A scheduled step may hold its module's own containers still (hq ADR 0189)

while-stopped names resource ids of the same module's containers; the host
stops them before the run and starts them again after it, in reverse order,
whatever the step did. The restart is deferred before the first stop and runs
on its own context, because the one real risk of this field is a window that
never closes.

Scheduled steps only: at apply the declaration is applied in order and a
run-once step already gates what follows.

internal/apply/apply.go

@@ -1041,38 +1041,6 @@ type unitReloader interface {
 	ReloadUnits(ctx context.Context, run system.Runner) error
 }
 
-// serviceSettle is how long the host waits before looking at a unit a second time. A test sets it
-// to nothing; on a machine it is the window in which a daemon that refuses its configuration dies.
-var serviceSettle = 2 * time.Second
-
-// stayedRunning is the state of a unit the host has just asked to run, read twice.
-//
-// **Because the first read races the failure.** A service manager returns when it has started the
-// process, and the unit is "activating" or "active" at that instant whatever the process is about
-// to do. A daemon that reads its configuration, refuses it and exits does so a fraction of a second
-// later — fail2ban took 221 milliseconds the day this was written — so a single read back says
-// running about a machine whose daemon is already gone, and the apply reports "restarted" for a
-// service that is dead. Every ban on both public machines was lost that way while every check
-// passed (novox/hq ADR 0184), which is the one shape of failure this host exists to refuse.
-//
-// So it looks again, after the moment in which that happens. It does not wait for a slow unit to
-// finish starting: a unit still coming up reads as running both times and is accepted, as before.
-// What this catches is a unit that was running and is not any more.
-func stayedRunning(ctx context.Context, sys system.System, run Runner, unit string) (string, error) {
-	state, err := sys.ServiceState(ctx, run, unit)
-	if err != nil || state != "running" {
-		return state, err
-	}
-	timer := time.NewTimer(serviceSettle)
-	defer timer.Stop()
-	select {
-	case <-ctx.Done():
-		return state, ctx.Err()
-	case <-timer.C:
-	}
-	return sys.ServiceState(ctx, run, unit)
-}
-
 func applyService(ctx context.Context, sys system.System, r *declaration.Service, run Runner,
 	changed map[string]bool, previous store.Applied) (Outcome, error) {
 	if r.Stateless() {
@@ -1152,9 +1120,6 @@ func applyService(ctx context.Context, sys system.System, r *declaration.Service
 		// Read back. A service manager accepting a command says the transaction was accepted,
 		// not that the unit is running — one that starts and immediately dies satisfies it.
 		after, err := sys.ServiceState(ctx, run, r.Unit)
-		if err == nil && r.State == "running" {
-			after, err = stayedRunning(ctx, sys, run, r.Unit)
-		}
 		if err != nil {
 			return out, err
 		}
@@ -1175,7 +1140,7 @@ func applyService(ctx context.Context, sys system.System, r *declaration.Service
 		}
 		// Read back, for the same reason as above: a unit that starts and immediately dies
 		// satisfies a service manager and nothing else.
-		after, err := stayedRunning(ctx, sys, run, r.Unit)
+		after, err := sys.ServiceState(ctx, run, r.Unit)
 		if err != nil {
 			return out, err
 		}
@@ -1265,7 +1230,7 @@ func reflectOnly(ctx context.Context, sys system.System, r *declaration.Service,
 	}
 	// Read back: it was running, and a restart or reload that left it otherwise is a failure —
 	// the machine's network manager down is not a change to report and move past.
-	after, err := stayedRunning(ctx, sys, run, r.Unit)
+	after, err := sys.ServiceState(ctx, run, r.Unit)
 	if err != nil {
 		return out, err
 	}
@@ -1442,25 +1407,6 @@ func applyPackage(ctx context.Context, sys system.System, r *declaration.Package
 	if err != nil {
 		return out, err
 	}
-	if r.Absent {
-		// Declared absent (novox/hq ADR 0180): removed when it is here, left alone when it is not.
-		if !installed {
-			out.Action = "unchanged"
-			out.Detail = "not installed, as declared"
-			return out, nil
-		}
-		if err := sys.RemovePackage(ctx, run, r.Package); err != nil {
-			return out, fmt.Errorf("removing %s: %w", r.Package, err)
-		}
-		if still, err := sys.PackageInstalled(ctx, run, r.Package); err != nil {
-			return out, err
-		} else if still {
-			return out, fmt.Errorf("%s was removed without error and the package database still has it", r.Package)
-		}
-		out.Action = "removed"
-		out.Detail = "declared absent; its configuration is left where the package manager leaves it"
-		return out, nil
-	}
 	if installed {
 		out.Action = "unchanged"
 		out.Detail = "already installed"
@@ -1642,10 +1588,6 @@ func containerSpecReading(r *declaration.Container, declares, reads map[string]s
 	for _, c := range r.Capabilities {
 		b.WriteString("cap " + c + "\n")
 	}
-	// And where it logs (ADR 0179): the runtime cannot move a running container's output.
-	if r.Logging != "" {
-		b.WriteString("log " + r.Logging + "\n")
-	}
 	// The cadence is part of what was declared, so a changed schedule is a changed spec — the marker
 	// moves and the install is reported "updated" and re-established. Added only when present, so no
 	// ordinary container's or run-once step's digest moves for a field it does not set.
@@ -1843,11 +1785,6 @@ func applyContainer(ctx context.Context, r *declaration.Container, run Runner,
 	for _, c := range r.Capabilities {
 		args = append(args, "--cap-add", c)
 	}
-	if r.Logging != "" {
-		// The journal keeps the container's name on every line (CONTAINER_NAME), which is what a
-		// jail matches on (novox/hq ADR 0179); `docker logs` keeps working against the journal.
-		args = append(args, "--log-driver", r.Logging)
-	}
 	for _, d := range r.Dns {
 		args = append(args, "--dns", d)
 	}

internal/apply/left_out_test.go

@@ -173,42 +173,3 @@ func TestACapabilityReachesTheRuntimeAndTheSpec(t *testing.T) {
 		t.Fatal("a capability is not part of the container's spec")
 	}
 }
-
-// A package may be declared absent (novox/hq ADR 0180): removed when it is installed, read back,
-// left alone when it is not.
-func TestAPackageDeclaredAbsentIsRemovedWhenPresentAndLeftWhenNot(t *testing.T) {
-	installed := true
-	var ran []string
-	run := func(_ context.Context, name string, args ...string) (string, error) {
-		ran = append(ran, name+" "+strings.Join(args, " "))
-		if name != "pacman" {
-			return "", nil
-		}
-		switch args[0] {
-		case "-Q":
-			if args[1] == "pacman" || installed {
-				return args[1] + " 1.0\n", nil
-			}
-			return "", errors.New("package not found")
-		case "-R":
-			installed = false
-		}
-		return "", nil
-	}
-	d := parseTrusted(t, `{"declaration":1,"resources":[{"id":"front-end","type":"package","package":"ufw","absent":true}]}`)
-	report, _, err := Apply(context.Background(), archHost(t), d, store.State{}, store.OriginCarried, run, nil, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if report.Outcomes[0].Action != "removed" || !strings.Contains(strings.Join(ran, "\n"), "pacman -R --noconfirm ufw") {
-		t.Fatalf("an installed package declared absent was not removed: %+v\n%v", report.Outcomes[0], ran)
-	}
-	ran = nil
-	report, _, err = Apply(context.Background(), archHost(t), d, store.State{}, store.OriginCarried, run, nil, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if report.Outcomes[0].Action != "unchanged" || strings.Contains(strings.Join(ran, "\n"), "-R") {
-		t.Fatalf("a package already absent was touched: %+v\n%v", report.Outcomes[0], ran)
-	}
-}

