Read memberships from the grants part's state, what the mesh holds from the indexer and placement, and give bundles newest, since and watch on logs, so the tool runner asks the controller for nothing it keeps (issue 1955, ADR 0571 clauses 1, 4, 5, 7)

Pins mesh-sdk bb993dd. The assignments stream stays the membership's
fallback until the lease write; a log another module keeps is read as
<module>.<log>.

node-tools/internal/console/address.go

@@ -131,7 +131,7 @@ type index struct {
 	NotAnswering []string
 	Listing      *Listing // the flat catalogue the call path resolves subjects with
 	Discovery    announce.Discovery
-	// Recorded is where the controller's records place each module that declares tools.
+	// Recorded is where placement places each module that declares tools.
 	Recorded map[string][]string
 	// Unheard is every runtime whose answer this index lacks: it said it was there and did not say
 	// what it serves in time, or it answered before and not now. An address it might answer is never
@@ -231,42 +231,8 @@ func findTool(tools []Tool, name string) *Tool {
 	return nil
 }
 
-// controllerOutput is a controller seat verb's answer: the command's printed output.
-func controllerOutput(conn *bus.Conn, verb string) (string, error) {
-	got, err := conn.Ask("seat:mesh-controller."+verb, map[string]any{}, "")
-	if err != nil {
-		return "", err
-	}
-	var r struct {
-		Output string `json:"output"`
-		OK     *bool  `json:"ok"`
-	}
-	if json.Unmarshal(got.Result, &r) != nil {
-		return "", fmt.Errorf("mesh-controller.%s answered something that is not its output", verb)
-	}
-	if r.OK != nil && !*r.OK {
-		return "", fmt.Errorf("mesh-controller.%s: %s", verb, strings.TrimSpace(r.Output))
-	}
-	return r.Output, nil
-}
-
-// jsonIn is the JSON document a command printed, after any lines it said first: a seat verb runs
-// the controller's command, and a command may warn before it answers.
-func jsonIn(output string) string {
-	t := strings.TrimSpace(output)
-	if strings.HasPrefix(t, "{") || strings.HasPrefix(t, "[") {
-		return t
-	}
-	for _, open := range []string{"\n{", "\n["} {
-		if i := strings.Index(output, open); i >= 0 {
-			return strings.TrimSpace(output[i+1:])
-		}
-	}
-	return ""
-}
-
-// recordedModule is a module as the controller's records hold it (`module list --json`): where the
-// mesh assigned it, and whether it declares tools — what should announce itself, and where.
+// recordedModule is a module as the bus holds it: where the placement seat places it, and whether its manifest declares
+// tools — what should announce itself, and where (novox/hq ADR 0571).
 type recordedModule struct {
 	Module string   `json:"module"`
 	On     []string `json:"on"`
@@ -275,11 +241,6 @@ type recordedModule struct {
 	Replaces map[string][]string `json:"replaces,omitempty"`
 }
 
-// recordedMachine is a machine as the controller's records hold it (`node list --json`).
-type recordedMachine struct {
-	Name string `json:"name"`
-}
-
 // indexOn asks the mesh what it holds (novox/hq ADR 0197): what answers, from every runtime's own
 // announcement on the bus — one `$SRV.INFO` request — and what should, from the controller's records
 // read as JSON. Nothing is inferred from a roster and nothing is parsed from print.
@@ -289,12 +250,15 @@ type recordedMachine struct {
 // index holds instead, marked with its age (novox/hq issue 554).
 func indexOn(conn *bus.Conn, held announce.Known, before func(announce.Discovery) []earlier) (*index, error) {
 	var wg sync.WaitGroup
-	var nodesOut, modulesOut string
 	var placed map[string][]byte
 	var placedErr error
-	wg.Add(3)
-	go func() { defer wg.Done(); nodesOut, _ = controllerOutput(conn, "nodes") }()
-	go func() { defer wg.Done(); modulesOut, _ = controllerOutput(conn, "modules") }()
+	var recorded []recordedModule
+	var known []string
+	var recordsWhy []string
+	wg.Add(2)
+	// Which modules there are and where they are placed, and which machines the mesh has, from the bus (ADR 0571
+	// clauses 4 and 5): the indexer's modules and manifests and the placement seat's placements, never the controller.
+	go func() { defer wg.Done(); recorded, known, recordsWhy = recordsOn(conn) }()
 	// Who holds which seat on which node, from placement (ADR 0571 clause 4): no call of the controller.
 	go func() { defer wg.Done(); placed, placedErr = seatHoldersOn(conn) }()
 	d, err := announce.Gather(conn, held)
@@ -346,26 +310,21 @@ func indexOn(conn *bus.Conn, held announce.Known, before func(announce.Discovery
 
