#
#
# patch "README.encapsulation"
#  from [d30f7ef43adcc15592adc8495355d58811122096]
#    to [a508a435c16fbec1ac8161ee2384618e86907581]
# 
# patch "app_state.cc"
#  from [ef0646d52f8d3a4a1197a415ca22b0fd879a3b46]
#    to [4173b14541089d94af06287dca7782a65a9bbad6]
# 
# patch "app_state.hh"
#  from [3446811266e70205cdfeada952b018ea846c6efc]
#    to [2a5bc31705ec0c67381e3f442dcbdf8029bdc81b]
# 
# patch "automate.cc"
#  from [7a0b4b83bd698f3c37cc19747cd0516006339f08]
#    to [58f559595f558158d76e5bb03c9884bb8a7681ef]
# 
# patch "cert.cc"
#  from [058fce8cad7351e2c5894575a4669d0de37fab19]
#    to [64cc2fa29bb75e7d79f4997c19207e7d566821e7]
# 
# patch "cert.hh"
#  from [842ed3d1c08d9ec589673ef4b7afd7b2a6470788]
#    to [64e7525541766330034ae0436dfee7066e6b894a]
# 
# patch "cmd.hh"
#  from [a77c1d7d4c48bc9f0494f2814adfe04c0925b4dc]
#    to [6ef78795227127faea508c24356e4c4952373140]
# 
# patch "cmd_key_cert.cc"
#  from [63b100b1dfc6c648204e8ba38b7b54ece19b45a2]
#    to [7ff053c42f366c5cc0ee8fcc72e92ea7596f9b02]
# 
# patch "cmd_list.cc"
#  from [d673c46c744088510cfd0fc8b8b972f94708d52d]
#    to [85768a54cbb3caa32349ca67376ad1461c168eec]
# 
# patch "cmd_merging.cc"
#  from [933ab606f898c8f056b3fa86815de0dc1977fb8c]
#    to [67522c6ca75eacaa3e74427d7ca9ade04aee5970]
# 
# patch "cmd_netsync.cc"
#  from [27562e25ad1c82527a6e54392f555e0cb6763a2d]
#    to [aaedc625c889c1b3dfeb9dc270326adc54824976]
# 
# patch "cmd_ws_commit.cc"
#  from [a849392a7e25e92eacfd1785c8576d5252fd344b]
#    to [7390145329711a7a90339633d7cace8296c92633]
# 
# patch "commands.cc"
#  from [74d824a3731a743a29a505e898a8ecc1735662e4]
#    to [9d0b1bc782bc695b35686be8e7718cad538f0f44]
# 
# patch "database.cc"
#  from [a43b661056bacfe298863382b8dc145285aea772]
#    to [40c9ed9bdbf10b11ed05b19b41e26b198f6c7099]
# 
# patch "database.hh"
#  from [e0a41892c27ca9c23da4ddb55462e102d314e2fd]
#    to [28fe3324ba174366b2ee92bb70256f2083de0a57]
# 
# patch "netsync.cc"
#  from [41565b23d89c106c08c1bd67a85b387d834f18c7]
#    to [0ec6a72cef9e52f71d16535127241642e543cf2a]
# 
# patch "project.cc"
#  from [6262745ddc861ff5aa139ec8c4ef25b300db84a0]
#    to [1500110683fb64d9252d3e44f2e85a2694607352]
# 
# patch "project.hh"
#  from [4fce04f721322c557064635b86cfaf13fd54fc00]
#    to [e66140583a55d848e04c6ca22db6101f32b187a8]
# 
# patch "rcs_import.cc"
#  from [352e42220856fef882d4125ca9df95c1896ceffb]
#    to [f1cd9a1642dc94e9a50577a962d494b2295b1b18]
# 
# patch "selectors.cc"
#  from [ce99f29673f959d809842a0233bd116422f06e2f]
#    to [423dd7fe2a2668ef509bf9269163e0ffc867d387]
# 
# patch "update.cc"
#  from [260394c808cc8f1c9c783a16274f60b8cbaed276]
#    to [2bad4b1ea8a05c37326d410761008d51032074ef]
# 
# patch "update.hh"
#  from [3e7b3c756bdd0a55ae4527cc54a4e99404879b08]
#    to [f0350936544465c9bd29166d2c809ca1a24acc79]
#
============================================================
--- README.encapsulation	d30f7ef43adcc15592adc8495355d58811122096
+++ README.encapsulation	a508a435c16fbec1ac8161ee2384618e86907581
@@ -1,22 +1,3 @@
-database.cc:
-
-  __app is a member variable of class database, used by accessor
-  hacks:
-
-  __app->lua
-    hook_get_manifest_cert_trust()
-    hook_get_revision_cert_trust()
-    hook_get_author()
-    hook_accept_testresult_change()
-
-  __app->opts
-    get_opt_author()
-    get_opt_ignore_suspend_certs()
-    get_opt_date_or_cur_date()
-    has_opt_branch()
-    get_opt_branchname()
-    set_opt_branchname()
-
 key_store.cc:
   app is a member variable of class key_store, used by:
 
