reeve 0.7.0 → 0.8.0

data/lib/reeve/audit/chain/report.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "time"
+
 module Reeve
   module Audit
     class Chain
@@ -15,6 +17,7 @@ module Reeve
         LABEL_WIDTH = 14
         KIND_WIDTH = 17
         PREFIX = "reeve ledger:"
+        NOTHING_AFTER_PURGE = "no entries after the purge to verify"
 
         def self.number(value)
           digits = value.abs.to_s.reverse.scan(/\d{1,3}/).join(",").reverse
@@ -46,48 +49,50 @@ module Reeve
         end
 
         def intact
-          "#{PREFIX} INTACT — sequences #{range(@v.covered)} verified " \
-            "(head at start: #{number(@v.head_at_start)}); #{uncovered}"
+          if @v.walked_from
+            return "#{PREFIX} INTACT — #{anchor_text.walked_from}; #{uncovered}; #{anchor_text}"
+          end
+
+          walked = @v.covered ? "sequences #{range(@v.covered)} verified" : NOTHING_AFTER_PURGE
+          "#{PREFIX} INTACT — #{walked} (head at start: #{number(@v.head_at_start)}); " \
+            "#{uncovered}; #{anchor_text}"
         end
 
         def broken
           count = @v.breaks.size
+          breaks = "#{number(count)} break#{'s' unless count == 1}"
+          if anchor_text.emptied?
+            return "#{PREFIX} BROKEN — #{breaks} in the ledger; #{anchor_text.emptied}"
+          end
+
           where = @v.covered ? "in sequences #{range(@v.covered)}" : "in the ledger"
-          "#{PREFIX} BROKEN — #{number(count)} break#{'s' unless count == 1} #{where}; #{uncovered}"
+          "#{PREFIX} BROKEN — #{breaks} #{where}; #{uncovered}; #{anchor_text}"
         end
 
+        def anchor_text = (@anchor_text ||= AnchorText.new(@v))
+
         def no_chain
           "#{PREFIX} NO CHAIN — #{number(@v.uncovered_now + @v.unchained_now)} entries, " \
             "none chained; nothing was verified"
         end
 
-        def no_key
-          "#{PREFIX} UNVERIFIABLE — no ledger key configured; nothing was verified"
-        end
+        def no_key = "#{PREFIX} UNVERIFIABLE — no ledger key configured; nothing was verified"
 
+        # The purge clause leads here too (FR-011), but the uncovered count stays as 0.6.0 wrote it.
         def unverifiable
-          unknown = @v.breaks.select { |found| found.kind == :unknown_key }
-          rows = unknown.count { |found| entry_position?(found.sequence) }
-          checked = @v.covered ? @v.covered.size - rows : 0
-          "#{PREFIX} UNVERIFIABLE — #{number(rows)} entries signed by #{missing_keys(unknown)} " \
-            "not configured; the other #{number(checked)} in #{range(@v.covered)} show no " \
-            "breaks, which is not a pass; #{number(@v.uncovered_now)} earlier entries not covered"
-        end
-
-        # The genesis is position 0 and is not an entry.
-        def entry_position?(sequence)
-          sequence.is_a?(Integer) && sequence.positive?
-        end
-
-        def missing_keys(unknown)
-          keys = unknown.map(&:key_id).compact.uniq
-          keys.one? ? "key #{keys.first}, which is" : "keys #{keys.join(', ')}, which are"
+          "#{PREFIX} UNVERIFIABLE — #{UnverifiableText.new(@v)}; #{RetentionText.new(@v).clause}" \
+            "#{number(@v.uncovered_now)} earlier entries not covered; #{anchor_text}"
         end
 
+        # After a purge, what it removed comes first (specs/005 FR-011): no line says what was
+        # verified without saying what was purged before it.
         def uncovered
-          parts = ["#{number(@v.uncovered_now)} earlier entries not covered"]
+          retention = RetentionText.new(@v)
+          parts = [retention.clause, "#{number(@v.uncovered_now)} earlier entries not covered"]
           at_genesis = @v.uncovered_at_genesis
-          parts << " (#{number(at_genesis)} when the chain started)" if at_genesis
+          if at_genesis
+            parts << " (#{number(at_genesis)} when the chain started#{retention.pre_chain})"
+          end
           unless @v.unchained_at_genesis.to_i.zero?
             parts << "; #{number(@v.unchained_at_genesis)} unchained entries from before the " \
                      "chain started, not covered"
@@ -95,9 +100,7 @@ module Reeve
           parts.join
         end
 
