Merge branch 'feat/47-G-fix11-a2' into feat/47-G-fix11-a3

# Conflicts:
#	node-tools/internal/console/wait_test.go

node-tools/internal/console/wait_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"net/http"
 	"os"
 	"reflect"
@@ -12,25 +13,25 @@ import (
 	"testing"
 	"time"
 
+	"git.novox.be/novox/mesh-delivery/contracts/go/clients/meshcatalogclient"
+	catalogseat "git.novox.be/novox/mesh-delivery/contracts/go/seats/meshcatalog"
+	"github.com/nats-io/nats-server/v2/server"
+	"github.com/nats-io/nats.go"
+
 	"github.com/novox/mesh-tools/node-tools/internal/approval"
 	"github.com/novox/mesh-tools/node-tools/internal/bus"
 	mt "github.com/novox/mesh-tools/node-tools/internal/meshtest"
 )
 
-// waitingRuntime is the tool runner on a machine, issued the families ADR 0367 §5 names, as the controller
-// composes them from its manifest: the surface over its connection, and the mesh to publish on.
+// waitingRuntime is the tool runner on a machine, issued no waits (novox/hq ADR 0670 §2): the surface over its
+// connection, and the mesh to publish on.
 func waitingRuntime(t *testing.T) (*Surface, *mt.Mesh) {
 	t.Helper()
 	mesh := mt.New(t)
-	m := mt.MembershipOf("node-tools", "desk", false, nil)
-	m.Waits = []bus.WaitIssued{
-		{Event: "mesh-knowledge.reviewed", Subject: "mesh.mod.mesh-knowledge.event.reviewed"},
-		{Event: "operator-channel.decided.claude-code", Subject: "mesh.seat.operator-channel.event.decided.claude-code"},
-	}
-	mesh.Issue(t, m)
+	mesh.Issue(t, mt.MembershipOf("node-tools", "desk", false, nil))
 	conn := connect(t, "node-tools", "desk")
 	mt.Until(t, func() error {
-		if got := conn.Membership("node-tools"); got == nil || len(got.Waits) == 0 {
+		if conn.Membership("node-tools") == nil {
 			return os.ErrNotExist
 		}
 		return nil
@@ -38,6 +39,25 @@ func waitingRuntime(t *testing.T) (*Surface, *mt.Mesh) {
 	return NewSurface(conn, busSource{conn}, "desk.node-tools"), mesh
 }
 
+// halfSource is a Source that also holds a catalog half, as the tool runner's first views do.
+type halfSource struct {
+	Source
+	halves map[string]meshcatalogclient.Half
+}
+
+func (h halfSource) Halves() (map[string]meshcatalogclient.Half, error) { return h.halves, nil }
+
+// listening waits until the surface's connection holds n more subscriptions than before: a wait has subscribed.
+func listening(t *testing.T, s *Surface, before, n int) {
+	t.Helper()
+	mt.Until(t, func() error {
+		if s.conn.Subscriptions() < before+n {
+			return os.ErrNotExist
+		}
+		return nil
+	})
+}
+
 // callWait is one tools/call of mesh_wait, answered as an agent host reads it.
 func callWait(s *Surface, args map[string]any) (text string, isError bool) {
 	raw, _ := json.Marshal(map[string]any{"name": verbWait, "arguments": args})
@@ -52,8 +72,9 @@ func callWait(s *Surface, args map[string]any) (text string, isError bool) {
 	return strings.Join(parts, "\n"), isErr
 }
 
