Move to mesh-sdk 16984aa, rebased on its main, which refuses a warrant with no time or for an ask with no expiry

Choosing Silence silenced the condition, the condition was no longer wanted, and the next reconcile
cancelled the Restart or Release ask beside it: an acknowledgement, which any desk click may give,
took an approval back. An open approval ask now stays until it is answered or expires while its
condition is open and silenced with the same answers. The test silences as the controller does; it
failed before (0 open) and passes, and the kept Restart is performed on its warrant.

Dockerfile

@@ -1,5 +1,11 @@
-ARG GO_BASE=golang:1.25-alpine
-# The control plane's image.
+# The Go it builds with, pinned here because genesis builds this file with no arguments (novox/hq
+# issue 223) — the Makefile passes the same digest. A tag older than go.mod asks for is how
+# `make image` broke once before (issue 146).
+ARG GO_BASE=golang@sha256:8ac98ca534ac3f51e1f420a1dd2c15e74c75cfa0f23f3ad27eb5d7236c349a0c
+# The control plane's image — for genesis and the lab only. The mesh runs the controller as a Go
+# bundle the host starts as a process (module.json; novox/hq issue 213), and builds no image of it.
+# Genesis builds this file and raises it as the container the process replaces on the first push
+# (mesh-host internal/bootstrap, novox/hq issue 223).
 #
 # novox/hq ADR 0006: this image is pinned by digest in the bundle the host carries, fetched on a
 # machine where no mesh exists yet, and run before there is anything to check it against. So it
@@ -15,13 +21,15 @@ ARG GO_BASE=golang:1.25-alpine
 FROM ${GO_BASE} AS build
 WORKDIR /src
 
-# Dependencies first, so a change to the source does not refetch them.
+# **Nothing is fetched** (novox/hq to-be 45 Phase 1): every dependency is in vendor/, committed, so
+# the image builds from this repository alone — the host's validator among them, whose module no
+# public proxy is asked for. Dependencies first, so a change to the source does not re-copy them.
 COPY go.mod go.sum ./
-RUN go mod download
+COPY vendor/ vendor/
 
 COPY . .
 ARG VERSION=development
-RUN CGO_ENABLED=0 go build -trimpath \
+RUN CGO_ENABLED=0 GOFLAGS=-mod=vendor GOPROXY=off go build -trimpath \
         -ldflags "-s -w -X main.version=${VERSION}" \
         -o /mesh-controller ./cmd/mesh-controller
 

Makefile

@@ -27,17 +27,21 @@ build:
 IMAGE ?= mesh-controller:$(VERSION)
 DEV_TAG ?= mesh-controller:development
 
-# The base the module declares, read from the manifest rather than written here twice.
+# The Go base the image is built on.
 #
 # **`make image` was broken and stayed broken**, because the Dockerfile's fallback base was a Go
 # older than go.mod asks for: every build died at `go mod download` with "go.mod requires go >=
 # 1.26.0", and the pipeline never saw it because the pipeline passes the declared base in. Anybody
 # building the image by hand hit it and had to find the digest themselves (novox/hq 04-ISSUES/146,
 # what it cost).
-GO_BASE ?= $(shell python3 -c "import json;print(next(o['image'] for o in json.load(open('module.json'))['build']['on'] if o['arg']=='GO_BASE'))" 2>/dev/null)
+#
+# **Pinned here since the manifest stopped building an image** (novox/hq issue 213): the mesh builds
+# the controller as a Go bundle with its own toolchain, and only `make image` — genesis and the lab —
+# still needs a Go base. The digest is the one the manifest declared until then.
+GO_BASE ?= golang@sha256:8ac98ca534ac3f51e1f420a1dd2c15e74c75cfa0f23f3ad27eb5d7236c349a0c
 
 image:
-	@test -n "$(GO_BASE)" || { echo "module.json declares no GO_BASE; pass GO_BASE=<image> or fix the manifest"; exit 1; }
+	@test -n "$(GO_BASE)" || { echo "no GO_BASE; pass GO_BASE=<image>"; exit 1; }
 	docker build --build-arg GO_BASE=$(GO_BASE) --build-arg VERSION=$(VERSION) -t $(IMAGE) -t $(DEV_TAG) .
 	@echo
 	@docker image inspect $(IMAGE) --format 'built {{.RepoTags}}  {{.Size}} bytes'
@@ -48,7 +52,7 @@ BUILDER_IMAGE ?= mesh-builder:$(VERSION)
 BUILDER_DEV_TAG ?= mesh-builder:development
 
 builder-image:
-	@test -n "$(GO_BASE)" || { echo "module.json declares no GO_BASE; pass GO_BASE=<image> or fix the manifest"; exit 1; }
+	@test -n "$(GO_BASE)" || { echo "no GO_BASE; pass GO_BASE=<image>"; exit 1; }
 	docker build --build-arg GO_BASE=$(GO_BASE) -f cmd/mesh-builder/Dockerfile -t $(BUILDER_IMAGE) -t $(BUILDER_DEV_TAG) .
 	@echo
 	@docker image inspect $(BUILDER_IMAGE) --format 'built {{.RepoTags}}  {{.Size}} bytes'
@@ -98,18 +102,18 @@ proxy-image:
 # The whole gate. Raises a database, runs everything against it, and takes it down again --
 # including when the tests fail, which is why the teardown is not conditional.
 #
-# **One package at a time (-p 1), and it is not about speed.** The live tests reach one bus, and on
-# it they assert, read and remove the mesh's own objects -- streams and consumers with fixed names,
-# because those names are the mesh's and a test cannot choose others. Two packages doing that at once
-# is one deleting a consumer the other is reading through, and the failure lands in whichever test
-# was reading, as "no response from stream". That reads as a bug in the code under test.
+# **Packages in parallel, under the race detector, each test on a bus of its own** (internal/testbus).
+# It was one package at a time against one shared bus, because the live tests assert, read and remove
+# the mesh's own objects by their fixed names, and two packages at once deleted what the other read; the
+# suite was red run as Go runs it and read as noise. A bus per test, of the release the mesh runs, made
+# it the same in any order. The timeout bounds a hang to a failure with a stack, never a stalled gate.
 check: fmt vet postgres
-	@go test -p 1 ./... ; status=$$? ; $(MAKE) postgres-stop ; exit $$status
+	@go test -race -timeout 15m ./... ; status=$$? ; $(MAKE) postgres-stop ; exit $$status
 
-# Without a database the live tests skip rather than fail, so this is the honest subset and not
-# the gate. Serialised for the same reason check is: a bus may be configured even when a store is not.
+# Without a database the store's tests skip rather than fail, so this is the honest subset and not
+# the gate.
 test:
-	go test -p 1 ./...
+	go test -timeout 15m ./...
 
 vet:
 	go vet ./...

README.md

@@ -193,6 +193,13 @@ passes every check that only looks at the message.
 
 ## The image
 
+**The mesh no longer runs the controller from it** (novox/hq issue 213). The module declares a Go
+bundle, `controller`, which the host on the controller's machine unpacks and runs as the process
+`mesh-controller` under the account of the same name (ADR 0188 §1, §3). The image stays for what
+still runs a container of the controller: genesis, which raises the first controller from it and
+installs the module from its manifest (mesh-host `internal/bootstrap`), and the lab. Neither is the
+mesh's own build any more — `make image` builds it.
+
 `FROM scratch`, holding one statically linked binary and nothing else — no shell, no package
 manager, no libc, no CA certificates.
 

cmd/mesh-builder/holder.go

@@ -0,0 +1,402 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/nats-io/nats.go/micro"
+
+	"github.com/novox/mesh-controller/internal/builder"
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// What a holder of the build seat answers for, on its own machine (novox/hq ADR 0219).
+//
+// **The queue is the controller's; the build running here is this machine's.** The controller can
+// see and change what waits in the seat's queue, but an ask a holder already took is a process tree
+// on this machine and containers in this machine's runtime, and only this machine can end them. So
+// the holder serves four verbs on the seat's subjects for this machine: what it is building, kill
+// it, pause, resume.
+//
+// **One build at a time** (ADR 0190), which is also what builder.Said assumes — a package global
+// set per build — so "the build running here" is one or none, and kill names it by id so a call
+// that arrives as one build ends and the next begins cannot end the wrong one.
+
+// holder is this machine's state as a holder of the build seat.
+type holder struct {
+	on, seat string
+	// workspace is where the paused flag is kept, so a holder restarted while paused stays paused
+	// rather than silently taking work again.
+	workspace string
+	// say publishes this machine's state: whether it takes work (link.HolderState).
+	say func(link.HolderState) error
+	// remove runs what a kill needs outside the build: the containers left behind.
+	remove builder.Runner
+
+	mu      sync.Mutex
+	paused  bool
+	running *running
+}
+
+// running is the build this machine is doing.
+type running struct {
+	request link.BuildRequest
+	step    string
+	started time.Time
+	cancel  context.CancelFunc
+	killed  bool
+	// returned is the build's own work having ended, before a kill or not; outcome is what was then
+	// announced, and announced whether it went out.
+	returned  bool
+	outcome   string
+	announced bool
+	done      chan struct{}
+}
+
+// pausedFile is where the flag lives in the workspace.
+func pausedFile(workspace string) string { return filepath.Join(workspace, ".mesh-builder-paused") }
+
+// newHolder reads the paused flag the workspace keeps.
+func newHolder(on, seat, workspace string, say func(link.HolderState) error) *holder {
+	h := &holder{on: on, seat: seat, workspace: workspace, say: say, remove: plainRun}
+	if _, err := os.Stat(pausedFile(workspace)); err == nil {
+		h.paused = true
+	}
+	return h
+}
+
+// Paused is asked by the taking loop before every fetch.
+func (h *holder) Paused() bool {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	return h.paused
+}
+
+// setPaused records the flag in the workspace first and then in memory, so what this holder says
+// it is and what it would be after a restart never differ.
+func (h *holder) setPaused(paused bool) error {
+	path := pausedFile(h.workspace)
+	if paused {
+		if err := os.MkdirAll(h.workspace, 0o755); err != nil {
+			return err
+		}
+		if err := os.WriteFile(path, []byte(time.Now().UTC().Format(time.RFC3339)+"\n"), 0o644); err != nil {
+			return fmt.Errorf("cannot keep the paused flag in %s: %w", path, err)
+		}
+	} else if err := os.Remove(path); err != nil && !errors.Is(err, os.ErrNotExist) {
+		return fmt.Errorf("cannot remove the paused flag %s: %w", path, err)
+	}
+	h.mu.Lock()
+	h.paused = paused
+	h.mu.Unlock()
+	h.announce()
+	return nil
+}
+
+// announce says whether this machine takes work. Never fatal: the flag is kept either way, and the
+// controller reading an older state is a plan read as late rather than a build lost.
+func (h *holder) announce() {
+	if h.say == nil {
+		return
+	}
+	if err := h.say(link.HolderState{On: h.on, Paused: h.Paused(), At: time.Now().UTC().Format(time.RFC3339Nano)}); err != nil {
+		fmt.Fprintf(os.Stderr, "cannot say whether this machine takes builds: %v\n", err)
+	}
+}
+
+// stateWhilePaused says this machine's state at start, and again every while it stays paused, so
+// a pause outlives the events stream's retention.
+func (h *holder) stateWhilePaused(ctx context.Context, every time.Duration) {
+	h.announce()
+	tick := time.NewTicker(every)
+	defer tick.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-tick.C:
+			if h.Paused() {
+				h.announce()
+			}
+		}
+	}
+}
+
+// begin records the build this machine took, with the cancel that ends it.
+func (h *holder) begin(request link.BuildRequest, cancel context.CancelFunc) *running {
+	r := &running{request: request, started: time.Now(), cancel: cancel, done: make(chan struct{})}
+	h.mu.Lock()
+	h.running = r
+	h.mu.Unlock()
+	return r
+}
+
+// end clears it, and lets a kill waiting on it know it is over.
+func (h *holder) end(r *running) {
+	h.mu.Lock()
+	if h.running == r {
+		h.running = nil
+	}
+	h.mu.Unlock()
+	close(r.done)
+}
+
+// stepped records the step a build is at, for `current`.
+func (h *holder) stepped(r *running, step string) {
+	h.mu.Lock()
+	r.step = step
+	h.mu.Unlock()
+}
+
+// currentBuild is what `current` answers.
+type currentBuild struct {
+	On      string `json:"on"`
+	Paused  bool   `json:"paused"`
+	Running *struct {
+		ID         string `json:"id"`
+		Repository string `json:"repository"`
+		Path       string `json:"path,omitempty"`
+		Ref        string `json:"ref,omitempty"`
+		Step       string `json:"step,omitempty"`
+		Started    string `json:"started"`
+		Elapsed    string `json:"elapsed"`
+	} `json:"running,omitempty"`
+	Said string `json:"said"`
+}
+
+func (h *holder) current() currentBuild {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	out := currentBuild{On: h.on, Paused: h.paused}
+	taking := "taking builds"
+	if h.paused {
+		taking = "paused, taking no new build"
+	}
+	if h.running == nil {
+		out.Said = fmt.Sprintf("%s is building nothing; %s", h.on, taking)
+		return out
+	}
+	r := h.running
+	elapsed := time.Since(r.started).Round(time.Second)
+	out.Running = &struct {
+		ID         string `json:"id"`
+		Repository string `json:"repository"`
+		Path       string `json:"path,omitempty"`
+		Ref        string `json:"ref,omitempty"`
+		Step       string `json:"step,omitempty"`
+		Started    string `json:"started"`
+		Elapsed    string `json:"elapsed"`
+	}{r.request.ID, r.request.Repository, r.request.Path, r.request.Ref, r.step,
+		r.started.UTC().Format(time.RFC3339), elapsed.String()}
+	out.Said = fmt.Sprintf("%s is building %s (%s) at %s for %s; %s",
+		h.on, r.request.Repository, r.request.ID, orNothing(r.step), elapsed, taking)
+	return out
+}
+
+// The bounds a kill keeps: each pass removing containers, and the wait for the build to end between
+// them. The worst case — 15s, 20s, 15s — is inside what the controller waits for the answer
+// (killAnswer in the controller's queue.go, 75s).
+var (
+	killRemoves = 15 * time.Second
+	killWaits   = 20 * time.Second
+)
+
+// kill ends the build with this id, if it is the one running here and still working: its context
+// cancelled — which kills each command's process group — and the containers it started removed by
+// their label, once at once and again after the build has ended, so one created while it was being
+// killed is not left. The build's own goroutine announces it failed, killed by hand, and settles the
+// ask so it is not redelivered; the answer says whether that happened.
+func (h *holder) kill(id string) (string, error) {
+	h.mu.Lock()
+	r := h.running
+	if r == nil || r.request.ID != id {
+		doing := "nothing"
+		if r != nil {
+			doing = r.request.ID
+		}
+		h.mu.Unlock()
+		return "", fmt.Errorf("%s is not building %s; it is building %s. `queue` says where an ask is", h.on, id, doing)
+	}
+	if r.returned {
+		h.mu.Unlock()
+		return "", fmt.Errorf("%s on %s has already ended on its own and is saying how; `builds` shows it", id, h.on)
+	}
+	r.killed = true
+	cancel, done := r.cancel, r.done
+	h.mu.Unlock()
+
+	cancel()
+	removed, removeErr := h.removeContainers(id)
+	ended := false
+	select {
+	case <-done:
+		ended = true
+	case <-time.After(killWaits):
+	}
+	again, againErr := h.removeContainers(id)
+	removed += again
+	if removeErr == nil {
+		removeErr = againErr
+	}
+	containers := fmt.Sprintf("%d container(s) it started removed", removed)
+	if removeErr != nil {
+		containers = "its containers could not all be listed or removed: " + removeErr.Error()
+	}
+	if !ended {
+		return fmt.Sprintf("killed %s on %s: %s; the build has not finished ending yet — `builds` says when "+
+			"its outcome is in", id, h.on, containers), nil
+	}
+	h.mu.Lock()
+	outcome, announced := r.outcome, r.announced
+	h.mu.Unlock()
+	if !announced {
+		return fmt.Sprintf("killed %s (%s) on %s: its commands ended and %s, and its outcome could not be "+
+			"announced — the ask is not settled and will be handed out again", id, r.request.Repository, h.on,
+			containers), nil
+	}
+	return fmt.Sprintf("killed %s (%s) on %s: its commands ended, %s, and its outcome announced as failed, %s — "+
+		"settled, so it is not handed to another machine", id, r.request.Repository, h.on, containers, outcome), nil
+}
+
+// removeContainers is one pass of removing what the build left, bounded.
+func (h *holder) removeContainers(id string) (int, error) {
+	cleanup, stop := context.WithTimeout(context.Background(), killRemoves)
+	defer stop()
+	return builder.RemoveContainersOf(cleanup, h.remove, id)
+}
+
+// removeLeftBehind removes, once, what earlier holders on this machine left — called before anything is
+// taken, so none of it is this holder's — and says what it did. A runtime that cannot be asked is said
+// and the holder takes work all the same: what is left is waste, not a reason to stop building.
+func (h *holder) removeLeftBehind() int {
+	cleanup, stop := context.WithTimeout(context.Background(), killRemoves)
+	defer stop()
+	n, err := builder.RemoveLeftBehind(cleanup, h.remove)
+	switch {
+	case err != nil:
+		fmt.Fprintf(os.Stderr, "could not look for containers earlier builds left on %s: %v\n", h.on, err)
+	case n > 0:
+		fmt.Fprintf(os.Stderr, "removed %d container(s) earlier builds left on %s\n", n, h.on)
+	}
+	return n
+}
+
+// returned records that the build's work ended, and says whether a kill came first — only then is
+// the build killed; an error it ended with on its own is its own outcome.
+func (h *holder) returned(r *running) bool {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	r.returned = true
+	return r.killed
+}
+
+// said records the outcome announced, and whether it went out, for a kill to answer with.
+func (h *holder) said(r *running, outcome string, announced bool) {
+	h.mu.Lock()
+	r.outcome, r.announced = outcome, announced
+	h.mu.Unlock()
+}
+
+// handlers are the seat's verbs, as this machine answers them.
+func (h *holder) handlers() map[string]link.ToolHandler {
+	return map[string]link.ToolHandler{
+		"current": func(context.Context, json.RawMessage) (any, error) { return h.current(), nil },
+		"kill": func(_ context.Context, raw json.RawMessage) (any, error) {
+			var args struct {
+				ID string `json:"id"`
+			}
+			if err := json.Unmarshal(raw, &args); err != nil || strings.TrimSpace(args.ID) == "" {
+				return nil, errors.New("kill needs the build's id")
+			}
+			said, err := h.kill(strings.TrimSpace(args.ID))
+			if err != nil {
+				return nil, err
+			}
+			return map[string]any{"said": said}, nil
+		},
+		"pause": func(context.Context, json.RawMessage) (any, error) {
+			if err := h.setPaused(true); err != nil {
+				return nil, err
+			}
+			said := h.on + " is paused: it takes no new build until resumed"
+			if c := h.current(); c.Running != nil {
+				said += "; " + c.Running.ID + " runs on and finishes"
+			}
+			return map[string]any{"said": said, "paused": true}, nil
+		},
+		"resume": func(context.Context, json.RawMessage) (any, error) {
+			if err := h.setPaused(false); err != nil {
+				return nil, err
+			}
+			return map[string]any{"said": h.on + " takes builds again", "paused": false}, nil
+		},
+	}
+}
+
+func orNothing(s string) string {
+	if s == "" {
+		return "its start"
+	}
+	return s
+}
+
+// plainRun runs a command outside any build: no line reaches a build's log, because the build whose
+// log it would be is the one being ended.
+func plainRun(ctx context.Context, dir, name string, args ...string) (string, error) {
+	cmd := exec.CommandContext(ctx, name, args...)
+	cmd.Dir = dir
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		return string(out), fmt.Errorf("%s %s: %w: %s", name, strings.Join(args, " "), err, strings.TrimSpace(string(out)))
+	}
+	return string(out), nil
+}
+
+// announcement is what this holder answers discovery with (novox/hq ADR 0195, ADR 0197): this
+// machine's verbs of the seat, in the shape every tool runtime announces a seat's verb — kind seat,
+// the module answering, the seat, scope node, the machine, its description and argument schema — so
+// the console finds `<node>/node-build-agent.kill` by searching, as it finds any seat's verb.
+//
+// One service per machine, named for the seat and identified by the machine, so the answer is this
+// machine's four verbs and nothing more. The verbs are the compiled seat row's: a build machine has no
+// store, and what it serves is what this binary was built to serve.
+func announcement(seat, module, node string) micro.Info {
+	s, _ := catalogue.SeatNamed(seat)
+	var endpoints []micro.EndpointInfo
+	for _, v := range s.Serves {
+		schema, _ := json.Marshal(v.Input)
+		endpoints = append(endpoints, micro.EndpointInfo{
+			Name:    seat + "__" + v.Name,
+			Subject: link.NodeSeatToolSubject(seat, v.Name, node),
+			// The queue group the verbs are served in, as every runtime announces its own.
+			QueueGroup: "seat." + seat,
+			Metadata: map[string]string{
+				"kind": "seat", "module": module, "tool": v.Name, "seat": seat, "scope": "node",
+				"node": node, "interchangeable": "false", "description": v.Description, "schema": string(schema),
+			},
+		})
+	}
+	return micro.Info{
+		ServiceIdentity: micro.ServiceIdentity{Name: seat, ID: node, Version: "0.1.0",
+			Metadata: map[string]string{"seat": seat, "scope": "node", "node": node, "module": module}},
+		Description: "what the build running on " + node + " is, and ending, pausing and resuming it (novox/hq ADR 0219)",
+		Endpoints:   endpoints,
+	}
+}
+
+// moduleOf is the module a credential was issued for: its user is `<node>.<module>`.
+func moduleOf(user string) string {
+	if _, module, ok := strings.Cut(user, "."); ok && module != "" {
+		return module
+	}
+	return "build-agent"
+}

cmd/mesh-builder/holder_test.go

@@ -0,0 +1,172 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"strings"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// A holder paused stays paused across its restart: the flag is kept in its workspace (novox/hq ADR
+// 0219), and what it says about itself follows.
+func TestAPausedHolderStaysPausedAcrossARestart(t *testing.T) {
+	workspace := t.TempDir()
+	var said []link.HolderState
+	h := newHolder("ace", link.TheBuildMachine, workspace, func(s link.HolderState) error {
+		said = append(said, s)
+		return nil
+	})
+	if h.Paused() {
+		t.Fatal("a new holder starts paused")
+	}
+	if _, err := h.handlers()["pause"](context.Background(), json.RawMessage(`{}`)); err != nil {
+		t.Fatal(err)
+	}
+	if !h.Paused() || len(said) != 1 || !said[0].Paused || said[0].On != "ace" {
+		t.Fatalf("paused: %v, said %+v", h.Paused(), said)
+	}
+	again := newHolder("ace", link.TheBuildMachine, workspace, nil)
+	if !again.Paused() {
+		t.Fatal("restarted, the holder forgot it was paused")
+	}
+	if _, err := again.handlers()["resume"](context.Background(), json.RawMessage(`{}`)); err != nil {
+		t.Fatal(err)
+	}
+	if newHolder("ace", link.TheBuildMachine, workspace, nil).Paused() {
+		t.Fatal("resumed, the holder came back paused")
+	}
+}
+
+// kill ends the build with that id — its context, which ends its commands — removes what it left by
+// label, and refuses an id it is not building.
+func TestKillEndsTheBuildRunningHereAndNoOther(t *testing.T) {
+	h := newHolder("ace", link.TheBuildMachine, t.TempDir(), nil)
+	var removed []string
+	h.remove = func(_ context.Context, _ string, name string, args ...string) (string, error) {
+		removed = append(removed, name+" "+strings.Join(args, " "))
+		if args[0] == "ps" {
+			return "c1\n", nil
+		}
+		return "", nil
+	}
+	kill := h.handlers()["kill"]
+	if _, err := kill(context.Background(), json.RawMessage(`{"id":"build-1"}`)); err == nil {
+		t.Fatal("killed a build while none ran")
+	}
+
+	building, cancel := context.WithCancel(context.Background())
+	r := h.begin(link.BuildRequest{ID: "build-1", Repository: "novox/a"}, cancel)
+	h.stepped(r, "image")
+	if c := h.current(); c.Running == nil || c.Running.ID != "build-1" || c.Running.Step != "image" {
+		t.Fatalf("current says %+v", c)
+	}
+	if _, err := kill(context.Background(), json.RawMessage(`{"id":"build-2"}`)); err == nil ||
+		!strings.Contains(err.Error(), "build-1") {
+		t.Fatalf("killed another id: %v", err)
+	}
+	// The build's own goroutine: it ends when its context does, as a build's commands do, and
+	// announces what came of it.
+	go func() {
+		<-building.Done()
+		if h.returned(r) {
+			h.said(r, link.KilledByHand, true)
+		}
+		h.end(r)
+	}()
+	answer, err := kill(context.Background(), json.RawMessage(`{"id":"build-1"}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if building.Err() == nil {
+		t.Fatal("the build's context was not cancelled")
+	}
+	if !r.killed {
+		t.Error("the build is not marked killed, so it would be announced as an ordinary failure")
+	}
+	said := answer.(map[string]any)["said"].(string)
+	if !strings.Contains(said, "2 container(s)") || !strings.Contains(said, "announced as failed") || !strings.Contains(said, link.KilledByHand) {
+		t.Errorf("kill said %q", said)
+	}
+	// Removed at the kill and again once the build had ended: a container made in between is caught.
+	if len(removed) != 4 || !strings.Contains(removed[0], "label=mesh.build=build-1") || !strings.Contains(removed[2], "label=mesh.build=build-1") {
+		t.Errorf("removed %v", removed)
+	}
+	if c := h.current(); c.Running != nil {
+		t.Errorf("after the kill current says %+v", c)
+	}
+}
+
+// A holder announces this machine's verbs of the seat as the console reads a seat's verb, and no more.
+func TestAHolderAnnouncesItsMachinesVerbsForTheConsole(t *testing.T) {
+	info := announcement(link.TheBuildMachine, moduleOf("ace.build-agent"), "ace")
+	if info.Name != "node-build-agent" || info.ID != "ace" || len(info.Endpoints) != 4 {
+		t.Fatalf("announced %s/%s with %d endpoints", info.Name, info.ID, len(info.Endpoints))
+	}
+	kill := info.Endpoints[1]
+	md := kill.Metadata
+	if kill.Subject != "mesh.seat.node-build-agent.tool.kill.ace" || kill.QueueGroup != "seat.node-build-agent" || md["kind"] != "seat" || md["seat"] != "node-build-agent" ||
+		md["scope"] != "node" || md["node"] != "ace" || md["tool"] != "kill" || md["module"] != "build-agent" ||
+		!strings.Contains(md["description"], "killed by hand") || !strings.Contains(md["schema"], `"id"`) {
+		t.Fatalf("kill is announced as %+v", kill)
+	}
+	body, err := json.Marshal(info)
+	if err != nil || len(body) > 8*1024 {
+		t.Fatalf("the answer is %d bytes (%v)", len(body), err)
+	}
+}
+
+// A build that ended on its own as the kill arrived says what it did: the kill is refused, and its
+// own error is its outcome. One whose outcome could not be announced is not said to be settled.
+func TestAKillArrivingAfterTheBuildEndedIsRefusedAndAnUnannouncedKillSaysSo(t *testing.T) {
+	h := newHolder("ace", link.TheBuildMachine, t.TempDir(), nil)
+	h.remove = func(context.Context, string, string, ...string) (string, error) { return "", nil }
+	_, cancel := context.WithCancel(context.Background())
+	r := h.begin(link.BuildRequest{ID: "build-1"}, cancel)
+	if killed := h.returned(r); killed {
+		t.Fatal("a build nobody killed reads as killed")
+	}
+	if _, err := h.kill("build-1"); err == nil || !strings.Contains(err.Error(), "ended on its own") {
+		t.Fatalf("killed a build that had ended: %v", err)
+	}
+	h.end(r)
+
+	building, cancel := context.WithCancel(context.Background())
+	r = h.begin(link.BuildRequest{ID: "build-2"}, cancel)
+	go func() {
+		<-building.Done()
+		if h.returned(r) {
+			h.said(r, link.KilledByHand, false)
+		}
+		h.end(r)
+	}()
+	said, err := h.kill("build-2")
+	if err != nil || strings.Contains(said, "announced as failed") || !strings.Contains(said, "could not be announced") {
+		t.Fatalf("kill said %q (%v)", said, err)
+	}
+}
+
+// **Issue 306**: a holder starting removes the containers earlier builds left on its machine, through
+// the runner a kill uses, and a runtime that cannot be asked does not stop it.
+func TestAHolderStartingRemovesWhatEarlierBuildsLeftHere(t *testing.T) {
+	h := newHolder("novox", link.TheBuildMachine, t.TempDir(), nil)
+	var removed []string
+	h.remove = func(_ context.Context, _ string, name string, args ...string) (string, error) {
+		removed = append(removed, name+" "+strings.Join(args, " "))
+		if args[0] == "ps" {
+			return "c1 build-1\nc2 build-1\nc3 check-here-2\n", nil
+		}
+		return "", nil
+	}
+	if n := h.removeLeftBehind(); n != 2 || len(removed) != 2 || removed[1] != "docker rm -f c1 c2" {
+		t.Fatalf("removed %d: %v", n, removed)
+	}
+	h.remove = func(context.Context, string, string, ...string) (string, error) {
+		return "", errors.New("no runtime")
+	}
+	if n := h.removeLeftBehind(); n != 0 {
+		t.Errorf("a runtime that cannot be asked removed %d", n)
+	}
+}

cmd/mesh-builder/main.go

@@ -19,11 +19,15 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"log"
 	"net/url"
 	"os"
 	"os/signal"
 	"strings"
 	"syscall"
+	"time"
+
+	"github.com/nats-io/nats.go"
 
 	"github.com/novox/mesh-controller/internal/broker"
 	"github.com/novox/mesh-controller/internal/builder"
@@ -107,43 +111,101 @@ func run() error {
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
 	defer stop()
 
-	machine, err := takeWorkFrom(credential, on)
+	js, seat, err := dialFor(credential)
 	if err != nil {
 		return err
 	}
+	defer js.Close()
+
+	// **This machine's holder: paused or not, and the build it is running** (novox/hq ADR 0219). The
+	// paused flag is read from the workspace before anything is taken, so a holder restarted while
+	// paused takes nothing.
+	h := newHolder(on, seat, workspace, func(state link.HolderState) error {
+		body, err := json.Marshal(state)
+		if err != nil {
+			return err
+		}
+		_, err = js.Context().Publish(link.BuildPausedOf(seat, on), body)
+		return err
+	})
+	if h.Paused() {
+		fmt.Fprintf(os.Stderr, "paused (kept in %s): taking no build until resumed\n", pausedFile(workspace))
+	}
+	// **What an earlier holder here left goes before anything is taken** (novox/hq issue 306): a holder
+	// recreated mid-check left the check's store and bus running, and the ask went to another machine.
+	h.removeLeftBehind()
+	machine := link.MachineOverNATSWith(js, on, seat, link.MachineOptions{Paused: h.Paused})
 	defer machine.Close()
 
+	// The seat's verbs, on this machine's subjects. Only the seat that declares them: the retired
+	// one serves none, and a subscription its holder has no grant for would be refused for ever.
+	if seat == link.TheBuildMachine {
+		stopServing, err := link.OverNATS{Conn: js.Conn()}.ServeNodeSeatTools(seat, on, h.handlers(),
+			log.New(os.Stderr, "", 0))
+		if err != nil {
+			return err
+		}
+		defer stopServing()
+		// And says so, for the console to find (novox/hq ADR 0197).
+		stopAnnouncing, err := link.OverNATS{Conn: js.Conn()}.Announce(
+			announcement(seat, moduleOf(credential.User), on), log.New(os.Stderr, "", 0))
+		if err != nil {
+			return err
+		}
+		defer stopAnnouncing()
+		go h.stateWhilePaused(ctx, time.Hour)
+	}
+
 	fmt.Fprintf(os.Stderr, "building for the mesh, publishing to %s\n", registry)
 	publisher := builder.Registry{Address: registry, Run: builder.Command}
 
 	return machine.Take(ctx, func(ctx context.Context, work link.Build) {
-		answer(ctx, publisher, on, workspace, work)
+		answer(ctx, publisher, on, workspace, work, h)
 	})
 }
 
-// takeWorkFrom opens this machine's link to whichever bus the mesh is on.
+// dialFor opens this machine's link to whichever bus the mesh is on, and says which build seat it
+// holds.
 //
 // **One place chooses**, as everywhere else the bus change went (novox/hq ADR 0116 step 5): a build
 // machine told about both would take work from one and answer on the other, and every log line would
 // say it was fine.
-func takeWorkFrom(credential Credential, on string) (link.BuildMachine, error) {
+func dialFor(credential Credential) (*broker.JetStream, string, error) {
 	// **The credential names the bus, and there is one** (novox/hq ADR 0131, design 28 task 5.5).
 	// A credential for the mesh's bus carries user, password and fingerprint beside the address,
 	// and that is enough to dial it, pinned.
 	if !credential.onTheNewBus() {
-		return nil, fmt.Errorf("the credential at hand names %q, which is not the mesh's bus", credential.URL)
+		return nil, "", fmt.Errorf("the credential at hand names %q, which is not the mesh's bus", credential.URL)
 	}
-	js, err := broker.DialPinned(credential.natsURL(), credential.Fingerprint)
+	// Named for what it is, not the controller whose code dials it (novox/hq issue 327).
+	host, _ := os.Hostname()
+	js, err := broker.DialPinned(credential.natsURL(), credential.Fingerprint, nats.Name("build agent on "+host))
 	if err != nil {
-		return nil, err
+		return nil, "", err
 	}
-	return link.MachineOverNATS(js, on), nil
+	// **The seat this machine serves is the one its credential claims** (novox/hq ADR 0190, the
+	// handover): the mesh issues a build machine's credential naming the seat its module claims,
+	// and one binary serves the old role as `builder` and the new as `build-agent` from that alone.
+	seat := link.BuildSeatClaimed(credential.seatsClaimed())
+	fmt.Fprintf(os.Stderr, "taking build work as a holder of %s\n", seat)
+	return js, seat, nil
 }
 
 // answer does one build and says what happened, whichever way it went.
-func answer(ctx context.Context, publisher builder.Publisher, on, workspace string, work link.Build) {
+func answer(ctx context.Context, publisher builder.Publisher, on, workspace string, work link.Build, h *holder) {
 	request := work.Request()
 
+	// **Its own context, so it can be killed alone** (novox/hq ADR 0219): cancelled by `kill`, it ends
+	// this build's commands and nothing else; the machine's own context ending — a SIGTERM — still
+	// reaches it through the parent, and that keeps today's meaning below.
+	building, cancel := context.WithCancel(ctx)
+	defer cancel()
+	var mine *running
+	if h != nil {
+		mine = h.begin(request, cancel)
+		defer h.end(mine)
+	}
+
 	// **First thing, and to stdout.** A build request that arrives and produces no visible line until
 	// it either finishes or fails is indistinguishable from one that never arrived — which cost a long
 	// diagnosis against a running mesh, chasing "the handler never fired" when the truth was only that
@@ -157,6 +219,9 @@ func answer(ctx context.Context, publisher builder.Publisher, on, workspace stri
 	say := func(step, message string) {
 		fmt.Fprintf(os.Stderr, "  [%s] %s\n", step, message)
 		work.Say(step, message)
+		if mine != nil && step != "run" && step != "output" {
+			h.stepped(mine, step)
+		}
 	}
 	builder.Said = say
 	defer func() { builder.Said = nil }()
@@ -166,7 +231,7 @@ func answer(ctx context.Context, publisher builder.Publisher, on, workspace stri
 
 	result := link.BuildResult{
 		ID: request.ID, Repository: request.Repository, Path: request.Path,
-		Ref: request.Ref, On: on, Source: request.Source,
+		Ref: request.Ref, On: on, Source: request.Source, DryRun: request.DryRun,
 	}
 	what := "building " + request.Repository
 	if request.Path != "" {
@@ -179,19 +244,50 @@ func answer(ctx context.Context, publisher builder.Publisher, on, workspace stri
 
 	npmrc, err := packagesFrom()
 	var built builder.Result
-	if err == nil {
+	if request.Check != nil {
+		// **A pull request's merge check, not a build** (novox/hq to-be 45 §9): nothing is built,
+		// published or registered; the verdict is the outcome.
+		result.Checked = request.Check
+		registry := ""
+		if r, ok := publisher.(builder.Registry); ok {
+			registry = r.Address
+		}
+		var v builder.CheckVerdict
+		v, err = builder.Check(building, builder.Command, checkSpecOf(request), workspace, registry, forgeFrom(), say)
+		if err == nil {
+			result.Check = &link.CheckOutcome{Verdict: v.Verdict, Summary: v.Summary, Report: v.Report,
+				Took: v.Took.Round(time.Second).String(), Gate: layerOf(v.Gate), RepoCheck: layerOf(v.Repo)}
+		}
+	} else if err == nil {
 		// The package-registry credential is a build input, so it is resolved before the clone: a
 		// build that could not have resolved its dependencies is refused in front of the reason, not
 		// after a clone that then fails at npm ci.
-		built, err = builder.Build(ctx, builder.Command, publisher,
+		// Every container it starts is labelled with its id, so a kill finds what outlived the
+		// docker client (ADR 0219).
+		built, err = builder.Build(building, builder.Labelled(builder.Command, request.ID), publisher,
 			request.Repository, request.Path, request.Ref, workspace, request.Held, npmrc,
 			forgeFrom(), say, request.Seats)
 	}
-	if err != nil {
+	// What it copied into the store, whatever became of the build (novox/hq ADR 0257).
+	result.Mirrored = built.Mirrored
+	// Only a build the kill ended: the kill came before its work did. One that finished — built, or
+	// failed on its own — in the moment the kill arrived says what it did, and the kill is refused.
+	killed := false
+	if mine != nil {
+		killed = h.returned(mine) && err != nil
+	}
+	if killed {
+		// **Killed by hand is the outcome, whatever the build was doing** (novox/hq ADR 0219): the
+		// error it ended with is the kill's consequence, not a fault of the source.
+		result.Failed = link.KilledByHand
+		say("failed", link.KilledByHand)
+	} else if err != nil {
 		// A failure is a result. A build that fails and says nothing is indistinguishable from a
 		// builder that is not running, and those want completely different responses.
 		result.Failed = err.Error()
 		say("failed", err.Error())
+	} else if request.Check != nil {
+		say("checked", result.Check.Verdict+": "+result.Check.Summary)
 	} else {
 		manifest, marshalErr := json.Marshal(built.Manifest)
 		if marshalErr != nil {
@@ -205,6 +301,8 @@ func answer(ctx context.Context, publisher builder.Publisher, on, workspace stri
 				})
 			}
 			result.Against = built.Against
+			result.SourceFingerprint = built.Source
+			result.Trunk, result.OnTrunk, result.Branches = built.Trunk, built.OnTrunk, built.Branches
 			for _, r := range built.Read {
 				result.Read = append(result.Read, link.ReadRepository{Repository: r.Repository, Ref: r.Ref})
 			}
@@ -212,7 +310,21 @@ func answer(ctx context.Context, publisher builder.Publisher, on, workspace stri
 		}
 	}
 
-	if err := work.Announce(ctx, result); err != nil {
+	// A killed build is announced on a context of its own: the build's was the one cancelled, and the
+	// outcome must go out and the ask be settled — acknowledged, never redelivered to another machine
+	// to be built again. A machine being stopped is the other case and keeps its meaning: the
+	// parent's context is gone, nothing is announced or settled, and the ask is redelivered.
+	announcing := ctx
+	if killed {
+		fresh, stop := context.WithTimeout(context.Background(), 30*time.Second)
+		defer stop()
+		announcing = fresh
+	}
+	announceErr := work.Announce(announcing, result)
+	if mine != nil {
+		h.said(mine, result.Failed, announceErr == nil)
+	}
+	if err := announceErr; err != nil {
 		// Said, not fatal: the build happened. A build reported as failed because announcing it
 		// failed is a lie about work that was done — and the request stays unsettled below only if
 		// nothing was said at all, so another machine can try.
@@ -227,6 +339,31 @@ func answer(ctx context.Context, publisher builder.Publisher, on, workspace stri
 	}
 }
 
+// checkSpecOf is a check request as the builder runs it.
+func checkSpecOf(request link.BuildRequest) builder.CheckSpec {
+	c := request.Check
+	spec := builder.CheckSpec{ID: request.ID, Repository: request.Repository, Ref: request.Ref,
+		Owner: c.Owner, Repo: c.Repo, Number: c.Number, Paths: c.Paths, Beside: map[string]builder.Beside{},
+		Modules: c.Modules, New: c.New, Manifests: c.Manifests, Judge: c.Judge, Base: c.Base,
+		Toolchain: builder.ToolchainOf(request.Held), Toolchains: builder.ToolchainsOf(request.Held)}
+	for dir, b := range c.Beside {
+		spec.Beside[dir] = builder.Beside{Repository: b.Repository, Ref: b.Ref}
+	}
+	for _, m := range c.Members {
+		spec.Group = append(spec.Group, builder.GroupHead{Owner: m.Owner, Repo: m.Repo, Repository: m.Repository,
+			Ref: m.Ref, Paths: m.Paths})
+	}
+	return spec
+}
+
+// layerOf is one layer of a check as the outcome carries it.
+func layerOf(l *builder.Layer) *link.CheckLayer {
+	if l == nil {
+		return nil
+	}
+	return &link.CheckLayer{Verdict: l.Verdict, Summary: l.Summary, Modules: l.Modules}
+}
+
 // packagesFrom is where a build resolves the mesh's own published packages — the SDK above all
 // (novox/hq ADR 0076, issue 053).
 //
@@ -453,6 +590,21 @@ type Credential struct {
 	// as two fields and this machine joins them once, here, to dial.
 	User     string `json:"user,omitempty"`
 	Password string `json:"password,omitempty"`
+	// Claims are the seats the module this credential was issued for claims, as the mesh writes
+	// them beside the credential (novox/hq ADR 0159). The first is the build role this machine
+	// serves; a credential naming none is from before claims travelled in it.
+	Claims []struct {
+		Seat string `json:"seat"`
+	} `json:"claims,omitempty"`
+}
+
+// seatsClaimed is the seats the credential names, in order.
+func (c Credential) seatsClaimed() []string {
+	out := make([]string, 0, len(c.Claims))
+	for _, claim := range c.Claims {
+		out = append(out, claim.Seat)
+	}
+	return out
 }
 
 // onTheNewBus is whether a credential is for the bus being built: its address says so, and the

cmd/mesh-builder/once.go

@@ -105,6 +105,7 @@ func buildOnce(ctx context.Context, args []string) error {
 		Ref:        *ref,
 		Manifest:   built.Manifest,
 		Against:    built.Against,
+		Source:     built.Source,
 	}
 	for _, r := range built.Read {
 		out.Read = append(out.Read, readRepository{Repository: r.Repository, Ref: r.Ref})
@@ -135,6 +136,7 @@ type onceResult struct {
 	Made       []madeArtifact   `json:"made"`
 	Against    []string         `json:"against,omitempty"`
 	Read       []readRepository `json:"read,omitempty"`
+	Source     string           `json:"source-fingerprint,omitempty"`
 }
 
 // readRepository is a repository this build read source from besides the module's own.

cmd/mesh-builder/seat_test.go

@@ -0,0 +1,27 @@
+package main
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// The seat a build machine serves comes from its credential (novox/hq ADR 0190 handover).
+func TestTheCredentialSaysWhichBuildRoleThisMachineServes(t *testing.T) {
+	var held Credential
+	if err := json.Unmarshal([]byte(`{"url":"nats://bus:4222","user":"anchor.builder","password":"x",
+		"claims":[{"seat":"mesh-build-machine","scope":"mesh","serves":[]}]}`), &held); err != nil {
+		t.Fatal(err)
+	}
+	if got := link.BuildSeatClaimed(held.seatsClaimed()); got != "mesh-build-machine" {
+		t.Errorf("the old builder's credential serves %q", got)
+	}
+	var bare Credential
+	if err := json.Unmarshal([]byte(`{"url":"nats://bus:4222","user":"anchor.build-agent","password":"x"}`), &bare); err != nil {
+		t.Fatal(err)
+	}
+	if got := link.BuildSeatClaimed(bare.seatsClaimed()); got != link.TheBuildMachine {
+		t.Errorf("a credential without claims serves %q, want %s", got, link.TheBuildMachine)
+	}
+}

cmd/mesh-controller/acting.go

@@ -0,0 +1,355 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"sync"
+	"time"
+
+	"github.com/nats-io/nats.go"
+	"github.com/nats-io/nats.go/jetstream"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/lease"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// Acting under the lease (novox/hq to-be 45 §6, ADR 0227 rule 1).
+//
+// **Only the instance holding the lease acts**: sends a declaration, writes a plan, a condition or a
+// call. Every one of those passes theLease.epoch, which answers the epoch the act carries or why it may
+// not happen. Three ways a process stands to the lease:
+//
+//   - **The serving controller** takes it before it does anything else — before it asserts the bus's
+//     objects, which are the controller's to write — waiting while another holds it, and renews it.
+//     A renewal refused or failed is the lease lost: the gate closes at once and the process exits, so
+//     its service manager restarts it as a candidate (serve, in push.go).
+//   - **A command run at a shell** — `push` in the installer, the lab, a person repairing a mesh whose
+//     controller is down (issue 201) — acts **under the holder's epoch** when a controller holds the
+//     lease: it is the same mesh's word, composed and sent under the store's hold of each machine like
+//     the serving controller's, and the epoch it carries is read at the moment it acts, so a handover
+//     between makes it stale and refused like any other. **When nobody holds the lease, the command
+//     takes it** for as long as it runs and gives it back; a controller starting meanwhile waits for
+//     it, as it would for another controller.
+//   - **A process with no bus** — a test, a command that only reads — acts with no epoch and is
+//     refused nothing: there is nothing to order against, and nothing it does reaches a machine.
+//
+// **Unleased, said and temporary.** A serving controller whose bus refuses it the lease's key — the bus's
+// user list is older than this build and does not grant the bucket yet — and that sees no other holder
+// serves without one, as every controller did before the lease: declarations carry no epoch, which no
+// node-engine refuses. Said once, kept as a condition (S12), and tried again every renewal interval; the
+// first push that sends the bus its new user list grants it, and the next try takes it. Refusing to act
+// instead would be a controller that can never send the user list that lets it act.
+
+// actor is this process's standing to the lease.
+type actor struct {
+	mu sync.Mutex
+	// held is the lease this process holds: the serving controller's, or a command's own.
+	held *lease.Lease
+	// unleased is why a serving controller acts without the lease; empty while it holds it or is not
+	// serving.
+	unleased string
+	// serving is a serving controller, which never borrows another's epoch.
+	serving bool
+	// kv is the lease bucket, for a command to read the holder's epoch from.
+	kv    jetstream.KeyValue
+	close func()
+	// noBus is a process with no bus configured.
+	noBus bool
+	// reset is when the lease bucket was found raised again from nothing and its revisions moved past
+	// the highest epoch issued, and what was said of it; zero when it was not (S12).
+	reset     time.Time
+	resetSaid string
+}
+
+// theLease is this process's standing to the lease.
+var theLease = &actor{}
+
+// instance names this process among controller instances: its machine, its process and when it
+// started. The lease's holder and every call this process keeps carry it.
+var instance = func() string {
+	host, _ := os.Hostname()
+	return fmt.Sprintf("controller@%s pid %d since %s", host, os.Getpid(), time.Now().UTC().Format(time.RFC3339))
+}()
+
+// epoch is the gate: the epoch an act carries — zero for none — or why it may not happen.
+func (a *actor) epoch(ctx context.Context) (uint64, error) {
+	a.mu.Lock()
+	held, serving, unleased, noBus := a.held, a.serving, a.unleased, a.noBus
+	a.mu.Unlock()
+	switch {
+	case held != nil:
+		return held.Epoch()
+	case serving && unleased != "":
+		return 0, nil
+	case serving:
+		return 0, lease.ErrNotHeld
+	case noBus:
+		return 0, nil
+	}
+	return a.forACommand(ctx)
+}
+
+// forACommand is a command's epoch: the holder's, or a lease of its own when nobody holds one.
+func (a *actor) forACommand(ctx context.Context) (uint64, error) {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	if a.held != nil {
+		return a.held.Epoch()
+	}
+	if a.kv == nil {
+		address, err := broker.BusAddress()
+		if err != nil {
+			// No bus: this process reaches no machine, and has nothing to order against.
+			a.noBus = true
+			return 0, nil
+		}
+		js, err := broker.Dial(address)
+		if err != nil {
+			return 0, fmt.Errorf("the bus cannot be reached, so whether a controller holds the lease cannot be "+
+				"read and nothing is done: %w", err)
+		}
+		api, err := jetstream.New(js.Conn())
+		if err != nil {
+			js.Close()
+			return 0, err
+		}
+		reading, cancel := context.WithTimeout(ctx, 10*time.Second)
+		defer cancel()
+		if err := broker.EnsureLeaseBucket(reading, api); err != nil {
+			js.Close()
+			return 0, err
+		}
+		kv, err := api.KeyValue(reading, broker.LeaseBucket)
+		if err != nil {
+			js.Close()
+			return 0, err
+		}
+		a.kv, a.close = kv, js.Close
+		if _, found, err := lease.Current(reading, kv); err == nil && !found {
+			// Nobody: this command takes it for as long as it runs.
+			l, err := lease.Open(reading, api, broker.LeaseBucket, lease.Options{Holder: holderOf(instance),
+				Say: func(format string, args ...any) { fmt.Printf(format+"\n", args...) }})
+			if err != nil {
+				return 0, err
+			}
+			epoch, err := l.TryTake(reading)
+			if err != nil {
+				return 0, fmt.Errorf("no controller holds the lease and this command could not take it: %w", err)
+			}
+			keeping, stop := context.WithCancel(context.Background())
+			go l.Keep(keeping)
+			a.held = l
+			closeBus := a.close
+			a.close = func() {
+				stop()
+				l.Release(context.Background())
+				closeBus()
+			}
+			return epoch, nil
+		}
+	}
+	reading, cancel := context.WithTimeout(ctx, 10*time.Second)
+	defer cancel()
+	holder, found, err := lease.Current(reading, a.kv)
+	if err != nil {
+		return 0, fmt.Errorf("who holds the controller lease cannot be read, so nothing is done: %w", err)
+	}
+	if !found {
+		return 0, errors.New("the controller that held the lease while this command ran let go of it; nothing " +
+			"more is done under an epoch nobody holds — run the command again")
+	}
+	return holder.Epoch, nil
+}
+
+// release gives back what this process holds, at its end.
+func (a *actor) release() {
+	a.mu.Lock()
+	closing := a.close
+	a.close = nil
+	a.mu.Unlock()
+	if closing != nil {
+		closing()
+	}
+}
+
+// holderOf is this process as the lease's holder.
+func holderOf(instance string) lease.Holder {
+	host, _ := os.Hostname()
+	return lease.Holder{Instance: instance, Host: host, Build: version}
+}
+
+// serveUnderTheLease takes the lease for the serving controller, waiting while another holds it, and
+// keeps it until ctx ends. Lost is closed when it is lost; the caller exits on it.
+func (a *actor) serveUnderTheLease(ctx context.Context, inv *inventory.Inventory, address string) (lost <-chan struct{}, err error) {
+	a.mu.Lock()
+	a.serving = true
+	a.mu.Unlock()
+	// Its own connection, held as long as the lease, and named so (novox/hq issue 327).
+	js, err := broker.Dial(address, nats.Name(broker.ConnectionName+" lease"))
+	if err != nil {
+		return nil, fmt.Errorf("the mesh is on the bus at %s and this control plane cannot reach it to take the "+
+			"lease: %w", broker.BareAddress(address), err)
+	}
+	api, err := jetstream.New(js.Conn())
+	if err != nil {
+		js.Close()
+		return nil, err
+	}
+	asserting, cancel := context.WithTimeout(ctx, 10*time.Second)
+	err = broker.EnsureLeaseBucket(asserting, api)
+	cancel()
+	if err != nil {
+		js.Close()
+		return nil, err
+	}
+	say := func(format string, args ...any) { fmt.Printf(format+"\n", args...) }
+	l, err := lease.Open(ctx, api, broker.LeaseBucket, lease.Options{Holder: holderOf(instance),
+		Floor: inv.HighestEpoch, Say: say, Health: controllerHealth, Moved: func(was, floor uint64) {
+			a.mu.Lock()
+			defer a.mu.Unlock()
+			a.reset = time.Now()
+			a.resetSaid = fmt.Sprintf("the lease bucket was at revision %d with epoch %d already issued: it was "+
+				"raised again from nothing (a bus whose data was replaced), and its revisions were moved past %d so "+
+				"no machine refuses the next epoch", was, floor, floor)
+		}})
+	if err != nil {
+		js.Close()
+		return nil, err
+	}
+	gone := make(chan struct{})
+	epoch, err := l.Take(ctx)
+	switch {
+	case ctx.Err() != nil:
+		js.Close()
+		return nil, ctx.Err()
+	case err != nil && !errors.Is(err, lease.ErrUnwritable):
+		// Whether another controller acts cannot be told: this one does not act, and exits to try again.
+		js.Close()
+		return nil, err
+	case err != nil:
+		// Nobody holds it and the bus will not let it be written: unleased, said, tried again (see above).
+		a.mu.Lock()
+		a.unleased = err.Error()
+		a.mu.Unlock()
+		say("this controller serves WITHOUT the lease: %v. Its declarations carry no epoch; it tries again "+
+			"every %s, and the first push that sends the bus its user list grants it", err, lease.RenewEvery)
+		go a.takeWhenGranted(ctx, l, inv, gone)
+	default:
+		a.took(ctx, l, inv, epoch, gone)
+	}
+	a.mu.Lock()
+	a.close = func() {
+		if held, err := l.Epoch(); err == nil {
+			ending, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+			if err := inv.EndEpoch(ending, held, inventory.EpochReleased); err != nil {
+				say("how epoch %d ended could not be recorded: %v", held, err)
+			}
+			cancel()
+		}
+		l.Release(context.Background())
+		js.Close()
+	}
+	a.mu.Unlock()
+	return gone, nil
+}
+
+// took is the lease taken: recorded, earlier epochs nobody gave back ended as expired, kept.
+func (a *actor) took(ctx context.Context, l *lease.Lease, inv *inventory.Inventory, epoch uint64, gone chan struct{}) {
+	a.mu.Lock()
+	a.held, a.unleased = l, ""
+	a.mu.Unlock()
+	h := holderOf(instance)
+	recording, cancel := context.WithTimeout(ctx, 10*time.Second)
+	expired, err := inv.TookEpoch(recording, inventory.Epoch{Epoch: epoch, Instance: h.Instance, Host: h.Host,
+		Build: h.Build, Taken: time.Now()})
+	cancel()
+	if err != nil {
+		fmt.Printf("epoch %d could not be recorded as taken, so a stale refusal from it will not name it: %v\n", epoch, err)
+	}
+	for _, e := range expired {
+		fmt.Printf("the controller of epoch %d (%s) stopped renewing the lease without giving it back: it is "+
+			"taken over at epoch %d\n", e.Epoch, e.Instance, epoch)
+	}
+	go l.Keep(ctx)
+	go func() {
+		<-l.Lost()
+		if ctx.Err() == nil {
+			why := l.LostWhy()
+			ending, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+			_ = inv.EndEpoch(ending, epoch, inventory.EpochLost)
+			cancel()
+			fmt.Printf("the controller lease was lost (epoch %d): %v — this controller stops and exits, to "+
+				"be started again as a candidate\n", epoch, why)
+		}
+		close(gone)
+	}()
+}
+
+// takeWhenGranted tries the lease again every renewal interval while serving unleased, and stops this
+// controller if another took it meanwhile: two serving at once is what the lease is for.
+func (a *actor) takeWhenGranted(ctx context.Context, l *lease.Lease, inv *inventory.Inventory, gone chan struct{}) {
+	tick := time.NewTicker(lease.RenewEvery)
+	defer tick.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-tick.C:
+		}
+		epoch, err := l.TryTake(ctx)
+		if errors.Is(err, lease.ErrTaken) {
+			fmt.Printf("another controller took the lease while this one served without it: %v — this one "+
+				"stops and exits\n", err)
+			close(gone)
+			return
+		}
+		if err != nil {
+			// Still not written, or not readable this time: unleased, said by S12, tried again.
+			a.mu.Lock()
+			a.unleased = err.Error()
+			a.mu.Unlock()
+			continue
+		}
+		a.took(ctx, l, inv, epoch, gone)
+		return
+	}
+}
+
+// standing is what `status` and the self-check say of this process and the lease.
+type standing struct {
+	Epoch    uint64
+	Held     bool
+	Renewed  time.Time
+	Unleased string
+	// Reset is when the lease bucket was found raised again from nothing, and ResetSaid what of it.
+	Reset     time.Time
+	ResetSaid string
+}
+
+func (a *actor) standing() standing {
+	a.mu.Lock()
+	held, unleased, reset, resetSaid := a.held, a.unleased, a.reset, a.resetSaid
+	a.mu.Unlock()
+	st := standing{Unleased: unleased, Reset: reset, ResetSaid: resetSaid}
+	if held == nil {
+		return st
+	}
+	epoch, err := held.Epoch()
+	st.Epoch, st.Held, st.Renewed = epoch, err == nil, held.Renewed()
+	return st
+}
+
+// The gates, given to what acts: a declaration's send (link) and a plan's write (the inventory).
+func init() {
+	link.ActingGate = func(ctx context.Context) error {
+		_, err := theLease.epoch(ctx)
+		if err != nil {
+			return fmt.Errorf("this controller may not send: %w", err)
+		}
+		return nil
+	}
+}

cmd/mesh-controller/acts.go

@@ -3,10 +3,14 @@ package main
 import (
 	"context"
 	"fmt"
+	"github.com/novox/mesh-controller/internal/broker"
+	"slices"
 	"sort"
 	"strings"
+	"time"
 
 	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
 )
 
 // The things the mesh can be asked to do, separated from how it was asked.
@@ -38,7 +42,18 @@ import (
 //
 // It costs a resolution per machine. Assignment is a person typing a command, and being told which
 // machines this just blocked is worth more than the milliseconds.
-func assign(ctx context.Context, open *stores, node, module string) (string, error) {
+func assign(ctx context.Context, open *stores, node string, modules ...string) (string, error) {
+	return assignWith(ctx, open, node, assignOptions{}, modules...)
+}
+
+// assignWith is assign asked with its options: build, for a module known and not built (novox/hq issue 325).
+func assignWith(ctx context.Context, open *stores, node string, opts assignOptions, modules ...string) (string, error) {
+	if len(modules) == 0 {
+		return "", fmt.Errorf("assign %s names no module", node)
+	}
+	if err := refusedMovingTheController(modules); err != nil {
+		return "", err
+	}
 	// Held while it is recorded, so it cannot land between a converge's preview and its flip and
 	// be taken without ever having been previewed (novox/hq ADR 0100).
 	ctx, release, err := holdNodes(ctx, open, []string{node})
@@ -46,6 +61,39 @@ func assign(ctx context.Context, open *stores, node, module string) (string, err
 		return "", err
 	}
 	defer release()
+	// **A module the catalogue does not hold is looked for further before it is refused** (novox/hq issue
+	// 325): a build in flight keeps the assignment pending, a module known and not built is said with how to
+	// build it, and only a name the mesh never heard of is refused as unknown. Several modules in one act
+	// are judged together (ADR 0207), so an act naming one not registered is not made in part.
+	if missing, err := notInCatalogue(ctx, open, modules); err != nil {
+		return "", err
+	} else if len(missing) > 0 {
+		if len(modules) == 1 {
+			return notRegistered(ctx, open, node, modules[0], opts)
+		}
+		var lines []string
+		for _, m := range missing {
+			where, err := whereIs(ctx, open.inventory, m, time.Now())
+			if err != nil {
+				return "", err
+			}
+			lines = append(lines, where.said)
+		}
+		return "", fmt.Errorf("%w: nothing was assigned, since modules assigned together are judged together "+
+			"(ADR 0207) and %s not registered:\n  %s\n  assign them together once each is registered, or each "+
+			"alone to keep it pending on its build", inventory.ErrNoSuchModule, strings.Join(missing, ", "),
+			strings.Join(lines, "\n  "))
+	}
+	// **The one assignment refused for what the node lacks** (novox/hq ADR 0207). Everything else
+	// an assignment leaves unresolved is kept, because assignment is not an ordering; a module whose
+	// resources are applied through a seat nothing on the node holds is refused, because that order
+	// — the service manager, the package manager and the runtime before anything that installs,
+	// runs or contains — is the mesh's to keep. Several modules in one act are judged together, so
+	// holders that depend on each other go on in one command.
+	shelf, before, err := seatDependenciesOnAssign(ctx, open, node, modules)
+	if err != nil {
+		return "", err
+	}
 	// **Before the new assignment can unsettle a seat somebody holds only by being alone**
 	// (novox/hq 04-ISSUES/170): what the mesh derived so far is written down, and then the
 	// assignment resolves against a record rather than against a coincidence.
@@ -53,58 +101,194 @@ func assign(ctx context.Context, open *stores, node, module string) (string, err
 	if err != nil {
 		return "", err
 	}
-	fresh, err := open.inventory.Assign(ctx, node, module)
-	if err != nil {
-		return "", err
+	var lines []string
+	var added []string
+	for _, module := range modules {
+		fresh, err := open.inventory.Assign(ctx, node, module)
+		if err != nil {
+			return strings.Join(lines, "\n"), err
+		}
+		if !fresh {
+			// Nothing changed, and saying "is assigned" would read as an action. One node runs one
+			// of each — the module's name is the assignment's identity (novox/hq ADR 0115).
+			lines = append(lines, fmt.Sprintf(
+				"%s already runs %s — one node runs one of each (ADR 0115); nothing changed", node, module))
+			continue
+		}
+		added = append(added, module)
+		lines = append(lines, fmt.Sprintf("%s is assigned %s", node, module))
 	}
-	if !fresh {
-		// Nothing changed, and saying "is assigned" would read as an action. One node runs one
-		// of each — the module's name is the assignment's identity (novox/hq ADR 0115).
-		return fmt.Sprintf("%s already runs %s — one node runs one of each (ADR 0115); nothing changed",
-			node, module), nil
+	if len(added) == 0 {
+		return strings.Join(lines, "\n"), nil
 	}
-	said := fmt.Sprintf("%s is assigned %s", node, module)
+	answer := strings.Join(lines, "\n")
 	for _, line := range settled {
-		said += "\n  " + line
+		answer += "\n  " + line
+	}
+	// What this act changed about this node's unmet seat dependencies, and nothing else (novox/hq
+	// ADR 0207): a dependency of a module just assigned, or one this assignment met. The rest of the
+	// node's list, and every other node's, is `status`'s.
+	for _, line := range unheldChange(shelf, node, before, append(append([]string(nil), before...), added...)) {
+		answer += "\n  " + line
+	}
+	// Its bus credential, in the same act (novox/hq issue 203): an assignment pushed before its
+	// credential exists delivers a process that cannot authenticate and crash-loops until somebody
+	// runs a second verb and a second push. Issued here when the module speaks on the bus and has
+	// no credential yet; kept when it has one, so re-assigning rotates nothing.
+	for _, module := range added {
+		if line := issueOnAssign(ctx, open, node, module); line != "" {
+			answer += "\n  " + line
+		}
 	}
 	plan, _, err := planFor(ctx, open, node)
 	if err != nil {
 		// Kept, and still refused. Both halves are the answer, and the rest of the mesh is still
 		// worth reporting: this machine's refusal is rarely the only consequence.
-		return said + blockedElsewhere(ctx, open, node), err
+		return answer + blockedElsewhere(ctx, open, node), err
 	}
 	// Kept, and cannot be hosted here. Said at once rather than discovered at push: a module whose
 	// capability the machine lacks is on the wrong machine, and the assignment records what a person
 	// meant while this line says it will not run until it moves. The rest of the node still pushes.
+	isAdded := map[string]bool{}
+	for _, m := range added {
+		isAdded[m] = true
+	}
 	for _, u := range plan.Unhostable {
-		if u.Module != module {
+		if !isAdded[u.Module] {
 			continue
 		}
 		for _, c := range u.Missing {
-			said += "\n  but " + catalogue.WrongMachine(u.Module, c, node)
+			answer += "\n  but " + catalogue.WrongMachine(u.Module, c, node)
 		}
 	}
-	return said + fmt.Sprintf("\n  run `push %s` to send it", node) +
+	return answer + fmt.Sprintf("\n  run `push %s` to send it", node) +
 		blockedElsewhere(ctx, open, node), nil
 }
 
-// unassign takes a module off a node. What it leaves behind is the host's business: a directory
+// seatDependenciesOnAssign is the refusal ADR 0207 makes at assignment, or nothing, with the
+// catalogue and the node's assignments it was judged against. Modules already assigned are not new
+// and are not judged again.
+func seatDependenciesOnAssign(ctx context.Context, open *stores, node string, modules []string) (
+	map[string]catalogue.Manifest, []string, error) {
+	shelf, err := open.inventory.Catalogue(ctx)
+	if err != nil {
+		return nil, nil, err
+	}
+	assigned, err := open.inventory.Assigned(ctx, node)
+	if err != nil {
+		return nil, nil, err
+	}
+	already := map[string]bool{}
+	for _, a := range assigned {
+		already[a] = true
+	}
+	var adding []string
+	for _, m := range modules {
+		if !already[m] {
+			adding = append(adding, m)
+		}
+	}
+	// The lines AssignRefusal says beside an assignment it lets through are said by unheldChange
+	// with everything else this act changed, so they are not said twice.
+	if _, err := catalogue.AssignRefusal(shelf, node, assigned, adding); err != nil {
+		return nil, nil, err
+	}
+	// Two modules declaring one package, path or unit is refused before anything is recorded
+	// (novox/hq ADR 0210, 04-ISSUES/235): kept, the node would not resolve until one came off again.
+	if err := catalogue.CollisionRefusal(shelf, node, assigned, adding); err != nil {
+		return nil, nil, err
+	}
+	return shelf, assigned, nil
+}
+
+// unassign takes modules off a node. What they leave behind is the host's business: a directory
 // holding anything the mesh did not put there is kept (novox/hq ADR 0030).
 //
 // It reports the rest of the mesh for the same reason assign does, and more sharply: taking a
 // module off one machine is the ordinary way to stop providing something to another, and nothing
 // about the command's own output would ever have said so.
-func unassign(ctx context.Context, open *stores, node, module string) (string, error) {
+//
+// **Refused when it takes away the last holder of a seat a module left on the node depends on**
+// (novox/hq ADR 0207) — the other side of refusing that module's assignment without one. Several
+// modules in one act are judged together, so a holder and its dependents come off in one command.
+func unassign(ctx context.Context, open *stores, node string, modules ...string) (string, error) {
+	if err := refusedMovingTheController(modules); err != nil {
+		return "", err
+	}
+	if len(modules) == 0 {
+		return "", fmt.Errorf("unassign %s names no module", node)
+	}
 	ctx, release, err := holdNodes(ctx, open, []string{node})
 	if err != nil {
 		return "", err
 	}
 	defer release()
-	if err := open.inventory.Unassign(ctx, node, module); err != nil {
+	shelf, err := open.inventory.Catalogue(ctx)
+	if err != nil {
 		return "", err
 	}
-	return fmt.Sprintf("%s no longer runs %s — run `push %s` to make it so",
-		node, module, node) + blockedElsewhere(ctx, open, node), nil
+	assigned, err := open.inventory.Assigned(ctx, node)
+	if err != nil {
+		return "", err
+	}
+	// Every one checked before any is taken off, so a refusal leaves the node as it was.
+	runs := map[string]bool{}
+	for _, a := range assigned {
+		runs[a] = true
+	}
+	// A module only pending on the node (novox/hq issue 325) is withdrawn, when it is the act's one module:
+	// that is the undo of an assignment kept while its build runs.
+	if len(modules) == 1 && !runs[modules[0]] {
+		said, withdrawn, err := withdrawPending(ctx, open.inventory, node, modules[0])
+		if err != nil {
+			return "", err
+		}
+		if withdrawn {
+			return said, nil
+		}
+	}
+	for _, module := range modules {
+		if !runs[module] {
+			return "", fmt.Errorf("%s is not assigned to %s", module, node)
+		}
+	}
+	if err := catalogue.UnassignRefusal(shelf, node, assigned, modules); err != nil {
+		return "", err
+	}
+	for _, module := range modules {
+		if err := open.inventory.Unassign(ctx, node, module); err != nil {
+			return "", err
+		}
+	}
+	answer := fmt.Sprintf("%s no longer runs %s — run `push %s` to make it so",
+		node, strings.Join(modules, ", "), node)
+	var left []string
+	for _, a := range assigned {
+		if !slices.Contains(modules, a) {
+			left = append(left, a)
+		}
+	}
+	for _, line := range unheldChange(shelf, node, assigned, left) {
+		answer += "\n  " + line
+	}
+	// What it leaves behind that is irreplaceable is kept and retired, never removed (novox/hq ADR 0233).
+	for _, line := range keptOnUnassign(ctx, open.inventory, node, modules) {
+		answer += "\n  " + line
+	}
+	return answer + blockedElsewhere(ctx, open, node), nil
+}
+
+// splitModules is a surface's one `module` field as the modules it names: several, comma-separated,
+// are one act (novox/hq ADR 0207), so the holders that depend on each other go on together from the
+// command API and the controller seat's verbs as they do from the command line.
+func splitModules(field string) []string {
+	var out []string
+	for _, m := range strings.Split(field, ",") {
+		if m = strings.TrimSpace(m); m != "" {
+			out = append(out, m)
+		}
+	}
+	return out
 }
 
 // blockedElsewhere is every OTHER machine that cannot be worked out as things now stand.
@@ -152,3 +336,47 @@ func blockedElsewhere(ctx context.Context, open *stores, except string) string {
 	out.WriteString("\nThis may or may not be what just changed — it is what is true now.")
 	return out.String()
 }
+
+// issueOnAssign gives a newly assigned module its bus credential, the way `module issue` does, and
+// says what it did in one line. Nothing for a module that declares no broker secret; nothing for one
+// whose user is already minted (a credential is rotated on purpose, never by re-assigning); and when
+// the bus cannot be reached from here, the line names the verb and the push that would refuse the
+// module until it is run — never a silent placeholder (novox/hq issue 203).
+func issueOnAssign(ctx context.Context, open *stores, node, module string) string {
+	inv := open.inventory
+	shelf, err := inv.Catalogue(ctx)
+	if err != nil {
+		return ""
+	}
+	m, known := shelf[module]
+	if !known || mayIssue(m) != nil {
+		return ""
+	}
+	user := broker.Principal{Kind: broker.KindModule, Node: node, Module: module}.Username()
+	if _, minted, err := inv.BusUserHash(ctx, user); err != nil || minted {
+		return ""
+	}
+	busAddress, err := broker.BusAddress()
+	if err == nil {
+		err = issueOnTheNewBus(ctx, inv, m, node, busAddress)
+	}
+	if err != nil {
+		return fmt.Sprintf("its bus credential is not issued (%v): `module issue %s --node %s` first — "+
+			"`push %s` refuses to send %s until it is", err, module, node, node, module)
+	}
+	return fmt.Sprintf("its bus credential is issued and sealed to %s, and arrives with the push", node)
+}
+
+// refusedMovingTheController refuses assigning or unassigning the controller's module through a verb (review of
+// novox/hq ADR 0272): the node it is assigned to is the control-node, and the control-node's operator account is
+// the controller's terminal, so whoever moves the module chooses the terminal. At the terminal alone, as every
+// change that says who may change what.
+func refusedMovingTheController(modules []string) error {
+	verb, through := throughAVerb()
+	if !through || !slices.Contains(modules, controllerModule) {
+		return nil
+	}
+	return fmt.Errorf("%s is assigned and unassigned at the controller's terminal only (mesh-cli on the control-node), "+
+		"never through a verb (this came through %q): the node it runs on is the control-node, whose operator is the "+
+		"terminal (novox/hq ADR 0272). Nothing was assigned", controllerModule, verb)
+}

cmd/mesh-controller/addresses_test.go

@@ -111,6 +111,14 @@ func TestTheRegistryTrustAndEveryImageFollowThePortTheNodeGaveTheStore(t *testin
 	if _, err := assign(ctx, open, "laptop", "app"); err != nil {
 		t.Fatal(err)
 	}
+	// The runtime's trust is the runtime's module's to write (novox/hq ADR 0222): a stand-in for it
+	// asks where this machine reaches the store, as the docker module does.
+	register(t, open, catalogue.Manifest{Module: "runtime", Version: "1",
+		Resources: []map[string]any{{"id": "daemon", "type": "file", "path": "/etc/docker/daemon.json",
+			"into": "json", "content": `{"insecure-registries": ["${seat:mesh-artifact-store:reach}"]}` + "\n"}}})
+	if _, err := assign(ctx, open, "laptop", "runtime"); err != nil {
+		t.Fatal(err)
+	}
 
 	on := map[string]bool{"anchor": true, "laptop": true}
 	node, port, found, err := artifactStoreOnNetwork(ctx, open.inventory, on)
@@ -145,7 +153,7 @@ func TestTheRegistryTrustAndEveryImageFollowThePortTheNodeGaveTheStore(t *testin
 //
 // Composed from the control plane's own manifest against a real inventory: the store's module is
 // given 6852 on this node the way genesis or an operator gives it, and the control plane's
-// container is told so beside the sealed connection genesis wrote.
+// process is told so beside the sealed connection genesis wrote.
 func TestTheControlPlaneIsToldWhereTheNodePutTheStoreAndTheBroker(t *testing.T) {
 	open := aMesh(t)
 	ctx := t.Context()
@@ -157,8 +165,8 @@ func TestTheControlPlaneIsToldWhereTheNodePutTheStoreAndTheBroker(t *testing.T)
 	if err != nil {
 		t.Fatal(err)
 	}
-	control, err := withSeatPorts(m).Resolve([]catalogue.Built{{Name: "server", Kind: catalogue.ArtifactImage,
-		Reference: "registry.example/control@" + aDigest}})
+	control, err := withSeatPorts(m).Resolve([]catalogue.Built{{Name: "controller", Kind: catalogue.ArtifactBundle,
+		Reference: "https://registry.example/mesh-controller/controller.tar.gz", Digest: aDigest}})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -175,6 +183,12 @@ func TestTheControlPlaneIsToldWhereTheNodePutTheStoreAndTheBroker(t *testing.T)
 		Guards: []int{15672},
 		Resources: []map[string]any{{"id": "server", "type": "container", "name": "mesh-broker",
 			"ports": []any{"5671:5671", "5672:5672", "127.0.0.1:15672:15672"}, "image": "mq@" + aDigest}}})
+	// The control plane's own bus user is the installer's, seeded at genesis before the controller
+	// runs (SeedBusUser); without it a push now refuses the credential nobody issued (issue 203).
+	if err := open.inventory.SeedBusUser(ctx, inventory.BusUser{Username: "anchor.mesh-controller",
+		Kind: inventory.BusController, Node: "anchor", Module: "mesh-controller"}, "bootstrap"); err != nil {
+		t.Fatal(err)
+	}
 	if _, err := assign(ctx, open, "anchor", "mesh-controller"); err != nil {
 		t.Fatal(err)
 	}
@@ -194,12 +208,12 @@ func TestTheControlPlaneIsToldWhereTheNodePutTheStoreAndTheBroker(t *testing.T)
 
 	var env map[string]any
 	for _, r := range composed(t, open, "anchor").Resources {
-		if r["id"] == "mesh-controller.server" {
+		if r["id"] == "mesh-controller.controller" {
 			env, _ = r["env"].(map[string]any)
 		}
 	}
 	if env == nil {
-		t.Fatal("the control plane's container is not in its own node's declaration")
+		t.Fatal("the control plane's process is not in its own node's declaration")
 	}
 	for key, want := range map[string]string{
 		"MESH_STORE_INVENTORY_PORT": "6852",
@@ -232,7 +246,7 @@ func withSeatPorts(m catalogue.Manifest) catalogue.Manifest {
 	out := m
 	out.Resources = nil
 	for _, r := range m.Resources {
-		if r["type"] != "container" {
+		if r["type"] != "container" && r["type"] != "process" {
 			out.Resources = append(out.Resources, r)
 			continue
 		}

cmd/mesh-controller/adopting_test.go

@@ -85,7 +85,7 @@ func reportsReaching(t *testing.T, open *stores, reachable []link.Reach, held ..
 	if err != nil {
 		t.Fatal(err)
 	}
-	if err := open.inventory.RecordSent(ctx, record.ID, digestOf(body)); err != nil {
+	if err := open.inventory.RecordSent(ctx, record.ID, digestOf(body), nil); err != nil {
 		t.Fatal(err)
 	}
 	if _, err := (link.Enrolment{Inventory: open.inventory}).Heard(ctx, link.Report{

cmd/mesh-controller/adoption.go

@@ -95,7 +95,7 @@ func showFiltering(f inventory.Filtering, adopted bool) {
 		case fw.Active:
 			fmt.Printf("  found firewall    %s is ACTIVE on this converged machine; the next apply retires it again\n", fw.Kind)
 		case fw.RetiredBy == "removed":
-			fmt.Printf("  found firewall    %s, removed: the mesh's filter is what filters this machine (novox/hq ADR 0175)\n", fw.Kind)
+			fmt.Printf("  found firewall    %s, removed: the mesh's filter is what filters this machine (novox/hq ADR 0180)\n", fw.Kind)
 		case fw.RetiredBy == inventory.FilterMesh || fw.RetiredBy == "mesh":
 			fmt.Printf("  found firewall    %s, retired by the mesh; its configuration stays on disk\n", fw.Kind)
 		case fw.RetiredBy != "":

cmd/mesh-controller/agent_account.go

@@ -0,0 +1,251 @@
+package main
+
+// The account agents run as (novox/hq ADR 0266).
+//
+// On the control node every agent session ran as the operator's account, which may become root without a
+// password — so any agent there could become root without a person, and ADR 0259 §8 (an answer from the
+// operator's phone authorises an act) rests on that being false where the router and its channels run. The
+// decision: a node may name an account its agents run as, of their own and without sudo; the operator's
+// account keeps its sudo.
+//
+//   - **Named at the controller's terminal only** (`node agent-account`): not a verb, not a setting, so no
+//     agent can name itself another account. Empty is a real state: agents run as the operator there.
+//   - **Composed** as `${machine:agent-account}`, `${machine:agent-home}` and `${machine:agent-root}` for the
+//     agent's module, which declares the account with `root: never`, and as MESH_AGENT_ACCOUNT and
+//     MESH_AGENT_HOME for its tools (catalogue/machine_into_files.go, runtime.go).
+//   - **Judged by the machine itself.** The node-engine reads, on every look, whether an account declared
+//     `root: never` can become root without a person — uid 0, a group that grants root, a sudo rule, a
+//     secret of the mesh it may read — and says it as the declaring module's account verdict, marked
+//     Root "never". agentConfined reads that verdict; the self-check (probe DA) raises
+//     `agent-can-become-root` while it does not hold, and `node show` says it.
+//
+// A verdict not given is never a pass: an engine older than the judging, an account not yet declared, a
+// statement that says nothing of it — each is "not judged", and fails.
+
+import (
+	"context"
+	"fmt"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// kindAgentCanBecomeRoot is the condition raised while a machine's agent account can become root without
+// a person, or is not judged (ADR 0266).
+const kindAgentCanBecomeRoot = "agent-can-become-root"
+
+// agentAccountProbe is the self-check's probe of it.
+const agentAccountProbe = "DA"
+
+// agentConfined says whether the agents of a machine that names an agent account are confined: the
+// machine's newest statement holds a healthy account verdict, judged for root, on that account. named is
+// false for a machine that names none — agents run as the operator account there, which this does not
+// judge. why is said either way, in the mesh's words; err is a store that could not be read.
+//
+// The one judgement: `node show`, the self-check, and ADR 0259's router honouring a verified sender read
+// it here.
+// now is the judging clock, threaded so a caller judging several things at one instant judges them all at it.
+func agentConfined(ctx context.Context, inv *inventory.Inventory, node string, now time.Time) (named, confined bool, why string, err error) {
+	n, err := inv.NodeByName(ctx, node)
+	if err != nil {
+		return false, false, "", err
+	}
+	if n.AgentAccount == "" {
+		return false, false, fmt.Sprintf("%s names no agent account: agents run as the operator account (%s)",
+			node, orNoneKnown(n.Account)), nil
+	}
+	h, had, err := inv.HealthOf(ctx, node)
+	if err != nil {
+		return true, false, "", err
+	}
+	confined, why = judgedConfined(n.AgentAccount, h, had, now)
+	return true, confined, why, nil
+}
+
+// verdictFreshFor is how old the statement holding the verdict may be, by this controller's clock. A
+// node-engine states its health on every change and at least every five minutes (mesh-host's sayAnyway), so
+// three statements missed is a node-engine stopped, or a machine away. **A stale verdict is not a pass**: an
+// agent that stopped the node-engine must not leave "cannot become root" standing from before.
+const verdictFreshFor = 15 * time.Minute
+
+// judgedConfined is the judgement over one statement, without the store, at now.
+func judgedConfined(agent string, h inventory.NodeHealth, had bool, now time.Time) (bool, string) {
+	if !had {
+		return false, fmt.Sprintf("the agent account %s is not judged: the machine's node-engine has stated "+
+			"nothing of what it runs", agent)
+	}
+	if age := now.Sub(h.HeardAt); age > verdictFreshFor {
+		return false, fmt.Sprintf("the agent account %s is not judged: the machine's newest statement was heard at "+
+			"%s, more than %d minutes ago, and a verdict that old is not a verdict on now", agent,
+			h.HeardAt.Local().Format("2006-01-02 15:04"), int(verdictFreshFor.Minutes()))
+	}
+	if h.Contract < link.RootContract {
+		return false, fmt.Sprintf("the agent account %s is not judged: the machine's node-engine is older than "+
+			"the judging of an account's root (its statement's contract is %d, the judging is %d)",
+			agent, h.Contract, link.RootContract)
+	}
+	var verdicts []inventory.ResourceHealth
+	for _, r := range h.Resources {
+		if r.Kind == link.KindAccount && r.Target == agent && r.Root == link.RootNever {
+			verdicts = append(verdicts, r)
+		}
+	}
+	if len(verdicts) == 0 {
+		return false, fmt.Sprintf("the agent account %s is not judged: the machine's newest statement holds no "+
+			"verdict on it — no module there declares it never to become root, or the declaration naming it "+
+			"has not been applied", agent)
+	}
+	sort.Slice(verdicts, func(i, j int) bool {
+		return verdicts[i].Module+verdicts[i].Resource < verdicts[j].Module+verdicts[j].Resource
+	})
+	for _, v := range verdicts {
+		switch v.State {
+		case link.StateHealthy:
+		case link.StateUnhealthy:
+			// The engine's own words, which start with link.ReasonRoot when it found a way to root.
+			return false, fmt.Sprintf("the agent account %s %s (said by %s's %s)", agent,
+				orNoneKnown(v.Reason), v.Module, v.Resource)
+		default:
+			return false, fmt.Sprintf("the agent account %s is not judged: %s (%s's %s, %s)", agent,
+				orNoneKnown(v.Reason), v.Module, v.Resource, v.State)
+		}
+	}
+	return true, fmt.Sprintf("the agent account %s cannot become root without a person (judged %s)", agent,
+		h.SaidAt.Local().Format("2006-01-02 15:04"))
+}
+
+// searchQuietFor is how long the controller lets an agent account's verdict wait for the node-engine's setuid
+// search before that is itself the urgent condition: the engine's bound on one search (link.RootSearchBound, the
+// engine's own value), counted from when this controller first saw it waiting, never from the engine's start.
+const searchQuietFor = link.RootSearchBound
+
+// The kinds of an agent account's verdict, for the quiet a search earns.
+const (
+	verdictOther    = iota // anything else: a stale statement, an older engine, no verdict, another unknown
+	verdictPending         // waiting for the search, and otherwise healthy
+	verdictComplete        // judged: healthy, or a way to root found
+)
+
+// rootVerdictKind reads a statement for the agent account (novox/hq ADR 0266): pending when every verdict on it
+// is healthy or not judged yet because the engine's setuid search runs, at least one of them that; complete when
+// every verdict is healthy or one found a way to root. The engine's own "since" is not read: it starts again at
+// every restart of the engine.
+func rootVerdictKind(agent string, h inventory.NodeHealth, had bool, now time.Time) int {
+	if !had || now.Sub(h.HeardAt) > verdictFreshFor || h.Contract < link.RootContract {
+		return verdictOther
+	}
+	pending, any := false, false
+	for _, r := range h.Resources {
+		if r.Kind != link.KindAccount || r.Target != agent || r.Root != link.RootNever {
+			continue
+		}
+		any = true
+		switch {
+		case r.State == link.StateHealthy:
+		case r.State == link.StateUnhealthy:
+			return verdictComplete
+		case r.State == link.StateUnknown && strings.HasPrefix(r.Reason, link.ReasonRootPending):
+			pending = true
+		default:
+			return verdictOther
+		}
+	}
+	switch {
+	case !any:
+		return verdictOther
+	case pending:
+		return verdictPending
+	}
+	return verdictComplete
+}
+
+// searchStillRunning says the one thing keeping an agent account from being judged is the node-engine's setuid
+// search, and that this controller first saw it waiting less than searchQuietFor ago — kept in the store, so a
+// node-engine restarted in a loop does not keep it quiet. A complete verdict forgets when it began.
+func searchStillRunning(ctx context.Context, inv *inventory.Inventory, node, agent string, h inventory.NodeHealth,
+	had bool, now time.Time) (bool, error) {
+	switch rootVerdictKind(agent, h, had, now) {
+	case verdictComplete:
+		return false, inv.RootSearchJudged(ctx, node)
+	case verdictPending:
+		since, err := inv.RootSearchPending(ctx, node, now)
+		if err != nil {
+			return false, err
+		}
+		return now.Sub(since) <= searchQuietFor, nil
+	}
+	return false, nil
+}
+
+// probeAgentAccounts is DA: every machine that names an agent account has it judged, on its node-engine's
+// newest statement, unable to become root without a person (ADR 0266).
+func probeAgentAccounts(ctx context.Context, d *doctor) ([]conditions.Observation, error) {
+	inv := d.open.inventory
+	nodes, err := inv.Nodes(ctx)
+	if err != nil {
+		return nil, err
+	}
+	var out []conditions.Observation
+	for _, n := range nodes {
+		if n.AgentAccount == "" {
+			continue
+		}
+		h, had, err := inv.HealthOf(ctx, n.Name)
+		if err != nil {
+			return nil, err
+		}
+		now := time.Now()
+		quiet, err := searchStillRunning(ctx, inv, n.Name, n.AgentAccount, h, had, now)
+		if err != nil {
+			return nil, err
+		}
+		confined, why := judgedConfined(n.AgentAccount, h, had, now)
+		if confined {
+			continue
+		}
+		// Not judged yet only because the first search since the node-engine started is still running: not the
+		// urgent condition after every restart. The agent is still not confined — ADR 0259's router reads
+		// agentConfined, not this — and `node show` still says not judged. Loud again once the search fails,
+		// runs out its bound, or the statement goes stale.
+		if quiet {
+			continue
+		}
+		out = append(out, conditions.Observation{Scope: conditions.ScopeMachine, ID: n.Name, Token: "agent-root",
+			Machine: n.Name, Severity: conditions.Urgent,
+			Summary: fmt.Sprintf("on %s, %s (ADR 0266): an agent there may become root without a person, and "+
+				"no answer from a channel authorises an act there (ADR 0259 §8)", n.Name, why),
+			Said: why})
+	}
+	return sortedFound(out), nil
+}
+
+// agentAccountLines is what `node show` says of the account agents run as.
+func agentAccountLines(ctx context.Context, inv *inventory.Inventory, n inventory.Node) []string {
+	if n.AgentAccount == "" {
+		return []string{fmt.Sprintf("  agents run as      the operator account (%s); no agent account is named",
+			orNoneKnown(n.Account))}
+	}
+	_, confined, why, err := agentConfined(ctx, inv, n.Name, time.Now())
+	if err != nil {
+		return []string{fmt.Sprintf("  agents run as      %s (home %s); whether it can become root could NOT be read: %v",
+			n.AgentAccount, n.AgentHome(), err)}
+	}
+	verdict := "CAN become root, or is not judged: " + why
+	if confined {
+		verdict = why
+	}
+	return []string{fmt.Sprintf("  agents run as      %s (home %s)", n.AgentAccount, n.AgentHome()),
+		"                     " + verdict}
+}
+
+// orNoneKnown is a value, or that none is known.
+func orNoneKnown(s string) string {
+	if strings.TrimSpace(s) == "" {
+		return "none known"
+	}
+	return s
+}

cmd/mesh-controller/agent_account_test.go

@@ -0,0 +1,273 @@
+package main
+
+import (
+	"github.com/novox/mesh-host/rootsearch"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/conditions"
+	snapshot "github.com/novox/mesh-controller/internal/facts"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// The agent account's judgement (novox/hq ADR 0266): confined only on a healthy account verdict judged for
+// root, on the very account; every verdict not given — no statement, an older engine, no verdict on it, a
+// verdict of unknown — is "not judged" and fails, never a pass.
+func TestAnAgentAccountIsConfinedOnlyOnAHealthyVerdictJudgedForRoot(t *testing.T) {
+	at := time.Date(2026, 10, 8, 19, 21, 0, 0, time.UTC)
+	verdict := func(target, root, state, reason string) inventory.ResourceHealth {
+		return inventory.ResourceHealth{Module: "claude-code", Resource: "claude-code.agent-account",
+			Kind: link.KindAccount, Target: target, State: state, Reason: reason, Root: root, Account: target}
+	}
+	statement := func(contract int, rs ...inventory.ResourceHealth) inventory.NodeHealth {
+		return inventory.NodeHealth{Node: "anchor", Contract: contract, SaidAt: at, HeardAt: at, Resources: rs}
+	}
+	for _, c := range []struct {
+		name     string
+		h        inventory.NodeHealth
+		had      bool
+		confined bool
+		says     string
+	}{
+		{"judged and unable", statement(link.RootContract, verdict("agent", link.RootNever, link.StateHealthy, "")),
+			true, true, "cannot become root without a person"},
+		{"judged and able", statement(link.RootContract, verdict("agent", link.RootNever, link.StateUnhealthy,
+			link.ReasonRoot+": in the group docker, which grants root")), true, false, "in the group docker"},
+		{"a verdict of unknown", statement(link.RootContract, verdict("agent", link.RootNever, link.StateUnknown,
+			"sudo could not be read")), true, false, "not judged"},
+		{"no statement", inventory.NodeHealth{}, false, false, "not judged"},
+		{"an older engine", statement(link.ReadinessContract, verdict("agent", "", link.StateHealthy, "")),
+			true, false, "older than the judging"},
+		{"a verdict on groups only", statement(link.RootContract, verdict("agent", "", link.StateHealthy, "")),
+			true, false, "no verdict on it"},
+		{"a verdict on another account", statement(link.RootContract, verdict("ops", link.RootNever, link.StateHealthy, "")),
+			true, false, "no verdict on it"},
+	} {
+		confined, why := judgedConfined("agent", c.h, c.had, at.Add(time.Minute))
+		if confined != c.confined || !strings.Contains(why, c.says) {
+			t.Errorf("%s: confined %v, %q; want %v saying %q", c.name, confined, why, c.confined, c.says)
+		}
+	}
+	// A verdict heard longer ago than the bound is no verdict: an agent that stopped the node-engine must not
+	// leave "healthy" standing.
+	fresh := statement(link.RootContract, verdict("agent", link.RootNever, link.StateHealthy, ""))
+	if ok, _ := judgedConfined("agent", fresh, true, at.Add(verdictFreshFor)); !ok {
+		t.Error("a verdict exactly at the bound is still one")
+	}
+	if ok, why := judgedConfined("agent", fresh, true, at.Add(verdictFreshFor+time.Second)); ok ||
+		!strings.Contains(why, "not judged") {
+		t.Errorf("a stale healthy verdict passed: %q", why)
+	}
+}
+
+// DA raises an urgent condition, with plain words, on a machine whose agent account is not judged unable to
+// become root; a machine that names none is not its to judge.
+func TestTheSelfCheckSaysAnAgentAccountThatCanBecomeRoot(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	for _, n := range []string{"anchor", "laptop"} {
+		if _, err := inv.NodeByName(ctx, n); err != nil {
+			if _, err := inv.AddNode(ctx, n); err != nil {
+				t.Fatal(err)
+			}
+		}
+		if err := inv.SetAccount(ctx, n, "ops", ""); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := inv.SetAgentAccount(ctx, "anchor", "agent", ""); err != nil {
+		t.Fatal(err)
+	}
+	d := &doctor{open: open}
+	found, err := probeAgentAccounts(ctx, d)
+	if err != nil {
+		t.Fatal(err)
+	}
+	found = onlyMachine(found, "anchor")
+	if len(found) != 1 || found[0].Machine != "anchor" || found[0].Severity != conditions.Urgent ||
+		!strings.Contains(found[0].Said, "not judged") {
+		t.Fatalf("a named agent account with no verdict: %+v", found)
+	}
+	w := plainWordings[kindAgentCanBecomeRoot](conditions.Observation{Kind: kindAgentCanBecomeRoot, Machine: "anchor"})
+	if w.Headline == "" || w.Needs == "" || w.Resolved == "" {
+		t.Errorf("the condition has no plain words: %+v", w)
+	}
+
+	healthy := inventory.ResourceHealth{Module: "claude-code", Resource: "claude-code.agent-account",
+		Kind: link.KindAccount, Target: "agent", State: link.StateHealthy, Root: link.RootNever, Account: "agent"}
+	if _, err := inv.RecordHealth(ctx, inventory.NodeHealth{Node: "anchor", Contract: link.RootContract,
+		SaidAt: time.Now(), HeardAt: time.Now(), Resources: []inventory.ResourceHealth{healthy}}); err != nil {
+		t.Fatal(err)
+	}
+	if found, err = probeAgentAccounts(ctx, d); err != nil || len(onlyMachine(found, "anchor")) != 0 {
+		t.Fatalf("a judged agent account still fails: %+v %v", found, err)
+	}
+	if named, confined, why, err := agentConfined(ctx, inv, "anchor", time.Now()); err != nil || !named || !confined {
+		t.Fatalf("agentConfined on anchor: %v %v %q %v", named, confined, why, err)
+	}
+	if named, _, why, err := agentConfined(ctx, inv, "laptop", time.Now()); err != nil || named ||
+		!strings.Contains(why, "operator account") {
+		t.Fatalf("agentConfined on a machine naming none: %v %q %v", named, why, err)
+	}
+}
+
+func TestTheAgentRootWordsArePlain(t *testing.T) {
+	w := plainWordings[kindAgentCanBecomeRoot](conditions.Observation{Kind: kindAgentCanBecomeRoot, Machine: "anchor"})
+	if why, ok := conditions.PlainWords(w, "anchor"); !ok {
+		t.Fatalf("not plain: %s: %+v", why, w)
+	}
+}
+
+func onlyMachine(obs []conditions.Observation, machine string) []conditions.Observation {
+	var out []conditions.Observation
+	for _, o := range obs {
+		if o.Machine == machine {
+			out = append(out, o)
+		}
+	}
+	return out
+}
+
+// The snapshot a merge check composes from carries the agent account as a pseudonym (novox/hq ADR 0266),
+// so a change is judged against machines that name one, and the name never leaves.
+func TestTheFactsCarryTheAgentAccountAsAPseudonym(t *testing.T) {
+	open, _ := aMeshWithSecrets(t)
+	ctx := t.Context()
+	if err := open.inventory.SetAccount(ctx, "anchor", "keeper", ""); err != nil {
+		t.Fatal(err)
+	}
+	if err := open.inventory.SetAgentAccount(ctx, "anchor", "warden", ""); err != nil {
+		t.Fatal(err)
+	}
+	f, err := gatherFacts(ctx, open, "2.11.17")
+	if err != nil {
+		t.Fatal(err)
+	}
+	body, _ := f.Encode()
+	if strings.Contains(string(body), "warden") {
+		t.Error("the agent account's name is in the snapshot")
+	}
+	m, ok := f.Machine(snapshot.Pseudonym("machine", "anchor"))
+	if !ok || m.AgentAccount != snapshot.Pseudonym("account", "warden") || m.Account == m.AgentAccount {
+		t.Fatalf("the anchor's agent account reads as %q (operator %q)", m.AgentAccount, m.Account)
+	}
+}
+
+// No verb runs a `node` command that sets something: through the generic `command` verb, `node account`,
+// `node agent-account` and every other `node` subcommand but list and show are refused, naming the terminal.
+func TestNoVerbSetsANodesAccounts(t *testing.T) {
+	for _, line := range []string{
+		"node agent-account novox --clear",
+		"node agent-account novox ops",
+		"node account novox agent",
+		"node account novox",
+		"node add intruder",
+		"node public-domain novox --clear",
+		"node",
+		"node frobnicate",
+	} {
+		argv, err := argvFor("command", map[string]any{"command": line})
+		if err == nil || !strings.Contains(err.Error(), "controller's terminal") ||
+			!strings.Contains(err.Error(), "ADR 0266") {
+			t.Errorf("%q ran as %v (%v); want a refusal naming the terminal", line, argv, err)
+		}
+	}
+	for _, line := range []string{"node show novox", "node list --json", "status --json"} {
+		if _, err := argvFor("command", map[string]any{"command": line}); err != nil {
+			t.Errorf("%q, a read, was refused: %v", line, err)
+		}
+	}
+	if err := terminalOnly([]string{"node", "account", "a", "b"}); err == nil {
+		t.Error("the refusal is not only the command verb's")
+	}
+}
+
+// Naming the agent account is the controller's terminal's alone: the `node` verb only shows.
+func TestTheNodeVerbOnlyShows(t *testing.T) {
+	argv, err := argvFor("node", map[string]any{"node": "anchor"})
+	if err != nil || strings.Join(argv, " ") != "node show anchor" {
+		t.Fatalf("the node verb runs %v (%v)", argv, err)
+	}
+	for _, v := range catalogue.ControllerVerbs {
+		if strings.Contains(v.Name, "agent") {
+			t.Errorf("a verb %q may name the agent account", v.Name)
+		}
+	}
+}
+
+// After every node-engine restart its search for setuid programs runs for up to its bound, and the agent account
+// is not judged until it ends. DA does not raise that as urgent while the search is within its bound, counted from
+// when this controller first saw it waiting — never from the engine's own "since", which a restart resets, so an
+// engine restarted in a loop does not keep it quiet. The account is still not confined, and `node show` still
+// says not judged; a search that failed, or a way to root found, is urgent at once.
+func TestASearchStillRunningAfterARestartIsNotUrgent(t *testing.T) {
+	if searchQuietFor != rootsearch.Bound {
+		t.Fatalf("the quiet is %s and the node-engine's bound %s: they are one value", searchQuietFor, rootsearch.Bound)
+	}
+	open := aMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	if _, err := inv.NodeByName(ctx, "anchor"); err != nil {
+		if _, err := inv.AddNode(ctx, "anchor"); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := inv.SetAgentAccount(ctx, "anchor", "agent", ""); err != nil {
+		t.Fatal(err)
+	}
+	d := &doctor{open: open}
+	say := func(state, reason string) []conditions.Observation {
+		t.Helper()
+		// The engine's since is always now: it was just restarted.
+		v := inventory.ResourceHealth{Module: "claude-code", Resource: "claude-code.agent-account",
+			Kind: link.KindAccount, Target: "agent", State: state, Reason: reason, Root: link.RootNever,
+			Account: "agent", Since: time.Now()}
+		if _, err := inv.RecordHealth(ctx, inventory.NodeHealth{Node: "anchor", Contract: link.RootContract,
+			SaidAt: time.Now(), HeardAt: time.Now(), Resources: []inventory.ResourceHealth{v}}); err != nil {
+			t.Fatal(err)
+		}
+		found, err := probeAgentAccounts(ctx, d)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return onlyMachine(found, "anchor")
+	}
+	running := link.ReasonRootPending + ": the search for setuid programs, started at 19:21, has not finished yet"
+	healthy := func() {
+		t.Helper()
+		if found := say(link.StateHealthy, ""); len(found) != 0 {
+			t.Fatalf("a healthy verdict raised: %+v", found)
+		}
+	}
+	if found := say(link.StateUnknown, running); len(found) != 0 {
+		t.Fatalf("a search first seen now was raised: %+v", found)
+	}
+	if _, confined, why, _ := agentConfined(ctx, inv, "anchor", time.Now()); confined || !strings.Contains(why, "not judged") {
+		t.Fatalf("an account whose search runs was read as confined: %q", why)
+	}
+	// The engine restarted again and again, each statement's own since fresh: the controller's clock runs on.
+	if _, err := inv.RootSearchPending(ctx, "anchor", time.Now().Add(-searchQuietFor-time.Minute)); err != nil {
+		t.Fatal(err)
+	}
+	healthy() // a complete verdict forgets when the waiting began …
+	if _, err := inv.RootSearchPending(ctx, "anchor", time.Now().Add(-searchQuietFor-time.Minute)); err != nil {
+		t.Fatal(err) // … and this restart loop began past the bound
+	}
+	if found := say(link.StateUnknown, running); len(found) != 1 || found[0].Severity != conditions.Urgent {
+		t.Fatalf("a search pending past the bound, by the controller's clock, was not urgent: %+v", found)
+	}
+	healthy()
+	incomplete := rootsearch.ReasonIncomplete + ": the search for setuid programs did not finish (last tried at " +
+		"19:23: timeout); it is tried again later"
+	if found := say(link.StateUnknown, incomplete); len(found) != 1 || found[0].Severity != conditions.Urgent {
+		t.Fatalf("a search that did not finish was not urgent: %+v", found)
+	}
+	if found := say(link.StateUnhealthy, link.ReasonRoot+": in the group docker; "+running); len(found) != 1 ||
+		found[0].Severity != conditions.Urgent {
+		t.Fatalf("a way to root found while the search runs was not urgent: %+v", found)
+	}
+}

cmd/mesh-controller/api.go

@@ -95,10 +95,10 @@ func commands(who Authenticator) http.Handler {
 	mux := http.NewServeMux()
 
 	mux.HandleFunc("POST /assign", acting(who, true, func(ctx context.Context, open *stores, in request) (string, error) {
-		return assign(ctx, open, in.Node, in.Module)
+		return assign(ctx, open, in.Node, splitModules(in.Module)...)
 	}))
 	mux.HandleFunc("POST /unassign", acting(who, true, func(ctx context.Context, open *stores, in request) (string, error) {
-		return unassign(ctx, open, in.Node, in.Module)
+		return unassign(ctx, open, in.Node, splitModules(in.Module)...)
 	}))
 	// Adoption (novox/hq ADR 0100): the same acts as `take`, `converge` and `adopt`.
 	mux.HandleFunc("POST /take", acting(who, true, func(ctx context.Context, open *stores, in request) (string, error) {

cmd/mesh-controller/asker.go

@@ -0,0 +1,801 @@
+package main
+
+// The controller asks, and acts on the operator's warrant (novox/hq ADR 0259 §6). It holds no channel, no
+// identity and no factor: it asks the router like any other module, and performs the answer chosen with its
+// own grant.
+//
+//   - **For every open, unsilenced condition that needs the operator and names its answers**, one ask is
+//     published on the `operator-channel` seat under the controller's own name: the condition's words, its
+//     actions as options at their levels (Silence acknowledges; Release, Stop, Start and Restart approve),
+//     answered by the operator, expiring after a day (a week when every option only acknowledges). A
+//     condition that clears, is silenced, or changes its answers has its ask cancelled; an ask that expired
+//     unanswered is asked again while the condition lasts. Each ask is kept in the controller's bucket
+//     `asked`, so a restart neither asks twice nor forgets.
+//   - **On a warrant**, heard on the seat's event under the controller's own name (which only the router may
+//     say), the controller acts once per ask: only for an ask it holds, only for the option it offered at
+//     that option's level, and only while the condition is still open. It performs the action as itself —
+//     a silence through its own conditions, any other through the verb the action names — with the warrant's
+//     words as its why, and records it in the hand-act log as the operator's decision, naming the channel,
+//     the ask and the proofs. An ask that ended without a choice is recorded and nothing is done.
+//   - **A warrant it missed** while away is read from the router's record of its asks, under its own name.
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"sort"
+	"strings"
+	"sync"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/asks"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// The asker's name on the seat: the controller's module.
+const askerName = broker.ControllerSeat
+
+// How long an ask lasts: a day when an answer approves, a week when every answer only acknowledges.
+const (
+	// askApproveFor is a day less a margin, so an ask is never refused at the router for lasting a day and
+	// a moment (the SDK's bound is a day).
+	askApproveFor     = 24*time.Hour - 10*time.Minute
+	askAcknowledgeFor = 7 * 24 * time.Hour
+	// askEvery is how often what is open is asked about again, beside every change.
+	askEvery = time.Minute
+	// askCatchUpAfter is how old an open ask is before the router's record of it is read: a warrant heard
+	// on the event needs no reading.
+	askCatchUpAfter = 2 * time.Minute
+	// askAgainAfterAnswer is how long a condition the operator answered is not asked about again with the
+	// same answers: what was chosen takes a while to clear it, and asking again at once would ask twice.
+	askAgainAfterAnswer = time.Hour
+	// askMostOpen is how many asks the controller holds open at once (the router refuses a fourth): the
+	// most urgent conditions first, then the oldest.
+	askMostOpen = asks.MostOpen
+)
+
+// What became of an ask, as the controller keeps it.
+const (
+	askOpen      = "open"
+	askCancelled = "cancelled"
+)
+
+// asked is one ask the controller made, as it keeps it.
+type asked struct {
+	ID        string `json:"id"`
+	Condition string `json:"condition"`
+	// Channels is what the channels were when it was asked (asker.channels): an ask the router refused is not
+	// asked again until the condition's answers or the channels change.
+	Channels string              `json:"channels,omitempty"`
+	Ask      asks.Ask            `json:"ask"`
+	Actions  []conditions.Action `json:"actions"`
+	// Options are the actions by option id.
+	Options map[string]int `json:"options"`
+	State   string         `json:"state"`
+	Opened  time.Time      `json:"opened"`
+	Ended   time.Time      `json:"ended,omitempty"`
+	Warrant *asks.Warrant  `json:"warrant,omitempty"`
+	// Acted is what the controller did on the warrant: empty before it did anything, "acting" while it acts,
+	// then "done", "failed: …" or "nothing: …". Anything but empty is never acted on again.
+	Acted string `json:"acted,omitempty"`
+	// Part is which ask of its condition this is (askPart): empty for the one that carries the condition's
+	// answers, or the authorising ones where it has both; "acknowledge" for its acknowledging answers asked
+	// apart (the review of 2026-10-09, M1).
+	Part string `json:"part,omitempty"`
+	// Rehearsal is an ask started at the controller's terminal (rehearse.go): about no condition, its answers
+	// perform nothing, and the reconciling of conditions leaves it alone.
+	Rehearsal bool `json:"rehearsal,omitempty"`
+}
+
+// partKey is an ask's place among what is asked: its condition and its part.
+func partKey(condition, part string) string { return condition + "#" + part }
+
+// partAcknowledge is the part of a condition asked apart for its acknowledging answers.
+const partAcknowledge = "acknowledge"
+
+// askPart is one ask a condition is asked with: its part, what it is about, and its answers.
+type askPart struct {
+	name    string
+	about   string
+	actions []conditions.Action
+}
+
+// levelOf is an action's level as an option offers it: one that says none is never taken for less than
+// approve.
+func levelOf(act conditions.Action) asks.Level {
+	if act.Level == "" {
+		return asks.Approve
+	}
+	return asks.Level(act.Level)
+}
+
+// partsOf is the asks a condition is asked with (the review of 2026-10-09, M1): one, when its answers are all
+// of one kind; else its authorising answers (Release, Stop, Restart) in one ask, about the condition, and its
+// acknowledging ones (Silence) in another. **An acknowledgement never shares an ask with an approval**: a
+// channel that only acknowledges would otherwise answer the ask, and end the approval with it.
+func partsOf(c conditions.Condition) []askPart {
+	var ack, auth []conditions.Action
+	for _, act := range c.Actions {
+		if levelOf(act) == asks.Acknowledge {
+			ack = append(ack, act)
+		} else {
+			auth = append(auth, act)
+		}
+	}
+	if len(ack) == 0 || len(auth) == 0 {
+		return []askPart{{about: c.Key, actions: c.Actions}}
+	}
+	return []askPart{{about: c.Key, actions: auth},
+		{name: partAcknowledge, about: c.Key + "." + partAcknowledge, actions: ack}}
+}
+
+// askedStore keeps the asks (broker.AskedBucket). **Every write after the first is a compare-and-set** (the
+// review of 2026-10-09, L2): an ask is created once, and changed only over the revision it was read at, the
+// change decided again on what is read — so two controllers, or two deliveries of one warrant, never write
+// over each other, and of two that would act only the one whose write stands does.
+type askedStore interface {
+	Get(ctx context.Context, id string) (*asked, error)
+	// Create keeps a new ask, and refuses one already kept under its id.
+	Create(ctx context.Context, a asked) error
+	// Change applies change to the ask kept under id, by compare-and-set, and says whether its write stood.
+	// change says whether to write at all; on a write that came between, it is asked again on what is read.
+	Change(ctx context.Context, id string, change func(*asked) bool) (bool, error)
+	All(ctx context.Context) ([]asked, error)
+}
+
+// askChangeTries is how often a change is read and tried again when another write came between.
+const askChangeTries = 5
+
+// asker is the controller asking the operator and acting on the answer.
+type asker struct {
+	open    func(ctx context.Context) ([]conditions.Condition, error)
+	silence func(ctx context.Context, key string, d time.Duration, by, why string) error
+	store   askedStore
+	// publish puts a message on a subject's stream, de-duplicated by id.
+	publish func(ctx context.Context, subject string, body []byte, id string) error
+	// call performs an action's verb with its arguments, as the controller.
+	call func(ctx context.Context, a conditions.Action, args map[string]string) error
+	// record writes the hand-act log.
+	record func(ctx context.Context, act link.HandAct) error
+	// routerRecord reads the router's record of an ask for a warrant missed; nil reads nothing.
+	routerRecord func(ctx context.Context, id string) (*asks.Warrant, error)
+	// routerHere says whether a router holds the seat and takes asks under the asker's name; nil is yes.
+	routerHere func(ctx context.Context) (bool, error)
+	// channels is what the channels are now, as a fingerprint: who holds which kind, promising what.
+	channels func(ctx context.Context) string
+	// raise keeps the asker's own condition (sourceAsker): which conditions needing the operator could not be
+	// asked, and why. Nil raises nothing (a test that does not look).
+	raise func(ctx context.Context, obs []conditions.Observation) error
+	now   func() time.Time
+	logf  func(string, ...any)
+
+	saidNoRouter bool
+
+	mu     sync.Mutex
+	nudged chan struct{}
+}
+
+func (a *asker) nudge() {
+	if a == nil {
+		return
+	}
+	a.mu.Lock()
+	if a.nudged == nil {
+		a.nudged = make(chan struct{}, 1)
+	}
+	ch := a.nudged
+	a.mu.Unlock()
+	select {
+	case ch <- struct{}{}:
+	default:
+	}
+}
+
+// keep asks until ctx ends: now, on every change of a condition, and every askEvery.
+func (a *asker) keep(ctx context.Context) {
+	a.nudge()
+	tick := time.NewTicker(askEvery)
+	defer tick.Stop()
+	a.mu.Lock()
+	nudged := a.nudged
+	a.mu.Unlock()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-tick.C:
+		case <-nudged:
+		}
+		if err := a.reconcile(ctx); err != nil {
+			a.logf("what the operator is asked could not be brought up to date: %v", err)
+		}
+	}
+}
+
+// wants says whether a condition is one to ask about now.
+func wants(c conditions.Condition, now time.Time) bool {
+	return len(c.Actions) > 0 && c.Needs != "" && !c.SilencedAt(now)
+}
+
+func sameAsked(a []conditions.Action, b []conditions.Action) bool {
+	x, _ := json.Marshal(a)
+	y, _ := json.Marshal(b)
+	return string(x) == string(y)
+}
+
+// reconcile brings what is asked in line with what is open.
+func (a *asker) reconcile(ctx context.Context) error {
+	now := a.now()
+	if a.routerHere != nil {
+		here, err := a.routerHere(ctx)
+		if err != nil {
+			return err
+		}
+		if !here {
+			if !a.saidNoRouter {
+				a.logf("no router takes asks under the controller's name (a module declaring %s with its ask "+
+					"named by its caller, assigned): the operator is asked nothing until one is", broker.AsksSeat)
+				a.saidNoRouter = true
+			}
+			open, err := a.open(ctx)
+			if err != nil {
+				return err
+			}
+			var unasked []conditions.Condition
+			for _, c := range open {
+				if wants(c, now) {
+					unasked = append(unasked, c)
+				}
+			}
+			return a.sayUnasked(ctx, unasked, "no router takes the controller's asks: no module holding "+
+				broker.AsksSeat+" that takes an ask under its asker's name is assigned")
+		}
+		a.saidNoRouter = false
+	}
+	channels := ""
+	if a.channels != nil {
+		channels = a.channels(ctx)
+	}
+	open, err := a.open(ctx)
+	if err != nil {
+		return err
+	}
+	all, err := a.store.All(ctx)
+	if err != nil {
+		return err
+	}
+	byCondition := map[string]asked{} // by partKey
+	for _, r := range all {
+		if r.State == askOpen && !r.Rehearsal {
+			k := partKey(r.Condition, r.Part)
+			if prior, held := byCondition[k]; !held || r.Opened.After(prior.Opened) {
+				byCondition[k] = r
+			}
+		}
+	}
+	// A warrant missed while away, read from the router's record.
+	if a.routerRecord != nil {
+		for _, r := range byCondition {
+			if now.Sub(r.Opened) < askCatchUpAfter {
+				continue
+			}
+			if w, err := a.routerRecord(ctx, r.ID); err == nil && w != nil {
+				body, _ := json.Marshal(w)
+				if err := a.Decided(ctx, body); err != nil {
+					return err
+				}
+			}
+		}
+		if all, err = a.store.All(ctx); err != nil {
+			return err
+		}
+		byCondition = map[string]asked{}
+		for _, r := range all {
+			if r.State == askOpen && !r.Rehearsal {
+				byCondition[partKey(r.Condition, r.Part)] = r
+			}
+		}
+	}
+	// What the operator answered lately, by condition: not asked again at once; and what the router refused,
+	// newest first: not asked again until the answers or the channels change.
+	answered, refused := map[string]asked{}, map[string]asked{}
+	for _, r := range all {
+		k := partKey(r.Condition, r.Part)
+		if r.State == string(asks.OutcomeChosen) && now.Sub(r.Ended) < askAgainAfterAnswer {
+			answered[k] = r
+		}
+		if r.State == string(asks.OutcomeRefused) {
+			if prior, has := refused[k]; !has || r.Opened.After(prior.Opened) {
+				refused[k] = r
+			}
+		}
+	}
+	wanted := map[string]bool{}
+	var unasked []conditions.Condition // refused by the router, and nothing it was refused for changed
+	var refusedWords []string
+	// The most urgent first, then the oldest: those are asked when no more than askMostOpen may be.
+	sort.SliceStable(open, func(i, j int) bool {
+		ui, uj := open[i].Severity == conditions.Urgent, open[j].Severity == conditions.Urgent
+		if ui != uj {
+			return ui
+		}
+		if !open[i].Raised.Equal(open[j].Raised) {
+			return open[i].Raised.Before(open[j].Raised)
+		}
+		return open[i].Key < open[j].Key
+	})
+	openNow := 0
+	for _, c := range open {
+		if !wants(c, now) {
+			continue
+		}
+		for _, p := range partsOf(c) {
+			if r, held := byCondition[partKey(c.Key, p.name)]; held && sameAsked(r.Actions, p.actions) && now.Before(r.Ask.Expires) {
+				openNow++
+			}
+		}
+	}
+	for _, c := range open {
+		if !wants(c, now) {
+			continue
+		}
+		saidUnasked := false
+		for _, p := range partsOf(c) {
+			key := partKey(c.Key, p.name)
+			wanted[key] = true
+			if r, was := refused[key]; was && sameAsked(r.Actions, p.actions) && r.Channels == channels {
+				if _, held := byCondition[key]; !held {
+					if !saidUnasked {
+						unasked, saidUnasked = append(unasked, c), true
+					}
+					if r.Warrant != nil && r.Warrant.Words != "" {
+						refusedWords = append(refusedWords, r.Warrant.Words)
+					}
+					continue // refused, and nothing it was refused for has changed
+				}
+			}
+			if r, done := answered[key]; done && sameAsked(r.Actions, p.actions) {
+				if _, held := byCondition[key]; !held {
+					continue
+				}
+			}
+			if r, held := byCondition[key]; held {
+				switch {
+				case !sameAsked(r.Actions, p.actions):
+					if err := a.cancel(ctx, r, "its answers changed"); err != nil {
+						return err
+					}
+				case !now.Before(r.Ask.Expires):
+					// Expired unanswered: the router says so too; asked again below while it lasts.
+					if _, err := a.store.Change(ctx, r.ID, func(x *asked) bool {
+						if x.State != askOpen {
+							return false
+						}
+						x.State, x.Ended = string(asks.OutcomeExpired), now
+						return true
+					}); err != nil {
+						return err
+					}
+					openNow--
+				default:
+					continue
+				}
+			}
+			if openNow >= askMostOpen {
+				continue // asked when one of the open ones ends, most urgent first
+			}
+			if err := a.ask(ctx, c, p, channels); err != nil {
+				a.logf("the operator could not be asked about %s: %v", c.Key, err)
+				continue
+			}
+			openNow++
+		}
+	}
+	stillOpen := map[string]conditions.Condition{}
+	for _, c := range open {
+		stillOpen[c.Key] = c
+	}
+	for key, r := range byCondition {
+		if wanted[key] {
+			continue
+		}
+		// **A silence never takes an approval back** (the confirmation review of 2026-10-09, M1). Silence is an
+		// acknowledgement — anyone at the desk may give it — so a condition silenced while its approval is asked
+		// keeps that ask open, unchanged, until it is answered on a channel that proves who answered, or expires.
+		// It is not asked again once it ends, while the silence lasts.
+		if c, open := stillOpen[r.Condition]; open && c.SilencedAt(now) && r.Ask.Highest() != asks.Acknowledge &&
+			now.Before(r.Ask.Expires) && keepsItsAnswers(c, r) {
+			continue
+		}
+		if err := a.cancel(ctx, r, "the condition ended, was silenced or needs nothing now"); err != nil {
+			return err
+		}
+	}
+	why := "the router refused the ask"
+	if len(refusedWords) > 0 {
+		why += ": " + refusedWords[0]
+	}
+	return a.sayUnasked(ctx, unasked, why)
+}
+
+// keepsItsAnswers says a condition still offers the answers an ask kept was asked with.
+func keepsItsAnswers(c conditions.Condition, r asked) bool {
+	for _, p := range partsOf(c) {
+		if partKey(c.Key, p.name) == partKey(r.Condition, r.Part) {
+			return sameAsked(r.Actions, p.actions)
+		}
+	}
+	return false
+}
+
+// sourceAsker raises the asker's own condition.
+const sourceAsker = "asker"
+
+// sayUnasked keeps the asker's one condition: while a condition that needs the operator could not be asked
+// on any channel, said loudly (failure must be loud), cleared when every one could be.
+func (a *asker) sayUnasked(ctx context.Context, unasked []conditions.Condition, why string) error {
+	if a.raise == nil {
+		return nil
+	}
+	var obs []conditions.Observation
+	if len(unasked) > 0 {
+		keys := make([]string, 0, len(unasked))
+		severity := conditions.Warning
+		for _, c := range unasked {
+			keys = append(keys, c.Key)
+			if c.Severity == conditions.Urgent {
+				severity = conditions.Urgent
+			}
+		}
+		sort.Strings(keys)
+		obs = append(obs, conditions.Observation{Scope: conditions.ScopeSeat, ID: broker.AsksSeat, Token: "unasked",
+			Kind: "asks-undelivered", Severity: severity, Source: sourceAsker,
+			Summary: fmt.Sprintf("%d condition(s) that need the operator could not be asked on any channel: %s; %s",
+				len(keys), strings.Join(keys, ", "), why),
+			Headline:    "Questions for you not delivered",
+			Explanation: "Needs you: answer them from the mesh MCP server. The mesh could not send you its questions on any channel.",
+			Needs:       "answer them from the mesh MCP server, and check why no channel carries them.",
+			Resolved:    "The mesh can ask you again"})
+	}
+	if err := a.raise(ctx, obs); err != nil {
+		a.logf("whether the operator could be asked could not be kept as a condition: %v", err)
+	}
+	return nil
+}
+
+// optionID is an action's label as an option's id: "Silence for a week" is silence-for-a-week.
+func optionID(label string) string {
+	var b strings.Builder
+	dash := false
+	for _, r := range strings.ToLower(label) {
+		switch {
+		case r >= 'a' && r <= 'z', r >= '0' && r <= '9':
+			b.WriteRune(r)
+			dash = false
+		case !dash && b.Len() > 0:
+			b.WriteByte('-')
+			dash = true
+		}
+	}
+	return strings.TrimSuffix(b.String(), "-")
+}
+
+// doesWords is what an action does, in the words an option says it with.
+func doesWords(act conditions.Action) string {
+	switch {
+	case act.Arguments["silence"] != "":
+		return "nothing more is said of it for a week"
+	case act.Verb == "mesh-delivery.release":
+		return "the delivery goes on"
+	case act.Verb == "mesh-delivery.stop":
+		return "the delivery ends"
+	case act.Verb == broker.ControllerSeat+".plans" && act.Arguments["go"] != "":
+		return "the delivery starts"
+	case act.Verb == broker.ControllerSeat+".plans" && act.Arguments["stop"] != "":
+		return "the delivery is stopped"
+	case strings.HasSuffix(act.Verb, ".restart"):
+		return "its service is restarted on " + act.Machine
+	}
+	return strings.ToLower(act.Label)
+}
+
+// askText is a condition's words as an ask says them: without where an answer is given when no channel can
+// give it (FromMeshMCPServer), since the ask is answered on a channel and the router says where else.
+func askText(s string) string {
+	for _, with := range []string{", " + FromMeshMCPServer, " " + FromMeshMCPServer} {
+		s = strings.ReplaceAll(s, with, ".")
+	}
+	return strings.ReplaceAll(s, "..", ".")
+}
+
+// askOf is the ask one part of a condition is asked with.
+func askOf(id string, c conditions.Condition, p askPart, now time.Time) (asks.Ask, map[string]int) {
+	q := asks.Ask{ID: id, Headline: c.Headline, Explanation: askText(c.Explanation), Who: asks.Operator,
+		OnExpiry: "nothing is done, and you are asked again while it lasts", About: p.about,
+		Urgent: c.Severity == conditions.Urgent}
+	options := map[string]int{}
+	approves := false
+	for i, act := range p.actions {
+		level := levelOf(act) // an action that says nothing of its level is never taken for less than approve
+		approves = approves || level != asks.Acknowledge
+		oid := optionID(act.Label)
+		options[oid] = i
+		// Every option binds the exact act it stands for (novox/hq ADR 0259 §6): the verb, the machine and
+		// every argument. The warrant then authorises that act and no other.
+		binds, _ := asks.ActDigest(boundAct(act))
+		q.Options = append(q.Options, asks.Option{ID: oid, Label: act.Label, Does: doesWords(act), Level: level,
+			Binds: binds})
+	}
+	q.Expires = now.Add(askAcknowledgeFor)
+	if approves {
+		q.Expires = now.Add(askApproveFor)
+	}
+	return q, options
+}
+
+// boundAct is what an option's Binds digests: the act exactly as the controller will perform it — its verb,
+// machine, level, and each argument as "arg.<name>" — and never its label or words.
+func boundAct(act conditions.Action) asks.Act {
+	out := asks.Act{"verb": act.Verb, "machine": act.Machine, "level": act.Level}
+	for k, v := range act.Arguments {
+		out["arg."+k] = v
+	}
+	return out
+}
+
+func newAskID() string {
+	var b [8]byte
+	_, _ = rand.Read(b[:])
+	return "c" + hex.EncodeToString(b[:])
+}
+
+// askUnsent is an ask kept and never published: asked again at the next look.
+const askUnsent = "unsent"
+
+// ask publishes one ask about a part of a condition, kept before it is published (the review of 2026-10-09,
+// L3): a warrant for it then always finds it, and one whose publishing failed is marked so and asked again.
+func (a *asker) ask(ctx context.Context, c conditions.Condition, p askPart, channels string) error {
+	now := a.now()
+	id := newAskID()
+	q, options := askOf(id, c, p, now)
+	if err := q.Check(now); err != nil {
+		return err
+	}
+	body, err := json.Marshal(q)
+	if err != nil {
+		return err
+	}
+	if err := a.store.Create(ctx, asked{ID: id, Condition: c.Key, Part: p.name, Ask: q, Actions: p.actions,
+		Options: options, State: askOpen, Opened: now, Channels: channels}); err != nil {
+		return fmt.Errorf("the ask could not be kept, so it was not asked: %w", err)
+	}
+	if err := a.publish(ctx, asks.AskSubject(askerName), body, "ask."+id); err != nil {
+		if _, cerr := a.store.Change(ctx, id, func(x *asked) bool {
+			if x.State != askOpen || x.Acted != "" {
+				return false
+			}
+			x.State, x.Ended, x.Acted = askUnsent, a.now(), "nothing: it could not be published: "+err.Error()
+			return true
+		}); cerr != nil {
+			a.logf("the ask %s could not be published, and could not be marked so: %v", id, cerr)
+		}
+		return err
+	}
+	a.logf("asked the operator about %s (%s): %d answer(s)", c.Key, id, len(q.Options))
+	return nil
+}
+
+// cancel takes an ask back: kept cancelled first, so a warrant that comes after is refused, then said to the
+// router; a cancel the router did not hear leaves the ask to expire there, and nothing is done on it here.
+func (a *asker) cancel(ctx context.Context, r asked, why string) error {
+	stood, err := a.store.Change(ctx, r.ID, func(x *asked) bool {
+		if x.State != askOpen {
+			return false
+		}
+		x.State, x.Ended = askCancelled, a.now()
+		return true
+	})
+	if err != nil || !stood {
+		return err
+	}
+	body, _ := json.Marshal(map[string]string{"id": r.ID})
+	if err := a.publish(ctx, asks.CancelSubject(askerName), body, "cancel."+r.ID); err != nil {
+		a.logf("the ask %s about %s is taken back here, and the router could not be told (%v): it expires there, "+
+			"and no answer to it is acted on", r.ID, r.Condition, err)
+		return nil
+	}
+	a.logf("took back the ask %s about %s: %s", r.ID, r.Condition, why)
+	return nil
+}
+
+// Decided takes the router's word on one of the controller's asks (link.Decider). An error is returned only
+// when what was decided could not be kept, so the word is held and heard again.
+func (a *asker) Decided(ctx context.Context, body []byte) error {
+	var w asks.Warrant
+	if err := json.Unmarshal(body, &w); err != nil {
+		a.logf("the router's word on an ask could not be read; ignored: %v", err)
+		return nil
+	}
+	if w.Asker != askerName {
+		a.logf("REFUSED a warrant for %s's ask %s: the controller acts only on its own", w.Asker, w.Ask)
+		return nil
+	}
+	r, err := a.store.Get(ctx, w.Ask)
+	if err != nil {
+		return err
+	}
+	if r == nil {
+		a.logf("REFUSED a warrant for the ask %s, which the controller does not hold", w.Ask)
+		return nil
+	}
+	if r.Acted != "" {
+		return nil // heard again: acted on once
+	}
+	now := a.now()
+	if w.Outcome != asks.OutcomeChosen {
+		acted := "nothing: the ask " + string(w.Outcome)
+		if w.Words != "" {
+			acted += ": " + w.Words
+		}
+		if _, err := a.store.Change(ctx, r.ID, func(x *asked) bool {
+			if x.Acted != "" {
+				return false
+			}
+			x.State, x.Ended, x.Warrant, x.Acted = string(w.Outcome), now, &w, acted
+			return true
+		}); err != nil {
+			return err
+		}
+		a.logf("the ask %s about %s ended %s; nothing is done", r.ID, r.Condition, w.Outcome)
+		return nil
+	}
+	if r.State != askOpen {
+		// Cancelled, replaced or expired in the controller's own record: no answer to it is acted on.
+		a.logf("REFUSED a warrant for the ask %s, which is %s in the controller's own record", r.ID, r.State)
+		return nil
+	}
+	option, err := w.For(askerName, r.Ask)
+	if err != nil {
+		a.logf("REFUSED a warrant for the ask %s: %v", r.ID, err)
+		return nil
+	}
+	index, offered := r.Options[option.ID]
+	if !offered || index >= len(r.Actions) {
+		a.logf("REFUSED a warrant for the ask %s: it chose %s, which no action stands for", r.ID, option.ID)
+		return nil
+	}
+	act := r.Actions[index]
+	// The act about to be performed is the one the option bound when the controller asked: a record changed
+	// since is refused, never performed.
+	if err := option.Performs(boundAct(act)); err != nil {
+		a.logf("REFUSED a warrant for the ask %s: %v", r.ID, err)
+		return nil
+	}
+	open, err := a.open(ctx)
+	if err != nil {
+		return err
+	}
+	stillOpen := r.Rehearsal // a rehearsal is about no condition
+	for _, c := range open {
+		stillOpen = stillOpen || c.Key == r.Condition
+	}
+	if !stillOpen {
+		// The asker checks the state is still what it asked about before it acts (to-be 46 §10, step 7).
+		if _, err := a.store.Change(ctx, r.ID, func(x *asked) bool {
+			if x.State != askOpen || x.Acted != "" {
+				return false
+			}
+			x.State, x.Warrant, x.Ended, x.Acted = string(asks.OutcomeChosen), &w, now,
+				"nothing: the condition ended before the answer"
+			return true
+		}); err != nil {
+			return err
+		}
+		a.logf("%s, for %s, which ended meanwhile: nothing is done", w.Says(), r.Condition)
+		return nil
+	}
+	// Claimed before acting, by compare-and-set: only the delivery whose write stands acts (security review
+	// of 2026-10-08, finding 9). Not by the warrant's message id, which another publisher could take first:
+	// the controller's own record decides.
+	claimed, err := a.store.Change(ctx, r.ID, func(x *asked) bool {
+		if x.State != askOpen || x.Acted != "" {
+			return false
+		}
+		x.State, x.Warrant, x.Acted = string(asks.OutcomeChosen), &w, "acting"
+		return true
+	})
+	if err != nil {
+		return err
+	}
+	if !claimed {
+		a.logf("the warrant for the ask %s was already taken by another delivery; nothing more is done", r.ID)
+		return nil
+	}
+	r.Acted = "acting"
+
+	why := fmt.Sprintf("%s (ask %s)", w.Says(), r.ID)
+	args := map[string]string{}
+	for k, v := range act.Arguments {
+		args[k] = v
+	}
+	if v, takes := args["why"]; takes && v == "" {
+		args["why"] = why
+	}
+	var acted error
+	switch {
+	case r.Rehearsal && act.Verb == rehearsalVerb:
+		// A rehearsal's answer performs nothing: it is recorded below as the operator's decision.
+	case act.Arguments["silence"] != "":
+		acted = a.silence(ctx, act.Arguments["silence"], conditions.MaxSilence, byWords(w), why)
+	default:
+		acted = a.call(ctx, act, args)
+	}
+	ended, outcome := a.now(), "done"
+	if acted != nil {
+		outcome = "failed: " + acted.Error()
+	}
+	r.Ended, r.Acted = ended, outcome
+	if _, err := a.store.Change(ctx, r.ID, func(x *asked) bool {
+		if x.Acted != "acting" {
+			return false
+		}
+		x.Ended, x.Acted = ended, outcome
+		return true
+	}); err != nil {
+		a.logf("%s was acted on (%s), and how it ended could NOT be kept: %v", r.ID, outcome, err)
+	}
+	verbArgs := []string{act.Verb}
+	if act.Machine != "" {
+		verbArgs = append(verbArgs, "on "+act.Machine)
+	}
+	keys := make([]string, 0, len(args))
+	for k := range args {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	for _, k := range keys {
+		if k != "why" {
+			verbArgs = append(verbArgs, k+"="+args[k])
+		}
+	}
+	if err := a.record(ctx, link.HandAct{Verb: handActWarrant, Args: verbArgs, Why: why, By: byWords(w),
+		Cause: conditions.CauseOperatorAnswer, Condition: r.Condition, Via: viaWords(w), Ask: r.ID,
+		Proofs: w.Proofs, RequestedBy: r.Condition, Outcome: r.Acted}); err != nil {
+		a.logf("%s was done, and could NOT be recorded in the hand-act log: %v", why, err)
+	}
+	a.logf("%s: %s", why, r.Acted)
+	return nil
+}
+
+// handActWarrant is the verb an act the operator chose on a warrant is recorded under: a person's decision,
+// never a repair (handActVerbs).
+const handActWarrant = "warrant"
+
+// byWords is who chose, as the hand-act log says it: "the operator, as telegram identity 42".
+func byWords(w asks.Warrant) string {
+	if w.By == nil {
+		return "the operator"
+	}
+	return fmt.Sprintf("the %s, as %s identity %s", w.By.Who, w.By.Kind, w.By.Identity)
+}
+
+// viaWords is the channel an answer came through: its module and kind, and how the sender was known.
+func viaWords(w asks.Warrant) string {
+	if w.By == nil {
+		return w.Channel
+	}
+	via := w.Channel + " (" + w.By.Kind + ")"
+	if w.By.Verified != "" {
+		via += ", " + w.By.Verified
+	}
+	return via
+}
+
+// errNotGranted is an action whose verb the controller's grant does not name.
+var errNotGranted = errors.New("the controller's grant does not name this verb")

