A3k finding 2: distribution reads its caller list as mesh-config resolves it, not from an environment nothing renders

The node-engine fills ${config:} only in files, unit names, owners and groups, never in a
process's environment, so MESH_CONFIG_CALLERS was never set and design 51's defaults always held.
The tools bundle now reads `callers` through stdio.Config on each call (holder.ConfiguredCallers,
Verbs.WithCallers per call); the program, which has no runtime resolving config, asks its own
tools bundle's new registry_callers on each wake of the windows (manifest invokes). The
environment variable is gone.

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig

modules/distribution/cmd/distribution/main.go

@@ -64,12 +64,8 @@ func run(ctx context.Context, getenv func(string) string) error {
 			return err
 		}
 		defer calls.Close()
-		callers, err := holder.ParseCallers(getenv("MESH_CONFIG_CALLERS"))
-		if err != nil {
-			return err
-		}
 		findings := process.OptionalBucket(ctx, js, "distribution_findings", "a window held for seven days is said in the log only", logger.Printf)
-		go drive(ctx, js, cred, &holder.Driver{Delivery: busDelivery{calls}, State: kvWindows{windows}, Callers: callers,
+		go drive(ctx, js, cred, &holder.Driver{Delivery: busDelivery{calls}, State: kvWindows{windows}, Callers: busCallers{calls}.Read,
 			Closed: sayClosed(js, cred), Finding: findingsKV(findings, logger.Printf)}, logger)
 	}
 	front := &holder.Front{Store: store, Window: &open, Logf: logger.Printf,

modules/distribution/cmd/distribution/whole_integration_test.go

@@ -6,8 +6,9 @@ package main
 // run() as the node starts it, its broker account on a nats-server of this test alone, the registry container a fake
 // OCI store on the loopback, the status view's node_haves and the node-engine seat's manifest-reads answered on their
 // call subjects. An away node holds the old name open; its return (manifest-reads-changed) closes it, said once on
-// distribution.events, after which a direct write is refused naming publish; reads stay open; and a waiter on a seat's
-// `published` hears none of the windows' events.
+// distribution.events, after which a direct write is refused naming publish; reads stay open; a waiter on a seat's
+// `published` hears none of the windows' events; and the build modules counted are publish's callers as the tools
+// bundle answers the config value, not design 51's defaults.
 
 import (
 	"context"
@@ -76,10 +77,22 @@ func TestDistributionWhole(t *testing.T) {
 		answer(m, map[string]any{"keys": map[string]any{
 			"ace.mesh-build-go": map[string]any{"fp": "fp-new"}, "g14.mesh-build-go": map[string]any{"fp": fp},
 			"ace.gitea": map[string]any{"fp": "x"}, "g14.gitea": map[string]any{"fp": "x"},
+			// A build module the operator took off publish's list: it holds no window (the caller list as configured).
+			"g14.mesh-build-node": map[string]any{"fp": "fp-node-old"},
 		}})
 	}); err != nil {
 		t.Fatal(err)
 	}
+	// distribution's own tools bundle answers the config value callers as mesh-config resolved it: publish by
+	// mesh-build-go alone. The program reads it there, never from an environment variable nothing renders.
+	if _, err := nc.Subscribe("mesh.mod.distribution.>", func(m *nats.Msg) {
+		if !strings.Contains(m.Subject, holder.CallersTool) {
+			return
+		}
+		answer(m, map[string]any{"callers": map[string]any{"publish": []string{"mesh-build-go"}}})
+	}); err != nil {
+		t.Fatal(err)
+	}
 	engine := func(node string) {
 		for _, subj := range []string{"mesh.seat.node-engine.call.manifest-reads." + node + ".>", "mesh.seat.node-engine.tool.manifest-reads." + node} {
 			if _, err := nc.Subscribe(subj, func(m *nats.Msg) {

modules/distribution/cmd/distribution/windows.go

@@ -28,6 +28,8 @@ import (
 const (
 	havesAsk = "mesh-delivery-view.node_haves"
 	readsAsk = "seat:node-engine.manifest-reads"
+	// callersAsk is distribution's own tool answering its config value callers as resolved.
+	callersAsk = holder.Self + "." + holder.CallersTool
 )
 
 // caller is a process's call of a tool or a seat verb.
@@ -36,6 +38,25 @@ type caller interface {
 	CallOn(node, key string, body any) (json.RawMessage, error)
 }
 
+// busCallers reads the caller list from distribution's own tools bundle (holder.CallersTool, manifest invokes): a
+// program has no runtime that resolves its module's config values, the tools bundle has (stdio.Config), so the program
+// asks it on each wake rather than read an environment variable nothing renders.
+type busCallers struct{ c caller }
+
+func (b busCallers) Read() (holder.Callers, error) {
+	raw, err := b.c.Call(callersAsk, map[string]any{})
+	if err != nil {
+		return nil, fmt.Errorf("%s: %w", callersAsk, err)
+	}
+	var a struct {
+		Callers json.RawMessage `json:"callers"`
+	}
+	if err := json.Unmarshal(unwrap(raw), &a); err != nil || len(a.Callers) == 0 {
+		return nil, fmt.Errorf("%s answered what is not a caller list: %s", callersAsk, unwrap(raw))
+	}
+	return holder.ParseCallers(string(a.Callers))
+}
+
 // busDelivery answers holder.Delivery through the bus.
 type busDelivery struct{ c caller }