		}
-	}
-	return b.String()
-}
-
-// contributionsInto fills a holder's file with the node's environment and its shell code.
-//
-// **Last, after every other placeholder pass, and in one pass each.** Shell code is contributed text
-// in a shell's own syntax — `${XDG_CACHE_HOME:-$HOME/.cache}`, `${(%):-%n}` — and the rendered
-// environment holds `${PATH:+…}`: a scanner for the mesh's own placeholders that ran after these
-// were in place would read the shell's expansions as the mesh's and refuse them, or fill a
-// `${machine:…}` some module wrote for its shell to see. So nothing runs after them, the environment
-// is filled before the shell's code is, and each is replaced in a single pass over what the holder
-// wrote, so a contributed piece is never scanned again.
-func contributionsInto(resource map[string]any, m Manifest, modules []Manifest, facts map[string]string) error {
-	if problems := placeholderProblems(m, resource); len(problems) > 0 {
-		return fmt.Errorf("%s", problems[0])
-	}
-	content, ok := resource["content"].(string)
-	if !ok {
-		return nil
-	}
-	if ofEnvironment.MatchString(content) {
-		env, err := environmentOn(modules, facts)
-		if err != nil {
-			return err
-		}
-		content = ofEnvironment.ReplaceAllStringFunc(content, func(placeholder string) string {
-			if ofEnvironment.FindStringSubmatch(placeholder)[1] == EnvironmentSystemd {
-				return env.systemd()
-			}
-			return env.posix()
-		})
-	}
-	if ofShell.MatchString(content) {
-		content = ofShell.ReplaceAllStringFunc(content, func(placeholder string) string {
-			shell, slot, _ := strings.Cut(ofShell.FindStringSubmatch(placeholder)[1], ":")
-			return shellCode(modules, shell, slot)
-		})
-	}
-	resource["content"] = content
-	return nil
-}

internal/catalogue/environment_into_test.go

@@ -1,471 +0,0 @@
-package catalogue
-
-import (
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-// Defends novox/hq ADR 0203 (the account's environment is one module's, and every module
-// contributes to it) and ADR 0204 (shell code in named slots, placed by the login shell's holder).
-
-// contributors is a fixed set of contributions, in no particular order: what the renderings are
-// asserted against byte for byte. go-toolchain and zsh both put ~/.local/bin on PATH, which is the
-// ordinary case of two modules sharing a directory, and is written once.
-func contributors() []Manifest {
-	return []Manifest{
-		{Module: "zsh", Environment: &Environment{
-			Variables: map[string]string{"XDG_CONFIG_HOME": "${machine:account-home}/.config", "EDITOR": "vim"},
-			Path: []PathEntry{
-				{Entry: "${machine:account-home}/.local/bin", At: PathAtStart},
-				{Entry: "${machine:account-home}/bin", At: PathAtStart},
-				{Entry: "/opt/scripts", At: PathAtEnd},
-			},
-		}},
-		{Module: "go-toolchain", Environment: &Environment{
-			Variables: map[string]string{"GOPATH": "${machine:account-home}/go"},
-			Path: []PathEntry{
-				{Entry: "${machine:account-home}/go/bin", At: PathAtStart},
-				{Entry: "/usr/local/go/bin", At: PathAtStart},
-				{Entry: "${machine:account-home}/.local/bin", At: PathAtStart},
-			},
-		}},
-		{Module: "agent", Environment: &Environment{
-			Variables: map[string]string{"DISABLE_AUTOUPDATER": "1"},
-			Path:      []PathEntry{{Entry: "/opt/agent/bin", At: PathAtEnd}},
-		}},
-		// A module contributing nothing is in the set and writes nothing.
-		{Module: "postgres"},
-	}
-}
-
-var operatorFacts = map[string]string{"name": "workstation", "account": "op", "account-home": "/home/op"}
-
-// The final PATH this set composes, around whatever the account had: the start entries in module
-// order and then declared order, the account's own, then the end entries.
-const composedPOSIX = `# agent
-export DISABLE_AUTOUPDATER='1'
-# go-toolchain
-export GOPATH='/home/op/go'
-# zsh
-export EDITOR='vim'
-export XDG_CONFIG_HOME='/home/op/.config'
-# zsh
-case ":${PATH}:" in *':/home/op/bin:'*) ;; *) PATH='/home/op/bin'"${PATH:+:${PATH}}" ;; esac
-# go-toolchain
-case ":${PATH}:" in *':/home/op/.local/bin:'*) ;; *) PATH='/home/op/.local/bin'"${PATH:+:${PATH}}" ;; esac
-case ":${PATH}:" in *':/usr/local/go/bin:'*) ;; *) PATH='/usr/local/go/bin'"${PATH:+:${PATH}}" ;; esac
-case ":${PATH}:" in *':/home/op/go/bin:'*) ;; *) PATH='/home/op/go/bin'"${PATH:+:${PATH}}" ;; esac
-# agent
-case ":${PATH}:" in *':/opt/agent/bin:'*) ;; *) PATH="${PATH:+${PATH}:}"'/opt/agent/bin' ;; esac
-# zsh
-case ":${PATH}:" in *':/opt/scripts:'*) ;; *) PATH="${PATH:+${PATH}:}"'/opt/scripts' ;; esac
-export PATH
-`
-
-const composedSystemd = `# agent
-DISABLE_AUTOUPDATER=1
-# go-toolchain
-GOPATH=/home/op/go
-# zsh
-EDITOR=vim
-XDG_CONFIG_HOME=/home/op/.config
-# go-toolchain, zsh
-PATH=/home/op/go/bin:/usr/local/go/bin:/home/op/.local/bin:/home/op/bin${PATH:+:$PATH}
-# agent, zsh
-PATH=${PATH:+$PATH:}/opt/agent/bin:/opt/scripts
-`
-
-func TestTheEnvironmentRendersForAPOSIXShellByteForByte(t *testing.T) {
-	env, err := environmentOn(contributors(), operatorFacts)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got := env.posix(); got != composedPOSIX {
-		t.Fatalf("the POSIX rendering is\n%s\nnot\n%s", got, composedPOSIX)
-	}
-}
-
-func TestTheEnvironmentRendersForTheServiceManagerByteForByte(t *testing.T) {
-	env, err := environmentOn(contributors(), operatorFacts)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got := env.systemd(); got != composedSystemd {
-		t.Fatalf("the environment.d rendering is\n%s\nnot\n%s", got, composedSystemd)
-	}
-}
-
-// Sourcing twice changes nothing (ADR 0203 §3): a login shell that starts another reads the file
-// again, and a PATH that grew each time would be the symptom. Run by a real `sh`, because the claim
-// is about what a shell does with the file, not about what the file looks like.
-func TestThePOSIXEnvironmentSourcedTwiceLeavesPATHAsOnce(t *testing.T) {
-	sh, err := exec.LookPath("sh")
-	if err != nil {
-		t.Skip("no sh on this machine")
-	}
-	script := "PATH=/usr/bin:/bin\n" + composedPOSIX + "once=$PATH\n" + composedPOSIX +
-		`[ "$PATH" = "$once" ] || { echo "changed: $once -> $PATH"; exit 1; }` + "\n" +
-		`echo "$PATH"; echo "$GOPATH"`
-	out, err := exec.Command(sh, "-c", script).CombinedOutput()
-	if err != nil {
-		t.Fatalf("sourcing twice: %v\n%s", err, out)
-	}
-	lines := strings.Split(strings.TrimSpace(string(out)), "\n")
-	want := "/home/op/go/bin:/usr/local/go/bin:/home/op/.local/bin:/home/op/bin:/usr/bin:/bin:/opt/agent/bin:/opt/scripts"
-	if lines[0] != want {
-		t.Fatalf("PATH is %s, not %s", lines[0], want)
-	}
-	if lines[1] != "/home/op/go" {
-		t.Fatalf("GOPATH was not exported: %q", lines[1])
-	}
-	// And an entry the account already has stays where it is, and once.
-	out, err = exec.Command(sh, "-c", "PATH=/opt/scripts:/usr/bin\n"+composedPOSIX+`echo "$PATH"`).CombinedOutput()
-	if err != nil {
-		t.Fatalf("%v\n%s", err, out)
-	}
-	if got := strings.TrimSpace(string(out)); got !=
-		"/home/op/go/bin:/usr/local/go/bin:/home/op/.local/bin:/home/op/bin:/opt/scripts:/usr/bin:/opt/agent/bin" {
-		t.Fatalf("an entry already on PATH was added again or moved: %s", got)
-	}
-}
-
-// The environment.d rendering, read by the service manager's own generator where this machine has
-// one — the same reader an account's user manager runs, so the PATH it composes is the one asserted.
-func TestTheServiceManagerReadsTheSystemdRenderingAsMeant(t *testing.T) {
-	generator := "/usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator"
-	if _, err := os.Stat(generator); err != nil {
-		t.Skip("no environment.d generator on this machine")
-	}
-	config := t.TempDir()
-	if err := os.MkdirAll(filepath.Join(config, "environment.d"), 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(config, "environment.d", "50-mesh.conf"), []byte(composedSystemd), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	cmd := exec.Command(generator)
-	cmd.Env = []string{"PATH=/usr/bin:/bin", "HOME=" + config, "XDG_CONFIG_HOME=" + config}
-	out, err := cmd.CombinedOutput()
-	if err != nil {
-		t.Fatalf("%v\n%s", err, out)
-	}
-	want := "PATH=/home/op/go/bin:/usr/local/go/bin:/home/op/.local/bin:/home/op/bin:/usr/bin:/bin:/opt/agent/bin:/opt/scripts"
-	if !strings.Contains(string(out), want+"\n") || !strings.Contains(string(out), "GOPATH=/home/op/go\n") {
-		t.Fatalf("the service manager read\n%s", out)
-	}
-}
-
-// Nothing contributed renders nothing, in both formats — not an empty `export PATH`.
-func TestNoContributionsRenderNothing(t *testing.T) {
-	env, err := environmentOn([]Manifest{{Module: "postgres"}}, operatorFacts)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if env.posix() != "" || env.systemd() != "" {
-		t.Fatalf("an empty environment rendered %q and %q", env.posix(), env.systemd())
-	}
-}
-
-// A ${machine:…} fact the machine does not have is refused naming the module, as a file's is.
-func TestAContributedFactTheMachineLacksIsRefused(t *testing.T) {
-	_, err := environmentOn(contributors(), map[string]string{"name": "server"})
-	if err == nil || !strings.Contains(err.Error(), "go-toolchain sets GOPATH") ||
-		!strings.Contains(err.Error(), "${machine:account-home}") {
-		t.Fatalf("a missing account home was not refused by name: %v", err)
-	}
-}
-
-// ADR 0203 §5: two modules setting one variable are refused, both named — neither silently wins.
-func TestAVariableTwoModulesSetIsRefusedNamingBoth(t *testing.T) {
-	modules := append(contributors(), Manifest{Module: "neovim", Environment: &Environment{
-		Variables: map[string]string{"EDITOR": "nvim"}}})
-	_, err := environmentOn(modules, operatorFacts)
-	if err == nil || err.Error() != "neovim and zsh both set EDITOR on this machine; the account has one "+
-		"environment, so one of them must stop setting it (novox/hq ADR 0203)" {
-		t.Fatalf("a variable set twice was not refused naming both: %v", err)
-	}
-	// And at composition, whether or not the node holds the environment.
-	r := Resolution{Node: "workstation", Account: "op", Modules: modules}
-	if _, err := r.Declaration(Rendering{}); err == nil || !strings.Contains(err.Error(), "neovim and zsh both set EDITOR") {
-		t.Fatalf("composition accepted a variable set twice: %v", err)
-	}
-}
-
-// shells contributes code for several shells and slots, in no order.
-func shells() []Manifest {
-	return []Manifest{
-		{Module: "zsh-syntax-highlighting", Shell: []ShellCode{
-			{For: "zsh", Slot: "last", Code: "source /usr/share/zsh/plugins/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh"},
-		}},
-		{Module: "powerlevel10k", Shell: []ShellCode{
-			{For: "zsh", Slot: "first", Code: "if [[ -r \"${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh\" ]]; then\n" +
-				"  source \"${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh\"\nfi\n"},
-			{For: "zsh", Slot: "normal", Code: "source ~/.local/share/powerlevel10k/powerlevel10k.zsh-theme"},
-			{For: "zsh", Slot: "normal", Code: "[[ -f ~/.local/share/powerlevel10k/p10k.zsh ]] && source ~/.local/share/powerlevel10k/p10k.zsh"},
-		}},
-		{Module: "zsh-autosuggestions", Shell: []ShellCode{
-			{For: "zsh", Slot: "normal", Code: "source /usr/share/zsh/plugins/zsh-autosuggestions/zsh-autosuggestions.zsh"},
-			{For: "bash", Slot: "normal", Code: "echo not for zsh"},
-		}},
-		{Module: "direnv", Shell: []ShellCode{
-			{For: "fish", Slot: "last", Code: "direnv hook fish | source"},
-			{For: "bash", Slot: "last", Code: "eval \"$(direnv hook bash)\""},
-		}},
-	}
-}
-
-// ADR 0204 §3: a slot holds that shell's code only, in module order, each module's pieces in the
-// order it declared them under a line naming it; empty when nothing is contributed.
-func TestShellCodeLandsInItsSlotInModuleOrderForItsShellOnly(t *testing.T) {
-	if got, want := shellCode(shells(), "zsh", "normal"), "# powerlevel10k\n"+
-		"source ~/.local/share/powerlevel10k/powerlevel10k.zsh-theme\n"+
-		"[[ -f ~/.local/share/powerlevel10k/p10k.zsh ]] && source ~/.local/share/powerlevel10k/p10k.zsh\n"+
-		"# zsh-autosuggestions\n"+
-		"source /usr/share/zsh/plugins/zsh-autosuggestions/zsh-autosuggestions.zsh\n"; got != want {
-		t.Fatalf("zsh's normal slot is\n%s\nnot\n%s", got, want)
-	}
-	if got, want := shellCode(shells(), "zsh", "last"), "# zsh-syntax-highlighting\n"+
-		"source /usr/share/zsh/plugins/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh\n"; got != want {
-		t.Fatalf("zsh's last slot is\n%s\nnot\n%s", got, want)
-	}
-	if got, want := shellCode(shells(), "bash", "last"), "# direnv\neval \"$(direnv hook bash)\"\n"; got != want {
-		t.Fatalf("bash's last slot is %q, not %q", got, want)
-	}
-	if got := shellCode(shells(), "fish", "first"); got != "" {
-		t.Fatalf("a slot nobody contributed to holds %q", got)
-	}
-}
-
-// The holder of node-login-shell, as WP3's zsh module writes its block, with its own zsh around the
-// slots — which holds `${…}` of the shell's own that no mesh pass may touch either.
-func zshHolder() Manifest {
-	return Manifest{Module: "zsh", Claims: []Claim{{Name: LoginShellSeat, Scope: ScopeNode}},
-		Resources: []map[string]any{
-			{"id": "zshrc", "type": "file", "path": "${machine:account-home}/.zshrc", "content": "" +
-				"${shell:zsh:first}" +
-				"PROMPT='%n@%m ${PWD/#$HOME/~} '\n" +
-				"${shell:zsh:normal}" +
-				"alias ll='ls -l'\n" +
-				"${shell:zsh:last}"},
-		}}
-}
-
-// The case the ordering exists for: contributed zsh code full of `${…}` reaches the file byte for
-// byte, because the shell's code is placed after every other placeholder pass and in one pass — a
-// scanner for the mesh's placeholders that ran after it would read `${XDG_CACHE_HOME:-…}` and
-// `${(%):-%n}` as the mesh's, or fill a `${machine:…}` some module wrote for its shell to see.
-func TestShellCodeReachesTheHoldersFileByteForByte(t *testing.T) {
-	modules := append(shells(), zshHolder(), Manifest{Module: "sly", Shell: []ShellCode{
-		{For: "zsh", Slot: "last", Code: "echo ${machine:account-home} ${secret:x} ${shell:zsh:first} ${environment:posix}"},
-	}})
-	r := Resolution{Node: "workstation", Account: "op", Modules: modules}
-	out, err := r.Declaration(Rendering{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	var zshrc map[string]any
-	for _, res := range out {
-		if res["id"] == "zsh.zshrc" {
-			zshrc = res
-		}
-	}
-	if zshrc == nil {
-		t.Fatalf("the holder's file was not composed: %v", out)
-	}
-	if zshrc["path"] != "/home/op/.zshrc" {
-		t.Fatalf("the holder's own placeholders were not filled first: %v", zshrc["path"])
-	}
-	want := "# powerlevel10k\n" +
-		"if [[ -r \"${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh\" ]]; then\n" +
-		"  source \"${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh\"\nfi\n" +
-		"PROMPT='%n@%m ${PWD/#$HOME/~} '\n" +
-		"# powerlevel10k\n" +
-		"source ~/.local/share/powerlevel10k/powerlevel10k.zsh-theme\n" +
-		"[[ -f ~/.local/share/powerlevel10k/p10k.zsh ]] && source ~/.local/share/powerlevel10k/p10k.zsh\n" +
-		"# zsh-autosuggestions\n" +
-		"source /usr/share/zsh/plugins/zsh-autosuggestions/zsh-autosuggestions.zsh\n" +
-		"alias ll='ls -l'\n" +
-		"# sly\n" +
-		"echo ${machine:account-home} ${secret:x} ${shell:zsh:first} ${environment:posix}\n" +
-		"# zsh-syntax-highlighting\n" +
-		"source /usr/share/zsh/plugins/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh\n"
-	if got := zshrc["content"]; got != want {
-		t.Fatalf("the holder's .zshrc is\n%s\nnot\n%s", got, want)
-	}
-}
-
-// The holder of node-environment places both renderings, and they are the same as rendered alone.
-func TestTheEnvironmentHolderPlacesBothRenderings(t *testing.T) {
-	holder := Manifest{Module: "node-env", Claims: []Claim{{Name: EnvironmentSeat, Scope: ScopeNode}},
-		Resources: []map[string]any{
-			{"id": "posix", "type": "file", "path": "${machine:account-home}/.config/mesh/environment.sh",
-				"content": "# The mesh's environment.\n${environment:posix}"},
-			{"id": "systemd", "type": "file", "path": "${machine:account-home}/.config/environment.d/50-mesh.conf",
-				"content": "${environment:systemd}"},
-		}}
-	r := Resolution{Node: "workstation", Account: "op", Modules: append(contributors(), holder)}
-	out, err := r.Declaration(Rendering{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	by := map[string]any{}
-	for _, res := range out {
-		by[res["id"].(string)] = res["content"]
-	}
-	if by["node-env.posix"] != "# The mesh's environment.\n"+composedPOSIX {
-		t.Fatalf("the POSIX file is\n%v", by["node-env.posix"])
-	}
-	if by["node-env.systemd"] != composedSystemd {
-		t.Fatalf("the environment.d file is\n%v", by["node-env.systemd"])
-	}
-}
-
-// ADR 0203 §5 and ADR 0204 §3: a placeholder outside the seat's holder is refused — by the parser,
-// which is what the catalogue check and registration run, and again at composition, in the same words.
-func TestAPlaceholderOutsideTheHolderIsRefused(t *testing.T) {
-	for _, c := range []struct{ content, want string }{
-		{"${environment:posix}", "toolchain's resource rc names ${environment:posix} and toolchain does not claim node-environment"},
-		{"${shell:zsh:normal}", "toolchain's resource rc names ${shell:zsh:normal} and toolchain does not claim node-login-shell"},
-	} {
-		raw := `{"module":"toolchain","resources":[{"id":"rc","type":"file","path":"/etc/rc","content":"` + c.content + `"}]}`
-		if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), c.want) {
-			t.Errorf("the catalogue check accepted %s outside its holder: %v", c.content, err)
-		}
-		m := Manifest{Module: "toolchain", Resources: []map[string]any{
-			{"id": "rc", "type": "file", "path": "/etc/rc", "content": c.content}}}
-		r := Resolution{Node: "workstation", Account: "op", Modules: []Manifest{m}}
-		if _, err := r.Declaration(Rendering{}); err == nil || !strings.Contains(err.Error(), c.want) {
-			t.Errorf("composition accepted %s outside its holder: %v", c.content, err)
-		}
-	}
-}
-
-// A key nobody renders is refused, not left in the file as a literal.
-func TestAnUnknownPlaceholderKeyIsRefused(t *testing.T) {
-	for _, c := range []struct{ content, want string }{
-		{"${environment:foo}", "names ${environment:foo}; the environment is ${environment:posix} or ${environment:systemd}"},
-		{"${shell:zsh:middle}", "names ${shell:zsh:middle}; shell code is ${shell:<shell>:<slot>}"},
-		{"${shell:tcsh:first}", "names ${shell:tcsh:first}; shell code is ${shell:<shell>:<slot>}"},
-		{"${shell:zsh}", "names ${shell:zsh}; shell code is ${shell:<shell>:<slot>}"},
-	} {
-		raw := `{"module":"holder","claims":[{"name":"node-environment","scope":"node"},{"name":"node-login-shell","scope":"node"}],` +
-			`"resources":[{"id":"rc","type":"file","path":"/etc/rc","content":"` + c.content + `"}]}`
-		if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), c.want) {
-			t.Errorf("%s was accepted: %v", c.content, err)
-		}
-	}
-	// And outside a file's content, where nothing could be placed.
-	raw := `{"module":"holder","claims":[{"name":"node-environment","scope":"node"}],` +
-		`"resources":[{"id":"rc","type":"file","path":"/etc/${environment:posix}","content":"x"}]}`
-	if _, err := ParseManifest([]byte(raw)); err == nil ||
-		!strings.Contains(err.Error(), "names ${environment:posix} in its path; the environment and the shell's code are placed only in a file's content") {
-		t.Errorf("a placeholder in a path was accepted: %v", err)
-	}
-}
-
-// What ADR 0203 §2 allows a contribution to say, refused at parse when it says anything else.
-func TestAMalformedEnvironmentIsRefusedAtParse(t *testing.T) {
-	for _, c := range []struct{ environment, want string }{
-		{`{"variables":{"1X":"a"}}`, `tool sets the variable "1X", which is not a name a shell accepts`},
-		{`{"variables":{"MY-VAR":"a"}}`, `tool sets the variable "MY-VAR", which is not a name a shell accepts`},
-		{`{"variables":{"PATH":"/bin"}}`, `tool sets PATH as a variable; a module adds an entry under environment.path`},
-		{`{"variables":{"A":"$HOME/x"}}`, `tool sets A to "$HOME/x", which holds a $ that is not one of the machine's ${machine:…} facts`},
-		{`{"variables":{"A":"${HOME}/x"}}`, `tool sets A to "${HOME}/x", which holds a $`},
-		{`{"variables":{"A":"it's"}}`, `tool sets A to "it's", which holds a quote`},
-		{`{"variables":{"A":"say \"hi\""}}`, `which holds a quote`},
-		{`{"variables":{"A":"a\\b"}}`, `which holds a backslash`},
-		{`{"variables":{"A":"a\nb"}}`, `which holds a line break`},
-		{`{"variables":{"A":"a\u0000b"}}`, `which holds a NUL`},
-		{`{"path":[{"entry":"","at":"start"}]}`, `tool's PATH entry 1 names no directory`},
-		{`{"path":[{"entry":"/a:/b","at":"start"}]}`, `tool puts "/a:/b" on PATH, which holds a colon`},
-		{`{"path":[{"entry":"$HOME/bin","at":"start"}]}`, `tool puts "$HOME/bin" on PATH, which holds a $`},
-		{`{"path":[{"entry":"/a","at":"middle"}]}`, `tool puts "/a" on PATH at "middle"; an entry goes at "start" or "end"`},
-		{`{"path":[{"entry":"/a"}]}`, `tool puts "/a" on PATH at ""`},
-		{`{"path":[{"entry":"/a","at":"start"},{"entry":"/a","at":"end"}]}`, `tool puts "/a" on PATH twice`},
-		{`{"variables":{"A":"x"},"paths":[]}`, `unknown field "paths"`},
-	} {
-		_, err := ParseManifest([]byte(`{"module":"tool","environment":` + c.environment + `}`))
-		if err == nil || !strings.Contains(err.Error(), c.want) {
-			t.Errorf("%s: want %q, got %v", c.environment, c.want, err)
-		}
-	}
-	// What is allowed: a literal, and the machine's own facts.
-	if _, err := ParseManifest([]byte(`{"module":"tool","environment":{` +
-		`"variables":{"GOPATH":"${machine:account-home}/go","DISABLE_X":"1","ANSWER":"a b+c=d"},` +
-		`"path":[{"entry":"${machine:account-home}/go/bin","at":"start"},{"entry":"/opt/x","at":"end"}]}}`)); err != nil {
-		t.Fatalf("a well-formed environment was refused: %v", err)
-	}
-}
-
-func TestMalformedShellCodeIsRefusedAtParse(t *testing.T) {
-	for _, c := range []struct{ shell, want string }{
-		{`[{"for":"tcsh","slot":"normal","code":"x"}]`, `tool's shell code 1 is for "tcsh"; the shells are zsh, bash, fish`},
-		{`[{"for":"zsh","slot":"middle","code":"x"}]`, `tool's shell code 1 goes in the slot "middle"; the slots are first, normal, last`},
-		{`[{"for":"zsh","slot":"last","code":"x"},{"for":"zsh","slot":"last","code":" \n"}]`, `tool's shell code 2 has no code`},
-		{`[{"for":"zsh","slot":"last","code":"x","order":1}]`, `unknown field "order"`},
-	} {
-		_, err := ParseManifest([]byte(`{"module":"tool","shell":` + c.shell + `}`))
-		if err == nil || !strings.Contains(err.Error(), c.want) {
-			t.Errorf("%s: want %q, got %v", c.shell, c.want, err)
-		}
-	}
-	// The code itself is never judged: a shell's own `${…}` is not the mesh's.
-	if _, err := ParseManifest([]byte(`{"module":"tool","shell":[{"for":"zsh","slot":"first",` +
-		`"code":"source \"${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh\""}]}`)); err != nil {
-		t.Fatalf("shell code was judged as if it were the mesh's: %v", err)
-	}
-}
-
-// ADR 0203 §1 and ADR 0204 §1: both seats are the mesh's own, held once per machine; the login
-// shell's contract is `execute`, described and with a schema an agent can call.
-func TestTheSeatTableCarriesTheEnvironmentAndTheLoginShell(t *testing.T) {
-	env, ok := SeatNamed("node-environment")
-	if !ok || env.Scope != ScopeNode || env.Decision != "novox/hq ADR 0203" ||
-		len(env.Serves)+len(env.Accepts)+len(env.Emits) != 0 || env.Delivers != "" {
-		t.Fatalf("node-environment is not a node seat with no protocol: %+v (defined %v)", env, ok)
-	}
-	shell, ok := SeatNamed("node-login-shell")
-	if !ok || shell.Scope != ScopeNode || shell.Decision != "novox/hq ADR 0204" {
-		t.Fatalf("node-login-shell is not a node seat: %+v (defined %v)", shell, ok)
-	}
-	if len(shell.Serves) != 1 || shell.Serves[0].Name != "execute" || shell.Serves[0].Description == "" {
-		t.Fatalf("the login shell serves %+v, not execute alone", shell.Serves)
-	}
-	props, _ := shell.Serves[0].Input["properties"].(map[string]any)
-	required, _ := shell.Serves[0].Input["required"].([]string)
-	if _, has := props["command"]; !has || len(required) != 1 || required[0] != "command" {
-		t.Fatalf("execute does not require a command: %v", shell.Serves[0].Input)
-	}
-	if _, has := props["timeout_seconds"]; !has {
-		t.Fatalf("execute takes no timeout: %v", props)
-	}
-}
-
-// ADR 0204 §1: the login shell is the mesh's, so no module declares it — neither under the mesh's
-// name nor under the name a module gave it before.
-func TestNoModuleMayDeclareTheLoginShell(t *testing.T) {
-	for _, n := range []string{"login-shell", "node-login-shell", "node-environment"} {
-		raw := `{"module":"zsh","seats":[{"name":"` + n + `","scope":"node","serves":["execute"]}],"tools":["execute"]}`
-		_, err := ParseManifest([]byte(raw))
-		if err == nil {
-			t.Errorf("a module declaring %q was accepted", n)
-		}
-	}
-	got := strings.Join(declaredSeatProblems(Manifest{Module: "zsh",
-		DefinesSeats: []SeatDeclaration{{Name: "login-shell", Scope: ScopeNode}}}), "; ")
-	if !strings.Contains(got, `zsh declares a seat named "login-shell"; the login shell is the mesh's own seat node-login-shell`) {
-		t.Fatalf("declaring login-shell was not refused by name: %q", got)
-	}
-	// And a shell module claiming the mesh's seat, serving execute, is what the seat is for.
-	m, err := ParseManifest([]byte(`{"module":"zsh","tools":["execute"],` +
-		`"claims":[{"name":"node-login-shell","scope":"node"}]}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := CanHold(m, Seat{Name: LoginShellSeat, Scope: ScopeNode, Serves: loginShellVerbs()}); err != nil {
-		t.Fatalf("a shell module claiming the seat cannot hold it: %v", err)
-	}
-}

