From 2d34ff468bc4939bc50a62c00110f4b373aeb01d Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Tue, 3 Nov 2026 11:43:24 +0100
Subject: [PATCH 01/12] The bus, the provisioner and its client say their own
 secrets are the core's credentials, and the vault keeps no list of modules;
 pinned at mesh-sdk 4f141ff (issue 774, the operator 2026-11-03)

---
 modules/mesh-provisioner-client/go.mod            |  2 +-
 modules/mesh-provisioner-client/go.sum            |  2 ++
 modules/mesh-provisioner-client/module.json       |  1 +
 modules/mesh-provisioner/go.mod                   |  2 +-
 modules/mesh-provisioner/go.sum                   |  2 ++
 modules/mesh-provisioner/module.json              |  1 +
 modules/mesh-vault/cmd/mesh-vault/core.go         |  4 ----
 modules/mesh-vault/cmd/mesh-vault/core_test.go    |  8 --------
 modules/mesh-vault/cmd/mesh-vault/move.go         |  5 ++++-
 modules/mesh-vault/cmd/mesh-vault/nodekey_test.go | 13 +++++++------
 modules/mesh-vault/go.mod                         |  2 +-
 modules/mesh-vault/go.sum                         |  6 ++++--
 modules/nats/go.mod                               |  2 +-
 modules/nats/go.sum                               |  2 ++
 modules/nats/module.json                          |  3 ++-
 15 files changed, 29 insertions(+), 26 deletions(-)

diff --git a/modules/mesh-provisioner-client/go.mod b/modules/mesh-provisioner-client/go.mod
index 2d0b5146..66d12cf1 100644
--- a/modules/mesh-provisioner-client/go.mod
+++ b/modules/mesh-provisioner-client/go.mod
@@ -3,7 +3,7 @@ module mesh-provisioner-client
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 	golang.org/x/sys v0.48.0
diff --git a/modules/mesh-provisioner-client/go.sum b/modules/mesh-provisioner-client/go.sum
index 43cc4ec7..0fd448ad 100644
--- a/modules/mesh-provisioner-client/go.sum
+++ b/modules/mesh-provisioner-client/go.sum
@@ -1,5 +1,7 @@
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128 h1:aI1DhZAuqVBXbybSqhLNOGX5rUOrn9T0cHNCDUQF7IQ=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892 h1:XWorhIHDVECRCYzGbkaexEpJ7v03B9LrZ8IVy7vkUKs=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
diff --git a/modules/mesh-provisioner-client/module.json b/modules/mesh-provisioner-client/module.json
index 095128a8..8fca6444 100644
--- a/modules/mesh-provisioner-client/module.json
+++ b/modules/mesh-provisioner-client/module.json
@@ -7,6 +7,7 @@
       "scope": "node"
     }
   ],
+  "core-credentials": true,
   "own-secrets": {
     "provisioner-broker": "${dir:state}/broker"
   },
diff --git a/modules/mesh-provisioner/go.mod b/modules/mesh-provisioner/go.mod
index f9cfe363..5727b790 100644
--- a/modules/mesh-provisioner/go.mod
+++ b/modules/mesh-provisioner/go.mod
@@ -3,7 +3,7 @@ module mesh-provisioner
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892
 	github.com/nats-io/nats.go v1.54.0
 )
 
diff --git a/modules/mesh-provisioner/go.sum b/modules/mesh-provisioner/go.sum
index 43cc4ec7..0fd448ad 100644
--- a/modules/mesh-provisioner/go.sum
+++ b/modules/mesh-provisioner/go.sum
@@ -1,5 +1,7 @@
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128 h1:aI1DhZAuqVBXbybSqhLNOGX5rUOrn9T0cHNCDUQF7IQ=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892 h1:XWorhIHDVECRCYzGbkaexEpJ7v03B9LrZ8IVy7vkUKs=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
diff --git a/modules/mesh-provisioner/module.json b/modules/mesh-provisioner/module.json
index e14cb7e3..7d5c4d3e 100644
--- a/modules/mesh-provisioner/module.json
+++ b/modules/mesh-provisioner/module.json
@@ -45,6 +45,7 @@
     "plans",
     "refused"
   ],
+  "core-credentials": true,
   "own-secrets": {
     "broker": "${dir:state}/broker"
   },
diff --git a/modules/mesh-vault/cmd/mesh-vault/core.go b/modules/mesh-vault/cmd/mesh-vault/core.go
index b0264c61..38fa165a 100644
--- a/modules/mesh-vault/cmd/mesh-vault/core.go
+++ b/modules/mesh-vault/cmd/mesh-vault/core.go
@@ -24,10 +24,6 @@ import (
 	"time"
 )
 
-// CoreModules are the core's modules whose own secrets the controller carries sealed by the vault: the same fixed
-// list as the controller's (ADR 0349 §16). The node-engine and the controller have no own secrets of their own here.
-var CoreModules = []string{"mesh-provisioner", "mesh-provisioner-client", "nats"}
-
 // nodeKeyFile is a machine's sealing key as its engine stated it.
 type nodeKeyFile struct {
 	Node  string    `json:"node"`
diff --git a/modules/mesh-vault/cmd/mesh-vault/core_test.go b/modules/mesh-vault/cmd/mesh-vault/core_test.go
index 5ea24183..e73ce5f7 100644
--- a/modules/mesh-vault/cmd/mesh-vault/core_test.go
+++ b/modules/mesh-vault/cmd/mesh-vault/core_test.go
@@ -14,7 +14,6 @@ import (
 	"encoding/pem"
 	"os"
 	"path/filepath"
-	"reflect"
 	"strings"
 	"sync"
 	"testing"
@@ -56,13 +55,6 @@ func clientsBroker(sealingKey string) MoveOf {
 		Generation: "g-1", SealingKey: sealingKey}
 }
 
-// The list is the controller's (mesh-controller's core list, ADR 0349 §16): named here so a change to either is seen.
-func TestTheCoreIsTheBusTheProvisionerAndItsClient(t *testing.T) {
-	if want := []string{"mesh-provisioner", "mesh-provisioner-client", "nats"}; !reflect.DeepEqual(CoreModules, want) {
-		t.Fatalf("the core's modules are %v, want %v", CoreModules, want)
-	}
-}
-
 // A node-engine states its machine's sealing key in its own name at the move, and only its own machine's.
 func TestAMoveRecordsTheSealingKeyItsNodeEngineStates(t *testing.T) {
 	v := newVault(t, nil)
diff --git a/modules/mesh-vault/cmd/mesh-vault/move.go b/modules/mesh-vault/cmd/mesh-vault/move.go
index 3950af49..269cf31f 100644
--- a/modules/mesh-vault/cmd/mesh-vault/move.go
+++ b/modules/mesh-vault/cmd/mesh-vault/move.go
@@ -292,7 +292,10 @@ func (v *Vault) StateNodeKey(caller, key string) error {
 	}
 	for _, r := range all {
 		parts := strings.Split(r.Name, "/")
-		if len(parts) == 4 && parts[0] == "own" && parts[1] == node && slices.Contains(CoreModules, parts[2]) {
+		// Every own secret of the machine is said changed: which modules carry theirs sealed by the vault is what their
+		// manifests say (core-credentials), read by the node-engine, which composes again and reseals those alone; the vault
+		// keeps no list of modules (issue 774, the operator 2026-11-03).
+		if len(parts) == 4 && parts[0] == "own" && parts[1] == node {
 			v.announce(Changed{Name: r.Name, Generation: r.Generation, At: v.Now().UTC(), By: caller})
 		}
 	}
diff --git a/modules/mesh-vault/cmd/mesh-vault/nodekey_test.go b/modules/mesh-vault/cmd/mesh-vault/nodekey_test.go
index cc721a48..cb24e41e 100644
--- a/modules/mesh-vault/cmd/mesh-vault/nodekey_test.go
+++ b/modules/mesh-vault/cmd/mesh-vault/nodekey_test.go
@@ -2,7 +2,7 @@ package main
 
 // Issue 786 (ADR 0372): a machine's node-engine states its own sealing key to the vault, in its own name, at start and
 // when it changes, whether or not it ever moved a secret in. The caller is the bus user the runtime proved; a changed
-// key (or a first one) raises `secret-changed` for the machine's core secrets, the same key says nothing.
+// key (or a first one) raises `secret-changed` for the machine's own secrets, the same key says nothing.
 