============================================================
--- app_state.cc	ef0646d52f8d3a4a1197a415ca22b0fd879a3b46
+++ app_state.cc	4173b14541089d94af06287dca7782a65a9bbad6
@@ -29,15 +29,11 @@ app_state::app_state()
 using std::vector;
 
 app_state::app_state()
-  : db(system_path()),
-    keys(*this), work(lua),
-//    search_root(current_root_path()),
-//    diff_format(unified_diff),
+  : db(lua), keys(*this), work(lua),
     branch_is_sticky(false),
     mtn_automate_allowed(false),
     project(db)
 {
-  db.set_app(this);
   lua.set_app(this);
   keys.set_key_dir(opts.conf_dir / "keys");
 }
============================================================
--- app_state.hh	3446811266e70205cdfeada952b018ea846c6efc
+++ app_state.hh	2a5bc31705ec0c67381e3f442dcbdf8029bdc81b
@@ -33,8 +33,8 @@ public:
 class app_state
 {
 public:
+  lua_hooks lua;
   database db;
-  lua_hooks lua;
   key_store keys;
   workspace work;
   ssh_agent agent;
============================================================
--- automate.cc	7a0b4b83bd698f3c37cc19747cd0516006339f08
+++ automate.cc	58f559595f558158d76e5bb03c9884bb8a7681ef
@@ -87,8 +87,10 @@ CMD_AUTOMATE(heads, N_("[BRANCH]"),
     branch_option = branch_name(idx(args, 0)());
   }
   set<revision_id> heads;
-  app.get_project().get_branch_heads(branch_option, heads);
-  for (set<revision_id>::const_iterator i = heads.begin(); i != heads.end(); ++i)
+  app.get_project().get_branch_heads(branch_option, heads,
+                                     app.opts.ignore_suspend_certs);
+  for (set<revision_id>::const_iterator i = heads.begin();
+       i != heads.end(); ++i)
     output << (*i).inner()() << '\n';
 }
 
@@ -1586,7 +1588,8 @@ CMD_AUTOMATE(branches, "",
 
   set<branch_name> names;
 
-  app.get_project().get_branch_list(names, !app.opts.ignore_suspend_certs);
+  app.get_project().get_branch_list(names,
+                                    !app.opts.ignore_suspend_certs);
 
   for (set<branch_name>::const_iterator i = names.begin();
        i != names.end(); ++i)
============================================================
--- cert.cc	058fce8cad7351e2c5894575a4669d0de37fab19
+++ cert.cc	64cc2fa29bb75e7d79f4997c19207e7d566821e7
@@ -434,14 +434,14 @@ get_user_key(rsa_keypair_id & key, key_s
 }
 
 // Guess which branch is appropriate for a commit below IDENT.
-// APP may override.  Branch name is returned in BRANCHNAME.
-// Does not modify branch state in APP.
+// OPTS may override.  Branch name is returned in BRANCHNAME.
+// Does not modify branch state in OPTS.
 void
-guess_branch(revision_id const & ident, database & db,
+guess_branch(revision_id const & ident, options & opts,
              project_t & project, branch_name & branchname)
 {
-  if (db.has_opt_branch() && !db.get_opt_branchname()().empty())
-    branchname = db.get_opt_branchname();
+  if (opts.branch_given && !opts.branchname().empty())
+    branchname = opts.branchname;
   else
     {
       N(!ident.inner()().empty(),
@@ -465,13 +465,14 @@ guess_branch(revision_id const & ident, 
     }
 }
 
-// As above, but set the branch name in the app state.
+// As above, but set the branch name in the options
+// if it wasn't already set.
 void
-guess_branch(revision_id const & ident, database & db, project_t & project)
+guess_branch(revision_id const & ident, options & opts, project_t & project)
 {
   branch_name branchname;
-  guess_branch(ident, db, project, branchname);
-  db.set_opt_branchname(branchname);
+  guess_branch(ident, opts, project, branchname);
+  opts.branchname = branchname;
 }
 
 void
@@ -547,21 +548,6 @@ void
 }
 
 void
-cert_revision_author_default(revision_id const & m,
-                             database & db, key_store & keys)
-{
-  string author;
-  rsa_keypair_id key;
-  get_user_key(key, keys, db);
-
-  if (!db.hook_get_author(key, author))
-    {
-      author = key();
-    }
-  cert_revision_author(m, author, db, keys);
-}
-
-void
 cert_revision_tag(revision_id const & m,
                   string const & tagname,
                   database & db, key_store & keys)
============================================================
--- cert.hh	842ed3d1c08d9ec589673ef4b7afd7b2a6470788
+++ cert.hh	64e7525541766330034ae0436dfee7066e6b894a
@@ -26,6 +26,7 @@ class project_t;
 class key_store;
 class database;
 class project_t;
+struct options;
 
 struct cert
 {
@@ -113,10 +114,10 @@ void
 get_user_key(rsa_keypair_id & key, key_store & keys, database & db);
 
 void
-guess_branch(revision_id const & id, database & db, project_t & project,
+guess_branch(revision_id const & id, options & opts, project_t & project,
              branch_name & branchname);
 void
-guess_branch(revision_id const & id, database & db, project_t & project);
+guess_branch(revision_id const & id, options & opts, project_t & project);
 
 #define date_cert_name cert_name("date")
 #define author_cert_name cert_name("author")
@@ -142,10 +143,6 @@ void
                     database & db, key_store & keys);
 
 void
-cert_revision_author_default(revision_id const & m,
-                            database & db, key_store & keys);
-
-void
 cert_revision_tag(revision_id const & m,
                  std::string const & tagname,
                  database & db, key_store & keys);
============================================================
--- cmd.hh	a77c1d7d4c48bc9f0494f2814adfe04c0925b4dc
+++ cmd.hh	6ef78795227127faea508c24356e4c4952373140
@@ -160,7 +160,8 @@ void
                   revision_id const & id);
 
 void
-notify_if_multiple_heads(project_t & project, branch_name const & branchname);
+notify_if_multiple_heads(project_t & project, branch_name const & branchname,
+                         bool ignore_suspend_certs);
 
 void
 process_commit_message_args(bool & given,
============================================================
--- cmd_key_cert.cc	63b100b1dfc6c648204e8ba38b7b54ece19b45a2
+++ cmd_key_cert.cc	7ff053c42f366c5cc0ee8fcc72e92ea7596f9b02
@@ -308,7 +308,7 @@ CMD(approve, "approve", "", CMD_REF(revi
 