cmd/mesh-controller/asker_bus_test.go

@@ -0,0 +1,151 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/nats-io/nats.go"
+	"github.com/nats-io/nats.go/jetstream"
+
+	"git.novox.be/novox/mesh-sdk/go/asks"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/link"
+	"github.com/novox/mesh-controller/internal/testbus"
+)
+
+// busAsker is an asker on a real bus's `asked` bucket, counting what it performs: two of them are two
+// controllers sharing one record.
+type busAskerRig struct {
+	mu     sync.Mutex
+	called int
+	acts   int
+	open   []conditions.Condition
+	sent   [][]byte
+}
+
+func (rig *busAskerRig) asker(t *testing.T, conn *nats.Conn, now time.Time) *asker {
+	return &asker{
+		open: func(context.Context) ([]conditions.Condition, error) {
+			rig.mu.Lock()
+			defer rig.mu.Unlock()
+			return rig.open, nil
+		},
+		silence: func(context.Context, string, time.Duration, string, string) error { return nil },
+		store:   busAsked{conn: conn},
+		publish: func(_ context.Context, subject string, body []byte, _ string) error {
+			rig.mu.Lock()
+			defer rig.mu.Unlock()
+			if subject == asks.AskSubject(askerName) {
+				rig.sent = append(rig.sent, body)
+			}
+			return nil
+		},
+		call: func(context.Context, conditions.Action, map[string]string) error {
+			time.Sleep(20 * time.Millisecond) // long enough for the other delivery to arrive meanwhile
+			rig.mu.Lock()
+			defer rig.mu.Unlock()
+			rig.called++
+			return nil
+		},
+		record: func(context.Context, link.HandAct) error {
+			rig.mu.Lock()
+			defer rig.mu.Unlock()
+			rig.acts++
+			return nil
+		},
+		now:  func() time.Time { return now },
+		logf: t.Logf,
+	}
+}
+
+func askedBus(t *testing.T) *nats.Conn {
+	t.Helper()
+	conn, err := nats.Connect(testbus.URL(t))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(conn.Close)
+	js, err := jetstream.New(conn)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := js.CreateKeyValue(context.Background(), jetstream.KeyValueConfig{Bucket: broker.AskedBucket}); err != nil {
+		t.Fatal(err)
+	}
+	return conn
+}
+
+// The review of 2026-10-09 (L7): two deliveries of one warrant, to two controllers at once, perform its act
+// exactly once and record it once — the record's compare-and-set decides, never the warrant's message id.
+func TestTwoAnswersAtOnceActOnce(t *testing.T) {
+	conn := askedBus(t)
+	now := time.Date(2026, 10, 9, 14, 0, 0, 0, time.UTC)
+	rig := &busAskerRig{open: []conditions.Condition{heldCondition()}}
+	first, second := rig.asker(t, conn, now), rig.asker(t, conn, now)
+	if err := first.reconcile(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	if len(rig.sent) != 1 {
+		t.Fatalf("asked %d times", len(rig.sent))
+	}
+	var q asks.Ask
+	_ = json.Unmarshal(rig.sent[0], &q)
+	release, _ := q.Option("release")
+	w := asks.Warrant{Ask: q.ID, Asker: askerName, About: q.About, Outcome: asks.OutcomeChosen, Option: release.ID,
+		Label: release.Label, Level: release.Level, Channel: "telegram", Proofs: []string{"P1"}, At: now,
+		AskDigest: q.Digest(), By: &asks.Person{Who: asks.Operator, Kind: "telegram", Identity: "42", Verified: "user id verified"}}
+	body, _ := json.Marshal(w)
+	var wg sync.WaitGroup
+	for _, a := range []*asker{first, second, first, second} {
+		wg.Add(1)
+		go func(a *asker) {
+			defer wg.Done()
+			if err := a.Decided(context.Background(), body); err != nil {
+				t.Error(err)
+			}
+		}(a)
+	}
+	wg.Wait()
+	if rig.called != 1 || rig.acts != 1 {
+		t.Fatalf("performed %d time(s), recorded %d time(s)", rig.called, rig.acts)
+	}
+	got, err := busAsked{conn: conn}.Get(context.Background(), q.ID)
+	if err != nil || got == nil || got.Acted != "done" {
+		t.Fatalf("kept as %+v (%v)", got, err)
+	}
+}
+
+// The review of 2026-10-09 (L2): a write decided on a record read earlier never lands over one made since. A
+// cancel read before the answer was acted on leaves the act's record as it is.
+func TestAStaleCancelDoesNotWriteOverAnAct(t *testing.T) {
+	conn := askedBus(t)
+	now := time.Date(2026, 10, 9, 14, 0, 0, 0, time.UTC)
+	rig := &busAskerRig{open: []conditions.Condition{heldCondition()}}
+	a := rig.asker(t, conn, now)
+	if err := a.reconcile(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	var q asks.Ask
+	_ = json.Unmarshal(rig.sent[0], &q)
+	stale, _ := busAsked{conn: conn}.Get(context.Background(), q.ID)
+	release, _ := q.Option("release")
+	w := asks.Warrant{Ask: q.ID, Asker: askerName, About: q.About, Outcome: asks.OutcomeChosen, Option: release.ID,
+		Label: release.Label, Level: release.Level, Channel: "telegram", At: now, AskDigest: q.Digest(),
+		By: &asks.Person{Who: asks.Operator, Kind: "telegram", Identity: "42", Verified: "user id verified"}}
+	body, _ := json.Marshal(w)
+	if err := a.Decided(context.Background(), body); err != nil {
+		t.Fatal(err)
+	}
+	if err := a.cancel(context.Background(), *stale, "the condition ended"); err != nil {
+		t.Fatal(err)
+	}
+	got, _ := busAsked{conn: conn}.Get(context.Background(), q.ID)
+	if got.State != string(asks.OutcomeChosen) || got.Acted != "done" {
+		t.Errorf("a stale cancel wrote over the act: %+v", got)
+	}
+}

cmd/mesh-controller/asker_test.go

@@ -0,0 +1,656 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/asks"
+
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// novox/hq ADR 0259 §6: the controller asks the operator for the answers its conditions name, and performs
+// the one chosen on the router's warrant — once, for its own ask, the option offered, at its level.
+
+type memAskedStore map[string]asked
+
+// memAskedMu guards every memAskedStore: Change is a compare-and-set as the bus's is.
+var memAskedMu sync.Mutex
+
+func (m memAskedStore) Get(_ context.Context, id string) (*asked, error) {
+	memAskedMu.Lock()
+	defer memAskedMu.Unlock()
+	r, ok := m[id]
+	if !ok {
+		return nil, nil
+	}
+	return &r, nil
+}
+func (m memAskedStore) Create(_ context.Context, r asked) error {
+	memAskedMu.Lock()
+	defer memAskedMu.Unlock()
+	if _, kept := m[r.ID]; kept {
+		return errors.New("an ask is kept under that id")
+	}
+	m[r.ID] = r
+	return nil
+}
+func (m memAskedStore) Change(_ context.Context, id string, change func(*asked) bool) (bool, error) {
+	memAskedMu.Lock()
+	defer memAskedMu.Unlock()
+	r, ok := m[id]
+	if !ok || !change(&r) {
+		return false, nil
+	}
+	m[id] = r
+	return true, nil
+}
+func (m memAskedStore) All(context.Context) ([]asked, error) {
+	memAskedMu.Lock()
+	defer memAskedMu.Unlock()
+	var out []asked
+	for _, r := range m {
+		out = append(out, r)
+	}
+	return out, nil
+}
+
+type published struct {
+	subject, id string
+	body        []byte
+}
+
+type askerRig struct {
+	a        *asker
+	open     []conditions.Condition
+	store    memAskedStore
+	sent     []published
+	called   []string
+	silenced []string
+	acts     []link.HandAct
+	now      time.Time
+}
+
+func newAskerRig(t *testing.T) *askerRig {
+	r := &askerRig{store: memAskedStore{}, now: time.Date(2026, 10, 8, 14, 0, 0, 0, time.UTC)}
+	r.a = &asker{
+		open: func(context.Context) ([]conditions.Condition, error) { return r.open, nil },
+		silence: func(_ context.Context, key string, d time.Duration, by, why string) error {
+			r.silenced = append(r.silenced, key+" for "+d.String()+" by "+by+" because "+why)
+			// As the controller's conditions do (the confirmation review of 2026-10-09, M1): the condition is
+			// silenced from now on, so what is asked next sees it silenced.
+			for i := range r.open {
+				if r.open[i].Key == key {
+					r.open[i].Silenced = &conditions.Silence{Until: r.now.Add(d), By: by, Why: why, Since: r.now}
+				}
+			}
+			return nil
+		},
+		store: r.store,
+		publish: func(_ context.Context, subject string, body []byte, id string) error {
+			r.sent = append(r.sent, published{subject, id, body})
+			return nil
+		},
+		call: func(_ context.Context, a conditions.Action, args map[string]string) error {
+			raw, _ := json.Marshal(args)
+			r.called = append(r.called, a.Verb+"@"+a.Machine+" "+string(raw))
+			return nil
+		},
+		record: func(_ context.Context, act link.HandAct) error { r.acts = append(r.acts, act); return nil },
+		now:    func() time.Time { return r.now },
+		logf:   t.Logf,
+	}
+	return r
+}
+
+func heldCondition() conditions.Condition {
+	o := stalledObservations([]stalledLine{{ID: "novox/hq@055550802096", State: "held", For: "36h2m6s",
+		Bound: "24h0m0s", H2: "none: the state is the operator's"}})[0]
+	return conditions.Condition{Key: o.Key(), Kind: o.Kind, Severity: conditions.Warning, Headline: o.Headline,
+		Explanation: conditions.Verdict(o.Needs, o.Explanation), Needs: o.Needs, Actions: o.Actions}
+}
+
+func unitsCondition() conditions.Condition {
+	key := "machine.shanks.units"
+	return conditions.Condition{Key: key, Kind: "machine-units", Severity: conditions.Warning,
+		Headline: "3 failed services on shanks", Explanation: "Needs you: mend or remove them on shanks, or silence this.",
+		Needs: "mend or remove them on shanks, or silence this.", Actions: []conditions.Action{conditions.SilenceAction(key)}}
+}
+
+func (r *askerRig) asksSent(t *testing.T) []asks.Ask {
+	t.Helper()
+	var out []asks.Ask
+	for _, p := range r.sent {
+		if p.subject != asks.AskSubject("mesh-controller") {
+			continue
+		}
+		var q asks.Ask
+		if err := json.Unmarshal(p.body, &q); err != nil {
+			t.Fatal(err)
+		}
+		out = append(out, q)
+	}
+	return out
+}
+
+func TestAnAskIsMadeForEachConditionThatNamesItsAnswers(t *testing.T) {
+	r := newAskerRig(t)
+	quiet := conditions.Condition{Key: "machine.ace.silent", Headline: "ace silent", Explanation: "Nothing for you to do. x"}
+	r.open = []conditions.Condition{heldCondition(), unitsCondition(), quiet}
+	if err := r.a.reconcile(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	sent := r.asksSent(t)
+	if len(sent) != 2 {
+		t.Fatalf("asked %d times: %+v", len(sent), sent)
+	}
+	byAbout := map[string]asks.Ask{}
+	for _, q := range sent {
+		byAbout[q.About] = q
+		if err := q.Check(r.now); err != nil {
+			t.Errorf("%s: %v", q.About, err)
+		}
+	}
+	held := byAbout[heldCondition().Key]
+	if len(held.Options) != 2 || held.Options[0].Label != "Release" || held.Options[0].Level != asks.Approve ||
+		held.Options[1].ID != "stop" || held.Expires != r.now.Add(askApproveFor) || held.Who != asks.Operator ||
+		held.OnExpiry == "" {
+		t.Errorf("the held delivery is asked %+v", held)
+	}
+	units := byAbout["machine.shanks.units"]
+	if len(units.Options) != 1 || units.Options[0].Level != asks.Acknowledge || units.Expires != r.now.Add(askAcknowledgeFor) {
+		t.Errorf("the failed units are asked %+v", units)
+	}
+	// No second ask while one is open.
+	r.now = r.now.Add(time.Minute)
+	_ = r.a.reconcile(context.Background())
+	if n := len(r.asksSent(t)); n != 2 {
+		t.Errorf("asked again while open: %d", n)
+	}
+}
+
+func TestAnAskIsTakenBackWhenItsConditionEndsAndAskedAgainAfterItExpires(t *testing.T) {
+	r := newAskerRig(t)
+	r.open = []conditions.Condition{heldCondition(), unitsCondition()}
+	_ = r.a.reconcile(context.Background())
+	// The units are silenced, the held delivery lasts past its ask's day.
+	units := unitsCondition()
+	units.Silenced = &conditions.Silence{Until: r.now.Add(48 * time.Hour)}
+	r.open = []conditions.Condition{heldCondition(), units}
+	r.now = r.now.Add(askApproveFor)
+	if err := r.a.reconcile(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	var cancels int
+	for _, p := range r.sent {
+		if p.subject == asks.CancelSubject("mesh-controller") {
+			cancels++
+		}
+	}
+	if cancels != 1 {
+		t.Errorf("cancels %d, want the silenced one's", cancels)
+	}
+	if sent := r.asksSent(t); len(sent) != 3 || sent[2].About != heldCondition().Key {
+		t.Errorf("the expired ask was not asked again: %+v", sent)
+	}
+}
+
+// warrantFor is the router's warrant for the open ask about a condition, choosing an option by label.
+func (r *askerRig) warrantFor(t *testing.T, condition, label string) asks.Warrant {
+	t.Helper()
+	for _, a := range r.store {
+		if a.Condition != condition || a.State != askOpen {
+			continue
+		}
+		for _, o := range a.Ask.Options {
+			if o.Label == label {
+				return asks.Warrant{Ask: a.ID, Asker: "mesh-controller", About: condition, Outcome: asks.OutcomeChosen,
+					Option: o.ID, Label: o.Label, Level: o.Level, Channel: "telegram", Proofs: []string{"P1"}, At: r.now,
+					AskDigest: a.Ask.Digest(),
+					By:        &asks.Person{Who: asks.Operator, Kind: "telegram", Identity: "42", Verified: "user id verified"}}
+			}
+		}
+	}
+	t.Fatalf("no open ask about %s offers %s", condition, label)
+	return asks.Warrant{}
+}
+
+func answerWith(t *testing.T, r *askerRig, w asks.Warrant) {
+	t.Helper()
+	body, _ := json.Marshal(w)
+	if err := r.a.Decided(context.Background(), body); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestAWarrantIsActedOnOnce(t *testing.T) {
+	r := newAskerRig(t)
+	r.open = []conditions.Condition{heldCondition()}
+	_ = r.a.reconcile(context.Background())
+	w := r.warrantFor(t, heldCondition().Key, "Release")
+	answerWith(t, r, w)
+	answerWith(t, r, w) // heard again
+	if len(r.called) != 1 {
+		t.Fatalf("called %v", r.called)
+	}
+	want := `mesh-delivery.release@ {"id":"novox/hq@055550802096","why":"the operator, via telegram (user id verified), chose Release (ask ` + w.Ask + `)"}`
+	if r.called[0] != want {
+		t.Errorf("called\n  %s\nwant\n  %s", r.called[0], want)
+	}
+	if len(r.acts) != 1 {
+		t.Fatalf("hand-acts %+v", r.acts)
+	}
+	act := r.acts[0]
+	if act.Verb != handActWarrant || act.By != "the operator, as telegram identity 42" ||
+		act.Via != "telegram (telegram), user id verified" || act.Ask != w.Ask || strings.Join(act.Proofs, ",") != "P1" ||
+		act.Cause != conditions.CauseOperatorAnswer || act.Condition != heldCondition().Key || act.Outcome != "done" {
+		t.Errorf("the hand-act %+v", act)
+	}
+	if !personsDecision(act) {
+		t.Error("an act on a warrant counts as a repair")
+	}
+	if got := r.store[w.Ask]; got.State != string(asks.OutcomeChosen) || got.Acted != "done" {
+		t.Errorf("kept %+v", got)
+	}
+}
+
+func TestAWarrantThatIsNotForItsOwnAskIsRefused(t *testing.T) {
+	for name, change := range map[string]func(*asks.Warrant){
+		"another asker":         func(w *asks.Warrant) { w.Asker = "mesh-delivery" },
+		"an ask not held":       func(w *asks.Warrant) { w.Ask = "c0000000000000000" },
+		"an option not offered": func(w *asks.Warrant) { w.Option = "delete" },
+		"another level":         func(w *asks.Warrant) { w.Level = asks.Acknowledge },
+		"no person":             func(w *asks.Warrant) { w.By = nil },
+		"another ask's digest":  func(w *asks.Warrant) { w.AskDigest = "sha256:0000" },
+		"no ask's digest":       func(w *asks.Warrant) { w.AskDigest = "" },
+	} {
+		t.Run(name, func(t *testing.T) {
+			r := newAskerRig(t)
+			r.open = []conditions.Condition{heldCondition()}
+			_ = r.a.reconcile(context.Background())
+			w := r.warrantFor(t, heldCondition().Key, "Stop")
+			change(&w)
+			answerWith(t, r, w)
+			if len(r.called)+len(r.acts)+len(r.silenced) != 0 {
+				t.Errorf("acted on it: %v %v %v", r.called, r.acts, r.silenced)
+			}
+		})
+	}
+}
+
+func TestEachAnswerCallsExactlyItsVerb(t *testing.T) {
+	plan := "plan-1791454185265004861"
+	waiting := conditions.Condition{Key: "plan." + plan + ".waiting", Severity: conditions.Urgent,
+		Headline: "openrazer delivery waiting to start", Needs: "start it, or stop it.",
+		Explanation: "Needs you: start it, or stop it.", Actions: waitingActions(plan, conditions.Urgent)}
+	module := conditions.Condition{Key: "module.openrazer.g14.unhealthy", Severity: conditions.Warning,
+		Headline: "openrazer not working on g14", Needs: "restart its service openrazer-daemon on g14.",
+		Explanation: "Needs you: restart it.", Actions: []conditions.Action{{Label: "Restart",
+			Verb: "node-service-manager.restart", Machine: "g14", Level: conditions.LevelApprove,
+			Arguments: map[string]string{"unit": "openrazer-daemon.service", "scope": "user"}}}}
+	for _, tc := range []struct {
+		c     conditions.Condition
+		label string
+		want  string
+	}{
+		{waiting, "Start", `mesh-controller.plans@ {"cause":"operator-answer","go":"` + plan + `","why":"`},
+		{waiting, "Stop", `mesh-controller.plans@ {"cause":"operator-answer","stop":"` + plan + `","why":"`},
+		{module, "Restart", `node-service-manager.restart@g14 {"scope":"user","unit":"openrazer-daemon.service"}`},
+	} {
+		r := newAskerRig(t)
+		r.open = []conditions.Condition{tc.c}
+		_ = r.a.reconcile(context.Background())
+		answerWith(t, r, r.warrantFor(t, tc.c.Key, tc.label))
+		if len(r.called) != 1 || !strings.HasPrefix(r.called[0], tc.want) {
+			t.Errorf("%s: called %v, want %s…", tc.label, r.called, tc.want)
+		}
+	}
+}
+
+func TestASilenceChosenIsTheControllersOwnAndAnAnswerToAnAsk(t *testing.T) {
+	r := newAskerRig(t)
+	r.open = []conditions.Condition{unitsCondition()}
+	_ = r.a.reconcile(context.Background())
+	w := r.warrantFor(t, "machine.shanks.units", "Silence for a week")
+	w.Level, w.Proofs = asks.Acknowledge, nil
+	w.By = &asks.Person{Who: asks.Operator, Kind: "desktop", Identity: "g14",
+		Verified: "a desk click: whoever was at the operator's session on g14"}
+	w.Channel = "desk-channel"
+	answerWith(t, r, w)
+	if len(r.called) != 0 || len(r.silenced) != 1 || !strings.HasPrefix(r.silenced[0], "machine.shanks.units for 168h0m0s by the operator, as desktop identity g14") {
+		t.Fatalf("silenced %v, called %v", r.silenced, r.called)
+	}
+	if len(r.acts) != 1 || r.acts[0].Cause != conditions.CauseOperatorAnswer || len(r.acts[0].Proofs) != 0 {
+		t.Errorf("%+v", r.acts)
+	}
+}
+
+func TestAnAskThatEndedWithoutAChoiceDoesNothing(t *testing.T) {
+	r := newAskerRig(t)
+	r.open = []conditions.Condition{heldCondition()}
+	_ = r.a.reconcile(context.Background())
+	w := r.warrantFor(t, heldCondition().Key, "Release")
+	w.Outcome, w.Option, w.Label, w.Level, w.By, w.Words = asks.OutcomeExpired, "", "", "", nil, "nobody answered in time"
+	answerWith(t, r, w)
+	if len(r.called)+len(r.acts) != 0 || r.store[w.Ask].State != string(asks.OutcomeExpired) ||
+		!strings.HasPrefix(r.store[w.Ask].Acted, "nothing") {
+		t.Errorf("called %v acts %v kept %+v", r.called, r.acts, r.store[w.Ask])
+	}
+	// And a choice for a condition that ended meanwhile does nothing either.
+	r2 := newAskerRig(t)
+	r2.open = []conditions.Condition{heldCondition()}
+	_ = r2.a.reconcile(context.Background())
+	w2 := r2.warrantFor(t, heldCondition().Key, "Release")
+	r2.open = nil
+	answerWith(t, r2, w2)
+	if len(r2.called) != 0 || r2.store[w2.Ask].Acted != "nothing: the condition ended before the answer" {
+		t.Errorf("%v %+v", r2.called, r2.store[w2.Ask])
+	}
+}
+
+func TestAWarrantMissedWhileAwayIsReadFromTheRoutersRecord(t *testing.T) {
+	r := newAskerRig(t)
+	r.open = []conditions.Condition{heldCondition()}
+	_ = r.a.reconcile(context.Background())
+	w := r.warrantFor(t, heldCondition().Key, "Stop")
+	r.a.routerRecord = func(_ context.Context, id string) (*asks.Warrant, error) {
+		if id != w.Ask {
+			return nil, errors.New("another ask")
+		}
+		return &w, nil
+	}
+	r.now = r.now.Add(askCatchUpAfter)
+	if err := r.a.reconcile(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	if len(r.called) != 1 || !strings.HasPrefix(r.called[0], "mesh-delivery.stop@") {
+		t.Errorf("called %v", r.called)
+	}
+	if n := len(r.asksSent(t)); n != 1 {
+		t.Errorf("asked again after the answer: %d", n)
+	}
+}
+
+// After review (2026-10-08): a refused ask is not asked again until its answers or the channels change.
+func TestAnAskTheRouterRefusedWaitsUntilSomethingChanges(t *testing.T) {
+	r := newAskerRig(t)
+	channels := "channel/telegram=telegram@anchor[choice]own:true"
+	r.a.channels = func(context.Context) string { return channels }
+	r.open = []conditions.Condition{heldCondition()}
+	_ = r.a.reconcile(context.Background())
+	first := r.asksSent(t)[0]
+	refusal, _ := json.Marshal(asks.Warrant{Ask: first.ID, Asker: "mesh-controller", Outcome: asks.OutcomeRefused,
+		Words: "no channel can carry any of its answers now", At: r.now})
+	if err := r.a.Decided(context.Background(), refusal); err != nil {
+		t.Fatal(err)
+	}
+	if got := r.store[first.ID]; got.State != string(asks.OutcomeRefused) || !strings.Contains(got.Acted, "nothing") {
+		t.Fatalf("the refusal was kept as %+v", got)
+	}
+	for i := 0; i < 3; i++ {
+		r.now = r.now.Add(askEvery)
+		_ = r.a.reconcile(context.Background())
+	}
+	if n := len(r.asksSent(t)); n != 1 {
+		t.Fatalf("asked again %d time(s) though nothing changed", n-1)
+	}
+	channels = "channel/telegram=telegram@anchor[choice,verified-sender]own:true"
+	_ = r.a.reconcile(context.Background())
+	if n := len(r.asksSent(t)); n != 2 {
+		t.Errorf("not asked again once the channels changed: %d", n)
+	}
+}
+
+// After review: at most three asks open at once, the most urgent first, then the oldest.
+func TestAtMostThreeAsksAreOpenTheMostUrgentFirst(t *testing.T) {
+	r := newAskerRig(t)
+	var open []conditions.Condition
+	for i := 0; i < 4; i++ {
+		c := unitsCondition()
+		c.Key = "machine.m" + string(rune('a'+i)) + ".units"
+		c.Actions = []conditions.Action{conditions.SilenceAction(c.Key)}
+		c.Raised = r.now.Add(-time.Duration(10-i) * time.Hour)
+		open = append(open, c)
+	}
+	urgent := heldCondition()
+	urgent.Severity, urgent.Raised = conditions.Urgent, r.now.Add(-time.Minute)
+	r.open = append(open, urgent)
+	_ = r.a.reconcile(context.Background())
+	sent := r.asksSent(t)
+	if len(sent) != askMostOpen || sent[0].About != urgent.Key || sent[1].About != "machine.ma.units" || sent[2].About != "machine.mb.units" {
+		var about []string
+		for _, q := range sent {
+			about = append(about, q.About)
+		}
+		t.Fatalf("asked %v", about)
+	}
+}
+
+// After review: nothing is asked while no router takes asks under the controller's name, and that is said once.
+func TestNothingIsAskedWithoutARouter(t *testing.T) {
+	r := newAskerRig(t)
+	var said []string
+	r.a.logf = func(f string, a ...any) { said = append(said, f) }
+	r.a.routerHere = func(context.Context) (bool, error) { return false, nil }
+	r.open = []conditions.Condition{heldCondition()}
+	_ = r.a.reconcile(context.Background())
+	_ = r.a.reconcile(context.Background())
+	if len(r.asksSent(t)) != 0 {
+		t.Error("asked with no router")
+	}
+	n := 0
+	for _, s := range said {
+		if strings.Contains(s, "no router takes asks") {
+			n++
+		}
+	}
+	if n != 1 {
+		t.Errorf("said %d times", n)
+	}
+}
+
+// After review: the condition's words keep where an answer is given without a channel; the ask's text does not.
+func TestTheAskDropsWhereItIsAnsweredAndTheConditionKeepsIt(t *testing.T) {
+	c := heldCondition()
+	if !strings.Contains(c.Explanation, FromMeshMCPServer) {
+		t.Fatalf("the condition lost where it is answered: %q", c.Explanation)
+	}
+	q, _ := askOf("x", c, partsOf(c)[0], time.Now())
+	if strings.Contains(q.Explanation, "mesh MCP server") || !strings.HasPrefix(q.Explanation, "Needs you: release it, or stop it.") {
+		t.Errorf("the ask says %q", q.Explanation)
+	}
+	if askApproveFor >= 24*time.Hour {
+		t.Errorf("an approving ask lasts %s, which the SDK may refuse at its bound", askApproveFor)
+	}
+}
+
+// After review (security finding 9): a warrant is acted on only for an ask open in the controller's own record,
+// once the claim stands, and never when given after the ask expired.
+func TestAWarrantIsActedOnlyForAnOpenAskItClaimsBeforeItExpired(t *testing.T) {
+	r := newAskerRig(t)
+	r.open = []conditions.Condition{heldCondition()}
+	_ = r.a.reconcile(context.Background())
+	w := r.warrantFor(t, heldCondition().Key, "Release")
+	late := w
+	late.At = r.store[w.Ask].Ask.Expires.Add(time.Minute)
+	body, _ := json.Marshal(late)
+	_ = r.a.Decided(context.Background(), body)
+	if len(r.called) != 0 {
+		t.Fatalf("acted on a warrant given after the ask expired: %v", r.called)
+	}
+	// Claimed already by another delivery: nothing done here.
+	kept := r.store[w.Ask]
+	kept.Acted = "acting"
+	r.store[w.Ask] = kept
+	body, _ = json.Marshal(w)
+	_ = r.a.Decided(context.Background(), body)
+	if len(r.called) != 0 {
+		t.Fatalf("acted though the claim was another's: %v", r.called)
+	}
+	// Cancelled in its own record: refused.
+	kept.Acted, kept.State = "", askCancelled
+	r.store[w.Ask] = kept
+	_ = r.a.Decided(context.Background(), body)
+	if len(r.called) != 0 {
+		t.Errorf("acted on a cancelled ask: %v", r.called)
+	}
+}
+
+// novox/hq ADR 0259 §6: a warrant authorises the act its option bound when the controller asked, and no
+// other. A record of the act changed after the ask — another delivery, another machine, another argument —
+// is refused and nothing is performed.
+func TestAWarrantPerformsOnlyTheActItsOptionBound(t *testing.T) {
+	for name, change := range map[string]func(*conditions.Action){
+		"another argument": func(a *conditions.Action) {
+			a.Arguments = map[string]string{"id": "novox/mesh-controller@000000000000"}
+		},
+		"another verb":    func(a *conditions.Action) { a.Verb = "mesh-delivery.stop" },
+		"another machine": func(a *conditions.Action) { a.Machine = "anchor" },
+	} {
+		t.Run(name, func(t *testing.T) {
+			r := newAskerRig(t)
+			r.open = []conditions.Condition{heldCondition()}
+			_ = r.a.reconcile(context.Background())
+			w := r.warrantFor(t, heldCondition().Key, "Release")
+			kept := r.store[w.Ask]
+			acts := append([]conditions.Action(nil), kept.Actions...)
+			i := kept.Options[w.Option]
+			change(&acts[i])
+			kept.Actions = acts
+			r.store[w.Ask] = kept
+			answerWith(t, r, w)
+			if len(r.called)+len(r.acts) != 0 {
+				t.Errorf("performed an act the option did not bind: %v %v", r.called, r.acts)
+			}
+		})
+	}
+	// Every option of an ask binds its act.
+	q, _ := askOf("x", heldCondition(), partsOf(heldCondition())[0], time.Now())
+	for _, o := range q.Options {
+		if o.Binds == "" {
+			t.Errorf("the option %s binds nothing", o.ID)
+		}
+	}
+}
+
+// Failure is loud (novox/hq ADR 0259, the self-review of 2026-10-09): a condition that needs the operator and
+// could not be asked on any channel — no router, or the router refused the ask — is a condition of its own,
+// cleared once it can be asked again.
+func TestAnAskThatCannotBeDeliveredIsSaid(t *testing.T) {
+	r := newAskerRig(t)
+	var raised [][]conditions.Observation
+	r.a.raise = func(_ context.Context, obs []conditions.Observation) error {
+		raised = append(raised, obs)
+		return nil
+	}
+	last := func() []conditions.Observation { return raised[len(raised)-1] }
+	routerHere := false
+	r.a.routerHere = func(context.Context) (bool, error) { return routerHere, nil }
+	channels := "channel/telegram=telegram@anchor[choice]own:true"
+	r.a.channels = func(context.Context) string { return channels }
+	r.open = []conditions.Condition{heldCondition()}
+
+	_ = r.a.reconcile(context.Background())
+	if got := last(); len(got) != 1 || got[0].Kind != "asks-undelivered" ||
+		!strings.Contains(got[0].Summary, heldCondition().Key) || !strings.Contains(got[0].Summary, "no router") {
+		t.Fatalf("no router, said as %+v", got)
+	}
+
+	routerHere = true
+	_ = r.a.reconcile(context.Background())
+	if got := last(); len(got) != 0 {
+		t.Fatalf("asked, and still said undelivered: %+v", got)
+	}
+	first := r.asksSent(t)[0]
+	refusal, _ := json.Marshal(asks.Warrant{Ask: first.ID, Asker: "mesh-controller", Outcome: asks.OutcomeRefused,
+		Words: "no channel can carry any of its answers now", At: r.now})
+	if err := r.a.Decided(context.Background(), refusal); err != nil {
+		t.Fatal(err)
+	}
+	_ = r.a.reconcile(context.Background())
+	if got := last(); len(got) != 1 || !strings.Contains(got[0].Summary, "no channel can carry") {
+		t.Fatalf("the router's refusal, said as %+v", got)
+	}
+	if why, ok := conditions.PlainWords(conditions.Words{Headline: last()[0].Headline, Explanation: last()[0].Explanation,
+		Needs: last()[0].Needs, Resolved: last()[0].Resolved}, ""); !ok {
+		t.Errorf("not plain: %s", why)
+	}
+	r.open = nil
+	_ = r.a.reconcile(context.Background())
+	if got := last(); len(got) != 0 {
+		t.Errorf("nothing needs asking, and still said: %+v", got)
+	}
+}
+
+// The review of 2026-10-09 (M1): an acknowledging answer never shares an ask with an authorising one. A
+// condition offering Restart and Silence is asked twice — Restart alone, about the condition, and Silence
+// alone, apart — so Silence chosen on a channel that only acknowledges leaves the Restart ask open.
+func TestAnAcknowledgementNeverSharesAnAskWithAnApproval(t *testing.T) {
+	r := newAskerRig(t)
+	key := "module.shanks.plex.down"
+	c := conditions.Condition{Key: key, Kind: "module-down", Severity: conditions.Urgent, Headline: "Plex down on shanks",
+		Explanation: "Needs you: restart it, or silence this.", Needs: "restart it, or silence this.",
+		Actions: []conditions.Action{
+			{Label: "Restart", Verb: "node-service-manager.restart", Machine: "shanks", Level: conditions.LevelApprove,
+				Arguments: map[string]string{"unit": "plex"}},
+			conditions.SilenceAction(key)}}
+	r.open = []conditions.Condition{c}
+	if err := r.a.reconcile(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	sent := r.asksSent(t)
+	if len(sent) != 2 {
+		t.Fatalf("asked %d time(s): %+v", len(sent), sent)
+	}
+	for _, q := range sent {
+		if err := q.Check(r.now); err != nil {
+			t.Errorf("%s: %v", q.About, err)
+		}
+		levels := map[asks.Level]bool{}
+		for _, o := range q.Options {
+			levels[o.Level] = true
+		}
+		if len(levels) != 1 {
+			t.Errorf("the ask about %s mixes levels: %+v", q.About, q.Options)
+		}
+	}
+	byAbout := map[string]asks.Ask{}
+	for _, q := range sent {
+		byAbout[q.About] = q
+	}
+	if q := byAbout[key]; len(q.Options) != 1 || q.Options[0].Label != "Restart" {
+		t.Errorf("the condition's own ask: %+v", q)
+	}
+	if q := byAbout[key+".acknowledge"]; len(q.Options) != 1 || q.Options[0].Level != asks.Acknowledge {
+		t.Errorf("the acknowledging ask: %+v", q)
+	}
+	// Silence chosen: performed, and the Restart ask stays open, never asked twice.
+	answerWith(t, r, r.warrantFor(t, key, "Silence for a week"))
+	if len(r.silenced) != 1 || len(r.called) != 0 {
+		t.Fatalf("silenced %v called %v", r.silenced, r.called)
+	}
+	_ = r.a.reconcile(context.Background())
+	open := 0
+	for _, a := range r.store {
+		if a.State == askOpen && a.Condition == key {
+			open++
+			if a.Part != "" || a.Ask.Options[0].Label != "Restart" {
+				t.Errorf("the open ask is %+v", a)
+			}
+		}
+	}
+	if open != 1 || len(r.asksSent(t)) != 2 {
+		t.Errorf("after the silence: %d open, %d asked", open, len(r.asksSent(t)))
+	}
+	// And the approval still answers: Restart chosen on a channel that proves who answered is performed.
+	answerWith(t, r, r.warrantFor(t, key, "Restart"))
+	if len(r.called) != 1 || !strings.HasPrefix(r.called[0], "node-service-manager.restart@shanks") {
+		t.Errorf("the approval kept through a silence was not performed: %v", r.called)
+	}
+}

cmd/mesh-controller/asker_wire.go

@@ -0,0 +1,303 @@
+package main
+
+// The asker on the bus: its asks in the controller's bucket `asked`, its asks and cancels published on the
+// seat under the controller's name, the verbs a warrant chooses called with the controller's grant, and the
+// router's record of its asks read under its name (novox/hq ADR 0259).
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/nats-io/nats.go"
+	"github.com/nats-io/nats.go/jetstream"
+
+	"git.novox.be/novox/mesh-sdk/go/asks"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// askerFrom is the serving controller's asker; nil in any other process.
+var askerFrom *asker
+
+// askWithin is how long a verb a warrant chose is given to answer.
+const askWithin = time.Minute
+
+type busAsked struct{ conn *nats.Conn }
+
+func (b busAsked) kv(ctx context.Context) (jetstream.KeyValue, error) {
+	js, err := jetstream.New(b.conn)
+	if err != nil {
+		return nil, err
+	}
+	return js.KeyValue(ctx, broker.AskedBucket)
+}
+
+func (b busAsked) Get(ctx context.Context, id string) (*asked, error) {
+	kv, err := b.kv(ctx)
+	if err != nil {
+		return nil, err
+	}
+	e, err := kv.Get(ctx, id)
+	if errors.Is(err, jetstream.ErrKeyNotFound) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	var r asked
+	return &r, json.Unmarshal(e.Value(), &r)
+}
+
+// Create keeps a new ask under its id, and only where none is kept: never over another.
+func (b busAsked) Create(ctx context.Context, r asked) error {
+	kv, err := b.kv(ctx)
+	if err != nil {
+		return err
+	}
+	body, err := json.Marshal(r)
+	if err != nil {
+		return err
+	}
+	_, err = kv.Create(ctx, r.ID, body)
+	return err
+}
+
+// Change applies change to the ask kept under id by compare-and-set on its key's revision (the review of
+// 2026-10-09, L2): read, changed, and written only over the revision read; when another write came between,
+// read again and asked again, at most askChangeTries times. change says whether to write at all.
+func (b busAsked) Change(ctx context.Context, id string, change func(*asked) bool) (bool, error) {
+	kv, err := b.kv(ctx)
+	if err != nil {
+		return false, err
+	}
+	for try := 0; try < askChangeTries; try++ {
+		e, err := kv.Get(ctx, id)
+		if errors.Is(err, jetstream.ErrKeyNotFound) {
+			return false, nil
+		}
+		if err != nil {
+			return false, err
+		}
+		var r asked
+		if err := json.Unmarshal(e.Value(), &r); err != nil {
+			return false, err
+		}
+		if !change(&r) {
+			return false, nil
+		}
+		body, err := json.Marshal(r)
+		if err != nil {
+			return false, err
+		}
+		if _, err := kv.Update(ctx, id, body, e.Revision()); err != nil {
+			var api *jetstream.APIError
+			if errors.Is(err, jetstream.ErrKeyExists) || (errors.As(err, &api) && api.ErrorCode == jetstream.JSErrCodeStreamWrongLastSequence) {
+				continue
+			}
+			return false, err
+		}
+		return true, nil
+	}
+	return false, fmt.Errorf("the ask %s changed under every one of %d tries", id, askChangeTries)
+}
+
+func (b busAsked) All(ctx context.Context) ([]asked, error) {
+	kv, err := b.kv(ctx)
+	if err != nil {
+		return nil, err
+	}
+	lister, err := kv.ListKeys(ctx)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = lister.Stop() }()
+	var out []asked
+	for k := range lister.Keys() {
+		e, err := kv.Get(ctx, k)
+		if err != nil {
+			continue
+		}
+		var r asked
+		if json.Unmarshal(e.Value(), &r) == nil {
+			out = append(out, r)
+		}
+	}
+	return out, nil
+}
+
+// callAction performs an action's verb as the controller, through the grant that names it.
+func callAction(conn *nats.Conn) func(ctx context.Context, a conditions.Action, args map[string]string) error {
+	return func(ctx context.Context, a conditions.Action, args map[string]string) error {
+		seat, verb, ok := strings.Cut(a.Verb, ".")
+		if !ok {
+			return fmt.Errorf("%q names no seat and verb", a.Verb)
+		}
+		body := map[string]any{}
+		for k, v := range args {
+			body[k] = v
+		}
+		if seat == catalogue.DeliverySeat {
+			_, err := askDeliveryOwner(ctx, conn, verb, body)
+			return err
+		}
+		granted := false
+		for _, v := range broker.VerbsTheControllerActsOnAWarrant {
+			granted = granted || (v.Seat == seat && v.Verb == verb)
+		}
+		if !granted {
+			return fmt.Errorf("%s: %w", a.Verb, errNotGranted)
+		}
+		var answer link.Answer
+		var err error
+		if a.Machine != "" {
+			answer, err = link.AskSeatTool(ctx, conn, seat, verb, a.Machine, body, askWithin)
+		} else {
+			answer, err = link.AskMeshSeatTool(ctx, conn, seat, verb, body, askWithin)
+		}
+		if err != nil {
+			return err
+		}
+		if answer.Error != "" {
+			return fmt.Errorf("%s refused: %s", a.Verb, answer.Error)
+		}
+		return nil
+	}
+}
+
+// routerRecordOf reads the router's record of one of the controller's asks, under its name, and answers
+// how it ended when it did: the bucket is the one the asks seat's declarer names as its records.
+func routerRecordOf(conn *nats.Conn, inv *inventory.Inventory) func(ctx context.Context, id string) (*asks.Warrant, error) {
+	return func(ctx context.Context, id string) (*asks.Warrant, error) {
+		bucket, err := asksRecords(ctx, inv)
+		if err != nil || bucket == "" {
+			return nil, err
+		}
+		reply, err := conn.RequestWithContext(ctx, "$JS.API.DIRECT.GET.KV_"+bucket+".$KV."+bucket+"."+askerName+"."+id, nil)
+		if err != nil {
+			return nil, err
+		}
+		if reply.Header.Get("Status") != "" {
+			return nil, nil // none, or not readable: the event says it
+		}
+		var rec struct {
+			State   string        `json:"state"`
+			Warrant *asks.Warrant `json:"warrant"`
+		}
+		if json.Unmarshal(reply.Data, &rec) != nil || rec.State == "open" || rec.Warrant == nil {
+			return nil, nil
+		}
+		return rec.Warrant, nil
+	}
+}
+
+// asksRecords is the bucket the asks seat's declarer keeps its record of asks in.
+func asksRecords(ctx context.Context, inv *inventory.Inventory) (string, error) {
+	declared, err := inv.Catalogue(ctx)
+	if err != nil {
+		return "", err
+	}
+	for _, m := range declared {
+		for _, s := range m.DefinesSeats {
+			if s.Name == broker.AsksSeat && len(s.Records) > 0 {
+				return broker.BucketName(m.Module, s.Records[0]), nil
+			}
+		}
+	}
+	return "", nil
+}
+
+// routerHereIn says whether a module declaring the asks seat, with its ask named by its caller, is assigned:
+// without it nothing takes an ask, and asking would only fill a queue nobody reads.
+func routerHereIn(inv *inventory.Inventory) func(ctx context.Context) (bool, error) {
+	return func(ctx context.Context) (bool, error) {
+		entries, err := inv.Catalogued(ctx)
+		if err != nil {
+			return false, err
+		}
+		for _, e := range entries {
+			for _, s := range e.Manifest.DefinesSeats {
+				if s.Name == broker.AsksSeat && s.NamedByCaller("ask") && len(e.On) > 0 {
+					return true, nil
+				}
+			}
+		}
+		return false, nil
+	}
+}
+
+// channelsIn is what the channels are now, as a fingerprint: each module claiming a kind of the channel
+// bench, where, promising what, and whether of its own account. An ask the router refused is asked again
+// once this changes.
+func channelsIn(inv *inventory.Inventory) func(ctx context.Context) string {
+	return func(ctx context.Context) string {
+		entries, err := inv.Catalogued(ctx)
+		if err != nil {
+			return ""
+		}
+		var parts []string
+		for _, e := range entries {
+			for _, c := range e.Manifest.Claims {
+				if c.Kind == "" || !catalogue.KindedBenches[c.Name] {
+					continue
+				}
+				on := append([]string(nil), e.On...)
+				sort.Strings(on)
+				caps := append([]string(nil), c.Capabilities...)
+				sort.Strings(caps)
+				parts = append(parts, fmt.Sprintf("%s/%s=%s@%s[%s]own:%t", c.Name, c.Kind, e.Manifest.Module,
+					strings.Join(on, ","), strings.Join(caps, ","), e.Manifest.RunsAs != ""))
+			}
+		}
+		sort.Strings(parts)
+		return strings.Join(parts, ";")
+	}
+}
+
+// startAsking makes the serving controller's asker and hands it the router's words.
+func startAsking(ctx context.Context, open *stores, server *link.Server, conn *nats.Conn, keeper *conditions.Keeper) {
+	js, err := jetstream.New(conn)
+	if err != nil {
+		fmt.Printf("the operator cannot be asked: %v\n", err)
+		return
+	}
+	a := &asker{
+		open: keeper.Open,
+		silence: func(ctx context.Context, key string, d time.Duration, by, why string) error {
+			_, err := keeper.Silence(ctx, key, d, by, why)
+			return err
+		},
+		store: busAsked{conn: conn},
+		publish: func(ctx context.Context, subject string, body []byte, id string) error {
+			_, err := js.Publish(ctx, subject, body, jetstream.WithMsgID(id))
+			return err
+		},
+		call: callAction(conn),
+		record: func(ctx context.Context, act link.HandAct) error {
+			_, err := link.RecordHandAct(ctx, conn, act)
+			return err
+		},
+		routerRecord: routerRecordOf(conn, open.inventory),
+		routerHere:   routerHereIn(open.inventory),
+		channels:     channelsIn(open.inventory),
+		raise: func(ctx context.Context, obs []conditions.Observation) error {
+			return keeper.Reconcile(ctx, sourceAsker, obs)
+		},
+		now:  time.Now,
+		logf: func(format string, args ...any) { fmt.Printf(format+"\n", args...) },
+	}
+	if err := server.Decides(a); err != nil {
+		fmt.Printf("the operator's answers cannot be heard, so nothing is asked: %v\n", err)
+		return
+	}
+	askerFrom = a
+	go a.keep(ctx)
+}

cmd/mesh-controller/awaiting_push_test.go

@@ -0,0 +1,281 @@
+package main
+
+import (
+	"errors"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/overlay"
+)
+
+// Between `assign` and `push` a module's own secrets are not made yet: the push makes them. D1 composed
+// the machine's declaration without making anything, failed on the missing secret, and raised an urgent
+// "nothing can be sent to <machine>" — seen live on 2026-10-06, a desktop notification for a machine
+// the next push sent to without a word (novox/hq issue 275). D1 now composes as the push would, with a
+// stand-in for what the push makes: pending, not broken, and said only past a bound, as a warning.
+
+// aKeeper is a module with an own secret the mesh makes — a backup repository's password.
+func aKeeper() catalogue.Manifest {
+	return catalogue.Manifest{Module: "keeper", Version: "1",
+		OwnSecrets: catalogue.OwnSecrets{"repository": {Path: "/var/lib/mesh/keeper/repository"}},
+		Resources: []map[string]any{
+			{"id": "state", "type": "directory", "path": "/var/lib/mesh/keeper", "mode": "0700"},
+		}}
+}
+
+// pushedBy records a send to a machine as a push does — composed on the send path, so its own secrets
+// are made — without a bus to carry it.
+func pushedBy(t *testing.T, open *stores, node string) string {
+	t.Helper()
+	ctx := t.Context()
+	plan, settings, err := planFor(ctx, open, node)
+	if err != nil {
+		t.Fatal(err)
+	}
+	declared, err := declarationFor(ctx, open, node, plan, settings)
+	if err != nil {
+		t.Fatal(err)
+	}
+	body, err := declared.Body()
+	if err != nil {
+		t.Fatal(err)
+	}
+	record, err := open.inventory.NodeByName(ctx, node)
+	if err != nil {
+		t.Fatal(err)
+	}
+	digest := digestOf(body)
+	if err := open.inventory.RecordSent(ctx, record.ID, digest, declared.Builds); err != nil {
+		t.Fatal(err)
+	}
+	return digest
+}
+
+// pushedAndApplied is pushedBy, and the machine reporting it applied that declaration.
+func pushedAndApplied(t *testing.T, open *stores, node string) {
+	t.Helper()
+	digest := pushedBy(t, open, node)
+	record, err := open.inventory.NodeByName(t.Context(), node)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := open.inventory.RecordDoing(t.Context(), record.ID, inventory.Doing{
+		Outcome: inventory.OutcomeApplied, Declared: digest}); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// d1 runs D1 once.
+func d1(t *testing.T, open *stores) []conditions.Observation {
+	t.Helper()
+	got, err := probeDeclarations(t.Context(), &doctor{open: open})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return got
+}
+
+// **THE WINDOW, REPRODUCED**: assigned and not pushed, a module whose own secret the push makes is
+// waiting, not uncomposable; past the bound it is a warning naming what the push makes; pushed, nothing.
+func TestAModuleAssignedAndNotPushedIsAwaitingAPushNotUncomposable(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	register(t, open, aKeeper())
+	pushedBy(t, open, "laptop") // the machine was pushed before; then the module is assigned
+	if _, err := assign(ctx, open, "laptop", "keeper"); err != nil {
+		t.Fatal(err)
+	}
+
+	// The read the rest of the mesh asks still refuses it, with the composer's typed error: nothing
+	// can be compared about a secret that does not exist (status), and nothing here string-matches.
+	plan, settings, err := planFor(ctx, open, "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	gens, err := generators(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, err = declarationWith(ctx, open, "laptop", plan, settings, gens, Reading)
+	var notMade *catalogue.NotMadeError
+	if !errors.As(err, &notMade) || notMade.Module != "keeper" || notMade.Name != "repository" {
+		t.Fatalf("a read composition did not say which secret is not made, typed: %v", err)
+	}
+	// Foreseen, it composes, names what the push makes, and made nothing.
+	foreseen, err := declarationWith(ctx, open, "laptop", plan, settings, gens, Foreseeing)
+	if err != nil || len(foreseen.foreseen) != 1 || foreseen.foreseen[0] != "keeper/repository" {
+		t.Fatalf("foreseen: %v %v", foreseen.foreseen, err)
+	}
+	if _, held, err := open.inventory.ModuleSecretIfIssued(ctx, "laptop", "keeper", "repository"); err != nil || held {
+		t.Fatalf("asking ahead of the push made the secret (held %v, %v)", held, err)
+	}
+
+	// Within the bound: nothing at all — no urgent, no warning, nobody notified.
+	if got := d1(t, open); len(got) != 0 {
+		t.Fatalf("a machine waiting for a push raised %+v", got)
+	}
+
+	// Past the bound: a warning, not urgent, saying what the push will make.
+	before := awaitingPushBound
+	awaitingPushBound = -time.Minute
+	t.Cleanup(func() { awaitingPushBound = before })
+	got := d1(t, open)
+	if len(got) != 1 || got[0].Key() != "machine.laptop.awaiting-push" || got[0].Severity != conditions.Warning ||
+		!strings.Contains(got[0].Summary, "keeper/repository") || !strings.Contains(got[0].Summary, "push laptop") {
+		t.Fatalf("a machine left un-pushed past the bound: %+v", got)
+	}
+
+	// Pushed: the secret is made and D1 says nothing.
+	pushedBy(t, open, "laptop")
+	if got := d1(t, open); len(got) != 0 {
+		t.Fatalf("a pushed machine still raised %+v", got)
+	}
+}
+
+// **A REAL FAILURE IS STILL URGENT**: a secret the push would be refused on is not one it will make.
+// A bus credential nobody issued (issue 203) fails the push, so D1 says it — urgent, in the push's words.
+func TestASecretThePushCannotMakeIsStillUncomposable(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	register(t, open, aTalker())
+	if _, err := assign(ctx, open, "laptop", "talker"); err != nil {
+		t.Fatal(err)
+	}
+	got := d1(t, open)
+	if len(got) != 1 || got[0].Key() != "machine.laptop.uncomposable" || got[0].Severity != conditions.Urgent ||
+		!strings.Contains(got[0].Summary, "module issue talker --node laptop") {
+		t.Fatalf("a push that will be refused was not said urgently: %+v", got)
+	}
+
+	// And a machine whose composition fails for anything else, with a secret waiting beside it, is
+	// uncomposable for that — the stand-in hides nothing.
+	register(t, open, aKeeper())
+	if _, err := assign(ctx, open, "anchor", "keeper"); err != nil {
+		t.Fatal(err)
+	}
+	one, two := rivals()
+	register(t, open, one)
+	register(t, open, two)
+	_, _ = assign(ctx, open, "anchor", "rival-one")
+	_, _ = assign(ctx, open, "anchor", "rival-two")
+	keys := map[string]conditions.Severity{}
+	for _, o := range d1(t, open) {
+		keys[o.Key()] = o.Severity
+	}
+	if keys["machine.anchor.uncomposable"] != conditions.Urgent {
+		t.Fatalf("a real failure beside a waiting secret: %v", keys)
+	}
+}
+
+// A given secret sealed to a key the machine no longer has is not the mesh's to make again: the push is
+// refused on it, so D1 is too.
+func TestAGivenSecretUnderAnOldKeyIsNotForeseen(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	register(t, open, aKeeper())
+	if _, err := assign(ctx, open, "laptop", "keeper"); err != nil {
+		t.Fatal(err)
+	}
+	if err := open.inventory.AcceptSecretForModule(ctx, "laptop", "keeper", "repository", "given"); err != nil {
+		t.Fatal(err)
+	}
+	record, err := open.inventory.NodeByName(ctx, "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := open.inventory.RecordSealingKey(ctx, record.ID, aPublicKey(t)); err != nil {
+		t.Fatal(err)
+	}
+	got := d1(t, open)
+	if len(got) != 1 || got[0].Key() != "machine.laptop.uncomposable" || !strings.Contains(got[0].Summary, "issue it again") {
+		t.Fatalf("a given secret under an old key: %+v", got)
+	}
+}
+
+// The bound is read from when the machine began waiting: the oldest assignment since its last send.
+func TestAMachineAwaitsAPushSinceItsOldestAssignmentSinceTheLastSend(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	register(t, open, aKeeper())
+	pushedBy(t, open, "laptop")
+	sent := time.Now()
+	since, err := open.inventory.AwaitingSince(ctx, "laptop")
+	if err != nil || since.After(sent) {
+		t.Fatalf("nothing assigned since the send: waiting since %v (%v), the send was before %v", since, err, sent)
+	}
+	if _, err := assign(ctx, open, "laptop", "keeper"); err != nil {
+		t.Fatal(err)
+	}
+	since, err = open.inventory.AwaitingSince(ctx, "laptop")
+	if err != nil || since.Before(sent.Add(-time.Second)) {
+		t.Fatalf("assigned after the send: waiting since %v (%v), not from the assignment", since, err)
+	}
+}
+
+// **D3 AND D13 WAIT FOR THE SEND**: a holder is expected to answer on a machine once the machine was sent
+// it and had time to report — never between assign and push.
+func TestAHolderIsExpectedOnlyOnceSentAndReported(t *testing.T) {
+	now := time.Now()
+	sent := now.Add(-time.Minute)
+	long := now.Add(-time.Hour)
+	cases := []struct {
+		name string
+		send lastSend
+		want bool
+	}{
+		{"never sent", lastSend{}, false},
+		{"sent without it", lastSend{sent: &long, current: true, carried: map[string]string{"other": "c"}}, false},
+		{"sent with it, not reported yet", lastSend{sent: &sent, carried: map[string]string{"keeper": "c"}}, false},
+		{"sent with it and reported", lastSend{sent: &sent, current: true, carried: map[string]string{"keeper": "c"}}, true},
+		{"sent with it long ago, never reported", lastSend{sent: &long, carried: map[string]string{"keeper": "c"}}, true},
+		{"sent before builds were kept", lastSend{sent: &long, current: true}, true},
+	}
+	for _, c := range cases {
+		if got := c.send.settled("keeper", now); got != c.want {
+			t.Errorf("%s: settled %v, want %v", c.name, got, c.want)
+		}
+	}
+}
+
+// And through the stores: assigned, not in the last send; pushed and reported, carried and settled.
+func TestALastSendIsReadFromTheSendAndTheReport(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	register(t, open, aKeeper())
+	pushedBy(t, open, "laptop")
+	if _, err := assign(ctx, open, "laptop", "keeper"); err != nil {
+		t.Fatal(err)
+	}
+	sends, err := readDeliveries(ctx, open.inventory)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if sends["laptop"].settled("keeper", time.Now()) {
+		t.Fatal("a holder assigned and not pushed is expected to answer")
+	}
+	if !sends["laptop"].settled(overlay.Name, time.Now().Add(time.Hour)) {
+		t.Fatal("a module the machine was sent long ago is not expected to answer")
+	}
+	pushedBy(t, open, "laptop")
+	sends, err = readDeliveries(ctx, open.inventory)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if sends["laptop"].settled("keeper", time.Now()) {
+		t.Fatal("pushed a moment ago and not reported, a holder is already expected")
+	}
+	if !sends["laptop"].settled("keeper", time.Now().Add(reportGrace+time.Minute)) {
+		t.Fatal("pushed past the grace, a holder is not expected")
+	}
+	if _, ok := sends["laptop"].carried["keeper"]; !ok {
+		t.Fatalf("the send's builds do not carry keeper: %v", sends["laptop"].carried)
+	}
+	pushedAndApplied(t, open, "laptop")
+	if sends, err = readDeliveries(ctx, open.inventory); err != nil || !sends["laptop"].settled("keeper", time.Now()) {
+		t.Fatalf("pushed and reported applied, a holder is not expected to answer (%v)", err)
+	}
+}

cmd/mesh-controller/bindings.go

@@ -0,0 +1,140 @@
+package main
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/conditions"
+)
+
+// A binding to data moves only by a person (novox/hq ADR 0232, issue 273).
+//
+// The resolver keeps each consumer of a provision that keeps its data at the provider it was last
+// sent (catalogue/bound.go) and says what it would have moved. This is where that is said: on the
+// push that composed it, and by the self-check's D12 every run, as an urgent condition naming the
+// consumer, both providers and the pin that confirms the move.
+
+// The condition kinds of D12.
+const (
+	// kindBindingKept is a move the resolver refused: the consumer is still where its data is.
+	kindBindingKept = "binding-kept"
+	// kindBindingMoved is a consumer about to be sent another provider than the one on record with
+	// no pin naming it — what the resolver exists to make impossible, said if it ever is not.
+	kindBindingMoved = "binding-moved"
+	// kindBindingMoving is a move a pin asked for, not yet sent: a person's act, said so that the
+	// data is moved before the push that carries it.
+	kindBindingMoving = "binding-moving"
+)
+
+// probeBindingsID is the self-check's id for this probe, and the source of what it raises.
+const probeBindingsID = "D12"
+
+// keptObservation is the urgent condition for one refused move.
+func keptObservation(k catalogue.KeptBinding) conditions.Observation {
+	return conditions.Observation{Scope: conditions.ScopeMachine, ID: bindingID(k.Machine, k.Consumer, k.Provision),
+		Token: kindBindingKept, Kind: kindBindingKept, Machine: k.Machine, Also: otherMachines(k.Machine, k.Bound.Node, k.Would.Node),
+		Severity: conditions.Urgent, Resolver: conditions.ResolverOperator,
+		Summary: fmt.Sprintf("on %s, the mesh %s", k.Machine, k.String())}
+}
+
+func bindingID(machine, consumer, provision string) string {
+	return machine + "." + consumer + "." + provision
+}
+
+func otherMachines(machine string, nodes ...string) []string {
+	var out []string
+	seen := map[string]bool{machine: true}
+	for _, n := range nodes {
+		if n != "" && !seen[n] {
+			seen[n] = true
+			out = append(out, n)
+		}
+	}
+	return out
+}
+
+// reportKept says every move a machine's resolution refused, on the push composing it, and raises its
+// condition at once where this process keeps the conditions: a push is when a person is looking.
+func reportKept(ctx context.Context, plan catalogue.Resolution) {
+	for _, k := range plan.Kept {
+		fmt.Printf("%s: the mesh %s\n", plan.Node, k)
+		if conditionsFrom != nil {
+			o := keptObservation(k)
+			o.Source = probeBindingsID
+			if _, err := conditionsFrom.Observe(ctx, o); err != nil {
+				fmt.Printf("%s: and the condition for it could not be raised: %v\n", plan.Node, err)
+			}
+		}
+	}
+}
+
+// probeBindings is D12: every consumer of a provision that keeps its data is bound where it was last
+// sent, on every machine — the resolver kept it there (said, urgent, until a person pins), or a pin
+// moves it (said, so the data goes first), and never anything else.
+func probeBindings(ctx context.Context, d *doctor) ([]conditions.Observation, error) {
+	inv := d.open.inventory
+	nodes, err := inv.Nodes(ctx)
+	if err != nil {
+		return nil, err
+	}
+	var out []conditions.Observation
+	for _, n := range nodes {
+		plan, _, err := planFor(ctx, d.open, n.Name)
+		if err != nil {
+			if unresolvable(err) {
+				// D1 says it, with the binding that refused it when that is why.
+				continue
+			}
+			return nil, fmt.Errorf("%s cannot be worked out: %w", n.Name, err)
+		}
+		bound, err := inv.BindingsFor(ctx, n.Name)
+		if err != nil {
+			return nil, err
+		}
+		pins, err := inv.PinsFor(ctx, n.Name)
+		if err != nil {
+			return nil, err
+		}
+		out = append(out, bindingFindings(plan, bound, pins)...)
+	}
+	return out, nil
+}
+
+// bindingFindings is what one machine's resolution says against its record.
+func bindingFindings(plan catalogue.Resolution, bound map[string]map[string]catalogue.Chosen,
+	pins map[string]catalogue.Chosen) []conditions.Observation {
+	var out []conditions.Observation
+	for _, k := range plan.Kept {
+		out = append(out, keptObservation(k))
+	}
+	said := map[string]bool{}
+	for _, need := range plan.Needs {
+		if !need.KeepsData || need.ByRecord {
+			continue
+		}
+		was, recorded := bound[need.For][need.Name]
+		now := catalogue.Chosen{Node: need.From, Module: need.Module}
+		if !recorded || was == now || (was.Module == "" && was.Node == now.Node) {
+			continue
+		}
+		id := bindingID(plan.Node, need.For, need.Name)
+		if said[id] {
+			continue
+		}
+		said[id] = true
+		o := conditions.Observation{Scope: conditions.ScopeMachine, ID: id, Machine: plan.Node,
+			Also: otherMachines(plan.Node, was.Node, now.Node), Resolver: conditions.ResolverOperator}
+		if pin, pinned := pins[need.Name]; pinned && pin.Node == now.Node && (pin.Module == "" || pin.Module == now.Module) {
+			o.Token, o.Kind, o.Severity = kindBindingMoving, kindBindingMoving, conditions.Warning
+			o.Summary = fmt.Sprintf("on %s, %s's %s moves from %s to %s at the next push, by the pin — its data "+
+				"is on %s: move it first", plan.Node, need.For, need.Name, was, now, was)
+		} else {
+			o.Token, o.Kind, o.Severity = kindBindingMoved, kindBindingMoved, conditions.Urgent
+			o.Summary = fmt.Sprintf("on %s, %s's %s would be sent %s, and it is bound to %s, where its data is, "+
+				"with no pin naming %s — a move nothing asked for", plan.Node, need.For, need.Name, now, was, now)
+		}
+		out = append(out, o)
+	}
+	return out
+}

cmd/mesh-controller/bindings_test.go

@@ -0,0 +1,183 @@
+package main
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/conditions"
+)
+
+// novox/hq issue 273, ADR 0232: a consumer of a provision that keeps its data moves only by a pin.
+
+func storeManifests() []catalogue.Manifest {
+	return []catalogue.Manifest{
+		{Module: "store", Version: "1",
+			Provides: []catalogue.Offer{{Name: "postgres-database", Scope: catalogue.ScopeMesh}},
+			Claims:   []catalogue.Claim{{Name: "mesh-store", Scope: catalogue.ScopeMesh}},
+			Serves:   map[string]map[string]any{"postgres-database": {"port": 5432}},
+			Grants:   map[string]string{"postgres-database": "/var/lib/mesh/store/grants"}},
+		{Module: "resolver", Version: "1",
+			Provides: []catalogue.Offer{{Name: "wildcard-resolution", Scope: catalogue.ScopeMesh}},
+			Claims:   []catalogue.Claim{{Name: "mesh-dns-resolver", Scope: catalogue.ScopeMesh}}},
+		{Module: "network", Version: "1", Requires: []string{"wildcard-resolution"}},
+		{Module: "board", Version: "1", Requires: []string{"postgres-database"}},
+	}
+}
+
+func need(t *testing.T, plan catalogue.Resolution, consumer, provision string) catalogue.Needed {
+	t.Helper()
+	for _, n := range plan.Needs {
+		if n.For == consumer && n.Name == provision {
+			return n
+		}
+	}
+	t.Fatalf("no %s for %s: %+v", provision, consumer, plan.Needs)
+	return catalogue.Needed{}
+}
+
+// The incident through the stores: the laptop runs its own store and a consumer of it, the anchor's
+// store holds the mesh's seat. The consumer stays beside its data, the resolver follows its seat, the
+// binding is recorded as sent, and a pin — only a pin — moves it, said before the push that carries it.
+func TestTheIncidentAConsumerStaysBesideItsDataUntilAPersonPinsIt(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	if _, err := inv.SeedSeats(ctx, catalogue.DefaultSeats()); err != nil {
+		t.Fatal(err)
+	}
+	for _, m := range storeManifests() {
+		register(t, open, m)
+	}
+	assignAll := func(pairs ...[2]string) {
+		for _, a := range pairs {
+			if _, err := assign(ctx, open, a[0], a[1]); err != nil {
+				t.Fatalf("assign %s %s: %v", a[0], a[1], err)
+			}
+		}
+	}
+	// The anchor's store and resolver hold the mesh's seats, on record; the laptop runs its own of each.
+	assignAll([2]string{"anchor", "store"}, [2]string{"anchor", "resolver"})
+	for _, seat := range [][2]string{{"mesh-store", "store"}, {"mesh-dns-resolver", "resolver"}} {
+		if err := inv.HoldSeat(ctx, seat[0], catalogue.ScopeMesh, "anchor", seat[1]); err != nil {
+			t.Fatal(err)
+		}
+	}
+	assignAll([2]string{"laptop", "store"}, [2]string{"laptop", "resolver"}, [2]string{"laptop", "network"},
+		[2]string{"laptop", "board"})
+
+	plan, _, err := planFor(ctx, open, "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if n := need(t, plan, "board", "postgres-database"); n.From != "laptop" || n.Module != "store" || !n.KeepsData {
+		t.Fatalf("the consumer was bound to %s/%s (keeps data: %v); its data is beside it", n.From, n.Module, n.KeepsData)
+	}
+	if n := need(t, plan, "network", "wildcard-resolution"); n.From != "anchor" || n.KeepsData {
+		t.Fatalf("the resolver was bound to %s (keeps data: %v); its seat is held on anchor (issue 258)", n.From, n.KeepsData)
+	}
+
+	// Sent, and recorded: only the binding to data.
+	bindings := boundToData(plan, nil)
+	if len(bindings) != 1 || bindings[0].Provider != (catalogue.Chosen{Node: "laptop", Module: "store"}) {
+		t.Fatalf("recorded %+v", bindings)
+	}
+	if err := inv.RecordBindings(ctx, "laptop", bindings); err != nil {
+		t.Fatal(err)
+	}
+	if found, err := probeBindings(ctx, &doctor{open: open}); err != nil || len(found) != 0 {
+		t.Fatalf("a mesh bound where it was sent: %+v, %v", found, err)
+	}
+
+	// The laptop's store taken away: refused, not moved to the anchor's empty one.
+	if err := inv.Unassign(ctx, "laptop", "store"); err != nil {
+		t.Fatal(err)
+	}
+	if _, _, err := planFor(ctx, open, "laptop"); err == nil || !unresolvable(err) ||
+		!strings.Contains(err.Error(), "board on laptop is bound to laptop/store") ||
+		!strings.Contains(err.Error(), "pin laptop postgres-database anchor store") {
+		t.Fatalf("the consumer's store went and it was answered elsewhere: %v", err)
+	}
+
+	// A person pins the anchor's: it moves, said before it is sent, and the record keeps where it was.
+	if err := inv.PinProvision(ctx, "laptop", "postgres-database", "anchor", "store"); err != nil {
+		t.Fatal(err)
+	}
+	plan, _, err = planFor(ctx, open, "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if n := need(t, plan, "board", "postgres-database"); n.From != "anchor" {
+		t.Fatalf("pinned to the anchor and bound to %s", n.From)
+	}
+	found, err := probeBindings(ctx, &doctor{open: open})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(found) != 1 || found[0].Kind != kindBindingMoving || found[0].Severity != conditions.Warning ||
+		!strings.Contains(found[0].Summary, "board's postgres-database moves from laptop/store to anchor/store") {
+		t.Fatalf("a pinned move is not said before it is sent: %+v", found)
+	}
+	if err := inv.RecordBindings(ctx, "laptop", boundToData(plan, nil)); err != nil {
+		t.Fatal(err)
+	}
+	all, err := inv.Bindings(ctx)
+	if err != nil || len(all) != 1 || all[0].MovedFrom != "laptop/store" {
+		t.Fatalf("%+v, %v", all, err)
+	}
+	if found, err := probeBindings(ctx, &doctor{open: open}); err != nil || len(found) != 0 {
+		t.Fatalf("a move sent is still said: %+v, %v", found, err)
+	}
+}
+
+// What one machine's resolution says against its record.
+func TestBindingFindingsSayAKeptMoveAndAMoveNothingAskedFor(t *testing.T) {
+	home, anchor := catalogue.Chosen{Node: "home", Module: "store"}, catalogue.Chosen{Node: "anchor", Module: "store"}
+	plan := catalogue.Resolution{Node: "laptop",
+		Kept: []catalogue.KeptBinding{{Machine: "laptop", Consumer: "board", Provision: "postgres-database",
+			Bound: home, Would: anchor}},
+		Needs: []catalogue.Needed{
+			{Name: "postgres-database", For: "board", From: "home", Module: "store", KeepsData: true},
+			{Name: "postgres-database", For: "game", From: "anchor", Module: "store", KeepsData: true},
+			{Name: "wildcard-resolution", For: "network", From: "anchor", Module: "resolver"},
+		}}
+	bound := map[string]map[string]catalogue.Chosen{
+		"board":   {"postgres-database": home},
+		"game":    {"postgres-database": home},
+		"network": {"wildcard-resolution": {Node: "home", Module: "resolver"}},
+	}
+	found := linted(bindingFindings(plan, bound, nil))
+	if len(found) != 2 {
+		t.Fatalf("found %+v", found)
+	}
+	kept, moved := found[0], found[1]
+	if kept.Kind != kindBindingKept || kept.Severity != conditions.Urgent || kept.Machine != "laptop" ||
+		!strings.Contains(kept.Summary, "would move board's postgres-database from home/store to anchor/store") ||
+		!strings.Contains(kept.Summary, "its data is on home/store") ||
+		!strings.Contains(kept.Summary, "`pin laptop postgres-database anchor store` to confirm a move (and move the data first)") {
+		t.Errorf("kept: %+v", kept)
+	}
+	if moved.Kind != kindBindingMoved || moved.Severity != conditions.Urgent ||
+		!strings.Contains(moved.Summary, "game's postgres-database would be sent anchor/store") {
+		t.Errorf("moved: %+v", moved)
+	}
+	if kept.Key() == moved.Key() {
+		t.Error("two consumers, one condition")
+	}
+}
+
+// A push says the move it refused, and raises its condition at once.
+func TestAPushSaysAKeptMoveAndRaisesItsCondition(t *testing.T) {
+	k, _ := withConditionsInMemory(t)
+	reportKept(t.Context(), catalogue.Resolution{Node: "laptop", Kept: []catalogue.KeptBinding{{Machine: "laptop",
+		Consumer: "board", Provision: "postgres-database", Bound: catalogue.Chosen{Node: "home", Module: "store"},
+		Would: catalogue.Chosen{Node: "anchor", Module: "store"}}}})
+	open, err := k.Open(t.Context())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(open) != 1 || open[0].Kind != kindBindingKept || open[0].Severity != conditions.Urgent ||
+		open[0].Source != probeBindingsID {
+		t.Fatalf("raised %+v", open)
+	}
+}

cmd/mesh-controller/build.go

@@ -6,7 +6,9 @@ import (
 	"errors"
 	"flag"
 	"fmt"
+	"github.com/novox/mesh-controller/internal/conditions"
 	"os"
+	"slices"
 	"strings"
 	"time"
 
@@ -147,10 +149,20 @@ func buildFrom(result link.BuildResult) inventory.Build {
 		// be, for exactly the modules it needs most. Keeping them is what makes a replay able to
 		// rebuild the graph rather than a list of names.
 		Path: result.Path,
+		// What it was made from (novox/hq issue 280): two builds with one are one build.
+		SourceFingerprint: result.SourceFingerprint,
+	}
+	// When it was asked, which is what orders it against another build of the same module
+	// (novox/hq 04-ISSUES/219) — not when it was heard.
+	if asked, ok := link.BuildAskedAt(result.ID); ok {
+		kept.Asked = asked
 	}
 	for _, ref := range result.Against {
 		kept.Against = append(kept.Against, catalogue.Recorded(ref))
 	}
+	for _, ref := range result.Mirrored {
+		kept.Mirrored = append(kept.Mirrored, catalogue.Recorded(ref))
+	}
 	for _, r := range result.Read {
 		kept.Read = append(kept.Read, inventory.ReadRepository{Repository: r.Repository, Ref: r.Ref})
 	}
@@ -387,34 +399,85 @@ func buildBehind(ctx context.Context, wait time.Duration) error {
 //
 // Separated from the command so `--behind` can walk a list without a second path to the same act.
 func buildOne(ctx context.Context, source buildSource, path, ref string, wait time.Duration) error {
+	_, err := buildOneAsked(ctx, source, path, ref, wait, false, "build")
+	return err
+}
+
+// recordAsked keeps a build request once it is asked (novox/hq issue 325), with who asked it, in a store
+// opened for the purpose: the asks reach here from processes that hold none.
+func recordAsked(ctx context.Context, r inventory.BuildRequest) {
+	open, err := openStores(ctx)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "build %s is asked and not kept as a build request: %v\n", r.ID, err)
+		return
+	}
+	defer open.Close()
+	recordBuildRequest(ctx, open.inventory, r)
+}
+
+// markWaitFailed says what became of a kept build request whose waited ask failed: never handed over, so
+// nothing runs; or handed over and no longer waited for, so asked with its outcome unknown — still read as in
+// flight until its outcome or its bound (novox/hq issue 325).
+func markWaitFailed(ctx context.Context, id string, why error) {
+	open, err := openStores(ctx)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "build %s could not be marked: %v\n", id, err)
+		return
+	}
+	defer open.Close()
+	mark := open.inventory.MarkOutcomeUnknown
+	if errors.Is(why, link.ErrNotHandedOver) {
+		mark = open.inventory.MarkNotAsked
+	}
+	if err := mark(ctx, id, why.Error()); err != nil {
+		fmt.Fprintf(os.Stderr, "build %s could not be marked: %v\n", id, err)
+	}
+}
+
+// buildOneAsked is buildOne answering the id it asked with — what a plan keeps to match the outcome
+// by (novox/hq ADR 0219) — and, for an ask not waited for, optionally a dry run: built and looked
+// at, never taken in (issue 240), which is what `replay` asks unless told to register.
+//
+// asker is who asked, for the build request kept once the ask is made (novox/hq issue 325); empty for an
+// asker that keeps the request itself, with its own name, once it knows the ask was made.
+func buildOneAsked(ctx context.Context, source buildSource, path, ref string, wait time.Duration,
+	dryRun bool, asker string) (string, error) {
+	if dryRun && wait != 0 {
+		return "", errors.New("a dry run waited for is `build --dry-run`")
+	}
 	// Before anything is asked of a builder: a source on a seat nobody holds is refused here, with
 	// the reason, rather than sent to a machine to fail at `git clone`.
 	repository, err := cloneFrom(ctx, source)
 	if err != nil {
-		return err
+		return "", err
+	}
+	// Through a verb, only a repository the catalogue builds from (novox/hq ADR 0266).
+	if err := verbMayAsk(ctx, source, repository); err != nil {
+		return "", err
 	}
 
 	ident, err := openIdentity(ctx)
 	if err != nil {
-		return err
+		return "", err
 	}
 	defer ident.Close()
 
 	server, err := connectLink(ctx, nil, nil, nil)
 	if err != nil {
-		return err
+		return "", err
 	}
 	defer server.Close()
 
 	// Correlated by something the control plane makes, not by the module's name: two builds of one
 	// module can be in flight, and the second answer is not the first one's.
 	request := link.BuildRequest{
-		ID:         fmt.Sprintf("%s-%d", "build", time.Now().UnixNano()),
+		ID:         link.NewBuildID(time.Now()),
 		Repository: repository,
 		Path:       path,
 		Ref:        ref,
 		Held:       heldBy(ctx),
 		Seats:      seatBases(ctx),
+		DryRun:     dryRun,
 	}
 	fmt.Printf("asked for %s", source)
 	if source.Seat != "" {
@@ -430,11 +493,21 @@ func buildOne(ctx context.Context, source buildSource, path, ref string, wait ti
 	}
 	fmt.Println()
 
-	ask, err := askOver(server)
+	seat := buildSeatHeld(ctx)
+	ask, err := askOverOn(seat)
 	if err != nil {
-		return err
+		return "", err
 	}
 	defer ask.Close()
+	fmt.Printf("  of %s\n", seat)
+	// Kept once it is asked, so `assign` knows a module is coming while its build runs (novox/hq issue 325);
+	// never before, so an ask that failed never reads as a build in flight. A dry run registers nothing, and
+	// is not kept.
+	keep := !dryRun && asker != ""
+	// Asked at the terminal is what lets its outcome register a module from a repository the catalogue does
+	// not build it from (novox/hq ADR 0266); never through a verb.
+	asked := inventory.BuildRequest{ID: request.ID, Repository: source.Repository, Seat: source.Seat, Path: path,
+		Ref: ref, For: asker, AtTerminal: startedAtTheTerminal()}
 
 	if wait == 0 {
 		// Asked and not waited for (novox/hq issue 176): the outcome is the role's event, and the
@@ -442,26 +515,46 @@ func buildOne(ctx context.Context, source buildSource, path, ref string, wait ti
 		// is still here. A tool call cannot hold a connection for the minutes a build takes; it
 		// follows the build by its id instead.
 		if err := ask.Ask(ctx, request); err != nil {
-			return err
+			return "", err
+		}
+		if keep {
+			recordAsked(ctx, asked)
+		}
+		if dryRun {
+			fmt.Printf("asked as a dry run, not waited for: `builds --log %s` follows it as it runs; "+
+				"its outcome is not taken in\n", request.ID)
+			return request.ID, nil
 		}
 		fmt.Printf("asked, not waited for: `builds --log %s` follows it as it runs, and `builds` "+
 			"shows what came of it; the module is registered when the outcome comes\n", request.ID)
-		return nil
+		return request.ID, nil
 	}
 
+	// Waited for: kept while it is waited for, since that can take minutes, and marked when the hand-over
+	// failed (not asked) or the wait did (asked, outcome unknown) — an outcome heard later is the last word.
+	if keep {
+		recordAsked(ctx, asked)
+	}
 	result, err := ask.Submit(ctx, request, wait)
 	if err != nil {
-		return err
+		if keep {
+			markWaitFailed(ctx, request.ID, err)
+		}
+		return request.ID, err
 	}
 
 	open, err := openStores(ctx)
 	if err != nil {
-		return err
+		return request.ID, err
 	}
 	defer open.Close()
 	manifest, kept, err := takeIn(ctx, open.inventory, result)
+	// The assignments pending on this build, made or ended (novox/hq issue 325).
+	for _, line := range settlePendingOnBuild(ctx, open, result, manifest.Module, err) {
+		fmt.Printf("  %s\n", line)
+	}
 	if err != nil {
-		return err
+		return request.ID, err
 	}
 	// Said as recorded: what each artifact is, not where this builder happened to push it.
 	for _, made := range kept.Made {
@@ -471,7 +564,7 @@ func buildOne(ctx context.Context, source buildSource, path, ref string, wait ti
 		manifest.Module, manifest.Version, result.On, short(result.Commit))
 	saysWhenThePolicyActs(ctx, open.inventory, manifest.Module)
 	fmt.Printf("  run `assign <node> %s` to put it somewhere\n", manifest.Module)
-	return nil
+	return request.ID, nil
 }
 
 // saysWhenThePolicyActs tells whoever built a module that its upgrade policy will send the
@@ -524,26 +617,136 @@ func takeIn(ctx context.Context, inv *inventory.Inventory, result link.BuildResu
 		BuiltFrom: result.Commit, Head: result.Commit,
 		// What it stood on, so registration can judge a built manifest's base (to-be 38 WP2.4).
 		Against: kept.Against,
+		// When it was asked, so an older request heard later does not replace a newer one
+		// (novox/hq 04-ISSUES/219).
+		Asked: kept.Asked,
 	}
 	if result.Source != nil && result.Source.Seat != "" {
 		recorded.Repository, recorded.Seat = result.Source.Repository, result.Source.Seat
 	}
+	// **A build at a commit does not change the branch a module follows** (novox/hq 04-ISSUES/215):
+	// the commit is built and recorded as what it was built from, and the module keeps following
+	// what it followed before — the repository's default branch for one new to the catalogue.
+	if followedBranch(result.Ref) == "" && result.Ref != "" {
+		recorded.Ref = ""
+		if was, err := inv.SourceOf(ctx, manifest.Module); err == nil {
+			recorded.Ref = followedBranch(was.Ref)
+		}
+	}
 	if err := namesNoInstallation(manifest); err != nil {
 		return manifest, kept, fmt.Errorf("%s built %s (%s), and the mesh does not register it: %w",
 			result.On, result.Repository, short(result.Commit), err)
 	}
+	// **Only from the repository the catalogue builds the module from** (novox/hq ADR 0266): else the trunk
+	// below is the trunk of whatever repository was built, which may be one an agent made — and a module named
+	// `sudo` from it would be what the next push sends. Another repository is the operator's, at the terminal.
+	trunk := result.Trunk
+	if was, err := inv.SourceOf(ctx, manifest.Module); err == nil && followedBranch(was.Ref) != "" {
+		trunk = followedBranch(was.Ref)
+	}
+	if trunk == "" {
+		trunk = "main"
+	}
+	repoID, err := mayRegisterFrom(ctx, inv, manifest.Module, recorded, result.ID, result.Path, trunk)
+	if err != nil {
+		return manifest, kept, fmt.Errorf("%s built %s (%s), recorded and not registered: %w", result.On,
+			manifest.Module, short(result.Commit), err)
+	}
+	// **Only a commit on the trunk is published** (novox/hq ADR 0238): a commit off its repository's
+	// default branch — a pull request's head, a feature branch built by hand, a `rebuild` or `replay
+	// --register` of one — is for checking, and is never a module's version; nothing could then send it.
+	// The branch the module already follows is its trunk — never the branch a build was asked at, or a
+	// build of a feature branch by name would make that branch its trunk.
+	follows := ""
+	if was, err := inv.SourceOf(ctx, manifest.Module); err == nil {
+		follows = followedBranch(was.Ref)
+	}
+	if err := publishable(result, follows); err != nil {
+		return manifest, kept, fmt.Errorf("%s built %s (%s), recorded and not registered: %w", result.On,
+			manifest.Module, short(result.Commit), err)
+	}
+	// **A build that failed its gate is never registered again** (novox/hq ADR 0236): an outcome heard
+	// twice, or replayed, would otherwise make the build a rollback put back what the module is again,
+	// and the next push would send it.
+	if failed, err := inv.GateFailed(ctx, kept.ID); err != nil {
+		return manifest, kept, err
+	} else if failed {
+		return manifest, kept, fmt.Errorf("%s built %s (%s), which failed its gate on its first machine and was put "+
+			"back: it is recorded and not registered again — a newer build is", result.On, manifest.Module,
+			short(result.Commit))
+	}
+	// **A build whose source is unchanged is never a move** (novox/hq issue 280): a rebuild made from
+	// what the build the mesh stands on was made from registers that build's artifacts at the new
+	// commit, so no machine is sent a new digest for a source nobody changed — an image is not
+	// byte-reproducible, and the bus rebuilt for another module's merge demanded a planned upgrade.
+	if kept.SourceFingerprint != "" {
+		stands, raw, err := inv.StandingBuild(ctx, manifest.Module, kept.ID)
+		if err != nil {
+			return manifest, kept, err
+		}
+		if stands != "" && stands != kept.ID && len(raw) > 0 {
+			if same, err := catalogue.ParseManifest(raw); err == nil && same.Module == manifest.Module {
+				fmt.Printf("%s at %s was made from the source %s was: registered with its artifacts, no move\n",
+					manifest.Module, short(result.Commit), stands)
+				manifest = same
+			}
+		}
+	}
 	if err := inv.RegisterModule(ctx, manifest, recorded); err != nil {
+		if errors.Is(err, inventory.ErrSuperseded) {
+			return manifest, kept, fmt.Errorf("%s built %s (%s), recorded and not registered: %w",
+				result.On, manifest.Module, short(result.Commit), err)
+		}
 		return manifest, kept, err
 	}
+	// Which repository it is registered from, by the forge's own id (novox/hq ADR 0266).
+	if err := inv.SetSourceIdentity(ctx, manifest.Module, repoID); err != nil {
+		return manifest, kept, err
+	}
+	// The keep set just moved, and new bytes just landed (novox/hq ADR 0189). Asked here rather
+	// than on a timer of its own: this is the only moment either is true. Never fatal — the build
+	// worked and the module is registered.
+	collect(ctx, inv)
 	return manifest, kept, nil
 }
 
+// errOffTheTrunk is a build of a commit off its repository's trunk, which is never published.
+var errOffTheTrunk = errors.New("the commit is not on its repository's trunk: a commit off the trunk is checked, " +
+	"never published (ADR 0238) — merge it, and the merge builds it")
+
+// publishable says whether a build's outcome may become a module's version: its commit on the module's
+// trunk, as the build seat read the forge at the build — the branch the module follows when its source
+// names one, else its repository's default branch. A build seat that could not say — one older than the
+// rule, building its own successor — is let through and said, so the rule can reach the mesh.
+func publishable(result link.BuildResult, follows string) error {
+	if result.Check != nil || result.Checked != nil || result.DryRun {
+		return errors.New("a check or a dry run is never published")
+	}
+	if result.Trunk == "" {
+		fmt.Printf("%s: the build seat did not say whether %s is on its repository's trunk (it predates ADR 0238); "+
+			"registered as before\n", result.ID, short(result.Commit))
+		return nil
+	}
+	trunk := result.Trunk
+	if follows != "" {
+		trunk = follows
+	}
+	on := slices.Contains(result.Branches, trunk) || (trunk == result.Trunk && result.OnTrunk)
+	if !on {
+		return fmt.Errorf("%w (%s is not on %s)", errOffTheTrunk, short(result.Commit), trunk)
+	}
+	return nil
+}
+
 // buildAndShow builds and prints the manifest without recording anything.
 func buildAndShow(ctx context.Context, source buildSource, path, ref string, wait time.Duration) error {
 	repository, err := cloneFrom(ctx, source)
 	if err != nil {
 		return err
 	}
+	if err := verbMayAsk(ctx, source, repository); err != nil {
+		return err
+	}
 	ident, err := openIdentity(ctx)
 	if err != nil {
 		return err
@@ -555,16 +758,17 @@ func buildAndShow(ctx context.Context, source buildSource, path, ref string, wai
 	}
 	defer server.Close()
 
-	ask, err := askOver(server)
+	ask, err := askOverOn(buildSeatHeld(ctx))
 	if err != nil {
 		return err
 	}
 	defer ask.Close()
 
 	result, err := ask.Submit(ctx, link.BuildRequest{
-		ID:         fmt.Sprintf("%s-%d", "build", time.Now().UnixNano()),
+		ID:         link.NewBuildID(time.Now()),
 		Repository: repository, Path: path, Ref: ref,
 		Held: heldBy(ctx), Seats: seatBases(ctx),
+		DryRun: true,
 	}, wait)
 	if err != nil {
 		return err
@@ -600,6 +804,10 @@ type answers struct {
 	reported []inventory.Reported
 	// plans is what the last merges produced and where each stands (novox/hq ADR 0162).
 	plans []inventory.Plan
+	// paused is whether the build seat takes work, which a plan waiting on it says (ADR 0219).
+	paused pauseView
+	// tierBounds is how long each repository's plan tier may take before it is late (novox/hq issue 296).
+	tierBounds tierBounds
 	// refused is why a machine cannot be worked out at all, by name. A different thing from every
 	// other answer here: those are about a machine that was told something, and this is about one
 	// that cannot be told anything — it never reaches waiting, because nothing was computed for it
@@ -623,6 +831,34 @@ type answers struct {
 	// public name on the machine went dark. The holds were correct; they were recorded only in the
 	// machine's own state file, and the one visible symptom was a count that did not add up.
 	untaken map[string]map[string]int
+	// unheld is every module on a machine whose resources are applied through a seat nothing on
+	// that machine holds (novox/hq ADR 0207), with the modules that could hold it. Reported, not
+	// refused, until the switch — and while there is any, the mesh is not all well: the order the
+	// machines' modules are built in is the mesh's to keep, and this is where it says it is not kept.
+	unheld []catalogue.Unheld
+	// conditions is every open condition (novox/hq to-be 45 §2), urgent first and then oldest first:
+	// what leads status, and what its all-well sentence needs to be none of, silenced ones included.
+	// A provider failing a consumer is one of them (ADR 0224). conditionsUnread says why they could
+	// not be read when they could not — never read as none.
+	conditions       []conditions.Condition
+	conditionsUnread string
+	// overflowing is every module whose identity overflows the bound of a provision it requires
+	// (novox/hq ADR 0225): its provider leaves it out of the grants and composes everything else, so
+	// this is the one place it is said across the mesh. Not well while there is any.
+	overflowing []catalogue.Overflow
+	// handActs is how many acts were done by hand in the last seven days (novox/hq to-be 45 §7), nil
+	// where the log is not on hand; handActsUnread why it could not be read when it could not.
+	handActs       *int
+	handActsUnread string
+	// heals is what the healers did in the last seven days (novox/hq to-be 45 §7): acts, and conditions
+	// handed to the operator; healsUnread why it could not be read.
+	heals       *healsCount
+	healsUnread string
+	// pending is every assignment waiting for its module's build, and every one ended in the last day
+	// (novox/hq issue 325); pendingUnread why they could not be read. One waiting, or one ended other than
+	// applied, is not well: an assignment somebody made is not made yet, or will not be.
+	pending       []inventory.PendingAssignment
+	pendingUnread string
 }
 
 // heldBy is every artifact this mesh has built, for a build that may need one as its base.
@@ -639,12 +875,14 @@ func heldBy(ctx context.Context) map[string]string {
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "could not read what this mesh has built, so a module naming a "+
 			"base will be told that base is missing: %v\n", err)
+		// empty-on-error: said above; a build that names a base is refused by name for want of it
 		return nil
 	}
 	defer open.Close()
 	held, err := open.inventory.Held(ctx)
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "could not read what this mesh has built: %v\n", err)
+		// empty-on-error: said above; a build that names a base is refused by name for want of it
 		return nil
 	}
 	address, err := whereABuilderReachesTheStore(ctx, open.inventory)
@@ -668,12 +906,60 @@ func heldBy(ctx context.Context) map[string]string {
 // **One place chooses**, as everywhere else the bus change went (novox/hq ADR 0116 step 5). On the bus
 // the mesh runs on today this needs the controller's own connection, so it is handed one; on the bus
 // being built it dials, because a build request is a one-shot and holds nothing else.
-func askOver(_ *link.Server) (link.Builders, error) {
+func askOverOn(seat string) (link.Builders, error) {
+	// The serving controller asks on its own connection (novox/hq issue 327).
+	if serving := servingBus.Load(); serving != nil {
+		return link.BuildsOn(serving, seat), nil
+	}
 	address, err := broker.BusAddress()
 	if err != nil {
 		return nil, err
 	}
-	return link.BuildsOverNATS(address)
+	return link.BuildsOverNATSOn(address, seat)
+}
+
+// buildSeatHeld is the build role to ask: the one some assigned module claims (novox/hq ADR 0190,
+// the handover). Read from the catalogue at ask time, because the answer changes exactly once, the
+// moment the first build-agent is assigned — and a controller that asked the new role before then
+// would queue work nothing takes, while the outcome that registers build-agent itself has to come
+// from the old builder. When the catalogue cannot be read the current role is asked, said aloud.
+func buildSeatHeld(ctx context.Context) string {
+	open, err := openStores(ctx)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "could not read what is assigned, so the build is asked of %s: %v\n",
+			link.TheBuildMachine, err)
+		return link.TheBuildMachine
+	}
+	defer open.Close()
+	entries, err := open.inventory.Catalogued(ctx)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "could not read the catalogue, so the build is asked of %s: %v\n",
+			link.TheBuildMachine, err)
+		return link.TheBuildMachine
+	}
+	return buildSeatAmong(entries)
+}
+
+// buildSeatAmong is the rule, over what the catalogue holds: the current build role when any
+// assigned module claims it; else the retired role while an assigned module still claims that; else
+// the current role, which is where every ask goes once the handover is done.
+func buildSeatAmong(entries []inventory.Entry) string {
+	heldBefore := false
+	for _, e := range entries {
+		if len(e.On) == 0 {
+			continue
+		}
+		if e.Manifest.ClaimsSeat(link.TheBuildMachine) {
+			return link.TheBuildMachine
+		}
+		if e.Manifest.ClaimsSeat(link.TheBuildMachineBefore) {
+			heldBefore = true
+		}
+	}
+	if heldBefore {
+		return link.TheBuildMachineBefore
+	}
+	return link.TheBuildMachine
 }
 
 // buildLog prints everything a build machine said about one build, read back from the bus.
@@ -683,20 +969,19 @@ func askOver(_ *link.Server) (link.Builders, error) {
 // with a consumer of its own that is gone when this returns, so nothing accumulates in the server
 // for the reading, and filtered by subject, so one build's lines are all that travel.
 func buildLog(ctx context.Context, id string) error {
-	address, err := broker.BusAddress()
-	if err != nil {
-		return err
-	}
-	js, err := broker.Dial(address)
+	js, err := aBus()
 	if err != nil {
 		return fmt.Errorf("cannot reach the bus to read a build's log: %w", err)
 	}
 	defer js.Close()
 
-	sub, err := js.Context().PullSubscribe(link.BuildLog(id), "",
+	// Under whichever build role did it: a build asked of the retired role during the handover
+	// (ADR 0190) said its lines as that role's events, and a reader should not have to know which.
+	lines := link.BuildLogOf("*", id)
+	sub, err := js.Context().PullSubscribe(lines, "",
 		nats.BindStream(broker.EventsStream), nats.DeliverAll(), nats.AckNone())
 	if err != nil {
-		return fmt.Errorf("cannot read %s from the bus: %w", link.BuildLog(id), err)
+		return fmt.Errorf("cannot read %s from the bus: %w", lines, err)
 	}
 	defer func() { _ = sub.Unsubscribe() }()
 

cmd/mesh-controller/build_seat_test.go

@@ -0,0 +1,43 @@
+package main
+
+import (
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+func claiming(module, seat string, on ...string) inventory.Entry {
+	return inventory.Entry{
+		Manifest: catalogue.Manifest{Module: module, Claims: []catalogue.Claim{{Name: seat}}},
+		On:       on,
+	}
+}
+
+// The controller asks the build role that has a holder (novox/hq ADR 0190 handover): the retired
+// one while only the builder is assigned, the current one from the first build-agent on, and the
+// current one when nothing holds either — where every ask goes once the handover is done.
+func TestTheControllerAsksTheBuildRoleThatHasAHolder(t *testing.T) {
+	onlyTheBuilder := []inventory.Entry{
+		claiming("builder", link.TheBuildMachineBefore, "anchor"),
+		claiming("build-agent", link.TheBuildMachine), // registered, assigned nowhere yet
+	}
+	if got := buildSeatAmong(onlyTheBuilder); got != link.TheBuildMachineBefore {
+		t.Errorf("with only the builder assigned, asked %q", got)
+	}
+	bothHeld := []inventory.Entry{
+		claiming("builder", link.TheBuildMachineBefore, "anchor"),
+		claiming("build-agent", link.TheBuildMachine, "home-server"),
+	}
+	if got := buildSeatAmong(bothHeld); got != link.TheBuildMachine {
+		t.Errorf("with a build-agent assigned anywhere, asked %q", got)
+	}
+	neither := []inventory.Entry{claiming("builder", link.TheBuildMachineBefore)}
+	if got := buildSeatAmong(neither); got != link.TheBuildMachine {
+		t.Errorf("with no holder of either, asked %q, want the current role", got)
+	}
+	if got := buildSeatAmong(nil); got != link.TheBuildMachine {
+		t.Errorf("an empty catalogue asks %q", got)
+	}
+}

cmd/mesh-controller/build_source.go

@@ -0,0 +1,458 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"regexp"
+	"strings"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// Where a build may register a module from (novox/hq ADR 0266).
+//
+// A build's outcome registers its module, and a registered module is what the next push sends. Before this,
+// an outcome registered whatever its manifest named, from whichever repository it was built from: an agent
+// that made a repository of its own, committed `modules/sudo/module.json` granting itself a rule without a
+// password, and asked the `build` verb for it had its repository registered as the module `sudo` — whose next
+// push made the agent root on every node. A fork of the node-engine did the same everywhere. The trunk rule
+// (ADR 0238) did not stop it: the trunk it checked was the trunk of the repository built, which was the
+// agent's own.
+//
+// So **an outcome registers a module only from the repository the catalogue already builds that module
+// from**; and a module new to the catalogue only from a repository the catalogue already builds another
+// module from — whose trunk takes a reviewed, approved merge, which is how a merge adds a module (novox/hq
+// issue 300). Anything else — a module moved to another repository, a module from a repository the
+// catalogue has never built — is the operator's, at the controller's terminal: allowed only when the build
+// request was kept as asked there. Judged at the take-in, which every outcome reaches whoever hears it and
+// whichever verb asked it (`build`, `rebuild`, `replay --register`, `assign` with build), and before the ask
+// for a call through a verb, so an agent cannot have a build node run a repository the catalogue does not
+// build from at all.
+
+// errNotItsSource is an outcome refused for where it was built from.
+var errNotItsSource = errors.New("not built from the repository the catalogue builds it from")
+
+// servedVar marks every process the serving controller starts — each verb's command, each child — and the serving
+// process itself, so none of them can read as the operator at the terminal (novox/hq ADR 0266). Set by serve
+// before it answers anything, inherited by every child through os.Environ.
+const servedVar = "MESH_SERVED_BY_THE_CONTROLLER"
+
+// startedAtTheTerminal says this process was started at the controller's terminal: not the serving controller,
+// not anything it started, not a verb's command, not a seat call's. The serving controller marks its own
+// environment (servedVar), so a build asked in it, or by any process it starts, never reads as the terminal's;
+// runVerb also names the verb and the caller.
+//
+// **And a line mesh-cli asked as the controller's terminal** (novox/hq ADR 0272 §4): the serving controller runs it
+// without the served mark and without a verb, names its caller, and marks it with cliTerminalVar — a mark only the
+// mesh-cli path sets and every other command line the controller runs is stripped of (commandEnvironment).
+func startedAtTheTerminal() bool {
+	if os.Getenv(servedVar) != "" || os.Getenv(verbVar) != "" {
+		return false
+	}
+	return os.Getenv(link.CallerVar) == "" || os.Getenv(cliTerminalVar) != ""
+}
+
+// cliTerminalVar marks a command line the serving controller runs as the controller's terminal for mesh-cli.
+const cliTerminalVar = "MESH_CLI_TERMINAL"
+
+// markServed marks this process, and so everything it starts, as the serving controller's.
+func markServed() {
+	if err := os.Setenv(servedVar, "1"); err != nil {
+		panic("the serving controller could not mark its environment: " + err.Error())
+	}
+}
+
+// sourceForms compares sources however each is spelled: a path on a seat's holder (ADR 0111) or a URL — a
+// build asked of a seat's path is registered with the URL composed from it when its outcome does not echo
+// the seat. A seat's path is composed into its URL where the seat's holder is known, so both spellings of
+// one repository are one; where it is not, a seat's path matches only the same seat's same path.
+type sourceForms struct {
+	bases map[string]string // the seat's clone base, `scheme://host:port`, by seat; "" where it is not known
+	base  func(seat string) string
+}
+
+// newSourceForms reads the seats' bases from the mesh once, when first needed.
+func newSourceForms(ctx context.Context, inv *inventory.Inventory) *sourceForms {
+	f := &sourceForms{bases: map[string]string{}}
+	var world *catalogue.World
+	f.base = func(seat string) string {
+		if b, known := f.bases[seat]; known {
+			return b
+		}
+		if world == nil {
+			w := catalogue.World{}
+			if shelf, err := inv.Catalogue(ctx); err == nil {
+				if read, err := theRestOfTheMesh(ctx, inv, shelf, ""); err == nil {
+					w = read
+				}
+			}
+			world = &w
+		}
+		b, err := seatBase(*world, seat)
+		if err != nil {
+			b = ""
+		}
+		f.bases[seat] = b
+		return b
+	}
+	return f
+}
+
+// canonical is one spelling of a repository: lower case, no `.git`, no trailing slash, and a seat's path as
+// the URL its holder serves it at where that is known.
+func (f *sourceForms) canonical(repository, seat string) string {
+	trim := func(s string) string {
+		s = strings.TrimSpace(strings.ToLower(s))
+		s = strings.TrimRight(s, "/")
+		return strings.TrimRight(strings.TrimSuffix(s, ".git"), "/")
+	}
+	if seat == "" {
+		return trim(repository)
+	}
+	if b := f.base(seat); b != "" {
+		return trim(b + "/" + strings.Trim(repository, "/"))
+	}
+	return "seat:" + seat + ":" + trim(strings.Trim(repository, "/"))
+}
+
+// same says two sources are one repository.
+func (f *sourceForms) same(aRepository, aSeat, bRepository, bSeat string) bool {
+	if aRepository == "" || bRepository == "" {
+		return false
+	}
+	return f.canonical(aRepository, aSeat) == f.canonical(bRepository, bSeat)
+}
+
+// buildsFrom says the catalogue builds some module from this repository.
+func (f *sourceForms) buildsFrom(entries []inventory.Entry, repository, seat string) bool {
+	for _, e := range entries {
+		if e.Provided || e.Source.Repository == "" {
+			continue
+		}
+		if f.same(e.Source.Repository, e.Source.Seat, repository, seat) {
+			return true
+		}
+	}
+	return false
+}
+
+// forgeFacts is what the mesh's forge says of a repository a module is registered from (novox/hq ADR 0266).
+type forgeFacts struct {
+	// ID is the forge's own id of the repository: what tells it from one deleted and made again by its name.
+	ID int64
+	// Guarded is whether the branch is protected as a module's trunk must be: no direct push, at least one
+	// required status, and no administrator merging past one. Why says what is missing when it is not.
+	Guarded bool
+	Why     string
+}
+
+// askTheForge asks the forge, through its module's tools on the bus, for a repository's id and its branch's
+// protection. A variable so a test needs no forge.
+var askTheForge = func(ctx context.Context, owner, repo, branch string) (forgeFacts, error) {
+	js, err := aBus()
+	if err != nil {
+		return forgeFacts{}, err
+	}
+	defer js.Close()
+	bus := link.OverNATS{Conn: js.Conn()}
+	ask := func(tool string, args map[string]any, into any) error {
+		raw, _ := json.Marshal(args)
+		answer, err := link.Ask(ctx, bus, "gitea", tool, raw, 30*time.Second)
+		if err != nil {
+			return err
+		}
+		if answer.Error != "" {
+			return fmt.Errorf("gitea.%s: %s", tool, answer.Error)
+		}
+		return json.Unmarshal(answer.Result, into)
+	}
+	var found struct {
+		Result struct {
+			ID       int64  `json:"id"`
+			FullName string `json:"full_name"`
+		} `json:"result"`
+	}
+	if err := ask("gitea_api", map[string]any{"path": "/repos/" + owner + "/" + repo}, &found); err != nil {
+		return forgeFacts{}, err
+	}
+	if found.Result.ID == 0 {
+		return forgeFacts{}, fmt.Errorf("the forge named no id for %s/%s", owner, repo)
+	}
+	var rules struct {
+		Rules []protectionRule `json:"rules"`
+	}
+	if err := ask("gitea_branch_protection_get", map[string]any{"owner": owner, "repo": repo}, &rules); err != nil {
+		return forgeFacts{}, err
+	}
+	facts := judgedRule(rules.Rules, branch)
+	facts.ID = found.Result.ID
+	return facts, nil
+}
+
+// protectionRule is a branch protection rule as the forge's tool summarises it.
+type protectionRule struct {
+	Rule             string   `json:"rule"`
+	Push             bool     `json:"push"`
+	RequiredStatuses []string `json:"required_statuses"`
+	AdminMayOverride bool     `json:"admin_may_override"`
+}
+
+// judgedRule judges the one rule the forge applies to a branch, as the forge picks it: the rule named for the
+// branch, else the first glob rule, in the forge's order, that covers it (gitea's first matching rule). Never a
+// later rule that happens to be stronger: the forge does not read it.
+func judgedRule(rules []protectionRule, branch string) forgeFacts {
+	var applied *protectionRule
+	for i := range rules {
+		if rules[i].Rule == branch {
+			applied = &rules[i]
+			break
+		}
+	}
+	if applied == nil {
+		for i := range rules {
+			if ruleCovers(rules[i].Rule, branch) {
+				applied = &rules[i]
+				break
+			}
+		}
+	}
+	switch r := applied; {
+	case r == nil:
+		return forgeFacts{Why: fmt.Sprintf("no protection rule covers %s", branch)}
+	case r.Push:
+		return forgeFacts{Why: fmt.Sprintf("the rule %s lets a person push to %s directly", r.Rule, branch)}
+	case len(r.RequiredStatuses) == 0:
+		return forgeFacts{Why: fmt.Sprintf("the rule %s requires no status before a merge into %s", r.Rule, branch)}
+	case r.AdminMayOverride:
+		return forgeFacts{Why: fmt.Sprintf("the rule %s lets an administrator merge into %s past a status", r.Rule, branch)}
+	}
+	return forgeFacts{Guarded: true}
+}
+
+// ruleCovers says a protection rule's name — a branch, or a glob of them — covers a branch, as the forge reads it.
+func ruleCovers(rule, branch string) bool {
+	if rule == branch {
+		return true
+	}
+	if !strings.ContainsAny(rule, "*?[") {
+		return false
+	}
+	var re strings.Builder
+	re.WriteString("^")
+	for i := 0; i < len(rule); i++ {
+		switch c := rule[i]; {
+		case c == '*' && i+1 < len(rule) && rule[i+1] == '*':
+			re.WriteString(".*")
+			i++
+		case c == '*':
+			re.WriteString("[^/]*")
+		case c == '?':
+			re.WriteString("[^/]")
+		default:
+			re.WriteString(regexp.QuoteMeta(string(c)))
+		}
+	}
+	re.WriteString("$")
+	ok, _ := regexp.MatchString(re.String(), branch)
+	return ok
+}
+
+// onTheForge is a source's owner and name on the mesh's own forge (the git seat's holder), and whether it is
+// there at all.
+func (f *sourceForms) onTheForge(repository, seat string) (owner, name string, ok bool) {
+	var rest string
+	switch {
+	case seat == gitSeat:
+		rest = strings.Trim(repository, "/")
+	case seat == "":
+		base := f.base(gitSeat)
+		if base == "" {
+			return "", "", false
+		}
+		url, prefix := f.canonical(repository, ""), f.canonical(base, "")+"/"
+		if !strings.HasPrefix(url, prefix) {
+			return "", "", false
+		}
+		// The case the forge spells it with: the URL as given, past the base.
+		rest = strings.TrimSuffix(strings.Trim(repository[len(prefix):], "/"), ".git")
+	default:
+		return "", "", false
+	}
+	parts := strings.Split(rest, "/")
+	if len(parts) != 2 || parts[0] == "" || parts[1] == "" {
+		return "", "", false
+	}
+	return parts[0], parts[1], true
+}
+
+// mayRegisterFrom says whether a build's outcome may register module from the source it was built from, and the
+// forge's id of that repository to record (novox/hq ADR 0266). Through any verb, only:
+//
+//   - from the module's registered repository — the same repository by the forge's own id, not only its name; or,
+//     for a module new to the catalogue, from a repository the catalogue builds another module from;
+//   - and from a repository on the mesh's forge whose trunk is protected as a trunk must be: no direct push, at
+//     least one required status, no administrator merging past one.
+//
+// Anything else only when the build request was kept as asked at the controller's terminal, for this very
+// repository and path. path is the module's directory as built; branch the trunk it is registered from.
+func mayRegisterFrom(ctx context.Context, inv *inventory.Inventory, module string, built inventory.Source,
+	buildID, path, branch string) (int64, error) {
+	forms := newSourceForms(ctx, inv)
+	was, err := inv.SourceOf(ctx, module)
+	isNew := errors.Is(err, inventory.ErrNoSuchModule)
+	if err != nil && !isNew {
+		return 0, err
+	}
+	terminal, err := askedHereFor(ctx, inv, forms, buildID, built, path)
+	if err != nil {
+		return 0, err
+	}
+	refuse := func(why string) (int64, error) {
+		return 0, fmt.Errorf("%w: %s. A module is registered from such a source only by a build asked at the "+
+			"controller's terminal, never through a verb: a registered module is what the next push sends, and whoever "+
+			"may call a verb includes agents (novox/hq ADR 0266)", errNotItsSource, why)
+	}
+
+	var why string
+	var alongside []inventory.Entry // the modules a new one's repository already builds
+	switch {
+	case !isNew && forms.same(was.Repository, was.Seat, built.Repository, built.Seat):
+	case !isNew:
+		registered := was.Repository
+		if registered == "" {
+			registered = "no repository (it was handed over by hand)"
+		}
+		why = fmt.Sprintf("%s is built from %s, and this build is of %s", module, sourceWords(registered, was.Seat),
+			sourceWords(built.Repository, built.Seat))
+	default:
+		entries, err := inv.Catalogued(ctx)
+		if err != nil {
+			return 0, err
+		}
+		for _, e := range entries {
+			if !e.Provided && e.Source.Repository != "" &&
+				forms.same(e.Source.Repository, e.Source.Seat, built.Repository, built.Seat) {
+				alongside = append(alongside, e)
+			}
+		}
+		if len(alongside) == 0 {
+			why = fmt.Sprintf("%s is new to the catalogue, and %s is no repository the catalogue builds a module from",
+				module, sourceWords(built.Repository, built.Seat))
+		}
+	}
+	if why != "" && !terminal {
+		return refuse(why)
+	}
+
+	owner, name, onForge := forms.onTheForge(built.Repository, built.Seat)
+	if !onForge {
+		if terminal {
+			fmt.Printf("%s: %s is not on the mesh's forge — registered, as asked at the controller's terminal\n",
+				buildID, sourceWords(built.Repository, built.Seat))
+			return 0, nil
+		}
+		return refuse(fmt.Sprintf("%s is not on the mesh's forge, so whether its trunk is protected cannot be read",
+			sourceWords(built.Repository, built.Seat)))
+	}
+	facts, err := askTheForge(ctx, owner, name, branch)
+	if err != nil {
+		if terminal {
+			fmt.Printf("%s: the forge could not be asked about %s/%s (%v) — registered, as asked at the controller's "+
+				"terminal\n", buildID, owner, name, err)
+			return 0, nil
+		}
+		return refuse(fmt.Sprintf("the forge could not say whether %s/%s's %s is protected: %v", owner, name, branch, err))
+	}
+	if terminal {
+		if why != "" || !facts.Guarded {
+			fmt.Printf("%s: %s — registered, as asked at the controller's terminal\n", buildID,
+				strings.Trim(why+"; "+facts.Why, "; "))
+		}
+		return facts.ID, nil
+	}
+	if !facts.Guarded {
+		return refuse(fmt.Sprintf("%s/%s's %s is not protected as a module's trunk must be: %s", owner, name, branch,
+			facts.Why))
+	}
+	// The same repository by the forge's id, not only its name: one deleted and made again is another.
+	recorded := map[string]int64{}
+	if !isNew {
+		id, err := inv.SourceIdentity(ctx, module)
+		if err != nil {
+			return 0, err
+		}
+		recorded[module] = id
+	}
+	for _, e := range alongside {
+		id, err := inv.SourceIdentity(ctx, e.Manifest.Module)
+		if err != nil {
+			return 0, err
+		}
+		recorded[e.Manifest.Module] = id
+	}
+	for m, id := range recorded {
+		if id != 0 && id != facts.ID {
+			return refuse(fmt.Sprintf("%s/%s is not the repository %s was registered from: the forge knows it as "+
+				"repository %d, and %s was registered from repository %d — one of that name deleted and made again",
+				owner, name, m, facts.ID, m, id))
+		}
+	}
+	return facts.ID, nil
+}
+
+// askedHereFor says the build was asked at the controller's terminal, for this repository and this path: a kept
+// request marked so, whose source is the outcome's (novox/hq ADR 0266).
+func askedHereFor(ctx context.Context, inv *inventory.Inventory, forms *sourceForms, buildID string,
+	built inventory.Source, path string) (bool, error) {
+	r, found, err := inv.BuildRequestByID(ctx, buildID)
+	if err != nil || !found || !r.AtTerminal {
+		return false, err
+	}
+	if !forms.same(r.Repository, r.Seat, built.Repository, built.Seat) ||
+		strings.Trim(r.Path, "/") != strings.Trim(path, "/") {
+		fmt.Printf("%s was asked at the terminal of %s at %q, and its outcome is of %s at %q: not the terminal's\n",
+			buildID, sourceWords(r.Repository, r.Seat), r.Path, sourceWords(built.Repository, built.Seat), path)
+		return false, nil
+	}
+	return true, nil
+}
+
+// sourceWords is a source as a person reads it.
+func sourceWords(repository, seat string) string {
+	if seat == "" {
+		return repository
+	}
+	return buildSource{Repository: repository, Seat: seat}.String()
+}
+
+// verbMayAsk refuses, for a call through a verb, a build of a repository the catalogue builds no module from
+// (novox/hq ADR 0266): the build node would run what an agent wrote, and its outcome could never be
+// registered anyway. url is the repository as it is cloned. At the terminal anything may be asked.
+func verbMayAsk(ctx context.Context, source buildSource, url string) error {
+	if startedAtTheTerminal() {
+		return nil
+	}
+	open, err := openStores(ctx)
+	if err != nil {
+		return err
+	}
+	defer open.Close()
+	entries, err := open.inventory.Catalogued(ctx)
+	if err != nil {
+		return err
+	}
+	forms := newSourceForms(ctx, open.inventory)
+	if forms.buildsFrom(entries, source.Repository, source.Seat) || forms.buildsFrom(entries, url, "") {
+		return nil
+	}
+	return terminalRefusal("%s is no repository the catalogue builds a module from, and a build of any other is "+
+		"asked at the controller's terminal only, never through a verb: a build node runs what the repository "+
+		"says, and its outcome would register a module the next push sends — whoever may call a verb includes "+
+		"agents (novox/hq ADR 0266). Nothing was asked", source)
+}

cmd/mesh-controller/build_source_test.go

@@ -0,0 +1,380 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"hash/fnv"
+	"os"
+	"os/exec"
+	"slices"
+	"strings"
+	"sync"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// The routes to root a review of ADR 0266 found (novox/hq ADR 0266 §7): an agent makes a repository of its
+// own — or forks one the mesh builds from — commits a module.json naming a module the mesh runs everywhere
+// (`sudo`, granting itself a rule without a password; `mesh-host`, the node-engine), and asks the `build` verb
+// for it. Its outcome was registered under that name from the agent's repository, and the next push sent it.
+
+// onTrunk is an outcome of a commit on its repository's trunk, as the build seat says it.
+func onTrunk(id, repository, seat, path string, manifest map[string]any) link.BuildResult {
+	raw, _ := json.Marshal(manifest)
+	r := link.BuildResult{ID: id, Repository: "http://forge.internal:20000/" + repository + ".git", Path: path,
+		Ref: "main", On: "anchor", Commit: "c0ffee0123456789", Manifest: raw,
+		Trunk: "main", OnTrunk: true, Branches: []string{"main"}}
+	if seat != "" {
+		r.Source = &link.SourceOnSeat{Seat: seat, Repository: repository}
+	}
+	return r
+}
+
+// keptAsked keeps a build request as the asker would: through a verb, or at the terminal.
+func keptAsked(t *testing.T, inv *inventory.Inventory, id, repository, path string, atTerminal bool) {
+	t.Helper()
+	if err := inv.RecordBuildRequest(t.Context(), inventory.BuildRequest{ID: id, Repository: repository, Seat: "git",
+		Path: path, For: "build", AtTerminal: atTerminal}); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// theCatalogue is a mesh whose sudo is built from the catalogue repository and whose node-engine from its own.
+func theCatalogue(t *testing.T) *stores {
+	t.Helper()
+	open := aMesh(t)
+	ctx := t.Context()
+	for _, b := range []link.BuildResult{
+		onTrunk("build-sudo", "novox/mesh-catalog", "git", "modules/sudo", map[string]any{"module": "sudo", "version": "1"}),
+		onTrunk("build-host", "novox/mesh-host", "git", "", map[string]any{"module": "mesh-host", "version": "1"}),
+	} {
+		keptAsked(t, open.inventory, b.ID, b.Source.Repository, b.Path, true)
+		if _, _, err := takeIn(ctx, open.inventory, b); err != nil {
+			t.Fatal(err)
+		}
+	}
+	return open
+}
+
+func TestABuildFromAnAgentsRepositoryIsNotRegisteredAsAModuleTheMeshHolds(t *testing.T) {
+	open := theCatalogue(t)
+	ctx := t.Context()
+	for _, c := range []struct {
+		name, repository, path, module string
+	}{
+		{"its own repository naming sudo", "agent/sudo", "modules/sudo", "sudo"},
+		{"a fork of the catalogue", "agent/mesh-catalog", "modules/sudo", "sudo"},
+		{"a fork of the node-engine", "agent/mesh-host", "", "mesh-host"},
+	} {
+		t.Run(c.name, func(t *testing.T) {
+			id := "build-" + strings.ReplaceAll(c.repository, "/", "-")
+			keptAsked(t, open.inventory, id, c.repository, c.path, false) // through the build verb
+			evil := onTrunk(id, c.repository, "git", c.path, map[string]any{"module": c.module, "version": "evil"})
+			_, _, err := takeIn(ctx, open.inventory, evil)
+			if !errors.Is(err, errNotItsSource) {
+				t.Fatalf("a build of %s was taken in as %s: %v", c.repository, c.module, err)
+			}
+			shelf, err := open.inventory.Catalogue(ctx)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if got := shelf[c.module].Version; got != "1" {
+				t.Fatalf("%s is now %q, from %s", c.module, got, c.repository)
+			}
+			if _, found, _ := open.inventory.BuildByID(ctx, id); !found {
+				t.Errorf("the refused build %s is not recorded", id)
+			}
+		})
+	}
+}
+
+func TestANewModuleFromARepositoryTheCatalogueDoesNotBuildFromIsNotRegistered(t *testing.T) {
+	open := theCatalogue(t)
+	ctx := t.Context()
+	keptAsked(t, open.inventory, "build-new", "agent/tools", "", false)
+	_, _, err := takeIn(ctx, open.inventory, onTrunk("build-new", "agent/tools", "git", "",
+		map[string]any{"module": "agent-tools", "version": "1"}))
+	if !errors.Is(err, errNotItsSource) {
+		t.Fatalf("a new module from an agent's repository was taken in: %v", err)
+	}
+	// And one asked of nobody here — an outcome on the bus no request was kept for — the same.
+	_, _, err = takeIn(ctx, open.inventory, onTrunk("build-unasked", "agent/tools", "git", "",
+		map[string]any{"module": "agent-tools", "version": "1"}))
+	if !errors.Is(err, errNotItsSource) {
+		t.Fatalf("an outcome nobody asked for was taken in: %v", err)
+	}
+	if shelf, _ := open.inventory.Catalogue(ctx); shelf["agent-tools"].Module != "" {
+		t.Fatal("the refused module is in the catalogue")
+	}
+}
+
+// The operator at the terminal may still move a module, or add one from a new repository.
+func TestAtTheTerminalAnotherRepositoryIsRegistered(t *testing.T) {
+	open := theCatalogue(t)
+	ctx := t.Context()
+	keptAsked(t, open.inventory, "build-moved", "novox/sudo", "", true)
+	if _, _, err := takeIn(ctx, open.inventory, onTrunk("build-moved", "novox/sudo", "git", "",
+		map[string]any{"module": "sudo", "version": "2"})); err != nil {
+		t.Fatalf("a move the operator asked for at the terminal was refused: %v", err)
+	}
+	if src, _ := open.inventory.SourceOf(ctx, "sudo"); src.Repository != "novox/sudo" {
+		t.Fatalf("sudo is built from %q", src.Repository)
+	}
+	if err := open.inventory.RecordBuildRequest(ctx, inventory.BuildRequest{ID: "build-external",
+		Repository: "http://forge.internal:20000/someone/app.git", For: "build", AtTerminal: true}); err != nil {
+		t.Fatal(err)
+	}
+	if _, _, err := takeIn(ctx, open.inventory, onTrunk("build-external", "someone/app", "", "",
+		map[string]any{"module": "app", "version": "1"})); err != nil {
+		t.Fatalf("a new module the operator asked for at the terminal was refused: %v", err)
+	}
+}
+
+// The delivery's flow is untouched: a merge's rebuild of a module from its own repository, and a merge adding
+// a module to a repository the catalogue builds from (novox/hq issue 300), are registered with no terminal.
+func TestADeliveryFromTheRegisteredRepositoryIsRegistered(t *testing.T) {
+	open := theCatalogue(t)
+	ctx := t.Context()
+	rebuilt := onTrunk("build-plan", "novox/mesh-catalog", "git", "modules/sudo", map[string]any{"module": "sudo", "version": "2"})
+	if err := open.inventory.RecordBuildRequest(ctx, inventory.BuildRequest{ID: rebuilt.ID,
+		Repository: "novox/mesh-catalog", Seat: "git", Path: "modules/sudo", For: "plan"}); err != nil {
+		t.Fatal(err)
+	}
+	if _, _, err := takeIn(ctx, open.inventory, rebuilt); err != nil {
+		t.Fatalf("a plan's build of the module's own repository was refused: %v", err)
+	}
+	added := onTrunk("build-merge", "novox/mesh-catalog", "git", "modules/zram", map[string]any{"module": "zram", "version": "1"})
+	if _, _, err := takeIn(ctx, open.inventory, added); err != nil {
+		t.Fatalf("a module a merge added to the catalogue repository was refused: %v", err)
+	}
+	shelf, _ := open.inventory.Catalogue(ctx)
+	if shelf["sudo"].Version != "2" || shelf["zram"].Module == "" {
+		t.Fatalf("not registered: sudo %q, zram %q", shelf["sudo"].Version, shelf["zram"].Module)
+	}
+}
+
+// Through a verb, a build of a repository the catalogue builds nothing from is not even asked: the build node
+// would run what the agent wrote.
+func TestAVerbAsksNoBuildOfARepositoryTheCatalogueDoesNotBuildFrom(t *testing.T) {
+	theCatalogue(t)
+	ctx := t.Context()
+	t.Setenv(verbVar, "build")
+	t.Setenv(link.CallerVar, "node-tools.anchor, through the mesh-controller seat")
+	err := verbMayAsk(ctx, buildSource{Repository: "agent/sudo", Seat: "git"}, "http://forge.internal:20000/agent/sudo.git")
+	var policy *heldAtTheTerminal
+	if !errors.As(err, &policy) {
+		t.Fatalf("a verb's build of an agent's repository was asked: %v", err)
+	}
+	if err := verbMayAsk(ctx, buildSource{Repository: "novox/mesh-catalog", Seat: "git"},
+		"http://forge.internal:20000/novox/mesh-catalog.git"); err != nil {
+		t.Fatalf("a verb's build of the catalogue repository was refused: %v", err)
+	}
+	t.Setenv(verbVar, "")
+	t.Setenv(link.CallerVar, "")
+	if err := verbMayAsk(ctx, buildSource{Repository: "agent/sudo", Seat: "git"}, ""); err != nil {
+		t.Fatalf("the terminal was refused: %v", err)
+	}
+}
+
+// asTheOperator keeps a build as asked at the controller's terminal, as the operator's first build of a module
+// from a repository the catalogue does not yet build from is (novox/hq ADR 0266), and hands it back.
+func asTheOperator(t *testing.T, inv *inventory.Inventory, b link.BuildResult) link.BuildResult {
+	t.Helper()
+	repository, seat := b.Repository, ""
+	if b.Source != nil {
+		repository, seat = b.Source.Repository, b.Source.Seat
+	}
+	if err := inv.RecordBuildRequest(t.Context(), inventory.BuildRequest{ID: b.ID, Repository: repository, Seat: seat,
+		Path: b.Path, For: "build", AtTerminal: true}); err != nil {
+		t.Fatal(err)
+	}
+	return b
+}
+
+// A rollback puts back only a build of the module's own repository: an agent's build of the module's name,
+// recorded and refused, at the very commit the machine ran before (a fork carries it), is never registered by
+// the back door of a failed gate.
+func TestARollbackNeverPutsBackABuildFromAnotherRepository(t *testing.T) {
+	open := theCatalogue(t)
+	ctx := t.Context()
+	inv := open.inventory
+	fork := onTrunk("build-1791500000000000000", "agent/mesh-catalog", "git", "modules/sudo",
+		map[string]any{"module": "sudo", "version": "evil"})
+	fork.Commit = "c0ffee0123456789" // the commit sudo was registered at
+	keptAsked(t, inv, fork.ID, "agent/mesh-catalog", "modules/sudo", false)
+	if _, _, err := takeIn(ctx, inv, fork); !errors.Is(err, errNotItsSource) {
+		t.Fatalf("the fork's build was taken in: %v", err)
+	}
+	failed := onTrunk("build-1791600000000000000", "novox/mesh-catalog", "git", "modules/sudo",
+		map[string]any{"module": "sudo", "version": "2"})
+	failed.Commit = "badbadbad0123456"
+	if _, _, err := takeIn(ctx, inv, failed); err != nil {
+		t.Fatal(err)
+	}
+	record, _, err := inv.BuildByID(ctx, failed.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	previous, found, err := inv.PreviousBuild(ctx, "sudo", "c0ffee0123456789", record)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if found && previous.ID == fork.ID {
+		t.Fatalf("a rollback would put back the fork's build %s", previous.ID)
+	}
+	if !found || previous.ID != "build-sudo" {
+		t.Fatalf("a rollback puts back %q (found %v), want the registered build-sudo", previous.ID, found)
+	}
+}
+
+// theForge is what the forge says in a test, by owner/name: a repository not named here is protected as a
+// trunk must be, with an id of its own.
+var theForge sync.Map
+
+func init() {
+	askTheForge = func(_ context.Context, owner, repo, _ string) (forgeFacts, error) {
+		if said, ok := theForge.Load(owner + "/" + repo); ok {
+			switch f := said.(type) {
+			case error:
+				return forgeFacts{}, f
+			case forgeFacts:
+				return f, nil
+			}
+		}
+		h := fnv.New32a()
+		_, _ = h.Write([]byte(owner + "/" + repo))
+		return forgeFacts{ID: int64(h.Sum32()), Guarded: true}, nil
+	}
+}
+
+// A module's trunk the forge does not protect — direct pushes, no required status — or a forge that cannot say,
+// registers nothing through a verb: the trunk rule means nothing on a branch anyone pushes to.
+func TestATrunkTheForgeDoesNotProtectRegistersNothing(t *testing.T) {
+	open := theCatalogue(t)
+	ctx := t.Context()
+	theForge.Store("novox/unguarded", forgeFacts{ID: 7, Why: "the rule main lets a person push to main directly"})
+	t.Cleanup(func() { theForge.Delete("novox/unguarded") })
+	first := onTrunk("build-unguarded-1", "novox/unguarded", "git", "", map[string]any{"module": "unguarded", "version": "1"})
+	keptAsked(t, open.inventory, first.ID, "novox/unguarded", "", true)
+	if _, _, err := takeIn(ctx, open.inventory, first); err != nil {
+		t.Fatalf("at the terminal: %v", err)
+	}
+	again := onTrunk("build-unguarded-2", "novox/unguarded", "git", "", map[string]any{"module": "unguarded", "version": "2"})
+	if _, _, err := takeIn(ctx, open.inventory, again); !errors.Is(err, errNotItsSource) ||
+		!strings.Contains(err.Error(), "push to main directly") {
+		t.Fatalf("a rebuild from an unprotected trunk was taken in: %v", err)
+	}
+	theForge.Store("novox/unguarded", errors.New("nothing serves gitea.gitea_api"))
+	if _, _, err := takeIn(ctx, open.inventory, onTrunk("build-unguarded-3", "novox/unguarded", "git", "",
+		map[string]any{"module": "unguarded", "version": "3"})); !errors.Is(err, errNotItsSource) {
+		t.Fatalf("a forge that could not say was read as a protected trunk: %v", err)
+	}
+	if shelf, _ := open.inventory.Catalogue(ctx); shelf["unguarded"].Version != "1" {
+		t.Fatalf("unguarded is %q", shelf["unguarded"].Version)
+	}
+}
+
+// A repository deleted and made again under the module's repository's name is another repository: the forge's
+// id, recorded at registration, tells them apart.
+func TestARepositoryMadeAgainUnderItsNameIsNotTheModulesSource(t *testing.T) {
+	open := theCatalogue(t)
+	ctx := t.Context()
+	theForge.Store("novox/remade", forgeFacts{ID: 100, Guarded: true})
+	t.Cleanup(func() { theForge.Delete("novox/remade") })
+	first := onTrunk("build-remade-1", "novox/remade", "git", "", map[string]any{"module": "remade", "version": "1"})
+	keptAsked(t, open.inventory, first.ID, "novox/remade", "", true)
+	if _, _, err := takeIn(ctx, open.inventory, first); err != nil {
+		t.Fatal(err)
+	}
+	if id, _ := open.inventory.SourceIdentity(ctx, "remade"); id != 100 {
+		t.Fatalf("the forge's id was not recorded: %d", id)
+	}
+	theForge.Store("novox/remade", forgeFacts{ID: 101, Guarded: true}) // deleted, and made again by an agent
+	if _, _, err := takeIn(ctx, open.inventory, onTrunk("build-remade-2", "novox/remade", "git", "",
+		map[string]any{"module": "remade", "version": "evil"})); !errors.Is(err, errNotItsSource) ||
+		!strings.Contains(err.Error(), "made again") {
+		t.Fatalf("a repository made again under the name was taken in: %v", err)
+	}
+	// And a new module from it, beside the one registered from the first, the same.
+	if _, _, err := takeIn(ctx, open.inventory, onTrunk("build-remade-3", "novox/remade", "git", "modules/other",
+		map[string]any{"module": "other", "version": "1"})); !errors.Is(err, errNotItsSource) {
+		t.Fatalf("a new module from a repository made again was taken in: %v", err)
+	}
+}
+
+// The terminal's mark is the operator's for the repository and path they asked: an outcome of another, under that
+// build's id, is not theirs.
+func TestATerminalRequestCoversOnlyWhatItAsked(t *testing.T) {
+	open := theCatalogue(t)
+	ctx := t.Context()
+	if err := open.inventory.RecordBuildRequest(ctx, inventory.BuildRequest{ID: "build-asked", Repository: "novox/app",
+		Seat: "git", Path: "modules/app", For: "build", AtTerminal: true}); err != nil {
+		t.Fatal(err)
+	}
+	other := onTrunk("build-asked", "agent/sudo", "git", "modules/app", map[string]any{"module": "sudo", "version": "evil"})
+	if _, _, err := takeIn(ctx, open.inventory, other); !errors.Is(err, errNotItsSource) {
+		t.Fatalf("an outcome of another repository under a terminal request's id was taken in: %v", err)
+	}
+	elsewhere := onTrunk("build-asked", "novox/app", "git", "modules/sudo", map[string]any{"module": "sudo", "version": "evil"})
+	if _, _, err := takeIn(ctx, open.inventory, elsewhere); !errors.Is(err, errNotItsSource) {
+		t.Fatalf("an outcome of another path under a terminal request's id was taken in: %v", err)
+	}
+}
+
+// The serving controller, and everything it starts, is never the terminal: a build asked in it reads as asked
+// through the mesh even when no verb and no caller is named.
+func TestTheServingControllerIsNeverTheTerminal(t *testing.T) {
+	t.Setenv(verbVar, "")
+	t.Setenv(link.CallerVar, "")
+	t.Setenv(servedVar, "")
+	if !startedAtTheTerminal() {
+		t.Fatal("a process started by hand is not the terminal")
+	}
+	markServed()
+	if startedAtTheTerminal() {
+		t.Fatal("the serving controller reads as the terminal")
+	}
+	child := exec.Command(os.Args[0], "-test.run=^$")
+	child.Env = os.Environ()
+	if !slices.Contains(child.Env, servedVar+"=1") {
+		t.Fatal("what the serving controller starts does not carry its mark")
+	}
+}
+
+// The forge applies one rule to a branch: the rule named for it, else the first glob that covers it. A stronger
+// rule later in the list is not what guards the branch, and is not read as if it were (the confirmation review).
+func TestTheRuleJudgedIsTheOneTheForgeApplies(t *testing.T) {
+	guarded := protectionRule{Rule: "*", RequiredStatuses: []string{"mesh/merge-gate"}}
+	open := protectionRule{Rule: "main", Push: true, RequiredStatuses: []string{"mesh/merge-gate"}}
+	if f := judgedRule([]protectionRule{guarded, open}, "main"); f.Guarded {
+		t.Error("an exact rule letting pushes was passed over for a glob that guards")
+	}
+	if f := judgedRule([]protectionRule{{Rule: "ma*", RequiredStatuses: nil}, {Rule: "*", RequiredStatuses: []string{"x"}}},
+		"main"); f.Guarded || !strings.Contains(f.Why, "ma*") {
+		t.Errorf("the first glob covering the branch was not the one judged: %+v", f)
+	}
+	if f := judgedRule([]protectionRule{{Rule: "release/*"}, {Rule: "main", RequiredStatuses: []string{"x"}}}, "main"); !f.Guarded {
+		t.Errorf("the rule named for the branch was not judged: %+v", f)
+	}
+	if f := judgedRule(nil, "main"); f.Guarded {
+		t.Error("no rule is no protection")
+	}
+}
+
+// An id the forge could not give keeps the id already recorded.
+func TestAnUnknownIdentityKeepsTheRecordedOne(t *testing.T) {
+	open := theCatalogue(t)
+	ctx := t.Context()
+	if err := open.inventory.SetSourceIdentity(ctx, "sudo", 100); err != nil {
+		t.Fatal(err)
+	}
+	if err := open.inventory.SetSourceIdentity(ctx, "sudo", 0); err != nil {
+		t.Fatal(err)
+	}
+	if id, _ := open.inventory.SourceIdentity(ctx, "sudo"); id != 100 {
+		t.Fatalf("the recorded id became %d", id)
+	}
+}

cmd/mesh-controller/build_test.go

@@ -2,9 +2,12 @@ package main
 
 import (
 	"encoding/json"
+	"errors"
 	"strings"
 	"testing"
+	"time"
 
