mesh-sdk/go/compose/frombus/frombus_test.go

package frombus

import (
	"archive/tar"
	"bytes"
	"compress/gzip"
	"context"
	"crypto/ecdh"
	"crypto/rand"
	"encoding/base64"
	"encoding/json"
	"errors"
	"fmt"
	"os"
	"reflect"
	"slices"
	"sort"
	"strings"
	"testing"

	"git.novox.be/novox/mesh-sdk/go/catalogue"
	"git.novox.be/novox/mesh-sdk/go/compose"
	"git.novox.be/novox/mesh-sdk/go/delivery"
	"git.novox.be/novox/mesh-sdk/go/overlay"
)

// bus is a Reader over values held in memory, counting whose config values were read.
type bus struct {
	vaultAuthority string
	placements     map[string]delivery.Placement
	records        map[string]delivery.NodeRecord
	modules        map[string]delivery.Module
	manifests      map[string][]byte
	values         map[string]map[string]any // by node.module
	valuesRead     []string
	own            []compose.OwnSecretRow
	ownErr         error
	// asked is every consumer credential asked; the fake refuses the whole ask, as the vault's own does, for a consuming
	// module its placement does not put on the node.
	asked []compose.CredentialKey
	// builds are the builder's keys, by "<module> <fp>"; archives the artifact store's blobs, by digest, and fetched
	// every URL asked; served another node's values by "<node>.<module>", and servedRead every ask with its keys.
	builds     map[string]*delivery.BuilderBuild
	archives   map[string][]byte
	fetched    []string
	served     map[string]map[string]any
	servedRead []string
	buildsRead []string
	// held answers every credential asked as held, sealed to the consumer.
	held bool
}

func (b *bus) Build(_ context.Context, module, fp string) (*delivery.BuilderBuild, error) {
	b.buildsRead = append(b.buildsRead, module)
	return b.builds[module+" "+fp], nil
}

func (b *bus) Archive(_ context.Context, url, digest string) ([]byte, error) {
	b.fetched = append(b.fetched, url)
	body, ok := b.archives[digest]
	if !ok {
		return nil, errors.New("the store holds no such blob")
	}
	return body, nil
}

func (b *bus) Served(_ context.Context, node, module string, keys []string) (map[string]any, error) {
	b.servedRead = append(b.servedRead, node+"."+module+":"+strings.Join(keys, ","))
	out := map[string]any{}
	for _, k := range keys {
		if v, ok := b.served[node+"."+module][k]; ok {
			out[k] = v
		}
	}
	return out, nil
}

func (b *bus) Placements(context.Context) (map[string]delivery.Placement, error) {
	return b.placements, nil
}
func (b *bus) VaultAuthority(context.Context) string                           { return b.vaultAuthority }
func (b *bus) Records(context.Context) (map[string]delivery.NodeRecord, error) { return b.records, nil }
func (b *bus) Modules(context.Context) (map[string]delivery.Module, error)     { return b.modules, nil }
func (b *bus) Manifest(_ context.Context, digest string) ([]byte, error) {
	raw, ok := b.manifests[digest]
	if !ok {
		return nil, errors.New("no such manifest")
	}
	return raw, nil
}
func (b *bus) OwnSecrets(context.Context, string) ([]compose.OwnSecretRow, error) {
	return b.own, b.ownErr
}

func (b *bus) Credentials(_ context.Context, node string, asConsumer, asProvider []compose.CredentialKey) ([]compose.Credential, []compose.Issued, error) {
	b.asked = append(b.asked, asConsumer...)
	for _, k := range asConsumer {
		placed := false
		for _, m := range b.placements[node].Modules {
			placed = placed || m.Module == k.ConsumerModule
		}
		if !placed {
			return nil, nil, fmt.Errorf("%s is not on %s: neither assigned there nor required by a module there", k.ConsumerModule, node)
		}
	}
	var out []compose.Credential
	var issued []compose.Issued
	for _, k := range append(append([]compose.CredentialKey{}, asConsumer...), asProvider...) {
		if b.held {
			out = append(out, compose.Credential{Provision: k.Provision, Consumer: k.Consumer, ConsumerModule: k.ConsumerModule,
				Provider: k.Provider, Local: k.Local, State: compose.CredentialHeld, Sealed: `"box"`})
			issued = append(issued, compose.Issued{Provision: k.Provision, Consumer: k.Consumer, ConsumerModule: k.ConsumerModule,
				Provider: k.Provider, Local: k.Local, ForProvider: `"box"`})
		}
	}
	return out, issued, nil
}

func (b *bus) Values(_ context.Context, node, module string) (map[string]any, error) {
	b.valuesRead = append(b.valuesRead, node+"."+module)
	return b.values[node+"."+module], nil
}

func publicKey(t *testing.T) string {
	t.Helper()
	k, err := ecdh.X25519().GenerateKey(rand.Reader)
	if err != nil {
		t.Fatal(err)
	}
	return base64.StdEncoding.EncodeToString(k.PublicKey().Bytes())
}