internal/catalogue/foundation_manifests_test.go

@@ -1,7 +1,6 @@
 package catalogue
 
 import (
-	"encoding/json"
 	"fmt"
 	"os"
 	"reflect"
@@ -171,7 +170,7 @@ func TestTheForgeHoldsTheNpmAndGitSeats(t *testing.T) {
 // **And the forge's own address follows it**, composed from the manifest in the catalogue beside
 // this checkout (novox/hq 04-ISSUES/088).
 //
-// The forge is reached a third way that neither test above covers: by its own code, over the
+// The forge is reached a third way that neither test above covers: by its own sidecar, over the
 // machine's loopback, told where to go in its environment. The `2999:3000` mapping that lets the
 // forge go on binding 3000 does nothing for a caller dialling the machine — so a literal there is
 // wrong on every node whose assignment differs, and wrong for a second reason on a node given the
@@ -179,13 +178,13 @@ func TestTheForgeHoldsTheNpmAndGitSeats(t *testing.T) {
 // in an `env` at all is a declaration, not a manifest.
 func TestTheForgesOwnAddressFollowsThePortTheNodeGaveIt(t *testing.T) {
 	forge, err := catalogueManifest(t, "gitea").Resolve([]Built{{
-		Name: "code", Kind: ArtifactBundle,
-		Reference: ArtifactStoreScheme + "gitea/code/blobs/" + bundleDigest, Digest: bundleDigest,
+		Name: "runtime", Kind: ArtifactImage,
+		Reference: "registry.example/gitea-runtime@sha256:" + strings.Repeat("a", 64),
 	}})
 	if err != nil {
 		t.Fatalf("the forge's manifest does not resolve against its own build: %v", err)
 	}
-	r := Resolution{Node: "anchor", Modules: []Manifest{forge, theRuntime(t)}, Needs: []Needed{
+	r := Resolution{Node: "anchor", Modules: []Manifest{forge}, Needs: []Needed{
 		{Name: "postgres-database", For: "gitea", From: "anchor", At: "127.0.0.1",
 			Serves: map[string]any{"port": float64(5432)}, Sealed: "sealed-db"},
 		{Name: "route", For: "gitea", From: "anchor"},
@@ -195,8 +194,8 @@ func TestTheForgesOwnAddressFollowsThePortTheNodeGaveIt(t *testing.T) {
 
 	// The number this node was given for the forge — the one the machine it is about to run on
 	// already publishes.
-	out, err := r.Declaration(Rendering{ArtifactStore: "anchor.internal:5101",
-		Needed: map[string]map[string]string{RuntimeModule: {"broker": "sealed-broker"}},
+	out, err := r.Declaration(Rendering{
+		Needed: map[string]map[string]string{"gitea": {"broker": "sealed-broker"}},
 		Given:  map[string]map[int]int{"gitea": {3000: 2999}},
 	})
 	if err != nil {
@@ -211,19 +210,14 @@ func TestTheForgesOwnAddressFollowsThePortTheNodeGaveIt(t *testing.T) {
 	if published := fmt.Sprint(server["ports"]); !strings.Contains(published, "2999:3000") {
 		t.Fatalf("the forge is not published on the port this node gave it: %v", server["ports"])
 	}
-	// The forge's own code runs in the node's runtime (novox/hq ADR 0198), given its words there.
-	runtime := fileNamed(out, RuntimeModule+"."+RuntimeProcessID())
+	runtime := fileNamed(out, "gitea.runtime")
 	if runtime == nil {
-		t.Fatalf("the node's runtime is not in the declaration: %v", ids(out))
+		t.Fatalf("the forge's sidecar is not in the declaration: %v", out)
 	}
-	env, _ := runtime["env"].(map[string]string)
-	var given map[string]map[string]string
-	if err := json.Unmarshal([]byte(env[RuntimeToolEnv]), &given); err != nil {
-		t.Fatalf("the runtime's %s is not JSON: %q", RuntimeToolEnv, env[RuntimeToolEnv])
-	}
-	if given["gitea"]["MESH_GITEA_URL"] != "http://127.0.0.1:2999" {
-		t.Fatalf("the forge's code dials %v while the machine publishes the forge on 2999 — "+
-			"whatever reads it dials a dead port", given["gitea"]["MESH_GITEA_URL"])
+	env, _ := runtime["env"].(map[string]any)
+	if env["MESH_GITEA_URL"] != "http://127.0.0.1:2999" {
+		t.Fatalf("the forge's sidecar dials %v while the machine publishes the forge on 2999 — "+
+			"whatever reads it dials a dead port", env["MESH_GITEA_URL"])
 	}
 }
 
@@ -235,13 +229,13 @@ func declaredGiteaSsh(t *testing.T, given map[int]int) map[string]any {
 	t.Helper()
 	forge := catalogueManifest(t, "gitea")
 	resolved, err := forge.Resolve([]Built{{
-		Name: "code", Kind: ArtifactBundle,
-		Reference: ArtifactStoreScheme + "gitea/code/blobs/" + bundleDigest, Digest: bundleDigest,
+		Name: "runtime", Kind: ArtifactImage,
+		Reference: "registry.example/gitea-runtime@sha256:" + strings.Repeat("a", 64),
 	}})
 	if err != nil {
 		t.Fatalf("the forge's manifest does not resolve against its own build: %v", err)
 	}
-	r := Resolution{Node: "anchor", Modules: []Manifest{resolved, theRuntime(t)}, Needs: []Needed{
+	r := Resolution{Node: "anchor", Modules: []Manifest{resolved}, Needs: []Needed{
 		{Name: "postgres-database", For: "gitea", From: "anchor", At: "127.0.0.1",
 			Serves: map[string]any{"port": float64(5432)}, Sealed: "sealed-db"},
 		{Name: "route", For: "gitea", From: "anchor"},
@@ -252,8 +246,8 @@ func declaredGiteaSsh(t *testing.T, given map[int]int) map[string]any {
 	for k, v := range given {
 		givenPorts[k] = v
 	}
-	out, err := r.Declaration(Rendering{ArtifactStore: "anchor.internal:5101",
-		Needed: map[string]map[string]string{RuntimeModule: {"broker": "sealed-broker"}},
+	out, err := r.Declaration(Rendering{
+		Needed: map[string]map[string]string{"gitea": {"broker": "sealed-broker"}},
 		Ports:  map[string]map[int]int{"gitea": givenPorts},
 		Given:  map[string]map[int]int{"gitea": given},
 	})

internal/catalogue/genesis_image_test.go

@@ -1,29 +0,0 @@
-package catalogue
-
-import (
-	"os"
-	"regexp"
-	"testing"
-)
-
-// novox/hq issue 223: genesis raises the controller as a container built from this repository's own
-// Dockerfile, with no build arguments — the manifest no longer builds an image, so nothing passes a
-// base in. The Dockerfile's own default must therefore be a Go that builds this module, pinned by
-// digest, and the replacement the manifest's process names must be the container genesis raises.
-func TestGenesisCanBuildTheControllersImageAsItStands(t *testing.T) {
-	raw, err := os.ReadFile("../../Dockerfile")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !regexp.MustCompile(`(?m)^ARG GO_BASE=golang@sha256:[0-9a-f]{64}$`).Match(raw) {
-		t.Fatal("the Dockerfile's default Go base is not pinned by digest; genesis builds it with no arguments")
-	}
-	makefile, err := os.ReadFile("../../Makefile")
-	if err != nil {
-		t.Fatal(err)
-	}
-	pin := regexp.MustCompile(`golang@sha256:[0-9a-f]{64}`)
-	if string(pin.Find(raw)) != string(pin.Find(makefile)) {
-		t.Errorf("the Dockerfile and the Makefile build on different Go: %s, %s", pin.Find(raw), pin.Find(makefile))
-	}
-}

internal/catalogue/grant_secret_owner_test.go

@@ -1,103 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// A grant secret is read by whatever provisions, and that stopped being root (novox/hq issue 225).
-//
-// The mesh seals one credential per consumer beside the provider's contributions file. The
-// provider's harness reads both: the file to learn who asked, the secret to set their password.
-// While a module's own code ran in a container as root, a root-owned 0600 file was readable by
-// the thing that needed it. ADR 0198 moved that code under the node's runtime, which runs as the
-// operator's account — and the secret stayed root's.
-//
-// **The cost was silence.** The harness says `secret not readable yet`, which is true and
-// ordinary on the first pass, so four thousand refusals in three hours read as patience. No user
-// was ever created, and two consumers crash-looped against a database that had never heard of
-// them.
-//
-// The same reasoning is already written for a module's *own* secrets, three hundred lines above:
-// "a root-owned 0600 file is one that process cannot read". This is that rule reaching the other
-// kind of secret the mesh writes for a module.
-
-// aProviderWithABundle is a provider whose code is a bundle the node's runtime runs — the shape
-// every TypeScript provisioner has since ADR 0198.
-func aProviderWithABundle() Manifest {
-	return Manifest{
-		Module: "mongodb", Version: "1",
-		Provides: FromAnywhere("mongodb-database"),
-		Receives: map[string]string{"mongodb-database": "/var/lib/mongodb/grants/mesh.json"},
-		Grants:   map[string]string{"mongodb-database": "/var/lib/mongodb/grants"},
-		Bundles:  []Bundle{{Name: "code", Language: "typescript"}},
-		Resources: []map[string]any{{
-			"id": "server", "type": "container", "name": "mongodb-server",
-			"image": "mongo@sha256:" + strings.Repeat("a", 64),
-		}},
-	}
-}
-
-func TestAGrantSecretIsOwnedByTheAccountThatProvisions(t *testing.T) {
-	r, err := Resolve(shelf(aProviderWithABundle()), []string{"mongodb"}, reachable(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	r.Account = "operator"
-	out, err := r.Declaration(Rendering{Grants: []Grant{{
-		Provision: "mongodb-database", Consumer: "workstation", From: "photos", Slug: "photos",
-		Values: map[string]any{}, Sealed: "c2VhbGVk",
-	}}})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	var secret map[string]any
-	for _, res := range out {
-		if res["type"] == "file" && strings.HasSuffix(fmtPath(res), ".secret") {
-			secret = res
-		}
-	}
-	if secret == nil {
-		t.Fatalf("no grant secret was composed at all: %v", out)
-	}
-	if got := secret["owner"]; got != "operator" {
-		t.Fatalf("the grant secret at %v belongs to %v; the provisioner runs as %q and a "+
-			"root-owned 0600 file is one it cannot read — which is silent, because the harness "+
-			"calls it \"not readable yet\"", fmtPath(secret), got, "operator")
-	}
-}
-
-// And a provider whose code still runs in a container keeps the owner it declares, so this
-// changes nothing for the modules the runtime has not taken.
-func TestAContainerProvidersGrantSecretKeepsItsDeclaredOwner(t *testing.T) {
-	m := aProviderWithABundle()
-	m.Bundles = nil
-	m.SecretsOwner = "65534:65534"
-	r, err := Resolve(shelf(m), []string{"mongodb"}, reachable(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	r.Account = "operator"
-	out, err := r.Declaration(Rendering{Grants: []Grant{{
-		Provision: "mongodb-database", Consumer: "workstation", From: "photos", Slug: "photos",
-		Values: map[string]any{}, Sealed: "c2VhbGVk",
-	}}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, res := range out {
-		if res["type"] == "file" && strings.HasSuffix(fmtPath(res), ".secret") {
-			if got := res["owner"]; got != "65534:65534" {
-				t.Fatalf("a container provider's grant secret belongs to %v, not what it declares", got)
-			}
-			return
-		}
-	}
-	t.Fatal("no grant secret was composed")
-}
-
-func fmtPath(r map[string]any) string {
-	p, _ := r["path"].(string)
-	return p
-}

internal/catalogue/graphical_session.go

@@ -1,105 +0,0 @@
-package catalogue
-
-// The graphical session's seats (novox/hq ADR 0208): one module per piece of software, each piece's
-// role a node seat in the mesh's own set, so i3 and sway, xterm and foot, rofi and dmenu compete for
-// a role rather than each inventing one — and a machine running two of one role is refused at
-// assignment instead of found by two bars on one screen.
-const (
-	LoginManagerSeat     = "node-login-manager"
-	DisplayServerSeat    = "node-display-server"
-	DisplaySessionSeat   = "node-display-session"
-	TerminalEmulatorSeat = "node-terminal-emulator"
-	LauncherSeat         = "node-launcher"
-	NotifierSeat         = "node-notifier"
-	LockScreenSeat       = "node-lock-screen"
-	ClipboardSeat        = "node-clipboard"
-	BarSeat              = "node-bar"
-	CompositorSeat       = "node-compositor"
-	SecretServiceSeat    = "node-secret-service"
-)
-
-// graphicalSessionSeats are the eleven, in the order ADR 0208's table reads, each with the verbs
-// research 026/05 starts it with. Three have none yet: the bar, the compositor and the secret
-// service are roles a second holder competes for, and nothing has needed to ask them anything.
-func graphicalSessionSeats() []Seat {
-	const decided = "novox/hq ADR 0208"
-	return []Seat{
-		{Name: LoginManagerSeat, Scope: ScopeNode, Decision: decided, Serves: []Verb{
-			{Name: "sessions", Description: "The sessions the login manager offers on this machine, and which " +
-				"one the operator account starts by default.",
-				Input: schema(map[string]string{}, nil)},
-		}},
-		{Name: DisplayServerSeat, Scope: ScopeNode, Decision: decided, Serves: []Verb{
-			{Name: "displays", Description: "The monitors connected now, each with its identity, its modes and " +
-				"where it is placed; and the layout profile in force, if one matches.",
-				Input: schema(map[string]string{}, nil)},
-			// Profiles are keyed by the monitors' identities and are the operator's data (ADR 0208 §6).
-			{Name: "layout", Description: "The monitor layout profiles, keyed by the connected monitors' " +
-				"identities: list them, save the current arrangement under a name, or apply one.",
-				Input: withEnum(schema(map[string]string{
-					"action": "list, save or apply",
-					"name":   "the profile to save or apply (save and apply only)",
-				}, []string{"action"}), "action", "list", "save", "apply")},
-		}},
-		{Name: DisplaySessionSeat, Scope: ScopeNode, Decision: decided, Serves: []Verb{
-			{Name: "reload", Description: "Reload the session's configuration in place, keeping its windows.",
-				Input: schema(map[string]string{}, nil)},
-			{Name: "workspaces", Description: "The session's workspaces: each one's name, output, and whether " +
-				"it is visible or focused.",
-				Input: schema(map[string]string{}, nil)},
-			{Name: "windows", Description: "The session's windows: each one's title, class, workspace and " +
-				"whether it has focus; narrowed to one workspace when named.",
-				Input: schema(map[string]string{"workspace": "one workspace (optional)"}, nil)},
-		}},
-		{Name: TerminalEmulatorSeat, Scope: ScopeNode, Decision: decided, Serves: []Verb{
-			{Name: "open", Description: "Open a terminal window in the operator's session, running a command " +
-				"or the login shell, in a directory or the account's home.",
-				Input: schema(map[string]string{
-					"command":   "what to run in it (optional; the login shell when absent)",
-					"directory": "where it starts (optional; the account's home when absent)",
-				}, nil)},
-		}},
-		{Name: LauncherSeat, Scope: ScopeNode, Decision: decided, Serves: []Verb{
-			{Name: "menu", Description: "Put a menu of choices in front of the operator and answer with the " +
-				"one chosen, or nothing when the menu was dismissed — the dmenu-compatible contract.",
-				Input: map[string]any{"type": "object", "required": []string{"choices"},
-					"properties": map[string]any{
-						"choices": map[string]any{"type": "array", "items": map[string]any{"type": "string"},
-							"description": "the lines to choose between, in order"},
-						"prompt": map[string]any{"type": "string", "description": "what the menu asks (optional)"},
-					}}},
-		}},
-		{Name: NotifierSeat, Scope: ScopeNode, Decision: decided, Serves: []Verb{
-			{Name: "send", Description: "Show the operator a notification.",
-				Input: withEnum(schema(map[string]string{
-					"title":   "the notification's summary",
-					"body":    "its text (optional)",
-					"urgency": "low, normal (the default) or critical",
-				}, []string{"title"}), "urgency", "low", "normal", "critical")},
-			{Name: "history", Description: "The notifications shown lately, newest first.",
-				Input: schema(map[string]string{"limit": "how many (optional, default 20)"}, nil)},
-		}},
-		{Name: LockScreenSeat, Scope: ScopeNode, Decision: decided, Serves: []Verb{
-			{Name: "lock", Description: "Lock the operator's session now.",
-				Input: schema(map[string]string{}, nil)},
-		}},
-		{Name: ClipboardSeat, Scope: ScopeNode, Decision: decided, Serves: []Verb{
-			{Name: "history", Description: "What the clipboard held lately, newest first.",
-				Input: schema(map[string]string{"limit": "how many (optional, default 20)"}, nil)},
-			{Name: "copy", Description: "Put text on the operator's clipboard.",
-				Input: schema(map[string]string{"text": "the text"}, []string{"text"})},
-		}},
-		{Name: BarSeat, Scope: ScopeNode, Decision: decided},
-		{Name: CompositorSeat, Scope: ScopeNode, Decision: decided},
-		{Name: SecretServiceSeat, Scope: ScopeNode, Decision: decided},
-	}
-}
-
-// withEnum narrows one string property of a schema to the values it may take, so a caller is told
-// the choices by the schema rather than by a refusal.
-func withEnum(s map[string]any, property string, values ...string) map[string]any {
-	props := s["properties"].(map[string]any)
-	p := props[property].(map[string]any)
-	p["enum"] = values
-	return s
-}