-        def totals
-          "  totals: #{@v.totals.map { |kind, count| "#{kind} #{count}" }.join(', ')}"
-        end
+        def totals = "  totals: #{@v.totals.map { |kind, count| "#{kind} #{count}" }.join(', ')}"
 
         def more(listed, limit)
           remaining = listed.size - limit
@@ -106,15 +109,24 @@ module Reeve
           "  … and #{number(remaining)} more (the totals above are complete)"
         end
 
+        # One space at least between columns, so a label or kind longer than its column
+        # (`checkpoint #48,000`, `checkpoint_not_reached`) never runs into the next.
         def line_for(found)
-          kind = found.kind.to_s.ljust(KIND_WIDTH)
-          "  #{label(found).ljust(LABEL_WIDTH)}#{kind}#{found.detail}".rstrip
+          label = label(found).ljust(LABEL_WIDTH - 1)
+          kind = found.kind.to_s.ljust(KIND_WIDTH - 1)
+          "  #{label} #{kind} #{found.detail}".rstrip
         end
 
         def label(found)
-          sequence = found.sequence
           return "invocation #{found.invocation_id}" if found.invocation_id
-          return "epoch #{found.epoch}" if sequence.nil? && found.epoch
+          return "checkpoint ##{number(found.checkpoint)}" if found.checkpoint
+          return "retention #{found.retention}" if found.retention
+          return "epoch #{found.epoch}" if found.sequence.nil? && found.epoch
+
+          position(found.sequence)
+        end
+
+        def position(sequence)
           return "—" if sequence.nil?
           return "##{range(sequence)}" if sequence.is_a?(Range)
 