internal/apply/logging_test.go

@@ -1,43 +0,0 @@
-package apply
-
-import (
-	"context"
-	"strings"
-	"testing"
-
-	"github.com/novox/mesh-host/internal/declaration"
-	"github.com/novox/mesh-host/internal/store"
-)
-
-// A container declared to log to the journal is run with the journal as its log driver, and the
-// place it logs is part of its spec, so moving it recreates the container (novox/hq ADR 0179).
-func TestAContainerLoggingToTheJournalIsRunThatWayAndRecreatedWhenMoved(t *testing.T) {
-	pinned := "postgres@sha256:" + strings.Repeat("a", 64)
-	var ran []string
-	run := func(_ context.Context, cmd string, args ...string) (string, error) {
-		if cmd == "docker" && len(args) > 0 && args[0] == "run" {
-			ran = args
-			return "deadbeef\n", nil
-		}
-		return "", nil
-	}
-	d := parseTrusted(t, `{"declaration":1,"resources":[
-	  {"id":"front","type":"container","name":"front","image":"`+pinned+`","logging":"journald"}
-	]}`)
-	_, _, _ = Apply(context.Background(), archHost(t), d, store.State{}, store.OriginCarried, run, nil, nil)
-	sent := false
-	for i, a := range ran {
-		if a == "--log-driver" && i+1 < len(ran) && ran[i+1] == "journald" {
-			sent = true
-		}
-	}
-	if !sent {
-		t.Fatalf("the container's output was not sent to the journal: %v", ran)
-	}
-	with := d.Resources[0].(*declaration.Container)
-	without := *with
-	without.Logging = ""
-	if containerSpec(with, inputs{}) == containerSpec(&without, inputs{}) {
-		t.Fatal("where a container logs is not part of its spec, so moving it would not recreate it")
-	}
-}

internal/apply/maintenance_window_test.go

@@ -0,0 +1,196 @@
+package apply
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-host/internal/declaration"
+)
+
+// A scheduled step may hold its module's own containers still while it runs (novox/hq ADR 0189,
+// issue 108).
+//
+// What it exists for: the artifact store's collector walks the storage and requires every writer
+// stopped. A run-once step runs beside containers and a scheduled one is the same container again,
+// so the mesh had no way to say it — which is why the store it inherited has never collected
+// anything. The risk the field brings is one shape only: a window that opens and never closes.
+// Every test here is about that shape.
+
+// windowRun records the order of stop / run / start, which is the whole of what is being asserted.
+type windowRun struct {
+	mu     sync.Mutex
+	order  []string
+	failAt string // the arg[0] that should fail ("run" makes the step fail)
+	wontGo string // a container name that refuses to start again
+}
+
+func (w *windowRun) run(_ context.Context, _ string, args ...string) (string, error) {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	switch args[0] {
+	case "info":
+		return "27.0\n", nil
+	case "stop", "start":
+		w.order = append(w.order, args[0]+" "+args[1])
+		if args[0] == "start" && args[1] == w.wontGo {
+			return "", errors.New("the runtime refused")
+		}
+	case "run":
+		w.order = append(w.order, "run")
+		if w.failAt == "run" {
+			return "", errors.New("the step exited non-zero")
+		}
+	}
+	return "", nil
+}
+
+func (w *windowRun) seen() []string {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	return append([]string{}, w.order...)
+}
+
+// aStoreWithACollector is a module in the shape distribution has: a server that must not be
+// writing, and a nightly step that walks its storage with the server held still.
+func aStoreWithACollector(t *testing.T) *declaration.Declaration {
+	t.Helper()
+	return parseTrusted(t, `{"declaration":1,"resources":[
+	  {"id":"store","type":"container","name":"mesh-registry","image":"`+pinned+`"},
+	  {"id":"collect","type":"container","name":"mesh-registry-collect","image":"`+pinned+`",
+	   "schedule":"30 3 * * *","while-stopped":["store"]}
+	]}`)
+}
+
+func fireOnce(t *testing.T, d *declaration.Declaration, w *windowRun) {
+	t.Helper()
+	clock := &fixedClock{now: time.Date(2026, 10, 2, 3, 29, 0, 0, time.UTC)}
+	s := NewScheduler(clock, w.run, func(string) {})
+	s.Sync(d, nil)
+	s.Advance(context.Background(), time.Date(2026, 10, 2, 3, 30, 5, 0, time.UTC))
+	s.Wait()
+}
+
+func TestAScheduledStepHoldsItsModulesContainerStillAndStartsItAgain(t *testing.T) {
+	w := &windowRun{}
+	fireOnce(t, aStoreWithACollector(t), w)
+
+	got := w.seen()
+	want := []string{"stop mesh-registry", "run", "start mesh-registry"}
+	var kept []string
+	for _, line := range got {
+		if strings.HasPrefix(line, "stop mesh-registry-collect") {
+			// Clearing the step's own exited container by name; not part of the window.
+			continue
+		}
+		kept = append(kept, line)
+	}
+	if len(kept) != len(want) {
+		t.Fatalf("the window was not stop, run, start: %v", got)
+	}
+	for i := range want {
+		if kept[i] != want[i] {
+			t.Fatalf("the window was %v, want %v", kept, want)
+		}
+	}
+}
+
+// The one that matters: a step that fails must leave the service running.
+func TestAFailedStepStillClosesTheWindow(t *testing.T) {
+	w := &windowRun{failAt: "run"}
+	fireOnce(t, aStoreWithACollector(t), w)
+
+	var started bool
+	for _, line := range w.seen() {
+		if line == "start mesh-registry" {
+			started = true
+		}
+	}
+	if !started {
+		t.Fatalf("the step failed and the container it held still was never started again: %v", w.seen())
+	}
+}
+
+// A container that will not come back is said loudly: it is down, and nothing else notices until
+// the next apply compares it.
+func TestAContainerThatWillNotStartAgainIsSaidLoudly(t *testing.T) {
+	w := &windowRun{wontGo: "mesh-registry"}
+	var said []string
+	clock := &fixedClock{now: time.Date(2026, 10, 2, 3, 29, 0, 0, time.UTC)}
+	s := NewScheduler(clock, w.run, func(line string) { said = append(said, line) })
+	s.Sync(aStoreWithACollector(t), nil)
+	s.Advance(context.Background(), time.Date(2026, 10, 2, 3, 30, 5, 0, time.UTC))
+	s.Wait()
+
+	var loud bool
+	for _, line := range said {
+		if strings.Contains(line, "WILL NOT START AGAIN") && strings.Contains(line, "mesh-registry") {
+			loud = true
+		}
+	}
+	if !loud {
+		t.Fatalf("a service left stopped by a maintenance window was not said loudly: %v", said)
+	}
+}
+
+// Several containers come back in the reverse of the order they were stopped: a module names the
+// dependant first, and starting it before what it depends on is not bringing it back.
+func TestTheWindowClosesInTheReverseOfTheOrderItOpened(t *testing.T) {
+	d := parseTrusted(t, `{"declaration":1,"resources":[
+	  {"id":"web","type":"container","name":"web","image":"`+pinned+`"},
+	  {"id":"db","type":"container","name":"db","image":"`+pinned+`"},
+	  {"id":"collect","type":"container","name":"collect","image":"`+pinned+`",
+	   "schedule":"30 3 * * *","while-stopped":["web","db"]}
+	]}`)
+	w := &windowRun{}
+	fireOnce(t, d, w)
+
+	var stops, starts []string
+	for _, line := range w.seen() {
+		switch {
+		case line == "stop web" || line == "stop db":
+			stops = append(stops, line)
+		case strings.HasPrefix(line, "start "):
+			starts = append(starts, line)
+		}
+	}
+	if len(stops) != 2 || stops[0] != "stop web" || stops[1] != "stop db" {
+		t.Fatalf("stopped in %v, want the order the step named them", stops)
+	}
+	if len(starts) != 2 || starts[0] != "start db" || starts[1] != "start web" {
+		t.Fatalf("started in %v, want the reverse", starts)
+	}
+}
+
+// And the refusals, each for what it says rather than that it says something.
+func TestAMaintenanceWindowIsRefusedWhereItCannotMean(t *testing.T) {
+	for _, c := range []struct{ name, body, says string }{
+		{
+			"a window with no schedule",
+			`{"id":"collect","type":"container","name":"c","image":"` + pinned + `","while-stopped":["store"]}`,
+			"needs a schedule",
+		},
+		{
+			"a window naming itself",
+			`{"id":"collect","type":"container","name":"c","image":"` + pinned + `","schedule":"30 3 * * *","while-stopped":["collect"]}`,
+			"this step itself",
+		},
+		{
+			"a window naming something that is not a container here",
+			`{"id":"collect","type":"container","name":"c","image":"` + pinned + `","schedule":"30 3 * * *","while-stopped":["elsewhere"]}`,
+			"no container by that id",
+		},
+	} {
+		_, err := declaration.ParseTrusted([]byte(`{"declaration":1,"resources":[` + c.body + `]}`))
+		if err == nil {
+			t.Errorf("%s was accepted", c.name)
+			continue
+		}
+		if !strings.Contains(err.Error(), c.says) {
+			t.Errorf("%s: the refusal does not say %q: %v", c.name, c.says, err)
+		}
+	}
+}