internal/catalogue/graphical_session_test.go

@@ -1,213 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"reflect"
-	"strings"
-	"testing"
-)
-
-// Defends novox/hq ADR 0208: the graphical session is one module per piece, on the mesh's seats.
-
-// §2: the eleven roles are the mesh's own node seats, each with the verbs it starts with.
-func TestTheGraphicalSessionsSeatsAreTheMeshsOwnWithTheirVerbs(t *testing.T) {
-	want := map[string][]string{
-		LoginManagerSeat:     {"sessions"},
-		DisplayServerSeat:    {"displays", "layout"},
-		DisplaySessionSeat:   {"reload", "workspaces", "windows"},
-		TerminalEmulatorSeat: {"open"},
-		LauncherSeat:         {"menu"},
-		NotifierSeat:         {"send", "history"},
-		LockScreenSeat:       {"lock"},
-		ClipboardSeat:        {"history", "copy"},
-		BarSeat:              nil,
-		CompositorSeat:       nil,
-		SecretServiceSeat:    nil,
-	}
-	for name, verbs := range want {
-		s, ok := SeatNamed(name)
-		if !ok {
-			t.Errorf("%s is not in the mesh's set", name)
-			continue
-		}
-		if s.Scope != ScopeNode || s.Decision != "novox/hq ADR 0208" {
-			t.Errorf("%s is %s-scoped under %q", name, s.Scope, s.Decision)
-		}
-		var got []string
-		for _, v := range s.Serves {
-			got = append(got, v.Name)
-			if v.Description == "" || v.Input["type"] != "object" {
-				t.Errorf("%s.%s has no description or no object schema", name, v.Name)
-			}
-		}
-		if !reflect.DeepEqual(got, verbs) {
-			t.Errorf("%s serves %v, want %v", name, got, verbs)
-		}
-	}
-	// The launcher's menu takes a list, and the layout verb says its actions.
-	menu, _ := SeatNamed(LauncherSeat)
-	choices := menu.Serves[0].Input["properties"].(map[string]any)["choices"].(map[string]any)
-	if choices["type"] != "array" {
-		t.Errorf("menu's choices are %v, not a list", choices["type"])
-	}
-	display, _ := SeatNamed(DisplayServerSeat)
-	action := display.Serves[1].Input["properties"].(map[string]any)["action"].(map[string]any)
-	if !reflect.DeepEqual(action["enum"], []string{"list", "save", "apply"}) {
-		t.Errorf("layout's actions are %v", action["enum"])
-	}
-	// And they survive the store's JSON, which is where the live set comes from.
-	if _, err := json.Marshal(graphicalSessionSeats()); err != nil {
-		t.Fatal(err)
-	}
-}
-
-// §2: a module may claim one of them, and may not declare it as its own.
-func TestNoModuleMayDeclareAGraphicalSessionSeat(t *testing.T) {
-	raw := `{"module":"xorg","seats":[{"name":"node-display-server","scope":"node"}]}`
-	if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), "mesh's own namespace") {
-		t.Fatalf("a module declared node-display-server as its own: %v", err)
-	}
-}
-
-func displayServer(name, display string, claims ...string) Manifest {
-	m := Manifest{Module: name, Provides: []Offer{{Name: display, Reach: ReachMachine}}}
-	for _, c := range claims {
-		m.Claims = append(m.Claims, Claim{Name: c})
-	}
-	return m
-}
-
-func windowManager() Manifest {
-	return Manifest{Module: "i3", Requires: []string{"x11-display"}}
-}
-
-// §3: a display is resolved on the requiring module's own node.
-func TestAMachineReachRequirementResolvesToTheProviderOnItsOwnNode(t *testing.T) {
-	cat := shelf(windowManager(), displayServer("xorg", "x11-display", DisplayServerSeat))
-	got, err := Resolve(cat, []string{"xorg", "i3"}, workstation(), World{})
-	if err != nil {
-		t.Fatalf("i3 beside xorg did not resolve: %v", err)
-	}
-	if !reflect.DeepEqual(names(got), []string{"xorg", "i3"}) && !reflect.DeepEqual(names(got), []string{"i3", "xorg"}) {
-		t.Errorf("resolved %v", names(got))
-	}
-}
-
-// §3: never answered by installing a provider, and never by another machine's.
-func TestAMachineReachRequirementIsNotPulledInNorAnsweredFromAnotherNode(t *testing.T) {
-	cat := shelf(windowManager(),
-		displayServer("xorg", "x11-display", DisplayServerSeat),
-		displayServer("xwayland", "x11-display"))
-	// Another machine runs xorg and says so to the world; it does not count.
-	world := World{Offered: map[string][]Provider{
-		"x11-display": {{Node: "laptop", At: "laptop.mesh", Module: "xorg"}}}}
-	_, err := Resolve(cat, []string{"i3"}, workstation(), world)
-	if err == nil {
-		t.Fatal("i3 resolved on a machine with no display of its own")
-	}
-	for _, want := range []string{
-		`"x11-display" is wanted by i3`, "usable only on the machine that provides it",
-		"assign one to workstation", "xorg (holds node-display-server)", "xwayland",
-	} {
-		if !strings.Contains(err.Error(), want) {
-			t.Errorf("the refusal does not say %q:\n%v", want, err)
-		}
-	}
-	// With a single provider in the catalogue too: one candidate is still not a choice to make
-	// for somebody, unlike a node-scoped provision without the machine's reach.
-	_, err = Resolve(shelf(windowManager(), displayServer("xorg", "x11-display", DisplayServerSeat)),
-		[]string{"i3"}, workstation(), World{})
-	if err == nil {
-		t.Fatal("xorg was pulled in for i3")
-	}
-	// Not in the first pass, whose refusals take the machine off the network.
-	if _, err := Resolve(cat, []string{"i3"}, workstation(), World{Unchecked: true}); err != nil {
-		t.Errorf("the first pass refused: %v", err)
-	}
-}
-
-func TestTheMachinesReachIsAProvisionsOnlyReachAndIsNodeScoped(t *testing.T) {
-	for _, c := range []struct{ provides, want string }{
-		{`{"name":"x11-display","reach":"internal"}`, `with reach "internal"; a provision's reach is "machine" or nothing`},
-		{`{"name":"x11-display","scope":"mesh","reach":"machine"}`, `at scope "mesh" with the machine's reach`},
-	} {
-		_, err := ParseManifest([]byte(`{"module":"xorg","provides":[` + c.provides + `]}`))
-		if err == nil || !strings.Contains(err.Error(), c.want) {
-			t.Errorf("%s: want %q, got %v", c.provides, c.want, err)
-		}
-	}
-	m, err := ParseManifest([]byte(`{"module":"xorg","provides":[{"name":"x11-display","reach":"machine"}]}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !m.Provides[0].MachineReach() {
-		t.Fatal("the reach was not read")
-	}
-	back, _ := json.Marshal(m.Provides[0])
-	if string(back) != `{"name":"x11-display","reach":"machine"}` {
-		t.Errorf("written back as %s", back)
-	}
-}
-
-func TestACatalogueDisagreeingAboutAProvisionsReachIsRefused(t *testing.T) {
-	cat := shelf(windowManager(), displayServer("xorg", "x11-display"),
-		Manifest{Module: "fake-x", Provides: Offers("x11-display")})
-	_, err := Resolve(cat, []string{"xorg", "i3"}, workstation(), World{})
-	if err == nil || !strings.Contains(err.Error(), `the catalogue disagrees about "x11-display"`) {
-		t.Fatalf("a provision with and without the machine's reach gave %v", err)
-	}
-}
-
-// §4: xinitrc and xresources slots, placed by the display server's holder alone.
-func TestTheSessionsFilesArePlacedByTheDisplayServersHolderAlone(t *testing.T) {
-	xorg := Manifest{Module: "xorg", Claims: []Claim{{Name: DisplayServerSeat}},
-		Shell: []ShellCode{{For: "xinitrc", Slot: "first", Code: "xset s off"}},
-		Resources: []map[string]any{
-			{"id": "xinitrc", "type": "file", "path": "/home/op/.xinitrc",
-				"content": "${shell:xinitrc:first}${shell:xinitrc:normal}${shell:xinitrc:last}"},
-			{"id": "xresources", "type": "file", "path": "/home/op/.Xresources",
-				"content": "${shell:xresources:normal}"},
-		}}
-	i3 := Manifest{Module: "i3", Shell: []ShellCode{{For: "xinitrc", Slot: "last", Code: "exec i3"}}}
-	theme := Manifest{Module: "theme", Shell: []ShellCode{
-		{For: "xresources", Slot: "normal", Code: "Xft.dpi: 96"},
-		{For: "zsh", Slot: "normal", Code: "not for the session"},
-	}}
-	r := Resolution{Node: "workstation", Account: "op", Modules: []Manifest{xorg, i3, theme}}
-	out, err := r.Declaration(Rendering{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	by := map[string]any{}
-	for _, res := range out {
-		by[res["id"].(string)] = res["content"]
-	}
-	if got := by["xorg.xinitrc"]; got != "# xorg\nxset s off\n# i3\nexec i3\n" {
-		t.Errorf("the .xinitrc is %q", got)
-	}
-	if got := by["xorg.xresources"]; got != "# theme\nXft.dpi: 96\n" {
-		t.Errorf("the .Xresources is %q", got)
-	}
-
-	// The contributions parse; the placeholders parse only in the holder.
-	if _, err := ParseManifest([]byte(`{"module":"i3","shell":[{"for":"xinitrc","slot":"last","code":"exec i3"},` +
-		`{"for":"xresources","slot":"normal","code":"i3.font: x"}]}`)); err != nil {
-		t.Fatalf("a session contribution was refused: %v", err)
-	}
-	for _, c := range []struct{ claims, content, want string }{
-		{``, "${shell:xinitrc:normal}", "does not claim node-display-server; every module's xinitrc is placed by the display server's holder alone"},
-		{`{"name":"node-login-shell"}`, "${shell:xresources:normal}", "does not claim node-display-server"},
-		{`{"name":"node-display-server"}`, "${shell:zsh:normal}", "does not claim node-login-shell"},
-		{`{"name":"node-display-server"}`, "${shell:xsession:normal}", "the session's file one of xinitrc, xresources"},
-	} {
-		raw := `{"module":"holder","claims":[` + c.claims + `],"resources":[{"id":"rc","type":"file","path":"/etc/rc","content":"` +
-			c.content + `"}]}`
-		if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), c.want) {
-			t.Errorf("%s with claims [%s]: want %q, got %v", c.content, c.claims, c.want, err)
-		}
-	}
-	if _, err := ParseManifest([]byte(`{"module":"xorg","claims":[{"name":"node-display-server"}],` +
-		`"resources":[{"id":"rc","type":"file","path":"/home/op/.xinitrc","content":"${shell:xinitrc:last}"}]}`)); err != nil {
-		t.Errorf("the display server's holder could not place the session's slots: %v", err)
-	}
-}

internal/catalogue/jails_into.go

@@ -1,8 +1,6 @@
 package catalogue
 
 import (
-	"crypto/sha256"
-	"encoding/hex"
 	"fmt"
 	"sort"
 	"strings"
@@ -45,16 +43,8 @@ func jailsInto(modules []Manifest, j *Jailing) []map[string]any {
 
 	out := make([]map[string]any, 0, len(jails)+1)
 	for _, d := range jails {
-		// **The filter's digest rides in the jail file.** fail2ban is restarted when this file
-		// changes, and the filter is a file of its own: a module that changed only what a failure
-		// looks like rewrote the filter on disk and left the running jail on the old pattern, with
-		// nothing said (novox/hq issue 191's rollout found it on gitea's sshd). Naming the filter's
-		// digest here makes a changed pattern a changed jail file, so the restart the service
-		// already takes on it covers the filter too.
-		sum := sha256.Sum256([]byte(d.jail.Failregex))
-		fmt.Fprintf(&composed, "\n# from %s, filter %s\n[%s]\nenabled = true\nfilter = %s\n%s\n",
-			d.module, hex.EncodeToString(sum[:])[:12], d.jail.Name, d.jail.Name,
-			strings.TrimRight(d.jail.Jail, "\n"))
+		fmt.Fprintf(&composed, "\n# from %s\n[%s]\nenabled = true\nfilter = %s\n%s\n",
+			d.module, d.jail.Name, d.jail.Name, strings.TrimRight(d.jail.Jail, "\n"))
 		// The filter is a file of its own, named as the jail's filter= references it.
 		out = append(out, map[string]any{
 			"id":   "filter-" + d.jail.Name,

internal/catalogue/jails_into_test.go

@@ -44,29 +44,3 @@ func TestTheComposedJailFileIsWrittenEvenWhenEmpty(t *testing.T) {
 		t.Fatalf("the empty composed jail file was not written alone: %v", files)
 	}
 }
-
-// A changed pattern restarts fail2ban (novox/hq issue 191's rollout): the service restarts when the
-// composed jail file changes, and the filter is a file of its own, so the jail file names the
-// filter's digest. Changing only the failregex must change the jail file; the same pattern must not.
-func TestAChangedFilterChangesTheJailFile(t *testing.T) {
-	jailFile := func(failregex string) string {
-		modules := []Manifest{
-			{Module: "fail2ban", Jailing: &Jailing{Into: "/etc/fail2ban/jail.d/mesh.conf", FilterInto: "/etc/fail2ban/filter.d"}},
-			{Module: "gitea", Jails: []Jail{{Name: "gitea", Failregex: failregex, Jail: "port = 222"}}},
-		}
-		for _, f := range jailsInto(modules, modules[0].Jailing) {
-			if f["id"] == ComposedJailsID() {
-				return f["content"].(string)
-			}
-		}
-		t.Fatal("no composed jail file")
-		return ""
-	}
-	before := jailFile("web login failed from <HOST>")
-	if again := jailFile("web login failed from <HOST>"); again != before {
-		t.Errorf("the same pattern composed a different jail file, which would restart fail2ban for nothing")
-	}
-	if after := jailFile("web login failed from <HOST>\n            Invalid user .* from <HOST>"); after == before {
-		t.Errorf("a changed pattern left the jail file as it was, so fail2ban keeps the old filter:\n%s", after)
-	}
-}

internal/catalogue/manifest.go

@@ -147,17 +147,8 @@ type Offer struct {
 	// shared by every consumer (novox/hq ADR 0158): software that holds one password or one key
 	// cannot give each consumer a login of its own. The named secret must say how it is taken.
 	Credential *OfferCredential `json:"credential,omitempty"`
-	// Reach is ReachMachine for a provision usable only on the provider's own machine — a display
-	// (novox/hq ADR 0208 §3). Node scope already keeps a provision off other machines; what this adds
-	// is that a requirement for it is never answered by installing a provider: the display server is
-	// a seat's holder gated by the machine's graphical session, and pulling one in for whatever asked
-	// is the misassignment research 026 found. Unmet, the requirement is refused naming who could.
-	Reach string `json:"reach,omitempty"`
 }
 
-// MachineReach is whether a provision is usable only on its provider's own machine.
-func (o Offer) MachineReach() bool { return o.Reach == ReachMachine }
-
 // OfferCredential names which of the provider's own secrets a provision's consumers receive.
 type OfferCredential struct {
 	Own string `json:"own"`
@@ -205,29 +196,27 @@ func (o *Offer) UnmarshalJSON(raw []byte) error {
 		Name       string           `json:"name"`
 		Scope      string           `json:"scope,omitempty"`
 		Credential *OfferCredential `json:"credential,omitempty"`
-		Reach      string           `json:"reach,omitempty"`
 	}
 	dec := json.NewDecoder(bytes.NewReader(raw))
 	dec.DisallowUnknownFields()
 	if err := dec.Decode(&full); err != nil {
-		return fmt.Errorf("a provided name is either a string or {name, scope, credential, reach}: %w", err)
+		return fmt.Errorf("a provided name is either a string or {name, scope, credential}: %w", err)
 	}
-	o.Name, o.Scope, o.Credential, o.Reach = full.Name, full.Scope, full.Credential, full.Reach
+	o.Name, o.Scope, o.Credential = full.Name, full.Scope, full.Credential
 	return nil
 }
 
 // MarshalJSON writes back the short form when there is nothing else to say, so a manifest that
 // went through the mesh comes out looking like the one that went in.
 func (o Offer) MarshalJSON() ([]byte, error) {
-	if o.Scope == "" && o.Credential == nil && o.Reach == "" {
+	if o.Scope == "" && o.Credential == nil {
 		return json.Marshal(o.Name)
 	}
 	return json.Marshal(struct {
 		Name       string           `json:"name"`
 		Scope      string           `json:"scope,omitempty"`
 		Credential *OfferCredential `json:"credential,omitempty"`
-		Reach      string           `json:"reach,omitempty"`
-	}{o.Name, o.Scope, o.Credential, o.Reach})
+	}{o.Name, o.Scope, o.Credential})
 }
 
 // Manifest is everything a module says about itself.
@@ -336,15 +325,6 @@ type Manifest struct {
 	// person's account (design 25 §7) already had the same shape.
 	Invokes []string `json:"invokes,omitempty"`
 
-	// State is the current state this module keeps on the bus, by local name: each a key-value
-	// bucket the controller creates, which every instance of the module writes and reads
-	// (novox/hq ADR 0201). Not history — that is an event — and never a secret, sealed or not.
-	State []StateDeclaration `json:"state,omitempty"`
-
-	// Reads are other modules' state this module reads and watches, each `<module>.<name>`
-	// (novox/hq ADR 0201). Read-only: only the owner's instances write.
-	Reads []string `json:"reads,omitempty"`
-
 	// Capabilities the machine must have. A different field from Requires because the remedy
 	// differs: a missing module can be assigned, and a missing capability means the wrong
 	// machine.
@@ -528,17 +508,6 @@ type Manifest struct {
 	// holder. Like Filtering: one module per node gathers what every module declared and writes it.
 	Jailing *Jailing `json:"jailing,omitempty"`
 
-	// Environment is what this module adds to the operator account's environment: variables, and
-	// entries on PATH (novox/hq ADR 0203). Facts, not lines of one shell's syntax — the holder of
-	// node-environment places them, and the controller writes them in each reader's format. Like
-	// Jails: any module contributes, gathered from every module on the node, written by the holder.
-	Environment *Environment `json:"environment,omitempty"`
-
-	// Shell is code this module adds to the login shell's startup, for a named shell in a named
-	// slot (novox/hq ADR 0204). The controller never reads it: it is placed, in module order, where
-	// the holder of node-login-shell put the slot's placeholder.
-	Shell []ShellCode `json:"shell,omitempty"`
-
 	// Guards are ports of this module's the mesh refuses on an adopted node except from the
 	// private network and from the machine itself (novox/hq ADR 0100) — the store's port and the
 	// broker's management port. The ports the software uses; the mesh guards where the machine
@@ -603,44 +572,6 @@ type Manifest struct {
 	// a module that could ask for it could read every credential on the bus — and the claim on
 	// `mesh-broker` is what authorises it, checked from this manifest alone.
 	BusUsers string `json:"bus-users,omitempty"`
-
-	// Bundles are this module's compiled bundles as the build produced them: what each is called,
-	// where it is, what it hashes to, what language it is in and which files a tool runtime loads
-	// from it (novox/hq ADR 0175, to-be 38).
-	//
-	// **Derived, never written.** The manifest in a repository says `build.artifacts`; the manifest
-	// the mesh holds says what came out, the way a resource naming an artifact comes to name a
-	// digest. Kept here because a tools bundle is referenced by no resource of the module's own —
-	// the node's runtime loads it, and the runtime is composed by the mesh — so without this the
-	// resolved manifest would carry no trace of the one artifact the runtime needs. A repository
-	// manifest that writes this beside a build is refused: it would be stating the build's output
-	// by hand.
-	Bundles []Bundle `json:"bundles,omitempty"`
-}
-
-// Bundle is one compiled bundle after it exists, as the resolved manifest carries it.
-type Bundle struct {
-	Name string `json:"name"`
-	// Source is where a machine fetches it, kept without the store's address like every reference
-	// the mesh records (artifacts.go); Digest is what it must hash to.
-	Source string `json:"source"`
-	Digest string `json:"digest"`
-	// Language is what it was compiled from, which is what says how it is run.
-	Language string `json:"language,omitempty"`
-	// Entrypoints are the compiled files it was built around, relative to its root.
-	Entrypoints []string `json:"entrypoints,omitempty"`
-	// Loads are the entrypoints a node's tool runtime imports from it: what the artifact said, or
-	// every entrypoint for a module declaring tools that said nothing. Empty for a bundle that is
-	// run rather than loaded.
-	Loads []string `json:"loads,omitempty"`
-	// Env is what the artifact said it is given (ADR 0192), as written; composed per machine.
-	Env map[string]string `json:"env,omitempty"`
-	// Launchers are the executables the build wrote beside its entrypoints, by entrypoint (novox/hq
-	// ADR 0193). A bundle built before them has none, and is served as it was built.
-	Launchers map[string]string `json:"launchers,omitempty"`
-	// Binary is the executable a bundle compiled to a binary is, at its root (novox/hq ADR 0193):
-	// what runs it, where an interpreted bundle names an interpreter and an entrypoint.
-	Binary string `json:"binary,omitempty"`
 }
 
 // Build says how to produce this module's artifacts from its source.
@@ -777,26 +708,6 @@ type Artifact struct {
 	// somebody adds a helper. An empty list is a bundle that is run rather than loaded — a
 	// provisioner or a step, named by whatever runs it.
 	Entrypoints []string `json:"entrypoints,omitempty"`
-
-	// Loads are the entrypoints of this bundle the node's tool runtime loads (novox/hq ADR 0175,
-	// to-be 38): the module's tool code, each file registering its tools as it is imported. A
-	// subset of Entrypoints, for a bundle that also carries things that are RUN — a daemon, a
-	// step, a report — and must not have them imported into the runtime.
-	//
-	// Absent means every entrypoint, for a module that declares `tools`: a bundle holding the
-	// module's tools and nothing else is the ordinary case and should not have to say the same
-	// list twice. A module declaring no tools has nothing the runtime loads, whatever it compiles.
-	Loads []string `json:"loads,omitempty"`
-
-	// External are packages a TypeScript bundle keeps as imports rather than inlining — a native
-	// addon, a package that reads its own files — and so carries the toolchain's node_modules for
-	// (novox/hq ADR 0193). Absent for nearly every bundle, which is then one file per entrypoint.
-	External []string `json:"external,omitempty"`
-
-	// Env is what a tools bundle is given on a machine (novox/hq ADR 0192): words and their values,
-	// paths and constants composed with ${dir:…} and ${port:…} exactly as a container's environment
-	// is, never a secret's content. The node's runtime hands it to this bundle and to no other.
-	Env map[string]string `json:"env,omitempty"`
 }
 