@@ -132,6 +144,151 @@ module Reeve
         end
       end
 
+      # What an unverifiable run could not check, and what it did (the UNVERIFIABLE line). Rows
+      # signed by a key that is not configured are counted; a checkpoint whose key is missing is
+      # named apart from them and is not one (specs/004).
+      class UnverifiableText
+        def initialize(verification)
+          @v = verification
+          unknown = verification.breaks.select { |found| found.kind == :unknown_key }
+          @checkpoints, unknown = unknown.partition(&:checkpoint)
+          @records, @signed = unknown.partition(&:retention)
+        end
+
+        def to_s
+          rows = @signed.count { |found| entry?(found.sequence) }
+          checked = @v.covered ? @v.covered.size - rows : 0
+          "#{unchecked(rows)}; the other #{Report.number(checked)} in #{range} show no breaks, " \
+            "which is not a pass"
+        end
+
+        private
+
+        def unchecked(rows)
+          parts = []
+          parts << "#{Report.number(rows)} entries signed by #{missing(@signed)}" if @signed.any?
+          parts << other("checkpoint", @checkpoints) if @checkpoints.any?
+          parts << other("retention record", @records) if @records.any?
+          parts.join("; ")
+        end
+
+        # Not entries, so named apart and not counted as rows.
+        def other(noun, found)
+          count = found.size
+          "#{Report.number(count)} #{noun}#{'s' unless count == 1} signed by #{missing(found)}"
+        end
+
+        # The genesis is position 0 and is not an entry.
+        def entry?(sequence)
+          sequence.is_a?(Integer) && sequence.positive?
+        end
+
+        def missing(unknown)
+          keys = unknown.map(&:key_id).compact.uniq
+          named = keys.one? ? "key #{keys.first}, which is" : "keys #{keys.join(', ')}, which are"
+          "#{named} not configured"
+        end
+
+        def range
+          return "—" if @v.covered.nil?
+
+          "#{Report.number(@v.covered.first)}–#{Report.number(@v.covered.last)}"
+        end
+      end
+
+      # What the ledger's purges removed, in words (specs/005 FR-011): the clause that leads the
+      # coverage on every walked summary line, and the pre-chain rows a purge removed.
+      class RetentionText
+        def initialize(verification)
+          @retention = verification.retention
+          @awaiting = verification.awaiting_purge.to_i
+        end
+
+        def clause
+          boundary = @retention&.boundary
+          return "" if boundary.nil?
+
+          text = "1–#{Report.number(boundary.through_sequence)} purged (retention record " \
+                 "#{boundary.purge_number}, #{boundary.purged_at.utc.strftime('%Y-%m-%d')}); "
+          text += "#{Report.number(@awaiting)} entries awaiting purge; " if @awaiting.positive?
+          text
+        end
+
+        def pre_chain
+          purged = if @retention
+                     @retention.summaries.reject { |found| found.status == :altered }
+                               .sum(&:removed_pre_chain)
+                   else
+                     0
+                   end
+          purged.positive? ? ", #{Report.number(purged)} purged" : ""
+        end
+      end
+
+      # What a run was anchored by, in words (specs/004 FR-014, FR-015): the clause every walked
+      # summary line ends with, and the wording for a walk from a checkpoint and for an emptied
+      # ledger that checkpoints saw.
+      class AnchorText
+        # A checkpoint's time for people: "2026-10-25 14:00 UTC". A time that does not parse is
+        # shown as written; verification never depends on it.
+        def self.made_on(made_at)
+          Time.iso8601(made_at).utc.strftime("%Y-%m-%d %H:%M UTC")
+        rescue ArgumentError
+          made_at
+        end
+
+        def initialize(verification)
+          @v = verification
+        end
+
+        # The highest checkpoint that checked, and how many entries it does not cover.
+        def to_s
+          anchor = @v.anchored_at
+          return "not anchored" if anchor.nil?
+
+          after = @v.beyond_anchor.to_i
+          "anchored at ##{number(anchor.head_sequence)} (checkpoint #{made_on(anchor)}), " \
+            "#{number(after)} #{after == 1 ? 'entry' : 'entries'} after it"
+        end
+
+        def walked_from
+          start = @v.walked_from
+          from = "checkpoint ##{number(start.head_sequence)} (#{made_on(start)})"
+          walked = if @v.covered
+                     "sequences #{range} verified from #{from}"
+                   else
+                     "no entries after #{from}"
+                   end
+          "#{walked}; #{number(start.head_sequence)} earlier chained entries not walked by " \
+            "this run"
+        end
+
+        # No walk, and checkpoints that saw a chain.
+        def emptied?
+          @v.head_at_start.nil? && @v.checkpoints.any?
+        end
+
+        def emptied
+          count = @v.checkpoints.size
+          "the ledger has no chain, but #{number(count)} checkpoint#{'s' unless count == 1} " \
+            "name#{'s' if count == 1} one"
+        end
+
+        private
+
+        def number(value)
+          Report.number(value)
+        end
+
+        def made_on(checkpoint)
+          AnchorText.made_on(checkpoint.made_at)
+        end
+
+        def range
+          "#{number(@v.covered.first)}–#{number(@v.covered.last)}"
+        end
+      end
+
       # The key epochs, one line each (specs/003 FR-013), shown once they say something the
       # summary does not: more than one, one that is not verified, or rows chained before the
       # first. A ledger with one verified epoch and nothing before it reads as 0.6.0's did.