internal/apply/opening.go

@@ -76,16 +76,6 @@ func retireFirewall(ctx context.Context, d *declaration.Declaration, origin stri
 	if origin != store.OriginDeclared || d.Adoption != nil || rec == nil || rec.Kind != string(firewall.UFW) || !rec.WasActive {
 		return "", nil
 	}
-	if !firewall.Installed(ctx, run) {
-		// Uninstalled (novox/hq ADR 0180): retired for good, by the module that replaced it. Said
-		// once, and nothing is asked of a command that is not there.
-		if rec.RetiredBy != firewall.RetiredRemoved {
-			rec.RetiredBy = firewall.RetiredRemoved
-			log("  the found firewall (ufw) is no longer installed; the mesh's filter is what filters this machine")
-			return "removed: ufw is no longer installed; the mesh's filter is what filters this machine", nil
-		}
-		return "", nil
-	}
 	active := firewall.Active(ctx, run)
 	if !active && !(rec.Forward != nil && !rec.DisabledByMesh) {
 		// Inactive, and either the mesh's doing already or nobody's recorded here: said as found,

internal/apply/opening_test.go

@@ -8,7 +8,6 @@ import (
 	"path/filepath"
 	"strings"
 	"testing"
-	"time"
 
 	"github.com/novox/mesh-host/internal/declaration"
 	"github.com/novox/mesh-host/internal/store"
@@ -523,33 +522,3 @@ func TestUfwIsNotRetiredUntilTheMeshsOwnFilterIsLoaded(t *testing.T) {
 		t.Errorf("ufw was not retired once the mesh's filter was loaded: active %v, %+v", u.active, state.Firewall)
 	}
 }
-
-// A front end that is no longer installed is recorded as removed, said once, and asked nothing of
-// (novox/hq ADR 0180).
-func TestAnUninstalledFrontEndIsRetiredForGood(t *testing.T) {
-	dir := t.TempDir()
-	u := &ufwMachine{installed: false, ruleset: "table inet mesh\n"}
-	known := store.State{Firewall: &store.FoundFirewall{Kind: "ufw", WasActive: true, DisabledByMesh: true,
-		RetiredBy: "mesh", FoundAt: time.Now()}}
-	converged := parse(t, `{"declaration":1,"resources":[`+withConf(dir)+`]}`)
-	report, state, err := applyWith(t, converged, known, u.run)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if state.Firewall.RetiredBy != "removed" || !strings.Contains(report.Firewall, "no longer installed") {
-		t.Fatalf("record %+v, said %q", state.Firewall, report.Firewall)
-	}
-	u.asked = nil
-	report, _, err = applyWith(t, converged, state, u.run)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if report.Firewall != "" {
-		t.Errorf("said again: %q", report.Firewall)
-	}
-	for _, a := range u.asked {
-		if strings.HasPrefix(a, "ufw") && a != "ufw status" {
-			t.Errorf("asked something of a front end that is not there: %v", u.asked)
-		}
-	}
-}

internal/apply/schedule.go

@@ -65,6 +65,29 @@ type scheduledJob struct {
 	container *declaration.Container
 	next      time.Time // the next minute at which it is due
 	running   bool      // a run is in flight — the next due run is skipped rather than stacked
+	// hold is the runtime names of the containers held still for the duration of a run, in the
+	// order the step named them (novox/hq ADR 0189).
+	hold []string
+}
+
+// heldStillFor is the runtime names of the containers a step holds still, resolved from ids.
+func heldStillFor(step *declaration.Container, d *declaration.Declaration) []string {
+	if len(step.WhileStopped) == 0 {
+		return nil
+	}
+	byID := map[string]string{}
+	for _, r := range d.Resources {
+		if c, ok := r.(*declaration.Container); ok {
+			byID[c.Identity()] = c.Name
+		}
+	}
+	out := make([]string, 0, len(step.WhileStopped))
+	for _, id := range step.WhileStopped {
+		if name := byID[id]; name != "" {
+			out = append(out, name)
+		}
+	}
+	return out
 }
 
