Land feature 57's controller work on its release branch

The controller plans config, templates and moved providers' provisions,
hands bus accounts to the vault and judges the new manifest words, on the
feature's SDK and node-engine validator (feature 57, config and provisioning).

internal/link/receive_nats_test.go

@@ -405,16 +405,15 @@ func TestEverySubjectTheControllerFollowsDecodesToAKind(t *testing.T) {
 // The bus waits a fixed time to be told a message was taken and then redelivers, which is right for
 // a consumer that died and wrong for one that is busy. Acting on a merge builds modules — minutes
 // against a thirty-second window — and the same merge was handed over five times while the first
-// build was still running (2026-09-28). Here the window is two seconds and the work takes six.
+// build was still running (2026-09-28). Here the window is a second and the work takes three.
 func TestNatsWorkSlowerThanTheWindowIsNotHandedOverAgain(t *testing.T) {
+	// Work that outlives a window of a second three times over, said while it runs four times a window (novox/hq
+	// issue 717: the test once set its window before the serving loop asserted the controller's own of thirty
+	// seconds, so it waited nine seconds and passed with the heartbeat removed).
+	before := heartbeatWhileWorking
+	heartbeatWhileWorking = 250 * time.Millisecond
+	t.Cleanup(func() { heartbeatWhileWorking = before })
 	js := aBus(t)
-	// The controller's own consumer, with a window short enough to outlive in a test.
-	if err := js.EnsureConsumer(broker.Consumer{
-		Name: broker.ControllerName, Stream: "CONTROL", Push: true, AckWaitSeconds: 2,
-		Why: "a window short enough to outlive in a test",
-	}); err != nil {
-		t.Fatal(err)
-	}
 	var mu sync.Mutex
 	handled := 0
 	slow := make(chan struct{})
@@ -426,10 +425,32 @@ func TestNatsWorkSlowerThanTheWindowIsNotHandedOverAgain(t *testing.T) {
 		first := handled == 1
 		mu.Unlock()
 		if first {
-			time.Sleep(6 * time.Second)
+			time.Sleep(3 * time.Second)
 			close(slow)
 		}
 	}}
+	// The controller's own consumer, given a window short enough to outlive in a test once the serving loop has
+	// asserted it and bound to it: asserted after this, it would be the controller's window of thirty seconds,
+	// which is how this test once waited out a window it never had.
+	for deadline := time.Now().Add(10 * time.Second); ; {
+		info, err := js.Context().ConsumerInfo("CONTROL", broker.ControllerName)
+		if err == nil && info.PushBound {
+			break
+		}
+		if time.Now().After(deadline) {
+			t.Fatalf("the serving loop never bound the controller's consumer: %v", err)
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	if err := js.EnsureConsumer(broker.Consumer{
+		Name: broker.ControllerName, Stream: "CONTROL", Push: true, AckWaitSeconds: 1,
+		Why: "a window short enough to outlive in a test",
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if info, err := js.Context().ConsumerInfo("CONTROL", broker.ControllerName); err != nil || info.Config.AckWait != time.Second {
+		t.Fatalf("the controller's consumer does not have the test's window of a second: %v", err)
+	}
 
 	body, err := json.Marshal(Report{Node: "anchor", Declared: "d1", Applied: []string{"store"}})
 	if err != nil {
@@ -444,12 +465,21 @@ func TestNatsWorkSlowerThanTheWindowIsNotHandedOverAgain(t *testing.T) {
 		t.Fatal("the slow work never finished")
 	}
 	// A moment for a redelivery to arrive, if the bus were going to send one.
-	time.Sleep(3 * time.Second)
+	time.Sleep(1500 * time.Millisecond)
 	mu.Lock()
 	defer mu.Unlock()
 	if handled != 1 {
 		t.Fatalf("one report was handled %d times, so slow work is run again while it is running", handled)
 	}
+	// Not handed over again at all: the loop drops a copy of what it is already doing, so the count above alone
+	// would pass on a bus that redelivered the work every window; the bus's own count says it did not.
+	info, err := js.Context().ConsumerInfo("CONTROL", broker.ControllerName)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if info.NumRedelivered != 0 {
+		t.Fatalf("the bus handed the report over again %d time(s) while it was being worked on", info.NumRedelivered)
+	}
 }
 
 // slowly is a listener that runs whatever it was given.