 // Kinds an artifact may be.
@@ -1328,19 +1239,6 @@ func ParseManifest(raw []byte) (Manifest, error) {
 				"%s provides %q at scope %q; a provision is %q or %q",
 				m.Module, p, s, ScopeNode, ScopeMesh))
 		}
-		switch {
-		case offer.Reach == "":
-		case offer.Reach != ReachMachine:
-			// The one reach a provision has (novox/hq ADR 0208): a provision reached over the private
-			// network is mesh scope, and the world reaches nothing but a name.
-			problems = append(problems, fmt.Sprintf(
-				"%s provides %q with reach %q; a provision's reach is %q or nothing",
-				m.Module, p, offer.Reach, ReachMachine))
-		case offer.At() != ScopeNode:
-			problems = append(problems, fmt.Sprintf(
-				"%s provides %q at scope %q with the machine's reach; a provision usable only on its own "+
-					"machine is node-scoped (novox/hq ADR 0208)", m.Module, p, offer.At()))
-		}
 		if p == m.Module {
 			// Harmless and worth saying: a module always provides its own name, so writing it
 			// suggests the author expected it not to.
@@ -1360,8 +1258,6 @@ func ParseManifest(raw []byte) (Manifest, error) {
 	// module whose event names are wrong installs, starts, connects and reacts to nothing, with
 	// every log line saying it is fine (novox/hq 04-ISSUES/127).
 	problems = append(problems, EventProblems(m)...)
-	// And what it may call its state, and whose it may read (state.go, novox/hq ADR 0201).
-	problems = append(problems, StateProblems(m)...)
 	wellFormed := true
 	for _, c := range m.Claims {
 		if !name.MatchString(c.Name) {
@@ -1424,7 +1320,6 @@ func ParseManifest(raw []byte) (Manifest, error) {
 		}
 	}
 	problems = append(problems, m.Build.problems(m.Module)...)
-	problems = append(problems, undeliveredBundles(m)...)
 	// **What provides the artifact store cannot be delivered through it** (novox/hq 04-ISSUES/029).
 	//
 	// Building publishes to the store, and the builder will not start without one. So a module
@@ -1438,15 +1333,6 @@ func ParseManifest(raw []byte) (Manifest, error) {
 	//
 	// Refused here because the alternative is a build that never returns, on a mesh new enough
 	// that nobody is watching it yet.
-	if m.Build != nil && len(m.Bundles) > 0 {
-		// The output of a build, written beside the build that produces it (ADR 0175). A resource
-		// naming a digest beside an `artifact` would be the same mistake, and is caught the same way:
-		// what the mesh derives, a repository does not state.
-		problems = append(problems, fmt.Sprintf(
-			"%s writes `bundles` beside its build. The mesh derives that from what the build "+
-				"produced; a manifest states `build.artifacts` and nothing about what came out",
-			m.Module))
-	}
 	if m.Build != nil && len(m.Build.Artifacts) > 0 {
 		for _, o := range m.Offers() {
 			if o != ArtifactStoreProvision {
@@ -1474,7 +1360,7 @@ func ParseManifest(raw []byte) (Manifest, error) {
 				"%s serves %q to whoever requires it, and does not provide it", m.Module, to))
 		}
 	}
-	// A served value may be derived for the consumer it is served to (novox/hq ADR 0201). Read
+	// A served value may be derived for the consumer it is served to (novox/hq ADR 0188). Read
 	// here, where the definition is, rather than when somebody first requires it: a rule that
 	// would be refused at the first consumer is wrong from the moment it is written.
 	problems = append(problems, CheckServes(m)...)
@@ -1565,53 +1451,6 @@ func ParseManifest(raw []byte) (Manifest, error) {
 				"program that reads what the mesh delivered and reconciles",
 			m.Module, r["id"]))
 	}
-	// **What a process replaces is something the module no longer declares** (novox/hq issue 213).
-	// The host keeps it running until the process is, then removes it: so it is named by the id the
-	// module used to give it, it is never a resource the module still declares — that would be
-	// applied and removed by one declaration — and only a process that stays up has anything to
-	// hand over to. Said here, near the author, as the host would refuse it far away.
-	ids := map[string]bool{}
-	for _, r := range m.Resources {
-		ids[fmt.Sprint(r["id"])] = true
-	}
-	for _, r := range m.Resources {
-		raw, present := r["replaces"]
-		if !present {
-			continue
-		}
-		if fmt.Sprint(r["type"]) != "process" {
-			problems = append(problems, fmt.Sprintf(
-				"%s: %v says what it replaces, and only a process does", m.Module, r["id"]))
-			continue
-		}
-		if once, _ := r["run-once"].(bool); once || r["schedule"] != nil {
-			problems = append(problems, fmt.Sprintf(
-				"%s: %v replaces something and runs once or on a schedule — only a process that stays "+
-					"up is there a moment later to hand over to", m.Module, r["id"]))
-		}
-		list, ok := raw.([]any)
-		if !ok {
-			problems = append(problems, fmt.Sprintf(
-				"%s: %v replaces %v; replaces is a list of the ids this module no longer declares",
-				m.Module, r["id"], raw))
-			continue
-		}
-		for _, item := range list {
-			id, ok := item.(string)
-			switch {
-			case !ok || strings.TrimSpace(id) == "":
-				problems = append(problems, fmt.Sprintf(
-					"%s: %v replaces %v, which is not an id", m.Module, r["id"], item))
-			case strings.Contains(id, "."):
-				problems = append(problems, fmt.Sprintf(
-					"%s: %v replaces %q; a process replaces only a resource of its own module, named "+
-						"by its own id", m.Module, r["id"], id))
-			case ids[id]:
-				problems = append(problems, fmt.Sprintf(
-					"%s: %v replaces %q, which this module still declares", m.Module, r["id"], id))
-			}
-		}
-	}
 	// **A module that prepares its state must have code the mesh can run** (novox/hq ADR 0135). The
 	// preparation is the module's own program in its preparation mode, so it is derived from the
 	// resource that runs that program — and a module declaring none has asked for something the mesh
@@ -1619,7 +1458,7 @@ func ParseManifest(raw []byte) (Manifest, error) {
 	// quietly prepares nothing.
 	if m.Prepares && preparationTarget(m) == "" {
 		problems = append(problems, fmt.Sprintf(
-			"%s says it prepares its state, and declares no container or process running an artifact it built — "+
+			"%s says it prepares its state, and declares no container running an artifact it built — "+
 				"the preparation is this module's own program, so there has to be one for the mesh to "+
 				"run it in", m.Module))
 	}
@@ -1840,12 +1679,6 @@ func ParseManifest(raw []byte) (Manifest, error) {
 	problems = append(problems, m.unknownDirRefs()...)
 	problems = append(problems, m.unknownAccessRefs()...)
 	problems = append(problems, m.jailProblems()...)
-	// What a module adds to the account's environment and to the login shell, and the holder's
-	// placeholders for them (novox/hq ADR 0203, ADR 0204) — here, so the catalogue check refuses
-	// them in the words registration does.
-	problems = append(problems, m.environmentProblems()...)
-	problems = append(problems, m.shellProblems()...)
-	problems = append(problems, m.contributionPlaceholderProblems()...)
 
 	for i, r := range m.Resources {
 		id, _ := r["id"].(string)

internal/catalogue/names_served.go

@@ -0,0 +1,124 @@
+package catalogue
+
+import (
+	"sort"
+	"strings"
+)
+
+// Which machine serves each routed name (novox/hq ADR 0066, issue 178).
+//
+// A routed name is a label the mesh composed for a consumer's endpoint, and it is *served* by the
+// provider that answers requests for it — the proxy the consumer's route reaches. The same name is
+// composed into every labelled contribution the consumer makes, because a provider that must know
+// the consumer's public name (an identity provider composing a redirect) is told it the same way
+// (04-ISSUES/122). Attributing the name to whichever of those providers a map happened to yield
+// last sent a public name to the identity provider's machine on one plan and to the proxy's on the
+// next (forge issue 227), and the whole names region flipped with it.
+//
+// **The terminus serves the name.** Among the providers a name reaches, the one that serves it is
+// the one that is not itself routed: a provider that contributes a labelled name of its own to some
+// requirement is published through another provider, and is a consumer of names, not their end.
+// Name-agnostic — nothing here knows what "route" means — and structural: it reads the graph the
+// modules declared. Deterministic: names, requirements and nodes are walked in order, so two
+// plans of one mesh yield one region.
+
+// NamesServed is every routed name across the mesh and the node that serves it, from every node's
+// resolution and settings. A name several termini claim goes to the first node in name order, so
+// the answer is stable; a name nothing terminal claims is left out.
+func NamesServed(plans map[string]Resolution, settings map[string]SettingsBy) (map[string]string, error) {
+	nodes := make([]string, 0, len(plans))
+	for n := range plans {
+		nodes = append(nodes, n)
+	}
+	sort.Strings(nodes)
+
+	out := map[string]string{}
+	for _, node := range nodes {
+		plan := plans[node]
+		all, err := plan.contributions(settings[node], nil, nil)
+		if err != nil {
+			return nil, err
+		}
+		requirements := make([]string, 0, len(all))
+		for to := range all {
+			requirements = append(requirements, to)
+		}
+		sort.Strings(requirements)
+		for _, to := range requirements {
+			for _, given := range all[to] {
+				if given.Node != "" {
+					// Said from another machine; that machine's own resolution carries it.
+					continue
+				}
+				// A routed name, and only that: a contribution the mesh composed a name for from a
+				// label it was given. A grant that happens to carry a `name` of its own — a database
+				// name — carries no label and is left alone.
+				if _, labelled := given.Values["label"]; !labelled {
+					continue
+				}
+				name, _ := given.Values["name"].(string)
+				if name == "" {
+					continue
+				}
+				serving := servingNodeOf(plan, to, given.From, node)
+				if !servesNames(plans[serving], to) {
+					continue
+				}
+				name = strings.ToLower(name)
+				if held, taken := out[name]; !taken || serving < held {
+					out[name] = serving
+				}
+			}
+		}
+	}
+	return out, nil
+}
+
+// servingNodeOf is the node answering one consumer's requirement: whoever the plan needs it from,
+// or this same node when the provider is beside the consumer.
+func servingNodeOf(plan Resolution, requirement, consumer, self string) string {
+	for _, need := range plan.Needs {
+		if need.Name == requirement && need.For == consumer && need.From != "" {
+			return need.From
+		}
+	}
+	return self
+}
+
+// servesNames says whether the module providing a requirement on a node is a terminus: it is not
+// itself published under a labelled name through some other provider. A node whose plan is not
+// known (it did not resolve) serves nothing.
+func servesNames(plan Resolution, requirement string) bool {
+	for _, m := range plan.Modules {
+		if !offers(m, requirement) {
+			continue
+		}
+		return !contributesALabel(m)
+	}
+	return false
+}
+
+func offers(m Manifest, requirement string) bool {
+	for _, o := range m.Offers() {
+		if o == requirement {
+			return true
+		}
+	}
+	return false
+}
+
+func contributesALabel(m Manifest) bool {
+	for _, values := range m.Contributes {
+		if _, labelled := values["label"]; labelled {
+			return true
+		}
+	}
+	for _, locals := range m.ContributesMany {
+		for _, values := range locals {
+			if _, labelled := values["label"]; labelled {
+				return true
+			}
+		}
+	}
+	return false
+}

internal/catalogue/names_served_test.go

@@ -0,0 +1,99 @@
+package catalogue
+
+import (
+	"testing"
+)
+
+// The mesh of forge issue 227 (novox/hq issue 178): a dashboard on the home server contributes its
+// label to the route its proxy serves AND to the identity provider on the control node, which must
+// know the dashboard's public name to compose a redirect. Both contributions carry the composed
+// name; only the proxy serves it.
+func twoNodesOneName(t *testing.T) (map[string]Resolution, map[string]SettingsBy) {
+	t.Helper()
+	catalogue := shelf(
+		Manifest{Module: "route-adapter", Version: "1", Provides: Offers("route"),
+			Serves: map[string]map[string]any{"route": {}}, Receives: map[string]string{"route": "/etc/adapter/mesh.json"}},
+		Manifest{Module: "route-proxy", Version: "1", Provides: Offers("route"),
+			Serves: map[string]map[string]any{"route": {}}, Receives: map[string]string{"route": "/etc/proxy/mesh.json"}},
+		Manifest{Module: "keycloak", Version: "1", Provides: FromAnywhere("oidc-client"),
+			Serves:   map[string]map[string]any{"oidc-client": {"token-path": "/token"}},
+			Receives: map[string]string{"oidc-client": "/etc/keycloak/clients.json"},
+			Listens:  []Listening{{Port: 8080, From: FromMesh, Why: "the login page"}},
+			// Published through the proxy itself: the identity provider is routed, not a router.
+			Contributes: map[string]map[string]any{"route": {"label": "login", "endpoint": "web", "port": 8080}}},
+		Manifest{Module: "grafana", Version: "1",
+			Listens: []Listening{{Port: 3000, From: FromMesh, Why: "dashboards"}},
+			Contributes: map[string]map[string]any{
+				"route":       {"label": "grafana", "endpoint": "web", "port": 3000},
+				"oidc-client": {"label": "grafana", "endpoint": "web", "port": 3000, "callback": "/login"},
+			}},
+	)
+	home := withDomain("home.example")
+	home.Name, home.At = "home-server", "home-server.internal"
+	control := withDomain("control.example")
+	control.Name, control.At = "anchor", "anchor.internal"
+
+	onHome, err := Resolve(catalogue, []string{"grafana", "route-adapter"}, home, World{
+		Offered: map[string][]Provider{"oidc-client": {{Node: "anchor", At: "anchor.internal", Module: "keycloak"}}},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	onControl, err := Resolve(catalogue, []string{"keycloak", "route-proxy"}, control, World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return map[string]Resolution{"home-server": onHome, "anchor": onControl},
+		map[string]SettingsBy{"home-server": {}, "anchor": {}}
+}
+
+func TestANameResolvesToTheNodeWhoseProxyServesIt(t *testing.T) {
+	plans, settings := twoNodesOneName(t)
+	// Many times, because the fault was map order: one plan said one node, the next the other.
+	for i := 0; i < 25; i++ {
+		served, err := NamesServed(plans, settings)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if served["grafana.home.example"] != "home-server" {
+			t.Fatalf("run %d: the dashboard's name is served by %q, and its proxy is on the home server: %v",
+				i, served["grafana.home.example"], served)
+		}
+		if served["login.control.example"] != "anchor" {
+			t.Fatalf("run %d: the identity provider's own name is served by its proxy on the control node: %v", i, served)
+		}
+		if _, leaked := served["grafana.control.example"]; leaked {
+			t.Fatalf("a name composed for the identity provider's benefit is not one it serves: %v", served)
+		}
+	}
+}
+
+// A module that is routed several times names each route (ADR 0094's sibling for contributes);
+// every one of them is a name the mesh must resolve, and none reached the names region before.
+func TestEveryRouteOfAModuleWithSeveralIsANameServed(t *testing.T) {
+	catalogue := shelf(
+		Manifest{Module: "route-proxy", Version: "1", Provides: Offers("route"),
+			Serves: map[string]map[string]any{"route": {}}, Receives: map[string]string{"route": "/etc/proxy/mesh.json"}},
+		Manifest{Module: "photos", Version: "1",
+			Listens: []Listening{{Port: 8102, From: FromMesh, Why: "web"}, {Port: 9102, From: FromMesh, Why: "api"}},
+			ContributesMany: map[string]map[string]map[string]any{"route": {
+				"site": {"label": "photos", "endpoint": "web", "port": 8102},
+				"api":  {"label": "photos-api", "endpoint": "api", "port": 9102},
+			}}},
+	)
+	node := withDomain("control.example")
+	node.Name, node.At = "anchor", "anchor.internal"
+	plan, err := Resolve(catalogue, []string{"photos", "route-proxy"}, node, World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	served, err := NamesServed(map[string]Resolution{"anchor": plan}, map[string]SettingsBy{"anchor": {}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, name := range []string{"photos.control.example", "photos-api.control.example"} {
+		if served[name] != "anchor" {
+			t.Fatalf("%s is not served by its proxy: %v", name, served)
+		}
+	}
+}

internal/catalogue/port_into.go

@@ -31,7 +31,7 @@ import (
 //
 // So a module asks. `${port:8080}` is "the machine-side port you gave me for the 8080 I said I
 // listen on", and the module writes that where it would otherwise have written a literal — in a
-// file's content, or in a value of a container's or a process's `env`.
+// file's content, or in a value of a container's `env`.
 //
 // **The environment is filled by the control plane, exactly as a bound value is.** A port is not
 // secret — the mesh holds it in the clear — so there is nothing for the host to be the only
@@ -64,12 +64,7 @@ func portsUsed(content string) []int {
 }
 
 // portInto replaces a resource's ${port:…} placeholders with what this machine assigned — in a
-// file's content, and in a value of a container's or a process's environment.
-//
-// **A process's environment is a container's** (novox/hq to-be 38 WP4c). A module's code moving out
-// of its container becomes a process on the machine and still has to be told what the container
-// was told; filled for one kind and not the other, the literal reached the process and was read as
-// a port, and the modules that moved first wrote their run-once steps a 0600 env file instead.
+// file's content, and in a value of a container's environment.
 //
 // A port the module did not say it listens on is refused, for the same reason a binding's unknown
 // key is: the module is asking about something it never declared, and the answer would be a guess.
@@ -89,7 +84,7 @@ func portInto(resource map[string]any, module string, listens []Listening, with
 		}
 		resource["content"] = filled
 
-	case "container", "process":
+	case "container":
 		env, ok := resource["env"].(map[string]any)
 		if !ok {
 			return nil
@@ -111,8 +106,8 @@ func portInto(resource map[string]any, module string, listens []Listening, with
 				continue
 			}
 			value, err := portsFilledInto(written,
-				fmt.Sprintf("%s's %s %s sets %s to something that",
-					module, resource["type"], resource["name"], key), module, listens, with)
+				fmt.Sprintf("%s's container %s sets %s to something that",
+					module, resource["name"], key), module, listens, with)
 			if err != nil {
 				return err
 			}

internal/catalogue/process_env_test.go

@@ -1,80 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// **A process's environment is composed as a container's is** (novox/hq to-be 38 WP4c).
-//
-// A module's code moving out of its container becomes a process on the machine, and what its
-// container's environment asked for — the port this machine gave the module, the place it put the
-// module's directory — it still has to be told. Filled for a container and not for a process, the
-// literal `${port:8080}` reached the process as its environment and was read as a port; the modules
-// that moved first wrote their run-once steps an env file instead.
-func processModule(env map[string]any) Manifest {
-	return Manifest{
-		Module:  "showcase",
-		Listens: []Listening{{Port: 8080, From: FromMesh}},
-		Resources: []map[string]any{
-			{"id": "data", "type": "directory", "mode": "0700"},
-			{"id": "setup", "type": "process", "name": "showcase-setup", "run-once": true,
-				"run": []any{"/usr/bin/showcase", "setup"}, "env": env},
-		},
-	}
-}
-
-func TestAProcessIsToldItsPortAndItsPlaceInItsEnvironment(t *testing.T) {
-	env := map[string]any{
-		"SHOWCASE_URL":  "http://127.0.0.1:${port:8080}",
-		"SHOWCASE_DATA": "${dir:data}/objects",
-		"SHOWCASE_DB":   "127.0.0.1:${seat:mesh-store:5432}",
-		"GREETING":      "hello",
-	}
-	out, err := Resolution{Node: "anchor", Modules: []Manifest{processModule(env)}}.Declaration(Rendering{
-		Ports: map[string]map[int]int{"showcase": {8080: 21000}},
-		Seats: map[string]map[int]int{"mesh-store": {5432: 6852}},
-	})
-	if err != nil {
-		t.Fatalf("a process asking for its port and its place does not compose: %v", err)
-	}
-	setup := fileNamed(out, "showcase.setup")
-	if setup == nil {
-		t.Fatalf("the process is not in the declaration: %v", out)
-	}
-	got, _ := setup["env"].(map[string]any)
-	for key, want := range map[string]string{
-		"SHOWCASE_URL":  "http://127.0.0.1:21000",
-		"SHOWCASE_DATA": "/var/lib/showcase/data/objects",
-		"SHOWCASE_DB":   "127.0.0.1:6852",
-		"GREETING":      "hello",
-	} {
-		if got[key] != want {
-			t.Errorf("the process is told %s=%v, want %q", key, got[key], want)
-		}
-	}
-	if env["SHOWCASE_URL"] != "http://127.0.0.1:${port:8080}" {
-		t.Fatalf("composing for one machine edited the module's own manifest: %v", env)
-	}
-}
-
-// An unknown reference in a process's environment is refused as a container's is, naming the
-// process and the variable — left alone, it would reach the machine as a literal.
-func TestAProcessAskingAboutAnUndeclaredPortIsRefused(t *testing.T) {
-	env := map[string]any{"SHOWCASE_URL": "http://127.0.0.1:${port:9999}"}
-	_, err := Resolution{Node: "anchor", Modules: []Manifest{processModule(env)}}.Declaration(Rendering{})
-	if err == nil {
-		t.Fatal("a process was told a port its module never said it listens on")
-	}
-	for _, said := range []string{"showcase-setup", "SHOWCASE_URL", "${port:9999}", "8080"} {
-		if !strings.Contains(err.Error(), said) {
-			t.Errorf("the refusal does not say %q: %v", said, err)
-		}
-	}
-
-	env = map[string]any{"SHOWCASE_DATA": "${dir:date}/objects"}
-	if _, err := (Resolution{Node: "anchor", Modules: []Manifest{processModule(env)}}).Declaration(Rendering{}); err == nil ||
-		!strings.Contains(err.Error(), "${dir:date}") {
-		t.Fatalf("a process naming no directory of its module was not refused: %v", err)
-	}
-}

internal/catalogue/published_ports_test.go

@@ -1,75 +0,0 @@
-package catalogue
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"strconv"
-	"strings"
-	"testing"
-)
-
-// A container publishes only a port its module declares (novox/hq issue 227).
-//
-// **The short form is a question the mesh answers.** `"80"` means *publish what the software
-// calls 80*, and the mesh fills in the machine's half from the port it assigned
-// ([ADR 0038](0038)). It can only assign one for a port the module declared in `listens` — so a
-// container publishing a number that appears nowhere in `listens` gets no assignment, and
-// `publishedOn` falls back to the number as written. It escapes to the machine.
-//
-// That is how the photo module asked for port 80 on the control node, where the reverse proxy
-// holds it: it declared its web endpoint at 4001, published a bare 80, and the container never
-// started. Four other modules publish 80 quite safely — because they declare 80, so the mesh
-// gives them a machine port for it. The difference is the declaration, not the number.
-//
-// A mapping written the long way is a module pinning both halves on purpose and is left alone.
-func TestEveryPublishedPortIsOneItsModuleDeclares(t *testing.T) {
-	root := catalogueRoot(t)
-	entries, err := os.ReadDir(filepath.Join(root, "modules"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	var escaped []string
-	for _, entry := range entries {
-		if !entry.IsDir() {
-			continue
-		}
-		raw, err := os.ReadFile(filepath.Join(root, "modules", entry.Name(), "module.json"))
-		if err != nil {
-			continue
-		}
-		m, err := ParseManifest(raw)
-		if err != nil {
-			// Whether every manifest parses is TestEveryCatalogueManifestParses's question.
-			continue
-		}
-		declared := map[int]bool{}
-		for _, l := range m.Listens {
-			declared[l.Port] = true
-		}
-		for _, r := range m.Resources {
-			if fmt.Sprint(r["type"]) != "container" {
-				continue
-			}
-			listed, _ := r["ports"].([]any)
-			for _, p := range listed {
-				written := strings.Split(fmt.Sprint(p), "/")[0]
-				if strings.Contains(written, ":") {
-					continue // pinned by hand, both halves, on purpose
-				}
-				port, err := strconv.Atoi(strings.TrimSpace(written))
-				if err != nil || declared[port] {
-					continue
-				}
-				escaped = append(escaped, fmt.Sprintf(
-					"%s's %v publishes %d, and %s declares no such port — the mesh has nothing "+
-						"to assign, so %d reaches the machine as written",
-					m.Module, r["id"], port, m.Module, port))
-			}
-		}
-	}
-	if len(escaped) > 0 {
-		t.Fatalf("a container may publish only a port its module declares:\n  - %s",
-			strings.Join(escaped, "\n  - "))
-	}
-}

internal/catalogue/resolve.go

@@ -147,10 +147,6 @@ type Resolution struct {
 	// dropped nor fatal to the rest. A module that is *required* by something running here is a
 	// different case — that set is incoherent and is refused (see checkCapabilities).
 	Unhostable []Unhostable
-	// Unheld is every dependency of this node's modules on a seat nothing here holds (novox/hq ADR
-	// 0207) — reported rather than refused while enforceSeatDependencies is off, so a node short of a
-	// holder still converges and `status` says what it is short of.
-	Unheld []Unheld
 }
 
 // Unhostable is one directly-assigned module the machine cannot run.
@@ -233,27 +229,6 @@ func Resolve(catalogue map[string]Manifest, assigned []string, node Node, world
 			local[o.Name] = true
 		}
 	}
-	// Which names are usable only on their provider's own machine (novox/hq ADR 0208 §3). Also a
-	// property of the name: a display one provider says is the machine's and another says is not
-	// would be pulled in for one consumer and refused for the next.
-	machineReach := map[string]bool{}
-	plainLocal := map[string]bool{}
-	for _, m := range catalogue {
-		for _, o := range m.Provides {
-			if o.MachineReach() {
-				machineReach[o.Name] = true
-			} else if o.At() == ScopeNode {
-				plainLocal[o.Name] = true
-			}
-		}
-	}
-	for want := range machineReach {
-		if plainLocal[want] {
-			problems = append(problems, fmt.Sprintf(
-				"the catalogue disagrees about %q: some modules provide it with the machine's reach and "+
-					"others without, so a requirement for it would be met differently by each", want))
-		}
-	}
 	for want := range brokered {
 		if local[want] {
 			problems = append(problems, fmt.Sprintf(
@@ -520,23 +495,6 @@ func Resolve(catalogue map[string]Manifest, assigned []string, node Node, world
 			continue
 		}
 
