Give a bundle module's bound credential to the account its runtime runs as (hq issue 624)

A consumer's credential file was composed with the owner the module declared, root when it declared
none. A module whose code is a bundle the node's runtime runs reads it as the operator's account, and
a root-owned 0600 file is one it cannot read: the lab cloned the forge with no credential. The grant
side was fixed the same way for issue 225; this is the consumer's side. A declared owner still wins.

cmd/mesh-controller/acts.go

@@ -203,9 +203,8 @@ func seatDependenciesOnAssign(ctx context.Context, open *stores, node string, mo
 	if _, err := catalogue.AssignRefusal(shelf, node, assigned, adding); err != nil {
 		return nil, nil, err
 	}
-	// Two modules declaring one path or unit, or one package present and absent, is refused before anything
-	// is recorded (novox/hq ADR 0210, ADR 0303, 04-ISSUES/235): kept, the node would not resolve until one came
-	// off again. Two modules declaring one package present is not a collision (ADR 0303, issue 628).
+	// Two modules declaring one package, path or unit is refused before anything is recorded
+	// (novox/hq ADR 0210, 04-ISSUES/235): kept, the node would not resolve until one came off again.
 	if err := catalogue.CollisionRefusal(shelf, node, assigned, adding); err != nil {
 		return nil, nil, err
 	}

cmd/mesh-controller/adoption.go

@@ -722,7 +722,7 @@ func converge(ctx context.Context, open *stores, node string, yes bool, digest s
 		return "", err
 	}
 	derived := derivedFilter{rules: rules, foundation: with.Foundation, mesh: with.Mesh,
-		outward: plan.PublicDomain != "", outwardLinks: with.OutwardLinks, local: with.LocalNetworks}
+		outward: plan.PublicDomain != "", outwardLinks: with.OutwardLinks}
 	filtering, err := inv.FilteringOf(ctx, node)
 	if err != nil {
 		return "", err
@@ -930,9 +930,6 @@ type derivedFilter struct {
 	// The filter constrains what arrives on them; everything arriving elsewhere is this machine's
 	// own guest and is not filtered.
 	outwardLinks []string
-	// local is the machine's local networks, which a port from `local-network` stays open to (novox/hq
-	// ADR 0340).
-	local []string
 }
 
 // closesOutside is what a narrowing from everywhere to the private network is called: it closes.
@@ -980,17 +977,6 @@ func (d derivedFilter) fate(r inventory.Reach) string {
 			if !onMesh {
 				return fmt.Sprintf("%s — declared by %s from the mesh only", closesOutside, by)
 			}
-		case catalogue.FromLocalNetwork:
-			// The private network and this machine's local networks (novox/hq ADR 0340): it closes to
-			// everything else outside, and says which local networks stay.
-			if !onMesh {
-				if len(d.local) == 0 {
-					return fmt.Sprintf("%s — declared by %s from the local network, and this machine "+
-						"reported none", closesOutside, by)
-				}
-				return fmt.Sprintf("WILL CLOSE to everything outside the private network and %s — declared "+
-					"by %s from the local network", strings.Join(d.local, ", "), by)
-			}
 		}
 		return fmt.Sprintf("declared by %s (from %s)", by, rule.From)
 	}

cmd/mesh-controller/handacts_test.go

@@ -55,7 +55,7 @@ func TestARepairByHandCarriesItsReason(t *testing.T) {
 		want string
 	}{
 		{"push", map[string]any{"node": "anchor", "why": "stuck", "cause": "sent-not-reported"},
-			"push anchor --wait 0s --why stuck --cause sent-not-reported"},
+			"push anchor --wait 0 --why stuck --cause sent-not-reported"},
 		{"plans", map[string]any{"close": "plan-1", "why": "the report will not come"},
 			"plans close plan-1 --why the report will not come"},
 		{"plans", map[string]any{"retry": "plan-1"}, "plans retry plan-1"},

cmd/mesh-controller/local_network.go

@@ -1,67 +0,0 @@
-package main
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/novox/mesh-controller/internal/catalogue"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/overlay"
-)
-
-// localNetworksOf is a machine's attached networks judged (novox/hq ADR 0340): which count as its local
-// network, from what it last said of itself and the links it said face outside it. A machine that has
-// said none judges to nothing, and a port reached from `local-network` is then admitted from the private
-// network only, and said so.
-func localNetworksOf(ctx context.Context, inv *inventory.Inventory, node string) ([]catalogue.LocalNetwork, error) {
-	account, had, err := inv.MachineOf(ctx, node)
-	if err != nil {
-		return nil, err
-	}
-	outward, err := inv.OutwardLinksOf(ctx, node)
-	if err != nil {
-		return nil, err
-	}
-	return judgedNetworks(account, had, outward, overlay.Interface), nil
-}
-
-// judgedNetworks is the judging alone, from what was read.
-func judgedNetworks(account inventory.MachineAccount, had bool, outward []string, tunnel string) []catalogue.LocalNetwork {
-	if !had || account.Machine == nil {
-		return nil
-	}
-	attached := make([]catalogue.AttachedNetwork, 0, len(account.Machine.Networks))
-	for _, n := range account.Machine.Networks {
-		attached = append(attached, catalogue.AttachedNetwork{Link: n.Link, Network: n.Network})
-	}
-	return catalogue.JudgeLocalNetworks(attached, outward, tunnel)
-}
-
-// localNetworkLines is what `node` shows of a machine's attached networks (ADR 0340 §8): each one, with
-// whether it counts as the local network and why, or why none is shown.
-func localNetworkLines(account inventory.MachineAccount, had bool, judged []catalogue.LocalNetwork) []string {
-	out := []string{"  its local network (what a port reached from local-network is admitted from):"}
-	switch {
-	case !had || account.Machine == nil:
-		return append(out, "    not said — this machine has not reported what it is attached to")
-	case len(account.Machine.Networks) == 0:
-		why := account.Machine.Unknown["networks"]
-		if why == "" {
-			why = "its node-engine is older than the one that says it"
-		}
-		return append(out, "    not said — "+why)
-	}
-	counted := 0
-	for _, j := range judged {
-		verdict := "not counted"
-		if j.Counts {
-			verdict = "counts"
-			counted++
-		}
-		out = append(out, fmt.Sprintf("    %-22s on %-10s %s: %s", j.Network, j.Link, verdict, j.Why))
-	}
-	if counted == 0 {
-		out = append(out, "    none counts: a port reached from local-network is admitted from the private network only")
-	}
-	return out
-}

cmd/mesh-controller/local_network_test.go

@@ -1,65 +0,0 @@
-package main
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/catalogue"
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// **node shows what the local network resolved to** (novox/hq ADR 0340 §8): every attached network,
-// whether it counts, and why the others do not — the public subnet named as never counted.
-func TestNodeShowsWhichAttachedNetworksCountAndWhy(t *testing.T) {
-	account := inventory.MachineAccount{Architecture: "amd64", Kernel: "linux", Machine: &inventory.MadeOf{
-		Networks: []inventory.AttachedNetwork{
-			{Link: "eth0", Network: "192.168.1.10/24"},
-			{Link: "eth1", Network: "203.0.113.7/24"},
-			{Link: "wg-mesh", Network: "10.10.0.4/24"},
-		}}}
-	judged := judgedNetworks(account, true, []string{"eth0", "eth1"}, "wg-mesh")
-	text := strings.Join(localNetworkLines(account, true, judged), "\n")
-	for _, want := range []string{
-		"192.168.1.0/24", "counts: in a private range (RFC 1918, 192.168.0.0/16)",
-		"203.0.113.0/24", "not counted: public, never counted",
-		"10.10.0.0/24", "the private network's own link",
-	} {
-		if !strings.Contains(text, want) {
-			t.Errorf("node does not say %q:\n%s", want, text)
-		}
-	}
-}
-
-// A machine that said none, or whose node-engine is older, is said as that — never as an empty list
-// that reads like a machine on no network.
-func TestNodeSaysWhenNoNetworkWasSaid(t *testing.T) {
-	older := inventory.MachineAccount{Machine: &inventory.MadeOf{}}
-	if text := strings.Join(localNetworkLines(older, true, nil), "\n"); !strings.Contains(text, "older than the one that says it") {
-		t.Errorf("an older node-engine is not said:\n%s", text)
-	}
-	public := inventory.MachineAccount{Machine: &inventory.MadeOf{
-		Networks: []inventory.AttachedNetwork{{Link: "eth0", Network: "198.51.100.9/24"}}}}
-	judged := judgedNetworks(public, true, []string{"eth0"}, "wg-mesh")
-	if text := strings.Join(localNetworkLines(public, true, judged), "\n"); !strings.Contains(text, "none counts") {
-		t.Errorf("a machine on a public network only is not said to have no local network:\n%s", text)
-	}
-	if text := strings.Join(localNetworkLines(inventory.MachineAccount{}, false, nil), "\n"); !strings.Contains(text, "not said") {
-		t.Errorf("a machine that never reported is not said:\n%s", text)
-	}
-}
-
-// The preview of a flip says what a port from the local network keeps: the local networks it stays
-// open to, or that the machine reported none (ADR 0340 §6).
-func TestTheFlipPreviewSaysWhatALocalNetworkPortKeeps(t *testing.T) {
-	rules := []catalogue.Rule{{Port: 1883, Protocol: "tcp", From: catalogue.FromLocalNetwork, Because: []string{"mosquitto"}}}
-	at := inventory.Reach{Protocol: "tcp", Address: "0.0.0.0", Port: 1883}
-	with := derivedFilter{rules: rules, mesh: []string{"10.10.0.1"}, outwardLinks: []string{"eth0"},
-		local: []string{"192.168.1.0/24"}}
-	if fate := with.fate(at); !strings.Contains(fate, "192.168.1.0/24") {
-		t.Errorf("the preview says %q, without the local network it stays open to", fate)
-	}
-	with.local = nil
-	if fate := with.fate(at); !strings.Contains(fate, "reported none") {
-		t.Errorf("the preview says %q, without saying no local network was reported", fate)
-	}
-}

cmd/mesh-controller/nodes.go

@@ -19,7 +19,6 @@ import (
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
-	"github.com/novox/mesh-controller/internal/overlay"
 	"github.com/novox/mesh-controller/internal/token"
 )
 
@@ -885,16 +884,6 @@ func showNode(ctx context.Context, stored *stores, name string) error {
 		for _, line := range machineLines(account, had, time.Now()) {
 			fmt.Println(line)
 		}
-		// And which of the networks it is attached to count as its local network, and why the others
-		// do not (novox/hq ADR 0340 §8).
-		outward, err := inv.OutwardLinksOf(ctx, name)
-		if err != nil {
-			fmt.Printf("  its local network could NOT be judged: %v\n", err)
-		} else {
-			for _, line := range localNetworkLines(account, had, judgedNetworks(account, had, outward, overlay.Interface)) {
-				fmt.Println(line)
-			}
-		}
 	}
 
 	held, err := inv.Profile(ctx, name)

cmd/mesh-controller/plan.go

@@ -451,12 +451,6 @@ func declarationWith(ctx context.Context, open *stores, node string,
 	if err != nil {
 		return sendable{}, err
 	}
-	// Which ports the filter admits from the local network, and from which networks, for plan to say
-	// (novox/hq ADR 0340 §8). The same rules the composition rendered, never sent.
-	rules, err := plan.Rules(with)
-	if err != nil {
-		return sendable{}, err
-	}
 	// And what was taken on it, said in every declaration it is sent from this one place.
 	adoption, err := adoptionOf(ctx, open.inventory, record, plan, composed)
 	if err != nil {
@@ -466,8 +460,7 @@ func declarationWith(ctx context.Context, open *stores, node string,
 		Received: composed.Received, Mesh: with.Mesh, BusUsers: with.BusUsers,
 		LeftOut: sortedKeysOf(composed.LeftOut), leftOutWhy: composed.LeftOut, withheld: with.Withheld,
 		unbound: with.Unbound, foreseen: composed.Foreseen, unplaced: composed.Unplaced,
-		modules:      namedModules(plan, composed.LeftOut),
-		localNetwork: catalogue.LocalNetworkPorts(rules, with.LocalNetworks)}
+		modules: namedModules(plan, composed.LeftOut)}
 	// And which build of each module it carries, for the send to record (novox/hq issue 259, ADR
 	// 0221). Read only on the send path: a question about what would be sent records nothing.
 	if choosing == Allocating {
@@ -976,12 +969,6 @@ func renderingFor(ctx context.Context, open *stores, node string,
 	if err != nil {
 		return catalogue.Rendering{}, inventory.Node{}, err
 	}
-	// And which of the networks it is attached to count as its local network (novox/hq ADR 0340):
-	// private ranges only, on a link facing outside it. Reported by the machine, never set.
-	local, err := localNetworksOf(ctx, inv, node)
-	if err != nil {
-		return catalogue.Rendering{}, inventory.Node{}, err
-	}
 	// Where this machine reaches each mesh seat's holder, for ${seat:<seat>:reach} (novox/hq ADR
 	// 0222): the artifact store as this network reaches it, which the container runtime is told to
 	// trust (ADR 0082). The same address composed into every reference the mesh built.
@@ -1006,8 +993,7 @@ func renderingFor(ctx context.Context, open *stores, node string,
 		Machines: machines, Zones: zones, Holders: replicas,
 		Suffix: overlay.Suffix(), MeshRange: meshRange, TunnelInterface: overlay.Interface, Accounts: accounts, Foundation: foundation,
 		Kept: kept, Adopted: record.Adopted, OutwardLinks: outwardLinks,
-		LocalNetworks: catalogue.CountedLocalNetworks(local),
-		Given:         given, Taken: taken, Seats: seats, ArtifactStore: artifactStore, SeatReach: reach, Built: built,
+		Given: given, Taken: taken, Seats: seats, ArtifactStore: artifactStore, SeatReach: reach, Built: built,
 		BusUsers: busUsers, Withheld: withheld, Unbound: unbound,
 	}, record, nil
 }
@@ -1440,11 +1426,6 @@ func planCommand(ctx context.Context, args []string) error {
 			fmt.Printf("  %-20s settings from %s\n", module, layer.From)
 		}
 	}
-	// What each port reached from the local network resolved to on this machine (novox/hq ADR 0340 §8),
-	// or that it resolved to none.
-	for _, p := range declared.localNetwork {
-		fmt.Println("  " + p.Said())
-	}
 	fmt.Printf("\n%d resource(s)\n", len(resources))
 
 	if *show {

cmd/mesh-controller/proposals.go

@@ -18,9 +18,8 @@ package main
 // it beside the layer (`settings` says it back), and records the warrant in the hand-act log on the bus, where a
 // person's decisions are read; the router edits the ask on every channel to its outcome. No seat event of its
 // own: nothing consumes one, and the installer's first user list in the node-engine's repository names every
-// controller event, so one would cost a node-engine change for a fact without a reader. No push is left for
-// afterwards: the warrant that sets the layer opens the walk that sends it (novox/hq ADR 0344, settings_walk.go),
-// so the operator's one Approve is the act that makes the change take effect.
+// controller event, so one would cost a node-engine change for a fact without a reader. The push afterwards is a
+// separate act, as it is for a layer set at the terminal.
 //
 // **What the operator reads** is the module, the machine, each key with its exact new value and, for a changed
 // key, the value it replaces. A value that may not leave the mesh (an address, a path, a secret's shape: the
@@ -48,7 +47,6 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/asks"
 