+	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
 
@@ -16,11 +19,11 @@ func TestABuildHeardIsRecordedAndRegistered(t *testing.T) {
 	open := aMesh(t)
 	ctx := t.Context()
 	manifest, _ := json.Marshal(map[string]any{"module": "shop", "version": "3"})
-	m, _, err := takeIn(ctx, open.inventory, link.BuildResult{
+	m, _, err := takeIn(ctx, open.inventory, asTheOperator(t, open.inventory, link.BuildResult{
 		ID: "b-1", Repository: "http://forge.internal:20000/novox/shop.git", Path: "modules/shop",
 		Ref: "main", On: "anchor", Commit: "abcdef0123", Manifest: manifest,
 		Source: &link.SourceOnSeat{Seat: "git", Repository: "novox/shop"},
-	})
+	}))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -63,3 +66,87 @@ func TestABuildHeardIsRecordedAndRegistered(t *testing.T) {
 		t.Fatalf("a failure is said in the builder's words: %v", err)
 	}
 }
+
+// novox/hq 04-ISSUES/215: a build asked at a commit is recorded as built from that commit, and the
+// module keeps following the branch it followed — a new one, the default branch.
+func TestABuildAtACommitKeepsTheBranchTheModuleFollows(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	manifest, _ := json.Marshal(map[string]any{"module": "unifi", "version": "1"})
+	result := func(id, ref, commit string) link.BuildResult {
+		return link.BuildResult{ID: id, Repository: "http://forge.internal:20000/novox/mesh-catalog.git",
+			Path: "modules/unifi", Ref: ref, On: "anchor", Commit: commit, Manifest: manifest,
+			Source: &link.SourceOnSeat{Seat: "git", Repository: "novox/mesh-catalog"}}
+	}
+	if _, _, err := takeIn(ctx, open.inventory, asTheOperator(t, open.inventory, result("b-1", "main", "1111111aaaa"))); err != nil {
+		t.Fatal(err)
+	}
+	if _, _, err := takeIn(ctx, open.inventory, result("b-2", "9c97a8a", "9c97a8a1d2c3")); err != nil {
+		t.Fatal(err)
+	}
+	src, err := open.inventory.SourceOf(ctx, "unifi")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if src.Ref != "main" || src.BuiltFrom != "9c97a8a1d2c3" {
+		t.Errorf("after a build at a commit the module follows %q, built from %q; want main, 9c97a8a1d2c3", src.Ref, src.BuiltFrom)
+	}
+
+	// One new to the catalogue, first built at a commit, follows the default branch.
+	other, _ := json.Marshal(map[string]any{"module": "letta", "version": "1"})
+	r := result("b-3", "deadbeef", "deadbeefcafe")
+	r.Manifest, r.Path = other, "modules/letta"
+	if _, _, err := takeIn(ctx, open.inventory, r); err != nil {
+		t.Fatal(err)
+	}
+	if src, _ := open.inventory.SourceOf(ctx, "letta"); src.Ref != "" {
+		t.Errorf("a module first built at a commit follows %q, want the default branch", src.Ref)
+	}
+}
+
+// novox/hq 04-ISSUES/219: an older request heard after a newer one is recorded and not registered,
+// so a push sends what the newer request built.
+func TestAnOlderBuildHeardLaterDoesNotReplaceTheNewer(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	older := time.Date(2026, 10, 3, 21, 33, 45, 0, time.UTC)
+	newer := time.Date(2026, 10, 3, 21, 51, 57, 0, time.UTC)
+	result := func(asked time.Time, image string) link.BuildResult {
+		manifest, _ := json.Marshal(map[string]any{"module": "postgres", "version": image})
+		return link.BuildResult{ID: link.NewBuildID(asked), Repository: "http://forge.internal:20000/novox/mesh-catalog.git",
+			Path: "modules/postgres", Ref: "main", On: "anchor", Commit: "efff5415", Manifest: manifest,
+			Source: &link.SourceOnSeat{Seat: "git", Repository: "novox/mesh-catalog"}}
+	}
+	if _, _, err := takeIn(ctx, open.inventory, asTheOperator(t, open.inventory, result(newer, "4bcd5f73"))); err != nil {
+		t.Fatal(err)
+	}
+	_, _, err := takeIn(ctx, open.inventory, result(older, "0ab07fa9"))
+	if !errors.Is(err, inventory.ErrSuperseded) {
+		t.Fatalf("the older request's outcome was taken in as current: %v", err)
+	}
+	shelf, err := open.inventory.Catalogue(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := shelf["postgres"].Version; got != "4bcd5f73" {
+		t.Errorf("postgres is %q; want the newer request's 4bcd5f73", got)
+	}
+	if builds, _ := open.inventory.Builds(ctx, "postgres", 5); len(builds) != 2 {
+		t.Errorf("the late build was not recorded: %v", builds)
+	}
+}
+
+func TestABuildIDSaysWhenItWasAsked(t *testing.T) {
+	at := time.Date(2026, 10, 3, 21, 51, 57, 392539762, time.UTC)
+	if got, ok := link.BuildAskedAt(link.NewBuildID(at)); !ok || !got.Equal(at) {
+		t.Errorf("read back %v %v; want %v", got, ok, at)
+	}
+	if got, ok := link.BuildAskedAt("build-1791064317392539762"); !ok || got.Format(time.TimeOnly) != "21:51:57" {
+		t.Errorf("the incident's id reads as %v %v", got, ok)
+	}
+	for _, id := range []string{"b-1", "build-2", "build-", "build-x", ""} {
+		if _, ok := link.BuildAskedAt(id); ok {
+			t.Errorf("%q read as a request time", id)
+		}
+	}
+}

cmd/mesh-controller/bus_step.go

@@ -0,0 +1,410 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"flag"
+	"fmt"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/nats-io/nats.go"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// The bus as a planned step (novox/hq to-be 45 §8, ADR 0227 rule 8, ADR 0236).
+//
+// **A bus upgrade is never rolled out.** The bus carries every declaration, every report and the
+// controller's own lease; a new bus build that does not come up is a mesh nobody can tell anything,
+// and a version whose data format moved (2.10 → 2.11) cannot be undone by putting the old one back.
+// So nothing sends a new bus build on its own: its policy is `record` whatever anyone says (the
+// catalogue's DerivedUpgrade, and `upgrade` refuses a roll-out), a plan builds it and sends nothing, a
+// cascade holds the machine (ADR 0221), and a push naming that machine is refused while a new bus build
+// waits for it (busHeld). The one way is this verb: a person, with why, the streams snapshotted first,
+// whether it can be reverted said before it starts, the step said as `bus-maintenance` while it runs,
+// and every stream, durable consumer and a round trip checked after (H-bus) — or the step said failed,
+// with its snapshot as the way back.
+
+// busStepProbe is the registry's row for the step; its kinds.
+const (
+	busStepProbe         = "DB"
+	kindBusMaintenance   = "bus-maintenance"
+	kindBusUpgradeFailed = "bus-upgrade-failed"
+)
+
+// busStepBound is how long after its start a bus upgrade must be followed by a healthy bus.
+var busStepBound = 15 * time.Minute
+
+// takeBusSnapshot snapshots every stream before a bus upgrade and answers where the snapshot is: the bus
+// machine's backup holder backs the bus module up now, whose dump is the streams' snapshot (novox/hq ADR
+// 0235). A variable so a test takes none. A person who took one by hand says where with --snapshot-taken,
+// and then none is taken — for a bus whose module does not yet carry the snapshot program.
+var takeBusSnapshot = snapshotTheBusNow
+
+// busPending is what a bus upgrade would do: the bus's module, the machines running it, and, per
+// machine, the build it was last sent against the build the mesh holds. Empty machines: the mesh holds
+// no bus module.
+type busPending struct {
+	module   string
+	machines []string
+	from     map[string]string
+	to       string
+	// same are the commits whose build was made from the same source as the build the mesh holds, or
+	// made the same artifacts and manifest (novox/hq issue 280).
+	same map[string]bool
+}
+
+// moves is whether sending the machine would replace its bus: a build it was not last sent, unless the
+// two builds were made from the same source, or made the same artifacts from the same manifest — a
+// rebuild of the same source for another module's merge changes nothing the machine runs, whatever
+// image digest it made (novox/hq issue 280).
+func (b busPending) moves(machine string) bool {
+	from, known := b.from[machine]
+	if b.module == "" || b.to == "" || (known && sameCommit(from, b.to)) {
+		return false
+	}
+	return !known || !b.same[from]
+}
+
+// pendingBus reads what a bus upgrade would do.
+func pendingBus(ctx context.Context, inv *inventory.Inventory) (busPending, error) {
+	var b busPending
+	shelf, err := inv.Catalogue(ctx)
+	if err != nil {
+		return b, err
+	}
+	for name, m := range shelf {
+		if catalogue.ProvidesBus(m) {
+			b.module = name
+		}
+	}
+	if b.module == "" {
+		return b, nil
+	}
+	current, err := inv.CurrentBuilds(ctx)
+	if err != nil {
+		return b, err
+	}
+	b.to = current[b.module].Commit
+	if b.machines, err = inv.Running(ctx, b.module); err != nil {
+		return b, err
+	}
+	b.from, b.same = map[string]string{}, map[string]bool{}
+	made, err := inv.BuildFingerprints(ctx, b.module)
+	if err != nil {
+		return b, err
+	}
+	for commit, refs := range made {
+		b.same[commit] = refs != "" && refs == made[b.to]
+	}
+	sources, err := inv.BuildSourceFingerprints(ctx, b.module)
+	if err != nil {
+		return b, err
+	}
+	for commit, src := range sources {
+		if src != "" && src == sources[b.to] {
+			b.same[commit] = true
+		}
+	}
+	for _, n := range b.machines {
+		sent, known, err := inv.SentBuilds(ctx, n)
+		if err != nil {
+			return b, err
+		}
+		if known {
+			if c, carried := sent[b.module]; carried {
+				b.from[n] = c
+			}
+		}
+	}
+	return b, nil
+}
+
+// busHeld names the machines a push may not send because sending them would replace the bus: the
+// planned step's, not a push's (ADR 0236). Said with the remedy.
+func busHeld(ctx context.Context, inv *inventory.Inventory, machines []string) (map[string]string, error) {
+	b, err := pendingBus(ctx, inv)
+	if err != nil {
+		return nil, err
+	}
+	out := map[string]string{}
+	for _, n := range machines {
+		for _, holder := range b.machines {
+			if n == holder && b.moves(n) {
+				out[n] = fmt.Sprintf("sending %s would replace the bus (%s %s → %s), which is a planned step: "+
+					"`bus upgrade --why …` snapshots its streams first and checks them after (novox/hq ADR 0236)",
+					n, b.module, short(orNotKnown(b.from[n])), short(b.to))
+			}
+		}
+	}
+	return out, nil
+}
+
+// busCommand is `bus` — what a bus upgrade would do and how the last went — and `bus upgrade`.
+func busCommand(ctx context.Context, args []string) error {
+	sub := ""
+	if len(args) > 0 && !strings.HasPrefix(args[0], "-") {
+		sub, args = args[0], args[1:]
+	}
+	set := flag.NewFlagSet("bus", flag.ContinueOnError)
+	snapshot := set.String("snapshot-taken", "", "where the streams' snapshot a person took is, while the mesh takes none itself")
+	reversible := set.Bool("reversible", false, "the new version can be undone by putting the old one back")
+	irreversible := set.Bool("irreversible", false, "the new version cannot be undone by putting the old one back, "+
+		"and this is the person's explicit word that it runs anyway")
+	why := addHandActFlags(set)
+	if rest, err := parseAround(set, args); err != nil {
+		return err
+	} else if len(rest) > 0 {
+		return errors.New("bus [upgrade --why … --reversible|--irreversible [--snapshot-taken <where>]]")
+	}
+	switch sub {
+	case "":
+		return busStatus(ctx)
+	case "upgrade":
+	default:
+		return fmt.Errorf("bus says what a bus upgrade would do, or `bus upgrade` — not %q", sub)
+	}
+	// Everything refused before anything is done.
+	if err := why.require("bus upgrade"); err != nil {
+		return err
+	}
+	if *reversible == *irreversible {
+		return errors.New("bus upgrade says, before it starts, whether the new version can be undone by putting the " +
+			"old one back: --reversible, or --irreversible as your explicit word that it runs anyway (to-be 45 §8). " +
+			"Nothing was done")
+	}
+	open, err := openStores(ctx)
+	if err != nil {
+		return err
+	}
+	defer open.Close()
+	inv := open.inventory
+	b, err := pendingBus(ctx, inv)
+	if err != nil {
+		return err
+	}
+	if b.module == "" {
+		return errors.New("the mesh holds no module that provides its bus: there is nothing to upgrade")
+	}
+	var moving []string
+	for _, n := range b.machines {
+		if b.moves(n) {
+			moving = append(moving, n)
+		}
+	}
+	if len(moving) == 0 {
+		fmt.Printf("every machine running %s runs the build the mesh holds (%s): nothing to upgrade\n", b.module, short(b.to))
+		return nil
+	}
+	where := strings.TrimSpace(*snapshot)
+	if where == "" {
+		for _, n := range moving {
+			fmt.Printf("snapshotting the bus's streams on %s first (its backup holder, ADR 0235)…\n", n)
+			if where, err = takeBusSnapshot(ctx, b.module, n); err != nil {
+				return fmt.Errorf("the streams could not be snapshotted, so the bus is not replaced: %w — a snapshot "+
+					"taken by hand is said with --snapshot-taken <where>", err)
+			}
+		}
+	}
+	from := map[string]bool{}
+	for _, n := range moving {
+		from[orNotKnown(b.from[n])] = true
+	}
+	step, err := inv.StartBusStep(ctx, inventory.BusStep{Module: b.module, Machines: moving,
+		From: strings.Join(sortedKeys(from), ", "), To: b.to, Snapshot: where, Reversible: *reversible,
+		By: link.Caller(), Why: strings.TrimSpace(*why.why)})
+	if err != nil {
+		return err
+	}
+	cause := "bus-upgrade"
+	if strings.TrimSpace(*why.cause) == "" {
+		why.cause = &cause
+	}
+	why.record(ctx, "bus upgrade", append([]string{b.module}, moving...))
+	fmt.Printf("bus upgrade %d: %s %s → %s on %s; streams snapshotted at %s; %s\n", step.ID, b.module, step.From,
+		short(b.to), strings.Join(moving, ", "), where, map[bool]string{true: "reversible: putting the old build back undoes it",
+			false: "NOT reversible: the snapshot is the only way back"}[*reversible])
+	sent, err := sendRollout(withBusStep(withScope(ctx, sendScope{person: true})), open, moving)
+	if err != nil {
+		_ = inv.EndBusStep(ctx, step.ID, "failed", "the send was refused: "+err.Error())
+		return fmt.Errorf("the bus's machine could not be sent its new build: %w — nothing was replaced", err)
+	}
+	fmt.Printf("sent %s; `bus-maintenance` is open until the bus answers healthy again — every stream, every durable "+
+		"consumer, a round trip to the machines (H-bus) — within %s, or the step is said failed with its snapshot "+
+		"as the way back. `bus` says how it went\n", strings.Join(sent, ", "), busStepBound)
+	return nil
+}
+
+// busStatus is `bus`: what an upgrade would do, and the last step.
+func busStatus(ctx context.Context) error {
+	open, err := openStores(ctx)
+	if err != nil {
+		return err
+	}
+	defer open.Close()
+	b, err := pendingBus(ctx, open.inventory)
+	if err != nil {
+		return err
+	}
+	if b.module == "" {
+		fmt.Println("the mesh holds no module that provides its bus")
+	} else {
+		fmt.Printf("the bus is %s, built %s, on %s; never rolled out — a planned step (`bus upgrade`)\n", b.module,
+			short(b.to), orNone(strings.Join(b.machines, ", ")))
+		for _, n := range b.machines {
+			state := "runs it"
+			if b.moves(n) {
+				state = "runs " + short(orNotKnown(b.from[n])) + ": `bus upgrade` replaces it"
+			}
+			fmt.Printf("  %-10s %s\n", n, state)
+		}
+	}
+	fmt.Println("  `bus upgrade` has the bus machine's backup holder snapshot the streams first (ADR 0235)")
+	s, found, err := open.inventory.LatestBusStep(ctx)
+	if err != nil || !found {
+		return err
+	}
+	state := "running since " + s.Started.Local().Format("2006-01-02 15:04")
+	if s.Ended != nil {
+		state = s.Outcome + " at " + s.Ended.Local().Format("2006-01-02 15:04")
+	}
+	fmt.Printf("last step %d: %s → %s on %s by %s (%s): %s; snapshot %s\n", s.ID, s.From, short(s.To),
+		strings.Join(s.Machines, ", "), orNone(s.By), s.Why, state, s.Snapshot)
+	if s.Found != "" {
+		fmt.Printf("  %s\n", s.Found)
+	}
+	return nil
+}
+
+// probeBusStep is DB: a bus upgrade running is said as `bus-maintenance`; the bus healthy again after
+// the machines reported the new build ends it done; past its bound, unhealthy, it ends failed and is
+// said — urgent, with its snapshot — while the bus is still not healthy.
+func probeBusStep(ctx context.Context, d *doctor) ([]conditions.Observation, error) {
+	inv := d.open.inventory
+	s, found, err := inv.LatestBusStep(ctx)
+	if err != nil || !found {
+		return nil, err
+	}
+	if s.Ended != nil && s.Outcome != "failed" {
+		return nil, nil
+	}
+	problems, err := busHealth(ctx, d)
+	if err != nil {
+		return nil, err
+	}
+	reports, err := inv.LastReports(ctx)
+	if err != nil {
+		return nil, err
+	}
+	applied := true
+	for _, r := range reports {
+		for _, n := range s.Machines {
+			if r.Node == n && (!r.Current || r.Outcome != inventory.OutcomeApplied || r.At == nil || r.At.Before(s.Started)) {
+				applied = false
+				problems = append(problems, n+" has not reported the new bus applied")
+			}
+		}
+	}
+	id := s.Module
+	if s.Ended == nil {
+		switch {
+		case applied && len(problems) == 0:
+			return nil, inv.EndBusStep(ctx, s.ID, "done", "the bus answered healthy after the upgrade")
+		case time.Since(s.Started) > busStepBound:
+			found := strings.Join(problems, "; ")
+			if err := inv.EndBusStep(ctx, s.ID, "failed", found); err != nil {
+				return nil, err
+			}
+			s.Found = found
+		default:
+			return []conditions.Observation{{Scope: conditions.ScopeBus, ID: id, Token: "maintenance",
+				Kind: kindBusMaintenance, Severity: conditions.Warning,
+				Summary: fmt.Sprintf("the bus is being upgraded (step %d, %s → %s on %s, by %s: %s); its snapshot is %s",
+					s.ID, s.From, short(s.To), strings.Join(s.Machines, ", "), orNone(s.By), s.Why, s.Snapshot),
+				Said: orNone(strings.Join(problems, "; "))}}, nil
+		}
+	}
+	if len(problems) == 0 {
+		return nil, nil // failed, and healthy since: nothing wrong now
+	}
+	way := "put the old build back"
+	if !s.Reversible {
+		way = "restore the snapshot"
+	}
+	return []conditions.Observation{{Scope: conditions.ScopeBus, ID: id, Token: "upgrade-failed",
+		Kind: kindBusUpgradeFailed, Severity: conditions.Urgent, Resolver: conditions.ResolverOperator,
+		Summary: fmt.Sprintf("the bus upgrade (step %d, %s → %s) did not end healthy within %s: %s — the way back is to %s (%s)",
+			s.ID, s.From, short(s.To), busStepBound, strings.Join(problems, "; "), way, s.Snapshot)}}, nil
+}
+
+func sortedKeys(set map[string]bool) []string {
+	out := make([]string, 0, len(set))
+	for k := range set {
+		out = append(out, k)
+	}
+	sort.Strings(out)
+	return out
+}
+
+// busSnapshotWithin is how long the bus machine's backup holder is given to take the bus's snapshot.
+var busSnapshotWithin = 15 * time.Minute
+
+// snapshotTheBusNow asks the bus machine's backup holder to back the bus module up now — its dump is
+// the streams' snapshot (novox/hq ADR 0235) — and waits until it says a backup newer than the ask:
+// where the snapshot is, as a person reads it. The serving controller's connection, or one of its own.
+func snapshotTheBusNow(ctx context.Context, module, node string) (string, error) {
+	var where string
+	err := onTheBus(func(conn *nats.Conn) error {
+		asked := time.Now()
+		answer, err := link.AskSeatTool(ctx, conn, catalogue.BackupSeat, "now", node,
+			map[string]any{"module": module}, 30*time.Second)
+		if err != nil {
+			return fmt.Errorf("%s's backup holder was not asked to take the bus's snapshot: %w", node, err)
+		}
+		if answer.Error != "" {
+			return fmt.Errorf("%s's backup holder would not take the bus's snapshot: %s", node, answer.Error)
+		}
+		deadline := time.Now().Add(busSnapshotWithin)
+		for {
+			answer, err := link.AskSeatTool(ctx, conn, catalogue.BackupSeat, "backed-up", node, map[string]any{}, 10*time.Second)
+			if err == nil && answer.Error == "" {
+				if measured, err := readHolder(answer.Result); err == nil {
+					for item, m := range measured[module] {
+						if m.LastBackup != nil && m.LastBackup.After(asked) && m.Error == "" {
+							where = fmt.Sprintf("%s's restore point of %s (%s) taken %s", node, module, item,
+								m.LastBackup.UTC().Format(time.RFC3339))
+							return nil
+						}
+					}
+				}
+			}
+			if time.Now().After(deadline) {
+				return fmt.Errorf("%s's backup holder did not say the bus's snapshot was taken within %s; the bus is "+
+					"not replaced", node, busSnapshotWithin)
+			}
+			select {
+			case <-ctx.Done():
+				return ctx.Err()
+			case <-time.After(10 * time.Second):
+			}
+		}
+	})
+	return where, err
+}
+
+// errBusWaits is a send refused because it would replace the bus outside its planned step.
+var errBusWaits = errors.New("a new bus build waits for its planned step")
+
+type busStepKey struct{}
+
+// withBusStep marks a send as the bus's planned step: the one send that may replace the bus.
+func withBusStep(ctx context.Context) context.Context {
+	return context.WithValue(ctx, busStepKey{}, true)
+}
+
+func busStepSending(ctx context.Context) bool { on, _ := ctx.Value(busStepKey{}).(bool); return on }

cmd/mesh-controller/bus_waits.go

@@ -0,0 +1,195 @@
+package main
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// A send held for the bus's planned step (novox/hq issue 336).
+//
+// **A wait only a person can end is said to that person at once.** No send replaces the bus but its planned
+// step (sendToEach, ADR 0236), and the step is a person's `bus upgrade`. So while a new bus build waits, every
+// walk whose tier sends to the bus's machine is refused, and tries again each tick. The refusal was kept only
+// as the walk's note; nothing was raised, and the operator found the hold by asking why a walk did not move.
+// Row S17 raises it on the first tick after the first refusal, in the bus's scope, for the operator: what
+// waits, behind which bus build, since when, and the verb. A walk held only by it is not late, so S3 leaves it
+// out, as it leaves out a walk under a paused build seat. It clears once the bus's machine has been sent the
+// build the mesh holds — the step was taken, and no send is refused for the bus any more — whatever the walks'
+// notes still say. Whether the new bus came up healthy is the step's own condition (probe DB).
+
+// kindBusStepWaiting is S17's kind: bus.<module>.step-waiting.
+const kindBusStepWaiting = "bus-step-waiting"
+
+// busFacts is a new bus build waiting for its planned step, and the sends held for it.
+type busFacts struct {
+	module, to string
+	// from is the build each machine of the bus runs; machines those whose bus the step would replace.
+	from     map[string]string
+	machines []string
+	waits    []busWaitFacts
+}
+
+// busWaitFacts is one walk whose send was refused because it would replace the bus.
+type busWaitFacts struct {
+	plan, repository, commit string
+	// modules are what its tier sends: what waits.
+	modules []string
+	// since is the first refusal: as this controller saw it, or, read back, the save that kept the refusal.
+	since time.Time
+}
+
+// busRefusedFirst is when this controller first saw each walk refused for the bus's step. The walk's note
+// keeps the refusal across a restart; this keeps its moment more exactly than the walk's last save.
+var busRefusedFirst = &firstSeen{at: map[string]time.Time{}}
+
+type firstSeen struct {
+	mu sync.Mutex
+	at map[string]time.Time
+}
+
+// mark keeps the first moment an id was seen.
+func (s *firstSeen) mark(id string, at time.Time) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if _, seen := s.at[id]; !seen {
+		s.at[id] = at
+	}
+}
+
+// of is when an id was first seen; zero when it was not.
+func (s *firstSeen) of(id string) time.Time {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.at[id]
+}
+
+// keepOnly forgets every id not given: a walk no longer held is not held since then.
+func (s *firstSeen) keepOnly(ids map[string]bool) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	for id := range s.at {
+		if !ids[id] {
+			delete(s.at, id)
+		}
+	}
+}
+
+// refusedForTheBus is whether an error is the refusal of a send for the bus's planned step.
+func refusedForTheBus(err error) bool {
+	return err != nil && strings.Contains(err.Error(), errBusWaits.Error())
+}
+
+// busWaitsOf is the sends held for the bus's step, from the open walks: each walk not waiting for its
+// delivery's word whose note keeps a refusal for this very bus build, while the build would still replace
+// the bus on a machine. first is when this controller first saw a walk refused, zero when it did not.
+func busWaitsOf(plans []inventory.Plan, b busPending, first func(string) time.Time) busFacts {
+	f := busFacts{module: b.module, to: b.to, from: b.from}
+	for _, n := range b.machines {
+		if b.moves(n) {
+			f.machines = append(f.machines, n)
+		}
+	}
+	if len(f.machines) == 0 {
+		return f
+	}
+	for _, p := range plans {
+		if !p.Open() || p.Waiting() || !strings.Contains(p.Note, errBusWaits.Error()) || !strings.Contains(p.Note, short(b.to)) {
+			continue
+		}
+		since := p.Updated
+		if seen := first(p.ID); !seen.IsZero() && (since.IsZero() || seen.Before(since)) {
+			since = seen
+		}
+		var modules []string
+		if p.Tier >= 0 && p.Tier < len(p.Tiers) {
+			modules = append(modules, p.Tiers[p.Tier]...)
+		} else {
+			modules = planModules(p)
+		}
+		sort.Strings(modules)
+		f.waits = append(f.waits, busWaitFacts{plan: p.ID, repository: p.Repository, commit: p.Commit, modules: modules,
+			since: since})
+	}
+	sort.Slice(f.waits, func(i, j int) bool { return f.waits[i].since.Before(f.waits[j].since) })
+	return f
+}
+
+// heldByTheBus is the walks of a bus's facts, by id: what S3 leaves out.
+func (b busFacts) heldByTheBus() map[string]bool {
+	out := map[string]bool{}
+	for _, w := range b.waits {
+		out[w.plan] = true
+	}
+	return out
+}
+
+// busUpgradeVerb is the call that ends the wait, as the summary names it: through the mesh MCP server, with
+// why, saying whether the new version can be undone ("reversible": "true") or not ("irreversible": "true").
+const busUpgradeVerb = "`mesh_call mesh-controller.bus {\"upgrade\": \"true\", \"why\": \"…\", \"reversible\" or \"irreversible\": \"true\"}`"
+
+// watchBusWaits is S17: a send held for the bus's planned step, said at once to the operator.
+func watchBusWaits(f *signalFacts) []conditions.Observation {
+	b := f.bus
+	if len(b.waits) == 0 || len(b.machines) == 0 {
+		return nil
+	}
+	since := b.waits[0].since
+	var walks, what []string
+	for _, w := range b.waits {
+		walks = append(walks, fmt.Sprintf("%s (%s %s, tier: %s)", w.plan, w.repository, short(w.commit),
+			strings.Join(w.modules, ", ")))
+		what = append(what, deliveryWhat(w.modules, w.repository))
+	}
+	var from []string
+	for _, n := range b.machines {
+		from = append(from, short(orNotKnown(b.from[n])))
+	}
+	machines := namesWords(b.machines, 3)
+	in := f.now.Sub(since)
+	return []conditions.Observation{{Scope: conditions.ScopeBus, ID: b.module, Token: "step-waiting",
+		Kind: kindBusStepWaiting, Severity: conditions.Warning, Resolver: conditions.ResolverOperator,
+		Machine: b.machines[0], Also: b.machines[1:],
+		Summary: fmt.Sprintf("sends to %s wait for the bus's planned step: a new bus build (%s %s → %s) would replace "+
+			"the bus there, which only a person's %s does; waiting since %s: %s", strings.Join(b.machines, ", "),
+			b.module, strings.Join(sortedUnique(from), ", "), short(b.to), busUpgradeVerb,
+			since.UTC().Format(time.RFC3339), strings.Join(walks, "; ")),
+		Said:     fmt.Sprintf("%d walk(s) refused since %s", len(b.waits), since.UTC().Format(time.RFC3339)),
+		Headline: clipWords("Sends to "+machines+" wait for a bus upgrade", conditions.HeadlineMax),
+		Explanation: clipWords(fmt.Sprintf("A new version of the mesh's message system is built, and only a person "+
+			"installs it. Until then nothing else is sent to %s: %s waits, for %s so far.", machines,
+			namesWords(sortedUnique(what), 3), humanDuration(in)), conditions.ExplanationMax),
+		Needs:    "start the bus upgrade " + FromMeshMCPServer,
+		Resolved: "Resolved: the bus upgrade started, and sends go on"}}
+}
+
+// sortedUnique is a list sorted, each once.
+func sortedUnique(xs []string) []string {
+	seen := map[string]bool{}
+	var out []string
+	for _, x := range xs {
+		if !seen[x] {
+			seen[x] = true
+			out = append(out, x)
+		}
+	}
+	sort.Strings(out)
+	return out
+}
+
+// clipWords keeps a plain sentence within a bound, at a word.
+func clipWords(s string, n int) string {
+	if len(s) <= n {
+		return s
+	}
+	cut := strings.LastIndex(s[:n-1], " ")
+	if cut <= 0 {
+		cut = n - 1
+	}
+	return s[:cut] + "…"
+}

cmd/mesh-controller/bus_waits_test.go

@@ -0,0 +1,159 @@
+package main
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// novox/hq issue 336: a send held because it would replace the bus outside its planned step waits for a
+// person, so a person is told at once — what waits, behind which bus build, since when, and the verb that
+// ends it — and the wait is not read as a walk running late.
+
+// aBusOnAnchor is a new bus build waiting for its step on anchor: nats 88135ad0 there, 32307bd1 held.
+func aBusOnAnchor() busPending {
+	return busPending{module: "nats", machines: []string{"anchor"}, from: map[string]string{"anchor": "88135ad0aaaa"},
+		to: "32307bd1bbbb", same: map[string]bool{}}
+}
+
+// refusedNote is the note a walk keeps when its send was refused for the bus, as advanceHeld writes it.
+func refusedNote(b busPending, tier int) string {
+	held := "sending anchor would replace the bus (nats " + short(b.from["anchor"]) + " → " + short(b.to) +
+		"), which is a planned step: `bus upgrade --why …` snapshots its streams first and checks them after (novox/hq ADR 0236)"
+	return "tier " + string(rune('0'+tier)) + ": " + errBusWaits.Error() + ": " + held + " — tried again"
+}
+
+func TestASendHeldForTheBusStepIsFoundFromTheWalksItHolds(t *testing.T) {
+	now := time.Date(2026, 10, 8, 18, 30, 0, 0, time.UTC)
+	b := aBusOnAnchor()
+	walk := func(id, repo, note string, updated time.Time) inventory.Plan {
+		return inventory.Plan{ID: id, Repository: repo, Commit: "c0ffee001122", State: inventory.PlanRolling, Tier: 0,
+			Tiers: [][]string{{"mesh-host"}}, Modules: map[string]*inventory.PlanModule{"mesh-host": {}}, Note: note,
+			Updated: updated}
+	}
+	for _, c := range []struct {
+		name  string
+		bus   busPending
+		plans []inventory.Plan
+		first map[string]time.Time
+		want  []string
+		since time.Time
+	}{
+		{"a walk refused for the bus", b,
+			[]inventory.Plan{walk("plan-1", "novox/mesh-host", refusedNote(b, 0), now.Add(-27*time.Minute))}, nil,
+			[]string{"plan-1"}, now.Add(-27 * time.Minute)},
+		{"refused earlier than its last save, as this controller saw it", b,
+			[]inventory.Plan{walk("plan-1", "novox/mesh-host", refusedNote(b, 0), now.Add(-5*time.Minute))},
+			map[string]time.Time{"plan-1": now.Add(-28 * time.Minute)}, []string{"plan-1"}, now.Add(-28 * time.Minute)},
+		{"a walk refused for another reason", b,
+			[]inventory.Plan{walk("plan-1", "novox/mesh-host", "tier 0: the build seat is paused — tried again", now)}, nil,
+			nil, time.Time{}},
+		{"refused for an older bus build than the one held now", func() busPending { o := b; o.to = "99999999cccc"; return o }(),
+			[]inventory.Plan{walk("plan-1", "novox/mesh-host", refusedNote(b, 0), now)}, nil, nil, time.Time{}},
+		{"the bus already runs the build held: its step started", func() busPending {
+			o := aBusOnAnchor()
+			o.from = map[string]string{"anchor": o.to}
+			return o
+		}(), []inventory.Plan{walk("plan-1", "novox/mesh-host", refusedNote(b, 0), now)}, nil, nil, time.Time{}},
+		{"a walk waiting for its delivery's word asks no send", b, func() []inventory.Plan {
+			p := walk("plan-1", "novox/mesh-host", refusedNote(b, 0), now)
+			p.Delivery = &inventory.PlanDelivery{Awaits: "mesh-delivery"}
+			return []inventory.Plan{p}
+		}(), nil, nil, time.Time{}},
+	} {
+		t.Run(c.name, func(t *testing.T) {
+			got := busWaitsOf(c.plans, c.bus, func(id string) time.Time { return c.first[id] })
+			var ids []string
+			for _, w := range got.waits {
+				ids = append(ids, w.plan)
+			}
+			if strings.Join(ids, ",") != strings.Join(c.want, ",") {
+				t.Fatalf("held for the bus: %v, want %v", ids, c.want)
+			}
+			if len(c.want) > 0 {
+				if !got.waits[0].since.Equal(c.since) {
+					t.Errorf("waiting since %s, want %s", got.waits[0].since, c.since)
+				}
+				if strings.Join(got.machines, ",") != "anchor" || got.to != b.to || got.module != "nats" {
+					t.Errorf("behind %+v", got)
+				}
+			}
+		})
+	}
+}
+
+// **Said at once, not as lateness, and cleared when the step starts**: the walk held only for the bus raises
+// the bus's condition on the first tick, before any tier bound, naming what waits, the bus build from and to,
+// since when and `bus upgrade`, for the operator; S3 says nothing of it even past its bound; and the
+// condition clears once the bus's machine runs the new build.
+func TestASendHeldForTheBusStepIsSaidAtOnceAndNotAsLateness(t *testing.T) {
+	now := time.Date(2026, 10, 8, 18, 30, 0, 0, time.UTC)
+	b := aBusOnAnchor()
+	held := func(entered time.Duration) *signalFacts {
+		f := calm(now)
+		f.plans = []planFacts{{id: "plan-1", repository: "novox/mesh-host", commit: "c0ffee00", tier: 0, tiers: 1,
+			entered: now.Add(-entered), bound: 30 * time.Minute, waiting: refusedNote(b, 0), bus: true}}
+		f.bus = busFacts{module: "nats", to: b.to, from: b.from, machines: []string{"anchor"},
+			waits: []busWaitFacts{{plan: "plan-1", repository: "novox/mesh-host", commit: "c0ffee001122",
+				modules: []string{"mesh-host"}, since: now.Add(-time.Minute)}}}
+		return f
+	}
+
+	f := held(time.Minute)
+	got := watchBusWaits(f)
+	if len(got) != 1 {
+		t.Fatalf("a send held for the bus a minute ago raised %+v", got)
+	}
+	o := got[0]
+	if o.Key() != "bus.nats.step-waiting" || o.Kind != kindBusStepWaiting || o.Resolver != conditions.ResolverOperator {
+		t.Fatalf("raised %s (%s), resolver %q", o.Key(), o.Kind, o.Resolver)
+	}
+	for _, want := range []string{"anchor", "mesh-host", "88135ad0", "32307bd1", "mesh_call mesh-controller.bus",
+		`"upgrade": "true"`, `"reversible"`, `"irreversible"`, "2026-10-08T18:29:00Z", "plan-1"} {
+		if !strings.Contains(o.Summary, want) {
+			t.Errorf("its summary does not say %q: %s", want, o.Summary)
+		}
+	}
+	if !strings.Contains(o.Explanation, "mesh-host") || !strings.Contains(o.Headline, "bus upgrade") || o.Needs == "" {
+		t.Errorf("its words do not say what waits and what the operator does: %+v", o)
+	}
+	if why, ok := conditions.PlainWords(conditions.Words{Headline: o.Headline, Explanation: o.Explanation,
+		Resolved: o.Resolved, Needs: o.Needs}, "anchor"); !ok {
+		t.Errorf("its words are not plain: %s", why)
+	}
+
+	// Past S3's bound: still the bus's wait, never a stalled walk.
+	late := held(45 * time.Minute)
+	if s3 := watchPlans(late); len(s3) != 0 {
+		t.Fatalf("a walk held only by the bus step was said stalled: %+v", s3)
+	}
+	// A walk held for something else past its bound is still stalled.
+	other := held(45 * time.Minute)
+	other.plans[0].bus = false
+	if s3 := watchPlans(other); len(s3) != 1 {
+		t.Fatalf("a walk held for something else past its bound raised %+v", s3)
+	}
+
+	// Through the keeper: open at the first tick, cleared when the step started.
+	store := conditions.NewInMemory()
+	k := conditions.NewKeeper(t.Context(), conditions.Options{Store: store, History: store, Teller: &conditions.Told{},
+		Now: func() time.Time { return now }})
+	defer k.Close(context.Background())
+	w := &watchdogs{keeper: k, started: now.Add(-time.Hour)}
+	w.see(t.Context(), held(time.Minute))
+	open, err := k.Open(t.Context())
+	if err != nil || len(open) != 1 || open[0].Key != "bus.nats.step-waiting" {
+		t.Fatalf("after the first tick, open: %+v (%v)", open, err)
+	}
+	started := held(time.Minute)
+	started.bus = busFacts{module: "nats", to: b.to}
+	started.plans[0].bus = false
+	w.see(t.Context(), started)
+	if open, _ := k.Open(t.Context()); len(open) != 0 {
+		t.Fatalf("the step started, and open: %+v", open)
+	}
+}

cmd/mesh-controller/busobjects.go

@@ -0,0 +1,210 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// The streams and durable consumers the mesh's own traffic needs, derived once (novox/hq to-be 45 §4,
+// D6 and D7).
+//
+// **What the controller asserts at its start and what the self-check expects to find are one
+// derivation**, run against the bus to make them and against a recorder to list them. Two lists would
+// drift, and a self-check comparing the bus with a second opinion of what should be there would find
+// the drift rather than the fault.
+
+// assertBusObjects brings every stream and consumer into being on r, and answers the machines that
+// can now hear a declaration.
+func assertBusObjects(ctx context.Context, inv *inventory.Inventory, r broker.Raiser) ([]string, error) {
+	nodes, err := inv.Nodes(ctx)
+	if err != nil {
+		return nil, err
+	}
+	names := make([]string, 0, len(nodes))
+	for _, n := range nodes {
+		names = append(names, n.Name)
+	}
+	if err := broker.Raise(r, names); err != nil {
+		return nil, err
+	}
+	// The work queues of the mesh's own roles (novox/hq ADR 0121). The queue before the holder,
+	// deliberately: work queues until somebody arrives to do it, so assigning a build machine a week
+	// after something started asking for builds flushes the backlog instead of having lost it.
+	// With the seats' holders, so each role's work queue gets the consumer its holder takes
+	// work from. Passed as nil until the first live raise, which left the build machine bound to a
+	// consumer nothing had created (2026-09-28).
+	holders, err := seatHolders(ctx, inv)
+	if err != nil {
+		return nil, err
+	}
+	if err := broker.RaiseSeats(r, inventory.MeshSeats(), holders); err != nil {
+		return nil, err
+	}
+	// And how every module hears what it consumes. Derived from the same records the user list is
+	// composed from, so a module the mesh grants a consumer's subjects has that consumer waiting.
+	// Done on every raise, not only when a credential is issued: every module moved onto this bus
+	// by the rollout was issued on the old one, and came up with nothing to bind to (2026-09-28).
+	consumers, err := moduleConsumers(ctx, inv)
+	if err != nil {
+		return nil, err
+	}
+	// And the work queues of seats that name their caller or their kind, with each holder's worker
+	// (novox/hq ADR 0259 §3): an ask queues until the router takes it, a channel's work until that kind
+	// takes it.
+	trafficStreams, trafficWorkers, err := seatTrafficObjects(ctx, inv)
+	if err != nil {
+		return nil, err
+	}
+	// Every one tried, and every failure named: one module's consumer the bus refuses is no reason
+	// the modules after it in the list hear nothing (novox/hq issue 208, where this runs on each send).
+	var failed []error
+	for _, s := range trafficStreams {
+		if err := r.EnsureStream(s); err != nil {
+			failed = append(failed, fmt.Errorf("the work queue %s: %w", s.Name, err))
+		}
+	}
+	for _, c := range trafficWorkers {
+		if err := r.EnsureConsumer(c); err != nil {
+			failed = append(failed, fmt.Errorf("the worker %s on %s: %w", c.Name, c.Stream, err))
+		}
+	}
+	for _, c := range consumers {
+		if err := r.EnsureConsumer(c.Consumer); err != nil {
+			failed = append(failed, fmt.Errorf("how %s on %s hears what it consumes: %w", c.Module, c.Node, err))
+		}
+	}
+	if len(failed) > 0 {
+		return nil, errors.Join(failed...)
+	}
+	return names, nil
+}
+
+// What raises the condition a send says when the objects it implies could not be asserted, and its kind.
+const (
+	sourceBusObjects         = "bus-objects"
+	kindBusObjectsUnasserted = "bus-objects-unasserted"
+)
+
+// assertOnSend asserts, on the bus a send is about to use, every object assertBusObjects derives —
+// **whenever a declaration is sent, not only when the controller starts** (novox/hq issue 208).
+//
+// A module assigned after the controller started was sent its declaration and found no consumer to
+// bind (`consumer not found`, messenger on 2026-10-06), and a seat holder assigned after it found no
+// worker: the objects a declaration implies were asserted at start and nowhere else, so they existed
+// only for what was assigned before the last restart. The same derivation, not a second list of what
+// a send needs: what start asserts, the self-check expects and a send asserts are one answer. Every
+// part is idempotent, so asserting the whole of it again is the no-op a restart already relies on.
+//
+// **A failure is said and raised, and the send goes on.** The objects are the mesh's, not the
+// machines' being sent: holding every machine back for one consumer that none of them may use would
+// turn one fault into all of them, and the declarations are not what is wrong. It is never silent —
+// said in the send's own output and raised as a condition, which the next send that asserts them
+// clears — and the start-time raise still refuses to serve without them.
+func assertOnSend(ctx context.Context, inv *inventory.Inventory, r broker.Raiser, indent string) error {
+	_, err := assertBusObjects(ctx, inv, r)
+	var observed []conditions.Observation
+	if err != nil {
+		fmt.Printf("%sTHE BUS DOES NOT HOLD WHAT THIS SEND IMPLIES: %v\n", indent, err)
+		fmt.Printf("%s  a module may find no consumer to bind, or a holder no worker; sent anyway, raised as "+
+			"condition %s, and asserted again by the next send\n", indent, unassertedObservation(err).Key())
+		observed = append(observed, unassertedObservation(err))
+	}
+	// Observed when it failed, cleared when it did not: a send that asserted everything is the
+	// observation that the bus holds what it should.
+	if kerr := withKeeper(ctx, func(k *conditions.Keeper) error {
+		return k.Reconcile(ctx, sourceBusObjects, observed)
+	}); kerr != nil {
+		fmt.Printf("%sand whether the bus holds what this send implies could not be kept as a condition: %v\n",
+			indent, kerr)
+	}
+	return err
+}
+
+// unassertedObservation is a send's failure to assert the bus's objects, as a condition.
+func unassertedObservation(err error) conditions.Observation {
+	return conditions.Observation{Scope: conditions.ScopeBus, ID: "objects", Token: "unasserted",
+		Kind: kindBusObjectsUnasserted, Severity: conditions.Warning, Source: sourceBusObjects,
+		Summary: "the bus's streams and consumers could not be asserted when a declaration was sent: " +
+			"a module may find no consumer to bind, or a seat's holder no worker",
+		Said: err.Error()}
+}
+
+// moduleConsumers is every module's durable consumer, from the records the user list is composed from.
+func moduleConsumers(ctx context.Context, inv *inventory.Inventory) ([]broker.ModuleConsumer, error) {
+	records, err := inv.BusRecords(ctx)
+	if err != nil {
+		return nil, err
+	}
+	users, err := broker.Users(records)
+	if err != nil {
+		return nil, err
+	}
+	return broker.ConsumersOf(users), nil
+}
+
+// seatTrafficObjects is the work queues and workers of seats that name their caller or their kind, from
+// the records the user list is composed from.
+func seatTrafficObjects(ctx context.Context, inv *inventory.Inventory) ([]broker.Stream, []broker.Consumer, error) {
+	records, err := inv.BusRecords(ctx)
+	if err != nil {
+		return nil, nil, err
+	}
+	users, err := broker.Users(records)
+	if err != nil {
+		return nil, nil, err
+	}
+	streams, workers := broker.SeatTrafficObjects(users)
+	// And the queue of every such seat the catalogue declares, held or not: work queues from registration,
+	// so what is submitted before a holder is assigned waits for it (the correctness review of 2026-10-08).
+	declared, err := inv.DeclaredTrafficSeats(ctx)
+	if err != nil {
+		return nil, nil, err
+	}
+	have := map[string]bool{}
+	for _, s := range streams {
+		have[s.Name] = true
+	}
+	for _, s := range broker.TrafficQueues(declared) {
+		if !have[s.Name] {
+			streams = append(streams, s)
+			have[s.Name] = true
+		}
+	}
+	return streams, workers, nil
+}
+
+// moduleConsumerCount is how many modules hear what they consume, for the raise's one line.
+func moduleConsumerCount(ctx context.Context, inv *inventory.Inventory) (int, error) {
+	consumers, err := moduleConsumers(ctx, inv)
+	return len(consumers), err
+}
+
+// expectedBusObjects is every stream and consumer assertBusObjects would make, made nowhere.
+func expectedBusObjects(ctx context.Context, inv *inventory.Inventory) ([]broker.Stream, []broker.Consumer, error) {
+	var rec recordingRaiser
+	if _, err := assertBusObjects(ctx, inv, &rec); err != nil {
+		return nil, nil, fmt.Errorf("what the bus should hold cannot be worked out: %w", err)
+	}
+	return rec.streams, rec.consumers, nil
+}
+
+// recordingRaiser keeps what it was asked to assert and asserts nothing.
+type recordingRaiser struct {
+	streams   []broker.Stream
+	consumers []broker.Consumer
+}
+
+func (r *recordingRaiser) EnsureStream(s broker.Stream) error {
+	r.streams = append(r.streams, s)
+	return nil
+}
+
+func (r *recordingRaiser) EnsureConsumer(c broker.Consumer) error {
+	r.consumers = append(r.consumers, c)
+	return nil
+}

cmd/mesh-controller/busobjects_test.go

@@ -0,0 +1,197 @@
+package main
+
+import (
+	"errors"
+	"strings"
+	"testing"
+
+	"github.com/nats-io/nats.go"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+
+	"github.com/novox/mesh-controller/internal/testbus"
+)
+
+// novox/hq issue 208: the bus's objects a declaration implies are asserted whenever one is sent, not
+// only when the controller starts.
+
+// aCarriedConsumer is the runtime on laptop and, carried by it, a module that consumes an event: the
+// shape of messenger on 2026-10-06, assigned after the controller started.
+func aCarriedConsumer(t *testing.T, open *stores) broker.Consumer {
+	t.Helper()
+	register(t, open, catalogue.Manifest{Module: catalogue.RuntimeModule, Version: "1",
+		OwnSecrets: catalogue.OwnSecrets{"broker": {Path: "/var/lib/mesh/node-tools/broker"}}})
+	register(t, open, catalogue.Manifest{Module: "messenger", Version: "1",
+		Consumes: []string{"billing.order.placed"}})
+	for _, m := range []string{catalogue.RuntimeModule, "messenger"} {
+		if _, err := open.inventory.Assign(t.Context(), "laptop", m); err != nil {
+			t.Fatal(err)
+		}
+	}
+	consumers, err := moduleConsumers(t.Context(), open.inventory)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, c := range consumers {
+		if c.Module == "messenger" && c.Node == "laptop" {
+			return c.Consumer
+		}
+	}
+	t.Fatalf("messenger on laptop is derived no consumer: %+v", consumers)
+	return broker.Consumer{}
+}
+
+// aLateHolder is a module holding the build agent's seat on anchor, assigned after the controller
+// started, and the worker its seat's queue should have for it.
+func aLateHolder(t *testing.T, open *stores) broker.Consumer {
+	t.Helper()
+	register(t, open, catalogue.Manifest{Module: "late-builder", Version: "1",
+		Claims: []catalogue.Claim{{Name: "node-build-agent", Scope: catalogue.ScopeNode}}})
+	if _, err := open.inventory.Assign(t.Context(), "anchor", "late-builder"); err != nil {
+		t.Fatal(err)
+	}
+	for _, s := range inventory.MeshSeats() {
+		if s.Name == "node-build-agent" {
+			c, needed := broker.HolderConsumerFor("anchor", "late-builder", s)
+			if !needed {
+				t.Fatal("the build agent's seat needs no worker")
+			}
+			return c
+		}
+	}
+	t.Fatal("the mesh declares no build agent's seat")
+	return broker.Consumer{}
+}
+
+// asserted says whether a recording holds a consumer by stream and name.
+func asserted(rec *recordingRaiser, want broker.Consumer) bool {
+	for _, c := range rec.consumers {
+		if c.Stream == want.Stream && c.Name == want.Name {
+			return true
+		}
+	}
+	return false
+}
+
+// What a send asserts includes what was assigned after the start's assertion: a carried module's
+// consumer and a late holder's worker. The derivation is the start's own, so this holds without a bus.
+func TestASendAssertsWhatWasAssignedAfterStart(t *testing.T) {
+	open := aMesh(t)
+	var atStart recordingRaiser
+	if _, err := assertBusObjects(t.Context(), open.inventory, &atStart); err != nil {
+		t.Fatal(err)
+	}
+	consumer := aCarriedConsumer(t, open)
+	worker := aLateHolder(t, open)
+	if asserted(&atStart, consumer) || asserted(&atStart, worker) {
+		t.Fatal("the start asserted what was not yet assigned; the test proves nothing")
+	}
+	var onSend recordingRaiser
+	if err := assertOnSend(t.Context(), open.inventory, &onSend, ""); err != nil {
+		t.Fatal(err)
+	}
+	if !asserted(&onSend, consumer) {
+		t.Fatalf("messenger's consumer %s on %s is not asserted by the send: %+v", consumer.Name, consumer.Stream, onSend.consumers)
+	}
+	if !asserted(&onSend, worker) {
+		t.Fatalf("the late holder's worker %s on %s is not asserted by the send: %+v", worker.Name, worker.Stream, onSend.consumers)
+	}
+}
+
+// failingRaiser refuses one consumer by name and records everything it was asked.
+type failingRaiser struct {
+	recordingRaiser
+	refuse string
+}
+
+func (f *failingRaiser) EnsureConsumer(c broker.Consumer) error {
+	f.consumers = append(f.consumers, c)
+	if c.Name == f.refuse {
+		return errors.New("nats: API error: code=503 description=insufficient resources")
+	}
+	return nil
+}
+
+// A send whose objects cannot be asserted says so in its output and raises a condition — and the next
+// send that asserts them clears it. The consumers after the refused one are still asked for.
+func TestASendThatCannotAssertTheBusSaysSoAndRaisesACondition(t *testing.T) {
+	open := aMesh(t)
+	consumer := aCarriedConsumer(t, open)
+	worker := aLateHolder(t, open)
+	failing := &failingRaiser{refuse: consumer.Name}
+
+	var sendErr error
+	out := stdoutOf(t, func() error {
+		sendErr = assertOnSend(t.Context(), open.inventory, failing, "  ")
+		return nil
+	})
+	if sendErr == nil || !strings.Contains(sendErr.Error(), "how messenger on laptop hears what it consumes") {
+		t.Fatalf("the failure is not answered: %v", sendErr)
+	}
+	if !strings.Contains(out, "THE BUS DOES NOT HOLD WHAT THIS SEND IMPLIES") ||
+		!strings.Contains(out, "insufficient resources") || !strings.Contains(out, "bus.objects.unasserted") {
+		t.Fatalf("the failure is not said in the send's output:\n%s", out)
+	}
+	if !asserted(&failing.recordingRaiser, worker) {
+		t.Fatal("the seat's worker was not asked for")
+	}
+	c, open1, err := conditionsFrom.Get(t.Context(), "bus.objects.unasserted")
+	if err != nil || !open1 {
+		t.Fatalf("no condition raised: %v", err)
+	}
+	if c.Kind != kindBusObjectsUnasserted || c.Source != sourceBusObjects ||
+		len(c.Evidence) == 0 || !strings.Contains(c.Evidence[0].Said, "insufficient resources") {
+		t.Fatalf("the condition does not say what failed: %+v", c)
+	}
+
+	// The next send asserts them, and that observation clears it.
+	if err := assertOnSend(t.Context(), open.inventory, &recordingRaiser{}, ""); err != nil {
+		t.Fatal(err)
+	}
+	if _, stillOpen, err := conditionsFrom.Get(t.Context(), "bus.objects.unasserted"); err != nil || stillOpen {
+		t.Fatalf("a send that asserted everything left the condition open: %v", err)
+	}
+}
+
+// Against a real bus, through the send's own grant: a module assigned after start has its consumer
+// once a declaration is sent, and a holder assigned after start its seat's worker.
+func TestNatsAModuleAssignedAfterStartGetsItsConsumerAtItsFirstSend(t *testing.T) {
+	url := testbus.URL(t)
+	open := aMesh(t)
+	js, err := broker.Dial(url)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(js.Close)
+	for _, s := range []string{"CONTROL", "NODES", "ASSIGNMENTS", "EVENTS"} {
+		_ = js.Context().DeleteStream(s)
+	}
+	// The controller starting, before either was assigned.
+	if _, err := assertBusObjects(t.Context(), open.inventory, js); err != nil {
+		t.Fatal(err)
+	}
+	consumer := aCarriedConsumer(t, open)
+	worker := aLateHolder(t, open)
+	_ = js.Context().DeleteConsumer(worker.Stream, worker.Name)
+	for _, c := range []broker.Consumer{consumer, worker} {
+		if _, err := js.Context().ConsumerInfo(c.Stream, c.Name); !errors.Is(err, nats.ErrConsumerNotFound) {
+			t.Fatalf("%s on %s exists before any send; the test proves nothing: %v", c.Name, c.Stream, err)
+		}
+	}
+
+	server := link.ConnectNats(js, nil, nil)
+	if err := (overTheBus{open: open, server: server}).grant(t.Context(), nil); err != nil {
+		t.Fatal(err)
+	}
+	for _, c := range []broker.Consumer{consumer, worker} {
+		if _, err := js.Context().ConsumerInfo(c.Stream, c.Name); err != nil {
+			t.Fatalf("%s on %s is not on the bus after a send: %v", c.Name, c.Stream, err)
+		}
+	}
+	if _, raised, _ := conditionsFrom.Get(t.Context(), "bus.objects.unasserted"); raised {
+		t.Fatal("a send that asserted everything raised a condition")
+	}
+}

cmd/mesh-controller/calls_verb_test.go

@@ -0,0 +1,79 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// consoleWaits is how long the console waits for an answer (mesh-tools node-tools/internal/bus
+// RequestTimeout) — the shortest wait of a caller the mesh ships.
+const consoleWaits = 30 * time.Second
+
+// **A call's one answer is never later than its caller or the bus allow** (novox/hq issue 265): a
+// holder answers within AnswerWithin, which must be inside both the console's wait and the window the
+// bus gives an answer. Before, the console waited 30s, the bus 60s, and a push ran as long as it ran.
+func TestAVerbAnswersInsideEveryWaitOnIt(t *testing.T) {
+	if link.AnswerWithin >= consoleWaits/2 {
+		t.Errorf("a call answers within %s: not well inside the console's %s", link.AnswerWithin, consoleWaits)
+	}
+	if link.AnswerWithin >= broker.ResponseTTL {
+		t.Errorf("a call answers within %s, after the bus stops permitting an answer at %s", link.AnswerWithin, broker.ResponseTTL)
+	}
+}
+
+// A push — named or through command — answers before it runs: it sends the machine holding the bus
+// first, and the broker reloading its user list forgets the answer it was about to permit.
+func TestAPushAnswersBeforeItSends(t *testing.T) {
+	for _, c := range []struct {
+		verb string
+		args map[string]any
+		want bool
+	}{
+		{"push", map[string]any{"node": "anchor", "why": "w"}, true},
+		{"push", map[string]any{"why": "w"}, true},
+		{"command", map[string]any{"command": "builds"}, false},
+		{"status", map[string]any{}, false},
+		{"assign", map[string]any{"node": "anchor", "module": "m"}, false},
+	} {
+		argv, err := argvFor(c.verb, c.args)
+		if err != nil {
+			t.Fatalf("%s %v: %v", c.verb, c.args, err)
+		}
+		if got := answersFirst(argv); got != c.want {
+			t.Errorf("%s %v answers first: %v, want %v", c.verb, c.args, got, c.want)
+		}
+	}
+}
+
+// `calls` is served, takes a call's id and nothing else, and says plainly when it holds no such call.
+func TestCallsIsServedAndSaysWhatItKeeps(t *testing.T) {
+	handlers, behind, err := seatToolHandlers()
+	if err != nil || len(behind) != 0 {
+		t.Fatalf("%v %v", behind, err)
+	}
+	calls, ok := handlers["calls"]
+	if !ok {
+		t.Fatal("calls is not served")
+	}
+	if _, err := calls(context.Background(), json.RawMessage(`{"node":"anchor"}`)); err == nil ||
+		!strings.Contains(err.Error(), `"node"`) {
+		t.Errorf("calls took an argument it does not declare: %v", err)
+	}
+	if _, err := calls(context.Background(), json.RawMessage(`{"call":"call-0-0"}`)); err == nil ||
+		!strings.Contains(err.Error(), "not across a restart") {
+		t.Errorf("an unknown call was not said plainly: %v", err)
+	}
+	got, err := calls(context.Background(), json.RawMessage(`{}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, listed := got.(map[string]any)["calls"]; !listed {
+		t.Errorf("calls answered %v", got)
+	}
+}

cmd/mesh-controller/changeplan.go

@@ -0,0 +1,168 @@
+package main
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// The change plan (novox/hq ADR 0238): **one commit, one plan** — what a change does to the mesh, computed
+// from its diffset (a repository, the branch it merges into, the commit at hand) by the planner, never by
+// a mapping of its own. reachOfMerge answers what moves and what follows it; this adds where each module
+// goes — the deploy plan, machine by machine in the build plan's order — and what is not an ordinary
+// send. A pull request's check posts it with its verdict; the release a merge makes follows the same
+// planner, so the two can be compared.
+
+// policyOf is a module's upgrade policy, as the controller holds it; false when it cannot be read.
+type policyOf func(module string) (inventory.Upgrade, bool)
+
+// changePlanOf is the change plan of a reach: pure, so it is tested without a store.
+func changePlanOf(repository, base, head string, r mergeReach, entries []inventory.Entry, policy policyOf) link.ChangePlan {
+	p := link.ChangePlan{Repository: repository, Base: base, Head: head, Moved: r.Moved(), Dependents: r.Dependents(),
+		New: r.Added, Unread: r.Unread, Tiers: r.Plan.Tiers}
+	byName := map[string]inventory.Entry{}
+	for _, e := range entries {
+		byName[e.Manifest.Module] = e
+	}
+	machines := map[string]*link.MachinePlan{}
+	machine := func(name string) *link.MachinePlan {
+		if machines[name] == nil {
+			machines[name] = &link.MachinePlan{Machine: name}
+		}
+		return machines[name]
+	}
+	for _, tier := range r.Plan.Tiers {
+		for _, name := range tier {
+			e, held := byName[name]
+			if !held {
+				continue
+			}
+			u, known := policy(name)
+			waits := known && !u.RollOut
+			for _, on := range e.On {
+				if waits {
+					machine(on).Waits = append(machine(on).Waits, name)
+				} else {
+					machine(on).Receives = append(machine(on).Receives, name)
+				}
+			}
+			switch {
+			case (name == "nats" || catalogue.ProvidesBus(e.Manifest)) && len(e.On) > 0:
+				// Said before the merge (novox/hq issue 336): a new bus build holds every send to the bus's machine
+				// until a person takes the step, so merging it is a promise to take it.
+				p.Steps = append(p.Steps, fmt.Sprintf("%s: %s is never sent by an ordinary send, and until %s runs, "+
+					"nothing else is sent to %s either — unless the new build turns out the same as the one running there "+
+					"(issue 280)", busUpgradeNeeded, name, busUpgradeVerb, strings.Join(e.On, ", ")))
+			case name == "nats" || catalogue.ProvidesBus(e.Manifest):
+				p.Steps = append(p.Steps, "a planned bus step: the bus is upgraded by `bus upgrade`, never by an ordinary send")
+			case waits && len(e.On) > 0:
+				p.Steps = append(p.Steps, fmt.Sprintf("%s waits for a person: its policy records (%s)", name,
+					orNone(u.From)))
+			}
+			if len(e.Manifest.Provides) > 0 && len(e.On) > 0 {
+				var offers []string
+				for _, o := range e.Manifest.Provides {
+					offers = append(offers, o.Name)
+				}
+				p.Steps = append(p.Steps, fmt.Sprintf("%s provides %s: its consumers are sent again after it",
+					name, strings.Join(offers, ", ")))
+			}
+			if e.Manifest.Data != nil && len(e.On) > 0 {
+				p.Steps = append(p.Steps, fmt.Sprintf("%s keeps data (ADR 0233): what it holds is backed up before it moves", name))
+			}
+		}
+	}
+	var names []string
+	for name := range machines {
+		names = append(names, name)
+	}
+	sort.Strings(names)
+	for _, name := range names {
+		p.Machines = append(p.Machines, *machines[name])
+	}
+	p.Summary = summaryOf(p)
+	return p
+}
+
+// busUpgradeNeeded is how a change plan says that merging it holds the bus's machine for a person's step.
+const busUpgradeNeeded = "merging this needs a person's bus upgrade"
+
+// summaryOf is a change plan in one line: what it builds, where it goes, and whether the bus moves.
+func summaryOf(p link.ChangePlan) string {
+	if len(p.Moved) == 0 && len(p.New) == 0 {
+		return "builds nothing: the change touches no module of the mesh's graph"
+	}
+	var parts []string
+	what := strings.Join(p.Moved, ", ")
+	if len(p.Dependents) > 0 {
+		what += fmt.Sprintf(" (+%d dependent(s))", len(p.Dependents))
+	}
+	if len(p.New) > 0 {
+		if what != "" {
+			what += ", "
+		}
+		what += "new: " + strings.Join(p.New, ", ")
+	}
+	var to []string
+	for _, m := range p.Machines {
+		if len(m.Receives) > 0 {
+			to = append(to, m.Machine)
+		}
+	}
+	if len(to) > 0 {
+		parts = append(parts, "builds "+what+" → "+strings.Join(to, ", "))
+	} else {
+		parts = append(parts, "builds "+what+", sent nowhere")
+	}
+	bus := "no bus step"
+	for _, s := range p.Steps {
+		switch {
+		case strings.HasPrefix(s, busUpgradeNeeded):
+			bus = busUpgradeNeeded
+		case strings.HasPrefix(s, "a planned bus step") && bus == "no bus step":
+			bus = "a bus step"
+		}
+	}
+	parts = append(parts, bus)
+	waiting := 0
+	for _, m := range p.Machines {
+		waiting += len(m.Waits)
+	}
+	if waiting > 0 {
+		parts = append(parts, fmt.Sprintf("%d wait(s) for a person", waiting))
+	}
+	return strings.Join(parts, "; ")
+}
+
+// planText is a change plan as a person reads it, for the pull request's comment.
+func planText(p link.ChangePlan) string {
+	var b strings.Builder
+	fmt.Fprintf(&b, "change plan of %s at %.8s into %s: %s\n", p.Repository, p.Head, p.Base, p.Summary)
+	for i, tier := range p.Tiers {
+		fmt.Fprintf(&b, "  tier %d: %s\n", i, strings.Join(tier, ", "))
+	}
+	for _, m := range p.Machines {
+		line := "  " + m.Machine + ": "
+		if len(m.Receives) > 0 {
+			line += "receives " + strings.Join(m.Receives, ", ")
+		}
+		if len(m.Waits) > 0 {
+			if len(m.Receives) > 0 {
+				line += "; "
+			}
+			line += "waits for a person: " + strings.Join(m.Waits, ", ")
+		}
+		b.WriteString(line + "\n")
+	}
+	for _, s := range p.Steps {
+		b.WriteString("  - " + s + "\n")
+	}
+	if len(p.Unread) > 0 {
+		fmt.Fprintf(&b, "  read by no module's build: %s\n", strings.Join(p.Unread, ", "))
+	}
+	return b.String()
+}

cmd/mesh-controller/changeplan_test.go

@@ -0,0 +1,78 @@
+package main
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// **One commit, one change plan** (novox/hq ADR 0238): the planner's reach, laid out machine by machine in
+// the build plan's order, with what is not an ordinary send said — the bus step, a module that waits for a
+// person, a provider whose consumers follow it.
+func TestAChangePlanSaysWhatEachMachineReceives(t *testing.T) {
+	const catalogue_ = "http://forge.internal:20000/novox/mesh-catalog.git"
+	entry := func(name, path string, on ...string) inventory.Entry {
+		e := fromRepo(name, catalogue_, path)
+		e.Source.BuiltFrom = "old"
+		e.On = on
+		return e
+	}
+	nats := entry("nats", "modules/nats", "anchor")
+	nats.Manifest.Provides = []catalogue.Offer{{Name: "mesh-bus"}}
+	gitea := entry("gitea", "modules/gitea", "anchor")
+	held := entry("photos", "modules/photos", "anchor", "laptop")
+	tools := fromRepo("node-tools", "http://forge.internal:20000/novox/mesh-tools.git", "node-tools")
+	tools.On = []string{"anchor", "laptop"}
+	entries := []inventory.Entry{nats, gitea, held, tools}
+	edges := []inventory.Edge{{From: "node-tools", To: "nats", Kind: inventory.EdgeStandsOn}}
+	policy := func(module string) (inventory.Upgrade, bool) {
+		if module == "photos" {
+			return inventory.Upgrade{RollOut: false, From: "a person"}, true
+		}
+		return inventory.Upgrade{RollOut: true}, true
+	}
+	plan := func(paths ...string) link.ChangePlan {
+		m := link.SourceMoved{Owner: "novox", Repo: "mesh-catalog", Base: "main", Commit: "head", Paths: paths}
+		return changePlanOf("novox/mesh-catalog", "main", "head", reachOfMerge(m, entries, nil, edges), entries, policy)
+	}
+
+	p := plan("modules/gitea/index.ts")
+	if p.Summary != "builds gitea → anchor; no bus step" {
+		t.Errorf("one module's change reads %q", p.Summary)
+	}
+
+	p = plan("modules/nats/Dockerfile", "modules/photos/x.js")
+	if !strings.Contains(p.Summary, "needs a person's bus upgrade") || !strings.Contains(p.Summary, "2 wait(s) for a person") ||
+		!strings.Contains(p.Summary, "(+1 dependent(s))") {
+		t.Errorf("the bus and a held module read %q", p.Summary)
+	}
+	got := map[string]string{}
+	for _, m := range p.Machines {
+		got[m.Machine] = strings.Join(m.Receives, ",") + "|" + strings.Join(m.Waits, ",")
+	}
+	// The bus first, what stands on it after: the build plan's order, per machine.
+	if got["anchor"] != "nats,node-tools|photos" || got["laptop"] != "node-tools|photos" {
+		t.Errorf("the deploy plan reads %v", got)
+	}
+	text := strings.Join(p.Steps, "\n")
+	// Said before the merge (novox/hq issue 336): merging it holds every send to the bus's machine until a
+	// person runs the bus's step, and the verb that does.
+	for _, want := range []string{"merging this needs a person's bus upgrade", "nothing else is sent to anchor",
+		"mesh_call mesh-controller.bus", "the same as the one running there", "photos waits for a person",
+		"nats provides mesh-bus"} {
+		if !strings.Contains(text, want) {
+			t.Errorf("the steps do not say %q:\n%s", want, text)
+		}
+	}
+
+	p = plan("merge-check.sh")
+	if !strings.HasPrefix(p.Summary, "builds nothing") || len(p.Machines) != 0 || strings.Join(p.Unread, ",") != "merge-check.sh" {
+		t.Errorf("a root file's plan reads %+v", p)
+	}
+	if !strings.Contains(planText(p), "read by no module's build: merge-check.sh") {
+		t.Errorf("the plan's text does not say why nothing is built:\n%s", planText(p))
+	}
+}

cmd/mesh-controller/check.go

@@ -7,6 +7,8 @@ import (
 	"os"
 	"path/filepath"
 	"sort"
+	"strings"
+	"time"
 
 	"github.com/novox/mesh-controller/internal/catalogue"
 )
@@ -24,7 +26,17 @@ import (
 // mesh seat is judged fully only at registration. A seat another module declares is unknown unless
 // that module's manifest is passed too. Both are printed as a note, not as a problem — a check that
 // refused what it could not see would teach people to ignore it.
+//
+// **And every identity against every bound it meets** (novox/hq ADR 0225, issue 263): each module's
+// identity, on a machine whose name is `longestMachine` characters, against the bound of every
+// provision it wants that a manifest given here offers. An overflow is refused in the pull request
+// that introduces it — a new requirement, a lowered bound, a longer slug — instead of on the
+// provider's machine when a real machine's name first meets the module's.
 func moduleCheck(paths []string, out io.Writer) error {
+	return moduleCheckFor(paths, catalogue.DefaultLongestMachine, out)
+}
+
+func moduleCheckFor(paths []string, longestMachine int, out io.Writer) error {
 	if len(paths) == 0 {
 		return errors.New("module check <manifest.json>... — one file per module; pass every " +
 			"manifest of a repository together so the rules between them are checked too")
@@ -53,6 +65,13 @@ func moduleCheck(paths []string, out io.Writer) error {
 		}
 		// A definition names no installation (novox/hq ADR 0112, ADR 0155): judged here, in the
 		// catalogue-wide test, and at registration, which refuses in the same words.
+		if wrong := catalogue.TrustProblems(m); len(wrong) > 0 {
+			for _, p := range wrong {
+				fmt.Fprintf(out, "%s: %s\n", path, p)
+			}
+			failed += len(wrong)
+			faulted[m.Module] = true
+		}
 		if named := catalogue.InstallationProblems(m); len(named) > 0 {
 			for _, p := range named {
 				fmt.Fprintf(out, "%s: %s\n", path, p)
@@ -73,11 +92,58 @@ func moduleCheck(paths []string, out io.Writer) error {
 	}
 	failed += len(problems)
 
+	// Between the manifests too: an identity against the bounds of the provisions it wants, which
+	// only the provider's manifest states.
+	identities := catalogue.IdentityProblems(shelf, longestMachine)
+	sort.Strings(identities)
+	for _, p := range identities {
+		fmt.Fprintln(out, p)
+	}
+	failed += len(identities)
+
+	// And the data each module keeps (novox/hq ADR 0233): a provider that grants says what it keeps for
+	// its consumers, a directory a container writes is declared, and no backup line is written by hand.
+	data := catalogue.DataProblems(shelf)
+	sort.Strings(data)
+	for _, p := range data {
+		fmt.Fprintln(out, p)
+	}
+	failed += len(data)
+
 	var names []string
 	for name := range shelf {
 		names = append(names, name)
 	}
 	sort.Strings(names)
+
+	// **Every long-running resource says how it is ready** (novox/hq ADR 0240 rule 8): warned until the
+	// date, refused from it. The count is the catalogue's: its merge check keeps the number and lets a
+	// change lower it, never raise it.
+	undeclared := 0
+	required := !checkNow().Before(catalogue.HealthRequiredFrom)
+	for _, name := range names {
+		missing := catalogue.Undeclared(shelf[name])
+		undeclared += len(missing)
+		if len(missing) == 0 {
+			continue
+		}
+		if required {
+			for _, id := range missing {
+				fmt.Fprintf(out, "%s: %s stays up and does not say how it is ready: a long-running resource declares "+
+					"health since %s (novox/hq ADR 0240 rule 8)\n", name, id, catalogue.HealthRequiredFrom.Format("2006-01-02"))
+			}
+			failed += len(missing)
+			faulted[name] = true
+		}
+	}
+
+	// **A file that asks for a setting and does not say whether it is trusted counts as trusted** (novox/hq issue
+	// 339): listed and counted, never refused, so an author can opt out a file nothing trusts.
+	unsaid := 0
+	for _, name := range names {
+		unsaid += len(catalogue.UnsaidTrust(shelf[name]))
+	}
+
 	for _, name := range names {
 		m := shelf[name]
 		if faulted[name] {
@@ -90,17 +156,70 @@ func moduleCheck(paths []string, out io.Writer) error {
 		if len(m.Invokes) > 0 {
 			fmt.Fprintf(out, ", invokes %s", joinInvokes(m.Invokes))
 		}
+		// The state it keeps and reads (novox/hq ADR 0201), so a reviewer sees what lands on the bus.
+		if len(m.State) > 0 {
+			kept := make([]string, 0, len(m.State))
+			for _, s := range m.State {
+				kept = append(kept, s.Name)
+			}
+			fmt.Fprintf(out, ", keeps state %s", strings.Join(kept, ", "))
+		}
+		if len(m.Reads) > 0 {
+			fmt.Fprintf(out, ", reads %s", strings.Join(m.Reads, ", "))
+		}
+		// The data it keeps, by class, so a reviewer sees what the mesh will protect and how.
+		if items := m.DataItems(); len(items) > 0 {
+			kept := make([]string, 0, len(items))
+			for _, it := range items {
+				kept = append(kept, it.ID+" ("+it.Class+")")
+			}
+			fmt.Fprintf(out, ", keeps %s", strings.Join(kept, ", "))
+		}
+		// How what it runs is ready (ADR 0240): each declared check, and what is judged by liveness alone.
+		var checks []string
+		for _, r := range m.Resources {
+			if h, has, _ := catalogue.ReadHealth(r); has {
+				checks = append(checks, fmt.Sprintf("%v by %s", r["id"], catalogue.HealthWords(h)))
+			}
+		}
+		if len(checks) > 0 {
+			fmt.Fprintf(out, ", ready: %s", strings.Join(checks, "; "))
+		}
+		if missing := catalogue.UnsaidTrust(m); len(missing) > 0 {
+			fmt.Fprintf(out, "; WARNING: %s ask(s) for a setting and do(es) not say whether it is trusted, so it counts as "+
+				"trusted: set at the terminal alone; say %q false where nothing trusts it (novox/hq issue 339)",
+				strings.Join(missing, ", "), catalogue.TrustedField)
+		}
+		if missing := catalogue.Undeclared(m); len(missing) > 0 {
+			fmt.Fprintf(out, "; WARNING: %s stay(s) up and say(s) not how it is ready — judged by liveness alone, "+
+				"refused from %s (ADR 0240 rule 8)", strings.Join(missing, ", "), catalogue.HealthRequiredFrom.Format("2006-01-02"))
+		}
 		fmt.Fprintln(out)
 	}
+	// The count the catalogue keeps (ADR 0240 rule 8), in a line its merge check reads.
+	fmt.Fprintf(out, "%s %d\n", UndeclaredHealthLine, undeclared)
+	fmt.Fprintf(out, "%s %d\n", UnsaidTrustLine, unsaid)
 	if failed > 0 {
 		return fmt.Errorf("%d problem(s) in %d manifest(s)", failed, len(paths))
 	}
 	fmt.Fprintf(out, "%d manifest(s) checked. Judged against the seats this binary carries; a claim on "+
 		"one of the mesh's own seats is judged fully at registration, and a seat declared by a "+
-		"module not given here reads as unknown\n", len(paths))
+		"module not given here reads as unknown. Identities judged on a %d-character machine name, "+
+		"against the bounds of the providers given here\n", len(paths), longestMachine)
 	return nil
 }
 
+// UndeclaredHealthLine starts the line `module check` says the count of long-running resources without
+// `health` in, over the manifests given: the catalogue's merge check compares it with the number it keeps.
+const UndeclaredHealthLine = "long-running resources without health:"
+
+// UnsaidTrustLine starts the line `module check` says the count of files that ask for a setting and do not say
+// whether it is trusted, and so count as trusted (novox/hq issue 339).
+const UnsaidTrustLine = "files asking for a setting without saying whether it is trusted:"
+
+// checkNow is the clock `module check` judges the date by; a test sets it.
+var checkNow = time.Now
+
 func joinInvokes(invokes []string) string {
 	if len(invokes) == 1 && invokes[0] == "*" {
 		return "every tool"

cmd/mesh-controller/check_here.go

@@ -0,0 +1,201 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"flag"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/builder"
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// `check-here` is a pull request's merge check run on the machine at hand **exactly as the build seat
+// runs it** (novox/hq issue 286): the same code (builder.Check), the same ask the controller would make of
+// the seat — the gate's modules and judge by the planner's own answer over the facts snapshot, the
+// repositories beside it at the refs the snapshot says the seat clones them at — in the toolchain image
+// the mesh holds, as the user the build seat runs as, against a throwaway store and bus of the versions
+// the mesh runs.
+//
+// **The build seat is the reference.** A merge-check.sh that passed on an agent's machine failed on the
+// seat for three reasons that were each the agent's environment, never the change: a newer Go whose gofmt
+// lays a file out differently, a sibling checkout at the agent's feature branch where the seat had the
+// commit the mesh runs, and a different user. Run here, a check sees what the seat will.
+//
+//	check-here [--tree <checkout>] [--base main] [--registry <artifact store>] [--forge <url of the owner>]
+//	           [--number <n>] [--user uid:gid] [--facts store|<file>] [--keep]
+//
+// The checkout's HEAD is what is checked, and it must be committed: the seat checks a commit, never a
+// working tree.
+func checkHereCommand(ctx context.Context, args []string) error {
+	set := flag.NewFlagSet("check-here", flag.ContinueOnError)
+	tree := set.String("tree", ".", "the change's checkout; its HEAD is checked")
+	base := set.String("base", "main", "the branch the change would merge into")
+	registry := set.String("registry", os.Getenv("MESH_REGISTRY"), "the artifact store holding the facts and the toolchains")
+	forge := set.String("forge", "", "where the repositories beside it are cloned from, as <forge>/<repository>.git; "+
+		"the checkout's origin without its own name when not given")
+	number := set.Int("number", 0, "the pull request's number, when there is one")
+	// The build seat's service runs as root, and its check containers run as the builder does.
+	user := set.String("user", "0:0", "the user the check's containers run as: the build seat's")
+	keep := set.Bool("keep", false, "keep the workspace afterwards")
+	factsFrom := set.String("facts", "store", "the facts snapshot: `store`, the one the artifact store holds — "+
+		"what the seat reads — or a file")
+	if _, err := parseAround(set, args); err != nil {
+		return err
+	}
+	if *registry == "" {
+		return errors.New("check-here reads the facts and the toolchains from the artifact store: --registry <host:port> or MESH_REGISTRY")
+	}
+	dir, err := filepath.Abs(*tree)
+	if err != nil {
+		return err
+	}
+	git := func(args ...string) (string, error) {
+		cmd := exec.CommandContext(ctx, "git", args...)
+		cmd.Dir = dir
+		out, err := cmd.Output()
+		return strings.TrimSpace(string(out)), err
+	}
+	if dirty, err := git("status", "--porcelain", "--untracked-files=no"); err != nil {
+		return fmt.Errorf("%s is not a checkout: %w", dir, err)
+	} else if dirty != "" {
+		return errors.New("the checkout has changes not committed: the build seat checks a commit, so commit first")
+	}
+	head, err := git("rev-parse", "HEAD")
+	if err != nil {
+		return err
+	}
+	origin, err := git("remote", "get-url", "origin")
+	if err != nil {
+		return fmt.Errorf("the checkout has no origin to say which repository it is: %w", err)
+	}
+	owner, repo, prefix := ownerRepoOf(origin)
+	if *forge == "" {
+		*forge = prefix
+	}
+	if _, err := git("fetch", "--quiet", "origin", *base); err != nil {
+		return fmt.Errorf("cannot fetch %s to say what the change touches: %w", *base, err)
+	}
+	changedText, err := git("diff", "--name-only", "origin/"+*base+"...HEAD")
+	if err != nil {
+		return err
+	}
+	var paths, removed []string
+	for _, p := range strings.Split(changedText, "\n") {
+		if p = strings.TrimSpace(p); p == "" {
+			continue
+		}
+		paths = append(paths, p)
+		if _, err := os.Stat(filepath.Join(dir, p)); os.IsNotExist(err) {
+			removed = append(removed, p)
+		}
+	}
+
+	_ = os.Setenv("MESH_REGISTRY", *registry)
+	f, err := readFacts(ctx, *factsFrom)
+	if err != nil {
+		return fmt.Errorf("the facts snapshot cannot be read: %w", err)
+	}
+	entries, read, edges, err := graphOfFacts(f)
+	if err != nil {
+		return err
+	}
+	p := link.PullUpdated{Owner: owner, Repo: repo, Number: *number, Base: *base, Commit: head, Paths: paths,
+		Removed: removed, ModuleDirs: moduleDirsIn(dir, paths), ModuleDirsSaid: true}
+	scope := pullScope(p, entries, read, edges)
+	_, scriptErr := os.Stat(filepath.Join(dir, builder.CheckScript))
+	if !scope.gated() && !scope.Mesh {
+		fmt.Printf("%s: %s, and the repository is not the mesh's: the build seat runs nothing for it\n",
+			owner+"/"+repo, noModuleTouched)
+		return nil
+	}
+	if !scope.gated() && scriptErr != nil {
+		fmt.Printf("%s: %s; %s\n", owner+"/"+repo, noModuleTouched, noMergeCheck)
+		return nil
+	}
+
+	toolchains := map[string]string{}
+	for language, reference := range f.Versions.Toolchains {
+		toolchains[language] = catalogue.Rerouted(reference, *registry)
+	}
+	if len(toolchains) == 0 {
+		return errors.New("the facts snapshot names no toolchain: it was taken by a controller from before " +
+			"issue 286, and the seat's toolchain cannot be known here")
+	}
+	beside := map[string]builder.Beside{}
+	for d, ref := range f.Beside {
+		from := d
+		if d == "mesh-controller-main" {
+			from = "mesh-controller"
+		}
+		beside[d] = builder.Beside{Repository: strings.TrimSuffix(*forge, "/") + "/" + from + ".git", Ref: ref}
+	}
+	id := fmt.Sprintf("check-here-%d", time.Now().UnixNano())
+	spec := builder.CheckSpec{ID: id, Repository: dir, Ref: head, Owner: owner, Repo: repo, Number: *number,
+		Paths: paths, Beside: beside, Modules: scope.Modules, New: scope.New, Manifests: scope.Manifests,
+		Base: *base, Judge: scope.Judge, Toolchain: toolchains["go"], Toolchains: toolchains, User: *user}
+
+	workspace, err := os.MkdirTemp("", "mesh-check-here-")
+	if err != nil {
+		return err
+	}
+	if !*keep {
+		defer removeWorkspace(spec.Toolchain, workspace, *user)
+	}
+	fmt.Fprintf(os.Stderr, "checking %s/%s at %.8s as the build seat would, against the facts of %s, in %s\n",
+		owner, repo, head, f.Taken.Format(time.RFC3339), workspace)
+	v, err := builder.Check(ctx, builder.Command, spec, workspace, *registry, builder.GitCredential{},
+		func(step, message string) {
+			if step != "output" {
+				fmt.Fprintf(os.Stderr, "  [%s] %s\n", step, message)
+			}
+		})
+	if err != nil {
+		return fmt.Errorf("the check could not run — on the seat an error, never a pass: %w", err)
+	}
+	fmt.Println(v.Report)
+	fmt.Println()
+	fmt.Printf("mesh/merge-gate: %s — %s\n", strings.ToUpper(v.Gate.Verdict), v.Gate.Summary)
+	if v.Repo != nil {
+		fmt.Printf("mesh/repo-check: %s — %s\n", strings.ToUpper(v.Repo.Verdict), v.Repo.Summary)
+	}
+	for _, l := range []*builder.Layer{v.Gate, v.Repo} {
+		if l != nil && l.Verdict != "pass" && l.Verdict != "warning" {
+			return errors.New("the build seat would not pass this change")
+		}
+	}
+	return nil
+}
+
+// ownerRepoOf reads owner, repository and the owner's URL from a remote: ssh://git@host:222/novox/mesh-host.git
+// → novox, mesh-host, ssh://git@host:222/novox.
+func ownerRepoOf(remote string) (string, string, string) {
+	trimmed := strings.TrimSuffix(strings.TrimSuffix(remote, "/"), ".git")
+	cut := strings.LastIndexAny(trimmed, "/:")
+	if cut < 0 {
+		return "", trimmed, ""
+	}
+	repo, prefix := trimmed[cut+1:], trimmed[:cut]
+	owner := prefix
+	if at := strings.LastIndexAny(prefix, "/:"); at >= 0 {
+		owner = prefix[at+1:]
+	}
+	return owner, repo, prefix
+}
+
+// removeWorkspace removes what the check left, written as the seat's user: by a container of that user
+// when it is not this one.
+func removeWorkspace(image, workspace, user string) {
+	if image != "" && user != fmt.Sprintf("%d:%d", os.Getuid(), os.Getgid()) {
+		// Everything in it — the check's HOME is the workspace, so the toolchain's own files are there too.
+		_ = exec.Command("docker", "run", "--rm", "--user", user, "--volume", workspace+":/workspace", image,
+			"sh", "-c", "rm -rf /workspace/* /workspace/.[!.]*").Run()
+	}
+	_ = os.RemoveAll(workspace)
+}

cmd/mesh-controller/check_test.go

@@ -92,3 +92,14 @@ func TestRegistrationRefusesADefinitionNamingAnInstallation(t *testing.T) {
 		t.Fatalf("a name declared on purpose passes; got %v", err)
 	}
 }
+
+// **The controller's own manifest names every verb of its seat** (novox/hq ADR 0132): its tools lagged
+// the seat's verbs for weeks, and `module check` — the gate's first step for a change touching it —
+// refused it. Held here, so a verb added to the table without the manifest fails this repository's
+// own suite rather than its next pull request's gate.
+func TestTheControllersManifestServesEveryVerbOfItsSeat(t *testing.T) {
+	var out strings.Builder
+	if err := moduleCheck([]string{"../../module.json"}, &out); err != nil {
+		t.Fatalf("the controller's own module.json fails module check: %v\n%s", err, out.String())
+	}
+}

cmd/mesh-controller/checks.go

@@ -0,0 +1,400 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"path"
+	"slices"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// A pull request's merge check (novox/hq to-be 45 §9, ADR 0237 as amended 2026-10-06): the forge
+// announces every pull request's new head, the controller decides what is checked, asks the build seat to
+// check it, and says the verdict as `checked`, which the forge's holder sets as the pull request's
+// statuses. **Before merge, never after**: every check the mesh had ran after a merge, on a machine.
+//
+// **The mesh's module graph decides, not the repository.** The controller holds the graph — every module,
+// the repository and directory it is built from — and maps the pull request's changed paths onto it by
+// the planner's own answer (reachOfMerge, touchedBy — the one place a changed file is mapped onto modules,
+// for the merge handler, the release planner, the merge gate and this check; issue 280): **a changed file
+// touches exactly the modules whose build reads it** — a module's own directory (the whole repository for
+// one built from its root), or a repository its recipe packages. A file no build reads — a script at the
+// root, a README — touches no module. A directory the change adds a module.json in, which the graph does
+// not hold yet (said by the head, issue 278), is a new module and is checked too.
+//
+//   - touches a module: the build seat runs **the gate** — `mesh/merge-gate`, the touched manifests, every
+//     machine composed with the change, the replays — and the repository's own merge-check.sh beside it;
+//   - touches none, in a repository that is the mesh's (it sources a module on some branch, or shares the
+//     core's owner): the gate is a pass that says so — a fact, not a missing check — and the repository's
+//     own merge-check.sh runs as `mesh/repo-check`, a warning when it has none;
+//   - touches none, anywhere else: the gate is a pass that says so, and nothing more is said.
+//
+// What is checked is decided here and run there (internal/builder/check.go).
+
+// checkTimeout is how long one check may run on the build seat. Said here so the ask's watchdog (S6)
+// and the builder agree on what late means.
+const checkTimeout = 45 * time.Minute
+
+// noModuleTouched is the gate's word for a change that touches nothing of the graph.
+const noModuleTouched = "the change touches no module of the mesh's graph"
+
+// noMergeCheck is the repository layer's word for a repository of the mesh with no merge-check.sh.
+const noMergeCheck = "the repository declares no merge-check.sh: none of its own tests run before it merges"
+
+// coreModules are the modules whose repositories are the mesh's core, by the directory a check finds
+// each beside it — and whose owner is the mesh's own.
+var coreModules = map[string]string{"mesh-controller": "mesh-controller", "mesh-host": "mesh-host",
+	"node-tools": "mesh-tools", "nats": "mesh-catalog"}
+
+// checkScope is what a pull request reaches of the mesh's graph, as the planner reckons it.
+type checkScope struct {
+	// Modules are the modules a merge of the change would move itself — built from the repository into
+	// the pull request's base and reading a changed file, or packaging the repository's source — and
+	// Dependents those the plan would build after them; New the directories it adds a module in.
+	Modules    []string
+	Dependents []string
+	New        []string
+	// Manifests are the moved modules' and the new ones' manifests in the change's tree.
+	Manifests []string
+	// Width is how many modules a merge would build, in how many tiers; Unread the changed files no
+	// module's build reads.
+	Width, Tiers int
+	Unread       []string
+	// Mesh says the repository is the mesh's: modules are built from it on some branch, its owner is the
+	// core's, or the change adds a module to it.
+	Mesh bool
+	// Judge is who judges the gate (link.JudgeSelf, link.JudgeValidator, or the running controller).
+	Judge string
+	// From is a module built from the repository, for how the mesh clones it; nil when none is.
+	From *inventory.Entry
+	// Reach is the planner's whole answer, which the change plan is made from.
+	Reach mergeReach
+}
+
+func (s checkScope) gated() bool { return len(s.Modules)+len(s.New) > 0 }
+
+// pullScope is what a pull request reaches: **the planner's own answer** (reachOfMerge), asked as if the
+// head were merged into the base — never a mapping of its own, so a change to what a merge touches
+// changes what is checked with it (novox/hq ADR 0238).
+func pullScope(p link.PullUpdated, entries []inventory.Entry, read map[string][]inventory.ReadRepository,
+	edges []inventory.Edge) checkScope {
+	m := link.SourceMoved{Owner: p.Owner, Repo: p.Repo, Base: p.Base, CloneURL: p.CloneURL, Commit: p.Commit,
+		Paths: p.Paths, PathsTruncated: p.PathsTruncated, Removed: p.Removed, ModuleDirs: p.ModuleDirs,
+		ModuleDirsSaid: p.ModuleDirsSaid}
+	r := reachOfMerge(m, entries, read, edges)
+	s := checkScope{Modules: r.Moved(), Dependents: r.Dependents(), New: r.Added, Unread: r.Unread,
+		Width: len(r.Plan.Modules), Tiers: len(r.Plan.Tiers), Reach: r}
+	for _, e := range append(append([]inventory.Entry{}, r.Touched...), r.Deleted...) {
+		s.Manifests = append(s.Manifests, path.Join(strings.Trim(e.Source.Path, "/"), moduleManifestFile))
+		switch e.Manifest.Module {
+		case "mesh-controller":
+			s.Judge = link.JudgeSelf
+		case "mesh-host":
+			if s.Judge == "" {
+				s.Judge = link.JudgeValidator
+			}
+		}
+	}
+	for _, d := range r.Added {
+		s.Manifests = append(s.Manifests, path.Join(d, moduleManifestFile))
+	}
+	sort.Strings(s.Manifests)
+	s.Manifests = slices.Compact(s.Manifests)
+
+	// Whose repository it is, for how it is cloned and whether its own check is the mesh's to run.
+	owners := map[string]bool{}
+	for i, e := range entries {
+		if e.Provided {
+			continue
+		}
+		if _, core := coreModules[e.Manifest.Module]; core {
+			if owner := sourceOwner(e.Source.Repository); owner != "" {
+				owners[owner] = true
+			}
+		}
+		if sameRepository(e.Source.Repository, m) && s.From == nil {
+			s.From = &entries[i]
+		}
+	}
+	s.Mesh = s.From != nil || owners[strings.ToLower(p.Owner)] || s.gated()
+	return s
+}
+
+// sourceOwner is the owner of a recorded repository, a path on the git seat or a URL: novox/mesh-host → novox.
+func sourceOwner(repository string) string {
+	parts := strings.Split(strings.Trim(strings.TrimSuffix(repository, ".git"), "/"), "/")
+	if len(parts) < 2 {
+		return ""
+	}
+	return strings.ToLower(parts[len(parts)-2])
+}
+
+// PullUpdated decides a pull request's merge check, and asks for it when there is something to run.
+func (f following) PullUpdated(ctx context.Context, p link.PullUpdated) error {
+	inv := f.open.inventory
+	entries, err := inv.Catalogued(ctx)
+	if err != nil {
+		return err
+	}
+	read, err := inv.ReadRepositories(ctx)
+	if err != nil {
+		return err
+	}
+	edges, err := inv.Dependencies(ctx)
+	if err != nil {
+		return err
+	}
+	scope := pullScope(p, entries, read, edges)
+	// The change plan of the commit at hand (ADR 0238): what a merge of it would build and send, posted
+	// with the verdict whatever the verdict is.
+	plan := changePlanOf(p.Owner+"/"+p.Repo, p.Base, p.Commit, scope.Reach, entries, func(module string) (inventory.Upgrade, bool) {
+		u, err := inv.UpgradeOf(ctx, module)
+		return u, err == nil
+	})
+	fmt.Print(planText(plan))
+	direct := link.Checked{Owner: p.Owner, Repo: p.Repo, Number: p.Number, Commit: p.Commit,
+		ID: link.NewBuildID(time.Now()), Verdict: "pass", Summary: noModuleTouched,
+		Gate: &link.CheckLayer{Verdict: "pass", Summary: noModuleTouched}, Plan: &plan}
+	switch {
+	case !scope.gated() && !scope.Mesh:
+		fmt.Printf("%s/%s#%d (%.8s): %s, and the repository is not the mesh's: said, nothing run\n",
+			p.Owner, p.Repo, p.Number, p.Commit, noModuleTouched)
+		sayChecked(ctx, direct)
+		return nil
+	case !scope.gated() && p.MergeCheckSaid && !p.MergeCheck:
+		direct.RepoCheck = &link.CheckLayer{Verdict: "warning", Summary: noMergeCheck}
+		fmt.Printf("%s/%s#%d (%.8s): %s; %s\n", p.Owner, p.Repo, p.Number, p.Commit, noModuleTouched, noMergeCheck)
+		sayChecked(ctx, direct)
+		return nil
+	}
+	request, err := checkRequestFor(ctx, f.open, p, scope, entries)
+	if err != nil {
+		return err
+	}
+	request.Check.Plan = &plan
+	seat := buildSeatHeld(ctx)
+	ask, err := askOverOn(seat)
+	if err != nil {
+		return err
+	}
+	defer ask.Close()
+	if err := ask.Ask(ctx, request); err != nil {
+		return err
+	}
+	what := "its own merge-check.sh alone: " + noModuleTouched
+	if scope.gated() {
+		what = fmt.Sprintf("the gate over %s (a merge would build %d module(s) in %d tier(s))",
+			strings.Join(append(append([]string{}, scope.Modules...), prefixedAll("new:", scope.New)...), ", "),
+			scope.Width, scope.Tiers)
+	}
+	fmt.Printf("%s/%s#%d (%.8s): asked %s to check it before it merges — %s — as %s\n", p.Owner, p.Repo, p.Number,
+		p.Commit, seat, what, request.ID)
+	return nil
+}
+
+// checkRequestFor is the ask for one pull request's head: the repository as the mesh clones it, the head,
+// and what is read beside it.
+func checkRequestFor(ctx context.Context, open *stores, p link.PullUpdated, scope checkScope,
+	entries []inventory.Entry) (link.BuildRequest, error) {
+	shelf := map[string]catalogue.Manifest{}
+	for _, e := range entries {
+		shelf[e.Manifest.Module] = e.Manifest
+	}
+	world, err := theRestOfTheMesh(ctx, open.inventory, shelf, "")
+	if err != nil {
+		return link.BuildRequest{}, err
+	}
+	clone := func(s inventory.Source) (string, error) {
+		if s.Seat == "" {
+			return s.Repository, nil
+		}
+		return clonedFromSeat(world, s.Seat, s.Repository)
+	}
+	// As the mesh clones a module built from it; a repository no module is built from, from the forge.
+	source := inventory.Source{Seat: gitSeat, Repository: p.Owner + "/" + p.Repo}
+	if scope.From != nil {
+		source = scope.From.Source
+	}
+	repository, err := clone(source)
+	if err != nil {
+		return link.BuildRequest{}, err
+	}
+	current, err := open.inventory.CurrentBuilds(ctx)
+	if err != nil {
+		return link.BuildRequest{}, err
+	}
+	// Beside it, at what the mesh runs: each core repository by the module the mesh builds from it.
+	beside := map[string]link.CheckedOut{}
+	for _, e := range entries {
+		dir, core := coreModules[e.Manifest.Module]
+		if !core || e.Provided || e.Source.Repository == "" {
+			continue
+		}
+		url, err := clone(e.Source)
+		if err != nil {
+			return link.BuildRequest{}, err
+		}
+		refs := besideRefs(dir, current[e.Manifest.Module].Commit)
+		beside[dir] = link.CheckedOut{Repository: url, Ref: refs[dir]}
+		if dir == "mesh-controller" {
+			beside["mesh-controller-main"] = link.CheckedOut{Repository: url, Ref: refs["mesh-controller-main"]}
+			if e.Source.Seat != "" {
+				if lab, err := clone(inventory.Source{Seat: e.Source.Seat, Repository: siblingOf(e.Source.Repository,
+					"mesh-lab")}); err == nil {
+					beside["mesh-lab"] = link.CheckedOut{Repository: lab, Ref: refs["mesh-lab"]}
+				}
+			}
+		}
+	}
+	return link.BuildRequest{
+		ID:         link.NewBuildID(time.Now()),
+		Repository: repository,
+		Ref:        p.Commit,
+		Held:       heldBy(ctx),
+		Seats:      seatBases(ctx),
+		Source:     sourceOnSeat(source),
+		Check: &link.CheckRequest{Owner: p.Owner, Repo: p.Repo, Number: p.Number, Base: p.Base,
+			Paths: p.Paths, Beside: beside, Modules: scope.Modules, Dependents: scope.Dependents, New: scope.New,
+			Manifests: scope.Manifests, Judge: scope.Judge},
+	}, nil
+}
+
+// besideRefs is the ref each repository is cloned at beside a check, by the directory it is found under:
+// a core repository at the commit the mesh runs of the module built from it (`running`) — but the
+// catalogue, whose checkout beside is what tests read its files from, at its main, what the next merge
+// builds from; and beside the controller its main, for a judge the running controller predates, and the
+// lab's main, whose replays every check runs. **One rule, read by the check the controller asks for and by
+// the facts snapshot** (Facts.Beside), so a check run by hand clones what the build seat clones.
+func besideRefs(dir, running string) map[string]string {
+	switch dir {
+	case "mesh-catalog":
+		return map[string]string{dir: "main"}
+	case "mesh-controller":
+		return map[string]string{dir: running, "mesh-controller-main": "main", "mesh-lab": "main"}
+	}
+	return map[string]string{dir: running}
+}
+
+// siblingOf is another repository of the same owner: novox/mesh-controller → novox/mesh-lab.
+func siblingOf(repository, name string) string {
+	if cut := strings.LastIndex(repository, "/"); cut >= 0 {
+		return repository[:cut+1] + name
+	}
+	return name
+}
+
+// sourceOnSeat is a source's seat form, nil for one on no seat.
+func sourceOnSeat(s inventory.Source) *link.SourceOnSeat {
+	if s.Seat == "" {
+		return nil
+	}
+	return &link.SourceOnSeat{Seat: s.Seat, Repository: s.Repository}
+}
+
+// checkEvents is where the serving controller says a check's verdict; nil in a command.
+var checkEvents link.Bus
+
+// maxCheckReport is how much of a check's report travels in its verdict: enough for the failures and
+// the machines, never a log.
+const maxCheckReport = 60 << 10
+
+// checked says a merge check's verdict as the controller's `checked`. Nothing is recorded or
+// registered: a check builds nothing (issue 240's rule for a dry run, kept for a check).
+func checked(ctx context.Context, result link.BuildResult) {
+	sayChecked(ctx, checkedOf(result))
+}
+
+// checkedOf is what a check's outcome says: each layer, and an error — never a pass — for a check that
+// could not run.
+func checkedOf(result link.BuildResult) link.Checked {
+	c := link.Checked{ID: result.ID, On: result.On, Commit: result.Ref}
+	if result.Checked != nil {
+		c.Owner, c.Repo, c.Number = result.Checked.Owner, result.Checked.Repo, result.Checked.Number
+	}
+	switch {
+	case result.Check != nil:
+		c.Verdict, c.Summary, c.Report = result.Check.Verdict, result.Check.Summary, result.Check.Report
+		c.Gate, c.RepoCheck = result.Check.Gate, result.Check.RepoCheck
+		if c.Gate == nil {
+			// A build seat from before the layers: its verdict is the gate's.
+			c.Gate = &link.CheckLayer{Verdict: c.Verdict, Summary: c.Summary}
+		}
+	case result.Failed != "":
+		// The check could not run: an error, never read as a pass — on both layers it was asked for.
+		c.Verdict, c.Summary = "error", "the check could not run: "+firstLine(result.Failed)
+	default:
+		c.Verdict, c.Summary = "error", "the build seat answered the check with no verdict"
+	}
+	if c.Verdict == "" {
+		c.Verdict = "error"
+	}
+	if result.Check == nil {
+		c.Gate = &link.CheckLayer{Verdict: c.Verdict, Summary: c.Summary}
+		c.RepoCheck = &link.CheckLayer{Verdict: c.Verdict, Summary: c.Summary}
+	}
+	if result.Checked != nil && c.Gate != nil && len(c.Gate.Modules) == 0 {
+		c.Gate.Modules = append(append([]string{}, result.Checked.Modules...), prefixedAll("new:", result.Checked.New)...)
+	}
+	if result.Checked != nil && c.Gate != nil && len(c.Gate.Dependents) == 0 {
+		c.Gate.Dependents = result.Checked.Dependents
+	}
+	if result.Checked != nil {
+		c.Plan = result.Checked.Plan
+		// A delivery group's composed check (novox/hq ADR 0239): every head it judged, this one first.
+		if g := result.Checked; g.Group != "" {
+			c.Group = g.Group
+			c.Members = append(c.Members, link.CheckedMember{Owner: g.Owner, Repo: g.Repo, Number: g.Number,
+				Commit: result.Ref})
+			for _, m := range g.Members {
+				c.Members = append(c.Members, link.CheckedMember{Owner: m.Owner, Repo: m.Repo, Number: m.Number,
+					Commit: m.Ref})
+			}
+		}
+	}
+	for _, l := range []*link.CheckLayer{c.Gate, c.RepoCheck} {
+		if l != nil && l.Verdict == "" {
+			l.Verdict = "error"
+		}
+	}
+	if len(c.Report) > maxCheckReport {
+		c.Report = "…" + c.Report[len(c.Report)-maxCheckReport:]
+	}
+	return c
+}
+
+func prefixedAll(prefix string, items []string) []string {
+	out := make([]string, 0, len(items))
+	for _, i := range items {
+		out = append(out, prefix+i)
+	}
+	return out
+}
+
+// sayChecked says a merge check's verdict on the bus, where the forge's holder hears it.
+func sayChecked(ctx context.Context, c link.Checked) {
+	repo := "none"
+	if c.RepoCheck != nil {
+		repo = strings.ToUpper(c.RepoCheck.Verdict) + " — " + c.RepoCheck.Summary
+	}
+	fmt.Printf("%s: %s/%s#%d at %.8s checked on %s: gate %s — %s; repository %s\n", c.ID, c.Owner, c.Repo, c.Number,
+		c.Commit, orSomewhere(c.On), strings.ToUpper(c.Verdict), c.Summary, repo)
+	if checkEvents == nil {
+		return
+	}
+	body, err := json.Marshal(c)
+	if err != nil {
+		return
+	}
+	stating, stop := context.WithTimeout(context.WithoutCancel(ctx), 10*time.Second)
+	defer stop()
+	if err := checkEvents.PublishSeatEvent(stating, link.MeshControllerSeat, link.KeyChecked, body); err != nil {
+		fmt.Printf("%s: the verdict could not be said, so the pull request is not told it: %v\n", c.ID, err)
+	}
+}

cmd/mesh-controller/checks_test.go

@@ -0,0 +1,212 @@
+package main
+
+import (
+	"errors"
+	"strings"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// **The mesh's module graph decides what a pull request's check runs**, not the repository (novox/hq
+// ADR 0237 as amended): a change is mapped onto the graph by the rule a merge is (issue 278), the gate
+// runs when it touches a module — a new one included — and a repository that is the mesh's and touches
+// none still has its own merge-check.sh run.
+func TestThePullRequestIsMappedOntoTheModuleGraph(t *testing.T) {
+	const catalogue = "http://forge.internal:20000/novox/mesh-catalog.git"
+	const controller = "http://forge.internal:20000/novox/mesh-controller.git"
+	const host = "http://forge.internal:20000/novox/mesh-host.git"
+	photos := fromRepo("photos", "http://forge.internal:20000/novox/photos.git", "")
+	photos.Source.Ref = "nox-mesh"
+	snake := fromRepo("snake", "jschoubben/snake", "")
+	snake.Source.Seat = "git"
+	entries := []inventory.Entry{
+		fromRepo("gitea", catalogue, "modules/gitea"),
+		fromRepo("keycloak", catalogue, "modules/keycloak"),
+		fromRepo("nats", catalogue, "modules/nats"),
+		fromRepo("mesh-controller", controller, ""),
+		fromRepo("mesh-host", host, ""),
+		photos, snake,
+	}
+	pull := func(owner, repo, base string, paths []string, dirs ...string) link.PullUpdated {
+		return link.PullUpdated{Owner: owner, Repo: repo, Base: base, Commit: "abc", Paths: paths,
+			ModuleDirs: dirs, ModuleDirsSaid: true}
+	}
+	for _, c := range []struct {
+		what                   string
+		p                      link.PullUpdated
+		modules, new, manifest string
+		mesh                   bool
+		judge                  string
+	}{
+		{"one module's own files", pull("novox", "mesh-catalog", "main", []string{"modules/gitea/index.ts"}, "modules/gitea"),
+			"gitea", "", "modules/gitea/module.json", true, ""},
+		{"a file no module's build reads touches no module (issue 280)",
+			pull("novox", "mesh-catalog", "main", []string{"merge-check.sh", "README.md"}), "", "", "", true, ""},
+		{"files the announcer could not list: everything built from it",
+			link.PullUpdated{Owner: "novox", Repo: "mesh-catalog", Base: "main", Commit: "abc", PathsTruncated: true,
+				Paths: []string{"README.md"}}, "gitea,keycloak,nats", "",
+			"modules/gitea/module.json,modules/keycloak/module.json,modules/nats/module.json", true, ""},
+		{"a new module, said by the head", pull("novox", "mesh-catalog", "main",
+			[]string{"modules/newmod/index.ts", "modules/newmod/module.json"}, "modules/newmod"),
+			"", "modules/newmod", "modules/newmod/module.json", true, ""},
+		{"the controller judges itself", pull("novox", "mesh-controller", "main", []string{"cmd/x.go"}),
+			"mesh-controller", "", "module.json", true, "self"},
+		{"the node-engine is judged with its validator", pull("novox", "mesh-host", "main", []string{"validate/v.go"}),
+			"mesh-host", "", "module.json", true, "validator"},
+		{"the core's owner, no module: the mesh's, its own check alone", pull("novox", "hq", "main", []string{"README.md"}),
+			"", "", "", true, ""},
+		{"a branch nothing is built from: the mesh's repository, no module", pull("novox", "photos", "master",
+			[]string{"server/x.js"}), "", "", "", true, ""},
+		{"the branch a module is built from", pull("novox", "photos", "nox-mesh", []string{"server/x.js"}),
+			"photos", "", "module.json", true, ""},
+		{"a repository on the forge's seat", pull("jschoubben", "snake", "main", []string{"index.html"}),
+			"snake", "", "module.json", true, ""},
+		{"a repository of nobody's, touching nothing", pull("someone", "dotfiles", "main", []string{"x"}),
+			"", "", "", false, ""},
+		{"a repository adding a module at its root", pull("someone", "newapp", "main", []string{"module.json", "x.js"}),
+			"", ".", "module.json", true, ""},
+	} {
+		s := pullScope(c.p, entries, nil, nil)
+		got := []string{strings.Join(s.Modules, ","), strings.Join(s.New, ","), strings.Join(s.Manifests, ",")}
+		want := []string{c.modules, c.new, c.manifest}
+		for i, what := range []string{"modules", "new", "manifests"} {
+			if got[i] != want[i] {
+				t.Errorf("%s: %s %q, wanted %q", c.what, what, got[i], want[i])
+			}
+		}
+		if s.Mesh != c.mesh || s.Judge != c.judge {
+			t.Errorf("%s: the mesh's %v judged by %q, wanted %v by %q", c.what, s.Mesh, s.Judge, c.mesh, c.judge)
+		}
+		if s.gated() != (c.modules != "" || c.new != "") {
+			t.Errorf("%s: gated %v", c.what, s.gated())
+		}
+	}
+}
+
+// A module whose build packages another repository's source is touched by a change to it.
+func TestAPullRequestTouchesWhatPackagesItsRepository(t *testing.T) {
+	entries := []inventory.Entry{fromRepo("node-tools", "http://forge.internal:20000/novox/mesh-tools.git", "node-tools")}
+	read := map[string][]inventory.ReadRepository{"node-tools": {{Repository: "http://forge.internal:20000/novox/mesh-sdk.git"}}}
+	s := pullScope(link.PullUpdated{Owner: "novox", Repo: "mesh-sdk", Base: "main", Commit: "abc", Paths: []string{"go/x.go"}}, entries, read, nil)
+	if strings.Join(s.Modules, ",") != "node-tools" || len(s.Manifests) != 0 {
+		t.Fatalf("a change to what node-tools packages touched %v (manifests %v)", s.Modules, s.Manifests)
+	}
+}
+
+// Each layer is said; a check that could not run is an error on both, never a pass; a build seat from
+// before the layers is read as the gate.
+func TestAChecksLayersAreEachSaidAndAnErrorIsNeverAPass(t *testing.T) {
+	asked := &link.CheckRequest{Owner: "novox", Repo: "mesh-catalog", Number: 3, Modules: []string{"gitea"}}
+	c := checkedOf(link.BuildResult{ID: "b", Ref: "abc", Checked: asked, Failed: "the facts snapshot cannot be read"})
+	if c.Verdict != "error" || c.Gate == nil || c.Gate.Verdict != "error" || c.RepoCheck == nil || c.RepoCheck.Verdict != "error" {
+		t.Fatalf("a check that could not run said %+v", c)
+	}
+	if strings.Join(c.Gate.Modules, ",") != "gitea" {
+		t.Errorf("the gate names %v", c.Gate.Modules)
+	}
+	c = checkedOf(link.BuildResult{ID: "b", Ref: "abc", Checked: asked, Check: &link.CheckOutcome{Verdict: "warning", Summary: "wide"}})
+	if c.Gate == nil || c.Gate.Verdict != "warning" || c.RepoCheck != nil {
+		t.Fatalf("an outcome without layers said %+v", c)
+	}
+	c = checkedOf(link.BuildResult{ID: "b", Ref: "abc", Checked: asked, Check: &link.CheckOutcome{Verdict: "pass",
+		Gate: &link.CheckLayer{Verdict: "pass"}, RepoCheck: &link.CheckLayer{Verdict: "fail", Summary: "its merge-check.sh failed"}}})
+	if c.RepoCheck.Verdict != "fail" || c.Gate.Verdict != "pass" {
+		t.Fatalf("the layers said %+v / %+v", c.Gate, c.RepoCheck)
+	}
+}
+
+// **The check asks the planner, never a mapping of its own** (novox/hq ADR 0238): what a pull request
+// reaches is reachOfMerge's answer — the same that plans a merge — so a file at the root touches no
+// module in both, and what stands on a touched module is named as its dependents in both.
+func TestAPullRequestReachesWhatAMergeOfItWouldPlan(t *testing.T) {
+	const catalogue = "http://forge.internal:20000/novox/mesh-catalog.git"
+	nats := fromRepo("nats", catalogue, "modules/nats")
+	nats.Source.BuiltFrom = "old"
+	gitea := fromRepo("gitea", catalogue, "modules/gitea")
+	gitea.Source.BuiltFrom = "old"
+	tools := fromRepo("node-tools", "http://forge.internal:20000/novox/mesh-tools.git", "node-tools")
+	entries := []inventory.Entry{nats, gitea, tools}
+	// node-tools stands on the bus's image; a code edge, so a plan takes it along.
+	edges := []inventory.Edge{{From: "node-tools", To: "nats", Kind: inventory.EdgeStandsOn}}
+	read := map[string][]inventory.ReadRepository{}
+
+	for _, c := range []struct {
+		what              string
+		paths             []string
+		moved, dependents string
+		width             int
+		unread            string
+	}{
+		{"a file at the root, read by no build", []string{"merge-check.sh"}, "", "", 0, "merge-check.sh"},
+		{"the bus's own directory", []string{"modules/nats/Dockerfile"}, "nats", "node-tools", 2, ""},
+		{"both, and a README", []string{"modules/gitea/index.ts", "modules/nats/x", "README.md"}, "gitea,nats", "node-tools", 3, "README.md"},
+	} {
+		p := link.PullUpdated{Owner: "novox", Repo: "mesh-catalog", Base: "main", Commit: "head", Paths: c.paths}
+		s := pullScope(p, entries, read, edges)
+		m := link.SourceMoved{Owner: "novox", Repo: "mesh-catalog", Base: "main", Commit: "head", Paths: c.paths}
+		r := reachOfMerge(m, entries, read, edges)
+		if got := strings.Join(s.Modules, ","); got != c.moved || got != strings.Join(r.Moved(), ",") {
+			t.Errorf("%s: the check reaches %q, the planner %v, wanted %q", c.what, got, r.Moved(), c.moved)
+		}
+		if got := strings.Join(s.Dependents, ","); got != c.dependents {
+			t.Errorf("%s: dependents %q, wanted %q", c.what, got, c.dependents)
+		}
+		if s.Width != c.width || s.Width != len(r.Plan.Modules) {
+			t.Errorf("%s: a merge would build %d, the planner says %d, wanted %d", c.what, s.Width, len(r.Plan.Modules), c.width)
+		}
+		if got := strings.Join(s.Unread, ","); got != c.unread {
+			t.Errorf("%s: unread %q, wanted %q", c.what, got, c.unread)
+		}
+	}
+
+	// A repository whose build another module's recipe packages: that module is reached through the
+	// planner's `read`, and what stands on it after it.
+	read["gitea"] = []inventory.ReadRepository{{Repository: "http://forge.internal:20000/novox/mesh-sdk.git"}}
+	s := pullScope(link.PullUpdated{Owner: "novox", Repo: "mesh-sdk", Base: "main", Commit: "head",
+		Paths: []string{"src/index.ts"}}, entries, read, edges)
+	if strings.Join(s.Modules, ",") != "gitea" || len(s.Manifests) != 0 {
+		t.Fatalf("a change to the source gitea packages reaches %v (manifests %v)", s.Modules, s.Manifests)
+	}
+}
+
+// **Only a commit on the trunk is published** (novox/hq ADR 0238): a build of a commit off its repository's
+// default branch — a pull request's head, a branch built by hand, a rebuild or replay of one — is recorded
+// and never registered, so nothing can send it; a check or a dry run never is either.
+func TestABuildOffTheTrunkIsNeverPublished(t *testing.T) {
+	on := link.BuildResult{ID: "b", Commit: "abc", Trunk: "main", OnTrunk: true}
+	if err := publishable(on, ""); err != nil {
+		t.Errorf("a build on the trunk was refused: %v", err)
+	}
+	off := link.BuildResult{ID: "b", Commit: "abc", Trunk: "main"}
+	if err := publishable(off, ""); !errors.Is(err, errOffTheTrunk) || !strings.Contains(err.Error(), "main") {
+		t.Errorf("a build off the trunk was let through: %v", err)
+	}
+	for _, r := range []link.BuildResult{
+		{ID: "c", Trunk: "main", OnTrunk: true, Check: &link.CheckOutcome{Verdict: "pass"}},
+		{ID: "d", Trunk: "main", OnTrunk: true, Checked: &link.CheckRequest{}},
+		{ID: "e", Trunk: "main", OnTrunk: true, DryRun: true},
+	} {
+		if publishable(r, "") == nil {
+			t.Errorf("%s, a check or a dry run, was publishable", r.ID)
+		}
+	}
+	// A module that follows a branch other than the default: that branch is its trunk, and the default
+	// is not.
+	follows := link.BuildResult{ID: "g", Commit: "abc", Trunk: "master", Branches: []string{"nox-mesh"}}
+	if err := publishable(follows, "nox-mesh"); err != nil {
+		t.Errorf("a commit on the branch a module follows was refused: %v", err)
+	}
+	if err := publishable(link.BuildResult{ID: "h", Commit: "abc", Trunk: "master", OnTrunk: true,
+		Branches: []string{"master"}}, "nox-mesh"); err == nil {
+		t.Error("a commit on the default but not on the branch the module follows was published")
+	}
+	if err := publishable(link.BuildResult{ID: "i", Commit: "abc", Trunk: "main", Branches: []string{"feat/x"}}, ""); err == nil {
+		t.Error("a feature branch's commit was published")
+	}
+	// A build seat older than the rule says nothing: let through and said, so the rule can reach the mesh.
+	if err := publishable(link.BuildResult{ID: "f", Commit: "abc"}, ""); err != nil {
+		t.Errorf("a build seat that said nothing was refused: %v", err)
+	}
+}

