mesh-sdk names what the bus server holds in one list, for the assigner and the node agent (ADR 0594 §7)

go/catalogue/bus_snapshot_test.go

@@ -43,4 +43,49 @@ func TestTheCataloguesBusIsBackedUpBySnapshot(t *testing.T) {
 	if !found {
 		t.Fatal("the bus declares no item for its streams")
 	}
+	// 774/S3 (ADR 0594 §7): the one list of what is the bus server names the bus's container and every resource that
+	// restarts it, read from the catalogue's nats manifest at mesh-catalog 0b2d393b; a module not providing the bus
+	// has none.
+	t.Run("the bus server's list", func(t *testing.T) {
+		raw, err := os.ReadFile("testdata/catalogue-0b2d393b-nats.module.json")
+		if err != nil {
+			t.Fatal(err)
+		}
+		nats, err := decodeForTest(raw)
+		if err != nil {
+			t.Fatal(err)
+		}
+		server := BusServerOf(nats)
+		var containers int
+		for _, r := range nats.Resources {
+			if r["type"] != "container" {
+				continue
+			}
+			containers++
+			restarts, _ := r["restart-on"].([]any)
+			if !server[r["id"].(string)] || len(restarts) == 0 {
+				t.Errorf("the bus's container %v (restarted on %v) is not all in the server's list %v", r["id"], restarts, server)
+			}
+			for _, id := range restarts {
+				if !server[id.(string)] {
+					t.Errorf("%v restarts the bus server and is not in its list %v", id, server)
+				}
+			}
+		}
+		if containers != 1 || len(server) != len(BusServer) {
+			t.Errorf("the bus has %d containers and its server is %v of %v", containers, server, BusServer)
+		}
+		xterm, err := os.ReadFile("testdata/catalogue-835bf22b-xterm.module.json")
+		if err != nil {
+			t.Fatal(err)
+		}
+		other, err := decodeForTest(xterm)
+		if err != nil {
+			t.Fatal(err)
+		}
+		other.Resources = append(other.Resources, map[string]any{"id": "server", "type": "container"})
+		if got := BusServerOf(other); len(got) != 0 {
+			t.Errorf("a module not providing the bus has a bus server %v", got)
+		}
+	})
 }

