Let a module declare a log the controller creates and never removes (ADR 0297)

The issue tracker's history lasts seven days on the events stream and its
bucket fills toward a cap with no warning (issues 501, 502). A module may
now declare `logs`; the controller creates each as a stream on the bus
(create-or-update, never deleted or recreated, reported when undeclared),
issues it to the owner's assignments in their membership, grants the
runtime exactly the append and direct-read subjects, and raises a
condition when any module's bucket or log reaches 75% of its cap, cleared
below 70%.

internal/broker/jetstream.go

@@ -448,3 +448,41 @@ func (j *JetStream) BucketNames() ([]string, error) {
 	}
 	return out, lister.Error()
 }
+
+// EnsureLog creates a module's log if it is absent and brings its configuration to match if it is
+// present (novox/hq ADR 0297).
+//
+// **An update, never a delete and recreate**, for a bucket's reason: recreating discards what the log
+// holds, and a log is a module's record. A configuration the server will not change in place (its
+// storage, say, on a stream made by hand) is said as this assertion's error and the stream is left as
+// it is — never removed to be made again.
+func (j *JetStream) EnsureLog(l Log) error {
+	js, err := jetstream.New(j.conn)
+	if err != nil {
+		return err
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	if _, err := js.CreateOrUpdateStream(ctx, l.Config()); err != nil {
+		return fmt.Errorf("asserting log %s: %w", l.Stream(), err)
+	}
+	return nil
+}
+
+// LogStreams is every log stream on the server: every stream whose name starts with LogStreamPrefix.
+func (j *JetStream) LogStreams() ([]string, error) {
+	js, err := jetstream.New(j.conn)
+	if err != nil {
+		return nil, err
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	lister := js.StreamNames(ctx)
+	var out []string
+	for name := range lister.Name() {
+		if strings.HasPrefix(name, LogStreamPrefix) {
+			out = append(out, name)
+		}
+	}
+	return out, lister.Err()
+}