cmd/mesh-controller/collect.go

@@ -0,0 +1,276 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/artifacts"
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// Letting the artifact store go of what the mesh no longer keeps (novox/hq ADR 0189, issue 108).
+//
+// **Run where the records change.** A build is the moment new bytes landed in the store and the
+// moment the keep set moved, so it is the moment to say what may go — and it needs no timer of
+// its own. Reclaiming the bytes is the store's own nightly step; this only decides.
+//
+// **And run when a person asks** (novox/hq ADR 0251): the `collect` verb is the same sweep, with
+// bounds of its own. One implementation, so what a person runs is exactly what a build runs.
+//
+// Never fatal to a build. The build succeeded, the module is registered, and a store that could
+// not be reached is a thing to say rather than a reason to undo any of that. The next build asks
+// again, and the references it could not collect are still uncollected, so nothing is lost by
+// having failed.
+
+// sweepBounds is how much one sweep may ask of the store.
+type sweepBounds struct {
+	// most is how many artifacts it lets go of at most.
+	most int
+	// budget is the longest it keeps its caller waiting.
+	budget time.Duration
+	// platforms is whether an index is let go of with its own platform manifests (novox/hq ADR 0257).
+	// Only a sweep a person confirmed, after its dry run listed what stays and names a platform: the
+	// records cannot see an unrecorded index, or a copy in progress, naming the same platform, and the
+	// store's tools can.
+	platforms bool
+}
+
+// afterBuild are the bounds of the sweep inside somebody's build.
+//
+// **Bounded, because this runs inside somebody's build.** The first sweep of a mesh that has never
+// collected has the whole history to get through, and a person waiting on `build` should not pay for
+// it. What is left over is simply offered again next time — builds are frequent, and the point is
+// that the store stops growing, not that it empties tonight.
+var afterBuild = sweepBounds{most: mostPerSweep, budget: sweepBudget}
+
+// sweepResult is what one sweep did.
+type sweepResult struct {
+	// HoldersWritten is how many kept archives the store now holds by a manifest it did not before.
+	HoldersWritten int
+	// Missing is how many kept archives the store does not have at all.
+	Missing int
+	// Held is whether every kept archive could be asked to be held; false stops the sweep before it
+	// lets anything go.
+	Held bool
+	// LetGo is what the store let go of, and the record now says collected.
+	LetGo []string
+	// Skipped is how many references the sweep will not address (novox/hq issue 226).
+	Skipped int
+	// Indexes is how many eligible indexes a sweep a person did not confirm left for one that is: an
+	// index goes only with its platform manifests (novox/hq ADR 0257 §4).
+	Indexes int
+	// Left is how many eligible references were not asked about this time.
+	Left int
+	// Bounded is whether it stopped at its bounds rather than at a refusal.
+	Bounded bool
+	// Stopped says why the sweep stopped before the end; empty when it did not.
+	Stopped string
+}
+
+// sweep holds every kept archive, then asks the store to let go of each reference in order, records
+// what it let go of, and says what it did.
+func sweep(ctx context.Context, inv *inventory.Inventory, store artifacts.Store, references, kept []string,
+	bounds sweepBounds) sweepResult {
+	within, stop := context.WithTimeout(ctx, bounds.budget)
+	defer stop()
+	var r sweepResult
+
+	// **Hold before letting go** (novox/hq issue 253). The store's collector keeps only what a
+	// manifest names, and archives were published as bare blobs, so every kept archive is first
+	// held by its manifest — which backfills the ones published before holders, a few at a time
+	// as builds come, and is two HEADs each once done. A kept archive that could not be held stops
+	// the sweep before it deletes anything: "everything kept is held" is the precondition the
+	// collector's safety rests on, and a store refusing a hold would refuse the deletes too.
+	// **An index goes with its platform manifests only when a person confirmed it** (novox/hq ADR
+	// 0257), and a kept index keeps its own: which platform manifests the kept indexes name is read
+	// from the store for every repository the sweep will touch, before the first delete. A single
+	// read that fails stops the sweep before it deletes anything, as a kept archive that cannot be
+	// held does. The sweep after a build leaves an eligible index for such a collect, below.
+	store.Spare = nil
+	if bounds.platforms {
+		if inv == nil {
+			r.Stopped = "no records to read which platform manifests a kept index names, so nothing was let go"
+			r.Left = len(references)
+			return r
+		}
+		images, err := inv.KeptImages(ctx)
+		if err == nil {
+			store.Spare, err = store.SpareKeptIndexes(within, images, references)
+		}
+		if err != nil {
+			r.Stopped = fmt.Sprintf("which platform manifests a kept index names could not be read, so nothing was let go: %v", err)
+			r.Left = len(references)
+			return r
+		}
+	}
+
+	wrote, missing, err := holdKept(within, store, kept)
+	r.HoldersWritten, r.Missing = wrote, missing
+	if err != nil {
+		r.Stopped = fmt.Sprintf("not every kept archive could be held, so nothing was let go: %v", err)
+		r.Left = len(references)
+		return r
+	}
+	r.Held = true
+
+	for i, reference := range references {
+		if i >= bounds.most || within.Err() != nil {
+			r.Left = len(references) - i
+			r.Bounded = true
+			if i >= bounds.most {
+				r.Stopped = fmt.Sprintf("asked about %d, the most one sweep asks", bounds.most)
+			} else {
+				r.Stopped = fmt.Sprintf("ran out of its %s", bounds.budget)
+			}
+			break
+		}
+		if !bounds.platforms {
+			// **An index waits for a confirmed collect** (novox/hq ADR 0257 §4). Let go of alone,
+			// its platform manifests would stay in the store and the record would say collected, so
+			// no later sweep would offer it again and they would stay for ever. Left eligible, the
+			// next collect a person confirms takes it with them.
+			index, err := store.IsIndex(within, reference)
+			if err != nil && !errors.Is(err, artifacts.Gone) && !errors.Is(err, artifacts.ErrNotOurs) {
+				r.Stopped = fmt.Sprintf("the artifact store could not say whether %s is an index, so nothing more was asked of it: %v", reference, err)
+				r.Left = len(references) - i
+				break
+			}
+			if index {
+				r.Indexes++
+				continue
+			}
+		}
+		err := store.LetGo(within, reference)
+		if err == nil || errors.Is(err, artifacts.Gone) {
+			// Gone is the outcome wanted, already true. Recorded so the next sweep does not ask
+			// again for ever.
+			r.LetGo = append(r.LetGo, reference)
+			continue
+		}
+		if errors.Is(err, artifacts.ErrNotOurs) {
+			// **A fact about this record, so this record is skipped** (novox/hq issue 226). Not
+			// marked collected — the mesh did not remove it and should not claim to — and not a
+			// reason to stop, because the store was never asked. One of these at the front of
+			// the oldest-first order ended every sweep until this.
+			r.Skipped++
+			if r.Skipped == 1 {
+				fmt.Fprintf(os.Stderr, "the sweep will not address %s and went on: %v\n", reference, err)
+			}
+			continue
+		}
+		// **Stopped at the first refusal by the STORE, not pushed through.** A store that refuses
+		// one refuses all of them — deletion disabled, the store down, the network gone — so
+		// going on would be a hundred identical failures and a hundred identical log lines in
+		// front of whoever was building something.
+		r.Stopped = fmt.Sprintf("the artifact store kept %s, so nothing more was asked of it: %v", reference, err)
+		r.Left = len(references) - i
+		break
+	}
+
+	if len(r.LetGo) > 0 {
+		// Recorded outside `within`: the deletions happened, and losing the record of them because
+		// the sweep ran out of budget would mean asking about them again for ever.
+		if err := inv.MarkCollected(ctx, r.LetGo); err != nil {
+			r.Stopped = fmt.Sprintf("the store let go of %d artifact(s) and the record of it did not keep: %v",
+				len(r.LetGo), err)
+		}
+	}
+	return r
+}
+
+// collect asks the store to let go of everything the mesh made and no longer keeps, and records
+// what it let go of — after a build. Says what it did and what it could not; returns nothing,
+// because nothing upstream should branch on it.
+func collect(ctx context.Context, inv *inventory.Inventory) {
+	references, err := inv.ToCollect(ctx)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "could not work out what the artifact store may let go of: %v\n", err)
+		return
+	}
+	kept, err := inv.KeptArchives(ctx)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "could not work out which archives the artifact store keeps: %v\n", err)
+		return
+	}
+	if len(references) == 0 && len(kept) == 0 {
+		return
+	}
+	shelf, err := inv.Catalogue(ctx)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "could not read the catalogue to find the artifact store: %v\n", err)
+		return
+	}
+	// As the mesh reaches it from the network. Empty means the store is not on the network — on a
+	// mesh being raised it is not yet, and there the store holds one build of anything and has
+	// nothing to collect.
+	address, err := artifactStoreAddress(ctx, inv, shelf, "")
+	if err != nil || address == "" {
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "could not find the artifact store to collect from: %v\n", err)
+		}
+		return
+	}
+
+	r := sweep(ctx, inv, artifacts.Store{Address: address}, references, kept, afterBuild)
+	if r.HoldersWritten > 0 {
+		fmt.Fprintf(os.Stderr, "the artifact store now holds %d more kept archive(s) by a manifest\n", r.HoldersWritten)
+	}
+	if r.Missing > 0 {
+		fmt.Fprintf(os.Stderr, "%d archive(s) the mesh keeps are not in the artifact store at all; "+
+			"`collection` lists them\n", r.Missing)
+	}
+	if len(r.LetGo) > 0 {
+		fmt.Fprintf(os.Stderr, "the artifact store let go of %d artifact(s) the mesh no longer keeps\n", len(r.LetGo))
+	}
+	if r.Stopped != "" && !r.Bounded {
+		fmt.Fprintln(os.Stderr, r.Stopped)
+	}
+	if r.Held && r.Left > 0 {
+		fmt.Fprintf(os.Stderr, "%d more to collect; the next build asks again\n", r.Left)
+	}
+	if r.Skipped > 0 {
+		fmt.Fprintf(os.Stderr, "%d artifact(s) the sweep will not address were skipped\n", r.Skipped)
+	}
+	if r.Indexes > 0 {
+		fmt.Fprintf(os.Stderr, "%d eligible index(es) wait for a collect a person confirms, which takes their platforms too\n", r.Indexes)
+	}
+}
+
+// holdKept holds every kept archive by its manifest, stopping at the first refusal by the store.
+// Answers how many holders it wrote and how many kept archives the store does not have.
+//
+// A missing archive is counted rather than fatal: there is nothing to hold, and that is a fact
+// for an operator to read (`collection`), not a reason to stop collecting what is not kept. A
+// reference the store cannot be asked about is skipped as the deletion loop skips one
+// (novox/hq issue 226).
+func holdKept(ctx context.Context, store artifacts.Store, kept []string) (wrote, missing int, err error) {
+	for _, reference := range kept {
+		if err := ctx.Err(); err != nil {
+			return wrote, missing, fmt.Errorf("ran out of time before %s: %w", reference, err)
+		}
+		did, err := store.Hold(ctx, reference)
+		switch {
+		case err == nil:
+			if did {
+				wrote++
+			}
+		case errors.Is(err, artifacts.Gone):
+			missing++
+		case errors.Is(err, artifacts.ErrNotOurs):
+		default:
+			return wrote, missing, fmt.Errorf("holding %s: %w", reference, err)
+		}
+	}
+	return wrote, missing, nil
+}
+
+// mostPerSweep is how many artifacts one sweep will ask about. Enough that a mesh building
+// several times a day converges within days of this landing; small enough that no single build
+// waits on the whole backlog.
+const mostPerSweep = 200
+
+// sweepBudget is the longest a sweep will keep a build waiting.
+const sweepBudget = 60 * time.Second

cmd/mesh-controller/collection.go

@@ -0,0 +1,166 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/novox/mesh-controller/internal/artifacts"
+)
+
+// What the artifact store keeps, whether each kept archive is held, and what the sweep may let go
+// (novox/hq issue 253, ADR 0189).
+//
+// **The question to answer before the store's collector runs for real.** The collector deletes
+// every blob no manifest names, and archives were published as bare blobs, so the nightly step
+// runs `--dry-run` until every archive the mesh keeps is held by its manifest. The sweep holds
+// them as builds come; this says how far that has got — "0 unheld" is the number that lets the
+// dry run go.
+//
+// Reads and changes nothing: each kept archive is asked about with HEADs only. Reached over the
+// console through the mesh-controller seat's `command` verb (`collection --json`), which needs no
+// new verb in the seat's row.
+
+type collectionReport struct {
+	// Store is the artifact store as this machine reached it; empty when it is not on the network.
+	Store string `json:"store"`
+	// KeptArchives is how many archives the mesh keeps, for either reason.
+	KeptArchives int `json:"kept_archives"`
+	// Held is how many of them the store holds by their manifest.
+	Held int `json:"held"`
+	// Unheld are the kept archives the collector would delete tonight if it ran for real.
+	Unheld []string `json:"unheld"`
+	// Missing are kept archives the store does not have at all.
+	Missing []string `json:"missing"`
+	// Unasked is how many could not be asked about, and why the asking stopped.
+	Unasked int    `json:"unasked"`
+	Stopped string `json:"stopped,omitempty"`
+	// Eligible is what the sweep may let go of: made by the mesh, kept for no reason, not yet
+	// collected — split by kind.
+	Eligible         int `json:"eligible"`
+	EligibleImages   int `json:"eligible_images"`
+	EligibleArchives int `json:"eligible_archives"`
+	// SafeToCollect is whether every kept archive was asked about and every one is held.
+	SafeToCollect bool `json:"safe_to_collect"`
+}
+
+func collectionCommand(ctx context.Context, args []string) error {
+	set := flag.NewFlagSet("collection", flag.ContinueOnError)
+	asJSON := set.Bool("json", false, "answer as JSON")
+	positionals, err := parseAround(set, args)
+	if err != nil {
+		return err
+	}
+	if len(positionals) != 0 {
+		return errors.New("collection [--json]")
+	}
+
+	open, err := openStores(ctx)
+	if err != nil {
+		return err
+	}
+	defer open.Close()
+	inv := open.inventory
+
+	kept, err := inv.KeptArchives(ctx)
+	if err != nil {
+		return err
+	}
+	eligible, err := inv.ToCollect(ctx)
+	if err != nil {
+		return err
+	}
+	report := collectionReport{KeptArchives: len(kept), Eligible: len(eligible), Unheld: []string{}, Missing: []string{}}
+	for _, reference := range eligible {
+		if strings.Contains(reference, "/blobs/") {
+			report.EligibleArchives++
+		} else {
+			report.EligibleImages++
+		}
+	}
+
+	shelf, err := inv.Catalogue(ctx)
+	if err != nil {
+		return err
+	}
+	report.Store, err = artifactStoreAddress(ctx, inv, shelf, "")
+	if err != nil {
+		return err
+	}
+	if report.Store == "" {
+		report.Unasked = len(kept)
+		report.Stopped = "this mesh has no artifact store on its network"
+	} else {
+		report.Unasked, report.Stopped = askHeld(ctx, artifacts.Store{Address: report.Store}, kept, &report)
+	}
+	report.SafeToCollect = report.Unasked == 0 && len(report.Unheld) == 0
+
+	if *asJSON {
+		encoder := json.NewEncoder(os.Stdout)
+		encoder.SetIndent("", "  ")
+		return encoder.Encode(report)
+	}
+	printCollection(report)
+	return nil
+}
+
+// askHeld asks the store about each kept archive, stopping at the first answer that is not about
+// the archive: a store that cannot be reached for one cannot be for the next, and a page of
+// identical failures says less than one line.
+func askHeld(ctx context.Context, store artifacts.Store, kept []string, report *collectionReport) (int, string) {
+	for i, reference := range kept {
+		held, err := store.Held(ctx, reference)
+		switch {
+		case err == nil && held:
+			report.Held++
+		case err == nil:
+			report.Unheld = append(report.Unheld, reference)
+		case errors.Is(err, artifacts.Gone):
+			report.Missing = append(report.Missing, reference)
+		case errors.Is(err, artifacts.ErrNotOurs):
+			// KeptArchives names only the mesh's own; counted as unasked if one ever is not.
+			report.Unasked++
+		default:
+			return report.Unasked + len(kept) - i, fmt.Sprintf("asking about %s: %v", reference, err)
+		}
+	}
+	return report.Unasked, ""
+}
+
+func printCollection(r collectionReport) {
+	store := r.Store
+	if store == "" {
+		store = "(not on the network)"
+	}
+	fmt.Printf("artifact store       %s\n", store)
+	fmt.Printf("kept archives        %d\n", r.KeptArchives)
+	fmt.Printf("  held               %d\n", r.Held)
+	fmt.Printf("  unheld             %d\n", len(r.Unheld))
+	fmt.Printf("  missing            %d\n", len(r.Missing))
+	if r.Unasked > 0 {
+		fmt.Printf("  not asked          %d (%s)\n", r.Unasked, r.Stopped)
+	}
+	fmt.Printf("eligible to let go   %d (%d images, %d archives)\n", r.Eligible, r.EligibleImages, r.EligibleArchives)
+	if len(r.Unheld) > 0 {
+		fmt.Println("\nunheld — the store's collector would delete these; the next build's sweep holds them:")
+		for _, reference := range r.Unheld {
+			fmt.Printf("  %s\n", reference)
+		}
+	}
+	if len(r.Missing) > 0 {
+		fmt.Println("\nmissing — kept by the mesh, not in the store:")
+		for _, reference := range r.Missing {
+			fmt.Printf("  %s\n", reference)
+		}
+	}
+	fmt.Println()
+	if r.SafeToCollect {
+		fmt.Println("every kept archive is held: the store's collector may run for real")
+	} else {
+		fmt.Println("NOT every kept archive is known to be held: keep the store's collector on --dry-run")
+	}
+}

cmd/mesh-controller/conditions.go

@@ -0,0 +1,483 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"os"
+	"slices"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/nats-io/nats.go"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// What is wrong, kept until observation says it is not (novox/hq to-be 45 §2, ADR 0227).
+//
+// **`status` used to be the only place the mesh said it was wrong, and only to whoever asked.** Every
+// core failure of research 031 was found by a person looking. A condition is the mesh saying it: raised
+// by a watchdog when a signal is late (signals.go), by a probe when an invariant does not hold
+// (doctor.go), or by an event a provider sends (standing.go); kept on the bus with since-when and
+// evidence; said on the bus as it changes, for the operator's channel to carry; and cleared when an
+// observation says it is resolved. Nobody resolves one by hand. A person who knows silences it, for a
+// while, with a reason, and that is recorded as a hand act.
+
+// conditionsFrom is the serving controller's keeper; nil in any other process, which opens its own.
+var conditionsFrom *conditions.Keeper
+
+// keeperOn is a keeper over the store on a connection, saying its transitions on that connection.
+func keeperOn(ctx context.Context, conn *nats.Conn) (*conditions.Keeper, error) {
+	store, history, err := conditions.OnTheBus(ctx, conn)
+	if err != nil {
+		return nil, err
+	}
+	js, err := conn.JetStream()
+	if err != nil {
+		return nil, err
+	}
+	return conditions.NewKeeper(ctx, conditions.Options{Store: store, History: history,
+		Teller: link.OverNATS{Conn: conn, JS: js},
+		Say:    func(format string, args ...any) { fmt.Fprintf(os.Stderr, format+"\n", args...) },
+		// What status leads with changed: composed again soon (a nudge outside the serving controller
+		// does nothing).
+		Changed: func() { statusFrom.nudge(); askerFrom.nudge() },
+		// Written under the lease, carrying its epoch (novox/hq to-be 45 §6).
+		Epoch: func() (uint64, error) { return theLease.epoch(context.WithoutCancel(ctx)) }}), nil
+}
+
+// withKeeper runs f with the serving controller's keeper, or one of its own that says everything
+// it was given before it returns.
+func withKeeper(ctx context.Context, f func(*conditions.Keeper) error) error {
+	if conditionsFrom != nil {
+		return f(conditionsFrom)
+	}
+	return onTheBus(func(conn *nats.Conn) error {
+		k, err := keeperOn(ctx, conn)
+		if err != nil {
+			return err
+		}
+		defer func() {
+			flushing, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+			defer cancel()
+			k.Close(flushing)
+		}()
+		return f(k)
+	})
+}
+
+// openConditions is every open condition, for `status` and `node show`: from the serving keeper, or
+// read from the bus. Where there is no bus to read it from, it says so — never "none open".
+func openConditions(ctx context.Context) ([]conditions.Condition, error) {
+	if conditionsFrom != nil {
+		return conditionsFrom.Open(ctx)
+	}
+	if _, err := broker.BusAddress(); err != nil {
+		return nil, fmt.Errorf("this process has no bus to read the conditions from: %w", err)
+	}
+	var out []conditions.Condition
+	err := onTheBus(func(conn *nats.Conn) error {
+		store, _, err := conditions.OnTheBus(ctx, conn)
+		if err != nil {
+			return err
+		}
+		reading, cancel := context.WithTimeout(ctx, 5*time.Second)
+		defer cancel()
+		out, err = conditions.Read(reading, store)
+		return err
+	})
+	return out, err
+}
+
+// conditionsUsage is how the verb is typed.
+const conditionsUsage = "conditions [--scope S] [--severity urgent|warning] [--machine M] [--json] | " +
+	"conditions show <key> | conditions silence <key> --for <duration> --why <text> | " +
+	"conditions history [--days N] [--key K] [--json]"
+
+// conditionsCommand is `conditions`, `conditions show`, `conditions silence` and `conditions history`.
+func conditionsCommand(ctx context.Context, args []string) error {
+	sub := "list"
+	if len(args) > 0 && !strings.HasPrefix(args[0], "-") {
+		sub, args = args[0], args[1:]
+	}
+	switch sub {
+	case "list":
+		return listConditions(ctx, args, os.Stdout)
+	case "show":
+		return showCondition(ctx, args, os.Stdout)
+	case "silence":
+		return silenceCondition(ctx, args)
+	case "history":
+		return conditionHistory(ctx, args, os.Stdout)
+	}
+	return errors.New(conditionsUsage)
+}
+
+func listConditions(ctx context.Context, args []string, w io.Writer) error {
+	set := flag.NewFlagSet("conditions", flag.ContinueOnError)
+	usageTo(set, w)
+	scope := set.String("scope", "", "only this scope: "+strings.Join(conditions.Scopes, ", "))
+	severity := set.String("severity", "", "only urgent, or only warning")
+	machine := set.String("machine", "", "only those about this machine")
+	asJSON := set.Bool("json", false, "as data")
+	if rest, err := parseAround(set, args); err != nil {
+		return err
+	} else if len(rest) > 0 {
+		return errors.New(conditionsUsage)
+	}
+	if *severity != "" && *severity != string(conditions.Urgent) && *severity != string(conditions.Warning) {
+		return fmt.Errorf("a severity is urgent or warning, not %q", *severity)
+	}
+	open, err := openConditions(ctx)
+	if err != nil {
+		return err
+	}
+	var out []conditions.Condition
+	for _, c := range open {
+		if (*scope == "" || c.Subject.Scope == *scope) && (*severity == "" || string(c.Severity) == *severity) &&
+			(*machine == "" || concerns(c, *machine)) {
+			out = append(out, c)
+		}
+	}
+	if *asJSON {
+		return printJSONTo(w, map[string]any{"conditions": inBrief(out), "open": len(open), "counted": counted(out),
+			"note": "urgent first, then oldest first; a condition clears when observation says so, never by hand; " +
+				"each with its newest evidence — `conditions key=<key>` gives one whole"})
+	}
+	if len(out) == 0 {
+		if len(open) == 0 {
+			fmt.Fprintln(w, "no open conditions")
+		} else {
+			fmt.Fprintf(w, "none of the %d open condition(s) is about that\n", len(open))
+		}
+		return nil
+	}
+	for _, line := range conditionLines(out, time.Now()) {
+		fmt.Fprintln(w, line)
+	}
+	return nil
+}
+
+// briefEvidence is how many observations a condition carries in a list of them: its newest. The store
+// keeps ten, and a list of hundreds of conditions with ten each was the larger half of an answer more
+// than the bus carries in one message (novox/hq issue 314). One condition whole is `conditions key=`.
+const briefEvidence = 1
+
+// conditionInBrief is a condition as a list carries it: its newest evidence, with how much more there is
+// and where to read it. Everything else of it, so a reader of the list — the operator's channel among
+// them — reads the same condition it always did.
+type conditionInBrief struct {
+	conditions.Condition
+	// EvidenceKept is how many observations the condition keeps, when the list shows fewer.
+	EvidenceKept int    `json:"evidence-kept,omitempty"`
+	More         string `json:"more,omitempty"`
+}
+
+// inBrief is a list of conditions in brief; never null.
+func inBrief(list []conditions.Condition) []conditionInBrief {
+	out := make([]conditionInBrief, 0, len(list))
+	for _, c := range list {
+		b := conditionInBrief{Condition: c}
+		if len(c.Evidence) > briefEvidence {
+			b.EvidenceKept = len(c.Evidence)
+			b.Evidence = c.Evidence[:briefEvidence:briefEvidence]
+			b.More = c.Show()
+		}
+		out = append(out, b)
+	}
+	return out
+}
+
+// counted is how many of a list each source raised of each kind — `D14 stalled: 689` — so a list of
+// hundreds says its shape before its lines.
+func counted(list []conditions.Condition) map[string]int {
+	out := map[string]int{}
+	for _, c := range list {
+		out[c.Source+" "+c.Kind]++
+	}
+	return out
+}
+
+// concerns says whether a condition is about a machine: it names it, or its key does.
+func concerns(c conditions.Condition, machine string) bool {
+	if c.Subject.Machine == machine || slices.Contains(c.Subject.Also, machine) {
+		return true
+	}
+	for _, part := range strings.Split(c.Key, ".") {
+		if part == machine {
+			return true
+		}
+	}
+	return false
+}
+
+// conditionLines is how a list of conditions reads: one line each, its silence under it.
+func conditionLines(list []conditions.Condition, now time.Time) []string {
+	var out []string
+	for _, c := range list {
+		times := ""
+		if c.Count > 1 {
+			times = fmt.Sprintf(", raised %d times", c.Count)
+		}
+		out = append(out, fmt.Sprintf("  %-7s %s — %s (since %s%s)", strings.ToUpper(string(c.Severity)),
+			c.Key, c.Summary, c.Raised.Local().Format("2006-01-02 15:04"), times))
+		if c.SilencedAt(now) {
+			out = append(out, fmt.Sprintf("          silenced until %s by %s: %s",
+				c.Silenced.Until.Local().Format("2006-01-02 15:04"), c.Silenced.By, c.Silenced.Why))
+		}
+	}
+	return out
+}
+
+func showCondition(ctx context.Context, args []string, w io.Writer) error {
+	set := flag.NewFlagSet("conditions show", flag.ContinueOnError)
+	usageTo(set, w)
+	asJSON := set.Bool("json", false, "as data")
+	rest, err := parseAround(set, args)
+	if err != nil {
+		return err
+	}
+	if len(rest) != 1 {
+		return errors.New("conditions show <key>")
+	}
+	key := rest[0]
+	var c conditions.Condition
+	var found bool
+	if conditionsFrom != nil {
+		c, found, err = conditionsFrom.Get(ctx, key)
+	} else {
+		err = onTheBus(func(conn *nats.Conn) error {
+			store, _, err := conditions.OnTheBus(ctx, conn)
+			if err != nil {
+				return err
+			}
+			c, found, err = conditions.ReadOne(ctx, store, key)
+			return err
+		})
+	}
+	if err != nil {
+		return err
+	}
+	if !found {
+		return fmt.Errorf("no condition %s is open — `conditions` lists those that are, and `conditions "+
+			"history --key %s` what became of it", key, key)
+	}
+	if *asJSON {
+		return printJSONTo(w, c)
+	}
+	now := time.Now()
+	fmt.Fprintf(w, "%s  %s\n  %s\n\n", strings.ToUpper(string(c.Severity)), c.Key, c.Summary)
+	fmt.Fprintf(w, "  kind       %s\n  about      %s %s", c.Kind, c.Subject.Scope, c.Subject.ID)
+	if c.Subject.Machine != "" {
+		fmt.Fprintf(w, ", on %s", c.Subject.Machine)
+	}
+	fmt.Fprintf(w, "\n  raised by  %s\n  since      %s (%s ago), observed %d time(s), last %s ago\n",
+		c.Source, c.Raised.Local().Format("2006-01-02 15:04:05"), roughly(now.Sub(c.Raised)), c.Observations,
+		now.Sub(c.LastObserved).Round(time.Second))
+	if c.Count > 1 {
+		fmt.Fprintf(w, "  raised     %d times, each within ten minutes of clearing\n", c.Count)
+	}
+	fmt.Fprintf(w, "  resolved   by %s\n", resolverWords(c.Resolver))
+	if c.Silenced != nil {
+		fmt.Fprintf(w, "  silenced   until %s by %s: %s\n", c.Silenced.Until.Local().Format("2006-01-02 15:04"),
+			c.Silenced.By, c.Silenced.Why)
+	}
+	if len(c.Tried) > 0 {
+		fmt.Fprintln(w, "\n  tried:")
+		for _, t := range c.Tried {
+			fmt.Fprintf(w, "    %s  %s — %s: %s\n", t.At.Local().Format("2006-01-02 15:04"), orHealer(t.By), t.What, t.Outcome)
+		}
+	}
+	fmt.Fprintln(w, "\n  evidence, newest first:")
+	for _, e := range c.Evidence {
+		fmt.Fprintf(w, "    %s  %s\n", e.At.Local().Format("2006-01-02 15:04:05"), e.Said)
+	}
+	return nil
+}
+
+func resolverWords(r string) string {
+	switch r {
+	case conditions.ResolverSelf:
+		return "itself: it clears when observation says it is resolved"
+	case conditions.ResolverOperator:
+		return "the operator: nothing in the mesh will repair it"
+	case conditions.ResolverAgent:
+		return "an agent"
+	}
+	return r
+}
+
+// silenceCondition stops a condition's messages for a while (to-be 45 §2). A hand act: recorded with
+// who and why before it is done, its cause the condition's kind unless one is given.
+func silenceCondition(ctx context.Context, args []string) error {
+	set := flag.NewFlagSet("conditions silence", flag.ContinueOnError)
+	forFlag := set.String("for", "", "how long: 30m, 4h, 2d — at most 7d")
+	acts := addHandActFlags(set)
+	rest, err := parseAround(set, args)
+	if err != nil {
+		return err
+	}
+	if len(rest) != 1 {
+		return errors.New("conditions silence <key> --for <duration> --why <text>")
+	}
+	key := rest[0]
+	if err := acts.require("conditions silence"); err != nil {
+		return err
+	}
+	d, err := parseFor(*forFlag)
+	if err != nil {
+		return err
+	}
+	if d > conditions.MaxSilence {
+		return fmt.Errorf("a condition is silenced for at most %s at once; past it, say so again", conditions.MaxSilence)
+	}
+	return withKeeper(ctx, func(k *conditions.Keeper) error {
+		c, found, err := k.Get(ctx, key)
+		if err != nil {
+			return err
+		}
+		if !found {
+			return fmt.Errorf("no condition %s is open — `conditions` lists them. Nothing was silenced", key)
+		}
+		if strings.TrimSpace(*acts.cause) == "" {
+			*acts.cause = c.Kind
+		}
+		*acts.condition = key
+		acts.record(ctx, "conditions silence", []string{key, "--for", *forFlag})
+		held, err := k.Silence(ctx, key, d, link.Caller(), *acts.why)
+		if err != nil {
+			return err
+		}
+		fmt.Printf("%s is silenced until %s: no message is sent for it until then. It is still open, and "+
+			"`status` still says it; it clears when observation says it is resolved\n",
+			held.Key, held.Silenced.Until.Local().Format("2006-01-02 15:04"))
+		return nil
+	})
+}
+
+// parseFor reads a duration, days included.
+func parseFor(s string) (time.Duration, error) {
+	s = strings.TrimSpace(s)
+	if s == "" {
+		return 0, errors.New("say for how long: --for 30m, 4h or 2d")
+	}
+	if days, ok := strings.CutSuffix(s, "d"); ok {
+		n, err := strconv.Atoi(days)
+		if err != nil || n <= 0 {
+			return 0, fmt.Errorf("%q is not a number of days", s)
+		}
+		return time.Duration(n) * 24 * time.Hour, nil
+	}
+	d, err := time.ParseDuration(s)
+	if err != nil || d <= 0 {
+		return 0, fmt.Errorf("%q is not a duration: 30m, 4h or 2d", s)
+	}
+	return d, nil
+}
+
+func conditionHistory(ctx context.Context, args []string, w io.Writer) error {
+	set := flag.NewFlagSet("conditions history", flag.ContinueOnError)
+	usageTo(set, w)
+	days := set.Int("days", 7, "how many days back, at most 90")
+	key := set.String("key", "", "only this condition")
+	asJSON := set.Bool("json", false, "as data")
+	if rest, err := parseAround(set, args); err != nil {
+		return err
+	} else if len(rest) > 0 {
+		return errors.New("conditions history [--days N] [--key K] [--json]")
+	}
+	since := time.Now().Add(-time.Duration(*days) * 24 * time.Hour)
+	var events []conditions.Event
+	read := func(h conditions.History) error {
+		var err error
+		events, err = h.Since(ctx, since)
+		return err
+	}
+	var err error
+	if conditionsFrom != nil {
+		events, err = conditionsFrom.HistorySince(ctx, since)
+	} else {
+		err = onTheBus(func(conn *nats.Conn) error {
+			_, history, err := conditions.OnTheBus(ctx, conn)
+			if err != nil {
+				return err
+			}
+			return read(history)
+		})
+	}
+	if err != nil {
+		return err
+	}
+	var out []conditions.Event
+	for _, e := range events {
+		if *key == "" || e.Key == *key {
+			out = append(out, e)
+		}
+	}
+	if *asJSON {
+		if out == nil {
+			out = []conditions.Event{}
+		}
+		return printJSONTo(w, map[string]any{"history": out, "days": *days})
+	}
+	if len(out) == 0 {
+		fmt.Fprintf(w, "nothing was raised, changed or cleared in the last %d day(s)\n", *days)
+		return nil
+	}
+	for _, e := range out {
+		line := fmt.Sprintf("%s  %-13s %s", e.At.Local().Format("2006-01-02 15:04:05"), e.Change, e.Key)
+		switch e.Change {
+		case conditions.ChangeRaised, conditions.ChangeReopened:
+			line += " — " + e.Summary
+		case conditions.ChangeSeverity:
+			line += fmt.Sprintf(" — %s, was %s", e.Severity, e.Was)
+		case conditions.ChangeResolver:
+			line += fmt.Sprintf(" — %s, was %s", e.Resolver, e.Was)
+		default:
+			if e.Why != "" {
+				line += " — " + e.Why
+			}
+		}
+		fmt.Fprintln(w, line)
+	}
+	return nil
+}
+
+// printConditions is the status section that leads it: every open condition, urgent first, oldest
+// first, silenced ones with their expiry (to-be 45 §2). A store that could not be read is said, and
+// is not "none open".
+func printConditions(list []conditions.Condition, unread string, now time.Time) {
+	if unread != "" {
+		fmt.Printf("the open conditions could NOT be read, so whether anything is wrong is not known: %s\n\n", unread)
+		return
+	}
+	if len(list) == 0 {
+		return
+	}
+	urgent := 0
+	for _, c := range list {
+		if c.Severity == conditions.Urgent {
+			urgent++
+		}
+	}
+	fmt.Printf("%d open condition(s), %d urgent:\n\n", len(list), urgent)
+	for _, line := range conditionLines(list, now) {
+		fmt.Println(line)
+	}
+	fmt.Printf("\n  `conditions show <key>` says more; each clears when observation says it is resolved, " +
+		"never by hand — `conditions silence <key> --for <d> --why <text>` stops its messages\n\n")
+}
+
+// orHealer is who tried, as an attempt names it.
+func orHealer(by string) string {
+	if by == "" {
+		return "a healer"
+	}
+	return by
+}

cmd/mesh-controller/conditions_brief_test.go

@@ -0,0 +1,108 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/conditions"
+)
+
+// stalledConditions are n open conditions like those of 2026-10-08: one per delivery held past its bound,
+// each keeping all its evidence.
+func stalledConditions(n int) []conditions.Condition {
+	at := time.Date(2026, 10, 8, 9, 0, 0, 0, time.UTC)
+	var out []conditions.Condition
+	for i := 0; i < n; i++ {
+		id := fmt.Sprintf("d-%012x", 0x51a11ed+i)
+		lines := stalledObservations([]stalledLine{{ID: id, State: "checking", For: "13h2m", Bound: "45m",
+			H2: "close: recheck", Says: "the check was asked and nothing has answered"}})
+		o := lines[0]
+		c := conditions.Condition{Key: o.Key(), Kind: o.Kind, Subject: conditions.Subject{Scope: o.Scope, ID: o.ID},
+			Severity: o.Severity, Summary: o.Summary, Source: probeDeliveriesID, Raised: at, LastObserved: at,
+			Observations: 160, Count: 1, Resolver: conditions.ResolverSelf}
+		for e := 0; e < conditions.KeptEvidence; e++ {
+			c.Evidence = append(c.Evidence, conditions.Evidence{At: at.Add(time.Duration(e) * 5 * time.Minute),
+				Said: "checking for " + (13*time.Hour + time.Duration(e)*time.Minute).String()})
+		}
+		out = append(out, c)
+	}
+	return out
+}
+
+// novox/hq issue 314: a list of hundreds of open conditions carries each one's newest evidence, with
+// how much more it keeps and where to read it, and the verb's answer says it once — as data, not again
+// as the text the command printed. On 2026-10-08, 689 stalled deliveries made that answer more than the
+// bus carries in one message; now it is less than half of one.
+func TestAListOfConditionsCarriesEachInBrief(t *testing.T) {
+	list := stalledConditions(689)
+	printed, _ := json.MarshalIndent(map[string]any{"conditions": inBrief(list), "open": len(list),
+		"counted": counted(list)}, "", "  ")
+	var parsed any
+	if err := json.Unmarshal(printed, &parsed); err != nil {
+		t.Fatal(err)
+	}
+	wire, _ := json.Marshal(map[string]any{"result": verbAnswer{OK: true, Answer: parsed,
+		Output: "its answer, as data, is `answer`\n"}})
+	before, _ := json.MarshalIndent(map[string]any{"conditions": list}, "", "  ")
+	t.Logf("689 stalled deliveries: %d bytes on the wire, where the whole list printed was %d and was sent twice",
+		len(wire), len(before))
+	if len(wire) >= 512<<10 {
+		t.Fatalf("the answer of 689 conditions is %d bytes, not under half of one message of the bus", len(wire))
+	}
+	var doc struct {
+		Conditions []conditionInBrief `json:"conditions"`
+		Counted    map[string]int     `json:"counted"`
+	}
+	if err := json.Unmarshal(printed, &doc); err != nil {
+		t.Fatal(err)
+	}
+	c := doc.Conditions[0]
+	if len(doc.Conditions) != 689 || len(c.Evidence) != 1 || c.EvidenceKept != conditions.KeptEvidence ||
+		c.Key != list[0].Key || c.Summary != list[0].Summary || !strings.Contains(c.More, "key="+c.Key) {
+		t.Fatalf("a condition in brief reads %+v", c)
+	}
+	if doc.Counted["D14 stalled"] != 689 {
+		t.Fatalf("counted %v", doc.Counted)
+	}
+	if one := inBrief(list[:1])[0]; len(list[0].Evidence) != conditions.KeptEvidence || one.Evidence[0] != list[0].Evidence[0] {
+		t.Fatal("the brief changed the condition it was made from, or kept other than the newest")
+	}
+}
+
+// The self-check's verdict carries at most overviewFindings of one probe's findings, with their count and
+// how to read them all; `doctor probe=` gives that probe whole (novox/hq issue 314).
+func TestAVerdictCarriesAProbesFindingsInBrief(t *testing.T) {
+	var found []string
+	for i := 0; i < 689; i++ {
+		found = append(found, fmt.Sprintf("delivery d-%012x has been checking for 13h, past its bound of 45m", i))
+	}
+	run := doctorRun{Run: "run-1", Probes: []probeVerdict{{ID: "D14", Verdict: "failed", Found: found},
+		{ID: "D1", Verdict: "passed"}}}
+	answer, err := verdictAnswer(run, time.Now(), "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	brief := answer["run"].(doctorRun).Probes[0]
+	if len(brief.Found) != overviewFindings || brief.FoundCount != 689 || !strings.Contains(brief.More, "probe=D14") {
+		t.Fatalf("the verdict carries %d findings of D14, count %d, more %q", len(brief.Found), brief.FoundCount, brief.More)
+	}
+	if len(run.Probes[0].Found) != 689 {
+		t.Fatal("the overview cut the run it was made from")
+	}
+	whole, err := verdictAnswer(run, time.Now(), "d14")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if p := whole["run"].(doctorRun).Probes; len(p) != 1 || len(p[0].Found) != 689 || p[0].More != "" {
+		t.Fatalf("doctor probe=D14 answered %+v", p)
+	}
+	if _, err := verdictAnswer(run, time.Now(), "D99"); err == nil {
+		t.Fatal("a probe the run does not have was answered")
+	}
+	if !strings.Contains(doctorText(answer), "probe=D14` gives them all") {
+		t.Fatalf("the text does not say how to read them all:\n%s", doctorText(answer))
+	}
+}

cmd/mesh-controller/conditions_test.go

@@ -0,0 +1,107 @@
+package main
+
+import (
+	"errors"
+	"strings"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/conditions"
+)
+
+// The verbs of the condition store (novox/hq to-be 45 §2) as the console reaches them, and status led
+// by what is open.
+
+func TestTheConditionsVerbComposesEachShape(t *testing.T) {
+	for _, c := range []struct {
+		args map[string]any
+		want string
+	}{
+		{map[string]any{}, "conditions --json"},
+		{map[string]any{"severity": "urgent", "machine": "ace"}, "conditions --json --severity urgent --machine ace"},
+		{map[string]any{"key": "machine.ace.silent"}, "conditions show machine.ace.silent --json"},
+		{map[string]any{"history": "true", "days": "3", "key": "machine.ace.silent"},
+			"conditions history --json --days 3 --key machine.ace.silent"},
+		{map[string]any{"silence": "machine.ace.silent", "for": "2h", "why": "on the train"},
+			"conditions silence machine.ace.silent --for 2h --why on the train"},
+		{map[string]any{"run": "true"}, "doctor run --json"},
+		{map[string]any{}, "doctor --json"},
+	} {
+		verb := "conditions"
+		if strings.HasPrefix(c.want, "doctor") {
+			verb = "doctor"
+		}
+		argv, err := argvFor(verb, c.args)
+		if err != nil || strings.Join(argv, " ") != c.want {
+			t.Errorf("%s %v composed %q (%v), want %q", verb, c.args, strings.Join(argv, " "), err, c.want)
+		}
+	}
+	for _, c := range []struct {
+		verb string
+		args map[string]any
+	}{
+		{"conditions", map[string]any{"silence": "machine.ace.silent", "why": "x"}},                           // no for
+		{"doctor", map[string]any{"run": "true", "signals": "true"}},                                          // two at once
+		{"conditions", map[string]any{"silence": "machine.ace.silent", "for": "1h", "why": "x", "days": "3"}}, // passed over
+	} {
+		if argv, err := argvFor(c.verb, c.args); err == nil {
+			t.Errorf("%s %v composed %v", c.verb, c.args, argv)
+		}
+	}
+	if repairingCommand([]string{"conditions", "silence", "k"}) != "conditions silence" {
+		t.Error("a silence is not a hand act")
+	}
+}
+
+// **A silence through the verb is recorded and bounded**; the condition stays open.
+func TestASilenceThroughTheVerbHoldsAndTheConditionStaysOpen(t *testing.T) {
+	k, _ := withConditionsInMemory(t)
+	ctx := t.Context()
+	if _, err := k.Observe(ctx, conditions.Observation{Scope: conditions.ScopeMachine, ID: "ace", Kind: "silent",
+		Severity: conditions.Warning, Summary: "ace is silent", Source: "S1"}); err != nil {
+		t.Fatal(err)
+	}
+	if err := conditionsCommand(ctx, []string{"silence", "machine.ace.silent", "--for", "2d"}); err == nil {
+		t.Fatal("silenced without saying why")
+	}
+	if err := conditionsCommand(ctx, []string{"silence", "machine.ace.silent", "--for", "8d", "--why", "x"}); err == nil {
+		t.Fatal("silenced for more than a week")
+	}
+	said := printed(t, func() error {
+		return conditionsCommand(ctx, []string{"silence", "machine.ace.silent", "--for", "2d", "--why", "on the train"})
+	})
+	if !strings.Contains(said, "is silenced until") {
+		t.Fatalf("%s", said)
+	}
+	c, found, _ := k.Get(ctx, "machine.ace.silent")
+	if !found || c.Silenced == nil || c.Silenced.Why != "on the train" {
+		t.Fatalf("%+v", c)
+	}
+	listed := printed(t, func() error { return conditionsCommand(ctx, nil) })
+	if !strings.Contains(listed, "machine.ace.silent") || !strings.Contains(listed, "silenced until") {
+		t.Fatalf("%s", listed)
+	}
+}
+
+// **Conditions that cannot be read are not none open**: status says so, and is not well.
+func TestUnreadableConditionsAreNotAWellMesh(t *testing.T) {
+	open := aMesh(t)
+	_, store := withConditionsInMemory(t)
+	store.SetFail(errors.New("the bus is away"))
+	asked, err := theThreeQuestions(t.Context(), open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if asked.well() || asked.conditionsUnread == "" {
+		t.Fatalf("well with its conditions unread: %+v", asked.conditionsUnread)
+	}
+	said := printed(t, func() error { return printStatus(asked) })
+	if !strings.HasPrefix(said, "the open conditions could NOT be read") || strings.Contains(said, "no open conditions") {
+		t.Fatalf("%s", said)
+	}
+	store.SetFail(nil)
+	asked, _ = theThreeQuestions(t.Context(), open)
+	said = printed(t, func() error { return printStatus(asked) })
+	if asked.well() && !strings.Contains(said, "no open conditions;") {
+		t.Fatalf("the all-well sentence does not say no conditions are open:\n%s", said)
+	}
+}

cmd/mesh-controller/confirm.go

@@ -0,0 +1,67 @@
+package main
+
+import (
+	"context"
+	"sync"
+
+	"github.com/novox/mesh-controller/internal/conditions"
+)
+
+// **A finding one look can be wrong about is raised on the second look in a row** (novox/hq issue 277).
+//
+// D2 raised its resolver urgent on one unanswered question, asked once, while the resolver's machine
+// was loaded by a push and a build starting; thirty questions right after were answered at once. A
+// single sample of something that is answered over the network, or timed on a machine under load,
+// is not the invariant failing. So a source marks such a finding `Confirm`, and this holds it back:
+//
+//   - raised when the source's previous look saw it too — two runs of the self-check in a row (five
+//     minutes apart), or two ticks of the watchdogs (half a minute) — at the severity the source says;
+//   - kept while it is already open, however it is seen, so a condition the next look still sees is
+//     never cleared and raised again (flapping is not news; a reopening within ReopenWithin still is);
+//   - cleared, as everything is, by the look that no longer sees it.
+//
+// A finding held back is not a pass: the self-check's verdict names it as unconfirmed. A finding that is
+// a definite answer — a resolver that answered wrongly, a stream that is not there — is not marked, and
+// is raised at once.
+type confirming struct {
+	mu sync.Mutex
+	// last is, by source, the keys of the Confirm findings its previous look saw.
+	last map[string]map[string]bool
+}
+
+// pass splits one source's findings into what is raised now and what is held for the next look, and
+// remembers what it saw. An open condition that cannot be read is kept: unknown is not a reason to
+// hold a finding back.
+func (c *confirming) pass(ctx context.Context, keeper *conditions.Keeper, source string,
+	found []conditions.Observation) (raise, held []conditions.Observation) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if c.last == nil {
+		c.last = map[string]map[string]bool{}
+	}
+	before, seen := c.last[source], map[string]bool{}
+	for _, o := range found {
+		if !o.Confirm {
+			raise = append(raise, o)
+			continue
+		}
+		key := o.Key()
+		seen[key] = true
+		if before[key] || isOpen(ctx, keeper, key) {
+			raise = append(raise, o)
+			continue
+		}
+		held = append(held, o)
+	}
+	c.last[source] = seen
+	return raise, held
+}
+
+// isOpen says whether a condition is open; one that cannot be read is taken as open.
+func isOpen(ctx context.Context, keeper *conditions.Keeper, key string) bool {
+	if keeper == nil {
+		return false
+	}
+	_, open, err := keeper.Get(ctx, key)
+	return open || err != nil
+}

cmd/mesh-controller/credential_on_assign_test.go

@@ -0,0 +1,90 @@
+package main
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// A fresh assignment is pushed before its credential exists (novox/hq issue 203): `assign` recorded
+// the module, `push` sealed a random own secret where the bus credential belongs, and the process
+// crash-looped until a person ran `module issue` and pushed again. Now assigning a module that speaks
+// on the bus issues its credential in the same act — or, when the bus cannot be reached from here,
+// says which verb to run — and a push never seals a placeholder in a credential's place.
+
+func aTalker() catalogue.Manifest {
+	return catalogue.Manifest{Module: "talker", Version: "1",
+		OwnSecrets: catalogue.OwnSecrets{"broker": {Path: "/var/lib/mesh/talker/broker"}},
+		Resources: []map[string]any{
+			{"id": "state", "type": "directory", "path": "/var/lib/mesh/talker", "mode": "0700"},
+		}}
+}
+
+func TestAssigningAModuleThatSpeaksOnTheBusNamesItsCredential(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	register(t, open, aTalker())
+
+	// No bus is known to this process, so the credential cannot be issued here: the assignment
+	// stands and says exactly what must happen before a push — never silently.
+	said, err := assign(ctx, open, "laptop", "talker")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(said, "module issue talker --node laptop") {
+		t.Fatalf("an assignment whose credential could not be issued does not name the verb:\n%s", said)
+	}
+
+	// And the push refuses to send it, naming the same verb, rather than sealing a placeholder.
+	plan, settings, err := planFor(ctx, open, "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, err = declarationFor(ctx, open, "laptop", plan, settings)
+	if err == nil {
+		t.Fatal("a push sealed a placeholder where talker's bus credential belongs")
+	}
+	if !strings.Contains(err.Error(), "module issue talker --node laptop") || !strings.Contains(err.Error(), "issue 203") {
+		t.Fatalf("the refusal does not say what to run: %v", err)
+	}
+
+	// Once the user is minted, the push goes on to the credential the mesh sealed, and re-assigning
+	// does not mint again: a credential rotates on purpose, never by habit.
+	if _, err := open.inventory.MintBusPassword(ctx, inventory.BusUser{
+		Username: "laptop.talker", Kind: inventory.BusModule, Node: "laptop", Module: "talker"}); err != nil {
+		t.Fatal(err)
+	}
+	hash, _, err := open.inventory.BusUserHash(ctx, "laptop.talker")
+	if err != nil {
+		t.Fatal(err)
+	}
+	said, err = assign(ctx, open, "laptop", "talker")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Contains(said, "module issue") {
+		t.Fatalf("a module with a minted credential was told to issue one:\n%s", said)
+	}
+	again, _, err := open.inventory.BusUserHash(ctx, "laptop.talker")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if again != hash {
+		t.Fatal("re-assigning rotated the credential")
+	}
+}
+
+// A module that declares no broker secret is left alone: nothing to issue, nothing said.
+func TestAssigningAModuleThatDoesNotSpeakSaysNothingOfCredentials(t *testing.T) {
+	open := aMesh(t)
+	register(t, open, helloWeb())
+	said, err := assign(t.Context(), open, "laptop", "hello-web")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Contains(said, "credential") {
+		t.Fatalf("a module without a broker secret was told about credentials:\n%s", said)
+	}
+}

cmd/mesh-controller/data.go

@@ -0,0 +1,931 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"log"
+	"sort"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/nats-io/nats.go"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// A module declares the data it holds, and the mesh protects and watches it from that declaration
+// (novox/hq ADR 0233).
+//
+// The self-check's D13 composes what every machine declares, asks each machine's backup holder what
+// it measured of every item — size, newest write, newest good backup, the redundant storage it is on —
+// and keeps both. From that, and from what every provider says it holds for its consumers, it raises,
+// each URGENT for what is irreplaceable and a WARNING for what is valuable (the operator's ranking):
+//
+//   - `data-shrank`: an item holds less than half of its largest size in seven days, and at least
+//     shrinkFloor less; `data-missing`: its path is gone;
+//   - `empty-replacement`: an item, or a consumer's data at a provider, is less than half the size of a
+//     copy of the same thing kept elsewhere — on 2026-10-05 five applications ran for twenty hours on
+//     empty databases while their real ones sat on another machine (issue 273);
+//   - `data-held-twice` (warning): a consumer has active data at two providers and their sizes cannot
+//     be compared;
+//   - `data-quiet`: an item said to be written all the time has not been, within its bound;
+//   - `backup-stale`: an item's newest good backup is older than its bound, or there is none;
+//   - `array-degraded`: the redundant storage an item is on is not healthy, or cannot be read;
+//     `protection-missing`: an item said to be protected by redundancy is on storage that is not;
+//   - `cleanup-waiting` (warning): an item retired more than thirty days, waiting for a person.
+//
+// And it retires: an irreplaceable or valuable item in a module's own directory that its machine no
+// longer declares — its module unassigned — is kept, marked retired with when and why, and listed by
+// `cleanup list` until `cleanup delete` removes it. The node-engine never deletes a directory with
+// anything in it; this is the record of what it kept. An operator's path is never retired or deleted.
+
+// The condition kinds of D13.
+const (
+	kindDataShrank       = "data-shrank"
+	kindEmptyReplacement = "empty-replacement"
+	kindDataHeldTwice    = "data-held-twice"
+	kindDataQuiet        = "data-quiet"
+	kindBackupStale      = "backup-stale"
+	kindDataUnmeasured   = "data-unmeasured"
+	// kindDataMissing is a watched item whose path is gone.
+	kindDataMissing = "data-missing"
+	// kindArrayDegraded is redundant storage watched data is on that is not healthy, or cannot be read.
+	kindArrayDegraded = "array-degraded"
+	// kindProtectionMissing is an item said to be protected by redundancy, on storage that is not.
+	kindProtectionMissing = "protection-missing"
+)
+
+// probeDataID is the self-check's id for this probe.
+const probeDataID = "D13"
+
+// The bounds the findings are read against.
+var (
+	// shrinkWindow is how far back the largest size is looked for.
+	shrinkWindow = 7 * 24 * time.Hour
+	// shrinkFloor is the least loss that is worth saying: two empty databases differ by a few
+	// megabytes, and half of almost nothing is noise.
+	shrinkFloor int64 = 16 << 20
+	// dataAsk is how long one machine's holder, or one provider, is given to answer.
+	dataAsk = 8 * time.Second
+)
+
+// keyOfItem is one item's condition id: its machine, module and item.
+func keyOfItem(machine, module, item string) string { return machine + "." + module + "." + item }
+
+// holderAnswer is what a node-backup holder's `backed-up` says of one module (ADR 0233 adds Data).
+type holderAnswer struct {
+	Module string       `json:"module"`
+	Data   []holderItem `json:"data"`
+}
+
+// holderItem is one item as the holder measured it.
+type holderItem struct {
+	Item       string     `json:"item"`
+	Class      string     `json:"class"`
+	Path       string     `json:"path"`
+	SizeBytes  *int64     `json:"size_bytes"`
+	LastWrite  *time.Time `json:"last_write"`
+	MeasuredAt *time.Time `json:"measured_at"`
+	LastBackup *time.Time `json:"last_backup"`
+	Error      string     `json:"error,omitempty"`
+	// Precision is what the size is: exact, a dataset's, partial, or none (ADR 0233).
+	Precision string `json:"precision,omitempty"`
+	// Redundancy is the redundant storage the item is on, where the holder could tell (ADR 0233).
+	Redundancy *inventory.Redundancy `json:"redundancy,omitempty"`
+}
+
+// readHolder reads a holder's answer into measurements by module and item.
+func readHolder(raw json.RawMessage) (map[string]map[string]inventory.Measurement, error) {
+	var modules []holderAnswer
+	if err := json.Unmarshal(raw, &modules); err != nil {
+		return nil, fmt.Errorf("its answer is not readable: %w", err)
+	}
+	out := map[string]map[string]inventory.Measurement{}
+	for _, m := range modules {
+		for _, it := range m.Data {
+			if out[m.Module] == nil {
+				out[m.Module] = map[string]inventory.Measurement{}
+			}
+			out[m.Module][it.Item] = inventory.Measurement{Path: it.Path, Size: it.SizeBytes, LastWrite: it.LastWrite,
+				MeasuredAt: it.MeasuredAt, LastBackup: it.LastBackup, Error: it.Error, Redundancy: it.Redundancy,
+				Precision: it.Precision}
+		}
+	}
+	return out, nil
+}
+
+// declaredOn is every data item a machine's composition declares, and the module there that holds
+// node-backup to measure them — empty for none.
+func declaredOn(plan catalogue.Resolution) ([]inventory.DeclaredData, string) {
+	var out []inventory.DeclaredData
+	held := ""
+	for _, m := range plan.Modules {
+		for _, c := range m.Claims {
+			if s, known := catalogue.SeatNamed(c.Name); known && s.Name == catalogue.BackupSeat {
+				held = m.Module
+			}
+		}
+		for _, it := range m.DataItems() {
+			out = append(out, inventory.DeclaredData{Module: m.Module, Item: it.ID, Class: it.Class,
+				Owned: it.OwnedByModule(), Protection: it.Protection()})
+		}
+	}
+	return out, held
+}
+
+// consumerCopy is one provider's account of one consumer: where, how big, and whether still active.
+type consumerCopy struct {
+	Node, Module, Consumer string
+	Size                   *int64
+	Retired                bool
+	// Class is how precious the consumer's data is: the stricter of what the provider keeps for its
+	// consumers and what the consumer says it keeps there (`kept-by`).
+	Class string
+}
+
+// probeData is D13.
+func probeData(ctx context.Context, d *doctor) ([]conditions.Observation, error) {
+	if d.js == nil {
+		return nil, errors.New("no bus to ask the machines over")
+	}
+	open := d.open
+	shelf, err := open.inventory.Catalogue(ctx)
+	if err != nil {
+		return nil, err
+	}
+	nodes, err := open.inventory.Nodes(ctx)
+	if err != nil {
+		return nil, err
+	}
+	heard := heardMachines(d)
+	now := time.Now()
+	delivered, err := readDeliveries(ctx, open.inventory)
+	if err != nil {
+		return nil, err
+	}
+
+	type machine struct {
+		name     string
+		declared []inventory.DeclaredData
+		held     bool
+		measured map[string]map[string]inventory.Measurement
+		askErr   error
+	}
+	var machines []*machine
+	for _, n := range nodes {
+		plan, _, err := planFor(ctx, open, n.Name)
+		if err != nil {
+			if ctx.Err() != nil {
+				return nil, ctx.Err()
+			}
+			// A machine that cannot be worked out declares nothing this run — which is not the same as
+			// declaring nothing: retiring its data on that would be acting on an unreadable result.
+			continue
+		}
+		declared, holder := declaredOn(plan)
+		// **A holder is asked only once its machine has been sent it and had time to report** (novox/hq
+		// issue 275): assigned and not pushed yet, it is not there to answer, and "did not say what it
+		// measured" about it was a warning for a push nobody had made yet.
+		held := holder != "" && delivered[n.Name].settled(holder, now)
+		machines = append(machines, &machine{name: n.Name, declared: declared, held: held})
+	}
+	// Every holder asked at once, as D8 asks every ban list.
+	var wg sync.WaitGroup
+	for _, m := range machines {
+		if !m.held || !heard[m.name] {
+			continue
+		}
+		wg.Add(1)
+		go func(m *machine) {
+			defer wg.Done()
+			asking, cancel := context.WithTimeout(ctx, dataAsk)
+			defer cancel()
+			raw, err := askSeatTool(asking, d.js.Conn(), catalogue.BackupSeat, "backed-up", m.name)
+			if err == nil {
+				m.measured, err = readHolder(raw)
+			}
+			m.askErr = err
+		}(m)
+	}
+	wg.Wait()
+
+	var out []conditions.Observation
+	for _, m := range machines {
+		if m.askErr != nil {
+			out = append(out, conditions.Observation{Scope: conditions.ScopeMachine, ID: m.name, Token: kindDataUnmeasured,
+				Kind: kindDataUnmeasured, Machine: m.name, Severity: conditions.Warning, Confirm: true,
+				Summary: fmt.Sprintf("%s's backup holder did not say what it measured of the data declared there, so "+
+					"nothing about that data is known", m.name),
+				Said: firstLine(m.askErr.Error())})
+		}
+		why := fmt.Sprintf("no longer declared on %s: its module was unassigned there, or is no longer pulled in", m.name)
+		change, err := open.inventory.RecordData(ctx, m.name, m.declared, m.measured, why, now)
+		if err != nil {
+			return nil, fmt.Errorf("what %s holds could not be kept: %w", m.name, err)
+		}
+		for _, r := range change.Retired {
+			log.Printf("data: %s of %s on %s RETIRED, kept at %s: %s — `cleanup list` shows it, and only `cleanup "+
+				"delete` removes it (novox/hq ADR 0233)", r.Item, r.Module, r.Machine, orUnknownPath(r.Path), why)
+		}
+		for _, r := range change.Reenabled {
+			log.Printf("data: %s of %s on %s is declared again, no longer retired", r.Item, r.Module, r.Machine)
+		}
+	}
+
+	records, err := open.inventory.Data(ctx)
+	if err != nil {
+		return nil, err
+	}
+	peaks, err := open.inventory.DataPeaks(ctx, now.Add(-shrinkWindow))
+	if err != nil {
+		return nil, err
+	}
+	bindings, err := open.inventory.Bindings(ctx)
+	if err != nil {
+		return nil, err
+	}
+	upgraded, keptBy := keptByClasses(bindings, shelf)
+	copies, err := consumerCopies(ctx, d.js.Conn(), open.inventory, shelf, keptBy)
+	if err != nil {
+		return nil, err
+	}
+	out = append(out, dataFindings(records, peaks, shelf, copies, upgraded, now)...)
+	return out, nil
+}
+
+func orUnknownPath(p string) string {
+	if p == "" {
+		return "a path its backup holder never named"
+	}
+	return p
+}
+
+// consumerCopies asks every provider of a provision whose consumers' data is kept what it holds, at
+// once. One that cannot answer is passed over: it says nothing about any copy, which is not a finding.
+func consumerCopies(ctx context.Context, conn *nats.Conn, inv *inventory.Inventory,
+	shelf map[string]catalogue.Manifest, keptBy map[string]string) ([]consumerCopy, error) {
+	instances, err := providerInstances(ctx, inv)
+	if err != nil {
+		return nil, err
+	}
+	var asked []providerInstance
+	for _, p := range instances {
+		m := shelf[p.Module]
+		keeps := false
+		for provision := range m.Grants {
+			keeps = keeps || m.KeepsConsumerData(provision)
+		}
+		if keeps {
+			asked = append(asked, p)
+		}
+	}
+	states := make([]*link.RetirementState, len(asked))
+	var wg sync.WaitGroup
+	for i, p := range asked {
+		wg.Add(1)
+		go func(i int, p providerInstance) {
+			defer wg.Done()
+			asking, cancel := context.WithTimeout(ctx, dataAsk)
+			defer cancel()
+			if s, err := askRetirement(asking, conn, p); err == nil {
+				states[i] = &s
+			}
+		}(i, p)
+	}
+	wg.Wait()
+	var out []consumerCopy
+	for i, p := range asked {
+		s := states[i]
+		if s == nil {
+			continue
+		}
+		class := consumersClass(shelf[p.Module])
+		for _, c := range s.Held {
+			cp := consumerCopy{Node: p.Node, Module: p.Module, Consumer: c,
+				Class: catalogue.StricterClass(class, keptBy[p.Module+"/"+c])}
+			if size, ok := s.HeldSizes[c]; ok && size >= 0 {
+				size := size
+				cp.Size = &size
+			}
+			out = append(out, cp)
+		}
+		for _, r := range s.Retired {
+			if r.Kind != "" && r.Kind != "consumer" {
+				continue
+			}
+			cp := consumerCopy{Node: p.Node, Module: p.Module, Consumer: r.Consumer, Retired: true,
+				Class: catalogue.StricterClass(class, keptBy[p.Module+"/"+r.Consumer])}
+			if r.SizeBytes != nil && *r.SizeBytes >= 0 {
+				cp.Size = r.SizeBytes
+			}
+			out = append(out, cp)
+		}
+	}
+	return out, nil
+}
+
+// severityOf is how loud a finding about data of a class is: urgent for what is irreplaceable, a warning
+// for anything else watched (the operator's ranking, ADR 0233).
+func severityOf(class string) conditions.Severity {
+	if class == catalogue.ClassIrreplaceable {
+		return conditions.Urgent
+	}
+	return conditions.Warning
+}
+
+// consumersClass is the most precious class a provider keeps any of its consumers' data as.
+func consumersClass(m catalogue.Manifest) string {
+	class := catalogue.ClassNone
+	for provision := range m.Grants {
+		if c, ok := m.ConsumerDataOf(provision); ok {
+			class = catalogue.StricterClass(class, c.Class)
+		} else if m.KeepsConsumerData(provision) {
+			class = catalogue.StricterClass(class, catalogue.ClassValuable)
+		}
+	}
+	return class
+}
+
+// keptByClasses is what consumers say of the data they keep with their providers (`kept-by`), read
+// through where each is bound: by provider module and consumer identity, the class of that consumer's
+// data there; and by provider item key (machine/module/item), the class the item holding it is held to.
+func keptByClasses(bindings []inventory.Binding, shelf map[string]catalogue.Manifest) (map[string]string, map[string]string) {
+	upgraded, keptBy := map[string]string{}, map[string]string{}
+	for _, b := range bindings {
+		m, ok := shelf[b.Consumer]
+		if !ok {
+			continue
+		}
+		k, said := m.KeptByOf(b.Provision)
+		if !said {
+			continue
+		}
+		identity := catalogue.ConsumerIdentity(b.Machine, catalogue.IdentitySource(m.Slug, m.Module))
+		key := b.Provider.Module + "/" + identity
+		keptBy[key] = catalogue.StricterClass(keptBy[key], k.Class)
+		if pc, ok := shelf[b.Provider.Module].ConsumerDataOf(b.Provision); ok && pc.In != "" {
+			if _, own := shelf[b.Provider.Module].DataItem(pc.In); own {
+				item := b.Provider.Node + "/" + b.Provider.Module + "/" + pc.In
+				upgraded[item] = catalogue.StricterClass(upgraded[item], k.Class)
+			}
+		}
+	}
+	return upgraded, keptBy
+}
+
+// dataFindings is every condition the data on record raises now. A function of what is known, so the
+// incident's shape is tested without a mesh. upgraded is the class an item is held to where a consumer
+// of its module keeps data in it more precious than its own class says (`kept-by`), by its key.
+func dataFindings(records []inventory.DataRecord, peaks map[string]int64, shelf map[string]catalogue.Manifest,
+	copies []consumerCopy, upgraded map[string]string, now time.Time) []conditions.Observation {
+	var out []conditions.Observation
+	byItem := map[string][]inventory.DataRecord{}
+	arrays := map[string][]inventory.DataRecord{}
+	type shrunk struct {
+		machine, dataset, class string
+		size, peak              int64
+		items                   []string
+	}
+	shrunkDatasets := map[string]shrunk{}
+	for _, r := range records {
+		if r.DeletedAt != nil {
+			continue
+		}
+		class := catalogue.StricterClass(r.Class, upgraded[r.Key()])
+		r.Class = class
+		byItem[r.Module+"/"+r.Item] = append(byItem[r.Module+"/"+r.Item], r)
+		item, declared := shelf[r.Module].DataItem(r.Item)
+		id := keyOfItem(r.Machine, r.Module, r.Item)
+		if r.Retired() {
+			if now.Sub(*r.RetiredAt) > cleanupAfter {
+				out = append(out, conditions.Observation{Scope: conditions.ScopeMachine, ID: id, Token: "cleanup",
+					Kind: kindCleanupWaiting, Machine: r.Machine, Severity: conditions.Warning, Resolver: conditions.ResolverOperator,
+					Summary: fmt.Sprintf("%s of %s on %s (%s, %s) has been retired %d days — kept where it was since %s; "+
+						"`cleanup delete %s %s %s --why …` once a person has decided, or assign %s there again",
+						r.Item, r.Module, r.Machine, r.Class, sizeWords(r.Size), int(now.Sub(*r.RetiredAt).Hours()/24),
+						r.RetiredWhy, r.Machine, r.Module, r.Item, r.Module),
+					Said: "kept at " + orUnknownPath(r.Path)})
+			}
+			continue
+		}
+		if !catalogue.Watched(class) {
+			continue
+		}
+		severity := severityOf(class)
+		if r.Redundancy != nil {
+			where := r.Machine + "/" + r.Redundancy.Kind + ":" + r.Redundancy.Where
+			arrays[where] = append(arrays[where], r)
+		} else if declared && item.Redundancy != "" && r.MeasuredAt != nil && r.MeasureError == "" {
+			out = append(out, conditions.Observation{Scope: conditions.ScopeMachine, ID: id, Token: kindProtectionMissing,
+				Kind: kindProtectionMissing, Machine: r.Machine, Severity: severity, Resolver: conditions.ResolverOperator,
+				Summary: fmt.Sprintf("%s of %s on %s (%s) is said to be protected by the redundancy of the storage it is on, "+
+					"and it is on nothing the backup holder can read as redundant: it has no protection the mesh can see",
+					r.Item, r.Module, r.Machine, class),
+				Said: orUnknownPath(r.Path) + " is on no redundant storage the backup holder can read"})
+		}
+		if r.MeasureError != "" && strings.Contains(r.MeasureError, "does not exist") {
+			out = append(out, conditions.Observation{Scope: conditions.ScopeMachine, ID: id, Token: kindDataMissing,
+				Kind: kindDataMissing, Machine: r.Machine, Severity: severity, Resolver: conditions.ResolverOperator,
+				Summary: fmt.Sprintf("%s of %s on %s (%s) is gone: where it was declared, nothing exists any more", r.Item,
+					r.Module, r.Machine, class),
+				Said: orUnknownPath(r.Path) + " does not exist: " + firstLine(r.MeasureError)})
+		} else if peak, ok := peaks[r.Key()]; ok && r.Size != nil && inventory.Comparable(r.Precision) &&
+			*r.Size*2 < peak && peak-*r.Size >= shrinkFloor && inventory.Dataset(r.Precision) != "" {
+			// Several items on one dataset share its size: one condition for the dataset, as loud as the
+			// most precious item on it.
+			k := r.Machine + "/" + inventory.Dataset(r.Precision)
+			ds := shrunkDatasets[k]
+			ds.machine, ds.dataset, ds.size, ds.peak = r.Machine, inventory.Dataset(r.Precision), *r.Size, peak
+			ds.class = catalogue.StricterClass(ds.class, class)
+			ds.items = append(ds.items, r.Module+"/"+r.Item)
+			shrunkDatasets[k] = ds
+		} else if peak, ok := peaks[r.Key()]; ok && r.Size != nil && inventory.Comparable(r.Precision) &&
+			*r.Size*2 < peak && peak-*r.Size >= shrinkFloor {
+			out = append(out, conditions.Observation{Scope: conditions.ScopeMachine, ID: id, Token: kindDataShrank,
+				Kind: kindDataShrank, Machine: r.Machine, Severity: severity, Resolver: conditions.ResolverOperator,
+				Summary: fmt.Sprintf("%s of %s on %s (%s) shrank to %s from %s within %d days — more than half of what it "+
+					"held is gone. If that was meant, silence this with why; if not, `node-backup.restore` puts the last "+
+					"good copy beside it", r.Item, r.Module, r.Machine, class, sizeWords(r.Size), sizeWords(&peak),
+					int(shrinkWindow.Hours()/24))})
+		}
+		if !declared {
+			continue
+		}
+		if within := item.ActiveWithin(); within > 0 && r.LastWrite != nil && now.Sub(*r.LastWrite) > within {
+			out = append(out, conditions.Observation{Scope: conditions.ScopeMachine, ID: id, Token: kindDataQuiet,
+				Kind: kindDataQuiet, Machine: r.Machine, Severity: severity,
+				Summary: fmt.Sprintf("%s of %s on %s is written all the time, and has not been since %s (its bound is %s): "+
+					"whatever writes it has stopped", r.Item, r.Module, r.Machine, r.LastWrite.UTC().Format(time.RFC3339),
+					within)})
+		}
+		// A backup is required of what is irreplaceable and copied; of what is valuable it is the standard
+		// plan, said only where the machine was measured — where a holder is there to take it.
+		if item.BackedUp() && (class == catalogue.ClassIrreplaceable || r.MeasuredAt != nil) {
+			within := item.BackupWithin()
+			switch {
+			case r.LastBackup == nil && now.Sub(r.FirstSeen) > within:
+				out = append(out, conditions.Observation{Scope: conditions.ScopeMachine, ID: id, Token: kindBackupStale,
+					Kind: kindBackupStale, Machine: r.Machine, Severity: severity,
+					Summary: fmt.Sprintf("%s of %s on %s is %s and has no good backup on record, %s after it was first "+
+						"declared — is node-backup held there, and do its nights succeed? (`node-backup.backed-up`)",
+						r.Item, r.Module, r.Machine, class, now.Sub(r.FirstSeen).Round(time.Hour))})
+			case r.LastBackup != nil && now.Sub(*r.LastBackup) > within:
+				out = append(out, conditions.Observation{Scope: conditions.ScopeMachine, ID: id, Token: kindBackupStale,
+					Kind: kindBackupStale, Machine: r.Machine, Severity: severity,
+					Summary: fmt.Sprintf("%s of %s on %s is %s and its newest good backup is from %s, older than its bound "+
+						"of %s", r.Item, r.Module, r.Machine, class, r.LastBackup.UTC().Format(time.RFC3339), within)})
+			}
+		}
+	}
+	for _, k := range keysSorted(shrunkDatasets) {
+		ds := shrunkDatasets[k]
+		out = append(out, conditions.Observation{Scope: conditions.ScopeMachine,
+			ID: ds.machine + ".dataset." + strings.ReplaceAll(ds.dataset, "/", "-"), Token: kindDataShrank,
+			Kind: kindDataShrank, Machine: ds.machine, Severity: severityOf(ds.class), Resolver: conditions.ResolverOperator,
+			Summary: fmt.Sprintf("the dataset on %s that holds %s shrank to %s from %s within %d days — more than half of "+
+				"what it held is gone", ds.machine, strings.Join(ds.items, ", "), sizeWords(&ds.size), sizeWords(&ds.peak),
+				int(shrinkWindow.Hours()/24)),
+			Said: "the dataset " + ds.dataset})
+	}
+	// The redundant storage watched data is on: one condition per array, as loud as the most precious
+	// item on it — the array, not each item, is what degrades.
+	for _, where := range keysSorted(arrays) {
+		rs := arrays[where]
+		red := rs[0].Redundancy
+		if red.Healthy != nil && *red.Healthy {
+			continue
+		}
+		class, machine := catalogue.ClassValuable, rs[0].Machine
+		var names []string
+		for _, r := range rs {
+			class = catalogue.StricterClass(class, r.Class)
+			names = append(names, r.Module+"/"+r.Item)
+		}
+		state := "could not be read"
+		if red.Healthy != nil {
+			state = "is NOT healthy"
+		}
+		out = append(out, conditions.Observation{Scope: conditions.ScopeMachine,
+			ID:    machine + ".array." + strings.NewReplacer("/", "-", ":", "-").Replace(red.Kind+"-"+red.Where),
+			Token: kindArrayDegraded, Kind: kindArrayDegraded, Machine: machine, Severity: severityOf(class),
+			Resolver: conditions.ResolverOperator,
+			Summary: fmt.Sprintf("the %s storage on %s that protects %s %s", red.Kind, machine, strings.Join(names, ", "),
+				state),
+			Said: fmt.Sprintf("the %s storage %s %s: %s", red.Kind, red.Where, state, firstLine(red.Said))})
+	}
+	// The same item on several machines: a copy that is in use and far smaller than one kept elsewhere is
+	// an empty replacement. Only against a retired copy — a module running on two machines on purpose
+	// keeps two different sets of data.
+	for _, key := range keysSorted(byItem) {
+		rs := byItem[key]
+		for _, a := range rs {
+			if a.Retired() || a.Size == nil || !catalogue.Watched(a.Class) || !inventory.Comparable(a.Precision) {
+				continue
+			}
+			for _, o := range rs {
+				if o.Machine == a.Machine || !o.Retired() || o.Size == nil || !inventory.Comparable(o.Precision) ||
+					!replacedByLess(*a.Size, *o.Size) {
+					continue
+				}
+				out = append(out, conditions.Observation{Scope: conditions.ScopeMachine,
+					ID: keyOfItem(a.Machine, a.Module, a.Item), Token: kindEmptyReplacement, Kind: kindEmptyReplacement,
+					Machine: a.Machine, Also: []string{o.Machine}, Severity: severityOf(a.Class), Resolver: conditions.ResolverOperator,
+					Summary: fmt.Sprintf("%s of %s on %s holds %s, and the copy %s kept on %s holds %s: %s is running on "+
+						"an empty replacement of its data. Move the data, or assign it back where its data is",
+						a.Item, a.Module, a.Machine, sizeWords(a.Size), o.Module, o.Machine, sizeWords(o.Size), a.Module)})
+				break
+			}
+		}
+	}
+	out = append(out, consumerFindings(copies)...)
+	return out
+}
+
+// replacedByLess is whether a copy in use is an empty replacement of a copy kept elsewhere: less than
+// half of it, and at least shrinkFloor less.
+func replacedByLess(inUse, kept int64) bool {
+	return inUse*2 < kept && kept-inUse >= shrinkFloor
+}
+
+// consumerFindings is the same question of consumers' data at providers: one consumer, the same
+// provider module on two machines.
+func consumerFindings(copies []consumerCopy) []conditions.Observation {
+	by := map[string][]consumerCopy{}
+	for _, c := range copies {
+		k := c.Module + "/" + c.Consumer
+		by[k] = append(by[k], c)
+	}
+	var out []conditions.Observation
+	for _, k := range keysSorted(by) {
+		cs := by[k]
+		if len(cs) < 2 {
+			continue
+		}
+		found := false
+		for _, a := range cs {
+			if a.Retired || a.Size == nil {
+				continue
+			}
+			for _, o := range cs {
+				if o.Node == a.Node || o.Size == nil || !replacedByLess(*a.Size, *o.Size) {
+					continue
+				}
+				state := "active"
+				if o.Retired {
+					state = "retired"
+				}
+				out = append(out, conditions.Observation{Scope: conditions.ScopeProvider,
+					ID: a.Module + "." + a.Node + "." + a.Consumer, Token: kindEmptyReplacement, Kind: kindEmptyReplacement,
+					Machine: a.Node, Also: []string{o.Node}, Severity: severityOf(catalogue.StricterClass(a.Class, o.Class)),
+					Resolver: conditions.ResolverOperator,
+					Summary: fmt.Sprintf("%s's data at %s on %s holds %s, and its %s copy at %s on %s holds %s: the "+
+						"consumer is using an empty replacement of its data (issue 273's shape). Pin it back to %s, or move "+
+						"the data first", a.Consumer, a.Module, a.Node, sizeWords(a.Size), state, o.Module, o.Node,
+						sizeWords(o.Size), o.Node)})
+				found = true
+				break
+			}
+			if found {
+				break
+			}
+		}
+		if found {
+			continue
+		}
+		var active []consumerCopy
+		for _, c := range cs {
+			if !c.Retired {
+				active = append(active, c)
+			}
+		}
+		if len(active) >= 2 {
+			var where []string
+			var also []string
+			for _, c := range active {
+				where = append(where, c.Node+" ("+sizeWords(c.Size)+")")
+				also = append(also, c.Node)
+			}
+			out = append(out, conditions.Observation{Scope: conditions.ScopeProvider,
+				ID: active[0].Module + "." + active[0].Consumer, Token: kindDataHeldTwice, Kind: kindDataHeldTwice,
+				Machine: active[0].Node, Also: also[1:], Severity: conditions.Warning, Resolver: conditions.ResolverOperator,
+				Summary: fmt.Sprintf("%s has active data at %s on %d machines — %s — and only one is the one it uses",
+					active[0].Consumer, active[0].Module, len(active), strings.Join(where, ", "))})
+		}
+	}
+	return out
+}
+
+func keysSorted[V any](m map[string]V) []string {
+	out := make([]string, 0, len(m))
+	for k := range m {
+		out = append(out, k)
+	}
+	sort.Strings(out)
+	return out
+}
+
+// ---- the `data` verb ---------------------------------------------------------------------------
+
+const dataUsage = "data [--json] [--machine <name>] [--retired]"
+
+// dataRow is one item as `data` lists it.
+type dataRow struct {
+	Machine    string `json:"machine"`
+	Module     string `json:"module"`
+	Item       string `json:"item"`
+	Class      string `json:"class"`
+	Path       string `json:"path,omitempty"`
+	Protection string `json:"protection,omitempty"`
+	// Array is the redundant storage it is on and its state, where its holder could tell.
+	Array      string `json:"array,omitempty"`
+	Unmeasured string `json:"unmeasured,omitempty"`
+	// Precision says what the size is: exact, a dataset's whole size, partial, or none.
+	Precision  string `json:"precision,omitempty"`
+	SizeBytes  *int64 `json:"size-bytes,omitempty"`
+	LastWrite  string `json:"last-write,omitempty"`
+	MeasuredAt string `json:"measured-at,omitempty"`
+	LastBackup string `json:"last-backup,omitempty"`
+	BackupDue  string `json:"backup-within,omitempty"`
+	Retired    string `json:"retired,omitempty"`
+	RetiredWhy string `json:"retired-why,omitempty"`
+	Deleted    string `json:"deleted,omitempty"`
+}
+
+// dataCommand is `data`: every item every machine declares, or held retired, as the self-check last
+// found it.
+func dataCommand(ctx context.Context, args []string) error {
+	set := flag.NewFlagSet("data", flag.ContinueOnError)
+	asJSON := set.Bool("json", false, "as data")
+	only := set.String("machine", "", "one machine")
+	retiredOnly := set.Bool("retired", false, "only what is retired")
+	if rest, err := parseAround(set, args); err != nil {
+		return err
+	} else if len(rest) > 0 {
+		return errors.New(dataUsage)
+	}
+	open, err := openStores(ctx)
+	if err != nil {
+		return err
+	}
+	defer open.Close()
+	records, err := open.inventory.Data(ctx)
+	if err != nil {
+		return err
+	}
+	shelf, err := open.inventory.Catalogue(ctx)
+	if err != nil {
+		return err
+	}
+	rows := dataRows(records, shelf, *only, *retiredOnly)
+	if *asJSON {
+		return printJSON(map[string]any{"data": rows})
+	}
+	if len(rows) == 0 {
+		fmt.Println("no data on record: the self-check (D13) records what each machine declares on its next run")
+		return nil
+	}
+	for _, r := range rows {
+		state := ""
+		switch {
+		case r.Deleted != "":
+			state = "  DELETED " + r.Deleted
+		case r.Retired != "":
+			state = "  RETIRED " + r.Retired + " — " + r.RetiredWhy
+		}
+		fmt.Printf("%s %s/%s  %s  %s  %s  protected by %s%s\n", r.Machine, r.Module, r.Item, r.Class,
+			sizeWords(r.SizeBytes), orUnknownPath(r.Path), orNothingWord(r.Protection), state)
+		if r.Array != "" {
+			fmt.Printf("    on %s\n", r.Array)
+		}
+		if r.Precision != "" && r.Precision != "exact" {
+			fmt.Printf("    size: %s\n", r.Precision)
+		}
+		if r.Unmeasured != "" {
+			fmt.Printf("    not measured: %s\n", r.Unmeasured)
+		}
+		if r.Class == catalogue.ClassCache {
+			continue
+		}
+		fmt.Printf("    last write %s, measured %s, last backup %s%s\n", orNever(r.LastWrite), orNever(r.MeasuredAt),
+			orNever(r.LastBackup), within(r.BackupDue))
+	}
+	return nil
+}
+
+func dataRows(records []inventory.DataRecord, shelf map[string]catalogue.Manifest, only string, retiredOnly bool) []dataRow {
+	rows := []dataRow{}
+	stamp := func(t *time.Time) string {
+		if t == nil {
+			return ""
+		}
+		return t.UTC().Format(time.RFC3339)
+	}
+	for _, r := range records {
+		if only != "" && r.Machine != only {
+			continue
+		}
+		if retiredOnly && !r.Retired() {
+			continue
+		}
+		row := dataRow{Machine: r.Machine, Module: r.Module, Item: r.Item, Class: r.Class, Path: r.Path,
+			Protection: r.Protection, Unmeasured: r.MeasureError, Precision: r.Precision, SizeBytes: r.Size, LastWrite: stamp(r.LastWrite), MeasuredAt: stamp(r.MeasuredAt),
+			LastBackup: stamp(r.LastBackup), Retired: stamp(r.RetiredAt), RetiredWhy: r.RetiredWhy,
+			Deleted: stamp(r.DeletedAt)}
+		if it, ok := shelf[r.Module].DataItem(r.Item); ok && it.BackedUp() {
+			row.BackupDue = it.BackupWithin().String()
+		}
+		if red := r.Redundancy; red != nil {
+			state := "state unread"
+			if red.Healthy != nil && *red.Healthy {
+				state = "healthy"
+			} else if red.Healthy != nil {
+				state = "NOT HEALTHY"
+			}
+			row.Array = red.Kind + " " + red.Where + ", " + state
+		}
+		rows = append(rows, row)
+	}
+	return rows
+}
+
+func orNothingWord(s string) string {
+	if s == "" || s == "none" {
+		return "nothing"
+	}
+	return s
+}
+
+func orNever(s string) string {
+	if s == "" {
+		return "never"
+	}
+	return s
+}
+
+func within(s string) string {
+	if s == "" {
+		return " (not backed up)"
+	}
+	return " (bound " + s + ")"
+}
+
+// ---- cleanup of retired own data ---------------------------------------------------------------
+
+// The tools a node-backup holder serves to delete one retired item (novox/hq ADR 0233): the first
+// takes a last restore point of it, tagged as retired, and only then removes it — in the background,
+// because a large item outlasts any call — and the second says how that went. Module tools, not seat
+// verbs: only the controller's `cleanup delete` calls them, as it calls a provider's provisioner_delete.
+const (
+	ToolDeleteRetired  = "backup_delete_retired"
+	ToolDeletedOutcome = "backup_deleted"
+)
+
+// deletionWait is how long `cleanup delete` follows a deletion before handing it back to the person.
+var deletionWait = 8 * time.Minute
+
+// deletionPoll is how often it asks.
+var deletionPoll = 5 * time.Second
+
+// deletion is a holder's account of one deletion.
+type deletion struct {
+	Started  bool   `json:"started"`
+	Running  bool   `json:"running"`
+	Done     bool   `json:"done"`
+	OK       bool   `json:"ok"`
+	Snapshot string `json:"snapshot"`
+	Error    string `json:"error"`
+}
+
+// retiredData is every retired item on record, as `cleanup list` shows them.
+func retiredData(records []inventory.DataRecord, now time.Time) []retiredRow {
+	var out []retiredRow
+	for _, r := range records {
+		if !r.Retired() {
+			continue
+		}
+		out = append(out, retiredRow{Node: r.Machine, Module: r.Module, Consumer: r.Item, Kind: retiredDataKind,
+			RetiredAt: r.RetiredAt.UTC().Format(time.RFC3339), AgeDays: int(now.Sub(*r.RetiredAt).Hours() / 24),
+			SizeBytes: r.Size, Why: r.RetiredWhy, Path: r.Path, Class: r.Class})
+	}
+	return out
+}
+
+// retiredDataKind is what `cleanup list` calls a module's own retired data, beside a provider's consumer.
+const retiredDataKind = "own-data"
+
+// holderOn is the module holding node-backup on a machine.
+func holderOn(ctx context.Context, inv *inventory.Inventory, machine string) (string, error) {
+	held, err := inv.Holdings(ctx)
+	if err != nil {
+		return "", err
+	}
+	for _, h := range held {
+		if s, known := catalogue.SeatNamed(h.Claim); known && s.Name == catalogue.BackupSeat && h.Node == machine {
+			return h.Module, nil
+		}
+	}
+	return "", fmt.Errorf("nothing holds %s on %s, and it is the backup holder that deletes retired data there "+
+		"(after a last restore point)", catalogue.BackupSeat, machine)
+}
+
+// deleteRetiredData has a machine's backup holder delete one retired item: never one declared now, and
+// never one not retired. The holder takes a last restore point of it first, so the deletion can be
+// undone until a person forgets that restore point; the record says deleted only once the holder says
+// it is.
+func deleteRetiredData(ctx context.Context, conn *nats.Conn, open *stores, r inventory.DataRecord, f handActFlags) error {
+	inv := open.inventory
+	if !r.Retired() {
+		return fmt.Errorf("%s of %s on %s is not retired — only retired data is deleted. Nothing was done",
+			r.Item, r.Module, r.Machine)
+	}
+	if r.Path == "" {
+		return fmt.Errorf("%s of %s on %s was never measured, so where it is was never said; nothing was deleted",
+			r.Item, r.Module, r.Machine)
+	}
+	if plan, _, err := planFor(ctx, open, r.Machine); err == nil {
+		for _, m := range plan.Modules {
+			if _, still := m.DataItem(r.Item); still && m.Module == r.Module {
+				return fmt.Errorf("%s runs on %s again and declares %s: it is not retired any more. Nothing was done",
+					r.Module, r.Machine, r.Item)
+			}
+		}
+	}
+	holder, err := holderOn(ctx, inv, r.Machine)
+	if err != nil {
+		return err
+	}
+	f.record(ctx, "cleanup delete", []string{r.Machine, r.Module, r.Item})
+	args := map[string]any{"module": r.Module, "item": r.Item, "path": r.Path, "confirm": r.Item,
+		"why": strings.TrimSpace(*f.why), "by": link.Caller(), "via": link.ViaController}
+	ask := func(tool string) (deletion, error) {
+		var d deletion
+		answer, err := link.AskModuleToolOn(ctx, conn, holder, tool, r.Machine, args, 25*time.Second)
+		if err != nil {
+			return d, err
+		}
+		if answer.Error != "" {
+			return d, fmt.Errorf("%s on %s refused: %s", holder, r.Machine, answer.Error)
+		}
+		return d, unmarshalAnswer(answer, &d)
+	}
+	d, err := ask(ToolDeleteRetired)
+	if err != nil {
+		return err
+	}
+	for waited := time.Duration(0); !d.Done && waited < deletionWait; waited += deletionPoll {
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		case <-time.After(deletionPoll):
+		}
+		if d, err = ask(ToolDeletedOutcome); err != nil {
+			return err
+		}
+	}
+	switch {
+	case !d.Done:
+		fmt.Printf("%s on %s is still taking the last restore point of %s and deleting it; `cleanup list` keeps "+
+			"showing it until the holder says it is done — the same `cleanup delete` again reads how it went\n",
+			holder, r.Machine, r.Path)
+		return nil
+	case !d.OK:
+		return fmt.Errorf("%s on %s did NOT delete %s: %s", holder, r.Machine, r.Path, d.Error)
+	}
+	if err := inv.MarkDataDeleted(ctx, r.Machine, r.Module, r.Item, link.Caller(), strings.TrimSpace(*f.why), time.Now()); err != nil {
+		return fmt.Errorf("%s deleted %s on %s, and it could not be recorded: %w", holder, r.Path, r.Machine, err)
+	}
+	fmt.Printf("%s on %s deleted %s of %s (%s, %s); its last restore point is %s, kept until a person forgets it\n",
+		holder, r.Machine, r.Item, r.Module, r.Path, sizeWords(r.Size), orNever(d.Snapshot))
+	return nil
+}
+
+// keptOnUnassign says, for an unassignment, the irreplaceable and valuable data each module leaves in its
+// own directories on the machine:
+// kept, and retired at the self-check's next run.
+func keptOnUnassign(ctx context.Context, inv *inventory.Inventory, machine string, modules []string) []string {
+	records, err := inv.Data(ctx)
+	if err != nil {
+		return []string{"what it leaves behind could not be read from the mesh's record: " + err.Error()}
+	}
+	var out []string
+	for _, r := range records {
+		if r.Machine != machine || r.DeletedAt != nil || !catalogue.Retires(r.Class) || !r.Owned {
+			continue
+		}
+		for _, m := range modules {
+			if r.Module == m {
+				out = append(out, fmt.Sprintf("%s's %s (%s, %s) stays where it is: it is %s, so it is retired, "+
+					"never removed — `cleanup list` shows it, `cleanup delete` alone removes it (novox/hq ADR 0233)",
+					r.Module, r.Item, orUnknownPath(r.Path), sizeWords(r.Size), r.Class))
+			}
+		}
+	}
+	return out
+}

cmd/mesh-controller/data_test.go

@@ -0,0 +1,465 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/nats-io/nats.go"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/link"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/inventory"
+
+	"github.com/novox/mesh-controller/internal/testbus"
+)
+
+func bytesOf(n int64) *int64 { return &n }
+
+func when(t time.Time) *time.Time { return &t }
+
+func shelfFor(t *testing.T, manifests ...string) map[string]catalogue.Manifest {
+	t.Helper()
+	out := map[string]catalogue.Manifest{}
+	for _, raw := range manifests {
+		m, err := catalogue.ParseManifest([]byte(raw))
+		if err != nil {
+			t.Fatal(err)
+		}
+		out[m.Module] = m
+	}
+	return out
+}
+
+const houseManifest = `{"module":"house","version":"1",
+	"data":{"own":[{"id":"config","path":"${dir:config}","class":"irreplaceable","active":"1d"}]},
+	"resources":[{"id":"config","type":"directory","mode":"0700"}]}`
+
+func findingsByKind(obs []conditions.Observation) map[string]conditions.Observation {
+	out := map[string]conditions.Observation{}
+	for _, o := range linted(obs) {
+		out[o.Kind] = o
+	}
+	return out
+}
+
+// THE INCIDENT (issue 273), replayed against what D13 reads: five applications on the home server bound,
+// by one changed rule, to the store on the control node, which made each an empty database — while
+// their real databases, hundreds of megabytes each, sat on the home server's own store, by then retired
+// because the mesh no longer asked for them there. Each is an empty replacement, naming both machines
+// and the pin back: a warning for the store's consumers, whose data is valuable; urgent for one that says
+// its data there is irreplaceable (`kept-by`).
+func TestAnEmptyReplacementOfAConsumersDataIsSaid(t *testing.T) {
+	var copies []consumerCopy
+	for _, app := range []string{"mesh_home_board", "mesh_home_flows", "mesh_home_agents", "mesh_home_game", "mesh_home_cars"} {
+		copies = append(copies,
+			consumerCopy{Node: "home", Module: "postgres", Consumer: app, Size: bytesOf(400 << 20), Retired: true, Class: "valuable"},
+			consumerCopy{Node: "anchor", Module: "postgres", Consumer: app, Size: bytesOf(9 << 20), Class: "valuable"})
+	}
+	copies[1].Class = "irreplaceable" // the photo site's own database says so
+	got := linted(dataFindings(nil, nil, nil, copies, nil, time.Now()))
+	if len(got) != 5 {
+		t.Fatalf("%d findings for five empty replacements: %+v", len(got), got)
+	}
+	for i, o := range got {
+		want := conditions.Warning
+		if strings.Contains(o.ID, "mesh_home_board") {
+			want = conditions.Urgent
+		}
+		_ = i
+		if o.Kind != kindEmptyReplacement || o.Severity != want || o.Machine != "anchor" ||
+			len(o.Also) != 1 || o.Also[0] != "home" || !strings.Contains(o.Summary, "Pin it back to home") {
+			t.Errorf("%+v", o)
+		}
+	}
+
+	// While the old copy is still active (the first ten minutes), it is the same finding.
+	copies[0].Retired = false
+	copies[1].Class = "valuable"
+	if got := dataFindings(nil, nil, nil, copies[:2], nil, time.Now()); len(got) != 1 || got[0].Kind != kindEmptyReplacement {
+		t.Fatalf("with the old copy still active: %+v", got)
+	}
+}
+
+// A move a person made — the data moved first, then pinned — leaves a full copy at the new provider and
+// a retired one at the old: nothing to say here; `cleanup` covers the old one.
+func TestADeliberateMoveIsNoEmptyReplacement(t *testing.T) {
+	copies := []consumerCopy{
+		{Node: "home", Module: "postgres", Consumer: "mesh_home_board", Size: bytesOf(400 << 20), Retired: true},
+		{Node: "anchor", Module: "postgres", Consumer: "mesh_home_board", Size: bytesOf(402 << 20)},
+	}
+	if got := dataFindings(nil, nil, nil, copies, nil, time.Now()); len(got) != 0 {
+		t.Fatalf("a deliberate move raised %+v", got)
+	}
+	// Two small databases differing by less than the floor are not a finding either.
+	copies[0].Size, copies[1].Size = bytesOf(12<<20), bytesOf(8<<20)
+	if got := dataFindings(nil, nil, nil, copies, nil, time.Now()); len(got) != 0 {
+		t.Fatalf("noise between two empty databases raised %+v", got)
+	}
+}
+
+// Where a provider cannot say sizes, a consumer active at two providers is still said — as a warning,
+// since which one is empty cannot be told.
+func TestConsumerDataActiveTwiceWithoutSizesIsAWarning(t *testing.T) {
+	copies := []consumerCopy{
+		{Node: "home", Module: "minio", Consumer: "mesh_home_photos"},
+		{Node: "anchor", Module: "minio", Consumer: "mesh_home_photos"},
+	}
+	got := linted(dataFindings(nil, nil, nil, copies, nil, time.Now()))
+	if len(got) != 1 || got[0].Kind != kindDataHeldTwice || got[0].Severity != conditions.Warning {
+		t.Fatalf("%+v", got)
+	}
+}
+
+// The same incident for a module's own data: a module unassigned from one machine and assigned on
+// another starts over in an empty directory while its full one is kept, retired, where it was.
+func TestAnEmptyReplacementOfAModulesOwnDataIsUrgent(t *testing.T) {
+	now := time.Now()
+	retired := now.Add(-time.Hour)
+	records := []inventory.DataRecord{
+		{Machine: "home", Module: "house", Item: "config", Class: "irreplaceable", Path: "/var/lib/house/config",
+			Size: bytesOf(2 << 30), RetiredAt: &retired, FirstSeen: now.Add(-90 * 24 * time.Hour)},
+		{Machine: "anchor", Module: "house", Item: "config", Class: "irreplaceable", Path: "/var/lib/house/config",
+			Size: bytesOf(1 << 20), FirstSeen: now.Add(-time.Hour), LastWrite: when(now)},
+	}
+	got := findingsByKind(dataFindings(records, nil, shelfFor(t, houseManifest), nil, nil, now))
+	o, ok := got[kindEmptyReplacement]
+	if !ok || o.Severity != conditions.Urgent || o.Machine != "anchor" || o.Also[0] != "home" {
+		t.Fatalf("%+v", got)
+	}
+	// The same of a valuable item is a warning.
+	records[0].Class, records[1].Class = "valuable", "valuable"
+	if o := findingsByKind(dataFindings(records, nil, shelfFor(t, houseManifest), nil, nil, now))[kindEmptyReplacement]; o.Severity != conditions.Warning {
+		t.Fatalf("a valuable empty replacement: %+v", o)
+	}
+	records[0].Class, records[1].Class = "irreplaceable", "irreplaceable"
+	// Two machines running a module on purpose, both active, keep two sets of data: nothing to say.
+	records[0].RetiredAt = nil
+	if got := findingsByKind(dataFindings(records, nil, shelfFor(t, houseManifest), nil, nil, now)); got[kindEmptyReplacement].Kind != "" {
+		t.Fatalf("two active copies were read as a replacement: %+v", got)
+	}
+}
+
+// An irreplaceable item that lost more than half of its largest size in a week is urgent; a smaller loss,
+// or a loss under the floor, is not a finding.
+func TestAShrinkOfMoreThanHalfIsUrgent(t *testing.T) {
+	now := time.Now()
+	r := inventory.DataRecord{Machine: "home", Module: "house", Item: "config", Class: "irreplaceable",
+		Size: bytesOf(300 << 20), FirstSeen: now.Add(-30 * 24 * time.Hour), LastWrite: when(now), LastBackup: when(now)}
+	shelf := shelfFor(t, houseManifest)
+	o := findingsByKind(dataFindings([]inventory.DataRecord{r}, map[string]int64{r.Key(): 1 << 30}, shelf, nil, nil, now))[kindDataShrank]
+	if o.Severity != conditions.Urgent || !strings.Contains(o.Summary, "shrank") {
+		t.Fatalf("%+v", o)
+	}
+	for _, peak := range []int64{500 << 20, 20 << 20} {
+		if got := findingsByKind(dataFindings([]inventory.DataRecord{r}, map[string]int64{r.Key(): peak}, shelf, nil, nil, now)); got[kindDataShrank].Kind != "" {
+			t.Errorf("a peak of %d raised a shrink", peak)
+		}
+	}
+	small := r
+	small.Size = bytesOf(1 << 20)
+	if got := findingsByKind(dataFindings([]inventory.DataRecord{small}, map[string]int64{r.Key(): 10 << 20}, shelf, nil, nil, now)); got[kindDataShrank].Kind != "" {
+		t.Error("a loss under the floor raised a shrink")
+	}
+}
+
+// Data said to be written all the time and not written; data with no backup or an old one — urgent when
+// irreplaceable, a warning when valuable; and a new item given its bound before it is said.
+func TestQuietDataAndMissingBackupsAreSaidByClass(t *testing.T) {
+	now := time.Now()
+	shelf := shelfFor(t, houseManifest)
+	r := inventory.DataRecord{Machine: "home", Module: "house", Item: "config", Class: "irreplaceable",
+		Size: bytesOf(1 << 30), FirstSeen: now.Add(-10 * 24 * time.Hour), LastWrite: when(now.Add(-3 * 24 * time.Hour)),
+		LastBackup: when(now.Add(-72 * time.Hour))}
+	got := findingsByKind(dataFindings([]inventory.DataRecord{r}, nil, shelf, nil, nil, now))
+	if got[kindDataQuiet].Severity != conditions.Urgent || got[kindBackupStale].Severity != conditions.Urgent {
+		t.Fatalf("irreplaceable: %+v", got)
+	}
+	valuable := r
+	valuable.Class, valuable.MeasuredAt = "valuable", when(now) // measured: a holder is there to take its backup
+	if got := findingsByKind(dataFindings([]inventory.DataRecord{valuable}, nil, shelf, nil, nil, now)); got[kindDataQuiet].Severity != conditions.Warning ||
+		got[kindBackupStale].Severity != conditions.Warning {
+		t.Fatalf("valuable: %+v", got)
+	}
+	never := r
+	never.LastBackup = nil
+	if o := findingsByKind(dataFindings([]inventory.DataRecord{never}, nil, shelf, nil, nil, now))[kindBackupStale]; !strings.Contains(o.Summary, "no good backup") {
+		t.Fatalf("never backed up: %+v", o)
+	}
+	fresh := never
+	fresh.FirstSeen, fresh.LastWrite = now.Add(-time.Hour), when(now)
+	if got := dataFindings([]inventory.DataRecord{fresh}, nil, shelf, nil, nil, now); len(got) != 0 {
+		t.Fatalf("an item declared an hour ago, before its first night, raised %+v", got)
+	}
+}
+
+// An item retired more than thirty days waits for a person; less, it is only listed.
+func TestRetiredDataWaitingThirtyDaysIsSaid(t *testing.T) {
+	now := time.Now()
+	old, recent := now.Add(-31*24*time.Hour), now.Add(-2*24*time.Hour)
+	records := []inventory.DataRecord{
+		{Machine: "home", Module: "house", Item: "config", Class: "irreplaceable", Size: bytesOf(1 << 30), RetiredAt: &old},
+		{Machine: "home", Module: "attic", Item: "boxes", Class: "irreplaceable", Size: bytesOf(1 << 30), RetiredAt: &recent},
+	}
+	got := linted(dataFindings(records, nil, shelfFor(t, houseManifest), nil, nil, now))
+	if len(got) != 1 || got[0].Kind != kindCleanupWaiting || !strings.Contains(got[0].Summary, "cleanup delete home house config") {
+		t.Fatalf("%+v", got)
+	}
+	if rows := retiredData(records, now); len(rows) != 2 || rows[0].Kind != retiredDataKind {
+		t.Fatalf("cleanup list: %+v", rows)
+	}
+}
+
+// The holder's answer reads into measurements, by module and item.
+func TestTheHoldersAnswerIsRead(t *testing.T) {
+	raw := []byte(`[{"module":"postgres","runs":1,"paths":["/var/lib/mesh-store/dumps"],"lastNight":null,"restorePoints":3,
+		"data":[{"item":"store","class":"irreplaceable","path":"/var/lib/mesh-store","covered_by":"/var/lib/mesh-store/dumps",
+		"size_bytes":1073741824,"last_write":"2026-10-06T10:00:00Z","measured_at":"2026-10-06T10:05:00Z","last_backup":"2026-10-06T03:10:00Z"}]}]`)
+	got, err := readHolder(raw)
+	if err != nil {
+		t.Fatal(err)
+	}
+	m := got["postgres"]["store"]
+	if m.Path != "/var/lib/mesh-store" || m.Size == nil || *m.Size != 1<<30 || m.LastBackup == nil || m.MeasuredAt == nil {
+		t.Fatalf("%+v", m)
+	}
+	// An older holder, which says no data, reads as nothing measured rather than a failure.
+	if got, err := readHolder([]byte(`[{"module":"postgres","runs":1,"paths":[]}]`)); err != nil || len(got) != 0 {
+		t.Fatalf("%v, %v", got, err)
+	}
+}
+
+// fakeHolder answers node-backup's `backed-up` on one machine over a real bus, with what it is told it
+// measured.
+type fakeHolder struct {
+	mu      sync.Mutex
+	modules []map[string]any
+}
+
+func (f *fakeHolder) set(modules ...map[string]any) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.modules = modules
+}
+
+func (f *fakeHolder) serve(t *testing.T, conn *nats.Conn, node string) {
+	t.Helper()
+	sub, err := conn.Subscribe(link.NodeSeatToolSubject(catalogue.BackupSeat, "backed-up", node), func(m *nats.Msg) {
+		f.mu.Lock()
+		defer f.mu.Unlock()
+		body, _ := json.Marshal(map[string]any{"result": f.modules, "error": "", "node": node})
+		_ = m.Respond(body)
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = sub.Unsubscribe() })
+	if err := conn.Flush(); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func measuredHouse(path string, size int64, at time.Time) map[string]any {
+	return map[string]any{"module": "house", "runs": 0, "paths": []string{path}, "data": []map[string]any{{
+		"item": "config", "class": "irreplaceable", "path": path, "covered_by": path, "size_bytes": size,
+		"last_write": at, "measured_at": at, "last_backup": at}}}
+}
+
+// UNASSIGNING A MODULE WITH IRREPLACEABLE DATA KEEPS THE DATA, and assigning it elsewhere onto an empty
+// directory is an empty replacement — through the real stores and a real bus. The unassignment says the
+// data stays; the self-check's next run retires it (kept, listed by cleanup), and when the module comes
+// up on another machine with an empty directory while the full one waits retired, that is urgent.
+func TestNatsUnassigningIrreplaceableDataRetiresItAndAnEmptyReplacementIsUrgent(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	if _, err := inv.SeedSeats(ctx, catalogue.DefaultSeats()); err != nil {
+		t.Fatal(err)
+	}
+	register(t, open, catalogue.Manifest{Module: "keeper", Version: "1",
+		Claims: []catalogue.Claim{{Name: catalogue.BackupSeat, Scope: catalogue.ScopeNode, Serves: []string{"backed-up", "now", "restore"}}}})
+	house, err := catalogue.ParseManifest([]byte(houseManifest))
+	if err != nil {
+		t.Fatal(err)
+	}
+	register(t, open, house)
+	if _, err := assign(ctx, open, "laptop", "house"); err == nil {
+		t.Fatal("irreplaceable data was assigned to a machine with nothing to back it up")
+	}
+	for _, node := range []string{"laptop", "anchor"} {
+		if _, err := assign(ctx, open, node, "keeper"); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if _, err := assign(ctx, open, "laptop", "house"); err != nil {
+		t.Fatal(err)
+	}
+	// Sent, and applied: a holder is asked only once it has been (novox/hq issue 275).
+	for _, node := range []string{"laptop", "anchor"} {
+		pushedAndApplied(t, open, node)
+	}
+
+	conn := onATestBus(t)
+	js, err := broker.Dial(testbus.URL(t))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(js.Close)
+	laptop, anchor := &fakeHolder{}, &fakeHolder{}
+	laptop.serve(t, conn, "laptop")
+	anchor.serve(t, conn, "anchor")
+	now := time.Now()
+	heard := &watchdogs{last: &signalFacts{now: now, machines: []machineFacts{
+		{name: "laptop", lastHeard: now}, {name: "anchor", lastHeard: now}}}}
+	d := &doctor{open: open, js: js, watchdogs: heard}
+	var d13 probe
+	for _, p := range probeRegistry {
+		if p.ID == probeDataID {
+			d13 = p
+		}
+	}
+	run := func() []conditions.Observation {
+		t.Helper()
+		probing := context.WithValue(ctx, probeAsksKey{}, d13)
+		obs, err := probeData(probing, d)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return obs
+	}
+
+	laptop.set(measuredHouse("/var/lib/house/config", 2<<30, now))
+	if obs := run(); len(obs) != 0 {
+		t.Fatalf("a measured, backed-up item raised %+v", obs)
+	}
+	r, err := inv.DataOf(ctx, "laptop", "house", "config")
+	if err != nil || r.Path != "/var/lib/house/config" || r.Size == nil || *r.Size != 2<<30 || r.LastBackup == nil {
+		t.Fatalf("what the holder measured was not kept: %+v, %v", r, err)
+	}
+
+	said, err := unassign(ctx, open, "laptop", "house")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(said, "house's config (/var/lib/house/config, 2.0 GB) stays where it is") {
+		t.Fatalf("the unassignment does not say the data stays:\n%s", said)
+	}
+	laptop.set()
+	run()
+	r, err = inv.DataOf(ctx, "laptop", "house", "config")
+	if err != nil || !r.Retired() || r.Path != "/var/lib/house/config" {
+		t.Fatalf("unassigned, the irreplaceable item is not kept retired: %+v, %v", r, err)
+	}
+	records, _ := inv.Data(ctx)
+	if rows := retiredData(records, time.Now()); len(rows) != 1 || rows[0].Path != "/var/lib/house/config" {
+		t.Fatalf("cleanup list: %+v", rows)
+	}
+
+	// Assigned on the anchor, onto an empty directory.
+	if _, err := assign(ctx, open, "anchor", "house"); err != nil {
+		t.Fatal(err)
+	}
+	anchor.set(measuredHouse("/var/lib/house/config", 300<<10, time.Now()))
+	obs := findingsByKind(run())
+	o, ok := obs[kindEmptyReplacement]
+	if !ok || o.Severity != conditions.Urgent || o.Machine != "anchor" || o.Also[0] != "laptop" {
+		t.Fatalf("an empty replacement of a module's data was not urgent: %+v", obs)
+	}
+}
+
+// Data on redundant storage: the array it is on is watched, one condition per array as loud as the most
+// precious item on it; an item said to be on redundancy and found on plain storage is said; an item
+// whose path is gone is said.
+func TestTheArrayUnderDataIsWatched(t *testing.T) {
+	now := time.Now()
+	media := `{"module":"media","version":"1","accesses":[{"id":"films","mode":"read"},{"id":"shows","mode":"read"}],
+		"data":{"own":[{"id":"films","path":"${access:films}","class":"irreplaceable","redundancy":"an array, no room to copy"},
+			{"id":"shows","path":"${access:shows}","class":"irreplaceable","redundancy":"an array, no room to copy"}]}}`
+	shelf := shelfFor(t, media)
+	sick := false
+	on := func(item string, healthy *bool) inventory.DataRecord {
+		return inventory.DataRecord{Machine: "home", Module: "media", Item: item, Class: "irreplaceable", Owned: false,
+			Path: "/tank/" + item, Size: bytesOf(40 << 40), FirstSeen: now.Add(-24 * time.Hour), MeasuredAt: when(now),
+			Redundancy: &inventory.Redundancy{Kind: "zfs", Where: "tank", Healthy: healthy, Said: "pool 'tank' is DEGRADED"}}
+	}
+	got := linted(dataFindings([]inventory.DataRecord{on("films", &sick), on("shows", &sick)}, nil, shelf, nil, nil, now))
+	if len(got) != 1 || got[0].Kind != kindArrayDegraded || got[0].Severity != conditions.Urgent ||
+		!strings.Contains(got[0].Summary, "media/films, media/shows") {
+		t.Fatalf("%+v", got)
+	}
+	well := true
+	if got := dataFindings([]inventory.DataRecord{on("films", &well)}, nil, shelf, nil, nil, now); len(got) != 0 {
+		t.Fatalf("a healthy array raised %+v", got)
+	}
+	plain := on("films", nil)
+	plain.Redundancy = nil
+	if o := findingsByKind(dataFindings([]inventory.DataRecord{plain}, nil, shelf, nil, nil, now))[kindProtectionMissing]; o.Severity != conditions.Urgent {
+		t.Fatalf("redundancy said and not found: %+v", o)
+	}
+	gone := on("films", &well)
+	gone.MeasureError, gone.Size = "/tank/films does not exist", bytesOf(0)
+	if o := findingsByKind(dataFindings([]inventory.DataRecord{gone}, map[string]int64{gone.Key(): 40 << 40}, shelf, nil, nil, now))[kindDataMissing]; o.Severity != conditions.Urgent {
+		t.Fatalf("a vanished library: %+v", o)
+	}
+}
+
+// What a consumer keeps with its provider as irreplaceable holds the provider's item to that class:
+// the photo site's objects make the object store's data an urgent matter.
+func TestKeptByHoldsTheProvidersItemToTheConsumersClass(t *testing.T) {
+	objects := `{"module":"objects","version":"1","provides":[{"name":"s3-bucket","scope":"mesh"}],"grants":{"s3-bucket":"${dir:g}"},
+		"data":{"own":[{"id":"data","path":"${dir:data}","class":"valuable"}],"consumers":{"s3-bucket":{"class":"valuable","in":"data"}}},
+		"resources":[{"id":"g","type":"directory","mode":"0700"},{"id":"data","type":"directory","mode":"0700"}]}`
+	photos := `{"module":"photos","version":"1","requires":["s3-bucket"],"data":{"kept-by":{"s3-bucket":{"class":"irreplaceable"}}}}`
+	shelf := shelfFor(t, objects, photos)
+	bindings := []inventory.Binding{{Machine: "anchor", Consumer: "photos", Provision: "s3-bucket",
+		Provider: catalogue.Chosen{Node: "anchor", Module: "objects"}}}
+	upgraded, keptBy := keptByClasses(bindings, shelf)
+	if upgraded["anchor/objects/data"] != "irreplaceable" || keptBy["objects/mesh_anchor_photos"] != "irreplaceable" {
+		t.Fatalf("upgraded %v, kept by %v", upgraded, keptBy)
+	}
+	now := time.Now()
+	r := inventory.DataRecord{Machine: "anchor", Module: "objects", Item: "data", Class: "valuable", Owned: true,
+		Size: bytesOf(10 << 30), FirstSeen: now.Add(-10 * 24 * time.Hour), MeasuredAt: when(now), LastBackup: when(now.Add(-72 * time.Hour))}
+	if o := findingsByKind(dataFindings([]inventory.DataRecord{r}, nil, shelf, nil, upgraded, now))[kindBackupStale]; o.Severity != conditions.Urgent {
+		t.Fatalf("the photos' store without a backup: %+v", o)
+	}
+	if o := findingsByKind(dataFindings([]inventory.DataRecord{r}, nil, shelf, nil, nil, now))[kindBackupStale]; o.Severity != conditions.Warning {
+		t.Fatalf("a valuable store without a backup: %+v", o)
+	}
+}
+
+// Items measured from one dataset's counters share its size: a shrink of the dataset is one condition
+// naming every item on it, not one per item; and a partial walk's lower bound is never compared.
+func TestADatasetShrinksOnceAndAPartialSizeIsNeverCompared(t *testing.T) {
+	now := time.Now()
+	media := `{"module":"media","version":"1","accesses":[{"id":"films","mode":"read"},{"id":"shows","mode":"read"}],
+		"data":{"own":[{"id":"films","path":"${access:films}","class":"irreplaceable","redundancy":"an array","measure":"dataset"},
+			{"id":"shows","path":"${access:shows}","class":"irreplaceable","redundancy":"an array","measure":"dataset"}]}}`
+	shelf := shelfFor(t, media, houseManifest)
+	well := true
+	on := func(item string, size int64) inventory.DataRecord {
+		return inventory.DataRecord{Machine: "home", Module: "media", Item: item, Class: "irreplaceable",
+			Size: bytesOf(size), FirstSeen: now.Add(-24 * time.Hour), MeasuredAt: when(now),
+			Precision:  "dataset tank/media: its whole size",
+			Redundancy: &inventory.Redundancy{Kind: "zfs", Where: "tank", Healthy: &well}}
+	}
+	films, shows := on("films", 30<<40), on("shows", 30<<40)
+	peaks := map[string]int64{films.Key(): 90 << 40, shows.Key(): 90 << 40}
+	got := linted(dataFindings([]inventory.DataRecord{films, shows}, peaks, shelf, nil, nil, now))
+	if len(got) != 1 || got[0].Kind != kindDataShrank || got[0].Severity != conditions.Urgent ||
+		!strings.Contains(got[0].Summary, "media/films, media/shows") {
+		t.Fatalf("%+v", got)
+	}
+	partial := inventory.DataRecord{Machine: "home", Module: "house", Item: "config", Class: "irreplaceable",
+		Size: bytesOf(1 << 20), FirstSeen: now.Add(-24 * time.Hour), MeasuredAt: when(now), LastWrite: when(now),
+		LastBackup: when(now), Precision: "partial: measured partially"}
+	if got := dataFindings([]inventory.DataRecord{partial}, map[string]int64{partial.Key(): 1 << 30}, shelf, nil, nil, now); len(got) != 0 {
+		t.Fatalf("a partial size was compared: %+v", got)
+	}
+}

cmd/mesh-controller/deadletters.go

@@ -0,0 +1,162 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+
+	"github.com/nats-io/nats.go"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// What a consumer gave up on, answered by the serving controller (novox/hq issue 330).
+//
+// **In this process, on its own connection**: DEAD_LETTERS is read and changed on the bus, and the
+// serving controller is already on it. A verb run as a fresh process would open a connection of its own
+// for each call (novox/hq issue 327).
+
+// busHandles are the serving controller's connection and JetStream handle.
+type busHandles struct {
+	conn *nats.Conn
+	js   nats.JetStreamContext
+}
+
+// defaultDeadLetters is how many the list says when not asked for more.
+const defaultDeadLetters = 50
+
+// causeDeadLetter is the cause a delivery or drop gives when the caller gives none.
+const causeDeadLetter = "dead-letter"
+
+// deadLettersAnswer is what `dead-letters` answers: the list, one whole, or what came of delivering one
+// again or dropping it.
+func deadLettersAnswer(ctx context.Context, a *verbArguments) (any, error) {
+	serving := servingBus.Load()
+	if serving == nil {
+		return nil, errors.New("this controller is not serving, so it does not read DEAD_LETTERS: ask again, " +
+			"and the serving controller answers")
+	}
+	on := &busHandles{conn: serving.Conn(), js: serving.Context()}
+	// The shape first, and every argument it reads; one given beside it is refused before anything is
+	// done, as every verb refuses what it would pass over (novox/hq issue 244).
+	var deliver, drop, why, cause, idText, consumer, limit string
+	switch {
+	case a.given["deliver"] != "" || a.given["drop"] != "":
+		deliver, drop, why, cause = a.str("deliver"), a.str("drop"), a.str("why"), a.str("cause")
+	case a.given["id"] != "":
+		idText = a.str("id")
+	default:
+		consumer, limit = a.str("consumer"), a.str("limit")
+	}
+	if unused := a.unused(); len(unused) > 0 {
+		return nil, fmt.Errorf("dead-letters did not use %s together with %s, and an argument a verb would pass "+
+			"over is refused: nothing was done", quoteAll(unused), quoteAll(a.usedGiven()))
+	}
+	switch {
+	case deliver != "" && drop != "":
+		return nil, errors.New("dead-letters delivers one again or drops one, not both. Nothing was done")
+	case deliver != "" || drop != "":
+		act, text := "deliver", deliver
+		if drop != "" {
+			act, text = "drop", drop
+		}
+		if strings.TrimSpace(why) == "" {
+			return nil, fmt.Errorf("dead-letters %s is a hand act, and says why: why is required and recorded in "+
+				"the hand-act log (novox/hq to-be 45 §7). Nothing was done", act)
+		}
+		id, err := deadLetterID(text)
+		if err != nil {
+			return nil, err
+		}
+		return actOnDeadLetter(ctx, on, act, id, why, cause)
+	case idText != "":
+		id, err := deadLetterID(idText)
+		if err != nil {
+			return nil, err
+		}
+		return link.DeadLetterNamed(on.js, id)
+	}
+	most := defaultDeadLetters
+	if limit != "" {
+		n, err := strconv.Atoi(limit)
+		if err != nil || n <= 0 {
+			return nil, fmt.Errorf("limit is a number of dead letters, not %q", limit)
+		}
+		most = n
+	}
+	held, total, err := link.DeadLetters(on.js, consumer, most)
+	if err != nil {
+		return nil, err
+	}
+	answer := map[string]any{"dead_letters": held, "held": total,
+		"note": "newest first; with id, one whole; deliver or drop one with why"}
+	if total == 0 {
+		answer["note"] = "no consumer gave up on a message that is still kept"
+	}
+	return answer, nil
+}
+
+// deadLetterID is a dead letter's id as a caller wrote it.
+func deadLetterID(text string) (uint64, error) {
+	id, err := strconv.ParseUint(strings.TrimSpace(text), 10, 64)
+	if err != nil || id == 0 {
+		return 0, fmt.Errorf("a dead letter's id is its number in %s, as dead-letters lists it, not %q",
+			broker.DeadLettersStream, text)
+	}
+	return id, nil
+}
+
+// actOnDeadLetter delivers one again or drops it, recorded in the hand-act log before it is done. A log
+// that cannot be written is said, and the act still happens: the log is never the reason a person's act
+// is refused (handacts.go).
+func actOnDeadLetter(ctx context.Context, on *busHandles, act string, id uint64, why, cause string) (any, error) {
+	d, err := link.DeadLetterNamed(on.js, id)
+	if err != nil {
+		return nil, err
+	}
+	if act == "deliver" {
+		// Refused before it is recorded: an act that cannot be done is not an act.
+		if _, err := link.AgainTo(on.js, d); err != nil {
+			return nil, err
+		}
+	}
+	if cause == "" {
+		cause = causeDeadLetter
+	}
+	by := link.CallerIn(ctx)
+	if by == "" {
+		by = "a seat call whose caller the bus did not name"
+	}
+	answer := map[string]any{"dead_letter": d.ID, "consumer": d.Who, "subject": d.Subject}
+	recorded, logErr := link.RecordHandAct(ctx, on.conn, link.HandAct{Verb: "dead-letters " + act,
+		Args: []string{strconv.FormatUint(id, 10), d.Stream + "." + d.Consumer}, Why: why, Cause: cause,
+		Condition: conditions.Key(conditions.ScopeBus, d.Stream+"."+d.Consumer, link.AdvisoryMaxDeliveries),
+		By:        by + ", through the " + catalogue.ControllerSeatName + " seat"})
+	if logErr != nil {
+		answer["unrecorded"] = "the hand-act log could not be written, and the act was done all the same: " + logErr.Error()
+	} else {
+		answer["recorded"] = recorded.ID
+	}
+	switch act {
+	case "deliver":
+		_, to, err := link.DeliverAgain(on.js, id)
+		if err != nil {
+			return nil, err
+		}
+		answer["delivered_on"] = to
+		answer["done"] = fmt.Sprintf("dead letter %d was delivered again to %s, and nobody else; it is no longer kept",
+			id, consumerWho(d.Stream, d.Consumer))
+	case "drop":
+		if _, err := link.DropDeadLetter(on.js, id); err != nil {
+			return nil, err
+		}
+		answer["done"] = fmt.Sprintf("dead letter %d, which %s gave up on, was dropped for good", id,
+			consumerWho(d.Stream, d.Consumer))
+	}
+	return answer, nil
+}

cmd/mesh-controller/deadletters_test.go

@@ -0,0 +1,132 @@
+package main
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/link"
+	"github.com/novox/mesh-controller/internal/testbus"
+)
+
+// The serving controller's bus, with the mesh's streams, for the verb to read and act on.
+func servingDeadLetters(t *testing.T) *broker.JetStream {
+	t.Helper()
+	js, err := broker.Dial(testbus.URL(t))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(js.Close)
+	if err := broker.AssertMeshStreams(js); err != nil {
+		t.Fatal(err)
+	}
+	if err := js.EnsureControllerBuckets(); err != nil {
+		t.Fatal(err)
+	}
+	before := servingBus.Load()
+	servingBus.Store(js)
+	t.Cleanup(func() { servingBus.Store(before) })
+	return js
+}
+
+func askDeadLetters(t *testing.T, args map[string]any) (any, error) {
+	t.Helper()
+	a, err := readArguments("dead-letters", args)
+	if err != nil {
+		return nil, err
+	}
+	return deadLettersAnswer(context.Background(), a)
+}
+
+func TestDeadLettersListsDropsAndRecordsWhy(t *testing.T) {
+	js := servingDeadLetters(t)
+	if _, err := js.Context().Publish("mesh.mod.gitea.event.pull.merged", []byte(`{"n":1}`)); err != nil {
+		t.Fatal(err)
+	}
+	d, err := link.KeepDeadLetter(js.Context(), []byte(`{"stream":"EVENTS","consumer":"media_sonarr","stream_seq":1,"deliveries":5}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	answer, err := askDeadLetters(t, map[string]any{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	listed := answer.(map[string]any)
+	if listed["held"] != 1 || len(listed["dead_letters"].([]link.DeadLetter)) != 1 {
+		t.Fatalf("listed %v", listed)
+	}
+
+	// Refused before anything is done: an act without why, an argument the shape passes over, both acts.
+	for _, args := range []map[string]any{
+		{"drop": "1"},
+		{"drop": "1", "why": "x", "limit": "3"},
+		{"drop": "1", "deliver": "1", "why": "x"},
+		{"why": "x"},
+		{"id": "nought"},
+	} {
+		if _, err := askDeadLetters(t, args); err == nil {
+			t.Errorf("%v was done", args)
+		}
+	}
+	if _, total, _ := link.DeadLetters(js.Context(), "", 0); total != 1 {
+		t.Fatalf("a refused call changed what is kept: %d left", total)
+	}
+
+	done, err := askDeadLetters(t, map[string]any{"drop": "1", "why": "the media server took the download in by hand"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if said := done.(map[string]any); said["recorded"] == nil || !strings.Contains(said["done"].(string), "dropped") {
+		t.Fatalf("answered %v", said)
+	}
+	acts, err := link.HandActs(context.Background(), js.Conn(), time.Now().Add(-time.Minute))
+	if err != nil || len(acts) != 1 || acts[0].Verb != "dead-letters drop" || acts[0].Cause != causeDeadLetter ||
+		!strings.Contains(acts[0].Condition, "media_sonarr") {
+		t.Fatalf("recorded %+v (%v)", acts, err)
+	}
+	if !personsDecision(acts[0]) {
+		t.Error("dropping a dead letter is counted as a repair, so S15 would want a healer for it")
+	}
+	if _, err := askDeadLetters(t, map[string]any{"id": "1"}); err == nil {
+		t.Errorf("dead letter %d is still answered after it was dropped", d.ID)
+	}
+}
+
+// Open while DEAD_LETTERS holds a message for the consumer, in words the operator reads in one pass:
+// what is held, and where to act.
+func TestAConsumersDeadLettersAreSaidUntilActedOn(t *testing.T) {
+	f := &signalFacts{now: time.Now(), deadLetters: map[string]int{"EVENTS.media_sonarr": 4, "EVENTS.controller": 1}}
+	found := watchDeadLetters(f)
+	if len(found) != 2 {
+		t.Fatalf("said %d conditions", len(found))
+	}
+	for _, o := range found {
+		if o.Kind != "max-deliveries" || o.Severity != conditions.Warning || o.Needs == "" {
+			t.Errorf("%+v", o)
+		}
+		if why, ok := conditions.PlainWords(conditions.Words{Headline: o.Headline, Needs: o.Needs,
+			Explanation: o.Explanation, Resolved: o.Resolved}, "media"); !ok {
+			t.Errorf("%q is not plain: %s", o.Headline, why)
+		}
+		if !strings.Contains(o.Needs, "mesh MCP server") {
+			t.Errorf("does not say where to act: %q", o.Needs)
+		}
+	}
+	sonarr := found[1]
+	if sonarr.ID != "EVENTS.media_sonarr" || sonarr.Machine != "media" ||
+		sonarr.Headline != "Sonarr on media could not handle 4 messages" ||
+		!strings.Contains(sonarr.Summary, "DEAD_LETTERS") {
+		t.Errorf("%+v", sonarr)
+	}
+	if found[0].Headline != "The controller could not handle a message" {
+		t.Errorf("%q", found[0].Headline)
+	}
+	// None held, none said: it clears when they are delivered again or dropped.
+	if left := watchDeadLetters(&signalFacts{now: time.Now()}); len(left) != 0 {
+		t.Fatalf("%v", left)
+	}
+}

