Issue an account whose credential is not sealed, and forget an unassigned module's accounts (issue 1945, ADR 0543)

Met a second time live on 2026-10-25 at 20:04 (note 35): mesh-build-go was
assigned to ace again, and its account rows, minted at 17:19, had outlived the
unassignment. The issue minted only when no row stood, so it minted and sealed
nothing; the node had no credential and the bus no user, and the module
crash-looped 20 times. The watch still said "the grants written".

- A bus account now says when its credential was sealed to its node (migration
  0108; every account standing before is taken as sealed). An issue under the
  assign act, the assignments' watch or a registration mints only an account
  that is not issued, a row with no seal counting as none, under the store's
  lock on the account across its look, mint and seal, and marks it sealed once
  sealed. A seal that fails leaves it unsealed for the next issue.
- Unassigning a module forgets its bus accounts and their credentials on that
  node, so an assignment again issues them afresh.
- Only sealed accounts count as minted for a composition and are named in a
  grant, so the assigner, which now wants a node only once the grant names its
  account (mesh-delivery, same branch), holds the node until it is.
- The assignment's log line says which accounts were issued and sealed, or that
  they stood issued and sealed.

The process-only issue drops the atomic insert of the review of 9ff47f6a for
the lock, which also covers the seal. Tests: cases in the existing tables.
Research 072: the grants piece (memberships and credentials heard from placement).

cmd/mesh-controller/acts.go

@@ -421,9 +421,9 @@ func issueOnAssign(ctx context.Context, open *stores, node, module string) strin
 		// A module running the provisioner client alone is minted the client's account (issue 917).
 		user = broker.Principal{Kind: broker.KindProvisioner, Node: node, Module: module}.Username()
 	}
-	if _, minted, err := inv.BusUserHash(ctx, user); err != nil {
+	if _, sealed, err := inv.BusAccountIssued(ctx, user); err != nil {
 		return ""
-	} else if minted {
+	} else if sealed { // a row whose credential is not sealed to the node is not issued (issue 1945)
 		// Its own account stands and is kept; a process it gained is not issued yet (issue 1226).
 		return processAccountsOnAssign(ctx, inv, m, node)
 	}

cmd/mesh-controller/assignment_accounts.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"slices"
 	"strings"
 	"sync"
 	"time"
@@ -195,22 +196,27 @@ func issueAssignmentAccounts(ctx context.Context, inv *inventory.Inventory, shel
 	if !known || mayIssue(m) != nil {
 		return false, "", nil
 	}
-	if user, own := ownAccountOf(m, node); own {
-		_, minted, err := inv.BusUserHash(ctx, user)
+	if _, own := ownAccountOf(m, node); own {
+		minted, err := inv.BusMinted(ctx) // sealed accounts alone: a row with no sealed credential is not issued
 		if err != nil {
-			return false, "", fmt.Errorf("whether %s is minted cannot be read: %w", user, err)
+			return false, "", fmt.Errorf("the issued accounts cannot be read: %w", err)
 		}
-		if !minted {
+		if missingAccounts(m, node, minted) {
 			busAddress, err := broker.BusAddress()
 			if err != nil {
 				return false, "", err
 			}
-			// Its processes' accounts too: issueOnTheNewBus issues every one of them with the module's own.
+			// Its processes' and provisioner client's accounts too: issueOnTheNewBus issues each that is not issued.
+			ctx, got := withIssued(ctx)
 			if err := issueOnTheNewBus(ctx, inv, m, node, busAddress); err != nil {
 				return false, "", err
 			}
-			return true, "its bus credential issued as " + user, nil
+			if issued := got.list(); len(issued) > 0 {
+				return true, "issued and sealed to " + node + ": " + strings.Join(issued, ", "), nil
+			}
+			return false, "", nil
 		}
+		return false, "its bus accounts on " + node + " stood issued and sealed", nil
 	}
 	line, err := issueMissingProcessAccounts(ctx, inv, m, node)
 	if err != nil {
@@ -219,6 +225,18 @@ func issueAssignmentAccounts(ctx context.Context, inv *inventory.Inventory, shel
 	return line != "", line, nil
 }
 