 // NewScheduler builds a scheduler. A nil clock is the system clock; a nil log says nothing.
@@ -123,15 +146,20 @@ func (s *Scheduler) Sync(d *declaration.Declaration, held map[string]bool) {
 		// on its cadence rather than staying running to be restarted — so its identity cannot
 		// depend on another resource's content and there is nothing to pass.
 		spec := containerSpec(c, inputs{})
+		// The runtime stops containers by name; the declaration names them by id. Resolved here,
+		// against the declaration this job was armed from, so a fire never has to look anything up
+		// (novox/hq ADR 0189). The parser has already refused an id that is not a container here.
+		hold := heldStillFor(c, d)
 		if existing := s.jobs[c.Identity()]; existing != nil && existing.spec == spec {
 			// Unchanged: keep where it is in its cadence, refresh the declaration pointer only.
 			existing.container = c
+			existing.hold = hold
 			continue
 		}
 		// New or changed: arm it for the next due minute after now.
 		next, _ := cron.Next(s.clock.Now())
 		s.jobs[c.Identity()] = &scheduledJob{
-			id: c.Identity(), spec: spec, cron: cron, container: c, next: next,
+			id: c.Identity(), spec: spec, cron: cron, container: c, next: next, hold: hold,
 		}
 	}
 
@@ -202,6 +230,15 @@ func (s *Scheduler) fire(ctx context.Context, j *scheduledJob) {
 		return
 	}
 
+	// **The window opens here and closes in the defer, whatever happens** (novox/hq ADR 0189).
+	// Deferred before the first stop so a panic, a failing step or a step that runs long all end
+	// the same way: the service running. The one real risk of this field is a window that never
+	// closes, and the only defence against it is that closing is not conditional on anything.
+	if len(j.hold) > 0 {
+		defer s.letRun(ctx, cri, j)
+		s.holdStill(ctx, cri, j)
+	}
+
 	// A container by this name left exited by the previous run would collide with --name. Removing
 	// one that is not there is the state we want, so its error is ignored — the same as run-once.
 	_, _ = s.run(ctx, cri, "rm", "-f", j.container.Name)
@@ -260,3 +297,51 @@ func (s *Scheduler) Run(ctx context.Context) {
 		}
 	}
 }
+
+// holdStill stops the containers this step runs instead of, in the order it named them.
+//
+// A stop that fails is said and not fatal. The step runs anyway: for the case this exists for —
+// a collector walking storage nothing must be writing to — a writer that would not stop is worth
+// knowing about, and refusing to run would mean the work never happens and the log says nothing
+// new each night. What must not be skipped is the restart, and it is not: it is deferred.
+func (s *Scheduler) holdStill(ctx context.Context, cri string, j *scheduledJob) {
+	for _, name := range j.hold {
+		if _, err := s.run(ctx, cri, "stop", name); err != nil {
+			s.log(fmt.Sprintf("scheduled step %s: could not stop %s for the run: %v", j.id, name, err))
+			continue
+		}
+		s.log(fmt.Sprintf("scheduled step %s: %s held still for the run", j.id, name))
+	}
+}
+
+// letRun starts them again, in the reverse of the order they were stopped, and says so loudly if
+// one does not come back.
+//
+// **Reverse order**, because stopping walks a dependency the other way: a module that holds two
+// containers still names the one that depends on the other first, and bringing them back the same
+// way would start a dependant before what it depends on.
+//
+// Given its own context, because this runs in a defer and the one the run used may already be
+// cancelled — a host shutting down mid-window would otherwise leave the service stopped, which is
+// precisely the outcome this field must never have.
+func (s *Scheduler) letRun(_ context.Context, cri string, j *scheduledJob) {
+	ctx, cancel := context.WithTimeout(context.Background(), closingWindow)
+	defer cancel()
+	for i := len(j.hold) - 1; i >= 0; i-- {
+		name := j.hold[i]
+		if _, err := s.run(ctx, cri, "start", name); err != nil {
+			// Said as loudly as this host says anything: a service the mesh stopped for a
+			// maintenance window and could not start again is down, and nothing else will notice
+			// until the next apply compares it.
+			s.log(fmt.Sprintf(
+				"scheduled step %s: %s was held still for the run and WILL NOT START AGAIN: %v",
+				j.id, name, err))
+			continue
+		}
+		s.log(fmt.Sprintf("scheduled step %s: %s running again", j.id, name))
+	}
+}
+
+// closingWindow is how long the host will spend putting back what it stopped. Generous: this is
+// the half that must not be given up on.
+const closingWindow = 5 * time.Minute

internal/apply/stayed_running_test.go

@@ -1,100 +0,0 @@
-package apply
-
-import (
-	"context"
-	"os"
-	"strings"
-	"testing"
-
-	"github.com/novox/mesh-host/internal/store"
-)
-
-// A daemon that reads a configuration it refuses dies a fraction of a second after the service
-// manager has reported it started — fail2ban took 221 milliseconds on the control node the day this
-// was written. One read back catches nothing: the unit is active at that instant. The mesh reported
-// the service "restarted" while every ban on two public machines was gone, and every check passed
-// (novox/hq ADR 0184). The host looks again, after the moment in which that happens.
-func TestAServiceThatDiesJustAfterItsRestartIsNotReportedRestarted(t *testing.T) {
-	serviceSettle = 0
-	// Alive at the first look after starting, dead at the second — the shape of a daemon that
-	// refuses what it was just given.
-	started, looks := false, 0
-	run := func(ctx context.Context, name string, args ...string) (string, error) {
-		if args[0] == "show" {
-			state := "active"
-			if started {
-				if looks++; looks >= 2 {
-					state = "failed"
-				}
-			}
-			return "LoadState=loaded\nActiveState=" + state + "\n", nil
-		}
-		if args[0] == "start" {
-			started = true
-		}
-		return "", nil
-	}
-	dir := t.TempDir()
-	d := parse(t, `{"declaration":1,"resources":[
-	  {"id":"conf","type":"file","path":"`+dir+`/jail.conf","content":"[sshd]\n","mode":"0644"},
-	  {"id":"run","type":"service","unit":"fail2ban.service","state":"running","restart-on":["conf"]}
-	]}`)
-	_, _, err := Apply(context.Background(), archHost(t), d, store.State{}, store.OriginCarried, run, nil, nil)
-	if err == nil {
-		t.Fatal("a service that died just after being restarted was reported as restarted")
-	}
-	if !strings.Contains(err.Error(), "fail2ban.service") || !strings.Contains(err.Error(), "is stopped") {
-		t.Errorf("the failure does not name the unit and what it is now: %v", err)
-	}
-	if looks < 2 {
-		t.Errorf("the host looked at the unit %d time(s) after starting it; it must look again", looks)
-	}
-}
-
-// A unit still coming up reads as running at both looks and is accepted: the second look is for a
-// unit that WAS running and is not any more, never a wait for a slow one to finish starting.
-func TestAUnitStillStartingIsNotAFailure(t *testing.T) {
-	serviceSettle = 0
-	run := func(ctx context.Context, name string, args ...string) (string, error) {
-		if args[0] == "show" {
-			return "LoadState=loaded\nActiveState=activating\n", nil
-		}
-		return "", nil
-	}
-	d := parse(t, `{"declaration":1,"resources":[
-	  {"id":"s","type":"service","unit":"slow.service","state":"running"}
-	]}`)
-	if _, _, err := Apply(context.Background(), archHost(t), d, store.State{}, store.OriginCarried, run, nil, nil); err != nil {
-		t.Fatalf("a unit still starting was reported as a failure: %v", err)
-	}
-}
-
-// And a service the declaration asks to be stopped is not waited on at all.
-func TestAServiceAskedToStopIsNotWaitedOn(t *testing.T) {
-	serviceSettle = 0
-	shows := 0
-	run := func(ctx context.Context, name string, args ...string) (string, error) {
-		if args[0] == "show" {
-			shows++
-			if shows == 1 {
-				return "LoadState=loaded\nActiveState=active\n", nil
-			}
-			return "LoadState=loaded\nActiveState=inactive\n", nil
-		}
-		return "", nil
-	}
-	d := parse(t, `{"declaration":1,"resources":[
-	  {"id":"s","type":"service","unit":"off.service","state":"stopped"}
-	]}`)
-	if _, _, err := Apply(context.Background(), archHost(t), d, store.State{}, store.OriginCarried, run, nil, nil); err != nil {
-		t.Fatalf("stopping a service was reported as a failure: %v", err)
-	}
-}
-
-// The settle between a unit's two read-backs is a real pause on a machine and nothing in a test:
-// no test here drives a service manager that takes time, so paying it would only slow the suite
-// (novox/hq ADR 0184).
-func TestMain(m *testing.M) {
-	serviceSettle = 0
-	os.Exit(m.Run())
-}