go/catalogue/testdata/catalogue-0b2d393b-nats.module.json

@@ -0,0 +1,236 @@
+{
+  "module": "nats",
+  "version": "1",
+  "upgrade": {
+    "policy": "record",
+    "why": "the bus: replaced only as a planned step a person starts (`bus upgrade`), its streams snapshotted first and checked after (hq ADR 0236); the controller holds this whatever is said here"
+  },
+  "provides": [
+    {
+      "name": "mesh-bus",
+      "scope": "mesh",
+      "credential": {
+        "form": "none"
+      }
+    }
+  ],
+  "claims": [
+    {
+      "name": "mesh-broker",
+      "scope": "mesh"
+    }
+  ],
+  "bus-users": "/var/lib/nats-module/conf/accounts.conf",
+  "own-secrets": {
+    "broker": "${dir:mesh-state}/broker",
+    "broker-nats-tools": "${dir:tools-secret}/broker-nats-tools"
+  },
+  "capabilities": [
+    "container-runtime"
+  ],
+  "emits": [
+    "consumer-removed",
+    "bucket-keys-removed",
+    "stream-removed",
+    "bucket-expiry-set"
+  ],
+  "invokes": [
+    "seat:mesh-hand-acts.hand-act"
+  ],
+  "consumes": [],
+  "listens": [
+    {
+      "name": "bus",
+      "port": 4222,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the mesh bus — every link the mesh has, over TLS, reached across the overlay"
+    }
+  ],
+  "tools": [
+    "nats_server",
+    "nats_connections",
+    "nats_closed_connections",
+    "nats_subscriptions",
+    "nats_streams",
+    "nats_backlog",
+    "nats_buckets",
+    "nats_users",
+    "nats_user_can",
+    "nats_snapshot_verify",
+    "nats_consumer_remove",
+    "nats_bucket_remove",
+    "nats_stream_remove",
+    "nats_bucket_expiry"
+  ],
+  "guards": [
+    8222
+  ],
+  "data": {
+    "own": [
+      {
+        "id": "jetstream",
+        "path": "${dir:jetstream-data}",
+        "class": "valuable",
+        "active": "1d",
+        "backup": {
+          "dump": "docker exec -i mesh-broker-nats /opt/mesh/mesh-nats-snapshot snapshot < ${dir:mesh-state}/broker > ${dir:snapshots}/bus.tar.partial && mv ${dir:snapshots}/bus.tar.partial ${dir:snapshots}/bus.tar || { rm -f ${dir:snapshots}/bus.tar.partial; exit 1; }",
+          "into": "snapshots"
+        },
+        "why": "the bus's streams and key-value buckets: the hand-act log, conditions, every module's state; written all the time, so copied by the server's own snapshot of each stream (novox/hq ADR 0235), never as live files"
+      },
+      {
+        "id": "snapshots",
+        "path": "${dir:snapshots}",
+        "class": "rebuildable",
+        "why": "last night's snapshot of every stream with its manifest, made again every night"
+      }
+    ]
+  },
+  "resources": [
+    {
+      "id": "jetstream-data",
+      "type": "directory",
+      "path": "/var/lib/mesh-broker-nats",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "conf-dir",
+      "type": "directory",
+      "path": "/var/lib/nats-module/conf",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "tools-secret",
+      "type": "directory",
+      "path": "/var/lib/mesh/nats-tools",
+      "mode": "0711",
+      "unknown": "program"
+    },
+    {
+      "id": "snapshots",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "mesh",
+      "unknown": "program"
+    },
+    {
+      "id": "server-conf",
+      "type": "file",
+      "path": "/var/lib/nats-module/conf/nats.conf",
+      "template": "files/nats.conf",
+      "mode": "0644"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "program-snapshot",
+      "type": "archive",
+      "path": "${dir:state}/snapshot",
+      "artifact": "snapshot",
+      "unknown": "program"
+    },
+    {
+      "id": "program-entrypoint",
+      "type": "archive",
+      "path": "${dir:state}/entrypoint",
+      "artifact": "entrypoint",
+      "unknown": "program"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "mesh-broker-nats",
+      "ports": [
+        "4222:4222",
+        "127.0.0.1:8222:8222"
+      ],
+      "volumes": [
+        "/var/lib/mesh-broker-nats:/data",
+        "/var/lib/nats-module/conf:/etc/nats:ro",
+        "${access:tls}:/tls:ro",
+        "${dir:state}/snapshot:/opt/mesh:ro",
+        "${dir:state}/entrypoint:/opt/mesh-entrypoint:ro"
+      ],
+      "args": [
+        "sh",
+        "/opt/mesh-entrypoint/entrypoint.sh"
+      ],
+      "artifact": "server",
+      "restart-on": [
+        "program-snapshot",
+        "program-entrypoint"
+      ]
+    }
+  ],
+  "accesses": [
+    {
+      "id": "tls",
+      "path": "/var/lib/mesh-broker-tls",
+      "mode": "read"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "server",
+        "kind": "upstream",
+        "from": "nats:2.11.17-alpine@sha256:e4bf19f15fd3218814a4e3c9e0064e1334bd8aa20d5984b9f1a0afd084f8cc00"
+      },
+      {
+        "name": "snapshot",
+        "kind": "bundle",
+        "language": "go",
+        "system": "alpine",
+        "from": "cmd/mesh-nats-snapshot",
+        "binary": "mesh-nats-snapshot"
+      },
+      {
+        "name": "entrypoint",
+        "kind": "archive",
+        "from": "program"
+      },
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/nats-tools",
+        "binary": "nats-tools",
+        "loads": [
+          "nats-tools"
+        ],
+        "bus": {
+          "removes": [
+            "controller-leftovers"
+          ]
+        },
+        "env": {
+          "MESH_NATS_MONITOR": "http://127.0.0.1:8222",
+          "MESH_NATS_CONTAINER": "mesh-broker-nats",
+          "MESH_NATS_USERS_FILE": "/etc/nats/accounts.conf",
+          "MESH_NATS_SNAPSHOTS_DIR": "${dir:snapshots}",
+          "NATS_TOOLS_CREDENTIAL": "${dir:tools-secret}/broker-nats-tools"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}

go/catalogue/upgrade.go

@@ -2,6 +2,7 @@ package catalogue
 
 import (
 	"fmt"
+	"slices"
 	"strings"
 	"time"
 )
@@ -69,6 +70,26 @@ func ProvidesBus(m Manifest) bool {
 	return false
 }
 