 	"github.com/novox/mesh-controller/internal/conditions"
-	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 	"github.com/novox/mesh-controller/internal/outward"
 )
@@ -181,7 +179,11 @@ func (p settingsProposal) ask(id string, machines []string) (asks.Ask, map[strin
 			"this fingerprint, through the mesh MCP server (mesh-controller.settings, proposal " + id + ") or with " +
 			"mesh-cli settings proposals " + id + ".")
 	}
-	b.WriteString(" " + p.onApprove())
+	if p.Clear {
+		b.WriteString(" Approved, the layer is removed at once and the machine takes it at its next push.")
+	} else {
+		b.WriteString(" Approved, the layer is set at once and the machine takes it at its next push.")
+	}
 	q := asks.Ask{ID: id, Headline: headline, Explanation: b.String(), Who: asks.Operator,
 		Expires: p.At.Add(askApproveFor), OnExpiry: "the proposal is discarded; nothing changes",
 		About: p.about()}
@@ -190,9 +192,9 @@ func (p settingsProposal) ask(id string, machines []string) (asks.Ask, map[strin
 		binds, _ := asks.ActDigest(boundAct(act))
 		oid := optionID(act.Label)
 		options[oid] = i
-		does := "the settings are set and sent to " + p.reaches() + " at once, each machine judged"
+		does := "the settings are set; nothing is pushed yet"
 		if p.Clear {
-			does = "the layer is removed and that is sent to " + p.reaches() + " at once, each machine judged"
+			does = "the layer is removed; nothing is pushed yet"
 		}
 		if act.Arguments["answer"] == answerDecline {
 			does = "nothing changes; the proposal is discarded"
@@ -517,29 +519,15 @@ func (pr proposer) propose(ctx context.Context, in proposeInput) (string, error)
 		fingerprint(p.Digest))
 	fmt.Fprintf(&b, "  until %s nothing changes: the layer is set only on Approve, and discarded on Decline or at expiry\n",
 		q.Expires.Local().Format("2006-01-02 15:04"))
-	fmt.Fprintf(&b, "  `settings proposals %s` shows it whole; once approved, a walk sends it to %s at once, one machine at "+
-		"a time, each judged, and its end is told as every walk's is (novox/hq ADR 0344)", id, p.reaches())
+	fmt.Fprintf(&b, "  `settings proposals %s` shows it whole; once approved, `push %s` sends it", id, pushWord(p.Node))
 	return b.String(), nil
 }
 
-// reaches is the machines an approved layer is sent to, in words: the one it names, or every machine running the
-// module.
-func (p settingsProposal) reaches() string {
-	if p.Node == "" {
-		return "every machine running " + p.Module
+func pushWord(node string) string {
+	if node == "" {
+		return "--behind"
 	}
-	return p.Node
-}
-
-// onApprove is what the ask says Approve does (novox/hq ADR 0344 §4): the one Approve sets the layer and sends it.
-func (p settingsProposal) onApprove() string {
-	what := "the layer is set"
-	if p.Clear {
-		what = "the layer is removed"
-	}
-	return fmt.Sprintf("Approved, %s and sent at once to %s, one machine at a time, each judged, every build there "+
-		"kept; its end is told as every walk's is. A module that reads its settings only when it starts takes them at "+
-		"its next start.", what, p.reaches())
+	return node
 }
 
 func newProposalID() string {
@@ -800,22 +788,6 @@ func setLayerIn(open *stores) setOnWarrant {
 				changed = "nothing changed"
 			}
 		}
-		// **And sends it** (novox/hq ADR 0344): the layer the operator approved is walked to the machines it reaches
-		// at once. A walk that cannot be opened is said as the act's failure — the layer is set and nothing sends it.
-		walked, err := openSettingsWalk(ctx, open, inventory.PlanSettings{Module: p.Module, Node: p.Node, Ask: askID,
-			Change: changed})
-		if err != nil {
-			return "", fmt.Errorf("%s (ask %s) is set, and the walk that sends it could not be opened: %v — `push %s` sends it",
-				changed, askID, err, pushTo(p.Node))
-		}
-		return changed + " (ask " + askID + "); " + walked, nil
+		return changed + " (ask " + askID + ")", nil
 	}
 }
-
-// pushTo is the push that sends a layer by hand when its walk could not: the machine, or every one behind.
-func pushTo(node string) string {
-	if node == "" {
-		return "--behind"
-	}
-	return node
-}

cmd/mesh-controller/push.go

@@ -740,14 +740,7 @@ func waitForApplied(ctx context.Context, inv *inventory.Inventory, node, digest
 				fmt.Printf("%s applied it\n", node)
 				return nil
 			case inventory.OutcomeFailed:
-				// Each failed resource by id with the machine's own words, so the answer says what to fix
-				// without a second look (novox/hq issue 629).
-				var each []string
-				for _, f := range doing.Failed {
-					each = append(each, f.ID+": "+f.Error)
-				}
-				return fmt.Errorf("%s applied what it was sent but %d resource(s) failed: %s", node, len(doing.Failed),
-					strings.Join(each, "; "))
+				return fmt.Errorf("%s applied what it was sent but %d resource(s) failed", node, len(doing.Failed))
 			case inventory.OutcomeRefused:
 				return fmt.Errorf("%s refused what it was sent: %s", node, doing.Refused)
 			}

cmd/mesh-controller/recorded_kept.go

@@ -2,7 +2,6 @@ package main
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"sort"
 
@@ -84,27 +83,6 @@ func everyBuildKept(ctx context.Context, node string) bool {
 	return on != "" && on == node
 }
 
-type keepForSettingsKey struct{}
-
-// keepingBuildsForSettings is a context whose sends compose every module of one machine — recorded or rolling out —
-// at the build that machine was last sent, as keepingEveryBuild does, for a settings walk's send (novox/hq ADR 0344):
-// the layer the operator approved, and nothing of any module's new code. A build held for a person, or waiting
-// for a gate, stays where it is; the walk that is its own carries it.
-func keepingBuildsForSettings(ctx context.Context, node string) context.Context {
-	return context.WithValue(ctx, keepForSettingsKey{}, node)
-}
-
-// errSettingsCannotKeep is a settings walk's send refused because a build of its machine cannot be kept: what the
-// machine was last sent is not known, or a build it runs is gone from the records. It does not clear by itself, so
-// the walk fails on it rather than trying again (ADR 0344).
-var errSettingsCannotKeep = errors.New("the settings cannot be sent with every build kept")
-
-// settingsKeptOn is whether this context is a settings walk's send to this machine.
-func settingsKeptOn(ctx context.Context, node string) bool {
-	on, _ := ctx.Value(keepForSettingsKey{}).(string)
-	return on != "" && on == node
-}
-
 // recordedKept is, for a send under keepingRecorded, every recorded module the machine was last sent a
 // build of that the mesh's build is not identical to: module → the commit it keeps. Nil when the context
 // keeps nothing, or when what the machine was last sent is not known (it is then held whole elsewhere —
@@ -114,7 +92,7 @@ func settingsKeptOn(ctx context.Context, node string) bool {
 // 490), and a machine whose last send is not known refuses the send: there is nothing to keep it at, and
 // composing the mesh's builds would be the very move the grants step must not make.
 func recordedKept(ctx context.Context, open *stores, node string) (map[string]string, error) {
-	every := everyBuildKept(ctx, node) || settingsKeptOn(ctx, node)
+	every := everyBuildKept(ctx, node)
 	skip, on := keptExcept(ctx)
 	if !on && !every {
 		return nil, nil
@@ -128,9 +106,6 @@ func recordedKept(ctx context.Context, open *stores, node string) (map[string]st
 		return nil, err
 	}
 	if !known {
-		if settingsKeptOn(ctx, node) {
-			return nil, fmt.Errorf("%w: what %s was last sent is not known (novox/hq ADR 0344)", errSettingsCannotKeep, node)
-		}
 		if every {
 			return nil, fmt.Errorf("what %s was last sent is not known, so the bus's user list cannot be sent "+
 				"there alone with every build kept (novox/hq issue 490)", node)
@@ -191,10 +166,6 @@ func keepRecorded(ctx context.Context, open *stores, node string, shelf map[stri
 		if err != nil {
 			return nil, err
 		}
-		if !found && settingsKeptOn(ctx, node) {
-			return nil, fmt.Errorf("%w: %s runs %s's build %s, which the build records no longer hold (novox/hq ADR 0344)",
-				errSettingsCannotKeep, node, m, short(kept[m]))
-		}
 		if !found && everyBuildKept(ctx, node) {
 			return nil, fmt.Errorf("%s runs %s's build %s, which the build records no longer hold: the bus's user "+
 				"list cannot be sent there alone with it kept (novox/hq issue 490)", node, m, short(kept[m]))

cmd/mesh-controller/release.go

@@ -616,10 +616,6 @@ func releaseBacklog(ctx context.Context, open *stores, by string) (*inventory.Pl
 	}
 	for _, p := range plans {
 		if p.Release != nil {
-			if by != "" && p.Release.Settings != nil {
-				return nil, fmt.Errorf("%s is sending %s; what waits is released once it ends — `plans %s` says where it is",
-					p.ID, p.Repository, p.ID)
-			}
 			if by != "" {
 				return nil, fmt.Errorf("%s is already releasing what waits; `plans %s` says where it is", p.ID, p.ID)
 			}
@@ -645,9 +641,7 @@ func releaseBacklog(ctx context.Context, open *stores, by string) (*inventory.Pl
 			return nil, err
 		}
 		for _, p := range recent {
-			// A settings walk that failed holds nothing back (novox/hq ADR 0344 §6): its failure is its module's
-			// settings on one machine, said on its own, not a build no gate passed.
-			if p.Release == nil || p.Release.Settings != nil {
+			if p.Release == nil {
 				continue
 			}
 			if p.State == inventory.PlanFailed {
@@ -708,9 +702,6 @@ func releaseBacklog(ctx context.Context, open *stores, by string) (*inventory.Pl
 // gate, or the machine being judged judged once more; the plan done when every machine is.
 func advanceRelease(ctx context.Context, open *stores, p *inventory.Plan) (bool, error) {
 	r := p.Release
-	if r.Settings != nil {
-		return advanceSettingsWalk(ctx, open, p)
-	}
 	now := time.Now().UTC()
 	if r.Gate == nil {
 		heard, err := releaseHeard(ctx, open)

cmd/mesh-controller/seatverbs.go

@@ -13,7 +13,6 @@ import (
 	"slices"
 	"sort"
 	"strings"
-	"time"
 
 	"github.com/novox/mesh-controller/internal/broker"
 	"github.com/novox/mesh-controller/internal/catalogue"
@@ -520,13 +519,9 @@ func (a *verbArguments) commandLine() ([]string, error) {
 		}
 		return []string{"unpin", str("node"), str("provision")}, nil
 	case "push":
-		// A push to a named machine waits for that machine's own answer, so the call's record says
-		// how it went: applied, refused with the machine's reason, or which resources failed and why
-		// (novox/hq issue 629). How long is the call's `wait`, else the controller's setting `push-wait`;
-		// neither given waits for nothing, as before. The caller is answered before the push starts
-		// (answersFirst) and the machines are released once sent, so the wait holds nobody; it is what
-		// `calls` then shows. A sweep (--behind) does not wait: the slowest machine would hold back
-		// what is said of the others.
+		// Sent and not waited for: the asker reads `status` for what the machine did, which is
+		// what a person at a shell does too. A tool call that blocked for a push's whole apply would
+		// time out on every machine that takes a minute, and say nothing about the ones that did not.
 		// A push through the seat is a push by hand, and says why (novox/hq to-be 45 §7).
 		if err := need("why"); err != nil {
 			return nil, fmt.Errorf("%w: a push by hand is a repair, recorded in the hand-act log with why", err)
@@ -539,11 +534,7 @@ func (a *verbArguments) commandLine() ([]string, error) {
 			// behind is not read here: given with a machine, it is refused as passed over — naming
 			// a machine and asking for every machine behind are two requests, and guessing one
 			// would push a machine nobody named, or not push one somebody did.
-			wait, err := pushWait(str("wait"))
-			if err != nil {
-				return nil, err
-			}
-			argv := []string{"push", n, "--wait", wait.String()}
+			argv := []string{"push", n, "--wait", "0"}
 			// A running module's data moving is sent only when said, per module (novox/hq ADR 0217).
 			if m := str("move"); m != "" {
 				argv = append(argv, "--move", m)
@@ -1337,47 +1328,6 @@ var inProcess = map[string]bool{"tools": true, "calls": true, "doctor": true,
 	// 0259 §8): the router asks it before an approval.
 	"root-free": true}
 
-// pushFileVar names the file the controller's push settings are written to (module.json, `push-wait`).
-const pushFileVar = "MESH_PUSH_FILE"
-
-// pushWait is how long a push to a named machine waits for its answer (novox/hq issue 629): the call's own
-// `wait` when given, else the controller's setting `push-wait`, else nothing. No length is written here: the
-// setting's default is the module's, and a setting that cannot be read waits for nothing, as a push did
-// before, and is said.
-func pushWait(given string) (time.Duration, error) {
-	if strings.TrimSpace(given) != "" {
-		d, ok := durationSetting(given)
-		if !ok {
-			return 0, fmt.Errorf("push: wait %q is no duration: say it as \"90s\", \"2m\", or \"0\" to wait for nothing", given)
-		}
-		return d, nil
-	}
-	path := os.Getenv(pushFileVar)
-	if path == "" {
-		return 0, nil
-	}
-	raw, err := os.ReadFile(path)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "the push settings cannot be read (%v); a push waits for nothing\n", err)
-		return 0, nil
-	}
-	var values map[string]any
-	if err := json.Unmarshal(raw, &values); err != nil {
-		fmt.Fprintf(os.Stderr, "the push settings are not JSON (%v); a push waits for nothing\n", err)
-		return 0, nil
-	}
-	v, has := values["push-wait"]
-	if !has || v == "" {
-		return 0, nil
-	}
-	d, ok := durationSetting(v)
-	if !ok {
-		fmt.Fprintf(os.Stderr, "the setting push-wait=%v is no duration; a push waits for nothing\n", v)
-		return 0, nil
-	}
-	return d, nil
-}
-
 // answersFirst is a command line whose caller is answered before it runs: a push, by its verb or
 // through `command`. A push sends the machine holding the bus first when its user list changed, the
 // broker reloads, and a reload forgets every answer the bus was about to permit — so an answer

cmd/mesh-controller/seatverbs_schema_test.go

@@ -146,7 +146,7 @@ func TestAnArgumentAVerbDoesNotDeclareIsRefused(t *testing.T) {
 // naming one beside behind is refused rather than one of the two guessed.
 func TestAPushIsOneMachineOrSaysItIsTheWholeMesh(t *testing.T) {
 	argv, err := argvFor("push", map[string]any{"node": "g1", "why": "w"})
-	if err != nil || strings.Join(argv, " ") != "push g1 --wait 0s --why w" {
+	if err != nil || strings.Join(argv, " ") != "push g1 --wait 0 --why w" {
 		t.Fatalf("a named push: %v %v", argv, err)
 	}
 	for _, args := range []map[string]any{{"why": "w"}, {"behind": "true", "why": "w"}} {

cmd/mesh-controller/seatverbs_test.go

@@ -5,8 +5,6 @@ import (
 	"errors"
 	"fmt"
 	"github.com/novox/mesh-controller/internal/link"
-	"os"
-	"path/filepath"
 	"strings"
 	"testing"
 