   revision_id r;
   complete(app, idx(args, 0)(), r);
-  guess_branch(r, app.db, app.get_project());
+  guess_branch(r, app.opts, app.get_project());
   N(app.opts.branchname() != "", F("need --branch argument for approval"));
   app.get_project().put_revision_in_branch(app.keys, r, app.opts.branchname);
 }
@@ -323,7 +323,7 @@ CMD(suspend, "suspend", "", CMD_REF(revi
 
   revision_id r;
   complete(app, idx(args, 0)(), r);
-  guess_branch(r, app.db, app.get_project());
+  guess_branch(r, app.opts, app.get_project());
   N(app.opts.branchname() != "", F("need --branch argument to suspend"));
   app.get_project().suspend_revision_in_branch(app.keys, r, app.opts.branchname);
 }
============================================================
--- cmd_list.cc	d673c46c744088510cfd0fc8b8b972f94708d52d
+++ cmd_list.cc	85768a54cbb3caa32349ca67376ad1461c168eec
@@ -281,7 +281,8 @@ CMD(branches, "branches", "", CMD_REF(li
 
   globish exc(app.opts.exclude_patterns);
   set<branch_name> names;
-  app.get_project().get_branch_list(inc, names, !app.opts.ignore_suspend_certs);
+  app.get_project().get_branch_list(inc, names,
+                                    !app.opts.ignore_suspend_certs);
 
   for (set<branch_name>::const_iterator i = names.begin();
        i != names.end(); ++i)
@@ -719,8 +720,8 @@ CMD_AUTOMATE(certs, N_("REV"),
       signers.insert(keyid);
 
       bool trusted =
-        db.hook_get_revision_cert_trust(signers, ident,
-                                        name, tv);
+        app.lua.hook_get_revision_cert_trust(signers, ident,
+                                             name, tv);
 
       st.push_str_pair(syms::key, keyid());
 
============================================================
--- cmd_merging.cc	933ab606f898c8f056b3fa86815de0dc1977fb8c
+++ cmd_merging.cc	67522c6ca75eacaa3e74427d7ca9ade04aee5970
@@ -164,13 +164,17 @@ CMD(update, "update", "", CMD_REF(worksp
     F("this workspace is a new project; cannot update"));
 
   // Figure out where we're going
+  N(!app.opts.branchname().empty(),
+    F("cannot determine branch for update"));
 
   revision_id chosen_rid;
   if (app.opts.revision_selectors.size() == 0)
     {
       P(F("updating along branch '%s'") % app.opts.branchname);
       set<revision_id> candidates;
-      pick_update_candidates(old_rid, app.db, app.get_project(), candidates);
+      pick_update_candidates(candidates, old_rid, app.opts.branchname,
+                             app.opts.ignore_suspend_certs,
+                             app.db, app.get_project(), app.lua);
       N(!candidates.empty(),
         F("your request matches no descendents of the current revision\n"
           "in fact, it doesn't even match the current revision\n"
@@ -197,7 +201,8 @@ CMD(update, "update", "", CMD_REF(worksp
   // do this notification before checking to see if we can bail out early,
   // because when you are at one of several heads, and you hit update, you
   // want to know that merging would let you update further.
-  notify_if_multiple_heads(app.get_project(), app.opts.branchname);
+  notify_if_multiple_heads(app.get_project(),
+                           app.opts.branchname, app.opts.ignore_suspend_certs);
 
   if (old_rid == chosen_rid)
     {
@@ -355,8 +360,9 @@ merge_two(revision_id const & left, revi
   transaction_guard guard(app.db);
   interactive_merge_and_store(left, right, merged, app.db, app.lua);
 
-  app.get_project().put_standard_certs_from_options(app.keys, merged,
-                                                    branch,
+  app.get_project().put_standard_certs_from_options(app.opts, app.lua,
+                                                    app.keys,
+                                                    merged, branch,
                                                     utf8(log.str()));
 
   guard.commit();
@@ -385,7 +391,8 @@ CMD(merge, "merge", "", CMD_REF(tree), "
     F("please specify a branch, with --branch=BRANCH"));
 
   set<revision_id> heads;
-  app.get_project().get_branch_heads(app.opts.branchname, heads);
+  app.get_project().get_branch_heads(app.opts.branchname, heads,
+                                     app.opts.ignore_suspend_certs);
 
   N(heads.size() != 0, F("branch '%s' is empty") % app.opts.branchname);
   if (heads.size() == 1)
@@ -453,7 +460,8 @@ CMD(merge, "merge", "", CMD_REF(tree), "
 
       ancestors.clear();
       heads_for_ancestor.clear();
-      app.get_project().get_branch_heads(app.opts.branchname, heads);
+      app.get_project().get_branch_heads(app.opts.branchname, heads,
+                                         app.opts.ignore_suspend_certs);
       pass++;
     }
 
@@ -522,8 +530,10 @@ CMD(merge_into_dir, "merge_into_dir", ""
   if (args.size() != 3)
     throw usage(execid);
 
-  app.get_project().get_branch_heads(branch_name(idx(args, 0)()), src_heads);
-  app.get_project().get_branch_heads(branch_name(idx(args, 1)()), dst_heads);
+  app.get_project().get_branch_heads(branch_name(idx(args, 0)()), src_heads,
+                                     app.opts.ignore_suspend_certs);
+  app.get_project().get_branch_heads(branch_name(idx(args, 1)()), dst_heads,
+                                     app.opts.ignore_suspend_certs);
 