cmd/mesh-controller/delivery.go

@@ -0,0 +1,760 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"os"
+	"slices"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/nats-io/nats.go"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// The controller's part in a delivery (novox/hq ADR 0239, to-be 47).
+//
+// **A delivery is mesh-delivery's; the walk is the controller's.** A delivery is one commit in one
+// repository from its pull request's head to every machine, and a delivery group a few of them sharing a
+// branch name; their states, order, holds and record belong to the module holding the `mesh-delivery`
+// seat. The controller keeps what it already owned — the planner, the gate, registration, sending, the
+// rollback — and the **walk**: one trunk commit's plan, tier by tier across the machines, one machine
+// first and judged at the gate (ADR 0236). What changes here is when a walk starts.
+//
+//   - A walk that moves the controller, the node-engine, the node tools, the bus or mesh-delivery itself is
+//     **on the controller's own path**: started by the merge, as every plan was. mesh-delivery cannot gate
+//     or deliver itself, and nothing the core needs to be repaired may wait for it.
+//   - Any other walk, **while the seat has a holder on record**, is opened by the merge and waits — nothing
+//     asked, nothing registered, nothing sent — until mesh-delivery says `deliver`, or a person says
+//     `plans go`. Nothing of it is registered before then, so no other send can carry it to a machine
+//     before its turn (ADR 0236 §4a carries everything registered).
+//   - With no holder on record, every walk starts at the merge, exactly as before this existed.
+//
+// The verbs mesh-delivery asks with are here: `delivery plan` (the planner's one answer for a diffset),
+// `delivery order` (a group's order from the graph), `delivery check` (a group's heads composed), `delivery
+// go`, `delivery stop` and `delivery walks`.
+
+// onTheControllersPath are the modules whose walk never waits for the delivery's owner, and what each is.
+var onTheControllersPath = map[string]string{
+	"mesh-controller":      "the controller",
+	"mesh-host":            "the node-engine",
+	"node-tools":           "the node tools",
+	"nats":                 "the bus",
+	catalogue.DeliverySeat: "the delivery's owner",
+}
+
+// deliverySeatHeld is whether a module claiming the delivery seat is assigned somewhere: the seat has a
+// holder on record. Read from the catalogue the merge handler already holds; never from whether the
+// holder answers, so a walk does not start by itself because mesh-delivery is down — that wait is said.
+func deliverySeatHeld(entries []inventory.Entry) bool {
+	for _, e := range entries {
+		if len(e.On) > 0 && e.Manifest.ClaimsSeat(catalogue.DeliverySeat) {
+			return true
+		}
+	}
+	return false
+}
+
+// awaitsFor is what a new walk waits for: nil when it starts at once — no holder on record, or a module
+// on the controller's own path among those it moves.
+func awaitsFor(entries []inventory.Entry, modules []string) *inventory.PlanDelivery {
+	if !deliverySeatHeld(entries) {
+		return nil
+	}
+	for _, m := range modules {
+		if _, own := onTheControllersPath[m]; own {
+			return nil
+		}
+	}
+	return &inventory.PlanDelivery{Awaits: catalogue.DeliverySeat}
+}
+
+// waitingNote is what a walk waiting for its word says, wherever it is read.
+func waitingNote(p inventory.Plan) string {
+	return fmt.Sprintf("published; its walk waits for %s's word — `plans go %s --why …` starts it by hand",
+		p.Delivery.Awaits, p.ID)
+}
+
+// letGo gives a waiting walk its word: by the delivery's owner, or a person. The next advance asks its
+// first tier. Refused for a walk that does not wait.
+func letGo(ctx context.Context, inv *inventory.Inventory, id, by, why string) (inventory.Plan, error) {
+	release, err := inv.HoldPlans(ctx, true)
+	if err != nil {
+		return inventory.Plan{}, err
+	}
+	defer release()
+	p, err := inv.PlanByID(ctx, id)
+	if err != nil {
+		return inventory.Plan{}, err
+	}
+	switch {
+	case !p.Open():
+		return p, fmt.Errorf("%s is %s: there is no walk to start", p.ID, p.State)
+	case p.Delivery == nil || p.Delivery.Awaits == "":
+		return p, fmt.Errorf("%s waits for nobody: it started at its merge", p.ID)
+	case p.Delivery.Go != nil:
+		return p, fmt.Errorf("%s was let go by %s at %s already", p.ID, p.Delivery.By,
+			p.Delivery.Go.Local().Format("15:04:05"))
+	}
+	now := time.Now().UTC()
+	p.Delivery.Go, p.Delivery.By, p.Delivery.Why = &now, by, why
+	p.Note = "let go by " + by + "; its first tier is asked next"
+	if err := inv.SavePlan(ctx, &p); err != nil {
+		return p, err
+	}
+	return p, nil
+}
+
+// stopWalk ends a walk on its delivery's word: failed, said as stopped by whom, why. What it asked still
+// builds and registers; nothing further is asked or sent.
+func stopWalk(ctx context.Context, inv *inventory.Inventory, id, by, why string) (inventory.Plan, error) {
+	release, err := inv.HoldPlans(ctx, true)
+	if err != nil {
+		return inventory.Plan{}, err
+	}
+	defer release()
+	p, err := inv.PlanByID(ctx, id)
+	if err != nil {
+		return inventory.Plan{}, err
+	}
+	if !p.Open() {
+		return p, fmt.Errorf("%s is already %s", p.ID, p.State)
+	}
+	if p.Delivery == nil {
+		p.Delivery = &inventory.PlanDelivery{}
+	}
+	p.Delivery.Stopped, p.Delivery.StoppedWhy = by, why
+	p.State = inventory.PlanFailed
+	p.Note = fmt.Sprintf("stopped by %s at tier %d: %s", by, p.Tier, why)
+	if err := inv.SavePlan(ctx, &p); err != nil {
+		return p, err
+	}
+	return p, nil
+}
+
+// orderMember is one member of a group, as mesh-delivery says it.
+type orderMember struct {
+	ID             string   `json:"id"`
+	Repository     string   `json:"repository"`
+	Base           string   `json:"base,omitempty"`
+	Head           string   `json:"head,omitempty"`
+	Number         int      `json:"number,omitempty"`
+	Paths          []string `json:"paths,omitempty"`
+	PathsTruncated bool     `json:"paths_truncated,omitempty"`
+	Removed        []string `json:"removed,omitempty"`
+	ModuleDirs     []string `json:"module_dirs,omitempty"`
+	ModuleDirsSaid bool     `json:"module_dirs_said,omitempty"`
+	CloneURL       string   `json:"clone_url,omitempty"`
+	// After are the repositories its pull request says it goes after (`after: <repository>`).
+	After []string `json:"after,omitempty"`
+}
+
+// pull is the member as the forge announced it.
+func (m orderMember) pull() link.PullUpdated {
+	owner, repo, _ := strings.Cut(m.Repository, "/")
+	base := m.Base
+	if base == "" {
+		base = "main"
+	}
+	return link.PullUpdated{Owner: owner, Repo: repo, Number: m.Number, Base: base, Commit: m.Head,
+		CloneURL: m.CloneURL, Paths: m.Paths, PathsTruncated: m.PathsTruncated, Removed: m.Removed,
+		ModuleDirs: m.ModuleDirs, ModuleDirsSaid: m.ModuleDirsSaid}
+}
+
+// orderPair is one "before" among a group's members, why, and the rules it won over.
+type orderPair struct {
+	Before string `json:"before"`
+	After  string `json:"after"`
+	Why    string `json:"why"`
+	// Over is the rules that ordered the pair the other way and lost to Why, by precedence (novox/hq ADR
+	// 0249): said, so a person reading the order sees which rule won.
+	Over []string `json:"over,omitempty"`
+}
+
+// orderContradiction is two members that rules of one rank order both ways: no precedence resolves it, so
+// the group is refused, the rules named, and Said says how a person declares the order.
+type orderContradiction struct {
+	Members []string    `json:"members"`
+	Rules   []orderPair `json:"rules"`
+	Said    string      `json:"said"`
+}
+
+// orderReach is what a member moves, as the planner says.
+type orderReach struct {
+	Moved      []string `json:"moved,omitempty"`
+	Dependents []string `json:"dependents,omitempty"`
+	New        []string `json:"new,omitempty"`
+	Manifests  []string `json:"manifests,omitempty"`
+}
+
+// groupOrder is a group's order: the members in it, every pair and why, and the cycle when there is one —
+// with each contradiction no precedence resolves.
+type groupOrder struct {
+	Order          []string              `json:"order"`
+	Pairs          []orderPair           `json:"pairs,omitempty"`
+	Cycle          []string              `json:"cycle,omitempty"`
+	Contradictions []orderContradiction  `json:"contradictions,omitempty"`
+	Reach          map[string]orderReach `json:"reach,omitempty"`
+}
+
+// The reasons a pair is ordered, in the words the delivery plan shows.
+const (
+	orderDeclared    = "declared"
+	orderBuiltBy     = "built by"
+	orderVersionSkew = "version skew"
+	orderEngineFirst = "engine before controller"
+)
+
+// orderRank is a rule's precedence when two rules order one pair both ways (novox/hq ADR 0249), the lower
+// winning: what a person declared; then what the graph and the change say (built by, version skew); then
+// the rollout default, which infers a direction from the modules' names alone.
+func orderRank(why string) int {
+	switch why {
+	case orderDeclared:
+		return 0
+	case orderBuiltBy, orderVersionSkew:
+		return 1
+	case orderEngineFirst:
+		return 2
+	}
+	return 3
+}
+
+// orderOf is a group's order (novox/hq ADR 0239 decision 4, ADR 0249), pure. A member goes before another
+// when:
+//
+//   - its pull request is named in the other's `after:` lines (declared);
+//   - it moves a module the other's moved modules are built by, stand on, package or declare (built by);
+//   - it moves the controller and the other changes any module's manifest (version skew: the newer
+//     controller parses what the newer manifest says) — the node-engine's excepted, which goes first;
+//   - it moves the node-engine and the other moves the controller (the witness reads nothing the controller
+//     does not yet grant, and a controller sends nothing an older engine would refuse — ADR 0236's rollout
+//     order).
+//
+// When rules order one pair both ways, the one of higher precedence wins (orderRank) and the pair says
+// what it won over. Rules of one rank both ways are a contradiction: both are kept as pairs, the members
+// are the cycle, and the contradiction says how to declare the order. Otherwise, by repository then id, so
+// every reading gives one order. A cycle through three members or more is named by its members, and none
+// of them is ordered.
+func orderOf(members []orderMember, reach map[string]orderReach, edges []inventory.Edge) groupOrder {
+	out := groupOrder{Reach: reach}
+	byID := map[string]orderMember{}
+	for _, m := range members {
+		byID[m.ID] = m
+	}
+	var claims []orderPair
+	add := func(before, after, why string) {
+		if before == after {
+			return
+		}
+		for _, p := range claims {
+			if p.Before == before && p.After == after && p.Why == why {
+				return
+			}
+		}
+		claims = append(claims, orderPair{Before: before, After: after, Why: why})
+	}
+	named := func(said, repository string) bool {
+		said = strings.TrimSuffix(strings.TrimSpace(said), ".git")
+		if strings.EqualFold(said, repository) {
+			return true
+		}
+		_, repo, _ := strings.Cut(repository, "/")
+		return strings.EqualFold(said, repo)
+	}
+	for _, a := range members {
+		for _, b := range members {
+			if a.ID == b.ID {
+				continue
+			}
+			ra, rb := reach[a.ID], reach[b.ID]
+			for _, said := range b.After {
+				if named(said, a.Repository) {
+					add(a.ID, b.ID, orderDeclared)
+				}
+			}
+			for _, e := range edges {
+				if slices.Contains(ra.Moved, e.To) && slices.Contains(rb.Moved, e.From) && e.From != e.To {
+					add(a.ID, b.ID, orderBuiltBy)
+					break
+				}
+			}
+			if slices.Contains(ra.Moved, "mesh-controller") && len(rb.Manifests) > 0 &&
+				!slices.Contains(rb.Moved, "mesh-controller") && !slices.Contains(rb.Moved, "mesh-host") {
+				add(a.ID, b.ID, orderVersionSkew)
+			}
+			if slices.Contains(ra.Moved, "mesh-host") && slices.Contains(rb.Moved, "mesh-controller") &&
+				!slices.Contains(ra.Moved, "mesh-controller") {
+				add(a.ID, b.ID, orderEngineFirst)
+			}
+		}
+	}
+	out.Pairs, out.Contradictions = resolveClaims(claims, byID)
+	sort.Slice(out.Pairs, func(i, j int) bool {
+		if out.Pairs[i].Before != out.Pairs[j].Before {
+			return out.Pairs[i].Before < out.Pairs[j].Before
+		}
+		return out.Pairs[i].After < out.Pairs[j].After
+	})
+	// Kahn's walk, the next always the first by repository and id among those with nothing before them.
+	waiting := map[string]int{}
+	for _, m := range members {
+		waiting[m.ID] = 0
+	}
+	for _, p := range out.Pairs {
+		waiting[p.After]++
+	}
+	done := map[string]bool{}
+	for len(done) < len(members) {
+		var ready []orderMember
+		for _, m := range members {
+			if !done[m.ID] && waiting[m.ID] == 0 {
+				ready = append(ready, m)
+			}
+		}
+		if len(ready) == 0 {
+			for _, m := range members {
+				if !done[m.ID] {
+					out.Cycle = append(out.Cycle, m.ID)
+				}
+			}
+			sort.Strings(out.Cycle)
+			return out
+		}
+		sort.Slice(ready, func(i, j int) bool {
+			if ready[i].Repository != ready[j].Repository {
+				return ready[i].Repository < ready[j].Repository
+			}
+			return ready[i].ID < ready[j].ID
+		})
+		next := ready[0]
+		done[next.ID] = true
+		out.Order = append(out.Order, next.ID)
+		for _, p := range out.Pairs {
+			if p.Before == next.ID {
+				waiting[p.After]--
+			}
+		}
+	}
+	return out
+}
+
+// orderRules is the rules in the order a pair names them when more than one says the same.
+var orderRules = []string{orderDeclared, orderBuiltBy, orderVersionSkew, orderEngineFirst}
+
+// resolveClaims is the pairs the rules' claims come to (novox/hq ADR 0249): for each two members, the claims
+// of the highest precedence decide, and the claims they overrule are said on the pair. Claims of one rank
+// both ways are a contradiction: both pairs are kept, so the walk finds the cycle, and the contradiction
+// says how a person declares the order.
+func resolveClaims(claims []orderPair, byID map[string]orderMember) ([]orderPair, []orderContradiction) {
+	byTwo := map[[2]string][]orderPair{}
+	var keys [][2]string
+	for _, c := range claims {
+		k := [2]string{min(c.Before, c.After), max(c.Before, c.After)}
+		if _, ok := byTwo[k]; !ok {
+			keys = append(keys, k)
+		}
+		byTwo[k] = append(byTwo[k], c)
+	}
+	slices.SortFunc(keys, func(a, b [2]string) int {
+		if c := strings.Compare(a[0], b[0]); c != 0 {
+			return c
+		}
+		return strings.Compare(a[1], b[1])
+	})
+	ruleIndex := func(why string) int { return slices.Index(orderRules, why) }
+	var pairs []orderPair
+	var contradictions []orderContradiction
+	for _, k := range keys {
+		cs := byTwo[k]
+		slices.SortStableFunc(cs, func(a, b orderPair) int { return ruleIndex(a.Why) - ruleIndex(b.Why) })
+		top := orderRank(cs[0].Why)
+		var won []orderPair
+		ways := map[string]bool{}
+		for _, c := range cs {
+			if orderRank(c.Why) == top {
+				won = append(won, c)
+				ways[c.Before] = true
+			}
+		}
+		if len(ways) == 1 {
+			p := orderPair{Before: won[0].Before, After: won[0].After, Why: won[0].Why}
+			for _, c := range cs {
+				if c.Before != p.Before && !slices.Contains(p.Over, c.Why) {
+					p.Over = append(p.Over, c.Why)
+				}
+			}
+			pairs = append(pairs, p)
+			continue
+		}
+		// One rank both ways: no precedence resolves it.
+		var first, second *orderPair
+		var said []string
+		for i := range won {
+			c := won[i]
+			if c.Before == k[0] && first == nil {
+				first = &won[i]
+			}
+			if c.Before == k[1] && second == nil {
+				second = &won[i]
+			}
+			said = append(said, fmt.Sprintf("%s puts %s first", c.Why, c.Before))
+		}
+		pairs = append(pairs, orderPair{Before: first.Before, After: first.After, Why: first.Why},
+			orderPair{Before: second.Before, After: second.After, Why: second.Why})
+		a, b := byID[k[0]], byID[k[1]]
+		how := fmt.Sprintf("neither outranks the other: declare the order with a line `after: %s` in %s's "+
+			"description, or `after: %s` in %s's", a.Repository, pullName(b), b.Repository, pullName(a))
+		if top == orderRank(orderDeclared) {
+			how = "each pull request declares it goes after the other: remove one of the `after:` lines"
+		}
+		contradictions = append(contradictions, orderContradiction{Members: []string{k[0], k[1]}, Rules: won,
+			Said: fmt.Sprintf("%s and %s: %s; %s", k[0], k[1], strings.Join(said, ", "), how)})
+	}
+	return pairs, contradictions
+}
+
+// pullName is a member as a person finds it: its pull request, or its id when no number was said.
+func pullName(m orderMember) string {
+	if m.Number > 0 {
+		return fmt.Sprintf("%s#%d", m.Repository, m.Number)
+	}
+	return m.ID
+}
+
+// reachOfMembers is each member's reach, as the planner says it.
+func reachOfMembers(members []orderMember, entries []inventory.Entry, read map[string][]inventory.ReadRepository,
+	edges []inventory.Edge) map[string]orderReach {
+	out := map[string]orderReach{}
+	for _, m := range members {
+		s := pullScope(m.pull(), entries, read, edges)
+		out[m.ID] = orderReach{Moved: s.Modules, Dependents: s.Dependents, New: s.New, Manifests: s.Manifests}
+	}
+	return out
+}
+
+// deliveryCommand is `delivery`, the controller's verbs for the delivery's owner:
+//
+//	delivery plan --repository owner/repo --head <commit> [--base main] --paths a,b [--module-dirs …] [--removed …]
+//	delivery order --members <json>
+//	delivery check --group <id> --members <json>
+//	delivery go <plan> [--by <who>] [--why <text>]
+//	delivery stop <plan> --why <text> [--by <who>]
+//	delivery walks [-n 50] [--plan <id>]
+func deliveryCommand(ctx context.Context, args []string) error {
+	if len(args) == 0 {
+		return errors.New("delivery plan|order|check|go|stop|walks")
+	}
+	sub, rest := args[0], args[1:]
+	set := flag.NewFlagSet("delivery "+sub, flag.ContinueOnError)
+	repository := set.String("repository", "", "owner/repository")
+	base := set.String("base", "main", "the branch it merges into")
+	head := set.String("head", "", "the commit at hand")
+	paths := set.String("paths", "", "the files it changes, comma-separated")
+	moduleDirs := set.String("module-dirs", "", "the directories holding a module.json at the head, comma-separated")
+	removed := set.String("removed", "", "the files it deletes, comma-separated")
+	membersJSON := set.String("members", "", "a group's members, as JSON")
+	group := set.String("group", "", "a delivery group's id")
+	by := set.String("by", catalogue.DeliverySeat, "who says it")
+	why := set.String("why", "", "why")
+	limit := set.Int("n", 50, "how many ended walks to answer beside the open ones")
+	planID := set.String("plan", "", "one walk")
+	positionals, err := parseAround(set, rest)
+	if err != nil {
+		return err
+	}
+	var members []orderMember
+	if *membersJSON != "" {
+		if err := json.Unmarshal([]byte(*membersJSON), &members); err != nil {
+			return fmt.Errorf("the members are not readable: %w", err)
+		}
+	}
+	open, err := openStores(ctx)
+	if err != nil {
+		return err
+	}
+	defer open.Close()
+	inv := open.inventory
+	answer := func(v any) error {
+		enc := json.NewEncoder(os.Stdout)
+		enc.SetIndent("", "  ")
+		return enc.Encode(v)
+	}
+	switch sub {
+	case "plan":
+		if *repository == "" || *head == "" && *paths == "" {
+			return errors.New("delivery plan --repository owner/repo --head <commit> --paths a,b")
+		}
+		m := orderMember{ID: *repository + "@" + *head, Repository: *repository, Base: *base, Head: *head,
+			Paths: splitList(*paths), Removed: splitList(*removed)}
+		if d := moduleDirsOf(*moduleDirs); d != nil {
+			m.ModuleDirs, m.ModuleDirsSaid = *d, true
+		}
+		entries, read, edges, err := theGraph(ctx, inv)
+		if err != nil {
+			return err
+		}
+		s := pullScope(m.pull(), entries, read, edges)
+		plan := changePlanOf(*repository, *base, *head, s.Reach, entries, func(module string) (inventory.Upgrade, bool) {
+			u, err := inv.UpgradeOf(ctx, module)
+			return u, err == nil
+		})
+		return answer(map[string]any{"plan": plan, "reach": orderReach{Moved: s.Modules, Dependents: s.Dependents,
+			New: s.New, Manifests: s.Manifests}, "mesh": s.Mesh, "gated": s.gated()})
+	case "order":
+		if len(members) == 0 {
+			return errors.New("delivery order --members <json>: a group has members")
+		}
+		entries, read, edges, err := theGraph(ctx, inv)
+		if err != nil {
+			return err
+		}
+		return answer(orderOf(members, reachOfMembers(members, entries, read, edges), edges))
+	case "check":
+		if *group == "" && len(members) == 1 {
+			// One head, checked again as the forge's announcement would have it (a recheck): the controller's
+			// own path for a pull request, run because the delivery's owner asked.
+			if err := sayingOnTheBus(ctx, func() error { return (following{open}).PullUpdated(ctx, members[0].pull()) }); err != nil {
+				return err
+			}
+			return answer(map[string]any{"rechecked": members[0].ID})
+		}
+		if *group == "" || len(members) < 2 {
+			return errors.New("delivery check --group <id> --members <json> (two heads or more), or --members <one head>")
+		}
+		id, err := askGroupCheck(ctx, open, *group, members)
+		if err != nil {
+			return err
+		}
+		return answer(map[string]any{"asked": id, "group": *group})
+	case "go":
+		if len(positionals) != 1 {
+			return errors.New("delivery go <plan> [--by <who>] [--why <text>]")
+		}
+		var p inventory.Plan
+		if err := sayingOnTheBus(ctx, func() (err error) {
+			p, err = letGo(ctx, inv, positionals[0], *by, strings.TrimSpace(*why))
+			return err
+		}); err != nil {
+			return err
+		}
+		fmt.Printf("%s (%s at %s) is let go by %s; its first tier is asked at the next pass\n", p.ID, p.Repository,
+			short(p.Commit), *by)
+		return nil
+	case "stop":
+		if len(positionals) != 1 || strings.TrimSpace(*why) == "" {
+			return errors.New("delivery stop <plan> --why <text> [--by <who>]")
+		}
+		var p inventory.Plan
+		if err := sayingOnTheBus(ctx, func() (err error) {
+			p, err = stopWalk(ctx, inv, positionals[0], *by, strings.TrimSpace(*why))
+			return err
+		}); err != nil {
+			return err
+		}
+		fmt.Printf("%s stopped by %s at tier %d of %d; what was asked still builds and registers, nothing further "+
+			"is asked or sent\n", p.ID, *by, p.Tier, len(p.Tiers))
+		return nil
+	case "walks":
+		var walks []inventory.Plan
+		if *planID != "" {
+			p, err := inv.PlanByID(ctx, *planID)
+			if err != nil {
+				return err
+			}
+			walks = []inventory.Plan{p}
+		} else {
+			if walks, err = inv.OpenPlans(ctx); err != nil {
+				return err
+			}
+			recent, err := inv.RecentPlans(ctx, *limit)
+			if err != nil {
+				return err
+			}
+			for _, p := range recent {
+				if !slices.ContainsFunc(walks, func(w inventory.Plan) bool { return w.ID == p.ID }) {
+					walks = append(walks, p)
+				}
+			}
+		}
+		entries, err := inv.Catalogued(ctx)
+		if err != nil {
+			return err
+		}
+		return answer(map[string]any{"held": deliverySeatHeld(entries), "walks": walks,
+			"own-path": sortedKeysOf(ownPathWords())})
+	}
+	return fmt.Errorf("delivery %s: plan, order, check, go, stop or walks", sub)
+}
+
+// ownPathWords is the controller's own path as words, for an answer.
+func ownPathWords() map[string]string { return onTheControllersPath }
+
+// theGraph is what the planner reads.
+func theGraph(ctx context.Context, inv *inventory.Inventory) ([]inventory.Entry, map[string][]inventory.ReadRepository,
+	[]inventory.Edge, error) {
+	entries, err := inv.Catalogued(ctx)
+	if err != nil {
+		return nil, nil, nil, err
+	}
+	read, err := inv.ReadRepositories(ctx)
+	if err != nil {
+		return nil, nil, nil, err
+	}
+	edges, err := inv.Dependencies(ctx)
+	if err != nil {
+		return nil, nil, nil, err
+	}
+	return entries, read, edges, nil
+}
+
+// groupPrimary is the head a group's composed check is run from: the one moving the controller, which then
+// judges the group by itself; else the one moving the node-engine, whose validator judges; else the first.
+func groupPrimary(members []orderMember, reach map[string]orderReach) int {
+	for _, want := range []string{"mesh-controller", "mesh-host"} {
+		for i, m := range members {
+			if slices.Contains(reach[m.ID].Moved, want) {
+				return i
+			}
+		}
+	}
+	return 0
+}
+
+// askGroupCheck asks the build seat for a group's composed check: every head laid over the mesh in turn,
+// judged as one future state (novox/hq ADR 0239). The verdict comes back as `checked` with the group's id,
+// for mesh-delivery; the forge's holder sets no status from it.
+func askGroupCheck(ctx context.Context, open *stores, group string, members []orderMember) (string, error) {
+	entries, read, edges, err := theGraph(ctx, open.inventory)
+	if err != nil {
+		return "", err
+	}
+	reach := reachOfMembers(members, entries, read, edges)
+	primary := groupPrimary(members, reach)
+	p := members[primary].pull()
+	scope := pullScope(p, entries, read, edges)
+	// The gate runs over what any member moves; a judge from the primary alone.
+	for _, m := range members {
+		r := reach[m.ID]
+		scope.Modules = appendNew(scope.Modules, r.Moved...)
+		scope.Dependents = appendNew(scope.Dependents, r.Dependents...)
+	}
+	request, err := checkRequestFor(ctx, open, p, scope, entries)
+	if err != nil {
+		return "", err
+	}
+	request.Check.Group = group
+	world, err := theRestOfTheMesh(ctx, open.inventory, shelfOf(entries), "")
+	if err != nil {
+		return "", err
+	}
+	for i, m := range members {
+		if i == primary {
+			continue
+		}
+		mp := m.pull()
+		// As the mesh clones a module built from it; a repository no module is built from, from the forge.
+		source := inventory.Source{Seat: gitSeat, Repository: mp.Owner + "/" + mp.Repo}
+		for _, e := range entries {
+			if !e.Provided && sameRepository(e.Source.Repository, link.SourceMoved{Owner: mp.Owner, Repo: mp.Repo}) {
+				source = e.Source
+				break
+			}
+		}
+		url := source.Repository
+		if source.Seat != "" {
+			url, err = clonedFromSeat(world, source.Seat, source.Repository)
+		}
+		if err != nil {
+			return "", fmt.Errorf("%s cannot be cloned for the group's check: %w", m.ID, err)
+		}
+		request.Check.Members = append(request.Check.Members, link.GroupMember{Owner: mp.Owner, Repo: mp.Repo,
+			Number: mp.Number, Repository: url, Ref: mp.Commit, Paths: mp.Paths})
+	}
+	seat := buildSeatHeld(ctx)
+	ask, err := askOverOn(seat)
+	if err != nil {
+		return "", err
+	}
+	defer ask.Close()
+	if err := ask.Ask(ctx, request); err != nil {
+		return "", err
+	}
+	fmt.Fprintf(os.Stderr, "group %s: asked %s to check %d head(s) composed together, as %s\n", group, seat,
+		len(members), request.ID)
+	return request.ID, nil
+}
+
+// appendNew appends what is not there yet.
+func appendNew(to []string, items ...string) []string {
+	for _, i := range items {
+		if !slices.Contains(to, i) {
+			to = append(to, i)
+		}
+	}
+	return to
+}
+
+// shelfOf is the catalogue's manifests by name.
+func shelfOf(entries []inventory.Entry) map[string]catalogue.Manifest {
+	shelf := map[string]catalogue.Manifest{}
+	for _, e := range entries {
+		shelf[e.Manifest.Module] = e.Manifest
+	}
+	return shelf
+}
+
+// sayPlanMoved says a walk kept in a new state as the controller's `plan-moved`, the plan whole: what the
+// delivery it walks reads its steps from. Never in the way of the walk: said beside it, and a save that could
+// not be said is logged — the delivery's owner, which also asks for the walks it follows, finds it by
+// comparison. Records arriving out of order are told apart by the plan's revision.
+func sayPlanMoved(ctx context.Context, bus link.Bus, p inventory.Plan) {
+	go publishPlanMoved(ctx, bus, p)
+}
+
+func publishPlanMoved(ctx context.Context, bus link.Bus, p inventory.Plan) {
+	body, err := json.Marshal(p)
+	if err != nil {
+		return
+	}
+	stating, stop := context.WithTimeout(context.WithoutCancel(ctx), 10*time.Second)
+	defer stop()
+	if err := bus.PublishSeatEvent(stating, link.MeshControllerSeat, link.KeyPlanMoved, body); err != nil {
+		fmt.Fprintf(os.Stderr, "%s: kept, and could not be said as plan-moved: %v\n", p.ID, err)
+	}
+}
+
+// sayingOnTheBus runs a command that keeps walks or says verdicts with the bus to say them on: the serving
+// controller's, or a connection of the command's own — a verb runs as a command of its own, and what it kept
+// would otherwise be said by nobody until the delivery's owner read the walks back. Without a bus the command
+// still runs; what it did is found by comparison.
+func sayingOnTheBus(ctx context.Context, f func() error) error {
+	if checkEvents != nil {
+		return f()
+	}
+	ran := false
+	err := onTheBus(func(conn *nats.Conn) error {
+		js, err := conn.JetStream()
+		if err != nil {
+			return err
+		}
+		bus := link.OverNATS{Conn: conn, JS: js}
+		checkEvents = bus
+		inventory.PlanSaved = func(p inventory.Plan) { publishPlanMoved(ctx, bus, p) }
+		defer func() { checkEvents, inventory.PlanSaved = nil, nil }()
+		ran = true
+		return f()
+	})
+	if !ran {
+		fmt.Fprintf(os.Stderr, "the bus cannot be reached (%v): what this does is not said, and is found by comparison\n", err)
+		return f()
+	}
+	return err
+}

cmd/mesh-controller/delivery_conditions.go

@@ -0,0 +1,185 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/nats-io/nats.go"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// A delivery held past its bound, said by the controller and healed by H2 from mesh-delivery's own table
+// (novox/hq ADR 0239 decision 9, to-be 47 Phase B). The conditions are the controller's, one owner: the
+// self-check reads the delivery owner's `stalled` (probe D14) and raises `delivery.<id>.stalled`; healer
+// H2 calls the owner's `close`, which takes only the transition the table names for that state, and only
+// the next observation says whether it worked (ADR 0231).
+
+// probeDeliveriesID is the probe that reads the delivery's owner.
+const probeDeliveriesID = "D14"
+
+// kindDeliveryStalled is what a delivery held past its bound raises: H2's kind, in the delivery scope.
+const kindDeliveryStalled = "stalled"
+
+// deliveryOwnerWithin is how long the owner is given to answer.
+var deliveryOwnerWithin = 10 * time.Second
+
+// stalledLine is one delivery past its bound, as mesh-delivery's `stalled` says it.
+type stalledLine struct {
+	ID string `json:"id"`
+	// Number is the pull request's, for a line of a head the forge never announced (novox/hq issue 347).
+	Number int    `json:"number,omitempty"`
+	State  string `json:"state"`
+	For    string `json:"for"`
+	Bound  string `json:"bound"`
+	H2     string `json:"h2"`
+	Says   string `json:"says"`
+}
+
+// operatorsOnly is whether the table leaves H2 nothing to do for the line: the state is the operator's.
+func (l stalledLine) operatorsOnly() bool { return l.H2 == "" || strings.HasPrefix(l.H2, "none") }
+
+// askDeliveryOwner asks the holder of the mesh-delivery seat one of the verbs the controller is granted;
+// a seam a test replaces. The holder's own refusal is an error naming it.
+var askDeliveryOwner = func(ctx context.Context, conn *nats.Conn, verb string, args map[string]any) (json.RawMessage, error) {
+	granted := false
+	for _, v := range broker.VerbsTheControllerAsksTheDeliveryOwner {
+		granted = granted || v.Verb == verb
+	}
+	if !granted {
+		return nil, fmt.Errorf("the controller asks %s.%s, which its grant does not name", catalogue.DeliverySeat, verb)
+	}
+	if conn == nil {
+		return nil, errors.New("this controller is not on the bus")
+	}
+	answer, err := link.AskMeshSeatTool(ctx, conn, catalogue.DeliverySeat, verb, args, deliveryOwnerWithin)
+	if err != nil {
+		return nil, err
+	}
+	if answer.Error != "" {
+		return nil, fmt.Errorf("%s.%s refused: %s", catalogue.DeliverySeat, verb, answer.Error)
+	}
+	return unwrapToolResult(answer.Result), nil
+}
+
+// unwrapToolResult is a tool's answer whatever the runtime wrapped it in: the JSON itself, or the
+// protocol's content list holding it as text.
+func unwrapToolResult(raw json.RawMessage) json.RawMessage {
+	var wrapped struct {
+		Content []struct {
+			Text string `json:"text"`
+		} `json:"content"`
+	}
+	if json.Unmarshal(raw, &wrapped) == nil && len(wrapped.Content) > 0 && json.Valid([]byte(wrapped.Content[0].Text)) {
+		return json.RawMessage(wrapped.Content[0].Text)
+	}
+	return raw
+}
+
+// deliveriesStalled is what the owner says is held past its bound; nothing when no holder is on record,
+// or none answers (D3 says that one).
+func deliveriesStalled(ctx context.Context, conn *nats.Conn, held bool) ([]stalledLine, error) {
+	if !held {
+		return nil, nil
+	}
+	raw, err := askDeliveryOwner(ctx, conn, "stalled", map[string]any{})
+	if errors.Is(err, link.ErrNothingServes) {
+		return nil, nil // the holder not running is D3's holder-silent, said once there
+	}
+	if err != nil {
+		return nil, err
+	}
+	var lines []stalledLine
+	if err := json.Unmarshal(raw, &lines); err != nil {
+		return nil, fmt.Errorf("%s.stalled answered something unreadable: %w", catalogue.DeliverySeat, err)
+	}
+	return lines, nil
+}
+
+// stalledObservations are the conditions of what is stalled.
+func stalledObservations(lines []stalledLine) []conditions.Observation {
+	out := make([]conditions.Observation, 0, len(lines))
+	for _, l := range lines {
+		o := conditions.Observation{Scope: conditions.ScopeDelivery, ID: l.ID, Kind: kindDeliveryStalled,
+			Severity: conditions.Warning,
+			Summary: fmt.Sprintf("the delivery %s has been %s for %s, past its bound of %s (%s): healer H2 may %s — "+
+				"`mesh-delivery.show %s`", l.ID, l.State, l.For, l.Bound, l.Says, l.H2, l.ID),
+			Said: fmt.Sprintf("%s for %s", l.State, l.For)}
+		if l.operatorsOnly() {
+			o.Resolver = conditions.ResolverOperator
+		}
+		o.Headline, o.Explanation, o.Resolved, o.Needs, o.Actions = stalledWords(l, o)
+		out = append(out, o)
+	}
+	return out
+}
+
+// probeDeliveries is D14: every delivery held past its state's bound is said.
+func probeDeliveries(ctx context.Context, d *doctor) ([]conditions.Observation, error) {
+	entries, err := d.open.inventory.Catalogued(ctx)
+	if err != nil {
+		return nil, err
+	}
+	var conn *nats.Conn
+	if d.js != nil {
+		conn = d.js.Conn()
+	}
+	lines, err := deliveriesStalled(ctx, conn, deliverySeatHeld(entries))
+	if err != nil {
+		return nil, err
+	}
+	return stalledObservations(lines), nil
+}
+
+// --- H2, for a delivery ---------------------------------------------------------------------------------
+
+// connOf is the bus a healer asks over.
+func (h *healing) connOf() *nats.Conn {
+	if h.js == nil {
+		return nil
+	}
+	return h.js.Conn()
+}
+
+// appliesToAStalledDelivery is H2's for a delivery: the owner still lists it, with a transition the table
+// lets H2 take; never one whose state is the operator's.
+func appliesToAStalledDelivery(ctx context.Context, h *healing, c conditions.Condition) (string, bool, string, error) {
+	lines, err := deliveriesStalled(ctx, h.connOf(), true)
+	if err != nil {
+		return "", false, "", err
+	}
+	for _, l := range lines {
+		if l.ID != c.Subject.ID {
+			continue
+		}
+		if l.operatorsOnly() {
+			return "", false, "the delivery is " + l.State + ", a state the table leaves to the operator", nil
+		}
+		return c.Key, true, "", nil
+	}
+	return "", false, "the delivery's owner no longer lists it as stalled: its condition clears on the next look", nil
+}
+
+// repairDelivery is H2 for a delivery: the owner's `close`, which reads the walk again and takes only the
+// transition its table names. A refusal is no repair, said; the next observation says whether it worked.
+func repairDelivery(ctx context.Context, h *healing, c conditions.Condition) (string, string, error) {
+	raw, err := askDeliveryOwner(ctx, h.connOf(), "close", map[string]any{"id": c.Subject.ID, "why": c.Key})
+	if err != nil {
+		if errors.Is(err, link.ErrNothingServes) {
+			return "", "", err
+		}
+		return "closed nothing", oneLine(err.Error()), nil
+	}
+	var said string
+	if json.Unmarshal(raw, &said) != nil {
+		said = string(raw)
+	}
+	return "asked " + catalogue.DeliverySeat + " to close " + c.Subject.ID, said, nil
+}

cmd/mesh-controller/delivery_conditions_test.go

@@ -0,0 +1,172 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/nats-io/nats.go"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+	"github.com/novox/mesh-controller/internal/testbus"
+)
+
+// novox/hq ADR 0239 decision 9, to-be 47 Phase B: a delivery held past its bound is the controller's
+// condition, read from mesh-delivery's `stalled`; H2 takes the table's transition through its `close`.
+
+// ownerAnswers replaces the delivery owner with one that answers stalled with these lines and records
+// what close was asked.
+func ownerAnswers(t *testing.T, lines []stalledLine, closeErr error) *[]string {
+	t.Helper()
+	var closed []string
+	was := askDeliveryOwner
+	askDeliveryOwner = func(_ context.Context, _ *nats.Conn, verb string, args map[string]any) (json.RawMessage, error) {
+		switch verb {
+		case "stalled":
+			raw, _ := json.Marshal(lines)
+			return raw, nil
+		case "close":
+			closed = append(closed, args["id"].(string))
+			if closeErr != nil {
+				return nil, closeErr
+			}
+			return json.RawMessage(`"` + args["id"].(string) + `: delivering → delivered, as its walk's record says"`), nil
+		}
+		t.Fatalf("asked the owner %s", verb)
+		return nil, nil
+	}
+	t.Cleanup(func() { askDeliveryOwner = was })
+	return &closed
+}
+
+func holdTheDeliverySeat(t *testing.T, open *stores) {
+	t.Helper()
+	m := catalogue.Manifest{Module: "mesh-delivery", Version: "1",
+		Claims: []catalogue.Claim{{Name: catalogue.DeliverySeat, Scope: catalogue.ScopeMesh}}}
+	if err := open.inventory.RegisterModule(t.Context(), m, inventory.Source{Repository: "novox/mesh-catalog",
+		Path: "modules/mesh-delivery", BuiltFrom: "c0"}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := open.inventory.Assign(t.Context(), "anchor", "mesh-delivery"); err != nil {
+		t.Fatal(err)
+	}
+}
+
+var twoStalled = []stalledLine{
+	{ID: "novox/app@aaaaaaaaaaaa", State: "delivering", For: "3h0m0s", Bound: "2h0m0s",
+		H2: "close, by done or superseded or failed, when the walk's record says so", Says: "its walk runs"},
+	{ID: "novox/lab@bbbbbbbbbbbb", State: "held", For: "49h0m0s", Bound: "24h0m0s",
+		H2: "none: the state is the operator's", Says: "it waits for the operator"},
+}
+
+func TestD14SaysEveryDeliveryHeldPastItsBound(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	ownerAnswers(t, twoStalled, nil)
+	d := &doctor{open: open}
+	got, err := probeDeliveries(ctx, d)
+	if err != nil || len(got) != 0 {
+		t.Fatalf("with no holder on record D14 said %+v %v", got, err)
+	}
+	holdTheDeliverySeat(t, open)
+	got, err = probeDeliveries(ctx, d)
+	if err != nil || len(got) != 2 {
+		t.Fatalf("D14 said %+v %v", got, err)
+	}
+	if got[0].Key() != "delivery.novox/app_aaaaaaaaaaaa.stalled" || got[0].Severity != conditions.Warning ||
+		got[0].Resolver != "" || !strings.Contains(got[0].Summary, "mesh-delivery.show novox/app@aaaaaaaaaaaa") {
+		t.Fatalf("the first is %+v", got[0])
+	}
+	if got[1].Resolver != conditions.ResolverOperator {
+		t.Fatalf("a held delivery is not the operator's: %+v", got[1])
+	}
+	// The holder not running is D3's to say, not D14's.
+	was := askDeliveryOwner
+	askDeliveryOwner = func(context.Context, *nats.Conn, string, map[string]any) (json.RawMessage, error) {
+		return nil, link.ErrNothingServes
+	}
+	defer func() { askDeliveryOwner = was }()
+	if got, err := probeDeliveries(ctx, d); err != nil || len(got) != 0 {
+		t.Fatalf("an owner that is down was said by D14: %+v %v", got, err)
+	}
+}
+
+// H2 for a delivery: close asked for the one whose state the table gives H2, never for the operator's; a
+// refusal is no repair.
+func TestH2ClosesAStalledDeliveryThroughItsOwnerOnly(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	h, told, _ := healingOn(t, open)
+	closed := ownerAnswers(t, twoStalled, nil)
+	for _, o := range stalledObservations(twoStalled) {
+		o.Source = probeDeliveriesID
+		if _, err := conditionsFrom.Observe(ctx, o); err != nil {
+			t.Fatal(err)
+		}
+	}
+	h.tick(ctx)
+	if !slices.Equal(*closed, []string{"novox/app@aaaaaaaaaaaa"}) {
+		t.Fatalf("close was asked for %v", *closed)
+	}
+	acts := told.said()
+	if len(acts) != 1 || acts[0].Healer != "H2" || acts[0].Condition != "delivery.novox/app_aaaaaaaaaaaa.stalled" {
+		t.Fatalf("said %+v", acts)
+	}
+	// A refusal: closed nothing, said so.
+	c, _, _ := conditionsFrom.Get(ctx, "delivery.novox/app_aaaaaaaaaaaa.stalled")
+	ownerAnswers(t, twoStalled, errors.New("mesh-delivery.close refused: still delivering"))
+	act, said, err := repairDelivery(ctx, h, c)
+	if err != nil || act != "closed nothing" || !strings.Contains(said, "still delivering") {
+		t.Fatalf("a refused close reads %q %q %v", act, said, err)
+	}
+}
+
+// The controller may ask the delivery's owner what D14 and H2 ask, on its flat subjects, and nothing else
+// of it; and over a real bus the answer — wrapped as the runtime wraps it — is read.
+func TestTheDeliveryOwnerIsAskedOverTheBus(t *testing.T) {
+	granted, err := broker.PermissionsFor(broker.Principal{Kind: broker.KindController, PasswordHash: "x"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	// And release and stop, which the operator's warrant chooses (novox/hq ADR 0259).
+	for _, verb := range []string{"stalled", "close", "release", "stop"} {
+		if !slices.Contains(granted.Publish, link.SeatToolSubject(catalogue.DeliverySeat, verb)) {
+			t.Errorf("the controller may not ask %s.%s", catalogue.DeliverySeat, verb)
+		}
+	}
+	if _, err := askDeliveryOwner(t.Context(), nil, "retire-history", nil); err == nil || !strings.Contains(err.Error(), "grant") {
+		t.Fatalf("a verb the grant does not name was asked: %v", err)
+	}
+	conn, err := nats.Connect(testbus.URL(t))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer conn.Close()
+	if _, err := deliveriesStalled(t.Context(), conn, true); err != nil {
+		t.Fatalf("an owner not running is D3's, not an error: %v", err)
+	}
+	lines, _ := json.Marshal(twoStalled)
+	wrapped, _ := json.Marshal(map[string]any{"content": []map[string]any{{"type": "text", "text": string(lines)}}})
+	sub, err := conn.Subscribe(link.SeatToolSubject(catalogue.DeliverySeat, "stalled"), func(m *nats.Msg) {
+		body, _ := json.Marshal(link.Answer{Result: wrapped})
+		_ = m.Respond(body)
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = sub.Unsubscribe() }()
+	ctx, cancel := context.WithTimeout(t.Context(), 5*time.Second)
+	defer cancel()
+	got, err := deliveriesStalled(ctx, conn, true)
+	if err != nil || len(got) != 2 || got[0].ID != "novox/app@aaaaaaaaaaaa" {
+		t.Fatalf("over the bus: %+v %v", got, err)
+	}
+}

cmd/mesh-controller/delivery_order_test.go

@@ -0,0 +1,145 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// recordingDelivery is a delivery that writes down what was done, in order, and fails where told.
+type recordingDelivery struct {
+	did        []string
+	grantErr   error
+	declareErr error
+}
+
+func (r *recordingDelivery) grant(_ context.Context, sending []readyNode) error {
+	for _, s := range sending {
+		r.did = append(r.did, "grant "+s.node)
+	}
+	return r.grantErr
+}
+
+func (r *recordingDelivery) declare(_ context.Context, s readyNode, _ []byte) (string, error) {
+	if r.declareErr != nil {
+		return "", r.declareErr
+	}
+	r.did = append(r.did, "declare "+s.node)
+	return "digest-" + s.node, nil
+}
+
+func ready(names ...string) []readyNode {
+	var out []readyNode
+	for _, n := range names {
+		out = append(out, readyNode{node: n, declared: sendable{Resources: []map[string]any{{"id": "x"}}}})
+	}
+	return out
+}
+
+// novox/hq issue 249: the grants that come with a module's new declarations are issued before any
+// machine is sent the code that uses them — except the machine holding the bus, whose declaration
+// carries the controller's own right to issue them, and goes first.
+func TestGrantsAreIssuedBeforeTheDeclarations(t *testing.T) {
+	d := &recordingDelivery{}
+	digests, err := deliver(t.Context(), d, "", ready("anchor", "laptop"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := []string{"grant anchor", "grant laptop", "declare anchor", "declare laptop"}
+	if !reflect.DeepEqual(d.did, want) {
+		t.Fatalf("delivered in the order %v, wanted %v", d.did, want)
+	}
+	if digests["anchor"] != "digest-anchor" || digests["laptop"] != "digest-laptop" {
+		t.Fatalf("the digests sent were not answered: %v", digests)
+	}
+
+	held := &recordingDelivery{}
+	if _, err := deliver(t.Context(), held, "broker", ready("broker", "anchor")); err != nil {
+		t.Fatal(err)
+	}
+	want = []string{"declare broker", "grant broker", "grant anchor", "declare anchor"}
+	if !reflect.DeepEqual(held.did, want) {
+		t.Fatalf("with the bus's machine in the send: %v, wanted %v", held.did, want)
+	}
+}
+
+// A grant that cannot be issued holds back the machines it concerns and is an error the caller
+// retries on — never "until the next push" — and the bus's own machine is sent regardless, so the
+// grant that would let the controller issue memberships is never held behind them.
+func TestAGrantThatFailsHoldsBackWhatItConcerns(t *testing.T) {
+	// A failure naming no machine (the buckets): everything but the bus's machine.
+	d := &recordingDelivery{grantErr: errors.New("the bus refused the bucket")}
+	_, err := deliver(t.Context(), d, "broker", ready("broker", "anchor", "laptop"))
+	if err == nil || !errors.Is(err, errGrants) || !strings.Contains(err.Error(), "the bus refused the bucket") ||
+		!strings.Contains(err.Error(), "anchor, laptop not sent") {
+		t.Fatalf("a failed grant was not said as the send's failure: %v", err)
+	}
+	if want := []string{"declare broker", "grant broker", "grant anchor", "grant laptop"}; !reflect.DeepEqual(d.did, want) {
+		t.Fatalf("delivered %v, wanted the bus's machine alone", d.did)
+	}
+
+	// A membership that failed for one machine: that machine alone.
+	one := &recordingDelivery{grantErr: &grantsRefused{nodes: map[string]error{"laptop": errors.New("no")}}}
+	_, err = deliver(t.Context(), one, "", ready("anchor", "laptop"))
+	if !errors.Is(err, errGrants) || !strings.Contains(err.Error(), "laptop not sent") {
+		t.Fatalf("one machine's refused membership was not said: %v", err)
+	}
+	if want := []string{"grant anchor", "grant laptop", "declare anchor"}; !reflect.DeepEqual(one.did, want) {
+		t.Fatalf("delivered %v, wanted anchor sent and laptop held back", one.did)
+	}
+
+	// The announced upgrade that hit it is asked again.
+	if !errors.Is(askAgainOnGrants(err), link.ErrTryAgain) {
+		t.Fatal("an announcement whose send stopped at its grants is not asked again")
+	}
+	if other := errors.New("laptop could not be resolved"); errors.Is(askAgainOnGrants(other), link.ErrTryAgain) {
+		t.Fatal("any failure is asked again, not only a grant's")
+	}
+
+	// Nothing to send is nothing granted either.
+	none := &recordingDelivery{grantErr: errors.New("never asked")}
+	if _, err := deliver(t.Context(), none, "", nil); err != nil || len(none.did) != 0 {
+		t.Fatalf("an empty send granted or failed: %v %v", none.did, err)
+	}
+}
+
+// Whether the bus's machine goes first is read from the user list alone, by its digest.
+func TestTheBusMachineIsBehindByItsUserListAlone(t *testing.T) {
+	list := "users: [a, b]"
+	if userListBehind(list, digestOf([]byte(list))) {
+		t.Fatal("the list it was sent reads as behind")
+	}
+	if !userListBehind(list, digestOf([]byte("users: [a]"))) || !userListBehind(list, "") {
+		t.Fatal("a changed or never-sent list reads as current")
+	}
+	if userListBehind("", "") {
+		t.Fatal("a machine sent no list reads as behind")
+	}
+}
+
+// The machine holding the bus goes first: its declaration carries the user list the new grants are
+// checked against. Among the machines it is moved to the front; not among them it is added only
+// when it is behind.
+func TestTheMachineHoldingTheBusIsSentFirst(t *testing.T) {
+	for _, c := range []struct {
+		what   string
+		names  []string
+		holder string
+		behind bool
+		want   []string
+	}{
+		{"among them", []string{"ace", "g14", "novox"}, "novox", false, []string{"novox", "ace", "g14"}},
+		{"not among them, behind", []string{"ace", "g14"}, "novox", true, []string{"novox", "ace", "g14"}},
+		{"not among them, current", []string{"ace", "g14"}, "novox", false, []string{"ace", "g14"}},
+		{"nothing holds the bus", []string{"ace", "g14"}, "", true, []string{"ace", "g14"}},
+		{"only it", []string{"novox"}, "novox", false, []string{"novox"}},
+	} {
+		if got := brokerFirst(c.names, c.holder, c.behind); !reflect.DeepEqual(got, c.want) {
+			t.Errorf("%s: sent in the order %v, wanted %v", c.what, got, c.want)
+		}
+	}
+}

cmd/mesh-controller/delivery_test.go

@@ -0,0 +1,390 @@
+package main
+
+import (
+	"encoding/json"
+	"reflect"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/nats-io/nats.go"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+	"github.com/novox/mesh-controller/internal/testbus"
+)
+
+// novox/hq ADR 0239 decision 4: a group's order, from the graph and the pull requests, the same on every
+// reading — the build agent before what it builds, the controller before a manifest that needs it, the
+// node-engine before the controller, a declared `after:` — and a contradiction named, never ordered.
+func TestAGroupIsOrderedByTheGraphAndWhatItsPullRequestsSay(t *testing.T) {
+	members := []orderMember{
+		{ID: "cat", Repository: "novox/mesh-catalog"},
+		{ID: "ctl", Repository: "novox/mesh-controller"},
+		{ID: "host", Repository: "novox/mesh-host"},
+		{ID: "agent", Repository: "novox/build-agent"},
+		{ID: "app", Repository: "novox/app", After: []string{"lab"}},
+		{ID: "lab", Repository: "novox/lab"},
+	}
+	reach := map[string]orderReach{
+		"cat":   {Moved: []string{"gitea"}, Manifests: []string{"modules/gitea/module.json"}},
+		"ctl":   {Moved: []string{"mesh-controller"}, Manifests: []string{"module.json"}},
+		"host":  {Moved: []string{"mesh-host"}, Manifests: []string{"module.json"}},
+		"agent": {Moved: []string{"build-agent"}},
+		"app":   {Moved: []string{"app"}},
+		"lab":   {Moved: []string{"lab"}},
+	}
+	edges := []inventory.Edge{{From: "app", To: "build-agent", Kind: inventory.EdgeBuiltBy},
+		{From: "gitea", To: "postgres", Kind: inventory.EdgeDeclared}}
+	got := orderOf(members, reach, edges)
+	if len(got.Cycle) > 0 {
+		t.Fatalf("a cycle where there is none: %v", got.Cycle)
+	}
+	// By repository among those with nothing before them: the build agent, the lab, then what waited on both.
+	want := []string{"agent", "lab", "app", "host", "ctl", "cat"}
+	if !reflect.DeepEqual(got.Order, want) {
+		t.Fatalf("ordered %v, wanted %v; pairs %+v", got.Order, want, got.Pairs)
+	}
+	why := map[string]string{}
+	for _, p := range got.Pairs {
+		why[p.Before+">"+p.After] = p.Why
+	}
+	for pair, reason := range map[string]string{"host>ctl": orderEngineFirst, "ctl>cat": orderVersionSkew,
+		"ctl>host": "", "agent>app": orderBuiltBy, "lab>app": orderDeclared} {
+		if why[pair] != reason {
+			t.Errorf("%s is ordered %q, wanted %q", pair, why[pair], reason)
+		}
+	}
+	// The same members in another order read the same.
+	shuffled := []orderMember{members[5], members[3], members[0], members[4], members[2], members[1]}
+	if again := orderOf(shuffled, reach, edges); !reflect.DeepEqual(again.Order, want) {
+		t.Fatalf("another reading ordered %v", again.Order)
+	}
+
+	// A declared order against an inferred one wins (novox/hq ADR 0249), and the pair says what it won over.
+	members[1].After = []string{"mesh-catalog"}
+	got = orderOf(members, reach, edges)
+	if len(got.Cycle) > 0 || len(got.Contradictions) > 0 {
+		t.Fatalf("a declared order did not win: cycle %v, %+v", got.Cycle, got.Contradictions)
+	}
+	if want := []string{"agent", "lab", "app", "cat", "host", "ctl"}; !reflect.DeepEqual(got.Order, want) {
+		t.Fatalf("ordered %v, wanted %v", got.Order, want)
+	}
+	if !slices.ContainsFunc(got.Pairs, func(p orderPair) bool {
+		return p.Before == "cat" && p.After == "ctl" && p.Why == orderDeclared && reflect.DeepEqual(p.Over, []string{orderVersionSkew})
+	}) || slices.ContainsFunc(got.Pairs, func(p orderPair) bool { return p.Before == "ctl" && p.After == "cat" }) {
+		t.Fatalf("the declared pair does not say it won over version skew: %+v", got.Pairs)
+	}
+
+	// Declared both ways is a contradiction no precedence resolves: a cycle, and how to end it.
+	members[0].After = []string{"novox/mesh-controller"}
+	got = orderOf(members, reach, edges)
+	if !reflect.DeepEqual(got.Cycle, []string{"cat", "ctl"}) || len(got.Contradictions) != 1 {
+		t.Fatalf("the cycle is %v, ordered %v, contradictions %+v", got.Cycle, got.Order, got.Contradictions)
+	}
+	if c := got.Contradictions[0]; !reflect.DeepEqual(c.Members, []string{"cat", "ctl"}) ||
+		!strings.Contains(c.Said, "remove one of the `after:` lines") {
+		t.Fatalf("the contradiction is said %+v", c)
+	}
+}
+
+// novox/hq ADR 0249: when two rules order one pair both ways, the rule of higher precedence wins and the
+// pair says what it overruled; rules of one rank both ways are refused, naming both and how to declare.
+func TestAnOrderRuleYieldsToAStrongerOne(t *testing.T) {
+	members := []orderMember{
+		{ID: "ctl", Repository: "novox/mesh-controller", Number: 7},
+		{ID: "host", Repository: "novox/mesh-host", Number: 9},
+	}
+	reach := map[string]orderReach{
+		"ctl":  {Moved: []string{"mesh-controller", "build-agent"}},
+		"host": {Moved: []string{"mesh-host"}},
+	}
+	builtBy := []inventory.Edge{{From: "mesh-host", To: "build-agent", Kind: inventory.EdgeBuiltBy}}
+
+	// Built by outranks engine before controller.
+	got := orderOf(members, reach, builtBy)
+	if !reflect.DeepEqual(got.Order, []string{"ctl", "host"}) || len(got.Cycle) > 0 {
+		t.Fatalf("ordered %v, cycle %v", got.Order, got.Cycle)
+	}
+	if want := []orderPair{{Before: "ctl", After: "host", Why: orderBuiltBy, Over: []string{orderEngineFirst}}}; !reflect.DeepEqual(got.Pairs, want) {
+		t.Fatalf("pairs %+v, wanted %+v", got.Pairs, want)
+	}
+
+	// A declared line outranks both.
+	members[0].After = []string{"mesh-host"}
+	got = orderOf(members, reach, builtBy)
+	if !reflect.DeepEqual(got.Order, []string{"host", "ctl"}) || len(got.Cycle) > 0 ||
+		!reflect.DeepEqual(got.Pairs[0].Over, []string{orderBuiltBy}) || got.Pairs[0].Why != orderDeclared {
+		t.Fatalf("a declared order did not win: %v %+v", got.Order, got.Pairs)
+	}
+
+	// Without the build agent, engine before controller stands alone.
+	members[0].After = nil
+	got = orderOf(members, map[string]orderReach{"ctl": {Moved: []string{"mesh-controller"}}, "host": reach["host"]}, builtBy)
+	if !reflect.DeepEqual(got.Order, []string{"host", "ctl"}) || got.Pairs[0].Why != orderEngineFirst || len(got.Pairs[0].Over) > 0 {
+		t.Fatalf("engine before controller alone: %v %+v", got.Order, got.Pairs)
+	}
+
+	// Built by both ways is one rank against itself: refused, both rules named, and how to declare.
+	both := append(builtBy, inventory.Edge{From: "build-agent", To: "mesh-host", Kind: inventory.EdgeStandsOn})
+	got = orderOf(members, reach, both)
+	if !reflect.DeepEqual(got.Cycle, []string{"ctl", "host"}) || len(got.Order) > 0 || len(got.Contradictions) != 1 {
+		t.Fatalf("a contradiction was ordered: %v, cycle %v, %+v", got.Order, got.Cycle, got.Contradictions)
+	}
+	said := got.Contradictions[0].Said
+	for _, w := range []string{"built by puts ctl first", "built by puts host first",
+		"`after: novox/mesh-controller` in novox/mesh-host#9's description", "`after: novox/mesh-host` in novox/mesh-controller#7's"} {
+		if !strings.Contains(said, w) {
+			t.Errorf("the contradiction does not say %q: %s", w, said)
+		}
+	}
+}
+
+// novox/hq ADR 0239 decision 8: a walk waits for the delivery's owner only while the seat has a holder on
+// record, and never one that moves a module on the controller's own path.
+func TestAWalkWaitsOnlyWhileTheDeliverySeatIsHeldAndNeverForTheCore(t *testing.T) {
+	holder := inventory.Entry{Manifest: catalogue.Manifest{Module: "mesh-delivery",
+		Claims: []catalogue.Claim{{Name: catalogue.DeliverySeat, Scope: catalogue.ScopeMesh}}}, On: []string{"anchor"}}
+	unassigned := holder
+	unassigned.On = nil
+	for _, c := range []struct {
+		entries []inventory.Entry
+		moved   []string
+		waits   bool
+	}{
+		{nil, []string{"gitea"}, false},
+		{[]inventory.Entry{unassigned}, []string{"gitea"}, false},
+		{[]inventory.Entry{holder}, []string{"gitea", "plex"}, true},
+		{[]inventory.Entry{holder}, []string{"gitea", "mesh-controller"}, false},
+		{[]inventory.Entry{holder}, []string{"mesh-host"}, false},
+		{[]inventory.Entry{holder}, []string{"node-tools"}, false},
+		{[]inventory.Entry{holder}, []string{"nats"}, false},
+		{[]inventory.Entry{holder}, []string{"mesh-delivery", "gitea"}, false},
+	} {
+		d := awaitsFor(c.entries, c.moved)
+		if (d != nil) != c.waits {
+			t.Errorf("held %v, moving %v: waits %v, wanted %v", len(c.entries) > 0 && len(c.entries[0].On) > 0,
+				c.moved, d != nil, c.waits)
+		}
+		if d != nil && d.Awaits != catalogue.DeliverySeat {
+			t.Errorf("waits for %q", d.Awaits)
+		}
+	}
+}
+
+// novox/hq ADR 0239: with mesh-delivery on record, a merge opens its walk and asks nothing until the
+// delivery's word; the word starts it; the core's own merge never waits; a person starts a waiting walk by
+// hand when the owner is down, and the owner's stop ends one as stopped.
+func TestAMergeWaitsForItsDeliverysWordAndThePersonsWordWorksWithoutIt(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	asked := asksRecorded(t)
+	withConditionsInMemory(t)
+	for _, name := range []string{"app", "mesh-delivery"} {
+		m := catalogue.Manifest{Module: name, Version: "1"}
+		if name == "mesh-delivery" {
+			m.Claims = []catalogue.Claim{{Name: catalogue.DeliverySeat, Scope: catalogue.ScopeMesh}}
+		}
+		if err := inv.RegisterModule(ctx, m, inventory.Source{Repository: "novox/mesh-catalog", Seat: "git",
+			Path: "modules/" + name, Ref: "main", BuiltFrom: "c0", Head: "c0"}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	merge := func(commit string, paths ...string) inventory.Plan {
+		t.Helper()
+		m := link.SourceMoved{Owner: "novox", Repo: "mesh-catalog", Base: "main", Commit: commit, Paths: paths,
+			ModuleDirs: []string{"modules/app", "modules/mesh-delivery"}, ModuleDirsSaid: true}
+		if err := (following{open: open}).SourceMoved(ctx, m); err != nil {
+			t.Fatal(err)
+		}
+		recent, err := inv.RecentPlans(ctx, 1)
+		if err != nil || len(recent) != 1 || recent[0].Commit != commit {
+			t.Fatalf("no plan for %s: %v %v", commit, recent, err)
+		}
+		return recent[0]
+	}
+
+	// finish ends a walk as done, so the next merge has nothing of it to take over.
+	finish := func(id string) {
+		t.Helper()
+		w, err := inv.PlanByID(ctx, id)
+		if err != nil {
+			t.Fatal(err)
+		}
+		w.State = inventory.PlanDone
+		if err := inv.SavePlan(ctx, &w); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	// No holder on record: the merge starts its walk, as before.
+	p := merge("c1aaaaaaaa", "modules/app/index.ts")
+	if p.Waiting() || len(*asked) != 1 {
+		t.Fatalf("with no holder on record the walk waited (%v) or asked %v", p.Waiting(), *asked)
+	}
+
+	// The holder on record: the next merge waits, asking nothing, and an advance asks nothing either.
+	if _, err := inv.Assign(ctx, "anchor", "mesh-delivery"); err != nil {
+		t.Fatal(err)
+	}
+	p = merge("c2bbbbbbbb", "modules/app/index.ts")
+	if !p.Waiting() || len(*asked) != 1 || !strings.Contains(p.Note, "plans go "+p.ID) {
+		t.Fatalf("the walk did not wait for its word: waiting %v, asked %v, note %q", p.Waiting(), *asked, p.Note)
+	}
+	advanceHeld(ctx, open)
+	if len(*asked) != 1 {
+		t.Fatalf("a waiting walk was advanced into asking: %v", *asked)
+	}
+	if line := planLine(p, p.Created); strings.Contains(line, "LATE") || !strings.Contains(line, "waits for") {
+		t.Errorf("a waiting walk reads %q", line)
+	}
+
+	// The delivery's word starts it.
+	if err := deliveryCommand(ctx, []string{"go", p.ID, "--by", catalogue.DeliverySeat, "--why", "its turn"}); err != nil {
+		t.Fatal(err)
+	}
+	if err := deliveryCommand(ctx, []string{"go", p.ID}); err == nil {
+		t.Fatal("a walk was let go twice")
+	}
+	advanceHeld(ctx, open)
+	if len(*asked) != 2 {
+		t.Fatalf("the word did not start the walk: %v", *asked)
+	}
+	got, err := inv.PlanByID(ctx, p.ID)
+	if err != nil || got.Delivery == nil || got.Delivery.By != catalogue.DeliverySeat || got.Delivery.Why != "its turn" {
+		t.Fatalf("the word was not kept: %+v %v", got.Delivery, err)
+	}
+
+	// The delivery's owner's own merge never waits for it — and takes over what the older walk had not
+	// built (app, folded in: ADR 0218), which goes with it on the controller's own path.
+	p = merge("c3cccccccc", "modules/mesh-delivery/main.go")
+	if p.Waiting() || len(*asked) != 4 {
+		t.Fatalf("mesh-delivery's own walk waited for mesh-delivery: %v %v", p.Waiting(), *asked)
+	}
+
+	// The owner down: a person starts a waiting walk, with why.
+	finish(p.ID)
+	p = merge("c4dddddddd", "modules/app/index.ts")
+	if !p.Waiting() {
+		t.Fatal("the walk did not wait")
+	}
+	if err := plansCommand(ctx, []string{"go", p.ID}); err == nil || !strings.Contains(err.Error(), "--why") {
+		t.Fatalf("a walk was started by hand without why: %v", err)
+	}
+	if err := plansCommand(ctx, []string{"go", p.ID, "--why", "mesh-delivery is down"}); err != nil {
+		t.Fatal(err)
+	}
+	advanceHeld(ctx, open)
+	got, _ = inv.PlanByID(ctx, p.ID)
+	if got.Waiting() || !strings.HasPrefix(got.Delivery.By, "a person") || len(*asked) < 5 {
+		t.Fatalf("a person's word did not start the walk: %+v, asked %v", got.Delivery, *asked)
+	}
+
+	// The owner's stop: failed, said as stopped by it.
+	finish(p.ID)
+	p = merge("c5eeeeeeee", "modules/app/index.ts")
+	if err := deliveryCommand(ctx, []string{"stop", p.ID, "--why", "the operator stopped it", "--by",
+		"mesh-delivery for jochen"}); err != nil {
+		t.Fatal(err)
+	}
+	got, _ = inv.PlanByID(ctx, p.ID)
+	if got.State != inventory.PlanFailed || got.Delivery.Stopped != "mesh-delivery for jochen" ||
+		!strings.Contains(got.Note, "the operator stopped it") {
+		t.Fatalf("the stop was kept as %s %+v %q", got.State, got.Delivery, got.Note)
+	}
+
+	// Unassigned: the mesh is back on the controller's own path.
+	if err := inv.Unassign(ctx, "anchor", "mesh-delivery"); err != nil {
+		t.Fatal(err)
+	}
+	asks := len(*asked)
+	if p = merge("c6ffffffff", "modules/app/index.ts"); p.Waiting() || len(*asked) != asks+1 {
+		t.Fatalf("with the holder gone the walk waited: %v", p.Waiting())
+	}
+}
+
+// The verbs mesh-delivery asks with become the commands they name, and nothing a caller sends is passed over.
+func TestTheDeliveryVerbsComposeTheirCommands(t *testing.T) {
+	for _, c := range []struct {
+		verb string
+		args map[string]any
+		want []string
+	}{
+		{"deliver", map[string]any{"plan": "plan-1", "why": "its turn"},
+			[]string{"delivery", "go", "plan-1", "--by", "mesh-delivery", "--why", "its turn"}},
+		{"delivery-stop", map[string]any{"plan": "plan-1", "why": "w", "by": "jochen"},
+			[]string{"delivery", "stop", "plan-1", "--why", "w", "--by", "mesh-delivery for jochen"}},
+		{"delivery-walks", map[string]any{}, []string{"delivery", "walks"}},
+		{"delivery-walks", map[string]any{"plan": "plan-1"}, []string{"delivery", "walks", "--plan", "plan-1"}},
+		{"delivery-order", map[string]any{"members": "[]"}, []string{"delivery", "order", "--members", "[]"}},
+		{"delivery-check", map[string]any{"group": "feat/x", "members": "[]"},
+			[]string{"delivery", "check", "--group", "feat/x", "--members", "[]"}},
+		{"delivery-plan", map[string]any{"repository": "novox/a", "paths": "x", "head": "c0"},
+			[]string{"delivery", "plan", "--repository", "novox/a", "--paths", "x", "--head", "c0"}},
+		{"plans", map[string]any{"go": "plan-1", "why": "down"}, []string{"plans", "go", "plan-1", "--why", "down"}},
+	} {
+		got, err := argvFor(c.verb, c.args)
+		if err != nil || !reflect.DeepEqual(got, c.want) {
+			t.Errorf("%s %v → %v %v, wanted %v", c.verb, c.args, got, err, c.want)
+		}
+	}
+	if _, err := argvFor("deliver", map[string]any{}); err == nil {
+		t.Error("deliver without a walk was composed")
+	}
+	if _, err := argvFor("delivery-stop", map[string]any{"plan": "p"}); err == nil {
+		t.Error("a stop without why was composed")
+	}
+}
+
+// A verb runs as a command of its own: what it keeps of a walk is still said as plan-moved, on a bus of the
+// command's own, so the delivery's owner hears it at once and not only when it reads the walks back.
+func TestAWalkLetGoByAVerbIsSaidAsPlanMoved(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	url := testbus.URL(t)
+	js, err := broker.Dial(url)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(js.Close)
+	if err := broker.AssertMeshStreams(js); err != nil {
+		t.Fatal(err)
+	}
+	before := handActConn
+	handActConn = js.Conn()
+	t.Cleanup(func() { handActConn = before })
+	heard := make(chan *nats.Msg, 4)
+	sub, err := js.Conn().ChanSubscribe(link.SeatEventSubject(link.MeshControllerSeat, link.KeyPlanMoved), heard)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = sub.Unsubscribe() })
+
+	waiting := inventory.Plan{ID: "plan-waits", Repository: "novox/mesh-catalog", Branch: "main", Commit: "c7c7c7c7",
+		Created: time.Now().UTC(), State: inventory.PlanBuilding, Tiers: [][]string{{"app"}},
+		Modules:  map[string]*inventory.PlanModule{"app": {}},
+		Delivery: &inventory.PlanDelivery{Awaits: catalogue.DeliverySeat}}
+	if err := open.inventory.SavePlan(ctx, &waiting); err != nil {
+		t.Fatal(err)
+	}
+	if err := deliveryCommand(ctx, []string{"go", waiting.ID, "--why", "its turn"}); err != nil {
+		t.Fatal(err)
+	}
+	select {
+	case m := <-heard:
+		var said inventory.Plan
+		if err := json.Unmarshal(m.Data, &said); err != nil || said.ID != waiting.ID || said.Delivery == nil ||
+			said.Delivery.Go == nil {
+			t.Fatalf("plan-moved said %s (%v)", m.Data, err)
+		}
+	case <-time.After(5 * time.Second):
+		t.Fatal("a walk let go by a verb was not said")
+	}
+	if checkEvents != nil || inventory.PlanSaved != nil {
+		t.Fatal("the command's own bus was left in place")
+	}
+}

cmd/mesh-controller/doctor.go

@@ -0,0 +1,678 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"sort"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/nats-io/nats.go"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// The self-check: `doctor` (novox/hq to-be 45 §4, ADR 0227 rule 6).
+//
+// **The design's invariants, run against the running mesh.** A probe is one live invariant of a
+// design — every machine's declaration composes and validates, every resolver answers, every seat's
+// holder answers, every stream and consumer is there as defined — with an id, a bound, and the
+// condition it raises when the invariant does not hold. The serving controller runs the registry every
+// five minutes, each probe given thirty seconds; a probe that errors or does not finish raises
+// `probe-failed` for itself, because an unanswered probe is never a pass. Every run ends with a
+// heartbeat on the bus (`doctor-heartbeat`, S10), which mesh-watcher listens for from a second
+// machine: a controller that stops checking is itself said, through a channel that does not pass
+// through it.
+//
+// `doctor` answers the last run's verdict at once; `doctor run` runs now; `doctor probes` lists the
+// registry; `doctor signals` says, for every row of the signals table, the age of its newest signal.
+
+// The self-check's clocks.
+var (
+	// doctorEvery is how often the registry runs; doctorFirstAfter how long after the controller
+	// starts the first run waits, so what the controller hears at its start has arrived.
+	doctorEvery      = 5 * time.Minute
+	doctorFirstAfter = time.Minute
+	// probeWithin is each probe's bound.
+	probeWithin = 30 * time.Second
+)
+
+// The verdicts a probe can have.
+const (
+	verdictPass        = "pass"
+	verdictFail        = "fail"
+	verdictFailedToRun = "failed-to-run"
+	verdictDeferred    = "deferred"
+)
+
+// probe is one live invariant.
+type probe struct {
+	ID      string
+	Asserts string
+	From    string
+	// Kind is the condition kind raised when the invariant does not hold.
+	Kind string
+	// Raises are the other kinds its findings carry, each its own (a consumer missing, one far behind):
+	// what a healer may be registered against (healers.go).
+	Raises []string
+	Phase  int
+	// Deferred says why it is not run yet; empty for one that is.
+	Deferred string
+	// Asks are the seat verbs it calls. A probe may call no other (askSeatTool refuses), and the
+	// controller's grant names every one (a test over this registry): a probe whose question the bus
+	// refuses checks nothing (D8, 2026-10-06).
+	Asks []broker.SeatVerb
+	run  func(ctx context.Context, d *doctor) ([]conditions.Observation, error)
+}
+
+// probeRegistry is the registry, in to-be 45's order. **The registry is the design's live form**: a
+// probe added to a design is a row added here.
+var probeRegistry = []probe{
+	{ID: "D1", Asserts: "every machine's declaration composes, and passes the node-engine's validation",
+		From: "issues 236, 263, 275", Kind: "declaration-refused", Raises: []string{kindAwaitingPush}, Phase: 1,
+		run: probeDeclarations},
+	{ID: "D2", Asserts: "every holder of the mesh's resolver answers a machine name for IPv4, and NODATA for IPv6",
+		From: "issue 262", Kind: "resolver-wrong", Phase: 1, run: probeResolvers},
+	{ID: "D3", Asserts: "every seat on record that serves verbs has a live holder that answers, on every " +
+		"machine that is heard from", From: "issues 208, 218", Kind: "holder-silent", Phase: 1, run: probeHolders},
+	{ID: "D4", Asserts: "every kept archive is held by a manifest", From: "issue 253",
+		Kind: "archives-unheld", Phase: 1, run: probeArchives},
+	{ID: "D5", Asserts: "exactly one lease holder — the key names this controller at its epoch, and the record " +
+		"holds no other epoch open; no message from a stale epoch refused in the last interval",
+		From: "issue 204", Kind: "lease-split", Phase: 2, run: probeLease},
+	{ID: "D6", Asserts: "every durable consumer the mesh expects exists with its definition, and is near its " +
+		"stream's head", From: "issues 248, 266", Kind: "consumer-wrong", Raises: []string{"consumer-lost", kindConsumerBehind},
+		Phase: 1, run: probeConsumers},
+	{ID: "D7", Asserts: "every stream the controller defines exists with its definition, and its own buckets",
+		From: "issue 208", Kind: "stream-wrong", Phase: 1, run: probeStreams},
+	{ID: "D8", Asserts: "no address the mesh owns — a machine's private address or its endpoint — is in a ban list",
+		From: "issue 238", Kind: "own-address-banned", Phase: 1, run: probeBans,
+		Asks: []broker.SeatVerb{{Seat: "node-intrusion-prevention", Verb: "banned"}}},
+	{ID: "D9", Asserts: "status answers in full within ten seconds, from a summary composed lately",
+		From: "issue 265", Kind: "status-slow", Phase: 1, run: probeStatus},
+	{ID: "D10", Asserts: "every machine runs the node-engine and node tools builds the mesh holds, or is inside " +
+		"a plan's window", From: "the version split", Kind: "core-behind", Phase: 1, run: probeCoreBuilds},
+	{ID: "D11", Asserts: "no provider holds a consumer retired more than thirty days without a person deciding " +
+		"its cleanup", From: "ADR 0230", Kind: kindCleanupWaiting, Phase: 2, run: probeRetired},
+	{ID: probeBindingsID, Asserts: "every consumer of a provision that keeps its data is bound where it was last " +
+		"sent, or moves by a pin", From: "issue 273, ADR 0232", Kind: kindBindingMoved,
+		Raises: []string{kindBindingKept, kindBindingMoving}, Phase: 2, run: probeBindings},
+	{ID: probeDataID, Asserts: "every item of data a machine declares is measured, is there, holds what it held, is " +
+		"written where it should be, is backed up within its bound or sits on healthy redundant storage, and is no " +
+		"empty replacement of a copy kept elsewhere; what a machine no longer declares that is irreplaceable or " +
+		"valuable is retired, not forgotten", From: "issue 273, ADR 0233",
+		Kind: kindDataShrank, Raises: []string{kindEmptyReplacement, kindDataHeldTwice, kindDataQuiet, kindBackupStale,
+			kindDataUnmeasured, kindDataMissing, kindArrayDegraded, kindProtectionMissing, kindCleanupWaiting},
+		Phase: 2, run: probeData,
+		Asks: []broker.SeatVerb{{Seat: "node-backup", Verb: "backed-up"}}},
+	// The delivery's owner (novox/hq ADR 0239): what it holds past a bound of its own table is said here, by
+	// the controller, and H2 works it through the owner's `close`.
+	{ID: probeDeliveriesID, Asserts: "no delivery is held past its state's bound unsaid: mesh-delivery's " +
+		"`stalled`, each with the transition its table lets healer H2 take", From: "ADR 0239",
+		Kind: kindDeliveryStalled, Phase: 3, run: probeDeliveries},
+	// A client of the bus reconnecting in a loop (novox/hq issue 327), from the server's record of closed
+	// connections, which the bus's own module reads.
+	{ID: probeReconnectsID, Asserts: "no user of the bus had its connection dropped more than twelve times in the " +
+		"last hour: the bus module's nats_closed_connections", From: "issue 327", Kind: kindBusReconnects,
+		Phase: 1, run: probeReconnects},
+	// The account agents run as (novox/hq ADR 0266): where a machine names one, its node-engine has judged it
+	// unable to become root without a person — what ADR 0259 §8 rests an authorised answer on.
+	{ID: agentAccountProbe, Asserts: "every machine that names an agent account has it judged, on its node-engine's " +
+		"newest statement, unable to become root without a person", From: "ADR 0266, ADR 0259 §8",
+		Kind: kindAgentCanBecomeRoot, Phase: 1, run: probeAgentAccounts},
+	// Root where the trusted parties run (novox/hq ADR 0259 §8): while an agent can become root there without a
+	// person, an answer proven there proves nothing.
+	{ID: "D-root", Asserts: "no agent can become root without a person on a machine where the router or a channel " +
+		"proving its sender runs: not by its own account, and not through a tool that runs its command as an account " +
+		"that can", From: "ADR 0259 §8", Kind: kindRootNotFree, Phase: 2, run: probeAgentRoot},
+	{ID: "DW", Asserts: "the watchdogs of the signals table ran within three of their intervals",
+		From: "ADR 0227 rule 6: the watchers are watched", Kind: "watchdogs-silent", Phase: 1, run: probeWatchdogs},
+	// The core's health definitions (novox/hq to-be 45 §8, ADR 0236): what a core component's new build is
+	// judged by on its first machine, run against every machine between upgrades too.
+	{ID: "H-controller", Asserts: "the controller lease is held, renewed in time, by a controller that says it is " +
+		"ready: its self-check ran and status answered in full within ten seconds", From: "ADR 0236, to-be 45 §8",
+		Kind: kindCoreUnhealthy, Phase: 4, run: probeControllerHealth},
+	{ID: "H-engine", Asserts: "every machine heard from has reported its current declaration, under a node-engine " +
+		"build it names", From: "ADR 0236, to-be 45 §8", Kind: kindCoreUnhealthy, Phase: 4, run: probeEngineHealth},
+	{ID: "H-tools", Asserts: "every machine heard from that runs the node tools has them answering the bus",
+		From: "ADR 0236, to-be 45 §8", Kind: kindCoreUnhealthy, Phase: 4, run: probeToolsHealth},
+	{ID: "H-bus", Asserts: "every stream and durable consumer the mesh defines is on the bus, and a request crosses " +
+		"it to the machines' node tools and back", From: "ADR 0236, to-be 45 §8", Kind: kindCoreUnhealthy, Phase: 4,
+		run: probeBusHealth},
+	// The gate's verdicts and the witnesses' rollbacks (ADR 0236): each build that failed its gate keeps its
+	// condition until a newer build passes; each rollback a witness stands by is said.
+	{ID: gateProbe, Asserts: "no build that failed its gate, and no core component a witness put back, goes unsaid; " +
+		"a newer build that passes its gate clears it", From: "ADR 0236, to-be 45 §8", Kind: kindRolledBack,
+		Raises: []string{kindRollbackFailed}, Phase: 4, run: probeGates},
+	// The bus's planned step (ADR 0236): open while a person's bus upgrade runs, then checked by H-bus.
+	{ID: busStepProbe, Asserts: "a bus upgrade a person started is said while it runs, and is followed by the bus's " +
+		"health within its bound — or is said failed, with its snapshot as the way back", From: "ADR 0236, to-be 45 §8",
+		Kind: kindBusMaintenance, Raises: []string{kindBusUpgradeFailed}, Phase: 4, run: probeBusStep},
+}
+
+// probeVerdict is one probe's outcome in a run.
+type probeVerdict struct {
+	ID      string   `json:"id"`
+	Verdict string   `json:"verdict"`
+	Found   []string `json:"found,omitempty"`
+	// Unconfirmed are findings one look can be wrong about, seen by this run and not the one before:
+	// raised if the next run sees them too (confirm.go). Not a pass, and not yet a condition.
+	Unconfirmed []string `json:"unconfirmed,omitempty"`
+	Error       string   `json:"error,omitempty"`
+	Took        string   `json:"took,omitempty"`
+	// FoundCount and More are an overview's: how many findings the probe had when the overview shows
+	// fewer, and how to read them all (novox/hq issue 314). Never in a heartbeat.
+	FoundCount int    `json:"found-count,omitempty"`
+	More       string `json:"more,omitempty"`
+}
+
+// overviewFindings is how many findings of one probe an overview carries. On 2026-10-08 D14 found 689
+// stalled deliveries, and an overview carrying every one of them, beside the conditions they raised,
+// was more than the bus carries in one message (novox/hq issue 314); one probe's verdict whole is
+// `doctor probe=<id>`.
+const overviewFindings = 20
+
+// inOverview is a run as an overview carries it: each probe's findings at most overviewFindings, with
+// their count and how to read them all. The run itself is not changed.
+func inOverview(run doctorRun) doctorRun {
+	probes := make([]probeVerdict, len(run.Probes))
+	for i, p := range run.Probes {
+		total := len(p.Found) + len(p.Unconfirmed)
+		if total > overviewFindings {
+			p.FoundCount = len(p.Found)
+			if len(p.Found) > overviewFindings {
+				p.Found = p.Found[:overviewFindings:overviewFindings]
+			}
+			if room := overviewFindings - len(p.Found); len(p.Unconfirmed) > room {
+				p.Unconfirmed = p.Unconfirmed[:room:room]
+			}
+			p.More = fmt.Sprintf("%d found and %d unconfirmed, %d of them shown — `doctor probe=%s` gives them all",
+				p.FoundCount, total-p.FoundCount, len(p.Found)+len(p.Unconfirmed), p.ID)
+		}
+		probes[i] = p
+	}
+	run.Probes = probes
+	return run
+}
+
+// oneProbe is a run with only one probe's verdict, whole.
+func oneProbe(run doctorRun, id string) (doctorRun, error) {
+	for _, p := range run.Probes {
+		if strings.EqualFold(p.ID, id) {
+			run.Probes = []probeVerdict{p}
+			return run, nil
+		}
+	}
+	return doctorRun{}, fmt.Errorf("the run %s has no probe %q — `doctor probes=true` lists them", run.Run, id)
+}
+
+// doctorCounts are a run's verdicts, counted.
+type doctorCounts struct {
+	Passed      int `json:"passed"`
+	Failed      int `json:"failed"`
+	FailedToRun int `json:"failed-to-run"`
+	Deferred    int `json:"deferred"`
+}
+
+// doctorRun is one run of the registry, and the body of its heartbeat.
+type doctorRun struct {
+	Run             string         `json:"run"`
+	At              time.Time      `json:"at"`
+	Started         time.Time      `json:"started"`
+	Took            string         `json:"took"`
+	IntervalSeconds int            `json:"interval-seconds"`
+	Counts          doctorCounts   `json:"counts"`
+	Probes          []probeVerdict `json:"probes"`
+	// Controller is the machine that ran it, and Why what started it: the schedule, or a person.
+	Controller string `json:"controller"`
+	Why        string `json:"why"`
+	// Unsaid is how many condition transitions this controller could not say, since it started.
+	Unsaid int `json:"unsaid,omitempty"`
+}
+
+// doctor is the registry and what its probes need.
+type doctor struct {
+	open      *stores
+	js        *broker.JetStream
+	keeper    *conditions.Keeper
+	teller    conditions.Teller
+	watchdogs *watchdogs
+	host      string
+	// confirm holds back what one run alone saw of a finding a single look can be wrong about.
+	confirm confirming
+
+	running sync.Mutex
+	mu      sync.Mutex
+	last    *doctorRun
+	ended   time.Time
+}
+
+// lastRunEnded is when the last run ended; zero before the first.
+func (d *doctor) lastRunEnded() time.Time {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	return d.ended
+}
+
+// lastRun is the last run's verdict; nil before the first.
+func (d *doctor) lastRun() *doctorRun {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	return d.last
+}
+
+// keep runs the registry on its schedule until ctx ends.
+func (d *doctor) keep(ctx context.Context) {
+	select {
+	case <-ctx.Done():
+		return
+	case <-time.After(doctorFirstAfter):
+	}
+	tick := time.NewTicker(doctorEvery)
+	defer tick.Stop()
+	for {
+		// Only the controller acting checks the mesh on a schedule: one standing by would say a
+		// heartbeat for a self-check that is not the mesh's.
+		if d.watchdogs == nil || d.watchdogs.acting == nil || d.watchdogs.acting() {
+			d.runOnce(ctx, "the schedule")
+		}
+		select {
+		case <-ctx.Done():
+			return
+		case <-tick.C:
+		}
+	}
+}
+
+var doctorRuns struct {
+	sync.Mutex
+	n uint64
+}
+
+// runOnce runs every probe the registry runs, keeps what each found, and says the heartbeat. One run
+// at a time: a person's `doctor run` during a scheduled one waits for it.
+func (d *doctor) runOnce(ctx context.Context, why string) doctorRun {
+	d.running.Lock()
+	defer d.running.Unlock()
+	doctorRuns.Lock()
+	doctorRuns.n++
+	n := doctorRuns.n
+	doctorRuns.Unlock()
+	started := time.Now()
+	run := doctorRun{Run: fmt.Sprintf("doctor-%d-%d", started.Unix(), n), Started: started.UTC(),
+		IntervalSeconds: int(doctorEvery / time.Second), Controller: d.host, Why: why}
+
+	type result struct {
+		obs  []conditions.Observation
+		err  error
+		took time.Duration
+	}
+	results := make([]result, len(probeRegistry))
+	var wg sync.WaitGroup
+	for i, p := range probeRegistry {
+		if p.run == nil {
+			continue
+		}
+		wg.Add(1)
+		go func(i int, p probe) {
+			defer wg.Done()
+			probing, cancel := context.WithTimeout(context.WithValue(ctx, probeAsksKey{}, p), probeWithin)
+			defer cancel()
+			began := time.Now()
+			done := make(chan result, 1)
+			go func() {
+				defer func() {
+					if r := recover(); r != nil {
+						done <- result{err: fmt.Errorf("the probe panicked: %v", r)}
+					}
+				}()
+				obs, err := p.run(probing, d)
+				done <- result{obs: obs, err: err}
+			}()
+			select {
+			case r := <-done:
+				r.took = time.Since(began)
+				results[i] = r
+			case <-probing.Done():
+				results[i] = result{err: fmt.Errorf("it did not finish within %s", probeWithin), took: time.Since(began)}
+			}
+		}(i, p)
+	}
+	wg.Wait()
+
+	var blind []conditions.Observation
+	for i, p := range probeRegistry {
+		v := probeVerdict{ID: p.ID}
+		r := results[i]
+		switch {
+		case p.run == nil:
+			v.Verdict = verdictDeferred
+			run.Counts.Deferred++
+		case r.err != nil:
+			v.Verdict, v.Error = verdictFailedToRun, r.err.Error()
+			run.Counts.FailedToRun++
+			// A probe that could not run once — a question timed out on a loaded machine — is said in
+			// the verdict at once, and raised as a condition when the next run cannot run it either.
+			blind = append(blind, conditions.Observation{Scope: conditions.ScopeProbe, ID: p.ID, Kind: "probe-failed",
+				Token: "failed", Severity: conditions.Warning, Confirm: true,
+				Summary: fmt.Sprintf("the probe %s (%s) could not run: what it checks is not known — never a pass", p.ID, p.Asserts),
+				Said:    firstLine(r.err.Error())})
+		default:
+			raise, held := d.confirm.pass(ctx, d.keeper, p.ID, kindedAs(r.obs, p.Kind))
+			if err := d.keeper.Reconcile(ctx, p.ID, raise); err != nil {
+				v.Error = "what it found could not be kept: " + err.Error()
+			}
+			for _, o := range held {
+				v.Unconfirmed = append(v.Unconfirmed, o.Summary)
+			}
+			if len(raise) == 0 {
+				v.Verdict = verdictPass
+				run.Counts.Passed++
+			} else {
+				v.Verdict = verdictFail
+				run.Counts.Failed++
+				for _, o := range raise {
+					v.Found = append(v.Found, o.Summary)
+				}
+			}
+		}
+		if p.run != nil {
+			v.Took = r.took.Round(time.Millisecond).String()
+		}
+		run.Probes = append(run.Probes, v)
+	}
+	blind, _ = d.confirm.pass(ctx, d.keeper, sourceDoctor, blind)
+	if err := d.keeper.Reconcile(ctx, sourceDoctor, blind); err != nil {
+		fmt.Printf("the self-check's own failures could not be kept: %v\n", err)
+	}
+	ended := time.Now()
+	run.At, run.Took, run.Unsaid = ended.UTC(), ended.Sub(started).Round(time.Millisecond).String(), d.keeper.Unsaid()
+	d.mu.Lock()
+	d.last, d.ended = &run, ended
+	d.mu.Unlock()
+	d.sayHeartbeat(ctx, run)
+	return run
+}
+
+// sourceDoctor is what raises a probe's own failure to run.
+const sourceDoctor = "doctor"
+
+// kindedAs gives each observation of a probe the probe's kind where it named none.
+func kindedAs(obs []conditions.Observation, kind string) []conditions.Observation {
+	out := make([]conditions.Observation, 0, len(obs))
+	for _, o := range obs {
+		if o.Kind == "" {
+			o.Kind = kind
+		}
+		out = append(out, o)
+	}
+	return out
+}
+
+// sayHeartbeat publishes the run's heartbeat. Not said is said here, and S10 on the second machine
+// says it outward: the watcher hears nothing.
+func (d *doctor) sayHeartbeat(ctx context.Context, run doctorRun) {
+	if d.teller == nil {
+		return
+	}
+	body, err := json.Marshal(run)
+	if err != nil {
+		fmt.Printf("the self-check's heartbeat could not be written: %v\n", err)
+		return
+	}
+	saying, cancel := context.WithTimeout(ctx, 10*time.Second)
+	defer cancel()
+	if err := d.teller.PublishSeatEvent(saying, conditions.Seat, conditions.HeartbeatEvent, body); err != nil {
+		fmt.Printf("the self-check's heartbeat (%s) could NOT be said, so the watcher on the second machine "+
+			"will say the self-check is silent: %v\n", run.Run, err)
+	}
+}
+
+// doctorFrom is the serving controller's self-check; nil in any other process.
+var doctorFrom *doctor
+
+// doctorCommand is `doctor`, `doctor run`, `doctor probes` and `doctor signals`.
+func doctorCommand(ctx context.Context, args []string) error {
+	sub := ""
+	if len(args) > 0 && !strings.HasPrefix(args[0], "-") {
+		sub, args = args[0], args[1:]
+	}
+	set := flag.NewFlagSet("doctor", flag.ContinueOnError)
+	asJSON := set.Bool("json", false, "as data")
+	probe := set.String("probe", "", "one probe's verdict, with every finding")
+	if rest, err := parseAround(set, args); err != nil {
+		return err
+	} else if len(rest) > 0 {
+		return errors.New("doctor [run|probes|signals] [--probe <id>] [--json]")
+	}
+	answer, err := doctorAnswer(ctx, sub, *probe)
+	if err != nil {
+		return err
+	}
+	if *asJSON {
+		return printJSON(answer)
+	}
+	fmt.Print(doctorText(answer))
+	return nil
+}
+
+// doctorAnswer is what the verb answers, as data.
+//
+// A verdict is an overview — each probe's findings at most overviewFindings — unless probe names one,
+// which is then answered alone and whole (novox/hq issue 314).
+func doctorAnswer(ctx context.Context, sub, probe string) (any, error) {
+	if probe != "" && sub != "" && sub != "run" {
+		return nil, fmt.Errorf("probe names one probe of a verdict; %s has none", sub)
+	}
+	switch sub {
+	case "":
+		if doctorFrom != nil {
+			if run := doctorFrom.lastRun(); run != nil {
+				return verdictAnswer(*run, time.Now(), probe)
+			}
+			return nil, fmt.Errorf("the self-check has not finished its first run yet: it runs %s after the "+
+				"controller starts, then every %s — `doctor run` runs it now", doctorFirstAfter, doctorEvery)
+		}
+		run, err := lastHeartbeat(ctx)
+		if err != nil {
+			return nil, err
+		}
+		return verdictAnswer(run, time.Now(), probe)
+	case "run":
+		d := doctorFrom
+		if d == nil {
+			local, closeIt, err := localDoctor(ctx)
+			if err != nil {
+				return nil, err
+			}
+			defer closeIt()
+			d = local
+		}
+		return verdictAnswer(d.runOnce(ctx, "asked by "+link.Caller()), time.Now(), probe)
+	case "probes":
+		return probesAnswer(), nil
+	case "signals":
+		if doctorFrom == nil || doctorFrom.watchdogs == nil {
+			return nil, errors.New("the age of each signal is known to the serving controller alone, which " +
+				"hears them: ask it through the mesh-controller seat's doctor verb")
+		}
+		return signalsAnswer(doctorFrom.watchdogs.lastFacts(), doctorFrom.watchdogs.lastTick()), nil
+	}
+	return nil, fmt.Errorf("doctor answers the last run, or `run`, `probes` or `signals` — not %q", sub)
+}
+
+// verdictAnswer is a run as the verb answers it, with its age.
+func verdictAnswer(run doctorRun, now time.Time, probe string) (map[string]any, error) {
+	if probe != "" {
+		one, err := oneProbe(run, probe)
+		if err != nil {
+			return nil, err
+		}
+		run = one
+	} else {
+		run = inOverview(run)
+	}
+	return map[string]any{"run": run, "age": now.Sub(run.At).Round(time.Second).String(),
+		"note": "a probe that could not run is never a pass; each failure is an open condition until a run passes it, " +
+			"and one a single look can be wrong about — an unanswered question, a slow answer — is raised when two " +
+			"runs in a row see it"}, nil
+}
+
+// probesAnswer is the registry.
+func probesAnswer() map[string]any {
+	var out []map[string]any
+	for _, p := range probeRegistry {
+		row := map[string]any{"id": p.ID, "asserts": p.Asserts, "from": p.From, "kind": p.Kind, "phase": p.Phase}
+		if len(p.Raises) > 0 {
+			row["raises"] = p.Raises
+		}
+		if p.Deferred != "" {
+			row["deferred"] = p.Deferred
+		}
+		out = append(out, row)
+	}
+	return map[string]any{"probes": out, "every": doctorEvery.String(), "each within": probeWithin.String()}
+}
+
+// signalsAnswer is every row of the signals table with the age of its newest signal.
+func signalsAnswer(f *signalFacts, ticked time.Time) map[string]any {
+	var rows []map[string]any
+	for _, r := range signalsTable {
+		row := map[string]any{"row": r.Row, "signal": r.Signal, "emitter": r.Emitter, "bound": r.Bound,
+			"kind": r.Kind, "severity": r.Severity, "phase": r.Phase}
+		switch {
+		case r.Deferred != "":
+			row["deferred"] = r.Deferred
+		case f == nil:
+			row["newest"] = "not yet looked at"
+		default:
+			if err := r.needs(f); err != nil {
+				row["blind"] = err.Error()
+			} else if newest := r.newest(f); newest.IsZero() {
+				row["newest"] = "none heard"
+			} else {
+				row["newest"] = newest.UTC().Format(time.RFC3339)
+				row["age"] = f.now.Sub(newest).Round(time.Second).String()
+			}
+		}
+		rows = append(rows, row)
+	}
+	out := map[string]any{"signals": rows, "every": watchEvery.String()}
+	if !ticked.IsZero() {
+		out["looked"] = ticked.UTC().Format(time.RFC3339)
+	}
+	return out
+}
+
+// doctorText is an answer as a person reads it.
+func doctorText(answer any) string {
+	body, _ := json.Marshal(answer)
+	var b strings.Builder
+	var verdict struct {
+		Run doctorRun `json:"run"`
+		Age string    `json:"age"`
+	}
+	if json.Unmarshal(body, &verdict) == nil && verdict.Run.Run != "" {
+		r := verdict.Run
+		fmt.Fprintf(&b, "%s, %s ago (took %s, %s): %d passed, %d failed, %d could not run, %d not built yet\n\n",
+			r.Run, verdict.Age, r.Took, r.Why, r.Counts.Passed, r.Counts.Failed, r.Counts.FailedToRun, r.Counts.Deferred)
+		for _, p := range r.Probes {
+			fmt.Fprintf(&b, "  %-4s %-14s %s\n", p.ID, p.Verdict, p.Took)
+			for _, f := range p.Found {
+				fmt.Fprintf(&b, "         %s\n", f)
+			}
+			for _, f := range p.Unconfirmed {
+				fmt.Fprintf(&b, "         unconfirmed, raised if the next run sees it too: %s\n", f)
+			}
+			if p.More != "" {
+				fmt.Fprintf(&b, "         … %s\n", p.More)
+			}
+			if p.Error != "" {
+				fmt.Fprintf(&b, "         %s\n", p.Error)
+			}
+		}
+		return b.String()
+	}
+	pretty, _ := json.MarshalIndent(answer, "", "  ")
+	return string(pretty) + "\n"
+}
+
+// lastHeartbeat is the newest run's heartbeat, read from the events stream: what a process other than
+// the serving controller answers `doctor` from.
+func lastHeartbeat(ctx context.Context) (doctorRun, error) {
+	var run doctorRun
+	err := onTheBus(func(conn *nats.Conn) error {
+		js, err := conn.JetStream(nats.Context(ctx))
+		if err != nil {
+			return err
+		}
+		msg, err := js.GetLastMsg(broker.EventsStream, link.SeatEventSubject(conditions.Seat, conditions.HeartbeatEvent))
+		if errors.Is(err, nats.ErrMsgNotFound) {
+			return errors.New("the self-check has said no heartbeat on the bus in the last week: it is not running")
+		}
+		if err != nil {
+			return fmt.Errorf("the self-check's last heartbeat cannot be read: %w", err)
+		}
+		return json.Unmarshal(msg.Data, &run)
+	})
+	return run, err
+}
+
+// localDoctor is a self-check run by a process other than the serving controller: its own stores,
+// its own connection, and its own keeper, closed after.
+func localDoctor(ctx context.Context) (*doctor, func(), error) {
+	open, err := openStores(ctx)
+	if err != nil {
+		return nil, nil, err
+	}
+	js, err := dialTheBus()
+	if err != nil {
+		open.Close()
+		return nil, nil, err
+	}
+	k, err := keeperOn(ctx, js.Conn())
+	if err != nil {
+		js.Close()
+		open.Close()
+		return nil, nil, err
+	}
+	jsCtx := js.Context()
+	d := &doctor{open: open, js: js, keeper: k, teller: link.OverNATS{Conn: js.Conn(), JS: jsCtx},
+		host: controlHost(ctx, open.inventory)}
+	return d, func() {
+		flushing, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+		defer cancel()
+		k.Close(flushing)
+		js.Close()
+		open.Close()
+	}, nil
+}
+
+// sortedFound is a probe's findings in a stated order, so two runs over one mesh say the same.
+func sortedFound(obs []conditions.Observation) []conditions.Observation {
+	sort.Slice(obs, func(i, j int) bool { return obs[i].Key() < obs[j].Key() })
+	return obs
+}
+
+// probeAsksKey carries the running probe, so a seat verb it calls is checked against what it declares.
+type probeAsksKey struct{}
+
+// declaredBy says whether the probe running in ctx declared a seat verb; outside a probe, false.
+func declaredBy(ctx context.Context, seat, verb string) (string, bool) {
+	p, ok := ctx.Value(probeAsksKey{}).(probe)
+	if !ok {
+		return "a caller outside the self-check", false
+	}
+	for _, v := range p.Asks {
+		if v.Seat == seat && v.Verb == verb {
+			return p.ID, true
+		}
+	}
+	return p.ID, false
+}

cmd/mesh-controller/doctor_test.go

@@ -0,0 +1,430 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"net"
+	"slices"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/nats-io/nats.go"
+	"github.com/nats-io/nats.go/jetstream"
+	"golang.org/x/net/dns/dnsmessage"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/link"
+
+	"github.com/novox/mesh-controller/internal/testbus"
+)
+
+// The self-check (novox/hq to-be 45 §4): a probe that fails raises its condition, one that cannot run
+// raises probe-failed for itself and is never a pass, and every run ends with its heartbeat.
+
+// withProbes runs the test with a registry of its own.
+func withProbes(t *testing.T, probes ...probe) {
+	t.Helper()
+	before := probeRegistry
+	probeRegistry = probes
+	t.Cleanup(func() { probeRegistry = before })
+}
+
+func TestARunKeepsWhatEachProbeFoundAndSaysItsHeartbeat(t *testing.T) {
+	failing := conditions.Observation{Scope: conditions.ScopeMachine, ID: "anchor", Token: "refused",
+		Severity: conditions.Urgent, Summary: "anchor's node-engine would refuse its declaration"}
+	var broken atomic.Bool
+	broken.Store(true)
+	withProbes(t,
+		probe{ID: "P1", Asserts: "passes", Kind: "never", Phase: 1,
+			run: func(context.Context, *doctor) ([]conditions.Observation, error) { return nil, nil }},
+		probe{ID: "P2", Asserts: "finds a fault", Kind: "declaration-refused", Phase: 1,
+			run: func(context.Context, *doctor) ([]conditions.Observation, error) {
+				if broken.Load() {
+					return []conditions.Observation{failing}, nil
+				}
+				return nil, nil
+			}},
+		probe{ID: "P3", Asserts: "cannot run", Kind: "x", Phase: 1,
+			run: func(context.Context, *doctor) ([]conditions.Observation, error) {
+				if broken.Load() {
+					return nil, errors.New("the store is away")
+				}
+				return nil, nil
+			}},
+		probe{ID: "P4", Asserts: "hangs", Kind: "x", Phase: 1,
+			run: func(ctx context.Context, _ *doctor) ([]conditions.Observation, error) {
+				if broken.Load() {
+					<-ctx.Done()
+					time.Sleep(50 * time.Millisecond)
+				}
+				return nil, nil
+			}},
+		probe{ID: "P5", Asserts: "later", Kind: "x", Phase: 2, Deferred: "not yet"},
+	)
+	before := probeWithin
+	probeWithin = 200 * time.Millisecond
+	t.Cleanup(func() { probeWithin = before })
+
+	store := conditions.NewInMemory()
+	told := &conditions.Told{}
+	k := conditions.NewKeeper(t.Context(), conditions.Options{Store: store, History: store})
+	defer k.Close(context.Background())
+	d := &doctor{keeper: k, teller: told, host: "anchor"}
+	// A probe that cannot run is said in the verdict at once, and as a condition when the next run cannot
+	// run it either (novox/hq issue 277): one timed-out question is not a probe gone blind.
+	first := d.runOnce(t.Context(), "a test")
+	if first.Counts != (doctorCounts{Passed: 1, Failed: 1, FailedToRun: 2, Deferred: 1}) {
+		t.Fatalf("counted %+v", first.Counts)
+	}
+	if open, _ := k.Open(t.Context()); len(open) != 1 || open[0].Key != "machine.anchor.refused" {
+		t.Fatalf("after one run, open: %+v", open)
+	}
+	run := d.runOnce(t.Context(), "a test")
+	if run.Counts != (doctorCounts{Passed: 1, Failed: 1, FailedToRun: 2, Deferred: 1}) {
+		t.Fatalf("counted %+v", run.Counts)
+	}
+	open, err := k.Open(t.Context())
+	if err != nil {
+		t.Fatal(err)
+	}
+	var keys []string
+	for _, c := range open {
+		keys = append(keys, c.Key+"="+c.Kind)
+	}
+	for _, want := range []string{"machine.anchor.refused=declaration-refused", "probe.P3.failed=probe-failed",
+		"probe.P4.failed=probe-failed"} {
+		if !slices.Contains(keys, want) {
+			t.Errorf("%s is not open: %v", want, keys)
+		}
+	}
+	// The heartbeat, in the shape mesh-watcher reads (the contract with the operator's channel).
+	if len(told.Names) != 2 || told.Names[1] != conditions.HeartbeatEvent {
+		t.Fatalf("said %v", told.Names)
+	}
+	if d.lastRunEnded().IsZero() || d.lastRun().Run != run.Run {
+		t.Fatal("the run is not the last verdict")
+	}
+	body, _ := json.Marshal(run)
+	var shape map[string]any
+	_ = json.Unmarshal(body, &shape)
+	for _, field := range []string{"run", "at", "interval-seconds", "counts", "probes", "controller"} {
+		if _, ok := shape[field]; !ok {
+			t.Errorf("the heartbeat carries no %q: %s", field, body)
+		}
+	}
+
+	// Mended: the next run clears every one of them.
+	broken.Store(false)
+	d.runOnce(t.Context(), "a test")
+	if open, _ := k.Open(t.Context()); len(open) != 0 {
+		t.Fatalf("a passing run left open %+v", open)
+	}
+}
+
+// **The registry says what each probe asserts**, and a probe not built says why and when.
+func TestTheRegistryIsTheDesignsLiveForm(t *testing.T) {
+	seen := map[string]bool{}
+	for _, p := range probeRegistry {
+		if seen[p.ID] {
+			t.Errorf("%s twice", p.ID)
+		}
+		seen[p.ID] = true
+		if p.Asserts == "" || p.From == "" || p.Kind == "" {
+			t.Errorf("%s does not say what it asserts, where from, or what it raises", p.ID)
+		}
+		if (p.run == nil) != (p.Deferred != "") || (p.Deferred != "" && p.Phase <= 1) {
+			t.Errorf("%s is run and deferred, or neither, or deferred out of Phase 1: %+v", p.ID, p)
+		}
+	}
+	for _, id := range []string{"D1", "D2", "D3", "D4", "D5", "D6", "D7", "D8", "D9", "D10"} {
+		if !seen[id] {
+			t.Errorf("to-be 45 §4 has %s and the registry does not", id)
+		}
+	}
+}
+
+// **The doctor and the watchdogs watch each other**: watchdogs that stopped are DW; a self-check that
+// stopped is S10 (signals_test.go).
+func TestWatchdogsThatStoppedAreSaid(t *testing.T) {
+	w := &watchdogs{started: time.Now().Add(-time.Hour)}
+	d := &doctor{watchdogs: w, host: "anchor"}
+	got, err := probeWatchdogs(t.Context(), d)
+	if err != nil || len(got) != 1 || got[0].Severity != conditions.Urgent {
+		t.Fatalf("%+v %v", got, err)
+	}
+	w.ticked = time.Now()
+	if got, _ := probeWatchdogs(t.Context(), d); len(got) != 0 {
+		t.Fatalf("%+v", got)
+	}
+}
+
+// **D1 composes every machine of a healthy mesh and the host's own validator takes each.**
+func TestEveryMachineOfAHealthyMeshComposesAndValidates(t *testing.T) {
+	open := aMesh(t)
+	got, err := probeDeclarations(t.Context(), &doctor{open: open})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 0 {
+		t.Fatalf("a healthy mesh failed D1: %+v", got)
+	}
+}
+
+// **D1 names a machine nothing can be sent to**, and the network that cannot be computed for it.
+func TestAMachineWhoseDeclarationDoesNotComposeIsSaid(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	one, two := rivals()
+	register(t, open, one)
+	register(t, open, two)
+	for _, m := range []string{"rival-one", "rival-two"} {
+		if _, err := assign(ctx, open, "laptop", m); err != nil && m == "rival-one" {
+			t.Fatal(err)
+		}
+	}
+	got, err := probeDeclarations(ctx, &doctor{open: open})
+	linted(got)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 1 || got[0].Key() != "machine.laptop.uncomposable" || !strings.Contains(got[0].Summary, "the-seat") {
+		t.Fatalf("%+v", got)
+	}
+}
+
+// **D2: a resolver answering NXDOMAIN for IPv6 is wrong** — musl takes it as no such name (issue 262).
+func TestAResolverAnsweringNoSuchNameForIPv6IsWrong(t *testing.T) {
+	answerAs := func(rcode dnsmessage.RCode) string {
+		conn, err := net.ListenPacket("udp", "127.0.0.1:0")
+		if err != nil {
+			t.Fatal(err)
+		}
+		t.Cleanup(func() { _ = conn.Close() })
+		go func() {
+			buf := make([]byte, 1500)
+			for {
+				n, from, err := conn.ReadFrom(buf)
+				if err != nil {
+					return
+				}
+				var q dnsmessage.Message
+				if q.Unpack(buf[:n]) != nil {
+					continue
+				}
+				reply := dnsmessage.Message{Header: dnsmessage.Header{ID: q.ID, Response: true}, Questions: q.Questions}
+				if q.Questions[0].Type == dnsmessage.TypeA {
+					reply.Answers = []dnsmessage.Resource{{Header: dnsmessage.ResourceHeader{Name: q.Questions[0].Name,
+						Type: dnsmessage.TypeA, Class: dnsmessage.ClassINET}, Body: &dnsmessage.AResource{A: [4]byte{10, 77, 0, 1}}}}
+				} else {
+					reply.RCode = rcode
+				}
+				packed, _ := reply.Pack()
+				_, _ = conn.WriteTo(packed, from)
+			}
+		}()
+		_, port, _ := net.SplitHostPort(conn.LocalAddr().String())
+		return port
+	}
+	before := resolverPort
+	t.Cleanup(func() { resolverPort = before })
+
+	resolverPort = answerAs(dnsmessage.RCodeSuccess)
+	v4, rcode, err := askResolver(t.Context(), "127.0.0.1", "anchor.internal", dnsmessage.TypeA)
+	if err != nil || rcode != dnsmessage.RCodeSuccess || !slices.Equal(v4, []string{"10.77.0.1"}) {
+		t.Fatalf("%v %v %v", v4, rcode, err)
+	}
+	v6, rcode, err := askResolver(t.Context(), "127.0.0.1", "anchor.internal", dnsmessage.TypeAAAA)
+	if err != nil || rcode != dnsmessage.RCodeSuccess || len(v6) != 0 {
+		t.Fatalf("NODATA read as %v %v %v", v6, rcode, err)
+	}
+	resolverPort = answerAs(dnsmessage.RCodeNameError)
+	if _, rcode, _ := askResolver(t.Context(), "127.0.0.1", "anchor.internal", dnsmessage.TypeAAAA); rcode != dnsmessage.RCodeNameError {
+		t.Fatalf("NXDOMAIN read as %v", rcode)
+	}
+}
+
+// **D6, D7: what the controller defines is what it finds**, and a consumer deleted or a stream
+// redefined is said — against a real bus, raised by the same derivation the controller starts with.
+func TestNatsTheBusIsWhatTheControllerDefines(t *testing.T) {
+	url := testbus.URL(t)
+	open := aMesh(t)
+	js, err := broker.Dial(url)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(js.Close)
+	for _, s := range []string{"CONTROL", "NODES", "ASSIGNMENTS", "EVENTS"} {
+		_ = js.Context().DeleteStream(s)
+	}
+	if _, err := assertBusObjects(t.Context(), open.inventory, js); err != nil {
+		t.Fatal(err)
+	}
+	if err := js.EnsureControllerBuckets(); err != nil {
+		t.Fatal(err)
+	}
+	d := &doctor{open: open, js: js}
+	for _, p := range []func(context.Context, *doctor) ([]conditions.Observation, error){probeConsumers, probeStreams} {
+		got, err := p(t.Context(), d)
+		if err != nil || len(got) != 0 {
+			t.Fatalf("a bus just raised fails: %+v %v", got, err)
+		}
+	}
+	if err := js.Context().DeleteConsumer("NODES", "laptop"); err != nil {
+		t.Fatal(err)
+	}
+	info, err := js.Context().StreamInfo("EVENTS")
+	if err != nil {
+		t.Fatal(err)
+	}
+	cfg := info.Config
+	cfg.MaxMsgsPerSubject = 3
+	if _, err := js.Context().UpdateStream(&cfg); err != nil {
+		t.Fatal(err)
+	}
+	consumers, err := probeConsumers(t.Context(), d)
+	if err != nil || len(consumers) != 1 || consumers[0].Key() != "bus.NODES.laptop.missing" {
+		t.Fatalf("the deleted consumer: %+v %v", consumers, err)
+	}
+	streams, err := probeStreams(t.Context(), d)
+	if err != nil || len(streams) != 1 || !strings.Contains(streams[0].Summary, "per subject") {
+		t.Fatalf("the redefined stream: %+v %v", streams, err)
+	}
+}
+
+// **S9 hears the bus**: a consumer that gives up on a message, and one deleted, as the server says.
+func TestNatsTheBusSaysAConsumerGaveUpAndOneWasDeleted(t *testing.T) {
+	url := testbus.URL(t)
+	conn, err := nats.Connect(url)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer conn.Close()
+	heard := make(chan *nats.Msg, 16)
+	for _, subject := range broker.BusAdvisories {
+		if _, err := conn.ChanSubscribe(subject, heard); err != nil {
+			t.Fatal(err)
+		}
+	}
+	api, _ := jetstream.New(conn)
+	_ = api.DeleteStream(t.Context(), "SEAT_ADVISED")
+	stream, err := api.CreateStream(t.Context(), jetstream.StreamConfig{Name: "SEAT_ADVISED", Subjects: []string{"advised.>"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = api.DeleteStream(context.Background(), "SEAT_ADVISED") }()
+	consumer, err := stream.CreateConsumer(t.Context(), jetstream.ConsumerConfig{Durable: "SEAT_ADVISED_worker",
+		AckPolicy: jetstream.AckExplicitPolicy, MaxDeliver: 1, AckWait: 100 * time.Millisecond})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := api.Publish(t.Context(), "advised.x", []byte("x")); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := consumer.Fetch(1, jetstream.FetchMaxWait(time.Second)); err != nil {
+		t.Fatal(err)
+	}
+	// A seat's worker, so the deletion is of a consumer the mesh names (link.MeshNamed).
+	// Not acknowledged: after its one delivery the consumer gives up on it — on the next fetch.
+	time.Sleep(300 * time.Millisecond)
+	_, _ = consumer.Fetch(1, jetstream.FetchMaxWait(300*time.Millisecond))
+	if err := stream.DeleteConsumer(t.Context(), "SEAT_ADVISED_worker"); err != nil {
+		t.Fatal(err)
+	}
+	kinds := map[string]string{}
+	deadline := time.After(5 * time.Second)
+	for len(kinds) < 2 {
+		select {
+		case m := <-heard:
+			if a, ok := link.ReadAdvisory(m.Subject, m.Data); ok {
+				kinds[a.Kind] = a.Said
+			}
+		case <-deadline:
+			t.Fatalf("the bus said only %v", kinds)
+		}
+	}
+	if !strings.Contains(kinds["max-deliveries"], "gave up") || !strings.Contains(kinds["consumer-lost"], "was deleted") {
+		t.Fatalf("%v", kinds)
+	}
+}
+
+// **D10 compares a node-engine with what it is delivered as, not with its commit** (2026-10-06: every
+// machine read as behind right after a push sent it the current build — it says the digest-named
+// directory it runs from, and the mesh holds a commit).
+func TestANodeEngineIsJudgedByTheVersionItIsDeliveredAs(t *testing.T) {
+	m := catalogue.Manifest{Module: "mesh-host", Resources: []map[string]any{
+		{"id": "launcher", "type": "file", "path": "/usr/lib/nox-mesh-host/launch"},
+		{"id": "host", "type": "archive", "path": "/usr/lib/nox-mesh-host/versions/31045596c83a"},
+		{"id": "unfilled", "type": "archive", "path": "/usr/lib/x/versions/${version}"},
+	}}
+	delivered := deliveredVersions(m)
+	if !slices.Equal(delivered, []string{"31045596c83a"}) {
+		t.Fatalf("%v", delivered)
+	}
+	commit := "1545b00a9f0c"
+	for _, c := range []struct {
+		reported string
+		behind   bool
+	}{
+		{"31045596c83a", false}, // the live case: current, and was called behind
+		{"0123456789ab", true},  // another delivery
+		{"1545b00a", false},     // placed by hand, stamped with the commit
+		{"", false},             // not said
+	} {
+		if got := engineBehind(c.reported, delivered, commit); got != c.behind {
+			t.Errorf("%q behind = %v, want %v", c.reported, got, c.behind)
+		}
+	}
+	if engineBehind("31045596c83a", nil, commit) {
+		t.Error("behind a mesh that holds no delivered build")
+	}
+}
+
+// **Every seat verb a probe calls is one it declares, and one the controller is granted** — derived
+// from the registry, so a probe added with a question the bus would refuse fails here, not live.
+func TestEverySeatVerbAProbeAsksIsGranted(t *testing.T) {
+	granted, err := broker.PermissionsFor(broker.Principal{Kind: broker.KindController, PasswordHash: "x"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	asked := 0
+	for _, p := range probeRegistry {
+		for _, v := range p.Asks {
+			asked++
+			subject := link.NodeSeatToolSubject(v.Seat, v.Verb, "anchor")
+			if !slices.ContainsFunc(granted.Publish, func(pattern string) bool { return subjectMatches(pattern, subject) }) {
+				t.Errorf("%s asks %s.%s and the controller may not publish %s", p.ID, v.Seat, v.Verb, subject)
+			}
+			if !slices.Contains(broker.VerbsTheSelfCheckAsks, v) {
+				t.Errorf("%s asks %s.%s, which broker.VerbsTheSelfCheckAsks does not name", p.ID, v.Seat, v.Verb)
+			}
+		}
+	}
+	if asked == 0 {
+		t.Fatal("no probe asks a seat verb: D8 lost its declaration")
+	}
+	// And a probe asking what it did not declare is refused before anything is sent.
+	ctx := context.WithValue(t.Context(), probeAsksKey{}, probe{ID: "DX"})
+	if _, err := askSeatTool(ctx, nil, "node-intrusion-prevention", "banned", "anchor"); err == nil ||
+		!strings.Contains(err.Error(), "does not declare") {
+		t.Fatalf("an undeclared question was asked: %v", err)
+	}
+}
+
+// subjectMatches is the bus's matching of a permission pattern against a subject.
+func subjectMatches(pattern, subject string) bool {
+	p, s := strings.Split(pattern, "."), strings.Split(subject, ".")
+	for i, tok := range p {
+		if tok == ">" {
+			return len(s) > i
+		}
+		if i >= len(s) || (tok != "*" && tok != s[i]) {
+			return false
+		}
+	}
+	return len(p) == len(s)
+}

cmd/mesh-controller/dry_run_test.go

@@ -0,0 +1,38 @@
+package main
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// A dry run's outcome is looked at, never taken in (novox/hq issue 240). The daemon here holds no
+// store at all, so anything that tried to record or register would fail rather than pass quietly.
+func TestADryRunsOutcomeIsTakenInByNothing(t *testing.T) {
+	err := builds{}.Built(t.Context(), link.BuildResult{
+		ID: "build-1", Repository: "ssh://forge/app.git", Ref: "unreviewed", Module: "app", DryRun: true,
+		Manifest: json.RawMessage(`{"module":"app","version":"1"}`),
+	})
+	if err != nil {
+		t.Fatalf("a dry run's outcome was not simply set aside: %v", err)
+	}
+}
+
+// The mark survives the wire both ways: asked as a dry run, answered as one.
+func TestTheDryRunMarkTravelsWithTheBuild(t *testing.T) {
+	raw, _ := json.Marshal(link.BuildRequest{ID: "build-1", Repository: "r", DryRun: true})
+	var asked link.BuildRequest
+	if err := json.Unmarshal(raw, &asked); err != nil || !asked.DryRun {
+		t.Fatalf("the request lost its dry-run mark: %s", raw)
+	}
+	raw, _ = json.Marshal(link.BuildResult{ID: "build-1", DryRun: true})
+	var answered link.BuildResult
+	if err := json.Unmarshal(raw, &answered); err != nil || !answered.DryRun {
+		t.Fatalf("the outcome lost its dry-run mark: %s", raw)
+	}
+	raw, _ = json.Marshal(link.BuildResult{ID: "build-2"})
+	if string(raw) != `{"id":"build-2","repository":"","on":""}` {
+		t.Fatalf("an ordinary outcome carries a dry-run mark: %s", raw)
+	}
+}

cmd/mesh-controller/durations.go

@@ -0,0 +1,170 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"flag"
+	"fmt"
+	"os"
+	"slices"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// What the core's bounds are set from (novox/hq to-be 45 Phase 0).
+//
+// **A bound is set from what was measured, not from what seemed reasonable.** Phase 1 puts a watchdog
+// on each row of the signals table, and each has a bound: S1 three heartbeat intervals, S2 three times
+// a machine's last apply, S3 a tier's build and apply time, S6 a build's timeout. Marked provisional
+// in the design until a fortnight of these says what the mesh actually takes. Recorded by the serving
+// controller as it hears each — a send's first report, a machine's next word, a plan leaving a tier, a
+// build's outcome — and summarised here per machine, repository or module.
+
+// recordBuildDuration measures one build from its ask to its outcome heard.
+func recordBuildDuration(ctx context.Context, inv *inventory.Inventory, result link.BuildResult, asked time.Time) {
+	if asked.IsZero() || result.ID == "" {
+		return
+	}
+	subject := result.Module
+	if subject == "" {
+		subject = result.Repository
+	}
+	detail := "built"
+	if result.Failed != "" {
+		detail = "failed: " + firstLine(result.Failed)
+	}
+	if err := inv.RecordDuration(ctx, inventory.Duration{Kind: inventory.DurationBuild, Subject: subject,
+		Node: result.On, Ref: result.ID, Started: asked, Took: time.Since(asked), Detail: detail}); err != nil {
+		fmt.Fprintf(os.Stderr, "%s: how long it took could not be recorded: %v\n", result.ID, err)
+	}
+}
+
+// durationSummary is one subject's measurements of one kind.
+type durationSummary struct {
+	Kind    string `json:"kind"`
+	Subject string `json:"subject"`
+	Count   int    `json:"count"`
+	Median  string `json:"median"`
+	P90     string `json:"p90"`
+	Max     string `json:"max"`
+	// Bound is what to-be 45's rule would make of these, where the rule is a multiple of a measured
+	// time: three times the slowest apply (S2), three times the median word interval (S1).
+	Suggests string `json:"suggests,omitempty"`
+}
+
+func summarise(ds []inventory.Duration) []durationSummary {
+	type key struct{ kind, subject string }
+	by := map[key][]time.Duration{}
+	for _, d := range ds {
+		k := key{d.Kind, d.Subject}
+		by[k] = append(by[k], d.Took)
+	}
+	var out []durationSummary
+	for k, took := range by {
+		slices.Sort(took)
+		at := func(q float64) time.Duration { return took[int(q*float64(len(took)-1))] }
+		s := durationSummary{Kind: k.kind, Subject: k.subject, Count: len(took),
+			Median: round(at(0.5)), P90: round(at(0.9)), Max: round(took[len(took)-1])}
+		switch k.kind {
+		case inventory.DurationApply:
+			s.Suggests = "S2 bound max(2m, 3×last apply) ≈ " + round(max(2*time.Minute, 3*at(0.9))) + " at the p90"
+		case inventory.DurationHeartbeatGap:
+			s.Suggests = "S1 bound 3×interval ≈ " + round(3*at(0.5))
+		}
+		out = append(out, s)
+	}
+	sort.Slice(out, func(i, j int) bool {
+		ki, kj := slices.Index(inventory.DurationKinds, out[i].Kind), slices.Index(inventory.DurationKinds, out[j].Kind)
+		if ki != kj {
+			return ki < kj
+		}
+		return out[i].Subject < out[j].Subject
+	})
+	return out
+}
+
+func round(d time.Duration) string {
+	switch {
+	case d < time.Second:
+		return d.Round(time.Millisecond).String()
+	case d < time.Minute:
+		return d.Round(100 * time.Millisecond).String()
+	default:
+		return d.Round(time.Second).String()
+	}
+}
+
+// durationsCommand is `durations`: the summary per kind and subject, or every measurement as data.
+func durationsCommand(ctx context.Context, args []string) error {
+	set := flag.NewFlagSet("durations", flag.ContinueOnError)
+	kind := set.String("kind", "", "one kind: "+strings.Join(inventory.DurationKinds, ", "))
+	days := set.Int("days", 14, "how many days back")
+	asJSON := set.Bool("json", false, "the summary as data")
+	all := set.Bool("all", false, "every measurement rather than the summary")
+	if _, err := parseAround(set, args); err != nil {
+		return err
+	}
+	if *kind != "" && !slices.Contains(inventory.DurationKinds, *kind) {
+		return fmt.Errorf("%q is not a kind of duration: %s", *kind, strings.Join(inventory.DurationKinds, ", "))
+	}
+	open, err := openStores(ctx)
+	if err != nil {
+		return err
+	}
+	defer open.Close()
+	ds, err := open.inventory.Durations(ctx, *kind, time.Now().Add(-time.Duration(*days)*24*time.Hour))
+	if err != nil {
+		return err
+	}
+	if *all {
+		body, err := json.MarshalIndent(ds, "", "  ")
+		if err != nil {
+			return err
+		}
+		fmt.Println(string(body))
+		return nil
+	}
+	summary := summarise(ds)
+	if *asJSON {
+		body, err := json.MarshalIndent(map[string]any{"days": *days, "durations": summary}, "", "  ")
+		if err != nil {
+			return err
+		}
+		fmt.Println(string(body))
+		return nil
+	}
+	if len(summary) == 0 {
+		fmt.Printf("nothing measured in the last %d day(s): the serving controller records apply, heartbeat-gap, "+
+			"plan-tier and build durations as it hears them\n", *days)
+		return nil
+	}
+	fmt.Printf("durations over the last %d day(s) — what the core's bounds are set from (to-be 45 Phase 0)\n\n", *days)
+	fmt.Printf("  %-14s %-28s %6s %10s %10s %10s\n", "kind", "of", "count", "median", "p90", "max")
+	for _, s := range summary {
+		fmt.Printf("  %-14s %-28s %6d %10s %10s %10s\n", s.Kind, s.Subject, s.Count, s.Median, s.P90, s.Max)
+		if s.Suggests != "" {
+			fmt.Printf("  %-14s %-28s %s\n", "", "", s.Suggests)
+		}
+	}
+	return nil
+}
+
+// forgettingOldDurations removes what is older than a month, at start and daily after.
+func forgettingOldDurations(ctx context.Context, inv *inventory.Inventory) {
+	for {
+		if n, err := inv.ForgetOldDurations(ctx); err != nil {
+			fmt.Fprintf(os.Stderr, "durations older than %s could not be removed: %v\n", inventory.DurationsKeptFor, err)
+		} else if n > 0 {
+			fmt.Printf("removed %d duration(s) older than %s\n", n, inventory.DurationsKeptFor)
+		}
+		select {
+		case <-ctx.Done():
+			return
+		case <-time.After(24 * time.Hour):
+		}
+	}
+}