@@ -166,14 +164,12 @@ func TestAVerbMissingWhatItNeedsIsRefused(t *testing.T) {
 	}
 }
 
-// Acts do not block the call. A build is sent, not waited for: the asker reads the build's log by its id.
-// A push answers its caller before it starts (answersFirst), so a named push waits for the machine's own
-// answer without holding anybody, and the call's record says how it went (novox/hq issue 629). A
-// repository given as a forge path is said to be one (issue 176).
+// A push and a build are sent, not waited for: the asker reads status, or the build's log by its
+// id, for what happened. A repository given as a forge path is said to be one (issue 176).
 func TestActsDoNotBlockTheCall(t *testing.T) {
 	argv, _ := argvFor("push", map[string]any{"node": "one", "why": "w"})
-	if strings.Join(argv, " ") != "push one --wait 0s --why w" || !answersFirst(argv) {
-		t.Fatalf("a named push with no setting waits, or holds its caller: %v", argv)
+	if strings.Join(argv, " ") != "push one --wait 0 --why w" {
+		t.Fatalf("push waits: %v", argv)
 	}
 	argv, _ = argvFor("build", map[string]any{"repository": "novox/x", "path": "modules/x"})
 	if strings.Join(argv, " ") != "build novox/x --wait 0 --self --path modules/x" {
@@ -464,40 +460,3 @@ func TestAQuotedValueRoundTrips(t *testing.T) {
 		}
 	}
 }
-
-// A named push waits as long as the call says, else as long as the controller's setting push-wait says, else
-// not at all: no length is the code's own (novox/hq issue 629).
-func TestAPushWaitsAsTheCallOrTheSettingSays(t *testing.T) {
-	file := filepath.Join(t.TempDir(), "push.json")
-	if err := os.WriteFile(file, []byte(`{"push-wait": "2m"}`), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	t.Setenv(pushFileVar, file)
-	argv, err := argvFor("push", map[string]any{"node": "one", "why": "w"})
-	if err != nil || strings.Join(argv, " ") != "push one --wait 2m0s --why w" {
-		t.Fatalf("the setting was not the default: %v %v", argv, err)
-	}
-	argv, err = argvFor("push", map[string]any{"node": "one", "why": "w", "wait": "30s"})
-	if err != nil || strings.Join(argv, " ") != "push one --wait 30s --why w" {
-		t.Fatalf("the call's wait did not win over the setting: %v %v", argv, err)
-	}
-	argv, err = argvFor("push", map[string]any{"node": "one", "why": "w", "wait": "0"})
-	if err != nil || strings.Join(argv, " ") != "push one --wait 0s --why w" {
-		t.Fatalf("a wait of 0 did not wait for nothing: %v %v", argv, err)
-	}
-	if _, err := argvFor("push", map[string]any{"node": "one", "why": "w", "wait": "soon"}); err == nil ||
-		!strings.Contains(err.Error(), "no duration") {
-		t.Fatalf("a wait that is no duration was taken: %v", err)
-	}
-	if err := os.WriteFile(file, []byte(`{"push-wait": "later"}`), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	argv, err = argvFor("push", map[string]any{"node": "one", "why": "w"})
-	if err != nil || strings.Join(argv, " ") != "push one --wait 0s --why w" {
-		t.Fatalf("an unreadable setting did not fall back to waiting for nothing: %v %v", argv, err)
-	}
-	argv, _ = argvFor("push", map[string]any{"why": "w"})
-	if strings.Join(argv, " ") != "push --behind --wait 0 --why w" {
-		t.Fatalf("a sweep waits: %v", argv)
-	}
-}

cmd/mesh-controller/sendable.go

@@ -40,9 +40,6 @@ type sendable struct {
 	actingEpoch  uint64
 	// modules are the modules this declaration names, for the record of the send; never on the wire.
 	modules []string
-	// localNetwork is every port admitted from the local network and what it resolved to (novox/hq ADR
-	// 0340 §8), for plan to say; never on the wire.
-	localNetwork []catalogue.LocalNetworkPort
 	// Adoption is nil for a converged node, and then the body is byte for byte what it was before
 	// adoption existed: an older host parses the envelope strictly and would refuse the key.
 	Adoption *adoptionEnvelope

cmd/mesh-controller/settings_walk.go

@@ -1,281 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"slices"
-	"sort"
-	"strings"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/catalogue"
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// An approved settings change is sent by a walk at once, and the operator's one Approve is its push (novox/hq ADR
-// 0344, issue 641).
-//
-// On 2026-10-13 the operator approved a betterbird proposal on Telegram and nothing happened: the warrant set the
-// layer, and the push stayed a separate act (ADR 0277 §18) that nobody took. Now the warrant that sets the layer
-// opens a **settings walk**: the walk ADR 0236 opens for builds waiting for a gate, with a layer in place of the
-// builds. Its order is every machine running the module that the layer reaches, the control node last; each is
-// sent and its module judged there, from the machine's report on that send, before the next is sent. The send is
-// the layer alone: every module there stays at the build its machine was last sent (keepingBuildsForSettings), so a
-// build held for a person (ADR 0242) or waiting for a gate stays where it is — a policy of `record` holds a build,
-// never a setting — and a send that would move a running module's data stops the walk (ADR 0217 §3). The walk says its start and end on `plan-moved` (ADR 0308), and the holder of the operator's
-// channel tells its end once. A failure stops the walk and leaves the layer as approved; it holds back nothing
-// else.
-
-// settingsWalkPrefix names a settings walk's id.
-const settingsWalkPrefix = "settings-"
-
-// settingsWalkFor is what a settings walk says it is for, where a merge's walk says its repository.
-func settingsWalkFor(s inventory.PlanSettings) string {
-	where := s.Node
-	if where == "" {
-		where = "the whole mesh"
-	}
-	return fmt.Sprintf("the settings of %s on %s", s.Module, where)
-}
-
-// settingsWalkOrder is the machines a layer reaches, in the order a settings walk sends them: every machine
-// running the module, or the one the layer names when it runs it there, sorted, the control node last. Pure.
-func settingsWalkOrder(node string, running, controllers []string) []string {
-	var order, last []string
-	for _, n := range running {
-		if node != "" && n != node {
-			continue
-		}
-		if slices.Contains(controllers, n) {
-			last = append(last, n)
-		} else {
-			order = append(order, n)
-		}
-	}
-	sort.Strings(order)
-	sort.Strings(last)
-	return append(order, last...)
-}
-
-// openSettingsWalk opens the walk that sends an approved layer, and answers the words of what it does: the
-// machines it sends, or that no machine runs the module and nothing is sent. Called on the operator's warrant,
-// after the layer is set.
-var openSettingsWalk = func(ctx context.Context, open *stores, s inventory.PlanSettings) (string, error) {
-	inv := open.inventory
-	running, err := inv.Running(ctx, s.Module)
-	if err != nil {
-		return "", err
-	}
-	controllers, err := inv.Running(ctx, catalogue.ControllerSeatName)
-	if err != nil {
-		return "", err
-	}
-	order := settingsWalkOrder(s.Node, running, controllers)
-	if len(order) == 0 {
-		return fmt.Sprintf("no machine runs %s there, so there is nothing to send", s.Module), nil
-	}
-	release, err := inv.HoldPlans(ctx, true)
-	if err != nil {
-		return "", err
-	}
-	defer release()
-	now := time.Now().UTC()
-	p := inventory.Plan{ID: fmt.Sprintf("%s%d", settingsWalkPrefix, now.UnixNano()), Repository: settingsWalkFor(s),
-		Created: now, State: inventory.PlanRolling, Tiers: [][]string{{s.Module}}, Modules: map[string]*inventory.PlanModule{},
-		Release: &inventory.PlanRelease{Order: order, Settings: &s},
-		Note: fmt.Sprintf("approved (ask %s): sent to %s, one machine at a time, each judged", s.Ask,
-			strings.Join(order, ", "))}
-	if err := inv.SavePlan(ctx, &p); err != nil {
-		return "", err
-	}
-	fmt.Printf("%s: %s — %s\n", p.ID, p.Repository, p.Note)
-	return fmt.Sprintf("%s sends it to %s, one machine at a time, each judged", p.ID, strings.Join(order, ", ")), nil
-}
-
-// settingsDataMoves is what a settings walk's send to a machine would move of a running module's data: composed as
-// that send composes it, every build kept, and compared with what the machine was last sent (ADR 0217 §3).
-var settingsDataMoves = func(ctx context.Context, open *stores, node string) ([]dataMove, error) {
-	keeping := keepingBuildsForSettings(keepingRecorded(ctx), node)
-	gens, err := generators(keeping, open)
-	if err != nil {
-		return nil, err
-	}
-	plan, settings, err := planFor(keeping, open, node)
-	if err != nil {
-		return nil, err
-	}
-	declared, err := declarationWith(keeping, open, node, plan, settings, gens, Reading)
-	if err != nil {
-		return nil, err
-	}
-	body, err := declared.Body()
-	if err != nil {
-		return nil, err
-	}
-	return heldMoves(keeping, open.inventory, node, body, nil)
-}
-
-// judgingOn is the open walk, other than the one named, whose gate is judging on a machine; empty when none is. A
-// settings walk sends a machine only when no other walk judges there: its send would set aside the declaration
-// that walk's gate reads the machine's report against.
-var judgingOn = func(ctx context.Context, open *stores, self, node string) (string, error) {
-	plans, err := open.inventory.OpenPlans(ctx)
-	if err != nil {
-		return "", err
-	}
-	return judgingIn(plans, self, node), nil
-}
-
-// judgingIn is judgingOn over plans read. Pure.
-func judgingIn(plans []inventory.Plan, self, node string) string {
-	judging := func(g *inventory.PlanGate) bool {
-		return g != nil && g.Verdict == "" && slices.Contains(g.Machines, node)
-	}
-	for _, p := range plans {
-		if p.ID == self || !p.Open() {
-			continue
-		}
-		if p.Release != nil {
-			if judging(p.Release.Gate) {
-				return p.ID
-			}
-			continue
-		}
-		for _, s := range p.Modules {
-			if s != nil && judging(s.Gate) {
-				return p.ID
-			}
-		}
-	}
-	return ""
-}
-
-// advanceSettingsWalk takes one step of a settings walk: the next machine sent and its module judged there, or the
-// machine being judged judged once more; done when every machine is.
-func advanceSettingsWalk(ctx context.Context, open *stores, p *inventory.Plan) (bool, error) {
-	r, s := p.Release, p.Release.Settings
-	now := time.Now().UTC()
-	wait := func(note string) (bool, error) {
-		changed := p.Note != note
-		p.Note = note
-		return changed, nil
-	}
-	if r.Gate == nil {
-		heard, err := releaseHeard(ctx, open)
-		if err != nil {
-			return false, err
-		}
-		for r.Next < len(r.Order) {
-			node := r.Order[r.Next]
-			if !heard[node] {
-				r.Skipped = append(r.Skipped, node)
-				r.Next++
-				continue
-			}
-			if id, err := judgingOn(ctx, open, p.ID, node); err != nil {
-				return false, err
-			} else if id != "" {
-				return wait(fmt.Sprintf("waiting before %s: %s is judging there", node, id))
-			}
-			// **A running module's data that would move is a person's word** (ADR 0217 §3): the walk stops before
-			// that machine, failed and said, and `push --move` sends it.
-			held, err := settingsDataMoves(ctx, open, node)
-			if errors.Is(err, errSettingsCannotKeep) {
-				return failBefore(p, node, err.Error())
-			}
-			if err != nil {
-				return false, fmt.Errorf("whether %s's data would move could not be read: %w", node, err)
-			}
-			if len(held) > 0 {
-				var said strings.Builder
-				sayDataHeld(&said, node, held)
-				return failBefore(p, node, "a running module's data would move there — "+
-					strings.Join(strings.Fields(said.String()), " "))
-			}
-			// A build that cannot be kept is refused by the composition above, which is the send's own, and fails the
-			// walk there: the send flattens its refusals into words, so it is not looked for again here.
-			sent, grants, err := sendJudged(keepingBuildsForSettings(ctx, node), open, node)
-			if err != nil {
-				return false, fmt.Errorf("sending %s %s: %w", node, settingsWalkFor(*s), err)
-			}
-			// **The module's build is the one the gate judges** (issue 641 review): kept by this send, it is what a
-			// crossing send — a merge's walk sending the machine a new build of the module — supersedes, so this gate
-			// never reads that send's report as its own.
-			kept := ""
-			if builds, known, err := open.inventory.SentBuilds(ctx, node); err == nil && known {
-				kept = builds[s.Module]
-			}
-			r.Gate = &inventory.PlanGate{Component: coreComponent(s.Module), Machines: sent, Since: &now,
-				From: kept, To: kept, Sent: sentNow(ctx, open.inventory, sent), Grants: grants}
-			p.Note = fmt.Sprintf("sent %s %s (ask %s), every build there kept; judging %s there", node,
-				settingsWalkFor(*s), s.Ask, s.Module)
-			if said := grantsSaid(grants); said != "" {
-				p.Note += "; " + said
-			}
-			fmt.Printf("%s: %s\n", p.ID, p.Note)
-			return true, nil
-		}
-		p.State, p.Tier = inventory.PlanDone, len(p.Tiers)
-		p.Note = fmt.Sprintf("%s (ask %s) delivered on %s", settingsWalkFor(*s), s.Ask, strings.Join(r.Done, ", "))
-		if len(r.Done) == 0 {
-			// Sent nowhere is not delivered: said as the walk's failure, so the operator is not told it landed.
-			p.State = inventory.PlanFailed
-			p.Note = fmt.Sprintf("%s (ask %s) was sent to no machine", settingsWalkFor(*s), s.Ask)
-		}
-		if len(r.Skipped) > 0 {
-			p.Note += "; not heard from, left as they were, their next send carries it: " + strings.Join(r.Skipped, ", ")
-		}
-		fmt.Printf("%s: %s\n", p.ID, p.Note)
-		return true, nil
-	}
-	g := r.Gate
-	node := r.Order[r.Next]
-	verdict, err := judgeMoves(ctx, open, g, []judged{{module: s.Module, node: node}}, now)
-	if err != nil {
-		return false, err
-	}
-	switch verdict {
-	case "":
-		return wait(fmt.Sprintf("judging %s on %s: %s", s.Module, node, gateLine(g)))
-	case inventory.GatePassed:
-		r.Done = append(r.Done, node)
-		r.Next++
-		r.Gate = nil
-		return true, nil
-	case inventory.GateSuperseded:
-		p.State = inventory.PlanSuperseded
-		p.Note = fmt.Sprintf("superseded on %s: %s — nothing judged, nothing put back; the layer is set, and the "+
-			"machines not yet sent take it at their next send", node, g.Why)
-		fmt.Printf("%s: %s\n", p.ID, p.Note)
-		return true, nil
-	}
-	p.State = inventory.PlanFailed
-	p.Note = fmt.Sprintf("%s failed its gate on %s: %s — the layer stays as the operator approved it, and the one it "+
-		"replaced is in `settings %s` history", settingsWalkFor(*s), node, g.Why, s.Module) + unreached(r)
-	fmt.Printf("%s: %s\n", p.ID, p.Note)
-	return true, nil
-}
-
-// failBefore ends a settings walk failed before it sent a machine, saying why, and that the layer stays.
-func failBefore(p *inventory.Plan, node, why string) (bool, error) {
-	r, s := p.Release, p.Release.Settings
-	p.State = inventory.PlanFailed
-	p.Note = fmt.Sprintf("%s not sent to %s: %s; the layer stays as the operator approved it", settingsWalkFor(*s),
-		node, why) + unreached(r)
-	fmt.Printf("%s: %s\n", p.ID, p.Note)
-	return true, nil
-}
-
-// unreached is what a stopped settings walk left without the layer, in words: the machines after the one it stopped
-// at, and those passed over as away (ADR 0344 §6). Empty when there are none.
-func unreached(r *inventory.PlanRelease) string {
-	var out string
-	if r.Next+1 < len(r.Order) {
-		out += "; not sent: " + strings.Join(r.Order[r.Next+1:], ", ")
-	}
-	if len(r.Skipped) > 0 {
-		out += "; not heard from, left as they were: " + strings.Join(r.Skipped, ", ")
-	}
-	return out
-}