+// missingAccounts says some account of m on node is not issued: its own, a process's, or its provisioner client's.
+func missingAccounts(m catalogue.Manifest, node string, minted []string) bool {
+	if user, own := ownAccountOf(m, node); own && !slices.Contains(minted, user) {
+		return true
+	}
+	if runsTheProvisionerClient(m) &&
+		!slices.Contains(minted, broker.Principal{Kind: broker.KindProvisioner, Node: node, Module: m.Module}.Username()) {
+		return true
+	}
+	return len(processAccountsMissing(m, node, minted)) > 0
+}
+
 // liveAssignmentAccountSteps are the steps on the controller's own stores and the bus: the composer's passes, as the
 // done keys' take-ins use them, so a node asked for by both is composed once a pass.
 func liveAssignmentAccountSteps(open *stores) assignmentAccountSteps {

cmd/mesh-controller/assignment_accounts_test.go

@@ -12,6 +12,7 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
 	"github.com/novox/mesh-controller/internal/chain"
+	"github.com/novox/mesh-controller/internal/inventory"
 )
 
 // An assignment that comes to stand issues its node's bus accounts and the module's grant (ADR 0543, issue 1945): on
@@ -324,6 +325,48 @@ func TestTheAccountsAModuleSpeaksWithOnANode(t *testing.T) {
 		}
 	})
 
+	// An issue mints and seals an account only when it is not issued: no row, or a row with no sealed credential (issue
+	// 1945, live on 2026-10-25 at 20:04: ace's mesh-build-go had a row from 17:19 and no credential), under the lock on
+	// the account; a seal that fails leaves it unsealed for the next issue. A rotation always mints.
+	for _, c := range []struct {
+		name           string
+		only           bool
+		minted, sealed bool
+		sealErr        error
+		want           string
+	}{
+		{"no row: minted unsealed, sealed, marked", true, false, false, nil, "lock mint-unsealed seal mark release"},
+		{"a row sealed: nothing", true, true, true, nil, "lock release"},
+		{"a row with no sealed credential: minted and sealed again", true, true, false, nil, "lock mint-unsealed seal mark release"},
+		{"a seal that fails: not marked", true, false, false, errors.New("the vault did not take it"), "lock mint-unsealed seal release"},
+		{"a rotation mints whatever stands", false, true, true, nil, "mint seal"},
+	} {
+		t.Run("issuing an account: "+c.name, func(t *testing.T) {
+			acts := &anAccountStore{minted: c.minted, sealed: c.sealed}
+			ctx, got := withIssued(t.Context())
+			if c.only {
+				ctx = onlyIfAbsent(ctx)
+			}
+			err := issueAccount(ctx, acts, inventory.BusUser{Username: "ace.mesh-build-go", Kind: inventory.BusModule},
+				func(password string) error {
+					acts.did("seal")
+					if password == "" {
+						t.Error("sealed no password")
+					}
+					return c.sealErr
+				})
+			if (err != nil) != (c.sealErr != nil) {
+				t.Fatalf("error %v, want %v", err, c.sealErr)
+			}
+			if strings.Join(acts.acts, " ") != c.want {
+				t.Fatalf("acts %q, want %q", strings.Join(acts.acts, " "), c.want)
+			}
+			if issued := len(got.list()) == 1; issued != (c.sealErr == nil && strings.Contains(c.want, "seal")) {
+				t.Fatalf("said issued %v", got.list())
+			}
+		})
+	}
+
 	t.Run("a process may be issued only with its own broker secret", func(t *testing.T) {
 		// mesh-mail's real shape: no `broker` of its own, its process declaring bus (review round 1 of issue 1181).
 		if err := mayIssue(mailSenderWithProcess()); err != nil {
@@ -342,3 +385,30 @@ func TestTheAccountsAModuleSpeaksWithOnANode(t *testing.T) {
 		}
 	})
 }
+
+// anAccountStore is an accountIssuer that writes down what was asked of it.
+type anAccountStore struct {
+	minted, sealed bool
+	acts           []string
+}
+
+func (a *anAccountStore) did(act string) { a.acts = append(a.acts, act) }
+func (a *anAccountStore) LockBusAccount(context.Context, string) (func(), error) {
+	a.did("lock")
+	return func() { a.did("release") }, nil
+}
+func (a *anAccountStore) BusAccountIssued(context.Context, string) (bool, bool, error) {
+	return a.minted, a.sealed, nil
+}
+func (a *anAccountStore) MintBusPassword(context.Context, inventory.BusUser) (string, error) {
+	a.did("mint")
+	return "a-password", nil
+}
+func (a *anAccountStore) MintBusPasswordUnsealed(context.Context, inventory.BusUser) (string, error) {
+	a.did("mint-unsealed")
+	return "a-password", nil
+}
+func (a *anAccountStore) MarkBusAccountSealed(context.Context, string) error {
+	a.did("mark")
+	return nil
+}