   N(src_heads.size() != 0, F("branch '%s' is empty") % idx(args, 0)());
   N(src_heads.size() == 1, F("branch '%s' is not merged") % idx(args, 0)());
@@ -636,7 +646,9 @@ CMD(merge_into_dir, "merge_into_dir", ""
                             % idx(args, 0) % (*src_i)
                             % idx(args, 1) % (*dst_i)).str());
 
-      app.get_project().put_standard_certs_from_options(app.keys, merged,
+      app.get_project().put_standard_certs_from_options(app.opts, app.lua,
+                                                        app.keys,
+                                                        merged,
                                                         branch_name(idx(args, 1)()),
                                                         log_message);
 
@@ -1031,7 +1043,8 @@ CMD(heads, "heads", "", CMD_REF(tree), "
   N(app.opts.branchname() != "",
     F("please specify a branch, with --branch=BRANCH"));
 
-  app.get_project().get_branch_heads(app.opts.branchname, heads);
+  app.get_project().get_branch_heads(app.opts.branchname, heads,
+                                     app.opts.ignore_suspend_certs);
 
   if (heads.size() == 0)
     P(F("branch '%s' is empty") % app.opts.branchname);
============================================================
--- cmd_netsync.cc	27562e25ad1c82527a6e54392f555e0cb6763a2d
+++ cmd_netsync.cc	aaedc625c889c1b3dfeb9dc270326adc54824976
@@ -344,7 +344,8 @@ CMD(clone, "clone", "", CMD_REF(network)
         F("use --revision or --branch to specify what to checkout"));
 
       set<revision_id> heads;
-      app.get_project().get_branch_heads(app.opts.branchname, heads);
+      app.get_project().get_branch_heads(app.opts.branchname, heads,
+                                         app.opts.ignore_suspend_certs);
       N(heads.size() > 0,
         F("branch '%s' is empty") % app.opts.branchname);
       if (heads.size() > 1)
@@ -363,7 +364,7 @@ CMD(clone, "clone", "", CMD_REF(network)
       // use specified revision
       complete(app, idx(app.opts.revision_selectors, 0)(), ident);
 
-      guess_branch(ident, app.db, app.get_project());
+      guess_branch(ident, app.opts, app.get_project());
       I(!app.opts.branchname().empty());
 
       N(app.get_project().revision_is_in_branch(ident, app.opts.branchname),
============================================================
--- cmd_ws_commit.cc	a849392a7e25e92eacfd1785c8576d5252fd344b
+++ cmd_ws_commit.cc	7390145329711a7a90339633d7cace8296c92633
@@ -347,7 +347,7 @@ CMD(disapprove, "disapprove", "", CMD_RE
   N(rev.edges.size() == 1,
     F("revision %s has %d changesets, cannot invert") % r % rev.edges.size());
 
-  guess_branch(r, app.db, app.get_project());
+  guess_branch(r, app.opts, app.get_project());
   N(app.opts.branchname() != "", F("need --branch argument for disapproval"));
 
   process_commit_message_args(log_message_given, log_message, app,
@@ -374,7 +374,9 @@ CMD(disapprove, "disapprove", "", CMD_RE
     calculate_ident(rdat, inv_id);
     app.db.put_revision(inv_id, rdat);
 
-    app.get_project().put_standard_certs_from_options(app.keys, inv_id,
+    app.get_project().put_standard_certs_from_options(app.opts, app.lua,
+                                                      app.keys,
+                                                      inv_id,
                                                       app.opts.branchname,
                                                       log_message);
     guard.commit();
@@ -592,7 +594,8 @@ CMD(checkout, "checkout", "co", CMD_REF(
         F("use --revision or --branch to specify what to checkout"));
 
       set<revision_id> heads;
-      app.get_project().get_branch_heads(app.opts.branchname, heads);
+      app.get_project().get_branch_heads(app.opts.branchname, heads,
+                                         app.opts.ignore_suspend_certs);
       N(heads.size() > 0,
         F("branch '%s' is empty") % app.opts.branchname);
       if (heads.size() > 1)
@@ -611,7 +614,7 @@ CMD(checkout, "checkout", "co", CMD_REF(
       // use specified revision
       complete(app, idx(app.opts.revision_selectors, 0)(), revid);
 
-      guess_branch(revid, app.db, app.get_project());
+      guess_branch(revid, app.opts, app.get_project());
 
       I(!app.opts.branchname().empty());
 
@@ -1086,7 +1089,7 @@ CMD(commit, "commit", "ci", CMD_REF(work
            i++)
         {
           // this will prefer --branch if it was set
-          guess_branch(edge_old_revision(i), app.db, app.get_project(),
+          guess_branch(edge_old_revision(i), app.opts, app.get_project(),
                        bn_candidate);
           N(branchname() == "" || branchname == bn_candidate,
             F("parent revisions of this commit are in different branches:\n"
@@ -1150,7 +1153,8 @@ CMD(commit, "commit", "ci", CMD_REF(work
 
   // for the divergence check, below
   set<revision_id> heads;
-  app.get_project().get_branch_heads(app.opts.branchname, heads);
+  app.get_project().get_branch_heads(app.opts.branchname, heads,
+                                     app.opts.ignore_suspend_certs);
   unsigned int old_head_size = heads.size();
 
   {
@@ -1235,7 +1239,8 @@ CMD(commit, "commit", "ci", CMD_REF(work
         app.db.put_revision(restricted_rev_id, rdat);
       }
 
-    app.get_project().put_standard_certs_from_options(app.keys,
+    app.get_project().put_standard_certs_from_options(app.opts, app.lua,
+                                                      app.keys,
                                                       restricted_rev_id,
                                                       app.opts.branchname,
                                                       log_message);
@@ -1253,7 +1258,8 @@ CMD(commit, "commit", "ci", CMD_REF(work
 
   app.work.blank_user_log();
 
