Leave modules the mesh provides itself out of the lines that say a module lacks a fingerprint (issue 774)

mesh-wireguard is provided by the mesh (sdkdelivery.ProvidedByMesh): no repository builds it and no
fingerprint will ever name it, yet every composition said it composes "with the node's own: no
fingerprint of the new form names them", and the switch's list counted it "not known". Both now leave
such a module out; its resources still go with the node's own composition, as before.

Quick and thorough are one here: the SDK names the modules the mesh provides, and every line that judges
fingerprints filters by it.

Research 072 piece: §6 milestone 2 (the composer reacts; its words say only what a change can fix).

cmd/mesh-controller/composed_live.go

@@ -124,11 +124,11 @@ func composeModulesByNode(ctx context.Context, open *stores, nodes []string) (ma
 				errsOf[node] = append(errsOf[node], fmt.Errorf("%s: %w", node, err))
 				return
 			}
-			if len(moved) > 0 {
+			if moved := builtByTheMesh(moved); len(moved) > 0 {
 				fmt.Printf("compositions: %s's %s compose with the node's own: no fingerprint of the new form names them\n",
 					node, strings.Join(moved, ", "))
 			}
-			if len(left) > 0 {
+			if left := builtByTheMesh(left); len(left) > 0 {
 				fmt.Printf("compositions: %s's %s are left out of the node's own: the controller knows no fingerprint of the "+
 					"new form for them, and the node's want or have names their own composition (issue 1945)\n",
 					node, strings.Join(left, ", "))

cmd/mesh-controller/forge_merge_test.go

@@ -89,3 +89,18 @@ func TestAMergeIsFoundOnTheForgeBridgesStream(t *testing.T) {
 		}
 	}
 }
+
+// Sweep 2026-10-30 (issue 774): a module the mesh provides itself is never named as lacking a fingerprint.
+func TestAModuleTheMeshProvidesIsNotSaidToLackAFingerprint(t *testing.T) {
+	for _, c := range []struct {
+		in, want []string
+	}{
+		{[]string{"mesh-wireguard"}, nil},
+		{[]string{"claude-code", "mesh-wireguard", "power"}, []string{"claude-code", "power"}},
+		{nil, nil},
+	} {
+		if got := builtByTheMesh(c.in); strings.Join(got, ",") != strings.Join(c.want, ",") {
+			t.Errorf("%v: %v, want %v", c.in, got, c.want)
+		}
+	}
+}

cmd/mesh-controller/switch_list.go

@@ -160,7 +160,7 @@ func switchList(ctx context.Context, inv *inventory.Inventory, keys switchReads)
 	var out []switchLine
 	for _, e := range entries {
 		m := e.Manifest.Module
-		if e.Provided || e.Source.Repository == "" {
+		if e.Provided || e.Source.Repository == "" || sdkdelivery.ProvidedByMesh(m) {
 			continue
 		}
 		trunk, err := keys.ModuleAt(ctx, m, "")
@@ -202,3 +202,16 @@ func heldArtifacts(ctx context.Context, inv *inventory.Inventory, module, builtF
 	// empty-on-error: not an error; the mesh holds no build of that commit on record, which the line says
 	return nil, nil
 }
+
+// builtByTheMesh are the modules of a list that a build of the mesh's makes: without the ones the mesh provides itself
+// (sdkdelivery.ProvidedByMesh, the private network), which no fingerprint ever names, so a line saying one has none
+// says nothing (sweep 2026-10-30, issue 774: "mesh-wireguard ... no fingerprint of the new form" on every composition).
+func builtByTheMesh(modules []string) []string {
+	var out []string
+	for _, m := range modules {
+		if !sdkdelivery.ProvidedByMesh(m) {
+			out = append(out, m)
+		}
+	}
+	return out
+}