 import (
 	"git.novox.be/novox/mesh-sdk/go/seal"
@@ -76,7 +76,8 @@ func TestANodeEngineStatesItsOwnKeyAndAChangeRaisesItsCoreSecrets(t *testing.T)
 		t.Error("a key was recorded for g14 by ace's engine")
 	}
 	got := changedNames(v.bus)[before:]
-	want := []string{"own/ace/mesh-provisioner-client/provisioner-broker", "own/ace/nats/broker"}
+	// Every own secret of the machine: which carry the vault's box their manifests say, read by the node-engine (issue 774).
+	want := []string{"own/ace/mesh-provisioner-client/provisioner-broker", "own/ace/nats/broker", "own/ace/postgres/superuser-password"}
 	if strings.Join(got, ",") != strings.Join(want, ",") {
 		t.Errorf("secret-changed was raised for %v, want %v", got, want)
 	}
@@ -85,16 +86,16 @@ func TestANodeEngineStatesItsOwnKeyAndAChangeRaisesItsCoreSecrets(t *testing.T)
 	if _, err := tool.runAs("node.ace", map[string]any{"key": pub}); err != nil {
 		t.Fatal(err)
 	}
-	if n := len(changedNames(v.bus)); n != before+2 {
-		t.Errorf("the same key raised %d more", n-before-2)
+	if n := len(changedNames(v.bus)); n != before+3 {
+		t.Errorf("the same key raised %d more", n-before-3)
 	}
 	// A different key raises them again.
 	other, _ := aSealingKey(t)
 	if _, err := tool.runAs("node.ace", map[string]any{"key": other}); err != nil {
 		t.Fatal(err)
 	}
-	if n := len(changedNames(v.bus)); n != before+4 {
-		t.Errorf("a changed key raised %d, want 2", n-before-2)
+	if n := len(changedNames(v.bus)); n != before+6 {
+		t.Errorf("a changed key raised %d, want 3", n-before-3)
 	}
 	if got, _, _ := v.Store.NodeKey("ace"); got != other {
 		t.Error("the changed key was not recorded")
diff --git a/modules/mesh-vault/go.mod b/modules/mesh-vault/go.mod
index 1a304645..f0d5892d 100644
--- a/modules/mesh-vault/go.mod
+++ b/modules/mesh-vault/go.mod
@@ -3,7 +3,7 @@ module mesh-vault
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103142843-f8bd12e4b7b1
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 	golang.org/x/crypto v0.57.0
diff --git a/modules/mesh-vault/go.sum b/modules/mesh-vault/go.sum
index 0111c9e9..0fd448ad 100644
--- a/modules/mesh-vault/go.sum
+++ b/modules/mesh-vault/go.sum
@@ -1,5 +1,7 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103142843-f8bd12e4b7b1 h1:T66tg9T/1hHg6KN/bDScHPT41IHkxLAGGO8VJiAOlb8=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103142843-f8bd12e4b7b1/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128 h1:aI1DhZAuqVBXbybSqhLNOGX5rUOrn9T0cHNCDUQF7IQ=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892 h1:XWorhIHDVECRCYzGbkaexEpJ7v03B9LrZ8IVy7vkUKs=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
diff --git a/modules/nats/go.mod b/modules/nats/go.mod
index 68625c89..4a4a8ab0 100644
--- a/modules/nats/go.mod
+++ b/modules/nats/go.mod
@@ -3,7 +3,7 @@ module nats-tools
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892
 	github.com/klauspost/compress v1.20.0
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
diff --git a/modules/nats/go.sum b/modules/nats/go.sum
index 43cc4ec7..0fd448ad 100644
--- a/modules/nats/go.sum
+++ b/modules/nats/go.sum
@@ -1,5 +1,7 @@
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128 h1:aI1DhZAuqVBXbybSqhLNOGX5rUOrn9T0cHNCDUQF7IQ=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892 h1:XWorhIHDVECRCYzGbkaexEpJ7v03B9LrZ8IVy7vkUKs=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
diff --git a/modules/nats/module.json b/modules/nats/module.json
index 01f36795..8e342bf6 100644
--- a/modules/nats/module.json
+++ b/modules/nats/module.json
@@ -3,7 +3,7 @@
   "version": "1",
   "upgrade": {
     "policy": "record",
-    "why": "the bus: replaced only as a planned step a person starts (`bus upgrade`), its streams snapshotted first and checked after (hq ADR 0236); the controller holds this whatever is said here"
+    "why": "the bus keeps the streams of the whole mesh: it moves on the operator's Approve of its release, its streams snapshotted first (hq ADR 0236, ADR 0599)"
   },
   "provides": [
     {
@@ -21,6 +21,7 @@
     }
   ],
   "bus-users": "/var/lib/nats-module/conf/accounts.conf",
+  "core-credentials": true,
   "own-secrets": {
     "broker": "${dir:mesh-state}/broker",
     "broker-nats-tools": "${dir:tools-secret}/broker-nats-tools"

From 843da56d09b1228d8b2c77a1297d288438ca54cb Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Tue, 3 Nov 2026 12:00:19 +0100
Subject: [PATCH 02/12] nats, mesh-provisioner, its client and mesh-vault pin
 mesh-sdk a973bfa (issue 774)

---
 modules/mesh-provisioner-client/go.mod | 2 +-
 modules/mesh-provisioner-client/go.sum | 2 ++
 modules/mesh-provisioner/go.mod        | 2 +-
 modules/mesh-provisioner/go.sum        | 2 ++
 modules/mesh-vault/go.mod              | 2 +-
 modules/mesh-vault/go.sum              | 2 ++
 modules/nats/go.mod                    | 2 +-
 modules/nats/go.sum                    | 2 ++
 8 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/modules/mesh-provisioner-client/go.mod b/modules/mesh-provisioner-client/go.mod
index 66d12cf1..684adca0 100644
--- a/modules/mesh-provisioner-client/go.mod
+++ b/modules/mesh-provisioner-client/go.mod
@@ -3,7 +3,7 @@ module mesh-provisioner-client
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103105230-a973bfaf42b2
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 	golang.org/x/sys v0.48.0
diff --git a/modules/mesh-provisioner-client/go.sum b/modules/mesh-provisioner-client/go.sum
index 0fd448ad..a8a3c3cf 100644
--- a/modules/mesh-provisioner-client/go.sum
+++ b/modules/mesh-provisioner-client/go.sum
@@ -2,6 +2,8 @@ git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128 h1:aI1DhZAu
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892 h1:XWorhIHDVECRCYzGbkaexEpJ7v03B9LrZ8IVy7vkUKs=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103105230-a973bfaf42b2 h1:CMNEBKlWI36rQEG5lhFRKoICquvYP4hBD7h/jCVFIcc=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103105230-a973bfaf42b2/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
diff --git a/modules/mesh-provisioner/go.mod b/modules/mesh-provisioner/go.mod
index 5727b790..9e024bde 100644
--- a/modules/mesh-provisioner/go.mod
+++ b/modules/mesh-provisioner/go.mod
@@ -3,7 +3,7 @@ module mesh-provisioner
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103105230-a973bfaf42b2
 	github.com/nats-io/nats.go v1.54.0
 )
 
diff --git a/modules/mesh-provisioner/go.sum b/modules/mesh-provisioner/go.sum
index 0fd448ad..a8a3c3cf 100644
--- a/modules/mesh-provisioner/go.sum
+++ b/modules/mesh-provisioner/go.sum
@@ -2,6 +2,8 @@ git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128 h1:aI1DhZAu
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892 h1:XWorhIHDVECRCYzGbkaexEpJ7v03B9LrZ8IVy7vkUKs=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103105230-a973bfaf42b2 h1:CMNEBKlWI36rQEG5lhFRKoICquvYP4hBD7h/jCVFIcc=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103105230-a973bfaf42b2/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
diff --git a/modules/mesh-vault/go.mod b/modules/mesh-vault/go.mod
index f0d5892d..f3d306e5 100644
--- a/modules/mesh-vault/go.mod
+++ b/modules/mesh-vault/go.mod
@@ -3,7 +3,7 @@ module mesh-vault
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103105230-a973bfaf42b2
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 	golang.org/x/crypto v0.57.0
diff --git a/modules/mesh-vault/go.sum b/modules/mesh-vault/go.sum
index 0fd448ad..a8a3c3cf 100644
--- a/modules/mesh-vault/go.sum
+++ b/modules/mesh-vault/go.sum
@@ -2,6 +2,8 @@ git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128 h1:aI1DhZAu
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892 h1:XWorhIHDVECRCYzGbkaexEpJ7v03B9LrZ8IVy7vkUKs=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103105230-a973bfaf42b2 h1:CMNEBKlWI36rQEG5lhFRKoICquvYP4hBD7h/jCVFIcc=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103105230-a973bfaf42b2/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
diff --git a/modules/nats/go.mod b/modules/nats/go.mod
index 4a4a8ab0..c5fd11b6 100644
--- a/modules/nats/go.mod
+++ b/modules/nats/go.mod
@@ -3,7 +3,7 @@ module nats-tools
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103105230-a973bfaf42b2
 	github.com/klauspost/compress v1.20.0
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
diff --git a/modules/nats/go.sum b/modules/nats/go.sum
index 0fd448ad..a8a3c3cf 100644
--- a/modules/nats/go.sum
+++ b/modules/nats/go.sum
@@ -2,6 +2,8 @@ git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128 h1:aI1DhZAu
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892 h1:XWorhIHDVECRCYzGbkaexEpJ7v03B9LrZ8IVy7vkUKs=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103105230-a973bfaf42b2 h1:CMNEBKlWI36rQEG5lhFRKoICquvYP4hBD7h/jCVFIcc=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103105230-a973bfaf42b2/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=