 	// What should have answered: every assignment of a module that declares tools. Silence is named;
 	// a module with no tools is never a name here.
-	var recorded []recordedModule
-	recordedOK := json.Unmarshal([]byte(jsonIn(modulesOut)), &recorded) == nil
 	x.Replaces = replacesOf(catalogue.DefaultSeats(), recorded)
-	if recordedOK {
-		for _, m := range recorded {
-			if !m.Tools {
-				continue
-			}
-			x.Recorded[m.Module] = append([]string{}, m.On...)
-			for _, n := range m.On {
-				// A holder of a seat held once for the mesh announces no machine — the seat is the mesh's,
-				// not a machine's — so what it announced without one answers for wherever it is assigned.
-				if !announced[m.Module][n] && !announced[m.Module][""] {
-					l.NotAnswering = append(l.NotAnswering, m.Module+" on "+n)
-				}
+	for _, m := range recorded {
+		if !m.Tools {
+			continue
+		}
+		x.Recorded[m.Module] = append([]string{}, m.On...)
+		for _, n := range m.On {
+			// A holder of a seat held once for the mesh announces no machine — the seat is the mesh's,
+			// not a machine's — so what it announced without one answers for wherever it is assigned.
+			if !announced[m.Module][n] && !announced[m.Module][""] {
+				l.NotAnswering = append(l.NotAnswering, m.Module+" on "+n)
 			}
 		}
-	} else {
-		l.NotAnswering = append(l.NotAnswering, "mesh-controller (its records of the modules did not answer, so what is missing cannot be said)")
 	}
+	l.NotAnswering = append(l.NotAnswering, recordsWhy...)
 	if x.PlacedWhy != "" {
 		l.NotAnswering = append(l.NotAnswering, delivery.SeatHoldersRead+" (who holds which seat by placement could not be read: "+
 			x.PlacedWhy+")")
@@ -376,13 +335,8 @@ func indexOn(conn *bus.Conn, held announce.Known, before func(announce.Discovery
 	sort.Strings(l.NotAnswering)
 	x.NotAnswering = l.NotAnswering
 
-	var known []recordedMachine
-	if json.Unmarshal([]byte(jsonIn(nodesOut)), &known) == nil {
-		for _, n := range known {
-			if n.Name != "" {
-				machines[n.Name] = true
-			}
-		}
+	for _, n := range known {
+		machines[n] = true
 	}
 	for n := range machines {
 		x.Machines = append(x.Machines, n)
@@ -391,12 +345,11 @@ func indexOn(conn *bus.Conn, held announce.Known, before func(announce.Discovery
 	return x, nil
 }
 
-// seatHoldersOn reads the state seat-holders whole (novox/hq ADR 0571 clause 4): its current values, through the
-// runtime's own membership, which reads it as delivery.SeatHoldersRead.
-func seatHoldersOn(conn *bus.Conn) (map[string][]byte, error) {
+// stateOn reads a state the runtime's membership reads, whole: its current values by key, a deleted key absent.
+func stateOn(conn *bus.Conn, name string) (map[string][]byte, error) {
 	var mu sync.Mutex
 	keys := map[string][]byte{}
-	stop, err := conn.StateWatch(conn.Credential().Module, delivery.SeatHoldersRead, "", func(c bus.StateChange) error {
+	stop, err := conn.StateWatch(conn.Credential().Module, name, "", func(c bus.StateChange) error {
 		if c.Current && c.Op == "put" {
 			mu.Lock()
 			keys[c.Key] = c.Value
@@ -413,6 +366,96 @@ func seatHoldersOn(conn *bus.Conn) (map[string][]byte, error) {
 	return keys, nil
 }
 
