Merge pull request 'Pin mesh-sdk dbcaa29, so a held module's hold no longer spreads to the modules that read from it (issue 1960)' (#175) from fix/1960-no-hold-spread into main

go.mod

@@ -3,7 +3,7 @@ module github.com/novox/mesh-host
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028234900-c2999a4e13cc
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261029145421-dbcaa29a1a38
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 	golang.org/x/crypto v0.57.0

go.sum

@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028234900-c2999a4e13cc h1:mOk2tAKTiuvnap/BUIYz91lLVbHi/EB6JPAD6KxTPvc=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261029145421-dbcaa29a1a38 h1:gJwMmK8isI9HwFM2WOCZXjiTqZmGQxs2UY38stk1ZOA=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028234900-c2999a4e13cc/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261029145421-dbcaa29a1a38/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=

internal/selfcompose/selfcompose_test.go

@@ -315,9 +315,9 @@ func TestTheNodeComposesItsWantsFromTheBus(t *testing.T) {
 	}
 	// Issue 1126, the applying path (review of the seed): one module's own refusal holds that module alone. On novox,
 	// de-spiegel's unset route names (its manifest at the indexer's commit e25e1beb, captured) refused the whole node and
-	// marked all its modules not composed. Now lemurs is handed; de-spiegel is held, and proxy with it, which receives its
+	// marked all its modules not composed. Now lemurs and proxy are handed; de-spiegel is held alone (issue 1960: a hold
-	// routes: what was handed of de-spiegel stays handed, so the node keeps running it, and the agent is told those two
+	// never spreads to proxy, which composes without its routes, nor to its smtp provider): what was handed of de-spiegel
-	// alone, de-spiegel in its config form's words.
+	// stays handed, so the node keeps running it, and the agent is told it alone, in its config form's words.
 	spiegel, err := os.ReadFile("testdata/de-spiegel-e25e1beb.module.json")
 	if err != nil {
 		t.Fatal(err)
@@ -353,15 +353,17 @@ func TestTheNodeComposesItsWantsFromTheBus(t *testing.T) {
 	if u, ok := handed3[lemursKey3]; !ok || u.Deleted {
 		t.Errorf("lemurs, which composes, is not handed beside de-spiegel's refusal: %v (told %q)", handed3, *told)
 	}
-	if u, ok := handed3[proxyKey]; ok {
+	// Issue 1960: a hold never spreads. proxy is handed, composed without held de-spiegel's routes, which do not compose.
-		t.Errorf("proxy is handed without held de-spiegel's routes: %+v", u)
+	if u, ok := handed3[proxyKey]; !ok || u.Deleted {
+		t.Errorf("proxy is not handed beside held de-spiegel: %v (told %q)", handed3, *told)
 	}
 	if u, ok := handed3[spiegelKey]; ok {
 		t.Errorf("held de-spiegel is handed %+v, want what was handed of it kept", u)
 	}
 	if len(*told) != 1 || !strings.HasPrefix((*told)[0], "held de-spiegel: ") || !strings.Contains((*told)[0], "${config:praktijk-name}") ||
-		!strings.Contains((*told)[0], "held proxy: ") || strings.Contains((*told)[0], "held lemurs") {
+		!strings.Contains((*told)[0], "without what it contributes to route") || strings.Contains((*told)[0], "held proxy") ||
-		t.Errorf("the agent was told %q, want de-spiegel held in its config form's words, and proxy", *told)
+		strings.Contains((*told)[0], "held lemurs") {
+		t.Errorf("the agent was told %q, want de-spiegel held alone, in its config form's words, without its routes", *told)
 	}
 
 	// A read the bus did not answer, timed out or not, is tried again later; the run's own end and a refusal are not.