-// novox/hq ADR 0367 §1: mesh_wait answers the first event that matches — by its family and its filter — with
-// its subject, body and time, within a second of its publication, and ignores the others.
+// novox/hq ADR 0367 §1, ADR 0670 §1 (design 34 every-event §13, §15, §19): mesh_wait answers the first event that
+// matches — by its name and its filter — with no membership naming it: its whole name, the namespace it arrived on, its
+// body, when it arrived and when it was published, within a second of its publication, and ignores the others.
 func TestMeshWaitAnswersTheFirstMatchingEvent(t *testing.T) {
 	s, mesh := waitingRuntime(t)
 	type answer struct {
@@ -61,18 +82,39 @@ func TestMeshWaitAnswersTheFirstMatchingEvent(t *testing.T) {
 		isErr bool
 		at    time.Time
 	}
+	type heardAnswer struct {
+		Heard struct {
+			Subject   string         `json:"subject"`
+			From      string         `json:"from"`
+			Body      map[string]any `json:"body"`
+			At        time.Time      `json:"at"`
+			Published *string        `json:"published"`
+		} `json:"heard"`
+		Read string `json:"read"`
+	}
+	nc, err := nats.Connect(mt.URL(t))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(nc.Close)
 	done := make(chan answer, 1)
+	before := s.conn.Subscriptions()
 	go func() {
-		text, isErr := callWait(s, map[string]any{"subjects": []any{"mesh-knowledge.reviewed"},
-			"filter": map[string]any{"kind": "decision", "number": 367}, "timeout": 20})
+		text, isErr := callWait(s, map[string]any{"subjects": []any{"mesh-delivery-view.delivered"},
+			"filter": map[string]any{"module": "netcheck"}, "timeout": 20})
 		done <- answer{text, isErr, time.Now()}
 	}()
-	// Once it listens: another record's verdict, another family's event, then the one it waits for.
-	time.Sleep(300 * time.Millisecond)
-	mesh.Emit(t, "mesh.mod.mesh-knowledge.event.reviewed", map[string]any{"kind": "decision", "number": 366, "what": "approved"})
-	mesh.Emit(t, "mesh.mod.mesh-knowledge.event.proposed", map[string]any{"kind": "decision", "number": 367})
+	// Once it listens: another module's delivery, another event, then the one it waits for, with its own time.
+	listening(t, s, before, 6)
+	mesh.Emit(t, "mesh.mod.mesh-delivery-view.event.delivered", map[string]any{"module": "grafana"})
+	mesh.Emit(t, "mesh.mod.mesh-delivery-view.event.planned", map[string]any{"module": "netcheck"})
+	msg := nats.NewMsg("mesh.mod.mesh-delivery-view.event.delivered")
+	msg.Header.Set("x-time", "2026-11-12T03:00:00.5Z")
+	msg.Data = []byte(`{"module":"netcheck"}`)
 	published := time.Now()
-	mesh.Emit(t, "mesh.mod.mesh-knowledge.event.reviewed", map[string]any{"kind": "decision", "number": 367, "what": "approved"})
+	if err := nc.PublishMsg(msg); err != nil {
+		t.Fatal(err)
+	}
 	var got answer
 	select {
 	case got = <-done:
@@ -85,32 +127,32 @@ func TestMeshWaitAnswersTheFirstMatchingEvent(t *testing.T) {
 	if got.at.Sub(published) > time.Second {
 		t.Errorf("answered %s after the event was published, want within a second", got.at.Sub(published))
 	}
-	var heard struct {
-		Heard struct {
-			Subject string         `json:"subject"`
-			Body    map[string]any `json:"body"`
-			At      time.Time      `json:"at"`
-		} `json:"heard"`
-	}
+	var heard heardAnswer
 	if err := json.Unmarshal([]byte(got.text), &heard); err != nil {
 		t.Fatalf("not an answer: %s", got.text)
 	}
-	if heard.Heard.Subject != "mesh-knowledge.reviewed" || heard.Heard.Body["number"] != float64(367) || heard.Heard.At.IsZero() {
-		t.Errorf("answered %+v, want record 367's verdict with its time", heard.Heard)
+	if h := heard.Heard; h.Subject != "mesh-delivery-view.delivered" || h.From != "module" || h.Body["module"] != "netcheck" ||
+		h.At.IsZero() || h.Published == nil || *h.Published != "2026-11-12T03:00:00.5Z" || !strings.Contains(heard.Read, "only wakes you") {
+		t.Errorf("answered %s, want netcheck's delivery from a module with its times", got.text)
 	}
-	// And the subject it is granted on the asker's own `decided`, by the name a session asks for.
+	// And a seat's `decided` of one asker, heard by `operator-channel.decided`: its whole name, from the seat, with no
+	// time of its own, and the answer read only with claude_code_answer.
+	before = s.conn.Subscriptions()
 	go func() {
-		text, isErr := callWait(s, map[string]any{"subjects": "operator-channel.decided.claude-code", "timeout": 20})
+		text, isErr := callWait(s, map[string]any{"subjects": "operator-channel.decided", "timeout": 20})
 		done <- answer{text, isErr, time.Now()}
 	}()
-	time.Sleep(300 * time.Millisecond)
+	listening(t, s, before, 6)
 	// A seat's event, said by the router on core NATS here: no stream of the test's bus carries the seat.
 	if err := connect(t, "messenger", "").Say("mesh.seat.operator-channel.event.decided.claude-code", []byte(`{"ask":"a1"}`)); err != nil {
 		t.Fatal(err)
 	}
 	select {
 	case got = <-done:
-		if got.isErr || !strings.Contains(got.text, `"subject": "operator-channel.decided.claude-code"`) {
+		heard = heardAnswer{}
+		_ = json.Unmarshal([]byte(got.text), &heard)
+		if h := heard.Heard; got.isErr || h.Subject != "operator-channel.decided.claude-code" || h.From != "seat" ||
+			h.Published != nil || !strings.Contains(heard.Read, "claude_code_answer") {
 			t.Errorf("the asker's decided: %s", got.text)
 		}
 	case <-time.After(10 * time.Second):
@@ -127,7 +169,8 @@ func TestMeshWaitSaysItTimedOutAndKeepsNothing(t *testing.T) {
 	if took := time.Since(start); took < time.Second || took > 3*time.Second {
 		t.Errorf("a one-second wait took %s", took)
 	}
-	if isErr || !strings.Contains(text, `"timed-out": true`) {
+	// Before the catalog half is read, names are not checked, and the answer says so (design 34 every-event §14).
+	if isErr || !strings.Contains(text, `"timed-out": true`) || !strings.Contains(text, `"unchecked"`) {
 		t.Errorf("a wait that heard nothing: %s", text)
 	}
 	if after := s.conn.Subscriptions(); after != before {
@@ -150,38 +193,86 @@ func TestMeshWaitsTimeoutIsBounded(t *testing.T) {
 	}
 }
 
