Fail only the packages when the package manager does not answer, and apply the rest, so a later declaration can restore what an earlier one removed (issue 233)

cmd/mesh-host/main.go

@@ -636,10 +636,15 @@ func runApply(ctx context.Context, opts options, d *declaration.Declaration, raw
 		return err
 	}
 	// And prove this is the machine the host was built for. Installing the arch host on Alpine
-	// must say so once, at the start, rather than failing later inside pacman.
-	if err := sys.Confirm(ctx, apply.ExecRunner); err != nil {
+	// must say so once, at the start, rather than failing later inside pacman. A package manager that
+	// does not answer fails only what needs it (novox/hq issue 233, probe.go).
+	probe, err := probePackageManager(ctx, sys)
+	if err != nil {
 		return err
 	}
+	if probe != nil {
+		fmt.Fprintf(out, "\n%s\n", probe.said())
+	}
 
 	fmt.Fprintf(out, "\napplying:\n")
 	// Minding the windows the daemon's scheduler has open: this runs as its own process, and a
@@ -671,6 +676,9 @@ func runApply(ctx context.Context, opts options, d *declaration.Declaration, raw
 	if applyErr != nil {
 		return applyErr
 	}
+	if probe != nil {
+		return probe.partial()
+	}
 
 	// Only now, and only after a clean apply: this version got as far as a completed
 	// reconcile, which is the whole of what "known good" claims (novox/hq ADR 0005). Not
@@ -1943,9 +1951,15 @@ func applyAndKeepHeld(ctx context.Context, opts options, raw []byte, signed *sto
 		return link.Report{Refused: err.Error()}
 	}
 
-	if err := built.Confirm(ctx, apply.ExecRunner); err != nil {
+	// A package manager that does not answer fails only what needs it, and the report says so (novox/hq
+	// issue 233, probe.go).
+	probe, err := probePackageManager(ctx, built)
+	if err != nil {
 		return link.Report{Refused: err.Error()}
 	}
+	if probe != nil {
+		announceOr(say)(probe.said())
+	}
 
 	// Declared, not carried. A declaration from the mesh removes only what the mesh previously
 	// declared — never what this machine raised for itself from its bundle (04-ISSUES/010).
@@ -2117,6 +2131,7 @@ func applyAndKeepHeld(ctx context.Context, opts options, raw []byte, signed *sto
 	if applyErr != nil {
 		report.Failed = map[string]string{"apply": applyErr.Error()}
 	}
+	report.Failed = withUnanswered(report.Failed, probe)
 	return report
 }
 

cmd/mesh-host/probe.go

@@ -0,0 +1,73 @@
+package main
+
+import (
+	"context"
+	"errors"
+
+	"github.com/novox/mesh-host/internal/apply"
+	"github.com/novox/mesh-host/internal/system"
+)
+
+// packageManagers are the tools a system's probe asks, for a system whose probe is its package manager.
+var packageManagers = map[string]string{"arch": "pacman", "alpine": "apk"}
+
+// unanswered is a probe of the package manager that failed before an apply: which tool, and its words.
+type unanswered struct {
+	tool  string
+	words string
+}
+
+// failedKey is how a report names the probe among what failed: one key, the same on every report, so the
+// mesh counts a package manager that keeps not answering as one failure that goes on.
+func (u *unanswered) failedKey() string { return "the package manager (" + u.tool + ")" }
+
+// said is the line the apply says before it begins.
+func (u *unanswered) said() string {
+	return u.tool + " does not answer here, so every package in this declaration fails and the rest of it is " +
+		"applied (novox/hq issue 233): " + u.words
+}
+
+// partial is the failure of an apply that applied everything else, when no package was declared to fail.
+func (u *unanswered) partial() error {
+	return errors.New("applied only in part: " + u.words + "\n\nevery resource that does not need " + u.tool +
+		" was attempted; none here needed it, and " + u.tool + " must answer before this machine applies whole " +
+		"(novox/hq issue 233)")
+}
+
+// probePackageManager proves the machine is the system the host was built for, before anything is applied.
+//
+// **A package manager that does not answer fails only what needs it** (novox/hq issue 233). The probe was a
+// refusal of the whole declaration — right for a host installed on a machine it was not built for, and a
+// wedge when what the probe reads is the mesh's own: a declaration that left the package manager's module
+// out removed its configuration file, and from then on every declaration was refused, the one that would
+// write the file back and the node-engine's own upgrade included. A person on the machine was the only way
+// back. Now the rest applies — files, units, accounts, the node-engine itself — and each package fails with
+// the probe's words (the system's PackageInstalled asks the same probe first), so a later declaration can
+// undo what an earlier one did. Before the rest is applied, a declaration composed from an older view of the
+// assignments than this machine applied has already been refused (issue 234's generation).
+//
+// A system with no package manager (android) still refuses whole: what its probe asks is the system itself,
+// which no resource the mesh declares can remove, and nothing else stands between it and the wrong machine.
+func probePackageManager(ctx context.Context, sys system.System) (*unanswered, error) {
+	err := sys.Confirm(ctx, apply.ExecRunner)
+	if err == nil {
+		return nil, nil
+	}
+	tool, ok := packageManagers[sys.Name()]
+	if !ok {
+		return nil, err
+	}
+	return &unanswered{tool: tool, words: err.Error()}, nil
+}
+
+// withUnanswered adds the probe to what a report says failed.
+func withUnanswered(failed map[string]string, u *unanswered) map[string]string {
+	if u == nil {
+		return failed
+	}
+	if failed == nil {
+		failed = map[string]string{}
+	}
+	failed[u.failedKey()] = u.said()
+	return failed
+}