From 281f5866218d22e927479371be7e63db88a4d335 Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Tue, 3 Nov 2026 13:41:41 +0100
Subject: [PATCH 03/12] The bus module keeps record and says why as ADR 0601
 has it: the operator's Approve of the release that carries its build is its
 yes, and its node backs its streams up before it applies

---
 modules/nats/module.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/nats/module.json b/modules/nats/module.json
index 8e342bf6..93f518d7 100644
--- a/modules/nats/module.json
+++ b/modules/nats/module.json
@@ -3,7 +3,7 @@
   "version": "1",
   "upgrade": {
     "policy": "record",
-    "why": "the bus keeps the streams of the whole mesh: it moves on the operator's Approve of its release, its streams snapshotted first (hq ADR 0236, ADR 0599)"
+    "why": "the bus keeps the streams of the whole mesh: each move waits for a person's yes, which the operator's Approve of the release that carries its build gives, and its node backs its streams up before it applies (hq ADR 0236, ADR 0601)"
   },
   "provides": [
     {

From 4c137795a8ffb9ac9bbd2507bcc0e05e738308df Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Tue, 3 Nov 2026 13:46:47 +0100
Subject: [PATCH 04/12] Pin mesh-sdk 09ec82cb3551, the group's head of
 feat/l3b-bus (ADR 0601)

---
 modules/mesh-provisioner-client/go.mod | 2 +-
 modules/mesh-provisioner-client/go.sum | 8 ++------
 modules/mesh-provisioner/go.mod        | 2 +-
 modules/mesh-provisioner/go.sum        | 8 ++------
 modules/mesh-vault/go.mod              | 2 +-
 modules/mesh-vault/go.sum              | 8 ++------
 modules/nats/go.mod                    | 2 +-
 modules/nats/go.sum                    | 8 ++------
 8 files changed, 12 insertions(+), 28 deletions(-)

diff --git a/modules/mesh-provisioner-client/go.mod b/modules/mesh-provisioner-client/go.mod
index 684adca0..ed7ba83a 100644
--- a/modules/mesh-provisioner-client/go.mod
+++ b/modules/mesh-provisioner-client/go.mod
@@ -3,7 +3,7 @@ module mesh-provisioner-client
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103105230-a973bfaf42b2
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103121808-09ec82cb3551
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 	golang.org/x/sys v0.48.0
diff --git a/modules/mesh-provisioner-client/go.sum b/modules/mesh-provisioner-client/go.sum
index a8a3c3cf..271c7949 100644
--- a/modules/mesh-provisioner-client/go.sum
+++ b/modules/mesh-provisioner-client/go.sum
@@ -1,9 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128 h1:aI1DhZAuqVBXbybSqhLNOGX5rUOrn9T0cHNCDUQF7IQ=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892 h1:XWorhIHDVECRCYzGbkaexEpJ7v03B9LrZ8IVy7vkUKs=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103105230-a973bfaf42b2 h1:CMNEBKlWI36rQEG5lhFRKoICquvYP4hBD7h/jCVFIcc=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103105230-a973bfaf42b2/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103121808-09ec82cb3551 h1:DAxLU3IjZ9Kof8F3kVnINcauLqzCdQ1smwMpzX8yi7I=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103121808-09ec82cb3551/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
diff --git a/modules/mesh-provisioner/go.mod b/modules/mesh-provisioner/go.mod
index 9e024bde..4d8b2621 100644
--- a/modules/mesh-provisioner/go.mod
+++ b/modules/mesh-provisioner/go.mod
@@ -3,7 +3,7 @@ module mesh-provisioner
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103105230-a973bfaf42b2
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103121808-09ec82cb3551
 	github.com/nats-io/nats.go v1.54.0
 )
 
diff --git a/modules/mesh-provisioner/go.sum b/modules/mesh-provisioner/go.sum
index a8a3c3cf..271c7949 100644
--- a/modules/mesh-provisioner/go.sum
+++ b/modules/mesh-provisioner/go.sum
@@ -1,9 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128 h1:aI1DhZAuqVBXbybSqhLNOGX5rUOrn9T0cHNCDUQF7IQ=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892 h1:XWorhIHDVECRCYzGbkaexEpJ7v03B9LrZ8IVy7vkUKs=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103105230-a973bfaf42b2 h1:CMNEBKlWI36rQEG5lhFRKoICquvYP4hBD7h/jCVFIcc=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103105230-a973bfaf42b2/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103121808-09ec82cb3551 h1:DAxLU3IjZ9Kof8F3kVnINcauLqzCdQ1smwMpzX8yi7I=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103121808-09ec82cb3551/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
diff --git a/modules/mesh-vault/go.mod b/modules/mesh-vault/go.mod
index f3d306e5..98a9bbb3 100644
--- a/modules/mesh-vault/go.mod
+++ b/modules/mesh-vault/go.mod
@@ -3,7 +3,7 @@ module mesh-vault
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103105230-a973bfaf42b2
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103121808-09ec82cb3551
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 	golang.org/x/crypto v0.57.0
diff --git a/modules/mesh-vault/go.sum b/modules/mesh-vault/go.sum
index a8a3c3cf..271c7949 100644
--- a/modules/mesh-vault/go.sum
+++ b/modules/mesh-vault/go.sum
@@ -1,9 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128 h1:aI1DhZAuqVBXbybSqhLNOGX5rUOrn9T0cHNCDUQF7IQ=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892 h1:XWorhIHDVECRCYzGbkaexEpJ7v03B9LrZ8IVy7vkUKs=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103105230-a973bfaf42b2 h1:CMNEBKlWI36rQEG5lhFRKoICquvYP4hBD7h/jCVFIcc=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103105230-a973bfaf42b2/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103121808-09ec82cb3551 h1:DAxLU3IjZ9Kof8F3kVnINcauLqzCdQ1smwMpzX8yi7I=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103121808-09ec82cb3551/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
diff --git a/modules/nats/go.mod b/modules/nats/go.mod
index c5fd11b6..e1958b58 100644
--- a/modules/nats/go.mod
+++ b/modules/nats/go.mod
@@ -3,7 +3,7 @@ module nats-tools
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103105230-a973bfaf42b2
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103121808-09ec82cb3551
 	github.com/klauspost/compress v1.20.0
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
diff --git a/modules/nats/go.sum b/modules/nats/go.sum
index a8a3c3cf..271c7949 100644
--- a/modules/nats/go.sum
+++ b/modules/nats/go.sum
@@ -1,9 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128 h1:aI1DhZAuqVBXbybSqhLNOGX5rUOrn9T0cHNCDUQF7IQ=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892 h1:XWorhIHDVECRCYzGbkaexEpJ7v03B9LrZ8IVy7vkUKs=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103105230-a973bfaf42b2 h1:CMNEBKlWI36rQEG5lhFRKoICquvYP4hBD7h/jCVFIcc=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103105230-a973bfaf42b2/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103121808-09ec82cb3551 h1:DAxLU3IjZ9Kof8F3kVnINcauLqzCdQ1smwMpzX8yi7I=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103121808-09ec82cb3551/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=

From 9c36d4edd4b73ed42643863a24ff64a1e1f2a82b Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Tue, 3 Nov 2026 14:05:07 +0100
Subject: [PATCH 05/12] Pin mesh-sdk 825483043549, the group's head of
 feat/l3b-bus (review round 1)