-  app.get_project().get_branch_heads(app.opts.branchname, heads);
+  app.get_project().get_branch_heads(app.opts.branchname, heads,
+                                     app.opts.ignore_suspend_certs);
   if (heads.size() > old_head_size && old_head_size > 0) {
     P(F("note: this revision creates divergence\n"
         "note: you may (or may not) wish to run '%s merge'")
@@ -1329,7 +1335,7 @@ CMD_NO_WORKSPACE(import, "import", "", C
       // use specified revision
       complete(app, idx(app.opts.revision_selectors, 0)(), ident);
 
-      guess_branch(ident, app.db, app.get_project());
+      guess_branch(ident, app.opts, app.get_project());
 
       I(!app.opts.branchname().empty());
 
@@ -1344,7 +1350,8 @@ CMD_NO_WORKSPACE(import, "import", "", C
         F("use --revision or --branch to specify what to checkout"));
 
       set<revision_id> heads;
-      app.get_project().get_branch_heads(app.opts.branchname, heads);
+      app.get_project().get_branch_heads(app.opts.branchname, heads,
+                                         app.opts.ignore_suspend_certs);
       if (heads.size() > 1)
         {
           P(F("branch %s has multiple heads:") % app.opts.branchname);
============================================================
--- commands.cc	74d824a3731a743a29a505e898a8ecc1735662e4
+++ commands.cc	9d0b1bc782bc695b35686be8e7718cad538f0f44
@@ -889,10 +889,11 @@ notify_if_multiple_heads(project_t & pro
 
 void
 notify_if_multiple_heads(project_t & project,
-                         branch_name const & branchname)
+                         branch_name const & branchname,
+                         bool ignore_suspend_certs)
 {
   set<revision_id> heads;
-  project.get_branch_heads(branchname, heads);
+  project.get_branch_heads(branchname, heads, ignore_suspend_certs);
   if (heads.size() > 1) {
     string prefixedline;
     prefix_lines_with(_("note: "),
============================================================
--- database.cc	a43b661056bacfe298863382b8dc145285aea772
+++ database.cc	40c9ed9bdbf10b11ed05b19b41e26b198f6c7099
@@ -182,7 +182,7 @@ class database_impl
 {
   friend class database;
 
-  database_impl(system_path const & fn);
+  database_impl();
   ~database_impl();
 
   //
@@ -381,8 +381,8 @@ class database_impl
 
 };
 
-database_impl::database_impl(system_path const & fn) :
-  filename(fn),
+database_impl::database_impl() :
+  filename(),
   __sql(NULL),
   transaction_level(0),
   roster_cache(constants::db_roster_cache_sz,
@@ -406,8 +406,8 @@ database_impl::~database_impl()
     close();
 }
 
-database::database(system_path const & fn)
-  : imp(new database_impl(fn))
+database::database(lua_hooks & lua)
+  : imp(new database_impl), lua(lua)
 {}
 
 database::~database()
@@ -3654,82 +3654,31 @@ database_impl::close()
   I(!__sql);
 }
 
-// FIXME: the quick hack lua link in functions
-void
-database::set_app(app_state * app)
-{
-  __app = app;
-}
+// the database holds onto the lua_hooks object and uses it to re-expose
+// these two hooks.  it is impractical to pass the lua_hooks object down to
+// all the places where this is used, and they're all going to get
+// reexamined when we do policy branches anyway.  also, arguably this is
+// cleaner, because those places don't have access to *all* the lua hooks,
+// just these two.  (manifest cert trust is only relevant to pre-roster
+// migration, but revision cert trust comes up everywhere erase_bogus_certs
+// is called.)  (A near-term refactor that might make sense: make
+// erase_bogus_certs a project_t member and have the project_t hold the
+// lua_hooks reference.)
 
 bool
 database::hook_get_manifest_cert_trust(set<rsa_keypair_id> const & signers,
     hexenc<id> const & id, cert_name const & name, cert_value const & val)
 {
-  return __app->lua.hook_get_manifest_cert_trust(signers, id, name, val);
+  return lua.hook_get_manifest_cert_trust(signers, id, name, val);
 };
 
 bool
 database::hook_get_revision_cert_trust(set<rsa_keypair_id> const & signers,
     hexenc<id> const & id, cert_name const & name, cert_value const & val)
 {
-  return __app->lua.hook_get_revision_cert_trust(signers, id, name, val);
+  return lua.hook_get_revision_cert_trust(signers, id, name, val);
 };
 
-bool
-database::hook_get_author(rsa_keypair_id const & k,
-                          string & author)
-{
-  return __app->lua.hook_get_author(__app->opts.branchname, k, author);
-}
-
-bool
-database::hook_accept_testresult_change(map<rsa_keypair_id, bool> const & old_results,
-                                     map<rsa_keypair_id, bool> const & new_results)
-{
-  return __app->lua.hook_accept_testresult_change(old_results, new_results);
-}
-
-utf8 const &
-database::get_opt_author()
-{
-  return __app->opts.author;
-}
-
-bool const
-database::get_opt_ignore_suspend_certs()
-{
-  return __app->opts.ignore_suspend_certs;
-}
-
-date_t const
-database::get_opt_date_or_cur_date()
-{
-  if (__app->opts.date_given)
-    return __app->opts.date;
-  else
-    return date_t::now();
-}
-
-bool
-database::has_opt_branch()
-{
-  return __app->opts.branch_given;
-}
-
-branch_name const &
-database::get_opt_branchname()
-{
-  return __app->opts.branchname;
-}
-
-void
-database::set_opt_branchname(branch_name const & branchname)
-{
-  __app->opts.branchname = branchname;
-}
-
-
-
 // transaction guards
 
 transaction_guard::transaction_guard(database & d, bool exclusive,
============================================================
--- database.hh	e0a41892c27ca9c23da4ddb55462e102d314e2fd
+++ database.hh	28fe3324ba174366b2ee92bb70256f2083de0a57
@@ -19,7 +19,7 @@
 #include "graph.hh"
 #include "cert.hh"
 
