Test the checker's latest package versions

The checker builds every Go check against them (issue 1585, S14); a row
in the repoModules test proves they come from the modules that hold each
package and leave out a package no module holds.

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

modules/mesh-delivery-assigner/cmd/mesh-delivery-assigner/integration_test.go

@@ -167,7 +167,7 @@ func saysWhatItKeeps(t *testing.T, b *bed, done <-chan error) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	m, err := catalogue.Decode(raw)
+	m, err := catalogue.ParseManifest(raw)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -407,7 +407,7 @@ func TestWantsAreWrittenAndNoDifferenceIs(t *testing.T) {
 	for _, fp := range []string{fNew, fOld} {
 		gkey, _ := delivery.ControllerGrantKey("web", fp)
 		grant, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
-		b.putJSON(t, delivery.PartGrantsBucket, gkey, grant)
+		b.putJSON(t, delivery.ControllerGrantsBucket, gkey, grant)
 	}
 	runs := map[string]string{"ace": fOld, "g14": "build-9", "shanks": fOld}
 	for _, node := range []string{"ace", "g14", "shanks"} {
@@ -617,7 +617,7 @@ func TestTheAssignerReplacedResumesWithNothingLostOrRepeated(t *testing.T) {
 		b.putJSON(t, delivery.BuilderBuildsBucket, bkey, built)
 		gkey, _ := delivery.ControllerGrantKey(name, fp)
 		grant, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
-		b.putJSON(t, delivery.PartGrantsBucket, gkey, grant)
+		b.putJSON(t, delivery.ControllerGrantsBucket, gkey, grant)
 		b.compose(t, "ace", name, fp, 'c', delivery.JudgedNeither)
 		b.putJSON(t, provider.AssignmentsBucket, "ace."+name, []byte(fmt.Sprintf(`{"node":"ace","module":%q,"build":"b-%d"}`, name, i)))
 	}
@@ -663,7 +663,7 @@ func TestAWantWaitsForItsComposition(t *testing.T) {
 	b.putJSON(t, delivery.BuilderBuildsBucket, bkey, built)
 	gkey, _ := delivery.ControllerGrantKey("web", fNew)
 	grant, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
-	b.putJSON(t, delivery.PartGrantsBucket, gkey, grant)
+	b.putJSON(t, delivery.ControllerGrantsBucket, gkey, grant)
 	on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
 	b.putJSON(t, delivery.PresenceBucket, "ace", on)
 	b.putJSON(t, provider.AssignmentsBucket, "ace.web", []byte(`{"node":"ace","module":"web","build":"b-1"}`))
@@ -712,7 +712,7 @@ func (b *bed) fixture(t *testing.T, name, fp, manifest string) {
 	b.putJSON(t, delivery.BuilderBuildsBucket, bkey, built)
 	gkey, _ := delivery.ControllerGrantKey(name, fp)
 	grant, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
-	b.putJSON(t, delivery.PartGrantsBucket, gkey, grant)
+	b.putJSON(t, delivery.ControllerGrantsBucket, gkey, grant)
 	on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
 	b.putJSON(t, delivery.PresenceBucket, "ace", on)
 	b.putJSON(t, provider.AssignmentsBucket, "ace."+name, []byte(`{"node":"ace","module":"`+name+`","build":"b-1"}`))

modules/mesh-delivery-assigner/cmd/mesh-delivery-assigner/main.go

@@ -59,6 +59,7 @@ func main() {
 var readBuckets = []string{
 	buscompose.ResolvedBucket,
 	provider.AssignmentsBucket,
+	delivery.ControllerGrantsBucket,
 	delivery.PartGrantsBucket,
 	buscompose.LeaseBucket,
 	delivery.ControllerComposedBucket,
@@ -218,8 +219,8 @@ func startsWithout(name string) bool {
 	return slices.Contains(seatBuckets, name) || sourceOfGrants(name)
 }
 
-// sourceOfGrants says the bucket is the grants part's grants or the controller's lease: neither stops the assigner when it
-// is not there.
+// sourceOfGrants says the bucket is one of the two that choose the grants' source, the grants part's grants and the
+// controller's lease: neither stops the assigner when it is not there (delivery.GrantSource).
 func sourceOfGrants(name string) bool {
 	return name == delivery.PartGrantsBucket || name == buscompose.LeaseBucket
 }
@@ -332,6 +333,7 @@ func (e emitting) Emit(eventType string, body any) error { return e.Conn.Emit(ev
 var watched = []string{
 	buscompose.ResolvedBucket,
 	provider.AssignmentsBucket,
+	delivery.ControllerGrantsBucket,
 	delivery.PartGrantsBucket,
 	buscompose.LeaseBucket,
 	delivery.ControllerComposedBucket,
@@ -417,10 +419,11 @@ func follow(ctx context.Context, js jetstream.JetStream, nc process.Subscriber,
 					if e.Operation() == jetstream.KeyValuePut {
 						value = e.Value()
 					}
-					before := w.handedAway()
+					before := w.grantsBucket()
 					w.putEntry(name, e.Key(), value, e.Revision(), e.Created())
-					if name == buscompose.LeaseBucket && w.handedAway() == before {
-						// The controller renews its lease every few seconds: only the lease's being handed away makes a pass.
+					if name == buscompose.LeaseBucket && w.grantsBucket() == before {
+						// The controller renews its lease every few seconds: only a change of where grants are read from
+						// makes a pass (delivery.GrantSource).
 						continue
 					}
 					wake()

modules/mesh-delivery-assigner/cmd/mesh-delivery-assigner/main_test.go

@@ -36,7 +36,7 @@ func TestOpensWhatItsManifestNames(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	m, err := catalogue.Decode(raw)
+	m, err := catalogue.ParseManifest(raw)
 	if err != nil {
 		t.Fatal(err)
 	}

modules/mesh-delivery-assigner/cmd/mesh-delivery-assigner/pass_test.go

@@ -272,7 +272,7 @@ func putOfTheBus(t *testing.T) {
 	world(delivery.ControllerComposedBucket, ckey, cd)
 	gkey, _ := delivery.ControllerGrantKey("nats", fp)
 	g, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
-	world(delivery.PartGrantsBucket, gkey, g)
+	world(delivery.ControllerGrantsBucket, gkey, g)
 	got := step()
 	akey, _ := delivery.RecordAskKey("novox", "nats", digest)
 	if got.Step != delivery.PutPerson || got.Ask != akey {

modules/mesh-delivery-assigner/cmd/mesh-delivery-assigner/seat.go

@@ -664,25 +664,12 @@ func (p *passer) compute(prop delivery.PlacementProposal, current map[string]del
 	}
 	get := kvGetter(p.kvs[delivery.ManifestsBucket])
 	r := worldReader{w: p.w, manifests: get}
-	// A read that fails is said, never dropped silently (novox/hq ADR 0578 §3); a refused manifest no longer fails it, and
-	// its module is held, named in the input's Refused.
 	var now, with *compose.Input
 	if in, err := frombus.Input(context.Background(), r, frombus.Mesh{}, frombus.Scope{Every: true}); err == nil {
 		now = &in
-	} else if p.logf != nil {
-		p.logf("proposal %s: the current composition input cannot be read, so what it changes is judged without it: %v", prop.ID, err)
 	}
 	if in, err := frombus.Input(context.Background(), r, frombus.Mesh{}, frombus.Scope{Every: true, Placements: laid}); err == nil {
 		with = &in
-	} else if p.logf != nil {
-		p.logf("proposal %s: the composition input with the proposal cannot be read, so what it changes is judged without it: %v", prop.ID, err)
-	}
-	if now != nil && len(now.Refused) > 0 && p.logf != nil {
-		var held []string
-		for _, m := range slices.Sorted(maps.Keys(now.Refused)) {
-			held = append(held, m+" ("+now.Refused[m]+")")
-		}
-		p.logf("proposal %s: held as refused by the indexer's judge: %s", prop.ID, strings.Join(held, "; "))
 	}
 	nodes := map[string]bool{}
 	for n := range current {

modules/mesh-delivery-assigner/cmd/mesh-delivery-assigner/seat_tools_test.go

@@ -6,7 +6,6 @@ import (
 	"errors"
 	"fmt"
 	"os"
-	"reflect"
 	"slices"
 	"strings"
 	"testing"
@@ -16,7 +15,6 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/buscompose"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/health"
 	"git.novox.be/novox/mesh-sdk/go/provisions"
 	"github.com/nats-io/nats.go/jetstream"
 
@@ -402,47 +400,6 @@ func wantsVerbs(t *testing.T) {
 	if splits := out.(map[string]any)["splits"].([]assign.Split); len(splits) != 1 || splits[0].Module != "web" || out.(map[string]any)["findings"] == nil {
 		t.Errorf("splits = %+v", splits)
 	}
-	// Read by watch (issue 1953 L5f): the same answer, each watched state started once, and no get per key of the
-	// large states (the modules, their manifests, the composed record).
-	watches := map[string]int{}
-	byWatch := newWantsTools(st, nil, nil)
-	byWatch.watched = stdio.WatchedStatesOver(func(state string, handle func(stdio.StateChange) error) error {
-		watches[state]++
-		for k, v := range st[state].values {
-			_ = handle(stdio.StateChange{Key: k, Op: stdio.OpPut, Value: v, Current: true})
-		}
-		return nil
-	}, func(state, key string) ([]byte, bool, error) {
-		watches[state+" by key"]++
-		v, ok := st[state].values[key]
-		return v, ok, nil
-	})
-	for range 2 {
-		wout, werr := byWatch.doUpgrade(map[string]any{"compare": "true"}, "op")
-		if werr != nil {
-			t.Fatal(werr)
-		}
-		if ws := wout.(map[string]any)["splits"].([]assign.Split); len(ws) != 1 || ws[0].Module != "web" {
-			t.Errorf("splits by watch = %+v", ws)
-		}
-	}
-	if n := watches[manifestsState+" by key"]; n == 0 || n > len(st[manifestsState].values) {
-		t.Errorf("the manifests were read by key %d times, want each once", n)
-	}
-	for _, state := range []string{modulesState, composedState, health.FindingsState} {
-		if watches[state] != 1 {
-			t.Errorf("%s was watched %d times, want once", state, watches[state])
-		}
-	}
-	// ADR 0580 clause 3: the compare reads through mesh-sdk's watched reader and the seat keeps no mirror of its own.
-	for f := range reflect.TypeFor[wantsTools]().Fields() {
-		if f.Type.Kind() == reflect.Map || (f.Type.Kind() == reflect.Pointer && f.Type.Elem().Kind() == reflect.Map) {
-			t.Errorf("wantsTools keeps %s, a copy of its own beside the watched reader", f.Name)
-		}
-	}
-	if watches[policiesState] != 0 {
-		t.Errorf("the seat's own small policies state was watched: %v", watches)
-	}
 	// The process says the split as its finding, and deletes it once they agree.
 	findings := map[string][]byte{}
 	p := &passer{w: newWorld(), logf: func(string, ...any) {}, findings: assign.Findings{
@@ -458,7 +415,7 @@ func wantsVerbs(t *testing.T) {
 		mod, _ := delivery.DecodeModule(raw)
 		mraw, _, _, _ := st.get(manifestsState, mod.Manifest)
 		kept, _ := delivery.DecodeManifest(mraw)
-		man[name], _ = catalogue.Decode([]byte(kept.JSON))
+		man[name], _ = catalogue.ParseManifest([]byte(kept.JSON))
 	}
 	findings["module.gone.policy-split"] = []byte("{}")
 	p.policySplits(man, nil)
@@ -507,7 +464,7 @@ func readManifest() (catalogue.Manifest, error) {
 	if err != nil {
 		return catalogue.Manifest{}, err
 	}
-	return catalogue.Decode(raw)
+	return catalogue.ParseManifest(raw)
 }
 
 // countingKV is a memKV that counts its puts.

modules/mesh-delivery-assigner/cmd/mesh-delivery-assigner/tools.go

@@ -352,12 +352,10 @@ func serveTools() error {
 		}
 	}()
 	tools := append(s.tools(), newSeatTools(runtimeStore{}, stdio.Ask).tools()...)
-	wants := newWantsTools(runtimeStore{}, stdio.Ask, func(e, id string, b any) error {
+	tools = append(tools, newWantsTools(runtimeStore{}, stdio.Ask, func(e, id string, b any) error {
 		// The seat's event, said on the seat: a claimed seat's event is never the module's own.
 		return stdio.SeatPublish(wantsEventSubject(e), b, id)
-	})
-	wants.watched = stdio.NewWatchedStates() // the large states read whole from one watched copy (ADR 0580 clause 3)
-	tools = append(tools, wants.tools()...)
+	}).tools()...)
 	return stdio.Serve("", tools)
 }
 

modules/mesh-delivery-assigner/cmd/mesh-delivery-assigner/wants_tools.go

@@ -41,10 +41,6 @@ type wantsTools struct {
 	ask  func(key string, body any) (json.RawMessage, error)
 	emit func(event, id string, body any) error
 	now  func() time.Time
-	// watched is the copy of the large states it reads whole, each by one watch started on its first read and kept by
-	// its changes after (mesh-sdk's WatchedStates, novox/hq ADR 0580 clause 3), never a get per key, which timed out on
-	// a large state (issue 1953 L5f). Nil reads key by key.
-	watched *stdio.WatchedStates
 }
 
 // wantsEventSubject is the subject of one of the seat's events.
@@ -63,16 +59,8 @@ func (s *wantsTools) leased() bool {
 	return away
 }
 
-// values reads every key of a state: from the watched copy when there is one, else key by key.
+// values reads every key of a state.
 func (s *wantsTools) values(state string) (map[string][]byte, error) {
-	if s.watched != nil {
-		return s.watched.Values(state)
-	}
-	return s.direct(state)
-}
-
-// direct reads a state key by key, for a small state of the seat's own.
-func (s *wantsTools) direct(state string) (map[string][]byte, error) {
 	keys, err := s.st.keys(state)
 	if err != nil {
 		return nil, fmt.Errorf("%s cannot be listed: %w", state, err)
@@ -90,16 +78,6 @@ func (s *wantsTools) direct(state string) (map[string][]byte, error) {
 	return out, nil
 }
 
-// manifest reads a manifest by its digest: kept once read when there is a watched copy, a manifest never changing
-// under its digest.
-func (s *wantsTools) manifest(digest string) ([]byte, bool, error) {
-	if s.watched != nil {
-		return s.watched.Once(manifestsState, digest)
-	}
-	raw, _, found, err := s.st.get(manifestsState, digest)
-	return raw, found, err
-}
-
 // manifests is every module the indexer holds, with its trunk manifest and fingerprint.
 func (s *wantsTools) manifests() (map[string]catalogue.Manifest, map[string]delivery.Module, error) {
 	mods, err := s.values(modulesState)
@@ -116,7 +94,7 @@ func (s *wantsTools) manifests() (map[string]catalogue.Manifest, map[string]deli
 		if m.Manifest == "" {
 			continue
 		}
-		mraw, found, err := s.manifest(m.Manifest)
+		mraw, _, found, err := s.st.get(manifestsState, m.Manifest)
 		if err != nil || !found {
 			continue
 		}
@@ -124,8 +102,7 @@ func (s *wantsTools) manifests() (map[string]catalogue.Manifest, map[string]deli
 		if err != nil {
 			continue
 		}
-		// Decoded, never judged (ADR 0578 §3); one that does not decode is left out of the answer, as before.
-		if man, err := catalogue.Decode([]byte(kept.JSON)); err == nil {
+		if man, err := catalogue.ParseManifest([]byte(kept.JSON)); err == nil {
 			out[name] = man
 		}
 	}
@@ -148,7 +125,7 @@ func (s *wantsTools) doUpgrade(args map[string]any, by string) (any, error) {
 	if err != nil {
 		return nil, err
 	}
-	raw, err := s.direct(policiesState) // the seat's own small state, read whole after its own writes
+	raw, err := s.values(policiesState)
 	if err != nil {
 		return nil, err
 	}

modules/mesh-delivery-assigner/cmd/mesh-delivery-assigner/world.go

@@ -197,10 +197,10 @@ func (w *world) manifest(ctx context.Context, get getter, digest string) parsed
 	m, err := delivery.DecodeManifest(value)
 	if err != nil {
 		p = parsed{err: err.Error()}
-	} else if man, err := catalogue.Decode([]byte(m.JSON)); err != nil {
-		// Decoded, never judged (novox/hq ADR 0578 §3): the indexer's judge judged it, and its verdict is taken from the
-		// module's value where it is read (world.mesh).
-		p = parsed{module: m.Module, err: "it does not decode: " + err.Error()}
+	} else if man, err := catalogue.ParseManifestForInputs([]byte(m.JSON)); err != nil {
+		// Read as the indexer reads it (issue 1751): a value falling back to a predefined key is judged by the merge gate
+		// in the catalogue, against the predefined.json at its root that this process never holds (ADR 0348 §7).
+		p = parsed{module: m.Module, err: err.Error()}
 	} else {
 		p = parsed{module: m.Module, manifest: man}
 	}
@@ -313,18 +313,6 @@ func (w *world) mesh(ctx context.Context, manifests getter) assign.Mesh {
 			continue
 		}
 		m.Digests[name] = mod.Manifest
-		// The indexer's verdict on it, carried in its value (ADR 0578 §3, §5): a refused module is held and named as one
-		// that cannot be read, and its verdict goes into the composer's input.
-		if v := mod.VerdictOf(name); v != nil {
-			if refused, _ := delivery.TakeManifestVerdict(v); refused {
-				if m.Verdicts == nil {
-					m.Verdicts = map[string]delivery.ManifestVerdict{}
-				}
-				m.Verdicts[name] = *v
-				m.Unreadable[name] = v.Why()
-				continue
-			}
-		}
 		p := w.manifest(ctx, manifests, mod.Manifest)
 		if p.err != "" {
 			m.Unreadable[name] = p.err
@@ -584,9 +572,15 @@ func (w *world) value(bucket, key string) []byte {
 	return w.values[bucket][key]
 }
 
-// grantsBucket is the bucket the grants are read from: the grants part's state `grants`, always (ADR 0571 clause 9); no
-// manifest but the controller's reads the controller's grants.
-func (w *world) grantsBucket() string { return delivery.PartGrantsBucket }
+// grantsBucket is the bucket the grants are read from now (delivery.GrantSource): the grants part's while the controller's
+// lease is handed away, as the lease bucket's key says it (buscompose.LeaseHandedAway), the controller's in every other
+// case, a lease not held here included.
+func (w *world) grantsBucket() string {
+	raw := w.value(buscompose.LeaseBucket, buscompose.ControllerLeaseKey)
+	away, _ := buscompose.LeaseHandedAway(raw, raw != nil, nil)
+	bucket, _ := delivery.GrantSource(away)
+	return bucket
+}
 
 // has says whether a bucket holds a key now.
 func (w *world) has(bucket, key string) bool {

modules/mesh-delivery-assigner/cmd/mesh-delivery-assigner/world_test.go

@@ -73,11 +73,10 @@ func TestTheChangeOfACandidate(t *testing.T) {
 }
 
 // 1297/B3b: a candidate whose module has no manifest digest yet, or whose manifest the indexer does not hold yet, waits,
-// saying for what; a manifest that does not decode is the change's, not a wait (one with a field the assigner does not
-// know is decoded with it set aside, novox/hq ADR 0578 §6).
+// saying for what; an unreadable manifest is the change's, not a wait.
 func TestAChangeWaitsForItsManifests(t *testing.T) {
 	f := fakeManifests{}
-	bad := f.add(t, "web", `{"module":"web","version":"2","requires":"x"}`)
+	bad := f.add(t, "web", `{"module":"web","version":"2","scope":"x"}`)
 	for _, c := range []delivery.CandidatePull{
 		pull("novox/web", 1, map[string]delivery.CandidateModule{"web": {None2: "no preview yet"}}),
 		pull("novox/web", 1, map[string]delivery.CandidateModule{"web": {FP2: fp('b'), Manifest: strings.Repeat("9", 64)}}),
@@ -128,22 +127,24 @@ func theWorldCountsTheValuesAKeyTakes(t *testing.T) {
 	if got := w.changed(delivery.HaveBucket, "gone"); got != 0 {
 		t.Errorf("changed = %d for a key never seen", got)
 	}
-	// ADR 0571 clause 9: grants are read from the grants part's bucket in every case, a lease held, handed away, absent or
-	// unreadable alike, and the controller's own grants count for nothing.
+	// Issue 774: grants are read from the grants part's bucket only while the controller's lease is handed away: a grant
+	// only the part holds lets a node's put through then, and with a controller's lease (or none, or an unreadable one) it
+	// holds it, a grant only the controller holds being the one that counts instead.
 	fp := delivery.SourcePrefix2 + strings.Repeat("d", 64)
 	gkey, _ := delivery.ControllerGrantKey("web", fp)
 	grant, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{Accounts: []string{"ace.web"}})
 	for _, row := range []struct {
 		name, lease          string
 		inPart, inController bool
+		bucket               string
 		granted              bool
 	}{
-		{"handed away, the part's grant", `{"handed-to":"the operator's hand-over"}`, true, false, true},
-		{"handed away, only the controller's grant", `{"handed-to":"x"}`, false, true, false},
-		{"a controller holds it, the part's grant", `{"instance":"novox/1","epoch":3}`, true, false, true},
-		{"a controller holds it, only its own grant", `{"instance":"novox/1"}`, false, true, false},
-		{"no lease read", ``, true, false, true},
-		{"an unreadable lease", `[1]`, true, false, true},
+		{"handed away, the part's grant", `{"handed-to":"the operator's hand-over"}`, true, false, delivery.PartGrantsBucket, true},
+		{"handed away, only the controller's grant", `{"handed-to":"x"}`, false, true, delivery.PartGrantsBucket, false},
+		{"a controller holds it, only the part's grant", `{"instance":"novox/1","epoch":3}`, true, false, delivery.ControllerGrantsBucket, false},
+		{"a controller holds it, its own grant", `{"instance":"novox/1"}`, false, true, delivery.ControllerGrantsBucket, true},
+		{"no lease read", ``, true, false, delivery.ControllerGrantsBucket, false},
+		{"an unreadable lease", `[1]`, true, false, delivery.ControllerGrantsBucket, false},
 	} {
 		p := newPasser(buckets{}, time.Now())
 		if row.lease != "" {
@@ -155,8 +156,8 @@ func theWorldCountsTheValuesAKeyTakes(t *testing.T) {
 		if row.inController {
 			p.w.put(delivery.ControllerGrantsBucket, gkey, grant)
 		}
-		if got := p.w.grantsBucket(); got != delivery.PartGrantsBucket {
-			t.Errorf("%s: grants are read from %s, want the part's", row.name, got)
+		if got := p.w.grantsBucket(); got != row.bucket {
+			t.Errorf("%s: grants are read from %s, want %s", row.name, got, row.bucket)
 		}
 		if _, granted := p.composedFor("ace", "web", fp); granted != row.granted {
 			t.Errorf("%s: granted = %v, want %v", row.name, granted, row.granted)

modules/mesh-delivery-assigner/go.mod

@@ -3,7 +3,7 @@ module mesh-delivery-assigner
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101085317-790d1c82d027
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )

modules/mesh-delivery-assigner/go.sum

@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101085317-790d1c82d027 h1:a33dsavoaqllh40eVICbhxi6Kero1EGSjt1V+2fa2Hk=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101085317-790d1c82d027/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a h1:DcSvfEmdPBKqCg5OmXRNb269EkkPe7BsEp+RykEhkgE=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=

modules/mesh-delivery-assigner/internal/assign/compose.go

@@ -43,9 +43,6 @@ type Mesh struct {
 	// InputUnread says why that input could not be read from the bus, when it could not: the check then composes the
 	// nodes and their assignments alone, and says so in its warnings.
 	InputUnread string
-	// Verdicts are the indexer's refusals of trunk manifests, by module, as their values carry them (novox/hq ADR 0578
-	// §3): each such module is in Unreadable too, and the composer's input carries the verdict (§5).
-	Verdicts map[string]delivery.ManifestVerdict
 }
 
 // Change is a group's change as the indexer's candidate holds it: the manifest of every module it moves or adds, those

modules/mesh-delivery-assigner/internal/assign/compose_test.go

@@ -42,7 +42,7 @@ func TestAChangeOfOneModuleComposesItsMachine(t *testing.T) {
 	}
 	// 1953/D7 (ADR 0565 §5, ADR 0502 §4): the group's own pull request's held value at its head is laid and named, judged
 	// against the head's declaration; one of another pull request or another head is not laid.
-	web, err := catalogue.Decode([]byte(`{"module":"web","version":"2","config":{"port":{"type":"number","default":80,"description":"the port, a number","runtime":true}}}`))
+	web, err := catalogue.ParseManifest([]byte(`{"module":"web","version":"2","config":{"port":{"type":"number","default":80,"description":"the port, a number","runtime":true}}}`))
 	if err != nil {
 		t.Fatal(err)
 	}

modules/mesh-delivery-assigner/internal/assign/composer.go

@@ -49,18 +49,10 @@ func HeadJob(m Mesh, c Change) (delivery.ComposeJob, error) {
 		in.Catalogue = nil
 		fromClaims = len(in.Holdings) == 0
 	}
-	// Each trunk manifest the indexer refused goes in with its verdict, so the composer holds and names it (ADR 0578 §5);
-	// a manifest the change brings has no verdict of the indexer yet, and the checker's judge judges it (§2).
-	changeVerdicts := map[string]delivery.ManifestVerdict{}
-	for name, v := range m.Verdicts {
-		if _, changed := c.Digests[name]; !changed {
-			changeVerdicts[name] = v
-		}
-	}
-	changeCase := composer.Case{Name: CaseChange, Manifests: change, Verdicts: changeVerdicts}
+	changeCase := composer.Case{Name: CaseChange, Manifests: change}
 	req := composer.Request{V: composer.Version, Input: in, Depth: composer.DepthResolve,
 		HoldingsFromClaims: fromClaims, Machines: Touched(m, c),
-		Cases: []composer.Case{{Name: CaseTrunk, Manifests: trunk, Verdicts: m.Verdicts}, changeCase}}
+		Cases: []composer.Case{{Name: CaseTrunk, Manifests: trunk}, changeCase}}
 	return job(SDKRepository, c.SDKHead, SDKDir, req, "the mesh-sdk head of "+c.Group)
 }
 
@@ -147,10 +139,10 @@ type Reader struct {
 
 // FromComposer is the composition check of a group with a mesh-sdk member, judged from the composer built at its head
 // (ADR 0482 clauses 3 to 5, issues 1622 and 1623): the same failures as Compose, read from the composer's two cases, the
-// verdict naming the mesh-sdk the composer was built with; a trunk manifest the head's mesh-sdk cannot decode fails too
-// (the group would deliver a reader that cannot read it). A reader that cannot read a changed manifest is a warning,
-// never a failure: it decodes leniently and sets a field it does not know aside (novox/hq ADR 0578 §6, which changes
-// ADR 0482 §5).
+// verdict naming the mesh-sdk the composer was built with; a trunk manifest the head's mesh-sdk refuses fails too (the
+// group would deliver a reader that refuses it); and each reader that refuses a changed manifest the head reads fails
+// it, naming the module and its words, unless the reader's mesh-sdk has no composer to ask (before issue 1621), which is
+// said and judged nothing.
 func FromComposer(m Mesh, c Change, head Ran, readers []Reader, took time.Duration) delivery.CompositionVerdict {
 	v := delivery.CompositionVerdict{Group: c.Group, Heads: c.Heads, SDK: "mesh-sdk " + c.SDKHead, Took: took.Milliseconds()}
 	machines := Touched(m, c)
@@ -253,10 +245,8 @@ func judgeReaders(c Change, head composer.CaseVerdict, readers []Reader) (fails,
 			if !head.Manifests[name].Accepted || read.Manifests[name].Accepted {
 				continue
 			}
-			// ADR 0578 §6: no longer a failure; the reader sets what it does not know aside, and the part that needs it takes
-			// the newer package (ADR 0573 §2).
-			warnings = append(warnings, fmt.Sprintf("the manifest of %s uses what %s (mesh-sdk %s) cannot read: %s; it reads the rest "+
-				"once it takes mesh-sdk %s", name, at, r.Ran.Verdict.SDK, read.Manifests[name].Refused, c.SDKHead))
+			fails = append(fails, fmt.Sprintf("the manifest of %s uses what %s (mesh-sdk %s) cannot read: %s; the group must move %s onto "+
+				"mesh-sdk %s", name, at, r.Ran.Verdict.SDK, read.Manifests[name].Refused, r.Module, c.SDKHead))
 		}
 	}
 	return fails, warnings

modules/mesh-delivery-assigner/internal/assign/composer_test.go

@@ -40,10 +40,9 @@ func digestedMesh() Mesh {
 // webShares is a group of mesh-sdk and mesh-catalog whose catalogue member gives web the field only the SDK head reads:
 // the assigner's own reader refuses it (Unreadable), as the indexer's manifest is read in world.change.
 func webShares(members map[string]string) Change {
-	// As an older reader refused it; the field set aside by the lenient decoder is named the same (ADR 0578 §6).
-	m, _ := catalogue.Decode([]byte(raws["d-web2"]))
+	_, err := catalogue.ParseManifest([]byte(raws["d-web2"]))
 	return Change{Group: "g", Heads: "0123456789ab", SDKHead: sdkHead, Manifests: map[string]catalogue.Manifest{},
-		Unreadable: map[string]string{"web": m.SetAside()}, Digests: map[string]string{"web": "d-web2"}, Members: members}
+		Unreadable: map[string]string{"web": err.Error()}, Digests: map[string]string{"web": "d-web2"}, Members: members}
 }
 