+// BusServer names the resources of a module that provides the mesh's bus which are its server (novox/hq ADR 0594 §7):
+// the server's container and what restarts it. A node agent applying the bus module's want without the warrant's mark
+// leaves these as they run (§2), and the assigner says which resources wait for the warrant from this list; neither
+// keeps a copy of it. The ids are the catalogue's nats module's (modules/nats/module.json).
+var BusServer = []string{"server", "program-snapshot", "program-entrypoint"}
+
+// BusServerOf is the ids of BusServer that m declares as resources, empty unless m provides the mesh's bus.
+func BusServerOf(m Manifest) map[string]bool {
+	if !ProvidesBus(m) {
+		return nil
+	}
+	of := map[string]bool{}
+	for _, r := range m.Resources {
+		if id, _ := r["id"].(string); slices.Contains(BusServer, id) {
+			of[id] = true
+		}
+	}
+	return of
+}
+
 // irreplaceable names the first irreplaceable data the module keeps, its own or its consumers', or
 // nothing.
 func (m Manifest) irreplaceable() string {

go/delivery/assigner.go

@@ -196,15 +196,37 @@ type Want struct {
 	// Self says the node composes this module itself (ADR 0547 §2): the want names the build alone, and no composition.
 	// A want that is not Self names the one composition it allows (ADR 0539 clause 1), as before.
 	Self bool `json:"self,omitempty"`
+	// Warrant is the mark of a want that may replace the bus server (novox/hq ADR 0594 §6): WarrantPut on a want a put
+	// writes on the operator's warrant after the streams' snapshot, WarrantOperator on one the operator's credential
+	// writes by hand at the terminal. The node agent reads this mark and nothing else to decide whether the bus server
+	// may be replaced (§2); a want without it never replaces the server. Empty on every other want.
+	Warrant string `json:"warrant,omitempty"`
 }
 
+// The warrants a want may carry (Want.Warrant, novox/hq ADR 0594 §6).
+const (
+	// WarrantPut marks a want the assigner's put wrote on the operator's warrant, after the streams' snapshot.
+	WarrantPut = "put"
+	// WarrantOperator marks a want the operator's credential wrote by hand at the terminal.
+	WarrantOperator = "operator"
+)
+
 func (w Want) check() error {
 	if w.Removed {
-		if w.FP != "" || w.Composed != "" || w.Newest != "" || w.Rule != 0 || w.Backup != "" || w.Put || w.Hold || w.Self || w.Yes != "" {
-			return fmt.Errorf("delivery: a removed want names no fingerprint, composition, rule, backup answer or put")
+		if w.FP != "" || w.Composed != "" || w.Newest != "" || w.Rule != 0 || w.Backup != "" || w.Put || w.Hold || w.Self || w.Yes != "" || w.Warrant != "" {
+			return fmt.Errorf("delivery: a removed want names no fingerprint, composition, rule, backup answer, put or warrant")
 		}
 		return nil
 	}
+	switch w.Warrant {
+	case "", WarrantOperator:
+	case WarrantPut:
+		if !w.Put {
+			return fmt.Errorf("delivery: only a put's want carries the put's warrant")
+		}
+	default:
+		return fmt.Errorf("delivery: the warrant %q is not %s or %s", w.Warrant, WarrantPut, WarrantOperator)
+	}
 	if w.Hold && !w.Put {
 		return fmt.Errorf("delivery: only a put holds a want")
 	}

go/delivery/assigner_test.go

@@ -79,6 +79,9 @@ func TestAssignerValuesRoundTrip(t *testing.T) {
 		{FP: fp2of('a'), Composed: hashOf('1'), Newest: fp2of('b'), Rule: RuleCanary, Words: "the canary ace does not run it healthy yet"},
 		{Removed: true, Words: "the module left g14"},
 		{FP: fp2of('a'), Composed: hashOf('1'), Put: true, Hold: true, Words: "put by the operator: the bus's user list"},
+		// 774/S1: a want that may replace the bus server says its warrant (ADR 0594 §6).
+		{FP: fp2of('a'), Composed: hashOf('1'), Put: true, Warrant: WarrantPut},
+		{FP: fp2of('a'), Self: true, Warrant: WarrantOperator},
 	}
 	for _, w := range wants {
 		data, err := EncodeWant(w)
@@ -151,6 +154,10 @@ func TestAssignerValuesRefused(t *testing.T) {
 		{FP: fp2of('a'), Composed: hashOf('1'), Hold: true},
 		{FP: fp2of('a'), Composed: hashOf('1'), Put: true, Newest: fp2of('b'), Rule: 3},
 		{Removed: true, Put: true},
+		// 774/S1: a removed want carries no warrant, a warrant is put or operator, and put only on a put's want.
+		{Removed: true, Warrant: WarrantOperator},
+		{FP: fp2of('a'), Self: true, Warrant: "yes"},
+		{FP: fp2of('a'), Self: true, Warrant: WarrantPut},
 	} {
 		if _, err := EncodeWant(w); err == nil {
 			t.Errorf("EncodeWant(%+v) accepted", w)