internal/declaration/declaration.go

@@ -870,12 +870,6 @@ type Package struct {
 	ID      string `json:"id"`
 	Type    Type   `json:"type"`
 	Package string `json:"package"`
-	// Absent declares that the package is NOT installed (novox/hq ADR 0180): the host removes it
-	// when it is, and leaves a machine that never had it alone. For the one case a module replaces
-	// software the machine was found with and the operator has decided it does not come back — the
-	// firewall front end a converged machine's filter module retired. Nothing to undo when the
-	// declaration drops it: the host does not install what a declaration stopped saying is absent.
-	Absent bool `json:"absent,omitempty"`
 }
 
 func (p *Package) Identity() string { return p.ID }
@@ -952,14 +946,6 @@ type Container struct {
 	// container; a privileged container stays undeclarable.
 	Capabilities []string `json:"capabilities,omitempty"`
 
-	// Logging names where the runtime sends this container's output: "journald" sends it to the
-	// machine's journal, under the container's name, where what reads the machine's logs — its
-	// intrusion prevention first of all (novox/hq ADR 0179) — can read it the way it reads the
-	// machine's own services. Empty keeps the runtime's default, which is a file of the runtime's
-	// own that nothing but the runtime reads. Part of the spec: a container that logs elsewhere
-	// is a different container, and the runtime cannot change a running one's driver.
-	Logging string `json:"logging,omitempty"`
-
 	// Networks are networks this container also joins once created, by name — a found network a
 	// per-machine setting keeps for a taken container (novox/hq ADR 0163, rule 4), so a
 	// neighbour that resolves it there keeps resolving it until the neighbour is taken too.
@@ -1011,6 +997,24 @@ type Container struct {
 	// rather than stacked. It is exclusive with RunOnce and with restart-on: a container runs once
 	// and gates, runs on a cadence, or stays up — never two of these.
 	Schedule string `json:"schedule,omitempty"`
+
+	// WhileStopped names resources of the same module — containers — that must be held still for
+	// the duration of this step's run (novox/hq ADR 0189). The host stops each before the run and
+	// starts each again after it, **whatever the step did**: a step that failed must leave the
+	// service running, because the one real risk of this field is a window that never closes.
+	//
+	// **For the work a service cannot have done underneath it.** The artifact store's collector
+	// walks the storage and requires every writer stopped; a run-once step runs beside containers
+	// and a scheduled one is the same container again, so until this there was no way for a module
+	// to say it. The predecessor said it with a shell script, which is how the mesh inherited a
+	// store that has never collected anything.
+	//
+	// **Its own module's containers, and only on a schedule.** A module that could quiesce a
+	// neighbour could stop the mesh. And at apply time the host already has a window — the
+	// declaration is applied in order and a run-once step gates what follows — so a one-time
+	// offline job says *before*, not *instead of*; a recurring window is the case order cannot
+	// express, and the only one this serves.
+	WhileStopped []string `json:"while-stopped,omitempty"`
 }
 
 func (c *Container) Identity() string { return c.ID }
@@ -1042,6 +1046,20 @@ func (c *Container) validate(where string, _ bool) []string {
 			problems = append(problems, where+": "+err.Error())
 		}
 	}
+	// A maintenance window belongs to a recurring step (novox/hq ADR 0189). Refused on anything
+	// else here, where the field is; that it names containers of the same module, and not itself,
+	// is judged against the whole declaration (see whileStoppedNames).
+	if len(c.WhileStopped) > 0 && c.Schedule == "" {
+		problems = append(problems, where+": while-stopped needs a schedule; at apply the host "+
+			"already has a window — the declaration is applied in order and a run-once step gates "+
+			"what follows — so a one-time offline job is declared before what it works on")
+	}
+	for _, id := range c.WhileStopped {
+		if id == c.ID {
+			problems = append(problems, where+": while-stopped names "+strconv.Quote(id)+
+				", which is this step itself")
+		}
+	}
 	// The runtime's flags take addresses, and a name here would be handed to it verbatim and
 	// refused at create — after the old container was already removed. Refused on arrival instead.
 	for _, d := range c.Dns {
@@ -1065,10 +1083,6 @@ func (c *Container) validate(where string, _ bool) []string {
 				"capability's name (CAP_NET_ADMIN or NET_ADMIN)")
 		}
 	}
-	if c.Logging != "" && c.Logging != "journald" {
-		problems = append(problems, where+": logging is "+strconv.Quote(c.Logging)+", and the only place a "+
-			"container's output can be sent besides the runtime's own file is \"journald\"")
-	}
 	for _, n := range c.Networks {
 		problems = append(problems, (&Network{Name: n}).validate(where+": networks", false)...)
 		if n == c.Network {
@@ -1456,6 +1470,7 @@ func parse(raw []byte, allowActions bool) (*Declaration, error) {
 		problems = append(problems, resource.validate(where, allowActions)...)
 		d.Resources = append(d.Resources, resource)
 	}
+	problems = append(problems, checkWhileStopped(d.Resources)...)
 	problems = append(problems, checkAdoption(env.Adoption, d.Resources, allowActions)...)
 	if env.Adoption == nil {
 		for _, r := range d.Resources {
@@ -1484,6 +1499,41 @@ func parse(raw []byte, allowActions bool) (*Declaration, error) {
 	return d, nil
 }
 