-class app_state;
+class lua_hooks;
 struct date_t;
 struct globish;
 class key_store;
@@ -75,7 +75,7 @@ public:
   // --== Opening the database and schema checking ==--
   //
 public:
-  database(system_path const & file);
+  database(lua_hooks & lua);
   ~database();
 
   void set_filename(system_path const & file);
@@ -427,29 +427,16 @@ public:
   void put_roster_for_revision(revision_id const & new_id,
                                revision_t const & rev);
 
-  // FIXME: quick hack to make these hooks available via the database context
-  void set_app(app_state * app);
-
+  // We make these lua hooks available via the database context;
+  // see comments above their definition for rationale and plans.
   bool hook_get_manifest_cert_trust(std::set<rsa_keypair_id> const & signers,
     hexenc<id> const & id, cert_name const & name, cert_value const & val);
   bool hook_get_revision_cert_trust(std::set<rsa_keypair_id> const & signers,
     hexenc<id> const & id, cert_name const & name, cert_value const & val);
-  bool hook_get_author(rsa_keypair_id const & k,
-                       std::string & author);
-  bool hook_accept_testresult_change(std::map<rsa_keypair_id, bool> const & old_results,
-                                     std::map<rsa_keypair_id, bool> const & new_results);
 
-  utf8 const & get_opt_author();
-  date_t const get_opt_date_or_cur_date();
-  bool has_opt_branch();
-  branch_name const & get_opt_branchname();
-  bool const get_opt_set_default();
-  bool const get_opt_ignore_suspend_certs();
-  void set_opt_branchname(branch_name const & branchname);
-
 private:
   database_impl *imp;
-  app_state * __app;
+  lua_hooks & lua;
 };
 
 // not a member function, defined in database_check.cc
============================================================
--- netsync.cc	41565b23d89c106c08c1bd67a85b387d834f18c7
+++ netsync.cc	0ec6a72cef9e52f71d16535127241642e543cf2a
@@ -1356,7 +1356,7 @@ session::process_hello_cmd(rsa_keypair_i
   // clients always include in the synchronization set, every branch that the
   // user requested
   set<branch_name> all_branches, ok_branches;
-  project.get_branch_list(all_branches, false);
+  project.get_branch_list(all_branches);
   for (set<branch_name>::const_iterator i = all_branches.begin();
       i != all_branches.end(); i++)
     {
@@ -1451,7 +1451,7 @@ session::process_anonymous_cmd(protocol_
     }
 
   set<branch_name> all_branches, ok_branches;
-  project.get_branch_list(all_branches, false);
+  project.get_branch_list(all_branches);
   globish_matcher their_matcher(their_include_pattern, their_exclude_pattern);
   for (set<branch_name>::const_iterator i = all_branches.begin();
       i != all_branches.end(); i++)
@@ -1592,7 +1592,7 @@ session::process_auth_cmd(protocol_role 
     }
 
   set<branch_name> all_branches, ok_branches;
-  project.get_branch_list(all_branches, false);
+  project.get_branch_list(all_branches);
   for (set<branch_name>::const_iterator i = all_branches.begin();
        i != all_branches.end(); i++)
     {
============================================================
--- project.cc	6262745ddc861ff5aa139ec8c4ef25b300db84a0
+++ project.cc	1500110683fb64d9252d3e44f2e85a2694607352
@@ -9,6 +9,7 @@
 #include "project.hh"
 #include "revision.hh"
 #include "transforms.hh"
+#include "lua_hooks.hh"
 
 using std::string;
 using std::set;
@@ -21,7 +22,8 @@ void
 {}
 
 void
-project_t::get_branch_list(std::set<branch_name> & names, bool check_certs_valid)
+project_t::get_branch_list(std::set<branch_name> & names,
+                           bool check_heads)
 {
   if (indicator.outdated())
     {
@@ -37,10 +39,10 @@ project_t::get_branch_list(std::set<bran
           const branch_name branch(*i);
           std::set<revision_id> heads;
 
-          if (check_certs_valid)
-            get_branch_heads(branch, heads, &inverse_graph_cache);
-          
-          if (!check_certs_valid || !heads.empty())
+          if (check_heads)
+            get_branch_heads(branch, heads, false, &inverse_graph_cache);
+
+          if (!check_heads || !heads.empty())
             branches.insert(branch);
         }
     }
@@ -51,7 +53,7 @@ project_t::get_branch_list(globish const
 void
 project_t::get_branch_list(globish const & glob,
                            std::set<branch_name> & names,
-                           bool check_certs_valid)
+                           bool check_heads)
 {
   std::vector<std::string> got;
   db.get_branches(glob, got);
@@ -65,10 +67,10 @@ project_t::get_branch_list(globish const
       const branch_name branch(*i);
       std::set<revision_id> heads;
 
-      if (check_certs_valid)
-        get_branch_heads(branch, heads, &inverse_graph_cache);
+      if (check_heads)
+        get_branch_heads(branch, heads, false, &inverse_graph_cache);
 
