ADR 0121: a seat carries the protocol of its role

The mesh's own seats said who does a job and nothing about what may be said to
them or by them, and that gap showed up three times in one day looking like three
different problems: a build machine with three audiences for one outcome and no way
to derive a grant for any of them; an event genuinely about a role with nowhere to
live but the namespace of whichever module holds that role today; and a catalogue
catching up on builds, where every option needed a grant the design refuses.

One cause — the mesh has roles it cannot describe. So the `mesh-*` seats take the
same three fields a module's seat has, and the machinery that already derives
authority, queues and consumers from a declared seat does it for these too.

Builds become work submitted to a role, and `mesh.build.request`,
`mesh.control.built` and the BUILDS stream retire. A work queue shared by several
build machines is exactly what a seat's `accepts` is, so a second mechanism for it
was two places a permission could be wrong. The outcome is the seat's own event,
which means one publish still reaches whoever asked, the controller that records it
and the catalogue that places it — the fan-out a shared exchange gave for free,
written as a subject the mesh derived rather than a topology somebody configured.

That also avoids the grant that ruled out the alternatives: no holder needs
permission to publish into an asker's inbox.

The blocking gap is now named rather than incidental: the shared library has no way
for a module to publish on a seat. The build machine is Go and reaches the bus
directly, so it is unaffected; the artifact-store event waits.

03-DESIGN/01-to-be/25-the-bus-on-nats.md

@@ -18,6 +18,7 @@ decisions:
   - 02-DECISIONS/0043-a-module-broker-account-is-scoped-by-emits-and-consumes.md
   - 02-DECISIONS/0083-one-push-leaves-the-mesh-consistent.md
   - 02-DECISIONS/0039-what-the-sdk-holds-and-refuses.md
+  - 02-DECISIONS/0121-a-seat-carries-the-protocol-of-its-role.md
 ---
 
 # 25. The bus on NATS
@@ -71,9 +72,7 @@ permissions are expressed as which branches of it that account may publish to an
 mesh.control.<node>.report        a node's report              (JetStream: CONTROL)
 mesh.control.<node>.alive         heartbeat                    (core, no persistence)
 mesh.control.enrol                an enrolment request         (JetStream: CONTROL)
-mesh.control.built                a build's outcome            (JetStream: CONTROL)
 mesh.node.<node>.declare          a declaration for a node     (JetStream: NODES, last-per-subject)
-mesh.build.request                work for the build machine   (JetStream: BUILDS, work queue)
 mesh.mod.<module>.event.<event>   an event                     (JetStream: EVENTS)
 mesh.mod.<module>.tool.<tool>     a tool invocation            (core request/reply)
 mesh.seat.<seat>.accept.<verb>    work submitted to a role     (JetStream: per-seat work queue)
@@ -82,6 +81,15 @@ mesh.seat.<seat>.tool.<verb>      a role's tool                (core request/rep
 mesh.ask.<node>.<command>         the controller's command api (core request/reply)
 ```
 
+**Revised 2026-09-27** ([ADR 0121](../../02-DECISIONS/0121-a-seat-carries-the-protocol-of-its-role.md)):
+**`mesh.build.request`, `mesh.control.built` and the BUILDS stream are gone.** A build is work submitted to a role, and the
+mesh already has a shape for that — a seat's `accept` subjects, on a work queue with a queue group of
+holders, which is what a build queue shared by several machines *is*. Keeping a second mechanism for it
+meant two things to reason about and two places for a permission to be wrong. A build's outcome is the
+seat's own event — which is why the control branch loses its copy too: one publish reaches whoever
+asked, the controller that records it and the catalogue that places it — the fan-out a shared exchange gave for free, as a derived subject rather than a
+configured topology.
+
 **Revised 2026-09-26** ([design 29](29-what-a-module-declares.md)): a module's events and tools
 moved from `mesh.events.*` / `mesh.tools.*` into one namespace per module, `mesh.mod.<module>.>`,
 so a module's authority over its own name is a single subject pattern the server enforces — and
@@ -124,9 +132,8 @@ Core NATS is at-most-once. Everything the mesh must not lose lives in a JetStrea
 
 | Stream | Subjects | Retention | Why |
 |---|---|---|---|
-| CONTROL | `mesh.control.>` except `alive` | work queue, one consumer (the controller), explicit ack | the store-window guarantee ([ADR 0083](../../02-DECISIONS/0083-one-push-leaves-the-mesh-consistent.md)): the controller `nak`s with a delay while its store is away and the message is redelivered; nothing is dropped |
+| CONTROL | `mesh.control.>` except `alive` (a build's outcome moved to its seat, ADR 0121) | work queue, one consumer (the controller), explicit ack | the store-window guarantee ([ADR 0083](../../02-DECISIONS/0083-one-push-leaves-the-mesh-consistent.md)): the controller `nak`s with a delay while its store is away and the message is redelivered; nothing is dropped |
 | NODES | `mesh.node.>` | last per subject | one declaration per node, always the newest |
-| BUILDS | `mesh.build.>` | work queue, explicit ack | at least once; a builder that dies mid-build has its message redelivered |
 | EVENTS | `mesh.mod.*.event.>` | limits (age, size), durable consumer per subscribing module | a subscriber that was down catches up; after `max-deliver` attempts the advisory feeds `mesh.events.dead` (its own small stream) |
 
 Tool calls and heartbeats stay on core NATS: a lost heartbeat is the next heartbeat; a lost tool
@@ -207,7 +214,8 @@ expresses this exactly, per subject, and better than a vhost could:
   permissions for each consumed event's subject, its tool subjects, and that same inbox prefix.
   Nothing else. A module that tries to publish outside its emits is refused by the server, not by
   convention.
-- **The controller's user** owns `mesh.control.>`, `mesh.node.>`, `mesh.build.>` and the streams.
+- **The controller's user** owns `mesh.control.>`, `mesh.node.>` and the streams, and may submit work
+  to the seats the mesh's own flows use — a build, for one (ADR 0121).
   **A host's user** may publish its own `mesh.control.<node>.>` and subscribe its own
   `mesh.node.<node>.declare` — and nothing of any other node's.
 - **A person's user** (§7) is a module-shaped user with permissions on the tool subjects it may