 // run is the composer's step for a job, as the build module answers it: the request filled from the indexer's digests
@@ -142,11 +141,10 @@ func TestAFieldTheGroupAddsPassesWithTheHeadsComposer(t *testing.T) {
 	}
 }
 
-// 1623/AC1, AC2 as ADR 0578 §6 changes them: the group of mesh-sdk and mesh-catalog adding and using a field, without a
-// controller member, passes with a warning naming the field and mesh-controller, whose running build pins an older
-// mesh-sdk that cannot read it: a reader sets a field it does not know aside, so it fails nothing. With a controller
-// member pinned to the SDK head it passes with no such warning.
-func TestAFieldTheRunningControllerCannotReadIsAWarning(t *testing.T) {
+// 1623/AC1, AC2: the group of mesh-sdk and mesh-catalog adding and using a field, without a controller member, fails
+// naming the field and mesh-controller, whose running build pins an older mesh-sdk; with a controller member pinned to
+// the SDK head (its composer reads what the head reads) it passes.
+func TestAFieldTheRunningControllerCannotReadFailsTheGroup(t *testing.T) {
 	c := webShares(nil)
 	job, _ := HeadJob(digestedMesh(), c)
 	head := run(t, job, asTheHeadReads)
@@ -158,12 +156,10 @@ func TestAFieldTheRunningControllerCannotReadIsAWarning(t *testing.T) {
 	if rjob.Fetch["commit"] != running || rjob.Dir != delivery.RootPath {
 		t.Fatalf("reader job = %+v", rjob)
 	}
-	// The running controller's mesh-sdk, older than the lenient decoder, refuses web2 for its field.
-	old := Ran{State: delivery.StepPassed, Verdict: &composer.Verdict{V: composer.Version, SDK: "v0.1.13", Cases: []composer.CaseVerdict{
-		{Name: CaseChange, Manifests: map[string]composer.ManifestRead{"web": {Refused: `json: unknown field "shares"`}}}}}}
+	old := run(t, rjob, nil) // the running controller's mesh-sdk reads web2 as the assigner's own does: refused
 	v := FromComposer(digestedMesh(), c, head, []Reader{{Module: "mesh-controller", Commit: running, Ran: old}}, 0)
-	if v.State != delivery.CompositionPass || !hasWarning(v, "shares") || !hasWarning(v, "mesh-controller at "+running) {
-		t.Fatalf("without a controller member: %+v, want a pass warning of the field and mesh-controller", v)
+	if v.State != delivery.CompositionFail || !strings.Contains(v.Words, "shares") || !strings.Contains(v.Words, "move mesh-controller onto mesh-sdk "+sdkHead) {
+		t.Fatalf("without a controller member: %+v, want a fail naming the field and mesh-controller", v)
 	}
 	member := "2222222222222222222222222222222222222222"
 	pinned := run(t, rjob, asTheHeadReads)
@@ -200,26 +196,9 @@ func TestTheHeadsComposerFailingOrRefusingTheTrunkFails(t *testing.T) {
 		t.Fatalf("a head composer that did not run: %+v", v)
 	}
 	job, _ := HeadJob(digestedMesh(), c)
-	strict := map[string]string{"d-web2": asTheHeadReads["d-web2"], "d-mail": `{"module": "mail", "version": "1", "requires": "x"}`}
+	strict := map[string]string{"d-web2": asTheHeadReads["d-web2"], "d-mail": `{"module": "mail", "version": "1", "gone": true}`}
 	v = FromComposer(digestedMesh(), c, run(t, job, strict), nil, 0)
 	if v.State != delivery.CompositionFail || !strings.Contains(v.Words, "refuses the trunk's manifest of mail") {
 		t.Fatalf("a head that refuses a trunk manifest: %+v", v)
 	}
-	// ADR 0578 §5: a trunk manifest the indexer refused goes into the composer's input with its verdict, in both cases;
-	// the composer holds and names it, and the group is not blamed for it.
-	m := digestedMesh()
-	m.Verdicts = map[string]delivery.ManifestVerdict{"mail": {Module: "mail", State: delivery.VerdictRefused, Problems: []string{"it is wrong"}}}
-	m.Unreadable = map[string]string{"mail": m.Verdicts["mail"].Why()}
-	job, _ = HeadJob(m, c)
-	var req composer.Request
-	if err := json.Unmarshal(job.Request, &req); err != nil || !req.Cases[0].Verdicts["mail"].Refused() || !req.Cases[1].Verdicts["mail"].Refused() {
-		t.Fatalf("the request carries no verdict: %+v %v", req.Cases, err)
-	}
-	head := run(t, job, asTheHeadReads)
-	if trunk, _ := caseOf(head.Verdict, CaseTrunk); !strings.Contains(trunk.Manifests["mail"].Refused, "refused the manifest of mail: it is wrong") {
-		t.Fatalf("the composer did not name the refusal: %+v", trunk.Manifests["mail"])
-	}
-	if v = FromComposer(m, c, head, nil, 0); v.State != delivery.CompositionPass {
-		t.Fatalf("a refusal on the trunk blamed the group: %+v", v)
-	}
 }

modules/mesh-delivery-assigner/manifest_test.go

@@ -16,9 +16,9 @@ func load(t *testing.T) catalogue.Manifest {
 	if err != nil {
 		t.Fatal(err)
 	}
-	m, err := catalogue.Decode(raw)
+	m, err := catalogue.ParseManifest(raw)
 	if err != nil {
-		t.Fatalf("mesh-sdk cannot decode the manifest: %v", err)
+		t.Fatalf("mesh-sdk's manifest reader refuses the manifest: %v", err)
 	}
 	return m
 }
@@ -33,7 +33,7 @@ func TestManifest(t *testing.T) {
 	}
 	reads := slices.Clone(m.Reads)
 	slices.Sort(reads)
-	want := []string{"mesh-build-go.steps", "mesh-conditions.takeover", "mesh-config.kept", "mesh-config.resolved", "mesh-controller.assignments", "mesh-controller.composed", "mesh-controller.lease",
+	want := []string{"mesh-build-go.steps", "mesh-conditions.takeover", "mesh-config.kept", "mesh-config.resolved", "mesh-controller.assignments", "mesh-controller.composed", "mesh-controller.grants", "mesh-controller.lease",
 		"mesh-delivery-builder.build-log", "mesh-delivery-builder.builds", "mesh-delivery-indexer.candidates", "mesh-delivery-indexer.manifests",
 		"mesh-delivery-indexer.modules", "mesh-delivery-teller.answers", "mesh-delivery-watchman.presence", "mesh-grants.grants", "mesh-provisioner.provisions", "node-engine.have"}
 	if !reflect.DeepEqual(reads, want) {
@@ -59,7 +59,7 @@ func TestManifest(t *testing.T) {
 		t.Errorf("uses = %v, want exactly node-build-go and operator-channel", m.Uses)
 	}
 	// ADR 0546: it serves its own tools (put, release, puts) from its bundle through the tool runner (the artifact loads the
-	// module), says each put's step as the event put, and calls the hand-act seat and the bus node's backup holder.
+	// module), says each put's step as the event put, and calls the controller's warranted and the bus node's backup holder.
 	// ADR 0567 §1, §6-§10: it holds the seat mesh-placement, serving its seven verbs; keeps the seat's events on its stream
 	// placement for 30 days; calls the controller's export, its four verbs that keep its assignments in step and its
 	// hand-act log; and reads mesh-config's resolved values to compose every node a proposal touches.
@@ -82,9 +82,9 @@ func TestManifest(t *testing.T) {
 		!slices.Equal(slices.Sorted(slices.Values(m.Streams[0].Events)), slices.Sorted(slices.Values(delivery.PlacementEvents))) {
 		t.Errorf("streams = %+v, want placement carrying the seat's four events for %d days", m.Streams, delivery.PlacementStreamDays)
 	}
-	if want := []string{"seat:mesh-controller.assign", "seat:mesh-controller.pin",
+	if want := []string{"seat:mesh-controller.assign", "seat:mesh-controller.hand-act", "seat:mesh-controller.pin",
 		"seat:mesh-controller.placement-export", "seat:mesh-controller.unassign", "seat:mesh-controller.unpin",
-		"seat:mesh-hand-acts.hand-act", "seat:mesh-hand-acts.hand-acts", "seat:mesh-hand-acts.warranted", // ADR 0565 §9, §11: the seat alone
+		"seat:mesh-controller.warranted", "seat:mesh-hand-acts.hand-act", "seat:mesh-hand-acts.hand-acts", "seat:mesh-hand-acts.warranted", // ADR 0565 §9, §11: the seat, the controller's only while it has no holder
 		"seat:node-backup.backed-up", "seat:node-backup.now"}; !slices.Equal(slices.Sorted(slices.Values(m.Invokes)), want) {
 		t.Errorf("invokes = %v, want %v", m.Invokes, want)
 	}

modules/mesh-delivery-assigner/module.json

@@ -32,6 +32,7 @@
     "mesh-config.resolved",
     "mesh-controller.assignments",
     "mesh-controller.composed",
+    "mesh-controller.grants",
     "mesh-controller.lease",
     "mesh-delivery-builder.build-log",
     "mesh-delivery-builder.builds",
@@ -50,10 +51,12 @@
   ],
   "invokes": [
     "seat:mesh-controller.assign",
+    "seat:mesh-controller.hand-act",
     "seat:mesh-controller.pin",
     "seat:mesh-controller.placement-export",
     "seat:mesh-controller.unassign",
     "seat:mesh-controller.unpin",
+    "seat:mesh-controller.warranted",
     "seat:mesh-hand-acts.hand-act",
     "seat:mesh-hand-acts.hand-acts",
     "seat:mesh-hand-acts.warranted",

modules/mesh-delivery-builder/cmd/mesh-delivery-builder/bus.go

@@ -123,6 +123,5 @@ func (m manifestReader) Manifest(ctx context.Context, digest string) (catalogue.
 	if err != nil {
 		return catalogue.Manifest{}, err
 	}
-	// Decoded, never judged (novox/hq ADR 0578 §3): what a build needs of it is read, a field it does not know set aside.
-	return catalogue.Decode([]byte(kept.JSON))
+	return catalogue.ParseManifestForInputs([]byte(kept.JSON))
 }

modules/mesh-delivery-builder/cmd/mesh-delivery-builder/gone_integration_test.go

@@ -12,7 +12,6 @@ import (
 	"github.com/nats-io/nats.go"
 	"github.com/nats-io/nats.go/jetstream"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 )
 
@@ -20,7 +19,7 @@ import (
 // (novox/hq issue 1937): on 2026-10-24 the store's 03:30 collection deleted the bare blobs of three done keys the
 // controller had never taken in, and the builder kept them done.
 
-// heldVerb answers the seat mesh-artifact-sweep's verb held on the bus, as its holder does: {result: {output, ok,
+// heldVerb answers the controller seat's verb held on the bus, as the serving controller does: {result: {output, ok,
 // answer}}; a reference is gone while gone says so.
 type heldVerb struct {
 	mu    sync.Mutex
@@ -30,7 +29,7 @@ type heldVerb struct {
 
 func (h *heldVerb) serve(t *testing.T, b *bed) {
 	t.Helper()
-	sub, err := b.js.Conn().Subscribe("mesh.seat."+catalogue.ArtifactSweepSeat+".call.held.>", func(m *nats.Msg) {
+	sub, err := b.js.Conn().Subscribe("mesh.seat.mesh-controller.call.held.>", func(m *nats.Msg) {
 		var args struct {
 			References []string `json:"references"`
 		}

modules/mesh-delivery-builder/cmd/mesh-delivery-builder/stored.go

@@ -11,6 +11,7 @@ import (
 
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/handacts"
 
 	"mesh-delivery-builder/internal/build"
 )
@@ -25,14 +26,19 @@ const SeatHeld = "seat:" + catalogue.ArtifactSweepSeat + ".held"
 // toolCaller calls a tool or a seat verb as the builder's own account (mesh-sdk process.Conn.Call).
 type toolCaller func(key string, body any) (json.RawMessage, error)
 
-// storedVia is build.Builder's Stored: it asks the seat mesh-artifact-sweep's `held` (novox/hq ADR 0571 §2, issue 1937)
-// and answers the references the store no longer holds. One it could not ask about, with none gone, is an error: the key
-// is then left done, and the controller's take-in still refuses a gone blob. The controller's `held` is not asked: it
-// is no longer a fallback (issue 1955).
+// storedVia is build.Builder's Stored: it asks the controller's verb held (mesh-sdk delivery.HeldVerb; novox/hq issue
+// 1937) and answers the references the store no longer holds. One it could not ask about, with none gone, is an error:
+// the key is then left done, and the controller's take-in still refuses a gone blob.
+//
+// It asks the seat mesh-artifact-sweep's `held` (novox/hq ADR 0571 §2), and the controller's while that seat has no holder that
+// answers (a named exception of clause 10, until the lease write).
 func storedVia(call toolCaller) func(ctx context.Context, references []string) ([]string, error) {
 	return func(_ context.Context, references []string) ([]string, error) {
 		body := map[string]any{"references": references}
 		raw, err := call(SeatHeld, body)
+		if handacts.NoResponder(err) {
+			raw, err = call(delivery.HeldVerb, body)
+		}
 		if err != nil {
 			return nil, fmt.Errorf("asking held: %w", err)
 		}

modules/mesh-delivery-builder/go.mod

@@ -3,7 +3,7 @@ module mesh-delivery-builder
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101143343-67354f8e019a
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005726-af4e4e60a3a0
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )

modules/mesh-delivery-builder/go.sum

@@ -1,5 +1,7 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101143343-67354f8e019a h1:AChSJUmHyOZ5smiuTrtDZNjetYNTFb+anRFjXIQHbSA=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101143343-67354f8e019a/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a h1:DcSvfEmdPBKqCg5OmXRNb269EkkPe7BsEp+RykEhkgE=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005726-af4e4e60a3a0 h1:q6ywchpTM9fwaJ1UNwDSuOjb5FYDFcsaeiTrKoB4scc=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005726-af4e4e60a3a0/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=

modules/mesh-delivery-builder/internal/build/askagain.go

@@ -6,7 +6,6 @@ import (
 	"fmt"
 	"regexp"
 	"slices"
-	"sort"
 	"strconv"
 	"strings"
 	"time"
@@ -178,42 +177,6 @@ func (b *Builder) drop(ctx context.Context, ask delivery.StepAsk, old string) {
 	}
 }
 
-// DefaultDeclineBound is how long one ask may go on being declined, from its first decline, before its key fails (the
-// checker's DefaultDeclineBound, issue 890); DefaultDeclinePause is how long the builder waits before it puts a declined
-// ask again, so a lone node off the agreed toolchain cannot spin on it.
-const (
-	DefaultDeclineBound = 30 * time.Minute
-	DefaultDeclinePause = 5 * time.Second
-)
-
-func (b *Builder) declineBound() time.Duration {
-	if b.DeclineBound > 0 {
-		return b.DeclineBound
-	}
-	return DefaultDeclineBound
-}
-
-func (b *Builder) declinePause() time.Duration {
-	if b.DeclinePause != 0 {
-		return max(b.DeclinePause, 0)
-	}
-	return DefaultDeclinePause
-}
-
-// declinedWords names the nodes that declined an ask and why, in the order of their names.
-func declinedWords(by map[string]string) string {
-	nodes := make([]string, 0, len(by))
-	for n := range by {
-		nodes = append(nodes, n)
-	}
-	sort.Strings(nodes)
-	var parts []string
-	for _, n := range nodes {
-		parts = append(parts, n+": "+by[n])
-	}
-	return strings.Join(parts, "; ")
-}
-
 func (b *Builder) askings() int {
 	if b.Askings > 0 {
 		return b.Askings
@@ -292,8 +255,6 @@ func (b *Builder) unlisten(key, language string, c chan string) {
 var (
 	errCheck = errors.New("the check bound passed")
 	errAgain = errors.New("asked again")
-	// errDeclined: a build node on another toolchain than the agreed one sat out of the ask (ADR 0584 clause 2).
-	errDeclined = errors.New("declined")
 )
 
 type byHand struct{ why string }
@@ -307,42 +268,11 @@ func (b *Builder) answer(ctx context.Context, l *lane, ask delivery.StepAsk, ask
 	again := b.listen(key, ask.Language)
 	defer b.unlisten(key, ask.Language, again)
 	asking := askingOf(asked.step, l.module)
-	var firstDecline time.Time
-	declines := map[string]string{} // node -> why it declined, the last
 	for {
 		step, why, err := b.waitOnce(ctx, ask, again)
 		switch {
 		case errors.Is(err, errCheck):
 			continue
-		case errors.Is(err, errDeclined):
-			// Not an asking: a node that sits out would use them all while it idles and pulls the ask again at once.
-			// Bounded by time from the first decline, then failed loudly naming the nodes and their reasons (as the
-			// checker's decline loop is, issue 890).
-			now := time.Now()
-			if firstDecline.IsZero() {
-				firstDecline = now
-			}
-			declines[step.Node] = why
-			if bound := b.declineBound(); now.Sub(firstDecline) > bound {
-				return step, ask, fmt.Errorf("the ask %s of %s was declined for %s and no build node took it: %s", ask.ID, l.module, bound.Round(time.Second), declinedWords(declines))
-			}
-			// The pause is a context's bound, not a timer (ADR 0437 §8).
-			pause, stop := context.WithTimeout(ctx, b.declinePause())
-			<-pause.Done()
-			stop()
-			if ctx.Err() != nil {
-				return step, ask, ctx.Err()
-			}
-			old := ask.ID
-			ask.ID, ask.At = buildstep.NewID(), time.Now()
-			if err := asked.note(ctx, ask.Language, ask.ID, fmt.Sprintf("put %s again after %s declined it", l.module, step.Node)); err != nil {
-				return step, ask, fmt.Errorf("the ask of %s put again after a decline could not be written to the key: %w", l.module, err)
-			}
-			if err := b.Asks.Put(ctx, ask); err != nil {
-				return step, ask, err
-			}
-			b.drop(ctx, ask, old)
-			b.logf("%s: the ask %s of %s was declined on %s and is put again as %s: %s", key, old, l.module, step.Node, ask.ID, why)
 		case errors.Is(err, errAgain):
 			if asking >= b.askings() {
 				return step, ask, fmt.Errorf("the ask %s could not be answered and was asked %d times, the most it is: %s", ask.ID, asking, why)
@@ -387,11 +317,6 @@ func (b *Builder) waitOnce(ctx context.Context, ask delivery.StepAsk, again <-ch
 		defer stop()
 	}
 	step, err := b.Asks.Wait(wait, ask)
-	if _, declined := delivery.DeclinedOf(step); err == nil && declined {
-		// A build node off the agreed toolchain sat out (ADR 0584 clause 2). It is no asking: answer() puts the ask again
-		// after a pause, within DeclineBound.
-		return step, step.Reason, errDeclined
-	}
 	if err == nil && buildrun.IsLost(step) {
 		// The build seat gave the ask up (issue 734): it can no longer be answered, so it is asked again now, with the
 		// words of why, not at the check bound.

modules/mesh-delivery-builder/internal/build/claim.go

@@ -61,8 +61,8 @@ type ClaimOptions struct {
 	// a package's reference. A key queued waiting for a version (BuilderBuild.Waits) is taken only once it is (ADR 0500
 	// clause 6). Nil means none is.
 	Published func(ref string) bool
-	// Stored answers which of the references given the artifact store no longer holds (the seat mesh-artifact-sweep's verb held,
-	// novox/hq ADR 0571 §2, issue 1937). A done key of the trunk's fingerprint is asked before it is left
+	// Stored answers which of the references given the artifact store no longer holds (the controller's verb held,
+	// mesh-sdk delivery.HeldVerb; novox/hq issue 1937). A done key of the trunk's fingerprint is asked before it is left
 	// done: the store's nightly collector deletes a blob nothing holds, and a key the controller never took in holds
 	// nothing, so a key whose blob is gone is claimed building as a new revision and built again. Nil asks nothing.
 	Stored func(ctx context.Context, references []string) (gone []string, err error)

modules/mesh-delivery-builder/internal/build/run.go

@@ -51,7 +51,7 @@ type Builder struct {
 	// Answered is told the build module whose step answered a reference (issue 1886): what the builder says it writes
 	// rests on it. Nil tells nobody.
 	Answered func(buildModule string)
-	// Stored answers which references the artifact store no longer holds (the seat mesh-artifact-sweep's verb held; issue 1937): a done
+	// Stored answers which references the artifact store no longer holds (the controller's verb held; issue 1937): a done
 	// key of the trunk's fingerprint is asked before it is left done (ClaimOptions.Stored). Nil asks nothing.
 	Stored func(ctx context.Context, references []string) (gone []string, err error)
 	// Trunk answers the head of a repository in the gate's source revision rev (source.main at that revision): the trunk a
@@ -67,9 +67,6 @@ type Builder struct {
 	// Askings is how many times one build module's part of a build is asked, the first included, before its key is failed
 	// with why; DefaultAskings when 0.
 	Askings int
-	// DeclineBound and DeclinePause bound and pace the asks build nodes off the agreed toolchain declined (ADR 0584 clause 2):
-	// they are no askings. DefaultDeclineBound and DefaultDeclinePause when 0; a negative DeclinePause puts it again at once.
-	DeclineBound, DeclinePause time.Duration
 	// Said is told each ask asked again (the builder's event build.asked-again). Nil tells nobody.
 	Said func(AskedAgain)
 	// Log is told each build's start and end, the entries of the builder's log (novox/hq ADR 0571 §1). Nil tells nobody.
@@ -418,7 +415,7 @@ func (b *Builder) try(ctx context.Context, module string, m delivery.Module) {
 	if planErr == nil && !nothing {
 		if why := b.stale(m, plan); why != "" {
 			// The fingerprint names a toolchain the build nodes no longer agree on: a new fingerprint is coming, and a build
-			// now would be of this source with another toolchain (ADR 0584 clause 1, which changes ADR 0477 clause 2). Nothing is written.
+			// now would be of this source with another toolchain (ADR 0477 clause 2). Nothing is written.
 			b.logf("%s at %s is not built: %s", module, m.FP2, why)
 			return
 		}
@@ -509,11 +506,10 @@ func (b *Builder) stale(m delivery.Module, plan Plan) string {
 			continue // an archive is packed with no toolchain
 		}
 		language := buildrun.LanguageOf[bm]
-		ag := delivery.ToolchainAgreement(b.Toolchains.Entries(language))
-		if ag.Wait != "" {
-			return fmt.Sprintf("the %s toolchain is not agreed: %s", language, ag.Wait)
+		tc, none := delivery.AgreedToolchain(b.Toolchains.Entries(language))
+		if none != "" {
+			return fmt.Sprintf("the %s toolchain is not agreed: %s", language, none)
 		}
-		tc := ag.Toolchain
 		want, ok := m.Toolchains[language]
 		if !ok || want.Version != tc.Version || want.Recipe != tc.Recipe {
 			return fmt.Sprintf("the fingerprint names %s %s (recipe %s) and the nodes agree on %s (recipe %s)", language, want.Version, want.Recipe, tc.Version, tc.Recipe)
@@ -547,8 +543,7 @@ func (b *Builder) build(ctx context.Context, module string, m delivery.Module, p
 	repository := delivery.RepositoryName(m.Repository)
 	var lanes []*lane
 	used := map[string]delivery.ToolchainUsed{}
-	var sitting []string // the nodes that sit out of a language's build, said in the key's step (ADR 0584 clause 2)
-	var kept []string    // build modules whose artifacts stay as the prior done key has them
+	var kept []string // build modules whose artifacts stay as the prior done key has them
 	for _, bm := range plan.Modules() {
 		if prior != nil && len(only) > 0 && !only[bm] {
 			kept = append(kept, bm)
@@ -558,12 +553,10 @@ func (b *Builder) build(ctx context.Context, module string, m delivery.Module, p
 		if bm != ImageBuildModule && plan.NeedsToolchain(bm) {
 			// The ask names the toolchain the fingerprint was computed with; a node building with another refuses it.
 			language := buildrun.LanguageOf[bm]
-			ag := delivery.ToolchainAgreement(b.Toolchains.Entries(language))
-			if ag.Wait != "" {
-				return failed("the %s toolchain is not agreed: %s", language, ag.Wait)
+			tc, none := delivery.AgreedToolchain(b.Toolchains.Entries(language))
+			if none != "" {
+				return failed("the %s toolchain is not agreed: %s", language, none)
 			}
-			tc := ag.Toolchain
-			sitting = append(sitting, SittingOutWords(language, ag)...)
 			if want := m.Toolchains[language]; want.Version != tc.Version || want.Recipe != tc.Recipe {
 				return delivery.BuilderBuild{} // the agreed toolchain moved since try looked: nothing is written
 			}
@@ -660,9 +653,6 @@ func (b *Builder) build(ctx context.Context, module string, m delivery.Module, p
 		}
 	}
 	step := "built " + strings.Join(steps, "; ")
-	if len(sitting) > 0 {
-		step += " (" + strings.Join(sitting, "; ") + ")"
-	}
 	if len(used) == 0 {
 		used = nil
 	}
@@ -952,13 +942,3 @@ func LogEnded(module string, m delivery.Module, ref, by string, at time.Time, re
 	e.Made = append([]delivery.BuiltArtifact(nil), result.Artifacts...)
 	return e
 }
-
-// SittingOutWords says, per node that is not on the agreed toolchain of a language, that it sits out and which version
-// it has against the agreed one: "ace sits out: typescript 26.12.1, agreed 26.13.0" (novox/hq ADR 0584 clause 2).
-func SittingOutWords(language string, a delivery.Agreement) []string {
-	var out []string
-	for _, s := range a.SittingOut {
-		out = append(out, fmt.Sprintf("%s sits out: %s %s, agreed %s", s.Node, language, s.Version, a.Toolchain.Version))
-	}
-	return out
-}

modules/mesh-delivery-builder/internal/build/run_test.go

@@ -223,14 +223,6 @@ var (
 
 func TestABundleAndAnArchiveAreBuiltOnOneNodeAndDone(t *testing.T) { // 1607/AC7, ADR 0478 clauses 1, 4
 	r := newRig(t, goBundle, archiveA, tsBundle)
-	// ADR 0584: a third node agrees with novox and ace's typescript is the odd one; the build is done and its step says ace sits out.
-	r.tools.Put(buildrun.NodeBuildModule, "g14.typescript", tcValue(t, "typescript", "tsc5"), false)
-	r.tools.Put(buildrun.NodeBuildModule, "ace.typescript", tcValue(t, "typescript", "tsc4"), false)
-	defer func() {
-		if st := r.st.vals[r.key]; !strings.Contains(string(st), "ace sits out: typescript tsc4, agreed tsc5") {
-			t.Errorf("the key does not say ace sits out: %s", st)
-		}
-	}()
 	var logged []delivery.BuildLogEntry
 	var lmu sync.Mutex
 	r.b.Node, r.b.Log = "novox", func(e delivery.BuildLogEntry) { lmu.Lock(); logged = append(logged, e); lmu.Unlock() }
@@ -738,25 +730,6 @@ func TestABuildAskWaitingInItsStreamIsNotBounded(t *testing.T) {
 			t.Fatalf("the key = %+v after %d asks, want done from the one ask", v, len(r.asks.Asks()))
 		}
 	})
-	t.Run("declined by a node off the agreed toolchain: put again, no asking used, the bound ends it loudly", func(t *testing.T) { // ADR 0584 clause 2
-		r := newRig(t, goBundle)
-		r.asks.Answer = nil
-		r.b.DeclinePause, r.b.DeclineBound = -1, 150*time.Millisecond
-		r.b.Module(context.Background(), "m", moduleValue(t, "modules/m"))
-		declined, _ := json.Marshal(delivery.StepDeclined{Declined: true, Lacks: []string{"the agreed toolchain go1.27.1 (recipe 1)"}})
-		waitForAsks(t, r, 1)
-		for ended, deadline := 0, time.Now().Add(5*time.Second); valueOf(t, r.st, r.key).State == delivery.BuildBuilding && time.Now().Before(deadline); time.Sleep(5 * time.Millisecond) {
-			if asks := r.asks.Asks(); len(asks) > ended { // each ask put again is declined in its turn
-				r.asks.End(delivery.Step{ID: asks[ended].ID, Node: "ace", State: delivery.StepRefused, Reason: "this node builds with go1.26.0", Result: declined})
-				ended++
-			}
-		}
-		r.b.Wait()
-		v := valueOf(t, r.st, r.key)
-		if n := len(r.asks.Asks()); v.State != delivery.BuildFailed || n <= DefaultAskings || !strings.Contains(v.Error, "declined for") || !strings.Contains(v.Error, "ace: this node builds with go1.26.0") {
-			t.Fatalf("the key = %+v after %d asks, want it failed after more than %d asks, naming ace and its reason", v, n, DefaultAskings)
-		}
-	})
 	for _, c := range []struct {
 		name    string
 		askings int

modules/mesh-delivery-builder/manifest_test.go

@@ -107,8 +107,8 @@ func TestManifestDeclarations(t *testing.T) { // 1607/AC1
 	}
 	// 1937/AC3: the builder asks the controller whether the artifact store still holds a done key's blobs (held), and no
 	// other tool; it holds no capacity.
-	// 1955/L7 (ADR 0571 §2): the seat mesh-artifact-sweep's held, the controller's `held` is no longer asked (issue 1955).
-	if want := []string{"seat:mesh-artifact-sweep.held"}; !reflect.DeepEqual(sorted(m.Invokes), want) || len(m.Config) != 0 {
+	// 1955/L7 (ADR 0571 §2): the seat mesh-artifact-sweep's held, the controller's only while the seat has no holder (clause 10).
+	if want := []string{"seat:mesh-artifact-sweep.held", "seat:mesh-controller.held"}; !reflect.DeepEqual(sorted(m.Invokes), want) || len(m.Config) != 0 {
 		t.Errorf("invokes = %v, config = %v, want %v and no config", m.Invokes, m.Config, want)
 	}
 	// The builder is woken by a build module's report of a toolchain, as the indexer is: the bucket may not exist when it

modules/mesh-delivery-builder/module.json

@@ -20,7 +20,8 @@
     "mesh-controller.artifacts-gone"
   ],
   "invokes": [
-    "seat:mesh-artifact-sweep.held"
+    "seat:mesh-artifact-sweep.held",
+    "seat:mesh-controller.held"
   ],
   "state": [
     { "name": "builds", "history": 5 },

modules/mesh-delivery-checker/cmd/mesh-delivery-checker/bus.go

@@ -125,11 +125,11 @@ func (m manifestReader) Manifest(ctx context.Context, digest string) (catalogue.
 	return parseManifest(kept.JSON)
 }
 
