fix(gitsync): the image's own module copy is judged against an import's requires (Plugins#2715)

[rbuergi]

Refs Systemorph/MeshWeaver.Plugins#2715. That issue is sev:H, so it closes after verification on a rolled instance, not when this merges.

Root cause

src/MeshWeaver.PluginCatalog/LoadedPackageModuleReader.cs (Resolve) is the reading that rule 1b (ModuleSyncDecision.DeclineUnmetRequirements, #6110) judges an import's requires against. It only stated a module that loaded from a landed generation. A module that loaded from the image's own copy was left out, and the comment called that "not judged". So rule 1b could never hold an import against the image copy, which is the most common copy there is.

It is live now on the control instance (memex.systemorph.com, image d205295 = 3.0.0-ci.9984, Plugins 29bfaefb). Read-only readings from 2026-10-06 ~06:45Z:

• search nodeType:NodeType content.compilationStatus:Error partitions:all returns 21 types over 123 readable partitions. 20 of them are in Hosting, including Hosting/InstanceAction, Deployment, InstanceRequest, FleetConsole and TriageItem. All were compiled at 2026-10-05 23:25–23:26Z.
• The compilationError on TriageItem and on an InstanceAction instance is CS0246/CS0103 LanePolicy, LaneScheduler, Lanes, and CS1061 ThreadDispatchPool.Allowance. Those are AI members from Plugins 4c5aa6437.
• Plugins/Hosting was installed at 23:27:04Z. Its Hosting/index.json hash 52bb6e92… is Plugins 26aaaf092, which declares AI@^1.22.0.
• The image's AI is stamped 1.21.1 (AI/manifest.lock at 29bfaefb), and 29bfaefb does not contain 4c5aa6437.
• /health nodetype_bake lists all 20 Hosting types as failed. The InstanceAction NodeType is in Error, so instance actions on the control instance cannot run.

Fix

• ResolveWithImageCopies. A module that loaded from the image's copy is now read at the version its module.seed.json stamp states (ImageModuleSeed, added for Store-installed module overrides the image's baseline seed at boot — correct image runs pre-8931656 Plugins code (no version/commit comparison in ComputeEffectiveModuleEntriesForPlatform) #6044 by fix(modules): a store copy overrides the image's own module only as a strictly newer release (#6044) #6103). The entry is keyed by the package the stamp names.
  • A landed generation that loaded wins, because it is what runs.
  • An image copy with no stamp, a substituted load and an ambiguous load stay unjudged, exactly as before.
• ImageCopiesOf is the production reader of those stamps.
• Resolve keeps its shape and forwards. The new method has a distinct name, not an overload, so dependents' <see cref> cannot hit CS0419.
• Why the stamp is a safe input. A seed stamp can only understate the image's bytes: an unsettled manifest.lock keeps its number while the sources move on, never the reverse (ImageModuleSeed.DeclineReason explains the same point). So this can hold an import the image would have satisfied, but it can never admit one the image cannot satisfy. That is the direction a gate should err in.
• Doc: ModuleSyncPerManifestHash.md, rule 1b.

Tests

LoadedPackageModuleReaderTest, run locally: 10 of 10 pass.

• The incident through the real decision. Hosting declares AI@^1.22.0 and the image AI is stamped 1.21.1, so the import is Declined and the reason names 1.21.1.
  • In-test negative control: the old reading (Resolve) lets the same tree go Synced, which is what happened on the control instance.
• Negative control (run): with the image pass disabled, 2 of 10 go red: the incident test and TheImageCopyLoaded_ReadsTheSeedsVersion.
• A landed generation that loaded wins. No stamp, no package and a foreign leaf all stay unjudged.
• ImageCopiesOf reads a real stamp from disk.

What this does NOT do / not established

• It does not fix the control instance as it stands. Hosting's sources are already written. Its 20 types recover when AI ≥ 1.22 is loaded there: either a roll to an image ≥ 3.0.0-ci.9995 (which ships AI 1.22.x), or the landed store AI 1.22.0 loading. After that, recycle Hosting/Deployment (the type cascades).
• Not established: why the landed store AI 1.22.0 (Plugins/AI installed 2026-10-05 21:40Z, which carries LanePolicy) did not load at the 22:54Z boot, even though 1.22.0 > 1.21.1. The compile errors show that the loaded AI lacks LanePolicy. I did not read the pod's [ModuleLoad] lines: that is break-glass, and the governed Logs action needs Hosting/InstanceAction, which is down. So "the image copy loaded" is an inference from the compile errors, not a log reading.
• A package that starts using a newer module without raising its requires is still not caught here. Plugins now stamps floors (mesh-floors.py).