---
 modules/mesh-provisioner-client/go.mod | 2 +-
 modules/mesh-provisioner-client/go.sum | 4 ++--
 modules/mesh-provisioner/go.mod        | 2 +-
 modules/mesh-provisioner/go.sum        | 4 ++--
 modules/mesh-vault/go.mod              | 2 +-
 modules/mesh-vault/go.sum              | 4 ++--
 modules/nats/go.mod                    | 2 +-
 modules/nats/go.sum                    | 4 ++--
 8 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/modules/mesh-provisioner-client/go.mod b/modules/mesh-provisioner-client/go.mod
index ed7ba83a..a69fd7d5 100644
--- a/modules/mesh-provisioner-client/go.mod
+++ b/modules/mesh-provisioner-client/go.mod
@@ -3,7 +3,7 @@ module mesh-provisioner-client
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103121808-09ec82cb3551
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103125438-825483043549
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 	golang.org/x/sys v0.48.0
diff --git a/modules/mesh-provisioner-client/go.sum b/modules/mesh-provisioner-client/go.sum
index 271c7949..9f1230bd 100644
--- a/modules/mesh-provisioner-client/go.sum
+++ b/modules/mesh-provisioner-client/go.sum
@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103121808-09ec82cb3551 h1:DAxLU3IjZ9Kof8F3kVnINcauLqzCdQ1smwMpzX8yi7I=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103121808-09ec82cb3551/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103125438-825483043549 h1:YihsvVnQ6LQwsuUx7if6Gp5rEB7hmx2kcdzZzhWqiVw=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103125438-825483043549/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
diff --git a/modules/mesh-provisioner/go.mod b/modules/mesh-provisioner/go.mod
index 4d8b2621..422b3328 100644
--- a/modules/mesh-provisioner/go.mod
+++ b/modules/mesh-provisioner/go.mod
@@ -3,7 +3,7 @@ module mesh-provisioner
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103121808-09ec82cb3551
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103125438-825483043549
 	github.com/nats-io/nats.go v1.54.0
 )
 
diff --git a/modules/mesh-provisioner/go.sum b/modules/mesh-provisioner/go.sum
index 271c7949..9f1230bd 100644
--- a/modules/mesh-provisioner/go.sum
+++ b/modules/mesh-provisioner/go.sum
@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103121808-09ec82cb3551 h1:DAxLU3IjZ9Kof8F3kVnINcauLqzCdQ1smwMpzX8yi7I=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103121808-09ec82cb3551/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103125438-825483043549 h1:YihsvVnQ6LQwsuUx7if6Gp5rEB7hmx2kcdzZzhWqiVw=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103125438-825483043549/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
diff --git a/modules/mesh-vault/go.mod b/modules/mesh-vault/go.mod
index 98a9bbb3..c110bf37 100644
--- a/modules/mesh-vault/go.mod
+++ b/modules/mesh-vault/go.mod
@@ -3,7 +3,7 @@ module mesh-vault
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103121808-09ec82cb3551
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103125438-825483043549
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 	golang.org/x/crypto v0.57.0
diff --git a/modules/mesh-vault/go.sum b/modules/mesh-vault/go.sum
index 271c7949..9f1230bd 100644
--- a/modules/mesh-vault/go.sum
+++ b/modules/mesh-vault/go.sum
@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103121808-09ec82cb3551 h1:DAxLU3IjZ9Kof8F3kVnINcauLqzCdQ1smwMpzX8yi7I=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103121808-09ec82cb3551/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103125438-825483043549 h1:YihsvVnQ6LQwsuUx7if6Gp5rEB7hmx2kcdzZzhWqiVw=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103125438-825483043549/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
diff --git a/modules/nats/go.mod b/modules/nats/go.mod
index e1958b58..034a9ee8 100644
--- a/modules/nats/go.mod
+++ b/modules/nats/go.mod
@@ -3,7 +3,7 @@ module nats-tools
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103121808-09ec82cb3551
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103125438-825483043549
 	github.com/klauspost/compress v1.20.0
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
diff --git a/modules/nats/go.sum b/modules/nats/go.sum
index 271c7949..9f1230bd 100644
--- a/modules/nats/go.sum
+++ b/modules/nats/go.sum
@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103121808-09ec82cb3551 h1:DAxLU3IjZ9Kof8F3kVnINcauLqzCdQ1smwMpzX8yi7I=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103121808-09ec82cb3551/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103125438-825483043549 h1:YihsvVnQ6LQwsuUx7if6Gp5rEB7hmx2kcdzZzhWqiVw=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103125438-825483043549/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=

From e84b9d13c41b95a01b84e019cf35f701925f33c5 Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Tue, 3 Nov 2026 14:12:50 +0100
Subject: [PATCH 06/12] Pin mesh-sdk e7ce86ff62b5, the group's head of
 feat/l3b-bus (review round 2)

---
 modules/mesh-provisioner-client/go.mod | 2 +-
 modules/mesh-provisioner-client/go.sum | 4 ++--
 modules/mesh-provisioner/go.mod        | 2 +-
 modules/mesh-provisioner/go.sum        | 4 ++--
 modules/mesh-vault/go.mod              | 2 +-
 modules/mesh-vault/go.sum              | 4 ++--
 modules/nats/go.mod                    | 2 +-
 modules/nats/go.sum                    | 4 ++--
 8 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/modules/mesh-provisioner-client/go.mod b/modules/mesh-provisioner-client/go.mod
index a69fd7d5..7e34f7dd 100644
--- a/modules/mesh-provisioner-client/go.mod
+++ b/modules/mesh-provisioner-client/go.mod
@@ -3,7 +3,7 @@ module mesh-provisioner-client
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103125438-825483043549
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103131008-e7ce86ff62b5
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 	golang.org/x/sys v0.48.0
diff --git a/modules/mesh-provisioner-client/go.sum b/modules/mesh-provisioner-client/go.sum
index 9f1230bd..310e531a 100644
--- a/modules/mesh-provisioner-client/go.sum
+++ b/modules/mesh-provisioner-client/go.sum
@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103125438-825483043549 h1:YihsvVnQ6LQwsuUx7if6Gp5rEB7hmx2kcdzZzhWqiVw=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103125438-825483043549/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103131008-e7ce86ff62b5 h1:snMd7KsMT+tKlWYtrXSXrHF4u60DElvHmbe/aq58DqU=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103131008-e7ce86ff62b5/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
diff --git a/modules/mesh-provisioner/go.mod b/modules/mesh-provisioner/go.mod
index 422b3328..90da01c5 100644
--- a/modules/mesh-provisioner/go.mod
+++ b/modules/mesh-provisioner/go.mod
@@ -3,7 +3,7 @@ module mesh-provisioner
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103125438-825483043549
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103131008-e7ce86ff62b5
 	github.com/nats-io/nats.go v1.54.0
 )
 
diff --git a/modules/mesh-provisioner/go.sum b/modules/mesh-provisioner/go.sum
index 9f1230bd..310e531a 100644
--- a/modules/mesh-provisioner/go.sum
+++ b/modules/mesh-provisioner/go.sum
@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103125438-825483043549 h1:YihsvVnQ6LQwsuUx7if6Gp5rEB7hmx2kcdzZzhWqiVw=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103125438-825483043549/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103131008-e7ce86ff62b5 h1:snMd7KsMT+tKlWYtrXSXrHF4u60DElvHmbe/aq58DqU=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103131008-e7ce86ff62b5/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
diff --git a/modules/mesh-vault/go.mod b/modules/mesh-vault/go.mod
index c110bf37..cf8cd000 100644
--- a/modules/mesh-vault/go.mod
+++ b/modules/mesh-vault/go.mod
@@ -3,7 +3,7 @@ module mesh-vault
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103125438-825483043549
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103131008-e7ce86ff62b5
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 	golang.org/x/crypto v0.57.0
diff --git a/modules/mesh-vault/go.sum b/modules/mesh-vault/go.sum
index 9f1230bd..310e531a 100644
--- a/modules/mesh-vault/go.sum
+++ b/modules/mesh-vault/go.sum
@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103125438-825483043549 h1:YihsvVnQ6LQwsuUx7if6Gp5rEB7hmx2kcdzZzhWqiVw=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103125438-825483043549/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103131008-e7ce86ff62b5 h1:snMd7KsMT+tKlWYtrXSXrHF4u60DElvHmbe/aq58DqU=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103131008-e7ce86ff62b5/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
diff --git a/modules/nats/go.mod b/modules/nats/go.mod
index 034a9ee8..09a87ab1 100644
--- a/modules/nats/go.mod
+++ b/modules/nats/go.mod
@@ -3,7 +3,7 @@ module nats-tools
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103125438-825483043549
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103131008-e7ce86ff62b5
 	github.com/klauspost/compress v1.20.0
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
diff --git a/modules/nats/go.sum b/modules/nats/go.sum
index 9f1230bd..310e531a 100644
--- a/modules/nats/go.sum
+++ b/modules/nats/go.sum
@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103125438-825483043549 h1:YihsvVnQ6LQwsuUx7if6Gp5rEB7hmx2kcdzZzhWqiVw=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103125438-825483043549/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103131008-e7ce86ff62b5 h1:snMd7KsMT+tKlWYtrXSXrHF4u60DElvHmbe/aq58DqU=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103131008-e7ce86ff62b5/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=