data/lib/reeve/audit/chain/retention/archive.rb

@@ -0,0 +1,98 @@
+# frozen_string_literal: true
+
+require "digest"
+require "fileutils"
+require "json"
+
+module Reeve
+  module Audit
+    class Chain
+      module Retention
+        # The archive a purge writes before it removes anything (specs/005 FR-007,
+        # contracts/archive-v1.md): one JSON line of header, then every purged row with every
+        # column, chain columns included, so the range can be verified on its own.
+        #
+        # Written to `path.tmp`, flushed and renamed, so a partial archive is never at `path`.
+        module Archive
+          FORMAT = "reeve-ledger-archive-v1"
+          BATCH = 1_000
+
+          module_function
+
+          # Writes the archive for `plan` and returns its SHA-256.
+          def write(path, plan, entry_class:)
+            partial = "#{path}.tmp"
+            File.open(partial, File::WRONLY | File::CREAT | File::EXCL, 0o644) do |file|
+              file.puts(JSON.generate(header(plan)))
+              each_row(plan, entry_class) { |row| file.puts(JSON.generate(line(row))) }
+              file.flush
+              file.fsync
+            end
+            File.rename(partial, path)
+            ::Digest::SHA256.file(path).hexdigest
+          rescue StandardError
+            FileUtils.rm_f(partial)
+            raise
+          end
+
+          def header(plan)
+            {
+              "format" => FORMAT, "ledger" => ChainRecord::LEDGER, "purge" => plan.purge,
+              "from_sequence" => plan.from, "through_sequence" => plan.through,
+              "through_checkpoint" => plan.checkpoint.to_line, "start" => plan.start || genesis,
+              "chained" => plan.removed_chained, "pre_chain" => plan.removed_pre_chain,
+              "reeve_version" => Reeve::VERSION
+            }.sort.to_h
+          end
+
+          # Purge 0 starts at the genesis, so the archive carries it.
+          def genesis
+            record = ChainRecord.ledger
+            fields = Canonical::GENESIS_FIELDS + ["genesis_digest"]
+            { "genesis" => fields.to_h { |field| [field, value(record[field])] } }
+          end
+
+          # Pre-chain rows first, then the chained range in sequence order, a batch at a time.
+          def each_row(plan, entry_class, &block)
+            entry_class.where("contract_version < 3").order(:id).find_each(batch_size: BATCH,
+&block)
+            after = plan.from - 1
+            loop do
+              batch = entry_class.where(chain_sequence: (after + 1)..plan.through)
+                                 .order(:chain_sequence).limit(BATCH).to_a
+              batch.each(&block)
+              break if batch.size < BATCH
+
+              after = batch.last.chain_sequence
+            end
+          end
+
+          # The header of the archive at `path`, refusing one in another format: a verifier
+          # never guesses at a format it does not know.
+          def read_header(path)
+            header = JSON.parse(File.foreach(path).first.to_s)
+            return header if header.is_a?(Hash) && header["format"] == FORMAT
+
+            found = header.is_a?(Hash) ? header["format"].inspect : "unreadable"
+            raise ArgumentError, "#{path} is not a #{FORMAT} archive (format #{found})"
+          rescue JSON::ParserError
+            raise ArgumentError, "#{path} is not a #{FORMAT} archive (its first line is not JSON)"
+          end
+
+          # The header's genesis, with its time as a Time again, for Canonical.genesis_digest.
+          def genesis_values(genesis)
+            genesis.merge("genesis_at" => Time.iso8601(genesis["genesis_at"]))
+          end
+
+          def line(row)
+            row.attributes.except("id").transform_values { |item| value(item) }.sort.to_h
+          end
+
+          def value(item)
+            item.respond_to?(:utc) ? item.utc.iso8601(6) : item
+          end
+        end
+      end
+    end
+  end
+end