-		// Usable only on its provider's own machine, and not here: refused, never answered by
-		// installing a provider (novox/hq ADR 0208 §3). The display server is the machine's own role,
-		// gated by its graphical session; one pulled in for a window manager is the misassignment
-		// research 026 found. Another node's provider never counts — node scope is never brokered.
-		if machineReach[want] && !isModule(catalogue, want) {
-			reported[want] = true
-			if world.Unchecked {
-				// The first pass's refusals take a machine off the network; the second says it.
-				continue
-			}
-			problems = append(problems, fmt.Sprintf(
-				"%q is wanted by %s and is usable only on the machine that provides it, and nothing "+
-					"assigned to %s does — %s", want, because[want], node.Name,
-				machineReachRemedy(catalogue, want, node.Name)))
-			continue
-		}
-
 		candidates := offers[want]
 		switch len(candidates) {
 		case 0:
@@ -670,22 +628,6 @@ func Resolve(catalogue map[string]Manifest, assigned []string, node Node, world
 	problems = append(problems, checkResources(resolution.Modules)...)
 	resolution.Claims = claims
 
-	// Judged over the closure — what this node will actually run — so a holder pulled in by a
-	// requirement counts, and the holders' mutual dependence resolves (novox/hq ADR 0207 §3).
-	// Reported until the switch; refused after it, though never in the first pass, whose refusals
-	// make a machine vanish from the network rather than report anything.
-	resolution.Unheld = UnheldDependencies(catalogue, node.Name, resolution.Modules, nil)
-	// Only a dependency some module in the catalogue could meet is refused: one with no possible
-	// holder has no remedy to name, and stays a report in `status` (novox/hq ADR 0207 §4, read with
-	// the assign rule above it).
-	if enforceSeatDependencies && !world.Unchecked {
-		for _, u := range resolution.Unheld {
-			if len(u.Holders) > 0 {
-				problems = append(problems, u.String())
-			}
-		}
-	}
-
 	if len(problems) > 0 {
 		sort.Strings(problems)
 		return Resolution{}, &Refusal{Problems: problems}
@@ -862,28 +804,6 @@ func checkResources(modules []Manifest) []string {
 		// does not exist is the manifest's own problem, refused where it was made.
 		dirs := dirsFor(m, Rendering{})
 		for _, r := range m.Resources {
-			if fmt.Sprint(r["type"]) == "user" {
-				// **An account is shared; what it is set to is not.** Several modules may need one
-				// login: the shell's module sets its shell, the container runtime's puts it in the
-				// `docker` group. The host only ever adds groups — it never takes the account out of
-				// one, not even when the resource that named it is undeclared — so groups from
-				// several modules cannot contradict each other and are not owned. A shell or a home
-				// is one value, and two modules setting it would each be undone by the other's
-				// apply: each stays one module's per node, and two are refused naming both.
-				name, _ := r["name"].(string)
-				for _, field := range []string{"shell", "home"} {
-					if v, ok := r[field].(string); !ok || v == "" || name == "" {
-						continue
-					}
-					key := "user " + field + " " + name
-					if other, taken := owner[key]; taken && other != m.Module {
-						problems = append(problems, fmt.Sprintf(
-							"%s and %s both set the %s of the user %q", other, m.Module, field, name))
-					}
-					owner[key] = m.Module
-				}
-				continue
-			}
 			for _, field := range []string{"path", "unit", "name", "package"} {
 				value, ok := r[field].(string)
 				if !ok || value == "" {
@@ -1099,38 +1019,3 @@ func eachLocal(needs []Needed, catalogue map[string]Manifest, n Needed) []Needed
 	}
 	return needs
 }
-
-// machineReachRemedy names what would meet a requirement with the machine's reach: every module in
-// the catalogue that provides it, each with the node seats it holds — for a display, the holders of
-// node-display-server (novox/hq ADR 0208 §3), named by the seat because that is the role being
-// asked for, without this code knowing which seat any provision belongs to.
-func machineReachRemedy(catalogue map[string]Manifest, want, node string) string {
-	var named []string
-	for _, name := range sortedKeys(catalogue) {
-		m := catalogue[name]
-		provides := false
-		for _, o := range m.Provides {
-			if o.Name == want {
-				provides = true
-			}
-		}
-		if !provides {
-			continue
-		}
-		var held []string
-		for _, c := range m.Claims {
-			if c.At() == ScopeNode {
-				held = append(held, c.Name)
-			}
-		}
-		if len(held) > 0 {
-			named = append(named, fmt.Sprintf("%s (holds %s)", name, strings.Join(held, ", ")))
-		} else {
-			named = append(named, name)
-		}
-	}
-	if len(named) == 0 {
-		return "and nothing in the catalogue provides it"
-	}
-	return fmt.Sprintf("assign one to %s: %s", node, strings.Join(named, "; "))
-}

internal/catalogue/resolve_keeps_references_test.go

@@ -1,42 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// A resolved manifest keeps a built artifact's reference in the store-relative form, never the
-// address the builder reached the store by (novox/hq ADR 0155): on 2026-10-02 the first bundle
-// resolved on the mesh carried the store's host in bundles[0].source and registration refused it
-// as naming an installation. Archive resources are the same kind of reference and get the same.
-func TestAResolvedReferenceIsKeptNotRouted(t *testing.T) {
-	m, err := ParseManifest([]byte(`{
-	  "module": "sample", "version": "1",
-	  "tools": ["one"],
-	  "build": {"artifacts": [
-	    {"name": "code", "kind": "bundle", "language": "typescript", "entrypoints": ["tools/index.js"]},
-	    {"name": "files", "kind": "archive", "from": "files"}
-	  ]},
-	  "resources": [{"id": "packed", "type": "archive", "path": "/opt/sample", "artifact": "files"}]
-	}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	digest := "sha256:" + strings.Repeat("ab", 32)
-	resolved, err := m.Resolve([]Built{
-		{Name: "code", Kind: ArtifactBundle, Reference: "http://store.example:5100/v2/sample/code/blobs/" + digest, Digest: digest},
-		{Name: "files", Kind: ArtifactArchive, Reference: "http://store.example:5100/v2/sample/files/blobs/" + digest, Digest: digest},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got, want := resolved.Bundles[0].Source, ArtifactStoreScheme+"sample/code/blobs/"+digest; got != want {
-		t.Errorf("bundle source %q, want the kept form %q", got, want)
-	}
-	if got, want := resolved.Resources[0]["source"], ArtifactStoreScheme+"sample/files/blobs/"+digest; got != want {
-		t.Errorf("archive source %q, want the kept form %q", got, want)
-	}
-	if problems := InstallationProblems(resolved); len(problems) != 0 {
-		t.Errorf("a resolved manifest names an installation: %v", problems)
-	}
-}

internal/catalogue/roster.go

@@ -28,10 +28,10 @@ import (
 
 // A RosterFile is a file the mesh renders from the roster of machines, in the format the module
 // gives as a Go text/template. The template sees a rosterView: `.Node` (this machine's bare name),
-// `.Suffix` (what its mesh name ends in), and two sets of `{Name, FQDN, Address}` — `.Names` and
-// `.Machines`. Both are the nodes of the mesh: routed names were once in `.Names` too, and are not
-// since every route became a name under its node's internal domain (novox/hq ADR 0191) — the hq
-// issue 111 distinction is kept as two fields so the templates that range either keep rendering.
+// `.Suffix` (what its mesh name ends in), and two sets of `{Name, FQDN, Address}` — `.Names`, every
+// name the mesh serves, and `.Machines`, only the nodes of the mesh. Which set a template ranges is
+// how the hq issue 111 distinction is drawn: a container's hosts wants every name; a resolver told
+// the suffix is its own wants only the machines.
 type RosterFile struct {
 	// Path is where on the machine the rendered file goes. Absolute, or it is refused here rather
 	// than discovered as a daemon that reads nothing.

internal/catalogue/runtime.go

@@ -1,365 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"fmt"
-	"sort"
-	"strings"
-)
-
-// The node's tool runtime, as the catalogue knows it (novox/hq ADR 0175, to-be 38).
-//
-// **One module is the runtime.** Where it is assigned, one process per machine serves every assigned
-// module's tools and every held seat's verbs, on the host side, from the bundles each module's build
-// produced — and no module needs a container to reach the bus with its tools. The name is a constant
-// rather than a manifest field because a rule turns on it: the composer places the runtime's process
-// where this module is, and registration refuses the old pattern once this module exists.
-
-// RuntimeModule is the module that is the node's tool runtime. Mirrored in the broker package,
-// which composes a principal of its own for it; the agreement test there holds the two to one string.
-const RuntimeModule = "node-tools"
-
-// BundleRoot is where a machine keeps the tools bundles the mesh delivers to it: under the mesh's
-// own directory, beside the daemons the host unpacks there, and never where a package manager also
-// writes. One directory per module, one per bundle beneath it, at a path that does not move with
-// the version — so the runtime's process names each entrypoint once and is restarted, not
-// recomposed, when a bundle changes.
-const BundleRoot = "/var/lib/mesh/bundles"
-
-// BundleID names the archive resource that delivers one of a module's bundles; prefixed with the
-// module like every resource of its own.
-func BundleID(bundle string) string { return "bundle-" + bundle }
-
-// BundlePath is where one module's bundle is unpacked on a machine.
-func BundlePath(module, bundle string) string { return BundleRoot + "/" + module + "/" + bundle }
-
-// runtimeHere says whether this node's set includes the runtime module, which is what decides
-// whether anything about tools changes on the machine (to-be 38 WP2): until the runtime is assigned,
-// a node is sent exactly what it was sent before, bundles included, because a bundle nothing loads
-// is bytes nobody reads.
-func (r Resolution) runtimeHere() bool {
-	for _, m := range r.Modules {
-		if m.Module == RuntimeModule {
-			return true
-		}
-	}
-	return false
-}
-
-// bundleArchives is one archive per tools bundle of a module — a bundle the runtime LOADS something
-// from — as the host fetches and unpacks any artifact (novox/hq ADR 0175 §3: a module brings its
-// tools as a bundle, delivered by the host like any artifact, never an image). A bundle it loads
-// nothing from is run rather than loaded: a daemon, a step, the runtime itself — delivered by the
-// process that runs it, and not again here.
-//
-// The source is the kept reference; the per-resource pass that follows routes it through the
-// artifact store as this network reaches it now, as it does every image and archive the mesh built.
-func bundleArchives(m Manifest) []map[string]any {
-	var out []map[string]any
-	for _, b := range m.Bundles {
-		if len(b.Loads) == 0 {
-			continue
-		}
-		out = append(out, map[string]any{
-			"id": BundleID(b.Name), "type": "archive",
-			"source": b.Source, "digest": b.Digest,
-			"path": BundlePath(m.Module, b.Name),
-		})
-	}
-	return out
-}
-
-// RuntimeProcessID names the one process the mesh composes for a machine's runtime; prefixed with
-// the runtime module like a resource of its own, because that module is what the host sees it as.
-func RuntimeProcessID() string { return "runtime" }
-
-// RuntimeToolModules is the variable the runtime reads the modules it serves from: one
-// `<module>=<entrypoint>` per file it loads, comma-separated — several entries may name one module.
-// RuntimeBrokerFile is where it reads the node's credential; RuntimeOperatorAccount and
-// RuntimeOperatorHome are the machine's operator account and home, handed to every tool's
-// environment (to-be 38 WP1), and absent on a machine with no account.
-const (
-	RuntimeToolModules     = "MESH_TOOL_MODULES"
-	RuntimeBrokerFile      = "MESH_BROKER_FILE"
-	RuntimeOperatorAccount = "MESH_OPERATOR_ACCOUNT"
-	RuntimeOperatorHome    = "MESH_OPERATOR_HOME"
-	// RuntimeToolEnv is every served module's composed environment, as JSON (novox/hq ADR 0192):
-	// {"<module>": {"<word>": "<value>"}}. The runtime takes it at start, removes it from its own
-	// environment and hands each module's words to that module's bundles alone. In the unit, so a
-	// change to any module's words changes the process and restarts it.
-	RuntimeToolEnv = "MESH_TOOL_ENV"
-)
-
-// interpreterFor is how a bundle in a language is run: the program the host's unit starts, with the
-// bundle's entrypoint after it. The one thing the composer takes from a language, and said here
-// rather than in a manifest because the runtime's process is the mesh's to compose (to-be 38 WP3).
-func interpreterFor(language string) (string, error) {
-	switch language {
-	case "typescript":
-		return "node", nil
-	}
-	return "", fmt.Errorf(
-		"%s is written in %q, and the mesh knows no interpreter to run a %q bundle with",
-		RuntimeModule, language, language)
-}
-
-// runtimeProcess is the one process a machine runs the node's tool runtime as (novox/hq ADR 0175,
-// to-be 38 WP2.3): the runtime module's own bundle, run by its language's interpreter, told which
-// modules it serves and from which files, where its credential is, and who the machine's operator
-// is — and restarted when any bundle it loads or the credential it holds changes.
-//
-// Composed from the placed manifests, so the credential's path is where this node puts it. The
-// runtime runs as the operator's account when the machine has one, which is what lets a tool that
-// needs root escalate as the operator would (ADR 0175 §4); on a machine with no account it runs as
-// root, and the two operator words are not set.
-func (r Resolution) runtimeProcess(with Rendering) (map[string]any, error) {
-	var runtime *Manifest
-	for i := range r.Modules {
-		if r.Modules[i].Module == RuntimeModule {
-			runtime = &r.Modules[i]
-		}
-	}
-	if runtime == nil {
-		return nil, nil
-	}
-	if len(runtime.Bundles) != 1 {
-		return nil, fmt.Errorf(
-			"%s is assigned to %s and its build produced %d bundle(s); the runtime is one bundle "+
-				"the mesh runs, so the module declares exactly one (novox/hq to-be 38)",
-			RuntimeModule, r.Node, len(runtime.Bundles))
-	}
-	bundle := runtime.Bundles[0]
-	// What runs it (novox/hq ADR 0193): a runtime compiled to a binary runs itself, from its own
-	// unpacked bundle; an interpreted one is its language's interpreter and its one entrypoint.
-	var run []any
-	if bundle.Binary != "" {
-		run = []any{"./" + bundle.Binary}
-	} else {
-		if len(bundle.Entrypoints) != 1 {
-			return nil, fmt.Errorf(
-				"%s's bundle %q names %d entrypoint(s); the runtime is run from one, so the module "+
-					"declares exactly one (novox/hq to-be 38)", RuntimeModule, bundle.Name, len(bundle.Entrypoints))
-		}
-		interpreter, err := interpreterFor(bundle.Language)
-		if err != nil {
-			return nil, err
-		}
-		run = []any{interpreter, bundle.Entrypoints[0]}
-	}
-	credential, declared := runtime.OwnSecrets["broker"]
-	if !declared {
-		return nil, fmt.Errorf(
-			"%s declares no own secret named broker, and the node's credential is delivered there: "+
-				"a module that speaks on the bus declares \"own-secrets\": {\"broker\": <path>}",
-			RuntimeModule)
-	}
-
-	// What it serves, and from which files: every module on this machine that composes here, in
-	// name order, each bundle it loads from in the order the manifest gave. A module left out of
-	// the declaration — a filter on an adopted machine — is left out of this too, or the runtime
-	// would be told to load files that were never delivered.
-	var served []string
-	var restartOn []string
-	given := map[string]map[string]string{}
-	for _, m := range r.Modules {
-		if with.Adopted && m.Filtering != nil {
-			continue
-		}
-		words, err := bundleWords(m, with)
-		if err != nil {
-			return nil, err
-		}
-		if len(words) > 0 {
-			given[m.Module] = words
-		}
-		for _, b := range m.Bundles {
-			if len(b.Loads) == 0 {
-				continue
-			}
-			for _, load := range b.Loads {
-				// What the runtime starts: the launcher the build wrote beside the entrypoint, where
-				// it wrote one (ADR 0193); the entrypoint itself for a build from before them.
-				if launcher, has := b.Launchers[load]; has {
-					load = launcher
-				}
-				served = append(served, m.Module+"="+BundlePath(m.Module, b.Name)+"/"+load)
-			}
-			restartOn = append(restartOn, m.Module+"."+BundleID(b.Name))
-		}
-	}
-	sort.Strings(served)
-	restartOn = append(restartOn, RuntimeModule+"."+NeedID("broker"))
-	sort.Strings(restartOn)
-
-	env := map[string]string{
-		RuntimeToolModules: strings.Join(served, ","),
-		RuntimeBrokerFile:  credential.Path,
-	}
-	if len(given) > 0 {
-		// Marshalled from maps, whose keys encoding/json sorts: the same words, the same unit.
-		body, err := json.Marshal(given)
-		if err != nil {
-			return nil, err
-		}
-		env[RuntimeToolEnv] = string(body)
-	}
-	process := map[string]any{
-		"id": RuntimeModule + "." + RuntimeProcessID(), "type": "process", "name": RuntimeModule,
-		"source": bundle.Source, "digest": bundle.Digest,
-		"run":        run,
-		"env":        env,
-		"restart-on": toAny(restartOn),
-	}
-	if r.Account != "" {
-		env[RuntimeOperatorAccount] = r.Account
-		env[RuntimeOperatorHome] = accountHomeOf(r.Account, r.AccountHome)
-		process["user"] = r.Account
-	}
-	// Routed through the artifact store as this network reaches it now, like everything the mesh
-	// built; refused with the same words when there is no store to route through.
-	if err := artifactsInto(process, RuntimeModule, with); err != nil {
-		return nil, err
-	}
-	return process, nil
-}
-
-func toAny(in []string) []any {
-	out := make([]any, 0, len(in))
-	for _, s := range in {
-		out = append(out, s)
-	}
-	return out
-}
-
-// RuntimeImageModule and RuntimeImageArtifact name the image every per-module tool container was
-// built on: the tool runtime's own runtime image. With the runtime a module of its own, that image
-// stays the way a module's SERVICE may be built and stops being the way tools reach a node (ADR 0175).
-const (
-	RuntimeImageModule   = "mesh-tools"
-	RuntimeImageArtifact = "runtime"
-)
-
-// ToolContainerOnTheRuntime says why a manifest is the pattern ADR 0175 retires — a module whose tools
-// are served from a container built on the tool runtime's image — or nothing when it is not. Judged
-// from the manifest's own `build.on` when it is a repository manifest, and from what its build stood
-// on when it is a built one, because a resolved manifest carries no build. The gate itself is
-// registration's (to-be 38 WP2.4): once the runtime module is in the catalogue, this is refused.
-//
-// Three things must hold, and each alone is fine: declaring tools (a bundle does that); a container
-// (a module's service may well be one); building on the runtime's image (a service written against
-// the SDK may). All three is a container whose purpose is tools, which the runtime now serves.
-func ToolContainerOnTheRuntime(m Manifest, against []string) string {
-	if len(m.Tools) == 0 {
-		return ""
-	}
-	container := false
-	for _, r := range m.Resources {
-		if fmt.Sprint(r["type"]) == "container" {
-			container = true
-		}
-	}
-	if !container {
-		return ""
-	}
-	onTheRuntime := false
-	if m.Build != nil {
-		for _, on := range m.Build.On {
-			if on.Module == RuntimeImageModule && on.Artifact == RuntimeImageArtifact {
-				onTheRuntime = true
-			}
-		}
-	}
-	for _, ref := range against {
-		path, kept := InArtifactStore(Recorded(ref))
-		if kept && strings.HasPrefix(path, RuntimeImageModule+"/"+RuntimeImageArtifact+"@") {
-			onTheRuntime = true
-		}
-	}
-	if !onTheRuntime {
-		return ""
-	}
-	return fmt.Sprintf(
-		"%s declares tools and a container built on %s's %s image — a container whose purpose is "+
-			"serving tools. The node's tool runtime (%s) serves every module's tools from its bundle "+
-			"now (novox/hq ADR 0175, to-be 38); declare the tools as a bundle and drop the container",
-		m.Module, RuntimeImageModule, RuntimeImageArtifact, RuntimeModule)
-}
-
-// bundleWords is what one module's tools bundles are given on this machine (novox/hq ADR 0192):
-// each loaded bundle's env, its ${dir:…} resolved to where this machine places the module's
-// directories and its ${port:…} to the port this machine gave it — the same resolution a
-// container's environment gets. Two bundles of one module naming one word differently is refused:
-// the runtime hands a module's words to all its bundles.
-func bundleWords(m Manifest, with Rendering) (map[string]string, error) {
-	var out map[string]string
-	dirs := dirsFor(m, with)
-	for _, b := range m.Bundles {
-		if len(b.Loads) == 0 || len(b.Env) == 0 {
-			continue
-		}
-		for _, word := range sortedKeys(b.Env) {
-			value, err := dirFill(b.Env[word], dirs, m.Module)
-			if err != nil {
-				return nil, err
-			}
-			if value, err = portsFilledInto(value, m.Module+"'s bundle "+b.Name+" ("+word+")", m.Module, m.Listens, with); err != nil {
-				return nil, err
-			}
-			if out == nil {
-				out = map[string]string{}
-			}
-			if was, had := out[word]; had && was != value {
-				return nil, fmt.Errorf("%s's bundles give %s two values (%q, %q); a module's words are "+
-					"handed to all its bundles, so they agree (novox/hq ADR 0192)", m.Module, word, was, value)
-			}
-			out[word] = value
-		}
-	}
-	return out, nil
-}
-
-// givenTo makes what a bundle's words name readable by the account the runtime runs as (novox/hq
-// ADR 0192): every file and directory of the module whose path a word names, or that holds one,
-// is owned by the account — a tool reads its configuration and its secret as the account, and a
-// root-owned 0600 file or a 0700 directory is one it cannot. Only where it says no owner already:
-// a module that named one knew why. Nothing on a machine with no account, where the runtime is root.
-//
-// It answers the files a word names exactly: what a tool reads, whose change the runtime must be
-// restarted for, as the container the tools came from was restarted when its configuration changed.
-func givenTo(out []map[string]any, owner map[string]string, words map[string]map[string]string, account string) []string {
-	var named []string
-	if len(words) == 0 {
-		return nil
-	}
-	for _, resource := range out {
-		module := owner[fmt.Sprint(resource["id"])]
-		mine := words[module]
-		if len(mine) == 0 {
-			continue
-		}
-		kind := fmt.Sprint(resource["type"])
-		if kind != "file" && kind != "directory" {
-			continue
-		}
-		path, _ := resource["path"].(string)
-		if path == "" {
-			continue
-		}
-		for _, value := range mine {
-			if kind == "file" && value == path {
-				named = append(named, fmt.Sprint(resource["id"]))
-			}
-		}
-		if _, said := resource["owner"]; said || account == "" {
-			continue
-		}
-		for _, value := range mine {
-			if value == path || strings.HasPrefix(value, strings.TrimRight(path, "/")+"/") {
-				resource["owner"] = account
-				break
-			}
-		}
-	}
-	sort.Strings(named)
-	return named
-}