cmd/mesh-controller/settings_walk_test.go

@@ -1,565 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"reflect"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/catalogue"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/lease"
-)
-
-// novox/hq ADR 0344, issue 641: the operator's one Approve on a settings proposal is the act that makes it take
-// effect. The warrant sets the layer and opens a settings walk, which sends it to the machines it reaches one at a
-// time, judging the module on each; the ask says so before the Approve, and nothing names a push.
-
-// The order: every machine running the module, or the one the layer names, the control node last.
-func TestASettingsWalkGoesToTheMachinesTheLayerReachesTheControlNodeLast(t *testing.T) {
-	running := []string{"shanks", "novox", "g14", "ace"}
-	for _, c := range []struct {
-		node string
-		want []string
-	}{
-		{"", []string{"ace", "g14", "shanks", "novox"}},
-		{"g14", []string{"g14"}},
-		{"novox", []string{"novox"}},
-		{"elsewhere", nil},
-	} {
-		if got := settingsWalkOrder(c.node, running, []string{"novox"}); !reflect.DeepEqual(got, c.want) {
-			t.Errorf("a layer on %q goes to %v, want %v", c.node, got, c.want)
-		}
-	}
-}
-
-// A settings walk sends a machine only when no other walk judges there.
-func TestASettingsWalkWaitsWhileAnotherWalkJudgesOnTheMachine(t *testing.T) {
-	judging := &inventory.PlanGate{Machines: []string{"g14"}}
-	passed := &inventory.PlanGate{Machines: []string{"g14"}, Verdict: inventory.GatePassed}
-	plans := []inventory.Plan{
-		{ID: "settings-1", State: inventory.PlanRolling, Release: &inventory.PlanRelease{Gate: judging}},
-		{ID: "release-2", State: inventory.PlanRolling, Release: &inventory.PlanRelease{Gate: passed}},
-		{ID: "plan-3", State: inventory.PlanRolling, Modules: map[string]*inventory.PlanModule{"app": {Gate: judging}}},
-		{ID: "plan-4", State: inventory.PlanDone, Modules: map[string]*inventory.PlanModule{"app": {Gate: judging}}},
-	}
-	if id := judgingIn(plans, "settings-1", "g14"); id != "plan-3" {
-		t.Errorf("on g14 %q judges, want plan-3 (itself, a passed gate and an ended walk are not judging)", id)
-	}
-	if id := judgingIn(plans[1:2], "x", "g14"); id != "" {
-		t.Errorf("a passed gate judges: %q", id)
-	}
-	if id := judgingIn(plans, "x", "shanks"); id != "" {
-		t.Errorf("on shanks %q judges", id)
-	}
-}
-
-// The ask says, before the Approve, that the layer is sent at once and judged, and that its end is told as every
-// walk's is; neither the ask nor the proposer's answer names a push any more.
-func TestTheAskSaysAnApprovedLayerIsSentAtOnce(t *testing.T) {
-	for _, c := range []struct {
-		in    proposeInput
-		where string
-		had   bool
-	}{
-		{proposeInput{module: "mounts", node: "shanks", values: mountsSources}, "shanks", false},
-		{proposeInput{module: "notes", values: map[string]any{"x": "1"}}, "every machine running notes", true},
-		{proposeInput{module: "notes", node: "laptop", clear: true}, "laptop", true},
-	} {
-		r := newProposerRig(t)
-		if c.had {
-			r.before, r.had = map[string]any{"x": "0"}, true
-		}
-		words, err := r.pr.propose(context.Background(), c.in)
-		if err != nil {
-			t.Fatal(err)
-		}
-		q := r.askSent(t)
-		if err := q.Check(r.now); err != nil {
-			t.Fatalf("the ask is refused: %v", err)
-		}
-		if !strings.Contains(q.Explanation, "and sent at once to "+c.where+", one machine at a time, each judged, "+
-			"every build there kept; its end is told as every walk's is") {
-			t.Errorf("the ask does not say the layer is sent at once to %s:\n%s", c.where, q.Explanation)
-		}
-		approve := q.Options[0]
-		if approve.Label != "Approve" || !strings.Contains(approve.Does, "sent to "+c.where+" at once") {
-			t.Errorf("Approve does %q", approve.Does)
-		}
-		if !strings.Contains(words, "a walk sends it to "+c.where+" at once") {
-			t.Errorf("the proposer's answer:\n%s", words)
-		}
-		for _, said := range []string{q.Explanation, approve.Does, words} {
-			if strings.Contains(said, "push") {
-				t.Errorf("a push is still named, as if a second act were needed:\n%s", said)
-			}
-		}
-	}
-}
-
-// ---- on the real stores -----------------------------------------------------------------------------
-
-// The warrant sets the layer and opens the walk that sends it, naming the machines it reaches; a layer for a
-// machine that does not run the module opens none and says so.
-func TestAnApprovedLayerOpensTheWalkThatSendsIt(t *testing.T) {
-	open := aMesh(t)
-	ctx := t.Context()
-	register(t, open, catalogue.Manifest{Module: "notes", Version: "1",
-		Resources: []map[string]any{{"id": "rc", "type": "file", "path": "/etc/notes.conf", "mode": "0644",
-			"content": "x = ${setting:x}\n"}}})
-	if _, err := assign(ctx, open, "laptop", "notes"); err != nil {
-		t.Fatal(err)
-	}
-	// A layer set by hand opens no walk: it still waits for a push (ADR 0344 §7).
-	if err := atTheTerminal(t, "settings", "set", "notes", `{"x":"0"}`, "--node", "laptop"); err != nil {
-		t.Fatal(err)
-	}
-	if plans, _ := open.inventory.OpenPlans(ctx); len(plans) != 0 {
-		t.Fatalf("a layer set at the terminal opened %d walk(s)", len(plans))
-	}
-	set := setLayerIn(open)
-	now := time.Now()
-	values := map[string]any{"x": "1"}
-	p := settingsProposal{Module: "notes", Values: values, From: "g14/claude-code", At: now,
-		Digest: layerDigest(values), BeforeDigest: layerDigest(nil)}
-	words, err := set(ctx, p, "s9", "approved by the operator (ask s9)")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !strings.Contains(words, "+ x (ask s9); settings-") || !strings.Contains(words, "sends it to laptop, one machine at a time") {
-		t.Errorf("the warrant's words: %q", words)
-	}
-	plans, err := open.inventory.OpenPlans(ctx)
-	if err != nil || len(plans) != 1 {
-		t.Fatalf("open walks: %+v %v", plans, err)
-	}
-	w := plans[0]
-	if w.Release == nil || w.Release.Settings == nil || w.Release.Settings.Module != "notes" || w.Release.Settings.Ask != "s9" ||
-		!reflect.DeepEqual(w.Release.Order, []string{"laptop"}) || w.Repository != "the settings of notes on the whole mesh" ||
-		!reflect.DeepEqual(w.Tiers, [][]string{{"notes"}}) {
-		t.Fatalf("the settings walk: %+v %+v", w, w.Release)
-	}
-
-	// A machine's layer where the module does not run: set, and nothing to send.
-	q := settingsProposal{Module: "notes", Node: "anchor", Values: values, From: "g14/claude-code", At: now,
-		Digest: layerDigest(values), BeforeDigest: layerDigest(nil)}
-	words, err = set(ctx, q, "s10", "approved by the operator (ask s10)")
-	if err != nil || !strings.Contains(words, "no machine runs notes there, so there is nothing to send") {
-		t.Fatalf("a layer nobody runs: %q %v", words, err)
-	}
-	if plans, _ := open.inventory.OpenPlans(ctx); len(plans) != 1 {
-		t.Fatalf("a walk was opened for a machine that does not run the module: %d open", len(plans))
-	}
-
-	// A walk that cannot be opened is the act's failure, said with the push that sends it by hand.
-	was := openSettingsWalk
-	openSettingsWalk = func(context.Context, *stores, inventory.PlanSettings) (string, error) {
-		return "", fmt.Errorf("the plans are not to be had")
-	}
-	t.Cleanup(func() { openSettingsWalk = was })
-	again := map[string]any{"x": "2"}
-	byHand := map[string]any{"x": "0"}
-	r := settingsProposal{Module: "notes", Node: "laptop", Values: again, Before: byHand, HadLayer: true,
-		From: "g14/claude-code", At: now, Digest: layerDigest(again), BeforeDigest: layerDigest(byHand)}
-	if _, err := set(ctx, r, "s11", "approved"); err == nil || !strings.Contains(err.Error(), "is set, and the walk that "+
-		"sends it could not be opened: the plans are not to be had — `push laptop` sends it") {
-		t.Errorf("an unopened walk: %v", err)
-	}
-}
-
-// walkMesh is a mesh where `app` runs c1 on anchor and laptop and nothing waits for a gate: every send applied at
-// once, recorded, and judged from the reports, with a machine named broken failing what it was sent.
-type walkMesh struct {
-	open   *stores
-	sent   [][]string
-	broken map[string]bool
-	// kept says, per send, whether it kept every build of its machine; moves is the data a machine's send would move.
-	kept  []bool
-	moves map[string][]dataMove
-	heard map[string]bool
-}
-
-func aSettledMesh(t *testing.T) *walkMesh {
-	t.Helper()
-	open := aMesh(t)
-	ctx := t.Context()
-	inv := open.inventory
-	w := &walkMesh{open: open, broken: map[string]bool{}, moves: map[string][]dataMove{},
-		heard: map[string]bool{"anchor": true, "laptop": true}}
-	withConditionsInMemory(t)
-	was := doctorFrom
-	doctorFrom = nil
-	t.Cleanup(func() { doctorFrom = was })
-	old := time.Now().Add(-2 * time.Hour)
-	manifest, _ := json.Marshal(catalogue.Manifest{Module: "app", Version: "1"})
-	if err := inv.RecordBuild(ctx, inventory.Build{ID: "build-app-c1", Module: "app", Commit: "c1",
-		Repository: "novox/mesh-catalog", Path: "modules/app", Manifest: manifest, Asked: old, At: old,
-		Made: []inventory.Artifact{{Name: "x", Kind: "bundle", Reference: "sha256:app-1"}}}); err != nil {
-		t.Fatal(err)
-	}
-	if err := inv.RegisterModule(ctx, catalogue.Manifest{Module: "app", Version: "1"}, inventory.Source{
-		Repository: "novox/mesh-catalog", Seat: "git", Path: "modules/app", BuiltFrom: "c1", Head: "c1", Asked: old}); err != nil {
-		t.Fatal(err)
-	}
-	for _, n := range []string{"anchor", "laptop"} {
-		if _, err := inv.Assign(ctx, n, "app"); err != nil {
-			t.Fatal(err)
-		}
-		if err := inv.RecordSent(ctx, nodeID(t, open, n), "d-"+n, map[string]string{"app": "c1"}); err != nil {
-			t.Fatal(err)
-		}
-	}
-	wasMoves, wasHeard, wasSend, wasGather, wasData := machineMoves, releaseHeard, sendRollout, gatherGateFacts, settingsDataMoves
-	settingsDataMoves = func(_ context.Context, _ *stores, node string) ([]dataMove, error) { return w.moves[node], nil }
-	machineMoves = func(ctx context.Context, open *stores, f moveFacts, node string, all bool) ([]inventory.CarriedMove, error) {
-		modules, err := open.inventory.Assigned(ctx, node)
-		if err != nil {
-			return nil, err
-		}
-		sent, known, err := open.inventory.SentBuilds(ctx, node)
-		if err != nil {
-			return nil, err
-		}
-		return f.moves(node, modules, sent, known, all), nil
-	}
-	releaseHeard = func(context.Context, *stores) (map[string]bool, error) { return w.heard, nil }
-	n := 0
-	sendRollout = func(ctx context.Context, open *stores, names []string) ([]string, error) {
-		w.sent = append(w.sent, append([]string(nil), names...))
-		w.kept = append(w.kept, len(names) == 1 && settingsKeptOn(ctx, names[0]))
-		current, err := open.inventory.CurrentBuilds(ctx)
-		if err != nil {
-			return nil, err
-		}
-		for _, node := range names {
-			modules, _ := open.inventory.Assigned(ctx, node)
-			carried := map[string]string{}
-			for _, m := range modules {
-				carried[m] = current[m].Commit
-			}
-			n++
-			digest := fmt.Sprintf("d-%s-%d", node, n)
-			if err := open.inventory.RecordSent(ctx, nodeID(t, open, node), digest, carried); err != nil {
-				return nil, err
-			}
-			if _, err := open.inventory.RecordDoing(ctx, nodeID(t, open, node), inventory.Doing{Node: node,
-				Outcome: inventory.OutcomeApplied, Declared: digest, Applied: 1, At: time.Now()}); err != nil {
-				return nil, err
-			}
-		}
-		return names, nil
-	}
-	gatherGateFacts = func(ctx context.Context, open *stores, component string) (gateFacts, error) {
-		f := gateFacts{now: time.Now(), reports: map[string]inventory.Reported{}, engines: map[string]string{},
-			rolledBack: map[string][]lease.Rollback{}, served: map[string]served{}}
-		reports, err := open.inventory.LastReports(ctx)
-		if err != nil {
-			return f, err
-		}
-		for _, r := range reports {
-			if w.broken[r.Node] {
-				r.Outcome = inventory.OutcomeFailed
-			}
-			f.reports[r.Node] = r
-		}
-		return f, nil
-	}
-	wasSettle, wasEvery, wasBound := gateSettle, gateEvery, gateBound
-	gateSettle, gateEvery = 0, time.Hour
-	t.Cleanup(func() {
-		machineMoves, releaseHeard, sendRollout, gatherGateFacts = wasMoves, wasHeard, wasSend, wasGather
-		settingsDataMoves = wasData
-		gateSettle, gateEvery, gateBound = wasSettle, wasEvery, wasBound
-	})
-	return w
-}
-
-func (w *walkMesh) walk(t *testing.T) inventory.Plan {
-	t.Helper()
-	plans, err := w.open.inventory.RecentPlans(t.Context(), 10)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, p := range plans {
-		if p.Release != nil && p.Release.Settings != nil {
-			return p
-		}
-	}
-	t.Fatal("no settings walk")
-	return inventory.Plan{}
-}
-
-// The walk sends the first machine alone and judges the module there before it sends the next, and ends
-// delivered on both; nothing waited for a gate, so each send carried the layer alone.
-func TestASettingsWalkSendsOneMachineAtATimeEachJudged(t *testing.T) {
-	judgeLeavesAsTheCore(t)
-	w := aSettledMesh(t)
-	ctx := t.Context()