-// parseManifest decodes a manifest the indexer kept, as every reader does (novox/hq ADR 0578 §3): judged by nothing here,
-// a field it does not know set aside. The checker judges a change's manifests with the indexer's judge, run as a step
-// (judge.go).
+// parseManifest reads a manifest the indexer kept as the indexer and the assigner read it (issues 1751, 1906): a config value that
+// falls back to a predefined key is judged by the merge gate in the catalogue, against the predefined.json at its root that this
+// process never holds, so it is not unreadable here (novox/hq ADR 0348 §7).
 func parseManifest(raw string) (catalogue.Manifest, error) {
-	return catalogue.Decode([]byte(raw))
+	return catalogue.ParseManifestForInputs([]byte(raw))
 }
 
 // awaitedKV is a bucket that may appear after the start (process.AwaitBucket) as a check.KV: a call while it is not on the

modules/mesh-delivery-checker/cmd/mesh-delivery-checker/judge.go

@@ -2,8 +2,6 @@ package main
 
 import (
 	"context"
-	"encoding/json"
-	"errors"
 	"fmt"
 	"sort"
 	"strings"
@@ -33,31 +31,7 @@ type judgeDeps struct {
 	compositions check.CompositionReader
 	// nodes names every node with a record; nil hands no names.
 	nodes *nodeNames
-	// predefined is the indexer's kept list of predefined keys; nil reads none.
-	predefined check.PredefinedList
-	logf       func(format string, args ...any)
-}
-
-// keptPredefined reads the indexer's key predefined.list (delivery.PredefinedKept), bound once its state appears.
-type keptPredefined struct{ b *process.AwaitedBucket }
-
-func (k keptPredefined) PredefinedList(ctx context.Context) (json.RawMessage, error) {
-	kv := k.b.KV()
-	if kv == nil {
-		return nil, process.ErrNotYet
-	}
-	e, err := kv.Get(ctx, delivery.PredefinedListKey)
-	if errors.Is(err, jetstream.ErrKeyNotFound) {
-		return nil, nil
-	}
-	if err != nil {
-		return nil, err
-	}
-	var kept delivery.PredefinedKept
-	if err := json.Unmarshal(e.Value(), &kept); err != nil {
-		return nil, err
-	}
-	return kept.List, nil
+	logf  func(format string, args ...any)
 }
 
 // nodeNames reads every node's name from the node-engine's have, one key `<node>.node` per node with a record (novox/hq
@@ -95,7 +69,7 @@ func newJudge(d judgeDeps) check.Judge {
 		nodes = d.nodes
 	}
 	return &check.Examiner{Nodes: nodes, Compositions: d.compositions, Asks: d.asks, Toolchains: d.tools,
-		Kept: check.Kept{Store: d.kept}, Previews: d.previews, Modules: d.repos, Packages: d.repos, Published: d.repos, Forge: d.forge, Runs: d.repos, Builds: d.builds, Announce: d.announce, Trunks: d.trunks, Manifests: d.repos, Predefined: d.predefined, Logf: d.logf}
+		Kept: check.Kept{Store: d.kept}, Previews: d.previews, Modules: d.repos, Packages: d.repos, Published: d.repos, Forge: d.forge, Runs: d.repos, Builds: d.builds, Announce: d.announce, Trunks: d.trunks, Logf: d.logf}
 }
 
 // manifestKV reads a manifest by its digest.
@@ -276,20 +250,6 @@ func (r buildReader) Build(ctx context.Context, module, fp2 string) (delivery.Bu
 	return b, err == nil, err
 }
 
-// ManifestDigests is the manifest digest of every module the indexer holds, by module: the catalogue the indexer's judge
-// judges a change's manifests in (novox/hq ADR 0578 §2).
-func (r *repoModules) ManifestDigests() map[string]string {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	out := map[string]string{}
-	for module, digest := range r.typed {
-		if digest != "" {
-			out[module] = digest
-		}
-	}
-	return out
-}
-
 // CommitOf is the commit the indexer's record of the module names: the commit its fingerprint first appeared at, so the source
 // of the build the mesh runs (a later merge that leaves the module alone writes no record, the operator 2026-10-25).
 func (r *repoModules) CommitOf(module string) string {

modules/mesh-delivery-checker/cmd/mesh-delivery-checker/main.go

@@ -202,8 +202,6 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 		repos: repos, builds: builds, forge: forgeReads{call: caller.Call}, logf: logger.Printf,
 		announce: announce, compositions: compositions,
 		nodes: openNodeNames(ctx, js, logger.Printf),
-		predefined: keptPredefined{process.AwaitBucket(ctx, js, conn, delivery.IndexerModule+"_"+delivery.IndexerPredefinedState,
-			"a change's manifests are judged with no predefined keys, each fallback as its value declares it", logger.Printf)},
 	})
 	ch.Announce = announce
 	tryer.Judge = ch.Judge

modules/mesh-delivery-checker/go.mod

@@ -3,7 +3,7 @@ module mesh-delivery-checker
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101143343-67354f8e019a
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005726-af4e4e60a3a0
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )

modules/mesh-delivery-checker/go.sum

@@ -1,5 +1,7 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101143343-67354f8e019a h1:AChSJUmHyOZ5smiuTrtDZNjetYNTFb+anRFjXIQHbSA=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101143343-67354f8e019a/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a h1:DcSvfEmdPBKqCg5OmXRNb269EkkPe7BsEp+RykEhkgE=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005726-af4e4e60a3a0 h1:q6ywchpTM9fwaJ1UNwDSuOjb5FYDFcsaeiTrKoB4scc=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005726-af4e4e60a3a0/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=

modules/mesh-delivery-checker/internal/check/examiner_test.go

@@ -17,7 +17,6 @@ import (
 	"time"
 
 	"git.novox.be/novox/mesh-sdk/go/buildstep"
-	"git.novox.be/novox/mesh-sdk/go/composer"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
 )
@@ -342,11 +341,6 @@ func TestOnlyThePackageWithoutAKeptVerdictRuns(t *testing.T) { // 1288/AC1
 	if out.Verdict.State != delivery.VerdictPass || len(asks) != 3 || len(asks[0].Needs) != 0 {
 		t.Fatalf("verdict %+v, asks %+v: want a pass of three asks, the first naming no need", out.Verdict, asks)
 	}
-	for _, a := range asks { // ADR 0584: every check ask names the agreed toolchain, so a node off it declines
-		if a.Check.Toolchain == nil || a.Check.Toolchain.Version != "go1.27.1" || a.Check.Toolchain.Recipe != "7" {
-			t.Errorf("a check ask names toolchain %+v, want go1.27.1 recipe 7", a.Check.Toolchain)
-		}
-	}
 	for _, a := range asks[1:] {
 		if strings.Join(a.Needs, ",") != delivery.NeedNodeBuildNode || strings.Join(a.Check.Levels, ",") != delivery.LevelIntegration || strings.Join(a.Check.Packages, ",") != "fixture/node" {
 			t.Errorf("a placed ask %+v, want the integration level needing node-build-node", a)
@@ -934,81 +928,3 @@ func TestASecondCheckOfTheSameHeadsKeepsWhatTheFirstPassed(t *testing.T) {
 		t.Errorf("%d test steps ran on the second check", n)
 	}
 }
-
-// keptList is the indexer's kept predefined list as a test gives it.
-type keptList string
-
-func (k keptList) PredefinedList(context.Context) (json.RawMessage, error) {
-	return json.RawMessage(k), nil
-}
-
-// fixedDigests are the indexer's manifest digests as a test gives them.
-type fixedDigests map[string]string
-
-func (f fixedDigests) ManifestDigests() map[string]string { return f }
-
-// ADR 0578 §2: a change's manifests are judged by the indexer's judge, built at mesh-delivery's trunk and run as the
-// composer is (a compose ask of its command); a refusal fails the check naming the manifest and each problem; a group
-// whose mesh-delivery member changes the judge is judged by that member's head.
-func TestTheIndexersJudgeJudgesTheChangesManifests(t *testing.T) {
-	web, trunk := strings.Repeat("e", 64), strings.Repeat("d", 40)
-	for _, row := range []struct {
-		name    string
-		refused string
-		fails   string
-		// untouched is the judge's refusal of mail, which the change leaves as it is, and trunkMail its refusal on the trunk:
-		// a problem the trunk had is a warning, one the change causes fails (ADR 0579 §2)
-		untouched, trunkMail string
-	}{
-		{name: "accepted"},
-		{name: "an untouched manifest's problem the trunk had", untouched: "mail says no credential form", trunkMail: "mail says no credential form"},
-		{name: "a problem the change causes in an untouched manifest", untouched: "mail reads a state web no longer keeps",
-			fails: "refuses the manifest of mail: mail reads a state web no longer keeps"},
-		{name: "refused", refused: "web requires \"amqp\"\nweb has no id", fails: "the indexer's judge at mesh-delivery's trunk " + strings.Repeat("d", 40) + ` refuses the manifest of web: web requires "amqp"; web has no id`},
-	} {
-		b := newBench(t)
-		b.ex.Manifests = fixedDigests{"mail": strings.Repeat("a", 64), "web": strings.Repeat("b", 64)}
-		b.ex.Trunks = fixedTrunks{heads: map[string]string{DeliveryRepository: trunk}}
-		b.ex.Predefined = keptList(`{"font-size": {"type": "number", "description": "the size"}}`)
-		var judged []delivery.ComposeJob
-		answer := b.asks.Answer
-		b.asks.Answer = func(a delivery.StepAsk) delivery.Step {
-			if a.Compose == nil {
-				return answer(a)
-			}
-			judged = append(judged, *a.Compose)
-			read := composer.ManifestRead{Accepted: row.refused == "", Refused: row.refused}
-			verdict, _ := json.Marshal(composer.Verdict{V: composer.Version, SDK: "exe:1", Cases: []composer.CaseVerdict{{Name: JudgeCase,
-				Manifests: map[string]composer.ManifestRead{"web": read, "mail": {Accepted: row.untouched == "", Refused: row.untouched}}},
-				{Name: JudgeTrunk, Manifests: map[string]composer.ManifestRead{"web": {Accepted: true}, "mail": {Accepted: row.trunkMail == "", Refused: row.trunkMail}}}}})
-			result, _ := json.Marshal(delivery.ComposeAnswer{Key: "k", Verdict: verdict})
-			return delivery.Step{ID: a.ID, State: delivery.StepPassed, Result: result}
-		}
-		p := pullOf(repoA, 7, head1)
-		p.Modules = []string{"web"}
-		p.Fps = map[string]delivery.CandidateModule{"web": {FP2: "src2:" + strings.Repeat("f", 64), Manifest: web}}
-		v := b.judge(t, caseOf(t, p)).Verdict
-		if len(judged) != 1 || judged[0].Fetch["repository"] != DeliveryRepository || judged[0].Fetch["commit"] != trunk ||
-			judged[0].Package != JudgePackage || judged[0].Dir != JudgeDir {
-			t.Fatalf("%s: judged %+v (verdict %+v)", row.name, judged, v)
-		}
-		var req composer.Request
-		if err := json.Unmarshal(judged[0].Request, &req); err != nil || req.Cases[0].Manifests["web"].Digest != web ||
-			req.Cases[1].Name != JudgeTrunk || req.Cases[1].Manifests["web"].Digest != strings.Repeat("b", 64) ||
-			req.Predefined["font-size"].Type != "number" ||
-			req.Cases[0].Manifests["mail"].Digest != strings.Repeat("a", 64) {
-			t.Fatalf("%s: the request %+v: %v", row.name, req, err)
-		}
-		switch {
-		case row.fails == "" && v.State != delivery.VerdictPass:
-			t.Errorf("%s: %+v", row.name, v)
-		case row.fails != "" && (v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, row.fails)):
-			t.Errorf("%s: %+v, want a fail saying %q", row.name, v.Failed, row.fails)
-		}
-	}
-	if !changesJudge(DeliveryRepository, []Fetched{{Changed: []string{JudgeDir + "/judge/judge.go"}}}) ||
-		changesJudge(DeliveryRepository, []Fetched{{Changed: []string{JudgeDir + "/internal/index/x.go"}}}) ||
-		changesJudge("novox/mesh-catalog", []Fetched{{Changed: []string{JudgeDir + "/judge/judge.go"}}}) {
-		t.Error("which merge changes the judge")
-	}
-}

modules/mesh-delivery-checker/internal/check/judge.go

@@ -111,11 +111,6 @@ type Examiner struct {
 	}
 	// Trunks are the trunk heads of every repository, for the siblings a repository's tests read.
 	Trunks interface{ Heads() map[string]string }
-	// Manifests are the indexer's manifest digests by module: the catalogue a change's manifests are judged in by the
-	// indexer's judge (manifests_judge.go, novox/hq ADR 0578 §2); nil judges no manifest.
-	Manifests TrunkManifests
-	// Predefined reads the catalogue's predefined keys the indexer keeps (manifests_judge.go); nil reads none.
-	Predefined PredefinedList
 	// Compositions answers the assigner's composition check of a check by the check's key (delivery.CompositionKey),
 	// waiting until the assigner wrote a verdict that does not wait, or ctx ends (ADR 0528 clause 5, issue 1297); nil
 	// leaves the composition not run.
@@ -166,9 +161,7 @@ type target struct {
 	module    string
 	node      string
 	toolchain string
-	// agreed is the toolchain the ask names, so a node off it declines the check (ADR 0584); nil when none is agreed.
-	agreed  *delivery.ToolchainUsed
-	fetched Fetched
+	fetched   Fetched
 	// fetchArgs are the arguments of the fetch its check ask runs.
 	fetchArgs map[string]any
 	// priority are the Go packages (import paths) or the Node module directories whose test files the merge changes.
@@ -226,11 +219,6 @@ type state struct {
 	slow    []string
 	// beside are the siblings read at their trunk's head, by repository (ADR 0548 §6).
 	beside map[string]string
-	// judgeHead is the group's mesh-delivery member head when its merge changes the judge (ADR 0578 §2); empty judges
-	// with mesh-delivery's trunk.
-	judgeHead string
-	// predefinedHead is the catalogue member's head when its merge changes predefined.json: the list is read there.
-	predefinedHead string
 }
 
 // Judge runs the case (it is the Judge of a Checker). A failure of the change, of a merge or of a step is a verdict; an error is only a case that cannot
@@ -241,10 +229,6 @@ func (j *Examiner) Judge(ctx context.Context, c *Case) (Outcome, error) {
 	if v := st.judgeAll(ctx); v != nil {
 		return st.finish(ctx, *v), nil
 	}
-	// Every manifest the change touches, judged by the indexer's judge (ADR 0578 §2): a refusal fails the check.
-	if v := st.judgeManifests(ctx); v != nil {
-		return st.finish(ctx, *v), nil
-	}
 	return st.finish(ctx, delivery.Verdict{State: delivery.VerdictPass}), nil
 }
 
@@ -376,7 +360,6 @@ func (st *state) judgeAll(ctx context.Context) *delivery.Verdict {
 			t := &target{pull: p, module: bm}
 			if tc, none := delivery.AgreedToolchain(st.j.Toolchains.Entries(buildrun.LanguageOf[bm])); none == "" {
 				t.toolchain = tc.Version
-				t.agreed = &delivery.ToolchainUsed{Version: tc.Version, Recipe: tc.Recipe}
 			}
 			args := map[string]any{"repository": p.Repository, "commit": p.Head, "ref": refOf(p.Number), "base": p.Trunk}
 			if bm == buildrun.NodeBuildModule && groupPackage != nil && p.Repository != SDKRepository {
@@ -405,7 +388,6 @@ func (st *state) judgeAll(ctx context.Context) *delivery.Verdict {
 		if st.c.Try == nil { // a try owes the indexer no preview: no pull request holds its head
 			st.j.writePreview(ctx, p, merged)
 		}
-		st.judgedByMember(p, merged)
 		if p.Repository == SDKRepository && len(st.c.Pulls) > 1 && st.j.changesPackage(p, merged) {
 			groupPackage = map[string]any{"repository": p.Repository, "commit": p.Head, "ref": refOf(p.Number)}
 		}
@@ -431,7 +413,7 @@ func (st *state) ask(ctx context.Context, t *target, merged *[]Fetched) *deliver
 func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, levels, needs, packages []string) *delivery.Verdict {
 	p := t.pull
 	placed := len(needs) > 0
-	job := &delivery.CheckJob{Fetch: t.fetchArgs, Levels: levels, Kept: true, Packages: packages, Toolchain: t.agreed}
+	job := &delivery.CheckJob{Fetch: t.fetchArgs, Levels: levels, Kept: true, Packages: packages}
 	if st.j.Nodes != nil {
 		names, err := st.j.Nodes.Names(ctx)
 		if err == nil && len(names) == 0 {
@@ -498,12 +480,8 @@ func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, l
 			bound = DefaultDeclineBound
 		}
 		if now.Sub(firstDecline) > bound {
-			lacks := strings.Join(needs, ", ")
-			if lacks == "" {
-				lacks = strings.Join(d.Lacks, ", ") // a node off the agreed toolchain declined it (ADR 0584)
-			}
 			return fail(step.Node, fmt.Sprintf("the check of %s#%d needs a node with %s, and none took it in %s: every node that pulled it lacks it (last %s)",
-				p.Repository, p.Number, lacks, bound, step.Node))
+				p.Repository, p.Number, strings.Join(needs, ", "), bound, step.Node))
 		}
 		st.j.logf("%s#%d: the ask %s was declined on %s, which lacks %s; asked again", p.Repository, p.Number, a.ID, step.Node, strings.Join(d.Lacks, ", "))
 		a.ID, a.At = buildstep.NewID(), now.UTC()

modules/mesh-delivery-checker/internal/check/manifests_judge.go

@@ -1,259 +0,0 @@
-package check
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"maps"
-	"slices"
-	"strings"
-
-	"git.novox.be/novox/mesh-sdk/go/buildstep"
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/composer"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// A change's manifests are judged by the indexer's judge (novox/hq ADR 0578 §2): the checker asks the Go build seat to
-// build the judge's command (mesh-delivery's modules/mesh-delivery-indexer, cmd/mesh-judge) at mesh-delivery's trunk, or
-// at the group's mesh-delivery member head when that member changes the judge, and to run it in its sandbox over the
-// catalogue as the change leaves it, exactly as the composer is run (delivery.ComposeJob, ADR 0482 §4). A manifest the
-// change touches that the judge refuses fails the check, naming the manifest and each problem. The checker links no
-// judge of its own.
-
-// The judge the checker runs.
-const (
-	DeliveryRepository = "novox/mesh-delivery"
-	JudgeDir           = "modules/mesh-delivery-indexer"
-	JudgePackage       = "mesh-delivery-indexer/cmd/mesh-judge"
-	// JudgeCase is the case of a judge request holding the catalogue as the change leaves it, and JudgeTrunk the one
-	// holding it as the trunk holds it: a problem the change case has and the trunk case lacks is the change's (ADR 0579 §2).
-	JudgeCase  = "change"
-	JudgeTrunk = "trunk"
-	// judgeBetween is how the judge names the problems between manifests that no one module's removal ends.
-	judgeBetween = "(between manifests)"
-)
-
-// judgePaths are the paths of mesh-delivery whose change changes the judge: a group whose mesh-delivery member changes
-// one is judged by that member's head.
-var judgePaths = []string{JudgeDir + "/judge/", JudgeDir + "/cmd/mesh-judge/", JudgeDir + "/go.mod", JudgeDir + "/go.sum"}
-
-// changesJudge says whether a merge of mesh-delivery with these changed paths changes the judge.
-func changesJudge(repository string, merged []Fetched) bool {
-	if repository != DeliveryRepository {
-		return false
-	}
-	for _, f := range merged {
-		for _, p := range f.Changed {
-			for _, j := range judgePaths {
-				if p == j || strings.HasPrefix(p, j) {
-					return true
-				}
-			}
-		}
-	}
-	return false
-}
-
-// TrunkManifests says the manifest digest of every module the indexer holds (its modules state), by module.
-type TrunkManifests interface {
-	ManifestDigests() map[string]string
-}
-
-// PredefinedList is the catalogue's list of predefined keys the indexer keeps (its state predefined, key list), the one a
-// config value falling back to a key is judged against (ADR 0348 §7); nil when it keeps none.
-type PredefinedList interface {
-	PredefinedList(ctx context.Context) (json.RawMessage, error)
-}
-
-// judgeRequest is the judge's request over the catalogue as the case leaves it: every trunk manifest by its digest, each
-// one a pull request touches replaced by the digest its candidate names; touched are the modules whose manifest the
-// change adds or changes (a digest the trunk does not hold for it), sorted (novox/hq ADR 0579 §2).
-func judgeRequest(trunk map[string]string, pulls []Pull) (req composer.Request, touched []string) {
-	manifests, before := map[string]composer.Manifest{}, map[string]composer.Manifest{}
-	for module, digest := range trunk {
-		if digest != "" {
-			manifests[module] = composer.Manifest{Digest: digest}
-			before[module] = composer.Manifest{Digest: digest}
-		}
-	}
-	seen := map[string]bool{}
-	for _, p := range pulls {
-		for module, cm := range p.Fps {
-			if cm.Manifest == "" {
-				continue
-			}
-			manifests[module] = composer.Manifest{Digest: cm.Manifest}
-			if trunk[module] != cm.Manifest {
-				seen[module] = true
-			}
-		}
-	}
-	return composer.Request{V: composer.Version, Cases: []composer.Case{{Name: JudgeCase, Manifests: manifests},
-		{Name: JudgeTrunk, Manifests: before}}}, slices.Sorted(maps.Keys(seen))
-}
-
-// judgeManifests runs the indexer's judge over the case's manifests and fails the check for each touched manifest it
-// refuses. A case that touches no manifest, or an examiner that reads no trunk manifests, judges nothing; a judge that
-// cannot be asked or does not answer fails the check, said, never passes it.
-func (st *state) judgeManifests(ctx context.Context) *delivery.Verdict {
-	if st.j.Manifests == nil || st.c.Try != nil {
-		return nil
-	}
-	req, touched := judgeRequest(st.j.Manifests.ManifestDigests(), st.c.Pulls)
-	if len(touched) == 0 {
-		return nil
-	}
-	commit, at := st.judgeHead, "the group's mesh-delivery head "+st.judgeHead
-	if commit == "" {
-		if st.j.Trunks != nil {
-			commit = st.j.Trunks.Heads()[DeliveryRepository]
-		}
-		at = "mesh-delivery's trunk " + commit
-	}
-	if commit == "" {
-		return fail(goModule, "the change's manifests cannot be judged: the trunk head of "+DeliveryRepository+" is not known")
-	}
-	// The list of predefined keys the manifests are judged against (ADR 0578 §2): the catalogue member's predefined.json
-	// when the change alters it, else the one the indexer keeps.
-	if list, from := st.predefinedList(ctx); list != nil {
-		req.Predefined = list
-		st.c.note("the manifests are judged against the predefined keys of " + from)
-	}
-	raw, err := json.Marshal(req)
-	if err != nil {
-		return fail(goModule, err.Error())
-	}
-	job := delivery.ComposeJob{Fetch: map[string]any{"repository": DeliveryRepository, "commit": commit}, Dir: JudgeDir,
-		Package: JudgePackage, Request: raw, Reader: "the indexer's judge at " + at}
-	a := delivery.StepAsk{ID: buildstep.NewID(), Kind: delivery.AskCheck, Language: delivery.AskGo, Asker: delivery.CheckerModule,
-		At: st.j.now().UTC(), Compose: &job}
-	st.c.Progress.Set(fmt.Sprintf("the judge ask %s of the manifests of %s", a.ID, strings.Join(touched, ", ")), "")
-	st.c.Asked(a.ID)
-	if err := st.j.Asks.Put(ctx, a); err != nil {
-		return fail(goModule, "the judge of the change's manifests could not be asked: "+err.Error())
-	}
-	step, err := st.j.Asks.Wait(ctx, a)
-	if err != nil {
-		return fail(goModule, "the judge of the change's manifests: "+err.Error())
-	}
-	cv, trunkCase, why := judgeAnswer(step)
-	if why != "" {
-		return fail(goModule, fmt.Sprintf("the indexer's judge at %s did not judge the change's manifests: %s", at, why))
-	}
-	// A new or changed manifest is judged in full; of one the change leaves as it is, a problem the trunk already had is a
-	// warning (it is not refused for a rule it already broke), and a problem the change causes in it, which the trunk case
-	// lacks, fails the check as the change's (ADR 0579 §2).
-	var refused, warned []string
-	for _, module := range slices.Sorted(maps.Keys(cv.Manifests)) {
-		r := cv.Manifests[module]
-		if r.Accepted || r.Refused == "" {
-			continue
-		}
-		had := map[string]bool{}
-		for _, p := range strings.Split(trunkCase.Manifests[module].Refused, "\n") {
-			had[p] = true
-		}
-		var caused, old []string
-		for _, p := range strings.Split(r.Refused, "\n") {
-			if slices.Contains(touched, module) || !had[p] {
-				caused = append(caused, p)
-			} else {
-				old = append(old, p)
-			}
-		}
-		if len(caused) > 0 {
-			what := "the manifest of " + module
-			if module == judgeBetween {
-				what = "the catalogue"
-			}
-			refused = append(refused, fmt.Sprintf("the indexer's judge at %s refuses %s: %s", at, what, strings.Join(caused, "; ")))
-		}
-		if len(old) > 0 {
-			warned = append(warned, module+": "+strings.Join(old, "; "))
-		}
-	}
-	if len(warned) > 0 {
-		st.c.note("warnings of the indexer's judge on manifests the change leaves as they are (ADR 0579 §2): " + strings.Join(warned, " | "))
-	}
-	if len(refused) > 0 {
-		return fail(goModule, strings.Join(refused, "\n"))
-	}
-	st.c.note(fmt.Sprintf("the manifests of %s are accepted by the indexer's judge at %s", strings.Join(touched, ", "), at))
-	return nil
-}
-
-// judgeAnswer reads the judge's change and trunk cases from its step, or why it cannot.
-func judgeAnswer(step delivery.Step) (change, trunk composer.CaseVerdict, why string) {
-	if step.State != delivery.StepPassed {
-		return change, trunk, fmt.Sprintf("its step %s: %s", step.State, step.Reason)
-	}
-	var a delivery.ComposeAnswer
-	if err := json.Unmarshal(step.Result, &a); err != nil {
-		return change, trunk, "its step's answer cannot be read: " + err.Error()
-	}
-	var v composer.Verdict
-	if err := json.Unmarshal(a.Verdict, &v); err != nil || v.V != composer.Version {
-		return change, trunk, fmt.Sprintf("its verdict cannot be read (version %d): %v", v.V, err)
-	}
-	found := 0
-	for _, c := range v.Cases {
-		switch c.Name {
-		case JudgeCase:
-			change, found = c, found+1
-		case JudgeTrunk:
-			trunk, found = c, found+1
-		}
-	}
-	if found != 2 {
-		return change, trunk, "its verdict does not hold both the cases " + JudgeCase + " and " + JudgeTrunk
-	}
-	return change, trunk, ""
-}
-
-// predefinedList is the list of predefined keys a case's manifests are judged against, and where it comes from: the
-// catalogue member's predefined.json at its head when its merge changes it, else the one the indexer keeps; nil when
-// neither can be read, said, and the judge then takes each fallback as its value declares it.
-func (st *state) predefinedList(ctx context.Context) (catalogue.PredefinedList, string) {
-	read := func(raw []byte, from string) (catalogue.PredefinedList, string) {
-		list, err := catalogue.ParsePredefined(raw)
-		if err != nil {
-			st.c.note("the predefined keys of " + from + " cannot be read, so fallbacks are judged as their values declare them: " + err.Error())
-			return nil, ""
-		}
-		return list, from
-	}
-	if st.predefinedHead != "" && st.j.Forge != nil {
-		text, err := st.j.Forge.File(ctx, catalogueRepository, catalogue.PredefinedFile, st.predefinedHead)
-		if err == nil {
-			return read([]byte(text), "the catalogue member's head "+st.predefinedHead)
-		}
-		st.c.note("the catalogue member's predefined.json cannot be read: " + err.Error())
-	}
-	if st.j.Predefined == nil {
-		return nil, ""
-	}
-	raw, err := st.j.Predefined.PredefinedList(ctx)
-	if err != nil || raw == nil {
-		if err != nil {
-			st.c.note("the indexer's predefined keys cannot be read: " + err.Error())
-		}
-		return nil, ""
-	}
-	return read(raw, "the indexer's kept list")
-}
-
-// judgedByMember notes the group's mesh-delivery member head as the judge's when its merge changes the judge, and the
-// catalogue member's head as where the predefined keys are read when its merge changes predefined.json.
-func (st *state) judgedByMember(p Pull, merged []Fetched) {
-	if changesJudge(p.Repository, merged) {
-		st.judgeHead = p.Head
-	}
-	if p.Repository == catalogueRepository {
-		for _, f := range merged {
-			if slices.Contains(f.Changed, catalogue.PredefinedFile) {
-				st.predefinedHead = p.Head
-			}
-		}
-	}
-}