cmd/mesh-controller/grants.go

@@ -248,7 +248,11 @@ func grantsIssued(ctx context.Context, inv *inventory.Inventory, js jetstream.Je
 	}
 	hashes := make(map[string]string, len(kept))
 	for name, u := range kept {
-		hashes[name] = u.PasswordHash
+		// A grant names an account whose credential is sealed to its node, never one only minted: the assigner wants a
+		// node only once the grant names its account (issue 1945, rule 6 per node).
+		if u.Sealed {
+			hashes[name] = u.PasswordHash
+		}
 	}
 	current, err := currentFingerprints(ctx, inv)
 	if err != nil {

cmd/mesh-controller/modules.go

@@ -9,8 +9,10 @@ import (
 	"net"
 	"os"
 	"path/filepath"
+	"slices"
 	"sort"
 	"strings"
+	"sync"
 	"time"
 
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
@@ -965,24 +967,91 @@ func processPrincipalFor(m catalogue.Manifest, processID string) (broker.Process
 	return broker.ProcessPrincipal{}, false
 }
 
-// mintOnlyIfAbsent marks a context whose issue mints only accounts no row names yet (onlyIfAbsent).
+// mintOnlyIfAbsent marks a context whose issue mints only accounts that are not issued (onlyIfAbsent).
 type mintOnlyIfAbsent struct{}
 
-// onlyIfAbsent is ctx for an issue that must never replace a minted account: the assign act's and the assignments'
-// watch's, which may run at once for one account (novox/hq ADR 0543, the review of issue 1945).
+// onlyIfAbsent is ctx for an issue that never replaces an issued account: the assign act's, the assignments' watch's
+// and a registration's, which may run at once for one account (novox/hq ADR 0543, issue 1945).
 func onlyIfAbsent(ctx context.Context) context.Context {
 	return context.WithValue(ctx, mintOnlyIfAbsent{}, true)
 }
 