+// checkWhileStopped judges a maintenance window against the whole declaration (novox/hq ADR 0189).
+//
+// A step may hold still only a container that is **here** — in this same declaration, which is to
+// say on this machine and placed by the mesh. That is what makes it the module's own: a node's
+// declaration carries one module's resources beside another's, so the id must also be a container
+// and not a file or a directory, which there would be nothing to stop.
+//
+// Refused on arrival rather than discovered at the first fire. A window that names something the
+// host cannot stop is a window that opens at 03:00 and reports nothing until somebody reads a log.
+func checkWhileStopped(resources []Resource) []string {
+	containers := map[string]bool{}
+	for _, r := range resources {
+		if r.Kind() == TypeContainer {
+			containers[r.Identity()] = true
+		}
+	}
+	var problems []string
+	for _, r := range resources {
+		c, ok := r.(*Container)
+		if !ok {
+			continue
+		}
+		for _, id := range c.WhileStopped {
+			if containers[id] {
+				continue
+			}
+			problems = append(problems, fmt.Sprintf(
+				"resource %q: while-stopped names %q, and this declaration has no container by "+
+					"that id. A step may hold still only a container placed on this machine "+
+					"beside it", c.ID, id))
+		}
+	}
+	return problems
+}
+
 func strictDecode(raw []byte, into any) error {
 	// DisallowUnknownFields is the whole point rather than strictness for its own sake: a
 	// field the host does not know is a thing the control plane believes it asked for.

internal/declaration/declaration_test.go

@@ -524,24 +524,3 @@ func TestACapabilityIsNamedOrRefused(t *testing.T) {
 		}
 	}
 }
-
-// A container may send its output to the machine's journal, and nowhere else but the runtime's own
-// file (novox/hq ADR 0179): what reads the machine's logs then reads the container's too.
-func TestAContainerMayLogToTheJournalAndNowhereElse(t *testing.T) {
-	image := "postgres@sha256:" + strings.Repeat("a", 64)
-	d, err := Parse([]byte(`{"declaration":1,"resources":[
-	  {"id":"front","type":"container","name":"front","image":"` + image + `","logging":"journald"}
-	]}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got := d.Resources[0].(*Container).Logging; got != "journald" {
-		t.Fatalf("logging read as %q", got)
-	}
-	for _, bad := range []string{`"syslog"`, `"none"`, `"json-file"`} {
-		if _, err := Parse([]byte(`{"declaration":1,"resources":[
-		  {"id":"front","type":"container","name":"front","image":"` + image + `","logging":` + bad + `}]}`)); err == nil {
-			t.Errorf("%s was accepted as a place to log", bad)
-		}
-	}
-}

internal/firewall/filters.go

@@ -179,18 +179,27 @@ func legacyFilters(rules, tool string, ufwActive bool) []Filter {
 			}
 		}
 	}
-	// A chain of refusals is a ban list when every refusal names the sources it refuses and the
-	// chain accepts nothing — the same rule the nftables side applies, and no more.
-	//
-	// **The policy of the chains that jump to it says nothing about what it is.** An earlier cut
-	// required every path into the chain to come from a built-in whose policy accepts, and the
-	// mesh's own intrusion prevention then read as a foreign rule set on the home server: its ban
-	// chain hangs off the container runtime's user chain as well as INPUT, and that machine's
-	// forward policy is DROP because the runtime set it. The machine reported "NOT the mesh alone"
-	// about a chain the mesh had just written (novox/hq ADR 0186). The policy is already classified
-	// where it belongs — as the runtime's — so requiring it here counted it twice.
+	var entered func(chain string, seen map[string]bool) bool
+	entered = func(chain string, seen map[string]bool) bool {
+		if seen[chain] || accepting[chain] || len(jumpedFrom[chain]) == 0 {
+			return false
+		}
+		seen[chain] = true
+		for _, from := range jumpedFrom[chain] {
+			if p, builtIn := policy[from]; builtIn {
+				if p != "ACCEPT" {
+					return false
+				}
+				continue
+			}
+			if !entered(from, seen) {
+				return false
+			}
+		}
+		return true
+	}
 	ban := func(chain, line string) bool {
-		return bansSources(line) && !accepting[chain] && len(jumpedFrom[chain]) > 0
+		return bansSources(line) && entered(chain, map[string]bool{})
 	}
 	type seen struct {
 		owner string
@@ -310,17 +319,8 @@ func Active(ctx context.Context, run Runner) bool {
 	return err == nil && statusActive(out)
 }
 
-// Installed says whether ufw is on this machine at all: a command that is not there is a front end
-// that was uninstalled (novox/hq ADR 0180), not one that is silent.
-func Installed(ctx context.Context, run Runner) bool {
-	_, err := run(ctx, "ufw", "status")
-	return !missing(err)
-}
-
 // Retirements of a found firewall, as the host records them.
 const (
 	RetiredByMesh  = "mesh"
 	RetiredFoundSo = "found-inactive"
-	// RetiredRemoved is a front end uninstalled by the module that replaced it (ADR 0180).
-	RetiredRemoved = "removed"
 )

internal/firewall/neighbour_ban_test.go

@@ -1,60 +0,0 @@
-package firewall
-
-import (
-	"os"
-	"testing"
-)
-
-// The mesh's own ban list is a ban wherever it hangs (novox/hq ADR 0186).
-//
-// Captured from the home server after the intrusion prevention had banned four addresses: its ban
-// chain is jumped to from INPUT, whose policy accepts, and from the container runtime's user chain,
-// which hangs off a FORWARD the runtime set to DROP. Requiring every path to come from an accepting
-// built-in made the machine report "NOT the mesh alone" about a chain the mesh had just written.
-func TestTheMeshsOwnBanChainIsABanBehindADroppingForward(t *testing.T) {
-	legacy, err := os.ReadFile("testdata/home-server-bans-S.txt")
-	if err != nil {
-		t.Fatal(err)
-	}
-	filters := Filters("", map[string]string{"iptables-legacy": string(legacy)}, false)
-
-	var ban, other []string
-	for _, f := range filters {
-		switch f.Owner {
-		case OwnerBan:
-			ban = append(ban, f.Where)
-		case OwnerOther:
-			other = append(other, f.Where)
-		}
-	}
-	if len(other) > 0 {
-		t.Errorf("the machine reports %v as rule sets the mesh did not write", other)
-	}
-	found := false
-	for _, w := range ban {
-		if w == "chain f2b-route-proxy (iptables-legacy)" {
-			found = true
-		}
-	}
-	if !found {
-		t.Errorf("the intrusion prevention's own chain was not read as a ban; bans were %v", ban)
-	}
-	if !Alone(filters) {
-		t.Error("a machine filtered by the mesh and its own bans does not read as the mesh alone")
-	}
-}
-
-// A chain that accepts anything is doing more than banning, and is still not a ban — which is what
-// keeps a predecessor's allow-and-drop chain classified as something the operator must look at.
-func TestAChainThatAcceptsIsNotABan(t *testing.T) {
-	rules := "-P INPUT ACCEPT\n" +
-		"-A INPUT -j HAL-MESH-ONLY\n" +
-		"-N HAL-MESH-ONLY\n" +
-		"-A HAL-MESH-ONLY -s 10.0.0.0/8 -j ACCEPT\n" +
-		"-A HAL-MESH-ONLY -s 203.0.113.7/32 -j DROP\n"
-	for _, f := range Filters("", map[string]string{"iptables-legacy": rules}, false) {
-		if f.Where == "chain HAL-MESH-ONLY (iptables-legacy)" && f.Owner != OwnerOther {
-			t.Errorf("a chain that accepts was classified as %s", f.Owner)
-		}
-	}
-}