-      if (!check_certs_valid || !heads.empty())
+      if (!check_heads || !heads.empty())
         names.insert(branch);
     }
 }
@@ -117,12 +119,15 @@ void
 }
 
 void
-project_t::get_branch_heads(branch_name const & name, std::set<revision_id> & heads,
-                            multimap<revision_id, revision_id> *inverse_graph_cache_ptr)
+project_t::get_branch_heads(branch_name const & name,
+                            std::set<revision_id> & heads,
+                            bool ignore_suspend_certs,
+                            multimap<revision_id, revision_id> * inverse_graph_cache_ptr)
 {
-  std::pair<branch_name, suspended_indicator> cache_index(name,
-    db.get_opt_ignore_suspend_certs());
-  std::pair<outdated_indicator, std::set<revision_id> > & branch = branch_heads[cache_index];
+  std::pair<branch_name, suspended_indicator>
+    cache_index(name, ignore_suspend_certs);
+  std::pair<outdated_indicator, std::set<revision_id> > &
+    branch = branch_heads[cache_index];
   if (branch.first.outdated())
     {
       L(FL("getting heads of branch %s") % name);
@@ -135,9 +140,10 @@ project_t::get_branch_heads(branch_name 
                                                     branch.second);
 
       not_in_branch p(db, branch_encoded);
-      erase_ancestors_and_failures(branch.second, p, db, inverse_graph_cache_ptr);
-      
-      if (!db.get_opt_ignore_suspend_certs())
+      erase_ancestors_and_failures(branch.second, p, db,
+                                   inverse_graph_cache_ptr);
+
+      if (!ignore_suspend_certs)
         {
           suspended_in_branch s(db, branch_encoded);
           std::set<revision_id>::iterator it = branch.second.begin();
@@ -324,29 +330,46 @@ project_t::put_standard_certs(key_store 
                               branch_name const & branch,
                               utf8 const & changelog,
                               date_t const & time,
-                              utf8 const & author)
+                              string const & author)
 {
+  I(!branch().empty());
+  I(!changelog().empty());
+  I(time.valid());
+  I(!author.empty());
+
   cert_revision_in_branch(id, branch, db, keys);
   cert_revision_changelog(id, changelog, db, keys);
   cert_revision_date_time(id, time, db, keys);
-  if (!author().empty())
-    cert_revision_author(id, author(), db, keys);
-  else
-    cert_revision_author_default(id, db, keys);
+  cert_revision_author(id, author, db, keys);
 }
 
 void
-project_t::put_standard_certs_from_options(key_store & keys,
+project_t::put_standard_certs_from_options(options const & opts,
+                                           lua_hooks & lua,
+                                           key_store & keys,
                                            revision_id const & id,
                                            branch_name const & branch,
                                            utf8 const & changelog)
 {
-  put_standard_certs(keys, id,
-                     branch,
-                     changelog,
-                     db.get_opt_date_or_cur_date(),
-                     db.get_opt_author());
+  date_t date;
+  if (opts.date_given)
+    date = opts.date;
+  else
+    date = date_t::now();
+
+  string author = opts.author();
+  if (author.empty())
+    {
+      rsa_keypair_id key;
+      get_user_key(key, keys, db);
+
+      if (!lua.hook_get_author(branch, key, author))
+        author = key();
+    }
+
+  put_standard_certs(keys, id, branch, changelog, date, author);
 }
+
 void
 project_t::put_cert(key_store & keys,
                     revision_id const & id,
============================================================
--- project.hh	4fce04f721322c557064635b86cfaf13fd54fc00
+++ project.hh	e66140583a55d848e04c6ca22db6101f32b187a8
@@ -13,6 +13,8 @@ class key_store;
 
 class database;
 class key_store;
+class options;
+class lua_hooks;
 
 class tag_t
 {
@@ -36,10 +38,12 @@ public:
 public:
   project_t(database & db);
 
-  void get_branch_list(std::set<branch_name> & names, bool check_certs_valid);
+  void get_branch_list(std::set<branch_name> & names,
+                       bool check_heads = false);
   void get_branch_list(globish const & glob, std::set<branch_name> & names,
-                        bool check_certs_valid);
+                       bool check_heads = false);
   void get_branch_heads(branch_name const & name, std::set<revision_id> & heads,
+                        bool ignore_suspend_certs,
                         std::multimap<revision_id, revision_id> *inverse_graph_cache_ptr = NULL);
 
   outdated_indicator get_tags(std::set<tag_t> & tags);
@@ -72,8 +76,10 @@ public:
                           branch_name const & branch,
                           utf8 const & changelog,
                           date_t const & time,
-                          utf8 const & author);
-  void put_standard_certs_from_options(key_store & keys,
+                          std::string const & author);
+  void put_standard_certs_from_options(options const & opts,
+                                       lua_hooks & lua,
+                                       key_store & keys,
                                        revision_id const & id,
                                        branch_name const & branch,
                                        utf8 const & changelog);
============================================================
--- rcs_import.cc	352e42220856fef882d4125ca9df95c1896ceffb
+++ rcs_import.cc	f1cd9a1642dc94e9a50577a962d494b2295b1b18
@@ -1377,7 +1377,7 @@ cluster_consumer::store_auxiliary_certs(
                              branch_name(branchname),
                              utf8(cvs.changelog_interner.lookup(p.changelog)),
                              date_t::from_unix_epoch(p.time),
-                             utf8(cvs.author_interner.lookup(p.author)));
+                             cvs.author_interner.lookup(p.author));
 }
 
 void
============================================================
--- selectors.cc	ce99f29673f959d809842a0233bd116422f06e2f
+++ selectors.cc	423dd7fe2a2668ef509bf9269163e0ffc867d387
@@ -32,6 +32,7 @@ enum selector_type
     sel_author,
     sel_branch,
     sel_head,
+    sel_any_head,
     sel_date,
     sel_tag,
     sel_ident,
@@ -79,7 +80,7 @@ decode_selector(string const & orig_sel,
           type = sel_branch;
           break;
         case 'h':
-          type = sel_head;
+          type = app.opts.ignore_suspend_certs ? sel_any_head : sel_head;
           break;
         case 'd':
           type = sel_date;
@@ -148,6 +149,7 @@ decode_selector(string const & orig_sel,
 
         case sel_branch:
         case sel_head:
+        case sel_any_head:
           if (sel.empty())
             {
               string msg = (sel_branch == type
@@ -271,11 +273,12 @@ complete_one_selector(selector_type ty, 
       break;
 
     case sel_head:
+    case sel_any_head:
       {
         // get branch names
         set<branch_name> branch_names;
         I(!value.empty());
-        project.get_branch_list(globish(value), branch_names, true);
+        project.get_branch_list(globish(value), branch_names);
 