internal/broker/log.go

@@ -0,0 +1,195 @@
+package broker
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+
+	"github.com/nats-io/nats.go/jetstream"
+)
+
+// A module's log on the bus (novox/hq ADR 0297): its record of operations, each entry appended under
+// a key and kept as long as the log is.
+//
+// A log follows a bucket in every respect (ADR 0201): the module names it locally, the mesh derives
+// its stream and subjects, the controller creates it from the catalogue on every raise and from
+// registration, never a module, and **no path of the mesh removes one** — a log whose declaration
+// is gone is reported, as a bucket is. Unlike a bucket, a log is its owner's alone: no other module
+// reads it, so there is no read of a log to grant or issue.
+//
+// Pure, but for the stream's configuration, which is the server's own type so that what is tested
+// is exactly what is sent; jetstream.go is the part that asks a server.
+
+// The mesh's caps on a log: what an entry's value may weigh, what a message on the log's stream may
+// weigh — the value and its headers, which the server counts in a message's size, so a value of the
+// full size still fits with the expected-last-sequence header an append carries — and what a log holds
+// when its module says nothing and at most.
+const (
+	LogMaxEntryBytes   = 256 * 1024
+	LogMaxMessageBytes = LogMaxEntryBytes + 4*1024
+	LogDefaultMiB      = 1024
+	LogMostMiB         = 8192
+)
+
+// A Log is one module's declared log as the bus holds it.
+type Log struct {
+	Module string
+	Name   string
+	// MaxMiB is its cap in MiB; zero is LogDefaultMiB.
+	MaxMiB int
+}
+
+// LogStreamPrefix starts every log's stream name, which no other stream of the mesh's starts with.
+const LogStreamPrefix = "LOG_"
+
+// LogStreamName is the stream a module's log lives in: `LOG_<module>_<name>`. The module and the
+// local name are each one token with no underscore, so two modules can never derive one stream.
+func LogStreamName(module, name string) string { return LogStreamPrefix + module + "_" + name }
+
+// LogSubject is the subject a log's entries are published under, without the key: an entry for key K
+// is on `<LogSubject>.<K>`.
+func LogSubject(module, name string) string { return "mesh.log." + module + "." + name }
+
+// Stream is this log's stream name.
+func (l Log) Stream() string { return LogStreamName(l.Module, l.Name) }
+
+// Subject is this log's subject, without the key.
+func (l Log) Subject() string { return LogSubject(l.Module, l.Name) }
+
+// MaxBytes is this log's cap in bytes.
+func (l Log) MaxBytes() int64 {
+	mib := l.MaxMiB
+	if mib <= 0 {
+		mib = LogDefaultMiB
+	}
+	return int64(mib) * 1024 * 1024
+}
+
+// Why is carried into the server's description of the stream, so somebody reading the server's own
+// state finds whose it is and why it is kept.
+func (l Log) Why() string {
+	return fmt.Sprintf("%s's log %q (novox/hq ADR 0297): its record of operations, one entry per operation "+
+		"under its key, appended by %s alone and kept as long as the log; never removed by the mesh, because "+
+		"it is data", l.Module, l.Name, l.Module)
+}
+
+// Config is the stream a log is, field by field as novox/hq ADR 0297 fixes it: a file stream kept by
+// limits, with no maximum age and no cap per key, whose message is an entry's value and 4 KiB of
+// headers at most, that refuses a new entry when full rather than
+// drop an old one, and that refuses deleting an entry or purging it. Direct gets are allowed, which
+// is how the runtime reads it.
+func (l Log) Config() jetstream.StreamConfig {
+	return jetstream.StreamConfig{
+		Name:              l.Stream(),
+		Description:       l.Why(),
+		Subjects:          []string{l.Subject() + ".>"},
+		Storage:           jetstream.FileStorage,
+		Retention:         jetstream.LimitsPolicy,
+		MaxAge:            0,
+		MaxMsgs:           -1,