cmd/mesh-host/probe_test.go

@@ -0,0 +1,58 @@
+package main
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/novox/mesh-host/internal/declaration"
+	"github.com/novox/mesh-host/internal/system"
+)
+
+// Defends novox/hq issue 233: a package manager that does not answer is said even when nothing declared
+// needs it — the apply is partial, never "applied" — and the report names it under one key, so the mesh
+// counts it as one failure that goes on.
+func TestAPackageManagerThatDoesNotAnswerIsSaidWithNoPackageDeclared(t *testing.T) {
+	unansweringPacman(t)
+	dir := t.TempDir()
+	opts := options{state: filepath.Join(dir, "state.json"), out: &strings.Builder{}}
+	conf := filepath.Join(dir, "pacman.conf")
+	raw := []byte(`{"declaration":1,"resources":[{"id":"pacman.conf","type":"file","path":"` + conf +
+		`","content":"[options]\n"}]}`)
+	d, err := declaration.ParseFileTrusted(raw)
+	if err != nil {
+		t.Fatal(err)
+	}
+	err = runApply(context.Background(), opts, d, raw, fromFile)
+	if err == nil || !strings.Contains(err.Error(), "applied only in part") || !strings.Contains(err.Error(), "could not be read") {
+		t.Fatalf("an apply whose package manager did not answer was not said to be partial: %v", err)
+	}
+	if _, statErr := os.Stat(conf); statErr != nil {
+		t.Fatalf("the file was not written: %v", statErr)
+	}
+
+	report := applyAndKeep(context.Background(), opts, raw, nil, nil, nil)
+	if report.Refused != "" {
+		t.Fatalf("refused whole: %s", report.Refused)
+	}
+	why, ok := report.Failed["the package manager (pacman)"]
+	if !ok || !strings.Contains(why, "could not be read") {
+		t.Errorf("the report does not name the package manager with the probe's words: %v", report.Failed)
+	}
+}
+
+// A system whose probe asks the system itself, not a tool a resource needs, still refuses whole: nothing
+// the mesh declares can remove it, and nothing else stands between that host and the wrong machine.
+func TestASystemWithNoPackageManagerStillRefusesWhole(t *testing.T) {
+	t.Setenv("PATH", t.TempDir())
+	sys, err := system.For("android")
+	if err != nil {
+		t.Fatal(err)
+	}
+	probe, err := probePackageManager(context.Background(), sys)
+	if err == nil || probe != nil {
+		t.Fatalf("the android host's failed probe did not refuse: %v, %+v", err, probe)
+	}
+}