internal/catalogue/runtime_gate_test.go

@@ -1,88 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// The packet-filter manifest as it was the day the runtime was decided (novox/hq ADR 0175): tools,
-// served from a container built on the tool runtime's image, with NET_ADMIN so the container could
-// reach the filter. The exact pattern to-be 38 WP4 moves it off, and the one the gate refuses.
-const thePacketFilterAsItWas = `{
-  "module": "nftables",
-  "version": "1",
-  "capabilities": ["firewall", "container-runtime"],
-  "claims": [{"name": "node-packet-filter", "scope": "node", "serves": ["rules", "reload", "remove"]}],
-  "filtering": {"into": "/etc/nftables.conf"},
-  "resources": [
-    {"id": "mesh-state", "type": "directory", "mode": "0700", "place": "mesh"},
-    {"id": "package", "type": "package", "package": "nftables"},
-    {"id": "unit", "type": "file", "path": "/etc/systemd/system/mesh-filter.service",
-     "content": "[Unit]\nDescription=The mesh's packet filter\n[Service]\nType=oneshot\nExecStart=nft -f /etc/nftables.conf\n", "mode": "0644"},
-    {"id": "load", "type": "service", "unit": "mesh-filter.service", "state": "running", "boot": "enabled",
-     "restart-on": ["unit"], "reload-on": ["filtering"]},
-    {"id": "runtime", "type": "container", "name": "mesh-nftables", "network": "host",
-     "capabilities": ["NET_ADMIN"],
-     "volumes": ["${dir:mesh-state}/broker:/run/secrets/broker:ro", "/etc/nftables.conf:/etc/nftables.conf:ro"],
-     "env": {"MESH_BROKER_FILE": "/run/secrets/broker", "MESH_FILTER_FILE": "/etc/nftables.conf"},
-     "artifact": "runtime"}
-  ],
-  "tools": ["firewall_rules"],
-  "own-secrets": {"broker": "${dir:mesh-state}/broker"},
-  "build": {
-    "on": [
-      {"arg": "BUILD_BASE", "module": "mesh-tools", "artifact": "build"},
-      {"arg": "RUNTIME_BASE", "module": "mesh-tools", "artifact": "runtime"}
-    ],
-    "artifacts": [{"name": "runtime", "kind": "image", "from": "Dockerfile"}]
-  }
-}`
-
-func TestAToolContainerOnTheRuntimeImageIsNamedForWhatItIs(t *testing.T) {
-	m, err := ParseManifest([]byte(thePacketFilterAsItWas))
-	if err != nil {
-		t.Fatal(err)
-	}
-	// From the repository: the manifest says what it builds on.
-	why := ToolContainerOnTheRuntime(m, nil)
-	if why == "" {
-		t.Fatal("the packet filter's tool container was not recognised from its build")
-	}
-	for _, word := range []string{"nftables", "mesh-tools", "runtime", "ADR 0175", "bundle"} {
-		if !strings.Contains(why, word) {
-			t.Errorf("the refusal does not say %q: %s", word, why)
-		}
-	}
-
-	// Built: the manifest carries no build, and what it stood on says the same.
-	built, err := m.Resolve([]Built{{Name: "runtime", Kind: ArtifactImage,
-		Reference: ArtifactStoreScheme + "nftables/runtime@" + digest}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	stoodOn := []string{"anchor.internal:5100/mesh-tools/build@" + digest, "anchor.internal:5100/mesh-tools/runtime@" + digest}
-	if ToolContainerOnTheRuntime(built, stoodOn) == "" {
-		t.Error("the packet filter's tool container was not recognised from what its build stood on")
-	}
-	if ToolContainerOnTheRuntime(built, nil) != "" {
-		t.Error("a built manifest with no record of its base was judged to be on the runtime")
-	}
-
-	// Each of the three alone is an ordinary module.
-	bundle := m
-	bundle.Resources = m.Resources[:len(m.Resources)-1]
-	if ToolContainerOnTheRuntime(bundle, nil) != "" {
-		t.Error("a module with tools and no container is the pattern the runtime serves, and was refused")
-	}
-	service := m
-	service.Tools = nil
-	if ToolContainerOnTheRuntime(service, nil) != "" {
-		t.Error("a service built against the SDK, declaring no tools, was refused")
-	}
-	elsewhere := m
-	elsewhere.Build = &Build{On: []BuildsOn{{Arg: "NODE_BASE", Image: "node@" + digest}},
-		Artifacts: m.Build.Artifacts}
-	if ToolContainerOnTheRuntime(elsewhere, nil) != "" {
-		t.Error("a tool container on a public base was refused as though it were on the runtime's")
-	}
-}

internal/catalogue/runtime_test.go

@@ -1,459 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"fmt"
-	"strings"
-	"testing"
-)
-
-// The node's tool runtime (novox/hq ADR 0175, to-be 38): where the runtime module is assigned, a
-// machine is sent every assigned module's tools bundle as an archive, and the runtime's own process
-// loading them. Where it is not, the machine is sent exactly what it was sent before.
-
-var bundleDigest = "sha256:" + strings.Repeat("b", 64)
-
-// aToolsModule is a module whose tools come as a compiled bundle and nothing else — the shape every
-// module takes once its tool container goes (to-be 38 WP4).
-func aToolsModule(t *testing.T, name string, entrypoints ...string) Manifest {
-	t.Helper()
-	m := Manifest{Module: name, Version: "1", Tools: []string{"status"},
-		Build: &Build{Artifacts: []Artifact{
-			{Name: "tools", Kind: ArtifactBundle, Language: "typescript", Entrypoints: entrypoints},
-		}}}
-	resolved, err := m.Resolve([]Built{{Name: "tools", Kind: ArtifactBundle,
-		Reference: ArtifactStoreScheme + name + "/tools/blobs/" + bundleDigest, Digest: bundleDigest}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	return resolved
-}
-
-// theRuntime is the runtime module as the catalogue holds it: its own bundle, run rather than
-// loaded, and its broker secret to receive the node's credential in.
-func theRuntime(t *testing.T) Manifest {
-	t.Helper()
-	m := Manifest{Module: RuntimeModule, Version: "1",
-		OwnSecrets: OwnSecrets{"broker": {Path: "/var/lib/mesh/" + RuntimeModule + "/broker"}},
-		Build: &Build{Artifacts: []Artifact{{Name: "runtime", Kind: ArtifactBundle, Language: "typescript",
-			Entrypoints: []string{"src/main.js"}}}}}
-	resolved, err := m.Resolve([]Built{{Name: "runtime", Kind: ArtifactBundle,
-		Reference: ArtifactStoreScheme + RuntimeModule + "/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	return resolved
-}
-
-func TestABuildsBundlesAreCarriedOnTheResolvedManifest(t *testing.T) {
-	m := aToolsModule(t, "nftables", "tools/index.js")
-	if len(m.Bundles) != 1 {
-		t.Fatalf("the resolved manifest carries %d bundle(s), not the one the build made", len(m.Bundles))
-	}
-	b := m.Bundles[0]
-	if b.Name != "tools" || b.Digest != bundleDigest || b.Language != "typescript" ||
-		b.Source != ArtifactStoreScheme+"nftables/tools/blobs/"+bundleDigest ||
-		len(b.Entrypoints) != 1 || b.Entrypoints[0] != "tools/index.js" {
-		t.Errorf("the bundle is carried as %+v", b)
-	}
-	// A repository manifest may not write what the build derives.
-	raw := `{"module":"x","version":"1","build":{"artifacts":[{"name":"t","kind":"bundle","language":"typescript"}]},` +
-		`"bundles":[{"name":"t","source":"s","digest":"` + bundleDigest + `"}]}`
-	if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), "bundles") {
-		t.Errorf("a manifest stating its build's output by hand was accepted: %v", err)
-	}
-}
-
-func TestEveryToolsBundleIsDeliveredWhereTheRuntimeRuns(t *testing.T) {
-	store := Rendering{ArtifactStore: "anchor.internal:5101",
-		Needed: map[string]map[string]string{RuntimeModule: {"broker": "sealed-credential"}}}
-	nftables := aToolsModule(t, "nftables", "tools/index.js")
-	zsh := aToolsModule(t, "zsh", "tools/index.js", "tools/more.js")
-
-	t.Run("with the runtime, one archive per tools bundle", func(t *testing.T) {
-		r := Resolution{Node: "anchor", Modules: []Manifest{nftables, zsh, theRuntime(t)}}
-		out, err := r.Declaration(store)
-		if err != nil {
-			t.Fatal(err)
-		}
-		archive := fileNamed(out, "nftables."+BundleID("tools"))
-		if archive == nil {
-			t.Fatalf("nftables' tools bundle was not delivered: %v", ids(out))
-		}
-		if archive["type"] != "archive" || archive["digest"] != bundleDigest ||
-			archive["path"] != BundleRoot+"/nftables/tools" {
-			t.Errorf("delivered as %v", archive)
-		}
-		if archive["source"] != "http://anchor.internal:5101/v2/nftables/tools/blobs/"+bundleDigest {
-			t.Errorf("fetched from %v, not through the store as this network reaches it", archive["source"])
-		}
-		if fileNamed(out, "zsh."+BundleID("tools")) == nil {
-			t.Errorf("zsh's tools bundle was not delivered: %v", ids(out))
-		}
-		// The runtime's own bundle is run, not loaded: its process delivers it, not an archive.
-		if fileNamed(out, RuntimeModule+"."+BundleID("runtime")) != nil {
-			t.Error("the runtime's own bundle was delivered as an archive beside its process")
-		}
-	})
-
-	t.Run("without the runtime, nothing changes", func(t *testing.T) {
-		r := Resolution{Node: "anchor", Modules: []Manifest{nftables, zsh}}
-		out, err := r.Declaration(store)
-		if err != nil {
-			t.Fatal(err)
-		}
-		for _, id := range ids(out) {
-			if strings.Contains(id, BundleID("")) {
-				t.Errorf("%s was delivered to a machine running no runtime to load it", id)
-			}
-		}
-	})
-}
-
-func ids(out []map[string]any) []string {
-	var names []string
-	for _, r := range out {
-		names = append(names, r["id"].(string))
-	}
-	return names
-}
-
-// One process per machine runs the runtime from its own bundle, told what it serves and from where,
-// where its credential is, and who the operator is — restarted when any of that changes.
-func TestTheMachineRunsOneRuntimeLoadingEveryDeliveredBundle(t *testing.T) {
-	with := Rendering{ArtifactStore: "anchor.internal:5101",
-		Needed: map[string]map[string]string{RuntimeModule: {"broker": "sealed-credential"}}}
-	nftables := aToolsModule(t, "nftables", "tools/index.js")
-	// A bundle carrying a daemon beside its tools says which files the runtime loads.
-	showcase := Manifest{Module: "showcase", Version: "1", Tools: []string{"greet"},
-		Build: &Build{Artifacts: []Artifact{{Name: "code", Kind: ArtifactBundle, Language: "typescript",
-			Entrypoints: []string{"daemon/index.js", "tools/index.js"}, Loads: []string{"tools/index.js"}}}}}
-	showcase, err := showcase.Resolve([]Built{{Name: "code", Kind: ArtifactBundle,
-		Reference: ArtifactStoreScheme + "showcase/code/blobs/" + bundleDigest, Digest: bundleDigest}})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	r := Resolution{Node: "anchor", Account: "ops", Modules: []Manifest{nftables, showcase, theRuntime(t)}}
-	out, err := r.Declaration(with)
-	if err != nil {
-		t.Fatal(err)
-	}
-	process := fileNamed(out, RuntimeModule+"."+RuntimeProcessID())
-	if process == nil {
-		t.Fatalf("no runtime process was composed: %v", ids(out))
-	}
-	if process["type"] != "process" || process["name"] != RuntimeModule || process["digest"] != bundleDigest ||
-		process["source"] != "http://anchor.internal:5101/v2/"+RuntimeModule+"/runtime/blobs/"+bundleDigest {
-		t.Errorf("the runtime's process is %v", process)
-	}
-	if fmt.Sprint(process["run"]) != "[node src/main.js]" {
-		t.Errorf("the runtime is run as %v; its bundle's one entrypoint, by its language's interpreter", process["run"])
-	}
-	env := process["env"].(map[string]string)
-	if env[RuntimeToolModules] != "nftables="+BundleRoot+"/nftables/tools/tools/index.js,"+
-		"showcase="+BundleRoot+"/showcase/code/tools/index.js" {
-		t.Errorf("the runtime is told to serve %q: every loaded file, by module, and nothing a bundle runs", env[RuntimeToolModules])
-	}
-	if env[RuntimeBrokerFile] != "/var/lib/mesh/"+RuntimeModule+"/broker" {
-		t.Errorf("the runtime reads its credential at %q, not where the module's own secret is placed", env[RuntimeBrokerFile])
-	}
-	if env[RuntimeOperatorAccount] != "ops" || env[RuntimeOperatorHome] != "/home/ops" || process["user"] != "ops" {
-		t.Errorf("the operator is not handed to the runtime: %v as %v", env, process["user"])
-	}
-	// The credential the process reads belongs to the account it runs as, or it could not read it
-	// (to-be 38 WP3); other modules' secrets are left as their manifests say.
-	if credential := fileNamed(out, RuntimeModule+"."+NeedID("broker")); credential == nil || credential["owner"] != "ops" {
-		t.Errorf("the runtime's credential is not the account's to read: %v", credential)
-	}
-	restarts := fmt.Sprint(process["restart-on"])
-	for _, want := range []string{"nftables." + BundleID("tools"), "showcase." + BundleID("code"), RuntimeModule + "." + NeedID("broker")} {
-		if !strings.Contains(restarts, want) {
-			t.Errorf("the runtime is not restarted when %s changes: %s", want, restarts)
-		}
-	}
-	// After every bundle and the credential, so both exist before it starts.
-	names := ids(out)
-	if names[len(names)-1] != RuntimeModule+"."+RuntimeProcessID() {
-		t.Errorf("the runtime's process is not last: %v", names)
-	}
-
-	t.Run("a machine with no account runs it as root without the operator words", func(t *testing.T) {
-		out, err := Resolution{Node: "anchor", Modules: []Manifest{nftables, theRuntime(t)}}.Declaration(with)
-		if err != nil {
-			t.Fatal(err)
-		}
-		process := fileNamed(out, RuntimeModule+"."+RuntimeProcessID())
-		env := process["env"].(map[string]string)
-		if _, set := env[RuntimeOperatorAccount]; set {
-			t.Error("an operator account was named on a machine that has none")
-		}
-		if _, set := process["user"]; set {
-			t.Error("a user was set on a machine with no account")
-		}
-		if credential := fileNamed(out, RuntimeModule+"."+NeedID("broker")); credential == nil || credential["owner"] != nil {
-			t.Errorf("the runtime's credential was given an owner on a machine with no account: %v", credential)
-		}
-	})
-
-	t.Run("a runtime module built wrong is refused by name", func(t *testing.T) {
-		two := Manifest{Module: RuntimeModule, Version: "1", OwnSecrets: OwnSecrets{"broker": {Path: "/b"}},
-			Build: &Build{Artifacts: []Artifact{{Name: "runtime", Kind: ArtifactBundle, Language: "typescript",
-				Entrypoints: []string{"a.js", "b.js"}}}}}
-		resolved, err := two.Resolve([]Built{{Name: "runtime", Kind: ArtifactBundle,
-			Reference: ArtifactStoreScheme + "x/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
-		if err != nil {
-			t.Fatal(err)
-		}
-		_, err = Resolution{Node: "anchor", Modules: []Manifest{resolved}}.Declaration(with)
-		if err == nil || !strings.Contains(err.Error(), "entrypoint") {
-			t.Errorf("a runtime bundle with two entrypoints was composed: %v", err)
-		}
-	})
-}
-
-// novox/hq ADR 0192: a tools bundle says what it is given; the composer resolves it per machine as
-// a container's environment, hands it to the runtime as the module's words, and makes what the
-// words name readable by the account the runtime runs as.
-func TestABundleIsGivenItsWordsResolvedForThisMachine(t *testing.T) {
-	with := Rendering{ArtifactStore: "anchor.internal:5101",
-		Needed: map[string]map[string]string{
-			RuntimeModule: {"broker": "sealed-credential"},
-			"dash":        {"token": "sealed-token"},
-		}}
-	dash := Manifest{Module: "dash", Version: "1", Tools: []string{"status"},
-		Listens:    []Listening{{Name: "web", Port: 3000, Protocol: "tcp"}},
-		OwnSecrets: OwnSecrets{"token": {Path: "${dir:mesh-state}/token"}},
-		Resources: []map[string]any{
-			{"id": "mesh-state", "type": "directory", "mode": "0700", "place": "mesh"},
-			{"id": "config", "type": "file", "path": "${dir:mesh-state}/config.json", "mode": "0600", "content": "{}\n"},
-			{"id": "unrelated", "type": "file", "path": "/etc/dash.conf", "content": "x\n"},
-		},
-		Build: &Build{Artifacts: []Artifact{{Name: "tools", Kind: ArtifactBundle, Language: "typescript",
-			Entrypoints: []string{"tools/index.js"},
-			Env: map[string]string{
-				"DASH_CONFIG_FILE": "${dir:mesh-state}/config.json",
-				"DASH_TOKEN_FILE":  "${dir:mesh-state}/token",
-				"DASH_URL":         "http://127.0.0.1:${port:3000}",
-				"DASH_ADMIN":       "mesh-admin",
-			}}}}}
-	if problems := dash.Build.problems(dash.Module); len(problems) > 0 {
-		t.Fatalf("a bundle's words written with ${dir:…} and ${port:…} were refused: %v", problems)
-	}
-	dash, err := dash.Resolve([]Built{{Name: "tools", Kind: ArtifactBundle,
-		Reference: ArtifactStoreScheme + "dash/tools/blobs/" + bundleDigest, Digest: bundleDigest}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	other := aToolsModule(t, "nftables", "tools/index.js")
-
-	out, err := Resolution{Node: "anchor", Account: "ops", Modules: []Manifest{dash, other, theRuntime(t)}}.Declaration(with)
-	if err != nil {
-		t.Fatal(err)
-	}
-	dir := fileNamed(out, "dash.mesh-state")
-	if dir == nil {
-		t.Fatalf("no directory: %v", ids(out))
-	}
-	at := fmt.Sprint(dir["path"])
-	process := fileNamed(out, RuntimeModule+"."+RuntimeProcessID())
-	env := process["env"].(map[string]string)
-	var given map[string]map[string]string
-	if err := json.Unmarshal([]byte(env[RuntimeToolEnv]), &given); err != nil {
-		t.Fatalf("the runtime's %s is not JSON: %q", RuntimeToolEnv, env[RuntimeToolEnv])
-	}
-	want := map[string]string{
-		"DASH_CONFIG_FILE": at + "/config.json",
-		"DASH_TOKEN_FILE":  at + "/token",
-		"DASH_URL":         "http://127.0.0.1:3000",
-		"DASH_ADMIN":       "mesh-admin",
-	}
-	if fmt.Sprint(given["dash"]) != fmt.Sprint(want) {
-		t.Errorf("dash is given %v, want %v", given["dash"], want)
-	}
-	if _, has := given["nftables"]; has {
-		t.Errorf("a module that declares no words was given some: %v", given)
-	}
-	// What the words name is the account's to read; nothing else of the module's is touched.
-	for _, id := range []string{"dash.mesh-state", "dash.config", "dash." + NeedID("token")} {
-		if r := fileNamed(out, id); r == nil || r["owner"] != "ops" {
-			t.Errorf("%s is not the account's to read: %v", id, r)
-		}
-	}
-	if r := fileNamed(out, "dash.unrelated"); r == nil || r["owner"] != nil {
-		t.Errorf("a file no word names was given an owner: %v", r)
-	}
-	// A file a word names restarts the runtime when it changes, as it restarted the tool container.
-	restarts := fmt.Sprint(process["restart-on"])
-	for _, want := range []string{"dash.config", "dash." + NeedID("token")} {
-		if !strings.Contains(restarts, want) {
-			t.Errorf("the runtime is not restarted when %s changes: %s", want, restarts)
-		}
-	}
-	if strings.Contains(restarts, "dash.unrelated") || strings.Contains(restarts, "dash.mesh-state") {
-		t.Errorf("the runtime restarts for something no word names as a file: %s", restarts)
-	}
-
-	t.Run("on a machine with no account the runtime is root and nothing is re-owned", func(t *testing.T) {
-		out, err := Resolution{Node: "anchor", Modules: []Manifest{dash, theRuntime(t)}}.Declaration(with)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if r := fileNamed(out, "dash.config"); r["owner"] != nil {
-			t.Errorf("re-owned with no account: %v", r)
-		}
-	})
-
-	t.Run("a change to a module's words changes the runtime's process", func(t *testing.T) {
-		changed := dash
-		changed.Bundles = append([]Bundle(nil), dash.Bundles...)
-		changed.Bundles[0].Env = map[string]string{"DASH_ADMIN": "somebody-else"}
-		out2, err := Resolution{Node: "anchor", Account: "ops", Modules: []Manifest{changed, theRuntime(t)}}.Declaration(with)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if fmt.Sprint(fileNamed(out2, RuntimeModule+"."+RuntimeProcessID())["env"]) == fmt.Sprint(env) {
-			t.Error("the runtime's process is the same after a module's words changed, so it would not restart")
-		}
-	})
-}
-
-func TestABundlesWordsAreRefusedWhenTheyAreNotPathsOrConstants(t *testing.T) {
-	m := Manifest{Module: "dash", Version: "1", Build: &Build{Artifacts: []Artifact{
-		{Name: "tools", Kind: ArtifactBundle, Language: "typescript", Entrypoints: []string{"tools/index.js"},
-			Env: map[string]string{"DASH_TOKEN": "${secret:token}", RuntimeBrokerFile: "/x", "DASH_PEER": "${bound:db:url}"}},
-		{Name: "runtime", Kind: ArtifactImage, From: "Dockerfile", Env: map[string]string{"X": "y"}},
-	}}}
-	said := strings.Join(m.Build.problems(m.Module), "\n")
-	for _, want := range []string{
-		`"tools" gives DASH_TOKEN the value "${secret:token}"`,
-		`"tools" gives DASH_PEER the value "${bound:db:url}"`,
-		`"tools" gives itself ` + RuntimeBrokerFile,
-		`"runtime" is a "image" and says what it is given`,
-	} {
-		if !strings.Contains(said, want) {
-			t.Errorf("not refused: %s\nsaid:\n%s", want, said)
-		}
-	}
-}
-
-// novox/hq ADR 0193: the runtime is told the launcher a build wrote, and the entrypoint itself for a
-// build from before launchers — so the move needs no flag day.
-func TestTheRuntimeStartsTheLauncherWhereTheBuildWroteOne(t *testing.T) {
-	with := Rendering{ArtifactStore: "anchor.internal:5101",
-		Needed: map[string]map[string]string{RuntimeModule: {"broker": "sealed-credential"}}}
-	launched := Manifest{Module: "dash", Version: "1", Tools: []string{"status"},
-		Build: &Build{Artifacts: []Artifact{{Name: "tools", Kind: ArtifactBundle, Language: "typescript",
-			Entrypoints: []string{"tools/index.js"}}}}}
-	launched, err := launched.Resolve([]Built{{Name: "tools", Kind: ArtifactBundle,
-		Reference: ArtifactStoreScheme + "dash/tools/blobs/" + bundleDigest, Digest: bundleDigest,
-		Launchers: map[string]string{"tools/index.js": "tools/index.serve.mjs"}}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	older := aToolsModule(t, "nftables", "tools/index.js")
-	out, err := Resolution{Node: "anchor", Account: "ops", Modules: []Manifest{launched, older, theRuntime(t)}}.Declaration(with)
-	if err != nil {
-		t.Fatal(err)
-	}
-	env := fileNamed(out, RuntimeModule+"."+RuntimeProcessID())["env"].(map[string]string)
-	want := "dash=" + BundleRoot + "/dash/tools/tools/index.serve.mjs,nftables=" + BundleRoot + "/nftables/tools/tools/index.js"
-	if env[RuntimeToolModules] != want {
-		t.Errorf("the runtime is told %q, want %q", env[RuntimeToolModules], want)
-	}
-}
-
-// novox/hq ADR 0193: a runtime compiled to a binary runs itself from its own unpacked bundle.
-func TestARuntimeCompiledToABinaryRunsItself(t *testing.T) {
-	with := Rendering{ArtifactStore: "anchor.internal:5101",
-		Needed: map[string]map[string]string{RuntimeModule: {"broker": "sealed-credential"}}}
-	goRuntime := Manifest{Module: RuntimeModule, Version: "1",
-		OwnSecrets: OwnSecrets{"broker": {Path: "/var/lib/mesh/" + RuntimeModule + "/broker"}},
-		Build: &Build{Artifacts: []Artifact{{Name: "runtime", Kind: ArtifactBundle, Language: "go",
-			System: "arch", From: "cmd/node-tools"}}}}
-	goRuntime, err := goRuntime.Resolve([]Built{{Name: "runtime", Kind: ArtifactBundle,
-		Reference: ArtifactStoreScheme + RuntimeModule + "/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	out, err := Resolution{Node: "anchor", Account: "ops", Modules: []Manifest{aToolsModule(t, "nftables", "tools/index.js"), goRuntime}}.Declaration(with)
-	if err != nil {
-		t.Fatal(err)
-	}
-	process := fileNamed(out, RuntimeModule+"."+RuntimeProcessID())
-	if fmt.Sprint(process["run"]) != "[./node-tools]" {
-		t.Errorf("a Go runtime is run as %v, want its own binary", process["run"])
-	}
-	env := process["env"].(map[string]string)
-	if env[RuntimeToolModules] == "" || process["user"] != "ops" {
-		t.Errorf("the Go runtime is not told what to serve or whose it is: %v %v", env, process["user"])
-	}
-}
-
-// novox/hq 04-ISSUES/216: a bundle nothing loads, runs or unpacks is refused at registration; saying
-// `loads`, listing `tools`, or a resource naming it admits it.
-func TestABundleNothingDeliversIsRefused(t *testing.T) {
-	base := func() Manifest {
-		return Manifest{Module: "baserow", Version: "1", Build: &Build{Artifacts: []Artifact{
-			{Name: "tools", Kind: ArtifactBundle, Language: "typescript", Entrypoints: []string{"tools/index.js"}}}}}
-	}
-	if p := undeliveredBundles(base()); len(p) != 1 || !strings.Contains(p[0], "never reach a machine") {
-		t.Fatalf("a bundle nothing delivers was admitted: %v", p)
-	}
-	loads := base()
-	loads.Build.Artifacts[0].Loads = []string{"tools/index.js"}
-	tools := base()
-	tools.Tools = []string{"baserow_list_rows"}
-	run := base()
-	run.Resources = []map[string]any{{"id": "daemon", "type": "process", "artifact": "tools", "run": []any{"node", "tools/index.js"}}}
-	runtime := base()
-	runtime.Module = RuntimeModule
-	for name, m := range map[string]Manifest{"loads": loads, "tools": tools, "a process": run, "the runtime": runtime} {
-		if p := undeliveredBundles(m); len(p) != 0 {
-			t.Errorf("a bundle delivered by %s was refused: %v", name, p)
-		}
-	}
-}
-
-// novox/hq ADR 0193: a Go tools bundle is served — its binary is what the runtime starts, delivered
-// like any tools bundle, named to the runtime where a TypeScript bundle names its launcher.
-func TestAGoToolsBundleIsServedByItsBinary(t *testing.T) {
-	with := Rendering{ArtifactStore: "anchor.internal:5101",
-		Needed: map[string]map[string]string{RuntimeModule: {"broker": "sealed-credential"}}}
-	lamp := Manifest{Module: "lamp", Version: "1", Tools: []string{"on"},
-		Build: &Build{Artifacts: []Artifact{{Name: "tools", Kind: ArtifactBundle, Language: "go",
-			System: "arch", From: "cmd/lamp-tools"}}}}
-	if p := lamp.Build.problems("lamp"); len(p) != 0 {
-		t.Fatalf("a Go tools bundle was refused: %v", p)
-	}
-	lamp, err := lamp.Resolve([]Built{{Name: "tools", Kind: ArtifactBundle,
-		Reference: ArtifactStoreScheme + "lamp/tools/blobs/" + bundleDigest, Digest: bundleDigest}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if fmt.Sprint(lamp.Bundles[0].Loads) != "[lamp-tools]" {
-		t.Fatalf("the runtime loads %v from a Go bundle, want its binary", lamp.Bundles[0].Loads)
-	}
-	out, err := Resolution{Node: "anchor", Account: "ops", Modules: []Manifest{lamp, theRuntime(t)}}.Declaration(with)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if fileNamed(out, "lamp."+BundleID("tools")) == nil {
-		t.Errorf("the Go bundle is not delivered: %v", ids(out))
-	}
-	env := fileNamed(out, RuntimeModule+"."+RuntimeProcessID())["env"].(map[string]string)
-	if env[RuntimeToolModules] != "lamp="+BundlePath("lamp", "tools")+"/lamp-tools" {
-		t.Errorf("the runtime is told %q, want the binary", env[RuntimeToolModules])
-	}
-
-	// An artifact may say it explicitly; naming anything but the binary is refused.
-	said := Manifest{Module: "lamp", Version: "1", Build: &Build{Artifacts: []Artifact{{Name: "tools",
-		Kind: ArtifactBundle, Language: "go", System: "arch", Binary: "lamp", Loads: []string{"lamp"}}}}}
-	if p := said.Build.problems("lamp"); len(p) != 0 {
-		t.Errorf("loads naming the binary was refused: %v", p)
-	}
-	said.Build.Artifacts[0].Loads = []string{"tools/index.js"}
-	if p := said.Build.problems("lamp"); len(p) == 0 {
-		t.Error("a Go bundle loading a file it does not contain was admitted")
-	}
-}