+		MaxMsgsPerSubject: -1,
+		MaxBytes:          l.MaxBytes(),
+		MaxMsgSize:        LogMaxMessageBytes,
+		Discard:           jetstream.DiscardNew,
+		AllowDirect:       true,
+		DenyDelete:        true,
+		DenyPurge:         true,
+		Replicas:          1,
+	}
+}
+
+// LogIssued is one log an assignment may reach, by the name its module uses for it (novox/hq ADR
+// 0297): its stream, the subject its entries go under, and whether it may append. Only the owner's
+// instances are issued a log, so Writes is always true today; it is said so the runtime need not
+// assume it.
+type LogIssued struct {
+	Name    string `json:"name"`
+	Stream  string `json:"stream"`
+	Subject string `json:"subject"`
+	Writes  bool   `json:"writes"`
+}
+
+// logsIssuedFor is every log a module's code may reach, as its membership lists them: its own.
+func logsIssuedFor(d Declared) []LogIssued {
+	var out []LogIssued
+	for _, l := range d.Logs {
+		if !safeSubject.MatchString(d.Module) || !safeSubject.MatchString(l.Name) {
+			continue
+		}
+		out = append(out, LogIssued{Name: l.Name, Stream: LogStreamName(d.Module, l.Name),
+			Subject: LogSubject(d.Module, l.Name), Writes: true})
+	}
+	return out
+}
+
+// logGrants is what a principal publishes to reach the logs its module keeps: for each, appending
+// under the log's subjects, binding to its stream, and reading it directly. Nothing more — the
+// runtime reads a log by direct gets alone and makes no consumer on it — and nothing of any other
+// module's log, because a log is its owner's alone. Replies come on the principal's inbox, as for a
+// bucket.
+func logGrants(module string, names []string) []string {
+	if !safeSubject.MatchString(module) {
+		return nil
+	}
+	var out []string
+	for _, name := range names {
+		if !safeSubject.MatchString(name) {
+			continue
+		}
+		stream := LogStreamName(module, name)
+		out = append(out,
+			LogSubject(module, name)+".>",
+			"$JS.API.STREAM.INFO."+stream,
+			"$JS.API.DIRECT.GET."+stream,
+			"$JS.API.DIRECT.GET."+stream+".>")
+	}
+	return out
+}
+
+// logNames is the local names of a module's logs.
+func logNames(logs []Log) []string {
+	out := make([]string, 0, len(logs))
+	for _, l := range logs {
+		out = append(out, l.Name)
+	}
+	return out
+}
+
+// A LogAsserter is the part of a JetStream connection log assertion needs. It has no way to remove a
+// log, by design: nothing the mesh runs asks for one.
+type LogAsserter interface {
+	// EnsureLog creates the log's stream if absent and brings its configuration to match if present,
+	// never deleting or recreating it.
+	EnsureLog(l Log) error
+	// LogStreams is every log stream on the server: every stream named with LogStreamPrefix.
+	LogStreams() ([]string, error)
+}
+
+// RaiseLogs asserts every declared log and answers the log streams on the server that nothing
+// declares any more.
+//
+// **Those are reported, never removed** (novox/hq ADR 0297 §2, ADR 0201 §15–16): a log is a module's
+// record, and a manifest edited, a module renamed or unassigned is an ordinary day's work that must
+// not take a record with it. Removing one is a person's act, outside the mesh.
+func RaiseLogs(a LogAsserter, logs []Log) (undeclared []string, err error) {
+	sorted := append([]Log(nil), logs...)
+	sort.Slice(sorted, func(i, j int) bool { return sorted[i].Stream() < sorted[j].Stream() })
+	declared := map[string]bool{}
+	for _, l := range sorted {
+		if err := a.EnsureLog(l); err != nil {
+			return nil, fmt.Errorf("asserting %s's log %q: %w", l.Module, l.Name, err)
+		}
+		declared[l.Stream()] = true
+	}
+	names, err := a.LogStreams()
+	if err != nil {
+		return nil, fmt.Errorf("listing the bus's logs: %w", err)
+	}
+	for _, n := range names {
+		if strings.HasPrefix(n, LogStreamPrefix) && !declared[n] {
+			undeclared = append(undeclared, n)
+		}
+	}
+	sort.Strings(undeclared)
+	return undeclared, nil
+}