-	words, err := openSettingsWalk(ctx, w.open, inventory.PlanSettings{Module: "app", Ask: "s1", Change: "~ x"})
-	if err != nil || !strings.Contains(words, "sends it to anchor, laptop") {
-		t.Fatalf("%q %v", words, err)
-	}
-	advancePlans(ctx, w.open)
-	if !reflect.DeepEqual(w.sent, [][]string{{"anchor"}}) {
-		t.Fatalf("sent %v: the first machine alone, before it is judged", w.sent)
-	}
-	p := w.walk(t)
-	if p.Release.Gate == nil || p.Release.Next != 0 || !strings.Contains(p.Note, "judging app on anchor") {
-		t.Fatalf("the walk after its first send: %s %+v", p.Note, p.Release)
-	}
-	gateEvery = 0
-	for i := 0; i < 6; i++ {
-		advancePlans(ctx, w.open)
-	}
-	if !reflect.DeepEqual(w.sent, [][]string{{"anchor"}, {"laptop"}}) {
-		t.Fatalf("sent %v", w.sent)
-	}
-	p = w.walk(t)
-	if p.State != inventory.PlanDone || !reflect.DeepEqual(p.Release.Done, []string{"anchor", "laptop"}) ||
-		p.Outcome() != inventory.WalkDelivered || !strings.Contains(p.Note, "delivered on anchor, laptop") {
-		t.Fatalf("the walk is %s: %s %+v", p.State, p.Note, p.Release)
-	}
-	// It said its start and its end, so the operator is told once (ADR 0308).
-	if p.Times == nil || p.Times.Started == nil || p.Times.Ended == nil {
-		t.Fatalf("the walk's start and end are not marked: %+v", p.Times)
-	}
-	// Nothing waits, and no walk of waiting builds opened beside it.
-	if r, err := releaseBacklog(ctx, w.open, ""); err != nil || r != nil {
-		t.Fatalf("%+v %v", r, err)
-	}
-}
-
-// A machine that fails what it was sent stops the walk there: the next is not sent, the layer stays, and the
-// failure holds back no walk of waiting builds.
-func TestAFailedSettingsWalkStopsAndHoldsNothingBack(t *testing.T) {
-	w := aSettledMesh(t)
-	ctx := t.Context()
-	inv := w.open.inventory
-	w.broken["anchor"] = true
-	if err := inv.KeepSettings(ctx, "", "app", map[string]any{"x": "1"}); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := openSettingsWalk(ctx, w.open, inventory.PlanSettings{Module: "app", Ask: "s2"}); err != nil {
-		t.Fatal(err)
-	}
-	for i := 0; i < 4; i++ {
-		advancePlans(ctx, w.open)
-	}
-	p := w.walk(t)
-	if p.State != inventory.PlanFailed || p.Outcome() != inventory.WalkFailed ||
-		!strings.Contains(p.Note, "the settings of app on the whole mesh failed its gate on anchor") ||
-		!strings.Contains(p.Note, "the layer stays as the operator approved it") || !strings.Contains(p.Note, "not sent: laptop") {
-		t.Fatalf("the walk is %s: %s", p.State, p.Note)
-	}
-	if !reflect.DeepEqual(w.sent, [][]string{{"anchor"}}) {
-		t.Fatalf("sent %v: anchor alone, nothing to laptop", w.sent)
-	}
-	if layer, has, err := inv.Layer(ctx, "", "app"); err != nil || !has || layer["x"] != "1" {
-		t.Fatalf("the layer after the failure: %v %v %v", layer, has, err)
-	}
-	// A build that waits for a gate is still walked: the failed settings walk holds nothing back.
-	w.broken["anchor"] = false
-	now := time.Now().Add(-time.Minute)
-	manifest, _ := json.Marshal(catalogue.Manifest{Module: "app", Version: "1"})
-	if err := inv.RecordBuild(ctx, inventory.Build{ID: "build-app-c2", Module: "app", Commit: "c2",
-		Repository: "novox/mesh-catalog", Path: "modules/app", Manifest: manifest, Asked: now, At: now,
-		Made: []inventory.Artifact{{Name: "x", Kind: "bundle", Reference: "sha256:app-2"}}}); err != nil {
-		t.Fatal(err)
-	}
-	if err := inv.RegisterModule(ctx, catalogue.Manifest{Module: "app", Version: "1"}, inventory.Source{
-		Repository: "novox/mesh-catalog", Seat: "git", Path: "modules/app", BuiltFrom: "c2", Head: "c2", Asked: now}); err != nil {
-		t.Fatal(err)
-	}
-	if r, err := releaseBacklog(ctx, w.open, ""); err != nil || r == nil {
-		t.Fatalf("the waiting build is held back by a failed settings walk: %+v %v", r, err)
-	}
-}
-
-// Each send of a settings walk keeps every build of its machine: the layer goes, and a build held for a person or
-// waiting for a gate stays where it is (ADR 0344 §3).
-func TestASettingsWalkSendsTheLayerAloneEveryBuildKept(t *testing.T) {
-	w := aSettledMesh(t)
-	ctx := t.Context()
-	inv := w.open.inventory
-	gateEvery = 0
-	if _, err := openSettingsWalk(ctx, w.open, inventory.PlanSettings{Module: "app", Ask: "s3"}); err != nil {
-		t.Fatal(err)
-	}
-	for i := 0; i < 4; i++ {
-		advancePlans(ctx, w.open)
-	}
-	if !reflect.DeepEqual(w.kept, []bool{true, true}) || w.walk(t).State != inventory.PlanDone {
-		t.Fatalf("the sends kept every build: %v; the walk: %s", w.kept, w.walk(t).Note)
-	}
-	// What such a send keeps, on the store: a rolled-out build waiting there is kept at the one last sent.
-	now := time.Now().Add(-time.Minute)
-	manifest, _ := json.Marshal(catalogue.Manifest{Module: "app", Version: "1"})
-	if err := inv.RecordBuild(ctx, inventory.Build{ID: "build-app-c2", Module: "app", Commit: "c2",
-		Repository: "novox/mesh-catalog", Path: "modules/app", Manifest: manifest, Asked: now, At: now,
-		Made: []inventory.Artifact{{Name: "x", Kind: "bundle", Reference: "sha256:app-2"}}}); err != nil {
-		t.Fatal(err)
-	}
-	if err := inv.RegisterModule(ctx, catalogue.Manifest{Module: "app", Version: "1"}, inventory.Source{
-		Repository: "novox/mesh-catalog", Seat: "git", Path: "modules/app", BuiltFrom: "c2", Head: "c2", Asked: now}); err != nil {
-		t.Fatal(err)
-	}
-	kept, err := recordedKept(keepingBuildsForSettings(ctx, "anchor"), w.open, "anchor")
-	if err != nil || kept["app"] != "c1" {
-		t.Fatalf("a settings send to anchor keeps %v (%v), want app at c1", kept, err)
-	}
-	if kept, _ := recordedKept(ctx, w.open, "anchor"); kept["app"] != "" {
-		t.Fatalf("an ordinary send keeps a rolled-out build: %v", kept)
-	}
-	// And so the ungated build waiting on anchor is no move of the settings send's: nothing for a gate to see.
-	f, err := readMoveFacts(ctx, inv)
-	if err != nil {
-		t.Fatal(err)
-	}
-	waiting, _ := machineMoves(ctx, w.open, f, "anchor", false)
-	if len(waiting) != 1 || waiting[0].Module != "app" {
-		t.Fatalf("anchor waits for %+v, want app's c2", waiting)
-	}
-	if moved, err := withoutKept(keepingBuildsForSettings(ctx, "anchor"), w.open, "anchor", waiting); err != nil || len(moved) != 0 {
-		t.Fatalf("a settings send to anchor would move %+v (%v)", moved, err)
-	}
-}
-
-// A machine whose send would move a running module's data stops the walk there, failed and said with the push that
-// sends it on a person's word (ADR 0217 §3); one not heard from is passed over and named; and a walk that reached
-// no machine is not said delivered.
-func TestASettingsWalkStopsBeforeADataMoveAndPassesOverAMachineAway(t *testing.T) {
-	w := aSettledMesh(t)
-	ctx := t.Context()
-	gateEvery = 0
-	w.moves["laptop"] = []dataMove{{Container: "app-server", Inside: "/data", From: "/srv/a", To: "/srv/b"}}
-	if _, err := openSettingsWalk(ctx, w.open, inventory.PlanSettings{Module: "app", Ask: "s4"}); err != nil {
-		t.Fatal(err)
-	}
-	for i := 0; i < 4; i++ {
-		advancePlans(ctx, w.open)
-	}
-	p := w.walk(t)
-	if p.State != inventory.PlanFailed || !reflect.DeepEqual(w.sent, [][]string{{"anchor"}}) ||
-		!strings.Contains(p.Note, "not sent to laptop: a running module's data would move there") ||
-		!strings.Contains(p.Note, "push laptop --move app") {
-		t.Fatalf("sent %v; the walk is %s: %s", w.sent, p.State, p.Note)
-	}
-
-	v := aSettledMesh(t)
-	v.heard = map[string]bool{"laptop": true}
-	gateEvery = 0
-	if _, err := openSettingsWalk(ctx, v.open, inventory.PlanSettings{Module: "app", Ask: "s5"}); err != nil {
-		t.Fatal(err)
-	}
-	for i := 0; i < 4; i++ {
-		advancePlans(ctx, v.open)
-	}
-	p = v.walk(t)
-	if p.State != inventory.PlanDone || !reflect.DeepEqual(p.Release.Skipped, []string{"anchor"}) ||
-		!strings.Contains(p.Note, "delivered on laptop; not heard from, left as they were, their next send carries it: anchor") {
-		t.Fatalf("the walk with anchor away is %s: %s", p.State, p.Note)
-	}
-
-	u := aSettledMesh(t)
-	u.heard = map[string]bool{}
-	if _, err := openSettingsWalk(ctx, u.open, inventory.PlanSettings{Module: "app", Ask: "s6"}); err != nil {
-		t.Fatal(err)
-	}
-	advancePlans(ctx, u.open)
-	if p := u.walk(t); p.State != inventory.PlanFailed || p.Outcome() != inventory.WalkFailed ||
-		!strings.Contains(p.Note, "was sent to no machine") || len(u.sent) != 0 {
-		t.Fatalf("a walk that reached nobody is %s: %s", p.State, p.Note)
-	}
-}
-
-// The gate keeps the module's build its send kept, so a crossing send — a merge's walk sending the machine a new
-// build of the module while the settings gate judges there — supersedes it, and its report is never read as the
-// settings send's (issue 641 review, finding 1).
-func TestACrossingSendSupersedesASettingsGate(t *testing.T) {
-	judgeLeavesAsTheCore(t)
-	w := aSettledMesh(t)
-	ctx := t.Context()
-	inv := w.open.inventory
-	if _, err := openSettingsWalk(ctx, w.open, inventory.PlanSettings{Module: "app", Ask: "s7"}); err != nil {
-		t.Fatal(err)
-	}
-	advancePlans(ctx, w.open)
-	p := w.walk(t)
-	if g := p.Release.Gate; g == nil || g.To != "c1" || g.From != "c1" {
-		t.Fatalf("the settings gate judges no build: %+v", p.Release.Gate)
-	}
-	// Another walk sends anchor app's c2 while the settings gate judges there.
-	now := time.Now().Add(-time.Minute)
-	manifest, _ := json.Marshal(catalogue.Manifest{Module: "app", Version: "1"})
-	if err := inv.RecordBuild(ctx, inventory.Build{ID: "build-app-c2", Module: "app", Commit: "c2",
-		Repository: "novox/mesh-catalog", Path: "modules/app", Manifest: manifest, Asked: now, At: now,
-		Made: []inventory.Artifact{{Name: "x", Kind: "bundle", Reference: "sha256:app-2"}}}); err != nil {
-		t.Fatal(err)
-	}
-	if err := inv.RecordSent(ctx, nodeID(t, w.open, "anchor"), "d-merge", map[string]string{"app": "c2"}); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := inv.RecordDoing(ctx, nodeID(t, w.open, "anchor"), inventory.Doing{Node: "anchor",
-		Outcome: inventory.OutcomeApplied, Declared: "d-merge", Applied: 1, At: time.Now()}); err != nil {
-		t.Fatal(err)
-	}
-	gateEvery = 0
-	advancePlans(ctx, w.open)
-	p = w.walk(t)
-	if p.State != inventory.PlanSuperseded || p.Release.Gate == nil || p.Release.Gate.Verdict != inventory.GateSuperseded ||
-		!strings.Contains(p.Note, "superseded on anchor") || len(p.Release.Done) != 0 {
-		t.Fatalf("the settings walk after a crossing send is %s: %s %+v", p.State, p.Note, p.Release)
-	}
-	if !reflect.DeepEqual(w.sent, [][]string{{"anchor"}}) {
-		t.Fatalf("sent %v: laptop was sent after a superseded judging", w.sent)
-	}
-}
-
-// A send refusal that cannot clear by itself — what the machine was last sent is not known, or a build it runs is
-// gone — fails the walk with why, rather than keeping it open and holding the walk of waiting builds; and a
-// failure names the machines passed over as away (issue 641 review, findings 2 and 3).
-func TestASettingsWalkFailsOnARefusalThatCannotClear(t *testing.T) {
-	w := aSettledMesh(t)
-	ctx := t.Context()
-	inv := w.open.inventory
-	// What a send to a machine never sent can keep: nothing, and said as the refusal the walk fails on.
-	if _, err := inv.AddNode(ctx, "fresh"); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := recordedKept(keepingBuildsForSettings(ctx, "fresh"), w.open, "fresh"); !errors.Is(err, errSettingsCannotKeep) {
-		t.Fatalf("a settings send to a machine never sent: %v", err)
-	}
-	w.heard = map[string]bool{"laptop": true}
-	settingsDataMoves = func(_ context.Context, _ *stores, node string) ([]dataMove, error) {
-		return nil, fmt.Errorf("%w: what %s was last sent is not known", errSettingsCannotKeep, node)
-	}
-	if _, err := openSettingsWalk(ctx, w.open, inventory.PlanSettings{Module: "app", Ask: "s8"}); err != nil {
-		t.Fatal(err)
-	}
-	advancePlans(ctx, w.open)
-	p := w.walk(t)
-	if p.State != inventory.PlanFailed || len(w.sent) != 0 ||
-		!strings.Contains(p.Note, "not sent to laptop: the settings cannot be sent with every build kept: what laptop was last sent is not known") ||
-		!strings.Contains(p.Note, "not heard from, left as they were: anchor") {
-		t.Fatalf("the walk is %s: %s", p.State, p.Note)
-	}
-	// It is not open, so a build waiting for a gate is walked.
-	now := time.Now().Add(-time.Minute)
-	manifest, _ := json.Marshal(catalogue.Manifest{Module: "app", Version: "1"})
-	if err := inv.RecordBuild(ctx, inventory.Build{ID: "build-app-c2", Module: "app", Commit: "c2",
-		Repository: "novox/mesh-catalog", Path: "modules/app", Manifest: manifest, Asked: now, At: now,
-		Made: []inventory.Artifact{{Name: "x", Kind: "bundle", Reference: "sha256:app-2"}}}); err != nil {
-		t.Fatal(err)
-	}
-	if err := inv.RegisterModule(ctx, catalogue.Manifest{Module: "app", Version: "1"}, inventory.Source{
-		Repository: "novox/mesh-catalog", Seat: "git", Path: "modules/app", BuiltFrom: "c2", Head: "c2", Asked: now}); err != nil {
-		t.Fatal(err)
-	}
-	if r, err := releaseBacklog(ctx, w.open, ""); err != nil || r == nil {
-		t.Fatalf("the waiting build is held by the failed settings walk: %+v %v", r, err)
-	}
-}