// Issue 1126 (S3, S4, S5): the bus's placement, node records, manifests and config values fill the same compose.Input the
// controller's store fills for compose's own two-machine mesh (compose's aMesh: anchor the hub, laptop), and that Input
// composes; a node reads only its own config values; what cannot be composed is refused, naming it.
func TestInput(t *testing.T) {
	// Issue 1126, the seed's shadow: every refusal named, an old-form module left to the node, and no store reached
	// saying why (answer_rows_test.go).
	t.Run("every refusal, and an old build left to the node", answerNamesEveryRefusalAndLeavesAnOldBuildToTheNode)
	t.Run("no store reached says why", noStoreReachedSaysWhy)
	// Issue 774: a node refused whole says what it held on the way.
	t.Run("a node refused whole says what it held", aNodeRefusedWholeSaysWhatItHeld)
	t.Run("the runtime is blamed only where its stub composes", theRuntimeIsBlamedOnlyWhereItsStubComposes)
	t.Run("a running module waits for its build", aRunningModuleWaitsForItsBuild)
	t.Run("a held module's first reason leads", aHeldModulesFirstReasonLeads)
	t.Run("a held module of its own account never refuses the node", aHeldModuleOfItsOwnAccountNeverRefusesTheNode)
	t.Run("another node not resolved is named", otherNodeNotResolvedIsNamed)
	ctx := context.Background()
	xterm, err := os.ReadFile("../../catalogue/testdata/catalogue-835bf22b-xterm.module.json")
	if err != nil {
		t.Fatal(err)
	}
	digest := delivery.ManifestDigest(xterm)
	// A module in the settings form (plex and the media modules on one node, 2026-10-26): its config values are in its
	// layers, not mesh-config, so the placement carries them (MeshValues, Values) and mesh-config's are not read for it.
	media := []byte(`{"module":"media","version":"1","settings":{"lines":{"kind":"preference","default":0,"why":"kept"},` +
		`"name":{"kind":"preference","default":"x","why":"shown"}},"own-secrets":{"token":"/srv/media/token"},"resources":[{"id":"conf","type":"file",` +
		`"path":"/srv/media/conf","mode":"0644","content":"uid=${setting:lines} name=${setting:name}\n"}]}`)
	mediaDigest := delivery.ManifestDigest(media)
	keys := map[string]string{"anchor": publicKey(t), "laptop": publicKey(t)}
	caps := []string{"container-runtime", "systemd", "wireguard"}
	tunnel := &delivery.RecordTunnel{Interface: "wg0", PublicKey: keys["anchor"], Address: "10.77.0.1/24",
		Peers: []delivery.RecordTunnelPeer{{PublicKey: "peer", Address: "10.77.0.9/32"}, {PublicKey: keys["laptop"], Address: "10.77.0.2/32"}}}
	mk := func() *bus {
		return &bus{
			placements: map[string]delivery.Placement{
				"anchor": {Node: "anchor", Decided: delivery.NodeDecided{Endpoint: "anchor.example:51820", Site: "here", Hub: true, Address: "10.77.0.1",
					Tunnel: tunnel, PeerNames: map[string]string{"peer": "phone"}},
					Modules: []delivery.PlacedModule{{Module: overlay.Name}},
					Holds:   []delivery.Holding{{Claim: "mesh-private-network", Scope: "mesh", Module: overlay.Name}}},
				"laptop": {Node: "laptop", Decided: delivery.NodeDecided{Endpoint: "laptop.example:51820", Site: "here", Address: "10.77.0.2"},
					Modules: []delivery.PlacedModule{{Module: overlay.Name},
						{Module: "xterm", HasLayer: true, Ports: map[string]int{"80": 8080}},
						{Module: "media", HasMesh: true, MeshValues: map[string]any{"name": "mesh"}, HasLayer: true,
							Layer: map[string]any{"places": map[string]any{"data": "/srv/data"}}, Values: map[string]any{"lines": float64(1000)}}}},
			},
			records: map[string]delivery.NodeRecord{
				"anchor": {Node: "anchor", TunnelKey: keys["anchor"], Capabilities: caps, Contract: 2},
				"laptop": {Node: "laptop", TunnelKey: keys["laptop"], Capabilities: caps, Authority: "the mesh's certificate"},
			},
			modules:   map[string]delivery.Module{"xterm": {Manifest: digest}, "media": {Manifest: mediaDigest}, "unread": {}},
			manifests: map[string][]byte{digest: xterm, mediaDigest: media},
			values: map[string]map[string]any{"laptop.xterm": {"font": "mono"}, "anchor.xterm": {"font": "serif"},
				"laptop.media": {"lines": "not mesh-config's"}},
			own: []compose.OwnSecretRow{{Node: "laptop", Module: "media", Name: "token", Origin: "made", SealedTo: "sk", Sealed: "{}"}},
		}
	}

	// What the controller's store gives for the same mesh, as compose's aMesh and SettingsFor build it.
	var private catalogue.Manifest
	raw, _ := json.Marshal(overlay.Manifest())
	if err := json.Unmarshal(raw, &private); err != nil {
		t.Fatal(err)
	}
	parsed, err := catalogue.ParseManifestForInputs(xterm)
	if err != nil {
		t.Fatal(err)
	}
	parsedMedia, err := catalogue.ParseManifestForInputs(media)
	if err != nil {
		t.Fatal(err)
	}
	capsSet := map[string]bool{"container-runtime": true, "systemd": true, "wireguard": true}
	tun := compose.Tunnel{Interface: "wg0", PublicKey: keys["anchor"], Address: "10.77.0.1/24",
		Peers: []compose.TunnelPeer{{PublicKey: "peer", Address: "10.77.0.9/32"}, {PublicKey: keys["laptop"], Address: "10.77.0.2/32"}}}
	want := compose.Input{
		Catalogue: map[string]catalogue.Manifest{overlay.Name: private, "xterm": parsed, "media": parsedMedia},
		Nodes: []compose.Node{
			{Name: "anchor", Place: compose.Place{Key: keys["anchor"], Endpoint: "anchor.example:51820", Site: "here", Hub: true,
				Address: "10.77.0.1"}, Assigned: []string{overlay.Name}, Capabilities: capsSet, Contract: 2, Stated: true},
			{Name: "laptop", Place: compose.Place{Key: keys["laptop"], Endpoint: "laptop.example:51820", Site: "here",
				Address: "10.77.0.2"}, Assigned: []string{overlay.Name, "xterm", "media"}, Capabilities: capsSet,
				Ports: map[string]map[int]int{"xterm": {80: 8080}},
				Settings: map[string][]catalogue.Layer{"xterm": {{From: "laptop", Values: map[string]any{"font": "mono"}}},
					"media": {{From: catalogue.MeshWideLayer, Values: map[string]any{"name": "mesh"}},
						{From: "laptop", Values: map[string]any{"lines": float64(1000)}, Placement: map[string]any{"places": map[string]any{"data": "/srv/data"}}}}}},
		},
		Holdings:   []catalogue.Held{{Claim: "mesh-private-network", Scope: "mesh", Node: "anchor", Module: overlay.Name}},
		OwnSecrets: []compose.OwnSecretRow{{Node: "laptop", Module: "media", Name: "token", Origin: "made", SealedTo: "sk", Sealed: "{}"}},
		// The same value as a core credential's box, for a core module (ADR 0349 §16).
		KeptCoreBoxes: []compose.CoreBox{{Node: "laptop", Module: "media", Name: "token", SealedTo: "sk", Box: json.RawMessage("{}")}},
		Tunnels:       map[string]compose.FoundTunnel{"anchor": {Tunnel: tun}},
		Adopted:       &compose.AdoptedTunnel{Tunnel: tun, Hub: "anchor", Adopted: true},
		// The controller's order is by address; laptop enrolled under its peer's key, and a person named the other.
		Authority: "the mesh's certificate",
		CarriedPeers: []compose.CarriedPeer{{PublicKey: keys["laptop"], Address: "10.77.0.2", EnrolledAs: "laptop"},
			{PublicKey: "peer", Address: "10.77.0.9", Named: "phone"}},
	}