go/delivery/delivery.go

@@ -360,6 +360,12 @@ type Have struct {
 	// slot that holds it, so a provider and a consumer of one value on one node each keep their own. Written in Sealed's
 	// place by a node-engine that knows it; Sealed is read only from a have written before.
 	SealedAt Seals `json:"sealed-at,omitempty"`
+	// Server is, in the have of the bus module, what the bus server runs (novox/hq ADR 0594 §4): the fingerprint whose
+	// server the node agent last made, or, from the take-over of a server a node's own composition made, that old-form
+	// build's name (`build-...`). FP is the fingerprint applied: the two differ while a build changed the server and no
+	// warranted want replaced it yet. Empty on every other have, and on a bus module's have from a node agent that does
+	// not keep the server.
+	Server string `json:"server,omitempty"`
 }
 
 // UserListWritten is the bus's user list as the node-engine of the bus node wrote it to the bus module's file, applied
@@ -421,8 +427,15 @@ type HaveNode struct {
 	// controller ended may still say `controller` (composedByTheEndedController), which is read and never written.
 	Composes    string `json:"composes,omitempty"`
 	ComposesWhy string `json:"composes-why,omitempty"`
+	// Keeps names what the node agent keeps as it runs on a want without the warrant's mark (novox/hq ADR 0594 §8):
+	// KeepsBusServer for a node agent that leaves the bus server alone. Written at each start; the assigner writes the
+	// bus module's want only to a node whose have names it. Empty from a node agent before it.
+	Keeps []string `json:"keeps,omitempty"`
 }
 
+// KeepsBusServer is a node agent that keeps the bus server unless a want is warranted (HaveNode.Keeps, ADR 0594 §8).
+const KeepsBusServer = "bus-server"
+
 // ComposesOwn is a node applying its own compositions (HaveNode.Composes).
 const ComposesOwn = "own"
 
@@ -494,6 +507,10 @@ func (h Have) check() error {
 			return err
 		}
 	}
+	if h.Server != "" && checkFingerprint(h.Server, "the bus server's fingerprint") != nil &&
+		(!strings.HasPrefix(h.Server, "build-") || checkName("bus server's build", h.Server) != nil) {
+		return fmt.Errorf("delivery: the bus server runs %q, neither a fingerprint nor a build's name", h.Server)
+	}
 	switch h.Health {
 	case HealthOK, HealthFailed, HealthWaits, HealthUnknown:
 	default:
@@ -529,6 +546,11 @@ func (n HaveNode) check() error {
 	default:
 		return fmt.Errorf("delivery: a node composes %q, not %s", n.Composes, ComposesOwn)
 	}
+	for _, k := range n.Keeps {
+		if k == "" {
+			return fmt.Errorf("delivery: a node keeps an empty name")
+		}
+	}
 	for group, a := range n.Candidates {
 		if group == "" {
 			return fmt.Errorf("delivery: a node's candidate answer names no group")
@@ -615,7 +637,7 @@ func SameHaveNode(a, b HaveNode) bool {
 		sameJSON(a.Strays, b.Strays) && sameJSON(a.Filters, b.Filters) && sameJSON(a.Profile, b.Profile) &&
 		(a.Record == nil) == (b.Record == nil) && (a.Record == nil || SameNodeRecord(*a.Record, *b.Record)) &&
 		jsonEqual(a.Sealed, b.Sealed) && maps.Equal(a.SealedAt, b.SealedAt) && jsonEqual(a.Candidates, b.Candidates) && a.Composes == b.Composes &&
-		a.ComposesWhy == b.ComposesWhy
+		a.ComposesWhy == b.ComposesWhy && slices.Equal(a.Keeps, b.Keeps)
 }
 