internal/broker/log_test.go

@@ -0,0 +1,294 @@
+package broker
+
+import (
+	"context"
+	"encoding/json"
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"io/fs"
+	"path/filepath"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/nats-io/nats.go/jetstream"
+)
+
+// **The stream a log is, field by field** (novox/hq ADR 0297 §2, the shared contract): a file stream
+// kept by limits, no maximum age, no cap per key, the declared cap, a message of at most 260 KiB (a
+// value of 256 KiB and 4 KiB of headers),
+// refusing what comes next when full, read directly, refusing a delete or a purge, one replica, and
+// a description that says whose it is and why.
+func TestALogsStreamIsAsTheDecisionFixesIt(t *testing.T) {
+	got := Log{Module: "mesh-issues", Name: "changes"}.Config()
+	want := jetstream.StreamConfig{
+		Name:              "LOG_mesh-issues_changes",
+		Description:       got.Description,
+		Subjects:          []string{"mesh.log.mesh-issues.changes.>"},
+		Storage:           jetstream.FileStorage,
+		Retention:         jetstream.LimitsPolicy,
+		MaxAge:            0,
+		MaxMsgs:           -1,
+		MaxMsgsPerSubject: -1,
+		MaxBytes:          1024 * 1024 * 1024,
+		MaxMsgSize:        260 * 1024,
+		Discard:           jetstream.DiscardNew,
+		AllowDirect:       true,
+		DenyDelete:        true,
+		DenyPurge:         true,
+		Replicas:          1,
+	}
+	a, _ := json.Marshal(got)
+	b, _ := json.Marshal(want)
+	if string(a) != string(b) {
+		t.Fatalf("the log's stream is\n %s\nwant\n %s", a, b)
+	}
+	if !strings.Contains(got.Description, "mesh-issues") || !strings.Contains(got.Description, "ADR 0297") {
+		t.Fatalf("the description does not say whose the log is and why: %q", got.Description)
+	}
+	if c := (Log{Module: "m", Name: "n", MaxMiB: 8192}).Config(); c.MaxBytes != 8192*1024*1024 {
+		t.Fatalf("a cap of 8192 MiB is %d bytes", c.MaxBytes)
+	}
+}
+
+// **The membership names each of the owner's logs** with exactly the field names the runtime reads:
+// `logs`, and in each `name`, `stream`, `subject`, `writes`. A module with no log is issued none, and
+// the field is absent.
+func TestAMembershipListsItsModulesLogs(t *testing.T) {
+	m := MembershipFor("one", Declared{Module: "mesh-issues",
+		Logs: []Log{{Module: "mesh-issues", Name: "changes"}}}, Placements{})
+	raw, err := json.Marshal(m)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var back map[string]json.RawMessage
+	if err := json.Unmarshal(raw, &back); err != nil {
+		t.Fatal(err)
+	}
+	if got := string(back["logs"]); got !=
+		`[{"name":"changes","stream":"LOG_mesh-issues_changes","subject":"mesh.log.mesh-issues.changes","writes":true}]` {
+		t.Fatalf("the membership's logs are %s", got)
+	}
+	none, _ := json.Marshal(MembershipFor("one", Declared{Module: "audit"}, Placements{}))
+	if strings.Contains(string(none), `"logs"`) {
+		t.Fatalf("a module with no log was issued logs: %s", none)
+	}
+}
+
+// logGrantsOf is the grants of a principal that are about logs.
+func logGrantsOf(publish []string) []string {
+	var out []string
+	for _, s := range publish {
+		if strings.HasPrefix(s, "mesh.log.") || strings.Contains(s, ".LOG_") {
+			out = append(out, s)
+		}
+	}
+	slices.Sort(out)
+	return out
+}
+
+// **The runtime is granted exactly the contract's subjects for each log it carries, and nothing else
+// of any log**: appending under the log's subjects, binding to its stream, reading it directly. No
+// consumer, no delete, no purge, and nothing of a log its modules do not keep.
+func TestTheRuntimeIsGrantedItsModulesLogsAndNoMore(t *testing.T) {
+	perms, err := PermissionsFor(Principal{Kind: KindNodeTools, Node: "one", Module: RuntimeModule,