	b := mk()
	got, err := Input(ctx, b, Mesh{}, Scope{Node: "laptop"})
	if err != nil {
		t.Fatal(err)
	}
	if !reflect.DeepEqual(got, want) {
		gj, _ := json.MarshalIndent(got, "", " ")
		wj, _ := json.MarshalIndent(want, "", " ")
		t.Fatalf("Input from the bus differs from the store's:\n got %s\nwant %s", gj, wj)
	}
	// L3 s8 (ADR 0550 §2): with the vault's authority published, the mesh's authority is the bundle of the controller's
	// and the vault's; with none, the controller's alone, as above.
	signing := mk()
	signing.vaultAuthority = "the vault's certificate"
	if bundled, err := Input(ctx, signing, Mesh{}, Scope{Node: "laptop"}); err != nil ||
		bundled.Authority != "the mesh's certificate\nthe vault's certificate\n" {
		t.Errorf("the authority with the vault's published: %q, %v", bundled.Authority, err)
	}
	if !reflect.DeepEqual(b.valuesRead, []string{"laptop." + overlay.Name, "laptop.xterm", "laptop.media"}) {
		t.Errorf("laptop read config values %v; a node reads its own slice alone", b.valuesRead)
	}

	// The same composer over both: the compositions from the bus are the store's, byte for byte.
	fps := map[string]string{overlay.Name: "src2:" + strings.Repeat("a", 64), "xterm": "src2:" + strings.Repeat("b", 64),
		"media": "src2:" + strings.Repeat("c", 64)}
	fromBus, _, held, err := Compose(ctx, mk(), Mesh{}, Scope{Node: "laptop"}, fps)
	if err == nil && len(held) > 0 {
		err = fmt.Errorf("modules held: %v", held)
	}
	if err != nil {
		t.Fatal(err)
	}
	fromStore, _, err := compose.Compositions(want, "laptop", fps, compose.Reading)
	if err != nil {
		t.Fatal(err)
	}
	if len(fromBus) == 0 || !reflect.DeepEqual(fromBus, fromStore) {
		t.Fatalf("compositions differ or are empty: %d from the bus, %d from the store", len(fromBus), len(fromStore))
	}

	// Issue 1126: a candidate placement equal to the node's composes what it runs, and CompareComposed says so; one
	// thing changed in the group's candidate of another node (the hub's endpoint) names exactly the module it moves
	// here. Placed puts the same placement over the store's input unchanged.
	running := make([]delivery.Composed, 0, len(fromBus))
	for _, c := range fromBus {
		running = append(running, c)
	}
	laptop := mk().placements["laptop"]
	asIs, _, held, err := Compose(ctx, mk(), Mesh{}, Scope{Node: "laptop", Placements: map[string]*delivery.Placement{"laptop": &laptop}}, fps)
	if err == nil && len(held) > 0 {
		err = fmt.Errorf("modules held: %v", held)
	}
	if err != nil {
		t.Fatal(err)
	}
	if c := delivery.CompareComposed(asIs, running); len(c.Differs)+len(c.Added)+len(c.Removed) != 0 || len(c.Same) != len(running) {
		t.Errorf("the candidate equal to the placement: %+v", c)
	}
	moved := mk().placements["anchor"]
	moved.Decided.Endpoint = "anchor.example:51821"
	changed, _, held, err := Compose(ctx, mk(), Mesh{}, Scope{Node: "laptop", Placements: map[string]*delivery.Placement{"laptop": &laptop, "anchor": &moved}}, fps)
	if err == nil && len(held) > 0 {
		err = fmt.Errorf("modules held: %v", held)
	}
	if err != nil {
		t.Fatal(err)
	}
	if c := delivery.CompareComposed(changed, running); len(c.Differs) != 1 || c.Differs[0].Module != overlay.Name || c.Differs[0].Resource != overlay.Name+".overlay-config" {
		t.Errorf("the hub's endpoint changed: %+v, want %s alone, naming its config", c, overlay.Name)
	}
	if c := delivery.CompareComposed(changed, running[:0]); len(c.Added) != len(changed) {
		t.Errorf("nothing runs: %+v", c)
	}