-// mintBusUser mints u's password. By default it replaces whatever stands (a rotation: `module issue`); under
-// onlyIfAbsent it mints only when no row names u, and won false says another caller minted it first and seals it,
-// so this one seals nothing.
-func mintBusUser(ctx context.Context, inv *inventory.Inventory, u inventory.BusUser) (string, bool, error) {
-	if only, _ := ctx.Value(mintOnlyIfAbsent{}).(bool); only {
-		return inv.MintBusPasswordIfAbsent(ctx, u)
+// issuedNow collects the accounts an issue minted and sealed, for the line that says it (withIssued).
+type issuedNow struct {
+	mu    sync.Mutex
+	users []string
+}
+
+type issuedNowKey struct{}
+
+// withIssued is ctx collecting the accounts its issues mint and seal.
+func withIssued(ctx context.Context) (context.Context, *issuedNow) {
+	got := &issuedNow{}
+	return context.WithValue(ctx, issuedNowKey{}, got), got
+}
+
+func (g *issuedNow) list() []string {
+	if g == nil {
+		return nil
 	}
-	password, err := inv.MintBusPassword(ctx, u)
-	return password, err == nil, err
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	return slices.Clone(g.users)
+}
+
+// accountIssuer is what issuing one account needs of the store.
+type accountIssuer interface {
+	LockBusAccount(ctx context.Context, username string) (func(), error)
+	BusAccountIssued(ctx context.Context, username string) (minted, sealed bool, err error)
+	MintBusPassword(ctx context.Context, u inventory.BusUser) (string, error)
+	MintBusPasswordUnsealed(ctx context.Context, u inventory.BusUser) (string, error)
+	MarkBusAccountSealed(ctx context.Context, username string) error
+}
+
+// issueAccount mints u's password and seals it to its node with seal. By default it replaces whatever stands (a
+// rotation: `module issue`). Under onlyIfAbsent it issues only an account that is not issued, a row with no sealed
+// credential counting as none (issue 1945, live on 2026-10-25 at 20:04: a row whose credential the node no longer held
+// left ace's mesh-build-go with no credential), under the store's lock on the account, so two issuers never interleave
+// their look, mint and seal: the hash the bus holds is always the password sealed. A seal that fails leaves the
+// account unsealed, issued again by the next issue.
+func issueAccount(ctx context.Context, accounts accountIssuer, u inventory.BusUser, seal func(password string) error) error {
+	only, _ := ctx.Value(mintOnlyIfAbsent{}).(bool)
+	if !only {
+		password, err := accounts.MintBusPassword(ctx, u)
+		if err != nil {
+			return err
+		}
+		if err := seal(password); err != nil {
+			return err
+		}
+	} else {
+		release, err := accounts.LockBusAccount(ctx, u.Username)
+		if err != nil {
+			return err
+		}
+		defer release()
+		if minted, sealed, err := accounts.BusAccountIssued(ctx, u.Username); err != nil {
+			return err
+		} else if minted && sealed {
+			return nil
+		}
+		password, err := accounts.MintBusPasswordUnsealed(ctx, u)
+		if err != nil {
+			return err
+		}
+		if err := seal(password); err != nil {
+			return err
+		}
+		if err := accounts.MarkBusAccountSealed(ctx, u.Username); err != nil {
+			return fmt.Errorf("%s is sealed and not marked so, and is issued again by the next issue: %w", u.Username, err)
+		}
+	}
+	if got, _ := ctx.Value(issuedNowKey{}).(*issuedNow); got != nil {
+		got.mu.Lock()
+		got.users = append(got.users, u.Username)
+		got.mu.Unlock()
+	}
+	return nil
 }
 