From 333ab9de22c2a109b12b330336c001db44bfb58b Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Tue, 3 Nov 2026 16:17:44 +0100
Subject: [PATCH 07/12] A provider's have counts as its outcome only from a
 build whose manifest offers the provision (ADR 0603 clause 5)

A provider whose build does not offer the provision it was asked for must
not be counted as having delivered it; the provisioner reads the build's
manifest (the builds read serves only this offer check and makes no plan,
ADR 0593 section 8) before it takes the provider's have as the outcome.
---
 .../cmd/mesh-provisioner/holder.go            | 63 ++++++++++++++++++-
 .../holder_integration_test.go                | 28 +++++++++
 .../cmd/mesh-provisioner/holder_test.go       | 22 +++++++
 .../cmd/mesh-provisioner/provisioner_test.go  |  9 +--
 modules/mesh-provisioner/module.json          |  1 +
 5 files changed, 118 insertions(+), 5 deletions(-)

diff --git a/modules/mesh-provisioner/cmd/mesh-provisioner/holder.go b/modules/mesh-provisioner/cmd/mesh-provisioner/holder.go
index 4a63e956..5d8fa5dc 100644
--- a/modules/mesh-provisioner/cmd/mesh-provisioner/holder.go
+++ b/modules/mesh-provisioner/cmd/mesh-provisioner/holder.go
@@ -68,7 +68,10 @@ const (
 	ModulesRead   = delivery.IndexerModule + ".modules"
 	ManifestsRead = delivery.IndexerModule + ".manifests"
 	HaveRead      = "node-engine.have"
-	ComposedRead  = "mesh-host.composed"
+	// BuildsRead is the builder's builds, `<module>.<fingerprint part>`: the key of the build a provider runs names the
+	// digest of the manifest it was built from (novox/hq ADR 0603 clause 5).
+	BuildsRead   = delivery.BuilderModule + ".builds"
+	ComposedRead = "mesh-host.composed"
 )
 
 // BoundReads are the providers' entries this module's manifest reads, `<module>.bound`, whose changes it hears. Which
@@ -819,6 +822,14 @@ func (h *Holder) haveOutcome(p *provisions.Provision) {
 	case have.Phase == delivery.PhaseFailed || have.Health == delivery.HealthFailed:
 		p.State, p.Why = provisions.Failed, orSaid(have.Detail, where+" failed")
 	case have.Phase == delivery.PhaseRunning && have.Health == delivery.HealthOK && (wantFP == "" || have.FP == wantFP):
+		// A provider's have counts as its outcome only from a build whose manifest offers the provision (ADR 0603 clause 5).
+		// Refused only when that manifest is known and does not offer it: a have with no builder key (an old-form build, an
+		// adopted module) or an unreadable manifest keeps the outcome it had.
+		if offers, known := h.buildOffers(p.Provider.Module, have.FP, p.Provision); known && !offers {
+			p.State, p.Why = provisions.Asked, "waits for "+where+" to run a build that offers "+p.Provision+": the build it runs ("+
+				have.FP+") does not"
+			return
+		}
 		p.State, p.Why = provisions.Provided, ""
 	default:
 		p.State, p.Why = provisions.Asked, fmt.Sprintf("waits for %s to run healthy at the build its want names (it is %s, "+
@@ -826,6 +837,56 @@ func (h *Holder) haveOutcome(p *provisions.Provision) {
 	}
 }
 
+// buildOffers says whether the build of a module at a fingerprint, as the builder keyed it, was made from a manifest that
+// offers the provision; known is false when the builder holds no such key, the key names no manifest, or the indexer holds
+// no such manifest (the caller then does not refuse).
+func (h *Holder) buildOffers(module, fingerprint, provision string) (offers, known bool) {
+	key, err := delivery.BuilderBuildKey(module, fingerprint)
+	if err != nil {
+		return false, false
+	}
+	be, err := h.Store.Get(BuildsRead, key)
+	if err != nil || be == nil {
+		return false, false
+	}
+	b, err := delivery.DecodeBuilderBuild(be.Value)
+	if err != nil || b.Manifest == "" {
+		return false, false
+	}
+	mk, err := delivery.ManifestsKey(b.Manifest)
+	if err != nil {
+		return false, false
+	}
+	me, err := h.Store.Get(ManifestsRead, mk)
+	if err != nil || me == nil {
+		return false, false
+	}
+	man, err := delivery.DecodeManifest(me.Value)
+	if err != nil {
+		return false, false
+	}
+	var decl struct {
+		Provides []json.RawMessage `json:"provides"`
+	}
+	if json.Unmarshal([]byte(man.JSON), &decl) != nil {
+		return false, false
+	}
+	for _, raw := range decl.Provides {
+		var name string
+		if json.Unmarshal(raw, &name) != nil {
+			var full struct {
+				Name string `json:"name"`
+			}
+			_ = json.Unmarshal(raw, &full)
+			name = full.Name
+		}
+		if name == provision {
+			return true, true
+		}
+	}
+	return false, true
+}
+
 // keepsEntries says whether a provider's outcome for one provision is its entries (its manifest at the trunk declares the
 // state `bound`) rather than its own have. When any offer of the provider says `answered-by: helper`, only those offers
 // are answered by its entries: a module running the helper for one provision and making another some other way (gitea:
diff --git a/modules/mesh-provisioner/cmd/mesh-provisioner/holder_integration_test.go b/modules/mesh-provisioner/cmd/mesh-provisioner/holder_integration_test.go
index 6ab8f93e..91e53cc2 100644
--- a/modules/mesh-provisioner/cmd/mesh-provisioner/holder_integration_test.go
+++ b/modules/mesh-provisioner/cmd/mesh-provisioner/holder_integration_test.go
@@ -224,6 +224,34 @@ func TestTheHolderPlansProvidesAndAsksOnTheBus(t *testing.T) {
 		t.Fatal(err)
 	}
 	settled(HaveRead, node+".postgres")
+	// The running build's manifest, as the builder keyed it: one that does not offer the provision keeps the key asked
+	// (ADR 0603 clause 5), one that does lets the have count.
+	buildsKey := mustKey(delivery.BuilderBuildKey("postgres", fpsOf["postgres"]))
+	offered := func(provides string) {
+		raw := `{"module":"postgres","version":"1","provides":` + provides + `}`
+		digest := delivery.ManifestDigest([]byte(raw))
+		value, _ := delivery.EncodeManifest(delivery.Manifest{Module: "postgres", JSON: raw})
+		if err := s.Put(ManifestsRead, mustKey(delivery.ManifestsKey(digest)), json.RawMessage(value)); err != nil {
+			t.Fatal(err)
+		}
+		build, err := delivery.EncodeBuilderBuild(delivery.BuilderBuild{State: delivery.BuildDone, Manifest: digest})
+		if err != nil {
+			t.Fatal(err)
+		}
+		if err := s.Put(BuildsRead, buildsKey, json.RawMessage(build)); err != nil {
+			t.Fatal(err)
+		}
+	}
+	offered(`["other"]`)
+	for i := 0; i < 2; i++ {
+		if _, err := h.ComposeNode(ctx, node); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if p := state(key); p.State != provisions.Asked {
+		t.Fatalf("a build not offering the provision turned it %s", p.State)
+	}
+	offered(`["postgres-database"]`)
 	for i := 0; i < 2; i++ { // the credential judged first, then what depends on it
 		if _, err := h.ComposeNode(ctx, node); err != nil {
 			t.Fatal(err)
diff --git a/modules/mesh-provisioner/cmd/mesh-provisioner/holder_test.go b/modules/mesh-provisioner/cmd/mesh-provisioner/holder_test.go
index 63504236..f99f945a 100644
--- a/modules/mesh-provisioner/cmd/mesh-provisioner/holder_test.go
+++ b/modules/mesh-provisioner/cmd/mesh-provisioner/holder_test.go
@@ -189,6 +189,28 @@ func TestAKeysStateFollowsItsProvidersOutcome(t *testing.T) {
 			t.Errorf("the provider's have %s: %+v, want %s", row.have, p, row.state)
 		}
 	}
+	// A have counts as the provider's outcome only from a build whose manifest offers the provision (ADR 0603 clause 5):
+	// refused when the build's manifest is known and does not offer it, provided when it does.
+	bfp := "src2:" + strings.Repeat("bb", 32)
+	buildKey := mustKey(delivery.BuilderBuildKey("systemd-resolved", bfp))
+	for _, row := range []struct{ name, provides, state, why string }{
+		{"a build whose manifest does not offer it", `["other"]`, provisions.Asked, "offers split-dns"},
+		{"a build whose manifest offers it", `[{"name":"split-dns"}]`, provisions.Provided, ""},
+	} {
+		raw := `{"module":"systemd-resolved","version":"1","provides":` + row.provides + `}`
+		digest := delivery.ManifestDigest([]byte(raw))
+		value, _ := delivery.EncodeManifest(delivery.Manifest{Module: "systemd-resolved", JSON: raw})
+		_ = m.s.Put(ManifestsRead, mustKey(delivery.ManifestsKey(digest)), json.RawMessage(value))
+		build, err := delivery.EncodeBuilderBuild(delivery.BuilderBuild{State: delivery.BuildDone, Manifest: digest})
+		if err != nil {
+			t.Fatal(err)
+		}
+		_ = m.s.Put(BuildsRead, buildKey, json.RawMessage(build))
+		m.compose(t, "g14")
+		if p := m.state(t, split); p.State != row.state || !strings.Contains(p.Why, row.why) {
+			t.Errorf("%s: %+v, want %s", row.name, p, row.state)
+		}
+	}
 	if e, _ := m.s.Get(PlansState, "g14.gitea"); e == nil {
 		t.Error("the plan is not written")
 	}
diff --git a/modules/mesh-provisioner/cmd/mesh-provisioner/provisioner_test.go b/modules/mesh-provisioner/cmd/mesh-provisioner/provisioner_test.go
index 7ef2233a..3b02e089 100644
--- a/modules/mesh-provisioner/cmd/mesh-provisioner/provisioner_test.go
+++ b/modules/mesh-provisioner/cmd/mesh-provisioner/provisioner_test.go
@@ -9,7 +9,6 @@ import (
 	"sync"
 	"testing"
 