cmd/mesh-controller/epoch_send_test.go

@@ -0,0 +1,115 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"strings"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// A declaration carries the lease's epoch (novox/hq to-be 45 §6) — to a machine whose node-engine said
+// it reads one, and to no other: an older node-engine refuses a key it does not know, whole.
+
+// bodiesDelivery records each send as the mesh does, and keeps the bodies.
+type bodiesDelivery struct {
+	recordedDelivery
+	bodies map[string][]byte
+}
+
+func (b *bodiesDelivery) declare(ctx context.Context, s readyNode, body []byte) (string, error) {
+	b.bodies[s.node] = body
+	return b.recordedDelivery.declare(ctx, s, body)
+}
+
+func TestAMachineIsSentTheEpochOnlyOnceItSaysItReadsOne(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	epoch := uint64(57)
+	was := epochForActs
+	epochForActs = func(context.Context) (uint64, error) { return epoch, nil }
+	t.Cleanup(func() { epochForActs = was })
+
+	anchor, err := inv.NodeByName(ctx, "anchor")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.RecordReadsEpoch(ctx, anchor.ID, true); err != nil {
+		t.Fatal(err)
+	}
+	gens, err := generators(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	d := &bodiesDelivery{recordedDelivery: recordedDelivery{inv: inv}, bodies: map[string][]byte{}}
+	if _, err := sendRound(ctx, open, []string{"anchor", "laptop"}, composeForPush(open, gens), d, "", nil); err != nil {
+		t.Fatal(err)
+	}
+	carried := func(node string) (epoch float64, has bool) {
+		var envelope map[string]any
+		if err := json.Unmarshal(d.bodies[node], &envelope); err != nil {
+			t.Fatal(err)
+		}
+		epoch, has = envelope["epoch"].(float64)
+		return epoch, has
+	}
+	if e, has := carried("anchor"); !has || e != 57 {
+		t.Fatalf("the machine that reads an epoch was sent %v: %s", e, d.bodies["anchor"])
+	}
+	if _, has := carried("laptop"); has {
+		t.Fatalf("a machine that never said it reads an epoch was sent one: %s", d.bodies["laptop"])
+	}
+
+	// A new holder of the lease is not a change of the machine: neither reads as behind.
+	epoch = 58
+	would, err := wouldSend(ctx, open, mustNodes(t, open))
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, node := range []string{"anchor", "laptop"} {
+		sent, err := inv.Outstanding(ctx, node)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if would[node] != sent {
+			t.Fatalf("%s reads as behind after the lease changed hands, with nothing else changed", node)
+		}
+	}
+}
+
+// A process that may not act composes nothing and sends nothing: its number is not taken.
+func TestNothingIsComposedOrSentWithoutTheLease(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	was := epochForActs
+	epochForActs = func(context.Context) (uint64, error) { return 0, errors.New("this controller lost the lease") }
+	t.Cleanup(func() { epochForActs = was })
+	gens, err := generators(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	d := &bodiesDelivery{recordedDelivery: recordedDelivery{inv: open.inventory}, bodies: map[string][]byte{}}
+	refused, err := sendRound(ctx, open, []string{"anchor"}, composeForPush(open, gens), d, "", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(d.bodies) != 0 || len(refused) != 1 || !strings.Contains(refused[0], "lost the lease") {
+		t.Fatalf("a controller without the lease composed %d and refused %v", len(d.bodies), refused)
+	}
+	anchor, _ := open.inventory.NodeByName(ctx, "anchor")
+	if seq, _ := open.inventory.Sequence(ctx, anchor.ID); seq != 0 {
+		t.Fatalf("a controller without the lease took sequence %d", seq)
+	}
+
+	// And at the send itself: the gate every declaration passes.
+	gate := link.ActingGate
+	link.ActingGate = func(context.Context) error { return errors.New("this controller lost the lease") }
+	t.Cleanup(func() { link.ActingGate = gate })
+	if err := link.Declare(ctx, nil, nil, "anchor", []byte(`{"declaration":1}`), 0); err == nil ||
+		!strings.Contains(err.Error(), "lost the lease") {
+		t.Fatalf("a declaration was let through the gate: %v", err)
+	}
+}

cmd/mesh-controller/facts.go

@@ -0,0 +1,647 @@
+package main
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"os"
+	"slices"
+	"sort"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/novox/mesh-host/validate"
+
+	"github.com/novox/mesh-controller/internal/artifacts"
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/builder"
+	"github.com/novox/mesh-controller/internal/catalogue"
+	snapshot "github.com/novox/mesh-controller/internal/facts"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// The facts snapshot (novox/hq to-be 45 §9, ADR 0227 rule 9): what a merge check needs to judge a change
+// against the mesh that runs, written by the controller to the artifact store, where the build seat reads
+// it. internal/facts says what it holds and what it never holds; this composes it from the store and
+// keeps it current.
+
+// factsEvery is how often the snapshot is composed. It is kept when it moved — a machine, an
+// assignment, a seat, a setting, a build — or once a day when nothing did, so its age says the
+// controller is still writing it (S14).
+var factsEvery = 10 * time.Minute
+
+// factsDaily is how old a snapshot of an unchanged mesh may grow before it is written again.
+const factsDaily = 24 * time.Hour
+
+// factsStaleAfter is S14's bound: a snapshot older than this is one no check should be fed.
+const factsStaleAfter = 48 * time.Hour
+
+// factsExport is what this controller knows of the snapshot it keeps: when the newest was taken, its
+// content, and the last attempt's error.
+type factsExport struct {
+	mu      sync.Mutex
+	taken   time.Time
+	content string
+	digest  string
+	err     error
+	began   time.Time
+}
+
+// exportedFacts is this process's export, read by S14.
+var exportedFacts = &factsExport{}
+
+func (e *factsExport) last() (taken time.Time, digest string, began time.Time, err error) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	return e.taken, e.digest, e.began, e.err
+}
+
+func (e *factsExport) kept(f snapshot.Facts, content, digest string) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	e.taken, e.content, e.digest, e.err = f.Taken, content, digest, nil
+}
+
+func (e *factsExport) failed(err error) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	e.err = err
+}
+
+// exportingFacts keeps the snapshot current for as long as this controller holds the lease: ctx ends
+// when it stops acting.
+func exportingFacts(ctx context.Context, open *stores, busVersion func() string) {
+	exportedFacts.mu.Lock()
+	exportedFacts.began = time.Now()
+	exportedFacts.mu.Unlock()
+	// What the store holds already, so a restarted controller neither writes an unchanged snapshot again
+	// nor reads its age as zero.
+	if address, err := factsStore(ctx, open); err == nil {
+		if body, digest, err := (artifacts.Store{Address: address}).GetTagged(ctx, snapshot.Repository, snapshot.Tag); err == nil {
+			if f, err := snapshot.Decode(body); err == nil {
+				content, _ := f.Content()
+				exportedFacts.kept(f, content, digest)
+			}
+		}
+	}
+	failing := ""
+	first := time.NewTimer(time.Minute)
+	defer first.Stop()
+	tick := time.NewTicker(factsEvery)
+	defer tick.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-first.C:
+		case <-tick.C:
+		}
+		wrote, err := exportFacts(ctx, open, busVersion(), false)
+		why := ""
+		if err != nil {
+			why = err.Error()
+			exportedFacts.failed(err)
+		}
+		if why != failing {
+			if why != "" {
+				fmt.Printf("the facts snapshot cannot be kept: %s\n", why)
+			} else {
+				fmt.Println("the facts snapshot is kept again")
+			}
+			failing = why
+		}
+		if wrote != "" {
+			fmt.Printf("the facts snapshot moved and is kept as %s\n", short(strings.TrimPrefix(wrote, "sha256:")))
+		}
+	}
+}
+
+// exportFacts composes the snapshot and keeps it when it moved, or when the one kept is a day old, or
+// when told to. Answers the digest it kept, empty when it kept nothing.
+func exportFacts(ctx context.Context, open *stores, busVersion string, force bool) (string, error) {
+	f, err := gatherFacts(ctx, open, busVersion)
+	if err != nil {
+		return "", err
+	}
+	content, err := f.Content()
+	if err != nil {
+		return "", err
+	}
+	exportedFacts.mu.Lock()
+	unchanged := content == exportedFacts.content && time.Since(exportedFacts.taken) < factsDaily
+	exportedFacts.mu.Unlock()
+	if unchanged && !force {
+		return "", nil
+	}
+	body, err := f.Encode()
+	if err != nil {
+		return "", err
+	}
+	address, err := factsStore(ctx, open)
+	if err != nil {
+		return "", err
+	}
+	digest, err := (artifacts.Store{Address: address}).PutTagged(ctx, snapshot.Repository, snapshot.Tag, snapshot.MediaType, body)
+	if err != nil && digest == "" {
+		return "", err
+	}
+	exportedFacts.kept(f, content, digest)
+	return digest, err
+}
+
+// factsStore is the artifact store as this controller reaches it.
+func factsStore(ctx context.Context, open *stores) (string, error) {
+	shelf, err := open.inventory.Catalogue(ctx)
+	if err != nil {
+		return "", err
+	}
+	address, err := artifactStoreAddress(ctx, open.inventory, shelf, "")
+	if err != nil {
+		return "", err
+	}
+	if address == "" {
+		return "", errors.New("the artifact store is not on the private network, so there is nowhere to keep the facts")
+	}
+	return address, nil
+}
+
+// gatherFacts composes one snapshot from the store: read only, nothing made, nothing sent.
+func gatherFacts(ctx context.Context, open *stores, busVersion string) (snapshot.Facts, error) {
+	inv := open.inventory
+	f := snapshot.Facts{Format: snapshot.Format, Taken: time.Now().UTC(), Controller: snapshot.Build{Version: version}}
+	f.Versions.Bus = busVersion
+	storeVersion, err := inv.ServerVersion(ctx)
+	if err != nil {
+		return snapshot.Facts{}, fmt.Errorf("the store will not say its version: %w", err)
+	}
+	f.Versions.Store = storeVersion
+
+	nodes, err := inv.Nodes(ctx)
+	if err != nil {
+		return snapshot.Facts{}, err
+	}
+	overlays, err := inv.Overlays(ctx)
+	if err != nil {
+		return snapshot.Facts{}, err
+	}
+	place := map[string]inventory.Overlay{}
+	for _, o := range overlays {
+		place[o.Name] = o
+	}
+	entries, err := inv.Catalogued(ctx)
+	if err != nil {
+		return snapshot.Facts{}, err
+	}
+	shelf := map[string]catalogue.Manifest{}
+	for _, e := range entries {
+		shelf[e.Manifest.Module] = e.Manifest
+	}
+	current, err := inv.CurrentBuilds(ctx)
+	if err != nil {
+		return snapshot.Facts{}, err
+	}
+	read, err := inv.ReadRepositories(ctx)
+	if err != nil {
+		return snapshot.Facts{}, err
+	}
+	edges, err := inv.Dependencies(ctx)
+	if err != nil {
+		return snapshot.Facts{}, err
+	}
+	holdings, err := inv.Holdings(ctx)
+	if err != nil {
+		return snapshot.Facts{}, err
+	}
+
+	// **Every name first**, so text read afterwards — a setting naming a machine, a problem naming a
+	// site — has it replaced wherever it appears.
+	scrub := snapshot.NewScrubber()
+	domains := map[string]string{}
+	for _, n := range nodes {
+		scrub.Machine(n.Name)
+		if n.Account != "" && n.Account != "root" {
+			scrub.Account(n.Account)
+		}
+		d, err := inv.PublicDomainOf(ctx, n.Name)
+		if err != nil {
+			return snapshot.Facts{}, err
+		}
+		domains[n.Name] = scrub.Domain(d)
+	}
+	for _, o := range overlays {
+		scrub.Site(o.Site)
+	}
+
+	// What a merge check runs in and reads beside it, as the build seat would be asked for it.
+	if held, err := inv.Held(ctx); err == nil {
+		for language, reference := range builder.ToolchainsOf(held) {
+			if f.Versions.Toolchains == nil {
+				f.Versions.Toolchains = map[string]string{}
+			}
+			f.Versions.Toolchains[language] = catalogue.Recorded(reference)
+		}
+	} else {
+		return snapshot.Facts{}, err
+	}
+	for _, e := range entries {
+		if dir, core := coreModules[e.Manifest.Module]; core && !e.Provided && e.Source.Repository != "" {
+			for d, ref := range besideRefs(dir, current[e.Manifest.Module].Commit) {
+				if f.Beside == nil {
+					f.Beside = map[string]string{}
+				}
+				f.Beside[d] = ref
+			}
+		}
+	}
+
+	if c, ok := current["mesh-controller"]; ok {
+		f.Controller.Commit = c.Commit
+	}
+
+	gens, gensErr := generators(ctx, open)
+	hostShelf := shelf[hostModule]
+	meshWide := map[string]bool{}
+	engines := map[string]bool{}
+	for _, n := range nodes {
+		m := snapshot.Machine{Name: scrub.Machine(n.Name), Length: len(n.Name), Adopted: n.Adopted,
+			AccountHome: scrub.Text(n.AccountHome), NodeEngine: n.HostVersion, PublicDomain: domains[n.Name],
+			AgentAccount: scrub.Account(n.AgentAccount), AgentAccountHome: scrub.Text(n.AgentAccountHome)}
+		switch n.Account {
+		case "", "root":
+			m.Account = n.Account
+		default:
+			m.Account = scrub.Account(n.Account)
+		}
+		if n.HostVersion != "" {
+			engines[n.HostVersion] = true
+		}
+		m.System = systemOf(hostShelf, n.HostVersion)
+		m.Libc = libcOf(m.System)
+		reported, err := inv.DescribedOf(ctx, n.Name)
+		if err != nil {
+			return snapshot.Facts{}, err
+		}
+		m.Architecture, m.Kernel = reported.Architecture, reported.Kernel
+		outward, err := inv.OutwardLinksOf(ctx, n.Name)
+		if err != nil {
+			return snapshot.Facts{}, err
+		}
+		for _, l := range outward {
+			m.OutwardLinks = append(m.OutwardLinks, scrub.Text(l))
+		}
+		capabilities, err := inv.Profile(ctx, n.Name)
+		if err != nil {
+			return snapshot.Facts{}, err
+		}
+		for _, c := range capabilities {
+			kept := snapshot.Capability{Name: c.Name, Present: c.Present}
+			// The detail only where it is a version: everything else a detector says — a ruleset, a
+			// device, a path — is the machine's own business and no check reads it.
+			if c.Present && (c.Name == "container-runtime" || c.Name == "package-manager") {
+				kept.Detail = scrub.Text(c.Detail)
+			}
+			m.Capabilities = append(m.Capabilities, kept)
+		}
+		if o, ok := place[n.Name]; ok {
+			m.Site, m.Hub, m.Public, m.OnNetwork = scrub.Site(o.Site), o.Hub, o.Endpoint != "", o.Address != ""
+		}
+		assigned, err := inv.Assigned(ctx, n.Name)
+		if err != nil {
+			return snapshot.Facts{}, err
+		}
+		m.Assigned = assigned
+		sent, known, err := inv.SentBuilds(ctx, n.Name)
+		if err != nil {
+			return snapshot.Facts{}, err
+		}
+		if known && slices.Contains(assigned, broker.RuntimeModule) {
+			m.NodeTools = sent[broker.RuntimeModule]
+		}
+		pins, err := inv.PinsFor(ctx, n.Name)
+		if err != nil {
+			return snapshot.Facts{}, err
+		}
+		for provision, c := range pins {
+			m.Pins = append(m.Pins, snapshot.Pin{Provision: provision, Machine: scrub.Machine(c.Node), Module: c.Module})
+		}
+		for _, module := range assigned {
+			held, err := inv.SecretsOf(ctx, n.Name, module)
+			if err != nil {
+				return snapshot.Facts{}, err
+			}
+			for _, h := range held {
+				if h.Origin == inventory.OriginAccepted {
+					m.Accepted = append(m.Accepted, snapshot.Accepted{Module: module, Name: h.Name,
+						Provider: scrub.Machine(h.Provider), Local: h.Local})
+				}
+			}
+			layers, err := inv.SettingsFor(ctx, n.Name, module)
+			if err != nil {
+				return snapshot.Facts{}, err
+			}
+			for _, layer := range layers {
+				if layer.From == catalogue.MeshWideLayer {
+					if !meshWide[module] {
+						meshWide[module] = true
+						f.Settings = append(f.Settings, snapshot.Settings{Module: module, Values: scrub.Values(layer.Values)})
+					}
+					continue
+				}
+				m.Settings = append(m.Settings, snapshot.Settings{Module: module, Values: scrub.Values(layer.Values)})
+			}
+		}
+		m.Declaration = declarationFacts(ctx, open, n.Name, gens, gensErr, scrub)
+		if ctx.Err() != nil {
+			return snapshot.Facts{}, ctx.Err()
+		}
+		f.Machines = append(f.Machines, m)
+	}
+	for e := range engines {
+		f.Versions.NodeEngines = append(f.Versions.NodeEngines, e)
+	}
+
+	// Seats and their holders, and from them the roles a machine is named by.
+	roles := map[string][]string{}
+	seats := map[string]*snapshot.Seat{}
+	for _, h := range holdings {
+		key := h.Claim + "\x00" + h.Scope
+		s, ok := seats[key]
+		if !ok {
+			s = &snapshot.Seat{Name: h.Claim, Scope: h.Scope}
+			seats[key] = s
+		}
+		s.Holders = append(s.Holders, snapshot.Holder{Machine: scrub.Machine(h.Node), Module: h.Module})
+		if h.Scope == catalogue.ScopeMesh {
+			role := "holds " + h.Claim
+			if h.Claim == catalogue.ControllerSeatName {
+				role = "the control node"
+			}
+			roles[h.Node] = append(roles[h.Node], role)
+		}
+	}
+	for _, s := range seats {
+		f.Seats = append(f.Seats, *s)
+	}
+	for i := range f.Machines {
+		for _, n := range nodes {
+			if scrub.Machine(n.Name) != f.Machines[i].Name {
+				continue
+			}
+			f.Machines[i].Roles = roles[n.Name]
+			if f.Machines[i].Hub {
+				f.Machines[i].Roles = append(f.Machines[i].Roles, "the hub")
+			}
+		}
+	}
+
+	// Every module, as the mesh holds it, and where it is built from.
+	newest := map[string]inventory.Source{}
+	count := map[string]int{}
+	for _, e := range entries {
+		raw, err := json.Marshal(e.Manifest)
+		if err != nil {
+			return snapshot.Facts{}, err
+		}
+		mod := snapshot.Module{Name: e.Manifest.Module, Repository: snapshot.RepositoryName(e.Source.Repository), Path: e.Source.Path,
+			Commit: e.Source.BuiltFrom, Provided: e.Provided, RollOut: current[e.Manifest.Module].RollOut,
+			Manifest: raw}
+		for _, r := range read[e.Manifest.Module] {
+			mod.Reads = append(mod.Reads, snapshot.RepositoryName(r.Repository))
+		}
+		f.Modules = append(f.Modules, mod)
+		if e.Provided || e.Source.Repository == "" {
+			continue
+		}
+		count[e.Source.Repository]++
+		if was, ok := newest[e.Source.Repository]; !ok || e.Source.Seen.After(was.Seen) {
+			newest[e.Source.Repository] = e.Source
+		}
+	}
+	for repository, s := range newest {
+		commit := s.Head
+		if commit == "" {
+			commit = s.BuiltFrom
+		}
+		f.Sources = append(f.Sources, snapshot.Source{Repository: snapshot.RepositoryName(repository), Commit: commit,
+			Modules: count[repository]})
+	}
+	for _, e := range edges {
+		f.Edges = append(f.Edges, snapshot.Edge{From: e.From, To: e.To, Kind: e.Kind})
+	}
+	f.Sorted()
+	return f, nil
+}
+
+// declarationFacts is how one machine's declaration composes now, as the next push would compose it and
+// without making anything (D1's composition), and whether the node-engine's validator takes it.
+func declarationFacts(ctx context.Context, open *stores, node string, gens map[string]catalogue.Generator,
+	gensErr error, scrub *snapshot.Scrubber) snapshot.Declaration {
+	var d snapshot.Declaration
+	if gensErr != nil {
+		d.Problems = []string{scrub.Text("the private network cannot be computed: " + oneLine(gensErr.Error()))}
+		return d
+	}
+	declared, problems, err := composedAndValidated(ctx, open, node, gens, Foreseeing)
+	if err != nil {
+		d.Problems = []string{scrub.Text(oneLine(err.Error()))}
+		return d
+	}
+	for _, p := range problems {
+		d.Problems = append(d.Problems, scrub.Text(p))
+	}
+	d.Composes = len(problems) == 0
+	if body, err := declared.Body(); err == nil {
+		d.Digest = fmt.Sprintf("sha256:%x", sha256.Sum256(body))
+	}
+	// Scrubbed like every other word: a resource is named after the machine a grant is for.
+	for _, r := range resourceNames(declared.Resources) {
+		d.Resources = append(d.Resources, scrub.Text(r))
+	}
+	for module, why := range declared.leftOutWhy {
+		if d.LeftOut == nil {
+			d.LeftOut = map[string]string{}
+		}
+		d.LeftOut[module] = scrub.Text(why)
+	}
+	for _, o := range declared.withheld {
+		d.Withheld = append(d.Withheld, scrub.Text(o.String()))
+	}
+	for _, u := range declared.unbound {
+		d.Unbound = append(d.Unbound, scrub.Text(u.String()))
+	}
+	sort.Strings(d.Withheld)
+	sort.Strings(d.Unbound)
+	return d
+}
+
+// composedAndValidated composes one machine's declaration — as a push would (Allocating) or as the next
+// push will without making anything (Foreseeing) — with the order it was last sent, and runs the
+// node-engine's own validator over the body. An error is that it did not compose; problems are what the
+// validator refuses.
+func composedAndValidated(ctx context.Context, open *stores, node string, gens map[string]catalogue.Generator,
+	choosing Choosing) (sendable, []string, error) {
+	plan, settings, err := planFor(ctx, open, node)
+	if err != nil {
+		return sendable{}, nil, err
+	}
+	declared, err := declarationWith(ctx, open, node, plan, settings, gens, choosing)
+	if err != nil {
+		return sendable{}, nil, err
+	}
+	record, err := open.inventory.NodeByName(ctx, node)
+	if err != nil {
+		return sendable{}, nil, err
+	}
+	if declared.Sequence, err = open.inventory.Sequence(ctx, record.ID); err != nil {
+		return sendable{}, nil, err
+	}
+	if declared.Epoch, err = open.inventory.SentEpoch(ctx, record.ID); err != nil {
+		return sendable{}, nil, err
+	}
+	body, err := declared.Body()
+	if err != nil {
+		return sendable{}, nil, err
+	}
+	return declared, validate.Declaration(body), nil
+}
+
+// resourceNames are a declaration's resources as `type:id`, sorted.
+func resourceNames(resources []map[string]any) []string {
+	out := make([]string, 0, len(resources))
+	for _, r := range resources {
+		kind, _ := r["type"].(string)
+		id, _ := r["id"].(string)
+		out = append(out, kind+":"+id)
+	}
+	sort.Strings(out)
+	return out
+}
+
+// systemOf is the system a node-engine of that version was built for, read from the build the mesh
+// holds: the artifact a resource delivered into `versions/<version>` came from is named for its system
+// (`host-arch`). Empty when the version is not a delivered one — an engine placed by hand.
+func systemOf(host catalogue.Manifest, version string) string {
+	if version == "" {
+		return ""
+	}
+	for _, r := range host.Resources {
+		path, _ := r["path"].(string)
+		if !strings.HasSuffix(path, "/versions/"+version) {
+			continue
+		}
+		source, _ := r["source"].(string)
+		for _, part := range strings.Split(source, "/") {
+			if system, ok := strings.CutPrefix(part, "host-"); ok && system != "" {
+				return system
+			}
+		}
+	}
+	return ""
+}
+
+// libcOf is the C library of a system the node-engine is built for.
+func libcOf(system string) string {
+	switch system {
+	case "arch":
+		return "glibc"
+	case "alpine":
+		return "musl"
+	case "android":
+		return "bionic"
+	}
+	return ""
+}
+
+// factsCommand is `facts`: what the controller keeps, and keeping it now.
+//
+//	facts                 the snapshot the artifact store holds: when, which, how many machines
+//	facts show            the same, whole, as JSON
+//	facts export          compose and keep one now
+//	facts compose         compose one and print it, keeping nothing
+func factsCommand(ctx context.Context, args []string) error {
+	set := flag.NewFlagSet("facts", flag.ContinueOnError)
+	rest, err := parseAround(set, args)
+	if err != nil {
+		return err
+	}
+	what := ""
+	if len(rest) > 0 {
+		what = rest[0]
+	}
+	open, err := openStores(ctx)
+	if err != nil {
+		return err
+	}
+	defer open.Close()
+	switch what {
+	case "", "show":
+		address, err := factsStore(ctx, open)
+		if err != nil {
+			return err
+		}
+		body, digest, err := (artifacts.Store{Address: address}).GetTagged(ctx, snapshot.Repository, snapshot.Tag)
+		if err != nil {
+			return err
+		}
+		if what == "show" {
+			_, err := os.Stdout.Write(body)
+			return err
+		}
+		f, err := snapshot.Decode(body)
+		if err != nil {
+			return err
+		}
+		fmt.Printf("the facts snapshot kept as %s:%s is %s, taken %s (%s ago) by controller %s\n",
+			snapshot.Repository, snapshot.Tag, short(strings.TrimPrefix(digest, "sha256:")),
+			f.Taken.Format(time.RFC3339), ago(time.Since(f.Taken)), orNone(f.Controller.Commit))
+		fmt.Printf("  %d machine(s), %d module(s), %d seat(s); the longest machine name is %d characters\n",
+			len(f.Machines), len(f.Modules), len(f.Seats), f.Longest())
+		fmt.Printf("  the bus runs %s, the store %s\n", orNone(f.Versions.Bus), orNone(f.Versions.Store))
+		for _, m := range f.Machines {
+			state := "composes"
+			if !m.Declaration.Composes {
+				state = "does NOT compose: " + strings.Join(m.Declaration.Problems, "; ")
+			}
+			fmt.Printf("  %-12s %s; %d module(s); %s\n", m.Name, m.Described(), len(m.Assigned), state)
+		}
+		return nil
+	case "export", "compose":
+		busVersion := ""
+		if server, err := connectLink(ctx, nil, nil, nil); err == nil {
+			busVersion = busVersionOf(server)
+			server.Close()
+		}
+		if what == "compose" {
+			f, err := gatherFacts(ctx, open, busVersion)
+			if err != nil {
+				return err
+			}
+			body, err := f.Encode()
+			if err != nil {
+				return err
+			}
+			_, err = os.Stdout.Write(append(body, '\n'))
+			return err
+		}
+		digest, err := exportFacts(ctx, open, busVersion, true)
+		if err != nil {
+			return err
+		}
+		fmt.Printf("the facts snapshot is kept as %s:%s, %s\n", snapshot.Repository, snapshot.Tag, digest)
+		return nil
+	}
+	return fmt.Errorf("facts [show|export|compose], not %q", what)
+}
+
+// busVersionOf is the bus server's release, as it told this connection.
+func busVersionOf(server *link.Server) string {
+	if bus, ok := server.Bus().(link.OverNATS); ok && bus.Conn != nil {
+		return bus.Conn.ConnectedServerVersion()
+	}
+	return ""
+}

cmd/mesh-controller/facts_test.go

@@ -0,0 +1,137 @@
+package main
+
+import (
+	"regexp"
+	"strings"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	snapshot "github.com/novox/mesh-controller/internal/facts"
+)
+
+// The facts snapshot (novox/hq to-be 45 §9): composed from the store, every machine under a pseudonym
+// of its name's length, and nothing of the installation in it — no secret, no address, no name.
+
+// aMeshWithSecrets is aMesh with a provider and its consumers, a value given by hand, settings carrying
+// a password, an address and a machine's name, and a push's worth of credentials made.
+func aMeshWithSecrets(t *testing.T) (*stores, []string) {
+	t.Helper()
+	open := aMesh(t)
+	ctx := t.Context()
+	register(t, open, catalogue.Manifest{Module: "objects", Version: "1",
+		Provides: []catalogue.Offer{{Name: "s3-bucket", Scope: catalogue.ScopeMesh,
+			Identity: &catalogue.OfferIdentity{Max: 20, In: "an S3 access key"}}},
+		Receives: map[string]string{"s3-bucket": "/var/lib/mesh/objects/mesh.json"}})
+	register(t, open, catalogue.Manifest{Module: "files", Version: "1", Requires: []string{"s3-bucket"},
+		Resources: []map[string]any{{"id": "config", "type": "file", "path": "/etc/files/config.json",
+			"mode": "0600", "content": "{}", "merge": "json"}}})
+	for _, a := range [][2]string{{"anchor", "objects"}, {"laptop", "files"}} {
+		if _, err := assign(ctx, open, a[0], a[1]); err != nil {
+			t.Fatalf("assign %s %s: %v", a[0], a[1], err)
+		}
+	}
+	secrets := []string{"Hunter2-Is-Not-A-Password-9f8e7d", "0123456789abcdefABCDEF0123456789zz"}
+	if err := open.inventory.SetSettings(ctx, "", "files", map[string]any{
+		"admin_password": secrets[0], "upstream": "10.77.0.9", "hub": "anchor"}); err != nil {
+		t.Fatal(err)
+	}
+	if err := open.inventory.SetSettings(ctx, "laptop", "files", map[string]any{
+		"note": "reach me at 192.168.1.135, token " + secrets[1]}); err != nil {
+		t.Fatal(err)
+	}
+	// A push's worth of composition, which makes the pair credential the consumer is sent.
+	gens, err := generators(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, node := range []string{"laptop", "anchor"} {
+		if _, _, err := composedAndValidated(ctx, open, node, gens, Allocating); err != nil {
+			t.Fatalf("%s does not compose: %v", node, err)
+		}
+	}
+	issued, err := open.inventory.SecretsFrom(ctx, "anchor")
+	if err != nil || len(issued) == 0 {
+		t.Fatalf("no credential was made for the consumer: %v", err)
+	}
+	for _, s := range issued {
+		// Sealed, never kept plain (ADR 0004): the sealed blobs are what the store holds, and none may leave.
+		secrets = append(secrets, s.ForConsumer, s.ForProvider)
+	}
+	return open, secrets
+}
+
+func TestTheFactsCarryNoSecretNoAddressAndNoName(t *testing.T) {
+	open, secrets := aMeshWithSecrets(t)
+	f, err := gatherFacts(t.Context(), open, "2.11.17")
+	if err != nil {
+		t.Fatal(err)
+	}
+	body, err := f.Encode()
+	if err != nil {
+		t.Fatal(err)
+	}
+	text := string(body)
+	for _, s := range secrets {
+		if s != "" && strings.Contains(text, s) {
+			t.Errorf("a secret is in the snapshot: %q", s)
+		}
+	}
+	for _, leaked := range []string{"anchor", "laptop", "10.77.0.", "192.168.1.135", ".example:51820"} {
+		if strings.Contains(text, leaked) {
+			t.Errorf("%q is in the snapshot", leaked)
+		}
+	}
+	// Every address it carries is a documentation address.
+	for _, a := range regexp.MustCompile(`\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b`).FindAllString(text, -1) {
+		if !strings.HasPrefix(a, "192.0.2.") && !strings.HasPrefix(a, "198.51.100.") && !strings.HasPrefix(a, "203.0.113.") {
+			t.Errorf("%s is an address outside the documentation ranges", a)
+		}
+	}
+
+	// What a check needs is there: every machine, its length, its modules, its declaration composing.
+	if len(f.Machines) != 2 || f.Longest() != len("laptop") {
+		t.Fatalf("machines %+v, longest %d", f.Machines, f.Longest())
+	}
+	anchor := snapshot.Pseudonym("machine", "anchor")
+	m, ok := f.Machine(anchor)
+	if !ok || !m.Hub || !strings.Contains(m.Described(), "the hub") || len(m.Name) != len("anchor") {
+		t.Fatalf("the anchor reads as %+v", m)
+	}
+	if !m.Declaration.Composes || m.Declaration.Digest == "" || len(m.Declaration.Resources) == 0 {
+		t.Errorf("the anchor's declaration reads as %+v", m.Declaration)
+	}
+	laptop, _ := f.Machine(snapshot.Pseudonym("machine", "laptop"))
+	if strings.Join(laptop.Assigned, ",") != "files,mesh-wireguard" && !strings.Contains(strings.Join(laptop.Assigned, ","), "files") {
+		t.Errorf("the laptop's assignments read as %v", laptop.Assigned)
+	}
+	var meshWide map[string]any
+	for _, s := range f.Settings {
+		if s.Module == "files" {
+			meshWide = s.Values
+		}
+	}
+	if meshWide["admin_password"] != snapshot.Withheld || meshWide["hub"] != anchor {
+		t.Errorf("the mesh-wide settings read as %v", meshWide)
+	}
+	if f.Versions.Bus != "2.11.17" || f.Versions.Store == "" {
+		t.Errorf("versions read as %+v", f.Versions)
+	}
+	var objects bool
+	for _, mod := range f.Modules {
+		objects = objects || mod.Name == "objects" && len(mod.Manifest) > 0
+	}
+	if !objects {
+		t.Error("the modules the mesh holds are not in the snapshot")
+	}
+
+	// And an unchanged mesh is the same content a moment later.
+	again, err := gatherFacts(t.Context(), open, "2.11.17")
+	if err != nil {
+		t.Fatal(err)
+	}
+	a, _ := f.Content()
+	b, _ := again.Content()
+	if a != b {
+		t.Error("two snapshots of an unchanged mesh differ, so it would be written again every ten minutes")
+	}
+}

cmd/mesh-controller/found_wait_test.go

@@ -0,0 +1,156 @@
+package main
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// A directory the node-engine uses as found (novox/hq issue 339) waits for a person to hand it over at the
+// machine. Found before this send, it is no fault of the build: the gate passes with the wait carried, so an
+// urgent fix of that module still goes through. Found by this send, the send brought it, and the gate holds.
+func foundDirectory(module string, since time.Time) inventory.ResourceHealth {
+	return inventory.ResourceHealth{Module: module, Resource: module + ".data", Kind: link.KindDirectory,
+		Target: "/srv/" + module, State: link.StateUnhealthy, Since: since,
+		Reason: link.ReasonUsedAsFound + " owned by 1000:1000, mode 700, as found; root, mode 755 was declared and " +
+			"not given it — `mesh-host hand-over` at the machine hands it to the mesh"}
+}
+
+func TestADirectoryFoundBeforeTheSendIsAWaitForAPerson(t *testing.T) {
+	now := time.Now()
+	sent := now.Add(-time.Minute)
+	f := gateFacts{now: now, health: map[string]inventory.NodeHealth{"laptop": {Node: "laptop", HeardAt: now,
+		Resources: []inventory.ResourceHealth{foundDirectory("notes", sent.Add(-24*time.Hour))}}}}
+	h, why := moduleHealthWord("notes", "laptop", sent, f)
+	if h != healthPerson || !strings.Contains(why, "notes.data") || !strings.Contains(why, "hand-over") {
+		t.Fatalf("a directory found before the send reads %v %q; want a wait for a person", h, why)
+	}
+	// Found by this very send: the send brought it, and it is not passed.
+	f.health["laptop"] = inventory.NodeHealth{Node: "laptop", HeardAt: now,
+		Resources: []inventory.ResourceHealth{foundDirectory("notes", sent.Add(time.Second))}}
+	if h, why := moduleHealthWord("notes", "laptop", sent, f); h != healthNotYet {
+		t.Fatalf("a directory this send found reads %v %q; want not yet", h, why)
+	}
+	// A container down beside the old wait is a fault, as before.
+	f.health["laptop"] = inventory.NodeHealth{Node: "laptop", HeardAt: now, Resources: []inventory.ResourceHealth{
+		foundDirectory("notes", sent.Add(-time.Hour)),
+		{Module: "notes", Resource: "notes.web", Kind: "container", Target: "notes", State: link.StateUnhealthy, Reason: "down"}}}
+	if h, why := moduleHealthWord("notes", "laptop", sent, f); h != healthNotYet {
+		t.Fatalf("a container down beside the wait reads %v %q; want not yet", h, why)
+	}
+}
+
+// The whole walk: a module whose directory was used as found long before still gets its fix to every machine,
+// its pass kept and the wait said; a directory this very send found holds it and puts it back.
+func TestAFixGoesThroughPastADirectoryFoundBefore(t *testing.T) {
+	for _, c := range []struct {
+		name   string
+		found  time.Duration // when the directory was found, against now
+		passes bool
+	}{
+		{"found a day before the send", -24 * time.Hour, true},
+		{"found by this send", time.Hour, false},
+	} {
+		t.Run(c.name, func(t *testing.T) {
+			b := aBacklog(t)
+			ctx := t.Context()
+			inv := b.open.inventory
+			releaseHeard = func(context.Context, *stores) (map[string]bool, error) {
+				return map[string]bool{"anchor": true, "laptop": true}, nil
+			}
+			backlogFacts := gatherGateFacts
+			gatherGateFacts = func(ctx context.Context, open *stores, component string) (gateFacts, error) {
+				f, err := backlogFacts(ctx, open, component)
+				// The used-as-found condition, raised after the send (its second statement): its own kind, never a
+				// fault the gate reads as the build's.
+				f.judged, f.openErr = true, nil
+				f.open = append(f.open, conditions.Condition{Key: usedAsFoundKey("app", "anchor"), Kind: kindUsedAsFound,
+					Subject: conditions.Subject{Scope: conditions.ScopeModule, ID: "app.anchor", Machine: "anchor"},
+					Raised:  time.Now()})
+				f.health = map[string]inventory.NodeHealth{}
+				for _, n := range []string{"anchor", "laptop"} {
+					f.health[n] = inventory.NodeHealth{Node: n, HeardAt: time.Now(), Resources: []inventory.ResourceHealth{
+						{Module: "app", Resource: "app.web", Kind: "container", Target: "app", State: link.StateHealthy},
+						foundDirectory("app", time.Now().Add(c.found)),
+						{Module: "late", Resource: "late.web", Kind: "container", Target: "late", State: link.StateHealthy}}}
+				}
+				return f, err
+			}
+			wasSettle, wasEvery, wasBound := gateSettle, gateEvery, gateBound
+			t.Cleanup(func() { gateSettle, gateEvery, gateBound = wasSettle, wasEvery, wasBound })
+			gateSettle, gateEvery, gateBound = 0, 0, 300*time.Millisecond
+			deadline := time.Now().Add(5 * time.Second)
+			for time.Now().Before(deadline) {
+				advancePlans(ctx, b.open)
+				if p := b.release(t); p.State != inventory.PlanRolling {
+					break
+				}
+				time.Sleep(20 * time.Millisecond)
+			}
+			p := b.release(t)
+			v, found, err := inv.GateOf(ctx, "build-app-c2")
+			if c.passes {
+				if p.State != inventory.PlanDone || err != nil || !found || v.Verdict != inventory.GatePassed {
+					t.Fatalf("the walk is %s (%s); app's verdict %+v: want the fix through", p.State, p.Note, v)
+				}
+				if !strings.Contains(v.Why+p.Note, "hand it over") {
+					t.Errorf("the wait is not carried: verdict %q, walk %q", v.Why, p.Note)
+				}
+				return
+			}
+			if p.State == inventory.PlanDone {
+				t.Fatalf("a directory this send found let the walk through: %s", p.Note)
+			}
+		})
+	}
+}
+
+// The condition says the wait in its own kind: the operator's, never urgent, and cleared once handed over.
+func TestADirectoryUsedAsFoundIsItsOwnCondition(t *testing.T) {
+	k, _ := withConditionsInMemory(t)
+	ctx := t.Context()
+	rs := map[string][]inventory.ResourceHealth{"notes": {foundDirectory("notes", time.Now().Add(-time.Hour))}}
+	for i := 0; i < 2; i++ {
+		if err := judgeModuleHealth(ctx, nil, k, "laptop", rs, map[string]int{"notes": i + 1}, time.Now()); err != nil {
+			t.Fatal(err)
+		}
+	}
+	open, _ := k.Open(ctx)
+	var got *conditions.Condition
+	for i, c := range open {
+		if c.Key == usedAsFoundKey("notes", "laptop") {
+			got = &open[i]
+		}
+		if c.Kind == kindModuleUnhealthy {
+			t.Fatalf("raised as a fault: %+v", c)
+		}
+	}
+	if got == nil || got.Resolver != conditions.ResolverOperator || got.Severity == conditions.Urgent ||
+		!strings.Contains(got.Summary, "notes.data") {
+		t.Fatalf("the condition: %+v", got)
+	}
+	// Long open is still not urgent: only a person can hand it over, and nothing is broken by the wait.
+	if err := judgeModuleHealth(ctx, nil, k, "laptop", rs, map[string]int{"notes": 3}, time.Now().Add(48*time.Hour)); err != nil {
+		t.Fatal(err)
+	}
+	open, _ = k.Open(ctx)
+	for _, c := range open {
+		if c.Key == usedAsFoundKey("notes", "laptop") && c.Severity == conditions.Urgent {
+			t.Fatal("a directory used as found became urgent")
+		}
+	}
+	if err := judgeModuleHealth(ctx, nil, k, "laptop", map[string][]inventory.ResourceHealth{}, nil, time.Now()); err != nil {
+		t.Fatal(err)
+	}
+	open, _ = k.Open(ctx)
+	for _, c := range open {
+		if c.Key == usedAsFoundKey("notes", "laptop") {
+			t.Fatal("not cleared once handed over")
+		}
+	}
+}

cmd/mesh-controller/foundation_scope_test.go

@@ -1,33 +0,0 @@
-package main
-
-// The broker opening belongs only on the node that listens on it (novox/hq: it leaked onto
-// every enrolled node's declaration, opening a from-anywhere hole for a port nothing there
-// serves). foundationPortsFor is the scope.
-
-import (
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/catalogue"
-)
-
-func TestTheBrokerHostGetsTheFoundationOpening(t *testing.T) {
-	broker := catalogue.Manifest{Module: "lavinmq", Listens: []catalogue.Listening{
-		{Port: 5671, Protocol: "tcp", From: "mesh"},
-		{Port: 5672, Protocol: "tcp", From: "mesh"},
-	}}
-	got := foundationPortsFor(5671, []catalogue.Manifest{broker})
-	if len(got) != 1 || got[0] != 5671 {
-		t.Fatalf("the node that listens on the broker port keeps it; got %v", got)
-	}
-}
-
-func TestANodeThatOnlyDialsTheBrokerGetsNoOpening(t *testing.T) {
-	// ace's set: things that reach the broker as a client, none listening on 5671.
-	ace := []catalogue.Manifest{
-		{Module: "plex", Listens: []catalogue.Listening{{Port: 32400, Protocol: "tcp", From: "anywhere"}}},
-		{Module: "postgres", Listens: []catalogue.Listening{{Port: 5432, Protocol: "tcp", From: "mesh"}}},
-	}
-	if got := foundationPortsFor(5671, ace); got != nil {
-		t.Fatalf("a node that only dials out opens nothing for the broker; got %v", got)
-	}
-}

cmd/mesh-controller/gate_followup_test.go

@@ -0,0 +1,453 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"reflect"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/lease"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// What the review of issue 318's fix found (novox/hq ADR 0254): every module of a send leaves it with a
+// verdict, a pass is counted no faster than the gate's spacing, a carried build's verdict carries only its own
+// wait, and a provider waiting for a login says who waits on it.
+
+// withGateBounds sets the gate's bounds for one test.
+func withGateBounds(t *testing.T, settle, every, bound time.Duration) {
+	t.Helper()
+	wasSettle, wasEvery, wasBound := gateSettle, gateEvery, gateBound
+	gateSettle, gateEvery, gateBound = settle, every, bound
+	t.Cleanup(func() { gateSettle, gateEvery, gateBound = wasSettle, wasEvery, wasBound })
+}
+
+// factsOn is a judging's facts for one machine that applied its send: the node tools answer, and what it says
+// of its modules' resources.
+func factsOn(t *testing.T, machine string, since time.Time, rs ...inventory.ResourceHealth) func() gateFacts {
+	return func() gateFacts {
+		now := time.Now()
+		at := now
+		return gateFacts{now: now,
+			reports:    map[string]inventory.Reported{machine: {Node: machine, Outcome: inventory.OutcomeApplied, At: &at, Current: true}},
+			engines:    map[string]string{},
+			rolledBack: map[string][]lease.Rollback{},
+			served:     map[string]served{machine: {runtime: true, tools: map[string]bool{}}},
+			health:     map[string]inventory.NodeHealth{machine: {Node: machine, HeardAt: now, Resources: rs}},
+		}
+	}
+}
+
+func healthyContainer(module string) inventory.ResourceHealth {
+	return inventory.ResourceHealth{Module: module, Resource: module + ".web", Kind: "container", Target: module,
+		State: link.StateHealthy}
+}
+
+// **A fault decided before the settle time does not strand the module beside it** (review (a)): the node
+// tools' witness put its build back at once, and the send waits for the healthy module's own verdict — a pass,
+// counted over the gate's spacing — before it says its own. The broken one alone is put back.
+func TestAFaultBeforeTheSettleTimeWaitsForTheModuleBesideIt(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	withGateBounds(t, 150*time.Millisecond, 20*time.Millisecond, 10*time.Second)
+	since := time.Now().Add(-time.Second)
+	base := factsOn(t, "laptop", since, healthyContainer("app"))
+	wasGather := gatherGateFacts
+	t.Cleanup(func() { gatherGateFacts = wasGather })
+	gatherGateFacts = func(context.Context, *stores, string) (gateFacts, error) {
+		f := base()
+		f.rolledBack["laptop"] = []lease.Rollback{{Component: lease.ComponentNodeTools, Outcome: lease.OutcomeRolledBack,
+			At: since.Add(100 * time.Millisecond), Why: "the node tools did not answer"}}
+		return f, nil
+	}
+	g := &inventory.PlanGate{Machines: []string{"laptop"}, Since: &since}
+	pairs := []judged{{module: broker_runtime, node: "laptop"}, {module: "app", node: "laptop"}}
+	judgings := 0
+	for deadline := time.Now().Add(5 * time.Second); g.Verdict == "" && time.Now().Before(deadline); {
+		if _, err := judgeMoves(ctx, open, g, pairs, time.Now()); err != nil {
+			t.Fatal(err)
+		}
+		judgings++
+		time.Sleep(30 * time.Millisecond)
+	}
+	if g.Verdict != inventory.GateFailed || judgings < gatePasses {
+		t.Fatalf("verdict %q after %d judging(s): %+v; want failed, after the module beside it was judged", g.Verdict,
+			judgings, g)
+	}
+	if !reflect.DeepEqual(g.Passing, []string{"app"}) || !reflect.DeepEqual(g.Failing, []string{broker_runtime}) {
+		t.Fatalf("passing %v, failing %v; want app kept and the node tools put back", g.Passing, g.Failing)
+	}
+	if !strings.Contains(g.Why, "witness") {
+		t.Errorf("the verdict does not say what broke: %q", g.Why)
+	}
+}
+
+// broker_runtime is the node tools' module name, a core component a witness judges.
+const broker_runtime = "node-tools"
+
+// **A pass is counted only the gate's spacing after the one before** (review (c)): a send judged every tick
+// while a module beside it is not yet healthy counts the healthy one once.
+func TestAPassIsCountedNoFasterThanTheGatesSpacing(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	withGateBounds(t, 0, time.Hour, time.Hour)
+	since := time.Now().Add(-time.Minute)
+	base := factsOn(t, "laptop", since, healthyContainer("app"), inventory.ResourceHealth{Module: "late",
+		Resource: "late.web", Kind: "container", Target: "late", State: link.StateUnhealthy, Reason: "down"})
+	wasGather := gatherGateFacts
+	t.Cleanup(func() { gatherGateFacts = wasGather })
+	gatherGateFacts = func(context.Context, *stores, string) (gateFacts, error) { return base(), nil }
+	g := &inventory.PlanGate{Machines: []string{"laptop"}, Since: &since}
+	pairs := []judged{{module: "app", node: "laptop"}, {module: "late", node: "laptop"}}
+	now := time.Now()
+	for i := 0; i < 3; i++ {
+		if _, err := judgeMoves(ctx, open, g, pairs, now.Add(time.Duration(i)*time.Second)); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if g.Healthy["app"] != 1 || g.Healthy["late"] != 0 {
+		t.Fatalf("counted %v in three judgings within a second; want app once and late never", g.Healthy)
+	}
+}
+
+// **A carried build's pass carries its own wait, never another's** (review (e)).
+func TestACarriedPassCarriesOnlyItsOwnWait(t *testing.T) {
+	b := aBacklog(t)
+	ctx := t.Context()
+	inv := b.open.inventory
+	since := time.Now().Add(-time.Minute)
+	g := &inventory.PlanGate{Machines: []string{"laptop"}, Since: &since, Verdict: inventory.GatePassed,
+		Why:   "healthy 3 times over 2m0s" + waitsSaid(map[string]string{"late": "relogin needed on laptop: late waits"}),
+		Waits: map[string]string{"late": "relogin needed on laptop: late waits"},
+		Carried: []inventory.CarriedMove{{Module: "app", Node: "laptop", From: "c1", To: "c2", Build: "build-app-c2"},
+			{Module: "late", Node: "laptop", From: "c1", To: "c2", Build: "build-late-c2"}}}
+	passCarried(ctx, b.open, &inventory.Plan{ID: "release-test"}, g, "")
+	app, _, _ := inv.GateOf(ctx, "build-app-c2")
+	late, _, _ := inv.GateOf(ctx, "build-late-c2")
+	if strings.Contains(app.Why, "waits for a person") || app.Verdict != inventory.GatePassed {
+		t.Errorf("app's pass: %+v; want it without late's wait", app)
+	}
+	if !strings.Contains(late.Why, "relogin needed on laptop") {
+		t.Errorf("late's pass: %+v; want its own wait", late)
+	}
+}
+
+// **The tier path keeps the pass of the module the gate is kept on** (review (b)): a plan's first send
+// carried its own module, healthy, and a build waiting on that machine that never became healthy. At the
+// bound the waiting one is put back and marked; the plan's own module keeps its pass, so no walk waits on it.
+func TestThePlansOwnModuleKeepsItsPassWhenItsSendFails(t *testing.T) {
+	g := aGateMesh(t)
+	ctx := t.Context()
+	inv := g.open.inventory
+	// `late` waits on anchor for a gate: c1 sent, c2 registered and built.
+	for _, b := range []inventory.Build{
+		{ID: "build-late-1", Module: "late", Commit: "l1", Repository: "novox/mesh-catalog", Path: "modules/late",
+			Asked: time.Now().Add(-2 * time.Hour), At: time.Now().Add(-2 * time.Hour)},
+		{ID: "build-late-2", Module: "late", Commit: "l2", Repository: "novox/mesh-catalog", Path: "modules/late",
+			Asked: time.Now().Add(-time.Minute), At: time.Now().Add(-time.Minute)},
+	} {
+		manifest, _ := json.Marshal(catalogue.Manifest{Module: "late", Version: b.Commit})
+		b.Manifest = manifest
+		b.Made = []inventory.Artifact{{Name: "x", Kind: "bundle", Reference: "sha256:" + b.Commit}}
+		if err := inv.RecordBuild(ctx, b); err != nil {
+			t.Fatal(err)
+		}
+		if err := inv.RegisterModule(ctx, catalogue.Manifest{Module: "late", Version: b.Commit}, inventory.Source{
+			Repository: "novox/mesh-catalog", Seat: "git", Path: "modules/late", BuiltFrom: b.Commit, Head: b.Commit,
+			Asked: b.Asked}); err != nil {
+			t.Fatal(err)
+		}
+		if b.Commit == "l1" {
+			if _, err := inv.Assign(ctx, "anchor", "late"); err != nil {
+				t.Fatal(err)
+			}
+			if err := inv.RecordSent(ctx, nodeID(t, g.open, "anchor"), "d-anchor-late", map[string]string{"app": "c1",
+				"late": "l1"}); err != nil {
+				t.Fatal(err)
+			}
+		}
+	}
+	wasMoves := machineMoves
+	t.Cleanup(func() { machineMoves = wasMoves })
+	machineMoves = func(ctx context.Context, open *stores, f moveFacts, node string, all bool) ([]inventory.CarriedMove, error) {
+		modules, err := open.inventory.Assigned(ctx, node)
+		if err != nil {
+			return nil, err
+		}
+		sent, known, err := open.inventory.SentBuilds(ctx, node)
+		if err != nil {
+			return nil, err
+		}
+		return f.moves(node, modules, sent, known, all), nil
+	}
+	gather := gatherGateFacts
+	gatherGateFacts = func(ctx context.Context, open *stores, component string) (gateFacts, error) {
+		f, err := gather(ctx, open, component)
+		f.health = map[string]inventory.NodeHealth{"anchor": {Node: "anchor", HeardAt: time.Now(), Resources: []inventory.ResourceHealth{
+			healthyContainer("app"), {Module: "late", Resource: "late.web", Kind: "container", Target: "late",
+				State: link.StateUnhealthy, Reason: "down"}}}}
+		return f, err
+	}
+	gateEvery, gateBound = 0, 400*time.Millisecond
+	for deadline := time.Now().Add(5 * time.Second); time.Now().Before(deadline); {
+		advancePlans(ctx, g.open)
+		if p := g.plan(t); p.State == inventory.PlanFailed || p.State == inventory.PlanDone {
+			break
+		}
+		time.Sleep(30 * time.Millisecond)
+	}
+	p := g.plan(t)
+	if p.State != inventory.PlanFailed {
+		t.Fatalf("the plan is %s: %s; want it failed on late", p.State, p.Note)
+	}
+	if v, found, err := inv.GateOf(ctx, "build-2"); err != nil || !found || v.Verdict != inventory.GatePassed ||
+		!strings.Contains(v.Why, "on its own") {
+		t.Fatalf("app's verdict: %+v (found %v, %v); want its own pass kept", v, found, err)
+	}
+	if failed, _ := inv.GateFailed(ctx, "build-late-2"); !failed {
+		t.Fatal("late's build is not marked failed at its gate")
+	}
+	if current, _ := inv.CurrentBuilds(ctx); current["app"].Commit != "c2" || current["late"].Commit != "l1" {
+		t.Fatalf("registered app %s, late %s; want app kept at c2 and late put back to l1", current["app"].Commit,
+			current["late"].Commit)
+	}
+}
+
+// **A provider waiting for a login says who waits on it** (review (g)): its consumer, failing a check that
+// needs it, is held under it, and the provider's relogin-needed condition lists it and is urgent.
+func TestAProviderWaitingForALoginSaysWhoWaitsOnIt(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	k := conditionsFrom
+	register(t, open, catalogue.Manifest{Module: "db", Version: "1",
+		Provides: []catalogue.Offer{{Name: "postgres-database", Scope: catalogue.ScopeMesh}}})
+	register(t, open, catalogue.Manifest{Module: "shop", Version: "1", Requires: []string{"postgres-database"}})
+	for _, a := range [][2]string{{"anchor", "db"}, {"laptop", "shop"}} {
+		if _, err := inv.Assign(ctx, a[0], a[1]); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := inv.RecordBindings(ctx, "laptop", []inventory.Binding{{Machine: "laptop", Consumer: "shop",
+		Provision: "postgres-database", Provider: catalogue.Chosen{Node: "anchor", Module: "db"}}}); err != nil {
+		t.Fatal(err)
+	}
+	at := h0
+	say := func(machine string, rs ...link.ResourceHealth) {
+		t.Helper()
+		at = at.Add(time.Second)
+		for i := range rs {
+			rs[i].Since = at
+		}
+		if err := stateHealth(ctx, inv, k, machine, link.Health{Contract: link.ReadinessContract, At: at, Resources: rs}, at); err != nil {
+			t.Fatal(err)
+		}
+	}
+	account := link.ResourceHealth{Module: "db", Resource: "db.operator", Kind: link.KindAccount, Target: "operator",
+		Account: "operator", State: link.StateUnhealthy, Reason: link.ReasonRelogin + ": operator is in the group db"}
+	unit := link.ResourceHealth{Module: "db", Resource: "db.server", Kind: link.KindUnit, Target: "db.service",
+		Account: "operator", State: link.StateUnhealthy, Reason: "failed in the account's own service manager (exit-code)"}
+	shop := link.ResourceHealth{Module: "shop", Resource: "shop.web", Kind: "container", Target: "shop",
+		State: link.StateUnhealthy, Reason: "http /health on web: answered 500", Check: "http", Needs: "postgres-database"}
+	for look := 0; look < 2; look++ {
+		say("anchor", account, unit)
+		say("laptop", shop)
+	}
+	list, err := k.Open(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var keys []string
+	var c conditions.Condition
+	for _, x := range list {
+		keys = append(keys, x.Key)
+		if x.Key == "module.db.anchor.relogin-needed" {
+			c = x
+		}
+	}
+	if !reflect.DeepEqual(keys, []string{"module.db.anchor.relogin-needed"}) {
+		t.Fatalf("open %v; want the provider's wait alone, its consumer held under it", keys)
+	}
+	if c.Severity != conditions.Urgent || !strings.Contains(c.Evidence[0].Said, "shop on laptop") {
+		t.Fatalf("the provider's wait: %s, %q; want it urgent and naming its consumer", c.Severity, c.Evidence[0].Said)
+	}
+}
+
+// **A broken module is put back at once** (issue 318 review): the laptop's witness put the node tools back
+// within a minute of a send that also moved `app`, and `app` reads not yet healthy because of it. The node
+// tools are marked and put back in the very judging that found them broken — their registered build is the
+// one before, and the laptop is sent it — while `app` goes on being judged, recovers, and keeps its own pass.
+func TestABrokenModuleIsPutBackAtOnceAndTheOneBesideItGetsItsOwnVerdict(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	withConditionsInMemory(t)
+	was := doctorFrom
+	doctorFrom = nil
+	t.Cleanup(func() { doctorFrom = was })
+	old, recent := time.Now().Add(-3*time.Hour), time.Now().Add(-time.Minute)
+	build := func(module, commit string, asked time.Time) {
+		manifest, _ := json.Marshal(catalogue.Manifest{Module: module, Version: "1"})
+		if err := inv.RecordBuild(ctx, inventory.Build{ID: "build-" + module + "-" + commit, Module: module, Commit: commit,
+			Repository: "novox/mesh-catalog", Path: "modules/" + module, Manifest: manifest, Asked: asked, At: asked,
+			Made: []inventory.Artifact{{Name: "x", Kind: "bundle", Reference: "sha256:" + module + commit}}}); err != nil {
+			t.Fatal(err)
+		}
+		if err := inv.RegisterModule(ctx, catalogue.Manifest{Module: module, Version: "1"}, inventory.Source{
+			Repository: "novox/mesh-catalog", Seat: "git", Path: "modules/" + module, BuiltFrom: commit, Head: commit,
+			Asked: asked}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	for _, m := range []string{"app", broker_runtime} {
+		build(m, "c1", old)
+		if _, err := inv.Assign(ctx, "laptop", m); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := inv.RecordSent(ctx, nodeID(t, open, "laptop"), "d-laptop", map[string]string{"app": "c1", broker_runtime: "c1"}); err != nil {
+		t.Fatal(err)
+	}
+	build("app", "c2", recent)
+	build(broker_runtime, "c2", recent)
+
+	wasMoves, wasHeard, wasSend, wasGather := machineMoves, releaseHeard, sendRollout, gatherGateFacts
+	t.Cleanup(func() {
+		machineMoves, releaseHeard, sendRollout, gatherGateFacts = wasMoves, wasHeard, wasSend, wasGather
+	})
+	machineMoves = func(ctx context.Context, open *stores, f moveFacts, node string, all bool) ([]inventory.CarriedMove, error) {
+		modules, _ := open.inventory.Assigned(ctx, node)
+		sent, known, err := open.inventory.SentBuilds(ctx, node)
+		if err != nil {
+			return nil, err
+		}
+		return f.moves(node, modules, sent, known, all), nil
+	}
+	releaseHeard = func(context.Context, *stores) (map[string]bool, error) { return map[string]bool{"laptop": true}, nil }
+	var sends []string
+	n := 0
+	sendRollout = func(ctx context.Context, open *stores, names []string) ([]string, error) {
+		current, err := open.inventory.CurrentBuilds(ctx)
+		if err != nil {
+			return nil, err
+		}
+		for _, node := range names {
+			n++
+			carried := map[string]string{"app": current["app"].Commit, broker_runtime: current[broker_runtime].Commit}
+			sends = append(sends, node+":"+carried[broker_runtime])
+			digest := "d-" + node + "-" + time.Now().Format("150405.000000") + string(rune('a'+n))
+			if err := open.inventory.RecordSent(ctx, nodeID(t, open, node), digest, carried); err != nil {
+				return nil, err
+			}
+			if _, err := open.inventory.RecordDoing(ctx, nodeID(t, open, node), inventory.Doing{Node: node,
+				Outcome: inventory.OutcomeApplied, Declared: digest, Applied: 1, At: time.Now()}); err != nil {
+				return nil, err
+			}
+		}
+		return names, nil
+	}
+	var seen []string // the node tools' registered build at each judging
+	gatherGateFacts = func(ctx context.Context, open *stores, component string) (gateFacts, error) {
+		now := time.Now()
+		f := gateFacts{now: now, reports: map[string]inventory.Reported{}, engines: map[string]string{},
+			rolledBack: map[string][]lease.Rollback{}, served: map[string]served{}}
+		reports, _ := open.inventory.LastReports(ctx)
+		for _, r := range reports {
+			f.reports[r.Node] = r
+		}
+		current, _ := open.inventory.CurrentBuilds(ctx)
+		seen = append(seen, current[broker_runtime].Commit)
+		app := healthyContainer("app")
+		if current[broker_runtime].Commit == "c2" {
+			// The witness reverted the node tools; app cannot reach them yet.
+			f.rolledBack["laptop"] = []lease.Rollback{{Component: lease.ComponentNodeTools, Outcome: lease.OutcomeRolledBack,
+				From: "c2", To: "c1", At: now, Why: "the node tools did not answer"}}
+			app.State, app.Reason = link.StateUnhealthy, "down"
+		}
+		f.served["laptop"] = served{runtime: current[broker_runtime].Commit == "c1", tools: map[string]bool{}}
+		f.health = map[string]inventory.NodeHealth{"laptop": {Node: "laptop", HeardAt: now, Resources: []inventory.ResourceHealth{app}}}
+		return f, nil
+	}
+	withGateBounds(t, 100*time.Millisecond, 0, 10*time.Second)
+
+	release := func() inventory.Plan {
+		t.Helper()
+		plans, _ := inv.RecentPlans(ctx, 10)
+		for _, p := range plans {
+			if p.Release != nil {
+				return p
+			}
+		}
+		t.Fatal("no walk")
+		return inventory.Plan{}
+	}
+	// Judged until the first judging has found the node tools broken, and one more.
+	for i := 0; i < 20 && len(seen) < 2; i++ {
+		advancePlans(ctx, open)
+	}
+	if len(seen) < 2 || seen[0] != "c2" || seen[1] != "c1" {
+		t.Fatalf("the node tools' registered build at each judging: %v; want c2, then c1 at the very next judging", seen)
+	}
+	if failed, _ := inv.GateFailed(ctx, "build-"+broker_runtime+"-c2"); !failed {
+		t.Fatal("the node tools' build is not marked failed at once")
+	}
+	if p := release(); p.State != inventory.PlanRolling || p.Release.Gate == nil || p.Release.Gate.Verdict != "" {
+		t.Fatalf("the walk is %s with gate %+v; want it still judging app", p.State, p.Release.Gate)
+	}
+	if !slices.Contains(sends, "laptop:c1") {
+		t.Fatalf("sends %v; want the laptop sent the node tools' earlier build at once", sends)
+	}
+	for deadline := time.Now().Add(5 * time.Second); time.Now().Before(deadline); {
+		advancePlans(ctx, open)
+		if release().State != inventory.PlanRolling {
+			break
+		}
+		time.Sleep(20 * time.Millisecond)
+	}
+	p := release()
+	if p.State != inventory.PlanFailed {
+		t.Fatalf("the walk is %s: %s; want failed, for the node tools", p.State, p.Note)
+	}
+	if v, found, _ := inv.GateOf(ctx, "build-app-c2"); !found || v.Verdict != inventory.GatePassed || !strings.Contains(v.Why, "on its own") {
+		t.Fatalf("app's verdict: %+v; want its own pass", v)
+	}
+	if current, _ := inv.CurrentBuilds(ctx); current["app"].Commit != "c2" {
+		t.Fatalf("app is registered at %s; want it kept at c2", current["app"].Commit)
+	}
+}
+
+// **A move from a build not known excuses no wait** (issue 318 review): a plan's own module whose previous
+// build was not recorded, or whose previous manifest is not kept, cannot be shown to have added the group.
+func TestAMoveFromAnUnknownBuildExcusesNoWait(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	record := func(commit string, m catalogue.Manifest) {
+		raw, _ := json.Marshal(m)
+		at := time.Now().Add(-time.Hour)
+		if err := inv.RecordBuild(ctx, inventory.Build{ID: "build-lights-" + commit, Module: "lights", Commit: commit,
+			Repository: "novox/mesh-catalog", Path: "modules/lights", Manifest: raw, Asked: at, At: at}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	record("c1", catalogue.Manifest{Module: "lights"})
+	record("c2", catalogue.Manifest{Module: "lights", Resources: []map[string]any{{"id": "operator", "type": "user",
+		"name": "operator", "groups": []any{"lights"}}}})
+	pairs := []judged{{module: "lights", node: "laptop"}}
+	shelf := map[string]catalogue.Manifest{}
+	for _, c := range []struct {
+		from string
+		want bool
+	}{{"c1", true}, {"", false}, {"c0-never-built", false}} {
+		g := &inventory.PlanGate{From: c.from, To: "c2"}
+		if got := movesAddingGroups(ctx, inv, g, pairs, shelf)["lights"]; got != c.want {
+			t.Errorf("a move from %q adds a group: %v; want %v", c.from, got, c.want)
+		}
+	}
+}

cmd/mesh-controller/gate_test.go

@@ -0,0 +1,594 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/lease"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// The gate on a plan's first machine and the rollback after it (novox/hq ADR 0236, to-be 45 §8).
+
+// gateMesh is a mesh with `app` running on anchor and laptop at build c1, a newer build c2 registered,
+// a plan whose tier built c2, and every send recorded and answered — the machine applies what it is
+// sent and reports it — with the gate's bounds shortened to judge in three steps.
+type gateMesh struct {
+	open   *stores
+	sent   [][]string
+	health map[string]health // per machine, what a judging finds; healthy when unsaid
+	keeper *conditions.Keeper
+	told   *conditions.Told
+}
+
+func aGateMesh(t *testing.T) *gateMesh {
+	t.Helper()
+	open := aMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	g := &gateMesh{open: open, health: map[string]health{}}
+	g.keeper, _ = withConditionsInMemory(t)
+	g.told = &conditions.Told{}
+	was := doctorFrom
+	doctorFrom = &doctor{open: open, keeper: g.keeper, teller: g.told}
+	t.Cleanup(func() { doctorFrom = was })
+
+	for _, b := range []inventory.Build{
+		{ID: "build-1", Module: "app", Commit: "c1", Repository: "novox/mesh-catalog", Path: "modules/app",
+			Asked: time.Now().Add(-2 * time.Hour), At: time.Now().Add(-2 * time.Hour)},
+		{ID: "build-2", Module: "app", Commit: "c2", Repository: "novox/mesh-catalog", Path: "modules/app",
+			Asked: time.Now().Add(-time.Minute), At: time.Now().Add(-time.Minute)},
+	} {
+		manifest, _ := json.Marshal(catalogue.Manifest{Module: "app", Version: b.Commit})
+		b.Manifest = manifest
+		if err := inv.RecordBuild(ctx, b); err != nil {
+			t.Fatal(err)
+		}
+	}
+	register := func(commit string, asked time.Time) {
+		if err := inv.RegisterModule(ctx, catalogue.Manifest{Module: "app", Version: commit},
+			inventory.Source{Repository: "novox/mesh-catalog", Seat: "git", Path: "modules/app", BuiltFrom: commit,
+				Head: commit, Asked: asked}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	register("c1", time.Now().Add(-2*time.Hour))
+	for _, n := range []string{"anchor", "laptop"} {
+		if _, err := inv.Assign(ctx, n, "app"); err != nil {
+			t.Fatal(err)
+		}
+		if err := inv.RecordSent(ctx, nodeID(t, open, n), "d-"+n+"-c1", map[string]string{"app": "c1"}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	register("c2", time.Now().Add(-time.Minute))
+
+	// Every send: recorded with the build the module is at, applied and reported by the machine.
+	n := 0
+	wasSend := sendRollout
+	sendRollout = func(ctx context.Context, open *stores, names []string) ([]string, error) {
+		g.sent = append(g.sent, append([]string(nil), names...))
+		current, err := open.inventory.CurrentBuilds(ctx)
+		if err != nil {
+			return nil, err
+		}
+		for _, node := range names {
+			n++
+			digest := fmt.Sprintf("d-%s-%d", node, n)
+			if err := open.inventory.RecordSent(ctx, nodeID(t, open, node), digest, map[string]string{"app": current["app"].Commit}); err != nil {
+				return nil, err
+			}
+			if _, err := open.inventory.RecordDoing(ctx, nodeID(t, open, node), inventory.Doing{Node: node,
+				Outcome: inventory.OutcomeApplied, Declared: digest, Applied: 1, At: time.Now()}); err != nil {
+				return nil, err
+			}
+		}
+		return names, nil
+	}
+	t.Cleanup(func() { sendRollout = wasSend })
+
+	// What a judging reads: the store's reports, and a health the test says per machine.
+	wasGather := gatherGateFacts
+	gatherGateFacts = func(ctx context.Context, open *stores, component string) (gateFacts, error) {
+		f := gateFacts{now: time.Now(), reports: map[string]inventory.Reported{}, engines: map[string]string{},
+			rolledBack: map[string][]lease.Rollback{}, served: map[string]served{}}
+		reports, err := open.inventory.LastReports(ctx)
+		if err != nil {
+			return f, err
+		}
+		for _, r := range reports {
+			if g.health[r.Node] == healthBroken {
+				r.Outcome = inventory.OutcomeFailed
+			}
+			f.reports[r.Node] = r
+		}
+		for node, h := range g.health {
+			if h == healthNotYet {
+				f.rolledBack[node] = nil
+				r := f.reports[node]
+				r.Current = false
+				f.reports[node] = r
+			}
+		}
+		return f, nil
+	}
+	t.Cleanup(func() { gatherGateFacts = wasGather })
+
+	wasSettle, wasEvery, wasBound := gateSettle, gateEvery, gateBound
+	// One judging per advance until a test says otherwise: a pass waits gateEvery for the next.
+	gateSettle, gateEvery = 0, time.Hour
+	t.Cleanup(func() { gateSettle, gateEvery, gateBound = wasSettle, wasEvery, wasBound })
+
+	built := time.Now().UTC()
+	plan := inventory.Plan{ID: "plan-gate", Repository: "novox/mesh-catalog", Branch: "main", Commit: "c2",
+		Created: built, State: inventory.PlanBuilding, Tiers: [][]string{{"app"}},
+		Modules: map[string]*inventory.PlanModule{"app": {State: "built", BuiltAt: &built, Commit: "c2",
+			Build: "build-2"}}}
+	if err := inv.SavePlan(ctx, &plan); err != nil {
+		t.Fatal(err)
+	}
+	return g
+}
+
+func (g *gateMesh) plan(t *testing.T) inventory.Plan {
+	t.Helper()
+	p, err := g.open.inventory.PlanByID(t.Context(), "plan-gate")
+	if err != nil {
+		t.Fatal(err)
+	}
+	return p
+}
+
+// A module's build that fails its gate on the first machine is put back there — the previous build
+// registered and sent to it again — and never reaches the second machine; it is marked, said as a
+// condition and an event, never registered or rolled back again.
+func TestABuildThatFailsItsGateIsRolledBackOnItsFirstMachineAndGoesNoFurther(t *testing.T) {
+	g := aGateMesh(t)
+	ctx := t.Context()
+	inv := g.open.inventory
+
+	advancePlans(ctx, g.open) // the first machine is sent the new build
+	if !reflect.DeepEqual(g.sent, [][]string{{"anchor"}}) {
+		t.Fatalf("sent %v, not the first machine alone", g.sent)
+	}
+	if p := g.plan(t); p.Modules["app"].Previous != "c1" {
+		t.Fatalf("the build the first machine ran before was not kept: %+v", p.Modules["app"])
+	}
+
+	g.health["anchor"] = healthBroken // the new build breaks its first machine, after one good judging
+	gateEvery = 0
+	advancePlans(ctx, g.open)
+
+	p := g.plan(t)
+	gate := p.Modules["app"].Gate
+	if p.State != inventory.PlanFailed || gate == nil || gate.Verdict != inventory.GateFailed ||
+		gate.Rollback != inventory.RolledBack {
+		t.Fatalf("the plan is %s (%s), its gate %+v", p.State, p.Note, gate)
+	}
+	if !reflect.DeepEqual(g.sent, [][]string{{"anchor"}, {"anchor"}}) {
+		t.Fatalf("sent %v: the rollback goes to the first machine, and nothing reaches laptop", g.sent)
+	}
+	if current, _ := inv.CurrentBuilds(ctx); current["app"].Commit != "c1" {
+		t.Fatalf("the module is registered at %s, not put back to c1", current["app"].Commit)
+	}
+	if sent, _, _ := inv.SentBuilds(ctx, "anchor"); sent["app"] != "c1" {
+		t.Fatalf("anchor was last sent %v, not the previous build", sent)
+	}
+	if sent, _, _ := inv.SentBuilds(ctx, "laptop"); sent["app"] != "c1" {
+		t.Fatalf("laptop was sent the failed build: %v", sent)
+	}
+	if failed, err := inv.GateFailed(ctx, "build-2"); err != nil || !failed {
+		t.Fatalf("the build is not marked failed at its gate: %v %v", failed, err)
+	}
+
+	// Said: a condition for the operator, and the event.
+	open, err := g.keeper.Open(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var key string
+	for _, c := range open {
+		if c.Kind == kindRolledBack {
+			key = c.Key
+		}
+	}
+	if key != "build.app.anchor.rolled-back" {
+		t.Fatalf("no rolled-back condition for app on anchor: %+v", open)
+	}
+	saidIt := false
+	for _, e := range g.told.Said() {
+		saidIt = saidIt || e.Event == link.KeyRolledBack
+	}
+	if !saidIt {
+		t.Fatalf("the rollback was not said as an event: %+v", g.told.Said())
+	}
+
+	// Never again: more passes send nothing, a second judging rolls nothing back, and the failed build
+	// heard again is not registered.
+	advancePlans(ctx, g.open)
+	state := p.Modules["app"]
+	gateFailed(ctx, g.open, &p, "app", state, []string{"anchor"}, "again")
+	if len(g.sent) != 2 {
+		t.Fatalf("sent again after the rollback: %v", g.sent)
+	}
+	_, _, err = takeIn(ctx, inv, link.BuildResult{ID: "build-2", Repository: "novox/mesh-catalog", Path: "modules/app",
+		Commit: "c2", Manifest: mustJSON(t, catalogue.Manifest{Module: "app", Version: "c2"}),
+		Source: &link.SourceOnSeat{Seat: "git", Repository: "novox/mesh-catalog"}})
+	if err == nil || !strings.Contains(err.Error(), "failed its gate") {
+		t.Fatalf("the failed build was registered again: %v", err)
+	}
+	if current, _ := inv.CurrentBuilds(ctx); current["app"].Commit != "c1" {
+		t.Fatalf("the module moved to %s", current["app"].Commit)
+	}
+	if _, err := retryPlan(ctx, g.open, "plan-gate"); err == nil || !strings.Contains(err.Error(), "failed its gate") {
+		t.Fatalf("a plan stopped at a failed gate was retried: %v", err)
+	}
+
+	// The probe keeps the condition while the newest verdict is the failure.
+	obs, err := probeGates(ctx, doctorFrom)
+	if err != nil || len(obs) != 1 || obs[0].Key() != key {
+		t.Fatalf("the gate's probe found %+v %v", obs, err)
+	}
+}
+
+// A passing build rolls everywhere with no hand: judged healthy on its first machine three times, then
+// the rest are sent, the verdict kept, and the plan done.
+func TestABuildThatPassesItsGateRollsEverywhereUnattended(t *testing.T) {
+	g := aGateMesh(t)
+	ctx := t.Context()
+	gateEvery = 0
+	for i := 0; i < 6; i++ {
+		advancePlans(ctx, g.open)
+	}
+	p := g.plan(t)
+	if !reflect.DeepEqual(g.sent, [][]string{{"anchor"}, {"laptop"}}) {
+		t.Fatalf("sent %v", g.sent)
+	}
+	gate := p.Modules["app"].Gate
+	if p.State != inventory.PlanDone || gate == nil || gate.Verdict != inventory.GatePassed || gate.Passes < gatePasses {
+		t.Fatalf("the plan is %s (%s), its gate %+v", p.State, p.Note, gate)
+	}
+	if v, found, err := g.open.inventory.GateOf(ctx, "build-2"); err != nil || !found || v.Verdict != inventory.GatePassed {
+		t.Fatalf("the verdict was not kept: %+v %v %v", v, found, err)
+	}
+	if obs, err := probeGates(ctx, doctorFrom); err != nil || len(obs) != 0 {
+		t.Fatalf("a passing build left a condition: %+v %v", obs, err)
+	}
+}
+
+// A first machine that never becomes healthy fails its gate at the bound, and is put back.
+func TestABuildNeverHealthyFailsAtTheBound(t *testing.T) {
+	g := aGateMesh(t)
+	ctx := t.Context()
+	advancePlans(ctx, g.open)
+	g.health["anchor"] = healthNotYet
+	gateEvery = 0
+	advancePlans(ctx, g.open)
+	if p := g.plan(t); !p.Open() || len(g.sent) != 1 {
+		t.Fatalf("judged before the bound: %s %v", p.State, g.sent)
+	}
+	gateBound = -time.Second
+	advancePlans(ctx, g.open)
+	p := g.plan(t)
+	if gate := p.Modules["app"].Gate; p.State != inventory.PlanFailed || gate.Verdict != inventory.GateFailed ||
+		!strings.Contains(gate.Why, "not healthy within") || gate.Rollback != inventory.RolledBack {
+		t.Fatalf("the plan is %s, its gate %+v", p.State, gate)
+	}
+}
+
+// The health a judging finds, per core component and for a module.
+func TestTheHealthDefinitions(t *testing.T) {
+	now := time.Now()
+	since := now.Add(-time.Minute)
+	applied := func(node string) gateFacts {
+		at := now
+		return gateFacts{now: now, reports: map[string]inventory.Reported{node: {Node: node,
+			Outcome: inventory.OutcomeApplied, At: &at, Current: true}}, engines: map[string]string{},
+			served: map[string]served{}, rolledBack: map[string][]lease.Rollback{}}
+	}
+	m := catalogue.Manifest{Module: "app", Tools: []string{"app_list"}}
+
+	f := applied("anchor")
+	f.served["anchor"] = served{runtime: true, tools: map[string]bool{}}
+	if h, why := judgeHealth("app", "", m, "anchor", since, f); h != healthNotYet || !strings.Contains(why, "tools") {
+		t.Errorf("a module whose tools are not served is %v (%s)", h, why)
+	}
+	f.served["anchor"].tools["app"] = true
+	if h, why := judgeHealth("app", "", m, "anchor", since, f); h != healthGood {
+		t.Errorf("a module applied with its tools served is %v (%s)", h, why)
+	}
+	// A condition raised about it on that machine since it was sent: not yet healthy.
+	f.judged = true
+	f.open = []conditions.Condition{{Key: "provider.app.anchor.x.failing", Subject: conditions.Subject{
+		Scope: conditions.ScopeProvider, ID: "app.anchor.x", Machine: "anchor"}, Raised: now, Summary: "failing"}}
+	if h, _ := judgeHealth("app", "", m, "anchor", since, f); h != healthNotYet {
+		t.Errorf("a module with a new condition about it is %v", h)
+	}
+	f.open[0].Raised = since.Add(-time.Hour)
+	if h, _ := judgeHealth("app", "", m, "anchor", since, f); h != healthGood {
+		t.Errorf("a condition older than the send counted against it: %v", h)
+	}
+	// A witness that put it back: broken.
+	f.rolledBack["anchor"] = []lease.Rollback{{Component: lease.ComponentNodeTools, From: "sha256:aa", To: "sha256:bb",
+		Outcome: lease.OutcomeRolledBack, Why: "x", At: now}}
+	if h, _ := judgeHealth("node-tools", lease.ComponentNodeTools, catalogue.Manifest{}, "anchor", since, f); h != healthBroken {
+		t.Errorf("a component a witness put back is %v", h)
+	}
+	// The node tools answer, or not.
+	f = applied("anchor")
+	if h, _ := judgeHealth("node-tools", lease.ComponentNodeTools, catalogue.Manifest{}, "anchor", since, f); h != healthNotYet {
+		t.Errorf("node tools not answering are %v", h)
+	}
+	f.served["anchor"] = served{runtime: true}
+	if h, _ := judgeHealth("node-tools", lease.ComponentNodeTools, catalogue.Manifest{}, "anchor", since, f); h != healthGood {
+		t.Errorf("node tools answering are %v", h)
+	}
+	// The controller: the lease held since the send, by a controller that says it is ready.
+	f = applied("control")
+	f.holder = &lease.Holder{Taken: since.Add(-time.Hour), Health: &lease.Health{Ready: true}}
+	if h, _ := judgeHealth("mesh-controller", lease.ComponentController, catalogue.Manifest{}, "control", since, f); h != healthNotYet {
+		t.Errorf("a lease held by a controller older than the build is %v", h)
+	}
+	f.holder.Taken = now
+	if h, _ := judgeHealth("mesh-controller", lease.ComponentController, catalogue.Manifest{}, "control", since, f); h != healthGood {
+		t.Errorf("a new controller holding the lease and ready is %v", h)
+	}
+	f.holder.Health = &lease.Health{Why: "the self-check has not finished its first run"}
+	if h, why := judgeHealth("mesh-controller", lease.ComponentController, catalogue.Manifest{}, "control", since, f); h != healthNotYet ||
+		!strings.Contains(why, "first run") {
+		t.Errorf("a controller not ready is %v (%s)", h, why)
+	}
+	// What the module runs (novox/hq ADR 0240 §4): a judging passes only when every long-running
+	// resource of it on that machine is stated healthy since the send; starting and unhealthy wait.
+	f = applied("anchor")
+	stated := func(state, reason string, heard time.Time) {
+		f.health = map[string]inventory.NodeHealth{"anchor": {Node: "anchor", Contract: 1, SaidAt: heard, HeardAt: heard,
+			Resources: []inventory.ResourceHealth{
+				{Module: "app", Resource: "app.server", Kind: "container", Target: "app-server", State: state, Reason: reason},
+				{Module: "other", Resource: "other.server", Kind: "container", State: link.StateUnhealthy, Reason: "down"}}}}
+	}
+	plain := catalogue.Manifest{Module: "app"}
+	if h, why := judgeHealth("app", "", plain, "anchor", since, f); h != healthGood {
+		t.Errorf("a machine whose engine states no health is judged as before, not %v (%s)", h, why)
+	}
+	stated(link.StateStarting, "", now)
+	if h, why := judgeHealth("app", "", plain, "anchor", since, f); h != healthNotYet || !strings.Contains(why, "starting") {
+		t.Errorf("a resource still starting is not yet a pass: %v (%s)", h, why)
+	}
+	stated(link.StateUnhealthy, "restarting", now)
+	if h, why := judgeHealth("app", "", plain, "anchor", since, f); h != healthNotYet || !strings.Contains(why, "restarting") {
+		t.Errorf("a resource unhealthy fails the judging: %v (%s)", h, why)
+	}
+	stated(link.StateHealthy, "", since.Add(-time.Minute))
+	if h, why := judgeHealth("app", "", plain, "anchor", since, f); h != healthNotYet {
+		t.Errorf("a statement from before the send says nothing of the new build: %v (%s)", h, why)
+	}
+	stated(link.StateHealthy, "", now)
+	if h, why := judgeHealth("app", "", plain, "anchor", since, f); h != healthGood {
+		t.Errorf("every resource of it healthy since the send — another module's state is not its — is %v (%s)", h, why)
+	}
+	f.healthErr = errors.New("the store is away")
+	if h, _ := judgeHealth("app", "", plain, "anchor", since, f); h != healthNotYet {
+		t.Errorf("health that cannot be read is never read as healthy: %v", h)
+	}
+	// And the condition it raises after the send holds it, as every condition about it does.
+	f.healthErr = nil
+	f.judged = true
+	f.open = []conditions.Condition{{Key: "module.app.anchor.unhealthy", Kind: kindModuleUnhealthy, Subject: conditions.Subject{
+		Scope: conditions.ScopeModule, ID: "app.anchor", Machine: "anchor"}, Raised: now, Summary: "app on anchor is not healthy"}}
+	if h, why := judgeHealth("app", "", plain, "anchor", since, f); h != healthNotYet || !strings.Contains(why, "module.app.anchor.unhealthy") {
+		t.Errorf("a module held on its own unhealthy condition is %v (%s)", h, why)
+	}
+
+	// A machine that refused what it was sent: broken.
+	f = applied("anchor")
+	r := f.reports["anchor"]
+	r.Outcome = inventory.OutcomeRefused
+	f.reports["anchor"] = r
+	if h, _ := judgeHealth("app", "", catalogue.Manifest{}, "anchor", since, f); h != healthBroken {
+		t.Errorf("a refusal is %v", h)
+	}
+}
+
+// The bus is never rolled out: its policy records whatever is said, a person's roll-out is refused,
+// a plan builds it and sends nothing, and a push naming its machine is refused while a new build waits.
+func TestTheBusIsNeverRolledOutAutomatically(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	bus := catalogue.Manifest{Module: "nats", Version: "2", Provides: []catalogue.Offer{{Name: "mesh-bus"}},
+		Upgrade: &catalogue.UpgradePolicy{Policy: catalogue.PolicyRoll}}
+	if err := inv.RegisterModule(ctx, bus, inventory.Source{Repository: "novox/mesh-catalog", Seat: "git",
+		Path: "modules/nats", BuiltFrom: "n2", Head: "n2"}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := inv.Assign(ctx, "anchor", "nats"); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.RecordSent(ctx, nodeID(t, open, "anchor"), "d-anchor", map[string]string{"nats": "n1"}); err != nil {
+		t.Fatal(err)
+	}
+	u, err := inv.UpgradeOf(ctx, "nats")
+	if err != nil || u.RollOut || u.From != catalogue.FromBus {
+		t.Fatalf("the bus's policy is %+v %v", u, err)
+	}
+	if err := inv.SetUpgradeOf(ctx, "nats", inventory.Upgrade{RollOut: true}); !errors.Is(err, inventory.ErrBusIsPlanned) {
+		t.Fatalf("a person rolled the bus out: %v", err)
+	}
+	var sent [][]string
+	was := sendRollout
+	sendRollout = func(_ context.Context, _ *stores, names []string) ([]string, error) {
+		sent = append(sent, names)
+		return names, nil
+	}
+	t.Cleanup(func() { sendRollout = was })
+	now := time.Now().UTC()
+	plan := inventory.Plan{ID: "plan-bus", Repository: "novox/mesh-catalog", Commit: "n2", Created: now,
+		State: inventory.PlanBuilding, Tiers: [][]string{{"nats"}},
+		Modules: map[string]*inventory.PlanModule{"nats": {State: "built", BuiltAt: &now, Commit: "n2", Build: "b"}}}
+	if err := inv.SavePlan(ctx, &plan); err != nil {
+		t.Fatal(err)
+	}
+	advancePlans(ctx, open)
+	if p, _ := inv.PlanByID(ctx, "plan-bus"); p.State != inventory.PlanDone || len(sent) != 0 {
+		t.Fatalf("a plan sent the bus: %s %v", p.State, sent)
+	}
+	held, err := busHeld(ctx, inv, []string{"anchor", "laptop"})
+	if err != nil || !strings.Contains(held["anchor"], "planned step") || held["laptop"] != "" {
+		t.Fatalf("a push may send the bus's machine: %v %v", held, err)
+	}
+	// Nor may any other send — a plan's for another module on that machine carried the bus with it.
+	if _, err := sendToEach(ctx, open, []string{"laptop", "anchor"}); !errors.Is(err, errBusWaits) {
+		t.Fatalf("a send to the bus's machine was not refused: %v", err)
+	}
+	// A rebuild that made the same artifacts is no move.
+	for _, b := range []inventory.Build{{ID: "nb1", Module: "nats", Commit: "n1"}, {ID: "nb2", Module: "nats", Commit: "n2"}} {
+		b.Made = []inventory.Artifact{{Name: "server", Kind: "image", Reference: "registry/nats@sha256:same"}}
+		b.Asked, b.At = time.Now(), time.Now()
+		if err := inv.RecordBuild(ctx, b); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if held, err := busHeld(ctx, inv, []string{"anchor"}); err != nil || len(held) != 0 {
+		t.Fatalf("a rebuild that changes nothing held the bus's machine: %v %v", held, err)
+	}
+	if err := inv.RecordBuild(ctx, inventory.Build{ID: "nb3", Module: "nats", Commit: "n2", Asked: time.Now().Add(time.Second),
+		At: time.Now().Add(time.Second), Made: []inventory.Artifact{{Name: "server", Kind: "image",
+			Reference: "registry/nats@sha256:new"}}}); err != nil {
+		t.Fatal(err)
+	}
+	// The planned step refuses to start without its word on reversibility, and without a snapshot taken
+	// first by the bus machine's backup holder.
+	if err := busCommand(ctx, []string{"upgrade", "--why", "2.11"}); err == nil || !strings.Contains(err.Error(), "reversible") {
+		t.Fatalf("a bus upgrade started without saying whether it can be reverted: %v", err)
+	}
+	wasSnapshot := takeBusSnapshot
+	t.Cleanup(func() { takeBusSnapshot = wasSnapshot })
+	takeBusSnapshot = func(context.Context, string, string) (string, error) { return "", errors.New("no holder answers") }
+	if err := busCommand(ctx, []string{"upgrade", "--why", "2.11", "--reversible"}); err == nil ||
+		!strings.Contains(err.Error(), "snapshotted") || len(sent) != 0 {
+		t.Fatalf("a bus upgrade started without its snapshot: %v, sent %v", err, sent)
+	}
+	takeBusSnapshot = func(_ context.Context, module, node string) (string, error) {
+		return node + "'s restore point of " + module, nil
+	}
+	if err := busCommand(ctx, []string{"upgrade", "--why", "2.11", "--reversible"}); err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(sent, [][]string{{"anchor"}}) {
+		t.Fatalf("the step sent %v, not the bus's machine", sent)
+	}
+	s, found, err := inv.LatestBusStep(ctx)
+	if err != nil || !found || s.Snapshot != "anchor's restore point of nats" || s.Ended != nil ||
+		!reflect.DeepEqual(s.Machines, []string{"anchor"}) {
+		t.Fatalf("the step is %+v %v %v", s, found, err)
+	}
+}
+
+// A merge that deletes a module's directory builds nothing for it: the module is forgotten where
+// nothing holds it, and a plan whose build finds no manifest goes on instead of failing.
+func TestAMergeThatDeletesAModulePlansNothingToBuildForIt(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	asked := asksRecorded(t)
+	for _, name := range []string{"gone", "kept"} {
+		if err := inv.RegisterModule(ctx, catalogue.Manifest{Module: name, Version: "1"}, inventory.Source{
+			Repository: "novox/mesh-catalog", Seat: "git", Path: "modules/" + name, BuiltFrom: "c0", Head: "c0"}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	m := link.SourceMoved{Owner: "novox", Repo: "mesh-catalog", Base: "main", Commit: "c1deadbeef",
+		Paths:   []string{"modules/gone/module.json", "modules/gone/index.ts"},
+		Removed: []string{"modules/gone/module.json", "modules/gone/index.ts"}}
+	if err := (following{open: open}).SourceMoved(ctx, m); err != nil {
+		t.Fatal(err)
+	}
+	if len(*asked) != 0 {
+		t.Fatalf("a deleted module was asked to build: %v", *asked)
+	}
+	if plans, _ := inv.OpenPlans(ctx); len(plans) != 0 {
+		t.Fatalf("a merge that only deleted a module made a plan: %+v", plans)
+	}
+	shelf, err := inv.Catalogue(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, still := shelf["gone"]; still {
+		t.Fatal("a deleted module nothing holds was not forgotten")
+	}
+
+	// Without the announcer saying what went: the build finds no manifest, and the plan goes on.
+	asked0 := time.Now().UTC().Add(-time.Minute)
+	plan := inventory.Plan{ID: "plan-deleted", Repository: "novox/mesh-catalog", Commit: "c2", Created: asked0,
+		State: inventory.PlanBuilding, Tiers: [][]string{{"kept"}},
+		Modules: map[string]*inventory.PlanModule{"kept": {State: "asked", AskedAt: &asked0, Build: "build-k"}}}
+	if err := inv.SavePlan(ctx, &plan); err != nil {
+		t.Fatal(err)
+	}
+	planBuilt(ctx, open, "kept", "", "http://forge/novox/mesh-catalog.git has no module.json at modules/kept, so "+
+		"there is nothing saying what it is: open …/module.json: no such file or directory", asked0, "build-k")
+	p, _ := inv.PlanByID(ctx, "plan-deleted")
+	if p.State == inventory.PlanFailed || p.Modules["kept"].State != planDeleted {
+		t.Fatalf("a module deleted at its source failed the plan: %s %+v", p.State, p.Modules["kept"])
+	}
+}
+
+func mustJSON(t *testing.T, v any) []byte {
+	t.Helper()
+	b, err := json.Marshal(v)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return b
+}
+
+func nodeID(t *testing.T, open *stores, name string) string {
+	t.Helper()
+	n, err := open.inventory.NodeByName(context.Background(), name)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return n.ID
+}
+
+// What a machine's witness says in its reports is a condition while it says it, by the host's words:
+// `core.<component>.<node>.<outcome>`, urgent for a rollback, a warning when it could not judge — and
+// gone with the first report that no longer carries it.
+func TestAWitnessesVerdictIsAConditionWhileItsReportsSayIt(t *testing.T) {
+	open := aMesh(t)
+	d := &doctor{open: open}
+	at := time.Now().UTC()
+	witnessed.heard("control", []lease.Rollback{
+		{Component: lease.ComponentController, From: "sha256:new", To: "sha256:old", Outcome: lease.OutcomeRolledBack,
+			Why: "the new controller did not take the lease within 60s", At: at},
+		{Component: lease.ComponentNodeTools, From: "sha256:t2", Outcome: lease.OutcomeUnwitnessed, Why: "no grant", At: at},
+	}, at)
+	t.Cleanup(func() { witnessed.heard("control", nil, time.Now()) })
+	obs, err := probeGates(t.Context(), d)
+	if err != nil {
+		t.Fatal(err)
+	}
+	got := map[string]conditions.Severity{}
+	for _, o := range obs {
+		got[o.Key()] = o.Severity
+	}
+	want := map[string]conditions.Severity{"core.controller.control.rolled-back": conditions.Urgent,
+		"core.node-tools.control.unwitnessed": conditions.Warning}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("the witness's verdicts are %v", got)
+	}
+	witnessed.heard("control", nil, time.Now())
+	if obs, err := probeGates(t.Context(), d); err != nil || len(obs) != 0 {
+		t.Fatalf("a verdict the reports no longer carry is still said: %+v %v", obs, err)
+	}
+}

cmd/mesh-controller/given.go

@@ -0,0 +1,90 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"log"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// A value given by hand lives only until the module's first good start (novox/hq ADR 0228).
+//
+// The serving controller hears every report; a clean one about the declaration a machine was last
+// sent is the signal the store asks about (inventory.ReplaceGivenAfterStart). What it replaced is
+// sent at once, said in the log and stated on the bus as the controller seat's `secret-replaced`,
+// so a replacement is never silent. **Not in the hand-act log**: nobody acted by hand, and that log
+// is read as the count of repairs a healer is wanted for.
+
+// SecretReplaced is the controller seat's fact that a value given by hand was replaced
+// (link.KeySecretReplaced). Never the value: neither the old one, which the mesh cannot read,
+// nor the new one, sealed to the machine as it was made.
+type SecretReplaced struct {
+	Node   string    `json:"node"`
+	Module string    `json:"module"`
+	Name   string    `json:"name"`
+	Given  time.Time `json:"given"`
+	// Sent are the machines sent so the module starts again on the new value; Unsent says why
+	// they could not be, in which case the next push carries it.
+	Sent   []string `json:"sent"`
+	Unsent string   `json:"unsent,omitempty"`
+	Why    string   `json:"why"`
+}
+
+// givenEvents is where the serving controller states it; nil in a command.
+var givenEvents link.Bus
+
+// replacing keeps one replacement per machine at a time: two reports arriving together find the
+// same rows, and the store's claim makes one of them the replacer, but the sends need not race.
+var replacing sync.Map
+
+// startedWell says a report is a machine's clean account of a declaration: everything applied,
+// nothing failed or refused. Whether it is the declaration last sent is the store's to answer.
+func startedWell(report link.Report) bool {
+	return report.Declared != "" && report.Refused == "" && len(report.Failed) == 0 && report.Applied != nil
+}
+
+const givenWhy = "a value given by hand lives only until its module's first good start under the mesh (novox/hq ADR 0228)"
+
+// replaceGiven replaces what the report makes due, sends the machines, and says so.
+func replaceGiven(ctx context.Context, open *stores, report link.Report) {
+	if _, busy := replacing.LoadOrStore(report.Node, true); busy {
+		return
+	}
+	defer replacing.Delete(report.Node)
+	replaced, err := open.inventory.ReplaceGivenAfterStart(ctx, report.Node, report.Declared)
+	if err != nil {
+		log.Printf("a value given by hand on %s could not be replaced after its module started: %v", report.Node, err)
+	}
+	for _, r := range replaced {
+		said := SecretReplaced{Node: report.Node, Module: r.Module, Name: r.Name, Given: r.Given.UTC(),
+			Sent: r.Machines, Why: givenWhy}
+		log.Printf("replaced %q of %s on %s, given %s, with a value the mesh made: %s; sending %s",
+			r.Name, r.Module, report.Node, r.Given.UTC().Format(time.RFC3339), givenWhy, strings.Join(r.Machines, ", "))
+		if err := sendTo(ctx, open, r.Machines); err != nil {
+			said.Sent, said.Unsent = nil, err.Error()
+			log.Printf("the new %q of %s is sealed and not yet delivered to %s — the next push carries it: %v",
+				r.Name, r.Module, strings.Join(r.Machines, ", "), err)
+		}
+		stateReplaced(ctx, said)
+	}
+}
+
+func stateReplaced(ctx context.Context, said SecretReplaced) {
+	if givenEvents == nil {
+		return
+	}
+	body, err := json.Marshal(said)
+	if err != nil {
+		log.Printf("could not say that %s's %q was replaced: %v", said.Module, said.Name, err)
+		return
+	}
+	stating, cancel := context.WithTimeout(ctx, 10*time.Second)
+	defer cancel()
+	if err := givenEvents.PublishSeatEvent(stating, link.MeshControllerSeat, link.KeySecretReplaced, body); err != nil {
+		log.Printf("could not say that %s's %q was replaced: %v", said.Module, said.Name, err)
+	}
+}

cmd/mesh-controller/given_test.go

@@ -0,0 +1,45 @@
+package main
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// A rotation asked through the seat carries why to the command, which records it in the hand-act
+// log (novox/hq ADR 0228); why with a provision is refused as passed over, not dropped.
+func TestARotationThroughTheSeatCarriesWhy(t *testing.T) {
+	argv, err := argvFor("rotate", map[string]any{"node": "anchor", "module": "letta",
+		"secret": "server-password", "why": "leaked into logs", "cause": "leaked"})
+	if err != nil || strings.Join(argv, " ") != "secret rotate anchor letta server-password --why leaked into logs --cause leaked" {
+		t.Fatalf("%v %v", argv, err)
+	}
+	argv, err = argvFor("rotate", map[string]any{"node": "anchor", "module": "letta", "secret": "server-password"})
+	if err != nil || strings.Join(argv, " ") != "secret rotate anchor letta server-password" {
+		t.Fatalf("without why: %v %v", argv, err)
+	}
+	if argv, err := argvFor("rotate", map[string]any{"provision": "postgres-database", "why": "leaked"}); err == nil {
+		t.Fatalf("why beside a provision was passed over: %v", argv)
+	}
+}
+
+// Only a clean account of a declaration is a good start; a refusal, a failure or a bare word that
+// the machine is there is not (novox/hq ADR 0228).
+func TestAGoodStartIsACleanAccountOfADeclaration(t *testing.T) {
+	for _, c := range []struct {
+		report link.Report
+		good   bool
+	}{
+		{link.Report{Node: "anchor", Declared: "d", Applied: []string{"container:letta"}}, true},
+		{link.Report{Node: "anchor", Declared: "d", Applied: []string{}}, true},
+		{link.Report{Node: "anchor"}, false},
+		{link.Report{Node: "anchor", Applied: []string{"x"}}, false},
+		{link.Report{Node: "anchor", Declared: "d", Applied: []string{"x"}, Failed: map[string]string{"y": "no"}}, false},
+		{link.Report{Node: "anchor", Declared: "d", Refused: "older"}, false},
+	} {
+		if got := startedWell(c.report); got != c.good {
+			t.Errorf("%+v: a good start = %v, want %v", c.report, got, c.good)
+		}
+	}
+}

cmd/mesh-controller/grant_follows_binding_test.go

@@ -0,0 +1,197 @@
+package main
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// novox/hq issue 274: a provider is granted exactly the consumers whose own resolution binds them to
+// it — not every consumer a pair credential from it was ever made for.
+
+// grantOf is the grant of one provision to one consuming module, and whether there is one at all.
+func grantOf(grants []catalogue.Grant, provision, consumer, module string) (catalogue.Grant, bool) {
+	for _, g := range grants {
+		if g.Provision == provision && g.Consumer == consumer && (g.From == module || g.From == "") {
+			return g, true
+		}
+	}
+	return catalogue.Grant{}, false
+}
+
+// The morning after issue 273, through the stores: a consumer was bound to the store on another
+// machine, a credential from there was made, and a person pinned it back to the store beside it. Both
+// credentials are on record. The store it left is no longer granted it — so it retires it and keeps
+// its data (ADR 0230) — and says so; the store it is bound to keeps its grant; and the credential from
+// the store it left stays on record.
+func TestAConsumerPinnedBackIsNoLongerGrantedByTheProviderItLeft(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	for _, m := range storeManifests() {
+		register(t, open, m)
+	}
+	if _, err := inv.SeedSeats(ctx, catalogue.DefaultSeats()); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := assign(ctx, open, "anchor", "store"); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.HoldSeat(ctx, "mesh-store", catalogue.ScopeMesh, "anchor", "store"); err != nil {
+		t.Fatal(err)
+	}
+	for _, a := range [][2]string{{"laptop", "store"}, {"laptop", "board"}} {
+		if _, err := assign(ctx, open, a[0], a[1]); err != nil {
+			t.Fatalf("assign %s %s: %v", a[0], a[1], err)
+		}
+	}
+
+	// Bound to the anchor's store, and sent so: the credential from the anchor is made and recorded.
+	if err := inv.PinProvision(ctx, "laptop", "postgres-database", "anchor", "store"); err != nil {
+		t.Fatal(err)
+	}
+	plan, _, err := planFor(ctx, open, "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if n := need(t, plan, "board", "postgres-database"); n.From != "anchor" {
+		t.Fatalf("pinned to the anchor and bound to %s", n.From)
+	}
+	if err := inv.RecordBindings(ctx, "laptop", boundToData(plan, nil)); err != nil {
+		t.Fatal(err)
+	}
+	grants, _, unbound, err := grantsFor(ctx, open, "anchor")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if g, ok := grantOf(grants, "postgres-database", "laptop", "board"); !ok || g.From != "board" || len(unbound) != 0 {
+		t.Fatalf("a consumer bound to the anchor is not granted there: %+v, unbound %+v", grants, unbound)
+	}
+
+	// Pinned back beside its data, as the operator did.
+	if err := inv.PinProvision(ctx, "laptop", "postgres-database", "laptop", "store"); err != nil {
+		t.Fatal(err)
+	}
+	plan, _, err = planFor(ctx, open, "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if n := need(t, plan, "board", "postgres-database"); n.From != "laptop" {
+		t.Fatalf("pinned back to the laptop and bound to %s", n.From)
+	}
+	if err := inv.RecordBindings(ctx, "laptop", boundToData(plan, nil)); err != nil {
+		t.Fatal(err)
+	}
+	holders, err := inv.HoldersOf(ctx, "postgres-database", "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(holders) != 2 {
+		t.Fatalf("today's state is two credentials on record, one from each store: %+v", holders)
+	}
+
+	// The store it left: no longer granted, and said.
+	grants, _, unbound, err = grantsFor(ctx, open, "anchor")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if g, ok := grantOf(grants, "postgres-database", "laptop", "board"); ok && g.From != "" {
+		t.Fatalf("the anchor's store is still granted a consumer bound to the laptop's: %+v", g)
+	}
+	if len(unbound) != 1 || unbound[0].Module != "board" || unbound[0].Provider != "anchor" ||
+		strings.Join(unbound[0].BoundTo, ",") != "laptop" {
+		t.Fatalf("the consumer that moved is not the one said: %+v", unbound)
+	}
+	planned, settings, err := planFor(ctx, open, "anchor")
+	if err != nil {
+		t.Fatal(err)
+	}
+	declared, err := declarationFor(ctx, open, "anchor", planned, settings)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := declared.Received["store"]["postgres-database"]; len(got) != 0 {
+		t.Fatalf("the anchor's store is still told about %+v", got)
+	}
+	said := printed(t, func() error { reportLeftOut("anchor", declared); return nil })
+	if !strings.Contains(said, "board on laptop is bound to laptop for postgres-database, not to anchor") ||
+		!strings.Contains(said, "cleanup delete") {
+		t.Fatalf("the push does not say whom the anchor no longer grants:\n%s", said)
+	}
+
+	// The store it is bound to: granted.
+	grants, _, unbound, err = grantsFor(ctx, open, "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if g, ok := grantOf(grants, "postgres-database", "laptop", "board"); !ok || g.From != "board" || len(unbound) != 0 {
+		t.Fatalf("the consumer is not granted by the store it is bound to: %+v, unbound %+v", grants, unbound)
+	}
+
+	// And the credential from the store it left is kept: the key to the login and data held there.
+	if holders, err = inv.HoldersOf(ctx, "postgres-database", "laptop"); err != nil || len(holders) != 2 {
+		t.Fatalf("a credential was forgotten while its provider still holds the login: %+v, %v", holders, err)
+	}
+}
+
+// A consumer whose resolution cannot be read is an error, never a consumer bound nowhere — withdrawing
+// a grant on that reading would take its access away (issue 152).
+func TestAConsumerWhoseResolutionCannotBeReadIsNotWithdrawn(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	for _, m := range storeManifests() {
+		register(t, open, m)
+	}
+	for _, a := range [][2]string{{"anchor", "store"}, {"laptop", "board"}} {
+		if _, err := assign(ctx, open, a[0], a[1]); err != nil {
+			t.Fatalf("assign %s %s: %v", a[0], a[1], err)
+		}
+	}
+	if _, _, err := planFor(ctx, open, "laptop"); err != nil {
+		t.Fatal(err)
+	}
+
+	// The laptop's key changes to one nothing can seal to: its resolution cannot be completed, and
+	// that is not its set failing to compose.
+	laptop, err := inv.NodeByName(ctx, "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.RecordSealingKey(ctx, laptop.ID, "not a key"); err != nil {
+		t.Fatal(err)
+	}
+	if _, _, err := planFor(ctx, open, "laptop"); err == nil || unresolvable(err) {
+		t.Fatalf("the seam this test relies on moved: %v", err)
+	}
+	grants, _, unbound, err := grantsFor(ctx, open, "anchor")
+	if err == nil {
+		t.Fatalf("an unreadable consumer was answered: grants %+v, unbound %+v", grants, unbound)
+	}
+	if !strings.Contains(err.Error(), "what laptop asked of postgres-database cannot be read") {
+		t.Fatalf("the error does not say whose resolution could not be read: %v", err)
+	}
+}
+
+// The rule itself, on a resolution: bound is the provider a need for exactly that credential is
+// answered by, never one answered by a record, and a different local name is a different credential.
+func TestBindsFromIsTheProviderOfThatCredential(t *testing.T) {
+	r := catalogue.Resolution{Needs: []catalogue.Needed{
+		{Name: "postgres-database", For: "board", From: "laptop"},
+		{Name: "postgres-database", For: "board", From: "laptop", Local: "reports"},
+		{Name: "postgres-database", For: "wiki", From: "anchor"},
+		{Name: "a-licence", For: "board", From: "the-licence", ByRecord: true},
+	}}
+	s := inventory.Secret{Name: "postgres-database", ConsumerModule: "board"}
+	if got := r.BindsFrom(s.Name, s.ConsumerModule, s.Local); strings.Join(got, ",") != "laptop" {
+		t.Fatalf("board's credential is bound to %v", got)
+	}
+	if got := r.BindsFrom("postgres-database", "board", "archive"); len(got) != 0 {
+		t.Fatalf("a local name nothing asks for is bound to %v", got)
+	}
+	if got := r.BindsFrom("a-licence", "board", ""); len(got) != 0 {
+		t.Fatalf("a need answered by a record is bound to %v", got)
+	}
+}

cmd/mesh-controller/handacts.go

@@ -0,0 +1,376 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"os"
+	"slices"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/nats-io/nats.go"
+
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// Acts done by hand, and why (novox/hq to-be 45 §7).
+//
+// **Which verbs ask why.** `plans close` and `plans stop`, `broker consumer-reset` and `hand-act
+// record` refuse without it everywhere: nothing automated runs them, so a call without a reason is a
+// person who has not given one. A named `push` asks for it through the mesh-controller seat, which is
+// how a person or an agent acts by hand on the mesh; at a shell `--why` is recorded when given and not
+// required, because the installer and the lab push by command line as a step of what they do, and a
+// step of a procedure is not a repair. `conditions silence` joins them when the condition store does
+// (Phase 1).
+
+// handActVerb is one verb that writes the hand-act log, and whether what it records is a repair.
+type handActVerb struct {
+	Verb string
+	// Decision says why an act of this verb is a person's decision by design rather than a repair a
+	// healer could take over; empty for a repair.
+	Decision string
+	// DecidedFor limits Decision to these causes; empty, it holds for every act of the verb.
+	DecidedFor []string
+	// DecidedWhen limits Decision to the acts it answers true for: what the controller read the act to
+	// be from what it did (a push's kind), never a word the person gave.
+	DecidedWhen func(link.HandAct) bool
+}
+
+// causeLeakedInLogs is the cause a rotation after a value was printed into a log gives.
+const causeLeakedInLogs = "leaked-in-logs"
+
+// causeDrill is the cause of every act `hand-act drill` records, and the one cause `hand-act record`
+// refuses: a drill has its own verb, so whether an act was a drill is said by the verb a person chose,
+// never by a word typed into a repair's cause (novox/hq issue 292).
+const causeDrill = "drill"
+
+// handActVerbs is every verb that writes the hand-act log (novox/hq to-be 45 §7). **S15 reads it**:
+// an act recorded by a verb whose entry names a decision is the mesh working as decided, never a
+// repair, and does not count toward `healer-wanted` — whatever cause it gives. A verb not listed, or
+// listed without a decision, counts, so a new verb is a repair until its entry says otherwise.
+var handActVerbs = []handActVerb{
+	// Repairs: each repeated is a healer the mesh lacks. A push by hand is exactly what roll-out by
+	// default (ADR 0236) exists to end — except a push that only moved builds a `record` policy held for
+	// a person's word (ADR 0242), which the push itself reads from what it carried (recorded_push.go).
+	{Verb: "push", Decision: "a recorded build moves only by a person's push: that push is the word its " +
+		"upgrade policy asks for (ADR 0242)", DecidedWhen: pushedRecorded},
+	// Stopping or starting a walk the operator chose on a warrant (novox/hq ADR 0259) is their decision.
+	{Verb: "plans stop", Decision: "the operator's answer to an ask is their decision, not a repair (ADR 0259)",
+		DecidedFor: []string{conditions.CauseOperatorAnswer}},
+	{Verb: "plans close"},
+	// A walk started by a person instead of its delivery's owner (novox/hq ADR 0239): the owner down, or
+	// not trusted with it — either is a repair the owner should have made. Unless the operator chose it on
+	// a warrant (ADR 0259).
+	{Verb: "plans go", Decision: "the operator's answer to an ask is their decision, not a repair (ADR 0259)",
+		DecidedFor: []string{conditions.CauseOperatorAnswer}},
+	// An act the operator chose on a warrant (novox/hq ADR 0259): asked by the controller, answered on a
+	// channel that proved who answered, performed by the controller as itself.
+	{Verb: handActWarrant, Decision: "the operator chose it, answering what the controller asked (ADR 0259)"},
+	{Verb: "broker consumer-reset"},
+	// Silencing the same condition twice says the condition, or what it watches, wants mending — unless
+	// it is the operator's answer on a notification: a decision to live with it (novox/hq ADR 0258).
+	{Verb: "conditions silence", Decision: "the operator's answer on a notification is their decision, " +
+		"not a repair (ADR 0258)", DecidedFor: []string{conditions.CauseOperatorAnswer}},
+	// An act done outside the mesh: the mesh cannot tell a repair from a decision there, so it counts —
+	// except a drill recorded through it before `hand-act drill` existed (2026-10-07). It refuses the
+	// cause since, so no act recorded through it now carries it.
+	{Verb: "hand-act record", Decision: "a drill recorded before `hand-act drill` existed: a person's " +
+		"deliberate test, never a repair", DecidedFor: []string{causeDrill}},
+	// A drill: something broken on purpose to see the mesh raise and clear it. A person's test, never a
+	// repair, however often it is run.
+	{Verb: "hand-act drill", Decision: "a drill is a person's deliberate test of the mesh, never a repair"},
+	// A person's decisions by design.
+	{Verb: "retire approve", Decision: "nothing is retired past its bound without a person (ADR 0230)"},
+	{Verb: "retire reject", Decision: "keeping a consumer active is a person's word (ADR 0230)"},
+	{Verb: "cleanup delete", Decision: "nothing retired is deleted without a person (ADR 0230)"},
+	// What becomes of a message a consumer gave up on (novox/hq issue 330): kept until a person says.
+	{Verb: "dead-letters deliver", Decision: "a message a consumer gave up on is delivered again only on a " +
+		"person's word (issue 330)"},
+	{Verb: "dead-letters drop", Decision: "a message a consumer gave up on is let go only on a person's word " +
+		"(issue 330)"},
+	// The sweep run on a person's word rather than after a build: the same decision the records make, at
+	// a moment the person chose (ADR 0251) — never a repair.
+	{Verb: "collect", Decision: "letting the store go of what the records keep for no reason, now rather " +
+		"than at the next build, is a person's word (ADR 0251)"},
+	// Recording a copy no record names as the mesh's: a person's reading of the store, never a repair
+	// (ADR 0257).
+	{Verb: "mirrors", Decision: "which copies in the store no record names are the mesh's is a person's " +
+		"word (ADR 0257)"},
+	{Verb: "bus upgrade", Decision: "the bus is never rolled by the mesh: replacing it is a planned step a " +
+		"person starts (ADR 0236)"},
+	{Verb: "upgrade release-backlog", Decision: "after a release plan failed, the next opens only when a " +
+		"person releases it (ADR 0236)"},
+	// A leak is judged by a person — which value was exposed, to whom — and its rotation is the answer
+	// to that judgement. Several values rotate for one leak, and a leak that recurs is a defect of the
+	// module that prints them, an issue against it, not a healer that rotates. A rotation for any other
+	// cause — a credential that stopped working — counts: a schedule or a healer could take it over.
+	{Verb: "secret rotate", Decision: "a value a person judged disclosed is replaced on their word",
+		DecidedFor: []string{causeLeakedInLogs}},
+}
+
+// personsDecision is whether an act in the log is a person's decision by design, by the verb that
+// recorded it (handActVerbs).
+func personsDecision(a link.HandAct) bool {
+	for _, v := range handActVerbs {
+		if v.Verb != a.Verb {
+			continue
+		}
+		return v.Decision != "" && (len(v.DecidedFor) == 0 || slices.Contains(v.DecidedFor, a.Cause)) &&
+			(v.DecidedWhen == nil || v.DecidedWhen(a))
+	}
+	return false
+}
+
+// handActFlags are the flags every repairing verb takes.
+type handActFlags struct {
+	why, cause, condition *string
+}
+
+func addHandActFlags(set *flag.FlagSet) handActFlags {
+	return handActFlags{
+		why:       set.String("why", "", "why this is done by hand — recorded in the hand-act log (novox/hq to-be 45 §7)"),
+		cause:     set.String("cause", "", "the cause, in a word or a condition's kind; the verb's own name when not given"),
+		condition: set.String("condition", "", "the key of the condition this act addresses, if any"),
+	}
+}
+
+// given is whether a reason was given.
+func (f handActFlags) given() bool { return strings.TrimSpace(*f.why) != "" }
+
+// require refuses an act without a reason, before anything is done.
+func (f handActFlags) require(verb string) error {
+	if f.given() {
+		return nil
+	}
+	return fmt.Errorf("%s is a repair done by hand, and says why: --why <text> (recorded in the hand-act "+
+		"log, novox/hq to-be 45 §7). Nothing was done", verb)
+}
+
+// handActConn is the serving controller's connection, for what it reads of the log itself; a
+// command dials its own.
+var handActConn *nats.Conn
+
+// onTheBus runs f with a connection to the bus: the serving controller's, or one of its own.
+func onTheBus(f func(*nats.Conn) error) error {
+	if handActConn != nil {
+		return f(handActConn)
+	}
+	js, err := aBus()
+	if err != nil {
+		return err
+	}
+	defer js.Close()
+	return f(js.Conn())
+}
+
+// record writes the entry for an act about to be done. **Before the act, and never instead of it**:
+// a log that cannot be written is said loudly, and the repair it was about still happens — a mesh
+// whose bus is down is exactly the mesh somebody is repairing by hand.
+func (f handActFlags) record(ctx context.Context, verb string, args []string) {
+	if !f.given() {
+		return
+	}
+	act := link.HandAct{Verb: verb, Args: args, Why: strings.TrimSpace(*f.why),
+		Cause: strings.TrimSpace(*f.cause), Condition: strings.TrimSpace(*f.condition)}
+	// A push naming one machine says whether it only moves recorded builds (novox/hq issue 301):
+	// read from what it carries, before it is sent.
+	if verb == "push" && len(args) == 1 && !strings.HasPrefix(args[0], "-") {
+		switch carried, why, err := recordedPushOf(ctx, args[0]); {
+		case err != nil:
+			fmt.Fprintf(os.Stderr, "whether this push only moves recorded builds could not be read, so it is "+
+				"recorded as a push by hand: %v\n", err)
+		case len(carried) > 0:
+			act.Kind, act.Carried = link.KindRecordedBuilds, carried
+		default:
+			fmt.Printf("a push by hand, not of recorded builds only: %s\n", why)
+		}
+	}
+	err := onTheBus(func(conn *nats.Conn) error {
+		written, err := link.RecordHandAct(ctx, conn, act)
+		act = written
+		return err
+	})
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "this act by hand could NOT be recorded in the hand-act log, and is done anyway: %v\n", err)
+		return
+	}
+	if act.Kind == link.KindRecordedBuilds {
+		fmt.Printf("recorded as %s in the hand-act log: a push of recorded builds (%s) by %s, because %q "+
+			"— the person's word their upgrade policy asks for, which no healer is wanted for\n", act.ID,
+			strings.Join(act.Carried, "; "), act.By, act.Why)
+		return
+	}
+	fmt.Printf("recorded as %s in the hand-act log: %s, because %q (cause: %s)\n", act.ID, act.By, act.Why, act.Cause)
+}
+
+// handActCommand is `hand-act record` and `hand-acts`.
+func handActCommand(ctx context.Context, args []string) error {
+	if len(args) > 0 && args[0] == "record" {
+		set := flag.NewFlagSet("hand-act record", flag.ContinueOnError)
+		f := addHandActFlags(set)
+		positionals, err := parseAround(set, args[1:])
+		if err != nil {
+			return err
+		}
+		what := strings.TrimSpace(strings.Join(positionals, " "))
+		if what == "" {
+			return errors.New("hand-act record <what was done> --why <text> [--cause <word>] [--condition <key>]")
+		}
+		if err := f.require("hand-act record"); err != nil {
+			return err
+		}
+		if strings.TrimSpace(*f.cause) == "" {
+			return errors.New("hand-act record says the cause too: --cause <word>, the word a second " +
+				"act for the same reason will use — it is how a repair done twice is found")
+		}
+		if strings.EqualFold(strings.TrimSpace(*f.cause), causeDrill) {
+			return errors.New("a drill is not recorded as a repair: hand-act drill <what was done> --why <text> " +
+				"records it as the person's deliberate test it is, which no healer is wanted for. Nothing was recorded")
+		}
+		act := link.HandAct{Verb: "hand-act record", Args: []string{what}, Why: strings.TrimSpace(*f.why),
+			Cause: strings.TrimSpace(*f.cause), Condition: strings.TrimSpace(*f.condition)}
+		return onTheBus(func(conn *nats.Conn) error {
+			written, err := link.RecordHandAct(ctx, conn, act)
+			if err != nil {
+				return fmt.Errorf("the act could not be recorded: %w", err)
+			}
+			fmt.Printf("recorded as %s: %s did %q, because %q (cause: %s)\n", written.ID, written.By, what,
+				written.Why, written.Cause)
+			return nil
+		})
+	}
+	if len(args) > 0 && args[0] == "drill" {
+		return handActDrill(ctx, args[1:])
+	}
+	if len(args) > 0 && args[0] != "list" && !strings.HasPrefix(args[0], "-") {
+		return errors.New("hand-act record <what> --why <text> --cause <word> | hand-act drill <what> --why <text> " +
+			"| hand-acts [--days N] [--json]")
+	}
+	if len(args) > 0 && args[0] == "list" {
+		args = args[1:]
+	}
+	return listHandActs(ctx, args, os.Stdout)
+}
+
+// listHandActs is `hand-acts`: what was done by hand lately, and the causes done more than once.
+func listHandActs(ctx context.Context, args []string, w io.Writer) error {
+	set := flag.NewFlagSet("hand-acts", flag.ContinueOnError)
+	usageTo(set, w)
+	days := set.Int("days", 14, "how many days back")
+	asJSON := set.Bool("json", false, "as data")
+	if _, err := parseAround(set, args); err != nil {
+		return err
+	}
+	return onTheBus(func(conn *nats.Conn) error {
+		now := time.Now()
+		acts, err := link.HandActs(ctx, conn, now.Add(-time.Duration(*days)*24*time.Hour))
+		if err != nil {
+			return err
+		}
+		repeated := link.RepeatedCauses(repairs(acts), now)
+		if *asJSON {
+			body, err := json.MarshalIndent(map[string]any{"acts": acts, "repeated": repeated}, "", "  ")
+			if err != nil {
+				return err
+			}
+			fmt.Fprintln(w, string(body))
+			return nil
+		}
+		if len(acts) == 0 {
+			fmt.Fprintf(w, "nothing was done by hand in the last %d day(s)\n", *days)
+			return nil
+		}
+		for i := len(acts) - 1; i >= 0; i-- {
+			a := acts[i]
+			fmt.Fprintf(w, "%s  %s  %s %s\n    by %s — %s (cause: %s", a.At.Local().Format("2006-01-02 15:04"), a.ID,
+				a.Verb, strings.Join(a.Args, " "), a.By, a.Why, a.Cause)
+			if a.Condition != "" {
+				fmt.Fprintf(w, ", condition %s", a.Condition)
+			}
+			fmt.Fprintln(w, ")")
+			if pushedRecorded(a) {
+				carried := strings.Join(a.Carried, "; ")
+				if carried == "" {
+					carried = recordedBefore[a.ID]
+				}
+				fmt.Fprintf(w, "    a push of recorded builds, no repair: %s\n", carried)
+			}
+		}
+		if len(repeated) > 0 {
+			causes := make([]string, 0, len(repeated))
+			for c, n := range repeated {
+				causes = append(causes, fmt.Sprintf("%s ×%d", c, n))
+			}
+			sort.Strings(causes)
+			fmt.Fprintf(w, "\ndone by hand more than once in a fortnight — a healer is wanted (to-be 45 S15): %s\n",
+				strings.Join(causes, ", "))
+		}
+		return nil
+	})
+}
+
+// handActDrill is `hand-act drill`: an act done on purpose to test the mesh — a module stopped, a
+// process killed — recorded so the conditions it raises are read as the drill they are. Its cause is
+// always causeDrill and S15 never counts it (handActVerbs).
+func handActDrill(ctx context.Context, args []string) error {
+	set := flag.NewFlagSet("hand-act drill", flag.ContinueOnError)
+	why := set.String("why", "", "what the drill tests — recorded in the hand-act log (novox/hq to-be 45 §7)")
+	condition := set.String("condition", "", "the key of the condition the drill is meant to raise, if any")
+	positionals, err := parseAround(set, args)
+	if err != nil {
+		return err
+	}
+	what := strings.TrimSpace(strings.Join(positionals, " "))
+	if what == "" {
+		return errors.New("hand-act drill <what was done on purpose> --why <what it tests> [--condition <key>]")
+	}
+	if strings.TrimSpace(*why) == "" {
+		return errors.New("a drill says what it tests: --why <text> (recorded in the hand-act log, novox/hq " +
+			"to-be 45 §7). Nothing was recorded")
+	}
+	act := link.HandAct{Verb: "hand-act drill", Args: []string{what}, Why: strings.TrimSpace(*why),
+		Cause: causeDrill, Condition: strings.TrimSpace(*condition)}
+	return onTheBus(func(conn *nats.Conn) error {
+		written, err := link.RecordHandAct(ctx, conn, act)
+		if err != nil {
+			return fmt.Errorf("the drill could not be recorded: %w", err)
+		}
+		fmt.Printf("recorded as %s: %s drilled %q, because %q — a drill, which no healer is wanted for\n",
+			written.ID, written.By, what, written.Why)
+		return nil
+	})
+}
+
+// repairs are the acts that are not a person's decision by design: what S15 counts.
+func repairs(acts []link.HandAct) []link.HandAct {
+	out := make([]link.HandAct, 0, len(acts))
+	for _, a := range acts {
+		if !personsDecision(a) {
+			out = append(out, a)
+		}
+	}
+	return out
+}
+
+// handActsThisWeek is how many acts were done by hand in the last seven days, for `status`; -1 when
+// the log could not be read, which status says rather than reading as none.
+func handActsThisWeek(ctx context.Context) (int, string) {
+	n := -1
+	err := onTheBus(func(conn *nats.Conn) error {
+		reading, cancel := context.WithTimeout(ctx, 5*time.Second)
+		defer cancel()
+		acts, err := link.HandActs(reading, conn, time.Now().Add(-7*24*time.Hour))
+		n = len(acts)
+		return err
+	})
+	if err != nil {
+		return -1, err.Error()
+	}
+	return n, ""
+}