+		Carries: []Declared{
+			{Module: "mesh-issues", Logs: []Log{{Module: "mesh-issues", Name: "changes"}}},
+			{Module: "audit"},
+		}, PasswordHash: "x"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := []string{
+		"$JS.API.DIRECT.GET.LOG_mesh-issues_changes",
+		"$JS.API.DIRECT.GET.LOG_mesh-issues_changes.>",
+		"$JS.API.STREAM.INFO.LOG_mesh-issues_changes",
+		"mesh.log.mesh-issues.changes.>",
+	}
+	if got := logGrantsOf(perms.Publish); !slices.Equal(got, want) {
+		t.Fatalf("the runtime is granted\n %q\nwant\n %q", got, want)
+	}
+	for _, s := range perms.Subscribe {
+		if strings.HasPrefix(s, "mesh.log.") || strings.Contains(s, "LOG_") {
+			t.Fatalf("the runtime subscribes a log's subjects: %q", s)
+		}
+	}
+	// A module running on its own account is granted the same for its own logs.
+	own, err := PermissionsFor(Principal{Kind: KindModule, Node: "one", Module: "mesh-issues",
+		Logs: []string{"changes"}, PasswordHash: "x"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := logGrantsOf(own.Publish); !slices.Equal(got, want) {
+		t.Fatalf("the module's own account is granted\n %q\nwant\n %q", got, want)
+	}
+	// And a module with no log, nothing of any.
+	none, err := PermissionsFor(Principal{Kind: KindModule, Node: "one", Module: "audit", PasswordHash: "x"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := logGrantsOf(none.Publish); len(got) != 0 {
+		t.Fatalf("a module with no log is granted %q", got)
+	}
+}
+
+// A log name or module that is not one plain token is issued and granted nothing rather than a
+// pattern that happens to parse.
+func TestALogThatNamesNoStreamGrantsNothing(t *testing.T) {
+	if got := logGrants("a", []string{"x.y", "x>", "*", ""}); len(got) != 0 {
+		t.Fatalf("granted %v for logs that name no stream", got)
+	}
+	if got := logGrants("a.b", []string{"c"}); len(got) != 0 {
+		t.Fatalf("granted %v for a module that is not one token", got)
+	}
+}
+
+type logs struct {
+	ensured []string
+	on      []string
+}
+
+func (l *logs) EnsureLog(x Log) error         { l.ensured = append(l.ensured, x.Stream()); return nil }
+func (l *logs) LogStreams() ([]string, error) { return l.on, nil }
+
+// Every declared log is asserted; one on the server that nothing declares is said, not removed — and
+// the asserter has no way to remove one.
+func TestRaisingLogsReportsWhatNothingDeclares(t *testing.T) {
+	l := &logs{on: []string{"LOG_mesh-issues_changes", "LOG_gone_old", "KV_not_a_log"}}
+	undeclared, err := RaiseLogs(l, []Log{{Module: "mesh-issues", Name: "changes"}, {Module: "a", Name: "b"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !slices.Equal(l.ensured, []string{"LOG_a_b", "LOG_mesh-issues_changes"}) {
+		t.Fatalf("asserted %v", l.ensured)
+	}
+	if !slices.Equal(undeclared, []string{"LOG_gone_old"}) {
+		t.Fatalf("reported %v", undeclared)
+	}
+}
+
+// **No path of the mesh deletes or purges a log or a bucket, or recreates one** (novox/hq ADR 0297 §2,
+// ADR 0201 §15–16): no code of this repository outside its tests calls the client's stream or bucket
+// delete, or purges a stream, but for the controller lease's own stream, which purges its own history
+// below a sequence (internal/lease). A new call is a decision, not a refactor.
+func TestNoPathDeletesALogOrABucket(t *testing.T) {
+	removers := map[string]bool{"DeleteStream": true, "DeleteKeyValue": true, "PurgeStream": true,
+		"DeleteObjectStore": true}
+	root := filepath.Join("..", "..")
+	var found []string
+	for _, dir := range []string{"cmd", "internal"} {
+		err := filepath.WalkDir(filepath.Join(root, dir), func(path string, e fs.DirEntry, err error) error {
+			if err != nil || e.IsDir() || !strings.HasSuffix(path, ".go") || strings.HasSuffix(path, "_test.go") {