-	"git.novox.be/novox/mesh-sdk/go/delivery"
 )
 
 // memStore is the bus as mesh-provisioner reaches it, in memory: the states it keeps.
@@ -326,13 +325,15 @@ func TestTheManifestDeclaresWhatTheCodeKeeps(t *testing.T) {
 			t.Errorf("the manifest lists %s, which is not served", tool)
 		}
 	}
-	for _, r := range append(slices.Clone(WatchedReads), ManifestsRead) {
+	// The builds read serves only haveOutcome's offer check (ADR 0603 clause 5: which manifest the build a provider runs
+	// was made from) and makes no plan, so ADR 0593 §8 ("it composes nothing") holds.
+	for _, r := range append(slices.Clone(WatchedReads), ManifestsRead, BuildsRead) {
 		if !slices.Contains(m.Reads, r) {
 			t.Errorf("the manifest does not read %s, which the holder reads", r)
 		}
 	}
-	// It composes nothing (ADR 0593 §8): no build, and no config value, is read to make a plan.
-	for _, r := range []string{delivery.BuilderModule + ".builds", "mesh-config.resolved"} {
+	// It composes nothing (ADR 0593 §8): no config value is read to make a plan.
+	for _, r := range []string{"mesh-config.resolved"} {
 		if slices.Contains(m.Reads, r) {
 			t.Errorf("the manifest reads %s, which only a composer reads", r)
 		}
diff --git a/modules/mesh-provisioner/module.json b/modules/mesh-provisioner/module.json
index 7d5c4d3e..7b512a6f 100644
--- a/modules/mesh-provisioner/module.json
+++ b/modules/mesh-provisioner/module.json
@@ -20,6 +20,7 @@
     "mesh-delivery-indexer.modules",
     "mesh-delivery-indexer.manifests",
     "node-engine.have",
+    "mesh-delivery-builder.builds",
     "mesh-host.composed",
     "gitea.bound",
     "keycloak.bound",

From 04ab9bc603e08aba163f8d4b26aabb9ace8ef70e Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Tue, 3 Nov 2026 16:18:25 +0100
Subject: [PATCH 08/12] The gate's row: a merged message with no trees is read
 and refused by nothing (issue 1367; passes with the group's mesh-sdk pin)

---
 .../cmd/mesh-delivery-gate/holder_test.go           | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/modules/mesh-delivery-gate/cmd/mesh-delivery-gate/holder_test.go b/modules/mesh-delivery-gate/cmd/mesh-delivery-gate/holder_test.go
index 49e8c2a0..0c5d84dd 100644
--- a/modules/mesh-delivery-gate/cmd/mesh-delivery-gate/holder_test.go
+++ b/modules/mesh-delivery-gate/cmd/mesh-delivery-gate/holder_test.go
@@ -5,6 +5,8 @@ import (
 	"strings"
 	"testing"
 	"time"
+
+	sdk "git.novox.be/novox/mesh-sdk/go/delivery"
 )
 
 // The holder, end to end over fakes (novox/hq ADR 0239 *How it is checked*, cut by ADR 0539 §17): a pull request's head
@@ -238,6 +240,17 @@ func TestAMergedGroupEndsMergedWithSourceMainMoved(t *testing.T) {
 	if w.source.main == nil || w.source.main.Heads["novox/a"] != strings.Repeat("p", 12) || w.source.main.Heads["novox/b"] != strings.Repeat("q", 12) {
 		t.Fatalf("source.main is %+v, wanted both merges", w.source.main)
 	}
+	// A merge that leaves no module.json carries no trees (issue 1367): the gate reads it, and refuses nothing.
+	msg := sdk.Forge{Kind: sdk.ForgeMerged, Repository: "novox/a", Number: 9, Head: strings.Repeat("e", 40),
+		Merge: strings.Repeat("f", 40), Root: "r"}
+	body, err := sdk.EncodeForge(msg)
+	if err != nil {
+		t.Fatalf("a merged message with no trees is refused: %v", err)
+	}
+	w.h.Forged("mesh-delivery-forge-bridge.novox.a.merged", body)
+	if len(w.h.refusals) != 0 {
+		t.Errorf("the gate refused a merged message with no trees: %v", w.h.refusals)
+	}
 }
 
 // ADR 0419 §2, issue 978: a description's `after:` line is not read, and says so once on its pull request. The

From e2fad6a50a341952db98abcd0a2fff9adf408150 Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Tue, 3 Nov 2026 16:26:35 +0100
Subject: [PATCH 09/12] Pin mesh-sdk 65b7adc8bdd9, the group's head of
 feat/l3b-bus (the gate reads a merged message with no trees)

---
 modules/mesh-delivery-gate/go.mod      | 2 +-
 modules/mesh-delivery-gate/go.sum      | 4 ++--
 modules/mesh-provisioner-client/go.mod | 2 +-
 modules/mesh-provisioner-client/go.sum | 4 ++--
 modules/mesh-provisioner/go.mod        | 2 +-
 modules/mesh-provisioner/go.sum        | 4 ++--
 modules/mesh-vault/go.mod              | 2 +-
 modules/mesh-vault/go.sum              | 4 ++--
 modules/nats/go.mod                    | 2 +-
 modules/nats/go.sum                    | 4 ++--
 10 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/modules/mesh-delivery-gate/go.mod b/modules/mesh-delivery-gate/go.mod
index c35b2a88..f2513bcc 100644
--- a/modules/mesh-delivery-gate/go.mod
+++ b/modules/mesh-delivery-gate/go.mod
@@ -3,7 +3,7 @@ module mesh-delivery-gate
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103152334-65b7adc8bdd9
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )
diff --git a/modules/mesh-delivery-gate/go.sum b/modules/mesh-delivery-gate/go.sum
index 43cc4ec7..c1f06287 100644
--- a/modules/mesh-delivery-gate/go.sum
+++ b/modules/mesh-delivery-gate/go.sum
@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128 h1:aI1DhZAuqVBXbybSqhLNOGX5rUOrn9T0cHNCDUQF7IQ=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103152334-65b7adc8bdd9 h1:XJ7L9ZZ26URj0WxT467I9xZXijKDlQ5ZfE9NK/SnV0Y=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103152334-65b7adc8bdd9/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
diff --git a/modules/mesh-provisioner-client/go.mod b/modules/mesh-provisioner-client/go.mod
index 7e34f7dd..afbcd6ea 100644
--- a/modules/mesh-provisioner-client/go.mod
+++ b/modules/mesh-provisioner-client/go.mod
@@ -3,7 +3,7 @@ module mesh-provisioner-client
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103131008-e7ce86ff62b5
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103152334-65b7adc8bdd9
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 	golang.org/x/sys v0.48.0
diff --git a/modules/mesh-provisioner-client/go.sum b/modules/mesh-provisioner-client/go.sum
index 310e531a..c1f06287 100644
--- a/modules/mesh-provisioner-client/go.sum
+++ b/modules/mesh-provisioner-client/go.sum
@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103131008-e7ce86ff62b5 h1:snMd7KsMT+tKlWYtrXSXrHF4u60DElvHmbe/aq58DqU=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103131008-e7ce86ff62b5/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103152334-65b7adc8bdd9 h1:XJ7L9ZZ26URj0WxT467I9xZXijKDlQ5ZfE9NK/SnV0Y=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103152334-65b7adc8bdd9/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
diff --git a/modules/mesh-provisioner/go.mod b/modules/mesh-provisioner/go.mod
index 90da01c5..63af89c0 100644
--- a/modules/mesh-provisioner/go.mod
+++ b/modules/mesh-provisioner/go.mod
@@ -3,7 +3,7 @@ module mesh-provisioner
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103131008-e7ce86ff62b5
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103152334-65b7adc8bdd9
 	github.com/nats-io/nats.go v1.54.0
 )
 