 // SamePresence says whether two presences are the same value.

go/delivery/delivery_test.go

@@ -282,6 +282,51 @@ func TestRoundTrip(t *testing.T) {
 			t.Error("a list was sealed to no key")
 		}
 	})
+	// 774/S2: the bus module's have names the fingerprint applied and what the server runs, a fingerprint or, at the
+	// take-over, an old-form build's name (ADR 0594 §4); a have written before decodes as it was.
+	t.Run("have of the bus with its server", func(t *testing.T) {
+		fpA, fpB := fp2of('a'), fp2of('b')
+		for _, server := range []string{fpA, "build-1792674595610176744"} {
+			in := Have{FP: fpB, Server: server, Phase: PhaseRunning, Health: HealthOK}
+			b, err := EncodeHave(in)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if !strings.Contains(string(b), `"server":"`+server+`"`) {
+				t.Errorf("the have says %s", b)
+			}
+			out, err := DecodeHave(b)
+			in.V = Version
+			if err != nil || !SameHave(out, in) || SameHave(out, Have{V: Version, FP: fpB, Phase: PhaseRunning, Health: HealthOK}) {
+				t.Errorf("got %+v, %v", out, err)
+			}
+		}
+		for _, server := range []string{"nats", "build-a.b", "src2:abc"} {
+			if _, err := EncodeHave(Have{FP: fpB, Server: server, Phase: PhaseRunning, Health: HealthOK}); err == nil {
+				t.Errorf("a server running %q was encoded", server)
+			}
+		}
+		old, err := DecodeHave([]byte(`{"v":1,"build":"build-17","phase":"running","health":"ok"}`))
+		if err != nil || old.Server != "" || !SameHave(old, Have{V: Version, Build: "build-17", Phase: PhaseRunning, Health: HealthOK}) {
+			t.Errorf("an old have read %+v, %v", old, err)
+		}
+		keeper := HaveNode{Composes: ComposesOwn, Keeps: []string{KeepsBusServer}}
+		b, err := EncodeHaveNode(keeper)
+		if err != nil || !strings.Contains(string(b), `"keeps":["bus-server"]`) {
+			t.Fatalf("the keeper's have is %s, %v", b, err)
+		}
+		back, err := DecodeHaveNode(b)
+		keeper.V = Version
+		if err != nil || !SameHaveNode(back, keeper) || SameHaveNode(back, HaveNode{V: Version, Composes: ComposesOwn}) {
+			t.Errorf("the keeper came back %+v, %v", back, err)
+		}
+		if older, err := DecodeHaveNode([]byte(`{"v":1,"composes":"own"}`)); err != nil || older.Keeps != nil {
+			t.Errorf("an older node's have read %+v, %v", older, err)
+		}
+		if _, err := EncodeHaveNode(HaveNode{Keeps: []string{""}}); err == nil {
+			t.Error("a node keeping an empty name was encoded")
+		}
+	})
 	t.Run("have node", func(t *testing.T) {
 		in := HaveNode{Windows: json.RawMessage(`{"a":1}`), Busy: json.RawMessage(`true`)}
 		b, err := EncodeHaveNode(in)

go/delivery/source.go

@@ -431,10 +431,6 @@ type Module struct {
 	// that state. Empty in a value written before the indexer judged, which a reader takes as accepted (TakeManifestVerdict).
 	Verdict  string   `json:"verdict,omitempty"`
 	Problems []string `json:"problems,omitempty"`
-	// Unknown are the fields of Manifest the judge does not know. A manifest that waits for them (VerdictManifestWaits) is
-	// written here as a refusal whose Problems say what it waits on and whose Unknown names the fields: a reader pinned
-	// before the verdict waits holds it as a refused one, and VerdictOf gives a reader that knows it the verdict waits.
-	Unknown []string `json:"unknown,omitempty"`
 	// Warnings are the problems of an accepted manifest a stricter judge outgrew (novox/hq ADR 0579 §1): Verdict is then
 	// empty (accepted), and the watchman raises delivery.ManifestOutgrown until the manifest is mended.
 	Warnings []string `json:"warnings,omitempty"`
@@ -448,9 +444,6 @@ func (m Module) VerdictOf(module string) *ManifestVerdict {
 	if m.Verdict == "" {
 		return &ManifestVerdict{Module: module, State: VerdictAccepted, Warnings: m.Warnings}
 	}
-	if m.Verdict == VerdictRefused && len(m.Unknown) > 0 {
-		return &ManifestVerdict{Module: module, State: VerdictManifestWaits, Unknown: m.Unknown}
-	}
 	return &ManifestVerdict{Module: module, State: m.Verdict, Problems: m.Problems}
 }
 
