Apply only the node's own compositions, never the controller's

The controller ended by its unassignment, so a node that falls back to the
compositions in its bucket follows what nobody writes (issue 1126, A7). The
node agent now always runs its own composer: without a placement key it
composes nothing and keeps what runs, a placement it cannot watch stops the
agent and is said, and a candidate taking its placement away is refused
instead of answered as a return to the controller. The start-time placement
read, the end-when-placed watchers and the returning answer go, with their
tests and the three integration tests of the controller-composed path.

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

cmd/mesh-host/nodeagent_integration_test.go

@@ -21,7 +21,6 @@ import (
 	"github.com/novox/mesh-host/internal/agent"
 	"github.com/novox/mesh-host/internal/link"
 	"github.com/novox/mesh-host/internal/selfcompose"
-	"github.com/novox/mesh-host/internal/store"
 )
 
 // The node agent whole, against a real bus with JetStream started in the test: the wants bucket, the node's composition
@@ -237,126 +236,6 @@ func within(t *testing.T, d time.Duration, what string, ok func() bool) {
 	}
 }
 
-// R6-A AC1: given a running agent on a bus, when a want naming a digest and that composition are written, the module is
-// applied within one second and its have names the fingerprint and the digest; a composition whose digest no want names
-// is not applied.
-func TestNatsAWantAndItsCompositionAreAppliedWithinASecond(t *testing.T) {
-	t.Run("1957: an engine start starts a declared-running unit", testNatsAnEngineStartStartsADeclaredRunningUnitTheHaveSaysRuns)
-	b := newItBed(t)
-	stop := b.start(false)
-	defer stop()
-	time.Sleep(300 * time.Millisecond) // the watches are up
-
-	fp := fpIt("a")
-	dig := b.compose("web", fp, "one\n", false, b.controll)
-	time.Sleep(300 * time.Millisecond)
-	if b.file("web") != "" {
-		t.Fatal("a composition no want names was applied")
-	}
-	began := time.Now()
-	b.want("web", fp, dig, "")
-	within(t, time.Second, "the module was not applied within one second of its want", func() bool { return b.file("web") == "one\n" })
-	t.Logf("applied %s after the want", time.Since(began))
-	within(t, 2*time.Second, "the have does not name the fingerprint and the digest", func() bool {
-		h := b.have("web")
-		return h.FP == fp && h.Composed == dig && h.Phase == delivery.PhaseRunning
-	})
-
-	// A want naming a digest the composition at its fingerprint does not have applies nothing.
-	fp2 := fpIt("b")
-	b.compose("web", fp2, "two\n", false, b.controll)
-	b.want("web", fp2, "sha256:"+strings.Repeat("0", 64), "")
-	time.Sleep(300 * time.Millisecond)
-	if b.file("web") != "one\n" {
-		t.Fatalf("a want naming another digest changed the module: %q", b.file("web"))
-	}
-}
-
-// R6-A AC5: a data module that ran before asks its backup before any resource changes; a backup that fails holds the
-// module (nothing applied, the have says held with the backup's words); when its want then says skip, it is applied.
-func TestNatsADataModuleAsksItsBackupFirstAndIsHeldWhenItFails(t *testing.T) {
-	b := newItBed(t)
-	var mu sync.Mutex
-	var asked []string
-	var onDiskWhenAsked string
-	if _, err := b.conn.Subscribe("mesh.seat.node-backup.tool.now."+itNode, func(m *nats.Msg) {
-		mu.Lock()
-		asked = append(asked, "now")
-		onDiskWhenAsked = b.file("db")
-		mu.Unlock()
-		_ = m.Respond([]byte(`{"result":{"started":"db"}}`))