+// seatHoldersOn reads the state seat-holders whole (novox/hq ADR 0571 clause 4), as delivery.SeatHoldersRead.
+func seatHoldersOn(conn *bus.Conn) (map[string][]byte, error) {
+	return stateOn(conn, delivery.SeatHoldersRead)
+}
+
+// The indexer's states the console reads (novox/hq ADR 0571 clauses 4 and 5): every module, and each manifest by its
+// digest, by the names a reader's manifest declares.
+var (
+	modulesRead   = delivery.IndexerModule + ".modules"
+	manifestsRead = delivery.IndexerModule + ".manifests"
+)
+
+// manifestFacts is what the console takes of a manifest: the tools it declares and what each replaces. A manifest's
+// digest never names another, so what is read once is kept.
+type manifestFacts struct {
+	Tools    []string            `json:"tools"`
+	Replaces map[string][]string `json:"replaces"`
+}
+
+var manifestsKept sync.Map // digest → manifestFacts
+
+// recordsOn is every module the indexer holds, with where the placement seat places it and whether it declares tools,
+// and every machine placement names (delivery.ModuleNames, delivery.MachineNames). What cannot be read is said, one line
+// per state, for the listing's not answering.
+func recordsOn(conn *bus.Conn) (recorded []recordedModule, machines []string, why []string) {
+	placements, err := stateOn(conn, delivery.PlacementRead)
+	if err != nil {
+		why = append(why, delivery.PlacementRead+" (where modules are placed could not be read, so what is missing cannot "+
+			"be said: "+err.Error()+")")
+	}
+	machines = delivery.MachineNames(placements)
+	on := map[string][]string{}
+	for _, node := range machines {
+		key, _ := delivery.PlacementKey(node)
+		var p delivery.Placement
+		if json.Unmarshal(placements[key], &p) != nil {
+			why = append(why, delivery.PlacementRead+" ("+key+" is not a placement)")
+			continue
+		}
+		for _, m := range p.Modules {
+			on[m.Module] = append(on[m.Module], node)
+		}
+	}
+	modules, err := stateOn(conn, modulesRead)
+	if err != nil {
+		return nil, machines, append(why, modulesRead+" (which modules there are could not be read: "+err.Error()+")")
+	}
+	names, err := delivery.ModuleNames(modules)
+	if err != nil {
+		return nil, machines, append(why, modulesRead+" ("+err.Error()+")")
+	}
+	for _, name := range names {
+		r := recordedModule{Module: name, On: on[name]}
+		if m, err := delivery.DecodeModule(modules[name]); err == nil && m.Manifest != "" {
+			facts, err := manifestOf(conn, m.Manifest)
+			if err != nil {
+				why = append(why, name+" (its manifest could not be read, so whether it answers tools is not known: "+err.Error()+")")
+			} else {
+				r.Tools, r.Replaces = len(facts.Tools) > 0, facts.Replaces
+			}
+		}
+		recorded = append(recorded, r)
+	}
+	return recorded, machines, why
+}
+
+// manifestOf is what the console takes of the manifest of a digest, read from the indexer's manifests once.
+func manifestOf(conn *bus.Conn, digest string) (manifestFacts, error) {
+	if kept, ok := manifestsKept.Load(digest); ok {
+		return kept.(manifestFacts), nil
+	}
+	entry, err := conn.StateGet(conn.Credential().Module, manifestsRead, digest)
+	if err != nil {
+		return manifestFacts{}, err
+	}
+	if entry == nil {
+		return manifestFacts{}, fmt.Errorf("the indexer holds no manifest %s", digest)
+	}
+	m, err := delivery.DecodeManifest(entry.Value)
+	if err != nil {
+		return manifestFacts{}, err
+	}
+	var facts manifestFacts
+	if err := json.Unmarshal([]byte(m.JSON), &facts); err != nil {
+		return manifestFacts{}, err
+	}
+	manifestsKept.Store(digest, facts)
+	return facts, nil
+}
+
 // placedHolders is who holds seat (on node, for a seat held per machine) by placement, or none.
 func (x *index) placedHolders(seat, node string) []delivery.SeatHolder {
 	if len(x.Placed) == 0 {