Pairs-with: none — adds a public method and a public record; nothing is removed or re-signed.

🤖 Generated with Claude Code

[github-actions]

Test Results

   11 files   -    11     11 suites   - 11   27m 59s ⏱️ - 15m 36s
6 842 tests  - 3 936  6 842 ✅  - 3 743  0 💤  - 193  0 ❌ ±0 
6 854 runs   - 3 937  6 854 ✅  - 3 744  0 💤  - 193  0 ❌ ±0 

Results for commit 7249e74. ± Comparison against base commit 8c08fa4.

This pull request removes 4011 and adds 57 tests. Note that renamed tests count towards both.

   --- End of inner exception stack trace ---
   --- End of inner exception stack trace ---, expected: True)
   --- End of inner exception stack trace ---, isDenial: True)
 ---> (Inner Exception #1) MeshWeaver.Messaging.Hub.Test.InfrastructureFaultTest+ProviderException (0x80004005): Failed to connect to 10.42.18.4:5432<---
 ---> (Inner Exception #1) System.InvalidOperationException: boom<---
 ---> (Inner Exception #1) System.InvalidOperationException: source B is misconfigured<---
 ---> (Inner Exception #1) System.Net.Sockets.SocketException (0xFFFDFFFF): Name or service not known<---
 ---> MeshWeaver.Messaging.Hub.Test.InfrastructureFaultTest+ProviderException (0x80004005): Failed to connect to 10.42.18.4:5432
 ---> System.AggregateException: One or more errors occurred. (Failed to connect to 10.42.18.4:5432)
…

Memex.Portal.Shared.Test.InstanceIdRulesMatchTheRegistryTest ‑ TheSetupHostAgreesWithTheRegistry(candidate: "083ef8dd-90ea-46cc-a532-1b55807296d6")
Memex.Portal.Shared.Test.InstanceRebootFaultedRestartTest ‑ ARestartThatCrashed_IsFaulted_RetriedByThePass_AndCompletesOnTheNextAttempt
Memex.Portal.Shared.Test.LoadedPackageModuleReaderTest ‑ ALandedGenerationThatLoaded_WinsOverTheImageReading
Memex.Portal.Shared.Test.LoadedPackageModuleReaderTest ‑ ARequirementTheImagesCopyDoesNotMeet_DeclinesTheImport
Memex.Portal.Shared.Test.LoadedPackageModuleReaderTest ‑ AnImageCopyWithoutAStampOrAnotherLeaf_IsNotJudged
Memex.Portal.Shared.Test.LoadedPackageModuleReaderTest ‑ ImageCopiesOf_ReadsTheStampBesideTheImagesCopy
Memex.Portal.Shared.Test.LoadedPackageModuleReaderTest ‑ TheImageCopyLoaded_ReadsTheSeedsVersion
Memex.Portal.Shared.Test.ModuleReloadFaultedBesideActivationTest ‑ OneModulesCrashedAdopt_BesideAnotherModulesLiveActivation_IsFaulted
Memex.Portal.Shared.Test.ModuleReloadFaultedTest ‑ ADecidedFailure_IsFailed_AndIsNeverRetried
Memex.Portal.Shared.Test.ModuleReloadFaultedTest ‑ ATransientFault_IsFaulted_TheNextPassRetriesIt_AndItSucceeds
…

♻️ This comment has been updated with latest results.

[github-actions]

Test Results (shard 0)

  3 files  ±0    3 suites  ±0   3m 34s ⏱️ +9s
566 tests ±0  375 ✅ ±0  191 💤 ±0  0 ❌ ±0 
570 runs  ±0  379 ✅ ±0  191 💤 ±0  0 ❌ ±0 

Results for commit 7249e74. ± Comparison against base commit 8c08fa4.

♻️ This comment has been updated with latest results.

[github-actions]

Test Results (shard 3)

2 481 tests  +5   2 481 ✅ +5   7m 35s ⏱️ +8s
    4 suites ±0       0 💤 ±0 
    4 files   ±0       0 ❌ ±0 

Results for commit 7249e74. ± Comparison against base commit 8c08fa4.

♻️ This comment has been updated with latest results.

[github-actions]

Test Results (shard 1)

1 753 tests  ±0   1 751 ✅ ±0   5m 32s ⏱️ -4s
    4 suites ±0       2 💤 ±0 
    4 files   ±0       0 ❌ ±0 

Results for commit 7249e74. ± Comparison against base commit 8c08fa4.