	// ADR 0559 §4, the node's answer: the same; one module differing; a module the group adds, whose own secret is not
	// yet issued (no refusal); a value missing for a module the node runs (a refusal); a module the candidate removes.
	keeper := []byte(`{"module":"keeper","version":"1","own-secrets":{"password":"/var/lib/mesh/keeper/password"},` +
		`"resources":[{"id":"state","type":"directory","path":"/var/lib/mesh/keeper","mode":"0700"}]}`)
	lemurs := []byte(`{"module":"lemurs","version":"1","capabilities":["systemd"],"resources":[{"id":"service","type":"service","unit":"lemurs.service","state":"running","boot":"enabled"}]}`)
	// A provider and a consumer of a pair credential on the one node (compose's objects and files).
	objects, _ := json.Marshal(catalogue.Manifest{Module: "objects", Version: "1",
		Provides: []catalogue.Offer{{Name: "s3-bucket", Scope: catalogue.ScopeMesh, Identity: &catalogue.OfferIdentity{Max: 20, In: "an S3 access key"}}},
		Receives: map[string]string{"s3-bucket": "/var/lib/mesh/objects/mesh.json"}})
	files, _ := json.Marshal(catalogue.Manifest{Module: "files", Version: "1", Requires: []string{"s3-bucket"},
		Resources: []map[string]any{{"id": "config", "type": "file", "path": "/etc/files/config.json", "mode": "0600", "content": "{}", "merge": "json"}}})
	one := func(placed ...string) *bus {
		p := delivery.Placement{Node: "n1", Decided: delivery.NodeDecided{Hub: true, Address: "10.77.0.1"}}
		for _, m := range placed {
			p.Modules = append(p.Modules, delivery.PlacedModule{Module: m})
		}
		return &bus{placements: map[string]delivery.Placement{"n1": p},
			records: map[string]delivery.NodeRecord{"n1": {Node: "n1", TunnelKey: keys["anchor"], SealingKey: "sk", Capabilities: []string{"systemd"}}},
			modules: map[string]delivery.Module{"keeper": {Manifest: delivery.ManifestDigest(keeper)}, "lemurs": {Manifest: delivery.ManifestDigest(lemurs)},
				"objects": {Manifest: delivery.ManifestDigest(objects)}, "files": {Manifest: delivery.ManifestDigest(files)}},
			manifests: map[string][]byte{delivery.ManifestDigest(keeper): keeper, delivery.ManifestDigest(lemurs): lemurs,
				delivery.ManifestDigest(objects): objects, delivery.ManifestDigest(files): files},
			own: []compose.OwnSecretRow{{Node: "n1", Module: "keeper", Name: "password", Origin: "made", SealedTo: "sk", Sealed: `"box"`}}}
	}
	oneFps := map[string]string{"keeper": "src2:" + strings.Repeat("d", 64), "lemurs": "src2:" + strings.Repeat("e", 64),
		"objects": "src2:" + strings.Repeat("f", 64), "files": "src2:" + strings.Repeat("0", 64)}
	runs, _, held, err := Compose(ctx, one("keeper", "lemurs"), Mesh{}, Scope{Node: "n1"}, oneFps)
	if err == nil && len(held) > 0 {
		err = fmt.Errorf("modules held: %v", held)
	}
	if err != nil {
		t.Fatal(err)
	}
	var runsNow []delivery.Composed
	for _, c := range runs {
		runsNow = append(runsNow, c)
	}
	objectsRun, _, held, err := Compose(ctx, one("objects"), Mesh{}, Scope{Node: "n1"}, oneFps)
	if err == nil && len(held) > 0 {
		err = fmt.Errorf("modules held: %v", held)
	}
	if err != nil {
		t.Fatal(err)
	}
	var consumerRuns []delivery.Composed
	for _, c := range objectsRun {
		consumerRuns = append(consumerRuns, c)
	}
	withoutOwn := func(cs []delivery.Composed) []delivery.Composed {
		var out []delivery.Composed
		for _, c := range cs {
			if c.Module != "" {
				out = append(out, c)
			}
		}
		return out
	}
	// What the controller runs on n1 for a module no want names (lemurs, at a build of the old form) and the private
	// network's (built by nobody): its composed writer (mesh-controller compositionsOf) folds their resources into the
	// node's own, each in its place, its module taken off; the rest split by module.
	tunnelled := func() *bus {
		b := one("keeper", "lemurs", overlay.Name)
		p := b.placements["n1"]
		p.Decided.Endpoint = "n1.example:51820"
		b.placements["n1"] = p
		return b
	}
	tunnelledAs := func() map[string]*delivery.Placement {
		p := tunnelled().placements["n1"]
		return map[string]*delivery.Placement{"n1": &p}
	}
	folded := func() []delivery.Composed {
		b := tunnelled()
		in, err := Input(ctx, b, Mesh{}, Scope{Node: "n1"})
		if err != nil {
			t.Fatal(err)
		}
		reading := in
		reading.Nodes = append([]compose.Node(nil), in.Nodes...)
		reading.Nodes[0].ReadsModules = true
		d, _, err := compose.ComposeIn(reading, "n1", compose.Reading)
		if err != nil {
			t.Fatal(err)
		}
		body, err := d.Body()
		if err != nil {
			t.Fatal(err)
		}
		var envelope struct {
			Resources []map[string]json.RawMessage `json:"resources"`
		}
		if err := json.Unmarshal(body, &envelope); err != nil {
			t.Fatal(err)
		}
		var resources []json.RawMessage
		for _, r := range envelope.Resources {
			var module string
			_ = json.Unmarshal(r["module"], &module)
			if module == "lemurs" || module == overlay.Name {
				delete(r, "module")
			}
			raw, _ := json.Marshal(r)
			resources = append(resources, raw)
		}
		split, err := delivery.SplitComposed("n1", resources, map[string]string{"keeper": oneFps["keeper"]}, nil, delivery.NodeOwn{})
		if err != nil {
			t.Fatal(err)
		}
		var out []delivery.Composed
		for _, c := range split {
			out = append(out, c)
		}
		return out
	}()
	if got := InOwn(folded, tunnelled().placements["n1"]); !reflect.DeepEqual(got, []string{"lemurs", overlay.Name}) {
		t.Errorf("InOwn of the controller's composition = %v, want lemurs and %s", got, overlay.Name)
	}
	placedAs := func(modules ...string) map[string]*delivery.Placement {
		p := one(modules...).placements["n1"]
		return map[string]*delivery.Placement{"n1": &p}
	}
	for name, c := range map[string]struct {
		b       *bus
		given   map[string]*delivery.Placement
		running []delivery.Composed
		verdict string
		check   func(delivery.CandidateAnswer) bool
	}{
		"the same": {one("keeper", "lemurs"), placedAs("keeper", "lemurs"), runsNow, delivery.CandidateSame,
			func(a delivery.CandidateAnswer) bool {
				return len(a.Same) == 3 && a.Proposal == "p-h1" && a.Revision == 7
			}},
		"the node runs no own composition": {one("keeper", "lemurs"), placedAs("keeper", "lemurs"), withoutOwn(runsNow), delivery.CandidateSame,
			func(a delivery.CandidateAnswer) bool { return len(a.Same) == 2 && len(a.Added) == 0 }},
		"one removed": {one("keeper", "lemurs"), placedAs("keeper"), runsNow, delivery.CandidateDiffers,
			func(a delivery.CandidateAnswer) bool { return reflect.DeepEqual(a.Removed, []string{"lemurs"}) }},
		"one added, its secret not yet issued": {func() *bus { b := one("lemurs"); b.own = nil; return b }(), placedAs("keeper", "lemurs"),
			nil, delivery.CandidateDiffers, func(a delivery.CandidateAnswer) bool {
				for _, m := range a.Added {
					if m.Module == "keeper" {
						return reflect.DeepEqual(m.Unissued, []string{"keeper/password"}) && len(a.Refusals) == 0
					}
				}
				return false
			}},
		"a value missing for a module that runs": {func() *bus { b := one("keeper", "lemurs"); b.own = nil; return b }(), placedAs("keeper", "lemurs"),
			runsNow, delivery.CandidateRefused, func(a delivery.CandidateAnswer) bool {
				return len(a.Refusals) == 1 && a.Refusals[0].Module == "keeper" && strings.Contains(a.Refusals[0].Why, "keeper/password")
			}},
		// Review of L2b, round 1, finding 1: a consumer the candidate adds has no credential yet, and the vault refuses an
		// ask for a module not on the node; it is not asked, and the module is added, its credential not yet issued.
		"a consumer added, the vault not asked for it": {one("objects"), placedAs("objects", "files"), consumerRuns, delivery.CandidateDiffers,
			func(a delivery.CandidateAnswer) bool {
				return len(a.Added) == 1 && a.Added[0].Module == "files" && len(a.Added[0].Unissued) > 0 && len(a.Refusals) == 0
			}},
		// And with no trunk at all (the seed), a stand-in of a module the node runs is a refusal, not an addition.
		"the seed, a value missing for a module that runs": {func() *bus { b := one(); b.own = nil; return b }(), placedAs("keeper", "lemurs"),
			runsNow, delivery.CandidateRefused, func(a delivery.CandidateAnswer) bool {
				return len(a.Refusals) == 1 && a.Refusals[0].Module == "keeper" && len(a.Added) == 0
			}},
		"cannot compose": {one("keeper"), map[string]*delivery.Placement{"n1": {Node: "n2"}}, runsNow, delivery.CandidateRefused,
			func(a delivery.CandidateAnswer) bool { return a.Refused != "" }},
		// Issue 1126 (the seed's review): the private network's module and one at a build of the old form, which no want
		// names and the controller folds into the node's own, are folded there again: the node's own is the same, and
		// neither is added.
		"mesh-wireguard and an old-form module, folded": {tunnelled(), tunnelledAs(),
			folded, delivery.CandidateSame, func(a delivery.CandidateAnswer) bool { return len(a.Same) == 2 && len(a.Added) == 0 }},
	} {
		fps := oneFps
		if name == "mesh-wireguard and an old-form module, folded" {
			fps = map[string]string{"keeper": oneFps["keeper"]} // the node's wants: no build of lemurs or the private network
		}
		a := Answer(ctx, c.b, Mesh{}, Scope{Node: "n1", Placements: c.given, InOwn: InOwn(c.running, *c.given["n1"])}, fps, c.running, "p-h1", 7)
		if a.Verdict != c.verdict || !c.check(a) {
			t.Errorf("%s: %+v", name, a)
		}
		if raw, err := delivery.EncodeHaveNode(delivery.HaveNode{Candidates: map[string]delivery.CandidateAnswer{"g": a}}); err != nil {
			t.Errorf("%s: the answer is not one a have holds: %v (%s)", name, err, raw)
		}
	}
	if got, err := Placed(want, map[string]*delivery.Placement{"laptop": &laptop}); err != nil || !reflect.DeepEqual(got, want) {
		t.Errorf("Placed with the node's own placement changes the input: %v", err)
	}
	if got, err := Placed(want, map[string]*delivery.Placement{"laptop": nil}); err != nil || len(got.Nodes[1].Assigned) != 0 || got.Nodes[1].Place.Key != keys["laptop"] {
		t.Errorf("Placed with no placement: %+v, %v", got.Nodes[1], err)
	}
	if _, err := Placed(want, map[string]*delivery.Placement{"stranger": {Node: "stranger"}}); err == nil {
		t.Error("Placed a node the input holds no node for")
	}
	if _, err := Input(ctx, mk(), Mesh{}, Scope{Node: "laptop", Placements: map[string]*delivery.Placement{"laptop": {Node: "anchor"}}}); err == nil {
		t.Error("a given placement naming another node was taken")
	}