data/lib/reeve/audit/chain/retention/archive_check.rb

@@ -0,0 +1,179 @@
+# frozen_string_literal: true
+
+require "json"
+
+module Reeve
+  module Audit
+    class Chain
+      module Retention
+        # Verifies an archive on its own (specs/005 FR-012, contracts/archive-v1.md): its boundary
+        # checkpoint is genuine, its start link is the genesis (or the boundary before it), and
+        # every chained row, rebuilt as an unsaved entry so it casts as the database did,
+        # recomputes its digest against the row before it, ending at the checkpoint's digest.
+        #
+        # Needs the entries table's columns, for the casts, but none of its rows.
+        class ArchiveCheck
+          BOUNDARY = "its boundary checkpoint"
+
+          def initialize(path, keyring:, entry_class:)
+            @path = path
+            @keyring = keyring
+            @entry_class = entry_class
+            @breaks = []
+          end
+
+          def call
+            header = Archive.read_header(@path)
+            checkpoint = Checkpoint.parse(header.fetch("through_checkpoint"), position: 1)
+            return result(header, checkpoint) unless genuine?(checkpoint)
+
+            check_end(header, checkpoint, walk(header, start_link(header, checkpoint)))
+            result(header, checkpoint)
+          end
+
+          private
+
+          attr_reader :keyring, :breaks
+
+          def genuine?(checkpoint)
+            signed = checkpoint.signed_by(keyring)
+            key = checkpoint.key_id
+            add(:unknown_key, nil, "#{BOUNDARY} is signed by key #{key}", key_id: key) if
+              signed == :key_not_configured
+            if signed == :altered
+              add(:checkpoint_altered, nil,
+                  "#{BOUNDARY} does not match its signature")
+            end
+            signed == :valid
+          end
+
+          # Purge 0 starts at the genesis, which is recomputed under its own key and must be the
+          # one the checkpoint names; a later purge starts at the previous boundary's digest,
+          # which the first row's own digest then binds.
+          def start_link(header, checkpoint)
+            genesis = header.dig("start", "genesis")
+            return header.dig("start", "through_digest") unless genesis
+
+            digest = genesis["genesis_digest"]
+            secret = keyring.for(genesis["genesis_key_id"])
+            if secret.nil?
+              add(:unknown_key, 0, "the genesis is signed by key #{genesis['genesis_key_id']}",
+                  key_id: genesis["genesis_key_id"])
+            elsif Canonical.genesis_digest(secret, Archive.genesis_values(genesis)) != digest ||
+                  checkpoint.genesis_digest != digest
+              add(:genesis_altered, 0,
+                  "the archive's genesis does not match its digest or its checkpoint")
+            end
+            digest
+          end
+
+          # Every row after the header: pre-chain rows counted, chained rows checked in order.
+          def walk(header, link)
+            expected = header["from_sequence"]
+            last = nil
+            @chained = @pre_chain = 0
+            File.foreach(@path).drop(1).each do |line|
+              entry = @entry_class.new(JSON.parse(line))
+              next @pre_chain += 1 if entry.chain_sequence.nil?
+
+              expected, link = visit(entry, expected, link)
+              last = entry
+            end
+            last
+          end
+
+          def visit(entry, expected, link)
+            @chained += 1
+            sequence = entry.chain_sequence
+            if sequence != expected
+              kind = sequence < expected ? :duplicate : :missing
+              add(kind, sequence < expected ? sequence : expected..(sequence - 1),
+                  "out of order in the archive")
+            end
+            check_digest(entry, link)
+            [sequence + 1, entry.chain_digest]
+          end
+
+          def check_digest(entry, link)
+            secret = keyring.for(entry.chain_key_id)
+            if secret.nil?
+              return add(:unknown_key, entry.chain_sequence, "signed by key #{entry.chain_key_id}",
+                         key_id: entry.chain_key_id)
+            end
+            return if Canonical.entry_digest(secret, entry,
+                                             previous_digest: link) == entry.chain_digest
+
+            add(:digest_mismatch, entry.chain_sequence, Walk::MISMATCH)
+          rescue ArgumentError => e
+            add(:digest_mismatch, entry.chain_sequence, e.message)
+          end
+
+          def check_end(header, checkpoint, last)
+            reached = last&.chain_sequence == header["through_sequence"] &&
+                      last&.chain_digest == checkpoint.head_digest
+            unless reached
+              add(:checkpoint_not_reached, nil, "the archive does not end at its boundary " \
+                                                "checkpoint " \
+                                                "##{Report.number(checkpoint.head_sequence)}")
+            end
+            return if @chained == header["chained"] && @pre_chain == header["pre_chain"]
+
+            add(:missing, nil, "the header counts #{header['chained']} chained and " \
+                               "#{header['pre_chain']} " \
+                               "pre-chain rows; the archive holds #{@chained} and #{@pre_chain}")
+          end
+
+          def add(kind, sequence, detail, key_id: nil)
+            breaks << Verification::Break.new(kind: kind, sequence: sequence, detail: detail,
+                                              key_id: key_id)
+          end
+
+          def result(header, checkpoint)
+            ArchiveResult.new(status: Verification.status_for(breaks), breaks: breaks,
+                              covered: header["from_sequence"]..header["through_sequence"],
+                              checkpoint: checkpoint, pre_chain: @pre_chain.to_i)
+          end
+        end
+
+        # What verifying an archive found, in words (`bin/rails reeve:verify_archive`).
+        ArchiveResult = Struct.new(:status, :breaks, :covered, :checkpoint, :pre_chain,
+                                   keyword_init: true) do
+          def intact? = status == :intact
+
+          def to_s
+            listed = breaks.reject { |found| found.kind == :unknown_key }
+            [summary, *listed.map { |found| line(found) }].join("\n")
+          end
+
+          private
+
+          def summary
+            word, found =
+              case status
+              when :intact then ["INTACT", "sequences #{range} verified, ending at #{ending}"]
+              when :broken then ["BROKEN", "#{n(breaks.size)} breaks in sequences #{range}"]
+              else ["UNVERIFIABLE", "signed by a key not configured; nothing in #{range} verified"]
+              end
+            "reeve archive: #{word} — #{found}; #{counted}"
+          end
+
+          def range = "#{n(covered.first)}–#{n(covered.last)}"
+
+          def ending
+            "checkpoint ##{n(checkpoint.head_sequence)} (#{AnchorText.made_on(checkpoint.made_at)})"
+          end
+
+          def counted = "#{n(pre_chain)} pre-chain rows counted, not verified"
+
+          def line(found)
+            sequence = found.sequence
+            where = sequence.is_a?(Range) ? "##{sequence.first}–#{sequence.last}" : "##{sequence}"
+            "  #{sequence.nil? ? '—' : where} #{found.kind} #{found.detail}"
+          end
+
+          def n(value) = Report.number(value.to_i)
+        end
+      end
+    end
+  end
+end