♻️ This comment has been updated with latest results.

[github-actions]

Test Results (shard 2)

    5 files  ±0      5 suites  ±0   4m 0s ⏱️ +7s
1 279 tests ±0  1 279 ✅ ±0  0 💤 ±0  0 ❌ ±0 
1 280 runs  ±0  1 280 ✅ ±0  0 💤 ±0  0 ❌ ±0 

Results for commit 7249e74. ± Comparison against base commit 8c08fa4.

♻️ This comment has been updated with latest results.

[github-actions]

Test Results (shard 5)

    2 files  ±0      2 suites  ±0   8m 42s ⏱️ +22s
1 108 tests ±0  1 108 ✅ ±0  0 💤 ±0  0 ❌ ±0 
1 109 runs  ±0  1 109 ✅ ±0  0 💤 ±0  0 ❌ ±0 

Results for commit 7249e74. ± Comparison against base commit 8c08fa4.

♻️ This comment has been updated with latest results.

[github-actions]

Test Results (shard 4)

  1 files   -     3    1 suites   - 3   6m 19s ⏱️ - 8m 33s
510 tests  - 3 086  510 ✅  - 3 086  0 💤 ±0  0 ❌ ±0 
510 runs   - 3 093  510 ✅  - 3 093  0 💤 ±0  0 ❌ ±0 

Results for commit 7249e74. ± Comparison against base commit 8c08fa4.

This pull request removes 3614 and adds 510 tests. Note that renamed tests count towards both.

   --- End of inner exception stack trace ---
   --- End of inner exception stack trace ---, expected: True)
   --- End of inner exception stack trace ---, isDenial: True)
 ---> (Inner Exception #1) MeshWeaver.Messaging.Hub.Test.InfrastructureFaultTest+ProviderException (0x80004005): Failed to connect to 10.42.18.4:5432<---
 ---> (Inner Exception #1) System.InvalidOperationException: boom<---
 ---> (Inner Exception #1) System.InvalidOperationException: source B is misconfigured<---
 ---> (Inner Exception #1) System.Net.Sockets.SocketException (0xFFFDFFFF): Name or service not known<---
 ---> MeshWeaver.Messaging.Hub.Test.InfrastructureFaultTest+ProviderException (0x80004005): Failed to connect to 10.42.18.4:5432
 ---> System.AggregateException: One or more errors occurred. (Failed to connect to 10.42.18.4:5432)
…

MeshWeaver.Hosting.Test.ABakedTypeRegistersWithoutAnInstanceTest ‑ ABakedTypeNobodyActivated_IsRegisteredByThePass_WithoutARecompile
MeshWeaver.Hosting.Test.ABakedTypeRegistersWithoutAnInstanceTest ‑ ATypeWithNoBuild_IsSkipped_NotCompiled
MeshWeaver.Hosting.Test.ADeletedPartitionIsNotPumpedTest ‑ AConfirmedAbsentPartition_SkipsTheTypeAndNamesThePartition
MeshWeaver.Hosting.Test.ADeletedPartitionIsNotPumpedTest ‑ APartitionNobodyDenied_IsWarmedAsBefore(typePath: "Admin/User", because: "a live partition is warmed")
MeshWeaver.Hosting.Test.ADeletedPartitionIsNotPumpedTest ‑ APartitionNobodyDenied_IsWarmedAsBefore(typePath: "Markdown", because: "a type with no partition segment at all is warmed")
MeshWeaver.Hosting.Test.ADeletedPartitionIsNotPumpedTest ‑ APartitionNobodyDenied_IsWarmedAsBefore(typePath: "UWDeepfieldExtra/Thing", because: "a partition whose NAME merely starts the same is w"···)
MeshWeaver.Hosting.Test.ADeletedPartitionIsNotPumpedTest ‑ AProviderThatKnowsItsStore_ConfirmsAbsence
MeshWeaver.Hosting.Test.ADeletedPartitionIsNotPumpedTest ‑ AProviderThatThrowsSynchronously_IsIndeterminate_NotAnEscapingException
MeshWeaver.Hosting.Test.ADeletedPartitionIsNotPumpedTest ‑ ASkippedType_DoesNotHoldReadiness
MeshWeaver.Hosting.Test.ADeletedPartitionIsNotPumpedTest ‑ ASkippedType_IsCountedAsContentBroken_NotAsAFault
…