 // issueOnTheNewBus gives an assigned module its credential on the bus being built.
@@ -1010,17 +1079,12 @@ func issueOnTheNewBus(ctx context.Context, inv *inventory.Inventory, m catalogue
 	}
 	if _, reads := m.OwnSecrets["broker"]; reads {
 		user := broker.Principal{Kind: broker.KindModule, Node: node, Module: m.Module}.Username()
-		password, won, err := mintBusUser(ctx, inv, inventory.BusUser{
-			Username: user, Kind: busKindOf(m.Module), Node: node, Module: m.Module,
-		})
-		if err != nil {
+		if err := issueAccount(ctx, inv, inventory.BusUser{Username: user, Kind: busKindOf(m.Module), Node: node,
+			Module: m.Module}, func(password string) error {
+			return issueWith(ctx, inv, m, node, busAddress, known, reachable, user, password)
+		}); err != nil {
 			return err
 		}
-		if won {
-			if err := issueWith(ctx, inv, m, node, busAddress, known, reachable, user, password); err != nil {
-				return err
-			}
-		}
 	}
 	// Every process with a bus declaration gets an account of its own (novox/hq ADR 0436 §1, §2), minted and
 	// delivered whether or not the module itself speaks on the bus — its own secret is broker-<process id>,
@@ -1043,12 +1107,15 @@ func issueOnTheNewBus(ctx context.Context, inv *inventory.Inventory, m catalogue
 func issueProcess(ctx context.Context, inv *inventory.Inventory, m catalogue.Manifest, pr broker.ProcessPrincipal,
 	node, busAddress string, known broker.Broker, reachable string) error {
 	user := broker.Principal{Kind: broker.KindProcess, Node: node, Module: m.Module, Process: pr.Process}.Username()
-	password, won, err := mintBusUser(ctx, inv, inventory.BusUser{
-		Username: user, Kind: inventory.BusProcess, Node: node, Module: m.Module,
-	})
-	if err != nil || !won {
-		return err // lost: the caller that minted it seals it
-	}
+	return issueAccount(ctx, inv, inventory.BusUser{Username: user, Kind: inventory.BusProcess, Node: node, Module: m.Module},
+		func(password string) error {
+			return sealProcess(ctx, inv, m, pr, node, busAddress, known, reachable, user, password)
+		})
+}
+
+// sealProcess seals a process's minted account to its node, hands it to the vault and makes its work-queue consumers.
+func sealProcess(ctx context.Context, inv *inventory.Inventory, m catalogue.Manifest, pr broker.ProcessPrincipal,
+	node, busAddress string, known broker.Broker, reachable, user, password string) error {
 	name := processSecretName(pr.Process)
 	held, err := heldProcessAccount(known, reachable, node, m.Module, user, password)
 	if err != nil {
@@ -1113,12 +1180,15 @@ func runsTheProvisionerClient(m catalogue.Manifest) bool {
 func issueProvisionerClient(ctx context.Context, inv *inventory.Inventory, m catalogue.Manifest, node string,
 	known broker.Broker, reachable string) error {
 	user := broker.Principal{Kind: broker.KindProvisioner, Node: node, Module: m.Module}.Username()
-	password, won, err := mintBusUser(ctx, inv, inventory.BusUser{
-		Username: user, Kind: inventory.BusProvisioner, Node: node, Module: m.Module,
+	return issueAccount(ctx, inv, inventory.BusUser{Username: user, Kind: inventory.BusProvisioner, Node: node,
+		Module: m.Module}, func(password string) error {
+		return sealProvisionerClient(ctx, inv, m, node, known, reachable, user, password)
 	})
-	if err != nil || !won {
-		return err // lost: the caller that minted it seals it
-	}
+}
+
+// sealProvisionerClient seals the provisioner client's minted account to its machine and hands it to the vault.
+func sealProvisionerClient(ctx context.Context, inv *inventory.Inventory, m catalogue.Manifest, node string,
+	known broker.Broker, reachable, user, password string) error {
 	held, err := json.Marshal(struct {
 		URL         string `json:"url"`
 		Fingerprint string `json:"fingerprint,omitempty"`

cmd/mesh-controller/process_accounts.go

@@ -94,15 +94,18 @@ func issueMissingProcessAccounts(ctx context.Context, inv *inventory.Inventory,
 	if err != nil {
 		busAddress = ""
 	}
-	var ids []string
+	ctx, got := withIssued(ctx)
 	for _, pr := range missing {
 		if err := issueProcess(ctx, inv, m, pr, node, busAddress, known, reachable); err != nil {
 			return "", err
 		}
-		ids = append(ids, pr.Process)
+	}
+	issued := got.list()
+	if len(issued) == 0 {
+		return "", nil // another issuer sealed them meanwhile
 	}
 	return fmt.Sprintf("its process account(s) %s issued and sealed to %s, and arrive with the push",
-		strings.Join(ids, ", "), node), nil
+		strings.Join(issued, ", "), node), nil
 }
 
 // issueGainedProcessAccounts runs after a module's new definition is registered: on each machine assigned it, the