-// novox/hq ADR 0367 §2 and §6: an event outside the granted families is refused, naming the families and how
-// one is added; no argument — a wildcard, another asker's `decided`, a subject spelled out — widens it.
-func TestMeshWaitRefusesAnEventOutsideTheGrantedFamilies(t *testing.T) {
+// novox/hq ADR 0670 §1, §2 (design 34 every-event §13, §16, §19): mesh_wait refuses loudly and never loops: a name with
+// a wildcard, of one token, more than 16 names, none, or a from of another word is refused at once naming the rule; a
+// wait whose every subscription the bus refuses answers after its timeout, in words naming no wait grant.
+func TestMeshWaitRefusesLoudlyAndNeverLoops(t *testing.T) {
 	s, _ := waitingRuntime(t)
-	for _, subjects := range []any{
-		[]any{"mesh-knowledge.proposed"},
-		[]any{"mesh-knowledge.reviewed", "gitea.forge.push"},
-		[]any{"mesh-knowledge.*"},
-		[]any{"operator-channel.decided.shop"},
-		[]any{"operator-channel.decided.*"},
-		[]any{"mesh.mod.mesh-knowledge.event.reviewed"},
-		[]any{">"},
-		[]any{},
+	var seventeen []any
+	for i := 0; i < 17; i++ {
+		seventeen = append(seventeen, fmt.Sprintf("mesh-knowledge.reviewed%d", i))
+	}
+	for _, c := range []struct {
+		args map[string]any
+		says string
+	}{
+		{map[string]any{"subjects": []any{"mesh-knowledge.*"}}, "[A-Za-z0-9_-]+"},
+		{map[string]any{"subjects": []any{"operator-channel.decided.>"}}, "[A-Za-z0-9_-]+"},
+		{map[string]any{"subjects": []any{"mesh-knowledge"}}, "fewer than two tokens"},
+		{map[string]any{"subjects": seventeen}, "at most 16"},
+		{map[string]any{"subjects": []any{}}, "at least one event"},
+		{map[string]any{"subjects": []any{"mesh-knowledge.reviewed"}, "from": "bench"}, "seat, module or stream"},
 	} {
-		text, isErr := callWait(s, map[string]any{"subjects": subjects, "timeout": 1})
-		if !isErr {
-			t.Errorf("%v was waited on: %s", subjects, text)
-			continue
+		c.args["timeout"] = 1
+		start := time.Now()
+		text, isErr := callWait(s, c.args)
+		if !isErr || !strings.Contains(text, c.says) || strings.Contains(text, "manifest") {
+			t.Errorf("%v: %s, want refused saying %q", c.args, text, c.says)
 		}
-		if len(subjects.([]any)) > 0 && (!strings.Contains(text, "mesh-knowledge.reviewed") || !strings.Contains(text, "manifest")) {
-			t.Errorf("%v refused without naming the families and how one is added: %s", subjects, text)
+		if took := time.Since(start); took > 500*time.Millisecond {
+			t.Errorf("%v was refused after %s, want at once", c.args, took)
 		}
 	}
-}
 