	// ADR 0555 §6: Export is Input's inverse for what a person decides: the store's input exported, node by node, is the
	// placement the bus holds, and read back it is the store's input again.
	for node, placed := range mk().placements {
		got, err := Export(want, node)
		if err != nil {
			t.Fatal(err)
		}
		if gj, _ := delivery.EncodePlacement(got); !delivery.SamePlacement(got, placed) {
			pj, _ := delivery.EncodePlacement(placed)
			t.Errorf("%s exported as %s, want %s", node, gj, pj)
		}
	}
	if _, err := Export(want, "stranger"); err == nil {
		t.Error("a node the input lacks was exported")
	}

	b = mk()
	if every, err := Input(ctx, b, Mesh{}, Scope{Every: true}); err != nil || every.OwnSecrets != nil {
		t.Fatalf("composing every node: %v, own secrets %v (the vault answers a node about itself alone)", err, every.OwnSecrets)
	}
	if !reflect.DeepEqual(b.valuesRead, []string{"anchor." + overlay.Name, "laptop." + overlay.Name, "laptop.xterm", "laptop.media"}) {
		// Every node's placed modules, and nothing placed nowhere: anchor places no xterm.
		t.Errorf("the check read %v", b.valuesRead)
	}

	// A node none of whose modules declares an own secret composes without asking the vault (the review of L2: a node
	// with no secret composed nothing while the vault did not answer); one whose module does, refuses without it.
	quiet := mk()
	quiet.ownErr = errors.New("no responders")
	if _, err := Input(ctx, quiet, Mesh{}, Scope{Node: "anchor"}); err != nil {
		t.Errorf("anchor, with no own secret, needed the vault: %v", err)
	}
	if _, err := Input(ctx, quiet, Mesh{}, Scope{Node: "laptop"}); err == nil {
		t.Error("laptop's media, which declares an own secret, composed without the vault")
	}