modules/mesh-delivery-checker/manifest_test.go

@@ -103,7 +103,7 @@ func TestManifestDeclarations(t *testing.T) { // 1678/AC1
 	}
 	if want := []string{"mesh-build-go.steps", "mesh-build-go.toolchains", "mesh-build-node.steps", "mesh-build-node.toolchains",
 		"mesh-delivery-assigner.compositions", "mesh-delivery-assigner.placement", "mesh-delivery-builder.builds", "mesh-delivery-gate.source", "mesh-delivery-gate.turns", "mesh-delivery-indexer.candidates",
-		"mesh-delivery-indexer.manifests", "mesh-delivery-indexer.modules", "mesh-delivery-indexer.predefined", "mesh-delivery-watchman.presence", "node-engine.have"}; !reflect.DeepEqual(sorted(m.Reads), want) {
+		"mesh-delivery-indexer.manifests", "mesh-delivery-indexer.modules", "mesh-delivery-watchman.presence", "node-engine.have"}; !reflect.DeepEqual(sorted(m.Reads), want) {
 		t.Errorf("reads = %v, want %v", m.Reads, want)
 	}
 	// 1887/A5b: the checker reads nothing of the controller's plans-building (ADR 0483 superseded by ADR 0525 §7), calls no

modules/mesh-delivery-checker/module.json

@@ -42,7 +42,6 @@
     "mesh-delivery-indexer.candidates",
     "mesh-delivery-indexer.manifests",
     "mesh-delivery-indexer.modules",
-    "mesh-delivery-indexer.predefined",
     "mesh-delivery-watchman.presence",
     "node-engine.have"
   ],

modules/mesh-delivery-forge-bridge/cmd/mesh-delivery-forge-bridge/integration_test.go

@@ -423,9 +423,7 @@ func TestBridgeWritesMergedMessage(t *testing.T) { // 1236/AC4, 1448/AC5
 	want := delivery.Forge{V: delivery.Version, Kind: "merged", Repository: "novox/mesh-delivery", Branch: "feat/x", Number: 12, Head: head,
 		Merge: merge, Root: "r0", Trees: map[string]string{"": "t0", "modules/a": "t1"},
 		Manifests: map[string]string{"": string(manifest), "modules/a": string(manifest)},
-		Locks:     map[string]map[string]string{"modules/a": {"go.sum": hex.EncodeToString(sha256Sum(sum))}},
-		// The mesh packages its go.sum names (ADR 0573 §2, issue 1585): this module's own go.sum names mesh-sdk.
-		Packages: map[string][]string{"modules/a": {"git.novox.be/novox/mesh-sdk/go"}}}
+		Locks:     map[string]map[string]string{"modules/a": {"go.sum": hex.EncodeToString(sha256Sum(sum))}}}
 	if !delivery.SameForge(f, want) {
 		t.Errorf("message = %+v, want %+v", f, want)
 	}

modules/mesh-delivery-forge-bridge/go.mod

@@ -3,7 +3,7 @@ module mesh-delivery-forge-bridge
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101022206-8af6e7266915
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005726-af4e4e60a3a0
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )

modules/mesh-delivery-forge-bridge/go.sum

@@ -1,5 +1,7 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101022206-8af6e7266915 h1:x8k7IeMirMTxUo8BH+xUO+MDnHYgU+636jl1NIw1wvs=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101022206-8af6e7266915/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030201806-eff81f1220e2 h1:RF73nVI1dTrrmlFosVDTMJmpUQ+rEeB7++BHH/RvZFg=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030201806-eff81f1220e2/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005726-af4e4e60a3a0 h1:q6ywchpTM9fwaJ1UNwDSuOjb5FYDFcsaeiTrKoB4scc=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005726-af4e4e60a3a0/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=

modules/mesh-delivery-indexer/cmd/mesh-delivery-indexer/integration_test.go

@@ -4,9 +4,6 @@ package main
 
 import (
 	"context"
-	"crypto/ecdh"
-	"crypto/rand"
-	"encoding/base64"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -23,8 +20,6 @@ import (
 	"github.com/nats-io/nats.go/jetstream"
 
 	"git.novox.be/novox/mesh-sdk/go/buscompose"
-	"git.novox.be/novox/mesh-sdk/go/compose"
-	"git.novox.be/novox/mesh-sdk/go/compose/frombus"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"git.novox.be/novox/mesh-sdk/go/process"
 )
@@ -234,12 +229,7 @@ func TestIndexerWritesModulesAtAMerge(t *testing.T) { // 1239/AC9; I1, I3: the m
 // TestIndexerKeepsManifestsAtAMerge: a merged message of mesh-catalog carrying the real manifest of the module avahi and the
 // hash of its go.sum (the bridge's Manifests and Locks, issue 1448) makes, within 5 s, modules.avahi with its manifest digest,
 // its inputs and the reason it has no fingerprint of the new form, and manifests.<digest> with the manifest byte for byte.
-//
-// And it judges them (novox/hq ADR 0578, issue 1585): with three manifests more, one valid, one refused and one with a
-// field the decoder does not know, mesh-sdk's bus reader read before the indexer judged composes all three, the field set
-// aside and named (a missing verdict is accepted, §3); the indexer writes the three verdicts, says manifest-refused for
-// each refusal, and the reader then composes the valid one and holds the others, named, never ending its read.
-func TestIndexerKeepsManifestsAtAMerge(t *testing.T) { // 1444/AC4, 1449/AC4, 1585
+func TestIndexerKeepsManifestsAtAMerge(t *testing.T) { // 1444/AC4, 1449/AC4
 	// The manifest is avahi's module.json from mesh-catalog at a67f01963f0d9ef0913a63720b89e573ca7a16ef (copied into the
 	// index package's testdata); the lock hash is the sha256 of modules/avahi/go.sum there.
 	manifest, err := os.ReadFile("../../internal/index/testdata/catalogue-a67f0196-avahi.module.json")
@@ -247,31 +237,14 @@ func TestIndexerKeepsManifestsAtAMerge(t *testing.T) { // 1444/AC4, 1449/AC4, 15
 		t.Fatal(err)
 	}
 	const goSum = "3b5028f0c1e9bde04dd766abd63eb5931bc516bae695cf46f00abcd8510b0381"
-	judged := map[string]string{
-		"good":  `{"module":"good","version":"1","resources":[{"id":"d","type":"directory","path":"/srv/good","mode":"0700"}],"data":{"own":[{"id":"d","path":"${dir:d}","class":"valuable"}]}}`,
-		"bad":   `{"module":"bad","version":"1","provides":[{"name":"amqp"}],"resources":[{"id":"d","type":"directory","path":"/srv/bad","mode":"0700"}],"data":{"own":[{"id":"d","path":"${dir:d}","class":"valuable"}]}}`,
-		"later": `{"module":"later","version":"1","a-field-from-later":1,"resources":[{"id":"d","type":"directory","path":"/srv/later","mode":"0700"}],"data":{"own":[{"id":"d","path":"${dir:d}","class":"valuable"}]}}`,
-	}
 	js, ctx, _, modules := startIndexer(t, func(ctx context.Context, builds buildLog) {
 		builds.end(t, "novox/mesh-catalog", "avahi", "modules/avahi")
-	}, func(ctx context.Context, js jetstream.JetStream) {
-		// The verdicts state and the stream of the indexer's events, as the controller makes them from its manifest.
-		if _, err := js.CreateKeyValue(ctx, jetstream.KeyValueConfig{Bucket: delivery.VerdictsBucket, History: delivery.VerdictsHistory}); err != nil {
-			t.Fatal(err)
-		}
-		if _, err := js.CreateStream(ctx, jetstream.StreamConfig{Name: "INDEXER_EVENTS", Subjects: []string{"mesh.mod.mesh-delivery-indexer.event.>"}}); err != nil {
-			t.Fatal(err)
-		}
 	})
-	forge := delivery.Forge{Kind: delivery.ForgeMerged, Repository: "novox/mesh-catalog", Branch: "feat/x", Number: 301,
+	data, err := delivery.EncodeForge(delivery.Forge{Kind: delivery.ForgeMerged, Repository: "novox/mesh-catalog", Branch: "feat/x", Number: 301,
 		Head: "0123456789abcdef0123456789abcdef01234567", Merge: "89abcdef0123456789abcdef0123456789abcdef", Root: "r0",
 		Trees:     map[string]string{"modules/avahi": "newtree"},
 		Manifests: map[string]string{"modules/avahi": string(manifest)},
-		Locks:     map[string]map[string]string{"modules/avahi": {"go.sum": goSum}}}
-	for name, raw := range judged {
-		forge.Manifests["modules/"+name], forge.Trees["modules/"+name] = raw, "tree-"+name
-	}
-	data, err := delivery.EncodeForge(forge)
+		Locks:     map[string]map[string]string{"modules/avahi": {"go.sum": goSum}}})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -302,156 +275,6 @@ func TestIndexerKeepsManifestsAtAMerge(t *testing.T) { // 1444/AC4, 1449/AC4, 15
 	if got, err := delivery.DecodeManifest(e.Value()); err != nil || got.Module != "avahi" || got.JSON != string(manifest) {
 		t.Errorf("manifest = %+v err %v, want avahi and the file's bytes", got, err)
 	}
-
-	verdicts, err := js.KeyValue(ctx, delivery.VerdictsBucket)
-	if err != nil {
-		t.Fatal(err)
-	}
-	want := map[string]string{"good": delivery.VerdictAccepted, "bad": delivery.VerdictRefused, "later": delivery.VerdictRefused}
-	got := map[string]delivery.ManifestVerdict{}
-	for deadline := time.Now().Add(10 * time.Second); time.Now().Before(deadline) && len(got) < len(want); time.Sleep(50 * time.Millisecond) {
-		for name := range want {
-			if e, err := verdicts.Get(ctx, delivery.ManifestDigest([]byte(judged[name]))); err == nil {
-				if v, err := delivery.DecodeManifestVerdict(e.Value()); err == nil {
-					got[name] = v
-				}
-			}
-		}
-	}
-	for name, state := range want {
-		if v := got[name]; v.State != state || v.Module != name || !strings.HasPrefix(v.Judge, "exe:") {
-			t.Errorf("the verdict on %s = %+v within 10 s, want %s by the running judge", name, v, state)
-		}
-	}
-	if !strings.Contains(strings.Join(got["bad"].Problems, " "), `provides "amqp"`) || !strings.Contains(strings.Join(got["later"].Problems, " "), "a-field-from-later") {
-		t.Errorf("the refusals name no problem: %+v", got)
-	}
-	// manifest-refused, said once for each refusal.
-	events, err := js.Stream(ctx, "INDEXER_EVENTS")
-	if err != nil {
-		t.Fatal(err)
-	}
-	said := map[string]bool{}
-	for seq := uint64(1); ; seq++ {
-		msg, err := events.GetMsg(ctx, seq)
-		if err != nil {
-			break
-		}
-		var r delivery.ManifestRefused
-		if msg.Subject == "mesh.mod.mesh-delivery-indexer.event."+delivery.ManifestRefusedEvent && json.Unmarshal(msg.Data, &r) == nil {
-			said[r.Module] = true
-		}
-	}
-	if !said["bad"] || !said["later"] || said["good"] {
-		t.Errorf("manifest-refused said for %v, want bad and later", said)
-	}
-	// mesh-sdk's bus reader over the indexer's modules and manifests: the refused modules held and named, the valid one
-	// composed, the read whole.
-	r := judgedReader{ctx: ctx, js: js, t: t}
-	items, _, held, err := frombus.DataItemsHeld(ctx, r, frombus.Mesh{}, frombus.Scope{Node: "n1"})
-	if err != nil || len(items["good"]) != 1 || items["bad"] != nil || items["later"] != nil ||
-		!strings.Contains(held["bad"], `provides "amqp"`) || !strings.Contains(held["later"], "a-field-from-later") {
-		t.Errorf("the bus reader after the judge: items %v held %v: %v", items, held, err)
-	}
-	// Before any verdict (a value without one, as an older indexer wrote it), the reader takes each as accepted and names
-	// the field it set aside.
-	for _, name := range []string{"bad", "later"} {
-		e, err := modules.Get(ctx, name)
-		if err != nil {
-			t.Fatal(err)
-		}
-		m, _ := delivery.DecodeModule(e.Value())
-		m.Verdict, m.Problems = "", nil
-		raw, _ := delivery.EncodeModule(m)
-		r.unjudged = append(r.unjudged, raw)
-		if r.values == nil {
-			r.values = map[string][]byte{}
-		}
-		r.values[name] = raw
-	}
-	in, err := frombus.Input(ctx, r, frombus.Mesh{}, frombus.Scope{Node: "n1"})
-	if err != nil || len(in.Refused) != 0 || !strings.Contains(in.SetAside["later"], "a-field-from-later") || in.Catalogue["later"].Stubbed {
-		t.Errorf("the bus reader before the judge: refused %v, set aside %v: %v", in.Refused, in.SetAside, err)
-	}
-}
-
-// judgedReader is mesh-sdk's bus reader over the indexer's modules and manifests on the bus, with good, bad and later placed
-// on n1 and n1's record; values stand in for a module's value where set. It reads nothing else.
-type judgedReader struct {
-	ctx      context.Context
-	js       jetstream.JetStream
-	t        *testing.T
-	values   map[string][]byte
-	unjudged [][]byte
-}
-
-func (r judgedReader) Placements(context.Context) (map[string]delivery.Placement, error) {
-	p := delivery.Placement{Node: "n1", Decided: delivery.NodeDecided{Hub: true, Address: "10.77.0.1"}}
-	for _, m := range []string{"good", "bad", "later"} {
-		p.Modules = append(p.Modules, delivery.PlacedModule{Module: m})
-	}
-	return map[string]delivery.Placement{"n1": p}, nil
-}
-
-func (r judgedReader) Records(context.Context) (map[string]delivery.NodeRecord, error) {
-	k, err := ecdh.X25519().GenerateKey(rand.Reader)
-	if err != nil {
-		return nil, err
-	}
-	return map[string]delivery.NodeRecord{"n1": {Node: "n1", TunnelKey: base64.StdEncoding.EncodeToString(k.PublicKey().Bytes()),
-		SealingKey: "sk", Capabilities: []string{"systemd"}}}, nil
-}
-
-func (r judgedReader) Modules(ctx context.Context) (map[string]delivery.Module, error) {
-	kv, err := r.js.KeyValue(ctx, delivery.ModulesBucket)
-	if err != nil {
-		return nil, err
-	}
-	out := map[string]delivery.Module{}
-	for _, name := range []string{"good", "bad", "later"} {
-		e, err := kv.Get(ctx, name)
-		if err != nil {
-			return nil, err
-		}
-		raw := e.Value()
-		if v, ok := r.values[name]; ok {
-			raw = v
-		}
-		m, err := delivery.DecodeModule(raw)
-		if err != nil {
-			return nil, err
-		}
-		out[name] = m
-	}
-	return out, nil
-}
-
-func (r judgedReader) Manifest(ctx context.Context, digest string) ([]byte, error) {
-	kv, err := r.js.KeyValue(ctx, delivery.ManifestsBucket)
-	if err != nil {
-		return nil, err
-	}
-	e, err := kv.Get(ctx, digest)
-	if err != nil {
-		return nil, err
-	}
-	m, err := delivery.DecodeManifest(e.Value())
-	return []byte(m.JSON), err
-}
-
-func (judgedReader) Values(context.Context, string, string) (map[string]any, error) { return nil, nil }
-func (judgedReader) OwnSecrets(context.Context, string) ([]compose.OwnSecretRow, error) {
-	return nil, nil
-}
-func (judgedReader) Credentials(context.Context, string, []compose.CredentialKey, []compose.CredentialKey) ([]compose.Credential, []compose.Issued, error) {
-	return nil, nil, nil
-}
-func (judgedReader) Build(context.Context, string, string) (*delivery.BuilderBuild, error) {
-	return nil, nil
-}
-func (judgedReader) Archive(context.Context, string, string) ([]byte, error) { return nil, nil }
-func (judgedReader) Served(context.Context, string, string, []string) (map[string]any, error) {
-	return nil, nil
 }
 
 // TestIndexerWritesAGoModuleAgainWhenTheBuildModuleReportsItsToolchain: the bucket mesh-build-go_toolchains exists (the state

modules/mesh-delivery-indexer/cmd/mesh-delivery-indexer/main.go

@@ -291,10 +291,7 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 		return err
 	}
 	defer calls.Close()
-	// The verdicts on manifests (ADR 0578 §1): a state this delivery brings, bound when it appears.
-	verdicts := process.AwaitBucket(ctx, js, conn, index.VerdictsBucket, "no verdict on a manifest is written", logger.Printf)
 	ix := &index.Indexer{Store: kvStore{candidates}, Modules: kvStore{modules}, Manifests: kvStore{manifests}, Taken: awaitedStore{taken}, Builds: known,
-		Verdicts: awaitedStore{verdicts}, SayRefused: sayRefused(js, cred, logger.Printf),
 		Predefined: awaitedStore{predefined}, ConfigCandidates: awaitedStore{configCandidates}, Logf: logger.Printf,
 		Named: namedVia(calls.Call), Trunk: trunkVia(calls.Call), Contains: containsVia(calls.Call), Read: readVia(calls.Call),
 		ReadOpen: openVia(calls.Call)}
@@ -388,19 +385,6 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 	if err := ix.Reconcile(ctx); err != nil {
 		logger.Printf("dropping the modules the trunk does not hold at start: %v", err)
 	}
-	// Every manifest judged at the start, so a judge that changed with this program judges every one again (ADR 0578
-	// §1), once the verdicts state is there; each merge judges them again (index.ApplyMessage).
-	verdicts.Ready(func(jetstream.KeyValue) {
-		// A pass that fails (a read the bus did not answer) is judged again at the next message or source revision the
-		// indexer hears (index.kickJudge): no timer.
-		j, err := ix.JudgeAtStart(ctx)
-		if err != nil {
-			logger.Printf("judging the manifests at start: %v; judged again at the next message heard", err)
-			return
-		}
-		logger.Printf("judged %d manifests at start: %d verdicts written, %d with problems, of which outgrown and kept accepted: %v",
-			j.Judged, j.Written, len(j.Refused), j.Outgrown)
-	})
 	// A build module says each time it wrote its toolchains key: its stream, and the indexer's durable consumer on it, are
 	// made by the controller as the forge's are. Where the stream is not there yet the indexer says so and is started again
 	// with the build module, as with the gate's source.

modules/mesh-delivery-indexer/cmd/mesh-delivery-indexer/verdicts.go

@@ -1,38 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/process"
-	"github.com/nats-io/nats.go"
-	"github.com/nats-io/nats.go/jetstream"
-)
-
-// sayRefused says the indexer's event manifest-refused (novox/hq ADR 0578 §1): mesh.mod.<module>.event.manifest-refused,
-// with the SDK's envelope headers and the digest and judge as the bus's dedup id, so one refusal is said once.
-func sayRefused(js jetstream.JetStream, cred process.Account, logf func(string, ...any)) func(context.Context, delivery.ManifestRefused) {
-	return func(ctx context.Context, r delivery.ManifestRefused) {
-		data, err := json.Marshal(r)
-		if err != nil {
-			logf("judge: %s for %s is not said: %v", delivery.ManifestRefusedEvent, r.Module, err)
-			return
-		}
-		msg := nats.NewMsg(cred.EventSubject(delivery.ManifestRefusedEvent))
-		id := "manifest-refused-" + r.Digest + "-" + r.Judge
-		msg.Header.Set("x-event-id", id)
-		msg.Header.Set("x-source", cred.Module)
-		msg.Header.Set("x-node", cred.Node)
-		msg.Header.Set("x-time", time.Now().UTC().Format(time.RFC3339Nano))
-		msg.Header.Set("content-type", "application/json")
-		msg.Data = data
-		pub, cancel := context.WithTimeout(context.WithoutCancel(ctx), 10*time.Second)
-		defer cancel()
-		if _, err := js.PublishMsg(pub, msg, jetstream.WithMsgID(id)); err != nil {
-			logf("judge: %s", fmt.Errorf("saying %s for %s: %w", delivery.ManifestRefusedEvent, r.Module, err))
-		}
-	}
-}

modules/mesh-delivery-indexer/cmd/mesh-judge/main.go

@@ -1,61 +0,0 @@
-// Command mesh-judge is the indexer's judge as a program the checker runs (novox/hq ADR 0578 §2): built at the trunk, or
-// at a group's mesh-delivery head when that head changes the judge, and run by a Go build module's compose step in its
-// sandbox exactly as the composer is (ADR 0482 §4; delivery.ComposeJob with this package). It reads a composer request
-// (mesh-sdk composer.Request; `-request <file>`, or its standard input) and writes one line, a composer verdict, whose
-// cases say of each manifest whether the judge accepts it and, when not, every problem. It reads nothing else: no bus,
-// store, network or environment.
-package main
-
-import (
-	"encoding/json"
-	"flag"
-	"fmt"
-	"io"
-	"os"
-
-	"git.novox.be/novox/mesh-sdk/go/composer"
-
-	"mesh-delivery-indexer/judge"
-)
-
-// Package is this command's import path in the indexer's Go module (the directory delivery.ComposeJob's Dir names).
-const Package = "mesh-delivery-indexer/cmd/mesh-judge"
-
-func main() { os.Exit(run(os.Args[1:], os.Stdin, os.Stdout, os.Stderr)) }
-
-func run(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
-	flags := flag.NewFlagSet("mesh-judge", flag.ContinueOnError)
-	flags.SetOutput(stderr)
-	file := flags.String("request", "", "the request's file; without it, the standard input")
-	if err := flags.Parse(args); err != nil {
-		return 2
-	}
-	var raw []byte
-	var err error
-	if *file != "" {
-		raw, err = os.ReadFile(*file)
-	} else {
-		raw, err = io.ReadAll(stdin)
-	}
-	if err != nil {
-		fmt.Fprintln(stderr, "mesh-judge:", err)
-		return 1
-	}
-	r, err := composer.Decode(raw)
-	if err != nil {
-		fmt.Fprintln(stderr, "mesh-judge:", err)
-		return 1
-	}
-	v, err := judge.Request(r)
-	if err != nil {
-		fmt.Fprintln(stderr, "mesh-judge:", err)
-		return 1
-	}
-	out, err := json.Marshal(v)
-	if err != nil {
-		fmt.Fprintln(stderr, "mesh-judge:", err)
-		return 1
-	}
-	fmt.Fprintln(stdout, string(out))
-	return 0
-}

modules/mesh-delivery-indexer/go.mod

@@ -3,7 +3,7 @@ module mesh-delivery-indexer
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101143343-67354f8e019a
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005726-af4e4e60a3a0
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )

modules/mesh-delivery-indexer/go.sum

@@ -1,5 +1,7 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101143343-67354f8e019a h1:AChSJUmHyOZ5smiuTrtDZNjetYNTFb+anRFjXIQHbSA=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101143343-67354f8e019a/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a h1:DcSvfEmdPBKqCg5OmXRNb269EkkPe7BsEp+RykEhkgE=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005726-af4e4e60a3a0 h1:q6ywchpTM9fwaJ1UNwDSuOjb5FYDFcsaeiTrKoB4scc=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005726-af4e4e60a3a0/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=