cmd/mesh-controller/unseen_test.go

@@ -160,7 +160,7 @@ func TestTheVerbsCarryReadReplaceAndMove(t *testing.T) {
 		{"settings", map[string]any{"module": "plex", "history": "true"}, []string{"settings", "show", "plex", "--history"}},
 		{"settings", map[string]any{"module": "plex", "values": "{}", "replace": "true"}, []string{"settings", "set", "plex", "{}", "--replace"}},
 		{"push", map[string]any{"node": "home", "move": "plex", "why": "w"},
-			[]string{"push", "home", "--wait", "0s", "--move", "plex", "--why", "w"}},
+			[]string{"push", "home", "--wait", "0", "--move", "plex", "--why", "w"}},
 		{"push", map[string]any{"why": "w"}, []string{"push", "--behind", "--wait", "0", "--why", "w"}},
 		{"plan", map[string]any{"node": "home", "diff": "true"}, []string{"plan", "home", "--diff"}},
 	} {

internal/catalogue/adoption.go

@@ -87,11 +87,6 @@ func Openings(rules []Rule, foundation []int, published map[string]map[int]int)
 			widen(key{rule.Protocol, rule.Port}, OpeningFromEverywhere)
 		case FromMesh:
 			widen(key{rule.Protocol, rule.Port}, OpeningFromMesh)
-		case FromLocalNetwork:
-			// The private network's part only (novox/hq ADR 0340). An adopted node's found firewall
-			// stays, and it is what admits the machine's local network; an opening has no word for a
-			// local network, and widening it to everywhere would open the port to the internet.
-			widen(key{rule.Protocol, rule.Port}, OpeningFromMesh)
 		}
 	}
 	for _, port := range foundation {

internal/catalogue/consumer_secret_owner_test.go

@@ -0,0 +1,57 @@
+package catalogue
+
+import "testing"
+
+// A consumer's credential is read by the consumer's own code, and that stopped being root for every
+// module whose code is a bundle the node's runtime runs (novox/hq issue 624, the consumer's side of
+// issue 225). The lab requires the package registry and reads its bound credential to clone the forge;
+// the credential file was composed with no owner, so root's and 0600, and the lab — running as the
+// operator's account — cloned with no credential and was refused, "could not read Username".
+
+// aConsumerWithABundle is the lab's shape: tools in a bundle, a requirement, its credential in a file.
+func aConsumerWithABundle() Manifest {
+	return Manifest{
+		Module:   "lab",
+		Requires: []string{"npm-package-registry"},
+		Secrets:  map[string]string{"npm-package-registry": "/var/lib/lab/package-registry.secret"},
+		Bundles:  []Bundle{{Name: "code", Language: "typescript"}},
+	}
+}
+
+func consumerSecret(t *testing.T, m Manifest, account string) map[string]any {
+	t.Helper()
+	r := Resolution{Node: "shanks", Account: account, Modules: []Manifest{m},
+		Needs: []Needed{{Name: "npm-package-registry", For: m.Module, From: "novox", Sealed: "c2VhbGVk"}}}
+	out, err := r.Declaration(Rendering{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, res := range out {
+		if res["type"] == "file" && res["path"] == "/var/lib/lab/package-registry.secret" {
+			return res
+		}
+	}
+	t.Fatalf("no credential file was composed: %v", out)
+	return nil
+}
+
+func TestABundlesBoundCredentialBelongsToTheAccountItsRuntimeRunsAs(t *testing.T) {
+	if got := consumerSecret(t, aConsumerWithABundle(), "jochen")["owner"]; got != "jochen" {
+		t.Fatalf("the lab's credential belongs to %v; its tools run as %q, and a root-owned 0600 file is one "+
+			"they cannot read", got, "jochen")
+	}
+}
+
+// A module that names its secrets' owner keeps it, and one with no bundle and no owner stays root's.
+func TestAConsumersDeclaredSecretsOwnerStillWins(t *testing.T) {
+	m := aConsumerWithABundle()
+	m.SecretsOwner = "65534:65534"
+	if got := consumerSecret(t, m, "jochen")["owner"]; got != "65534:65534" {
+		t.Errorf("a declared owner was replaced by %v", got)
+	}
+	m = aConsumerWithABundle()
+	m.Bundles = nil
+	if got, has := consumerSecret(t, m, "jochen")["owner"]; has {
+		t.Errorf("a container consumer's credential was given the owner %v", got)
+	}
+}

internal/catalogue/declaration.go

@@ -135,12 +135,6 @@ type Rendering struct {
 	// composes no filter for it rather than writing a rule around a link with no name.
 	OutwardLinks []string
 
-	// LocalNetworks is this machine's local networks (novox/hq ADR 0340): the networks it reported on a
-	// link facing outside it that lie wholly in a private range (JudgeLocalNetworks), which a port
-	// reached from `local-network` is admitted from beside the private network. Empty when it reported
-	// none, and the rule set then says so rather than widening the port or dropping it.
-	LocalNetworks []string
-
 	// TunnelInterface is the interface the mesh's private network runs on, named here rather than
 	// imported because the overlay package rests on this one. Traffic arriving on it is the mesh's,
 	// not this machine's own guest, so the filter admits it only by a rule.
@@ -533,8 +527,8 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 				"`node show %s` says whether it has. Until then %s is not sent, and the machine "+
 				"keeps the filter it has", r.Node, r.Node, filters)
 	}
-	filtering := AsNftablesWithLocal(rules, with.Mesh, r.PublicDomain != "", with.Foundation,
-		with.OutwardLinks, with.TunnelInterface, with.LocalNetworks)
+	filtering := AsNftables(rules, with.Mesh, r.PublicDomain != "", with.Foundation,
+		with.OutwardLinks, with.TunnelInterface)
 
 	// **A variable two modules set is refused whether or not anything places it** (novox/hq ADR
 	// 0203 §5): the account has one environment, and a machine whose holder arrives later should not
@@ -736,7 +730,16 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 					// worse than none: something would read it and fail authenticating.
 					continue
 				}
-				first = append(first, ownedBy(m.SecretsOwner, map[string]any{
+				// **Read by the module's own code, so owned by whoever runs it** (novox/hq issue 624, the
+				// consumer's side of issue 225): a module whose code is a bundle the node's runtime runs reads
+				// its binding's credential as the operator's account, and a root-owned 0600 file is one it
+				// cannot read — the lab cloned the forge with no credential and said nothing about why. A
+				// module that names its secrets' owner keeps it.
+				owner := m.SecretsOwner
+				if owner == "" {
+					owner = r.provisionsAs(m)
+				}
+				first = append(first, ownedBy(owner, map[string]any{
 					"id": SecretID(SecretLocal(to, file.Local)), "type": "file", "path": file.Path,
 					"sealed": found.Sealed,
 				}))
@@ -2557,8 +2560,8 @@ func onlyGroups(r map[string]any) bool {
 
 // generatedHere is what each computed module's generator answers for this machine, by module —
 // absent for a module whose machine is not yet part of what it generates — held to the rule every
-// module is held to: no two modules on a machine declare one path, unit or name, nor one package present
-// and absent (novox/hq issue 190, step 5; ADR 0222, ADR 0303).
+// module is held to: no two modules on a machine declare one path, unit, name or package (novox/hq
+// issue 190, step 5; ADR 0222).
 //
 // Resolution checks the catalogue's manifests, and a computed module's manifest has none of the
 // resources it will declare — they exist only once its generator has answered for this machine,

internal/catalogue/filtering.go

@@ -152,10 +152,9 @@ func Exposure(m Manifest, layers []Layer) (map[int]string, error) {
 					m.Module, port)
 			}
 			source, ok := value.(string)
-			if !ok || (source != FromMesh && source != FromEverywhere && source != FromMachine &&
-				source != FromLocalNetwork) {
-				return nil, fmt.Errorf("%s exposes port %d as %v; it is %q, %q, %q or %q",
-					m.Module, port, value, FromMesh, FromEverywhere, FromMachine, FromLocalNetwork)
+			if !ok || (source != FromMesh && source != FromEverywhere && source != FromMachine) {
+				return nil, fmt.Errorf("%s exposes port %d as %v; it is %q, %q or %q",
+					m.Module, port, value, FromMesh, FromEverywhere, FromMachine)
 			}
 			out[port] = source
 		}
@@ -173,9 +172,7 @@ func Exposure(m Manifest, layers []Layer) (map[int]string, error) {
 // the appearance-of-restriction this mechanism exists to remove. The narrower rule's sources are
 // carried onto the wider one, so the module that wanted it is still named.
 func widest(rules []Rule) []Rule {
-	// The local network is the private network and the machine's own local networks (novox/hq ADR
-	// 0340 §4), so it covers `mesh` and is covered by `anywhere`.
-	reach := map[string]int{FromMachine: 0, FromMesh: 1, FromLocalNetwork: 2, FromEverywhere: 3}
+	reach := map[string]int{FromMachine: 0, FromMesh: 1, FromEverywhere: 2}
 	var out []Rule
 	for _, rule := range rules {
 		covered := false
@@ -235,15 +232,6 @@ const SSHPort = 22
 // any module asks for, and neither may be derived away.
 func AsNftables(rules []Rule, mesh []string, outward bool, foundation []int,
 	outwardLinks []string, tunnel string) string {
-	return AsNftablesWithLocal(rules, mesh, outward, foundation, outwardLinks, tunnel, nil)
-}
-
-// AsNftablesWithLocal is AsNftables with the machine's local networks: the networks it reported on a
-// link facing outside that count (novox/hq ADR 0340, JudgeLocalNetworks), which a rule from
-// `local-network` admits on its own port alone, beside the private network. None is not widened to
-// anywhere and not dropped silently: the rule set says the port wanted the local network and found none.
-func AsNftablesWithLocal(rules []Rule, mesh []string, outward bool, foundation []int,
-	outwardLinks []string, tunnel string, local []string) string {
 	// The links that are not this machine's own: the ones facing outside, and the mesh's tunnel.
 	// Traffic arriving on any of them is admitted only by a rule below; traffic arriving anywhere
 	// else is this machine's own guest and is not something the mesh has a position on.
@@ -406,31 +394,6 @@ func AsNftablesWithLocal(rules []Rule, mesh []string, outward bool, foundation [
 				b.WriteString(fmt.Sprintf("\t\tip6 saddr { %s } %s dport %d accept\n",
 					strings.Join(six, ", "), rule.Protocol, rule.Port))
 			}
-		case FromLocalNetwork:
-			// The private network and the machine's own local networks, on this port alone (novox/hq
-			// ADR 0340 §5).
-			four, six := byFamily(mesh)
-			lfour, lsix := byFamily(local)
-			four, six = append(four, lfour...), append(six, lsix...)
-			if len(lfour) == 0 && len(lsix) == 0 {
-				b.WriteString(fmt.Sprintf(
-					"\t\t# %s/%d wanted the local network, and this machine reported no private network "+
-						"on a link facing outside; admitted from no local network\n", rule.Protocol, rule.Port))
-			}
-			if len(four) == 0 && len(six) == 0 {
-				b.WriteString(fmt.Sprintf(
-					"\t\t# %s/%d wanted the local network, and this node knows neither mesh addresses nor a "+
-						"local network; closed\n", rule.Protocol, rule.Port))
-				break
-			}
-			if len(four) > 0 {
-				b.WriteString(fmt.Sprintf("\t\tip saddr { %s } %s dport %d accept\n",
-					strings.Join(four, ", "), rule.Protocol, rule.Port))
-			}
-			if len(six) > 0 {
-				b.WriteString(fmt.Sprintf("\t\tip6 saddr { %s } %s dport %d accept\n",
-					strings.Join(six, ", "), rule.Protocol, rule.Port))
-			}
 		case FromEverywhere:
 			b.WriteString(fmt.Sprintf("\t\t%s dport %d accept\n", rule.Protocol, rule.Port))
 		}
@@ -524,18 +487,6 @@ func AsNftablesWithLocal(rules []Rule, mesh []string, outward bool, foundation [
 				b.WriteString(fmt.Sprintf("\t\tip6 saddr { %s } ct original proto-dst %d accept\n",
 					strings.Join(six, ", "), rule.Port))
 			}
-		case FromLocalNetwork:
-			four, six := byFamily(mesh)
-			lfour, lsix := byFamily(local)
-			four, six = append(four, lfour...), append(six, lsix...)
-			if len(four) > 0 {
-				b.WriteString(fmt.Sprintf("\t\tip saddr { %s } ct original proto-dst %d accept\n",
-					strings.Join(four, ", "), rule.Port))
-			}
-			if len(six) > 0 {
-				b.WriteString(fmt.Sprintf("\t\tip6 saddr { %s } ct original proto-dst %d accept\n",
-					strings.Join(six, ", "), rule.Port))
-			}
 		case FromEverywhere:
 			b.WriteString(fmt.Sprintf("\t\tct original proto-dst %d accept\n", rule.Port))
 		}
@@ -842,14 +793,10 @@ const (
 	// are a subset of anywhere. What differs is the names, which is the whole reason reach is not
 	// simply the filter's vocabulary with nicer words.
 	ReachBoth = "both"
-	// ReachLocalNetwork is `internal` with the machine's own local networks added to what the filter
-	// opens (novox/hq ADR 0340 §4): the internal name and not the public one, the mesh's own authority,
-	// and the port opened to the private network and to the private networks the machine is attached to.
-	ReachLocalNetwork = "local-network"
 )
 