internal/firewall/testdata/home-server-bans-S.txt

@@ -1,147 +0,0 @@
--P INPUT ACCEPT
--P FORWARD DROP
--P OUTPUT ACCEPT
--N DOCKER
--N DOCKER-BRIDGE
--N DOCKER-CT
--N DOCKER-FORWARD
--N DOCKER-INTERNAL
--N DOCKER-USER
--N f2b-route-proxy
--N ufw-after-forward
--N ufw-after-input
--N ufw-after-logging-forward
--N ufw-after-logging-input
--N ufw-after-logging-output
--N ufw-after-output
--N ufw-before-forward
--N ufw-before-input
--N ufw-before-logging-forward
--N ufw-before-logging-input
--N ufw-before-logging-output
--N ufw-before-output
--N ufw-reject-forward
--N ufw-reject-input
--N ufw-reject-output
--N ufw-track-forward
--N ufw-track-input
--N ufw-track-output
--A INPUT -p tcp -j f2b-route-proxy
--A INPUT -j ufw-before-logging-input
--A INPUT -j ufw-before-input
--A INPUT -j ufw-after-input
--A INPUT -j ufw-after-logging-input
--A INPUT -j ufw-reject-input
--A INPUT -j ufw-track-input
--A FORWARD -j DOCKER-USER
--A FORWARD -j DOCKER-FORWARD
--A FORWARD -j ufw-before-logging-forward
--A FORWARD -j ufw-before-forward
--A FORWARD -j ufw-after-forward
--A FORWARD -j ufw-after-logging-forward
--A FORWARD -j ufw-reject-forward
--A FORWARD -j ufw-track-forward
--A OUTPUT -j ufw-before-logging-output
--A OUTPUT -j ufw-before-output
--A OUTPUT -j ufw-after-output
--A OUTPUT -j ufw-after-logging-output
--A OUTPUT -j ufw-reject-output
--A OUTPUT -j ufw-track-output
--A DOCKER -d 172.17.0.18/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 8686 -j ACCEPT
--A DOCKER -d 172.17.0.14/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 8989 -j ACCEPT
--A DOCKER -d 172.17.0.15/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 7878 -j ACCEPT
--A DOCKER -d 172.17.0.5/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 9117 -j ACCEPT
--A DOCKER -d 172.17.0.13/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 6789 -j ACCEPT
--A DOCKER -d 172.19.0.2/32 ! -i br-32062158f584 -o br-32062158f584 -p tcp -m tcp --dport 8080 -j ACCEPT
--A DOCKER -d 172.17.0.2/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 5432 -j ACCEPT
--A DOCKER -d 172.27.0.2/32 ! -i br-0910a98c6158 -o br-0910a98c6158 -p tcp -m tcp --dport 5678 -j ACCEPT
--A DOCKER -d 172.17.0.21/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 3579 -j ACCEPT
--A DOCKER -d 172.17.0.19/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 8181 -j ACCEPT
--A DOCKER -d 172.17.0.17/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 8787 -j ACCEPT
--A DOCKER -d 172.17.0.16/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 6767 -j ACCEPT
--A DOCKER -d 172.17.0.12/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 3000 -j ACCEPT
--A DOCKER -d 172.17.0.11/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 80 -j ACCEPT
--A DOCKER -d 172.17.0.10/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 9443 -j ACCEPT
--A DOCKER -d 172.17.0.10/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 9000 -j ACCEPT
--A DOCKER -d 172.17.0.9/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 3000 -j ACCEPT
--A DOCKER -d 172.17.0.7/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 1880 -j ACCEPT
--A DOCKER -d 172.28.0.2/32 ! -i br-b11461b5b028 -o br-b11461b5b028 -p tcp -m tcp --dport 80 -j ACCEPT
--A DOCKER -d 172.23.0.14/32 ! -i br-66ffa5c1cba5 -o br-66ffa5c1cba5 -p tcp -m tcp --dport 6543 -j ACCEPT
--A DOCKER -d 172.23.0.14/32 ! -i br-66ffa5c1cba5 -o br-66ffa5c1cba5 -p tcp -m tcp --dport 5432 -j ACCEPT
--A DOCKER -d 172.23.0.5/32 ! -i br-66ffa5c1cba5 -o br-66ffa5c1cba5 -p tcp -m tcp --dport 8000 -j ACCEPT
--A DOCKER -d 172.26.0.3/32 ! -i br-b0fec361ccaa -o br-b0fec361ccaa -p tcp -m tcp --dport 6167 -j ACCEPT
--A DOCKER -d 172.26.0.2/32 ! -i br-b0fec361ccaa -o br-b0fec361ccaa -p tcp -m tcp --dport 80 -j ACCEPT
--A DOCKER -d 172.17.0.8/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 8000 -j ACCEPT
--A DOCKER -d 172.17.0.6/32 ! -i docker0 -o docker0 -p udp -m udp --dport 10001 -j ACCEPT
--A DOCKER -d 172.17.0.6/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 8880 -j ACCEPT
--A DOCKER -d 172.17.0.6/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 8843 -j ACCEPT
--A DOCKER -d 172.17.0.6/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 8443 -j ACCEPT
--A DOCKER -d 172.17.0.6/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 8080 -j ACCEPT
--A DOCKER -d 172.17.0.6/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 6789 -j ACCEPT
--A DOCKER -d 172.17.0.6/32 ! -i docker0 -o docker0 -p udp -m udp --dport 5514 -j ACCEPT
--A DOCKER -d 172.17.0.6/32 ! -i docker0 -o docker0 -p udp -m udp --dport 3478 -j ACCEPT
--A DOCKER -d 172.17.0.6/32 ! -i docker0 -o docker0 -p udp -m udp --dport 1900 -j ACCEPT
--A DOCKER -d 172.25.0.3/32 ! -i br-b98821f7dc38 -o br-b98821f7dc38 -p tcp -m tcp --dport 8000 -j ACCEPT
--A DOCKER -d 172.18.0.3/32 ! -i br-442a0bfc65f8 -o br-442a0bfc65f8 -p tcp -m tcp --dport 1433 -j ACCEPT
--A DOCKER -d 172.20.0.3/32 ! -i br-afa37ac8b33d -o br-afa37ac8b33d -p tcp -m tcp --dport 8081 -j ACCEPT
--A DOCKER -d 172.20.0.3/32 ! -i br-afa37ac8b33d -o br-afa37ac8b33d -p tcp -m tcp --dport 1883 -j ACCEPT
--A DOCKER -d 172.17.0.4/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 8086 -j ACCEPT
--A DOCKER -d 172.21.0.2/32 ! -i br-df15d8e19ec7 -o br-df15d8e19ec7 -p tcp -m tcp --dport 6379 -j ACCEPT
--A DOCKER -d 172.30.0.3/32 ! -i br-521eab9a3a5e -o br-521eab9a3a5e -p tcp -m tcp --dport 8283 -j ACCEPT
--A DOCKER -d 172.17.0.3/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 3000 -j ACCEPT
--A DOCKER ! -i br-32062158f584 -o br-32062158f584 -j DROP
--A DOCKER ! -i docker0 -o docker0 -j DROP
--A DOCKER ! -i br-521eab9a3a5e -o br-521eab9a3a5e -j DROP
--A DOCKER ! -i br-df15d8e19ec7 -o br-df15d8e19ec7 -j DROP
--A DOCKER ! -i br-afa37ac8b33d -o br-afa37ac8b33d -j DROP
--A DOCKER ! -i br-442a0bfc65f8 -o br-442a0bfc65f8 -j DROP
--A DOCKER ! -i br-b98821f7dc38 -o br-b98821f7dc38 -j DROP
--A DOCKER ! -i br-b0fec361ccaa -o br-b0fec361ccaa -j DROP
--A DOCKER ! -i br-66ffa5c1cba5 -o br-66ffa5c1cba5 -j DROP
--A DOCKER ! -i br-b11461b5b028 -o br-b11461b5b028 -j DROP
--A DOCKER ! -i br-2df4e541b877 -o br-2df4e541b877 -j DROP
--A DOCKER ! -i br-0910a98c6158 -o br-0910a98c6158 -j DROP
--A DOCKER-BRIDGE -o br-32062158f584 -j DOCKER
--A DOCKER-BRIDGE -o docker0 -j DOCKER
--A DOCKER-BRIDGE -o br-521eab9a3a5e -j DOCKER
--A DOCKER-BRIDGE -o br-df15d8e19ec7 -j DOCKER
--A DOCKER-BRIDGE -o br-afa37ac8b33d -j DOCKER
--A DOCKER-BRIDGE -o br-442a0bfc65f8 -j DOCKER
--A DOCKER-BRIDGE -o br-b98821f7dc38 -j DOCKER
--A DOCKER-BRIDGE -o br-b0fec361ccaa -j DOCKER
--A DOCKER-BRIDGE -o br-66ffa5c1cba5 -j DOCKER
--A DOCKER-BRIDGE -o br-b11461b5b028 -j DOCKER
--A DOCKER-BRIDGE -o br-2df4e541b877 -j DOCKER
--A DOCKER-BRIDGE -o br-0910a98c6158 -j DOCKER
--A DOCKER-CT -o br-32062158f584 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
--A DOCKER-CT -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
--A DOCKER-CT -o br-521eab9a3a5e -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
--A DOCKER-CT -o br-df15d8e19ec7 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
--A DOCKER-CT -o br-afa37ac8b33d -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
--A DOCKER-CT -o br-442a0bfc65f8 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
--A DOCKER-CT -o br-b98821f7dc38 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
--A DOCKER-CT -o br-b0fec361ccaa -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
--A DOCKER-CT -o br-66ffa5c1cba5 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
--A DOCKER-CT -o br-b11461b5b028 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
--A DOCKER-CT -o br-2df4e541b877 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
--A DOCKER-CT -o br-0910a98c6158 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
--A DOCKER-FORWARD -j DOCKER-CT
--A DOCKER-FORWARD -j DOCKER-INTERNAL
--A DOCKER-FORWARD -j DOCKER-BRIDGE
--A DOCKER-FORWARD -i br-32062158f584 -j ACCEPT
--A DOCKER-FORWARD -i docker0 -j ACCEPT
--A DOCKER-FORWARD -i br-521eab9a3a5e -j ACCEPT
--A DOCKER-FORWARD -i br-df15d8e19ec7 -j ACCEPT
--A DOCKER-FORWARD -i br-afa37ac8b33d -j ACCEPT
--A DOCKER-FORWARD -i br-442a0bfc65f8 -j ACCEPT
--A DOCKER-FORWARD -i br-b98821f7dc38 -j ACCEPT
--A DOCKER-FORWARD -i br-b0fec361ccaa -j ACCEPT
--A DOCKER-FORWARD -i br-66ffa5c1cba5 -j ACCEPT
--A DOCKER-FORWARD -i br-b11461b5b028 -j ACCEPT
--A DOCKER-FORWARD -i br-2df4e541b877 -j ACCEPT
--A DOCKER-FORWARD -i br-0910a98c6158 -j ACCEPT
--A DOCKER-USER -p tcp -j f2b-route-proxy
--A f2b-route-proxy -s 13.70.107.184/32 -j REJECT --reject-with icmp-port-unreachable
--A f2b-route-proxy -s 45.138.12.51/32 -j REJECT --reject-with icmp-port-unreachable
--A f2b-route-proxy -s 20.214.191.94/32 -j REJECT --reject-with icmp-port-unreachable
--A f2b-route-proxy -j RETURN