diff --git a/modules/mesh-provisioner/go.sum b/modules/mesh-provisioner/go.sum
index 310e531a..c1f06287 100644
--- a/modules/mesh-provisioner/go.sum
+++ b/modules/mesh-provisioner/go.sum
@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103131008-e7ce86ff62b5 h1:snMd7KsMT+tKlWYtrXSXrHF4u60DElvHmbe/aq58DqU=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103131008-e7ce86ff62b5/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103152334-65b7adc8bdd9 h1:XJ7L9ZZ26URj0WxT467I9xZXijKDlQ5ZfE9NK/SnV0Y=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103152334-65b7adc8bdd9/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
diff --git a/modules/mesh-vault/go.mod b/modules/mesh-vault/go.mod
index cf8cd000..e6c7c235 100644
--- a/modules/mesh-vault/go.mod
+++ b/modules/mesh-vault/go.mod
@@ -3,7 +3,7 @@ module mesh-vault
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103131008-e7ce86ff62b5
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103152334-65b7adc8bdd9
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 	golang.org/x/crypto v0.57.0
diff --git a/modules/mesh-vault/go.sum b/modules/mesh-vault/go.sum
index 310e531a..c1f06287 100644
--- a/modules/mesh-vault/go.sum
+++ b/modules/mesh-vault/go.sum
@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103131008-e7ce86ff62b5 h1:snMd7KsMT+tKlWYtrXSXrHF4u60DElvHmbe/aq58DqU=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103131008-e7ce86ff62b5/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103152334-65b7adc8bdd9 h1:XJ7L9ZZ26URj0WxT467I9xZXijKDlQ5ZfE9NK/SnV0Y=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103152334-65b7adc8bdd9/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
diff --git a/modules/nats/go.mod b/modules/nats/go.mod
index 09a87ab1..5e073253 100644
--- a/modules/nats/go.mod
+++ b/modules/nats/go.mod
@@ -3,7 +3,7 @@ module nats-tools
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103131008-e7ce86ff62b5
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103152334-65b7adc8bdd9
 	github.com/klauspost/compress v1.20.0
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
diff --git a/modules/nats/go.sum b/modules/nats/go.sum
index 310e531a..c1f06287 100644
--- a/modules/nats/go.sum
+++ b/modules/nats/go.sum
@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103131008-e7ce86ff62b5 h1:snMd7KsMT+tKlWYtrXSXrHF4u60DElvHmbe/aq58DqU=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103131008-e7ce86ff62b5/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103152334-65b7adc8bdd9 h1:XJ7L9ZZ26URj0WxT467I9xZXijKDlQ5ZfE9NK/SnV0Y=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103152334-65b7adc8bdd9/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=

From 1a35e5cf4dc6c1af084c1ef71753042d46d2407d Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Tue, 3 Nov 2026 17:01:35 +0100
Subject: [PATCH 10/12] Pin mesh-sdk cf5812101b0b, the group's final head of
 feat/l3b-bus (the module graph is no part of mesh-sdk)

---
 modules/mesh-delivery-gate/go.mod      | 2 +-
 modules/mesh-delivery-gate/go.sum      | 4 ++--
 modules/mesh-provisioner-client/go.mod | 2 +-
 modules/mesh-provisioner-client/go.sum | 4 ++--
 modules/mesh-provisioner/go.mod        | 2 +-
 modules/mesh-provisioner/go.sum        | 4 ++--
 modules/mesh-vault/go.mod              | 2 +-
 modules/mesh-vault/go.sum              | 4 ++--
 modules/nats/go.mod                    | 2 +-
 modules/nats/go.sum                    | 4 ++--
 10 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/modules/mesh-delivery-gate/go.mod b/modules/mesh-delivery-gate/go.mod
index f2513bcc..476154bf 100644
--- a/modules/mesh-delivery-gate/go.mod
+++ b/modules/mesh-delivery-gate/go.mod
@@ -3,7 +3,7 @@ module mesh-delivery-gate
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103152334-65b7adc8bdd9
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103155154-cf5812101b0b
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )
diff --git a/modules/mesh-delivery-gate/go.sum b/modules/mesh-delivery-gate/go.sum
index c1f06287..764e281d 100644
--- a/modules/mesh-delivery-gate/go.sum
+++ b/modules/mesh-delivery-gate/go.sum
@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103152334-65b7adc8bdd9 h1:XJ7L9ZZ26URj0WxT467I9xZXijKDlQ5ZfE9NK/SnV0Y=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103152334-65b7adc8bdd9/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103155154-cf5812101b0b h1:UPkJqQj+1y6WraOxDidkrokNjA25jxmCk+zIRkujjMc=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103155154-cf5812101b0b/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
diff --git a/modules/mesh-provisioner-client/go.mod b/modules/mesh-provisioner-client/go.mod
index afbcd6ea..25155255 100644
--- a/modules/mesh-provisioner-client/go.mod
+++ b/modules/mesh-provisioner-client/go.mod
@@ -3,7 +3,7 @@ module mesh-provisioner-client
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103152334-65b7adc8bdd9
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103155154-cf5812101b0b
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 	golang.org/x/sys v0.48.0
diff --git a/modules/mesh-provisioner-client/go.sum b/modules/mesh-provisioner-client/go.sum
index c1f06287..764e281d 100644
--- a/modules/mesh-provisioner-client/go.sum
+++ b/modules/mesh-provisioner-client/go.sum
@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103152334-65b7adc8bdd9 h1:XJ7L9ZZ26URj0WxT467I9xZXijKDlQ5ZfE9NK/SnV0Y=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103152334-65b7adc8bdd9/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103155154-cf5812101b0b h1:UPkJqQj+1y6WraOxDidkrokNjA25jxmCk+zIRkujjMc=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103155154-cf5812101b0b/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
diff --git a/modules/mesh-provisioner/go.mod b/modules/mesh-provisioner/go.mod
index 63af89c0..16514841 100644
--- a/modules/mesh-provisioner/go.mod
+++ b/modules/mesh-provisioner/go.mod
@@ -3,7 +3,7 @@ module mesh-provisioner
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103152334-65b7adc8bdd9
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103155154-cf5812101b0b
 	github.com/nats-io/nats.go v1.54.0
 )
 