 // reaches is every value, in the order a refusal lists them.
-var reaches = []string{ReachMachine, ReachInternal, ReachPublic, ReachBoth, ReachLocalNetwork}
+var reaches = []string{ReachMachine, ReachInternal, ReachPublic, ReachBoth}
 
 // RoutedPorts are the ports a module serves through a proxy, taken from its route contributions.
 //
@@ -898,8 +845,6 @@ func FilterSource(reach string) (string, bool) {
 		return FromMesh, true
 	case ReachPublic, ReachBoth:
 		return FromEverywhere, true
-	case ReachLocalNetwork:
-		return FromLocalNetwork, true
 	default:
 		return "", false
 	}
@@ -909,9 +854,7 @@ func FilterSource(reach string) (string, bool) {
 func WantsPublicName(reach string) bool { return reach == ReachPublic || reach == ReachBoth }
 
 // WantsInternalName is whether a reach asks for the route's internal name to be composed.
-func WantsInternalName(reach string) bool {
-	return reach == ReachInternal || reach == ReachBoth || reach == ReachLocalNetwork
-}
+func WantsInternalName(reach string) bool { return reach == ReachInternal || reach == ReachBoth }
 
 // Reaches reads a module's per-node reach settings: declared port → how far it reaches.
 //

internal/catalogue/generated_collision_test.go

@@ -6,8 +6,7 @@ import (
 )
 
 // novox/hq issue 190, step 5 (ADR 0222): what the mesh computes for a module is held to the rule
-// every module is — no two modules on a machine declare one path, unit or name (a package may be declared by
-// several, novox/hq ADR 0303). The
+// every module is — no two modules on a machine declare one path, unit, name or package. The
 // private network once declared the container runtime's file and service beside the runtime's own
 // module, and nothing refused it, because the collision check only ever saw catalogue manifests.
 

internal/catalogue/localnetwork.go

@@ -1,154 +0,0 @@
-package catalogue
-
-import (
-	"fmt"
-	"net/netip"
-	"slices"
-	"sort"
-	"strings"
-)
-
-// AttachedNetwork is one network a machine said it is directly attached to: the link it is on and the
-// network as address and prefix (novox/hq ADR 0340 §7), as the node-engine reports it among its facts.
-type AttachedNetwork struct {
-	Link    string `json:"link"`
-	Network string `json:"network"`
-}
-
-// LocalNetwork is one attached network judged: whether it counts as this machine's local network for a
-// port reached from `local-network`, and why — said for one that counts as well as for one that does
-// not, so `node` can show which counted and why the others did not (ADR 0340 §8).
-type LocalNetwork struct {
-	Link    string
-	Network string
-	Counts  bool
-	Why     string
-}
-
-// privateRanges are the only ranges a local network may lie in (ADR 0340 §2): RFC 1918 for IPv4 and the
-// unique local addresses for IPv6. A network counts only when it lies wholly inside one of them.
-var privateRanges = []struct {
-	prefix netip.Prefix
-	name   string
-}{
-	{netip.MustParsePrefix("10.0.0.0/8"), "a private range (RFC 1918, 10.0.0.0/8)"},
-	{netip.MustParsePrefix("172.16.0.0/12"), "a private range (RFC 1918, 172.16.0.0/12)"},
-	{netip.MustParsePrefix("192.168.0.0/16"), "a private range (RFC 1918, 192.168.0.0/16)"},
-	{netip.MustParsePrefix("fc00::/7"), "the IPv6 unique local range (fc00::/7)"},
-}
-
-// JudgeLocalNetworks says, for each network a machine reported, whether it counts as its local network.
-//
-// **A public subnet never counts** (ADR 0340 §2): a network counts only when it lies wholly in a private
-// range, so `local-network` can never open a port to the internet — a machine sitting on a public /24 has
-// that /24 judged and refused, never rendered. A link-local network does not count either. And only a
-// link the machine reported as facing outside it counts (§3): the private network's own link and a
-// container bridge are this machine's own, not its local network, whatever their addresses.
-//
-// Sorted by link and then network, one entry per (link, network), so what `node` shows and what the
-// filter is rendered from do not depend on the order a machine happened to say them in.
-func JudgeLocalNetworks(attached []AttachedNetwork, outward []string, tunnel string) []LocalNetwork {
-	seen := map[[2]string]bool{}
-	var out []LocalNetwork
-	for _, a := range attached {
-		key := [2]string{a.Link, a.Network}
-		if seen[key] {
-			continue
-		}
-		seen[key] = true
-		out = append(out, judgeOne(a, outward, tunnel))
-	}
-	sort.Slice(out, func(i, j int) bool {
-		if out[i].Link != out[j].Link {
-			return out[i].Link < out[j].Link
-		}
-		return out[i].Network < out[j].Network
-	})
-	return out
-}
-
-func judgeOne(a AttachedNetwork, outward []string, tunnel string) LocalNetwork {
-	j := LocalNetwork{Link: a.Link, Network: a.Network}
-	prefix, err := netip.ParsePrefix(strings.TrimSpace(a.Network))
-	if err != nil {
-		j.Why = "not a network the mesh can read (" + err.Error() + ")"
-		return j
-	}
-	prefix = prefix.Masked()
-	j.Network = prefix.String()
-	switch {
-	case tunnel != "" && a.Link == tunnel:
-		j.Why = "the private network's own link, not the local network"
-		return j
-	case !slices.Contains(outward, a.Link):
-		j.Why = fmt.Sprintf("%s does not face outside this machine (a bridge or a link of its own)", a.Link)
-		return j
-	case prefix.Addr().IsLoopback():
-		j.Why = "loopback"
-		return j
-	case prefix.Addr().IsLinkLocalUnicast():
-		j.Why = "link-local, never counted"
-		return j
-	}
-	for _, r := range privateRanges {
-		if r.prefix.Contains(prefix.Addr()) && prefix.Bits() >= r.prefix.Bits() {
-			j.Counts = true
-			j.Why = "in " + r.name
-			return j
-		}
-	}
-	if prefix.Addr().IsPrivate() {
-		// Overlaps a private range without lying wholly inside it (a /7 around 10.0.0.0/8, say).
-		j.Why = "not wholly in a private range, so never counted"
-		return j
-	}
-	j.Why = "public, never counted: local-network may not open a port to the internet"
-	return j
-}
-
-// CountedLocalNetworks is the networks that count, as the filter renders them: sorted, without repeats.
-func CountedLocalNetworks(judged []LocalNetwork) []string {
-	var out []string
-	for _, j := range judged {
-		if j.Counts && !slices.Contains(out, j.Network) {
-			out = append(out, j.Network)
-		}
-	}
-	sort.Strings(out)
-	return out
-}
-
-// LocalNetworkPort is one port the filter admits from `local-network`, and what that resolved to on this
-// machine (ADR 0340 §8): what `plan` shows for it.
-type LocalNetworkPort struct {
-	Port     int
-	Protocol string
-	Because  []string
-	// Networks is the local networks it is admitted from; empty when the machine reported none (§6).
-	Networks []string
-}
-
-// LocalNetworkPorts is every rule admitted from `local-network`, with the networks it resolved to.
-func LocalNetworkPorts(rules []Rule, networks []string) []LocalNetworkPort {
-	var out []LocalNetworkPort
-	for _, rule := range rules {
-		if rule.From != FromLocalNetwork {
-			continue
-		}
-		out = append(out, LocalNetworkPort{Port: rule.Port, Protocol: rule.Protocol,
-			Because: rule.Because, Networks: networks})
-	}
-	return out
-}
-
-// Said is how `plan` says one such port: the networks, or that there are none and the port is admitted
-// from the private network only.
-func (p LocalNetworkPort) Said() string {
-	by := strings.Join(p.Because, ", ")
-	if len(p.Networks) == 0 {
-		return fmt.Sprintf("%s/%d (%s) from the local network: none — this machine reported no private "+
-			"network on a link facing outside, so it is admitted from the private network only", p.Protocol, p.Port, by)
-	}
-	return fmt.Sprintf("%s/%d (%s) from the local network: %s, and the private network", p.Protocol, p.Port, by,
-		strings.Join(p.Networks, ", "))
-}

internal/catalogue/localnetwork_test.go

@@ -1,195 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// The home server's case (novox/hq issue 154): it sits on 192.168.1.0/24, and also on a public /24 a
-// provider handed it, beside the private network's own link and a container bridge.
-var homeServer = []AttachedNetwork{
-	{Link: "eth0", Network: "192.168.1.10/24"},
-	{Link: "eth1", Network: "203.0.113.7/24"},
-	{Link: "eth0", Network: "fe80::1/64"},
-	{Link: "eth0", Network: "fd12:3456:789a::5/64"},
-	{Link: "wg-mesh", Network: "10.10.0.4/24"},
-	{Link: "docker0", Network: "172.17.0.1/16"},
-}
-
-func judged(t *testing.T) []LocalNetwork {
-	t.Helper()
-	return JudgeLocalNetworks(homeServer, []string{"eth0", "eth1"}, "wg-mesh")
-}
-
-// **A public subnet never counts** (ADR 0340 §2), and only a private one on a link facing outside does
-// (§3): the tunnel's and a bridge's are this machine's own, whatever their addresses.
-func TestOnlyAPrivateNetworkOnALinkFacingOutsideCounts(t *testing.T) {
-	got := CountedLocalNetworks(judged(t))
-	want := []string{"192.168.1.0/24", "fd12:3456:789a::/64"}
-	if strings.Join(got, " ") != strings.Join(want, " ") {
-		t.Fatalf("counted %v, want %v", got, want)
-	}
-	for _, j := range judged(t) {
-		if j.Why == "" {
-			t.Errorf("%s on %s is judged without a why", j.Network, j.Link)
-		}
-		switch j.Network {
-		case "203.0.113.0/24":
-			if j.Counts || !strings.Contains(j.Why, "public") {
-				t.Errorf("the public subnet is judged %v (%s), want never counted as public", j.Counts, j.Why)
-			}
-		case "fe80::/64":
-			if j.Counts || !strings.Contains(j.Why, "link-local") {
-				t.Errorf("a link-local network is judged %v (%s)", j.Counts, j.Why)
-			}
-		case "10.10.0.0/24", "172.17.0.0/16":
-			if j.Counts {
-				t.Errorf("%s on %s counts, and it is not the local network", j.Network, j.Link)
-			}
-		}
-	}
-}
-
-// A network overlapping a private range without lying wholly inside it does not count either, so a
-// wide prefix around a private range cannot carry the internet with it.
-func TestANetworkNotWhollyInAPrivateRangeDoesNotCount(t *testing.T) {
-	for _, n := range []string{"10.0.0.0/7", "172.0.0.0/8", "100.64.0.0/10", "0.0.0.0/0", "::/0"} {
-		got := JudgeLocalNetworks([]AttachedNetwork{{Link: "eth0", Network: n}}, []string{"eth0"}, "")
-		if len(got) != 1 || got[0].Counts {
-			t.Errorf("%s counts as a local network: %+v", n, got)
-		}
-	}
-}
-
-// **The filter admits the local network on that port's rule alone** (§5), beside the private network,
-// in both chains, and never the public subnet.
-func TestALocalNetworkPortIsAdmittedFromItsNetworksAndTheMesh(t *testing.T) {
-	rules := []Rule{
-		{Port: 1883, Protocol: "tcp", From: FromLocalNetwork, Because: []string{"mosquitto"}},
-		{Port: 5432, Protocol: "tcp", From: FromMesh, Because: []string{"postgres"}},
-	}
-	local := CountedLocalNetworks(judged(t))
-	out := AsNftablesWithLocal(rules, []string{"10.10.0.1", "10.10.0.4"}, false, nil,
-		[]string{"eth0", "eth1"}, "wg-mesh", local)
-
-	for _, want := range []string{
-		"ip saddr { 10.10.0.1, 10.10.0.4, 192.168.1.0/24 } tcp dport 1883 accept",
-		"ip6 saddr { fd12:3456:789a::/64 } tcp dport 1883 accept",
-		"ip saddr { 10.10.0.1, 10.10.0.4, 192.168.1.0/24 } ct original proto-dst 1883 accept",
-		// The mesh-only port is not widened by the machine having a local network.
-		"ip saddr { 10.10.0.1, 10.10.0.4 } tcp dport 5432 accept",
-	} {
-		if !strings.Contains(out, want) {
-			t.Errorf("the rule set lacks %q:\n%s", want, out)
-		}
-	}
-	if strings.Contains(out, "203.0.113") {
-		t.Errorf("the public subnet reached the rule set:\n%s", out)
-	}
-	if strings.Contains(out, "tcp dport 1883 accept\n") && !strings.Contains(out, "saddr") {
-		t.Errorf("1883 is open to anywhere:\n%s", out)
-	}
-	for _, line := range strings.Split(out, "\n") {
-		if strings.TrimSpace(line) == "tcp dport 1883 accept" {
-			t.Fatalf("1883 is open to anywhere:\n%s", out)
-		}
-	}
-}
-
-// **Nothing resolved is closed and said** (§6): a machine that reported no private network admits the
-// port from the private network only, and the rule set says it found none — never widened to anywhere.
-func TestNoLocalNetworkIsSaidAndNotWidened(t *testing.T) {
-	rules := []Rule{{Port: 1883, Protocol: "tcp", From: FromLocalNetwork, Because: []string{"mosquitto"}}}
-	out := AsNftablesWithLocal(rules, []string{"10.10.0.1"}, false, nil, []string{"eth0"}, "wg-mesh", nil)
-	if !strings.Contains(out, "1883 wanted the local network, and this machine reported no private network") {
-		t.Errorf("the rule set does not say the local network resolved to nothing:\n%s", out)
-	}
-	if !strings.Contains(out, "ip saddr { 10.10.0.1 } tcp dport 1883 accept") {
-		t.Errorf("the port is not admitted from the private network:\n%s", out)
-	}
-	for _, line := range strings.Split(out, "\n") {
-		if strings.TrimSpace(line) == "tcp dport 1883 accept" {
-			t.Fatalf("an unresolved local network was widened to anywhere:\n%s", out)
-		}
-	}
-	said := LocalNetworkPorts(rules, nil)[0].Said()
-	if !strings.Contains(said, "none") {
-		t.Errorf("plan says %q, want it to say no local network was found", said)
-	}
-}
-
-// `local-network` is a source a manifest may name (§1, changing ADR 0045 §3), and an unknown source is
-// still refused.
-func TestAManifestMayListenFromTheLocalNetwork(t *testing.T) {
-	if _, err := ParseManifest([]byte(`{"module":"mosquitto","version":"1",
-		"listens":[{"port":1883,"from":"local-network"}]}`)); err != nil {
-		t.Fatalf("a listen from the local network is refused: %v", err)
-	}
-	_, err := ParseManifest([]byte(`{"module":"mosquitto","version":"1",
-		"listens":[{"port":1883,"from":"lan"}]}`))
-	if err == nil || !strings.Contains(err.Error(), `from "lan"`) {
-		t.Fatalf("a source the mesh cannot render is not refused: %v", err)
-	}
-}
-
-// **A fourth reach** (§4, changing ADR 0138 §4): `internal` with the local networks added to what the
-// filter opens — the internal name, not the public one.
-func TestTheLocalNetworkReachIsInternalWithTheLocalNetworkAdded(t *testing.T) {
-	public, internal := namesFor(t, aRoutedWeb(), reachSet(ReachLocalNetwork))
-	if public != "" || internal != "app.anchor.internal" {
-		t.Fatalf("names are %q and %q, want the internal name only", public, internal)
-	}
-	bare := aRoutedWeb()
-	bare.Contributes = nil
-	r := Resolution{Node: "anchor", Modules: []Manifest{bare}}
-	rules, err := r.Rules(Rendering{Settings: reachSet(ReachLocalNetwork)})
-	if err != nil {
-		t.Fatalf("rules: %v", err)
-	}
-	if len(rules) != 1 || rules[0].From != FromLocalNetwork {
-		t.Fatalf("reach local-network made the filter say %+v", rules)
-	}
-}
-
-// Two modules wanting one port, one from the mesh and one from the local network, render one rule from
-// the local network: it covers the mesh, and anywhere covers it.
-func TestTheLocalNetworkSitsBetweenTheMeshAndAnywhere(t *testing.T) {
-	got := widest([]Rule{
-		{Port: 53, Protocol: "udp", From: FromMesh, Because: []string{"a"}},
-		{Port: 53, Protocol: "udp", From: FromLocalNetwork, Because: []string{"b"}},
-	})
-	if len(got) != 1 || got[0].From != FromLocalNetwork || len(got[0].Because) != 2 {
-		t.Fatalf("got %+v", got)
-	}
-	got = widest(append(got, Rule{Port: 53, Protocol: "udp", From: FromEverywhere, Because: []string{"c"}}))
-	if len(got) != 1 || got[0].From != FromEverywhere {
-		t.Fatalf("got %+v", got)
-	}
-}
-
-// On an adopted node the opening is the private network's part only: the found firewall admits the
-// local network, and an opening that widened to everywhere would open the port to the internet.
-func TestAnAdoptedNodeOpensTheLocalNetworkPortToTheMeshOnly(t *testing.T) {
-	out := Openings([]Rule{{Port: 1883, Protocol: "tcp", From: FromLocalNetwork}}, nil, nil)
-	if len(out) != 1 || out[0]["from"] != OpeningFromMesh {
-		t.Fatalf("openings %v", out)
-	}
-}
-
-// A global unicast IPv6 subnet on a link facing outside is public, and never counts: the IPv6 side of the
-// rule that `local-network` cannot open a port to the internet (ADR 0340 §2).
-func TestAGlobalIPv6SubnetIsPublicAndNeverCounts(t *testing.T) {
-	got := JudgeLocalNetworks([]AttachedNetwork{{Link: "eth0", Network: "2001:db8:1234::7/48"}}, []string{"eth0"}, "wg-mesh")
-	if len(got) != 1 {
-		t.Fatalf("judged %+v", got)
-	}
-	if got[0].Counts {
-		t.Fatalf("the global IPv6 subnet %s counts as a local network", got[0].Network)
-	}
-	if got[0].Network != "2001:db8:1234::/48" || !strings.Contains(got[0].Why, "public, never counted") {
-		t.Fatalf("judged %s with why %q, want it named public and never counted", got[0].Network, got[0].Why)
-	}
-	if n := CountedLocalNetworks(got); len(n) != 0 {
-		t.Fatalf("counted %v", n)
-	}
-}