internal/catalogue/seat_dependencies.go

@@ -1,286 +0,0 @@
-package catalogue
-
-import (
-	"fmt"
-	"sort"
-	"strings"
-)
-
-// A module depends on the node seats that apply its resources (novox/hq ADR 0207).
-//
-// Some of what a module declares is applied through software on the machine that is itself a
-// module: a service through the service manager, a package through the package manager, a container
-// through the container runtime. A *capability* only says that software is installed; it does not
-// say that a module of the mesh holds the role and answers for it. So the dependency is derived from
-// the resources — never stated in a manifest, because a module that adds a service and forgets a
-// field would pass — and is met when some module assigned to the same node holds the seat.
-
-// The three seats that apply resources (novox/hq ADR 0207 §1). Named once, because the derivation,
-// the seed and the messages all turn on these strings.
-const (
-	ServiceManagerSeat   = "node-service-manager"
-	PackageManagerSeat   = "node-package-manager"
-	ContainerRuntimeSeat = "node-container-runtime"
-)
-
-// appliedThrough is which seat applies a resource of each type. **Only these three**: ADR 0207
-// names them and no more. A process is supervised by the host itself, a file, a directory, an
-// archive, a user or an action is the host's own act, and a module's other kinds reach the machine
-// without a role in between — adding one here is a decision, not a refinement.
-var appliedThrough = map[string]string{
-	"service":   ServiceManagerSeat,
-	"package":   PackageManagerSeat,
-	"container": ContainerRuntimeSeat,
-}
-
-// enforceSeatDependencies is the one-line switch ADR 0207 §4 names. Off, an unmet dependency at
-// composition is *reported* — in the resolution, in `status`, once in the log — and the node still
-// resolves; on, it is refused like any unresolved requirement. Off until `status` reports none,
-// which is when the three holders are assigned to every node: switching it before then would stop
-// every machine lacking one from being sent anything at all.
-//
-// Switched on 2026-10-04, when `status` first reported no unmet dependency on any node: systemd,
-// pacman and docker were assigned to all four machines that afternoon (novox/hq to-be 42).
-//
-// A variable rather than a constant only so a test can hold both behaviours; nothing else sets it.
-var enforceSeatDependencies = true
-
-// EnforcingSeatDependencies sets the switch and returns what puts it back. For tests in other
-// packages that hold the behaviour from before the switch; nothing else calls it.
-func EnforcingSeatDependencies(on bool) (restore func()) {
-	was := enforceSeatDependencies
-	enforceSeatDependencies = on
-	return func() { enforceSeatDependencies = was }
-}
-
-// foundationModules are the pieces genesis lays before any module exists (novox/hq ADR 0207 §5):
-// the host and the private network. Registered as modules so they can be assigned, but what they
-// declare is the installation's, not a module's, so it is never judged. The third piece, the
-// bootstrap container runtime, is not a module at all: its package and service are in the genesis
-// bundle the host applies itself, and never pass through a resolution here.
-//
-// The private network's module is overlay.Name, written out because the overlay package composes
-// on top of this one; its resources are computed, which exempts it by the rule below as well.
-var foundationModules = map[string]bool{
-	"mesh-host":      true,
-	"mesh-wireguard": true,
-}
-
-// isFoundation is whether a module's declarations are the foundation's rather than its own. A
-// module whose resources are computed is the mesh's by construction — the private network's peer
-// list and its tools are the controller's, written per node — so it counts whatever its name.
-func isFoundation(m Manifest) bool {
-	return foundationModules[m.Module] || m.Computed != ""
-}
-
-// DependsOn is every seat a module needs held on its node, derived from the resource types it
-// declares itself (novox/hq ADR 0207 §2), sorted.
-//
-// **The module's own `resources` only.** What the controller composes around a module — its
-// filter, jails, certificates, kept files, bundles, the guard — is the mesh's, put there because the
-// module is assigned, and depending on it would make the module answer for the mesh's choices.
-func DependsOn(m Manifest) []string {
-	if isFoundation(m) {
-		return nil
-	}
-	seen := map[string]bool{}
-	for _, r := range m.Resources {
-		if seat, applied := appliedThrough[fmt.Sprint(r["type"])]; applied {
-			seen[seat] = true
-		}
-	}
-	out := make([]string, 0, len(seen))
-	for s := range seen {
-		out = append(out, s)
-	}
-	sort.Strings(out)
-	return out
-}
-
-// claimsSeat is whether a module claims a node seat, by its current name or one it used to have
-// (ADR 0122), so a rename leaves the dependency met.
-func claimsSeat(m Manifest, seat string) bool {
-	for _, c := range m.Claims {
-		if c.At() != ScopeNode {
-			continue
-		}
-		name := c.Name
-		if s, known := SeatNamed(name); known {
-			name = s.Name
-		}
-		if name == seat {
-			return true
-		}
-	}
-	return false
-}
-
-// PossibleHolders is every module in the catalogue that claims a seat at node scope — what a
-// refusal names as the remedy.
-func PossibleHolders(catalogue map[string]Manifest, seat string) []string {
-	var out []string
-	for name, m := range catalogue {
-		if claimsSeat(m, seat) {
-			out = append(out, name)
-		}
-	}
-	sort.Strings(out)
-	return out
-}
-
-// Unheld is one dependency of one module on a node that nothing on that node holds.
-type Unheld struct {
-	Node   string `json:"node"`
-	Module string `json:"module"`
-	Seat   string `json:"seat"`
-	// Holders are the modules in the catalogue that could hold the seat: assigning one meets it.
-	Holders []string `json:"holders"`
-}
-
-// String is the line a refusal and a report both say, so the two never drift.
-func (u Unheld) String() string {
-	remedy := "and no module in the catalogue claims it yet"
-	if len(u.Holders) > 0 {
-		remedy = "— assign one that holds it: " + strings.Join(u.Holders, ", ")
-	}
-	return fmt.Sprintf("%s on %s depends on %s, which nothing on %s holds (novox/hq ADR 0207) %s",
-		u.Module, u.Node, u.Seat, u.Node, remedy)
-}
-
-// UnheldDependencies is every dependency of the modules in `judged` that the node's whole set
-// leaves unmet (novox/hq ADR 0207 §3).
-//
-// **Judged over the whole set, never one module at a time.** The holders depend on each other:
-// the service manager's own package needs the package manager, and the package manager's timer
-// needs the service manager. Asked one by one, neither could ever be first; asked of the set, the
-// two assigned together meet each other. A module holding a seat it depends on meets its own
-// dependency. `judged` nil judges every module of the set.
-func UnheldDependencies(catalogue map[string]Manifest, node string, set []Manifest, judged map[string]bool) []Unheld {
-	held := map[string]bool{}
-	for _, m := range set {
-		for seat := range seatsApplying() {
-			if claimsSeat(m, seat) {
-				held[seat] = true
-			}
-		}
-	}
-	var out []Unheld
-	for _, m := range set {
-		if judged != nil && !judged[m.Module] {
-			continue
-		}
-		for _, seat := range DependsOn(m) {
-			if held[seat] {
-				continue
-			}
-			out = append(out, Unheld{Node: node, Module: m.Module, Seat: seat,
-				Holders: PossibleHolders(catalogue, seat)})
-		}
-	}
-	sort.Slice(out, func(i, j int) bool {
-		if out[i].Module != out[j].Module {
-			return out[i].Module < out[j].Module
-		}
-		return out[i].Seat < out[j].Seat
-	})
-	return out
-}
-
-func seatsApplying() map[string]bool {
-	out := map[string]bool{}
-	for _, s := range appliedThrough {
-		out[s] = true
-	}
-	return out
-}
-
-// manifestsOf is the catalogue's definitions of the named modules; a name the catalogue does not
-// know contributes nothing, as it does to a resolution.
-func manifestsOf(catalogue map[string]Manifest, names []string) []Manifest {
-	var out []Manifest
-	seen := map[string]bool{}
-	for _, n := range names {
-		if m, known := catalogue[n]; known && !seen[n] {
-			seen[n] = true
-			out = append(out, m)
-		}
-	}
-	return out
-}
-
-// AssignRefusal is why assigning `adding` to a node already running `assigned` is refused, or
-// nothing (novox/hq ADR 0207 §4): each new module's dependency the node's assignments, the new ones
-// included, leave unmet.
-//
-// **Only the new modules are judged.** A node already short of a holder is reported by `status`;
-// refusing an unrelated assignment for it would make the remedy — assigning the holder — refused too.
-//
-// **A dependency nothing in the catalogue can meet is said, not refused.** A refusal names the
-// module that would meet it; with none registered there is no remedy to name, and refusing would
-// stop every assignment of that kind until a module that does not exist yet is written. The answer
-// still says it, and `status` reports it — before the switch and after it alike: there is never a
-// remedy to name for it. The first return is those lines.
-func AssignRefusal(catalogue map[string]Manifest, node string, assigned, adding []string) ([]string, error) {
-	set := manifestsOf(catalogue, append(append([]string(nil), assigned...), adding...))
-	judged := map[string]bool{}
-	for _, a := range adding {
-		judged[a] = true
-	}
-	var refused, said []string
-	for _, u := range UnheldDependencies(catalogue, node, set, judged) {
-		if len(u.Holders) == 0 {
-			said = append(said, u.String())
-			continue
-		}
-		refused = append(refused, u.String())
-	}
-	if len(refused) > 0 {
-		return said, &Refusal{Problems: append(refused,
-			fmt.Sprintf("holders that depend on each other are assigned together: `assign %s <module> <module>…`", node))}
-	}
-	return said, nil
-}
-
-// UnassignRefusal is why taking `removing` off a node running `assigned` is refused, or nothing
-// (novox/hq ADR 0207): a seat the removed modules hold that nothing left on the node holds, while
-// a module left there depends on it. Names the dependents, because they are what must go first —
-// or the holder's replacement come.
-func UnassignRefusal(catalogue map[string]Manifest, node string, assigned, removing []string) error {
-	gone := map[string]bool{}
-	for _, r := range removing {
-		gone[r] = true
-	}
-	var left []string
-	for _, a := range assigned {
-		if !gone[a] {
-			left = append(left, a)
-		}
-	}
-	before := map[string]bool{}
-	for _, u := range UnheldDependencies(catalogue, node, manifestsOf(catalogue, assigned), nil) {
-		before[u.Module+"\x00"+u.Seat] = true
-	}
-	dependents := map[string][]string{}
-	for _, u := range UnheldDependencies(catalogue, node, manifestsOf(catalogue, left), nil) {
-		if before[u.Module+"\x00"+u.Seat] {
-			continue // unmet already; not this removal's doing
-		}
-		dependents[u.Seat] = append(dependents[u.Seat], u.Module)
-	}
-	if len(dependents) == 0 {
-		return nil
-	}
-	seats := make([]string, 0, len(dependents))
-	for s := range dependents {
-		seats = append(seats, s)
-	}
-	sort.Strings(seats)
-	var problems []string
-	for _, s := range seats {
-		problems = append(problems, fmt.Sprintf(
-			"%s holds %s on %s, and %s depend on it (novox/hq ADR 0207) — unassign them with it, "+
-				"or assign another holder first", strings.Join(removing, ", "), s, node,
-			strings.Join(dependents[s], ", ")))
-	}
-	return &Refusal{Problems: problems}
-}

internal/catalogue/seat_dependencies_test.go

@@ -1,247 +0,0 @@
-package catalogue
-
-import (
-	"errors"
-	"reflect"
-	"strings"
-	"testing"
-)
-
-// Defends novox/hq ADR 0207: a module depends on the node seats that apply its resources.
-
-func res(kind, id string) map[string]any {
-	r := map[string]any{"id": id, "type": kind}
-	switch kind {
-	case "service":
-		r["unit"] = id + ".service"
-	case "package":
-		r["package"] = id
-	case "container":
-		r["image"] = id
-	case "file":
-		r["path"] = "/etc/" + id
-	}
-	return r
-}
-
-func withResources(m Manifest, rs ...map[string]any) Manifest {
-	m.Resources = rs
-	return m
-}
-
-// The three holders as to-be 42 names them, each declaring what it really does: systemd's own
-// package needs the package manager, pacman's timer needs the service manager, docker's package and
-// service need both.
-func coreThree() []Manifest {
-	return []Manifest{
-		withResources(mod("systemd", nil, nil, nil, Claim{Name: ServiceManagerSeat}), res("package", "systemd")),
-		withResources(mod("pacman", nil, nil, nil, Claim{Name: PackageManagerSeat}), res("service", "pacman-refresh")),
-		withResources(mod("docker", nil, nil, nil, Claim{Name: ContainerRuntimeSeat}),
-			res("package", "docker"), res("service", "docker")),
-	}
-}
-
-func TestADependencyIsDerivedFromEachResourceTypeThatAppliesThroughASeat(t *testing.T) {
-	cases := map[string][]string{
-		"service":   {ServiceManagerSeat},
-		"package":   {PackageManagerSeat},
-		"container": {ContainerRuntimeSeat},
-		// The host's own acts, or the mesh's: nothing in between holds a role for them.
-		"file": nil, "directory": nil, "process": nil, "archive": nil, "user": nil,
-		"action": nil, "network": nil, "access": nil,
-	}
-	for kind, want := range cases {
-		got := DependsOn(withResources(mod("m", nil, nil, nil), res(kind, "x")))
-		if len(got) == 0 {
-			got = nil
-		}
-		if !reflect.DeepEqual(got, want) {
-			t.Errorf("a %s resource depends on %v, want %v", kind, got, want)
-		}
-	}
-	all := DependsOn(withResources(mod("m", nil, nil, nil),
-		res("container", "a"), res("service", "b"), res("package", "c"), res("package", "d")))
-	if want := []string{ContainerRuntimeSeat, PackageManagerSeat, ServiceManagerSeat}; !reflect.DeepEqual(all, want) {
-		t.Errorf("a module of every kind depends on %v, want each seat once: %v", all, want)
-	}
-}
-
-func TestTheSeatsThatApplyResourcesAreTheMeshsOwnAtNodeScope(t *testing.T) {
-	for _, name := range []string{ServiceManagerSeat, PackageManagerSeat, ContainerRuntimeSeat} {
-		s, ok := SeatNamed(name)
-		if !ok {
-			t.Fatalf("%s is not in the mesh's set", name)
-		}
-		if s.Scope != ScopeNode {
-			t.Errorf("%s is held per %s, want per node", name, s.Scope)
-		}
-	}
-	// No verbs yet for either new seat: ADR 0207 seeds the package manager without a protocol, and
-	// the runtime's verbs wait for ADR 0166's acceptance.
-	for _, name := range []string{PackageManagerSeat, ContainerRuntimeSeat} {
-		if s, _ := SeatNamed(name); len(s.Serves)+len(s.Accepts)+len(s.Emits) > 0 {
-			t.Errorf("%s carries a protocol; ADR 0207 seeds it with none", name)
-		}
-	}
-}
-
-func TestANodeWhoseAssignmentsHoldTheSeatsResolvesWithNothingUnheld(t *testing.T) {
-	web := withResources(mod("web", nil, nil, nil), res("container", "web"), res("service", "web-timer"))
-	cat := shelf(append(coreThree(), web)...)
-	got, err := Resolve(cat, []string{"systemd", "pacman", "docker", "web"}, workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(got.Unheld) != 0 {
-		t.Errorf("a node holding all three seats reports %v", got.Unheld)
-	}
-	if _, err := AssignRefusal(cat, "workstation", []string{"systemd", "pacman", "docker"}, []string{"web"}); err != nil {
-		t.Errorf("assigning beside the three holders was refused: %v", err)
-	}
-}
-
-func TestAnAssignmentMissingAHolderIsRefusedNamingTheSeatAndItsPossibleHolders(t *testing.T) {
-	web := withResources(mod("web", nil, nil, nil), res("container", "web"), res("service", "web-timer"))
-	cat := shelf(append(coreThree(), web)...)
-	_, err := AssignRefusal(cat, "workstation", []string{"systemd", "pacman"}, []string{"web"})
-	var refusal *Refusal
-	if !errors.As(err, &refusal) {
-		t.Fatalf("web assigned to a node without a container runtime was not refused: %v", err)
-	}
-	msg := err.Error()
-	for _, want := range []string{"web on workstation depends on " + ContainerRuntimeSeat, "docker", "ADR 0207"} {
-		if !strings.Contains(msg, want) {
-			t.Errorf("the refusal does not say %q:\n%s", want, msg)
-		}
-	}
-	// What the node does hold is not named as missing.
-	if strings.Contains(msg, "depends on "+ServiceManagerSeat) {
-		t.Errorf("the refusal names a seat systemd already holds:\n%s", msg)
-	}
-}
-
-func TestADependencyNoCatalogueModuleCanMeetIsSaidNeverRefused(t *testing.T) {
-	// No runtime module in the catalogue: refusing would stop every container's assignment until one
-	// is written, with no remedy to name — so it is said, with the switch on as with it off.
-	web := withResources(mod("web", nil, nil, nil), res("container", "web"))
-	cat := shelf(web)
-	for _, on := range []bool{false, true} {
-		enforceSeatDependencies = on
-		said, err := AssignRefusal(cat, "workstation", nil, []string{"web"})
-		if err != nil {
-			t.Fatalf("switch %v: a dependency nothing could meet was refused: %v", on, err)
-		}
-		if len(said) != 1 || !strings.Contains(said[0], "no module in the catalogue claims it yet") {
-			t.Errorf("switch %v: the assignment does not say what it depends on: %v", on, said)
-		}
-		if _, err := Resolve(cat, []string{"web"}, workstation(), World{}); err != nil {
-			t.Errorf("switch %v: a dependency nothing could meet refused the node: %v", on, err)
-		}
-	}
-	enforceSeatDependencies = true
-}
-
-func TestTheHoldersMutualDependenceResolvesWhenAssignedTogether(t *testing.T) {
-	cat := shelf(coreThree()...)
-	// Alone, each needs the other.
-	if _, err := AssignRefusal(cat, "workstation", nil, []string{"systemd"}); err == nil ||
-		!strings.Contains(err.Error(), "pacman") {
-		t.Errorf("systemd alone was not refused naming pacman: %v", err)
-	}
-	if _, err := AssignRefusal(cat, "workstation", nil, []string{"pacman"}); err == nil ||
-		!strings.Contains(err.Error(), "systemd") {
-		t.Errorf("pacman alone was not refused naming systemd: %v", err)
-	}
-	// Together, in one act, they meet each other — and docker meets its own seat.
-	if _, err := AssignRefusal(cat, "workstation", nil, []string{"systemd", "pacman", "docker"}); err != nil {
-		t.Errorf("the three holders assigned together were refused: %v", err)
-	}
-	got, err := Resolve(cat, []string{"systemd", "pacman"}, workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(got.Unheld) != 0 {
-		t.Errorf("systemd and pacman together report %v", got.Unheld)
-	}
-}
-
-func TestStatusIsToldOfAnUnmetDependencyAndTheNodeStillResolves(t *testing.T) {
-	// Before the switch (the state the mesh ran in until every node held the three seats).
-	enforceSeatDependencies = false
-	defer func() { enforceSeatDependencies = true }()
-	web := withResources(mod("web", nil, nil, nil), res("container", "web"))
-	cat := shelf(append(coreThree(), web)...)
-	got, err := Resolve(cat, []string{"web"}, workstation(), World{})
-	if err != nil {
-		t.Fatalf("an unmet dependency refused the node before the switch: %v", err)
-	}
-	want := []Unheld{{Node: "workstation", Module: "web", Seat: ContainerRuntimeSeat, Holders: []string{"docker"}}}
-	if !reflect.DeepEqual(got.Unheld, want) {
-		t.Errorf("reported %+v, want %+v", got.Unheld, want)
-	}
-}
-
-func TestWithTheSwitchFlippedAnUnmetDependencyRefusesTheNode(t *testing.T) {
-	enforceSeatDependencies = true
-	defer func() { enforceSeatDependencies = true }()
-	web := withResources(mod("web", nil, nil, nil), res("container", "web"))
-	cat := shelf(append(coreThree(), web)...)
-	_, err := Resolve(cat, []string{"web"}, workstation(), World{})
-	if err == nil || !strings.Contains(err.Error(), ContainerRuntimeSeat) || !strings.Contains(err.Error(), "docker") {
-		t.Fatalf("with the switch on, an unmet dependency gave %v", err)
-	}
-	// Never in the first pass, whose refusals take a machine off the network instead.
-	if _, err := Resolve(cat, []string{"web"}, workstation(), World{Unchecked: true}); err != nil {
-		t.Errorf("the first pass refused an unmet dependency: %v", err)
-	}
-}
-
-func TestTheFoundationsDeclarationsAreNotJudged(t *testing.T) {
-	// The private network, as the controller computes it: its tools' package and its service are
-	// the mesh's, written per node, and so are never a module's dependency.
-	network := withResources(mod("mesh-wireguard", []string{"private-network"}, nil, nil),
-		res("package", "wireguard-tools"), res("service", "overlay-up"))
-	network.Computed = "mesh-wireguard"
-	// The host, whatever it declares.
-	host := withResources(mod("mesh-host", nil, nil, nil), res("file", "launcher"), res("service", "nox-mesh-host"))
-	cat := shelf(append(coreThree(), network, host)...)
-
-	for _, m := range []Manifest{network, host} {
-		if d := DependsOn(m); len(d) != 0 {
-			t.Errorf("%s, the foundation's, depends on %v", m.Module, d)
-		}
-	}
-	got, err := Resolve(cat, []string{"mesh-wireguard", "mesh-host"}, workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(got.Unheld) != 0 {
-		t.Errorf("the foundation on a node with no holders reports %v", got.Unheld)
-	}
-	if _, err := AssignRefusal(cat, "workstation", nil, []string{"mesh-wireguard", "mesh-host"}); err != nil {
-		t.Errorf("assigning the foundation was refused: %v", err)
-	}
-}
-
-func TestUnassigningTheLastHolderWhileDependentsRemainIsRefused(t *testing.T) {
-	sshd := withResources(mod("sshd", nil, nil, nil), res("service", "sshd"))
-	cat := shelf(append(coreThree(), sshd)...)
-	on := []string{"systemd", "pacman", "docker", "sshd"}
-
-	err := UnassignRefusal(cat, "workstation", on, []string{"systemd"})
-	if err == nil {
-		t.Fatal("the last service manager came off a node still running services")
-	}
-	for _, want := range []string{ServiceManagerSeat, "sshd", "pacman", "docker"} {
-		if !strings.Contains(err.Error(), want) {
-			t.Errorf("the refusal does not name %q:\n%v", want, err)
-		}
-	}
-	// A dependent comes off freely, and the holders with everything depending on them in one act.
-	if err := UnassignRefusal(cat, "workstation", on, []string{"sshd"}); err != nil {
-		t.Errorf("a dependent's unassignment was refused: %v", err)
-	}
-	if err := UnassignRefusal(cat, "workstation", on, on); err != nil {
-		t.Errorf("unassigning everything together was refused: %v", err)
-	}
-}