	// A module the node's want keeps at another build than the trunk's composes from that build's manifest, resolved with
	// what it made (issue 1126), on the composing node alone.
	kept := mk()
	oldXterm := []byte(`{"module":"xterm","version":"1","resources":[{"id":"tools","type":"process","name":"xterm-tools",` +
		`"artifact":"tools","run":["./xterm-tools"]}],"build":{"artifacts":[{"name":"tools","kind":"bundle","language":"go","system":"arch","from":"cmd/xterm-tools","binary":"xterm-tools"}]}}`)
	kept.manifests["old"] = oldXterm
	oldFP := "src2:" + strings.Repeat("9", 64)
	toolsRef := "artifact-store://xterm/tools/blobs/sha256:" + strings.Repeat("1", 64)
	kept.builds = map[string]*delivery.BuilderBuild{"xterm " + oldFP: {State: delivery.BuildDone, Manifest: "old",
		Artifacts: []delivery.BuiltArtifact{{Name: "tools", Kind: "bundle", Reference: toolsRef, Digest: "sha256:" + strings.Repeat("1", 64)}}}}
	parsedOld, err := catalogue.ParseManifestForInputs(oldXterm)
	if err != nil {
		t.Fatal(err)
	}
	keptBuilt, err := parsedOld.Resolve([]catalogue.Built{{Name: "tools", Kind: "bundle", Reference: toolsRef, Digest: "sha256:" + strings.Repeat("1", 64)}})
	if err != nil {
		t.Fatal(err)
	}
	in, err := Input(ctx, kept, Mesh{}, Scope{Node: "laptop", KeptAt: map[string]string{"xterm": oldFP}})
	if err != nil || !reflect.DeepEqual(in.Nodes[1].Kept, map[string]catalogue.Manifest{"xterm": keptBuilt}) || in.Nodes[0].Kept != nil {
		t.Errorf("the want's build is kept on the composing node alone: %v, %v", in.Nodes, err)
	}