-		// The holder says the backup ended on its event.
-		ev, _ := json.Marshal(map[string]any{"node": itNode, "module": "db", "ok": false, "at": time.Now().UTC(),
-			"error": "restic: the repository is locked"})
-		_ = b.conn.Publish(backedUpEvent, ev)
-	}); err != nil {
-		t.Fatal(err)
-	}
-	stop := b.start(false)
-	defer stop()
-	time.Sleep(300 * time.Millisecond)
-
-	fp1, fp2 := fpIt("a"), fpIt("b")
-	b.want("db", fp1, b.compose("db", fp1, "v1\n", true, b.controll), "")
-	within(t, 3*time.Second, "the first composition was not applied", func() bool { return b.file("db") == "v1\n" })
-	mu.Lock()
-	if len(asked) != 0 {
-		t.Fatalf("a module that never ran was backed up: %v", asked)
-	}
-	mu.Unlock()
-
-	dig2 := b.compose("db", fp2, "v2\n", true, b.controll)
-	b.want("db", fp2, dig2, "")
-	within(t, 3*time.Second, "the module was not held behind the failed backup", func() bool {
-		h := b.have("db")
-		return h.Phase == delivery.PhaseHeld && strings.Contains(h.Detail, "repository is locked")
-	})
-	mu.Lock()
-	if len(asked) != 1 || onDiskWhenAsked != "v1\n" {
-		t.Fatalf("the backup was asked %v, with %q on disk: it is asked before any resource changes", asked, onDiskWhenAsked)
-	}
-	mu.Unlock()
-	if b.file("db") != "v1\n" {
-		t.Fatalf("something was applied behind a failed backup: %q", b.file("db"))
-	}
-	if h := b.have("db"); h.FP != fp1 {
-		t.Fatalf("a held module should still name what it runs: %+v", h)
-	}
-
-	b.want("db", fp2, dig2, delivery.BackupSkip)
-	within(t, 3*time.Second, "the module was not applied once its want said skip", func() bool { return b.file("db") == "v2\n" })
-	within(t, 2*time.Second, "the have does not say running at the new fingerprint", func() bool {
-		h := b.have("db")
-		return h.Phase == delivery.PhaseRunning && h.FP == fp2 && h.Composed == dig2
-	})
-}
-
-// R6-A AC9, the hand path end to end: with no controller running, a composition signed by the operator's key and a want
-// naming it are applied and the have written; the same signed by a key nobody trusts is not.
-func TestNatsTheHandPathAppliesACompositionTheOperatorSigned(t *testing.T) {
-	b := newItBed(t)
-	stop := b.start(true)
-	defer stop()
-	time.Sleep(300 * time.Millisecond)
-
-	_, stranger, _ := ed25519.GenerateKey(nil)
-	fpS := fpIt("c")
-	b.want("evil", fpS, b.compose("evil", fpS, "no\n", false, stranger), "")
-	time.Sleep(300 * time.Millisecond)
-	if b.file("evil") != "" {
-		t.Fatal("a composition signed by a key nobody trusts was applied")
-	}
-
-	fp := fpIt("d")
-	dig := b.compose("rescue", fp, "back\n", false, b.operator)
-	b.want("rescue", fp, dig, "")
-	within(t, 2*time.Second, "the operator's composition was not applied", func() bool { return b.file("rescue") == "back\n" })
-	within(t, 2*time.Second, "the have was not written", func() bool {
-		h := b.have("rescue")
-		return h.FP == fp && h.Composed == dig && h.Phase == delivery.PhaseRunning
-	})
-}
-
 // Issue 1126 (ADR 0547 §2, the milestone's H8): the node agent started whole against a real bus, once the catalogue
 // places its node (the placement written after it started), composes a module from its want, the indexer's manifest, its record and its mesh-config value, and applies it,
 // with no key in the controller's compositions; a changed config value is composed again on its event and applied as a
@@ -478,9 +357,10 @@ func h8once(t *testing.T, b *itBed, resolved, candidates nats.KeyValue, place []
 	}
 }
 