node-tools/internal/console/address_test.go

@@ -70,29 +70,28 @@ func TestTheMeshsToolsAreFoundByAddress(t *testing.T) {
 		t.Cleanup(stop)
 	}
 
-	// The controller: its records as JSON, as its seat verbs answer them, and its own seat's verbs
-	// announced on the bus like every runtime's.
+	// The controller: its own seat's verbs announced on the bus like every runtime's; its records are asked by no one.
 	controller := connect(t, "mesh-controller", "bench")
-	out := func(s string) map[string]any { return map[string]any{"output": s, "ok": true} }
-	serve := func(verb string, answer func() any) {
-		stop, err := controller.HandleSubject("mesh.seat.mesh-controller.tool."+verb, func(json.RawMessage) (any, error) {
-			return answer(), nil
-		})
-		if err != nil {
-			t.Fatal(err)
-		}
-		t.Cleanup(stop)
-	}
-	serve("nodes", func() any {
-		return out("the bus's user list leaves out 2 user(s)\n" +
-			`[{"name":"bench","heard":"3m ago","mode":"converged","id":"1f2e"},{"name":"desk","heard":"here","mode":"converged","id":"9a8b"}]`)
+	// Its verb nodes, called through the console as any seat's verb is.
+	stopNodes, err := controller.HandleSubject("mesh.seat.mesh-controller.tool.nodes", func(json.RawMessage) (any, error) {
+		return map[string]any{"ok": true, "output": `[{"name":"bench","mode":"converged"},{"name":"desk","mode":"converged"}]`}, nil
 	})
-	var gammaOn atomic.Value
-	gammaOn.Store("[]")
-	serve("modules", func() any {
-		return out(fmt.Sprintf(`[{"module":"alpha","on":["desk"],"tools":true},{"module":"beta","on":["desk"],"tools":true},`+
-			`{"module":"gamma","on":%s,"tools":true},{"module":"delta","on":["desk"],"tools":false},`+
-			`{"module":"epsilon","on":["bench"],"tools":true},{"module":"mesh-controller","on":["bench"],"tools":true}]`, gammaOn.Load().(string)))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(stopNodes)
+	// What the mesh holds, as the indexer and placement write it (ADR 0571 clauses 4, 5): never the controller's records.
+	tools := map[string][]string{"alpha": {"one", "two"}, "beta": {"three"}, "gamma": {"given"}, "delta": nil,
+		"epsilon": {"seven"}, "mesh-controller": {"nodes"}}
+	mesh.Placed(t, tools, map[string][]string{"desk": {"alpha", "beta", "delta"}, "bench": {"epsilon", "mesh-controller"}})
+	console := mt.MembershipOf("node-tools", "desk", false, nil)
+	console.State = mt.ConsoleReads()
+	mesh.Issue(t, console)
+	mt.Until(t, func() error {
+		if m := nodeTools.Membership("node-tools"); m == nil || len(m.State) == 0 {
+			return fmt.Errorf("the console's reads are not issued yet")
+		}
+		return nil
 	})
 	stopAnn, err := announce.Serve(controller, announce.Service{Name: "mesh-controller", ID: "bench"}, func() []announce.Endpoint {
 		return []announce.Endpoint{{Kind: announce.KindSeat, Module: "mesh-controller", Seat: "mesh-controller", Scope: "mesh",
@@ -202,7 +201,7 @@ func TestTheMeshsToolsAreFoundByAddress(t *testing.T) {
 		t.Fatalf("gamma was found before it served: %s", got)
 	}
 	mesh.Issue(t, mt.MembershipOf("gamma", "desk", false, nil))
-	gammaOn.Store(`["desk"]`)
+	mesh.Placed(t, tools, map[string][]string{"desk": {"alpha", "beta", "delta", "gamma"}, "bench": {"epsilon", "mesh-controller"}})
 	late := connect(t, "node-tools", "desk")
 	stopLate, err := runtime.Run(late, []runtime.Served{{Module: "gamma", Entrypoints: []string{mt.Fixture("env-gamma.serve.mjs")}}},
 		nil, (&mt.Logs{}).Logf)
@@ -233,12 +232,3 @@ func TestTheMeshsToolsAreFoundByAddress(t *testing.T) {
 		t.Errorf("an old name: %s", got)
 	}
 }
-
-func TestTheControllersRecordsAreReadAsJSON(t *testing.T) {
-	if got := jsonIn("a warning printed first\n[{\"name\":\"ace\"}]"); got != `[{"name":"ace"}]` {
-		t.Errorf("an array after a warning: %q", got)
-	}
-	if got := jsonIn(`{"seats":[]}`); got != `{"seats":[]}` {
-		t.Errorf("an object: %q", got)
-	}
-}