internal/catalogue/seat_into.go

@@ -43,8 +43,8 @@ import (
 var ofSeat = regexp.MustCompile(`\$\{seat:([a-z0-9][a-z0-9-]*):([0-9]+)\}`)
 
 // seatInto replaces a resource's ${seat:…} placeholders with where this machine put each seat's
-// holder — in a file's content, and in a value of a container's or a process's environment. The
-// same places portInto fills, for the same reason: they are where a program reads a number from.
+// holder — in a file's content, and in a value of a container's environment. The same two places
+// portInto fills, for the same reason: they are where a process reads a number from.
 func seatInto(resource map[string]any, module string, with Rendering) error {
 	switch fmt.Sprint(resource["type"]) {
 	case "file":
@@ -58,7 +58,7 @@ func seatInto(resource map[string]any, module string, with Rendering) error {
 		}
 		resource["content"] = filled
 
-	case "container", "process":
+	case "container":
 		env, ok := resource["env"].(map[string]any)
 		if !ok {
 			return nil
@@ -78,8 +78,8 @@ func seatInto(resource map[string]any, module string, with Rendering) error {
 				continue
 			}
 			value, err := seatsFilledInto(written,
-				fmt.Sprintf("%s's %s %s sets %s to something that",
-					module, resource["type"], resource["name"], key), with)
+				fmt.Sprintf("%s's container %s sets %s to something that",
+					module, resource["name"], key), with)
 			if err != nil {
 				return err
 			}

internal/catalogue/seat_into_test.go

@@ -101,7 +101,7 @@ func TestTheControlPlanesOwnAddressesFollowTheNodesPorts(t *testing.T) {
 	}
 	// The manifest itself names them now; withSeatPorts is a no-op on it, and this holds it so.
 	for _, r := range m.Resources {
-		if r["type"] != "process" {
+		if r["type"] != "container" {
 			continue
 		}
 		env, _ := r["env"].(map[string]any)
@@ -113,9 +113,8 @@ func TestTheControlPlanesOwnAddressesFollowTheNodesPorts(t *testing.T) {
 	}
 	m = withSeatPorts(m)
 	control, err := m.Resolve([]Built{{
-		Name: "controller", Kind: ArtifactBundle,
-		Reference: ArtifactStoreScheme + "mesh-controller/controller@sha256:" + strings.Repeat("c", 64),
-		Digest:    "sha256:" + strings.Repeat("c", 64),
+		Name: "server", Kind: ArtifactImage,
+		Reference: ArtifactStoreScheme + "mesh-controller/server@sha256:" + strings.Repeat("c", 64),
 	}})
 	if err != nil {
 		t.Fatal(err)
@@ -136,9 +135,9 @@ func TestTheControlPlanesOwnAddressesFollowTheNodesPorts(t *testing.T) {
 	if err != nil {
 		t.Fatalf("the control plane does not compose: %v", err)
 	}
-	server := fileNamed(out, "mesh-controller.controller")
+	server := fileNamed(out, "mesh-controller.server")
 	if server == nil {
-		t.Fatalf("the control plane's process is not in the declaration: %v", out)
+		t.Fatalf("the control plane's container is not in the declaration: %v", out)
 	}
 	env, _ := server["env"].(map[string]any)
 	for key, want := range map[string]string{
@@ -152,8 +151,8 @@ func TestTheControlPlanesOwnAddressesFollowTheNodesPorts(t *testing.T) {
 			t.Errorf("the control plane is told %s=%v; the node put it on %s", key, env[key], want)
 		}
 	}
-	if got := server["source"]; got != "anchor.internal:5100/mesh-controller/controller@sha256:"+strings.Repeat("c", 64) {
-		t.Errorf("the control plane's own bundle is fetched from %v, not routed through the store", got)
+	if got := server["image"]; got != "anchor.internal:5100/mesh-controller/server@sha256:"+strings.Repeat("c", 64) {
+		t.Errorf("the control plane's own image is %v, not routed through the store", got)
 	}
 
 	// And on a mesh where the foundation is where genesis raised it, nothing is added.
@@ -161,7 +160,7 @@ func TestTheControlPlanesOwnAddressesFollowTheNodesPorts(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	env, _ = fileNamed(out, "mesh-controller.controller")["env"].(map[string]any)
+	env, _ = fileNamed(out, "mesh-controller.server")["env"].(map[string]any)
 	if env["MESH_STORE_INVENTORY_PORT"] != "" {
 		t.Errorf("with no settings, the control plane is told %v", env)
 	}
@@ -187,7 +186,7 @@ func withSeatPorts(m Manifest) Manifest {
 	out := m
 	out.Resources = nil
 	for _, r := range m.Resources {
-		if r["type"] != "container" && r["type"] != "process" {
+		if r["type"] != "container" {
 			out.Resources = append(out.Resources, r)
 			continue
 		}

internal/catalogue/seats.go

@@ -49,7 +49,7 @@ type Seat struct {
 // written; the store's table is seeded from it and thereafter is the live, editable copy.
 //
 // In the order a person reads it: the mesh's own, then a node's.
-var defaultSeats = append([]Seat{
+var defaultSeats = []Seat{
 	// The control plane states what it did under the seat it holds (novox/hq ADR 0134): a role's
 	// events belong to the role, so they keep their address while the holder is replaced. No accepts,
 	// so no work queue is raised for it — only what its holder may say.
@@ -96,17 +96,8 @@ var defaultSeats = append([]Seat{
 	// A build says what it does as it does it (novox/hq ADR 0157): `started` when work is taken,
 	// `log.<build id>` for every line, `built` for the outcome. The log's tail token is the build's
 	// id, so a reader follows one build by subject alone.
-	// **Node-scoped, and every holder takes from one queue** (novox/hq ADR 0190): a build is asked of
-	// the role, and whichever machine holding the seat is idle pulls it. One holder per machine is
-	// what the scope says; sharing the work is what a seat's queue has always done.
-	{Name: "node-build-agent", Scope: ScopeNode,
-		Accepts: []string{"build"}, Emits: []string{"started", "built", "log.*"}, Decision: "novox/hq ADR 0190"},
-	// **Retired by ADR 0190, kept while a manifest still claims it.** The one build machine's seat.
-	// A claim to a seat the mesh no longer defines is refused, and the module holding this one is
-	// assigned on a live machine until build-agent replaces it — removing the row first would make
-	// that machine unresolvable in the meantime. Deleted once no registered manifest claims it.
 	{Name: "mesh-build-machine", Scope: ScopeMesh,
-		Accepts: []string{"build"}, Emits: []string{"started", "built", "log.*"}, Decision: "novox/hq ADR 0190"},
+		Accepts: []string{"build"}, Emits: []string{"started", "built", "log.*"}, Decision: "novox/hq ADR 0121"},
 	{Name: "node-dns-resolver", Scope: ScopeNode, Decision: "novox/hq ADR 0121"},
 	// The intrusion prevention's verbs (novox/hq ADR 0179): what a person asks a machine's ban list
 	// whatever keeps it — who is banned and why, ban one address, let one go. Every holder serves all
@@ -148,30 +139,8 @@ var defaultSeats = append([]Seat{
 	// system or user scope; the holder answers questions and operator acts about them, each verb
 	// taking the unit and an optional scope. The holder runs nothing of its own: its verbs are
 	// served by the node tools runtime (ADR 0175).
-	{Name: ServiceManagerSeat, Scope: ScopeNode, Decision: "novox/hq ADR 0177",
+	{Name: "node-service-manager", Scope: ScopeNode, Decision: "novox/hq ADR 0177",
 		Serves: serviceManagerVerbs()},
-	// The machine's package manager (novox/hq ADR 0207). A module declaring a `package` depends on
-	// it being held on its node, as one declaring a `service` depends on node-service-manager: the
-	// mesh's word for "something on this machine answers for installing", where a capability only
-	// says the software is there. No verbs yet — the seat says who answers, and what may be asked
-	// of it is decided when someone needs to ask.
-	{Name: PackageManagerSeat, Scope: ScopeNode, Decision: "novox/hq ADR 0207"},
-	// The machine's container runtime (novox/hq ADR 0166, seeded now by ADR 0207): a module
-	// declaring a `container` depends on it being held on its node. Its verbs, and the host creating
-	// containers through its holder, wait for ADR 0166's acceptance — seeded without them so the
-	// dependency has a seat to name and the runtime's module has one to claim.
-	{Name: ContainerRuntimeSeat, Scope: ScopeNode, Decision: "novox/hq ADR 0166, ADR 0207"},
-	// The operator account's environment (novox/hq ADR 0203): one module per machine writes it, and
-	// every module contributes to it. No verbs — the seat says who places the environment's files,
-	// and their path is its protocol: a shell sources ~/.config/mesh/environment.sh without knowing
-	// which module wrote it.
-	{Name: EnvironmentSeat, Scope: ScopeNode, Decision: "novox/hq ADR 0203"},
-	// The login shell (novox/hq ADR 0204, replacing the module-declared `login-shell` of ADR 0176):
-	// the mesh's, so a second shell module claims the seat rather than declaring a second one, and
-	// the seat exists whether or not zsh's definition is registered. `execute` is the contract any
-	// node may call; the holder places every module's shell code in its slots.
-	{Name: LoginShellSeat, Scope: ScopeNode, Decision: "novox/hq ADR 0204",
-		Serves: loginShellVerbs()},
 	// Deferred (novox/hq ADR 0121): renaming to mesh-private-network is a scope + server/client
 	// model change, not a rename, so it stays until that is built.
 	{Name: "the-private-network", Scope: ScopeNode, Decision: "novox/hq ADR 0110"},
@@ -183,9 +152,7 @@ var defaultSeats = append([]Seat{
 	// rather than a condition in the resolver's module, so a machine running two managers is
 	// refused at assignment instead of found by the resolver being rewritten (novox/hq ADR 0117).
 	{Name: "node-uplink", Scope: ScopeNode, Decision: "novox/hq ADR 0117"},
-},
-	// The graphical session's roles (novox/hq ADR 0208), last because they are a workstation's.
-	graphicalSessionSeats()...)
+}
 
 // A system seat name is the control plane's namespace: `mesh-*` for a mesh-wide role, `node-*` for
 // a per-node one (novox/hq ADR 0121). A claim to a system name the mesh does not define is refused;
@@ -480,17 +447,3 @@ func serviceManagerVerbs() []Verb {
 			Input: scoped(map[string]string{"unit": unit["unit"], "lines": "how many lines from the end (default 100)"}, []string{"unit"})},
 	}
 }
-
-// loginShellVerbs is the contract every holder of node-login-shell serves (novox/hq ADR 0176, ADR
-// 0204): one command, run the way the operator's own terminal would run it, bounded below the
-// runtime's thirty-second call limit so a hung command answers rather than times the caller out.
-func loginShellVerbs() []Verb {
-	return []Verb{
-		{Name: "execute", Description: "Run one command on this machine as the operator account, in a " +
-			"non-interactive login shell in its home; answers with what it printed and how it exited.",
-			Input: schema(map[string]string{
-				"command":         "the command line, as you would type it",
-				"timeout_seconds": "give up after this long, at most 25 (default 20)",
-			}, []string{"command"})},
-	}
-}

internal/catalogue/seats_declared.go

@@ -25,10 +25,6 @@ import (
 // and nothing to keep in step when a mesh seat is added.
 const meshSeatPrefix = "mesh-"
 
-// retiredLoginShell is the one name outside the prefix a module may not declare: the login shell's,
-// from when a module declared it (novox/hq ADR 0176), before it became the mesh's (ADR 0204).
-const retiredLoginShell = "login-shell"
-
 // A SeatDeclaration is a role a module offers on the bus: what may be sent to it, what it says,
 // and what it answers. A caller declares that it uses the *seat*, never the module, so the
 // implementation can be replaced under it.
@@ -92,15 +88,6 @@ func declaredSeatProblems(m Manifest) []string {
 					"seats (novox/hq ADR 0118)", m.Module, s.Name, meshSeatPrefix+"*"))
 			continue
 		}
-		if s.Name == retiredLoginShell {
-			// The name ADR 0176 gave the login shell when the zsh module declared it. The seat is
-			// the mesh's now, so a module declaring the old name would be a second login shell
-			// beside it, with a protocol of its own (novox/hq ADR 0204).
-			problems = append(problems, fmt.Sprintf(
-				"%s declares a seat named %q; the login shell is the mesh's own seat %s, which a shell "+
-					"module claims and none declares (novox/hq ADR 0204)", m.Module, s.Name, LoginShellSeat))
-			continue
-		}
 		if seen[s.Name] {
 			problems = append(problems, fmt.Sprintf(
 				"%s declares the seat %q twice", m.Module, s.Name))
@@ -228,13 +215,6 @@ func CatalogueProblems(shelf Shelf) []string {
 			}
 		}
 	}
-	// A read of a module's state that module does not keep (novox/hq ADR 0201) — said only where the
-	// owner is on the shelf, as a consumer may be installed before its emitter.
-	var manifests []Manifest
-	for _, module := range shelfOrder(shelf) {
-		manifests = append(manifests, shelf[module])
-	}
-	problems = append(problems, StateReadsNothingDeclares(manifests)...)
 	sort.Strings(problems)
 	return problems
 }

internal/catalogue/seats_test.go

@@ -18,9 +18,7 @@ import (
 // vocabulary test follows. If this fails because a seat was added, the fix is a record in novox/hq
 // and a row in to-be 26, not a new number here.
 func TestTheSeatsAreAClosedSetAndEachNamesItsDecision(t *testing.T) {
-	// A seat a later record extends names both, "novox/hq ADR 0166, ADR 0207": the one that defined
-	// it and the one that seeded it.
-	record := regexp.MustCompile(`^novox/hq ADR \d{4}(, ADR \d{4})*$`)
+	record := regexp.MustCompile(`^novox/hq ADR \d{4}$`)
 	seen := map[string]bool{}
 	delivered := map[string]string{}
 	for _, s := range Seats() {
@@ -46,12 +44,9 @@ func TestTheSeatsAreAClosedSetAndEachNamesItsDecision(t *testing.T) {
 			delivered[s.Delivers] = s.Name
 		}
 	}
-	// Thirty-two since the graphical session's eleven (novox/hq ADR 0208); twenty-one with
-	// node-package-manager and node-container-runtime (ADR 0207); nineteen with node-environment and
-	// node-login-shell (ADR 0203, ADR 0204); seventeen with node-build-agent (ADR 0190). One fewer
-	// once the retired mesh-build-machine row goes, when no registered manifest claims it any more.
-	if len(Seats()) != 32 {
-		t.Errorf("the mesh defines %d seats rather than 32; the set is closed, so a change here is "+
+	// Sixteen since node-service-manager (novox/hq ADR 0177).
+	if len(Seats()) != 16 {
+		t.Errorf("the mesh defines %d seats rather than 16; the set is closed, so a change here is "+
 			"a decision (novox/hq ADR 0110): %s", len(Seats()), seatNames())
 	}
 }

internal/catalogue/secret_restart_test.go

@@ -1,52 +0,0 @@
-package catalogue
-
-import (
-	"reflect"
-	"strings"
-	"testing"
-)
-
-// What reads one of a module's own secrets is restarted when the secret changes (novox/hq issue 203,
-// issue 206): the build machine kept an hour-old credential open because its manifest restarted it
-// on its environment file alone. Composed, so a manifest need not say it; a scheduled process is
-// left alone, because the host refuses a restart-on for one and it reads the file afresh each run.
-func TestAContainerReadingAnOwnSecretIsRestartedWhenItChanges(t *testing.T) {
-	m := Manifest{Module: "agent", Version: "1",
-		OwnSecrets: OwnSecrets{"broker": {Path: "/var/lib/mesh/agent/broker"}},
-		Resources: []map[string]any{
-			{"id": "mesh-state", "type": "directory", "path": "/var/lib/mesh/agent", "mode": "0700"},
-			{"id": "settings", "type": "file", "path": "/var/lib/mesh/agent/agent.env", "mode": "0600", "content": "A=1\n"},
-			{"id": "server", "type": "container", "name": "agent", "network": "host",
-				"image":      "registry.example/agent@sha256:" + strings.Repeat("a", 64),
-				"volumes":    []any{"/var/lib/mesh/agent:/run/mesh:ro", "/var/lib/mesh/agent/broker:/run/mesh/broker:ro"},
-				"env-file":   []any{"/var/lib/mesh/agent/agent.env"},
-				"restart-on": []any{"settings"}},
-			{"id": "nightly", "type": "container", "name": "agent-nightly", "schedule": "0 3 * * *",
-				"image":   "registry.example/agent@sha256:" + strings.Repeat("a", 64),
-				"volumes": []any{"/var/lib/mesh/agent/broker:/run/mesh/broker:ro"}},
-			{"id": "other", "type": "container", "name": "agent-other",
-				"image": "registry.example/agent@sha256:" + strings.Repeat("a", 64)},
-		}}
-	got, err := Resolve(shelf(m), []string{m.Module},
-		Node{Name: "anchor", At: "10.0.0.1", Capabilities: map[string]bool{"container-runtime": true}}, World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	out, err := got.Declaration(Rendering{Needed: map[string]map[string]string{"agent": {"broker": "SEALED"}}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	by := map[string]map[string]any{}
-	for _, r := range out {
-		by[r["id"].(string)] = r
-	}
-	if want := []any{"agent.settings", "agent.needs-broker"}; !reflect.DeepEqual(by["agent.server"]["restart-on"], want) {
-		t.Fatalf("the server reads the credential and is not restarted on it: %v", by["agent.server"]["restart-on"])
-	}
-	if _, has := by["agent.nightly"]["restart-on"]; has {
-		t.Fatalf("a scheduled container was given a restart-on, which the host refuses: %v", by["agent.nightly"]["restart-on"])
-	}
-	if _, has := by["agent.other"]["restart-on"]; has {
-		t.Fatalf("a container that reads no secret was given one to restart on: %v", by["agent.other"]["restart-on"])
-	}
-}

internal/catalogue/shared_account_test.go

@@ -1,42 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// One account, several modules: the shell's module sets its shell, the container runtime's adds it
-// to a group. Groups are only ever added by the host, so they are contributed; a shell or a home is
-// one value, owned by one module per node.
-
-func userResource(fields map[string]any) map[string]any {
-	r := map[string]any{"id": "operator", "type": "user", "name": "op"}
-	for k, v := range fields {
-		r[k] = v
-	}
-	return r
-}
-
-func TestAShellAndAGroupOnOneAccountFromTwoModulesResolve(t *testing.T) {
-	zsh := Manifest{Module: "zsh", Resources: []map[string]any{userResource(map[string]any{"shell": "/usr/bin/zsh"})}}
-	docker := Manifest{Module: "docker", Resources: []map[string]any{userResource(map[string]any{"groups": []any{"docker"}})}}
-	other := Manifest{Module: "media", Resources: []map[string]any{userResource(map[string]any{"groups": []any{"video"}})}}
-	if problems := checkResources([]Manifest{zsh, docker, other}); len(problems) != 0 {
-		t.Fatalf("a shell and two modules' groups on one account were refused: %v", problems)
-	}
-	if _, err := Resolve(shelf(zsh, docker, other), []string{"zsh", "docker", "media"}, workstation(), World{}); err != nil {
-		t.Fatalf("the three did not resolve together: %v", err)
-	}
-}
-
-func TestTwoModulesSettingOneAccountsShellOrHomeAreRefused(t *testing.T) {
-	for _, field := range []string{"shell", "home"} {
-		a := Manifest{Module: "zsh", Resources: []map[string]any{userResource(map[string]any{field: "/one"})}}
-		b := Manifest{Module: "fish", Resources: []map[string]any{userResource(map[string]any{field: "/two", "groups": []any{"x"}})}}
-		problems := checkResources([]Manifest{a, b})
-		want := `zsh and fish both set the ` + field + ` of the user "op"`
-		if len(problems) != 1 || !strings.Contains(problems[0], want) {
-			t.Errorf("two modules setting %s gave %v, want %q", field, problems, want)
-		}
-	}
-}