         L(FL("found %d matching branches") % branch_names.size());
 
@@ -284,7 +287,7 @@ complete_one_selector(selector_type ty, 
              bn != branch_names.end(); bn++)
           {
             set<revision_id> branch_heads;
-            project.get_branch_heads(*bn, branch_heads);
+            project.get_branch_heads(*bn, branch_heads, ty == sel_any_head);
             completions.insert(branch_heads.begin(), branch_heads.end());
             L(FL("after get_branch_heads for %s, heads has %d entries")
               % (*bn) % completions.size());
============================================================
--- update.cc	260394c808cc8f1c9c783a16274f60b8cbaed276
+++ update.cc	2bad4b1ea8a05c37326d410761008d51032074ef
@@ -22,6 +22,7 @@
 #include "update.hh"
 #include "vocab.hh"
 #include "revision.hh"
+#include "lua_hooks.hh"
 
 // these functions just encapsulate the (somewhat complex) logic behind
 // picking an update target. the actual updating takes place in
@@ -81,7 +82,8 @@ acceptable_descendent(branch_name const 
                       revision_id const & base,
                       map<rsa_keypair_id, bool> & base_results,
                       revision_id const & target,
-                      database & db, project_t & project)
+                      database & db, project_t & project,
+                      lua_hooks & lua)
 {
   L(FL("Considering update target %s") % target);
 
@@ -95,7 +97,7 @@ acceptable_descendent(branch_name const 
   // step 2: check the testresults
   map<rsa_keypair_id, bool> target_results;
   get_test_results_for_revision(target, target_results, db, project);
-  if (db.hook_accept_testresult_change(base_results, target_results))
+  if (lua.hook_accept_testresult_change(base_results, target_results))
     {
       L(FL("%s is acceptable update candidate") % target);
       return true;
@@ -107,12 +109,17 @@ acceptable_descendent(branch_name const 
     }
 }
 
-static void
-calculate_update_set(revision_id const & base,
-                     branch_name const & branch,
-                     database & db, project_t & project,
-                     set<revision_id> & candidates)
+void
+pick_update_candidates(set<revision_id> & candidates,
+                       revision_id const & base,
+                       branch_name const & branch,
+                       bool ignore_suspend_certs,
+                       database & db, project_t & project,
+                       lua_hooks & lua)
 {
+  I(!null_id(base));
+  I(!branch().empty());
+
   map<rsa_keypair_id, bool> base_results;
   get_test_results_for_revision(base, base_results, db, project);
 
@@ -120,7 +127,7 @@ calculate_update_set(revision_id const &
   // we possibly insert base into the candidate set as well; returning a set
   // containing just it means that we are up to date; returning an empty set
   // means that there is no acceptable update.
-  if (acceptable_descendent(branch, base, base_results, base, db, project))
+  if (acceptable_descendent(branch, base, base_results, base, db, project, lua))
     candidates.insert(base);
 
   // keep a visited set to avoid repeating work
@@ -143,7 +150,7 @@ calculate_update_set(revision_id const &
 
       // then, possibly insert this revision as a candidate
       if (acceptable_descendent(branch, base, base_results,
-                                target, db, project))
+                                target, db, project, lua))
         candidates.insert(target);
 
       // and traverse its children as well
@@ -153,7 +160,7 @@ calculate_update_set(revision_id const &
 
   erase_ancestors(candidates, db);
 
-  if (db.get_opt_ignore_suspend_certs())
+  if (ignore_suspend_certs)
     return;
   
    set<revision_id> active_candidates;
@@ -166,21 +173,6 @@ calculate_update_set(revision_id const &
      candidates = active_candidates;
 }
 
-void pick_update_candidates(revision_id const & base_ident,
-                            database & db, project_t & project,
-                            set<revision_id> & candidates)
-{
-  branch_name const & branchname = db.get_opt_branchname();
-  N(branchname() != "",
-    F("cannot determine branch for update"));
-  I(!null_id(base_ident));
-
-  calculate_update_set(base_ident, branchname,
-                       db, project, candidates);
-}
-
-
-
 // Local Variables:
 // mode: C++
 // fill-column: 76
============================================================
--- update.hh	3e7b3c756bdd0a55ae4527cc54a4e99404879b08
+++ update.hh	f0350936544465c9bd29166d2c809ca1a24acc79
@@ -15,6 +15,7 @@ class project_t;
 
 class database;
 class project_t;
+class lua_hooks;
 
 // this function just encapsulates the (somewhat complex) logic
 // behind picking an update target. the actual updating takes
@@ -25,9 +26,12 @@ class project_t;
 // returned in 'candidates'.  if no revisions are better than the current
 // revision, then 'candidates' will contain exactly the current revision.
 
-void pick_update_candidates(revision_id const & base_ident,
+void pick_update_candidates(std::set<revision_id> & candidates,
+                            revision_id const & base_ident,
+                            branch_name const & branchname,
+                            bool ignore_suspend_certs,
                             database & db, project_t & project,
-                            std::set<revision_id> &candidates);
+                            lua_hooks & lua);
 
 // Local Variables:
 // mode: C++