modules/mesh-delivery-indexer/internal/beside/beside.go

@@ -1,148 +0,0 @@
-// Package beside is where a test finds another repository of the mesh it reads: the catalogue's manifests,
-// the node-engine's genesis template (novox/hq issue 432), the SDK's conformance fixtures (issue 449).
-//
-// Copied from mesh-controller internal/beside at commit 6c2a8d62 (R4b, issue 1379); the one change is that Dir
-// lays out the captured copy of a repository once per process, not once per test (see laidOut). In mesh-sdk the
-// catalogue's tests read mesh-catalog and mesh-host only; the captured copy holds just what they read.
-//
-// A test used to read the checkout beside this one, `../../../mesh-catalog`, so its verdict depended on
-// whatever sat on the machine running it: a stale or dirty checkout failed it on a desktop, and where none
-// was beside it skipped and said nothing. Now there are two inputs, both named, and no third:
-//
-//   - In a merge check, the build seat clones each core repository beside the one checked (the catalogue
-//     at its main, the node-engine at the commit the mesh runs) and says where in MESH_CHECK_BESIDE. A
-//     test judges against those clones, so agreement with the other repository is checked where
-//     `mesh/repo-check` runs; a repository missing there fails the test, never skips it. Which clones a
-//     check gets is chosen from the inventory: mesh-catalog by the source of the `nats` module, mesh-host
-//     by the source of `mesh-host`, and mesh-sdk as the controller's sibling at the commit the controller's
-//     go.mod pins. Each repository's tests read these siblings, and the checker places exactly these
-//     (mesh-delivery's checker, besideRules, follows this list): mesh-controller's read mesh-catalog,
-//     mesh-host and mesh-sdk; mesh-host's read mesh-catalog, mesh-sdk and mesh-controller (its step-nine
-//     test reads the controller's own manifest, novox/hq issue 1295); mesh-sdk's read mesh-catalog and
-//     mesh-host; mesh-catalog's read mesh-sdk and mesh-controller; mesh-delivery's read mesh-sdk and
-//     mesh-catalog. In a mesh where either module has no source repository nothing is
-//     cloned, and these tests fail loudly with "not beside this check": a cause in the setup, not in the
-//     change. And in a delivery group that holds a mesh-catalog pull request, these tests read the
-//     catalogue's main, not the group's head.
-//   - Anywhere else, the test judges against the copy captured in this repository's testdata/beside, at the
-//     commit testdata/beside/CAPTURED names. Never against a developer's own checkout: to judge one, set
-//     MESH_CHECK_BESIDE to the directory holding it, as the check does.
-//
-// The captured manifests are named module.json.captured, and put back as module.json in a directory of
-// the test's own: a module.json anywhere in this repository is a module of it to the forge's announcer and
-// the planner, and a merge would build and register a hundred copies of the catalogue's.
-package beside
-
-import (
-	"io/fs"
-	"os"
-	"path/filepath"
-	"runtime"
-	"strings"
-	"sync"
-	"testing"
-)
-
-// Env is where a merge check says the repositories cloned beside the one checked are (internal/builder's
-// EnvBeside, repeated here so a test does not import the builder).
-const Env = "MESH_CHECK_BESIDE"
-
-// CapturedSuffix is what a captured file's name carries that the repository's own does not.
-const CapturedSuffix = ".captured"
-
-// notPlaced are the repositories the checker places beside no mesh-delivery check (besideRules in
-// mesh-delivery-checker/internal/check/beside.go places mesh-sdk and the catalogue): a test reads them from the captured
-// copy even in a merge check, and says so (issue 1585). Every other sibling missing from a merge check fails the test.
-var notPlaced = map[string]bool{"mesh-host": true}
-
-// Dir is the named repository a test reads — the clone beside a merge check, or the captured copy — and
-// says which in the test's log.
-func Dir(t testing.TB, repository string) string {
-	t.Helper()
-	root := os.Getenv(Env)
-	if root != "" {
-		dir := filepath.Join(root, repository)
-		_, err := os.Stat(dir)
-		switch {
-		case err == nil:
-			t.Logf("judged against %s as cloned beside this check", dir)
-			return dir
-		case !notPlaced[repository]:
-			// A sibling the checker places that is missing is the checker's fault, never judged against a stale copy.
-			t.Fatalf("%s is not beside this check in %s=%s, so its agreement with this repository cannot be "+
-				"judged here: %v", repository, Env, root, err)
-		}
-	}
-	from := filepath.Join(Captured(), repository)
-	if _, err := os.Stat(from); err != nil {
-		t.Fatalf("no captured copy of %s at %s: %v", repository, from, err)
-	}
-	if root != "" {
-		t.Logf("%s is not beside this check in %s=%s (the checker places it beside no mesh-delivery check): read from "+
-			"its captured copy", repository, Env, root)
-	}
-	dir, err := layOut(repository, from)
-	if err != nil {
-		t.Fatalf("the captured copy of %s could not be laid out: %v", repository, err)
-	}
-	t.Logf("judged against the copy of %s captured in testdata/beside (see CAPTURED); a merge check "+
-		"judges it against the repository's own clone", repository)
-	return dir
-}
-
-// laidOut is the captured copies already put back in place in this process, by repository. A copy is
-// read-only to every test, so it is laid out once per process and not once per test: with a copy per test
-// the catalogue's tests alone took 2.14 s, over mesh-sdk's unit bound of 2 s, and with one 0.81 s (measured
-// 2026-10-20). The directories are in the temp directory, which the system clears; a process cannot remove
-// them while another test may still read them.
-var (
-	laidOutMu sync.Mutex
-	laidOut   = map[string]string{}
-)
-
-func layOut(repository, from string) (string, error) {
-	laidOutMu.Lock()
-	defer laidOutMu.Unlock()
-	if dir, ok := laidOut[repository]; ok {
-		return dir, nil
-	}
-	root, err := os.MkdirTemp("", "beside-")
-	if err != nil {
-		return "", err
-	}
-	dir := filepath.Join(root, repository)
-	err = filepath.WalkDir(from, func(path string, d fs.DirEntry, err error) error {
-		if err != nil {
-			return err
-		}
-		rel, _ := filepath.Rel(from, path)
-		into := filepath.Join(dir, strings.TrimSuffix(rel, CapturedSuffix))
-		if d.IsDir() {
-			return os.MkdirAll(into, 0o755)
-		}
-		raw, err := os.ReadFile(path)
-		if err != nil {
-			return err
-		}
-		return os.WriteFile(into, raw, 0o644)
-	})
-	if err != nil {
-		os.RemoveAll(root)
-		return "", err
-	}
-	laidOut[repository] = dir
-	return dir, nil
-}
-
-// Catalogue is the catalogue's modules directory, as Dir finds the catalogue.
-func Catalogue(t testing.TB) string {
-	t.Helper()
-	return filepath.Join(Dir(t, "mesh-catalog"), "modules")
-}
-
-// Captured is this repository's testdata/beside, found from this file rather than from the working
-// directory, so a test in any package reaches it.
-func Captured() string {
-	_, file, _, _ := runtime.Caller(0)
-	return filepath.Join(filepath.Dir(file), "..", "..", "testdata", "beside")
-}

modules/mesh-delivery-indexer/internal/index/candidates.go

@@ -52,12 +52,6 @@ type Indexer struct {
 	Predefined, ConfigCandidates Store
 	// Taken is the taken bucket: per repository the last merge taken in (taken.go, ADR 0556); nil writes none.
 	Taken Store
-	// Verdicts is the verdicts state (verdicts.go, novox/hq ADR 0578 §1); nil judges nothing.
-	Verdicts Store
-	// JudgeID names the judge a verdict says made it; empty is judge.Identity, the running program's.
-	JudgeID string
-	// SayRefused says the event manifest-refused for a refusal newly written; nil says nothing.
-	SayRefused func(ctx context.Context, r delivery.ManifestRefused)
 	// Now is the clock of a taken value; nil is time.Now.
 	Now    func() time.Time
 	Builds *Builds
@@ -78,20 +72,19 @@ type Indexer struct {
 	// closed message the indexer missed heals at the next one (issue 1126); nil asks none.
 	ReadOpen func(ctx context.Context) ([]delivery.OpenPull, error)
 
-	mu           sync.Mutex // guards source, toolchains and previews, which the watches and the forge messages all reach
-	source       sourceNow
-	previews     map[string]delivery.Preview              // by previews key (previews.go)
-	toolchains   map[string]map[string]delivery.Toolchain // language, then node (toolchains.go)
-	tried        map[string]bool                          // repository, commit and directory a registered module's manifest was tried at (registered.go)
-	unread       map[string]bool                          // registered modules whose last read the forge could not answer, read again by RetryUnread
-	retrying     atomic.Bool                              // a RetryUnread runs in the background (kickRetry)
-	retryAgain   atomic.Bool                              // an event asked for one more RetryUnread after the running one
-	retryWG      sync.WaitGroup                           // the background RetryUnread, for tests to wait on
-	recompute    sync.Mutex                               // one Recompute at a time
-	untaken      map[string]string                        // repository to the latest merge applied while the taken state was missing (taken.go)
-	filling      atomic.Bool                              // a FillTaken runs in the background (KickFill)
-	fillAgain    atomic.Bool                              // a kick arrived while it ran
-	judgePending atomic.Bool                              // the start's judge pass failed: judged again at the next message (verdicts.go)
+	mu         sync.Mutex // guards source, toolchains and previews, which the watches and the forge messages all reach
+	source     sourceNow
+	previews   map[string]delivery.Preview              // by previews key (previews.go)
+	toolchains map[string]map[string]delivery.Toolchain // language, then node (toolchains.go)
+	tried      map[string]bool                          // repository, commit and directory a registered module's manifest was tried at (registered.go)
+	unread     map[string]bool                          // registered modules whose last read the forge could not answer, read again by RetryUnread
+	retrying   atomic.Bool                              // a RetryUnread runs in the background (kickRetry)
+	retryAgain atomic.Bool                              // an event asked for one more RetryUnread after the running one
+	retryWG    sync.WaitGroup                           // the background RetryUnread, for tests to wait on
+	recompute  sync.Mutex                               // one Recompute at a time
+	untaken    map[string]string                        // repository to the latest merge applied while the taken state was missing (taken.go)
+	filling    atomic.Bool                              // a FillTaken runs in the background (KickFill)
+	fillAgain  atomic.Bool                              // a kick arrived while it ran
 }
 
 func (ix *Indexer) logf(format string, args ...any) {
@@ -112,7 +105,6 @@ func (ix *Indexer) Apply(ctx context.Context, f delivery.Forge) error {
 // ApplyMessage is Apply, and answers which modules a merged message wrote and kept (for the indexer's heard state). Each
 // applied merged message is said in one line: its repository, commit and pull request, and the modules written.
 func (ix *Indexer) ApplyMessage(ctx context.Context, f delivery.Forge) (Applied, error) {
-	ix.kickJudge(ctx)
 	var applied Applied
 	if f.Kind == delivery.ForgeOpen {
 		return applied, ix.applyOpen(ctx, f)
@@ -139,11 +131,6 @@ func (ix *Indexer) ApplyMessage(ctx context.Context, f delivery.Forge) (Applied,
 			if err := ix.configCandidatesAfterMerge(ctx, f, writtenModules(w.written)); err != nil {
 				return applied, err
 			}
-			// Every manifest judged again: a rule between manifests can turn on the one this merge moved (ADR 0578 §1).
-			// What this take-in newly wrote is fresh: judged in full (ADR 0579 §1).
-			if _, err := ix.JudgeAll(ctx, w.fresh); err != nil {
-				ix.logf("judge: the manifests are not judged after %s#%d: %v", f.Repository, f.Number, err)
-			}
 		}
 		ix.kickRetry(ctx) // a registered module the forge could not read is read again on a merge, in the background (issue 1945)
 	}

modules/mesh-delivery-indexer/internal/index/inputs.go

@@ -9,8 +9,6 @@ import (
 
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-
-	"mesh-delivery-indexer/judge"
 )
 
 // The reasons a module has no fingerprint of the new form while the indexer writes none for any module (novox/hq
@@ -72,7 +70,7 @@ func inputsOf(module, raw, tree string, locks map[string]string, base baseFP) mo
 // packages are the mesh packages of other repositories the module's go.sum names (novox/hq ADR 0573 §2): a module with a
 // Go artifact keeps them, and the fingerprint takes the latest published version of each (Recompute).
 func inputsOfNamed(module, raw, tree string, locks, objects map[string]string, packages []string, base baseFP) moduleInputs {
-	m, err := judge.ForInputs([]byte(raw))
+	m, err := catalogue.ParseManifestForInputs([]byte(raw))
 	if err != nil {
 		return moduleInputs{None2: None2Unreadable + err.Error()}
 	}

modules/mesh-delivery-indexer/internal/index/modules.go

@@ -7,9 +7,8 @@ import (
 	"slices"
 	"strings"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-
-	"mesh-delivery-indexer/judge"
 )
 
 // applyMerged writes, for each module whose manifest the merged message carries (each directory of the merge commit that
@@ -155,7 +154,7 @@ func (ix *Indexer) namedObjects(ctx context.Context, f delivery.Forge) (map[stri
 	objects := map[string]map[string]string{}
 	need := map[string][]string{}
 	for dir, raw := range f.Manifests {
-		m, err := judge.ForInputs([]byte(raw))
+		m, err := catalogue.ParseManifestForInputs([]byte(raw))
 		if err != nil {
 			continue // inputsOfNamed says why
 		}

modules/mesh-delivery-indexer/internal/index/order.go

@@ -34,16 +34,6 @@ type mergeWrite struct {
 	late              string // the taken merge this one is older than, or ""
 	asked             string // the taken merge the order was asked against, or "" when none was asked
 	written           []string
-	// fresh are the manifest digests this take-in newly wrote: a new module's, or a changed one's (ADR 0579 §1).
-	fresh map[string]bool
-}
-
-// taken marks a digest this take-in newly wrote.
-func (w *mergeWrite) taken(digest string) {
-	if w.fresh == nil {
-		w.fresh = map[string]bool{}
-	}
-	w.fresh[digest] = true
 }
 
 func newMergeWrite(f delivery.Forge) *mergeWrite {

modules/mesh-delivery-indexer/internal/index/predefined_test.go

@@ -19,7 +19,9 @@ func TestAManifestFallingBackToAPredefinedKeyIsRead(t *testing.T) { // 1751
 			t.Errorf("%s: inputs = %+v, want the manifest read and its inputs kept", module, in)
 		}
 	}
-	// A predefined key of another type than its value is still refused: the read judges what it can.
+}
+
+func TestAPredefinedKeyOfAnotherTypeThanItsValueIsStillRefused(t *testing.T) { // 1751: the read judges what it can
 	raw := strings.Replace(fixture(t, "catalogue-835bf22b-xterm"), `"predefined": "font-size"`, `"predefined": "font-size", "trusted": "yes"`, 1)
 	if in := inputsOf("xterm", raw, "newtree", nil, func(string) (string, string) { return "", "none" }); in.Kept != nil {
 		t.Errorf("inputs = %+v, want a manifest the catalogue refuses still refused", in)

modules/mesh-delivery-indexer/internal/index/registered.go

@@ -134,14 +134,9 @@ func (ix *Indexer) indexAt(ctx context.Context, r Registration, force, reread bo
 	if p := read.Packages[dir]; len(p) > 0 {
 		f.Packages = map[string][]string{dir: p}
 	}
-	w, err := ix.applyManifests(ctx, f, false)
-	if err != nil {
+	if _, err := ix.applyManifests(ctx, f, false); err != nil {
 		return t, err
 	}
-	// A module registered or taken in is judged as a merge's are (ADR 0578 §1, ADR 0579 §1).
-	if _, err := ix.JudgeAll(ctx, w.fresh); err != nil {
-		ix.logf("judge: the manifests are not judged after taking in %s: %v", r.Module, err)
-	}
 	if _, _, found, err := ix.Modules.Get(ctx, key); err != nil {
 		return t, fmt.Errorf("modules.%s: %w", key, err)
 	} else if !found {

modules/mesh-delivery-indexer/internal/index/source.go

@@ -37,7 +37,6 @@ func (ix *Indexer) srcOf(repository, merge string) uint64 {
 // when it is written, applyMerged), and a repository none of the indexer's modules is built from writes nothing. The
 // modules of a repository are those the modules bucket holds of it (ADR 0501 clause 6).
 func (ix *Indexer) ApplySource(ctx context.Context, rev uint64, s delivery.Source) error {
-	ix.kickJudge(ctx)
 	ix.mu.Lock()
 	if rev < ix.source.rev {
 		ix.mu.Unlock()

modules/mesh-delivery-indexer/internal/index/toolchains.go

@@ -10,8 +10,6 @@ import (
 
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-
-	"mesh-delivery-indexer/judge"
 )
 
 // The new-form fingerprint of a module is written, and written again with no merge, when what it is of changes
@@ -256,10 +254,7 @@ func (ix *Indexer) recomputeModules(ctx context.Context, overlay map[string]deli
 		}
 		// The latest published version of each mesh package the module uses: the trunk merge of the module that holds it,
 		// as this recompute holds it, so a package's merge moves every dependent in the same recompute (ADR 0573 §2).
-		versions, unpublished := delivery.PackageVersionsOf(kept.Packages, held)
-		if len(unpublished) > 0 {
-			ix.logf("%s: no module the indexer holds publishes %s, so its fingerprint takes no version of it", module, strings.Join(unpublished, ", "))
-		}
+		versions, _ := delivery.PackageVersionsOf(kept.Packages, held)
 		var r result
 		switch {
 		case k.contexts:
@@ -351,19 +346,10 @@ func (ix *Indexer) writeOverlay(ctx context.Context, overlay, finals map[string]
 		wrote := false
 		err := write(ctx, ix.Modules, key, func(value []byte, found bool) ([]byte, bool, error) {
 			wrote = false
-			next := next
-			cur, err := delivery.DecodeModule(value)
-			held := found && err == nil
-			if held && cur.Manifest == next.Manifest {
-				// The judge's verdict stands while the digest does (ADR 0578 §3, ADR 0579 §1): a recompute never writes a
-				// refused or outgrown module as accepted; only the judge changes it.
-				next.Verdict, next.Problems, next.Warnings = cur.Verdict, cur.Problems, cur.Warnings
-			}
-			if held && sameButWhere(cur, next) {
-				return nil, false, nil
-			}
-			if next.Manifest != "" && (!held || cur.Manifest != next.Manifest) {
-				w.taken(next.Manifest) // a new module, or a changed manifest: fresh, judged in full (ADR 0579 §1)
+			if found {
+				if cur, err := delivery.DecodeModule(value); err == nil && sameButWhere(cur, next) {
+					return nil, false, nil
+				}
 			}
 			data, err := delivery.EncodeModule(next)
 			wrote = err == nil
@@ -379,12 +365,10 @@ func (ix *Indexer) writeOverlay(ctx context.Context, overlay, finals map[string]
 	return nil
 }
 
-// sameButWhere says the held value cur is next but for where it was computed (Commit and Src) and the judge's verdict,
-// which only the judge writes: the module is unchanged.
+// sameButWhere says the held value cur is next but for where it was computed (Commit and Src): the module is unchanged.
 func sameButWhere(cur, next delivery.Module) bool {
 	next = withV(next)
 	next.Commit, next.Src = cur.Commit, cur.Src
-	next.Verdict, next.Problems, next.Warnings = cur.Verdict, cur.Problems, cur.Warnings
 	return reflect.DeepEqual(cur, next)
 }
 
@@ -405,7 +389,7 @@ func (ix *Indexer) manifestRaw(ctx context.Context, digest string) (string, cata
 	if err != nil {
 		return "", catalogue.Manifest{}, err
 	}
-	m, err := judge.ForInputs([]byte(kept.JSON))
+	m, err := catalogue.ParseManifestForInputs([]byte(kept.JSON))
 	return kept.JSON, m, err
 }
 

modules/mesh-delivery-indexer/internal/index/verdicts.go

@@ -1,228 +0,0 @@
-package index
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"maps"
-	"slices"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/process"
-
-	"mesh-delivery-indexer/judge"
-)
-
-// The indexer judges every manifest it holds, once, with its own judge (novox/hq ADR 0578 §1): it writes each verdict in
-// its state verdicts (delivery.VerdictsBucket), one key per manifest digest, only when the verdict differs from the one
-// held; a module's value in the modules state carries a refusal (Verdict, Problems), so a reader of modules takes it
-// without a second read; a new refusal is said as the event manifest-refused. It judges at its start, so a judge that
-// changed (a new indexer) judges every manifest again, and after every merge it takes in, since a rule between manifests
-// can turn on any of them. Nothing polls.
-
-// VerdictsBucket is the indexer's state of verdicts.
-var VerdictsBucket = delivery.VerdictsBucket
-
-// Judged is what one pass of the judge did: the manifests judged, the verdicts written, and the modules refused.
-type Judged struct {
-	Judged, Written int
-	Refused         map[string][]string
-	// Outgrown are the modules accepted before whose problems are now warnings (ADR 0579 §1).
-	Outgrown []string
-}
-
-// JudgeAll judges every manifest the modules state names, as one catalogue with the predefined list the indexer keeps,
-// and writes what differs. A manifest the manifests state does not hold is left unjudged and said; a write that fails is
-// said and the pass goes on, so one key never costs the others their verdict.
-//
-// **A stricter judge never refuses what it accepted before** (novox/hq ADR 0579 §1): a manifest whose verdict under its
-// digest is accepted, or which the indexer held before any verdict (taken as accepted, ADR 0578 §3) and is not in fresh,
-// stays accepted, the new problems written as the verdict's Warnings and carried in its module's value, which the
-// watchman raises as manifest-outgrown. A manifest in fresh (the digests a merge just took in) with no verdict yet, and
-// one already refused, is judged in full.
-func (ix *Indexer) JudgeAll(ctx context.Context, fresh map[string]bool) (Judged, error) {
-	var out Judged
-	if ix.Verdicts == nil || ix.Modules == nil || ix.Manifests == nil {
-		return out, nil
-	}
-	held, err := ix.heldModules(ctx)
-	if err != nil {
-		return out, err
-	}
-	raws := map[string][]byte{}
-	digests := map[string]string{}
-	for _, name := range slices.Sorted(maps.Keys(held)) {
-		digest := held[name].Manifest
-		if digest == "" {
-			continue
-		}
-		value, _, found, err := ix.Manifests.Get(ctx, digest)
-		if err != nil {
-			return out, fmt.Errorf("reading manifests.%s of %s: %w", digest, name, err)
-		}
-		if !found {
-			ix.logf("judge: the manifest of %s (digest %s) is not in the manifests state, so it is not judged", name, digest)
-			continue
-		}
-		kept, err := delivery.DecodeManifest(value)
-		if err != nil {
-			ix.logf("judge: manifests.%s of %s cannot be read, so it is not judged: %v", digest, name, err)
-			continue
-		}
-		raws[name] = []byte(kept.JSON)
-		digests[name] = digest
-	}
-	refused, unnamed := judge.Shelf(raws, ix.predefinedList(ctx), 0)
-	for _, p := range unnamed {
-		ix.logf("judge: a problem between the manifests that no one module's removal ends, so it refuses none: %s", p)
-	}
-	out.Refused = refused
-	id := ix.JudgeID
-	if id == "" {
-		id = judge.Identity()
-	}
-	for _, name := range slices.Sorted(maps.Keys(digests)) {
-		out.Judged++
-		v := delivery.ManifestVerdict{Module: name, State: delivery.VerdictAccepted, Judge: id, At: ix.now()}
-		if problems := refused[name]; len(problems) > 0 {
-			if ix.acceptedBefore(ctx, digests[name], fresh) {
-				v.Warnings = problems
-				out.Outgrown = append(out.Outgrown, name)
-			} else {
-				v.State, v.Problems = delivery.VerdictRefused, problems
-			}
-		}
-		wrote, err := ix.writeVerdict(ctx, digests[name], v)
-		if errors.Is(err, process.ErrNotYet) {
-			return out, fmt.Errorf("the state %s is not on the bus yet: %w", VerdictsBucket, err)
-		}
-		if err != nil {
-			ix.logf("judge: the verdict on %s (digest %s) is not written: %v", name, digests[name], err)
-			continue
-		}
-		if wrote {
-			out.Written++
-			if v.Refused() {
-				ix.logf("judge: %s", v.Why())
-				if ix.SayRefused != nil {
-					ix.SayRefused(ctx, delivery.RefusedOf(digests[name], v))
-				}
-			}
-		}
-		if err := ix.carryVerdict(ctx, name, digests[name], v); err != nil {
-			ix.logf("judge: modules.%s does not carry its verdict: %v", name, err)
-		}
-	}
-	return out, nil
-}
-
-// JudgeAtStart is JudgeAll of every manifest held, none fresh, as the indexer starts (a judge that changed judges every
-// one again); one that fails is judged again at the next message or source revision heard (kickJudge).
-func (ix *Indexer) JudgeAtStart(ctx context.Context) (Judged, error) {
-	j, err := ix.JudgeAll(ctx, nil)
-	ix.judgePending.Store(err != nil)
-	return j, err
-}
-
-// kickJudge judges again a start pass that failed, when the indexer hears something: never on a timer.
-func (ix *Indexer) kickJudge(ctx context.Context) {
-	if !ix.judgePending.Load() {
-		return
-	}
-	if j, err := ix.JudgeAtStart(ctx); err != nil {
-		ix.logf("judge: the manifests are still not judged: %v", err)
-	} else {
-		ix.logf("judge: judged %d manifests again after a failed start: %d verdicts written", j.Judged, j.Written)
-	}
-}
-
-// acceptedBefore says whether the manifest of digest was accepted before this judgement: its verdict says accepted, or
-// it has none and is not fresh (held before any verdict, so taken in under the judges that ran until then).
-func (ix *Indexer) acceptedBefore(ctx context.Context, digest string, fresh map[string]bool) bool {
-	value, _, found, err := ix.Verdicts.Get(ctx, digest)
-	if err != nil {
-		return false // unread: judged in full, said by the write that follows
-	}
-	if !found {
-		return !fresh[digest]
-	}
-	prev, err := delivery.DecodeManifestVerdict(value)
-	return err == nil && !prev.Refused()
-}
-
-// writeVerdict writes v under the digest's key unless the verdict held there says the same (ManifestVerdict.Same); wrote
-// says it was written.
-func (ix *Indexer) writeVerdict(ctx context.Context, digest string, v delivery.ManifestVerdict) (wrote bool, err error) {
-	key, err := delivery.VerdictsKey(digest)
-	if err != nil {
-		return false, err
-	}
-	err = write(ctx, ix.Verdicts, key, func(value []byte, found bool) ([]byte, bool, error) {
-		wrote = false
-		if found {
-			if cur, err := delivery.DecodeManifestVerdict(value); err == nil && cur.Same(v) {
-				return nil, false, nil
-			}
-		}
-		wrote = true
-		next, err := delivery.EncodeManifestVerdict(v)
-		return next, false, err
-	})
-	return wrote, err
-}
-
-// carryVerdict puts a refusal into the module's value, and takes one out once the manifest is accepted, while the value
-// still names the digest judged; an accepted module's value carries nothing, so judging writes no value of a module the
-// judge accepts (a reader takes a value without a verdict as accepted, delivery.TakeManifestVerdict).
-func (ix *Indexer) carryVerdict(ctx context.Context, name, digest string, v delivery.ManifestVerdict) error {
-	key, err := delivery.ModulesKey(name)
-	if err != nil {
-		return err
-	}
-	return write(ctx, ix.Modules, key, func(value []byte, found bool) ([]byte, bool, error) {
-		if !found {
-			return nil, false, nil
-		}
-		cur, err := delivery.DecodeModule(value)
-		if err != nil || cur.Manifest != digest {
-			return nil, false, nil // gone, unreadable, or moved to another manifest since: the next pass judges it
-		}
-		state := ""
-		if v.Refused() {
-			state = delivery.VerdictRefused
-		}
-		if cur.Verdict == state && slices.Equal(cur.Problems, v.Problems) && slices.Equal(cur.Warnings, v.Warnings) {
-			return nil, false, nil
-		}
-		cur.Verdict, cur.Problems, cur.Warnings = state, v.Problems, v.Warnings
-		if state == "" {
-			cur.Problems = nil
-		}
-		next, err := delivery.EncodeModule(cur)
-		return next, false, err
-	})
-}
-
-// predefinedList is the catalogue's predefined list the indexer keeps (writePredefined), or nil when it keeps none or
-// it cannot be read: the judge then takes each fallback as its value declares it.
-func (ix *Indexer) predefinedList(ctx context.Context) catalogue.PredefinedList {
-	if ix.Predefined == nil {
-		return nil
-	}
-	value, _, found, err := ix.Predefined.Get(ctx, delivery.PredefinedListKey)
-	if err != nil || !found {
-		return nil
-	}
-	var kept delivery.PredefinedKept
-	if json.Unmarshal(value, &kept) != nil {
-		return nil
-	}
-	list, err := catalogue.ParsePredefined(kept.List)
-	if err != nil {
-		ix.logf("judge: the predefined list kept cannot be read, so fallbacks are judged as their values declare them: %v", err)
-		return nil
-	}
-	return list
-}