internal/system/alpine.go

@@ -46,11 +46,6 @@ func (a alpine) PackageInstalled(ctx context.Context, run Runner, name string) (
 	return strings.TrimSpace(out) != "", nil
 }
 
-func (alpine) RemovePackage(ctx context.Context, run Runner, name string) error {
-	_, err := run(ctx, "apk", "del", name)
-	return err
-}
-
 func (alpine) InstallPackage(ctx context.Context, run Runner, name string) error {
 	_, err := run(ctx, "apk", "add", "--no-cache", name)
 	return err

internal/system/android.go

@@ -65,10 +65,6 @@ func (a android) InstallPackage(context.Context, Runner, string) error {
 	return fmt.Errorf("%w: package", ErrUnsupported)
 }
 
-func (a android) RemovePackage(context.Context, Runner, string) error {
-	return fmt.Errorf("%w: package", ErrUnsupported)
-}
-
 func (a android) ServiceState(context.Context, Runner, string) (string, error) {
 	return "", fmt.Errorf("%w: service (init is not reachable without root)", ErrUnsupported)
 }

internal/system/arch.go

@@ -39,14 +39,6 @@ func (a arch) PackageInstalled(ctx context.Context, run Runner, name string) (bo
 	return true, nil
 }
 
-// RemovePackage removes one package and nothing it depends on: `-R`, not `-Rs`, because what else
-// relied on a dependency is not this declaration's to know. pacman keeps a configuration file the
-// operator changed as `.pacsave`, which is what "never flushed" comes to once the front end is gone.
-func (arch) RemovePackage(ctx context.Context, run Runner, name string) error {
-	_, err := run(ctx, "pacman", "-R", "--noconfirm", name)
-	return err
-}
-
 func (arch) InstallPackage(ctx context.Context, run Runner, name string) error {
 	out, err := run(ctx, "pacman", "-S", "--noconfirm", "--needed", name)
 	if err == nil {

internal/system/system.go

@@ -51,9 +51,6 @@ type System interface {
 
 	PackageInstalled(ctx context.Context, run Runner, name string) (bool, error)
 	InstallPackage(ctx context.Context, run Runner, name string) error
-	// RemovePackage uninstalls one package, leaving its dependencies and anything the operator
-	// changed in its configuration where the package manager leaves them (novox/hq ADR 0180).
-	RemovePackage(ctx context.Context, run Runner, name string) error
 
 	// ServiceState is "running" or "stopped". A unit that does not exist is an error, never
 	// "stopped" — reporting absence as satisfaction is the fault this host exists to prevent.