-// h8back is the way back (issue 1126, the seed's revert): a candidate deleting the node's placement is compared with
-// the controller's compositions at its wants (here none: refused, naming web), and the placement key deleted returns the agent to them without a
-// restart, said in the journal and the node's have, keeping what runs.
+// h8back is A7 of issue 1126: no composition made elsewhere is applied. A candidate deleting the node's placement is
+// refused, never answered as a return to the controller's compositions; the placement key deleted leaves the agent on
+// its own composer, composing nothing and keeping what runs, said in the journal, the node's have still saying it
+// composes its own.
 func h8back(t *testing.T, b *itBed, placement, resolved, candidates nats.KeyValue, hkey string) {
 	t.Helper()
 	node := func() delivery.HaveNode {
@@ -502,65 +382,38 @@ func h8back(t *testing.T, b *itBed, placement, resolved, candidates nats.KeyValu
 	if _, err := candidates.Put(ckey, craw); err != nil {
 		t.Fatal(err)
 	}
-	// The controller holds no composition at web's want (the node composed its own): returning would leave web with
-	// nothing to apply, and the answer says so rather than "same" (review of the shadow, round 1).
-	within(t, 10*time.Second, "the node did not refuse returning to compositions the controller does not hold", func() bool {
+	within(t, 10*time.Second, "the node did not refuse a candidate taking its placement away", func() bool {
 		a := node().Candidates["revert-x"]
 		return a.Proposal == "revert-x" && a.Returns == "" && a.Verdict == delivery.CandidateRefused &&
-			strings.Contains(a.Refused, "web: the controller holds no composition")
+			strings.Contains(a.Refused, "composes nothing")
 	})
 	ran := b.have("web").Composed
 	pkey, _ := delivery.PlacementNodeKey(itNode)
-	// A pass in flight at the switch (issue 1126, 2026-10-28: the last pass of the own run, failing on its run's end,
-	// marked the next agent's modules failed): a config value changed starts one, and the key goes at once.
+	// A pass in flight when the key goes (issue 1126, 2026-10-28): a config value changed starts one, and the key goes at once.
 	if _, err := resolved.Put(itNode+".web.greeting", []byte(`{"value":"salut","source":"module"}`)); err != nil {
 		t.Fatal(err)
 	}
 	if err := placement.Delete(pkey); err != nil {
 		t.Fatal(err)
 	}
-	stopWatch := make(chan struct{})
-	marked := make(chan Have1126, 1)
-	go func() {
-		for {
-			select {
-			case <-stopWatch:
-				return
-			case <-time.After(20 * time.Millisecond):
-			}
-			if h := b.have("web"); h.Phase == delivery.PhaseFailed {
-				select {
-				case marked <- Have1126{h.Phase, h.Detail}:
-				default:
-				}
-				return
-			}
-		}
-	}()
-	defer close(stopWatch)
-	within(t, 15*time.Second, "the node did not return to the controller's compositions when its placement went", func() bool {
+	within(t, 15*time.Second, "the node did not say it composes nothing once its placement went", func() bool {
 		b.mu.Lock()
 		said := strings.Join(b.said, "\n")
 		b.mu.Unlock()
-		return strings.Contains(said, "key in the seat's placement state is gone") && node().Composes == delivery.ComposesController
+		return strings.Contains(said, "key in the seat's placement state is gone: it composes nothing of its own")
 	})
 	time.Sleep(3 * time.Second) // what a pass in flight would mark lands within it
-	select {
-	case h := <-marked:
-		t.Errorf("a pass in flight at the switch marked web failed: %+v", h)
-	default:
+	b.mu.Lock()
+	said := strings.Join(b.said, "\n")
+	b.mu.Unlock()
+	if n := node(); n.Composes != delivery.ComposesOwn || strings.Contains(said, "applying the controller's compositions") {
+		t.Errorf("without its placement the node turned to the controller's compositions: %q", n.Composes)
 	}
 	if h := b.have("web"); h.Composed != ran || h.Phase == delivery.PhaseFailed || b.file("web") != "greeting=salut\n" {
-		t.Errorf("returning to the controller's compositions moved what runs: %+v, %q", h, b.file("web"))
+		t.Errorf("without its placement what runs moved: %+v, %q", h, b.file("web"))
 	}
 }
 