-// A tool runner issued no families waits on nothing, and says so.
-func TestMeshWaitWithNoFamiliesIssuedWaitsOnNothing(t *testing.T) {
-	mt.New(t)
-	s := NewSurface(connect(t, "node-tools", "desk"), nil, "desk.node-tools")
-	text, isErr := callWait(s, map[string]any{"subjects": []any{"mesh-knowledge.reviewed"}, "timeout": 1})
-	if !isErr || !strings.Contains(text, "no event families") {
-		t.Errorf("a runtime issued no families: %s", text)
+	// E §14: against the catalog half, a misspelt emitter is refused naming the half and its revision, a known emitter's
+	// undeclared event is waited on and its timeout says so, and a declared one says nothing of it.
+	half := NewSurface(s.conn, halfSource{busSource{s.conn}, map[string]meshcatalogclient.Half{"main": {
+		Revision: catalogseat.CatalogRevision{Revision: 7, Definitions: []catalogseat.CatalogRevisionDefinitionsItem{{Seat: "mesh-catalog"}}},
+		Entries: map[string]catalogseat.CatalogEntry{"mesh-delivery-view": {Module: "mesh-delivery-view",
+			Manifest: map[string]any{"emits": []any{"delivered"}}}},
+	}}}, "desk.node-tools")
+	for _, c := range []struct {
+		name, says string
+		refused    bool
+	}{
+		{"mesh-delivry-view.delivered", "mesh-delivry-view is neither a seat nor a module of the catalog half (mesh-catalog.revision, revision 7 of main)", true},
+		{"mesh-delivery-view.planned", "no declaration names mesh-delivery-view.planned", false},
+		{"mesh-catalog.catalog-revision", "", false},
+	} {
+		text, isErr := callWait(half, map[string]any{"subjects": []any{c.name}, "timeout": 1})
+		if isErr != c.refused || c.says != "" && !strings.Contains(text, c.says) ||
+			c.says == "" && (strings.Contains(text, "undeclared") || strings.Contains(text, "unchecked")) {
+			t.Errorf("%s against the catalog half: %s", c.name, text)
+		}
+	}
+
+	// The bus refusing every subscription of the call: answered after the timeout, in §16's words.
+	b, err := server.NewServer(&server.Options{Host: "127.0.0.1", Port: server.RANDOM_PORT, NoLog: true, NoSigs: true,
+		Users: []*server.User{{Username: "desk.node-tools", Password: "pw", Permissions: &server.Permissions{
+			Subscribe: &server.SubjectPermission{Allow: []string{"_INBOX.desk.node-tools.>", "mesh.assignment.desk.*"}},
+		}}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	go b.Start()
+	if !b.ReadyForConnections(10 * time.Second) {
+		t.Fatal("the bus did not come up")
+	}
+	t.Cleanup(b.Shutdown)
+	conn, err := bus.Connect(bus.Credential{URL: b.ClientURL(), Module: "node-tools", Node: "desk", User: "desk.node-tools", Password: "pw"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	conn.Logf = func(string, ...any) {}
+	t.Cleanup(conn.Close)
+	start := time.Now()
+	text, isErr := callWait(NewSurface(conn, nil, "desk.node-tools"), map[string]any{"subjects": []any{"mesh-delivery-view.delivered"}, "timeout": 1})
+	if took := time.Since(start); took < time.Second || took > 3*time.Second {
+		t.Errorf("a wait the bus refused whole answered after %s, want its timeout of 1s", took)
+	}
+	if !isErr || !strings.Contains(text, "the bus refused this account a subscription on mesh.seat.mesh-delivery-view.event.delivered") ||
+		!strings.Contains(text, "novox/hq ADR 0670 §1") || strings.Contains(text, "wait grant") || strings.Contains(text, "0367 §2") {
+		t.Errorf("a wait the bus refused whole: %s", text)
 	}
 }