node-tools/internal/console/console_test.go

@@ -3,6 +3,7 @@ package console
 import (
 	"bytes"
 	"encoding/json"
+	"fmt"
 	"io"
 	"net/http"
 	"strings"
@@ -56,14 +57,19 @@ func TestTheConsoleListsAndCallsOverHTTP(t *testing.T) {
 	}
 	defer stop()
 
-	// The controller's records (ADR 0197): ghost declares tools on desk and nothing announces it.
-	controller := connect(t, "mesh-controller", "")
-	stopSeat, _ := controller.HandleSubject("mesh.seat.mesh-controller.tool.modules", func(json.RawMessage) (any, error) {
-		return map[string]any{"ok": true, "output": `[{"module":"alpha","on":["desk"],"tools":true},` +
-			`{"module":"beta","on":["desk"],"tools":true},{"module":"ghost","on":["desk"],"tools":true}]`}, nil
+	// What the mesh holds, as the indexer and placement write it (ADR 0571): ghost declares tools on desk and nothing
+	// announces it.
+	mesh.Placed(t, map[string][]string{"alpha": {"one", "two"}, "beta": {"three"}, "ghost": {"boo"}},
+		map[string][]string{"desk": {"alpha", "beta", "ghost"}})
+	console := mt.MembershipOf("node-tools", "desk", false, nil)
+	console.State = mt.ConsoleReads()
+	mesh.Issue(t, console)
+	mt.Until(t, func() error {
+		if m := nodeTools.Membership("node-tools"); m == nil || len(m.State) == 0 {
+			return fmt.Errorf("the console's reads are not issued yet")
+		}
+		return nil
 	})
-	defer stopSeat()
-	controller.Flush()
 
 	flat := NewSurface(nodeTools, "desk.node-tools")
 	flat.Flat = true // the whole catalogue, as before ADR 0195: still reachable, no longer announced
@@ -86,9 +92,7 @@ func TestTheConsoleListsAndCallsOverHTTP(t *testing.T) {
 	if got := strings.Join(names, ","); got != "alpha.one,alpha.two,beta.five,beta.four,beta.three,node-shelf.clear,node-shelf.list" {
 		t.Errorf("listed %s", got)
 	}
-	// The console's runtime is issued no read of seat-holders here: that is said beside ghost, never dropped (ADR 0571).
-	if got := listed["_meta"].(map[string]any)["notAnswering"]; len(got.([]any)) != 2 || got.([]any)[0] != "ghost on desk" ||
-		!strings.HasPrefix(got.([]any)[1].(string), "mesh-delivery-assigner.seat-holders (who holds which seat by placement could not be read") {
+	if got := listed["_meta"].(map[string]any)["notAnswering"]; len(got.([]any)) != 1 || got.([]any)[0] != "ghost on desk" {
 		t.Errorf("not answering: %v", got)
 	}
 	for _, x := range listed["tools"].([]any) {