internal/catalogue/manifest.go

@@ -1165,12 +1165,6 @@ const (
 	FromEverywhere = "anywhere"
 	// FromMachine is this machine only — a port bound for something else on the same host.
 	FromMachine = "machine"
-	// FromLocalNetwork is the private network and the networks this machine is directly attached to
-	// through its uplink, as it reports them, and only those wholly in a private range (novox/hq ADR
-	// 0340): a local service reached by devices that will never be nodes, said as exactly that rather
-	// than as `anywhere`. A public subnet the machine sits on never counts, so it cannot open a port to
-	// the internet.
-	FromLocalNetwork = "local-network"
 )
 
 // At is this port's protocol, with the default applied.
@@ -1935,17 +1929,17 @@ func ParseManifest(raw []byte) (Manifest, error) {
 				"%s listens on port %d, which is not a port", m.Module, l.Port))
 		}
 		switch l.From {
-		case FromMesh, FromEverywhere, FromMachine, FromLocalNetwork:
+		case FromMesh, FromEverywhere, FromMachine:
 		case "":
 			// The fault this field exists to prevent. A rule with no source is open, and a
 			// manifest that omitted it would read as a restriction and be none.
 			problems = append(problems, fmt.Sprintf(
-				"%s listens on %d and does not say from where; it is %q, %q, %q or %q",
-				m.Module, l.Port, FromMesh, FromEverywhere, FromMachine, FromLocalNetwork))
+				"%s listens on %d and does not say from where; it is %q, %q or %q",
+				m.Module, l.Port, FromMesh, FromEverywhere, FromMachine))
 		default:
 			problems = append(problems, fmt.Sprintf(
-				"%s listens on %d from %q; it is %q, %q, %q or %q",
-				m.Module, l.Port, l.From, FromMesh, FromEverywhere, FromMachine, FromLocalNetwork))
+				"%s listens on %d from %q; it is %q, %q or %q",
+				m.Module, l.Port, l.From, FromMesh, FromEverywhere, FromMachine))
 		}
 		if p := l.At(); p != "tcp" && p != "udp" {
 			problems = append(problems, fmt.Sprintf(

internal/catalogue/seat_dependencies.go

@@ -331,13 +331,12 @@ func UnassignRefusal(catalogue map[string]Manifest, node string, assigned, remov
 }
 
 // CollisionRefusal is why assigning `adding` beside `assigned` is refused for what two modules
-// would both declare, or nothing (novox/hq ADR 0210 §1, 04-ISSUES/235): one path, unit or name, or a package one
-// declares present and another absent. A package several modules declare present is no collision (ADR 0303).
+// would both declare, or nothing (novox/hq ADR 0210 §1, 04-ISSUES/235).
 //
 // **Refused, not kept like an unresolved provision.** An assignment is otherwise kept when the
 // node does not resolve, because assignment is not an ordering: a consumer's provider can follow.
 // A collision is not an order anything can complete — no further assignment makes two owners of one
-// file one owner — and kept, it leaves the node unresolvable, so the next push of anything drops
+// package one owner — and kept, it leaves the node unresolvable, so the next push of anything drops
 // it from the mesh. Only collisions involving a module being added are refused; one already on the
 // node is `status`'s, and refusing an unrelated assignment for it would block its own remedy.
 func CollisionRefusal(catalogue map[string]Manifest, node string, assigned, adding []string) error {

internal/catalogue/verbs.go

@@ -217,16 +217,14 @@ var ControllerVerbs = []Verb{
 		Input: schema(map[string]string{"node": "the machine's name", "provision": "the provision"}, []string{"node", "provision"})},
 	{Name: "push", Description: "Send one machine everything it should be. With no machine named it is a push of the " +
 		"WHOLE mesh — every machine that is behind — and the answer says so first; behind says that outright. " +
-		"Answers at once that it is running, with a call id: `calls` with that id says what it sent and, for a " +
-		"machine named, how that machine applied it — applied, refused with its reason, or each failed resource — " +
-		"once it reports within wait (a push can reload the bus, which then refuses any answer still to come). A push by hand is a repair, " +
+		"Answers at once that it is running, with a call id: `calls` with that id says what it sent " +
+		"(a push can reload the bus, which then refuses any answer still to come). A push by hand is a repair, " +
 		"and says why: recorded in the hand-act log (novox/hq to-be 45 §7). A machine whose push would give a " +
 		"running module's data another directory is held and named, the others sent (novox/hq ADR 0217): read " +
 		"`plan` with diff, and name the machine with move to send it.",
 		Input: schema(map[string]string{
 			"node":   "the machine's name; without it, every machine that is behind",
 			"move":   "with node: the modules whose data may move with this push, comma-separated (optional)",
-			"wait":   "with node: how long the call waits for the machine to report how it applied what it was sent, as \"90s\" or \"2m\"; \"0\" waits for nothing; without it, the controller's setting push-wait (optional)",
 			"behind": "\"true\": every machine that is behind, the whole mesh — the same as naming none, said outright; not with node",
 			"why":    "why this is pushed by hand: recorded in the hand-act log",
 			"cause":  "the cause in a word, or a condition's kind — the word a second push for the same reason uses (optional)",

internal/inventory/machine.go

@@ -36,16 +36,7 @@ type MadeOf struct {
 	BootedAt      *time.Time          `json:"booted_at"`
 	Timezone      string              `json:"timezone"`
 	Filesystems   []MountedFilesystem `json:"filesystems"`
-	// Networks is every network the machine is directly attached to on a link facing outside it, as
-	// link and network (novox/hq ADR 0340 §7): what a port reached from `local-network` resolves from.
-	Networks []AttachedNetwork `json:"networks"`
-	Unknown  map[string]string `json:"unknown"`
-}
-
-// AttachedNetwork is one network a machine said it is attached to, and the link it is on.
-type AttachedNetwork struct {
-	Link    string `json:"link"`
-	Network string `json:"network"`
+	Unknown       map[string]string   `json:"unknown"`
 }
 
 // MountedFilesystem is one local filesystem a machine has mounted.

internal/inventory/machine_test.go

@@ -40,18 +40,3 @@ func TestAProfileWithoutTheFactsIsAnOlderNodeEngineNotNothing(t *testing.T) {
 		t.Error("a node that never reported read as having reported")
 	}
 }
-
-// The networks a machine is attached to (novox/hq ADR 0340 §7), in the node-engine's words: what a port
-// reached from `local-network` resolves from.
-func TestAMachinesAttachedNetworksAreRead(t *testing.T) {
-	a, had, err := machineFrom([]byte(`{"architecture":"amd64","kernel":"linux",
-		"machine":{"observed_at":"2026-10-13T09:00:00Z",
-		"networks":[{"link":"eth0","network":"192.168.1.0/24"},{"link":"eth1","network":"203.0.113.0/24"}]}}`))
-	if err != nil || !had || a.Machine == nil {
-		t.Fatalf("%+v had %v err %v", a, had, err)
-	}
-	n := a.Machine.Networks
-	if len(n) != 2 || n[0].Link != "eth0" || n[0].Network != "192.168.1.0/24" || n[1].Network != "203.0.113.0/24" {
-		t.Fatalf("networks read as %+v", n)
-	}
-}

internal/inventory/plans.go

@@ -433,20 +433,6 @@ type PlanRelease struct {
 	Skipped []string `json:"skipped,omitempty"`
 	// By is the person who released it, empty when the mesh did.
 	By string `json:"by,omitempty"`
-	// Settings is set on a settings walk (novox/hq ADR 0344): not the builds waiting for a gate, but a settings
-	// layer the operator approved, sent to the machines it reaches one at a time, its module judged on each.
-	Settings *PlanSettings `json:"settings,omitempty"`
-}
-
-// PlanSettings is what a settings walk sends (novox/hq ADR 0344): the module whose layer the operator approved, the
-// layer's scope, the ask that approved it and what changed, in words.
-type PlanSettings struct {
-	Module string `json:"module"`
-	// Node is the machine the layer is for, empty for the whole mesh.
-	Node string `json:"node,omitempty"`
-	// Ask is the proposal the operator approved, and Change what its layer changed ("~ prefs").
-	Ask    string `json:"ask"`
-	Change string `json:"change,omitempty"`
 }
 
 // The states a plan passes through.

module.json

@@ -35,11 +35,6 @@
       "kind": "preference",
       "default": "10m",
       "why": "a busy period never holds a batch longer than this after its first merge (novox/hq ADR 0276)"
-    },
-    "push-wait": {
-      "kind": "preference",
-      "default": "2m",
-      "why": "how long a push to a named machine waits for that machine's answer, so its call says how it went; a call's own wait overrides it, and 0 waits for nothing (novox/hq issue 629)"
     }
   },
   "tools": [
@@ -125,15 +120,6 @@
       "owner": "mesh-controller",
       "content": "{\n  \"merge-window\": \"${setting:merge-window}\",\n  \"merge-window-at-most\": \"${setting:merge-window-at-most}\"\n}\n"
     },
-    {
-      "id": "push",
-      "trusted": false,
-      "type": "file",
-      "path": "${dir:mesh-state}/push.json",
-      "mode": "0600",
-      "owner": "mesh-controller",
-      "content": "{\n  \"push-wait\": \"${setting:push-wait}\"\n}\n"
-    },
     {
       "id": "controller",
       "type": "process",
@@ -158,8 +144,7 @@
         "MESH_BROKER_ADDRESS_PORT": "${seat:mesh-broker:5671}",
         "MESH_BUS_NATS_FILE": "${dir:mesh-state}/bus",
         "MESH_CONTROLLER_VERSION": "${version}",
-        "MESH_MERGE_WINDOW_FILE": "${dir:mesh-state}/merge-window.json",
-        "MESH_PUSH_FILE": "${dir:mesh-state}/push.json"
+        "MESH_MERGE_WINDOW_FILE": "${dir:mesh-state}/merge-window.json"
       },
       "replaces": [
         "server"

testdata/store-tests

@@ -51,10 +51,3 @@
 ./internal/inventory TestASharedOwnSecretIssuedOutsideIsNeverMade
 ./cmd/mesh-controller TestOneAcceptForAProviderIsPlacedForEveryConsumer
 ./cmd/mesh-controller TestReplay164
-./cmd/mesh-controller TestAnApprovedLayerOpensTheWalkThatSendsIt
-./cmd/mesh-controller TestASettingsWalkSendsOneMachineAtATimeEachJudged
-./cmd/mesh-controller TestAFailedSettingsWalkStopsAndHoldsNothingBack
-./cmd/mesh-controller TestASettingsWalkSendsTheLayerAloneEveryBuildKept
-./cmd/mesh-controller TestASettingsWalkStopsBeforeADataMoveAndPassesOverAMachineAway
-./cmd/mesh-controller TestACrossingSendSupersedesASettingsGate
-./cmd/mesh-controller TestASettingsWalkFailsOnARefusalThatCannotClear