mesh-controller.try fault A: decide drop-only dead letters by a module's own retention: work-queue, not by the bus's work-queue retention alone (issue 1178)

sourceAge keyed AgainTo's clause-6 refusal on the stream's bus retention
policy, which SEAT_* and other mesh-internal work queues share without
being one of ADR 0436 §6's module streams — so every seat's ask, once
given up on, was refused delivery again. Added a dedicated metadata key
(WorkQueueMetadata), set only by ModuleStream.Stream() when the
catalogue declared retention: work-queue, and read sourceAge from that
instead of the stream's retention policy. New test proves a seat's own
work queue carries neither that metadata nor the restricted one.

internal/broker/jetstream.go

@@ -168,8 +168,14 @@ func StreamConfigFor(s Stream) *nats.StreamConfig {
 	}
 	want.AllowDirect = s.Direct
 	want.AllowMsgTTL = s.AllowMsgTTL
-	if s.Restricted {
-		want.Metadata = map[string]string{RestrictedMetadata: "true"}
+	if s.Restricted || s.WorkQueue {
+		want.Metadata = map[string]string{}
+		if s.Restricted {
+			want.Metadata[RestrictedMetadata] = "true"
+		}
+		if s.WorkQueue {
+			want.Metadata[WorkQueueMetadata] = "true"
+		}
 	}
 	if s.MaxBytes > 0 {
 		want.MaxBytes = s.MaxBytes

internal/broker/modstreams.go

@@ -98,6 +98,10 @@ func (s ModuleStream) Stream() Stream {
 		// by (novox/hq ADR 0436 §6, ADR 0376 §3-4): a work-queue stream's grant is always empty (ADR 0436
 		// §6 refuses one that carries a grant), so this never collides with a trusted-config restriction.
 		out.Restricted = true
+		// And its own metadata, apart from the bus's work-queue retention SEAT_* and other mesh-internal
+		// streams share without being one of this clause's: only this flag says a dead letter kept from the
+		// stream is drop-only (novox/hq ADR 0436 §6), never the stream's Retention alone.
+		out.WorkQueue = true
 	}
 	return out
 }

internal/broker/streams.go

@@ -65,11 +65,21 @@ type Stream struct {
 	// Restricted marks a module's stream restricted by a grant (novox/hq ADR 0363 §4), in the stream's own
 	// metadata, so whoever keeps one of its messages reads it from the bus (ADR 0376 §3).
 	Restricted bool
+	// WorkQueue marks a module stream declared retention: work-queue (novox/hq ADR 0436 §6), in the
+	// stream's own metadata, so a dead letter kept from it is read as drop-only from the bus, by the
+	// declaration and not by the bus's work-queue retention alone — which SEAT_* and other mesh-internal
+	// streams share without being one of ADR 0436's, and whose dead letters are still delivered again
+	// (ADR 0264 §4).
+	WorkQueue bool
 }
 
 // RestrictedMetadata is the key a restricted stream's metadata says it under.
 const RestrictedMetadata = "mesh-restricted"
 
+// WorkQueueMetadata is the key a module stream declared retention: work-queue (novox/hq ADR 0436 §6) says
+// it under: never set by a mesh-internal work-queue stream (a seat's, a check's), only by Stream.WorkQueue.
+const WorkQueueMetadata = "mesh-work-queue"
+
 // AssignmentsStream holds every assignment's membership, the newest per subject.
 const AssignmentsStream = "ASSIGNMENTS"