modules/mesh-delivery-indexer/internal/index/verdicts_test.go

@@ -1,126 +0,0 @@
-package index
-
-import (
-	"context"
-	"strings"
-	"testing"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// The indexer judges every manifest it holds and writes each verdict only when it differs; a module's value carries a
-// refusal, which is said once as manifest-refused; a new judge writes again only what it judges otherwise; a manifest
-// mended clears the module's refusal (novox/hq ADR 0578 §1).
-func TestTheIndexerJudgesEveryManifestOnce(t *testing.T) {
-	ctx := context.Background()
-	ix := &Indexer{Modules: newMem(), Manifests: newMem(), Verdicts: newMem(), JudgeID: "judge-1",
-		Now: func() time.Time { return time.Date(2026, 11, 1, 3, 0, 0, 0, time.UTC) }}
-	var said []delivery.ManifestRefused
-	ix.SayRefused = func(_ context.Context, r delivery.ManifestRefused) { said = append(said, r) }
-	hold := func(module, raw string) string {
-		digest, err := ix.keepManifest(ctx, module, raw)
-		if err != nil {
-			t.Fatal(err)
-		}
-		value, err := delivery.EncodeModule(delivery.Module{FP2: "src2:" + strings.Repeat("a", 64), Manifest: digest,
-			Repository: "novox/mesh-catalog", Commit: "c"})
-		if err != nil {
-			t.Fatal(err)
-		}
-		ix.Modules.(*memStore).put(module, value)
-		return digest
-	}
-	good := hold("good", `{"module":"good","version":"1"}`)
-	bad := hold("bad", `{"module":"bad","version":"1","requires":["amqp"]}`)
-	// Both taken in by a merge: judged in full.
-	j, err := ix.JudgeAll(ctx, map[string]bool{good: true, bad: true})
-	if err != nil || j.Judged != 2 || j.Written != 2 || len(j.Refused) != 1 {
-		t.Fatalf("the first pass: %+v %v", j, err)
-	}
-	verdict := func(digest string) delivery.ManifestVerdict {
-		value, _, found, _ := ix.Verdicts.Get(ctx, digest)
-		v, err := delivery.DecodeManifestVerdict(value)
-		if !found || err != nil {
-			t.Fatalf("no verdict under %s: %v", digest, err)
-		}
-		return v
-	}
-	if v := verdict(good); v.Refused() || v.Judge != "judge-1" {
-		t.Fatalf("good: %+v", v)
-	}
-	if v := verdict(bad); !v.Refused() || !strings.Contains(v.Problems[0], `requires "amqp"`) {
-		t.Fatalf("bad: %+v", v)
-	}
-	module := func(name string) delivery.Module {
-		value, _, _, _ := ix.Modules.Get(ctx, name)
-		m, err := delivery.DecodeModule(value)
-		if err != nil {
-			t.Fatal(err)
-		}
-		return m
-	}
-	if m := module("bad"); m.Verdict != delivery.VerdictRefused || len(m.Problems) != 1 {
-		t.Fatalf("modules.bad carries %+v", m)
-	}
-	if m := module("good"); m.Verdict != "" {
-		t.Fatalf("modules.good carries %q", m.Verdict)
-	}
-	if len(said) != 1 || said[0].Module != "bad" || said[0].Digest != bad || said[0].Judge != "judge-1" {
-		t.Fatalf("said %+v", said)
-	}
-	// A new judge that judges alike writes nothing and says nothing again.
-	ix.JudgeID = "judge-2"
-	if j, err := ix.JudgeAll(ctx, nil); err != nil || j.Written != 0 || len(said) != 1 {
-		t.Fatalf("a judge that judges alike: %+v %v, said %d", j, err, len(said))
-	}
-	// The manifest mended: its new digest is accepted and the module's refusal goes.
-	mended := hold("bad", `{"module":"bad","version":"2"}`)
-	if j, err := ix.JudgeAll(ctx, map[string]bool{mended: true}); err != nil || j.Written != 1 || len(j.Refused) != 0 {
-		t.Fatalf("mended: %+v %v", j, err)
-	}
-	if m := module("bad"); m.Verdict != "" || m.Problems != nil {
-		t.Fatalf("modules.bad still carries %+v", m)
-	}
-	// ADR 0579 §1: a manifest held before any verdict (taken in under the judges until then), which this judge finds a
-	// problem in, stays accepted with the problem as a warning, carried in its value and said nowhere as a refusal; the
-	// same problem in a manifest a merge takes in now, or in one whose digest changed, is refused in full.
-	old := hold("old", `{"module":"old","version":"1","requires":["amqp"]}`)
-	if j, err := ix.JudgeAll(ctx, nil); err != nil || len(j.Outgrown) != 1 || j.Outgrown[0] != "old" {
-		t.Fatalf("an outgrown manifest: %+v %v", j, err)
-	}
-	if v := verdict(old); v.Refused() || len(v.Warnings) != 1 || !strings.Contains(v.Warnings[0], `requires "amqp"`) {
-		t.Fatalf("old: %+v", v)
-	}
-	if m := module("old"); m.Verdict != "" || len(m.Warnings) != 1 || len(said) != 1 {
-		t.Fatalf("modules.old carries %+v, said %d", m, len(said))
-	}
-	changed := hold("old", `{"module":"old","version":"2","requires":["amqp"]}`)
-	fresh := hold("new", `{"module":"new","version":"1","requires":["amqp"]}`)
-	if j, err := ix.JudgeAll(ctx, map[string]bool{changed: true, fresh: true}); err != nil || len(j.Outgrown) != 0 {
-		t.Fatalf("a changed and a new manifest: %+v %v", j, err)
-	}
-	if !verdict(changed).Refused() || !verdict(fresh).Refused() || module("old").Verdict != delivery.VerdictRefused || len(module("old").Warnings) != 0 {
-		t.Fatalf("the changed and the new manifest are not refused: %+v %+v", verdict(changed), verdict(fresh))
-	}
-	// A merge's write of a module whose digest it leaves as it is carries the verdict over, and nothing is fresh; a changed
-	// digest is fresh, judged in full (review R1, R2).
-	w := &mergeWrite{}
-	same := delivery.Module{FP2: "src2:" + strings.Repeat("c", 64), Manifest: changed, Repository: "novox/mesh-catalog", Commit: "c2"}
-	if err := ix.writeOverlay(ctx, map[string]delivery.Module{"old": same}, nil, w); err != nil {
-		t.Fatal(err)
-	}
-	if m := module("old"); m.Verdict != delivery.VerdictRefused || len(m.Problems) == 0 || len(w.fresh) != 0 {
-		t.Fatalf("a merge rewrote a refused module as %+v, fresh %v", m, w.fresh)
-	}
-	other := strings.Repeat("d", 64)
-	same.Manifest = other
-	if err := ix.writeOverlay(ctx, map[string]delivery.Module{"old": same}, nil, w); err != nil || !w.fresh[other] {
-		t.Fatalf("a changed digest is not fresh: %v %v", w.fresh, err)
-	}
-	// Without the verdicts state the indexer judges nothing.
-	ix.Verdicts = nil
-	if j, err := ix.JudgeAll(ctx, nil); err != nil || j.Judged != 0 {
-		t.Fatalf("without the state: %+v %v", j, err)
-	}
-}

modules/mesh-delivery-indexer/judge/judge.go

@@ -1,279 +0,0 @@
-// Package judge is the mesh's one judge of module manifests (novox/hq ADR 0578 §1, §2): strict decoding, the seat and
-// namespace rules, the bus and stream limits, and the rules between the manifests of one catalogue. Only the indexer,
-// which judges every manifest it takes in and writes the verdicts (delivery.VerdictsBucket), and the checker, which
-// judges every manifest a change touches by running this judge built at the trunk or a group's head (cmd/mesh-judge,
-// as the composer is run), use it. Every other part decodes a manifest leniently (catalogue.Decode) and takes the
-// verdict; it never judges (ADR 0578 §3).
-//
-// Its rules are still mesh-sdk's catalogue functions it calls; they leave mesh-sdk for this package in the group's last
-// mesh-sdk commit, once no reader imports them (ADR 0578 §7, issue 1585 S19). Callers depend only on what this package
-// answers, so that move changes nothing for them.
-package judge
-
-import (
-	"crypto/sha256"
-	"encoding/hex"
-	json "encoding/json"
-	"fmt"
-	"io"
-	"maps"
-	"os"
-	filepath "path/filepath"
-	"regexp"
-	"slices"
-	"sort"
-	"strings"
-	"sync"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/composer"
-)
-
-// Manifest judges one manifest alone: decoded strictly, and every rule a manifest is held to by itself. The list of
-// predefined keys is the one a config value falling back to a key is judged against (ADR 0348 §7); nil judges each
-// fallback as its value declares it, where no list is at hand. Problems is empty when the manifest is accepted, and
-// then m is the manifest as the judge read it.
-func Manifest(raw []byte, predefined catalogue.PredefinedList) (m catalogue.Manifest, problems []string) {
-	var err error
-	if predefined != nil {
-		m, err = ParseManifestWith(raw, predefined)
-	} else {
-		m, err = ParseManifestForInputs(raw)
-	}
-	if err != nil {
-		return catalogue.Manifest{}, problemsOf(err)
-	}
-	return m, nil
-}
-
-// ForInputs is Manifest worded as the strict parser words a refusal: the indexer's read of a manifest for the inputs of its
-// fingerprint, which keeps a refused manifest's reason in its value (None2) as it always has.
-func ForInputs(raw []byte) (catalogue.Manifest, error) {
-	return ParseManifestForInputs(raw)
-}
-
-// listedRefusal is how the strict parser words a refusal of several problems, one per line after its header.
-const listedRefusal = "this manifest cannot be used:\n  - "
-
-// problemsOf splits the strict parser's refusal into its problems, one each.
-func problemsOf(err error) []string {
-	text := err.Error()
-	if rest, ok := strings.CutPrefix(text, listedRefusal); ok {
-		return strings.Split(rest, "\n  - ")
-	}
-	return []string{text}
-}
-
-// Shelf judges every manifest of one catalogue, by the name it is given under (a module's name): each alone (Manifest),
-// then the rules between the manifests accepted alone (Between). A problem between manifests is a problem of each module
-// whose removal from the catalogue ends it (a rule two modules break together refuses both); one no removal ends is in
-// unnamed, for the caller to say. A module not in the answer is accepted.
-func Shelf(raws map[string][]byte, predefined catalogue.PredefinedList, longestMachine int) (refused map[string][]string, unnamed []string) {
-	refused = map[string][]string{}
-	shelf := catalogue.Shelf{}
-	for name, raw := range raws {
-		m, problems := Manifest(raw, predefined)
-		if len(problems) > 0 {
-			refused[name] = problems
-			continue
-		}
-		if m.Module != name {
-			refused[name] = []string{fmt.Sprintf("the manifest is of module %q, not %q", m.Module, name)}
-			continue
-		}
-		shelf[name] = m
-	}
-	between := Between(shelf, longestMachine)
-	without := map[string]map[string]bool{} // by module: the problems between the rest, once asked
-	ends := func(module, problem string) bool {
-		if without[module] == nil {
-			rest := maps.Clone(shelf)
-			delete(rest, module)
-			without[module] = map[string]bool{}
-			for _, p := range Between(rest, longestMachine) {
-				without[module][p] = true
-			}
-		}
-		return !without[module][problem]
-	}
-	for _, p := range between {
-		// The modules it names are asked first; only when none of them ends it is every module asked.
-		var of []string
-		for _, name := range Named(p, shelf) {
-			if ends(name, p) {
-				of = append(of, name)
-			}
-		}
-		if len(of) == 0 {
-			for _, name := range slices.Sorted(maps.Keys(shelf)) {
-				if ends(name, p) {
-					of = append(of, name)
-				}
-			}
-		}
-		if len(of) == 0 {
-			unnamed = append(unnamed, p)
-			continue
-		}
-		for _, name := range of {
-			refused[name] = append(refused[name], p)
-		}
-	}
-	for name := range refused {
-		sort.Strings(refused[name])
-	}
-	return refused, unnamed
-}
-
-// Between is every problem between the manifests of shelf, sorted: catalogue.CatalogueProblems, IdentityProblems over
-// the longest machine name (catalogue.DefaultLongestMachine when not above 0) and DataProblems.
-func Between(shelf catalogue.Shelf, longestMachine int) []string {
-	if longestMachine <= 0 {
-		longestMachine = catalogue.DefaultLongestMachine
-	}
-	between := CatalogueProblems(shelf)
-	between = append(between, IdentityProblems(shelf, longestMachine)...)
-	between = append(between, DataProblems(shelf)...)
-	sort.Strings(between)
-	return slices.Compact(between)
-}
-
-// nameChar is a character a module's name may hold; a name is named in a text only where none borders it.
-var nameChar = regexp.MustCompile(`[a-z0-9.-]`)
-
-// Named is every module of shelf a problem names, as a word of its own (not part of a longer name), sorted: the modules
-// Shelf asks first whether their removal ends the problem. A module named only as a word ("mounts" in "f1-circuits
-// mounts its directory") is not blamed for it, since its removal ends nothing.
-func Named(problem string, shelf catalogue.Shelf) []string {
-	var out []string
-	for name := range shelf {
-		for at := 0; ; {
-			i := strings.Index(problem[at:], name)
-			if i < 0 {
-				break
-			}
-			i += at
-			end := i + len(name)
-			before := i == 0 || !nameChar.MatchString(problem[i-1:i])
-			after := end == len(problem) || !nameChar.MatchString(problem[end:end+1]) ||
-				// A sentence's full stop after a name ends it.
-				(problem[end] == '.' && (end+1 == len(problem) || problem[end+1] == ' '))
-			if before && after {
-				out = append(out, name)
-				break
-			}
-			at = i + 1
-		}
-	}
-	sort.Strings(out)
-	return out
-}
-
-// Unnamed names, in a request's case verdict, the problems between manifests that no one module's removal ends.
-const Unnamed = "(between manifests)"
-
-// Request judges every case of a composer request (mesh-sdk composer.Request), what cmd/mesh-judge answers the checker:
-// each case's manifests as one catalogue (Shelf), every manifest accepted or refused with its problems, one per line; the
-// problems no module's removal ends under Between. The verdict's SDK names this judge (Identity). A manifest left as a
-// digest, or a case named twice, is a request it cannot run.
-func Request(r composer.Request) (composer.Verdict, error) {
-	v := composer.Verdict{V: composer.Version, SDK: Identity()}
-	seen := map[string]bool{}
-	for _, c := range r.Cases {
-		if seen[c.Name] {
-			return composer.Verdict{}, fmt.Errorf("the case %q is named twice", c.Name)
-		}
-		seen[c.Name] = true
-		raws := map[string][]byte{}
-		for name, m := range c.Manifests {
-			if len(m.Raw) == 0 {
-				return composer.Verdict{}, fmt.Errorf("%w: %s (digest %s)", composer.ErrUnfilled, name, m.Digest)
-			}
-			raws[name] = m.Raw
-		}
-		refused, unnamed := Shelf(raws, r.Predefined, 0)
-		cv := composer.CaseVerdict{Name: c.Name, Manifests: map[string]composer.ManifestRead{}}
-		for name := range raws {
-			if problems := refused[name]; len(problems) > 0 {
-				cv.Manifests[name] = composer.ManifestRead{Refused: strings.Join(problems, "\n")}
-				continue
-			}
-			cv.Manifests[name] = composer.ManifestRead{Accepted: true}
-		}
-		if len(unnamed) > 0 {
-			cv.Manifests[Unnamed] = composer.ManifestRead{Refused: strings.Join(unnamed, "\n")}
-		}
-		v.Cases = append(v.Cases, cv)
-	}
-	return v, nil
-}
-
-var (
-	identityOnce sync.Once
-	identity     string
-)
-
-// Identity names this judge: the sha256 of the running program, "exe:" and 16 hex digits, so a verdict says which judge
-// made it and the indexer knows its judge changed when the program it runs does. "unknown" when the program cannot be
-// read.
-func Identity() string {
-	identityOnce.Do(func() {
-		identity = "unknown"
-		path, err := os.Executable()
-		if err != nil {
-			return
-		}
-		f, err := os.Open(path)
-		if err != nil {
-			return
-		}
-		defer f.Close()
-		h := sha256.New()
-		if _, err := io.Copy(h, f); err != nil {
-			return
-		}
-		identity = "exe:" + hex.EncodeToString(h.Sum(nil)[:8])
-	})
-	return identity
-}
-
-// WithTemplatesFrom is catalogue.WithTemplatesFrom judged: m with each template's text read from dir, then judged again
-// as filled, against the list of predefined keys m was read with (a template's text can ask for what the manifest
-// does not declare). The catalogue's reader only fills it (novox/hq ADR 0578 §3); judging the result is this judge's.
-func WithTemplatesFrom(m catalogue.Manifest, dir string) (catalogue.Manifest, error) {
-	filled, err := catalogue.WithTemplatesFrom(m, dir)
-	if err != nil {
-		return catalogue.Manifest{}, err
-	}
-	// Judged as it composes without its build's templates archive, as the catalogue judged it before (template.go).
-	filled.Moved = false
-	raw, err := json.Marshal(filled)
-	if err != nil {
-		return catalogue.Manifest{}, err
-	}
-	again, err := parseManifest(raw, m.Predefined())
-	if err != nil {
-		return catalogue.Manifest{}, err
-	}
-	again.Moved = m.Moved
-	return again, nil
-}
-
-// ReadTreeManifest is the manifest in a module's directory of a repository tree judged as the merge gate judges it:
-// strictly, against the list of predefined keys at the tree's root, then with each template's text read from its
-// directory and judged again (WithTemplatesFrom).
-func ReadTreeManifest(root, dir string) (catalogue.Manifest, error) {
-	list, err := catalogue.ReadPredefined(root)
-	if err != nil {
-		return catalogue.Manifest{}, err
-	}
-	raw, err := os.ReadFile(filepath.Join(dir, "module.json"))
-	if err != nil {
-		return catalogue.Manifest{}, err
-	}
-	m, err := ParseManifestWith(raw, list)
-	if err != nil {
-		return catalogue.Manifest{}, err
-	}
-	return WithTemplatesFrom(m, dir)
-}

modules/mesh-delivery-indexer/judge/judge_test.go

@@ -1,93 +0,0 @@
-package judge
-
-import (
-	"encoding/json"
-	"reflect"
-	"strings"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/composer"
-	"git.novox.be/novox/mesh-sdk/go/overlay"
-)
-
-// The judge (novox/hq ADR 0578 §1): a manifest alone is accepted, or refused with each problem; an unknown field is
-// refused (strict decoding); a rule between manifests refuses every module it names, and a word inside a longer name
-// is no naming.
-func TestTheJudge(t *testing.T) {
-	for _, row := range []struct {
-		name string
-		raws map[string]string
-		want map[string]string // module: a word of its first problem; absent: accepted
-	}{
-		{name: "a valid manifest", raws: map[string]string{"a": `{"module":"a","version":"1"}`}},
-		{name: "a refused manifest", raws: map[string]string{"a": `{"module":"a","version":"1","provides":[{"name":"amqp"}]}`},
-			want: map[string]string{"a": `provides "amqp", which is not a provision`}},
-		{name: "a provision named as a credential's", raws: map[string]string{"a": `{"module":"a","version":"1","provides":[{"name":"secret-db","scope":"mesh"}]}`},
-			want: map[string]string{"a": `secret-`}},
-		{name: "an unknown field", raws: map[string]string{"a": `{"module":"a","version":"1","a-field-from-later":1}`},
-			want: map[string]string{"a": `"a-field-from-later"`}},
-		{name: "a manifest under another name", raws: map[string]string{"b": `{"module":"a","version":"1"}`},
-			want: map[string]string{"b": `of module "a", not "b"`}},
-		{name: "a seat declared twice",
-			raws: map[string]string{
-				"one": `{"module":"one","version":"1","seats":[{"name":"thing","scope":"mesh"}]}`,
-				"two": `{"module":"two","version":"1","seats":[{"name":"thing","scope":"mesh"}]}`,
-				"ok":  `{"module":"ok","version":"1"}`},
-			want: map[string]string{"one": "already declares", "two": "already declares"}},
-	} {
-		raws := map[string][]byte{}
-		for k, v := range row.raws {
-			raws[k] = []byte(v)
-		}
-		refused, unnamed := Shelf(raws, nil, 0)
-		if len(unnamed) > 0 {
-			t.Errorf("%s: unnamed %v", row.name, unnamed)
-		}
-		if len(refused) != len(row.want) {
-			t.Errorf("%s: refused %v, want %v", row.name, refused, row.want)
-			continue
-		}
-		for m, word := range row.want {
-			if len(refused[m]) == 0 || !strings.Contains(strings.Join(refused[m], "\n"), word) {
-				t.Errorf("%s: %s refused with %v, want %q", row.name, m, refused[m], word)
-			}
-		}
-	}
-	// The private network's manifest, which the mesh provides itself, is accepted (moved from mesh-sdk overlay's test).
-	if raw, err := json.Marshal(overlay.Manifest()); err != nil {
-		t.Fatal(err)
-	} else if _, problems := Manifest(raw, nil); len(problems) > 0 {
-		t.Errorf("the provided private network is refused: %v", problems)
-	}
-	shelf := catalogue.Shelf{"nats": {}, "mesh-nats": {}, "a.b": {}}
-	for problem, want := range map[string][]string{
-		"nats removes a stream":                   {"nats"},
-		"mesh-nats reads nats.":                   {"mesh-nats", "nats"},
-		"the state nats.modules and mesh-natsy":   nil,
-		"a.b and a.bc":                            {"a.b"},
-		`"nats" is quoted, (mesh-nats) bracketed`: {"mesh-nats", "nats"},
-	} {
-		if got := Named(problem, shelf); !reflect.DeepEqual(got, want) {
-			t.Errorf("Named(%q) = %v, want %v", problem, got, want)
-		}
-	}
-	if id := Identity(); !strings.HasPrefix(id, "exe:") || id != Identity() {
-		t.Errorf("identity %q", id)
-	}
-	// What cmd/mesh-judge answers the checker (ADR 0578 §2): a composer request in, a verdict out, each manifest accepted
-	// or refused; a manifest left as a digest is a request it cannot run.
-	r := composer.Request{V: composer.Version, Cases: []composer.Case{{Name: "change", Manifests: map[string]composer.Manifest{
-		"a": {Raw: json.RawMessage(`{"module":"a","version":"1"}`)},
-		"b": {Raw: json.RawMessage(`{"module":"b","version":"1","requires":["amqp"]}`)},
-	}}}}
-	v, err := Request(r)
-	if err != nil || v.V != composer.Version || len(v.Cases) != 1 || v.SDK != Identity() || !v.Cases[0].Manifests["a"].Accepted ||
-		v.Cases[0].Manifests["b"].Accepted || !strings.Contains(v.Cases[0].Manifests["b"].Refused, `requires "amqp"`) {
-		t.Fatalf("request: %+v %v", v, err)
-	}
-	r.Cases[0].Manifests["c"] = composer.Manifest{Digest: strings.Repeat("a", 64)}
-	if _, err := Request(r); err == nil {
-		t.Fatal("a manifest left as a digest was judged")
-	}
-}

modules/mesh-delivery-indexer/judge/reads-outside

@@ -1 +0,0 @@
-These tests read files outside this directory: the catalogue and the node-engine captured in the module's testdata/beside (internal/beside).

modules/mesh-delivery-indexer/judge/testdata/catalogue-835bf22b-claude-code.module.json

@@ -1,249 +0,0 @@
-{
-  "module": "claude-code",
-  "version": "1",
-  "moved": true,
-  "slug": "agent",
-  "capabilities": [
-    "package-manager"
-  ],
-  "requires": [
-    "mcp-endpoint",
-    {
-      "name": "gitea-read",
-      "optional": true
-    }
-  ],
-  "binds": {
-    "mcp-endpoint": "${dir:state}/mcp-endpoint.json"
-  },
-  "secrets": {
-    "gitea-read": "${dir:state}/gitea-read.secret"
-  },
-  "uses": [
-    "operator-channel"
-  ],
-  "state": [
-    "servers",
-    "holdings",
-    "config",
-    "proposals",
-    "questions",
-    "memory",
-    "waits"
-  ],
-  "reads": [
-    "claude-licence-manager.bindings"
-  ],
-  "tools": [
-    "claude_code_status",
-    "claude_code_render",
-    "claude_code_guard",
-    "claude_code_pull",
-    "claude_code_grant",
-    "claude_code_add_api_key",
-    "claude_code_registrations",
-    "claude_code_memory",
-    "claude_code_mcp_list",
-    "claude_code_mcp_register",
-    "claude_code_mcp_unregister",
-    "claude_code_skill_list",
-    "claude_code_skill_register",
-    "claude_code_skill_unregister",
-    "claude_code_agent_list",
-    "claude_code_agent_register",
-    "claude_code_agent_unregister",
-    "claude_code_command_list",
-    "claude_code_command_register",
-    "claude_code_command_unregister",
-    "claude_code_hook_list",
-    "claude_code_hook_register",
-    "claude_code_hook_unregister",
-    "claude_code_output_style_list",
-    "claude_code_output_style_register",
-    "claude_code_output_style_unregister",
-    "claude_code_instructions_list",
-    "claude_code_instructions_register",
-    "claude_code_instructions_unregister",
-    "claude_code_instructions_propose",
-    "claude_code_proposals",
-    "claude_code_ask",
-    "claude_code_answer",
-    "claude_code_wait",
-    "claude_code_settings_get",
-    "claude_code_settings_set",
-    "claude_code_settings_clear",
-    "claude_code_permission_add",
-    "claude_code_permission_remove",
-    "claude_code_config_list",
-    "claude_code_config_show",
-    "claude_code_config_status",
-    "claude_code_config_import",
-    "claude_code_home_show",
-    "claude_code_home_remove",
-    "claude_code_home_removed",
-    "claude_code_home_restore",
-    "claude_code_judge",
-    "claude_code_judged"
-  ],
-  "data": {
-    "own": [
-      {
-        "id": "agent-home",
-        "path": "${dir:agent-home}",
-        "class": "valuable",
-        "why": "the operator's agent's own files: its memory, history and projects"
-      }
-    ]
-  },
-  "config": {
-    "role": {
-      "type": "string",
-      "description": "What this machine is for, in a sentence, written into the instructions every Claude Code session on it reads; empty says nothing.",
-      "trusted": true,
-      "default": ""
-    },
-    "mcp_servers": {
-      "type": "object",
-      "description": "The tool servers every session on this machine is given beside the mesh's own, by name, each as Claude Code's managed MCP configuration takes it; empty adds none.",
-      "trusted": true,
-      "default": {}
-    },
-    "managed_settings": {
-      "type": "object",
-      "description": "Keys of Claude Code's managed settings every session on this machine obeys, such as spinnerTipsEnabled, laid over the mesh's own; empty adds none. Falls back to agent-managed-settings, the mesh's or this node's.",
-      "trusted": true,
-      "predefined": "agent-managed-settings",
-      "default": {}
-    },
-    "instructions": {
-      "type": "object",
-      "description": "The instructions every session on this machine reads, by name, each a text as one line or a list of its lines; empty adds none.",
-      "trusted": true,
-      "default": {}
-    },
-    "output_styles": {
-      "type": "object",
-      "description": "The output styles offered to every session on this machine, by name, each a text as one line or a list of its lines; empty adds none.",
-      "trusted": true,
-      "default": {}
-    },
-    "skills": {
-      "type": "object",
-      "description": "The skills offered to every session on this machine, by name, each its files by path, a text as one line or a list of its lines; a skill without its SKILL.md is left out; empty adds none.",
-      "trusted": true,
-      "default": {}
-    },
-    "commands": {
-      "type": "object",
-      "description": "The slash commands offered to every session on this machine, by name, each a text as one line or a list of its lines; empty adds none.",
-      "trusted": true,
-      "default": {}
-    },
-    "agents": {
-      "type": "object",
-      "description": "The agents offered to every session on this machine, by name, each a text as one line or a list of its lines; empty adds none.",
-      "trusted": true,
-      "default": {}
-    }
-  },
-  "resources": [
-    {
-      "id": "package",
-      "type": "package",
-      "package": "claude-code"
-    },
-    {
-      "id": "managed",
-      "type": "directory",
-      "path": "/etc/claude-code",
-      "mode": "0755",
-      "unknown": "program"
-    },
-    {
-      "id": "start",
-      "type": "file",
-      "path": "/usr/local/bin/claude-agent",
-      "mode": "0755",
-      "template": "files/claude-agent"
-    },
-    {
-      "id": "agent-account-name",
-      "type": "file",
-      "path": "/etc/claude-code/agent-account",
-      "mode": "0644",
-      "template": "files/agent-account"
-    },
-    {
-      "id": "agent-account",
-      "type": "user",
-      "name": "${machine:agent-account}",
-      "home": "${machine:agent-home}",
-      "root": "${machine:agent-root}"
-    },
-    {
-      "id": "agent-home",
-      "type": "directory",
-      "path": "${machine:agent-home}/.claude",
-      "mode": "0700",
-      "owner": "${machine:agent-account}",
-      "unknown": "module"
-    },
-    {
-      "id": "state",
-      "type": "directory",
-      "mode": "0700",
-      "owner": "${machine:account}",
-      "place": ".",
-      "unknown": "program"
-    },
-    {
-      "id": "facts",
-      "type": "file",
-      "path": "${dir:state}/facts.json",
-      "mode": "0600",
-      "owner": "${machine:account}",
-      "template": "files/facts.json"
-    },
-    {
-      "id": "settings",
-      "type": "file",
-      "path": "${dir:state}/settings.json",
-      "mode": "0600",
-      "owner": "${machine:account}",
-      "takes-config": ["role", "mcp_servers", "managed_settings", "instructions", "output_styles", "skills", "commands", "agents"],
-      "merge": "json",
-      "template": "files/settings.json"
-    }
-  ],
-  "items": [
-    {
-      "collection": "shell:zsh:normal",
-      "template": "files/zsh-normal"
-    }
-  ],
-  "build": {
-    "artifacts": [
-      {
-        "name": "tools",
-        "kind": "bundle",
-        "language": "go",
-        "system": "arch",
-        "from": "cmd/claude-code",
-        "binary": "claude-code",
-        "loads": [
-          "claude-code"
-        ],
-        "env": {
-          "MESH_CLAUDE_CODE_STATE": "${dir:state}",
-          "MESH_CLAUDE_CODE_FACTS": "${dir:state}/facts.json",
-          "MESH_CLAUDE_CODE_SETTINGS": "${dir:state}/settings.json"
-        }
-      },
-      {
-        "name": "files",
-        "kind": "archive",
-        "from": "files"
-      }
-    ]
-  }
-}

modules/mesh-delivery-indexer/judge/testdata/catalogue-835bf22b-dunst.module.json

