Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

Two controllers could both act (issue 204), a reconcile's report could
overtake the apply after it and the digest decided (issue 267), and a grant
could make a second writer of a machine's report.

- The lease (internal/lease, ADR 0229): mesh-controller_lease key `holder`,
  15 s age, renewed every 5 s by compare-and-set; the epoch is the revision
  it was taken at. The gate is the clock (stops 3 s before expiry); a refused
  renewal is a loss and the process exits; a holder that stops gives it back.
  serve takes it before asserting the bus. Epochs kept in the store
  (migration 0068 controller_epoch) as a floor: a bucket raised from nothing
  is compacted past it. Unleased (no epoch, S12 urgent) only when nobody
  holds it and the bus will not let it be written. A shell command acts
  under the holder's epoch, or its own lease when none.
- Declarations carry `epoch` inside the signed envelope, only to a machine
  whose latest account carried a report_sequence (mesh-host #35); would-send
  is composed with the epoch last sent. Allot and the send both pass the gate.
- Reports: contract in internal/link/order.go (epoch, sequence,
  report_sequence, older_than, refused_older). Accounts kept by epoch, then
  sequence, then report sequence; older refused, counted; unordered reports
  keep the digest rule. Plans by compare-and-set on a revision, with epoch.
  Conditions and calls carry the epoch and are not written off the lease.
- S12 and S13 (naming the writer by epoch) watched, D5 run; reset of the
  bucket said. Writers table compiled in and enforced in PermissionsFor; the
  controller no longer publishes mesh.control.>. A contract per consumed
  kind, and the empty-on-error lint over the repository.
- mesh-host pinned to its main with the epoch in the validator (D1 validates
  the envelope as sent).

Needs mesh-host's genesis lock with the lease grant (mesh-host PR) for
TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose.

vendor/github.com/novox/mesh-host/internal/declaration/declaration.go

@@ -1297,6 +1297,16 @@ type Declaration struct {
 	// superseded.
 	Sequence int64
 
+	// Epoch is the controller's lease epoch this declaration was sent under (novox/hq to-be 45 §6):
+	// the revision at which the sending controller took the lease. A controller that lost its lease
+	// and goes on sending sends an older epoch than the holder's, and the node-engine refuses what
+	// is older than what it applied. Zero is a declaration from a controller without a lease — every
+	// one sent before the lease existed — and carries no claim.
+	//
+	// Inside what is signed, beside the sequence, so a message cannot be given a newer epoch than
+	// the controller gave it.
+	Epoch int64
+
 	// LeftOut names the modules of this machine's set the mesh left out of this declaration,
 	// because a setting stored for one cannot compose with its definition (novox/hq ADR 0163,
 	// rule 6). A machine is told everything or nothing about what it IS told; this is what it is
@@ -1462,6 +1472,10 @@ type envelope struct {
 	// Sequence is optional on the wire, so a controller that does not send one is still
 	// understood: absent reads as zero, which is "no ordering claimed" rather than "first".
 	Sequence int64 `json:"sequence,omitempty"`
+	// Epoch is optional on the wire as the sequence is: absent is a controller without a lease.
+	// **An older host refuses this key**, decoding strictly; a controller sends it only to a host
+	// whose reports carry a report sequence, which a host that reads it does.
+	Epoch int64 `json:"epoch,omitempty"`
 	// LeftOut is optional on the wire too, and absent when nothing was left out (ADR 0163).
 	LeftOut []string `json:"left_out,omitempty"`
 }
@@ -1481,8 +1495,14 @@ func parse(raw []byte, allowActions bool) (*Declaration, error) {
 	}
 
 	d := &Declaration{Version: env.Version, For: env.For, Adoption: env.Adoption, Sequence: env.Sequence,
-		LeftOut: env.LeftOut}
+		Epoch: env.Epoch, LeftOut: env.LeftOut}
 	var problems []string
+	if env.Sequence < 0 || env.Epoch < 0 {
+		// Below zero is no order any controller assigns, and read as "none claimed" it would let the
+		// declaration past every refusal of what is older.
+		problems = append(problems, fmt.Sprintf("an order below zero (epoch %d, sequence %d) is not "+
+			"one the mesh assigns", env.Epoch, env.Sequence))
+	}
 	if len(env.LeftOut) > 0 && allowActions {
 		// The bundle is carried with the binary and leaves nothing out: which module a setting
 		// stopped composing for is the mesh's record (ADR 0163).

vendor/modules.txt

@@ -41,7 +41,7 @@ github.com/nats-io/nkeys
 # github.com/nats-io/nuid v1.0.1
 ## explicit
 github.com/nats-io/nuid
-# github.com/novox/mesh-host v0.0.0 => git.novox.be/novox/mesh-host v0.0.0-20261006081854-6953b5bafdb2
+# github.com/novox/mesh-host v0.0.0 => git.novox.be/novox/mesh-host v0.0.0-20261006095519-3e80b7ae325e
 ## explicit; go 1.26.0
 github.com/novox/mesh-host/internal/declaration
 github.com/novox/mesh-host/validate
@@ -83,4 +83,4 @@ golang.org/x/text/transform
 golang.org/x/text/unicode/bidi
 golang.org/x/text/unicode/norm
 golang.org/x/text/width
-# github.com/novox/mesh-host => git.novox.be/novox/mesh-host v0.0.0-20261006081854-6953b5bafdb2
+# github.com/novox/mesh-host => git.novox.be/novox/mesh-host v0.0.0-20261006095519-3e80b7ae325e