cmd/mesh-controller/handacts_test.go

@@ -0,0 +1,118 @@
+package main
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// **Every verb that repairs by hand takes a required why** (novox/hq to-be 45 §7): refused before
+// anything is done, through the seat, through `command`, and at a shell where nothing automated runs
+// the verb.
+func TestARepairByHandWithoutAReasonIsRefused(t *testing.T) {
+	for _, c := range []struct {
+		verb string
+		args map[string]any
+	}{
+		{"push", map[string]any{"node": "anchor"}},
+		{"push", map[string]any{}},
+		{"plans", map[string]any{"close": "plan-1"}},
+		{"plans", map[string]any{"stop": "plan-1"}},
+		{"hand-act", map[string]any{"what": "restarted the proxy", "cause": "proxy-stuck"}},
+	} {
+		argv, err := argvFor(c.verb, c.args)
+		if c.verb == "plans" && err == nil {
+			// The seat composes the command line; the command refuses it, before opening anything.
+			err = plansCommand(context.Background(), argv[1:])
+		}
+		if err == nil || !strings.Contains(err.Error(), "why") {
+			t.Errorf("%s %v was not refused for want of why: %v %v", c.verb, c.args, argv, err)
+		}
+	}
+	for _, args := range [][]string{{"EVENTS", "controller"}} {
+		if err := consumerReset(context.Background(), args); err == nil || !strings.Contains(err.Error(), "--why") {
+			t.Errorf("consumer-reset without why: %v", err)
+		}
+	}
+	if err := handActCommand(context.Background(), []string{"record", "restarted the proxy", "--cause", "x"}); err == nil ||
+		!strings.Contains(err.Error(), "--why") {
+		t.Errorf("hand-act record without why: %v", err)
+	}
+	if err := handActCommand(context.Background(), []string{"record", "restarted the proxy", "--why", "it hung"}); err == nil ||
+		!strings.Contains(err.Error(), "--cause") {
+		t.Errorf("hand-act record without a cause: %v", err)
+	}
+}
+
+// With a reason, the seat passes it to the command, and a verb that only reads is not held to one.
+func TestARepairByHandCarriesItsReason(t *testing.T) {
+	for _, c := range []struct {
+		verb string
+		args map[string]any
+		want string
+	}{
+		{"push", map[string]any{"node": "anchor", "why": "stuck", "cause": "sent-not-reported"},
+			"push anchor --wait 0 --why stuck --cause sent-not-reported"},
+		{"plans", map[string]any{"close": "plan-1", "why": "the report will not come"},
+			"plans close plan-1 --why the report will not come"},
+		{"plans", map[string]any{"retry": "plan-1"}, "plans retry plan-1"},
+		{"hand-act", map[string]any{"what": "restarted", "why": "hung", "cause": "proxy", "condition": "machine.a.silent"},
+			"hand-act record restarted --why hung --cause proxy --condition machine.a.silent"},
+		{"command", map[string]any{"command": "plans plan-1"}, "plans plan-1"},
+	} {
+		argv, err := argvFor(c.verb, c.args)
+		if err != nil || strings.Join(argv, " ") != c.want {
+			t.Errorf("%s %v: %v %v, want %q", c.verb, c.args, argv, err, c.want)
+		}
+	}
+}
+
+// The summary of durations says, per kind and subject, what a bound would be set from.
+func TestDurationsAreSummarisedPerSubject(t *testing.T) {
+	var ds []inventory.Duration
+	for i := 1; i <= 10; i++ {
+		ds = append(ds, inventory.Duration{Kind: inventory.DurationApply, Subject: "anchor",
+			Took: time.Duration(i) * time.Second})
+	}
+	ds = append(ds, inventory.Duration{Kind: inventory.DurationHeartbeatGap, Subject: "anchor", Took: time.Minute})
+	got := summarise(ds)
+	if len(got) != 2 || got[0].Kind != inventory.DurationApply || got[0].Count != 10 ||
+		got[0].Max != "10s" || got[0].Median != "5s" || got[0].P90 != "9s" {
+		t.Fatalf("%+v", got)
+	}
+	if !strings.Contains(got[1].Suggests, "3m0s") {
+		t.Fatalf("a minute between words suggests %q", got[1].Suggests)
+	}
+}
+
+// **A drill has its own verb** — `hand-act drill`, the seat's `drill` — and `hand-act record` refuses
+// the cause, so a repair cannot pass for a drill by the word it gives.
+func TestADrillIsRecordedThroughItsOwnVerb(t *testing.T) {
+	err := handActCommand(context.Background(), []string{"record", "stopped searxng", "--why", "a test", "--cause", "drill"})
+	if err == nil || !strings.Contains(err.Error(), "hand-act drill") {
+		t.Errorf("hand-act record --cause drill was not sent to the drill verb: %v", err)
+	}
+	if err := handActCommand(context.Background(), []string{"drill", "stopped searxng"}); err == nil ||
+		!strings.Contains(err.Error(), "--why") {
+		t.Errorf("a drill without what it tests: %v", err)
+	}
+	if err := handActCommand(context.Background(), []string{"drill", "--why", "a test"}); err == nil ||
+		!strings.Contains(err.Error(), "hand-act drill <what") {
+		t.Errorf("a drill without what was done: %v", err)
+	}
+	argv, err := argvFor("drill", map[string]any{"what": "stopped searxng", "why": "ADR 0240 phase A",
+		"condition": "machine.ace.module.searxng.unhealthy"})
+	if want := "hand-act drill stopped searxng --why ADR 0240 phase A --condition machine.ace.module.searxng.unhealthy"; err != nil ||
+		strings.Join(argv, " ") != want {
+		t.Errorf("the seat's drill: %v %v, want %q", argv, err, want)
+	}
+	if _, err := argvFor("drill", map[string]any{"what": "stopped searxng"}); err == nil {
+		t.Error("the seat's drill without why was not refused")
+	}
+	if repairingCommand([]string{"hand-act", "drill", "x"}) != "hand-act drill" {
+		t.Error("a drill through `command` is not held to why")
+	}
+}

cmd/mesh-controller/healers.go

@@ -0,0 +1,876 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"slices"
+	"sort"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/nats-io/nats.go"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// The healers (novox/hq to-be 45 §7, ADR 0227 rule 7, Phase 3).
+//
+// **A known failure heals itself, under a brake, and every repair is said.** Research 031 counted the
+// repairs people made by hand in six days: a push to unstick a plan waiting on a report (four times),
+// a controller restarted to make an object again (twice), a plan closed (twice), a consumer re-made from
+// now (once). Each was the ordinary path, taken again by a person who noticed. A healer is that act,
+// registered against the one condition kind it answers, so the mesh takes it itself:
+//
+//   - **its repair is the ordinary path again** — the send a push makes, the plan's own close, the
+//     assertion every send makes, the consumer reset the verb makes — never a withdrawal, a deletion of
+//     data or a recreation of it;
+//   - **its budget** is how many acts it may take against one thing in a window, and **its settle** how
+//     long after an act it leaves the observation to say whether it worked;
+//   - **success is never the healer's to say.** The condition clears when the watchdog or the probe that
+//     raised it no longer sees it. A healer marking its own work done would be the second opinion of a
+//     fact that rule 1 forbids;
+//   - **a spent budget stops it**: the condition is the operator's, urgent, with every attempt in
+//     `tried`, and no healer touches it again until observation clears it;
+//   - **every act is said**: begun in the store before it is made (so a controller dying mid-act has
+//     still spent it), kept in the condition's `tried` as `healer Hn`, and said on the bus as the
+//     controller seat's `healer-acted`. A heal is not a hand act and is never in the hand-act log —
+//     which is how S15 can tell a repair the mesh made from one a person had to.
+//
+// **And the mesh-wide brake**: more than healBrakeLimit acts in an hour, all healers together, and every
+// healer stops — an urgent condition says so — until an hour has passed with none. A healer looping is
+// then at most a dozen acts, said, and never the incident itself.
+//
+// Only the controller holding the lease heals, under its epoch: a controller serving without the lease
+// (S12) heals nothing, because a repair is the one act that can always wait for the lease.
+
+// The mesh-wide brake (to-be 45 §7): how many acts all healers together may take in an hour.
+const (
+	healBrakeLimit  = 12
+	healBrakeWindow = time.Hour
+)
+
+// healEvery is how often the healers look at what is open.
+var healEvery = 30 * time.Second
+
+// What raises the healers' own conditions, and their kinds.
+const (
+	sourceHealers      = "healers"
+	kindHealersBraked  = "healers-braked"
+	kindConsumerBehind = "consumer-behind"
+	kindHealersBlind   = "probe-failed"
+)
+
+// healerRow is one row of the registry.
+type healerRow struct {
+	ID string
+	// Kinds are the condition kinds it answers: from the signals table, the probe registry, or an event.
+	Kinds []string
+	// Condition, Repair, Then, From are the row in words, as to-be 45 §7 and `healers` say it.
+	Condition string
+	Repair    string
+	Then      string
+	From      string
+	// Budget acts against one budget key within Window; Settle after an act before the next, or the
+	// escalation, so the observation has had its turn to say whether it worked.
+	Budget int
+	Window time.Duration
+	Settle time.Duration
+	// ActsIn is where the repair runs: the controller, or a module that repairs its own (H5).
+	ActsIn string
+	// Event is what each act is said as.
+	Event string
+	// applies says whether this condition is one the healer may act on, and what its budget is
+	// counted against; why when it is not. Reads, never acts. Nil where the repair is a module's.
+	applies func(ctx context.Context, h *healing, c conditions.Condition) (budget string, ok bool, why string, err error)
+	// repair is the act: what it did in words, what came of it, or an error when it could not be done.
+	repair func(ctx context.Context, h *healing, c conditions.Condition) (act, said string, err error)
+}
+
+// actsInController is a healer whose repair the controller makes.
+const actsInController = "controller"
+
+// healerRegistry is to-be 45 §7's table, compiled in. **The registry is the design's live form**: a
+// test generated from it holds every row to a condition kind the mesh raises, a budget, a brake and its
+// event (healers_test.go).
+var healerRegistry = []healerRow{
+	{ID: "H1", Kinds: []string{"sent-not-reported"},
+		Condition: "a machine was sent a declaration and has not reported it (S2)",
+		Repair: "ask the machine's node-engine to say again what it last applied (the `report` verb); if what " +
+			"comes back is not the declaration it was sent, or nothing comes, send it its current declaration " +
+			"again — what a push of that one machine does, never moving a build a policy or a plan holds back",
+		Then: "resolver operator, urgent", From: "a push by hand to unstick a plan waiting on a report (230, 257, 264, 267)",
+		Budget: 2, Window: 6 * time.Hour, Settle: 3 * time.Minute, ActsIn: actsInController, Event: link.KeyHealerActed,
+		applies: appliesToAMachine, repair: repairReport},
+	{ID: "H2", Kinds: []string{"stalled"},
+		Condition: "a plan stalled on a wait that is superseded — a newer plan of its repository and branch " +
+			"exists — or already finished — every module of every tier built or failed, and every one that " +
+			"rolls out sent (S3); or a delivery held past its state's bound where mesh-delivery's table lets H2 " +
+			"take a transition (D14, novox/hq ADR 0239)",
+		Repair: "close the plan with its note, as `plans close` does: superseded, naming the newer plan, or " +
+			"done; what it asked still builds and registers — or, for a delivery, mesh-delivery's `close`, which " +
+			"reads its walk again and takes only the transition its table names",
+		Then: "resolver operator, urgent", From: "a stuck plan closed by hand (214, 254)",
+		Budget: 1, Window: 24 * time.Hour, Settle: 2 * time.Minute, ActsIn: actsInController, Event: link.KeyHealerActed,
+		applies: appliesToAStalePlan, repair: repairPlan},
+	{ID: "H3", Kinds: []string{"holder-silent", "consumer-lost"},
+		Condition: "a seat's holder that does not answer (D3), or a durable consumer the mesh expects and the " +
+			"bus does not hold (D6, S9)",
+		Repair: "assert the bus's streams, consumers and seat workers again — the assertion every send makes " +
+			"(issue 208)",
+		Then: "resolver operator, urgent", From: "a controller restarted to make a missing object again (208, 248)",
+		Budget: 1, Window: time.Hour, Settle: 6 * time.Minute, ActsIn: actsInController, Event: link.KeyHealerActed,
+		applies: appliesToAnObject, repair: repairObjects},
+	{ID: "H4", Kinds: []string{kindConsumerBehind},
+		Condition: "a durable consumer far behind its stream's head (D6) that the stream table marks resettable",
+		Repair: "re-make the consumer to deliver from now — `broker consumer-reset` (issue 248); what it drops " +
+			"is caught up where the table says",
+		Then: "resolver operator, urgent", From: "a consumer re-made from now by hand (248)",
+		Budget: 1, Window: 24 * time.Hour, Settle: 6 * time.Minute, ActsIn: actsInController, Event: link.KeyHealerActed,
+		applies: appliesToAResettableConsumer, repair: repairConsumer},
+	{ID: "H5", Kinds: []string{kindProviderFailing},
+		Condition: "the identity provider's administrator refusing the mesh's secret (provider-failing, " +
+			"credentials-rejected)",
+		Repair: "the provider repairs it itself through the server's own bootstrap command, checks again and " +
+			"says what it did (ADR 0224 §5); the controller keeps its word as the condition",
+		Then: "announced failing by the provider, braked from ten minutes doubling to six hours (ADR 0224 §5)",
+		From: "the identity provider's admin reset through its bootstrap command (179)",
+		// Its budget and brake are the module's own: ten minutes, doubling, to six hours.
+		Budget: 1, Window: 10 * time.Minute, Settle: 10 * time.Minute,
+		ActsIn: "the provider module (keycloak), ADR 0224 §5", Event: "provisioner.failing, provisioner.recovered"},
+}
+
+// healerFor is the healer registered for a kind, and false when none acts in the controller.
+func healerFor(kind string) (healerRow, bool) {
+	for _, r := range healerRegistry {
+		if r.repair != nil && slices.Contains(r.Kinds, kind) {
+			return r, true
+		}
+	}
+	return healerRow{}, false
+}
+
+// healerNamedFor is any healer registered for a kind, wherever it acts: what S15 says beside a cause.
+func healerNamedFor(kind string) string {
+	for _, r := range healerRegistry {
+		if slices.Contains(r.Kinds, kind) {
+			return r.ID
+		}
+	}
+	return ""
+}
+
+// healing is the healers' runner and what their repairs reach.
+type healing struct {
+	open   *stores
+	keeper *conditions.Keeper
+	teller conditions.Teller
+	// js is the bus, for the repairs that assert or reset its objects; nil where there is none.
+	js *broker.JetStream
+	// epoch is the lease's gate; acting says this controller is the one acting, not one standing by.
+	epoch  func(ctx context.Context) (uint64, error)
+	acting func() bool
+	now    func() time.Time
+	say    func(format string, args ...any)
+
+	// The acts, as seams a test replaces: asking a machine to report, sending it again, asserting the
+	// bus's objects, resetting a consumer.
+	askReport     func(ctx context.Context, node string) error
+	sendAgain     func(ctx context.Context, node string) error
+	assertObjects func(ctx context.Context) error
+	resetConsumer func(stream, name string) (string, error)
+	// reportWait is how long H1 waits for the machine's report after asking.
+	reportWait time.Duration
+
+	mu sync.Mutex
+	// declined is why each condition was last passed over, so it is said once and `healers` can show it.
+	declined map[string]string
+	paused   string
+}
+
+// newHealing is the serving controller's runner, its acts the real ones.
+func newHealing(open *stores, keeper *conditions.Keeper, teller conditions.Teller, js *broker.JetStream) *healing {
+	h := &healing{open: open, keeper: keeper, teller: teller, js: js, acting: link.Holding,
+		epoch: func(ctx context.Context) (uint64, error) { return theLease.epoch(ctx) },
+		now:   time.Now, say: func(format string, args ...any) { fmt.Printf(format+"\n", args...) },
+		reportWait: 45 * time.Second, declined: map[string]string{}}
+	h.askReport = func(ctx context.Context, node string) error {
+		if h.js == nil {
+			return errors.New("this controller is not on the bus")
+		}
+		return askToReport(ctx, h.js.Conn(), node)
+	}
+	h.sendAgain = func(ctx context.Context, node string) error {
+		// **Never what a policy or a plan holds back** (ADR 0221): a send by the mesh itself is a push
+		// that did not name the machine — a person's word sends a held build, a healer's does not.
+		held, err := heldMachines(ctx, open, []string{node})
+		if err != nil {
+			return err
+		}
+		if why := held[node]; len(why) > 0 {
+			return fmt.Errorf("not sent again: it would move what a policy or a plan holds back (ADR 0221) — %s; "+
+				"`push %s` sends it, on a person's word", strings.Join(why, "; "), node)
+		}
+		return sendTo(ctx, open, []string{node})
+	}
+	h.assertObjects = func(ctx context.Context) error {
+		if h.js == nil {
+			return errors.New("this controller is not on the bus")
+		}
+		return assertOnSend(ctx, open.inventory, h.js, "  ")
+	}
+	h.resetConsumer = func(stream, name string) (string, error) {
+		if h.js == nil {
+			return "", errors.New("this controller is not on the bus")
+		}
+		before, after, err := h.js.ResetConsumer(stream, name)
+		if err != nil {
+			return "", err
+		}
+		return fmt.Sprintf("it was %d behind with %d unacknowledged; it delivers from now, %d pending", before.Pending,
+			before.AckPending, after.Pending), nil
+	}
+	return h
+}
+
+// askToReport asks one machine's node-engine to say again what it last applied (to-be 45 §6). On core
+// NATS, fired and flushed: the answer is the machine's ordinary report, read from the store.
+func askToReport(ctx context.Context, conn *nats.Conn, node string) error {
+	body, err := json.Marshal(map[string]any{"asked": time.Now().UTC(), "by": "the controller's healer H1"})
+	if err != nil {
+		return err
+	}
+	if err := conn.Publish(broker.AskReportSubject(node), body); err != nil {
+		return err
+	}
+	flushing, cancel := context.WithTimeout(ctx, 5*time.Second)
+	defer cancel()
+	return conn.FlushWithContext(flushing)
+}
+
+// keep runs the healers until ctx ends.
+func (h *healing) keep(ctx context.Context) {
+	tick := time.NewTicker(healEvery)
+	defer tick.Stop()
+	for {
+		h.tick(ctx)
+		select {
+		case <-ctx.Done():
+			return
+		case <-tick.C:
+		}
+	}
+}
+
+// tick is one look at what is open, and every act it calls for.
+func (h *healing) tick(ctx context.Context) {
+	if h.acting != nil && !h.acting() {
+		return
+	}
+	epoch, err := h.epoch(ctx)
+	switch {
+	case err != nil:
+		h.pause(fmt.Sprintf("this controller may not act: %v", err))
+		return
+	case epoch == 0:
+		h.pause("this controller serves without the lease (S12): a repair waits for it")
+		return
+	}
+	inv := h.open.inventory
+	now := h.now()
+	heals, err := inv.HealsSince(ctx, now.Add(-24*time.Hour))
+	if err != nil {
+		// Blind: nothing is done, and that is said — never read as "no heals, budgets whole".
+		h.reconcile(ctx, []conditions.Observation{{Scope: conditions.ScopeProbe, ID: "healers", Token: "failed",
+			Kind: kindHealersBlind, Severity: conditions.Warning,
+			Summary: "the healers cannot read what they did, so they count no budget and act on nothing",
+			Said:    firstLine(err.Error())}})
+		return
+	}
+	open, err := h.keeper.Open(ctx)
+	if err != nil {
+		h.say("the healers cannot read the open conditions, and act on nothing: %v", err)
+		return
+	}
+	acts := actsWithin(heals, now.Add(-healBrakeWindow))
+	if braked, said := brakeHolds(acts, open, now); braked {
+		h.reconcile(ctx, []conditions.Observation{brakeObservation(acts, said)})
+		h.pause("the mesh-wide brake holds: " + said)
+		return
+	}
+	h.reconcile(ctx, nil)
+	h.resume()
+	for _, c := range open {
+		row, ok := healerFor(c.Kind)
+		if !ok || c.Escalated() {
+			continue
+		}
+		budget, applies, why, err := row.applies(ctx, h, c)
+		if err != nil {
+			h.decline(c.Key, row.ID, "could not tell whether it applies: "+err.Error())
+			continue
+		}
+		if !applies {
+			h.decline(c.Key, row.ID, why)
+			continue
+		}
+		h.forget(c.Key)
+		spent := spentOn(heals, row, budget, now)
+		if n := len(spent); n > 0 && now.Sub(spent[n-1].At) < row.Settle {
+			continue // its last act is still the observation's to judge
+		}
+		if len(spent) >= row.Budget {
+			h.escalate(ctx, row, c, budget, spent)
+			continue
+		}
+		if len(acts) >= healBrakeLimit {
+			return // the brake takes hold on the next look, said there
+		}
+		if h.act(ctx, row, c, budget, len(spent)) {
+			acts = append(acts, inventory.Heal{At: now})
+		}
+	}
+}
+
+// act is one healer's act on one condition: begun in the store, made, finished, kept in the
+// condition's tried and said. False when it could not even be begun.
+func (h *healing) act(ctx context.Context, row healerRow, c conditions.Condition, budget string, spent int) bool {
+	inv := h.open.inventory
+	begun, err := inv.BeginHeal(ctx, inventory.Heal{Healer: row.ID, ConditionKey: c.Key, Kind: c.Kind,
+		BudgetKey: budget, Act: row.Repair, At: h.now()})
+	if err != nil {
+		h.say("healer %s did not act on %s: %v", row.ID, c.Key, err)
+		return false
+	}
+	act, said, err := row.repair(ctx, h, c)
+	outcome := inventory.HealActed
+	if err != nil {
+		outcome, said = inventory.HealFailed, err.Error()
+	}
+	if act == "" {
+		act = row.Repair
+	}
+	finishing, cancel := context.WithTimeout(context.WithoutCancel(ctx), 10*time.Second)
+	defer cancel()
+	if ferr := inv.FinishHeal(finishing, begun.ID, outcome, act+" — "+said); ferr != nil {
+		h.say("healer %s acted on %s and could not record what came of it: %v", row.ID, c.Key, ferr)
+	}
+	budgetWords := fmt.Sprintf("act %d of %d within %s", spent+1, row.Budget, row.Window)
+	attempt := conditions.Attempt{What: act, Outcome: outcome + ": " + said + " (" + budgetWords + ")",
+		By: "healer " + row.ID}
+	if _, _, terr := h.keeper.Tried(finishing, c.Key, attempt, conditions.ResolverHealer(row.ID)); terr != nil {
+		h.say("healer %s acted on %s and could not keep it in the condition: %v", row.ID, c.Key, terr)
+	}
+	h.tell(finishing, healerActed{Healer: row.ID, Condition: c.Key, Kind: c.Kind, Act: act, Outcome: outcome,
+		Said: said, Budget: budgetWords, Epoch: begun.Epoch})
+	h.say("healer %s %s %s: %s — %s (%s)", row.ID, outcome, c.Key, act, said, budgetWords)
+	return true
+}
+
+// escalate is a spent budget: the condition is the operator's now, urgent, with what was tried. Said
+// once: an escalated condition is passed over by every healer until observation clears it.
+func (h *healing) escalate(ctx context.Context, row healerRow, c conditions.Condition, budget string, spent []inventory.Heal) {
+	var tried []string
+	for _, s := range spent {
+		tried = append(tried, fmt.Sprintf("%s at %s (%s)", s.Outcome, s.At.UTC().Format("15:04 MST"), firstLine(s.Said)))
+	}
+	said := fmt.Sprintf("its budget of %d act(s) within %s is spent and %s is still open: %s", row.Budget, row.Window,
+		c.Key, strings.Join(tried, "; "))
+	if _, err := h.open.inventory.BeginHeal(ctx, inventory.Heal{Healer: row.ID, ConditionKey: c.Key, Kind: c.Kind,
+		BudgetKey: budget, Act: "handed the condition to the operator", Outcome: inventory.HealEscalated, Said: said,
+		At: h.now()}); err != nil {
+		h.say("healer %s could not record handing %s to the operator, and does not: %v", row.ID, c.Key, err)
+		return
+	}
+	attempt := conditions.Attempt{What: "handed to the operator: nothing in the mesh will repair it now",
+		Outcome: inventory.HealEscalated + ": " + said, By: "healer " + row.ID}
+	if _, _, err := h.keeper.Escalate(ctx, c.Key, attempt); err != nil {
+		h.say("healer %s could not hand %s to the operator: %v", row.ID, c.Key, err)
+	}
+	h.tell(ctx, healerActed{Healer: row.ID, Condition: c.Key, Kind: c.Kind, Act: "handed to the operator",
+		Outcome: inventory.HealEscalated, Said: said, Budget: fmt.Sprintf("%d of %d within %s", len(spent), row.Budget, row.Window)})
+	h.say("healer %s handed %s to the operator: %s", row.ID, c.Key, said)
+}
+
+// healerActed is the body of `healer-acted` (to-be 45 §7): the healer, the condition, the act and its
+// outcome, and where the budget stands. **A contract**, like a condition's events: the operator-channel's
+// holder may say it.
+type healerActed struct {
+	Event     string    `json:"event"`
+	At        time.Time `json:"at"`
+	Healer    string    `json:"healer"`
+	By        string    `json:"by"`
+	Condition string    `json:"condition"`
+	Kind      string    `json:"kind"`
+	Act       string    `json:"act"`
+	// Outcome is acted, failed or escalated. Acted says the act was made, not that it worked: the
+	// condition clearing says that.
+	Outcome string `json:"outcome"`
+	Said    string `json:"said"`
+	Budget  string `json:"budget"`
+	Epoch   uint64 `json:"epoch,omitempty"`
+	Show    string `json:"show"`
+}
+
+// tell says a heal on the bus. Not said is said in the log: the act and the condition's tried still
+// hold it.
+func (h *healing) tell(ctx context.Context, e healerActed) {
+	e.Event, e.At, e.By = link.KeyHealerActed, h.now().UTC(), "healer "+e.Healer
+	e.Show = "mesh-controller.conditions key=" + e.Condition
+	if h.teller == nil {
+		return
+	}
+	body, err := json.Marshal(e)
+	if err != nil {
+		return
+	}
+	saying, cancel := context.WithTimeout(ctx, 10*time.Second)
+	defer cancel()
+	if err := h.teller.PublishSeatEvent(saying, conditions.Seat, link.KeyHealerActed, body); err != nil {
+		h.say("healer %s %s %s, and that could NOT be said on the bus: %v", e.Healer, e.Outcome, e.Condition, err)
+	}
+}
+
+// reconcile keeps the healers' own conditions: the brake, and their being blind.
+func (h *healing) reconcile(ctx context.Context, observed []conditions.Observation) {
+	if err := h.keeper.Reconcile(ctx, sourceHealers, observed); err != nil {
+		h.say("the healers' own conditions could not be kept: %v", err)
+	}
+}
+
+func (h *healing) pause(why string) {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	if h.paused != why {
+		h.say("the healers act on nothing: %s", why)
+	}
+	h.paused = why
+}
+
+func (h *healing) resume() {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	if h.paused != "" {
+		h.say("the healers act again")
+	}
+	h.paused = ""
+}
+
+// decline remembers why a healer passed a condition over, said once.
+func (h *healing) decline(key, healer, why string) {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	if h.declined[key] != why {
+		h.say("healer %s leaves %s alone: %s", healer, key, why)
+	}
+	h.declined[key] = why
+}
+
+func (h *healing) forget(key string) {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	delete(h.declined, key)
+}
+
+// actsWithin are the heals since a moment that were acts — begun, made or failed; an escalation is a
+// saying, not an act, and the brake does not count it.
+func actsWithin(heals []inventory.Heal, since time.Time) []inventory.Heal {
+	var out []inventory.Heal
+	for _, h := range heals {
+		if !h.At.Before(since) && h.Outcome != inventory.HealEscalated {
+			out = append(out, h)
+		}
+	}
+	return out
+}
+
+// spentOn is one healer's acts against one budget key within its window, oldest first.
+func spentOn(heals []inventory.Heal, row healerRow, budget string, now time.Time) []inventory.Heal {
+	var out []inventory.Heal
+	for _, h := range actsWithin(heals, now.Add(-row.Window)) {
+		if h.Healer == row.ID && h.BudgetKey == budget {
+			out = append(out, h)
+		}
+	}
+	return out
+}
+
+// brakeHolds says whether the mesh-wide brake holds: the limit reached within the hour, or the brake
+// already said and an act within the hour still — it lets go an hour after the last act, not the first.
+func brakeHolds(acts []inventory.Heal, open []conditions.Condition, now time.Time) (bool, string) {
+	said := fmt.Sprintf("%d act(s) by the healers in the last %s, the limit %d", len(acts), healBrakeWindow, healBrakeLimit)
+	if len(acts) >= healBrakeLimit {
+		return true, said
+	}
+	held := slices.ContainsFunc(open, func(c conditions.Condition) bool { return c.Kind == kindHealersBraked })
+	if held && len(acts) > 0 {
+		last := acts[len(acts)-1].At
+		return true, fmt.Sprintf("%s; held until an hour after the last, at %s", said,
+			last.Add(healBrakeWindow).UTC().Format("15:04 MST"))
+	}
+	return false, said
+}
+
+// brakeObservation is the brake, as the urgent condition that says it.
+func brakeObservation(acts []inventory.Heal, said string) conditions.Observation {
+	counts := map[string]int{}
+	for _, a := range acts {
+		if a.Healer != "" {
+			counts[a.Healer+" on "+a.ConditionKey]++
+		}
+	}
+	var most []string
+	for what, n := range counts {
+		most = append(most, fmt.Sprintf("%s ×%d", what, n))
+	}
+	sort.Strings(most)
+	return conditions.Observation{Scope: conditions.ScopeMesh, ID: "healers", Token: "braked", Kind: kindHealersBraked,
+		Severity: conditions.Urgent,
+		Summary: "every healer has stopped: the healers acted more often in an hour than the mesh allows, which is a " +
+			"healer looping, not repairing — " + said,
+		Said: strings.Join(most, ", ")}
+}
+
+// --- H1 ----------------------------------------------------------------------------------------------
+
+// appliesToAMachine is H1's: a machine named, its budget counted against the condition.
+func appliesToAMachine(_ context.Context, _ *healing, c conditions.Condition) (string, bool, string, error) {
+	if c.Subject.Machine == "" {
+		return "", false, "it names no machine", nil
+	}
+	return c.Key, true, "", nil
+}
+
+// repairReport is H1: ask the machine to report; if what comes back is not what it was sent, or nothing
+// comes, send it again.
+func repairReport(ctx context.Context, h *healing, c conditions.Condition) (string, string, error) {
+	node := c.Subject.Machine
+	inv := h.open.inventory
+	// The store's clock, as the report's time is: not the runner's, which a test moves by hand.
+	asked := time.Now()
+	askErr := h.askReport(ctx, node)
+	current, heard := false, false
+	if askErr == nil {
+		deadline := time.Now().Add(h.reportWait)
+		for {
+			r, found, err := lastReportOf(ctx, inv, node)
+			if err != nil {
+				return "", "", err
+			}
+			if found && r.At != nil && r.At.After(asked) {
+				heard, current = true, r.Current
+				if current {
+					break
+				}
+			}
+			if time.Now().After(deadline) {
+				break
+			}
+			select {
+			case <-ctx.Done():
+				return "", "", ctx.Err()
+			case <-time.After(min(2*time.Second, h.reportWait/4+time.Millisecond)):
+			}
+		}
+	}
+	if current {
+		return "asked " + node + "'s node-engine to say again what it last applied",
+			"it reported the declaration it was sent: its report had not reached the mesh", nil
+	}
+	why := "it said nothing within " + h.reportWait.String() + " — its node-engine may be older than the report verb"
+	switch {
+	case askErr != nil:
+		why = "it could not be asked: " + askErr.Error()
+	case heard:
+		why = "it reported a declaration other than the one it was sent"
+	}
+	if err := h.sendAgain(ctx, node); err != nil {
+		return "asked " + node + " to report, then sent it its current declaration again", why + "; the send failed",
+			err
+	}
+	return "asked " + node + " to report, then sent it its current declaration again", why + "; sent again", nil
+}
+
+// lastReportOf is one machine's last report beside its last send.
+func lastReportOf(ctx context.Context, inv *inventory.Inventory, node string) (inventory.Reported, bool, error) {
+	reports, err := inv.LastReports(ctx)
+	if err != nil {
+		return inventory.Reported{}, false, err
+	}
+	for _, r := range reports {
+		if r.Node == node {
+			return r, true, nil
+		}
+	}
+	return inventory.Reported{}, false, nil
+}
+
+// --- H2 ----------------------------------------------------------------------------------------------
+
+// planStale is why a plan's wait is superseded or finished, and the state closing it leaves it in; empty
+// when it is neither, which is not H2's to repair.
+func planStale(ctx context.Context, inv *inventory.Inventory, p inventory.Plan) (state, why string, err error) {
+	if p.Release != nil {
+		return "", "", nil // a release plan walks machines, and its own gate says when it is done (ADR 0236)
+	}
+	recent, err := inv.RecentPlans(ctx, 50)
+	if err != nil {
+		return "", "", err
+	}
+	for _, newer := range recent {
+		if newer.ID == p.ID || !newer.Created.After(p.Created) || !repositoryMatches(newer.Repository, p.Repository) ||
+			newer.Branch != p.Branch || newer.State == inventory.PlanSuperseded {
+			continue
+		}
+		return inventory.PlanSuperseded, fmt.Sprintf("superseded by %s (%s %s), a newer merge of the same repository "+
+			"and branch", newer.ID, newer.Repository, short(newer.Commit)), nil
+	}
+	for _, tier := range p.Tiers {
+		for _, m := range tier {
+			s := p.Modules[m]
+			if s == nil || (s.State != "built" && s.State != "failed") {
+				return "", "", nil
+			}
+			if s.State == "built" && s.SentAt == nil {
+				u, err := inv.UpgradeOf(ctx, m)
+				if err != nil {
+					return "", "", err
+				}
+				if u.RollOut {
+					return "", "", nil
+				}
+			}
+		}
+	}
+	return inventory.PlanDone, "finished: every module of every tier is built or failed, and every one that rolls " +
+		"out was sent — nothing is left to wait on", nil
+}
+
+// appliesToAStalePlan is H2's: the plan is open, and its wait is superseded or finished.
+func appliesToAStalePlan(ctx context.Context, h *healing, c conditions.Condition) (string, bool, string, error) {
+	if c.Subject.Scope == conditions.ScopeDelivery {
+		return appliesToAStalledDelivery(ctx, h, c)
+	}
+	p, err := h.open.inventory.PlanByID(ctx, c.Subject.ID)
+	if err != nil {
+		return "", false, "", err
+	}
+	if !p.Open() {
+		return "", false, "the plan is " + p.State + " already: its condition clears on the next look", nil
+	}
+	state, _, err := planStale(ctx, h.open.inventory, p)
+	if err != nil {
+		return "", false, "", err
+	}
+	if state == "" {
+		return "", false, "its wait is neither superseded nor finished: it waits on something still to come, " +
+			"which its own signal says", nil
+	}
+	return c.Key, true, "", nil
+}
+
+// repairPlan is H2: the plan closed with its note, under the plans' hold, by compare-and-set.
+func repairPlan(ctx context.Context, h *healing, c conditions.Condition) (string, string, error) {
+	if c.Subject.Scope == conditions.ScopeDelivery {
+		return repairDelivery(ctx, h, c)
+	}
+	inv := h.open.inventory
+	release, err := inv.HoldPlans(ctx, true)
+	if err != nil {
+		return "", "", err
+	}
+	defer release()
+	p, err := inv.PlanByID(ctx, c.Subject.ID)
+	if err != nil {
+		return "", "", err
+	}
+	if !p.Open() {
+		return "closed nothing", "the plan is " + p.State + " already", nil
+	}
+	state, why, err := planStale(ctx, inv, p)
+	if err != nil {
+		return "", "", err
+	}
+	if state == "" {
+		return "closed nothing", "its wait is no longer superseded or finished", nil
+	}
+	p.State = state
+	p.Note = fmt.Sprintf("closed by healer H2 at tier %d: %s", p.Tier, why)
+	if state != inventory.PlanDone {
+		sayUnsent(&p, func(m string) bool {
+			u, err := inv.UpgradeOf(ctx, m)
+			return err == nil && u.RollOut
+		})
+	}
+	if err := inv.SavePlan(ctx, &p); err != nil {
+		return "", "", err
+	}
+	return "closed the plan " + p.ID + " (" + state + ")", why, nil
+}
+
+// --- H3 ----------------------------------------------------------------------------------------------
+
+// appliesToAnObject is H3's: every holder or consumer the probe or the bus names, its budget per object.
+func appliesToAnObject(_ context.Context, h *healing, c conditions.Condition) (string, bool, string, error) {
+	if h.assertObjects == nil {
+		return "", false, "this controller is not on the bus", nil
+	}
+	return c.Key, true, "", nil
+}
+
+// repairObjects is H3: the send's own assertion of every stream, consumer and seat worker.
+func repairObjects(ctx context.Context, h *healing, _ conditions.Condition) (string, string, error) {
+	if err := h.assertObjects(ctx); err != nil {
+		return "", "", err
+	}
+	return "asserted the bus's streams, consumers and seat workers again",
+		"every object the mesh defines is asserted; the probe that raised it says on its next run whether it is there", nil
+}
+
+// --- H4 ----------------------------------------------------------------------------------------------
+
+// resettable is why a consumer may be reset by the mesh itself, from the stream table; empty when not.
+func resettable(stream, name string) string {
+	for _, c := range broker.MeshConsumers() {
+		if c.Stream == stream && c.Name == name {
+			return c.Resettable
+		}
+	}
+	return ""
+}
+
+// consumerOf is the stream and consumer a bus condition names: `<stream>.<consumer>`.
+func consumerOf(c conditions.Condition) (string, string, bool) {
+	stream, name, found := strings.Cut(c.Subject.ID, ".")
+	return stream, name, found && stream != "" && name != ""
+}
+
+// appliesToAResettableConsumer is H4's: only a consumer the stream table marks resettable.
+func appliesToAResettableConsumer(_ context.Context, _ *healing, c conditions.Condition) (string, bool, string, error) {
+	stream, name, ok := consumerOf(c)
+	if !ok {
+		return "", false, "it names no consumer", nil
+	}
+	if resettable(stream, name) == "" {
+		return "", false, fmt.Sprintf("%s on %s is not marked resettable in the stream table: what a reset drops, "+
+			"nothing would catch up", name, stream), nil
+	}
+	return c.Key, true, "", nil
+}
+
+// repairConsumer is H4: `broker consumer-reset`, made by the mesh.
+func repairConsumer(_ context.Context, h *healing, c conditions.Condition) (string, string, error) {
+	stream, name, _ := consumerOf(c)
+	said, err := h.resetConsumer(stream, name)
+	if err != nil {
+		return "", "", err
+	}
+	return fmt.Sprintf("re-made %s on %s to deliver from now", name, stream),
+		said + "; " + resettable(stream, name), nil
+}
+
+// --- the verb ----------------------------------------------------------------------------------------
+
+// healersCommand is `healers`: the registry, what the healers did lately, and the brake.
+func healersCommand(ctx context.Context, args []string) error {
+	set := flag.NewFlagSet("healers", flag.ContinueOnError)
+	daysFlag := set.Int("days", 7, "how many days of acts back")
+	jsonFlag := set.Bool("json", false, "as data")
+	if rest, err := parseAround(set, args); err != nil {
+		return err
+	} else if len(rest) > 0 {
+		return errors.New("healers [--days N] [--json]")
+	}
+	days, asJSON := *daysFlag, *jsonFlag
+	if days <= 0 {
+		return fmt.Errorf("healers --days takes a number of days, not %d", days)
+	}
+	open, err := openStores(ctx)
+	if err != nil {
+		return err
+	}
+	defer open.Close()
+	now := time.Now()
+	heals, err := open.inventory.HealsSince(ctx, now.Add(-time.Duration(days)*24*time.Hour))
+	if err != nil {
+		return fmt.Errorf("what the healers did cannot be read: %w", err)
+	}
+	conds, condErr := openConditions(ctx)
+	braked, said := brakeHolds(actsWithin(heals, now.Add(-healBrakeWindow)), conds, now)
+	brake := map[string]any{"holds": braked, "said": said, "limit": healBrakeLimit, "window": healBrakeWindow.String()}
+	if condErr != nil {
+		brake["conditions"] = "the open conditions could not be read, so whether the brake was said is not known: " +
+			condErr.Error()
+	}
+	var rows []map[string]any
+	for _, r := range healerRegistry {
+		rows = append(rows, map[string]any{"id": r.ID, "kinds": r.Kinds, "condition": r.Condition, "repair": r.Repair,
+			"budget": fmt.Sprintf("%d act(s) within %s, %s apart at least", r.Budget, r.Window, r.Settle),
+			"then":   r.Then, "acts-in": r.ActsIn, "event": r.Event, "from": r.From})
+	}
+	if heals == nil {
+		heals = []inventory.Heal{}
+	}
+	if asJSON {
+		return printJSON(map[string]any{"healers": rows, "heals": heals, "brake": brake, "days": days,
+			"note": "a heal is never a hand act; whether it repaired anything is the condition's clearing to say"})
+	}
+	for _, r := range healerRegistry {
+		fmt.Printf("%s  %s\n    → %s\n    budget %d within %s; then %s (in %s)\n", r.ID, r.Condition, r.Repair, r.Budget,
+			r.Window, r.Then, r.ActsIn)
+	}
+	fmt.Printf("\nthe brake: %s — %s\n\n", map[bool]string{true: "HOLDS, every healer has stopped", false: "off"}[braked], said)
+	if len(heals) == 0 {
+		fmt.Printf("no healer acted in the last %d day(s)\n", days)
+		return nil
+	}
+	for i := len(heals) - 1; i >= 0; i-- {
+		x := heals[i]
+		fmt.Printf("%s  %s %-9s %s\n    %s\n", x.At.Local().Format("2006-01-02 15:04"), x.Healer, x.Outcome, x.ConditionKey,
+			firstLine(x.Said))
+	}
+	return nil
+}
+
+// forgettingOldHeals removes heals past their keeping once a day, by the controller acting only.
+func forgettingOldHeals(ctx context.Context, inv *inventory.Inventory) {
+	for {
+		if link.Holding() {
+			if n, err := inv.ForgetOldHeals(ctx); err != nil {
+				fmt.Printf("heals older than %s could not be removed: %v\n", inventory.HealsKeptFor, err)
+			} else if n > 0 {
+				fmt.Printf("removed %d heal(s) older than %s\n", n, inventory.HealsKeptFor)
+			}
+		}
+		select {
+		case <-ctx.Done():
+			return
+		case <-time.After(24 * time.Hour):
+		}
+	}
+}
+
+// healsCount is what the healers did, counted for `status`.
+type healsCount struct {
+	Acts      int `json:"acts"`
+	Escalated int `json:"escalated"`
+}
+
+// countHeals counts acts and escalations.
+func countHeals(heals []inventory.Heal) *healsCount {
+	out := &healsCount{}
+	for _, h := range heals {
+		if h.Outcome == inventory.HealEscalated {
+			out.Escalated++
+		} else {
+			out.Acts++
+		}
+	}
+	return out
+}

cmd/mesh-controller/healers_test.go

@@ -0,0 +1,640 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"os"
+	"slices"
+	"strconv"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/nats-io/nats.go"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+
+	"github.com/novox/mesh-controller/internal/testbus"
+)
+
+// The test generated from the healer registry (novox/hq to-be 45 §7, ADR 0227 rule 7 "how it is
+// checked"): **every row is walked.** Its kinds are ones the mesh raises — a row of the signals table, a
+// probe of the self-check, or a provider's event — it has a budget, a window and a settle inside it,
+// what happens when the budget is spent, and the event each act is said as; a healer the controller runs
+// has its applies and its repair, and an induced failure below that sees it act, say so and brake. A
+// row added without one fails, so the registry cannot grow a healer nobody has seen act.
+
+// raisedKinds is every condition kind the mesh raises, and what raises it.
+func raisedKinds() map[string]string {
+	out := map[string]string{kindProviderFailing: "the provisioner.failing event (ADR 0224)"}
+	for _, r := range signalsTable {
+		for _, k := range kindsOf(r) {
+			out[k] = r.Row
+		}
+	}
+	for _, p := range probeRegistry {
+		out[p.Kind] = p.ID
+		for _, k := range p.Raises {
+			out[k] = p.ID
+		}
+	}
+	return out
+}
+
+// inducedFailures are the healers seen acting in this file, by id: a row without one fails.
+var inducedFailures = map[string]string{
+	"H1": "TestH1AsksAMachineToReportAndSendsItAgain",
+	"H2": "TestH2ClosesAPlanAnotherHasTakenOver",
+	"H3": "TestNatsH3AssertsAMissingConsumerAgainAndBrakesAfterItsBudget",
+	"H4": "TestNatsH4ResetsTheControllersEventsConsumerAndItStillDelivers",
+}
+
+func TestEveryHealerAnswersAKindTheMeshRaisesWithABudgetABrakeAndItsEvent(t *testing.T) {
+	kinds := raisedKinds()
+	source, err := os.ReadFile("healers_test.go")
+	if err != nil {
+		t.Fatal(err)
+	}
+	seen := map[string]bool{}
+	answered := map[string]string{}
+	for _, r := range healerRegistry {
+		t.Run(r.ID, func(t *testing.T) {
+			if seen[r.ID] {
+				t.Fatalf("%s is in the registry twice", r.ID)
+			}
+			seen[r.ID] = true
+			if len(r.Kinds) == 0 || r.Condition == "" || r.Repair == "" || r.Then == "" || r.From == "" || r.ActsIn == "" {
+				t.Fatalf("%s does not say what it answers, what it does, what then, and which hand act it replaces: %+v", r.ID, r)
+			}
+			for _, k := range r.Kinds {
+				if _, ok := kinds[k]; !ok {
+					t.Errorf("%s answers %q, which nothing in the mesh raises", r.ID, k)
+				}
+				if other, twice := answered[k]; twice {
+					t.Errorf("%q is answered by %s and %s: one healer per kind", k, other, r.ID)
+				}
+				answered[k] = r.ID
+			}
+			if r.Budget <= 0 || r.Window <= 0 || r.Settle <= 0 || r.Settle > r.Window {
+				t.Errorf("%s has no budget it can spend: %d within %s, settled after %s", r.ID, r.Budget, r.Window, r.Settle)
+			}
+			if r.Event == "" {
+				t.Errorf("%s says nothing when it acts", r.ID)
+			}
+			if r.ActsIn != actsInController {
+				if r.repair != nil || r.applies != nil {
+					t.Errorf("%s acts in %s and the controller would act for it too", r.ID, r.ActsIn)
+				}
+				return
+			}
+			if r.repair == nil || r.applies == nil {
+				t.Fatalf("%s acts in the controller and has no repair or no applies", r.ID)
+			}
+			if r.Event != link.KeyHealerActed || !slices.Contains(broker.ControllerStates, r.Event) {
+				t.Errorf("%s is said as %q, which the controller's grant does not permit", r.ID, r.Event)
+			}
+			if inducedFailures[r.ID] == "" {
+				t.Errorf("%s has no induced failure: a healer nobody has seen act", r.ID)
+			} else if !strings.Contains(string(source), "func "+inducedFailures[r.ID]+"(t *testing.T)") {
+				t.Errorf("%s's induced failure %s is not a test in this file", r.ID, inducedFailures[r.ID])
+			}
+		})
+	}
+	for id := range inducedFailures {
+		if !seen[id] {
+			t.Errorf("an induced failure for %s, which the registry does not have", id)
+		}
+	}
+	if healBrakeLimit <= 0 || healBrakeWindow <= 0 {
+		t.Error("the mesh-wide brake holds nothing")
+	}
+}
+
+// heard keeps the healer-acted events said.
+type heard struct {
+	mu   sync.Mutex
+	acts []healerActed
+}
+
+func (h *heard) PublishSeatEvent(_ context.Context, seat, event string, body []byte) error {
+	if seat != conditions.Seat || event != link.KeyHealerActed {
+		return errors.New("said under the wrong seat or name: " + seat + " " + event)
+	}
+	var e healerActed
+	if err := json.Unmarshal(body, &e); err != nil {
+		return err
+	}
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	h.acts = append(h.acts, e)
+	return nil
+}
+
+func (h *heard) said() []healerActed {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	return append([]healerActed(nil), h.acts...)
+}
+
+// testClock is a moment a test moves by hand.
+type testClock struct {
+	mu sync.Mutex
+	at time.Time
+}
+
+func (c *testClock) now() time.Time {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return c.at
+}
+
+func (c *testClock) pass(d time.Duration) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.at = c.at.Add(d)
+}
+
+// healingOn is a runner over a mesh's stores and its condition store, under epoch 57, every act a
+// fake that fails the test unless the test gives it.
+func healingOn(t *testing.T, open *stores) (*healing, *heard, *testClock) {
+	t.Helper()
+	if conditionsFrom == nil {
+		t.Fatal("the mesh has no condition store")
+	}
+	told, clock := &heard{}, &testClock{at: time.Now()}
+	// The store's gate, as the serving controller's is the lease's (stores.go).
+	open.inventory.ActsUnder(func(context.Context) (uint64, error) { return 57, nil })
+	h := &healing{open: open, keeper: conditionsFrom, teller: told,
+		epoch: func(context.Context) (uint64, error) { return 57, nil }, now: clock.now,
+		say: func(f string, a ...any) { t.Logf(f, a...) }, reportWait: 300 * time.Millisecond,
+		declined: map[string]string{}}
+	h.askReport = func(context.Context, string) error { t.Error("asked a machine to report"); return nil }
+	h.sendAgain = func(context.Context, string) error { t.Error("sent a machine again"); return nil }
+	h.assertObjects = func(context.Context) error { t.Error("asserted the bus's objects"); return nil }
+	h.resetConsumer = func(string, string) (string, error) { t.Error("reset a consumer"); return "", nil }
+	return h, told, clock
+}
+
+// sentNotReported raises S2 for a machine, as the watchdog does.
+func sentNotReported(t *testing.T, node string) string {
+	t.Helper()
+	o := conditions.Observation{Scope: conditions.ScopeMachine, ID: node, Kind: "sent-not-reported", Machine: node,
+		Severity: conditions.Warning, Summary: node + " was sent a declaration and has not reported it", Source: "S2"}
+	if _, err := conditionsFrom.Observe(t.Context(), o); err != nil {
+		t.Fatal(err)
+	}
+	return o.Key()
+}
+
+// **H1, the commonest hand act** (031/01 §f: a push by hand to unstick a plan waiting on a report, four
+// times): the machine is asked to report; a report that names what it was sent is all it takes, and one
+// that does not — or none — is a send of its current declaration again. Each act kept in `tried` as
+// `healer H1`, said as healer-acted, counted; twice, then the operator's, urgent; then nothing more.
+func TestH1AsksAMachineToReportAndSendsItAgain(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	h, told, clock := healingOn(t, open)
+	record, err := open.inventory.NodeByName(ctx, "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := open.inventory.RecordSent(ctx, record.ID, "d2", nil); err != nil {
+		t.Fatal(err)
+	}
+	key := sentNotReported(t, "laptop")
+
+	// First: the report had not reached the mesh, and asking for it brings it.
+	asked := 0
+	h.askReport = func(ctx context.Context, node string) error {
+		asked++
+		if node != "laptop" {
+			t.Errorf("asked %s", node)
+		}
+		_, err := open.inventory.RecordDoing(ctx, record.ID, inventory.Doing{Outcome: inventory.OutcomeApplied,
+			At: time.Now().Add(time.Second), Declared: "d2"})
+		return err
+	}
+	h.tick(ctx)
+	c, found, err := conditionsFrom.Get(ctx, key)
+	if err != nil || !found {
+		t.Fatalf("the condition is gone after the act — a healer cleared it, not an observation: %v", err)
+	}
+	if asked != 1 || len(c.Tried) != 1 || c.Tried[0].By != "healer H1" || !strings.Contains(c.Tried[0].Outcome, "acted") ||
+		c.Resolver != "healer:H1" {
+		t.Fatalf("after the first act: asked %d, %+v", asked, c)
+	}
+	if acts := told.said(); len(acts) != 1 || acts[0].Healer != "H1" || acts[0].Outcome != inventory.HealActed ||
+		acts[0].Condition != key || acts[0].By != "healer H1" || acts[0].Epoch != 57 {
+		t.Fatalf("the act was not said as healer-acted: %+v", acts)
+	}
+
+	// Within its settle, nothing more: the observation has its turn.
+	clock.pass(time.Minute)
+	h.tick(ctx)
+	if asked != 1 {
+		t.Fatalf("acted again inside the settle: asked %d", asked)
+	}
+
+	// Second: the machine says nothing, so it is sent again.
+	clock.pass(3 * time.Minute)
+	sent := 0
+	h.askReport = func(context.Context, string) error { asked++; return nil }
+	h.sendAgain = func(_ context.Context, node string) error { sent++; return nil }
+	h.tick(ctx)
+	if asked != 2 || sent != 1 {
+		t.Fatalf("the second act: asked %d, sent %d", asked, sent)
+	}
+	c, _, _ = conditionsFrom.Get(ctx, key)
+	if len(c.Tried) != 2 || !strings.Contains(c.Tried[1].Outcome, "sent again") || !strings.Contains(c.Tried[1].Outcome, "act 2 of 2") {
+		t.Fatalf("tried %+v", c.Tried)
+	}
+
+	// The budget is spent: the operator's, urgent, said; and no healer touches it again.
+	clock.pass(4 * time.Minute)
+	h.tick(ctx)
+	c, _, _ = conditionsFrom.Get(ctx, key)
+	if !c.Escalated() || c.Severity != conditions.Urgent || len(c.Tried) != 3 ||
+		!strings.Contains(c.Tried[2].Outcome, "budget of 2") {
+		t.Fatalf("not handed to the operator: %+v", c)
+	}
+	if acts := told.said(); len(acts) != 3 || acts[2].Outcome != inventory.HealEscalated {
+		t.Fatalf("the escalation was not said: %+v", acts)
+	}
+	clock.pass(time.Hour)
+	h.tick(ctx)
+	if asked != 2 || sent != 1 || len(told.said()) != 3 {
+		t.Fatalf("a healer acted on a condition the operator holds: asked %d sent %d said %d", asked, sent, len(told.said()))
+	}
+	heals, err := open.inventory.HealsSince(ctx, time.Now().Add(-time.Hour))
+	if err != nil || len(heals) != 3 || heals[0].Outcome != inventory.HealActed || heals[1].Outcome != inventory.HealActed ||
+		heals[2].Outcome != inventory.HealEscalated || heals[0].Epoch != 57 {
+		t.Fatalf("the heals kept: %+v %v", heals, err)
+	}
+	// And a heal is not a hand act: what S15 counts never sees it.
+	for _, x := range heals {
+		if x.Healer == "" || strings.HasPrefix(x.Act, "hand-act") {
+			t.Errorf("a heal reads as a hand act: %+v", x)
+		}
+	}
+}
+
+// **Only the controller holding the lease heals** (to-be 45 §6): unleased, or standing by, nothing.
+func TestNoHealerActsWithoutTheLease(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	h, told, _ := healingOn(t, open)
+	sentNotReported(t, "laptop")
+	h.epoch = func(context.Context) (uint64, error) { return 0, nil }
+	h.tick(ctx)
+	h.epoch = func(context.Context) (uint64, error) { return 0, errors.New("the lease is not held") }
+	h.tick(ctx)
+	h.epoch = func(context.Context) (uint64, error) { return 57, nil }
+	h.acting = func() bool { return false }
+	h.tick(ctx)
+	if len(told.said()) != 0 {
+		t.Fatalf("a healer acted without the lease: %+v", told.said())
+	}
+}
+
+// **The mesh-wide brake**: a dozen acts in an hour and every healer stops, said urgently, until an hour
+// after the last.
+func TestTheBrakeStopsEveryHealerAndSaysSo(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	h, told, clock := healingOn(t, open)
+	for i := 0; i < healBrakeLimit; i++ {
+		if _, err := open.inventory.BeginHeal(ctx, inventory.Heal{Healer: "H3", ConditionKey: "seat.x.anchor.silent",
+			Kind: "holder-silent", Act: "asserted", Outcome: inventory.HealActed,
+			At: clock.now().Add(-time.Duration(healBrakeLimit-i) * time.Minute)}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	sentNotReported(t, "laptop")
+	h.tick(ctx) // the fakes fail the test if anything acts
+	braked, found, err := conditionsFrom.Get(ctx, "mesh.healers.braked")
+	if err != nil || !found || braked.Severity != conditions.Urgent || !strings.Contains(braked.Evidence[0].Said, "H3 on seat.x.anchor.silent ×12") {
+		t.Fatalf("the brake was not said: %+v %v", braked, err)
+	}
+	if len(told.said()) != 0 {
+		t.Fatalf("a healer acted under the brake: %+v", told.said())
+	}
+	// Past the hour of the first act, still held: it lets go an hour after the last.
+	clock.pass(30 * time.Minute)
+	h.tick(ctx)
+	if _, held, _ := conditionsFrom.Get(ctx, "mesh.healers.braked"); !held {
+		t.Fatal("the brake let go before an hour had passed since the last act")
+	}
+	clock.pass(31 * time.Minute)
+	asked := 0
+	h.askReport = func(context.Context, string) error { asked++; return nil }
+	h.sendAgain = func(context.Context, string) error { return nil }
+	h.tick(ctx)
+	if _, held, _ := conditionsFrom.Get(ctx, "mesh.healers.braked"); held {
+		t.Fatal("the brake held an hour after the last act")
+	}
+	if asked != 1 {
+		t.Fatalf("the healers did not act again after the brake let go: asked %d", asked)
+	}
+}
+
+// **H2 closes a plan another has taken over**, with its note — and leaves a plan alone whose wait is
+// still to come: that one is its own signal's, not a healer's.
+func TestH2ClosesAPlanAnotherHasTakenOver(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	h, told, _ := healingOn(t, open)
+	created := time.Now().UTC().Add(-time.Hour)
+	older := inventory.Plan{ID: "plan-old", Repository: "novox/app", Branch: "main", Commit: "0ld0ld0", Created: created,
+		State: inventory.PlanBuilding, Tiers: [][]string{{"a"}}, Modules: map[string]*inventory.PlanModule{"a": {State: "asked"}}}
+	waiting := inventory.Plan{ID: "plan-other", Repository: "novox/other", Branch: "main", Commit: "07he707", Created: created,
+		State: inventory.PlanBuilding, Tiers: [][]string{{"b"}}, Modules: map[string]*inventory.PlanModule{"b": {State: "asked"}}}
+	newer := inventory.Plan{ID: "plan-new", Repository: "novox/app", Branch: "main", Commit: "new0new", Created: created.Add(time.Minute),
+		State: inventory.PlanDone, Tiers: [][]string{{"a"}}, Modules: map[string]*inventory.PlanModule{"a": {State: "built"}}}
+	for _, p := range []*inventory.Plan{&older, &waiting, &newer} {
+		if err := open.inventory.SavePlan(ctx, p); err != nil {
+			t.Fatal(err)
+		}
+	}
+	for _, id := range []string{"plan-old", "plan-other"} {
+		if _, err := conditionsFrom.Observe(ctx, conditions.Observation{Scope: conditions.ScopePlan, ID: id, Kind: "stalled",
+			Severity: conditions.Warning, Summary: id + " is stalled", Source: "S3"}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	h.tick(ctx)
+	closed, err := open.inventory.PlanByID(ctx, "plan-old")
+	if err != nil || closed.State != inventory.PlanSuperseded || !strings.Contains(closed.Note, "closed by healer H2") ||
+		!strings.Contains(closed.Note, "plan-new") {
+		t.Fatalf("the superseded plan: %+v %v", closed, err)
+	}
+	if other, _ := open.inventory.PlanByID(ctx, "plan-other"); other.State != inventory.PlanBuilding {
+		t.Fatalf("a plan still waiting was closed: %+v", other)
+	}
+	if c, _, _ := conditionsFrom.Get(ctx, "plan.plan-other.stalled"); len(c.Tried) != 0 || c.Resolver != conditions.ResolverSelf {
+		t.Fatalf("a plan H2 does not repair was touched: %+v", c)
+	}
+	if acts := told.said(); len(acts) != 1 || acts[0].Healer != "H2" || acts[0].Condition != "plan.plan-old.stalled" {
+		t.Fatalf("said %+v", acts)
+	}
+	// Finished: every module built, none rolled out unsent — closed as done.
+	done := inventory.Plan{ID: "plan-done", Repository: "novox/third", Branch: "main", Commit: "d0ned0n", Created: created,
+		State: inventory.PlanRolling, Tier: 0, Tiers: [][]string{{"c"}}, Modules: map[string]*inventory.PlanModule{"c": {State: "built"}}}
+	if err := open.inventory.SavePlan(ctx, &done); err != nil {
+		t.Fatal(err)
+	}
+	if state, why, err := planStale(ctx, open.inventory, done); err != nil || state != inventory.PlanDone || !strings.Contains(why, "finished") {
+		t.Fatalf("a finished plan reads %q %q %v", state, why, err)
+	}
+}
+
+// **H4 only for a consumer the stream table marks resettable**: a module's consumer far behind is said
+// and left — what a reset drops, nothing would catch up for it.
+func TestH4ResetsOnlyWhatTheTableMarksResettable(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	h, _, _ := healingOn(t, open)
+	marked := 0
+	for _, c := range broker.MeshConsumers() {
+		if c.Resettable != "" {
+			marked++
+			if c.Stream != broker.EventsStream || c.Name != broker.ControllerName {
+				t.Errorf("%s on %s is marked resettable: only the controller's own events consumer is", c.Name, c.Stream)
+			}
+		}
+	}
+	if marked != 1 {
+		t.Fatalf("%d consumers are marked resettable, want the controller's events consumer alone", marked)
+	}
+	for _, who := range []string{"EVENTS.anchor_shop", "CONTROL.controller"} {
+		if _, err := conditionsFrom.Observe(ctx, conditions.Observation{Scope: conditions.ScopeBus, ID: who, Token: "behind",
+			Kind: kindConsumerBehind, Severity: conditions.Warning, Summary: who + " is far behind", Source: "D6"}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	h.tick(ctx) // the fake reset fails the test if it is called
+	reset := ""
+	h.resetConsumer = func(stream, name string) (string, error) {
+		reset = stream + "." + name
+		return "it was 1500 behind", nil
+	}
+	if _, err := conditionsFrom.Observe(ctx, conditions.Observation{Scope: conditions.ScopeBus, ID: "EVENTS.controller",
+		Token: "behind", Kind: kindConsumerBehind, Severity: conditions.Warning, Summary: "far behind", Source: "D6"}); err != nil {
+		t.Fatal(err)
+	}
+	h.tick(ctx)
+	if reset != "EVENTS.controller" {
+		t.Fatalf("reset %q", reset)
+	}
+}
+
+// **H3 against a real bus** (issue 208's note): a consumer the mesh expects, deleted; D6 says so; H3
+// asserts the bus's objects the way a send does, and D6's next run clears it — the healer never does.
+// Deleted again within the hour, the budget is spent: the operator's, urgent, and H3 stops.
+func TestNatsH3AssertsAMissingConsumerAgainAndBrakesAfterItsBudget(t *testing.T) {
+	url := testbus.URL(t)
+	open := aMesh(t)
+	ctx := t.Context()
+	js, err := broker.Dial(url)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(js.Close)
+	for _, s := range []string{"CONTROL", "NODES", "ASSIGNMENTS", "EVENTS"} {
+		_ = js.Context().DeleteStream(s)
+	}
+	if _, err := assertBusObjects(ctx, open.inventory, js); err != nil {
+		t.Fatal(err)
+	}
+	h, told, clock := healingOn(t, open)
+	h.js = js
+	h.assertObjects = func(ctx context.Context) error { return assertOnSend(ctx, open.inventory, js, "  ") }
+	d := &doctor{open: open, js: js}
+	probe := func() {
+		t.Helper()
+		found, err := probeConsumers(ctx, d)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if err := conditionsFrom.Reconcile(ctx, "D6", kindedAs(found, "consumer-wrong")); err != nil {
+			t.Fatal(err)
+		}
+	}
+	const key = "bus.NODES.laptop.missing"
+
+	if err := js.Context().DeleteConsumer("NODES", "laptop"); err != nil {
+		t.Fatal(err)
+	}
+	probe()
+	if c, raised, _ := conditionsFrom.Get(ctx, key); !raised || c.Kind != "consumer-lost" {
+		t.Fatalf("the deleted consumer was not raised: %+v", c)
+	}
+	h.tick(ctx)
+	if _, err := js.Context().ConsumerInfo("NODES", "laptop"); err != nil {
+		t.Fatalf("H3 did not make the consumer again: %v", err)
+	}
+	c, still, _ := conditionsFrom.Get(ctx, key)
+	if !still || len(c.Tried) != 1 || c.Tried[0].By != "healer H3" || c.Resolver != "healer:H3" {
+		t.Fatalf("the act is not in the condition, or the healer cleared it: %+v", c)
+	}
+	probe()
+	if _, still, _ := conditionsFrom.Get(ctx, key); still {
+		t.Fatal("the probe's next run did not clear what H3 repaired")
+	}
+	// Kept in the history as the keeper says it, a moment later.
+	var cleared *conditions.Event
+	for wait := time.Now().Add(5 * time.Second); cleared == nil && time.Now().Before(wait); time.Sleep(20 * time.Millisecond) {
+		history, err := conditionsFrom.HistorySince(ctx, time.Now().Add(-time.Minute))
+		if err != nil {
+			t.Fatal(err)
+		}
+		for i := range history {
+			if history[i].Key == key && history[i].Change == conditions.ChangeCleared {
+				cleared = &history[i]
+			}
+		}
+	}
+	if cleared == nil || !strings.Contains(cleared.Why, "D6 no longer observes it") || len(cleared.Tried) != 1 {
+		t.Fatalf("the clearing is not the probe's, or forgets what was tried: %+v", cleared)
+	}
+
+	// Again within the hour: the budget is one, so after its settle the operator is told, and H3 stops.
+	clock.pass(10 * time.Minute)
+	if err := js.Context().DeleteConsumer("NODES", "laptop"); err != nil {
+		t.Fatal(err)
+	}
+	probe()
+	h.assertObjects = func(context.Context) error { t.Error("H3 acted past its budget"); return nil }
+	h.tick(ctx)
+	c, _, _ = conditionsFrom.Get(ctx, key)
+	if !c.Escalated() || c.Severity != conditions.Urgent || c.Count != 2 {
+		t.Fatalf("the spent budget was not handed to the operator: %+v", c)
+	}
+	acts := told.said()
+	if len(acts) != 2 || acts[0].Outcome != inventory.HealActed || acts[1].Outcome != inventory.HealEscalated {
+		t.Fatalf("said %+v", acts)
+	}
+	clock.pass(2 * time.Hour)
+	h.tick(ctx)
+	if len(told.said()) != 2 {
+		t.Fatal("a healer acted on what the operator holds")
+	}
+}
+
+// **H4 against a real bus** (issue 248): the controller's events consumer a long way behind — the week it
+// once replayed — is re-made from now by the mesh itself, and the controller's bound subscription still
+// receives what comes next: a reset that left the controller deaf would be the incident.
+func TestNatsH4ResetsTheControllersEventsConsumerAndItStillDelivers(t *testing.T) {
+	url := testbus.URL(t)
+	open := aMesh(t)
+	ctx := t.Context()
+	js, err := broker.Dial(url)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(js.Close)
+	for _, s := range []string{"CONTROL", "NODES", "ASSIGNMENTS", "EVENTS"} {
+		_ = js.Context().DeleteStream(s)
+	}
+	if _, err := assertBusObjects(ctx, open.inventory, js); err != nil {
+		t.Fatal(err)
+	}
+	// Bound as the controller binds it (link/receive_nats.go), taking one and acknowledging none.
+	events := make(chan *nats.Msg, 64)
+	sub, err := js.Context().ChanSubscribe("", events, nats.Bind(broker.EventsStream, broker.ControllerName))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = sub.Unsubscribe() })
+	followed := broker.ControllerFollows[0]
+	for i := 0; i < consumerFarBehind+200; i++ {
+		if _, err := js.Context().Publish(followed, []byte(`{"n":`+strconv.Itoa(i)+`}`)); err != nil {
+			t.Fatal(err)
+		}
+	}
+	d := &doctor{open: open, js: js}
+	probe := func() []conditions.Observation {
+		t.Helper()
+		found, err := probeConsumers(ctx, d)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if err := conditionsFrom.Reconcile(ctx, "D6", kindedAs(found, "consumer-wrong")); err != nil {
+			t.Fatal(err)
+		}
+		return found
+	}
+	probe()
+	const key = "bus.EVENTS.controller.behind"
+	if c, raised, _ := conditionsFrom.Get(ctx, key); !raised || c.Kind != kindConsumerBehind {
+		t.Fatalf("a consumer %d behind was not raised: %+v", consumerFarBehind+200, c)
+	}
+	h, told, _ := healingOn(t, open)
+	h.resetConsumer = func(stream, name string) (string, error) {
+		before, after, err := js.ResetConsumer(stream, name)
+		if err != nil {
+			return "", err
+		}
+		return "it was " + strconv.FormatUint(before.Pending, 10) + " behind; " + strconv.FormatUint(after.Pending, 10) +
+			" pending now", nil
+	}
+	h.tick(ctx)
+	if acts := told.said(); len(acts) != 1 || acts[0].Healer != "H4" || acts[0].Outcome != inventory.HealActed {
+		t.Fatalf("said %+v", acts)
+	}
+	if found := probe(); len(found) != 0 {
+		t.Fatalf("after the reset the probe still finds %+v", found)
+	}
+	if _, still, _ := conditionsFrom.Get(ctx, key); still {
+		t.Fatal("the probe's next run did not clear what H4 repaired")
+	}
+	// What comes next still reaches the controller.
+	for len(events) > 0 {
+		<-events
+	}
+	if _, err := js.Context().Publish(followed, []byte(`{"after":"the reset"}`)); err != nil {
+		t.Fatal(err)
+	}
+	deadline := time.After(10 * time.Second)
+	for {
+		select {
+		case m := <-events:
+			if strings.Contains(string(m.Data), "after") {
+				return
+			}
+			_ = m.Ack()
+		case <-deadline:
+			t.Fatal("the controller's subscription heard nothing after its consumer was reset: it would be deaf")
+		}
+	}
+}
+
+// **H1's question reaches the machine**, on the subject its grant lets it hear and nothing else.
+func TestNatsAskToReportReachesTheMachine(t *testing.T) {
+	url := testbus.URL(t)
+	conn, err := nats.Connect(url)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(conn.Close)
+	asked, err := conn.SubscribeSync(broker.AskReportSubject("laptop"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := askToReport(t.Context(), conn, "laptop"); err != nil {
+		t.Fatal(err)
+	}
+	msg, err := asked.NextMsg(5 * time.Second)
+	if err != nil || !strings.Contains(string(msg.Data), "healer H1") {
+		t.Fatalf("the machine heard %v, %v", msg, err)
+	}
+	perms, err := broker.PermissionsFor(broker.Principal{Kind: broker.KindNode, Node: "laptop", PasswordHash: "x"})
+	if err != nil || !slices.Contains(perms.Subscribe, "mesh.node.laptop.ask.report") ||
+		slices.Contains(perms.Subscribe, "mesh.node.anchor.ask.report") {
+		t.Fatalf("a machine's grant for the question: %v %v", perms.Subscribe, err)
+	}
+}

cmd/mesh-controller/health_check_test.go

@@ -0,0 +1,72 @@
+package main
+
+import (
+	"bytes"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+)
+
+// Every catalogue module that runs something long-lived declares how it is ready (novox/hq ADR 0240 rule
+// 8): `module check` warns and counts the undeclared before the date, and refuses them from it.
+func TestModuleCheckCountsTheUndeclaredAndRefusesThemFromTheDate(t *testing.T) {
+	dir := t.TempDir()
+	digest := "@sha256:" + strings.Repeat("a", 64)
+	path := filepath.Join(dir, "module.json")
+	os.WriteFile(path, []byte(`{"module":"web","listens":[{"name":"web","port":80,"from":"mesh"}],"resources":[
+	  {"id":"server","type":"container","name":"web","image":"registry.example/web`+digest+`","ports":["80"],
+	   "health":{"kind":"http","endpoint":"web"}},
+	  {"id":"worker","type":"container","name":"web-worker","image":"registry.example/web`+digest+`"},
+	  {"id":"seed","type":"container","name":"web-seed","image":"registry.example/web`+digest+`","run-once":true}]}`), 0o600)
+	defer func() { checkNow = time.Now }()
+
+	checkNow = func() time.Time { return catalogue.HealthRequiredFrom.Add(-time.Hour) }
+	var out bytes.Buffer
+	if err := moduleCheck([]string{path}, &out); err != nil {
+		t.Fatalf("refused before the date: %v\n%s", err, out.String())
+	}
+	for _, want := range []string{"ready: server by http / on web every 30s", "WARNING: worker stay(s) up",
+		catalogue.HealthRequiredFrom.Format("2006-01-02"), UndeclaredHealthLine + " 1"} {
+		if !strings.Contains(out.String(), want) {
+			t.Errorf("the check does not say %q:\n%s", want, out.String())
+		}
+	}
+
+	checkNow = func() time.Time { return catalogue.HealthRequiredFrom }
+	out.Reset()
+	if err := moduleCheck([]string{path}, &out); err == nil {
+		t.Fatalf("a long-running resource without health passed after the date:\n%s", out.String())
+	}
+	if !strings.Contains(out.String(), "web: worker stays up and does not say how it is ready") {
+		t.Errorf("the refusal does not name the resource:\n%s", out.String())
+	}
+}
+
+// A file that asks for a setting without saying whether it is trusted counts as trusted (novox/hq issue 339):
+// `module check` lists and counts it, and never refuses it — there is nothing unsafe to refuse.
+func TestModuleCheckListsUnmarkedFilesAndNeverRefusesThem(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "module.json")
+	os.WriteFile(path, []byte(`{"module":"power","resources":[
+	  {"id":"logind","type":"file","path":"/etc/systemd/logind.conf.d/power.conf","mode":"0644","trusted":true,
+	   "content":"HandleLidSwitch=${setting:lid}\n"},
+	  {"id":"note","type":"file","path":"/var/lib/power/note","mode":"0644","content":"${setting:greeting}\n"}]}`), 0o600)
+	defer func() { checkNow = time.Now }()
+	for _, at := range []time.Time{time.Date(2026, 10, 1, 0, 0, 0, 0, time.UTC), time.Date(2036, 1, 1, 0, 0, 0, 0, time.UTC)} {
+		checkNow = func() time.Time { return at }
+		var out bytes.Buffer
+		if err := moduleCheck([]string{path}, &out); err != nil {
+			t.Fatalf("refused at %v: %v\n%s", at, err, out.String())
+		}
+		for _, want := range []string{"note ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted",
+			UnsaidTrustLine + " 1"} {
+			if !strings.Contains(out.String(), want) {
+				t.Errorf("the check does not say %q:\n%s", want, out.String())
+			}
+		}
+	}
+}

cmd/mesh-controller/health_probes.go

@@ -0,0 +1,226 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"slices"
+	"strings"
+	"time"
+
+	"github.com/nats-io/nats.go"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/lease"
+)
+
+// The core components' health definitions, as probes in the self-check's registry (novox/hq to-be 45
+// §8, §4 `H-*`). The same definitions judge a core component's new build on its first machine (the
+// gate, gate.go); here they are run against every machine on the self-check's schedule, so a core
+// component that stops being healthy between upgrades is said too.
+//
+//	controller   holds the lease, and says it is ready: its self-check ran, `status` answered in bound
+//	node-engine  has reported its current declaration, under a build the mesh delivered
+//	node tools   announced, and answer the bus's discovery
+//	bus          every stream and durable consumer the mesh defines is there, and a request crosses the
+//	             bus to every machine's node tools and back
+const kindCoreUnhealthy = "core-unhealthy"
+
+// probeControllerHealth is H-controller: the lease is held, fresh, by a controller that says it is
+// ready — or one that started less than the witness's bound ago.
+func probeControllerHealth(ctx context.Context, d *doctor) ([]conditions.Observation, error) {
+	h, found, err := theLease.holder(ctx)
+	if err != nil {
+		return nil, err
+	}
+	unhealthy := func(why string) []conditions.Observation {
+		node := d.host
+		if found && h.Host != "" {
+			node = h.Host
+		}
+		return []conditions.Observation{{Scope: conditions.ScopeCore, ID: lease.ComponentController + "." + node,
+			Token: "unhealthy", Kind: kindCoreUnhealthy, Machine: node, Severity: conditions.Urgent,
+			Summary: "the controller is not healthy: " + why}}
+	}
+	switch {
+	case !found:
+		return unhealthy("nobody holds the controller lease"), nil
+	case time.Since(h.Renewed) > lease.FreshWithin:
+		return unhealthy(fmt.Sprintf("the lease was last renewed %s ago", time.Since(h.Renewed).Round(time.Second))), nil
+	case (h.Health == nil || !h.Health.Ready) && time.Since(h.Taken) > lease.ReadyWithin:
+		why := "the controller holding the lease does not say it is ready"
+		if h.Health != nil && h.Health.Why != "" {
+			why += ": " + h.Health.Why
+		}
+		return unhealthy(why), nil
+	}
+	return nil, nil
+}
+
+// probeEngineHealth is H-engine: every machine heard from has reported its current declaration — the
+// last one it was sent — under a node-engine build the mesh delivered, or is inside the bound of a send.
+func probeEngineHealth(ctx context.Context, d *doctor) ([]conditions.Observation, error) {
+	return machinesHealth(ctx, d, hostModule)
+}
+
+// probeToolsHealth is H-tools: every machine heard from that is assigned the node tools has them
+// announced, answering the bus's discovery.
+func probeToolsHealth(ctx context.Context, d *doctor) ([]conditions.Observation, error) {
+	return machinesHealth(ctx, d, broker.RuntimeModule)
+}
+
+// machinesHealth judges a component on every machine running it and heard from, by its health
+// definition, as the gate does — with no condition taken as the build's doing.
+func machinesHealth(ctx context.Context, d *doctor, component string) ([]conditions.Observation, error) {
+	inv := d.open.inventory
+	running, err := inv.Running(ctx, component)
+	if err != nil {
+		return nil, err
+	}
+	shelf, err := inv.Catalogue(ctx)
+	if err != nil {
+		return nil, err
+	}
+	f, err := gatherGateFacts(ctx, d.open, coreComponent(component))
+	if err != nil {
+		return nil, err
+	}
+	f.judged = false
+	heard := heardMachines(d)
+	var out []conditions.Observation
+	for _, node := range running {
+		if !heard[node] {
+			continue // a machine not heard from is S1's
+		}
+		if r, said := f.reports[node]; said && !r.Current && r.Sent != nil && time.Since(*r.Sent) < gateBound {
+			continue // inside the bound of a send: S2's, and the gate's
+		}
+		// What the machine did with what it was sent is not the component's health: the node-engine's is
+		// that it reported its current declaration at all, the node tools' that they answer.
+		if r := f.reports[node]; r.Current || component == broker.RuntimeModule {
+			now := time.Now()
+			r.Current, r.Outcome = true, inventory.OutcomeApplied
+			if r.At == nil {
+				r.At = &now
+			}
+			f.reports[node] = r
+		}
+		if component == hostModule {
+			// A node-engine reporting a build the mesh delivered, current or previous, is the version
+			// split's (D10), not ill health; a build the mesh did not deliver is.
+			f.engines[node] = deliveredOr(shelf[component], f.engines[node])
+		}
+		h, why := judgeHealth(component, coreComponent(component), shelf[component], node, time.Time{}, f)
+		if h == healthGood {
+			continue
+		}
+		out = append(out, conditions.Observation{Scope: conditions.ScopeCore, ID: coreComponent(component) + "." + node,
+			Token: "unhealthy", Kind: kindCoreUnhealthy, Machine: node, Severity: conditions.Warning,
+			Summary: fmt.Sprintf("the %s on %s is not healthy: %s", componentWords(component), node, why)})
+	}
+	return sortedFound(out), nil
+}
+
+// deliveredOr is the reported engine build, or the current delivered one when the report names any
+// build at all: what H-engine judges is that it reports, not which.
+func deliveredOr(m catalogue.Manifest, reported string) string {
+	if reported == "" {
+		return reported
+	}
+	if v := deliveredVersions(m); len(v) > 0 {
+		return v[0]
+	}
+	return reported
+}
+
+// componentWords is a core component as a sentence names it.
+func componentWords(component string) string {
+	switch component {
+	case hostModule:
+		return "node-engine"
+	case broker.RuntimeModule:
+		return "node tools"
+	case catalogue.ControllerSeatName:
+		return "controller"
+	}
+	return component
+}
+
+// probeBusHealth is H-bus: every stream and durable consumer the mesh defines is on the bus, and a
+// request crosses it to every machine's node tools and back.
+func probeBusHealth(ctx context.Context, d *doctor) ([]conditions.Observation, error) {
+	problems, err := busHealth(ctx, d)
+	if err != nil {
+		return nil, err
+	}
+	if len(problems) == 0 {
+		return nil, nil
+	}
+	return []conditions.Observation{{Scope: conditions.ScopeBus, ID: "mesh", Token: "unhealthy",
+		Kind: kindCoreUnhealthy, Severity: conditions.Urgent,
+		Summary: fmt.Sprintf("the bus is not healthy: %s", strings.Join(problems, "; ")),
+		Said:    strings.Join(problems, "; ")}}, nil
+}
+
+// busHealth is the bus's health definition, as what is wanting: nothing when healthy. What the bus's
+// planned step checks after the bus is replaced, too.
+var busHealth = func(ctx context.Context, d *doctor) ([]string, error) {
+	if d.js == nil {
+		return nil, errors.New("this controller has no bus to ask")
+	}
+	streams, consumers, err := expectedBusObjects(ctx, d.open.inventory)
+	if err != nil {
+		return nil, err
+	}
+	js := d.js.Context()
+	var problems []string
+	for _, s := range streams {
+		if _, err := js.StreamInfo(s.Name, nats.Context(ctx)); errors.Is(err, nats.ErrStreamNotFound) {
+			problems = append(problems, "the stream "+s.Name+" is missing")
+		} else if err != nil {
+			return nil, fmt.Errorf("the stream %s cannot be read: %w", s.Name, err)
+		}
+	}
+	for _, c := range consumers {
+		_, err := js.ConsumerInfo(c.Stream, c.Name, nats.Context(ctx))
+		if errors.Is(err, nats.ErrConsumerNotFound) || errors.Is(err, nats.ErrStreamNotFound) {
+			problems = append(problems, consumerWords(c)+" is missing")
+		} else if err != nil {
+			return nil, fmt.Errorf("%s cannot be read: %w", consumerWords(c), err)
+		}
+	}
+	// The round trip: every machine heard from that runs the node tools answers across the bus.
+	running, err := d.open.inventory.Running(ctx, broker.RuntimeModule)
+	if err != nil {
+		return nil, err
+	}
+	heard := heardMachines(d)
+	var expected []string
+	for _, n := range running {
+		if heard[n] {
+			expected = append(expected, n)
+		}
+	}
+	if len(expected) > 0 {
+		answered, err := servedOnTheBus(ctx, d.js.Conn())
+		if err != nil {
+			return nil, err
+		}
+		var silent []string
+		for _, n := range expected {
+			if !answered[n].runtime {
+				silent = append(silent, n)
+			}
+		}
+		// One machine's tools silent is that machine's (H-tools); none answering is the bus.
+		if len(silent) == len(expected) {
+			slices.Sort(silent)
+			problems = append(problems, "no request crossed the bus and came back: no machine's node tools answered ("+
+				strings.Join(silent, ", ")+")")
+		}
+	}
+	return problems, nil
+}

cmd/mesh-controller/held_back.go

@@ -0,0 +1,264 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"sort"
+	"strings"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// A push sends no build a policy or a plan holds back, except to the machine it names (novox/hq
+// issue 259, ADR 0221).
+//
+// A named push ends by sending every other machine whose declaration differs from what it was last
+// sent (ADR 0083), so that a grant the push's work minted reaches the provider in the same act. A
+// digest cannot say why a machine differs. A module whose upgrade policy records rather than rolls
+// out makes every machine running it differ from the merge on, and so did a module whose plan was
+// still waiting on its first machine (ADR 0218): `push <anchor>` sent all four machines the build
+// that was meant to be walked through the mesh one machine at a time, and a fault in it was met
+// everywhere at once.
+//
+// What tells the two apart is which build of each module the machine was last sent, kept with every
+// send. A machine any of whose modules would move to a build its policy or an open plan holds back
+// is not sent by a push that did not name it; the push says which, and why, and how to send it.
+
+// heldBack is why a push that did not name a machine must not send it, empty when it may.
+//
+// `modules` is what the machine would be sent now; `sent` and `known` what it was last sent, as
+// Inventory.SentBuilds answers. A module moves when the build it would carry is not the one the
+// machine was last sent — including a module the machine was never sent at all. A move is held when
+// the module's policy records rather than rolls out, or when an open plan has not yet sent this
+// machine (planStillToSend). A machine whose last send was not recorded is held whole: what it carried
+// is not known, so a held upgrade cannot be told from anything else.
+func heldBack(node string, modules []string, sent map[string]string, known bool,
+	current map[string]inventory.CurrentBuild, plans []inventory.Plan) []string {
+	if !known {
+		return []string{"which builds it was last sent is not known — it was last sent before the " +
+			"mesh kept them, or sent a declaration by hand"}
+	}
+	var why []string
+	for _, m := range modules {
+		now := current[m]
+		was, carried := sent[m]
+		if carried && was == now.Commit {
+			continue
+		}
+		move := fmt.Sprintf("%s would move %sto %s", m, fromBuild(was, carried), buildName(now.Commit))
+		if !now.RollOut {
+			why = append(why, move+", which its upgrade policy records rather than rolls out")
+			continue
+		}
+		if id := planStillToSend(plans, m, node); id != "" {
+			why = append(why, move+", which "+id+" has not sent it yet (one machine first)")
+		}
+	}
+	sort.Strings(why)
+	return why
+}
+
+// planStillToSend is the open plan that has a module's new build still to send this machine, or empty:
+// one holding the module that has neither finished sending it nor sent it here first, and has not
+// failed it (novox/hq ADR 0218). The same reading rolledOutByAPlan makes for the whole module, made
+// per machine.
+func planStillToSend(plans []inventory.Plan, module, node string) string {
+	for _, p := range plans {
+		s, holds := p.Modules[module]
+		if !p.Open() || !holds {
+			continue
+		}
+		if s == nil {
+			return p.ID
+		}
+		if s.SentAt != nil || s.State == "failed" {
+			continue
+		}
+		first := false
+		for _, n := range s.First {
+			if n == node {
+				first = true
+			}
+		}
+		if !first {
+			return p.ID
+		}
+	}
+	return ""
+}
+
+func fromBuild(was string, carried bool) string {
+	if !carried {
+		return "(never sent it) "
+	}
+	return "from " + buildName(was) + " "
+}
+
+func buildName(commit string) string {
+	if commit == "" {
+		return "a build with no source"
+	}
+	return shortCommit(commit)
+}
+
+// heldMachines reads, for each machine named, why a push that did not name it must not send it
+// (heldBack), and answers only the machines held. A machine whose set cannot be worked out is left
+// to the send, which says why.
+func heldMachines(ctx context.Context, open *stores, names []string) (map[string][]string, error) {
+	out := map[string][]string{}
+	if len(names) == 0 {
+		return out, nil
+	}
+	inv := open.inventory
+	current, err := inv.CurrentBuilds(ctx)
+	if err != nil {
+		return nil, err
+	}
+	plans, err := inv.OpenPlans(ctx)
+	if err != nil {
+		return nil, err
+	}
+	f, err := readMoveFacts(ctx, inv)
+	if err != nil {
+		return nil, err
+	}
+	for _, node := range names {
+		plan, _, err := planFor(ctx, open, node)
+		if err != nil {
+			continue
+		}
+		modules := make([]string, 0, len(plan.Modules))
+		for _, m := range plan.Modules {
+			modules = append(modules, m.Module)
+		}
+		sent, known, err := inv.SentBuilds(ctx, node)
+		if err != nil {
+			return nil, err
+		}
+		// A rebuild that put the same thing on the machine is no move (ADR 0236): read as the build it
+		// runs.
+		same := map[string]string{}
+		for m, was := range sent {
+			same[m] = was
+			if f.identical(m, was, current[m].Commit) {
+				same[m] = current[m].Commit
+			}
+		}
+		why := heldBack(node, modules, same, known, current, plans)
+		// And a build no gate has seen is not carried by a send that does not judge it (ADR 0236).
+		for _, mv := range f.moves(node, modules, same, known, false) {
+			if planStillToSend(plans, mv.Module, node) == "" {
+				why = append(why, fmt.Sprintf("%s would move from %s to %s, which has passed no gate yet — a release "+
+					"plan sends it, one machine at a time, judged", mv.Module, buildName(mv.From), buildName(mv.To)))
+			}
+		}
+		if len(why) > 0 {
+			sort.Strings(why)
+			out[node] = why
+		}
+	}
+	return out, nil
+}
+
+// sayHeld is what a push says about a machine it left behind on purpose: that it is behind, why it
+// was not sent, that whatever else it is owed waits with it, and the command that sends it.
+func sayHeld(w io.Writer, node string, why []string) {
+	fmt.Fprintf(w, "\n%s is behind and was not sent: %s. A push sends no build a policy or a plan "+
+		"holds back to a machine it did not name (novox/hq ADR 0221), so anything else it is owed — a "+
+		"grant from this push among it — waits with it. `push %s` sends it\n",
+		node, strings.Join(why, "; "), node)
+}
+
+// flushBehind is the end of a named push: every other machine now behind is sent too, by name, over
+// as many rounds as the sends take to settle (novox/hq issue 057, ADR 0083) — except a machine whose
+// modules would move to a build a policy or a plan holds back, which is named and left (ADR 0221).
+//
+// `handled` is every machine already sent or already said; it is not considered again. Answers the
+// machines that could not be composed, as refusals.
+func flushBehind(ctx context.Context, open *stores, nodes []inventory.Node, handled map[string]bool,
+	compose func(held context.Context, node string) (sendable, error), d delivery, holder string,
+	keep keeping, w io.Writer) ([]string, error) {
+	inv := open.inventory
+	var refusals []string
+	// Bounded by the node count: a node is marked handled the round it is considered and is never
+	// considered twice, so the loop cannot run more than len(nodes) rounds. The bound is a guard
+	// against a logic error, not a real limit — if it were ever hit, that is a bug rather than a
+	// cascade legitimately still converging, so it is said rather than passed over in silence.
+	rounds := 0
+	for {
+		would, err := wouldSend(ctx, open, nodes)
+		if err != nil {
+			return refusals, err
+		}
+		behind, err := inv.Waiting(ctx, would)
+		if err != nil {
+			return refusals, err
+		}
+		var also []string
+		for _, m := range behind {
+			if !handled[m.Node] {
+				also = append(also, m.Node)
+			}
+		}
+		if len(also) == 0 {
+			return refusals, nil
+		}
+		if rounds++; rounds > len(nodes) {
+			fmt.Fprintf(w, "\nstopped cascading after %d rounds with %s still behind — this "+
+				"should not happen; run `push --behind` to finish\n",
+				rounds-1, strings.Join(also, ", "))
+			return refusals, nil
+		}
+		sort.Strings(also)
+		held, err := heldMachines(ctx, open, also)
+		if err != nil {
+			return refusals, err
+		}
+		var sending []string
+		for _, name := range also {
+			// Every candidate this round is marked handled — the sent ones so they are not
+			// re-listed, the held ones because they stay held, and the refused ones so a machine
+			// that cannot be composed does not make the loop spin on it for ever.
+			handled[name] = true
+			if why, isHeld := held[name]; isHeld {
+				sayHeld(w, name, why)
+				continue
+			}
+			sending = append(sending, name)
+		}
+		if len(sending) == 0 {
+			continue
+		}
+		fmt.Fprintf(w, "\nthis push left %s behind — a provision granted from there, or a "+
+			"declaration since changed; sending it too\n", strings.Join(sending, ", "))
+		// Tolerantly, exactly as the named send: a machine that cannot be composed is collected as
+		// a refusal and reported at the end, and the others are still sent (novox/hq ADR 0066).
+		// Held for this round only, and after the last round's were given back, so two pushes
+		// cascading into each other's machines never each wait on the other.
+		refused, err := sendRound(ctx, open, sending, compose, d, holder, keep)
+		refusals = append(refusals, refused...)
+		if err != nil {
+			return refusals, err
+		}
+	}
+}
+
+// composeForPush is how a push composes one machine: its set resolved, what it cannot host and what
+// is left out of it said, and its declaration allocated.
+func composeForPush(open *stores, gens map[string]catalogue.Generator) func(held context.Context, node string) (sendable, error) {
+	return func(held context.Context, node string) (sendable, error) {
+		plan, settings, err := planFor(held, open, node)
+		if err != nil {
+			return sendable{}, err
+		}
+		reportUnhostable(node, plan)
+		reportKept(held, plan)
+		declared, err := declarationWith(held, open, node, plan, settings, gens, Allocating)
+		if err == nil {
+			reportLeftOut(node, declared)
+		}
+		return declared, err
+	}
+}

cmd/mesh-controller/held_back_test.go

@@ -0,0 +1,353 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"reflect"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/overlay"
+)
+
+// novox/hq issue 259, ADR 0221: a push that did not name a machine does not send it a build its
+// upgrade policy records rather than rolls out, nor one an open plan has not sent it yet. Anything
+// else that moved is still a consequence the push sends (ADR 0083).
+func TestAHeldBuildHoldsAMachineANamedPushDidNotName(t *testing.T) {
+	current := map[string]inventory.CurrentBuild{
+		"resolver": {Commit: "c2c2c2c2c2"},
+		"agent":    {Commit: "a2", RollOut: true},
+		"network":  {},
+	}
+	modules := []string{"network", "resolver", "agent"}
+	sent := map[string]string{"network": "", "resolver": "c1c1c1c1c1", "agent": "a2"}
+
+	// A module whose policy records moved: held, naming it, both builds and why.
+	why := heldBack("laptop", modules, sent, true, current, nil)
+	if len(why) != 1 || !strings.Contains(why[0], "resolver would move from c1c1c1c1 to c2c2c2c2") ||
+		!strings.Contains(why[0], "upgrade policy records") {
+		t.Fatalf("a recorded upgrade did not hold the machine: %v", why)
+	}
+
+	// Nothing moved — what differs is a grant, a peer, a setting: not held (issue 057).
+	sent["resolver"] = "c2c2c2c2c2"
+	if why := heldBack("laptop", modules, sent, true, current, nil); len(why) != 0 {
+		t.Fatalf("a machine whose builds are all current was held: %v", why)
+	}
+
+	// A module whose policy rolls out moved, and no plan holds it: sent, as before.
+	sent["agent"] = "a1"
+	if why := heldBack("laptop", modules, sent, true, current, nil); len(why) != 0 {
+		t.Fatalf("a rolled-out upgrade no plan holds was held: %v", why)
+	}
+
+	// The last send's builds are not known: held whole.
+	if why := heldBack("laptop", modules, nil, false, current, nil); len(why) != 1 ||
+		!strings.Contains(why[0], "not known") {
+		t.Fatalf("a machine whose last send was not recorded was not held: %v", why)
+	}
+
+	// A module the machine was never sent, under a recording policy: held, and said so.
+	delete(sent, "resolver")
+	sent["agent"] = "a2"
+	if why := heldBack("laptop", modules, sent, true, current, nil); len(why) != 1 ||
+		!strings.Contains(why[0], "resolver would move (never sent it) to c2c2c2c2") {
+		t.Fatalf("a module never sent under a recording policy: %v", why)
+	}
+}
+
+// ADR 0218 meets ADR 0083: a plan waiting on its first machine has not sent the rest, and a push
+// naming some other machine must not send them for it.
+func TestAPlanWaitingOnItsFirstMachineHoldsTheRest(t *testing.T) {
+	at := time.Now()
+	current := map[string]inventory.CurrentBuild{"agent": {Commit: "a2", RollOut: true}}
+	sent := map[string]string{"agent": "a1"}
+	waiting := []inventory.Plan{{ID: "plan-7", State: inventory.PlanRolling, Modules: map[string]*inventory.PlanModule{
+		"agent": {State: "built", First: []string{"ace"}, FirstAt: &at}}}}
+
+	why := heldBack("g14", []string{"agent"}, sent, true, current, waiting)
+	if len(why) != 1 || !strings.Contains(why[0], "plan-7 has not sent it yet") {
+		t.Fatalf("a machine the plan has not reached was not held: %v", why)
+	}
+	// The first machine itself was sent by the plan: not held by it.
+	if why := heldBack("ace", []string{"agent"}, sent, true, current, waiting); len(why) != 0 {
+		t.Fatalf("the plan's first machine was held: %v", why)
+	}
+	// Built but not yet sent anywhere, or not yet built: the plan has it still to send.
+	for what, s := range map[string]*inventory.PlanModule{"built, unsent": {State: "built"}, "unasked": nil} {
+		plans := []inventory.Plan{{ID: "plan-8", State: inventory.PlanBuilding,
+			Modules: map[string]*inventory.PlanModule{"agent": s}}}
+		if why := heldBack("ace", []string{"agent"}, sent, true, current, plans); len(why) != 1 {
+			t.Errorf("%s: not held: %v", what, why)
+		}
+	}
+	// Sent everywhere, failed, or a plan no longer open: the plan holds nothing back.
+	for what, plans := range map[string][]inventory.Plan{
+		"sent everywhere": {{ID: "p", State: inventory.PlanRolling, Modules: map[string]*inventory.PlanModule{
+			"agent": {State: "built", First: []string{"ace"}, FirstAt: &at, SentAt: &at}}}},
+		"failed": {{ID: "p", State: inventory.PlanRolling, Modules: map[string]*inventory.PlanModule{
+			"agent": {State: "failed"}}}},
+		"closed": {{ID: "p", State: inventory.PlanDone, Modules: map[string]*inventory.PlanModule{
+			"agent": {State: "built"}}}},
+	} {
+		if why := heldBack("g14", []string{"agent"}, sent, true, current, plans); len(why) != 0 {
+			t.Errorf("%s: held: %v", what, why)
+		}
+	}
+}
+
+// A send records the build of each module it carried; a module left out of it keeps the build it
+// was last sent, since the machine keeps that one.
+func TestASendCarriesTheCurrentBuildsAndALeftOutModuleKeepsItsOwn(t *testing.T) {
+	current := map[string]inventory.CurrentBuild{"a": {Commit: "a2"}, "b": {Commit: "b2"}, "c": {}}
+	got := carriedBuilds([]string{"a", "b", "c"}, map[string]string{"b": "a setting does not compose"},
+		current, map[string]string{"a": "a1", "b": "b1"})
+	if want := map[string]string{"a": "a2", "b": "b1", "c": ""}; !reflect.DeepEqual(got, want) {
+		t.Fatalf("carried %v, wanted %v", got, want)
+	}
+	// Not known before: the left-out module is not recorded at all, so it reads as never sent.
+	got = carriedBuilds([]string{"a", "b"}, map[string]string{"b": "x"}, current, nil)
+	if want := map[string]string{"a": "a2"}; !reflect.DeepEqual(got, want) {
+		t.Fatalf("carried %v, wanted %v", got, want)
+	}
+}
+
+// recordedDelivery sends nothing and records each send as the mesh does, so the next comparison
+// reads the machine as current — and writes down which machines it declared.
+type recordedDelivery struct {
+	inv      *inventory.Inventory
+	declared []string
+}
+
+func (r *recordedDelivery) grant(context.Context, []readyNode) error { return nil }
+
+func (r *recordedDelivery) declare(ctx context.Context, s readyNode, body []byte) (string, error) {
+	r.declared = append(r.declared, s.node)
+	return recordSent(ctx, r.inv, s.node, body, s.declared.Builds, s.declared.Epoch)
+}
+
+// aResolver is a module built from a repository, at a commit, with something on the machine that
+// says which build it is.
+func aResolver(t *testing.T, open *stores, commit string, asked time.Time) {
+	t.Helper()
+	m := catalogue.Manifest{Module: "resolver", Version: "1", Resources: []map[string]any{
+		{"id": "zones", "type": "file", "path": "/etc/resolver/zones", "content": "built from " + commit},
+	}}
+	if err := open.inventory.RegisterModule(t.Context(), m, inventory.Source{
+		Repository: "novox/mesh-catalog", Path: "modules/resolver", BuiltFrom: commit, Asked: asked}); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// A third machine on the private network: once it is sent, every other machine's peers change with
+// it, which is a consequence a push must still send — no build moved.
+func aThirdMachine(t *testing.T, open *stores) {
+	t.Helper()
+	ctx := t.Context()
+	record, err := open.inventory.AddNode(ctx, "spare")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := open.inventory.SetPlace(ctx, "spare", "spare.example:51820", "here", false, "10.77.0.3"); err != nil {
+		t.Fatal(err)
+	}
+	reported, err := json.Marshal(map[string]any{"capabilities": []map[string]any{
+		{"name": "container-runtime", "present": true}, {"name": "wireguard", "present": true},
+		{"name": "systemd", "present": true}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var profile map[string]any
+	if err := json.Unmarshal(reported, &profile); err != nil {
+		t.Fatal(err)
+	}
+	if err := open.inventory.RecordProfile(ctx, record.ID, profile); err != nil {
+		t.Fatal(err)
+	}
+	if err := open.inventory.RecordSealingKey(ctx, record.ID, aPublicKey(t)); err != nil {
+		t.Fatal(err)
+	}
+	if err := open.inventory.RecordOverlayKey(ctx, record.ID, aPublicKey(t)); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := open.inventory.Assign(ctx, "spare", overlay.Name); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// The issue as it happened, against the real stores: a change merged with the policy `record`, a push
+// naming the anchor, and the laptop — running the same module — left with what it had, by name.
+func TestANamedPushLeavesAMachineAPolicyHoldsBack(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	asked := time.Now().Add(-time.Hour)
+	aResolver(t, open, "c1c1c1c1c1", asked)
+	for _, node := range []string{"anchor", "laptop"} {
+		if _, err := inv.Assign(ctx, node, "resolver"); err != nil {
+			t.Fatal(err)
+		}
+	}
+	// Recorded by a person's choice: the default rolls out since novox/hq ADR 0236.
+	if err := inv.SetUpgradeOf(ctx, "resolver", inventory.Upgrade{Why: "each machine checked by hand"}); err != nil {
+		t.Fatal(err)
+	}
+	gens, err := generators(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	compose := composeForPush(open, gens)
+	d := &recordedDelivery{inv: inv}
+	if _, err := sendRound(ctx, open, []string{"anchor", "laptop"}, compose, d, "", nil); err != nil {
+		t.Fatal(err)
+	}
+	if builds, known, err := inv.SentBuilds(ctx, "laptop"); err != nil || !known || builds["resolver"] != "c1c1c1c1c1" {
+		t.Fatalf("the send did not record the build it carried: %v %v %v", builds, known, err)
+	}
+	digestOfLaptop := func() string {
+		sent, err := inv.Outstanding(ctx, "laptop")
+		if err != nil {
+			t.Fatal(err)
+		}
+		return sent
+	}
+	before := digestOfLaptop()
+
+	// The change merges; the policy is record. `push anchor` sends the anchor...
+	aResolver(t, open, "c2c2c2c2c2", asked.Add(time.Minute))
+	d.declared = nil
+	if _, err := sendRound(ctx, open, []string{"anchor"}, compose, d, "", nil); err != nil {
+		t.Fatal(err)
+	}
+	// ...and its cascade leaves the laptop, saying so.
+	var said bytes.Buffer
+	d.declared = nil
+	refused, err := flushBehind(ctx, open, mustNodes(t, open), map[string]bool{"anchor": true}, compose, d, "", nil, &said)
+	if err != nil || len(refused) != 0 {
+		t.Fatalf("the cascade failed: %v %v", refused, err)
+	}
+	if len(d.declared) != 0 {
+		t.Fatalf("the cascade sent %v a build its policy records", d.declared)
+	}
+	if digestOfLaptop() != before {
+		t.Fatal("the laptop's last send moved: it was sent the held build")
+	}
+	for _, want := range []string{"laptop is behind and was not sent", "resolver would move from c1c1c1c1 to c2c2c2c2",
+		"upgrade policy records", "`push laptop` sends it"} {
+		if !strings.Contains(said.String(), want) {
+			t.Errorf("the push did not say %q:\n%s", want, said.String())
+		}
+	}
+
+	// Held and owed something else at once — a peer joined: still not sent, and both said: why it
+	// is held, and that what else it is owed waits with it.
+	aThirdMachine(t, open)
+	d.declared = nil
+	if _, err := sendRound(ctx, open, []string{"spare"}, compose, d, "", nil); err != nil {
+		t.Fatal(err)
+	}
+	d.declared = nil
+	said.Reset()
+	if _, err := flushBehind(ctx, open, mustNodes(t, open), map[string]bool{"anchor": true, "spare": true},
+		compose, d, "", nil, &said); err != nil {
+		t.Fatal(err)
+	}
+	if len(d.declared) != 0 || digestOfLaptop() != before {
+		t.Fatalf("a held machine owed a consequence was sent: %v", d.declared)
+	}
+	if !strings.Contains(said.String(), "resolver would move") || !strings.Contains(said.String(), "anything else it is owed") {
+		t.Fatalf("the push did not say both:\n%s", said.String())
+	}
+
+	// A policy that rolls out, and a build no gate has seen: still held — a cascade does not judge it
+	// (novox/hq ADR 0236).
+	if err := inv.SetUpgradeOf(ctx, "resolver", inventory.Upgrade{RollOut: true}); err != nil {
+		t.Fatal(err)
+	}
+	said.Reset()
+	if _, err := flushBehind(ctx, open, mustNodes(t, open), map[string]bool{"anchor": true, "spare": true},
+		compose, d, "", nil, &said); err != nil {
+		t.Fatal(err)
+	}
+	if len(d.declared) != 0 || !strings.Contains(said.String(), "has passed no gate yet") {
+		t.Fatalf("a cascade carried a build no gate has seen: %v\n%s", d.declared, said.String())
+	}
+	// Once it passed a gate on some machine, the laptop is a consequence like any other, and sent.
+	if err := inv.RecordGate(ctx, inventory.GateVerdict{Build: "build-c2", Module: "resolver", Commit: "c2c2c2c2c2",
+		Machines: []string{"anchor"}, Verdict: inventory.GatePassed}); err != nil {
+		t.Fatal(err)
+	}
+	said.Reset()
+	if _, err := flushBehind(ctx, open, mustNodes(t, open), map[string]bool{"anchor": true, "spare": true},
+		compose, d, "", nil, &said); err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(d.declared, []string{"laptop"}) || digestOfLaptop() == before {
+		t.Fatalf("a rolled-out upgrade's machine was not sent: %v\n%s", d.declared, said.String())
+	}
+	if builds, _, _ := inv.SentBuilds(ctx, "laptop"); builds["resolver"] != "c2c2c2c2c2" {
+		t.Fatalf("the new send did not record the new build: %v", builds)
+	}
+}
+
+// Issue 057's case is unchanged: a machine whose builds are all current and whose declaration moved
+// for another reason is sent by a push that names someone else.
+func TestANamedPushStillSendsAConsequenceNothingHolds(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	aResolver(t, open, "c1c1c1c1c1", time.Now().Add(-time.Hour))
+	if _, err := inv.Assign(ctx, "laptop", "resolver"); err != nil {
+		t.Fatal(err)
+	}
+	gens, err := generators(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	compose := composeForPush(open, gens)
+	d := &recordedDelivery{inv: inv}
+	if _, err := sendRound(ctx, open, []string{"anchor", "laptop"}, compose, d, "", nil); err != nil {
+		t.Fatal(err)
+	}
+
+	// `push spare`, the machine just placed: the others' peers change with it.
+	aThirdMachine(t, open)
+	if _, err := sendRound(ctx, open, []string{"spare"}, compose, d, "", nil); err != nil {
+		t.Fatal(err)
+	}
+	d.declared = nil
+	var said bytes.Buffer
+	if _, err := flushBehind(ctx, open, mustNodes(t, open), map[string]bool{"spare": true}, compose, d, "", nil, &said); err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(d.declared, []string{"anchor", "laptop"}) {
+		t.Fatalf("a consequence nothing holds was not sent: %v\n%s", d.declared, said.String())
+	}
+	if strings.Contains(said.String(), "was not sent") {
+		t.Fatalf("a machine nothing holds was said to be held:\n%s", said.String())
+	}
+
+	// A machine whose last send was not recorded — a declaration sent by hand — is held until named.
+	record, err := inv.NodeByName(ctx, "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.RecordSent(ctx, record.ID, "sent-by-hand", nil); err != nil {
+		t.Fatal(err)
+	}
+	d.declared = nil
+	said.Reset()
+	if _, err := flushBehind(ctx, open, mustNodes(t, open), map[string]bool{"spare": true}, compose, d, "", nil, &said); err != nil {
+		t.Fatal(err)
+	}
+	// The anchor, the hub, may still be settling from the machine placed above; the laptop is the
+	// question.
+	if slices.Contains(d.declared, "laptop") || !strings.Contains(said.String(), "laptop is behind and was not sent") {
+		t.Fatalf("a machine whose last send is not known was sent: %v\n%s", d.declared, said.String())
+	}
+}

cmd/mesh-controller/hold_test.go

@@ -18,16 +18,16 @@ func TestASendRoundGivesItsHoldBackOnEveryWayOut(t *testing.T) {
 	plain := func(context.Context, string) (sendable, error) {
 		return sendable{Resources: []map[string]any{{"id": "x"}}}, nil
 	}
-	failing := func(readyNode, []byte) error { return errors.New("the broker went away") }
-	fine := func(readyNode, []byte) error { return nil }
+	failing := &recordingDelivery{declareErr: errors.New("the broker went away")}
+	fine := &recordingDelivery{}
 
 	for name, round := range map[string]func() error{
 		"a body that cannot be marshalled": func() error {
-			_, err := sendRound(ctx, open, []string{"anchor"}, unmarshallable, fine)
+			_, err := sendRound(ctx, open, []string{"anchor"}, unmarshallable, fine, "", nil)
 			return err
 		},
 		"a send that fails": func() error {
-			_, err := sendRound(ctx, open, []string{"anchor"}, plain, failing)
+			_, err := sendRound(ctx, open, []string{"anchor"}, plain, failing, "", nil)
 			return err
 		},
 	} {

cmd/mesh-controller/holders_silent_test.go

@@ -0,0 +1,117 @@
+package main
+
+import (
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+)
+
+// The live case of 2026-10-07 (novox/hq issue 299), replayed: the node-uplink seat gained its first
+// verbs, `resolvers` and `links`, both optional while its holders catch up, and the holders serve
+// neither. The working set is read from the store, whose rows carry no optional mark, so the seat comes
+// back through UseSeats as it does live. Its holder on every machine answers nothing for it on the bus,
+// and must not be judged silent: a seat whose verbs are all optional asks no holder to answer.
+func TestAHolderOfASeatWhoseVerbsAreAllOptionalIsNotSilent(t *testing.T) {
+	defer catalogue.UseSeats(catalogue.DefaultSeats())
+	var rows []catalogue.Seat
+	for _, s := range catalogue.DefaultSeats() {
+		stored := s
+		stored.Serves = nil
+		for _, v := range s.Serves {
+			v.Optional = false // the store never keeps the mark
+			stored.Serves = append(stored.Serves, v)
+		}
+		rows = append(rows, stored)
+	}
+	catalogue.UseSeats(rows)
+
+	uplink, ok := catalogue.SeatNamed("node-uplink")
+	if !ok || len(uplink.Serves) == 0 {
+		t.Fatalf("node-uplink must serve verbs for this replay: %+v", uplink)
+	}
+	for _, v := range uplink.Serves {
+		if !v.Optional {
+			t.Fatalf("node-uplink's %s is required; this replay is of a seat whose verbs are all optional", v.Name)
+		}
+	}
+
+	nodes := []string{"anchor", "home-server", "workstation", "laptop"}
+	heard := map[string]bool{}
+	var recorded []catalogue.Held
+	for _, n := range nodes {
+		heard[n] = true
+		recorded = append(recorded, catalogue.Held{Claim: "node-uplink", Scope: catalogue.ScopeNode, Node: n,
+			Module: "networkmanager"})
+	}
+	expected := holdersToHear(catalogue.SeatsWithAProtocol(), recorded, nil, heard, nil, time.Now())
+	if _, asked := expected["node-uplink"]; asked {
+		t.Fatalf("node-uplink's holders are expected to answer though every verb of the seat is optional: %v",
+			expected["node-uplink"])
+	}
+	// Nothing answers for the seat, as live: no silence is said about it.
+	for _, o := range silentHolders(expected, map[string]map[string]bool{}) {
+		if o.ID == "node-uplink."+o.Machine {
+			t.Errorf("a holder serving none of a seat's optional verbs was judged silent: %s", o.Summary)
+		}
+	}
+}
+
+// Silence is still judged on a required verb: a seat with one required and one optional verb, held on a
+// machine that is heard from, whose holder answers nothing — silent.
+func TestAHolderServingNoRequiredVerbIsStillSilent(t *testing.T) {
+	seat := catalogue.Seat{Name: "example-seat", Scope: catalogue.ScopeNode, Serves: []catalogue.Verb{
+		{Name: "state"}, {Name: "later", Optional: true}}}
+	recorded := []catalogue.Held{{Claim: "example-seat", Scope: catalogue.ScopeNode, Node: "laptop", Module: "m"}}
+	expected := holdersToHear([]catalogue.Seat{seat}, recorded, nil, map[string]bool{"laptop": true}, nil, time.Now())
+	if !expected["example-seat"]["laptop"] {
+		t.Fatalf("a holder of a seat with a required verb is not expected to answer: %v", expected)
+	}
+	out := silentHolders(expected, map[string]map[string]bool{})
+	if len(out) != 1 || out[0].ID != "example-seat.laptop" || out[0].Token != "silent" {
+		t.Fatalf("a holder serving no required verb is not said to be silent: %+v", out)
+	}
+	if got := silentHolders(expected, map[string]map[string]bool{"example-seat": {"laptop": true}}); len(got) != 0 {
+		t.Fatalf("a holder that answers is said to be silent: %+v", got)
+	}
+}
+
+func TestHoldingNeedsAnAnswer(t *testing.T) {
+	for _, c := range []struct {
+		name   string
+		serves []catalogue.Verb
+		want   bool
+	}{
+		{"no verb", nil, false},
+		{"only optional verbs", []catalogue.Verb{{Name: "a", Optional: true}, {Name: "b", Optional: true}}, false},
+		{"a required verb among optional ones", []catalogue.Verb{{Name: "a", Optional: true}, {Name: "b"}}, true},
+		{"only required verbs", []catalogue.Verb{{Name: "a"}}, true},
+	} {
+		if got := holdingNeedsAnAnswer(catalogue.Seat{Name: "s", Serves: c.serves}); got != c.want {
+			t.Errorf("%s: holdingNeedsAnAnswer = %v, want %v", c.name, got, c.want)
+		}
+	}
+}
+
+// The control-node withholds the login shell's `execute` (novox/hq ADR 0268): its holder there serves
+// nothing on the seat, and must not be judged silent for it, as the store's rows read it back.
+func TestALoginShellWithholdingExecuteIsNotSilent(t *testing.T) {
+	defer catalogue.UseSeats(catalogue.DefaultSeats())
+	var rows []catalogue.Seat
+	for _, s := range catalogue.DefaultSeats() {
+		stored := s
+		stored.Serves = nil
+		for _, v := range s.Serves {
+			v.Optional = false // the store never keeps the mark
+			stored.Serves = append(stored.Serves, v)
+		}
+		rows = append(rows, stored)
+	}
+	catalogue.UseSeats(rows)
+	recorded := []catalogue.Held{{Claim: catalogue.LoginShellSeat, Scope: catalogue.ScopeNode, Node: "anchor", Module: "zsh"}}
+	expected := holdersToHear(catalogue.SeatsWithAProtocol(), recorded, nil, map[string]bool{"anchor": true}, nil, time.Now())
+	if _, asked := expected[catalogue.LoginShellSeat]; asked {
+		t.Fatalf("the login shell's holder is expected to answer, so withholding execute would be said silent: %v",
+			expected[catalogue.LoginShellSeat])
+	}
+}

cmd/mesh-controller/holdings.go

@@ -6,6 +6,8 @@ import (
 	"sort"
 
 	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/overlay"
 )
 