@@ -1,123 +0,0 @@
-{
-  "module": "dunst",
-  "version": "1",
-  "moved": true,
-  "capabilities": [
-    "package-manager"
-  ],
-  "claims": [
-    {
-      "name": "node-notifier",
-      "scope": "node",
-      "serves": [
-        "send",
-        "history"
-      ]
-    }
-  ],
-  "tools": [
-    "dunst_pause",
-    "dunst_resume",
-    "dunst_close_all",
-    "dunst_rules",
-    "dunst_count",
-    "dunst_reload"
-  ],
-    "config": {
-      "font-size": {
-        "type": "number",
-        "description": "The size of a notification's text, in points of Inter: 10 reads well on a screen of about 100 DPI, and a denser screen needs a larger size.",
-        "minimum": 6,
-        "maximum": 72,
-        "predefined": "font-size",
-        "default": 10
-      },
-      "width": {
-        "type": "number",
-        "description": "The width of a notification, in pixels: 250 fits a title of about forty characters at 10 points, and a larger font needs a wider notification.",
-        "minimum": 50,
-        "maximum": 4000,
-        "default": 250
-      }
-    },
-  "resources": [
-    {
-      "id": "package",
-      "type": "package",
-      "package": "dunst"
-    },
-    {
-      "id": "client",
-      "type": "package",
-      "package": "libnotify"
-    },
-    {
-      "id": "configuration-dir",
-      "type": "directory",
-      "path": "${machine:account-home}/.config/dunst",
-      "owner": "${machine:account}",
-      "mode": "0755",
-      "unknown": "move-out"
-    },
-    {
-      "id": "dropins",
-      "type": "directory",
-      "path": "${machine:account-home}/.config/dunst/dunstrc.d",
-      "owner": "${machine:account}",
-      "mode": "0755",
-      "unknown": "move-out",
-      "knows": ["50-slack.conf"]
-    },
-    {
-      "id": "configuration",
-      "trusted": false,
-      "type": "file",
-      "path": "${machine:account-home}/.config/dunst/dunstrc",
-      "owner": "${machine:account}",
-      "mode": "0644",
-      "template": "files/dunstrc"
-    },
-    {
-      "id": "notifier",
-      "type": "service",
-      "unit": "dunst.service",
-      "scope": "user",
-      "user": "${machine:account}",
-      "reload-on": [
-        "configuration"
-      ]
-    }
-  ],
-  "build": {
-    "artifacts": [
-      {
-        "name": "tools",
-        "kind": "bundle",
-        "language": "go",
-        "system": "arch",
-        "from": "cmd/dunst-tools",
-        "binary": "dunst-tools",
-        "loads": [
-          "dunst-tools"
-        ]
-      },
-      {
-        "name": "files",
-        "kind": "archive",
-        "from": "files"
-      }
-    ]
-  },
-  "emits": [
-    "action-chosen",
-    "started",
-    "paused"
-  ],
-  "items": [
-    {
-      "collection": "contribution:node-display-session:config",
-      "name": "display-session",
-      "template": "files/i3/50-dunst.conf"
-    }
-  ]
-}

modules/mesh-delivery-indexer/judge/testdata/catalogue-835bf22b-xterm.module.json

@@ -1,236 +0,0 @@
-{
-  "module": "xterm",
-  "version": "1",
-  "moved": true,
-  "capabilities": [
-    "package-manager"
-  ],
-  "requires": [
-    "x11-display"
-  ],
-  "claims": [
-    {
-      "name": "node-terminal-emulator",
-      "scope": "node",
-      "serves": [
-        "open"
-      ]
-    }
-  ],
-  "tools": [
-    "xterm_font",
-    "xterm_colours"
-  ],
-  "config": {
-    "face": {
-      "type": "string",
-      "description": "The font family xterm draws with, as fc-list names it: JetBrainsMono Nerd Font, because research 026/04 chose it for its glyphs the prompt uses. A family the machine does not have falls back to the nearest installed face (xterm_font says which).",
-      "pattern": "[A-Za-z0-9 ._-]{1,64}",
-      "default": "JetBrainsMono Nerd Font"
-    },
-    "size": {
-      "type": "number",
-      "description": "The size of xterm's text, in points: 12 reads well on a screen of about 100 DPI, and a denser screen needs a larger size.",
-      "minimum": 6,
-      "maximum": 72,
-      "predefined": "font-size",
-      "default": 12
-    },
-    "save-lines": {
-      "type": "number",
-      "description": "How many lines of scrollback xterm keeps per terminal: 10000 holds a long build log, and each line costs memory in every open terminal.",
-      "minimum": 0,
-      "maximum": 1000000,
-      "default": 10000
-    },
-    "term-name": {
-      "type": "string",
-      "description": "The TERM value xterm sets for the programs it runs: xterm-256color, because the palette has 256 colours and every program knows the name.",
-      "pattern": "[A-Za-z0-9._-]{1,64}",
-      "default": "xterm-256color"
-    },
-    "render-font": {
-      "type": "boolean",
-      "description": "Whether xterm draws with fontconfig faces (true) or the old X core fonts (false): true, because the face is a fontconfig family and core fonts cannot show it.",
-      "default": true
-    },
-    "bold-mode": {
-      "type": "boolean",
-      "description": "Whether xterm draws bold text by overstriking the normal face (true): false, because the face has a real bold style and overstriking blurs it.",
-      "default": false
-    },
-    "always-bold-mode": {
-      "type": "boolean",
-      "description": "Whether xterm overstrikes bold even where the face has a bold style (true): false, for the same reason as bold-mode.",
-      "default": false
-    },
-    "allow-bold-fonts": {
-      "type": "boolean",
-      "description": "Whether xterm may use the face's bold style for bold text (true): true, so bold text is drawn with the real bold weight.",
-      "default": true
-    },
-    "background": {
-      "type": "string",
-      "description": "The terminal's background colour, as #rrggbb: black, as both workstations ran it.",
-      "pattern": "#[0-9a-fA-F]{6}",
-      "default": "#000000"
-    },
-    "foreground": {
-      "type": "string",
-      "description": "The terminal's text colour, as #rrggbb: a light grey, easier on the eyes than white on black.",
-      "pattern": "#[0-9a-fA-F]{6}",
-      "default": "#a8a8a8"
-    },
-    "color0": {
-      "type": "string",
-      "description": "Palette entry 0, the normal black, as #rrggbb: #000000, as both workstations ran it.",
-      "pattern": "#[0-9a-fA-F]{6}",
-      "default": "#000000"
-    },
-    "color1": {
-      "type": "string",
-      "description": "Palette entry 1, the normal red, as #rrggbb: #9e1828, as both workstations ran it.",
-      "pattern": "#[0-9a-fA-F]{6}",
-      "default": "#9e1828"
-    },
-    "color2": {
-      "type": "string",
-      "description": "Palette entry 2, the normal green, as #rrggbb: #008800, as both workstations ran it.",
-      "pattern": "#[0-9a-fA-F]{6}",
-      "default": "#008800"
-    },
-    "color3": {
-      "type": "string",
-      "description": "Palette entry 3, the normal yellow, as #rrggbb: #d2bb4b, as both workstations ran it.",
-      "pattern": "#[0-9a-fA-F]{6}",
-      "default": "#d2bb4b"
-    },
-    "color4": {
-      "type": "string",
-      "description": "Palette entry 4, the normal blue, as #rrggbb: #414171, as both workstations ran it.",
-      "pattern": "#[0-9a-fA-F]{6}",
-      "default": "#414171"
-    },
-    "color5": {
-      "type": "string",
-      "description": "Palette entry 5, the normal magenta, as #rrggbb: #963c59, as both workstations ran it.",
-      "pattern": "#[0-9a-fA-F]{6}",
-      "default": "#963c59"
-    },
-    "color6": {
-      "type": "string",
-      "description": "Palette entry 6, the normal cyan, as #rrggbb: #418179, as both workstations ran it.",
-      "pattern": "#[0-9a-fA-F]{6}",
-      "default": "#418179"
-    },
-    "color7": {
-      "type": "string",
-      "description": "Palette entry 7, the normal white, as #rrggbb: #bebebe, as both workstations ran it.",
-      "pattern": "#[0-9a-fA-F]{6}",
-      "default": "#bebebe"
-    },
-    "color8": {
-      "type": "string",
-      "description": "Palette entry 8, the bright black, as #rrggbb: #666666, as both workstations ran it.",
-      "pattern": "#[0-9a-fA-F]{6}",
-      "default": "#666666"
-    },
-    "color9": {
-      "type": "string",
-      "description": "Palette entry 9, the bright red, as #rrggbb: #bc5766, as both workstations ran it.",
-      "pattern": "#[0-9a-fA-F]{6}",
-      "default": "#bc5766"
-    },
-    "color10": {
-      "type": "string",
-      "description": "Palette entry 10, the bright green, as #rrggbb: #61a171, as both workstations ran it.",
-      "pattern": "#[0-9a-fA-F]{6}",
-      "default": "#61a171"
-    },
-    "color11": {
-      "type": "string",
-      "description": "Palette entry 11, the bright yellow, as #rrggbb: #e7db52, as both workstations ran it.",
-      "pattern": "#[0-9a-fA-F]{6}",
-      "default": "#e7db52"
-    },
-    "color12": {
-      "type": "string",
-      "description": "Palette entry 12, the bright blue, as #rrggbb: #5085af, as both workstations ran it.",
-      "pattern": "#[0-9a-fA-F]{6}",
-      "default": "#5085af"
-    },
-    "color13": {
-      "type": "string",
-      "description": "Palette entry 13, the bright magenta, as #rrggbb: #a97a99, as both workstations ran it.",
-      "pattern": "#[0-9a-fA-F]{6}",
-      "default": "#a97a99"
-    },
-    "color14": {
-      "type": "string",
-      "description": "Palette entry 14, the bright cyan, as #rrggbb: #6ba4a4, as both workstations ran it.",
-      "pattern": "#[0-9a-fA-F]{6}",
-      "default": "#6ba4a4"
-    },
-    "color15": {
-      "type": "string",
-      "description": "Palette entry 15, the bright white, as #rrggbb: #ffffff, as both workstations ran it.",
-      "pattern": "#[0-9a-fA-F]{6}",
-      "default": "#ffffff"
-    },
-    "copy-binding": {
-      "type": "string",
-      "description": "The key combination that copies the selection to the clipboard, in X translation syntax: Ctrl Shift ~Alt <Key> C, so a plain Ctrl+C still interrupts the program. It holds no colon, backslash or line break, which would end the resource.",
-      "pattern": "[^:\\\\\\n]+",
-      "default": "Ctrl Shift ~Alt <Key> C"
-    },
-    "paste-binding": {
-      "type": "string",
-      "description": "The key combination that pastes the clipboard, in X translation syntax: Ctrl Shift ~Alt <Key> V, the pair of copy-binding. It holds no colon, backslash or line break, which would end the resource.",
-      "pattern": "[^:\\\\\\n]+",
-      "default": "Ctrl Shift ~Alt <Key> V"
-    }
-  },
-  "items": [
-    {
-      "collection": "environment",
-      "name": "terminal",
-      "attributes": {
-        "kind": "variable",
-        "name": "TERMINAL"
-      },
-      "template": "files/env-terminal"
-    },
-    {
-      "collection": "shell:xresources:normal",
-      "name": "xresources-normal",
-      "template": "files/xresources-normal"
-    }
-  ],
-  "resources": [
-    {
-      "id": "package",
-      "type": "package",
-      "package": "xterm"
-    }
-  ],
-  "build": {
-    "artifacts": [
-      {
-        "name": "tools",
-        "kind": "bundle",
-        "language": "go",
-        "system": "arch",
-        "from": "cmd/xterm-tools",
-        "binary": "xterm-tools",
-        "loads": [
-          "xterm-tools"
-        ]
-      },
-      {
-        "name": "files",
-        "kind": "archive",
-        "from": "files"
-      }
-    ]
-  }
-}

modules/mesh-delivery-indexer/manifest_test.go

@@ -81,13 +81,12 @@ func TestManifestDeclarations(t *testing.T) { // 1238/AC1, 1444 (reads the build
 	if m.Module != "mesh-delivery-indexer" {
 		t.Errorf("module = %q", m.Module)
 	}
-	// 1126: placement is the seat mesh-placement's (ADR 0567): the indexer holds no placement state. ADR 0578 §1: it says
-	// a refused manifest as manifest-refused, its one event.
-	if !reflect.DeepEqual(m.Emits, []string{"manifest-refused"}) {
-		t.Errorf("emits = %v, want manifest-refused alone", m.Emits)
+	// 1126: placement is the seat mesh-placement's (ADR 0567): the indexer holds no placement state and says no event.
+	if len(m.Emits) != 0 {
+		t.Errorf("emits = %v, want none", m.Emits)
 	}
 	// 1126 note 76: heard keeps the last 64 FORGE messages the indexer handled, for indexer_heard.
-	if want := []state{{Name: "candidates", History: 10}, {Name: "heard", History: 64}, {Name: "manifests", History: 1}, {Name: "modules", History: 20}, {Name: "predefined", History: 5}, {Name: "config-candidates", History: 5}, {Name: "taken", History: 1}, {Name: "takeins", History: 1}, {Name: "verdicts", History: 5}}; !reflect.DeepEqual(m.State, want) {
+	if want := []state{{Name: "candidates", History: 10}, {Name: "heard", History: 64}, {Name: "manifests", History: 1}, {Name: "modules", History: 20}, {Name: "predefined", History: 5}, {Name: "config-candidates", History: 5}, {Name: "taken", History: 1}, {Name: "takeins", History: 1}}; !reflect.DeepEqual(m.State, want) {
 		t.Errorf("state = %+v, want %+v", m.State, want)
 	}
 	if want := []string{"mesh-build-go.toolchains", "mesh-build-node.toolchains", "mesh-delivery-assigner.placement", "mesh-delivery-builder.build-log", "mesh-delivery-checker.previews", "mesh-delivery-gate.source"}; !reflect.DeepEqual(sorted(m.Reads), want) {

modules/mesh-delivery-indexer/module.json

@@ -19,11 +19,7 @@
     { "name": "predefined", "history": 5 },
     { "name": "config-candidates", "history": 5 },
     { "name": "taken", "history": 1 },
-    { "name": "takeins", "history": 1 },
-    { "name": "verdicts", "history": 5 }
-  ],
-  "emits": [
-    "manifest-refused"
+    { "name": "takeins", "history": 1 }
   ],
   "reads": [
     "mesh-build-go.toolchains",

modules/mesh-delivery-indexer/testdata/beside/CAPTURED

@@ -1,29 +0,0 @@
-What a test reads of another repository when no merge check has cloned it beside this one (internal/beside,
-novox/hq issue 432). Copied from the repositories at the commits below, never written by hand. Each
-module.json is kept as module.json.captured: a module.json in this repository is a module of it to the
-forge and the planner, and a merge would build and register it.
-
-The copy carries the catalogue's private details: domains, first names in module names, a node name and
-private addresses. That is acceptable while mesh-sdk is private; if it ever goes public, this copy is
-a second place to clean besides the catalogue itself.
-
-Only what go/catalogue's tests read is captured (R4b, issue 1379), copied here from mesh-sdk with the judge's tests
-(issue 1585). mesh-host refreshed 2026-11-01 from its main, the catalogue 2026-10-21 from its main; before that it
-was mesh-controller's copy, which still held two modules that had left the catalogue.
-
-mesh-catalog  b5dbfbb784507e211372a7c9640d91f7d6dadd84  modules/*/module.json, modules/*/files/**, modules/*/templates/**, predefined.json
-mesh-host     233bb23bbcb1a829ce2a6164a31a5c5cc4f3d950  internal/apply/placement_guard.go
-
-To move them, from mesh-delivery's modules/mesh-delivery-indexer directory, with the two repositories checked out
-beside mesh-delivery:
-
-  rm -rf testdata/beside/mesh-catalog testdata/beside/mesh-host
-  mkdir -p testdata/beside/mesh-catalog testdata/beside/mesh-host/internal/apply
-  git -C ../../../mesh-catalog archive <commit> -- predefined.json ':(glob)modules/*/module.json' \
-    ':(glob)modules/*/files/**' ':(glob)modules/*/templates/**' | tar -x -C testdata/beside/mesh-catalog
-  find testdata/beside -name module.json -exec mv {} {}.captured \;
-  git -C ../../../mesh-host show <commit>:internal/apply/placement_guard.go \
-    > testdata/beside/mesh-host/internal/apply/placement_guard.go.captured
-
-and write the commits here. The placement guard is kept as .captured so no Go tool reads it as this
-repository's code.

modules/mesh-delivery-indexer/testdata/beside/mesh-catalog/modules/adwaita/files/cursor-index.theme

@@ -1,5 +0,0 @@
-# Written by the mesh (module adwaita, novox/hq ADR 0208): the default cursor theme, for programs that
-# read neither XCURSOR_THEME nor the X resources.
-[Icon Theme]
-Name=Default
-Inherits=Adwaita

modules/mesh-delivery-indexer/testdata/beside/mesh-catalog/modules/adwaita/files/env-gtk-theme

@@ -1 +0,0 @@
-Adwaita:dark

modules/mesh-delivery-indexer/testdata/beside/mesh-catalog/modules/adwaita/files/env-gtk2-rc-files

@@ -1 +0,0 @@
-/usr/share/themes/Adwaita-dark/gtk-2.0/gtkrc

modules/mesh-delivery-indexer/testdata/beside/mesh-catalog/modules/adwaita/files/env-qt-qpa-platformtheme

@@ -1 +0,0 @@
-qt6ct

modules/mesh-delivery-indexer/testdata/beside/mesh-catalog/modules/adwaita/files/env-qt-select

@@ -1 +0,0 @@
-6

modules/mesh-delivery-indexer/testdata/beside/mesh-catalog/modules/adwaita/files/env-qt-style-override

@@ -1 +0,0 @@
-Fusion

modules/mesh-delivery-indexer/testdata/beside/mesh-catalog/modules/adwaita/files/env-xcursor-size

@@ -1 +0,0 @@
-24

modules/mesh-delivery-indexer/testdata/beside/mesh-catalog/modules/adwaita/files/env-xcursor-theme

@@ -1 +0,0 @@
-Adwaita

modules/mesh-delivery-indexer/testdata/beside/mesh-catalog/modules/adwaita/files/gtk-settings.ini

@@ -1,9 +0,0 @@
-# Written by the mesh (module adwaita, novox/hq ADR 0208), for GTK 3 and GTK 4 alike. Replaced at
-# every push; adwaita_appearance switches dark and light for the running session.
-[Settings]
-gtk-theme-name=Adwaita
-gtk-icon-theme-name=Adwaita
-gtk-cursor-theme-name=Adwaita
-gtk-cursor-theme-size=24
-gtk-font-name=Inter 11
-gtk-application-prefer-dark-theme=1

modules/mesh-delivery-indexer/testdata/beside/mesh-catalog/modules/adwaita/files/portals.conf

@@ -1,11 +0,0 @@
-# Written by the mesh (module adwaita, novox/hq ADR 0208). Replaced at every push.
-#
-# Which portal backend answers each interface. i3 is not a desktop xdg-desktop-portal knows, so with
-# no preference it uses whichever backend happens to be installed: fine while gtk is the only one,
-# wrong the day another arrives as somebody else's dependency. Named instead. gtk also serves
-# org.freedesktop.appearance (dark or light) from GSettings, which the session's start sets.
-[preferred]
-default=gtk
-# Secrets for sandboxed programs come from the keyring's backend. Without this line no backend answers
-# the interface: gtk does not implement it, and gnome-keyring's names only GNOME as its desktop.
-org.freedesktop.impl.portal.Secret=gnome-keyring

modules/mesh-delivery-indexer/testdata/beside/mesh-catalog/modules/adwaita/files/qt6ct.conf

@@ -1,29 +0,0 @@
-[Appearance]
-color_scheme_path=/usr/share/qt6ct/colors/darker.conf
-custom_palette=true
-icon_theme=Adwaita
-standard_dialogs=default
-style=Fusion
-
-[Fonts]
-fixed="JetBrainsMono Nerd Font,11,-1,5,50,0,0,0,0,0"
-general="Inter,11,-1,5,50,0,0,0,0,0"
-
-[Interface]
-activate_item_on_single_click=1
-buttonbox_layout=0
-cursor_flash_time=1000
-dialog_buttons_have_icons=1
-double_click_interval=400
-gui_effects=@Invalid()
-keyboard_scheme=2
-menus_have_icons=true
-show_shortcuts_in_context_menus=true
-stylesheets=@Invalid()
-toolbutton_style=4
-underline_shortcut=1
-wheel_scroll_lines=3
-
-[Troubleshooting]
-force_raster_widgets=1
-ignored_applications=@Invalid()

modules/mesh-delivery-indexer/testdata/beside/mesh-catalog/modules/adwaita/files/xinitrc-normal

@@ -1,10 +0,0 @@
-# The appearance (module adwaita): GSettings is where the portal reads dark or light, and the portal is
-# the only way it reaches Electron, Chromium, Firefox and flatpaks. Set at every session start to the
-# module's default; adwaita_appearance switches it for a session.
-gsettings set org.gnome.desktop.interface color-scheme 'prefer-dark' || true
-gsettings set org.gnome.desktop.interface gtk-theme 'Adwaita' || true
-gsettings set org.gnome.desktop.interface icon-theme 'Adwaita' || true
-gsettings set org.gnome.desktop.interface cursor-theme 'Adwaita' || true
-gsettings set org.gnome.desktop.interface cursor-size 24 || true
-gsettings set org.gnome.desktop.interface font-name 'Inter 11' || true
-gsettings set org.gnome.desktop.interface monospace-font-name 'JetBrainsMono Nerd Font 11' || true

modules/mesh-delivery-indexer/testdata/beside/mesh-catalog/modules/adwaita/files/xresources-normal

@@ -1,3 +0,0 @@
-! adwaita: the cursor, for X programs that take it from the resources.
-Xcursor.theme: Adwaita
-Xcursor.size: 24

modules/mesh-delivery-indexer/testdata/beside/mesh-catalog/modules/adwaita/module.json.captured

@@ -1,176 +0,0 @@
-{
-  "module": "adwaita",
-  "version": "1",
-  "moved": true,
-  "capabilities": [
-    "package-manager"
-  ],
-  "tools": [
-    "adwaita_appearance",
-    "adwaita_cursor",
-    "adwaita_icons",
-    "adwaita_portal_check"
-  ],
-  "items": [
-    {
-      "collection": "environment",
-      "name": "gtk-theme",
-      "attributes": {
-        "kind": "variable",
-        "name": "GTK_THEME"
-      },
-      "template": "files/env-gtk-theme"
-    },
-    {
-      "collection": "environment",
-      "name": "gtk2-rc-files",
-      "attributes": {
-        "kind": "variable",
-        "name": "GTK2_RC_FILES"
-      },
-      "template": "files/env-gtk2-rc-files"
-    },
-    {
-      "collection": "environment",
-      "name": "qt-qpa-platformtheme",
-      "attributes": {
-        "kind": "variable",
-        "name": "QT_QPA_PLATFORMTHEME"
-      },
-      "template": "files/env-qt-qpa-platformtheme"
-    },
-    {
-      "collection": "environment",
-      "name": "qt-style-override",
-      "attributes": {
-        "kind": "variable",
-        "name": "QT_STYLE_OVERRIDE"
-      },
-      "template": "files/env-qt-style-override"
-    },
-    {
-      "collection": "environment",
-      "name": "qt-select",
-      "attributes": {
-        "kind": "variable",
-        "name": "QT_SELECT"
-      },
-      "template": "files/env-qt-select"
-    },
-    {
-      "collection": "environment",
-      "name": "xcursor-theme",
-      "attributes": {
-        "kind": "variable",
-        "name": "XCURSOR_THEME"
-      },
-      "template": "files/env-xcursor-theme"
-    },
-    {
-      "collection": "environment",
-      "name": "xcursor-size",
-      "attributes": {
-        "kind": "variable",
-        "name": "XCURSOR_SIZE"
-      },
-      "template": "files/env-xcursor-size"
-    },
-    {
-      "collection": "shell:xresources:normal",
-      "name": "xresources-normal",
-      "template": "files/xresources-normal"
-    },
-    {
-      "collection": "shell:xinitrc:normal",
-      "name": "xinitrc-normal",
-      "template": "files/xinitrc-normal"
-    }
-  ],
-  "resources": [
-    {
-      "id": "package-gnome-themes-extra",
-      "type": "package",
-      "package": "gnome-themes-extra"
-    },
-    {
-      "id": "package-adwaita-icon-theme",
-      "type": "package",
-      "package": "adwaita-icon-theme"
-    },
-    {
-      "id": "package-adwaita-cursors",
-      "type": "package",
-      "package": "adwaita-cursors"
-    },
-    {
-      "id": "package-qt6ct",
-      "type": "package",
-      "package": "qt6ct"
-    },
-    {
-      "id": "package-xdg-desktop-portal-gtk",
-      "type": "package",
-      "package": "xdg-desktop-portal-gtk"
-    },
-    {
-      "id": "gtk3",
-      "type": "file",
-      "path": "${machine:account-home}/.config/gtk-3.0/settings.ini",
-      "owner": "${machine:account}",
-      "mode": "0644",
-      "template": "files/gtk-settings.ini"
-    },
-    {
-      "id": "gtk4",
-      "type": "file",
-      "path": "${machine:account-home}/.config/gtk-4.0/settings.ini",
-      "owner": "${machine:account}",
-      "mode": "0644",
-      "template": "files/gtk-settings.ini"
-    },
-    {
-      "id": "qt6ct",
-      "type": "file",
-      "path": "${machine:account-home}/.config/qt6ct/qt6ct.conf",
-      "owner": "${machine:account}",
-      "mode": "0644",
-      "template": "files/qt6ct.conf"
-    },
-    {
-      "id": "portals",
-      "type": "file",
-      "path": "${machine:account-home}/.config/xdg-desktop-portal/portals.conf",
-      "owner": "${machine:account}",
-      "mode": "0644",
-      "template": "files/portals.conf"
-    },
-    {
-      "id": "cursor",
-      "type": "file",
-      "path": "${machine:account-home}/.icons/default/index.theme",
-      "owner": "${machine:account}",
-      "mode": "0644",
-      "template": "files/cursor-index.theme"
-    }
-  ],
-  "build": {
-    "artifacts": [
-      {
-        "name": "tools",
-        "kind": "bundle",
-        "language": "go",
-        "system": "arch",
-        "from": "cmd/adwaita-tools",
-        "binary": "adwaita-tools",
-        "loads": [
-          "adwaita-tools"
-        ]
-      },
-      {
-        "name": "files",
-        "kind": "archive",
-        "from": "files"
-      }
-    ]
-  }
-}

modules/mesh-delivery-indexer/testdata/beside/mesh-catalog/modules/artifact-store-tools/files/store-names

