Carry the catalogue's predefined list on the bridge's merged message, so the indexer keeps it without the controller's mirror (issue 1953 L5-D1, ADR 0565 §2)

go/delivery/source.go

@@ -542,6 +542,31 @@ type Forge struct {
 	// refused, loudly, rather than read with them dropped.
 	RetiredPlacements json.RawMessage `json:"placements,omitempty"`
 	RetiredRead       bool            `json:"placements-read,omitempty"`
+	// Predefined is the catalogue's predefined.json, exact, at the merge commit of a merged message (novox/hq ADR 0565
+	// §2): what the indexer keeps as its state `predefined`. PredefinedRead says the bridge read the merge and it holds
+	// no predefined.json. Carried on a merged message only; an older bridge sends neither, and the indexer keeps what it
+	// held.
+	Predefined     json.RawMessage `json:"predefined,omitempty"`
+	PredefinedRead bool            `json:"predefined-read,omitempty"`
+}
+
+// checkPredefined refuses the predefined list on anything but a merged message, a list that is not one JSON object, and
+// a list said both present and absent.
+func (f Forge) checkPredefined() error {
+	if len(f.Predefined) == 0 && !f.PredefinedRead {
+		return nil
+	}
+	if f.Kind != ForgeMerged {
+		return fmt.Errorf("delivery: only a merged message carries the predefined list, not a %s message", f.Kind)
+	}
+	if len(f.Predefined) > 0 && f.PredefinedRead {
+		return fmt.Errorf("delivery: a merged message carries the predefined list and says the merge holds none (predefined-read)")
+	}
+	var list map[string]json.RawMessage
+	if len(f.Predefined) > 0 && json.Unmarshal(f.Predefined, &list) != nil {
+		return fmt.Errorf("delivery: the predefined list a merged message carries is not one JSON object")
+	}
+	return nil
 }
 
 func (f Forge) check() error {
@@ -558,6 +583,9 @@ func (f Forge) check() error {
 		return fmt.Errorf("delivery: a forge message carries placement files, which no repository holds since ADR 0567: " +
 			"placement is the seat mesh-placement's state")
 	}
+	if err := f.checkPredefined(); err != nil {
+		return err
+	}
 	if err := checkRepository(f.Repository); err != nil {
 		return err
 	}