 // recordDerivedHolders writes down who holds each mesh-scoped seat that nobody was ever recorded
@@ -90,3 +92,72 @@ func recordDerivedHolders(ctx context.Context, open *stores) ([]string, error) {
 	}
 	return said, nil
 }
+
+// replicatedHolders is, for each replicated mesh seat, every machine on the private network holding
+// it — by internal name, at its private address (novox/hq ADR 0223). What a machine's resolver file
+// lists for `mesh-dns-resolver`; the rendering puts the machine itself first when it is one.
+//
+// **The holders on record, and only the sole claimant when there are none** — the same answer the
+// resolver gives about who holds (ADR 0131, issue 170). An assignment standing beside the holders,
+// eligible and silent, is not listed: it becomes a holder by `seat <name> --add`, an act, never by
+// being assigned. Two claimants with nothing on record are refused at resolution, so neither is
+// listed here. A holder off the private network is left out: a resolver named at an address nothing
+// answers is a lookup that waits out its timeout on every name.
+func replicatedHolders(ctx context.Context, inv *inventory.Inventory,
+	shelf map[string]catalogue.Manifest) (map[string]map[string]string, error) {
+	var replicated []catalogue.Seat
+	for _, s := range catalogue.Seats() {
+		if s.Replicated && s.Scope == catalogue.ScopeMesh {
+			replicated = append(replicated, s)
+		}
+	}
+	if len(replicated) == 0 {
+		return nil, nil
+	}
+	recorded, err := inv.Holdings(ctx)
+	if err != nil {
+		return nil, err
+	}
+	places, err := onTheNetwork(ctx, inv, shelf)
+	if err != nil {
+		return nil, err
+	}
+	address := map[string]string{}
+	for _, p := range places {
+		address[p.Name] = p.Address
+	}
+	entries, err := inv.Catalogued(ctx)
+	if err != nil {
+		return nil, err
+	}
+	out := map[string]map[string]string{}
+	for _, seat := range replicated {
+		var nodes []string
+		for _, h := range recorded {
+			if hs, ok := catalogue.SeatNamed(h.Claim); ok && hs.Name == seat.Name && h.Scope == seat.Scope {
+				nodes = append(nodes, h.Node)
+			}
+		}
+		if len(nodes) == 0 {
+			var derived []string
+			for _, e := range entries {
+				for _, c := range e.Manifest.Claims {
+					if cs, ok := catalogue.SeatNamed(c.Name); ok && cs.Name == seat.Name && c.At() == seat.Scope {
+						derived = append(derived, e.On...)
+					}
+				}
+			}
+			if len(derived) == 1 {
+				nodes = derived
+			}
+		}
+		at := map[string]string{}
+		for _, n := range nodes {
+			if address[n] != "" {
+				at[overlay.InternalName(n)] = address[n]
+			}
+		}
+		out[seat.Name] = at
+	}
+	return out, nil
+}

cmd/mesh-controller/identity_bound_test.go

@@ -0,0 +1,150 @@
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+)
+
+// novox/hq ADR 0225, issue 263: a consumer's identity is bounded by the provision it requires, an
+// overflow is refused before merge by `module check`, and a provider's machine is never refused for
+// one consumer's identity.
+
+// `module check` refuses the pull request that introduces an overflow, naming the module.
+func TestModuleCheckRefusesAnIdentityThatOverflowsWhatItRequires(t *testing.T) {
+	dir := t.TempDir()
+	write := func(name, body string) string {
+		p := filepath.Join(dir, name+".json")
+		if err := os.WriteFile(p, []byte(body), 0o600); err != nil {
+			t.Fatal(err)
+		}
+		return p
+	}
+	objects := write("objects", `{"module":"objects","version":"1",
+		"provides":[{"name":"s3-bucket","scope":"mesh","identity":{"max":20,"in":"an S3 access key"}}],
+		"receives":{"s3-bucket":"/var/lib/mesh/objects/mesh.json"}}`)
+	resolver := write("resolver", `{"module":"resolver","version":"1",
+		"provides":[{"name":"wildcard-resolution","scope":"mesh","identity":false}]}`)
+	album := write("photoalbum", `{"module":"photoalbum","version":"1","requires":["s3-bucket"]}`)
+	nm := write("networkmanager", `{"module":"networkmanager","version":"1","requires":["wildcard-resolution"]}`)
+
+	var out bytes.Buffer
+	if err := moduleCheckFor([]string{resolver, nm}, 6, &out); err != nil {
+		t.Fatalf("a long name requiring a keyless provision was refused (issue 263): %v\n%s", err, out.String())
+	}
+	out.Reset()
+	err := moduleCheckFor([]string{objects, album, resolver, nm}, 6, &out)
+	if err == nil {
+		t.Fatalf("an identity overflowing an S3 access key passed:\n%s", out.String())
+	}
+	if !strings.Contains(out.String(), "photoalbum wants s3-bucket") ||
+		!strings.Contains(out.String(), "`slug` of at most 8 characters") ||
+		strings.Contains(out.String(), "networkmanager wants") {
+		t.Fatalf("the refusal does not name the one overflowing module and its remedy:\n%s", out.String())
+	}
+}
+
+// Tonight's case, through the commands: networkmanager on a six-character machine requires the
+// resolver provision, and a second consumer there overflows an object store's access key. The
+// provider's machine still composes; the overflowing consumer is left out of its grants and named,
+// by push and by `status`, and the keyless consumer is granted with its long name.
+func TestAnOverflowingConsumerNeverRefusesItsProvidersMachine(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	register(t, open, catalogue.Manifest{Module: "objects", Version: "1",
+		Provides: []catalogue.Offer{{Name: "s3-bucket", Scope: catalogue.ScopeMesh,
+			Identity: &catalogue.OfferIdentity{Max: 20, In: "an S3 access key"}}},
+		Receives: map[string]string{"s3-bucket": "/var/lib/mesh/objects/mesh.json"}})
+	register(t, open, catalogue.Manifest{Module: "resolver", Version: "1",
+		Provides: []catalogue.Offer{{Name: "wildcard-resolution", Scope: catalogue.ScopeMesh}}})
+	register(t, open, catalogue.Manifest{Module: "networkmanager", Version: "1",
+		Requires: []string{"wildcard-resolution"}})
+	register(t, open, catalogue.Manifest{Module: "photoalbum", Version: "1", Requires: []string{"s3-bucket"}})
+	register(t, open, catalogue.Manifest{Module: "files", Version: "1", Requires: []string{"s3-bucket"}})
+	for _, a := range [][2]string{{"anchor", "objects"}, {"anchor", "resolver"},
+		{"laptop", "networkmanager"}, {"laptop", "photoalbum"}, {"laptop", "files"}} {
+		if _, err := assign(ctx, open, a[0], a[1]); err != nil {
+			t.Fatalf("assign %s %s: %v", a[0], a[1], err)
+		}
+	}
+
+	// The consumer's machine resolves, and says which of its modules no provider will grant.
+	consumer, _, err := planFor(ctx, open, "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	over := consumer.Overflowing()
+	if len(over) != 1 || over[0].Module != "photoalbum" || over[0].Provision != "s3-bucket" {
+		t.Fatalf("the consumer's side does not name exactly photoalbum: %+v", over)
+	}
+
+	// The provider's machine composes. Under ADR 0049's one bound this was a refusal naming
+	// networkmanager, and no push to the provider could go through.
+	plan, settings, err := planFor(ctx, open, "anchor")
+	if err != nil {
+		t.Fatal(err)
+	}
+	declared, err := declarationFor(ctx, open, "anchor", plan, settings)
+	if err != nil {
+		t.Fatalf("one consumer's identity refused its provider's whole machine: %v", err)
+	}
+	if len(declared.withheld) != 1 || declared.withheld[0].Identity != "mesh_laptop_photoalbum" {
+		t.Fatalf("the overflowing consumer is not the one withheld: %+v", declared.withheld)
+	}
+	grants, _, _, err := grantsFor(ctx, open, "anchor")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var keyless bool
+	for _, g := range grants {
+		keyless = keyless || g.Provision == "wildcard-resolution" && g.From == "networkmanager"
+	}
+	if !keyless {
+		t.Fatalf("networkmanager, 26 characters, is not granted the keyless resolver provision: %+v", grants)
+	}
+	var granted []string
+	for _, c := range declared.Received["objects"]["s3-bucket"] {
+		granted = append(granted, c.From)
+	}
+	if strings.Join(granted, ",") != "files" {
+		t.Fatalf("the object store grants %v; files and only files fit", granted)
+	}
+	said := printed(t, func() error { reportLeftOut("anchor", declared); return nil })
+	if !strings.Contains(said, `photoalbum on laptop requires s3-bucket from anchor`) ||
+		!strings.Contains(said, "left out of anchor's grants") {
+		t.Fatalf("the push does not say whom it leaves out:\n%s", said)
+	}
+
+	// And `status` names it, and does not call the mesh well while it stands.
+	asked, err := theThreeQuestions(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(asked.overflowing) != 1 || asked.overflowing[0].Module != "photoalbum" {
+		t.Fatalf("status does not carry the overflow: %+v", asked.overflowing)
+	}
+	if asked.well() {
+		t.Fatal("a mesh with a consumer left out of its grants reads as well")
+	}
+	shown := printed(t, func() error { return printStatus(asked) })
+	if !strings.Contains(shown, "identified too long for a provision they require") ||
+		!strings.Contains(shown, "mesh_laptop_photoalbum") {
+		t.Fatalf("status does not say it:\n%s", shown)
+	}
+	body, err := statusAsJSON(asked)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var doc struct {
+		Overflowing []catalogue.Overflow `json:"overflowing"`
+	}
+	if err := json.Unmarshal(body, &doc); err != nil || len(doc.Overflowing) != 1 ||
+		doc.Overflowing[0].Bound.Max != 20 {
+		t.Fatalf("the document does not carry it: %v\n%s", err, body)
+	}
+}

cmd/mesh-controller/issue348_test.go

@@ -0,0 +1,221 @@
+package main
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/lease"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// novox/hq issue 348: on 2026-10-09 the control node's resolver stopped answering on its private address
+// at 10:57:57 UTC; the machine's network condition was raised at 10:58:45. The node-engine and the
+// controller were sent at 10:59:34. The new node-engine's first statement judged the names once — unknown,
+// "one look failed; a second decides" — and that statement cleared the condition, though its last evidence
+// still said "connection refused". The next look raised it again at 11:00:23, after the send, and both
+// builds failed their gate at 11:10 with "raised since it was sent" and were put back, for a fault that
+// began before they were sent.
+
+// namesRefused is the control node's names part as its node-engine said it in the outage: its own
+// resolver, at its own address, refusing.
+func namesRefused(state string, streak int) link.NetworkPart {
+	p := link.NetworkPart{Part: link.PartNames, State: state, Since: h0, Streak: streak}
+	if state == link.StateUnhealthy {
+		p.Reason = "1 of its 2 resolvers do not answer as the mesh's do"
+		p.Said = "10.77.0.1 — anchor.internal (IPv4): read udp 10.77.0.1:35244->10.77.0.1:53: read: connection refused"
+		p.Toward = []string{"10.77.0.1"}
+	}
+	return p
+}
+
+func networkSaying(parts ...link.NetworkPart) *link.NetworkHealth {
+	state := link.StateHealthy
+	for _, p := range parts {
+		switch {
+		case p.State == link.StateUnhealthy:
+			state = link.StateUnhealthy
+		case p.State == link.StateUnknown && state == link.StateHealthy:
+			state = link.StateUnknown
+		}
+	}
+	return &link.NetworkHealth{State: state, Since: h0, Parts: parts}
+}
+
+// TestReplay348 replays the statements of the outage: the condition raised before the send is not
+// cleared by the restarted engine's first, undecided statement, and the gate does not count it against
+// the builds sent after it began.
+func TestReplay348(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	inv, k := open.inventory, conditionsFrom
+	say := func(at time.Time, n *link.NetworkHealth) {
+		t.Helper()
+		if err := stateHealth(ctx, inv, k, "anchor", link.Health{Contract: link.ReadinessContract, At: at, Network: n}, at); err != nil {
+			t.Fatal(err)
+		}
+	}
+	network := func() (conditions.Condition, bool) {
+		t.Helper()
+		list, err := k.Open(ctx)
+		if err != nil {
+			t.Fatal(err)
+		}
+		for _, c := range list {
+			if c.Key == "machine.anchor.network" {
+				return c, true
+			}
+		}
+		return conditions.Condition{}, false
+	}
+
+	// 10:58:45 — the second failing look: raised.
+	say(h0, networkSaying(namesRefused(link.StateUnhealthy, 2)))
+	raised, ok := network()
+	if !ok {
+		t.Fatal("the resolver refusing on the control node raised nothing")
+	}
+	time.Sleep(5 * time.Millisecond)
+	sent := time.Now().UTC()
+	time.Sleep(5 * time.Millisecond)
+
+	// 10:59:42 — the restarted engine's first statement: one look failed, a second decides.
+	say(h0.Add(time.Minute), networkSaying(namesRefused(link.StateUnknown, 1)))
+	if _, ok := network(); !ok {
+		t.Fatal("a statement that judged nothing yet cleared the condition: the restarted engine's first look " +
+			"said the fault was gone while it still refused")
+	}
+	// 11:00:23 — its second look: unhealthy again, the same raising.
+	say(h0.Add(2*time.Minute), networkSaying(namesRefused(link.StateUnhealthy, 2)))
+	again, ok := network()
+	if !ok || !again.Raised.Equal(raised.Raised) || again.Count != 1 {
+		t.Fatalf("the same raising was not kept: raised %s (first %s), count %d", again.Raised, raised.Raised, again.Count)
+	}
+
+	// The gate on the control node, for a build sent after the fault began.
+	open2, err := k.Open(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	f := gateFacts{judged: true, open: open2}
+	if w := aboutTheMachine("anchor", []string{"mesh-host"}, sent, f); w.whole != "" || len(w.on) != 0 {
+		t.Fatalf("a fault from before the send held the build: %+v", w)
+	}
+
+	// Decided healthy: cleared.
+	say(h0.Add(3*time.Minute), networkSaying(link.NetworkPart{Part: link.PartNames, State: link.StateHealthy, Since: h0}))
+	if c, ok := network(); ok {
+		t.Fatalf("a statement that decides the names healthy left %s open", c.Key)
+	}
+}
+
+// A fault there at the send, cleared and reopened after it, is not raised since the send; one that cleared
+// before the send and came back after it is — a send that breaks a recovered machine fails its gate (review
+// of mesh-controller PR 179, A2). Read through OpenAt, by both of the gate's readings.
+func TestAFaultThatFlappedAfterTheSendIsNotTheSendsAndOneThatRecoveredBeforeItIs(t *testing.T) {
+	since := h0
+	network := func(first time.Time, gaps ...conditions.Gap) conditions.Condition {
+		raised := since.Add(time.Minute)
+		if len(gaps) > 0 {
+			raised = gaps[len(gaps)-1].Reopened
+		}
+		return conditions.Condition{Key: "machine.anchor.network", Kind: kindMachineNetwork,
+			Subject: conditions.Subject{Scope: conditions.ScopeMachine, ID: "anchor", Machine: "anchor"},
+			Summary: "anchor's network is not healthy", Source: sourceNetwork, First: first, Gaps: gaps, Raised: raised}
+	}
+	held := func(c conditions.Condition) bool {
+		return aboutTheMachine("anchor", []string{"mesh-controller"}, since, gateFacts{judged: true,
+			open: []conditions.Condition{c}}).whole != ""
+	}
+	// The day's case: raised before the send, cleared 8 s after it, reopened 49 s after it.
+	flapped := network(since.Add(-49*time.Second),
+		conditions.Gap{Cleared: since.Add(8 * time.Second), Reopened: since.Add(49 * time.Second)})
+	if held(flapped) {
+		t.Fatal("a fault there at the send, flapping after it, held the machine")
+	}
+	// Recovered before the send, broken again after it: the send's.
+	recovered := network(since.Add(-time.Hour),
+		conditions.Gap{Cleared: since.Add(-30 * time.Second), Reopened: since.Add(20 * time.Second)})
+	if !held(recovered) {
+		t.Fatal("a machine recovered at the send and broken after it passed the gate")
+	}
+	// An older gap, before the send, and the fault there at the send: not the send's.
+	twice := network(since.Add(-time.Hour),
+		conditions.Gap{Cleared: since.Add(-50 * time.Minute), Reopened: since.Add(-45 * time.Minute)},
+		conditions.Gap{Cleared: since.Add(10 * time.Second), Reopened: since.Add(30 * time.Second)})
+	if held(twice) {
+		t.Fatal("a fault there at the send, with an older gap, held the machine")
+	}
+	// Raised after the send, never cleared: the send's.
+	if !held(network(time.Time{})) {
+		t.Fatal("a fault raised after the send held nothing")
+	}
+	// And a module's own, through judgeHealth.
+	at := since.Add(2 * time.Minute)
+	g := gateFacts{judged: true, now: at, reports: map[string]inventory.Reported{"anchor": {Node: "anchor",
+		Outcome: inventory.OutcomeApplied, At: &at, Current: true}}, engines: map[string]string{},
+		served: map[string]served{}, rolledBack: map[string][]lease.Rollback{},
+		open: []conditions.Condition{{Key: "provider.app.anchor.x.failing", Subject: conditions.Subject{
+			Scope: conditions.ScopeProvider, ID: "app.anchor.x", Machine: "anchor"}, Summary: "failing",
+			First: since.Add(-time.Hour), Raised: since.Add(time.Minute),
+			Gaps: []conditions.Gap{{Cleared: since.Add(5 * time.Second), Reopened: since.Add(time.Minute)}}}}}
+	if _, why := judgeHealth("app", "", catalogue.Manifest{Module: "app"}, "anchor", since, g); strings.HasPrefix(why, "raised since it was sent") {
+		t.Fatalf("a module's own fault there at the send: %s", why)
+	}
+	g.open[0].Gaps[0].Cleared = since.Add(-5 * time.Second)
+	if _, why := judgeHealth("app", "", catalogue.Manifest{Module: "app"}, "anchor", since, g); !strings.HasPrefix(why, "raised since it was sent") {
+		t.Fatalf("a module's own fault, recovered at the send and back after it, was not counted: %s", why)
+	}
+}
+
+// Only an undecided part holds a condition that names it; a condition about another part clears, and a
+// statement unknown as a whole holds every part (review of PR 179, A4). Pure.
+func TestAnUndecidedPartHoldsOnlyWhatNamesIt(t *testing.T) {
+	f := netFacts(map[string]*inventory.NetworkHealth{
+		"anchor": aNetwork(link.StateUnknown, inventory.NetworkPart{Part: link.PartNames, State: link.StateUnknown, Streak: 1},
+			inventory.NetworkPart{Part: link.PartRoute, State: link.StateHealthy}),
+		"laptop": aNetwork(link.StateHealthy, inventory.NetworkPart{Part: link.PartNames, State: link.StateHealthy}),
+		"spare":  aNetwork(link.StateStarting, inventory.NetworkPart{Part: link.PartTunnel, State: link.StateHealthy}),
+		"other":  aNetwork(link.StateStarting, inventory.NetworkPart{Part: link.PartTunnel, State: link.StateStarting}),
+	})
+	u := undecidedParts(f)
+	if !u["anchor"][link.PartNames] || u["anchor"][link.PartRoute] || u["laptop"] != nil || !u["spare"]["*"] ||
+		!u["other"][link.PartTunnel] || u["other"]["*"] {
+		t.Fatalf("undecided: %v", u)
+	}
+	about := func(machine, said string, also ...string) conditions.Condition {
+		return conditions.Condition{Subject: conditions.Subject{Scope: conditions.ScopeMachine, ID: machine,
+			Machine: machine, Also: also}, Evidence: []conditions.Evidence{{Said: said}}}
+	}
+	for _, c := range []struct {
+		c    conditions.Condition
+		held bool
+	}{
+		{about("anchor", "names since 2026-10-09 10:58:45 UTC: 10.77.0.1 — refused"), true},
+		{about("anchor", "route since 2026-10-09 10:58:45 UTC: no default route"), false},
+		{about("laptop", "names since 2026-10-09 10:58:45 UTC: refused"), false},
+		{about("spare", "route since …: no default route"), true},
+		{about("hub", "anchor: names: refused", "anchor"), true},
+		{about("hub", "anchor: tunnel: no handshake", "anchor"), false},
+	} {
+		if got := heldUndecided(c.c, u); got != c.held {
+			t.Errorf("%s %q held %v, want %v", c.c.Subject.Machine, c.c.Evidence[0].Said, got, c.held)
+		}
+	}
+}
+
+// A release walks its modules without a record per module: D10 counts what its tier names as rolling,
+// so the node-engine a release walks is not "behind, and no plan is rolling it out" on its first machine.
+func TestAReleaseRollsOutWhatItsTierNames(t *testing.T) {
+	plans := []inventory.Plan{
+		{ID: "release-1", State: inventory.PlanRolling, Tiers: [][]string{{"mesh-host"}}, Modules: map[string]*inventory.PlanModule{}},
+		{ID: "plan-2", State: inventory.PlanRolling, Modules: map[string]*inventory.PlanModule{"letta": {}}},
+	}
+	got := rollingModules(plans)
+	if !got["mesh-host"] || !got["letta"] || len(got) != 2 {
+		t.Fatalf("rolling: %v", got)
+	}
+}

cmd/mesh-controller/issue349_test.go

@@ -0,0 +1,194 @@
+package main
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// novox/hq issue 349: on 2026-10-09 the plan of mesh-catalog at a082615b (the merge of a security fix to the
+// forge's module) was "superseded at tier 0 by" the plan at 8ff8197a, the merge before it, which the
+// catch-up acted on late; what the later plan had not built was folded into a plan at the commit before the
+// fix. Plans of one branch are ordered by when the forge made their merges, and a merge older than an open
+// plan of its branch is planned at that plan's commit.
+
+// TestTwoMergesActedOnInReverseOrderBuildTheNewerCommit replays it: the later merge acted on first, the
+// earlier one second (the catch-up). One plan is left open, at the later commit, and it builds both.
+func TestTwoMergesActedOnInReverseOrderBuildTheNewerCommit(t *testing.T) {
+	open := aCatalogueMesh(t)
+	ctx := t.Context()
+	asksWithPaths(t)
+	for _, m := range []string{"gitea", "notes"} {
+		if err := open.inventory.RegisterModule(ctx, catalogue.Manifest{Module: m, Version: "1"},
+			inventory.Source{Repository: "novox/mesh-catalog", Seat: "git", Path: "modules/" + m, Ref: "main",
+				BuiltFrom: "c0", Head: "c0"}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	at := time.Now().UTC().Add(-20 * time.Minute).Truncate(time.Second)
+	fix := link.SourceMoved{Owner: "novox", Repo: "mesh-catalog", Base: "main", Commit: "a082615bfix",
+		MergedAt: at.Add(2 * time.Minute).Format(time.RFC3339Nano),
+		Paths:    []string{"modules/gitea/module.json"}, ModuleDirs: []string{"modules/gitea"}, ModuleDirsSaid: true}
+	before := link.SourceMoved{Owner: "novox", Repo: "mesh-catalog", Base: "main", Commit: "8ff8197abefore",
+		MergedAt: at.Format(time.RFC3339Nano),
+		Paths:    []string{"modules/notes/module.json"}, ModuleDirs: []string{"modules/notes"}, ModuleDirsSaid: true}
+	for _, m := range []link.SourceMoved{fix, before} {
+		if err := (following{open: open}).SourceMoved(ctx, m); err != nil {
+			t.Fatal(err)
+		}
+	}
+	plans, err := open.inventory.OpenPlans(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(plans) != 1 {
+		var said []string
+		for _, p := range plans {
+			said = append(said, p.ID+" "+p.Commit+" "+p.Note)
+		}
+		t.Fatalf("open plans: %s", strings.Join(said, "; "))
+	}
+	p := plans[0]
+	if p.Commit != fix.Commit {
+		t.Fatalf("the open plan builds %s, not the newer commit %s", p.Commit, fix.Commit)
+	}
+	for _, m := range []string{"gitea", "notes"} {
+		if _, has := p.Modules[m]; !has {
+			t.Fatalf("the open plan at the newer commit does not build %s: %v", m, p.Modules)
+		}
+	}
+}
+
+// A late older merge after the newer plan is done (review of PR 179, A1): what it moved is built from the
+// newer commit, and what the newer merge already looked at is not built again at the older one.
+func TestALateMergeAfterTheNewerPlanEndedBuildsTheNewerCommit(t *testing.T) {
+	open := aCatalogueMesh(t)
+	ctx := t.Context()
+	asksWithPaths(t)
+	for _, m := range []string{"gitea", "notes"} {
+		if err := open.inventory.RegisterModule(ctx, catalogue.Manifest{Module: m, Version: "1"},
+			inventory.Source{Repository: "novox/mesh-catalog", Seat: "git", Path: "modules/" + m, Ref: "main",
+				BuiltFrom: "c0", Head: "c0"}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	at := time.Now().UTC().Add(-20 * time.Minute).Truncate(time.Second)
+	fix := link.SourceMoved{Owner: "novox", Repo: "mesh-catalog", Base: "main", Commit: "a082615bfix",
+		MergedAt: at.Add(2*time.Minute + 500*time.Millisecond).Format(time.RFC3339Nano),
+		Paths:    []string{"modules/gitea/module.json"}, ModuleDirs: []string{"modules/gitea"}, ModuleDirsSaid: true}
+	if err := (following{open: open}).SourceMoved(ctx, fix); err != nil {
+		t.Fatal(err)
+	}
+	plans, err := open.inventory.OpenPlans(ctx)
+	if err != nil || len(plans) != 1 {
+		t.Fatalf("%v %v", plans, err)
+	}
+	done := plans[0]
+	done.State = inventory.PlanDone
+	if err := open.inventory.SavePlan(ctx, &done); err != nil {
+		t.Fatal(err)
+	}
+	if got, err := open.inventory.PlanByID(ctx, done.ID); err != nil || !got.Merged.Equal(at.Add(2*time.Minute+500*time.Millisecond)) {
+		t.Fatalf("the merge time kept is %s, not to the nanosecond (%v)", got.Merged, err)
+	}
+	before := link.SourceMoved{Owner: "novox", Repo: "mesh-catalog", Base: "main", Commit: "8ff8197abefore",
+		MergedAt:   at.Format(time.RFC3339Nano),
+		Paths:      []string{"modules/notes/module.json", "modules/gitea/module.json"},
+		ModuleDirs: []string{"modules/notes", "modules/gitea"}, ModuleDirsSaid: true}
+	if err := (following{open: open}).SourceMoved(ctx, before); err != nil {
+		t.Fatal(err)
+	}
+	plans, err = open.inventory.OpenPlans(ctx)
+	if err != nil || len(plans) != 1 {
+		t.Fatalf("open plans after the late merge: %+v %v", plans, err)
+	}
+	p := plans[0]
+	if p.Commit != fix.Commit {
+		t.Fatalf("the late merge was planned at %s, not the newer commit %s", p.Commit, fix.Commit)
+	}
+	if _, has := p.Modules["notes"]; !has {
+		t.Fatalf("what only the late merge moved is not built: %v", p.Modules)
+	}
+	if _, has := p.Modules["gitea"]; has {
+		t.Fatalf("what the newer merge already built is built again: %v", p.Modules)
+	}
+}
+
+// Pure: the branch's order is the merges', where both plans know it; and a later merge of the branch is
+// found in any state, never a release's, another repository's or another branch's.
+func TestTheBranchOrderIsTheMerges(t *testing.T) {
+	t0 := time.Date(2026, 10, 9, 10, 0, 0, 0, time.UTC)
+	newerMerge := inventory.Plan{ID: "plan-1", Repository: "novox/mesh-catalog", Branch: "main", Commit: "a082615b",
+		Merged: t0.Add(time.Minute), Created: t0.Add(2 * time.Minute), State: inventory.PlanRolling}
+	olderMerge := inventory.Plan{ID: "plan-2", Repository: "novox/mesh-catalog", Branch: "main", Commit: "8ff8197a",
+		Merged: t0, Created: t0.Add(10 * time.Minute), State: inventory.PlanBuilding}
+	if earlierOnTheBranch(newerMerge, olderMerge) || !earlierOnTheBranch(olderMerge, newerMerge) {
+		t.Fatal("ordered by when the plans were made, not by when the merges were")
+	}
+	if _, closed := supersededBy(olderMerge, []inventory.Plan{newerMerge}, func(string) bool { return true }); len(closed) != 0 {
+		t.Fatalf("the plan of an older merge superseded a newer one: %s", closed[0].Note)
+	}
+	unknown := newerMerge
+	unknown.Merged = time.Time{}
+	if !earlierOnTheBranch(unknown, olderMerge) {
+		t.Fatal("without a merge time the plans' own order does not stand")
+	}
+	same := olderMerge
+	same.Merged = newerMerge.Merged
+	if !earlierOnTheBranch(newerMerge, same) || earlierOnTheBranch(same, newerMerge) {
+		t.Fatal("one merge time: the plans' own order does not stand")
+	}
+	m := link.SourceMoved{Owner: "novox", Repo: "mesh-catalog", Base: "main", Commit: "8ff8197a",
+		MergedAt: t0.Add(500 * time.Millisecond).Format(time.RFC3339Nano)}
+	newerMerge.State = inventory.PlanDone
+	if !laterOnTheBranch(m, newerMerge) {
+		t.Fatal("a later merge of the branch, its plan done, was not found")
+	}
+	for name, change := range map[string]func(p *inventory.Plan, m *link.SourceMoved){
+		"another branch":     func(_ *inventory.Plan, m *link.SourceMoved) { m.Base = "release" },
+		"another repository": func(p *inventory.Plan, _ *link.SourceMoved) { p.Repository = "novox/mesh-controller" },
+		"a release":          func(p *inventory.Plan, _ *link.SourceMoved) { p.Release = &inventory.PlanRelease{} },
+		"no merge time":      func(p *inventory.Plan, _ *link.SourceMoved) { p.Merged = time.Time{} },
+		"the same commit":    func(p *inventory.Plan, m *link.SourceMoved) { m.Commit = p.Commit },
+		"an older merge":     func(p *inventory.Plan, _ *link.SourceMoved) { p.Merged = t0 },
+		"the same moment":    func(p *inventory.Plan, _ *link.SourceMoved) { p.Merged = t0.Add(500 * time.Millisecond) },
+		"an unreadable time": func(_ *inventory.Plan, m *link.SourceMoved) { m.MergedAt = "yesterday" },
+	} {
+		p, mm := newerMerge, m
+		change(&p, &mm)
+		if laterOnTheBranch(mm, p) {
+			t.Errorf("%s was taken as a later merge of the branch", name)
+		}
+	}
+	// To the nanosecond: two merges within a second keep their order.
+	m.MergedAt = t0.Add(time.Minute + 200*time.Millisecond).Format(time.RFC3339Nano)
+	if !laterOnTheBranch(m, inventory.Plan{Repository: "novox/mesh-catalog", Branch: "main", Commit: "x",
+		Merged: t0.Add(time.Minute + 700*time.Millisecond)}) {
+		t.Fatal("merges within one second lost their order")
+	}
+}
+
+// A merge time with a fraction of a second is kept whole in its plan, and two merges within one second keep
+// their order through the plans and the lookup (review of PR 179).
+func TestAMergeTimeKeepsItsFractionOfASecond(t *testing.T) {
+	at := "2026-10-09T10:57:52.123456789Z"
+	p := planOfMerge(link.SourceMoved{Owner: "novox", Repo: "mesh-catalog", Base: "main", Commit: "c1", MergedAt: at}, nil, nil)
+	want := time.Date(2026, 10, 9, 10, 57, 52, 123456789, time.UTC)
+	if !p.Merged.Equal(want) {
+		t.Fatalf("the plan's merge time is %s, not %s", p.Merged, want)
+	}
+	earlier := planOfMerge(link.SourceMoved{Owner: "novox", Repo: "mesh-catalog", Base: "main", Commit: "c0",
+		MergedAt: "2026-10-09T10:57:52.123456788Z"}, nil, nil)
+	earlier.Created = p.Created.Add(time.Second) // made after, merged before
+	if !earlierOnTheBranch(earlier, p) || earlierOnTheBranch(p, earlier) {
+		t.Fatal("two merges a nanosecond apart lost their order")
+	}
+	m := link.SourceMoved{Owner: "novox", Repo: "mesh-catalog", Base: "main", Commit: "c0", MergedAt: "2026-10-09T10:57:52.123456788Z"}
+	if !laterOnTheBranch(m, p) {
+		t.Fatal("a merge a nanosecond later was not found as the later one")
+	}
+}

cmd/mesh-controller/issue_204_test.go

@@ -0,0 +1,93 @@
+package main
+
+import (
+	"context"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// A declaration composed earlier is numbered lower than one composed later, whatever order the two
+// are sent in (novox/hq issue 204). The number used to be taken at send time, after composing, so a
+// declaration composed before an assignment changed and sent after a newer one carried the higher
+// number — and the machine, which refuses a lower number, took the older content as the mesh's
+// newest word. Taken before the composition reads anything, the order of numbers is the order of
+// compositions, and the host's refusal does what it is for.
+func TestADeclarationComposedEarlierIsNumberedLowerWhateverOrderItIsSent(t *testing.T) {
+	allot := numbered()
+	var composed []string
+	compose := func(stamp string) func(string) (sendable, error) {
+		return func(node string) (sendable, error) {
+			composed = append(composed, stamp)
+			return sendable{Resources: []map[string]any{{"id": node + "." + stamp}}}, nil
+		}
+	}
+	// Composed first — before an assignment changed — and sent last.
+	stale, _ := composeEach([]string{"anchor"}, allot, compose("before"))
+	// Composed after the change, sent first.
+	fresh, _ := composeEach([]string{"anchor"}, allot, compose("after"))
+
+	if stale[0].declared.Sequence != 1 || fresh[0].declared.Sequence != 2 {
+		t.Fatalf("the numbers do not follow the compositions: before=%d after=%d",
+			stale[0].declared.Sequence, fresh[0].declared.Sequence)
+	}
+	// Sent in the other order, the numbers do not change — so the machine that has applied the
+	// fresh one (2) refuses the stale one (1) when it arrives late.
+	if !(stale[0].declared.Sequence < fresh[0].declared.Sequence) {
+		t.Fatal("a declaration composed earlier must carry the lower number, however late it is sent")
+	}
+	if len(composed) != 2 || composed[0] != "before" {
+		t.Fatalf("compositions happened in an unexpected order: %v", composed)
+	}
+}
+
+// The number is taken before the first read of the composition, not after it: an allotter that
+// fails leaves nothing composed for that machine, and the others are still composed.
+func TestTheNumberIsTakenBeforeComposingAndItsFailureIsARefusal(t *testing.T) {
+	calls := 0
+	allot := func(node string) (order, error) {
+		if node == "anchor" {
+			return order{}, context.DeadlineExceeded
+		}
+		return order{sequence: 7}, nil
+	}
+	sending, refusals := composeEach([]string{"anchor", "laptop"}, allot, func(node string) (sendable, error) {
+		calls++
+		if node == "anchor" {
+			t.Fatal("anchor was composed although its number could not be taken")
+		}
+		return sendable{}, nil
+	})
+	if calls != 1 || len(sending) != 1 || sending[0].node != "laptop" || sending[0].declared.Sequence != 7 {
+		t.Fatalf("laptop should be composed with its number and anchor refused: %v / %v", sending, refusals)
+	}
+	if len(refusals) != 1 {
+		t.Fatalf("anchor's failed number should be a refusal naming it: %v", refusals)
+	}
+}
+
+// What was sent is written down even when the sender's context is already cancelled (issue 204): a
+// controller replaced mid-send had told the machine and never recorded it, so status read "applied,
+// current" over a machine that had just been sent something else.
+func TestASendIsRecordedEvenWhenTheSenderIsBeingCancelled(t *testing.T) {
+	inv := inventory.ForTest(t)
+	ctx, cancel := context.WithCancel(t.Context())
+	if _, err := inv.AddNode(ctx, "anchor"); err != nil {
+		t.Fatal(err)
+	}
+	cancel() // the sender is going away: its context is cancelled between the send and the record
+	body := []byte(`{"declaration":1,"resources":[]}`)
+	digest, err := recordSent(ctx, inv, "anchor", body, nil, 0)
+	if err != nil {
+		// NodeByName on the cancelled context may itself refuse; the record must still be possible
+		// through the detached context, so look the node up again on a live one.
+		t.Fatalf("recording a send after cancellation failed: %v", err)
+	}
+	outstanding, err := inv.Outstanding(t.Context(), "anchor")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if outstanding != digest || digest != digestOf(body) {
+		t.Fatalf("the send was not recorded: outstanding %q, sent %q", outstanding, digest)
+	}
+}

cmd/mesh-controller/join_through_the_tunnel_test.go

@@ -0,0 +1,102 @@
+package main
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// aMachineJoining is a machine with a live token issued for a tunnel key, given its address — what
+// `token issue --overlay-key` records before it pushes the hub (novox/hq ADR 0169).
+func aMachineJoining(t *testing.T, ctx context.Context, inv *inventory.Inventory, name string,
+	validFor time.Duration) string {
+	t.Helper()
+	record, err := inv.AddNode(ctx, name)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := inv.IssueToken(ctx, name, validFor); err != nil {
+		t.Fatal(err)
+	}
+	key := aPublicKey(t)
+	if err := inv.RecordOverlayKey(ctx, record.ID, key); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.BindTokenToKey(ctx, record.ID, key); err != nil {
+		t.Fatal(err)
+	}
+	cidr, err := overlayRange(ctx, inv)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := inv.AssignAddress(ctx, record.ID, cidr); err != nil {
+		t.Fatal(err)
+	}
+	return key
+}
+
+// hubPeers are the keys the hub's composed tunnel carries.
+func hubPeers(t *testing.T, ctx context.Context, inv *inventory.Inventory) map[string]bool {
+	t.Helper()
+	g, err := network(ctx, inv, map[string]bool{"anchor": true, "laptop": true}, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	out := map[string]bool{}
+	for _, p := range g.Graph()["anchor"] {
+		out[p.Key] = true
+	}
+	return out
+}
+
+// **A machine joining is a peer of the hub while its token can be used, and not after** (novox/hq
+// ADR 0169): the hub's composed tunnel carries a machine whose token was issued for its key, so the
+// tunnel answers the first time it knocks; a token that expired unused takes the peer with it at the
+// hub's next composition.
+func TestAMachineJoiningIsAPeerOfTheHubUntilItsTokenExpires(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+
+	joining := aMachineJoining(t, ctx, inv, "joiner", time.Hour)
+	expired := aMachineJoining(t, ctx, inv, "late", 2*time.Second)
+	time.Sleep(2100 * time.Millisecond)
+
+	peers := hubPeers(t, ctx, inv)
+	if !peers[joining] {
+		t.Fatalf("the hub does not carry the machine its live token was issued for: %v", peers)
+	}
+	if peers[expired] {
+		t.Fatalf("the hub still carries a machine whose token expired unused: %v", peers)
+	}
+
+	// A token issued without a key gives the hub nothing to carry: there is no key to carry.
+	if _, err := inv.AddNode(ctx, "keyless"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := inv.IssueToken(ctx, "keyless", time.Hour); err != nil {
+		t.Fatal(err)
+	}
+	if after := hubPeers(t, ctx, inv); len(after) != len(peers) {
+		t.Fatalf("a token issued without a key changed the hub's peers: %v, was %v", after, peers)
+	}
+}
+
+// **A tunnel key that is not one is refused before anything is recorded** (novox/hq ADR 0169): a
+// token issued for it would be a tunnel the hub could never answer.
+func TestATokenIsNotIssuedForSomethingThatIsNotATunnelKey(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	record, err := open.inventory.AddNode(ctx, "joiner")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, _, err := throughTheTunnel(ctx, open, record, "not-a-key", "10.77.0.1:4222"); err == nil {
+		t.Fatal("a token was issued for something that is not a tunnel key")
+	}
+	if held := placementOf(t, ctx, open.inventory, "joiner"); held.Key != "" || held.Address != "" {
+		t.Fatalf("a refused key left a record behind: %+v", held)
+	}
+}

cmd/mesh-controller/lease_command_test.go

@@ -0,0 +1,68 @@
+package main
+
+import (
+	"testing"
+
+	"github.com/nats-io/nats.go"
+	"github.com/nats-io/nats.go/jetstream"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/lease"
+)
+
+// A command run at a shell (novox/hq to-be 45 §6): under the holder's epoch while a controller holds the
+// lease, read at the moment it acts; under a lease of its own while none does, given back as it ends.
+func TestACommandActsUnderTheHoldersEpochOrItsOwn(t *testing.T) {
+	url, kv := aBusForTheLease(t)
+	t.Setenv(broker.NATSVar, url)
+	ctx := t.Context()
+
+	// Nobody holds it: the command takes it, and gives it back.
+	cmd := &actor{}
+	own, err := cmd.epoch(ctx)
+	if err != nil || own == 0 {
+		t.Fatalf("a command with nobody holding the lease acts as %d (%v)", own, err)
+	}
+	if h, found, _ := lease.Current(ctx, kv); !found || h.Epoch != own {
+		t.Fatalf("the command's lease is not on the bus: %+v", h)
+	}
+	cmd.release()
+	if _, found, _ := lease.Current(ctx, kv); found {
+		t.Fatal("the command did not give its lease back as it ended")
+	}
+
+	// A controller holds it: a command acts under that epoch.
+	l, err := lease.Open(ctx, mustJetStream(t, url), broker.LeaseBucket, lease.Options{Holder: lease.Holder{Instance: "serving"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	held, err := l.TryTake(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	borrower := &actor{}
+	defer borrower.release()
+	if got, err := borrower.epoch(ctx); err != nil || got != held {
+		t.Fatalf("a command acts as %d (%v), want the holder's %d", got, err, held)
+	}
+	// The holder lets go: the command does not go on under an epoch nobody holds.
+	l.Release(ctx)
+	if _, err := borrower.epoch(ctx); err == nil {
+		t.Fatal("a command acted under an epoch nobody holds any more")
+	}
+}
+
+// mustJetStream is a connection of its own to the test bus.
+func mustJetStream(t *testing.T, url string) jetstream.JetStream {
+	t.Helper()
+	conn, err := nats.Connect(url)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(conn.Close)
+	js, err := jetstream.New(conn)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return js
+}

cmd/mesh-controller/lease_test.go

@@ -0,0 +1,173 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/nats-io/nats.go"
+	"github.com/nats-io/nats.go/jetstream"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/lease"
+
+	"github.com/novox/mesh-controller/internal/testbus"
+)
+
+// Two controllers at once (novox/hq to-be 45 §6, issue 204; the half of replay R1 that lives here): two
+// serving controllers over one store and one bus. The second waits while the first holds the lease; on
+// a handover it takes it at a higher epoch, the record says which held what and how each ended; and the
+// one that lost it acts no more — no declaration composed, no plan and no condition written — the
+// moment it lost it.
+//
+//	MESH_TEST_POSTGRES=… go test ./cmd/mesh-controller/ -run Controllers   (each test on a bus of its own: internal/testbus)
+
+// aBusForTheLease is the test bus with the controller's lease bucket new.
+func aBusForTheLease(t *testing.T) (string, jetstream.KeyValue) {
+	t.Helper()
+	url := testbus.URL(t)
+	conn, err := nats.Connect(url)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(conn.Close)
+	js, err := jetstream.New(conn)
+	if err != nil {
+		t.Fatal(err)
+	}
+	_ = js.DeleteKeyValue(t.Context(), broker.LeaseBucket)
+	if err := broker.EnsureLeaseBucket(t.Context(), js); err != nil {
+		t.Fatal(err)
+	}
+	kv, err := js.KeyValue(t.Context(), broker.LeaseBucket)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = js.DeleteKeyValue(context.Background(), broker.LeaseBucket) })
+	return url, kv
+}
+
+func TestTwoControllersOneActs(t *testing.T) {
+	url, kv := aBusForTheLease(t)
+	inv := inventory.ForTest(t)
+	ctx := t.Context()
+
+	// Controller A takes the lease.
+	a := &actor{}
+	aCtx, stopA := context.WithCancel(ctx)
+	defer stopA()
+	lostA, err := a.serveUnderTheLease(aCtx, inv, url)
+	if err != nil {
+		t.Fatal(err)
+	}
+	epochA, err := a.epoch(ctx)
+	if err != nil || epochA == 0 {
+		t.Fatalf("A holds no epoch: %d, %v", epochA, err)
+	}
+
+	// Controller B starts while A holds it, and waits — acting on nothing meanwhile.
+	b := &actor{}
+	bCtx, stopB := context.WithCancel(ctx)
+	defer stopB()
+	tookB := make(chan (<-chan struct{}), 1)
+	go func() {
+		lost, err := b.serveUnderTheLease(bCtx, inv, url)
+		if err != nil {
+			t.Errorf("B: %v", err)
+			close(tookB)
+			return
+		}
+		tookB <- lost
+	}()
+	select {
+	case <-tookB:
+		t.Fatal("B took the lease while A held it")
+	case <-time.After(3 * time.Second):
+	}
+	if _, err := b.epoch(ctx); !errors.Is(err, lease.ErrNotHeld) {
+		t.Fatalf("B, waiting, may act: %v", err)
+	}
+
+	// A hands over, as a controller being replaced does: B takes the lease at once, at a higher epoch.
+	stopA()
+	a.release()
+	var lostB <-chan struct{}
+	select {
+	case lostB = <-tookB:
+	case <-time.After(10 * time.Second):
+		t.Fatal("B did not take the lease A gave back")
+	}
+	select {
+	case <-lostA:
+	default:
+		t.Fatal("A, having given the lease back, is not told it no longer holds it")
+	}
+	epochB, err := b.epoch(ctx)
+	if err != nil || epochB <= epochA {
+		t.Fatalf("B acts as epoch %d after A's %d (%v): an epoch only grows", epochB, epochA, err)
+	}
+	if _, err := a.epoch(ctx); err == nil {
+		t.Fatal("A acts after giving the lease back")
+	}
+	ea, _, _ := inv.EpochOf(ctx, epochA)
+	eb, _, _ := inv.EpochOf(ctx, epochB)
+	if ea.How != inventory.EpochReleased || eb.Ended != nil || eb.Instance != instance {
+		t.Fatalf("the record of the handover reads %+v then %+v", ea, eb)
+	}
+
+	// Something else writes the lease's key — a third controller on a clock that read it as expired:
+	// B's next renewal is refused, and B stops acting at once.
+	if _, err := kv.Put(ctx, lease.Key, []byte(`{"instance":"a third controller","epoch":1}`)); err != nil {
+		t.Fatal(err)
+	}
+	select {
+	case <-lostB:
+	case <-time.After(2 * lease.RenewEvery):
+		t.Fatal("B was not told it lost the lease")
+	}
+	if _, err := b.epoch(ctx); !errors.Is(err, lease.ErrNotHeld) {
+		t.Fatalf("B acts after losing the lease: %v", err)
+	}
+	// Nothing B does is written: a declaration's number is not taken, a plan is not saved, a condition
+	// is not raised.
+	inv.ActsUnder(b.epoch)
+	if _, err := inv.AddNode(ctx, "anchor"); err != nil {
+		t.Fatal(err)
+	}
+	saved := inventory.Plan{ID: "plan-after-loss", Repository: "novox/app", Commit: "c0ffee00", Created: time.Now(),
+		State: inventory.PlanBuilding}
+	if err := inv.SavePlan(ctx, &saved); err == nil {
+		t.Fatal("B wrote a plan after losing the lease")
+	}
+	store := conditions.NewInMemory()
+	keeper := conditions.NewKeeper(ctx, conditions.Options{Store: store, History: store,
+		Epoch: func() (uint64, error) { return b.epoch(ctx) }})
+	defer keeper.Close(context.Background())
+	if _, err := keeper.Observe(ctx, conditions.Observation{Scope: conditions.ScopeCore, ID: "x", Kind: "x",
+		Severity: conditions.Warning, Summary: "x", Source: "test"}); err == nil {
+		t.Fatal("B raised a condition after losing the lease")
+	}
+	if ended, _, _ := inv.EpochOf(ctx, epochB); ended.How != inventory.EpochLost {
+		t.Fatalf("B's epoch does not say it was lost: %+v", ended)
+	}
+}
+
+// A controller whose bus refuses it the lease's key, with nobody holding it, serves without the lease:
+// it acts with no epoch — refused by no node-engine — says so, and takes the lease once it can.
+func TestAControllerTheBusRefusesTheLeaseServesUnleasedAndSaysSo(t *testing.T) {
+	a := &actor{serving: true, unleased: "the bus refused the lease's key"}
+	if epoch, err := a.epoch(context.Background()); err != nil || epoch != 0 {
+		t.Fatalf("an unleased controller answers %d, %v: it acts, claiming no epoch", epoch, err)
+	}
+	if st := a.standing(); st.Unleased == "" || st.Held {
+		t.Fatalf("its standing says %+v", st)
+	}
+	// One that neither holds nor is unleased — still waiting — acts on nothing.
+	waiting := &actor{serving: true}
+	if _, err := waiting.epoch(context.Background()); !errors.Is(err, lease.ErrNotHeld) {
+		t.Fatalf("a controller waiting for the lease may act: %v", err)
+	}
+}

cmd/mesh-controller/licence.go

@@ -232,7 +232,7 @@ func licenceKey(ctx context.Context, args []string) error {
 	// and printing the value here would put the one copy that matters on a terminal.
 	fmt.Printf("sealed to %d holder(s). The mesh has discarded the key and cannot read it back\n",
 		sealed)
-	fmt.Printf("  run `push` to deliver it\n")
+	fmt.Printf("  run `push --behind` to deliver it\n")
 	return nil
 }
 
@@ -340,7 +340,7 @@ func licenceSetGrant(ctx context.Context, args []string) error {
 		return err
 	}
 	fmt.Printf("%s now holds a refresh token for %s, sealed to that node's key and readable by it "+
-		"alone.\n  the control plane stored the box without opening it; run `push` to deliver it\n",
+		"alone.\n  the control plane stored the box without opening it; run `push --behind` to deliver it\n",
 		"the manager", name)
 	return nil
 }
@@ -423,7 +423,7 @@ func licenceSubmitRefresh(ctx context.Context, args []string) error {
 			"manager node alone"
 	}
 	fmt.Printf("submitted a refresh for %s: a new access token sealed to %d holder(s), and %s.\n"+
-		"  run `push` to deliver it\n", name, sealed, rotatedNote)
+		"  run `push --behind` to deliver it\n", name, sealed, rotatedNote)
 	return nil
 }
 
@@ -456,7 +456,7 @@ func licenceRefresh(ctx context.Context, args []string) error {
 		return err
 	}
 	fmt.Printf("refreshed %s: a new access token sealed to %d holder(s), and the refresh token left "+
-		"with its manager.\n  run `push` to deliver it\n", name, sealed)
+		"with its manager.\n  run `push --behind` to deliver it\n", name, sealed)
 	return nil
 }
 

cmd/mesh-controller/machine_network.go

@@ -0,0 +1,413 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// A machine says how its network is (novox/hq ADR 0241, which extends ADR 0240 from what a module runs
+// to the machine it runs on).
+//
+// **Every machine's node-engine judges its own networking** — the resolver file the uplink holder
+// declared, the names through every resolver it lists, the tunnel's handshake with the hub, the bus, the
+// default route — on the two-look rule, and states it beside its resources. The controller keeps the
+// newest statement per machine and raises from all of them together:
+//
+//   - **an outside writer of the resolver file is its own finding**, `machine.<m>.<owner>.rewritten`:
+//     the file the uplink holder declares was rewritten by another program, named where the engine could
+//     name it. The names failing through what that program wrote are that finding's consequence, said in
+//     it — never a second condition;
+//   - **what is the machine's own** — its route, its tunnel, its resolvers answering wrong, a resolver
+//     that is no mesh machine — is `machine.<m>.network`;
+//   - **what points at another machine is said once, there** (the provider hold of ADR 0240 rule 5, for
+//     the network): a failure toward the hub or toward a mesh resolver is held under that machine when it
+//     is down on the record — silent, or its own network unhealthy — or when a second machine finds the
+//     same; then `machine.<x>.unreachable` names every machine that cannot reach it, and none of them
+//     raises anything of its own for it. One machine alone failing toward a healthy one is its own.
+//
+// Each is a warning; urgent on the control node, or when the bus cannot be reached, or for the hub.
+// Cleared on the first statement that no longer says it. An engine older than this judging says nothing
+// of its network, and nothing is raised for it.
+
+// The conditions a machine's network raises.
+const (
+	kindMachineNetwork     = "machine-network"
+	kindNetworkRewritten   = "network-rewritten"
+	kindNetworkUnreachable = "network-unreachable"
+	sourceNetwork          = "network"
+)
+
+// networkKinds are the kinds this judging owns: every open one it no longer says, it clears.
+var networkKinds = []string{kindMachineNetwork, kindNetworkRewritten, kindNetworkUnreachable}
+
+// networkFacts is what one judging of every machine's network reads.
+type networkFacts struct {
+	healths map[string]inventory.NodeHealth
+	// byAddress is each machine's address on the private network; hub the hub's name; control the
+	// control node's.
+	byAddress map[string]string
+	hub       string
+	control   string
+	// silent is every machine whose silence is an open condition.
+	silent map[string]bool
+}
+
+// judgeNetworks raises and clears every machine's network conditions from every machine's newest
+// statement, after one machine's statement was kept.
+func judgeNetworks(ctx context.Context, inv *inventory.Inventory, k *conditions.Keeper, now time.Time) error {
+	healths, err := inv.Healths(ctx)
+	if err != nil {
+		return err
+	}
+	overlays, err := inv.Overlays(ctx)
+	if err != nil {
+		return err
+	}
+	open, err := k.Open(ctx)
+	if err != nil {
+		return err
+	}
+	f := networkFacts{healths: healths, byAddress: map[string]string{}, control: controlHost(ctx, inv),
+		silent: map[string]bool{}}
+	for _, o := range overlays {
+		if o.Address != "" {
+			f.byAddress[o.Address] = o.Name
+		}
+		if o.Hub {
+			f.hub = o.Name
+		}
+	}
+	for _, c := range open {
+		if c.Subject.Scope == conditions.ScopeMachine && c.Kind == "silent" {
+			f.silent[c.Subject.ID] = true
+		}
+	}
+	var problems []string
+	said := map[string]bool{}
+	for _, o := range networkObservations(f) {
+		said[o.Key()] = true
+		if _, err := k.Observe(ctx, o); err != nil {
+			problems = append(problems, err.Error())
+		}
+	}
+	undecided := undecidedParts(f)
+	for _, c := range open {
+		if !slices.Contains(networkKinds, c.Kind) || said[c.Key] || heldUndecided(c, undecided) {
+			continue
+		}
+		why := "no machine says it any more"
+		if c.Subject.Machine != "" {
+			why = c.Subject.Machine + "'s network no longer says it"
+		}
+		if _, err := k.Clear(ctx, c.Key, why); err != nil {
+			problems = append(problems, err.Error())
+		}
+	}
+	if len(problems) > 0 {
+		return fmt.Errorf("%s", strings.Join(problems, "; "))
+	}
+	return nil
+}
+
+// undecidedParts is, per machine, every part of its newest statement not yet judged: starting, or unknown
+// — one look failed and a second decides (novox/hq issue 348). Such a part does not say its fault is gone.
+// A statement whose parts are all decided but whose whole is unknown or starting holds every part. Pure.
+//
+// On 2026-10-09 the control node's resolver refused every question from 10:58 to 11:18 UTC. A build of
+// the node-engine sent at 10:59:34 restarted it; its first statement judged the names once (unknown, "one
+// look failed; a second decides"), and that statement cleared the control node's network condition while
+// its last evidence still said "connection refused". The second look raised it again forty seconds later —
+// after the send — and the gate failed the build for a fault from before it.
+func undecidedParts(f networkFacts) map[string]map[string]bool {
+	out := map[string]map[string]bool{}
+	for m, h := range f.healths {
+		if h.Network == nil {
+			continue
+		}
+		parts := map[string]bool{}
+		for _, p := range h.Network.Parts {
+			if p.State == link.StateUnknown || p.State == link.StateStarting {
+				parts[p.Part] = true
+			}
+		}
+		if len(parts) == 0 && (h.Network.State == link.StateUnknown || h.Network.State == link.StateStarting) {
+			parts["*"] = true
+		}
+		if len(parts) > 0 {
+			out[m] = parts
+		}
+	}
+	return out
+}
+
+// heldUndecided says an open network condition is kept rather than cleared: a part its newest evidence
+// names is undecided in the newest statement of a machine it is about. A condition about other parts
+// clears as before. Pure.
+func heldUndecided(c conditions.Condition, undecided map[string]map[string]bool) bool {
+	said := ""
+	if len(c.Evidence) > 0 {
+		said = c.Evidence[0].Said
+	}
+	for _, m := range append([]string{c.Subject.Machine}, c.Subject.Also...) {
+		parts := undecided[m]
+		if parts["*"] {
+			return true
+		}
+		for part := range parts {
+			if strings.Contains(said, part+" since ") || strings.Contains(said, part+": ") {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// pointed is one machine's failing part that points at another machine.
+type pointed struct {
+	from string
+	part inventory.NetworkPart
+}
+
+// networkObservations is every network condition the statements say now. Pure.
+func networkObservations(f networkFacts) []conditions.Observation {
+	machines := make([]string, 0, len(f.healths))
+	for m := range f.healths {
+		machines = append(machines, m)
+	}
+	sort.Strings(machines)
+
+	unhealthy := func(m string) []inventory.NetworkPart {
+		h := f.healths[m]
+		if h.Network == nil {
+			return nil
+		}
+		var out []inventory.NetworkPart
+		for _, p := range h.Network.Parts {
+			if p.State == link.StateUnhealthy {
+				out = append(out, p)
+			}
+		}
+		return out
+	}
+	// The machines a part points at, other than its own: the hub, and each mesh resolver by its address.
+	// An address that is no mesh machine's — the resolver a VPN client wrote in — is the machine's own.
+	targets := func(m string, p inventory.NetworkPart) ([]string, bool) {
+		if len(p.Toward) == 0 {
+			return nil, false
+		}
+		var out []string
+		for _, t := range p.Toward {
+			x := f.byAddress[t]
+			if t == link.TowardHub {
+				x = f.hub
+			}
+			if x == "" || x == m {
+				return nil, false
+			}
+			if !slices.Contains(out, x) {
+				out = append(out, x)
+			}
+		}
+		return out, true
+	}
+
+	// First pass: what points at whom.
+	pointing := map[string][]pointed{}
+	for _, m := range machines {
+		for _, p := range unhealthy(m) {
+			if xs, ok := targets(m, p); ok {
+				for _, x := range xs {
+					pointing[x] = append(pointing[x], pointed{from: m, part: p})
+				}
+			}
+		}
+	}
+	from := func(x string) []string {
+		var out []string
+		for _, pt := range pointing[x] {
+			if !slices.Contains(out, pt.from) {
+				out = append(out, pt.from)
+			}
+		}
+		sort.Strings(out)
+		return out
+	}
+	// A machine is down on the record when its silence is open or its own network is unhealthy, or when
+	// two machines find it unreachable: then what points at it is held there.
+	down := func(x string) bool {
+		return f.silent[x] || len(unhealthy(x)) > 0 || len(from(x)) >= 2
+	}
+
+	var out []conditions.Observation
+	saysOwn := map[string]bool{}
+	for _, m := range machines {
+		parts := unhealthy(m)
+		if len(parts) == 0 {
+			continue
+		}
+		var own []inventory.NetworkPart
+		var rewritten *inventory.NetworkPart
+		for i, p := range parts {
+			if p.Part == link.PartResolvConf {
+				rewritten = &parts[i]
+				continue
+			}
+			if xs, ok := targets(m, p); ok && allDown(xs, down) {
+				continue // held at the machines it points at
+			}
+			own = append(own, p)
+		}
+		if rewritten != nil {
+			out = append(out, rewrittenObservation(m, *rewritten, parts, f))
+			// The names failing through what another program wrote are that finding's, said in it.
+			kept := own[:0]
+			for _, p := range own {
+				if p.Part != link.PartNames {
+					kept = append(kept, p)
+				}
+			}
+			own = kept
+		}
+		if len(own) > 0 {
+			out = append(out, machineNetworkObservation(m, own, f, from(m)))
+			saysOwn[m] = true
+		}
+	}
+	// Said once, at the machine everybody points at — unless its own network condition already says it
+	// (listed there), or its silence does.
+	targetsSorted := make([]string, 0, len(pointing))
+	for x := range pointing {
+		targetsSorted = append(targetsSorted, x)
+	}
+	sort.Strings(targetsSorted)
+	for _, x := range targetsSorted {
+		if !down(x) || saysOwn[x] || f.silent[x] {
+			continue
+		}
+		out = append(out, unreachableObservation(x, pointing[x], from(x), f))
+	}
+	return out
+}
+
+func allDown(xs []string, down func(string) bool) bool {
+	for _, x := range xs {
+		if !down(x) {
+			return false
+		}
+	}
+	return len(xs) > 0
+}
+
+// rewrittenObservation is the resolver file rewritten by another program: its own finding, naming the
+// writer where the engine could, and what it costs the machine.
+func rewrittenObservation(m string, p inventory.NetworkPart, all []inventory.NetworkPart, f networkFacts) conditions.Observation {
+	writer := ""
+	if p.Writer != "" {
+		writer = " (" + p.Writer + ")"
+	}
+	cost := "the names through it are not yet judged"
+	said := []string{p.Part + ": " + p.Said}
+	for _, q := range all {
+		if q.Part == link.PartNames {
+			cost = strings.TrimSuffix(q.Reason, ".")
+			said = append(said, q.Part+": "+q.Said)
+		}
+	}
+	if cost == "the names through it are not yet judged" {
+		cost = "the names still resolve through what it wrote"
+	}
+	id := m
+	if p.Owner != "" {
+		// Named by the module whose file it is: a send that moved that module is what the gate
+		// holds it on (issue 281's rule — what names a moved module is that module's).
+		id = m + "." + p.Owner
+	}
+	severity := conditions.Warning
+	if m == f.control {
+		severity = conditions.Urgent
+	}
+	summary := fmt.Sprintf("the resolver file on %s was rewritten by another program%s — %s until the "+
+		"node-engine writes it back at its next reconcile, or that program gives it back", m, writer, cost)
+	if p.Owner != "" {
+		summary = fmt.Sprintf("the resolver file %s writes on %s was rewritten by another program%s — %s until "+
+			"the node-engine writes it back at its next reconcile, or that program gives it back", p.Owner, m, writer, cost)
+	}
+	return conditions.Observation{Scope: conditions.ScopeMachine, ID: id, Token: "rewritten", Kind: kindNetworkRewritten,
+		Machine: m, Severity: severity, Source: sourceNetwork, Summary: summary,
+		Said: fmt.Sprintf("since %s: %s", p.Since.UTC().Format("2006-01-02 15:04:05 MST"), strings.Join(said, " | "))}
+}
+
+// machineNetworkObservation is what is wrong with a machine's own networking.
+func machineNetworkObservation(m string, parts []inventory.NetworkPart, f networkFacts, waiting []string) conditions.Observation {
+	var words, said []string
+	severity := conditions.Warning
+	for _, p := range parts {
+		words = append(words, p.Reason)
+		said = append(said, fmt.Sprintf("%s since %s: %s", p.Part, p.Since.UTC().Format("2006-01-02 15:04:05 MST"), p.Said))
+		if p.Part == link.PartBus {
+			severity = conditions.Urgent
+		}
+	}
+	if m == f.control || m == f.hub {
+		severity = conditions.Urgent
+	}
+	summary := fmt.Sprintf("%s's network is not healthy: %s", m, strings.Join(words, "; "))
+	if len(waiting) > 0 {
+		severity = conditions.Urgent
+		summary += fmt.Sprintf("; %s cannot reach it", strings.Join(waiting, ", "))
+	}
+	return conditions.Observation{Scope: conditions.ScopeMachine, ID: m, Token: "network", Kind: kindMachineNetwork,
+		Machine: m, Severity: severity, Source: sourceNetwork, Summary: summary, Said: strings.Join(said, " | ")}
+}
+
+// unreachableObservation is one machine others cannot reach, said once there.
+func unreachableObservation(x string, pts []pointed, from []string, f networkFacts) conditions.Observation {
+	var what []string
+	var said []string
+	for _, pt := range pts {
+		w := map[string]string{link.PartTunnel: "the tunnel to it", link.PartBus: "the bus on it",
+			link.PartNames: "its resolver"}[pt.part.Part]
+		if w == "" {
+			w = pt.part.Part
+		}
+		if !slices.Contains(what, w) {
+			what = append(what, w)
+		}
+		said = append(said, fmt.Sprintf("%s: %s: %s", pt.from, pt.part.Part, pt.part.Said))
+	}
+	severity := conditions.Warning
+	if x == f.hub || x == f.control || slices.Contains(what, "the bus on it") {
+		severity = conditions.Urgent
+	}
+	return conditions.Observation{Scope: conditions.ScopeMachine, ID: x, Token: "unreachable", Kind: kindNetworkUnreachable,
+		Machine: x, Also: from, Severity: severity, Source: sourceNetwork,
+		Summary: fmt.Sprintf("%s cannot be reached from %s: %s", x, strings.Join(from, ", "), strings.Join(what, ", ")),
+		Said:    strings.Join(said, " | ")}
+}
+
+// networkLines is what `node show` says of a machine's networking.
+func networkLines(h inventory.NodeHealth, had bool, now time.Time) []string {
+	if !had || h.Network == nil {
+		return []string{"  its node-engine does not say how its network is — it is older than that judging (ADR 0241)"}
+	}
+	out := []string{fmt.Sprintf("  its network: %s since %s", h.Network.State, h.Network.Since.Local().Format("2006-01-02 15:04"))}
+	for _, p := range h.Network.Parts {
+		line := fmt.Sprintf("    %-10s %s", p.State, p.Part)
+		if p.Reason != "" {
+			line += " — " + p.Reason
+		}
+		if p.Writer != "" {
+			line += " (" + p.Writer + ")"
+		}
+		out = append(out, line)
+	}
+	return out
+}

cmd/mesh-controller/machine_network_test.go

@@ -0,0 +1,306 @@
+package main
+
+import (
+	"encoding/json"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// A machine says how its network is (novox/hq ADR 0241, "how it is checked"): the resolver file rewritten
+// by another program is one finding, naming the writer, with the names it costs said in it; what is the
+// machine's own is `machine.<m>.network`; what points at another machine that is down is said once, there;
+// one machine alone failing toward a healthy one is its own; the control node, the hub and the bus are
+// urgent; an engine that says nothing of its network raises nothing; and the gate waits on what is shown to
+// be another's.
+
+func aNetwork(state string, parts ...inventory.NetworkPart) *inventory.NetworkHealth {
+	for i := range parts {
+		if parts[i].State == "" {
+			parts[i].State = link.StateUnhealthy
+		}
+		parts[i].Since = h0
+	}
+	return &inventory.NetworkHealth{State: state, Since: h0, Parts: parts}
+}
+
+func netFacts(healths map[string]*inventory.NetworkHealth) networkFacts {
+	f := networkFacts{healths: map[string]inventory.NodeHealth{}, hub: "anchor", control: "anchor",
+		byAddress: map[string]string{"10.77.0.1": "anchor", "10.77.0.2": "laptop", "10.77.0.3": "spare"},
+		silent:    map[string]bool{}}
+	for m, n := range healths {
+		f.healths[m] = inventory.NodeHealth{Node: m, Network: n}
+	}
+	return f
+}
+
+var (
+	rewrittenByVPN = inventory.NetworkPart{Part: link.PartResolvConf, Reason: "the resolver file was rewritten by another program",
+		Said: "/etc/resolv.conf lists 172.16.5.5 where 10.77.0.1 is declared", Writer: "FortiClient", Owner: "networkmanager"}
+	namesThroughVPN = inventory.NetworkPart{Part: link.PartNames, Reason: "mesh names do not resolve",
+		Said: "172.16.5.5 — anchor.internal (IPv4): says no such name", Toward: []string{"172.16.5.5"}}
+	tunnelDown = inventory.NetworkPart{Part: link.PartTunnel, Reason: "the tunnel to the hub has not handshaken for over five minutes",
+		Said: "mesh0's newest handshake with the hub was 9m0s ago", Toward: []string{link.TowardHub}}
+	noRoute = inventory.NetworkPart{Part: link.PartRoute, Reason: "the machine has no default route", Said: "no default route"}
+)
+
+func keysOf(obs []conditions.Observation) []string {
+	var keys []string
+	for _, o := range obs {
+		keys = append(keys, o.Key())
+	}
+	return keys
+}
+
+func TestAResolverFileRewrittenIsOneFindingNamingItsWriterAndWhatItCosts(t *testing.T) {
+	obs := networkObservations(netFacts(map[string]*inventory.NetworkHealth{
+		"anchor": aNetwork(link.StateHealthy),
+		"laptop": aNetwork(link.StateUnhealthy, rewrittenByVPN, namesThroughVPN),
+	}))
+	if keys := keysOf(obs); len(keys) != 1 || keys[0] != "machine.laptop.networkmanager.rewritten" {
+		t.Fatalf("want one finding, the rewrite, got %v", keys)
+	}
+	o := obs[0]
+	for _, want := range []string{"laptop", "rewritten by another program (FortiClient)", "mesh names do not resolve",
+		"next reconcile"} {
+		if !strings.Contains(o.Summary, want) {
+			t.Errorf("the summary does not say %q: %s", want, o.Summary)
+		}
+	}
+	if strings.Contains(o.Summary, "172.16.") || strings.Contains(o.Summary, "/etc/") {
+		t.Errorf("an address or a path reached the summary: %s", o.Summary)
+	}
+	if !strings.Contains(o.Said, "172.16.5.5") || o.Severity != conditions.Warning || o.Machine != "laptop" {
+		t.Errorf("the evidence or the severity is wrong: %+v", o)
+	}
+}
+
+func TestOneMachineFailingTowardAHealthyHubIsItsOwn(t *testing.T) {
+	obs := networkObservations(netFacts(map[string]*inventory.NetworkHealth{
+		"anchor": aNetwork(link.StateHealthy),
+		"laptop": aNetwork(link.StateUnhealthy, tunnelDown),
+		"spare":  aNetwork(link.StateHealthy),
+	}))
+	if keys := keysOf(obs); len(keys) != 1 || keys[0] != "machine.laptop.network" {
+		t.Fatalf("want the laptop's own, got %v", keys)
+	}
+	if obs[0].Severity != conditions.Warning {
+		t.Fatalf("a laptop's own tunnel is a warning, got %s", obs[0].Severity)
+	}
+}
+
+func TestTwoMachinesThatCannotReachTheHubAreSaidOnceAtTheHub(t *testing.T) {
+	obs := networkObservations(netFacts(map[string]*inventory.NetworkHealth{
+		"anchor": aNetwork(link.StateHealthy),
+		"laptop": aNetwork(link.StateUnhealthy, tunnelDown),
+		"spare":  aNetwork(link.StateUnhealthy, tunnelDown),
+	}))
+	if keys := keysOf(obs); len(keys) != 1 || keys[0] != "machine.anchor.unreachable" {
+		t.Fatalf("want one condition at the hub, got %v", keys)
+	}
+	o := obs[0]
+	if o.Severity != conditions.Urgent || !strings.Contains(o.Summary, "laptop, spare") || len(o.Also) != 2 {
+		t.Fatalf("the hub's condition is %+v", o)
+	}
+}
+
+func TestWhatPointsAtASilentHubIsHeldUnderItsSilence(t *testing.T) {
+	f := netFacts(map[string]*inventory.NetworkHealth{"laptop": aNetwork(link.StateUnhealthy, tunnelDown)})
+	f.silent["anchor"] = true
+	if obs := networkObservations(f); len(obs) != 0 {
+		t.Fatalf("the hub's silence says it; got %v", keysOf(obs))
+	}
+}
+
+func TestAHubWhoseOwnNetworkIsUnhealthyListsWhoCannotReachIt(t *testing.T) {
+	obs := networkObservations(netFacts(map[string]*inventory.NetworkHealth{
+		"anchor": aNetwork(link.StateUnhealthy, noRoute),
+		"laptop": aNetwork(link.StateUnhealthy, tunnelDown),
+	}))
+	if keys := keysOf(obs); len(keys) != 1 || keys[0] != "machine.anchor.network" {
+		t.Fatalf("want the hub's own, holding the laptop's, got %v", keys)
+	}
+	if o := obs[0]; o.Severity != conditions.Urgent || !strings.Contains(o.Summary, "laptop cannot reach it") {
+		t.Fatalf("the hub's condition is %+v", o)
+	}
+}
+
+func TestOneMachineFailingAHealthyMeshResolverIsItsOwnAndTwoAreTheResolvers(t *testing.T) {
+	silentResolver := inventory.NetworkPart{Part: link.PartNames, Reason: "1 of its 2 resolvers do not answer as the mesh's do",
+		Said: "10.77.0.3 — no answer within 1s", Toward: []string{"10.77.0.3"}}
+	obs := networkObservations(netFacts(map[string]*inventory.NetworkHealth{
+		"anchor": aNetwork(link.StateHealthy), "spare": aNetwork(link.StateHealthy),
+		"laptop": aNetwork(link.StateUnhealthy, silentResolver),
+	}))
+	if keys := keysOf(obs); len(keys) != 1 || keys[0] != "machine.laptop.network" {
+		t.Fatalf("one machine alone: want its own, got %v", keys)
+	}
+	obs = networkObservations(netFacts(map[string]*inventory.NetworkHealth{
+		"anchor": aNetwork(link.StateUnhealthy, silentResolver), "spare": aNetwork(link.StateHealthy),
+		"laptop": aNetwork(link.StateUnhealthy, silentResolver),
+	}))
+	if keys := keysOf(obs); len(keys) != 1 || keys[0] != "machine.spare.unreachable" {
+		t.Fatalf("two machines: want it said once at the resolver's machine, got %v", keys)
+	}
+	if !strings.Contains(obs[0].Summary, "its resolver") {
+		t.Fatalf("the resolver's machine is said %s", obs[0].Summary)
+	}
+}
+
+func TestTheControlNodeAndTheBusAreUrgent(t *testing.T) {
+	f := netFacts(map[string]*inventory.NetworkHealth{"anchor": aNetwork(link.StateUnhealthy, rewrittenByVPN)})
+	if obs := networkObservations(f); len(obs) != 1 || obs[0].Severity != conditions.Urgent {
+		t.Fatalf("the control node's rewritten file: %+v", obs)
+	}
+	bus := inventory.NetworkPart{Part: link.PartBus, Reason: "the bus cannot be reached", Said: "no link"}
+	f = netFacts(map[string]*inventory.NetworkHealth{"laptop": aNetwork(link.StateUnhealthy, bus, noRoute)})
+	if obs := networkObservations(f); len(obs) != 1 || obs[0].Severity != conditions.Urgent {
+		t.Fatalf("the bus unreachable from the laptop: %+v", obs)
+	}
+}
+
+func TestAnEngineThatSaysNothingOfItsNetworkRaisesNothing(t *testing.T) {
+	f := netFacts(map[string]*inventory.NetworkHealth{"laptop": nil, "anchor": aNetwork(link.StateHealthy)})
+	if obs := networkObservations(f); len(obs) != 0 {
+		t.Fatalf("got %v", keysOf(obs))
+	}
+}
+
+// Through the store and the keeper: the statement kept, the rewrite raised from it, cleared when the file
+// is written back, and node show saying it.
+func TestARewrittenResolverFileIsRaisedFromTheStatementAndClearedWhenWrittenBack(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	inv, k := open.inventory, conditionsFrom
+	say := func(at time.Time, n *link.NetworkHealth) {
+		t.Helper()
+		if err := stateHealth(ctx, inv, k, "laptop", link.Health{Contract: link.ReadinessContract, At: at, Network: n}, at); err != nil {
+			t.Fatal(err)
+		}
+	}
+	openKeys := func() []string {
+		t.Helper()
+		list, err := k.Open(ctx)
+		if err != nil {
+			t.Fatal(err)
+		}
+		var keys []string
+		for _, c := range list {
+			keys = append(keys, c.Key)
+		}
+		return keys
+	}
+	healthy := &link.NetworkHealth{State: link.StateHealthy, Since: h0, Parts: []link.NetworkPart{
+		{Part: link.PartResolvConf, State: link.StateHealthy, Since: h0}}}
+	rewritten := &link.NetworkHealth{State: link.StateUnhealthy, Since: h0.Add(time.Minute), Parts: []link.NetworkPart{
+		{Part: link.PartResolvConf, State: link.StateUnhealthy, Reason: rewrittenByVPN.Reason, Said: rewrittenByVPN.Said,
+			Writer: "FortiClient", Owner: "networkmanager", Since: h0.Add(time.Minute)},
+		{Part: link.PartNames, State: link.StateUnhealthy, Reason: namesThroughVPN.Reason, Said: namesThroughVPN.Said,
+			Toward: namesThroughVPN.Toward, Since: h0.Add(time.Minute)}}}
+
+	say(h0, healthy)
+	if keys := openKeys(); len(keys) != 0 {
+		t.Fatalf("a healthy network raised %v", keys)
+	}
+	say(h0.Add(time.Minute), rewritten)
+	if keys := openKeys(); len(keys) != 1 || keys[0] != "machine.laptop.networkmanager.rewritten" {
+		t.Fatalf("the rewrite raised %v", keys)
+	}
+	kept, had, err := inv.HealthOf(ctx, "laptop")
+	if err != nil || !had || kept.Network == nil || kept.Network.Parts[0].Writer != "FortiClient" {
+		t.Fatalf("the statement's network was not kept: %+v %v", kept.Network, err)
+	}
+	if lines := strings.Join(networkLines(kept, had, h0), "\n"); !strings.Contains(lines, "FortiClient") ||
+		!strings.Contains(lines, "unhealthy  resolv-conf") {
+		t.Fatalf("node show says:\n%s", lines)
+	}
+	say(h0.Add(2*time.Minute), healthy)
+	if keys := openKeys(); len(keys) != 0 {
+		t.Fatalf("written back, still open: %v", keys)
+	}
+	// An engine older than the judging says no network: nothing raised, and node show says it is not known.
+	say(h0.Add(3*time.Minute), nil)
+	kept, had, _ = inv.HealthOf(ctx, "laptop")
+	if keys := openKeys(); len(keys) != 0 || kept.Network != nil {
+		t.Fatalf("an older engine: %v %+v", keys, kept.Network)
+	}
+	if lines := strings.Join(networkLines(kept, had, h0), "\n"); !strings.Contains(lines, "older than that judging") {
+		t.Fatalf("node show says:\n%s", lines)
+	}
+}
+
+// The gate: a resolver file another program rewrote waits the judging rather than failing it at the
+// bound; the same, when the send moved the module whose file it is, is that module's; a machine's own
+// network fault holds the machine as a whole, as before.
+func TestTheGateWaitsOnARewriteItDidNotMakeAndHoldsTheOwnerOnOneItMoved(t *testing.T) {
+	since := h0
+	rewrite := conditions.Condition{Key: "machine.laptop.networkmanager.rewritten", Kind: kindNetworkRewritten,
+		Subject: conditions.Subject{Scope: conditions.ScopeMachine, ID: "laptop.networkmanager", Machine: "laptop"},
+		Summary: "the resolver file was rewritten", Raised: since.Add(time.Minute), Source: sourceNetwork}
+	f := gateFacts{judged: true, open: []conditions.Condition{rewrite}}
+	if w := aboutTheMachine("laptop", []string{"letta"}, since, f); w.waiting == "" || w.whole != "" || len(w.on) != 0 {
+		t.Fatalf("a rewrite the send did not make: %+v", w)
+	}
+	if w := aboutTheMachine("laptop", []string{"networkmanager", "letta"}, since, f); w.on["networkmanager"] == "" ||
+		w.on["letta"] != "" || w.waiting != "" {
+		t.Fatalf("a rewrite of the file a moved module owns: %+v", w)
+	}
+	own := conditions.Condition{Key: "machine.laptop.network", Kind: kindMachineNetwork,
+		Subject: conditions.Subject{Scope: conditions.ScopeMachine, ID: "laptop", Machine: "laptop"},
+		Summary: "laptop's network is not healthy", Raised: since.Add(time.Minute), Source: sourceNetwork}
+	if w := aboutTheMachine("laptop", []string{"letta"}, since, gateFacts{judged: true,
+		open: []conditions.Condition{own}}); w.whole == "" || w.waiting != "" {
+		t.Fatalf("the machine's own network: %+v", w)
+	}
+	unreachable := conditions.Condition{Key: "machine.anchor.unreachable", Kind: kindNetworkUnreachable,
+		Subject: conditions.Subject{Scope: conditions.ScopeMachine, ID: "anchor", Machine: "anchor", Also: []string{"laptop", "spare"}},
+		Summary: "anchor cannot be reached", Raised: since.Add(time.Minute), Source: sourceNetwork}
+	if w := aboutTheMachine("laptop", []string{"letta"}, since, gateFacts{judged: true,
+		open: []conditions.Condition{unreachable}}); w.waiting == "" || w.whole != "" {
+		t.Fatalf("a machine that cannot reach the hub: %+v", w)
+	}
+}
+
+// TestTheDrillsStatementsRaiseAndClearTheRewrite replays the drill of ADR 0241 (mesh-host
+// internal/network TestDrill…): what a node-engine said in a throwaway container while its resolver file
+// was declared, rewritten as a VPN client rewrites it, and written back — recorded, with the mesh's names
+// and addresses replaced by this test mesh's. Healthy raises nothing; the rewrite, on its second look, is
+// raised as one finding naming the writer; written back, it clears.
+func TestTheDrillsStatementsRaiseAndClearTheRewrite(t *testing.T) {
+	raw, err := os.ReadFile("testdata/network-drill.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var said []link.Health
+	if err := json.Unmarshal(raw, &said); err != nil {
+		t.Fatal(err)
+	}
+	open := aMesh(t)
+	ctx := t.Context()
+	k := conditionsFrom
+	var raisedAt []int
+	for i, h := range said {
+		if err := stateHealth(ctx, open.inventory, k, "laptop", h, h.At); err != nil {
+			t.Fatal(err)
+		}
+		list, err := k.Open(ctx)
+		if err != nil {
+			t.Fatal(err)
+		}
+		for _, c := range list {
+			if c.Key != "machine.laptop.networkmanager.rewritten" || !strings.Contains(c.Summary, "(FortiClient)") {
+				t.Fatalf("statement %d raised %s: %s", i, c.Key, c.Summary)
+			}
+			raisedAt = append(raisedAt, i)
+		}
+	}
+	// Five statements: healthy, healthy, one failing look (still healthy), unhealthy, written back.
+	if len(raisedAt) != 1 || raisedAt[0] != 3 {
+		t.Fatalf("the rewrite was open after statements %v; want after the fourth alone", raisedAt)
+	}
+}

cmd/mesh-controller/machine_units.go

@@ -0,0 +1,157 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// A failed unit is never silent (novox/hq issue 315).
+//
+// **A module's failed unit was never raised, and neither was the machine's.** Liveness judges what a
+// module runs long-lived; a module whose daemon is a package's unit, started by D-Bus activation, states
+// no service, and its unit failed at every start while the machine read healthy. The profile's
+// `service-manager` said `degraded`, and nothing raised that.
+//
+// The node-engine now reads every failed unit in the managers the mesh places units in, and says whose
+// each is:
+//
+//   - **a module's** — the declaration states it, writes its file, or installs the package its file
+//     belongs to — is among the module's resources, unhealthy, of kind `unit`: the module's own
+//     `module.<module>.<machine>.unhealthy`, naming the unit, raised on the second statement and held by
+//     the gate as any unhealthy resource is (ADR 0240 §4);
+//   - **the machine's** — no module places it: a mount of the machine's own table, a unit a removed
+//     package left behind — is one finding for the machine, `machine.<m>.units`, listing them, so a
+//     degraded service manager is never silent. A warning; cleared on the first statement that lists none.
+//
+// The engine applies the two-look rule itself (ADR 0241 §2), so the machine's finding is raised on the
+// statement that first says it. It is nothing a send did — no module places what it lists — so the gate
+// never holds a send on it. An engine older than this reading says nothing of its units, and nothing is
+// raised or cleared for it.
+
+// The condition a machine's own failed units raise.
+const (
+	kindMachineUnits = "machine-units"
+	sourceUnits      = "units"
+)
+
+// unitsKept is a statement's units as the inventory keeps them.
+func unitsKept(u *link.UnitsHealth) *inventory.UnitsHealth {
+	if u == nil {
+		return nil
+	}
+	out := &inventory.UnitsHealth{State: u.State, Failed: []inventory.FailedUnit{}, Unread: u.Unread}
+	for _, f := range u.Failed {
+		out.Failed = append(out.Failed, inventory.FailedUnit{Unit: f.Unit, Scope: f.Scope, Load: f.Load, Result: f.Result,
+			Resource: f.Resource, Since: f.Since})
+	}
+	return out
+}
+
+// judgeUnits raises the machine's own failed units as one finding, or clears it when the statement lists
+// none. A statement that says nothing of units — an older engine — leaves it as it is.
+func judgeUnits(ctx context.Context, k *conditions.Keeper, node string, u *link.UnitsHealth) error {
+	if k == nil || u == nil {
+		return nil
+	}
+	o, raise := machineUnitsObservation(node, u)
+	if raise {
+		_, err := k.Observe(ctx, o)
+		return err
+	}
+	open, err := k.Open(ctx)
+	if err != nil {
+		return err
+	}
+	for _, c := range open {
+		if c.Kind == kindMachineUnits && c.Key == o.Key() {
+			why := fmt.Sprintf("%s's service managers list no failed unit the mesh does not place", node)
+			if u.State == link.UnitsRunning {
+				why = fmt.Sprintf("%s's service managers are running, no unit failed", node)
+			}
+			_, err := k.Clear(ctx, c.Key, why)
+			return err
+		}
+	}
+	return nil
+}
+
+// machineUnitsObservation is the machine's own failed units in one finding, and whether there are any.
+// The summary names each unit and its manager, which is what a person looks for; how each failed and
+// since when is evidence. Pure.
+func machineUnitsObservation(node string, u *link.UnitsHealth) (conditions.Observation, bool) {
+	o := conditions.Observation{Scope: conditions.ScopeMachine, ID: node, Token: "units", Kind: kindMachineUnits,
+		Machine: node, Severity: conditions.Warning, Source: sourceUnits}
+	if len(u.Failed) == 0 {
+		return o, false
+	}
+	var names, said, plain []string
+	for _, f := range u.Failed {
+		plain = append(plain, unitPlainWords(f.Unit))
+		where := ""
+		if f.Scope == "user" {
+			where = " (the account's own manager)"
+		}
+		names = append(names, f.Unit+where)
+		line := fmt.Sprintf("%s in the %s manager: %s", f.Unit, orSystem(f.Scope), orNotSaid(f.Result))
+		if f.Load != "" && f.Load != "loaded" {
+			line += ", its unit " + f.Load
+		}
+		if f.Resource != "" {
+			line += ", named by the mesh's own " + f.Resource
+		}
+		line += ", since " + f.Since.UTC().Format("2006-01-02 15:04:05 MST")
+		said = append(said, line)
+	}
+	o.Summary = fmt.Sprintf("%s's service manager is degraded: %d failed unit(s) no module places — %s. "+
+		"Each is the machine's own: mend or remove it there, or have a module place it",
+		node, len(u.Failed), strings.Join(names, ", "))
+	o.Said = strings.Join(said, "; ")
+	failed := "1 failed service"
+	if len(u.Failed) > 1 {
+		failed = fmt.Sprintf("%d failed services", len(u.Failed))
+	}
+	o.Headline = fmt.Sprintf("%s on %s", conditions.Capital(failed), node)
+	o.Needs = fmt.Sprintf("mend or remove them on %s, or silence this if they do not matter.", node)
+	o.Explanation = fmt.Sprintf("On %s, %s failed. No module manages them, so the mesh does not repair them.",
+		node, namesWords(plain, 3))
+	o.Actions = []conditions.Action{conditions.SilenceAction(o.Key())}
+	o.Resolved = "No failed services on " + node + " any more"
+	return o, true
+}
+
+func orSystem(scope string) string {
+	if scope == "" {
+		return "system"
+	}
+	return scope
+}
+
+// unitsLines is what `node show` says of a machine's service managers.
+func unitsLines(h inventory.NodeHealth, had bool, _ time.Time) []string {
+	if !had || h.Units == nil {
+		return []string{"  its node-engine does not say which units failed — it is older than that reading (issue 315)"}
+	}
+	out := []string{"  its service managers: " + h.Units.State}
+	for _, f := range h.Units.Failed {
+		line := fmt.Sprintf("    failed     %s (%s) — no module places it", f.Unit, orSystem(f.Scope))
+		if f.Result != "" {
+			line += ", " + f.Result
+		}
+		out = append(out, line)
+	}
+	for _, r := range h.Resources {
+		if r.Kind == link.KindUnit {
+			out = append(out, fmt.Sprintf("    failed     %s — %s's, %s", r.Target, r.Module, r.Reason))
+		}
+	}
+	for _, w := range h.Units.Unread {
+		out = append(out, "    unread     "+w)
+	}
+	return out
+}

cmd/mesh-controller/machine_units_test.go

@@ -0,0 +1,128 @@
+package main
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// A failed unit is never silent (novox/hq issue 315, "how it is checked"): a module's failed unit raises
+// the module's condition on the second statement, naming the unit; the machine's own failed units raise
+// one finding for the machine, listing them, cleared when none is listed; an engine that says nothing of
+// its units raises and clears nothing; and the gate never holds a send on the machine's own.
+
+// desktop is the workstation as found on 2026-10-08, with the mesh's names: the Razer daemon's packaged
+// user unit, the module's; two mounts of the machine's own table and a unit a removed package left
+// behind, the machine's.
+func desktop(at time.Time) link.Health {
+	return link.Health{Contract: link.ReadinessContract, At: at,
+		Resources: []link.ResourceHealth{{Module: "openrazer", Resource: "openrazer.daemon", Kind: link.KindUnit,
+			Target: "openrazer-daemon.service", State: link.StateUnhealthy,
+			Reason: "failed in the account's own service manager (exit-code)", Since: h0, Streak: 2}},
+		Units: &link.UnitsHealth{State: link.UnitsDegraded, Failed: []link.FailedUnit{
+			{Unit: "mnt-recalbox.mount", Scope: "system", Load: "loaded", Result: "exit-code", Since: h0},
+			{Unit: "storage-media.mount", Scope: "system", Load: "loaded", Result: "timeout", Since: h0},
+			{Unit: "greenclip.service", Scope: "user", Load: "not-found", Result: "start-limit-hit", Since: h0},
+		}}}
+}
+
+func TestAFailedUnitIsTheModulesConditionAndTheMachinesOwnAreOneFinding(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	inv, k := open.inventory, conditionsFrom
+	openConditions := func() map[string]conditions.Condition {
+		t.Helper()
+		list, err := k.Open(ctx)
+		if err != nil {
+			t.Fatal(err)
+		}
+		out := map[string]conditions.Condition{}
+		for _, c := range list {
+			out[c.Key] = c
+		}
+		return out
+	}
+	say := func(at time.Time, h link.Health) {
+		t.Helper()
+		if err := stateHealth(ctx, inv, k, "laptop", h, at); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	say(h0, desktop(h0))
+	got := openConditions()
+	machine, raised := got["machine.laptop.units"]
+	if !raised || len(got) != 1 {
+		t.Fatalf("the machine's own failed units are one finding at once (the engine looked twice): %v", got)
+	}
+	for _, unit := range []string{"mnt-recalbox.mount", "storage-media.mount", "greenclip.service"} {
+		if !strings.Contains(machine.Summary, unit) {
+			t.Errorf("the finding names %s: %s", unit, machine.Summary)
+		}
+	}
+	if strings.Contains(machine.Summary, "openrazer") || machine.Severity != conditions.Warning {
+		t.Errorf("the module's unit is the module's, and the machine's a warning: %+v", machine)
+	}
+
+	say(h0.Add(time.Minute), desktop(h0.Add(time.Minute)))
+	got = openConditions()
+	module, raised := got["module.openrazer.laptop.unhealthy"]
+	if !raised || !strings.Contains(module.Summary, "openrazer-daemon.service") ||
+		!strings.Contains(module.Summary, "account's own service manager") {
+		t.Fatalf("the module's failed unit raises its condition on the second statement, naming the unit: %+v", got)
+	}
+
+	kept, had, err := inv.HealthOf(ctx, "laptop")
+	if err != nil || !had || kept.Units == nil || len(kept.Units.Failed) != 3 {
+		t.Fatalf("the statement's units were not kept: %+v %v", kept.Units, err)
+	}
+	lines := strings.Join(unitsLines(kept, had, h0), "\n")
+	for _, want := range []string{"degraded", "storage-media.mount (system) — no module places it",
+		"openrazer-daemon.service — openrazer's"} {
+		if !strings.Contains(lines, want) {
+			t.Errorf("node show does not say %q:\n%s", want, lines)
+		}
+	}
+
+	// An older engine says nothing of its units: nothing cleared on its word.
+	older := desktop(h0.Add(2 * time.Minute))
+	older.Units = nil
+	say(h0.Add(2*time.Minute), older)
+	if _, still := openConditions()["machine.laptop.units"]; !still {
+		t.Fatal("a statement saying nothing of units cleared the machine's finding")
+	}
+
+	// The operator mends the mounts and removes the leftover link; the module's unit still fails.
+	mended := desktop(h0.Add(3 * time.Minute))
+	mended.Units.Failed = []link.FailedUnit{}
+	say(h0.Add(3*time.Minute), mended)
+	got = openConditions()
+	if _, still := got["machine.laptop.units"]; still {
+		t.Fatalf("no failed unit of the machine's own, still open: %v", got)
+	}
+	if _, still := got["module.openrazer.laptop.unhealthy"]; !still {
+		t.Fatalf("the module's unit still fails, and its condition stands: %v", got)
+	}
+
+	// And the module's unit mended: running, nothing open.
+	well := link.Health{Contract: link.ReadinessContract, At: h0.Add(4 * time.Minute),
+		Units: &link.UnitsHealth{State: link.UnitsRunning, Failed: []link.FailedUnit{}}}
+	say(h0.Add(4*time.Minute), well)
+	if got = openConditions(); len(got) != 0 {
+		t.Fatalf("a running service manager leaves nothing open: %v", got)
+	}
+}
+
+func TestTheGateNeverHoldsASendOnTheMachinesOwnUnits(t *testing.T) {
+	since := h0
+	units := conditions.Condition{Key: "machine.laptop.units", Kind: kindMachineUnits,
+		Subject: conditions.Subject{Scope: conditions.ScopeMachine, ID: "laptop", Machine: "laptop"},
+		Summary: "laptop's service manager is degraded", Raised: since.Add(time.Minute), Source: sourceUnits}
+	if w := aboutTheMachine("laptop", []string{"openrazer"}, since, gateFacts{judged: true,
+		open: []conditions.Condition{units}}); w.whole != "" || w.waiting != "" || len(w.on) != 0 {
+		t.Fatalf("the machine's own failed units held a send: %+v", w)
+	}
+}

cmd/mesh-controller/main.go

@@ -8,12 +8,14 @@ package main
 
 import (
 	"context"
+	"errors"
 	"flag"
 	"fmt"
 	"os"
 	"os/signal"
 	"syscall"
 
+	"github.com/novox/mesh-controller/internal/broker"
 	"github.com/novox/mesh-controller/internal/identity"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/licences"
@@ -52,8 +54,14 @@ func run() error {
 		return fmt.Errorf("no command given")
 	}
 
+	// Every connection this process dials says what it is (novox/hq issue 327).
+	broker.ConnectionName = connectionName(args[0], os.Getenv(verbVar))
+
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
 	defer stop()
+	// Whatever this process holds of the controller's lease is given back as it ends (novox/hq to-be
+	// 45 §6), so the next controller takes it at once rather than after its age.
+	defer theLease.release()
 
 	switch args[0] {
 	case "build":
@@ -70,10 +78,41 @@ func run() error {
 		return rotateCommand(ctx, args[1:])
 	case "ask":
 		return askCommand(ctx, args[1:])
+	case "rehearse":
+		return rehearseCommand(ctx, args[1:])
 	case "builds":
 		return buildsCommand(ctx, args[1:])
+	// The build queue, controlled by hand (novox/hq ADR 0219).
+	case "queue":
+		return queueCommand(ctx, args[1:])
+	case "cancel":
+		return cancelCommand(ctx, args[1:])
+	case "clear":
+		return clearCommand(ctx, args[1:])
+	case "rebuild":
+		return rebuildCommand(ctx, args[1:])
+	case "replay":
+		return replayCommand(ctx, args[1:])
+	case "kill":
+		return killCommand(ctx, args[1:])
+	case "pause", "resume":
+		return pauseCommand(ctx, args[0], args[1:])
+	case "collection":
+		return collectionCommand(ctx, args[1:])
+	// What the records say the registries may keep, asked on demand (novox/hq ADR 0251).
+	case "artifacts":
+		return artifactsCommand(ctx, args[1:])
+	case "collect":
+		return collectCommand(ctx, args[1:])
+	case "images":
+		return imagesCommand(ctx, args[1:])
+	case "mirrors":
+		return mirrorsCommand(ctx, args[1:])
 	case "plans":
 		return plansCommand(ctx, args[1:])
+	case "delivery":
+		// The verbs the delivery's owner asks with (novox/hq ADR 0239).
+		return deliveryCommand(ctx, args[1:])
 	case "pin":
 		return pinCommand(ctx, args[1:], true)
 	case "unpin":
@@ -93,8 +132,20 @@ func run() error {
 		return brokerCommand(ctx, args[1:])
 	case "serve":
 		return serve(ctx)
+	// The facts snapshot a merge check is fed (novox/hq to-be 45 §9).
+	case "facts":
+		return factsCommand(ctx, args[1:])
+	// The merge gate: every machine of the snapshot composed with a change (novox/hq to-be 45 §9).
+	case "merge-gate":
+		return mergeGateCommand(ctx, args[1:])
+	// A pull request's merge check run here exactly as the build seat runs it (novox/hq issue 286).
+	case "check-here":
+		return checkHereCommand(ctx, args[1:])
 	case "upgrade":
 		return upgradeCommand(ctx, args[1:])
+	// The bus as a planned step (novox/hq to-be 45 §8, ADR 0236).
+	case "bus":
+		return busCommand(ctx, args[1:])
 	case "declare":
 		return declare(ctx, args[1:])
 	case "overlay":
@@ -127,6 +178,31 @@ func run() error {
 		return seatCommand(ctx, args[1:])
 	case "status":
 		return statusCommand(ctx, args[1:])
+	// Acts done by hand, and why (novox/hq to-be 45 §7).
+	case "hand-act":
+		return handActCommand(ctx, args[1:])
+	case "hand-acts":
+		return handActCommand(ctx, append([]string{"list"}, args[1:]...))
+	// What the mesh's bounds will be set from (novox/hq to-be 45 Phase 0).
+	case "durations":
+		return durationsCommand(ctx, args[1:])
+	// What is wrong, and the self-check (novox/hq to-be 45 §2, §4).
+	case "conditions":
+		return conditionsCommand(ctx, args[1:])
+	case "doctor":
+		return doctorCommand(ctx, args[1:])
+	// What the healers did, and their brake (novox/hq to-be 45 §7).
+	case "healers":
+		return healersCommand(ctx, args[1:])
+	// A consumer the mesh stopped asking for: retired, waiting for a person, deleted only by one
+	// (novox/hq ADR 0230).
+	case "retire":
+		return retireCommand(ctx, args[1:])
+	case "cleanup":
+		return cleanupCommand(ctx, args[1:])
+	// The data every machine declares, as the self-check last found it (novox/hq ADR 0233).
+	case "data":
+		return dataCommand(ctx, args[1:])
 	case "version":
 		fmt.Println(version)
 		return nil
@@ -142,6 +218,10 @@ func run() error {
 func usage() {
 	fmt.Fprint(os.Stderr, `mesh-controller — the control plane
 
+  On a node the operator types these as 'mesh-cli <command>' (in zsh, 'nox <command>'): asked
+  through the node's engine, and run as the controller's terminal only on the control-node
+  (novox/hq ADR 0272).
+
   migrate                        bring each context's schema up to date
   prepare                        the same, asked the way the mesh asks any module (ADR 0135)
   node add <name> [--adopted]    create a node record; --adopted: the machine is in use
@@ -173,13 +253,24 @@ func usage() {
   upgrade <name> roll-out [--together]   ...send it to the machines running it
   upgrade <name> record          ...record that they are behind, and send nothing
   status [--json]                what is wrong, what is quiet, and what is out of date
+  retire [--json]                every provider waiting for a person to approve a retirement (ADR 0230)
+  retire approve <node> <module> --why <text>   retire what it waits with: access off, data kept
+  retire reject <node> <module> --why <text>    keep them active; a warning stays open
+  cleanup [list] [--json]        every retired consumer per provider: age, size, why
+  cleanup delete <node> <module> <consumer> --why <text>   the provider deletes that one retired consumer
+  cleanup delete --older-than <days> --why <text> [--confirm]   list those older; delete only with --confirm
+  artifacts [--json] [--repository <r>] [--collected]   every artifact the mesh made: kept and why, eligible, collected (ADR 0251)
+  collect [--json] [--most <n>]  what the store's sweep would let go of, now; nothing is done
+  collect --confirm --why <text> [--most <n>]   run the sweep now: hold every kept archive, let go of the eligible
+  images <node> [--json]         every container image the machine's declaration names, now and as last sent
   seats [--json]                 every seat this mesh defines, what it delivers, and who holds it
   seat rename <from> <to>        rename a seat; its former name still resolves (ADR 0122)
   seat <name> --to <node>/<module>   hand a seat to that assignment as one act; never empty in between (ADR 0131)
+  seat <name> --add <node>/<module>  add a holder beside the others, for a replicated seat (ADR 0223)
   board [--listen ADDR]          the same three questions, as a page that holds nothing
   api --issuer URL [--listen A]  assign and unassign over http, for a surface that is not here
-  assign <node> <module>         put a module on a node
-  unassign <node> <module>       take it off
+  assign <node> <module>...      put modules on a node, judged together (ADR 0207)
+  unassign <node> <module>...    take them off
   take <node> <module>           preview a module's cutover on an adopted node: what runs beside
                                  what it declares; --yes <digest> cuts it over as previewed
   converge <node> [--yes <digest>] [--filter nftables]   preview, then make, an adopted node converged
@@ -199,18 +290,42 @@ func usage() {
   build --behind                 build every module the mesh holds older than its source
   build --on <module>            rebuild every module that stands on this module's artifacts, bases first
   builds [<module>]              what has been built lately, and what came of it
+  queue [--json]                 every ask in the build queue: waiting, in flight (where, how long), dead
+  cancel <id>                    drop a waiting or dead ask; recorded failed, cancelled by hand
+  clear [--dead]                 cancel every waiting ask (and the dead ones); never one in flight
+  rebuild <module|build-id>      ask the module's source again, or that build's, under a new id
+  replay <build-id> [--register [--older]]   that build's commit again; a dry run unless --register
+  kill <id>                      end a build where it runs; recorded failed, killed by hand
+  pause [<node>] / resume [<node>]   the build seat's holder there, or every holder, takes nothing new / again
+  plans retry <id>               ask a failed plan's failed builds again, and carry the plan on
+  plans stop|close <id> --why <text>   end a plan by hand; recorded in the hand-act log
+  hand-act record <what> --why <text> --cause <word> [--condition <key>]
+                                 record an act done by hand outside the mesh (to-be 45 §7)
+  hand-acts [--days N] [--json]  what was done by hand lately, why, and which causes repeat
+  conditions [--scope S] [--severity S] [--machine M] [--json]
+                                 what is wrong now: every open condition, urgent first (to-be 45 §2)
+  conditions show <key>          one condition whole, with its evidence
+  conditions silence <key> --for <d> --why <text>   send no message for it a while; a hand act
+  conditions history [--days N] [--key K]   every raising, change and clearing lately
+  doctor [run|probes|signals] [--json]
+                                 the self-check: the last verdict, a run now, the probes, the signals' ages
+  healers [--days N] [--json]    the healers, what they did lately, and their brake (to-be 45 §7)
+  durations [--kind K] [--days N] [--json]
+                                 apply, heartbeat, plan-tier and build durations, per machine or module
+  collection [--json]            kept archives held/unheld by a manifest, and what the sweep may let go
   builder issue <name>           a broker account for a build machine, scoped to build work,
                                  delivered as the builder module's broker secret (module add it first)
   licence add|list|use|key       model access, under the name a person calls it
   licence manager <name> <node>  the node that holds a refreshable licence's refresh token
   licence refresh <name>         mint a new access token and seal it to every holder
-  rotate <provision> [--consumer <n>]  a new credential for every holder, both ends at once
+  rotate <provision> [--consumer <n>] [--module <m>]  a new credential for every holder, both ends at once
   ask <module> <tool> [json]           call one of a module's tools over the broker, and print its answer
   pin <node> <provision> <from-node> <module>
                                  which provider this one gets a provision from: the module, and its node
   unpin <node> <provision>       put that question back
   plan <node> [--files|--json]     what that node would run, and why
-  push [<node>] [--behind]       send a node everything it should be, or only those that need it
+  push [<node>] [--behind] [--why <text>]  send a node everything it should be, or only those
+                                 that need it; --why records it in the hand-act log
   version                        what this binary is
 
 Each context reaches its own store through its own credential (novox/hq ADR 0008), named
@@ -252,26 +367,77 @@ func parseAround(set *flag.FlagSet, args []string) ([]string, error) {
 // registered, the same as the waiting command does. Said either way, so the daemon's log tells what
 // became of a build nobody was watching.
 func (b builds) Built(ctx context.Context, result link.BuildResult) error {
+	// **A merge check builds nothing** (novox/hq to-be 45 §9): its verdict is said, and nothing of it is
+	// recorded or registered.
+	if result.Check != nil || result.Checked != nil {
+		checked(ctx, result)
+		return nil
+	}
+	// **A dry run is looked at, never taken in** (novox/hq issue 240). On 2026-10-04 a dry run of an
+	// unmerged branch was heard here like any build, registered, and its definition reached a machine
+	// before anyone had reviewed it.
+	if result.DryRun {
+		fmt.Printf("%s: a dry run of %s on %s, not taken in\n", result.ID, result.Repository, result.Ref)
+		return nil
+	}
 	manifest, _, err := takeIn(ctx, b.inv, result)
+	// The assignments pending on this build, made or ended (novox/hq issue 325), said in the daemon's log
+	// after what became of the build.
+	if b.open != nil {
+		defer func() {
+			for _, line := range settlePendingOnBuild(ctx, b.open, result, manifest.Module, err) {
+				fmt.Printf("%s: %s\n", result.ID, line)
+			}
+		}()
+	}
+	// When it was asked, so a plan takes as its outcome only a build asked for it or after it
+	// (novox/hq 04-ISSUES/219). Zero when the id does not say.
+	asked, _ := link.BuildAskedAt(result.ID)
+	// And how long it took, asked to heard, which a build's bound will be set from (novox/hq to-be 45
+	// Phase 0). Said if lost; never a reason not to take the build in.
+	recordBuildDuration(ctx, b.inv, result, asked)
 	switch {
 	case err != nil && result.Failed != "":
 		fmt.Printf("%s: %v\n", result.ID, err)
 		if result.Module != "" {
-			planBuilt(ctx, b.open, result.Module, result.Commit, result.Failed)
+			planBuilt(ctx, b.open, result.Module, result.Commit, result.Failed, asked, result.ID)
 		} else {
 			planFailedBuild(ctx, b.open, result)
 		}
 		return nil
+	case errors.Is(err, inventory.ErrSuperseded):
+		// Not a failure: the module is already at what a later request built. A plan that asked
+		// before that later request is answered by it; one that asked after it ignores this.
+		fmt.Printf("%s: %v\n", result.ID, err)
+		planBuilt(ctx, b.open, manifest.Module, result.Commit, "", asked, result.ID)
+		return nil
 	case err != nil:
 		fmt.Printf("%s: heard and recorded, and not registered: %v\n", result.ID, err)
 		if manifest.Module != "" {
-			planBuilt(ctx, b.open, manifest.Module, result.Commit, err.Error())
+			planBuilt(ctx, b.open, manifest.Module, result.Commit, err.Error(), asked, result.ID)
 		}
 		return nil
 	}
 	fmt.Printf("%s: %s %s registered, built on %s from %s\n",
 		result.ID, manifest.Module, manifest.Version, result.On, short(result.Commit))
 	saysWhenThePolicyActs(ctx, b.inv, manifest.Module)
-	planBuilt(ctx, b.open, manifest.Module, result.Commit, "")
+	planBuilt(ctx, b.open, manifest.Module, result.Commit, "", asked, result.ID)
+	// A module registered may be one a machine is now behind: `status` is composed again.
+	statusFrom.nudge()
 	return nil
 }
+
+// verbVar carries the seat verb a command runs for, from the serving controller to the process it starts.
+const verbVar = "MESH_VERB"
+
+// connectionName is what this process's connections say they are in the bus's list (novox/hq issue 327):
+// the serving controller, a verb's own process and which verb, or a command run at a shell and which.
+func connectionName(command, verb string) string {
+	switch {
+	case command == "serve":
+		return "mesh-controller serving"
+	case verb != "":
+		return "mesh-controller verb " + verb
+	}
+	return "mesh-controller command " + command
+}

cmd/mesh-controller/merge_gate_test.go

@@ -0,0 +1,414 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/catalogue"
+	snapshot "github.com/novox/mesh-controller/internal/facts"
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// The merge gate (novox/hq to-be 45 §9): a change judged against every machine of the snapshot, by the
+// incidents it is written from. Each case raises a mesh, takes its snapshot, and judges a pull request's
+// tree against it in throwaway stores of its own.
+
+// catalogueMesh is two machines and a catalogue repository: a resolver and an object store on the
+// anchor, and on the laptop a network manager requiring the resolver, an album requiring the object
+// store, and a login manager. Every module is registered from novox/mesh-catalog, as the mesh's are.
+func catalogueMesh(t *testing.T) (snapshot.Facts, map[string]string) {
+	t.Helper()
+	open := aMesh(t)
+	ctx := t.Context()
+	manifests := map[string]string{
+		"objects": `{"module":"objects","version":"1",
+			"provides":[{"name":"s3-bucket","scope":"mesh","identity":{"max":20,"in":"an S3 access key"}}],
+			"receives":{"s3-bucket":"/var/lib/mesh/objects/mesh.json"}}`,
+		"resolver": `{"module":"resolver","version":"1",
+			"provides":[{"name":"wildcard-resolution","scope":"mesh","identity":false}]}`,
+		"networkmanager": `{"module":"networkmanager","version":"1","requires":["wildcard-resolution"]}`,
+		"album":          `{"module":"album","version":"1","requires":["s3-bucket"]}`,
+		"lemurs": `{"module":"lemurs","version":"1","capabilities":["systemd"],
+			"resources":[{"id":"service","type":"service","unit":"lemurs.service","state":"running","boot":"enabled"}]}`,
+	}
+	for name, raw := range manifests {
+		m, err := catalogue.ParseManifest([]byte(raw))
+		if err != nil {
+			t.Fatalf("%s: %v", name, err)
+		}
+		if err := open.inventory.RegisterModule(ctx, m, inventory.Source{Repository: "novox/mesh-catalog",
+			Path: "modules/" + name, BuiltFrom: "c0ffee"}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	for _, a := range [][2]string{{"anchor", "objects"}, {"anchor", "resolver"}, {"laptop", "networkmanager"},
+		{"laptop", "album"}, {"laptop", "lemurs"}} {
+		if _, err := assign(ctx, open, a[0], a[1]); err != nil {
+			t.Fatalf("assign %s %s: %v", a[0], a[1], err)
+		}
+	}
+	f, err := gatherFacts(ctx, open, "2.11.17")
+	if err != nil {
+		t.Fatal(err)
+	}
+	return f, manifests
+}
+
+// aTree is a checkout of the catalogue repository holding these manifests.
+func aTree(t *testing.T, manifests map[string]string) string {
+	t.Helper()
+	dir := t.TempDir()
+	for name, raw := range manifests {
+		at := filepath.Join(dir, "modules", name)
+		if err := os.MkdirAll(at, 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(filepath.Join(at, "module.json"), []byte(raw), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	return dir
+}
+
+func gateJudged(t *testing.T, f snapshot.Facts, tree string, changed ...string) mergeVerdict {
+	t.Helper()
+	admin := os.Getenv("MESH_TEST_POSTGRES")
+	in := mergeCheckInput{facts: f, admin: admin, changed: changed}
+	if tree != "" {
+		in.repository, in.tree = "novox/mesh-catalog", tree
+	}
+	v, err := judgeChange(t.Context(), in)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return v
+}
+
+func withEdit(manifests map[string]string, name, raw string) map[string]string {
+	out := map[string]string{}
+	for k, v := range manifests {
+		out[k] = v
+	}
+	if raw == "" {
+		delete(out, name)
+	} else {
+		out[name] = raw
+	}
+	return out
+}
+
+// The mesh as it is passes: every machine composes in the gate's store as the controller composed it.
+func TestTheMeshAsItIsPassesTheGate(t *testing.T) {
+	f, manifests := catalogueMesh(t)
+	for _, m := range f.Machines {
+		if !m.Declaration.Composes {
+			t.Fatalf("the mesh itself does not compose: %+v", m.Declaration)
+		}
+	}
+	v := gateJudged(t, f, aTree(t, manifests))
+	if v.Verdict != "pass" {
+		t.Fatalf("an unchanged catalogue does not pass:\n%s", v.Report())
+	}
+	for _, m := range v.Machines {
+		if !m.Base.Composes || !m.Change.Composes {
+			t.Errorf("%s does not compose in the gate's store as it does on the mesh: %+v / %+v", m.Described, m.Base, m.Change)
+		}
+	}
+}
+
+// **Issue 263**: a change makes the network manager require the object store's provision; on a machine
+// whose name is six characters its identity is 26 against a bound of 20. Refused in the pull request,
+// naming the module, and not on the anchor after it merged.
+func TestIssue263AnIdentityARealMachineNameOverflowsFailsThePullRequest(t *testing.T) {
+	f, manifests := catalogueMesh(t)
+	tree := aTree(t, withEdit(manifests, "networkmanager",
+		`{"module":"networkmanager","version":"1","requires":["wildcard-resolution","s3-bucket"]}`))
+	v := gateJudged(t, f, tree)
+	if v.Verdict != "fail" {
+		t.Fatalf("the overflow passed the gate:\n%s", v.Report())
+	}
+	report := v.Report()
+	if !strings.Contains(report, "networkmanager") || !strings.Contains(report, "s3-bucket") {
+		t.Errorf("the refusal does not name the module and the provision:\n%s", report)
+	}
+}
+
+// **Issue 236**: a login manager's service that omits its state passed the catalogue check and was
+// refused whole by the node-engine on the first machine. A change to a module a machine runs, and a
+// module nobody runs yet, are both refused before merge, naming the machine and the module.
+func TestIssue236AManifestTheNodeEngineRefusesFailsThePullRequest(t *testing.T) {
+	f, manifests := catalogueMesh(t)
+	broken := `{"module":"lemurs","version":"1","capabilities":["systemd"],
+		"resources":[{"id":"service","type":"service","unit":"lemurs.service","boot":"enabled"}]}`
+	v := gateJudged(t, f, aTree(t, withEdit(manifests, "lemurs", broken)))
+	if v.Verdict != "fail" || !strings.Contains(v.Report(), "lemurs") {
+		t.Fatalf("a service the node-engine refuses passed the gate:\n%s", v.Report())
+	}
+	laptop := snapshot.Pseudonym("machine", "laptop")
+	if !strings.Contains(v.Report(), laptop) {
+		t.Errorf("the refusal does not name the machine it would be refused on:\n%s", v.Report())
+	}
+
+	// And as a new module, which no machine runs: tried on one that could.
+	newcomer := strings.ReplaceAll(broken, `"lemurs"`, `"greeter"`)
+	newcomer = strings.ReplaceAll(newcomer, "lemurs.service", "greeter.service")
+	v = gateJudged(t, f, aTree(t, withEdit(manifests, "greeter", newcomer)))
+	if v.Verdict != "fail" || !strings.Contains(v.Report(), "greeter, assigned to") {
+		t.Fatalf("a new module the node-engine would refuse passed the gate:\n%s", v.Report())
+	}
+}
+
+// **Version skew**: a manifest the controller judging it cannot read — the one the mesh runs, for a
+// catalogue change — fails here, not at registration after the merge.
+func TestAManifestTheRunningControllerCannotReadFailsThePullRequest(t *testing.T) {
+	f, manifests := catalogueMesh(t)
+	v := gateJudged(t, f, aTree(t, withEdit(manifests, "album",
+		`{"module":"album","version":"1","requires":["s3-bucket"],"a-field-of-a-newer-controller":true}`)))
+	if v.Verdict != "fail" || !strings.Contains(v.Report(), "refuses it") {
+		t.Fatalf("a manifest this controller cannot read passed:\n%s", v.Report())
+	}
+}
+
+// A module a machine runs, removed from its source, fails until it is unassigned (ADR 0236).
+func TestAModuleAMachineRunsRemovedFromItsSourceFails(t *testing.T) {
+	f, manifests := catalogueMesh(t)
+	v := gateJudged(t, f, aTree(t, withEdit(manifests, "album", "")))
+	if v.Verdict != "fail" || !strings.Contains(v.Report(), "album is removed") {
+		t.Fatalf("removing a module a machine runs passed:\n%s", v.Report())
+	}
+}
+
+// **Issues 278 and 280**: a file in no held module's directory read as shared code, and a merge rebuilt the
+// catalogue. A file is a module's only by being inside it — no build reads one outside — so it rebuilds
+// nothing, and the gate says why; a merge that does rebuild widely is warned of.
+func TestIssue278AWideRebuildIsSaidBeforeTheMerge(t *testing.T) {
+	f, manifests := catalogueMesh(t)
+	was := wideRebuild
+	wideRebuild = 2
+	t.Cleanup(func() { wideRebuild = was })
+	for _, file := range []string{"modules/showcase/index.ts", "merge-check.sh", "README.md"} {
+		v := gateJudged(t, f, aTree(t, manifests), file)
+		if v.Width == nil || len(v.Width.Modules) != 0 || len(v.Width.Unread) != 1 || v.Verdict != "pass" {
+			t.Fatalf("%s, read by no build, reads %+v, %s", file, v.Width, v.Verdict)
+		}
+		if !strings.Contains(v.Report(), "read by no module's build") {
+			t.Errorf("why %s rebuilds nothing is not said:\n%s", file, v.Report())
+		}
+	}
+	v := gateJudged(t, f, aTree(t, manifests), "modules/album/x.ts", "modules/objects/x.go", "modules/resolver/x.go")
+	if v.Width == nil || len(v.Width.Modules) < 3 || v.Verdict != "warning" {
+		t.Fatalf("a rebuild wider than the bound is not warned of: %+v, %s", v.Width, v.Verdict)
+	}
+	// With the reference module's definition in the tree, its directory is a module, held or not.
+	withShowcase := withEdit(manifests, "showcase", `{"module":"showcase","version":"1"}`)
+	v = gateJudged(t, f, aTree(t, withShowcase), "modules/showcase/index.ts")
+	if v.Width == nil || len(v.Width.Modules) != 0 || len(v.Width.Unread) != 0 {
+		t.Fatalf("a file of a module nobody holds reads %+v", v.Width)
+	}
+	v = gateJudged(t, f, aTree(t, manifests), "modules/album/module.json")
+	if v.Width == nil || strings.Join(v.Width.Modules, ",") != "album" || v.Verdict != "pass" {
+		t.Fatalf("a change to one module's directory reads %+v, %s", v.Width, v.Verdict)
+	}
+}
+
+// **A delivery group is judged as one future state** (novox/hq ADR 0239): a catalogue change that needs a
+// provision only another repository's change adds fails alone and passes composed with it; and a group
+// whose other head breaks what the first needs fails, naming it.
+func TestADeliveryGroupsHeadsAreComposedTogether(t *testing.T) {
+	f, manifests := catalogueMeshWithAnApp(t)
+	needsTheApp := withEdit(manifests, "album", `{"module":"album","version":"1","requires":["s3-bucket","app-api"]}`)
+	catTree := aTree(t, needsTheApp)
+	alone := gateJudged(t, f, catTree, "modules/album/module.json")
+	if alone.Verdict != "fail" {
+		t.Fatalf("a requirement nothing provides passed alone:\n%s", alone.Report())
+	}
+	app := t.TempDir()
+	if err := os.WriteFile(filepath.Join(app, "module.json"), []byte(`{"module":"app","version":"1",
+		"provides":[{"name":"app-api","scope":"mesh","identity":false}]}`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	in := mergeCheckInput{facts: f, admin: os.Getenv("MESH_TEST_POSTGRES"), repository: "novox/mesh-catalog",
+		tree: catTree, changed: []string{"modules/album/module.json"},
+		group: []groupChange{{Repository: "novox/app", Tree: app, Changed: []string{"module.json"}}}}
+	together, err := judgeChange(t.Context(), in)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if together.Verdict == "fail" {
+		t.Fatalf("the group composed together fails:\n%s", together.Report())
+	}
+	if together.Modules["app"] != "changed" || together.Modules["album"] != "changed" {
+		t.Fatalf("the group's heads were not both laid over the mesh: %v", together.Modules)
+	}
+}
+
+// catalogueMeshWithAnApp is catalogueMesh with an application built from a repository of its own, at its
+// root, on the anchor.
+func catalogueMeshWithAnApp(t *testing.T) (snapshot.Facts, map[string]string) {
+	t.Helper()
+	open := aMesh(t)
+	ctx := t.Context()
+	manifests := map[string]string{
+		"objects": `{"module":"objects","version":"1",
+			"provides":[{"name":"s3-bucket","scope":"mesh","identity":{"max":20,"in":"an S3 access key"}}],
+			"receives":{"s3-bucket":"/var/lib/mesh/objects/mesh.json"}}`,
+		"album": `{"module":"album","version":"1","requires":["s3-bucket"]}`,
+	}
+	for name, raw := range manifests {
+		m, err := catalogue.ParseManifest([]byte(raw))
+		if err != nil {
+			t.Fatalf("%s: %v", name, err)
+		}
+		if err := open.inventory.RegisterModule(ctx, m, inventory.Source{Repository: "novox/mesh-catalog",
+			Path: "modules/" + name, BuiltFrom: "c0ffee"}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := open.inventory.RegisterModule(ctx, catalogue.Manifest{Module: "app", Version: "1"},
+		inventory.Source{Repository: "novox/app", BuiltFrom: "c0ffee"}); err != nil {
+		t.Fatal(err)
+	}
+	for _, a := range [][2]string{{"anchor", "objects"}, {"anchor", "app"}, {"laptop", "album"}} {
+		if _, err := assign(ctx, open, a[0], a[1]); err != nil {
+			t.Fatalf("assign %s %s: %v", a[0], a[1], err)
+		}
+	}
+	f, err := gatherFacts(ctx, open, "2.11.17")
+	if err != nil {
+		t.Fatal(err)
+	}
+	return f, manifests
+}
+
+// busMesh is aMesh with a module on the bus on the laptop, its account issued as `module issue` issues
+// one: minted, and its credential held as the module's own secret named broker.
+func busMesh(t *testing.T) snapshot.Facts {
+	t.Helper()
+	open := aMesh(t)
+	ctx := t.Context()
+	m, err := catalogue.ParseManifest([]byte(`{"module":"speaker","version":"1",
+		"own-secrets":{"broker":"/var/lib/speaker/broker"}}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := open.inventory.RegisterModule(ctx, m, inventory.Source{Repository: "novox/mesh-catalog",
+		Path: "modules/speaker", BuiltFrom: "c0ffee"}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := assign(ctx, open, "laptop", "speaker"); err != nil {
+		t.Fatal(err)
+	}
+	user := broker.Principal{Kind: broker.KindModule, Node: "laptop", Module: "speaker"}.Username()
+	password, err := open.inventory.MintBusPassword(ctx, inventory.BusUser{Username: user, Kind: inventory.BusModule,
+		Node: "laptop", Module: "speaker"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := open.inventory.AcceptSecretForModule(ctx, "laptop", "speaker", "broker",
+		`{"user":"`+user+`","password":"`+password+`"}`); err != nil {
+		t.Fatal(err)
+	}
+	f, err := gatherFacts(ctx, open, "2.11.17")
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, mc := range f.Machines {
+		if !mc.Declaration.Composes {
+			t.Fatalf("the mesh itself does not compose: %+v", mc.Declaration)
+		}
+	}
+	return f
+}
+
+// **Issue 285**: every machine running a module on the bus failed to compose in the gate's store, with
+// the change and without — the store held the module's credential and no account for it, which
+// composition refuses (issue 203) — and the gate passed every change, "0 of 4 compose". The account the
+// mesh issued is raised with its credential, so the machine composes in the gate as on the mesh.
+func TestIssue285AModuleOnTheBusComposesInTheGate(t *testing.T) {
+	f := busMesh(t)
+	v := gateJudged(t, f, "")
+	if v.Verdict != "pass" {
+		t.Fatalf("the mesh as it is does not pass:\n%s", v.Report())
+	}
+	for _, m := range v.Machines {
+		if !m.Base.Composes {
+			t.Errorf("%s composes on the mesh and not in the gate: %v", m.Described, m.Base.Problems)
+		}
+	}
+	if !strings.Contains(v.Summary, "2 of 2 compose") {
+		t.Errorf("the summary does not say every machine composes: %s", v.Summary)
+	}
+}
+
+// **Issue 285**: a machine the mesh composes that the gate cannot raise as it is leaves the change judged
+// against a machine that is not the mesh's — broken against broken, which passes whatever the change does.
+// That is an error, never a pass.
+func TestIssue285AMachineTheGateCannotRaiseIsAnErrorNeverAPass(t *testing.T) {
+	f := busMesh(t)
+	for i := range f.Machines {
+		// A fact the snapshot does not carry: the module's credential, gone from the laptop's.
+		var kept []snapshot.Accepted
+		for _, a := range f.Machines[i].Accepted {
+			if a.Name != "broker" {
+				kept = append(kept, a)
+			}
+		}
+		f.Machines[i].Accepted = kept
+	}
+	v := gateJudged(t, f, "")
+	if v.Verdict != "error" {
+		t.Fatalf("a gate whose mesh does not compose said %s:\n%s", v.Verdict, v.Report())
+	}
+	if len(v.Errors) != 1 || !strings.Contains(v.Errors[0], "speaker") {
+		t.Errorf("the error does not name what could not be raised: %v", v.Errors)
+	}
+}
+
+// A path the snapshot withheld is given a path of its own where an access or a place needs one: a bare
+// "withheld" is no absolute path, and a machine whose setting composes on the mesh would not in the gate.
+func TestAWithheldPathIsStoodInForByAPath(t *testing.T) {
+	got := standInPaths(map[string]any{
+		"accesses": map[string]any{"races": "withheld", "films": "/media/films", "shows": "/withheld"},
+		"places":   map[string]any{"config": map[string]any{"path": "withheld", "owner": "1000:1000"}},
+		"puid":     1000,
+	})
+	accesses := got["accesses"].(map[string]any)
+	if accesses["races"] == accesses["shows"] || !strings.HasPrefix(accesses["races"].(string), "/") ||
+		!strings.HasPrefix(accesses["shows"].(string), "/") || accesses["films"] != "/media/films" {
+		t.Errorf("accesses: %v", accesses)
+	}
+	place := got["places"].(map[string]any)["config"].(map[string]any)
+	if !strings.HasPrefix(place["path"].(string), "/") || place["owner"] != "1000:1000" || got["puid"] != 1000 {
+		t.Errorf("places: %v", got)
+	}
+}
+
+// **Issue 286**: a check run by hand clones beside a change what the seat clones — one rule, read by the
+// controller's ask and by the facts — and finds the repository it checks from its origin.
+func TestACheckByHandClonesWhatTheSeatClones(t *testing.T) {
+	for dir, refs := range map[string]map[string]string{
+		"mesh-catalog":    {"mesh-catalog": "main"},
+		"mesh-host":       {"mesh-host": "c0ffee"},
+		"mesh-controller": {"mesh-controller": "c0ffee", "mesh-controller-main": "main", "mesh-lab": "main"},
+	} {
+		got := besideRefs(dir, "c0ffee")
+		for d, ref := range refs {
+			if got[d] != ref {
+				t.Errorf("beside %s, %s is cloned at %q, not %q", dir, d, got[d], ref)
+			}
+		}
+	}
+	for owner, want := range map[string][3]string{
+		"ssh://git@git.example:222/novox/mesh-host.git": {"novox", "mesh-host", "ssh://git@git.example:222/novox"},
+		"git@git.example:novox/mesh-tools.git":          {"novox", "mesh-tools", "git@git.example:novox"},
+		"http://git.example/novox/hq":                   {"novox", "hq", "http://git.example/novox"},
+	} {
+		o, r, p := ownerRepoOf(owner)
+		if [3]string{o, r, p} != want {
+			t.Errorf("%s reads as %s %s %s", owner, o, r, p)
+		}
+	}
+}

cmd/mesh-controller/mesh_for_test.go

@@ -1,11 +1,14 @@
 package main
 
 import (
+	"context"
+
 	"crypto/ecdh"
 	"crypto/rand"
 	"encoding/base64"
 	"encoding/json"
 	"fmt"
+	"github.com/novox/mesh-controller/internal/conditions"
 	"testing"
 
 	"github.com/novox/mesh-controller/internal/catalogue"
@@ -37,6 +40,9 @@ func aMesh(t *testing.T) *stores {
 		t.Fatal(err)
 	}
 	t.Cleanup(open.Close)
+	// A condition store of its own, held in memory (novox/hq to-be 45 §2): status leads with what is
+	// open, and a mesh with no bus would otherwise read as one whose conditions cannot be read.
+	withConditionsInMemory(t)
 	for _, m := range provided {
 		if err := open.inventory.Provide(t.Context(), m); err != nil {
 			t.Fatal(err)
@@ -106,3 +112,17 @@ func rivals() (catalogue.Manifest, catalogue.Manifest) {
 	return catalogue.Manifest{Module: "rival-one", Version: "1", Claims: claim},
 		catalogue.Manifest{Module: "rival-two", Version: "1", Claims: claim}
 }
+
+// withConditionsInMemory gives the test a condition store in memory, as the serving controller's.
+func withConditionsInMemory(t *testing.T) (*conditions.Keeper, *conditions.InMemory) {
+	t.Helper()
+	store := conditions.NewInMemory()
+	k := conditions.NewKeeper(t.Context(), conditions.Options{Store: store, History: store})
+	before := conditionsFrom
+	conditionsFrom = k
+	t.Cleanup(func() {
+		conditionsFrom = before
+		k.Close(context.Background())
+	})
+	return k, store
+}

cmd/mesh-controller/meshcli.go

@@ -0,0 +1,261 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"os/exec"
+	"slices"
+	"strings"
+
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// The operator's command, `mesh-cli` (alias `nox`), answered here (novox/hq ADR 0272).
+//
+// mesh-cli asks the node-engine on its own machine; the engine reads the asking account from the kernel and asks
+// this controller on its own node's subject. Here it is judged — the controller's terminal, an ordinary call, or
+// nothing — and run as every verb's line is: a fresh process of this binary, with this process's environment.
+//
+// **The terminal** is a line from a node's operator account, on the control-node (§4). Phase 2 adds a node whose
+// agents run under an account of their own, judged unable to become root (ADR 0266, not built yet); until then no
+// other node is the terminal, because agents there run as its operator. **An ordinary call** is a line from that
+// account elsewhere: it meets every refusal of the generic `command` verb and runs with `MESH_VERB=mesh-cli`, so a
+// terminal-only change is refused with its reason. **Any other account is refused**, root included: those two
+// accounts already reach the mesh's verbs through the mesh MCP server, and no other account gains anything here.
+
+// cliVerb is what a line from mesh-cli that is not the terminal runs as: the verb its process names, so every
+// terminal-only refusal applies and says it came through mesh-cli.
+const cliVerb = "mesh-cli"
+
+// cliServers are commands that serve until stopped. Run for mesh-cli they would hold a second server under this
+// one until the call's bound killed it.
+var cliServers = map[string]bool{"serve": true, "api": true, "board": true}
+
+// cliVerdict is how a line is run, or why it is not.
+type cliVerdict struct {
+	terminal bool
+	// why says why the line is or is not the terminal, in words the operator reads under the answer.
+	why string
+	// refused says why nothing runs.
+	refused string
+}
+
+// judgeCLI decides how a line from mesh-cli runs (ADR 0272 §4). nodes is every node the mesh knows; control is
+// every node the controller's module is assigned to, which is exactly one in a mesh that is well.
+func judgeCLI(node string, asked link.CLIAsked, nodes []inventory.Node, control []string) cliVerdict {
+	var record *inventory.Node
+	for i := range nodes {
+		if nodes[i].Name == node {
+			record = &nodes[i]
+			break
+		}
+	}
+	switch {
+	case record == nil:
+		return cliVerdict{refused: fmt.Sprintf("%s is not a node this mesh knows, so nothing ran", node)}
+	case asked.UID == 0 || asked.Account == "root":
+		return cliVerdict{refused: "mesh-cli answers the operator's own account, never root: run it as yourself, " +
+			"not under sudo. Nothing ran"}
+	case record.Account == "":
+		return cliVerdict{refused: fmt.Sprintf("the mesh does not know %s's operator account (`node account <node> <login>`), "+
+			"so no account there is answered. Nothing ran", node)}
+	case asked.Account != record.Account:
+		return cliVerdict{refused: fmt.Sprintf("mesh-cli answers %s's operator account (%s) only, and this line came "+
+			"from %s. Nothing ran", node, record.Account, asked.Account)}
+	}
+	if len(control) != 1 {
+		return cliVerdict{why: fmt.Sprintf("not the controller's terminal: the mesh names %d control-nodes, and the "+
+			"terminal is the one control-node's operator account", len(control))}
+	}
+	if control[0] == node {
+		// **A person at a terminal, not a service of the operator's** (review of ADR 0272): the tool runner and the
+		// account's user units run as the operator too, and only a login session is the terminal.
+		if asked.Session == "" {
+			return cliVerdict{why: fmt.Sprintf("not the controller's terminal: %s on %s asked from no login session — a "+
+				"service or a user unit running as the operator, not a person at a terminal", asked.Account, node)}
+		}
+		return cliVerdict{terminal: true, why: fmt.Sprintf("the controller's terminal: %s on the control-node %s, "+
+			"login session %s", asked.Account, node, asked.Session)}
+	}
+	return cliVerdict{why: fmt.Sprintf("not the controller's terminal: agents on %s may run as %s, so a "+
+		"terminal-only change is made from the control-node %s (novox/hq ADR 0272)", node, asked.Account, control[0])}
+}
+
+// controlNodes is every node the controller's module is assigned to.
+func controlNodes(ctx context.Context, inv *inventory.Inventory, nodes []inventory.Node) ([]string, error) {
+	var out []string
+	for _, n := range nodes {
+		modules, err := inv.Assigned(ctx, n.Name)
+		if err != nil {
+			return nil, err
+		}
+		if slices.Contains(modules, controllerModule) {
+			out = append(out, n.Name)
+		}
+	}
+	return out, nil
+}
+
+// controllerModule is the module that runs the controller, and so marks the control-node.
+const controllerModule = "mesh-controller"
+
+// answerMeshCLI is the serving controller's answer to mesh-cli.
+func answerMeshCLI(inv *inventory.Inventory) link.CLIHandler {
+	return func(ctx context.Context, node string, asked link.CLIAsked) link.CLIAnswer {
+		if handingOver.Load() {
+			return link.CLIRefusal("this controller is stopping and runs no new command; ask again in a moment. Nothing ran")
+		}
+		nodes, err := inv.Nodes(ctx)
+		if err != nil {
+			return link.CLIRefusal("the mesh's nodes cannot be read, so nothing ran: " + err.Error())
+		}
+		control, err := controlNodes(ctx, inv, nodes)
+		if err != nil {
+			return link.CLIRefusal("which node is the control-node cannot be read, so nothing ran: " + err.Error())
+		}
+		return runForMeshCLI(ctx, node, asked, judgeCLI(node, asked, nodes, control))
+	}
+}
+
+// cliJournal says one line in the controller's journal (its standard output); a variable so a test can read it.
+var cliJournal = func(line string) { fmt.Println(line) }
+
+// runForMeshCLI runs a judged line and answers what it said. Every line is said in the journal first: its call,
+// who asked on which node, its command word only, and how it runs (review of ADR 0272).
+func runForMeshCLI(ctx context.Context, node string, asked link.CLIAsked, v cliVerdict) link.CLIAnswer {
+	how := "as an ordinary call"
+	switch {
+	case v.refused != "":
+		how = "refused: " + v.refused
+	case v.terminal:
+		how = "as the controller's terminal"
+	}
+	call := link.CallIDIn(ctx)
+	if call == "" {
+		call = "(no call)"
+	}
+	cliJournal(fmt.Sprintf("mesh-cli %s: %s on %s asked %q, %s", call, asked.Account, node, asked.Line[0], how))
+	if v.refused != "" {
+		return link.CLIRefusal(v.refused)
+	}
+	if cliServers[asked.Line[0]] {
+		return link.CLIAnswer{Exit: 1, Why: v.why, Refused: fmt.Sprintf("%s serves until stopped, and is not a "+
+			"command line mesh-cli runs. Nothing ran", asked.Line[0])}
+	}
+	verb, line := "", asked.Line
+	if !v.terminal {
+		composed, err := ordinaryLine(asked.Line)
+		if err != nil {
+			return link.CLIAnswer{Exit: 1, Why: v.why, Refused: err.Error()}
+		}
+		verb, line = cliVerb, composed
+	}
+	cmd := selfCommand(ctx, line)
+	cmd.Env = commandEnvironment(fmt.Sprintf("%s through mesh-cli on %s", asked.Account, node), verb, v.terminal)
+	// No standard input: a command that reads one gets nothing, and fails saying so (ADR 0272 §5).
+	cmd.Stdin = nil
+	var stdout, stderr bytes.Buffer
+	cmd.Stdout, cmd.Stderr = &stdout, &stderr
+	err := cmd.Run()
+	answer := link.CLIAnswer{Stdout: stdout.Bytes(), Stderr: stderr.Bytes(), Terminal: v.terminal, Why: v.why}
+	var exit *exec.ExitError
+	switch {
+	case err == nil:
+	case errors.As(err, &exit):
+		answer.Exit = exit.ExitCode()
+		if answer.Exit < 0 {
+			// Killed: by the call's bound, or by this controller stopping.
+			answer.Exit = 1
+			answer.Stderr = append(answer.Stderr, []byte(fmt.Sprintf("\nmesh-cli: the command was stopped (%v)\n",
+				exit))...)
+		}
+	default:
+		answer.Exit = 1
+		answer.Refused = fmt.Sprintf("could not run %s from this controller's own build: %v", strings.Join(asked.Line, " "), err)
+	}
+	return answer
+}
+
+// settingsForms is what an ordinary `settings` line may say: the settings verb's own forms.
+const settingsForms = "settings set <module> <values> [--replace] [--node <node>], settings clear <module> " +
+	"[--node <node>], settings show <module> [--history] [--node <node>], or settings preferences [<module>] " +
+	"[--node <node>]"
+
+// ordinaryLine is the command line an ordinary call runs (ADR 0272 §4): a `settings` line composed exactly as the
+// settings verb composes its own, so its refusals — the terminal-only keys among them — are that verb's (review of
+// ADR 0272); any other line as the generic `command` verb takes it, with its refusals.
+func ordinaryLine(argv []string) ([]string, error) {
+	if len(argv) == 0 || argv[0] != "settings" {
+		// What the generic verb runs, and nothing it would refuse: its reading forms only, and never a command that
+		// is the terminal's alone (novox/hq ADR 0266) — the two checks argvFor makes of the `command` verb's line,
+		// made of the words as given rather than re-split from one string.
+		if err := refusedAsTheGenericCommand(argv); err != nil {
+			return nil, err
+		}
+		if err := terminalOnly(argv); err != nil {
+			return nil, err
+		}
+		return argv, nil
+	}
+	args := map[string]any{}
+	var words []string
+	rest := argv[1:]
+	for i := 0; i < len(rest); i++ {
+		w := rest[i]
+		switch {
+		case w == "--replace" || w == "-replace":
+			args["replace"] = "true"
+		case w == "--history" || w == "-history":
+			args["history"] = "true"
+		case w == "--node" || w == "-node":
+			if i+1 >= len(rest) {
+				return nil, fmt.Errorf("--node names no node; settings takes %s. Nothing ran", settingsForms)
+			}
+			i++
+			args["node"] = rest[i]
+		case strings.HasPrefix(w, "--node=") || strings.HasPrefix(w, "-node="):
+			_, args["node"], _ = strings.Cut(w, "=")
+		case strings.HasPrefix(w, "-"):
+			return nil, fmt.Errorf("settings takes no %s through mesh-cli outside the terminal; it takes %s. "+
+				"Nothing ran", w, settingsForms)
+		default:
+			words = append(words, w)
+		}
+	}
+	wrong := fmt.Errorf("through mesh-cli outside the terminal, settings takes the settings verb's forms: %s. "+
+		"Nothing ran", settingsForms)
+	if len(words) == 0 {
+		return nil, wrong
+	}
+	switch words[0] {
+	case "set":
+		if len(words) != 3 {
+			return nil, wrong
+		}
+		args["module"], args["values"] = words[1], words[2]
+	case "clear":
+		if len(words) != 2 {
+			return nil, wrong
+		}
+		args["module"], args["clear"] = words[1], "true"
+	case "show":
+		if len(words) != 2 {
+			return nil, wrong
+		}
+		args["module"] = words[1]
+	case "preferences":
+		if len(words) > 2 {
+			return nil, wrong
+		}
+		args["list"] = "preferences"
+		if len(words) == 2 {
+			args["module"] = words[1]
+		}
+	default:
+		return nil, wrong
+	}
+	return argvFor("settings", args)
+}