@@ -1,4 +0,0 @@
-# The names the artifact store had before, from the setting older-store-names, written by the mesh.
-# artifact_store_references reads every definition under these too (novox/hq issue 323).
-# Replaced on every push; change the setting, never this file.
-older=${config:older-store-names}

modules/mesh-delivery-indexer/testdata/beside/mesh-catalog/modules/artifact-store-tools/module.json.captured

@@ -1,65 +0,0 @@
-{
-  "module": "artifact-store-tools",
-  "version": "1",
-  "invokes": [
-    "seat:mesh-controller.artifacts",
-    "seat:mesh-controller.collect",
-    "mesh-catalog.catalog_modules",
-    "mesh-catalog.catalog_module"
-  ],
-  "tools": [
-    "artifact_store_repositories",
-    "artifact_store_usage",
-    "artifact_store_references",
-    "artifact_store_collect"
-  ],
-    "config": {
-      "older-store-names": {
-        "type": "string",
-        "description": "The names the artifact store had before, as host names or host:port separated by spaces, or none when it had no other. artifact_store_references reads every definition under these as well as under the store's current name, so an image a definition pins under one is said to be named by a definition (novox/hq issue 323).",
-        "pattern": "none|[A-Za-z0-9.:-]+( [A-Za-z0-9.:-]+)*",
-        "default": "none"
-      }
-    },
-  "resources": [
-    {
-      "id": "state",
-      "type": "directory",
-      "mode": "0700",
-      "place": ".",
-      "unknown": "program"
-    },
-    {
-      "id": "store-names",
-      "type": "file",
-      "path": "${dir:state}/store-names",
-      "mode": "0600",
-      "trusted": false,
-      "template": "files/store-names"
-    }
-  ],
-  "build": {
-    "artifacts": [
-      {
-        "name": "tools-go",
-        "kind": "bundle",
-        "language": "go",
-        "system": "arch",
-        "from": "cmd/artifact-store-tools",
-        "binary": "artifact-store-tools",
-        "loads": [
-          "artifact-store-tools"
-        ],
-        "env": {
-          "MESH_ARTIFACT_STORE_CONTAINER": "mesh-registry",
-          "MESH_ARTIFACT_STORE_NAMES_FILE": "${dir:state}/store-names"
-        }
-      },
-      {
-        "name": "files",
-        "kind": "archive",
-        "from": "files"
-      }
-    ]
-  }
-}

modules/mesh-delivery-indexer/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/files/bin/zephyrus-backlight

@@ -1,33 +0,0 @@
-#!/bin/bash
-# zephyrus-backlight + | - | PERCENT — step or set the internal panel's backlight, never below 1 %.
-# Shipped by the mesh's asus-zephyrus-g14 module; edit the catalogue.
-#
-# The panel is the backlight beneath the eDP connector, not a name: in hybrid mode this model also
-# registers the discrete GPU's backlight (nvidia_0), which moves nothing. Writable by the video group
-# through the module's udev rule, so the vendor-key trigger needs no root.
-set -u
-STEP=5
-dev=""
-for d in /sys/class/backlight/*; do
-	[ -e "$d" ] || continue
-	case "$(readlink -f "$d")" in *-eDP-*) dev=$d; break ;; esac
-done
-if [ -z "$dev" ]; then
-	for d in /sys/class/backlight/*; do [ -e "$d" ] && { dev=$d; break; }; done
-fi
-[ -n "$dev" ] || { echo "zephyrus-backlight: no backlight" >&2; exit 1; }
-cur=$(cat "$dev/brightness")
-max=$(cat "$dev/max_brightness")
-pct=$(( cur * 100 / max ))
-case "${1:-}" in
-	+|up|Up) pct=$(( pct + STEP )) ;;
-	-|down|Down) pct=$(( pct - STEP )) ;;
-	''|*[!0-9]*) echo "usage: zephyrus-backlight + | - | PERCENT" >&2; exit 2 ;;
-	*) pct=$1 ;;
-esac
-(( pct < 1 )) && pct=1
-(( pct > 100 )) && pct=100
-new=$(( max * pct / 100 ))
-(( new < 1 )) && new=1
-printf '%s' "$new" >"$dev/brightness" || exit 1
-exec "$(dirname "$0")/zephyrus-notify" 5555 "Brightness: ${pct}%"

modules/mesh-delivery-indexer/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/files/bin/zephyrus-display

@@ -1,41 +0,0 @@
-#!/bin/bash
-# zephyrus-display primary | order — the laptop's internal panel among the outputs.
-# Shipped by the mesh's asus-zephyrus-g14 module; edit the catalogue.
-#
-#   primary  makes the internal panel X's primary output, where the bars' tray goes.
-#   order    the display key (Fn+F9, which the firmware sends as Super+P): odd workspaces to the
-#            internal panel, even ones to the first external output, or all to the panel when it
-#            is alone. The predecessor's orden-workspaces.
-#
-# The panel is found, not named: the connected output whose name starts with eDP. The predecessor
-# wrote eDP-1, which is what this model calls it today and not a promise.
-set -u
-here=$(dirname "$0")
-panel=$(xrandr --query 2>/dev/null | awk '$2 == "connected" && $1 ~ /^eDP/ { print $1; exit }')
-[ -n "$panel" ] || { echo "zephyrus-display: no internal panel connected" >&2; exit 1; }
-case "${1:-}" in
-primary)
-	exec xrandr --output "$panel" --primary
-	;;
-order)
-	external=$(xrandr --listmonitors 2>/dev/null | awk -v p="$panel" 'NR > 1 && $NF != p { print $NF; exit }')
-	[ -n "$external" ] || external=$panel
-	# i3's workspace list, one object per workspace; num and output read from each. No jq: the
-	# fields are flat strings and numbers, and rect, the only nested value, holds neither name.
-	i3-msg -t get_workspaces 2>/dev/null | sed 's/},{"id"/}\n{"id"/g' |
-		while read -r ws; do
-			num=$(printf '%s' "$ws" | grep -o '"num":-\?[0-9]*' | cut -d: -f2)
-			out=$(printf '%s' "$ws" | grep -o '"output":"[^"]*"' | cut -d'"' -f4)
-			[ -n "$num" ] && [ "$num" -ge 0 ] || continue
-			if [ $((num % 2)) -eq 0 ]; then dest=$external; else dest=$panel; fi
-			[ "$out" = "$dest" ] && continue
-			i3-msg "workspace number $num; move workspace to output $dest" >/dev/null
-		done
-	if [ "$external" = "$panel" ]; then
-		"$here/zephyrus-notify" 7780 "Workspaces: all on the panel"
-	else
-		"$here/zephyrus-notify" 7780 "Workspaces: odd on the panel, even on $external"
-	fi
-	;;
-*) echo "usage: zephyrus-display primary | order" >&2; exit 2 ;;
-esac

modules/mesh-delivery-indexer/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/files/bin/zephyrus-kbd-notify

@@ -1,20 +0,0 @@
-#!/bin/bash
-# zephyrus-kbd-notify — shows the keyboard backlight's level when it changes. The level itself is set
-# by the firmware and asusd (Fn+F2/F3), which tell UPower; this only listens and notifies. Started once
-# per session from the module's i3 fragment. Shipped by the mesh's asus-zephyrus-g14 module.
-#
-# One instance per session: i3 runs its `exec` lines again on an in-place restart, and the
-# predecessor's listener ran twice after one, showing every change twice.
-set -u
-here=$(dirname "$0")
-lock="${XDG_RUNTIME_DIR:-/run/user/$(id -u)}/zephyrus-kbd-notify.lock"
-exec 9>"$lock"
-flock -n 9 || exit 0
-levels=(Off Low Med High)
-dbus-monitor --system "type='signal',interface='org.freedesktop.UPower.KbdBacklight',member='BrightnessChanged'" 2>/dev/null |
-	while read -r line; do
-		if [[ $line =~ int32\ ([0-9]+) ]]; then
-			v=${BASH_REMATCH[1]}
-			"$here/zephyrus-notify" 5556 "Keyboard: ${levels[$v]:-$v}"
-		fi
-	done

modules/mesh-delivery-indexer/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/files/bin/zephyrus-media

@@ -1,27 +0,0 @@
-#!/bin/bash
-# zephyrus-media play-pause | next | previous — the media keys, through MPRIS (playerctl), with a short
-# notification of what happened. Shipped by the mesh's asus-zephyrus-g14 module; edit the catalogue.
-#
-# From the predecessor's media-control, kept: the lock against a double fire (the vendor keys can
-# repeat), and the notification. Dropped: its fallback to a media server's local API, which needed a
-# token from a file of secrets (novox/hq research 027 question 2). A player that speaks MPRIS is
-# reached; one that does not says so.
-set -u
-here=$(dirname "$0")
-action=${1:-play-pause}
-case "$action" in play-pause | next | previous) ;; *) echo "usage: zephyrus-media play-pause | next | previous" >&2; exit 2 ;; esac
-lock="${XDG_RUNTIME_DIR:-/run/user/$(id -u)}/zephyrus-media.lock"
-exec 9>"$lock"
-flock -n 9 || exit 0
-if ! playerctl status >/dev/null 2>&1; then
-	"$here/zephyrus-notify" 7777 "Media: no player"
-	exit 0
-fi
-playerctl "$action" 2>/dev/null
-if [ "$action" = play-pause ]; then
-	sleep 0.2
-	[ "$(playerctl status 2>/dev/null)" = Playing ] && label=Playing || label=Paused
-else
-	label=${action^}
-fi
-"$here/zephyrus-notify" 7777 "Media: $label"

modules/mesh-delivery-indexer/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/files/bin/zephyrus-notify

@@ -1,12 +0,0 @@
-#!/bin/bash
-# zephyrus-notify ID SUMMARY — a short desktop notification that replaces the previous one with the
-# same ID, through the session's notification service on its bus. busctl is the service manager's
-# own client, so nothing is installed for it. Shipped by the mesh's asus-zephyrus-g14 module.
-set -u
-id=${1:-0}
-summary=${2:-}
-uid=$(id -u)
-DBUS_SESSION_BUS_ADDRESS="unix:path=/run/user/${uid}/bus" \
-	busctl --user call org.freedesktop.Notifications /org/freedesktop/Notifications \
-	org.freedesktop.Notifications Notify susssasa{sv}i \
-	asus-zephyrus-g14 "$id" "" "$summary" "" 0 1 urgency y 0 1500 >/dev/null 2>&1 || true

modules/mesh-delivery-indexer/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/files/bin/zephyrus-session

@@ -1,46 +0,0 @@
-#!/bin/bash
-# zephyrus-session COMMAND [ARG...] — run a command in the operator's graphical session from outside
-# it: from a vendor-key trigger, which triggerhappy runs as the operator's account but with none of
-# the session's environment. Shipped by the mesh's asus-zephyrus-g14 module; edit the catalogue.
-#
-# What it replaces: the predecessor's `as-user`, which triggerhappy ran as root and which `su`-ed to
-# a named person with a hard-coded user id and display, and sourced a file of secrets on the way.
-# Here the account is whoever runs it, the bus is that account's, and the display is the one the
-# account's own session uses. Nothing is sourced.
-set -u
-uid=$(id -u)
-export XDG_RUNTIME_DIR="/run/user/${uid}"
-export DBUS_SESSION_BUS_ADDRESS="unix:path=${XDG_RUNTIME_DIR}/bus"
-home=$(getent passwd "$uid" | cut -d: -f6)
-[ -n "$home" ] && export HOME="$home"
-# The session's own window manager says best which display and authority the session uses: read
-# them from its environment, as the desktop modules' session finder does. Then logind, then any
-# process of this account that has a display.
-from_environ() {
-	env=$(tr '\0' '\n' <"/proc/$1/environ" 2>/dev/null) || return 1
-	d=$(printf '%s\n' "$env" | sed -n 's/^DISPLAY=//p' | head -n1)
-	[ -n "$d" ] || return 1
-	export DISPLAY="$d"
-	a=$(printf '%s\n' "$env" | sed -n 's/^XAUTHORITY=//p' | head -n1)
-	[ -n "$a" ] && export XAUTHORITY="$a"
-	return 0
-}
-if [ -z "${DISPLAY:-}" ]; then
-	for pid in $(pgrep -xu "$uid" i3 2>/dev/null); do
-		from_environ "$pid" && break
-	done
-fi
-if [ -z "${DISPLAY:-}" ]; then
-	for s in $(loginctl list-sessions --no-legend 2>/dev/null | awk -v u="$uid" '$2 == u { print $1 }'); do
-		d=$(loginctl show-session "$s" -p Display --value 2>/dev/null)
-		if [ -n "$d" ]; then export DISPLAY="$d"; break; fi
-	done
-fi
-if [ -z "${DISPLAY:-}" ]; then
-	for pid in $(pgrep -u "$uid" 2>/dev/null); do
-		from_environ "$pid" && break
-	done
-fi
-: "${XAUTHORITY:=${HOME}/.Xauthority}"
-export XAUTHORITY
-exec "$@"

modules/mesh-delivery-indexer/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/files/bin/zephyrus-touchpad

@@ -1,29 +0,0 @@
-#!/bin/bash
-# zephyrus-touchpad reset | toggle — apply the touchpad's settings again, or switch it on or off.
-# Shipped by the mesh's asus-zephyrus-g14 module; edit the catalogue.
-#
-# The settings themselves are an X input class (/etc/X11/xorg.conf.d/30-asus-zephyrus-g14-touchpad.conf),
-# which X applies every time the device appears — after a resume too, which is what the predecessor's
-# sleep hook existed for. This is the manual form, bound to the touchpad key.
-set -u
-here=$(dirname "$0")
-name=$("$here/zephyrus-session" xinput list --name-only 2>/dev/null | grep -m1 -i 'touchpad')
-[ -n "$name" ] || { echo "zephyrus-touchpad: no touchpad in this session" >&2; exit 1; }
-x() { "$here/zephyrus-session" xinput "$@"; }
-case "${1:-reset}" in
-	reset)
-		x set-prop "$name" "libinput Tapping Enabled" 1
-		x set-prop "$name" "libinput Natural Scrolling Enabled" 1
-		x set-prop "$name" "libinput Accel Speed" 0.15
-		x enable "$name"
-		"$here/zephyrus-session" "$here/zephyrus-notify" 7779 "Touchpad: reset"
-		;;
-	toggle)
-		if x list-props "$name" | grep -q 'Device Enabled ([0-9]*):[[:space:]]*1'; then
-			x disable "$name"; "$here/zephyrus-session" "$here/zephyrus-notify" 7779 "Touchpad: off"
-		else
-			x enable "$name"; "$here/zephyrus-session" "$here/zephyrus-notify" 7779 "Touchpad: on"
-		fi
-		;;
-	*) echo "usage: zephyrus-touchpad reset | toggle" >&2; exit 2 ;;
-esac

modules/mesh-delivery-indexer/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/module.json.captured

@@ -1,229 +0,0 @@
-{
-  "module": "asus-zephyrus-g14",
-  "version": "1",
-  "moved": true,
-  "templates": "templates",
-  "capabilities": [
-    "package-manager",
-    "service-manager"
-  ],
-  "requires": [
-    "x11-display"
-  ],
-  "emits": [
-    "profile.switched"
-  ],
-  "tools": [
-    "zephyrus_brightness",
-    "zephyrus_battery",
-    "zephyrus_charge_limit",
-    "zephyrus_gpu_mode",
-    "zephyrus_profile",
-    "zephyrus_thermals",
-    "zephyrus_power_draw",
-    "zephyrus_profile_policy",
-    "zephyrus_fan_curves",
-    "zephyrus_keys",
-    "zephyrus_check"
-  ],
-  "resources": [
-    {
-      "id": "asusctl",
-      "type": "package",
-      "package": "asusctl"
-    },
-    {
-      "id": "playerctl",
-      "type": "package",
-      "package": "playerctl"
-    },
-    {
-      "id": "asusd",
-      "type": "service",
-      "unit": "asusd.service",
-      "state": "running"
-    },
-    {
-      "id": "supergfxd",
-      "type": "service",
-      "unit": "supergfxd.service",
-      "state": "running",
-      "boot": "enabled"
-    },
-    {
-      "id": "scripts",
-      "type": "archive",
-      "path": "/usr/local/lib/asus-zephyrus-g14",
-      "artifact": "scripts",
-      "unknown": "program"
-    },
-    {
-      "id": "nvidia-options",
-      "type": "file",
-      "path": "/etc/modprobe.d/g14-nvidia-power.conf",
-      "mode": "0644",
-      "template": "templates/modprobe.d/g14-nvidia-power.conf"
-    },
-    {
-      "id": "video-options",
-      "type": "file",
-      "path": "/etc/modprobe.d/video-brightness-switch.conf",
-      "mode": "0644",
-      "template": "templates/modprobe.d/video-brightness-switch.conf"
-    },
-    {
-      "id": "suspend-drop-ins",
-      "type": "directory",
-      "path": "/etc/systemd/system/systemd-suspend.service.d",
-      "mode": "0755",
-      "unknown": "program"
-    },
-    {
-      "id": "nvidia-on-suspend",
-      "type": "file",
-      "path": "/etc/systemd/system/systemd-suspend.service.d/asus-zephyrus-g14-nvidia.conf",
-      "mode": "0644",
-      "template": "templates/systemd/system/systemd-suspend.service.d/asus-zephyrus-g14-nvidia.conf"
-    },
-    {
-      "id": "hibernate-drop-ins",
-      "type": "directory",
-      "path": "/etc/systemd/system/systemd-hibernate.service.d",
-      "mode": "0755",
-      "unknown": "program"
-    },
-    {
-      "id": "nvidia-on-hibernate",
-      "type": "file",
-      "path": "/etc/systemd/system/systemd-hibernate.service.d/asus-zephyrus-g14-nvidia.conf",
-      "mode": "0644",
-      "template": "templates/systemd/system/systemd-hibernate.service.d/asus-zephyrus-g14-nvidia.conf"
-    },
-    {
-      "id": "suspend-then-hibernate-drop-ins",
-      "type": "directory",
-      "path": "/etc/systemd/system/systemd-suspend-then-hibernate.service.d",
-      "mode": "0755",
-      "unknown": "program"
-    },
-    {
-      "id": "nvidia-on-suspend-then-hibernate",
-      "type": "file",
-      "path": "/etc/systemd/system/systemd-suspend-then-hibernate.service.d/asus-zephyrus-g14-nvidia.conf",
-      "mode": "0644",
-      "template": "templates/systemd/system/systemd-suspend-then-hibernate.service.d/asus-zephyrus-g14-nvidia.conf"
-    },
-    {
-      "id": "powerd-drop-ins",
-      "type": "directory",
-      "path": "/etc/systemd/system/nvidia-powerd.service.d",
-      "mode": "0755",
-      "unknown": "program"
-    },
-    {
-      "id": "powerd-opt-in",
-      "type": "file",
-      "path": "/etc/systemd/system/nvidia-powerd.service.d/asus-zephyrus-g14.conf",
-      "mode": "0644",
-      "template": "templates/systemd/system/nvidia-powerd.service.d/asus-zephyrus-g14.conf"
-    },
-    {
-      "id": "backlight-rule",
-      "type": "file",
-      "path": "/etc/udev/rules.d/90-backlight.rules",
-      "mode": "0644",
-      "template": "templates/udev/rules.d/90-backlight.rules"
-    },
-    {
-      "id": "udev",
-      "type": "service",
-      "unit": "systemd-udevd.service",
-      "reload-on": [
-        "backlight-rule"
-      ]
-    },
-    {
-      "id": "upower-package",
-      "type": "package",
-      "package": "upower"
-    },
-    {
-      "id": "upower-drop-ins",
-      "type": "directory",
-      "path": "/etc/UPower/UPower.conf.d",
-      "mode": "0755",
-      "unknown": "program"
-    },
-    {
-      "id": "low-battery",
-      "type": "file",
-      "path": "/etc/UPower/UPower.conf.d/50-asus-zephyrus-g14.conf",
-      "mode": "0644",
-      "template": "templates/UPower/UPower.conf.d/50-asus-zephyrus-g14.conf"
-    },
-    {
-      "id": "upower",
-      "type": "service",
-      "unit": "upower.service",
-      "state": "running",
-      "boot": "enabled",
-      "restart-on": [
-        "low-battery"
-      ]
-    },
-    {
-      "id": "xorg-drop-ins",
-      "type": "directory",
-      "path": "/etc/X11/xorg.conf.d",
-      "mode": "0755",
-      "unknown": "program"
-    },
-    {
-      "id": "touchpad",
-      "type": "file",
-      "path": "/etc/X11/xorg.conf.d/30-asus-zephyrus-g14-touchpad.conf",
-      "mode": "0644",
-      "template": "templates/X11/xorg.conf.d/30-asus-zephyrus-g14-touchpad.conf"
-    }
-  ],
-  "items": [
-    {
-      "collection": "shell:after-wake:normal",
-      "template": "templates/after-wake"
-    },
-    {
-      "collection": "contribution:node-hotkeys:trigger",
-      "template": "templates/hotkeys-triggers"
-    },
-    {
-      "collection": "contribution:node-display-session:config",
-      "name": "display-session",
-      "template": "templates/display-session"
-    }
-  ],
-  "build": {
-    "artifacts": [
-      {
-        "name": "tools-go",
-        "kind": "bundle",
-        "language": "go",
-        "system": "arch",
-        "from": "cmd/zephyrus",
-        "binary": "zephyrus",
-        "loads": [
-          "zephyrus"
-        ]
-      },
-      {
-        "name": "scripts",
-        "kind": "archive",
-        "from": "files"
-      },
-      {
-        "name": "templates",
-        "kind": "archive",
-        "from": "templates"
-      }
-    ]
-  }
-}

modules/mesh-delivery-indexer/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/UPower/UPower.conf.d/50-asus-zephyrus-g14.conf

@@ -1,11 +0,0 @@
-# Managed by the mesh (module asus-zephyrus-g14). Replaced on every push; edit the catalogue instead.
-#
-# On low battery the machine suspends rather than powering off, at 7 % — s2idle still draws a little,
-# so it leaves headroom. A drop-in over the package's own UPower.conf, which stays the package's.
-[UPower]
-UsePercentageForPolicy=true
-PercentageLow=15.0
-PercentageCritical=10.0
-PercentageAction=7.0
-CriticalPowerAction=Suspend
-AllowRiskyCriticalPowerAction=true

modules/mesh-delivery-indexer/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/X11/xorg.conf.d/30-asus-zephyrus-g14-touchpad.conf

@@ -1,12 +0,0 @@
-# Managed by the mesh (module asus-zephyrus-g14). Replaced on every push; edit the catalogue instead.
-#
-# The touchpad's settings, applied by X every time the device appears — at login and after every
-# resume, when the device is initialised again. This replaces the predecessor's sleep hook, which ran
-# xinput after a resume as a named person on a guessed display.
-Section "InputClass"
-    Identifier "asus-zephyrus-g14 touchpad"
-    MatchIsTouchpad "on"
-    Option "Tapping" "on"
-    Option "NaturalScrolling" "true"
-    Option "AccelSpeed" "0.15"
-EndSection

modules/mesh-delivery-indexer/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/after-wake

@@ -1,7 +0,0 @@
-# The touchpad's settings again after waking, in the operator's session: X applies the module's
-# input class when the device appears, and this covers a wake that does not initialise it again.
-# Runs as root from the power module; the reset itself runs as the session's owner.
-sleep 2
-owner=$(ps -o user= -C i3 | head -n 1)
-[ -n "$owner" ] && runuser -u "$owner" -- /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-touchpad reset
-true

modules/mesh-delivery-indexer/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/display-session

@@ -1,30 +0,0 @@
-# The laptop's own lines in i3 (module asus-zephyrus-g14, novox/hq ADR 0208, ADR 0210). Owned by the
-# mesh: replaced at every push. Once the controller places contributions to node-display-session
-# (ADR 0210), these become the module's contribution instead of a file in i3's directory.
-#
-# The keys the firmware turns into ordinary key presses. The vendor keys that reach no X client are
-# triggerhappy's (/etc/triggerhappy/triggers.d/asus-g14.conf): M4 and Fn+F4/F5 for media, Fn+F7/F8 for
-# the panel, Fn+F10 for the touchpad. The keyboard backlight (Fn+F2/F3) is the firmware's and asusd's.
-
-# Fn+F6, the screenshot key: the firmware sends Super+Shift+S. Released before it runs, because the
-# screenshot grabs the pointer to select a region, which fails while the key is still held.
-bindsym --release $mod+Shift+s exec --no-startup-id $XDG_CONFIG_HOME/i3/scripts/screenshot.sh
-
-# Fn+F9, the display key: the firmware sends Super+P. Odd workspaces to the panel, even ones to the
-# external output.
-bindsym $mod+p exec --no-startup-id /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-display order
-
-# The keyboard backlight's level, shown when it changes.
-exec --no-startup-id /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-kbd-notify
-# The laptop's own lines in i3 (module asus-zephyrus-g14, novox/hq ADR 0208, ADR 0210). Owned by the
-# mesh: replaced at every push. Once the controller places contributions to node-display-session
-# (ADR 0210), these become the module's contribution instead of a file in i3's directory.
-#
-# The model's panel and touchpad.
-
-# The internal panel is the primary output, where the bars' tray goes. Which monitors are on and where
-# is the display server's (autorandr, run at every session start).
-exec --no-startup-id /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-display primary
-
-# The touchpad's settings again, by hand. X applies them itself whenever the device appears.
-bindsym $mod+Shift+x exec --no-startup-id /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-touchpad reset

modules/mesh-delivery-indexer/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/hotkeys-triggers

@@ -1,10 +0,0 @@
-# The ROG Zephyrus G14's vendor keys, which reach no X client: media (the M-keys), panel brightness,
-# and the touchpad key. Each runs this module's own script, as the operator's account.
-KEY_PROG1	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-session /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-media play-pause
-KEY_PROG3	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-session /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-media previous
-KEY_PROG4	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-session /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-media next
-KEY_BRIGHTNESSDOWN	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-backlight -
-KEY_BRIGHTNESSDOWN	2	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-backlight -
-KEY_BRIGHTNESSUP	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-backlight +
-KEY_BRIGHTNESSUP	2	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-backlight +
-KEY_F21	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-touchpad reset

modules/mesh-delivery-indexer/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/modprobe.d/g14-nvidia-power.conf

@@ -1,16 +0,0 @@
-# Managed by the mesh (module asus-zephyrus-g14). Replaced on every push; edit the catalogue instead.
-#
-# The discrete GPU's driver options on the ROG Zephyrus G14 (GA403, RTX 40 series, hybrid graphics).
-#
-# NVreg_DynamicPowerManagement=0x00 turns runtime D3 off. With it on, a change of power source sends
-# the driver an ACPI notification it fails to handle on this model ("RmHandleDNotifierEvent: Failed to
-# handle ACPI D-Notifier event, status=0x62"), and the GPU stops making progress until the machine is
-# powered off. Off costs a few idle watts in hybrid mode and keeps the machine up.
-#
-# NVreg_PreserveVideoMemoryAllocations=1 saves video memory across suspend, so what used the GPU still
-# works after waking. It needs nvidia-suspend, -hibernate and -resume to run around a sleep, which this
-# module's drop-ins on the sleep services ask for.
-#
-# A change here applies when the driver next loads: at the next boot.
-options nvidia NVreg_PreserveVideoMemoryAllocations=1
-options nvidia NVreg_DynamicPowerManagement=0x00