+				return err
+			}
+			f, err := parser.ParseFile(token.NewFileSet(), path, nil, 0)
+			if err != nil {
+				return err
+			}
+			ast.Inspect(f, func(n ast.Node) bool {
+				call, ok := n.(*ast.CallExpr)
+				if !ok {
+					return true
+				}
+				sel, ok := call.Fun.(*ast.SelectorExpr)
+				if !ok {
+					return true
+				}
+				name := sel.Sel.Name
+				if removers[name] || (name == "Purge" && !strings.Contains(filepath.ToSlash(path), "internal/lease/")) {
+					found = append(found, path+": "+name)
+				}
+				return true
+			})
+			for _, lit := range stringsIn(f) {
+				if strings.Contains(lit, "$JS.API.STREAM.DELETE") || strings.Contains(lit, "$JS.API.STREAM.PURGE") {
+					// Only the writers table names it, as a subject no one but the controller may publish.
+					if !strings.HasSuffix(filepath.ToSlash(path), "internal/broker/writers.go") {
+						found = append(found, path+": "+lit)
+					}
+				}
+			}
+			return nil
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+	if len(found) > 0 {
+		t.Fatalf("a path of the mesh removes a stream, a bucket or what one holds:\n  %s", strings.Join(found, "\n  "))
+	}
+}
+
+// stringsIn is every string literal of a file.
+func stringsIn(f *ast.File) []string {
+	var out []string
+	ast.Inspect(f, func(n ast.Node) bool {
+		if lit, ok := n.(*ast.BasicLit); ok && lit.Kind == token.STRING {
+			out = append(out, lit.Value)
+		}
+		return true
+	})
+	return out
+}
+
+// Against a real server: a log is created as its configuration says, asserting it again keeps what
+// it holds, a changed cap is brought to match in place, an entry cannot be deleted from it, and one
+// nothing declares any more is reported and stays.
+func TestALogIsAssertedInPlaceAndNeverRemoved(t *testing.T) {
+	bus := aLiveBus(t)
+	l := Log{Module: "logtest", Name: "changes", MaxMiB: 1}
+	if _, err := RaiseLogs(bus, []Log{l}); err != nil {
+		t.Fatalf("a real server refused a module's log: %v", err)
+	}
+	js, err := jetstream.New(bus.Conn())
+	if err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	ack, err := js.Publish(ctx, l.Subject()+".7", []byte(`{"op":"opened"}`))
+	if err != nil {
+		t.Fatalf("an append to the log was refused: %v", err)
+	}
+	stream, err := js.Stream(ctx, l.Stream())
+	if err != nil {
+		t.Fatal(err)
+	}
+	have := stream.CachedInfo().Config
+	want := l.Config()
+	if have.Storage != want.Storage || have.Retention != want.Retention || have.MaxAge != 0 ||
+		have.MaxMsgsPerSubject != -1 || have.MaxBytes != want.MaxBytes || have.MaxMsgSize != want.MaxMsgSize ||
+		have.Discard != jetstream.DiscardNew || !have.AllowDirect || !have.DenyDelete || !have.DenyPurge ||
+		have.Replicas != 1 || !slices.Equal(have.Subjects, want.Subjects) {
+		t.Fatalf("the server holds the log as %+v", have)
+	}
+	if err := stream.DeleteMsg(ctx, ack.Sequence); err == nil {
+		t.Fatal("an entry was deleted from a log")
+	}
+	l.MaxMiB = 2
+	if _, err := RaiseLogs(bus, []Log{l}); err != nil {
+		t.Fatalf("asserting the log again failed, so a restart would: %v", err)
+	}
+	info, err := stream.Info(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if info.Config.MaxBytes != 2*1024*1024 {
+		t.Fatalf("the changed cap was not brought to match: %d", info.Config.MaxBytes)
+	}
+	if info.State.Msgs < 1 {
+		t.Fatal("asserting the log again lost what it held")
+	}
+	undeclared, err := RaiseLogs(bus, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !slices.Contains(undeclared, l.Stream()) {
+		t.Fatalf("a log nothing declares was not reported: %v", undeclared)
+	}
+	if _, err := js.Stream(ctx, l.Stream()); err != nil {
+		t.Fatalf("a log nothing declares is gone: %v", err)
+	}
+}