	// Issue 1126, the seed's refusals. restic and the provisioner's client as the catalogue holds them (mesh-catalog
	// c05aa5e6), restic moved with an own secret the vault leaves out (it hands it to the client, mesh-vault ownnode.go
	// handed): composed from the indexer's manifest restic is not handed and stands in for that secret, as novox's,
	// ace's, g14's and shanks's answers refused; composed from its build, it is handed, its templates archive read
	// where the node reaches the artifact store, and the composition is the one the controller's take-in gives.
	resticRaw, err := os.ReadFile("testdata/catalogue-c05aa5e6-restic.module.json")
	if err != nil {
		t.Fatal(err)
	}
	clientRaw, err := os.ReadFile("testdata/catalogue-c05aa5e6-mesh-provisioner-client.module.json")
	if err != nil {
		t.Fatal(err)
	}
	store := []byte(`{"module":"store","version":"1","provides":[{"name":"artifact-store","scope":"mesh"}],` +
		`"serves":{"artifact-store":{"port":5000}}}`)
	texts := map[string]string{}
	var packed bytes.Buffer
	zw := gzip.NewWriter(&packed)
	tw := tar.NewWriter(zw)
	for _, f := range []string{"backups.conf", "data.conf", "retention.conf"} {
		text, err := os.ReadFile("testdata/catalogue-c05aa5e6-restic.files/" + f)
		if err != nil {
			t.Fatal(err)
		}
		texts[f] = string(text)
		if err := tw.WriteHeader(&tar.Header{Name: "./" + f, Mode: 0o644, Size: int64(len(text)), Typeflag: tar.TypeReg}); err != nil {
			t.Fatal(err)
		}
		if _, err := tw.Write(text); err != nil {
			t.Fatal(err)
		}
	}
	if err := tw.Close(); err != nil {
		t.Fatal(err)
	}
	if err := zw.Close(); err != nil {
		t.Fatal(err)
	}
	archiveDigest := delivery.ManifestDigest(packed.Bytes())
	digestOf := func(c string) string { return "sha256:" + strings.Repeat(c, 64) }
	movedFps := map[string]string{"restic": "src2:" + strings.Repeat("3", 64), "mesh-provisioner-client": "src2:" + strings.Repeat("4", 64),
		"store": "src2:" + strings.Repeat("5", 64)}
	resticArtifacts := []delivery.BuiltArtifact{{Name: "tools", Kind: "bundle", Reference: "artifact-store://restic/tools/blobs/" + digestOf("6"), Digest: digestOf("6")},
		{Name: "files", Kind: "archive", Reference: "artifact-store://restic/files/blobs/" + archiveDigest, Digest: archiveDigest}}
	clientArtifacts := []delivery.BuiltArtifact{{Name: "client", Kind: "bundle", Reference: "artifact-store://mesh-provisioner-client/client/blobs/" + digestOf("7"), Digest: digestOf("7")}}
	movedMesh := func(built bool) *bus {
		b := one()
		p := b.placements["n1"]
		p.Modules = []delivery.PlacedModule{{Module: "store"}, {Module: "mesh-provisioner-client"}, {Module: "restic"}}
		p.Decided.Account, p.Decided.AccountHome = "operator", "/home/operator"
		b.placements["n1"] = p
		rec := b.records["n1"]
		rec.Contract, rec.Capabilities = compose.HandedContract, []string{"systemd", "package-manager"}
		b.records["n1"] = rec
		b.modules = map[string]delivery.Module{}
		b.manifests = map[string][]byte{}
		for module, raw := range map[string][]byte{"restic": resticRaw, "mesh-provisioner-client": clientRaw, "store": store} {
			b.modules[module] = delivery.Module{FP2: movedFps[module], Manifest: delivery.ManifestDigest(raw)}
			b.manifests[delivery.ManifestDigest(raw)] = raw
		}
		// The vault's own answer: the client's own secret; restic's is the client's to ask, so own leaves it out.
		b.own = []compose.OwnSecretRow{{Node: "n1", Module: "mesh-provisioner-client", Name: "provisioner-broker", Origin: "made", SealedTo: "sk", Sealed: `"box"`}}
		if built {
			b.builds = map[string]*delivery.BuilderBuild{
				"restic " + movedFps["restic"]:                                   {State: delivery.BuildDone, Manifest: delivery.ManifestDigest(resticRaw), Artifacts: resticArtifacts},
				"mesh-provisioner-client " + movedFps["mesh-provisioner-client"]: {State: delivery.BuildDone, Manifest: delivery.ManifestDigest(clientRaw), Artifacts: clientArtifacts},
				"store " + movedFps["store"]:                                     {State: delivery.BuildDone, Manifest: delivery.ManifestDigest(store)},
			}
			b.archives = map[string][]byte{archiveDigest: packed.Bytes()}
		}
		return b
	}
	if out, _, held, err := Compose(ctx, movedMesh(false), Mesh{}, Scope{Node: "n1"}, movedFps); err != nil || !strings.Contains(held["restic"], `restic needs a secret called "repository"`) {
		t.Errorf("restic composed from the indexer's manifest: %v %v, want its own secret refusing restic alone", err, held)
	} else {
		for key, c := range out {
			if c.Module == "restic" {
				// Its stub's composition, applied, would remove what restic runs: a held module keeps its last one.
				t.Errorf("held restic is composed as %s, want none of its own composition handed", key)
			}
		}
	}
	builtBus := movedMesh(true)
	fromBuild, _, held, err := Compose(ctx, builtBus, Mesh{}, Scope{Node: "n1"}, movedFps)
	if err == nil && len(held) > 0 {
		err = fmt.Errorf("modules held: %v", held)
	}
	if err != nil {
		t.Fatalf("restic composed from its build: %v", err)
	}
	if !reflect.DeepEqual(builtBus.fetched, []string{"http://127.0.0.1:5000/v2/restic/files/blobs/" + archiveDigest}) {
		t.Errorf("the templates archive was read at %v", builtBus.fetched)
	}
	resticKey, _ := delivery.ComposedKey("n1", "restic", movedFps["restic"])
	if c := fromBuild[resticKey]; len(c.Filled) != 4 { // its three templated files and its own secret
		t.Errorf("restic is not handed to the provisioner: its filled files are %v", c.Filled)
	}
	// A done key an artifact of which names no reference is waited for, in the controller's words (ADR 0498 §8).
	unreferenced := movedMesh(true)
	unreferenced.builds["restic "+movedFps["restic"]].Artifacts = []delivery.BuiltArtifact{{Name: "tools", Kind: "bundle", Digest: digestOf("6")}, resticArtifacts[1]}
	if _, _, held, err := Compose(ctx, unreferenced, Mesh{}, Scope{Node: "n1"}, movedFps); err != nil || !strings.Contains(held["restic"], "the build of restic is done and waits for the reference of tools") {
		t.Errorf("a done key with an unreferenced artifact: %v %v, want restic held alone", err, held)
	}
	// A module the node runs inside its own composition (the fold) composes from the indexer's manifest though a done
	// build of it is at the trunk's FP2: its build is not read.
	folding := movedMesh(true)
	foldIn, err := Input(ctx, folding, Mesh{}, Scope{Node: "n1", InOwn: []string{"mesh-provisioner-client"}})
	if err != nil {
		t.Fatal(err)
	}
	clientParsed, err := catalogue.ParseManifestForInputs(clientRaw)
	if err != nil {
		t.Fatal(err)
	}
	if slices.Contains(folding.buildsRead, "mesh-provisioner-client") || !reflect.DeepEqual(foldIn.Catalogue["mesh-provisioner-client"], clientParsed) {
		t.Errorf("a folded module was taken from its build: builds read %v", folding.buildsRead)
	}
	// The controller's: its take-in resolves each manifest with the key's artifacts and the archive's texts, and composes
	// from those over the same input.
	storeIn, err := Input(ctx, movedMesh(false), Mesh{}, Scope{Node: "n1"})
	if err != nil {
		t.Fatal(err)
	}
	for module, built := range map[string][]catalogue.Built{
		"restic": {{Name: "tools", Kind: "bundle", Reference: resticArtifacts[0].Reference, Digest: digestOf("6")},
			{Name: "files", Kind: "archive", Reference: resticArtifacts[1].Reference, Digest: archiveDigest, Texts: texts}},
		"mesh-provisioner-client": {{Name: "client", Kind: "bundle", Reference: clientArtifacts[0].Reference, Digest: digestOf("7")}},
	} {
		resolved, err := storeIn.Catalogue[module].Resolve(built)
		if err != nil {
			t.Fatal(err)
		}
		// Kept as its bytes and read again, as the controller's store holds a build's manifest.
		raw, _ := json.Marshal(resolved)
		if storeIn.Catalogue[module], err = catalogue.ParseManifestForInputs(raw); err != nil {
			t.Fatal(err)
		}
	}
	storeIn.OwnSecrets = movedMesh(true).own
	fromStoreMoved, _, err := compose.Compositions(storeIn, "n1", movedFps, compose.Reading)
	if err != nil {
		t.Fatal(err)
	}
	if !reflect.DeepEqual(fromBuild, fromStoreMoved) {
		gj, _ := json.MarshalIndent(fromBuild, "", " ")
		wj, _ := json.MarshalIndent(fromStoreMoved, "", " ")
		t.Errorf("composed from the build differs from the controller's take-in:\n got %s\nwant %s", gj, wj)
	}
	// ADR 0570 clause 2 (issue 1954 L6-P1): the seat mesh-provisioner's plans, composed from the bus alone and with no
	// secret read (the Planning mode), are the controller's handedPlans over its own input, which holds its secrets
	// (compose_sdk.go: Resolve, Render in Foreseeing, Generators, Plan.Compose), and restic, handed, has one.
	noSecrets := movedMesh(true)
	noSecrets.own = nil
	seat, err := Plans(ctx, noSecrets, Mesh{}, Scope{Node: "n1"})
	if err != nil {
		t.Fatalf("the plans from the bus: %v", err)
	}
	controllers, err := plansIn(storeIn, "n1", compose.Foreseeing)
	if err != nil {
		t.Fatal(err)
	}
	if _, handed := seat["restic"]; !handed || !reflect.DeepEqual(seat, controllers) {
		gj, _ := json.MarshalIndent(seat, "", " ")
		wj, _ := json.MarshalIndent(controllers, "", " ")
		t.Errorf("the seat's plans differ from the controller's:\n got %s\nwant %s", gj, wj)
	}
	// ADR 0571 clause 3: the data items of n1's modules, placed, from the bus alone: what disk-load measures.
	items, unplaced, err := DataItems(ctx, noSecrets, Mesh{}, Scope{Node: "n1"})
	if err != nil || len(unplaced) > 0 || len(items) == 0 {
		t.Errorf("the data items from the bus are %v, unplaced %v: %v", items, unplaced, err)
	}
	for module, its := range items {
		for _, it := range its {
			if it.Module != module || !strings.HasPrefix(it.Path, "/") || it.Measure == "" {
				t.Errorf("%s's item %+v is not placed", module, it)
			}
		}
	}
	// And the same through StatesReader, over the fake's states as a module's runtime gives them (one reader for
	// mesh-provisioner and disk-load, the lead 2026-10-29).
	viaStates, _, err := DataItems(ctx, StatesReader(statesOf(t, ctx, noSecrets), func(_ context.Context, url string) ([]byte, error) {
		for _, body := range noSecrets.archives {
			return body, nil
		}
		return nil, errors.New("no archive")
	}), Mesh{}, Scope{Node: "n1"})
	if err != nil || !reflect.DeepEqual(viaStates, items) {
		t.Errorf("through the states the data items are %v, %v; through the reader %v", viaStates, err, items)
	}