-// Have1126 is what H8's way back watches of web's have.
-type Have1126 struct {
-	Phase  delivery.Phase
-	Detail string
-}
-
 // h8state is what h8 set up that the rest of H8 writes to.
 type h8state struct {
 	placement, resolved, candidates nats.KeyValue
@@ -730,71 +583,3 @@ func h8rest(t *testing.T, b *itBed, resolved, candidates nats.KeyValue, hkey str
 		t.Errorf("a candidate moved what runs: %+v, %q", h, b.file("web"))
 	}
 }
-
-// 1957/AC1 (integration; ADR 0568 §1): a node agent starting on a bus that holds a `running` have for a module at its want,
-// with a service manager (a systemctl on the PATH) that shows the module's unit inactive, starts the unit once and writes
-// the have running; the same start with the unit active applies nothing.
-func testNatsAnEngineStartStartsADeclaredRunningUnitTheHaveSaysRuns(t *testing.T) {
-	for _, active := range []bool{false, true} {
-		b := newItBed(t)
-		bin := t.TempDir()
-		stateFile, calls := filepath.Join(bin, "state"), filepath.Join(bin, "calls")
-		if active {
-			os.WriteFile(stateFile, []byte("active"), 0o644)
-		} else {
-			os.WriteFile(stateFile, []byte("inactive"), 0o644)
-		}
-		script := "#!/bin/sh\necho \"$@\" >> " + calls + "\ncase \"$1\" in\n" +
-			"show) printf 'LoadState=loaded\\nActiveState=%s\\nType=simple\\n' \"$(cat " + stateFile + ")\" ;;\n" +
-			"start) printf active > " + stateFile + " ;;\nis-enabled) echo enabled ;;\nesac\nexit 0\n"
-		if err := os.WriteFile(filepath.Join(bin, "systemctl"), []byte(script), 0o755); err != nil {
-			t.Fatal(err)
-		}
-		t.Setenv("PATH", bin+string(os.PathListSeparator)+os.Getenv("PATH"))
-
-		// The engine's own record of the unit, as a previous run left it, and the have it wrote then.
-		res, _ := json.Marshal(map[string]any{"id": "web.unit", "type": "service", "unit": "web-it.service", "state": "running", "module": "web"})
-		var known store.State
-		known.Record(store.Applied{ID: "web.unit", Type: "service", Target: "web-it.service"})
-		if err := store.Save(b.opts.state, known); err != nil {
-			t.Fatal(err)
-		}
-		fp := fpIt("a")
-		c := delivery.Composed{Node: itNode, Module: "web", FP: fp, Resources: []json.RawMessage{res}}
-		signed, _ := delivery.SignComposed(c, b.controll)
-		raw, _ := delivery.EncodeComposed(signed)
-		dig, _ := delivery.ComposedDigestOf(signed)
-		key, _ := delivery.ComposedKey(itNode, "web", fp)
-		if _, err := b.composed.Put(key, raw); err != nil {
-			t.Fatal(err)
-		}
-		b.want("web", fp, dig, "")
-		hkey, _ := delivery.HaveKey(itNode, "web")
-		have, err := delivery.EncodeHave(delivery.Have{FP: fp, Composed: dig, Phase: delivery.PhaseRunning, Health: delivery.HealthUnknown})
-		if err != nil {
-			t.Fatal(err)
-		}
-		if _, err := b.haves.Put(hkey, have); err != nil {
-			t.Fatal(err)
-		}
-
-		stop := b.start(false)
-		within(t, 5*time.Second, "the unit was not started and the have not running", func() bool {
-			got, _ := os.ReadFile(stateFile)
-			h := b.have("web")
-			return string(got) == "active" && h.Phase == delivery.PhaseRunning && h.Composed == dig
-		})
-		time.Sleep(300 * time.Millisecond)
-		stop()
-		starts := 0
-		log, _ := os.ReadFile(calls)
-		for _, l := range strings.Split(string(log), "\n") {
-			if strings.HasPrefix(l, "start") {
-				starts++
-			}
-		}
-		if want := map[bool]int{false: 1, true: 0}[active]; starts != want {
-			t.Fatalf("unit active=%v: started %d times, want %d", active, starts, want)
-		}
-	}
-}