internal/broker/membership.go

@@ -51,6 +51,10 @@ type Membership struct {
 	// and refuses, with the reason, what is not on it — the bus enforces only the union over every
 	// module on the machine.
 	State []StateIssued `json:"state,omitempty"`
+	// Logs is every log this module's code may reach, by the name it uses for each (novox/hq ADR 0297):
+	// its own and no other's, since a log is its owner's alone. The runtime answers a bundle's log verbs
+	// from this list and refuses, with the reason, a log not on it.
+	Logs []LogIssued `json:"logs,omitempty"`
 	// SeatTraffic is what this module's code may submit, say, hear, take, ask, answer and read on seats
 	// that name their caller or their kind (novox/hq ADR 0259 §3). The runtime carrying the module
 	// publishes, takes and answers for it only what is listed here: the bus enforces only the union
@@ -121,6 +125,7 @@ func MembershipFor(node string, d Declared, where Placements) Membership {
 		}
 	}
 	m.State = stateIssuedFor(d, node)
+	m.Logs = logsIssuedFor(d)
 	t := SeatTrafficOf(d.Module, d.Holds, d.Uses, d.Watches)
 	for _, s := range append(append([]Seat{}, d.Uses...), d.Watches...) {
 		if !s.Kinded {

internal/broker/nats.go

@@ -132,6 +132,8 @@ type Principal struct {
 	// no other; KeyedReads the keys of others' state it reads one key at a time (novox/hq ADR 0260).
 	PerMachine []string
 	KeyedReads []KeyedRead
+	// Logs is the local names of the logs this principal's module keeps (novox/hq ADR 0297).
+	Logs []string
 
 	// SnapshotsTheBus is the bus's own module, the one holding mesh-broker (novox/hq ADR 0235). Its
 	// whole authority is BusSnapshotGrants: it copies the streams for the night's backup and nothing
@@ -746,6 +748,8 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		//    watched, its own written too.
 		pub = append(pub, stateGrants(stateAccess{Module: p.Module, Node: p.Node, Keeps: p.State,
 			PerMachine: p.PerMachine, Reads: p.Reads, KeyedReads: p.KeyedReads})...)
+		// And its logs (novox/hq ADR 0297): appended to and read directly, its own alone.
+		pub = append(pub, logGrants(p.Module, p.Logs)...)
 
 		// 6. Its traffic on seats that name their caller or their kind, ask proofs or keep records
 		//    (novox/hq ADR 0259 §3).
@@ -833,6 +837,12 @@ func PermissionsFor(p Principal) (Permissions, error) {
 			pub = append(pub, stateGrants(stateAccess{Module: d.Module, Node: p.Node, Keeps: stateNames(d.State),
 				PerMachine: perMachineNames(d.State), Reads: d.Reads, KeyedReads: d.KeyedReads})...)
 		}
+		// **And it keeps the logs of the modules it carries** (novox/hq ADR 0297): each module's own, the
+		// union over them. That one module's code does not append to another's log through it is the
+		// runtime's to keep, from the logs each membership lists.
+		for _, d := range p.Carries {
+			pub = append(pub, logGrants(d.Module, logNames(d.Logs))...)
+		}
 		// **Never the traffic of a trusted holder** (novox/hq ADR 0259 §8): the machine's runtime runs as the
 		// operator's account, which every agent runs as, so a module saying warrants or speaking for a kind
 		// that proves its sender is never composed into it — refused here, naming it, whatever registration

internal/broker/users.go

@@ -35,6 +35,8 @@ type Declared struct {
 	Invokes []string
 	// State is the state it keeps, each a bucket its instances write (novox/hq ADR 0201).
 	State []Bucket
+	// Logs are the logs it keeps, each a stream its instances append to (novox/hq ADR 0297).
+	Logs []Log
 	// Reads are other modules' state it reads, each `<module>.<name>` (novox/hq ADR 0201).
 	Reads []string
 	// KeyedReads are keys of other modules' state it reads, each one key alone: what a seat's holder is
@@ -124,6 +126,7 @@ func Users(r Records) ([]Principal, error) {
 				Holds: d.Holds, Uses: d.Uses, Watches: d.Watches, Invokes: d.Invokes,
 				State: stateNames(d.State), Reads: d.Reads, SnapshotsTheBus: d.SnapshotsTheBus,
 				PerMachine: perMachineNames(d.State), KeyedReads: d.KeyedReads,
+				Logs: logNames(d.Logs),
 			})
 		}
 		if runtimeHere {