	// And what a provider on another node serves from its settings (mailu's smtp domain, issue 1126: shanks refused
	// '${setting:domain} ... nothing sets "domain"'): read for that provider's served keys alone, through Served.
	mailer := []byte(`{"module":"mailer","version":"1","config":{"domain":{"type":"string","description":"the mail domain","required":true}},` +
		`"provides":[{"name":"smtp","scope":"mesh"}],"serves":{"smtp":{"port":587,"domain":"${config:domain}"}}}`)
	withMailer := func(set bool) *bus {
		b := mk()
		p := b.placements["anchor"]
		p.Modules = append(p.Modules, delivery.PlacedModule{Module: "mailer"})
		b.placements["anchor"] = p
		b.modules["mailer"] = delivery.Module{Manifest: delivery.ManifestDigest(mailer)}
		b.manifests[delivery.ManifestDigest(mailer)] = mailer
		if set {
			b.served = map[string]map[string]any{"anchor.mailer": {"domain": "example.org"}}
		}
		return b
	}
	if _, _, _, err := Compose(ctx, withMailer(false), Mesh{}, Scope{Node: "laptop"}, fps); err == nil || !strings.Contains(err.Error(), `nothing sets "domain"`) {
		t.Errorf("a provider's served setting nobody sets: %v", err)
	}
	served := withMailer(true)
	if _, _, held, err := Compose(ctx, served, Mesh{}, Scope{Node: "laptop"}, fps); err != nil || len(held) > 0 {
		t.Errorf("laptop with what anchor's mailer serves: %v %v", err, held)
	}
	if !reflect.DeepEqual(served.servedRead, []string{"anchor.mailer:domain"}) || slices.Contains(served.valuesRead, "anchor.mailer") {
		t.Errorf("laptop read %v of other nodes (and %v of config values): the served keys of anchor's mailer alone", served.servedRead, served.valuesRead)
	}

	for name, c := range map[string]struct {
		change func(*bus)
		scope  Scope
		says   string
	}{
		"no record":          {func(b *bus) { delete(b.records, "laptop") }, Scope{Node: "anchor"}, "laptop, whose agent has written no record"},
		"no placement":       {func(b *bus) {}, Scope{Node: "stranger"}, "stranger has no placement"},
		"a manifest unread":  {func(b *bus) { delete(b.manifests, digest) }, Scope{Node: "laptop"}, "the manifest of xterm"},
		"a kept one unbuilt": {func(b *bus) {}, Scope{Node: "laptop", KeptAt: map[string]string{"xterm": "src2:gone"}}, "holds no done build"},
	} {
		b := mk()
		c.change(b)
		if _, err := Input(ctx, b, Mesh{}, c.scope); err == nil || !strings.Contains(err.Error(), c.says) {
			t.Errorf("%s: %v, want it to say %q", name, err, c.says)
		}
	}
}

// mapStates are read states by name, key to value, as a module's runtime gives them.
type mapStates map[string]map[string][]byte

func (m mapStates) Get(state, key string) ([]byte, bool, error) {
	v, ok := m[state][key]
	return v, ok, nil
}

func (m mapStates) Keys(state string) ([]string, error) {
	var out []string
	for k := range m[state] {
		out = append(out, k)
	}
	sort.Strings(out)
	return out, nil
}

// statesOf is b laid out as the states StatesReader reads.
func statesOf(t *testing.T, ctx context.Context, b *bus) mapStates {
	t.Helper()
	out := mapStates{}
	put := func(state, key string, raw []byte, err error) {
		if err != nil {
			t.Fatal(err)
		}
		if out[state] == nil {
			out[state] = map[string][]byte{}
		}
		out[state][key] = raw
	}
	placements, _ := b.Placements(ctx)
	for node, p := range placements {
		k, _ := delivery.PlacementKey(node)
		raw, err := delivery.EncodePlacement(p)
		put(PlacementRead, k, raw, err)
	}
	records, _ := b.Records(ctx)
	for node, r := range records {
		k, _ := delivery.HaveNodeKey(node)
		rec := r
		raw, err := delivery.EncodeHaveNode(delivery.HaveNode{Record: &rec})
		put(HaveRead, k, raw, err)
	}
	modules, _ := b.Modules(ctx)
	for name, m := range modules {
		raw, err := delivery.EncodeModule(m)
		put(ModulesRead, name, raw, err)
		var mf struct{ Module string }
		_ = json.Unmarshal(b.manifests[m.Manifest], &mf)
		k, _ := delivery.ManifestsKey(m.Manifest)
		raw, err = delivery.EncodeManifest(delivery.Manifest{Module: mf.Module, JSON: string(b.manifests[m.Manifest])})
		put(ManifestsRead, k, raw, err)
	}
	for key, build := range b.builds {
		module, fp, _ := strings.Cut(key, " ")
		k, _ := delivery.BuilderBuildKey(module, fp)
		raw, err := delivery.EncodeBuilderBuild(*build)
		put(BuildsRead, k, raw, err)
	}
	for nm, values := range b.values {
		for k, v := range values {
			value, _ := json.Marshal(v)
			raw, err := json.Marshal(map[string]any{"value": json.RawMessage(value), "source": catalogue.SourceModule})
			put(ResolvedRead, nm+"."+k, raw, err)
		}
	}
	return out
}