@@ -545,8 +538,6 @@ func (m Module) check() error {
 	switch {
 	case m.Verdict != "" && m.Verdict != VerdictAccepted && m.Verdict != VerdictRefused:
 		return fmt.Errorf("delivery: the module's verdict %q is neither %s nor %s", m.Verdict, VerdictAccepted, VerdictRefused)
-	case len(m.Unknown) > 0 && m.Verdict != VerdictRefused:
-		return fmt.Errorf("delivery: a module's unknown fields are named only with the refusal a wait is written as")
 	case m.Verdict != "" && m.Manifest == "":
 		return fmt.Errorf("delivery: a module carries a verdict and no manifest digest")
 	case (m.Verdict == VerdictRefused) != (len(m.Problems) > 0):

go/delivery/verdicts.go

@@ -4,7 +4,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"slices"
-	"strings"
 	"time"
 )
 
@@ -25,14 +24,6 @@ const (
 	// VerdictRefused is the state of a manifest the judge found a problem in; Problems says each.
 	VerdictRefused = "refused"
 
-	// VerdictManifestWaits is the state of a MANIFEST's verdict (not a proposal's: VerdictWaits, in placement_proposal.go,
-	// has the same word for a different thing, which is why this one carries Manifest in its name). It is the state of a
-	// manifest that carries a field the indexer's judge does not know (novox/hq ADR 0578 §1, amended): the manifest is not
-	// refused, because a newer judge may know the field; Unknown names each field. A reader holds a module whose manifest
-	// waits as it holds a refused one (ManifestVerdict.Held) and keeps what runs. In a modules value it is written as a
-	// refusal naming the fields (Module.Unknown), for readers that do not know this state.
-	VerdictManifestWaits = "waits"
-
 	// ManifestRefusedEvent is the indexer's event saying a manifest was refused (ManifestRefused), so the watchman
 	// raises it as a condition beside the indexer's finding.
 	ManifestRefusedEvent = "manifest-refused"
@@ -41,10 +32,6 @@ const (
 	// (novox/hq ADR 0579 §1): it stays accepted, its problems are the verdict's Warnings, and the watchman raises it as a
 	// warning until the manifest is mended.
 	ManifestOutgrown = "manifest-outgrown"
-
-	// ManifestWaits is the finding of a manifest whose verdict waits (VerdictManifestWaits): the watchman raises it as a warning
-	// until a judge knows the fields or the manifest is mended.
-	ManifestWaits = "manifest-waits"
 )
 
 // ManifestVerdict is the value of a verdicts key: the module whose manifest it is, accepted or refused, every problem the judge
@@ -54,8 +41,6 @@ type ManifestVerdict struct {
 	Module   string   `json:"module"`
 	State    string   `json:"state"`
 	Problems []string `json:"problems,omitempty"`
-	// Unknown are the fields of a manifest the judge does not know, named when the state is VerdictManifestWaits and nowhere else.
-	Unknown []string `json:"unknown,omitempty"`
 	// Warnings are the problems a stricter judge found in a manifest it accepted before, digest unchanged (novox/hq ADR
 	// 0579 §1): the verdict stays accepted.
 	Warnings []string  `json:"warnings,omitempty"`
@@ -66,36 +51,16 @@ type ManifestVerdict struct {
 // Refused is whether v refuses its manifest.
 func (v ManifestVerdict) Refused() bool { return v.State == VerdictRefused }
 