node-tools/internal/console/runtimes_test.go

@@ -56,6 +56,10 @@ func TestARuntimeThatAnswersLateIsFoundAndOneThatNeverDoesIsNamed(t *testing.T)
 	IndexKept, announce.Patience = time.Minute, 2500*time.Millisecond
 	t.Cleanup(func() { IndexKept, announce.Patience = keptWas, patienceWas })
 	mesh := mt.New(t)
+	// What the mesh holds, as the indexer and placement write it (ADR 0571): never the controller's records.
+	mesh.Placed(t, map[string][]string{"slack": {"slack_check"}, "nap": {"doze"}, "nextcloud-client": {"nextcloud_check"}},
+		map[string][]string{"laptop": {"slack", "nextcloud-client"}, "sleeper": {"nap", "nextcloud-client"},
+			"desktop": {"nextcloud-client"}, "bench": nil})
 	// Who holds which seat, by placement (ADR 0571 clause 4), as the seat mesh-placement's holder composes it.
 	placedKV := mesh.Bucket(t, delivery.SeatHoldersBucket)
 	for key, sh := range delivery.SeatHoldersOf(map[string]delivery.Placement{"bench": {Node: "bench",
@@ -66,7 +70,7 @@ func TestARuntimeThatAnswersLateIsFoundAndOneThatNeverDoesIsNamed(t *testing.T)
 		}
 	}
 	consoleMembership := mt.MembershipOf("node-tools", "laptop-console", false, nil)
-	consoleMembership.State = []bus.StateIssued{{Name: delivery.SeatHoldersRead, Bucket: delivery.SeatHoldersBucket}}
+	consoleMembership.State = mt.ConsoleReads()
 	mesh.Issue(t, consoleMembership)
 
 	laptop := connect(t, "node-tools", "laptop")
@@ -94,18 +98,14 @@ func TestARuntimeThatAnswersLateIsFoundAndOneThatNeverDoesIsNamed(t *testing.T)
 	controller := connect(t, "mesh-controller", "bench")
 	var toolsAsked atomic.Int32
 	for verb, output := range map[string]string{
-		"nodes": `[{"name":"laptop"},{"name":"sleeper"},{"name":"desktop"},{"name":"bench"}]`,
-		"modules": `[{"module":"slack","on":["laptop"],"tools":true},{"module":"nap","on":["sleeper"],"tools":true},` +
-			`{"module":"nextcloud-client","on":["laptop","desktop","sleeper"],"tools":true}]`,
-		// No part keeps a central record of tools (ADR 0571 clause 5): a seat verb's `replaces` is read from its contract
-		// in mesh-sdk, so the controller's `tools` is served here only to see that it is never asked.
-		"tools": `{"seats":[]}`,
+		// The controller's records are served here only to see that none is asked (ADR 0571 clauses 4 and 5).
+		"nodes":   `[{"name":"laptop"}]`,
+		"modules": `[]`,
+		"tools":   `{"seats":[]}`,
 	} {
 		output, verb := output, verb
 		stop, err := controller.HandleSubject("mesh.seat.mesh-controller.tool."+verb, func(json.RawMessage) (any, error) {
-			if verb == "tools" {
-				toolsAsked.Add(1)
-			}
+			toolsAsked.Add(1)
 			return map[string]any{"output": output, "ok": true}, nil
 		})
 		if err != nil {
@@ -149,7 +149,7 @@ func TestARuntimeThatAnswersLateIsFoundAndOneThatNeverDoesIsNamed(t *testing.T)
 		t.Errorf("mesh/seats answered %s", raw)
 	}
 	if n := toolsAsked.Load(); n != 0 {
-		t.Errorf("the console asked the controller's tools %d times", n)
+		t.Errorf("the console asked the controller's records %d times", n)
 	}
 
 	// The silent one is named, never called missing.