diff --git a/modules/mesh-provisioner/go.sum b/modules/mesh-provisioner/go.sum
index c1f06287..764e281d 100644
--- a/modules/mesh-provisioner/go.sum
+++ b/modules/mesh-provisioner/go.sum
@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103152334-65b7adc8bdd9 h1:XJ7L9ZZ26URj0WxT467I9xZXijKDlQ5ZfE9NK/SnV0Y=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103152334-65b7adc8bdd9/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103155154-cf5812101b0b h1:UPkJqQj+1y6WraOxDidkrokNjA25jxmCk+zIRkujjMc=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103155154-cf5812101b0b/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
diff --git a/modules/mesh-vault/go.mod b/modules/mesh-vault/go.mod
index e6c7c235..1f34a94c 100644
--- a/modules/mesh-vault/go.mod
+++ b/modules/mesh-vault/go.mod
@@ -3,7 +3,7 @@ module mesh-vault
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103152334-65b7adc8bdd9
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103155154-cf5812101b0b
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 	golang.org/x/crypto v0.57.0
diff --git a/modules/mesh-vault/go.sum b/modules/mesh-vault/go.sum
index c1f06287..764e281d 100644
--- a/modules/mesh-vault/go.sum
+++ b/modules/mesh-vault/go.sum
@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103152334-65b7adc8bdd9 h1:XJ7L9ZZ26URj0WxT467I9xZXijKDlQ5ZfE9NK/SnV0Y=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103152334-65b7adc8bdd9/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103155154-cf5812101b0b h1:UPkJqQj+1y6WraOxDidkrokNjA25jxmCk+zIRkujjMc=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103155154-cf5812101b0b/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
diff --git a/modules/nats/go.mod b/modules/nats/go.mod
index 5e073253..bb28ca80 100644
--- a/modules/nats/go.mod
+++ b/modules/nats/go.mod
@@ -3,7 +3,7 @@ module nats-tools
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103152334-65b7adc8bdd9
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103155154-cf5812101b0b
 	github.com/klauspost/compress v1.20.0
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
diff --git a/modules/nats/go.sum b/modules/nats/go.sum
index c1f06287..764e281d 100644
--- a/modules/nats/go.sum
+++ b/modules/nats/go.sum
@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103152334-65b7adc8bdd9 h1:XJ7L9ZZ26URj0WxT467I9xZXijKDlQ5ZfE9NK/SnV0Y=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103152334-65b7adc8bdd9/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103155154-cf5812101b0b h1:UPkJqQj+1y6WraOxDidkrokNjA25jxmCk+zIRkujjMc=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103155154-cf5812101b0b/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=

From d5237091a6e19c73a75f887a74ac6047dafe02cd Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Tue, 3 Nov 2026 18:43:32 +0100
Subject: [PATCH 11/12] gofmt the provisioner's test: the group's check refused
 it unformatted

Claude-Session: https://claude.ai/code/session_01JG73KG7AfSdh6FP8VrBqCn
---
 .../mesh-provisioner/cmd/mesh-provisioner/provisioner_test.go    | 1 -
 1 file changed, 1 deletion(-)

diff --git a/modules/mesh-provisioner/cmd/mesh-provisioner/provisioner_test.go b/modules/mesh-provisioner/cmd/mesh-provisioner/provisioner_test.go
index 3b02e089..c856a63b 100644
--- a/modules/mesh-provisioner/cmd/mesh-provisioner/provisioner_test.go
+++ b/modules/mesh-provisioner/cmd/mesh-provisioner/provisioner_test.go
@@ -8,7 +8,6 @@ import (
 	"strings"
 	"sync"
 	"testing"
-
 )
 
 // memStore is the bus as mesh-provisioner reaches it, in memory: the states it keeps.

From 5fab8f118e18b7ff2da76eb5119d7ff56693d20a Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Tue, 3 Nov 2026 18:50:12 +0100
Subject: [PATCH 12/12] Pin mesh-sdk b7abe203a929, the group's head of
 feat/l3b-bus: it keeps, deprecated, the exported names the running parts
 still use

Claude-Session: https://claude.ai/code/session_01JG73KG7AfSdh6FP8VrBqCn
---
 modules/mesh-delivery-gate/go.mod      | 2 +-
 modules/mesh-delivery-gate/go.sum      | 4 ++--
 modules/mesh-provisioner-client/go.mod | 2 +-
 modules/mesh-provisioner-client/go.sum | 4 ++--
 modules/mesh-provisioner/go.mod        | 2 +-
 modules/mesh-provisioner/go.sum        | 4 ++--
 modules/mesh-vault/go.mod              | 2 +-
 modules/mesh-vault/go.sum              | 4 ++--
 modules/nats/go.mod                    | 2 +-
 modules/nats/go.sum                    | 4 ++--
 10 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/modules/mesh-delivery-gate/go.mod b/modules/mesh-delivery-gate/go.mod
index 476154bf..c0544f39 100644
--- a/modules/mesh-delivery-gate/go.mod
+++ b/modules/mesh-delivery-gate/go.mod
@@ -3,7 +3,7 @@ module mesh-delivery-gate
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103155154-cf5812101b0b
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103174208-b7abe203a929
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )
diff --git a/modules/mesh-delivery-gate/go.sum b/modules/mesh-delivery-gate/go.sum
index 764e281d..abad2969 100644
--- a/modules/mesh-delivery-gate/go.sum
+++ b/modules/mesh-delivery-gate/go.sum
@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103155154-cf5812101b0b h1:UPkJqQj+1y6WraOxDidkrokNjA25jxmCk+zIRkujjMc=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103155154-cf5812101b0b/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103174208-b7abe203a929 h1:RtAFbUJRP1qO9AIMM2ue+cXNzqj7WZ7IOlSqNvttwuU=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103174208-b7abe203a929/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
diff --git a/modules/mesh-provisioner-client/go.mod b/modules/mesh-provisioner-client/go.mod
index 25155255..ea5c9d1f 100644
--- a/modules/mesh-provisioner-client/go.mod
+++ b/modules/mesh-provisioner-client/go.mod
@@ -3,7 +3,7 @@ module mesh-provisioner-client
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103155154-cf5812101b0b
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103174208-b7abe203a929
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 	golang.org/x/sys v0.48.0
diff --git a/modules/mesh-provisioner-client/go.sum b/modules/mesh-provisioner-client/go.sum
index 764e281d..abad2969 100644
--- a/modules/mesh-provisioner-client/go.sum
+++ b/modules/mesh-provisioner-client/go.sum
@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103155154-cf5812101b0b h1:UPkJqQj+1y6WraOxDidkrokNjA25jxmCk+zIRkujjMc=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103155154-cf5812101b0b/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103174208-b7abe203a929 h1:RtAFbUJRP1qO9AIMM2ue+cXNzqj7WZ7IOlSqNvttwuU=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103174208-b7abe203a929/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
diff --git a/modules/mesh-provisioner/go.mod b/modules/mesh-provisioner/go.mod
index 16514841..03d2bf48 100644
--- a/modules/mesh-provisioner/go.mod
+++ b/modules/mesh-provisioner/go.mod
@@ -3,7 +3,7 @@ module mesh-provisioner
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103155154-cf5812101b0b
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103174208-b7abe203a929
 	github.com/nats-io/nats.go v1.54.0
 )
 
diff --git a/modules/mesh-provisioner/go.sum b/modules/mesh-provisioner/go.sum
index 764e281d..abad2969 100644
--- a/modules/mesh-provisioner/go.sum
+++ b/modules/mesh-provisioner/go.sum
@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103155154-cf5812101b0b h1:UPkJqQj+1y6WraOxDidkrokNjA25jxmCk+zIRkujjMc=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103155154-cf5812101b0b/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103174208-b7abe203a929 h1:RtAFbUJRP1qO9AIMM2ue+cXNzqj7WZ7IOlSqNvttwuU=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103174208-b7abe203a929/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
diff --git a/modules/mesh-vault/go.mod b/modules/mesh-vault/go.mod
index 1f34a94c..55f6b0da 100644
--- a/modules/mesh-vault/go.mod
+++ b/modules/mesh-vault/go.mod
@@ -3,7 +3,7 @@ module mesh-vault
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103155154-cf5812101b0b
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103174208-b7abe203a929
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 	golang.org/x/crypto v0.57.0
diff --git a/modules/mesh-vault/go.sum b/modules/mesh-vault/go.sum
index 764e281d..abad2969 100644
--- a/modules/mesh-vault/go.sum
+++ b/modules/mesh-vault/go.sum
@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103155154-cf5812101b0b h1:UPkJqQj+1y6WraOxDidkrokNjA25jxmCk+zIRkujjMc=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103155154-cf5812101b0b/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103174208-b7abe203a929 h1:RtAFbUJRP1qO9AIMM2ue+cXNzqj7WZ7IOlSqNvttwuU=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103174208-b7abe203a929/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
diff --git a/modules/nats/go.mod b/modules/nats/go.mod
index bb28ca80..a6aa5c98 100644
--- a/modules/nats/go.mod
+++ b/modules/nats/go.mod
@@ -3,7 +3,7 @@ module nats-tools
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103155154-cf5812101b0b
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103174208-b7abe203a929
 	github.com/klauspost/compress v1.20.0
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
diff --git a/modules/nats/go.sum b/modules/nats/go.sum
index 764e281d..abad2969 100644
--- a/modules/nats/go.sum
+++ b/modules/nats/go.sum
@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103155154-cf5812101b0b h1:UPkJqQj+1y6WraOxDidkrokNjA25jxmCk+zIRkujjMc=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103155154-cf5812101b0b/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103174208-b7abe203a929 h1:RtAFbUJRP1qO9AIMM2ue+cXNzqj7WZ7IOlSqNvttwuU=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103174208-b7abe203a929/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=