-// Waits is whether v says the manifest waits for a judge that knows its fields.
-func (v ManifestVerdict) Waits() bool { return v.State == VerdictManifestWaits }
-
-// Held is whether a reader holds the module as refused: the manifest is refused or waits.
-func (v ManifestVerdict) Held() bool { return v.Refused() || v.Waits() }
-
-// AsRefused is v as a reader pinned before the verdict waits takes it: a waiting verdict is a refusal naming what it waits
-// on, any other verdict is v. For a part that hands a verdict to a program it does not deliver with itself (the checker's
-// sandbox composer).
-func (v ManifestVerdict) AsRefused() ManifestVerdict {
-	if !v.Waits() {
-		return v
-	}
-	v.State, v.Problems, v.Unknown = VerdictRefused, []string{v.WaitsOn()}, nil
-	return v
-}
-
-// Same is whether v and o say the same of a manifest: the module, the state, the problems and the unknown fields, whoever judged and when.
+// Same is whether v and o say the same of a manifest: the module, the state and the problems, whoever judged and when.
 // The indexer writes a verdict only when it is not the same as the one it holds.
 func (v ManifestVerdict) Same(o ManifestVerdict) bool {
-	return v.Module == o.Module && v.State == o.State && slices.Equal(v.Problems, o.Problems) && slices.Equal(v.Unknown, o.Unknown) && slices.Equal(v.Warnings, o.Warnings)
+	return v.Module == o.Module && v.State == o.State && slices.Equal(v.Problems, o.Problems) && slices.Equal(v.Warnings, o.Warnings)
 }
 
 func (v ManifestVerdict) check() error {
 	if err := checkName("module", v.Module); err != nil {
 		return err
 	}
-	if v.State != VerdictManifestWaits && len(v.Unknown) > 0 {
-		return fmt.Errorf("delivery: the verdict on %s names unknown fields and does not wait", v.Module)
-	}
 	switch v.State {
 	case VerdictAccepted:
 		if len(v.Problems) > 0 {
@@ -108,12 +73,8 @@ func (v ManifestVerdict) check() error {
 		if len(v.Warnings) > 0 {
 			return fmt.Errorf("delivery: the verdict on %s refuses its manifest and warns: a refusal names problems", v.Module)
 		}
-	case VerdictManifestWaits:
-		if len(v.Unknown) == 0 || len(v.Problems) > 0 || len(v.Warnings) > 0 {
-			return fmt.Errorf("delivery: the verdict on %s waits and names no unknown field, or names problems or warnings: a wait names the fields", v.Module)
-		}
 	default:
-		return fmt.Errorf("delivery: the verdict on %s is %q, none of %s, %s and %s", v.Module, v.State, VerdictAccepted, VerdictRefused, VerdictManifestWaits)
+		return fmt.Errorf("delivery: the verdict on %s is %q, neither %s nor %s", v.Module, v.State, VerdictAccepted, VerdictRefused)
 	}
 	if v.Judge == "" {
 		return fmt.Errorf("delivery: the verdict on %s names no judge", v.Module)
@@ -152,37 +113,26 @@ func DecodeManifestVerdict(data []byte) (ManifestVerdict, error) {
 	return v, nil
 }
 
-// TakeManifestVerdict is how a reader takes the verdict on a manifest (ADR 0578 §3): held, with its problems, when the
-// indexer wrote a refusal, or, for a manifest that waits, with the words that say which fields it waits on. A missing verdict (nil) is taken as accepted, because every manifest the indexer holds before
+// TakeManifestVerdict is how a reader takes the verdict on a manifest (ADR 0578 §3): refused, with its problems, only when the
+// indexer wrote a refusal. A missing verdict (nil) is taken as accepted, because every manifest the indexer holds before
 // it has judged it was taken in under the judges that ran until then; that lasts until the indexer's first pass after its
 // delivery has written every verdict. A reader holds a refused module and names it with Why, and reads the rest.
 func TakeManifestVerdict(v *ManifestVerdict) (refused bool, problems []string) {
-	if v == nil || !v.Held() {
+	if v == nil || !v.Refused() {
 		return false, nil
 	}
-	if v.Waits() {
-		return true, []string{v.WaitsOn()}
-	}
 	return true, v.Problems
 }
 