data/lib/reeve/audit/chain/retention/check.rb

@@ -0,0 +1,94 @@
+# frozen_string_literal: true
+
+module Reeve
+  module Audit
+    class Chain
+      module Retention
+        # Checks the retention records (specs/005 FR-009): numbered 0 to n, each signed under a
+        # key this verifier holds, each linked to the one before and record 0 to the genesis,
+        # each boundary following on from the last. Leaves the boundary the walk starts after:
+        # the last record of the unbroken run from record 0.
+        #
+        # A record whose key is not held cannot be checked; it still sets the boundary (the
+        # rows it accounts for are gone either way) and makes the run unverifiable, never
+        # intact and never broken. A record that fails ends the run: the walk starts at the one
+        # before it, so the rows the failing record claims to account for are reported missing.
+        class Check
+          Summary = Struct.new(:purge, :through_sequence, :purged_at, :removed_chained,
+                               :removed_pre_chain, :archived, :status, keyword_init: true) do
+            def as_json(*)
+              to_h.transform_keys(&:to_s).merge("status" => status.to_s)
+            end
+          end
+
+          Result = Struct.new(:boundary, :summaries, keyword_init: true) do
+            def as_json(*)
+              { "through" => boundary&.through_sequence, "records" => summaries.map(&:as_json) }
+            end
+          end
+
+          # `report` receives (kind, sequence, detail, invocation_id, key_id, retention:).
+          def initialize(keyring:, report:)
+            @keyring = keyring
+            @report = report
+          end
+
+          def call(records, genesis_digest:)
+            boundary = nil
+            previous = nil
+            summaries = records.each_with_index.map do |record, index|
+              status = judge(record, index, previous,
+                             previous ? previous.retention_digest : genesis_digest)
+              boundary = record if boundary.equal?(previous) && status != :altered
+              previous = record
+              summary(record, status)
+            end
+            Result.new(boundary: boundary, summaries: summaries)
+          end
+
+          private
+
+          attr_reader :keyring
+
+          def judge(record, index, previous, link)
+            if record.purge_number != index
+              return altered(record,
+                             "is numbered #{record.purge_number}, not #{index}")
+            end
+            return altered(record, "does not follow on from the purge before it") unless follows?(
+              record, previous
+            )
+
+            secret = keyring.for(record.key_id)
+            if secret.nil?
+              @report.call(:unknown_key, nil, "signed by key #{record.key_id}", nil, record.key_id,
+                           retention: record.purge_number)
+              return :key_not_configured
+            end
+            return :verified if Digest.call(secret, record, previous_digest: link) ==
+                                record.retention_digest
+
+            altered(record, "does not match its digest; it was edited, or a record before it was")
+          end
+
+          def follows?(record, previous)
+            through = previous ? previous.through_sequence : 0
+            record.previous_through == through && record.through_sequence > through
+          end
+
+          def altered(record, detail)
+            @report.call(:retention_altered, nil, detail, nil, nil, retention: record.purge_number)
+            :altered
+          end
+
+          def summary(record, status)
+            Summary.new(purge: record.purge_number, through_sequence: record.through_sequence,
+                        purged_at: record.purged_at, removed_chained: record.removed_chained,
+                        removed_pre_chain: record.removed_pre_chain, archived: record.archived,
+                        status: status)
+          end
+        end
+      end
+    end
+  end
+end