cmd/mesh-host/replay233_test.go

@@ -0,0 +1,109 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/novox/mesh-host/internal/declaration"
+	"github.com/novox/mesh-host/internal/store"
+)
+
+// unansweringPacman puts a pacman on PATH that answers as one whose configuration file is gone, as the
+// workstation's did on 2026-10-04 (novox/hq issue 233), and makes this an arch host.
+func unansweringPacman(t *testing.T) {
+	t.Helper()
+	bin := t.TempDir()
+	script := "#!/bin/sh\necho 'error: config file /etc/pacman.conf could not be read: No such file or directory' >&2\nexit 1\n"
+	if err := os.WriteFile(filepath.Join(bin, "pacman"), []byte(script), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("PATH", bin+string(os.PathListSeparator)+os.Getenv("PATH"))
+	was := builtFor
+	builtFor = "arch"
+	t.Cleanup(func() { builtFor = was })
+}
+
+// TestReplay233 replays novox/hq issue 233. The package manager's module wrote pacman's configuration
+// file; a declaration that left the module out removed it; from then on pacman did not answer, and the
+// node-engine refused every declaration whole — the one that named the module again and would have
+// written the file back included. A person restored the file by hand an hour and a half later.
+//
+// Held to: a declaration that restores the file is applied while pacman does not answer. Only what needs
+// pacman fails, with the probe's words; the file is written and recorded. Written only with what the
+// node-engine had before the fix, so it lays over the commit before it, where it fails.
+func TestReplay233(t *testing.T) {
+	unansweringPacman(t)
+	dir := t.TempDir()
+	opts := options{state: filepath.Join(dir, "state.json")}
+	conf := filepath.Join(dir, "pacman.conf")
+	raw := []byte(`{"declaration":1,"resources":[` +
+		`{"id":"pacman.conf","type":"file","path":"` + conf + `","content":"[options]\n"},` +
+		`{"id":"pacman.base","type":"package","package":"base"}]}`)
+
+	report := applyAndKeep(context.Background(), opts, raw, nil, nil, nil)
+
+	if report.Refused != "" {
+		t.Fatalf("the declaration that restores the package manager's configuration was refused whole: %s", report.Refused)
+	}
+	if got, err := os.ReadFile(conf); err != nil || string(got) != "[options]\n" {
+		t.Fatalf("the file that restores the package manager was not written: %q, %v", got, err)
+	}
+	known, err := store.Load(opts.state)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := known.Find("pacman.conf"); !ok {
+		t.Error("the file written was not recorded, so the next apply would not know it is the mesh's")
+	}
+	words := strings.Join(failedWords(report.Failed), "\n")
+	if !strings.Contains(words, "pacman does not answer") || !strings.Contains(words, "could not be read") {
+		t.Errorf("the report does not say the package manager did not answer, in the probe's words: %q", words)
+	}
+	if !strings.Contains(words, "pacman.base") {
+		t.Errorf("the report does not name the package that was not applied: %q", words)
+	}
+}
+
+func failedWords(failed map[string]string) []string {
+	var out []string
+	for id, why := range failed {
+		out = append(out, id+": "+why)
+	}
+	return out
+}
+
+// Defends novox/hq issue 233 at the machine: `mesh-host apply` applies what does not need the package
+// manager, and says the apply was partial with the probe's words — a non-zero exit, never "applied".
+func TestApplyByHandAppliesWhatDoesNotNeedAPackageManagerThatDoesNotAnswer(t *testing.T) {
+	unansweringPacman(t)
+	dir := t.TempDir()
+	out := &bytes.Buffer{}
+	opts := options{state: filepath.Join(dir, "state.json"), out: out}
+	conf := filepath.Join(dir, "pacman.conf")
+	raw := []byte(`{"declaration":1,"resources":[` +
+		`{"id":"pacman.conf","type":"file","path":"` + conf + `","content":"[options]\n"},` +
+		`{"id":"pacman.base","type":"package","package":"base"}]}`)
+	d, err := declaration.ParseFileTrusted(raw)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = runApply(context.Background(), opts, d, raw, fromFile)
+
+	if _, statErr := os.Stat(conf); statErr != nil {
+		t.Fatalf("the file was not written: %v (the apply said %v)", statErr, err)
+	}
+	if err == nil {
+		t.Fatal("an apply whose package manager did not answer said it applied")
+	}
+	if !strings.Contains(err.Error(), "pacman does not answer") || !strings.Contains(err.Error(), "pacman.base") {
+		t.Errorf("the failure does not name the package or the probe's words: %v", err)
+	}
+	if !strings.Contains(out.String(), "pacman does not answer") {
+		t.Errorf("what was said before applying does not say the package manager does not answer:\n%s", out.String())
+	}
+}