-// WaitsOn says, in words, what a waiting manifest waits on.
-func (v ManifestVerdict) WaitsOn() string {
-	return "it carries " + strings.Join(v.Unknown, ", ") + ", which the indexer's judge does not know yet"
-}
-
 // Why is a refusal in a reader's words: the module, that the indexer's judge refused its manifest, and each problem.
 func (v ManifestVerdict) Why() string {
-	if !v.Held() {
+	if !v.Refused() {
 		return ""
 	}
 	judge := "the indexer's judge"
 	if v.Judge != "" {
 		judge += " (" + v.Judge + ")"
 	}
-	if v.Waits() {
-		return fmt.Sprintf("%s holds the manifest of %s: %s", judge, v.Module, v.WaitsOn())
-	}
 	why := fmt.Sprintf("%s refused the manifest of %s:", judge, v.Module)
 	for _, p := range v.Problems {
 		why += " " + p + ";"

go/delivery/verdicts_test.go

@@ -29,9 +29,6 @@ func TestAManifestVerdictIsTheContractReadersTake(t *testing.T) {
 		"refused, no problem": {Module: "m", State: VerdictRefused, Judge: "j"},
 		"accepted, a problem": {Module: "m", State: VerdictAccepted, Problems: []string{"x"}, Judge: "j"},
 		"refused, a warning":  {Module: "m", State: VerdictRefused, Problems: []string{"x"}, Warnings: []string{"y"}, Judge: "j"},
-		"waits, no field":     {Module: "m", State: VerdictManifestWaits, Judge: "j"},
-		"waits, a problem":    {Module: "m", State: VerdictManifestWaits, Unknown: []string{"f"}, Problems: []string{"x"}, Judge: "j"},
-		"fields, accepted":    {Module: "m", State: VerdictAccepted, Unknown: []string{"f"}, Judge: "j"},
 	} {
 		if _, err := EncodeManifestVerdict(bad); err == nil {
 			t.Errorf("%s: encoded", name)
@@ -75,38 +72,4 @@ func TestAManifestVerdictIsTheContractReadersTake(t *testing.T) {
 	if r, _ := TakeManifestVerdict(m.VerdictOf("x")); r || len(m.VerdictOf("x").Warnings) != 1 {
 		t.Fatalf("an outgrown module: %+v", m.VerdictOf("x"))
 	}
-	// A manifest with a field the judge does not know waits (clause 3 of the record on a release's Approve): readers hold it
-	// as a refused one, it round-trips through a modules value, an old value decodes unchanged, and it is not a refusal.
-	waits := ManifestVerdict{Module: "nats", State: VerdictManifestWaits, Unknown: []string{"core-credentials", "tool-runner"}, Judge: "j"}
-	data, err = EncodeManifestVerdict(waits)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if back, err = DecodeManifestVerdict(data); err != nil || !back.Same(waits) || back.Same(ManifestVerdict{Module: "nats", State: VerdictManifestWaits, Unknown: []string{"x"}, Judge: "j"}) {
-		t.Fatalf("a waiting verdict: %+v %v", back, err)
-	}
-	if r, p := TakeManifestVerdict(&waits); !r || waits.Refused() || !waits.Held() || !strings.Contains(p[0], "core-credentials, tool-runner") ||
-		!strings.Contains(waits.Why(), "holds the manifest of nats") {
-		t.Fatalf("a waiting verdict is held like a refusal: %v %v %q", r, p, waits.Why())
-	}
-	if r := waits.AsRefused(); !r.Refused() || r.Waits() || len(r.Problems) != 1 || len(r.Unknown) != 0 || refused.AsRefused().State != VerdictRefused {
-		t.Fatalf("a waiting verdict as a reader before it takes it: %+v", r)
-	}
-	// In a modules value a wait is written as a refusal naming the fields (an older reader holds it as refused).
-	w := Module{FP2: "src2:" + strings.Repeat("b", 64), Manifest: strings.Repeat("c", 64), Repository: "novox/x", Commit: "c",
-		Verdict: VerdictRefused, Problems: []string{waits.WaitsOn()}, Unknown: []string{"f"}}
-	data, err = EncodeModule(w)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got, err = DecodeModule(data); err != nil || got.VerdictOf("x").Unknown[0] != "f" || !got.VerdictOf("x").Waits() || got.VerdictOf("x").Refused() {
-		t.Fatalf("the module's waiting verdict: %+v %v", got, err)
-	}
-	if r, p := TakeManifestVerdict(got.VerdictOf("x")); !r || !strings.Contains(p[0], "which the indexer's judge does not know yet") {
-		t.Fatalf("a waiting module is held: %v %v", r, p)
-	}
-	w.Verdict, w.Problems = "", nil
-	if _, err := EncodeModule(w); err == nil {
-		t.Fatal("unknown fields with no wait were encoded")
-	}
 }